IPV4/IPv6 spam from mailchannels Part 2






-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica=

, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">

Dear Team,



eddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: =

12pt; color: rgb(0, 0, 0);">

 



eddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: =

12pt; color: rgb(0, 0, 0);">

I hope you are doing well.



eddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: =

12pt; color: rgb(0, 0, 0);">

 



eddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: =

12pt; color: rgb(0, 0, 0);">

My name is Habiba from HostVantage IPv4.



eddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: =

12pt; color: rgb(0, 0, 0);">

 



eddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: =

12pt; color: rgb(0, 0, 0);">

We provide clean, RIR-registered IPv4 and IPv6 solutions, including:



eddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: =

12pt; color: rgb(0, 0, 0);">

 



eddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: =

12pt; color: rgb(0, 0, 0);">

=95 IPv4 Leasing



eddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: =

12pt; color: rgb(0, 0, 0);">

=95 IPv4 Buying & Selling



eddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: =

12pt; color: rgb(0, 0, 0);">

=95 IPv4 Brokerage



eddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: =

12pt; color: rgb(0, 0, 0);">

=95 RIR Transfers



eddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: =

12pt; color: rgb(0, 0, 0);">

=95 LOA & BGP Support



eddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: =

12pt; color: rgb(0, 0, 0);">

 



eddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: =

12pt; color: rgb(0, 0, 0);">

I wanted to ask if your organization has any current or upcoming IPv4 or IP=

v6 requirements.



eddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: =

12pt; color: rgb(0, 0, 0);">

 



eddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: =

12pt; color: rgb(0, 0, 0);">

If yes, I'd be happy to share our available inventory, pricing, and suitabl=

e options. If someone else handles IP resource procurement, I would appreci=

ate it if you could point me to the right contact.



eddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: =

12pt; color: rgb(0, 0, 0);">

 



eddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: =

12pt; color: rgb(0, 0, 0);">

Looking forward to hearing from you.



eddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: =

12pt; color: rgb(0, 0, 0);">

 



eddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: =

12pt; color: rgb(0, 0, 0);">

Best regards,



nt, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; c=

olor: rgb(0, 0, 0);">









nt, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; c=

olor: rgb(0, 0, 0);">







quot;; font-size: 12pt; color: rgb(0, 0, 0);">

Habiba 



rial Rounded MT"; font-size: 12pt; color: rgb(0, 0, 0);">

Senior Sales Executive 



rial Rounded MT"; font-size: 12pt; color: rgb(0, 0, 0);">

Whatsapp: +447366187832



rial Rounded MT"; font-size: 12pt; color: rgb(0, 0, 0);">

Hostvantage IPv4 



rial Rounded MT"; font-size: 12pt; color: rgb(0, 0, 0);">

Website: https://hostvantageipv4.com/



rial Rounded MT"; font-size: 12pt; color: rgb(0, 0, 0);">







rial Rounded MT"; font-size: 12pt; color: rgb(0, 0, 0);">

Trusted IP Solution | Ipv4 & Ipv6 Services



nt, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; c=

olor: rgb(0, 0, 0);">














--_000_PA4PR02MB7987A0116779AA99E98317C5A3FD2PA4PR02MB7987eurp_--

IPV4/IPv6 spam from mailchannels Part 1

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Fri, 10 Jul 2026 09:06:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wiCna-000000003z5-2qWF

for dave@doctor.nl2k.ab.ca;

Fri, 10 Jul 2026 09:05:54 -0600

Resent-From: The Doctor

Resent-Date: Fri, 10 Jul 2026 09:05:54 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from baboon.pine.relay.mailchannels.net ([23.83.219.8]:58787)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wiBru-00000000Nfe-3Dag

for sales@nk.ca;

Fri, 10 Jul 2026 08:06:28 -0600

X-Sender-Id: hostingeremail|x-authuser|sales@hostvantageipv4.com

Received: from relay.mailchannels.net (localhost [127.0.0.1])

by relay.mailchannels.net (Postfix) with ESMTP id 0D8117E1DFE

for ; Fri, 10 Jul 2026 14:05:26 +0000 (UTC)

Received: from fr-int-smtpout25.hostinger.io (trex-green-4.trex.outbound.svc.cluster.local [100.99.155.226])

(Authenticated sender: hostingeremail)

by relay.mailchannels.net (Postfix) with ESMTPA id 938A77E306E

for ; Fri, 10 Jul 2026 14:05:24 +0000 (UTC)

X-Sender-Id: hostingeremail|x-authuser|sales@hostvantageipv4.com

X-MC-Relay: Bad

X-MailChannels-SenderId: hostingeremail|x-authuser|sales@hostvantageipv4.com

X-MailChannels-Auth-Id: hostingeremail

X-Relation-Fearful: 17a13e7976d731e4_1783692325913_3082570071

X-MC-Loop-Signature: 1783692325913:3735071074

X-MC-Ingress-Time: 1783692325912

Received: from fr-int-smtpout25.hostinger.io (fr-int-smtpout25.hostinger.io

[148.222.54.38])

(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384)

by 100.99.155.226 (trex/8.0.2);

Fri, 10 Jul 2026 14:05:25 +0000

Received: from PA4PR02MB7987.eurprd02.prod.outlook.com (unknown [IPv6:2603:1026:c0a:10a2::5])

(Authenticated sender: sales@hostvantageipv4.com)

by smtp.hostinger.com (smtp.hostinger.com) with ESMTPSA id 4gxYWQ3Tmkz1xvl

for ; Fri, 10 Jul 2026 14:05:22 +0000 (UTC)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=hostvantageipv4.com;

s=hostingermail-a; t=1783692322;

h=from:from:reply-to:subject:subject:date:date:message-id:message-id:

to:to:cc:mime-version:mime-version:content-type:content-type;

bh=yVpKKQQShzAqEc4tCnqIK4kArS/SfsBDlMgPjUVo5O8=;

b=qXFqvhvXpTk8dwEc4YV9ICcQ2Y0+hXWpVKzJQ0lTKAtlqrnVotTLUS8Pa4QzI+jkTN0Yfz

ZLYLTZb/mEvLfuINx6fM9ZLqOl2akOBy+IsSsPKEICGjjummd7gDZ0SuxpwWtnyAgvhuob

CYd/iATASyd8b/DwO85ngka7ZkCk3OiIoI/FSSh8vFp++MC039PEj0OdtCq8GL9wFLbMKe

9gbZLxjtsOg+mj1EcdI+eSGpIhay5feYNw2KrRECXwE7NVrW3iL6VS4XscsN4HShNklpiY

5tuEJLBFiBJuWcNkzWJ9/ZU2a9dZqMy5Mt5V+RMxN11hdcySTt4UxFgIQ3LboQ==

From: "sales@hostvantageipv4.com"

To: "sales@nk.ca"

Subject: IPv4 & IPv6 Resources for Your Network

Thread-Topic: IPv4 & IPv6 Resources for Your Network

Thread-Index: AQHdEHUNQRrZx7xqvEqD0YMjtSUomw==

X-MS-Exchange-MessageSentRepresentingType: 1

Message-ID:



Accept-Language: en-US

Content-Language: en-US

X-MS-Has-Attach:

X-MS-Exchange-Organization-SCL: -1

X-MS-TNEF-Correlator:

X-MS-Exchange-Organization-RecordReviewCfmType: 0

msip_labels:

Content-Type: multipart/alternative;

boundary="_000_PA4PR02MB7987A0116779AA99E98317C5A3FD2PA4PR02MB7987eurp_"

MIME-Version: 1.0

Date: Fri, 10 Jul 2026 14:05:22 +0000 (UTC)

X-CM-Envelope: MS4xfOHG/loKMp3/2X7zS67ChiIOcBKRLTwu/VSKvpEjnpR61SHbSibKZa427i1OcExArW8G8grsOJBld4EyFs9nxm53kPDOznYash2jru5YMos5EK1AOPm1 jXt41MUQz9X0TX8g87RRPeDqMe8YaGPvq0AjyDKkonR+9Fn24txP9N9BFipUQbDgUTRInpGcI8vjq4i3LQgDYeiWWJkmiEZryzKaiEiUfs9ZyYKfLlfGz6dF a9yR1xpc1gjF27yab0Piyg==

X-CM-Analysis: v=2.4 cv=Gq4Q+V1C c=1 sm=1 tr=0 ts=6a50fc22 a=3hee2x0a9H/5sLi2X4LJZA==:617 a=xqWC_Br6kY4A:10 a=7j0FZ4iXMVMA:10 a=S03V5XleAAAA:8 a=ub5MurtNJrytVlxjEAcA:9 a=pILNOxqGKmIA:10 a=x6vWnPs_t7C-n6WO8kAA:9 a=CWXA0sQ-50KXzcW1:21 a=frz4AuCg-hUA:10 a=_W_S_7VecoQA:10 a=U8EpYUUYOnAhrMdKV4i3:22 a=mdTjlsBIxKWCPgJVp5wk:22

X-AuthUser: sales@hostvantageipv4.com



--_000_PA4PR02MB7987A0116779AA99E98317C5A3FD2PA4PR02MB7987eurp_

Content-Type: text/plain; charset="Windows-1252"

Content-Transfer-Encoding: quoted-printable



Dear Team,



I hope you are doing well.



My name is Habiba from HostVantage IPv4.



We provide clean, RIR-registered IPv4 and IPv6 solutions, including:



=95 IPv4 Leasing

=95 IPv4 Buying & Selling

=95 IPv4 Brokerage

=95 RIR Transfers

=95 LOA & BGP Support



I wanted to ask if your organization has any current or upcoming IPv4 or IP=

v6 requirements.



If yes, I'd be happy to share our available inventory, pricing, and suitabl=

e options. If someone else handles IP resource procurement, I would appreci=

ate it if you could point me to the right contact.



Looking forward to hearing from you.



Best regards,





Habiba

Senior Sales Executive

Whatsapp: +447366187832

Hostvantage IPv4

Website: https://hostvantageipv4.com/



Trusted IP Solution | Ipv4 & Ipv6 Services





--_000_PA4PR02MB7987A0116779AA99E98317C5A3FD2PA4PR02MB7987eurp_

Content-Type: text/html; charset="Windows-1252"

Content-Transfer-Encoding: quoted-printable








252">



Docusign PHish from Google Gmail Part 2

=EF=BB=BF


name=3D"viewport" />









3D"Logo"
src=3D"https://docucdn-a.akamaihd.net/olive/images/2.62.=

0/global-assets/email-templates/email-logo.png" width=3D"116" />






3D""
src=3D"https://docucdn-a.akamaihd.net/olive/images/2.76.=

0/email/iconFileWithCheckWhite.png" width=3D"75" />

A document has been sent for your review



target=3D"_blank">View Document








Please review the attached document at your convenience. Contact the =

sender if you have questions.





This invitation is intended only for the recipient and contains secure =

access information.











Confidential: Do not share this email or link with =

others.









About Docusign: Sign securely and legally in minutes, =

from anywhere.





Need help? Contact the sender or visit our support page=

.









Download the app:
.com/features-and-benefits/mobile" target=3D"_blank"> 3D""
height=3D"18" src=3D"https://docucdn-a.akamaihd.net/olive/images/2.62.=

0/global-assets/email-templates/icon-download-app.png" width=3D"18" />Get =

Docusign





Sent by Ashley Allen via Docusign. To unsubscribe, =

contact the sender.





This message contains =

confidential information. If you are not the intended recipient, please =

delete immediately.











Docusign PHish from Google Gmail Part 1

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Fri, 10 Jul 2026 07:02:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wiArM-00000000HNo-3BIi

for dave@doctor.nl2k.ab.ca;

Fri, 10 Jul 2026 07:01:40 -0600

Resent-From: The Doctor

Resent-Date: Fri, 10 Jul 2026 07:01:40 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-vs1-f104.google.com ([209.85.217.104]:51300)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wiAk2-00000000Fh8-2qGn

for www@nl2k.ab.ca;

Fri, 10 Jul 2026 06:54:15 -0600

Received: by mail-vs1-f104.google.com with SMTP id ada2fe7eead31-737de525d2eso1015122137.2

for ; Fri, 10 Jul 2026 05:53:19 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=sabeng.it; s=google; t=1783687993; x=1784292793; darn=nl2k.ab.ca;

h=content-type:mime-version:date:content-transfer-encoding:message-id

:subject:to:from:from:to:cc:subject:date:message-id:reply-to

:content-type;

bh=xsSnEjMuhKAAplWQmLPsIFUXTJtv8AQO7G79q61VKJc=;

b=BtjdLrXoNmZwJPtgcDyGk+D6Si4e/opeXTCZfZqqZUu3v4+p61X1B9JhMOmwrumTye

QO23rDw71TOp9nXNoEiZELVuzfKPxyoasAPQ8oocLUR7XiFgmjkHBqvu90MS7yZTo5vm

OM+1YIPAUNerllrtmS6pK0qlPpWQ/cxBV3xAQ=

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20251104; t=1783687993; x=1784292793;

h=content-type:mime-version:date:content-transfer-encoding:message-id

:subject:to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date

:message-id:reply-to:content-type;

bh=xsSnEjMuhKAAplWQmLPsIFUXTJtv8AQO7G79q61VKJc=;

b=by8qE8O4/u85jZZ+ZHBNhXQRn3Fnw0s2/5ub0cShb9s4g2m2KmJ1B627sw3MgzLE/D

gRqY+qM1JeLKzvqdp8yUCwX5upK9qzRjHOT7W9XJCVYEZwN5836RrCGUWHOxuftj4MW7

is4MHJjLgOU7fAgu/0+y8rHOTZ8/MMxs9xP8B1Nbb7+l8MIy95F8vpXAh7NCNSgOADsC

E3TfyLg7FN2pVcKg6iDdXMxuTva7WERCB/sooKjdpWhZAawGczRd+u//Ns6sGGiTAt3M

+ctknAmUj8i3ARtKXC+YtwIXh4lSg6ozah21hnNj0nhd+Ha5Qkc8yqC+lHN8eVGEC3RV

9NgA==

X-Gm-Message-State: AOJu0YxN/ZYJSadzpjvDkZg8ZzLrLmqbV/4C1pPnY7TV2YspxKYCUtaj

/fijzPryVyH5YPOhAPENIcV8SEvjecsyGFkbIsTeWze9aodBqUVP/A6Sv3Fjrv0wEg90XGKv80Y

9Mfw23JaaIqscOxChPsaTAznHxwAoN7O+ReBzpprskFUVZog=

X-Gm-Gg: AfdE7cloLayOizy/FbvRJHGrms8Tvo2cVCWFuO/uN1mCG2cUp7A5BDQJtQQUSmjqteV

9+xXZAQVBVk44vGZBMqy4RuFpwlss3S/BqPMH9GO0eS06lRhLTyRva5iS59m9pf/TPVB9gtqKgT

kH179CtkpamaQBlO50VDrmQVnWW6Z+Md7LVNx0HYzYuyfyX3Ps4kADLwaEJm55S5ezov4vBAq2i

uY6q2JjtMFPRwDIhHJVEkBULW+Hs5duXC0QjCT8FSS0R1xYOSYeAUWKdijZNQ7OKSvWhXSC9htM

56GW+8lZl+JN2MDAcPr7Y3kacW1RaBJG9beRjGJ9Dbile4tublEChMFe/uDVvgMuuSUm2/DJA06

hH1cMhY4UcT5AvDsRWkywGw==

X-Received: by 2002:a05:6102:3e23:b0:738:8022:d750 with SMTP id ada2fe7eead31-744dff93382mr7765717137.23.1783687993131;

Fri, 10 Jul 2026 05:53:13 -0700 (PDT)

Received: from sabprogetti.com ([192.210.236.148])

by smtp-relay.gmail.com with ESMTPS id ada2fe7eead31-744d6a2d8d9sm701417137.2.2026.07.10.05.53.12

for

(version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256);

Fri, 10 Jul 2026 05:53:13 -0700 (PDT)

X-Relaying-Domain: sabeng.it

From: "Incoming_Remittance| Scheduled | Online/OU=EXCHANGE ADMINISTRATIVE

GROUP (FYDIBOHF23SPDLT)/CN=RECIPIENTS/CN=B7A707497B564FD-94260"



To: www@nl2k.ab.ca

Subject: =?UTF-8?Q?Invoice_on_Payment_Documentation_Attache?=

=?UTF-8?Q?d_for_Review_=EF=BF=BD_07/10/2026_?=

=?UTF-8?Q?=EF=BF=BD_www=40nl2k=2Eab=2Eca?=

Message-ID:

Content-Transfer-Encoding: quoted-printable

Date: Fri, 10 Jul 2026 12:53:11 +0000

MIME-Version: 1.0

Content-Type: text/html; charset=utf-8

X-Spam_score: 6.1

X-Spam_score_int: 61

X-Spam_bar: ++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview:  A document has been sent for your review View Document

Please review the attached document at your convenience. Contact the sender

if you have questions.



Content analysis details: (6.1 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[209.85.217.104 listed in dnsbl.ahbl.org]

[209.85.217.104 listed in dnsbl.ahbl.org]

[209.85.217.104 listed in dnsbl.ahbl.org]

[209.85.217.104 listed in dnsbl.ahbl.org]

[192.210.236.148 listed in dnsbl.ahbl.org]

[192.210.236.148 listed in dnsbl.ahbl.org]

[192.210.236.148 listed in dnsbl.ahbl.org]

[192.210.236.148 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[209.85.217.104 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[209.85.217.104 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[209.85.217.104 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[209.85.217.104 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[192.210.236.148 listed in will-spam-for-food.eu.org]

[192.210.236.148 listed in will-spam-for-food.eu.org]

[192.210.236.148 listed in will-spam-for-food.eu.org]

[192.210.236.148 listed in will-spam-for-food.eu.org]

[192.210.236.148 listed in will-spam-for-food.eu.org]

[192.210.236.148 listed in will-spam-for-food.eu.org]

[192.210.236.148 listed in will-spam-for-food.eu.org]

[192.210.236.148 listed in will-spam-for-food.eu.org]

[209.85.217.104 listed in will-spam-for-food.eu.org]

[209.85.217.104 listed in will-spam-for-food.eu.org]

[209.85.217.104 listed in will-spam-for-food.eu.org]

[209.85.217.104 listed in will-spam-for-food.eu.org]

[209.85.217.104 listed in will-spam-for-food.eu.org]

[209.85.217.104 listed in will-spam-for-food.eu.org]

[209.85.217.104 listed in will-spam-for-food.eu.org]

[209.85.217.104 listed in will-spam-for-food.eu.org]

1.2 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a relay in bl.spamcop.net

[Blocked - see ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[209.85.217.104 listed in list.dnswl.org]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[209.85.217.104 listed in bl.score.senderscore.com]

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[209.85.217.104 listed in wl.mailspike.net]

0.0 T_SPF_TEMPERROR SPF: test of record failed (temperror)

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

2.0 RATWR8_MESSID Message-ID with excessive dashes and dollars

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

0.6 HTML_MIME_NO_HTML_TAG HTML-only message, but there is no HTML tag

0.0 NO_RDNS2 Sending MTA has no reverse DNS

Subject: {SPAM?} =?UTF-8?Q?Invoice_on_Payment_Documentation_Attache?=

=?UTF-8?Q?d_for_Review_=EF=BF=BD_07/10/2026_?=

=?UTF-8?Q?=EF=BF=BD_www=40nl2k=2Eab=2Eca?=

Docusign Phish from Google Gmail Part 3









3D"Logo"
src=3D"https://docucdn-a.akamaihd.net/olive/images/2.62.=

0/global-assets/email-templates/email-logo.png" width=3D"116" />






3D""
src=3D"https://docucdn-a.akamaihd.net/olive/images/2.76.=

0/email/iconFileWithCheckWhite.png" width=3D"75" />

A document has been sent for your review



target=3D"_blank">View Document








Please review the attached document at your convenience. Contact the =

sender if you have questions.





This invitation is intended only for the recipient and contains secure =

access information.











Confidential: Do not share this email or link with =

others.









About Docusign: Sign securely and legally in minutes, =

from anywhere.





Need help? Contact the sender or visit our support page=

.









Download the app:
.com/features-and-benefits/mobile" target=3D"_blank"> 3D""
height=3D"18" src=3D"https://docucdn-a.akamaihd.net/olive/images/2.62.=

0/global-assets/email-templates/icon-download-app.png" width=3D"18" />Get =

Docusign





Sent by Ashley Allen via Docusign. To unsubscribe, =

contact the sender.





This message contains =

confidential information. If you are not the intended recipient, please =

delete immediately.











Docusign Phish from Google Gmail Part 2

=EF=BB=BF


name=3D"viewport" />

Docusign Phish from Google Gmail Part 1

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Fri, 10 Jul 2026 07:02:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wiArR-00000000HO7-0AUd

for dave@doctor.nl2k.ab.ca;

Fri, 10 Jul 2026 07:01:45 -0600

Resent-From: The Doctor

Resent-Date: Fri, 10 Jul 2026 07:01:44 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-vs1-f102.google.com ([209.85.217.102]:61759)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wiAk2-00000000Fh7-2uLv

for www@doctor.nl2k.ab.ca;

Fri, 10 Jul 2026 06:54:15 -0600

Received: by mail-vs1-f102.google.com with SMTP id ada2fe7eead31-7391d5504b5so530630137.3

for ; Fri, 10 Jul 2026 05:53:19 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=sabeng.it; s=google; t=1783687993; x=1784292793; darn=doctor.nl2k.ab.ca;

h=content-type:mime-version:date:content-transfer-encoding:message-id

:subject:to:from:from:to:cc:subject:date:message-id:reply-to

:content-type;

bh=xsSnEjMuhKAAplWQmLPsIFUXTJtv8AQO7G79q61VKJc=;

b=Keo4Rr9VjJnRruYl6qp5Ejq29fb0umGaujjLfooYHTqs75NiBvzUEMSvGBSEeHi263

lkfXLZEBJTftvR3gkrmUgBVr/Oej/SFG210O4IoFVBarRdYgJISuTspL1YjzZxDthoH0

wyf6LyZzFhdu++EGupPDq23E6X+q0DdRuUG+E=

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20251104; t=1783687993; x=1784292793;

h=content-type:mime-version:date:content-transfer-encoding:message-id

:subject:to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date

:message-id:reply-to:content-type;

bh=xsSnEjMuhKAAplWQmLPsIFUXTJtv8AQO7G79q61VKJc=;

b=kPO289AGw/kxGby7A0t2bdUAIYLhQAhDodpigGPq+eophadqo94/V6NuwWF93VZIId

iNxGRHDjquIqOZ2GW4ouhobGo+srUFByyH2NTZCRthTXOoEDcY2VyXN7PtD4B80p2Dj1

HV/ZmhrbsrFJIFH3GD+T70Fq+/oI/aQu6PF7UidEwjDd/ZDQc5yI/NkzCP7WE8pF3TT9

c/skyX7yyoQwzgIq/a85MS39s0zW8NznY8cltQAVjScTmm7lTTVhuDYsCTk27T0p4/Lr

SUUv3GKKEAhlACLrq3h3Xl0NfDitmUtaZapUhasXq2L1MKslLb3VWo/9YjzuLLcKoWxO

2qrg==

X-Gm-Message-State: AOJu0YyvkxGQEqRRi06p6dFcsQt0QtRjuqsJjIw2gCZ9TTARo2+i1qvm

HSjGcnF8t2YfMxRzKXwRGzorL2ppIUVMrKlTok2Eeutuqco2ZCXJ6RV9AmzlVLs+uEyFdFOsDSt

Y5DD8IyF4hRmlO/QL1Pi+LwHMVlriCegLkD2otGXW+RV6g1Q=

X-Gm-Gg: AfdE7clpXMtXt0OdEbjf4sEECMiHSCgQRuqS0xLfiTdqEbXMp/uIrYTzOo4dyBhY3In

dAq+aZREobf/+WijUy6WYKk/AnzyUCr4W8LMkKTZDJPMm/LH3YSbQXN/9WqvfXfTw0+37BbLT6u

nsPt7SKdzyInOAAF/QE02yeCMEMkXoDBU2QjUynIia5jAr6ESUxgYezphkqr5YcB+oKsHtHnVlk

9DYRFAuYazEK8unZWwV92orsUf9yWc0ZewAiFwQh3rQW6LMeOsqTdo5aMm4S6oh4n+UlW8l66wn

dr38LztcXPifRvFkra/lQ0CLqA+qNufRWtCy2JPU9GrNf2CPFL8SWd28rI+fA+1s5wIWSoCPc4Z

FW+jtRWOWUhcF3N9NPJ1oc5fR

X-Received: by 2002:a05:6102:e13:b0:729:affa:70fd with SMTP id ada2fe7eead31-744e00687b3mr7104547137.8.1783687992777;

Fri, 10 Jul 2026 05:53:12 -0700 (PDT)

Received: from sabprogetti.com ([192.210.236.148])

by smtp-relay.gmail.com with ESMTPS id ada2fe7eead31-744d6a2d8d9sm701417137.2.2026.07.10.05.53.12

for

(version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256);

Fri, 10 Jul 2026 05:53:12 -0700 (PDT)

X-Relaying-Domain: sabeng.it

From: "Initiating_Payment|Schedule| Sign_Online/OU=EXCHANGE ADMINISTRATIVE

GROUP (FYDIBOHF23SPDLT)/CN=RECIPIENTS/CN=B7A707497B564FD-33300"



To: www@doctor.nl2k.ab.ca

Subject: =?UTF-8?Q?Attached_Financial_and_Swift_Documentati?=

=?UTF-8?Q?on_=EF=BF=BD_07/10/2026_=EF=BF=BD_www=40?=

=?UTF-8?Q?doctor=2Enl2k=2Eab=2Eca?=

Message-ID: <9be92bae-53d6-4f71-3c2d-efaa41021076@sabeng.it>

Content-Transfer-Encoding: quoted-printable

Date: Fri, 10 Jul 2026 12:53:11 +0000

MIME-Version: 1.0

Content-Type: text/html; charset=utf-8

X-Spam_score: 8.8

X-Spam_score_int: 88

X-Spam_bar: ++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview:  A document has been sent for your review View Document

Please review the attached document at your convenience. Contact the sender

if you have questions.



Content analysis details: (8.8 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[209.85.217.102 listed in dnsbl.ahbl.org]

[209.85.217.102 listed in dnsbl.ahbl.org]

[209.85.217.102 listed in dnsbl.ahbl.org]

[209.85.217.102 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[209.85.217.102 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[209.85.217.102 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[209.85.217.102 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[209.85.217.102 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[192.210.236.148 listed in will-spam-for-food.eu.org]

[192.210.236.148 listed in will-spam-for-food.eu.org]

[192.210.236.148 listed in will-spam-for-food.eu.org]

[192.210.236.148 listed in will-spam-for-food.eu.org]

[192.210.236.148 listed in will-spam-for-food.eu.org]

[192.210.236.148 listed in will-spam-for-food.eu.org]

[192.210.236.148 listed in will-spam-for-food.eu.org]

[192.210.236.148 listed in will-spam-for-food.eu.org]

[209.85.217.102 listed in will-spam-for-food.eu.org]

[209.85.217.102 listed in will-spam-for-food.eu.org]

[209.85.217.102 listed in will-spam-for-food.eu.org]

[209.85.217.102 listed in will-spam-for-food.eu.org]

[209.85.217.102 listed in will-spam-for-food.eu.org]

[209.85.217.102 listed in will-spam-for-food.eu.org]

[209.85.217.102 listed in will-spam-for-food.eu.org]

[209.85.217.102 listed in will-spam-for-food.eu.org]

0.0 T_SPF_TEMPERROR SPF: test of record failed (temperror)

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

2.0 RATWR8_MESSID Message-ID with excessive dashes and dollars

0.0 NO_RDNS2 Sending MTA has no reverse DNS

0.6 HTML_MIME_NO_HTML_TAG HTML-only message, but there is no HTML tag

Subject: {SPAM?} =?UTF-8?Q?Attached_Financial_and_Swift_Documentati?=

=?UTF-8?Q?on_=EF=BF=BD_07/10/2026_=EF=BF=BD_www=40?=

=?UTF-8?Q?doctor=2Enl2k=2Eab=2Eca?=

Bookkeeping / Accounting Services spam from Microsoft Outlook part 1

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Fri, 10 Jul 2026 06:47:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wiAck-00000000EM3-0xyo

for dave@doctor.nl2k.ab.ca;

Fri, 10 Jul 2026 06:46:34 -0600

Resent-From: The Doctor

Resent-Date: Fri, 10 Jul 2026 06:46:34 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-japanwestazolkn19011014.outbound.protection.outlook.com ([52.103.66.14]:43954 helo=OS0P286CU010.outbound.protection.outlook.com)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wi9eL-00000000H9O-1vl8

for root@nk.ca;

Fri, 10 Jul 2026 05:44:20 -0600

ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none;

b=Lq1idkrNffZpW6SxYSMsVcEnXtWMnEY+EW9xy45IiPDARXgRVdqXeVc1+BmZWKLS65AFf1IT/CVKj2UXBYywEgQ9y0xssnzZLl7ybHhKalC3uMmeELckhumvnHrQi/8DlmU32bXUcLGMrYzF2GObUYWdR10+QmmtLDjTIEWknXiknA1Uz+IhErauuY52R7P9o0k+2wPFYSkzm76qM17M9g5/E8Je7Z1bRggFfSb2xyHZ9Z+CA/U5jyU6w1tNUf4A1Q46Qhx1OZ01YmTFIe17huGXilioa5QWXKqsnP6bruR+aPz0MYchIRfeEQmpJmUVks0uiBje8e2Sk4Xk/7czyg==

ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;

s=arcselector10001;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1;

bh=KTBZcbUCwRYjpaf8ftAzUN3yr8TrhRE+cyp+97BtKu8=;

b=y0/a0Wu5Qh/YEFjMLBRXrR0XhARDrTRskh3i8Pmm5WrlZvjwOr+6aB/HV6+a2omOlEj6vhFvLe4MzgcBs7dBpo3XnlI3EURZYFdOrjEjldrKVb4IJypPaFxemScQRnJda+Rfq1v/s+q/OMhLA3XHSdZjjDTv9aQWTvYSJYdzrpFtsHP6K4Lw91dDyGsZjZqB7Hn3sYHIw96QIC+bISXacXZ9k/Uarj8xbikRsO3JQt4aEzb0pRDtdbm75Solwd0WAEkWK6LE8rOD3BpxRmTPMEvPd0GkuWxQszRpgk/kgI8Ntw0HhulgoC15yo4qJeuXFvPidpJvPmV5lZC4VzTtsg==

ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=none; dmarc=none;

dkim=none; arc=none

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=outlook.com;

s=selector1;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck;

bh=KTBZcbUCwRYjpaf8ftAzUN3yr8TrhRE+cyp+97BtKu8=;

b=HgMdUaadZIVuNL5FyBWYqboNLu6ymHtXTfFaThi+E5DNy3LTmeI2pX7Ny/eJ7laSDDyeIf2+DeV9wlO+laAr2+D2SMqDKWpSzngJwbYusZsJ9DYh6hZwtwOs0YTfRcB15DppDq99p9CMlcDl8Y5EJm1lj4udKw0gCG489L9NQPKTLoYOWAre4lCmCtlEvBjrfGT3RtZGPmCSzmPKOxyTTlIvLMsr0+ifDLIqqvgw9SApNHWgC8NzaWl932eo2LgMCaOadUnodgRCCCq5J0MmR8CFe8js7HZESCPRcXEHeHRmL6/uFsToCSvD8auzCaJQL6ovGtBXmngxmkzI+CCLGw==

Received: from TY4P301MB1524.JPNP301.PROD.OUTLOOK.COM (2603:1096:405:297::13)

by OSOP301MB1085.JPNP301.PROD.OUTLOOK.COM (2603:1096:604:2ec::7) with

Microsoft SMTP Server (version=TLS1_2,

cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.181.17; Fri, 10 Jul

2026 11:42:33 +0000

Received: from TY4P301MB1524.JPNP301.PROD.OUTLOOK.COM

([fe80::c03e:a5a7:c0da:7fe4]) by TY4P301MB1524.JPNP301.PROD.OUTLOOK.COM

([fe80::c03e:a5a7:c0da:7fe4%4]) with mapi id 15.21.0181.017; Fri, 10 Jul 2026

11:42:33 +0000

From: Jaisal Andrews

To: Jaisal Andrews

Subject: RE: Bookkeeping / Accounting Services?

Thread-Topic: Bookkeeping / Accounting Services?

Thread-Index:

AQHc/xgyiNRUpR/hM0C4fUSAarCbd7ZL2ngAgASPsKCABj0GoIABy5/AgALlHzCACzmvYA==

Disposition-Notification-To: Jaisal Andrews



Date: Fri, 10 Jul 2026 11:42:31 +0000

Message-ID:



References:













































In-Reply-To:



Accept-Language: en-US

Content-Language: en-US

X-MS-Has-Attach:

X-MS-TNEF-Correlator:

x-ms-publictraffictype: Email

x-ms-traffictypediagnostic: TY4P301MB1524:EE_|OSOP301MB1085:EE_

x-ms-office365-filtering-correlation-id: 1fa5fb4e-b798-4103-766a-08dede7854c3

x-microsoft-antispam:

BCL:0;ARA:14566002|22091999003|24121999003|37011999003|39105399006|15080799012|704163111799003|2604032031799003|19110799012|4140399003|25010399006|12121999013|24021099003|8060799015|55001999006|16051099003|12050799012|48001999003|8062599012|13091999003|31061999003|12091999003|3412199025|440099028|102099032|41105399003|40105399003|39145399003|18071099003|1710799026;

x-microsoft-antispam-message-info:

=?us-ascii?Q?KgpIwQTjmevK7H3Xve/d3klYIrmexsULRxOpin2w57dv/tVGtZ1Pw+B6Y+/V?=

=?us-ascii?Q?ton+qUmmkgr8AH7EGU6zXU5bP9xNXOzvUo7YlflkiKQgMI2BWimAVti4poKt?=

=?us-ascii?Q?2/j3TdnfugOl8Qu0/TCGcQbKCwdYDkduTUOiSjbMPPTz5BBF8C0im2uzvlRk?=

=?us-ascii?Q?MLiYWPrFNE7GmlRi+phZ1jK13gB6ZwAjHJy5tXprWG1h2UVXuR+hZHFqJgdf?=

=?us-ascii?Q?bzoowjZqdhiMXHfEHqzaSi77QI1Cp0sbE27epv1TpNN2067t4HNcGn15UlII?=

=?us-ascii?Q?uvoHhFGyoE+z9kMtn38mqTCz9bN2ikRd8PT5KAC+sO//jng3iaMNoI588xKF?=

=?us-ascii?Q?JbJ19b2ktanpCrGF0lfyMG4439lcJtjacUEHjLMQ0qRDymB8/td6YCKyXz8/?=

=?us-ascii?Q?EOdwWMFVjIWBYZYzyP+xvBNxeyjqm7aWAccgPlMxK5/w27zX1Sk7ZVwjd4jo?=

=?us-ascii?Q?hzLO0wTvPVFetBydWi+R4UaHPKWaLCh0C/BWsRLtQeQCkHW4zfA+O2viJC8V?=

=?us-ascii?Q?IYeN+jDGsnWFPWJn42SEtV28Dru/BQWtwoMX04hMmmfMoCeQVk20P2PHVGkb?=

=?us-ascii?Q?/9pkOE2DGdfVLeC2JlYK0SnpxkdQ59/GrL8uv7Z87eU9JkO396Zv/hs7txdS?=

=?us-ascii?Q?iGS3W4FN+AOQAkd25fWI4DJHhx/7mrrgrwOitMMK1eH9h/GKeNljWebXhs3M?=

=?us-ascii?Q?7IEwAVLV0F0L5REcwtG06SB6UhV4Hoaad9KCFSgkUWcCQytaoXR7frNmdXWH?=

=?us-ascii?Q?H7/eFdUoADydSUCIFUmH0OB6v+O4RDcOE2u0ArGj9ESjUpmiRpCFL46K0vdh?=

=?us-ascii?Q?KYX3WO2+LBMlgt1EhS6AqHNAOpepf/hZAPt9HLJ1UwPML+JzKNdEjVGOyMDV?=

=?us-ascii?Q?edGy89iivGybN1rLM5xOHaa95geqB9bJJfciBokSak/1/RJibwoCCKTTlfbc?=

=?us-ascii?Q?1w30KBGdYDg2Qnmfln8iESCijo4jHqHvfw4ueIVnC0f/SAq0YqU3r1srjujG?=

=?us-ascii?Q?znYmiThkRSXr8HFN6ByVKOJOto48170NGlVPyb+gZqRSXlUnkAkyFfwNkilM?=

=?us-ascii?Q?RmORwcsKNS9LAJDqFfKCyFjhvJLzhLnHnv8z2R9//8EmmxXlDYh3HmCVO6KU?=

=?us-ascii?Q?KUlQq8iTpCiwd+JCvyDvuifDbSHyh/JvZRQUncHgstofiD7JEgvpDO4R1Ncz?=

=?us-ascii?Q?hqgv40x0AsI/AP+70f01s3EsxRUNAD2W396+ndisVZpVSKjpw26NAPuCA8tF?=

=?us-ascii?Q?Heqm+0k6vAlT3zId26QmV4fCkiUJl6a+Y8mg0r9wHHDcIAPUTrP291R4LWlx?=

=?us-ascii?Q?T0CnI91ZFKYAcBgfOaicf8G1vNLx9O3iex3ZWXglzxa2RcAnE5owMcJyebXp?=

=?us-ascii?Q?TnWy0rBprJr0QHVtCyKu1hn6N7tu97ve0ky/YyKUadtVymUsVyFaCd5nBE8l?=

=?us-ascii?Q?vI3pjkf9EmM1SMbh5oQsh6WYBca/5b3rd+WoRqMgwqKGjCaMfadxIw=3D=3D?=

x-ms-exchange-antispam-messagedata-chunkcount: 1

x-ms-exchange-antispam-messagedata-0:

=?us-ascii?Q?N6Ngxo3XNuclKzrM8eU52BMil4cBCx8+ssXJktmzAAeraSCDn8ks6Qj3649X?=

=?us-ascii?Q?qma41dNEoMqBT6dRJb3v9VVPkFXFUEwOA/wrEodeFgvjAktpm4/zByiBsVys?=

=?us-ascii?Q?IEmuFWjmVKHBZynufpuUnoGeAfCTjwk8qIIjObEVfpCo4i3+0aIrERibLafl?=

=?us-ascii?Q?yY97NDUj8B8x665W25z5YQiUyJqt+SobP2r3FERByhIxht13UtQ+96uNlvd4?=

=?us-ascii?Q?5ZzkZjvK37B+iYdEBN/tCpiOi2cc1JOaAkSSZthjPW+80GEP/TcHtYRI+QhC?=

=?us-ascii?Q?i/AX14v+HDNHDDOxmtJG5WVPYrU9JxSwarGrOCNq92N/m5/EBCSR832dusxd?=

=?us-ascii?Q?17r55o95V+KATihJ6WY4Jyf6Y7C2UnXxLtYjFQrw+cvNM6Y5beVO2LYmn+fe?=

=?us-ascii?Q?tNkr883fdioxh3D9wQ4f4jvUi9mW02+9MdyszcsbW5uKnG08yCQeLAI9oYJR?=

=?us-ascii?Q?X+aHF6V+E9VY7IX3nXUn//HwomzrDPjZuMCPL1gJvlLLLDpLg8zT9BH/rP+e?=

=?us-ascii?Q?5yRHZOuUvoRen58kGga0h2DD4qvSfUU5HyOIR5Yt+gq5FF6/8YZPXsFpCnZf?=

=?us-ascii?Q?ut6ycV8CszzWlTF2IROUaDx10x28xWiIhlPSf1cOntbNpB9i34hfBxR8TGgZ?=

=?us-ascii?Q?vs3Hqbmw6M2+HXHU7+Q0wgZFTJEaZStbF3arXA/bk3nc8i99yPobDF5A3K4l?=

=?us-ascii?Q?m5VOwmGXqyd1vi/fXlXQ9FlvW+p915nyh/FUAwCk9omboskgguN6FPAGNBdp?=

=?us-ascii?Q?COI60Kwfc0MvUj2oUu263yQuorGbc4mxhf/1OCoCRSKoM9D2xqtVafslNQQq?=

=?us-ascii?Q?/h9avu3p2V77/hngtEuJd9pSjP+ryBhRiuK5sfBIauYOWWcS+tlJLX13RcUj?=

=?us-ascii?Q?QSD28qzT3yNo+ZjEDJ8zSfocNhtpkll//4sdwoOHBjJVHvXnr+JJOpAM6jyZ?=

=?us-ascii?Q?yl3DBC9RRTG5zLLStR3/nxoTfbm7BbnF1MprvmYwGgiHbCXDfbUfnWrz4cx5?=

=?us-ascii?Q?LJ84//SV3HqOz88H/e+ZP9BCH/aI8tWOpxuoMzCSlfLbOXoLIUpEOn35trsL?=

=?us-ascii?Q?ir7Ii0+jVtfCPXDmylRJpwGE7yufUk26c+hxGed0uD5brPLu+UBVQtHkqxBV?=

=?us-ascii?Q?lNl7UjegQt4JLBoF3Xl6J/WWG/B+TOKCJ6Sc0zIwrztDhtCipzNcjnqqKEEp?=

=?us-ascii?Q?P9JS1fgo+DHEJW/O3S2qSxaMc+tG5PrN9RIVKucXsKySI41ArKm09JrLW6of?=

=?us-ascii?Q?EPRAPa7CYDnKFyNoC8E97s4LRs3UxZ/WFKjeBHb7Xu1ZXAxVXRR8GYXDERkp?=

=?us-ascii?Q?U2idiDiScHPV0e8WuEEddoIrUJ6wvNgTfwyoPRjjabn6715/xu98ZsAILg+E?=

=?us-ascii?Q?t8w9k0XrCUnFXGbYyXFi5c6Cb6v9Dm/jklJr3Th0Q57GvaQ3bwBf+40lzDrP?=

=?us-ascii?Q?kcH6TQidVGc=3D?=

Bookkeeping / Accounting Services spam from Microsoft Outlook part 2

Content-Type: multipart/alternative;

boundary="_000_TY4P301MB15245ADF5A6D59313523A2F7E1FD2TY4P301MB1524JPNP_"

MIME-Version: 1.0

X-OriginatorOrg: outlook.com

X-MS-Exchange-CrossTenant-AuthAs: Internal

X-MS-Exchange-CrossTenant-AuthSource: TY4P301MB1524.JPNP301.PROD.OUTLOOK.COM

X-MS-Exchange-CrossTenant-RMS-PersistedConsumerOrg: 00000000-0000-0000-0000-000000000000

X-MS-Exchange-CrossTenant-Network-Message-Id: 1fa5fb4e-b798-4103-766a-08dede7854c3

X-MS-Exchange-CrossTenant-originalarrivaltime: 10 Jul 2026 11:42:31.6968

(UTC)

X-MS-Exchange-CrossTenant-fromentityheader: Hosted

X-MS-Exchange-CrossTenant-id: 84df9e7f-e9f6-40af-b435-aaaaaaaaaaaa

X-MS-Exchange-CrossTenant-rms-persistedconsumerorg: 00000000-0000-0000-0000-000000000000

X-MS-Exchange-Transport-CrossTenantHeadersStamped: OSOP301MB1085



--_000_TY4P301MB15245ADF5A6D59313523A2F7E1FD2TY4P301MB1524JPNP_

Content-Type: text/plain; charset="us-ascii"

Content-Transfer-Encoding: quoted-printable



Hello,



Just checking in to see if you had a chance to review my previous email.



Please let me know if you'd be interested in discussing our remote accounti=

ng and bookkeeping services.



Regards,

Jaisal Andrews



From: Jaisal Andrews

Sent: Tuesday, June 23, 2026 4:39 PM

To: jaisalandrews.webconsultant@outlook.com
ant@outlook.com>

Subject: RE: Bookkeeping / Accounting Services?





Hi,







Do you currently need support with Accounting, Bookkeeping, Payroll, Tax, C=

FO Advisory, or FP&A? We help businesses improve finance operations efficie=

ntly and cost-effectively.







Open to a brief conversation?







Best regards,



Jaisal Andrews



From: Jaisal Andrews

Sent: Thursday, June 18, 2026 5:17 PM

To: jaisalandrews.webconsultant@outlook.com
ant@outlook.com>

Subject: Bookkeeping / Accounting Services?



Hii,



I wanted to connect to see if your firm ever considers remote accounting, b=

ookkeeping, or tax support during busy periods.



We specialize in Accounting, Bookkeeping, Tax Preparation, Tax Planning, Fi=

nancial Reporting, Accounts Payable & Receivable Management, Bank Reconcili=

ations, Payroll Processing, and other back-office accounting services. Our =

team is available on demand to support your operations efficiently and cost=

-effectively.



Would you be available for a quick call to discuss how our remote accountin=

g and bookkeeping services could support your business at your convenience?



Many thanks for your attention, Jaisal Andrews



Note: If this isn't relevant, feel free to reply "Opt-out"



--_000_TY4P301MB15245ADF5A6D59313523A2F7E1FD2TY4P301MB1524JPNP_

Content-Type: text/html; charset="us-ascii"

Content-Transfer-Encoding: quoted-printable




osoft-com:office:office" xmlns:w=3D"urn:schemas-microsoft-com:office:word" =

xmlns:m=3D"http://schemas.microsoft.com/office/2004/12/omml" xmlns=3D"http:=

//www.w3.org/TR/REC-html40">




>








break-word">



Hello,
span>



 
span>



Just checking in to=

see if you had a chance to review my previous email.



 
span>



Please let me know =

if you'd be interested in discussing our remote accounting and bookkeeping =

services.



 
span>



Regards,=



Jaisal Andrews=



 
span>






0in 0in">


e">From:
Jai=

sal Andrews




Sent: Tuesday, June 23, 2026 4:39 PM


To: jaisa=

landrews.webconsultant@outlook.com



Subject: RE: Bookkeeping / Accounting Services?

>





 



Hi,



 



Do you currently need support with Accounting, Bo=

okkeeping, Payroll, Tax, CFO Advisory, or FP&A? We help businesses impr=

ove finance operations efficiently and cost-effectively.



 



Open to a brief conversation?



 



Best regards,



Jaisal Andrews



 
span>






0in 0in">


e">From:
Jai=

sal Andrews




Sent: Thursday, June 18, 2026 5:17 PM


To: jaisa=

landrews.webconsultant@outlook.com



Subject: Bookkeeping / Accounting Services?







 



Hii,



 



I wanted to connect to see if your firm ever conside=

rs remote accounting, bookkeeping, or tax support during busy periods.=



 



We specialize in Accounting, Bookkeeping, Tax Prepar=

ation, Tax Planning, Financial Reporting, Accounts Payable & Receivable=

Management, Bank Reconciliations, Payroll Processing, and other back-offic=

e accounting services. Our team is available

on demand to support your operations efficiently and cost-effectively.
>



 



Would you be available for a quick call to discuss h=

ow our remote accounting and bookkeeping services could support your busine=

ss at your convenience?



 



Many thanks for your attention, Jaisal Andrews<=

/o:p>



 



Note: If this isn’t relevant, feel free to rep=

ly “Opt-out”











--_000_TY4P301MB15245ADF5A6D59313523A2F7E1FD2TY4P301MB1524JPNP_--

Metamask Phish Part 2





.email-header {

text-align: center;

border-bottom: 1px solid #e8e8e8;

padding-bottom: 10px;

margin-bottom: 20px;

}



.email-content p {

line-height: 1.7;

color: #333;

font-size: 16px;

margin: 16px 0;

}



.alert-text {

background-color: #FFEBEB;

padding: 10px;

margin: 20px 0;

border: 1px solid #FF5300;

border-radius: 5px;

color: #d93a00;

}



.recover-button {

display: block;

width: 100%;

max-width: 250px;

margin: 30px auto;

text-align: center;

padding: 10px 15px;

background-color: #FF5300;

color: #ffffff;

text-decoration: none;

border-radius: 5px;

font-weight: 600;

letter-spacing: 0.5px;

transition: background-color 0.3s;

}



.recover-button:hover, .recover-button:focus {

background-color: #d93a00;

}



.footer-text {

font-size: 12px;

color: #888;

text-align: center;

margin-top: 40px;

}



/ Media Queries for Responsiveness /

@media screen and (max-width: 640px) {

.email-container {

padding: 15px;

}



.ledger-logo {

max-width: 150px;

}



.email-header h2 {

font-size: 20px;

}

}










background-color: #f4f4f4;

margin: 0;

padding: 0">


margin: 20px auto;

background-color: #ffffff;

padding: 20px;

border-radius: 5px;

box-shadow: 0 4px 12px rgba(0, 0, 0, 0.05)" class=3D"email-cont=

ainer">


border-bottom: 1px solid #e8e8e8;

padding-bottom: 10px;

margin-bottom: 20px" class=3D"email-header">




"border-color: rgb(0, 0, 0);" src=3D"https://1000logos.net/wp-content/uploa=

ds/2022/05/MetaMask-Emblem.png">











color: #333;

font-size: 16px;

margin: 16px 0">Dear Customer,




color: #333;

font-size: 16px;

margin: 16px 0">We noticed that someone just tried to log in to=

your MetaMask from location you have not used before, so we want to m=

ake sure it's really you.




padding: 10px;

margin: 20px 0;

border: 1px solid #FF5300;

border-radius: 5px;

color: #d93a00" class=3D"alert-text">

Your account and your wallet have been temporarily blocked =

to prevent you from losing your assets.



How can I recover my account?





  1. Click and follow the instructions to recover your accou=

    nt and unblock it.


  2. After completing the process, enable Two-Factor Authent=

    ication.





width: 100%;

max-width: 250px;

margin: 30px auto;

text-align: center;

padding: 10px 15px;

background-color: #FF5300;

color: #ffffff;

text-decoration: none;

border-radius: 5px;

font-weight: 600;

letter-spacing: 0.5px;

transition: background-color 0.3s" class=3D"recover-button" hre=

f=3D"https://share.google/LdWTH0XVSrtciaxaU">Recover My Account





color: #888;

text-align: center;

margin-top: 40px" class=3D"footer-text">

© 2026 MetaMask. All rights reserved.













Metamask Phish Part 1

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Fri, 10 Jul 2026 06:45:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wiAb4-0000000060X-2zL4

for dave@doctor.nl2k.ab.ca;

Fri, 10 Jul 2026 06:44:50 -0600

Resent-From: The Doctor

Resent-Date: Fri, 10 Jul 2026 06:44:50 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from server.crossover.host ([50.6.227.113]:56484)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wi6Z7-000000003Rd-2Nz0

for sales@nk.ca;

Fri, 10 Jul 2026 02:26:41 -0600

Received: from [180.93.250.238] (port=56772)

by server.crossover.host with essmtpa (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.99.4)

(envelope-from )

id 1wi6YM-0000000DqJX-3gBQ

for sales@nk.ca;

Fri, 10 Jul 2026 04:25:44 -0400

From: "=?UTF-8?B?TWV0YU1hc2s=?="

To: sales@nk.ca

Subject: =?UTF-8?B?WW91ciBNZXRhTWFzayB3YWxsZXQgd2lsbCBiZSBzdXNwZW5kZWQ=?=

Date: 9 Jul 2026 19:23:53 -0600

Message-ID: <20260709192353.16F3C70C261C35F7@famepods.com>

MIME-Version: 1.0

Content-Type: text/html;

charset="iso-8859-1"

Content-Transfer-Encoding: quoted-printable

X-AntiAbuse: This header was added to track abuse, please include it with any abuse report

X-AntiAbuse: Primary Hostname - server.crossover.host

X-AntiAbuse: Original Domain - nk.ca

X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12]

X-AntiAbuse: Sender Address Domain - famepods.com

X-Get-Message-Sender-Via: server.crossover.host: authenticated_id: no-reply@hotelsupa.com.np

X-Authenticated-Sender: server.crossover.host: no-reply@hotelsupa.com.np

X-Source:

X-Source-Args:

X-Source-Dir:

X-Spam_score: 9.5

X-Spam_score_int: 95

X-Spam_bar: +++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Important Notice Dear Customer,



Content analysis details: (9.5 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[50.6.227.113 listed in dnsbl.ahbl.org]

[50.6.227.113 listed in dnsbl.ahbl.org]

[50.6.227.113 listed in dnsbl.ahbl.org]

[50.6.227.113 listed in dnsbl.ahbl.org]

[180.93.250.238 listed in dnsbl.ahbl.org]

[180.93.250.238 listed in dnsbl.ahbl.org]

[180.93.250.238 listed in dnsbl.ahbl.org]

[180.93.250.238 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[50.6.227.113 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[50.6.227.113 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[50.6.227.113 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[50.6.227.113 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[180.93.250.238 listed in will-spam-for-food.eu.org]

[180.93.250.238 listed in will-spam-for-food.eu.org]

[180.93.250.238 listed in will-spam-for-food.eu.org]

[180.93.250.238 listed in will-spam-for-food.eu.org]

[180.93.250.238 listed in will-spam-for-food.eu.org]

[180.93.250.238 listed in will-spam-for-food.eu.org]

[180.93.250.238 listed in will-spam-for-food.eu.org]

[180.93.250.238 listed in will-spam-for-food.eu.org]

[50.6.227.113 listed in will-spam-for-food.eu.org]

[50.6.227.113 listed in will-spam-for-food.eu.org]

[50.6.227.113 listed in will-spam-for-food.eu.org]

[50.6.227.113 listed in will-spam-for-food.eu.org]

[50.6.227.113 listed in will-spam-for-food.eu.org]

[50.6.227.113 listed in will-spam-for-food.eu.org]

[50.6.227.113 listed in will-spam-for-food.eu.org]

[50.6.227.113 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_SBL_XBL RBL: Received via a relay in Spamhaus SBL+XBL

[180.93.250.238 listed in sbl-xbl.spamhaus.org]

1.5 RCVD_IN_CBL RBL: Received via a relay in cbl.abuseat.org

[Listed by XBL, see ]

1.6 RCVD_IN_BRBL_LASTEXT RBL: No description available.

[50.6.227.113 listed in bb.barracudacentral.org]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[50.6.227.113 listed in bl.score.senderscore.com]

1.0 SPF_SOFTFAIL SPF: sender does not match SPF record (softfail)

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

1.1 DATE_IN_PAST_06_12 Date: is 6 to 12 hours before Received: date

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 SARE_FROM_SPAM_WORD4 From address suggests this may be spam

0.1 FROM_EXCESS_BASE64 From: base64 encoded unnecessarily

Subject: {SPAM?} =?UTF-8?B?WW91ciBNZXRhTWFzayB3YWxsZXQgd2lsbCBiZSBzdXNwZW5kZWQ=?=














=3D1.0">

Important Notice