Paypal Cryptocurrency phishing from Microsoft Outlook Part 3

Posted by Dave Yadallee on
0.0 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level mail

domains are different

-0.0 T_RP_MATCHES_RCVD Envelope sender domain matches handover relay

domain

0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider

[haressaznzxrrsxaxz321(at)gmail.com]

0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in digit

[haressaznzxrrsxaxz321(at)gmail.com]

0.3 LONGWORD BODY: Uses overlong words

0.6 MEGALONGWORD BODY: Uses really overlong words

0.1 TW_RW BODY: Odd Letter Triples with RW

0.1 TW_VJ BODY: Odd Letter Triples with VJ

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 HTML_MESSAGE BODY: HTML included in message

2.0 RATWR8_MESSID Message-ID with excessive dashes and dollars

0.2 FREEMAIL_FORGED_FROMDOMAIN 2nd level domains in From and EnvelopeFrom

freemail headers are different

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

0.6 LONG_INVISIBLE_TEXT Long block of hidden text - bayes poison?

0.1 TO_IN_SUBJ To address is in Subject

Subject: {SPAM?} =?UTF-8?Q?Pozv=C3=A1nky=3A_Order_Processing_Notice_=2D_Payment_Confirm?=

=?UTF-8?Q?ed_=40_st_22=2E_apr_2026_=28cynthiaperez389903=40groups=2Eoutlook=2Ecom=29?=





Haresasz Nxysarwsa has invited you to Order Processing Notice – Payment Confirmed

Title: Order Processing Notice – Payment Confirmed

Location: https://meet.google.com/yqr-oyab-vjx

When: April 22, 2026

Organizer:

Haresasz Nxysarwsa

Description: Dear Customer,



Thank you for your payment. We confirm that your PayPal transaction has been successfully verified and your Bitcoin (BTC) order is now in the confirmation stage.



Transaction ID: X4N8Q2J7T5

Date: April 22, 2026

Amount: $410.00

Payment Method: PayPal

Order Status: Pending Verification



Blockchain confirmation times may vary depending on overall network demand. You will be notified once your order has been finalized.



If you have any questions, please contact our support department.



Customer Support: +1(843) 367-5992



Thank you for your continued support.



Best Regards,

Billing Department



-::~:~::~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~::~:~::-

Pripojiť sa cez Google Meet: https://meet.google.com/yqr-oyab-vjx



Viac o službe Meet sa dozviete na https://support.google.com/a/users/answer/9282720



Túto sekciu neupravujte.

-::~:~::~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~::~:~::-

Attendees:



cynthiaperez389903@groups.outlook.com





Pripojiť sa cez Google Meet

Odkaz na stretnutie

meet.google.com/yqr-oyab-vjx

Dear Customer,



Thank you for your payment. We confirm that your PayPal transaction has been successfully verified and your Bitcoin (BTC) order is now in the confirmation stage.



Transaction ID: X4N8Q2J7T5

Date: April 22, 2026

Amount: $410.00

Payment Method: PayPal

Order Status: Pending Verification



Blockchain confirmation times may vary depending on overall network demand. You will be notified once your order has been finalized.



If you have any questions, please contact our support department.



Customer Support: +1(843) 367-5992



Thank you for your continued support.



Best Regards,

Billing Department

Kedy

streda 22. apr 2026

Organizátor

Haresasz Nxysarwsa

haressaznzxrrsxaxz321@gmail.com

Hostia

(Zoznam hostí bol na žiadosť organizátora skrytý)

Odpoveď na cynthiaperez389903@groups.outlook.com

Áno



Nie



Možno

Ďalšie možnosti



Pozvánka z Kalendára Google



Túto správu ste dostali, pretože ste účastníkom danej udalosti.



Ak túto pozvánku prepošlete, ktorýkoľvek jej príjemca bude môcť odoslať odpoveď organizátorovi, byť pridaný do zoznamu hostí, pozývať iných bez ohľadu na ich vlastný stav pozvánky alebo meniť vaše potvrdenie účasti. Ďalšie informácie

Paypal Cryptocurrency phishing from Microsoft Outlook Part 2

Posted by Dave Yadallee on
=?utf-8?B?OXBleHZkNGorK3VQc1ZEbkZXVUZqV0VTdlZiWHFPWktqZGE0c29ac0Z3d3Y4?=

=?utf-8?B?bDBrMHMvMXh0WXBoajVvQ20wZEVwQ1dqSFJLb3N6aTJSOWNqYXdRRDdVVnBt?=

=?utf-8?B?Rkh3V2FJNkZxMTdETlpvUGpTUDRaWUtTc3VJc0dWbU5nR01uMWhLWldVbU1N?=

=?utf-8?B?ZDhacWJZVHBEczk4WkRmaWMwMHFFZWkzam9HY2xCMFlTSURYWjkyUm83dnQ3?=

=?utf-8?B?RDcrN09RemQvVW1qMVhLU0x5N3pNTHBTNzVPcmVEc0pOMTBJLzQxOEpyYURZ?=

=?utf-8?B?VGRoSGdldHB1ckRmZGZSNWhoZkpXdnEyMlVYbjNuVUxKaE1Ic2JtRjRFOFRj?=

=?utf-8?B?V1VKTFljMkl6U1orTkVpTmdrckhQSW5XNTJ5UXh2OEI5UXFBZUVwc0duVGlr?=

=?utf-8?B?dnJBdHkxejMyNkU3Ynorakg2YVlwMUNTRW81MUdPc1RLZnNsME11Y2ROM1My?=

=?utf-8?B?Y3ZzT3NHUWFyUDlibGdFRW9iSy96SVozc3hKNEpJdVdCa2pZZXVkNE1iK3Rw?=

=?utf-8?B?QU1GaEkwRnF2cndhT0Fzd0luWml3eDBUWDBLNGZzUG8xN1d2OWlXMVAzVWVZ?=

=?utf-8?B?WGsrNndFVmI5ZGN4cm5OaE1TRWpZRFdGRkJrbTBEeGgyaXhhdWYxUC9ZUTBF?=

=?utf-8?B?R2l2QmJ0Q052VFdqUmhEZUdYNzNISzBIY0d3c000cnpTOUExOWtmUGZWWnBp?=

=?utf-8?B?cDhNOEhWZFhtK1ZZZWFkM2JNQ0g1R0FWQklrdUdZU2xjeFZJZ3craUp6djU1?=

=?utf-8?B?VUlhSGp4UEZkYTdIeVNualkvaWdNbGpycEswWFIrMFE5eXR6QVdwOGluRmMr?=

=?utf-8?B?bGhIUUxtMXMvNjQwQzlOSjAvc1Q4K0U1cVRhMC96dDlJVTdNaEVLY1RIRVVt?=

=?utf-8?B?ODg4WXhiWDhVeHRQOFZhTmF3RTdrQlNsT21jU0RDb3dNdlY2RnFqYm9MZWpx?=

=?utf-8?B?N2JKZjB6c0FiZnRTc3I1QXpjUE44QVlld09mdDcyZGpTTTEwM1VPYXZSNEky?=

=?utf-8?B?V3VIWUJpQUFOVkd3OVNIRWNqS0FyRStxeXJ6VGVVSHc0V1RoZzJSVmRmUGtN?=

=?utf-8?B?SXlGWkhkUTRoNUh6dG92NVVrOHBzVEI1ZERIcGd1Q0lJN1JsZlBxcmY5MzNY?=

=?utf-8?B?WUppWnBGOE5QUkM5SXZBRGJ3WVhlNlZKaGp0R2Z1NzR3L0pCektXVWYwb091?=

=?utf-8?Q?p0QJ4MclJnyQpFlnodoMpI4MBl6VC5aUt?=

X-Auto-Response-Suppress: DR, OOF, AutoReply

X-OriginatorOrg: sct-15-20-9412-4-msonline-outlook-090a5.templateTenant

X-MS-Exchange-CrossTenant-OriginalArrivalTime: 22 Apr 2026 14:45:21.3282

(UTC)

X-MS-Exchange-CrossTenant-Network-Message-Id: bf3d12cb-f271-4597-be26-08dea07dc79c

X-MS-Exchange-CrossTenant-Id: 84df9e7f-e9f6-40af-b435-aaaaaaaaaaaa

X-MS-Exchange-CrossTenant-AuthSource: DM2PEPF00003FC2.namprd04.prod.outlook.com

X-MS-Exchange-CrossTenant-AuthAs: Anonymous

X-MS-Exchange-CrossTenant-FromEntityHeader: Internet

X-MS-Exchange-Transport-CrossTenantHeadersStamped: PH0PR18MB3848

X-Spam_score: 11.4

X-Spam_score_int: 114

X-Spam_bar: +++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Order Processing Notice – Payment Confirmed streda 22. apr

2026 Pripojiť sa cez Google Meet https://meet.google.com/yqr-oyab-vjx?hs=224

Dear Customer,



Content analysis details: (11.4 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[40.93.1.2 listed in dnsbl.ahbl.org]

[40.93.1.2 listed in dnsbl.ahbl.org]

[40.93.1.2 listed in dnsbl.ahbl.org]

[40.93.1.2 listed in dnsbl.ahbl.org]

[209.85.161.74 listed in dnsbl.ahbl.org]

[209.85.161.74 listed in dnsbl.ahbl.org]

[209.85.161.74 listed in dnsbl.ahbl.org]

[209.85.161.74 listed in dnsbl.ahbl.org]

[2603:10b6:610:e7:0:0:0:35 listed in]

[dnsbl.ahbl.org]

[2603:10b6:610:e7:0:0:0:35 listed in]

[dnsbl.ahbl.org]

[2603:10b6:610:e7:0:0:0:35 listed in]

[dnsbl.ahbl.org]

[2603:10b6:610:e7:0:0:0:35 listed in]

[dnsbl.ahbl.org]

[2603:10b6:610:e7:cafe:0:0:50 listed in]

[dnsbl.ahbl.org]

[2603:10b6:610:e7:cafe:0:0:50 listed in]

[dnsbl.ahbl.org]

[2603:10b6:610:e7:cafe:0:0:50 listed in]

[dnsbl.ahbl.org]

[2603:10b6:610:e7:cafe:0:0:50 listed in]

[dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[40.93.1.2 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[40.93.1.2 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[40.93.1.2 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[40.93.1.2 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[209.85.161.74 listed in will-spam-for-food.eu.org]

[209.85.161.74 listed in will-spam-for-food.eu.org]

[209.85.161.74 listed in will-spam-for-food.eu.org]

[209.85.161.74 listed in will-spam-for-food.eu.org]

[209.85.161.74 listed in will-spam-for-food.eu.org]

[209.85.161.74 listed in will-spam-for-food.eu.org]

[209.85.161.74 listed in will-spam-for-food.eu.org]

[209.85.161.74 listed in will-spam-for-food.eu.org]

[2603:10b6:610:e7:cafe:0:0:50 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:610:e7:cafe:0:0:50 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:610:e7:cafe:0:0:50 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:610:e7:cafe:0:0:50 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:610:e7:cafe:0:0:50 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:610:e7:cafe:0:0:50 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:610:e7:cafe:0:0:50 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:610:e7:cafe:0:0:50 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:610:e7:0:0:0:35 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:610:e7:0:0:0:35 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:610:e7:0:0:0:35 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:610:e7:0:0:0:35 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:610:e7:0:0:0:35 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:610:e7:0:0:0:35 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:610:e7:0:0:0:35 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:610:e7:0:0:0:35 listed in]

[will-spam-for-food.eu.org]

[40.93.1.2 listed in will-spam-for-food.eu.org]

[40.93.1.2 listed in will-spam-for-food.eu.org]

[40.93.1.2 listed in will-spam-for-food.eu.org]

[40.93.1.2 listed in will-spam-for-food.eu.org]

[40.93.1.2 listed in will-spam-for-food.eu.org]

[40.93.1.2 listed in will-spam-for-food.eu.org]

[40.93.1.2 listed in will-spam-for-food.eu.org]

[40.93.1.2 listed in will-spam-for-food.eu.org]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[40.93.1.2 listed in list.dnswl.org]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-0.0 SPF_PASS SPF: sender matches SPF record

-0.0 SPF_HELO_PASS SPF: HELO matches SPF record

0.5 FROM_LOCAL_NOVOWEL From: localpart has series of non-vowel letters

3.5 VOWEL_FROM_7 Impronouncable from header (7+ consecutive vowels)

1.0 HK_RANDOM_REPLYTO Reply-To username looks random

1.0 HK_RANDOM_FROM From username looks random

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[40.93.1.2 listed in wl.mailspike.net]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[40.93.1.2 listed in bl.score.senderscore.com]

Paypal Cryptocurrency phishing from Microsoft Outlook Part 1

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Wed, 22 Apr 2026 09:50:03 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1wFZpN-00000000E9O-41gn

for dave@doctor.nl2k.ab.ca;

Wed, 22 Apr 2026 09:49:25 -0600

Resent-From: The Doctor

Resent-Date: Wed, 22 Apr 2026 09:49:25 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-westusazlp17010002.outbound.protection.outlook.com ([40.93.1.2]:43322 helo=BYAPR05CU005.outbound.protection.outlook.com)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1wFYqS-000000008K6-0e9f

for doctor@doctor.nl2k.ab.ca;

Wed, 22 Apr 2026 08:46:40 -0600

Received: from CH0PR03CA0240.namprd03.prod.outlook.com (2603:10b6:610:e7::35)

by PH0PR18MB3848.namprd18.prod.outlook.com (2603:10b6:510:2b::24) with

Microsoft SMTP Server (version=TLS1_2,

cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.9846.20; Wed, 22 Apr

2026 14:45:22 +0000

Received: from DM2PEPF00003FC2.namprd04.prod.outlook.com

(2603:10b6:610:e7:cafe::50) by CH0PR03CA0240.outlook.office365.com

(2603:10b6:610:e7::35) with Microsoft SMTP Server (version=TLS1_3,

cipher=TLS_AES_256_GCM_SHA384) id 15.20.9791.48 via Frontend Transport; Wed,

22 Apr 2026 14:45:21 +0000

Authentication-Results: spf=pass (sender IP is 209.85.161.74)

smtp.mailfrom=gmail.com; dkim=pass (signature was verified)

header.d=google.com;dkim=pass (signature was verified)

header.d=gmail.com;dmarc=pass action=none header.from=gmail.com;compauth=pass

reason=100

Received-SPF: Pass (protection.outlook.com: domain of gmail.com designates

209.85.161.74 as permitted sender) receiver=protection.outlook.com;

client-ip=209.85.161.74; helo=mail-oo1-f74.google.com; pr=C

Received: from mail-oo1-f74.google.com (209.85.161.74) by

DM2PEPF00003FC2.mail.protection.outlook.com (10.167.23.20) with Microsoft

SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.20.9846.18

via Frontend Transport; Wed, 22 Apr 2026 14:45:21 +0000

X-IncomingTopHeaderMarker:

OriginalChecksum:0A597A57D272C789A52AE46B09C8BBA62646102A41C8E30A2EB1E83E6A05F3AA;UpperCasedChecksum:0331458022BE88BC4608EB18A567A9D5BB9B0C77D54299CCD77FDD2EB8D0B567;SizeAsReceived:3383;Count:15

Received: by mail-oo1-f74.google.com with SMTP id 006d021491bc7-6946dfca922so4677615eaf.1

for ; Wed, 22 Apr 2026 07:45:21 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=google.com; s=20251104; t=1776869121; x=1777473921; darn=groups.outlook.com;

h=to:from:subject:date:message-id:sender:reply-to:mime-version:from

:to:cc:subject:date:message-id:reply-to;

bh=Qcznrz6dMXfhK6mVdeLuj7BHSjZW9UCiByt6meB7GPA=;

b=TWfE+xcEeLX8aGJK7wxuGkHga1C4qefZp7TalhfS+YUMcgafZuWFqy+6ntMZOQGrZO

A/+gPX8HeDyVzobvlIfVs/rwQXtv0EdQbEr1fEHbSHQtw2VoKa/pl7IwcmX3vGcxnXu/

vXkFXBeLneKtBPatO/nmvHey6BUyg04gZ58f+ecAYqUjSAfwGKK5dpCRHKViFqXMleIK

YHfVMJWFHy+iH9gVJTYyw6Ln0XDjOUTuUu15/UyDc6btSkFRWBhjt7V55Pk62+Dd21ao

O4jysIMbSJG11pMh3xDa/m1EOd65ovtigcdLy1uH3chY+Ks1lX4p89EkcNFkkCfgNr2l

srUw==

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=gmail.com; s=20251104; t=1776869121; x=1777473921; darn=groups.outlook.com;

h=to:from:subject:date:message-id:sender:reply-to:mime-version:from

:to:cc:subject:date:message-id:reply-to;

bh=Qcznrz6dMXfhK6mVdeLuj7BHSjZW9UCiByt6meB7GPA=;

b=Cg2v9o5jDXNgKAPf/ZsUD4qeyXSoFGf9Fz8eerHYu59BKbEUIUJNW3afJqofkdwkL1

Pq0sH6Gw6/GtACdVfu7CRSa5d3TwqOTUt/TZlhH0fdPu2aO7A+FzBnvSTtU84Fc7QmN0

I4/tOFIKAsV2uBmSewtKUtDMziCiwpa6fHmL18BgB5pNniBC4KEqkKiWv6vKfJUTZ6fv

BVeowY40Fo6wuCo/GNGIJ5dvKmNFI4XaPaBrxkwmm0FtEADF8r4Z3YlKs4C0jpPFhb9X

rb5vL15x+EcihpeMbAbHIawQph/2WXF61bITMhG6r5SmYdLm8PlfDtT7SfB/Z8MJdjkZ

uS6g==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20251104; t=1776869121; x=1777473921;

h=to:from:subject:date:message-id:sender:reply-to:mime-version

:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to;

bh=Qcznrz6dMXfhK6mVdeLuj7BHSjZW9UCiByt6meB7GPA=;

b=a8qZ8wQ0Uj+zyIpTC5IaohI9yRKuj4/FhQpjgzorwOLu/aLJj71aCDHPUbPXaiw+zr

nwmjkfPekz+eoblBzO4j09paA2z/FM3+0fiElFZs/9jTqkmHOyV0wTloFabqZmJmE6Hx

RziBLgrAkLleF41p+HVpOJgryczbF68I2NT67HGQI2J026BNyNoebbva/7ltB4L90nnl

G/yKw1UIc5Jnh+R/11hqaZXWsK+rgwg1oXGwzUU0gygiLfZyDAREhB73IXV3Lp8Da06S

I4YLCVKsvLM9ZJdRecCHVtIyFVA99HMLAm9kMXR/WgnT+g/a1QvKp9yw/WKaLviGQ4LD

HEng==

X-Gm-Message-State: AOJu0YxEtN6M80n+S7JKi9wzxzGHepOJ7wkAdBaO5ukdkdBHScLPic9+

k2gzLbly3kP1+njgqOzXd+//n/4RJrVH5jflcZYvgcM+uTmqDslnrmYK7f3qi2q7chDKMl4q25A

4qrD2zgcaoDbGq9VH20+21aHIZfx+RV9C+QA=

MIME-Version: 1.0

X-Received: by 2002:a05:6820:4c06:b0:694:8f3a:3f41 with SMTP id

006d021491bc7-6948f3a4683mr5431110eaf.41.1776869120784; Wed, 22 Apr 2026

07:45:20 -0700 (PDT)

Reply-To: Haresasz Nxysarwsa

Sender: =?UTF-8?Q?Kalend=C3=A1r_Google?=

Message-ID:

Date: Wed, 22 Apr 2026 14:45:20 +0000

Subject: =?UTF-8?Q?Pozv=C3=A1nky=3A_Order_Processing_Notice_=2D_Payment_Confirm?=

=?UTF-8?Q?ed_=40_st_22=2E_apr_2026_=28cynthiaperez389903=40groups=2Eoutlook=2Ecom=29?=

From: Haresasz Nxysarwsa

To: cynthiaperez389903@groups.outlook.com

Content-Type: multipart/mixed; boundary="000000000000c1c0f406500d94f8"

X-IncomingHeaderCount: 15

X-EOPAttributedMessage: 0

X-EOPTenantAttributedMessage: 84df9e7f-e9f6-40af-b435-aaaaaaaaaaaa:0

X-MS-PublicTrafficType: Email

X-MS-TrafficTypeDiagnostic: DM2PEPF00003FC2:EE_|PH0PR18MB3848:EE_

X-MS-Office365-Filtering-Correlation-Id: bf3d12cb-f271-4597-be26-08dea07dc79c

X-MS-Exchange-EOPDirect: true

X-Sender-IP: 209.85.161.74

X-SID-PRA: HARESSAZNZXRRSXAXZ321@GMAIL.COM

X-SID-Result: PASS

X-MS-Consumer-Group-Expansion-Loop: cynthiaperez389903@groups.outlook.com

X-MS-Exchange-Group-Expansion-Loop: cynthiaperez389903@groups.outlook.com

X-Microsoft-Antispam:

BCL:0;ARA:1444111002|16200799027|9020799019|24102599021|6092099016|461199028|9000799056|26130799006|3151999006|9400799043|29080799006|6019299003|6149299003|1680799066|26000799027|5139299004|4040799016|4302099013|3412199025|440099028|2145499017|30041999003|26104999006|22062799003|18021999003|1380799030|1360799030|1370799030|21002599022;

X-Microsoft-Antispam-Message-Info:

=?utf-8?B?V2dJM0NtdC9Odk9XazJzWGwzaE03V2lwY1E4NG9rdEo1cGZhMVlCTDdYcHhu?=

=?utf-8?B?U1RqWFkxaWN2NWhjQ2NKSHlVajNGZmNXbWdtRlR0ZXV5SENsL2dxZGgwZEMz?=

=?utf-8?B?ZUdQc3dhOHgzSTgxMWtFSUhBOFZhdVN0RHY2YS9kN0h4OTZlcjJ0ellZQVlo?=

=?utf-8?B?OFhNT0d2eTlHOEhqYXRzL1Q4T3hWcy90Z2R1N0UwanFrWHR2YkxUSFZNdU9j?=

=?utf-8?B?ZW5FMWlaMWJRbi83UU1GeHpzVFNWcVV2K1c3WE0ya3dNQkFrSGF2SC9hK0ZI?=

=?utf-8?B?OWd4aEJKQ0M2dmdWWVAwVTFzbmRDNzZqalhYTTB1NVZpQTZuSHVZM1luc2pp?=

=?utf-8?B?cGIwNkhubk1aVisxRjh1VmgzYUFsdDNoMmpyYXJ4S1l5NFZFNDVsWTVmRnRL?=

=?utf-8?B?NG5uWHMwazFBR052dVY0alBTL2Iyak5zRjJsQUQxYWllUThVWlgxTmdpODFr?=

=?utf-8?B?QjgvdEI1dHA1blBwdElzcFVhb0c1NU1sYlN5dzB1bWZvQkRYM0RESTE2aWs5?=

=?utf-8?B?N1p0allPb1owem5BL0w1VGN3ay9ZOEJTN2d2VXplOEMzU0d4ZDNnTWV5OFBx?=

=?utf-8?B?NHlYK2tuS1dOT0hvQzhqQ2hIdXhIQ2hsMldIUyt4KytKQzNyTmRTcU1PQnk3?=

=?utf-8?B?dUY3STVVeXVtYXlsVUwrZ0xwUkxEWUxUMnJ0enExOC9FbGxuakcxN1Y5QnAw?=

=?utf-8?B?T0F6VkhoSklQNmZCNkpNUkRwOWNjY2dEVWlFR0o5TVNmVlJENUFmcjhpK1Z6?=

=?utf-8?B?SkI4NCtrak91QlNsSFZTUE5BTzhzSHRzd2JYYUVVcDV4R244YnpraGVSYjdi?=

=?utf-8?B?aDBVejRrcHdWSnU0WTJJbDAxdXNjcVhCb3ZsZmo0dDlTclhCTXVySmUwYXBC?=

=?utf-8?B?Umw1T21LY3dudmFULzRJQ29RYjRCZWdkemQrTUgxZlhPTTRqR2hHbTBTUEI4?=

=?utf-8?B?eVpWZmoxdFVmdDZRdFBhSHVWSlZFWlZRa3pxV0c3ZVlNSktuU1ZaUzBQeC93?=

=?utf-8?B?NHVsY3RzM3pJVW9DandVKzB1N3V1ODhQaWRjc0dyRUI3RVJKcnM2VDRiWXFI?=

=?utf-8?B?ZStHbzVzUVEwZGRDNmJDb3BXNkNwTHlYcHpTZlNDeXFOczZKSUkzbWxsNU5D?=

=?utf-8?B?OS9xdGwxNFJVdTUxbWhraXJVOVErbURFK3JVRHdIYWJzTzU5cUJ6dGlYd1B6?=

=?utf-8?B?eDVxdHRlcldyV3FKakU5K25tMUI4NjRUU0dzMXVCV3pSeU4vWURhWlJuVHhs?=

=?utf-8?B?ZEtTQ0hrNmpQZzQ1R3JPM0JSbTFJVzJ5b2hWLzI3NFliVHA5NFZvVXdEaVlr?=

=?utf-8?B?R2RkUUtyZ3B0eDZtY1Fnd29QbEpMUlM2V1NER0Fnampua0NRZUZxb3F5Z0Zj?=

=?utf-8?B?Z2JGZEhRYitWUjl1bktFMGdQRjVYcVRlNGE1ZURjTXRSRXQ4emREWk1lb1FJ?=

=?utf-8?B?V01ZT3pTTGw0aDUyaEZKL2RyVHNtTG40UkhKeGhqQ3ljaGxtQXF6R2ZZWE1W?=

=?utf-8?B?QnNDRE9ETEh4QU1xQWN0TTlNdGlGMVBZZm1vS3J6TkorUEhDTFpJbTl5MVdy?=

=?utf-8?B?SVNGMDIrT3RjSUNEQnp1TXhpTFRQVUplOUpGcjNxVVh0cW5qNjE4a284K1A4?=

=?utf-8?B?Qzl2WnU2NkRWaWZ1bW4xT2hycmw4bU5LYk1uUEh4U28wc25qdGIwNnQ1bmIv?=

=?utf-8?B?d2JJdndZK3I4b2pZaElzdVp1SFZWNmJiQm9sQk1FdVNRTXdsM3AvWWlidnN0?=

=?utf-8?B?d3pIUTVRc2x2cFZ0Z3hwdm1TZktkTmo0QjlJVjQ3WTFCOVBDa2lXOWNqdUcw?=

=?utf-8?B?ZG1mWFBJMHlaK1djYVhSaGkwcDB0V3A0Skh4dTJIVitNUlNtcEc2VWlEVDBn?=

=?utf-8?B?N1AzU0Izc2d0Qzh2cTVKTlAxWkR3MXVybnRyUUpjYmo5L0xnbldwcy9tS09S?=

=?utf-8?B?cG5rRHFLVkJVYVBnd3BBRGNFTVQvbnBNc3lUSE9rUHAvNDFwWElWNTZxQ2Ji?=

=?utf-8?B?eEIyNDJCMHJLRG5HMGFidGZYN3lUQW5MSjhHbGpoZDRQdWJKR2pOcy9lcVJk?=

=?utf-8?B?U0VQN3FINWxKTCtoWmhnbkhhbUlzZmRWYkdnNm41elBJbzRvYmhXbkx2NU55?=

=?utf-8?B?enowZXJwS29KRzg0Wmtpb09DU1NJZW1KZE90OThnVWNBTnB6Q3VzanVzQUtL?=

=?utf-8?B?b1VuTTNReUZVNHNXMWxtR2ZJSmNGcEQ5UU05c0UyWUpoRWdXZkJxRWdsRnAz?=

=?utf-8?B?UURNcVA5dUxsUFM1VCtqeWhIemdVNTk1WkxUTU9CcnVqMzk4ellrOUt2TTgw?=

=?utf-8?B?SWVkVDlTazJTd2NNRkYzTTFzQXJINDRlS3NISmZwQVByS1FHOFl0OENHVG5y?=

Norton Phish from Google Gmail Part 3

Posted by Dave Yadallee on
























































































--===============1534604035356672217==--

Norton Phish from Google Gmail Part 2

Posted by Dave Yadallee on









778a4d3c8a66954f0e23f1f694ea285081' height=3D'1' width=3D'1' align=3D'ri=

ght' />

------d6b546ff4550a245ba8d898f567ce67c--



Account phish posing as BC Cannabis Alliance Part 2

Posted by Dave Yadallee on

td>
%" border=3D"0" cellpadding=3D"0" cellspacing=3D"0" role=3D"presentation=

" style=3D"mso-table-lspace:0;mso-table-rspace:0;word-break:break-word">=


"font-family:Arial,sans-serif">

ont-family:Arial,'Helvetica Neue',Helvetica,sans-serif;mso-line-height-a=

lt:18px;color:#4a4a4a;line-height:1.5">


px;mso-line-height-alt:21px">
-size: 14px;">If you have already completed this update, you can safely =

ignore this message. Thanks for helping keep your account secure. <=

/span>


e>
width=3D"100%" border=3D"0" cellpadding=3D"0" cellspacing=3D"0" role=3D"=

presentation" style=3D"mso-table-lspace:0;mso-table-rspace:0">
>

llpadding=3D"0" cellspacing=3D"0" role=3D"presentation" style=3D"mso-tab=

le-lspace:0;mso-table-rspace:0;color:#000;width:600px;margin:0 auto" wid=

th=3D"600">

=3D"mso-table-lspace:0;mso-table-rspace:0;font-weight:400;text-align:lef=

t;padding-bottom:5px;padding-top:5px;vertical-align:top">
"social_block block-1" width=3D"100%" border=3D"0" cellpadding=3D"0" cel=

lspacing=3D"0" role=3D"presentation" style=3D"mso-table-lspace:0;mso-tab=

le-rspace:0">
y>

ding-right:0;padding-left:0">
<=

table class=3D"social-table" width=3D"188px" border=3D"0" cellpadding=3D=

"0" cellspacing=3D"0" role=3D"presentation" style=3D"mso-table-lspace:0;=

mso-table-rspace:0;display:inline-block">

:0">
a4d3c8a66954f0eb113e3625d92fc4c70a9d66ea88257f9" target=3D"_blank">
src=3D"https://app-rsrc.getbee.io/public/resources/social-networks-icon-=

sets/t-outline-circle-default-gray/facebook@2x.png" width=3D"32" height=3D=

"auto" alt=3D"Facebook" title=3D"Facebook" style=3D"display:block;height=

:auto;border:0">


c8a66954f0eb113e3625d92fc4c9ebe182642bbb156" target=3D"_blank">
"https://app-rsrc.getbee.io/public/resources/social-networks-icon-sets/t=

-outline-circle-default-gray/twitter@2x.png" width=3D"32" height=3D"auto=

" alt=3D"Twitter" title=3D"Twitter" style=3D"display:block;height:auto;b=

order:0">
td1.com/c/443/cb6bfcb666a7e30d5da5b5749e4dc7778a4d3c8a66954f0eb113e3625d=

92fc4c24d7ad0dc9cab4bb" target=3D"_blank">
etbee.io/public/resources/social-networks-icon-sets/t-outline-circle-def=

ault-gray/instagram@2x.png" width=3D"32" height=3D"auto" alt=3D"Instagra=

m" title=3D"Instagram" style=3D"display:block;height:auto;border:0">=


/cb6bfcb666a7e30d5da5b5749e4dc7778a4d3c8a66954f0eb113e3625d92fc4cb62c327=

84419519d" target=3D"_blank">
ic/resources/social-networks-icon-sets/t-outline-circle-default-gray/lin=

kedin@2x.png" width=3D"32" height=3D"auto" alt=3D"LinkedIn" title=3D"Lin=

kedIn" style=3D"display:block;height:auto;border:0">

block-2" width=3D"100%" border=3D"0" cellpadding=3D"0" cellspacing=3D"0"=

role=3D"presentation" style=3D"mso-table-lspace:0;mso-table-rspace:0"><=

tbody>
y>

px;padding-right:30px;padding-top:60px">

"center">
"presentation" width=3D"100%" style=3D"mso-table-lspace:0;mso-table-rspa=

ce:0">

-height:1px;border-top:1px solid #e2e2e2">
ak-word;"> 

ss=3D"row row-3" align=3D"center" width=3D"100%" border=3D"0" cellpaddin=

g=3D"0" cellspacing=3D"0" role=3D"presentation" style=3D"mso-table-lspac=

e:0;mso-table-rspace:0;background-color:#fff">


lpadding=3D"0" cellspacing=3D"0" role=3D"presentation" style=3D"mso-tabl=

e-lspace:0;mso-table-rspace:0;color:#333;width:600px;margin:0 auto" widt=

h=3D"600">

"mso-table-lspace:0;mso-table-rspace:0;font-weight:400;text-align:left;p=

adding-bottom:60px;padding-left:30px;padding-right:30px;padding-top:60px=

;vertical-align:top">
border=3D"0" cellpadding=3D"0" cellspacing=3D"0" role=3D"presentation" =

style=3D"mso-table-lspace:0;mso-table-rspace:0">

pad" style=3D"padding-bottom:32px;width:100%;padding-right:0;padding-lef=

t:0">

08px">
grxx.png" style=3D"display:block;height:auto;border:0;width:100%" width=3D=

"108" alt=3D"Alternate text" title=3D"Alternate text" height=3D"auto">
div>

width=3D"100%" border=3D"0" cellpadding=3D"10" cellspacing=3D"0" role=3D=

"presentation" style=3D"mso-table-lspace:0;mso-table-rspace:0;word-break=

:break-word">

l,sans-serif">

',Helvetica,sans-serif;font-size:12px;mso-line-height-alt:18px;color:#9b=

9b9b;line-height:1.5">


er;mso-line-height-alt:12px">

Account phish posing as BC Cannabis Alliance Part 1

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Wed, 22 Apr 2026 07:31:02 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1wFXfQ-00000000Jyc-49Tt

for dave@doctor.nl2k.ab.ca;

Wed, 22 Apr 2026 07:31:00 -0600

Resent-From: The Doctor

Resent-Date: Wed, 22 Apr 2026 07:31:00 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from smtp-newslist-210.md02.com ([209.172.40.210]:64221)

by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

(Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1wFR9w-000000007qE-0rRI

for doctor@nk.ca;

Wed, 22 Apr 2026 00:34:16 -0600

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; s=c133315; d=cmtd1.com;

h=Subject:From:To:Reply-To:List-Unsubscribe:List-Unsubscribe-Post:List-id:

MIME-Version:Date:Content-Type:Message-Id:From:To:Subject:Date;

i=info+bccannabisalliance.com@cmtd1.com;

bh=sXmVKhLm62pi9KckLa+48HZ8TDKbdz9jY8UR9CaEEPQ=;

b=q4IRgyc95aYOZnTF22OewMHflOLlJxrbwmCdRhEcYC5YGhaQioTkdFanhnDY6u6138SeiATTNFPy

Y5+F6LUSqKL4yJ2TksIGwTXcCiWiaMH614+vgr/7YdoSNP4Zx6H3+tCFD/OMQH4Z+GjgPh0LVxy+

lEZPaB0VAYannaP+tcg=

Received: by smtp-newslist-210.md02.com id ht1lto3cld82 for ; Wed, 22 Apr 2026 06:33:09 +0000 (envelope-from )

Subject: Keep your account features up to date

From: "Ledger =?UTF-8?Q?=F0=9F=94=90?="

To: doctor@nk.ca

Reply-To: info@bccannabisalliance.com

Tag-id: 1724342.15265028.9406955.743775.m.300a09a4

List-Unsubscribe: ,

List-Unsubscribe-Post: List-Unsubscribe=One-Click

Interface-id: 443

Parent-id: 133315

Client-id: 1724342

List-id: 9406955

Feedback-ID: 1724342:news:2:cmd02

MIME-Version: 1.0

Date: Wed, 22 Apr 2026 02:33:09 -0400 (EDT)

Content-Type: multipart/alternative; boundary="----d6b546ff4550a245ba8d898f567ce67c"

Message-Id: <20260422063309.A70BF40005@mta-mailings-postfix.postfix-production.cluster.local>



------d6b546ff4550a245ba8d898f567ce67c

Content-Type: text/plain; charset="utf-8"

Content-Transfer-Encoding: quoted-printable



In order to see your message, click on the following link: https://cmtd1=

.com/v/443/cb6bfcb666a7e30d5da5b5749e4dc7778a4d3c8a66954f0e23f1f694ea285=

081

------d6b546ff4550a245ba8d898f567ce67c

Content-Type: text/html; charset="utf-8"

Content-Transfer-Encoding: quoted-printable






content=3D"text/html; charset=3Dutf-8">
"width=3Ddevice-width,initial-scale=3D1">


transparent; border-bottom: 0px solid transparent; border-left: 0px soli=

d transparent; border-radius: 4px; border-right: 0px solid transparent; =

border-top: 0px solid transparent; color: #ffffff; display: inline-block=

; font-family: Arial, Helvetica Neue, Helvetica, sans-serif; font-size: =

14px; font-weight: 400; mso-border-alt: none; padding-bottom: 5px; paddi=

ng-top: 5px; padding-left: 20px; padding-right: 20px; text-align: center=

; width: auto; word-break: keep-all; letter-spacing: normal;">
e=3D"word-break: break-word; line-height: 28px;">Update Now
>

Capital leasing spam from Google Gmail

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Tue, 21 Apr 2026 16:11:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1wFJIY-00000000OZw-02x8

for dave@doctor.nl2k.ab.ca;

Tue, 21 Apr 2026 16:10:26 -0600

Resent-From: The Doctor

Resent-Date: Tue, 21 Apr 2026 16:10:25 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-pj1-f50.google.com ([209.85.216.50]:53399)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1wFIda-000000001p6-2Jpt

for sales@nk.ca;

Tue, 21 Apr 2026 15:28:14 -0600

Received: by mail-pj1-f50.google.com with SMTP id 98e67ed59e1d1-35d90833cacso3024817a91.2

for ; Tue, 21 Apr 2026 14:27:19 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=kesefmarketing.com; s=google; t=1776806833; x=1777411633; darn=nk.ca;

h=references:list-unsubscribe-post:list-unsubscribe:message-id:date

:to:from:subject:mime-version:from:to:cc:subject:date:message-id

:reply-to;

bh=iBITknHIPxCCF0El6RBiLy8grx/2WPogDSjUKfgKg9c=;

b=H2afL6+KKHlHQH2MndfwZINWGQdx0Fa3Q6yJ1Hxka93dbEJUvSkkXGsSdNEMUVmM0V

JgHZ2DKLJDpmmI+TZ3EmjSop9MxAT+StpBes2BZ6RK59aVa3eKXNRAiVdmPSFdANKD9p

uTczJKVSa2FC/1REOZkDjI8akL0R7HFTSk5ON6ejEAe/sZIIIOKFhdkDJBmxYZoWAGwO

Bb0Ih4exDqUQvfwf/UJ1FVT547Pstk/hNN7IVb0AeaKE3PFywPDXBUrUrmfaVwO67DeK

5KedEJ3enO5W8cTBZZb+ZnseQqZQrVWCiAydmCNTB/Oz6DIvTOnDN45s+WYgxgD/attS

TcMw==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20251104; t=1776806833; x=1777411633;

h=references:list-unsubscribe-post:list-unsubscribe:message-id:date

:to:from:subject:mime-version:x-gm-gg:x-gm-message-state:from:to:cc

:subject:date:message-id:reply-to;

bh=iBITknHIPxCCF0El6RBiLy8grx/2WPogDSjUKfgKg9c=;

b=RWlTiQ544wjNbGuUZor2TglLO6k+vcjfcCP66/ZEDWTPeUcf6iE3B+MVKS7n12povB

h8b+DAbmqGq26NpZuku0XxahJWBdjspxg8DeEmt/ImgEbP6nJbwapIVNwPmmeazoyhDM

SOCYTs6JhS+PNCYD2E29c0O//D15xERPcLtdmdkvBaW84lneM27XLt1c/0/7+2gcJWzo

p3ZcSpIdXbMotQrNkqGQWvnjvi/wzw4QfXyRu1eAX+eTmtJmQcL30BV5Gp6tLW/Ofx/t

gy5vvJbDUTRCIP5W2BgZLXqLJQGXWgzr+IGG62ymj3Bh41nw/sTY/0ikmHUZk5JAS2a6

jyGQ==

X-Gm-Message-State: AOJu0YzfoNvYIWOFfPaLANAEMmPCdZvMTCPy4FVhCPZkc+vczKBJWsag

OoEWpW8hJ4roWR9QuyK+YZwcgxxo7kcWXdHB3lqQKmuopCZXWWshP7JRLp9sImv22LDefJ5QfCy

QbcQu

X-Gm-Gg: AeBDietoB/LBVJCHQiaXyLB4QbP0B3tXI5qswsjoKVe/KGMQkXyimyKk3m4Vfvn8OGc

tTvsDpq+uPts6l6as+34IF5h2oL/qlJKRT8qolcvSPBWNJWBDnQyxt+rpXc2byLNXj0EA5eias1

u317QUk7sQlIrWCnB7MKoaaekg9uzTou/BkK0XYQykGrZzrvRO30+ftZru2PikjsVhMB47Vnpx5

7AoTUkn0FUT0qedHTJ/ouxdL4M1bh4S//OzaOCgMxZE2YOAvG0SiupdcbJHbUZD0G9BU+YMSYBi

yuNH1wiRned7q1hIRCnrTHQtNi63oJBtHiDEoSn/cNMoGg0Mk15lpooULpJ0B/0QtcNV/ucUXx8

xrbD3sAIFQTBXzITJdG2KFBvOfZ7eoO9ODVpaf3GupL9H599aNCGltysGVzM/d+XdNXkvDaHzCX

uU/s0uuyK3iEj/mTDA27f8DQh5eZGZMkMmI1JgmFSldqa2WSU02UjQmz0prhYFCovlFuSvR2zWR

IQd6OfecYefuGCp94bz

X-Received: by 2002:a17:90b:2243:b0:35f:bf4b:c396 with SMTP id 98e67ed59e1d1-361403ca5femr18730106a91.1.1776806833314;

Tue, 21 Apr 2026 14:27:13 -0700 (PDT)

Received: from smtpgw.close.com (am11-natgw-c0.close.com. [54.200.191.154])

by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-362b9a79176sm3324110a91.5.2026.04.21.14.27.12

for

(version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256);

Tue, 21 Apr 2026 14:27:13 -0700 (PDT)

Content-Type: multipart/mixed; boundary="===============4369740770558548234=="

MIME-Version: 1.0

Subject: Fast Capital Option for Your Business

From: =?utf-8?q?Stephanie_Kesef_Marketing?=

To: sales@nk.ca

Date: Tue, 21 Apr 2026 21:27:12 +0000

Message-ID: <177680683266.9.16246492346819765111@smtpgw.close.com>

X-CLOSEIO-EMAIL-ID: acti_w1KC2NWhLn3VwaWPL7cxRaV2TWDS4SfSw8CsHGaFPPz

List-Unsubscribe:

List-Unsubscribe-Post: List-Unsubscribe=One-Click

References: <177680683266.9.6431321791237356164@smtpgw.close.com>



--===============4369740770558548234==

Content-Type: multipart/alternative; boundary="===============4285206556271752772=="

MIME-Version: 1.0



--===============4285206556271752772==

Content-Type: text/plain; charset="utf-8"

MIME-Version: 1.0

Content-Transfer-Encoding: quoted-printable



Hi Gurkirat,



=20



I tried reaching you briefly by phone earlier but wasn=E2=80=99t able to co=

nnect.



=20



My name is Stephanie from Kesef Marketing. I=E2=80=99m reaching out because=

we work

with business owners who are looking for faster access to working capital to

support growth, expansion, or improve cash flow.



=20



Unlike traditional banks, our process is much simpler. We typically don=E2=

=80=99t

require tax returns or collateral, and approvals are usually based on the

business=E2=80=99s recent cash flow. In many cases, funding can be arranged=

within 24

to 48 hours once everything is reviewed.



=20



Even if you=E2=80=99re not actively looking right now, many owners like to =

keep an

option like this available for when the right opportunity comes up.



=20



If you have a few minutes later this week, I=E2=80=99d be happy to introduc=

e myself

and see if this could be helpful for your business.



=20



=20



=F0=9F=91=89 **Complete Your Application Here:** :[CLICK HERE TO START YOUR

APPLICATION](https://form.jotform.com/260753747697272?lead_id=3Dlead_bqyNtS=

fmgPr9HEY1bFvoKaWRLZZxf887Qp2LC28qfuP)



Wishing you continued success, and I look forward to connecting.



=20



Best regards,



=20



Stephanie Cabi-Ao



Funding Advisor | Kesef Marketing



581 873 5950 | [stephanie@kesefmarketing.com](mailto:stephanie@kesefmarketi=

ng.com)



7250 Keele St #304Concord, ON L4K 1Z8, Canada



=20



To stop receiving these emails, click

[here](https://app.close.com/go/unsubscribe/orga_WJQdcK5MUUa02rLIty6GVDnil9=

kHSKU8WElV6ueTPiF/sales%40nk.ca/GK6U1JDQJSfaf6

--tg9gajA9HdvShNSyH_DgbhmTyc8=3D/)

--===============4285206556271752772==

Content-Type: text/html; charset="utf-8"

MIME-Version: 1.0

Content-Transfer-Encoding: quoted-printable



Hi Gurkirat,

I tried reaching you briefly by =

phone earlier but wasn=E2=80=99t able to connect.

=

My name is Stephanie from Kesef Marketing. I=E2=80=99m reaching out because=

we work with business owners who are looking for faster access to working =

capital to support growth, expansion, or improve cash flow.

<=

/div>
Unlike traditional banks, our process is much simpler. We typical=

ly don=E2=80=99t require tax returns or collateral, and approvals are usual=

ly based on the business=E2=80=99s recent cash flow. In many cases, funding=

can be arranged within 24 to 48 hours once everything is reviewed.

iv>
Even if you=E2=80=99re not actively looking right now, ma=

ny owners like to keep an option like this available for when the right opp=

ortunity comes up.

If you have a few minutes later=

this week, I=E2=80=99d be happy to introduce myself and see if this could =

be helpful for your business.


Wishing you continued success, and I look forward to con=

necting.

Best regards,

St=

ephanie Cabi-Ao
Funding Advisor | Kesef Marketing
581 8=

73 5950 |
rel=3D"noopener noreferrer nofollow">stephanie@kesefmarketing.com
>
7250 Keele St #304Concord, ON L4K 1Z8, Canada




//ml.closeml.com/t/w1KC2NWhLn3VwaWPL7cxRaV2TWDS4SfSw8CsHGaFPPz/1TRpq4kUQd.p=

ng" alt=3D"" width=3D"1" height=3D"1" />

--===============4285206556271752772==--



--===============4369740770558548234==--