WEb/sEo/App spam from Google gmail

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Fri, 24 Jul 2026 07:31:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wnFyj-0000000098Y-0qyh

for dave@doctor.nl2k.ab.ca;

Fri, 24 Jul 2026 07:30:17 -0600

Resent-From: The Doctor

Resent-Date: Fri, 24 Jul 2026 07:30:17 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-pz2-f1.google.com ([74.125.228.1]:34050)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wnFq2-000000007f7-2XIn

for sales@nk.ca;

Fri, 24 Jul 2026 07:21:26 -0600

Received: by mail-pz2-f1.google.com with SMTP id 41be03b00d2f7-ca7a25cd87dso397870a12.1

for ; Fri, 24 Jul 2026 06:20:31 -0700 (PDT)

ARC-Seal: i=1; a=rsa-sha256; t=1784899226; cv=none;

d=google.com; s=arc-20260327;

b=XZwMMHHHYya1OtP264ZDonjbK48wzhOD3xDTW+3H+UKvFuxspGPFiTsrPLoSMNFivU

4moaCyzFnQ72zxlsOUukIth+AX04ctlfC2JwC5sAeZhY8wtlO3XeYyBsUUK6SI7DYbmQ

oUi+gPQOAKTgQS5g1kMA+Vz+axSv01B/SitFxF6gksXsBY1AQ05xwsayBFXtDswz31F1

XJsc11IHosx3vSdHebGfAEMwjwBUBHWAxWjgynQRqPaLH6uQzYaCUGi/oDR2lnTMDnYM

0D+ijeldklzZNQmFLsrZ8X+hCuAHZAWLbN4Ewesi+j43B7DPrS+MmqJMJVs7nHqwKEqX

iBYg==

ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20260327;

h=to:subject:message-id:date:from:sender:mime-version:dkim-signature;

bh=EIynxyDYjad1lfv1fTPAXvgsuxMGwF6QHP/hJiVHj/s=;

fh=C4vsnDG7cTH8aa/8f7sygxKSfblX4MPDg6mph8A3jUw=;

b=Jm4LYmJSsB8M4KPETLVlGfKQ8c8gEb7ZFWzIZxXxAEBLufsqd1M80Ma5YVQcj9qCRe

DPIXbbqgUj+P9RaR7x3+6lsp3C1b87dqUH3LjOUjQP50/9+eVFoiCgqkKsP7dfHojaBi

CfRQzXAJFXXQTsADhAC52g2DPWIZ7J9aCndiTRTxhTbRg2o3d/Hh/aJ1TBvZ1aOkMKmZ

bvr27AOLcVywXC2fRtwZJHNd2w+smPWjns/HQ9M1G85LCOLiA5dDsDATHAYheLN36FJS

N1nN0StxolD3J5Z2T5BsdC5XlH/U1OfzqwrFeWwxp8pIbWU7DTuRPHm+zpk0T1GYWBRV

ztXQ==;

darn=nk.ca

ARC-Authentication-Results: i=1; mx.google.com; arc=none

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=getanysolutions-com.20251104.gappssmtp.com; s=20251104; t=1784899226; x=1785504026; darn=nk.ca;

h=content-type:to:subject:message-id:date:from:sender:mime-version

:from:to:cc:subject:date:message-id:reply-to:content-type;

bh=EIynxyDYjad1lfv1fTPAXvgsuxMGwF6QHP/hJiVHj/s=;

b=PwDznqYIu2jrigeAVjqumvh2Zcn8CuCcE0+QVwbGE8PM67vgkbOp2dMCgte33Vw0oU

1Udgz+XZsmCJyAgjoPQo27uleiz55TQNjNc7Gi2N6xM1+WZFuPNR1ljtmTHqKx3BJwbu

I38Mo+5p2QNOna5e4YWbl5/sSQ4soc1O2EV3TvFqSGUPm1lHNu1PN89y38Rdc/zapn+S

Dm8dzhRVbImJPav1iw6ZmxTiDC0xuXl6XYvzOWWsYc0qvXbkdEQfmTy+ZtQ3Yx0JicOp

7P36r7P/5cd4dTN6HBUqaTH3ZhgNEn8q8lzCPL8G6u+i1oygzqWOvLQ+6DbQ98CjezwW

Bd4Q==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20251104; t=1784899226; x=1785504026;

h=content-type:to:subject:message-id:date:from:sender:mime-version

:x-gm-gg:x-gm-message-state:from:to:cc:subject:date:message-id

:reply-to:content-type;

bh=EIynxyDYjad1lfv1fTPAXvgsuxMGwF6QHP/hJiVHj/s=;

b=EcW3B+0h3VrMv5VPOqDEKTQ0DUVveZtiK9w/ae+NKlnZ68PTgfcUD+PcYiVV2i9V5l

Hg22sI2p78KqTvbhhLK5Lxe1iO4/2PHWx/gMSQkCkra/23Xaf+OtShvvF1l9xn6DhuLP

TD1hKha1ZHk02cG4JWPprZtgnsR/YO0Zrhk8E4MmakhX267qqEkNOYpjNT/SDBpQUfeM

Qz6gGcipsvvIuTh8QLk65aB1p8Z98ikMlF5AlLysb53oRR/kAmiuwq278aaycVv2+vVs

XSNq9EaVF1e5bodFAikFVk8ZAxgFxhParAre/2U0uLC9rG1HYnrJ++dhWDnVLobprOa4

BUJA==

X-Gm-Message-State: AOJu0Yy262i4jOdBhGJ90xPqD+HlAlz2duyoA0dfyj6kCg5UyfWRBphg

Rws4XlanIe4J74neF2nf57eiLXCwGUictEHXTaOV34+VPHGjbw2no8c8PZ9UISTf39crOMHRQ09

JqEiUOf8ofGBDFznY9VVjBqry912NLfwA8DKLoRcWmcTBCyyRjvYHlFigHQ==

X-Gm-Gg: AR+sD11fBQbzI7OsWikJvyzUMkISrYCfWd7Q+XESdWnUeNQXJ3aCowrsdnV0ldhhv4E

kBiz7i73z5SuEW0krjlwriPvkllSD8x1Ly0viij47MFwJw/dErehO7/ob3oyi98HdHoAIrNmxvK

xYCsbY3JbA2hh79POWoeCXftJLxb9Sm8FLQ4jpcW7DbgFXP1mTwoZrKyoKT/z31xeALydDP8juK

7hPgHsB0xqdbRGQhJJlByCP5gqcLFvzQh1rxaWzsPifBDe1GtecJIujxXtRs4V7GdF0z1LziAdW

p+YFSeI1G6tKq3LIJCVJ

X-Received: by 2002:a05:690e:24ce:b0:667:b234:d5e7 with SMTP id

956f58d0204a3-668a4fc009cmr1407141d50.86.1784898881195; Fri, 24 Jul 2026

06:14:41 -0700 (PDT)

Received: from 657113358970 named unknown by gmailapi.google.com with

HTTPREST; Fri, 24 Jul 2026 06:14:40 -0700

Received: from 657113358970 named unknown by gmailapi.google.com with

HTTPREST; Fri, 24 Jul 2026 06:14:40 -0700

MIME-Version: 1.0

Sender: claire@getanysolutions.com

From: claire@getanysolutions.com

Date: Fri, 24 Jul 2026 06:14:40 -0700

X-Google-Sender-Auth: 7IRhv1i0LqJuWTGJzDbjlkEwrhc

X-Gm-Features: AUfX_mwAs1RuD_3WwWJgRtdTzpVb5fqoo7PcI1W6rjooHf_verlq_bFAQvb2ro0

Message-ID:

Subject: One stop solution for nk.ca.

To: sales@nk.ca

Content-Type: multipart/alternative; boundary="000000000000c620a706575b27fc"



--000000000000c620a706575b27fc

Content-Type: text/plain; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable



Hello nk.ca,



After reviewing your nk.ca I can see a number of major issues which are

badly affecting your search engine presence and that is the reason you are

losing almost 42% of your potential traffic.



I would be happy to send you errors and the solutions that would help to

improve your nk.ca website performance and traffic.



We've been using AI-driven SEO methods lately that are helping clients

see steadier lead flow without the usual guesswork.



If you are interested, I can provide you with the list of issues and the

master plan
to perform far better as compared to your competitors.



Let me know if you are interested.





Regards,

Claire Howard









Business Development Executive

---------------------------------------------------------------------------=

----------------

PS 1: Please answer our email with =E2=80=9CInterested=E2=80=9D or =E2=80=

=9CNot Interested=E2=80=9D=E2=80=AFso that

we will know the status of your inquiry and act accordingly. If you are

interested then I will send more details on our=E2=80=AF=E2=80=9Ccorporate

identity=E2=80=9D, =E2=80=9Ccompany profile=E2=80=9D, =E2=80=9CPrice list=

=E2=80=9D & =E2=80=9Cwhy you should choose us?=E2=80=99=E2=80=99




--000000000000c620a706575b27fc

Content-Type: text/html; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable




=3D"verdana, sans-serif">Hello nk.ca,









After

reviewing your nk.ca I

can see a number of major issues which are badly affecting your search engi=

ne

presence and that is the reason you are losing almost 42% =

of your potential

traffic.





I would be

happy to send you errors and the solutions that would help to improve your =

nk.ca website performance

and traffic.





We've =

been

using AI-driven SEO methods lately that are helping clients see stea=

dier

lead flow without the usual guesswork.





If

you are interested, I can provide you with the list of issues and the maste=

r

plan


to perform far better as compared to your competitors.





Let me

know if you are interested.






age:initial;background-position:initial;background-size:initial;background-=

repeat:initial;background-origin:initial;background-clip:initial">
e=3D"verdana, sans-serif">
Regards,
>

Claire Howard






tion:initial;background-size:initial;background-repeat:initial;background-o=

rigin:initial;background-clip:initial">B=

usiness Development Executive


---------------------------------------------------------------------------=

----------------


PS 1: Please answer our email with =E2=80=9CInterested=E2=80=9D or =E2=80=

=9CNot Interested=E2=80=9D=E2=80=AFso that we

will know the status of your inquiry and act accordingly. If you are intere=

sted

then I will send more details on our=E2=80=AF=E2=80=9Ccorporate identity=E2=

=80=9D,=C2=A0=E2=80=9Ccompany

profile=E2=80=9D,=C2=A0=E2=80=9CPrice list=E2=80=9D & =E2=80=9Cwhy you =

should choose us?=E2=80=99=E2=80=99=C2=A0











--000000000000c620a706575b27fc--

WEb/SEO/APP spam from Google Gmail

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Fri, 24 Jul 2026 07:31:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wnFyV-0000000097P-1vUf

for dave@doctor.nl2k.ab.ca;

Fri, 24 Jul 2026 07:30:03 -0600

Resent-From: The Doctor

Resent-Date: Fri, 24 Jul 2026 07:30:03 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-lj1-f196.google.com ([209.85.208.196]:42405)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wnFKM-00000000NKS-0sxg

for sales@nk.ca;

Fri, 24 Jul 2026 06:48:42 -0600

Received: by mail-lj1-f196.google.com with SMTP id 38308e7fff4ca-39c94d4fdb9so4312761fa.1

for ; Fri, 24 Jul 2026 05:47:47 -0700 (PDT)

ARC-Seal: i=1; a=rsa-sha256; t=1784897260; cv=none;

d=google.com; s=arc-20260327;

b=Q1g2927Rtw2PyYVhfKIkl5iBIwuDcrncxHSB64QOkq2WYJ3CqSpFKm1RnltsGFtmdw

zBF/0p47p9bqaNrW2edNLvIRBlOaMUSD8AGmea5JpCxFJWdy56mVArzgrRPu8XckzEqF

aim+eW/MKXCpHuiiYQH3P2Z5CMVOkT3kr7ZEGv85lFrBA6YDPUC4OSLNkboUtFOyVLu0

TjpDYzZpV7ixruzH/PLJyiuv+CB7NnqmgUXg76xk3sefVSaTKZ7SOmzSjKA4ckPnfvN4

botZoWvebjdM7RJtZ8pd3A+7pOtAu8DMxhmu9nDGi/IudJVUEqNNanDpQS0PBAsVhPu9

JI2g==

ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20260327;

h=to:subject:message-id:date:from:sender:mime-version:dkim-signature;

bh=9oLou62vr8LXnHhjBv8ipkFGtbgY80chQiQCfMsjPO8=;

fh=C4vsnDG7cTH8aa/8f7sygxKSfblX4MPDg6mph8A3jUw=;

b=DQMl9nuuwIXt50yKnNEUejkNzOKSh8T+PFRr7+SxqPY++pdvqTbpbfvcnKVaze2ut8

fmbxwldXDxip6xFdq/W+nL/hT4hO4O00Uei2HUC9aWjC6W6CJQ+d+ByTss+xeOBpiIRN

WR9w1qYfQ6Gn5JnBtlyootQ/q7HnuoIIMX1Sv3YnBUw2o5YGV8UrU4ONu+dNftauZZgF

I7ASAMULq/w7L299eQZbLBsZH6SARowfiIy3NBgKHoHE7mi1m55dblbO/H3Zx/iZf2cL

mK+9ER9pGvZX/VMwlUB2WQHg1nL4mdgzo7VUX9DAH3YyFyz+M+tZ+idZrQ+KkYV9O0R+

Yd6w==;

darn=nk.ca

ARC-Authentication-Results: i=1; mx.google.com; arc=none

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=getanysolutions-com.20251104.gappssmtp.com; s=20251104; t=1784897260; x=1785502060; darn=nk.ca;

h=content-type:to:subject:message-id:date:from:sender:mime-version

:from:to:cc:subject:date:message-id:reply-to:content-type;

bh=9oLou62vr8LXnHhjBv8ipkFGtbgY80chQiQCfMsjPO8=;

b=zmjrk+XADTDZB4mQuek2W8OBLuy2qxKgycCYBRNE0W21rfnmp7bdEy4HW1eCI9iM/6

BIetrc3CtNwh7LBh3TDBqaohfnItespTDoV5Fv2IR7nW8gWEyERujxjytubmf9yGDdpt

rBngUPtSrRoAo2IUdKBt5FSEnKTQz30NgQ8yOQu5Rq5nWTalDZ0sXt1fJBQI0zFsE1aE

jLOJUKLfNschS2Yt7ITd77BfkmuPqqtM/1Akml+sCEFYUhgHW7NFP9bJ8mjDJp3sBYfQ

XHPE8Vj89UQxNTzdwRj0oo1Vwh8BkfOD8mX2Vlsv7zVXnyAYrIcM2TcPxtxylOeFqFph

ysMQ==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20251104; t=1784897260; x=1785502060;

h=content-type:to:subject:message-id:date:from:sender:mime-version

:x-gm-gg:x-gm-message-state:from:to:cc:subject:date:message-id

:reply-to:content-type;

bh=9oLou62vr8LXnHhjBv8ipkFGtbgY80chQiQCfMsjPO8=;

b=GBgNP7uYRpNdATWD5UTTbDCmnyhGOx0mibDM+cn17jFM4xRFGt5orC9OzL8K8t2Xug

5831/G7Y60zMTWBw/8EaGH4P1WiVX/ytP2M175WCsF/1teby3KQ1Z7k1nJ7/RMsZUpRd

mo5IgT0LhuHnx8c0Kt0Q8ZL69uw67+rOzjLjr6B1QxnxOzLQip+t1v8u9DK2FRCmWcAH

KRYwVONkhIR2lVBoN5+bewfHxJ/rTJicDzAkGYQhBRHxbmnpxIVbQUqPgKFRPjCwFq/D

rlDbUq0jgW4kuA6nyvRlHfrou6fMR23K5ttEjOfkVkBpG9Lr1u2WyXyRHEfr/RShCYjl

rVMw==

X-Gm-Message-State: AOJu0YyS/GZYguoHOfWx2p7zEAKGE866OL14rg8Vjvrz8FGxSweuG+EY

EpMHFvs4avg2jgrOKqDO881pT1c3RsrtGUeJxD/wQWBL35uGVObkhfKG8qBGEGKzpVnnaue7ebx

0CpVE0ohNwhRNBSLDLBSvOzzyxY75+ymzv7ZJyLrmbgXzwiJR20d/zv5b7A==

X-Gm-Gg: AR+sD12GC4vdY1ReeP5SPDAyDQ2SV4OBW+rStroj4ny7+gi5cN8d5BWG8dgpesjBkNA

iNwS5+CoeY3jGu1yu9LYUrV0o/vlcngtyVFPwpdmtMsfKHSXYxcjqZ/t99VquUFF0nixrnAgmJx

SE5pNveVAaWVEv1pAkt271r8hBWKlSQl2JZWVUXyTn0hJ+lxeauuM+cHoPZ7XvNePVRuGcTnOgY

e2EAdlG76mVtKXWK6Pm03c7XJFQPrhPirhL4bRll9y7TuUIb0gkGkUZZAq6cjynqevOAywfT9mo

U7uU8Irl9qzSU80QRdN9

X-Received: by 2002:a05:651c:1548:b0:396:6d94:4a4b with SMTP id

38308e7fff4ca-39f2106280fmr644401fa.10.1784897259854; Fri, 24 Jul 2026

05:47:39 -0700 (PDT)

Received: from 706480606290 named unknown by gmailapi.google.com with

HTTPREST; Fri, 24 Jul 2026 07:47:37 -0500

Received: from 706480606290 named unknown by gmailapi.google.com with

HTTPREST; Fri, 24 Jul 2026 07:47:37 -0500

MIME-Version: 1.0

Sender: olivia@getanysolutions.com

From: olivia@getanysolutions.com

Date: Fri, 24 Jul 2026 07:47:37 -0500

X-Google-Sender-Auth: Z6VSRy7USWUIqfQkC5uj1X4OVrA

X-Gm-Features: AUfX_myd-edh3OQVtumgYr6086kDRow8w5NQDYLyOaCWo6FgX9sJNW7VpezAwh4

Message-ID:

Subject: One stop solution for nk.ca.

To: sales@nk.ca

Content-Type: multipart/alternative; boundary="00000000000022671f06575ac792"



--00000000000022671f06575ac792

Content-Type: text/plain; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable



Hello nk.ca,



After reviewing your nk.ca I can see a number of major issues which are

badly affecting your search engine presence and that is the reason you are

losing almost 42% of your potential traffic.



I would be happy to send you errors and the solutions that would help to

improve your nk.ca website performance and traffic.



We've been using AI-driven SEO methods lately that are helping clients

see steadier lead flow without the usual guesswork.



If you are interested, I can provide you with the list of issues and the

master plan
to perform far better as compared to your competitors.



Let me know if you are interested.





Regards,

Olivia Smith







Business Development

Executive------------------------------------------------------------------=

-------------------------PS

1: Please answer our email with =E2=80=9CInterested=E2=80=9D or =E2=80=9CNo=

t Interested=E2=80=9D=E2=80=AFso that we

will know the status of your inquiry and act accordingly. If you are

interested then I will send more details on our=E2=80=AF=E2=80=9Ccorporate

identity=E2=80=9D, =E2=80=9Ccompany profile=E2=80=9D, =E2=80=9CPrice list=

=E2=80=9D & =E2=80=9Cwhy you should choose us?=E2=80=99=E2=80=99




--00000000000022671f06575ac792

Content-Type: text/html; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable




0cm">Hello=C2=A0
">nk.ca
,


verdana, sans-serif">After reviewing your=C2=A0nk.=

ca
I can see a number of major issues which are badly affecting your se=

arch engine presence and that is the reason you are losing almost=C2=A0
ong>42%=C2=A0of your potential traffic.


in:9.2pt 0cm">I would be happy to send y=

ou errors and the solutions that would help to improve your=C2=A0
"http://nk.ca">nk.ca
=C2=A0website performance and traffic.


style=3D"margin:9.2pt 0cm">We've be=

en using=C2=A0AI-driven SEO=C2=A0methods lately that are helping cli=

ents see steadier lead flow without the usual guesswork.


=3D"margin:9.2pt 0cm">If you are=

interested, I can provide you with the list of issues and the master plan<=

/strong>=C2=A0to perform far better as compared to your competitors.
=

Let me=

know if you are interested.


in:0cm 0cm 0.0001pt;background-image:initial;background-position:initial;ba=

ckground-size:initial;background-repeat:initial;background-origin:initial;b=

ackground-clip:initial;line-height:normal">
f">
Regards,

Olivia Smith


ine-height:14.95px;background-image:initial;background-position:initial;bac=

kground-size:initial;background-repeat:initial;background-origin:initial;ba=

ckground-clip:initial">Business Developm=

ent Executive
----------------------------------------------------------=

---------------------------------
PS 1: Please answer our email with =E2=

=80=9CInterested=E2=80=9D or =E2=80=9CNot Interested=E2=80=9D=E2=80=AFso th=

at we will know the status of your inquiry and act accordingly. If you are =

interested then I will send more details on our=E2=80=AF=E2=80=9Ccorporate =

identity=E2=80=9D,=C2=A0=E2=80=9Ccompany profile=E2=80=9D,=C2=A0=E2=80=9CPr=

ice list=E2=80=9D & =E2=80=9Cwhy you should cho

e=3D"line-height:15.3333px;background-image:initial;background-position:ini=

tial;background-size:initial;background-repeat:initial;background-origin:in=

itial;background-clip:initial">ose us?=

=E2=80=99=E2=80=99=C2=A0









--00000000000022671f06575ac792--

web/SEO/App spam from Google Gmail

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Fri, 24 Jul 2026 07:30:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wnFy5-0000000093T-3gOB

for dave@doctor.nl2k.ab.ca;

Fri, 24 Jul 2026 07:29:37 -0600

Resent-From: The Doctor

Resent-Date: Fri, 24 Jul 2026 07:29:37 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-pj2-f11.google.com ([74.125.227.139]:44964)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wnF0B-00000000LUm-2h0E

for sales@nk.ca;

Fri, 24 Jul 2026 06:27:52 -0600

Received: by mail-pj2-f11.google.com with SMTP id d9443c01a7336-2cf02ecb572so6142895ad.1

for ; Fri, 24 Jul 2026 05:26:56 -0700 (PDT)

ARC-Seal: i=1; a=rsa-sha256; t=1784896010; cv=none;

d=google.com; s=arc-20260327;

b=ZApG2bdlKLrrTck+j64JUpCisr4KH8UXgS3hO4YNl/Yl09IhO0+b9KujuNuOZWd5Wq

zI2AbQD96fDloAmXa6ieQgaYNy8zMSWf6qFaltb8ufTxj/+yXQ/KyFrfVxmRLhYNp2aW

jBQJ7sonT7W9wSVCQqKAE+CCYES/dYsHbj/RxFgNg/4uj67O2ki3YqE7cEcplV/h2xTm

12GE2la2N5Pvn63gWknOO+bDgCVYswfbcZe1HYyOaZOlqr1Dvc4nl76AwMmktQC0i/Bs

A6DRUkx5Qu24QZvA1s6CCMOd/Oc/NGSGH2eGVxoazrit9iV+5wjt4aH/EW2/2mO+OGiW

5hLA==

ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20260327;

h=to:subject:message-id:date:from:sender:mime-version:dkim-signature;

bh=FQbBbPX/senAzy0ljPY7IWgVT0MnSTS3PGpF1qOQzYQ=;

fh=C4vsnDG7cTH8aa/8f7sygxKSfblX4MPDg6mph8A3jUw=;

b=TZVwx4IkhlbkgsDPQkL/7YL00hCzZ18tjF5PfVSCzV9B3mw2YYdTyPPXz0Ols/2ShQ

dUJ9aJn2NQG3hyGj5yfmFJliQJwWVBSbOfWNCeRsHcFjkgjnQCIXfMZg/oSo4RB+3abq

Yf8MrLtXDugLyFMLV6fnl2SBMu/Jz8tXV1TctR3mKTWSF8cLYBJ3Xu1z+2ZhwxnhjpXD

yxIPfB6GmdvV7cggj7WaIfNH29nUs903wlMsWLJfFsG/5Fkfr7I4wqc5CWWvb8aPeSuB

WpUetv9+Xe9CMkEOLhaejwAdotlsuhGoddbUoxG9vutfBV2H2QBO1dHWUae+kLXADBnJ

sG6g==;

darn=nk.ca

ARC-Authentication-Results: i=1; mx.google.com; arc=none

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=getanysolutions-com.20251104.gappssmtp.com; s=20251104; t=1784896010; x=1785500810; darn=nk.ca;

h=content-type:to:subject:message-id:date:from:sender:mime-version

:from:to:cc:subject:date:message-id:reply-to:content-type;

bh=FQbBbPX/senAzy0ljPY7IWgVT0MnSTS3PGpF1qOQzYQ=;

b=U+mSp6opyCeWm6b5bGxNJmiDWo6NVA25mjQ1BaSAZBXulnZzQB5yBBuYZJqkmpMI+H

bI/OK0ZfUubtc55P/e0lRxMZU2Vc6LtkrrkvthA8zG+SoGKgsPcY6Dcy1UrQFi3rJSe4

nSxXkbgUmm43B6OT2AQw6hex3T9YaZJ4Bonl8xWS6qj+/ozxs0zv2IDThHCbsaHBl2Le

CvD9JvVC9ylN73gJVzP3Agj8+Z96D8bi3l49SJox8wElVlmHek+lXFWRJE1D6r1EaUVI

YkVVvruK4q+xIclaTT2dg+3/HCJeFZ+WIXbR79AmRFJmKw/pVqX7Up2vOUIfD1rkf6Bp

AF1A==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20251104; t=1784896010; x=1785500810;

h=content-type:to:subject:message-id:date:from:sender:mime-version

:x-gm-gg:x-gm-message-state:from:to:cc:subject:date:message-id

:reply-to:content-type;

bh=FQbBbPX/senAzy0ljPY7IWgVT0MnSTS3PGpF1qOQzYQ=;

b=LZbVpgNGFpdbmyUHbGjCGjOsBzSDd1AClUN3KsIidNPZcSYVxqoamG4jnJtXipdldr

w4chTuFx8Y8Ed62OP1+kGPjifQUVhmeC3KSuy1D/cG0dxeCClOw6Qk07GaD7MHGrcgM9

rLaNc2ShZips5H3vemKAoizu2u+Q7EujehNLWWnZgJ7/46I/Fx2JWrbMsc0hnOLmaIQi

uvqU9RphpB6o2EbKJOGPt6B0kLM0JdsB8YmtE9PRXmI8YWTgMwMtnC72kPzvheYZrDwq

flrJTPJNryK0gqknBGcxS+vwGEOFAhxBP6Pbye+xy+e65rQNSGAZ9r3RnGEa0+h4lGkW

KNNw==

X-Gm-Message-State: AOJu0YyXM8dIZdKEKLNOkXaNaik31K4bpdr6AMuOimWUlF1t5Ysesw7z

xZO/1oPKCesErDFA8gQeQDYhTS7IDw76HCNSBFruGvKfgRMe8tbMlp1KHSHZkPOenB9E/dX0IxG

mSNzfkA9bmpAWS6xrycIeZ/H8KD4wXfZKg+t1Wray8bDDNJF+gujRhb48Lg==

X-Gm-Gg: AR+sD137gNHioG08Qnyc6nj2duSNz1uQqApy57WN2EfidSexNfH2N+eYL34iqWzi+vF

yMUzh+AMfyFmsyziIPchMKfCpU1BoQU7ZKQyX1YVTL5t+Ub2TrQnhiH/aTgrfDfwaBwE1FK9VPX

rNrV4YpGPD7IwmATgEdDzsGSVTzvNR+cXwGF8AgbhJ1hG28VPRk6i02PrjbQBbicxZUgUZS2Ca1

UX9qQhR+ueMhx28RTUcOzrVPfTKJepd79t3+C3JuKZCNv55p+a0DxPsyr3PoCXmcFQpPTX3E8FC

w/5bQTR7BKwV7E7wya4D8X5g0FtYvWE=

X-Received: by 2002:a05:6a20:b08d:b0:3b3:1c7b:ffb with SMTP id

adf61e73a8af0-3c44b05ceccmr7678373637.34.1784896010536; Fri, 24 Jul 2026

05:26:50 -0700 (PDT)

Received: from 706480606290 named unknown by gmailapi.google.com with

HTTPREST; Fri, 24 Jul 2026 05:26:40 -0700

Received: from 706480606290 named unknown by gmailapi.google.com with

HTTPREST; Fri, 24 Jul 2026 05:26:40 -0700

MIME-Version: 1.0

Sender: olivia@getanysolutions.com

From: olivia@getanysolutions.com

Date: Fri, 24 Jul 2026 05:26:40 -0700

X-Google-Sender-Auth: 58PXa29noXahdOTNQfVrITfNCYc

X-Gm-Features: AUfX_mwX67Eqxy0fHEhVdrLh_nUtGJQHd_6xFyp7cf55nFK-FmqGZMMZ0SAy3RE

Message-ID:

Subject: One stop solution for nk.ca.

To: sales@nk.ca

Content-Type: multipart/alternative; boundary="000000000000ab557506575a7c75"



--000000000000ab557506575a7c75

Content-Type: text/plain; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable



Hello nk.ca,



After reviewing your nk.ca I can see a number of major issues which are

badly affecting your search engine presence and that is the reason you are

losing almost 42% of your potential traffic.



I would be happy to send you errors and the solutions that would help to

improve your nk.ca website performance and traffic.



We've been using AI-driven SEO methods lately that are helping clients

see steadier lead flow without the usual guesswork.



If you are interested, I can provide you with the list of issues and the

master plan
to perform far better as compared to your competitors.



Let me know if you are interested.





Regards,

Olivia Smith







Business Development

Executive------------------------------------------------------------------=

-------------------------PS

1: Please answer our email with =E2=80=9CInterested=E2=80=9D or =E2=80=9CNo=

t Interested=E2=80=9D=E2=80=AFso that we

will know the status of your inquiry and act accordingly. If you are

interested then I will send more details on our=E2=80=AF=E2=80=9Ccorporate

identity=E2=80=9D, =E2=80=9Ccompany profile=E2=80=9D, =E2=80=9CPrice list=

=E2=80=9D & =E2=80=9Cwhy you should choose us?=E2=80=99=E2=80=99




--000000000000ab557506575a7c75

Content-Type: text/html; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable




0cm">Hello=C2=A0
">nk.ca
,


verdana, sans-serif">After reviewing your=C2=A0nk.=

ca
I can see a number of major issues which are badly affecting your se=

arch engine presence and that is the reason you are losing almost=C2=A0
ong>42%
=C2=A0of your potential traffic.


in:9.2pt 0cm">I would be happy to send y=

ou errors and the solutions that would help to improve your=C2=A0
"http://nk.ca">nk.ca
=C2=A0website performance and traffic.


style=3D"margin:9.2pt 0cm">We've be=

en using=C2=A0AI-driven SEO=C2=A0methods lately that are helping cli=

ents see steadier lead flow without the usual guesswork.


=3D"margin:9.2pt 0cm">If you are=

interested, I can provide you with the list of issues and the master plan<=

/strong>=C2=A0to perform far better as compared to your competitors.
=

Let me=

know if you are interested.


in:0cm 0cm 0.0001pt;background-image:initial;background-position:initial;ba=

ckground-size:initial;background-repeat:initial;background-origin:initial;b=

ackground-clip:initial;line-height:normal">
f">
Regards,

Olivia Smith


ine-height:14.95px;background-image:initial;background-position:initial;bac=

kground-size:initial;background-repeat:initial;background-origin:initial;ba=

ckground-clip:initial">Business Developm=

ent Executive
----------------------------------------------------------=

---------------------------------
PS 1: Please answer our email with =E2=

=80=9CInterested=E2=80=9D or =E2=80=9CNot Interested=E2=80=9D=E2=80=AFso th=

at we will know the status of your inquiry and act accordingly. If you are =

interested then I will send more details on our=E2=80=AF=E2=80=9Ccorporate =

identity=E2=80=9D,=C2=A0=E2=80=9Ccompany profile=E2=80=9D,=C2=A0=E2=80=9CPr=

ice list=E2=80=9D & =E2=80=9Cwhy you should cho

e=3D"line-height:15.3333px;background-image:initial;background-position:ini=

tial;background-size:initial;background-repeat:initial;background-origin:in=

itial;background-clip:initial">ose us?=

=E2=80=99=E2=80=99=C2=A0









--000000000000ab557506575a7c75--

Interactive Brokers Canada Inc. from Google Gmail

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Fri, 24 Jul 2026 07:30:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wnFyI-0000000094d-0S5B

for dave@doctor.nl2k.ab.ca;

Fri, 24 Jul 2026 07:29:50 -0600

Resent-From: The Doctor

Resent-Date: Fri, 24 Jul 2026 07:29:49 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from vldkj.com ([35.212.57.57]:48205 helo=promos.vldkj.com)

by doctor.nl2k.ab.ca with esmtp (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wnFFc-00000000Mmm-42rD

for sales@nk.ca;

Fri, 24 Jul 2026 06:43:48 -0600

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; s=default; d=promos.vldkj.com;

h=Content-Type:MIME-Version:From:To:Subject:Date:Message-ID;

i=contact@zcytew.promos.vldkj.com;

bh=Of4ynqf8y0soT0yu0QgzJPUDD0YipoN1JkB4iNauo7g=;

b=ryhcNOybb+qW7TDwuHc37CTIGgO90M9JiI5TkA9i0tSRMKpgf1q9Grza2apN5/1mebDp0Hp5/nQr

ZM94rIeg9CNmyWAllrTTnADjg/ohf85TgnUuIYhKv6g6FfhU4ulwSFQzixxUhwJxDwMXBSUh6K7h

gx40Dy8ErJZ69SgQAN+cRZlnPBBFKPd9xmJJHWzSr+08mAn0f2y5tozTQfa/rGFRAJsr7Ny9HPNi

lYbumZo2AOA6v5I9PM2+5ZkVJvjcV10T70sNUv4slG1mxFHj5lK0O+gw1nnyl84OLgIkCNfm0QBv

zxWvjWhm85CZEdZclA3k4FqKkR3iZtQP89QiWQ==

Content-Type: multipart/alternative;

boundary="===============7232632550120936226=="

MIME-Version: 1.0

From: =?utf-8?b?SeKAi0LigItL4oCLUg==?=

To: sales@nk.ca

Subject: =?utf-8?q?Security_Alert_=E2=80=94_Unrecognized_Sign-In_Activity_De?=

=?utf-8?q?tected_on_Your_Account?=

Date: Fri, 24 Jul 2026 21:42:53 +0900

Message-ID: <178489697341.3404.2409268673890319677@zcytew.promos.vldkj.com>

List-Unsubscribe-Post: List-Unsubscribe=One-Click

X-Auto-Response-Suppress: OOF, DR, RN, NRN

Feedback-ID: campaign:zcytew.promos.vldkj.com:mailer

X-Entity-Ref-ID: 550fbed0-ff33-45f3-872d-74cb1792c37b

X-Spam_score: 13.3

X-Spam_score_int: 133

X-Spam_bar: +++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: [Interactive Brokers Canada] Security Alert — Unrecognized

Sign-In Activity Detected on Your Account Dear sales, Interactive Brokers

Canada's security monitoring system has detected sign-in activity on your

account that deviates from your established access pattern. This notification

is generated automatically w [...]



Content analysis details: (13.3 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[35.212.57.57 listed in dnsbl.ahbl.org]

[35.212.57.57 listed in dnsbl.ahbl.org]

[35.212.57.57 listed in dnsbl.ahbl.org]

[35.212.57.57 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[35.212.57.57 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[35.212.57.57 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[35.212.57.57 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[35.212.57.57 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[35.212.57.57 listed in will-spam-for-food.eu.org]

[35.212.57.57 listed in will-spam-for-food.eu.org]

[35.212.57.57 listed in will-spam-for-food.eu.org]

[35.212.57.57 listed in will-spam-for-food.eu.org]

[35.212.57.57 listed in will-spam-for-food.eu.org]

[35.212.57.57 listed in will-spam-for-food.eu.org]

[35.212.57.57 listed in will-spam-for-food.eu.org]

[35.212.57.57 listed in will-spam-for-food.eu.org]

-0.0 SPF_HELO_PASS SPF: HELO matches SPF record

-0.0 SPF_PASS SPF: sender matches SPF record

2.5 URIBL_DBL_SPAM Contains a spam URL listed in the DBL blocklist

[URI: vldkj.com]

1.9 URIBL_JP_SURBL Contains an URL listed in the JP SURBL blocklist

[URI: vldkj.com]

1.9 URIBL_ABUSE_SURBL Contains an URL listed in the ABUSE SURBL blocklist

[URI: promos.vldkj.com]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-0.0 T_RP_MATCHES_RCVD Envelope sender domain matches handover relay

domain

1.5 TVD_PH_SEC BODY: Message includes a phrase commonly used in phishing

mails

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[35.212.57.57 listed in bl.score.senderscore.com]

1.5 MR_STRANGE_QUESTION URI: No description available.

1.3 URI_HEX URI: URI hostname has long hexadecimal sequence

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.5 VOWEL_FROM_5 Impronouncable from header (6 consecutive vowels)

0.8 SARE_FROM_SPAM_WORD3 I don't know people named this!

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

0.0 T_FILL_THIS_FORM_SHORT Fill in a short form with personal information

Subject: {SPAM?} =?utf-8?q?Security_Alert_=E2=80=94_Unrecognized_Sign-In_Activity_De?=

=?utf-8?q?tected_on_Your_Account?=



Interactive Brokers Canada Inc. — CIRO Dealer Member • CIPF Participant



Interactive Brokers Canada



Security Alert — Immediate Attention Required



Unrecognized Sign-In Activity Detected on Your Account



Dear sales,



Interactive Brokers Canada’s security monitoring system has detected sign-in activity on your account that deviates from your established access pattern. This notification is generated automatically when our systems identify authentication attempts exhibiting characteristics inconsistent with your historical usage profile.



We request that you review the following session details and confirm whether this activity was authorized. If you do not recognize this sign-in attempt, your account security may be compromised and immediate protective measures are warranted.



Session Activity Details



Unrecognized Sign-In Attempt



Status: Authentication successful Unusual Pattern



Origin IP: [Address geolocated outside your typical access region]



Location: [City, Country — inconsistent with your registered address and prior activity]



Device: Unrecognized device — no prior association with your account



Browser: [Browser and operating system not previously used to access your account]



Time: [Timestamp of the sign-in attempt in Eastern Time]



Action Required



If you recognize this activity, no further action is required beyond confirming the sign-in through the Client Portal. If you do not recognize this sign-in attempt, your credentials may have been compromised. In that case, Interactive Brokers Canada strongly recommends an immediate password reset, enrolment in two-factor authentication (if not already active), and a comprehensive review of recent account activity including order history, funding transactions, and personal information changes.



Your account security is a matter of the highest priority. Please take a moment to verify this activity now. Review requires approximately two minutes.

Review Sign-In Activity



Interactive Brokers Client Portal — Security Centre > Recent Activity



If you believe your account has been accessed without your authorization, contact Interactive Brokers Canada Client Services immediately. Our security team can assist with account lockdown procedures, credential reset, and activity audit.



1-877-745-4222



Monday through Friday, 8:00 a.m. to 5:30 p.m. Eastern Time



Interactive Brokers Canada employs continuous security monitoring to protect client accounts. This alert is part of our commitment to safeguarding your assets and personal information against unauthorized access.



Interactive Brokers Canada Inc.



Information Security Operations Centre



Interactive Brokers Canada Inc. is a member of the Canadian Investment Regulatory Organization (CIRO) and the Canadian Investor Protection Fund (CIPF). Registered office: 1800 McGill College Avenue, Suite 2106, Montreal, Quebec, H3A 3J6. This security notification is automatically generated. Clients are responsible for safeguarding their login credentials and for immediately reporting any suspected unauthorized account activity. Interactive Brokers Canada will never request your password or two-factor authentication code via email or telephone.



CIRO Member • CIPF Participant

Interactive Brokers Canada phish from Google User

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Fri, 24 Jul 2026 07:30:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wnFyL-0000000095D-3nYg

for dave@doctor.nl2k.ab.ca;

Fri, 24 Jul 2026 07:29:53 -0600

Resent-From: The Doctor

Resent-Date: Fri, 24 Jul 2026 07:29:53 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from cntv-didiaokanqiu.com ([35.212.81.252]:46559 helo=delivery.cntv-didiaokanqiu.com)

by doctor.nl2k.ab.ca with esmtp (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wnFFx-00000000MpM-2OhG

for root@nk.ca;

Fri, 24 Jul 2026 06:44:09 -0600

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; s=default;

d=delivery.cntv-didiaokanqiu.com;

h=Content-Type:MIME-Version:From:To:Subject:Date:Message-ID;

i=newsletter@mdzqcl.delivery.cntv-didiaokanqiu.com;

bh=0HyYSce3vu3wD6H4MHp3R2C5/FZf8hSC75cd6vIsllI=;

b=XIO30kN0JOkp6cbeaWndYLBxelKxoqS4zj5J5dce71iS+ZpY2gZOTVAourSoxE58Cjvv6qhEjhu5

D6SihtIsj+HSgMbnK2ucNsemyg0NtO4kJ4p1U+J14pHeFe+74K57WDJQ0LNCxTfceAd69dY1wMSN

L50c5IQkxD+oXKM1MSptg55u5Ot1aMuDwSH2nuO7Xv6m6f4gf8k7M+IMXJNEiEi8fKHIZRPbll6t

xdfgPUuhXFbMiNlulF+r0XAOF6EKunccfVDzK/0FMyD0zCVTAouKSLP14gX8IFClho033qQK2XBu

QYQtxLVLZn+gIjXssVIA4XsZVZJr0x4MtngKaQ==

Content-Type: multipart/alternative;

boundary="===============7792457910886774540=="

MIME-Version: 1.0

From:

=?utf-8?b?SeKAi0LigItL4oCLUuKAiyDigItD4oCLbOKAi2nigItl4oCLbuKAi3TigIsg4oCLU+KAi2XigIty4oCLduKAi2nigItj4oCLZeKAi3M=?=



To: root@nk.ca

Subject: =?utf-8?q?=5BTax_Compliance=5D_Mid-Year_SIN_Verification_=E2=80=94_?=

=?utf-8?q?T5_and_T5008_Slip_Accuracy_Pre-Audit?=

Date: Fri, 24 Jul 2026 21:43:14 +0900

Message-ID:

<178489699431.3368.17386419979951599710@mdzqcl.delivery.cntv-didiaokanqiu.com>

List-Unsubscribe-Post: List-Unsubscribe=One-Click

X-Auto-Response-Suppress: OOF, DR, RN, NRN

Feedback-ID: campaign:mdzqcl.delivery.cntv-didiaokanqiu.com:mailer

X-Entity-Ref-ID: 09e05f87-d405-4065-8100-aa9bb2977031

X-Spam_score: 12.2

X-Spam_score_int: 122

X-Spam_bar: ++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: [Interactive Brokers Canada] Tax Compliance — Mid-Year SIN

Verification — T5 and T5008 Slip Accuracy Pre-Audit Dear root, Interactive

Brokers Canada Inc., as an issuer of Canadian tax information slips, is required

under the Income Tax Act (Canada) to file T5 (Statement of Investment Income),

T5008 (Statement of Securiti [...]



Content analysis details: (12.2 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[35.212.81.252 listed in dnsbl.ahbl.org]

[35.212.81.252 listed in dnsbl.ahbl.org]

[35.212.81.252 listed in dnsbl.ahbl.org]

[35.212.81.252 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[35.212.81.252 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[35.212.81.252 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[35.212.81.252 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[35.212.81.252 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[35.212.81.252 listed in will-spam-for-food.eu.org]

[35.212.81.252 listed in will-spam-for-food.eu.org]

[35.212.81.252 listed in will-spam-for-food.eu.org]

[35.212.81.252 listed in will-spam-for-food.eu.org]

[35.212.81.252 listed in will-spam-for-food.eu.org]

[35.212.81.252 listed in will-spam-for-food.eu.org]

[35.212.81.252 listed in will-spam-for-food.eu.org]

[35.212.81.252 listed in will-spam-for-food.eu.org]

-0.0 SPF_HELO_PASS SPF: HELO matches SPF record

-0.0 SPF_PASS SPF: sender matches SPF record

1.9 URIBL_JP_SURBL Contains an URL listed in the JP SURBL blocklist

[URI: cntv-didiaokanqiu.com]

1.9 URIBL_ABUSE_SURBL Contains an URL listed in the ABUSE SURBL blocklist

[URI: delivery.cntv-didiaokanqiu.com]

2.5 URIBL_DBL_SPAM Contains a spam URL listed in the DBL blocklist

[URI: cntv-didiaokanqiu.com]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-0.0 T_RP_MATCHES_RCVD Envelope sender domain matches handover relay

domain

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[35.212.81.252 listed in bl.score.senderscore.com]

1.5 MR_STRANGE_QUESTION URI: No description available.

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 LOTS_OF_MONEY Huge... sums of money

1.5 VOWEL_FROM_6 Impronouncable from header (6 consecutive vowels)

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

1.5 TVD_PH_BODY_ACCOUNTS_PRE The body matches phrases such as "accounts

suspended", "account credited", "account

verification"

0.0 T_FILL_THIS_FORM_SHORT Fill in a short form with personal information

0.0 T_FILL_THIS_FORM_FRAUD_PHISH Answer suspicious question(s)

Subject: {SPAM?} =?utf-8?q?=5BTax_Compliance=5D_Mid-Year_SIN_Verification_=E2=80=94_?=

=?utf-8?q?T5_and_T5008_Slip_Accuracy_Pre-Audit?=



Interactive Brokers Canada Inc. — CIRO Dealer Member • CIPF Participant



Interactive Brokers Canada



Tax Compliance — CRA Reporting



Mid-Year SIN and Tax Information Verification — T5/T5008 Slip Accuracy



Dear root,



Interactive Brokers Canada Inc., as an issuer of Canadian tax information slips, is required under the Income Tax Act (Canada) to file T5 (Statement of Investment Income), T5008 (Statement of Securities Transactions), and, where applicable, T1135 (Foreign Income Verification Statement) information returns with the Canada Revenue Agency (CRA). The accuracy of these filings depends on the completeness and correctness of the taxpayer identification and account profile information maintained in our records.



This mid-year verification is a routine compliance procedure. It is designed to identify and correct any discrepancies in your Social Insurance Number (SIN), legal name, date of birth, and residential address before the annual tax information slip production cycle commences. Ensuring these records are accurate now prevents the issuance of corrected slips, CRA matching errors, and subsequent tax filing complications.



Tax Information Slips Issued by Interactive Brokers Canada



T5



Statement of Investment Income

Reports dividend income, interest income, and foreign income paid or credited to your account during the tax year. Issued annually to you and the CRA.



T5008



Statement of Securities Transactions

Reports proceeds of disposition from the sale or redemption of securities. Used to calculate capital gains and losses on your income tax return.



T1135



Foreign Income Verification Statement

Applicable where the aggregate cost of specified foreign property exceeds CAD 100,000. Interactive Brokers Canada provides cost basis data to support this filing.



Critical Verification Item



Your Social Insurance Number (SIN) is the primary identifier used by the CRA to match tax information slips to your individual tax return. A SIN mismatch between Interactive Brokers Canada’s records and CRA records will result in the rejection of your T5 and T5008 filings, potentially triggering a CRA review of your tax return, delayed assessment, and the administrative burden of requesting corrected slips.



Information Requiring Confirmation

Social Insurance Number Must match the SIN registered with the CRA. The SIN on file will be used to populate Box 22 (Recipient Identification Number) on T5 slips and the corresponding identification field on T5008 slips.

Legal Name Must match the name as it appears on your CRA Notice of Assessment. Discrepancies between the name on file and CRA records will cause SIN-matching failures even if the SIN itself is correct.

Date of Birth Used as a secondary identifier in CRA matching routines. An incorrect date of birth can contribute to information slip rejection.

Residential Address Must reflect your current physical residence for provincial tax allocation purposes. The province of residence determines the applicable provincial tax rates and credits reported on your tax information slips.

Tax Residency Status Confirmation that your Canadian tax residency status is correctly recorded. Non-resident account holders are subject to different withholding and reporting requirements under Part XIII of the Income Tax Act.



Common Reporting Standard (CRS) and FATCA



In addition to domestic CRA reporting, Interactive Brokers Canada Inc. is required to comply with the OECD Common Reporting Standard (CRS) and the Canada–US Foreign Account Tax Compliance Act (FATCA) Intergovernmental Agreement. Tax residency information on file is used to determine CRS and FATCA reporting obligations. Accurate tax residency classification prevents unnecessary reporting to foreign tax authorities.

Verify Tax Information



Interactive Brokers Client Portal — Settings > Tax Profile > SIN and Identification



Interactive Brokers Canada Inc. does not provide tax advice. For questions regarding the tax treatment of investment income, T5/T5008 reporting, or your individual tax filing obligations, consult a qualified tax professional. For technical assistance updating your SIN or tax profile information, contact Interactive Brokers Canada Client Services.



1-877-745-4222



Monday through Friday, 8:00 a.m. to 5:30 p.m. Eastern Time



Accurate tax information reporting benefits all parties. It ensures that your investment income is correctly attributed to your CRA account, minimizes the likelihood of CRA review queries, and supports the timely processing of your annual tax return.



Interactive Brokers Canada Inc.



Tax Operations Division



Interactive Brokers Canada Inc. is a member of the Canadian Investment Regulatory Organization (CIRO) and the Canadian Investor Protection Fund (CIPF). Registered office: 1800 McGill College Avenue, Suite 2106, Montreal, Quebec, H3A 3J6. The tax information slip data reported to the CRA is based on the account holder information on file as of the slip production date. Account holders are responsible for ensuring the accuracy of their personal and tax identification information. This communication does not constitute tax advice.



CIRO Member • CIPF Participant

Interactive Brokers Canada phish from Google User

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Fri, 24 Jul 2026 07:30:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wnFyL-0000000095D-3nYg

for dave@doctor.nl2k.ab.ca;

Fri, 24 Jul 2026 07:29:53 -0600

Resent-From: The Doctor

Resent-Date: Fri, 24 Jul 2026 07:29:53 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from cntv-didiaokanqiu.com ([35.212.81.252]:46559 helo=delivery.cntv-didiaokanqiu.com)

by doctor.nl2k.ab.ca with esmtp (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wnFFx-00000000MpM-2OhG

for root@nk.ca;

Fri, 24 Jul 2026 06:44:09 -0600

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; s=default;

d=delivery.cntv-didiaokanqiu.com;

h=Content-Type:MIME-Version:From:To:Subject:Date:Message-ID;

i=newsletter@mdzqcl.delivery.cntv-didiaokanqiu.com;

bh=0HyYSce3vu3wD6H4MHp3R2C5/FZf8hSC75cd6vIsllI=;

b=XIO30kN0JOkp6cbeaWndYLBxelKxoqS4zj5J5dce71iS+ZpY2gZOTVAourSoxE58Cjvv6qhEjhu5

D6SihtIsj+HSgMbnK2ucNsemyg0NtO4kJ4p1U+J14pHeFe+74K57WDJQ0LNCxTfceAd69dY1wMSN

L50c5IQkxD+oXKM1MSptg55u5Ot1aMuDwSH2nuO7Xv6m6f4gf8k7M+IMXJNEiEi8fKHIZRPbll6t

xdfgPUuhXFbMiNlulF+r0XAOF6EKunccfVDzK/0FMyD0zCVTAouKSLP14gX8IFClho033qQK2XBu

QYQtxLVLZn+gIjXssVIA4XsZVZJr0x4MtngKaQ==

Content-Type: multipart/alternative;

boundary="===============7792457910886774540=="

MIME-Version: 1.0

From:

=?utf-8?b?SeKAi0LigItL4oCLUuKAiyDigItD4oCLbOKAi2nigItl4oCLbuKAi3TigIsg4oCLU+KAi2XigIty4oCLduKAi2nigItj4oCLZeKAi3M=?=



To: root@nk.ca

Subject: =?utf-8?q?=5BTax_Compliance=5D_Mid-Year_SIN_Verification_=E2=80=94_?=

=?utf-8?q?T5_and_T5008_Slip_Accuracy_Pre-Audit?=

Date: Fri, 24 Jul 2026 21:43:14 +0900

Message-ID:

<178489699431.3368.17386419979951599710@mdzqcl.delivery.cntv-didiaokanqiu.com>

List-Unsubscribe-Post: List-Unsubscribe=One-Click

X-Auto-Response-Suppress: OOF, DR, RN, NRN

Feedback-ID: campaign:mdzqcl.delivery.cntv-didiaokanqiu.com:mailer

X-Entity-Ref-ID: 09e05f87-d405-4065-8100-aa9bb2977031

X-Spam_score: 12.2

X-Spam_score_int: 122

X-Spam_bar: ++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: [Interactive Brokers Canada] Tax Compliance — Mid-Year SIN

Verification — T5 and T5008 Slip Accuracy Pre-Audit Dear root, Interactive

Brokers Canada Inc., as an issuer of Canadian tax information slips, is required

under the Income Tax Act (Canada) to file T5 (Statement of Investment Income),

T5008 (Statement of Securiti [...]



Content analysis details: (12.2 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[35.212.81.252 listed in dnsbl.ahbl.org]

[35.212.81.252 listed in dnsbl.ahbl.org]

[35.212.81.252 listed in dnsbl.ahbl.org]

[35.212.81.252 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[35.212.81.252 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[35.212.81.252 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[35.212.81.252 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[35.212.81.252 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[35.212.81.252 listed in will-spam-for-food.eu.org]

[35.212.81.252 listed in will-spam-for-food.eu.org]

[35.212.81.252 listed in will-spam-for-food.eu.org]

[35.212.81.252 listed in will-spam-for-food.eu.org]

[35.212.81.252 listed in will-spam-for-food.eu.org]

[35.212.81.252 listed in will-spam-for-food.eu.org]

[35.212.81.252 listed in will-spam-for-food.eu.org]

[35.212.81.252 listed in will-spam-for-food.eu.org]

-0.0 SPF_HELO_PASS SPF: HELO matches SPF record

-0.0 SPF_PASS SPF: sender matches SPF record

1.9 URIBL_JP_SURBL Contains an URL listed in the JP SURBL blocklist

[URI: cntv-didiaokanqiu.com]

1.9 URIBL_ABUSE_SURBL Contains an URL listed in the ABUSE SURBL blocklist

[URI: delivery.cntv-didiaokanqiu.com]

2.5 URIBL_DBL_SPAM Contains a spam URL listed in the DBL blocklist

[URI: cntv-didiaokanqiu.com]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-0.0 T_RP_MATCHES_RCVD Envelope sender domain matches handover relay

domain

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[35.212.81.252 listed in bl.score.senderscore.com]

1.5 MR_STRANGE_QUESTION URI: No description available.

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 LOTS_OF_MONEY Huge... sums of money

1.5 VOWEL_FROM_6 Impronouncable from header (6 consecutive vowels)

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

1.5 TVD_PH_BODY_ACCOUNTS_PRE The body matches phrases such as "accounts

suspended", "account credited", "account

verification"

0.0 T_FILL_THIS_FORM_SHORT Fill in a short form with personal information

0.0 T_FILL_THIS_FORM_FRAUD_PHISH Answer suspicious question(s)

Subject: {SPAM?} =?utf-8?q?=5BTax_Compliance=5D_Mid-Year_SIN_Verification_=E2=80=94_?=

=?utf-8?q?T5_and_T5008_Slip_Accuracy_Pre-Audit?=



Interactive Brokers Canada Inc. — CIRO Dealer Member • CIPF Participant



Interactive Brokers Canada



Tax Compliance — CRA Reporting



Mid-Year SIN and Tax Information Verification — T5/T5008 Slip Accuracy



Dear root,



Interactive Brokers Canada Inc., as an issuer of Canadian tax information slips, is required under the Income Tax Act (Canada) to file T5 (Statement of Investment Income), T5008 (Statement of Securities Transactions), and, where applicable, T1135 (Foreign Income Verification Statement) information returns with the Canada Revenue Agency (CRA). The accuracy of these filings depends on the completeness and correctness of the taxpayer identification and account profile information maintained in our records.



This mid-year verification is a routine compliance procedure. It is designed to identify and correct any discrepancies in your Social Insurance Number (SIN), legal name, date of birth, and residential address before the annual tax information slip production cycle commences. Ensuring these records are accurate now prevents the issuance of corrected slips, CRA matching errors, and subsequent tax filing complications.



Tax Information Slips Issued by Interactive Brokers Canada



T5



Statement of Investment Income

Reports dividend income, interest income, and foreign income paid or credited to your account during the tax year. Issued annually to you and the CRA.



T5008



Statement of Securities Transactions

Reports proceeds of disposition from the sale or redemption of securities. Used to calculate capital gains and losses on your income tax return.



T1135



Foreign Income Verification Statement

Applicable where the aggregate cost of specified foreign property exceeds CAD 100,000. Interactive Brokers Canada provides cost basis data to support this filing.



Critical Verification Item



Your Social Insurance Number (SIN) is the primary identifier used by the CRA to match tax information slips to your individual tax return. A SIN mismatch between Interactive Brokers Canada’s records and CRA records will result in the rejection of your T5 and T5008 filings, potentially triggering a CRA review of your tax return, delayed assessment, and the administrative burden of requesting corrected slips.



Information Requiring Confirmation

Social Insurance Number Must match the SIN registered with the CRA. The SIN on file will be used to populate Box 22 (Recipient Identification Number) on T5 slips and the corresponding identification field on T5008 slips.

Legal Name Must match the name as it appears on your CRA Notice of Assessment. Discrepancies between the name on file and CRA records will cause SIN-matching failures even if the SIN itself is correct.

Date of Birth Used as a secondary identifier in CRA matching routines. An incorrect date of birth can contribute to information slip rejection.

Residential Address Must reflect your current physical residence for provincial tax allocation purposes. The province of residence determines the applicable provincial tax rates and credits reported on your tax information slips.

Tax Residency Status Confirmation that your Canadian tax residency status is correctly recorded. Non-resident account holders are subject to different withholding and reporting requirements under Part XIII of the Income Tax Act.



Common Reporting Standard (CRS) and FATCA



In addition to domestic CRA reporting, Interactive Brokers Canada Inc. is required to comply with the OECD Common Reporting Standard (CRS) and the Canada–US Foreign Account Tax Compliance Act (FATCA) Intergovernmental Agreement. Tax residency information on file is used to determine CRS and FATCA reporting obligations. Accurate tax residency classification prevents unnecessary reporting to foreign tax authorities.

Verify Tax Information



Interactive Brokers Client Portal — Settings > Tax Profile > SIN and Identification



Interactive Brokers Canada Inc. does not provide tax advice. For questions regarding the tax treatment of investment income, T5/T5008 reporting, or your individual tax filing obligations, consult a qualified tax professional. For technical assistance updating your SIN or tax profile information, contact Interactive Brokers Canada Client Services.



1-877-745-4222



Monday through Friday, 8:00 a.m. to 5:30 p.m. Eastern Time



Accurate tax information reporting benefits all parties. It ensures that your investment income is correctly attributed to your CRA account, minimizes the likelihood of CRA review queries, and supports the timely processing of your annual tax return.



Interactive Brokers Canada Inc.



Tax Operations Division



Interactive Brokers Canada Inc. is a member of the Canadian Investment Regulatory Organization (CIRO) and the Canadian Investor Protection Fund (CIPF). Registered office: 1800 McGill College Avenue, Suite 2106, Montreal, Quebec, H3A 3J6. The tax information slip data reported to the CRA is based on the account holder information on file as of the slip production date. Account holders are responsible for ensuring the accuracy of their personal and tax identification information. This communication does not constitute tax advice.



CIRO Member • CIPF Participant

French language rental demand phish from Google Gmail

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Fri, 24 Jul 2026 10:05:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wnINi-00000000MGX-2GD5

for dave@doctor.nl2k.ab.ca;

Fri, 24 Jul 2026 10:04:14 -0600

Resent-From: The Doctor

Resent-Date: Fri, 24 Jul 2026 10:04:14 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-ed2-f10.google.com ([74.125.228.74]:36434)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.99.3 (FreeBSD))

(envelope-from <32744@ppk.ac.th>)

id 1wnGpT-00000000Dzw-1fwI

for root@nk.ca;

Fri, 24 Jul 2026 08:24:57 -0600

Received: by mail-ed2-f10.google.com with SMTP id 4fb4d7f45d1cf-69f81c7774bso308423a12.1

for ; Fri, 24 Jul 2026 07:23:59 -0700 (PDT)

ARC-Seal: i=1; a=rsa-sha256; t=1784903032; cv=none;

d=google.com; s=arc-20260327;

b=oqGslwAPORZ87jQI/hrpYxoIbMh9C3qLVJycZh/urBFKG/ej2/ZbJEhfcvm9Snfxmi

R7xJBtpDcFukndv4tpXSVKGIGTQuVVJGvomwbjE4fd4E3tYPwFH2+Nh9YLKmH1IxRsp6

wVbwx4Pbnh3I7Zm6xctPbRNM5j+IRP5NpqZGnw3Aneqf2ueVPto1waRVs2oLKLAeBEpL

Nf8Awtk/MK3lovXBQYvVFz7ufnqwQSvGQRMPuarWy6l3p4n3SzJ20AhkPW7XOqSEUcaB

0DRUDVKE8+g1t5vgNWAWBkoO3Ix3V7I3GvZg8Oix/cYSVGmW8Lv8x1W1jWxL0LS93wNI

fgoQ==

ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20260327;

h=to:subject:message-id:date:from:reply-to:mime-version

:dkim-signature;

bh=IMA5Sw8qIrcHV4qGqe22xd6am7rg+aYSZ4DpW/tGOUk=;

fh=Kl59CKHKJhLDs6k6686Z5rwTvm/C94sehbcmVK1rOJA=;

b=Du2Tx11o8/sCNdZdSrAc0tLRvlV36rmqMhqFNMZNemcjXKzE7f4x0Zg5OjXFKL4Q6T

8czq7xNhtHnduhONEJEy0hVcoMWwmENQT8Dkak3nkP37qDBnsDDjMGVDlDTYdWimIKYF

YPrphAO6pLO4TA05Vl4tNTr7wn11E2G3/nZzUVCMdQjceFTekhgVEkJBUpHBFEqjlcVd

SteNU20SE2O+//v8B/+1WGgWjcplu9MnJKc4X+kc4sEvXQ9DUp6Pv9oUYqetIfrdxdqb

nZHy4J5zsiextkgyz9BFnm3umMTlQZEaA6BTPqtdnCn1079bfXpK1K1pKwNs3Lo0yj4T

mGMg==;

darn=nk.ca

ARC-Authentication-Results: i=1; mx.google.com; arc=none

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=ppk-ac-th.20251104.gappssmtp.com; s=20251104; t=1784903032; x=1785507832; darn=nk.ca;

h=content-type:to:subject:message-id:date:from:reply-to:mime-version

:from:to:cc:subject:date:message-id:reply-to:content-type;

bh=IMA5Sw8qIrcHV4qGqe22xd6am7rg+aYSZ4DpW/tGOUk=;

b=P1BxEmQUStfzPDFHehqyiqDkwVaV1kkUd5K+L0Y1SliuE+tZ8qRIQKIo4yRdNEPJnM

tw1N5FCZS6qeDXGyKbSPu7qZpmsQtcPQWhPj5EZrSZ9+1F6fw15LgC6mQUxvzggd5YF1

rRGKDsU7QNxqKE/oB4STrQmTQwMHg4YlK0esntbDR2Z/zhfdEPFuWnNbTu+yPsICvwEn

rnNT+lYijHT6darhVA2x1+aMLmaQWSCPq1NFYjbZyvhSLsRZGr2ewtFFhTlwjDjv59M5

h8ezjj0b6n5JQAQYFoRMXgG78QvkdUHJwKzCapZx0Q7b+0/qs7WPryhiO8mSPmZA+sD9

1YsQ==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20251104; t=1784903032; x=1785507832;

h=content-type:to:subject:message-id:date:from:reply-to:mime-version

:x-gm-gg:x-gm-message-state:from:to:cc:subject:date:message-id

:reply-to:content-type;

bh=IMA5Sw8qIrcHV4qGqe22xd6am7rg+aYSZ4DpW/tGOUk=;

b=MmrPY/Wea/BVH2861Ybqy3YWeOlmGgGxazsy5P9Cm+JyahBqBsb0cS4aYx0hO2N/2/

oO4jqJgB7aFRLMfYlAx20Tl1QZJE5uh8C3Q/nV8jZvEwKwhaMTF0fCOXz6mVCPBTQIl4

QkhxwSTkpRKMy9eX7qZzbjlgrKYIRJUusZzJN8ZWcr4lCJlUsppu0FGWKR0Io/iOzOl1

gYQY0+UatUyQQv1eisVFi5IDxOWff6ez9NWfD6ANodxTOACzT/eojLhY09C5WV14WCge

hhdLLENqC6pSYcOYoaGewh4ILZZs9oyN6owJ0b5QA1K788xdv2mVQg9beIgzGCYpM9m3

N4LQ==

X-Forwarded-Encrypted: i=1; AHgh+RoO0mo1iEE/pvbHshecyLdFyVZiibL22AQgLtbzJVucsq3Gu5EabNlUUG6yjXXhgTfmAJpy@nk.ca

X-Gm-Message-State: AOJu0Yyf4HpVxShy8yCegxJniXz37dAewtsbrAgbQ7n2WoEh+VKMQAny

FRaZtyNnMs17MMOaBIL3mFuC+f8FTqri4YsRxlsHkupU7rwm4RFpFcla0vDp08aNmUKTp488nJX

79rPwX0FEJSeGhxVHIPNWdWgfO7CBXnZhLLxZAOeFmA==

X-Gm-Gg: AR+sD13s3QRwJ9qKg1EuU8X8nq39Vocvj8hh37zlpl7X2KITnUoVVWizQOzQGTn4gFS

bHATzCTAjHFJNNF39B7DW2bLFz0Z+ZRoCk/2T2B8F7X+5u+fvYkGgJ2nlT7a9jYVK3sQWoHs1EG

7IpVECz6W52XaBKGw/xVxMByz4ZnqFi3vRN9lwmpOHoxq7w+mnGSjIQAdqKk4Z3P/WjvlE5HtkM

nEeBfRybnQybx6UTvuNSQD9ptTBHNJh4kdo7xz7Y3rM2Aa4U4Co5bv33P3AMABO6CuBd7dM3PhF

8xoQiiXj1k9axOPcGB4qj3Pu+hl43sh5uQ==

X-Received: by 2002:a05:6402:52cc:b0:698:4405:4feb with SMTP id

4fb4d7f45d1cf-69f6b138549mr2863956a12.3.1784903032279; Fri, 24 Jul 2026

07:23:52 -0700 (PDT)

MIME-Version: 1.0

Reply-To: servicegestionlocative020103@outlook.com

From: GESTION LOCATIVE <32744@ppk.ac.th>

Date: Fri, 24 Jul 2026 16:23:41 +0200

X-Gm-Features: AUfX_mxvFV-3_VygFkak9EgO9_7g46BXXiV5iftyEZxoTRBr5nBMhXIQRbHqB4M

Message-ID:

Subject: =?UTF-8?Q?Avis_important_=E2=80=93_Mise_=C3=A0_jour_de_nos_modalit=C3=A9s_de?=

=?UTF-8?Q?_paiement_du_loyer=F0=9F=8F=A0?=

To: undisclosed-recipients:;

Content-Type: multipart/alternative; boundary="00000000000032b04506575c1f1e"

Bcc: root@nk.ca

X-Spam_score: 9.5

X-Spam_score_int: 95

X-Spam_bar: +++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Madame, Monsieur, Nous vous rappelons que le loyer du mois

d’août
est maintenant exigible. Afin de faciliter le traitement et l’encaissement

des paiements, nous vous informons que *le virement Interac est désormais

notre mode de paiement privilégié*. Cette procédure est en vigueur Ã

[...]



Content analysis details: (9.5 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[74.125.228.74 listed in dnsbl.ahbl.org]

[74.125.228.74 listed in dnsbl.ahbl.org]

[74.125.228.74 listed in dnsbl.ahbl.org]

[74.125.228.74 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[74.125.228.74 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[74.125.228.74 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[74.125.228.74 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[74.125.228.74 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[74.125.228.74 listed in will-spam-for-food.eu.org]

[74.125.228.74 listed in will-spam-for-food.eu.org]

[74.125.228.74 listed in will-spam-for-food.eu.org]

[74.125.228.74 listed in will-spam-for-food.eu.org]

[74.125.228.74 listed in will-spam-for-food.eu.org]

[74.125.228.74 listed in will-spam-for-food.eu.org]

[74.125.228.74 listed in will-spam-for-food.eu.org]

[74.125.228.74 listed in will-spam-for-food.eu.org]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[74.125.228.74 listed in list.dnswl.org]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-0.0 SPF_PASS SPF: sender matches SPF record

1.5 GR_DOMAIN_UNDISC1 To contains undisclosed recipient (undisc)

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in digit

[servicegestionlocative020103(at)outlook.com]

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[74.125.228.74 listed in wl.mailspike.net]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[74.125.228.74 listed in bl.score.senderscore.com]

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

2.5 FREEMAIL_FORGED_REPLYTO Freemail in Reply-To, but not From

1.0 FREEMAIL_REPLYTO Reply-To/From or Reply-To/body contain different

freemails

3.0 UNDISC_FREEM Undisclosed recipients + freemail reply-to

Subject: {SPAM?} =?UTF-8?Q?Avis_important_=E2=80=93_Mise_=C3=A0_jour_de_nos_modalit=C3=A9s_de?=

=?UTF-8?Q?_paiement_du_loyer=F0=9F=8F=A0?=



--00000000000032b04506575c1f1e

Content-Type: text/plain; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable



Madame, Monsieur,



Nous vous rappelons que le loyer du mois d=E2=80=99ao=C3=BBt est maintena=

nt exigible.



Afin de faciliter le traitement et l=E2=80=99encaissement des paiements, no=

us vous

informons que *le virement Interac est d=C3=A9sormais notre mode de paiemen=

t

privil=C3=A9gi=C3=A9*. Cette proc=C3=A9dure est en vigueur =C3=A0 compter d=

e ce mois et

permettra un traitement plus rapide et plus s=C3=A9curitaire de votre paiem=

ent.



Nous vous invitons =C3=A0 effectuer votre r=C3=A8glement en utilisant les c=

oordonn=C3=A9es

suivantes :



Adresse Interac :

servicegestionlocative020103@outlook.com





Question de s=C3=A9curit=C3=A9 : Paiement

R=C3=A9ponse : Loyer



Nous vous serions reconnaissants d=E2=80=99effectuer votre paiement dans le=

s d=C3=A9lais

pr=C3=A9vus afin d=E2=80=99assurer la bonne tenue de votre dossier et d=E2=

=80=99=C3=A9viter tout

retard.



Une fois le virement effectu=C3=A9, nous vous remercions de bien vouloir

r=C3=A9pondre =C3=A0 ce courriel en joignant la confirmation ou le re=C3=A7=

u de votre

transaction. Cela nous permettra de confirmer rapidement la r=C3=A9ception =

des

fonds et de mettre votre dossier =C3=A0 jour.



Si vous avez des questions ou si vous =C3=A9prouvez des difficult=C3=A9s =

=C3=A0 effectuer

votre paiement, notre =C3=A9quipe demeure =C3=A0 votre enti=C3=A8re disposi=

tion et se fera

un plaisir de vous accompagner.



Nous vous remercions de votre confiance et de votre collaboration.



Veuillez agr=C3=A9er, Madame, Monsieur, l=E2=80=99expression de nos salutat=

ions

distingu=C3=A9es.



Cordialement,



--00000000000032b04506575c1f1e

Content-Type: text/html; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable



Madame, Monsieur,

Nous vous rappelons que =

le=C2=A0loyer du mois d=E2=80=99ao=C3=BBt=C2=A0est maintenant exigib=

le.

Afin de faciliter le traitement et l=E2=80=99encaissement des pai=

ements, nous vous informons que=C2=A0le virement Interac est d=C3=A9sorm=

ais notre mode de paiement privil=C3=A9gi=C3=A9
. Cette proc=C3=A9dure e=

st en vigueur =C3=A0 compter de ce mois et permettra un traitement plus rap=

ide et plus s=C3=A9curitaire de votre paiement.

Nous vous invitons =

=C3=A0 effectuer votre r=C3=A8glement en utilisant les coordonn=C3=A9es sui=

vantes :

Adresse Interac :

locative020103@outlook.com" target=3D"_blank">servicegestionlocative0201=

03@outlook.com

Question de s=C3=

=A9curit=C3=A9 :
=C2=A0Paiement
R=C3=A9ponse :=C2=A0Loyer

<=

/span>

Nous vous serions reconnaissants d=E2=80=99effectuer votre paiemen=

t dans les d=C3=A9lais pr=C3=A9vus afin d=E2=80=99assurer la bonne tenue de=

votre dossier et d=E2=80=99=C3=A9viter tout retard.

Une fois le vire=

ment effectu=C3=A9, nous vous remercions de bien vouloir r=C3=A9pondre =C3=

=A0 ce courriel en joignant la confirmation ou le re=C3=A7u de votre transa=

ction. Cela nous permettra de confirmer rapidement la r=C3=A9ception des fo=

nds et de mettre votre dossier =C3=A0 jour.

Si vous avez des question=

s ou si vous =C3=A9prouvez des difficult=C3=A9s =C3=A0 effectuer votre paie=

ment, notre =C3=A9quipe demeure =C3=A0 votre enti=C3=A8re disposition et se=

fera un plaisir de vous accompagner.

Nous vous remercions de votre c=

onfiance et de votre collaboration.


=3D"margin:5px 0px">

a-label=3D"Masquer le contenu d=C3=A9velopp=C3=A9" aria-expanded=3D"true" s=

tyle=3D"background-color:rgb(232,234,237);border-width:medium;border-style:=

none;border-color:currentcolor;clear:both;line-height:6px;outline:none;widt=

h:24px;font-size:11px;border-radius:5.5px">

=3D"background:url("https://www.gstatic.com/images/icons/material/syst=

em_gm/1x/more_horiz_black_20dp.png") 50% center/20px no-repeat;height:=

11px;opacity:0.71;width:24px">

le=3D"color:inherit">

Veuillez agr=C3=A9er, Madame, Monsieur, l=E2=80=99e=

xpression de nos salutations distingu=C3=A9es.

Cordialement,
p>





--00000000000032b04506575c1f1e--

French language rental demand phish from Google Gmail

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path: <32744@ppk.ac.th>

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Fri, 24 Jul 2026 08:25:00 -0600

Received: from mail-ed2-f10.google.com ([74.125.228.74]:35592)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.99.3 (FreeBSD))

(envelope-from <32744@ppk.ac.th>)

id 1wnGpT-00000000Dzx-1ftg

for dave@doctor.nl2k.ab.ca;

Fri, 24 Jul 2026 08:24:57 -0600

Received: by mail-ed2-f10.google.com with SMTP id 4fb4d7f45d1cf-69f81c7774bso308437a12.1

for ; Fri, 24 Jul 2026 07:23:59 -0700 (PDT)

ARC-Seal: i=1; a=rsa-sha256; t=1784903032; cv=none;

d=google.com; s=arc-20260327;

b=GyyWDP4qtNkMv9b1ZnPwD5f+AVTHoszL+a1HGpLD2A5UhatgTyE6XVIITxHOMfM/zr

6Gi0scSrZPmNpOJKeJKrMMgi/BtL2NkVMWP2lJyneC4f25kGXlFnaV8ntrhX4M8Xu/NZ

ncIF5f7dYnbwN2vrO/JKGEQRhyCfKJ0S3QGMzEBZQ8Zhfw0FSPumwVZKxlSvrnCm5aXA

2tkLBnZT/lEEvNat3btW1TA+d/r8g+ayivQc04s2//qJaaZ/G1J6s4YGw+4KLX5syhbw

1OP4IA3icYM6tTU/hqjIHweCtQSAHRB3aA8DliQpQbm8jWnQItJtSsTCaVzfWpFt96r+

eQ/A==

ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20260327;

h=to:subject:message-id:date:from:reply-to:mime-version

:dkim-signature;

bh=IMA5Sw8qIrcHV4qGqe22xd6am7rg+aYSZ4DpW/tGOUk=;

fh=iJxnW4txVHu36bxW6bVHuHW9xfC3HwpWkzGZSogv29I=;

b=bnqaenTY+zpFntyzGfLE6k7oRISknC6aLONC6RmUuZqV6WOIASlWFvM2onGT7bk+7z

paF1O2Odq4274WJoQnGS4/FAA2M9aMEKBuo/LzD367ZCOAmeMM0LNpNFXrHHwBTcihsk

unucHYQoBOv2TG8I3A50h8CM6PWt91kmpNljyKWpIGx0FD9FfcsDwtlQLjY6wsdrIvLI

zjT97ind2ZnzG4nf6KUhv/oou42rTSLNECjli2oREsw0z5i6JNuuWD3205zf8fQMMwAI

JBztKsaNGxKOt9T4M3oMdblsPfuT+Q2d/U1TpiHEO/HBJgW7NGltBC7F8bl/Mg8N3mUC

1Ecg==;

darn=doctor.nl2k.ab.ca

ARC-Authentication-Results: i=1; mx.google.com; arc=none

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=ppk-ac-th.20251104.gappssmtp.com; s=20251104; t=1784903032; x=1785507832; darn=doctor.nl2k.ab.ca;

h=content-type:to:subject:message-id:date:from:reply-to:mime-version

:from:to:cc:subject:date:message-id:reply-to:content-type;

bh=IMA5Sw8qIrcHV4qGqe22xd6am7rg+aYSZ4DpW/tGOUk=;

b=WmjEJm0r9uxDWKLP1guLLu715ANoz12YfGLWaEacmspe2T9QdNKC11pzhPcPIUX6Mk

L6JS/ZK05af1fh73JHhMRH3URL8Lu8TeEoGjlYR0QysuBPUfYFvh/Wv+zU+vFALoJ+3H

2eqyKWJATY5rPv1pFbfDxkNDrInor6M3dYQ3DI9mA68oa6zmNXwYJnyI91HB7nCeoWkY

u60rGyUxAEvBwgMsDNML9t7cY066G0ZeyBEtBhnqtN10DJjnM4OReFRv9Rn9A+pWaiQk

Pw3fRGuhF93wBtrlRP9O85E+y2XfRfVzD08Md7pvSjnVPMntO3gyCjI6mn+iLj0grBUG

YHBw==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20251104; t=1784903032; x=1785507832;

h=content-type:to:subject:message-id:date:from:reply-to:mime-version

:x-gm-gg:x-gm-message-state:from:to:cc:subject:date:message-id

:reply-to:content-type;

bh=IMA5Sw8qIrcHV4qGqe22xd6am7rg+aYSZ4DpW/tGOUk=;

b=A3xjpEJTaJ6O08uoUY1DcnmpUcJRIlCj4qPf/A121FVqVQ5YCcqkeBNWj1e9Eg23Cq

QgXATG0ZZbvFY7KzAQUIcoFZfENZcXWW4/dFhatj04nsQSE4n2ygDF+yhNsd8b1BwSaX

tz6uPvH0ECnt8uLOdnDKKOLGKAH81XsgAfVSngrCUYCNERg0SH6gisqKpKr7Ih774EiY

sR24WpodjyFb5yAGHmhlstVDVSEX6hmWOVBktFTerqS5c4DbAZwkP/3i+SlRLvl+R7Jw

Pb6wnXrMsa/i57RDnap9D4Ba3FZUKa/xH61zicdF86DSxfobFRivuuqvgDdeoMiUYbJF

ieNA==

X-Forwarded-Encrypted: i=1; AHgh+RqeoOws3ywpwnnILwtHPZmJK7DRzymZlNgdNy52t4jpE2DiDXwcEu+Q8mZ9PZNe8v48Y+OP@doctor.nl2k.ab.ca

X-Gm-Message-State: AOJu0Yzxikqr7mGQVEC3YZTP9afj3JXSKPSjA4l/Myyn9iVfhCFIsMnq

eBbBOtvYx6l1iF1tMRLmUbkA43QeEGQbRoZFZ4KUz3VeOiQwo66cFfVkWVFqWe0ev8Jhi5aF+kl

IikcV6i7bRLmqlNM+qgJZnlWkkzdHH5M+GUVZON2Kcw==

X-Gm-Gg: AR+sD10geENy+GCIuHy4GJEjmLnc8prlr/Ptw35Vsvt0/hjx9gNKFtengYARJRWQ6MC

J4xVC9ErL2G2qLuqjlmG8j6IYFi3PXOBrwBpZxF8Ccvn9ZwUTx5pjXAOZ8ZLEXX8w5uMneUE8Ex

ncI3Kcyp18X6AKtzSHPWkTF/Cbt2rgU1Z5Z1vclQ5rB+SfNQjnPtgrpmdogoOSk67309pku+TJ9

/zMaholQosphsMigBiOLdoPKCLH2So5QunMxQB2uhN8w3TBR5jQDEwT9Z8XGzY/HdY6uAXmgO2D

A48isXw79FgAQvO6VHneHKpQaCGGjuOPBw==

X-Received: by 2002:a05:6402:52cc:b0:698:4405:4feb with SMTP id

4fb4d7f45d1cf-69f6b138549mr2863956a12.3.1784903032279; Fri, 24 Jul 2026

07:23:52 -0700 (PDT)

MIME-Version: 1.0

Reply-To: servicegestionlocative020103@outlook.com

From: GESTION LOCATIVE <32744@ppk.ac.th>

Date: Fri, 24 Jul 2026 16:23:41 +0200

X-Gm-Features: AUfX_mxvFV-3_VygFkak9EgO9_7g46BXXiV5iftyEZxoTRBr5nBMhXIQRbHqB4M

Message-ID:

Subject: =?UTF-8?Q?Avis_important_=E2=80=93_Mise_=C3=A0_jour_de_nos_modalit=C3=A9s_de?=

=?UTF-8?Q?_paiement_du_loyer=F0=9F=8F=A0?=

To: undisclosed-recipients:;

Content-Type: multipart/alternative; boundary="00000000000032b04506575c1f1e"

Bcc: dave@doctor.nl2k.ab.ca

X-Spam_score: 9.5

X-Spam_score_int: 95

X-Spam_bar: +++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Madame, Monsieur, Nous vous rappelons que le loyer du mois

d’août
est maintenant exigible. Afin de faciliter le traitement et l’encaissement

des paiements, nous vous informons que *le virement Interac est désormais

notre mode de paiement privilégié*. Cette procédure est en vigueur Ã

[...]



Content analysis details: (9.5 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[74.125.228.74 listed in dnsbl.ahbl.org]

[74.125.228.74 listed in dnsbl.ahbl.org]

[74.125.228.74 listed in dnsbl.ahbl.org]

[74.125.228.74 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[74.125.228.74 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[74.125.228.74 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[74.125.228.74 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[74.125.228.74 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[74.125.228.74 listed in will-spam-for-food.eu.org]

[74.125.228.74 listed in will-spam-for-food.eu.org]

[74.125.228.74 listed in will-spam-for-food.eu.org]

[74.125.228.74 listed in will-spam-for-food.eu.org]

[74.125.228.74 listed in will-spam-for-food.eu.org]

[74.125.228.74 listed in will-spam-for-food.eu.org]

[74.125.228.74 listed in will-spam-for-food.eu.org]

[74.125.228.74 listed in will-spam-for-food.eu.org]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[74.125.228.74 listed in list.dnswl.org]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-0.0 SPF_PASS SPF: sender matches SPF record

1.5 GR_DOMAIN_UNDISC1 To contains undisclosed recipient (undisc)

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in digit

[servicegestionlocative020103(at)outlook.com]

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[74.125.228.74 listed in wl.mailspike.net]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[74.125.228.74 listed in bl.score.senderscore.com]

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

1.0 FREEMAIL_REPLYTO Reply-To/From or Reply-To/body contain different

freemails

2.5 FREEMAIL_FORGED_REPLYTO Freemail in Reply-To, but not From

3.0 UNDISC_FREEM Undisclosed recipients + freemail reply-to

Subject: {SPAM?} =?UTF-8?Q?Avis_important_=E2=80=93_Mise_=C3=A0_jour_de_nos_modalit=C3=A9s_de?=

=?UTF-8?Q?_paiement_du_loyer=F0=9F=8F=A0?=



--00000000000032b04506575c1f1e

Content-Type: text/plain; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable



Madame, Monsieur,



Nous vous rappelons que le loyer du mois d=E2=80=99ao=C3=BBt est maintena=

nt exigible.



Afin de faciliter le traitement et l=E2=80=99encaissement des paiements, no=

us vous

informons que *le virement Interac est d=C3=A9sormais notre mode de paiemen=

t

privil=C3=A9gi=C3=A9*. Cette proc=C3=A9dure est en vigueur =C3=A0 compter d=

e ce mois et

permettra un traitement plus rapide et plus s=C3=A9curitaire de votre paiem=

ent.



Nous vous invitons =C3=A0 effectuer votre r=C3=A8glement en utilisant les c=

oordonn=C3=A9es

suivantes :



Adresse Interac :

servicegestionlocative020103@outlook.com





Question de s=C3=A9curit=C3=A9 : Paiement

R=C3=A9ponse : Loyer



Nous vous serions reconnaissants d=E2=80=99effectuer votre paiement dans le=

s d=C3=A9lais

pr=C3=A9vus afin d=E2=80=99assurer la bonne tenue de votre dossier et d=E2=

=80=99=C3=A9viter tout

retard.



Une fois le virement effectu=C3=A9, nous vous remercions de bien vouloir

r=C3=A9pondre =C3=A0 ce courriel en joignant la confirmation ou le re=C3=A7=

u de votre

transaction. Cela nous permettra de confirmer rapidement la r=C3=A9ception =

des

fonds et de mettre votre dossier =C3=A0 jour.



Si vous avez des questions ou si vous =C3=A9prouvez des difficult=C3=A9s =

=C3=A0 effectuer

votre paiement, notre =C3=A9quipe demeure =C3=A0 votre enti=C3=A8re disposi=

tion et se fera

un plaisir de vous accompagner.



Nous vous remercions de votre confiance et de votre collaboration.



Veuillez agr=C3=A9er, Madame, Monsieur, l=E2=80=99expression de nos salutat=

ions

distingu=C3=A9es.



Cordialement,



--00000000000032b04506575c1f1e

Content-Type: text/html; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable



Madame, Monsieur,

Nous vous rappelons que =

le=C2=A0loyer du mois d=E2=80=99ao=C3=BBt=C2=A0est maintenant exigib=

le.

Afin de faciliter le traitement et l=E2=80=99encaissement des pai=

ements, nous vous informons que=C2=A0le virement Interac est d=C3=A9sorm=

ais notre mode de paiement privil=C3=A9gi=C3=A9
. Cette proc=C3=A9dure e=

st en vigueur =C3=A0 compter de ce mois et permettra un traitement plus rap=

ide et plus s=C3=A9curitaire de votre paiement.

Nous vous invitons =

=C3=A0 effectuer votre r=C3=A8glement en utilisant les coordonn=C3=A9es sui=

vantes :

Adresse Interac :

locative020103@outlook.com" target=3D"_blank">servicegestionlocative0201=

03@outlook.com

Question de s=C3=

=A9curit=C3=A9 :
=C2=A0Paiement
R=C3=A9ponse :=C2=A0Loyer

<=

/span>

Nous vous serions reconnaissants d=E2=80=99effectuer votre paiemen=

t dans les d=C3=A9lais pr=C3=A9vus afin d=E2=80=99assurer la bonne tenue de=

votre dossier et d=E2=80=99=C3=A9viter tout retard.

Une fois le vire=

ment effectu=C3=A9, nous vous remercions de bien vouloir r=C3=A9pondre =C3=

=A0 ce courriel en joignant la confirmation ou le re=C3=A7u de votre transa=

ction. Cela nous permettra de confirmer rapidement la r=C3=A9ception des fo=

nds et de mettre votre dossier =C3=A0 jour.

Si vous avez des question=

s ou si vous =C3=A9prouvez des difficult=C3=A9s =C3=A0 effectuer votre paie=

ment, notre =C3=A9quipe demeure =C3=A0 votre enti=C3=A8re disposition et se=

fera un plaisir de vous accompagner.

Nous vous remercions de votre c=

onfiance et de votre collaboration.


=3D"margin:5px 0px">

a-label=3D"Masquer le contenu d=C3=A9velopp=C3=A9" aria-expanded=3D"true" s=

tyle=3D"background-color:rgb(232,234,237);border-width:medium;border-style:=

none;border-color:currentcolor;clear:both;line-height:6px;outline:none;widt=

h:24px;font-size:11px;border-radius:5.5px">

=3D"background:url("https://www.gstatic.com/images/icons/material/syst=

em_gm/1x/more_horiz_black_20dp.png") 50% center/20px no-repeat;height:=

11px;opacity:0.71;width:24px">

le=3D"color:inherit">

Veuillez agr=C3=A9er, Madame, Monsieur, l=E2=80=99e=

xpression de nos salutations distingu=C3=A9es.

Cordialement,
p>





--00000000000032b04506575c1f1e--

TD Direct Investment Phish from Google USer

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Fri, 24 Jul 2026 10:05:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wnINw-00000000MHq-1AxJ

for dave@doctor.nl2k.ab.ca;

Fri, 24 Jul 2026 10:04:28 -0600

Resent-From: The Doctor

Resent-Date: Fri, 24 Jul 2026 10:04:28 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from euawz.com ([35.212.104.177]:49193 helo=api.euawz.com)

by doctor.nl2k.ab.ca with esmtp (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wnHLk-00000000Gst-2b5G

for doctor@nk.ca;

Fri, 24 Jul 2026 08:58:16 -0600

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; s=default; d=api.euawz.com;

h=Content-Type:MIME-Version:From:To:Subject:Date:Message-ID;

i=notice@fivuxb.api.euawz.com;

bh=MoAxeqSBy04DpuVA7vAGRI8uKthnimZ7xWxRUMpPLo8=;

b=bXN2AG8/gL+qXaHq4b+VNW9/0aW+JadjAwHRRUasxLoM+tt68iIHKT6LCPRxfbB3Zweah0EXlyqS

tVssB7qqvSWVndd3228GmXOIVkIvtJqihCJcZxfekhRZ05BxwdI6T6AvRwMnbxtmszXDWiDmY6AL

/PR/y3nu1qSY6ejdjSjNQKCvWlYTrfoncTKbR7ILeDKn1O09N0phXBjMs8dpCpcZzupPvPZ8Lllz

hsesEBa6SU+3abIf6xYU5uyPXJd6inbjzvcXvw005dLul0p1fTb+Xi0L2D2QhTXCs25X9smOCvWD

LF8DaZe70bmRkFyoiAuKXQ07/j3BTvX2V2/n/A==

Content-Type: multipart/alternative;

boundary="===============8872122310485188626=="

MIME-Version: 1.0

From:

=?utf-8?b?VOKAi0TigIsg4oCLQ+KAi2HigItu4oCLYeKAi2TigIth4oCLIOKAi1TigIty4oCLdeKAi3PigIt0?=



To: doctor@nk.ca

Subject: =?utf-8?q?=5BTD_Direct_Investing=5D_Account_Restriction_=E2=80=94_C?=

=?utf-8?q?IRO_Investor_Profile_Re-Verification_=E2=80=94_Order_Entry_Suspen?=

=?utf-8?q?ded?=

Date: Fri, 24 Jul 2026 23:57:20 +0900

Message-ID: <178490504078.5315.10255750785074319201@fivuxb.api.euawz.com>

List-Unsubscribe-Post: List-Unsubscribe=One-Click

X-Auto-Response-Suppress: OOF, DR, RN, NRN

Feedback-ID: campaign:fivuxb.api.euawz.com:mailer

X-Entity-Ref-ID: 32c2e438-2da2-43f6-8eda-a08d03794848

X-Spam_score: 10.7

X-Spam_score_int: 107

X-Spam_bar: ++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: [TD Direct Investing] Account Restriction: CIRO Investor Profile

Re-Verification — Order Entry Suspended doctor, TD Direct Investing, as

a Dealer Member of the Canadian Investment Regulatory Organization (CIRO),

is required under CIRO Rule 3300 to conduct periodic suitability assessments

for every client account [...]



Content analysis details: (10.7 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[35.212.104.177 listed in dnsbl.ahbl.org]

[35.212.104.177 listed in dnsbl.ahbl.org]

[35.212.104.177 listed in dnsbl.ahbl.org]

[35.212.104.177 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[35.212.104.177 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[35.212.104.177 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[35.212.104.177 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[35.212.104.177 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[35.212.104.177 listed in will-spam-for-food.eu.org]

[35.212.104.177 listed in will-spam-for-food.eu.org]

[35.212.104.177 listed in will-spam-for-food.eu.org]

[35.212.104.177 listed in will-spam-for-food.eu.org]

[35.212.104.177 listed in will-spam-for-food.eu.org]

[35.212.104.177 listed in will-spam-for-food.eu.org]

[35.212.104.177 listed in will-spam-for-food.eu.org]

[35.212.104.177 listed in will-spam-for-food.eu.org]

-0.0 SPF_HELO_PASS SPF: HELO matches SPF record

-0.0 SPF_PASS SPF: sender matches SPF record

1.9 URIBL_JP_SURBL Contains an URL listed in the JP SURBL blocklist

[URI: euawz.com]

1.9 URIBL_ABUSE_SURBL Contains an URL listed in the ABUSE SURBL blocklist

[URI: api.euawz.com]

2.5 URIBL_DBL_SPAM Contains a spam URL listed in the DBL blocklist

[URI: euawz.com]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-0.0 T_RP_MATCHES_RCVD Envelope sender domain matches handover relay

domain

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[35.212.104.177 listed in bl.score.senderscore.com]

1.5 MR_STRANGE_QUESTION URI: No description available.

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

1.5 TVD_PH_BODY_ACCOUNTS_PRE The body matches phrases such as "accounts

suspended", "account credited", "account

verification"

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

Subject: {SPAM?} =?utf-8?q?=5BTD_Direct_Investing=5D_Account_Restriction_=E2=80=94_C?=

=?utf-8?q?IRO_Investor_Profile_Re-Verification_=E2=80=94_Order_Entry_Suspen?=

=?utf-8?q?ded?=



TD Direct Investing  |  Dealer Member of CIRO  |  Member of CIPF



CIRO Regulatory Compliance — Suitability Determination

Account Restriction: Annual CIRO Investor Profile Re-Verification — Order Entry Suspended



Reference: CIRO Rule 3300 Series — Know Your Client and Suitability Determination



doctor,



TD Direct Investing, as a Dealer Member of the Canadian Investment Regulatory Organization (CIRO), is required under CIRO Rule 3300 to conduct periodic suitability assessments for every client account. This regulatory obligation is not discretionary. The Client Relationship Model (CRM2) mandates that Dealer Members maintain current Know Your Client (KYC) information and verify that account permissions and trading activity remain consistent with each client’s documented investment profile.



Our records indicate that the investor profile re-verification for your TD WebBroker account is overdue. Pursuant to CIRO supervisory requirements, a compliance restriction has been placed on your account. This restriction will remain in effect until your updated investor profile is submitted and reviewed.

IInvestment Objectives & Time Horizon

Confirm whether your investment objectives — growth, income, capital preservation, or speculation — and your anticipated investment time horizon remain accurate. A mismatch between stated objectives and actual trading activity triggers a mandatory suitability review under CIRO rules.

IIRisk Tolerance Reassessment

Reaffirm your comfort level with market volatility, unrealized loss scenarios, and product-specific risks. Your documented risk tolerance determines the range of investment products and strategies available within your WebBroker account.

IIIFinancial Circumstances Update

Disclose your current annual income, liquid net worth, total net worth, and employment status. Material changes in your financial circumstances may affect the suitability of certain investment products and strategies available through your account.

IVInvestment Knowledge & Experience

Confirm your level of familiarity with equities, fixed-income securities, exchange-traded funds, options, and other investment products. Your self-assessed knowledge level governs the trading permissions available within WebBroker.



Account Restriction in Effect



Order Entry Restricted — New Position Establishment Suspended. Existing holdings may be monitored and liquidated. Dividend and interest distributions continue unaffected.

Regulatory Basis

CIRO Rule 3300 Series requires Dealer Members to take reasonable steps to ensure that account permissions and investment recommendations are suitable for each client based on current KYC information. Annual re-verification of client profiles is a mandatory supervisory obligation. TD Direct Investing is required to restrict account functionality where KYC information is not current. This restriction is applied uniformly to all accounts with overdue profile verifications and is not subject to discretionary waiver.



The re-verification questionnaire requires approximately five to seven minutes. It is completed entirely online through the secure WebBroker platform. Your responses are encrypted and used solely for regulatory compliance and suitability assessment.

Log In to Complete Investor Profile Re-Verification



If your investor profile has been updated within the past 90 days, no further action is required. For questions regarding this regulatory obligation, contact TD Direct Investing Client Services at 1-800-465-5463 or use the Secure Message Centre within WebBroker.



Yours truly,

TD Direct Investing

Compliance & Supervision Department

TD Direct Investing  |  Dealer Member of CIRO  |  Member of CIPF

This message is an automated regulatory compliance notification issued pursuant to CIRO suitability and supervision requirements. Please direct all inquiries through the Secure Message Centre within your WebBroker account or call TD Direct Investing Client Services.

© 2026 TD Direct Investing. All rights reserved. TD Direct Investing is a division of TD Waterhouse Canada Inc., a subsidiary of The Toronto-Dominion Bank.

TD Direct Investing phish from Microsoft

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Fri, 24 Jul 2026 11:50:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wnK1s-00000000Gnd-2dMy

for dave@doctor.nl2k.ab.ca;

Fri, 24 Jul 2026 11:49:48 -0600

Resent-From: The Doctor

Resent-Date: Fri, 24 Jul 2026 11:49:48 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from [4.149.124.54] (port=40375 helo=webmail.pxowz.com)

by doctor.nl2k.ab.ca with esmtp (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wnJaR-00000000DF9-2ABP

for root@nk.ca;

Fri, 24 Jul 2026 11:21:35 -0600

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; s=default; d=webmail.pxowz.com;

h=Content-Type:MIME-Version:From:To:Subject:Date:Message-ID;

i=tech@aodslf.webmail.pxowz.com;

bh=Yt1nZxdYfD7YQM1l2uynz1cmH+BbJjihZ0IYKhDfzbk=;

b=wD+NaUSupdanw5DilTVwH1etc+gFiDQYqC1UzP8uQdtUZwTsLDhN96/dTo49IlX4BqZkgne3J4Eb

mNBv0T4u0EHsiPBX6cPK3iyTe9OPsQv+nJIzLeMRtdyPlS8JcgMS5XBhCvhq7+MDzcl7OIPfEUaw

IyYNjdxeBxFYG7/8eAG2BdXmeUqPVRjDC8c9q6OwZZz/kkJkrgqIO42ow4SjTFYO0ENO7eadli3h

dtg0c0ZjkhbHtCqSAdtWzW/R1svGO1JmqBbWu8EEb8DoqYrmGyABwY2Wh6JIy+ENkMkV8wHUOxsx

KO5TKYhiHW3Cgc92Gd8HDzbcxTIRodDOIk2yQQ==

Content-Type: multipart/alternative;

boundary="===============3453787963808454136=="

MIME-Version: 1.0

From: =?utf-8?b?VOKAi0Q=?=

To: root@nk.ca

Subject: =?utf-8?q?=5BTD_Direct_Investing=5D_Trading_Password_Expired_?=

=?utf-8?q?=E2=80=94_Order_Entry_Blocked_Pending_Credential_Update?=

Date: Sat, 25 Jul 2026 02:20:39 +0900

Message-ID: <178491363983.4152.1477497014429872006@aodslf.webmail.pxowz.com>

List-Unsubscribe-Post: List-Unsubscribe=One-Click

X-Auto-Response-Suppress: OOF, DR, RN, NRN

Feedback-ID: campaign:aodslf.webmail.pxowz.com:mailer

X-Entity-Ref-ID: b57b6a8a-8dac-4e86-b531-e9264197c2f3



TD Direct Investing  |  Dealer Member of CIRO  |  Member of CIPF



Trading Credential Expiry

Trading Password Expired

— Order Entry Blocked Pending Update



TD Direct Investing Trading Password Policy — CIRO Cybersecurity Guidelines



root,



TD Direct Investing maintains separate credentials for account access (login password) and trade authorization (trading password). The trading password is a distinct security layer that must be entered to confirm each order submission. Under TD Direct Investing’s credential rotation policy, trading passwords are subject to periodic expiry and must be renewed to maintain order entry capability.



Our records indicate that the trading password associated with your TD WebBroker account has expired. This does not affect your ability to log in to WebBroker, view your portfolio, monitor positions, or receive distributions. However, the expiry of your trading password has resulted in the suspension of order entry functionality.



Login Password



Active



Account access, portfolio viewing, statements, and research remain available.



Trading Password



Expired



Order entry suspended. Buy and sell orders cannot be submitted until trading password is renewed.



Order Entry Blocked



The following order types are currently blocked: market orders, limit orders, stop orders, stop-limit orders, trailing stop orders, and contingent orders across all exchanges, asset classes, and order entry channels (WebBroker, mobile, and Advanced Dashboard). Existing open orders that were entered prior to trading password expiry are not affected. Open positions may be monitored and closed by contacting TD Direct Investing Client Services.

Trading Password Policy

TD Direct Investing requires separate trading password authentication for each order submission as an additional security control against unauthorized trading. This is consistent with CIRO cybersecurity guidance and OSFI Guideline B-13. Trading passwords expire on a rolling basis and must be renewed to maintain uninterrupted order entry capability. The trading password must differ from the login password and must meet the same complexity requirements: minimum 12 characters, inclusive of uppercase and lowercase letters, numerals, and special characters.



Renewing your trading password takes approximately one minute. Log in to WebBroker, navigate to Settings, and select Trading Password Update. You will be prompted to enter your current login password, create a new trading password, and confirm the new password.

Log In to Renew Trading Password



This is a routine security measure applied uniformly to all TD WebBroker accounts. If you have recently renewed your trading password, this notice may have crossed with your update and no further action is required. For assistance, contact TD Direct Investing Client Services at 1-800-465-5463. TD Direct Investing will never request your trading password by email or telephone.



Yours truly,

TD Direct Investing

Trade Authorization & Security Division

TD Direct Investing  |  Dealer Member of CIRO  |  Member of CIPF

This is an automated security notification. Please direct all inquiries through the Secure Message Centre within your WebBroker account.

© 2026 TD Direct Investing. All rights reserved. TD Direct Investing is a division of TD Waterhouse Canada Inc., a subsidiary of The Toronto-Dominion Bank.

TD Direct Investing phish from Google user

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Fri, 24 Jul 2026 07:28:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wnFva-000000008pd-3NCj

for dave@doctor.nl2k.ab.ca;

Fri, 24 Jul 2026 07:27:02 -0600

Resent-From: The Doctor

Resent-Date: Fri, 24 Jul 2026 07:27:02 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-m82222.xmail.ntesmail.com ([156.224.82.222]:34492)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wnARS-00000000K6W-3DD8

for sales@nk.ca;

Fri, 24 Jul 2026 01:35:51 -0600

Content-Type: multipart/alternative; BOUNDARY="=_Part_251956_1373983531.1784878477795"

To: sales

Subject: =?UTF-8?B?RW5oYW5jaW5nIFdvcmtzaG9wIFNhZmV0eSB3aXRoIElucHVyIER1c3QgQ29udHJvbCBTb2x1dGlvbnM=?=

X-Priority: 3

MIME-Version: 1.0

Received: from johnny@shuishengyuan-ccup.com( [10.139.0.42] ) by ajax-webmail ( [127.0.0.1] ) ; Fri, 24 Jul 2026 15:34:37 +0800 (GMT+08:00)

From: terrence.kirlin@voro.machineclementia.com

Date: Fri, 24 Jul 2026 15:34:37 +0800 (GMT+08:00)

X-WM-Tid: 0a9f930c2a0703bckunm332466465192b

Reply-To: johnny@shuishengyuan-ccup.com

DKIM-Signature: a=rsa-sha256;

b=0+RLDDMruOuBTtSgH+h6hiP+YzE2ZkCTWRebG99we01JKdeJgTVE88snm5wU8fNsD8wn+J+dabpoulHS0OjmKU76iS6X/VYuvL8TLO0o42ytdYe6y0Q+ZMU1dTUxMovC7SnJrRe07/c7Z9NUbQjCn65oxNIuI41uXpvE6gT4LfY=; c=relaxed/relaxed; s=default; d=voro.machineclementia.com; v=1;

bh=dqpy2MdE8aOtBKykleeWaaewBs4htNPE0x/KCzkL9NA=;

h=date:mime-version:subject:message-id:from;

Message-ID:



FINTRAC Regulatory Compliance — AML / CTF

Mandatory Identity & Beneficial

Ownership Verification

Pursuant to the Proceeds of Crime (Money Laundering) and Terrorist Financing Act, S.C. 2000, c. 17, and FINTRAC Guideline 6B



sales,



TD Direct Investing, as a reporting entity under the Proceeds of Crime (Money Laundering) and Terrorist Financing Act (PCMLTFA), is legally obligated to conduct periodic verification of client identification records, residential address information, and beneficial ownership declarations for all account holders. A scheduled compliance audit conducted by our AML/CTF Compliance Unit has identified that certain elements of your client file require updated verification.



This verification is not discretionary. The PCMLTFA and its associated regulations, as administered by the Financial Transactions and Reports Analysis Centre of Canada (FINTRAC), mandate that all reporting entities maintain current and verified client identification records. Failure to maintain compliant records obliges the reporting entity to escalate protective measures, which may include temporary restrictions on account services.



The following items require your review and, where indicated, updated documentation:

!

Government-Issued Photographic IdentificationValid Canadian passport, provincial driver’s licence, or provincial/territorial photo ID card. The document on file requires renewal verification.

Expired

!

Proof of Residential AddressUtility bill, financial institution statement, or government correspondence dated within the past 90 days confirming your current residential address.

Update Required

!

Tax Residency Self-CertificationDeclaration confirming your country (or countries) of tax residency. This is required even if you are exclusively a Canadian tax resident.

Certification Required

!

Beneficial Ownership DeclarationConfirmation that you are the beneficial owner of the assets held in this account, or identification of any third parties on whose behalf the account is maintained, as required under FINTRAC beneficial ownership requirements.

Declaration Required



TD Direct Investing is committed to facilitating this verification process with minimal inconvenience to you. All document submissions and declarations are completed securely through your TD WebBroker account portal. Documents are encrypted and stored in accordance with the Personal Information Protection and Electronic Documents Act (PIPEDA) and FINTRAC record-keeping requirements.

Pending Protective Measure: Withdrawal Restriction

Should the required verifications remain outstanding beyond the prescribed remediation period, TD Direct Investing shall be obligated to apply a temporary restriction on external fund withdrawals and third-party transfers until the verification process is completed. This measure is mandated by our AML/CTF compliance program and is applied uniformly to all accounts with outstanding verification requirements.

Log In to Complete Identity Verification



This communication constitutes a formal regulatory notice issued in accordance with TD Direct Investing’s obligations as a reporting entity under the PCMLTFA. The collection and verification of client identification and beneficial ownership information is a legal requirement imposed on all financial entities in Canada. Clients with questions concerning the verification process or the specific documentation required may contact the AML Compliance Unit through the Secure Message Centre upon login. TD Direct Investing is committed to the highest standards of anti-money laundering and counter-terrorist financing compliance.



Yours sincerely,

TD Direct Investing

AML Compliance & Client Identification Unit



TD Direct Investing is a division of TD Waterhouse Canada Inc., a subsidiary of The Toronto-Dominion Bank. TD Waterhouse Canada Inc. is a Dealer Member of CIRO and a Member of CIPF.



This message is an automated regulatory compliance notification issued pursuant to the PCMLTFA and FINTRAC guidelines.

Please direct inquiries through the Secure Message Centre within your TD WebBroker account.



TD Bank Group © 2026. All rights reserved.

TD Direct Investing phish from Google User

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Fri, 24 Jul 2026 12:59:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wnL6h-000000003to-24zg

for dave@doctor.nl2k.ab.ca;

Fri, 24 Jul 2026 12:58:51 -0600

Resent-From: The Doctor

Resent-Date: Fri, 24 Jul 2026 12:58:51 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from [35.215.3.35] (port=44459 helo=campaigns.arf01.com)

by doctor.nl2k.ab.ca with esmtp (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wnKzz-000000003E3-02qo

for root@nk.ca;

Fri, 24 Jul 2026 12:52:03 -0600

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; s=default; d=campaigns.arf01.com;

h=Content-Type:MIME-Version:From:To:Subject:Date:Message-ID;

i=notification@kpgzmv.campaigns.arf01.com;

bh=AkVxnPl+VD/dcLdpJ02JcrM3POmFXBP0DleIwOOHcww=;

b=X9H0AcDsRhI+2MHs/Lt2GCQ5rABeMW1m7fETK2xZo6pYW6NJHfCHr0OuySAc/yxGW5Y7+dfUTY5W

MUj0j9GDx///0yhrC60WkAm8WsFdpC48ePO3+wv1yBBRHLAOepkNA5LM4rxJ7RbJL5/lsJy8/pLb

SPCq6GVo9QHzPAlA7OiQOwRz2Vt2DhFRsf7lrfvu6vGJhhhvYDoVx/EonvkZCRM5EZj6AoC6Jz4a

IM/Nry1GaqhOnhrsZEyJRoU0eUHk69R8k0GFFuHsuSf2eN7cRgmIqqiVHvswfTx9UDAQss6kSSuR

HsJoNM//GUmC8Mh+YZ0wkpy8BcDxX7CxU4ALZQ==

Content-Type: multipart/alternative;

boundary="===============4261748735468286487=="

MIME-Version: 1.0

From: TD Direct Investing

To: root@nk.ca

Subject: [TD WebBroker] Security Protocol - Temporary Withdrawal Hold -

Unrecognized Device Access Verification Required

Date: Sat, 25 Jul 2026 03:50:58 +0900

Message-ID:

<178491905818.3307.16470108963559159387@kpgzmv.campaigns.arf01.com>

List-Unsubscribe-Post: List-Unsubscribe=One-Click

X-Auto-Response-Suppress: OOF, DR, RN, NRN

Feedback-ID: campaign:kpgzmv.campaigns.arf01.com:mailer

X-Entity-Ref-ID: 89d69dce-c30b-4844-a03f-14a94d1142fd

X-Spam_score: 17.4

X-Spam_score_int: 174

X-Spam_bar: +++++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: [TD WebBroker] Security Protocol: Temporary Withdrawal Hold

— Unrecognized Device Access Verification Required root, The TD Direct

Investing Security Operations Centre has identified one or more access events

associated with your TD WebBroker account that originate from a device, browser

fingerprint, or network endp [...]



Content analysis details: (17.4 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[35.215.3.35 listed in dnsbl.ahbl.org]

[35.215.3.35 listed in dnsbl.ahbl.org]

[35.215.3.35 listed in dnsbl.ahbl.org]

[35.215.3.35 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[35.215.3.35 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[35.215.3.35 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[35.215.3.35 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[35.215.3.35 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[35.215.3.35 listed in will-spam-for-food.eu.org]

[35.215.3.35 listed in will-spam-for-food.eu.org]

[35.215.3.35 listed in will-spam-for-food.eu.org]

[35.215.3.35 listed in will-spam-for-food.eu.org]

[35.215.3.35 listed in will-spam-for-food.eu.org]

[35.215.3.35 listed in will-spam-for-food.eu.org]

[35.215.3.35 listed in will-spam-for-food.eu.org]

[35.215.3.35 listed in will-spam-for-food.eu.org]

3.6 RCVD_IN_SBL_CSS RBL: Received via a relay in Spamhaus SBL-CSS

[35.215.3.35 listed in zen.spamhaus.org]

1.5 RCVD_IN_SBL_XBL RBL: Received via a relay in Spamhaus SBL+XBL

[35.215.3.35 listed in sbl-xbl.spamhaus.org]

2.5 URIBL_DBL_SPAM Contains a spam URL listed in the DBL blocklist

[URI: arf01.com]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[35.215.3.35 listed in bl.score.senderscore.com]

1.5 MR_STRANGE_QUESTION URI: No description available.

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

1.3 RDNS_NONE Delivered to internal network by a host with no rDNS

1.5 VOWEL_FROM_6 Impronouncable from header (6 consecutive vowels)

0.8 SARE_FROM_SPAM_WORD3 I don't know people named this!

1.5 TVD_PH_BODY_ACCOUNTS_PRE The body matches phrases such as "accounts

suspended", "account credited", "account

verification"

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

2.0 TVD_PH_BODY_META No description available.

Subject: {SPAM?} [TD WebBroker] Security Protocol - Temporary Withdrawal Hold -

Unrecognized Device Access Verification Required



X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Fri, 24 Jul 2026 12:59:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wnL6h-000000003to-24zg

for dave@doctor.nl2k.ab.ca;

Fri, 24 Jul 2026 12:58:51 -0600

Resent-From: The Doctor

Resent-Date: Fri, 24 Jul 2026 12:58:51 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from [35.215.3.35] (port=44459 helo=campaigns.arf01.com)

by doctor.nl2k.ab.ca with esmtp (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wnKzz-000000003E3-02qo

for root@nk.ca;

Fri, 24 Jul 2026 12:52:03 -0600

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; s=default; d=campaigns.arf01.com;

h=Content-Type:MIME-Version:From:To:Subject:Date:Message-ID;

i=notification@kpgzmv.campaigns.arf01.com;

bh=AkVxnPl+VD/dcLdpJ02JcrM3POmFXBP0DleIwOOHcww=;

b=X9H0AcDsRhI+2MHs/Lt2GCQ5rABeMW1m7fETK2xZo6pYW6NJHfCHr0OuySAc/yxGW5Y7+dfUTY5W

MUj0j9GDx///0yhrC60WkAm8WsFdpC48ePO3+wv1yBBRHLAOepkNA5LM4rxJ7RbJL5/lsJy8/pLb

SPCq6GVo9QHzPAlA7OiQOwRz2Vt2DhFRsf7lrfvu6vGJhhhvYDoVx/EonvkZCRM5EZj6AoC6Jz4a

IM/Nry1GaqhOnhrsZEyJRoU0eUHk69R8k0GFFuHsuSf2eN7cRgmIqqiVHvswfTx9UDAQss6kSSuR

HsJoNM//GUmC8Mh+YZ0wkpy8BcDxX7CxU4ALZQ==

Content-Type: multipart/alternative;

boundary="===============4261748735468286487=="

MIME-Version: 1.0

From: TD Direct Investing

To: root@nk.ca

Subject: [TD WebBroker] Security Protocol - Temporary Withdrawal Hold -

Unrecognized Device Access Verification Required

Date: Sat, 25 Jul 2026 03:50:58 +0900

Message-ID:

<178491905818.3307.16470108963559159387@kpgzmv.campaigns.arf01.com>

List-Unsubscribe-Post: List-Unsubscribe=One-Click

X-Auto-Response-Suppress: OOF, DR, RN, NRN

Feedback-ID: campaign:kpgzmv.campaigns.arf01.com:mailer

X-Entity-Ref-ID: 89d69dce-c30b-4844-a03f-14a94d1142fd

X-Spam_score: 17.4

X-Spam_score_int: 174

X-Spam_bar: +++++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: [TD WebBroker] Security Protocol: Temporary Withdrawal Hold

— Unrecognized Device Access Verification Required root, The TD Direct

Investing Security Operations Centre has identified one or more access events

associated with your TD WebBroker account that originate from a device, browser

fingerprint, or network endp [...]



Content analysis details: (17.4 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[35.215.3.35 listed in dnsbl.ahbl.org]

[35.215.3.35 listed in dnsbl.ahbl.org]

[35.215.3.35 listed in dnsbl.ahbl.org]

[35.215.3.35 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[35.215.3.35 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[35.215.3.35 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[35.215.3.35 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[35.215.3.35 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[35.215.3.35 listed in will-spam-for-food.eu.org]

[35.215.3.35 listed in will-spam-for-food.eu.org]

[35.215.3.35 listed in will-spam-for-food.eu.org]

[35.215.3.35 listed in will-spam-for-food.eu.org]

[35.215.3.35 listed in will-spam-for-food.eu.org]

[35.215.3.35 listed in will-spam-for-food.eu.org]

[35.215.3.35 listed in will-spam-for-food.eu.org]

[35.215.3.35 listed in will-spam-for-food.eu.org]

3.6 RCVD_IN_SBL_CSS RBL: Received via a relay in Spamhaus SBL-CSS

[35.215.3.35 listed in zen.spamhaus.org]

1.5 RCVD_IN_SBL_XBL RBL: Received via a relay in Spamhaus SBL+XBL

[35.215.3.35 listed in sbl-xbl.spamhaus.org]

2.5 URIBL_DBL_SPAM Contains a spam URL listed in the DBL blocklist

[URI: arf01.com]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[35.215.3.35 listed in bl.score.senderscore.com]

1.5 MR_STRANGE_QUESTION URI: No description available.

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

1.3 RDNS_NONE Delivered to internal network by a host with no rDNS

1.5 VOWEL_FROM_6 Impronouncable from header (6 consecutive vowels)

0.8 SARE_FROM_SPAM_WORD3 I don't know people named this!

1.5 TVD_PH_BODY_ACCOUNTS_PRE The body matches phrases such as "accounts

suspended", "account credited", "account

verification"

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

2.0 TVD_PH_BODY_META No description available.

Subject: {SPAM?} [TD WebBroker] Security Protocol - Temporary Withdrawal Hold -

Unrecognized Device Access Verification Required





▶Account Security — Verification Required

Unrecognized Device Access Detected

Temporary Withdrawal Hold Applied

TD WebBroker Security Operations Centre — Automated Threat Detection



root,



The TD Direct Investing Security Operations Centre has identified one or more access events associated with your TD WebBroker account that originate from a device, browser fingerprint, or network endpoint not previously recognized within your established access profile. In accordance with TD Direct Investing’s automated client asset protection protocols, a temporary hold on external fund transfers and third-party withdrawals has been applied to your account pending identity verification.



The access event(s) flagged by our security monitoring systems exhibited the following characteristics:

Access OriginUnrecognized IP Address / Geolocation

Device FingerprintNew / Previously Unseen Client Hash

Browser & Operating SystemUnfamiliar Configuration Profile

Access Time PatternDeviation from Historical Baseline

Account Function AccessedExternal Transfer & Withdrawal Module

Account Security Confidence Score

Requires Verification

Device Trust: Unverified — Account Holder Confirmation Required



TD Direct Investing applies these precautionary measures as a matter of operational security protocol to safeguard client assets against unauthorized access. The temporary hold applies exclusively to external transfer and third-party withdrawal functions. All other account functions—including portfolio viewing, order placement, and internal transfers between your TD accounts—continue to operate normally.

Protective Measure in Effect: External Transfer Hold

The temporary hold on external fund transfers and third-party withdrawals shall remain in effect until the account holder’s identity and control of the account are independently confirmed through the secure verification protocol. This measure is non-negotiable and is applied automatically when unrecognized device access is detected in conjunction with withdrawal-related account functions.



To resolve this matter and lift the temporary hold, please log in to your TD WebBroker account from a previously recognized device where possible, and complete the secure identity verification protocol. The verification process confirms that you are the legitimate account holder and that the flagged access event does not represent an ongoing security concern. If you confirm that the access was indeed initiated by you from a new device or location, the device will be registered to your trusted device profile and the hold will be released.

Log In to Verify Identity & Lift Hold



TD Direct Investing deploys continuous automated security monitoring across all TD WebBroker accounts. All access events are logged and subject to real-time behavioural analytics and anomaly detection. This alert is issued as part of TD Direct Investing’s commitment to the proactive protection of client accounts and assets. If you believe you have received this alert in error or require assistance completing the verification process, please contact the TD Direct Investing Security Operations Centre immediately through the Secure Message Centre upon login or by calling the number on the back of your TD Access Card. Do not reply to this email with sensitive or personal information.



Yours sincerely,

TD Direct Investing

Security Operations Centre



TD Direct Investing is a division of TD Waterhouse Canada Inc., a subsidiary of The Toronto-Dominion Bank. TD Waterhouse Canada Inc. is a Dealer Member of CIRO and a Member of CIPF.



This message is an automated security operations notification.

Please direct all inquiries through the Secure Message Centre within your TD WebBroker account.



TD Bank Group © 2026. All rights reserved.

web/SEO/App spam from Microsoft Outlook

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Fri, 24 Jul 2026 07:30:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wnFxk-0000000091p-3Bv7

for dave@doctor.nl2k.ab.ca;

Fri, 24 Jul 2026 07:29:16 -0600

Resent-From: The Doctor

Resent-Date: Fri, 24 Jul 2026 07:29:16 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-koreacentralazolkn19011024.outbound.protection.outlook.com ([52.103.74.24]:54631 helo=SLXP216CU001.outbound.protection.outlook.com)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wnEnm-00000000KSw-3wts

for sales@nk.ca;

Fri, 24 Jul 2026 06:15:05 -0600

ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none;

b=miPyEyK6+ImyZpUrCA9rY0Rt1ctqsjE2F3HQSxk5LRl5+jp8WdteaziGhM4zIjc9SAEpHmQERyVvPeBMaL3u+/pBBnBmrg9U72WXrMOQWCns506rcmE//ZHSGQiHC4L3SlqP6Q62N1l7GZ2v1UP7txeDCTlRmmrnWuGp8d4TLykRTHup5wBb55HL8C39r8KQkqO5rKy0bYctFYVABEoR3MmxVlSZloiKpkULGcw2T9YdloQwzr8vwtWjjhYKDkhktQ2zz6/ozhpgPFOWtd0QILoOQoywu0qz7MWNN+Etm2YUEiBUC7xzfrGu6qHvEvjM9Ww0IBFuAKnWv6/zO1Hq9A==

ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;

s=arcselector10001;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1;

bh=BYCIDlBYxDCB9L1F+Uw/2wr24KvvhhnYS5TLyF3tedw=;

b=GW9Wl7WcmmoFVF39Dp9TYVR/yaVmyXrmogESmLvW72h7delt8ayBYJXF+Pb+RGYsOjSf8vdthZbl3xcSIw5tCFuUAynyi/ny6JFCklSvtyJBsK4OhmcWhRp5lHnD1UGLpMamuANLDJJLQ6XoepEAMyDI0xDhfOalmKs1d6X0a/fcjM5vAQ21HTSJrYtF59wcY3miWqLa8TMxxYf37tImzImr1LBhF/A7Zo2kImkZuCf3STjAtJePylgw8+WnrWHcv6Wkd8lIriZzMQfV6V25xR1IE+M2TD6pm0pg/ANJ8pAE7q0uFoJo+XMw20Svpk83zhvdDVD0mL5ZDAR4rPzIVQ==

ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=none; dmarc=none;

dkim=none; arc=none

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=outlook.com;

s=selector1;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck;

bh=BYCIDlBYxDCB9L1F+Uw/2wr24KvvhhnYS5TLyF3tedw=;

b=eXq/YxL+K9z1nVAt6nl5JSeOu7+VeXetLOTMLIqnd/1dPqNIaPB2M7hzyVIa2FDmHiKRAQXwcAQh0af+NZJaxCm7W69qmenQQLDVKu66fN+2yu6ZE82UNpLco8fQQ2ZgP42AMT9f1xGbDosgku34V14qfEmZLXTx6NoCrvvFl00mpIErkIXa4xereLlUlkpm1g+c4FP8/LkqAV5cEcC788GVjXREbWWi33BuhGOkUFTeanVlCwH50fl+BAgh4Z9t57Z8KU1K6C1AL/2MkqCwtPeT2iE83NSBX6IOiFV0z3MxYczvYOBL2TieuJgU5MchmLliC5Je180BxFndHiE44w==

Received: from SLXP216MB1049.KORP216.PROD.OUTLOOK.COM (2603:1096:101:c::8) by

SE2P216MB3438.KORP216.PROD.OUTLOOK.COM (2603:1096:101:2fa::6) with Microsoft

SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id

15.21.245.11; Fri, 24 Jul 2026 12:13:26 +0000

Received: from SLXP216MB1049.KORP216.PROD.OUTLOOK.COM

([fe80::5e46:f9fd:e74:7ecf]) by SLXP216MB1049.KORP216.PROD.OUTLOOK.COM

([fe80::5e46:f9fd:e74:7ecf%4]) with mapi id 15.21.0245.010; Fri, 24 Jul 2026

12:13:26 +0000

From: Philip Masih

To: Philip Masih

Subject: Re:

Thread-Topic:

Thread-Index: AQHdGoU8sMvqT1QSy0SnBsLGarKyVbZ61amTgAAAQZaAAABV7IAAAFnBgAG/+rA=

Date: Fri, 24 Jul 2026 12:13:26 +0000

Message-ID:



References:





















In-Reply-To:



Accept-Language: en-GB, en-US

Content-Language: en-GB

X-MS-Has-Attach:

X-MS-TNEF-Correlator:

msip_labels:

x-ms-publictraffictype: Email

x-ms-traffictypediagnostic: SLXP216MB1049:EE_|SE2P216MB3438:EE_

x-ms-office365-filtering-correlation-id: 060a76c3-b251-4f7e-9c4a-08dee97cf6f9

x-microsoft-antispam:

BCL:0;ARA:14566002|8060799015|19110799012|55001999006|39105399006|48001999003|31061999003|24021099003|8062599012|15030799006|41001999006|15080799012|4140399003|25010399006|24121999003|12121999013|22091999003|37011999003|40105399003|41105399003|39145399003|26121999007|30101999006|18071099003|102099032|3412199025|440099028|1710799026;

x-microsoft-antispam-message-info:

=?Windows-1252?Q?WECVERMpcf5JWGLB9Q4hP3nrSdULYvHOdMGjf5YqGfZukkVy1g3jiaGt?=

=?Windows-1252?Q?lppT+YhZBy42ZFEyH3ZBqfh3+Zt4Tp0f0tpMjIg46hAnl0bOLwR39IFb?=

=?Windows-1252?Q?0jsCmFlldJ191T56TWl9kblb26s1tneSUMxGQUntYMfN94dMy4+NzZ44?=

=?Windows-1252?Q?fizKorhw6u+hrkVrhEmOUb8gPpjTnSM2qsxgc5bcmxdUq7AmvNWgCB3g?=

=?Windows-1252?Q?MNFPZTm9l4jS2frSvr7a7vpPHvaf6wuvNWCtWqzIIQuAGAJnG23qctgt?=

=?Windows-1252?Q?vx7SZmyvK2AjR1R/LFSNN8omtCtDwOFyOomiI7G+xye6x4mIUgsKer8w?=

=?Windows-1252?Q?iQIxgPIDBOgxTWuSjwz4DTwuPuFgyl3JstDDYu+mIbQv438aqL79lRY8?=

=?Windows-1252?Q?m1bqS4wVAJaIlRyDt2l8c2vNwjQuLYuewIxt6uQqR4ByuIYHjQb04Its?=

=?Windows-1252?Q?3GUN642aj3ysRIe2nqJuM894Uq3ZATtyMdRVIzc6r8MkwtsYVreFxC6i?=

=?Windows-1252?Q?1Ye3/SEpaVYG1UCstjSbXzbk0GgZArPdp6Ht0V7IjDaycLKK1jUdClNJ?=

=?Windows-1252?Q?MAV95SKKfDb0wKHy9C5kK3Q6QMdDpJ/QRBBoRRU2+53ZxBuII4TVYXyF?=

=?Windows-1252?Q?hpfWASKxJOJMqBy7QOwxXsQcloYKnkxXK2S/AbywbO3O+JkBFOQkzmFy?=

=?Windows-1252?Q?DPR7O+l9YOUZ6sWby0bx1zoswo4ozQWbvLzDJCtsouSj9UDgwsF7pmZ+?=

=?Windows-1252?Q?vude7GwrWkJrzW/W+kXoomi7pbvYsIqvfb59SdMYEzYajU5H/GyK/E6N?=

=?Windows-1252?Q?HyDZ0iBLoVTLZHFpaW3I54lVGO63Tg0VUK7jLOCnAjT+3FKLrzqBKKou?=

=?Windows-1252?Q?504xpiqvmCEFcRgUYI9khU424yGU9DM62PRtg5g7RiedgssLksGnTIpi?=

=?Windows-1252?Q?Q1bQ3WnBBrutwNfeYvow3PmtW8Dv0jaGv531XcchhHiNw9nZdGuJBDux?=

=?Windows-1252?Q?L0/YL9iRPZwHrtgRo4UMu5LWaLZC3+spoipJbf7+6bJBXFEVC+AtXQeq?=

=?Windows-1252?Q?h2m3Fhl/3aKcjueu0bySomYY/qBl1ZM3Fv1ldPOI3Gfr6QyRN2NJgPnZ?=

=?Windows-1252?Q?18u0Hg/n1+kBXEVDE1BJpuUPNDCp6TJalLsscU00vZXBmJzyx27ds1RY?=

=?Windows-1252?Q?yVUTpt0AG2RZpDimHYrPS+KXQWiDaBFMXqce0HU/DqrhtSLSnQz5JHOf?=

=?Windows-1252?Q?htlo1AfF70bvnYIJgE35uvqEQcDSG1TgY49GLW2mIPbU4GMYCVhHHWln?=

=?Windows-1252?Q?pokPBAW60L/YEyXIoFsbvQnd1VYW31/dxNE4l6De40BJZTHlh6kq+TBE?=

=?Windows-1252?Q?JUdOOcWwTSrRYysRuYMz6fa+Rqykp2xWyEOtXoKa7a72LDvit12+JEOZ?=

=?Windows-1252?Q?XMxYCz3Frg3/s2+N5d74DgsBQTusruAXuZHw6/+Pjoxu3CysAAlRDrsm?=

=?Windows-1252?Q?0nrrjo/Q?=

x-ms-exchange-antispam-messagedata-chunkcount: 1

x-ms-exchange-antispam-messagedata-0:

=?Windows-1252?Q?AcMPh5sHuu5JY2Xr1JvPFocWR2akBoN/WsSx+OJsJSTGSRjxyMv139Nz?=

=?Windows-1252?Q?i58zV59SZbH2YpMIW2C1NqVLWCUOiWu70rbTY4d1LuhyNKxEBg7qAgMk?=

=?Windows-1252?Q?99YiR+LdLNdeCUuNKl8gV3d/BMa1+HmSNwXRYxhCZDDPAXTh1M2ImxAD?=

=?Windows-1252?Q?l5VKy1sEe7sJ5dOxEErajTeSvPJ8xiwdE8qhTcuUb9fiZA8XoOv0czN5?=

=?Windows-1252?Q?FzjpQZw+FwONnBLTGPBYHi96VBkmb7TU0Tg017TBbw5nm9OWG0h7ao7m?=

=?Windows-1252?Q?qRoKKkBjjMDpCgiLeKsYheQj0cGLI6OkDhqrYeBLI4Gznw24f3opkGSJ?=

=?Windows-1252?Q?Jdt89r/HmEPwgMeepA1UQxkpsTfnNoFhJp3/ugWPirQZYCcsvbqBK2ny?=

=?Windows-1252?Q?Q1ioPaNZTuhnrKHDOw59xmtYiMDN2vJIyPp62J6wdvZatRNntRf4Q8bp?=

=?Windows-1252?Q?bJYqzT9eS1xiljT5FZqDzAtlEy0XYMt+lVG0at2lKbr0321OgWvFCuVP?=

=?Windows-1252?Q?s8i8G/Kd4sWV7IYbcGD0zaj0W0BRboJXAWuREX4K1NRUEiiRsVDbEcAu?=

=?Windows-1252?Q?vdHkO9KLsMVNs/M1tw9SBdP7wvxP2hfqzVUnlMwXo5pF8UbEWxH1NhXU?=

=?Windows-1252?Q?WXUqYvZtq4uMeulpFsXCEzVTFflWPu+JseQeyKHkN+3k5T3bmlbkSD78?=

=?Windows-1252?Q?XRuYJ3h2tiWUJ6aGpXgJNXW1bxruoTj0BZTgDmuAvCjpugC/yeQT6hWf?=

=?Windows-1252?Q?17+PFh5vnrF08hjsRf06lt9hOI774RCKLejQD3JprsBR398fehKpp3Wf?=

=?Windows-1252?Q?R9E8g0EZUfmARnJNV8sHj68JQbu90mCy8u+cL8s2sn42s7fsO+zIwL/o?=

=?Windows-1252?Q?K26lYG8CcGyzk+4g2zF34ATUIy7aVq7p5l1Wvgtm7kITWUDBFSCVtUJf?=

=?Windows-1252?Q?RLa4cde0J69Q5eNnuDJK1FMQ77s8IH6Rmiz1brSvj73qNn8bGe32LMY4?=

=?Windows-1252?Q?5pvXfj9RVxTTKXaRi/HZauzFzic6hxA0vEmx7SbUoIA+zcFZZjalq2PJ?=

=?Windows-1252?Q?x4E98iHkgG9vOFPTQrJfB/ClkRHuf/ksOLSQCXHpkaB/cIRmjAph8yJ+?=

=?Windows-1252?Q?VM/usYA2/ZFxjK9h4uD6HjU5Bj3ihpsxXlt+Bez7TwopIAVBld1cP2IX?=

=?Windows-1252?Q?7Ts+p8q59/REYIGTPYmwOAFVp3UqQ7F4X7U+sJBGZn+YLune+L4mB0M/?=

=?Windows-1252?Q?3MMWJ8IDsFzM2dsvKqNRdFSA9cfwaFZnlfdmG2IhgkqjXegZdxk9CWXg?=

=?Windows-1252?Q?jYCrNZuJJFuHkvlYPdWdtv/vNA+84DMRpbvgpfVJ++hwzMxm+pXYwaxG?=

=?Windows-1252?Q?Ldugx5dkzMmD2l4T4JV+IsEo0EEwOXz+fdnWJyxNRXGVQaZGnuCnxglx?=

=?Windows-1252?Q?UYFMqfQ3mxLzR4+2mDHFNsx4+d1WIHq0sYrAC3D6KFhK0ZzRvk2mRPG9?=

=?Windows-1252?Q?Fd1t4y+N?=

Content-Type: multipart/alternative;

boundary="_000_SLXP216MB10490C4F2DD8795A27AC511D98CF2SLXP216MB1049KORP_"

MIME-Version: 1.0

X-OriginatorOrg: outlook.com

X-MS-Exchange-CrossTenant-AuthAs: Internal

X-MS-Exchange-CrossTenant-AuthSource: SLXP216MB1049.KORP216.PROD.OUTLOOK.COM

X-MS-Exchange-CrossTenant-RMS-PersistedConsumerOrg: 00000000-0000-0000-0000-000000000000

X-MS-Exchange-CrossTenant-Network-Message-Id: 060a76c3-b251-4f7e-9c4a-08dee97cf6f9

X-MS-Exchange-CrossTenant-originalarrivaltime: 24 Jul 2026 12:13:26.1816

(UTC)

X-MS-Exchange-CrossTenant-fromentityheader: Hosted

X-MS-Exchange-CrossTenant-id: 84df9e7f-e9f6-40af-b435-aaaaaaaaaaaa

X-MS-Exchange-CrossTenant-rms-persistedconsumerorg: 00000000-0000-0000-0000-000000000000

X-MS-Exchange-Transport-CrossTenantHeadersStamped: SE2P216MB3438



--_000_SLXP216MB10490C4F2DD8795A27AC511D98CF2SLXP216MB1049KORP_

Content-Type: text/plain; charset="Windows-1252"

Content-Transfer-Encoding: quoted-printable



Hi,



Still waiting for your reply!



Please let me know if there is any interest in mobile app development.



Thank you,

________________________________

From: Philip Masih

Sent: 20 July 2026 17:53

To: Philip Masih

Subject: Mobile Application Proposal



Hello,



We are a Mobile app development company. Would you be interested to develop=

an App?



We have expertise in:-

=95 Transport App

=95 Food App

=95 Delivery App

=95 Appointment App

=95 Doctor App

=95 Medical App

=95 Fitness App

=95 Dating App

=95 Music App

=95 Travel App

=95 Shop App

=95 Business App

=95 Educational App

=95 Web App

=95 Hybrid App



Please share your App=92s idea with us (which will remain confidential) wit=

h your website URL for healthy communication.



Thanks & Regards,

Philip

Development Manager



--_000_SLXP216MB10490C4F2DD8795A27AC511D98CF2SLXP216MB1049KORP_

Content-Type: text/html; charset="Windows-1252"

Content-Transfer-Encoding: quoted-printable








252">








Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">

Hi, 



_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb=

(0, 0, 0);">







_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb=

(0, 0, 0);">

Still waiting for your reply!



_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb=

(0, 0, 0);">







_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb=

(0, 0, 0);">

Please let me know if there is any interest in mobile app development. =

;



_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb=

(0, 0, 0);">







_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb=

(0, 0, 0);">

Thank you,








11pt; color: rgb(0, 0, 0);">

From: Philip Masih <philipmasih482@outlook.com>


Sent: 20 July 2026 17:53


To: Philip Masih <philipmasih482@outlook.com>


Subject: Mobile Application Proposal


 





_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb=

(0, 0, 0);">

Hello,



_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb=

(0, 0, 0);">







_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb=

(0, 0, 0);">

We are a Mobile app development company. Would you be interested to develop=

an App?



_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb=

(0, 0, 0);">







_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb=

(0, 0, 0);">

We have expertise in:-



_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb=

(0, 0, 0);">

=95 Transport App



_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb=

(0, 0, 0);">

=95 Food App



_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb=

(0, 0, 0);">

=95 Delivery App



_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb=

(0, 0, 0);">

=95 Appointment App



_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb=

(0, 0, 0);">

=95 Doctor App



_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb=

(0, 0, 0);">

=95 Medical App



_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb=

(0, 0, 0);">

=95 Fitness App



_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb=

(0, 0, 0);">

=95 Dating App



_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb=

(0, 0, 0);">

=95 Music App



_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb=

(0, 0, 0);">

=95 Travel App



_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb=

(0, 0, 0);">

=95 Shop App



_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb=

(0, 0, 0);">

=95 Business App



_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb=

(0, 0, 0);">

=95 Educational App



_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb=

(0, 0, 0);">

=95 Web App



_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb=

(0, 0, 0);">

=95 Hybrid App



_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb=

(0, 0, 0);">

 



_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb=

(0, 0, 0);">

Please share your App=92s idea with us (which will remain confidential) wit=

h your website URL for healthy communication.  



_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb=

(0, 0, 0);">







_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb=

(0, 0, 0);">

Thanks & Regards,



_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb=

(0, 0, 0);">

Philip



_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb=

(0, 0, 0);">

Development Manager








--_000_SLXP216MB10490C4F2DD8795A27AC511D98CF2SLXP216MB1049KORP_--

ChatGPT phish from serviceshelps.com

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Fri, 24 Jul 2026 07:29:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wnFwy-000000008xe-42ku

for dave@doctor.nl2k.ab.ca;

Fri, 24 Jul 2026 07:28:28 -0600

Resent-From: The Doctor

Resent-Date: Fri, 24 Jul 2026 07:28:28 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mta.serviceshelps.com ([87.99.132.75]:34951)

by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

(Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wnCyx-00000000AGJ-23o7

for sales@nk.ca;

Fri, 24 Jul 2026 04:18:28 -0600

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; s=1784883504.serviceshelps;

d=serviceshelps.com;

h=Content-Type:MIME-Version:From:To:Subject:Date:Message-ID:List-Unsubscribe;

i=support@serviceshelps.com;

bh=wVpt49JWqY37C/3Zs/AgtnRqTwwhCnyhDyko6sXYgRg=;

b=FwCuLopg6VONm4IuZTvSQbiZKR6yRfuzF2Y/bK37tEnUISvTfgF14jWY0VNrb7C06c2ayetnZP0L

usHf+wv83UjdHBE0g12d7geAWM819CZWMbWH4q2hc1FEB3grpv5dtQLcmneQAIvWa87hpHqS9pnk

bSX76rp/8whCiFaTAXEDQ2h4FOV0VdzYscqjzT69Lo2ySDAmpckyQU5BFRigggfF4jc0nYH9wYr4

LjVcUG7vzumCkAPIhppZiIEa8gYEm0DG1lEGLlFoKo01ujAteB6B0qpQADqnB6UfWniPq1b2leWw

Y1XF/h7nrT1vNjlnI3BX9lsZcilvEZy06kGntg==

Content-Type: multipart/mixed; boundary="===============4557206524044104869=="

MIME-Version: 1.0

From: ChatGPT

To: sales@nk.ca

Subject: =?utf-8?q?Payment_Failed_=E2=80=94_ChatGPT_Subscription_Suspended?=

Date: Fri, 24 Jul 2026 03:17:30 -0700

Message-ID: <178488825008.11672.17320155450568200932@WIN-EP3PH7304AD>

X-Priority: 3

X-MSMail-Priority: Normal

Importance: Normal

X-Mailer: Mozilla Thunderbird

X-Auto-Response-Suppress: All

Precedence: bulk

List-Unsubscribe:

X-Spam-Status: No, score=0.0 required=5.0

X-Spam-Level:

X-Spam-Checker-Version: SpamAssassin (version 3.4.0)

X-Spam-Report: This message is not spam.

X-Spam_score: 5.8

X-Spam_score_int: 58

X-Spam_bar: +++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Your ChatGPT Subscription Has Been Paused Your Subscription

Has Been Paused



Content analysis details: (5.8 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[87.99.132.75 listed in dnsbl.ahbl.org]

[87.99.132.75 listed in dnsbl.ahbl.org]

[87.99.132.75 listed in dnsbl.ahbl.org]

[87.99.132.75 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[87.99.132.75 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[87.99.132.75 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[87.99.132.75 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[87.99.132.75 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[87.99.132.75 listed in will-spam-for-food.eu.org]

[87.99.132.75 listed in will-spam-for-food.eu.org]

[87.99.132.75 listed in will-spam-for-food.eu.org]

[87.99.132.75 listed in will-spam-for-food.eu.org]

[87.99.132.75 listed in will-spam-for-food.eu.org]

[87.99.132.75 listed in will-spam-for-food.eu.org]

[87.99.132.75 listed in will-spam-for-food.eu.org]

[87.99.132.75 listed in will-spam-for-food.eu.org]

-0.0 SPF_PASS SPF: sender matches SPF record

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-0.0 T_RP_MATCHES_RCVD Envelope sender domain matches handover relay

domain

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[87.99.132.75 listed in bl.score.senderscore.com]

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 URI_TRUNCATED BODY: Message contained a URI which was truncated

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

1.6 FORGED_MUA_MOZILLA Forged mail pretending to be from Mozilla

1.8 MISSING_MIMEOLE Message has X-MSMail-Priority, but no X-MimeOLE

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

Subject: {SPAM?} =?utf-8?q?Payment_Failed_=E2=80=94_ChatGPT_Subscription_Suspended?=



--===============4557206524044104869==

Content-Type: text/html; charset="us-ascii"

MIME-Version: 1.0

Content-Transfer-Encoding: 7bit













Your ChatGPT Subscription Has Been Paused




























































alt="ChatGPT"

width="160"

style="display:block;border:0;height:auto;max-width:160px;" />









Your Subscription Has Been Paused









Dear Customer,









We were unable to process the most recent payment for your ChatGPT subscription. The charge was declined due to insufficient funds or a declined payment method on file.







As a result, your subscription has been temporarily paused and you'll lose access to premium features including GPT-5, advanced data analysis, and more.







To regain full access, please update your payment method below. Your subscription will be reactivated immediately once the update is complete.


















target="_blank"

style="display:inline-block;background-color:#10a37f;color:#ffffff;text-decoration:none;padding:14px 36px;border-radius:8px;font-size:15px;font-weight:600;letter-spacing:0.2px;text-align:center;white-space:nowrap;">

Update Payment Method















You received this email because you have a ChatGPT account.


If you did not create this account, please disregard this message.





© 2026 OpenAI. All rights reserved.















--===============4557206524044104869==--

Aeroplan points phish from Sendgrid

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Fri, 24 Jul 2026 07:29:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wnFws-000000008xB-1SqH

for dave@doctor.nl2k.ab.ca;

Fri, 24 Jul 2026 07:28:22 -0600

Resent-From: The Doctor

Resent-Date: Fri, 24 Jul 2026 07:28:22 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from vsvhscxc.outbound-mail.sendgrid.net ([134.128.108.172]:36258)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wnCxu-00000000ABJ-410w

for root@nk.ca;

Fri, 24 Jul 2026 04:17:18 -0600

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=sendgrid.net;

h=content-type:date:from:mime-version:subject:reply-to:list-unsubscribe:

list-unsubscribe-post:to:cc:content-type:date:from:subject:to;

s=smtpapi; t=1784888182;

bh=ORbY7kzCUKxNYs6FcrI8VjduKe4PHld/pU2V09z3ahE=;

b=FW3YjW1q354Zk84+FWD04FZYuE/OYK2M8afCF8Dvst8aw4RpToI1JeyNuC5L02XAuApx

XBAUwB1oCFFl93vPg4m8dv88XQmg46ZTKowIcxZnT9c73p4CJ8kmdVSVYSZa9+Z9pcjYV4

gJhbzdG9YY/ZCOJQvIJ+YT0k7RXNOAALw=

Received: by recvd-f66db6c76-nr4b7 with SMTP id recvd-f66db6c76-nr4b7-1-6A633B76-3

2026-07-24 10:16:21.99697942 +0000 UTC m=+138325.487921945

Received: from NTM0ODA1Njc (unknown)

by geopod-ismtpd-94 (SG) with HTTP

id 2Hbi_45tTBmYNvWqjW80nQ

Fri, 24 Jul 2026 10:16:21.963 +0000 (UTC)

Content-Type: multipart/alternative; boundary=320e69bdc408514e005a25ee978f0a29c8d61f89b0995434b99f24c440af

Date: Fri, 24 Jul 2026 10:16:22 +0000 (UTC)

From: Aeroplan Points

Mime-Version: 1.0

Message-ID: <2Hbi_45tTBmYNvWqjW80nQ@geopod-ismtpd-94>

Subject: =?UTF-8?B?4pqg77iP?= Final Notice: Your Aeroplan Points Expire

November 30

Reply-To: du.tcharonson620@googlemail.com

List-Unsubscribe:

=?us-ascii?Q?=3Chttps=3A=2F=2Fu53480567=2Ect=2Esendgrid=2Enet=2Flu=2Funsubscribe=3Foc=3Du001=2ESdR=5F?=

=?us-ascii?Q?=5FsCN=5F7rZz8-Rbz2kDHv6XjDsTgUwD7BOqwV3PPS?=

=?us-ascii?Q?biAyR4beYCB5L-Fi83tNDwdpI2ceLLvKwk5N8g4?=

=?us-ascii?Q?eKjmbE0B9lOaw=5F7-IvdclzO68ZlNf-Anq4rRkLd?=

=?us-ascii?Q?ALK8MDAMTAkO3gJqX1v=5F4i4rzYFhhOD5q9C06Nf?=

=?us-ascii?Q?FkK2-wayO4-JsGE5GfVK-si=5FzOF6zb3DuT2kU3q?=

=?us-ascii?Q?p6vIb6hNNs7s=5FR2yK4GdI7e4AcPQEOxo=5Fnu99u5?=

=?us-ascii?Q?7K-KExhlmxDnqu56EY-eUpIcA4QZ5v4dqZldgs6?=

=?us-ascii?Q?7f2iJtz4CoDadG=5FXTFwLTzY8e1uddcRkWEcjSMX?=

=?us-ascii?Q?MXlnRMjXShFo-9vshatz2nxmHymVxrsK8KUK-Xy?=

=?us-ascii?Q?1WGahcJUQa75mhZKnxCfWmXsQeN=5FCzaM7cD5X1r?=

=?us-ascii?Q?87IRGzW1HAbvkud10ylWaIj0Lvo3xoyp-z8PKdP?=

=?us-ascii?Q?g8PxrpcnB=5FuJ7tZD507tODxZL3pAv10Cco=5FICXj?=

=?us-ascii?Q?6a3-dKaMSm0giCxr=5FNQoe=5FA=5FpI6jfZtvXS1rUFu?=

=?us-ascii?Q?mjAkdykSe=5FuiGYmWPIN8Bxo7DnHGyc-1fSIstgD?=

=?us-ascii?Q?pq-VWU-3M8cR0ubGvAbLrRY40EJ09xo=5Ftpp=5Ftdd?=

=?us-ascii?Q?=5FrtI6iwSbN-CVfL3zq0jS7w=5FVgSlol=5Fl-jRYBGf?=

=?us-ascii?Q?z4bxFqpioJ=5F7Mmd5ZrcL-gDxmHNqdUIKzOnd0Vk?=

=?us-ascii?Q?NE4hvvyDWVZQi5nrY6XAFvxZwB3xKZUPK9GnLgv?=

=?us-ascii?Q?077PK6vhUNcrqBgVm=5FE0f3w8O6f1p1gQmZ128yk?=

=?us-ascii?Q?3mqYVKBSMWUWCeIpnVb1XOoNCVLlsosHia2eSMj?=

=?us-ascii?Q?Ch9BhmFRaoJC30rC7rz5rGrquEia6evgnUMgtWi?=

=?us-ascii?Q?ojc4mHQPxoLoEcEWxuQLDybtoiGWO0PWNIJCj02?=

=?us-ascii?Q?BhlVKHC9XaNcMf-0PGYXfpDNUHq4KQZr47fyUSC?=

=?us-ascii?Q?MjboB9KQflvKJ4dqpf-qYc5FXphVgoYknwVewUd?=

=?us-ascii?Q?VKjzDh1EsrOxMRbIjsuGdDuDGOrk-j466Spr7tX?=

=?us-ascii?Q?Hvy9vwI7rMkhLlYfBUOaJMJGKDfg1En--UcKiTO?=

=?us-ascii?Q?3anMztcS5BAkD2cML7kc0vEjeVux7P9v=5Fiy-zOx?=

=?us-ascii?Q?uLfN11aRe9WsjsHiGUqGSa3=5FbwIrD969xrrOeU6?=

=?us-ascii?Q?yVEQBVUJsng6HsSGrcphJZ9zcrKnWz38lY08-HC?=

=?us-ascii?Q?5SFiJ0zx3T5kW2ZAORTnWmUFc7=5Fnqnv6msld8kH?=

=?us-ascii?Q?Ms1Tvfx19uiTm14P8po299JdP-cEFcTTSbN1K=5FY?=

=?us-ascii?Q?Pf69GpTowHMi5K6CUNx6lDf8N9TExoJJCYekdNC?=

=?us-ascii?Q?veuBsiZzbwpg0wcTca001qpeLnqqCNFEdQCXn6J?=

=?us-ascii?Q?KCyW6X6p4G41bh3f-1A-lbWEQ1jnVyUKW5e6-0e?=

=?us-ascii?Q?nj9HygfRB1lxeX=5F--tdUx268ldyZgE-1KXJA=3E=2C=3C?=

=?us-ascii?Q?mailto=3Aunsubscribe=40sendgrid=2Enet=3Fsubject?=

=?us-ascii?Q?=3Dhttps=3A=2F=2Fu53480567=2Ect=2Esendgrid=2Enet=2Fmt=2Fu?=

=?us-ascii?Q?=2Fu001=2E9QLdQEyMyPNLvIS5NnhdxG6qQLOP1xA5E?=

=?us-ascii?Q?fZdJMLDJF4=2F4sl=2Fu001=2EM=5Fki9d06=2Fu001=2Ep7ggp?=

=?us-ascii?Q?GYbNHJ4vKUM-2FW9CPnBeZzyxd2AM24oVDqSCQy?=

=?us-ascii?Q?Q7okK2WzCPTSFNqQsNV-2Bhnyn6RBim2FZZumww?=

=?us-ascii?Q?XnXhGRPZiy4ZxRJBNggaUHCprb5gjLScH6svxP0?=

=?us-ascii?Q?KcOqZmfx501AyXk4Bl7xXxNz4OA-2FQoKQyNk5V?=

=?us-ascii?Q?CloOL0mOrVsp-2Bgy9gx88QXCvr4Y7-2BHg-2Bo?=

=?us-ascii?Q?5TtE9jT-2BFuVfHx0rljHexYAoaUCNIiAYrajM5?=

=?us-ascii?Q?Z-2FuTTtV5-2ByiXQbxxyixjm47OC3g7wwFWi7L?=

=?us-ascii?Q?4OFFDwh-2FdUS0W-2BcNmWaqR2eDV15NxRLFvze?=

=?us-ascii?Q?r9edOzRDCha9McNlV483EWnETL6j-2FIU2JMWVV?=

=?us-ascii?Q?8vQt1hNjiN9pWVqkNJLppp-2B5WfG6O-2FcxbNg?=

=?us-ascii?Q?ya7wMVccOXSnqDXVVR38pHpWUbKDa56nLMTvo9l?=

=?us-ascii?Q?JcQd39MMsHTIKtK8j5xuk-2BTnubiQMo9Qrh4lh?=

=?us-ascii?Q?rTeRmYGb8Xl86s3e8K-2F-2BRfNDpmZMmGyJYNZ?=

=?us-ascii?Q?s2vobPpqYCaVLqjjAZRUY7CHW-2FLFzpqQjkTGy?=

=?us-ascii?Q?5jLrGYSDHw69jZbZg2gwXq9IPDOMxJDTxRH4hwF?=

=?us-ascii?Q?QzeM3Yo0J8DaY0of3mdCSuLDVTlSsZmP0AA8xQd?=

=?us-ascii?Q?bl7T23yf9iL4-2B9x0LYG-2BFIOjzXWm0OCrenZ?=

=?us-ascii?Q?9a3eiedCNpOu8CgqKCdD-2BO4iCTICzXMVWptKd?=

=?us-ascii?Q?paPI3o5UAL9jItm0ph33FpmliwjCNH00Atz-2By?=

=?us-ascii?Q?SojsfLofqHgXNXlRuczAtiGaP4YuQPugHKXUzaf?=

=?us-ascii?Q?AqKryvQpxguO6CmicD4z1S-2F8vMwl0lAE53-2B?=

=?us-ascii?Q?029mly-2FzaDFvHTNEKmOc1wDppy1nqKxmdOW-2?=

=?us-ascii?Q?Bi0SeqGhVbT53B6qShZDAG-2BqW3ft7i5D7JD5R?=

=?us-ascii?Q?SULPUKw6FZEo4vaASU-2BILe2x3CBq7OHNZswW4?=

=?us-ascii?Q?14DzfJXus-2Fp=2Fu001=2E8nk6MTNq=3E?=

List-Unsubscribe-Post: List-Unsubscribe=One-Click

X-SG-EID:

=?us-ascii?Q?u001=2EkPCokVTLpzOQN11CnW+qjss2owXwiFks=2FTgz9R=2FU4jfPl0ZXtdQBHmYH3?=

=?us-ascii?Q?d5qkGPfZG2KBfmsCEqFjKNhBRGbPKYMBB7XBlxq?=

=?us-ascii?Q?krc6TgGTf5gvKY0MIKmm5Z7J2I4gXd=2FmYBA5nl7?=

=?us-ascii?Q?plFxbHBc=2FqVphxYFqW6lV15ee=2Fs4C71cVPhHxEu?=

=?us-ascii?Q?MOnvv9gu8SGmwHEJE+fVNDxWj2jnjxyBrPxvIzn?=

=?us-ascii?Q?OI5Swg2MuhCD3hrQFoVg=2FePxaOXi1aX8+zcx62W?= =?us-ascii?Q?qd5R?=

X-SG-ID:

=?us-ascii?Q?u001=2EXwhBPNhCejkv4+fVosb2QVfR16Qxp9CrA7PjDe5zzeI=2F0IZCBsPXtgHbA?=

=?us-ascii?Q?oGIj+RskLxA4N2rJjSWrHfgX07tLOm0v5BUQcd6?=

=?us-ascii?Q?w3knjorGi7Hwu0WCOA5AFSvy0=2FwlG32=2FNAZeXoL?=

=?us-ascii?Q?EM+T8zDzl8AajadOUVFLcAti=2F60xz6KkEAPPwKv?=

=?us-ascii?Q?4Ant4inEbYmKEgStj7SRAgoD=2FhsvVpculaXgOBl?=

=?us-ascii?Q?TI7AuvGSTzU0wYWrOcFvA8a8x00b3jiK=2FnsTxC2?=

=?us-ascii?Q?snKxFDb=2FCtrVk=2FLxShFSrP3MF2Q6Bfa7H7crQo8?=

=?us-ascii?Q?pbcLon=2FSlzrgMnMgsq5+efOeVwmJCdp7zTbjbmE?=

=?us-ascii?Q?OvdQHfdivCspOlaMqfR0i2ZAzU+WVLVFSPf+TOP?=

=?us-ascii?Q?ccDLYIlsObC9aJsmWL55+7sLkuVyVFWR9IlYeTR?=

=?us-ascii?Q?ZPzzP=2F4Ay=2F72D48ieXOw4QJI2jOMhxTlvTnGHbo?=

=?us-ascii?Q?lG5Ax0ENINadVKhNSlYDQ5SjuDwP46f=2FTt0+fKO?=

=?us-ascii?Q?sHlvctpKAkuy08ouzv7VqO7uzJUMYtBlPPFQcmo?=

=?us-ascii?Q?vZXEblHoVkl26SQjxjAkDNx31AZPAcmKhNImII5?=

=?us-ascii?Q?iyXKJgo1MaytRzEBMAr55frIryrGCBypVvjpgxb?=

=?us-ascii?Q?tvRN2rEm8xxved6TQILAGO4KvqFIPRjk8+XSegz?=

=?us-ascii?Q?cTC507LCEXkOE4QP0AZ6MMuk+5HbySRMUnljt0u?=

=?us-ascii?Q?Dprj5yOO=2F4YPyhmP0c0Gqwl?=

To: root@nk.ca

X-Entity-ID: u001.ySM5x/GwaHPYGIUJEBBikQ==

X-Spam_score: 37.5

X-Spam_score_int: 375

X-Spam_bar: +++++++++++++++++++++++++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: AEROPLAN Your Points Are at Risk ⚠️ Action Required by

July 25, 2026



Content analysis details: (37.5 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[134.128.108.172 listed in dnsbl.ahbl.org]

[134.128.108.172 listed in dnsbl.ahbl.org]

[134.128.108.172 listed in dnsbl.ahbl.org]

[134.128.108.172 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[134.128.108.172 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[134.128.108.172 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[134.128.108.172 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[134.128.108.172 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[134.128.108.172 listed in will-spam-for-food.eu.org]

[134.128.108.172 listed in will-spam-for-food.eu.org]

[134.128.108.172 listed in will-spam-for-food.eu.org]

[134.128.108.172 listed in will-spam-for-food.eu.org]

[134.128.108.172 listed in will-spam-for-food.eu.org]

[134.128.108.172 listed in will-spam-for-food.eu.org]

[134.128.108.172 listed in will-spam-for-food.eu.org]

[134.128.108.172 listed in will-spam-for-food.eu.org]

-0.0 SPF_PASS SPF: sender matches SPF record

15 GR_DOMAIN_SENDGR1 Received contains spammer id (sendgr)

0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in digit

[du.tcharonson620(at)googlemail.com]

0.0 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level mail

domains are different

-0.0 T_RP_MATCHES_RCVD Envelope sender domain matches handover relay

domain

0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider

[du.tcharonson620(at)googlemail.com]

15 GR_DOMAIN_SENDGR6 URI: Body contains known spammer URI (sendgr)

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

2.0 VOWEL_URI_6 URI hostname with 6 consecutive vowels

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

0.2 FREEMAIL_FORGED_FROMDOMAIN 2nd level domains in From and EnvelopeFrom

freemail headers are different

Subject: {SPAM?} =?UTF-8?B?4pqg77iP?= Final Notice: Your Aeroplan Points Expire

November 30



--320e69bdc408514e005a25ee978f0a29c8d61f89b0995434b99f24c440af

Content-Transfer-Encoding: quoted-printable

Content-Type: text/plain; charset=utf-8

Mime-Version: 1.0



AEROPLAN



**********************

Your Points Are at Risk

**********************




=E2=9A=A0=EF=B8=8F Action Required by July 25, 2026



Dear {Member Name},



We noticed that your Aeroplan account has been inactive for *18 months*. Ac=

cording to our program terms, points may expire if no qualifying activity i=

s recorded within that period.



Your hard-earned points are worth real travel value =E2=80=94 *don't let th=

em go to waste*. Redeem them for flights, seat upgrades, hotel stays, car r=

entals, and more.



3,247

Aeroplan Points Available

=E2=8F=B3 Expires: July 25, 2026



=E2=9A=A0=EF=B8=8F Limited time remaining =E2=80=94 take action before th=

e deadline



=F0=9F=92=A1 Quick Tip: Making any eligible purchase with your Aeroplan c=

redit card will automatically extend your points for another 18 months.



Qualifying activities include:



=E2=9C=93 Redeem points for flights or upgrades =E2=9C=93 Book hotels or re=

ntal cars via Aeroplan partners =E2=9C=93 Earn points from retail, dining, =

or travel partners =E2=9C=93 Make purchases using your Aeroplan credit card



=F0=9F=94=92 Keep My Points Active ( https://www.mppvjh.com )



=F0=9F=94=90 Secure connection =E2=80=A2 No payment required =E2=80=A2 Inst=

ant activation



Act now =E2=80=94 once your points expire, they cannot be reinstated.



We appreciate your loyalty and hope you continue to enjoy the benefits of b=

eing an Aeroplan member.



Sincerely,

Aeroplan Member Services



Member #: {Member Number}



=F0=9F=9B=A1=EF=B8=8F Security Reminder: Aeroplan will never ask for yo=

ur password, PIN, or credit card details via email. Always verify you are o=

n the official Aeroplan website before entering any information.



This is an automated service message regarding your Aeroplan account. Pleas=

e do not reply to this email.



=C2=A9 2026 Aeroplan Loyalty Program. All rights reserved.

--320e69bdc408514e005a25ee978f0a29c8d61f89b0995434b99f24c440af

Content-Transfer-Encoding: quoted-printable

Content-Type: text/html; charset=utf-8

Mime-Version: 1.0












0">

Your Aeroplan Points Are About to Expire






l,Helvetica,sans-serif;">




nd-color:#f4f6f9;padding:30px 0;">












d:#ffffff;border-radius:8px;overflow:hidden;box-shadow:0 4px 20px rgba(0,0,=

0,0.08);">






































255,255,0.7);letter-spacing:3px;">

AEROPLAN




ight:1.3;">

Your Points Are at Risk





=E2=9A=A0=EF=B8=8F Action Required by July 25, 2026








weight:600;">

Dear {Member Name},







We noticed that your Aeroplan account has been inactive for 18 mont=

hs
.=20

According to our program terms, points may expire if no qualifying activity=

is recorded within that period.







Your hard-earned points are worth real travel value =E2=80=94 don't=

let them go to waste
.=20

Redeem them for flights, seat upgrades, hotel stays, car rentals, and more.








x;padding:28px 25px;margin:30px 0;text-align:center;">




>

3,247







Aeroplan Points Available






;background:#fff0f0;display:inline-block;padding:4px 16px;border-radius:20p=

x;">

=E2=8F=B3 Expires: July 25, 2026






















=E2=9A=A0=EF=B8=8F Limited time remaining<=

/strong> =E2=80=94 take action before the deadline














20px;margin:0 0 25px;border-radius:4px;">



=F0=9F=92=A1 Quick Tip: Making any eligible purchase with =

your Aeroplan credit card will automatically extend your points for another=

18 months.









Qualifying activities include:






0 25px;">


























t:1.8;border-bottom:1px solid #f0f0f0;">

=E2=9C=93 Redeem points for flights or upgrades


t:1.8;border-bottom:1px solid #f0f0f0;">

=E2=9C=93 Book hotels or rental cars via Aeroplan partners


t:1.8;border-bottom:1px solid #f0f0f0;">

=E2=9C=93 Earn points from retail, dining, or travel partners


t:1.8;">

=E2=9C=93 Make purchases using your Aeroplan credit card










VbxEAMpHdbYYnBk2C24jThtmu1utwCTY8-3DpzCa_YmNPztx4miJCrnDYqcF7jfR8yISc1B2YMc=

URCB95RzH7v-2FAlqusd9Q2l6rZumiG-2BKDbmL6ETKFvupUGdMmnHpZ8xnfswBgDv56ULRc6Ej=

7kJm-2BGqZQL6DqzqUNPNV7238ktb63re1Vuvzgscbmjh6KWccBT8mTGz6HmkDR2KHhp0Wzoz01=

vYeOYJISGX7KmJqop22-2Bd7e4ZW6pN0YXeM1271PiWnBKKrGkjwdex8LIrj6oQX5GPo6962hA4=

oeVxyWQpwGCYKGXvQ54LQ4sQI08bD4PSZqy95W5IAZhL-2BSKm6SPpfBxFvpv7ryGqaU2z-2FtW=

JYddMbsHVVE6SRc2CNund2Bv7j7TOTtFbck3dQj6cpsnQc-2FtAY05BmAc2lLXl3EXLVricPkDn=

CvFhFLGwCoHr-2BExo1CKpIOYZ0Kh2wZyvmoG96Ej9ZRt-2B7qa7CNuedLOaeVEnb1-2Br7Z3tI=

0bIhBRYHcbK8TRJ7uOmyk5iD-2F99-2FiFXPMx37IPufNTseSb6tN4viAY4t1N0mjn0ga7MrVi4=

qhWh7W8CRd2DqUdKBqOcBNRLrPjSikBbF7Oak8Xg2VllOAueLllLC7SEzXNcPKtf-2B1HDQ37iJ=

KaU2Z7LPUBRwJMc8eYy7HuAzw-2BddH6BGZ00Wc-2Bm5Kq6Xo4JUtLvXqQhKX2DD51PunWUsUHt=

Bc2ssIOxyqrgkgrpg8bRKuBt02-2BWXA7wiUYirp0AjY-2Bj2aTnH121pYy2jXk9hZylW57dKzP=

Zwe-2FTM2DXUF7M1MiJNVRsqhHcM-2Bzmi-2BAhxEuWJZiKgN83Pej9-2BaRi0en2k4QNvIe73k=

l6nghz2o-2B3To4DVBK-2BLArgSbyiKCGtkQNDvPCKIJcP90wXYtNiBASqG2cg-3D" style=3D=

"

background:#d71920;

color:#ffffff;

text-decoration:none;

padding:15px 44px;

border-radius:6px;

font-size:16px;

font-weight:bold;

display:inline-block;

box-shadow:0 4px 12px rgba(215,25,32,0.3);

">

=F0=9F=94=92 Keep My Points Active










line-height:1.6;">

=F0=9F=94=90 Secure connection =E2=80=A2 No payment required =E2=80=A2 Inst=

ant activation






">

Act now =E2=80=94 once your points expire, they cannot be reinstated.







We appreciate your loyalty and hope you continue to enjoy the benefits of b=

eing an Aeroplan member.







Sincerely,


Aeroplan Member Services






xt-align:center;border-top:1px solid #eee;padding-top:18px;">

Member #: {Member Number}






top:1px solid #e8e8e8;">





=F0=9F=9B=A1=EF=B8=8F Security Reminder:
strong>=20

Aeroplan will never ask for your password, PIN, or credit =

card details via email.=20

Always verify you are on the official Aeroplan website before entering any =

information.







This is an automated service message regarding your Aeroplan account.=20

Please do not reply to this email.







=C2=A9 2026 Aeroplan Loyalty Program. All rights reserved.














GZYDmBykh8zSgppscrG1a9-2FbnUZspF0av6mdLTg7APu65Yl-2FlT7gYWIWvlofAwKkY-2F2pt=

fbkc7w8h-2FPFa6xEfU55tVw9pxqAkjKcoCM5xYrUadMDhNOM92fWIv17g9YhozDkR7CnSOMHWp=

Kp-2FOCL5FPngHGR5vJixDSB2pKjOBbSSeBrl2C4HDeklkzb-2Fzbw4w1ozpYGHSYwVJPMr3g-2=

BQXxypOGqfR75fWSHgy3PX1YZ3XPQ7ht6-2F80BXspIM4bFdbHzcaB-2BPfMdaDjzCL4UvK4iZ3=

khVyTPaVQ0W1aIIZ7-2FTwpfPfW2-2BbGnIq1fz6UQN5Ynet6A9yEn3SYVLlSusvLcZ9DQcBpdH=

7nM-2B7ttKQhgRpxzhs9SSHe93QAA3W0QPwEIa2eoVJ64id-2BMD4F1A8JBSPsUo4KBqhjucstg=

uv4wg7kHkKJHxiTzWAsk-2BokKYMGuG2H7V2JOtzJ0eX5yhU7D5-2Fl5FHTmukUTMP4O7bcn4IX=

kLfvtioo7TVzstzMfPTWsW2-2Bp7f7Vbnrh3ZRvdi3LRwgN74dgw7OK5jUhr1A4OblzhotPTxRg=

8L6A4L46AEjjAJGmcE7-2B7dAfHAFLjN-2BGidKxCX3zAI13wkNB2z4XduBv-2BjHtws8TB3uuA=

TXNiEii1MmCqPWwpspl0dKZkFiPTcUAtz3lA3Gtza2yCly-2FLYW-2FFC4qVXSfl-2FZ1HK1MoW=

I-2FzrRgkO6VcpmhLbrYxnLH-2BpZrM2wIjF1cG6KVylb-2BRleqbwKqDJToAKp95R9d5Jy8vva=

AmAC-2Bl-2FYRCHIu4DZ84v3wSKTxk05EDzu46zJoW6Id2BNYC6VdSPS-2BouXqM9pUzOdgLb9a=

gdq7m-2Fsc8LDzkzBZahNKA-3D" alt=3D"" width=3D"1" height=3D"1" border=3D"0" =

style=3D"height:1px !important;width:1px !important;border-width:0 !importa=

nt;margin-top:0 !important;margin-bottom:0 !important;margin-right:0 !impor=

tant;margin-left:0 !important;padding-top:0 !important;padding-bottom:0 !im=

portant;padding-right:0 !important;padding-left:0 !important;"/>



--320e69bdc408514e005a25ee978f0a29c8d61f89b0995434b99f24c440af--