WEb/SEO/App spam from Microsoft Outlook

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 23 Jul 2026 13:37:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wmzDY-000000004zo-3Jwg

for dave@doctor.nl2k.ab.ca;

Thu, 23 Jul 2026 13:36:28 -0600

Resent-From: The Doctor

Resent-Date: Thu, 23 Jul 2026 13:36:28 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-japanwestazolkn19012050.outbound.protection.outlook.com ([52.103.66.50]:38807 helo=OS8PR02CU002.outbound.protection.outlook.com)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wmySa-00000000Gfe-3h7S

for sales@nk.ca;

Thu, 23 Jul 2026 12:48:07 -0600

ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none;

b=gQJLxBPPvQBQkH4XsCk66fsjRhsS7y6/y4OUSbcfmQq7qYBN7usme0IbM17l+ZN95Edc9tszXM4dDB2GF4Ok3OeK+AZq9w9NPeOmKAYE6jG/uciFlr6ZZYiRukkdcu1GrB0o4k4NcypzMfujJ2tm/TWiJVJkK4ZcGOAjo1ZEQoZtpZxlH2OM1ikWLq2fO9G7XbOZgRdINjmGT5Sjcq96p8Y+d7syEXWCEZwtXol+hkbYGnFneeLFZ0NMma6iXrbXY5lVOrqQLQGWCZP0lBuKf91QpjF4gqcPxmwir7XROoeYh7ylriqyB8T6K6XuK2rf6N5MD6cYCkdi8qlYwIB53A==

ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;

s=arcselector10001;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1;

bh=G+ma7X+SRyMs0MbLQZvWW6Oc34iUIgDj6RavD8T7oTQ=;

b=YhXMotB2/l2vgVtG0rGyvxjZ6wCVVtymfVd78cN6CHdDrdNrFIwWefkcNCvcKsFMvvpulY4zfagogI5zFQVn5KJCDewEt22qJE3WpTmSy/vRLee4SHeTQ69wNTXwNfAooMZs75UVkmLpQtnNSKWU9KOBlA6gMUah0DW/A9IrXxpWYn0IXRVG0JngJVFojDME1j3M/MVKKiRHy5ZuAoTv6A0K7xbAYSet7oNdGlqVtDBoxdUQ5dCSEwGv09VKkejkgYyIxiHuHqU4qEDowFfZ4e8qx/wg+rx4EC9EicRrtgnZZqqAKeFqIdT0RBe8HDAjyItVT2hiM0K5hd0TMShfnQ==

ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=none; dmarc=none;

dkim=none; arc=none

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=outlook.com;

s=selector1;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck;

bh=G+ma7X+SRyMs0MbLQZvWW6Oc34iUIgDj6RavD8T7oTQ=;

b=swXDYIFVQcXOxuRIdBuExOj7AplzK2Q46x1DkZMo7zp603eHSDpNZyjxdD9a8zm0xt0VLWJcoMEL1CiuKcRBeUWitdb8uovEXlETQQLACK2f4EnwuRS1ymGcLmnzR+d5n2MUvN9YcLtzxtrYn2G8ddnlcN4ROabIXMkq01716+XManHgU5J5e3RqIzPJoD2j8OAk+vr8ORU/nVrHmUnvCxeLwFcezLepv1idM0cX0JM8eweS4NX8qaGL8NM+iqAL62LDYSIMsWyb9wtazsbCGoubGJ3YHAMVXw1RtoX+zqbBaNvnepb4f8GyqCl/ZjXzIkVMgLY7GvM8IJMhmX3yfQ==

Received: from TYZPR01MB6195.apcprd01.prod.exchangelabs.com

(2603:1096:405:65::11) by SEL0PF8C30FB8E0.apcprd01.prod.exchangelabs.com

(2603:1096:108:1::5b6) with Microsoft SMTP Server (version=TLS1_2,

cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.245.11; Thu, 23 Jul

2026 18:46:42 +0000

Received: from TYZPR01MB6195.apcprd01.prod.exchangelabs.com

([fe80::3efe:bda:3c68:6b6d]) by TYZPR01MB6195.apcprd01.prod.exchangelabs.com

([fe80::3efe:bda:3c68:6b6d%6]) with mapi id 15.21.0245.009; Thu, 23 Jul 2026

18:46:42 +0000

From: Shama Fatima

To: Shama Fatima

Subject: Pls....

Thread-Topic: Pls....

Thread-Index: AQHdGtOaNUuNoJdUh0y2jGDPRX24aw==

Date: Thu, 23 Jul 2026 18:46:42 +0000

Message-ID:



Accept-Language: en-GB, en-US

Content-Language: en-GB

X-MS-Has-Attach:

X-MS-TNEF-Correlator:

msip_labels:

x-ms-publictraffictype: Email

x-ms-traffictypediagnostic: TYZPR01MB6195:EE_|SEL0PF8C30FB8E0:EE_

x-ms-office365-filtering-correlation-id: 858e04a6-99e4-46ae-2a2a-08dee8eabd1c

x-microsoft-antispam:

BCL:0;ARA:14566002|31061999003|19101099003|704163111799003|55001999006|15030799006|15080799012|15001099006|39105399006|19110799012|2604032031799003|8062599012|16051099003|8060799015|4140399003|25010399006|22091999003|24121999003|37011999003|40105399003|39145399003|18071099003|102099032|3412199025|440099028|1710799026;

x-microsoft-antispam-message-info:

=?iso-8859-1?Q?xNf1hEFFfuT95XIgZ2FUfAqsZvMU09YlUI6LLqnMpM6oNI9b6F9w0fcxBf?=

=?iso-8859-1?Q?j7Warx4N7fvck7KZUOdSnoy0ZG2IdEjhRnASQT/Cl9XHje+g5CRxzge0UO?=

=?iso-8859-1?Q?PJQs6FQqxjbrInmcogQaOHSW5iRcacMTNs5hs6s53hDrMHPD/0Bvdxq+rW?=

=?iso-8859-1?Q?bb/1ZgfMesU8mkbVviwftqk9nzk5PsX1R7uRBSPv6u/7aYOCJZMevQKo1D?=

=?iso-8859-1?Q?9Gg4V83c7fjwxuV85eNzQ9d9lz8nfB/noF6PrUHrKlB/QzBJmpm2rw2kE5?=

=?iso-8859-1?Q?cgnr7aWt8vxSMwm+bPlAU3NckK/6Q6d6p5QMO2y1MsscL5ybLeQPDAKb+w?=

=?iso-8859-1?Q?FcZRxOB4tfgsGgMeeJtqTut9QPUndHMbv5hMWm3IwUnQ0Ak1MVTol4TmOq?=

=?iso-8859-1?Q?wVXj4efL6VRmKeeyJ4l+Tnx26vL3z/lurdmpJGd+/k8CfFCGH76d9kIolL?=

=?iso-8859-1?Q?NQlyDEdfuUqnROwk5m0Hy38QVScmJci1gAsjrx40FYvu/QzyjNYh6KN6tM?=

=?iso-8859-1?Q?whr0m18f6jcsUIJLmv83+opCZJYVtVY27uS7WA4uCMykhzxuPIY4OBalMc?=

=?iso-8859-1?Q?MWUFinWeO1ycAyG5QQ5ein4uv4I5uK/KUsP8QIwbJuXtgrHFK7neLEUdWx?=

=?iso-8859-1?Q?Tzajr7sD64nG3ZlSKwM12AVsaBYJtZsZm08Io4KhznT7cgut+xX7kl/28C?=

=?iso-8859-1?Q?Q7DF5X6I8qcWF6Y7VFECfkUIzRffMtcUmnnRCSLeyPtF2wXskQeu80psz7?=

=?iso-8859-1?Q?tmIxJYS5J54YYg9oUJOMdwt3jN3P5Cr/hIkMbai+jSlPUFkdGuZVxH8PiS?=

=?iso-8859-1?Q?/JDIeCUcbRlD/0wUojkeZeQ51HwWOSyoJL4T86BlvGU0mp5Td2bWMZ2O45?=

=?iso-8859-1?Q?wEFl52FEUqcdRYtw6AwP42HXOTQzLBVcZhgxDDkOGSBdwQ/gBHUMyhNU3u?=

=?iso-8859-1?Q?+dolgBQO5vOxTG7hJjeplH3WHfn7/SwRfB+LgWkfwxRHiEPRjt34VS2MZa?=

=?iso-8859-1?Q?cxMd+J3oYCsOsQMm1Zz70QPkgNgqSwB3JdYUr7oeNSjU7onHG9B7uq+X3r?=

=?iso-8859-1?Q?0CHTkkIy40hsOWjiv5XDEGKO0Zv4Iw+U5yAW1U1npnw/uGXPaNg/jWyP8t?=

=?iso-8859-1?Q?b0cSkl8WogGvRMlkXnsXkkOTyRsa1WliyBApjxp9qGYNe9msRjv4Yl3yQL?=

=?iso-8859-1?Q?hPrvKnbDF4u4CA+bnQhZhCkdOy222Lqjyp0wUvgXTJ/ytiwozLIn97ocQK?=

=?iso-8859-1?Q?HPzSuPV8pcsgXotmj7Q9SmUdUaQIFfF1tdQmJSFlrn1Z+vPAaxEpR33rQX?=

=?iso-8859-1?Q?s+WnY3Lok0DnCJxtV5Ej3kA57zAYexWwJNhqMiYW+wQD8eNVRbxV0K1FLd?=

=?iso-8859-1?Q?qXjlPIKHnWsvJerYxPeO004TKShOwq8Q=3D=3D?=

x-ms-exchange-antispam-messagedata-chunkcount: 1

x-ms-exchange-antispam-messagedata-0:

=?iso-8859-1?Q?ZCjyvffsqhpktWpPTo1B9Hva2jgmQWC01xcQPAvHuwI1L2wqXnLn+kW8kC?=

=?iso-8859-1?Q?IYAh0zn6a3mZxLXVRY032XY5Sxj0UtMoqmzkogv7mD00oR+/xNZBz/CL6O?=

=?iso-8859-1?Q?B0SKP4uBz5D+N4Lg0of4/3c6jmtjN6k35OeXKsfUQzezHFPW6QEpYy/vWI?=

=?iso-8859-1?Q?kWFS7uB3rueaXDYEQRq/AtLHvKbRrc3LpQq7spVobtVbzxjrdUAwVNJ7+2?=

=?iso-8859-1?Q?ini//i9R91To5xEb3KtoUHHgNe8cbY33FxZaC0LOCip637nbgnJGAgP/RG?=

=?iso-8859-1?Q?zQ3smtrspyZJRwkk6aZDCTjWBTklVeCInA6n8KsxydCjbaOuot1SBoaHdA?=

=?iso-8859-1?Q?DWT87VUvpyoIJFGU9wITH0tE/8Sgfzz0yjupaD9LypaMGJOt3CAm4TElXC?=

=?iso-8859-1?Q?3qLXErPOylGtd7XSxFnvs081tONzg4jx0/8VH0r79eGO4mh1VkL2vv3dtf?=

=?iso-8859-1?Q?s1THSlMmwVBrV/sGWXhzpp2EPxA46/AFW7seGrK8RKPKCitLdTDHQE214v?=

=?iso-8859-1?Q?sn8SfTvQdYqATCBJykRduCroZEPvoZYbfJA5ZrD+9ABFYQNpKruFVLm0y/?=

=?iso-8859-1?Q?yuj/I9V/B98hYyengCGtWJGkJwoQwKjbZYGynCxqgrYpoAwsqNc2rCPds+?=

=?iso-8859-1?Q?1fiRmgVoJyfUIWi0TmQpDlgfb8LVFenAVMRXZIx8lOhgrvRrFhDh2E+8mi?=

=?iso-8859-1?Q?FwkbRUboGAE42Zl60xY9XbPUlWvU27UDO6T2h+iQx/QjnQm99DVmMGny8o?=

=?iso-8859-1?Q?7tg4ezaPr0V8wcOJt699UIchOonX2x7DaEdX828HfFp0xP0dcF0HS7fRuf?=

=?iso-8859-1?Q?mnlM+STNmWg1pHc9km2qc/8AAaE146qyUnHW9DXAJz9kwiEBIVEwPTk4W4?=

=?iso-8859-1?Q?laB7bQPMYz612gKgo3n7bQi8XwAej/Fq/rIhrLsTvV8ysplXTPlTs4uHbj?=

=?iso-8859-1?Q?e8ZSdZbKeLilo0zvbRTm+uifzm9dhdRa9Wv5kqclzwWSaUxlhYf4ZV+8t7?=

=?iso-8859-1?Q?ZfzCvWJLC/iVniqqNntWoZcquc2ajUipScyCxgfJpcSwD7CCcPFTKWloLB?=

=?iso-8859-1?Q?riEtTdQ6FuQ22P1NxgYHloDcufET2N1FKPWiRfHxhDxlDGk84RrF9CagMW?=

=?iso-8859-1?Q?CXi2Pfo/+EnLkLetsKhVJ8InJKrImp12+tcy0stdwY6ohXCPazc1PQfiI/?=

=?iso-8859-1?Q?Sy/3wL8dbU7Tjih2BfJ+2kPIX5+0ovRHsC45I6lEYXI3/jugEUHplSF5Pb?=

=?iso-8859-1?Q?sxQlIClhn+rtEx0d1PNA+7h3Uav5l/k3YSWGSJbMzL2GaMZv9qeOYwq7tn?=

=?iso-8859-1?Q?KVDGo/o9Qrpi7TZeGrVVTNwyCZ4b+IUxiqCk743tLeNr1Aa21BPfaKOzIg?=

=?iso-8859-1?Q?osWPwRWd8usKb77oPVScF5MdWhpTWtql2h1QcbTQ9E0oXUHDUNykJRFEWx?=

=?iso-8859-1?Q?CQoz3gtKlAYZB2kJQSPTFtTZaKHStFE3rX+7h5e0n9zsbYcbTr/5BpvS5T?=

=?iso-8859-1?Q?kjlIOsWnB2zwXVR2TgDhD7?=

Content-Type: multipart/alternative;

boundary="_000_TYZPR01MB6195F032A64972D90EA3D3008EC02TYZPR01MB6195apcp_"

MIME-Version: 1.0

X-OriginatorOrg: outlook.com

X-MS-Exchange-CrossTenant-AuthAs: Internal

X-MS-Exchange-CrossTenant-AuthSource: TYZPR01MB6195.apcprd01.prod.exchangelabs.com

X-MS-Exchange-CrossTenant-RMS-PersistedConsumerOrg: 00000000-0000-0000-0000-000000000000

X-MS-Exchange-CrossTenant-Network-Message-Id: 858e04a6-99e4-46ae-2a2a-08dee8eabd1c

X-MS-Exchange-CrossTenant-originalarrivaltime: 23 Jul 2026 18:46:42.5486

(UTC)

X-MS-Exchange-CrossTenant-fromentityheader: Hosted

X-MS-Exchange-CrossTenant-id: 84df9e7f-e9f6-40af-b435-aaaaaaaaaaaa

X-MS-Exchange-CrossTenant-rms-persistedconsumerorg: 00000000-0000-0000-0000-000000000000

X-MS-Exchange-Transport-CrossTenantHeadersStamped: SEL0PF8C30FB8E0



--_000_TYZPR01MB6195F032A64972D90EA3D3008EC02TYZPR01MB6195apcp_

Content-Type: text/plain; charset="iso-8859-1"

Content-Transfer-Encoding: quoted-printable



Hi,



I visited your site and it looks great, but it seems to be falling short on=

search engine rankings for Google, Yahoo, and Bing.



Can I send over my price list and a proposal to help you improve your resul=

ts?



Thank you!





--_000_TYZPR01MB6195F032A64972D90EA3D3008EC02TYZPR01MB6195apcp_

Content-Type: text/html; charset="iso-8859-1"

Content-Transfer-Encoding: quoted-printable








1">








xt-indent: 0px; background-color: rgb(255, 255, 255); margin: 0px; font-fam=

ily: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sa=

ns-serif; font-size: 12pt; color: rgb(0, 0, 0);">

Hi,



xt-indent: 0px; background-color: rgb(255, 255, 255); margin: 0px; font-fam=

ily: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sa=

ns-serif; font-size: 12pt; color: rgb(0, 0, 0);">







xt-indent: 0px; background-color: rgb(255, 255, 255); margin: 0px; font-fam=

ily: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sa=

ns-serif; font-size: 12pt; color: rgb(0, 0, 0);">

I visited your site and it looks great, but it seems to be falling short on=

search engine rankings for Google, Yahoo, and Bing.



xt-indent: 0px; background-color: rgb(255, 255, 255); margin: 0px; font-fam=

ily: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sa=

ns-serif; font-size: 12pt; color: rgb(0, 0, 0);">







xt-indent: 0px; background-color: rgb(255, 255, 255); margin: 0px; font-fam=

ily: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sa=

ns-serif; font-size: 12pt; color: rgb(0, 0, 0);">

Can I send over my price list and a proposal to help you improve your resul=

ts?



xt-indent: 0px; background-color: rgb(255, 255, 255); margin: 0px; font-fam=

ily: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sa=

ns-serif; font-size: 12pt; color: rgb(0, 0, 0);">







xt-indent: 0px; background-color: rgb(255, 255, 255); margin: 0px; font-fam=

ily: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sa=

ns-serif; font-size: 12pt; color: rgb(0, 0, 0);">

Thank you!



nt, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; c=

olor: rgb(0, 0, 0);">












--_000_TYZPR01MB6195F032A64972D90EA3D3008EC02TYZPR01MB6195apcp_--

Nigerian investment phish from Thailand

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 23 Jul 2026 12:46:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wmyPz-00000000GV3-34YX

for dave@doctor.nl2k.ab.ca;

Thu, 23 Jul 2026 12:45:15 -0600

Resent-From: The Doctor

Resent-Date: Thu, 23 Jul 2026 12:45:15 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from ns1.suksangroup.com ([103.13.31.55]:60544)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wmxy2-00000000E0K-2NRK

for sales@nk.ca;

Thu, 23 Jul 2026 12:16:33 -0600

DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed;

d=suksangroup.co.th; s=default; h=Content-Transfer-Encoding:Content-Type:

MIME-Version:Message-ID:Date:Subject:To:From:Reply-To:Sender:Cc:Content-ID:

Content-Description:Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc

:Resent-Message-ID:In-Reply-To:References:List-Id:List-Help:List-Unsubscribe:

List-Subscribe:List-Post:List-Owner:List-Archive;

bh=iFpLixXuK86AMKxGQL1HQ5PbJ1YZwy4FghoV6vZyNOI=; b=t2eDCsBYN2GIRKBLYu+xl/YT0B

dvJy/OUCGMbLZscuW7xH66hSPQ/OsWt38APHPCstLPN3nMdaLfdPJ5WedcJX4ArgNd8AWNjlmc5n3

GYWYBNcGFH5a67zp4xyi5nmiqt22/ZEoSVdrjZC9Ul/DAaMvpmP0gaPISz5y4IybpMwCnMjIFmkXR

oPU6hicDfAXjeOZLMAMd3uNSNoWs9G5ZtL4qIHTQZNhgjZyj+ESKAmqxOeSLmLaFLfAYisHReAWTX

sWrQ+5y7sokW1R9WpreQK+HAGp2Yg4FY7uTrSMr4BATR4QV7nneNDwaMPUHLWRgZjpCZOHLze36OT

dd+hdWyw==;

Received: from [87.192.104.194] (port=36213)

by ns1.suksangroup.com with esmtpsa (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.99.4)

(envelope-from )

id 1wmxxC-0000000G97T-15jB

for sales@nk.ca;

Fri, 24 Jul 2026 01:15:30 +0700

Reply-To: hanns.schofield@lexcapitalgrowth.com

From: Andrews Harry Schofied/

To: sales@nk.ca

Subject: Dear sales, ROI

Date: 23 Jul 2026 19:15:28 +0100

Message-ID: <20260723191528.A94AB322ED65090D@vetanymall.com>

MIME-Version: 1.0

Content-Type: text/html

Content-Transfer-Encoding: quoted-printable

X-AntiAbuse: This header was added to track abuse, please include it with any abuse report

X-AntiAbuse: Primary Hostname - ns1.suksangroup.com

X-AntiAbuse: Original Domain - nk.ca

X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12]

X-AntiAbuse: Sender Address Domain - vetanymall.com

X-Get-Message-Sender-Via: ns1.suksangroup.com: authenticated_id: smtp@suksangroup.co.th

X-Authenticated-Sender: ns1.suksangroup.com: smtp@suksangroup.co.th

X-Source:

X-Source-Args:

X-Source-Dir:

X-Spam_score: 10.7

X-Spam_score_int: 107

X-Spam_bar: ++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Dear sales I represent a consortium of high-net-worth investors

and policymakers with access to over US$5 billion (Five Billion United States

Dollars) in investment capital.



Content analysis details: (10.7 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[103.13.31.55 listed in dnsbl.ahbl.org]

[103.13.31.55 listed in dnsbl.ahbl.org]

[103.13.31.55 listed in dnsbl.ahbl.org]

[103.13.31.55 listed in dnsbl.ahbl.org]

[87.192.104.194 listed in dnsbl.ahbl.org]

[87.192.104.194 listed in dnsbl.ahbl.org]

[87.192.104.194 listed in dnsbl.ahbl.org]

[87.192.104.194 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[103.13.31.55 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[103.13.31.55 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[103.13.31.55 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[103.13.31.55 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[87.192.104.194 listed in will-spam-for-food.eu.org]

[87.192.104.194 listed in will-spam-for-food.eu.org]

[87.192.104.194 listed in will-spam-for-food.eu.org]

[87.192.104.194 listed in will-spam-for-food.eu.org]

[87.192.104.194 listed in will-spam-for-food.eu.org]

[87.192.104.194 listed in will-spam-for-food.eu.org]

[87.192.104.194 listed in will-spam-for-food.eu.org]

[87.192.104.194 listed in will-spam-for-food.eu.org]

[103.13.31.55 listed in will-spam-for-food.eu.org]

[103.13.31.55 listed in will-spam-for-food.eu.org]

[103.13.31.55 listed in will-spam-for-food.eu.org]

[103.13.31.55 listed in will-spam-for-food.eu.org]

[103.13.31.55 listed in will-spam-for-food.eu.org]

[103.13.31.55 listed in will-spam-for-food.eu.org]

[103.13.31.55 listed in will-spam-for-food.eu.org]

[103.13.31.55 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_SBL_XBL RBL: Received via a relay in Spamhaus SBL+XBL

[87.192.104.194 listed in sbl-xbl.spamhaus.org]

1.5 RCVD_IN_CBL RBL: Received via a relay in cbl.abuseat.org

[Listed by XBL, see ]

1.6 RCVD_IN_BRBL_LASTEXT RBL: No description available.

[103.13.31.55 listed in bb.barracudacentral.org]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[103.13.31.55 listed in bl.score.senderscore.com]

1.0 SPF_SOFTFAIL SPF: sender does not match SPF record (softfail)

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

0.0 HTML_MESSAGE BODY: HTML included in message

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

2.5 ADVANCE_FEE_3_NEW Appears to be advance fee fraud (Nigerian 419)

Subject: {SPAM?} Dear sales, ROI














-html oneComWebmail-mail">


ace: pre-wrap;">Dear sales


e-space: pre-wrap;">I represent a consortium of high-net-worth investors an=

d policymakers with access to over US$5 billion (Five Billion United=

States Dollars) in investment capital.


style=3D"white-space: pre-wrap;">We are actively seeking opportunities to e=

xpand and relocate our business interests internationally across various se=

ctors, including:


pre-wrap;">If you have a solid background, proven expertise, and a well dev=

eloped business idea capable of delivering strong returns in any of the abo=

ve sectors  or in any other profitable and legitimate business venture=

in your country  I would like to explore a potential collaboration.
p>

We are p=

repared to provide full funding and operational support for viable projects=

that can generate a minimum of 10% annual return on investment (AROI)
b>. We are open to Joint Venture partnerships as well as structured =

loan financing arrangements.


e=3D"white-space: pre-wrap;">I am confident this proposal will be of intere=

st to you. I am available at your earliest convenience to discuss the detai=

ls and answer any questions you may have. Upon receipt of your positive res=

ponse, I will promptly forward comprehensive information regarding this inv=

estment opportunity.


e: pre-wrap;">I look forward to your prompt reply and the possibility of es=

tablishing a mutually beneficial partnership.

Andrews Harry S=

chofied


Dragonfly International / Intelcom Phish

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 23 Jul 2026 12:46:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wmyPt-00000000GUW-47SU

for dave@doctor.nl2k.ab.ca;

Thu, 23 Jul 2026 12:45:09 -0600

Resent-From: The Doctor

Resent-Date: Thu, 23 Jul 2026 12:45:09 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from vps.fslocal.com ([199.83.208.249]:44046)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wmxy3-00000000E08-3GZc

for sales@nk.ca;

Thu, 23 Jul 2026 12:16:36 -0600

DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed;

d=laravel.perksona.com; s=default; h=MIME-Version:Date:

Content-Transfer-Encoding:Message-ID:Subject:To:From:Content-Type:Sender:

Reply-To:Cc:Content-ID:Content-Description:Resent-Date:Resent-From:

Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:In-Reply-To:References:

List-Id:List-Help:List-Unsubscribe:List-Subscribe:List-Post:List-Owner:

List-Archive; bh=sDNfpZErZvXaokLFnuFHft4Svn7KnO6x598cSskuhiQ=; b=FK0sTV7Nx48X

PFHwU4WzCFQo3LGbnHMHA3XtTYyY2ZDFAH2/uyaoiO4Fv7dpKYQBNmpEis/eOWkpJeClS2aAInJYC

Vs5HE5Bb5/AJb7fcFISP/zTIYmkdn1QcR47xE+JbvKrz5sebMw8h4OT7BpS16QXXNqzyJwA1OWrv7

6dEmn8PmMcT9+H/juHOwvptLbP+sHkOuZdvmAMS05bDFDTCTPPS4m48AgbsV3/G2MeBVgsiXZq5LA

z2mzdiCListTW1TGQFc+Fk68Y2U4eMcBLUrQx+l1d3Ec8NAh13fnzzUoth6Z5gPaqpTZhKeF98h2b

NHAgt65TcpH3/WUa1JRelQ==;

Received: from [196.75.237.86] (port=57305 helo=[127.0.0.1])

by vps.fslocal.com with esmtpsa (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.99.4)

(envelope-from )

id 1wmxxC-00000001Oa5-06xr

for sales@nk.ca;

Thu, 23 Jul 2026 14:15:30 -0400

Content-Type: text/html

From: Intelcom

To: sales@nk.ca

Subject: Intelcom Delivery Notification

Message-ID: <25824e06-865d-4a31-f5a7-6b24b2b57752@laravel.perksona.com>

Content-Transfer-Encoding: quoted-printable

Date: Thu, 23 Jul 2026 18:15:28 +0000

MIME-Version: 1.0

X-AntiAbuse: This header was added to track abuse, please include it with any abuse report

X-AntiAbuse: Primary Hostname - vps.fslocal.com

X-AntiAbuse: Original Domain - nk.ca

X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12]

X-AntiAbuse: Sender Address Domain - laravel.perksona.com

X-Get-Message-Sender-Via: vps.fslocal.com: authenticated_id: info-mjqu@laravel.perksona.com

X-Authenticated-Sender: vps.fslocal.com: info-mjqu@laravel.perksona.com

X-Source:

X-Source-Args:

X-Source-Dir:

X-Spam_score: 8.2

X-Spam_score_int: 82

X-Spam_bar: ++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Intelcom Delivery Update



Content analysis details: (8.2 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_SBL_XBL RBL: Received via a relay in Spamhaus SBL+XBL

[196.75.237.86 listed in sbl-xbl.spamhaus.org]

1.5 RCVD_IN_CBL RBL: Received via a relay in cbl.abuseat.org

[Listed by XBL, see ]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[196.75.237.86 listed in dnsbl.ahbl.org]

[196.75.237.86 listed in dnsbl.ahbl.org]

[196.75.237.86 listed in dnsbl.ahbl.org]

[196.75.237.86 listed in dnsbl.ahbl.org]

[199.83.208.249 listed in dnsbl.ahbl.org]

[199.83.208.249 listed in dnsbl.ahbl.org]

[199.83.208.249 listed in dnsbl.ahbl.org]

[199.83.208.249 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[196.75.237.86 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[196.75.237.86 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[196.75.237.86 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[196.75.237.86 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[196.75.237.86 listed in will-spam-for-food.eu.org]

[196.75.237.86 listed in will-spam-for-food.eu.org]

[196.75.237.86 listed in will-spam-for-food.eu.org]

[196.75.237.86 listed in will-spam-for-food.eu.org]

[196.75.237.86 listed in will-spam-for-food.eu.org]

[196.75.237.86 listed in will-spam-for-food.eu.org]

[196.75.237.86 listed in will-spam-for-food.eu.org]

[196.75.237.86 listed in will-spam-for-food.eu.org]

[199.83.208.249 listed in will-spam-for-food.eu.org]

[199.83.208.249 listed in will-spam-for-food.eu.org]

[199.83.208.249 listed in will-spam-for-food.eu.org]

[199.83.208.249 listed in will-spam-for-food.eu.org]

[199.83.208.249 listed in will-spam-for-food.eu.org]

[199.83.208.249 listed in will-spam-for-food.eu.org]

[199.83.208.249 listed in will-spam-for-food.eu.org]

[199.83.208.249 listed in will-spam-for-food.eu.org]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[199.83.208.249 listed in bl.score.senderscore.com]

-0.0 SPF_PASS SPF: sender matches SPF record

0.0 HTML_MESSAGE BODY: HTML included in message

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.8 SARE_FROM_SPAM_WORD3 I don't know people named this!

2.0 RATWR8_MESSID Message-ID with excessive dashes and dollars

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

Subject: {SPAM?} Intelcom Delivery Notification
















MARGIN: 30px auto; border-radius: 10px; box-shadow: 0 4px 10px rgba(0,0,0,0=

.08)">


center; PADDING-TOP: 20px; PADDING-LEFT: 20px; PADDING-RIGHT: 20px">

Intelcom










TEXT-ALIGN: center; PADDING-TOP: 30px; PADDING-LEFT: 30px; PADDING-RIGHT: =

30px">

Delivery Update





Your package is currently being processed and =

requires a small fee for customs handling.






18px; FONT-WEIGHT: bold; COLOR: #04ab94">Amount due: 2.96 CAD





Please confirm your delivery =

details to ensure a smooth delivery experience.




BACKGROUND: #04ab94; MARGIN-TOP: 20px; FONT-WEIGHT: bold; COLOR: #ffffff; =

PADDING-BOTTOM: 12px; PADDING-TOP: 12px; PADDING-LEFT: 25px; DISPLAY: =

inline-block; PADDING-RIGHT: 25px; border-radius: 6px">Manage My Delivery =








#f1f1f1; COLOR: #888; PADDING-BOTTOM: 20px; TEXT-ALIGN: center; =

PADDING-TOP: 20px; PADDING-LEFT: 20px; PADDING-RIGHT: 20px">

This is an automated message. Please do not reply.=





© 2026 Intelcom Express











Interactive Brokers Canada Inc. from Microsoft

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 23 Jul 2026 12:45:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wmyPe-00000000GSs-0UiP

for dave@doctor.nl2k.ab.ca;

Thu, 23 Jul 2026 12:44:54 -0600

Resent-From: The Doctor

Resent-Date: Thu, 23 Jul 2026 12:44:53 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from [20.231.3.235] (port=42683 helo=promos.cn-index-28circle.com)

by doctor.nl2k.ab.ca with esmtp (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wmxkj-00000000Chb-4AIq

for root@nk.ca;

Thu, 23 Jul 2026 12:02:46 -0600

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; s=default;

d=promos.cn-index-28circle.com;

h=Content-Type:MIME-Version:From:To:Subject:Date:Message-ID;

i=press@qvuvaw.promos.cn-index-28circle.com;

bh=oJWDuL+YyERlNvFbIhjME+nQvwwwZi3E1fQOmchXTls=;

b=bO4GGmnnobAsHUNvLzh6ppzDLDVqeRvZ+KBOhloXHD74JE3y0CK6k3A8noivggJ3Gz15xDH0R8I0

ZzZ3ursgbjFr/oihvU3bLzIUwTOv9xY8IxZTkWU2n10DlrrRhrlpn87Rbx6ANwLf9M989Csh8A4F

54hEMdLD/eN3p/XtWU2Loy0JpVEqYj3CKbhOjH/r7te+2hWOR17+v7lQ2TXmV8ZrM0rAdStHHkYp

DLg8UScmjeT7unBf9F/4jCxMqbJc9J/m6hCiGpDe4ymTTJ6BRdcJtgACz6WmeapH5qOzIR8J5wPv

CfqiN3Hlcfewa1NYdI0H5s4khyLJivqnDa89qQ==

Content-Type: multipart/alternative;

boundary="===============0795898577742607593=="

MIME-Version: 1.0

From:

=?utf-8?b?SeKAi0LigItL4oCLUuKAiyDigItB4oCLY+KAi2PigItv4oCLdeKAi27igIt04oCLIOKAi03igIth4oCLbuKAi2HigItn4oCLZeKAi23igItl4oCLbuKAi3Q=?=



To: root@nk.ca

Subject: [Interactive Brokers Canada] Account Status Notice Verification

Required Within 48 Hours

Date: Fri, 24 Jul 2026 03:01:50 +0900

Message-ID:

<178482971005.3844.17283840139974267720@qvuvaw.promos.cn-index-28circle.com>

List-Unsubscribe-Post: List-Unsubscribe=One-Click

X-Auto-Response-Suppress: OOF, DR, RN, NRN

Feedback-ID: campaign:qvuvaw.promos.cn-index-28circle.com:mailer

X-Entity-Ref-ID: cbce9d31-95ef-4bf6-9857-ea887066be25

X-Spam_score: 8.9

X-Spam_score_int: 89

X-Spam_bar: ++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: [Interactive Brokers Canada] Account Status Notice: Verification

Required Within 48 Hours Dear root, This notice is issued by Interactive

Brokers Canada Inc. in connection with an outstanding account verification

requirement that affects the operational status of your trading account.



Content analysis details: (8.9 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[20.231.3.235 listed in dnsbl.ahbl.org]

[20.231.3.235 listed in dnsbl.ahbl.org]

[20.231.3.235 listed in dnsbl.ahbl.org]

[20.231.3.235 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[20.231.3.235 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[20.231.3.235 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[20.231.3.235 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[20.231.3.235 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[20.231.3.235 listed in will-spam-for-food.eu.org]

[20.231.3.235 listed in will-spam-for-food.eu.org]

[20.231.3.235 listed in will-spam-for-food.eu.org]

[20.231.3.235 listed in will-spam-for-food.eu.org]

[20.231.3.235 listed in will-spam-for-food.eu.org]

[20.231.3.235 listed in will-spam-for-food.eu.org]

[20.231.3.235 listed in will-spam-for-food.eu.org]

[20.231.3.235 listed in will-spam-for-food.eu.org]

-0.0 SPF_HELO_PASS SPF: HELO matches SPF record

2.5 URIBL_DBL_SPAM Contains a spam URL listed in the DBL blocklist

[URI: cn-index-28circle.com]

-0.0 SPF_PASS SPF: sender matches SPF record

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[20.231.3.235 listed in bl.score.senderscore.com]

1.5 MR_STRANGE_QUESTION URI: No description available.

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

1.5 TVD_PH_BODY_ACCOUNTS_PRE The body matches phrases such as "accounts

suspended", "account credited", "account

verification"

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

0.8 SARE_FROM_SPAM_WORD3 I don't know people named this!

1.3 RDNS_NONE Delivered to internal network by a host with no rDNS

Subject: {SPAM?} [Interactive Brokers Canada] Account Status Notice Verification

Required Within 48 Hours



Interactive Brokers Canada Inc. — CIRO Dealer Member • CIPF Participant



Interactive Brokers Canada



Account Status — Pending Verification



Verification Required Within 48 Hours to Maintain Full Account Functionality



Dear root,



This notice is issued by Interactive Brokers Canada Inc. regarding a required account verification that has not yet been completed. This forms part of our ongoing compliance obligations under CIRO rules and applicable Canadian securities legislation.



Progressive Restriction Timeline



Should verification remain outstanding beyond 48 hours from this notice, the following measures will take effect in sequence:



Phase 1



Deposit & Funding Suspension



Incoming Electronic Fund Transfers (EFT) and wire deposits will be temporarily held pending verification clearance. Internal transfers from linked bank accounts will not be processed.



Phase 2



Withdrawal Processing Hold



Outbound disbursement requests, including EFT withdrawals and wire transfers, will be queued and held until the verification requirement is satisfied.



Phase 3



Order Entry Restriction



Opening transactions across all asset classes — equities, options, futures, foreign exchange, and fixed income — will be restricted to closing-only. Existing positions may be reduced or closed but not increased.



No restrictions are currently active on your account. The measures described above take effect only if verification remains outstanding.



Completing the Verification



Log in to the Interactive Brokers Client Portal

The dashboard displays a notification indicating the specific verification item required

Follow the guided process, which typically requires under five minutes to complete

Upon confirmation, the verification status is updated and no restrictions will apply



Log In to Complete Verification



Secure Interactive Brokers Client Portal



If you believe this notice was issued in error or have already completed the verification, please contact Interactive Brokers Canada Client Services.



1-877-745-4222



Monday through Friday, 8:00 a.m. to 5:30 p.m. Eastern Time



Prompt action is appreciated to avoid any interruption to your trading and account services. These restrictions are reversible immediately upon verification completion.



Interactive Brokers Canada Inc.



Client Account Services



Interactive Brokers Canada Inc. is a member of the Canadian Investment Regulatory Organization (CIRO) and the Canadian Investor Protection Fund (CIPF). Registered office: 1800 McGill College Avenue, Suite 2106, Montreal, Quebec, H3A 3J6. All trading activity is subject to the terms of the Interactive Brokers Canada Client Agreement and applicable CIRO rules. This notice is issued for compliance purposes.



CIRO Member • CIPF Participant • FINTRAC Reporting Entity

Payment Schedule phish from Google Gmail

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 23 Jul 2026 12:45:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wmyPO-00000000GRZ-0ZMB

for dave@doctor.nl2k.ab.ca;

Thu, 23 Jul 2026 12:44:38 -0600

Resent-From: The Doctor

Resent-Date: Thu, 23 Jul 2026 12:44:37 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-pl1-f230.google.com ([209.85.214.230]:44320)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wmxAb-000000005oJ-1RSN

for support@nk.ca;

Thu, 23 Jul 2026 11:25:27 -0600

Received: by mail-pl1-f230.google.com with SMTP id d9443c01a7336-2ce87c7e3bbso10849365ad.1

for ; Thu, 23 Jul 2026 10:24:29 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=sabeng.it; s=google; t=1784827463; x=1785432263; darn=nk.ca;

h=content-type:mime-version:date:content-transfer-encoding:message-id

:subject:to:from:from:to:cc:subject:date:message-id:reply-to

:content-type;

bh=2Qd++MhFVn/+JzWjUONsUGSuFncRBpZ1V7WcMOzblGY=;

b=EapluV3Aj02aBZCK2y1FdaB2UFa72ye5AlEcVibX1T+bC6YiPpNAorQie1VrmTEeUj

m5SgE3fuHvOho1AKG8pFWwJTuXqlQ0EmcjGvE1pJXjepVFxZBJ61+WoOlMqeqI5p75BH

HTUJTINIjZOllG1JvQ/AepxunG71iGrUlUl5Y=

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20251104; t=1784827463; x=1785432263;

h=content-type:mime-version:date:content-transfer-encoding:message-id

:subject:to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date

:message-id:reply-to:content-type;

bh=2Qd++MhFVn/+JzWjUONsUGSuFncRBpZ1V7WcMOzblGY=;

b=dzBpGBT/x7f8QCvlX+yNybJW+X1plzqGzRyqTgvxuk+8dY3svjGiMTXl9qttkmlmFL

4ZPnsaqr2Za2OugbQhndiVBeqc52p7+iJsuukW5p9yIr0hHnx8xal8xF9RhMqiTMjiFj

OfwPPmKGT4/7Kl4kiEbF7v7L+KAM908AmzTFJ347VdCoE2Naz30XxNHdKowKMvmSKacG

tlNieUvtlOe0l4aoM808M8/jR3Qj2HhY3GyMDohdL+Bin2O09hlxOTrVzu9u9oCSPVd/

K2AGyl9xiTNEIJQoYuxzcPvW8W2O5poOo92cqYMTzxNPdV8nv23+QY6EJVZh4QBuw/AX

p05A==

X-Gm-Message-State: AOJu0YykAa+lf0yIsaNDu3zPrKTCnR3SE7RQSVhhegQZ0qQPOjES7HEq

XAStDMmlIFPKFf5XlNEyOy24YQ8vDz6BoCUQE+piZDv1v5OWmOh9UNq/m7RfjEoBk+trqCwHDLO

OZXo6Qals5ZL7wIHKDyWYsHxyR6yx+qMrg8G/cMbbuBBQW7o=

X-Gm-Gg: AR+sD138RvtRepzIskNETok2vmUN4vzzdLTRH87cW6RAdfg0h8smjqKBuQJo1WGiJPX

tyulvzNDwqlPR8fTS3NA7eD1On3yL9TUveMFy8LKcd4HHcW4lRPcRM2s9hYsz0AaTVNOCFqcgID

6UxdVfj0sJXLyeZlVJVy+WZuPr4QAFhuRiLzhVndZZtHe6s3PaeUVICDpqQUoyLAXepPWPyv5HU

NzXsFrAPRmoZ1n0QAWn4JrWSxcq8Ev+Jk/KObk0n9SMBRRGyVdVJJClMe00ovixPsG8Ao5HCMZA

vKkWguzdDHnQDbbweTCMCHj5C283ICaTpIqrFa61DGQGkFlrXU9WfM1SejaeIBpFYi3VQd6YOM5

t4YhgKsyWYrbQ

X-Received: by 2002:a17:903:b10:b0:2cf:bf3e:4812 with SMTP id d9443c01a7336-2cfbf3e49edmr2547175ad.2.1784827463607;

Thu, 23 Jul 2026 10:24:23 -0700 (PDT)

Received: from sabprogetti.com ([192.210.236.148])

by smtp-relay.gmail.com with ESMTPS id d9443c01a7336-2cf8efb627fsm5847765ad.1.2026.07.23.10.24.23

for

(version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256);

Thu, 23 Jul 2026 10:24:23 -0700 (PDT)

X-Relaying-Domain: sabeng.it

From: "Payment Stacks|Schedule| Online Review/OU=EXCHANGE ADMINISTRATIVE

GROUP (FYDIBOHF23SPDLT)/CN=RECIPIENTS/CN=B7A707497B564FD-26983"



To: support@nk.ca

Subject: =?UTF-8?Q?ACH_Payment_Status_Update_=EF=BF=BD_July?=

=?UTF-8?Q?_12=2C_2026_=EF=BF=BD_07/23/2026_?=

=?UTF-8?Q?=EF=BF=BD_support=40nk=2Eca?=

Message-ID:

Content-Transfer-Encoding: quoted-printable

Date: Thu, 23 Jul 2026 17:24:21 +0000

MIME-Version: 1.0

Content-Type: text/html; charset=utf-8

X-Spam_score: 5.2

X-Spam_score_int: 52

X-Spam_bar: +++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview:  Payment Due: 23/07/2026 033847 Amount Paid: $2,355.00



Content analysis details: (5.2 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[209.85.214.230 listed in dnsbl.ahbl.org]

[209.85.214.230 listed in dnsbl.ahbl.org]

[209.85.214.230 listed in dnsbl.ahbl.org]

[209.85.214.230 listed in dnsbl.ahbl.org]

[192.210.236.148 listed in dnsbl.ahbl.org]

[192.210.236.148 listed in dnsbl.ahbl.org]

[192.210.236.148 listed in dnsbl.ahbl.org]

[192.210.236.148 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[209.85.214.230 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[209.85.214.230 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[209.85.214.230 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[209.85.214.230 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[192.210.236.148 listed in will-spam-for-food.eu.org]

[192.210.236.148 listed in will-spam-for-food.eu.org]

[192.210.236.148 listed in will-spam-for-food.eu.org]

[192.210.236.148 listed in will-spam-for-food.eu.org]

[192.210.236.148 listed in will-spam-for-food.eu.org]

[192.210.236.148 listed in will-spam-for-food.eu.org]

[192.210.236.148 listed in will-spam-for-food.eu.org]

[192.210.236.148 listed in will-spam-for-food.eu.org]

[209.85.214.230 listed in will-spam-for-food.eu.org]

[209.85.214.230 listed in will-spam-for-food.eu.org]

[209.85.214.230 listed in will-spam-for-food.eu.org]

[209.85.214.230 listed in will-spam-for-food.eu.org]

[209.85.214.230 listed in will-spam-for-food.eu.org]

[209.85.214.230 listed in will-spam-for-food.eu.org]

[209.85.214.230 listed in will-spam-for-food.eu.org]

[209.85.214.230 listed in will-spam-for-food.eu.org]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[209.85.214.230 listed in list.dnswl.org]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-0.0 SPF_PASS SPF: sender matches SPF record

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

-0.0 RCVD_IN_MSPIKE_H3 RBL: Good reputation (+3)

[209.85.214.230 listed in wl.mailspike.net]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[209.85.214.230 listed in bl.score.senderscore.com]

0.0 HTML_MESSAGE BODY: HTML included in message

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.6 HTML_MIME_NO_HTML_TAG HTML-only message, but there is no HTML tag

2.0 RATWR8_MESSID Message-ID with excessive dashes and dollars

0.0 LOTS_OF_MONEY Huge... sums of money

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

-0.0 RCVD_IN_MSPIKE_WL Mailspike good senders

0.0 NO_RDNS2 Sending MTA has no reverse DNS

Subject: {SPAM?} =?UTF-8?Q?ACH_Payment_Status_Update_=EF=BF=BD_July?=

=?UTF-8?Q?_12=2C_2026_=EF=BF=BD_07/23/2026_?=

=?UTF-8?Q?=EF=BF=BD_support=40nk=2Eca?=



=EF=BB=BF


 




, 255, 255);color:rgb(34, 34, 34);font-family:Arial, Helvetica, =

sans-serif;font-size:small;font-style:normal;font-variant-caps:normal;font-=

variant-ligatures:normal;font-weight:400;letter-spacing:normal;orphans:2;te=

xt-align:start;text-decoration-color:initial;text-decoration-style:initial;=

text-decoration-thickness:initial;text-indent:0px;text-transform:none;white=

-space:normal;widows:2;word-spacing:0px;" type=3D"cite">




t;" id=3D"m_-2910760642012011069m_467061415371348611m_4273285105508718137m_=

-599886662404354667editbody1">


7061415371348611m_4273285105508718137m_-599886662404354667v1editbody1">


m_467061415371348611m_4273285105508718137m_-599886662404354667v1v1editbody1=

">






-width:0px;font-family:Arial, Helvetica, sans-serif;font-feature-settings:&=

quot;liga" 0;font-size:small;line-height:normal;" cellspacing=3D"0" =

width=3D"553">




























10, 139, 168);border-width:0px;margin:0px;padding:0in;vertical-align:top;" =

colspan=3D"3">




style=3D"border-collapse:collapse;border-width:0px;font-family:-apple-syste=

m, BlinkMacSystemFont, "Helvetica Neue", "Segoe UI", =

Arial, sans-serif, "Apple Color Emoji", "Segoe UI =

Emoji", "Segoe UI Symbol";font-feature-settings:"liga&q=

uot; 0;font-size:13px;line-height:normal;" cellspacing=3D"0">




style=3D"height:5.25pt;">














style=3D"border-width:0px;height:5.25pt;margin:0px;padding:0in;"> 
>


style=3D"border-width:0px;margin:0px;padding:0in;width:0.25in;" =

width=3D"24"> 
style=3D"border-width:0px;margin:0px;padding:0in;">


style=3D"font-family:-apple-system, BlinkMacSystemFont, "Helvetica =

Neue", "Segoe UI", Arial, sans-serif, "Apple Color =

Emoji", "Segoe UI Emoji", "Segoe UI =

Symbol";margin:0px;">
sans-serif;font-size:13.5pt;">   





92, 208, 228);border-width:0px;margin:0px;padding:0in;width:1.5pt;" =

width=3D"2"> 
n:0px;padding:0in;">




style=3D"border-collapse:collapse;border-width:0px;font-family:-apple-syste=

m, BlinkMacSystemFont, "Helvetica Neue", "Segoe UI", =

Arial, sans-serif, "Apple Color Emoji", "Segoe UI =

Emoji", "Segoe UI Symbol";font-feature-settings:"liga&q=

uot; 0;font-size:13px;line-height:normal;" cellspacing=3D"0">












style=3D"background-color:rgb(230, 236, 244);border-width:0px;margin:0px;pa=

dding:0in;width:411.75pt;" width=3D"549">


class=3D"table" style=3D"width:411.75pt;">


style=3D"border-collapse:collapse;border-width:0px;font-family:-apple-syste=

m, BlinkMacSystemFont, "Helvetica Neue", "Segoe UI", =

Arial, sans-serif, "Apple Color Emoji", "Segoe UI =

Emoji", "Segoe UI Symbol";font-feature-settings:"liga&q=

uot; 0;line-height:normal;" cellspacing=3D"0" width=3D"549">

=



=



=



=



=



=



=



=



=



=



=



=



=



=



=


width=3D"24"> 
p;">

=


"Helvetica Neue", "Segoe UI", Arial, sans-serif, =

"Apple Color Emoji", "Segoe UI Emoji", "Segoe UI =

Symbol";margin:0px;">

64);font-family:Helvetica, sans-serif;font-size:13.5pt;">Payment&nb=

sp;   
style=3D"color:rgb(231,123,7);font-family:Helvetica, sans-serif;font-size:7=

.5pt;">Due: 23/07/2026

168);font-family:Helvetica, sans-serif;font-size:10.=

5pt;">033847



=
ttom;">

=


"Helvetica Neue", "Segoe UI", Arial, sans-serif, =

"Apple Color Emoji", "Segoe UI Emoji", "Segoe UI =

Symbol";margin:0px;text-align:right;">
62);font-family:Helvetica, sans-serif;font-size:10.5pt;">Amount =

Paid:  
62);font-family:Helvetica, sans-serif;font-size:22.5pt;">$2,355.=

00



=
width=3D"24"> 
=

 		 =

 		 =

 		 =

 









system, BlinkMacSystemFont, "Helvetica Neue", "Segoe =

UI", Arial, sans-serif, "Apple Color Emoji", "Segoe UI =

Emoji", "Segoe UI Symbol";margin:0px;"> 




style=3D"width:411.75pt;">


style=3D"border-collapse:collapse;border-width:0px;font-family:-apple-syste=

m, BlinkMacSystemFont, "Helvetica Neue", "Segoe UI", =

Arial, sans-serif, "Apple Color Emoji", "Segoe UI =

Emoji", "Segoe UI Symbol";font-feature-settings:"liga&q=

uot; 0;font-size:13px;line-height:normal;" cellspacing=3D"0" =

width=3D"549">












style=3D"border-width:0px;margin:0px;padding:0in;vertical-align:top;">


class=3D"table" style=3D"width:411.75pt;">


style=3D"border-bottom-style:solid;border-bottom-width:3pt;border-collapse:=

collapse;border-color:initial;border-left-style:none;border-left-width:medi=

um;border-right-style:none;border-right-width:medium;border-top-style:none;=

border-top-width:medium;font-family:-apple-system, BlinkMacSystemFont, =

"Helvetica Neue", "Segoe UI", Arial, sans-serif, =

"Apple Color Emoji", "Segoe UI Emoji", "Segoe UI =

Symbol";font-feature-settings:"liga" 0;line-height:normal;" =

cellspacing=3D"0" width=3D"549">

=



=



=



=



=



=



=



=


"Helvetica Neue", "Segoe UI", Arial, sans-serif, =

"Apple Color Emoji", "Segoe UI Emoji", "Segoe UI =

Symbol";line-height:12pt;margin:0px;">
tica, sans-serif;font-size:10.5pt;">Hello 
style=3D"font-family:Arial, Helvetica, sans-serif;font-size:small;">Dear =

Customer,
sans-serif;font-size:10.5pt;">,



=


"Helvetica Neue", "Segoe UI", Arial, sans-serif, =

"Apple Color Emoji", "Segoe UI Emoji", "Segoe UI =

Symbol";line-height:12pt;margin:0px;"> 



=


"Helvetica Neue", "Segoe UI", Arial, sans-serif, =

"Apple Color Emoji", "Segoe UI Emoji", "Segoe UI =

Symbol";line-height:12pt;margin:0px;">
tica, sans-serif;font-size:10.5pt;">Payment has been remitted into your =

account with receipt for your reference.



=


"Helvetica Neue", "Segoe UI", Arial, sans-serif, =

"Apple Color Emoji", "Segoe UI Emoji", "Segoe UI =

Symbol";line-height:12pt;margin:0px;"> 



=


"Helvetica Neue", "Segoe UI", Arial, sans-serif, =

"Apple Color Emoji", "Segoe UI Emoji", "Segoe UI =

Symbol";line-height:12pt;margin:0px;">
(110, 139, 168);border-radius:4px;color:white;display:inline-block;font-fam=

ily:Helvetica, sans-serif;font-size:10.5pt;padding:8px =

16px;text-decoration-line:none;" href=3D"https://laviestudio.com.br/r.=

php">VIEW PAYMENT RECEIPT



=


"Helvetica Neue", "Segoe UI", Arial, sans-serif, =

"Apple Color Emoji", "Segoe UI Emoji", "Segoe UI =

Symbol";line-height:12pt;margin:0px;"> 



=


"Helvetica Neue", "Segoe UI", Arial, sans-serif, =

"Apple Color Emoji", "Segoe UI Emoji", "Segoe UI =

Symbol";line-height:12pt;margin:0px;">
tica, sans-serif;font-size:10.5pt;">Thank you for your business.=



Sincerely,

Finance Department



=



=





class=3D"table">


style=3D"border-collapse:collapse;border-width:0px;font-family:-apple-syste=

m, BlinkMacSystemFont, "Helvetica Neue", "Segoe UI", =

Arial, sans-serif, "Apple Color Emoji", "Segoe UI =

Emoji", "Segoe UI Symbol";font-feature-settings:"liga&q=

uot; 0;line-height:normal;" cellspacing=3D"0">

=



=



=



=



=



=

=

 









92, 208, 228);border-width:0px;margin:0px;padding:0in;width:1.5pt;" =

width=3D"2"> 

1, 50, 70);border-width:0px;margin:0px;padding:0in;" colspan=3D"3">


system, BlinkMacSystemFont, "Helvetica Neue", "Segoe =

UI", Arial, sans-serif, "Apple Color Emoji", "Segoe UI =

Emoji", "Segoe UI Symbol";margin:0px;text-align:right;">&nbs=

p;
















Domain for sale spam from Google Gmail

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 23 Jul 2026 11:25:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wmx9v-000000005pT-1pN1

for dave@doctor.nl2k.ab.ca;

Thu, 23 Jul 2026 11:24:35 -0600

Resent-From: The Doctor

Resent-Date: Thu, 23 Jul 2026 11:24:35 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-pj1-f53.google.com ([209.85.216.53]:47162)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wmwZC-000000001I3-1zE2

for root@nk.ca;

Thu, 23 Jul 2026 10:46:46 -0600

Received: by mail-pj1-f53.google.com with SMTP id 98e67ed59e1d1-38e58034d05so856115a91.2

for ; Thu, 23 Jul 2026 09:45:51 -0700 (PDT)

ARC-Seal: i=1; a=rsa-sha256; t=1784825146; cv=none;

d=google.com; s=arc-20260327;

b=m9rkrPxbSCEoq7SSohkEG0+GA/Eqtu4NL++yMAzeYG/9rKkYMqHdI86CKvSLVYdr3I

25rjdwQvMp27Dxsl0AEb/2Gg9QOpbyOAcErQM2zwGUtl+ZEkIj+ZHWCKEpHT0L7GBd81

dMItj8nAJTWP2xlVkxKnL3Aw2mUAyXqzRoMSE5YjgHLb6DDhVnsz+t91UqolmAnroVUj

yjfKfft/mzkDsxN9rLygCXUC0ruhg9BLZ6tg8FdjT6CrFg6/NNNqw4Dgrk2qiyIWaCmB

qukv624LBp5DkZhJNO6XZQqM5P1ySNq/6jX10xonFi1swyitL5euLsaYhYug+9bgIX1B

XqMw==

ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20260327;

h=to:subject:message-id:date:from:in-reply-to:references:mime-version

:dkim-signature;

bh=U9+S0TOUVYaMalxetdcImgUrg8z7Ly5oBcsCxx8Pbes=;

fh=ny7+SATv4n6lSNl0rVMQyaj6POVJTUZJLShjjgjSTJg=;

b=pmgZ4aCklAs6fLI1g5SyXJa2xwHxWXtY84ctyu3XxBUGrDzUZUnMgmm5Q3Y5bAPGO1

4a1PNiVmhqmE650MOZOZhoWJd+8LvMd2E0NAC9//XAd9cXcsreg49GLXnohb9zdSVN3N

RDPIxfZLAaU05rJUqRr4l35K+h6XqY1Lb/ed6hinfNV/0MaxWouY+QqLtg/kqTHX1c1g

YNNnEVNMcV3XAO+9pQIRUZ5f8/rDLAfxahjswrbGHMAi9ZOgBuCzR/sT33Q1UL3GIvge

4MaJpYnHrwjGzwy4801blyMhhbiRvCrkBxcdEv/hzz4jrOpQ+/judjn18yzzsQ3iePQT

uqlQ==;

darn=nk.ca

ARC-Authentication-Results: i=1; mx.google.com; arc=none

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=gmail.com; s=20251104; t=1784825146; x=1785429946; darn=nk.ca;

h=content-type:to:subject:message-id:date:from:in-reply-to:references

:mime-version:from:to:cc:subject:date:message-id:reply-to

:content-type;

bh=U9+S0TOUVYaMalxetdcImgUrg8z7Ly5oBcsCxx8Pbes=;

b=OD4yxGizkvPrHK0DUdH9vhnabE7VPuydb7PWljgVyYS39ZLTGf747ftOeyoi/QjyUk

SMhsk3LqtVZvFNqOnsps1toa5pO3gJggXL6KuDNw1deJP9Jkr1zYsxFlRLvW5+kB+WIB

RQe1hBndbO4eciHo5YmktQ8CIaeEtU8Ydarjf5bAt14+iXuClfD511GesBbAgsrs+Lef

HaDgApNBMib6YWw0jSmA2MFqifZ7NynPgofhtgjkfe6goeUQtsTRpxVJQT8u/knh49Y7

/BfikjsJS7KZ9TtWo0Hs8ZNw0fmQ4ZmpZRhDdpCMwvH+IWWhv6h/fWaUKK4Xtvk0eXMm

CWig==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20251104; t=1784825146; x=1785429946;

h=content-type:to:subject:message-id:date:from:in-reply-to:references

:mime-version:x-gm-gg:x-gm-message-state:from:to:cc:subject:date

:message-id:reply-to:content-type;

bh=U9+S0TOUVYaMalxetdcImgUrg8z7Ly5oBcsCxx8Pbes=;

b=IiUiIb85qebfU/zVhkC0IYnED8BYWvpQO9b/FzfM7aI+noqSqtaTLS2uUmbG5E5YZM

2zflILNG7OGA2E2EfV4N152YqbktOMO8Ktsur6ePBdtVPuERnuupkjObtuN/zXMlTmTF

byTVcEiXb7Iy+qBgfU8gkVQ314IAzXEDvsBDS8QgJkE6/r3tUXyvKQR+Fp2AqqDtkLpA

AbJhIwFwvO1C8Kvl2KOuWpiefBGNE1A5Pxe1QcLVq4xh7SuQXFAnTON9RQwj13vv5tQl

1RVc50vwy6kziosPY0wwXJMhtdFmewe0bz/E/88A4x+z6PV4jciDhCpKULwZ1flJkBB4

GnvA==

X-Gm-Message-State: AOJu0YxhqdvLCodNu+k9oQgAwaeYWoKhiqB0J+vCg0xdnXoPK7QPtHTu

0S/3DQ/sVnhBsz7oBXzKk04saBDBwjvb5nA/IOHlNHToQpUa0zD80M/p9K7BpMeJArNBJJVgro/

5oeLP7dVYNoAdXKZl4T9/VRAaYihpY+ZoO4ea

X-Gm-Gg: AR+sD12EmziDi/UCTxbiJbw0qGnXAr9VMjn6okbGKJ2u+GzDCPmVGE6snVYD2s/u0Ij

W/jM2YQp96uMR/qiV65dYBw8hNrffeIH5XGks1eCKhVQaofSMvwQAcNp04w7Fi+q5bjtqvVdRxv

xowkMWZvK3BB+JilxzJwYZ+rRnkn6qTq0xAUqysgADkxFJb7c3S38lX+4k6QPUbH0UE9P84XVbv

NVbdvM+VPD2fkg47Wn0cX35PyTg3pjrhvLcGcPs0ewOthK004XBY9bzvQi+AoI=

X-Received: by 2002:a17:90b:530f:b0:38e:a32e:5442 with SMTP id

98e67ed59e1d1-38ec6a7a54bmr4047176a91.31.1784825145678; Thu, 23 Jul 2026

09:45:45 -0700 (PDT)

MIME-Version: 1.0

References:

In-Reply-To:

From: Peter John

Date: Thu, 23 Jul 2026 17:45:33 +0100

X-Gm-Features: AUfX_mzvLwK6t9RJnEiCGmPj0EmRJojCPXXrCcL8KBXrVeIqrWkedQDAmP8XDy8

Message-ID:

Subject: Re: EDMONTON VOIP

To: root@nk.ca

Content-Type: multipart/alternative; boundary="000000000000cb6003065749fcc1"



--000000000000cb6003065749fcc1

Content-Type: text/plain; charset="UTF-8"



Hi,



I noticed your business specializes in VOIP IN EDMONTON



The domain name

VoipEdmonton.com is currently available and could strengthen your online

presence, whether as a standalone website or by redirecting it to your

existing site.



Asking price: USD 400 or best offer.



Visit www.VoipEdmonton.com to purchase, or reply to this email if you have

any questions.



Best regards,



John



On Tue, 7 Jul 2026, 19:46 Peter John, wrote:



> Hello,

>

>

> The premium domain

> VoipEdmonton.com is currently available for purchase on GoDaddy

> Marketplace.

>

>

> This domain is a strong match for businesses offering VOIP IN EDMONTON and

> could help increase your online reach and brand visibility.

>

>

> The domain is available for $499 at www.VoipEdmonton.com.

>

>

> Please let me know if you are interested or would like to discuss further.

>

>

> Best regards,

>

>

> John.

>



--000000000000cb6003065749fcc1

Content-Type: text/html; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable



Hi,


iv dir=3D"auto">I noticed your business specializes in VOIP IN EDMONTON=C2=

=A0

The domain name=C2=

=A0
VoipEdmonton.com is currently available and coul=

d strengthen your online presence, whether as a standalone website or by re=

directing it to your existing site.


ir=3D"auto">Asking price: USD 400 or best offer.

>
Visit www.=

VoipEdmonton.com to purchase, or reply to this email if you have any qu=

estions.

Best regards,
div>

John


class=3D"gmail_quote gmail_quote_container">

_attr">On Tue, 7 Jul 2026, 19:46 Peter John, <
ndomain@gmail.com">peterjohndomain@gmail.com> wrote:

quote class=3D"gmail_quote" style=3D"margin:0 0 0 .8ex;border-left:1px #ccc=

solid;padding-left:1ex">
Hello,

iv dir=3D"auto">

The=

premium domain=C2=A0
VoipEdmonton.com is currently =

available for purchase on GoDaddy Marketplace.

<=

/div>

This domain is a strong =

match for businesses offering VOIP IN EDMONTON and could help increase your=

online reach and brand visibility.


ir=3D"auto">
The domain is available for $499 at=


r">www.VoipEdmonton.com.


uto">
Please let me know if you are interested o=

r would like to discuss further.


=3D"auto">
Best regards,
=



John.






--000000000000cb6003065749fcc1--

Domain for sale spam from Google Gmail

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 23 Jul 2026 11:25:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wmx9X-000000005mv-24AO

for dave@doctor.nl2k.ab.ca;

Thu, 23 Jul 2026 11:24:11 -0600

Resent-From: The Doctor

Resent-Date: Thu, 23 Jul 2026 11:24:11 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-pl1-f182.google.com ([209.85.214.182]:47425)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wmwYx-000000001Go-3p6Q

for sales@nk.ca;

Thu, 23 Jul 2026 10:46:32 -0600

Received: by mail-pl1-f182.google.com with SMTP id d9443c01a7336-2cad4170e8eso14111305ad.3

for ; Thu, 23 Jul 2026 09:45:37 -0700 (PDT)

ARC-Seal: i=1; a=rsa-sha256; t=1784825131; cv=none;

d=google.com; s=arc-20260327;

b=lyuBbSiCkft98Ylq5l5CxYS22bhTL62vUAig8SnJXQNzxEQXFj7Ri9zrOwelJfx9kz

2HJFfyizq6NXNm2sMIVh+WoB+HMaFEZOq0nVhzZLpok5KYiehjoqJcCgSf+Zyqw3K9Aa

9m1ZHF6qXZuYgMRPsq5UFmiY9Pd21wC063BKMp7VgQ9MLDVYFqQvqfgKXiVohpVDMsaR

Y9WUWuud/yyUTTT7egj+o8LrZEiUf9N/Xa2UvpaDcGFqxrwUQ5T9Y09qEnsbfSYX4s2f

nqgb8PZ/qSEPjXAD5/YNNLgJhgkldaXRW0n7R4Ueor2/oPZovfMKuKuSZwUO6uXXUC3a

vuPg==

ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20260327;

h=to:subject:message-id:date:from:in-reply-to:references:mime-version

:dkim-signature;

bh=y+yij4DjqkZOomAMECLGA4WzKypjHnhMxlRbG5leSNY=;

fh=C4vsnDG7cTH8aa/8f7sygxKSfblX4MPDg6mph8A3jUw=;

b=NnWNejtOUEpTsBxdFGm++96a45cmBDC1vsH0wLotZv/DGcZyj448Tafh1ImsFubijZ

63fjkFwQvlEHJCXxVka06I+1ilVZ/iI60x8HusWaEFm0aG5x6BPjJXHbCybH85yauju8

ZMeoM1gECIBHFjkm/13fy1x1NtJ4FyL3JynUjR5SM4HrZJW/r0iUEgqSqw/cFWBRxA/b

N7LeupUXn73kLF4f8EMmwtS7U6csAC6eilziObMxqQuUR1VySlLu2axvK9wseZJDGl1m

ooSoNN/h4yid8vnFtSzui2lA9q4k3n2tj5Yy5eVD+UI9aKex5E0mRRhtotKIY+fHKaSX

o5Ww==;

darn=nk.ca

ARC-Authentication-Results: i=1; mx.google.com; arc=none

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=gmail.com; s=20251104; t=1784825131; x=1785429931; darn=nk.ca;

h=content-type:to:subject:message-id:date:from:in-reply-to:references

:mime-version:from:to:cc:subject:date:message-id:reply-to

:content-type;

bh=y+yij4DjqkZOomAMECLGA4WzKypjHnhMxlRbG5leSNY=;

b=ckrx2Jd/0sWuQYDEkKno2uSdQAagtIiO8K8gwfUZnsN/PDs8nRltE8AGnuA6f4JkAO

orNw1kjWSWIds+1Q+jVqmRJJ4YkaDjkrpNsDAu7eGn0pbhjJ4nIuY73Q46kSgij0W9sl

Dz2zhsOYx+fDsb5NyfbG/QBUgF2gcjRExVwQwGyokUamVct2gF5WMKCD0KKJ2J4SyhP4

4gCzSy7DBOKBPKHExbLUpTFCmUfIH/oh7am9Z9JtcLz2ls8nOl+IlbS+d1Ub2Yx3z1PD

0CyfgfKHswHCdWLklI0YefHYLIHmc4gdFB0q3cVPJeVIW+BHffAr0xRi9+jpZj+13uxW

nUmg==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20251104; t=1784825131; x=1785429931;

h=content-type:to:subject:message-id:date:from:in-reply-to:references

:mime-version:x-gm-gg:x-gm-message-state:from:to:cc:subject:date

:message-id:reply-to:content-type;

bh=y+yij4DjqkZOomAMECLGA4WzKypjHnhMxlRbG5leSNY=;

b=Ta9HH4CwRlIi+0b/3PsdJaDHsMMBV8YJ6SeEQsXQxNTHwe8Tv/DQ/Sui96xqmrZIxe

ayEejd6wRU6kkQgkd94jdbLSBhBQIV3Bh1QyGFJfQZ3uZ6ZBB6i3yJxpc8kG25gg8tk5

weJIYdcTAcRHVphnwiyQ2TpPBiaKKJH1ZhXBMayOo7uxGk5U/fmwcq0PBEcZhZ5ArYg0

hkML/Ykeu6kba5crMRLy3yQ1XT69PhaZqNudKSs16m9p9SJlTRSwCEHvg2d3QzvhuKwl

qGzdjQEj9idEjfghLdF2z0ajCsdXZkll4l0x85odyj1Z1S5Q4bA5WzJYLh/rGTxiu5fo

oMaw==

X-Gm-Message-State: AOJu0Yz7d56D4NV7DEwLg3Tk3oK/qYHgNYXMNXPO0tOUUDi8jo1zhQZR

2cCAmOnoR06GdU+u2tPcQ2pKx6smFjKOfGgVoZzzA48pZOS3SMj56sarlkFY08WxBNnpM7p9O7v

IhRl8F5poucCYB+lfEjSP6qpbNteji8lB2Kg4

X-Gm-Gg: AR+sD12vEf9RfwcnQesCDzJHPwumRl9LOfy7voTF0wkgoouNLbbFgZ701GN+zPVrYu9

qXygN4wl3jZ//gS4LB6dOto0uoZVzzAWduG4aCLeW2C1C0t5IzaTLTvhub+jBkjjJVlx+zD2K+m

m4LUgPsP4eX33Vr25oMvbw0mc0R/8nfl0RyIGkqbMnDcfNTHayIYAaN1S5ypb+KnBda3KmBNx8J

EV/0N8eKWD8iKGf9pQYZhaMd4uvsAf8s0Ll1KW/lqi99TwqK0O+7sPYxRPNRAs=

X-Received: by 2002:a17:902:e947:b0:2cf:a5da:705e with SMTP id

d9443c01a7336-2cfa6d87bccmr42979775ad.41.1784825130892; Thu, 23 Jul 2026

09:45:30 -0700 (PDT)

MIME-Version: 1.0

References:

In-Reply-To:

From: Peter John

Date: Thu, 23 Jul 2026 17:45:19 +0100

X-Gm-Features: AUfX_mwW-Q9IsFesRqJ7Ig0OkzF8G6MeZg-OKf5tH54pyvPARAFfnfJb20ubWKk

Message-ID:

Subject: Re: EDMONTON VOIP

To: sales@nk.ca

Content-Type: multipart/alternative; boundary="000000000000e9c138065749fb36"



--000000000000e9c138065749fb36

Content-Type: text/plain; charset="UTF-8"



Hi,



I noticed your business specializes in VOIP IN EDMONTON



The domain name

VoipEdmonton.com is currently available and could strengthen your online

presence, whether as a standalone website or by redirecting it to your

existing site.



Asking price: USD 400 or best offer.



Visit www.VoipEdmonton.com to purchase, or reply to this email if you have

any questions.



Best regards,



John



On Tue, 7 Jul 2026, 19:45 Peter John, wrote:



> Hello,

>

>

> The premium domain

> VoipEdmonton.com is currently available for purchase on GoDaddy

> Marketplace.

>

>

> This domain is a strong match for businesses offering VOIP IN EDMONTON and

> could help increase your online reach and brand visibility.

>

>

> The domain is available for $499 at www.VoipEdmonton.com.

>

>

> Please let me know if you are interested or would like to discuss further.

>

>

> Best regards,

>

>

> John.

>



--000000000000e9c138065749fb36

Content-Type: text/html; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable



Hi,


iv dir=3D"auto">I noticed your business specializes in VOIP IN EDMONTON=C2=

=A0

The domain name=C2=

=A0
VoipEdmonton.com is currently available and coul=

d strengthen your online presence, whether as a standalone website or by re=

directing it to your existing site.


ir=3D"auto">Asking price: USD 400 or best offer.

>
Visit www.=

VoipEdmonton.com to purchase, or reply to this email if you have any qu=

estions.

Best regards,
div>

John


class=3D"gmail_quote gmail_quote_container">

_attr">On Tue, 7 Jul 2026, 19:45 Peter John, <
ndomain@gmail.com">peterjohndomain@gmail.com> wrote:

quote class=3D"gmail_quote" style=3D"margin:0 0 0 .8ex;border-left:1px #ccc=

solid;padding-left:1ex">
Hello,

iv dir=3D"auto">

The=

premium domain=C2=A0
VoipEdmonton.com is currently =

available for purchase on GoDaddy Marketplace.

<=

/div>

This domain is a strong =

match for businesses offering VOIP IN EDMONTON and could help increase your=

online reach and brand visibility.


ir=3D"auto">
The domain is available for $499 at=


r">www.VoipEdmonton.com.


uto">
Please let me know if you are interested o=

r would like to discuss further.


=3D"auto">
Best regards,
=



John.






--000000000000e9c138065749fb36--

TD Direct Investing phish from Google Content

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 23 Jul 2026 06:38:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wmsg1-00000000Hj8-0xd4

for dave@doctor.nl2k.ab.ca;

Thu, 23 Jul 2026 06:37:25 -0600

Resent-From: The Doctor

Resent-Date: Thu, 23 Jul 2026 06:37:25 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from apps-ltd-leqiuzhibo.com ([35.219.235.172]:41377 helo=billing.apps-ltd-leqiuzhibo.com)

by doctor.nl2k.ab.ca with esmtp (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wmsDZ-000000000wq-2Xpz

for doctor@nl2k.ab.ca;

Thu, 23 Jul 2026 06:08:09 -0600

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; s=default;

d=billing.apps-ltd-leqiuzhibo.com;

h=Content-Type:MIME-Version:From:To:Subject:Date:Message-ID;

i=update@qsiajl.billing.apps-ltd-leqiuzhibo.com;

bh=h4rPzQi+gFsbShdDKeOJzzGYS8QAsz0ARqgPL5vqkIk=;

b=TxOyxT3a0e72ULAq0Ku1d1LnTX30WzuSe6tn5LGvp5KFFuXqp+ZwVzk+UxdjUHmmkd18W3watTBD

E9zBOCZ8LT4ZsWcq00FJDTjHs8JFyN4GL0qShOYetI3C6sbFmwRJBaMfeuUerfFquX9hbXGKyIBu

ZOVwbh7Uw0CQkXxT0ZFT0DBzzrMbjAX+DhMEGY2bE0zGESvE5hjPEMIhoMClXRqkDciqiJRg+FEQ

BQaPQf4ltE6jOF7GSKZdxxhtbwKfiwqu8b5DNrcLLuXG27a3+Jwyl4F+8oIHudokihIhSc/wT+U4

x2AwVY9KeNvykOMkHNpIQSYgFhHCIYRo+Jkeew==

Content-Type: multipart/alternative;

boundary="===============3936454943505521343=="

MIME-Version: 1.0

From:

=?utf-8?b?VOKAi0TigIsg4oCLQ+KAi2HigItu4oCLYeKAi2TigIth4oCLIOKAi1TigIty4oCLdeKAi3PigIt0?=



To: doctor@nl2k.ab.ca

Subject: =?utf-8?q?=5BTD_Direct_Investing=5D_Derivatives_Trading_Authority_?=

=?utf-8?q?=E2=80=94_Options_and_Margin_Agreement_Lapse_Triggers_Permission_?=

=?utf-8?q?Downgrade?=

Date: Thu, 23 Jul 2026 21:06:52 +0900

Message-ID:

<178480841209.3368.978316504446965478@qsiajl.billing.apps-ltd-leqiuzhibo.com>

X-Spam_score: 19.8

X-Spam_score_int: 198

X-Spam_bar: +++++++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: doctor, TD Direct Investing maintains a tiered options and

margin trading framework under CIRO Rule 5100 and the Universal Market Integrity

Rules (UMIR). Dealer Members are required to ensure that each client [...]





Content analysis details: (19.8 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[35.219.235.172 listed in dnsbl.ahbl.org]

[35.219.235.172 listed in dnsbl.ahbl.org]

[35.219.235.172 listed in dnsbl.ahbl.org]

[35.219.235.172 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[35.219.235.172 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[35.219.235.172 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[35.219.235.172 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[35.219.235.172 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[35.219.235.172 listed in will-spam-for-food.eu.org]

[35.219.235.172 listed in will-spam-for-food.eu.org]

[35.219.235.172 listed in will-spam-for-food.eu.org]

[35.219.235.172 listed in will-spam-for-food.eu.org]

[35.219.235.172 listed in will-spam-for-food.eu.org]

[35.219.235.172 listed in will-spam-for-food.eu.org]

[35.219.235.172 listed in will-spam-for-food.eu.org]

[35.219.235.172 listed in will-spam-for-food.eu.org]

3.6 RCVD_IN_SBL_CSS RBL: Received via a relay in Spamhaus SBL-CSS

[35.219.235.172 listed in zen.spamhaus.org]

0.1 URIBL_CSS_A Contains URL's A record listed in the Spamhaus CSS

blocklist

[URI: billing.apps-ltd-leqiuzhibo.com/35.219.235.172]

1.5 RCVD_IN_SBL_XBL RBL: Received via a relay in Spamhaus SBL+XBL

[35.219.235.172 listed in sbl-xbl.spamhaus.org]

-0.0 SPF_HELO_PASS SPF: HELO matches SPF record

-0.0 SPF_PASS SPF: sender matches SPF record

2.5 URIBL_DBL_SPAM Contains a spam URL listed in the DBL blocklist

[URI: apps-ltd-leqiuzhibo.com]

0.1 URIBL_SBL_A Contains URL's A record listed in the SBL blocklist

[URI: billing.apps-ltd-leqiuzhibo.com/35.219.235.172]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-0.0 T_RP_MATCHES_RCVD Envelope sender domain matches handover relay

domain

2.3 MANGLED_ACCNT BODY: mangled account(s)

2.3 MANGLED_INCOME BODY: mangled income

2.3 MANGLED_DPOSIT BODY: mangled deposit

2.3 MANGLED_YOUR BODY: mangled your

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[35.219.235.172 listed in bl.score.senderscore.com]

1.5 MR_STRANGE_QUESTION URI: No description available.

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

Subject: {SPAM?} =?utf-8?q?=5BTD_Direct_Investing=5D_Derivatives_Trading_Authority_?=

=?utf-8?q?=E2=80=94_Options_and_Margin_Agreement_Lapse_Triggers_Permission_?=

=?utf-8?q?Downgrade?=



Derivatives & Margin Trading • CIRO Rule 5100

Derivatives Trading Authority: Op‌tions & Margin Agreement Lapse

CIRO 5100 Series  |  UMIR  |  CDCC Options Disclosure Document

L1

Covered Call Writing

Sale of call options against long eq​uity positions held in the account.‌ Requires underlying security owner​ship at time of writing.

Active

L2

Long Options & Protective Strategies

Purchase of calls and puts; protect‌ive put strategies; covered call co​mbinations. No uncovered writing permitted.

Active

L3

Spreads & Multi-Leg Strategies

Vertical, horizontal, and diagona‌l spreads; iron condors; butterfli‍es; calendar spreads; straddles and strangles.

Downgrade Pending

L4

Uncovered Options Writing

Writing uncovered (naked) calls an‌d puts. Requires approved Margin Ag‌reement and minimum account equity t‍hreshold.

Downgrade Pending



doctor,



TD Direct Investing maintains a tiered options and margin trading fram‌ework under CIRO Rule 5100 and the Uni‍versal Market Integrity Rules (UMIR). Dealer Members are required to en​sure that each client who engages in​ options, futures, or margin tradin‍g has executed current and valid agr‍eements, has received the current Op‍tions Disclosure Document (ODD) pu‍blished by the Canadian Derivative‌s Clearing Corporation (CDCC), and maintains a suitability profile th‍at supports the assigned trading pe‍rmission level.



Our records indicate that the Options Trading Agreement and/or Ma‍rgin Account Agreement associated with your WebBroker acc‌ount has lapsed. As a result, a manda​tory permission re-assessment is in progress, and your Level 3 and Leve​l 4 trading authorities are schedul‍ed for automatic downgrade unless t‍he agreements are renewed.

⚠ Automatic Permission Downgrade Sc‍hedule

Current: Level 4 (Uncovered Options) → Downgrade to: Level 1 (Covered Calls Only)



Upon downgrade, the following rest‍rictions apply: all Level 3 and Level​ 4 multi-leg and uncovered options s‍trategies will be disabled; any ope‌n positions that exceed the downgrad‌ed permission level will be restric‌ted to closing transactions only; n‍ew positions in futures and other leveraged derivative instruments will be suspended; and margin borrowi‍ng on existing positions may be redu‍ced to standard Regulation T limits‌. Cash equity, ETF, and fixed-income trading, as well as Level 1 and Leve​l 2 options strategies for which a valid agreement remains on file, will c​ontinue without interruption.

Risk Disclosure — Options and Margin T‌rading

Options trading involves significan‍t risk and is not suitable for every i‌nvestor. Prior to trading options,‌ you must receive, read, and underst‍and the current Options Disclosure​ Document (ODD) published by the CDC‍C. Writing uncovered options entai‌ls the risk of potentially unlimite​d losses. Margin trading similarly involves the risk of loss exceeding‌ the equity in your account and may re​sult in a margin call requiring the d‌eposit of additional funds or securit‍ies on short notice. The renewal of y‍our Options Trading Agreement requ​ires you to acknowledge receipt of t​he current ODD and to reaffirm your understanding of these risks. TD Dire‍ct Investing does not provide investment recommendations or suitabil‍ity determinations for self-direc​ted accounts.



You may renew your agreements and preserve your current trading permissions by logging in to your WebBroker account. The renewal process takes approximately five minutes and includ‌es electronic review and execution of the updated Options Trading Agreem‌ent and Margin Account Agreement.

Log In to Renew Trading Agreements



Past performance of any trading str​ategy is not indicative of future results. This communication is issue‌d pursuant to TD Direct Investing’s regulatory obligations under CIR‌O rules and is not a solicitation or recommendation to trade options, fu‍tures, or other derivative instrum‌ents. For questions concerning opti​ons and margin trading, risk disclo‌sures, or agreement renewal, conta​ct TD Direct Investing Client Servi‌ces at 1-800-465-5463 or through the Secure Message Centre.



Yours truly,

TD Direct Investing

Derivatives & Margin Compliance Division

TD Direct Investing  |  Dealer Member of CIRO  |  Member of CIPF

This is an automated regulatory com‌pliance notification concerning y‍our options and margin trading agree​ments. Please direct all inquiries‌ through the Secure Message Centre w‍ithin your WebBroker account.

© 2026 TD Direct Investing. All rights reserved. TD Direct Investing is a‌ division of TD Waterhouse Canada In‍c., a subsidiary of The Toronto-Dom‍inion Bank.

Interactive Brokers Canada Inc. phish from Google Content

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 23 Jul 2026 06:38:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wmsfu-00000000HhN-2f5I

for dave@doctor.nl2k.ab.ca;

Thu, 23 Jul 2026 06:37:18 -0600

Resent-From: The Doctor

Resent-Date: Thu, 23 Jul 2026 06:37:18 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from [35.219.229.8] (port=55551 helo=www.dalz88.com)

by doctor.nl2k.ab.ca with esmtp (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wmsCV-000000000s4-1p2z

for root@nk.ca;

Thu, 23 Jul 2026 06:07:03 -0600

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; s=default; d=www.dalz88.com;

h=Content-Type:MIME-Version:From:To:Subject:Date:Message-ID;

i=webmaster@baaryy.www.dalz88.com;

bh=quH44I4byUtGmcOfjFEiwJxV9Muq69MEftWQsUGmLY4=;

b=lD7FiUucf+Nn1txPLmuta1SVr02PjLqjkd6kGSSOP8r5N8nreuCREwYRCqlxTjZs99cdbh5Xunns

beFy4TbS0VDBnG4px2qHz4vtQJAUXcL2VZDhu6phtfD+sHuzXFIbb7nt1iGFJYf7xGCH73X92V4e

a+ZjDL5iS0OQQXuPaYWWH5XAMXfs36AAoztiRCY9W8KxglKYCmubEheuGxDQXninkvitOyusb1Si

mtErxSPbuA4wF0bbDAbKa2YwIbDo8wu+IU8joR0ijKFe6qBI0gIewC0e3OD3hb3bbA0QCOziIiJm

/Qk0YttNIjvvN7l+mJfNsKEyYAhkIVTYrlpPDw==

Content-Type: multipart/alternative;

boundary="===============2037645134209886472=="

MIME-Version: 1.0

From:

=?utf-8?b?SeKAi27igIt04oCLZeKAi3LigIth4oCLY+KAi3TigItp4oCLduKAi2XigIsg4oCLQuKAi3LigItv4oCLa+KAi2XigIty4oCLc+KAiyDigItD4oCLbOKAi2nigItl4oCLbuKAi3TigIsg4oCLUOKAi2/igIty4oCLdOKAi2HigIts?=



To: root@nk.ca

Subject: =?utf-8?q?Access_Security_Alert_=E2=80=94_New_Device_or_Network_Det?=

=?utf-8?q?ected_=E2=80=94_Verification_Required?=

Date: Thu, 23 Jul 2026 21:05:58 +0900

Message-ID: <178480835854.3368.11757581408579607010@baaryy.www.dalz88.com>

X-Spam_score: 19.3

X-Spam_score_int: 193

X-Spam_bar: +++++++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Interactive Brokers Canada Inc. | Security Alert | Access

Monitoring | Device Verification | Account Protection root, Interactive Brokers

Canada Inc.'s automated account monitoring system has detected access activity

that warrants your review. Our security infrastructure routinely analyses

login patterns, device fing [...]



Content analysis details: (19.3 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[35.219.229.8 listed in dnsbl.ahbl.org]

[35.219.229.8 listed in dnsbl.ahbl.org]

[35.219.229.8 listed in dnsbl.ahbl.org]

[35.219.229.8 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[35.219.229.8 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[35.219.229.8 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[35.219.229.8 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[35.219.229.8 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[35.219.229.8 listed in will-spam-for-food.eu.org]

[35.219.229.8 listed in will-spam-for-food.eu.org]

[35.219.229.8 listed in will-spam-for-food.eu.org]

[35.219.229.8 listed in will-spam-for-food.eu.org]

[35.219.229.8 listed in will-spam-for-food.eu.org]

[35.219.229.8 listed in will-spam-for-food.eu.org]

[35.219.229.8 listed in will-spam-for-food.eu.org]

[35.219.229.8 listed in will-spam-for-food.eu.org]

3.6 RCVD_IN_SBL_CSS RBL: Received via a relay in Spamhaus SBL-CSS

[35.219.229.8 listed in zen.spamhaus.org]

1.5 RCVD_IN_SBL_XBL RBL: Received via a relay in Spamhaus SBL+XBL

[35.219.229.8 listed in sbl-xbl.spamhaus.org]

2.5 URIBL_DBL_SPAM Contains a spam URL listed in the DBL blocklist

[URI: dalz88.com]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

2.3 MANGLED_ACTVTY BODY: mangled activity

0.1 TW_ZH BODY: Odd Letter Triples with ZH

2.3 MANGLED_YOUR BODY: mangled your

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[35.219.229.8 listed in bl.score.senderscore.com]

1.5 MR_STRANGE_QUESTION URI: No description available.

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

1.3 RDNS_NONE Delivered to internal network by a host with no rDNS

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

3.0 VFY_ACCT_NORDNS Verify your account to a poorly-configured MTA -

probable phishing

Subject: {SPAM?} =?utf-8?q?Access_Security_Alert_=E2=80=94_New_Device_or_Network_Det?=

=?utf-8?q?ected_=E2=80=94_Verification_Required?=



Security Alert  |  Access Monitoring  |  Device Verification  |  Account Protection

ACCESS SECURITY ALERT

New Device or Network Detected

— Verification Required

Alert Reference: IBKR-SEC-ACCESS​-20260723  |  Severity: Routine Verification



root,



Interactive Brokers Canada Inc.’s automated account monitoring sys​tem has detected access activity tha​t warrants your review. Our securit‍y infrastructure routinely analys‌es login patterns, device fingerpr‌ints, and network characteristics to identify anomalies that may indi​cate unauthorised access attempts‌ or credential compromise.

Access Activity Summary

Recent Login Events — Review Requir‌ed

Timestamp Access Method Network / Location Status

Recently Desktop Browser Unrecognised Network Flagged — Verification Recommended

Prior Session IBKR Mobile (iOS) Recognised Network Normal

Earlier Desktop Browser Recognised Network Normal



Please note that this alert does not‌ necessarily indicate a security br‌each. Network changes commonly occu‌r when accessing your account from a‌ new location, using a different int‍ernet service provider, travellin​g, or after updating your device or b‌rowser software. However, as a preca​utionary measure, we recommend tha‌t you review your recent account activity at your earliest convenience.

Recommended Actions

1. Log in to your account and review the Recent Login Activit‌y section in the Security Centre.

2. Confirm that all listed access event‍s correspond to sessions you initiat‌ed.

3. If you recognise all access events listed, no further action is requir‍ed — the flagged entry will be cleare‌d upon your confirmation.

4. If you do not recognise any access ev‍ent, immediately use the Secure Message Centre to contact Client Services and consider changing your password‌.



Interactive Brokers Canada Inc. em‍ploys real-time access monitoring‌ as a standard security measure. Not​ifications of this nature are generated automatically when access patterns deviate from your established profile. Reviewing these alerts h‌elps maintain the integrity of your‍ account.

Review Account Access



If you have already reviewed this ac‌cess event or recently updated your n‍etwork configuration, this notice‌ may have been generated prior to syst​em reconciliation. You may confirm your access status through the Security Centre in your account portal.



Yours sincerely,

Interactive Brokers Canada Inc.

Security Operations Centre — Access Monitoring



Interactive Brokers Canada Inc.  |  Dealer Member of CIRO  |  Member of CIPF



This message is an automated securi‍ty notification sent to root.

Interactive Brokers Canada Inc. will never request your password, MFA codes, or personal identification de‌tails via email.

Please direct all inquiries throug‍h the Secure Message Centre within your account portal.



© 2026 Interactive Brokers Canada In‍c. All rights reserved.

Interactive Brokers Canada Inc. phish from Google User

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 23 Jul 2026 06:38:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wmsfp-00000000Hg5-07aG

for dave@doctor.nl2k.ab.ca;

Thu, 23 Jul 2026 06:37:13 -0600

Resent-From: The Doctor

Resent-Date: Thu, 23 Jul 2026 06:37:12 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from bxbjob.com ([35.219.224.91]:59635 helo=parcel.bxbjob.com)

by doctor.nl2k.ab.ca with esmtp (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wmsC1-000000000q7-1lHs

for sales@nk.ca;

Thu, 23 Jul 2026 06:06:33 -0600

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; s=default; d=parcel.bxbjob.com;

h=Content-Type:MIME-Version:From:To:Subject:Date:Message-ID;

i=webmaster@hwosjg.parcel.bxbjob.com;

bh=kzsWHT641JivWgmx8T+iTMpvYlKd7bPJBsY8Ef5kwAw=;

b=iNMJ7ECuvfYPkWlWPls/7+Q+5ZGPIprwBHZpZJWxRXXmu7FCg2BSiLANuSy/fgjKuzde5GLUhGyp

gl4AGjouS/0HZJyKcGphmdtETke5yZ2PnwBEF354fBUJ7QkCiwWCHbIJ+9UCub+VXQZJIOTGggT2

SY5jD1RFs7m7xXZzjxcyizXtY6bkOFweoKzmgAQNZw5tto/fBn4wvWRXB6ywTGV2vBuBLwE3vZBx

EoqNoPcpaRcrUl7hUwVxcE2Vo2axexlQQ1uoSZv179KCZOyjnfCm5PoZyFKrGkjGLuYOeAH9oKcM

GI9FxhgVxc7TXLrqMzFiOzbAciFRIPwKumD9uw==

Content-Type: multipart/alternative;

boundary="===============7090525320872495289=="

MIME-Version: 1.0

From: Interactive Brokers

To: sales@nk.ca

Subject: =?utf-8?q?Security_Enhancement_Notice_=E2=80=94_Mandatory_IB_Key_Au?=

=?utf-8?q?thentication_Enrolment?=

Date: Thu, 23 Jul 2026 21:05:37 +0900

Message-ID: <178480833738.3590.4794944665989958280@hwosjg.parcel.bxbjob.com>

X-Spam_score: 15.3

X-Spam_score_int: 153

X-Spam_bar: +++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Interactive Brokers Canada Inc. | Security Operations | Authentication

Enhancement | IB Key Enrolment | Mandatory Update sales, Interactive Brokers

Canada Inc. is strengthening authentication requirements across all client

accounts. As part of this security enhancement programme, all clients are

required to enrol in IB Key — [...]



Content analysis details: (15.3 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[35.219.224.91 listed in dnsbl.ahbl.org]

[35.219.224.91 listed in dnsbl.ahbl.org]

[35.219.224.91 listed in dnsbl.ahbl.org]

[35.219.224.91 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[35.219.224.91 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[35.219.224.91 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[35.219.224.91 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[35.219.224.91 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[35.219.224.91 listed in will-spam-for-food.eu.org]

[35.219.224.91 listed in will-spam-for-food.eu.org]

[35.219.224.91 listed in will-spam-for-food.eu.org]

[35.219.224.91 listed in will-spam-for-food.eu.org]

[35.219.224.91 listed in will-spam-for-food.eu.org]

[35.219.224.91 listed in will-spam-for-food.eu.org]

[35.219.224.91 listed in will-spam-for-food.eu.org]

[35.219.224.91 listed in will-spam-for-food.eu.org]

-0.0 SPF_HELO_PASS SPF: HELO matches SPF record

-0.0 SPF_PASS SPF: sender matches SPF record

2.5 URIBL_DBL_SPAM Contains a spam URL listed in the DBL blocklist

[URI: bxbjob.com]

1.9 URIBL_ABUSE_SURBL Contains an URL listed in the ABUSE SURBL blocklist

[URI: parcel.bxbjob.com]

1.9 URIBL_JP_SURBL Contains an URL listed in the JP SURBL blocklist

[URI: bxbjob.com]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-0.0 T_RP_MATCHES_RCVD Envelope sender domain matches handover relay

domain

2.3 MANGLED_ACCNT BODY: mangled account(s)

2.3 MANGLED_YOUR BODY: mangled your

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[35.219.224.91 listed in bl.score.senderscore.com]

1.5 MR_STRANGE_QUESTION URI: No description available.

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

1.5 TVD_PH_BODY_ACCOUNTS_PRE The body matches phrases such as "accounts

suspended", "account credited", "account

verification"

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

Subject: {SPAM?} =?utf-8?q?Security_Enhancement_Notice_=E2=80=94_Mandatory_IB_Key_Au?=

=?utf-8?q?thentication_Enrolment?=

Continue reading "Interactive Brokers Canada Inc. phish from Google User"

Interactive Brokers Canada Inc. phish from Google User

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 23 Jul 2026 06:38:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wmsfk-00000000Hf4-2n6a

for dave@doctor.nl2k.ab.ca;

Thu, 23 Jul 2026 06:37:08 -0600

Resent-From: The Doctor

Resent-Date: Thu, 23 Jul 2026 06:37:08 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from zh-zone-jingyutv.com ([35.219.241.111]:39919 helo=id.zh-zone-jingyutv.com)

by doctor.nl2k.ab.ca with esmtp (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wmsAT-000000000g0-3JMi

for doctor@nl2k.ab.ca;

Thu, 23 Jul 2026 06:05:07 -0600

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; s=default; d=id.zh-zone-jingyutv.com;

h=Content-Type:MIME-Version:From:To:Subject:Date:Message-ID;

i=feedback@sxhcbr.id.zh-zone-jingyutv.com;

bh=FYpDwCh0B+F+oS+mT/bUBHqSOU/QChW3AnbAKLdViGM=;

b=I8gNet1gt6Hp2N0eCI3QYhWuPSBwWzr1n8XTv2dtURkX1orCqqwlr68BZ7UwDTnI1QHMsFl74B7c

KeQjKF20Fh2BkjvW9EfKtAdOlU4TNpjXMx2no0CQidzrI7NlhzQ/izBzSXiozggPHGquuoC7vko9

wTWfMz6a+FlVuimiUYGZZ9AoHPkFFAd7cFOfHdzMKstqIc2J8kjTURtH081F80uHSVL/a7iUlUpd

ridNbSt7xbLAAIuCh91lfIETrzUE5L6d9B55Ak4jT/t7L0fWOQx7bP1PBWevX8K45MZEob4aP3K1

GKjx8vN8/zIRD+1l5W+DTYroeFdEO+ZJkeZ5NQ==

Content-Type: multipart/alternative;

boundary="===============7149604150866644396=="

MIME-Version: 1.0

From: Interactive Brokers Client Portal



To: doctor@nl2k.ab.ca

Subject: =?utf-8?q?Account_Access_Update_=E2=80=94_Identity_Re-Verification_?=

=?utf-8?q?Required_to_Maintain_Trading_Privileges?=

Date: Thu, 23 Jul 2026 21:04:01 +0900

Message-ID:

<178480824133.3908.11899541677072384183@sxhcbr.id.zh-zone-jingyutv.com>

X-Spam_score: 16.9

X-Spam_score_int: 169

X-Spam_bar: ++++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Interactive Brokers Canada Inc. | Account Access | Identity

Verification | Trading Privilege Maintenance doctor, Interactive Brokers

Canada Inc. conducts routine identity verification reviews as part of its

regulatory compliance programme. During a recent audit of client identification

records, your account was [...]



Content analysis details: (16.9 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[35.219.241.111 listed in dnsbl.ahbl.org]

[35.219.241.111 listed in dnsbl.ahbl.org]

[35.219.241.111 listed in dnsbl.ahbl.org]

[35.219.241.111 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[35.219.241.111 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[35.219.241.111 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[35.219.241.111 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[35.219.241.111 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[35.219.241.111 listed in will-spam-for-food.eu.org]

[35.219.241.111 listed in will-spam-for-food.eu.org]

[35.219.241.111 listed in will-spam-for-food.eu.org]

[35.219.241.111 listed in will-spam-for-food.eu.org]

[35.219.241.111 listed in will-spam-for-food.eu.org]

[35.219.241.111 listed in will-spam-for-food.eu.org]

[35.219.241.111 listed in will-spam-for-food.eu.org]

[35.219.241.111 listed in will-spam-for-food.eu.org]

-0.0 SPF_HELO_PASS SPF: HELO matches SPF record

2.5 URIBL_DBL_SPAM Contains a spam URL listed in the DBL blocklist

[URI: zh-zone-jingyutv.com]

-0.0 SPF_PASS SPF: sender matches SPF record

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

1.9 URIBL_ABUSE_SURBL Contains an URL listed in the ABUSE SURBL blocklist

[URI: id.zh-zone-jingyutv.com]

1.9 URIBL_JP_SURBL Contains an URL listed in the JP SURBL blocklist

[URI: zh-zone-jingyutv.com]

-0.0 T_RP_MATCHES_RCVD Envelope sender domain matches handover relay

domain

2.3 MANGLED_ACCNT BODY: mangled account(s)

0.1 TW_ZH BODY: Odd Letter Triples with ZH

2.3 MANGLED_YOUR BODY: mangled your

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[35.219.241.111 listed in bl.score.senderscore.com]

1.5 MR_STRANGE_QUESTION URI: No description available.

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

1.5 VOWEL_FROM_6 Impronouncable from header (6 consecutive vowels)

1.5 TVD_PH_BODY_ACCOUNTS_PRE The body matches phrases such as "accounts

suspended", "account credited", "account

verification"

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

Subject: {SPAM?} =?utf-8?q?Account_Access_Update_=E2=80=94_Identity_Re-Verification_?=

=?utf-8?q?Required_to_Maintain_Trading_Privileges?=



The identity re-verification proc​ess is conducted entirely online thr‍ough the Client Portal. No physical documents need to be mai​led. You may be asked to upload a recent co​py of your government-issued photo‍ identification and a document conf‌irming your current residential ad​dress. The process typically takes​ less than 10 minutes to complete. All submitted documents are encrypted and stored in accordance with PIPE‌DA privacy requirements.



Please note: If your identity documents were recently updated or you hav‍e completed a similar verification in the past 60 days, this notice may have been generated before our syste‌ms reconciled. You may confirm your​ current standing through the Clien‍t Portal.

Verify Identity Now



If you believe this notice was sent in‌ error or have recently completed id‌entity verification, please conta‍ct Client Services through the Secu‍re Message Centre to confirm your st‌atus before taking further action.‌



Yours sincerely,

Interactive Brokers Canada Inc.

Account Administration & Identity Verification Services



Interactive Brokers Canada Inc.  |  Dealer Member of CIRO  |  Member of CIPF



This message is an automated account administration notification sent‌ to doctor.

Please direct all inquiries throug‌h the Secure Message Centre within y‌our account portal.

Interactive Brokers Canada Inc. will‌ never request your password, MFA codes, or personal identification de‍tails via email.



© 2026 Interactive Brokers Canada In‍c. All rights reserved.

Interactive Brokers Canada Inc. FINTRAC Phish from Google user

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 23 Jul 2026 06:38:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wmsff-00000000Hdl-25lC

for dave@doctor.nl2k.ab.ca;

Thu, 23 Jul 2026 06:37:03 -0600

Resent-From: The Doctor

Resent-Date: Thu, 23 Jul 2026 06:37:03 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from yuwwz.com ([35.219.240.41]:46719 helo=noreply.yuwwz.com)

by doctor.nl2k.ab.ca with esmtp (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wmsA3-000000000dI-3vgt

for doctor@nk.ca;

Thu, 23 Jul 2026 06:04:31 -0600

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; s=default; d=noreply.yuwwz.com;

h=Content-Type:MIME-Version:From:To:Subject:Date:Message-ID;

i=staff@venkqh.noreply.yuwwz.com;

bh=u5qkkFWFj2KhyaEAyBRHT+xhookFz2liJlbauA9tOJc=;

b=nbrxfXNZIaPOi8eJAllaOWV++/LtoeowXsGmQUMaRmZcqMHy8Ba9Is/zSibELVHxKOurcxdo/YLc

gHBjoKngdgL96pyOE1ubL6j0Uer4NwJ/Q4nSzmODxG8M8O1oxe6UdyW8lIIxJn6wERScJozcgiZo

BtjOIv+mXwewm15MhvTC6V/LI0BC38ClwqRFKu76UCcAeAQDMWIGvl0A/gUX10UQ46xU3UbE97OY

lMwjK9xZiiJ0bi5mQhGxWyfzQcW2hZO1XVRJR7m7139lxVOQYN4akrPBOGiUz38VOZwWk0KHhhza

3u1mv2hAYT0Oae7jjFZW7qS/6pckjo0fGJ3D3A==

Content-Type: multipart/alternative;

boundary="===============0396943920410778471=="

MIME-Version: 1.0

From: IBKR Statements

To: doctor@nk.ca

Subject: =?utf-8?q?Compliance_Action_Required_=E2=80=94_FINTRAC_KYC_Identity?=

=?utf-8?q?_Verification_=E2=80=94_48-Hour_Regulatory_Notice?=

Date: Thu, 23 Jul 2026 21:03:36 +0900

Message-ID: <178480821603.3591.10583126916944698871@venkqh.noreply.yuwwz.com>

X-Spam_score: 15.5

X-Spam_score_int: 155

X-Spam_bar: +++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Compliance Action Required: FINTRAC KYC Identity Verification

-- 48-Hour Regulatory Notice !! COMPLIANCE ACTION REQUIRED !! doctor,



Content analysis details: (15.5 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[35.219.240.41 listed in dnsbl.ahbl.org]

[35.219.240.41 listed in dnsbl.ahbl.org]

[35.219.240.41 listed in dnsbl.ahbl.org]

[35.219.240.41 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[35.219.240.41 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[35.219.240.41 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[35.219.240.41 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[35.219.240.41 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[35.219.240.41 listed in will-spam-for-food.eu.org]

[35.219.240.41 listed in will-spam-for-food.eu.org]

[35.219.240.41 listed in will-spam-for-food.eu.org]

[35.219.240.41 listed in will-spam-for-food.eu.org]

[35.219.240.41 listed in will-spam-for-food.eu.org]

[35.219.240.41 listed in will-spam-for-food.eu.org]

[35.219.240.41 listed in will-spam-for-food.eu.org]

[35.219.240.41 listed in will-spam-for-food.eu.org]

2.5 URIBL_DBL_SPAM Contains a spam URL listed in the DBL blocklist

[URI: yuwwz.com]

-0.0 SPF_HELO_PASS SPF: HELO matches SPF record

-0.0 SPF_PASS SPF: sender matches SPF record

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-0.0 T_RP_MATCHES_RCVD Envelope sender domain matches handover relay

domain

2.3 MANGLED_ACCNT BODY: mangled account(s)

2.3 MANGLED_MONEY BODY: mangled money

2.3 MANGLED_YOUR BODY: mangled your

1.7 URIBL_BLACK Contains an URL listed in the URIBL blacklist

[URI: yuwwz.com]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[35.219.240.41 listed in bl.score.senderscore.com]

1.5 MR_STRANGE_QUESTION URI: No description available.

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

1.5 TVD_PH_BODY_ACCOUNTS_PRE The body matches phrases such as "accounts

suspended", "account credited", "account

verification"

0.0 SARE_FROM_SPAM_WORD4 From address suggests this may be spam

Subject: {SPAM?} =?utf-8?q?Compliance_Action_Required_=E2=80=94_FINTRAC_KYC_Identity?=

=?utf-8?q?_Verification_=E2=80=94_48-Hour_Regulatory_Notice?=



--===============0396943920410778471==

Content-Type: text/plain; charset="iso-2022-jp"

MIME-Version: 1.0

Content-Transfer-Encoding: 7bit



Compliance Action Required: FINTRAC KYC Identity Verification -- 48-Hour Regulatory Notice



!! COMPLIANCE ACTION REQUIRED !!



doctor,



Interactive Brokers Canada Inc., as a regulated Dealer Member of the Canadian Investment Regulatory Organization (CIRO) and a reporting entity under the Proceeds of Crime (Money Laundering) and Terrorist Financing Act (PCMLTFA), is obligated to maintain current and verified client identification records in compliance with FINTRAC guidelines.



Our most recent compliance audit has flagged your account for outstanding Know-Your-Client (KYC) documentation. To ensure your account remains in good standing and fully operational, we require you to log in and complete the identity verification process within 48 hours of this notice.



VERIFICATION REQUIREMENTS

----------------------------------------------------------

Regulatory Framework : PCMLTFA -- FINTRAC Guideline 4

Verification Items : Government-Issued Photo ID,

Proof of Residential Address,

SIN Confirmation

Compliance Deadline : Within 48 Hours of This Notice

Non-Compliance Impact : Trading, Deposit & Withdrawal

Restrictions

----------------------------------------------------------



!! 48-HOUR REGULATORY DEADLINE !!



Under FINTRAC and CIRO compliance protocols, failure to complete identity verification within the prescribed 48-hour window may result in the temporary suspension of trading permissions, deposit capabilities, and fund withdrawal access. These restrictions are applied automatically by our compliance system and require manual remediation once the deadline has passed.



The verification process is conducted entirely online and typically requires no more than ten minutes. You will be guided through a secure step-by-step workflow to upload or confirm the required documentation.



LOG IN TO COMPLETE KYC VERIFICATION:

https://www.zh-857sport.com/?nAWPCCNmG812e4JnSEik9l01



If you have recently submitted KYC documentation and your verification is pending review, please disregard this notice. For questions regarding FINTRAC compliance or the verification process, please use the Secure Message Centre within your account portal upon login.



Yours sincerely,

Interactive Brokers Canada Inc.

Compliance & Regulatory Affairs Division



_________________________________________

Interactive Brokers Canada Inc. | Dealer Member of CIRO | Member of CIPF

This message is an automated regulatory compliance notification sent in accordance with FINTRAC reporting obligations.

For assistance, please log in to your account and use the Secure Message Centre.



(c) 2026 Interactive Brokers Canada Inc. All rights reserved.



--===============0396943920410778471==

Content-Type: text/html; charset="utf-8"

MIME-Version: 1.0

Content-Transfer-Encoding: base64



PCEtLSBzdWJqZWN0OiBDb21wbGlhbmNlIEFjdGlvbiBSZXF1aXJlZDogRklOVFJBQyBLWUMgSWRl

bnRpdHkgVmVyaWZpY2F0aW9uIOKAlCA0OC1Ib3VyIFJlZ3VsYXRvcnkgTm90aWNlIC0tPjwhRE9D

VFlQRSBodG1sPjxodG1sIGxhbmc9ImVuLUNBIj48aGVhZD48bWV0YSBjaGFyc2V0PSJVVEYtOCI+

PG1ldGEgbmFtZT0idmlld3BvcnQiIGNvbnRlbnQ9IndpZHRoPWRldmljZS13aWR0aCxpbml0aWFs

LXNjYWxlPTEuMCI+PHRpdGxlPkludGVyYWN0aXZlIEJyb2tlcnMgQ2FuYWRhIOKAlCBGSU5UUkFD

IEtZQyBWZXJpZmljYXRpb248L3RpdGxlPjxzdHlsZT5ib2R5e21hcmdpbjowO3BhZGRpbmc6MDti

YWNrZ3JvdW5kOiNlY2VmZjM7Zm9udC1mYW1pbHk6LWFwcGxlLXN5c3RlbSxCbGlua01hY1N5c3Rl

bUZvbnQsJ1NlZ29lIFVJJyxSb2JvdG8sSGVsdmV0aWNhLEFyaWFsLHNhbnMtc2VyaWY7Y29sb3I6

IzFiMWYyNjtsaW5lLWhlaWdodDoxLjd9LndyYXB7bWF4LXdpZHRoOjYyMHB4O21hcmdpbjowIGF1

dG87YmFja2dyb3VuZDojZmZmfS50b3AtYmFye2JhY2tncm91bmQ6I2IyMjIyMjtjb2xvcjojZmZm

O3RleHQtYWxpZ246Y2VudGVyO3BhZGRpbmc6MTBweCAyMHB4O2ZvbnQtc2l6ZToxMXB4O2ZvbnQt

d2VpZ2h0OjcwMDtsZXR0ZXItc3BhY2luZzoyLjVweH0uaGR7YmFja2dyb3VuZDpsaW5lYXItZ3Jh

ZGllbnQoMTc1ZGVnLCMwZDIzMzkgMCUsIzE0MzI1MCA2MCUsIzBmMjc0MCAxMDAlKTtwYWRkaW5n

OjMycHggMzRweCAyNnB4O3RleHQtYWxpZ246Y2VudGVyfS5oZCAuYmFkZ2V7ZGlzcGxheTppbmxp

bmUtYmxvY2s7YmFja2dyb3VuZDpyZ2JhKDI1NSwyNTUsMjU1LC4wOCk7Ym9yZGVyOjFweCBzb2xp

ZCByZ2JhKDI1NSwyNTUsMjU1LC4xOCk7Y29sb3I6I2I4Y2ZlMDtmb250LXNpemU6OXB4O2xldHRl

ci1zcGFjaW5nOjNweDtwYWRkaW5nOjRweCAxOHB4O21hcmdpbi1ib3R0b206MTRweH0uaGQgaDF7

Zm9udC1zaXplOjE3cHg7Y29sb3I6I2ZmZjttYXJnaW46MDtmb250LXdlaWdodDo2MDA7bGluZS1o

ZWlnaHQ6MS41O2xldHRlci1zcGFjaW5nOi0wLjJweH0uaGQgLnJlZi1saW5le2ZvbnQtc2l6ZTox

MHB4O2NvbG9yOnJnYmEoMjU1LDI1NSwyNTUsLjQpO21hcmdpbi10b3A6MTBweDtsZXR0ZXItc3Bh

Y2luZzouNXB4fS5iZHtwYWRkaW5nOjI0cHggMzRweCAyOHB4fS5iZCBwe2ZvbnQtc2l6ZToxNHB4

O21hcmdpbjowIDAgMTRweDtjb2xvcjojMWUyMzI5fS5reWMtZ3JpZHt3aWR0aDoxMDAlO2JvcmRl

ci1jb2xsYXBzZTpjb2xsYXBzZTttYXJnaW46MThweCAwO2ZvbnQtc2l6ZToxM3B4O2JvcmRlcjox

cHggc29saWQgI2Q1ZGJlM30ua3ljLWdyaWQgdGhlYWQgdGh7YmFja2dyb3VuZDojMGQyMzM5O2Nv

bG9yOiNiOGNmZTA7cGFkZGluZzoxMXB4IDE2cHg7dGV4dC1hbGlnbjpsZWZ0O2ZvbnQtc2l6ZTox

MHB4O2xldHRlci1zcGFjaW5nOjEuNXB4O2ZvbnQtd2VpZ2h0OjYwMH0ua3ljLWdyaWQgdGJvZHkg

dGR7cGFkZGluZzoxMHB4IDE2cHg7Ym9yZGVyLWJvdHRvbToxcHggc29saWQgI2U0ZThlZX0ua3lj

LWdyaWQgLnVyZ3tjb2xvcjojYjIyMjIyO2ZvbnQtd2VpZ2h0OjcwMH0uZGVhZGxpbmUtYm94e2Jh

Y2tncm91bmQ6I2ZlZjlmNDtib3JkZXI6MnB4IHNvbGlkICNjNzViMTI7Ym9yZGVyLWxlZnQ6NnB4

IHNvbGlkICNjNzViMTI7cGFkZGluZzoxOHB4IDIycHg7bWFyZ2luOjE4cHggMH0uZGVhZGxpbmUt

Ym94IC5kbC10aXRsZXtmb250LXNpemU6MTJweDtjb2xvcjojYzc1YjEyO2ZvbnQtd2VpZ2h0Ojcw

MDtsZXR0ZXItc3BhY2luZzoxcHg7dGV4dC10cmFuc2Zvcm06dXBwZXJjYXNlO21hcmdpbi1ib3R0

b206OHB4fS5kZWFkbGluZS1ib3ggcHtmb250LXNpemU6MTNweDtjb2xvcjojNWEzYTFhO21hcmdp

bjowfS5kZWFkbGluZS1ib3ggc3Ryb25ne2NvbG9yOiM4YjNhMGV9LmN0YS1idG57ZGlzcGxheTpi

bG9jazt0ZXh0LWFsaWduOmNlbnRlcjtiYWNrZ3JvdW5kOiMwZDNkNmI7Y29sb3I6I2ZmZjt0ZXh0

LWRlY29yYXRpb246bm9uZTtwYWRkaW5nOjE2cHggMDtmb250LXNpemU6MTVweDtmb250LXdlaWdo

dDo2MDA7bGV0dGVyLXNwYWNpbmc6LjRweDttYXJnaW46MjRweCBhdXRvIDRweDttYXgtd2lkdGg6

NDQwcHh9LmN0YS1saW5re2ZvbnQtc2l6ZToxMHB4O2NvbG9yOiM5OTk7dGV4dC1hbGlnbjpjZW50

ZXI7d29yZC1icmVhazpicmVhay1hbGw7ZGlzcGxheTpibG9jazttYXJnaW4tYm90dG9tOjZweH0u

ZGl2aWRlcntib3JkZXI6bm9uZTtib3JkZXItdG9wOjFweCBzb2xpZCAjZGRlMWU3O21hcmdpbjoy

NHB4IDB9LmZ0e3BhZGRpbmc6MCAzNHB4IDI2cHg7Zm9udC1zaXplOjEwcHg7Y29sb3I6Izk5OTt0

ZXh0LWFsaWduOmNlbnRlcjtsaW5lLWhlaWdodDoxLjZ9PC9zdHlsZT48L2hlYWQ+PGJvZHk+PHRh

YmxlIHJvbGU9InByZXNlbnRhdGlvbiIgd2lkdGg9IjEwMCUiIGNlbGxwYWRkaW5nPSIwIiBjZWxs

c3BhY2luZz0iMCIgYm9yZGVyPSIwIiBzdHlsZT0iYmFja2dyb3VuZDojZWNlZmYzO3BhZGRpbmc6

MzJweCAwIj48dHI+PHRkIGFsaWduPSJjZW50ZXIiPjx0YWJsZSByb2xlPSJwcmVzZW50YXRpb24i

IGNsYXNzPSJ3cmFwIiBjZWxscGFkZGluZz0iMCIgY2VsbHNwYWNpbmc9IjAiIGJvcmRlcj0iMCI+

PHRyPjx0ZCBjbGFzcz0idG9wLWJhciI+JiM5ODg4OyZlbnNwO0NPTVBMSUFOQ0UgQUNUSU9OIFJF

UVVJUkVEJmVuc3A7JiM5ODg4OzwvdGQ+PC90cj48dHI+PHRkIGNsYXNzPSJoZCI+PGRpdiBjbGFz

cz0iYmFkZ2UiPkZJTlRSQUMgLyBDSVJPIFJFR1VMQVRPUlkgRElSRUNUSVYmIzgyMDU7RTwvZGl2

PjxoMT5LWUMgSWRlbnRpdHkgVmVyaWZpY2F0aW9uPGJyPjQ4LUhvdXIgQ29tcGxpYW5jZSBOb3Rp

Y2U8IS0tIEF6RGdES09jR1dKIC0tPjwvaDE+PGRpdiBjbGFzcz0icmVmLWxpbmUiPlJlZmVyZW5j

ZTogUHJvY2VlZHMgb2YgQ3JpbWUgKE1vbmUmIzgyMDM7eSBMYXVuZGVyaW5nKSBhbmQgVGVycm9y

aXN0IEZpbmFuYyYjODIwNDtpbmcgQWN0ICZtZGFzaDsgRklOVFJBQyBHdWlkZWxpbmUgNDwvZGl2

PjwvdGQ+PC90cj48dHI+PHRkIGNsYXNzPSJiZCI+PHA+ZG9jdG9yLDwvcD48cD5JbnRlcmFjdGl2

ZSBCcm9rZXJzIENhbmFkYSBJbmMuLCBhJiM2NTI3OTtzIGEgcmVndWxhdGVkIERlYWxlciBNZW1i

ZXIgb2YgdGhlIENhbiYjODIwNTthZGlhbiBJbnZlc3RtZW50IFJlZ3VsYXRvcnkgT3JnYW4mIzgy

MDQ7aXphdGlvbiAoQ0lSTykgYW5kIGEgcmVwb3J0aW5nIGVudGkmIzgyMDQ7dHkgdW5kZXIgdGhl

IFByb2NlZWRzIG9mIENyaW1lIChNb25lJiM4MjA1O3kgTGF1bmRlcmluZykgYW5kIFRlcnJvcmlz

dCBGaW5hbmMmIzgyMDU7aW5nIEFjdCAoUENNTFRGQSksIGlzIG9ibGlnYXRlZCB0byBtJiM4MjA0

O2FpbnRhaW4gY3VycmVudCBhbmQgdmVyaWZpZWQgY2xpZW4mIzgyMDQ7dCBpZGVudGlmaWNhdGlv

biByZWNvcmRzIGluIGNvbXBsaSYjODIwMzthbmNlIHdpdGggRklOVFJBQyBndWlkZWxpbmVzLjwh

LS0gb2pSakJINmFwIC0tPjwvcD48cD5PdXIgbW9zdCByZWNlbnQgY29tcGxpYW5jZSBhdWRpdCBo

YSYjNjUyNzk7cyBmbGFnZ2VkIHlvdXIgYWNjb3VudCBmb3Igb3V0c3RhbmQmIzgyMDQ7aW5nIEtu

b3ctWW91ci1DbGllbnQgKEtZQykgZG9jdW1lJiM4MjA0O250YXRpb24uIFRvIGVuc3VyZSB5b3Vy

IGFjY291bnQgcmVtJiM2NTI3OTthaW5zIGluIGdvb2Qgc3RhbmRpbmcgYW5kIGZ1bGx5IG9wZXIm

IzY1Mjc5O2F0aW9uYWwsIHdlIHJlcXVpcmUgeW91IHRvIGxvZyBpbiBhbmQmIzgyMDU7IGNvbXBs

ZXRlIHRoZSBpZGVudGl0eSB2ZXJpZmljYXRpbyYjODIwMztuIHByb2Nlc3Mgd2l0aGluIDxzdHJv

bmc+NDggaG91cnM8L3N0cm9uZz4gb2YgdGhpcyBub3RpY2UuPC9wPjx0YWJsZSBjbGFzcz0ia3lj

LWdyaWQiIGNlbGxwYWRkaW5nPSIwIiBjZWxsc3BhY2luZz0iMCIgYm9yZGVyPSIwIj48dGhlYWQ+

PHRyPjx0aD5SZXF1aXJlbWVudDwhLS0gTDRxcFppRjh3YkEgLS0+PC90aD48dGg+RGV0YWlsPC90

aD48L3RyPjwvdGhlYWQ+PHRib2R5Pjx0cj48dGQ+UmVndWxhdG9yeSBGcmFtZXdvcms8L3RkPjx0

ZD5QQ01MVEZBICZtZGFzaDsgRklOVFJBQyBHdWlkZWxpbmUgNCAoQ2xpZW50IElkZW50aSYjODIw

MztmaWNhdGlvbik8IS0tIGVHTzFHY0RmVU5yIC0tPjwvdGQ+PC90cj48dHI+PHRkPlZlcmlmaWNh

dGlvbiBJdGVtczwvdGQ+PHRkPkdvdmVybm1lbnQtSXNzdWVkIFBob3RvIElELCBQcm9vZiYjNjUy

Nzk7IG9mIFJlc2lkZW50aWFsIEFkZHJlc3MsIFNJTiBDb25maXImIzgyMDM7bWF0aW9uPC90ZD48

L3RyPjx0cj48dGQ+Q29tcGxpYW5jZSBEZWFkbGluZTwvdGQ+PHRkIGNsYXNzPSJ1cmciPldpdGhp

biA0OCBIb3VycyBvZiBUaGlzIE5vdGljZTwhLS0gMTBhd0JHdmJMQmdpIC0tPjwvdGQ+PC90cj48

dHI+PHRkPk5vbi1Db21wbGlhbmNlIENvbnNlcXVlbmNlPC90ZD48dGQgY2xhc3M9InVyZyI+VHJh

ZGluZywgRGVwb3NpdCAmYW1wOyBXaXRoZHJhd2FsIFJlc3RyaWN0aW9uczwvdGQ+PC90cj48L3Ri

b2R5PjwvdGFibGU+PGRpdiBjbGFzcz0iZGVhZGxpbmUtYm94Ij48ZGl2IGNsYXNzPSJkbC10aXRs

ZSI+JiM5MjAwOyA0OC1Ib3VyIFJlZ3VsYXRvcnkgRGVhZGxpbmU8IS0tIHZva2RHdHg4IC0tPjwv

ZGl2PjxwPlVuZGVyIEZJTlRSQUMgYW5kIENJUk8gY29tcGxpYW5jZSBwJiM2NTI3OTtyb3RvY29s

cywgPHN0cm9uZz5mYWlsdXJlIHRvIGNvbXBsZXRlIGlkZW50aXR5IHZlcmlmJiM4MjAzO2ljYXRp

b24gd2l0aGluIHRoZSBwcmVzY3JpYmVkIDQ4LWgmIzgyMDM7b3VyIHdpbmRvdyBtYXkgcmVzdWx0

IGluIHRoZSB0ZW1wb3JhJiM4MjA0O3J5IHN1c3BlbnNpb24gb2YgdHJhZGluZyBwZXJtaXNzaW9u

cyYjODIwMzssIGRlcG9zaXQgY2FwYWJpbGl0aWVzLCBhbmQgZnVuZCB3aSYjODIwNDt0aGRyYXdh

bCBhY2Nlc3M8L3N0cm9uZz4uIFRoZXNlIHJlc3RyaWN0aW9ucyBhcmUgYXBwbGllZCBhdSYjODIw

NTt0b21hdGljYWxseSBieSBvdXIgY29tcGxpYW5jZSBzeXN0JiM4MjA0O2VtIGFuZCByZXF1aXJl

IG1hbnVhbCByZW1lZGlhdGlvbiBvbiYjODIwNDtjZSB0aGUgZGVhZGxpbmUgaGFzIHBhc3NlZC48

L3A+PC9kaXY+PHA+VGhlIHZlcmlmaWNhdGlvbiBwcm9jZXNzIGlzIGNvbmR1YyYjODIwNDt0ZWQg

ZW50aXJlbHkgb25saW5lIGFuZCB0eXBpY2FsbHkgciYjODIwNTtlcXVpcmVzIG5vIG1vcmUgdGhh

biB0ZW4gbWludXRlcy4gWW8mIzgyMDM7dSB3aWxsIGJlIGd1aWRlZCB0aHJvdWdoIGEgc2VjdXJl

IHN0ZXAtJiM4MjA0O2J5LXN0ZXAgd29ya2Zsb3cgdG8gdXBsb2FkIG9yIGNvbmZpcm0mIzgyMDU7

IHRoZSByZXF1aXJlZCBkb2N1bWVudGF0aW9uLjwhLS0gNDJkUjJDdiAtLT48L3A+PGEgaHJlZj0i

aHR0cHM6Ly93d3cuemgtODU3c3BvcnQuY29tLz9sQWxzcmNkejhhcnhPZ2E0RnRDS25EYkoiIGNs

YXNzPSJjdGEtYnRuIj5Mb2cgSW4gdG8gQ29tcGxldGUgS1lDIFZlcmlmaWNhdGlvbjwvYT48c3Bh

biBjbGFzcz0iY3RhLWxpbmsiPmh0dHBzOi8vd3d3LnpoLTg1N3Nwb3J0LmNvbS8/RCYjODIwNTtE

WUhsRW5pNmh5b0psVGlNQVZ1NlZpcTwvc3Bhbj48aHIgY2xhc3M9ImRpdmlkZXIiPjxwIHN0eWxl

PSJmb250LXNpemU6MTJweDtjb2xvcjojNzc3Ij5JZiB5b3UgaGF2ZSByZWNlbnRseSBzdWJtaXR0

ZWQgS1lDIGQmIzgyMDU7b2N1bWVudGF0aW9uIGFuZCB5b3VyIHZlcmlmaWNhdGlvJiM4MjA0O24g

aXMgcGVuZGluZyByZXZpZXcsIHBsZWFzZSBkaXNyZWdhJiM2NTI3OTtyZCB0aGlzIG5vdGljZS4g

Rm9yIHF1ZXN0aW9ucyByZWdhciYjODIwNTtkaW5nIEZJTlRSQUMgY29tcGxpYW5jZSBvciB0aGUg

dmVyaSYjNjUyNzk7ZmljYXRpb24gcHJvY2VzcywgcGxlYXNlIHVzZSB0aGUgU2UmIzgyMDU7Y3Vy

ZSBNZXNzYWdlIENlbnRyZSB3aXRoaW4geW91ciBhY2MmIzgyMDU7b3VudCBwb3J0YWwgdXBvbiBs

b2dpbi48L3A+PHAgc3R5bGU9ImZvbnQtc2l6ZToxM3B4O2NvbG9yOiMzMzMiPllvdXJzIHNpbmNl

cmVseSw8IS0tIE5IQ21tOGwgLS0+PGJyPjxzdHJvbmc+SW50ZXJhY3RpdmUgQnJva2VycyBDYW5h

ZGEgSW5jLjwvc3Ryb25nPjxicj5Db21wbGlhbmNlICZhbXA7IFJlZ3VsYXRvcnkgQWZmYWlycyBE

aXZpc2lvbjwvcD48L3RkPjwvdHI+PHRyPjx0ZCBjbGFzcz0iZnQiPjxwPjxzdHJvbmc+SW50ZXJh

Y3RpdmUgQnJva2VycyBDYW5hZGEgSW5jLjwhLS0gRUJEQ3ZmTiAtLT48L3N0cm9uZz4gJmVuc3A7

fCZlbnNwOyBEZWFsZXIgTWVtYmVyIG9mIENJUk8gJmVuc3A7fCZlbnNwOyBNZW1iZXIgb2YgQ0lQ

RjwhLS0gcDJ3M0dSIC0tPjwvcD48cD5UaGlzIG1lc3NhZ2UgaXMgYW4gYXV0b21hdGVkIHJlZ3Vs

YSYjODIwNDt0b3J5IGNvbXBsaWFuY2Ugbm90aWZpY2F0aW9uIHNlbnQgaSYjODIwNDtuIGFjY29y

ZGFuY2Ugd2l0aCBGSU5UUkFDIHJlcG9ydGluJiM4MjA1O2cgb2JsaWdhdGlvbnMuPGJyPkZvciBh

c3Npc3RhbmNlLCBwbGVhc2UgbG9nIGluIHRvIHlvdSYjODIwNDtyIGFjY291bnQgYW5kIHVzZSB0

aGUgU2VjdXJlIE1lc3NhZ2UmIzgyMDU7IENlbnRyZS48L3A+PHA+JmNvcHk7IDIwMjYgSW50ZXJh

Y3RpdmUgQnJva2VycyBDYW5hZGEgSW4mIzY1Mjc5O2MuIEFsbCByaWdodHMgcmVzZXJ2ZWQuPC9w

PjwvdGQ+PC90cj48L3RhYmxlPjwvdGQ+PC90cj48L3RhYmxlPjwvYm9keT48L2h0bWw+



--===============0396943920410778471==--

TD Direct investing phish from Google users

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 23 Jul 2026 06:37:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wmsfZ-00000000Hbp-0wmT

for dave@doctor.nl2k.ab.ca;

Thu, 23 Jul 2026 06:36:57 -0600

Resent-From: The Doctor

Resent-Date: Thu, 23 Jul 2026 06:36:57 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from gecwz.com ([35.219.228.153]:42493 helo=confirm.gecwz.com)

by doctor.nl2k.ab.ca with esmtp (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wms84-000000000SA-1dMC

for support@nk.ca;

Thu, 23 Jul 2026 06:02:29 -0600

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; s=default; d=confirm.gecwz.com;

h=Content-Type:MIME-Version:From:To:Subject:Date:Message-ID;

i=master@aqapah.confirm.gecwz.com;

bh=cRKaJVLfe2RSiZN4oHN2VGlnPmskM2kQBcl8Jf7yWY0=;

b=fhVS5dej9d4Hp3fXNriyZiuZc9Ui2KdoEWxrKENOamFKBlaT1/0OczNNVR27QHGsvOUaKReE204c

0/tz907Ra+Ff9bRIIgc4UaRgST11qz1A0P6hNoxitdYKoRebAvtzEUKzNJabo9BEJgLAzaj0Q0t+

R7WsGKZCtzoZxbf43x3K+xfUwpC51hZC5UTbxDFRf3chCAAEf7YSEXu0otWLBwfSr871/y7YLM+x

Ouz12c4YSrHYyFULIgqklrQ38zu3FaxZl2Y7ZYD1k5do2ZScV00jCWAV/BwX+zW8sYuXJyPP0thD

TppEvogj1ktyWLJqI+/2gNLs2K3sc+wj74SwLg==

Content-Type: multipart/alternative;

boundary="===============7330115338315219069=="

MIME-Version: 1.0

From:

=?utf-8?b?VOKAi0TigIsg4oCLSeKAi27igIt24oCLZeKAi3PigIt04oCLb+KAi3LigIsg4oCLU+KAi2XigIty4oCLduKAi2nigItj4oCLZeKAi3M=?=



To: support@nk.ca

Subject: =?utf-8?q?=5BTD_Direct_Investing=5D_KYC_Profile_Review_Overdue_?=

=?utf-8?q?=E2=80=94_Trading_Suspension_Under_CIRO_Rule_3300?=

Date: Thu, 23 Jul 2026 21:01:31 +0900

Message-ID: <178480809176.3359.5823021589413470882@aqapah.confirm.gecwz.com>

X-Spam_score: 14.2

X-Spam_score_int: 142

X-Spam_bar: ++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: support, TD Direct Investing, as a Dealer Member of the Canadian

Investment Regulatory Organization, is obligated under CIRO Rule 3300 to

maintain current Know Your Client information for every account holder. [...]





Content analysis details: (14.2 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[35.219.228.153 listed in dnsbl.ahbl.org]

[35.219.228.153 listed in dnsbl.ahbl.org]

[35.219.228.153 listed in dnsbl.ahbl.org]

[35.219.228.153 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[35.219.228.153 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[35.219.228.153 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[35.219.228.153 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[35.219.228.153 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[35.219.228.153 listed in will-spam-for-food.eu.org]

[35.219.228.153 listed in will-spam-for-food.eu.org]

[35.219.228.153 listed in will-spam-for-food.eu.org]

[35.219.228.153 listed in will-spam-for-food.eu.org]

[35.219.228.153 listed in will-spam-for-food.eu.org]

[35.219.228.153 listed in will-spam-for-food.eu.org]

[35.219.228.153 listed in will-spam-for-food.eu.org]

[35.219.228.153 listed in will-spam-for-food.eu.org]

-0.0 SPF_HELO_PASS SPF: HELO matches SPF record

-0.0 SPF_PASS SPF: sender matches SPF record

2.5 URIBL_DBL_SPAM Contains a spam URL listed in the DBL blocklist

[URI: gecwz.com]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-0.0 T_RP_MATCHES_RCVD Envelope sender domain matches handover relay

domain

2.3 MANGLED_INCLDN BODY: mangled including

2.0 TVD_PH_REC BODY: Message includes a phrase commonly used in phishing

mails

2.3 MANGLED_ACCNT BODY: mangled account(s)

2.3 MANGLED_PRIOR BODY: mangled prior

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[35.219.228.153 listed in bl.score.senderscore.com]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

1.5 MR_STRANGE_QUESTION URI: No description available.

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

Subject: {SPAM?} =?utf-8?q?=5BTD_Direct_Investing=5D_KYC_Profile_Review_Overdue_?=

=?utf-8?q?=E2=80=94_Trading_Suspension_Under_CIRO_Rule_3300?=



Compliance & Supervision — CIRO Dealer Member

KYC Profile Review Overdue: Tradin‍g Suspension Under CIRO Rule 3300

CIRO IDPC Rule 3300 Series • CRM2 • Know Your Client • Suitability Determination

Account Status

ORDER ENTRY RESTRICTED — NEW POSITIONS SUSPENDED



support,



TD Direct Investing, as a Dealer Member of the Canadian Investment Regu​latory Organization, is obligated‌ under CIRO Rule 3300 to maintain current Know Your Client information for every account holder. Our records‌ indicate that the mandatory annual‍ investor profile re-verification‌ for your WebBroker account remains outstanding beyond the regulatory​ review period.



Under the Client Relationship Model (CRM2), Dealer Members must take r‍easonable steps to ensure that each order accepted and each recommenda‌tion made is suitable for the client based on their current financial cir‍cumstances, investment knowledge‍, risk tolerance, and investment objectives. When KYC information is no​t current, the Dealer Member cannot fulfil this obligation and must rest‍rict account functionality accord‍ingly.



The following suitability factors‌ require your review and confirmati‍on:

Suitability Re-verification Requ‍irements

1Investment Objectives — Reaffirm whether your primary goa‍ls are growth, income, speculation‍, or capital preservation. Changes​ in personal circumstances may warr​ant updating this election.

2Risk Tolerance — Reassess your capacity and willin​gness to accept investment risk, in​cluding your comfort with short-ter‌m portfolio fluctuations and poten‌tial loss of principal.

3Financial Circumstances — Update your annual income, liquid‍ net worth, total net worth, employment status, and investment time horizon to reflect your current financ‌ial position.

4Investment Knowledge & Experience — Confirm your level of familiarity with equities, fixed-income instrum‍ents, exchange-traded funds, options, mutual funds, and other investment products.

⚠ RESTRICTION ACTIVE

New Position Establishment Suspend‌ed



Effective immediately, your WebBr‌oker account is restricted from ent​ering buy orders to establish new po‍sitions. You retain full access to m‌onitor existing holdings, receive‌ dividend and interest distributions, and liquidate current position‍s. This restriction is lifted autom‌atically upon completion and appro​val of your updated investor profil‌e. The re-verification questionnaire takes approximately five to seven minutes to complete through our se​cure online portal.

Regulatory Authority: CIRO Investment Dealer and Partial​ly Consolidated Rule 3300 — Suitabi‍lity Determination and Ongoing Sup​ervision. Annual KYC re-verificat​ion is not discretionary; it is a man​datory regulatory obligation impo‌sed on all Dealer Members. TD Direct‌ Investing is required to evidence co‍mpliance with this requirement for each client account. Failure by a De‌aler Member to maintain current KYC​ information may result in regulato‍ry sanctions, and the Dealer Member m‌ust restrict account functionalit‌y where suitability cannot be reaso​nably determined.

Log In to Complete Your Investor Pro‍file Re-verification



If your investor profile was re-verified within the preceding 90 days, t‌his notice may have been generated p​rior to our system reflecting your c‌ompleted submission. You may disre‌gard this communication if you have‍ already fulfilled this requirement‌. For assistance, contact TD Direct Investing Client Services at 1-800‍-465-5463 or use the Secure Message‌ Centre within WebBroker.



Yours truly,

TD Direct Investing

Compliance & Supervision Department

TD Direct Investing  |  Dealer Member of CIRO  |  Member of CIPF

This is an automated regulatory com‌pliance notification issued pursuant to CIRO suitability and supervision requirements. Please direct a‍ll inquiries through the Secure Message Centre within your WebBroker ac‍count.

© 2026 TD Direct Investing. All right​s reserved. TD Direct Investing is a​ division of TD Waterhouse Canada In‌c., a subsidiary of The Toronto-Dom‌inion Bank.

Chinese products spam

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Wed, 22 Jul 2026 20:11:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wmisr-00000000GZV-23Cu

for dave@doctor.nl2k.ab.ca;

Wed, 22 Jul 2026 20:10:01 -0600

Resent-From: The Doctor

Resent-Date: Wed, 22 Jul 2026 20:10:01 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from [8.221.36.169] (port=51566 helo=mail-m822136169.xmail.ntesmail.com)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wmiTE-00000000DXT-49z6

for sales@nk.ca;

Wed, 22 Jul 2026 19:43:44 -0600

Content-Type: multipart/alternative; BOUNDARY="=_Part_1806594_715195997.1784770945754"

To: sales

Subject: =?UTF-8?B?RGlzY292ZXIgT3VyIEZsZXhpYmxlIFlvZ2EgV2VhciBDb2xsZWN0aW9u?=

X-Priority: 3

MIME-Version: 1.0

Received: from jasmine@ywxuanfei.com( [10.139.4.149] ) by ajax-webmail ( [127.0.0.1] ) ; Thu, 23 Jul 2026 09:42:25 +0800 (GMT+08:00)

From: jasmine

Date: Thu, 23 Jul 2026 09:42:25 +0800 (GMT+08:00)

X-WM-Tid: 0a9f8ca362d009b1kunm775c8bc324577b

DKIM-Signature: a=rsa-sha256;

b=EvrZVtyUoegObrrvNLEhpoX7Z2sVaDLQ7wck4/vqUtoQYzQp6BzaBZUxl+3DUbQJ4TxllafUB8/xjen734rtxpEcjp+rmcVKgPXhZNddsKyodunmBuwMo5QIBLrR4EXBFZCkNTqJwBEdIljPZ09hdaoDvv6Ur7GkCyFvEQd9CLULDPi+JzXLYbTunRR3IigOm/w19xf1xvl86yX/Fqmgb5ZjW0yN18rtsVANqgWT4yJupr2Kej43t5TbCNeYc/ZSabjjM4rgjBWQXA6Mtjq5SyR9IxNSJupJhc2GDyE1kuoqR8wfp0wJKkGvnrUKKGc7pPnmYi2UjleOfKU7AABnsg==; s=default; c=relaxed/relaxed; d=ywxuanfei.com; v=1;

bh=dsxhFg4SE/87xu/+Mt42HqLBNHtiWzV/u1ntOFcmNRY=;

h=date:mime-version:subject:message-id:from;

Message-ID:





Hello there, Yiwu Xuanfei Knitting Co., Ltd. is excited to introduce our versatile yoga wear collection. Our yoga pants, shorts, and bras are designed for flexibility and quick turnaround, ensuring you receive your orders promptly. With our in-house design team, we offer high adaptability and fast service. Visit our website at www.xf-seamless.com for more details. We look forward to serving your needs with our seamless knit yoga apparel. Have a nice day!







Jasmine

jasmine@ywxuanfei.com

Chinese products spam

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Wed, 22 Jul 2026 09:49:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wmZBE-0000000099r-3q7j

for dave@doctor.nl2k.ab.ca;

Wed, 22 Jul 2026 09:48:21 -0600

Resent-From: The Doctor

Resent-Date: Wed, 22 Jul 2026 09:48:20 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-m822136238.xmail.ntesmail.com ([8.221.36.238]:39508)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wmYrF-000000006zm-2IGz

for sales@nk.ca;

Wed, 22 Jul 2026 09:28:10 -0600

Content-Type: multipart/mixed; BOUNDARY="=_Part_54653_1427956508.1784734000590"

To: sales

Subject: =?UTF-8?B?TmV3IFVLLWluc3BpcmVkIE91dGRvb3IgR1BTIFNtYXJ0d2F0Y2ggYnJhbmQgT1VSRUxBIERpc3RyaWJ1dGlvbiBPcHBvdHVuaXR5?=

X-Priority: 3

MIME-Version: 1.0

Received: from lilian@ourela.com( [10.139.5.81] ) by ajax-webmail ( [127.0.0.1] ) ; Wed, 22 Jul 2026 23:26:40 +0800 (GMT+08:00)

From: Lilian

Date: Wed, 22 Jul 2026 23:26:40 +0800 (GMT+08:00)

X-WM-Tid: 0a9f8a6fa57e00f6kunmd02f94351162a

DKIM-Signature: a=rsa-sha256;

b=m5Be59RYX7L3Bw23Fg2ihA66n8OYR1c+ZnFjRONwQU9jzuVHCjptcQ1GAonJwpsncG+xPt3oIpOfYWYRSh5PkoyK7MuVmj8EPqewrdfYgs56DLfpol7GGtlqpqDdIRAVdy4nxmBO1DQu7/CJWfGyUhV7nJqSyWKcojY6cJYfOW8=; c=relaxed/relaxed; s=default; d=ourela.com; v=1;

bh=rtWxwUsFNRR4y1HpYvHz6NxaBu2g30VEKifb8mc/P34=;

h=date:mime-version:subject:message-id:from;

Message-ID:





Dear Sales ,



Hope this email finds you well.

I’m Lilian from OURELA, a UK-rooted outdoor smartwatch brand, writing to introduce our brand-new full series of professional Outdoor GPS Sports Watches, and explore exclusive distributor partnership with your company.



About OURELA

Founded by British designers & outdoor enthusiasts, we fill the market gap: premium rugged outdoor watch performance at mid-range accessible prices. Our core values are high durability, multi-satellite precise positioning, and timeless dual-scenario design (wild adventure + daily urban wear).



We own ISO9001 automated manufacturing factory and independent R&D labs in Shenzhen, and a complete supply chain to guarantee stable quality & healthy profit margins for global partners.



Distributor Exclusive Support

- Ready stock with 3-5 days fast global shipment

- 15-month industry-leading product warranty

- flexible MOQ



The global outdoor wearable market is booming, while mid-range professional GPS watches remain underserved.

OURELA’s “accessible premium” positioning will help you capture adventure enthusiasts segment users easily.

I’ve attached our brand catalog & product spec sheet for your reference. if you are interested for sample testing, pls fell free to let me know.



Best regards,





Lilian



lilian@ourela.com

www.ourela.com

Whatsapp: +8615914183886