OpenAI Phish from nxcli

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Fri, 24 Jul 2026 00:10:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wn96b-00000000B8O-1S3P

for dave@doctor.nl2k.ab.ca;

Fri, 24 Jul 2026 00:09:57 -0600

Resent-From: The Doctor

Resent-Date: Fri, 24 Jul 2026 00:09:57 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from [8.29.155.178] (port=35124 helo=cloudhost-1920808.us-midwest-1.nxcli.net)

by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256

(Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wn73I-00000000NSn-1ai7

for doctor@nl2k.ab.ca;

Thu, 23 Jul 2026 21:58:31 -0600

Comment: DomainKeys? See http://domainkeys.sourceforge.net/

DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws;

s=default; d=8f7ff93830.nxcli.io;

b=ioCJrSN9argsryvmq3FHeZsTdsNF8E5e9r0bajoBbDLP0rFJ7X10e7lABEN2y47qgPxZicBOc+9fzauzIlfPGmyRtx2KvdK4Z7LwxAE6wpD4Up2924n5LTduKyDs0Bm3MIQbtWcSSoA4s1i0dDlngi8O0VTJJf925GzVdd5Jj/kmzAtAjuXsdilraQIZL3213wYdvFEWPNQyLmGUNm2PMwUA0KEWagC/qsKAUtuSGqOYfW8SWpviU6BqLqZV1u+ynZEQL8vMhopv6wPPJzbzTA69Ovhueh+3yDv+cNeuZXhzxztIg3U7RwfTgEJYWzaedq5icemKuR4mqH3lv8USdw==;

h=Received:Date:Message-ID:To:Subject:X-PHP-Originating-Script:MIME-Version:Content-type:From:Reply-To;

DKIM-Signature: v=1; a=rsa-sha1; c=relaxed; d=8f7ff93830.nxcli.io; h=

date:message-id:to:subject:mime-version:content-type:from

:reply-to; s=default; bh=T5p1jW4K2aRE7vn0V5xSzH34Wc8=; b=hj3NWJ3

iOCVblcadZtGIT0Udh3iO5ZXO1GbfJVWRBaeayaVwJylscmzzIfDzpEQMbdUav/n

yBOlwNepR4Y+Z2rlGMuCzpZB1SWVbx9LOXqJ7y8tnDBgCsRYwIaXknwkGJ+OO82h

ot0xFT0IVAnto9zZsoAYPRjmINVMIBwmu25bfCheZ481oSKYBorvvEloFgV5N+fy

FhL+EsouaJvaNS/9LaM4eiar8RoccGSKnppiq0Ao56SPPg+2xfUsd53leeYGTsYf

NEI29SWhUG9NobUl3APt/ipJzDpQToiPSQWtvrFrAFkD7sAsinY+7PqIT3eciN4x

CHsC0lQY/Az3WNA==

Received: (qmail 7217 invoked by uid 10252); 24 Jul 2026 03:55:26 +0000

Date: 24 Jul 2026 03:55:26 +0000

Message-ID: <20260724035526.7209.qmail@cloudhost-1920808.us-midwest-1.nxcli.net>

To: doctor@nl2k.ab.ca

Subject: Action Required: Please update your payment details

X-PHP-Originating-Script: 10252:info.php

MIME-Version: 1.0

Content-type: text/html; charset=UTF-8

From: ChatGPT

Reply-To: support@8f7ff93830.nxcli.io















ChatGPT Subscription Update









































OpenAI
Subscription Payment Declined


Hello,





We attempted to process your subscription payment for ChatGPT, but unfortunately, the payment was declined.





This may be due to an issue with your payment method. To continue enjoying uninterrupted access to ChatGPT Plus, please update your payment information.



































ChatGPT Plus Subscription $20.00
VAT (19%) $3.80
Total Due Today $23.80




*By subscribing, you agree to OpenAI's Terms of Use. You will be charged $23.80 monthly until you cancel.














Update Payment Details




If you have any questions or need help, feel free to contact our support team.


OpenAI Support





You received this because you requested a subscription update.





Help Center | Privacy Policy






Intelcom Phish

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Fri, 24 Jul 2026 00:09:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wn95g-00000000B2g-3bjF

for dave@doctor.nl2k.ab.ca;

Fri, 24 Jul 2026 00:09:00 -0600

Resent-From: The Doctor

Resent-Date: Fri, 24 Jul 2026 00:09:00 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from [89.252.152.6] (port=51351 helo=srv.nacarmedya.com)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wn54Q-00000000BJ1-0pui

for sales@nk.ca;

Thu, 23 Jul 2026 19:51:39 -0600

Received: from 127.0.0.1 (unknown [196.119.23.177])

by srv.nacarmedya.com (Postfix) with ESMTPSA id 4A265FCC69

for ; Fri, 24 Jul 2026 04:50:32 +0300 (+03)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=turkishtextilefair.com; s=default; t=1784857833;

bh=Qha4otnuk8+m1R+ii7jQpfGe+Vru4MB9i07aE7ZXnUk=; h=To:From:Subject;

b=LEeAnsinnQK9KEViwOJKfqJfnZbPMDfbYveCukBmZDvxs7zKBNEyNKCLyU9S3J2lN

4pjFolIRlMDh1U6PqrlAGYdJGGRf1b3CabrNWxK4NDwCHF3/5u0BN5EUrehSuzjf+r

SmmD3MEj2UnWAVhCre4YO6iiYri3PRuVOAZRFXS0Kj0p6vW2UI/FpFmAzwfDyQUXZz

2YodjlmrfNEzXKyjPvl0P+RKtW5N4AcG53JVLIb1sYNZo5AWh90EN+ZEIxzqGcI/0V

tcmjERBfzqEkEWW7PhLJ7APfFznEYwWBfnN8A4Ue0glnsvlIfHLuSV6knxwmXn/sJm

DAPNy/19a69bQ==

Authentication-Results: srv.nacarmedya.com;

spf=pass (sender IP is 196.119.23.177) smtp.mailfrom=info@turkishtextilefair.com smtp.helo=127.0.0.1

Received-SPF: pass (srv.nacarmedya.com: connection is authenticated)

Date: Fri, 24 Jul 2026 03:47:55 +0200

To: sales@nk.ca

From: Intelcom

Subject: Intelcom Delivery Notification

Message-ID: <0535efe555f8aa3097b3437cbefbb1c6@turkishtextilefair.com>

MIME-Version: 1.0

Content-Type: multipart/alternative;

boundary="17c1fd1e81497652a6b439b10c6a23df8"

Content-Transfer-Encoding: 8bit



This is a multi-part message in MIME format.



--17c1fd1e81497652a6b439b10c6a23df8

Content-Type: text/plain; charset=UTF-8

Content-Transfer-Encoding: 8bit

















Intelcom



Dear Customer,





Goods imported into Canada may be subject to applicable duties and/or taxes. Carriers are authorized by the CBSA (Canada Border Services Agency) to process occasional shipments on behalf of the importer or owner and may remit applicable duties and taxes.

However, a parcel belonging to you has been held by customs due to missing declaration details from the sender. Please pay 2.96 CAD in duties and taxes as soon as possible using the button below:



Schedule my delivery



Thank you for choosing Intelcom.









This email was sent by an automated system. Please do not reply.

© 2026 Intelcom Express - Dragonfly Express. All rights reserved.





--17c1fd1e81497652a6b439b10c6a23df8

Content-Type: text/html; charset=UTF-8

Content-Transfer-Encoding: 8bit

































Intelcom
Dear Customer,


Goods imported into Canada may be subject to applicable duties and/or taxes. Carriers are authorized by the CBSA (Canada Border Services Agency) to process occasional shipments on behalf of the importer or owner and may remit applicable duties and taxes.



However, a parcel belonging to you has been held by customs due to missing declaration details from the sender. Please pay 2.96 CAD in duties and taxes as soon as possible using the button below:

Schedule my delivery
Thank you for choosing Intelcom.










This email was sent by an automated system. Please do not reply.



© 2026 Intelcom Express - Dragonfly Express. All rights reserved.









--17c1fd1e81497652a6b439b10c6a23df8--



Chinese products spam

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 23 Jul 2026 17:00:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wn2O1-00000000H4a-1pxf

for dave@doctor.nl2k.ab.ca;

Thu, 23 Jul 2026 16:59:29 -0600

Resent-From: The Doctor

Resent-Date: Thu, 23 Jul 2026 16:59:29 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from [210.79.60.70] (port=51618 helo=mail-m6070.netease.com)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wn2FK-00000000FXl-3g6q

for sales@nk.ca;

Thu, 23 Jul 2026 16:50:45 -0600

Content-Type: multipart/alternative; BOUNDARY="=_Part_146544_1970923275.1784846970996"

To: sales

Reply-To: sales23@abiscircuits.com

Subject: =?UTF-8?B?LlJlbGlhYmxlIFBDQkEgZm9yICB5b3VyIHByb2R1Y3QgUENCQSBTYWxlcw==?=

X-Priority: 3

MIME-Version: 1.0

Received: from diana@abiscircuits.cn( [10.139.4.160] ) by ajax-webmail ( [127.0.0.1] ) ; Fri, 24 Jul 2026 06:49:30 +0800 (GMT+08:00)

From: Diana

Date: Fri, 24 Jul 2026 06:49:30 +0800 (GMT+08:00)

X-WM-Tid: 0a9f912b70660696kunmbcdc05dd2f7fe

DKIM-Signature: a=rsa-sha256;

b=Ixr+2wRW+mjCLDmvQjnD+akK/bX1jxqF8Wbw1uqIXEQp2c0kjbR1qxqoJUy2/aD2BzlmfWW+cNvoNu4UFuAa14HLFDp63xhX5vGqFy7s5bgeuXajYu1JyaS3/Gt9y5pK+A23tol+xFe8+n78xr0h3TRJiXY6kNMNBptq4WtfHIg=; c=relaxed/relaxed; s=default; d=abisassembly.net; v=1;

bh=Z40VWDhn3V0cgQ5v/tXgZpi0mG98wd1LdsZHDJ4t8GA=;

h=date:mime-version:subject:message-id:from;

Message-ID:

X-Spam_score: 7.7

X-Spam_score_int: 77

X-Spam_bar: +++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Hi , Hoping you're doing well .This Diana from Abis circuits

the professional PCBA OEM . What this means for you is simply one more qualified

choice when you source PCBAs. A few facts about Abis that may help you decide

when the next RFQ lands:



Content analysis details: (7.7 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[210.79.60.70 listed in dnsbl.ahbl.org]

[210.79.60.70 listed in dnsbl.ahbl.org]

[210.79.60.70 listed in dnsbl.ahbl.org]

[210.79.60.70 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[210.79.60.70 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[210.79.60.70 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[210.79.60.70 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[210.79.60.70 listed in dnsbl.ahbl.org]

0.6 URIBL_SBL Contains an URL's NS IP listed in the SBL blocklist

[URI: ns14.xincache.com/112.80.181.111]

[URI: ns13.xincache.com/112.80.181.45]

-0.0 SPF_PASS SPF: sender matches SPF record

0.4 SALES_REPLY Your parents named you sales?

1.3 URI_HEX URI: URI hostname has long hexadecimal sequence

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_IMAGE_RATIO_06 BODY: HTML has a low ratio of text to image area

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

1.3 RDNS_NONE Delivered to internal network by a host with no rDNS

0.0 T_REMOTE_IMAGE Message contains an external image

Subject: {SPAM?} =?UTF-8?B?LlJlbGlhYmxlIFBDQkEgZm9yICB5b3VyIHByb2R1Y3QgUENCQSBTYWxlcw==?=



--=_Part_146544_1970923275.1784846970996

Content-Type: text/plain; charset="UTF-8"

Content-Transfer-Encoding: base64



SGkgLAogCkhvcGluZyB5b3UncmUgZG9pbmcgd2VsbCAuVGhpcyBEaWFuYSBmcm9tIEFiaXMgY2ly

Y3VpdHMgdGhlIHByb2Zlc3Npb25hbCBQQ0JBIE9FTSAuCiAKV2hhdCB0aGlzIG1lYW5zIGZvciB5

b3UgaXMgc2ltcGx5IG9uZSBtb3JlIHF1YWxpZmllZCBjaG9pY2Ugd2hlbiB5b3Ugc291cmNlIFBD

QkFzLiBBIGZldyBmYWN0cyBhYm91dCBBYmlzIHRoYXQgbWF5IGhlbHAgeW91IGRlY2lkZSB3aGVu

IHRoZSBuZXh0IFJGUSBsYW5kczoKIAotIDE0IFNNVCBsaW5lIHRvIG1lZXQgdGhlIGxlYWQgdGlt

ZSByZXF1aXJtZW50IG9mIG91ciBjdXN0b21lciAuCi0gUHJvZmVzc2lvbmFsIGVuZ2luZWVyIGFu

ZCBwdXJjaGFzaW5nIHRlYW0gY2FuIHJlcGxhY2UgdGhlIGNvbXBvZW5lbnQgd2l0aCAxMDAlIGFs

dGVybmF0aXZlIGFuZCBzYXZlIHRoZSBjb3N0IGZvciB5b3UgLgotIEluLWhvdXNlIGNvbmZvcm1h

bCBjb2F0aW5nLCBmdW5jdGlvbmFsIHRlc3QsIGFuZCBib3gtYnVpbGQKLSBEaXJlY3QgZnJhbmNo

aXNlZCBjaGFubmVscyBmb3IgVEksIEFESSwgTXVyYXRhLCBhbmQgb3RoZXJzCiAKSGVyZSBpcyB0

aGUgQWJpcyBjb21wYW55IHByZXNlbnRhdGlvbiBmb3IgeW91ciByZWZlcmVuY2UgLgogClRoYW5r

IHlvdSBmb3IgdGhlIHRydXN0IHlvdeKAmXZlIHBsYWNlZCBpbiBtZSBvdmVyIHRoZSB5ZWFyc+KA

lEnigJltIGVhZ2VyIHRvIGtlZXAgZWFybmluZyBpdC4KIAogCiAKCgoKRGlhbmEgRGFpClByb2pl

Y3QgUmVwcmVzZW50YXRpdmUgfCBBQklTIENpcmN1aXRzIENvLiwgTHRkCiAKUmlnaWQgUENCLCBG

bGV4IFBDQiwgUmlnaWQtRmxleCAxfjMyIExheWVyIFBDQiwgTWV0YWwgUENCLCBIREkgUENCLCBQ

Q0JBCk1vYmlsZSAvIFdoYXRzYXBwIC8gV2VjaGF0OiArODYgMTM1MTA3NTQ3NTMKRW1haWw6IHNh

bGVzMjNAYWJpc2NpcmN1aXRzLmNvbSAvIGRpYW5hQGFiaXNjaXJjdWl0cy5jbgpXZWJzaXRlOiBh

YmlzY2lyY3VpdHMuY29tCgogICAgCgoK

--=_Part_146544_1970923275.1784846970996

Content-Type: text/html; charset="UTF-8"

Content-Transfer-Encoding: base64



Hi ,







Hoping you're doing well .This Diana from Abis circuits the professional PCBA OEM .







What this means for you is simply one more qualified choice when you source PCBAs. A few facts about Abis that may help you decide when the next RFQ lands:







- 14 SMT line to meet the lead time requirment of our customer .



- Professional engineer and purchasing team can replace the compoenent with 100% alternative and save the cost for you .



- In-house conformal coating, functional test, and box-build



- Direct franchised channels for TI, ADI, Murata, and others







Here is the Abis company presentation for your reference .







Thank you for the trust you’ve placed in me over the years—I’m eager to keep earning it.









Diana Dai

Project Representative | ABIS Circuits Co., Ltd



Rigid PCB, Flex PCB, Rigid-Flex 1~32 Layer PCB, Metal PCB, HDI PCB, PCBA

Mobile / Whatsapp / Wechat: +86 13510754753

Email: sales23@abiscircuits.com / diana@abiscircuits.cn

Website: abiscircuits.com







Remittance phish from Google Gmail

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 23 Jul 2026 16:34:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wn1ya-000000002E0-1cXm

for dave@doctor.nl2k.ab.ca;

Thu, 23 Jul 2026 16:33:12 -0600

Resent-From: The Doctor

Resent-Date: Thu, 23 Jul 2026 16:33:12 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-oa1-f101.google.com ([209.85.160.101]:44102)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wn1gy-00000000BHt-2iDD

for doctor@mail.nl2k.ab.ca;

Thu, 23 Jul 2026 16:15:08 -0600

Received: by mail-oa1-f101.google.com with SMTP id 586e51a60fabf-44cb057311bso405782fac.0

for ; Thu, 23 Jul 2026 15:14:13 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=sabeng.it; s=google; t=1784844847; x=1785449647; darn=mail.nl2k.ab.ca;

h=content-type:mime-version:date:content-transfer-encoding:message-id

:subject:to:from:from:to:cc:subject:date:message-id:reply-to

:content-type;

bh=2Qd++MhFVn/+JzWjUONsUGSuFncRBpZ1V7WcMOzblGY=;

b=ODdc/RMoHdFInbVC7Mi3Q6apajWjPx/gJQbcmd960yKolcTiitx8jjnue6STzIQigS

hSwTYFsk8bhPNX+iJ1IAc6dwKSO9OLAVjTCF37130yXsryi5zr3TNFNJHtwMVSXhADnP

6Tb7nEj6F53FhbrjEFFSmRXJj06V2fF0YLL4E=

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20251104; t=1784844847; x=1785449647;

h=content-type:mime-version:date:content-transfer-encoding:message-id

:subject:to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date

:message-id:reply-to:content-type;

bh=2Qd++MhFVn/+JzWjUONsUGSuFncRBpZ1V7WcMOzblGY=;

b=XvjnEE250Fd8QuuH++5qXnAuC7CMDmi45HDbhNy/YxKbuFirPbTcfFat4H6h14b/VQ

2hX8qkKH4rvzKLaltX0Xcp2gJISFE1jI+snHzrlbRCgGJhglG+C0C4576mHx28MtVeLE

6Elp1Nw8Hgidw4Hd/ixAJA7xBpmZbtS8PTg4iglgYHQ+5VeDf4lt9oad0RHspVQoomYR

UMBaL4TsNSrm3DQ1DL4+eqJJynQIZKCNJm1oK5L9OvgE7pqVGdcMXHhFbYNmYhRP3kMM

p8P27bhLGksCNCzfLN3xljP6tKYCa3YBzi3E9Eszfhx9R91nYeAAglb+bYR6SBBVk7Xq

Kifw==

X-Gm-Message-State: AOJu0YzVZK5Z+D9oCQMvx26gdS8vGgTh6e/9lOM6uJQEi4DbzpEnrIuD

om5iFk6VsRc+LAilM4MP0PwMD2gpFFyLqM0HKsKOWbkoQnTMRpsQU2zt01Hg6QrsIszYKve1Qqw

VPI1w1tyu3XNKuRpGyZOL8tHNvNfCyJi1xivWkWiMTVc+geU=

X-Gm-Gg: AR+sD12OqfLOr93p8lOq7OLA5Q1ljX2I4Mi50i6AyFBp0q2hxXTJ8B+PRBZPYsf69Uh

fT0RS9y10raKMK+1V3yoW15Doo8pQ6Gl66weQZCI1cLzVZ1UhDBgUfXRX4zf2PKGDRLAXGds+I6

WhGT47ztMNN+CucgrBvuvEYVa1SvsiUXzn4lT5Ti+8+ZDlJNKxGhiY80hyQ4K5y4fyUU/QFtZeo

A/d7vKDITcYweiUHIIhmPx9F5/pkVachjl/vsJSzHXI20jmFNU0g9P4YNfcZIYro514HvuAHWLx

BmMvfpOLR43NnL9gFeyscP5D1U4yXTT5nXzvwBlHPzJt4A7EIOEbDm2eWo0eiLm5ENE7Grejrzz

Q4iVRy/TxqmM=

X-Received: by 2002:a05:6870:3196:b0:457:8533:a16f with SMTP id 586e51a60fabf-457a10a7e5dmr2681197fac.32.1784844847392;

Thu, 23 Jul 2026 15:14:07 -0700 (PDT)

Received: from sabprogetti.com ([192.210.236.148])

by smtp-relay.gmail.com with ESMTPS id 586e51a60fabf-45766e2846dsm361125fac.2.2026.07.23.15.14.07

for

(version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256);

Thu, 23 Jul 2026 15:14:07 -0700 (PDT)

X-Relaying-Domain: sabeng.it

From: "Payroll@remittance.com|Schedule| Sign_Online/OU=EXCHANGE

ADMINISTRATIVE GROUP

(FYDIBOHF23SPDLT)/CN=RECIPIENTS/CN=B7A707497B564FD-07320"



To: doctor@mail.nl2k.ab.ca

Subject: =?UTF-8?Q?ACH_Funds_Transfer_Notification_?=

=?UTF-8?Q?=EF=BF=BD_July_12=2C_2026_=EF=BF=BD_07/2?=

=?UTF-8?Q?3/2026_=EF=BF=BD_doctor=40mail=2Enl2k=2E?= =?UTF-8?Q?ab=2Eca?=

Message-ID: <3c5c7e77-d3ad-c6cf-320c-426d764b1b77@sabeng.it>

Content-Transfer-Encoding: quoted-printable

Date: Thu, 23 Jul 2026 22:14:05 +0000

MIME-Version: 1.0

Content-Type: text/html; charset=utf-8

X-Spam_score: 6.5

X-Spam_score_int: 65

X-Spam_bar: ++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview:  Payment Due: 23/07/2026 033847 Amount Paid: $2,355.00



Content analysis details: (6.5 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[192.210.236.148 listed in dnsbl.ahbl.org]

[192.210.236.148 listed in dnsbl.ahbl.org]

[192.210.236.148 listed in dnsbl.ahbl.org]

[192.210.236.148 listed in dnsbl.ahbl.org]

[209.85.160.101 listed in dnsbl.ahbl.org]

[209.85.160.101 listed in dnsbl.ahbl.org]

[209.85.160.101 listed in dnsbl.ahbl.org]

[209.85.160.101 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[192.210.236.148 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[192.210.236.148 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[192.210.236.148 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[192.210.236.148 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[192.210.236.148 listed in will-spam-for-food.eu.org]

[192.210.236.148 listed in will-spam-for-food.eu.org]

[192.210.236.148 listed in will-spam-for-food.eu.org]

[192.210.236.148 listed in will-spam-for-food.eu.org]

[192.210.236.148 listed in will-spam-for-food.eu.org]

[192.210.236.148 listed in will-spam-for-food.eu.org]

[192.210.236.148 listed in will-spam-for-food.eu.org]

[192.210.236.148 listed in will-spam-for-food.eu.org]

[209.85.160.101 listed in will-spam-for-food.eu.org]

[209.85.160.101 listed in will-spam-for-food.eu.org]

[209.85.160.101 listed in will-spam-for-food.eu.org]

[209.85.160.101 listed in will-spam-for-food.eu.org]

[209.85.160.101 listed in will-spam-for-food.eu.org]

[209.85.160.101 listed in will-spam-for-food.eu.org]

[209.85.160.101 listed in will-spam-for-food.eu.org]

[209.85.160.101 listed in will-spam-for-food.eu.org]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

1.2 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a relay in bl.spamcop.net

[Blocked - see ]

-0.0 SPF_PASS SPF: sender matches SPF record

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[209.85.160.101 listed in list.dnswl.org]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[209.85.160.101 listed in bl.score.senderscore.com]

-0.0 RCVD_IN_MSPIKE_H3 RBL: Good reputation (+3)

[209.85.160.101 listed in wl.mailspike.net]

0.0 HTML_MESSAGE BODY: HTML included in message

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

-0.0 RCVD_IN_MSPIKE_WL Mailspike good senders

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

0.0 NO_RDNS2 Sending MTA has no reverse DNS

0.6 HTML_MIME_NO_HTML_TAG HTML-only message, but there is no HTML tag

2.0 RATWR8_MESSID Message-ID with excessive dashes and dollars

0.0 LOTS_OF_MONEY Huge... sums of money

Subject: {SPAM?} =?UTF-8?Q?ACH_Funds_Transfer_Notification_?=

=?UTF-8?Q?=EF=BF=BD_July_12=2C_2026_=EF=BF=BD_07/2?=

=?UTF-8?Q?3/2026_=EF=BF=BD_doctor=40mail=2Enl2k=2E?= =?UTF-8?Q?ab=2Eca?=



=EF=BB=BF


 




, 255, 255);color:rgb(34, 34, 34);font-family:Arial, Helvetica, =

sans-serif;font-size:small;font-style:normal;font-variant-caps:normal;font-=

variant-ligatures:normal;font-weight:400;letter-spacing:normal;orphans:2;te=

xt-align:start;text-decoration-color:initial;text-decoration-style:initial;=

text-decoration-thickness:initial;text-indent:0px;text-transform:none;white=

-space:normal;widows:2;word-spacing:0px;" type=3D"cite">




t;" id=3D"m_-2910760642012011069m_467061415371348611m_4273285105508718137m_=

-599886662404354667editbody1">


7061415371348611m_4273285105508718137m_-599886662404354667v1editbody1">


m_467061415371348611m_4273285105508718137m_-599886662404354667v1v1editbody1=

">






-width:0px;font-family:Arial, Helvetica, sans-serif;font-feature-settings:&=

quot;liga" 0;font-size:small;line-height:normal;" cellspacing=3D"0" =

width=3D"553">




























10, 139, 168);border-width:0px;margin:0px;padding:0in;vertical-align:top;" =

colspan=3D"3">




style=3D"border-collapse:collapse;border-width:0px;font-family:-apple-syste=

m, BlinkMacSystemFont, "Helvetica Neue", "Segoe UI", =

Arial, sans-serif, "Apple Color Emoji", "Segoe UI =

Emoji", "Segoe UI Symbol";font-feature-settings:"liga&q=

uot; 0;font-size:13px;line-height:normal;" cellspacing=3D"0">




style=3D"height:5.25pt;">














style=3D"border-width:0px;height:5.25pt;margin:0px;padding:0in;"> 
>


style=3D"border-width:0px;margin:0px;padding:0in;width:0.25in;" =

width=3D"24"> 
style=3D"border-width:0px;margin:0px;padding:0in;">


style=3D"font-family:-apple-system, BlinkMacSystemFont, "Helvetica =

Neue", "Segoe UI", Arial, sans-serif, "Apple Color =

Emoji", "Segoe UI Emoji", "Segoe UI =

Symbol";margin:0px;">
sans-serif;font-size:13.5pt;">   





92, 208, 228);border-width:0px;margin:0px;padding:0in;width:1.5pt;" =

width=3D"2"> 
n:0px;padding:0in;">




style=3D"border-collapse:collapse;border-width:0px;font-family:-apple-syste=

m, BlinkMacSystemFont, "Helvetica Neue", "Segoe UI", =

Arial, sans-serif, "Apple Color Emoji", "Segoe UI =

Emoji", "Segoe UI Symbol";font-feature-settings:"liga&q=

uot; 0;font-size:13px;line-height:normal;" cellspacing=3D"0">












style=3D"background-color:rgb(230, 236, 244);border-width:0px;margin:0px;pa=

dding:0in;width:411.75pt;" width=3D"549">


class=3D"table" style=3D"width:411.75pt;">


style=3D"border-collapse:collapse;border-width:0px;font-family:-apple-syste=

m, BlinkMacSystemFont, "Helvetica Neue", "Segoe UI", =

Arial, sans-serif, "Apple Color Emoji", "Segoe UI =

Emoji", "Segoe UI Symbol";font-feature-settings:"liga&q=

uot; 0;line-height:normal;" cellspacing=3D"0" width=3D"549">

=



=



=



=



=



=



=



=



=



=



=



=



=



=



=


width=3D"24"> 
p;">

=


"Helvetica Neue", "Segoe UI", Arial, sans-serif, =

"Apple Color Emoji", "Segoe UI Emoji", "Segoe UI =

Symbol";margin:0px;">

64);font-family:Helvetica, sans-serif;font-size:13.5pt;">Payment&nb=

sp;   
style=3D"color:rgb(231,123,7);font-family:Helvetica, sans-serif;font-size:7=

.5pt;">Due: 23/07/2026

168);font-family:Helvetica, sans-serif;font-size:10.=

5pt;">033847



=
ttom;">

=


"Helvetica Neue", "Segoe UI", Arial, sans-serif, =

"Apple Color Emoji", "Segoe UI Emoji", "Segoe UI =

Symbol";margin:0px;text-align:right;">
62);font-family:Helvetica, sans-serif;font-size:10.5pt;">Amount =

Paid:  
62);font-family:Helvetica, sans-serif;font-size:22.5pt;">$2,355.=

00



=
width=3D"24"> 
=

 		 =

 		 =

 		 =

 









system, BlinkMacSystemFont, "Helvetica Neue", "Segoe =

UI", Arial, sans-serif, "Apple Color Emoji", "Segoe UI =

Emoji", "Segoe UI Symbol";margin:0px;"> 




style=3D"width:411.75pt;">


style=3D"border-collapse:collapse;border-width:0px;font-family:-apple-syste=

m, BlinkMacSystemFont, "Helvetica Neue", "Segoe UI", =

Arial, sans-serif, "Apple Color Emoji", "Segoe UI =

Emoji", "Segoe UI Symbol";font-feature-settings:"liga&q=

uot; 0;font-size:13px;line-height:normal;" cellspacing=3D"0" =

width=3D"549">












style=3D"border-width:0px;margin:0px;padding:0in;vertical-align:top;">


class=3D"table" style=3D"width:411.75pt;">


style=3D"border-bottom-style:solid;border-bottom-width:3pt;border-collapse:=

collapse;border-color:initial;border-left-style:none;border-left-width:medi=

um;border-right-style:none;border-right-width:medium;border-top-style:none;=

border-top-width:medium;font-family:-apple-system, BlinkMacSystemFont, =

"Helvetica Neue", "Segoe UI", Arial, sans-serif, =

"Apple Color Emoji", "Segoe UI Emoji", "Segoe UI =

Symbol";font-feature-settings:"liga" 0;line-height:normal;" =

cellspacing=3D"0" width=3D"549">

=



=



=



=



=



=



=



=


"Helvetica Neue", "Segoe UI", Arial, sans-serif, =

"Apple Color Emoji", "Segoe UI Emoji", "Segoe UI =

Symbol";line-height:12pt;margin:0px;">
tica, sans-serif;font-size:10.5pt;">Hello 
style=3D"font-family:Arial, Helvetica, sans-serif;font-size:small;">Dear =

Customer,
sans-serif;font-size:10.5pt;">,



=


"Helvetica Neue", "Segoe UI", Arial, sans-serif, =

"Apple Color Emoji", "Segoe UI Emoji", "Segoe UI =

Symbol";line-height:12pt;margin:0px;"> 



=


"Helvetica Neue", "Segoe UI", Arial, sans-serif, =

"Apple Color Emoji", "Segoe UI Emoji", "Segoe UI =

Symbol";line-height:12pt;margin:0px;">
tica, sans-serif;font-size:10.5pt;">Payment has been remitted into your =

account with receipt for your reference.



=


"Helvetica Neue", "Segoe UI", Arial, sans-serif, =

"Apple Color Emoji", "Segoe UI Emoji", "Segoe UI =

Symbol";line-height:12pt;margin:0px;"> 



=


"Helvetica Neue", "Segoe UI", Arial, sans-serif, =

"Apple Color Emoji", "Segoe UI Emoji", "Segoe UI =

Symbol";line-height:12pt;margin:0px;">
(110, 139, 168);border-radius:4px;color:white;display:inline-block;font-fam=

ily:Helvetica, sans-serif;font-size:10.5pt;padding:8px =

16px;text-decoration-line:none;" href=3D"https://laviestudio.com.br/r.=

php">VIEW PAYMENT RECEIPT



=


"Helvetica Neue", "Segoe UI", Arial, sans-serif, =

"Apple Color Emoji", "Segoe UI Emoji", "Segoe UI =

Symbol";line-height:12pt;margin:0px;"> 



=


"Helvetica Neue", "Segoe UI", Arial, sans-serif, =

"Apple Color Emoji", "Segoe UI Emoji", "Segoe UI =

Symbol";line-height:12pt;margin:0px;">
tica, sans-serif;font-size:10.5pt;">Thank you for your business.=



Sincerely,

Finance Department



=



=





class=3D"table">


style=3D"border-collapse:collapse;border-width:0px;font-family:-apple-syste=

m, BlinkMacSystemFont, "Helvetica Neue", "Segoe UI", =

Arial, sans-serif, "Apple Color Emoji", "Segoe UI =

Emoji", "Segoe UI Symbol";font-feature-settings:"liga&q=

uot; 0;line-height:normal;" cellspacing=3D"0">

=



=



=



=



=



=

=

 









92, 208, 228);border-width:0px;margin:0px;padding:0in;width:1.5pt;" =

width=3D"2"> 

1, 50, 70);border-width:0px;margin:0px;padding:0in;" colspan=3D"3">


system, BlinkMacSystemFont, "Helvetica Neue", "Segoe =

UI", Arial, sans-serif, "Apple Color Emoji", "Segoe UI =

Emoji", "Segoe UI Symbol";margin:0px;text-align:right;">&nbs=

p;
















Remittance phish from Google Gmail

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 23 Jul 2026 16:04:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wn1VQ-000000008D1-3Qt2

for dave@doctor.nl2k.ab.ca;

Thu, 23 Jul 2026 16:03:04 -0600

Resent-From: The Doctor

Resent-Date: Thu, 23 Jul 2026 16:03:04 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-yx1-f104.google.com ([74.125.224.104]:48612)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wmzf0-000000008eV-0LxD

for games@nl2k.ab.ca;

Thu, 23 Jul 2026 14:04:59 -0600

Received: by mail-yx1-f104.google.com with SMTP id 956f58d0204a3-667f1390f58so862173d50.1

for ; Thu, 23 Jul 2026 13:04:03 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=sabeng.it; s=google; t=1784837037; x=1785441837; darn=nl2k.ab.ca;

h=content-type:mime-version:date:content-transfer-encoding:message-id

:subject:to:from:from:to:cc:subject:date:message-id:reply-to

:content-type;

bh=2Qd++MhFVn/+JzWjUONsUGSuFncRBpZ1V7WcMOzblGY=;

b=SvcdQEaDdqA6fU2J2nBGCYfqsMRsBVcTrhgRPOiZw9N8J3wr9ynmKXhhr3cemWbWN2

zstM2tVQV6vq28+tn2NGdoCE8tGK7kLMr1ljX3xYkTzq+qtbCAd57L4KsqgNrZI1yKPL

SnCNcNiCcbjRxHpIais0JpUP17HzG0OzAMlxg=

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20251104; t=1784837037; x=1785441837;

h=content-type:mime-version:date:content-transfer-encoding:message-id

:subject:to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date

:message-id:reply-to:content-type;

bh=2Qd++MhFVn/+JzWjUONsUGSuFncRBpZ1V7WcMOzblGY=;

b=WfegUVDxNaLR7nX2PtFTDLgB4/7rb+T5goGvNraQRURFARqqwcZ9BWO1dYlRHxjGPB

d0iNUxknjch2ey51P9U1IeUofi4KoEQu8PN53M7ma4oru1Z5sabrILmag/Uwh1s0OCrx

eX0xJMFYz4n1+Q8lJTXjPRF7ZlbFifFBlzfnZ+Jao234axXKutkNR9seJu2YVODSfqxZ

6kd54zJhPVpuPK2s4kkAcEesKNBgKc4lvye1zXzEhbVKl2XiHIwzEkqFlJcw/2wpx9Sy

JYPuj0s02HA7H77PyMijjEaDaN+aGngcx+xRhO95TXeWx1+k0mLXDiu8/LwfMJSwd6va

ohAA==

X-Gm-Message-State: AOJu0Yx7n5z95MXtSGmEmpCijBXKuHqINFkrgFwzwnUp365H/5xyqecW

N5lNjBybRkEhV3W/Agk2ShgO12yXd44OUBxgX+4p3GlysQpzc0kakyNEPyFhg/zX8N9ImPpf9RM

+YajOdgc8jSjKafIksqQVmoDUJkYPDzFoZ/qUgC+VP5VJ5ss=

X-Gm-Gg: AR+sD13ot7gaqcphkXOLKp/juZ7VMatxuzvGwXirkguFnQor0wiDmah1dDnjav8TbO4

U0z5NfZrpPXTK91+19oca+gMWc0SKSxsme1dCq9QgtKPeNkZdPRfzEVL5Okv2vhRyqLwOnvL3D/

9i3P/uorwY8fTPTDtnzVvs2UULdbSakffyFF+oXIJjjYVPzVrj2ytbM+GT8+Y2v35xozS4GqpC+

HmDghAjeoxYD5X0YClVGb7GcJjmG8cfknpsxg2yiCmxlglzmW70J6mcB0E4qACFgHGiUpnRMjDg

WBgxb37mMI/MZbyG3+IoGXcy/SXWbj3dPWn/i1d43Vm62+EJBfcSgGTy/iaRApes8FoIpXZd49g

OlZrvrb1dUA8=

X-Received: by 2002:a53:d305:0:b0:668:17c4:1636 with SMTP id 956f58d0204a3-668a4c2824amr903126d50.31.1784837036982;

Thu, 23 Jul 2026 13:03:56 -0700 (PDT)

Received: from sabprogetti.com ([192.210.236.148])

by smtp-relay.gmail.com with ESMTPS id 956f58d0204a3-66890527726sm409837d50.4.2026.07.23.13.03.56

for

(version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256);

Thu, 23 Jul 2026 13:03:56 -0700 (PDT)

X-Relaying-Domain: sabeng.it

From: "e-Remittance| Scheduled | Online/OU=EXCHANGE ADMINISTRATIVE GROUP

(FYDIBOHF23SPDLT)/CN=RECIPIENTS/CN=B7A707497B564FD-41477"



To: games@nl2k.ab.ca

Subject: =?UTF-8?Q?ACH_Funds_Transfer_Notification_?=

=?UTF-8?Q?=EF=BF=BD_July_12=2C_2026_=EF=BF=BD_07/2?=

=?UTF-8?Q?3/2026_=EF=BF=BD_games=40nl2k=2Eab=2Eca?=

Message-ID:

Content-Transfer-Encoding: quoted-printable

Date: Thu, 23 Jul 2026 20:03:55 +0000

MIME-Version: 1.0

Content-Type: text/html; charset=utf-8

X-Spam_score: 5.0

X-Spam_score_int: 50

X-Spam_bar: +++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview:  Payment Due: 23/07/2026 033847 Amount Paid: $2,355.00



Content analysis details: (5.0 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[192.210.236.148 listed in dnsbl.ahbl.org]

[192.210.236.148 listed in dnsbl.ahbl.org]

[192.210.236.148 listed in dnsbl.ahbl.org]

[192.210.236.148 listed in dnsbl.ahbl.org]

[74.125.224.104 listed in dnsbl.ahbl.org]

[74.125.224.104 listed in dnsbl.ahbl.org]

[74.125.224.104 listed in dnsbl.ahbl.org]

[74.125.224.104 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[192.210.236.148 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[192.210.236.148 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[192.210.236.148 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[192.210.236.148 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[192.210.236.148 listed in will-spam-for-food.eu.org]

[192.210.236.148 listed in will-spam-for-food.eu.org]

[192.210.236.148 listed in will-spam-for-food.eu.org]

[192.210.236.148 listed in will-spam-for-food.eu.org]

[192.210.236.148 listed in will-spam-for-food.eu.org]

[192.210.236.148 listed in will-spam-for-food.eu.org]

[192.210.236.148 listed in will-spam-for-food.eu.org]

[192.210.236.148 listed in will-spam-for-food.eu.org]

[74.125.224.104 listed in will-spam-for-food.eu.org]

[74.125.224.104 listed in will-spam-for-food.eu.org]

[74.125.224.104 listed in will-spam-for-food.eu.org]

[74.125.224.104 listed in will-spam-for-food.eu.org]

[74.125.224.104 listed in will-spam-for-food.eu.org]

[74.125.224.104 listed in will-spam-for-food.eu.org]

[74.125.224.104 listed in will-spam-for-food.eu.org]

[74.125.224.104 listed in will-spam-for-food.eu.org]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[74.125.224.104 listed in list.dnswl.org]

-0.0 SPF_PASS SPF: sender matches SPF record

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[74.125.224.104 listed in wl.mailspike.net]

0.0 HTML_MESSAGE BODY: HTML included in message

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 NO_RDNS2 Sending MTA has no reverse DNS

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

0.0 LOTS_OF_MONEY Huge... sums of money

2.0 RATWR8_MESSID Message-ID with excessive dashes and dollars

0.6 HTML_MIME_NO_HTML_TAG HTML-only message, but there is no HTML tag

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[74.125.224.104 listed in bl.score.senderscore.com]

Subject: {SPAM?} =?UTF-8?Q?ACH_Funds_Transfer_Notification_?=

=?UTF-8?Q?=EF=BF=BD_July_12=2C_2026_=EF=BF=BD_07/2?=

=?UTF-8?Q?3/2026_=EF=BF=BD_games=40nl2k=2Eab=2Eca?=



=EF=BB=BF


 




, 255, 255);color:rgb(34, 34, 34);font-family:Arial, Helvetica, =

sans-serif;font-size:small;font-style:normal;font-variant-caps:normal;font-=

variant-ligatures:normal;font-weight:400;letter-spacing:normal;orphans:2;te=

xt-align:start;text-decoration-color:initial;text-decoration-style:initial;=

text-decoration-thickness:initial;text-indent:0px;text-transform:none;white=

-space:normal;widows:2;word-spacing:0px;" type=3D"cite">




t;" id=3D"m_-2910760642012011069m_467061415371348611m_4273285105508718137m_=

-599886662404354667editbody1">


7061415371348611m_4273285105508718137m_-599886662404354667v1editbody1">


m_467061415371348611m_4273285105508718137m_-599886662404354667v1v1editbody1=

">






-width:0px;font-family:Arial, Helvetica, sans-serif;font-feature-settings:&=

quot;liga" 0;font-size:small;line-height:normal;" cellspacing=3D"0" =

width=3D"553">




























10, 139, 168);border-width:0px;margin:0px;padding:0in;vertical-align:top;" =

colspan=3D"3">




style=3D"border-collapse:collapse;border-width:0px;font-family:-apple-syste=

m, BlinkMacSystemFont, "Helvetica Neue", "Segoe UI", =

Arial, sans-serif, "Apple Color Emoji", "Segoe UI =

Emoji", "Segoe UI Symbol";font-feature-settings:"liga&q=

uot; 0;font-size:13px;line-height:normal;" cellspacing=3D"0">




style=3D"height:5.25pt;">














style=3D"border-width:0px;height:5.25pt;margin:0px;padding:0in;"> 
>


style=3D"border-width:0px;margin:0px;padding:0in;width:0.25in;" =

width=3D"24"> 
style=3D"border-width:0px;margin:0px;padding:0in;">


style=3D"font-family:-apple-system, BlinkMacSystemFont, "Helvetica =

Neue", "Segoe UI", Arial, sans-serif, "Apple Color =

Emoji", "Segoe UI Emoji", "Segoe UI =

Symbol";margin:0px;">
sans-serif;font-size:13.5pt;">   





92, 208, 228);border-width:0px;margin:0px;padding:0in;width:1.5pt;" =

width=3D"2"> 
n:0px;padding:0in;">




style=3D"border-collapse:collapse;border-width:0px;font-family:-apple-syste=

m, BlinkMacSystemFont, "Helvetica Neue", "Segoe UI", =

Arial, sans-serif, "Apple Color Emoji", "Segoe UI =

Emoji", "Segoe UI Symbol";font-feature-settings:"liga&q=

uot; 0;font-size:13px;line-height:normal;" cellspacing=3D"0">












style=3D"background-color:rgb(230, 236, 244);border-width:0px;margin:0px;pa=

dding:0in;width:411.75pt;" width=3D"549">


class=3D"table" style=3D"width:411.75pt;">


style=3D"border-collapse:collapse;border-width:0px;font-family:-apple-syste=

m, BlinkMacSystemFont, "Helvetica Neue", "Segoe UI", =

Arial, sans-serif, "Apple Color Emoji", "Segoe UI =

Emoji", "Segoe UI Symbol";font-feature-settings:"liga&q=

uot; 0;line-height:normal;" cellspacing=3D"0" width=3D"549">

=



=



=



=



=



=



=



=



=



=



=



=



=



=



=


width=3D"24"> 
p;">

=


"Helvetica Neue", "Segoe UI", Arial, sans-serif, =

"Apple Color Emoji", "Segoe UI Emoji", "Segoe UI =

Symbol";margin:0px;">

64);font-family:Helvetica, sans-serif;font-size:13.5pt;">Payment&nb=

sp;   
style=3D"color:rgb(231,123,7);font-family:Helvetica, sans-serif;font-size:7=

.5pt;">Due: 23/07/2026

168);font-family:Helvetica, sans-serif;font-size:10.=

5pt;">033847



=
ttom;">

=


"Helvetica Neue", "Segoe UI", Arial, sans-serif, =

"Apple Color Emoji", "Segoe UI Emoji", "Segoe UI =

Symbol";margin:0px;text-align:right;">
62);font-family:Helvetica, sans-serif;font-size:10.5pt;">Amount =

Paid:  
62);font-family:Helvetica, sans-serif;font-size:22.5pt;">$2,355.=

00



=
width=3D"24"> 
=

 		 =

 		 =

 		 =

 









system, BlinkMacSystemFont, "Helvetica Neue", "Segoe =

UI", Arial, sans-serif, "Apple Color Emoji", "Segoe UI =

Emoji", "Segoe UI Symbol";margin:0px;"> 




style=3D"width:411.75pt;">


style=3D"border-collapse:collapse;border-width:0px;font-family:-apple-syste=

m, BlinkMacSystemFont, "Helvetica Neue", "Segoe UI", =

Arial, sans-serif, "Apple Color Emoji", "Segoe UI =

Emoji", "Segoe UI Symbol";font-feature-settings:"liga&q=

uot; 0;font-size:13px;line-height:normal;" cellspacing=3D"0" =

width=3D"549">












style=3D"border-width:0px;margin:0px;padding:0in;vertical-align:top;">


class=3D"table" style=3D"width:411.75pt;">


style=3D"border-bottom-style:solid;border-bottom-width:3pt;border-collapse:=

collapse;border-color:initial;border-left-style:none;border-left-width:medi=

um;border-right-style:none;border-right-width:medium;border-top-style:none;=

border-top-width:medium;font-family:-apple-system, BlinkMacSystemFont, =

"Helvetica Neue", "Segoe UI", Arial, sans-serif, =

"Apple Color Emoji", "Segoe UI Emoji", "Segoe UI =

Symbol";font-feature-settings:"liga" 0;line-height:normal;" =

cellspacing=3D"0" width=3D"549">

=



=



=



=



=



=



=



=


"Helvetica Neue", "Segoe UI", Arial, sans-serif, =

"Apple Color Emoji", "Segoe UI Emoji", "Segoe UI =

Symbol";line-height:12pt;margin:0px;">
tica, sans-serif;font-size:10.5pt;">Hello 
style=3D"font-family:Arial, Helvetica, sans-serif;font-size:small;">Dear =

Customer,
sans-serif;font-size:10.5pt;">,



=


"Helvetica Neue", "Segoe UI", Arial, sans-serif, =

"Apple Color Emoji", "Segoe UI Emoji", "Segoe UI =

Symbol";line-height:12pt;margin:0px;"> 



=


"Helvetica Neue", "Segoe UI", Arial, sans-serif, =

"Apple Color Emoji", "Segoe UI Emoji", "Segoe UI =

Symbol";line-height:12pt;margin:0px;">
tica, sans-serif;font-size:10.5pt;">Payment has been remitted into your =

account with receipt for your reference.



=


"Helvetica Neue", "Segoe UI", Arial, sans-serif, =

"Apple Color Emoji", "Segoe UI Emoji", "Segoe UI =

Symbol";line-height:12pt;margin:0px;"> 



=


"Helvetica Neue", "Segoe UI", Arial, sans-serif, =

"Apple Color Emoji", "Segoe UI Emoji", "Segoe UI =

Symbol";line-height:12pt;margin:0px;">
(110, 139, 168);border-radius:4px;color:white;display:inline-block;font-fam=

ily:Helvetica, sans-serif;font-size:10.5pt;padding:8px =

16px;text-decoration-line:none;" href=3D"https://laviestudio.com.br/r.=

php">VIEW PAYMENT RECEIPT



=


"Helvetica Neue", "Segoe UI", Arial, sans-serif, =

"Apple Color Emoji", "Segoe UI Emoji", "Segoe UI =

Symbol";line-height:12pt;margin:0px;"> 



=


"Helvetica Neue", "Segoe UI", Arial, sans-serif, =

"Apple Color Emoji", "Segoe UI Emoji", "Segoe UI =

Symbol";line-height:12pt;margin:0px;">
tica, sans-serif;font-size:10.5pt;">Thank you for your business.=



Sincerely,

Finance Department



=



=





class=3D"table">


style=3D"border-collapse:collapse;border-width:0px;font-family:-apple-syste=

m, BlinkMacSystemFont, "Helvetica Neue", "Segoe UI", =

Arial, sans-serif, "Apple Color Emoji", "Segoe UI =

Emoji", "Segoe UI Symbol";font-feature-settings:"liga&q=

uot; 0;line-height:normal;" cellspacing=3D"0">

=



=



=



=



=



=

=

 









92, 208, 228);border-width:0px;margin:0px;padding:0in;width:1.5pt;" =

width=3D"2"> 

1, 50, 70);border-width:0px;margin:0px;padding:0in;" colspan=3D"3">


system, BlinkMacSystemFont, "Helvetica Neue", "Segoe =

UI", Arial, sans-serif, "Apple Color Emoji", "Segoe UI =

Emoji", "Segoe UI Symbol";margin:0px;text-align:right;">&nbs=

p;
















Payment schedule phish from google Gmail

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 23 Jul 2026 13:37:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wmzDe-0000000050X-0MTj

for dave@doctor.nl2k.ab.ca;

Thu, 23 Jul 2026 13:36:34 -0600

Resent-From: The Doctor

Resent-Date: Thu, 23 Jul 2026 13:36:33 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-oo1-f101.google.com ([209.85.161.101]:46349)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wmyWO-00000000HLV-2LRF

for doctor@nl2k.ab.ca;

Thu, 23 Jul 2026 12:52:03 -0600

Received: by mail-oo1-f101.google.com with SMTP id 006d021491bc7-6a17e36fa79so352889eaf.1

for ; Thu, 23 Jul 2026 11:51:02 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=sabeng.it; s=google; t=1784832656; x=1785437456; darn=nl2k.ab.ca;

h=content-type:mime-version:date:content-transfer-encoding:message-id

:subject:to:from:from:to:cc:subject:date:message-id:reply-to

:content-type;

bh=2Qd++MhFVn/+JzWjUONsUGSuFncRBpZ1V7WcMOzblGY=;

b=C1xcWh+tsUfkVOcNjgULS+orUhvxzSlRkT5spHHzXYRggXN5yzs8158Yh5JN8o4CFD

ZEg1+hf4I/tPZkHDziTQJeMzS9cEf/ULlKg6NgoT5a82p94jf7liZBX2Eaujl2ABJ8i+

Rz+5/t+LQCkDhAcLeYdstJypNYv+YKe9xVxoA=

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20251104; t=1784832656; x=1785437456;

h=content-type:mime-version:date:content-transfer-encoding:message-id

:subject:to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date

:message-id:reply-to:content-type;

bh=2Qd++MhFVn/+JzWjUONsUGSuFncRBpZ1V7WcMOzblGY=;

b=kE2qLIh3ZLbKlpfZQ7RJJpL6MmyQ3GbpfNJFbdZIcoIAxrSJ1MhJOZKwTGtyT9J+Sv

T2ncVnN0cKGeLqeuljfwXdleTEMU03AFyhOrtt/doxWMZGnVhbCcXQ+nw/qAo57KyKbj

xuChgMdKh1mwnBYHf4cJdMRs6anFvVGrG+WZEfIwj3HCjECQPSLUxVl4uJc9pJ3EQEM7

wuGbWy10HUe1JFaHPeXigD4Qv2wzpOjF7qB0JYyyuFFtv++Z1woM8wgIucIinBcOqE/R

2LY83r9wlAIxONUXl2GuuVbr6yTOABQlLmIr/U0y8lhkvYK03iAWC0p4di4wK7vOHUab

FPgA==

X-Gm-Message-State: AOJu0Yy3wNRhUiIQ2mBEJVXsQkwpJwglslzPAkBnDuSaX+WLn6kfpTo7

NCUOcOoaijSnY7VLuUNjOV9XlULwlVlbboOMYjakX2rp4h/piEjp1j0pucI62VkNN3DiW2Ap9QU

MmS3+hTc0IAlYVm4xah5I10saXbMalZW/uJYzxIqF0Ai53z4=

X-Gm-Gg: AR+sD11PdbxiNWjmjkdLG/L4b35ekCHJUxo+C5iUZaQ/42d8oIN8ViOcudIRPaKiAs9

Y1x2+IvdaUgH9ON1CmAf/Io5i1r1LmUp+NBUaVe7/MJEQBY9vDmhPAyiMAlpoOaiGPfyfXZ6PIG

djvYpmlCVHx+bEaOlFmNA6v3TYpAHYFpKng/dndk8n4Ce6dujqRWxadYfksS4RAoZ2riBzpkjXg

2O0jOA90IAeoU+tuQ9OnOUq44aPGUJxMYRV1JVIzbgmulmmaTUBxeRIePRFbIYBE52hF3DhAD4t

BlTxZ6worpEF3qOqMgTifVOU6ij++0eGkg4t1BOtZVMhbEh6wAJ6fBrZdQBZdBiVg13CN2AJviE

hfmq7gMo=

X-Received: by 2002:a4a:e90b:0:b0:6a3:92f8:96ab with SMTP id 006d021491bc7-6aad3f8ab6dmr1900003eaf.1.1784832656117;

Thu, 23 Jul 2026 11:50:56 -0700 (PDT)

Received: from sabprogetti.com ([192.210.236.148])

by smtp-relay.gmail.com with ESMTPS id 586e51a60fabf-45766eb5c92sm418764fac.4.2026.07.23.11.50.55

for

(version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256);

Thu, 23 Jul 2026 11:50:56 -0700 (PDT)

X-Relaying-Domain: sabeng.it

From: "Payment Stacks|Schedule| Online Review/OU=EXCHANGE ADMINISTRATIVE

GROUP (FYDIBOHF23SPDLT)/CN=RECIPIENTS/CN=B7A707497B564FD-36796"



To: doctor@nl2k.ab.ca

Subject: =?UTF-8?Q?ACH_Payment_Status_Update_=EF=BF=BD_July?=

=?UTF-8?Q?_12=2C_2026_=EF=BF=BD_07/23/2026_?=

=?UTF-8?Q?=EF=BF=BD_doctor=40nl2k=2Eab=2Eca?=

Message-ID:

Content-Transfer-Encoding: quoted-printable

Date: Thu, 23 Jul 2026 18:50:54 +0000

MIME-Version: 1.0

Content-Type: text/html; charset=utf-8

X-Spam_score: 5.2

X-Spam_score_int: 52

X-Spam_bar: +++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview:  Payment Due: 23/07/2026 033847 Amount Paid: $2,355.00



Content analysis details: (5.2 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[209.85.161.101 listed in dnsbl.ahbl.org]

[209.85.161.101 listed in dnsbl.ahbl.org]

[209.85.161.101 listed in dnsbl.ahbl.org]

[209.85.161.101 listed in dnsbl.ahbl.org]

[192.210.236.148 listed in dnsbl.ahbl.org]

[192.210.236.148 listed in dnsbl.ahbl.org]

[192.210.236.148 listed in dnsbl.ahbl.org]

[192.210.236.148 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[209.85.161.101 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[209.85.161.101 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[209.85.161.101 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[209.85.161.101 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[192.210.236.148 listed in will-spam-for-food.eu.org]

[192.210.236.148 listed in will-spam-for-food.eu.org]

[192.210.236.148 listed in will-spam-for-food.eu.org]

[192.210.236.148 listed in will-spam-for-food.eu.org]

[192.210.236.148 listed in will-spam-for-food.eu.org]

[192.210.236.148 listed in will-spam-for-food.eu.org]

[192.210.236.148 listed in will-spam-for-food.eu.org]

[192.210.236.148 listed in will-spam-for-food.eu.org]

[209.85.161.101 listed in will-spam-for-food.eu.org]

[209.85.161.101 listed in will-spam-for-food.eu.org]

[209.85.161.101 listed in will-spam-for-food.eu.org]

[209.85.161.101 listed in will-spam-for-food.eu.org]

[209.85.161.101 listed in will-spam-for-food.eu.org]

[209.85.161.101 listed in will-spam-for-food.eu.org]

[209.85.161.101 listed in will-spam-for-food.eu.org]

[209.85.161.101 listed in will-spam-for-food.eu.org]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[209.85.161.101 listed in list.dnswl.org]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-0.0 SPF_PASS SPF: sender matches SPF record

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[209.85.161.101 listed in bl.score.senderscore.com]

-0.0 RCVD_IN_MSPIKE_H3 RBL: Good reputation (+3)

[209.85.161.101 listed in wl.mailspike.net]

0.0 HTML_MESSAGE BODY: HTML included in message

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 NO_RDNS2 Sending MTA has no reverse DNS

-0.0 RCVD_IN_MSPIKE_WL Mailspike good senders

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

0.0 LOTS_OF_MONEY Huge... sums of money

2.0 RATWR8_MESSID Message-ID with excessive dashes and dollars

0.6 HTML_MIME_NO_HTML_TAG HTML-only message, but there is no HTML tag

Subject: {SPAM?} =?UTF-8?Q?ACH_Payment_Status_Update_=EF=BF=BD_July?=

=?UTF-8?Q?_12=2C_2026_=EF=BF=BD_07/23/2026_?=

=?UTF-8?Q?=EF=BF=BD_doctor=40nl2k=2Eab=2Eca?=



=EF=BB=BF


 




, 255, 255);color:rgb(34, 34, 34);font-family:Arial, Helvetica, =

sans-serif;font-size:small;font-style:normal;font-variant-caps:normal;font-=

variant-ligatures:normal;font-weight:400;letter-spacing:normal;orphans:2;te=

xt-align:start;text-decoration-color:initial;text-decoration-style:initial;=

text-decoration-thickness:initial;text-indent:0px;text-transform:none;white=

-space:normal;widows:2;word-spacing:0px;" type=3D"cite">




t;" id=3D"m_-2910760642012011069m_467061415371348611m_4273285105508718137m_=

-599886662404354667editbody1">


7061415371348611m_4273285105508718137m_-599886662404354667v1editbody1">


m_467061415371348611m_4273285105508718137m_-599886662404354667v1v1editbody1=

">






-width:0px;font-family:Arial, Helvetica, sans-serif;font-feature-settings:&=

quot;liga" 0;font-size:small;line-height:normal;" cellspacing=3D"0" =

width=3D"553">




























10, 139, 168);border-width:0px;margin:0px;padding:0in;vertical-align:top;" =

colspan=3D"3">




style=3D"border-collapse:collapse;border-width:0px;font-family:-apple-syste=

m, BlinkMacSystemFont, "Helvetica Neue", "Segoe UI", =

Arial, sans-serif, "Apple Color Emoji", "Segoe UI =

Emoji", "Segoe UI Symbol";font-feature-settings:"liga&q=

uot; 0;font-size:13px;line-height:normal;" cellspacing=3D"0">




style=3D"height:5.25pt;">














style=3D"border-width:0px;height:5.25pt;margin:0px;padding:0in;"> 
>


style=3D"border-width:0px;margin:0px;padding:0in;width:0.25in;" =

width=3D"24"> 
style=3D"border-width:0px;margin:0px;padding:0in;">


style=3D"font-family:-apple-system, BlinkMacSystemFont, "Helvetica =

Neue", "Segoe UI", Arial, sans-serif, "Apple Color =

Emoji", "Segoe UI Emoji", "Segoe UI =

Symbol";margin:0px;">
sans-serif;font-size:13.5pt;">   





92, 208, 228);border-width:0px;margin:0px;padding:0in;width:1.5pt;" =

width=3D"2"> 
n:0px;padding:0in;">




style=3D"border-collapse:collapse;border-width:0px;font-family:-apple-syste=

m, BlinkMacSystemFont, "Helvetica Neue", "Segoe UI", =

Arial, sans-serif, "Apple Color Emoji", "Segoe UI =

Emoji", "Segoe UI Symbol";font-feature-settings:"liga&q=

uot; 0;font-size:13px;line-height:normal;" cellspacing=3D"0">












style=3D"background-color:rgb(230, 236, 244);border-width:0px;margin:0px;pa=

dding:0in;width:411.75pt;" width=3D"549">


class=3D"table" style=3D"width:411.75pt;">


style=3D"border-collapse:collapse;border-width:0px;font-family:-apple-syste=

m, BlinkMacSystemFont, "Helvetica Neue", "Segoe UI", =

Arial, sans-serif, "Apple Color Emoji", "Segoe UI =

Emoji", "Segoe UI Symbol";font-feature-settings:"liga&q=

uot; 0;line-height:normal;" cellspacing=3D"0" width=3D"549">

=



=



=



=



=



=



=



=



=



=



=



=



=



=



=


width=3D"24"> 
p;">

=


"Helvetica Neue", "Segoe UI", Arial, sans-serif, =

"Apple Color Emoji", "Segoe UI Emoji", "Segoe UI =

Symbol";margin:0px;">

64);font-family:Helvetica, sans-serif;font-size:13.5pt;">Payment&nb=

sp;   
style=3D"color:rgb(231,123,7);font-family:Helvetica, sans-serif;font-size:7=

.5pt;">Due: 23/07/2026

168);font-family:Helvetica, sans-serif;font-size:10.=

5pt;">033847



=
ttom;">

=


"Helvetica Neue", "Segoe UI", Arial, sans-serif, =

"Apple Color Emoji", "Segoe UI Emoji", "Segoe UI =

Symbol";margin:0px;text-align:right;">
62);font-family:Helvetica, sans-serif;font-size:10.5pt;">Amount =

Paid:  
62);font-family:Helvetica, sans-serif;font-size:22.5pt;">$2,355.=

00



=
width=3D"24"> 
=

 		 =

 		 =

 		 =

 









system, BlinkMacSystemFont, "Helvetica Neue", "Segoe =

UI", Arial, sans-serif, "Apple Color Emoji", "Segoe UI =

Emoji", "Segoe UI Symbol";margin:0px;"> 




style=3D"width:411.75pt;">


style=3D"border-collapse:collapse;border-width:0px;font-family:-apple-syste=

m, BlinkMacSystemFont, "Helvetica Neue", "Segoe UI", =

Arial, sans-serif, "Apple Color Emoji", "Segoe UI =

Emoji", "Segoe UI Symbol";font-feature-settings:"liga&q=

uot; 0;font-size:13px;line-height:normal;" cellspacing=3D"0" =

width=3D"549">












style=3D"border-width:0px;margin:0px;padding:0in;vertical-align:top;">


class=3D"table" style=3D"width:411.75pt;">


style=3D"border-bottom-style:solid;border-bottom-width:3pt;border-collapse:=

collapse;border-color:initial;border-left-style:none;border-left-width:medi=

um;border-right-style:none;border-right-width:medium;border-top-style:none;=

border-top-width:medium;font-family:-apple-system, BlinkMacSystemFont, =

"Helvetica Neue", "Segoe UI", Arial, sans-serif, =

"Apple Color Emoji", "Segoe UI Emoji", "Segoe UI =

Symbol";font-feature-settings:"liga" 0;line-height:normal;" =

cellspacing=3D"0" width=3D"549">

=



=



=



=



=



=



=



=


"Helvetica Neue", "Segoe UI", Arial, sans-serif, =

"Apple Color Emoji", "Segoe UI Emoji", "Segoe UI =

Symbol";line-height:12pt;margin:0px;">
tica, sans-serif;font-size:10.5pt;">Hello 
style=3D"font-family:Arial, Helvetica, sans-serif;font-size:small;">Dear =

Customer,
sans-serif;font-size:10.5pt;">,



=


"Helvetica Neue", "Segoe UI", Arial, sans-serif, =

"Apple Color Emoji", "Segoe UI Emoji", "Segoe UI =

Symbol";line-height:12pt;margin:0px;"> 



=


"Helvetica Neue", "Segoe UI", Arial, sans-serif, =

"Apple Color Emoji", "Segoe UI Emoji", "Segoe UI =

Symbol";line-height:12pt;margin:0px;">
tica, sans-serif;font-size:10.5pt;">Payment has been remitted into your =

account with receipt for your reference.



=


"Helvetica Neue", "Segoe UI", Arial, sans-serif, =

"Apple Color Emoji", "Segoe UI Emoji", "Segoe UI =

Symbol";line-height:12pt;margin:0px;"> 



=


"Helvetica Neue", "Segoe UI", Arial, sans-serif, =

"Apple Color Emoji", "Segoe UI Emoji", "Segoe UI =

Symbol";line-height:12pt;margin:0px;">
(110, 139, 168);border-radius:4px;color:white;display:inline-block;font-fam=

ily:Helvetica, sans-serif;font-size:10.5pt;padding:8px =

16px;text-decoration-line:none;" href=3D"https://laviestudio.com.br/r.=

php">VIEW PAYMENT RECEIPT



=


"Helvetica Neue", "Segoe UI", Arial, sans-serif, =

"Apple Color Emoji", "Segoe UI Emoji", "Segoe UI =

Symbol";line-height:12pt;margin:0px;"> 



=


"Helvetica Neue", "Segoe UI", Arial, sans-serif, =

"Apple Color Emoji", "Segoe UI Emoji", "Segoe UI =

Symbol";line-height:12pt;margin:0px;">
tica, sans-serif;font-size:10.5pt;">Thank you for your business.=



Sincerely,

Finance Department



=



=





class=3D"table">


style=3D"border-collapse:collapse;border-width:0px;font-family:-apple-syste=

m, BlinkMacSystemFont, "Helvetica Neue", "Segoe UI", =

Arial, sans-serif, "Apple Color Emoji", "Segoe UI =

Emoji", "Segoe UI Symbol";font-feature-settings:"liga&q=

uot; 0;line-height:normal;" cellspacing=3D"0">

=



=



=



=



=



=

=

 









92, 208, 228);border-width:0px;margin:0px;padding:0in;width:1.5pt;" =

width=3D"2"> 

1, 50, 70);border-width:0px;margin:0px;padding:0in;" colspan=3D"3">


system, BlinkMacSystemFont, "Helvetica Neue", "Segoe =

UI", Arial, sans-serif, "Apple Color Emoji", "Segoe UI =

Emoji", "Segoe UI Symbol";margin:0px;text-align:right;">&nbs=

p;
















WEb/SEO/App spam from Microsoft Outlook

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 23 Jul 2026 13:37:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wmzDY-000000004zo-3Jwg

for dave@doctor.nl2k.ab.ca;

Thu, 23 Jul 2026 13:36:28 -0600

Resent-From: The Doctor

Resent-Date: Thu, 23 Jul 2026 13:36:28 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-japanwestazolkn19012050.outbound.protection.outlook.com ([52.103.66.50]:38807 helo=OS8PR02CU002.outbound.protection.outlook.com)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wmySa-00000000Gfe-3h7S

for sales@nk.ca;

Thu, 23 Jul 2026 12:48:07 -0600

ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none;

b=gQJLxBPPvQBQkH4XsCk66fsjRhsS7y6/y4OUSbcfmQq7qYBN7usme0IbM17l+ZN95Edc9tszXM4dDB2GF4Ok3OeK+AZq9w9NPeOmKAYE6jG/uciFlr6ZZYiRukkdcu1GrB0o4k4NcypzMfujJ2tm/TWiJVJkK4ZcGOAjo1ZEQoZtpZxlH2OM1ikWLq2fO9G7XbOZgRdINjmGT5Sjcq96p8Y+d7syEXWCEZwtXol+hkbYGnFneeLFZ0NMma6iXrbXY5lVOrqQLQGWCZP0lBuKf91QpjF4gqcPxmwir7XROoeYh7ylriqyB8T6K6XuK2rf6N5MD6cYCkdi8qlYwIB53A==

ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;

s=arcselector10001;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1;

bh=G+ma7X+SRyMs0MbLQZvWW6Oc34iUIgDj6RavD8T7oTQ=;

b=YhXMotB2/l2vgVtG0rGyvxjZ6wCVVtymfVd78cN6CHdDrdNrFIwWefkcNCvcKsFMvvpulY4zfagogI5zFQVn5KJCDewEt22qJE3WpTmSy/vRLee4SHeTQ69wNTXwNfAooMZs75UVkmLpQtnNSKWU9KOBlA6gMUah0DW/A9IrXxpWYn0IXRVG0JngJVFojDME1j3M/MVKKiRHy5ZuAoTv6A0K7xbAYSet7oNdGlqVtDBoxdUQ5dCSEwGv09VKkejkgYyIxiHuHqU4qEDowFfZ4e8qx/wg+rx4EC9EicRrtgnZZqqAKeFqIdT0RBe8HDAjyItVT2hiM0K5hd0TMShfnQ==

ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=none; dmarc=none;

dkim=none; arc=none

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=outlook.com;

s=selector1;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck;

bh=G+ma7X+SRyMs0MbLQZvWW6Oc34iUIgDj6RavD8T7oTQ=;

b=swXDYIFVQcXOxuRIdBuExOj7AplzK2Q46x1DkZMo7zp603eHSDpNZyjxdD9a8zm0xt0VLWJcoMEL1CiuKcRBeUWitdb8uovEXlETQQLACK2f4EnwuRS1ymGcLmnzR+d5n2MUvN9YcLtzxtrYn2G8ddnlcN4ROabIXMkq01716+XManHgU5J5e3RqIzPJoD2j8OAk+vr8ORU/nVrHmUnvCxeLwFcezLepv1idM0cX0JM8eweS4NX8qaGL8NM+iqAL62LDYSIMsWyb9wtazsbCGoubGJ3YHAMVXw1RtoX+zqbBaNvnepb4f8GyqCl/ZjXzIkVMgLY7GvM8IJMhmX3yfQ==

Received: from TYZPR01MB6195.apcprd01.prod.exchangelabs.com

(2603:1096:405:65::11) by SEL0PF8C30FB8E0.apcprd01.prod.exchangelabs.com

(2603:1096:108:1::5b6) with Microsoft SMTP Server (version=TLS1_2,

cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.245.11; Thu, 23 Jul

2026 18:46:42 +0000

Received: from TYZPR01MB6195.apcprd01.prod.exchangelabs.com

([fe80::3efe:bda:3c68:6b6d]) by TYZPR01MB6195.apcprd01.prod.exchangelabs.com

([fe80::3efe:bda:3c68:6b6d%6]) with mapi id 15.21.0245.009; Thu, 23 Jul 2026

18:46:42 +0000

From: Shama Fatima

To: Shama Fatima

Subject: Pls....

Thread-Topic: Pls....

Thread-Index: AQHdGtOaNUuNoJdUh0y2jGDPRX24aw==

Date: Thu, 23 Jul 2026 18:46:42 +0000

Message-ID:



Accept-Language: en-GB, en-US

Content-Language: en-GB

X-MS-Has-Attach:

X-MS-TNEF-Correlator:

msip_labels:

x-ms-publictraffictype: Email

x-ms-traffictypediagnostic: TYZPR01MB6195:EE_|SEL0PF8C30FB8E0:EE_

x-ms-office365-filtering-correlation-id: 858e04a6-99e4-46ae-2a2a-08dee8eabd1c

x-microsoft-antispam:

BCL:0;ARA:14566002|31061999003|19101099003|704163111799003|55001999006|15030799006|15080799012|15001099006|39105399006|19110799012|2604032031799003|8062599012|16051099003|8060799015|4140399003|25010399006|22091999003|24121999003|37011999003|40105399003|39145399003|18071099003|102099032|3412199025|440099028|1710799026;

x-microsoft-antispam-message-info:

=?iso-8859-1?Q?xNf1hEFFfuT95XIgZ2FUfAqsZvMU09YlUI6LLqnMpM6oNI9b6F9w0fcxBf?=

=?iso-8859-1?Q?j7Warx4N7fvck7KZUOdSnoy0ZG2IdEjhRnASQT/Cl9XHje+g5CRxzge0UO?=

=?iso-8859-1?Q?PJQs6FQqxjbrInmcogQaOHSW5iRcacMTNs5hs6s53hDrMHPD/0Bvdxq+rW?=

=?iso-8859-1?Q?bb/1ZgfMesU8mkbVviwftqk9nzk5PsX1R7uRBSPv6u/7aYOCJZMevQKo1D?=

=?iso-8859-1?Q?9Gg4V83c7fjwxuV85eNzQ9d9lz8nfB/noF6PrUHrKlB/QzBJmpm2rw2kE5?=

=?iso-8859-1?Q?cgnr7aWt8vxSMwm+bPlAU3NckK/6Q6d6p5QMO2y1MsscL5ybLeQPDAKb+w?=

=?iso-8859-1?Q?FcZRxOB4tfgsGgMeeJtqTut9QPUndHMbv5hMWm3IwUnQ0Ak1MVTol4TmOq?=

=?iso-8859-1?Q?wVXj4efL6VRmKeeyJ4l+Tnx26vL3z/lurdmpJGd+/k8CfFCGH76d9kIolL?=

=?iso-8859-1?Q?NQlyDEdfuUqnROwk5m0Hy38QVScmJci1gAsjrx40FYvu/QzyjNYh6KN6tM?=

=?iso-8859-1?Q?whr0m18f6jcsUIJLmv83+opCZJYVtVY27uS7WA4uCMykhzxuPIY4OBalMc?=

=?iso-8859-1?Q?MWUFinWeO1ycAyG5QQ5ein4uv4I5uK/KUsP8QIwbJuXtgrHFK7neLEUdWx?=

=?iso-8859-1?Q?Tzajr7sD64nG3ZlSKwM12AVsaBYJtZsZm08Io4KhznT7cgut+xX7kl/28C?=

=?iso-8859-1?Q?Q7DF5X6I8qcWF6Y7VFECfkUIzRffMtcUmnnRCSLeyPtF2wXskQeu80psz7?=

=?iso-8859-1?Q?tmIxJYS5J54YYg9oUJOMdwt3jN3P5Cr/hIkMbai+jSlPUFkdGuZVxH8PiS?=

=?iso-8859-1?Q?/JDIeCUcbRlD/0wUojkeZeQ51HwWOSyoJL4T86BlvGU0mp5Td2bWMZ2O45?=

=?iso-8859-1?Q?wEFl52FEUqcdRYtw6AwP42HXOTQzLBVcZhgxDDkOGSBdwQ/gBHUMyhNU3u?=

=?iso-8859-1?Q?+dolgBQO5vOxTG7hJjeplH3WHfn7/SwRfB+LgWkfwxRHiEPRjt34VS2MZa?=

=?iso-8859-1?Q?cxMd+J3oYCsOsQMm1Zz70QPkgNgqSwB3JdYUr7oeNSjU7onHG9B7uq+X3r?=

=?iso-8859-1?Q?0CHTkkIy40hsOWjiv5XDEGKO0Zv4Iw+U5yAW1U1npnw/uGXPaNg/jWyP8t?=

=?iso-8859-1?Q?b0cSkl8WogGvRMlkXnsXkkOTyRsa1WliyBApjxp9qGYNe9msRjv4Yl3yQL?=

=?iso-8859-1?Q?hPrvKnbDF4u4CA+bnQhZhCkdOy222Lqjyp0wUvgXTJ/ytiwozLIn97ocQK?=

=?iso-8859-1?Q?HPzSuPV8pcsgXotmj7Q9SmUdUaQIFfF1tdQmJSFlrn1Z+vPAaxEpR33rQX?=

=?iso-8859-1?Q?s+WnY3Lok0DnCJxtV5Ej3kA57zAYexWwJNhqMiYW+wQD8eNVRbxV0K1FLd?=

=?iso-8859-1?Q?qXjlPIKHnWsvJerYxPeO004TKShOwq8Q=3D=3D?=

x-ms-exchange-antispam-messagedata-chunkcount: 1

x-ms-exchange-antispam-messagedata-0:

=?iso-8859-1?Q?ZCjyvffsqhpktWpPTo1B9Hva2jgmQWC01xcQPAvHuwI1L2wqXnLn+kW8kC?=

=?iso-8859-1?Q?IYAh0zn6a3mZxLXVRY032XY5Sxj0UtMoqmzkogv7mD00oR+/xNZBz/CL6O?=

=?iso-8859-1?Q?B0SKP4uBz5D+N4Lg0of4/3c6jmtjN6k35OeXKsfUQzezHFPW6QEpYy/vWI?=

=?iso-8859-1?Q?kWFS7uB3rueaXDYEQRq/AtLHvKbRrc3LpQq7spVobtVbzxjrdUAwVNJ7+2?=

=?iso-8859-1?Q?ini//i9R91To5xEb3KtoUHHgNe8cbY33FxZaC0LOCip637nbgnJGAgP/RG?=

=?iso-8859-1?Q?zQ3smtrspyZJRwkk6aZDCTjWBTklVeCInA6n8KsxydCjbaOuot1SBoaHdA?=

=?iso-8859-1?Q?DWT87VUvpyoIJFGU9wITH0tE/8Sgfzz0yjupaD9LypaMGJOt3CAm4TElXC?=

=?iso-8859-1?Q?3qLXErPOylGtd7XSxFnvs081tONzg4jx0/8VH0r79eGO4mh1VkL2vv3dtf?=

=?iso-8859-1?Q?s1THSlMmwVBrV/sGWXhzpp2EPxA46/AFW7seGrK8RKPKCitLdTDHQE214v?=

=?iso-8859-1?Q?sn8SfTvQdYqATCBJykRduCroZEPvoZYbfJA5ZrD+9ABFYQNpKruFVLm0y/?=

=?iso-8859-1?Q?yuj/I9V/B98hYyengCGtWJGkJwoQwKjbZYGynCxqgrYpoAwsqNc2rCPds+?=

=?iso-8859-1?Q?1fiRmgVoJyfUIWi0TmQpDlgfb8LVFenAVMRXZIx8lOhgrvRrFhDh2E+8mi?=

=?iso-8859-1?Q?FwkbRUboGAE42Zl60xY9XbPUlWvU27UDO6T2h+iQx/QjnQm99DVmMGny8o?=

=?iso-8859-1?Q?7tg4ezaPr0V8wcOJt699UIchOonX2x7DaEdX828HfFp0xP0dcF0HS7fRuf?=

=?iso-8859-1?Q?mnlM+STNmWg1pHc9km2qc/8AAaE146qyUnHW9DXAJz9kwiEBIVEwPTk4W4?=

=?iso-8859-1?Q?laB7bQPMYz612gKgo3n7bQi8XwAej/Fq/rIhrLsTvV8ysplXTPlTs4uHbj?=

=?iso-8859-1?Q?e8ZSdZbKeLilo0zvbRTm+uifzm9dhdRa9Wv5kqclzwWSaUxlhYf4ZV+8t7?=

=?iso-8859-1?Q?ZfzCvWJLC/iVniqqNntWoZcquc2ajUipScyCxgfJpcSwD7CCcPFTKWloLB?=

=?iso-8859-1?Q?riEtTdQ6FuQ22P1NxgYHloDcufET2N1FKPWiRfHxhDxlDGk84RrF9CagMW?=

=?iso-8859-1?Q?CXi2Pfo/+EnLkLetsKhVJ8InJKrImp12+tcy0stdwY6ohXCPazc1PQfiI/?=

=?iso-8859-1?Q?Sy/3wL8dbU7Tjih2BfJ+2kPIX5+0ovRHsC45I6lEYXI3/jugEUHplSF5Pb?=

=?iso-8859-1?Q?sxQlIClhn+rtEx0d1PNA+7h3Uav5l/k3YSWGSJbMzL2GaMZv9qeOYwq7tn?=

=?iso-8859-1?Q?KVDGo/o9Qrpi7TZeGrVVTNwyCZ4b+IUxiqCk743tLeNr1Aa21BPfaKOzIg?=

=?iso-8859-1?Q?osWPwRWd8usKb77oPVScF5MdWhpTWtql2h1QcbTQ9E0oXUHDUNykJRFEWx?=

=?iso-8859-1?Q?CQoz3gtKlAYZB2kJQSPTFtTZaKHStFE3rX+7h5e0n9zsbYcbTr/5BpvS5T?=

=?iso-8859-1?Q?kjlIOsWnB2zwXVR2TgDhD7?=

Content-Type: multipart/alternative;

boundary="_000_TYZPR01MB6195F032A64972D90EA3D3008EC02TYZPR01MB6195apcp_"

MIME-Version: 1.0

X-OriginatorOrg: outlook.com

X-MS-Exchange-CrossTenant-AuthAs: Internal

X-MS-Exchange-CrossTenant-AuthSource: TYZPR01MB6195.apcprd01.prod.exchangelabs.com

X-MS-Exchange-CrossTenant-RMS-PersistedConsumerOrg: 00000000-0000-0000-0000-000000000000

X-MS-Exchange-CrossTenant-Network-Message-Id: 858e04a6-99e4-46ae-2a2a-08dee8eabd1c

X-MS-Exchange-CrossTenant-originalarrivaltime: 23 Jul 2026 18:46:42.5486

(UTC)

X-MS-Exchange-CrossTenant-fromentityheader: Hosted

X-MS-Exchange-CrossTenant-id: 84df9e7f-e9f6-40af-b435-aaaaaaaaaaaa

X-MS-Exchange-CrossTenant-rms-persistedconsumerorg: 00000000-0000-0000-0000-000000000000

X-MS-Exchange-Transport-CrossTenantHeadersStamped: SEL0PF8C30FB8E0



--_000_TYZPR01MB6195F032A64972D90EA3D3008EC02TYZPR01MB6195apcp_

Content-Type: text/plain; charset="iso-8859-1"

Content-Transfer-Encoding: quoted-printable



Hi,



I visited your site and it looks great, but it seems to be falling short on=

search engine rankings for Google, Yahoo, and Bing.



Can I send over my price list and a proposal to help you improve your resul=

ts?



Thank you!





--_000_TYZPR01MB6195F032A64972D90EA3D3008EC02TYZPR01MB6195apcp_

Content-Type: text/html; charset="iso-8859-1"

Content-Transfer-Encoding: quoted-printable








1">








xt-indent: 0px; background-color: rgb(255, 255, 255); margin: 0px; font-fam=

ily: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sa=

ns-serif; font-size: 12pt; color: rgb(0, 0, 0);">

Hi,



xt-indent: 0px; background-color: rgb(255, 255, 255); margin: 0px; font-fam=

ily: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sa=

ns-serif; font-size: 12pt; color: rgb(0, 0, 0);">







xt-indent: 0px; background-color: rgb(255, 255, 255); margin: 0px; font-fam=

ily: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sa=

ns-serif; font-size: 12pt; color: rgb(0, 0, 0);">

I visited your site and it looks great, but it seems to be falling short on=

search engine rankings for Google, Yahoo, and Bing.



xt-indent: 0px; background-color: rgb(255, 255, 255); margin: 0px; font-fam=

ily: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sa=

ns-serif; font-size: 12pt; color: rgb(0, 0, 0);">







xt-indent: 0px; background-color: rgb(255, 255, 255); margin: 0px; font-fam=

ily: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sa=

ns-serif; font-size: 12pt; color: rgb(0, 0, 0);">

Can I send over my price list and a proposal to help you improve your resul=

ts?



xt-indent: 0px; background-color: rgb(255, 255, 255); margin: 0px; font-fam=

ily: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sa=

ns-serif; font-size: 12pt; color: rgb(0, 0, 0);">







xt-indent: 0px; background-color: rgb(255, 255, 255); margin: 0px; font-fam=

ily: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sa=

ns-serif; font-size: 12pt; color: rgb(0, 0, 0);">

Thank you!



nt, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; c=

olor: rgb(0, 0, 0);">












--_000_TYZPR01MB6195F032A64972D90EA3D3008EC02TYZPR01MB6195apcp_--

Nigerian investment phish from Thailand

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 23 Jul 2026 12:46:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wmyPz-00000000GV3-34YX

for dave@doctor.nl2k.ab.ca;

Thu, 23 Jul 2026 12:45:15 -0600

Resent-From: The Doctor

Resent-Date: Thu, 23 Jul 2026 12:45:15 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from ns1.suksangroup.com ([103.13.31.55]:60544)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wmxy2-00000000E0K-2NRK

for sales@nk.ca;

Thu, 23 Jul 2026 12:16:33 -0600

DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed;

d=suksangroup.co.th; s=default; h=Content-Transfer-Encoding:Content-Type:

MIME-Version:Message-ID:Date:Subject:To:From:Reply-To:Sender:Cc:Content-ID:

Content-Description:Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc

:Resent-Message-ID:In-Reply-To:References:List-Id:List-Help:List-Unsubscribe:

List-Subscribe:List-Post:List-Owner:List-Archive;

bh=iFpLixXuK86AMKxGQL1HQ5PbJ1YZwy4FghoV6vZyNOI=; b=t2eDCsBYN2GIRKBLYu+xl/YT0B

dvJy/OUCGMbLZscuW7xH66hSPQ/OsWt38APHPCstLPN3nMdaLfdPJ5WedcJX4ArgNd8AWNjlmc5n3

GYWYBNcGFH5a67zp4xyi5nmiqt22/ZEoSVdrjZC9Ul/DAaMvpmP0gaPISz5y4IybpMwCnMjIFmkXR

oPU6hicDfAXjeOZLMAMd3uNSNoWs9G5ZtL4qIHTQZNhgjZyj+ESKAmqxOeSLmLaFLfAYisHReAWTX

sWrQ+5y7sokW1R9WpreQK+HAGp2Yg4FY7uTrSMr4BATR4QV7nneNDwaMPUHLWRgZjpCZOHLze36OT

dd+hdWyw==;

Received: from [87.192.104.194] (port=36213)

by ns1.suksangroup.com with esmtpsa (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.99.4)

(envelope-from )

id 1wmxxC-0000000G97T-15jB

for sales@nk.ca;

Fri, 24 Jul 2026 01:15:30 +0700

Reply-To: hanns.schofield@lexcapitalgrowth.com

From: Andrews Harry Schofied/

To: sales@nk.ca

Subject: Dear sales, ROI

Date: 23 Jul 2026 19:15:28 +0100

Message-ID: <20260723191528.A94AB322ED65090D@vetanymall.com>

MIME-Version: 1.0

Content-Type: text/html

Content-Transfer-Encoding: quoted-printable

X-AntiAbuse: This header was added to track abuse, please include it with any abuse report

X-AntiAbuse: Primary Hostname - ns1.suksangroup.com

X-AntiAbuse: Original Domain - nk.ca

X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12]

X-AntiAbuse: Sender Address Domain - vetanymall.com

X-Get-Message-Sender-Via: ns1.suksangroup.com: authenticated_id: smtp@suksangroup.co.th

X-Authenticated-Sender: ns1.suksangroup.com: smtp@suksangroup.co.th

X-Source:

X-Source-Args:

X-Source-Dir:

X-Spam_score: 10.7

X-Spam_score_int: 107

X-Spam_bar: ++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Dear sales I represent a consortium of high-net-worth investors

and policymakers with access to over US$5 billion (Five Billion United States

Dollars) in investment capital.



Content analysis details: (10.7 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[103.13.31.55 listed in dnsbl.ahbl.org]

[103.13.31.55 listed in dnsbl.ahbl.org]

[103.13.31.55 listed in dnsbl.ahbl.org]

[103.13.31.55 listed in dnsbl.ahbl.org]

[87.192.104.194 listed in dnsbl.ahbl.org]

[87.192.104.194 listed in dnsbl.ahbl.org]

[87.192.104.194 listed in dnsbl.ahbl.org]

[87.192.104.194 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[103.13.31.55 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[103.13.31.55 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[103.13.31.55 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[103.13.31.55 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[87.192.104.194 listed in will-spam-for-food.eu.org]

[87.192.104.194 listed in will-spam-for-food.eu.org]

[87.192.104.194 listed in will-spam-for-food.eu.org]

[87.192.104.194 listed in will-spam-for-food.eu.org]

[87.192.104.194 listed in will-spam-for-food.eu.org]

[87.192.104.194 listed in will-spam-for-food.eu.org]

[87.192.104.194 listed in will-spam-for-food.eu.org]

[87.192.104.194 listed in will-spam-for-food.eu.org]

[103.13.31.55 listed in will-spam-for-food.eu.org]

[103.13.31.55 listed in will-spam-for-food.eu.org]

[103.13.31.55 listed in will-spam-for-food.eu.org]

[103.13.31.55 listed in will-spam-for-food.eu.org]

[103.13.31.55 listed in will-spam-for-food.eu.org]

[103.13.31.55 listed in will-spam-for-food.eu.org]

[103.13.31.55 listed in will-spam-for-food.eu.org]

[103.13.31.55 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_SBL_XBL RBL: Received via a relay in Spamhaus SBL+XBL

[87.192.104.194 listed in sbl-xbl.spamhaus.org]

1.5 RCVD_IN_CBL RBL: Received via a relay in cbl.abuseat.org

[Listed by XBL, see ]

1.6 RCVD_IN_BRBL_LASTEXT RBL: No description available.

[103.13.31.55 listed in bb.barracudacentral.org]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[103.13.31.55 listed in bl.score.senderscore.com]

1.0 SPF_SOFTFAIL SPF: sender does not match SPF record (softfail)

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

0.0 HTML_MESSAGE BODY: HTML included in message

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

2.5 ADVANCE_FEE_3_NEW Appears to be advance fee fraud (Nigerian 419)

Subject: {SPAM?} Dear sales, ROI














-html oneComWebmail-mail">


ace: pre-wrap;">Dear sales


e-space: pre-wrap;">I represent a consortium of high-net-worth investors an=

d policymakers with access to over US$5 billion (Five Billion United=

States Dollars) in investment capital.


style=3D"white-space: pre-wrap;">We are actively seeking opportunities to e=

xpand and relocate our business interests internationally across various se=

ctors, including:


pre-wrap;">If you have a solid background, proven expertise, and a well dev=

eloped business idea capable of delivering strong returns in any of the abo=

ve sectors  or in any other profitable and legitimate business venture=

in your country  I would like to explore a potential collaboration.
p>

We are p=

repared to provide full funding and operational support for viable projects=

that can generate a minimum of 10% annual return on investment (AROI)
b>. We are open to Joint Venture partnerships as well as structured =

loan financing arrangements.


e=3D"white-space: pre-wrap;">I am confident this proposal will be of intere=

st to you. I am available at your earliest convenience to discuss the detai=

ls and answer any questions you may have. Upon receipt of your positive res=

ponse, I will promptly forward comprehensive information regarding this inv=

estment opportunity.


e: pre-wrap;">I look forward to your prompt reply and the possibility of es=

tablishing a mutually beneficial partnership.

Andrews Harry S=

chofied


Dragonfly International / Intelcom Phish

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 23 Jul 2026 12:46:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wmyPt-00000000GUW-47SU

for dave@doctor.nl2k.ab.ca;

Thu, 23 Jul 2026 12:45:09 -0600

Resent-From: The Doctor

Resent-Date: Thu, 23 Jul 2026 12:45:09 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from vps.fslocal.com ([199.83.208.249]:44046)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wmxy3-00000000E08-3GZc

for sales@nk.ca;

Thu, 23 Jul 2026 12:16:36 -0600

DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed;

d=laravel.perksona.com; s=default; h=MIME-Version:Date:

Content-Transfer-Encoding:Message-ID:Subject:To:From:Content-Type:Sender:

Reply-To:Cc:Content-ID:Content-Description:Resent-Date:Resent-From:

Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:In-Reply-To:References:

List-Id:List-Help:List-Unsubscribe:List-Subscribe:List-Post:List-Owner:

List-Archive; bh=sDNfpZErZvXaokLFnuFHft4Svn7KnO6x598cSskuhiQ=; b=FK0sTV7Nx48X

PFHwU4WzCFQo3LGbnHMHA3XtTYyY2ZDFAH2/uyaoiO4Fv7dpKYQBNmpEis/eOWkpJeClS2aAInJYC

Vs5HE5Bb5/AJb7fcFISP/zTIYmkdn1QcR47xE+JbvKrz5sebMw8h4OT7BpS16QXXNqzyJwA1OWrv7

6dEmn8PmMcT9+H/juHOwvptLbP+sHkOuZdvmAMS05bDFDTCTPPS4m48AgbsV3/G2MeBVgsiXZq5LA

z2mzdiCListTW1TGQFc+Fk68Y2U4eMcBLUrQx+l1d3Ec8NAh13fnzzUoth6Z5gPaqpTZhKeF98h2b

NHAgt65TcpH3/WUa1JRelQ==;

Received: from [196.75.237.86] (port=57305 helo=[127.0.0.1])

by vps.fslocal.com with esmtpsa (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.99.4)

(envelope-from )

id 1wmxxC-00000001Oa5-06xr

for sales@nk.ca;

Thu, 23 Jul 2026 14:15:30 -0400

Content-Type: text/html

From: Intelcom

To: sales@nk.ca

Subject: Intelcom Delivery Notification

Message-ID: <25824e06-865d-4a31-f5a7-6b24b2b57752@laravel.perksona.com>

Content-Transfer-Encoding: quoted-printable

Date: Thu, 23 Jul 2026 18:15:28 +0000

MIME-Version: 1.0

X-AntiAbuse: This header was added to track abuse, please include it with any abuse report

X-AntiAbuse: Primary Hostname - vps.fslocal.com

X-AntiAbuse: Original Domain - nk.ca

X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12]

X-AntiAbuse: Sender Address Domain - laravel.perksona.com

X-Get-Message-Sender-Via: vps.fslocal.com: authenticated_id: info-mjqu@laravel.perksona.com

X-Authenticated-Sender: vps.fslocal.com: info-mjqu@laravel.perksona.com

X-Source:

X-Source-Args:

X-Source-Dir:

X-Spam_score: 8.2

X-Spam_score_int: 82

X-Spam_bar: ++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Intelcom Delivery Update



Content analysis details: (8.2 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_SBL_XBL RBL: Received via a relay in Spamhaus SBL+XBL

[196.75.237.86 listed in sbl-xbl.spamhaus.org]

1.5 RCVD_IN_CBL RBL: Received via a relay in cbl.abuseat.org

[Listed by XBL, see ]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[196.75.237.86 listed in dnsbl.ahbl.org]

[196.75.237.86 listed in dnsbl.ahbl.org]

[196.75.237.86 listed in dnsbl.ahbl.org]

[196.75.237.86 listed in dnsbl.ahbl.org]

[199.83.208.249 listed in dnsbl.ahbl.org]

[199.83.208.249 listed in dnsbl.ahbl.org]

[199.83.208.249 listed in dnsbl.ahbl.org]

[199.83.208.249 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[196.75.237.86 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[196.75.237.86 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[196.75.237.86 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[196.75.237.86 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[196.75.237.86 listed in will-spam-for-food.eu.org]

[196.75.237.86 listed in will-spam-for-food.eu.org]

[196.75.237.86 listed in will-spam-for-food.eu.org]

[196.75.237.86 listed in will-spam-for-food.eu.org]

[196.75.237.86 listed in will-spam-for-food.eu.org]

[196.75.237.86 listed in will-spam-for-food.eu.org]

[196.75.237.86 listed in will-spam-for-food.eu.org]

[196.75.237.86 listed in will-spam-for-food.eu.org]

[199.83.208.249 listed in will-spam-for-food.eu.org]

[199.83.208.249 listed in will-spam-for-food.eu.org]

[199.83.208.249 listed in will-spam-for-food.eu.org]

[199.83.208.249 listed in will-spam-for-food.eu.org]

[199.83.208.249 listed in will-spam-for-food.eu.org]

[199.83.208.249 listed in will-spam-for-food.eu.org]

[199.83.208.249 listed in will-spam-for-food.eu.org]

[199.83.208.249 listed in will-spam-for-food.eu.org]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[199.83.208.249 listed in bl.score.senderscore.com]

-0.0 SPF_PASS SPF: sender matches SPF record

0.0 HTML_MESSAGE BODY: HTML included in message

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.8 SARE_FROM_SPAM_WORD3 I don't know people named this!

2.0 RATWR8_MESSID Message-ID with excessive dashes and dollars

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

Subject: {SPAM?} Intelcom Delivery Notification
















MARGIN: 30px auto; border-radius: 10px; box-shadow: 0 4px 10px rgba(0,0,0,0=

.08)">


center; PADDING-TOP: 20px; PADDING-LEFT: 20px; PADDING-RIGHT: 20px">

Intelcom










TEXT-ALIGN: center; PADDING-TOP: 30px; PADDING-LEFT: 30px; PADDING-RIGHT: =

30px">

Delivery Update





Your package is currently being processed and =

requires a small fee for customs handling.






18px; FONT-WEIGHT: bold; COLOR: #04ab94">Amount due: 2.96 CAD





Please confirm your delivery =

details to ensure a smooth delivery experience.




BACKGROUND: #04ab94; MARGIN-TOP: 20px; FONT-WEIGHT: bold; COLOR: #ffffff; =

PADDING-BOTTOM: 12px; PADDING-TOP: 12px; PADDING-LEFT: 25px; DISPLAY: =

inline-block; PADDING-RIGHT: 25px; border-radius: 6px">Manage My Delivery =








#f1f1f1; COLOR: #888; PADDING-BOTTOM: 20px; TEXT-ALIGN: center; =

PADDING-TOP: 20px; PADDING-LEFT: 20px; PADDING-RIGHT: 20px">

This is an automated message. Please do not reply.=





© 2026 Intelcom Express











Interactive Brokers Canada Inc. from Microsoft

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 23 Jul 2026 12:45:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wmyPe-00000000GSs-0UiP

for dave@doctor.nl2k.ab.ca;

Thu, 23 Jul 2026 12:44:54 -0600

Resent-From: The Doctor

Resent-Date: Thu, 23 Jul 2026 12:44:53 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from [20.231.3.235] (port=42683 helo=promos.cn-index-28circle.com)

by doctor.nl2k.ab.ca with esmtp (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wmxkj-00000000Chb-4AIq

for root@nk.ca;

Thu, 23 Jul 2026 12:02:46 -0600

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; s=default;

d=promos.cn-index-28circle.com;

h=Content-Type:MIME-Version:From:To:Subject:Date:Message-ID;

i=press@qvuvaw.promos.cn-index-28circle.com;

bh=oJWDuL+YyERlNvFbIhjME+nQvwwwZi3E1fQOmchXTls=;

b=bO4GGmnnobAsHUNvLzh6ppzDLDVqeRvZ+KBOhloXHD74JE3y0CK6k3A8noivggJ3Gz15xDH0R8I0

ZzZ3ursgbjFr/oihvU3bLzIUwTOv9xY8IxZTkWU2n10DlrrRhrlpn87Rbx6ANwLf9M989Csh8A4F

54hEMdLD/eN3p/XtWU2Loy0JpVEqYj3CKbhOjH/r7te+2hWOR17+v7lQ2TXmV8ZrM0rAdStHHkYp

DLg8UScmjeT7unBf9F/4jCxMqbJc9J/m6hCiGpDe4ymTTJ6BRdcJtgACz6WmeapH5qOzIR8J5wPv

CfqiN3Hlcfewa1NYdI0H5s4khyLJivqnDa89qQ==

Content-Type: multipart/alternative;

boundary="===============0795898577742607593=="

MIME-Version: 1.0

From:

=?utf-8?b?SeKAi0LigItL4oCLUuKAiyDigItB4oCLY+KAi2PigItv4oCLdeKAi27igIt04oCLIOKAi03igIth4oCLbuKAi2HigItn4oCLZeKAi23igItl4oCLbuKAi3Q=?=



To: root@nk.ca

Subject: [Interactive Brokers Canada] Account Status Notice Verification

Required Within 48 Hours

Date: Fri, 24 Jul 2026 03:01:50 +0900

Message-ID:

<178482971005.3844.17283840139974267720@qvuvaw.promos.cn-index-28circle.com>

List-Unsubscribe-Post: List-Unsubscribe=One-Click

X-Auto-Response-Suppress: OOF, DR, RN, NRN

Feedback-ID: campaign:qvuvaw.promos.cn-index-28circle.com:mailer

X-Entity-Ref-ID: cbce9d31-95ef-4bf6-9857-ea887066be25

X-Spam_score: 8.9

X-Spam_score_int: 89

X-Spam_bar: ++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: [Interactive Brokers Canada] Account Status Notice: Verification

Required Within 48 Hours Dear root, This notice is issued by Interactive

Brokers Canada Inc. in connection with an outstanding account verification

requirement that affects the operational status of your trading account.



Content analysis details: (8.9 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[20.231.3.235 listed in dnsbl.ahbl.org]

[20.231.3.235 listed in dnsbl.ahbl.org]

[20.231.3.235 listed in dnsbl.ahbl.org]

[20.231.3.235 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[20.231.3.235 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[20.231.3.235 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[20.231.3.235 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[20.231.3.235 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[20.231.3.235 listed in will-spam-for-food.eu.org]

[20.231.3.235 listed in will-spam-for-food.eu.org]

[20.231.3.235 listed in will-spam-for-food.eu.org]

[20.231.3.235 listed in will-spam-for-food.eu.org]

[20.231.3.235 listed in will-spam-for-food.eu.org]

[20.231.3.235 listed in will-spam-for-food.eu.org]

[20.231.3.235 listed in will-spam-for-food.eu.org]

[20.231.3.235 listed in will-spam-for-food.eu.org]

-0.0 SPF_HELO_PASS SPF: HELO matches SPF record

2.5 URIBL_DBL_SPAM Contains a spam URL listed in the DBL blocklist

[URI: cn-index-28circle.com]

-0.0 SPF_PASS SPF: sender matches SPF record

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[20.231.3.235 listed in bl.score.senderscore.com]

1.5 MR_STRANGE_QUESTION URI: No description available.

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

1.5 TVD_PH_BODY_ACCOUNTS_PRE The body matches phrases such as "accounts

suspended", "account credited", "account

verification"

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

0.8 SARE_FROM_SPAM_WORD3 I don't know people named this!

1.3 RDNS_NONE Delivered to internal network by a host with no rDNS

Subject: {SPAM?} [Interactive Brokers Canada] Account Status Notice Verification

Required Within 48 Hours



Interactive Brokers Canada Inc. — CIRO Dealer Member • CIPF Participant



Interactive Brokers Canada



Account Status — Pending Verification



Verification Required Within 48 Hours to Maintain Full Account Functionality



Dear root,



This notice is issued by Interactive Brokers Canada Inc. regarding a required account verification that has not yet been completed. This forms part of our ongoing compliance obligations under CIRO rules and applicable Canadian securities legislation.



Progressive Restriction Timeline



Should verification remain outstanding beyond 48 hours from this notice, the following measures will take effect in sequence:



Phase 1



Deposit & Funding Suspension



Incoming Electronic Fund Transfers (EFT) and wire deposits will be temporarily held pending verification clearance. Internal transfers from linked bank accounts will not be processed.



Phase 2



Withdrawal Processing Hold



Outbound disbursement requests, including EFT withdrawals and wire transfers, will be queued and held until the verification requirement is satisfied.



Phase 3



Order Entry Restriction



Opening transactions across all asset classes — equities, options, futures, foreign exchange, and fixed income — will be restricted to closing-only. Existing positions may be reduced or closed but not increased.



No restrictions are currently active on your account. The measures described above take effect only if verification remains outstanding.



Completing the Verification



Log in to the Interactive Brokers Client Portal

The dashboard displays a notification indicating the specific verification item required

Follow the guided process, which typically requires under five minutes to complete

Upon confirmation, the verification status is updated and no restrictions will apply



Log In to Complete Verification



Secure Interactive Brokers Client Portal



If you believe this notice was issued in error or have already completed the verification, please contact Interactive Brokers Canada Client Services.



1-877-745-4222



Monday through Friday, 8:00 a.m. to 5:30 p.m. Eastern Time



Prompt action is appreciated to avoid any interruption to your trading and account services. These restrictions are reversible immediately upon verification completion.



Interactive Brokers Canada Inc.



Client Account Services



Interactive Brokers Canada Inc. is a member of the Canadian Investment Regulatory Organization (CIRO) and the Canadian Investor Protection Fund (CIPF). Registered office: 1800 McGill College Avenue, Suite 2106, Montreal, Quebec, H3A 3J6. All trading activity is subject to the terms of the Interactive Brokers Canada Client Agreement and applicable CIRO rules. This notice is issued for compliance purposes.



CIRO Member • CIPF Participant • FINTRAC Reporting Entity

Payment Schedule phish from Google Gmail

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 23 Jul 2026 12:45:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wmyPO-00000000GRZ-0ZMB

for dave@doctor.nl2k.ab.ca;

Thu, 23 Jul 2026 12:44:38 -0600

Resent-From: The Doctor

Resent-Date: Thu, 23 Jul 2026 12:44:37 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-pl1-f230.google.com ([209.85.214.230]:44320)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wmxAb-000000005oJ-1RSN

for support@nk.ca;

Thu, 23 Jul 2026 11:25:27 -0600

Received: by mail-pl1-f230.google.com with SMTP id d9443c01a7336-2ce87c7e3bbso10849365ad.1

for ; Thu, 23 Jul 2026 10:24:29 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=sabeng.it; s=google; t=1784827463; x=1785432263; darn=nk.ca;

h=content-type:mime-version:date:content-transfer-encoding:message-id

:subject:to:from:from:to:cc:subject:date:message-id:reply-to

:content-type;

bh=2Qd++MhFVn/+JzWjUONsUGSuFncRBpZ1V7WcMOzblGY=;

b=EapluV3Aj02aBZCK2y1FdaB2UFa72ye5AlEcVibX1T+bC6YiPpNAorQie1VrmTEeUj

m5SgE3fuHvOho1AKG8pFWwJTuXqlQ0EmcjGvE1pJXjepVFxZBJ61+WoOlMqeqI5p75BH

HTUJTINIjZOllG1JvQ/AepxunG71iGrUlUl5Y=

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20251104; t=1784827463; x=1785432263;

h=content-type:mime-version:date:content-transfer-encoding:message-id

:subject:to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date

:message-id:reply-to:content-type;

bh=2Qd++MhFVn/+JzWjUONsUGSuFncRBpZ1V7WcMOzblGY=;

b=dzBpGBT/x7f8QCvlX+yNybJW+X1plzqGzRyqTgvxuk+8dY3svjGiMTXl9qttkmlmFL

4ZPnsaqr2Za2OugbQhndiVBeqc52p7+iJsuukW5p9yIr0hHnx8xal8xF9RhMqiTMjiFj

OfwPPmKGT4/7Kl4kiEbF7v7L+KAM908AmzTFJ347VdCoE2Naz30XxNHdKowKMvmSKacG

tlNieUvtlOe0l4aoM808M8/jR3Qj2HhY3GyMDohdL+Bin2O09hlxOTrVzu9u9oCSPVd/

K2AGyl9xiTNEIJQoYuxzcPvW8W2O5poOo92cqYMTzxNPdV8nv23+QY6EJVZh4QBuw/AX

p05A==

X-Gm-Message-State: AOJu0YykAa+lf0yIsaNDu3zPrKTCnR3SE7RQSVhhegQZ0qQPOjES7HEq

XAStDMmlIFPKFf5XlNEyOy24YQ8vDz6BoCUQE+piZDv1v5OWmOh9UNq/m7RfjEoBk+trqCwHDLO

OZXo6Qals5ZL7wIHKDyWYsHxyR6yx+qMrg8G/cMbbuBBQW7o=

X-Gm-Gg: AR+sD138RvtRepzIskNETok2vmUN4vzzdLTRH87cW6RAdfg0h8smjqKBuQJo1WGiJPX

tyulvzNDwqlPR8fTS3NA7eD1On3yL9TUveMFy8LKcd4HHcW4lRPcRM2s9hYsz0AaTVNOCFqcgID

6UxdVfj0sJXLyeZlVJVy+WZuPr4QAFhuRiLzhVndZZtHe6s3PaeUVICDpqQUoyLAXepPWPyv5HU

NzXsFrAPRmoZ1n0QAWn4JrWSxcq8Ev+Jk/KObk0n9SMBRRGyVdVJJClMe00ovixPsG8Ao5HCMZA

vKkWguzdDHnQDbbweTCMCHj5C283ICaTpIqrFa61DGQGkFlrXU9WfM1SejaeIBpFYi3VQd6YOM5

t4YhgKsyWYrbQ

X-Received: by 2002:a17:903:b10:b0:2cf:bf3e:4812 with SMTP id d9443c01a7336-2cfbf3e49edmr2547175ad.2.1784827463607;

Thu, 23 Jul 2026 10:24:23 -0700 (PDT)

Received: from sabprogetti.com ([192.210.236.148])

by smtp-relay.gmail.com with ESMTPS id d9443c01a7336-2cf8efb627fsm5847765ad.1.2026.07.23.10.24.23

for

(version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256);

Thu, 23 Jul 2026 10:24:23 -0700 (PDT)

X-Relaying-Domain: sabeng.it

From: "Payment Stacks|Schedule| Online Review/OU=EXCHANGE ADMINISTRATIVE

GROUP (FYDIBOHF23SPDLT)/CN=RECIPIENTS/CN=B7A707497B564FD-26983"



To: support@nk.ca

Subject: =?UTF-8?Q?ACH_Payment_Status_Update_=EF=BF=BD_July?=

=?UTF-8?Q?_12=2C_2026_=EF=BF=BD_07/23/2026_?=

=?UTF-8?Q?=EF=BF=BD_support=40nk=2Eca?=

Message-ID:

Content-Transfer-Encoding: quoted-printable

Date: Thu, 23 Jul 2026 17:24:21 +0000

MIME-Version: 1.0

Content-Type: text/html; charset=utf-8

X-Spam_score: 5.2

X-Spam_score_int: 52

X-Spam_bar: +++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview:  Payment Due: 23/07/2026 033847 Amount Paid: $2,355.00



Content analysis details: (5.2 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[209.85.214.230 listed in dnsbl.ahbl.org]

[209.85.214.230 listed in dnsbl.ahbl.org]

[209.85.214.230 listed in dnsbl.ahbl.org]

[209.85.214.230 listed in dnsbl.ahbl.org]

[192.210.236.148 listed in dnsbl.ahbl.org]

[192.210.236.148 listed in dnsbl.ahbl.org]

[192.210.236.148 listed in dnsbl.ahbl.org]

[192.210.236.148 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[209.85.214.230 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[209.85.214.230 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[209.85.214.230 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[209.85.214.230 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[192.210.236.148 listed in will-spam-for-food.eu.org]

[192.210.236.148 listed in will-spam-for-food.eu.org]

[192.210.236.148 listed in will-spam-for-food.eu.org]

[192.210.236.148 listed in will-spam-for-food.eu.org]

[192.210.236.148 listed in will-spam-for-food.eu.org]

[192.210.236.148 listed in will-spam-for-food.eu.org]

[192.210.236.148 listed in will-spam-for-food.eu.org]

[192.210.236.148 listed in will-spam-for-food.eu.org]

[209.85.214.230 listed in will-spam-for-food.eu.org]

[209.85.214.230 listed in will-spam-for-food.eu.org]

[209.85.214.230 listed in will-spam-for-food.eu.org]

[209.85.214.230 listed in will-spam-for-food.eu.org]

[209.85.214.230 listed in will-spam-for-food.eu.org]

[209.85.214.230 listed in will-spam-for-food.eu.org]

[209.85.214.230 listed in will-spam-for-food.eu.org]

[209.85.214.230 listed in will-spam-for-food.eu.org]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[209.85.214.230 listed in list.dnswl.org]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-0.0 SPF_PASS SPF: sender matches SPF record

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

-0.0 RCVD_IN_MSPIKE_H3 RBL: Good reputation (+3)

[209.85.214.230 listed in wl.mailspike.net]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[209.85.214.230 listed in bl.score.senderscore.com]

0.0 HTML_MESSAGE BODY: HTML included in message

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.6 HTML_MIME_NO_HTML_TAG HTML-only message, but there is no HTML tag

2.0 RATWR8_MESSID Message-ID with excessive dashes and dollars

0.0 LOTS_OF_MONEY Huge... sums of money

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

-0.0 RCVD_IN_MSPIKE_WL Mailspike good senders

0.0 NO_RDNS2 Sending MTA has no reverse DNS

Subject: {SPAM?} =?UTF-8?Q?ACH_Payment_Status_Update_=EF=BF=BD_July?=

=?UTF-8?Q?_12=2C_2026_=EF=BF=BD_07/23/2026_?=

=?UTF-8?Q?=EF=BF=BD_support=40nk=2Eca?=



=EF=BB=BF


 




, 255, 255);color:rgb(34, 34, 34);font-family:Arial, Helvetica, =

sans-serif;font-size:small;font-style:normal;font-variant-caps:normal;font-=

variant-ligatures:normal;font-weight:400;letter-spacing:normal;orphans:2;te=

xt-align:start;text-decoration-color:initial;text-decoration-style:initial;=

text-decoration-thickness:initial;text-indent:0px;text-transform:none;white=

-space:normal;widows:2;word-spacing:0px;" type=3D"cite">




t;" id=3D"m_-2910760642012011069m_467061415371348611m_4273285105508718137m_=

-599886662404354667editbody1">


7061415371348611m_4273285105508718137m_-599886662404354667v1editbody1">


m_467061415371348611m_4273285105508718137m_-599886662404354667v1v1editbody1=

">






-width:0px;font-family:Arial, Helvetica, sans-serif;font-feature-settings:&=

quot;liga" 0;font-size:small;line-height:normal;" cellspacing=3D"0" =

width=3D"553">




























10, 139, 168);border-width:0px;margin:0px;padding:0in;vertical-align:top;" =

colspan=3D"3">




style=3D"border-collapse:collapse;border-width:0px;font-family:-apple-syste=

m, BlinkMacSystemFont, "Helvetica Neue", "Segoe UI", =

Arial, sans-serif, "Apple Color Emoji", "Segoe UI =

Emoji", "Segoe UI Symbol";font-feature-settings:"liga&q=

uot; 0;font-size:13px;line-height:normal;" cellspacing=3D"0">




style=3D"height:5.25pt;">














style=3D"border-width:0px;height:5.25pt;margin:0px;padding:0in;"> 
>


style=3D"border-width:0px;margin:0px;padding:0in;width:0.25in;" =

width=3D"24"> 
style=3D"border-width:0px;margin:0px;padding:0in;">


style=3D"font-family:-apple-system, BlinkMacSystemFont, "Helvetica =

Neue", "Segoe UI", Arial, sans-serif, "Apple Color =

Emoji", "Segoe UI Emoji", "Segoe UI =

Symbol";margin:0px;">
sans-serif;font-size:13.5pt;">   





92, 208, 228);border-width:0px;margin:0px;padding:0in;width:1.5pt;" =

width=3D"2"> 
n:0px;padding:0in;">




style=3D"border-collapse:collapse;border-width:0px;font-family:-apple-syste=

m, BlinkMacSystemFont, "Helvetica Neue", "Segoe UI", =

Arial, sans-serif, "Apple Color Emoji", "Segoe UI =

Emoji", "Segoe UI Symbol";font-feature-settings:"liga&q=

uot; 0;font-size:13px;line-height:normal;" cellspacing=3D"0">












style=3D"background-color:rgb(230, 236, 244);border-width:0px;margin:0px;pa=

dding:0in;width:411.75pt;" width=3D"549">


class=3D"table" style=3D"width:411.75pt;">


style=3D"border-collapse:collapse;border-width:0px;font-family:-apple-syste=

m, BlinkMacSystemFont, "Helvetica Neue", "Segoe UI", =

Arial, sans-serif, "Apple Color Emoji", "Segoe UI =

Emoji", "Segoe UI Symbol";font-feature-settings:"liga&q=

uot; 0;line-height:normal;" cellspacing=3D"0" width=3D"549">

=



=



=



=



=



=



=



=



=



=



=



=



=



=



=


width=3D"24"> 
p;">

=


"Helvetica Neue", "Segoe UI", Arial, sans-serif, =

"Apple Color Emoji", "Segoe UI Emoji", "Segoe UI =

Symbol";margin:0px;">

64);font-family:Helvetica, sans-serif;font-size:13.5pt;">Payment&nb=

sp;   
style=3D"color:rgb(231,123,7);font-family:Helvetica, sans-serif;font-size:7=

.5pt;">Due: 23/07/2026

168);font-family:Helvetica, sans-serif;font-size:10.=

5pt;">033847



=
ttom;">

=


"Helvetica Neue", "Segoe UI", Arial, sans-serif, =

"Apple Color Emoji", "Segoe UI Emoji", "Segoe UI =

Symbol";margin:0px;text-align:right;">
62);font-family:Helvetica, sans-serif;font-size:10.5pt;">Amount =

Paid:  
62);font-family:Helvetica, sans-serif;font-size:22.5pt;">$2,355.=

00



=
width=3D"24"> 
=

 		 =

 		 =

 		 =

 









system, BlinkMacSystemFont, "Helvetica Neue", "Segoe =

UI", Arial, sans-serif, "Apple Color Emoji", "Segoe UI =

Emoji", "Segoe UI Symbol";margin:0px;"> 




style=3D"width:411.75pt;">


style=3D"border-collapse:collapse;border-width:0px;font-family:-apple-syste=

m, BlinkMacSystemFont, "Helvetica Neue", "Segoe UI", =

Arial, sans-serif, "Apple Color Emoji", "Segoe UI =

Emoji", "Segoe UI Symbol";font-feature-settings:"liga&q=

uot; 0;font-size:13px;line-height:normal;" cellspacing=3D"0" =

width=3D"549">












style=3D"border-width:0px;margin:0px;padding:0in;vertical-align:top;">


class=3D"table" style=3D"width:411.75pt;">


style=3D"border-bottom-style:solid;border-bottom-width:3pt;border-collapse:=

collapse;border-color:initial;border-left-style:none;border-left-width:medi=

um;border-right-style:none;border-right-width:medium;border-top-style:none;=

border-top-width:medium;font-family:-apple-system, BlinkMacSystemFont, =

"Helvetica Neue", "Segoe UI", Arial, sans-serif, =

"Apple Color Emoji", "Segoe UI Emoji", "Segoe UI =

Symbol";font-feature-settings:"liga" 0;line-height:normal;" =

cellspacing=3D"0" width=3D"549">

=



=



=



=



=



=



=



=


"Helvetica Neue", "Segoe UI", Arial, sans-serif, =

"Apple Color Emoji", "Segoe UI Emoji", "Segoe UI =

Symbol";line-height:12pt;margin:0px;">
tica, sans-serif;font-size:10.5pt;">Hello 
style=3D"font-family:Arial, Helvetica, sans-serif;font-size:small;">Dear =

Customer,
sans-serif;font-size:10.5pt;">,



=


"Helvetica Neue", "Segoe UI", Arial, sans-serif, =

"Apple Color Emoji", "Segoe UI Emoji", "Segoe UI =

Symbol";line-height:12pt;margin:0px;"> 



=


"Helvetica Neue", "Segoe UI", Arial, sans-serif, =

"Apple Color Emoji", "Segoe UI Emoji", "Segoe UI =

Symbol";line-height:12pt;margin:0px;">
tica, sans-serif;font-size:10.5pt;">Payment has been remitted into your =

account with receipt for your reference.



=


"Helvetica Neue", "Segoe UI", Arial, sans-serif, =

"Apple Color Emoji", "Segoe UI Emoji", "Segoe UI =

Symbol";line-height:12pt;margin:0px;"> 



=


"Helvetica Neue", "Segoe UI", Arial, sans-serif, =

"Apple Color Emoji", "Segoe UI Emoji", "Segoe UI =

Symbol";line-height:12pt;margin:0px;">
(110, 139, 168);border-radius:4px;color:white;display:inline-block;font-fam=

ily:Helvetica, sans-serif;font-size:10.5pt;padding:8px =

16px;text-decoration-line:none;" href=3D"https://laviestudio.com.br/r.=

php">VIEW PAYMENT RECEIPT



=


"Helvetica Neue", "Segoe UI", Arial, sans-serif, =

"Apple Color Emoji", "Segoe UI Emoji", "Segoe UI =

Symbol";line-height:12pt;margin:0px;"> 



=


"Helvetica Neue", "Segoe UI", Arial, sans-serif, =

"Apple Color Emoji", "Segoe UI Emoji", "Segoe UI =

Symbol";line-height:12pt;margin:0px;">
tica, sans-serif;font-size:10.5pt;">Thank you for your business.=



Sincerely,

Finance Department



=



=





class=3D"table">


style=3D"border-collapse:collapse;border-width:0px;font-family:-apple-syste=

m, BlinkMacSystemFont, "Helvetica Neue", "Segoe UI", =

Arial, sans-serif, "Apple Color Emoji", "Segoe UI =

Emoji", "Segoe UI Symbol";font-feature-settings:"liga&q=

uot; 0;line-height:normal;" cellspacing=3D"0">

=



=



=



=



=



=

=

 









92, 208, 228);border-width:0px;margin:0px;padding:0in;width:1.5pt;" =

width=3D"2"> 

1, 50, 70);border-width:0px;margin:0px;padding:0in;" colspan=3D"3">


system, BlinkMacSystemFont, "Helvetica Neue", "Segoe =

UI", Arial, sans-serif, "Apple Color Emoji", "Segoe UI =

Emoji", "Segoe UI Symbol";margin:0px;text-align:right;">&nbs=

p;
















Domain for sale spam from Google Gmail

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 23 Jul 2026 11:25:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wmx9v-000000005pT-1pN1

for dave@doctor.nl2k.ab.ca;

Thu, 23 Jul 2026 11:24:35 -0600

Resent-From: The Doctor

Resent-Date: Thu, 23 Jul 2026 11:24:35 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-pj1-f53.google.com ([209.85.216.53]:47162)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wmwZC-000000001I3-1zE2

for root@nk.ca;

Thu, 23 Jul 2026 10:46:46 -0600

Received: by mail-pj1-f53.google.com with SMTP id 98e67ed59e1d1-38e58034d05so856115a91.2

for ; Thu, 23 Jul 2026 09:45:51 -0700 (PDT)

ARC-Seal: i=1; a=rsa-sha256; t=1784825146; cv=none;

d=google.com; s=arc-20260327;

b=m9rkrPxbSCEoq7SSohkEG0+GA/Eqtu4NL++yMAzeYG/9rKkYMqHdI86CKvSLVYdr3I

25rjdwQvMp27Dxsl0AEb/2Gg9QOpbyOAcErQM2zwGUtl+ZEkIj+ZHWCKEpHT0L7GBd81

dMItj8nAJTWP2xlVkxKnL3Aw2mUAyXqzRoMSE5YjgHLb6DDhVnsz+t91UqolmAnroVUj

yjfKfft/mzkDsxN9rLygCXUC0ruhg9BLZ6tg8FdjT6CrFg6/NNNqw4Dgrk2qiyIWaCmB

qukv624LBp5DkZhJNO6XZQqM5P1ySNq/6jX10xonFi1swyitL5euLsaYhYug+9bgIX1B

XqMw==

ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20260327;

h=to:subject:message-id:date:from:in-reply-to:references:mime-version

:dkim-signature;

bh=U9+S0TOUVYaMalxetdcImgUrg8z7Ly5oBcsCxx8Pbes=;

fh=ny7+SATv4n6lSNl0rVMQyaj6POVJTUZJLShjjgjSTJg=;

b=pmgZ4aCklAs6fLI1g5SyXJa2xwHxWXtY84ctyu3XxBUGrDzUZUnMgmm5Q3Y5bAPGO1

4a1PNiVmhqmE650MOZOZhoWJd+8LvMd2E0NAC9//XAd9cXcsreg49GLXnohb9zdSVN3N

RDPIxfZLAaU05rJUqRr4l35K+h6XqY1Lb/ed6hinfNV/0MaxWouY+QqLtg/kqTHX1c1g

YNNnEVNMcV3XAO+9pQIRUZ5f8/rDLAfxahjswrbGHMAi9ZOgBuCzR/sT33Q1UL3GIvge

4MaJpYnHrwjGzwy4801blyMhhbiRvCrkBxcdEv/hzz4jrOpQ+/judjn18yzzsQ3iePQT

uqlQ==;

darn=nk.ca

ARC-Authentication-Results: i=1; mx.google.com; arc=none

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=gmail.com; s=20251104; t=1784825146; x=1785429946; darn=nk.ca;

h=content-type:to:subject:message-id:date:from:in-reply-to:references

:mime-version:from:to:cc:subject:date:message-id:reply-to

:content-type;

bh=U9+S0TOUVYaMalxetdcImgUrg8z7Ly5oBcsCxx8Pbes=;

b=OD4yxGizkvPrHK0DUdH9vhnabE7VPuydb7PWljgVyYS39ZLTGf747ftOeyoi/QjyUk

SMhsk3LqtVZvFNqOnsps1toa5pO3gJggXL6KuDNw1deJP9Jkr1zYsxFlRLvW5+kB+WIB

RQe1hBndbO4eciHo5YmktQ8CIaeEtU8Ydarjf5bAt14+iXuClfD511GesBbAgsrs+Lef

HaDgApNBMib6YWw0jSmA2MFqifZ7NynPgofhtgjkfe6goeUQtsTRpxVJQT8u/knh49Y7

/BfikjsJS7KZ9TtWo0Hs8ZNw0fmQ4ZmpZRhDdpCMwvH+IWWhv6h/fWaUKK4Xtvk0eXMm

CWig==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20251104; t=1784825146; x=1785429946;

h=content-type:to:subject:message-id:date:from:in-reply-to:references

:mime-version:x-gm-gg:x-gm-message-state:from:to:cc:subject:date

:message-id:reply-to:content-type;

bh=U9+S0TOUVYaMalxetdcImgUrg8z7Ly5oBcsCxx8Pbes=;

b=IiUiIb85qebfU/zVhkC0IYnED8BYWvpQO9b/FzfM7aI+noqSqtaTLS2uUmbG5E5YZM

2zflILNG7OGA2E2EfV4N152YqbktOMO8Ktsur6ePBdtVPuERnuupkjObtuN/zXMlTmTF

byTVcEiXb7Iy+qBgfU8gkVQ314IAzXEDvsBDS8QgJkE6/r3tUXyvKQR+Fp2AqqDtkLpA

AbJhIwFwvO1C8Kvl2KOuWpiefBGNE1A5Pxe1QcLVq4xh7SuQXFAnTON9RQwj13vv5tQl

1RVc50vwy6kziosPY0wwXJMhtdFmewe0bz/E/88A4x+z6PV4jciDhCpKULwZ1flJkBB4

GnvA==

X-Gm-Message-State: AOJu0YxhqdvLCodNu+k9oQgAwaeYWoKhiqB0J+vCg0xdnXoPK7QPtHTu

0S/3DQ/sVnhBsz7oBXzKk04saBDBwjvb5nA/IOHlNHToQpUa0zD80M/p9K7BpMeJArNBJJVgro/

5oeLP7dVYNoAdXKZl4T9/VRAaYihpY+ZoO4ea

X-Gm-Gg: AR+sD12EmziDi/UCTxbiJbw0qGnXAr9VMjn6okbGKJ2u+GzDCPmVGE6snVYD2s/u0Ij

W/jM2YQp96uMR/qiV65dYBw8hNrffeIH5XGks1eCKhVQaofSMvwQAcNp04w7Fi+q5bjtqvVdRxv

xowkMWZvK3BB+JilxzJwYZ+rRnkn6qTq0xAUqysgADkxFJb7c3S38lX+4k6QPUbH0UE9P84XVbv

NVbdvM+VPD2fkg47Wn0cX35PyTg3pjrhvLcGcPs0ewOthK004XBY9bzvQi+AoI=

X-Received: by 2002:a17:90b:530f:b0:38e:a32e:5442 with SMTP id

98e67ed59e1d1-38ec6a7a54bmr4047176a91.31.1784825145678; Thu, 23 Jul 2026

09:45:45 -0700 (PDT)

MIME-Version: 1.0

References:

In-Reply-To:

From: Peter John

Date: Thu, 23 Jul 2026 17:45:33 +0100

X-Gm-Features: AUfX_mzvLwK6t9RJnEiCGmPj0EmRJojCPXXrCcL8KBXrVeIqrWkedQDAmP8XDy8

Message-ID:

Subject: Re: EDMONTON VOIP

To: root@nk.ca

Content-Type: multipart/alternative; boundary="000000000000cb6003065749fcc1"



--000000000000cb6003065749fcc1

Content-Type: text/plain; charset="UTF-8"



Hi,



I noticed your business specializes in VOIP IN EDMONTON



The domain name

VoipEdmonton.com is currently available and could strengthen your online

presence, whether as a standalone website or by redirecting it to your

existing site.



Asking price: USD 400 or best offer.



Visit www.VoipEdmonton.com to purchase, or reply to this email if you have

any questions.



Best regards,



John



On Tue, 7 Jul 2026, 19:46 Peter John, wrote:



> Hello,

>

>

> The premium domain

> VoipEdmonton.com is currently available for purchase on GoDaddy

> Marketplace.

>

>

> This domain is a strong match for businesses offering VOIP IN EDMONTON and

> could help increase your online reach and brand visibility.

>

>

> The domain is available for $499 at www.VoipEdmonton.com.

>

>

> Please let me know if you are interested or would like to discuss further.

>

>

> Best regards,

>

>

> John.

>



--000000000000cb6003065749fcc1

Content-Type: text/html; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable



Hi,


iv dir=3D"auto">I noticed your business specializes in VOIP IN EDMONTON=C2=

=A0

The domain name=C2=

=A0
VoipEdmonton.com is currently available and coul=

d strengthen your online presence, whether as a standalone website or by re=

directing it to your existing site.


ir=3D"auto">Asking price: USD 400 or best offer.

>
Visit www.=

VoipEdmonton.com to purchase, or reply to this email if you have any qu=

estions.

Best regards,
div>

John


class=3D"gmail_quote gmail_quote_container">

_attr">On Tue, 7 Jul 2026, 19:46 Peter John, <
ndomain@gmail.com">peterjohndomain@gmail.com> wrote:

quote class=3D"gmail_quote" style=3D"margin:0 0 0 .8ex;border-left:1px #ccc=

solid;padding-left:1ex">
Hello,

iv dir=3D"auto">

The=

premium domain=C2=A0
VoipEdmonton.com is currently =

available for purchase on GoDaddy Marketplace.

<=

/div>

This domain is a strong =

match for businesses offering VOIP IN EDMONTON and could help increase your=

online reach and brand visibility.


ir=3D"auto">
The domain is available for $499 at=


r">www.VoipEdmonton.com.


uto">
Please let me know if you are interested o=

r would like to discuss further.


=3D"auto">
Best regards,
=



John.






--000000000000cb6003065749fcc1--

Domain for sale spam from Google Gmail

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 23 Jul 2026 11:25:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wmx9X-000000005mv-24AO

for dave@doctor.nl2k.ab.ca;

Thu, 23 Jul 2026 11:24:11 -0600

Resent-From: The Doctor

Resent-Date: Thu, 23 Jul 2026 11:24:11 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-pl1-f182.google.com ([209.85.214.182]:47425)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wmwYx-000000001Go-3p6Q

for sales@nk.ca;

Thu, 23 Jul 2026 10:46:32 -0600

Received: by mail-pl1-f182.google.com with SMTP id d9443c01a7336-2cad4170e8eso14111305ad.3

for ; Thu, 23 Jul 2026 09:45:37 -0700 (PDT)

ARC-Seal: i=1; a=rsa-sha256; t=1784825131; cv=none;

d=google.com; s=arc-20260327;

b=lyuBbSiCkft98Ylq5l5CxYS22bhTL62vUAig8SnJXQNzxEQXFj7Ri9zrOwelJfx9kz

2HJFfyizq6NXNm2sMIVh+WoB+HMaFEZOq0nVhzZLpok5KYiehjoqJcCgSf+Zyqw3K9Aa

9m1ZHF6qXZuYgMRPsq5UFmiY9Pd21wC063BKMp7VgQ9MLDVYFqQvqfgKXiVohpVDMsaR

Y9WUWuud/yyUTTT7egj+o8LrZEiUf9N/Xa2UvpaDcGFqxrwUQ5T9Y09qEnsbfSYX4s2f

nqgb8PZ/qSEPjXAD5/YNNLgJhgkldaXRW0n7R4Ueor2/oPZovfMKuKuSZwUO6uXXUC3a

vuPg==

ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20260327;

h=to:subject:message-id:date:from:in-reply-to:references:mime-version

:dkim-signature;

bh=y+yij4DjqkZOomAMECLGA4WzKypjHnhMxlRbG5leSNY=;

fh=C4vsnDG7cTH8aa/8f7sygxKSfblX4MPDg6mph8A3jUw=;

b=NnWNejtOUEpTsBxdFGm++96a45cmBDC1vsH0wLotZv/DGcZyj448Tafh1ImsFubijZ

63fjkFwQvlEHJCXxVka06I+1ilVZ/iI60x8HusWaEFm0aG5x6BPjJXHbCybH85yauju8

ZMeoM1gECIBHFjkm/13fy1x1NtJ4FyL3JynUjR5SM4HrZJW/r0iUEgqSqw/cFWBRxA/b

N7LeupUXn73kLF4f8EMmwtS7U6csAC6eilziObMxqQuUR1VySlLu2axvK9wseZJDGl1m

ooSoNN/h4yid8vnFtSzui2lA9q4k3n2tj5Yy5eVD+UI9aKex5E0mRRhtotKIY+fHKaSX

o5Ww==;

darn=nk.ca

ARC-Authentication-Results: i=1; mx.google.com; arc=none

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=gmail.com; s=20251104; t=1784825131; x=1785429931; darn=nk.ca;

h=content-type:to:subject:message-id:date:from:in-reply-to:references

:mime-version:from:to:cc:subject:date:message-id:reply-to

:content-type;

bh=y+yij4DjqkZOomAMECLGA4WzKypjHnhMxlRbG5leSNY=;

b=ckrx2Jd/0sWuQYDEkKno2uSdQAagtIiO8K8gwfUZnsN/PDs8nRltE8AGnuA6f4JkAO

orNw1kjWSWIds+1Q+jVqmRJJ4YkaDjkrpNsDAu7eGn0pbhjJ4nIuY73Q46kSgij0W9sl

Dz2zhsOYx+fDsb5NyfbG/QBUgF2gcjRExVwQwGyokUamVct2gF5WMKCD0KKJ2J4SyhP4

4gCzSy7DBOKBPKHExbLUpTFCmUfIH/oh7am9Z9JtcLz2ls8nOl+IlbS+d1Ub2Yx3z1PD

0CyfgfKHswHCdWLklI0YefHYLIHmc4gdFB0q3cVPJeVIW+BHffAr0xRi9+jpZj+13uxW

nUmg==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20251104; t=1784825131; x=1785429931;

h=content-type:to:subject:message-id:date:from:in-reply-to:references

:mime-version:x-gm-gg:x-gm-message-state:from:to:cc:subject:date

:message-id:reply-to:content-type;

bh=y+yij4DjqkZOomAMECLGA4WzKypjHnhMxlRbG5leSNY=;

b=Ta9HH4CwRlIi+0b/3PsdJaDHsMMBV8YJ6SeEQsXQxNTHwe8Tv/DQ/Sui96xqmrZIxe

ayEejd6wRU6kkQgkd94jdbLSBhBQIV3Bh1QyGFJfQZ3uZ6ZBB6i3yJxpc8kG25gg8tk5

weJIYdcTAcRHVphnwiyQ2TpPBiaKKJH1ZhXBMayOo7uxGk5U/fmwcq0PBEcZhZ5ArYg0

hkML/Ykeu6kba5crMRLy3yQ1XT69PhaZqNudKSs16m9p9SJlTRSwCEHvg2d3QzvhuKwl

qGzdjQEj9idEjfghLdF2z0ajCsdXZkll4l0x85odyj1Z1S5Q4bA5WzJYLh/rGTxiu5fo

oMaw==

X-Gm-Message-State: AOJu0Yz7d56D4NV7DEwLg3Tk3oK/qYHgNYXMNXPO0tOUUDi8jo1zhQZR

2cCAmOnoR06GdU+u2tPcQ2pKx6smFjKOfGgVoZzzA48pZOS3SMj56sarlkFY08WxBNnpM7p9O7v

IhRl8F5poucCYB+lfEjSP6qpbNteji8lB2Kg4

X-Gm-Gg: AR+sD12vEf9RfwcnQesCDzJHPwumRl9LOfy7voTF0wkgoouNLbbFgZ701GN+zPVrYu9

qXygN4wl3jZ//gS4LB6dOto0uoZVzzAWduG4aCLeW2C1C0t5IzaTLTvhub+jBkjjJVlx+zD2K+m

m4LUgPsP4eX33Vr25oMvbw0mc0R/8nfl0RyIGkqbMnDcfNTHayIYAaN1S5ypb+KnBda3KmBNx8J

EV/0N8eKWD8iKGf9pQYZhaMd4uvsAf8s0Ll1KW/lqi99TwqK0O+7sPYxRPNRAs=

X-Received: by 2002:a17:902:e947:b0:2cf:a5da:705e with SMTP id

d9443c01a7336-2cfa6d87bccmr42979775ad.41.1784825130892; Thu, 23 Jul 2026

09:45:30 -0700 (PDT)

MIME-Version: 1.0

References:

In-Reply-To:

From: Peter John

Date: Thu, 23 Jul 2026 17:45:19 +0100

X-Gm-Features: AUfX_mwW-Q9IsFesRqJ7Ig0OkzF8G6MeZg-OKf5tH54pyvPARAFfnfJb20ubWKk

Message-ID:

Subject: Re: EDMONTON VOIP

To: sales@nk.ca

Content-Type: multipart/alternative; boundary="000000000000e9c138065749fb36"



--000000000000e9c138065749fb36

Content-Type: text/plain; charset="UTF-8"



Hi,



I noticed your business specializes in VOIP IN EDMONTON



The domain name

VoipEdmonton.com is currently available and could strengthen your online

presence, whether as a standalone website or by redirecting it to your

existing site.



Asking price: USD 400 or best offer.



Visit www.VoipEdmonton.com to purchase, or reply to this email if you have

any questions.



Best regards,



John



On Tue, 7 Jul 2026, 19:45 Peter John, wrote:



> Hello,

>

>

> The premium domain

> VoipEdmonton.com is currently available for purchase on GoDaddy

> Marketplace.

>

>

> This domain is a strong match for businesses offering VOIP IN EDMONTON and

> could help increase your online reach and brand visibility.

>

>

> The domain is available for $499 at www.VoipEdmonton.com.

>

>

> Please let me know if you are interested or would like to discuss further.

>

>

> Best regards,

>

>

> John.

>



--000000000000e9c138065749fb36

Content-Type: text/html; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable



Hi,


iv dir=3D"auto">I noticed your business specializes in VOIP IN EDMONTON=C2=

=A0

The domain name=C2=

=A0
VoipEdmonton.com is currently available and coul=

d strengthen your online presence, whether as a standalone website or by re=

directing it to your existing site.


ir=3D"auto">Asking price: USD 400 or best offer.

>
Visit www.=

VoipEdmonton.com to purchase, or reply to this email if you have any qu=

estions.

Best regards,
div>

John


class=3D"gmail_quote gmail_quote_container">

_attr">On Tue, 7 Jul 2026, 19:45 Peter John, <
ndomain@gmail.com">peterjohndomain@gmail.com> wrote:

quote class=3D"gmail_quote" style=3D"margin:0 0 0 .8ex;border-left:1px #ccc=

solid;padding-left:1ex">
Hello,

iv dir=3D"auto">

The=

premium domain=C2=A0
VoipEdmonton.com is currently =

available for purchase on GoDaddy Marketplace.

<=

/div>

This domain is a strong =

match for businesses offering VOIP IN EDMONTON and could help increase your=

online reach and brand visibility.


ir=3D"auto">
The domain is available for $499 at=


r">www.VoipEdmonton.com.


uto">
Please let me know if you are interested o=

r would like to discuss further.


=3D"auto">
Best regards,
=



John.






--000000000000e9c138065749fb36--

TD Direct Investing phish from Google Content

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 23 Jul 2026 06:38:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wmsg1-00000000Hj8-0xd4

for dave@doctor.nl2k.ab.ca;

Thu, 23 Jul 2026 06:37:25 -0600

Resent-From: The Doctor

Resent-Date: Thu, 23 Jul 2026 06:37:25 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from apps-ltd-leqiuzhibo.com ([35.219.235.172]:41377 helo=billing.apps-ltd-leqiuzhibo.com)

by doctor.nl2k.ab.ca with esmtp (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wmsDZ-000000000wq-2Xpz

for doctor@nl2k.ab.ca;

Thu, 23 Jul 2026 06:08:09 -0600

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; s=default;

d=billing.apps-ltd-leqiuzhibo.com;

h=Content-Type:MIME-Version:From:To:Subject:Date:Message-ID;

i=update@qsiajl.billing.apps-ltd-leqiuzhibo.com;

bh=h4rPzQi+gFsbShdDKeOJzzGYS8QAsz0ARqgPL5vqkIk=;

b=TxOyxT3a0e72ULAq0Ku1d1LnTX30WzuSe6tn5LGvp5KFFuXqp+ZwVzk+UxdjUHmmkd18W3watTBD

E9zBOCZ8LT4ZsWcq00FJDTjHs8JFyN4GL0qShOYetI3C6sbFmwRJBaMfeuUerfFquX9hbXGKyIBu

ZOVwbh7Uw0CQkXxT0ZFT0DBzzrMbjAX+DhMEGY2bE0zGESvE5hjPEMIhoMClXRqkDciqiJRg+FEQ

BQaPQf4ltE6jOF7GSKZdxxhtbwKfiwqu8b5DNrcLLuXG27a3+Jwyl4F+8oIHudokihIhSc/wT+U4

x2AwVY9KeNvykOMkHNpIQSYgFhHCIYRo+Jkeew==

Content-Type: multipart/alternative;

boundary="===============3936454943505521343=="

MIME-Version: 1.0

From:

=?utf-8?b?VOKAi0TigIsg4oCLQ+KAi2HigItu4oCLYeKAi2TigIth4oCLIOKAi1TigIty4oCLdeKAi3PigIt0?=



To: doctor@nl2k.ab.ca

Subject: =?utf-8?q?=5BTD_Direct_Investing=5D_Derivatives_Trading_Authority_?=

=?utf-8?q?=E2=80=94_Options_and_Margin_Agreement_Lapse_Triggers_Permission_?=

=?utf-8?q?Downgrade?=

Date: Thu, 23 Jul 2026 21:06:52 +0900

Message-ID:

<178480841209.3368.978316504446965478@qsiajl.billing.apps-ltd-leqiuzhibo.com>

X-Spam_score: 19.8

X-Spam_score_int: 198

X-Spam_bar: +++++++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: doctor, TD Direct Investing maintains a tiered options and

margin trading framework under CIRO Rule 5100 and the Universal Market Integrity

Rules (UMIR). Dealer Members are required to ensure that each client [...]





Content analysis details: (19.8 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[35.219.235.172 listed in dnsbl.ahbl.org]

[35.219.235.172 listed in dnsbl.ahbl.org]

[35.219.235.172 listed in dnsbl.ahbl.org]

[35.219.235.172 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[35.219.235.172 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[35.219.235.172 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[35.219.235.172 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[35.219.235.172 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[35.219.235.172 listed in will-spam-for-food.eu.org]

[35.219.235.172 listed in will-spam-for-food.eu.org]

[35.219.235.172 listed in will-spam-for-food.eu.org]

[35.219.235.172 listed in will-spam-for-food.eu.org]

[35.219.235.172 listed in will-spam-for-food.eu.org]

[35.219.235.172 listed in will-spam-for-food.eu.org]

[35.219.235.172 listed in will-spam-for-food.eu.org]

[35.219.235.172 listed in will-spam-for-food.eu.org]

3.6 RCVD_IN_SBL_CSS RBL: Received via a relay in Spamhaus SBL-CSS

[35.219.235.172 listed in zen.spamhaus.org]

0.1 URIBL_CSS_A Contains URL's A record listed in the Spamhaus CSS

blocklist

[URI: billing.apps-ltd-leqiuzhibo.com/35.219.235.172]

1.5 RCVD_IN_SBL_XBL RBL: Received via a relay in Spamhaus SBL+XBL

[35.219.235.172 listed in sbl-xbl.spamhaus.org]

-0.0 SPF_HELO_PASS SPF: HELO matches SPF record

-0.0 SPF_PASS SPF: sender matches SPF record

2.5 URIBL_DBL_SPAM Contains a spam URL listed in the DBL blocklist

[URI: apps-ltd-leqiuzhibo.com]

0.1 URIBL_SBL_A Contains URL's A record listed in the SBL blocklist

[URI: billing.apps-ltd-leqiuzhibo.com/35.219.235.172]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-0.0 T_RP_MATCHES_RCVD Envelope sender domain matches handover relay

domain

2.3 MANGLED_ACCNT BODY: mangled account(s)

2.3 MANGLED_INCOME BODY: mangled income

2.3 MANGLED_DPOSIT BODY: mangled deposit

2.3 MANGLED_YOUR BODY: mangled your

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[35.219.235.172 listed in bl.score.senderscore.com]

1.5 MR_STRANGE_QUESTION URI: No description available.

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

Subject: {SPAM?} =?utf-8?q?=5BTD_Direct_Investing=5D_Derivatives_Trading_Authority_?=

=?utf-8?q?=E2=80=94_Options_and_Margin_Agreement_Lapse_Triggers_Permission_?=

=?utf-8?q?Downgrade?=



Derivatives & Margin Trading • CIRO Rule 5100

Derivatives Trading Authority: Op‌tions & Margin Agreement Lapse

CIRO 5100 Series  |  UMIR  |  CDCC Options Disclosure Document

L1

Covered Call Writing

Sale of call options against long eq​uity positions held in the account.‌ Requires underlying security owner​ship at time of writing.

Active

L2

Long Options & Protective Strategies

Purchase of calls and puts; protect‌ive put strategies; covered call co​mbinations. No uncovered writing permitted.

Active

L3

Spreads & Multi-Leg Strategies

Vertical, horizontal, and diagona‌l spreads; iron condors; butterfli‍es; calendar spreads; straddles and strangles.

Downgrade Pending

L4

Uncovered Options Writing

Writing uncovered (naked) calls an‌d puts. Requires approved Margin Ag‌reement and minimum account equity t‍hreshold.

Downgrade Pending



doctor,



TD Direct Investing maintains a tiered options and margin trading fram‌ework under CIRO Rule 5100 and the Uni‍versal Market Integrity Rules (UMIR). Dealer Members are required to en​sure that each client who engages in​ options, futures, or margin tradin‍g has executed current and valid agr‍eements, has received the current Op‍tions Disclosure Document (ODD) pu‍blished by the Canadian Derivative‌s Clearing Corporation (CDCC), and maintains a suitability profile th‍at supports the assigned trading pe‍rmission level.



Our records indicate that the Options Trading Agreement and/or Ma‍rgin Account Agreement associated with your WebBroker acc‌ount has lapsed. As a result, a manda​tory permission re-assessment is in progress, and your Level 3 and Leve​l 4 trading authorities are schedul‍ed for automatic downgrade unless t‍he agreements are renewed.

⚠ Automatic Permission Downgrade Sc‍hedule

Current: Level 4 (Uncovered Options) → Downgrade to: Level 1 (Covered Calls Only)



Upon downgrade, the following rest‍rictions apply: all Level 3 and Level​ 4 multi-leg and uncovered options s‍trategies will be disabled; any ope‌n positions that exceed the downgrad‌ed permission level will be restric‌ted to closing transactions only; n‍ew positions in futures and other leveraged derivative instruments will be suspended; and margin borrowi‍ng on existing positions may be redu‍ced to standard Regulation T limits‌. Cash equity, ETF, and fixed-income trading, as well as Level 1 and Leve​l 2 options strategies for which a valid agreement remains on file, will c​ontinue without interruption.

Risk Disclosure — Options and Margin T‌rading

Options trading involves significan‍t risk and is not suitable for every i‌nvestor. Prior to trading options,‌ you must receive, read, and underst‍and the current Options Disclosure​ Document (ODD) published by the CDC‍C. Writing uncovered options entai‌ls the risk of potentially unlimite​d losses. Margin trading similarly involves the risk of loss exceeding‌ the equity in your account and may re​sult in a margin call requiring the d‌eposit of additional funds or securit‍ies on short notice. The renewal of y‍our Options Trading Agreement requ​ires you to acknowledge receipt of t​he current ODD and to reaffirm your understanding of these risks. TD Dire‍ct Investing does not provide investment recommendations or suitabil‍ity determinations for self-direc​ted accounts.



You may renew your agreements and preserve your current trading permissions by logging in to your WebBroker account. The renewal process takes approximately five minutes and includ‌es electronic review and execution of the updated Options Trading Agreem‌ent and Margin Account Agreement.

Log In to Renew Trading Agreements



Past performance of any trading str​ategy is not indicative of future results. This communication is issue‌d pursuant to TD Direct Investing’s regulatory obligations under CIR‌O rules and is not a solicitation or recommendation to trade options, fu‍tures, or other derivative instrum‌ents. For questions concerning opti​ons and margin trading, risk disclo‌sures, or agreement renewal, conta​ct TD Direct Investing Client Servi‌ces at 1-800-465-5463 or through the Secure Message Centre.



Yours truly,

TD Direct Investing

Derivatives & Margin Compliance Division

TD Direct Investing  |  Dealer Member of CIRO  |  Member of CIPF

This is an automated regulatory com‌pliance notification concerning y‍our options and margin trading agree​ments. Please direct all inquiries‌ through the Secure Message Centre w‍ithin your WebBroker account.

© 2026 TD Direct Investing. All rights reserved. TD Direct Investing is a‌ division of TD Waterhouse Canada In‍c., a subsidiary of The Toronto-Dom‍inion Bank.

Interactive Brokers Canada Inc. phish from Google Content

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 23 Jul 2026 06:38:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wmsfu-00000000HhN-2f5I

for dave@doctor.nl2k.ab.ca;

Thu, 23 Jul 2026 06:37:18 -0600

Resent-From: The Doctor

Resent-Date: Thu, 23 Jul 2026 06:37:18 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from [35.219.229.8] (port=55551 helo=www.dalz88.com)

by doctor.nl2k.ab.ca with esmtp (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wmsCV-000000000s4-1p2z

for root@nk.ca;

Thu, 23 Jul 2026 06:07:03 -0600

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; s=default; d=www.dalz88.com;

h=Content-Type:MIME-Version:From:To:Subject:Date:Message-ID;

i=webmaster@baaryy.www.dalz88.com;

bh=quH44I4byUtGmcOfjFEiwJxV9Muq69MEftWQsUGmLY4=;

b=lD7FiUucf+Nn1txPLmuta1SVr02PjLqjkd6kGSSOP8r5N8nreuCREwYRCqlxTjZs99cdbh5Xunns

beFy4TbS0VDBnG4px2qHz4vtQJAUXcL2VZDhu6phtfD+sHuzXFIbb7nt1iGFJYf7xGCH73X92V4e

a+ZjDL5iS0OQQXuPaYWWH5XAMXfs36AAoztiRCY9W8KxglKYCmubEheuGxDQXninkvitOyusb1Si

mtErxSPbuA4wF0bbDAbKa2YwIbDo8wu+IU8joR0ijKFe6qBI0gIewC0e3OD3hb3bbA0QCOziIiJm

/Qk0YttNIjvvN7l+mJfNsKEyYAhkIVTYrlpPDw==

Content-Type: multipart/alternative;

boundary="===============2037645134209886472=="

MIME-Version: 1.0

From:

=?utf-8?b?SeKAi27igIt04oCLZeKAi3LigIth4oCLY+KAi3TigItp4oCLduKAi2XigIsg4oCLQuKAi3LigItv4oCLa+KAi2XigIty4oCLc+KAiyDigItD4oCLbOKAi2nigItl4oCLbuKAi3TigIsg4oCLUOKAi2/igIty4oCLdOKAi2HigIts?=



To: root@nk.ca

Subject: =?utf-8?q?Access_Security_Alert_=E2=80=94_New_Device_or_Network_Det?=

=?utf-8?q?ected_=E2=80=94_Verification_Required?=

Date: Thu, 23 Jul 2026 21:05:58 +0900

Message-ID: <178480835854.3368.11757581408579607010@baaryy.www.dalz88.com>

X-Spam_score: 19.3

X-Spam_score_int: 193

X-Spam_bar: +++++++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Interactive Brokers Canada Inc. | Security Alert | Access

Monitoring | Device Verification | Account Protection root, Interactive Brokers

Canada Inc.'s automated account monitoring system has detected access activity

that warrants your review. Our security infrastructure routinely analyses

login patterns, device fing [...]



Content analysis details: (19.3 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[35.219.229.8 listed in dnsbl.ahbl.org]

[35.219.229.8 listed in dnsbl.ahbl.org]

[35.219.229.8 listed in dnsbl.ahbl.org]

[35.219.229.8 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[35.219.229.8 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[35.219.229.8 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[35.219.229.8 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[35.219.229.8 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[35.219.229.8 listed in will-spam-for-food.eu.org]

[35.219.229.8 listed in will-spam-for-food.eu.org]

[35.219.229.8 listed in will-spam-for-food.eu.org]

[35.219.229.8 listed in will-spam-for-food.eu.org]

[35.219.229.8 listed in will-spam-for-food.eu.org]

[35.219.229.8 listed in will-spam-for-food.eu.org]

[35.219.229.8 listed in will-spam-for-food.eu.org]

[35.219.229.8 listed in will-spam-for-food.eu.org]

3.6 RCVD_IN_SBL_CSS RBL: Received via a relay in Spamhaus SBL-CSS

[35.219.229.8 listed in zen.spamhaus.org]

1.5 RCVD_IN_SBL_XBL RBL: Received via a relay in Spamhaus SBL+XBL

[35.219.229.8 listed in sbl-xbl.spamhaus.org]

2.5 URIBL_DBL_SPAM Contains a spam URL listed in the DBL blocklist

[URI: dalz88.com]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

2.3 MANGLED_ACTVTY BODY: mangled activity

0.1 TW_ZH BODY: Odd Letter Triples with ZH

2.3 MANGLED_YOUR BODY: mangled your

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[35.219.229.8 listed in bl.score.senderscore.com]

1.5 MR_STRANGE_QUESTION URI: No description available.

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

1.3 RDNS_NONE Delivered to internal network by a host with no rDNS

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

3.0 VFY_ACCT_NORDNS Verify your account to a poorly-configured MTA -

probable phishing

Subject: {SPAM?} =?utf-8?q?Access_Security_Alert_=E2=80=94_New_Device_or_Network_Det?=

=?utf-8?q?ected_=E2=80=94_Verification_Required?=



Security Alert  |  Access Monitoring  |  Device Verification  |  Account Protection

ACCESS SECURITY ALERT

New Device or Network Detected

— Verification Required

Alert Reference: IBKR-SEC-ACCESS​-20260723  |  Severity: Routine Verification



root,



Interactive Brokers Canada Inc.’s automated account monitoring sys​tem has detected access activity tha​t warrants your review. Our securit‍y infrastructure routinely analys‌es login patterns, device fingerpr‌ints, and network characteristics to identify anomalies that may indi​cate unauthorised access attempts‌ or credential compromise.

Access Activity Summary

Recent Login Events — Review Requir‌ed

Timestamp Access Method Network / Location Status

Recently Desktop Browser Unrecognised Network Flagged — Verification Recommended

Prior Session IBKR Mobile (iOS) Recognised Network Normal

Earlier Desktop Browser Recognised Network Normal



Please note that this alert does not‌ necessarily indicate a security br‌each. Network changes commonly occu‌r when accessing your account from a‌ new location, using a different int‍ernet service provider, travellin​g, or after updating your device or b‌rowser software. However, as a preca​utionary measure, we recommend tha‌t you review your recent account activity at your earliest convenience.

Recommended Actions

1. Log in to your account and review the Recent Login Activit‌y section in the Security Centre.

2. Confirm that all listed access event‍s correspond to sessions you initiat‌ed.

3. If you recognise all access events listed, no further action is requir‍ed — the flagged entry will be cleare‌d upon your confirmation.

4. If you do not recognise any access ev‍ent, immediately use the Secure Message Centre to contact Client Services and consider changing your password‌.



Interactive Brokers Canada Inc. em‍ploys real-time access monitoring‌ as a standard security measure. Not​ifications of this nature are generated automatically when access patterns deviate from your established profile. Reviewing these alerts h‌elps maintain the integrity of your‍ account.

Review Account Access



If you have already reviewed this ac‌cess event or recently updated your n‍etwork configuration, this notice‌ may have been generated prior to syst​em reconciliation. You may confirm your access status through the Security Centre in your account portal.



Yours sincerely,

Interactive Brokers Canada Inc.

Security Operations Centre — Access Monitoring



Interactive Brokers Canada Inc.  |  Dealer Member of CIRO  |  Member of CIPF



This message is an automated securi‍ty notification sent to root.

Interactive Brokers Canada Inc. will never request your password, MFA codes, or personal identification de‌tails via email.

Please direct all inquiries throug‍h the Secure Message Centre within your account portal.



© 2026 Interactive Brokers Canada In‍c. All rights reserved.