Docusign phish from Google Gmail Part 3

Posted by Dave Yadallee on








3D"Logo"
src=3D"https://docucdn-a.akamaihd.net/olive/images/2.62.=

0/global-assets/email-templates/email-logo.png" width=3D"116" />






3D""
src=3D"https://docucdn-a.akamaihd.net/olive/images/2.76.=

0/email/iconFileWithCheckWhite.png" width=3D"75" />

A document has been sent for your review



target=3D"_blank">View Document








Please review the attached document at your convenience. Contact the =

sender if you have questions.





This invitation is intended only for the recipient and contains secure =

access information.











Confidential: Do not share this email or link with =

others.





Alternative signing:
class=3D"alt-sign-link" href=3D"https://app.docusign.com/documents" =

target=3D"_blank"> 3D"DocuSign"
src=3D"https://docucdn-a.akamaihd.net/olive/images/2.62.=

0/global-assets/email-templates/email-logo.png" /> Access documents on =

DocuSign and use code:
padding:2px 8px; border-radius:12px; font-weight:bold; =

color:#260559;">{docu-id}




About Docusign: Sign securely and legally in minutes, =

from anywhere.





Need help? Contact the sender or visit our support page=

.






com/en/guides/Declining-to-sign-DocuSign-Signer-Guide" =

target=3D"_blank">Decline to sign |
href=3D"https://support.docusign.com/en/articles/How-do-I-manage-my-email-n=

otifications" target=3D"_blank">Manage notifications




Download the app:
.com/features-and-benefits/mobile" target=3D"_blank"> 3D""
height=3D"18" src=3D"https://docucdn-a.akamaihd.net/olive/images/2.62.=

0/global-assets/email-templates/icon-download-app.png" width=3D"18" />Get =

Docusign





Sent by Ashley Allen via Docusign. To unsubscribe, =

contact the sender.





This message contains =

confidential information. If you are not the intended recipient, please =

delete immediately.











Docusign phish from Google Gmail Part 2

Posted by Dave Yadallee on




=EF=BB=BF


name=3D"viewport" />

Docusign phish from Google Gmail Part 1

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 09 Jul 2026 14:12:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1whv61-00000000Lss-0U65

for dave@doctor.nl2k.ab.ca;

Thu, 09 Jul 2026 14:11:45 -0600

Resent-From: The Doctor

Resent-Date: Thu, 9 Jul 2026 14:11:45 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-oa1-f102.google.com ([209.85.160.102]:53473)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1whsUL-00000000CFE-0oC2

for support@nk.ca;

Thu, 09 Jul 2026 11:24:53 -0600

Received: by mail-oa1-f102.google.com with SMTP id 586e51a60fabf-448b89f700fso1095661fac.2

for ; Thu, 09 Jul 2026 10:23:54 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=sabeng.it; s=google; t=1783617828; x=1784222628; darn=nk.ca;

h=content-type:mime-version:date:content-transfer-encoding:message-id

:subject:to:from:from:to:cc:subject:date:message-id:reply-to

:content-type;

bh=CBCnKi6yFedusYVAYEog8Pbq6nVfckjxBILUJZflDog=;

b=CZlrJaStO4BWs5V0y+HgT4rlO9RG2ao7w6HwSiU/CErCl0q2B8mXsJOn+5C0mnyeYJ

ryxfcvtchzPdbF88NhwdO0dbRRJnmLIoK9Q+4N+mDeid7KD5X57Zq3M4v4n2ryafr8ls

Y/AfHJpALo+1XEwQ6yG+skgMrwKAY+XMMZv1Q=

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20251104; t=1783617828; x=1784222628;

h=content-type:mime-version:date:content-transfer-encoding:message-id

:subject:to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date

:message-id:reply-to:content-type;

bh=CBCnKi6yFedusYVAYEog8Pbq6nVfckjxBILUJZflDog=;

b=MnCaYFolcC9WGpCZuAXF4N9RZPuKKgfD3vRHig8BFZ9nujTQsNP++TMoAe5ZoqOrsQ

sucHAL5btzdoQ9bZymxV787pcXeQ+GG7VxDUfJQ+r9bVjJR6PK+FaR3H+wsgR4qVnuoi

dQJEwLD3tRCDMqZLKA4w5DWBWGs6dy2YcAF3LeDS+uf2cOuNGOuOwzP77E9pSgrUsFQF

4WR4tJEZHfhu/CGehn77bC8RGqTNwjYRikmSbDB464j6S6p4aRqq8Ff5kEFK2NyrFcK0

5phnPttm11Nazog+cRNVVQF1RFrQDbHLJtHJzjK2VyLorAQ3Si13rSPjB4xwT5TP3bJ0

R6+A==

X-Gm-Message-State: AOJu0YyVrvBeAyzmNZANNrkbsOZblL0rqMUf+JbMDhafOOxGGSHtTW3q

EKlTljGCrllxVEARqwXRBGteGP+oKqUmYfDLn2A6S7F+b+hzg4jqTf8JSfXj7qlJh2C1ylj08F3

8w12kIyWqFD4zxtDt0ZuxSCZDMtYrteuWAfW+yBMyzsZitqM=

X-Gm-Gg: AfdE7cmSWaPC4COvimD4+PouFKnk56IKuDYZWFl0G6dqGWslusVMLY9lLL0rd0zrfkE

oWhxwjHZiFdLhDOs2XtHsET46JgzZa8CtJ/70i9YqJew+cHFIpKM/oGpN7q/dd9nR1WMTCPacA/

6dQI1U2wyk+D/meW34OSxAB+ttkiud8HkLUpnaXw78vR9ow17dI9RCtAIvKMPJnT+jb8YuG4ob6

hfHl0vlZLIuYfHihHRWYI5oBJxBVERkOXLNwDxv8q3k8RrtiWJ4/3dZeVHr8mvyokXU3MOdB5CR

InG5dKNwONLV//kwpLIGOQKfqwkS2oSYGqUKQmwMu7budRDAu2EF2GcaG9EnnYfpQ+Oy1bm4pF2

ENxl+ErU3ZSPuUzeq5A==

X-Received: by 2002:a05:6870:231a:b0:440:67b1:b59b with SMTP id 586e51a60fabf-45162e399c1mr5318395fac.0.1783617828058;

Thu, 09 Jul 2026 10:23:48 -0700 (PDT)

Received: from sabprogetti.com ([192.210.236.148])

by smtp-relay.gmail.com with ESMTPS id 586e51a60fabf-451913f8914sm285696fac.8.2026.07.09.10.23.47

for

(version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256);

Thu, 09 Jul 2026 10:23:48 -0700 (PDT)

X-Relaying-Domain: sabeng.it

From: "Incoming_Payment|Schedule| Online Review/OU=EXCHANGE ADMINISTRATIVE

GROUP (FYDIBOHF23SPDLT)/CN=RECIPIENTS/CN=B7A707497B564FD-61941"



To: support@nk.ca

Subject: =?UTF-8?Q?Attached_Financial_and_Swift_Documentati?=

=?UTF-8?Q?on_=EF=BF=BD_07/09/2026_=EF=BF=BD_suppor?=

=?UTF-8?Q?t=40nk=2Eca?=

Message-ID: <67d83905-a343-4b1f-6fa8-c016c48097a5@sabeng.it>

Content-Transfer-Encoding: quoted-printable

Date: Thu, 09 Jul 2026 17:23:46 +0000

MIME-Version: 1.0

Content-Type: text/html; charset=utf-8

X-Spam_score: 6.3

X-Spam_score_int: 63

X-Spam_bar: ++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview:  A document has been sent for your review View Document

Please review the attached document at your convenience. Contact the sender

if you have questions.



Content analysis details: (6.3 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[192.210.236.148 listed in dnsbl.ahbl.org]

[192.210.236.148 listed in dnsbl.ahbl.org]

[192.210.236.148 listed in dnsbl.ahbl.org]

[192.210.236.148 listed in dnsbl.ahbl.org]

[209.85.160.102 listed in dnsbl.ahbl.org]

[209.85.160.102 listed in dnsbl.ahbl.org]

[209.85.160.102 listed in dnsbl.ahbl.org]

[209.85.160.102 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[192.210.236.148 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[192.210.236.148 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[192.210.236.148 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[192.210.236.148 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[192.210.236.148 listed in will-spam-for-food.eu.org]

[192.210.236.148 listed in will-spam-for-food.eu.org]

[192.210.236.148 listed in will-spam-for-food.eu.org]

[192.210.236.148 listed in will-spam-for-food.eu.org]

[192.210.236.148 listed in will-spam-for-food.eu.org]

[192.210.236.148 listed in will-spam-for-food.eu.org]

[192.210.236.148 listed in will-spam-for-food.eu.org]

[192.210.236.148 listed in will-spam-for-food.eu.org]

[209.85.160.102 listed in will-spam-for-food.eu.org]

[209.85.160.102 listed in will-spam-for-food.eu.org]

[209.85.160.102 listed in will-spam-for-food.eu.org]

[209.85.160.102 listed in will-spam-for-food.eu.org]

[209.85.160.102 listed in will-spam-for-food.eu.org]

[209.85.160.102 listed in will-spam-for-food.eu.org]

[209.85.160.102 listed in will-spam-for-food.eu.org]

[209.85.160.102 listed in will-spam-for-food.eu.org]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

1.2 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a relay in bl.spamcop.net

[Blocked - see ]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[209.85.160.102 listed in list.dnswl.org]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[209.85.160.102 listed in bl.score.senderscore.com]

-0.0 RCVD_IN_MSPIKE_H3 RBL: Good reputation (+3)

[209.85.160.102 listed in wl.mailspike.net]

-0.0 SPF_PASS SPF: sender matches SPF record

-0.0 RCVD_IN_MSPIKE_WL Mailspike good senders

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

2.0 RATWR8_MESSID Message-ID with excessive dashes and dollars

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

0.6 HTML_MIME_NO_HTML_TAG HTML-only message, but there is no HTML tag

0.0 NO_RDNS2 Sending MTA has no reverse DNS

Subject: {SPAM?} =?UTF-8?Q?Attached_Financial_and_Swift_Documentati?=

=?UTF-8?Q?on_=EF=BF=BD_07/09/2026_=EF=BF=BD_suppor?=

=?UTF-8?Q?t=40nk=2Eca?=

HR records phish from Google Gmail

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 09 Jul 2026 14:12:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1whv69-00000000LtH-0apO

for dave@doctor.nl2k.ab.ca;

Thu, 09 Jul 2026 14:11:53 -0600

Resent-From: The Doctor

Resent-Date: Thu, 9 Jul 2026 14:11:53 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-lj1-f229.google.com ([209.85.208.229]:42371)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1whsfY-00000000D4Z-2PJL

for doctor@nl2k.ab.ca;

Thu, 09 Jul 2026 11:36:25 -0600

Received: by mail-lj1-f229.google.com with SMTP id 38308e7fff4ca-39c94d4fdb9so570701fa.1

for ; Thu, 09 Jul 2026 10:35:29 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=waves-systems.20251104.gappssmtp.com; s=20251104; t=1783618522; x=1784223322; darn=nl2k.ab.ca;

h=content-type:mime-version:date:content-transfer-encoding:message-id

:subject:to:from:from:to:cc:subject:date:message-id:reply-to

:content-type;

bh=TTaCEMM11Spje0itWq3IMDUmFcem/VGFQIsbz8obGsU=;

b=CHfZMauie2R2qM2G4c20nbG84vbznJoudQoBjOlAgYWc7d/DuDULH4SbvbUmr/6tv8

1LUd3Jclnyr0PqHXB7STKKyNuoZgLBSZHdbDvUyJNgwj+O8TdYrUfC9hcHVe/ks+ktR0

UfAx3vc+6MumlFLgGdJrLlxvH4Uy3zJXh1TAFC6Zw7OskztV4Kje36gafCS3efknQCdH

99cmmZN44YmrdzeNmMLkPfX0Fmkw4RuuXIrbnkk+c1IWxb/v4rZ4z+jAvrSaOmmUc6eB

mRa0gK7SL2tN7RJG7JJIrGC94VueGNkaJkoLcGi/+DhIEw+xmlsLl4W0kVLOdL8E+dSV

jdwA==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20251104; t=1783618522; x=1784223322;

h=content-type:mime-version:date:content-transfer-encoding:message-id

:subject:to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date

:message-id:reply-to:content-type;

bh=TTaCEMM11Spje0itWq3IMDUmFcem/VGFQIsbz8obGsU=;

b=NmZRkOeW5vZlYWWFS1vWjZJWfdZQ4/Ak5NIJVFJXYxojatbiBP/zybRgn/Vt70oiJP

i2jQkG6XewPUjhwHK2FwCvr1rf15VTxUN1JJP2AXvEJLQ1Qe68PZkKPTB7Q5dQQ/dfs+

/yl8OCFE1nQRUK/3AGnKlufp+2jkWuWsxZSb4+ALx8389zFVs5N+oe/O0UlyEbiSbSVu

a0lH6RXr+xnQmKHSz+Y6O1SCz36pssJ1YheEAtRswWcK0DBninHaEtg5OSZTiWsalNx2

hCGQD++zUlr1Qpdi5ieftK96W54bts3aHMjIYuOlAsz1rgzU/9X20qP0MepSlKp3frAv

emIQ==

X-Gm-Message-State: AOJu0Yw92F57dNWXMZBMrL6CyLDktyhEJ+2diCjzoNb5K1CVhiWg1p1H

BhxMGJv3yqy21oIWZwHNJQPPZM/Z+ihyIZNeSmJ9SEzS2HhzysM32BpDtDkEhr2CeofUVEO6YCf

uo2YiY9owIdMtN5r70FmDFZAoC+0TuOzcU65nfIx5vqQASZY=

X-Gm-Gg: AfdE7cnpJ3+HKj/gToqiSHfXJycTUvIuRCFD30olLXi8vVgK4kXcL7ticrmf4mSDQBi

C2cltH6nqQLViZTB+WPz2Z6NHi9fVDdQ7OkNjNkMALWmaxXrT30RXvgr1bVuYZQGYqKmQBsOvz3

gm9HhvpcUCC44IJltOSshaJlvdab6+a7yrqDEzAcFMDv8fvDIixLXAxGl7NAoVDXO+8A/eGBp6P

BEG/yzcZl3HN8vySg/V2KmKCx/uuOS8pdKPPDVRE+sAxWlxJYpbWL/zezUu7RYmK+3451h9tP/Z

1YEM3WUGQ9iMQgySOvFRSluBX/PHtGs2+Ad2JKVfcWMoqZ/4fEbU7+IOs7PQFJBIjd+2Viu4txF

ap9eiN2/HroTcSJBDGHrcpOYlY4n3jSoyHTxr

X-Received: by 2002:a2e:bb8e:0:b0:393:aa48:8243 with SMTP id 38308e7fff4ca-39c94ca66ffmr265461fa.18.1783618521935;

Thu, 09 Jul 2026 10:35:21 -0700 (PDT)

Received: from waves.systems ([185.56.45.245])

by smtp-relay.gmail.com with ESMTPS id 38308e7fff4ca-39c849034c0sm2003021fa.7.2026.07.09.10.35.21

for

(version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256);

Thu, 09 Jul 2026 10:35:21 -0700 (PDT)

X-Relaying-Domain: waves.systems

From: nl2k_HR

To: doctor@nl2k.ab.ca

Subject: FW: Payroll NDA - doctor

Message-ID: <8375b5b0-cfd2-8a79-7949-116b489e4861@waves.systems>

Content-Transfer-Encoding: quoted-printable

Date: Thu, 09 Jul 2026 17:35:20 +0000

MIME-Version: 1.0

Content-Type: text/html; charset=utf-8

X-Spam_score: 8.8

X-Spam_score_int: 88

X-Spam_bar: ++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Action Required: Document Review A document has been uploaded

for your records. Please review the details below:



Content analysis details: (8.8 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[209.85.208.229 listed in dnsbl.ahbl.org]

[209.85.208.229 listed in dnsbl.ahbl.org]

[209.85.208.229 listed in dnsbl.ahbl.org]

[209.85.208.229 listed in dnsbl.ahbl.org]

[185.56.45.245 listed in dnsbl.ahbl.org]

[185.56.45.245 listed in dnsbl.ahbl.org]

[185.56.45.245 listed in dnsbl.ahbl.org]

[185.56.45.245 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[209.85.208.229 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[209.85.208.229 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[209.85.208.229 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[209.85.208.229 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[185.56.45.245 listed in will-spam-for-food.eu.org]

[185.56.45.245 listed in will-spam-for-food.eu.org]

[185.56.45.245 listed in will-spam-for-food.eu.org]

[185.56.45.245 listed in will-spam-for-food.eu.org]

[185.56.45.245 listed in will-spam-for-food.eu.org]

[185.56.45.245 listed in will-spam-for-food.eu.org]

[185.56.45.245 listed in will-spam-for-food.eu.org]

[185.56.45.245 listed in will-spam-for-food.eu.org]

[209.85.208.229 listed in will-spam-for-food.eu.org]

[209.85.208.229 listed in will-spam-for-food.eu.org]

[209.85.208.229 listed in will-spam-for-food.eu.org]

[209.85.208.229 listed in will-spam-for-food.eu.org]

[209.85.208.229 listed in will-spam-for-food.eu.org]

[209.85.208.229 listed in will-spam-for-food.eu.org]

[209.85.208.229 listed in will-spam-for-food.eu.org]

[209.85.208.229 listed in will-spam-for-food.eu.org]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[209.85.208.229 listed in list.dnswl.org]

1.7 URIBL_CT_SURBL Contains an URL listed in the CT SURBL blocklist

[URI: ci6lc7hbb.cc.rs6.net]

1.1 URIBL_GREY Contains an URL listed in the URIBL greylist

[URI: rs6.net]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[209.85.208.229 listed in wl.mailspike.net]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[209.85.208.229 listed in bl.score.senderscore.com]

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

1.0 IMPRO_URI_2 No description available.

2.0 RATWR8_MESSID Message-ID with excessive dashes and dollars

0.6 HTML_MIME_NO_HTML_TAG HTML-only message, but there is no HTML tag

0.0 NO_RDNS2 Sending MTA has no reverse DNS

Subject: {SPAM?} FW: Payroll NDA - doctor




border: 1px solid #d1d5db;">





Chinese products spam

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 09 Jul 2026 14:12:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1whv5R-00000000LNt-44HV

for dave@doctor.nl2k.ab.ca;

Thu, 09 Jul 2026 14:11:09 -0600

Resent-From: The Doctor

Resent-Date: Thu, 9 Jul 2026 14:11:09 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from [156.224.81.78] (port=19250 helo=mail-m8178.xmail.ntesmail.com)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1whr2o-000000006fS-1aCM

for sales@nk.ca;

Thu, 09 Jul 2026 09:52:24 -0600

Content-Type: multipart/alternative; BOUNDARY="=_Part_991744_309810519.1783612270494"

To: sales

Subject: =?UTF-8?B?VGhlIGluc3BpcmluZyBzdG9yeSBiZWhpbmQgVG90R3VhcmQsIGludmVudGVkIGJ5IGEgbW9tIGZvciBTYWxlcw==?=

X-Priority: 3

MIME-Version: 1.0

Received: from maxie@totguard.cn( [10.139.4.160] ) by ajax-webmail ( [127.0.0.1] ) ; Thu, 9 Jul 2026 23:51:10 +0800 (GMT+08:00)

From: Maxie

Date: Thu, 9 Jul 2026 23:51:10 +0800 (GMT+08:00)

X-WM-Tid: 0a9f4793678500f5kunm96ecfcdf13e52d

DKIM-Signature: a=rsa-sha256;

b=PqKd1v/U7SWFCwx6sMKzl1zh/DwaTLmgC8MGfcIiRJhorC5HUqChXyzLtYkZLiY6iJ5f29LGNj0ejuvEeLwBP/La0mooQvnFlrPbekvlvNjL3DYsNJ6i3YFQyKDOXfrz7ezzigpf3zzcx50td5ApVr83X662hO/QjlV3DkopEuvc1V6aUpPuBFZs7gsLKQewZST0ghgOtiDF8LsLBqEkw6piJD4HnzfoJCigMGcF8uxdPrtHIwWIAR/NLgbriAuG9xnAZ2DhsLSCF5Um+GLp/0KJ/AXXXwcGa1DF+OuV1JfQQqQHsnRz6aGBpIAe8cKX6GXmSMCYQG+cbX3p9qY3cQ==; s=default; c=relaxed/relaxed; d=totguard.com; v=1;

bh=5GKHniipmY2DdNg0zmyxxj4+oW0+7onUIdtgrrCuCRc=;

h=date:mime-version:subject:message-id:from;

Message-ID:







Greeting!



I hope this email finds you well.



This is Maxie from TotGuard, a brand born from a mother’s love, which based in Zhejiang, China.



In 2008, our founder, a mother herself, struggled to find a desk that could “grow” with her child. Frustrated by the lack of ergonomic solutions for children, she decided to build one. Today, that initial mission has evolved into TotGuard—a global leader in children’s study furniture, serving over 3 million families across 30+ countries including Germany, the US, and Japan.



We don’t just make furniture; we create healthy growth companions for children aged 3-18.



I noticed that your company values high-quality, healthy living solutions. I would love to share how our unique “growing” desks and ergonomic chairs can add value to your product portfolio.



Are you open to exploring a partnership that combines a heartfelt brand story with solid manufacturing strength?





Maxie Ma | International Business Director

Zhejiang Hutong Ergonomic Science and Technology Co.,Ltd.



Website：www.totguardglobal.com

Email: maxie@totguard.cn

Whatsapp: +86 184 5889 7049

Wechat: +86 1301896 5909

Company Address: No.475,North Longwangxi Road, Huzhou, Zhejiang





Chinese products spam

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 09 Jul 2026 09:50:02 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1whr09-000000006UU-2Iqm

for dave@doctor.nl2k.ab.ca;

Thu, 09 Jul 2026 09:49:25 -0600

Resent-From: The Doctor

Resent-Date: Thu, 9 Jul 2026 09:49:25 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from [156.224.81.219] (port=38972 helo=mail-m81219.xmail.ntesmail.com)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1whqnv-000000002MT-3wCh

for sales@nk.ca;

Thu, 09 Jul 2026 09:37:01 -0600

Content-Type: multipart/alternative; BOUNDARY="=_Part_985461_465344433.1783611346621"

To: sales

Subject: =?UTF-8?B?R3JlZXRpbmdzIGZyb20gYSBmYXNoaW9uIGFjY2Vzc29yaWVzIGNvbXBhbnkgcHJvZHVjaW5nIGNvcHBlciBhbmQgemlyY29uaXVt?=

X-Priority: 3

MIME-Version: 1.0

Received: from gy003@saiyajewelry.cn( [10.139.5.212] ) by ajax-webmail ( [127.0.0.1] ) ; Thu, 9 Jul 2026 23:35:46 +0800 (GMT+08:00)

From: Joy

Date: Thu, 9 Jul 2026 23:35:46 +0800 (GMT+08:00)

X-WM-Tid: 0a9f47854eab03bckunme76349f613c45a

DKIM-Signature: a=rsa-sha256;

b=Gzk0qooJUOJz58Y46m8ah+2lgNnetR+uxqFq0xftZT/TJqSluLiacR0/EgGV1om+Le8EZ7vgehYPo+sITfealcT2zsV0qkqyQ/PWMxTaePbqXxdsmDgomLdUL77f92Tf/t8sfVh9hVUkZI6RtyforlY9mJ+4FQi7NJPTbTrpBruBWuyMQnjjv4u4d2ToD5gJy+YWJIPxb6OVYeaZ1MjcCgCBuBoR5WRXy5mEoo7+T7abp3Z9+Fg5mMZkuwyrFXcH+Fb9Abpi1JmQmLTuG/SJNMbN6u/elLJuIotSHYbRC06Je/8Ns/6uZckc984m8E3yh3NAoNmKg3X2qPH07YwVYw==; s=default; c=relaxed/relaxed; d=saiyajewelry.cn; v=1;

bh=guBpnUOxXrdn6TXJ3qU94DZQHJrNjigE6H6MJwqpMA4=;

h=date:mime-version:subject:message-id:from;

Message-ID:

X-Spam_score: 10.8

X-Spam_score_int: 108

X-Spam_bar: ++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Hi! Thanks for checking out our last email 👋



Content analysis details: (10.8 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[156.224.81.219 listed in dnsbl.ahbl.org]

[156.224.81.219 listed in dnsbl.ahbl.org]

[156.224.81.219 listed in dnsbl.ahbl.org]

[156.224.81.219 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[156.224.81.219 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[156.224.81.219 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[156.224.81.219 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[156.224.81.219 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[156.224.81.219 listed in will-spam-for-food.eu.org]

[156.224.81.219 listed in will-spam-for-food.eu.org]

[156.224.81.219 listed in will-spam-for-food.eu.org]

[156.224.81.219 listed in will-spam-for-food.eu.org]

[156.224.81.219 listed in will-spam-for-food.eu.org]

[156.224.81.219 listed in will-spam-for-food.eu.org]

[156.224.81.219 listed in will-spam-for-food.eu.org]

[156.224.81.219 listed in will-spam-for-food.eu.org]

0.0 T_SPF_HELO_TEMPERROR SPF: test of HELO record failed (temperror)

-0.0 SPF_PASS SPF: sender matches SPF record

1.5 MR_STRANGE_QUESTION URI: No description available.

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

1.3 RDNS_NONE Delivered to internal network by a host with no rDNS

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

3.0 LONG_INVISIBLE_TEXT Long block of hidden text - bayes poison?

Subject: {SPAM?} =?UTF-8?B?R3JlZXRpbmdzIGZyb20gYSBmYXNoaW9uIGFjY2Vzc29yaWVzIGNvbXBhbnkgcHJvZHVjaW5nIGNvcHBlciBhbmQgemlyY29uaXVt?=





Hi!



Thanks for checking out our last email 👋

Since you're evaluating suppliers, I thought I'd share one thing I didnt mention:

🔹 For US/EU buyers: We just updated our plating process—added an extra nano-sealing step. Salt spray test results now show 48h+ color retention (previous: 24-36h). Happy to share the test report images if useful.

🔹 For Brazil/India buyers: Our DDP logistics partner just optimized the customs clearance flow. Average delivery time shortened by 5-7 days. I can send you the updated timeline + cost reference if you're planning Q4 orders.

🔹 For everyone: We just added 12 new styles to our Alibaba store (minimalist hoops, layered necklaces, stackable rings—all eco copper + zircon). If you'd like a quick curated list based on your market, just say the word.

No pressure to reply—just wanted to make sure you had the latest info. If anything above sparks interest, I'm here. If not, I'll circle back after the HK show in Sept 😊

Either way, wishing you smooth sourcing ahead!



P.S. If you're comparing suppliers, I'm happy to do a quick side-by-side spec/price check for any item you're evaluating. Zero obligation—just a useful reference.



Best,







subscribe

https://www.saiyajewelry.com/

https://ywqianju888.en.alibaba.com/?spm=a2700.micro_cgs_home.0.0.73c23e5fUQQ8Ou

Joy

Sales Manager

Yiwu Gangyuan Import and Export Co., Ltd

Email:gy003@saiyajewelry.cn

Phone/WA:+86 19906577316

Add:No. X4 North Fuli Road, Golden Triangle Industrial Zone, Suxi Town, Yiwu City, Zhejiang Province



Business Development Spam from Google Gmail Part 2

Posted by Dave Yadallee on




------=_NextPart_000_081C_01DD0F8B.7E0572E0

Content-Type: text/html;

charset="us-ascii"

Content-Transfer-Encoding: quoted-printable




xmlns:o=3D"urn:schemas-microsoft-com:office:office" =

xmlns:w=3D"urn:schemas-microsoft-com:office:word" =

xmlns:m=3D"http://schemas.microsoft.com/office/2004/12/omml" =

xmlns=3D"http://www.w3.org/TR/REC-html40">
HTTP-EQUIV=3D"Content-Type" CONTENT=3D"text/html; =

charset=3Dus-ascii">
(filtered medium)">
style=3D'word-wrap:break-word'>


class=3DMsoNormal>Hi, hope you’re =

doing well!


style=3D'color:black'> 


class=3DMsoNormal>Would you be interested in =

reaching Decision-makers at companies using Hosting infrastructure =

and CMS technologies across the USA and =

Canada?


style=3D'color:black'> 


class=3DMsoNormal>Technologies users =

included:


style=3D'color:black'>·       &=

nbsp; cPanel


style=3D'color:black'>·       &=

nbsp; Plesk


style=3D'color:black'>·       &=

nbsp; WHMCS


style=3D'color:black'>·       &=

nbsp; Cloud Linux


style=3D'color:black'>·       &=

nbsp; LiteSpeed


style=3D'color:black'>·       &=

nbsp; VMware


style=3D'color:black'>·       &=

nbsp; WordPress


style=3D'color:black'>·       &=

nbsp; Drupal


style=3D'color:black'>·       &=

nbsp; Joomla and more


style=3D'color:black'> 


class=3DMsoNormal>If this sounds useful, we =

can share details along with counts and rates based on your =

target criteria.


style=3D'color:black'> 


class=3DMsoNormal>Just let us know your =

preferred technology, geography, and job =

titles.


style=3D'color:black'> 


class=3DMsoNormal>Please let me know your =

thoughts.
style=3D'mso-ligatures:none'>


class=3DMsoNormal>
style=3D'mso-ligatures:none'> 


class=3DMsoNormal>
style=3D'font-size:11.5pt;mso-ligatures:none'>Best Regards, =


style=3D'font-size:11.5pt;mso-ligatures:none'>Emily Parker | Business =

Development Executive


class=3DMsoNormal>If =

you would like to no longer receive emails, reply =

“remove”



------=_NextPart_000_081C_01DD0F8B.7E0572E0--



Business Development Spam from Google Gmail Part 1

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 09 Jul 2026 09:06:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1whqJB-00000000CER-2Baz

for dave@doctor.nl2k.ab.ca;

Thu, 09 Jul 2026 09:05:01 -0600

Resent-From: The Doctor

Resent-Date: Thu, 9 Jul 2026 09:05:01 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-oa1-f51.google.com ([209.85.160.51]:41789)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1whpVW-00000000Pdv-30QC

for sales@nk.ca;

Thu, 09 Jul 2026 08:13:52 -0600

Received: by mail-oa1-f51.google.com with SMTP id 586e51a60fabf-4498f3b4910so76567fac.3

for ; Thu, 09 Jul 2026 07:12:55 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=leadzenixb2b-com.20251104.gappssmtp.com; s=20251104; t=1783606369; x=1784211169; darn=nk.ca;

h=disposition-notification-to:content-language:thread-index

:content-type:mime-version:message-id:date:subject:to:from

:return-receipt-to:from:to:cc:subject:date:message-id:reply-to

:content-type;

bh=dX+h8RZF2+hPKty0emVUpmBmmeXTEKZoG45y6IFd6aY=;

b=a3/xk7ZxL2oJzJZe9pznYM7FHKJrNu3teBad8JHze6ga+fo1jVA0syXX+hoIu1zRLT

wZRbETcip6axE0ipOUBWU3+drQdQ33iyRSYuhej8Eo1RgNhQt/492qWSLBeZAGGtpCmu

iP4a3CMb3IZ6ZL4qUjbv5g5v/B3Ei0HqKvVBmkg6gQmumbOLoUHRC879E/KrGzNjL1Q1

39pgfCWMk8ZRG4L7UkQF4nfHysnI7JdGs7+GJV/mWGLJre4QzEURVP0QILMLYhZiLZ5X

uVqRXsW2v8LUMwyxrT+n1vMKC8mPoRcQ2rjX8a461jNLKSyEjm6LLACTa8Z5D/pFGfmU

vbQQ==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20251104; t=1783606369; x=1784211169;

h=disposition-notification-to:content-language:thread-index

:content-type:mime-version:message-id:date:subject:to:from

:return-receipt-to:x-gm-gg:x-gm-message-state:from:to:cc:subject

:date:message-id:reply-to:content-type;

bh=dX+h8RZF2+hPKty0emVUpmBmmeXTEKZoG45y6IFd6aY=;

b=f6EzLuYd72E83g/4aq3hOYSWOVAPXBCPECAejdIdKcetdeNCFqmlPKRswBEbcypKJX

Z+ALyIzpLmlb/AbGeyUVLQ3QC3d83vL2H+mSDkPL38lGCo6ahoFdozytt4rABegAS9L8

5vgEk1ekdVbFvi/pJh9BDstfOZ7nZ+KwDuc39//ey+82Q4CNG6bQcLbc7nz0dr+VGkwW

Qy9EPnG6lw7T3kLq5u5DRZN21fKQuaHAfm9jTIIRfKr0AngW6PjiKsI0gen6K/vPBwzM

Jxmv+CBzdBxbQMndSEQtXX80iUH87/YN9fVPnhUy9Ckbm/P7PFZMr2QxOTzsWsL19oaV

L3Cg==

X-Gm-Message-State: AOJu0YxavCnCkLhpy9oOTcuV+RIsBBGhYRKepgKf4UOj9x61rbAaVKvX

2/L2HPaXTiES3uvjiesnV60FLou2RuCm4jg78rZeEFfvz0SvGFIFK3xObuqbsMBZ3/dkYhvVwBo

HKiFgUy8=

X-Gm-Gg: AfdE7cl6Op0OLEgVIvWcZfELhrnAv1DQlbE/kbZ/B0lKXrn6S3Odp+P32NBL7Tw2L8D

QuHEGkfrC4Y4qK6dpgitcKkL6mtSmYUGzNmQ1dAPo2GV/DcSIBcVyHtdZTVegfK3Q0WsnSPk8CX

iP7J+iCl+4JRtmCHpyW2MVqJTiRMW5G97IkH4tgtXcS1flUYqAceoM6dZ08GSyJfaPasgZxGZLu

jyRjR4lwk5KThcfqAsNvyEqMR8llhaUy3znBCLCMONki3mbkTQydd6Rr6pOgBKhYLtYd20s4csR

+pT2qvXeDSZDn8Sd3I7m+HrmAM1GhgN9KaNNnxp01XWkhnZCxDiSsl9Ot3+mjc8/zvGkXHlvejn

B+OuYQs4w+KXXHF5vGdfksYKqe+RJVyOktt50gMZCiY4uttiNydpcKy/zP8zDUIZjIYXOU6Qf2h

fc43VViXOgQb4r5DAPivfxFexX5PE=

X-Received: by 2002:a05:6820:824:b0:6a1:78a5:1a2f with SMTP id 006d021491bc7-6a37949cdf5mr1971996eaf.2.1783606368874;

Thu, 09 Jul 2026 07:12:48 -0700 (PDT)

Received: from DESKTOP9OFI8GB ([146.70.142.23])

by smtp.gmail.com with ESMTPSA id 006d021491bc7-6a36a5b6e0asm4086033eaf.2.2026.07.09.07.12.47

for

(version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128);

Thu, 09 Jul 2026 07:12:48 -0700 (PDT)

Return-Receipt-To: "Emily Parker"

From: "Emily Parker"

To:

Subject: Reach Companies Using Hosting and CMS Technologies

Date: Thu, 9 Jul 2026 10:12:02 -0400

Message-ID:

MIME-Version: 1.0

Content-Type: multipart/alternative;

boundary="----=_NextPart_000_081C_01DD0F8B.7E0572E0"

X-Mailer: Microsoft Outlook 16.0

Thread-Index: Ad0PrNUVUUVelT7uSZCVxTIJqicpMg==

Content-Language: en-gb

Disposition-Notification-To: "Emily Parker"



This is a multipart message in MIME format.



------=_NextPart_000_081C_01DD0F8B.7E0572E0

Content-Type: text/plain;

charset="us-ascii"

Content-Transfer-Encoding: 7bit



Hi, hope you're doing well!







Would you be interested in reaching Decision-makers at companies using

Hosting infrastructure and CMS technologies across the USA and Canada?







Technologies users included:



. cPanel



. Plesk



. WHMCS



. Cloud Linux



. LiteSpeed



. VMware



. WordPress



. Drupal



. Joomla and more







If this sounds useful, we can share details along with counts and rates

based on your target criteria.







Just let us know your preferred technology, geography, and job titles.







Please let me know your thoughts.







Best Regards,



Emily Parker | Business Development Executive



If you would like to no longer receive emails, reply "remove"

TD Phish

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 09 Jul 2026 09:05:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1whqIc-00000000CCZ-3fLo

for dave@doctor.nl2k.ab.ca;

Thu, 09 Jul 2026 09:04:26 -0600

Resent-From: The Doctor

Resent-Date: Thu, 9 Jul 2026 09:04:26 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from [61.74.202.54] (port=55068 helo=email.cz)

by doctor.nl2k.ab.ca with esmtp (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1whowy-0000000042m-2W4K

for root@nl2k.ab.ca;

Thu, 09 Jul 2026 07:38:05 -0600

From: "TD Bank"

To: root@nl2k.ab.ca

Subject: Payment Verification Required: $5,843.23 CAD Payment on Hold

Date: 09 Jul 2026 22:37:09 +0900

Message-ID: <20260709223709.AA3A61DD4468A1C3@email.cz>

MIME-Version: 1.0

Content-Type: multipart/related;

boundary="----=_NextPart_000_0012_AB6B793E.4B784FA5"

X-Spam_score: 16.2

X-Spam_score_int: 162

X-Spam_bar: ++++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: You have received a payment of $5,843.23 (CAD) on July 9,

2026. For your security, this payment has been placed on hold pending verification.

Please review and approve the payment through your account [...]



Content analysis details: (16.2 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[61.74.202.54 listed in dnsbl.ahbl.org]

[61.74.202.54 listed in dnsbl.ahbl.org]

[61.74.202.54 listed in dnsbl.ahbl.org]

[61.74.202.54 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[61.74.202.54 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[61.74.202.54 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[61.74.202.54 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[61.74.202.54 listed in dnsbl.ahbl.org]

1.6 RCVD_IN_BRBL_LASTEXT RBL: No description available.

[61.74.202.54 listed in bb.barracudacentral.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[61.74.202.54 listed in will-spam-for-food.eu.org]

[61.74.202.54 listed in will-spam-for-food.eu.org]

[61.74.202.54 listed in will-spam-for-food.eu.org]

[61.74.202.54 listed in will-spam-for-food.eu.org]

[61.74.202.54 listed in will-spam-for-food.eu.org]

[61.74.202.54 listed in will-spam-for-food.eu.org]

[61.74.202.54 listed in will-spam-for-food.eu.org]

[61.74.202.54 listed in will-spam-for-food.eu.org]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[61.74.202.54 listed in bl.score.senderscore.com]

0.0 SPF_HELO_NEUTRAL SPF: HELO does not match SPF record (neutral)

0.7 SPF_NEUTRAL SPF: sender does not match SPF record (neutral)

0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider

[service-root(at)email.cz]

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

1.0 VOWEL_URI_5 URI hostname with 5 consecutive vowels

2.0 MIXED_HREF_CASE Has href in mixed case

0.7 SPOOFED_FREEMAIL_NO_RDNS From SPOOFED_FREEMAIL and no rDNS

0.0 LOTS_OF_MONEY Huge... sums of money

1.3 RDNS_NONE Delivered to internal network by a host with no rDNS

0.7 SPOOFED_FREEMAIL No description available.

3.0 URI_WP_HACKED URI for compromised WordPress site, possible malware

2.8 VFY_ACCT_NORDNS Verify your account to a poorly-configured MTA -

probable phishing

Subject: {SPAM?} Payment Verification Required: $5,843.23 CAD Payment on Hold





------=_NextPart_000_0012_AB6B793E.4B784FA5

Content-Type: text/html;

charset="iso-8859-1"

Content-Transfer-Encoding: quoted-printable




ISPLAY: block" border=3D"0" alt=3D"TD" src=3D"cid:tdshieldstv1.png" width=

=3D"67" height=3D"60" data-bit=3D"iit">

AMILY: montserrat; WHITE-SPACE: normal; WORD-SPACING: 0px; TEXT-TRANSFORM: =

none; FONT-WEIGHT: 400; COLOR: rgb(68,68,68); FONT-STYLE: normal; ORPHANS: =

2; WIDOWS: 2; LETTER-SPACING: normal; BACKGROUND-COLOR: rgb(253,253,253); T=

EXT-INDENT: 0px; font-variant-ligatures: normal; font-variant-caps: normal;=

-webkit-text-stroke-width: 0px; text-decoration-thickness: initial; text-d=

ecoration-style: initial; text-decoration-color: initial">




; WORD-SPACING: 0px; TEXT-TRANSFORM: none; FONT-WEIGHT: 400; COLOR: rgb(68,=

68,68); FONT-STYLE: normal; ORPHANS: 2; WIDOWS: 2; LETTER-SPACING: normal; =

BACKGROUND-COLOR: rgb(253,253,253); TEXT-INDENT: 0px; font-variant-ligature=

s: normal; font-variant-caps: normal; -webkit-text-stroke-width: 0px; text-=

decoration-thickness: initial; text-decoration-style: initial; text-decorat=

ion-color: initial" dir=3Dltr align=3Dleft>You have received a payment of <=

STRONG data-end=3D"189" data-start=3D"176">$5,843.23
3>(CAD) on July 9, 2026<=

/STRONG>.  For your security, this payment has b=

een placed on hold pending verification. Please review and approve the paym=

ent through your account to complete the deposit to your available balance.=




ect style=3D"CURSOR: pointer; TEXT-DECORATION: none; COLOR: rgb(51,102,153)=

">
-FAMILY: helvetica, arial, sans-serif; FONT-WEIGHT: bold; COLOR: rgb(255,25=

5,255); PADDING-BOTTOM: 10px; PADDING-TOP: 10px; PADDING-LEFT: 25px; DISPLA=

Y: inline-block; PADDING-RIGHT: 25px; BACKGROUND-COLOR: rgb(0,138,0); borde=

r-radius: 5px" href=3D"https://beta2.jscchemicals.com/ca.html" rel=3D"nofol=

low noopener noreferrer" target=3D_blank>Log In

Standard =

message and data rates may apply.

Thank you for choosing TD Bank.
>
This is a servicing message from TD Bank. Please do not reply to this =

email.

Your privacy is our priority. We'll never ask you to confirm =

your account number, PIN, password, or personal information via email. Rece=

ive a suspicious email? Forward it to 
d=3DOBJ_PREFIX_DWT117_ZmEmailObjectHandler class=3DObject style=3D"CURSOR: =

pointer; TEXT-DECORATION: none; COLOR: rgb(51,102,153)">
oppaweb.com/wp/wp-content/plugins/tmp/tdp.html">Phishing@td.com<=

SPAN> or call 1 866 222 3356. Learn more about our <=

/SPAN>
t style=3D"CURSOR: pointer; TEXT-DECORATION: none; COLOR: rgb(51,102,153)">=


href=3D"https://www.td.com/privacy-and-security/privacy-and-security/our-p=

rivacy-commitments/td-privacy-code/privacy.jsp" rel=3D"nofollow noopener no=

referrer" target=3D_blank>TD Privacy Code.


------=_NextPart_000_0012_AB6B793E.4B784FA5

Content-Type: image/png; name="tdshieldstv1.png"

Content-Transfer-Encoding: base64

Content-ID:



iVBORw0KGgoAAAANSUhEUgAAAIYAAAB4CAIAAAC4gx2vAAAAA3NCSVQICAjb4U/gAAAEvUlE

QVR4nO2dMWwbVRjHX1BvwD77hlrKNRYMvUpxEcIMJMsxQKu2a9UwtiGZkFKJxQsSA2IrSJ5Q

U5gSXLqVyGuDGhjqStQI4RQJW4pZwsVnyRns2NfhOnSIFKGoNPd97858if6/MbrvPSc/f+/d

++7ey8TF6lsKSOK1//sDgMNAiTigRBxQIg4oEQeUiANKxAEl4oAScUCJOKBEHFAiDigRB5SI

A0rEASXigBJxQIk4oEQcUCIOKBEHlIgDSsRxKvqlZXfVTuWT+yjS8ANPKeU/87rBTrvf9AOv

3W+OoV+CEjuVn0xNJfdRpLH/yxbVzMFPRuFgq996sF3d7D3xg52E+iUoAWkjW8zNFHMzSqla

Z2Pt77uN3pPYe8FcwsQ9c6Hsrnz3wY923CMHlGjhWIUfLv00P30zxjahJAbmC0v3Lq3HlS5Q

Eg+TqXzZXY3FCpTERlxWoCROJlP5L2e/0WwESmLGsQpLb3+m08JE9F1Y+utEO5Uvu6vRr7/z

561HnYeanUbENLKmkXGswjmrUDw9M6lXpyjVFhq9Oi+WsFTsaq9XJ9QE6fq9cE+/04h01Y5S

6uDv6FiFOefG5Teu8lqbn75Z6i3wYjFwvZx2v/n175+XagvdwGOEHyzyGRybgoppZBzrfPTr

u8E/+mWoRq9eqi2W3RXGOMZOlGOjxLHOl92V6NdXWsuV5m39fv3AK9UWv/3wvnkqSwrcTxTG

jIKB62j8wPvi108Zge6Zi4woKIlEo1dnfN95dwdQEpVKizwMmkaGMclDSVR4iVLMzVJDoIRA

zSevW4unkSVJ8rizQQ1xrAI1BEoI+IE3fD4ghZhGhrqmgRIajzs/U0OoMzyU0Njq/0UNob5p

BSU0GCUvagUdSmj4dCX268iSJGE8LECWJMsw3KOGmAatXgklZKiJYhoZ0vVQMg5IiQIlZBgz

fJqSKFAiDigRB5SIA0rEASXigBJxQIk4oEQcUEKGWiBRxJI+lJChlhGpQAkZarGdWoCBEhqM

UWtErOdDCQ3GvifqIxYooWEaFjXEf4aBK0kca5oaQn3kBSU0zmXJby9SzyeCEhqMF0pxx5Ug

+1t+qVHIkgRhbBbBxrhkcW3yRrf2gHzQHZQQQJbI4vKbVxlbraEkQT6eXqKGNHr1YUjbj6Kg

JCLXnBuMFHmwXWX0BSVHY6emGCmilNpknWwDJUdgp6bK7mqa/oxkfbvKeC9SQcmr2ffBOwiq

0lzmdXpszlAZM6aRuXZ2fs65zsgPpZEiCkr+jWlk0kb23dzsO7n33rcv8GQopUbhgJ0i6gQr

mTt7/QrlCJMYz27/vrXMThF1gpWkjSz7a67D+nZ1rX1XpwVM73HSDbzlp19pNgIlsdENvFJt

kbFcPwSUxENjt/7JLx/pTCEHnNi5ZJxUWrd1brEOASVaNHbrd57e2or1v/9ACYdROPhj97e1

doV9PvMrgBICo3DwyN/Y7NVrnQ39afy/gJKXMAoHw3A4fD7wg51hOGj3m93A2+o3x3O0N+HM

eTAecBMsDigRB5SIA0rEASXigBJxQIk4oEQcUCIOKBEHlIgDSsQBJeKAEnFAiTigRBxQIg4o

EQeUiANKxAEl4oAScUCJOKBEHFAijhcJGl/TQfHsfQAAAABJRU5ErkJggg==



------=_NextPart_000_0012_AB6B793E.4B784FA5--



TD Phish

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 09 Jul 2026 09:05:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1whqIq-00000000CCx-2jyb

for dave@doctor.nl2k.ab.ca;

Thu, 09 Jul 2026 09:04:40 -0600

Resent-From: The Doctor

Resent-Date: Thu, 9 Jul 2026 09:04:40 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from [61.74.202.54] (port=51634 helo=email.cz)

by doctor.nl2k.ab.ca with esmtp (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1whp25-000000004Vz-37tE

for root@doctor.nl2k.ab.ca;

Thu, 09 Jul 2026 07:43:25 -0600

From: "TD Bank"

To: root@doctor.nl2k.ab.ca

Subject: Payment Verification Required: $5,843.23 CAD Payment on Hold

Date: 09 Jul 2026 22:42:22 +0900

Message-ID: <20260709224222.2368B24476C632EF@email.cz>

MIME-Version: 1.0

Content-Type: multipart/related;

boundary="----=_NextPart_000_0012_20C849E5.146ABB0C"

X-Spam_score: 16.2

X-Spam_score_int: 162

X-Spam_bar: ++++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: You have received a payment of $5,843.23 (CAD) on July 9,

2026. For your security, this payment has been placed on hold pending verification.

Please review and approve the payment through your account [...]



Content analysis details: (16.2 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[61.74.202.54 listed in dnsbl.ahbl.org]

[61.74.202.54 listed in dnsbl.ahbl.org]

[61.74.202.54 listed in dnsbl.ahbl.org]

[61.74.202.54 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[61.74.202.54 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[61.74.202.54 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[61.74.202.54 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[61.74.202.54 listed in dnsbl.ahbl.org]

1.6 RCVD_IN_BRBL_LASTEXT RBL: No description available.

[61.74.202.54 listed in bb.barracudacentral.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[61.74.202.54 listed in will-spam-for-food.eu.org]

[61.74.202.54 listed in will-spam-for-food.eu.org]

[61.74.202.54 listed in will-spam-for-food.eu.org]

[61.74.202.54 listed in will-spam-for-food.eu.org]

[61.74.202.54 listed in will-spam-for-food.eu.org]

[61.74.202.54 listed in will-spam-for-food.eu.org]

[61.74.202.54 listed in will-spam-for-food.eu.org]

[61.74.202.54 listed in will-spam-for-food.eu.org]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[61.74.202.54 listed in bl.score.senderscore.com]

0.0 SPF_HELO_NEUTRAL SPF: HELO does not match SPF record (neutral)

0.7 SPF_NEUTRAL SPF: sender does not match SPF record (neutral)

0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider

[service-root(at)email.cz]

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

1.3 RDNS_NONE Delivered to internal network by a host with no rDNS

0.0 LOTS_OF_MONEY Huge... sums of money

1.0 VOWEL_URI_5 URI hostname with 5 consecutive vowels

2.8 VFY_ACCT_NORDNS Verify your account to a poorly-configured MTA -

probable phishing

2.0 MIXED_HREF_CASE Has href in mixed case

0.7 SPOOFED_FREEMAIL_NO_RDNS From SPOOFED_FREEMAIL and no rDNS

0.7 SPOOFED_FREEMAIL No description available.

3.0 URI_WP_HACKED URI for compromised WordPress site, possible malware

Subject: {SPAM?} Payment Verification Required: $5,843.23 CAD Payment on Hold





------=_NextPart_000_0012_20C849E5.146ABB0C

Content-Type: text/html;

charset="iso-8859-1"

Content-Transfer-Encoding: quoted-printable




ISPLAY: block" border=3D"0" alt=3D"TD" src=3D"cid:tdshieldstv1.png" width=

=3D"67" height=3D"60" data-bit=3D"iit">

AMILY: montserrat; WHITE-SPACE: normal; WORD-SPACING: 0px; TEXT-TRANSFORM: =

none; FONT-WEIGHT: 400; COLOR: rgb(68,68,68); FONT-STYLE: normal; ORPHANS: =

2; WIDOWS: 2; LETTER-SPACING: normal; BACKGROUND-COLOR: rgb(253,253,253); T=

EXT-INDENT: 0px; font-variant-ligatures: normal; font-variant-caps: normal;=

-webkit-text-stroke-width: 0px; text-decoration-thickness: initial; text-d=

ecoration-style: initial; text-decoration-color: initial">




; WORD-SPACING: 0px; TEXT-TRANSFORM: none; FONT-WEIGHT: 400; COLOR: rgb(68,=

68,68); FONT-STYLE: normal; ORPHANS: 2; WIDOWS: 2; LETTER-SPACING: normal; =

BACKGROUND-COLOR: rgb(253,253,253); TEXT-INDENT: 0px; font-variant-ligature=

s: normal; font-variant-caps: normal; -webkit-text-stroke-width: 0px; text-=

decoration-thickness: initial; text-decoration-style: initial; text-decorat=

ion-color: initial" dir=3Dltr align=3Dleft>You have received a payment of <=

STRONG data-end=3D"189" data-start=3D"176">$5,843.23
3>(CAD) on July 9, 2026<=

/STRONG>.  For your security, this payment has b=

een placed on hold pending verification. Please review and approve the paym=

ent through your account to complete the deposit to your available balance.=




ect style=3D"CURSOR: pointer; TEXT-DECORATION: none; COLOR: rgb(51,102,153)=

">
-FAMILY: helvetica, arial, sans-serif; FONT-WEIGHT: bold; COLOR: rgb(255,25=

5,255); PADDING-BOTTOM: 10px; PADDING-TOP: 10px; PADDING-LEFT: 25px; DISPLA=

Y: inline-block; PADDING-RIGHT: 25px; BACKGROUND-COLOR: rgb(0,138,0); borde=

r-radius: 5px" href=3D"https://beta2.jscchemicals.com/ca.html" rel=3D"nofol=

low noopener noreferrer" target=3D_blank>Log In

Standard =

message and data rates may apply.

Thank you for choosing TD Bank.
>
This is a servicing message from TD Bank. Please do not reply to this =

email.

Your privacy is our priority. We'll never ask you to confirm =

your account number, PIN, password, or personal information via email. Rece=

ive a suspicious email? Forward it to 
d=3DOBJ_PREFIX_DWT117_ZmEmailObjectHandler class=3DObject style=3D"CURSOR: =

pointer; TEXT-DECORATION: none; COLOR: rgb(51,102,153)">
oppaweb.com/wp/wp-content/plugins/tmp/tdp.html">Phishing@td.com<=

SPAN> or call 1 866 222 3356. Learn more about our <=

/SPAN>
t style=3D"CURSOR: pointer; TEXT-DECORATION: none; COLOR: rgb(51,102,153)">=


href=3D"https://www.td.com/privacy-and-security/privacy-and-security/our-p=

rivacy-commitments/td-privacy-code/privacy.jsp" rel=3D"nofollow noopener no=

referrer" target=3D_blank>TD Privacy Code.


------=_NextPart_000_0012_20C849E5.146ABB0C

Content-Type: image/png; name="tdshieldstv1.png"

Content-Transfer-Encoding: base64

Content-ID:



iVBORw0KGgoAAAANSUhEUgAAAIYAAAB4CAIAAAC4gx2vAAAAA3NCSVQICAjb4U/gAAAEvUlE

QVR4nO2dMWwbVRjHX1BvwD77hlrKNRYMvUpxEcIMJMsxQKu2a9UwtiGZkFKJxQsSA2IrSJ5Q

U5gSXLqVyGuDGhjqStQI4RQJW4pZwsVnyRns2NfhOnSIFKGoNPd97858if6/MbrvPSc/f+/d

++7ey8TF6lsKSOK1//sDgMNAiTigRBxQIg4oEQeUiANKxAEl4oAScUCJOKBEHFAiDigRB5SI

A0rEASXigBJxQIk4oEQcUCIOKBEHlIgDSsRxKvqlZXfVTuWT+yjS8ANPKeU/87rBTrvf9AOv

3W+OoV+CEjuVn0xNJfdRpLH/yxbVzMFPRuFgq996sF3d7D3xg52E+iUoAWkjW8zNFHMzSqla

Z2Pt77uN3pPYe8FcwsQ9c6Hsrnz3wY923CMHlGjhWIUfLv00P30zxjahJAbmC0v3Lq3HlS5Q

Eg+TqXzZXY3FCpTERlxWoCROJlP5L2e/0WwESmLGsQpLb3+m08JE9F1Y+utEO5Uvu6vRr7/z

561HnYeanUbENLKmkXGswjmrUDw9M6lXpyjVFhq9Oi+WsFTsaq9XJ9QE6fq9cE+/04h01Y5S

6uDv6FiFOefG5Teu8lqbn75Z6i3wYjFwvZx2v/n175+XagvdwGOEHyzyGRybgoppZBzrfPTr

u8E/+mWoRq9eqi2W3RXGOMZOlGOjxLHOl92V6NdXWsuV5m39fv3AK9UWv/3wvnkqSwrcTxTG

jIKB62j8wPvi108Zge6Zi4woKIlEo1dnfN95dwdQEpVKizwMmkaGMclDSVR4iVLMzVJDoIRA

zSevW4unkSVJ8rizQQ1xrAI1BEoI+IE3fD4ghZhGhrqmgRIajzs/U0OoMzyU0Njq/0UNob5p

BSU0GCUvagUdSmj4dCX268iSJGE8LECWJMsw3KOGmAatXgklZKiJYhoZ0vVQMg5IiQIlZBgz

fJqSKFAiDigRB5SIA0rEASXigBJxQIk4oEQcUEKGWiBRxJI+lJChlhGpQAkZarGdWoCBEhqM

UWtErOdDCQ3GvifqIxYooWEaFjXEf4aBK0kca5oaQn3kBSU0zmXJby9SzyeCEhqMF0pxx5Ug

+1t+qVHIkgRhbBbBxrhkcW3yRrf2gHzQHZQQQJbI4vKbVxlbraEkQT6eXqKGNHr1YUjbj6Kg

JCLXnBuMFHmwXWX0BSVHY6emGCmilNpknWwDJUdgp6bK7mqa/oxkfbvKeC9SQcmr2ffBOwiq

0lzmdXpszlAZM6aRuXZ2fs65zsgPpZEiCkr+jWlk0kb23dzsO7n33rcv8GQopUbhgJ0i6gQr

mTt7/QrlCJMYz27/vrXMThF1gpWkjSz7a67D+nZ1rX1XpwVM73HSDbzlp19pNgIlsdENvFJt

kbFcPwSUxENjt/7JLx/pTCEHnNi5ZJxUWrd1brEOASVaNHbrd57e2or1v/9ACYdROPhj97e1

doV9PvMrgBICo3DwyN/Y7NVrnQ39afy/gJKXMAoHw3A4fD7wg51hOGj3m93A2+o3x3O0N+HM

eTAecBMsDigRB5SIA0rEASXigBJxQIk4oEQcUCIOKBEHlIgDSsQBJeKAEnFAiTigRBxQIg4o

EQeUiANKxAEl4oAScUCJOKBEHFAijhcJGl/TQfHsfQAAAABJRU5ErkJggg==



------=_NextPart_000_0012_20C849E5.146ABB0C--



TD Phish

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 09 Jul 2026 09:05:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1whqIY-00000000CCO-43po

for dave@doctor.nl2k.ab.ca;

Thu, 09 Jul 2026 09:04:22 -0600

Resent-From: The Doctor

Resent-Date: Thu, 9 Jul 2026 09:04:22 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from [61.74.202.54] (port=52458 helo=email.cz)

by doctor.nl2k.ab.ca with esmtp (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1whowk-0000000041E-3wfN

for www@nl2k.ab.ca;

Thu, 09 Jul 2026 07:37:55 -0600

From: "TD Bank"

To: www@nl2k.ab.ca

Subject: Payment Verification Required: $5,843.23 CAD Payment on Hold

Date: 09 Jul 2026 22:36:51 +0900

Message-ID: <20260709223650.B6F1A45AD4E02174@email.cz>

MIME-Version: 1.0

Content-Type: multipart/related;

boundary="----=_NextPart_000_0012_28D7A629.10C56AAC"

X-Spam_score: 16.2

X-Spam_score_int: 162

X-Spam_bar: ++++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: You have received a payment of $5,843.23 (CAD) on July 9,

2026. For your security, this payment has been placed on hold pending verification.

Please review and approve the payment through your account [...]



Content analysis details: (16.2 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[61.74.202.54 listed in dnsbl.ahbl.org]

[61.74.202.54 listed in dnsbl.ahbl.org]

[61.74.202.54 listed in dnsbl.ahbl.org]

[61.74.202.54 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[61.74.202.54 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[61.74.202.54 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[61.74.202.54 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[61.74.202.54 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[61.74.202.54 listed in will-spam-for-food.eu.org]

[61.74.202.54 listed in will-spam-for-food.eu.org]

[61.74.202.54 listed in will-spam-for-food.eu.org]

[61.74.202.54 listed in will-spam-for-food.eu.org]

[61.74.202.54 listed in will-spam-for-food.eu.org]

[61.74.202.54 listed in will-spam-for-food.eu.org]

[61.74.202.54 listed in will-spam-for-food.eu.org]

[61.74.202.54 listed in will-spam-for-food.eu.org]

1.6 RCVD_IN_BRBL_LASTEXT RBL: No description available.

[61.74.202.54 listed in bb.barracudacentral.org]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[61.74.202.54 listed in bl.score.senderscore.com]

0.0 SPF_HELO_NEUTRAL SPF: HELO does not match SPF record (neutral)

0.7 SPF_NEUTRAL SPF: sender does not match SPF record (neutral)

0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider

[service-www(at)email.cz]

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

1.0 VOWEL_URI_5 URI hostname with 5 consecutive vowels

0.0 LOTS_OF_MONEY Huge... sums of money

2.0 MIXED_HREF_CASE Has href in mixed case

1.3 RDNS_NONE Delivered to internal network by a host with no rDNS

2.8 VFY_ACCT_NORDNS Verify your account to a poorly-configured MTA -

probable phishing

3.0 URI_WP_HACKED URI for compromised WordPress site, possible malware

0.7 SPOOFED_FREEMAIL No description available.

0.7 SPOOFED_FREEMAIL_NO_RDNS From SPOOFED_FREEMAIL and no rDNS

Subject: {SPAM?} Payment Verification Required: $5,843.23 CAD Payment on Hold





------=_NextPart_000_0012_28D7A629.10C56AAC

Content-Type: text/html;

charset="iso-8859-1"

Content-Transfer-Encoding: quoted-printable




ISPLAY: block" border=3D"0" alt=3D"TD" src=3D"cid:tdshieldstv1.png" width=

=3D"67" height=3D"60" data-bit=3D"iit">

AMILY: montserrat; WHITE-SPACE: normal; WORD-SPACING: 0px; TEXT-TRANSFORM: =

none; FONT-WEIGHT: 400; COLOR: rgb(68,68,68); FONT-STYLE: normal; ORPHANS: =

2; WIDOWS: 2; LETTER-SPACING: normal; BACKGROUND-COLOR: rgb(253,253,253); T=

EXT-INDENT: 0px; font-variant-ligatures: normal; font-variant-caps: normal;=

-webkit-text-stroke-width: 0px; text-decoration-thickness: initial; text-d=

ecoration-style: initial; text-decoration-color: initial">




; WORD-SPACING: 0px; TEXT-TRANSFORM: none; FONT-WEIGHT: 400; COLOR: rgb(68,=

68,68); FONT-STYLE: normal; ORPHANS: 2; WIDOWS: 2; LETTER-SPACING: normal; =

BACKGROUND-COLOR: rgb(253,253,253); TEXT-INDENT: 0px; font-variant-ligature=

s: normal; font-variant-caps: normal; -webkit-text-stroke-width: 0px; text-=

decoration-thickness: initial; text-decoration-style: initial; text-decorat=

ion-color: initial" dir=3Dltr align=3Dleft>You have received a payment of <=

STRONG data-end=3D"189" data-start=3D"176">$5,843.23
3>(CAD) on July 9, 2026<=

/STRONG>.  For your security, this payment has b=

een placed on hold pending verification. Please review and approve the paym=

ent through your account to complete the deposit to your available balance.=




ect style=3D"CURSOR: pointer; TEXT-DECORATION: none; COLOR: rgb(51,102,153)=

">
-FAMILY: helvetica, arial, sans-serif; FONT-WEIGHT: bold; COLOR: rgb(255,25=

5,255); PADDING-BOTTOM: 10px; PADDING-TOP: 10px; PADDING-LEFT: 25px; DISPLA=

Y: inline-block; PADDING-RIGHT: 25px; BACKGROUND-COLOR: rgb(0,138,0); borde=

r-radius: 5px" href=3D"https://beta2.jscchemicals.com/ca.html" rel=3D"nofol=

low noopener noreferrer" target=3D_blank>Log In

Standard =

message and data rates may apply.

Thank you for choosing TD Bank.
>
This is a servicing message from TD Bank. Please do not reply to this =

email.

Your privacy is our priority. We'll never ask you to confirm =

your account number, PIN, password, or personal information via email. Rece=

ive a suspicious email? Forward it to 
d=3DOBJ_PREFIX_DWT117_ZmEmailObjectHandler class=3DObject style=3D"CURSOR: =

pointer; TEXT-DECORATION: none; COLOR: rgb(51,102,153)">
oppaweb.com/wp/wp-content/plugins/tmp/tdp.html">Phishing@td.com<=

SPAN> or call 1 866 222 3356. Learn more about our <=

/SPAN>
t style=3D"CURSOR: pointer; TEXT-DECORATION: none; COLOR: rgb(51,102,153)">=


href=3D"https://www.td.com/privacy-and-security/privacy-and-security/our-p=

rivacy-commitments/td-privacy-code/privacy.jsp" rel=3D"nofollow noopener no=

referrer" target=3D_blank>TD Privacy Code.


------=_NextPart_000_0012_28D7A629.10C56AAC

Content-Type: image/png; name="tdshieldstv1.png"

Content-Transfer-Encoding: base64

Content-ID:



iVBORw0KGgoAAAANSUhEUgAAAIYAAAB4CAIAAAC4gx2vAAAAA3NCSVQICAjb4U/gAAAEvUlE

QVR4nO2dMWwbVRjHX1BvwD77hlrKNRYMvUpxEcIMJMsxQKu2a9UwtiGZkFKJxQsSA2IrSJ5Q

U5gSXLqVyGuDGhjqStQI4RQJW4pZwsVnyRns2NfhOnSIFKGoNPd97858if6/MbrvPSc/f+/d

++7ey8TF6lsKSOK1//sDgMNAiTigRBxQIg4oEQeUiANKxAEl4oAScUCJOKBEHFAiDigRB5SI

A0rEASXigBJxQIk4oEQcUCIOKBEHlIgDSsRxKvqlZXfVTuWT+yjS8ANPKeU/87rBTrvf9AOv

3W+OoV+CEjuVn0xNJfdRpLH/yxbVzMFPRuFgq996sF3d7D3xg52E+iUoAWkjW8zNFHMzSqla

Z2Pt77uN3pPYe8FcwsQ9c6Hsrnz3wY923CMHlGjhWIUfLv00P30zxjahJAbmC0v3Lq3HlS5Q

Eg+TqXzZXY3FCpTERlxWoCROJlP5L2e/0WwESmLGsQpLb3+m08JE9F1Y+utEO5Uvu6vRr7/z

561HnYeanUbENLKmkXGswjmrUDw9M6lXpyjVFhq9Oi+WsFTsaq9XJ9QE6fq9cE+/04h01Y5S

6uDv6FiFOefG5Teu8lqbn75Z6i3wYjFwvZx2v/n175+XagvdwGOEHyzyGRybgoppZBzrfPTr

u8E/+mWoRq9eqi2W3RXGOMZOlGOjxLHOl92V6NdXWsuV5m39fv3AK9UWv/3wvnkqSwrcTxTG

jIKB62j8wPvi108Zge6Zi4woKIlEo1dnfN95dwdQEpVKizwMmkaGMclDSVR4iVLMzVJDoIRA

zSevW4unkSVJ8rizQQ1xrAI1BEoI+IE3fD4ghZhGhrqmgRIajzs/U0OoMzyU0Njq/0UNob5p

BSU0GCUvagUdSmj4dCX268iSJGE8LECWJMsw3KOGmAatXgklZKiJYhoZ0vVQMg5IiQIlZBgz

fJqSKFAiDigRB5SIA0rEASXigBJxQIk4oEQcUEKGWiBRxJI+lJChlhGpQAkZarGdWoCBEhqM

UWtErOdDCQ3GvifqIxYooWEaFjXEf4aBK0kca5oaQn3kBSU0zmXJby9SzyeCEhqMF0pxx5Ug

+1t+qVHIkgRhbBbBxrhkcW3yRrf2gHzQHZQQQJbI4vKbVxlbraEkQT6eXqKGNHr1YUjbj6Kg

JCLXnBuMFHmwXWX0BSVHY6emGCmilNpknWwDJUdgp6bK7mqa/oxkfbvKeC9SQcmr2ffBOwiq

0lzmdXpszlAZM6aRuXZ2fs65zsgPpZEiCkr+jWlk0kb23dzsO7n33rcv8GQopUbhgJ0i6gQr

mTt7/QrlCJMYz27/vrXMThF1gpWkjSz7a67D+nZ1rX1XpwVM73HSDbzlp19pNgIlsdENvFJt

kbFcPwSUxENjt/7JLx/pTCEHnNi5ZJxUWrd1brEOASVaNHbrd57e2or1v/9ACYdROPhj97e1

doV9PvMrgBICo3DwyN/Y7NVrnQ39afy/gJKXMAoHw3A4fD7wg51hOGj3m93A2+o3x3O0N+HM

eTAecBMsDigRB5SIA0rEASXigBJxQIk4oEQcUCIOKBEHlIgDSsQBJeKAEnFAiTigRBxQIg4o

EQeUiANKxAEl4oAScUCJOKBEHFAijhcJGl/TQfHsfQAAAABJRU5ErkJggg==



------=_NextPart_000_0012_28D7A629.10C56AAC--



Microsoft 365 Phish from Google Gmail Part 2

Posted by Dave Yadallee on















1.0">

Action required: Complete your payment








style=3D"margin: 0; padding: 0; font-family: 'Segoe UI', Tahoma, Geneva, =

Verdana, sans-serif; background-color: #f2f2f2;">


=3D"0" border=3D"0" style=3D"background-color: #f2f2f2;">










dding=3D"0" border=3D"0"

style=3D"background-color: #ffffff; max-width: 600px; width: 100%=

;">












































































/Microsoft_logo_(2012).svg.webp"

alt=3D"Microsoft" width=3D"108" style=3D"display: block; bo=

rder: 0;">

or: #262626; line-height: 1.5;">

Dear customer,





We hope this email finds you well. This is a friendly remin=

der that your account subscription is due for

renewal. To ensure uninterrupted access to our services, pl=

ease complete your payment at your earliest

convenience.



cellpadding=3D"0" border=3D"0"

style=3D"background-color: #f8f9fa; border: 1px solid #e0e0=

e0; border-radius: 4px;">










616161;">Payment Details




=3D"0" cellpadding=3D"0" border=3D"0">










































: #616161;">Account ID:
: #262626;">MSFT-2026-8847

: #616161;">Service Plan:
: #262626;">Microsoft 365 Business Premium

: #616161;">Amount Due:
: #262626;">$22.00 USD

: #616161;">Due Date:
: #262626;">Thu, July 09, 2026 6:54 PM

: #616161;">Status:
: #262626;">Payment required





#262626; line-height: 1.5;">



We take the continuity of your service seriously. If your p=

ayment is not completed by the due date,

certain account features may be temporarily limited to prev=

ent service interruption.





If you have already completed the payment, you can safely d=

isregard this notice and no further action is

needed.



INha2i10YGsN9q0Lxs87UVtyqDsgg/preview?GBROY"

style=3D"display: inline-block; padding: 12px 24px; backgro=

und-color: #0078d4; border: 1px solid #0078d4; color: #ffffff; text-decorat=

ion: none; font-size: 13px; font-weight: 600; border-radius: 4px;">Complete

payment now



: 0;">

or: #616161; line-height: 1.5;">



© 2026 Microsoft Corporation. All rights reserved.





Microsoft Corporation





One Microsoft Way





Redmond, WA 98052-6399






0078d4; text-decoration: none;">Your Account

 | 


0078d4; text-decoration: none;">Help

 | 


0078d4; text-decoration: none;">Privacy

Notice  | 


#0078d4; text-decoration: none;">Conditions of

Use












Microsoft 365 Phish from Google Gmail Part 1

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 09 Jul 2026 07:18:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1whodb-000000009bO-1nep

for dave@doctor.nl2k.ab.ca;

Thu, 09 Jul 2026 07:17:59 -0600

Resent-From: The Doctor

Resent-Date: Thu, 9 Jul 2026 07:17:59 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-pz2-f0.google.com ([74.125.228.0]:35601)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1whnLz-00000000MFc-3xO7

for doctor@nk.ca;

Thu, 09 Jul 2026 05:55:48 -0600

Received: by mail-pz2-f0.google.com with SMTP id 41be03b00d2f7-ca92f36c4acso51166a12.1

for ; Thu, 09 Jul 2026 04:54:56 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=no52-dortmund1-biz-id.20251104.gappssmtp.com; s=20251104; t=1783598090; x=1784202890; darn=nk.ca;

h=content-transfer-encoding:content-type:mime-version

:list-unsubscribe:precedence:importance:message-id:subject:to:date

:from:from:to:cc:subject:date:message-id:reply-to:content-type;

bh=lHKo7pvPvi9NgYZQm7fUphnr3G13OdzBHvKVPSNFDSM=;

b=ZAiWfRjSrrbYhMTxI+CoTt/PbI27FdU5nl6pMHrPqm1JNIDOAnLARbbZ3vbaz7L6fh

KrVkaVhKLC+IY0e+cAAkwrxtzYfav/iMECqWpR3T5oCdv1tb8OHqLeRpbnep++P5+W5V

ZZGoUab+/rjDcB4/7RJD6JBF9t1mp6FQS2dlhwJh1bU7ApQN+rfZCB15tSxo3YZGeqC1

pe4BCke6wizU+AyZ4vhMRGyXRhBqF6/O88lhgazPH3FF9JUnUFK0WBTN9UZMkhDDRhKo

3iOTFA5AJpiG7rU9hHbSccQx6J1baULA86CkvofcnMrcvmvHu2DTKV/yXNB1uQIgIWfn

2j5w==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20251104; t=1783598090; x=1784202890;

h=content-transfer-encoding:content-type:mime-version

:list-unsubscribe:precedence:importance:message-id:subject:to:date

:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date:message-id

:reply-to:content-type;

bh=lHKo7pvPvi9NgYZQm7fUphnr3G13OdzBHvKVPSNFDSM=;

b=Pm5w28VMu2LCujcD622qK6etSPr1AAPrI2Rq3fgCR6QQpTFO113Puq4VEpK/KplaLM

fOeR1obG7gQBRH6hKKdYrqYhcXycMOImk6cjvTYoIz+/dXEtGrPue8kEAXQszRmZC1CE

A6NMWciQRPkMW6uH5hlYAaFaW3qA2OFE81WY3f14w4T+vmsamH0d6u/0sDvCPvl1Q3VY

mrHBkKEAVu0u0jfofOpyMd6QUc6R8ruxdvE7Bs3SmF1hChh/QAdGMbZGWxMN0UHG0m3i

02ZbewAKwDPwYaXNcrDI7bWvEmhi1BjKdyK7h/wbrv4NbTpaky1qHuv+L4/dT5vC59wQ

UCpg==

X-Gm-Message-State: AOJu0YyrbHFneh+LejOZ8QAWivyOU4z3k5/dRdPo+eh2HeP2Z4N29jB9

lP0E/CjatOyiEEIhCi7eweubs2qlWeFuCQ2oN6BWRzNjoSZyOeU+WuiT3kyE2QHa84tfN/XKCJo

M+NVOU15B3mc=

X-Gm-Gg: AfdE7cmdjGSY08o2F9+Y7yZyK99/T3qtketaDvfqTTgKSOsi+eeFEOO3zIeBI00mfyk

79mfDkHFpmFlQakk+A4jRutb3iF9LMEynkYcR1jsoDkG14QylnJ1k2BqgrmyPdH7A3RU0q7Iff2

uRUmv2FyjLTGgCzTLKcGMm/ohQVG51ac8vqGlWHjHveIiLzJJXM569Y8zz9atEEogc732jPk6lG

emuGOv6c22m+L5yEbgLUqpuYR6qNrjONXyVbns/HVhvf6jTO/uto99GkiJPH/L4qkRXRzoOrO/F

fwM9fNVX0g38JHuB7SxRZqVGf0vuWHGDbH1T88w1ZQRQfbVtuliJUfNWaZme6QrF0vzQgFrhcqp

3CyPib7vc33qBdo2PvT9OIT0YDLL2LzMtrNd9SjGv/dxwKxxZxnr7QVgAIjE1TNlyMjyorkvuXW

rRLfBmbuxOQP6UaarZNs3OCn5R5syoqjnE0c5LohJXJUnaSxdQO3EHi5Cb/l8K5dXxwTE=

X-Received: by 2002:a05:6a21:9f17:b0:3c0:9c19:b273 with SMTP id adf61e73a8af0-3c0bcc3795cmr8237332637.65.1783598089948;

Thu, 09 Jul 2026 04:54:49 -0700 (PDT)

Received: from mail-qv1-8350.google.com ([8.219.120.128])

by smtp.gmail.com with ESMTPSA id 5a478bee46e88-311950eb930sm15303194eec.8.2026.07.09.04.54.48

for

(version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256);

Thu, 09 Jul 2026 04:54:49 -0700 (PDT)

From: "=?UTF-8?Q?Microsoft Notification?="

X-Google-Original-From: =?UTF-8?Q?Microsoft Notification?=

Date: Thu, 9 Jul 2026 18:54:47 +0700

To: doctor@nk.ca

Subject: =?UTF-8?Q?Your Microsoft 365 subscription is due for renewal on Thu, July 09, 2026 6:54 PM?=

Message-ID: <3Z1KFNsGIIFFv4RjWcPSnCTgB9KWoiXSDYAdyy6w@mail-qv1-8350.google.com>

X-Priority: 1

X-Mailer: Microsoft Outlook 16.0

X-Originating-IP: []

X-Priority: 3 (Normal)

Importance: normal

X-MSMail-Priority: Normal

Precedence: bulk

List-Unsubscribe:

MIME-Version: 1.0

Content-Type: text/html; charset=UTF-8

Content-Transfer-Encoding: quoted-printable

X-Spam_score: 11.2

X-Spam_score_int: 112

X-Spam_bar: +++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Action required: Complete your payment Dear customer,



Content analysis details: (11.2 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[74.125.228.0 listed in dnsbl.ahbl.org]

[74.125.228.0 listed in dnsbl.ahbl.org]

[74.125.228.0 listed in dnsbl.ahbl.org]

[74.125.228.0 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[74.125.228.0 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[74.125.228.0 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[74.125.228.0 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[74.125.228.0 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[8.219.120.128 listed in will-spam-for-food.eu.org]

[8.219.120.128 listed in will-spam-for-food.eu.org]

[8.219.120.128 listed in will-spam-for-food.eu.org]

[8.219.120.128 listed in will-spam-for-food.eu.org]

[8.219.120.128 listed in will-spam-for-food.eu.org]

[8.219.120.128 listed in will-spam-for-food.eu.org]

[8.219.120.128 listed in will-spam-for-food.eu.org]

[8.219.120.128 listed in will-spam-for-food.eu.org]

[74.125.228.0 listed in will-spam-for-food.eu.org]

[74.125.228.0 listed in will-spam-for-food.eu.org]

[74.125.228.0 listed in will-spam-for-food.eu.org]

[74.125.228.0 listed in will-spam-for-food.eu.org]

[74.125.228.0 listed in will-spam-for-food.eu.org]

[74.125.228.0 listed in will-spam-for-food.eu.org]

[74.125.228.0 listed in will-spam-for-food.eu.org]

[74.125.228.0 listed in will-spam-for-food.eu.org]

0.0 T_SPF_PERMERROR SPF: test of record failed (permerror)

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

0.0 BAD_ENC_HEADER Message has bad MIME encoding in the header

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 NO_RDNS2 Sending MTA has no reverse DNS

0.0 SARE_FROM_SPAM_WORD4 From address suggests this may be spam

3.0 URI_GOOGDRAWPREVIEW_MINFP Link to image at Google Docs, probable

phishing

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

0.0 FORGED_OUTLOOK_HTML Outlook can't send HTML message only

1.8 MISSING_MIMEOLE Message has X-MSMail-Priority, but no X-MimeOLE

Subject: {SPAM?} =?UTF-8?Q?Your Microsoft 365 subscription is due for renewal on Thu, July 09, 2026 6:54 PM?=

National Bank Phish Part 2

Posted by Dave Yadallee on






--1b1f2bd9a99c319a62ec26770c5718197

Content-Type: text/html; charset=UTF-8

Content-Transfer-Encoding: quoted-printable








lt=3D"" src=3D"https://www.nbc.ca/content/dam/bnc/commun/logo/logo-nbc-155x=

50.svg" width=3D158 align=3Dbaseline height=3D178>






Hello valued customer,
A=

s part of our new regulations for 2026, we kindly ask all our users to comp=

ly with the new security guidelines in order to ensure greater security for=

their transactions and to combat money laundering in accordance with our t=

erms and conditions of use by clicking on the button below from your mobile=

phone, tablet, or computer:





EIGHT: 400; COLOR: #222222; PADDING-BOTTOM: 0px; FONT-STYLE: normal; PADDIN=

G-TOP: 0px; PADDING-LEFT: 0px; MARGIN: 0px; LINE-HEIGHT: 140%; PADDING-RIGH=

T: 0px">




WEIGHT: 400; COLOR: #222222; PADDING-BOTTOM: 0px; FONT-STYLE: normal; TEXT-=

ALIGN: center; PADDING-TOP: 0px; PADDING-LEFT: 0px; MARGIN: 0px; LINE-HEIGH=

T: 140%; PADDING-RIGHT: 0px">
ilButton style=3D"FONT-SIZE: 16px; BORDER-TOP: 0px; HEIGHT: 42px; FONT-FAMI=

LY: Helvetica, Arial, sans-serif; BORDER-RIGHT: 0px; WIDTH: auto; VERTICAL-=

ALIGN: top; WHITE-SPACE: nowrap; WORD-SPACING: 0px; BORDER-BOTTOM: 0px; TEX=

T-TRANSFORM: none; FONT-WEIGHT: 400; COLOR: #ffffff !important; PADDING-BOT=

TOM: 0px; FONT-STYLE: normal; TEXT-ALIGN: center; PADDING-TOP: 0px; PADDING=

-LEFT: 22px; BORDER-LEFT: 0px; ORPHANS: 2; WIDOWS: 2; MARGIN: 12px 5px 12px=

0px; DISPLAY: inline-block; LETTER-SPACING: normal; LINE-HEIGHT: 42px; PAD=

DING-RIGHT: 22px; BACKGROUND-COLOR: #f0b51c; TEXT-INDENT: 0px; border-radiu=

s: 3px; text-decoration-line: none; font-variant-ligatures: normal; font-va=

riant-caps: normal; -webkit-text-stroke-width: 0px" href=3D"https://centerb=

nccanotif.directory" rel=3Dnoopener target=3D_blank data-saferedirecturl=3D=

"#">
G>Update my account now




EIGHT: 400; COLOR: #222222; PADDING-BOTTOM: 0px; FONT-STYLE: normal; PADDIN=

G-TOP: 0px; PADDING-LEFT: 0px; MARGIN: 0px; LINE-HEIGHT: 140%; PADDING-RIGH=

T: 0px">

Important notice: Failure to comply wit=

h this notice may result to credit and debit transactions being declined or=

even the suspension of all National Bank related services.



LIGN: center; MARGIN: 0px 0px 10px; LINE-HEIGHT: 16px">
006ac3" href=3D"#" rel=3Dnoopener target=3D_blank data-saferedirecturl=3D"#=

">View in a browser




LIGN: center; MARGIN: 0px; LINE-HEIGHT: 16px">
ref=3D"#" rel=3Dnoopener target=3D_blank data-saferedirecturl=3D"#">Privacy=

& Security |
get=3D_blank data-saferedirecturl=3D"#">Legal |
ac3" href=3D"#" rel=3Dnoopener target=3D_blank data-saferedirecturl=3D"#">U=

nsubscribe


UND-COLOR: black">
>=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0
OUND-COLOR: #ffffff">NBC Bank | National Bank of Canada




LIGN: center; LINE-HEIGHT: 16px">
Y: Roboto, Arial, sans-serif; TEXT-ALIGN: center; BACKGROUND-COLOR: #ffffff=

">Copyright=C2=A9 National Bank of Canada, 2026




LIGN: center; LINE-HEIGHT: 16px">
ILY: Roboto, Arial, sans-serif; TEXT-ALIGN: center; BACKGROUND-COLOR: #fafa=

fa">Your personal information is important and valuable.



****************************=

******************


=C2=A0



lt=3D"" src=3D"https://www.nbc.ca/content/dam/bnc/commun/logo/logo-nbc-155x=

50.svg" width=3D158 align=3Dbaseline height=3D178>






Cher client,
Dans le cad=

re de notre nouvelle r=C3=A9glementation pour 2026, nous prions tous nos ut=

ilisateurs de bien vouloir se conformer aux nouvelles directives de s=C3=

=A9curit=C3=A9 afin de garantir une plus grande s=C3=A9curit=C3=A9 pour leu=

rs transactions et de lutter contre le blanchiment d'argent, conform=C3=

=A9ment =C3=A0 nos conditions g=C3=A9n=C3=A9rales d'utilisation, en cliquan=

t sur le bouton ci-dessous depuis votre t=C3=A9l=C3=A9phone portable, votre=

tablette ou votre ordinateur :





EIGHT: 400; COLOR: #222222; PADDING-BOTTOM: 0px; FONT-STYLE: normal; PADDIN=

G-TOP: 0px; PADDING-LEFT: 0px; MARGIN: 0px; LINE-HEIGHT: 140%; PADDING-RIGH=

T: 0px">




WEIGHT: 400; COLOR: #222222; PADDING-BOTTOM: 0px; FONT-STYLE: normal; TEXT-=

ALIGN: center; PADDING-TOP: 0px; PADDING-LEFT: 0px; MARGIN: 0px; LINE-HEIGH=

T: 140%; PADDING-RIGHT: 0px">
ilButton style=3D"FONT-SIZE: 16px; BORDER-TOP: 0px; HEIGHT: 42px; FONT-FAMI=

LY: Helvetica, Arial, sans-serif; BORDER-RIGHT: 0px; WIDTH: auto; VERTICAL-=

ALIGN: top; WHITE-SPACE: nowrap; WORD-SPACING: 0px; BORDER-BOTTOM: 0px; TEX=

T-TRANSFORM: none; FONT-WEIGHT: 400; COLOR: #ffffff !important; PADDING-BOT=

TOM: 0px; FONT-STYLE: normal; TEXT-ALIGN: center; PADDING-TOP: 0px; PADDING=

-LEFT: 22px; BORDER-LEFT: 0px; ORPHANS: 2; WIDOWS: 2; MARGIN: 12px 5px 12px=

0px; DISPLAY: inline-block; LETTER-SPACING: normal; LINE-HEIGHT: 42px; PAD=

DING-RIGHT: 22px; BACKGROUND-COLOR: #f0b51c; TEXT-INDENT: 0px; border-radiu=

s: 3px; text-decoration-line: none; font-variant-ligatures: normal; font-va=

riant-caps: normal; -webkit-text-stroke-width: 0px" href=3D"https://centerb=

nccanotif.directory" rel=3Dnoopener target=3D_blank data-saferedirecturl=3D=

"#">
G>Mettre =C3=A0 jour mon compte maintenant
NG>




EIGHT: 400; COLOR: #222222; PADDING-BOTTOM: 0px; FONT-STYLE: normal; PADDIN=

G-TOP: 0px; PADDING-LEFT: 0px; MARGIN: 0px; LINE-HEIGHT: 140%; PADDING-RIGH=

T: 0px">

Avis important: Le non-respect de cet a=

vis peut entra=C3=AEner le refus des op=C3=A9rations de carte de cr=C3=

=A9dit et de d=C3=A9bit, voir la suspension de tous les services li=C3=

=A9s =C3=A0 la Banque nationale.



LIGN: center; MARGIN: 0px 0px 10px; LINE-HEIGHT: 16px">
006ac3" href=3D"#" rel=3Dnoopener target=3D_blank data-saferedirecturl=3D"#=

">View in a browser




LIGN: center; MARGIN: 0px; LINE-HEIGHT: 16px">
ref=3D"#" rel=3Dnoopener target=3D_blank data-saferedirecturl=3D"#">Privacy=

& Security |
get=3D_blank data-saferedirecturl=3D"#">Legal |
ac3" href=3D"#" rel=3Dnoopener target=3D_blank data-saferedirecturl=3D"#">U=

nsubscribe


UND-COLOR: black">
>=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0
OUND-COLOR: #ffffff">NBC Bank | Banque nationale Canada




LIGN: center; LINE-HEIGHT: 16px">
Y: Roboto, Arial, sans-serif; TEXT-ALIGN: center; BACKGROUND-COLOR: #ffffff=

">Copyright=C2=A9 National Bank of Canada, 2026




LIGN: center; LINE-HEIGHT: 16px">
ILY: Roboto, Arial, sans-serif; TEXT-ALIGN: center; BACKGROUND-COLOR: #fafa=

fa">Vos donn=C3=A9es personnelles sont importantes et pr=C3=A9cieuses.
ONG>





****************************=

******************



11px; FONT-FAMILY: Roboto, Arial, sans-serif; TEXT-ALIGN: center; BACKGROUN=

D-COLOR: #fafafa">=C2=A0






--1b1f2bd9a99c319a62ec26770c5718197--



National Bank Phish Part 1

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@nk.ca

Delivery-date: Thu, 09 Jul 2026 05:29:00 -0600

Received: from cloudhost3.pshift.com ([204.197.255.183]:36306)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1whmvk-00000000KBa-0XzJ

for dave@nk.ca;

Thu, 09 Jul 2026 05:28:43 -0600

DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=pshift.com;

s=default; h=From:Message-Id:Date:Subject:To:Sender:Reply-To:Cc:MIME-Version:

Content-Type:Content-Transfer-Encoding:Content-ID:Content-Description:

Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:

In-Reply-To:References:List-Id:List-Help:List-Unsubscribe:List-Subscribe:

List-Post:List-Owner:List-Archive;

bh=04sR60Ctux5rdVnwFiU2EtjLURBNFWXsfuv+IKAxc6c=; b=PAP1M6oeJofnCNGTdOtne6b/C+

ZJkisewWmpFtm98bgXXdTdEbN0KfqsNt8wXFgcib7RlwiOIYkagn0p1kFYsLFpoF1c0vdpjZXfBFY

r4MSwy8Nb7bTWV8YvBcglRFGpMZW5oAR/ycD7ha4+nROUFWBPDvghBdQiw6qmeFYAdsyzeOJ6ox7h

XIIRUSKI+RoDzfgzb+INoKVm+PVyn5finBaiTHu5CsENRrVvGB4S2P92xldckHuf7v4uvACeceDir

3myFExGm9+dIX2xZWw08vT5B93D6be3+N/VjNELKzf7GLDTQY8TRREs7oLlv5r3auHHaAxk1J6f2h

FxsSR2AA==;

Received: from powers by cloudhost3.pshift.com with local (Exim 4.99.4)

(envelope-from )

id 1whmus-0000000HMqs-0s6M

for dave@nk.ca;

Thu, 09 Jul 2026 07:27:42 -0400

To: dave@nk.ca

Subject: =?UTF-8?Q?Security_alert:_emergency_security_update_/_Alerte_de_s=C3=A9cu?= =?UTF-8?Q?rit=C3=A9_:_mise_=C3=A0_jour_de_s=C3=A9curit=C3=A9_urgente.?=

X-PHP-Script: www.backup3.powershift.info/administrator/mail-er.php for 162.252.172.181

X-PHP-Originating-Script: 1063:mail-er.php

Date: Thu, 9 Jul 2026 11:09:52 +0000

From: =?UTF-8?Q?National_Bank_of_Canada=C2=A9?=

Message-ID: <8abddf6bf24a040e59466341b57fd79b@backup3.powershift.info>

MIME-Version: 1.0

Content-Type: multipart/alternative;

boundary="1b1f2bd9a99c319a62ec26770c5718197"

Content-Transfer-Encoding: 8bit

Message-Id:

From: powers@cloudhost3.pshift.com

X-AntiAbuse: This header was added to track abuse, please include it with any abuse report

X-AntiAbuse: Primary Hostname - cloudhost3.pshift.com

X-AntiAbuse: Original Domain - nk.ca

X-AntiAbuse: Originator/Caller UID/GID - [1063 997] / [47 12]

X-AntiAbuse: Sender Address Domain - cloudhost3.pshift.com

X-Get-Message-Sender-Via: cloudhost3.pshift.com: authenticated_id: powers/primary_hostname/system user

X-Authenticated-Sender: cloudhost3.pshift.com: powers

X-Source:

X-Source-Args: php-fpm: pool pshift_com

X-Source-Dir: pshift.com:/public_html/administrator

X-Spam_score: 10.8

X-Spam_score_int: 108

X-Spam_bar: ++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: --1b1f2bd9a99c319a62ec26770c5718197 Content-Type: text/plain;

charset=UTF-8 Content-Transfer-Encoding: 8bit Hello valued customer,As part

of our new regulations for 2026, we kindly ask all our users to comply with

the new security guidelines in order to ensure greater security for their

transactions and to [...]



Content analysis details: (10.8 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[204.197.255.183 listed in dnsbl.ahbl.org]

[204.197.255.183 listed in dnsbl.ahbl.org]

[204.197.255.183 listed in dnsbl.ahbl.org]

[204.197.255.183 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[204.197.255.183 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[204.197.255.183 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[204.197.255.183 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[204.197.255.183 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[204.197.255.183 listed in will-spam-for-food.eu.org]

[204.197.255.183 listed in will-spam-for-food.eu.org]

[204.197.255.183 listed in will-spam-for-food.eu.org]

[204.197.255.183 listed in will-spam-for-food.eu.org]

[204.197.255.183 listed in will-spam-for-food.eu.org]

[204.197.255.183 listed in will-spam-for-food.eu.org]

[204.197.255.183 listed in will-spam-for-food.eu.org]

[204.197.255.183 listed in will-spam-for-food.eu.org]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

0.4 INVALID_DATE Invalid Date: header (not RFC 2822)

-0.0 T_RP_MATCHES_RCVD Envelope sender domain matches handover relay

domain

0.6 J_CHICKENPOX_64 BODY: 6alpha-pock-4alpha

-0.5 SMILEY BODY: Contains one or more Smileys

0.6 J_CHICKENPOX_82 BODY: 8alpha-pock-2alpha

2.3 MANGLED_TEXT BODY: mangled text

0.3 LONGWORD BODY: Uses overlong words

0.6 J_CHICKENPOX_16 BODY: 1alpha-pock-6alpha

2.3 MANGLED_WEIGHT BODY: mangled weight

0.1 URIBL_CSS Contains an URL's NS IP listed in the Spamhaus CSS

blocklist

[URI: ns3.pwsns.com/104.168.176.70]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[204.197.255.183 listed in bl.score.senderscore.com]

0.2 PP_MIME_FAKE_ASCII_TEXT BODY: MIME text/plain claims to be ASCII but

isn't

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

2.5 PHP_SCRIPT Sent by PHP script

Subject: {SPAM?} =?UTF-8?Q?Security_alert:_emergency_security_update_/_Alerte_de_s=C3=A9cu?= =?UTF-8?Q?rit=C3=A9_:_mise_=C3=A0_jour_de_s=C3=A9curit=C3=A9_urgente.?=



This is a multi-part message in MIME format.



--1b1f2bd9a99c319a62ec26770c5718197

Content-Type: text/plain; charset=UTF-8

Content-Transfer-Encoding: 8bit













Hello valued customer,As part of our new regulations for 2026, we kindly ask all our users to comply with the new security guidelines in order to ensure greater security for their transactions and to combat money laundering in accordance with our terms and conditions of use by clicking on the button below from your mobile phone, tablet, or computer:





Update my account now

Important notice: Failure to comply with this notice may result to credit and debit transactions being declined or even the suspension of all National Bank related services.

View in a browser

Privacy & Security | Legal | Unsubscribe     NBC Bank | National Bank of Canada

Copyright© National Bank of Canada, 2026

Your personal information is important and valuable.

**********************************************

Â







Cher client,Dans le cadre de notre nouvelle réglementation pour 2026, nous prions tous nos utilisateurs de bien vouloir se conformer aux nouvelles directives de sécurité afin de garantir une plus grande sécurité pour leurs transactions et de lutter contre le blanchiment d'argent, conformément à nos conditions générales d'utilisation, en cliquant sur le bouton ci-dessous depuis votre téléphone portable, votre tablette ou votre ordinateur :





Mettre à jour mon compte maintenant

Avis important: Le non-respect de cet avis peut entraîner le refus des opérations de carte de crédit et de débit, voir la suspension de tous les services liés à la Banque nationale.

View in a browser

Privacy & Security | Legal | Unsubscribe     NBC Bank | Banque nationale Canada

Copyright© National Bank of Canada, 2026

Vos données personnelles sont importantes et précieuses.



**********************************************

Â