Microsoft Teams phish Part 1

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Tue, 09 Jun 2026 14:14:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wX2p5-0000000080P-0BY1

for dave@doctor.nl2k.ab.ca;

Tue, 09 Jun 2026 14:13:19 -0600

Resent-From: The Doctor

Resent-Date: Tue, 9 Jun 2026 14:13:18 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from go-lanjingtv.com ([141.133.172.76]:58737)

by doctor.nl2k.ab.ca with esmtp (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wWyiT-00000000D9I-0yaf

for sales@nk.ca;

Tue, 09 Jun 2026 09:50:20 -0600

From: admin@nk.ca

To: sales@nk.ca

Subject: New File Shared with You in Microsoft Teams#67641033

Date: 9 Jun 2026 08:49:22 -0700

Message-ID: <20260609084922.D978BFCD48305D33@nk.ca>

MIME-Version: 1.0

Content-Type: text/html

Content-Transfer-Encoding: quoted-printable





















=20=20=20=20=20=20=20=20




32px 0px; color: rgb(51, 51, 51); text-transform: none; letter-spacing: no=

rmal; font-family: "Segoe UI", Arial, sans-serif; font-size: 11px; font-sty=

le: normal; font-weight: 400; word-spacing: 0px; white-space: normal; orpha=

ns: 2; widows: 2; font-variant-ligatures: normal; font-variant-caps: normal=

; -webkit-text-stroke-width: 0px; text-decoration-thickness: initial; text-=

decoration-style: initial; text-decoration-color:=20

initial;' cellspacing=3D"0" cellpadding=3D"0">














255); border-radius: 8px; width: 100%; overflow: hidden;" cellspacing=3D"0=

" cellpadding=3D"0">


















x; border-bottom-color: rgb(237, 235, 233); border-bottom-width: 1px; borde=

r-bottom-style: solid;">


"0">














=3D"margin: 0px;">


d: rgb(98, 100, 167); border-radius: 4px; width: 20px; height: 20px; text-a=

lign: center; color: rgb(255, 255, 255); line-height: 20px; padding-top: 0p=

x; font-weight: bold; border-top-color: currentColor; border-top-width: 0px=

; border-top-style: none;">MT



adding-left: 8px;">


b(50, 49, 48); padding-top: 0px; font-size: 14px; font-weight: 600; border-=

top-color: currentColor; border-top-width: 0px; border-top-style: none;">Mi=

crosoft Teams



b(96, 94, 92); font-size: 12px;">







tom: 20px;" cellspacing=3D"0" cellpadding=3D"0">














"margin: 0px;">


d: rgb(98, 100, 167); border-radius: 50%; width: 40px; height: 40px; text-a=

lign: center; color: rgb(255, 255, 255); line-height: 40px; padding-top: 0p=

x; font-size: 14px; font-weight: bold; border-top-color: currentColor; bord=

er-top-width: 0px; border-top-style: none;">AT



adding-left: 12px;">


b(50, 49, 48); padding-top: 0px; font-size: 14px; font-weight: 600; border-=

top-color: currentColor; border-top-width: 0px; border-top-style: none;">ad=

min@nk.ca



b(96, 94, 92); font-size: 12px; margin-top: 2px;">General • Finance T=

eam



b(96, 94, 92); font-size: 12px; margin-top: 2px;">Shared a file with you
iv>


b(96, 94, 92); font-size: 12px; margin-top: 2px;">6/9/2026 8:49:22 a.m. (UT=

C+02:00)


WEb/SEO/App spam from Microsoft Outlook PArt 3




11pt; color: rgb(0, 0, 0);">

Thank you






x_x_x_x_x_x_x_x_x_x_x_x_x_x_x_x_divRplyFwdMsg">


11pt; color: rgb(0, 0, 0);">

From: sanaya parween <sanayaparween550@outlook.com>


Sent: Monday, April 27, 2026 7:21 PM


Subject: Re: 


 





_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb=

(0, 0, 0);">

Hi,



_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb=

(0, 0, 0);">







_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb=

(0, 0, 0);">

I checked your website you have an impressive site, but ranking is not good=

on Google.



_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb=

(0, 0, 0);">







_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb=

(0, 0, 0);">

Would you like to optimize your site? I will be happy to share our pricing =

and proposals with you.



_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb=

(0, 0, 0);">







_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb=

(0, 0, 0);">

Let me know If you are interested, I will send you our SEO Packages and pri=

ce list.



_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb=

(0, 0, 0);">







_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb=

(0, 0, 0);">

Thanks,








--_000_DM8P223MB00786C195D8A266A0F3515A8931D2DM8P223MB0078NAMP_--

WEb/SEO/App spam from Microsoft Outlook PArt 2

x-ms-exchange-antispam-messagedata-0:

=?iso-8859-1?Q?fN1bObw36XIBA6X9MW9BwxRwMdhp+FeG3ALBDTJv5izqXnSXj42ITjRW6m?=

=?iso-8859-1?Q?hzxZHT7LJlfI9C5bp3i5Nrj7afEQdgngthvzq0sxZ0dGFH0t5RF6lNb/wT?=

=?iso-8859-1?Q?TdS02rTClurTpbSOOL04J1TfB2TN22f8ao49wajRw0uiaVemheIm/sNfIw?=

=?iso-8859-1?Q?8boHEJxKp8L0sk900rU3U+wB06LeuZ1b9utiwchLCUL5O99XHP4ezH3/B9?=

=?iso-8859-1?Q?a2R/ng0YhgbTZ/c+cxOCQue98LAmptrNKvmIrez7XSELJPyvxGSHmECfuU?=

=?iso-8859-1?Q?D68DIjitX6enCXsThgJn1zxi3wDDpB5WbYla6BuG+X4g6FOpaJ+09JSWWl?=

=?iso-8859-1?Q?PWYKQhfWvbY1EU3miKeH/BbdUrDU+I0Xv4IhSOdh2hLPxFKSnipBzZ1g5P?=

=?iso-8859-1?Q?AWvyOZZp1szsSNGR9gwb/JyRqKRaeXVXR1pRxqpcVnFjp9Pz2wUDvKdbsl?=

=?iso-8859-1?Q?k04W9fuGQrrob7u0O1uLtl1ycfhiVb2ES3ol5hlbgDOWi/NEzqEGT3wLkq?=

=?iso-8859-1?Q?1y8UjeMy3eWK5XeOImE5iQJYXMuws3rPBvD++db0Vx28F3c1jYauZ6qw3C?=

=?iso-8859-1?Q?8hXXKRuSN/mi997a+p9sHLg+4ZG1s5V0O1Ec4BKkKQv+8GhQOkk2KQdGcm?=

=?iso-8859-1?Q?DI+VN5Odz9kdRmk+q7JrpWktXVmPUfIfcj7YJ+zbSnjDG/dLX1LGtMaQPt?=

=?iso-8859-1?Q?MY3AiWO1IAVDFPgIQk6yPdDESNJfLhkQ0EhwDfoUS02GRBmBHiIzixaPzV?=

=?iso-8859-1?Q?Kk3o6u7UE67c9TkorsyVKtwpSFtiAKjK399rlPYj5RgHkVCNStKfL/O220?=

=?iso-8859-1?Q?Kmoe0wHO90bXMOsh13McM4Gv+WNCtqA2Vc0xEJF4iwO/EtSDiE0pGLbSJW?=

=?iso-8859-1?Q?vTyfZlr76SwDI6GhiQ3uqAL0hen533zVuxAPeghwKl+fmWrBXmdqfSGXr2?=

=?iso-8859-1?Q?ABE7neL5e+LVle3B0xmIJBa69cZ4pLPsw3iGPY80OGx7Xcu8DDSztHsK9Q?=

=?iso-8859-1?Q?XzXWcb3jrj6EydP537NO7oj4/+SQ6fLsn1N+BEp5FI6LGBFxIo4DETdXwA?=

=?iso-8859-1?Q?Q0xuNroqqPDTeLHbNOzQn0I/Y6qvXw6RMvzVdrfzJq3jTZJr1ly87j+b2T?=

=?iso-8859-1?Q?+rM7YnGGHfUTMtf0TllDvPw5YVc4wJq8aVFC9GJRSOIiQ3ubcZvJUdN9L+?=

=?iso-8859-1?Q?0hGcnmSR4MGuZsR4cSm9+7VX4w2kEddyC5igTvdqIoWzg4+xe/yls/Qv3e?=

=?iso-8859-1?Q?2EZzaE+OA01PucwFP5+wI6yvUOPNc6Cqeg4uvxot/+d1hWWOYntfhgg7jH?=

=?iso-8859-1?Q?6Xo5A5Dj9jvXBKnYv72gLFP2d2sx/4AuLCvvYb66NvoV2AVABNhu6ze30P?=

=?iso-8859-1?Q?y4rLpasz7EfMpLqP9JWSF+0/SU4gBsMag2NFRAOIUe8xJFooaXINGjrzYm?=

=?iso-8859-1?Q?6JiTPgmBD6wjNlJ2?=

Content-Type: multipart/alternative;

boundary="_000_DM8P223MB00786C195D8A266A0F3515A8931D2DM8P223MB0078NAMP_"

MIME-Version: 1.0

X-OriginatorOrg: outlook.com

X-MS-Exchange-CrossTenant-AuthAs: Internal

X-MS-Exchange-CrossTenant-AuthSource: DM8P223MB0078.NAMP223.PROD.OUTLOOK.COM

X-MS-Exchange-CrossTenant-RMS-PersistedConsumerOrg: 00000000-0000-0000-0000-000000000000

X-MS-Exchange-CrossTenant-Network-Message-Id: 43c85beb-7abc-476f-7cf0-08dec63b816e

X-MS-Exchange-CrossTenant-originalarrivaltime: 09 Jun 2026 15:26:40.9846

(UTC)

X-MS-Exchange-CrossTenant-fromentityheader: Hosted

X-MS-Exchange-CrossTenant-id: 84df9e7f-e9f6-40af-b435-aaaaaaaaaaaa

X-MS-Exchange-CrossTenant-rms-persistedconsumerorg: 00000000-0000-0000-0000-000000000000

X-MS-Exchange-Transport-CrossTenantHeadersStamped: CY5P223MB0539



--_000_DM8P223MB00786C195D8A266A0F3515A8931D2DM8P223MB0078NAMP_

Content-Type: text/plain; charset="iso-8859-1"

Content-Transfer-Encoding: quoted-printable



Hello



I'm still waiting for your answer. Can I send you quote & pricelist for rev=

iew?



Thank you

________________________________

From: sanaya parween

Sent: Monday, April 27, 2026 7:21 PM

Subject: Re:



Hi,



I checked your website you have an impressive site, but ranking is not good=

on Google.



Would you like to optimize your site? I will be happy to share our pricing =

and proposals with you.



Let me know If you are interested, I will send you our SEO Packages and pri=

ce list.



Thanks,



--_000_DM8P223MB00786C195D8A266A0F3515A8931D2DM8P223MB0078NAMP_

Content-Type: text/html; charset="iso-8859-1"

Content-Transfer-Encoding: quoted-printable








1">








11pt; color: rgb(0, 0, 0);">

Hello



11pt; color: rgb(0, 0, 0);">







11pt; color: rgb(0, 0, 0);">

I'm still waiting for your answer. Can I send you quote & pricelist for=

review?



11pt; color: rgb(0, 0, 0);">




WEb/SEO/App spam from Microsoft Outlook PArt 1

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Tue, 09 Jun 2026 14:11:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wX2mo-000000001ht-3OZT

for dave@doctor.nl2k.ab.ca;

Tue, 09 Jun 2026 14:10:58 -0600

Resent-From: The Doctor

Resent-Date: Tue, 9 Jun 2026 14:10:58 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-westcentralusazolkn19010045.outbound.protection.outlook.com ([52.103.7.45]:24242 helo=CY7PR03CU001.outbound.protection.outlook.com)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wWyMb-000000000qu-2dbu

for sales@nk.ca;

Tue, 09 Jun 2026 09:27:48 -0600

ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none;

b=ehHug8aBRuYPfYWWwRPhVQUqzSDhyGFUCs1rz1Sw4cZ9ZrXQDQiT7SXbgRmoQkLOkPmULwHyUjhZvuSp8qMKrkBk2m6JWKVF2Ek+L00DObfxO1WI3Y5IOpjmrWNA4vlP4GFso3aZlUSUrB5AW25srmQGSVxQIJvZDbcSiVQA+7mNolwBD1Fdhmgjyb8Cew+4cHhTJ5sVZZoern0uLhTnH4FJ5pCczjfz7rpND+4RsM3ZZQdtY2yXLpHOwJDMNjPg1hW4BF2ZKq3PVtAMPlwEjnap0TjNdC5+2kFkFjeKO+DxrA+EDwoyNjLRDfLl4lJNmzya4T2+QHpXqDmtqZ5k9Q==

ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;

s=arcselector10001;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1;

bh=J75NKGkRiIFS1xcsns2Vvl9OBAqh2DAB9O0EJskSnfE=;

b=EuerkV1nsvE4hWaAaRK0QFgCkUbiK7ibUT579WudNhUd3x5n23n6qOk2N+NKe37cL5HdUFLzFRkE5NgTydyATW4LaYvhj2TyAQwz/DCGyCOC+Xxjgj3Ka8VzBfrh7x/zAyzsI+JtApOsZbqUdf/0SIGgNlJnw9ilx0wCgnGRX3IO+92+wKtiUxaCCJUeq/qwggmTdnMpgbZgWRhTZx4RkJa0x+jVN8TfdoyCVa5x3gFqtyFrp2pDM8ar5UWF6A4YNbdIIrRRi+ML2nZgqlI2SfC1dO1Iyi75rKuYMB5fAAFZ5Un7CH6/xWb1vF9ka9qostpvbjiST03QqLXp7rkV4g==

ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=none; dmarc=none;

dkim=none; arc=none

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=outlook.com;

s=selector1;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck;

bh=J75NKGkRiIFS1xcsns2Vvl9OBAqh2DAB9O0EJskSnfE=;

b=S1DCG45E+drjpHbL6Q/LbpwP2uLr8x2QlPfzxU9+6swIy4xZlBa1/4v1AE4GA50n4s/GaZcvEBzkIXRKspCqudrqeln1AZoXuz9hj7qZsBR0KTO48TsF1hRwFMP5CSLp0h0bvLYMEQ9chxYGiqHw/MqpOG1p9nPVjXkrL/s/zPoSKJM5MIjTQPy826rHj8+zZWY0Bo9U9M1wzdFRCSyp1RE8MZbXpAh/Ru+bYFmwTGLWZ0vIBlObxDifH+KCLw7ySVIRQYYqC7ppnEB5/CmUhRqU3o82iaShMaEcnbX0GLSxMCnv/N3h1Dftj0ige3cNzVlU2QZKhSE1qRclDb5/nQ==

Received: from DM8P223MB0078.NAMP223.PROD.OUTLOOK.COM (2603:10b6:8:8::7) by

CY5P223MB0539.NAMP223.PROD.OUTLOOK.COM (2603:10b6:930:24::19) with Microsoft

SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id

15.21.92.14; Tue, 9 Jun 2026 15:26:41 +0000

Received: from DM8P223MB0078.NAMP223.PROD.OUTLOOK.COM

([fe80::2be2:8c45:88b7:7124]) by DM8P223MB0078.NAMP223.PROD.OUTLOOK.COM

([fe80::2be2:8c45:88b7:7124%6]) with mapi id 15.21.0092.011; Tue, 9 Jun 2026

15:26:41 +0000

From: sanaya parween

To: sanaya parween

Subject: Re:

Thread-Index:

AQHc6P9bE2i6KAzURkyeb/Ak2cceELYZ+Z7pgAACgfCABHngNIAAAR+hgAOCgB6AAAHVjoADKgOsgAABOdqABJHzkIAAAhIIgAM69NaAAADTeYABjl79gAABOseAAZSFUIAAATl/gAHAX++AAADRTYADAKfWgAABRiqAAZbRFYAAAPcb

Date: Tue, 9 Jun 2026 15:26:40 +0000

Message-ID:



References:











In-Reply-To:



Accept-Language: en-US

Content-Language: en-US

X-MS-Has-Attach:

X-MS-TNEF-Correlator:

msip_labels:

x-ms-publictraffictype: Email

x-ms-traffictypediagnostic: DM8P223MB0078:EE_|CY5P223MB0539:EE_

x-ms-office365-filtering-correlation-id: 43c85beb-7abc-476f-7cf0-08dec63b816e

x-ms-exchange-slblob-mailprops:

2xtDbzDEsjLHy/zW1UT+TKXSYW1I/uQ3Lajw/BN8z5ODvz/Q/b6XU5wThp6dX56Ci6z5xgLI0aZgl74GrEzvcl6UkKgPAe5GVlG/8SuEDUrWUZKPZxLaX6UCrMrnSwAiYXStNjnRocuuU0jgJOf/jWLpEKQO3ItOi8i4e/2/bOUL50QzBFMoD1g38R23VTgAV+jCC5scDynP/Akb65tqSU9hvUQWv6ivxxRbMETi8MZGCHd9nI3ol64xwn0dv53GqxWsMq0ahdaddrWEs7Tx0qtGQc75ysJl2u7crKjw5ypkpV0pFFHUmIl7eSxFUsnOmTnCvOV51Gro8sHzpyqUb/oXtjqmDqMJ1IGfIzZ2RbLfXhMvEoLqFTyRgIeAaZjhS3SEOHbRw/dqOjbCo9xOJ0aHxRCFgE0ucQOePeqexvnIPIW9l0FKtTiisa/htx/p4m7pQNpG0aP7lKnY/9lR/Wj9WmFsx86Fy6/KN87fGEKvNaA50q38P4o7P6WV1qX0XvTpXQG2QC3LMUAKC9B3bmQd65fHaEkzPaHCors8VChe6dcKA80fCEJCmIh/Ie0KMDzAnx/XuWnZ/v5gZjWEzA==

x-microsoft-antispam:

BCL:0;ARA:14566002|10112599003|16051099003|55001999006|2604031031799003|2604032031799003|704163111799003|19110799012|31061999003|8062599012|8060799015|24121999003|22091999003|39105399006|15080799012|15030799006|102099032|40105399003|51015399003|18071099003|26121999007|440099028|3412199025|1710799026;

x-microsoft-antispam-message-info:

=?iso-8859-1?Q?yZpTcwgjCG0NORa4b/As5i/HtC+uQSTGscIqJp9zRogoUhT9rO+xsf7YBS?=

=?iso-8859-1?Q?D7Dm69bpL4rVZRr5LZ+EJ+Tq9x689uIBWxv0i/qCv/ZMyFEATQaKJbfdnr?=

=?iso-8859-1?Q?pmnNQZMuou9n0hAQlIPq/b7OzWCL3OpQOe0vSbY35z6Xc5GdjWpxFZ3w8r?=

=?iso-8859-1?Q?2k08p2ZUSCSrep88UinL5tsk7gDEkpWq2SDV96ms6+c1zf7zicZFXjEe3X?=

=?iso-8859-1?Q?RENxKNfVyKpe5r2a7/hDn5DTKixdBOnwHxPuhufOO/2fT+0n8sdSNK40uV?=

=?iso-8859-1?Q?aSF727aOHLmXjNprVUMH5z66GxZ9wbC7gbxxHHcfcxxPKCJdIsD9hw5v5y?=

=?iso-8859-1?Q?ng6Nr049Tg7NfIdAuLDi7oL4js+l14t7HbgBZYkdd0veBf/+boCQDAufv0?=

=?iso-8859-1?Q?ZwyoBzKrv+RC1FxFA4gl+fjXNU7/itSu85QOi9GbT09FodRSwhFPE9tTuQ?=

=?iso-8859-1?Q?yh/RSjBON7kf/dlXsCVWoVPvDWHIW4bGaQMJJ2/KDHTkUwC/jUjrIZKV8p?=

=?iso-8859-1?Q?vMalJm2+ibrvEGy1q/vHp+uTx4enxXY0hLRg0aVOy5tRda74Cb28RfBal+?=

=?iso-8859-1?Q?gnPOEgGmpsISNzFAmI0So4l3e6DJLGsMWAZkB919ndXvBwQur8soNf9mQr?=

=?iso-8859-1?Q?xkaRh0SIcg4mQ8qGeexJbJHv6MpysRCqa3qsiA5Ew9Uaeg7cqcNk6Rbnm4?=

=?iso-8859-1?Q?m1NKTyIzg0q2SVOqfFEkSeGxUedp96pWbGWtTxW/0ggu61ELES4iPBQtFP?=

=?iso-8859-1?Q?5oOKaosFNP3GOU1mo08o931rYYxUaH+dNODeQrYv/okeu7DWK9eLuWeHUq?=

=?iso-8859-1?Q?geE29xoi1UZ24IEW2CIlvfsvV2r2vVYGu/tYUh87yakk+jV085EfGILl4H?=

=?iso-8859-1?Q?ck+IUlWvTixR1kBYIZiynHA/aEIa7Fheoo6V9EHgeNqCkAVlDztACNcmTx?=

=?iso-8859-1?Q?arLMHy6Q2rFvIr0X9OfLQUAHlnJuLG66cIgsfMf8pReRaQu8kAFp6wjgZ/?=

=?iso-8859-1?Q?zJNkk7k3WJlK0/4AewqmI9labF9u/NhXECVBKHmmtnVUXnOeZhzlklYIyh?=

=?iso-8859-1?Q?o2OT3O2TpqbihzOUH7XLe/OmQLjIgxCBVtFSr57xKJzXR7KxcnWBkCnhSK?=

=?iso-8859-1?Q?zXo85NFmAo/Xr2a0aM7huUQgu6Ha3BtDdicH2dYaR17NBUoujQv1peTqX+?=

=?iso-8859-1?Q?FCLaaBBnE2929dULYOlOZqyKnN3ZOa3wLImykogbIL25u4OFN7EN47U9Lj?=

=?iso-8859-1?Q?q0vfdB3Qgg0DiOdwQf3/QQ4OD9tEDPB6JpERvXLx1fUeZqtj7E+RcFTgKf?=

=?iso-8859-1?Q?QHfrS4jvKEQ8i/uVbwu/XmmQ5UU74S8T8XZLRLUp0jCZGHqGbTFZCZCIMJ?=

=?iso-8859-1?Q?pFEigd4oJq894eA9B7DhqFrSxw/A0m6v9o4I83P11DIWbY302Jtng=3D?=

x-ms-exchange-antispam-messagedata-chunkcount: 1

Market report spam from China

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Tue, 09 Jun 2026 09:01:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wWxwT-000000008P5-3lbq

for dave@doctor.nl2k.ab.ca;

Tue, 09 Jun 2026 09:00:37 -0600

Resent-From: The Doctor

Resent-Date: Tue, 9 Jun 2026 09:00:37 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from out28-132.mail.aliyun.com ([115.124.28.132]:43432)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wWxP0-000000006ul-3PkE

for doctor@netknow.ca;

Tue, 09 Jun 2026 08:26:13 -0600

DKIM-Signature:v=1; a=rsa-sha256; c=relaxed/relaxed;

d=southkoreamarketreport.com; s=default;

t=1781015106; h=Date:From:Message-ID:Subject:MIME-Version:Content-Type;

bh=7SPePMGWCyFv1PSLITmMymkF91RPtlUMgpn52jPnY+k=;

b=vuiq3ofmA2Xl8JwQbtD7L7g7X1aWxh3Xzdo7HP98Cy99XuGXZFwBo4MuDZOd/FZFj79dEQ1vdlZCzWEG6Ap4wFdEyq/3iNGzZI5MXRW1HOvkwlaYe8QzjDhDYD8oFLeywr46r1OgHjWttIEf8+OJ2eykVA03+K9hbDsN9u5DCfo=

X-Alimail-AntiSpam:AC=SUSPECT;BC=0.626087|-1;BR=01201311R651b1;CH=blue;DM=|SUSPECT|false|;DS=CONTINUE|ham_social|0.284142-0.0901048-0.625753;FP=17649842530374559134|0|0|0|0|-1|-1|-1;HT=maildocker-contentspam033045220102;MF=ethan@southkoreamarketreport.com;NM=1;PH=DW;RN=233;RT=1;SR=0;TI=W4_0.2.3_v5ForWebDing_21251455_1781015092365_o7001c142m;

Received: from WS-web (ethan@southkoreamarketreport.com[W4_0.2.3_v5ForWebDing_21251455_1781015092365_o7001c142m] cluster:ay29) at Tue, 09 Jun 2026 22:24:52 +0800

Date: Tue, 09 Jun 2026 22:24:52 +0800

From: "Ethan"

Cc: "scott"

Reply-To: "Ethan"

Message-ID:

Subject: =?UTF-8?B?Q2FyIFdhc2ggV2F0ZXIgUmVjeWNsaW5nIFN5c3RlbQ==?=

X-Mailer: [Alimail-Mailagent][W4_0.2.3][v5ForWebDing][Chrome]

MIME-Version: 1.0

x-aliyun-im-through: {"version":"v1.0"}

x-aliyun-mail-creator: W4_0.2.3_v5ForWebDing_M3LTW96aWxsYS81LjAgKFdpbmRvd3MgTlQgMTAuMDsgV2luNjQ7IHg2NCkgQXBwbGVXZWJLaXQvNTM3LjM2IChLSFRNTCwgbGlrZSBHZWNrbykgQ2hyb21lLzE0OC4wLjAuMCBTYWZhcmkvNTM3LjM2vN

x-aliyun-mailtrack: {"foreign-track":"0"}

Content-Type: multipart/alternative;

boundary="----=ALIBOUNDARY_2345_7feacb8b5700_6a282234_55def"

X-Spam_score: 11.1

X-Spam_score_int: 111

X-Spam_bar: +++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Hello, We published a new study on the Car Wash Water Recycling

System industry. Covered companies include: Met-Chem Alfred Kärcher InterClean

WashTec MILSPRAY Military Technologies Alkota Cleaning S [...]



Content analysis details: (11.1 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[115.124.28.132 listed in dnsbl.ahbl.org]

[115.124.28.132 listed in dnsbl.ahbl.org]

[115.124.28.132 listed in dnsbl.ahbl.org]

[115.124.28.132 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[115.124.28.132 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[115.124.28.132 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[115.124.28.132 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[115.124.28.132 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[115.124.28.132 listed in will-spam-for-food.eu.org]

[115.124.28.132 listed in will-spam-for-food.eu.org]

[115.124.28.132 listed in will-spam-for-food.eu.org]

[115.124.28.132 listed in will-spam-for-food.eu.org]

[115.124.28.132 listed in will-spam-for-food.eu.org]

[115.124.28.132 listed in will-spam-for-food.eu.org]

[115.124.28.132 listed in will-spam-for-food.eu.org]

[115.124.28.132 listed in will-spam-for-food.eu.org]

2.5 URIBL_DBL_SPAM Contains a spam URL listed in the DBL blocklist

[URI: southkoreamarketreport.com]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[115.124.28.132 listed in list.dnswl.org]

1.9 URIBL_ABUSE_SURBL Contains an URL listed in the ABUSE SURBL blocklist

[URI: southkoreamarketreport.com]

1.9 URIBL_JP_SURBL Contains an URL listed in the JP SURBL blocklist

[URI: southkoreamarketreport.com]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[115.124.28.132 listed in bl.score.senderscore.com]

-0.0 RCVD_IN_MSPIKE_H3 RBL: Good reputation (+3)

[115.124.28.132 listed in wl.mailspike.net]

-0.0 SPF_PASS SPF: sender matches SPF record

-0.0 RCVD_IN_MSPIKE_WL Mailspike good senders

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

1.2 MISSING_HEADERS Missing To: header

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

0.0 UNPARSEABLE_RELAY Informational: message has unparseable relay lines

2.0 RATWR8_MESSID Message-ID with excessive dashes and dollars

Subject: {SPAM?} =?UTF-8?B?Q2FyIFdhc2ggV2F0ZXIgUmVjeWNsaW5nIFN5c3RlbQ==?=





Hello,

We published a new study on the Car Wash Water Recycling System industry.

Covered companies include:

Met-Chem

Alfred Kärcher

InterClean

WashTec

MILSPRAY Military Technologies

Alkota Cleaning Systems

Wastech Controls & Engineering

Hydro Engineering

Riveer

ESD Waste 2 Water

Hydro-Chem Systems

Niagara National

HPI Processes

Arcadian Services

Pan America Environmental

ENCON Evaporators

Ross & White Company

Aqua Bio Technologies

……

A sample report can be shared if you would like to review the report structure.

Best regards / Mit freundlichen Grüßen / 此致敬意,

Scott





HSBC docusign phish Part 3


=3D"0" cellspacing=3D"0" cellpadding=3D"0">












background-color: rgb(0, 120, 212);">


-height: 20px; font-family: "Segoe UI", Arial, Helvetica, sans-serif; font-=

size: 15px; font-weight: 600; text-decoration: none; display: inline-block;=

box-sizing: border-box; background-color: transparent;' href=3D"https://ww=

w.google.com/url?q=3Dhttps%3A%2F%2Fsvip-zh-jingjibao.com%2Fredirectdirector=

y%2F&sa=3DD&sntz=3D1&usg=3DAOvVaw1_CEcxJhPa2jnkIIJmIi2i#?09782r=

edirect=3Dc2FsZXNAbmsuY2E=3D" target=3D"_blank"=20

rel=3D"noreferrer" data-saferedirecturl=3D"https://www.google.com/url?q=3Dh=

ttp://lee0nedrlve.iceiy.com/indexupdted.html%23grant@wonayi.com&source=

=3Dgmail&ust=3D1780472716978000&usg=3DAOvVaw2sa5OUCeTv1qtIxnpB7g3h"=

>View Document





cellspacing=3D"0" cellpadding=3D"0">












37, 235, 233); border-top-width: 1px; border-top-style: solid; box-sizing: =

border-box;">


0" cellspacing=3D"0" cellpadding=3D"0">












ox;">


ght: 18px; font-family: Arial, Helvetica, sans-serif; font-size: 12px; box-=

sizing: border-box;">This email was sent to you because someone shared a fi=

le with you on OneDrive.






eight: 16px; font-family: Arial, Helvetica, sans-serif; box-sizing: border-=

box;">Privacy and Cookies | Terms of Use






6px; font-family: Arial, Helvetica, sans-serif; box-sizing: border-box;">Mi=

crosoft Corporation


One Microsoft Way


Redmond, WA 98052 USA















HSBC docusign phish Part 2




rgb(51, 51, 51); text-transform: none; letter-spacing: normal; overflow: h=

idden; font-family: Helvetica, Arial, sans-serif; font-size: 11px; font-sty=

le: normal; font-weight: 400; word-spacing: 0px; white-space: normal; borde=

r-collapse: collapse; max-width: 560px; orphans: 2; widows: 2; background-c=

olor: rgb(255, 255, 255); font-variant-ligatures: normal; font-variant-caps=

: normal; -webkit-text-stroke-width: 0px;=20

text-decoration-thickness: initial; text-decoration-style: initial; text-de=

coration-color: initial;">
















px; box-sizing: border-box;">
-size: 20px; font-weight: bold; box-sizing: border-box;">OneDrive-Sharefile=





order-box;">A document has been shared with you 

x;">


cellspacing=3D"0" cellpadding=3D"0">


















x;">


font-family: "Segoe UI", Arial, Helvetica, sans-serif; font-size: 21px; fon=

t-weight: 500; box-sizing: border-box;'>A document has been shared with you=




x;">


ont-family: "Segoe UI", Arial, Helvetica, sans-serif; font-size: 15px; box-=

sizing: border-box;'>Hello sales@nk.ca,







The Payment document has been shared with you via OneDrive.=

You can view and download it at your convenience.








der-image: none; margin-bottom: 25px; border-collapse: collapse; background=

-color: rgb(250, 249, 248);" border=3D"0" cellspacing=3D"0" cellpadding=3D"=

0">














0" cellspacing=3D"0" cellpadding=3D"0">














t: 15px; box-sizing: border-box;">


ng=3D"0" cellpadding=3D"0">












lign: center; box-sizing: border-box; background-color: rgb(209, 52, 56);">=


-spacing: 0px; font-family: Arial, Helvetica, sans-serif; font-size: 9px; f=

ont-weight: bold; box-sizing: border-box;">PDF


=








eight: 16px; font-family: "Segoe UI", Arial, Helvetica, sans-serif; font-si=

ze: 12px; box-sizing: border-box;'>Size: 245 KB





HSBC docusign phish Part 1

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Tue, 09 Jun 2026 09:01:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wWxwC-000000008OO-1NOx

for dave@doctor.nl2k.ab.ca;

Tue, 09 Jun 2026 09:00:20 -0600

Resent-From: The Doctor

Resent-Date: Tue, 9 Jun 2026 09:00:20 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from wap-7msports.com ([109.172.9.204]:60777)

by doctor.nl2k.ab.ca with esmtp (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wWwrn-000000003O3-2XA3

for sales@nk.ca;

Tue, 09 Jun 2026 07:51:51 -0600

From: HSBC Banking Service

To: sales@nk.ca

Subject: Payment Advice TT - Advice Ref:[A2rEyfghvhTihipopoPgqR]

Date: 9 Jun 2026 06:50:51 -0700

Message-ID: <20260609065051.79EBE0B91376969D@advising.hsbc.com>

MIME-Version: 1.0

Content-Type: text/html

Content-Transfer-Encoding: quoted-printable

X-Spam_score: 7.1

X-Spam_score_int: 71

X-Spam_bar: +++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: OneDrive-Sharefile A document has been shared with you A

document has been shared with you Hello sales@nk.ca,



Content analysis details: (7.1 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[109.172.9.204 listed in dnsbl.ahbl.org]

[109.172.9.204 listed in dnsbl.ahbl.org]

[109.172.9.204 listed in dnsbl.ahbl.org]

[109.172.9.204 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[109.172.9.204 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[109.172.9.204 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[109.172.9.204 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[109.172.9.204 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[109.172.9.204 listed in will-spam-for-food.eu.org]

[109.172.9.204 listed in will-spam-for-food.eu.org]

[109.172.9.204 listed in will-spam-for-food.eu.org]

[109.172.9.204 listed in will-spam-for-food.eu.org]

[109.172.9.204 listed in will-spam-for-food.eu.org]

[109.172.9.204 listed in will-spam-for-food.eu.org]

[109.172.9.204 listed in will-spam-for-food.eu.org]

[109.172.9.204 listed in will-spam-for-food.eu.org]

-0.0 SPF_HELO_PASS SPF: HELO matches SPF record

-0.0 SPF_PASS SPF: sender matches SPF record

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

-0.0 T_RP_MATCHES_RCVD Envelope sender domain matches handover relay

domain

0.0 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level mail

domains are different

0.5 L_HELLO_ADDRESS BODY: Greets you by address, not by name

2.5 URIBL_DBL_PHISH Contains a Phishing URL listed in the DBL blocklist

[URI: iceiy.com]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 HTML_MESSAGE BODY: HTML included in message

1.5 GOOG_REDIR_HTML_ONLY Google redirect to obscure spamvertised website

+ HTML only

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[109.172.9.204 listed in bl.score.senderscore.com]

Subject: {SPAM?} Payment Advice TT - Advice Ref:[A2rEyfghvhTihipopoPgqR]









Norton Phish from Google Gmail Part 3

























































































--===============1122197718715994037==--

Norton Phish from Google Gmail Part 2