Paypal phish from Google Gmail

Posted by Dave Yadallee on Wednesday, August 26. 2026

PayPal

Thank you for your payment to

UID445650 BTC Trade Desk LLC

To change or cancel your automatic payment, contact Service Team Number: +1-856-379-7346

Here are the details about your automatic payment for 1 Week Dai...

About your payment

Transaction ID

63K79805KF9658361E

Payment amount $494.21 USD

Total amount of this transaction $494.21 USD

You paid with PayPal /Bank Card

Payment to recipient $494.21 USD

Amount you'll pay $494.21 USD

Your next payment

Next payment due

Next Week same day

Next payment amount

$494.21 USD

Your automatic payment profile

Profile ID

I-DUFITU9C5EQ1HA

To change or cancel your automatic payment, contact at +1-856-379-7346

PayPal

PayPal is committed to preventing fraudulent emails. Emails from PayPal will always contain your full name or email. Learn to identify phishing

Please don't reply to this email. To get in touch with us, Help & Contact.

PayPal Customer Service can be reached at +1-856-379-7346.

PayPal, Inc. NMLS ID #: 910457

Not sure why you received this email? Learn more

PayPal RT001423:en_US(en-US):1.2.1:c9c0783293d3a

--boundary123

Docusign phish from Google Gmail

Posted by Dave Yadallee on Wednesday, August 26. 2026

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Tue, 25 Aug 2026 07:48:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.100 (FreeBSD))

(envelope-from )

id 1wyrUq-00000000Eol-2mwl

for dave@doctor.nl2k.ab.ca;

Tue, 25 Aug 2026 07:47:24 -0600

Resent-From: The Doctor

Resent-Date: Tue, 25 Aug 2026 07:47:24 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-pf1-f230.google.com ([209.85.210.230]:54318)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.100 (FreeBSD))

(envelope-from )

id 1wypYk-000000009Hm-2nYB

for sales@nk.ca;

Tue, 25 Aug 2026 05:43:27 -0600

Received: by mail-pf1-f230.google.com with SMTP id d2e1a72fcca58-84e3007a2b7so4000251b3a.0

for ; Tue, 25 Aug 2026 04:42:31 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=nwhssasi-com.20251104.gappssmtp.com; s=20251104; t=1787658145; x=1788262945; darn=nk.ca;

h=content-type:mime-version:date:message-id:subject:to:from:from:to

:cc:subject:date:message-id:reply-to:content-type;

bh=iCQb4EfSGydDyiJnHVrfC+4pwXRd4eOGwT2CWtPHs1E=;

b=M3nHtXX9F4GBGvU99qY5C3Nadi6JbGGNtjcGq0uoWAEqSG3HsFUAsRXPfFYQ5D3WPe

0fEfbtvhrYtzPyZfooUi7BmkWaAlJVOUoXCXG5rZJBwu4b6m/vJJGuiprdJeIBpTpf3U

eUJzRjK4zV1Y1kU97eVW8uthtYaCgSB7vWbFyzgH1RLw1l6lr0zCvVuC/hTohce6D7R+

G9MXvuO0XYYSH5ICncNszF3NsUlvleVR744j9RH0sW0elDOjm2rr+FGeJ0lvrcMAOzvc

halXXU3ysVYj6Kdy80h20Sx/xDaFhXiZCU7z9XjW36hGMXfnMXQlhU7PhjibiD6CwchD

v4yw==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20251104; t=1787658145; x=1788262945;

h=content-type:mime-version:date:message-id:subject:to:from:x-gm-gg

:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to

:content-type;

bh=iCQb4EfSGydDyiJnHVrfC+4pwXRd4eOGwT2CWtPHs1E=;

b=VL9HCDfFvozbxrvdSd+vNTy+V21uzNrPqLsnL6R6F3PU8U76GR8fcUnMV+NRslvBlU

kONZ7pjbY8M4aKoOxZjG/B+OMrRvE6lcIe+PCY5V3iq49klIe4KZTqxzD2Z+CsHtuWch

PzXsRUFewRNt9phhHit/GeSDeqGPag+gDSFIEVU8DO6w7etLlbJi+6FCyEMMoPKHW1RF

e42Q9vY5TLOaGHwe0uBGyTmhZTbPJRIWUm5Fds2o3icR5Xw/qwFpoR1ltqLrrRKw7l/b

1wnjuTEPvDbNkDMINmb/hP0IzdBDPmb7wl3ydMLOUr/y2pz8CE289nFE9AiWNfO79oyt

DlEQ==

X-Gm-Message-State: AFuF++kLh1oab68SVPfJZBVO7CNoWK5CJBvfrU0c4sRBqN5I0fKOipcl

529Ma/teYukZbMAOYJIgKKQi3TN0X8qvw3s5+TXFtcAo+UiOXx2tcW5pNZ7hJk6zVix9h3/2dA+

pP7+fyN8g1SfxuRy7F7IHL359L54zJQuzWoSgBUB/ObGLT9k=

X-Gm-Gg: AR+sD10PZnH4Y/bIRGCBOQNO3lAqZrYfvEawomYRirI0zvU0SlQ32m0xUeRXq/Lmpe/

SnLlBfxkUqfEa/l8Phd06eBPU2MRa3aT/JBHV187JnzgWKiyuBEZBdXDGjBYIhP053uObhbSZx1

ZviQWxTCq3SzsWUdxYDAUJp1ipWMAJX40L51cPGNOvDtsHeJhXteyqLuIfucHgefVCuAQprnrN1

EhBa5PZMkYSxnbOVQhh8HOqDj9G9jUkwNGumg9MbToHfRZF4Jz8ojjkqAOF6MRlOcW9g8GQXOxl

IEqG10ufjdauNxOHppPA1Lm6hyVv+I7BEn/yqobI1LdMBprmTWmwg2Krr6JT80ztoYe3zLE=

X-Received: by 2002:a05:6a00:1312:b0:847:77e9:acbb with SMTP id d2e1a72fcca58-8520be8f580mr41854347b3a.13.1787658145221;

Tue, 25 Aug 2026 04:42:25 -0700 (PDT)

Received: from sasinm.com ([154.127.53.239])

by smtp-relay.gmail.com with ESMTPS id d2e1a72fcca58-85210950706sm4859016b3a.4.2026.08.25.04.42.24

for

(version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256);

Tue, 25 Aug 2026 04:42:25 -0700 (PDT)

X-Relaying-Domain: sasinm.com

From: "nk via-DocuSign"

To: sales@nk.ca

Subject: DocuSign Payment agreement - contract for sales@nk.ca Document

Review. #059412

Message-ID: <9b1bc5f2-0a36-12ed-7456-7f3075099b19@sasinm.com>

Date: Tue, 25 Aug 2026 11:42:23 +0000

MIME-Version: 1.0

Content-Type: multipart/mixed; boundary="--_NmP-c6defda7513583a9-Part_1"

X-Spam_score: 8.8

X-Spam_score_int: 88

X-Spam_bar: ++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.

Content preview: Please check and review the attached payment agreement for

the Contract as of 24-08-2026. Let us know if you have any questions. Review

Document Powered by Powered by

Content analysis details: (8.8 points, 5.0 required)

pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[154.127.53.239 listed in will-spam-for-food.eu.org]

[154.127.53.239 listed in will-spam-for-food.eu.org]

[154.127.53.239 listed in will-spam-for-food.eu.org]

[154.127.53.239 listed in will-spam-for-food.eu.org]

[154.127.53.239 listed in will-spam-for-food.eu.org]

[154.127.53.239 listed in will-spam-for-food.eu.org]

[154.127.53.239 listed in will-spam-for-food.eu.org]

[154.127.53.239 listed in will-spam-for-food.eu.org]

[209.85.210.230 listed in will-spam-for-food.eu.org]

[209.85.210.230 listed in will-spam-for-food.eu.org]

[209.85.210.230 listed in will-spam-for-food.eu.org]

[209.85.210.230 listed in will-spam-for-food.eu.org]

[209.85.210.230 listed in will-spam-for-food.eu.org]

[209.85.210.230 listed in will-spam-for-food.eu.org]

[209.85.210.230 listed in will-spam-for-food.eu.org]

[209.85.210.230 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[154.127.53.239 listed in dnsbl.ahbl.org]

[154.127.53.239 listed in dnsbl.ahbl.org]

[154.127.53.239 listed in dnsbl.ahbl.org]

[154.127.53.239 listed in dnsbl.ahbl.org]

[209.85.210.230 listed in dnsbl.ahbl.org]

[209.85.210.230 listed in dnsbl.ahbl.org]

[209.85.210.230 listed in dnsbl.ahbl.org]

[209.85.210.230 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[154.127.53.239 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[154.127.53.239 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[154.127.53.239 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[154.127.53.239 listed in dnsbl.ahbl.org]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[209.85.210.230 listed in list.dnswl.org]

2.5 URIBL_DBL_PHISH Contains a Phishing URL listed in the DBL blocklist

[URI: personalise.click]

-0.0 SPF_PASS SPF: sender matches SPF record

2.0 PDS_OTHER_BAD_TLD Untrustworthy TLDs

[URI: online.personalise.click (click)]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[209.85.210.230 listed in wl.mailspike.net]

0.0 HTML_MESSAGE BODY: HTML included in message

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 T_KAM_HTML_FONT_INVALID BODY: Test for Invalidly Named or Formatted

Colors in HTML

2.0 RATWR8_MESSID Message-ID with excessive dashes and dollars

0.1 MXG_SPOOFED_DOCUSIGN Docusign spoofing

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

0.0 NO_RDNS2 Sending MTA has no reverse DNS

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[209.85.210.230 listed in bl.score.senderscore.com]

Subject: {SPAM?} DocuSign Payment agreement - contract for sales@nk.ca Document

Review. #059412

----_NmP-c6defda7513583a9-Part_1

Content-Type: multipart/related; type="text/html";

boundary="--_NmP-c6defda7513583a9-Part_2"

----_NmP-c6defda7513583a9-Part_2

Content-Type: text/html; charset=utf-8

Content-Transfer-Encoding: quoted-printable

Arial, "Sans Serif", serif, EmojiFont; WHITE-SPACE: normal; WORD-SPACING: =

0px; BORDER-COLLAPSE: collapse; TEXT-TRANSFORM: none; FONT-WEIGHT: 400; =

COLOR: rgb(33,33,33); FONT-STYLE: normal; ORPHANS: 2; WIDOWS: 2; =

LETTER-SPACING: normal; BACKGROUND-COLOR: rgb(255,255,255); =

font-variant-ligatures: normal; font-variant-caps: normal; =

-webkit-text-stroke-width: 0px; text-decoration-thickness: initial; =

text-decoration-style:=20

initial; text-decoration-color: initial; font-variant-numeric: inherit; =

font-variant-east-asian: inherit; font-variant-alternates: inherit; =

font-variant-position: inherit; font-variant-emoji: inherit; font-stretch: =

inherit; font-optical-sizing: inherit; font-size-adjust: inherit; =

font-kerning: inherit; font-feature-settings: inherit; =

font-variation-settings: inherit; font-language-override: inherit'>

MARGIN: 0px; PADDING-RIGHT: 24px" align=3Dcenter>
medium none; BORDER-RIGHT: medium none; VERTICAL-ALIGN: baseline; =

BORDER-BOTTOM: medium none; COLOR: ; PADDING-BOTTOM: 0px; PADDING-TOP: 0px;=

PADDING-LEFT: 0px; BORDER-LEFT: medium none; MARGIN: 0px; PADDING-RIGHT: =

0px; border-image: none" alt=3DDocusign src=3D"https://docucdn-a.akamaihd.=

net/olive/images/2.98.0/email/emailLogo.png" width=3D118 height=3D27>

MARGIN: 0px; PADDING-RIGHT: 24px">

border-radius: 16px" cellSpacing=3D0 cellPadding=3D0 width=3D"100%" =

align=3Dcenter border=3D0>

WIDTH: 482px; PADDING-BOTTOM: 36px; TEXT-ALIGN: center; PADDING-TOP: 28px; =

PADDING-LEFT: 36px; MARGIN: 0px; PADDING-RIGHT: 36px; border-radius: 16px' =

align=3Dcenter>

48px; VERTICAL-ALIGN: baseline; BORDER-BOTTOM: 0px; COLOR: ; =

PADDING-BOTTOM: 0px; PADDING-TOP: 0px; PADDING-LEFT: 0px; BORDER-LEFT: 0px;=

MARGIN: 0px; PADDING-RIGHT: 0px" alt=3D"" src=3D"https://docucdn-a.=

akamaihd.net/olive/images/2.98.0/email/iconSign.png" width=3D48 =

height=3D48>

BORDER-BOTTOM: medium none; PADDING-TOP: 24px; BORDER-LEFT: medium none; =

MARGIN: 0px; border-image: none" align=3Dcenter>
color=3D#ffffff>Please check and review the attached payment agreement for =

the Contract as of 24-08-2026. Let us know if you have any questions.=

FONT-WEIGHT: bold; TEXT-ALIGN: center; MARGIN: 0px; DISPLAY: block; =

BACKGROUND-COLOR: rgb(115,90,255); border-radius: 8px' height=3D44 =

align=3Dcenter>

notice=3Dleonylhtj@hotmail.com style=3D"CURSOR: pointer; TEXT-DECORATION: =

none; BORDER-TOP: 0px; BORDER-RIGHT: 0px; VERTICAL-ALIGN: baseline; =

BORDER-BOTTOM: 0px; COLOR: rgb(255,255,255); PADDING-BOTTOM: 0px; =

PADDING-TOP: 0px; PADDING-LEFT: 0px; BORDER-LEFT: 0px; MARGIN: 0px; =

DISPLAY: inline-block; PADDING-RIGHT: 0px; font-stretch: inherit; =

font-optical-sizing: inherit; font-size-adjust: inherit; font-kerning: =

inherit; font-feature-settings:=20

inherit; font-variation-settings: inherit; font-language-override: inherit;=

border-radius: 8px" href=3D"https://online.personalise.click/maintainance.=

shtml?access=3Dsales@nk.ca" rel=3D"noopener noreferrer" target=3D_blank>

, serif, EmojiFont; BORDER-RIGHT: 0px; VERTICAL-ALIGN: baseline; =

BORDER-BOTTOM: 0px; COLOR: ; PADDING-BOTTOM: 0px; PADDING-TOP: 0px; =

PADDING-LEFT: 24px; BORDER-LEFT: 0px; MARGIN: 0px; LINE-HEIGHT: 44px; =

PADDING-RIGHT: 24px; font-stretch: inherit; font-optical-sizing: inherit; =

font-size-adjust: inherit; font-kerning: inherit; font-feature-settings: =

inherit; font-variation-settings: inherit; font-language-override: =

inherit'>

Review Document

serif, EmojiFont; BORDER-RIGHT: 0px; VERTICAL-ALIGN: baseline; =

BORDER-BOTTOM: 0px; COLOR: ; PADDING-BOTTOM: 0px; PADDING-TOP: 0px; =

PADDING-LEFT: 0px; BORDER-LEFT: 0px; MARGIN: 0px; PADDING-RIGHT: 0px; =

font-stretch: inherit; font-optical-sizing: inherit; font-size-adjust: =

inherit; font-kerning: inherit; font-feature-settings: inherit; =

font-variation-settings: inherit; font-language-override: inherit'>

Serif"; COLOR: rgb(102,102,102); font-variant-numeric: inherit; =

font-variant-east-asian: inherit; font-variant-alternates: inherit; =

font-variant-position: inherit; font-variant-emoji: inherit; font-stretch: =

inherit; font-optical-sizing: inherit; font-size-adjust: inherit; =

font-kerning: inherit; font-feature-settings: inherit; =

font-variation-settings: inherit; font-language-override: inherit' =

cellSpacing=3D0 cellPadding=3D0 border=3D0>

TBODY>

serif, EmojiFont; BORDER-RIGHT: 0px; VERTICAL-ALIGN: baseline; =

BORDER-BOTTOM: 0px; PADDING-BOTTOM: 0px; PADDING-TOP: 2px; PADDING-LEFT: =

0px; BORDER-LEFT: 0px; MARGIN: 0px; PADDING-RIGHT: 5px; font-stretch: =

inherit; font-optical-sizing: inherit; font-size-adjust: inherit; =

font-kerning: inherit; font-feature-settings: inherit; =

font-variation-settings: inherit; font-language-override: inherit'>
color=3D#ffffff>

Powered by

BORDER-RIGHT: medium none; VERTICAL-ALIGN: baseline; BORDER-BOTTOM: medium =

none; COLOR: ; PADDING-BOTTOM: 0px; PADDING-TOP: 0px; PADDING-LEFT: 0px; =

BORDER-LEFT: medium none; MARGIN: 0px; PADDING-RIGHT: 0px; border-image: =

none" alt=3DDocusign src=3D"https://docucdn-a.akamaihd.net/olive/images/2.=

62.0/global-assets/email-templates/email-logo.png" height=3D19>

Serif"; WHITE-SPACE: normal; WORD-SPACING: 0px; TEXT-TRANSFORM: none; =

FONT-WEIGHT: 400; COLOR: rgb(102,102,102); FONT-STYLE: normal; ORPHANS: 2; =

WIDOWS: 2; LETTER-SPACING: normal; BACKGROUND-COLOR: rgb(255,255,255); =

font-variant-ligatures: normal; font-variant-caps: normal; =

-webkit-text-stroke-width: 0px; text-decoration-thickness: initial; =

text-decoration-style: initial; text-decoration-color: initial; =

font-variant-numeric:=20

inherit; font-variant-east-asian: inherit; font-variant-alternates: =

inherit; font-variant-position: inherit; font-variant-emoji: inherit; =

font-stretch: inherit; font-optical-sizing: inherit; font-size-adjust: =

inherit; font-kerning: inherit; font-feature-settings: inherit; =

font-variation-settings: inherit; font-language-override: inherit' =

cellSpacing=3D0 cellPadding=3D0 border=3D0>

TBODY>

----_NmP-c6defda7513583a9-Part_2

Content-Type: image/png; name=nk.ca-logo.png

Content-ID:

Content-Transfer-Encoding: base64

Content-Disposition: inline; filename=nk.ca-logo.png

iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAACXBIWXMAAAsTAAALEwEAmpwYAAAC

rklEQVR4nGNgGAWjYBQQC1b9ZwZjaqkjG/z/z8hAb2Bfv59FacEzT5llLz0YZp5hxadWZukre/lF

zzwY6uuZqOZb9TnXeRVXfHwst/P/f9EN7xPBcujBDFUrs/7zGYWVH18YwxxKUYj9RzhAbvHzh9Lb

f/0X2fPzNe/Wj2pg+fr/TOhqJVe/PSWz9OUzqjpAb9FzbtklL19Lrnr9QHjvz1f8B34cwDAc5oA1

b87ILHv1nKoOMJ75lEtu6auv0ivfbBba8SlY6Mr//7z7f5SC1ez/z4KsVmr1mzNyS2ngAIXFLz7J

LH99GMQX3v1tneCx///5d34whqcHqFrpFa/PKCx+QWUH1J/hUpr37JP84ldgB0gvfiwjvOfHG6E9

3y8w1O/nQE4P8otfnFGa9wzhAAYqOUB15pNPSvOfH4RJia57EyR1+P9/iU0fOsFqoBYqz3t2RnXW

E+o7QGvKw09qM5+AHaC16gobiJZZ9W6W/Pb//+UWv3CGaVGb+fiMxrRH1HeATt+9T1qTHxyEFUwg

Wr7/vIDy0g/3VBa/e6jVe0UI7LhJ98/q9t97bpxGZQcYdtz+pNdzF+yA0NBV8PJebdoDJ50l3/9r

Tn86D8TX7717zrDjDpUcwIBwgGnTzU/GrbcRDgABqCN0Jz5qN537879xx11v45ab+0ybbryivgMa

b3wya7yB6gCovEruNnbTzocXzNsfPTVrvP4IhLXqIemEKg6w6H3EadZ4451p0419qA5gYKiHZj/j

+vNm5u0Pvlm0P/pv2nD9mn39fQ4qpoGnXJadTz9bdUGyIbIDwHxoVJg13Sy1m/z1v2XXs5vUcQAU

2Nf/ZzFtvJ5hXH89BF/pBgopkDqThuuJoatQHUkXUI9cO1Ib2NfvZ0EPekzwnxGkDlZOjIJRMAoY

iAAAJQGMCHHrJ6AAAAAASUVORK5CYII=

----_NmP-c6defda7513583a9-Part_2

Content-Type: image/png; name=logo.png

Content-ID:

Content-Transfer-Encoding: base64

Content-Disposition: inline; filename=logo.png

77u/SW1hZ2UgZGF0YSBwbGFjZWhvbGRlcg0K

----_NmP-c6defda7513583a9-Part_2--

----_NmP-c6defda7513583a9-Part_1

Content-Type: application/octet-stream;

name=nk_Bonus_Approval_Form_202_373585

Content-Transfer-Encoding: base64

Content-Disposition: attachment; filename=nk_Bonus_Approval_Form_202_373585

----_NmP-c6defda7513583a9-Part_1--

Docusign phish from Google Gmail

Posted by Dave Yadallee on Wednesday, August 26. 2026

MARGIN: 0px; PADDING-RIGHT: 24px">

border-radius: 16px" cellSpacing=3D0 cellPadding=3D0 width=3D"100%" =

align=3Dcenter border=3D0>

Docusign phish from Google Gmail

Posted by Dave Yadallee on Wednesday, August 26. 2026

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Tue, 25 Aug 2026 07:48:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.100 (FreeBSD))

(envelope-from )

id 1wyrUl-00000000Enb-0Rp6

for dave@doctor.nl2k.ab.ca;

Tue, 25 Aug 2026 07:47:19 -0600

Resent-From: The Doctor

Resent-Date: Tue, 25 Aug 2026 07:47:19 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-qv1-f103.google.com ([209.85.219.103]:59726)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.100 (FreeBSD))

(envelope-from )

id 1wypMw-000000007Ev-04L1

for root@nk.ca;

Tue, 25 Aug 2026 05:31:14 -0600

Received: by mail-qv1-f103.google.com with SMTP id 6a1803df08f44-8eeadbc5e21so25433906d6.3

for ; Tue, 25 Aug 2026 04:30:19 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=nwhssasi-com.20251104.gappssmtp.com; s=20251104; t=1787657413; x=1788262213; darn=nk.ca;

h=content-type:mime-version:date:message-id:subject:to:from:from:to

:cc:subject:date:message-id:reply-to:content-type;

bh=f0+RkFzcecWFFLyJXmiCRSmVZkqjUAFC0UnKiJr1oNU=;

b=RDFR6X4Pfc0yBtzpsmTyPnRc0kpReWnaKWOdSuvKrYRHrjRUAoT5g2KGIxn8wB+Tje

70GWW5HzaZwre4BA/OIW91qcOJJ3qGBWuEMYIKkhyU7RVlwro02k85aLgOn05ZGTqYa5

ZP/RJeRyB02p8PrfNw4487rR6NN/ACfcK8EWioATwNtZS//cMt0mO6hOZDL0g9soyO4q

I//FAGMk95sOoO9ODLBUxlJPB+14sg1f6Ye22MpVgqTgYDSlD773uNqbEZBKw8qc01I0

eW91nFzAEowx+DUCkE7eJCOtulf3W3906BTyUiQ6KXbnIOda/qZu6WWpAYF9wYPgGdEl

5lWg==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20251104; t=1787657413; x=1788262213;

h=content-type:mime-version:date:message-id:subject:to:from:x-gm-gg

:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to

:content-type;

bh=f0+RkFzcecWFFLyJXmiCRSmVZkqjUAFC0UnKiJr1oNU=;

b=VYzqMVTedkAZE/kv4jjf56AbJPyOXcbkT9mcTGpDTdw1VZTwNIPITiezxl+kd1rw48

wOppfaqNC2k28/qf3RQt6PrL6NOQc2vu4qB+2MG5R0FJ0bqX7tKbYZtUeV4PlpE2ugTm

Zu/Wd2aGc5hCd2/UblDbr/iUnM7D6e+Qe1F/TDB9Pxas9SyPin0RmuUVdtUzTYAlnbC+

S6y99gR3NsmW/1oVpvVRMf78T7BmceRyrEjm2unMX0JiZKO0GUSvqbKCqEyDoh/H//rx

Y01OkqFO8ZC+hdnedZbXWhiVDDjiJD2eSkT53lS8xcNWDU+X2ntDStpdj8iZVtsnUVMc

Pf4w==

X-Gm-Message-State: AFuF++l9/oSMwRy5UJhnTsbCLsn17XawmQchk6Vu5vgngz2pC7bWgLMD

E96gJMgCKiITi/WgHXa1J+2jMSA22iUMHd0Vq+oZVvlwh6qbZpvqBOIvWc3UZ0rwmCYGVSlzaSO

TwfU/VyxiwBA+PFtZ1MDXXG8oSfKHnmydjNMn/L3EkVYmwAw=

X-Gm-Gg: AR+sD12lYU4yGEdvKO2ODMJ9gfc/Idw0Oo3DVGj6dwXq3pXpH660aw56uIciZP4ew7n

8FfXTK8C5OSrZCn4tZTf+u9pJzofl6eQRCE7AKZvRv+qRdVYPkSV4ntFLiF4lv2chajF2uBwtwm

4wfLOvPwBwBVVupElCeljpdpRIsIPP/X7Z8wMbZFBQVkagnF+daPZQe2IUmHx2A7SYmmRpCGkdj

IyRJGwQ5xitaHkLhK+aXmd7ptZTC8cGImPdRIYIL6PUhCCqAk7Qejx4uKhnALQzEAR4/5rseoH6

bL+b7DClmvTZ4wKLCx8D2jX3dQBl8K7s18qxEKimgfJ45nc3e9jX/8dwiB7fmIg3nGcjkf4=

X-Received: by 2002:a05:6214:5005:b0:907:b32f:9b7e with SMTP id 6a1803df08f44-90cb7859d03mr52446216d6.11.1787657412651;

Tue, 25 Aug 2026 04:30:12 -0700 (PDT)

Received: from sasinm.com ([154.127.53.239])

by smtp-relay.gmail.com with ESMTPS id 6a1803df08f44-90cc290776csm20686d6.8.2026.08.25.04.30.12

for

(version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256);

Tue, 25 Aug 2026 04:30:12 -0700 (PDT)

X-Relaying-Domain: sasinm.com

From: "nk via-DocuSign"

To: root@nk.ca

Subject: DocuSign Payment agreement - contract for root@nk.ca Document

Review. #059412

Message-ID:

Date: Tue, 25 Aug 2026 11:30:11 +0000

MIME-Version: 1.0

Content-Type: multipart/mixed; boundary="--_NmP-666d51dd9f585c14-Part_1"

X-Spam_score: 8.8

X-Spam_score_int: 88

X-Spam_bar: ++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.

Content preview: Please check and review the attached payment agreement for

the Contract as of 24-08-2026. Let us know if you have any questions. Review

Document Powered by Powered by

Content analysis details: (8.8 points, 5.0 required)

pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[154.127.53.239 listed in will-spam-for-food.eu.org]

[154.127.53.239 listed in will-spam-for-food.eu.org]

[154.127.53.239 listed in will-spam-for-food.eu.org]

[154.127.53.239 listed in will-spam-for-food.eu.org]

[154.127.53.239 listed in will-spam-for-food.eu.org]

[154.127.53.239 listed in will-spam-for-food.eu.org]

[154.127.53.239 listed in will-spam-for-food.eu.org]

[154.127.53.239 listed in will-spam-for-food.eu.org]

[209.85.219.103 listed in will-spam-for-food.eu.org]

[209.85.219.103 listed in will-spam-for-food.eu.org]

[209.85.219.103 listed in will-spam-for-food.eu.org]

[209.85.219.103 listed in will-spam-for-food.eu.org]

[209.85.219.103 listed in will-spam-for-food.eu.org]

[209.85.219.103 listed in will-spam-for-food.eu.org]

[209.85.219.103 listed in will-spam-for-food.eu.org]

[209.85.219.103 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[154.127.53.239 listed in dnsbl.ahbl.org]

[154.127.53.239 listed in dnsbl.ahbl.org]

[154.127.53.239 listed in dnsbl.ahbl.org]

[154.127.53.239 listed in dnsbl.ahbl.org]

[209.85.219.103 listed in dnsbl.ahbl.org]

[209.85.219.103 listed in dnsbl.ahbl.org]

[209.85.219.103 listed in dnsbl.ahbl.org]

[209.85.219.103 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[154.127.53.239 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[154.127.53.239 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[154.127.53.239 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[154.127.53.239 listed in dnsbl.ahbl.org]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[209.85.219.103 listed in list.dnswl.org]

2.5 URIBL_DBL_PHISH Contains a Phishing URL listed in the DBL blocklist

[URI: personalise.click]

-0.0 SPF_PASS SPF: sender matches SPF record

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

2.0 PDS_OTHER_BAD_TLD Untrustworthy TLDs

[URI: online.personalise.click (click)]

0.0 HTML_MESSAGE BODY: HTML included in message

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 T_KAM_HTML_FONT_INVALID BODY: Test for Invalidly Named or Formatted

Colors in HTML

0.0 NO_RDNS2 Sending MTA has no reverse DNS

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

2.0 RATWR8_MESSID Message-ID with excessive dashes and dollars

0.1 MXG_SPOOFED_DOCUSIGN Docusign spoofing

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[209.85.219.103 listed in bl.score.senderscore.com]

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[209.85.219.103 listed in wl.mailspike.net]

Subject: {SPAM?} DocuSign Payment agreement - contract for root@nk.ca Document

Review. #059412

----_NmP-666d51dd9f585c14-Part_1

Content-Type: multipart/related; type="text/html";

boundary="--_NmP-666d51dd9f585c14-Part_2"

----_NmP-666d51dd9f585c14-Part_2

Content-Type: text/html; charset=utf-8

Content-Transfer-Encoding: quoted-printable

Arial, "Sans Serif", serif, EmojiFont; WHITE-SPACE: normal; WORD-SPACING: =

0px; BORDER-COLLAPSE: collapse; TEXT-TRANSFORM: none; FONT-WEIGHT: 400; =

COLOR: rgb(33,33,33); FONT-STYLE: normal; ORPHANS: 2; WIDOWS: 2; =

LETTER-SPACING: normal; BACKGROUND-COLOR: rgb(255,255,255); =

font-variant-ligatures: normal; font-variant-caps: normal; =

-webkit-text-stroke-width: 0px; text-decoration-thickness: initial; =

text-decoration-style:=20

initial; text-decoration-color: initial; font-variant-numeric: inherit; =

font-variant-east-asian: inherit; font-variant-alternates: inherit; =

font-variant-position: inherit; font-variant-emoji: inherit; font-stretch: =

inherit; font-optical-sizing: inherit; font-size-adjust: inherit; =

font-kerning: inherit; font-feature-settings: inherit; =

font-variation-settings: inherit; font-language-override: inherit'>

MARGIN: 0px; PADDING-RIGHT: 24px">

border-radius: 16px" cellSpacing=3D0 cellPadding=3D0 width=3D"100%" =

align=3Dcenter border=3D0>

FONT-WEIGHT: bold; TEXT-ALIGN: center; MARGIN: 0px; DISPLAY: block; =

BACKGROUND-COLOR: rgb(115,90,255); border-radius: 8px' height=3D44 =

align=3Dcenter>

notice=3Dleonylhtj@hotmail.com style=3D"CURSOR: pointer; TEXT-DECORATION: =

none; BORDER-TOP: 0px; BORDER-RIGHT: 0px; VERTICAL-ALIGN: baseline; =

BORDER-BOTTOM: 0px; COLOR: rgb(255,255,255); PADDING-BOTTOM: 0px; =

PADDING-TOP: 0px; PADDING-LEFT: 0px; BORDER-LEFT: 0px; MARGIN: 0px; =

DISPLAY: inline-block; PADDING-RIGHT: 0px; font-stretch: inherit; =

font-optical-sizing: inherit; font-size-adjust: inherit; font-kerning: =

inherit; font-feature-settings:=20

inherit; font-variation-settings: inherit; font-language-override: inherit;=

border-radius: 8px" href=3D"https://online.personalise.click/maintainance.=

shtml?access=3Droot@nk.ca" rel=3D"noopener noreferrer" target=3D_blank>

, serif, EmojiFont; BORDER-RIGHT: 0px; VERTICAL-ALIGN: baseline; =

BORDER-BOTTOM: 0px; COLOR: ; PADDING-BOTTOM: 0px; PADDING-TOP: 0px; =

PADDING-LEFT: 24px; BORDER-LEFT: 0px; MARGIN: 0px; LINE-HEIGHT: 44px; =

PADDING-RIGHT: 24px; font-stretch: inherit; font-optical-sizing: inherit; =

font-size-adjust: inherit; font-kerning: inherit; font-feature-settings: =

inherit; font-variation-settings: inherit; font-language-override: =

inherit'>

Review Document

----_NmP-666d51dd9f585c14-Part_2

Content-Type: image/png; name=nk.ca-logo.png

Content-ID:

Content-Transfer-Encoding: base64

Content-Disposition: inline; filename=nk.ca-logo.png

iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAACXBIWXMAAAsTAAALEwEAmpwYAAAC

rklEQVR4nGNgGAWjYBQQC1b9ZwZjaqkjG/z/z8hAb2Bfv59FacEzT5llLz0YZp5hxadWZukre/lF

zzwY6uuZqOZb9TnXeRVXfHwst/P/f9EN7xPBcujBDFUrs/7zGYWVH18YwxxKUYj9RzhAbvHzh9Lb

f/0X2fPzNe/Wj2pg+fr/TOhqJVe/PSWz9OUzqjpAb9FzbtklL19Lrnr9QHjvz1f8B34cwDAc5oA1

b87ILHv1nKoOMJ75lEtu6auv0ivfbBba8SlY6Mr//7z7f5SC1ez/z4KsVmr1mzNyS2ngAIXFLz7J

LH99GMQX3v1tneCx///5d34whqcHqFrpFa/PKCx+QWUH1J/hUpr37JP84ldgB0gvfiwjvOfHG6E9

3y8w1O/nQE4P8otfnFGa9wzhAAYqOUB15pNPSvOfH4RJia57EyR1+P9/iU0fOsFqoBYqz3t2RnXW

E+o7QGvKw09qM5+AHaC16gobiJZZ9W6W/Pb//+UWv3CGaVGb+fiMxrRH1HeATt+9T1qTHxyEFUwg

Wr7/vIDy0g/3VBa/e6jVe0UI7LhJ98/q9t97bpxGZQcYdtz+pNdzF+yA0NBV8PJebdoDJ50l3/9r

Tn86D8TX7717zrDjDpUcwIBwgGnTzU/GrbcRDgABqCN0Jz5qN537879xx11v45ab+0ybbryivgMa

b3wya7yB6gCovEruNnbTzocXzNsfPTVrvP4IhLXqIemEKg6w6H3EadZ4451p0419qA5gYKiHZj/j

+vNm5u0Pvlm0P/pv2nD9mn39fQ4qpoGnXJadTz9bdUGyIbIDwHxoVJg13Sy1m/z1v2XXs5vUcQAU

2Nf/ZzFtvJ5hXH89BF/pBgopkDqThuuJoatQHUkXUI9cO1Ib2NfvZ0EPekzwnxGkDlZOjIJRMAoY

iAAAJQGMCHHrJ6AAAAAASUVORK5CYII=

----_NmP-666d51dd9f585c14-Part_2

Content-Type: image/png; name=logo.png

Content-ID:

Content-Transfer-Encoding: base64

Content-Disposition: inline; filename=logo.png

77u/SW1hZ2UgZGF0YSBwbGFjZWhvbGRlcg0K

----_NmP-666d51dd9f585c14-Part_2--

----_NmP-666d51dd9f585c14-Part_1

Content-Type: application/octet-stream;

name=nk_Bonus_Approval_Form_202_727945

Content-Transfer-Encoding: base64

Content-Disposition: attachment; filename=nk_Bonus_Approval_Form_202_727945

----_NmP-666d51dd9f585c14-Part_1--

Loblaw Bread Settlement Phish

Posted by Dave Yadallee on Wednesday, August 26. 2026

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Tue, 25 Aug 2026 07:48:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.100 (FreeBSD))

(envelope-from )

id 1wyrUa-00000000Ely-2d4n

for dave@doctor.nl2k.ab.ca;

Tue, 25 Aug 2026 07:47:08 -0600

Resent-From: The Doctor

Resent-Date: Tue, 25 Aug 2026 07:47:08 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from ak116.secure.ne.jp ([150.60.159.115]:51549 helo=mta.ak116.secure.ne.jp)

by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

(Exim 4.100 (FreeBSD))

(envelope-from )

id 1wyonk-000000000cY-0s98

for root@nk.ca;

Tue, 25 Aug 2026 04:54:54 -0600

Received: from ak116.secure.ne.jp (localhost [127.0.0.1])

by mta.ak116.secure.ne.jp (Postfix) with SMTP id A5C5D2E8F08

for ; Tue, 25 Aug 2026 19:53:54 +0900 (JST)

Received: (qmail 67167 invoked from network); 25 Aug 2026 19:53:54 +0900

Received: from unknown (HELO EC2AMAZ-DC6VTIU) (webmaster@itns.co.jp@15.152.53.28)

by 0 with SMTP; 25 Aug 2026 19:53:54 +0900

MIME-Version: 1.0

From: "Settlement Purchase Information"

To: root@nk.ca

Date: 25 Aug 2026 10:53:54 +0000

Subject: =?utf-8?B?Q2FuYWRpYW4gUGFja2FnZWQgQnJlYWQg4oCUIFNldHRsZW1l?=

=?utf-8?B?bnQgTm90aWNlIDogUmVmIE5vwrogMzgxNjgyNDUxNCAvIDgvMjUvMjAy?=

=?utf-8?B?NiAxMDo1Mzo1NCBBTQ==?=

Content-Type: multipart/alternative;

boundary=--boundary_9533_07120958-0afe-4bb3-b342-29acb8b9cf26

Message-Id: <20260825105354.A5C5D2E8F08@mta.ak116.secure.ne.jp>

X-Spam_score: 6.3

X-Spam_score_int: 63

X-Spam_bar: ++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.

Content preview:
xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office">

Content analysis details: (6.3 points, 5.0 required)

pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[15.152.53.28 listed in will-spam-for-food.eu.org]

[15.152.53.28 listed in will-spam-for-food.eu.org]

[15.152.53.28 listed in will-spam-for-food.eu.org]

[15.152.53.28 listed in will-spam-for-food.eu.org]

[15.152.53.28 listed in will-spam-for-food.eu.org]

[15.152.53.28 listed in will-spam-for-food.eu.org]

[15.152.53.28 listed in will-spam-for-food.eu.org]

[15.152.53.28 listed in will-spam-for-food.eu.org]

[150.60.159.115 listed in will-spam-for-food.eu.org]

[150.60.159.115 listed in will-spam-for-food.eu.org]

[150.60.159.115 listed in will-spam-for-food.eu.org]

[150.60.159.115 listed in will-spam-for-food.eu.org]

[150.60.159.115 listed in will-spam-for-food.eu.org]

[150.60.159.115 listed in will-spam-for-food.eu.org]

[150.60.159.115 listed in will-spam-for-food.eu.org]

[150.60.159.115 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[15.152.53.28 listed in dnsbl.ahbl.org]

[15.152.53.28 listed in dnsbl.ahbl.org]

[15.152.53.28 listed in dnsbl.ahbl.org]

[15.152.53.28 listed in dnsbl.ahbl.org]

[150.60.159.115 listed in dnsbl.ahbl.org]

[150.60.159.115 listed in dnsbl.ahbl.org]

[150.60.159.115 listed in dnsbl.ahbl.org]

[150.60.159.115 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[15.152.53.28 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[15.152.53.28 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[15.152.53.28 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[15.152.53.28 listed in dnsbl.ahbl.org]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[150.60.159.115 listed in list.dnswl.org]

1.1 URIBL_GREY Contains an URL listed in the URIBL greylist

[URI: squarespace.com]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[150.60.159.115 listed in bl.score.senderscore.com]

-0.0 SPF_PASS SPF: sender matches SPF record

2.5 US_DOLLARS_3 BODY: Mentions millions of $ ($NN,NNN,NNN.NN)

0.6 J_CHICKENPOX_75 BODY: 7alpha-pock-5alpha

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 MIME_BASE64_TEXT RAW: Message text disguised using base64 encoding

0.0 LOTS_OF_MONEY Huge... sums of money

0.8 SARE_FROM_SPAM_WORD3 I don't know people named this!

0.0 T_MONEY_PERCENT X% of a lot of money for you

Subject: {SPAM?} =?utf-8?B?Q2FuYWRpYW4gUGFja2FnZWQgQnJlYWQg4oCUIFNldHRsZW1l?=

=?utf-8?B?bnQgTm90aWNlIDogUmVmIE5vwrogMzgxNjgyNDUxNCAvIDgvMjUvMjAy?=

=?utf-8?B?NiAxMDo1Mzo1NCBBTQ==?=

FILE NO. LOBLAW–WESTON / 2008–2026 ONT. S.C.J. · QC S.C.

SC

Notice of Settlement

Loblaw/Weston Packaged Bread

You are receiving this notice as a party identified to have claimed a $100–$200 Loblaw Card under the Packaged Bread Loblaw Card Program (2008–2026), and/or as a registrant with counsel of record in this matter.

Authorized by the Superior Court of Justice for Ontario

Class actions have been certified/authorized by the Ontario Superior Court of Justice and the Superior Court of Quebec on behalf of all individuals and businesses resident in Canada who purchased Packaged Bread, alleging certain manufacturers and retailers engaged in anticompetitive conduct resulting in overcharges. The Courts have not yet made any decision on the merits of the claims or defences in either action.

The Plaintiffs have entered into a national settlement with Loblaw Companies Limited, Loblaws Inc., George Weston Limited, Weston Foods (Canada) Inc., Weston Bakeries Limited, and Weston Food Distribution Inc. (collectively “Loblaw/Weston”), plus their cooperation pursuing claims against non-settling defendants. In exchange, Settlement Class Members release Loblaw/Weston from claims relating to Packaged Bread.

Settlement Ledger

Total settlement fund $500,000,000

Already paid to date $96,000,000

Eligible purchase window Jan 1, 2008 – Dec 31, 2025

If approved by both Courts, net settlement funds will be distributed to Settlement Class Members per the approved distribution protocol. Funds for personal-consumption purchasers will be distributed through a claims process; funds for resale purchasers will be held in trust pending a future Court determination.

Canadian Settlement Class Members’ Options

If you reside anywhere in Canada, except Quebec, and purchased Packaged Bread within the eligible window above, and wish to participate, you do not need to do anything to be included in the Ontario Settlement Class.

Apply Now

For more information and to exercise your rights, read the full Notice at

www.canadianbreadsettlement.ca

A further Notice will be published with details on how eligible Settlement Class Members may claim compensation once the Loblaw/Weston Agreement is approved.

Class Counsel of Record

Strosberg Wingfield Sasso LLP — www.swslitigation.com

Orr Taylor LLP — www.orrtaylor.com

Verita Global, LLC · Claims Administrator

P.O. Box 3355 | London, Ontario | N6A 4K3 | Canada

DoNotReply@m.veritacanada.com

Unsubscribe from these notices

-

Web/SEO/App spam from Microsoft Outlook

Posted by Dave Yadallee on Tuesday, August 25. 2026

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Tue, 25 Aug 2026 07:47:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.100 (FreeBSD))

(envelope-from )

id 1wyrUM-00000000Egw-0cZu

for dave@doctor.nl2k.ab.ca;

Tue, 25 Aug 2026 07:46:54 -0600

Resent-From: The Doctor

Resent-Date: Tue, 25 Aug 2026 07:46:54 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-koreacentralazolkn19011030.outbound.protection.outlook.com ([52.103.74.30]:13033 helo=SE2P216CU007.outbound.protection.outlook.com)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.100 (FreeBSD))

(envelope-from )

id 1wyoYA-00000000NpU-16kc

for sales@nk.ca;

Tue, 25 Aug 2026 04:38:48 -0600

ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none;

b=Hlh+GVFv4+sMYK2Xxe9rgnn4U9cAgK4oMr0eX6YaWAt/lhHENgcOHMLCMiAr2412CmplhGMy0qOWHU6nbRSLMOrJtA54QlJeJZDK6YHbpM2NiPl3C62ItDCT1NCAU2nkK7uR+8O17lC4lPXhGIly4uyOQJKD+hgwTMW7nj5630c3Bh48pfg5VwHX5gNCHbHqgRiRYLiIuJjcq9Dj8Rm2Zm9jgHKhA4wNR5LbA+lqxPKC4jUIRyCFjC7XWNLLcdX6fsvKAPB7k/pwu6qG+R3Q1kf+YyAZMYHIPX/KWPuHXCZygc/l0E3in9bQS8R/xqTp7mQzUe74VzzDlJcC/hz5qw==

ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;

s=arcselector10001;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1;

bh=ch0kGp33m5FNTZ47trW2/dXXzJD+e7en2tTeue/WmWM=;

b=ct0KC5dAEXwACSaWknWl65p1Yy3dPqnZoUz6eNoM8J0VyQEogrmScAdCZ0S3wAQNn+1P7ZZlWHrHcxePWPw6+3bX+iLppVRtTBpkNcMNOfQqmZQgMMKZ9gzhPYEg9YTc9JA2yFs0cV2sHIW964o3Bj4WWDqpaJpjhM7niiHd1vDBILcc2pIKZ3S7bN7rsxiDSXhrmzAWgTW3K3o0SPHKPzXtRMPo7OfGQ7E+fKz4qt6w8YckCwKntqdhbDCUkKeVZa19OqXMs97yzdtiVvCZw7mDuAjjiuP4Ep0ic6khe3V87d9SpehqMz5lMd6750KDABkJs9xmBs9tzNNWgEFh6g==

ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=none; dmarc=none;

dkim=none; arc=none

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=outlook.com;

s=selector1;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck;

bh=ch0kGp33m5FNTZ47trW2/dXXzJD+e7en2tTeue/WmWM=;

b=D3MTi4qaj5jfOvOpNjEyL9iWnZvT5pu4UNgQIKZjHToFVq7FuY/gCOQl37ajegZw7yeh0WTPaBeDBD8EQ9qfwMM+EMmn0p4JvBwRlLDqy4U1r/TzHDNFQh5Z8ocYjldzqxgmy5aBQ1lPi/HuEtljhQjlv8/0Sp4PEO16EVuXYaSAAYyP340ER/R8nZ3d9hHNZESmkk2hFOYj08rBKjiV/YQBvn4xaRc1tM89Qrg8xbEWv8VtlR/jN7uZKSJ+FLgXyuRUehD4kUzeqLNCUQuF/pA1SLjXlB+T4Zu8wDJ2uzhztJk6PrR7XnwLxwOzbc7CqpK/C949wJLsVm0fdnHi2Q==

Received: from SL2P216MB1867.KORP216.PROD.OUTLOOK.COM (2603:1096:101:fd::8) by

SE1P216MB2191.KORP216.PROD.OUTLOOK.COM (2603:1096:101:15a::10) with Microsoft

SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id

15.21.339.12; Tue, 25 Aug 2026 10:37:28 +0000

Received: from SL2P216MB1867.KORP216.PROD.OUTLOOK.COM

([fe80::89cc:4a08:22c9:d7da]) by SL2P216MB1867.KORP216.PROD.OUTLOOK.COM

([fe80::89cc:4a08:22c9:d7da%4]) with mapi id 15.21.0360.005; Tue, 25 Aug 2026

10:37:28 +0000

From: Kelly Smith

Subject: Better Rankings

Thread-Topic: Better Rankings

Thread-Index: AQHdNH23+pOqxfjJZ0mO1NBHvDKNJA==

Date: Tue, 25 Aug 2026 10:37:27 +0000

Message-ID:

Accept-Language: en-GB, en-US

Content-Language: en-GB

X-MS-Has-Attach:

X-MS-TNEF-Correlator:

msip_labels:

x-ms-publictraffictype: Email

x-ms-traffictypediagnostic: SL2P216MB1867:EE_|SE1P216MB2191:EE_

x-ms-office365-filtering-correlation-id: 1ec278a0-ef3c-41ae-d8c9-08df0294dc04

x-microsoft-antispam:

BCL:0;ARA:14566002|24121999003|22091999003|19101099003|24071999003|55001999006|20031999006|8062599012|39105399006|31061999003|8060799015|15030799006|7071999006|15080799012|19110799012|4140399003|25010399006|40105399003|51015399003|260806224601699006|26121999007|2607281247196008|102099032|440099028|3412199025;

x-microsoft-antispam-message-info:

=?Windows-1252?Q?kNADGK67P308wrOroilHB3YTwnm1SmYhhAlXl71rXS4ljmiVu+Jbt4fu?=

=?Windows-1252?Q?3k8X/C3Yrz/LOIBSFPGSiDGSE8xAGJu4VIu8jZt8u+sZNYPsmMDAOudn?=

=?Windows-1252?Q?ysxtl2F9vm2sOXaUo/QumrtZC8yREuol923eOpyq2rMSmyvriaNcoljc?=

=?Windows-1252?Q?x1dr9hdgGCEt7X65jQPmEkXegdXQSuck94Kxcz3iC1f9HOZhn6ycwzUd?=

=?Windows-1252?Q?t/k1GwC3xwbQiJA3bvnaBoNXVj/yU4yWmpc+NnA1RHX2iBDSwR84+h5p?=

=?Windows-1252?Q?Npq9aROBs+Iqqcu2eFenUAp5TnbXEJQ3aPvKK9fKQwEVazRn8T71xLqg?=

=?Windows-1252?Q?cpN/ecxQsfJ1Z+hVlzp5ITGt9ZOA1UqdQy58EZo01Aju6wKrTDP3gj7O?=

=?Windows-1252?Q?nMluCZyWRwbCIeiv3nMmB60ob1vNZK0AJoon3H/iPmaLmoubMH6EiIcz?=

=?Windows-1252?Q?Kt04Kiyrq+KdNWDMHVC3En3NOpHZYWTSS4hGqoX9CnKQuYp8LA88G9oF?=

=?Windows-1252?Q?g8bgU4HbTEfxGUc+pW3vtmfkRSeAZg728JAgjzOh2DUOzxlnfDOV2EOK?=

=?Windows-1252?Q?qaTIdt0dZKFlD6PNPcNRz5fj8Q47U4UZIXQ0PgrbMTp2WuZqvk6hA9OB?=

=?Windows-1252?Q?s9lTip8eBDkdIy7Rar5DvHHBWz5qJ0SUfUr9h5dxULYvbIL23GlyWrMK?=

=?Windows-1252?Q?3SdnA8divjn7mIwSdBPXbkMnyeElqHcmRoF9Z5W8IiVA/oC1w+Th1znk?=

=?Windows-1252?Q?5ZAp6guMOQ/2UW7uzJtisSelz0c1/JQE2hkeaUTKiXIJKqb6h4fuckeb?=

=?Windows-1252?Q?x3fQAi1VmiuoEK29ItQaHoIkhs6HbrrbYKvyiVGi7auCNowQ75taYu9m?=

=?Windows-1252?Q?5uGEc+hF7WWyZaPaI2AGiG/SR77BfkCgereM+jFzentUVAwMIpKiZuBN?=

=?Windows-1252?Q?SHDnzeaHVUnRtmF0hwA88kZBarBhceLbNRxfIWvWj3o5cYnfNmsUdJIY?=

=?Windows-1252?Q?DpkWhjDGPF8tTKqp97NUqiVi/zzspmtI8VpIWBkyAhdWeRPlot5XWzvb?=

=?Windows-1252?Q?52U/m+c0vH9J6ZNDj0VyZOwPE6JMHQGOdp1sAADas9B5KCkl4E6+XXuA?=

=?Windows-1252?Q?0Np8jqOjxdvDBECa/pFHavRtv51nTSUhIVZUj2xbgVvXG2xAeBvbydcJ?=

=?Windows-1252?Q?rS79oSXx62DcGglqnSRSuSGVohg3J/B1e620scvd+rplrmDIXqcD3Wcs?=

=?Windows-1252?Q?YePnLL5RlpxSOL90rP6VV+slyUWGRyIyEqKqmpdcIvvryPZ7wNajqoED?=

=?Windows-1252?Q?VWcgWgKeGUi8Y10kl4JkXK2OqrWL4VIvrk1sPflJe+JBWCOEc1AXCf0Q?=

=?Windows-1252?Q?oRrYzrqDDVAJyg=3D=3D?=

x-ms-exchange-antispam-messagedata-chunkcount: 1

x-ms-exchange-antispam-messagedata-0:

=?Windows-1252?Q?pKqACpkAHEci1DRNNej3FFvmYpOt03Nk5hAzsr/500E/bj2I7WSWlvBf?=

=?Windows-1252?Q?pdrnXZLWddldH7hQidoFwKmJ+nqKlv86xjvVim5HfA6FVQ+15H4nmAuv?=

=?Windows-1252?Q?K6WEXgxlwyz/pUi118/AV8nEp8kVV9wxjG/GallwOeFpTIlAaiVOpu/E?=

=?Windows-1252?Q?zMRdTHZ94vMi1nuDjLqlSikeHOFCW/19fFx8SBu4hebmJsxX2L96dSNc?=

=?Windows-1252?Q?5D4sBU5M6NUHvMQcg2uG2VG5hd9MWkU5OILTmfbQlsQDAuOpGl1Oli8L?=

=?Windows-1252?Q?AMBYWw4evwo3IjNzsoTSwZNyhapOGYy6nfhQ43E0cnri3GSnv0/ivflu?=

=?Windows-1252?Q?FH4SVfy8o4w0OHQwJiysnPSpBNzyrPmGq07J98xW9P4xMSjt0RSCg47C?=

=?Windows-1252?Q?da7bkPL9wCrqmsejNgBQmbZPyP+eVi0kdsDWbfV67MK4deEqP8bLPII9?=

=?Windows-1252?Q?zEtDQkOqzrCVuMPHEVLDV4/rk7/EzYd/qj/gKhFnAJzmPDxL4hfnp/CG?=

=?Windows-1252?Q?+q3qGqnUSP1eVguGPwNrdfa7xIcGUA+PvdUp7BoB16dOJz4PKp/QyWaX?=

=?Windows-1252?Q?ouLYh2rkKAB7Il0xccmHP4JykkhdbXwMp0/S8GXmehmzNmjy7/Jlr764?=

=?Windows-1252?Q?QRRDH10muH//YpicbMmzpMpiDqbkbnT+XghOg8vZqw7T8XX6F17Zdrit?=

=?Windows-1252?Q?Y0CjzR7DO0aeku3//nfBE/n6fg7Q1uU7XcSNJi6oPwQ/VLqMmWJr7y1E?=

=?Windows-1252?Q?4ks9s1O+2HrEX4306JL962PHOKzA6V1Yvpi5y6ZC6p38xcwNxhBuZFzj?=

=?Windows-1252?Q?K8/+TTSjYx9e9oZBwIwsH473svdx92XKPW5gRzJU9LzgAaMAhcidPtbG?=

=?Windows-1252?Q?n0NcpiesvSJjEVAdeMjsnvVEGs0w7v2fRpAHOgkB76XyW3luNM0erVoN?=

=?Windows-1252?Q?90wa9j9gxmCD1zkoAjfecV7iT6/vh2LSaOwpB2XWgnXI1vpexV/NfWSo?=

=?Windows-1252?Q?PBiN6mA5KFjKJwiI0WWj39nII8hC9iqG6qAAWJGSpH+OeoyP1KjpgfoU?=

=?Windows-1252?Q?Q9xS0IqJqFvisI6ZexjX12ktlMZ4phayfBK3iL/ka33ral6/lJLPKMgD?=

=?Windows-1252?Q?Mv02PjlNbFwmUyClj0j58vSVFEEB6ExuKNpy909dZkMD2ob6LLPqfrUW?=

=?Windows-1252?Q?RSgHF9RU9dR9wPLFwGs7yc7ppy0kupE1QSmBIDCjRAiGajJSoXOkNumd?=

=?Windows-1252?Q?gHM3XGMc8Zvph/b70jXL0Jy0mP0WH8a1DJSxAkx323TOTJ7z4Hg8Vf9+?=

=?Windows-1252?Q?tkwF9AFhwEzT+sFPPyJBGMCdQrXzCvzRhT13Z7yOfpzbBDZivb0JnOKt?=

=?Windows-1252?Q?/D3L2LjgUmGYNIkvhhH8KPDbKm203VqGkjCKRXRBib7uZWaeaIHibG/2?=

=?Windows-1252?Q?maFZHw6sCW/BXe7QuoWbCrsMMo+UM8B6WDEB9kbDLl0GGmgaOkeSBGTU?=

=?Windows-1252?Q?i0JaCcCW?=

Content-Type: multipart/alternative;

boundary="_000_SL2P216MB1867C230275FD45075B99AEDD3AF2SL2P216MB1867KORP_"

MIME-Version: 1.0

X-OriginatorOrg: outlook.com

X-MS-Exchange-CrossTenant-AuthAs: Internal

X-MS-Exchange-CrossTenant-AuthSource: SL2P216MB1867.KORP216.PROD.OUTLOOK.COM

X-MS-Exchange-CrossTenant-RMS-PersistedConsumerOrg: 00000000-0000-0000-0000-000000000000

X-MS-Exchange-CrossTenant-Network-Message-Id: 1ec278a0-ef3c-41ae-d8c9-08df0294dc04

X-MS-Exchange-CrossTenant-originalarrivaltime: 25 Aug 2026 10:37:27.9220

(UTC)

X-MS-Exchange-CrossTenant-fromentityheader: Hosted

X-MS-Exchange-CrossTenant-id: 84df9e7f-e9f6-40af-b435-aaaaaaaaaaaa

X-MS-Exchange-CrossTenant-rms-persistedconsumerorg: 00000000-0000-0000-0000-000000000000

X-MS-Exchange-Transport-CrossTenantHeadersStamped: SE1P216MB2191

--_000_SL2P216MB1867C230275FD45075B99AEDD3AF2SL2P216MB1867KORP_

Content-Type: text/plain; charset="Windows-1252"

Content-Transfer-Encoding: quoted-printable

Hi,

We help businesses strengthen their search presence and compete for valuabl=

e Google searches.

Our services include:

=95 Keyword Research

=95 Website Optimization

=95 Technical SEO

=95 Local SEO

=95 Content Optimization

=95 Link Building

=95 Search Visibility Growth

Would you like me to share our SEO options and pricing?

Thanks & Regards,

Kelly

--_000_SL2P216MB1867C230275FD45075B99AEDD3AF2SL2P216MB1867KORP_

Content-Type: text/html; charset="Windows-1252"

Content-Transfer-Encoding: quoted-printable

252">

font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helv=

etica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">

Hi,

font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helv=

etica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">

We help businesses strengthen their search presence and compete for valuabl=

e Google searches.

font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helv=

etica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">

Our services include:

font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helv=

etica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">

=95 Keyword Research

=95 Website Optimization

=95 Technical SEO

=95 Local SEO

=95 Content Optimization

=95 Link Building

=95 Search Visibility Growth

font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helv=

etica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">

Would you like me to share our SEO options and pricing?

font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helv=

etica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">

Thanks & Regards,

font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helv=

etica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">

Kelly

--_000_SL2P216MB1867C230275FD45075B99AEDD3AF2SL2P216MB1867KORP_--

Blog Article spammer from Microsoft Outlook

Posted by Dave Yadallee on Tuesday, August 25. 2026

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Tue, 25 Aug 2026 07:47:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.100 (FreeBSD))

(envelope-from )

id 1wyrTx-00000000Ecp-1BL1

for dave@doctor.nl2k.ab.ca;

Tue, 25 Aug 2026 07:46:29 -0600

Resent-From: The Doctor

Resent-Date: Tue, 25 Aug 2026 07:46:29 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-francecentralazon11023099.outbound.protection.outlook.com ([40.107.162.99]:12311 helo=PA4PR04CU001.outbound.protection.outlook.com)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.100 (FreeBSD))

(envelope-from )

id 1wynsE-00000000FRs-0ehP

for sales@nk.ca;

Tue, 25 Aug 2026 03:55:27 -0600

ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none;

b=mfC1DFGGqwT0Evr4rXQ7mt9AFfhRzAxpr/Yl1e8pNrZYg73Gzv4FQiUwerRMiTCwx5/sb4RwiMKqSUsspGLPbJQdyrTg2+rkMyNxM0A12F6ypoqjhaHu+aDd+WRG3Wxm4u2+5h6UiRCvJybsnMXZqRoAiw7yUyiBAMugsD0JEHx78qPAVjUJ203b3XnJWgSPngeXyRKsyirqUMI4pzIqBFAH1AMgx9+sBL0YuTFTT+cnivEik/nEhCd7DPsSqMUuYibN28Nd600EgqF3sOvrM5g2y0M9hzmPd0VvHjRLiopq0eFf4oDEkaNlZ7/uQKRjDacF0eZRvi6kxXCTgds3vw==

ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;

s=arcselector10001;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1;

bh=grkQt9zhxOpEi3dcK1DC3oyEAmMeGg0gQ36J10mVxqc=;

b=aL+pmo7qfgyTr1F3GEOnrfA9zG64KNsrUWKpyuXqHLR60xsWQqjx5oxjDV1ohTz5Yxtq9Ldj8+0fQelnjK3+/bO9aLVsOKNdFrrj/1POrWDfbhOjn5lAU3GKOuqxlgzbpptQH5YQo//7dCdQ2xPgBi27q9jGj9i8lJrPqD5PD/MHmruONfMyLhHXpB5qOXpQ0o0E6limCFcbbanv7zGQQXZEWOdVxH24vfU9brexMeJlcYak7LVXNoSUD72dcz8CEHmBQ8iw3ib/uvqGMmEHEPuHwjulv162i+5l60jiiXf1SZRu0dg5zAUeAWQF7nlp/ly7XSxrG0I0aGXUGLPKww==

ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass

smtp.mailfrom=klicklinks.info; dmarc=pass action=none

header.from=klicklinks.info; dkim=pass header.d=klicklinks.info; arc=none

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=klicklinks.info;

s=selector1;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck;

bh=grkQt9zhxOpEi3dcK1DC3oyEAmMeGg0gQ36J10mVxqc=;

b=js+OTbDn1y16Wu9QX0TbJ+AtA8O0zXY+GHkUD1AhfSDcsYS2VKYWyYXapFID3OFou7/iHsPUoDFAGSK29yl/XRcMHQ46nXuGxG4e8jnSamQHpui1NGe64EQR4xCNpuWFouS+kRDUhbCpmSNgD0/rqoNEQqF9L3L6Hy4Lgu0c83ZVHbfHszppuJCnTvGCW0XeZH68I64wTG7oKuYW9DZ83ruL4UUkEYJx20UGPPlpG3B+TMg0SchE5Oe/gpumjbuYnp0vAE66NXA5X+1YFCrlq1DFpBtUOkmmM3HH6dnBsWQmyxZd3LStlxl8csTHlcxA7N1yw037V5oQUWSgRx6S+Q==

Received: from DU4PR04MB11772.eurprd04.prod.outlook.com (2603:10a6:10:615::5)

by AS8PR04MB8295.eurprd04.prod.outlook.com (2603:10a6:20b:3b0::16) with

Microsoft SMTP Server (version=TLS1_2,

cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.360.6; Tue, 25 Aug

2026 09:54:21 +0000

Received: from DU4PR04MB11772.eurprd04.prod.outlook.com

([fe80::1d70:59c2:a77f:8171]) by DU4PR04MB11772.eurprd04.prod.outlook.com

([fe80::1d70:59c2:a77f:8171%3]) with mapi id 15.21.0360.005; Tue, 25 Aug 2026

09:54:21 +0000

From: Liora Adler

To: "sales@nk.ca"

Subject: Re: Quick question about nk.ca

Thread-Topic: Quick question about nk.ca

Thread-Index: AQHdE4f67TyCXD7x7EKuGINX4BKqfLaHhy6VgCdBIco=

Date: Tue, 25 Aug 2026 09:54:21 +0000

Message-ID:

References:

In-Reply-To:

Reply-To: Liora Adler

Accept-Language: en-US, sr-Latn-CS

Content-Language: en-US

X-MS-Has-Attach:

X-MS-TNEF-Correlator:

authentication-results: dkim=none (message not signed)

header.d=none;dmarc=none action=none header.from=klicklinks.info;

x-ms-publictraffictype: Email

x-ms-traffictypediagnostic: DU4PR04MB11772:EE_|AS8PR04MB8295:EE_

x-ms-office365-filtering-correlation-id: b090c658-8b0b-491e-2237-08df028ed65f

x-ms-exchange-senderadcheck: 1

x-ms-exchange-antispam-relay: 0

x-microsoft-antispam:

BCL:0;ARA:13230040|376014|23010399003|366016|1800799024|8096899003|10067099003|4143699003|56012099006|18002099003|22082099003|38070700021;

x-microsoft-antispam-message-info:

vFoL8GjZmwBu+4vlO5OQLPlehp4CQn82JsfOSTx07Q7ZuxbYqMUDPwimjJP4F/Ywc6/RGkz6hSGFYCcVsxSF2wSSNVMa0+iKfpEotN1SU/FungaAwEKNADoX8ekteQ7UBL0yZsHP0OjtBtzaWd9mbRsTQLUr9GAK9AZfHFBVOfonAJPKOH/K/2DzqZFoKpCy/mV+chbmpepZQIsrkw89C7YfyVcCi0KIR7FS8xNTOWRzBTr6VnNy6Ln6+FmW/+wUKSKPZDlajp13niJTp4s87MBanYLZTn5f22uwAFimeyIidwH864SDwyCqXk/DI0b4w49sGUhE40bhXNmZKEA9RSmjMqKfaeHxoDljY8KfQPavll320gAiI7csJPfJ+a9hlboBLYiO//2nKDbP4SxowBZ6xdToz0gliKK6DdNuXcnHshXiL7fharcoHVGzaU4yKDRfP6ab4gBX7yBy7pAOd1zuvgyUkTIGXnATrWFc0ya4bXiaaiDyzm4tYgSTQReu2q4S1wz1NyG3CVHPabbw/WJGOy26AglxXRnh+pG/em8JbGHvSN+sCmU88D5v9V96kYpZWQ0RFVh5thJIpdKHrsjAgFkOxF1TdElNejuldRC+fhV0xxD0EsqcYKmmIZrHQ9EKSk+lkTmlKSVswppYAH7zhSmmb/Q1hpZty1YSDJftLHq/fN7dWb8gWQ/rFY55/JK6c7qSUA8MJiztE+/bbn2PJB0cXmsiwcz1vzjRIcA=

x-forefront-antispam-report:

CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:DU4PR04MB11772.eurprd04.prod.outlook.com;PTR:;CAT:NONE;SFS:(13230040)(376014)(23010399003)(366016)(1800799024)(8096899003)(10067099003)(4143699003)(56012099006)(18002099003)(22082099003)(38070700021);DIR:OUT;SFP:1102;

x-ms-exchange-antispam-messagedata-chunkcount: 1

x-ms-exchange-antispam-messagedata-0:

=?Windows-1252?Q?pWCalsq1lSuTckD3tkgOti63AD6BXguQZpivCti4mFyS5/RvW4Da3wC8?=

=?Windows-1252?Q?2+o2+DWwLQELv51zI6G1eXP4u+T47tMGmyEjIaGySZwjj691+6N20tCI?=

=?Windows-1252?Q?n+aJuYddfIJWPSYiR+xWP8JXdXGtrDuyuGnB1ryhRAdlXYWPI8QxrT1F?=

=?Windows-1252?Q?Q7axK6T1n073DKcDPJbl7oOmC11l9xi4MukJ9dDR/HL2UkXS+ALawguh?=

=?Windows-1252?Q?TDjreTsM9qhM7qtfHgOfFR2lbUsh7N6nk6OhbohIN+9Adf068RnaCufj?=

=?Windows-1252?Q?GvyuCXev+3IuBGRLiFZXk2nYGxol9Kth3r/Q7Jyc+0PU3AwN/Euu/8Xd?=

=?Windows-1252?Q?l3ZiaSRoxRuCn+ZUjAFaUHI8blAnLYgROYHm8FZYOLg95z5uJ3Z9V0Xg?=

=?Windows-1252?Q?Oo+CwspYVP0ESDoQ+vS6WjwXMwHGJqXY37bDLmrHee2AR++RUpx1ZyYq?=

=?Windows-1252?Q?YUU9v12U5NuMxjuOUm/aqXsNDy3MBSiErkF90TDl7vYHAuay7FpYBMxP?=

=?Windows-1252?Q?3ffGtkWJQdhI0rMpP+YKrFQZ2xnKc7clu4zE+cJWV4aJ9scd54ybkVF2?=

=?Windows-1252?Q?ZtXMEixqqm2clOekWLzSNH1wfIHO94uz+LHdeOV7p2EoyeVbA4U3XNZW?=

=?Windows-1252?Q?d1iavfFELremXsWmRUGsL2UmLk2BeJDVRSdro9BHJR9Rfoi1kO4S9O+D?=

=?Windows-1252?Q?ysk6zEyWkwoGJO8vzwlsGOTSXnmEbBeSLcZgiiEb7kp86LPIHyQkJ5rv?=

=?Windows-1252?Q?wEWl+j+aFeFZNS8/5nwkCgLaEoeyiiGkyc5bt34uIfuO4CkNYQSfeBfg?=

=?Windows-1252?Q?5aphip3zsYkk/MEZtq3yuA5/Jc0uQFIfH5si7Op/AvK9RA82Xtwugh7Z?=

=?Windows-1252?Q?cx/t3BUywDmJz1X8liUqbno4BT7lWzByDRH8iN48BONhSWIJX8FPP5IB?=

=?Windows-1252?Q?/m5ziJO3sWwYhw2n0Z417dU3q+KmZf2JVnH61bGOYbV/myXU5Qs0dAYW?=

=?Windows-1252?Q?ITpq0PLRHboLS0PP705Y6d02WiAZEnMB29IrGlMqxKHndiKz6OqhEnmi?=

=?Windows-1252?Q?7vA6PHiVWRWeqcINbeZDSt03idZ4VF8msplwJlScXbSt3Jyc7kiQ+56N?=

=?Windows-1252?Q?2ZrGhqAlbxTGX5Vc2KUw4uxkdAS8KdQXII7UtjiJp4UEWT9z7tmF/Lzv?=

=?Windows-1252?Q?LgpgaNlwHfz1jWzNwrbKTmxVo5v5InKtA35el5F399E2cqSKZSzaciuN?=

=?Windows-1252?Q?7wfbnQ63VlabsPoyUxY9UtpBhj6/Aabf/1E3vyhvFlhCG8QC3YRXC/ai?=

=?Windows-1252?Q?Xez42QTtWLeNcXCGSKO28uiwU1tx/QZHq7UIKVWl+9qgkNc+TCNkuvp/?=

=?Windows-1252?Q?SXmG/f8haOVQw7fM1H83pJ0zAZ8O8zek8xEyWbfIZBSFcGwlFh/3w/cO?=

=?Windows-1252?Q?FTkFnv1HLmRSjMMkfsZrqbv+4LRkhW6NUEckbIEiF4idi5AOomnXbl38?=

=?Windows-1252?Q?jIbjQ9uuFzCq04Zbs4+qv+IzPq44zkHzGyRpJ3bf/mppOGLNYTodJ37B?=

=?Windows-1252?Q?/XbyM3P4BeXtGBPKArGkD3Q+sZIDOILkhTzN/8HeJWwM66zSgn89/fEt?=

=?Windows-1252?Q?2VuMiQFMm8ZOixLstgVDx1XntAbz+eADelyUXJhBWrn19ihjyZxV2TWS?=

=?Windows-1252?Q?AVg+g2cMX0SvpDSAZAShR6j2OG3Km04YZiEHZazoib8gaUFhNboyDy6i?=

=?Windows-1252?Q?jW3mZZe8PWnw1/xZODwJMD78KQUWceQ/nJk9i9tV9Qw0zMWlDAgCmjT6?=

=?Windows-1252?Q?afpyM1BzkeaFG7QvpYKN+ac1TNoNH47T5HljNI1diLfidxTiVMb2TZhE?=

=?Windows-1252?Q?QZ6Lddzd4mKqAw=3D=3D?=

Content-Type: multipart/alternative;

boundary="_000_DU4PR04MB1177203EDF141C5E27D26A1F1B6AF2DU4PR04MB11772eu_"

MIME-Version: 1.0

X-OriginatorOrg: klicklinks.info

X-MS-Exchange-CrossTenant-AuthAs: Internal

X-MS-Exchange-CrossTenant-AuthSource: DU4PR04MB11772.eurprd04.prod.outlook.com

X-MS-Exchange-CrossTenant-Network-Message-Id: b090c658-8b0b-491e-2237-08df028ed65f

X-MS-Exchange-CrossTenant-originalarrivaltime: 25 Aug 2026 09:54:21.5023

(UTC)

X-MS-Exchange-CrossTenant-fromentityheader: Hosted

X-MS-Exchange-CrossTenant-id: dd7b1d48-c69e-46e6-b08f-0d21fe331609

X-MS-Exchange-CrossTenant-mailboxtype: HOSTED

X-MS-Exchange-CrossTenant-userprincipalname: WhN/iH4djZ0CM6/Lzwo6rU6a22FVBzNPfTYHlmCkqnmDju0Alf5HnneEl+65c5DdN1jU0Tbsutj7TT6BGxDWhg==

X-MS-Exchange-Transport-CrossTenantHeadersStamped: AS8PR04MB8295

--_000_DU4PR04MB1177203EDF141C5E27D26A1F1B6AF2DU4PR04MB11772eu_

Content-Type: text/plain; charset="Windows-1252"

Content-Transfer-Encoding: quoted-printable

Hi,

I wanted to quickly follow up on my earlier email about contributing a tail=

ored article to nk.ca.

I=92d be glad to provide original content that resonates with your readers =

and meets your publishing standards.

Could you let me know if you=92re open to this collaboration and share your=

placement terms?

Best regards,

Liora Adler

Outreach Specialist | KlickLinks

Reply 'Stop' if you'd prefer not to receive messages at this time.

________________________________

From: Liora Adler

Sent: Friday, 31 July 2026 10:27:07

To: sales@nk.ca

Subject: Re: Quick question about nk.ca

Hi,

I just wanted to follow up on my previous email regarding publishing an art=

icle on nk.ca.

I believe the content would be a great fit for your readers, and I=92d be h=

appy to provide a unique piece tailored to your audience. Could you please =

let me know if you=92re open to this collaboration and what the placement f=

ee would be?

Looking forward to your reply.

Best regards,

Liora Adler

Outreach Specialist at KlickLinks

Reply 'Stop' if you'd prefer not to receive messages at this time.

________________________________

From: Liora Adler

Sent: Tuesday, 14 July 2026 11:57:43

To: sales@nk.ca

Subject: Quick question about nk.ca

Hi,

I'm Liora and I help companies place high-quality content on relevant websi=

tes.

Would you be open to publishing articles on nk.ca? I will provide you with =

a high-quality and unique article that will be interesting for your readers=

.

If you are interested, please let me know what will be the price for the ar=

ticle placement.

Best Regards,

Liora Adler

Outreach Specialist at KlickLinks

Reply 'Stop' if you'd prefer not to receive messages at this time.

--_000_DU4PR04MB1177203EDF141C5E27D26A1F1B6AF2DU4PR04MB11772eu_

Content-Type: text/html; charset="Windows-1252"

Content-Transfer-Encoding: quoted-printable

252">

Hi,

I wanted to quickly follow up on my earlier email about contributing a=

tailored article to nk.ca.

I=92d be glad to provide original content that resonates with your readers =

and meets your publishing standards.

Could you let me know if you=92re open to this collaboration and share your=

placement terms?

Best regards,

Liora Adler

Outreach Specialist | KlickLinks

Reply 'Stop' if you'd prefer not to receive =

messages at this time.

lor=3D"#000000" style=3D"font-size:11pt">From: Liora Adler <liora=

@klicklinks.info>

Sent: Friday, 31 July 2026 10:27:07

To: sales@nk.ca <sales@nk.ca>

Subject: Re: Quick question about nk.ca

Hi,

I just wanted to follow up on my previous email regarding publishing an art=

icle on nk.ca.

I believe the content would be a great fit for your readers, and I=92d be h=

appy to provide a unique piece tailored to your audience. Could you please =

let me know if you=92re open to this collaboration and what the placement f=

ee would be?

Looking forward to your reply.

Best regards,

Liora Adler

Outreach Specialist at KlickLinks

Reply 'Stop' if you'd prefer not to receive =

messages at this time.

lor=3D"#000000" style=3D"font-size:11pt">From: Liora Adler

Sent: Tuesday, 14 July 2026 11:57:43

To: sales@nk.ca <sales@nk.ca>

Subject: Quick question about nk.ca

Hi,

I'm Liora and I help companies place high-quality content on relevant websi=

tes.

Would you be open to publishing articles on nk.ca? I will provide you with =

a high-quality and unique article that will be interesting for your readers=

.

If you are interested, please let me know what will be the price for t=

he article placement.

Best Regards,

Liora Adler

Outreach Specialist at KlickLinks

Reply 'Stop' if you'd prefer not to receive =

messages at this time.

--_000_DU4PR04MB1177203EDF141C5E27D26A1F1B6AF2DU4PR04MB11772eu_--

Nigerian spam

Posted by Dave Yadallee on Tuesday, August 25. 2026

Canadian Bread Information Centre Phish

Posted by Dave Yadallee on Tuesday, August 25. 2026

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Tue, 25 Aug 2026 02:39:00 -0600

Received: from [150.60.154.254] (port=16754 helo=af106.secure.ne.jp)

by doctor.nl2k.ab.ca with smtp (Exim 4.100 (FreeBSD))

(envelope-from )

id 1wymff-0000000000q-22hI

for dave@doctor.nl2k.ab.ca;

Tue, 25 Aug 2026 02:38:23 -0600

Received: (qmail 12178 invoked from network); 25 Aug 2026 17:37:22 +0900

Received: from unknown (HELO EC2AMAZ-DC6VTIU) (admin@maruko18.co.jp@15.152.53.28)

by 0 with SMTP; 25 Aug 2026 17:37:22 +0900

MIME-Version: 1.0

From: "Canadian Bread Information Centre"

To: dave@doctor.nl2k.ab.ca

X-Priority: 1

Priority: urgent

Importance: high

Date: 25 Aug 2026 08:37:22 +0000

Subject: =?utf-8?B?VW5kZXJzdGFuZGluZyB0aGUgQ2FuYWRpYW4gQnJlYWQgU2V0?=

=?utf-8?B?dGxlbWVudCA6IFJlZiBOb8K6IDU3ODQ2NTcwNTMgLyA4LzI1LzIwMjYg?=

=?utf-8?B?ODozNzoyMiBBTQ==?=

Content-Type: multipart/alternative;

boundary=--boundary_3242_37796a29-b44f-42a5-9a24-593fcc37888a

X-Spam_score: 11.7

X-Spam_score_int: 117

X-Spam_bar: +++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.

Content preview:
xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office">

Content analysis details: (11.7 points, 5.0 required)

pts rule name description

---- ---------------------- --------------------------------------------------

0.1 MISSING_MID Missing Message-Id: header

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[150.60.154.254 listed in dnsbl.ahbl.org]

[150.60.154.254 listed in dnsbl.ahbl.org]

[150.60.154.254 listed in dnsbl.ahbl.org]

[150.60.154.254 listed in dnsbl.ahbl.org]

[15.152.53.28 listed in dnsbl.ahbl.org]

[15.152.53.28 listed in dnsbl.ahbl.org]

[15.152.53.28 listed in dnsbl.ahbl.org]

[15.152.53.28 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[150.60.154.254 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[150.60.154.254 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[150.60.154.254 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[150.60.154.254 listed in dnsbl.ahbl.org]

1.1 URIBL_GREY Contains an URL listed in the URIBL greylist

[URI: squarespace.com]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[150.60.154.254 listed in list.dnswl.org]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[150.60.154.254 listed in will-spam-for-food.eu.org]

[150.60.154.254 listed in will-spam-for-food.eu.org]

[150.60.154.254 listed in will-spam-for-food.eu.org]

[150.60.154.254 listed in will-spam-for-food.eu.org]

[150.60.154.254 listed in will-spam-for-food.eu.org]

[150.60.154.254 listed in will-spam-for-food.eu.org]

[150.60.154.254 listed in will-spam-for-food.eu.org]

[150.60.154.254 listed in will-spam-for-food.eu.org]

[15.152.53.28 listed in will-spam-for-food.eu.org]

[15.152.53.28 listed in will-spam-for-food.eu.org]

[15.152.53.28 listed in will-spam-for-food.eu.org]

[15.152.53.28 listed in will-spam-for-food.eu.org]

[15.152.53.28 listed in will-spam-for-food.eu.org]

[15.152.53.28 listed in will-spam-for-food.eu.org]

[15.152.53.28 listed in will-spam-for-food.eu.org]

[15.152.53.28 listed in will-spam-for-food.eu.org]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[150.60.154.254 listed in bl.score.senderscore.com]

-0.0 SPF_HELO_PASS SPF: HELO matches SPF record

-0.0 SPF_PASS SPF: sender matches SPF record

2.5 US_DOLLARS_3 BODY: Mentions millions of $ ($NN,NNN,NNN.NN)

0.6 J_CHICKENPOX_75 BODY: 7alpha-pock-5alpha

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 MIME_BASE64_TEXT RAW: Message text disguised using base64 encoding

0.0 LOTS_OF_MONEY Huge... sums of money

1.3 RDNS_NONE Delivered to internal network by a host with no rDNS

4.0 DOS_BODY_HIGH_NO_MID High bit body and no message ID header

0.8 SARE_FROM_SPAM_WORD3 I don't know people named this!

0.0 T_MONEY_PERCENT X% of a lot of money for you

Subject: {SPAM?} =?utf-8?B?VW5kZXJzdGFuZGluZyB0aGUgQ2FuYWRpYW4gQnJlYWQgU2V0?=

=?utf-8?B?dGxlbWVudCA6IFJlZiBOb8K6IDU3ODQ2NTcwNTMgLyA4LzI1LzIwMjYg?=

=?utf-8?B?ODozNzoyMiBBTQ==?=

FILE NO. LOBLAW–WESTON / 2008–2026 ONT. S.C.J. · QC S.C.

SC

Notice of Settlement

Loblaw/Weston Packaged Bread

You are receiving this notice as a party identified to have claimed a $100–$200 Loblaw Card under the Packaged Bread Loblaw Card Program (2008–2026), and/or as a registrant with counsel of record in this matter.

Authorized by the Superior Court of Justice for Ontario

Class actions have been certified/authorized by the Ontario Superior Court of Justice and the Superior Court of Quebec on behalf of all individuals and businesses resident in Canada who purchased Packaged Bread, alleging certain manufacturers and retailers engaged in anticompetitive conduct resulting in overcharges. The Courts have not yet made any decision on the merits of the claims or defences in either action.

The Plaintiffs have entered into a national settlement with Loblaw Companies Limited, Loblaws Inc., George Weston Limited, Weston Foods (Canada) Inc., Weston Bakeries Limited, and Weston Food Distribution Inc. (collectively “Loblaw/Weston”), plus their cooperation pursuing claims against non-settling defendants. In exchange, Settlement Class Members release Loblaw/Weston from claims relating to Packaged Bread.

Settlement Ledger

Total settlement fund $500,000,000

Already paid to date $96,000,000

Eligible purchase window Jan 1, 2008 – Dec 31, 2025

If approved by both Courts, net settlement funds will be distributed to Settlement Class Members per the approved distribution protocol. Funds for personal-consumption purchasers will be distributed through a claims process; funds for resale purchasers will be held in trust pending a future Court determination.

Canadian Settlement Class Members’ Options

If you reside anywhere in Canada, except Quebec, and purchased Packaged Bread within the eligible window above, and wish to participate, you do not need to do anything to be included in the Ontario Settlement Class.

Apply Now

For more information and to exercise your rights, read the full Notice at

www.canadianbreadsettlement.ca

A further Notice will be published with details on how eligible Settlement Class Members may claim compensation once the Loblaw/Weston Agreement is approved.

Class Counsel of Record

Strosberg Wingfield Sasso LLP — www.swslitigation.com

Orr Taylor LLP — www.orrtaylor.com

Verita Global, LLC · Claims Administrator

P.O. Box 3355 | London, Ontario | N6A 4K3 | Canada

DoNotReply@m.veritacanada.com

Unsubscribe from these notices

Nk.CA credential phishing to Google Gmail

Posted by Dave Yadallee on Tuesday, August 25. 2026

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Tue, 25 Aug 2026 07:46:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.100 (FreeBSD))

(envelope-from )

id 1wyrSh-00000000CR1-3IFW

for dave@doctor.nl2k.ab.ca;

Tue, 25 Aug 2026 07:45:11 -0600

Resent-From: The Doctor

Resent-Date: Tue, 25 Aug 2026 07:45:11 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-ot1-f103.google.com ([209.85.210.103]:43434)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.100 (FreeBSD))

(envelope-from )

id 1wylJv-000000008Xy-0cmD

for root@nl2k.ab.ca;

Tue, 25 Aug 2026 01:11:51 -0600

Received: by mail-ot1-f103.google.com with SMTP id 46e09a7af769-7ee4f241f42so447466a34.1

for ; Tue, 25 Aug 2026 00:10:08 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=brushme.com.ua; s=google; t=1787641802; x=1788246602; darn=nl2k.ab.ca;

h=content-transfer-encoding:content-type:mime-version:message-id:date

:subject:to:from:from:to:cc:subject:date:message-id:reply-to

:content-type;

bh=yygeFoTg4U6V/0mVjOueeTqvRKSLqeJTOr+D9s3WyKE=;

b=Ixnc6Q+3BRgobdAjvycUOFJXr4MtpFRDbpsLgme0/UE+NufZDLrukuR1YQZ96HuZvg

hQEibl5vJoNTTxnD3vN5818oPB/ku8YI1AeVo7dbP170RdC8pHLnsEfOsAhom3067W+k

y9kV8MkFA99qxS1N+hBmMSAaez7KmU+ccdt1xrXSCcB7KX1AYs6JbUAg3hh7yM4e1PPR

R7JAadWLz51RfCe35A1TMTxCTRzjUKce6gPq+QLNlb2NANwdtZsu1PqOIkNKfuSqRWl+

xXQKaF128pMYbraI4pHn9LB8Lgu17MTe/yucG8r3l2OLRh+uKEVmS6+n8EEM54mZuuEa

HpFw==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20251104; t=1787641802; x=1788246602;

h=content-transfer-encoding:content-type:mime-version:message-id:date

:subject:to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date

:message-id:reply-to:content-type;

bh=yygeFoTg4U6V/0mVjOueeTqvRKSLqeJTOr+D9s3WyKE=;

b=V7U/HHMHEOIcDY/i4sjCpPW7GRt+B2vJxw6BgO+pV57yaq+3eJQgtKQZ6RTVQKArqL

WuQd5Wku2YLoXhS+w5jTkon89NWTIJjZ4GGrFUflWUhGaQ1opmjAsuDTSLelzFJOmu9s

4jYXgjdHlnOjoLlfODGuRJtzJyU6rox6Bdd7RS0vEqxnbB1JzcZTzTXWXD7HNNZejNPv

aS9IRcf3VzOyob2brdzXQdK7xsZhIZ+4NhTRG2mtUEoEFPGZcohJh8gHAHUnDsvBlRSE

920/Wjh3njg1An5jmvebEkL+cZzGVY3dsK2QjsJmfJw2arkZpZRqhWOgxJNUQCJEXxF2

Ce1A==

X-Gm-Message-State: AFuF++mGXD/dKJhbUx6Zk8eZYXUY3HWnHPw7c6N2G4nmng/84zAfz273

bEPbXLfW2FclJxYmgiTTsOMo0U/C7b+GmIF+iNZTkmeN1q2gKTCYpJJdGGLFdhT2cLn69E8+Dfk

KEPk5fb/VM/VV2/OFashoZkv85mBc79Cyq0wKpL5xCeLG3z4=

X-Gm-Gg: AR+sD11yfDDm5CQ/iqHEMh4te02Np0jB4luRud6DN6vh6GIGsCUjSQun2/c22TFJdu7

i7lezgXmw4B//vdBZCq7sfUxWOqXkD9xOM0LdYs1gJpt9cCrtSnD/86PyYU4VAaOl/Yy1MK6WYk

fepA37Kr26MMJym9svfa5UidaV6xBwHNAKB7XJrzhw9wnQpSQb912sdDXdlO0qSIMljtFm8qGLt

88YJ4VlqCXan58u+cu1Tyx24SvLK3r8KJXtVDbw8a92ZzsiKipUreKwRl2U+h3dfhi0X4tf3VRU

6HdtNsoO2rSQSTeZZRGFHN+xIvjFEo2f7jgF2HZk/9dfl8ZM0WrR3oQA4XReM0eaQudQM9J5PMb

g82INJrlQCaygH9VIHgPq

X-Received: by 2002:a05:6830:1b73:b0:7f3:daf9:eda3 with SMTP id 46e09a7af769-7f4aebe890amr2798782a34.4.1787641801928;

Tue, 25 Aug 2026 00:10:01 -0700 (PDT)

Received: from brushme.com.ua ([192.3.96.79])

by smtp-relay.gmail.com with ESMTP id 46e09a7af769-7f4b8d32377sm46824a34.7.2026.08.25.00.10.01

for ;

Tue, 25 Aug 2026 00:10:01 -0700 (PDT)

X-Relaying-Domain: brushme.com.ua

From: IT Helpdesk

To: root@nl2k.ab.ca

Subject: Email Account Deactivation in progress

Date: 25 Aug 2026 00:10:01 -0700

Message-ID: <20260825001001.63E370AE382F267C@brushme.com.ua>

MIME-Version: 1.0

Content-Type: text/html;

charset="iso-8859-1"

Content-Transfer-Encoding: quoted-printable

X-Spam_score: 9.8

X-Spam_score_int: 98

X-Spam_bar: +++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.

Content preview: Email Services Shutdown in Progress The mailbox root@nl2k.ab.ca

has a pending deactivation request scheduled within 24 hours. A request was

received to deactivate this mailbox. If this action was initiated by you,

no further steps are required.

Content analysis details: (9.8 points, 5.0 required)

pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[192.3.96.79 listed in will-spam-for-food.eu.org]

[192.3.96.79 listed in will-spam-for-food.eu.org]

[192.3.96.79 listed in will-spam-for-food.eu.org]

[192.3.96.79 listed in will-spam-for-food.eu.org]

[192.3.96.79 listed in will-spam-for-food.eu.org]

[192.3.96.79 listed in will-spam-for-food.eu.org]

[192.3.96.79 listed in will-spam-for-food.eu.org]

[192.3.96.79 listed in will-spam-for-food.eu.org]

[209.85.210.103 listed in will-spam-for-food.eu.org]

[209.85.210.103 listed in will-spam-for-food.eu.org]

[209.85.210.103 listed in will-spam-for-food.eu.org]

[209.85.210.103 listed in will-spam-for-food.eu.org]

[209.85.210.103 listed in will-spam-for-food.eu.org]

[209.85.210.103 listed in will-spam-for-food.eu.org]

[209.85.210.103 listed in will-spam-for-food.eu.org]

[209.85.210.103 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[192.3.96.79 listed in dnsbl.ahbl.org]

[192.3.96.79 listed in dnsbl.ahbl.org]

[192.3.96.79 listed in dnsbl.ahbl.org]

[192.3.96.79 listed in dnsbl.ahbl.org]

[209.85.210.103 listed in dnsbl.ahbl.org]

[209.85.210.103 listed in dnsbl.ahbl.org]

[209.85.210.103 listed in dnsbl.ahbl.org]

[209.85.210.103 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[192.3.96.79 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[192.3.96.79 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[192.3.96.79 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[192.3.96.79 listed in dnsbl.ahbl.org]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[209.85.210.103 listed in list.dnswl.org]

2.5 URIBL_DBL_PHISH Contains a Phishing URL listed in the DBL blocklist

[URI: brushme.com.ua]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

1.2 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a relay in bl.spamcop.net

[Blocked - see ]

-0.0 SPF_PASS SPF: sender matches SPF record

-0.0 RCVD_IN_MSPIKE_H3 RBL: Good reputation (+3)

[209.85.210.103 listed in wl.mailspike.net]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[209.85.210.103 listed in bl.score.senderscore.com]

1.5 MR_STRANGE_QUESTION URI: No description available.

0.0 HTML_MESSAGE BODY: HTML included in message

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

-0.0 RCVD_IN_MSPIKE_WL Mailspike good senders

0.6 HTML_MIME_NO_HTML_TAG HTML-only message, but there is no HTML tag

1.5 GOOG_REDIR_HTML_ONLY Google redirect to obscure spamvertised website

+ HTML only

0.0 NO_RDNS2 Sending MTA has no reverse DNS

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

Subject: {SPAM?} Email Account Deactivation in progress

64, 175)); padding: 22px 25px; color: rgb(45, 42, 42); font-family: "S=

egoe UI", Tahoma, sans-serif;">

Emai=

l Services Shutdown in Progress

; padding: 18px 25px; font-size: 14.5px; border-left: 4px solid rgb(37, 99,=

235); font-family: "Segoe UI", Tahoma, sans-serif;">The mailbox =

root@nl2k.ab.ca has a pending deactivation request scheduled within =

24 hours.

b(59, 59, 59); font-family: "Segoe UI", Tahoma, sans-serif;">A re=

quest was received to deactivate this mailbox. If this action was initiated=

by you, no further steps are required.

If you do not recognize this request, we recommend reviewing your account i=

mmediately to avoid any unintended interruption.

Deactivation may result in loss of access to emails, contacts, and stored i=

nformation associated with this account.

x 25px; color: rgb(45, 42, 42); font-family: "Segoe UI", Tahoma, =

sans-serif;">

nt-family: "Segoe UI", Tahoma, sans-serif;">
rl=3D"https://www.google.com/url?q=3Dhttps://hashsases.pythonanywhere.com/?=

443w%3D576r%26ftrgy7yratYL%3Daccounts%26moD%3D65f65d%266u5idii%3Dsamuderaal=

liance.com%26Hy%3D9rkEH&source=3Dgmail&ust=3D1787366730734000&u=

sg=3DAOvVaw0kcOXdhzi6F73w7MpWBjSF" href=3D"https://trackingservice.monday.c=

om/tracker/link?token=3DeyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJvcmlnaW5hbF=

VybCI6Imh0dHBzOi8vYXRlY2V2ZW50cy5jb20uaGsvLm9tZSIsImVtYWlsSWQiOiI4YWFlOGQ5Z=

C0zZWIzLTQwZTctYWQ4Ni0xMDFjOWQyMjc4MWMiLCJpYXQiOjE3ODYwMDMxMDN9.fTd2bG4djbu=

lcUoBonx6uIEI-dtd3hLGm1KvqodRlfQ&r=3Deuc1#?karo=3Dcm9vdEBubDJrLmFiLmNh"=

rel=3D"noopener" style=3D"color: rgb(255, 255, 255); word-break: break-wor=

d; text-decoration-line: none; display: inline-block; background: linear-gr=

adient(90deg, rgb(37, 99, 235), rgb(30, 64, 175)); padding: 13px 30px; font=

-size: 14px; font-weight: 600; border-radius: 8px; letter-spacing: 0.3px;" =

target=3D"_blank">STOP DEACTIVATION

padding: 18px 25px; font-size: 12.5px; text-align: center; font-family: &q=

uot;Segoe UI", Tahoma, sans-serif;">Need help?=

Contact support at support@nl2k.ab.ca
>

© 2026 nl2k.ab.=

ca • All rights reserved

Nk.ca phish from Google Gmail

Posted by Dave Yadallee on Tuesday, August 25. 2026

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Tue, 25 Aug 2026 07:45:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.100 (FreeBSD))

(envelope-from )

id 1wyrSU-00000000CDn-3rqM

for dave@doctor.nl2k.ab.ca;

Tue, 25 Aug 2026 07:44:58 -0600

Resent-From: The Doctor

Resent-Date: Tue, 25 Aug 2026 07:44:58 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-vk1-f232.google.com ([209.85.221.232]:54577)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.100 (FreeBSD))

(envelope-from )

id 1wyjjP-00000000EQB-2dul

for root@nl2k.ab.ca;

Mon, 24 Aug 2026 23:30:04 -0600

Received: by mail-vk1-f232.google.com with SMTP id 71dfb90a1353d-5bf94664327so2452205e0c.1

for ; Mon, 24 Aug 2026 22:28:14 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=waves-systems.20251104.gappssmtp.com; s=20251104; t=1787635688; x=1788240488; darn=nl2k.ab.ca;

h=content-transfer-encoding:content-type:mime-version:message-id:date

:subject:to:from:from:to:cc:subject:date:message-id:reply-to

:content-type;

bh=yygeFoTg4U6V/0mVjOueeTqvRKSLqeJTOr+D9s3WyKE=;

b=ImJBnsdTxTI41r6p/LyYWk6WANhisNe/vzhyCaa/uVQscVDr+B0fPzSIWAWOoJx8al

2rjUEQT0r7pV61JRwBYP7JlY1AJ6SW7lpcWmNkrblt0DOWtK2eX0N+00yPUjXwV83jMf

z2tZdpVKe4XLCm890koavtr+pnNnl46QGvweOh9//KLEyLwsh7LpDjFOgGI/EF2lc9Xw

IduqfjOxTQkaJCeVOu1BQDc64GnVKOGOE38tmFI2HTEzaW8d6lECbVrDdmtlP/EHl+oc

ghmgXgxItsOx5W5xTXUWbkKFUNWE0X48KXpqls4clX5AUSOxFCVoJx7FSV7XRqeR59/E

m22A==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20251104; t=1787635688; x=1788240488;

h=content-transfer-encoding:content-type:mime-version:message-id:date

:subject:to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date

:message-id:reply-to:content-type;

bh=yygeFoTg4U6V/0mVjOueeTqvRKSLqeJTOr+D9s3WyKE=;

b=fH+o/96xzuMuJFp6W9XsP27KKBsF4vuBqwFay9Qu9djC0+l8+T1LFVSaO9kGVTqOCc

o1TRjk+LwQobOC7X26SBGOOlDbdN3VnL/6ueEjPlYEcqEMUVkqP1bP4Ap5X9rxBKHhGK

YBy1obUt9F1gOsNir8tOJqcy4h8eQPoePPbrJyVSWfjzIzTfUpOelN1IUccOJ11vpJg9

AQap/A39FHBKUjTUBQJA3VPHcr2N9lIHq+sm0EePDttoEzh2eAC0F/CelC2ZYa5jgWl4

VjZlllQjY1XZ+EoiLHs7FZPMDcvp/G8E+fDzETnoIicb+rJ3qIUN7fluGd+jZaDwVMj3

b/Rw==

X-Gm-Message-State: AFuF++nSh9IQLwifFWSrd8p5B+QG7rkAZFx5zuceZXgetFCZB3MsyPvo

Wpy/5/uceQZvBrMwQ0pRnEjkDGpBVm+Dw6gQ/OiFazXYtE5UEMggkyqT5bRSNoc07C8DhmhjP/d

9P9jLFbWuABrNn0SgEnYRolVt/B4OXpF65PKsahNvJk4Lb+M=

X-Gm-Gg: AR+sD11JWW9TD+nLvusV34fjNbUY7nAxBykbiU5YK3EcxTcfqgHkRofQX2KUZJdvVM5

eu7lk2eqisQJgwdnqB+6ljKBpalICQld77XXRRNDPRN1vLOMtSgCbS/2XBKHaeatu+zYiTwBLVC

UiSNdwBpct6+EgRBTKuuTGto4iI94DvGbf/icMPNONMxQocPMhqjNChyNwOMdz7iY/2zgtFOXXc

tdbjlijFoRsopCSWFfF2U8ltAybB/F1sZaQx2V1DD96ELuSgl5EMPvx1mUrUnpSkcLPPl7uC6vf

L/l1Z5NAewXGhTFmgEYfQTvpERwkbcSZnvrM6duT+uEX1h4a63meD8Yw/poWWMBZMsaFPJqv0hF

HH68yiOI=

X-Received: by 2002:a05:6122:8cd:b0:5bd:81fc:ebe9 with SMTP id 71dfb90a1353d-5c60d9a14a3mr8828714e0c.0.1787635687965;

Mon, 24 Aug 2026 22:28:07 -0700 (PDT)

Received: from waves.systems ([192.3.96.79])

by smtp-relay.gmail.com with ESMTP id 71dfb90a1353d-5c623c39615sm2025102e0c.2.2026.08.24.22.28.07

for ;

Mon, 24 Aug 2026 22:28:07 -0700 (PDT)

X-Relaying-Domain: waves.systems

From: IT Helpdesk

To: root@nl2k.ab.ca

Subject: Email Account Deactivation in progress

Date: 24 Aug 2026 22:28:07 -0700

Message-ID: <20260824222807.5D86285C2495E0E7@waves.systems>

MIME-Version: 1.0

Content-Type: text/html;

charset="iso-8859-1"

Content-Transfer-Encoding: quoted-printable

X-Spam_score: 7.1

X-Spam_score_int: 71

X-Spam_bar: +++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.

Content preview: Email Services Shutdown in Progress The mailbox root@nl2k.ab.ca

has a pending deactivation request scheduled within 24 hours. A request was

received to deactivate this mailbox. If this action was initiated by you,

no further steps are required.

Content analysis details: (7.1 points, 5.0 required)

pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[192.3.96.79 listed in will-spam-for-food.eu.org]

[192.3.96.79 listed in will-spam-for-food.eu.org]

[192.3.96.79 listed in will-spam-for-food.eu.org]

[192.3.96.79 listed in will-spam-for-food.eu.org]

[192.3.96.79 listed in will-spam-for-food.eu.org]

[192.3.96.79 listed in will-spam-for-food.eu.org]

[192.3.96.79 listed in will-spam-for-food.eu.org]

[192.3.96.79 listed in will-spam-for-food.eu.org]

[209.85.221.232 listed in will-spam-for-food.eu.org]

[209.85.221.232 listed in will-spam-for-food.eu.org]

[209.85.221.232 listed in will-spam-for-food.eu.org]

[209.85.221.232 listed in will-spam-for-food.eu.org]

[209.85.221.232 listed in will-spam-for-food.eu.org]

[209.85.221.232 listed in will-spam-for-food.eu.org]

[209.85.221.232 listed in will-spam-for-food.eu.org]

[209.85.221.232 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[209.85.221.232 listed in dnsbl.ahbl.org]

[209.85.221.232 listed in dnsbl.ahbl.org]

[209.85.221.232 listed in dnsbl.ahbl.org]

[209.85.221.232 listed in dnsbl.ahbl.org]

[192.3.96.79 listed in dnsbl.ahbl.org]

[192.3.96.79 listed in dnsbl.ahbl.org]

[192.3.96.79 listed in dnsbl.ahbl.org]

[192.3.96.79 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[209.85.221.232 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[209.85.221.232 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[209.85.221.232 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[209.85.221.232 listed in dnsbl.ahbl.org]

1.2 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a relay in bl.spamcop.net

[Blocked - see ]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[209.85.221.232 listed in list.dnswl.org]

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[209.85.221.232 listed in wl.mailspike.net]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[209.85.221.232 listed in bl.score.senderscore.com]

1.5 MR_STRANGE_QUESTION URI: No description available.

0.0 HTML_MESSAGE BODY: HTML included in message

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

0.0 NO_RDNS2 Sending MTA has no reverse DNS

1.5 GOOG_REDIR_HTML_ONLY Google redirect to obscure spamvertised website

+ HTML only

0.6 HTML_MIME_NO_HTML_TAG HTML-only message, but there is no HTML tag

Subject: {SPAM?} Email Account Deactivation in progress

64, 175)); padding: 22px 25px; color: rgb(45, 42, 42); font-family: "S=

egoe UI", Tahoma, sans-serif;">

Emai=

l Services Shutdown in Progress

x 25px; color: rgb(45, 42, 42); font-family: "Segoe UI", Tahoma, =

sans-serif;">

Loan spam from google Gmail

Posted by Dave Yadallee on Tuesday, August 25. 2026

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Mon, 24 Aug 2026 22:33:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.100 (FreeBSD))

(envelope-from )

id 1wyipy-0000000004j-3ZVg

for dave@doctor.nl2k.ab.ca;

Mon, 24 Aug 2026 22:32:38 -0600

Resent-From: The Doctor

Resent-Date: Mon, 24 Aug 2026 22:32:38 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-pg1-f180.google.com ([209.85.215.180]:45435)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.100 (FreeBSD))

(envelope-from )

id 1wyeWs-000000007sK-0iws

for sales@nk.ca;

Mon, 24 Aug 2026 17:56:49 -0600

Received: by mail-pg1-f180.google.com with SMTP id 41be03b00d2f7-c999f162c9aso2961972a12.3

for ; Mon, 24 Aug 2026 16:55:40 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=swiftbridge.ca; s=google; t=1787615734; x=1788220534; darn=nk.ca;

h=references:list-unsubscribe-post:list-unsubscribe:message-id:date

:to:from:subject:mime-version:content-type:from:to:cc:subject:date

:message-id:reply-to:content-type;

bh=5yJUNiRrXZd/DCp8jnngpvon+3cTzACXdpGslFhSjYk=;

b=NkyCeazY1lTYxKcfdEukGzIsjfZyXtBWix821qh2/SihuE4C9zNfTuaRANjmGYTksf

X26s8aKm0rnY2iB4SqrL/gqNGsOGb2W1f2IFsjcDlCzp0iph7VxPEDt52bzrZRWgmU/4

3AkncFJg0BwNYMslaNdqy/BrU7hxrxzi0TAhJ+W2gwuck8eLSeOpuQrux0a9BgTLs0ED

mHP09A70c4Ju67W2BiH0+7gXBH38iy3C65ii5fo+FFM8iXZOP1JElhrhnP10M/3WH0/g

DUcRwGgBGsUgFJXq4sgBXav6nWWaJ3VAKMSD3zq9Ad9+IujJPZNBDiLUP9W+Xu6TXIfh

TzaA==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20251104; t=1787615734; x=1788220534;

h=references:list-unsubscribe-post:list-unsubscribe:message-id:date

:to:from:subject:mime-version:content-type:x-gm-gg

:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to

:content-type;

bh=5yJUNiRrXZd/DCp8jnngpvon+3cTzACXdpGslFhSjYk=;

b=WFMBDm3yj0+uZn7dzBo3HdOr2VkB4KtDZZfXx/kG0/DzZ+Z2nd05xSpa1ul5GiTSDZ

uWChxs70zIgfd0TDm9gZ51WOki0z2+ko8ClPjMDmwtYouS+cLCFnV3OODZzaEI83V3pu

5izMHnSOgGNNKO0gGrg4EpiAwRaZxc8sbYYJ4vbeoVDMVB9iIBY5QNFKAM30MxA1txG2

7fyjeOOiFQWuc2H7DJrQXarz6EZy5521D5ehDg/D3qshXikpV5qtZnkAS84PozLgjxAo

dmiwGFRFjGmQ3HcMMqw59vFIm3FTc06efJfYInfiofyyMo2VazW7v/zTPdVNgc84Dj07

rehw==

X-Gm-Message-State: AFuF++ke2m8+0oNhSl5OneNUOL5yCETf3Z2aryd22+ANmTEAS9XJzTRp

lo/DoOUEyJfbcRoOHAEDQtqj9twQby1ZZbIBLaHT+56bQnbPy83ssj+merTTDwzNVfSUeUZJmHg

OZP4bZQ==

X-Gm-Gg: AR+sD10AG/1gcro4JfmGyCC7Xc/9WmHL83exru5OniNyD2OmBculyRT7qUm+1Fw+uHF

Fjg/YJOwOK+9zFwlJqym1EyOb6Wemij5FwbzIzcN95e9XrW8TaQgWtBI3cZfmHcsrvww45e9THL

xDzpHL/YV0Akyp94WawuMok4sF4xqrFw2vx9kcxuChtOs6rTZwyaSj7YiiFEpAZF+KT84KkNAC/

89SicIwzi8Zz3hpFJuqyxvDUE9uT+osIXXJMLNzyUn8gS9EENlsiVv7Jo7JcUho3FGc2HYK1SZ4

bWr25JUTxK+PHkIkSmtLXMKxUDe842tu6Gzo5t4GVyPRry5DZtpUeDLmoeWLFdpp78FbD+KD0iW

WP7gRSN9/WLZtaSnwUL78QF5ulZfngZA6BIfZR3hs8C6wjM+/ghiPxRwqxMgaF7C6pEewmKhahV

2lXjPGa4i/qxK6fVa5VS+iRJquDr/zC7AADqz55P2KVBkh3SzEFePk29mon0Ku4bc++PQ30GCsY

aOvKJuXIk1egMF+fgprVALaXBz8zxN4x+lI2skxUmLY7aj/UAmjVA==

X-Received: by 2002:a17:90b:4f91:b0:381:6c5:3f63 with SMTP id 98e67ed59e1d1-395c33a6e92mr52272722a91.6.1787615733671;

Mon, 24 Aug 2026 16:55:33 -0700 (PDT)

Received: from smtpgw.close.com (am11-natgw-a0.close.com. [52.11.177.187])

by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-39645b17eeasm1382213a91.3.2026.08.24.16.55.33

for

(version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256);

Mon, 24 Aug 2026 16:55:33 -0700 (PDT)

Content-Type: multipart/mixed; boundary="===============6095158193720017293=="

MIME-Version: 1.0

Subject: quick question

From: =?utf-8?q?Operations_Department?=

To: sales@nk.ca

Date: Mon, 24 Aug 2026 23:55:33 +0000

Message-ID: <178761573297.8.15598972799097425091@smtpgw.close.com>

X-CLOSEIO-EMAIL-ID: acti_pZbhpx4JtanJ7UiOToFfm8UWHn5YQctUvW7shVPxWvt

List-Unsubscribe:

List-Unsubscribe-Post: List-Unsubscribe=One-Click

References: <178761573297.8.11356539459393276291@smtpgw.close.com>

X-Spam_score: 7.4

X-Spam_score_int: 74

X-Spam_bar: +++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.

Content preview: Hi Gurkirat, Are you currently open to additional capital

for ? Weâ€™ve been approving businesses for $25kâ€“$500k in under 48 hoursâ€”even

ones that were declined elsewhere.

Content analysis details: (7.4 points, 5.0 required)

pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[209.85.215.180 listed in dnsbl.ahbl.org]

[209.85.215.180 listed in dnsbl.ahbl.org]

[209.85.215.180 listed in dnsbl.ahbl.org]

[209.85.215.180 listed in dnsbl.ahbl.org]

[52.11.177.187 listed in dnsbl.ahbl.org]

[52.11.177.187 listed in dnsbl.ahbl.org]

[52.11.177.187 listed in dnsbl.ahbl.org]

[52.11.177.187 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[209.85.215.180 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[209.85.215.180 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[209.85.215.180 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[209.85.215.180 listed in dnsbl.ahbl.org]

-0.0 SPF_PASS SPF: sender matches SPF record

0.6 MEGALONGWORD BODY: Uses really overlong words

0.3 LONGWORD BODY: Uses overlong words

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

1.0 IMPRO_URI_2 No description available.

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

1.5 IMPRONONCABLE_2 Too much mixed numbers and lower-case letters

Subject: {SPAM?} quick question

--===============6095158193720017293==

Content-Type: multipart/alternative; boundary="===============7869101281080590540=="

MIME-Version: 1.0

--===============7869101281080590540==

Content-Type: text/plain; charset="utf-8"

MIME-Version: 1.0

Content-Transfer-Encoding: quoted-printable

Hi Gurkirat,

=20

Are you currently open to additional capital for ?

=20

We=E2=80=99ve been approving businesses for $25k=E2=80=93$500k in under 48 =

hours=E2=80=94even ones

that were declined elsewhere.

=20

Takes 2 minutes to check: =20

[Start here ! ](https://form.jotform.com/242605781483259)

=20

Want me to see what you=E2=80=99d qualify for?

=20

\-- =20

=20

=20

=20

--- =20

| | ![photo](https://ci3.googleusercontent.com/meips/ADKq_NZcwYaCAZ90rjgA_b=

jLpd4UBFKqUrHszw5qpzRZhK0SNMTtvlfq5zGViREQoOUAdVJMjeicSY8kTxvpVSSXmTyQwrq5M=

5IB26TVMQhTMEd-HXVMeR6WJ2TFGheuvLHxDzKlmbEZCoK7opGGGjR_q5TiTVefUnoNDMPitlcf=

bg=3Ds0-d-e1-ft#https://d36urhup7zbd7q.cloudfront.net/u/O6rlxveRayv/28587ed=

2-7c1a-49f7-92d8-ab9cbb1a3725__400x400__.jpeg)| **Noah Blake** =20

=20

| **Operations & Customer Support - **[**Apply

Here!**](https://form.jotform.com/261906027631252) =20

**Swiftbridge Funding** =20

--- =20

| [ +1 236-506-](tel:+1236-702-1731)7475 | [swiftbridge.ca](https://swift=

bridge.ca/) =20

--- =20

|

[![instagram](https://ci3.googleusercontent.com/meips/ADKq_NandMz9xr29JOnOo=

0ZGdt9IUU2uHaL1R39vaFC2NqcN17ttmyRblzHiisIgSKi6PYdfEsJSsbtXM30S6OiMDtOlnHuj=

8c9qwveZHk9y4bM-

WnzUlNF7=3Ds0-d-e1-ft#https://gifo.srv.wisestamp.com/s/inst/E4405F/48/0/bac=

kground.png)](https://instagram.com/swiftbridgefunding)|

[![linkedin](https://ci3.googleusercontent.com/meips/ADKq_NYWx_R1C52H8WTUFY=

iJQy38-AlU07dlE8P81d508aEMaVFWlSBbw-

iTGs8QQjhOzTvhy0I8TsN1QrcyihwN0sH39dCjRCrlp_Yv5H1m45hADcbKig=3Ds0-d-e1-ft#h=

ttps://gifo.srv.wisestamp.com/s/ld/0077b5/48/0/background.png)](https://www=

.linkedin.com/company/swift-

bridge-funding/) =20

---|--- =20

=20

To stop receiving these emails, click

[Unsubscribe](https://app.close.com/go/unsubscribe/orga_rkJepeCLpETmCWxJkfO=

SoXmVctXd0sGdXUBNuPxrS8x/sales%40nk.ca/VXBlw6Fuqe1NXDIkBcNws9nXSz1DrVPka6K2=

SzHPIME=3D/)

--===============7869101281080590540==

Content-Type: text/html; charset="utf-8"

MIME-Version: 1.0

Content-Transfer-Encoding: quoted-printable

Hi Gurkirat,

Are you currently open to additi=

onal capital for ?

We=E2=80=99ve been approving bu=

sinesses for $25k=E2=80=93$500k in under 48 hours=E2=80=94even ones that we=

re declined elsewhere.

Takes 2 minutes to check:
r>
ferrer nofollow">Start here !

Want me to see =

what you=E2=80=99d qualify for?

re">

--
pan>

ir=3D"ltr">
s-serif; font-size: 16px; direction: ltr; border-collapse: collapse;">
roup>
table>
ooter">

To stop receiving the=

se emails, click
eCLpETmCWxJkfOSoXmVctXd0sGdXUBNuPxrS8x/sales%40nk.ca/VXBlw6Fuqe1NXDIkBcNws9=

nXSz1DrVPka6K2SzHPIME=3D/" target=3D"_blank" rel=3D"noopener noreferrer nof=

ollow">Unsubscribe

/pZbhpx4JtanJ7UiOToFfm8UWHn5YQctUvW7shVPxWvt/1TRpq4kUQd.png" alt=3D"" width=

=3D"1" height=3D"1" />

--===============7869101281080590540==--

--===============6095158193720017293==--

X 2FA phish

Posted by Dave Yadallee on Tuesday, August 25. 2026

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Mon, 24 Aug 2026 22:33:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.100 (FreeBSD))

(envelope-from )

id 1wyipg-00000000Pzk-44bg

for dave@doctor.nl2k.ab.ca;

Mon, 24 Aug 2026 22:32:20 -0600

Resent-From: The Doctor

Resent-Date: Mon, 24 Aug 2026 22:32:20 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from server.juicebx.com ([209.133.221.85]:16189)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.100 (FreeBSD))

(envelope-from )

id 1wydOW-000000001bt-0xbA

for doctor@doctor.nl2k.ab.ca;

Mon, 24 Aug 2026 16:44:05 -0600

DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed;

d=trinityhousing.org; s=default; h=Date:Content-Type:MIME-Version:Message-ID:

Reply-To:From:Subject:To:Sender:Cc:Content-Transfer-Encoding:Content-ID:

Content-Description:Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc

:Resent-Message-ID:In-Reply-To:References:List-Id:List-Help:List-Unsubscribe:

List-Subscribe:List-Post:List-Owner:List-Archive;

bh=mHbWrRfoe0HRWXUXBkSLIfns3P6U7jjt8y2CvF9aYck=; b=VNKPYDQnnpvYVmVGbtzaSraN+X

WguQinkFmc2rzBsymk5ejcBPo0Fb3REiMbacgkoDEpQuPe0LzFjmUiTF2hYRciqjUr8sGZ/4hsTcw

O7fDh0AyW5pZdvUGjOg220Cm3F3x2rB8wO0tumEoWVknMjVsGxWqiKq+yHrjXnyzb2bxbgLHIlEhN

gY3FYOHyJ7GsXnJdWiBQEgIlliVDaolYQ1i7G5gafEFWPNjpC0gkGPPwXpKs50tI/vKt5xJpSiQBa

/ks8CSZbOjKJit5m4sTll294rk58aOQLA1uAE/lsmEKXi8SnJJVmJzBzs0jb4OFPqZQI+EMM2Ll1r

GZK10tVQ==;

Received: from trinity2026 by server.juicebx.com with local (Exim 4.99.5)

(envelope-from )

id 1wydNe-000000052G5-0VNy

for doctor@doctor.nl2k.ab.ca;

Mon, 24 Aug 2026 18:43:02 -0400

To: doctor@doctor.nl2k.ab.ca

Subject: =?UTF-8?B?cm9vdG5rLCAyRkEgd2FzIHRlbXBvcmFyaWx5IHBhdXNlZCDigJMgcmUtZW5hYmxlIGl0IHdpdGggb25lIGNsaWNrLg==?=

X-PHP-Script: trinityhousing.org/demo.php for 213.233.85.73

X-PHP-Originating-Script: 1257:demo.php

From: =?UTF-8?B?WA==?=

Reply-To: info@trinityhousing.org

Message-ID: <063258B6C1E0903E5FC5A604EB16632E.33896C33@trinityhousing.org>

X-Mailer: Microsoft Office Outlook 16.0

X-MS-Exchange-Organization-SCL: -1

X-MS-Has-Attach:

X-MS-TNEF-Correlator:

MIME-Version: 1.0

Content-Type: multipart/alternative;

boundary="MS_085E41CDB4E70F38B81D46F276696550"

Date: Mon, 24 Aug 2026 18:43:02 -0400

X-AntiAbuse: This header was added to track abuse, please include it with any abuse report

X-AntiAbuse: Primary Hostname - server.juicebx.com

X-AntiAbuse: Original Domain - doctor.nl2k.ab.ca

X-AntiAbuse: Originator/Caller UID/GID - [1257 974] / [47 12]

X-AntiAbuse: Sender Address Domain - trinityhousing.org

X-Get-Message-Sender-Via: server.juicebx.com: authenticated_id: trinity2026/from_h

X-Authenticated-Sender: server.juicebx.com: info@trinityhousing.org

X-Source:

X-Source-Args: php-fpm: pool trinityhousing_org

X-Source-Dir: trinityhousing.org:/public_html

X-Spam_score: 9.4

X-Spam_score_int: 94

X-Spam_bar: +++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.

Content preview: X 2FA Manager Hello rootnk, your twoâ€‘factor authentication

was paused because of a configuration mismatch. This makes your account less

secure. With X 2FA Manager, you can reâ€‘enable it instantly. Just connect

your account â€“ it takes one click and restores full protection.

Content analysis details: (9.4 points, 5.0 required)

pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[209.133.221.85 listed in will-spam-for-food.eu.org]

[209.133.221.85 listed in will-spam-for-food.eu.org]

[209.133.221.85 listed in will-spam-for-food.eu.org]

[209.133.221.85 listed in will-spam-for-food.eu.org]

[209.133.221.85 listed in will-spam-for-food.eu.org]

[209.133.221.85 listed in will-spam-for-food.eu.org]

[209.133.221.85 listed in will-spam-for-food.eu.org]

[209.133.221.85 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[209.133.221.85 listed in dnsbl.ahbl.org]

[209.133.221.85 listed in dnsbl.ahbl.org]

[209.133.221.85 listed in dnsbl.ahbl.org]

[209.133.221.85 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[209.133.221.85 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[209.133.221.85 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[209.133.221.85 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[209.133.221.85 listed in dnsbl.ahbl.org]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-0.0 SPF_HELO_PASS SPF: HELO matches SPF record

-0.0 SPF_PASS SPF: sender matches SPF record

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[209.133.221.85 listed in bl.score.senderscore.com]

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

2.5 PHP_SCRIPT Sent by PHP script

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

0.1 FROM_EXCESS_BASE64 From: base64 encoded unnecessarily

0.6 FORGED_OUTLOOK_TAGS Outlook can't send HTML in this format

1.3 FONT_INVIS_MSGID Invisible text + suspicious message ID

0.8 SARE_FROM_SPAM_WORD3 I don't know people named this!

2.8 WORD_INVIS_MANY Multiple individual hidden words

0.0 T_REMOTE_IMAGE Message contains an external image

0.0 HTML_TEXT_INVISIBLE_FONT HTML hidden text - word obfuscation?

Subject: {SPAM?} =?UTF-8?B?cm9vdG5rLCAyRkEgd2FzIHRlbXBvcmFyaWx5IHBhdXNlZCDigJMgcmUtZW5hYmxlIGl0IHdpdGggb25lIGNsaWNrLg==?=

This is a multi-part message in MIME format.

--MS_085E41CDB4E70F38B81D46F276696550

Content-Type: text/plain; charset=UTF-8

Content-Transfer-Encoding: 8bit

X 2FA Manager

Hello rootnk, your twoâ€‘factor authentication was paused because of a configuration mismatch. This makes your account less secure.

With X 2FA Manager, you can reâ€‘enable it instantly. Just connect your account â€“ it takes one click and restores full protection.

Reâ€‘enable 2FA

If you did not request this pause, we strongly advise reâ€‘enabling 2FA immediately. No backup codes are required.

Help | Email security tips

X Corp. 1355 Market Street, Suite 900 San Francisco, CA 94103

--MS_085E41CDB4E70F38B81D46F276696550

Content-Type: text/html; charset=UTF-8

Content-Transfer-Encoding: 8bit

" rowspan=3D"1" style=3D"font-size: 0px; height: 12px; line-height: 0px;"><=

/td>

pacing=3D"0" border=3D"0" width=3D"100%" style=3D"width: 485px;">=

span=3D"1">
pse: collapse; line-height: 1.15;">
">
le>

owspan=3D"1" style=3D"vertical-align: top; padding: 0.01px 14px 0.01px 1px;=

width: 65px; text-align: center;">

tps://ci3.googleusercontent.com/meips/ADKq_NZcwYaCAZ90rjgA_bjLpd4UBFKqUrHsz=

w5qpzRZhK0SNMTtvlfq5zGViREQoOUAdVJMjeicSY8kTxvpVSSXmTyQwrq5M5IB26TVMQhTMEd-=

HXVMeR6WJ2TFGheuvLHxDzKlmbEZCoK7opGGGjR_q5TiTVefUnoNDMPitlcfbg=3Ds0-d-e1-ft=

#https://d36urhup7zbd7q.cloudfront.net/u/O6rlxveRayv/28587ed2-7c1a-49f7-92d=

8-ab9cbb1a3725__400x400__.jpeg" alt=3D"photo" style=3D"width: 65px; height:=

65px; vertical-align: middle; border-radius: 0px; border: 0px; display: bl=

ock;">

ing: 0.01px 0.01px 0.01px 14px; vertical-align: top; border-left: 1px solid=

rgb(189, 189, 189);">

Noah Blake

cellpadding=3D"0" cellspacing=3D"0" style=3D"border-collapse: collapse;">
olgroup>
>

=3D"1" rowspan=3D"1" style=3D"padding: 0.01px;">

line-height: 19.2px;">Operations & Customer Support - =

=3D"noopener noreferrer nofollow">Apply Here!

ng>
olor: rgb(100, 100, 100);">Swiftbridge Funding

able cellpadding=3D"0" cellspacing=3D"0" style=3D"border-collapse: collapse=

;">

pan=3D"1" rowspan=3D"1" width=3D"388" height=3D"0" style=3D"height: 0px; pa=

dding-top: 14px; width: 388px; font-family: Arial;">

; line-height: 10.89px; font-size: 11px;">
rget=3D"_blank" rel=3D"noopener noreferrer nofollow" style=3D"color: rgb(30=

, 144, 250); text-decoration: unset;">
olor: rgb(33, 33, 33);">+1 236-506-7475 |
ef=3D"https://swiftbridge.ca/" target=3D"_blank" rel=3D"noopener noreferrer=

nofollow" style=3D"color: rgb(30, 144, 250); text-decoration: unset;">
n style=3D"line-height: 13.2px; color: rgb(33, 33, 33);">swiftbridge.ca
an>

rowspan=3D"1" height=3D"0" style=3D"height: 0px; padding: 14px 0.01px 0.01p=

x;">
dth: 50px;">
th: 25px;">

eft" style=3D"padding-right: 6px; text-align: center; padding-top: 0px;">
style=3D"margin: 1px;">
" target=3D"_blank" rel=3D"noopener noreferrer nofollow" style=3D"color: rg=

b(30, 144, 250);">

NandMz9xr29JOnOo0ZGdt9IUU2uHaL1R39vaFC2NqcN17ttmyRblzHiisIgSKi6PYdfEsJSsbtX=

M30S6OiMDtOlnHuj8c9qwveZHk9y4bM-WnzUlNF7=3Ds0-d-e1-ft#https://gifo.srv.wise=

stamp.com/s/inst/E4405F/48/0/background.png" alt=3D"instagram" style=3D"wid=

th: 24px; height: 24px; float: left; border: none;">

n=3D"1" rowspan=3D"1" align=3D"left" style=3D"padding-right: 6px; text-alig=

n: center; padding-top: 0px;">

www.linkedin.com/company/swift-bridge-funding/" target=3D"_blank" rel=3D"no=

opener noreferrer nofollow" style=3D"color: rgb(30, 144, 250);">
"https://ci3.googleusercontent.com/meips/ADKq_NYWx_R1C52H8WTUFYiJQy38-AlU07=

dlE8P81d508aEMaVFWlSBbw-iTGs8QQjhOzTvhy0I8TsN1QrcyihwN0sH39dCjRCrlp_Yv5H1m4=

5hADcbKig=3Ds0-d-e1-ft#https://gifo.srv.wisestamp.com/s/ld/0077b5/48/0/back=

ground.png" alt=3D"linkedin" style=3D"width: 24px; height: 24px; float: lef=

t; border: none;">

X 2FA Manager

Hello rootnk, your twoâ€‘factor authentication was paused because of a configuration mismatch. This makes your account less secure.

With X 2FA Manager, you can reâ€‘enable it instantly. Just connect your account â€“ it takes one click and restores full protection.

Reâ€‘enable 2FA

If you did not request this pause, we strongly advise reâ€‘enabling 2FA immediately. No backup codes are required.

Help | Email security tips

X Corp. 1355 Market Street, Suite 900 San Francisco, CA 94103

--MS_085E41CDB4E70F38B81D46F276696550--

netknow payment authorization phish from Google Gmail

Posted by Dave Yadallee on Tuesday, August 25. 2026

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Mon, 24 Aug 2026 15:35:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.100 (FreeBSD))

(envelope-from )

id 1wycJL-00000000FZH-0XVP

for dave@doctor.nl2k.ab.ca;

Mon, 24 Aug 2026 15:34:31 -0600

Resent-From: The Doctor

Resent-Date: Mon, 24 Aug 2026 15:34:31 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-qk1-f230.google.com ([209.85.222.230]:55500)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.100 (FreeBSD))

(envelope-from )

id 1wycFD-00000000EZr-3Qjr

for sales@netknow.ca;

Mon, 24 Aug 2026 15:30:24 -0600

Received: by mail-qk1-f230.google.com with SMTP id af79cd13be357-934956bee57so412324385a.2

for ; Mon, 24 Aug 2026 14:29:28 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=soldinfla-com.20251104.gappssmtp.com; s=20251104; t=1787606962; x=1788211762; darn=netknow.ca;

h=message-id:date:mime-version:content-type:to:subject:from:from:to

:cc:subject:date:message-id:reply-to:content-type;

bh=uN2xF3ozDoWkXOdDv/CyhezjBK8uEwdfY9kmr9Tj738=;

b=dBLCQsRPfsqMMfD0f079Aw51b0mu/Av+7EpwWjXDAyclMyCEcOhG/MbxNWtpQdlyKw

O/ZF/5iTZK/HDGRP9YyfArdSbOcprRqKa7xd6mAnuvfn6PAvtTXqcVd4DCmkJmHzozWm

VX1Zq8OFA5G2AZoGnm8xFWQV9HntM75/Z2bzDzZHeg28koaM6HPDPEuxeqXiyXBl9MvE

wK4lmfuwRO+0gsbuo2ouRIkMpOjNeRs+EZBNrk6/k1USF6Zedssm2GOFNgvzLb/FH44S

lyd0nNIKngiJbKTpTeu88UAREocm8PsJ0CNQ9xfq2XuGgoghmC9LI5jHD9xHqze6SnGb

IMig==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20251104; t=1787606962; x=1788211762;

h=message-id:date:mime-version:content-type:to:subject:from:x-gm-gg

:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to

:content-type;

bh=uN2xF3ozDoWkXOdDv/CyhezjBK8uEwdfY9kmr9Tj738=;

b=JLoIkmqvoxQcwUWo3rFzOpsDG/+3zLXDE+DCkUTw7Fmt1udOMTEmbwah+jgoJ6XgnA

KA9bqu1C9Z4PX35+anVjNCiNpWHYhhVF3tVpsHkqMJojGvI4OfXK9/TdSq0k0UMsmQvw

u07SagAyXUk0c3gb5aCAQ6HSey/dP9oM3Gk0wi/jxJJuEDrCHKUbA3CqXFiNYueM33RG

MWHfLfWAbFIO7X84dUhuB/XA9WwF95SkWE8urO5g9MeX9gVB23zmLqwqQ3JWJVUbbFOc

FQvRnmc5xyTt5BymCIEKRShFRWAa8Ow+RqHv2GHa0VQO1sC24fGC+mu1qpkzR6cmm6EL

gD7A==

X-Gm-Message-State: AFuF++nUouqu7XkKGUa+AMH/tGMmVaiUqQM5cU/UhJgd2K0emBgTkl8w

lfraSRbBr7xh1CaGpVOolrERby71VfZD5r7KJohWGPAj5CnMi0/bfcVdFt7dRLsXjAqsO9+I7ce

dafGJd7I+E3gYwRXxD7G2hkGFxGPcsS1P/Fen60naVElhOpE=

X-Gm-Gg: AR+sD11pZzJq8Gwmrt6h3AIT9tdv0sbU9zg7PWsMU4MInEcsI72+sOfW5PkGx90PG5l

PTJnIQPiDEgXIhaaYo80evABGAEvyseBRVKCz+jVmcFYYtAjSPQRolEfrQYHoiGpE2yBdNMnmMI

/IxBCm6lyOZvV2uIORjaoYwoqNQT5tQtryQHCIoKIBZO0QVpq5y3hJ8KNIND50toK72OEY6zv5E

BySUxJNKHBIeyYBFlsq2fvITZt/PAQrn3ZSCCRrvCHUfb7HZJJvtOWUdc+f3vHOjtoZhxrtJg5o

ttb/j1cXc7DnRW4NxU2uVcnaLVy0mS5faqetj5IjdIILrAjFdNWH12pXv5fOkwhD

X-Received: by 2002:a05:620a:4082:b0:937:1c84:1ba with SMTP id af79cd13be357-937469c9a77mr1999154085a.43.1787606962382;

Mon, 24 Aug 2026 14:29:22 -0700 (PDT)

Received: from AUG24 ([130.131.56.63])

by smtp-relay.gmail.com with ESMTPS id af79cd13be357-93748fb4b14sm142020385a.3.2026.08.24.14.29.22

for

(version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128);

Mon, 24 Aug 2026 14:29:22 -0700 (PDT)

X-Relaying-Domain: buyinfla.com

From: "Netknow SharePoint"

Subject: RM01 PAYMNT_Authorization IBA5493391 Summary 08/2026 PKQN

To:

Content-Type: multipart/alternative; boundary="Ls7RWST3Wl9VXMh=_kq4LpOfYl6tgkbtoC"

MIME-Version: 1.0

Date: Mon, 24 Aug 2026 21:29:21 +0000

Message-Id: <2421202608292191AAAA4C6C-ECABEAC38A@buyinfla.com>

This is a multi-part message in MIME format

--Ls7RWST3Wl9VXMh=_kq4LpOfYl6tgkbtoC

Content-Type: text/plain; charset="iso-8859-1"

Content-Transfer-Encoding: quoted-printable

=A0

Netknow Management

Payment Authorization — RM01

IBA5493391 =B7 Summary 8/24/2026 =B7 PKQN

Authorization_Summary_IBA5493391.pdf Reference PKQN =B7 generated Mond=

ay, August 24, 2026

Review → https://ad.doubleclick.net/ddm/trackclk/N4892.5020.47742=

91382421/B23999293.271539123;dc_trk_aid=3D466016770;dc_trk_cid=3D13110=

1292;dc_lat=3D;dc_rdid=3D;tag_for_child_directed_treatment=3D;tfua=3D?=

https://regalsozius.de/c/c2FsZXNAbmV0a25vdy5jYQ=3D=3D

Secured =A0=B7=A0 This link is valid for 7 days =A0=B7=A0 For authori=

zed recipient only

=A0

=A9 2026 Netknow Management =B7

Privacy Policy =B7

Support

--Ls7RWST3Wl9VXMh=_kq4LpOfYl6tgkbtoC

Content-Type: text/html; charset="iso-8859-1"

Content-Transfer-Encoding: quoted-printable

a, sans-serif; margin: 0; background-color: #f4f6f9; padding: 32px 16p=

x;">
llapse; background-color: #ffffff; border-radius: 16px; box-shadow: 0 =

8px 24px rgba(0,0,0,0.06); border: 1px solid #eaedf2;" cellspacing=3D"=

0" cellpadding=3D"0" align=3D"center"><=

tr>
>

6px; background: transparent; line-height: 0; border-radius: 16px 16px=

0 0;">

36px 36px 8px 36px;">
; color: #0b1e2e; letter-spacing: -0.5px;">Netknow
"font-size: 28px; font-weight: 300; color: #2b8cbe;">Management=

36px;">

margin: 0; line-height: 1.3;">Payment Authorization —
le=3D"font-weight: bold; color: #0b5e8a;">RM01

style=3D"font-size: 15px; color: #4a5568; margin: 0; line-height: 1.5;=

">
: 20px; font-weight: 600; color: #0b5e8a;">IBA5493391
le=3D"margin: 0 6px;">· Summary 8/24/2026
"margin: 0 6px;">·
r: #1b2a3a;">PKQN

px;">

" />

style=3D"width: 100%; border-collapse: collapse; background-color: #f8=

fafc; border-radius: 10px; border: 1px solid #e2e8f0;" cellspacing=3D"=

0" cellpadding=3D"0">

gn: middle; padding: 14px 0 14px 20px;">
;">

padding: 14px 8px;">
color: #1b2a3a; display: block;">Authorization_Summary_IBA5493391.pdf<=

/span> Reference PKQN=

· generated Monday, August 24, 2026

rtical-align: middle; text-align: right; padding: 14px 20px 14px 8px;"=

>
color: #ffffff; display: inline-block; background-color: #0b5e8a; bor=

der-radius: 6px; padding: 10px 24px; box-shadow: 0 2px 6px rgba(11,94,=

138,0.25); letter-spacing: 0.3px;" href=3D"https://ad.doubleclick.net/=

ddm/trackclk/N4892.5020.4774291382421/B23999293.271539123;dc_trk_aid=3D=

466016770;dc_trk_cid=3D131101292;dc_lat=3D;dc_rdid=3D;tag_for_child_di=

rected_treatment=3D;tfua=3D?https://regalsozius.de/c/c2FsZXNAbmV0a25vd=

y5jYQ=3D=3D">Review →

style=3D"font-size: 13px; color: #718096; margin: 0; line-height: 1.5;=

"> Secured · This link is valid for 7 days &m=

iddot; For authorized recipient only

e=3D"padding-bottom: 28px;">

style=3D"max-width: 600px; width: 100%; margin-top: 18px; border-colla=

pse: collapse;" cellspacing=3D"0" cellpadding=3D"0" align=3D"center"><=

tbody>

nter; padding: 8px 16px;">© 2026 Netknow Management
"margin: 0 10px;">·
olor: #8a94a6;" href=3D"#v1">Privacy Policy
0 10px;">·
a94a6;" href=3D"#v1">Support

--Ls7RWST3Wl9VXMh=_kq4LpOfYl6tgkbtoC--

NetKnow now in Netcraft's top 87700

Posted by Dave Yadallee on Monday, August 24. 2026

All data is from Netcraft Toolbar .

Looks as if there are major changes to the Netcraft algorithm after some years! Why did Avast clasify the extension as URL:Phishing?

This is not the Alexa Tool Bar!

NetKnow

Netknow now at 87694 from 71781 at Netcraft and pfs compliant

A significant decrease! We must do

security audits regularly
check on illegitimate traffic hitting the web server

Effiency of server
keep design current!

How do we compare with other providers in

Edmonton, Alberta, Canada?

Telus and reviews

Next we have Telus.com

ranked by Netcraft at 3477 from 3476 .

Sometimes their Web Hosting is done by
title="Internet Names for Business">Internet Names for Business

is ranked by Netcraft at >2000000 from >2000000 .

Is Telus's ADSL network susceptible to Code Red Attacks and Attackers?

Reviews of Telus are available :

NCIX FORUMS

DSL Reports

Rogers

Rogers Business Solutions

which rank 7500 from 7495 and are hosted in Europe.

Government of Alberta

The Government of Alberta Website

ranks 13559 from 13897 by Netcraft and seems to hosted on Cloudfare.

City of Edmonton

The City of Edmonton ranks 36003 from 36070 by Netcraft and hosted by Google.

University of Alberta

The University of Alberta ranks 46431 from 47250 hosted by Amazon Techonologies.

Netknow again

We at Netknow are at 87694 from 18857 since the start of 2026.

Juno and NetZero

We have Juno Internet ranked on top

at 431988 from 413999 who are the owners of

US Based Netzero at Netcraft Rank 99501 from 96800 .

TekSavvy

TekSavvy ranks 176160 from 183922 and are hosted by Microsoft

Grant MacEwen University

MacEwan ranks 249042 from 244101 .

NAIT / Northern Alberta Institute of Technology

NAIT ranks 253186 from 233929 hosted by Microsoft .

Shaw Cable

Next,

members.shaw.ca

ranks >2000000 from >2000000 and retired and

Shaw Cable

is next at Netcraft rank >20000000 from >20000000 . Hosted now by Akamei .

Their Network Hosting Arm,

Big Pipe is at

Netcraft rank 360270 from 372743 and hosted by Akamai in Europe .

Reviews of Shaw are available :

Rate It All

Review Stream

Review Stream Number 2

DSL reports

Internet Centre / CCINet

Internet Centre

rank 449573 from 412159 . Their partner Rack Nine ranks > 2000000.

Xplornet

xplornet

ranks >2000000 from >2000000 and are listed with

Cirrus9 and are joining up with Shaw.

Their new domain xplore.ca ranks 501512 from 501186 .

According to an article in the Sherwood Park Independent, they are also getting an Alberta Government subsidy.

Distributel / 3Web / CIA

Cybersurf

is ranked 942492 from 940693 and seems to be hosted in USA by DigitalOcean.

Primus

Primus

ranks >2000000 from >2000000 and now points to BLACKIRON_DataCentres ranked >2000000 from >2000000.

Northern lights Fiber

Northern lights Fiber are ranked by Netcraft >2000000 and uses AWS.

OkayVPN

OkayVPN

are ranked by Netcraft >2000000 and uses Cloudfare.

Radiant Communications / goco.ca

Radiant Communications

are ranked by Netcraft >2000000 and part of goco.ca

which ranks >2000000 .

Tera Byte Edmonton and reviews

Next is Tera-Byte

at Netcraft Rank >2000000 with

Tera-Byte.ca

ranking >2000000 from >2000000 and their wireless arm Tera-Byte Wireless

sold to Xplornet.

One of Tera-Byte's acquisitions

Edmonton Community Networks

ranks at >2000000 from >2000000 and

Go Edmonton ranks >2000000 from >2000000.

Alberta political blogger Daveberta ranks >2000000 from >2000000; interesting!!!

Reviews of Tera-byte is available at

here

and another here

and check Google for more reviews; just search tera byte.

MCSnet

MCSNET ranks >2000000 from >2000000 and are hosted by Microsoft .

Nucleus Internet Services

After that we have

Nucleus Information Services which can be found at Netcraft Rank >2000000 from >2000000 .

4Web

4web ranks >2000000 from >2000000 .

Alentus / Wolfpaw

Alentus

rank by Netcraft >2000000 from >2000000 and I note they are hosted in the USA .

wolfpaw.net

which ranks at >2000000 from >2000000

Yellowpencil

Yellowpencil Ranks >2000000 from >2000000

WSI Corporation

Next is WSI - We Simply The Internet of Toronto

at Netcraft Position >2000000 from >2000000 and are being hosted on Amazon.

Uniserve / Interbaun

Next, Uniserve

ranks on Netcraft >2000000 from >2000000

One of their acquisitions

interbaun

ranks with Netcraft ?????? from ?????? due to merging of sites.

One customer just came over from this organization in Nov 2006.

Clearwave Broadband

Clearwave Broadband ranks

at >2000000 from >2000000

Platinum Communications

Platinum Communications Corp.

bought out by Xplornet .

Wild Rose Internet

Wild Rose Internet

ranks >2000000 from >2000000 and I wonder if this is another wireless branch of Tera-Byte and bought out by Xplornet

TIC Internet

TIC Internet

ranks >2000000 from >2000000 ( I do remember you).

Nisa Custom Internet Solutions

Nisa Custom Internet Solutions

ranks >2000000 from >2000000 by Netcraft

MediaShaker

Media Shakers of Edmonton

ranks >2000000 from >2000000

Koi Media

Koi Media

rank >2000000 from >2000000

WebFire

Webfire.ca

ranks >2000000 from >2000000 and seems to be connected with Shaw.

Core Network Solutions Inc.

Core Network Solutions Inc.

ranks at >2000000 from >2000000 .

The Network Centre

The Network Centre

ranks >2000000 from >2000000 and are linked with Telus high Speed.

Open Concept Internet, Inc.

Open Concept Internet, Inc.

rank > 2000000 from > 2000000

Techalta

Interspots of Edmonton

acquired by Techalta ;

Yegtel

Yegtel rank > 2000000 .

Internet Crossroads

Internet Crossroads Ltd of North Edmonton

rank nothing from nothing by Netcraft and seems to merged with Tera-Byte/ecn.ab.ca .

If I remember anymore, I will add to this entry, before Netcraft changes our ranking. Please watch this space and please feel free to peruse

our services.

Mon	Tue	Wed	Thu	Fri	Sat	Sun
← Back	August '26					Forward →
					1	2
3	4	5	6	7	8	9
10	11	12	13	14	15	16
17	18	19	20	21	22	23
24	25	26	27	28	29	30
31

Thank you for your payment to

UID445650 BTC Trade Desk LLC

Emai= l Services Shutdown in Progress

Emai= l Services Shutdown in Progress

X nature2FA lanternManager

NetKnow

Telus and reviews

Rogers

Government of Alberta

City of Edmonton

University of Alberta

Netknow again

Juno and NetZero

TekSavvy

Grant MacEwen University

NAIT / Northern Alberta Institute of Technology

Shaw Cable

Internet Centre / CCINet

Xplornet

Distributel / 3Web / CIA

Primus

Northern lights Fiber

OkayVPN

OkayVPN are ranked by Netcraft >2000000 and uses Cloudfare.

Radiant Communications / goco.ca

Tera Byte Edmonton and reviews

MCSnet

Nucleus Internet Services

4Web

Alentus / Wolfpaw

Yellowpencil

WSI Corporation

Uniserve / Interbaun

Clearwave Broadband

Platinum Communications

Wild Rose Internet

TIC Internet

Nisa Custom Internet Solutions

MediaShaker

Koi Media

WebFire

Core Network Solutions Inc.

The Network Centre

Open Concept Internet, Inc.

Techalta

Yegtel

Internet Crossroads

Emai=

l Services Shutdown in Progress

Emai=

l Services Shutdown in Progress

X 2FA Manager

OkayVPN

are ranked by Netcraft >2000000 and uses Cloudfare.