NetKnow Corporate Blog

Telent Communications phish Part 2

Posted by Dave Yadallee on Thursday, June 4. 2026

>

le=3D"font-family: verdana,geneva,sans-serif; font-size: 10pt;">Dear Telnet=

Customer,

We detected a recent sign-in to your Telnet email account=

=2E

or: rgb(35, 111, 161);">
sans-serif; font-size: 10pt;">Login Attempt :

t-family: verdana,geneva,sans-serif; font-size: 10pt;">Date &n=

bsp; : June 3, 2026, 02:49 PM
>Location : Moscow, Russia

pan style=3D"font-family: Verdana;">Device :&nbs=

p; Samsung Galaxy S24 Android 14

t-family: verdana,geneva,sans-serif; font-size: 10pt;">
family: Verdana;">If you don't recognize this activity,
style=3D"font-family: Verdana;">

secure-adm.netlify.app/" target=3D"_blank" rel=3D"noopener noreferrer" data=

-saferedirecturl=3D"https://www.google.com/url?q=3Dhttps://telnet-secure-ad=

m.netlify.app/&source=3Dgmail&ust=3D1780564954225000&usg=3DAOvV=

aw0NAl2CwoZWs8_a2fuWU_LT">
yle=3D"font-family: Verdana;">CLICK HERE
yle=3D"font-family: Verdana;"> to secure your account.

px;">

adding: 4px 10px; border-radius: 3.01px; border: 1px solid transparent; bor=

der-image: none; color: rgb(255, 255, 255); line-height: 1.4286; font-size:=

14px; font-weight: 600; vertical-align: baseline; display: inline-block; m=

in-height: 1.42em; background-color: rgb(0, 82, 204); text-decoration-color=

: currentcolor; text-decoration-line: none; text-decoration-style: solid;" =

href=3D"https://telnet-secure-adm.netlify.app/"=20

target=3D"_blank" rel=3D"noopener noreferrer" data-saferedirecturl=3D"https=

://www.google.com/url?q=3Dhttps://telnet-secure-adm.netlify.app/&source=

=3Dgmail&ust=3D1780564954225000&usg=3DAOvVaw0NAl2CwoZWs8_a2fuWU_LT"=

>SECURE YOUR EMAIL ACCOUNT HERE

erdana;">=

style=3D"font-family: verdana,geneva,sans-serif;">

mily: Rockwell Condensed;">
le=3D"font-family: Verdana;">
"font-size: 10pt;">If this was you :
=

style=3D"font-size: 10pt;">
: Rockwell Condensed;">

e=3D"color: rgb(196, 71, 59);">
style=3D"font-size: 9pt;">You can ignore t=

his message. There's no need to take any action.
>
isplay: inline-block; min-height: 0px;">
>

">

ackground-color: rgb(153, 153, 153);">
font-size: small;">
Teln=

et Communications

communications.com/" target=3D"_blank" rel=3D"noopener noreferrer" data-saf=

eredirecturl=3D"https://www.google.com/url?q=3Dhttp://www.telnetcommunicati=

ons.com/&source=3Dgmail&ust=3D1780564954225000&usg=3DAOvVaw2xam=

5Ldpo0NAVHX6OS6Jwj">
nt-size: 11pt;">
11pt;">http://www.

telnetcommunications.com/

ly: Verdana;">
pt;">
n style=3D"font-size: 9pt;">605 Boxwo=

od Drive

"font-family: Verdana;">
t-size: 10pt;">

e=3D"font-family: Verdana;">Cambridge, ON
>

t-size: 11pt;">
1pt;">
n style=3D"font-family: Verdana;">Canada N3E 1A5=

1pt;">
an style=3D"font-size: 10pt;">
style=3D"color: rgb(52, 52, 52);">1-=

855-TELNET1 (835-6381)
span>

Telent Communications phish Part 1

Posted by Dave Yadallee on Thursday, June 4. 2026

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Wed, 03 Jun 2026 20:11:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wUxXK-000000009Sw-2hq2

for dave@doctor.nl2k.ab.ca;

Wed, 03 Jun 2026 20:10:22 -0600

Resent-From: The Doctor

Resent-Date: Wed, 3 Jun 2026 20:10:22 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from [192.84.154.21] (port=51550 helo=mail.aquila.infn.it)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wUx51-0000000064d-0t3n

for sales@nk.ca;

Wed, 03 Jun 2026 19:41:15 -0600

Received: from localhost (localhost [127.0.0.1])

by mail.aquila.infn.it (Postfix) with ESMTP id 60BC8963D01A1

for ; Thu, 4 Jun 2026 03:40:12 +0200 (CEST)

Received: from mail.aquila.infn.it ([127.0.0.1])

by localhost (mail.aquila.infn.it [127.0.0.1]) (amavis, port 10032)

with ESMTP id uBo3tUtET2Ub for ;

Thu, 4 Jun 2026 03:40:12 +0200 (CEST)

Received: from localhost (localhost [127.0.0.1])

by mail.aquila.infn.it (Postfix) with ESMTP id 47C67963D01A0

for ; Thu, 4 Jun 2026 03:40:12 +0200 (CEST)

X-Virus-Scanned: amavis at aquila.infn.it

Received: from mail.aquila.infn.it ([127.0.0.1])

by localhost (mail.aquila.infn.it [127.0.0.1]) (amavis, port 10026)

with ESMTP id Mw_z46Mvh2Fy for ;

Thu, 4 Jun 2026 03:40:12 +0200 (CEST)

Received: from [14.192.212.45] (unknown [14.192.212.45])

by mail.aquila.infn.it (Postfix) with ESMTPSA id 9D252963D01A1

for ; Thu, 4 Jun 2026 03:40:11 +0200 (CEST)

From: "=?UTF-8?B?VGVsbmV0IENvbW11bmljYXRpb25zIMKu?="

To: sales@nk.ca

Subject: =?UTF-8?B?4oCiIFNFQ1VSSVRZIEFMRVJUOiBQcm90ZWN0IHlvdXIgVGVsbmV0IEFjY291bnQ=?=

Date: 3 Jun 2026 20:40:08 -0500

Message-ID: <20260603204008.F9D3F61B41D27029@aquila.infn.it>

MIME-Version: 1.0

Content-Type: text/html

Content-Transfer-Encoding: quoted-printable

X-Spam_score: 8.3

X-Spam_score_int: 83

X-Spam_bar: ++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.

Content preview: Dear Telnet Customer, We detected a recent sign-in to your

Telnet email account. Login Attempt :

Content analysis details: (8.3 points, 5.0 required)

pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[192.84.154.21 listed in dnsbl.ahbl.org]

[192.84.154.21 listed in dnsbl.ahbl.org]

[192.84.154.21 listed in dnsbl.ahbl.org]

[192.84.154.21 listed in dnsbl.ahbl.org]

[14.192.212.45 listed in dnsbl.ahbl.org]

[14.192.212.45 listed in dnsbl.ahbl.org]

[14.192.212.45 listed in dnsbl.ahbl.org]

[14.192.212.45 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[192.84.154.21 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[192.84.154.21 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[192.84.154.21 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[192.84.154.21 listed in dnsbl.ahbl.org]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[192.84.154.21 listed in will-spam-for-food.eu.org]

[192.84.154.21 listed in will-spam-for-food.eu.org]

[192.84.154.21 listed in will-spam-for-food.eu.org]

[192.84.154.21 listed in will-spam-for-food.eu.org]

[192.84.154.21 listed in will-spam-for-food.eu.org]

[192.84.154.21 listed in will-spam-for-food.eu.org]

[192.84.154.21 listed in will-spam-for-food.eu.org]

[192.84.154.21 listed in will-spam-for-food.eu.org]

[14.192.212.45 listed in will-spam-for-food.eu.org]

[14.192.212.45 listed in will-spam-for-food.eu.org]

[14.192.212.45 listed in will-spam-for-food.eu.org]

[14.192.212.45 listed in will-spam-for-food.eu.org]

[14.192.212.45 listed in will-spam-for-food.eu.org]

[14.192.212.45 listed in will-spam-for-food.eu.org]

[14.192.212.45 listed in will-spam-for-food.eu.org]

[14.192.212.45 listed in will-spam-for-food.eu.org]

-0.7 RCVD_IN_DNSWL_LOW RBL: Sender listed at http://www.dnswl.org/, low

trust

[192.84.154.21 listed in list.dnswl.org]

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[192.84.154.21 listed in wl.mailspike.net]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[192.84.154.21 listed in bl.score.senderscore.com]

-0.0 SPF_PASS SPF: sender matches SPF record

0.5 NO_RDNS Sending MTA has no reverse DNS (Postfix variant)

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 NO_RDNS2 Sending MTA has no reverse DNS

1.3 RDNS_NONE Delivered to internal network by a host with no rDNS

2.0 PDS_DBL_URL_TNB_RUNON Double-url and To no arrows, from runon

1.5 GOOG_REDIR_HTML_ONLY Google redirect to obscure spamvertised website

+ HTML only

1.5 GOOG_REDIR_NORDNS Google redirect to obscure spamvertised website +

no rDNS

0.0 TO_NO_BRKTS_NORDNS_HTML To: misformatted and no rDNS and HTML only

Subject: {SPAM?} =?UTF-8?B?4oCiIFNFQ1VSSVRZIEFMRVJUOiBQcm90ZWN0IHlvdXIgVGVsbmV0IEFjY291bnQ=?=

Nigerian Phish Part 2

Posted by Dave Yadallee on Thursday, June 4. 2026

You will not see this in a MIME-aware mail reader.

--===============1359163047==

Content-Type: text/plain; charset="utf-8"

MIME-Version: 1.0

Content-Transfer-Encoding: quoted-printable

Content-Description: Mail message body

=

Dear Sir/Madam,

My Warmest Greetings.

With due respect and humility, I was forced to write to you about your huma=

nitarian aid. I am Mrs. Antonia Atlasik a widow, who is aging long term il=

lness (cancer).

I am currently admitted to a private hospital.

I have some assets that I inherited from my late husband. When my husband w=

as alive, He made a deposit of ($11 MILLION DOLLARS).Currently this money i=

s still in the Bank.The doctor told me that I will not last for more than =

one month due to cancer problems.

I need someone who is a very capable, honest, healthy or wealthy person or =

an organization that can spend these funds on God=2019s work to help the po=

or and the needy. My late husband taught that this fund should be used for =

charitable purposes like advancing Chief Executive Officer (CEOS).

health, education, religion, culture or social or public welfare such as b=

uilding schools, houses, orphanages, hospitals, etc. This also will help in=

promoting or protecting human rights, and other purposes beneficial to the=

public.I made that decision because I don't have any child that will inher=

it this fund and want God to have mercy on me and receive my soul. With God=

all things are possible. Please, please, if you can use this fund for God'=

s work, please get back to me.

I want you to send me the following information listed below:

Your full name

Your country

Your address

Your age

Your occupation

Your phone number

I understand that I don't know you in person but I have been directed to do=

this by God Almighty. If you are interested in carrying out this task, get=

back to me for more details on this noble project of mine.

I hope to receive your reply Immediately. And please send your reply to thi=

s below private e-mail address: aatlasik405@gmail.com

Stay blessed in the Lord.

Thank you.

Yours Faithfully,

Mrs.Antonia Atlasik.

--===============1359163047==

Content-Type: text/html; charset="utf-8"

MIME-Version: 1.0

Content-Transfer-Encoding: quoted-printable

Content-Description: Mail message body

=3Dutf-8"/>

Dear Sir/Madam,
My Warmest Greeting=

s.
With due respect and humility, I was forced to write to you about you=

r humanitarian aid. I am Mrs. Antonia Atlasik a widow, who is aging l=

ong term illness (cancer).
I am currently admitted to a private hospital=

.
I have some assets that I inherited from my late husband. When my husb=

and was alive, He made a deposit of ($11 MILLION DOLLARS).Currently this mo=

ney is still in the Bank.The doctor told me that I will not last=

for more than one month due to cancer problems.
I need someone who is a=

very capable, honest, healthy or wealthy person or an organization that ca=

n spend these funds on God=E2=80=99s work to help the poor and the needy. M=

y late husband taught that this fund should be used for charitable purposes=

like advancing Chief Executive Officer (CEOS).
health, education,=

religion, culture or social or public welfare such as building schools, ho=

uses, orphanages, hospitals, etc. This also will help in promoting or prote=

cting human rights, and other purposes beneficial to the public.I made that=

decision because I don't have any child that will inherit this fund and wa=

nt God to have mercy on me and receive my soul. With God all things are pos=

sible. Please, please, if you can use this fund for God's work, please get =

back to me.
I want you to send me the following information listed below=

:
Your full name
Your country
Your address
Your age
Your occ=

upation
Your phone number
I understand that I don't know you in perso=

n but I have been directed to do this by God Almighty. If you are intereste=

d in carrying out this task, get back to me for more details on this noble =

project of mine.
I hope to receive your reply Immediately. And please se=

nd your reply to this below private e-mail address:
sik405@gmail.com">aatlasik405@gmail.com
Stay blessed in the Lord.
>Thank you.
Yours Faithfully,
Mrs.Antonia Atlasik.

ML>

--===============1359163047==--

Nigerian Phish Part 1

Posted by Dave Yadallee on Thursday, June 4. 2026

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Wed, 03 Jun 2026 18:33:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wUw0V-000000000T6-14MT

for dave@doctor.nl2k.ab.ca;

Wed, 03 Jun 2026 18:32:23 -0600

Resent-From: The Doctor

Resent-Date: Wed, 3 Jun 2026 18:32:23 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail.sibotec.com.ar ([138.219.41.184]:42646)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wUvTy-00000000NIs-0WjX

for sales@nk.ca;

Wed, 03 Jun 2026 17:58:55 -0600

Content-Type: multipart/alternative; boundary="===============1359163047=="

MIME-Version: 1.0

Subject: Please Read And Reply At Once!

To: Recipients

From: atlasikantonia0@gmail.com

Date: Thu, 04 Jun 2026 01:57:34 +0200

X-Spam_score: 17.2

X-Spam_score_int: 172

X-Spam_bar: +++++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.

Content preview: Dear Sir/Madam, My Warmest Greetings. With due respect and

humility, I was forced to write to you about your humanitarian aid. I am

Mrs. Antonia Atlasik a widow, who is aging long term illness (cance [...]

Content analysis details: (17.2 points, 5.0 required)

pts rule name description

---- ---------------------- --------------------------------------------------

0.1 MISSING_MID Missing Message-Id: header

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[138.219.41.184 listed in dnsbl.ahbl.org]

[138.219.41.184 listed in dnsbl.ahbl.org]

[138.219.41.184 listed in dnsbl.ahbl.org]

[138.219.41.184 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[138.219.41.184 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[138.219.41.184 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[138.219.41.184 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[138.219.41.184 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[138.219.41.184 listed in will-spam-for-food.eu.org]

[138.219.41.184 listed in will-spam-for-food.eu.org]

[138.219.41.184 listed in will-spam-for-food.eu.org]

[138.219.41.184 listed in will-spam-for-food.eu.org]

[138.219.41.184 listed in will-spam-for-food.eu.org]

[138.219.41.184 listed in will-spam-for-food.eu.org]

[138.219.41.184 listed in will-spam-for-food.eu.org]

[138.219.41.184 listed in will-spam-for-food.eu.org]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

1.0 SPF_SOFTFAIL SPF: sender does not match SPF record (softfail)

1.0 FORGED_GMAIL_RCVD 'From' gmail.com does not match 'Received' headers

0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends in

digit

[atlasikantonia0(at)gmail.com]

0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider

[atlasikantonia0(at)gmail.com]

1.5 BILLION_DOLLARS BODY: Talks about lots of money

1.7 DEAR_SOMETHING BODY: Contains 'Dear (something)'

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[138.219.41.184 listed in bl.score.senderscore.com]

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 HTML_MESSAGE BODY: HTML included in message

2.0 MIXED_HREF_CASE Has href in mixed case

0.0 LOTS_OF_MONEY Huge... sums of money

0.9 TEQF_USR_POLITE To and from user nearly same + polite greeting

1.0 FREEMAIL_REPLY From and body contain different freemails

0.4 TO_EQ_FM_DIRECT_MX To == From and direct-to-MX

0.0 T_FILL_THIS_FORM_LONG Fill in a form with personal information

2.0 FILL_THIS_FORM_LONG Fill in a form with personal information

0.7 SPOOFED_FREEMAIL No description available.

0.0 FILL_THIS_FORM Fill in a form with personal information

0.0 MONEY_FORM Lots of money if you fill out a form

0.9 SPOOF_GMAIL_MID From Gmail but it doesn't seem to be...

0.5 MONEY_FRAUD_8 Lots of money and very many fraud phrases

1.8 ADVANCE_FEE_5_NEW_FRM_MNY Advance Fee fraud form and lots of money

Subject: {SPAM?} Please Read And Reply At Once!

German language spam

Posted by Dave Yadallee on Thursday, June 4. 2026

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Wed, 03 Jun 2026 17:55:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wUvPi-00000000JcZ-1epd

for dave@doctor.nl2k.ab.ca;

Wed, 03 Jun 2026 17:54:22 -0600

Resent-From: The Doctor

Resent-Date: Wed, 3 Jun 2026 17:54:22 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail.sarpi-dz.com ([41.111.186.158]:30024)

by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

(Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wUuHa-00000000Osg-3gAJ

for doctor@doctor.nl2k.ab.ca;

Wed, 03 Jun 2026 16:42:03 -0600

From: Abdessamed MANAA

Subject: wir haben versucht, Sie zu erreichen.

Thread-Topic: wir haben versucht, Sie zu erreichen.

Thread-Index: Adzzm0yYL3ObFSIIQKWtyq5+oJP2SwAC1cYAAABBwGAAAAAGYAAAAApQ

Date: Wed, 3 Jun 2026 22:33:39 +0000

Message-ID: <99476e27694145baa2788b46499b90df@sarpi-dz.com>

Reply-To: Frau Maria Elisabeth Schaeffler

Accept-Language: fr-FR, en-US

Content-Language: en-US

X-MS-Has-Attach:

X-MS-TNEF-Correlator:

Content-Type: multipart/alternative;

boundary="_000_99476e27694145baa2788b46499b90dfsarpidzcom_"

MIME-Version: 1.0

DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; d=sarpi-dz.com; s=Sarpi_Key; c=relaxed/relaxed;

h=from:subject:date:message-id:reply-to:content-type:mime-version;

bh=lgg67GjF1lTHLUgZ5DoZvjAXEzFE8Nl1BPVBLx87PZI=;

b=GenEmXI6qhSvfU7zMxa4LSb5NgffgHMkrGmKaHTGs2YU+QwHrZCsQJrpIdZ+dgc5PFa426KuoUI2

phBYmCjAnmKvmwmm54Sh2DU5ouJP6gVEecrjKsuxlOF7tIbWy+rkJ4dnXM1srttlNCEmBlGcF+MT

nXygDzWlxIEQofOR65Z/vxlbnvMx1M+9YEIH7ZxfxhOpyCwD5JSzopojNfj4qQEsnDUW7yC304mW

fheFJmikUwLeDQWjMKE0Tg9knsjtrczNLu9GPeQic9apd/gxN3EC8d0T42XLxNbI3kY5iBlLJSRH

VyAOpyHkYhubvyVDq1G2WBYuBiHkRB6T19aJRA==

X-Spam_score: 7.6

X-Spam_score_int: 76

X-Spam_bar: +++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.

Content preview: Hallo, wir haben versucht, Sie zu erreichen. Ich habe mich

entschlossen, Ihnen 1 Million Euro zu spenden. Sollten Sie an meiner Spende

interessiert sein, kontaktieren Sie mich bitte fÃ¼r weitere Informatione

[...]

Content analysis details: (7.6 points, 5.0 required)

pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[41.111.186.158 listed in dnsbl.ahbl.org]

[41.111.186.158 listed in dnsbl.ahbl.org]

[41.111.186.158 listed in dnsbl.ahbl.org]

[41.111.186.158 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[41.111.186.158 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[41.111.186.158 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[41.111.186.158 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[41.111.186.158 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[41.111.186.158 listed in will-spam-for-food.eu.org]

[41.111.186.158 listed in will-spam-for-food.eu.org]

[41.111.186.158 listed in will-spam-for-food.eu.org]

[41.111.186.158 listed in will-spam-for-food.eu.org]

[41.111.186.158 listed in will-spam-for-food.eu.org]

[41.111.186.158 listed in will-spam-for-food.eu.org]

[41.111.186.158 listed in will-spam-for-food.eu.org]

[41.111.186.158 listed in will-spam-for-food.eu.org]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[41.111.186.158 listed in wl.mailspike.net]

-0.0 SPF_PASS SPF: sender matches SPF record

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

-0.0 T_RP_MATCHES_RCVD Envelope sender domain matches handover relay

domain

1.2 MISSING_HEADERS Missing To: header

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[41.111.186.158 listed in bl.score.senderscore.com]

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 HTML_MESSAGE BODY: HTML included in message

1.9 REPLYTO_WITHOUT_TO_CC No description available.

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

0.0 LOTS_OF_MONEY Huge... sums of money

2.5 FREEMAIL_FORGED_REPLYTO Freemail in Reply-To, but not From

0.7 MONEY_FROM_41 Lots of money from Africa

0.0 MONEY_FREEMAIL_REPTO Lots of money from someone using free email?

Subject: {SPAM?} wir haben versucht, Sie zu erreichen.

--_000_99476e27694145baa2788b46499b90dfsarpidzcom_

Content-Type: text/plain; charset="iso-8859-1"

Content-Transfer-Encoding: quoted-printable

Hallo,

wir haben versucht, Sie zu erreichen. Ich habe mich entschlossen, Ihnen 1 M=

illion Euro zu spenden. Sollten Sie an meiner Spende interessiert sein, kon=

taktieren Sie mich bitte f=FCr weitere Informationen.

Ich w=FCrde mich =FCber eine baldige Antwort freuen.

Mit freundlichen Gr=FC=DFen,

Frau Maria Elisabeth Schaeffler.

--_000_99476e27694145baa2788b46499b90dfsarpidzcom_

Content-Type: text/html; charset="iso-8859-1"

Content-Transfer-Encoding: quoted-printable

osoft-com:office:office" xmlns:w=3D"urn:schemas-microsoft-com:office:word" =

xmlns:m=3D"http://schemas.microsoft.com/office/2004/12/omml" xmlns=3D"http:=

//www.w3.org/TR/REC-html40">

1">

Hallo,

wir haben versucht, Sie zu erreichen. Ich habe mich =

entschlossen, Ihnen 1 Million Euro zu spenden. Sollten Sie an meiner Spende=

interessiert sein, kontaktieren Sie mich bitte f=FCr weitere Informationen=

.

Ich w=FCrde mich =FCber eine baldige Antwort freuen.=

Mit freundlichen Gr=FC=DFen,

Frau Maria Elisabeth Schaeffler.

--_000_99476e27694145baa2788b46499b90dfsarpidzcom_--

German language spam

Posted by Dave Yadallee on Thursday, June 4. 2026

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Wed, 03 Jun 2026 16:58:00 -0600

Received: from mail.sarpi-dz.com ([41.111.186.158]:32506)

by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

(Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wUuW5-000000006t7-17x4

for dave@doctor.nl2k.ab.ca;

Wed, 03 Jun 2026 16:57:01 -0600

From: Abdessamed MANAA

Subject: wir haben versucht, Sie zu erreichen.

Thread-Topic: wir haben versucht, Sie zu erreichen.

Thread-Index: Adzzm0yYL3ObFSIIQKWtyq5+oJP2SwAC1cYAAABBwGAAAAAGYAAAAApQAAAAC7AAAAAJEA==

Date: Wed, 3 Jun 2026 22:33:27 +0000

Message-ID:

Reply-To: Frau Maria Elisabeth Schaeffler

Accept-Language: fr-FR, en-US

Content-Language: en-US

X-MS-Has-Attach:

X-MS-TNEF-Correlator:

Content-Type: multipart/alternative;

boundary="_000_b2106956d937470c9cd9e2d9d4261b3bsarpidzcom_"

MIME-Version: 1.0

DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; d=sarpi-dz.com; s=Sarpi_Key; c=relaxed/relaxed;

h=from:subject:date:message-id:reply-to:content-type:mime-version;

bh=870dS3rRTaRuYmzfO1T5V9a17nMg/Zq+XUSVmRoTkgA=;

b=tquxWpoVQ9a8lbN04v2r7npRedV56JtmssxI9ORXwXujBv0QAy4LQZjXYcynP8bAB284woGfsZkn

VksifoSXG9/xaWrFY7mFTg+uzRiYCh0qVoZfR4pNJtX61o4BsCTXnvN2EEIySVQ9qjSJl4Cm8/jo

tRh6c/9sZtPDICuNi1Eq6ctgrqQkSHYGx7RoHuhQ5rr0/mxBrnkErVQnOxFIUTyfeZ3r1bjQ1P49

CmZ1rnfc46n1lRPx/qppYj0HU6eHWfugwpeeAtjDjaDpekJLJ16LsADplf/ZPa63E2XhKAiqzuR6

1XqXMjQf03stBkWoHsUHPz+MxU8n2c+AM9bgiA==

X-Spam_score: 7.6

X-Spam_score_int: 76

X-Spam_bar: +++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.

Content preview: Hallo, wir haben versucht, Sie zu erreichen. Ich habe mich

entschlossen, Ihnen 1 Million Euro zu spenden. Sollten Sie an meiner Spende

interessiert sein, kontaktieren Sie mich bitte fÃ¼r weitere Informatione

[...]

Content analysis details: (7.6 points, 5.0 required)

pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[41.111.186.158 listed in dnsbl.ahbl.org]

[41.111.186.158 listed in dnsbl.ahbl.org]

[41.111.186.158 listed in dnsbl.ahbl.org]

[41.111.186.158 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[41.111.186.158 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[41.111.186.158 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[41.111.186.158 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[41.111.186.158 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[41.111.186.158 listed in will-spam-for-food.eu.org]

[41.111.186.158 listed in will-spam-for-food.eu.org]

[41.111.186.158 listed in will-spam-for-food.eu.org]

[41.111.186.158 listed in will-spam-for-food.eu.org]

[41.111.186.158 listed in will-spam-for-food.eu.org]

[41.111.186.158 listed in will-spam-for-food.eu.org]

[41.111.186.158 listed in will-spam-for-food.eu.org]

[41.111.186.158 listed in will-spam-for-food.eu.org]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-0.0 SPF_PASS SPF: sender matches SPF record

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

-0.0 T_RP_MATCHES_RCVD Envelope sender domain matches handover relay

domain

1.2 MISSING_HEADERS Missing To: header

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[41.111.186.158 listed in bl.score.senderscore.com]

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[41.111.186.158 listed in wl.mailspike.net]

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 LOTS_OF_MONEY Huge... sums of money

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

2.5 FREEMAIL_FORGED_REPLYTO Freemail in Reply-To, but not From

1.9 REPLYTO_WITHOUT_TO_CC No description available.

0.7 MONEY_FROM_41 Lots of money from Africa

0.0 MONEY_FREEMAIL_REPTO Lots of money from someone using free email?

Subject: {SPAM?} wir haben versucht, Sie zu erreichen.

--_000_b2106956d937470c9cd9e2d9d4261b3bsarpidzcom_

Content-Type: text/plain; charset="iso-8859-1"

Content-Transfer-Encoding: quoted-printable

Hallo,

wir haben versucht, Sie zu erreichen. Ich habe mich entschlossen, Ihnen 1 M=

illion Euro zu spenden. Sollten Sie an meiner Spende interessiert sein, kon=

taktieren Sie mich bitte f=FCr weitere Informationen.

Ich w=FCrde mich =FCber eine baldige Antwort freuen.

Mit freundlichen Gr=FC=DFen,

Frau Maria Elisabeth Schaeffler.

--_000_b2106956d937470c9cd9e2d9d4261b3bsarpidzcom_

Content-Type: text/html; charset="iso-8859-1"

Content-Transfer-Encoding: quoted-printable

osoft-com:office:office" xmlns:w=3D"urn:schemas-microsoft-com:office:word" =

xmlns:m=3D"http://schemas.microsoft.com/office/2004/12/omml" xmlns=3D"http:=

//www.w3.org/TR/REC-html40">

1">

Hallo,

wir haben versucht, Sie zu erreichen. Ich habe mich =

entschlossen, Ihnen 1 Million Euro zu spenden. Sollten Sie an meiner Spende=

interessiert sein, kontaktieren Sie mich bitte f=FCr weitere Informationen=

.

Ich w=FCrde mich =FCber eine baldige Antwort freuen.=

Mit freundlichen Gr=FC=DFen,

Frau Maria Elisabeth Schaeffler.

--_000_b2106956d937470c9cd9e2d9d4261b3bsarpidzcom_--

Docusign phish from Google User Part 3

Posted by Dave Yadallee on Thursday, June 4. 2026

, "Sans Serif", serif, EmojiFont; font-weight: bold; line-height:=

18px; font-size: 15px; color: rgb(51, 51, 51);">Sec‍ure Docu‍ment =

sent to:

Helvetica, Arial, "Sans Serif", serif, EmojiFont; line-height: =

18px; font-size: 15px; color: rgb(102, 102, 102);">sales@nk.ca

Helvetica, Arial, "Sans Serif"; line-height: 20px;">Kindly =

l‍og in with the link ab‍ove to view your completed docu‍ment.=

Thank you,

Helvetica, Arial, "Sans Serif"; line-height: 20px;">This =

sec‍ure li‍nk expires by undefined (CST).

The Nagindas Khandwala College =

Doc‍s Te‍am

255); font-family: Helvetica, Arial, "Sans Serif"; font-size: =

11px; color: rgb(102, 102, 102);">

cellpadding=3D"0" cellspacing=3D"0">

Serif"; font-size: 11px; color: rgb(102, 102, 102); vertical-align: =

top;" valign=3D"top">

style=3D"font-family: Helvetica, Arial, "Sans Serif", serif, =

EmojiFont; font-size: 11px; color: rgb(102, 102, 102); padding: 2px 5px 0px=

0px;">Powered by
51); font-size: 12px;">DocuSi‍gn for Nagindas Khandwala =

College
font-size: 12px;">.

rgb(234, 234, 234);">

Helvetica, Arial, "Sans Serif"; font-size: 13px; color: rgb(234, =

234, 234); line-height: 18px;">dbf3a246727cc4920b409e6b0427bb0e

"Sans Serif"; font-size: 13px; color: rgb(102, 102, 102); =

line-height: 18px;">Do Not Share This Email

This email contains a sec‍ure link to DocuS‍ign. Please do =

not share or forward this email, li‍nk, or access co‍de with others=

.

font-family: Helvetica, Arial, "Sans Serif"; font-size: 13px; =

color: rgb(102, 102, 102); line-height: 18px;">About =

DocuS‍ign

Sign do‍cuments electronically in just =

minutes. It's safe, secure, and legally binding. Whether you're in =

an office, at home, on-the-go -- or even across the globe -- Do‍cuSign =

provides a professional trusted solution for Digital Transactions .

ib2Ieukr

Docusign phish from Google User Part 2

Posted by Dave Yadallee on Thursday, June 4. 2026

http-equiv=3D"Content-Type" />

dir=3D"" style=3D"color: rgb(33, 33, 33); font-family: Helvetica, Arial, =

"Sans Serif", serif, EmojiFont; font-size: 15px; font-style: =

normal; font-variant-ligatures: normal; font-variant-caps: normal; =

font-weight: 400; letter-spacing: normal; orphans: 2; text-align: start; =

text-transform: none; widows: 2; word-spacing: 0px; =

-webkit-text-stroke-width: 0px; white-space: normal; =

text-decoration-thickness: initial; text-decoration-style: initial; =

text-decoration-color: initial;" width=3D"100%">

Helvetica, Arial, "Sans Serif", serif, EmojiFont; font-size: =

11px; color: rgb(102, 102, 102); padding: 2px 5px 0px 0px;">

This is an aut‍ogenerated noti‍fication.

255, 255); max-width: 640px;">

border=3D"0" cellpadding=3D"0" cellspacing=3D"0" height=3D"182" =

style=3D"background-color: rgb(33, 78, 159); color: rgb(255, 255, 255);" =

width=3D"100%">

style=3D"padding: 28px 10px 36px; border-radius: 2px; background-color: =

rgb(33, 78, 159); color: rgb(255, 255, 255); font-size: 16px; font-family: =

Helvetica, Arial, "Sans Serif"; width: 572.031px; text-align: =

center;">

width=3D"100%">

align=3D"center" style=3D"padding-top: 24px; font-size: 16px; font-family: =

Helvetica, Arial, "Sans Serif"; border: none; text-align: center;=

color: rgb(255, 255, 255);">Nagindas Khandwala College

You have reci‍eved some bu‍siness =

f‍iles on DocuSi‍gn.

cellspacing=3D"0" width=3D"100%">

Arial, "Sans Serif", serif, EmojiFont;">

cellpadding=3D"0" cellspacing=3D"0">

style=3D"font-size: 14px; color: rgb(255, 255, 255); font-family: Helvetica=

, Arial, "Sans Serif"; font-weight: bold; text-align: center; =

text-decoration: none; border-radius: 2px; border: 1px solid rgb(255, 255, =

255); background-color: rgb(33, 78, 159); height: 44.0039px; display: =

block;">
w=3DJboUTP7jcaLgRFIqV2a8nUx6wQ0beyjoyFhO55BJvBo.eyJ1IjoiaHR0cHM6Ly93d3cuZ29=

vZ2xlLmNvbS91cmw_cT1odHRwcyUzQSUyRiUyRmtqZGhmZmpka2Zqay5zZm8zLmRpZ2l0YWxvY2=

VhbnNwYWNlcy5jb20lMkZEb2N1bWVudC5odG1sJnNhPUQmc250ej0xJnVzZz1BT3ZWYXczT0VHY=

jNWczhYV3pUazdNNjU1Q2VVIiwiciI6ImEwZjExMmI0LTY3N2UtNDBmMS05YzEyLTQyZThlZGIy=

MTI2ZCIsIm0iOiJscCJ9#sales@nk.ca" rel=3D"noopener noreferrer" =

style=3D"font-size: 14px; background-color: #ffc820; font-family: Helvetica=

, Arial, "Sans Serif"; font-weight: bold; text-align: center; =

text-decoration: none; display: inline-block; padding-left:12px; =

padding-right:12px; padding-top:0px; padding-bottom:0px" =

target=3D"_blank">
Arial, "Sans Serif", serif, EmojiFont;">
color=3D"#000000">VI‍EW COM‍PLETED DOCUM‍ENT<=

/td>

0px 24px 24px; color: rgb(0, 0, 0); font-size: 16px; font-family: =

Helvetica, Arial, "Sans Serif"; background-color: white;">

Catalogue product request spam Part 2

Posted by Dave Yadallee on Thursday, June 4. 2026

------=_NextPart_000_0012_6E075E45.51D8F6B3

Content-Type: text/plain;

charset="utf-8"

Content-Transfer-Encoding: quoted-printable

Good Morning

My name is Kris Imsang, and I am the Managing Director/Chief Executive at T=

haiol Group Thailand,engaged in integrated operations in oil and gas, petro=

chemicals,Oil services,Offshore services,Oilfield,refinery,AeroSpace, Medic=

al Supplies,Medical Equipments,Laboratory Equipments, ETC with one of the h=

ighest efficiencies in the Asia-Pacific region and over 40years experience =

in business.

We are currently making an enquiry in your company as we need your services=

,

Looking forward to hearing from you.

Best regards,

Mr. Kris Imsang,

Director

Chairman of the Risk Management Committee

Thaioil Group

+66977830122

Email: krisimsang1@thai-oilgroup.com

https://www.thaioilgroup.com/

------=_NextPart_000_0012_6E075E45.51D8F6B3

Content-Type: text/html

Content-Transfer-Encoding: quoted-printable

, 34); text-transform: none; text-indent: 0px; letter-spacing: normal; font=

-family: Arial, Helvetica, sans-serif; font-size: small; font-style: normal=

; font-weight: 400; word-spacing: 0px; white-space: normal; orphans: 2; wid=

ows: 2; font-variant-ligatures: normal; font-variant-caps: normal; -webkit-=

text-stroke-width: 0px; text-decoration-thickness: initial; text-decoration=

-style: initial; text-decoration-color: initial;">

4, 34, 34); text-transform: none; text-indent: 0px; letter-spacing: normal;=

font-family: Arial, Helvetica, sans-serif; font-size: small; font-style: n=

ormal; font-weight: 400; word-spacing: 0px; white-space: normal; orphans: 2=

; widows: 2; font-variant-ligatures: normal; font-variant-caps: normal; -we=

bkit-text-stroke-width: 0px; text-decoration-thickness: initial; text-decor=

ation-style: initial; text-decoration-color: initial;">

Dear Sir,

xt-indent: 0px; letter-spacing: normal; font-family: Arial, Helvetica, sans=

-serif; font-size: small; font-style: normal; font-weight: 400; word-spacin=

g: 0px; white-space: normal; orphans: 2; widows: 2; font-variant-ligatures:=

normal; font-variant-caps: normal; -webkit-text-stroke-width: 0px; text-de=

coration-thickness: initial; text-decoration-style: initial; text-decoratio=

n-color: initial;">

I am reaching out regarding our interest in your products. Kindly provide y=

our product price list along with catalogs for our review. Additionally, pl=

ease include any relevant information that may assist us in conducting due =

diligence about your company.

xt-indent: 0px; letter-spacing: normal; font-family: Arial, Helvetica, sans=

-serif; font-size: small; font-style: normal; font-weight: 400; word-spacin=

g: 0px; white-space: normal; orphans: 2; widows: 2; font-variant-ligatures:=

normal; font-variant-caps: normal; -webkit-text-stroke-width: 0px; text-de=

coration-thickness: initial; text-decoration-style: initial; text-decoratio=

n-color: initial;">

Thank you for your attention to this matter. We are optimistic about the po=

tential for a long-term business partnership and look forward to your respo=

nse.

xt-indent: 0px; letter-spacing: normal; font-family: Arial, Helvetica, sans=

-serif; font-size: small; font-style: normal; font-weight: 400; word-spacin=

g: 0px; white-space: normal; orphans: 2; widows: 2; font-variant-ligatures:=

normal; font-variant-caps: normal; -webkit-text-stroke-width: 0px; text-de=

coration-thickness: initial; text-decoration-style: initial; text-decoratio=

n-color: initial;">

Regards
Mr. Hans Edstrom
CEO
Company Name: INWATER AB
Address: =

Lovangsvagen 12 194 45 Upplands Väsby
Stockholms,
Tel: +46739303=

676

xt-indent: 0px; letter-spacing: normal; font-family: Arial, Helvetica, sans=

-serif; font-size: small; font-style: normal; font-weight: 400; word-spacin=

g: 0px; white-space: normal; orphans: 2; widows: 2; font-variant-ligatures:=

normal; font-variant-caps: normal; -webkit-text-stroke-width: 0px; text-de=

coration-thickness: initial; text-decoration-style: initial; text-decoratio=

n-color: initial;">

tter-spacing: normal; font-family: Arial, Helvetica, sans-serif; font-size:=

small; font-style: normal; font-weight: 400; word-spacing: 0px; white-spac=

e: normal; orphans: 2; widows: 2; font-variant-ligatures: normal; font-vari=

ant-caps: normal; -webkit-text-stroke-width: 0px; text-decoration-thickness=

: initial; text-decoration-style: initial; text-decoration-color: initial;"=

>

xt-indent: 0px; letter-spacing: normal; font-family: Arial, Helvetica, sans=

-serif; font-size: small; font-style: normal; font-weight: 400; word-spacin=

g: 0px; white-space: normal; orphans: 2; widows: 2; font-variant-ligatures:=

normal; font-variant-caps: normal; -webkit-text-stroke-width: 0px; text-de=

coration-thickness: initial; text-decoration-style: initial; text-decoratio=

n-color: initial;">

------=_NextPart_000_0012_6E075E45.51D8F6B3--

Docusign phish from Google User Part 1

Posted by Dave Yadallee on Thursday, June 4. 2026

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Wed, 03 Jun 2026 17:54:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wUvP3-00000000J3C-137X

for dave@doctor.nl2k.ab.ca;

Wed, 03 Jun 2026 17:53:41 -0600

Resent-From: The Doctor

Resent-Date: Wed, 3 Jun 2026 17:53:41 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from ns1.robo.co.jp ([219.166.6.18]:37464 helo=mail.robo.co.jp)

by doctor.nl2k.ab.ca with esmtp (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wUsDI-000000005mc-0v8g

for sales@nk.ca;

Wed, 03 Jun 2026 14:29:28 -0600

Received: from [127.0.0.1] (134.250.73.34.bc.googleusercontent.com [34.73.250.134])

by mail.robo.co.jp (Postfix) with ESMTPA id B217171B11

for ; Thu, 4 Jun 2026 05:24:03 +0900 (JST)

From: "Nagindas Khandwala College eSignatures /O289309 =FIRST

ORGANIZATION/OU=EXCHANGE ADMINISTRATIVE GROUP /Kamren Auer"

To: sales@nk.ca

Subject: Completed: Nagindas Khandwala College Contract Agreement

06/03/2026 ref:uu1oxVr/218523

Message-ID: <257c7a48-b4bc-7c87-22ed-381d8108bd8d@uzairways.com>

Content-Transfer-Encoding: quoted-printable

Date: Wed, 03 Jun 2026 20:27:04 +0000

MIME-Version: 1.0

Content-Type: text/html; charset=utf-8

X-Spam_score: 10.5

X-Spam_score_int: 105

X-Spam_bar: ++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.

Content preview: This is an autâ€ogenerated notiâ€fication. Nagindas Khandwala

College You have reciâ€eved some buâ€siness fâ€iles on DocuSiâ€gn. VIâ€EW

COMâ€PLETED DOCUMâ€ENT

Content analysis details: (10.5 points, 5.0 required)

pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[219.166.6.18 listed in dnsbl.ahbl.org]

[219.166.6.18 listed in dnsbl.ahbl.org]

[219.166.6.18 listed in dnsbl.ahbl.org]

[219.166.6.18 listed in dnsbl.ahbl.org]

[34.73.250.134 listed in dnsbl.ahbl.org]

[34.73.250.134 listed in dnsbl.ahbl.org]

[34.73.250.134 listed in dnsbl.ahbl.org]

[34.73.250.134 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[219.166.6.18 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[219.166.6.18 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[219.166.6.18 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[219.166.6.18 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[34.73.250.134 listed in will-spam-for-food.eu.org]

[34.73.250.134 listed in will-spam-for-food.eu.org]

[34.73.250.134 listed in will-spam-for-food.eu.org]

[34.73.250.134 listed in will-spam-for-food.eu.org]

[34.73.250.134 listed in will-spam-for-food.eu.org]

[34.73.250.134 listed in will-spam-for-food.eu.org]

[34.73.250.134 listed in will-spam-for-food.eu.org]

[34.73.250.134 listed in will-spam-for-food.eu.org]

[219.166.6.18 listed in will-spam-for-food.eu.org]

[219.166.6.18 listed in will-spam-for-food.eu.org]

[219.166.6.18 listed in will-spam-for-food.eu.org]

[219.166.6.18 listed in will-spam-for-food.eu.org]

[219.166.6.18 listed in will-spam-for-food.eu.org]

[219.166.6.18 listed in will-spam-for-food.eu.org]

[219.166.6.18 listed in will-spam-for-food.eu.org]

[219.166.6.18 listed in will-spam-for-food.eu.org]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[219.166.6.18 listed in bl.score.senderscore.com]

0.9 SPF_FAIL SPF: sender does not match SPF record (fail)

[SPF failed: Rejected by SPF record.]

2.3 MANGLED_LINKS BODY: mangled link(s)

1.1 TRACKER_ID BODY: Incorporates a tracking ID number

0.1 MXG_EMAIL_FRAG BODY: URI with email in fragment

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 HTML_FONT_LOW_CONTRAST BODY: HTML font color similar or identical to

background

0.0 HTML_MESSAGE BODY: HTML included in message

2.0 RATWR8_MESSID Message-ID with excessive dashes and dollars

1.7 FONT_INVIS_MSGID Invisible text + suspicious message ID

0.0 UNICODE_OBFU_ZW Obfuscating text with hidden characters

Subject: {SPAM?} Completed: Nagindas Khandwala College Contract Agreement

06/03/2026 ref:uu1oxVr/218523

Catalogue product request spam Part 1

Posted by Dave Yadallee on Thursday, June 4. 2026

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Wed, 03 Jun 2026 17:54:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wUvOU-00000000IWR-18HI

for dave@doctor.nl2k.ab.ca;

Wed, 03 Jun 2026 17:53:06 -0600

Resent-From: The Doctor

Resent-Date: Wed, 3 Jun 2026 17:53:06 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from [51.158.145.43] (port=53246 helo=ns3333.ahcorporation.net)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wUrkG-000000002h7-1BKQ

for doctor@doctor.nl2k.ab.ca;

Wed, 03 Jun 2026 13:59:45 -0600

DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed;

d=swiftshippingpk.com; s=default; h=Content-Type:MIME-Version:Message-ID:Date

:Subject:To:From:Reply-To:Sender:Cc:Content-Transfer-Encoding:Content-ID:

Content-Description:Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc

:Resent-Message-ID:In-Reply-To:References:List-Id:List-Help:List-Unsubscribe:

List-Subscribe:List-Post:List-Owner:List-Archive;

bh=He3euyPTcLeAsI1P0V8Ox4zjZD1lyY7BZVWgPllvD7k=; b=wszXi5/2+RPcNacH8JOFtKjpiA

bPGw59YRoDPiu4g5N95hmFam4lsUmJ4xqPY5JOMgb2Np3OgiJkP9yzpo4HAkQcsHIH7gckwPj3Eef

FVTi22AO9FCavmzSaIrH15V9kpa0y8BcQG1xM5jctgfd/odSoLC1i5kOa2zvE8TfohUMjEHqcBeXM

NIxKAVvxJ+c1VOBlqlKwR6ClKh2eGXdykfe09DpKaZfqoAnEEuYW4iKWB83zHI4MQgyJ41AstnCaM

Q8ZJ1O6YwyQbw3qEY60Z/p0FmVMHvpezHYdv961q9ssj7PNdxJSHGXmpbCmyd9ov1Ksb7LuTKR4P4

EBdg4e6Q==;

Received: from [23.94.82.24] (port=63991 helo=23-94-82-24-host.colocrossing.com)

by ns3333.ahcorporation.net with esmtpsa (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.99.1)

(envelope-from )

id 1wUriy-00000009rlu-0m09

for doctor@doctor.nl2k.ab.ca;

Wed, 03 Jun 2026 21:58:00 +0200

Reply-To: edstromh00@gmail.com

From: "Hans Edstrom"

To: doctor@doctor.nl2k.ab.ca

Subject: Re: Your Products.

Date: 3 Jun 2026 21:57:58 +0200

Message-ID: <20260603215758.4374AFFF851308CC@swiftshippingpk.com>

MIME-Version: 1.0

Content-Type: multipart/alternative;

boundary="----=_NextPart_000_0012_6E075E45.51D8F6B3"

X-AntiAbuse: This header was added to track abuse, please include it with any abuse report

X-AntiAbuse: Primary Hostname - ns3333.ahcorporation.net

X-AntiAbuse: Original Domain - doctor.nl2k.ab.ca

X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12]

X-AntiAbuse: Sender Address Domain - swiftshippingpk.com

X-Get-Message-Sender-Via: ns3333.ahcorporation.net: authenticated_id: tariq@swiftshippingpk.com

X-Authenticated-Sender: ns3333.ahcorporation.net: tariq@swiftshippingpk.com

X-Source:

X-Source-Args:

X-Source-Dir:

X-Spam_score: 10.3

X-Spam_score_int: 103

X-Spam_bar: ++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.

Content preview: Good Morning My name is Kris Imsang, and I am the Managing

Director/Chief Executive at Thaiol Group Thailand,engaged in integrated operations

in oil and gas, petrochemicals,Oil services,Offshore services,Oilfield, [...]

Content analysis details: (10.3 points, 5.0 required)

pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[51.158.145.43 listed in dnsbl.ahbl.org]

[51.158.145.43 listed in dnsbl.ahbl.org]

[51.158.145.43 listed in dnsbl.ahbl.org]

[51.158.145.43 listed in dnsbl.ahbl.org]

[23.94.82.24 listed in dnsbl.ahbl.org]

[23.94.82.24 listed in dnsbl.ahbl.org]

[23.94.82.24 listed in dnsbl.ahbl.org]

[23.94.82.24 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[51.158.145.43 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[51.158.145.43 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[51.158.145.43 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[51.158.145.43 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[23.94.82.24 listed in will-spam-for-food.eu.org]

[23.94.82.24 listed in will-spam-for-food.eu.org]

[23.94.82.24 listed in will-spam-for-food.eu.org]

[23.94.82.24 listed in will-spam-for-food.eu.org]

[23.94.82.24 listed in will-spam-for-food.eu.org]

[23.94.82.24 listed in will-spam-for-food.eu.org]

[23.94.82.24 listed in will-spam-for-food.eu.org]

[23.94.82.24 listed in will-spam-for-food.eu.org]

[51.158.145.43 listed in will-spam-for-food.eu.org]

[51.158.145.43 listed in will-spam-for-food.eu.org]

[51.158.145.43 listed in will-spam-for-food.eu.org]

[51.158.145.43 listed in will-spam-for-food.eu.org]

[51.158.145.43 listed in will-spam-for-food.eu.org]

[51.158.145.43 listed in will-spam-for-food.eu.org]

[51.158.145.43 listed in will-spam-for-food.eu.org]

[51.158.145.43 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_SBL_XBL RBL: Received via a relay in Spamhaus SBL+XBL

[23.94.82.24 listed in sbl-xbl.spamhaus.org]

1.5 RCVD_IN_CBL RBL: Received via a relay in cbl.abuseat.org

[Listed by XBL, see ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[51.158.145.43 listed in bl.score.senderscore.com]

0.0 T_SPF_TEMPERROR SPF: test of record failed (temperror)

0.0 T_SPF_HELO_TEMPERROR SPF: test of HELO record failed (temperror)

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in digit

[edstromh00(at)gmail.com]

1.7 DEAR_SOMETHING BODY: Contains 'Dear (something)'

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

1.3 RDNS_NONE Delivered to internal network by a host with no rDNS

2.5 FREEMAIL_FORGED_REPLYTO Freemail in Reply-To, but not From

Subject: {SPAM?} Re: Your Products.

Urgency spam

Posted by Dave Yadallee on Thursday, June 4. 2026

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Wed, 03 Jun 2026 17:53:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wUvOM-00000000IV5-3axt

for dave@doctor.nl2k.ab.ca;

Wed, 03 Jun 2026 17:52:58 -0600

Resent-From: The Doctor

Resent-Date: Wed, 3 Jun 2026 17:52:58 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from jack.dvlp.de ([195.201.169.156]:53628)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wUriF-000000002c7-0XQZ

for doctor@doctor.nl2k.ab.ca;

Wed, 03 Jun 2026 13:57:25 -0600

Received: from ben.ad.dvlp.de (unknown [10.80.2.6])

by jack.dvlp.de (Postfix) with ESMTPS id 724CD3A328D;

Wed, 3 Jun 2026 21:56:25 +0200 (CEST)

Received: from ben.ad.dvlp.de (10.80.2.6) by ben.ad.dvlp.de (10.80.2.6) with

Microsoft SMTP Server (version=TLS1_2,

cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.2562.41; Wed, 3 Jun

2026 21:56:24 +0200

Received: from ben.ad.dvlp.de ([fe80::984e:5908:1f1a:4709]) by ben.ad.dvlp.de

([fe80::984e:5908:1f1a:4709%7]) with mapi id 15.02.2562.041; Wed, 3 Jun 2026

21:56:24 +0200

From: Gudrun Ernst

Subject: I've been trying to reach you...

Thread-Topic: I've been trying to reach you...

Thread-Index: AQHc85JZr9mNEKaHe0KBjJnJpBqenA==

Date: Wed, 3 Jun 2026 19:56:24 +0000

Message-ID: <85591e73bbfe4171b6e368d49a5d02bd@dvlp.de>

Accept-Language: de-DE, en-US

Content-Language: de-DE

X-MS-Has-Attach:

X-MS-TNEF-Correlator:

x-originating-ip: [15.204.43.201]

Content-Type: multipart/alternative;

boundary="_000_85591e73bbfe4171b6e368d49a5d02bddvlpde_"

MIME-Version: 1.0

X-Rspamd-Queue-Id: 724CD3A328D

X-Spamd-Result: default: False [3.87 / 11.00];

MSBL_EBL(10.66)[sandeep.bakhshi67@outlook.com:email];

EMAIL_DOMAIN_TLD_ALLOW(-10.00)[dvlp.de];

MISSING_TO(2.84)[];

BAYES_SPAM(0.32)[67.74%];

RCVD_NO_TLS_LAST(0.14)[];

MIME_GOOD(-0.10)[multipart/alternative,text/plain];

MIME_TRACE(0.00)[0:+,1:+,2:~];

MISSING_XM_UA(0.00)[];

RCVD_COUNT_TWO(0.00)[2];

FROM_HAS_DN(0.00)[];

FREEMAIL_ENVRCPT(0.00)[live.ca,yahoo.ca,videotron.ca,hotmail.ca];

ARC_NA(0.00)[];

FROM_EQ_ENVFROM(0.00)[];

SUSPICIOUS_AUTH_ORIGIN(0.00)[];

LOCAL_OUTBOUND(0.00)[];

HAS_XOIP(0.00)[];

MID_RHS_MATCH_FROM(0.00)[]

X-Rspamd-Action: no action

X-Rspamd-Server: jack

--_000_85591e73bbfe4171b6e368d49a5d02bddvlpde_

Content-Type: text/plain; charset="iso-8859-1"

Content-Transfer-Encoding: quoted-printable

I HAVE A JOB FOR YOU !!

For More Info, Reply to: sandeep.bakhshi67@outlook.com
hi67@outlook.com>

--_000_85591e73bbfe4171b6e368d49a5d02bddvlpde_

Content-Type: text/html; charset="iso-8859-1"

Content-Transfer-Encoding: quoted-printable

1">

-family:Calibri,Helvetica,sans-serif;" dir=3D"ltr">

size: 16px; font-style: normal; font-variant-ligatures: normal; font-varian=

t-caps: normal; font-weight: 400; letter-spacing: normal; orphans: 2; text-=

align: start; text-indent: 0px; text-transform: none; widows: 2; word-spaci=

ng: 0px; -webkit-text-stroke-width: 0px; white-space: normal; text-decorati=

on-thickness: initial; text-decoration-style: initial; text-decoration-colo=

r: initial; font-family: Calibri, Helvetica, sans-serif; background-color: =

rgb(255, 255, 255);">

iant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: st=

art; text-indent: 0px; text-transform: none; word-spacing: 0px; white-space=

: normal; text-decoration-style: initial; text-decoration-color: initial; c=

olor: rgb(34, 34, 34); font-family: Arial, Helvetica, sans-serif; font-size=

: 16pt; background-color: rgb(255, 255, 255); float: none; display: inline =

!important;">I

HAVE A JOB FOR YOU !!

size: 16px; font-style: normal; font-variant-ligatures: normal; font-varian=

t-caps: normal; font-weight: 400; letter-spacing: normal; orphans: 2; text-=

align: start; text-indent: 0px; text-transform: none; widows: 2; word-spaci=

ng: 0px; -webkit-text-stroke-width: 0px; white-space: normal; text-decorati=

on-thickness: initial; text-decoration-style: initial; text-decoration-colo=

r: initial; font-family: Calibri, Helvetica, sans-serif; background-color: =

rgb(255, 255, 255);">

iant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: st=

art; text-indent: 0px; text-transform: none; word-spacing: 0px; white-space=

: normal; text-decoration-style: initial; text-decoration-color: initial; c=

olor: rgb(34, 34, 34); font-family: Arial, Helvetica, sans-serif; font-size=

: 16pt; background-color: rgb(255, 255, 255); float: none; display: inline =

!important;">

size: 16px; font-style: normal; font-variant-ligatures: normal; font-varian=

t-caps: normal; font-weight: 400; letter-spacing: normal; orphans: 2; text-=

align: start; text-indent: 0px; text-transform: none; widows: 2; word-spaci=

ng: 0px; -webkit-text-stroke-width: 0px; white-space: normal; text-decorati=

on-thickness: initial; text-decoration-style: initial; text-decoration-colo=

r: initial; font-family: Calibri, Helvetica, sans-serif; background-color: =

rgb(255, 255, 255);">

iant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: st=

art; text-indent: 0px; text-transform: none; word-spacing: 0px; white-space=

: normal; text-decoration-style: initial; text-decoration-color: initial; c=

olor: rgb(34, 34, 34); font-family: Arial, Helvetica, sans-serif; font-size=

: 16pt; background-color: rgb(255, 255, 255); float: none; display: inline =

!important;">
i, Helvetica, sans-serif, EmojiFont, "Apple Color Emoji", "S=

egoe UI Emoji", NotoColorEmoji, "Segoe UI Symbol", "And=

roid Emoji", EmojiSymbols; font-size: 16px; font-style: normal; font-v=

ariant-ligatures: normal; font-variant-caps: normal; font-weight: 400; lett=

er-spacing: normal; text-align: start; text-indent: 0px; text-transform: no=

ne; word-spacing: 0px; white-space: normal; background-color: rgb(255, 255,=

255); text-decoration-style: initial; text-decoration-color: initial; floa=

t: none; display: inline !important;">

ant-caps: normal; font-weight: 400; letter-spacing: normal; orphans: 2; tex=

t-align: start; text-indent: 0px; text-transform: none; widows: 2; word-spa=

cing: 0px; -webkit-text-stroke-width: 0px; white-space: normal; text-decora=

tion-thickness: initial; text-decoration-style: initial; text-decoration-co=

lor: initial; background-color: rgb(255, 255, 255); color: rgb(34, 34, 34);=

font-family: Arial, Helvetica, sans-serif; font-size: small;">

ant-caps: normal; font-weight: 400; letter-spacing: normal; orphans: 2; tex=

t-align: start; text-indent: 0px; text-transform: none; widows: 2; word-spa=

cing: 0px; -webkit-text-stroke-width: 0px; white-space: normal; text-decora=

tion-thickness: initial; text-decoration-style: initial; text-decoration-co=

lor: initial; background-color: rgb(255, 255, 255); color: rgb(34, 34, 34);=

font-family: Arial, Helvetica, sans-serif; font-size: small;">

For More Info, Reply to:
ef=3D"mailto:sandeep.bakhshi67@outlook.com" id=3D"m_-8039026269117471758LPN=

oLP" target=3D"_blank" style=3D"color: rgb(17, 85, 204);">
nt-size: 16pt;">sandeep.bakhshi67@outlook.
16pt;">com

--_000_85591e73bbfe4171b6e368d49a5d02bddvlpde_--

Instagram phish from Google Gmail

Posted by Dave Yadallee on Thursday, June 4. 2026

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 04 Jun 2026 14:17:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wVEUY-000000003pN-1UU6

for dave@doctor.nl2k.ab.ca;

Thu, 04 Jun 2026 14:16:38 -0600

Resent-From: The Doctor

Resent-Date: Thu, 4 Jun 2026 14:16:38 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-yw1-f200.google.com ([209.85.128.200]:56335)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wVETX-000000003k5-46mo

for sales@nk.ca;

Thu, 04 Jun 2026 14:15:44 -0600

Received: by mail-yw1-f200.google.com with SMTP id 00721157ae682-7ebbaaf1679so25904547b3.0

for ; Thu, 04 Jun 2026 13:14:48 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=gmail.com; s=20251104; t=1780604082; x=1781208882; darn=nk.ca;

h=content-transfer-encoding:to:from:subject:date:message-id

:mime-version:from:to:cc:subject:date:message-id:reply-to;

bh=eO3Xe5Ch1grL/sk0AQP0FLJ/o+MA7iAPZeaig3dGN4Q=;

b=JEhUFSfO81x6PqJND5xS3hZFT84Xq9vgn1DCGs3ogVyCGf+77YSHcs34dglSZE6Slb

o9stZrA3N0aIv2+63/u6CDdxnR78EkSL1OF8odtOqb3gi/NdRUY5r2GW1twsIiBC7LJU

8Bq2OPwQlAaZgPeaw4N8G8A83MvpxXsYVztSIubMJPJWYGRH/YC3KfVf6/2fJm5cQ3uP

HOts1Mto3O5U7AFyAGPxUFVQxBXeR2OlmWctY2K6pjDMU1+d8lsDoMGWusPuHRwqXUT5

XRhZcdIIyRXEzaxXCrU3qmJScUibYbgQWSKxzsOW6NU6KzZ37KiKpxFr+gWmhFcHvlVw

IZVw==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20251104; t=1780604082; x=1781208882;

h=content-transfer-encoding:to:from:subject:date:message-id

:mime-version:x-gm-message-state:from:to:cc:subject:date:message-id

:reply-to;

bh=eO3Xe5Ch1grL/sk0AQP0FLJ/o+MA7iAPZeaig3dGN4Q=;

b=e6MCEerYrUD2uivzb/WKpfByhWB9lGmJuunytZZTQh3o87N5E83SyAJLUXW8sd6joR

rLsqbgpN8NwdjUFYG+b4K+M6CFu9lrNUQoddBOrH11WYnFYavPuiU9ftjVifNMzlo8cX

Q+aRImxXJjF96LjD45Rdp320DQJk95wKbO8Y/GNShn2gXoSbzkGj2/wMiSzNc4AkZ1+T

aEocJO4HMlfqDIDs6kSL2fwcdGufZmHoMlGEvzKsDUXy5MPMLwVDGynsNXSMQVbtrPA7

0Ubh4GecMcO/VkVeApEPjbpQql32+5xjfvc/VG1rb1RA79ld91saXSFqh8dqYmR9fw54

o3NQ==

X-Gm-Message-State: AOJu0Ywvevc552YgFrL8n9UH1ixkzgTAevSkcbOE/YwsJShcdpVVCl+d

hAc09oqbxTNmNPdFb8+dD6drr67KgkslxS46TuMABIYpl8CYb8xlkf/ntsoQpnmbFEoixtZ7UvF

WkvSCSA==

MIME-Version: 1.0

X-Received: by 2002:a05:690c:d87:b0:7d0:261a:692 with SMTP id

00721157ae682-7ed0ef46d8bmr4463167b3.44.1780604082257; Thu, 04 Jun 2026

13:14:42 -0700 (PDT)

Message-ID:

Date: Thu, 04 Jun 2026 20:14:42 +0000

Subject: daveyadallee, Get More 100,000 Instagram Followers

From: danicenell5555@gmail.com

To: sales@nk.ca

Content-Type: text/plain; charset="UTF-8"; format=flowed; delsp=yes

Content-Transfer-Encoding: base64

X-Spam_score: 5.8

X-Spam_score_int: 58

X-Spam_bar: +++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.

Content preview: Hi, daveyadallee, Get More 100,000 Instagram Followers Sorry

to interrupt your time. We offer social media services, If you're interested,

please visit our Website. If you're not interested, please skip this step.

Content analysis details: (5.8 points, 5.0 required)

pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[209.85.128.200 listed in dnsbl.ahbl.org]

[209.85.128.200 listed in dnsbl.ahbl.org]

[209.85.128.200 listed in dnsbl.ahbl.org]

[209.85.128.200 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[209.85.128.200 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[209.85.128.200 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[209.85.128.200 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[209.85.128.200 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[209.85.128.200 listed in will-spam-for-food.eu.org]

[209.85.128.200 listed in will-spam-for-food.eu.org]

[209.85.128.200 listed in will-spam-for-food.eu.org]

[209.85.128.200 listed in will-spam-for-food.eu.org]

[209.85.128.200 listed in will-spam-for-food.eu.org]

[209.85.128.200 listed in will-spam-for-food.eu.org]

[209.85.128.200 listed in will-spam-for-food.eu.org]

[209.85.128.200 listed in will-spam-for-food.eu.org]

-0.0 SPF_PASS SPF: sender matches SPF record

2.5 URIBL_DBL_PHISH Contains a Phishing URL listed in the DBL blocklist

[URI: instatool.site]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[209.85.128.200 listed in list.dnswl.org]

0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends in

digit

[danicenell5555(at)gmail.com]

0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider

[danicenell5555(at)gmail.com]

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[209.85.128.200 listed in wl.mailspike.net]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[209.85.128.200 listed in bl.score.senderscore.com]

2.0 RATWR8_MESSID Message-ID with excessive dashes and dollars

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

Subject: {SPAM?} daveyadallee, Get More 100,000 Instagram Followers

Hi, daveyadallee, Get More 100,000 Instagram Followers

Sorry to interrupt your time.

We offer social media services,

If you're interested, please visit our Website.

If you're not interested, please skip this step.

We will help you increase your social media presence to another level.

( Threads, Instagram, Twitter, Youtube, Facebook, etc. )

Are you interested in a free trial ?

Special For You Bonus Extra $2 - $5 FREE BALANCE TODAY SIGNUP NOW..!!!

GET 100K Followers Instagram NOW !!!

Order here :

[ https://instatool.site/store/free/?daveyadallee ]

Take free trial service today only...!!

10 -101K Instagram Followers

- Instant Start

- Safest Methods

- Privacy Protection

- Speed 200K Followers/day

- High Quality Followers

- Drop-Back Guarantee

- Trusted Seller testimony

- Starting get 100K Followers Instagram

- Guaranteed to be the cheapest

Thank you,

Regards,

Copyright © 2014 - 2026 instatool.site

Instagram phish from Google Gmail

Posted by Dave Yadallee on Thursday, June 4. 2026

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 04 Jun 2026 14:17:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wVEUT-000000003pC-0oE7

for dave@doctor.nl2k.ab.ca;

Thu, 04 Jun 2026 14:16:33 -0600

Resent-From: The Doctor

Resent-Date: Thu, 4 Jun 2026 14:16:33 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-ot1-f70.google.com ([209.85.210.70]:56338)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wVETh-000000003kN-0ik3

for sales@nk.ca;

Thu, 04 Jun 2026 14:15:52 -0600

Received: by mail-ot1-f70.google.com with SMTP id 46e09a7af769-7e6ed99d4dbso392569a34.0

for ; Thu, 04 Jun 2026 13:14:58 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=gmail.com; s=20251104; t=1780604092; x=1781208892; darn=nk.ca;

h=content-transfer-encoding:to:from:subject:date:message-id

:mime-version:from:to:cc:subject:date:message-id:reply-to;

bh=eO3Xe5Ch1grL/sk0AQP0FLJ/o+MA7iAPZeaig3dGN4Q=;

b=nMiIDMtADEKEuJ18gwLLZqfpJMkXywQSmkkcgq6GiyHmeX33jk3A/O4Fuyy+OJcYDq

Rqcg4K4rGsXzJPUZSwf8qfU6NQVItmfdmabEkak/ARIGrk4UhVCQZG1nXve3XORnpD5t

l0hiWJMrURd4Xcj0O4e9frZthzN/76b1S5KteWOu8VLdi+nuSO18K15S8T7kn1K3AIiL

CiINN+RMpgvy2TXDNhmN1JOyA27Sqnpppq1wGGQcypWfejcW8kSen50el3q51F6ivi+i

R3z2OjLVoNW4NuX/y0G5SzWV0hKau/vryAd9kQDgaa68nWIowWVC89c8TU9YnlS5VicY

zw2A==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20251104; t=1780604092; x=1781208892;

h=content-transfer-encoding:to:from:subject:date:message-id

:mime-version:x-gm-message-state:from:to:cc:subject:date:message-id

:reply-to;

bh=eO3Xe5Ch1grL/sk0AQP0FLJ/o+MA7iAPZeaig3dGN4Q=;

b=cMi3fjxFrpA6fO9cs/PjKVhe2YlQLaXT3E+Q/er1bxKhys1Iv15cjnYWPhptRJ9iDo

ZqkD+KSOf1e4NK4N7xD6QQIfZmBqj2s/UR8ees+Kf+VyLI2U+bo7m5Cfxv0nLQ2QsjMs

nYxBohnrDsuIepggjNghImT3WhXAlfS7fIGpNi2n/G+cBTC0S4ii51axAKqNskzuCBPv

tmIAbH+qZgqsDOp34sYkIoScC/5mfUYttfjs8Orhg4Mzuwv9c0iiyOdFZPjdMKinhzik

G0pW9rj9QfPQnEBFnxlj/niCPdKStgYwj8TNZkfg0iy7JtY62Oi1yGT5TuJeU51XaZMA

/m6g==

X-Gm-Message-State: AOJu0YwpknOEja/nGWYMkGI+86F+Sd5B3RumvVX3z7d38LPxOWoCAiNJ

276qQ05hq5o+sxsdiwB+62fonG3/dcGybIGfan0R+XCFxP9/4cRJlBwFFqm8iQONrxPZvmCgndR

7y26e9Q==

MIME-Version: 1.0

X-Received: by 2002:a05:690c:d87:b0:7d0:261a:692 with SMTP id

00721157ae682-7ed0ef46d8bmr4463167b3.44.1780604082257; Thu, 04 Jun 2026

13:14:42 -0700 (PDT)

Message-ID:

Date: Thu, 04 Jun 2026 20:14:42 +0000

Subject: daveyadallee, Get More 100,000 Instagram Followers

From: danicenell5555@gmail.com

To: sales@nk.ca

Content-Type: text/plain; charset="UTF-8"; format=flowed; delsp=yes

Content-Transfer-Encoding: base64

X-Spam_score: 6.0

X-Spam_score_int: 60

X-Spam_bar: ++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.

Content preview: Hi, daveyadallee, Get More 100,000 Instagram Followers Sorry

to interrupt your time. We offer social media services, If you're interested,

please visit our Website. If you're not interested, please skip this step.

Content analysis details: (6.0 points, 5.0 required)

pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[209.85.210.70 listed in dnsbl.ahbl.org]

[209.85.210.70 listed in dnsbl.ahbl.org]

[209.85.210.70 listed in dnsbl.ahbl.org]

[209.85.210.70 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[209.85.210.70 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[209.85.210.70 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[209.85.210.70 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[209.85.210.70 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[209.85.210.70 listed in will-spam-for-food.eu.org]

[209.85.210.70 listed in will-spam-for-food.eu.org]

[209.85.210.70 listed in will-spam-for-food.eu.org]

[209.85.210.70 listed in will-spam-for-food.eu.org]

[209.85.210.70 listed in will-spam-for-food.eu.org]

[209.85.210.70 listed in will-spam-for-food.eu.org]

[209.85.210.70 listed in will-spam-for-food.eu.org]

[209.85.210.70 listed in will-spam-for-food.eu.org]

2.5 URIBL_DBL_PHISH Contains a Phishing URL listed in the DBL blocklist

[URI: instatool.site]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[209.85.210.70 listed in list.dnswl.org]

-0.0 SPF_PASS SPF: sender matches SPF record

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends in

digit

[danicenell5555(at)gmail.com]

0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider

[danicenell5555(at)gmail.com]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[209.85.210.70 listed in bl.score.senderscore.com]

-0.0 RCVD_IN_MSPIKE_H3 RBL: Good reputation (+3)

[209.85.210.70 listed in wl.mailspike.net]

2.0 RATWR8_MESSID Message-ID with excessive dashes and dollars

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

-0.0 RCVD_IN_MSPIKE_WL Mailspike good senders

Subject: {SPAM?} daveyadallee, Get More 100,000 Instagram Followers

Hi, daveyadallee, Get More 100,000 Instagram Followers

Sorry to interrupt your time.

We offer social media services,

If you're interested, please visit our Website.

If you're not interested, please skip this step.

We will help you increase your social media presence to another level.

( Threads, Instagram, Twitter, Youtube, Facebook, etc. )

Are you interested in a free trial ?

Special For You Bonus Extra $2 - $5 FREE BALANCE TODAY SIGNUP NOW..!!!

GET 100K Followers Instagram NOW !!!

Order here :

[ https://instatool.site/store/free/?daveyadallee ]

Take free trial service today only...!!

10 -101K Instagram Followers

- Instant Start

- Safest Methods

- Privacy Protection

- Speed 200K Followers/day

- High Quality Followers

- Drop-Back Guarantee

- Trusted Seller testimony

- Starting get 100K Followers Instagram

- Guaranteed to be the cheapest

Thank you,

Regards,

Copyright © 2014 - 2026 instatool.site

Instagram phish from Google Gmail

Posted by Dave Yadallee on Thursday, June 4. 2026

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Wed, 03 Jun 2026 17:53:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wUvNm-00000000H3U-4ATS

for dave@doctor.nl2k.ab.ca;

Wed, 03 Jun 2026 17:52:22 -0600

Resent-From: The Doctor

Resent-Date: Wed, 3 Jun 2026 17:52:22 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-ua1-f70.google.com ([209.85.222.70]:44306)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wUqvW-000000000JN-2sK6

for sales@nk.ca;

Wed, 03 Jun 2026 13:07:02 -0600

Received: by mail-ua1-f70.google.com with SMTP id a1e0cc1a2514c-96396658728so1739299241.1

for ; Wed, 03 Jun 2026 12:06:08 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=gmail.com; s=20251104; t=1780513562; x=1781118362; darn=nk.ca;

h=content-transfer-encoding:to:from:subject:date:message-id

:mime-version:from:to:cc:subject:date:message-id:reply-to;

bh=Nk1X77ROWPND4KkUVa6jMZOsIHCAYHPgVKMCQ0eaG28=;

b=NaaXqUbQAcM7U/1UB7aZ7XjMHzhfu+0cnZ6+SXUDmbBnTGjMntY6yS+qM97cwr3jEn

7rROVw1+QNdwCd5vSN6D6XTjkKrc9SqnN5JkZBfor/6n7G639WLZsBPYoUcHrNnIo4D4

39xHcZbn5bVBvlvj9Ri9fVg31i9+GTmE9eZGWPY8uzvbaXB+yqgs6FsqlHm5Wibegosn

ECgLuaH3RqzOX5/x5N/VHvQ2H1UbUVtIiI1C2nqdiHHu016281RNymzUCcDlU1nBXrTO

QzQxaJsDv8B7eBO4pftkbfdr3cbmqcgVfkotutFVbLfUIIvvSJ+PYvkyZbTdQb7C/Cis

V4pw==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20251104; t=1780513562; x=1781118362;

h=content-transfer-encoding:to:from:subject:date:message-id

:mime-version:x-gm-message-state:from:to:cc:subject:date:message-id

:reply-to;

bh=Nk1X77ROWPND4KkUVa6jMZOsIHCAYHPgVKMCQ0eaG28=;

b=pBBrzLYeQLz1ymrZd+nay1oWbJfut/xH4EL6ybjZrPwTvyEo2Xwthze6Shl8yIPi6F

IKSoH2TJziwjVP/3hGSAe6LaOVcdlQhLQVy5RFAuD6T80xdBaUKVq75UPdzajjt1jqFR

VRQ0IgUd7GedcBwCDb2vtXaj3S//xGj334AvWF38/hDeXwQnRp/JuA/f6tzDvYr9pjuT

ySBFbXg2gVf8tVAm0T/2rK8gabdpefHt7fQWmx5nOrCPL7qjHoIlAXywV4kOpF87bifN

XN0WY67lysB//2iDrNo6NZJJJ97nOhKMOT0sXVEUNZ8gAJHijlexv0aO44ls77wmV6j4

8POA==

X-Gm-Message-State: AOJu0YynOUYiFOeoQnielB1Km/SdFgig2yx0TW5LgfMvrOxVXn7gnMwd

w/w7NG5bY7iTQNPU7T4YvbKuiNdVgDqTxp4LKrDwgBBKbGKrOrGAHTKhzjBft/u9O1htrDJo/JO

fEhfa+w==

MIME-Version: 1.0

X-Received: by 2002:a05:6122:4d12:b0:573:a779:62cf with SMTP id

71dfb90a1353d-5a6e5ddeb96mr3050410e0c.7.1780513562069; Wed, 03 Jun 2026

12:06:02 -0700 (PDT)

Message-ID:

Date: Wed, 03 Jun 2026 19:06:02 +0000

Subject: Netknow Internet Service, Get More 100,000 Instagram Followers and

100,000 Facebook Likes here

From: tutugnangko836@gmail.com

To: sales@nk.ca

Content-Type: text/plain; charset="UTF-8"; format=flowed; delsp=yes

Content-Transfer-Encoding: base64

X-Spam_score: 5.8

X-Spam_score_int: 58

X-Spam_bar: +++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.

Content preview: Hi, Netknow Internet Service, Get More 100,000 Instagram Followers

and 100,000 Facebook Likes here Sorry to interrupt your time. We offer social

media services, If you're interested, please visit our Website. If you're

not interested, please skip this step.

Content analysis details: (5.8 points, 5.0 required)

pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[209.85.222.70 listed in dnsbl.ahbl.org]

[209.85.222.70 listed in dnsbl.ahbl.org]

[209.85.222.70 listed in dnsbl.ahbl.org]

[209.85.222.70 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[209.85.222.70 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[209.85.222.70 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[209.85.222.70 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[209.85.222.70 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[209.85.222.70 listed in will-spam-for-food.eu.org]

[209.85.222.70 listed in will-spam-for-food.eu.org]

[209.85.222.70 listed in will-spam-for-food.eu.org]

[209.85.222.70 listed in will-spam-for-food.eu.org]

[209.85.222.70 listed in will-spam-for-food.eu.org]

[209.85.222.70 listed in will-spam-for-food.eu.org]

[209.85.222.70 listed in will-spam-for-food.eu.org]

[209.85.222.70 listed in will-spam-for-food.eu.org]

2.5 URIBL_DBL_PHISH Contains a Phishing URL listed in the DBL blocklist

[URI: instatool.site]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[209.85.222.70 listed in list.dnswl.org]

-0.0 SPF_PASS SPF: sender matches SPF record

0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends in

digit

[tutugnangko836(at)gmail.com]

0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider

[tutugnangko836(at)gmail.com]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[209.85.222.70 listed in bl.score.senderscore.com]

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[209.85.222.70 listed in wl.mailspike.net]

2.0 RATWR8_MESSID Message-ID with excessive dashes and dollars

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

Subject: {SPAM?} Netknow Internet Service, Get More 100,000 Instagram Followers and

100,000 Facebook Likes here

Hi, Netknow Internet Service, Get More 100,000 Instagram Followers and 100,000 Facebook Likes here

Sorry to interrupt your time.

We offer social media services,

If you're interested, please visit our Website.

If you're not interested, please skip this step.

We will help you increase your social media presence to another level.

( Threads, Instagram, Twitter, Youtube, Facebook, etc. )

Are you interested in a free trial ?

Special For You Bonus Extra $2 - $5 FREE BALANCE TODAY SIGNUP NOW..!!!

GET 100K Followers Instagram NOW !!!

Order here :

[ https://instatool.site/store/free/?netknowyeg ]

Take free trial service today only...!!

10 -101K Instagram Followers

- Instant Start

- Safest Methods

- Privacy Protection

- Speed 200K Followers/day

- High Quality Followers

- Drop-Back Guarantee

- Trusted Seller testimony

- Starting get 100K Followers Instagram

- Guaranteed to be the cheapest

Thank you,

Regards,

Copyright © 2014 - 2026 instatool.site