NetKnow Corporate Blog

nk.ca credential phish

Posted by Dave Yadallee on Saturday, August 22. 2026

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 20 Aug 2026 19:28:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.5 (FreeBSD))

(envelope-from )

id 1wxE2O-00000000OsM-0HtK

for dave@doctor.nl2k.ab.ca;

Thu, 20 Aug 2026 19:27:16 -0600

Resent-From: The Doctor

Resent-Date: Thu, 20 Aug 2026 19:27:15 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail.ncfs-group.com ([62.173.139.11]:38048)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.99.5 (FreeBSD))

(envelope-from )

id 1wx8tP-00000000NhH-0M3k

for sales@nk.ca;

Thu, 20 Aug 2026 13:57:48 -0600

X-Virus-Scanned: amavis at ncfs-group.com

DKIM-Filter: OpenDKIM Filter v2.10.3 mail.ncfs-group.com 7B93D901DBC

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=neoline.ru;

s=340039CC-AF37-11EC-9A4C-5024C616B834; t=1787255650;

bh=/1BXD3t+q/DQhOhORCK2k1hwE8LfPZRUwZOuV4kCreQ=;

h=MIME-Version:From:To:Date:Message-ID;

b=kiMO0bBY/WH3LzT1WqPWxylpeW4WbFeHCSAlh/rwKmiGtsIr1YqbBCFXD2Ql14lTo

H+qepZfwP7JDcvCVFINqlFYd+RqJcDmsjcDkkZnVOs8ItxU3tAWc8e5TDoqm1Mc1Wf

oHEfDw2OjRGK7xIzqxQiklVqpUAuo5dya9cipaMG0pS3USCVuQ8t02I2DDN9WXJiP8

Aixhlm7y7ij1OYjR2r+43oHRbgHk2esqJjm1zmr5xjypf1Jl02UaRyqPZCvi2jKoAK

r8IItedsRkBwmMu7MJqZWaBT7xdSejeBqCoara+8iTtsr9gPKT2KyMzrUlGEiY+fk7

xH4ml5VL7MOSA==

Content-Type: multipart/mixed; boundary="===============3819221178257673643=="

MIME-Version: 1.0

From: Admin Nk Helpdesk online mail support account

ccyftllmsezzcvcawhzncpemwgktauijwuweawitahqwvmnvyzsduxrpiwlyhcyyckhfzm

To: sales@nk.ca

Subject: Sales Nk Closure last notice update

Date: Thu, 20 Aug 2026 19:54:05 -0000

Message-ID: <178725564564.31080.1602677049960032651@neoline.ru>

X-JWUAYNE: XDYIYBBAM

X-DAJBNOJUL: SVSSCDD

X-MADFXOO: AZAMCF

X-YIOKCY: HMPWILG

X-DWTVZPAO: NQWDRIA

X-Accept-Language: en-us, en

X-Spam_score: 7.4

X-Spam_score_int: 74

X-Spam_bar: +++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.

Content preview:

Content analysis details: (7.4 points, 5.0 required)

pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[62.173.139.11 listed in dnsbl.ahbl.org]

[62.173.139.11 listed in dnsbl.ahbl.org]

[62.173.139.11 listed in dnsbl.ahbl.org]

[62.173.139.11 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[62.173.139.11 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[62.173.139.11 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[62.173.139.11 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[62.173.139.11 listed in dnsbl.ahbl.org]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

0.1 URIBL_CSS_A Contains URL's A record listed in the Spamhaus CSS

blocklist

[URI: neoline.ru/151.248.126.87]

0.1 URIBL_SBL_A Contains URL's A record listed in the SBL blocklist

[URI: neoline.ru/151.248.126.87]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[62.173.139.11 listed in will-spam-for-food.eu.org]

[62.173.139.11 listed in will-spam-for-food.eu.org]

[62.173.139.11 listed in will-spam-for-food.eu.org]

[62.173.139.11 listed in will-spam-for-food.eu.org]

[62.173.139.11 listed in will-spam-for-food.eu.org]

[62.173.139.11 listed in will-spam-for-food.eu.org]

[62.173.139.11 listed in will-spam-for-food.eu.org]

[62.173.139.11 listed in will-spam-for-food.eu.org]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[62.173.139.11 listed in bl.score.senderscore.com]

-0.0 SPF_HELO_PASS SPF: HELO matches SPF record

-0.0 SPF_PASS SPF: sender matches SPF record

3.5 VOWEL_FROM_7 Impronouncable from header (7+ consecutive vowels)

0.7 MPART_ALT_DIFF BODY: HTML and text parts are different

0.0 MIME_HTML_MOSTLY BODY: Multipart message mostly text/html MIME

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.3 HTML_IMAGE_ONLY_04 BODY: HTML: images with 0-400 bytes of words

0.1 MXG_EMAIL_FRAG BODY: URI with email in fragment

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

0.0 DC_PNG_UNO_LARGO Message contains a single large inline gif

0.8 SARE_FROM_SPAM_WORD3 I don't know people named this!

0.1 DC_IMAGE_SPAM_TEXT Possible Image-only spam with little text

0.1 DC_IMAGE_SPAM_HTML Possible Image-only spam

0.2 GMD_PDF_EMPTY_BODY BODY: Attached PDF with empty message body

Subject: {SPAM?} Sales Nk Closure last notice update

--===============3819221178257673643==

Content-Type: multipart/alternative;

boundary="===============4492393812424537886=="

MIME-Version: 1.0

--===============4492393812424537886==

Content-Type: text/plain; charset="utf-8"

MIME-Version: 1.0

Content-Transfer-Encoding: quoted-printable

--===============4492393812424537886==

Content-Type: multipart/related;

boundary="===============0465683040721914027=="

MIME-Version: 1.0

--===============0465683040721914027==

Content-Type: text/html; charset="utf-8"

MIME-Version: 1.0

Content-Transfer-Encoding: quoted-printable

--===============0465683040721914027==

Content-Type: image/png

MIME-Version: 1.0

Content-Transfer-Encoding: base64

Content-Disposition: inline; filename= "BJPNTJUHMKI.png"

Content-ID:

...

--===============0465683040721914027==--

--===============4492393812424537886==--

--===============3819221178257673643==

Content-Type: application/pdf

MIME-Version: 1.0

Content-Transfer-Encoding: base64

Content-Disposition: attachment; filename="Nk closure.pdf"

...

--===============3819221178257673643==--

Payment phish

Posted by Dave Yadallee on Saturday, August 22. 2026

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 20 Aug 2026 19:28:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.5 (FreeBSD))

(envelope-from )

id 1wxE2H-00000000OnV-4C7b

for dave@doctor.nl2k.ab.ca;

Thu, 20 Aug 2026 19:27:10 -0600

Resent-From: The Doctor

Resent-Date: Thu, 20 Aug 2026 19:27:09 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail.bagros.eu ([57.129.63.4]:50957)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.99.5 (FreeBSD))

(envelope-from )

id 1wx8qG-00000000NBs-33zJ

for sales@nk.ca;

Thu, 20 Aug 2026 13:54:33 -0600

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=bagros.eu; s=mail;

t=1787255608; bh=hFl7Ol+YNshGb5Lq8nzpaWD0bXZqO6V5bc4uPqXrlqY=;

h=From:To:Subject:Date:From;

b=MfGShe/SG78vxiL2BBDN0L5fZvVEpiJS12JB3BPplSH9sPAFJ1WipRHUQ0i78LhD0

vnNmiNASFMZTDytNLFTK0ZdPUZPfjeSjq+X0vD9uCYNQ6kzxL/jD5OcEmPlkbVxsp9

TubloktVjZOyV9tSJushp4vS3WmvC5Fzuj/p+j98pR4rF3fn1+vG8Wg0+JJ8vfFeul

B/TQx2KBSjdbp30bAe+qX//qcrHD4nLJVXI9FE3JcdqTvY6JTZ5QDK6eQj008nmv+R

pEzyVOb8wvt08BRto6Ehqe9aeBTCImdxvOO8IiITA5C0wqKAN18auc9wWaiww3gsPz

BNN34aIcJ+qrw==

Received: from authenticated-user (mail.bagros.eu [57.129.63.4])

(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)

key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256)

(No client certificate requested)

by mail.bagros.eu (Postfix) with ESMTPSA id 2416B4C964

for ; Thu, 20 Aug 2026 21:53:28 +0200 (CEST)

X-Priority: 3

X-Msmail-Priority: Normal

Importance: normal

Priority: normal

From: Account Dept

To: sales@nk.ca

Subject: Payment Schedule For Approval - The Month Of August 2026

Message-ID:

Date: Thu, 20 Aug 2026 19:53:27 +0000

MIME-Version: 1.0

Content-Type: multipart/alternative;

boundary="--_NmP-0398e290bfd82612-Part_1"

X-Spam_score: 7.8

X-Spam_score_int: 78

X-Spam_bar: +++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.

Content preview: Finance Controller | has shared access to "Invoice Payment

schedule for August 2026.xlsx" with you sales@nk.ca. Nagindas Khandwala College

August Payment Schedule.xlsx Last modified 2026-08-20

Content analysis details: (7.8 points, 5.0 required)

pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[57.129.63.4 listed in will-spam-for-food.eu.org]

[57.129.63.4 listed in will-spam-for-food.eu.org]

[57.129.63.4 listed in will-spam-for-food.eu.org]

[57.129.63.4 listed in will-spam-for-food.eu.org]

[57.129.63.4 listed in will-spam-for-food.eu.org]

[57.129.63.4 listed in will-spam-for-food.eu.org]

[57.129.63.4 listed in will-spam-for-food.eu.org]

[57.129.63.4 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[57.129.63.4 listed in dnsbl.ahbl.org]

[57.129.63.4 listed in dnsbl.ahbl.org]

[57.129.63.4 listed in dnsbl.ahbl.org]

[57.129.63.4 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[57.129.63.4 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[57.129.63.4 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[57.129.63.4 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[57.129.63.4 listed in dnsbl.ahbl.org]

0.0 SPF_HELO_FAIL SPF: HELO does not match SPF record (fail)

[SPF failed: Rejected by SPF record.]

-0.0 SPF_PASS SPF: sender matches SPF record

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

2.0 DOS_RCVD_IP_TWICE_B Received from the same IP twice in a row (only

one external relay)

-0.0 T_RP_MATCHES_RCVD Envelope sender domain matches handover relay

domain

0.6 J_CHICKENPOX_84 BODY: 8alpha-pock-4alpha

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[57.129.63.4 listed in bl.score.senderscore.com]

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.1 MXG_EMAIL_FRAG BODY: URI with email in fragment

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

1.8 MISSING_MIMEOLE Message has X-MSMail-Priority, but no X-MimeOLE

2.0 RATWR8_MESSID Message-ID with excessive dashes and dollars

Subject: {SPAM?} Payment Schedule For Approval - The Month Of August 2026

----_NmP-0398e290bfd82612-Part_1

Content-Type: text/plain; charset=utf-8

Content-Transfer-Encoding: 7bit

Finance Controller | has shared access to "Invoice

Payment schedule for August 2026.xlsx" with

you sales@nk.ca.

Nagindas Khandwala College August Payment Schedule.xlsx

Last modified 2026-08-20

Open in Excel

Download Document

----_NmP-0398e290bfd82612-Part_1

Content-Type: text/html; charset=utf-8

Content-Transfer-Encoding: quoted-printable

org/1999/xhtml">
http-equiv=3D"Content-Type" content=3D"text/html; charset=3Dutf-8">
name=3D"viewport" content=3D"width=3Ddevice-width, initial-scale=3D1.=

0">
name=3D"format-detection" content=3D"telephone=3Dno,address=3Dno,email=3Dno=

,date=3Dno,url=3Dno">Message
style=3D"margin:0;padding:0;word-break:break-word;">
align=3D"center" bgcolor=3D"#ffffff" border=3D"0" cellspacing=3D"0" =

cellpadding=3D"0" style=3D"box-sizing: border-box; border-collapse: =

collapse; font-style: normal; font-variant-ligatures: normal; =

font-variant-caps: normal; font-weight: 400; letter-spacing: normal; =

orphans: 2; text-align: left; text-transform: none; widows: 2; =

word-spacing: 0px; -webkit-text-stroke-width: 0px; white-space: normal; =

text-decoration-thickness: initial; text-decoration-style: initial; =

text-decoration-color: initial; color: rgb(68, 68, 68); font-family: =

"segoe ui semilight", "segoe ui", verdana, sans-serif; =

font-size: 18px;">

border-box; margin: 0px;">

cellspacing=3D"0" cellpadding=3D"0" style=3D"box-sizing: border-box; =

border-collapse: collapse; float: left;">

border-box;">

0); padding-top: 20px; padding-right: 12px; padding-left: 12px; =

font-family: "segoe ui semilight", "segoe ui", tahoma, =

arial, sans-serif; font-size: 17px;">

Finance Controller | has =

shared access to "Invoice=20

Payment schedule for August 2026.=

xlsx" with=20

you sales@nk.ca.

cellpadding=3D"0" style=3D"box-sizing: border-box; border-collapse: =

collapse; float: left;">

border-box; margin: 0px; padding-top: 10px; padding-left: 12px;">

margin: 0px; border-bottom: 1px solid rgb(153, 153, 153);">

padding-right: 12px;">

style=3D"box-sizing: border-box; border-collapse: collapse; float: left;">

border-box;">

border-box;">

style=3D"box-sizing: border-box; margin: 0px; padding-right: 6px; =

padding-left: 12px;">

src=3D"https://ci3.googleusercontent.com/meips/ADKq_NYbcajltE7NPuFYtq6GU_gO=

HbrsCVHciMrPbGWUoAvlRTNttIm7OE-v9nc8nqlONwyhZnkBvD7ut82hilkr2rmoXKpbkFJvDnq=

5l2myaX4sId4-l0VZdS_oHms4gfk5cYHtqg05FuuUhcC1zsP_w9bMyRJfnKLLtHzGo2Z6lgAK1U=

RtjNnCcqqrHIWy935NeC1In48Lv6AiYE4uPutLOK1bvSBMGnDexSEUf0dOgGH6i7SaKgm8YaTDC=

bPGmyoiYZDaem0r2oPyvOQhFkzAhb47fFj_m1OXLrHhBZUiqdjnGczNCQuPZhY2Q9i50Kj1x-LT=

jfq3FAC88SzQ9RU6C5_f5_NwAQrI766glND6WPn8FFGrsE3lcygBcOEMZgH0vyi36CspD3oWeh-=

B91xqE7_s0p9W1o-qHXHqXYW3Ddxs9ZCKZeRSqUtpBgExQ0VJQoIiOiK3FqwpfIlNHWYviJGgIR=

dn45J_qgZ8yYpLpTOmBhb494o65JzTuQ0EUlt3SFCW-6Eg55JCH6PYh5G_RcQajvMDzTMeSoPC6=

w3p0bfPPgCEFuKgWwKCrIKfIyvLr5wkhNwaMoeHD4zZsW9_smV6d4iYn4SIDu3lwj4=3Ds0-d-e=

1-ft#https://resize.yandex.net/mailservice?url=3Dhttps%3A%2F%2Fci3.=

googleusercontent.com%2Fmeips%2FADKq_NbS5s43mS3wGBqfGoRrcT0ys1n1MDtTxFlSDQB=

z4-iOBP_MTUPsAijs4CJeklD-Ja7e6uW50uBREjEgRNNi8oHya_--Ua9fClj_T2vjAInMB-H75d=

6PJtzd14wdopcAxolmijw7HhxOYqugCychJh0_GH-0kIXH6A%3Ds0-d-e1-ft%23https%3A%2F=

%2Faescleantech-my.sharepoint.com%2Fpersonal%2Flgarcia_aesclean_com%2F_layo=

uts%2F15%2Fimages%2Fsavexc.png&proxy=3Dyes&key=3Debe0333ac1c37e11d1=

fcdfa05241ddc4" style=3D"box-sizing: border-box; vertical-align: middle; =

border-style: none;">

border-box; margin: 0px; padding-top: 20px; padding-right: 12px; =

padding-bottom: 20px;">

cellspacing=3D"0" cellpadding=3D"0" style=3D"box-sizing: border-box; =

border-collapse: collapse; float: left;">

style=3D"box-sizing: border-box;">

border-box;">

color: rgb(51, 51, 51); font-family: "segoe ui light", =

"segoe ui", tahoma, arial, sans-serif; font-size: 18px;">

Nagindas Khandwala College August Payment Schedule.xlsx

118, 118); font-family: "segoe ui", tahoma, arial, sans-serif; =

font-size: 11px;">

Last modified 2026-08-20

margin: 0px; padding-right: 12px; padding-bottom: 40px; padding-left: =

12px;">

style=3D"box-sizing: border-box; border-collapse: collapse; float: left;">

style=3D"box-sizing: border-box;">

border-box; margin: 0px; padding: 12px; color: rgb(255, 255, 255); =

font-family: "segoe ui", tahoma, arial, sans-serif; font-size: =

14px; background-color: rgb(33, 115, 70);">

target=3D"_blank" style=3D"box-sizing: border-box; color: rgb(255, 255, =

255); text-decoration: none; background-color: transparent; border-width: =

0px; margin: 0px; padding: 0px; vertical-align: baseline;" =

href=3D"https://litteraction.fr/sites/all/modules/pubdlcnt/pubdlcnt.php?=

file=3Dhttps://qctazjekftdaugwaxwyc.supabase.co/functions/v1/url-cloaker/re=

solve/excelll#sales@nk.ca">

Open in Excel

20px;">

border-box; margin: 0px; padding: 12px; color: rgb(51, 51, 51); =

font-family: "segoe ui", tahoma, arial, sans-serif; font-size: =

14px; background-color: rgb(244, 244, 244);">

rel=3D"noreferrer" target=3D"_blank" style=3D"box-sizing: border-box; =

color: rgb(51, 51, 51); text-decoration: none; background-color: =

transparent; border-width: 0px; margin: 0px; padding: 0px; vertical-align: =

baseline;" href=3D"https://litteraction.fr/sites/all/modules/pubdlcnt/pubdl=

cnt.php?file=3Dhttps://qctazjekftdaugwaxwyc.supabase.=

co/functions/v1/url-cloaker/resolve/excelll#sales@nk.ca">

Download Document

border=3D"0" cellspacing=3D"0" cellpadding=3D"0" style=3D"box-sizing: =

border-box; border-collapse: collapse; font-style: normal; =

font-variant-ligatures: normal; font-variant-caps: normal; font-weight: =

400; letter-spacing: normal; orphans: 2; text-align: left; text-transform: =

none; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; =

white-space: normal; text-decoration-thickness: initial; =

text-decoration-style: initial; text-decoration-color: initial; color: =

rgb(68, 68, 68); font-family: "segoe ui semilight", "segoe =

ui", verdana, sans-serif; font-size: 18px;">

style=3D"box-sizing: border-box;">

font-size: 0px;">

style=3D"box-sizing: border-box; margin: 0px;">

margin-bottom: 1rem; font-style: normal; font-variant-ligatures: normal; =

font-variant-caps: normal; font-weight: 400; letter-spacing: normal; =

orphans: 2; text-align: left; text-indent: 0px; text-transform: none; =

widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; white-space: =

normal; text-decoration-thickness: initial; text-decoration-style: initial;=

text-decoration-color: initial; color: rgb(26, 26, 26); font-family: =

"YS Text", Arial, sans-serif; font-size: 16px; background-color: =

rgb(255, 255, 255);">

----_NmP-0398e290bfd82612-Part_1--

Top developers and brokers will be at the Canada Intl Property list spam

Posted by Dave Yadallee on Saturday, August 22. 2026

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 20 Aug 2026 19:27:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.5 (FreeBSD))

(envelope-from )

id 1wxE1z-00000000OaU-2Z0K

for dave@doctor.nl2k.ab.ca;

Thu, 20 Aug 2026 19:26:51 -0600

Resent-From: The Doctor

Resent-Date: Thu, 20 Aug 2026 19:26:51 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from o22.p25.mailjet.com ([185.189.236.22]:39911)

by doctor.nl2k.ab.ca with utf8esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256

(Exim 4.99.5 (FreeBSD))

(envelope-from )

id 1wx8Sk-000000006U0-2eGN

for sales@nk.ca;

Thu, 20 Aug 2026 13:30:14 -0600

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; q=dns/txt;

d=canadapropertyshow.ca; i=info@canadapropertyshow.ca; s=mailjet; t=1787254144; x=1787261344;

h=Message-Id: MIME-Version: From: Reply-To: To: Subject: Date:

List-Id: List-Unsubscribe: List-Unsubscribe-Post:

Feedback-Id: Precedence: X-CampaignID: X-CSA-Complaints:

X-MJ-Mid: X-MJ-SMTPGUID: X-REPORT-ABUSE-TO: Content-Type:

To: From: Sender: Subject: Date;

bh=WBlxcT2lpm1AOL3klsBnLEGlFgADy34SZJPzvoOA+9E=;

b=DbusIX8ImEvOnRt8bFxptCopHus5COeMvJh53ARKgD6Z/eafbDXADiLL0

apQbsT6P5wOteflrBrcQR55dWuyG4kknskqPx5uVuR+e1Xr1KkJo603G0PdX

444bF2Rx8V2vkmzJc9j5/sxijzKcl34ew2xsIAghZAPmW8AF/sMjjHUXAx9P

Jgw/UJbTflxF6tfZ1t8Gi3ru+hybkQTwxj8JQCwMgv6bQfgTSwh3EWmwzu0u

GLCghxQp70gs7rsMik6TiD8GIcKPWcCV1QrVINGUSNDspgxefB6hKPIjNr+i

jq+slv9UwP0lwiQS4gvvnI0RnjH3MDb0s7lS0+31hNgsQ==

Message-Id:

MIME-Version: 1.0

From: Canada International Property Show

Reply-To: info@canadapropertyshow.ca

To: sales@nk.ca

Subject: Top developers and brokers will be at the Canada Intl Property

Show. Will you?

Date: Thu, 20 Aug 2026 19:29:04 +0000 (UTC)

List-Id:

List-Unsubscribe:

,

List-Unsubscribe-Post: List-Unsubscribe=One-Click

Feedback-Id: 42.2952425.2720056:MJ

Precedence: bulk

X-CampaignID: 7765198642

X-CSA-Complaints: csa-complaints@eco.de

X-MJ-Mid:

AW4AAKTON0EAAc7XhzIAA-BCcpQAAYKI8DcAoK6BAC0M6QBqh1WA3me8Osx7R_isQbQDL0t2mwApgTg

X-MJ-SMTPGUID: de67bc3a-cc7b-47f8-ac41-b4032f4b769b

X-REPORT-ABUSE-TO: Message sent by Mailjet please report to

abuse@mailjet.com with a copy of the message

Content-Type: multipart/alternative; boundary="=-JNQ9BmupxUUuO7LcWbVt"

X-Spam_score: 47.5

X-Spam_score_int: 475

X-Spam_bar: +++++++++++++++++++++++++++++++++++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.

Content preview: <> [https://canadapropertyshow.ca/]

View online version https://sh4zl.mjt.lu/nl3/rxHvhBUY3I4gD9gGU2GEZw?m=AW4AAKTON0EAAc7XhzIAA-BCcpQAAYKI8DcAoK6BAC0M6QBqh1WA3me8Osx7R_isQbQDL

[...]

Content analysis details: (47.5 points, 5.0 required)

pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[185.189.236.22 listed in will-spam-for-food.eu.org]

[185.189.236.22 listed in will-spam-for-food.eu.org]

[185.189.236.22 listed in will-spam-for-food.eu.org]

[185.189.236.22 listed in will-spam-for-food.eu.org]

[185.189.236.22 listed in will-spam-for-food.eu.org]

[185.189.236.22 listed in will-spam-for-food.eu.org]

[185.189.236.22 listed in will-spam-for-food.eu.org]

[185.189.236.22 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[185.189.236.22 listed in dnsbl.ahbl.org]

[185.189.236.22 listed in dnsbl.ahbl.org]

[185.189.236.22 listed in dnsbl.ahbl.org]

[185.189.236.22 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[185.189.236.22 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[185.189.236.22 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[185.189.236.22 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[185.189.236.22 listed in dnsbl.ahbl.org]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[185.189.236.22 listed in list.dnswl.org]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

0.1 URIBL_SBL_A Contains URL's A record listed in the SBL blocklist

[URI: canadapropertyshow.ca/35.227.194.51]

1.1 URIBL_GREY Contains an URL listed in the URIBL greylist

[URI: mjt.lu]

-0.0 SPF_HELO_PASS SPF: HELO matches SPF record

-0.0 SPF_PASS SPF: sender matches SPF record

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

15 GR_DOMAIN_XECODE1 Spammer tool signature (xecode)

15 GR_DOMAIN_MAILJE3 Message-ID contains spammer id (mailje)

15 GR_DOMAIN_MAILJE1 Received contains spammer id (mailje)

-1.0 RCVD_IN_MSPIKE_H5 RBL: Excellent reputation (+5)

[185.189.236.22 listed in wl.mailspike.net]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[185.189.236.22 listed in bl.score.senderscore.com]

-0.0 T_RP_MATCHES_RCVD Envelope sender domain matches handover relay

domain

0.0 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level mail

domains are different

0.3 LONGWORD BODY: Uses overlong words

0.8 HTML_IMAGE_RATIO_02 BODY: HTML has a low ratio of text to image area

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

-1.0 MAILING_LIST_MULTI Multiple indicators imply a widely-seen list

manager

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

-0.0 RCVD_IN_MSPIKE_WL Mailspike good senders

0.8 SARE_FROM_SPAM_WORD3 I don't know people named this!

Subject: {SPAM?} Top developers and brokers will be at the Canada Intl Property

Show. Will you?

--=-JNQ9BmupxUUuO7LcWbVt

Content-Type: text/plain; charset=utf-8

Content-Transfer-Encoding: quoted-printable

<> [https://canadapropertyshow.ca/]

View online version https://sh4zl.mjt.lu/nl3/rxHvhBUY3I4gD9gGU2GEZw?m=3DAW4=

AAKTON0EAAc7XhzIAA-BCcpQAAYKI8DcAoK6BAC0M6QBqh1WA3me8Osx7R_isQbQDL0t2mwApgT=

g&b=3De9532e8d&e=3D83f7d3f6&x=3DBCwpwHREIv6H13pFkkwx5w

If you don't like our emails, you can=C2=A0

update your preferences https://sh4zl.mjt.lu/unsub2?m=3DAW4AAKTON0EAAc7XhzI=

AA-BCcpQAAYKI8DcAoK6BAC0M6QBqh1WA3me8Osx7R_isQbQDL0t2mwApgTg&b=3De9532e8d&e=

=3D83f7d3f6&x=3DBCwpwHREIv6H13pFkkwx5w&hl=3Den_us]or https://sh4zl.mjt.lu/u=

nsub2?m=3DAUYAAHPnElQAAc6lPsQAA9FtWcgAAYKI_iYAoEvTAC0M6QBocCUcmJ9mT1W7QtmiO=

bGBnsWaDQApgTg&b=3Dacc166ac&e=3De9ed69b4&x=3DJXV5YF4Lsy_PYywz1IAQXRtzDekYgN=

I6e86cGq3ZbC4&hl=3Denunsubscribe [https://sh4zl.mjt.lu/unsub2?m=3DAW4AAKTON=

0EAAc7XhzIAA-BCcpQAAYKI8DcAoK6BAC0M6QBqh1WA3me8Osx7R_isQbQDL0t2mwApgTg&b=3D=

e9532e8d&e=3D83f7d3f6&x=3DBCwpwHREIv6H13pFkkwx5w&hl=3Den_usat any time.=

--=-JNQ9BmupxUUuO7LcWbVt

Content-Type: text/html; charset=utf-8

Content-Transfer-Encoding: quoted-printable

9/xhtml" xmlns:v=3D"urn:schemas-microsoft-com:vml" xmlns:o=3D"urn:schemas-m=

icrosoft-com:office:office">Top developers and brokers will be=<br /><br /> at the Canada Intl Property Show. Will you?
a http-equiv=3D"X-UA-Compatible" content=3D"IE=3Dedge">
a http-equiv=3D"Content-Type" content=3D"text/html; charset=3DUTF-8">
name=3D"viewport" content=3D"width=3Ddevice-width,initial-scale=3D1">
type=3D"text/css">#outlook a { padding:0; }

body { margin:0;padding:0;-webkit-text-size-adjust:100%;-ms-text-size=

-adjust:100%; }

table, td { border-collapse:collapse;mso-table-lspace:0pt;mso-table-r=

space:0pt; }

img { border:0;height:auto;line-height:100%; outline:none;text-decora=

tion:none;-ms-interpolation-mode:bicubic; }

p { display:block;margin:13px 0; }
le type=3D"text/css">[owa] .mj-column-per-100 { width:100% !important; max-=

width: 100%; }
acing:normal;background-color:#F4F4F4;">

"main" lang=3D"en" dir=3D"ltr">

gin:0px auto;max-width:600px;">
ding=3D"0" cellspacing=3D"0" role=3D"presentation" style=3D"width:100%;">
body>
tr>

adding-left:0px;padding-right:0px;text-align:center;"><=

div class=3D"mj-column-per-100 mj-outlook-group-fix" style=3D"font-size:0px=

;text-align:left;direction:ltr;display:inline-block;vertical-align:top;widt=

h:100%;">
esentation" style=3D"vertical-align:top;" width=3D"100%">
tbody>

gn=3D"center" style=3D"font-size:0px;padding:0px 0px 0px 0px;word-break:bre=

ak-word;">
resentation" style=3D"border-collapse:collapse;border-spacing:0px;">=

N0EAAc7XhzIAA-BCcpQAAYKI8DcAoK6BAC0M6QBqh1WA3me8Osx7R_isQbQDL0t2mwApgTg/1/1=

UsmcBnzQyJLpRKlgzAvZw/aHR0cHM6Ly9jYW5hZGFwcm9wZXJ0eXNob3cuY2Ev" target=3D"_=

blank"> 3D"Property

2/sh4zl/c611a6fa-f7b8-41ad-8821-bc6addef4065/content" style=3D"border:none;=

display:block;outline:none;text-decoration:none;height:auto;width:100%;font=

-size:13px;" width=3D"600" height=3D"auto">

td>

px;padding-top:0px;padding-bottom:0px;word-break:break-word;">

"font-family:Verdana, Helvetica, Arial, sans-serif;font-size:13px;line-heig=

ht:1;text-align:left;color:#000000;">

=3D"line-height: 12px; text-align: center; margin: 10px 0; margin-top: 10px=

; margin-bottom: 10px;">
rit;text-decoration:none;; text-decoration: none;" target=3D"_blank" href=

=3D"https://sh4zl.mjt.lu/nl3/rxHvhBUY3I4gD9gGU2GEZw?m=3DAW4AAKTON0EAAc7XhzI=

AA-BCcpQAAYKI8DcAoK6BAC0M6QBqh1WA3me8Osx7R_isQbQDL0t2mwApgTg&b=3De9532e=

8d&e=3D83f7d3f6&x=3DBCwpwHREIv6H13pFkkwx5w">
000EE;font-family:Arial;font-size:12px">View online version

<=

/div>

x 0px 0px;padding-top:0px;padding-bottom:0px;word-break:break-word;">

tyle=3D"font-family:Verdana, Helvetica, Arial, sans-serif;font-size:13px;li=

ne-height:1;text-align:left;color:#000000;">

style=3D"line-height: 14px; text-align: center; margin: 10px 0; margin-top=

: 10px;">If =

you don't like our emails, you can

ontent" style=3D"line-height: 14px; text-align: center; margin: 10px 0; mar=

gin-bottom: 10px;">
:12px">update your
herit;text-decoration:none;; text-decoration: none;" target=3D"_blank" href=

=3D"https://sh4zl.mjt.lu/unsub2?m=3DAW4AAKTON0EAAc7XhzIAA-BCcpQAAYKI8DcAoK6=

BAC0M6QBqh1WA3me8Osx7R_isQbQDL0t2mwApgTg&b=3De9532e8d&e=3D83f7d3f6&=

amp;x=3DBCwpwHREIv6H13pFkkwx5w&hl=3Den_us">
;font-family:Arial;font-size:12px">preferences
55575d;font-family:Arial;font-size:12px">
55575d;font-family:Arial;font-size:12px">or
ntent" style=3D"color:inherit;text-decoration:none;; text-decoration: none;=

" target=3D"_blank" href=3D"https://sh4zl.mjt.lu/unsub2?m=3DAUYAAHPnElQAAc6=

lPsQAA9FtWcgAAYKI_iYAoEvTAC0M6QBocCUcmJ9mT1W7QtmiObGBnsWaDQApgTg&b=3Dac=

c166ac&e=3De9ed69b4&x=3DJXV5YF4Lsy_PYywz1IAQXRtzDekYgNI6e86cGq3ZbC4=

&hl=3Den">
">
ecoration:none;; text-decoration: none;" target=3D"_blank" href=3D"https://=

sh4zl.mjt.lu/unsub2?m=3DAW4AAKTON0EAAc7XhzIAA-BCcpQAAYKI8DcAoK6BAC0M6QBqh1W=

A3me8Osx7R_isQbQDL0t2mwApgTg&b=3De9532e8d&e=3D83f7d3f6&x=3DBCwp=

wHREIv6H13pFkkwx5w&hl=3Den_us">
:Arial;font-size:12px">unsubscribe
font-family:Arial;font-size:12px">at any time.

div>

.mjt.lu/lnk/AW4AAKTON0EAAc7XhzIAA-BCcpQAAYKI8DcAoK6BAC0M6QBqh1WA3me8Osx7R_i=

sQbQDL0t2mwApgTg/0/G5-BfNuoJE1ovaMUY3otSg/aHR0cHM6Ly9jYW5hZGFwcm9wZXJ0eXNob=

3cuY2Ev?b=3D1">
e-block;" href=3D"https://sh4zl.mjt.lu/lnk/AW4AAKTON0EAAc7XhzIAA-BCcpQAAYKI=

8DcAoK6BAC0M6QBqh1WA3me8Osx7R_isQbQDL0t2mwApgTg/0/G5-BfNuoJE1ovaMUY3otSg/aH=

R0cHM6Ly9jYW5hZGFwcm9wZXJ0eXNob3cuY2Ev?b=3D3">

BAC0M6QBqh1WA3me8Osx7R_isQbQDL0t2mwApgTg/eb9a0558/e.gif" height=3D"1" width=

=3D"1" alt=3D"" border=3D"0" style=3D"height:1px;width:1px;border:0;"/>

=

--=-JNQ9BmupxUUuO7LcWbVt--

Chinese products spam

Posted by Dave Yadallee on Saturday, August 22. 2026

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 20 Aug 2026 13:20:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.5 (FreeBSD))

(envelope-from )

id 1wx8IS-00000000AKx-0Onc

for dave@doctor.nl2k.ab.ca;

Thu, 20 Aug 2026 13:19:28 -0600

Resent-From: The Doctor

Resent-Date: Thu, 20 Aug 2026 13:19:27 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from [103.209.128.192] (port=34812 helo=mail-m128192.netease.com)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.99.5 (FreeBSD))

(envelope-from )

id 1wx77l-00000000NVN-3kwl

for sales@nk.ca;

Thu, 20 Aug 2026 12:04:34 -0600

Content-Type: multipart/alternative; BOUNDARY="=_Part_85882_219339396.1787249000662"

To: sales

Subject: =?UTF-8?B?UmU6UmU6UmU6IFN0aWxsIGxvb2tpbmcgZm9yIGEgcmVsaWFibGUgZnJlaWdodCBwYXJ0bmVyIGluIENoaW5hPyA=?=

X-Priority: 3

MIME-Version: 1.0

Received: from sales03_szx@bnclogistics.com( [10.139.5.212] ) by ajax-webmail ( [127.0.0.1] ) ; Fri, 21 Aug 2026 02:03:20 +0800 (GMT+08:00)

From: Sunny

Date: Fri, 21 Aug 2026 02:03:20 +0800 (GMT+08:00)

X-WM-Tid: 0aa0205780850a84kunm3825510b1afc1

Message-ID:

X-Spam_score: 8.5

X-Spam_score_int: 85

X-Spam_bar: ++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.

Content preview: Hi sales, I hope everything is going well for you. Your interest

in our updates means a lot to us. We look forward to keeping you informed

with our latest news and offers. We are interested in learning more about

your purchasing needs and the types of products you are seeking. Please let

us know, and we can provide you with our comprehensive product catalog..

Your swift [...]

Content analysis details: (8.5 points, 5.0 required)

pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[103.209.128.192 listed in will-spam-for-food.eu.org]

[103.209.128.192 listed in will-spam-for-food.eu.org]

[103.209.128.192 listed in will-spam-for-food.eu.org]

[103.209.128.192 listed in will-spam-for-food.eu.org]

[103.209.128.192 listed in will-spam-for-food.eu.org]

[103.209.128.192 listed in will-spam-for-food.eu.org]

[103.209.128.192 listed in will-spam-for-food.eu.org]

[103.209.128.192 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[103.209.128.192 listed in dnsbl.ahbl.org]

[103.209.128.192 listed in dnsbl.ahbl.org]

[103.209.128.192 listed in dnsbl.ahbl.org]

[103.209.128.192 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[103.209.128.192 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[103.209.128.192 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[103.209.128.192 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[103.209.128.192 listed in dnsbl.ahbl.org]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[103.209.128.192 listed in bl.score.senderscore.com]

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

2.0 PDS_OTHER_BAD_TLD Untrustworthy TLDs

[URI: hkdd5498.hk.yjz.top (top)]

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

1.3 RDNS_NONE Delivered to internal network by a host with no rDNS

1.0 HTML_TEXT_INVISIBLE_STYLE HTML hidden text + other spam signs

0.8 SARE_FROM_SPAM_WORD3 I don't know people named this!

2.0 MIXED_HREF_CASE Has href in mixed case

Subject: {SPAM?} =?UTF-8?B?UmU6UmU6UmU6IFN0aWxsIGxvb2tpbmcgZm9yIGEgcmVsaWFibGUgZnJlaWdodCBwYXJ0bmVyIGluIENoaW5hPyA=?=

Hi sales,

I hope everything is going well for you.

Your interest in our updates means a lot to us. We look forward to keeping you informed with our latest news and offers.

We are interested in learning more about your purchasing needs and the types of products you are seeking. Please let us know, and we can provide you with our comprehensive product catalog..

Your swift feedback will ensure we meet your needs effectively.

Thank you for taking the time to review this. I look forward to your prompt reply.

Best regards,

Unlock continuous updates and new feature announcements at . Enable Alerts

Prefer an empty inbox? Adjust settings at Email Preferences.

在2026-08-18，Sunny 写道:

-----原始邮件-----

发件人： Sunny

发件时间: 2026年08月18日周二

收件人： [sales ]

主题： Re:Re: Still looking for a reliable freight partner in China?

Hi sales,

I hope this email finds you well.

Thank you for subscribing to our newsletter. We're thrilled to have you on board!

I am excited to inform you that we are currently offering a special promotion on our products.If you have any needs, please let me know as soon as possible so I can secure a discounted spot for you.

Thank you for your attention, and I look forward to hearing from you soon.

Best regards,

Do not miss a product highlight: hit . Stay Engaged

Whenever you’d like fewer emails, use Edit Email Choices.

Shopify phish from Sendgrid

Posted by Dave Yadallee on Saturday, August 22. 2026

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 20 Aug 2026 13:20:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.5 (FreeBSD))

(envelope-from )

id 1wx8IH-00000000AJH-2w2a

for dave@doctor.nl2k.ab.ca;

Thu, 20 Aug 2026 13:19:17 -0600

Resent-From: The Doctor

Resent-Date: Thu, 20 Aug 2026 13:19:17 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from o37.mailer.shopify.com ([149.72.116.219]:64544)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.99.5 (FreeBSD))

(envelope-from )

id 1wx6cg-00000000IRy-28kq

for doctor@doctor.nl2k.ab.ca;

Thu, 20 Aug 2026 11:32:21 -0600

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=g.shopifyemail.com;

h=content-transfer-encoding:content-type:date:from:mime-version:subject:

reply-to:list-unsubscribe:list-unsubscribe-post:to:cc:content-type:date:from:

subject:to;

s=s1; t=1787247080;

bh=zzw63LeEXWsiLpFnlpWW7P1TNZCr6dlltE2dWvghjG4=;

b=ieoM+ihU36bCA6ThqgsCeQeyU1/wbc0U4ju1BbquQXbIEdY4a78/zfGAX25wxooBjY+2

Phl80Q9Pz9jd+/zmatBVwmgI2Y3LC3XpvehYtfV5qGpJetkwbSUgqOPyQmKUP4ww8kIVBE

JvBnS1bLjCvs2Gnbj68G46UcHKXfQVU/4JzaF3q4vo3AyNgQGNsjUIo0w86b5swdqdhsRD

YiEEmSEvunDJK4ZXVf6AzErkb58zYwnXG+qt1IeusrxJ01MZays3sApicfiWK4MgSjlQU4

dh2ttpem1KpqZBiDFwGmQs2Qp1jejvcwsbwlqEVaKOP/2xEOQK/92TYLxLMBgfxg==

Received: by recvd-68db557557-vcmhc with SMTP id recvd-68db557557-vcmhc-1-6A8739E8-A5

2026-08-20 17:31:20.605752998 +0000 UTC m=+1982312.972510147

Received: from NDk0NzczNjY (unknown)

by geopod-ismtpd-58 (SG) with HTTP

id F42oSiElR3KbnVGL8WejZg

Thu, 20 Aug 2026 17:31:20.583 +0000 (UTC)

Content-Transfer-Encoding: quoted-printable

Content-Type: text/html; charset=utf-8

Date: Thu, 20 Aug 2026 17:31:20 +0000 (UTC)

From: "service@paypal.com"

Mime-Version: 1.0

Message-ID:

Subject: Complete your order

Reply-To: "service@paypal.com"

Feedback-Id: s_106707910990:shopify

List-Unsubscribe:

List-Unsubscribe-Post: List-Unsubscribe=One-Click

Precedence: bulk

X-SG-EID:

=?us-ascii?Q?u001=2EGmVxpVuDfKJTxhIgjQJ1VAFdi8E8qyZo16R2EVFrC+PdwJYJqPo8Gup3j?=

=?us-ascii?Q?LNmBBfew81GaeXCEqOWG3map51OjGV6xhaV0RJq?=

=?us-ascii?Q?Q8dNjfF6CfZqdolIhCEegnwaFJIjEx1VDIj9h2I?=

=?us-ascii?Q?xj9pgo10D9cjrytJ1VFQCmtBvVXfKRWdC6AFsLT?=

=?us-ascii?Q?xfQDhZ2woftyiSUKXik9t46Dnd5jBawNnvSGMR9?=

=?us-ascii?Q?bZB4kNnzVRGKOZ75BCCO3QV6Y7h8hhpc+K8bMLT?=

=?us-ascii?Q?b9fR7mr5c9UWYlP=2F5UV8DDvDSg=3D=3D?=

X-SG-ID:

=?us-ascii?Q?u001=2ESdBcvi+Evd=2FbQef8eZF3BpTL9BgbK5wfSJMJGMsmprDITwp3LLcgXu9gv?=

=?us-ascii?Q?F1Oq5oTf1VY9MM=2F=2FZCviT=2FP37sq3379EqymfwVT?=

=?us-ascii?Q?WCZnBG9CINW4nFULeDp5vAqPqKDHP8eUFMZJtNN?=

=?us-ascii?Q?cBdvuZTWBIDM=2FpyWQFsdvRurFycpfuRbVM1CH7V?=

=?us-ascii?Q?B9UeVbTFEbWimGwhj5PCRUuqFWUKFHuQiQs71T5?=

=?us-ascii?Q?2yegj2+d924QGFeO+hLPjgZP9qHAYGjTJTsrNu9?=

=?us-ascii?Q?grPS5HQM8sf2GVc7kpTvnlLDFqBva=2F4EuRkgVBG?=

=?us-ascii?Q?DmyyehXg7oUHO1bXya1BrPcEw1ombQQCzyr6=2F9Z?=

=?us-ascii?Q?5vlW6=2FjbglHD+uHBxZIYV67ijUC9f03hmIoQivf?=

=?us-ascii?Q?H+4RXT4QugUV88+MeeKUwiTvjFGa2Kc7ON389eW?=

=?us-ascii?Q?9r=2Fi17CqEIDC212NQEq09oQdaEJOz7c8k++szmj?=

=?us-ascii?Q?2Ipx+Zwf20qK+1g2CW=2F2x+6hAQjMRAUvvD7mKFW?=

=?us-ascii?Q?iWZOs9wMCgWWYA0v+leUZ3CwlGkQ+At8lPZEg9V?=

=?us-ascii?Q?QzC2zrPmhEU4jKqlCJnrOUa9OsSWj1=2FwU79Yxfp?=

=?us-ascii?Q?JAVnLI36qwASw6mKmWDk4dQhA5PY1QrdHPgljsb?=

=?us-ascii?Q?XYa=2FCrWXYk91WJsZuTrVuJ9=2F41bj+DJspE6kh=2Fa?=

=?us-ascii?Q?Vcl4OkzMIUwdHC0aLC+EpAZSuJENFbcQuCn0Ncd?=

=?us-ascii?Q?mFsjJlnZwubbfws8aUQWGgDYj07AkqWaXd6GUsN?=

=?us-ascii?Q?lyj=2Fen7OnXKTtUw949GRVHDObLz1J2FN4lX=2F+Do?=

=?us-ascii?Q?2+Qah6uw45y5tmBZaScJbmb+=2Fhyo+56ALzgnSiD?=

=?us-ascii?Q?4B+7lXWqnXYpu3HZ4DnybeNifLJc1EC+ldW6I3d?=

=?us-ascii?Q?cAIAh9S9rtRHPbJcQEmxohT=2FqpsNdfmYWlbNDDM?=

=?us-ascii?Q?ot69bFrpyoZXj6JbNva6wWVvw8rv0RvC3KEke5E?=

=?us-ascii?Q?hksZkKnzi9K2T3lkamrJp51UZeNXX0hMHaDlTmI?=

=?us-ascii?Q?7QolpBDQvRsRNoBpFiuo+yBEoAlLKN7+sBacNQq?=

=?us-ascii?Q?zOg3YeK4qosu3mugNcVnzcf2COeLPFhzKIJWnNP?=

=?us-ascii?Q?FXxR=2FxQHmsG9CanXh8d3Ga6kD0b8+Y4IAm7upU7?=

=?us-ascii?Q?UnxT53jn55JRTszu3icOer2GdI2dJlGbJXZK6tG?=

=?us-ascii?Q?B02RKtf7XJpP=2FQp0LG9ZD+A4zB0D2hcBo+JLsVf?=

=?us-ascii?Q?P1msA3SNKHklnuK1O1qIhLABA=2FeRdVTpg0U4mKo?=

=?us-ascii?Q?jz=2F5uxBCmcRhNLJm+XBgZoYdik7LGx4MSoFO9Yo?=

=?us-ascii?Q?=2FNZeuste0uigmw09Pq=2FES1HdmrX38ersKx5j5Gw?=

=?us-ascii?Q?4s4WO1qk6Vzbz52esD8jvna4U9hgNFQKVrzJOnK?=

=?us-ascii?Q?ljFLEaM=2FI7oq17sHXSW7EnC3cKOaj2HmKWAufIu?=

=?us-ascii?Q?y8gEfG1wxwvg7G=2Fi3f3T4TCUiF9FaSsO+u6JpY2?=

=?us-ascii?Q?orU9xvyazGTXpoP2Hm1SyiaxdvCH51E5y0xr3ft?=

=?us-ascii?Q?eD0gi6p131FLVn0txRIYtfRiJ3mNd2rr8Wg7HFF?=

=?us-ascii?Q?9Xpa+js09y1xyjzaFnaoZogFm=2FTdoSi3RzJjK+p?=

=?us-ascii?Q?cbrmm63yBLFYx8XX2IlgFhv03h6QF6C48vBu9hl?=

=?us-ascii?Q?BC52wjvIc+d6C3q+62+v7WKqe2GSf0GUTVuKolw?=

=?us-ascii?Q?WDUg6vClsmrOuyUc73sCwFdHa=2FNpV9l8lJF2LrG?=

=?us-ascii?Q?Y58xDJkNe9qIdrWGKBRbNpYBLz3Aoju4Nr1lV5a?=

=?us-ascii?Q?be09Bw+shsqBeSMpNkmfsZu1JrOT8w=3D=3D?=

To: doctor@doctor.nl2k.ab.ca

X-Entity-ID: u001.k39LvibKjYznfclAFDcpvQ==

X-Spam_score: 7.0

X-Spam_score_int: 70

X-Spam_bar: +++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.

Content preview: Just checking in НЏ НЏ НЏ НЏ НЏ НЏ НЏ НЏ НЏ НЏ НЏ НЏ НЏ НЏ

НЏ НЏ НЏ НЏ НЏ НЏ НЏ НЏ НЏ НЏ НЏ НЏ НЏ НЏ НЏ НЏ НЏ НЏ НЏ НЏ НЏ НЏ НЏ НЏ НЏ

НЏ НЏ НЏ НЏ НЏ НЏ НЏ НЏ НЏ НЏ НЏ НЏ НЏ НЏ НЏ НЏ НЏ НЏ НЏ НЏ НЏ НЏ НЏ НЏ НЏ

НЏ НЏ Н [...]

Content analysis details: (7.0 points, 5.0 required)

pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[149.72.116.219 listed in will-spam-for-food.eu.org]

[149.72.116.219 listed in will-spam-for-food.eu.org]

[149.72.116.219 listed in will-spam-for-food.eu.org]

[149.72.116.219 listed in will-spam-for-food.eu.org]

[149.72.116.219 listed in will-spam-for-food.eu.org]

[149.72.116.219 listed in will-spam-for-food.eu.org]

[149.72.116.219 listed in will-spam-for-food.eu.org]

[149.72.116.219 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[149.72.116.219 listed in dnsbl.ahbl.org]

[149.72.116.219 listed in dnsbl.ahbl.org]

[149.72.116.219 listed in dnsbl.ahbl.org]

[149.72.116.219 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[149.72.116.219 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[149.72.116.219 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[149.72.116.219 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[149.72.116.219 listed in dnsbl.ahbl.org]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-0.0 SPF_PASS SPF: sender matches SPF record

0.0 FROM_LOCAL_DIGITS From: localpart has long digit sequence

0.3 FROM_LOCAL_HEX From: localpart has long hexadecimal sequence

0.5 L_HELLO_ADDRESS BODY: Greets you by address, not by name

1.5 DEAR_EMAIL BODY: Message contains Dear email address

-0.0 RCVD_IN_MSPIKE_H3 RBL: Good reputation (+3)

[149.72.116.219 listed in wl.mailspike.net]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[149.72.116.219 listed in bl.score.senderscore.com]

1.3 URI_HEX URI: URI hostname has long hexadecimal sequence

0.0 HTML_MESSAGE BODY: HTML included in message

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

-0.0 RCVD_IN_MSPIKE_WL Mailspike good senders

1.0 POSSIBLE_PAYPAL_PHISH_02 Claims to be from paypal but not processed

by any paypal MTA

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

Subject: {SPAM?} Complete your order

nt; font-family: 'Helvetica Neue', Helvetica, system-ui, -apple-sys=

tem, Arial, sans-serif; font-weight: 400; font-style: normal; line-height: =

1.5; font-size: 16px; overflow-wrap: break-word; word-wrap: break-word; wor=

d-spacing: normal; -ms-text-size-adjust: 100%; -webkit-text-size-adjust: 10=

0%; margin: 0 auto; padding: 0;">

0"/>

ss=3Dno, email=3Dno, url=3Dno"/>

message-reformatting"/>

rtant; width: 100% !important; font-family: 'Helvetica Neue', Helve=

tica, system-ui, -apple-system, Arial, sans-serif; font-weight: 400; font-s=

tyle: normal; line-height: 1.5; font-size: 16px; overflow-wrap: break-word;=

word-wrap: break-word; word-spacing: normal; -ms-text-size-adjust: 100%; -=

webkit-text-size-adjust: 100%; margin: 0 auto; padding: 0;" class=3D"full-w=

rap">

0px; max-width: 0px; opacity: 0; overflow: hidden; mso-hide: all; font-fami=

ly: sans-serif; -ms-text-size-adjust: 100%; -webkit-text-size-adjust: 100%;=

">Just checking in

ze-adjust: 100%; -webkit-text-size-adjust: 100%;">=E2=80=87=CD=8F=E2=80=87=

=CD=8F=E2=80=87=CD=8F=E2=80=87=CD=8F=E2=80=87=CD=8F=E2=80=87=CD=8F=E2=80=87=

=CD=8F=E2=80=87=CD=8F=E2=80=87=CD=8F=E2=80=87=CD=8F=E2=80=87=CD=8F=E2=80=87=

=CD=8F=E2=80=87=CD=8F=E2=80=87=CD=8F=E2=80=87=CD=8F=E2=80=87=CD=8F=E2=80=87=

=CD=8F=E2=80=87=CD=8F=E2=80=87=CD=8F=E2=80=87=CD=8F=E2=80=87=CD=8F=E2=80=87=

=CD=8F=E2=80=87=CD=8F=E2=80=87=CD=8F=E2=80=87=CD=8F=E2=80=87=CD=8F=E2=80=87=

=CD=8F=E2=80=87=CD=8F=E2=80=87=CD=8F=E2=80=87=CD=8F=E2=80=87=CD=8F=E2=80=87=

=CD=8F=E2=80=87=CD=8F=E2=80=87=CD=8F=E2=80=87=CD=8F=E2=80=87=CD=8F=E2=80=87=

=CD=8F=E2=80=87=CD=8F=E2=80=87=CD=8F=E2=80=87=CD=8F=E2=80=87=CD=8F=E2=80=87=

=CD=8F=E2=80=87=CD=8F=E2=80=87=CD=8F=E2=80=87=CD=8F=E2=80=87=CD=8F=E2=80=87=

=CD=8F=E2=80=87=CD=8F=E2=80=87=CD=8F=E2=80=87=CD=8F=E2=80=87=CD=8F=E2=80=87=

=CD=8F=E2=80=87=CD=8F=E2=80=87=CD=8F=E2=80=87=CD=8F=E2=80=87=CD=8F=E2=80=87=

=CD=8F=E2=80=87=CD=8F=E2=80=87=CD=8F=E2=80=87=CD=8F=E2=80=87=CD=8F=E2=80=87=

=CD=8F=E2=80=87=CD=8F=E2=80=87=CD=8F=E2=80=87=CD=8F=E2=80=87=CD=8F=E2=80=87=

=CD=8F=E2=80=87=CD=8F=E2=80=87=CD=8F=E2=80=87=CD=8F=E2=80=87=CD=8F=E2=80=87=

=CD=8F=E2=80=87=CD=8F=E2=80=87=CD=8F=E2=80=87=CD=8F=E2=80=87=CD=8F=E2=80=87=

=CD=8F=E2=80=87=CD=8F=E2=80=87=CD=8F=E2=80=87=CD=8F=E2=80=87=CD=8F=E2=80=87=

=CD=8F=E2=80=87=CD=8F=E2=80=87=CD=8F=E2=80=87=CD=8F=E2=80=87=CD=8F=E2=80=87=

=CD=8F=E2=80=87=CD=8F=E2=80=87=CD=8F=E2=80=87=CD=8F=E2=80=87=CD=8F=E2=80=87=

=CD=8F=E2=80=87=CD=8F=E2=80=87=CD=8F=E2=80=87=CD=8F=E2=80=87=CD=8F=E2=80=87=

=CD=8F=E2=80=87=CD=8F=E2=80=87=CD=8F=E2=80=87=CD=8F=E2=80=87=CD=8F=E2=80=87=

=CD=8F=E2=80=87=CD=8F=E2=80=87=CD=8F=E2=80=87=CD=8F=E2=80=87=CD=8F=E2=80=87=

=CD=8F=E2=80=87=CD=8F=E2=80=87=CD=8F=E2=80=87=CD=8F=E2=80=87=CD=8F=E2=80=87=

=CD=8F=E2=80=87=CD=8F=E2=80=87=CD=8F=E2=80=87=CD=8F=E2=80=87=CD=8F=E2=80=87=

=CD=8F=E2=80=87=CD=8F=E2=80=87=CD=8F=E2=80=87=CD=8F=E2=80=87=CD=8F=E2=80=87=

=CD=8F=E2=80=87=CD=8F=E2=80=87=CD=8F=E2=80=87=CD=8F=E2=80=87=CD=8F=E2=80=87=

=CD=8F=E2=80=87=CD=8F=E2=80=87=CD=8F=E2=80=87=CD=8F=E2=80=87=CD=8F=E2=80=87=

=CD=8F=E2=80=87=CD=8F=E2=80=87=CD=8F=E2=80=87=CD=8F=E2=80=87=CD=8F=E2=80=87=

=CD=8F=E2=80=87=CD=8F=E2=80=87=CD=8F=E2=80=87=CD=8F=E2=80=87=CD=8F=E2=80=87=

=CD=8F=E2=80=87=CD=8F=E2=80=87=CD=8F=E2=80=87=CD=8F=E2=80=87=CD=8F=E2=80=87=

=CD=8F=E2=80=87=CD=8F=E2=80=87=CD=8F=E2=80=87=CD=8F=E2=80=87=CD=8F=E2=80=87=

=CD=8F=E2=80=87=CD=8F=E2=80=87=CD=8F=E2=80=87=CD=8F=E2=80=87=CD=8F=E2=80=87=

=CD=8F=E2=80=87=CD=8F=E2=80=87=CD=8F=E2=80=87=CD=8F=E2=80=87=CD=8F=E2=80=87=

=CD=8F=E2=80=87=CD=8F=E2=80=87=CD=8F=E2=80=87=CD=8F=C2=AD=C2=AD=C2=AD=C2=AD=

=C2=AD=C2=AD=C2=AD=C2=AD=C2=AD=C2=AD=C2=AD=C2=AD=C2=AD=C2=AD=C2=AD=C2=AD=C2=

=AD=C2=AD=C2=AD=C2=AD=C2=AD=C2=AD=C2=AD=C2=AD=C2=AD=C2=AD=C2=AD=C2=AD=C2=AD=

=C2=AD=C2=AD=C2=AD=C2=AD=C2=AD=C2=AD=C2=AD=C2=AD=C2=AD=C2=AD=C2=AD=C2=AD=C2=

=AD=C2=AD=C2=AD=C2=AD=C2=AD=C2=AD=C2=AD=C2=AD=C2=AD=C2=AD=C2=AD=C2=AD=C2=AD=

=C2=AD=C2=AD=C2=AD=C2=AD=C2=AD=C2=AD=C2=AD=C2=AD=C2=AD=C2=AD=C2=AD=C2=AD=C2=

=AD=C2=AD=C2=AD=C2=AD=C2=AD=C2=AD=C2=AD=C2=AD=C2=AD=C2=AD=C2=AD=C2=AD=C2=AD=

=C2=AD=C2=AD=C2=AD=C2=AD=C2=AD=C2=AD=C2=AD=C2=AD=C2=AD=C2=AD=C2=AD=C2=AD=C2=

=AD=C2=AD=C2=AD=C2=AD=C2=AD=C2=AD=C2=AD=C2=AD=C2=AD=C2=AD=C2=AD=C2=AD=C2=AD=

=C2=AD=C2=AD=C2=AD=C2=AD=C2=AD=C2=AD=C2=AD=C2=AD=C2=AD=C2=AD=C2=AD=C2=AD=C2=

=AD=C2=AD=C2=AD=C2=AD=C2=AD=C2=AD=C2=AD=C2=AD=C2=AD=C2=AD=C2=AD=C2=AD=C2=AD=

=C2=AD=C2=AD=C2=AD=C2=AD=C2=AD=C2=AD=C2=AD=C2=AD=C2=AD=C2=AD=C2=AD=C2=AD=C2=

=AD=C2=AD=C2=AD=C2=AD=C2=AD=C2=AD=C2=AD=C2=AD=C2=AD=C2=AD=C2=AD=C2=AD=C2=AD=

=C2=AD=C2=AD=C2=AD=C2=AD=C2=AD=C2=AD=C2=AD=C2=AD=C2=AD=C2=AD=C2=AD=C2=A0
iv>

dth=3D"100%" style=3D"background-color: #fafafa; -ms-text-size-adjust: 100%=

; -webkit-text-size-adjust: 100%; mso-table-lspace: 0pt !important; mso-tab=

le-rspace: 0pt !important; border-spacing: 0 !important; border-collapse: c=

ollapse !important; table-layout: fixed !important; margin: auto;" class=3D=

"full-wrap">
djust: 100%;">

<=

td style=3D"-ms-text-size-adjust: 100%; -webkit-text-size-adjust: 100%; mso=

-table-lspace: 0pt !important; mso-table-rspace: 0pt !important; vertical-a=

lign: top;">

dth=3D"600" style=3D"background-color: #ffffff; -ms-text-size-adjust: 100%;=

-webkit-text-size-adjust: 100%; mso-table-lspace: 0pt !important; mso-tabl=

e-rspace: 0pt !important; border-spacing: 0 !important; border-collapse: co=

llapse !important; table-layout: fixed !important; margin: auto;" class=3D"=

email-container">
ize-adjust: 100%;">
ze-adjust: 100%;">

e-adjust: 100%; mso-table-lspace: 0pt !important; mso-table-rspace: 0pt !im=

portant; vertical-align: top;">
order=3D"0" align=3D"center" width=3D"600" style=3D"background-color: #ffff=

ff; -ms-text-size-adjust: 100%; -webkit-text-size-adjust: 100%; mso-table-l=

space: 0pt !important; mso-table-rspace: 0pt !important; border-spacing: 0 =

!important; border-collapse: collapse !important; table-layout: fixed !impo=

rtant; margin: auto;" class=3D"email-container">
ze-adjust: 100%; -webkit-text-size-adjust: 100%;">
e-adjust: 100%; -webkit-text-size-adjust: 100%;">

0; font-family: 'Helvetica Neue', Helvetica, Arial, sans-serif; fon=

t-weight: 400; font-style: normal; -ms-text-size-adjust: 100%; -webkit-text=

-size-adjust: 100%; mso-table-lspace: 0pt !important; mso-table-rspace: 0pt=

!important; vertical-align: top; padding: 30px 60px;" align=3D"left" class=

=3D"column-container-left column-container-right">

-adjust: 100%; -webkit-text-size-adjust: 100%; line-height: 1.5; margin: 0;=

padding: 0;">Dear Customer, doctor@doctor.nl2k.ab.ca

size-adjust: 100%; -webkit-text-size-adjust: 100%;"/>

size-adjust: 100%; -webkit-text-size-adjust: 100%;"/>Our fraud prevention s=

ystem recently logged a $699.99 purchase attempt at shopify Store location =

in Massachusetts (MA).

-size-adjust: 100%;"/>

-size-adjust: 100%;"/>Your transaction of 699.99 USD to SHOPIFY 448085139 =

on 2026-08-20

ust: 100%;"/>

ust: 100%;"/>If this purchase was made by you:

just: 100%; -webkit-text-size-adjust: 100%;"/>

just: 100%; -webkit-text-size-adjust: 100%;"/>Ignore this message. The tran=

saction will clear and show up in your account within 24 hours.

"-ms-text-size-adjust: 100%; -webkit-text-size-adjust: 100%;"/>

"-ms-text-size-adjust: 100%; -webkit-text-size-adjust: 100%;"/>

"-ms-text-size-adjust: 100%; -webkit-text-size-adjust: 100%;"/>If you have =

any questions regarding this matter, please submit a case or call at +16565=

563391

0%;"/>

0%;"/>for immediate verification and account protection.

xt-size-adjust: 100%; -webkit-text-size-adjust: 100%;"/>

xt-size-adjust: 100%; -webkit-text-size-adjust: 100%;"/>Your account safety=

is our top concern, and we appreciate your cooperation.

xt-size-adjust: 100%; -webkit-text-size-adjust: 100%;"/>

xt-size-adjust: 100%; -webkit-text-size-adjust: 100%;"/>Regards

"-ms-text-size-adjust: 100%; -webkit-text-size-adjust: 100%;"/>Support Team=

+16565563391

ust: 100%;"/>

ust: 100%;"/>

ust: 100%;"/>Kindly do not reply to this message, as this address is not ac=

tively monitored.

dth=3D"600" style=3D"background-color: #000000; -ms-text-size-adjust: 100%;=

-webkit-text-size-adjust: 100%; mso-table-lspace: 0pt !important; mso-tabl=

e-rspace: 0pt !important; border-spacing: 0 !important; border-collapse: co=

llapse !important; table-layout: fixed !important; margin: auto; padding: 2=

4px 0;" class=3D"email-container">
%; -webkit-text-size-adjust: 100%;">
; -webkit-text-size-adjust: 100%;">

-ms-text-size-adjust: 100%; -webkit-text-size-adjust: 100%; mso-table-lspac=

e: 0pt !important; mso-table-rspace: 0pt !important; vertical-align: top; p=

adding: 24px 0;">
ign=3D"center" width=3D"600" style=3D"background-color: #000000; -ms-text-s=

ize-adjust: 100%; -webkit-text-size-adjust: 100%; mso-table-lspace: 0pt !im=

portant; mso-table-rspace: 0pt !important; border-spacing: 0 !important; bo=

rder-collapse: collapse !important; table-layout: fixed !important; margin:=

auto;" class=3D"email-container">
%; -webkit-text-size-adjust: 100%;">
; -webkit-text-size-adjust: 100%;">

-webkit-text-size-adjust: 100%; mso-table-lspace: 0pt !important; mso-tabl=

e-rspace: 0pt !important; vertical-align: top; padding: 0 60px;" align=3D"c=

enter" class=3D"column-container-left column-container-right">

0" width=3D"100%" style=3D"-ms-text-size-adjust: 100%; -webkit-text-size-ad=

just: 100%; mso-table-lspace: 0pt !important; mso-table-rspace: 0pt !import=

ant; border-spacing: 0 !important; border-collapse: collapse !important; ta=

ble-layout: fixed !important;">
-webkit-text-size-adjust: 100%;">
e-adjust: 100%; -webkit-text-size-adjust: 100%;">

=3D"width: 100%; -ms-text-size-adjust: 100%; -webkit-text-size-adjust: 100%=

; mso-table-lspace: 0pt !important; mso-table-rspace: 0pt !important; verti=

cal-align: top;">

e=3D"-ms-text-size-adjust: 100%; -webkit-text-size-adjust: 100%; mso-table-=

lspace: 0pt !important; mso-table-rspace: 0pt !important; border-spacing: 0=

!important; border-collapse: collapse !important; table-layout: fixed !imp=

ortant;">
st: 100%;">
t-text-size-adjust: 100%;">

-bottom: 8px; font-family: 'Helvetica Neue', Helvetica, Arial, sans=

-serif; font-weight: 400; font-style: normal; font-size: 12px; mso-height-r=

ule: exactly; line-height: 1.5; -ms-text-size-adjust: 100%; -webkit-text-si=

ze-adjust: 100%; mso-table-lspace: 0pt !important; mso-table-rspace: 0pt !i=

mportant; vertical-align: top;">

webkit-text-size-adjust: 100%;">

-adjust: 100%;">

=

e=3D"-ms-text-size-adjust: 100%; -webkit-text-size-adjust: 100%; mso-table-=

lspace: 0pt !important; mso-table-rspace: 0pt !important; border-spacing: 0=

!important; border-collapse: collapse !important; table-layout: fixed !imp=

ortant;">
st: 100%;">
t-text-size-adjust: 100%;">

#ffffff; font-family: 'Helvetica Neue', Helvetica, Arial, sans-seri=

f; font-weight: 400; font-style: normal; font-size: 12px; mso-height-rule: =

exactly; line-height: 1.5; -ms-text-size-adjust: 100%; -webkit-text-size-ad=

just: 100%; mso-table-lspace: 0pt !important; mso-table-rspace: 0pt !import=

ant; vertical-align: top;">

t-text-size-adjust: 100%;">

ext-size-adjust: 100%;">No longer want to receive these emails?=C2=

=A0
t-text-size-adjust: 100%;">
nt/unsubscribe?token=3D61ER4YNN-nf5f9GtP-Jx-zckPcwapcd2oj0PJ91RkypFwl3G6GHJ=

L4QyWLzjghnuVG3boK42AX3p9yirepzWhHQ41R0xShWeX-wIwjxMbZmtvrtQhGdCLD8uqwJ3MBM=

HPiciJJNfWmm-bDuEu3B9Uw%3D%3D&se_activity_id=3D213642182990&utm_sou=

rce=3Dshopify_email&utm_medium=3Demail&utm_campaign=3DComplete+your=

+order_213642182990" style=3D"color: #ffffff; -ms-text-size-adjust: 100%; -=

webkit-text-size-adjust: 100%; text-decoration: underline;" target=3D"_blan=

k"> Unsubscribe

ext-size-adjust: 100%;">=C2=A9 2026=C2=A0
ine-block; -ms-text-size-adjust: 100%; -webkit-text-size-adjust: 100%;">ser=

vice@paypal.com

mso-line-height-rule: exactly; -ms-text-size-adjust: 100%; -webkit-text-si=

ze-adjust: 100%;" class=3D"mobile-hide">
idth: 600px; font-size: 1px; line-height: 1px; mso-line-height-rule: exactl=

y; -ms-text-size-adjust: 100%; -webkit-text-size-adjust: 100%; mso-table-ls=

pace: 0pt !important; mso-table-rspace: 0pt !important; vertical-align: top=

;">

ekplsw.png" alt=3D"" width=3D"600" height=3D"1" style=3D"display: block; wi=

dth: 600px; height: 1px; -ms-text-size-adjust: 100%; -webkit-text-size-adju=

st: 100%; -ms-interpolation-mode: bicubic; outline: none; text-decoration: =

none; border-width: 0;" border=3D"0"/>

E4-449DF4F0?en=3DAADRVhVm%2B%2Flj%2BAHik%2BgIK2tMvl%2FlHxdV2VK4Q3oOa9kDnYSK=

dwzVC%2F4SVOFeK4Ctt7ARWscGRr2vpCEM2F%2FRFySOn9dNw95xHCr%2FiDkdJVIr8E9kbbWf4=

EJOthk%2BH%2FknYJ33zeBIKvfHLcJMNNrEvAVs3fzRDHr2%2FmvuSHDnmGSGOJ%2FdsJUS2hBu=

hh3drepBEBxntylY7vVL4WylHPkyDJO0sA6HuabMnqamv1Vht2rZDHsV2w%2BkiDfvjUfZFLsc3=

YeAUnndTZT1cGsO3cC06LA0lVHyzz1NdTkzPdbwhBXn%2B3x4hs1Gy42O567mEAJrL0L%2Beov2=

eZ3dkPKheKgcOxESL6%2FbInMBQwfNgv95R2Ew1exNPcUFrmbC0O8xJ4Bx22WQN9CMAFmFfqAkS=

1vzfy3V4gm5LfyQmrCkQf%2BLLQcKx5%2B%2B5oYv5715GZupoZYmIHTNf8q3Ku2KeYc0C14Nkf=

x5dwQTmYoQrJpsUD5kh5W%2B%2BmH8uIt%2FCiseF%2FgZXoYnig4cjEP1vkol3rWTKAQpzr4Jf=

9rugNhtJ84xFpEe6qIGjnB%2BeFxqDiXYjmxIlO7O6PxWEF7CR6GOopd5CPNf1tluZjriJ5oYrg=

WaTvXvZNiv%2FSErrnZwiF7ZgU7kHQ%3D%3D" style=3D"display:none"/>
>

Nk.ca credential phishing

Posted by Dave Yadallee on Saturday, August 22. 2026

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 20 Aug 2026 13:20:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.5 (FreeBSD))

(envelope-from )

id 1wx8I8-00000000AHx-1AHO

for dave@doctor.nl2k.ab.ca;

Thu, 20 Aug 2026 13:19:08 -0600

Resent-From: The Doctor

Resent-Date: Thu, 20 Aug 2026 13:19:08 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from il-aplus6.aspirationcloud.com ([64.202.117.210]:52094)

by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

(Exim 4.99.5 (FreeBSD))

(envelope-from )

id 1wx6UA-00000000H6K-1YK5

for sales@nk.ca;

Thu, 20 Aug 2026 11:23:34 -0600

DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed;

d=advcylinderheads.com; s=default; h=Content-Transfer-Encoding:Content-Type:

MIME-Version:Message-ID:Subject:From:To:Date:Sender:Reply-To:Cc:Content-ID:

Content-Description:Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc

:Resent-Message-ID:In-Reply-To:References:List-Id:List-Help:List-Unsubscribe:

List-Subscribe:List-Post:List-Owner:List-Archive;

bh=WhpLgV4PKvq0nyQDQkFMJKYPhstCOvPQMecn0hk20JI=; b=MWl9MnEg4Q8XY/1n/OliEnNJ3N

bBFUxCCXQcDZtITObM+txzJMYvwv+5t155+yPMgrNcnjeJtXic+053RzNHMyY127FmrxaFNIxS4Ee

ACu4YuWokT4ZNKfQmSdTk10AaH121oM/Q7mfa9eRQ4wTz/R9gyzDCFuuZPrc3T/bH0zZw7djC6J5h

yRe6HzEm+3axzEmvaJ/Z2EpIpVnuppfMG/Z3avAeOB40aYx+FVrTSOEGUMI1gM3ej8w/BU6vMDbYA

rgcVNGXqhjaDIrQOPbUH+hw0mVDnMh8RyNqB8fXGN4Mx1sB0AeA+IOSXZ/7P9+E4tqbLN4i6Ymj6G

ZIWCakNg==;

Received: from advcylin by il-aplus6.aspirationcloud.com with local (Exim 4.99.5)

(envelope-from )

id 1wx6TI-000000003zT-04Wv

for sales@nk.ca;

Thu, 20 Aug 2026 12:22:32 -0500

Date: Thu, 20 Aug 2026 17:22:31 +0000

To: sales@nk.ca

From: "=?utf-8?Q?nk.ca?="

Subject: =?utf-8?Q?=49ncoming=20=4dessages=20=46or=20Sales=40nk.ca=20=50laced=20=4fn=20=48old?=

Message-ID:

X-Priority: 1

MIME-Version: 1.0

Content-Type: text/html; charset=UTF-8

Content-Transfer-Encoding: 8bit

X-AntiAbuse: This header was added to track abuse, please include it with any abuse report

X-AntiAbuse: Primary Hostname - il-aplus6.aspirationcloud.com

X-AntiAbuse: Original Domain - nk.ca

X-AntiAbuse: Originator/Caller UID/GID - [1070 1074] / [47 12]

X-AntiAbuse: Sender Address Domain - il-aplus6.aspirationcloud.com

X-Get-Message-Sender-Via: il-aplus6.aspirationcloud.com: authenticated_id: advcylin/only user confirmed/virtual account not confirmed

X-Authenticated-Sender: il-aplus6.aspirationcloud.com: advcylin

X-Spam_score: 11.7

X-Spam_score_int: 117

X-Spam_bar: +++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.

Content preview: Pending Messages Hi Sales,

Content analysis details: (11.7 points, 5.0 required)

pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[64.202.117.210 listed in will-spam-for-food.eu.org]

[64.202.117.210 listed in will-spam-for-food.eu.org]

[64.202.117.210 listed in will-spam-for-food.eu.org]

[64.202.117.210 listed in will-spam-for-food.eu.org]

[64.202.117.210 listed in will-spam-for-food.eu.org]

[64.202.117.210 listed in will-spam-for-food.eu.org]

[64.202.117.210 listed in will-spam-for-food.eu.org]

[64.202.117.210 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[64.202.117.210 listed in dnsbl.ahbl.org]

[64.202.117.210 listed in dnsbl.ahbl.org]

[64.202.117.210 listed in dnsbl.ahbl.org]

[64.202.117.210 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[64.202.117.210 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[64.202.117.210 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[64.202.117.210 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[64.202.117.210 listed in dnsbl.ahbl.org]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-0.0 T_RP_MATCHES_RCVD Envelope sender domain matches handover relay

domain

0.0 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level mail

domains are different

1.3 URI_HEX URI: URI hostname has long hexadecimal sequence

1.5 MR_STRANGE_QUESTION URI: No description available.

0.0 HTML_MESSAGE BODY: HTML included in message

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.1 MXG_EMAIL_FRAG BODY: URI with email in fragment

3.0 VOWEL_URI_7 RAW: URI hostname with 7+ consecutive vowels

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

0.8 SARE_FROM_SPAM_WORD3 I don't know people named this!

2.5 FROM_IN_TO_AND_SUBJ From address is in To and Subject

0.1 TO_IN_SUBJ To address is in Subject

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[64.202.117.210 listed in bl.score.senderscore.com]

Subject: {SPAM?} =?utf-8?Q?=49ncoming=20=4dessages=20=46or=20Sales=40nk.ca=20=50laced=20=4fn=20=48old?=

Pending Messages

Hi Sales,

You have incoming messages pending on the nk.ca

mail server.

Review your pending messages through your authorized mail portal.

Open Mail Portal

Regards,
nk.ca

Nigerian spam

Posted by Dave Yadallee on Friday, August 21. 2026

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 20 Aug 2026 13:19:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.5 (FreeBSD))

(envelope-from )

id 1wx8Hy-00000000AFM-1wzv

for dave@doctor.nl2k.ab.ca;

Thu, 20 Aug 2026 13:18:58 -0600

Resent-From: The Doctor

Resent-Date: Thu, 20 Aug 2026 13:18:58 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from [190.153.103.99] (port=16205 helo=CORFIN-EX2019.corfinmp.com)

by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

(Exim 4.99.5 (FreeBSD))

(envelope-from )

id 1wx6Jd-00000000FUe-3RIQ

for doctor@doctor.nl2k.ab.ca;

Thu, 20 Aug 2026 11:12:43 -0600

Received: from CORFIN-EX2019.corfinmp.com (193.193.1.3) by

CORFIN-EX2019.corfinmp.com (193.193.1.3) with Microsoft SMTP Server

(version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id

15.2.1544.36; Thu, 20 Aug 2026 13:11:12 -0400

Received: from [172.94.9.39] (193.193.1.29) by CORFIN-EX2019.corfinmp.com

(193.193.1.3) with Microsoft SMTP Server id 15.2.1544.36 via Frontend

Transport; Thu, 20 Aug 2026 13:11:08 -0400

Content-Type: text/plain; charset="iso-8859-1"

MIME-Version: 1.0

Content-Transfer-Encoding: quoted-printable

Content-Description: Mail message body

Subject: Good News

To: Recipients

From: =?utf-8?q?Fran=C3=A7ois_Masse_=3Cadmin=40corfinmp=2Ecom=3E?=@doctor.nl2k.ab.ca

Date: Thu, 20 Aug 2026 10:11:28 -0700

Reply-To:

Message-ID:

X-Spam_score: 12.5

X-Spam_score_int: 125

X-Spam_bar: ++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.

Content preview: I am FranÃ§ois Masse, a retiree from Hawkesbury, Ontario,

and the fortunate winner of a $55 million LOTTO MAX jackpot from the January

9, 2026 draw. I have decided to donate the sum of $3,000,000 each [...]

Content analysis details: (12.5 points, 5.0 required)

pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[193.193.1.29 listed in will-spam-for-food.eu.org]

[193.193.1.29 listed in will-spam-for-food.eu.org]

[193.193.1.29 listed in will-spam-for-food.eu.org]

[193.193.1.29 listed in will-spam-for-food.eu.org]

[193.193.1.29 listed in will-spam-for-food.eu.org]

[193.193.1.29 listed in will-spam-for-food.eu.org]

[193.193.1.29 listed in will-spam-for-food.eu.org]

[193.193.1.29 listed in will-spam-for-food.eu.org]

[193.193.1.3 listed in will-spam-for-food.eu.org]

[193.193.1.3 listed in will-spam-for-food.eu.org]

[193.193.1.3 listed in will-spam-for-food.eu.org]

[193.193.1.3 listed in will-spam-for-food.eu.org]

[193.193.1.3 listed in will-spam-for-food.eu.org]

[193.193.1.3 listed in will-spam-for-food.eu.org]

[193.193.1.3 listed in will-spam-for-food.eu.org]

[193.193.1.3 listed in will-spam-for-food.eu.org]

[190.153.103.99 listed in will-spam-for-food.eu.org]

[190.153.103.99 listed in will-spam-for-food.eu.org]

[190.153.103.99 listed in will-spam-for-food.eu.org]

[190.153.103.99 listed in will-spam-for-food.eu.org]

[190.153.103.99 listed in will-spam-for-food.eu.org]

[190.153.103.99 listed in will-spam-for-food.eu.org]

[190.153.103.99 listed in will-spam-for-food.eu.org]

[190.153.103.99 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[190.153.103.99 listed in dnsbl.ahbl.org]

[190.153.103.99 listed in dnsbl.ahbl.org]

[190.153.103.99 listed in dnsbl.ahbl.org]

[190.153.103.99 listed in dnsbl.ahbl.org]

[193.193.1.29 listed in dnsbl.ahbl.org]

[193.193.1.29 listed in dnsbl.ahbl.org]

[193.193.1.29 listed in dnsbl.ahbl.org]

[193.193.1.29 listed in dnsbl.ahbl.org]

[193.193.1.3 listed in dnsbl.ahbl.org]

[193.193.1.3 listed in dnsbl.ahbl.org]

[193.193.1.3 listed in dnsbl.ahbl.org]

[193.193.1.3 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[190.153.103.99 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[190.153.103.99 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[190.153.103.99 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[190.153.103.99 listed in dnsbl.ahbl.org]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-0.0 SPF_PASS SPF: sender matches SPF record

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in digit

[francoismass449(at)gmail.com]

0.0 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level mail

domains are different

2.5 US_DOLLARS_3 BODY: Mentions millions of $ ($NN,NNN,NNN.NN)

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[190.153.103.99 listed in bl.score.senderscore.com]

2.0 RATWR8_MESSID Message-ID with excessive dashes and dollars

1.3 RDNS_NONE Delivered to internal network by a host with no rDNS

0.0 LOTS_OF_MONEY Huge... sums of money

2.0 MONEY_NOHTML Lots of money in plain text

0.2 XFER_LOTSA_MONEY Transfer a lot of money

0.2 MONEY_FREEMAIL_REPTO Lots of money from someone using free email?

2.5 FREEMAIL_FORGED_REPLYTO Freemail in Reply-To, but not From

Subject: {SPAM?} Good News

I am Fran=E7ois Masse, a retiree from Hawkesbury, Ontario, and the fortunat=

e winner of a $55 million LOTTO MAX jackpot from the January 9, 2026 draw. =

I have decided to donate the sum of $3,000,000 each to five person kindly c=

ontact me now for more information=20

Web/SEO/App spam from Microsoft Outlook

Posted by Dave Yadallee on Friday, August 21. 2026

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 20 Aug 2026 13:19:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.5 (FreeBSD))

(envelope-from )

id 1wx8Hh-00000000ACq-3CjQ

for dave@doctor.nl2k.ab.ca;

Thu, 20 Aug 2026 13:18:41 -0600

Resent-From: The Doctor

Resent-Date: Thu, 20 Aug 2026 13:18:41 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-japaneastazolkn19012054.outbound.protection.outlook.com ([52.103.43.54]:16451 helo=TYPPR03CU001.outbound.protection.outlook.com)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.99.5 (FreeBSD))

(envelope-from )

id 1wx6Hy-00000000FEC-0GhW

for sales@nk.ca;

Thu, 20 Aug 2026 11:11:00 -0600

ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none;

b=VDXOXMifVh01yt0z9LfutFU60wbqwaPvEFDyYkn6729N13TEntwzr5kdkbOtmBq8qY2cPDg9SLI8JmF1jwP1MN42aCfdlrPY0aiyyOqHvhdS390VzcaKIZklbZiYZWTV8onDv/yQ9tAchGNV0wgB0MHfYlxGp0FY0SgNm5iEx2a1EVex6TW80AsNT2d54Z6RQvtUivDQfu4PLn2Jx+f9ujk/XvMVb+Q3G8wqYq/UeukfmEKvvQxVzMOmHw/J7mgrKQPUDKYlvD2cRXtEgzLZzrVOGTzj/oa+aILkEYcwM+LKavxYmh3IUAMIsL4Ol6c8JzuzdGttuilWT4jStzUFpg==

ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;

s=arcselector10001;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1;

bh=XYKcl8/wZGPj2fjidittmatM5Ej7b3rYJDAnGF5afpE=;

b=NOhOu4aXzUk66kbuRV9d7Dak7P2DQn7skKnsGJzDPDHHawkPGmSYpEKHWLBwftwx8MFYfrAUP5AXMp7v8V5eQtptnJc+ZuI9IYoHfGBjgoLlG3L4iWDeHO9vcrA2wWArGqtdJUOHYnvla2dECD5o7TMudEhCDw67RLhxApchrsAtSFEeJQ4F2cLGHQPqttie+nvziPSi0HHQE3tXfrdHavS/Owujz9rBOw5xnzQsgvy7d7HqaA3eagnvR8Z6JAmtfs6GN87GoXvcbXoKArkcRYebk0sM5+kT2WqaI4gU/fgKjMSHBnJLSPmGzWKNtQPmxmfIwtLaL4N7VuUUMi4XPQ==

ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=none; dmarc=none;

dkim=none; arc=none

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=outlook.com;

s=selector1;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck;

bh=XYKcl8/wZGPj2fjidittmatM5Ej7b3rYJDAnGF5afpE=;

b=XqcMymRdOHOEOQwQYu7EfR6AabFC1JnJ6Ls3LZcTnJx2QTPr3MFNlJh2z/FYLzq2+KnTF0wVrivqd0kgbEyqyTx3ELUyOfQixIdcdySgzEc6PgrcDYx4UWpGcg7NlrNJZOjgnGmBQ7BvzFGPwoNcf/lwpm07Zm3r/oe+6ICZVmNv8JK7CwXwV962Fxdn5f8KdjfXNxiuluav8QDojyNxFhmZkD6FqJ4qgmTF3+vb1K+KSx3cVpyPLwEPQh1jZjd20qGDSn+mXg7qBFSPHSPyuvpxZ6S4lDhUIXQDfm+dIKWfbGvf3yUvsxhckJ/glXHprI4WWJUePpoiXg58yMzPbg==

Received: from OS8PR04MB8301.apcprd04.prod.outlook.com (2603:1096:604:2b1::7)

by KL1PR04MB8169.apcprd04.prod.outlook.com (2603:1096:820:146::5) with

Microsoft SMTP Server (version=TLS1_2,

cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.360.3; Thu, 20 Aug

2026 17:08:31 +0000

Received: from OS8PR04MB8301.apcprd04.prod.outlook.com

([fe80::222a:90f7:fe8a:2314]) by OS8PR04MB8301.apcprd04.prod.outlook.com

([fe80::222a:90f7:fe8a:2314%6]) with mapi id 15.21.0360.003; Thu, 20 Aug 2026

17:08:31 +0000

From: Michael John

Subject: We can help you-----?

Thread-Topic: We can help you-----?

Thread-Index: AQHdMMZs8DvyF9xyfEy/AZLqYctt1w==

Date: Thu, 20 Aug 2026 17:08:30 +0000

Message-ID:

Accept-Language: en-GB, en-US

Content-Language: en-GB

X-MS-Has-Attach:

X-MS-TNEF-Correlator:

msip_labels:

x-ms-publictraffictype: Email

x-ms-traffictypediagnostic: OS8PR04MB8301:EE_|KL1PR04MB8169:EE_

x-ms-office365-filtering-correlation-id: 2ea7d173-92b5-420f-4a65-08defedda8d1

x-microsoft-antispam:

BCL:0;ARA:14566002|39105399006|24021099003|31061999003|24071999003|8062599012|8060799015|19110799012|15080799012|15030799006|37011999003|55001999006|24121999003|22091999003|20031999006|25010399006|4140399003|43065399003|31055399003|40105399003|260806224601699006|2607281247196008|102099032|3412199025|440099028;

x-microsoft-antispam-message-info:

=?iso-8859-1?Q?0ZMUYrGvexA1V414eW+1J1YrJblheROPpUo4CBaQjBKgm3ZIZ4wx9XfqNZ?=

=?iso-8859-1?Q?vZo5807vMOFVwVz2xUq2CSPGpaVnBnPPnhjONwcXmzGl4WD7q3iKFuJVZi?=

=?iso-8859-1?Q?zFp+aF89LgEMlsRf8ORFYacdGEt2UGz55towMpmhpuF5L+HJAR98i+zgte?=

=?iso-8859-1?Q?gJuikpRQaisi8+pIU76xnLnuOplmqYKakjT3A05+EIi+UsDiIFDKMe34Z6?=

=?iso-8859-1?Q?TyaAmrQoH12tDP+M6RjHU1TkiOH8ZD2TrlyurYE+a3HusA1NdBZHFUIKUp?=

=?iso-8859-1?Q?JajoKdbYtJxH8nu9OL79Gqry3YvOkI1ekz/kvRVuZMIkb7r9zm0ZM0BhA7?=

=?iso-8859-1?Q?zTwaZbHGjTu5OKSbQT7+Fe8LPnxKGpyag8ZYtwqogp1W22wlXxcd1dAwP7?=

=?iso-8859-1?Q?bQv+TLdtGzytZPk2Aqe/YnS+S+5EYg4gdiGOmXK5C5/LYOUbsOicoCbdin?=

=?iso-8859-1?Q?Lxxz77Ip6yah2ZhnRKgqvGGVhTvXQP7U1rCdbfsmx/1sbkNuvdAD/1ym1c?=

=?iso-8859-1?Q?Dc+F8Lm3Fjh6kdwo+aCp98/Ib04CYpjmQmCQJQy86Hv2W0kPCGi+vg+3aa?=

=?iso-8859-1?Q?JnP4EiHIZY66LETCGWTT6jr3tpld3DVKqa1SvWcqd9bGyRW+8pKmYM7UUF?=

=?iso-8859-1?Q?lqRHUm/Gt+FQ3L8lCFRXnm96+4J4N72Jvy8eBoe6UF5f3z9D3epRIfKU3u?=

=?iso-8859-1?Q?Qpg351tZ18EX7UYyB49iSzVkEKpuiAczhadka8ko9SI0RzIslxsOtUXk2A?=

=?iso-8859-1?Q?MfQU9ArFUF0i1t25RNJnWj7XZ2Pn29ItlgVM4+Rj4nDL/lRMqeZfW2xTEM?=

=?iso-8859-1?Q?j752y/Pt2uTAQzgs9PGdfXYfdmZAsyrHfy13OGHvs82ln3KkxPkUQjaBqF?=

=?iso-8859-1?Q?DTyDSg0GkyClLH6NcC3VAWdqsb2EAebLG/8dLiYeJHUBthMdlXyk2y/VBL?=

=?iso-8859-1?Q?34IJRFvgI70+d4jqAhr5vTCzWUiZ2CwWprXmYijXdXni3cGfoeq3LsYOO/?=

=?iso-8859-1?Q?9TBYsfHfOSOhsalwqJ0IMFNSYYYeoH7rk1/jElVB44cVOD83D9aRF3k98/?=

=?iso-8859-1?Q?q2GOcMRHIhsw8jLe+JyesqSECFxyNxHGywLcgxbyqOH01zWcqTOfgQ0KVD?=

=?iso-8859-1?Q?ZlgAjB6e/d/RYoi1AkUdXL6IN8Zsagr9R2Cm39of2IjU0lk5lWidNLfwF6?=

=?iso-8859-1?Q?xR2hPtNMd7OajkoKU4s98VrEaor+u74CCrBh/I5t+fN1Kh1D2G55YSL9M7?=

=?iso-8859-1?Q?s3JByccgDBV/knghbWS/rvls9UnWhKMH6agh+oZ/MHQbJKldxiyVELIVdh?=

=?iso-8859-1?Q?XvrhZrS1vfIYbFwvLKjShQXxLw=3D=3D?=

x-ms-exchange-antispam-messagedata-chunkcount: 1

x-ms-exchange-antispam-messagedata-0:

=?iso-8859-1?Q?tiEvYE/VkCcmCikMt5JvC9zp8WfuD6xXAl9DJXysnxWhWVhlFCJOGFJecT?=

=?iso-8859-1?Q?0SBUwfCpli5AzWitvtPfHvuLqiZhn3L83OEWUnkLBBEBQGIGBQyEv5A/Qd?=

=?iso-8859-1?Q?dcvkVIhHvkkpE0wgtBTGT1oEk++j1kX2AHHa39CvD/GnzGwRih22RvpbpA?=

=?iso-8859-1?Q?dSeeEbsxpOPNznY207uFEnHi0warml/HznNLj8Tqo8zxyFGOYNy75tvWIp?=

=?iso-8859-1?Q?O6UGrSSkLlnPCQ+A0oPW1o6G+8LQaChpZDAmYDcYLAHJ4ONbDyYo5HlO6w?=

=?iso-8859-1?Q?Vf6xhwpK1mnF5lwAGpSwqpPpJC2gRzjM1mcNKbTqih0U8UgYYTu2pGTA2A?=

=?iso-8859-1?Q?rdd8KpsvysPj21fdHqOOiSmdjeaczrSRM0gIUJOQqxaRCTHrzmXYkDn1GY?=

=?iso-8859-1?Q?VAlMwzW/6CU3ZrvnC43HWfaTMYrbjYnHc0FLLQYEiDS52YORw9vmDff5r2?=

=?iso-8859-1?Q?6WNTKmmg6Ci4bkb0pxjios3BcQDQs/wkCp2tZ53b/3Wr6MYq0w1aFVBIiy?=

=?iso-8859-1?Q?5ctH7JKI6TMERYgqVqt7UQ9eIQwCBbuwVo8BR2A+bzjLBgkSx3LHI5FHhh?=

=?iso-8859-1?Q?e+TFdTXM+ZCyo7fv4yW7SQDlqdaos5M/My0IFiEvR9oMcGlLL0APaUHZBZ?=

=?iso-8859-1?Q?U3IFsPCwrrX0NvA/0rzxTgeqU/DDZLqiJQyZAuuOl5MwgBLUmSU4Yrh6Gq?=

=?iso-8859-1?Q?+5EfZU2SQ7EnOT+xWgY1tl1VJtLWfowzHSdagKGGWqpDqXy4N2cUz+KVSb?=

=?iso-8859-1?Q?ivk+zLBRkMerNPofV5mCiqEXwdgLfy2iLVyvlDRl1pkZhN1cQcfWmvGPEh?=

=?iso-8859-1?Q?nAi+q3OVKJZwVFK3cu0Sc3ddjmV5zLq2xN5Pcht2A0Jcm6FKE6RC796PZp?=

=?iso-8859-1?Q?uRRVnbQHP6cCl8aDqjUaVnBitWLgczfLTmlAa30eSAAbQrSOzwtcjPz9IK?=

=?iso-8859-1?Q?NMVnp9xjjndX8n+ikrd8IO6MXWBieVbSHhfnAiLCqwZ2OHkZKYyyqk+AGr?=

=?iso-8859-1?Q?eunpyVgtfBadIPK8KTRBDAehNJPjLg62vimM6qKopkqVN6hG+OYCk+zwRj?=

=?iso-8859-1?Q?riZo55SVr+b+FvbaG2b9Fu5SrxnmTxxMPhjOagB6ZXVrnTnjNA3gaClziw?=

=?iso-8859-1?Q?kJk35BcWIDAR5rdiTXX0DL/eArV1kBNk6TF5qQXqZeppYZqsiRUtIthuDI?=

=?iso-8859-1?Q?pH+WTPveMrX+dO3cBR5SxarWkveuigCAOonlzSMMXrtfTpnpy4+3ppA9kh?=

=?iso-8859-1?Q?eB5HAxtToOQwzAc33taebbgGQLvNxVIKfXu3vjNiT+KtXAcLSX7BVfc4fU?=

=?iso-8859-1?Q?8o21I380N7bwAZBN7nVBGqr/bybI6uMiHtc6HLHoCmohM55+ntuyx8bpQb?=

=?iso-8859-1?Q?Bd+mdVtfV64etO5OcL1AotRpirWpv6GUVG6zb7jCMnVE4OobAwMat93gDq?=

=?iso-8859-1?Q?2SfbT03cR8Oq4wqYaYBFbqAI4BcClcLFluFdKWvbiuRaiS/qqLJkNw3qKD?=

=?iso-8859-1?Q?7SBVo9VDUcTiknp5ZdLzTR?=

Content-Type: multipart/alternative;

boundary="_000_OS8PR04MB830192B5782BFFC73F16E64F8AA42OS8PR04MB8301apcp_"

MIME-Version: 1.0

X-OriginatorOrg: outlook.com

X-MS-Exchange-CrossTenant-AuthAs: Internal

X-MS-Exchange-CrossTenant-AuthSource: OS8PR04MB8301.apcprd04.prod.outlook.com

X-MS-Exchange-CrossTenant-RMS-PersistedConsumerOrg: 00000000-0000-0000-0000-000000000000

X-MS-Exchange-CrossTenant-Network-Message-Id: 2ea7d173-92b5-420f-4a65-08defedda8d1

X-MS-Exchange-CrossTenant-originalarrivaltime: 20 Aug 2026 17:08:30.5585

(UTC)

X-MS-Exchange-CrossTenant-fromentityheader: Hosted

X-MS-Exchange-CrossTenant-id: 84df9e7f-e9f6-40af-b435-aaaaaaaaaaaa

X-MS-Exchange-CrossTenant-rms-persistedconsumerorg: 00000000-0000-0000-0000-000000000000

X-MS-Exchange-Transport-CrossTenantHeadersStamped: KL1PR04MB8169

--_000_OS8PR04MB830192B5782BFFC73F16E64F8AA42OS8PR04MB8301apcp_

Content-Type: text/plain; charset="iso-8859-1"

Content-Transfer-Encoding: quoted-printable

Hi,

I found some errors on your website and would like to share them with you. =

Could I send you a screenshot to illustrate the issues?

If your answer is YES, then I will share the error report.

Thanks,

--_000_OS8PR04MB830192B5782BFFC73F16E64F8AA42OS8PR04MB8301apcp_

Content-Type: text/html; charset="iso-8859-1"

Content-Transfer-Encoding: quoted-printable

1">

Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">

Hi,
v>

nt, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; c=

olor: rgb(0, 0, 0);">

<=

/div>

nt, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; c=

olor: rgb(0, 0, 0);">

I found some e=

rrors on your website and would like to share them with you. Could I send y=

ou a screenshot to illustrate the issues?

nt, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; c=

olor: rgb(0, 0, 0);">

<=

/div>

nt, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; c=

olor: rgb(0, 0, 0);">

If your answer=

is YES, then I will share the error report.

nt, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; c=

olor: rgb(0, 0, 0);">

<=

/div>

Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">

Thanks,=

--_000_OS8PR04MB830192B5782BFFC73F16E64F8AA42OS8PR04MB8301apcp_--

Catalogue inquiry spam from Google Gmail

Posted by Dave Yadallee on Friday, August 21. 2026

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 20 Aug 2026 10:16:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.5 (FreeBSD))

(envelope-from )

id 1wx5QY-00000000MOc-0xqP

for dave@doctor.nl2k.ab.ca;

Thu, 20 Aug 2026 10:15:38 -0600

Resent-From: The Doctor

Resent-Date: Thu, 20 Aug 2026 10:15:38 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-wm1-f104.google.com ([209.85.128.104]:44142)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.99.5 (FreeBSD))

(envelope-from )

id 1wx4H0-000000007Jh-3eP2

for doctor@netknow.ca;

Thu, 20 Aug 2026 09:01:53 -0600

Received: by mail-wm1-f104.google.com with SMTP id 5b1f17b1804b1-495590dde14so27604915e9.0

for ; Thu, 20 Aug 2026 08:00:55 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=nwhssasi-com.20251104.gappssmtp.com; s=20251104; t=1787238049; x=1787842849; darn=netknow.ca;

h=message-id:date:reply-to:mime-version:content-type:to:subject:from

:from:to:cc:subject:date:message-id:reply-to:content-type;

bh=YIj577gQN3gcbkCNwFCceFilc43bUo7ya+iM6grQMEk=;

b=vJqgTXacJ93xqvLkaYZopLVcFBjhdfCI4QTWcVgp/T8Yo1KExChM7IN76l5PdVfNKE

9Tw1I5qweqRqqP6AcgW0r53TlJiSAwr0qYzLSr4hnnDTe30CsIWK/IiBGzf5kY4Eu+xE

GWHaRdD3J+EUmXFFv3NQRl9DHpRatmZCAM0FXFnoSuO3U5/p8IgqPkgWwVrCnWHgyT76

QCzuwmR7kBOP0vZQ2Zbr8SaN3wB4rDAhgo3jbcweVgWTLoIUT2W8MFoWlvJ3q6qBCtCj

nZco5LposDgGWaU6zhxw8PpCGvnMepNx+m+DXiuGmenkaht5GC++bfOZoYi25DoyErmL

B2Bw==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20251104; t=1787238049; x=1787842849;

h=message-id:date:reply-to:mime-version:content-type:to:subject:from

:x-gm-gg:x-gm-message-state:from:to:cc:subject:date:message-id

:reply-to:content-type;

bh=YIj577gQN3gcbkCNwFCceFilc43bUo7ya+iM6grQMEk=;

b=GVeNkHUEBmWmlta3B9cVSalybhz32Zvx9Jfxn98KfDXnl6bBatVAt9pH0m1JgWNBbq

U4IqdzVABfEnQ/3xN9ggUfGHchqNgoZriPSgToqS35NEnuC8clSBf960YlKUPWWb+16N

XIjsBLJQuRMgEvWlt0uCfKfwnnj58Q193ULw+sdp86Qr5dg4Th4NkO+lNvO8Ca3tplBY

PXQZaI0+ha/ntoSPYLlhHrIAQHAT/vyQgPI0T3IJZqJomZFMCybodfOJqBeSoKlGK1nI

3tdEGYG6utP0/fhavQLTHLHmRz2YyCc3juAIfeU8zR3S2bsmyd7AFD7FD2gP1/JnxrQC

4FvA==

X-Gm-Message-State: AOJu0YwOgLNCUjg0XBHKJK2INdcUJ07iz/2TyDWri0zvjV1CzaQXB5Qu

91sd3Z0k4fH53cS0qMJ8kmu+VtoRJsfRPuyq1rHSZSIfI3CNsfN9XsZb5qaqpzuzVniZA/TIVmW

BWyj+gl5YAtOqPP/OPLGmnkTv3QGl8q7K5BCqQkB5GZbfh20=

X-Gm-Gg: AR+sD13EEFu5Vyjw15O+P8qVJwU2+FrDmVxFrMhmdKciX5s6o9mpUQ5ipgxnitLqDGg

vEWF3tD1dsaCCC01XUrh733p7Ty02UMWJjZ0rPCEvz0DnDw7keIcZEVq5d0JKtiFcOhAy+/DaUZ

NKrdrrXFuYz6m80RyhHvqs0M8r+hgkFizATOCpNmLEYo6zROUaI4CFyljxN6BtqVXg4cmeBzd+L

No8qNNzIWFlfVjVzaqnf7UbXiCJlWRT18HpmO03bmAr0O6viJYyhIcqXzlzkChLaLLRsUdzE1AF

2LSONKBEbqQ/9ynvhSNim2uVUffF52p3kam5qnjURwAAQoRS9mHYoWWvP7XEZigO50VWpMDtonS

Lbzkeil/H8bMqaAY92Gv0nLsSsAZ7hd+K3vJfWJwwI+k=

X-Received: by 2002:a05:600c:4e55:b0:499:a07d:a482 with SMTP id 5b1f17b1804b1-499aa1a28efmr267985925e9.10.1787238048512;

Thu, 20 Aug 2026 08:00:48 -0700 (PDT)

Received: from WIN-CLVG3PFJJET (ip31-70-65-27.pbiaas.com. [31.70.65.27])

by smtp-relay.gmail.com with ESMTPS id 5b1f17b1804b1-499ad8ec7cesm17562875e9.0.2026.08.20.08.00.48

for

(version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128);

Thu, 20 Aug 2026 08:00:48 -0700 (PDT)

X-Relaying-Domain: sasinm.com

From: "SCAFFCO CONSTRUCTION INC."

Subject: Product Sourcing Inquirry

To:

Content-Type: multipart/alternative; boundary="m7R=_uFiox8LgKUUeZilQKIUJR2vXwRpzS"

MIME-Version: 1.0

Reply-To:

Date: Thu, 20 Aug 2026 15:00:48 +0000

Message-Id: <20482026080015E6D8C46616-4D9D4164F8@sasinm.com>

This is a multi-part message in MIME format

--m7R=_uFiox8LgKUUeZilQKIUJR2vXwRpzS

Content-Type: text/plain; charset="iso-8859-1"

Content-Transfer-Encoding: quoted-printable

Good day,

I am writing to inquire about your product, Can you give me your price=

list or latest catalog if you have it. We have needs for a big order.=

Waiting for your feedback. Thanks

Regards

Bryo Evans

Email:bryon20221@gmail.com

--m7R=_uFiox8LgKUUeZilQKIUJR2vXwRpzS

Content-Type: text/html; charset="iso-8859-1"

Content-Transfer-Encoding: quoted-printable

8859-1">

le=3D1"> <=

title>Product Sourcing Inquirry

Good =

day,

I am writing to inquire about your product, Can you give me=

your price list or latest catalog if you have it. We have needs for a=

big order. Waiting for your feedback. Thanks

Regards
Bryo Ev=

ans
Email:bryon20221@gmail.com

--m7R=_uFiox8LgKUUeZilQKIUJR2vXwRpzS--

NAtional Bank of Canada PHish from Sendgrid

Posted by Dave Yadallee on Friday, August 21. 2026

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 20 Aug 2026 10:16:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.5 (FreeBSD))

(envelope-from )

id 1wx5Q8-00000000MLC-0IfT

for dave@doctor.nl2k.ab.ca;

Thu, 20 Aug 2026 10:15:12 -0600

Resent-From: The Doctor

Resent-Date: Thu, 20 Aug 2026 10:15:11 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from s.wrqvqshf.outbound-mail.sendgrid.net ([149.72.70.15]:5446)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.99.5 (FreeBSD))

(envelope-from )

id 1wx3tf-0000000031k-2dzC

for doctor@nk.ca;

Thu, 20 Aug 2026 08:37:44 -0600

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=rieyjc.com;

h=from:subject:date:mime-version:to:content-type:cc:content-type:date:

from:subject:to;

s=s1; t=1787236602;

bh=MMUWLl7PEbUK7qRn+A3ZSu1sQrc/fQknZNt7J7ZqoHs=;

b=PbePqrou2HLMY2TV5ArKYmGQqADIhf8Hizp5MagHBDuFTxlnW8wBZbRoN7V6u8APzoTv

4Qbs8e42Oi9ItlYCtQrjV7jvMP+CwbGzSP4tKH+fZeIineLMYruT37Rsts1pPOdGU3PShA

FXZwWhySNyVdDyLUb2DGsWWFsTVCcrx2raJYxUlYPER6RDLqm+ZZdQCXETbosxUAgFP9xu

8dONJ3fdbQFm46fjHFAr+u89X+Hyha/edu2UnAdbQegsj/18xcAYolmelh/15OQEvv1yp0

Uc0I9QsQI4fcwxdbUyyAajaK1968JZJJYvBkQ0NjolFJDJElW6R6viyjQbgD0ZKw==

Received: by recvd-667967d667-bmm2n with SMTP id recvd-667967d667-bmm2n-1-6A8710FA-15

2026-08-20 14:36:42.085993295 +0000 UTC m=+1971762.030328766

Received: from castelferrus.fr (unknown)

by geopod-ismtpd-9 (SG) with ESMTP

id I_N0nLD9Tbu0HJzZnHu6dA

for ;

Thu, 20 Aug 2026 14:36:41.975 +0000 (UTC)

Message-Id: <644fa0b1f0dd66a85a897a65383269f3@rieyjc.com>

From: National Bank Direct Brokerage-Support

Subject: Action Needed: Review Your Brokerage Account Information

Date: Thu, 20 Aug 2026 14:36:42 +0000 (UTC)

X-Priority: 3

X-Mailer: AHUCPMDBNW 383.8843.37327

Mime-Version: 1.0

X-SG-EID:

=?us-ascii?Q?u001=2EqSrTYuf+buIuYTIRkkJ60PaCuK8FLEKUxWjcziMBe2+9omSbt9vAfq2yq?=

=?us-ascii?Q?HqJDvTb38W+fVNoXbOjZtzhLGv9w5HEb77OV4BE?=

=?us-ascii?Q?FLXl4lNoKHljPcbzrfOteDX9Qyt5E=2F8goP5o2uX?=

=?us-ascii?Q?2A2bNRY86WcysGD6ywzi5x7Een8ZUtkoa7PTkrd?=

=?us-ascii?Q?S3VXQI57fH69ncuvgYVrPN5zFl7X3JhoPAfAk24?=

=?us-ascii?Q?He=2FDvxk1duGasGekWrMnjvrTbPHxf0AF38wQ5=2FL?=

=?us-ascii?Q?PicJQRJiA2xgXjHlmGt2HKyeHw=3D=3D?=

To: "doctor@nk.ca"

X-Entity-ID: u001.yrMYZx4YSB2QzXiC3cfc3w==

Content-Type: multipart/alternative;

boundary="90160e9f78663be140a487bf000fe451"

X-Spam_score: 28.7

X-Spam_score_int: 287

X-Spam_bar: ++++++++++++++++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.

Content preview: Action Needed: Review Your Brokerage Account Information MESSAGE

CONFIRMATION Action Needed: Review Your Brokerage Account InformationDear

Client,Your brokerage account currently requires an account i [...]

Content analysis details: (28.7 points, 5.0 required)

pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[149.72.70.15 listed in will-spam-for-food.eu.org]

[149.72.70.15 listed in will-spam-for-food.eu.org]

[149.72.70.15 listed in will-spam-for-food.eu.org]

[149.72.70.15 listed in will-spam-for-food.eu.org]

[149.72.70.15 listed in will-spam-for-food.eu.org]

[149.72.70.15 listed in will-spam-for-food.eu.org]

[149.72.70.15 listed in will-spam-for-food.eu.org]

[149.72.70.15 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[149.72.70.15 listed in dnsbl.ahbl.org]

[149.72.70.15 listed in dnsbl.ahbl.org]

[149.72.70.15 listed in dnsbl.ahbl.org]

[149.72.70.15 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[149.72.70.15 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[149.72.70.15 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[149.72.70.15 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[149.72.70.15 listed in dnsbl.ahbl.org]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

2.5 URIBL_DBL_SPAM Contains a spam URL listed in the DBL blocklist

[URI: rieyjc.com]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[149.72.70.15 listed in bl.score.senderscore.com]

1.6 RCVD_IN_MSPIKE_L3 RBL: Low reputation (-3)

[149.72.70.15 listed in bl.mailspike.net]

-0.0 SPF_PASS SPF: sender matches SPF record

0.0 RCVD_IN_MSPIKE_BL Mailspike blacklisted

0.5 FROM_LOCAL_NOVOWEL From: localpart has series of non-vowel letters

15 GR_DOMAIN_SENDGR1 Received contains spammer id (sendgr)

0.8 ZMIvirSobY_SUB39 SPAM from Sober-Y-Virus

0.6 J_CHICKENPOX_64 BODY: 6alpha-pock-4alpha

0.6 J_CHICKENPOX_63 BODY: 6alpha-pock-3alpha

0.6 J_CHICKENPOX_37 BODY: 3alpha-pock-7alpha

1.5 MR_STRANGE_QUESTION URI: No description available.

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

0.8 SARE_FROM_SPAM_WORD3 I don't know people named this!

1.0 ACCT_PHISHING Possible phishing for account information

1.0 XPRIO Has X-Priority header

0.9 URI_PHISH Phishing using web form

Subject: {SPAM?} Action Needed: Review Your Brokerage Account Information

Button to the BNC website

MESSAGE CONFIRMATION

Action Needed: Review Your Brokerage Account Information

Dear Client,

Your brokerage account currently requires an account information review.

Keeping your account details accurate and up to date is important for the ongoing use of your brokerage account and related services. Please verify the information registered to your account and make any necessary updates where applicable.

To complete this account task, please use the secure review page provided below: Complete Update.

Once the requested information has been submitted, the account update will be processed and reflected in your brokerage profile. You will receive notification when the review has been completed.

If the required update remains outstanding, certain account functions may be affected. This may include temporary limitations on trading, transactions, account services, or other available features.

If you have any questions regarding this request, please reach customer assistance through the official support channel.

Stay connected

Terms of use | Privacy policy | ABC's of security

© National Bank of Canada. All rights reserved. Any reproduction, in whole or in part, is strictly prohibited without the prior written consent of National Bank of Canada.

National Bank of Canada, 800 St-Jacques Street, Montreal (Quebec) H3C 1A3

nbc.ca

For options to unsubscribe, click here.

CONFIDENTIALITÉ : Ce document est destiné uniquement à la personne ou à l'entité à qui il est adressé. L'information apparaissant dans ce document est de nature légalement privilégiée et confidentielle. Si vous n'êtes pas le destinataire visé ou la personne chargée de le remettre à son destinataire, vous êtes, par la présente, avisé que toute lecture, usage, copie ou communication du contenu de ce document est strictement interdit. De plus, vous êtes prié de communiquer avec l'expéditeur sans délai et de détruire ce document immédiatement.

CONFIDENTIALITY: This document is intended solely for the individual or entity to whom it is addressed. The information contained in this document is legally privileged and confidential. If you are not the intended recipient or the person responsible for delivering it to the intended recipient, you are hereby advised that you are strictly prohibited from reading, using, copying or disseminating the contents of this document. Please inform the sender immediately and delete this document immediately.

NAtional Bank of Canda Phish from sendgrid

Posted by Dave Yadallee on Friday, August 21. 2026

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 20 Aug 2026 10:15:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.5 (FreeBSD))

(envelope-from )

id 1wx5Pq-00000000MH8-12pj

for dave@doctor.nl2k.ab.ca;

Thu, 20 Aug 2026 10:14:54 -0600

Resent-From: The Doctor

Resent-Date: Thu, 20 Aug 2026 10:14:54 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from s.wrqvqsbb.outbound-mail.sendgrid.net ([149.72.70.187]:6838)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.99.5 (FreeBSD))

(envelope-from )

id 1wx3Sp-00000000LgX-1GNh

for root@nk.ca;

Thu, 20 Aug 2026 08:09:59 -0600

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=rieyjc.com;

h=from:subject:date:mime-version:to:content-type:cc:content-type:date:

from:subject:to;

s=s1; t=1787234938;

bh=Ux0fq1jmTKu8FbDXYBIPvNOpZbMp+n4IrdVSpArl5IQ=;

b=bZYjVhteTHSwyVRev1s1CRJ4izmG/voBS4b3sGeohr1ixZYrrw6cB/mhDgJ34Rwfeg1t

PDpyKv4sI1Pbx+fNtekurpka+/9Q3BGrGXq3a9sP37WrfXVhBpsIQwCMXDSMP5iMv2zjUo

6kCSxiId5rgSe2k28GeU6td+N48z9gggSHWcQwgQxs2j0P2NhREprGpVR7uPRR5fBSbfox

/azY73wxn5n2Z5MTRuCGy5TW8PtzNgs7Oru1E5LM9P3G01bDCZKW42HlQhVkn2eZhcib7x

euJhbxrs0yyBHxkEzkdETBlbCZjQXA+GdIedC48uiGjbb/2hyrFivhRslYUem8Rg==

Received: by recvd-6cfbc786db-lqgpm with SMTP id recvd-6cfbc786db-lqgpm-1-6A870A7A-7

2026-08-20 14:08:58.041322547 +0000 UTC m=+1970202.041859720

Received: from electricien-neuilly-sur-seine.fr (unknown)

by geopod-ismtpd-11 (SG) with ESMTP id H3jRsznDRmW3C4J1HmvSJQ

for ; Thu, 20 Aug 2026 14:08:57.980 +0000 (UTC)

Message-Id: <248c021f279bd83802a8eedb08267249@rieyjc.com>

From: National Bank Direct Brokerage-Support

Subject: Action Needed: Review Your Brokerage Account Information

Date: Thu, 20 Aug 2026 14:08:58 +0000 (UTC)

X-Priority: 3

X-Mailer: GMVWE 899.54163.20155

Mime-Version: 1.0

X-SG-EID:

=?us-ascii?Q?u001=2EqSrTYuf+buIuYTIRkkJ60PaCuK8FLEKUxWjcziMBe2+9omSbt9vAfq2yq?=

=?us-ascii?Q?HqJDvTbPKCE24L5IguTXFY=2FxlogE6P6zrk5MjKZ?=

=?us-ascii?Q?+c47gPmsDRIWTF+McjDPuL7k03djWVoG3rNUDF8?=

=?us-ascii?Q?TB60FVAlWYcrTbUVEoj3RMV2G80L+m1st33+hpF?=

=?us-ascii?Q?nRiKq+H+DM=2F3UWN9=2FcMb+yaQuIHERpgLpFqbgif?=

=?us-ascii?Q?7Arf7uvG6XWoeSCMErUZu4jZj7CTD70=2F0Ntg4jC?=

=?us-ascii?Q?fZEjthfmu69TBv0rHJ0b4qO8jw=3D=3D?=

To: root

X-Entity-ID: u001.yrMYZx4YSB2QzXiC3cfc3w==

Content-Type: multipart/alternative;

boundary="324106537a241c5ea8379fdd000f1111"

X-Spam_score: 28.2

X-Spam_score_int: 282

X-Spam_bar: ++++++++++++++++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.

Content preview: Action Needed: Review Your Brokerage Account Information MESSAGE

CONFIRMATION Action Needed: Review Your Brokerage Account InformationDear

Client,Your brokerage account currently requires an account i [...]

Content analysis details: (28.2 points, 5.0 required)

pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[149.72.70.187 listed in will-spam-for-food.eu.org]

[149.72.70.187 listed in will-spam-for-food.eu.org]

[149.72.70.187 listed in will-spam-for-food.eu.org]

[149.72.70.187 listed in will-spam-for-food.eu.org]

[149.72.70.187 listed in will-spam-for-food.eu.org]

[149.72.70.187 listed in will-spam-for-food.eu.org]

[149.72.70.187 listed in will-spam-for-food.eu.org]

[149.72.70.187 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[149.72.70.187 listed in dnsbl.ahbl.org]

[149.72.70.187 listed in dnsbl.ahbl.org]

[149.72.70.187 listed in dnsbl.ahbl.org]

[149.72.70.187 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[149.72.70.187 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[149.72.70.187 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[149.72.70.187 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[149.72.70.187 listed in dnsbl.ahbl.org]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

2.5 URIBL_DBL_SPAM Contains a spam URL listed in the DBL blocklist

[URI: rieyjc.com]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[149.72.70.187 listed in bl.score.senderscore.com]

1.6 RCVD_IN_MSPIKE_L3 RBL: Low reputation (-3)

[149.72.70.187 listed in bl.mailspike.net]

-0.0 SPF_PASS SPF: sender matches SPF record

0.0 RCVD_IN_MSPIKE_BL Mailspike blacklisted

15 GR_DOMAIN_SENDGR1 Received contains spammer id (sendgr)

0.8 ZMIvirSobY_SUB39 SPAM from Sober-Y-Virus

0.6 J_CHICKENPOX_64 BODY: 6alpha-pock-4alpha

0.6 J_CHICKENPOX_63 BODY: 6alpha-pock-3alpha

0.6 J_CHICKENPOX_37 BODY: 3alpha-pock-7alpha

1.5 MR_STRANGE_QUESTION URI: No description available.

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

0.8 SARE_FROM_SPAM_WORD3 I don't know people named this!

1.0 ACCT_PHISHING Possible phishing for account information

1.0 XPRIO Has X-Priority header

0.9 URI_PHISH Phishing using web form

Subject: {SPAM?} Action Needed: Review Your Brokerage Account Information

This is a multi-part message in MIME format.

--324106537a241c5ea8379fdd000f1111

Content-Type: text/plain; charset=iso-8859-1

Content-Transfer-Encoding: quoted-printable

Action Needed: Review Your Brokerage Account Information MESSAGE CONFIRMAT=

ION Action Needed: Review Your Brokerage Account InformationDear Client,You=

r brokerage account currently requires an account information review.Keepin=

g your account details accurate and up to date is important for the ongoing=

use of your brokerage account and related services. Please verify the info=

rmation registered to your account and make any necessary updates where app=

licable.To complete this account task, please use the secure review page pr=

ovided below: Complete Update.Once the requested information has been submi=

tted, the account update will be processed and reflected in your brokerage =

profile. You will receive notification when the review has been completed.I=

f the required update remains outstanding, certain account functions may be=

affected. This may include temporary limitations on trading, transactions,=

account services, or other available features.If you have any questions re=

garding this request, please reach customer assistance through the official=

support channel. Stay connectedTerms of use|Privacy policy|ABC's of securi=

ty=A9 National Bank of Canada. All rights reserved. Any reproduction, in wh=

ole or in part, is strictly prohibited without the prior written consent of=

National Bank of Canada. National Bank of Canada, 800 St-Jacques Street, M=

ontreal (Quebec)H3C 1A3nbc.caFor options to unsubscribe, click here. CONFID=

ENTIALIT=C9 : Ce document est destin=E9 uniquement =E0 la personne ou =E0 l=

'entit=E9 =E0 qui il est adress=E9. L'information apparaissant dans ce docu=

ment est de nature l=E9galement privil=E9gi=E9e et confidentielle. Si vous =

n'=EAtes pas le destinataire vis=E9 ou la personne charg=E9e de le remettre=

=E0 son destinataire, vous =EAtes, par la pr=E9sente, avis=E9 que toute le=

cture, usage, copie ou communication du contenu de ce document est strictem=

ent interdit. De plus, vous =EAtes pri=E9 de communiquer avec l'exp=E9diteu=

r sans d=E9lai et de d=E9truire ce document imm=E9diatement. CONFIDENTIALIT=

Y: This document is intended solely for the individual or entity to whom it=

is addressed. The information contained in this document is legally privil=

eged and confidential. If you are not the intended recipient or the person =

responsible for delivering it to the intended recipient, you are hereby adv=

ised that you are strictly prohibited from reading, using, copying or disse=

minating the contents of this document. Please inform the sender immediatel=

y and delete this document immediately.=20=

--324106537a241c5ea8379fdd000f1111

Content-Type: text/html; charset=iso-8859-1

Content-Transfer-Encoding: quoted-printable

Action Needed: Review Your Brokerage Account Information=<br /><br />

0>

style=3D"FONT-SIZE: 11px; FONT-FAMILY: Arial,sans-serif,'Open Sans'; CO=

LOR: #666666; PADDING-BOTTOM: 45px; LINE-HEIGHT: 12px"=20

vAlign=3Dtop width=3D600 align=3Dleft>
style=3D"TEXT-DECORATION: underline; COLOR: #666666"=20

href=3D"https://z7f2p6w1j9t4g8b3mx.live" target=3D_blank>
style=3D"DISPLAY: block" border=3D0 alt=3D"Button to the BNC website"=

=20

src=3D"https://www.bnc.ca/content/dam/bnc/formulaires/picto/NB_2D_RGB=

.jpg"=20

width=3D217>

der=3D0>

DY>

E>

der=3D0>

align=3Dcenter>
gn=3Dcenter=20

border=3D0>

style=3D"FONT-SIZE: 14px; FONT-FAMILY: Arial,sans-serif,'Open San=

s'; COLOR: #333333; LINE-HEIGHT: 19px"=20

vAlign=3Dtop width=3D600 align=3Dleft>

0>

align=3Dleft> 3D""=20<br

src=3D"https://www.bnc.ca/content/dam/bnc/formulaires/mod=

ele-courriel/icon-confirm-84x44.gif"=20

width=3D42 height=3D22>

style=3D"FONT-SIZE: 14px; FONT-FAMILY: Arial,sans-serif; =

FONT-WEIGHT: bold; COLOR: #ffffff; PADDING-BOTTOM: 0px; PADDING-TOP: 0px; P=

ADDING-LEFT: 0px; MARGIN: 0px; LINE-HEIGHT: 19px; PADDING-RIGHT: 0px">MESSA=

GE=20

CONFIRMATION=20

Y>

der=3D0>

der=3D0>

style=3D"FONT-SIZE: 14px; FONT-FAMILY: Arial,sans-serif,'Open San=

s'; COLOR: #333333; LINE-HEIGHT: 19px"=20

vAlign=3Dtop align=3Dleft>

style=3D"FONT-SIZE: 20px; FONT-FAMILY: Arial,sans-serif; FONT-W=

EIGHT: normal; COLOR: #00334d; PADDING-BOTTOM: 0px; PADDING-TOP: 0px; PADDI=

NG-LEFT: 0px; MARGIN: 0px; LINE-HEIGHT: 24px; PADDING-RIGHT: 0px">Action=20

Needed: Review Your Brokerage Account Information

style=3D"FONT-SIZE: 10px; HEIGHT: 10px; LINE-HEIGHT: 10px">
V>Dear=20

Client,

Your brokerage account currently requires an acc=

ount=20

information review.

Keeping your account details accurat=

e and=20

up to date is important for the ongoing use of your brokerage=20

account and related services. Please verify the information=20

registered to your account and make any necessary updates where=

=20

applicable.

To complete this account task, please use th=

e=20

secure review page provided below:
href=3D"https://z7f2p6w1j9t4g8b3mx.live">Complete=20

Update.

Once the requested information has been=20

submitted, the account update will be processed and reflected i=

n=20

your brokerage profile. You will receive notification when the=20

review has been completed.

If the required update remain=

s=20

outstanding, certain account functions may be affected. This ma=

y=20

include temporary limitations on trading, transactions, account=

=20

services, or other available features.

If you have any=20

questions regarding this request, please reach customer assista=

nce=20

through the official support channel.=20

der=3D0>

align=3Dcenter>
der=3D0>

der=3D0>

style=3D"BORDER-TOP: #a6a6a6 1px solid; BORDER-BOTTOM: #a6a6a6 1px soli=

d; PADDING-BOTTOM: 12px; PADDING-TOP: 12px"=20

vAlign=3Dtop align=3Dcenter>

R>

er=20

border=3D0>

>
style=3D"WIDTH: 630px; MIN-WIDTH: 630px; MIN-HEIGHT: 1px;=

DISPLAY: block; MAX-HEIGHT: 1px"=20

alt=3D""=20

src=3D"https://www.bnc.ca/content/dam/bnc/formulaires/mod=

ele-courriel/spacer-social-media-1x1.gif"=20

width=3D630 height=3D1>

er=20

border=3D0>

ABLE>

=3Dcenter=20

border=3D0>

height=3D1>
style=3D"WIDTH: 600px; MIN-WIDTH: 600px; MIN-HEIGHT=

: 1px; DISPLAY: block; MAX-HEIGHT: 1px"=20

alt=3D""=20

src=3D"https://www.bnc.ca/content/dam/bnc/formulair=

es/modele-courriel/spacer-social-media-1x1.gif"=20

width=3D600 height=3D1>

TD>

er=3D0>

style=3D"FONT-SIZE: 11px; FONT-FAMILY: Arial,sans-ser=

if,'Open Sans'; COLOR: #000000; LINE-HEIGHT: 15px; PADDING-RIGHT: 4px"=20

vAlign=3Dmiddle align=3Dright>Stay connected

style=3D"FONT-SIZE: 11px; FONT-FAMILY: Arial,sans-ser=

if,'Open Sans'; COLOR: #000000; PADDING-LEFT: 6px; LINE-HEIGHT: 15px"=20

vAlign=3Dmiddle width=3D25 align=3Dleft>
href=3D"https://www.facebook.com/nationalbanknetwor=

ks"=20

target=3D_blank> 3D""=20<br

src=3D"https://www.bnc.ca/content/dam/bnc/formulair=

es/modele-courriel/icon-facebook-25x25.gif"=20

width=3D25 height=3D25>

style=3D"FONT-SIZE: 11px; FONT-FAMILY: Arial,sans-ser=

if,'Open Sans'; COLOR: #000000; PADDING-LEFT: 6px; LINE-HEIGHT: 15px"=20

vAlign=3Dmiddle width=3D25 align=3Dleft>
href=3D"https://twitter.com/nationalbank/"=20

target=3D_blank> 3D""=20<br

src=3D"https://www.bnc.ca/content/dam/bnc/formulair=

es/modele-courriel/icon-twitter-25x25.gif"=20

width=3D25 height=3D25>

style=3D"FONT-SIZE: 11px; FONT-FAMILY: Arial,sans-ser=

if,'Open Sans'; COLOR: #000000; PADDING-LEFT: 6px; LINE-HEIGHT: 15px"=20

vAlign=3Dmiddle width=3D25 align=3Dleft>
href=3D"https://www.youtube.com/user/nationalbankne=

tworks"=20

target=3D_blank> 3D""=20<br

src=3D"https://www.bnc.ca/content/dam/bnc/formulair=

es/modele-courriel/icon-youtube-25x25.gif"=20

width=3D25 height=3D25>

style=3D"FONT-SIZE: 11px; FONT-FAMILY: Arial,sans-ser=

if,'Open Sans'; COLOR: #000000; PADDING-LEFT: 6px; LINE-HEIGHT: 15px"=20

vAlign=3Dmiddle width=3D25 align=3Dleft>
href=3D"https://www.linkedin.com/company/national-b=

ank-of-canada/"=20

target=3D_blank> 3D""=20<br

src=3D"https://www.bnc.ca/content/dam/bnc/formulair=

es/modele-courriel/icon-linkedin-25x25.gif"=20

width=3D25=20

height=3D25>

der=3D0>

der=3D0>

style=3D"FONT-SIZE: 11px; FONT-FAMILY: Arial,sans-serif,'Open San=

s'; COLOR: #686868; PADDING-BOTTOM: 30px; PADDING-TOP: 30px; LINE-HEIGHT: 1=

5px"=20

vAlign=3Dtop align=3Dleft>

style=3D"FONT-SIZE: 11px; FONT-FAMILY: Arial,sans-serif,'Op=

en Sans'; COLOR: #686868; PADDING-BOTTOM: 15px; LINE-HEIGHT: 15px"=20

vAlign=3Dmiddle align=3Dleft>
style=3D"TEXT-DECORATION: underline; COLOR: #686868"=20

href=3D"https://www.nbc.ca/terms-of-use.html?utm_campaign=

=3Dacq_credit-card_aem-forms-email_en&utm_medium=3Demail&utm_source=

=3Depush-bnc&utm_content=3Dinterrompu&utm_term=3D"=20

target=3D_blank>Terms of=20

use

style=3D"FONT-SIZE: 11px; FONT-FAMILY: Arial,sans-serif,'Op=

en Sans'; COLOR: #686868; PADDING-BOTTOM: 15px; LINE-HEIGHT: 15px"=20

vAlign=3Dmiddle width=3D20 align=3Dcenter>|

style=3D"FONT-SIZE: 11px; FONT-FAMILY: Arial,sans-serif,'Op=

en Sans'; COLOR: #686868; PADDING-BOTTOM: 15px; LINE-HEIGHT: 15px"=20

vAlign=3Dmiddle align=3Dleft>
style=3D"TEXT-DECORATION: underline; COLOR: #686868"=20

href=3D"https://www.nbc.ca/privacy-policy.html?utm_campai=

gn=3Dacq_credit-card_aem-forms-email_en&utm_medium=3Demail&utm_sour=

ce=3Depush-bnc&utm_content=3Dinterrompu&utm_term=3D"=20

target=3D_blank>Privacy=20

policy

style=3D"FONT-SIZE: 11px; FONT-FAMILY: Arial,sans-serif,'Op=

en Sans'; COLOR: #686868; PADDING-BOTTOM: 15px; LINE-HEIGHT: 15px"=20

vAlign=3Dmiddle width=3D20 align=3Dcenter>|

style=3D"FONT-SIZE: 11px; FONT-FAMILY: Arial,sans-serif,'Op=

en Sans'; COLOR: #686868; PADDING-BOTTOM: 15px; LINE-HEIGHT: 15px"=20

vAlign=3Dmiddle align=3Dleft>
style=3D"TEXT-DECORATION: underline; COLOR: #686868"=20

href=3D"https://www.nbc.ca/abcs-of-security.html?utm_camp=

aign=3Dacq_credit-card_aem-forms-email_en&utm_medium=3Demail&utm_so=

urce=3Depush-bnc&utm_content=3Dinterrompu&utm_term=3D"=20

target=3D_blank>ABC's of=20

security

style=3D"FONT-SIZE: 15px; HEIGHT: 15px; LINE-HEIGHT: 15px">
V>
style=3D"FONT-SIZE: 8px; VERTICAL-ALIGN: 5px; LINE-HEIGHT: 0">=

=A9=20

National Ba=

nk of=20

Canada. All rights reserved. Any reproduction, in whole or in p=

art,=20

is strictly prohibited without the prior written consent of
AN=20

style=3D"WHITE-SPACE: nowrap">National Bank of Cana=

da.=20

National Bank of Canada, 800 St-Jacques Street,=20

Montreal (Quebec)
style=3D"WHITE-SPACE: nowrap">H3C 1A3

>
style=3D"TEXT-DECORATION: underline; COLOR: #686868"=20

href=3D"https://www.nbc.ca?utm_campaign=3Dacq_credit-card_aem-f=

orms-email_en&utm_medium=3Demail&utm_source=3Depush-bnc&utm_con=

tent=3Dconfirmation&utm_term=3D"=20

target=3D_blank>
style=3D"COLOR: #686868">nbc.ca

For options t=

o=20

unsubscribe,
6868"=20

href=3D"https://www.nbc.ca/forms/communications/withdraw-consen=

t.html"=20

target=3D_blank>click here
>.=20

DY>

style=3D"FONT-SIZE: 8pt; FONT-FAMILY: 'Cambria','times roman',serif; LINE-H=

EIGHT: 10pt">
CONFIDENTIALIT=C9=20

: Ce document est destin=E9 uniquement =E0 la personne ou =E0 l'entit=E9 =

=E0 qui il est=20

adress=E9. L'information apparaissant dans ce document est de nature l=E9ga=

lement=20

privil=E9gi=E9e et confidentielle. Si vous n'=EAtes pas le destinataire vis=

=E9 ou la=20

personne charg=E9e de le remettre =E0 son destinataire, vous =EAtes, par la=

pr=E9sente,=20

avis=E9 que toute lecture, usage, copie ou communication du contenu de ce d=

ocument=20

est strictement interdit. De plus, vous =EAtes pri=E9 de communiquer avec=20

l'exp=E9diteur sans d=E9lai et de d=E9truire ce document imm=E9diatement.=20

CONFIDENTIALITY: This document is intended solely for the individual or=

=20

entity to whom it is addressed. The information contained in this document =

is=20

legally privileged and confidential. If you are not the intended recipient =

or=20

the person responsible for delivering it to the intended recipient, you are=

=20

hereby advised that you are strictly prohibited from reading, using, copyin=

g or=20

disseminating the contents of this document. Please inform the sender=20

immediately and delete this document immediately.

--324106537a241c5ea8379fdd000f1111--

National Bank phish from Sendgrid

Posted by Dave Yadallee on Friday, August 21. 2026

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 20 Aug 2026 10:15:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.5 (FreeBSD))

(envelope-from )

id 1wx5Pl-00000000MGE-1aMn

for dave@doctor.nl2k.ab.ca;

Thu, 20 Aug 2026 10:14:49 -0600

Resent-From: The Doctor

Resent-Date: Thu, 20 Aug 2026 10:14:49 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from s.wrqvqsbb.outbound-mail.sendgrid.net ([149.72.70.187]:64524)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.99.5 (FreeBSD))

(envelope-from )

id 1wx3NO-00000000KEg-2u1Q

for doctor@doctor.nl2k.ab.ca;

Thu, 20 Aug 2026 08:04:22 -0600

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gywqi.com;

h=from:subject:date:mime-version:to:content-type:cc:content-type:date:

from:subject:to;

s=s1; t=1787234601;

bh=QBVHvZOShbdi6GlXsez1BA1vShnsgOHrPTP63nvohYQ=;

b=Uu0tEL7FgnXqQxWQerAPbfHyhOcF17tv2sh9HRzg4wlvy5HPILaOLzJXfi1C5v4gVw0H

Zxxd8INw2YB5/bOBj3XQydcwlL5VC83QC6SExtszuCA7sKQ5XUGZwD5p/uztRfxC1EYtY9

RQEiHdqMBTodvnGNoxvN/oa6/NfGYRzCzvurwooM9ytkh2g+7j8ahRSW/sgZgSPR7xKLhz

aYnQ47l81stYwhLQALhRZvvGZeErIk3jdxVw8m7lNxtVZK1CIgHOql/C0WsVvzwWYq7fio

YDY+rNX4Cmtj3MJf6iMGOIbBrfGQPiLhsWmYvUrye80q8rTD4NNsOHQHB+CgTqmA==

Received: by recvd-75c96bbb78-t4k4l with SMTP id recvd-75c96bbb78-t4k4l-1-6A870929-4C

2026-08-20 14:03:21.216668013 +0000 UTC m=+1969865.210055325

Received: from dryuptechnology.com (unknown)

by geopod-ismtpd-0 (SG)

with ESMTP id iXExYestTmSRWSl12iCejg

for ;

Thu, 20 Aug 2026 14:03:20.984 +0000 (UTC)

Message-Id: <0cd6cfcbaf98b2374f72db9c35d91643@gywqi.com>

From: National Bank Direct Brokerage-Secure <1OE8I9@gywqi.com>

Subject: Important Brokerage Account Information Update

Date: Thu, 20 Aug 2026 14:03:21 +0000 (UTC)

X-Priority: 3

X-Mailer: Goryt Tajqxxurhgf Vwhranqywqqc 169

Mime-Version: 1.0

X-SG-EID:

=?us-ascii?Q?u001=2EqSrTYuf+buIuYTIRkkJ60PaCuK8FLEKUxWjcziMBe28GJ21d6ci3ZY1E8?=

=?us-ascii?Q?jMGVY5cm83vgvA+Us9Q9w7ImkWPdFJQRfgud8le?=

=?us-ascii?Q?HERqSzGMb8CXcQaFblygry59Epzlazh0I0GZWV0?=

=?us-ascii?Q?gknoE4AuTzKds6hvLI9ROMACj1sxheBdTFe=2FOKQ?=

=?us-ascii?Q?TufnOsQYeQlzdaWrNe2aiH4XKsvHm5u2Sljbz4c?=

=?us-ascii?Q?2XL2PIW+QOGPizLF18r46ozxY4G55nNnVMzoV4K?=

=?us-ascii?Q?2wP3yZifh9jxSlfvGhZs6+w8uA=3D=3D?=

To: doctor

X-Entity-ID: u001.hwz/4ON2U4jEhsV5As9sWA==

Content-Type: multipart/alternative;

boundary="9e752fd94d989cc6f97d599900011641"

X-Spam_score: 34.7

X-Spam_score_int: 347

X-Spam_bar: ++++++++++++++++++++++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.

Content preview: Important Brokerage Account Information Update MESSAGE CONFIRMATION

Important Brokerage Account Information UpdateDear Client,This message is

regarding a pending account maintenance requirement for yo [...]

Content analysis details: (34.7 points, 5.0 required)

pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[149.72.70.187 listed in will-spam-for-food.eu.org]

[149.72.70.187 listed in will-spam-for-food.eu.org]

[149.72.70.187 listed in will-spam-for-food.eu.org]

[149.72.70.187 listed in will-spam-for-food.eu.org]

[149.72.70.187 listed in will-spam-for-food.eu.org]

[149.72.70.187 listed in will-spam-for-food.eu.org]

[149.72.70.187 listed in will-spam-for-food.eu.org]

[149.72.70.187 listed in will-spam-for-food.eu.org]

1.6 RCVD_IN_MSPIKE_L3 RBL: Low reputation (-3)

[149.72.70.187 listed in bl.mailspike.net]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[149.72.70.187 listed in dnsbl.ahbl.org]

[149.72.70.187 listed in dnsbl.ahbl.org]

[149.72.70.187 listed in dnsbl.ahbl.org]

[149.72.70.187 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[149.72.70.187 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[149.72.70.187 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[149.72.70.187 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[149.72.70.187 listed in dnsbl.ahbl.org]

2.5 URIBL_DBL_SPAM Contains a spam URL listed in the DBL blocklist

[URI: gywqi.com]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[149.72.70.187 listed in bl.score.senderscore.com]

-0.0 SPF_PASS SPF: sender matches SPF record

0.0 RCVD_IN_MSPIKE_BL Mailspike blacklisted

15 GR_DOMAIN_SENDGR1 Received contains spammer id (sendgr)

0.8 ZMIvirSobY_SUB39 SPAM from Sober-Y-Virus

2.0 TVD_PH_REC BODY: Message includes a phrase commonly used in phishing

mails

0.6 J_CHICKENPOX_64 BODY: 6alpha-pock-4alpha

0.6 J_CHICKENPOX_63 BODY: 6alpha-pock-3alpha

0.6 J_CHICKENPOX_37 BODY: 3alpha-pock-7alpha

1.5 MR_STRANGE_QUESTION URI: No description available.

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

2.5 XM_RANDOM X-Mailer apparently random

2.0 MIXED_HREF_CASE Has href in mixed case

0.8 SARE_FROM_SPAM_WORD3 I don't know people named this!

1.0 ACCT_PHISHING Possible phishing for account information

1.0 XPRIO Has X-Priority header

0.9 URI_PHISH Phishing using web form

Subject: {SPAM?} Important Brokerage Account Information Update

Button to the BNC website

MESSAGE CONFIRMATION

Important Brokerage Account Information Update

Dear Client,

This message is regarding a pending account maintenance requirement for your brokerage account.

As part of maintaining current and accurate account records, you are required to review and update your account information. Keeping these details current helps ensure that your brokerage account remains available for normal use and that applicable account services can continue without interruption.

Please complete the required account information update through the secure page below: Complete Update.

Following submission, the updated information will be processed and applied to your account record. A confirmation will be provided after the account task has been successfully finalized.

Until the required update is completed, access to certain account services or functions may be subject to temporary restrictions. This may include trading activity, transaction processing, or other brokerage account features.

For further assistance, please contact the official customer support team.

Stay connected

Terms of use | Privacy policy | ABC's of security

© National Bank of Canada. All rights reserved. Any reproduction, in whole or in part, is strictly prohibited without the prior written consent of National Bank of Canada.

National Bank of Canada, 800 St-Jacques Street, Montreal (Quebec) H3C 1A3

nbc.ca

For options to unsubscribe, click here.

CONFIDENTIALITÉ : Ce document est destiné uniquement à la personne ou à l'entité à qui il est adressé. L'information apparaissant dans ce document est de nature légalement privilégiée et confidentielle. Si vous n'êtes pas le destinataire visé ou la personne chargée de le remettre à son destinataire, vous êtes, par la présente, avisé que toute lecture, usage, copie ou communication du contenu de ce document est strictement interdit. De plus, vous êtes prié de communiquer avec l'expéditeur sans délai et de détruire ce document immédiatement.

CONFIDENTIALITY: This document is intended solely for the individual or entity to whom it is addressed. The information contained in this document is legally privileged and confidential. If you are not the intended recipient or the person responsible for delivering it to the intended recipient, you are hereby advised that you are strictly prohibited from reading, using, copying or disseminating the contents of this document. Please inform the sender immediately and delete this document immediately.

Business Broker spam from Google Gmail

Posted by Dave Yadallee on Friday, August 21. 2026

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 20 Aug 2026 10:15:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.5 (FreeBSD))

(envelope-from )

id 1wx5Pg-00000000MFN-0djH

for dave@doctor.nl2k.ab.ca;

Thu, 20 Aug 2026 10:14:44 -0600

Resent-From: The Doctor

Resent-Date: Thu, 20 Aug 2026 10:14:44 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-yw1-f169.google.com ([209.85.128.169]:44068)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.99.5 (FreeBSD))

(envelope-from )

id 1wx3MZ-00000000K07-2Qyc

for sales@nk.ca;

Thu, 20 Aug 2026 08:03:36 -0600

Received: by mail-yw1-f169.google.com with SMTP id 00721157ae682-836c8bdac50so33628147b3.0

for ; Thu, 20 Aug 2026 07:02:36 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=bankingtheadvisoryib.com; s=google; t=1787234550; x=1787839350; darn=nk.ca;

h=content-type:mime-version:date:content-transfer-encoding:subject:to

:from:references:in-reply-to:message-id:from:to:cc:subject:date

:message-id:reply-to:content-type;

bh=i4QjuTNwKZMpL6gC+niWZZl8b2eB0SemAUcaNX/Wa3w=;

b=fJf6rn8rGFpUgCF4L8nT3N7M1DxbBqzUN+yiBXoBrxne1u6sTsQffCeZEcNi0u+D2q

hObvJijh41IIrliBGR9eUOZTElp2MriUGsKVAmhrM7URLULWbQAynDGpWy2FKcfm2wdC

vP5IXaJoqOWH2Y3P6WX7Id/aw1VoBj8Nt0HiHqNheiatpVde2UIlbihI9jWLMPTaqCqL

V4YJJLNr1cpH6lMbLYTyBN6tIAITvmTONdtk45fY0Qw1D8YHHLA41J+W4R5sycSggPOq

f/R3juyTFNVCoFNJ1QMKNVmx97YIjrzTLUKa46AyxKxCf4avNwNl7SlulpHTe1pBlxbD

z1xQ==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20251104; t=1787234550; x=1787839350;

h=content-type:mime-version:date:content-transfer-encoding:subject:to

:from:references:in-reply-to:message-id:x-gm-gg:x-gm-message-state

:from:to:cc:subject:date:message-id:reply-to:content-type;

bh=i4QjuTNwKZMpL6gC+niWZZl8b2eB0SemAUcaNX/Wa3w=;

b=FgZAsbFMmm2ZFsd91s5jXZPD73UTXeTLU5l+JN50+0hqhxOjnTm2qXSrYs6nZ9oz3R

J0mMH2X8SvjCibq5en8TLjXdnEVg+yjAM6Smp6U5+rtY9RK9ceiSD51sO4akcB3rm49N

O0iUtfLY2bvVzmRWEZcPFHN7s8mPoZs5bGggBfgA7ALqOdByMF9St62xRZ7TeH6JsUBC

8ZgfyshF1DQgg7b1toUlVzZT3YJB9aJWQqA6pdtt2WbL3bSYa2w8V6wKnqyB8c5NTH6m

khK3Nz6KTpiaaASH9tW2U53U38P0vhzwq+oAkr+uulGzHE/ZS7RV7XbSK+Ww38MEZ8EL

h+UQ==

X-Gm-Message-State: AFuF++le6LUF7pQ094w9aKGPvZj65mRiP+A230F844jNEWL7HkK8ay38

Rag6OuUkGUyGSEucxUEHyLq60VJbMfvc2iVyKJo/KuaGxig1yhwg7Vv+pmGKQT7KynXMn1aB1LW

2MIBNYA==

X-Gm-Gg: AR+sD10lJq+v3Ns6eJRJwAvhS8roOPru59Cf9WX03NDrKieZ7ydr6sN60A2WY138CBA

TnKX8o0nlVsc3Z92mBP2feYbJaWZTJ7GISfRZaQLfASqDTN8fEJuoRszvmeauDIhLWpFjmTxPF5

3dgLT4Cn8ONN3WbIYJS+BEQEyGfDcG2PPzQO33sL1K7fVE/uPiPAeAyXAw+7kHsNSxVq8Im01bL

Sev7LIh+oix8jE+42wD0Mddk4G8beuk22j/gqLeBIWmYBbko5i3JhMt0XPxFEQNM2E6KH4iHVqa

Uk4hBaL/xwUXx5L8ZYfFfrwx4M9QLfY0TsBEUoLG/rz+YOKUNJ7uHiwcWJTS4XzCaUojAa4iKgY

lWMSXuiv0OvXJrDLTdMvZEPEVxQHqZrPFndftT6PKZSQHNV5L8XN8EWR7hdyfrIhRRiG6OD2CYP

qnpQtpB/AHtf2153WL5YMjfNc+kzY8Xoo48b14jK8u2/AE6WQuZ3Y03Jl4c+f8jCFQ4b1M7nwQw

7i+c36yy+5r/PlpFsLgQwmRwcerYtGr1HQqCYnLp80crP2i3N0jsVM3tDp0Stnj57YH+bthPBGX

1NDB6SssccBBtrmdxP2YiT7Acw==

X-Received: by 2002:a05:690c:397:b0:847:8ef9:fa30 with SMTP id 00721157ae682-8478f093db2mr19746907b3.13.1787234548583;

Thu, 20 Aug 2026 07:02:28 -0700 (PDT)

Received: from 01a01f7a-f363-7221-a099-00339bcf7bb6.local (ec2-35-168-20-52.compute-1.amazonaws.com. [35.168.20.52])

by smtp.gmail.com with ESMTPSA id 00721157ae682-84512664915sm24128107b3.13.2026.08.20.07.02.27

for

(version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256);

Thu, 20 Aug 2026 07:02:27 -0700 (PDT)

Message-ID: <01a01f7a-f363-7221-a099-00339bcf7bb6@bankingtheadvisoryib.com>

In-Reply-To:

<01a0100e-b9f5-703d-8d3b-111f37b9c027@bankingtheadvisoryib.com>

References: <01a0100e-b9f5-703d-8d3b-111f37b9c027@bankingtheadvisoryib.com>

X-Mail-Abuse-Inquiries:

https://app.instantly.ai/privacy/report-abuse/01a01f7a-f363-7221-a099-00339bcf7bb6

From: Oliver Bogner

To: sales@nk.ca

Subject: Re: Buyer for Netknow Internet Knowledge

Content-Transfer-Encoding: quoted-printable

Date: Thu, 20 Aug 2026 14:02:26 +0000

MIME-Version: 1.0

Content-Type: text/plain; charset=utf-8

X-Spam_score: 7.0

X-Spam_score_int: 70

X-Spam_bar: +++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.

Content preview: Free on Tuesday? Oliver Bogner Managing Partner | The Advisory

Investment Bank Q1 2026 #1 Lower Middle Market Investment Bank on Axial 5x

Top 5 Lower Middle Market Investment Bank on Axial 2x Forbes 30 Under 30

Alumni [...]

Content analysis details: (7.0 points, 5.0 required)

pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[35.168.20.52 listed in will-spam-for-food.eu.org]

[35.168.20.52 listed in will-spam-for-food.eu.org]

[35.168.20.52 listed in will-spam-for-food.eu.org]

[35.168.20.52 listed in will-spam-for-food.eu.org]

[35.168.20.52 listed in will-spam-for-food.eu.org]

[35.168.20.52 listed in will-spam-for-food.eu.org]

[35.168.20.52 listed in will-spam-for-food.eu.org]

[35.168.20.52 listed in will-spam-for-food.eu.org]

[209.85.128.169 listed in will-spam-for-food.eu.org]

[209.85.128.169 listed in will-spam-for-food.eu.org]

[209.85.128.169 listed in will-spam-for-food.eu.org]

[209.85.128.169 listed in will-spam-for-food.eu.org]

[209.85.128.169 listed in will-spam-for-food.eu.org]

[209.85.128.169 listed in will-spam-for-food.eu.org]

[209.85.128.169 listed in will-spam-for-food.eu.org]

[209.85.128.169 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[209.85.128.169 listed in dnsbl.ahbl.org]

[209.85.128.169 listed in dnsbl.ahbl.org]

[209.85.128.169 listed in dnsbl.ahbl.org]

[209.85.128.169 listed in dnsbl.ahbl.org]

[35.168.20.52 listed in dnsbl.ahbl.org]

[35.168.20.52 listed in dnsbl.ahbl.org]

[35.168.20.52 listed in dnsbl.ahbl.org]

[35.168.20.52 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[209.85.128.169 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[209.85.128.169 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[209.85.128.169 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[209.85.128.169 listed in dnsbl.ahbl.org]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-0.0 SPF_PASS SPF: sender matches SPF record

1.9 URIBL_ABUSE_SURBL Contains an URL listed in the ABUSE SURBL blocklist

[URI: bankingtheadvisoryib.com]

1.9 URIBL_JP_SURBL Contains an URL listed in the JP SURBL blocklist

[URI: bankingtheadvisoryib.com]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[209.85.128.169 listed in bl.score.senderscore.com]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[209.85.128.169 listed in list.dnswl.org]

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[209.85.128.169 listed in wl.mailspike.net]

2.0 RATWR8_MESSID Message-ID with excessive dashes and dollars

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

Subject: {SPAM?} Re: Buyer for Netknow Internet Knowledge

Free on Tuesday?

Oliver Bogner

Managing Partner | The Advisory Investment =

Bank

Q1 2026 #1 Lower Middle Market Investment Bank on Axial

5x Top 5 Lower Middle Market Investment Bank on Axial

2x Forbes 30 Under 30 Alumni | 2x Inc 5,000 CEO

On Mon, August 17, 2026 =

2:09 PM, Oliver Bogner

[ceo@bankingtheadvisoryib.com]> wrote:

> Hey,

>=20

> We're the number 1-ranked lower middle market investment bank in the US =

(Axial, 2026) and there's a buyer who reached out specifically regarding =

Netknow Internet Knowledge.

>=20

> I understand your journey firsthand - =

personally sold five-plus companies, and that's precisely why I founded The=

Advisory, to assist founders like yourself in selling their businesses.

>=20

> Through my previous ventures, my work led to features in Forbes 30 =

under 30 and an INC 5000 CEO designation, and currently, The Advisory holds=

a ranking as a leading investment bank in the US.

>=20

> Valuations are very high right now - we see companies in your space go =

for up to 10x.

>=20

> Would you be open to a brief call early next week?

>=20

> Oliver Bogner

> Managing Partner | The Advisory Investment Bank

> Q1 2026 #1 Lower Middle Market Investment Bank on Axial

> 5x Top 5 Lower Middle Market Investment Bank on Axial

> 2x Forbes 30 Under 30 Alumni | 2x Inc 5,000 CEO

>

Canada Bread scandal phish from Japan

Posted by Dave Yadallee on Friday, August 21. 2026

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@nk.ca

Delivery-date: Thu, 20 Aug 2026 07:43:00 -0600

Received: from plab.co.jp ([61.126.17.40]:37880)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.99.5 (FreeBSD))

(envelope-from )

id 1wx31o-00000000EQA-2TW6

for dave@nk.ca;

Thu, 20 Aug 2026 07:42:04 -0600

Received: from EC2AMAZ-K59C7BB (ec2-43-207-65-189.ap-northeast-1.compute.amazonaws.com [43.207.65.189])

by plab.co.jp (Postfix) with ESMTPA id 921D2692F8C

for ; Thu, 20 Aug 2026 22:41:06 +0900 (JST)

Authentication-Results: plab.co.jp; arc=none smtp.remote-ip=43.207.65.189

ARC-Seal: i=1; a=rsa-sha256; d=bizmw.com; s=default; t=1787233266; cv=none;

b=nBFcqjYeZ8JiOodaXXR+B/q3SkLcz023mLn/HpEBUb2zEN6zlNsL3+jaF4UdD05rrQ3UT1TxLTU2iznU8lLd/OgyCcBCZkJJz7bhNvm3rgX2UFGidkY5h5F0rNUbG9k2caoZXnRijgXNx1b1lTilbT5Pyi/eNovKnJ4gNxs3SVU=

ARC-Message-Signature: i=1; a=rsa-sha256; d=bizmw.com; s=default;

t=1787233266; c=relaxed/relaxed;

bh=j+E2PBgVHE/LH8aV7yLr3FGKR5M0gxqwBBH63GLDPdc=;

h=DKIM-Signature:MIME-Version:From:To:Date:Subject; b=gzEVXCzGfXCycinznA+gbvHYwDbi9ZufcRGviuy64KW9itJtu5y00g6QmFm6h1XDFPmCnn0SO9uS9lP1hSMFUIy4b2+IrTb/VLhxZFWmCcWVNQw4/QS75uARZCasacMEC+lvNHw2s42Wfts+O896fbGHz1pnDfUCXZuYtx5a8YY=

ARC-Authentication-Results: i=1; plab.co.jp

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=plab.co.jp; s=bizmw;

t=1787233266; bh=j+E2PBgVHE/LH8aV7yLr3FGKR5M0gxqwBBH63GLDPdc=;

h=From:To:Date:Subject:From;

b=nQrc7zex472JQpF1DZ7kW85LI9RErsMZLlGn/tPYCaOJ2XvUwMgNJb/DQvyeTCRN2

ameS3BKQiz5eOY7ifT9k2K2INv3t1pmMcReckfHazfDvAE3dUzR6fEBAMAyFNU4bYi

uJ9gDldn4iJkyCB0JFwCe25Zf5jpewqgp8izEJKk=

MIME-Version: 1.0

From: "Ontario Class Information"

To: dave@nk.ca

Date: 20 Aug 2026 13:41:06 +0000

Subject: =?utf-8?B?TG9ibGF3L1dlc3RvbiBTZXR0bGVtZW50OiBFbGlnaWJpbGl0?=

=?utf-8?B?eSBJbmZvcm1hdGlvbiBSZWYgTm/CuiA6IDA0MzgwMjA4NjQgOC8yMC8y?=

=?utf-8?B?MDI2IDE6NDE6MDYgUE0=?=

Content-Type: multipart/alternative;

boundary=--boundary_14317_722a606c-fd9e-4cda-bb0b-3921d48749a6

X-Spam_score: 10.1

X-Spam_score_int: 101

X-Spam_bar: ++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.

Content preview:
xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office">

Content analysis details: (10.1 points, 5.0 required)

pts rule name description

---- ---------------------- --------------------------------------------------

0.1 MISSING_MID Missing Message-Id: header

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[43.207.65.189 listed in will-spam-for-food.eu.org]

[43.207.65.189 listed in will-spam-for-food.eu.org]

[43.207.65.189 listed in will-spam-for-food.eu.org]

[43.207.65.189 listed in will-spam-for-food.eu.org]

[43.207.65.189 listed in will-spam-for-food.eu.org]

[43.207.65.189 listed in will-spam-for-food.eu.org]

[43.207.65.189 listed in will-spam-for-food.eu.org]

[43.207.65.189 listed in will-spam-for-food.eu.org]

[61.126.17.40 listed in will-spam-for-food.eu.org]

[61.126.17.40 listed in will-spam-for-food.eu.org]

[61.126.17.40 listed in will-spam-for-food.eu.org]

[61.126.17.40 listed in will-spam-for-food.eu.org]

[61.126.17.40 listed in will-spam-for-food.eu.org]

[61.126.17.40 listed in will-spam-for-food.eu.org]

[61.126.17.40 listed in will-spam-for-food.eu.org]

[61.126.17.40 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[43.207.65.189 listed in dnsbl.ahbl.org]

[43.207.65.189 listed in dnsbl.ahbl.org]

[43.207.65.189 listed in dnsbl.ahbl.org]

[43.207.65.189 listed in dnsbl.ahbl.org]

[61.126.17.40 listed in dnsbl.ahbl.org]

[61.126.17.40 listed in dnsbl.ahbl.org]

[61.126.17.40 listed in dnsbl.ahbl.org]

[61.126.17.40 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[43.207.65.189 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[43.207.65.189 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[43.207.65.189 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[43.207.65.189 listed in dnsbl.ahbl.org]

1.1 URIBL_GREY Contains an URL listed in the URIBL greylist

[URI: squarespace.com]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-0.0 SPF_HELO_PASS SPF: HELO matches SPF record

-0.0 SPF_PASS SPF: sender matches SPF record

-0.0 T_RP_MATCHES_RCVD Envelope sender domain matches handover relay

domain

2.8 FONT_ZERO BODY: Nobody likes invisible fonts in emails

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[61.126.17.40 listed in bl.score.senderscore.com]

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 MIME_BASE64_TEXT RAW: Message text disguised using base64 encoding

4.0 DOS_BODY_HIGH_NO_MID High bit body and no message ID header

0.8 SARE_FROM_SPAM_WORD3 I don't know people named this!

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

0.0 LOTS_OF_MONEY Huge... sums of money

Subject: {SPAM?} =?utf-8?B?TG9ibGF3L1dlc3RvbiBTZXR0bGVtZW50OiBFbGlnaWJpbGl0?=

=?utf-8?B?eSBJbmZvcm1hdGlvbiBSZWYgTm/CuiA6IDA0MzgwMjA4NjQgOC8yMC8y?=

=?utf-8?B?MDI2IDE6NDE6MDYgUE0=?=

Verita Global, LLC

Class Action Claims Administrator

P.O. Box 3355

London, Ontario N6A 4K3

Notice of Class Action Settlement

Re: Loblaw/Weston Packaged Bread Class Actions

You are receiving this notice because you were identified as having claimed a $100–$200 Loblaw Card from the Packaged Bread Loblaw Card Program (2008–2026) and/or registered with the lawyers handling this class action.

Authorized by the Superior Court of Justice for Ontario

Class actions have been certified/authorized by the Ontario Superior Court of Justice and the Superior Court of Quebec on behalf of all individuals and businesses resident in Canada who purchased Packaged Bread, alleging certain manufacturers and retailers engaged in anticompetitive conduct resulting in overcharges. The Courts have not yet made any decision on the merits of the claims or defences in either action.

The Plaintiffs have entered into a national settlement with Loblaw Companies Limited, Loblaws Inc., George Weston Limited, Weston Foods (Canada) Inc., Weston Bakeries Limited, and Weston Food Distribution Inc. (collectively “Loblaw/Weston”) for $500 million ($96 million already paid), plus their cooperation pursuing claims against non-settling defendants. In exchange, Settlement Class Members release Loblaw/Weston from claims relating to Packaged Bread.

If approved by both Courts, net settlement funds will be distributed to Settlement Class Members per the approved distribution protocol. Funds for personal-consumption purchasers will be distributed through a claims process; funds for resale purchasers will be held in trust pending a future Court determination.

Canadian Settlement Class Members’ Options

If you reside anywhere in Canada, except Quebec, and purchased Packaged Bread between January 1, 2008 and December 31, 2025, and wish to participate, you do not need to do anything to be included in the Ontario Settlement Class.

Apply Now

For more information and to exercise your rights, read the full Notice at

www.canadianbreadsettlement.ca

A further Notice will be published with details on how eligible Settlement Class Members may claim compensation once the Loblaw/Weston Agreement is approved.

Class Counsel

Strosberg Wingfield Sasso LLP – www.swslitigation.com

Orr Taylor LLP – www.orrtaylor.com

Sincerely,

Verita Global, LLC

Claims Administrator

P.O. Box 3355 | London, Ontario | N6A 4K3 | Canada

DoNotReply@m.veritacanada.com

If you no longer wish to receive these notices, you can unsubscribe here.

Virtual assistant spam from Google Gmail

Posted by Dave Yadallee on Friday, August 21. 2026

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 20 Aug 2026 07:52:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.5 (FreeBSD))

(envelope-from )

id 1wx3Ac-00000000Gsi-1Bir

for dave@doctor.nl2k.ab.ca;

Thu, 20 Aug 2026 07:51:02 -0600

Resent-From: The Doctor

Resent-Date: Thu, 20 Aug 2026 07:51:02 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-oo1-f54.google.com ([209.85.161.54]:59611)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.99.5 (FreeBSD))

(envelope-from )

id 1wx2Zg-000000009TK-02Dg

for root@nk.ca;

Thu, 20 Aug 2026 07:13:02 -0600

Received: by mail-oo1-f54.google.com with SMTP id 006d021491bc7-6b13735e47dso1497714eaf.2

for ; Thu, 20 Aug 2026 06:12:04 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=gmail.com; s=20251104; t=1787231518; x=1787836318; darn=nk.ca;

h=date:organization:mime-version:content-type:to:subject:from

:message-id:from:to:cc:subject:date:message-id:reply-to:content-type;

bh=vdT+HHqOd3kNH6BQiwWuqOX3VmPub3pzSYD7dH6DIAI=;

b=nTRRdYQwQifuLJ3KCxnLNMCIYbER7M7HaooU0tlrvbsaWl4OFLYh0cbJ5wtrpqtq7w

ZXf5avkMTAK0FGfaCFBvly4ci8+yH2jm0EepubT6L2OEO98QRSIirNTZNV4WTuuraSIk

3hpzNsX9v4zn0K4jPEFqVoGsll8uJe3mgCNAIfWe2uGsyLkknXy1Y/j4oglkRrdnQv7r

bJGMqYQHBXMv3mdWiHBjlcHsTBjVxRZbPHguiUaWg7SrxfbacLK+pQj73I28llZW+PuO

5dCZEhnPATNgj1awIYRThqORxpUKZswiArguK0TSr4+R+edKE1qhoi0T5Jdw16ysE4oS

d3Iw==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20251104; t=1787231518; x=1787836318;

h=date:organization:mime-version:content-type:to:subject:from

:message-id:x-gm-gg:x-gm-message-state:from:to:cc:subject:date

:message-id:reply-to:content-type;

bh=vdT+HHqOd3kNH6BQiwWuqOX3VmPub3pzSYD7dH6DIAI=;

b=p0G5KKPod6TcDLZWbS2CDtRm0a4UyNMmuYtDlPMjnhMLC/iyLxV7zgMxJM+DH3stnl

JvjoSYn9SZBHF/+dcJ6ocAkQ+MVoRLr8Jc5c2pqCLCIuJT6HgL8jx+qyKcEY/nLykCOD

enQziU2pq1oVJBaJt154kvCKE12MB320y3cYTW63bMeU9AompQnKzjQd13d+jFrrd8S8

840Z0KqZzGluElYfxzsj56vig63UmbFW489jBJBYdOO279i8Cs/YDK/mYCtrjTx8JK+P

Ua9jPy7GI/OEBabFU+c9aj8OO1qSACzmk4eJgQwjQh52KozarXd16HjwyoWlmpqixH7r

mNIw==

X-Gm-Message-State: AOJu0YyFgYn2uBXbNDlHk6BrysOs3frz8LCBuctVM/eoUktufSIR4OJw

KT3uEHkmGI4Om296idilSt31ePPt1CoUfZqmriIBxuboZ7GlwHt7trsN6tbazA==

X-Gm-Gg: AR+sD11rmCtftthw7LeRUl1aF9aZTY1+EFeSQ7tR0LKW2W0eHxZJuJg+FX31iM0CX3X

k7jjtyby9LiYitGluDCd1lIpvmP0bP1cA0GYWlV1TdKHvJwUx21zIdfETY0KIAAlHygPsqhWx71

NgD1g4+Q6dVGWYna4sAPnr1RODtOOAz5L1jyow6ueWi0iIeZfLD65sGEOCcBZozRoDqGj7obj/y

NmrIeGKsmj6o8Twwhw3kcId51z0rTW3+4JMsUSkWoD53tFrwdAkk4W/04MaIwvZKdKAJuJIODlF

KrKOKaFuvTXUHvJbaL8qg4k1aWT3iEoOwR7Y+d+HEg09pTRPb29vEcHWlEgO+K2L70A/j6BLZvf

oHoVQaFw4TwU8oWsldnSNMRcscaPi04rEq+CpUSLc6g2WEut8VWC4cnw+v+hCMW4pATWFG1hbcX

3ca9wHRIhFdt49PiScc6qY253ZLhgNs0Ga6P6szZ9FOyUJ9T+mJDZZ3qYVG/DYptJlAj+83UQ=

X-Received: by 2002:a05:6820:4cc1:b0:6b0:ae64:b307 with SMTP id 006d021491bc7-6b13c34429bmr12055840eaf.10.1787231517726;

Thu, 20 Aug 2026 06:11:57 -0700 (PDT)

Received: from gmail.com ([122.160.196.13])

by smtp.gmail.com with ESMTPSA id 5a478bee46e88-327bf10a94dsm16860470eec.15.2026.08.20.06.11.54

for

(version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128);

Thu, 20 Aug 2026 06:11:56 -0700 (PDT)

Message-ID: <6a86fd1c.92d2873c.12c24f.60b5@mx.google.com>

From: Elva

X-Google-Original-From: "Elva"

Subject: Re: Hii, Good Morning! Reminder ## Remote VA Support. root@nk.ca My

Name is Elva

To: "root"

Content-Type: multipart/alternative; boundary="5jFxYm3aiw9V94vENEBCYuDVaj=_oWPokm"

MIME-Version: 1.0

Organization: Headfield Solutions Pvt Ltd

Date: Thu, 20 Aug 2026 18:41:56 +0530

X-Spam_score: 9.7

X-Spam_score_int: 97

X-Spam_bar: +++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.

Content preview: Hi Good Morning! I sent you an email on Friday but didnâ€™t

hear back. Happy to schedule a quick call. We offer Affordable Remote VA

Support. Thank you! Elva, VA Team! On Apr 10, 2026, at 12:35 PM, Elva wrote:

Content analysis details: (9.7 points, 5.0 required)

pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[122.160.196.13 listed in will-spam-for-food.eu.org]

[122.160.196.13 listed in will-spam-for-food.eu.org]

[122.160.196.13 listed in will-spam-for-food.eu.org]

[122.160.196.13 listed in will-spam-for-food.eu.org]

[122.160.196.13 listed in will-spam-for-food.eu.org]

[122.160.196.13 listed in will-spam-for-food.eu.org]

[122.160.196.13 listed in will-spam-for-food.eu.org]

[122.160.196.13 listed in will-spam-for-food.eu.org]

[209.85.161.54 listed in will-spam-for-food.eu.org]

[209.85.161.54 listed in will-spam-for-food.eu.org]

[209.85.161.54 listed in will-spam-for-food.eu.org]

[209.85.161.54 listed in will-spam-for-food.eu.org]

[209.85.161.54 listed in will-spam-for-food.eu.org]

[209.85.161.54 listed in will-spam-for-food.eu.org]

[209.85.161.54 listed in will-spam-for-food.eu.org]

[209.85.161.54 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[209.85.161.54 listed in dnsbl.ahbl.org]

[209.85.161.54 listed in dnsbl.ahbl.org]

[209.85.161.54 listed in dnsbl.ahbl.org]

[209.85.161.54 listed in dnsbl.ahbl.org]

[122.160.196.13 listed in dnsbl.ahbl.org]

[122.160.196.13 listed in dnsbl.ahbl.org]

[122.160.196.13 listed in dnsbl.ahbl.org]

[122.160.196.13 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[209.85.161.54 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[209.85.161.54 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[209.85.161.54 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[209.85.161.54 listed in dnsbl.ahbl.org]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

3.6 RCVD_IN_SBL_CSS RBL: Received via a relay in Spamhaus SBL-CSS

[122.160.196.13 listed in zen.spamhaus.org]

1.5 RCVD_IN_SBL_XBL RBL: Received via a relay in Spamhaus SBL+XBL

[122.160.196.13 listed in sbl-xbl.spamhaus.org]

-0.0 SPF_PASS SPF: sender matches SPF record

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

1.4 FSL_HELO_FAKE No description available.

0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends in

digit

[elvaterra987(at)gmail.com]

0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider

[elvaterra987(at)gmail.com]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[209.85.161.54 listed in list.dnswl.org]

1.0 OPT_OUT BODY: No description available.

0.5 L_HELLO_ADDRESS BODY: Greets you by address, not by name

-0.0 RCVD_IN_MSPIKE_H3 RBL: Good reputation (+3)

[209.85.161.54 listed in wl.mailspike.net]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[209.85.161.54 listed in bl.score.senderscore.com]

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 NO_RDNS2 Sending MTA has no reverse DNS

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

-0.0 RCVD_IN_MSPIKE_WL Mailspike good senders

Subject: {SPAM?} Re: Hii, Good Morning! Reminder ## Remote VA Support. root@nk.ca My

Name is Elva

This is a multi-part message in MIME format

--5jFxYm3aiw9V94vENEBCYuDVaj=_oWPokm

Content-Type: text/plain; charset="utf-8"

Content-Transfer-Encoding: quoted-printable

Content-Disposition: inline

Hi Good Morning!

I sent you an email on Friday but didn=E2=80=99t hear back.

Happy to schedule a quick call. We offer Affordable Remote VA Support.=

Thank you!

Elva,

VA Team!

On Apr 10, 2026, at 12:35=E2=80=AFPM, Elva w=

rote:

Hi, root@nk.ca

Hope you are doing well=E2=80=A6

Please, could you let me know whether you are interested in hiring a r=

emote Virtual Assistant at a reasonable cost?

What we can handle for you:

=F0=9F=91=89 Admin & Data Entry

=F0=9F=91=89 Email & Calendar Management

=F0=9F=91=89 Cold Calling & Outreach

=F0=9F=91=89 social media & Lead Generation

=F0=9F=91=89 Customer Support

=F0=9F=91=89 Online Research

=F0=9F=91=89 CRM Management

=F0=9F=91=89 Bookkeeping Assistance

=F0=9F=91=89 Appointment Scheduling

=F0=9F=91=89 Document Preparation

=F0=9F=91=89 Real Estate & E-commerce Support

=F0=9F=91=89 Studio-quality 3D Rendering

=F0=9F=91=89 SEO & Digital Marketing

=F0=9F=91=89 Website Development

=F0=9F=91=89 Mobile App Development

=F0=9F=91=89 LPO =E2=80=93 Legal Process Outsourcing

=F0=9F=91=89 RPO =E2=80=93 Recruitment Process Outsourcing

=F0=9F=91=89 Video Editing Support

We provide reliable, affordable, and results-driven remote support tai=

lored to your business needs?

Would you be open to a quick call this week?

Best Regards,

Elva,

VA Team

Note: If this isn=E2=80=99t relevant, feel free to reply =E2=80=9COpt-=

out=E2=80=9D

--5jFxYm3aiw9V94vENEBCYuDVaj=_oWPokm

Content-Type: text/html; charset="utf-8"

Content-Transfer-Encoding: quoted-printable

Content-Disposition: inline

Hi Good Morning!
I sen=

t you an email on Friday but didn=E2=80=99t hear back.
Happy to sch=

edule a quick call. We offer Affordable Remote VA Support.
Thank yo=

u!
Elva,
VA Team!

On Apr 10, 2026, at 12:35=E2=80=AFPM,&nb=

sp; Elva <Elvaterra987@Gmail.Com> wrote:

Hi, root@nk.ca
>

Hope you are doing well=E2=80=A6

Please, could you let me kn=

ow whether you are interested in hiring a remote Virtual Assistant at =

a reasonable cost?

What we can handle for you:

=F0=9F=91=89=

Admin & Data Entry

=F0=9F=91=89 Email & Calendar Manage=

ment

=F0=9F=91=89 Cold Calling & Outreach

=F0=9F=91=89=

social media & Lead Generation

=F0=9F=91=89 Customer Suppor=

t

=F0=9F=91=89 Online Research

=F0=9F=91=89 CRM Management=

=F0=9F=91=89 Bookkeeping Assistance

=F0=9F=91=89 Appointm=

ent Scheduling

=F0=9F=91=89 Document Preparation

=F0=9F=91=

=89 Real Estate & E-commerce Support

=F0=9F=91=89 Studio-qua=

lity 3D Rendering

=F0=9F=91=89 SEO & Digital Marketing

>=F0=9F=91=89 Website Development

=F0=9F=91=89 Mobile App Develo=

pment

=F0=9F=91=89 LPO =E2=80=93 Legal Process Outsourcing

>=F0=9F=91=89 RPO =E2=80=93 Recruitment Process Outsourcing

=F0=9F=

=91=89 Video Editing Support

We provide reliable, affordable, an=

d results-driven remote support tailored to your business needs?

>Would you be open to a quick call this week?

Best Regards,
E=

lva,
VA Team
Note: If this isn=E2=80=99t relevant, feel free to =

reply =E2=80=9COpt-out=E2=80=9D

--5jFxYm3aiw9V94vENEBCYuDVaj=_oWPokm--

Mon	Tue	Wed	Thu	Fri	Sat	Sun
← Back	August '26					Forward →
					1	2
3	4	5	6	7	8	9
10	11	12	13	14	15	16
17	18	19	20	21	22	23
24	25	26	27	28	29	30
31