NIgerian spam from Google Gmail

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Fri, 25 Sep 2026 04:28:30 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.100.1 (FreeBSD))

(envelope-from )

id 1xA3A7-00000000IaD-3EOC

for dave@doctor.nl2k.ab.ca;

Fri, 25 Sep 2026 04:28:15 -0600

Resent-From: The Doctor

Resent-Date: Fri, 25 Sep 2026 04:28:15 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-dy2-f12.google.com ([74.125.229.12]:43123)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.100.1 (FreeBSD))

(envelope-from )

id 1x9xdm-00000000D29-1Qlp

for root@doctor.nl2k.ab.ca;

Thu, 24 Sep 2026 22:34:39 -0600

Received: by mail-dy2-f12.google.com with SMTP id 5a478bee46e88-33bf5a1c4d9so448311eec.3

for ; Thu, 24 Sep 2026 21:33:42 -0700 (PDT)

ARC-Seal: i=1; a=rsa-sha256; t=1790310816; cv=none;

d=google.com; s=arc-20260327;

b=bccq2W21CNW7yJTn1xRMHrtPM3NO4SaYDaikeq1pqZ9S8vg3VBA93j2btxUM+ZlO6R

A9PkLp9hb+rsppeJbsSOXjISDc88evdgEAex0zSSeTPYZq46/Qx8AhRPFpM8RDwE1a26

7Nf99QargNXEEH1Zg8iJVxABk1NmUBOkGNEO8F5NMcb7G7rlgryPtzh7XoFGlPXXXDtI

H7MJe/WuqIxMq+2t7D7LVLR10AptbM7aPU1zF30HXlmCMPethkyzFMHjLnEnPRs/ibSm

OPyyr3eUrKp2tsV0FxYbV5/9noIuwymTfmAY4Hfp3m2xzUDuJlCol1w0tAb5HUy4Q7LY

Hhfg==

ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20260327;

h=to:subject:message-id:date:from:mime-version:dkim-signature;

bh=LfHesDgcVW7xCU158lBKvRy+xaqMBG5QUV0/mSFRr2g=;

fh=qtVanvFdpwwY6FyHbbz1kN5+bfzNvkWWQj84hDvKv44=;

b=MnHvHbJQKnJW9UavS2WflHT/0fZxslqOMMt0/D0gK2mqXPVxHCsNakGUZ5LbdLGjR3

Jm1lD3T/ZCkYErYmJGAQSl7u0wGYVdVwtUQRekSRBL512u7VzfkcYV3CoLyb9tKfV+oU

NHnCTEvKuK8A7HbF6CLI7GvrjpwEucvEnpvlgG0sqwXuI9HNzpyU7AA0wRDwXAJPmy0T

nxjnqEXU9byGY33U3vcWDCIt/VXDD1mG1ZB7VAnh0b/GIx+Lg6/USi/mEV0WFtqZu/UU

96ClOiBo+D1Isku2kZeJXwB+CI+pkEFifWQl+bWss2F0qo7evXYqaUd5lcXaOCRLZICc

ebtQ==;

darn=doctor.nl2k.ab.ca

ARC-Authentication-Results: i=1; mx.google.com; arc=none

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=gmail.com; s=20251104; t=1790310816; x=1790915616; darn=doctor.nl2k.ab.ca;

h=content-type:to:subject:message-id:date:from:mime-version:from:to

:cc:subject:date:message-id:reply-to:content-type;

bh=LfHesDgcVW7xCU158lBKvRy+xaqMBG5QUV0/mSFRr2g=;

b=jCV/cLZsSBudXqWOM3dS3l4CmqsUMFmGNNuBagNAON7K0RHzsuLKCiYFfhvzubL8E9

a2dNkQ9L7IKIcHh/yX9lDOOR5Q6koC7bhE80pcORcIblrChmxLvAcOft8csqOw6BHM9O

gSKStX4Fk53K25xIx6e7EM2FwCxaJfzclRHDa60QKZBNPGyCxCf6qTp72GOrOgib0nuI

vglbNzb0D20iXxBnAKNUcv6SgQAG7XcCx9dWNrMvnolTAuhW14oeIB4yRMty/RvIBE1r

o/pasLwrRckI0YndLbIrul5ROGYPyOqtdH0F+Nm2L3T964iHhNCKcQmiRK2A4bmcfk0W

mD4A==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20260707; t=1790310816; x=1790915616;

h=content-type:to:subject:message-id:date:from:mime-version:x-gm-gg

:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to

:content-type;

bh=LfHesDgcVW7xCU158lBKvRy+xaqMBG5QUV0/mSFRr2g=;

b=Gr4sGYXGUgaM06KcGK6KI8Xd8gXJPLHZpuHo6HTKms5LvQ4ZNnzq68asJheaCvU7hM

UKwFdfKppH4Rq0lk/HOG77LIURBbRlCT50b7evwSczA9gvq41QUjAWwH9h3OP1jKnsAe

+t9f8f+q6SGJubLh7Hay8GXtwyy/Nl4iY91gmbJbu+xdhXTnshYFniVBjWpbBOCl/s9w

rXL2MPs3jhI5HNwWcIOXBEsqJ6uWdreEoSeszuciilNRKF0Ofg30zFMbANQgoh+DEJCb

ZRpguhqMgoDUzwmBsMMNGMtM+8sDBx12gWHvWH6KwcmOG980YfteH5B+1YRWoCZuR0zi

5pzg==

X-Forwarded-Encrypted: i=1; AKwUvBzETOQg3O6obcVEnYFQhaEKEOMrL4HCT3WBycDCUaYaIezCrFzmMaHkWTEZVbfQIiG7Xovh@doctor.nl2k.ab.ca

X-Gm-Message-State: AFuF++lIHkkxLzRE0X9iPFNICXFvZvD2vmA4RDK8LMEAa/7uTFZiVKzw

NAQeDPfgfPJ2eVzJH7bG0NsU/+AarUKX9qN42LeXz/vbf7oKsUifckptB7mXeMkkCSIibJ0k6aI

xaG12AdcwzC6DdUx+fvSJvLml0pSvy1o=

X-Gm-Gg: AYBFou1CONHWKPydDSpvFYxQ4iixd/d5L/M9qdda/AYpiqoseppKfXqlVgD8RKCVJH+

Z+UiNU60kS5MjoZLywRC5VwliB1FljMchwmxMUgTMx9WYxMQeo2FM5lrsVXTaDZT6R2/7ctFJdI

NX6eeKxn5xY4x5I6Bpz06xsOqTaGdmXrds32r35iWDHcG1u4mauyJ6jb90NC/hVT1m6CWvFZCeY

qK4vm9yGCegiijM02H41iUII8s7WxQt6c4BVYDoBgxG4H8iTGJg7PrZEsVSDZFaZGKJpbvwydIl

G0CSWvMUDqcrZj6HMEpodhZoRHHv0Lcql81ykCkDoIWZ//+pX/nttR1PjrGiyYBJGXtc0wiOS9N

UwE/ckRnbjQ==

X-Received: by 2002:a05:693c:66d6:20b0:331:89d6:80e7 with SMTP id

5a478bee46e88-34004c897a8mr3655808eec.13.1790310815450; Thu, 24 Sep 2026

21:33:35 -0700 (PDT)

MIME-Version: 1.0

From: Willson Victor

Date: Fri, 25 Sep 2026 04:33:21 +0000

X-Gm-Features: AclHuK_lcw3rE6Nd3HphwdCEmvdOW2ea0vqkMnhtCY8NFf_bGifMAXN29Z_Hq-k

Message-ID:

Subject: Dear Sir/Madam,

To: undisclosed-recipients:;

Content-Type: multipart/alternative; boundary="00000000000031483e065c47386f"

Bcc: root@doctor.nl2k.ab.ca

X-Antivirus: AVG (VPS 260925-4, 9/25/2026), Inbound message

X-Antivirus-Status: Clean



--00000000000031483e065c47386f

Content-Type: text/plain; charset="UTF-8"



Dear Sir/Madam,















I am a private wealth manager for a high net-worth individual, offering

growth stage capital and leveraged buyouts from a dedicated portfolio. Our

non-traditional funding provides medium to large scale financing with

unmatched terms. We seek a competent company or executive for medium or

long-term ROI. If interested, contact me at wvic2001@gmail.com

to discuss further. Thank you, Sincerely Yours

Mr.Willlson Victor.



--00000000000031483e065c47386f

Content-Type: text/html; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable



Dear Sir/Ma=

dam,

gmail_signature">

I am a private wealth manager for =

a high net-worth individual, offering growth stage capital and leveraged bu=

youts from a dedicated portfolio. Our non-traditional funding provides medi=

um to large scale financing with unmatched terms.

We seek a compete=

nt company or executive for medium or long-term ROI. If interested, contact=

me at wvic2001@gma=

il.com to discuss further.

Thank you, Sincerely Yours

M=

r.Willlson Victor.




--00000000000031483e065c47386f--

Nigerian spam from Yahoo! mail

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Fri, 25 Sep 2026 04:28:30 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.100.1 (FreeBSD))

(envelope-from )

id 1xA3A2-00000000IMJ-48ti

for dave@doctor.nl2k.ab.ca;

Fri, 25 Sep 2026 04:28:10 -0600

Resent-From: The Doctor

Resent-Date: Fri, 25 Sep 2026 04:28:10 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from sonic-euwe9-0017.asd.mail.yahoo.com ([34.2.88.16]:10240 helo=sonic.asd.mail.yahoo.com)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.100.1 (FreeBSD))

(envelope-from )

id 1x9xZs-00000000CiK-3LSQ

for postmaster@nl2k.ab.ca;

Thu, 24 Sep 2026 22:30:38 -0600

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yahoo.ca; s=s2048; t=1790310573; bh=xqPddsjyDYha2Wbv/exjvGqg9PuvUHxsWxn3egcBJUY=; h=Date:From:Reply-To:References:Subject:From:Subject:Reply-To; b=EcCgQKnBccTCy9eybGQ6tlhzRLM/JJqzgyMM2du4duHqpZvTx7wcDiEXgHrbMoR6BOMOg1uZpt8EfNJBPGKxJ2K4CGbp5gKp4KJR2LwcFPKm72MCRy6Q0CXxVAVtgY1UogJ+QUru4zsViFuN5jdFacT5DG6RyIfO1p9GbaKclsFJdVsGdx6QSU5SmmY6iLI3gomnZCaJPtx6frowTreldkpKw9kzSgfoZr9UaCtxwuiglrFfNnSay1ZHR74oWE36TEOxZ32fSQB11RW9KhX7G6wmFY7L05MNNGslN9A9fh3/spNX9aqYblFpSIyNp0PnCjm7fuhjFRNqKxt5a8EGoA==

X-SONIC-DKIM-SIGN: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yahoo.com; s=s2048; t=1790310573; bh=EfzD144CVhir7l5Bjir2/1+ttHiyIUfQQaXRdBgwgs2=; h=X-Sonic-MF:Date:From:Subject:From:Subject; b=UlYEBFYJ9JZv6VeS/BJpGwenpxOEH6QAzLJCbgc4/xhaOHYT67xETHlsicZMskR+nJajJhbxLDjZmT8GyPLpH2UyGADmna+WRPMZhSR39we24m3YnRj5s49lUu2aZxfiB7O07REgk77m6lDgq3lv0wzz6R2YrCcW4SuCZvV5+7p3lqwlNJaUeN/3ZNifhkwiwOiQ1W8XBrBYZoYyVEog3S29LH5KQuGhktg9C7WCHBDXYpssevihXHk6CsZY5S17PRuxvTvNfnJ7L6fpNwWfsLvwaTXfsA8I7XYE8upDyDNv6p1BK6S3AOns9+8curFsM6AORvPWfp8BZvcVH37XuQ==

X-YMail-OSG: YkEhZVYVM1kqhdELE3IszEFoNAGHbD.oF6RjLcrC_HPFAXDk26VhFMfdvTBQaas

7yBG8hCk1UeN1cT03goYW5G1QGAbgM4xUR16rwLeu4gxHaMxp2UNqZFpytmGa1R.EojJssrMaOnC

FwosW4aMsEI4OHlfKnVRiAlr7D2sMwWx5dq3XXNDOsu1alH5baskFT8ivN_lOs6Aaqn3NX5XE7zR

m4_aan0sz0YfWEVKikfiU6M7bWLm8wkXAMIYzP4wqKp6ilziYHxI6tK67yWq_DBJ7xAm723xo.6j

gg.BtjYLHS6CXgcrJwfXUGo3BPmI9rxFnm9Qjdds9NH2w0geqnPY_S5z57EJNWswdFwwZqXQLDHC

DDkjjo7bZ5P.qdSaIIkWwUGqOAIub2EGncZvk.o4hD5eQmzCS1.1eLe_MRG15aMVSRDKMGMHc4u1

j.W6fVxGH.og.kXJjPim_s.WAYOExo3yblImZSGaF7z3TxSq8BcvmdmEBkTlFqYDm9M62JmWx8QW

yO8i2pmrsmZ2hCQvepFLiZN5wuUwkI8MA20jdvBd4E9jLBiEllctrk7sjA8fPZCWycMbsK2u5YtN

EoP6BS7JratT08PI2IEiDY0TPOZSk83peCcwV.9KO_4I6UnlQTWpfN5gUTU7xGhIXp.x.neTaXpY

LVWqMHyUB5Pv51Vbczd5jiNCANpPyu9yppVWejQRPpXNwbXbBisMApenthrpmnhUGCZ6.z583jwI

t2JVf6E85lXw3657SqztHPXI8OO1CF3T_GeHutP7OTA9QLm0.jYiPPHJrWT9gBBDgivJqzSnRn8S

91I8qpqWp_LSpPPjaTvJnw0ZH2Y8IgPkn94kDNWZH4Uq5LIv_sC_5IPVS44roNlaRKu2be8CNyGH

.1VQ5Zh8z_HhOwK64TfQWyqBBYe317yL4yGrQUSS8ipS.I2zKRt80kbNGUb1EzAkeTzaxMqT4C.7

aWMMnJy13qcBSZStqJI..KtlUfdlah8pyfD_BWMAG1EZG4H6zRLi9C8D8GDWRQ19fdBA43ptbSMP

QGVeep7cIEwoGKGHAdDCfIO40MafqPMDh9zd8foYOWhViDTuWGBzcg6qyfpCSTLtMTNeqdMB5.a9

8vNr3XN48Ac26hyGl03fgmJq9gUjmFp1nhpygc9yLbL7DwvZ9M9S70mm19KUCBGR88SzXLRAelf3

Vj5bLutjlOcswjRtT9nrvGvBwPnC7465_jhPdoIYaoBlpcba6VJhnpMp5W_kWA6KH6xclwrWMd9C

ZLhl3ELItZHK4tFsUZO_.LS8eIXAE1aZPfmHlrSkeu5X6FM.aoyx0znh_ewuSwzJ18RQNj9rQ3Wo

jvWydRmqeEJ2Dupf6iMKXoMgWCsIFhgl1_fVED6RQ3PYRER7RQCtzoCixnlsU7tpujlPiu8zU7WC

t.RTLdYZX6jKKsprANEMG65yCRdkuuGGWm5dZv8knwlGMHJectv73VfzlYGrLTzc2HWwNlF8DqR.

sMbWryhIHrfADirYyI6tYENeyX82rP_pzjVlOSoq1S34XCx46rdGRhdtRyrS9SKYE6Dnkgszg360

Nn4WjMlgtEQDB9psQfdVaOTycQg3Fjqf.NUihG.sL_76AR3qlzqswcDh_6aHbT_gzN3hFETTiy7Q

lWBUixZr0RMrgzARvHmSo.INjxegQbs5.i8ba4iUMQqmcCBmPqY5vDNaSgKH3MOnJOg2ycfng31Y

mRrSg6rzBOwcyPb.1J1pL4R7iR_Cmv1nk0jQUUOmP9vepaxIE.s1rYw7tpNDKjHS19GPCxuFbu2K

EYTSxwFvJNc9zHrhE6qe8UmK_Px7Z9j1J80dAvaA8YMCLK.DdporUcu7xDi64iBDqxT8x5QYkDaB

BBDNqGAbVCff.e8y_h8U1ZbLbWn_dgBzI1q0j2sJxOwzIdCixXHHTIBsNBIOkkLLi2_t6i46t8OG

9bMSpDB8tfhbDT3CoVOlSpM4qjaRvQWWOHcNF2kCZiPaqP3ZhaXHmufvP6QwgPe0hfqDaXGI_zhG

Ll.ASZ1.DPxg9xyv._5MyEuzM18Jecu4tGM6cE18gmhXwLquKBnlyD8WhOK28IIuIyqXZalSSbIf

Zldi.8o3tqfMBHjzYfc2lzNS5DzQNX.BXMeyMa9SCJaE-

X-Sonic-MF:

X-Sonic-ID: 970768e8-916b-4714-b31e-3810995aef82

Received: from sonic.gate.mail.ne1.yahoo.com by mail-asdoutdeli-p-cin-euwe9-prod-sonicconsumer-svc-102 with HTTP; Fri, 25 Sep 2026 04:29:33 +0000

Date: Fri, 25 Sep 2026 04:29:31 +0000 (UTC)

From: Musa Ibrahim

Reply-To: musa.ibrahim67@yahoo.ca

Message-ID: <2064048363.2334278.1790310571036@mail.yahoo.com>

References: <2064048363.2334278.1790310571036.ref@mail.yahoo.com>

Subject: Good News

MIME-Version: 1.0

Content-Type: text/plain; charset=UTF-8

Content-Transfer-Encoding: 7bit

X-Mailer: WebService/1.1.26577 YMailCLDNodin

X-Spam_score: 6.2

X-Spam_score_int: 62

X-Spam_bar: ++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Hello My Dear, I hope this message finds you in good Health.

My name is Mr.Musa Ibrahim and I am looking for a partner who is willing

to team up with me for potential investment opportunities. I shall provide

the FUND for the investment, and upon your acknowled [...]



Content analysis details: (6.2 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[34.2.88.16 listed in will-spam-for-food.eu.org]

[34.2.88.16 listed in will-spam-for-food.eu.org]

[34.2.88.16 listed in will-spam-for-food.eu.org]

[34.2.88.16 listed in will-spam-for-food.eu.org]

[34.2.88.16 listed in will-spam-for-food.eu.org]

[34.2.88.16 listed in will-spam-for-food.eu.org]

[34.2.88.16 listed in will-spam-for-food.eu.org]

[34.2.88.16 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[34.2.88.16 listed in dnsbl.ahbl.org]

[34.2.88.16 listed in dnsbl.ahbl.org]

[34.2.88.16 listed in dnsbl.ahbl.org]

[34.2.88.16 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[34.2.88.16 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[34.2.88.16 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[34.2.88.16 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[34.2.88.16 listed in dnsbl.ahbl.org]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[34.2.88.16 listed in list.dnswl.org]

-0.0 SPF_PASS SPF: sender matches SPF record

-0.0 SPF_HELO_PASS SPF: HELO matches SPF record

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends in

digit

[musa.ibrahim67(at)yahoo.ca]

0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider

[musa.ibrahim67(at)yahoo.ca]

1.2 MISSING_HEADERS Missing To: header

0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in digit

[musa.ibrahim67(at)yahoo.ca]

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[34.2.88.16 listed in wl.mailspike.net]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[34.2.88.16 listed in bl.score.senderscore.com]

1.9 REPLYTO_WITHOUT_TO_CC No description available.

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

1.4 MALFORMED_FREEMAIL Bad headers on message from free email service

Subject: {SPAM?} Good News

X-Antivirus: AVG (VPS 260925-4, 9/25/2026), Inbound message

X-Antivirus-Status: Clean



Hello My Dear,



I hope this message finds you in good Health.



My name is Mr.Musa Ibrahim and I am looking for a partner who is willing to team up with me for potential investment opportunities. I shall provide the FUND for the investment, and upon your acknowledgment of receiving this Message I will therefore enlighten you with the Full Details of my investment proposal.



I'm awaiting your Response.



My regards,



Mr.Musa Ibrahim.

Nigerian spam from Google Gmail

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Fri, 25 Sep 2026 04:28:30 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.100.1 (FreeBSD))

(envelope-from )

id 1xA39x-00000000HsP-201n

for dave@doctor.nl2k.ab.ca;

Fri, 25 Sep 2026 04:28:05 -0600

Resent-From: The Doctor

Resent-Date: Fri, 25 Sep 2026 04:28:05 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-qk2-f41.google.com ([74.125.230.233]:33157)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.100.1 (FreeBSD))

(envelope-from )

id 1x9xVP-00000000CLt-1KeB

for sales@nk.ca;

Thu, 24 Sep 2026 22:26:01 -0600

Received: by mail-qk2-f41.google.com with SMTP id af79cd13be357-93bfa7b2093so55573985a.1

for ; Thu, 24 Sep 2026 21:25:04 -0700 (PDT)

ARC-Seal: i=1; a=rsa-sha256; t=1790310298; cv=none;

d=google.com; s=arc-20260327;

b=DNI60H6OEIiTsEEbb4vMWGrZScY5Op0QYmrz3jR9pIR+TA1FivQcN7+Tv0MfN4E4E3

iHIr+XG0dD9s8p3/uAJdXWRWbe7rA99ZhC0+U3WFSYlQMTbzyEsNTB1Ar9NaTYhYSwxM

Coo6xefHQpghfT7FguGxHHAGsiEOvW/2oi3ihcQz89tQTaJNmxBlbdixVr6YG6dD1Iu5

8bZbrrll4LiUOtboM185USKIGZZAYAZj0fMDUkf1RT3vZkQnD6gBYD1s5jNiRoBnXs1P

R8We5U0uZhaMun4a+zD8fBciZvvpyjp2DVON69QZLIWvOVCYO/l1sxl2JvmwVP6IunqU

naRA==

ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20260327;

h=to:subject:message-id:date:from:mime-version:dkim-signature;

bh=r1kQ6wn5BiTHA8RlMl9sWrMWq0Yma69pEwc1VegDsE4=;

fh=DV78l8SqIkvKMv1c9vT51h6hsAhDNydeA0PqALIMglc=;

b=Ve4ChL1+ak8VtdfQDqajX9HngNsDDXQOqx/WlmfBJV7DSfz0YpJccDIiFFhwOlcGLw

2P+pURP+uXXOOcZ5cqBZ9/OrLglGTk1wI19AslAlb9Drgl8tsoYfN0bfxB00hGJOAIMR

bkH0d93m6Qfm2q4pWGLuOoOcUEYz18L9RM3n/kglQhxi4AC2kAjtLyU4zcuz2XvK/nDx

0nXHU3vSeKgeFeQd6yVuYtcBAwffnCR9HPnzWmP0DDCXlXKtyxTDpAAqlYqiWj0RrhW+

qhD/JvhTPMoy0nOd6O812Y6PRB7h23p7Sdmcw1i/BEdgfdQXIi/rjt2BUhOdJTSRkM3P

x0Hw==;

darn=nk.ca

ARC-Authentication-Results: i=1; mx.google.com; arc=none

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=gmail.com; s=20251104; t=1790310298; x=1790915098; darn=nk.ca;

h=content-type:to:subject:message-id:date:from:mime-version:from:to

:cc:subject:date:message-id:reply-to:content-type;

bh=r1kQ6wn5BiTHA8RlMl9sWrMWq0Yma69pEwc1VegDsE4=;

b=SzXOF2489H16oh0coj3y2jjNZQZ6esc/qDKVo6zYS6LznDoXlYRuvWO+Gke4Iwbi1p

sBO6fW+yd3DSkb/lcwlig9t0GvCwjZ8HBd0UGuy+J/k9snUixp+DEUWAqE/UuYk3IQJy

tn5YglNh4GkBAfna03P5YLFpyvUBwCgoFh/PZgRgMXxdAVPVEHQtkjYzSYcOFImsc5lz

D60ImTh3YImk5GUewrWGZ9Fayrf/spLS3Hq68PWwg2Aji6TDTE5R+y3e4oTGd2DXyX9J

PR9+Q9oSfq7ajW9kc6mJBMMLHDvAFIqrthZEV2etKfBw5/VtQe1/zCimxhDd3MR0qSfz

vIgQ==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20260707; t=1790310298; x=1790915098;

h=content-type:to:subject:message-id:date:from:mime-version:x-gm-gg

:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to

:content-type;

bh=r1kQ6wn5BiTHA8RlMl9sWrMWq0Yma69pEwc1VegDsE4=;

b=SRmi5U/kRdX8Sxgn6FWzdx/51wwZTCzFfG2J6BzK+jAJY7KvzzAMGic7T5bph7RkYw

dOUIfbaR/l1VuXc3YoJuq5O4CTXghxm4KDIdib5BFdu25zi05enSrmNxLw8cEAqHh3fH

UA6Q2Ly2r7uQB7DUylGee1DpCwJQm+iHjsBgoWz5MvMuX6K0+XhGCmKHMsVcenkac1fB

4ZleIEEAGXWaN1GzEZv9k/gJalKzkj8sUdRs/wtvIQeCQolo3DVCI9FO2TqmqahlYqri

c/L0DGHlOt/QJ3V0vBDHMhcwbQrHOPL4TmCWWeftzYPBnilA1Q/BD8tmMOMmyzblAkvg

jnPw==

X-Forwarded-Encrypted: i=1; AKwUvBx9u0g/AGq1qM9taK9qOFVfphPknrSG0sIL/icQCJKh0NVel+exAj2RxNGSkzBdVDHJ5I8hfw==@nk.ca

X-Gm-Message-State: AFuF++kMomTippL0bLloGL8LJm+AuijIktQQtLSsaFsrSY6uSsWCKPe0

FOHgaqDjWE0s5m8+FdWB4yBJna3h+csbXiFc6sEhqx8/oXYDKo0uWVxh4HdbCTQ2PK0OGNYdP6k

6r7EQkoEJkFDNLG9cxk/kFFUNVtYiW3M=

X-Gm-Gg: AYBFou0UhYIwRLxxEiP+cYqun+BmQTZQjn0br1LMxkpMgLXJm1y3Rl+TaDIs5suGSdt

wZN8U9jS7N2A/mWRA0A+djTjwsoro/+X4dQCwjBRTOpTTCfd9GFhaMTTJHObWtTQ4QuNs/qUY4K

Sf+AiZk+Vjy7X5FkN5dr9F5aqRrr3t0MPn3rN6Z+y5kvNhcp3eVXF6I/qWMGfMz+X6NWl62xCVv

fYonpabd1MNmMJw19/l2HofTIP7ufQZGa5xOTPNmJ+1wLa9IqOBcIaBsID/1fo7zT4/zxd/05HM

8qnkTNmPS17LjKbolCfqbH7FvasJUo8oKs7zTTQO/RoFO30eteLsr15y68E1xsbVdrOYeGCRcjK

CfqOAvQw3XYpAjJZvL30c

X-Received: by 2002:a05:620a:4592:b0:93b:d79a:c467 with SMTP id

af79cd13be357-93c43e3e5e4mr232385585a.63.1790310298048; Thu, 24 Sep 2026

21:24:58 -0700 (PDT)

MIME-Version: 1.0

From: Willson Victor

Date: Fri, 25 Sep 2026 04:24:39 +0000

X-Gm-Features: AclHuK_D7muWM01nKPjAYEgwoM3_gyV0wXBIcND34jTFMqHZmlW_ldrjAUwTWZY

Message-ID:

Subject: Dear Sir/Madam,

To: undisclosed-recipients:;

Content-Type: multipart/alternative; boundary="0000000000005a5d24065c471904"

Bcc: sales@nk.ca

X-Antivirus: AVG (VPS 260925-4, 9/25/2026), Inbound message

X-Antivirus-Status: Clean



--0000000000005a5d24065c471904

Content-Type: text/plain; charset="UTF-8"



Dear Sir/Madam,















I am a private wealth manager for a high net-worth individual, offering

growth stage capital and leveraged buyouts from a dedicated portfolio. Our

non-traditional funding provides medium to large scale financing with

unmatched terms. We seek a competent company or executive for medium or

long-term ROI. If interested, contact me at wvic2001@gmail.com

to discuss further. Thank you, Sincerely Yours

Mr.Willlson Victor.



--0000000000005a5d24065c471904

Content-Type: text/html; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable



Dear Sir/Ma=

dam,

gmail_signature">

I am a private wealth manager for =

a high net-worth individual, offering growth stage capital and leveraged bu=

youts from a dedicated portfolio. Our non-traditional funding provides medi=

um to large scale financing with unmatched terms.

We seek a compete=

nt company or executive for medium or long-term ROI. If interested, contact=

me at wvic2001@gma=

il.com to discuss further.

Thank you, Sincerely Yours

M=

r.Willlson Victor.




--0000000000005a5d24065c471904--

Payment phish

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 24 Sep 2026 17:59:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.100.1 (FreeBSD))

(envelope-from )

id 1x9tL8-000000008Fb-3otB

for dave@doctor.nl2k.ab.ca;

Thu, 24 Sep 2026 17:58:58 -0600

Resent-From: The Doctor

Resent-Date: Thu, 24 Sep 2026 17:58:58 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mx1.uzairways.com ([84.54.82.148]:46272)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.100.1 (FreeBSD))

(envelope-from )

id 1x9sFn-00000000M4P-05Rj

for sales@nk.ca;

Thu, 24 Sep 2026 16:49:32 -0600

Received: from EX2019S01.uzairways.com ([10.82.22.51])

by fmprotect.uzairways.com with ESMTP id 68OMlX8T029994-68OMlX8W029994

(version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=FAIL)

for ; Fri, 25 Sep 2026 03:47:34 +0500

Received: from EX2019S01.uzairways.com (10.82.22.51) by

EX2019S01.uzairways.com (10.82.22.51) with Microsoft SMTP Server

(version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id

15.2.2562.49; Fri, 25 Sep 2026 03:47:33 +0500

Received: from EX2019S01.uzairways.com ([10.82.22.51]) by

EX2019S01.uzairways.com ([10.82.22.51]) with mapi id 15.02.2562.049; Fri, 25

Sep 2026 03:47:33 +0500

From: "Abdilaziz M. Aslanov"

To: "sales@nk.ca"

Subject: Remittance Details : Nagindas Khandwala College

Thread-Topic: Remittance Details : Nagindas Khandwala College

Thread-Index: AQHdTHavIUW+CBSLjkGbuXU6O2TbJA==

Date: Thu, 24 Sep 2026 22:47:33 +0000

Message-ID: <3613561100ff479aaee73acf4c311f75@uzairways.com>

Accept-Language: ru-RU, en-US

Content-Language: en-US

X-MS-Has-Attach:

X-MS-TNEF-Correlator:

x-originating-ip: [10.82.22.120]

Content-Type: multipart/alternative;

boundary="_000_3613561100ff479aaee73acf4c311f75uzairwayscom_"

MIME-Version: 1.0

X-FEAS-Client-IP: 10.82.22.51

X-FE-Policy-ID: 1:2:2:uzairways.com

DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; d=uzairways.com; s=hymail; c=relaxed/relaxed;

h=from:to:subject:date:message-id:content-type:mime-version;

bh=nhX3y2qRJ/0sN6W+H11qdiF8sEwyVYNgusUmZ/nDCzA=;

b=X9wXpxqywtT36WUqoT3aUM4hRnSEfU4O1YnN0M79S1bbaPt5GrwwvzldMmq2HG3Gs9kcKzglmp6o

gXjZNDIKOvZLGACwCi5Mob1ucox36RX7FWF4DlY1M9E+FnaV007GGF3xoiUqgPiAopN8h11SPrXe

xbxRfNkmTq0k66oBXsw=

X-Antivirus: AVG (VPS 260925-4, 9/25/2026), Inbound message

X-Antivirus-Status: Clean



--_000_3613561100ff479aaee73acf4c311f75uzairwayscom_

Content-Type: text/plain; charset="us-ascii"

Content-Transfer-Encoding: quoted-printable



Swift Inc has shared payment receipt for "Invoice#783364 with you sales@nk=

.ca.



[https://ci3.googleusercontent.com/meips/ADKq_NYbcajltE7NPuFYtq6GU_gOHbrsCV=

HciMrPbGWUoAvlRTNttIm7OE-v9nc8nqlONwyhZnkBvD7ut82hilkr2rmoXKpbkFJvDnq5l2mya=

X4sId4-l0VZdS_oHms4gfk5cYHtqg05FuuUhcC1zsP_w9bMyRJfnKLLtHzGo2Z6lgAK1URtjNnC=

cqqrHIWy935NeC1In48Lv6AiYE4uPutLOK1bvSBMGnDexSEUf0dOgGH6i7SaKgm8YaTDCbPGmyo=

iYZDaem0r2oPyvOQhFkzAhb47fFj_m1OXLrHhBZUiqdjnGczNCQuPZhY2Q9i50Kj1x-LTjfq3FA=

C88SzQ9RU6C5_f5_NwAQrI766glND6WPn8FFGrsE3lcygBcOEMZgH0vyi36CspD3oWeh-B91xqE=

7_s0p9W1o-qHXHqXYW3Ddxs9ZCKZeRSqUtpBgExQ0VJQoIiOiK3FqwpfIlNHWYviJGgIRdn45J_=

qgZ8yYpLpTOmBhb494o65JzTuQ0EUlt3SFCW-6Eg55JCH6PYh5G_RcQajvMDzTMeSoPC6w3p0bf=

PPgCEFuKgWwKCrIKfIyvLr5wkhNwaMoeHD4zZsW9_smV6d4iYn4SIDu3lwj4=3Ds0-d-e1-ft#h=

ttps://resize.yandex.net/mailservice?url=3Dhttps%3A%2F%2Fci3.googleusercont=

ent.com%2Fmeips%2FADKq_NbS5s43mS3wGBqfGoRrcT0ys1n1MDtTxFlSDQBz4-iOBP_MTUPsA=

ijs4CJeklD-Ja7e6uW50uBREjEgRNNi8oHya_--Ua9fClj_T2vjAInMB-H75d6PJtzd14wdopcA=

xolmijw7HhxOYqugCychJh0_GH-0kIXH6A%3Ds0-d-e1-ft%23https%3A%2F%2Faescleantec=

h-my.sharepoint.com%2Fpersonal%2Flgarcia_aesclean_com%2F_layouts%2F15%2Fima=

ges%2Fsavexc.png&proxy=3Dyes&key=3Debe0333ac1c37e11d1fcdfa05241ddc4]

Nagindas Khandwala College September Payment Confirmation.xlsx

Last modified 2026-09-24



Open in Excel
hp?file=3Dhttps://archerholdingintl.com#sales@nk.ca> Download Doc=

ument
=3Dhttps://archerholdingintl.com#sales@nk.ca>













--_000_3613561100ff479aaee73acf4c311f75uzairwayscom_

Content-Type: text/html; charset="us-ascii"

Content-Transfer-Encoding: quoted-printable










>


l=3Dno,date=3Dno,url=3Dno">




0">








cellspacing=3D"0" style=3D"box-sizing: border-box; border-collapse: collaps=

e; font-style: normal; font-variant-ligatures: normal; font-variant-caps: n=

ormal; font-weight: 400; letter-spacing: normal; orphans: 2; text-align: le=

ft; text-transform: none; widows: 2; word-spacing: 0px; -webkit-text-stroke=

-width: 0px; white-space: normal; text-decoration-thickness: initial; text-=

decoration-style: initial; text-decoration-color: initial; color: rgb(68, 6=

8, 68); font-family: "segoe ui semilight", "segoe ui", =

verdana, sans-serif; font-size: 18px;" width=3D"100%">












=3D"top" width=3D"600">


: border-box; border-collapse: collapse; float: left;" width=3D"600">












ing-top: 20px; padding-right: 12px; padding-left: 12px; font-family: "=

segoe ui semilight", "segoe ui", tahoma, arial, sans-serif; =

font-size: 17px;">

Swift Inc has shared payment receipt for  "Invoice#783364 with yo=

u sales@nk.ca.



: border-box; border-collapse: collapse; float: left;" width=3D"100%">
















g-left: 12px;">

 
rgb(153, 153, 153);" width=3D"100%">

 		 &nb=

sp;



: border-box; border-collapse: collapse; float: left;" width=3D"600">




















ng-left: 12px;" valign=3D"middle" width=3D"50">


ajltE7NPuFYtq6GU_gOHbrsCVHciMrPbGWUoAvlRTNttIm7OE-v9nc8nqlONwyhZnkBvD7ut82h=

ilkr2rmoXKpbkFJvDnq5l2myaX4sId4-l0VZdS_oHms4gfk5cYHtqg05FuuUhcC1zsP_w9bMyRJ=

fnKLLtHzGo2Z6lgAK1URtjNnCcqqrHIWy935NeC1In48Lv6AiYE4uPutLOK1bvSBMGnDexSEUf0=

dOgGH6i7SaKgm8YaTDCbPGmyoiYZDaem0r2oPyvOQhFkzAhb47fFj_m1OXLrHhBZUiqdjnGczNC=

QuPZhY2Q9i50Kj1x-LTjfq3FAC88SzQ9RU6C5_f5_NwAQrI766glND6WPn8FFGrsE3lcygBcOEM=

ZgH0vyi36CspD3oWeh-B91xqE7_s0p9W1o-qHXHqXYW3Ddxs9ZCKZeRSqUtpBgExQ0VJQoIiOiK=

3FqwpfIlNHWYviJGgIRdn45J_qgZ8yYpLpTOmBhb494o65JzTuQ0EUlt3SFCW-6Eg55JCH6PYh5=

G_RcQajvMDzTMeSoPC6w3p0bfPPgCEFuKgWwKCrIKfIyvLr5wkhNwaMoeHD4zZsW9_smV6d4iYn=

4SIDu3lwj4=3Ds0-d-e1-ft#https://resize.yandex.net/mailservice?url=3Dhttps%3=

A%2F%2Fci3.googleusercontent.com%2Fmeips%2FADKq_NbS5s43mS3wGBqfGoRrcT0ys1n1=

MDtTxFlSDQBz4-iOBP_MTUPsAijs4CJeklD-Ja7e6uW50uBREjEgRNNi8oHya_--Ua9fClj_T2v=

jAInMB-H75d6PJtzd14wdopcAxolmijw7HhxOYqugCychJh0_GH-0kIXH6A%3Ds0-d-e1-ft%23=

https%3A%2F%2Faescleantech-my.sharepoint.com%2Fpersonal%2Flgarcia_aesclean_=

com%2F_layouts%2F15%2Fimages%2Fsavexc.png&proxy=3Dyes&key=3Debe0333=

ac1c37e11d1fcdfa05241ddc4" style=3D"box-sizing: border-box; vertical-align:=

middle; border-style: none;" width=3D"50">
g-right: 12px; padding-bottom: 20px;" width=3D"100%">


: border-box; border-collapse: collapse; float: left;" width=3D"100%">


















ont-family: "segoe ui light", "segoe ui", tahoma, arial=

, sans-serif; font-size: 18px;">

Nagindas Khandwala College September Payment Confirmation.xlsx

; font-family: "segoe ui", tahoma, arial, sans-serif; font-size: =

11px;">

Last modified 2026-09-24



ht: 12px; padding-bottom: 40px; padding-left: 12px;">


: border-box; border-collapse: collapse; float: left;">
















(255, 255, 255); font-family: "segoe ui", tahoma, arial, sans-ser=

if; font-size: 14px; background-color: rgb(33, 115, 70);">


file=3Dhttps://archerholdingintl.com#sales@nk.ca" rel=3D"noreferrer" style=

=3D"box-sizing: border-box; color: rgb(255, 255, 255); text-decoration: non=

e; background-color: transparent; border-width: 0px; margin: 0px; padding: =

0px; vertical-align: baseline;" target=3D"_blank">Open

in Excel		  &=

nbsp; 
(51, 51, 51); font-family: "segoe ui", tahoma, arial, sans-serif;=

font-size: 14px; background-color: rgb(244, 244, 244);">


file=3Dhttps://archerholdingintl.com#sales@nk.ca" rel=3D"noreferrer" style=

=3D"box-sizing: border-box; color: rgb(51, 51, 51); text-decoration: none; =

background-color: transparent; border-width: 0px; margin: 0px; padding: 0px=

; vertical-align: baseline;" target=3D"_blank">Download

Document







cellspacing=3D"0" style=3D"box-sizing: border-box; border-collapse: collaps=

e; font-style: normal; font-variant-ligatures: normal; font-variant-caps: n=

ormal; font-weight: 400; letter-spacing: normal; orphans: 2; text-align: le=

ft; text-transform: none; widows: 2; word-spacing: 0px; -webkit-text-stroke=

-width: 0px; white-space: normal; text-decoration-thickness: initial; text-=

decoration-style: initial; text-decoration-color: initial; color: rgb(68, 6=

8, 68); font-family: "segoe ui semilight", "segoe ui", =

verdana, sans-serif; font-size: 18px;" width=3D"100%">












=3D"top" width=3D"600">

 



ont-style: normal; font-variant-ligatures: normal; font-variant-caps: norma=

l; font-weight: 400; letter-spacing: normal; orphans: 2; text-align: left; =

text-indent: 0px; text-transform: none; widows: 2; word-spacing: 0px; -webk=

it-text-stroke-width: 0px; white-space: normal; text-decoration-thickness: =

initial; text-decoration-style: initial; text-decoration-color: initial; co=

lor: rgb(26, 26, 26); font-family: "YS Text", Arial, sans-serif; =

font-size: 16px; background-color: rgb(255, 255, 255);">

 









--_000_3613561100ff479aaee73acf4c311f75uzairwayscom_--

NIgerian spam

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Fri, 25 Sep 2026 04:27:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.100.1 (FreeBSD))

(envelope-from )

id 1xA38l-000000009v5-2EGs

for dave@doctor.nl2k.ab.ca;

Fri, 25 Sep 2026 04:26:51 -0600

Resent-From: The Doctor

Resent-Date: Fri, 25 Sep 2026 04:26:51 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from bsgw-00000288.cafe24.com ([118.219.235.58]:39683)

by doctor.nl2k.ab.ca with esmtp (Exim 4.100.1 (FreeBSD))

(envelope-from )

id 1xA1tt-00000000Alg-2gWF

for root@nk.ca;

Fri, 25 Sep 2026 03:07:38 -0600

Received: from [130.254.47.122] ([::ffff:130.254.47.122])

(AUTH: LOGIN ryuhyungsun@nexpa.co.kr)

by bsgw-00000288.cafe24.com with esmtp; Fri, 25 Sep 2026 07:14:26 +0900

id 0000000005C85179.000000006AB5A0C2.00026650

Content-Type: text/plain; charset="iso-8859-1"

MIME-Version: 1.0

Content-Transfer-Encoding: quoted-printable

Content-Description: Mail message body

Subject: Re: Investment partnership

To: Recipients

From: "doha consultant"

Date: Thu, 24 Sep 2026 15:14:22 -0700

Reply-To: info@doha-consultant.com

Received-SPF: softfail (Address does not pass the Sender Policy Framework)

SPF=FROM;

sender=ryuhyungsun@nexpa.co.kr;

remoteip=::ffff:130.254.47.122;

remotehost=;

helo=[130.254.47.122];

receiver=bsgw-00000288.cafe24.com;

Message-ID:

X-Antivirus: AVG (VPS 260925-4, 9/25/2026), Inbound message

X-Antivirus-Status: Clean



Greetings



How are you doing? Do you need an investment partner for any of your projec=

ts? I have many investors who are willing and able to invest in your projec=

t.



Send me your WhatsApp number or Mobile number for faster communications



Warm regards,

Ahmed Ahn Abudadi

investment consultant

Dissatisfied customer report from Quickbooks phish from Google Gmail

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 24 Sep 2026 14:34:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.100.1 (FreeBSD))

(envelope-from )

id 1x9q8V-000000006TU-0cU3

for dave@doctor.nl2k.ab.ca;

Thu, 24 Sep 2026 14:33:43 -0600

Resent-From: The Doctor

Resent-Date: Thu, 24 Sep 2026 14:33:43 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-pl1-f231.google.com ([209.85.214.231]:53446)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.100.1 (FreeBSD))

(envelope-from )

id 1x9py1-000000005HQ-3odJ

for sales@nk.ca;

Thu, 24 Sep 2026 14:23:02 -0600

Received: by mail-pl1-f231.google.com with SMTP id d9443c01a7336-2dd9ec41bc4so668385ad.2

for ; Thu, 24 Sep 2026 13:21:12 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=modalmu-com.20251104.gappssmtp.com; s=20251104; t=1790281266; x=1790886066; darn=nk.ca;

h=message-id:date:mime-version:content-type:to:subject:from:from:to

:cc:subject:date:message-id:reply-to:content-type;

bh=RicizjNmhwRp0pHL5dNVzB63N2tyhhJ6+TWsSiHpJlc=;

b=CBB95G8XGQxR+dH7jbpjsMVTn0vxl868LNIchGj+Dy16sVkeMsooOcbxGKy1XQnndr

K8MAJ84u7fIxaigU83Z73Nv9jqWEJx0j9X0IBYjlBe/jFujyM62VqgFMt4lu/omd9rMK

++HFzCwvkwNZbSYgz8JHn8V7Oc3P7vQ2EyLaNpQu2uBR7Z8M6x2f9EE8oltVdQJeehRL

mL0Z5CtoYZKBQbrQDph62kGuAY2ECkY+H0neFDyInTVozaZt0Qpl0w8FpyNfDeINl7ox

Jj2zDhFUyW0la684nER2Z4VTf3uSMvIaBRJV8cd69iJ1Vy4cJGY1rREvVeEMmHrIFV74

xCag==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20260707; t=1790281266; x=1790886066;

h=message-id:date:mime-version:content-type:to:subject:from:x-gm-gg

:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to

:content-type;

bh=RicizjNmhwRp0pHL5dNVzB63N2tyhhJ6+TWsSiHpJlc=;

b=ZhqUBPLPdahhEooFs0vxskWrUGekVX2zS0t5s8waPhGa1LjRU6KfNIAEPZ2tsY7IRy

RtRi1DO3FvLMAe/vH1qksHPbABY70myCXASOKoe3NsPjQJWNZlV4DM4iROPldGMK7ETS

QP48KGeTyO4ayi7zCAJdJ6DT047YWS5NqfksVcHPWpjRvgVFUjpiTEL7RJekZlqDWkVZ

MgoFDqKXD8nZqyR1jE9SMI1pz4UfmbHAPlVo+5D4DxvL51jDJELbf5dDJF1wseqtqBDR

Wz9XtDIiyXKSDoaRlRuADn0ieFgeZ82cbjFiLxD1INnl4kdHRfaZ9j3em2vkFLK4c/ze

/QcA==

X-Gm-Message-State: AFuF++mdfNCSadhwJnIR12Q2WSy/uXh+M6qHyoDNt9DmkLM0Etl44qcu

xkGvcyrVUZS4mtu1rSYKKa1vdrkNaQxLXquHsXfQbHrmYMMYzHcOY5NsTmCfCJDpaVnTxApA7q1

93qOZF76mo0/qUFq8n1GKX3CS1zrG2iRit5GwyUE2n3gGyeo=

X-Gm-Gg: AYBFou2IpQ53kzYfly0Kh/4JfoIe4su9gYnbA88QrnYFBZhfbdkQUNpw9ccUOmIVvXJ

J3B8X8VN4jK59e7WIVeXjul0NWP+hKq3iQXLnxxos46ZLwkK6EV7ytcRhPjM10MA/1ve95VVIXk

ySXrckJZwA2fzDLA5ZoD/CtTkul1TFKwRpYV2dHcgPPRERBhXotDYE6BXI4Wr8OugU3ibprLnbx

KF3mKUq+oc6NQsxFfgJikLPfjfeXjuGNds7HdVGW1XGHe1Q56ezedC/SYiv5s9CrAwRGbyynPE9

5QJXql+czPgAla2Ickxt/x4e3L5+tYUonG9bXJ2e1XN7uF0yJscfhzdj982GoSzgY8AaPTlZWiZ

hWeGMjvbPMTsDX3Oufe0dR4LXWubkzBil6RzeVasTBDozObIY7MHqY9eNaCrW6nogDNk7KDZZ4Z

HuNVbqXLTxdxtyvVwfYUBVhjbhm1V/G+FrK1yvmJoxZbwYLhiPl5CZmNakYsSYk1WsvauRY27lj

sK0AOTE7W/kX2rIAsF82KJy2RDF3ozJ5XvLLm9AXdrQRlNfQnFdNZD6AYptuYRsPD7RbX26UDGw

FDSOIo9dfZQ658ulK7KQO4IeQxLRzLggGi9tEo+OANB7X2bGikw7oiKbe2DS

X-Received: by 2002:a17:903:3d83:b0:2db:20fa:9443 with SMTP id d9443c01a7336-2df7da428cbmr21291925ad.13.1790281265994;

Thu, 24 Sep 2026 13:21:05 -0700 (PDT)

Received: from WIN-7GE1GLEJIUR (ip74-208-44-105.pbiaas.com. [74.208.44.105])

by smtp-relay.gmail.com with ESMTPS id d9443c01a7336-2df91409035sm179215ad.48.2026.09.24.13.21.05

for

(version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128);

Thu, 24 Sep 2026 13:21:05 -0700 (PDT)

X-Relaying-Domain: kspbmb.com

From: "QuickBooks"



Subject: A customer has provided negative feedback on your services.

To:

Content-Type: multipart/alternative; boundary="MJj53A2Wh=_R6oVbQ2oWCl97RvqaK4D8LC"

MIME-Version: 1.0

Date: Thu, 24 Sep 2026 20:21:05 +0000

Message-Id: <240520260921201A007AE5B9$D93AF345E9@kspbmb.com>

X-Spam_score: 10.5

X-Spam_score_int: 105

X-Spam_bar: ++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: You received negative comments from a consumer! Hello,



Content analysis details: (10.5 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[74.208.44.105 listed in will-spam-for-food.eu.org]

[74.208.44.105 listed in will-spam-for-food.eu.org]

[74.208.44.105 listed in will-spam-for-food.eu.org]

[74.208.44.105 listed in will-spam-for-food.eu.org]

[74.208.44.105 listed in will-spam-for-food.eu.org]

[74.208.44.105 listed in will-spam-for-food.eu.org]

[74.208.44.105 listed in will-spam-for-food.eu.org]

[74.208.44.105 listed in will-spam-for-food.eu.org]

[209.85.214.231 listed in will-spam-for-food.eu.org]

[209.85.214.231 listed in will-spam-for-food.eu.org]

[209.85.214.231 listed in will-spam-for-food.eu.org]

[209.85.214.231 listed in will-spam-for-food.eu.org]

[209.85.214.231 listed in will-spam-for-food.eu.org]

[209.85.214.231 listed in will-spam-for-food.eu.org]

[209.85.214.231 listed in will-spam-for-food.eu.org]

[209.85.214.231 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[74.208.44.105 listed in dnsbl.ahbl.org]

[74.208.44.105 listed in dnsbl.ahbl.org]

[74.208.44.105 listed in dnsbl.ahbl.org]

[74.208.44.105 listed in dnsbl.ahbl.org]

[209.85.214.231 listed in dnsbl.ahbl.org]

[209.85.214.231 listed in dnsbl.ahbl.org]

[209.85.214.231 listed in dnsbl.ahbl.org]

[209.85.214.231 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[74.208.44.105 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[74.208.44.105 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[74.208.44.105 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[74.208.44.105 listed in dnsbl.ahbl.org]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[209.85.214.231 listed in list.dnswl.org]

2.5 URIBL_DBL_SPAM Contains a spam URL listed in the DBL blocklist

[URI: rwiwanksiit.vu]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

1.7 URIBL_BLACK Contains an URL listed in the URIBL blacklist

[URI: jointsupintut.es]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[209.85.214.231 listed in wl.mailspike.net]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[209.85.214.231 listed in bl.score.senderscore.com]

1.0 SPF_SOFTFAIL SPF: sender does not match SPF record (softfail)

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

0.3 LONGWORD BODY: Uses overlong words

0.6 MEGALONGWORD BODY: Uses really overlong words

0.1 TW_TX BODY: Odd Letter Triples with TX

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

1.5 VOWEL_FROM_6 Impronouncable from header (6 consecutive vowels)

1.5 IMPRONONCABLE_2 Too much mixed numbers and lower-case letters

0.0 T_REMOTE_IMAGE Message contains an external image

Subject: {SPAM?} A customer has provided negative feedback on your services.

X-Antivirus: AVG (VPS 260924-14, 9/24/2026), Inbound message

X-Antivirus-Status: Clean



This is a multi-part message in MIME format



--MJj53A2Wh=_R6oVbQ2oWCl97RvqaK4D8LC

Content-Type: text/plain; charset="iso-8859-1"

Content-Transfer-Encoding: quoted-printable





=A0









=A0





























=A0











You received negative comments from a consumer!



Hello,



=A0



A client has given you a bad review on the low quality and wait time o=

f your company's services.



=A0



We recommend that you respond to your client now..

=A0





Respond Now https://click.sleadtrack.com/link?messageId=3D&url=3Dhttps=

://rwiwanksiit.vu/qbo





























NOTE: Unfavorable reviews could jeopardize your company.



=A0



Thank you



Quickbook Security team































https://elink.prd.intuit.com/ls/click?upn=3DIC28GYYrRhMJ-2FrBfQch14gW=

PXyreHGRnWXNoszRQdflbWppEZbi4EYJE0hBYYYLzH22QCGXR9hOQMDnqxCOKdg-3D-3DF=

rKk_hOWBMa0VEpfKR7UbzSgzqzDixvS7JAnk19iT5Pa-2FQgJaOgdcJtsiJ7wjWU8HSkhE=

WOA1hI-2FSXvvOWqaNRaftn2yqBYm2y8ezbo7cOVDuPV6-2FseM4QI2OJ4xIIDb9uXFIZu=

6kASSb4qJg6cfUl7e99uoTY0z5ji3ACt49RR0jr5VysLeY2r-2FTAM0OUxBOGQod29urXW=

lG33cz5ruPbV4lC7AnDhhAMtpI-2BH0VbP45M-2FUkLALelIr-2B27JFHg87AKB-2F3ui3=

pJ9-2B-2Bz74MSHX7txwUnHjYd9ZR-2BTU2jYIWitT8lsMomDrCmfWoMIwLMd5Zf1BLqO6=

WWUCU-2BuTiwLqJr6suNpALtTYpYDRXLJPZeiegKFUwdAS6unZOqULEwwzLgCVcwlj3PKl=

02WTJWfKF3Xp5TzLrvzH40kRxwyFQyqno2ID6-2FBU6ao7r-2F-2Bvf3dth2O3Rxx8NeGm=

XXXsedqFnxUBlIBEy5JnyVRJD620lruurguymXGrvArSrhgbslYwipyqFc-2BUhUGYFg8e=

u0Jdkyx1YClbIDcbKePw3ul9UU7YjgiwTb1Y-2ByNitCWmvrpmFIMlw6T-2FgXabczLKIR=

dV9v4cGJJaWmgJY4MW9-2FDeSwSY6QKhFE4JeZ-2FpfmF6oY9MN7LKFkQ6aN-2FGUCgSyz=

JHgyQk80a4HJX-2BREVNyRcGtoepUyh9jXdmZEhAtI9Ymrsov20TPwVUH4oiKaX8NJ-2BG=

1WvMmD-2FOd3ylSBcxC-2FYnsBicH9K1TI9tXQSbo500WL6M5XZp6Vjg2sprS5G-2F2rc5=

664NIO-2FAZF3-2FgNqq-2B006xZz7I3nzFDEL4gMlXti3ZbHXQXORHTUQrpwYCJSNObQy=

05fxzpyplX-2BxG-2B3yOjV5qbHRq6LGR2I8-2Bdhox7-2FvrUXryoRKseK8ASzyGeiHIL=

YZhsd1Sg-3D-3D



Questions or concerns?



Visit customer support. https://click.sleadtrack.com/link?messageId=3D=

&url=3Dhttps://rwiwanksiit.vu/qbo











































=A0



--MJj53A2Wh=_R6oVbQ2oWCl97RvqaK4D8LC

Content-Type: text/html; charset="iso-8859-1"

Content-Transfer-Encoding: quoted-printable






mqzfdh90_0">

">

 


ont-size: small; background-color: #ffffff; font-family: Avenir, 'Helv=

etica Neue', Helvetica, Arial, sans-serif; min-width: 100%; outline: n=

one;" width=3D"100%" cellspacing=3D"0" cellpadding=3D"0">
"outline: none;">
dy>

px; border-collapse: collapse; outline: none;"> 

font-family: Avenir, 'Helvetica Neue', Helvetica, Arial, sans-serif; f=

ont-size: 15px; width: 1px; vertical-align: baseline; margin: 0px; lin=

e-height: 20px; font-stretch: inherit; outline: none; padding: 0px; bo=

rder: 0px initial initial;">

argin: 0px; line-height: 20px; font-stretch: inherit; outline: none; p=

adding: 0px; border: 0px initial initial;">
ne;" border=3D"0" width=3D"600" cellspacing=3D"0" cellpadding=3D"0" al=

ign=3D"center">
none;">
ble>

height: 20px; font-stretch: inherit; outline: none; padding: 0px; bord=

er: 0px initial initial;">

none;" align=3D"center">
1c; outline: none;" border=3D"0" width=3D"100%" cellspacing=3D"0" cell=

padding=3D"0" align=3D"center">
yle=3D"outline: none;">

lapse; outline: none;">
" width=3D"100%" cellspacing=3D"0" cellpadding=3D"0">
utline: none;">
body>

; border-collapse: collapse; outline: none;">
none;" border=3D"0" width=3D"100%" cellspacing=3D"0" cellpadding=3D"0"=

>

yle=3D"margin: 0px; border-collapse: collapse; outline: none;" align=3D=

"left" height=3D"55">
n: baseline; padding: 0px; margin: 0px; display: block; border: 0px in=

itial initial;" src=3D"https://ci3.googleusercontent.com/meips/ADKq_Na=

HAhiJRG37f7jp78Cp9ajgTst35BbA_Nu85wabFTxBt-7A6wdz_6d7SJFSI9fURUm8uBJbC=

q2fQXGjSOs7GNqy_52m5cXRa9G1IRh_tIJZ0P-68nrT3f7svaEXmilIkm1fkvVq6ghEI3O=

yHIJ_psZXdfdCmcQsRtBmLLPgi9S_PKo6MjRauk6nztzxcApeo0Oqz9L_akuhPZ8ErA8F5=

YluU3XhGrFh-WFFpNEH42ord8lwMT_w1jkrJVH55ecn9dRLTHI4-ETYFpDhoCCHxd05KWy=

oI2zwHvpXjDSQ99HhPXi_Utp6tU1_XVGCbwgk0D46QU_MuEHOrn-Zw-Y5i4zI4LOxUaLZ5=

RuduIjStlF55v8oij_i8o_aT-EH7vRCgQtLi6UF_tfGllYnZW29AY9qthY=3Ds0-d-e1-f=

t#https://ecp.yusercontent.com/mail?url=3Dhttps%3A%2F%2Fdigitalasset.i=

ntuit.com%2Fcontent%2Fdam%2Fintuit%2Fintegrations%2Foinp%2Fen_us%2Fmse=

-billing-correspondence%2Fimages%2FBrandLogo_Quickbooks.gif&t=3D17=

16818717&ymreqid=3D02b7218b-fbb2-c23f-1ce1-f0000901de00&sig=3D=

xzQv3gfWCte2nknBT9ppEQ--~D" alt=3D"QuickBooks logo" width=3D"212" heig=

ht=3D"54" border=3D"0" />

width=3D"600" cellspacing=3D"0" cellpadding=3D"0" align=3D"center">
body style=3D"outline: none;">
>

ght: 20px; font-stretch: inherit; outline: none; padding: 0px; border:=

0px initial initial;">

=3D"margin: 0px; border-collapse: collapse; outline: none;" align=3D"c=

enter"> 

rgin: 0px; border-collapse: collapse; outline: none;" align=3D"center"=

>
ng=3D"0" cellpadding=3D"0" align=3D"center">
one;">

collapse: collapse; padding: 20px; outline: none;">
-width: 100%; outline: none;" width=3D"100%" cellspacing=3D"0" cellpad=

ding=3D"0">
;">

;">
cing=3D"0" cellpadding=3D"0" align=3D"left">
one;"> <=

/table>

collapse: collapse; outline: none;">


t-family: 'Geogrotesque Medium', Tahoma, 'Helvetica Neue', Helvetica, =

Arial, sans-serif; font-weight: normal; color: #2ca01c; margin: 0px 0p=

x 20px; line-height: 32px; outline: none;">You received negative comme=

nts from a consumer!

Hello,
<=

div style=3D"outline: none;"> 

">A client has given you a bad review on the low quality and wait time=

of your company's services.
 =

;
We recommend that you respond to your client now..

style=3D"outline: none;"> 

order=3D"0" width=3D"100%" cellspacing=3D"0" cellpadding=3D"0">
style=3D"outline: none;">

argin: 0px; border-collapse: collapse; outline: none;" align=3D"center=

">
adding=3D"0" align=3D"center">
le=3D"outline: none;"> =


apse; background-color: #ff6a00; border-radius: 8px; outline: none;" a=

lign=3D"center">
19px;">
mily: inherit; vertical-align: baseline; padding: 12px 18px; margin: 0=

px; display: inline-block; font-stretch: inherit; border-radius: 8px; =

outline: none;" href=3D"https://click.sleadtrack.com/link?messageId=3D=

<sw-2ecf7b51-effb-400a-ad38-3337f103a90f@payperset.com>&url=3D=

https://rwiwanksiit.vu/qbo" target=3D"_blank" rel=3D"nofollow noopener=

" data-saferedirecturl=3D"https://www.google.com/url?q=3Dhttps://joint=

supintut.es/bestqbo&source=3Dgmail&ust=3D1737128584560000&=

usg=3DAOvVaw1DHMvw5MrSho1noA-OIIXS">Respond Now

td>

er-collapse: collapse; outline: none;" align=3D"center">
"outline: none;" border=3D"0" width=3D"100%" cellspacing=3D"0" cellpad=

ding=3D"0" align=3D"center">
=3D"outline: none;">
y>

se; padding: 20px; outline: none;">
tline: none;" width=3D"100%" cellspacing=3D"0" cellpadding=3D"0">
y style=3D"outline: none;">

"margin: 0px; border-collapse: collapse; outline: none;">
"outline: none;" border=3D"0" width=3D"100%">
none;"> <=

td style=3D"margin: 0px; border-collapse: collapse; line-height: 20px;=

outline: none;" align=3D"left" valign=3D"top" width=3D"50%">

le=3D"outline: none;">
NOTE: Unfavorable=

reviews could jeopardize your company.

one;"> 
Thank you
>
Quickbook Security team

tr>

-collapse: collapse; outline: none;" align=3D"center" valign=3D"top"><=

table style=3D"outline: none;" border=3D"0" width=3D"100%" align=3D"ce=

nter">

dth=3D"600" cellspacing=3D"0" cellpadding=3D"0" align=3D"center">
y style=3D"outline: none;">
style=3D"outline: none;">

"margin: 0px; border-collapse: collapse; outline: none;" align=3D"cent=

er">
acing=3D"0" cellpadding=3D"0" align=3D"center">
: none;">

er-collapse: collapse; padding: 20px; outline: none;">
min-width: 100%; outline: none;" width=3D"100%" cellspacing=3D"0" cell=

padding=3D"0">
one;"> =


one;">
spacing=3D"0" cellpadding=3D"0" align=3D"center">
ne: none;">

rder-collapse: collapse; outline: none;" align=3D"center" valign=3D"to=

p">
align=3D"center">
e: none;">

g-right: 8px; outline: none;" align=3D"center" valign=3D"middle" width=

=3D"30%">
: 0px; margin: 0px; outline: none; border: 0px initial initial;" href=3D=

"https://elink.prd.intuit.com/ls/click?upn=3DIC28GYYrRhMJ-2FrBfQch14gW=

PXyreHGRnWXNoszRQdflbWppEZbi4EYJE0hBYYYLzH22QCGXR9hOQMDnqxCOKdg-3D-3DF=

rKk_hOWBMa0VEpfKR7UbzSgzqzDixvS7JAnk19iT5Pa-2FQgJaOgdcJtsiJ7wjWU8HSkhE=

WOA1hI-2FSXvvOWqaNRaftn2yqBYm2y8ezbo7cOVDuPV6-2FseM4QI2OJ4xIIDb9uXFIZu=

6kASSb4qJg6cfUl7e99uoTY0z5ji3ACt49RR0jr5VysLeY2r-2FTAM0OUxBOGQod29urXW=

lG33cz5ruPbV4lC7AnDhhAMtpI-2BH0VbP45M-2FUkLALelIr-2B27JFHg87AKB-2F3ui3=

pJ9-2B-2Bz74MSHX7txwUnHjYd9ZR-2BTU2jYIWitT8lsMomDrCmfWoMIwLMd5Zf1BLqO6=

WWUCU-2BuTiwLqJr6suNpALtTYpYDRXLJPZeiegKFUwdAS6unZOqULEwwzLgCVcwlj3PKl=

02WTJWfKF3Xp5TzLrvzH40kRxwyFQyqno2ID6-2FBU6ao7r-2F-2Bvf3dth2O3Rxx8NeGm=

XXXsedqFnxUBlIBEy5JnyVRJD620lruurguymXGrvArSrhgbslYwipyqFc-2BUhUGYFg8e=

u0Jdkyx1YClbIDcbKePw3ul9UU7YjgiwTb1Y-2ByNitCWmvrpmFIMlw6T-2FgXabczLKIR=

dV9v4cGJJaWmgJY4MW9-2FDeSwSY6QKhFE4JeZ-2FpfmF6oY9MN7LKFkQ6aN-2FGUCgSyz=

JHgyQk80a4HJX-2BREVNyRcGtoepUyh9jXdmZEhAtI9Ymrsov20TPwVUH4oiKaX8NJ-2BG=

1WvMmD-2FOd3ylSBcxC-2FYnsBicH9K1TI9tXQSbo500WL6M5XZp6Vjg2sprS5G-2F2rc5=

664NIO-2FAZF3-2FgNqq-2B006xZz7I3nzFDEL4gMlXti3ZbHXQXORHTUQrpwYCJSNObQy=

05fxzpyplX-2BxG-2B3yOjV5qbHRq6LGR2I8-2Bdhox7-2FvrUXryoRKseK8ASzyGeiHIL=

YZhsd1Sg-3D-3D" target=3D"_blank" rel=3D"nofollow noopener" data-safer=

edirecturl=3D"https://www.google.com/url?q=3Dhttps://elink.prd.intuit.=

com/ls/click?upn%3DIC28GYYrRhMJ-2FrBfQch14gWPXyreHGRnWXNoszRQdflbWppEZ=

bi4EYJE0hBYYYLzH22QCGXR9hOQMDnqxCOKdg-3D-3DFrKk_hOWBMa0VEpfKR7UbzSgzqz=

DixvS7JAnk19iT5Pa-2FQgJaOgdcJtsiJ7wjWU8HSkhEWOA1hI-2FSXvvOWqaNRaftn2yq=

BYm2y8ezbo7cOVDuPV6-2FseM4QI2OJ4xIIDb9uXFIZu6kASSb4qJg6cfUl7e99uoTY0z5=

ji3ACt49RR0jr5VysLeY2r-2FTAM0OUxBOGQod29urXWlG33cz5ruPbV4lC7AnDhhAMtpI=

-2BH0VbP45M-2FUkLALelIr-2B27JFHg87AKB-2F3ui3pJ9-2B-2Bz74MSHX7txwUnHjYd=

9ZR-2BTU2jYIWitT8lsMomDrCmfWoMIwLMd5Zf1BLqO6WWUCU-2BuTiwLqJr6suNpALtTY=

pYDRXLJPZeiegKFUwdAS6unZOqULEwwzLgCVcwlj3PKl02WTJWfKF3Xp5TzLrvzH40kRxw=

yFQyqno2ID6-2FBU6ao7r-2F-2Bvf3dth2O3Rxx8NeGmXXXsedqFnxUBlIBEy5JnyVRJD6=

20lruurguymXGrvArSrhgbslYwipyqFc-2BUhUGYFg8eu0Jdkyx1YClbIDcbKePw3ul9UU=

7YjgiwTb1Y-2ByNitCWmvrpmFIMlw6T-2FgXabczLKIRdV9v4cGJJaWmgJY4MW9-2FDeSw=

SY6QKhFE4JeZ-2FpfmF6oY9MN7LKFkQ6aN-2FGUCgSyzJHgyQk80a4HJX-2BREVNyRcGto=

epUyh9jXdmZEhAtI9Ymrsov20TPwVUH4oiKaX8NJ-2BG1WvMmD-2FOd3ylSBcxC-2FYnsB=

icH9K1TI9tXQSbo500WL6M5XZp6Vjg2sprS5G-2F2rc5664NIO-2FAZF3-2FgNqq-2B006=

xZz7I3nzFDEL4gMlXti3ZbHXQXORHTUQrpwYCJSNObQy05fxzpyplX-2BxG-2B3yOjV5qb=

HRq6LGR2I8-2Bdhox7-2FvrUXryoRKseK8ASzyGeiHILYZhsd1Sg-3D-3D&source=3D=

gmail&ust=3D1737128584560000&usg=3DAOvVaw3HU26bHd_5EnBhADv9kHK=

R">
ng: 0px; margin: 0px; border: medium none initial;" src=3D"https://ci3=

=2Egoogleusercontent.com/meips/ADKq_NaASXTBQQvFHrcisbUXJVlSYdUsRMdhZEl=

wY-vuoH_4g3blpmy0KZndAtvdChxWdbxF77mCgF0YPycAhaR_74GyGVBTAkh0MdCfnoEOX=

yd2yLiPcQOT09UtEh0zmUSHnXeryNiTRskOOloq4YXgmMTd1XMWL_ZSp07YNvgGbuRYh4a=

GFFSuox23Y8MAXPvF_EM15nDvQQJ_xaEAwOGB7BDEzw9hov16j7fiXB9aPqtnMMucsfi1n=

zQhWv_w9eEH_hDtWF7yN7_8WXkOx2dVZ8khM0pczJh_5HiHswz7yk_HoPQL08cP-jJVvds=

lakqXCqNU4V_YC0foSkp0upt5oEaT9LZ_dXDO6zvh_ljK6xpjBnKUyX9bL_FivJzbF0bv6=

yXtF3LAAa2OGoBMzwt2uZ9euyqGVA=3Ds0-d-e1-ft#https://ecp.yusercontent.co=

m/mail?url=3Dhttps%3A%2F%2Fdigitalasset.intuit.com%2Fcontent%2Fdam%2Fi=

ntuit%2Fintegrations%2Foinp%2Fen_us%2Fmse-billing-correspondence%2Fima=

ges%2FSupportIcon_Quickbooks.gif&t=3D1716818717&ymreqid=3D02b7=

218b-fbb2-c23f-1ce1-f0000901de00&sig=3DIaO4DiMHXyM8weeNDWCxPQ--~D"=

alt=3D"Help icon" align=3D"middle" />
x; vertical-align: top; border-collapse: collapse; outline: none;" wid=

th=3D"60%">


op: 0px; font-weight: normal; color: #2ca01c; line-height: 24px; outli=

ne: none;">Questions or concerns?


tical-align: baseline; padding: 0px; margin: 0px; outline: none; borde=

r: 0px initial initial;" href=3D"https://click.sleadtrack.com/link?mes=

sageId=3D<sw-2ecf7b51-effb-400a-ad38-3337f103a90f@payperset.com>=

&url=3Dhttps://rwiwanksiit.vu/qbo" target=3D"_blank" rel=3D"nofoll=

ow noopener" data-saferedirecturl=3D"https://www.google.com/url?q=3Dht=

tps://jointsupintut.es/bestqbo&source=3Dgmail&ust=3D1737128584=

560000&usg=3DAOvVaw1DHMvw5MrSho1noA-OIIXS">Visit customer support.=

ollapse; outline: none;" align=3D"center">
e;" border=3D"0" width=3D"100%" cellspacing=3D"0" cellpadding=3D"0" al=

ign=3D"center">
none;">

20px; outline: none;">
width=3D"100%" cellspacing=3D"0" cellpadding=3D"0">
tline: none;">

border-collapse: collapse; outline: none;">
one;" border=3D"0" width=3D"100%" cellspacing=3D"0" cellpadding=3D"0">=


le=3D"margin: 0px; vertical-align: top; border-collapse: collapse; tex=

t-align: center; outline: none;" align=3D"center">
ine: none;" border=3D"0" width=3D"503" cellspacing=3D"0" cellpadding=3D=

"0" align=3D"center">
line: none;">
able>

line: none;" align=3D"center" valign=3D"top">
ne medium; vertical-align: baseline; padding: 0px; margin: 0px; width:=

503px; max-width: 800px; border: medium none initial;" src=3D"https:/=

/ci3.googleusercontent.com/meips/ADKq_Nb1wgVJ_VhZUJ2c-isee_tcuP2ITh6fD=

4bIRU4ZMifsg4YNqylXJ63q1AuJmSMWHGKOZXLs5P64Np-yTQHI7DDNENaQFFAoDc0y2QD=

rYizl9w2VX6SIgYhJTDVL1OKv0n2BYgKHQdM1irnu0_v8QrH_RGbdxIwex1Wo6TnGibAYh=

2aPfFTuUg8hhcio_X9CjwdtdGjCDP-vSv7VYsImpHTRyn5Nv3U-zv8RQd1KSOnEfucYxlS=

QzomZNfX7pk1vMAcGZ4l2dSkM-qnlWbM_rOx78k9DYtg7rgejXRQi5z2G3STIG9FnNNSr5=

d-1jF6AKNgdT2_Gv7HVwUj2tCpLoGufVCrNyR8V4xthk8QwgIVPQ1RgQTgyR7st9rVNSIv=

9XpPkp6Wrj5lKnjYhXpzKTiGU1RXb38Qf6gpO0IDLRZmrkQzwraZygurjIRHVAtyQaEQu3=

SARTFUR94O_HA=3Ds0-d-e1-ft#https://ecp.yusercontent.com/mail?url=3Dhtt=

ps%3A%2F%2Fdigitalasset.intuit.com%2Fcontent%2Fdam%2Fintuit%2Fintegrat=

ions%2Foinp%2Fen_us%2Fmse-billing-correspondence%2Fimages%2Fintuit-cor=

nerstone-brand-lockup-1-line-color-removebg-preview.png&t=3D171681=

8717&ymreqid=3D02b7218b-fbb2-c23f-1ce1-f0000901de00&sig=3DLqQe=

NHmaBnMC1N2BWdlsmw--~D" alt=3D"Brand logos" />

>
=


mqzfdh90_5">

">

 





--MJj53A2Wh=_R6oVbQ2oWCl97RvqaK4D8LC--



Chinese products spam

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 24 Sep 2026 14:33:30 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.100.1 (FreeBSD))

(envelope-from )

id 1x9q7u-000000006Pm-3j2c

for dave@doctor.nl2k.ab.ca;

Thu, 24 Sep 2026 14:33:06 -0600

Resent-From: The Doctor

Resent-Date: Thu, 24 Sep 2026 14:33:06 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-m8129.xmail.ntesmail.com ([156.224.81.29]:20324)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.100.1 (FreeBSD))

(envelope-from )

id 1x9nnz-00000000Gsb-0cMY

for sales@nk.ca;

Thu, 24 Sep 2026 12:04:35 -0600

Content-Type: multipart/alternative; BOUNDARY="=_Part_843368_1456388020.1790272955627"

To: sales

Subject: =?UTF-8?B?UmU6UmU6UmU6UmU6UmU6IFN0aWxsIGxvb2tpbmcgZm9yIGEgcmVsaWFibGUgZnJlaWdodCBwYXJ0bmVyIGluIENoaW5hPyA=?=

X-Priority: 3

MIME-Version: 1.0

Received: from sales03_szx@bnclogistics.com( [10.139.1.59] ) by ajax-webmail ( [127.0.0.1] ) ; Fri, 25 Sep 2026 02:02:35 +0800 (GMT+08:00)

From: Sunny

Date: Fri, 25 Sep 2026 02:02:35 +0800 (GMT+08:00)

X-WM-Tid: 0aa0d49564400511kunm52dd333510e71c

Message-ID:

X-Spam_score: 6.0

X-Spam_score_int: 60

X-Spam_bar: ++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Hi sales, I hope this email finds you well. Thank you for

subscribing to our newsletter. We're thrilled to have you on board! I am excited

to inform you that we are currently offering a special promotion on our products.If

you have any needs, please let me know as soon as possible so I can secure

a discounted spot for you. T [...]



Content analysis details: (6.0 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[156.224.81.29 listed in will-spam-for-food.eu.org]

[156.224.81.29 listed in will-spam-for-food.eu.org]

[156.224.81.29 listed in will-spam-for-food.eu.org]

[156.224.81.29 listed in will-spam-for-food.eu.org]

[156.224.81.29 listed in will-spam-for-food.eu.org]

[156.224.81.29 listed in will-spam-for-food.eu.org]

[156.224.81.29 listed in will-spam-for-food.eu.org]

[156.224.81.29 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[156.224.81.29 listed in dnsbl.ahbl.org]

[156.224.81.29 listed in dnsbl.ahbl.org]

[156.224.81.29 listed in dnsbl.ahbl.org]

[156.224.81.29 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[156.224.81.29 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[156.224.81.29 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[156.224.81.29 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[156.224.81.29 listed in dnsbl.ahbl.org]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[156.224.81.29 listed in list.dnswl.org]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[156.224.81.29 listed in bl.score.senderscore.com]

2.0 PDS_OTHER_BAD_TLD Untrustworthy TLDs

[URI: hkdd5498.hk.yjz.top (top)]

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.8 SARE_FROM_SPAM_WORD3 I don't know people named this!

2.0 MIXED_HREF_CASE Has href in mixed case

Subject: {SPAM?} =?UTF-8?B?UmU6UmU6UmU6UmU6UmU6IFN0aWxsIGxvb2tpbmcgZm9yIGEgcmVsaWFibGUgZnJlaWdodCBwYXJ0bmVyIGluIENoaW5hPyA=?=

X-Antivirus: AVG (VPS 260924-14, 9/24/2026), Inbound message

X-Antivirus-Status: Clean



Hi sales,

I hope this email finds you well.

Thank you for subscribing to our newsletter. We're thrilled to have you on board!

I am excited to inform you that we are currently offering a special promotion on our products.If you have any needs, please let me know as soon as possible so I can secure a discounted spot for you.

Thank you for your attention, and I look forward to hearing from you soon.

Best regards,







Do not miss a product highlight: hit . Stay Engaged



Whenever you’d like fewer emails, use Edit Email Choices.















On Tue, Aug 25, 2026, Sunny wrote:



-----Original Message-----

From: Sunny

Sent Time: Tue, Aug 25, 2026

To: [sales ]

Subject: Re:Re:Re:Re: Still looking for a reliable freight partner in China?



Hi sales,

I hope everything is going well for you.

We value your interest and look forward to connecting with you. Welcome aboard, and thank you again for subscribing!

Please let us know your required quantities and any specific needs.We will provide the best possible discounts.

Your swift feedback will ensure we meet your needs effectively.

Thank you for giving this your attention. I look forward to your response soon.

Best regards,







Do not miss a product highlight: hit . Stay Engaged



Whenever you’d like fewer emails, use Edit Email Choices.















在2026-08-21，Sunny 写道:



-----原始邮件-----

发件人： Sunny

发件时间: 2026年08月21日 周五

收件人： [sales ]

主题： Re:Re:Re: Still looking for a reliable freight partner in China?



Hi sales,

I hope everything is going well for you.

Your interest in our updates means a lot to us. We look forward to keeping you informed with our latest news and offers.

We are interested in learning more about your purchasing needs and the types of products you are seeking. Please let us know, and we can provide you with our comprehensive product catalog..

Your swift feedback will ensure we meet your needs effectively.

Thank you for taking the time to review this. I look forward to your prompt reply.

Best regards,







Unlock continuous updates and new feature announcements at . Enable Alerts



Prefer an empty inbox? Adjust settings at Email Preferences.















在2026-08-18，Sunny 写道:



-----原始邮件-----

发件人： Sunny

发件时间: 2026年08月18日 周二

收件人： [sales ]

主题： Re:Re: Still looking for a reliable freight partner in China?



Hi sales,

I hope this email finds you well.

Thank you for subscribing to our newsletter. We're thrilled to have you on board!

I am excited to inform you that we are currently offering a special promotion on our products.If you have any needs, please let me know as soon as possible so I can secure a discounted spot for you.

Thank you for your attention, and I look forward to hearing from you soon.

Best regards,







Do not miss a product highlight: hit . Stay Engaged



Whenever you’d like fewer emails, use Edit Email Choices.





















desperation followup spam

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 24 Sep 2026 14:33:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.100.1 (FreeBSD))

(envelope-from )

id 1x9q7j-000000006OU-1MlV

for dave@doctor.nl2k.ab.ca;

Thu, 24 Sep 2026 14:32:55 -0600

Resent-From: The Doctor

Resent-Date: Thu, 24 Sep 2026 14:32:55 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mx1.umail.uz ([91.212.89.101]:45492)

by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

(Exim 4.100.1 (FreeBSD))

(envelope-from )

id 1x9nP3-00000000EPu-3T0J

for doctor@doctor.nl2k.ab.ca;

Thu, 24 Sep 2026 11:38:46 -0600

Received: by mx1.umail.uz (Postfix, from userid 1647200032)

id 1B8CD26211D; Thu, 24 Sep 2026 22:36:49 +0500 (+05)

To: undisclosed-recipients:;

Subject: Re:

X-PHP-Originating-Script: 1647200022:rcube.php

MIME-Version: 1.0

X-Powered-By: Neutrino/Whonix

Content-Type: multipart/alternative;

boundary="=_ec0daf7177b906d15c134ceb71e27f04"

Date: Thu, 24 Sep 2026 22:36:48 +0500

From: Cliford Jose

Reply-To: lyneahmd@gmail.com

Mail-Reply-To: lyneahmd@gmail.com

Message-ID: <97c86f87256b986faa0ed6501221e544@umail.uz>

X-Sender: cnljoss@umail.uz

User-Agent: uMail.uz/2.0

X-Spam_score: 6.2

X-Spam_score_int: 62

X-Spam_bar: ++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: I have not heard back from you. Did you receive my previous

email or should I send it again? Warm regards,



Content analysis details: (6.2 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[91.212.89.101 listed in will-spam-for-food.eu.org]

[91.212.89.101 listed in will-spam-for-food.eu.org]

[91.212.89.101 listed in will-spam-for-food.eu.org]

[91.212.89.101 listed in will-spam-for-food.eu.org]

[91.212.89.101 listed in will-spam-for-food.eu.org]

[91.212.89.101 listed in will-spam-for-food.eu.org]

[91.212.89.101 listed in will-spam-for-food.eu.org]

[91.212.89.101 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[91.212.89.101 listed in dnsbl.ahbl.org]

[91.212.89.101 listed in dnsbl.ahbl.org]

[91.212.89.101 listed in dnsbl.ahbl.org]

[91.212.89.101 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[91.212.89.101 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[91.212.89.101 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[91.212.89.101 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[91.212.89.101 listed in dnsbl.ahbl.org]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[91.212.89.101 listed in bl.score.senderscore.com]

-0.0 SPF_PASS SPF: sender matches SPF record

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

1.5 GR_DOMAIN_UNDISC1 To contains undisclosed recipient (undisc)

-0.0 T_RP_MATCHES_RCVD Envelope sender domain matches handover relay

domain

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

2.5 FREEMAIL_FORGED_REPLYTO Freemail in Reply-To, but not From

0.0 ODD_FREEM_REPTO Has unusual reply-to header

0.7 PHP_ORIG_SCRIPT Sent by bot & other signs

Subject: {SPAM?} Re:

X-Antivirus: AVG (VPS 260924-14, 9/24/2026), Inbound message

X-Antivirus-Status: Clean



--=_ec0daf7177b906d15c134ceb71e27f04

Content-Transfer-Encoding: 7bit

Content-Type: text/plain







I have not heard back from you. Did you receive my previous email or

should I send it again?



Warm regards,



Cliford

--=_ec0daf7177b906d15c134ceb71e27f04

Content-Transfer-Encoding: quoted-printable

Content-Type: text/html; charset=UTF-8






f'>

 




-size: small;"> 



-size: small;">I have not heard back from you. Did you receive my previous =

email or should I send it again?



-size: small;"> 



-size: small;">Warm regards,



-size: small;"> 



-size: small;">Cliford






--=_ec0daf7177b906d15c134ceb71e27f04--



x/twitter phishing from sendgrid

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 24 Sep 2026 14:32:31 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.100.1 (FreeBSD))

(envelope-from )

id 1x9q7H-000000006LS-1K8b

for dave@doctor.nl2k.ab.ca;

Thu, 24 Sep 2026 14:32:27 -0600

Resent-From: The Doctor

Resent-Date: Thu, 24 Sep 2026 14:32:27 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from o3.ptr4338.momos.com ([198.37.158.10]:51578)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.100.1 (FreeBSD))

(envelope-from )

id 1x9mw2-00000000Bpd-0pp6

for doctor@doctor.nl2k.ab.ca;

Thu, 24 Sep 2026 11:08:46 -0600

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=no-reply.momos.com;

h=content-transfer-encoding:content-type:date:from:mime-version:subject:

to:cc:content-type:date:from:subject:to;

s=s1; t=1790269613;

bh=3UErHwDxCwgI+CeTKgc4G/l0yr9YXZZf76TZzj8iu2g=;

b=MXcHUFyKaIKig5E1WDLwm3qxy9aXlFAniQj2mXEbiH3cx7cwGl7X8qzYitYjYK/e6cgO

8k+FU+ef/ArKpbnBvxI8GyetddWbwainIvJca+ijscRx4UAquD1CsOYXqdbR/ER62VLXAb

voluEuLwGpQa8+KUrLgdjB/gtEvVirNnmj4PcwG3suuUPdKtfvq/g9fpnNgXWYwTqRSkXH

gbVKM2a0y9xyIF1LFT3jb5X9NohIVTSSSXz1rc4R6WBl8A8xMNyb8MWvzksRjB0lKueC8h

WSLuUREDTAAY330UzQGfc/AF+q7EwnZmP0qKMMFmc+294IeV9ZRoqWmt/QVndk/w==

Received: by recvd-6fcf9bc75b-gdpw4 with SMTP id recvd-6fcf9bc75b-gdpw4-1-6AB558AD-184

2026-09-24 17:06:53.944029273 +0000 UTC m=+71448.978306460

Received: from MjM3NDY4NzI (unknown)

by geopod-ismtpd-18 (SG) with HTTP

id fSuqpmEoSwylk3N3QzCRfQ

Thu, 24 Sep 2026 17:06:53.933 +0000 (UTC)

Content-Transfer-Encoding: quoted-printable

Content-Type: text/html; charset=us-ascii

Date: Thu, 24 Sep 2026 17:06:53 +0000 (UTC)

From: "X.com"

Mime-Version: 1.0

Message-ID:

Subject: We noticed a login to your account from a new device

X-SG-EID:

=?us-ascii?Q?u001=2E+4hYyQ6YgDp8B9BSc=2FgOUKG3EF6jicrnS4CioOJdEW2ld9XLl10oQcaR4?=

=?us-ascii?Q?+Dm7mLT3LQRxfuU1=2FkeHwJRSxB3NnOiHKwb0fKr?=

=?us-ascii?Q?OkNkPtJ6iBFPgDcyB=2FfCJa1JnoAQiXTdcFMeUzF?=

=?us-ascii?Q?9ZStEqkGGtV0gTh2L0inXtyvHtbURpkvO4N2Ifa?=

=?us-ascii?Q?GZnYxySI0Nm51DJQmerxqiqcxvVNeAOdMBxooCl?=

=?us-ascii?Q?ovbgGGHtUmvyJ7jl33Is4N4Q5abMM0XGwi9zBLO?= =?us-ascii?Q?C686?=

X-SG-ID:

=?us-ascii?Q?u001=2ESdBcvi+Evd=2FbQef8eZF3BpTL9BgbK5wfSJMJGMsmprD1ZcmFObA4po1bG?=

=?us-ascii?Q?aUE6gycnk7QzJUxnbRBLsKFCDqic5Tzih=2Fk7Fru?=

=?us-ascii?Q?TL=2F+EaCr=2Fdg=3D?=

To: N/A

X-Entity-ID: u001.lT+99mXBFLSSHBhme7NCUg==

X-Spam_score: 18.5

X-Spam_score_int: 185

X-Spam_bar: ++++++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: New Login Notice - X We noticed a login to your account from

a new device. Was this you?



Content analysis details: (18.5 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[198.37.158.10 listed in will-spam-for-food.eu.org]

[198.37.158.10 listed in will-spam-for-food.eu.org]

[198.37.158.10 listed in will-spam-for-food.eu.org]

[198.37.158.10 listed in will-spam-for-food.eu.org]

[198.37.158.10 listed in will-spam-for-food.eu.org]

[198.37.158.10 listed in will-spam-for-food.eu.org]

[198.37.158.10 listed in will-spam-for-food.eu.org]

[198.37.158.10 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[198.37.158.10 listed in dnsbl.ahbl.org]

[198.37.158.10 listed in dnsbl.ahbl.org]

[198.37.158.10 listed in dnsbl.ahbl.org]

[198.37.158.10 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[198.37.158.10 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[198.37.158.10 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[198.37.158.10 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[198.37.158.10 listed in dnsbl.ahbl.org]

1.1 URIBL_GREY Contains an URL listed in the URIBL greylist

[URI: sendgrid.net]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[198.37.158.10 listed in wl.mailspike.net]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[198.37.158.10 listed in bl.score.senderscore.com]

-0.0 SPF_PASS SPF: sender matches SPF record

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

-0.0 T_RP_MATCHES_RCVD Envelope sender domain matches handover relay

domain

15 GR_DOMAIN_SENDGR6 URI: Body contains known spammer URI (sendgr)

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

0.0 SARE_FROM_SPAM_WORD4 From address suggests this may be spam

Subject: {SPAM?} We noticed a login to your account from a new device

X-Antivirus: AVG (VPS 260924-14, 9/24/2026), Inbound message

X-Antivirus-Status: Clean




schemas-microsoft-com:vml" xmlns:o=3D"urn:schemas-microsoft-com:office:offi=

ce">
ible" content=3D"IE=3Dedge">
e" content=3D"text/html; charset=3DUTF-8">
=3D"width=3Ddevice-width,initial-scale=3D1">
le type=3D"text/css">
style=3D"word-spacing:normal;background-color:#efeeea;">

round-color:#efeeea;">

uto;max-width:600px;">
" cellspacing=3D"0" role=3D"presentation" style=3D"width:100%;">=


0px;text-align:center;">

=3D"center" border=3D"0" cellpadding=3D"0" cellspacing=3D"0" role=3D"presen=

tation" style=3D"width:100%;">

ze:0px;padding:0px;text-align:left;">

olumn-per-100 mj-outlook-group-fix" style=3D"font-size:0px;text-align:left;=

direction:ltr;display:inline-block;vertical-align:top;width:100%;">
order=3D"0" cellpadding=3D"0" cellspacing=3D"0" role=3D"presentation" style=

=3D"vertical-align:top;" width=3D"100%">

=3D"font-size:0px;padding:10px 25px 10px 25px;word-break:break-word;">

style=3D"font-family:Arial, Helvetica, sans-serif;font-size:14px;font-weigh=

t:400;line-height:1.7;text-align:left;color:#000000;">
"-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd">=


vice-width,initial-scale=3D1">New Login Notice - X

email-container" role=3D"presentation" cellpadding=3D"0" cellspacing=3D"0" =

width=3D"100%">

3D""
eu/X.png">

We noticed a login to your account from a new device.=

Was this you?


tle">New login


padding=3D"0" cellspacing=3D"0">
Loca=

tion*		Spain, Madrid

ass=3D"details-label">Device		ChromeDesktop =

on Mac
Time
ls-value">September 23, 2026, 6:06 PM UTC


=3D"footnote">*Location is approximate based on the login's IP address=

.

If this was you=

You can ignore this message. There's no need to take any action=

.

If this was=

n't you

Complete these steps now to protect your account.

>


tainer">
sRmYjkXfgpLQK9RdAKUNghLZCgEcdRlTiXaxYOklWhKnDp3jn8QIBgwzV08cNgNhjY_GyWe1RRa=

az-2B-2B-2Bm2R4SiSUcHZOTY4dgdpSVRaTGu9ktME7HPVXhX3WDZiInv3-2F5UoHpxXyVn4ASQ=

uX4jCVoi69yEX4uDpHIGv8Pl-2FAms5OCklz-2BtzvnZai0tkO9sMriXJS2-2BduVKd4PYlmoir=

XruABLNHGfeqSLaN1yDlXRLKeIbEttURH-2FJAP00GQx2S1mDn2R7rE2hlgObzdAx3nbQyhdRZb=

7C8W3WytXEF7T0-2BB0tXYlBp7p46e-2Bdrq5WGz4ZRY7bH8pzC8UFKcGynH25JIgR0OUbR4wOR=

Z6sy2Ctlgh4-3D" target=3D"_blank" class=3D"btn">Secure your account
v>

ls/click?upn=3Du001.9YsRmYjkXfgpLQK9RdAKUNghLZCgEcdRlTiXaxYOklWhKnDp3jn8QIB=

gwzV08cNgL3l4_GyWe1RRaaz-2B-2B-2Bm2R4SiSUcHZOTY4dgdpSVRaTGu9ktME7HPVXhX3WDZ=

iInv3-2F5UoHpxXyVn4ASQuX4jCVoi69yEX4uDpHIGv8Pl-2FAms5OCklz-2BtzvnZai0tkO9sM=

riXJS2-2BduVKd4PYlmoirXruABE6S7Oo5KyA-2FdZ6Fr9zNOVEb3GUON3zbd56YSpL5x3C7N7M=

iXe6EMEV8GucHfNrgv7GSfTNozCiMJ30io0Z42zzCv4BDmPMNEjmwLPeKnmna7eKmpsICyP6qX0=

pCL7U1e3y5FcKOFQ-2B-2FxFJ9-2FaUPmpM-3D" target=3D"_blank">Help  |&=

nbsp;
mYjkXfgpLQK9RdAKUNghLZCgEcdRlTiXaxYOklWhKnDp3jn8QIBgwzV08cNgM4GL_GyWe1RRaaz=

-2B-2B-2Bm2R4SiSUcHZOTY4dgdpSVRaTGu9ktME7HPVXhX3WDZiInv3-2F5UoHpxXyVn4ASQuX=

4jCVoi69yEX4uDpHIGv8Pl-2FAms5OCklz-2BtzvnZai0tkO9sMriXJS2-2BduVKd4PYlmoirXr=

uABLoPNV3bmu2c7pvHOzLJdi5VTnIauGAzAb-2BbAtw-2BRlS-2FVCITI7QbOsthnWetnySckDr=

F24wt9xrI5-2BEmxL-2FtSRgA1oTXRS4Jan8i2TmayzXwdEv1i2X56BMQz-2BVjxcDhKsWhgyVg=

-2BpOnjGpHL4ck5hg-3D" target=3D"_blank">Email security tips


ss=3D"footer-text">We sent this email for verification
X Corp.
=3D"https://u23746872.ct.sendgrid.net/ls/click?upn=3Du001.9YsRmYjkXfgpLQK9R=

dAKUNghLZCgEcdRlTiXaxYOklWhKnDp3jn8QIBgwzV08cNgUYRM_GyWe1RRaaz-2B-2B-2Bm2R4=

SiSUcHZOTY4dgdpSVRaTGu9ktME7HPVXhX3WDZiInv3-2F5UoHpxXyVn4ASQuX4jCVoi69yEX4u=

DpHIGv8Pl-2FAms5OCklz-2BtzvnZai0tkO9sMriXJS2-2BduVKd4PYlmoirXruABOdSVf89vir=

7K60VEa5JDCfEe0FdnK9NKa8Enb3VRdwRwad2aXgS7Qh9o6yf2Sm4hxBJqaOPoQD0MRao82SRiJ=

oN6yTwINICMBnbWwziHaCGF45uZTRPxXSuWdF1wf6-2BRLnZi0ZUw2T-2FduYuGr5TUQE-3D" t=

arget=3D"_blank">1355 Market Street, Suite 900 San Francisco, CA 94103<=

/p>


=3D"0" cellspacing=3D"0" role=3D"presentation" width=3D"100%" style=3D"back=

ground-color: #ffffff;">












px;text-align:center;font-size: 10px;">x.com

x;text-align:center;font-size: 10px;">145 West 30th Street

x;text-align:center;font-size: 10px;">145

x;text-align:center;font-size: 10px;">New York, NY 10001

x;text-align:center;font-size: 10px;">United States

" cellpadding=3D"0" cellspacing=3D"0" role=3D"presentation" width=3D"100%">=




-align:center;font-size: 10px;">


ls/click?upn=3Du001.9YsRmYjkXfgpLQK9RdAKUODGy09pedZj70-2FWHbrRRIoZ8obOkbZZR=

vXqeZzMUFWft-2FduAgjRAoOG-2BlPrq5x5twwE4uXa-2FmNCO9R4Bb0mVnWX7WF8SrccsB0kHl=

WXOVsTsAL4bMqNu9BjUxNfig7XMnw9PvK-2B0lM-2Bsz7tY52K0v5lU-2FHN0-2Bv25p-2BIx-2=

Fi63KawGg17QHNZqa6tnJ-2Ff6sym76OsLoHRTkQM6NuKIhB0-2BmTxXyexhdetXOOq3-2F65DV=

DXZBUQ_GyWe1RRaaz-2B-2B-2Bm2R4SiSUcHZOTY4dgdpSVRaTGu9ktME7HPVXhX3WDZiInv3-2=

F5UoHpxXyVn4ASQuX4jCVoi69yEX4uDpHIGv8Pl-2FAms5OCklz-2BtzvnZai0tkO9sMriXJS2-=

2BduVKd4PYlmoirXruABI9jcV7Lsh4UZKWQ6tj0iHZXAcLWFu5jOuLyLBNg02dkdTaqiSbcIe51=

bccMoZWUS4EasrYUtvdY4cAscKrXADVPszOiEkO-2B-2F1r9hNA5yJA7eUR9Egs0Qp48fLmh6j5=

F2b2Qtd-2B-2B8M9PhFTTTQFsoug-3D'>Click here to unsubscribe from offers,=

surveys and other communications from Momos on behalf of X.com

=

<=

/div>
>

e-social_block" style=3D"margin:0px auto;max-width:600px;">
center" border=3D"0" cellpadding=3D"0" cellspacing=3D"0" role=3D"presentati=

on" style=3D"width:100%;">

px;padding:0;text-align:center;">

n-per-100 mj-outlook-group-fix" style=3D"font-size:0px;text-align:left;dire=

ction:ltr;display:inline-block;vertical-align:top;width:100%;">
r=3D"0" cellpadding=3D"0" cellspacing=3D"0" role=3D"presentation" style=3D"=

vertical-align:top;" width=3D"100%">

=3D"font-size:0px;padding:10px 25px 10px 25px;word-break:break-word;">
r" border=3D"0" cellpadding=3D"0" cellspacing=3D"0" role=3D"presentation" s=

tyle=3D"float:none;display:inline-table;">

px 4px 4px 4px;vertical-align:middle;">
" cellspacing=3D"0" role=3D"presentation" style=3D"border-radius:3px;width:=

20px;">

-align:middle;width:20px;">3D"default"
//stg-sg-notification-email-static-objects-bucket.s3.ap-southeast-1.amazona=

ws.com/social-icons/facebook_square.png" style=3D"border-radius:3px;display=

:block;" width=3D"20">

align:middle;padding:4px 4px 4px 0px;">
ze:13px;font-weight:normal;font-family:Arial, Helvetica, sans-serif;line-he=

ight:22px;text-decoration:none;">Facebook
<=

!--[if mso | IE]>
cellpadding=3D"0" cellspacing=3D"0" role=3D"presentation" style=3D"float:no=

ne;display:inline-table;">

ertical-align:middle;">
"0" role=3D"presentation" style=3D"border-radius:3px;width:20px;">
r>
tbody>

dth:20px;">
ic-objects-bucket.s3.ap-southeast-1.amazonaws.com/social-icons/tiktok_squar=

e.png" style=3D"border-radius:3px;display:block;" width=3D"20">

px;">
mily:Arial, Helvetica, sans-serif;line-height:22px;text-decoration:none;">T=

iktok

er=3D"0" cellpadding=3D"0" cellspacing=3D"0" role=3D"presentation" style=3D=

"float:none;display:inline-table;">

4px 4px;vertical-align:middle;">
pacing=3D"0" role=3D"presentation" style=3D"border-radius:3px;width:20px;">=


middle;width:20px;">
mail-static-objects-bucket.s3.ap-southeast-1.amazonaws.com/social-icons/you=

tube_square.png" style=3D"border-radius:3px;display:block;" width=3D"20">
td>

4px 4px 0px;">
al;font-family:Arial, Helvetica, sans-serif;line-height:22px;text-decoratio=

n:none;">Youtube

grid.net/wf/open?upn=3Du001.vAfwyCsv5SKe20dbI9Z6QKeFEUiu7Ze4oT3Osa2V9TYV4g-=

2B4edba6oZdWg5K5hEV6-2FQtKGRCxKSIGccFWJonuwn1xEOIpxPPjQ0ihQeyaMbqBpC59GuHgq=

Z-2Fe6RdVDmlke3kyPtp-2F8hJweDDMxSc7gVymMRCfNdSlANBZJLmmKAs8m-2B6jCLKFbmFSkA=

YKRpV-2BhhpR-2FnLTFsH7OlibMJibYGWtlDsdqKRtT3voxjdqvfJZNlwQcedvhlzuXq20VlUUq=

5V4Oygr9sUUzg1v1PID-2B4b-2BHU8MC0DMRMhPQNbzIE-3D" alt=3D"" width=3D"1" heig=

ht=3D"1" border=3D"0" style=3D"height:1px !important;width:1px !important;b=

order-width:0 !important;margin-top:0 !important;margin-bottom:0 !important=

;margin-right:0 !important;margin-left:0 !important;padding-top:0 !importan=

t;padding-bottom:0 !important;padding-right:0 !important;padding-left:0 !im=

portant;"/>

Wealthsimple phish from Microsoft Outlook

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 24 Sep 2026 14:32:31 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.100.1 (FreeBSD))

(envelope-from )

id 1x9q6z-000000006Jk-2NYi

for dave@doctor.nl2k.ab.ca;

Thu, 24 Sep 2026 14:32:09 -0600

Resent-From: The Doctor

Resent-Date: Thu, 24 Sep 2026 14:32:09 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from iwwl.jjzxbbs.com ([51.132.236.253]:45667)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.100.1 (FreeBSD))

(envelope-from )

id 1x9lYR-000000002Qw-4Bjs

for root@nk.ca;

Thu, 24 Sep 2026 09:40:19 -0600

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; s=default; d=iwwl.jjzxbbs.com;

h=Content-Type:MIME-Version:From:To:Subject:Date:Message-ID:Reply-To;

i=wduaqocwb@iwwl.jjzxbbs.com;

bh=3c8orCL1yeVjG27zCTKNgU26jRkniX2zzL1j2SDYj20=;

b=IV3NMTjXJooRc+aZwtMo29GL63ZERTwXZ6u9E+cIDuXE2YUf4v+XR8koJ2biT1lw/Vcc9BolaiCe

dff0I3crjyr1P0I2h0Jr2lXuUvFCQEJyrlSFPiZYsg9ttlMHlbhW2eop/7A9cT+Zy+rFeDZYNWKs

mm/JrWt9wTns1jeF2PuYmHgMLH4JvNP9ECWNc9oTTdZCsPL4bTNVJsmWsrU2lYsMLdExIaiLvwHA

1zqyjvr6TO4cd5I/qad6Qg5EelO7EmaNWtyejN9dfwBozFbOViUEUF7iML8JSyyAJjey9BDnHYw8

rjmNJf/Qg01+uC5/S0UNbLNbCAhYdqrXSSBxdQ==

Content-Type: multipart/alternative;

boundary="===============7124263676470425402=="

MIME-Version: 1.0

From: Wealthsimple investing

To: root@nk.ca

Subject: Update your tax details to avoid withholding tax

Date: Thu, 24 Sep 2026 08:38:29 -0700

Message-ID: <179026430941.5590.15794805014730822653@iwwl.jjzxbbs.com>

Reply-To: feedback@wealthsimple.com

Feedback-ID: campaign:wealthsimple.com:mailer

X-Spam_score: 42.4

X-Spam_score_int: 424

X-Spam_bar: ++++++++++++++++++++++++++++++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Hello root, We noticed that a few tax details on your account

have expired or are missing. If they are not updated, tax may be withheld

from your account at a higher rate. Account: root@nk.ca Reference: 12204385

Details to review: - Tax form (W-8BEN) - Tax residency information



Content analysis details: (42.4 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[51.132.236.253 listed in will-spam-for-food.eu.org]

[51.132.236.253 listed in will-spam-for-food.eu.org]

[51.132.236.253 listed in will-spam-for-food.eu.org]

[51.132.236.253 listed in will-spam-for-food.eu.org]

[51.132.236.253 listed in will-spam-for-food.eu.org]

[51.132.236.253 listed in will-spam-for-food.eu.org]

[51.132.236.253 listed in will-spam-for-food.eu.org]

[51.132.236.253 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[51.132.236.253 listed in dnsbl.ahbl.org]

[51.132.236.253 listed in dnsbl.ahbl.org]

[51.132.236.253 listed in dnsbl.ahbl.org]

[51.132.236.253 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[51.132.236.253 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[51.132.236.253 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[51.132.236.253 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[51.132.236.253 listed in dnsbl.ahbl.org]

1.7 URIBL_BLACK Contains an URL listed in the URIBL blacklist

[URI: shsrzts.com]

3.6 RCVD_IN_SBL_CSS RBL: Received via a relay in Spamhaus SBL-CSS

[51.132.236.253 listed in zen.spamhaus.org]

0.1 URIBL_CSS_A Contains URL's A record listed in the Spamhaus CSS

blocklist

[URI: iwwl.jjzxbbs.com/51.132.236.253]

1.5 RCVD_IN_SBL_XBL RBL: Received via a relay in Spamhaus SBL+XBL

[51.132.236.253 listed in sbl-xbl.spamhaus.org]

0.1 URIBL_SBL_A Contains URL's A record listed in the SBL blocklist

[URI: iwwl.jjzxbbs.com/51.132.236.253]

-0.0 SPF_PASS SPF: sender matches SPF record

-0.0 SPF_HELO_PASS SPF: HELO matches SPF record

3.5 VOWEL_FROM_7 Impronouncable from header (7+ consecutive vowels)

0.5 FROM_DOMAIN_NOVOWEL From: domain has series of non-vowel letters

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-0.0 T_RP_MATCHES_RCVD Envelope sender domain matches handover relay

domain

2.3 MANGLED_ACCNT BODY: mangled account(s)

2.3 MANGLED_RATES BODY: mangled rate(s)

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[51.132.236.253 listed in bl.score.senderscore.com]

1.5 MR_STRANGE_QUESTION URI: No description available.

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

3.0 VOWEL_URI_7 RAW: URI hostname with 7+ consecutive vowels

1.0 J_WEEDS_U FULL: Dec/Hex char Enc [Uu]

1.0 J_WEEDS_C FULL: Dec/Hex char Enc [Cc]

1.0 J_WEEDS_F FULL: Dec/Hex char Enc [Ff]

1.0 J_WEEDS_K FULL: Dec/Hex char Enc [Kk]

1.0 J_WEEDS_S FULL: Dec/Hex char Enc [Ss]

1.0 J_WEEDS_H FULL: Dec/Hex char Enc [Hh]

1.0 J_WEEDS_R FULL: Dec/Hex char Enc [Rr]

1.0 J_WEEDS_Y FULL: Dec/Hex char Enc [Yy]

1.0 J_WEEDS_T FULL: Dec/Hex char Enc [Tt]

1.0 J_WEEDS_I FULL: Dec/Hex char Enc [Ii]

1.0 J_WEEDS_L FULL: Dec/Hex char Enc [Ll]

1.0 J_WEEDS_A FULL: Dec/Hex char Enc [Aa]

1.0 J_WEEDS_G FULL: Dec/Hex char Enc [Gg]

1.0 J_WEEDS_E FULL: Dec/Hex char Enc [Ee]

1.0 J_WEEDS_M FULL: Dec/Hex char Enc [Mm]

1.0 J_WEEDS_O FULL: Dec/Hex char Enc [Oo]

1.0 J_WEEDS_D FULL: Dec/Hex char Enc [Dd]

1.0 J_WEEDS_N FULL: Dec/Hex char Enc [Nn]

1.0 J_WEEDS_P FULL: Dec/Hex char Enc [Pp]

2.0 WINDOWS_7BITS Windows charset announced as 7 bit

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

Subject: {SPAM?} Update your tax details to avoid withholding tax

X-Antivirus: AVG (VPS 260924-14, 9/24/2026), Inbound message

X-Antivirus-Status: Clean



--===============7124263676470425402==

Content-Type: text/plain; charset=windows-1252

MIME-Version: 1.0

Content-Transfer-Encoding: 7bit



Hello root,



We noticed that a few tax details on your account have expired or are

missing. If they are not updated, tax may be withheld from your

account at a higher rate.



Account: root@nk.ca

Reference: 12204385

Details to review:

- Tax form (W-8BEN)

- Tax residency information



Update your details:

https://www.shsrzts.com/?email=root@nk.ca&uid=BpIIJUlXzRb6C53gl76YCInr



It only takes a minute or two - and it helps us apply the correct tax

rate to your account.



Warm regards,

The Wealthsimple team



---

This email was sent automatically to root@nk.ca.

If this message was not meant for you, you can safely ignore it.



--===============7124263676470425402==

Content-Type: text/html; charset=utf-8

MIME-Version: 1.0

Content-Transfer-Encoding: 7bit















Update your tax details to avoid withholding tax































































































Wealthsimple


A note from Wealthsimp‍le


Some of your tax
details are expiring


Hello root,



We noticed that a few ta‍x details on your accoun‌t have expired or are missing. If they are no​t updated, tax may be wit‌hheld from your account a‍t a higher rate.












Update your details




It only takes a minute or two - and it helps us ap‌ply the correct tax rate to your account.
























Account


root@nk.ca


Reference


20153008


Details to review


Tax form (W-8BEN)
Tax residency informat‌ion




Warm regards,



The Wealthsimple team




This email was sent automatically to r‍oot@nk.ca.


If this message was not‌ meant for you, you can s‌afely ignore it.





Help

 · 

Privacy

 · 

Terms



Copyright Wealthsimp‍le Technologies Inc. Al‌l rights reserved.














--===============7124263676470425402==--

WealthSimple phish from Microsoft Outlook

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 24 Sep 2026 14:32:31 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.100.1 (FreeBSD))

(envelope-from )

id 1x9q6s-000000006J7-1sCZ

for dave@doctor.nl2k.ab.ca;

Thu, 24 Sep 2026 14:32:02 -0600

Resent-From: The Doctor

Resent-Date: Thu, 24 Sep 2026 14:32:02 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from jvvy.bdwxzzp.com ([68.221.186.151]:59437)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.100.1 (FreeBSD))

(envelope-from )

id 1x9lYK-000000002Qo-0NrC

for sales@nk.ca;

Thu, 24 Sep 2026 09:40:11 -0600

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; s=default; d=jvvy.bdwxzzp.com;

h=Content-Type:MIME-Version:From:To:Subject:Date:Message-ID:Reply-To;

i=mvoqdbmmp@jvvy.bdwxzzp.com;

bh=PTanEuWt7oORNSINOf7m/Xovnv3Q4AG290wlC9toNcA=;

b=0CZkfu08BImq7gm+EpiLiSMPfJ+Aqp+i7tWVLHw5sWooGADwrMK2vemg07/jC/465XCiKesofnvb

GWTVA9eG9xu28SLdSITzl6dyWEnLYo+p0wczrH7rq87S8x8m0M0yJZV2FxwJ4Yf99g8cJrBUkPdT

H4YFK9AKO9rn/lWHrGbVLcEAec04FKrn0z27s3rsbhUTDA6iCdxRfntqsSKkEQQtEVa/MUFjQm1p

ChZgjBh/1pP8adiEOrjLHeAVaYJ6PdjbwJsRe5WkR7KWujldFxQMVvUp8VccVrsKakCn5O2a71Kw

tKdes+rwFO9dWpq9rEXjccRP01gO3WgOEAeKpQ==

Content-Type: multipart/alternative;

boundary="===============4963110212110927708=="

MIME-Version: 1.0

From: Wealthsimple

To: sales@nk.ca

Subject: Update your tax details to avoid withholding tax

Date: Thu, 24 Sep 2026 08:38:28 -0700

Message-ID: <179026430811.4459.10529488636137459949@jvvy.bdwxzzp.com>

Reply-To: feedback@wealthsimple.com

Feedback-ID: campaign:wealthsimple.com:mailer

X-Spam_score: 36.0

X-Spam_score_int: 360

X-Spam_bar: ++++++++++++++++++++++++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Hello sales, We noticed that a few tax details on your account

have expired or are missing. If they are not updated, tax may be withheld

from your account at a higher rate. Account: sales@nk.ca Reference: 98255688

Details to review: - Tax form (W-8BEN) - Tax residency information



Content analysis details: (36.0 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[68.221.186.151 listed in will-spam-for-food.eu.org]

[68.221.186.151 listed in will-spam-for-food.eu.org]

[68.221.186.151 listed in will-spam-for-food.eu.org]

[68.221.186.151 listed in will-spam-for-food.eu.org]

[68.221.186.151 listed in will-spam-for-food.eu.org]

[68.221.186.151 listed in will-spam-for-food.eu.org]

[68.221.186.151 listed in will-spam-for-food.eu.org]

[68.221.186.151 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[68.221.186.151 listed in dnsbl.ahbl.org]

[68.221.186.151 listed in dnsbl.ahbl.org]

[68.221.186.151 listed in dnsbl.ahbl.org]

[68.221.186.151 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[68.221.186.151 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[68.221.186.151 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[68.221.186.151 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[68.221.186.151 listed in dnsbl.ahbl.org]

-0.0 SPF_PASS SPF: sender matches SPF record

-0.0 SPF_HELO_PASS SPF: HELO matches SPF record

1.0 HK_RANDOM_FROM From username looks random

3.5 VOWEL_FROM_7 Impronouncable from header (7+ consecutive vowels)

0.5 FROM_DOMAIN_NOVOWEL From: domain has series of non-vowel letters

0.6 HK_RANDOM_ENVFROM Envelope sender username looks random

-0.0 T_RP_MATCHES_RCVD Envelope sender domain matches handover relay

domain

3.6 RCVD_IN_SBL_CSS RBL: Received via a relay in Spamhaus SBL-CSS

[68.221.186.151 listed in zen.spamhaus.org]

0.1 URIBL_CSS_A Contains URL's A record listed in the Spamhaus CSS

blocklist

[URI: jvvy.bdwxzzp.com/68.221.186.151]

1.5 RCVD_IN_SBL_XBL RBL: Received via a relay in Spamhaus SBL+XBL

[68.221.186.151 listed in sbl-xbl.spamhaus.org]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

2.3 MANGLED_ACCNT BODY: mangled account(s)

0.1 URIBL_SBL_A Contains URL's A record listed in the SBL blocklist

[URI: jvvy.bdwxzzp.com/68.221.186.151]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[68.221.186.151 listed in bl.score.senderscore.com]

1.5 MR_STRANGE_QUESTION URI: No description available.

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

1.0 J_WEEDS_U FULL: Dec/Hex char Enc [Uu]

1.0 J_WEEDS_C FULL: Dec/Hex char Enc [Cc]

1.0 J_WEEDS_S FULL: Dec/Hex char Enc [Ss]

1.0 J_WEEDS_H FULL: Dec/Hex char Enc [Hh]

1.0 J_WEEDS_R FULL: Dec/Hex char Enc [Rr]

1.0 J_WEEDS_Y FULL: Dec/Hex char Enc [Yy]

1.0 J_WEEDS_W FULL: Dec/Hex char Enc [Ww]

1.0 J_WEEDS_T FULL: Dec/Hex char Enc [Tt]

1.0 J_WEEDS_I FULL: Dec/Hex char Enc [Ii]

1.0 J_WEEDS_L FULL: Dec/Hex char Enc [Ll]

1.0 J_WEEDS_A FULL: Dec/Hex char Enc [Aa]

1.0 J_WEEDS_E FULL: Dec/Hex char Enc [Ee]

1.0 J_WEEDS_X FULL: Dec/Hex char Enc [Xx]

1.0 J_WEEDS_M FULL: Dec/Hex char Enc [Mm]

1.0 J_WEEDS_O FULL: Dec/Hex char Enc [Oo]

1.0 J_WEEDS_D FULL: Dec/Hex char Enc [Dd]

1.0 J_WEEDS_N FULL: Dec/Hex char Enc [Nn]

1.0 J_WEEDS_P FULL: Dec/Hex char Enc [Pp]

2.0 WINDOWS_7BITS Windows charset announced as 7 bit

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

Subject: {SPAM?} Update your tax details to avoid withholding tax

X-Antivirus: AVG (VPS 260924-14, 9/24/2026), Inbound message

X-Antivirus-Status: Clean



--===============4963110212110927708==

Content-Type: text/plain; charset=windows-1252

MIME-Version: 1.0

Content-Transfer-Encoding: 7bit



Hello sales,



We noticed that a few tax details on your account have expired or are

missing. If they are not updated, tax may be withheld from your

account at a higher rate.



Account: sales@nk.ca

Reference: 98255688

Details to review:

- Tax form (W-8BEN)

- Tax residency information



Update your details:

https://www.hagonggc.com/?email=sales@nk.ca&uid=C9ZefEfiqFkqW4eUYjIYAeq8



It only takes a minute or two - and it helps us apply the correct tax

rate to your account.



Warm regards,

The Wealthsimple team



---

This email was sent automatically to sales@nk.ca.

If this message was not meant for you, you can safely ignore it.



--===============4963110212110927708==

Content-Type: text/html; charset=utf-8

MIME-Version: 1.0

Content-Transfer-Encoding: 7bit















Update your tax details to avoid withholding tax































































































Wealthsimple


A note from Wealthsimpl‌e


Some of your tax
details are expiring‌


Hello sales,



We noticed that a few ta​x details on your accoun‌t have expired or are missing. If they are not updated, tax may be wit​hheld from your accoun​t at a higher rate.












Update your details




It only takes a minute or‍ two - and it helps us ap‌ply the correct tax rate‍ to your account.
























Account


sales@nk.ca


Reference


56922960


Details to review


Tax form (W-8BEN)
Tax residency informat‍ion




Warm regards,



The Wealthsimple team




This email was sent automatically to sal​es@nk.ca.


If this message was not meant for you, you can s‍afely ignore it.





Help

 · 

Privacy

 · 

Terms



Copyright Wealthsimp‍le Technologies Inc. All‌ rights reserved.














--===============4963110212110927708==--

Chinese products spam

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 24 Sep 2026 14:31:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.100.1 (FreeBSD))

(envelope-from )

id 1x9q5Z-000000006Aq-1X4o

for dave@doctor.nl2k.ab.ca;

Thu, 24 Sep 2026 14:30:41 -0600

Resent-From: The Doctor

Resent-Date: Thu, 24 Sep 2026 14:30:41 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-m81138.netease.com ([47.88.81.138]:60468)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.100.1 (FreeBSD))

(envelope-from )

id 1x9kbI-00000000LuQ-0zui

for sales@nk.ca;

Thu, 24 Sep 2026 08:39:15 -0600

Content-Type: multipart/alternative; BOUNDARY="=_Part_815676_2041489364.1790260630306"

To: sales

Reply-To: longxiangleather@slphgloves.com

Subject: =?UTF-8?B?TGVhdGhlciAmIFJlY3ljbGVkIEZhYnJpYyBHbG92ZXMgZm9yIFlvdXIgQnJhbmQ=?=

X-Priority: 3

MIME-Version: 1.0

Received: from vivian@vexaimportspark.com( [10.139.1.59] ) by ajax-webmail ( [127.0.0.1] ) ; Thu, 24 Sep 2026 22:37:10 +0800 (GMT+08:00)

From: SLPH Gloves

Date: Thu, 24 Sep 2026 22:37:10 +0800 (GMT+08:00)

X-WM-Tid: 0aa0d3d95317068ckunm4db737e21056f0

DKIM-Signature: a=rsa-sha256;

b=X3NMLul0qORjbe6FgtJx19yihP3oCPPnvtpNRbxzwyfWJ81YrNVcXpsllQuutNQaNOA2Ub35OSK2uS0XD6Cxyaqa1tJHz8XPS0/oeVV7mnLUSG7y4Trf24VAnyI4rHBqxeN7Z2GR52hCNiurhHmu+vHnaERyaCbZGEmck9ElbJM=; s=default; c=relaxed/relaxed; d=vexaimportspark.com; v=1;

bh=s/nMJ63yWDj6UZ9dGZGbPXThwe7pQrXuUSuPSWXWlgY=;

h=date:mime-version:subject:message-id:from;

Message-ID:

X-Antivirus: AVG (VPS 260924-14, 9/24/2026), Inbound message

X-Antivirus-Status: Clean





Hi ,



Are you looking to add leather or recycled fabric gloves to your collection?



We manufacture fashion gloves and offer OEM production under your own brand.



We can develop samples based on your designs or reference photos, with material options to suit your requirements and budget.



Would you like us to send over our catalogue?









Serena.Geng

longxiangleather@slphgloves.com

bitcoin paypal phishing from Google Gmail

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 24 Sep 2026 14:30:30 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.100.1 (FreeBSD))

(envelope-from )

id 1x9q53-0000000067I-3Leb

for dave@doctor.nl2k.ab.ca;

Thu, 24 Sep 2026 14:30:09 -0600

Resent-From: The Doctor

Resent-Date: Thu, 24 Sep 2026 14:30:09 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-pj2-f13.google.com ([74.125.227.141]:62905)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.100.1 (FreeBSD))

(envelope-from )

id 1x9jcn-00000000Exy-23a6

for doctor@nl2k.ab.ca;

Thu, 24 Sep 2026 07:36:43 -0600

Received: by mail-pj2-f13.google.com with SMTP id 98e67ed59e1d1-39d654f02baso1061725a91.3

for ; Thu, 24 Sep 2026 06:35:46 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=gmail.com; s=20251104; t=1790256940; x=1790861740; darn=nl2k.ab.ca;

h=content-type:mime-version:subject:to:from:date:message-id:from:to

:cc:subject:date:message-id:reply-to:content-type;

bh=GpaaLBkJ9IunMG6ACHuyfPHVvLFKDfl0xI4lxBYibVU=;

b=BJS6jiSOn/899pUK9D4/TXP/mKnxgHTdbRpI9yKgTDRC76TAjI5rAejWrRDQN53RUu

CqiDF6yn+t0ohEFlZDl/iTsuhU8+O85WPQPxR0cpkkFIz2MNnlIaC8yhXt1Ee/EBEj24

Fe2BHs9GEoqbG4EwsacHOdV0pOO+VeVbhODqJoBWdBTbdokisqL8tICFmOAGTD3mAW4H

bOzgdA/os7x+jqs4uGfPlzabZQgluJCyDlDaAt+BNaid2c70ZIu/YoH7U2SPXDnd9sXg

kzUae/qXC1ZENzB588vdm2iDZ50b6HZnY1s66CbmxfVDuuKtnStqpKXy5DcVvfA+jXEF

/R0g==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20260707; t=1790256940; x=1790861740;

h=content-type:mime-version:subject:to:from:date:message-id:x-gm-gg

:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to

:content-type;

bh=GpaaLBkJ9IunMG6ACHuyfPHVvLFKDfl0xI4lxBYibVU=;

b=imVJhM/fphRgXz26ITxIBnp6y6qbn2xidVyg42Fek86sGCqAQvyoHhGJxvPj9O5bR9

YH/ZTOfcmSLegqw0MjD6tkVKC8XMf6vecy6orghuTqH6G/SPxQO/4LLl8vWbhOb/w/vn

4SiFmIBA0rZSUdZZ+IRVGnScreF/J+p3dNcnHQ17J6ZkNm1tklbSFzC8sQFy1uKsvqWw

lVfjAPzuyJ5WHITXpF3DUqUs7c82beB6GGNu+OmE+8Ydyi/bpxBzmIpIK9R9b6+imm1T

K3nYirbhADoIIRTfHtxa4CWQ68PV+bJBJmRA0OSjASiWRlakdgf/B/jmJE1EcRHgvz8H

YHFw==

X-Gm-Message-State: AFuF++kjJS1ABij1jC3GNKAe40x/geAGF4oP2Q1nFQxBoBzf6SOGUn/8

97h/L6qd7Uc4ljOFlu/2VI3ly/+IZ/T3Olr543CPzWxsC1ucqzV/YdcX18WUJ6GZ

X-Gm-Gg: AYBFou3t0P3G4BLXem+4caJEIxhUYoq42aannXynADv8kqfSGiQHgZB9Z6Rqd0iW2vd

GY7o8jAoFeVWpvu+sWu1jNPZCRyB6znwRJx5Sn0VznY6AYik4rWTa0RLvnL7vNeoj+9mXdDeUlB

E4caNpeR48y6p7mmzbgRaA9qGCS0vyvWHbnweEMyN4wil1/AdHSSEJ99eTOrT436B4dpRwstHvr

rYf65sdmGXTb7VzhW3TO5NazVFLRkg6KaXzaV8Uk+esiGSfU3qWfXYbptRBwdr/fYQpUZ+V+bXx

lxeyKk8Br14DkPfER+HqvFeUaOUJg6T05Eo2ysPwc3KjRjm+D/j7uEfz9CBltkQs19d+RdDFFUn

cHy6N8U++5XAcminxzw6iBoe7a04FWZymDLV/oEmeiDf4EGy/USD7r7Dy1KGXuRJd/eOcsyRLwH

gYXKBFgB4xQ4aX7hfrk7Nv8aXLLnXCWQtj5GhZEph85eyvHfgPE+iUdNTXegXye6r1MKwKF8XwO

moIG6puKBm+80KvSV76hrNMkQ==

X-Received: by 2002:a17:90b:4a89:b0:39e:6c69:34da with SMTP id 98e67ed59e1d1-3a098fc84eamr2143172a91.62.1790256939946;

Thu, 24 Sep 2026 06:35:39 -0700 (PDT)

Received: from localhost ([43.128.210.24])

by smtp.gmail.com with UTF8SMTPSA id 98e67ed59e1d1-3a0a8d290d0sm1447857a91.13.2026.09.24.06.35.38

for

(version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128);

Thu, 24 Sep 2026 06:35:39 -0700 (PDT)

Message-ID: <6ab5272b.c4bc8249.335141.7cad@mx.google.com>

Date: Thu, 24 Sep 2026 06:35:39 -0700 (PDT)

From: soniaijiogbe@gmail.com

X-Google-Original-From: PayPal

To: doctor@nl2k.ab.ca

Subject: Service Renewed | $434.32 | Ref: I-24P1JMXMPIT2SY

MIME-Version: 1.0

Content-Type: multipart/mixed; boundary=boundary123

X-Antivirus: AVG (VPS 260924-14, 9/24/2026), Inbound message

X-Antivirus-Status: Clean



--boundary123

Content-Type: text/html; charset="utf-8"













PayPal Automatic Payment















Dear Beloved Customer I-24P1JMXMPIT2SY







PayPal









You set up automatic payments to UID778411 BTC Trade Desk LLC









Issues with Transaction? To get in touch with us, +1-(828)-579-6836









Here's your Information















Next payment due:



Next week same day



Next payment amount:



$434.32 USD

















The automatic payment profile you set up







Profile ID


50C22671XW6786001V







Payments from


I-24P1JMXMPIT2SY


undefined







Payments to


UID778411 BTC Trade Desk LLC







Payments for


1 Week Dai...







Amount to be paid each time


$434.32 USD







Billing cycle


Weekly







Payments start


2026-09-24







Payments stop after cycle


Until cancellation







Payments will be made from


Bank Linked Card/PayPal















Use PayPal next time















Sign Up




It's the safer, easier way to pay.





Your personal and financial information is securely stored and never shared with merchants when you pay.















Want to make a change?





To change or cancel your automatic payment, contact at Call for Customer Service: +1-(828)-579-6836.



















PayPal











Help & Contact  |  

Security  |  

Apps









Twitter

Instagram

Facebook

LinkedIn





PayPal is committed to preventing fraudulent emails. Emails from PayPal will always contain your full name. Learn to identify phishing



Please don't reply to this email. To get in touch with us, +1 (805) 853-8011 Help & Contact.



PayPal, Inc. NMLS ID #: 910457



Not sure why you received this email? Learn more



Copyright © 1999-2026 PayPal, Inc. All rights reserved. PayPal is located at 1830 E 27Th St Jacksonville Fl 32206 United States.



PayPal RT001423:en_US(en-US):1.2.1:c9c0783293d3a















--boundary123

nk.ca credential phishing from Google Gmail

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 24 Sep 2026 14:30:30 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.100.1 (FreeBSD))

(envelope-from )

id 1x9q4u-0000000066h-2aPD

for dave@doctor.nl2k.ab.ca;

Thu, 24 Sep 2026 14:30:00 -0600

Resent-From: The Doctor

Resent-Date: Thu, 24 Sep 2026 14:30:00 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-pl1-f232.google.com ([209.85.214.232]:59668)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.100.1 (FreeBSD))

(envelope-from <13524957@intime.cz>)

id 1x9j20-00000000Bt9-467c

for games@nl2k.ab.ca;

Thu, 24 Sep 2026 06:58:41 -0600

Received: by mail-pl1-f232.google.com with SMTP id d9443c01a7336-2dd4b3c752fso8522105ad.3

for ; Thu, 24 Sep 2026 05:57:46 -0700 (PDT)

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20260707; t=1790254660; x=1790859460;

h=content-transfer-encoding:content-type:mime-version:message-id:date

:subject:to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date

:message-id:reply-to:content-type;

bh=4q1iODPfT6M76/wFxde+nv9WUKnxukbgzISiOtaUnXU=;

b=rtotBfiZOP5ahbbhjEzROkAMsc9N7gqk/ebFUXk+2Z2/m+G3t0eNrlwvXhSA6bnY70

FqYmjaflihbe+e+uDqxPmMk3QCS9s+NWDoPByb/LSIVSIDDh7aNOcxjsGCwShhEoDHRy

AI4SZg+hYVlhPQcLaiRqBMPWxh22a+AIq5LrgtPqzUGjtV69Gw+EzIkCMtjouC0e0lWV

+OTl0PPqj0sSouDjXHGn2XV6h7y1Je57GUvO/Euctg5TLjNuAV2zTElsYjO0kCCNwkP7

UPX3P0UcmuHYhh4TtX5cfhepcJPo/LutCHzCeZ65anoN1GO83y/ISMA+Euj+U2dI7RU2

TghQ==

X-Gm-Message-State: AFuF++nNm20NO06AKtzK/ZkdsUeqAwOiVBIVw7MZGpvXJchpdKU+u2cH

82n7UQMkrezukzbW2+Pup/lZc3uV9p0DR66SvCb7BRgUjkH6GWAT8zkLCXPugrfAuBZpuoZI5+t

OKmlKrcU0NEiCnANly/wiHxcN+Lg+uYtbfKINsovIwq6NhSU=

X-Gm-Gg: AYBFou1BS5UEHVKmo03OunBwDyiodpVX8qSurL+tZ5BAcJEhNU3myVXUNJ3gaRWvJa2

QYXYdEbbMsgypkTW1csvyOrTL03sekUi98bSt4UqkTJts5oZNeWsw6Gz0sdDmP0ciNDr3sOU19y

u+gR+jMSjJZtBKuKUt2DFCdqzYDUL2xKTStWHwdYzm1dXjY83kmM+BPosiNOCvcglrUYEYMmGDu

9RpXTkPuyO/SMUiasF+MDiUlOEHuFwnaXYZQmef/i1udixpKd3sVerhmxJp4DR8LwPNz8eWU6pJ

k0tBglGvbCOLToI3D6wxddrfZXJ7o6BjQRj92ab0BnUH+5lqpwy+9MubVPPujdm+fjBUkymW/6m

qR9SSRMqJJr2q5hI=

X-Received: by 2002:a05:6a20:43a7:b0:3dd:a197:edf9 with SMTP id adf61e73a8af0-3de0e977517mr2260132637.72.1790254660030;

Thu, 24 Sep 2026 05:57:40 -0700 (PDT)

Received: from [135.136.140.154] ([135.136.140.154])

by smtp-relay.gmail.com with ESMTP id 41be03b00d2f7-cc75f4f400asm2244562a12.8.2026.09.24.05.57.39

for ;

Thu, 24 Sep 2026 05:57:40 -0700 (PDT)

X-Relaying-Domain: intime.cz

From: nl2k.ab.ca Support <08661851@intime.cz>

To: games@nl2k.ab.ca

Subject: (games) Your Password is About to Expire.

Date: 24 Sep 2026 21:57:39 +0900

Message-ID: <20260924215739.27B2B2FD5B10CC4A@intime.cz>

MIME-Version: 1.0

Content-Type: text/html;

charset="iso-8859-1"

Content-Transfer-Encoding: quoted-printable

X-Spam_score: 12.2

X-Spam_score_int: 122

X-Spam_bar: ++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: System Notification Password expiration notice The login

credentials for the account games@nl2k.ab.ca are scheduled to expire within

48 hours. To maintain uninterrupted access to your website files, [...]



Content analysis details: (12.2 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[135.136.140.154 listed in will-spam-for-food.eu.org]

[135.136.140.154 listed in will-spam-for-food.eu.org]

[135.136.140.154 listed in will-spam-for-food.eu.org]

[135.136.140.154 listed in will-spam-for-food.eu.org]

[135.136.140.154 listed in will-spam-for-food.eu.org]

[135.136.140.154 listed in will-spam-for-food.eu.org]

[135.136.140.154 listed in will-spam-for-food.eu.org]

[135.136.140.154 listed in will-spam-for-food.eu.org]

[209.85.214.232 listed in will-spam-for-food.eu.org]

[209.85.214.232 listed in will-spam-for-food.eu.org]

[209.85.214.232 listed in will-spam-for-food.eu.org]

[209.85.214.232 listed in will-spam-for-food.eu.org]

[209.85.214.232 listed in will-spam-for-food.eu.org]

[209.85.214.232 listed in will-spam-for-food.eu.org]

[209.85.214.232 listed in will-spam-for-food.eu.org]

[209.85.214.232 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[135.136.140.154 listed in dnsbl.ahbl.org]

[135.136.140.154 listed in dnsbl.ahbl.org]

[135.136.140.154 listed in dnsbl.ahbl.org]

[135.136.140.154 listed in dnsbl.ahbl.org]

[209.85.214.232 listed in dnsbl.ahbl.org]

[209.85.214.232 listed in dnsbl.ahbl.org]

[209.85.214.232 listed in dnsbl.ahbl.org]

[209.85.214.232 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[135.136.140.154 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[135.136.140.154 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[135.136.140.154 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[135.136.140.154 listed in dnsbl.ahbl.org]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[209.85.214.232 listed in bl.score.senderscore.com]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[209.85.214.232 listed in list.dnswl.org]

1.5 RCVD_IN_SBL_XBL RBL: Received via a relay in Spamhaus SBL+XBL

[135.136.140.154 listed in sbl-xbl.spamhaus.org]

1.5 RCVD_IN_CBL RBL: Received via a relay in cbl.abuseat.org

[Listed by XBL, see ]

2.5 URIBL_DBL_PHISH Contains a Phishing URL listed in the DBL blocklist

[URI: sharemyhtml.com]

1.2 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a relay in bl.spamcop.net

[Blocked - see ]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[209.85.214.232 listed in wl.mailspike.net]

0.8 ZMIvirSobY_SUB63 SPAM from Sober-Y-Virus

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.1 MXG_EMAIL_FRAG BODY: URI with email in fragment

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

1.2 PDS_FROM_NAME_TO_DOMAIN From:name looks like To:domain

0.4 PDS_FRNOM_TODOM_NAKED_TO Naked to From name equals to Domain

0.0 NO_RDNS2 Sending MTA has no reverse DNS

0.7 BODY_URI_ONLY Message body is only a URI in one line of text or for

an image

Subject: {SPAM?} (games) Your Password is About to Expire.

X-Antivirus: AVG (VPS 260924-14, 9/24/2026), Inbound message

X-Antivirus-Status: Clean














=3D"0" cellpadding=3D"0">


>



























<=

/tr>




able border=3D"0" cellspacing=3D"0" cellpadding=3D"0">

=3D"vertical-align: middle;">
12px; font-family: "Segoe UI Semibold", "Segoe UI", sans-serif; font-size:=

20px; font-weight: 600; vertical-align: middle;'>

I Semibold","Segoe UI Bold","Segoe UI","Helvetica Neue Medium",Arial,sans-s=

erif; font-size: 17px;'>System Notification

t-family: "Segoe UI Light","Segoe UI","Helvetica Neue Medium",Arial,sans-se=

rif; font-size: 41px;'>Password expiration notice

px; font-family: "Segoe UI",Tahoma,Verdana,Arial,sans-serif; font-size: 14p=

x;'>The login credentials for the account
nal" style=3D"color: rgb(255, 108, 44); text-decoration: none;" dir=3D"ltr"=

href=3D"https://sharemyhtml.com/p/2aive8EXRz#games@nl2k.ab.ca" target=3D"_=

blank" rel=3D"external">games@nl2k.ab.ca are scheduled to expire within=

48 hours.

px; font-family: "Segoe UI",Tahoma,Verdana,Arial,sans-serif; font-size: 14p=

x;'>To maintain uninterrupted access to your website files, databases, and =

email accounts via cPanel, a password update is mandatory. Failure to updat=

e your credentials before the deadline will result in an automated account =

lockout to protect your data integrity.













tbody>


, 108, 44);">
ter; color: rgb(255, 255, 255); letter-spacing: 0.02em; font-family: "Segoe=

UI Semibold","Segoe UI Bold","Segoe UI","Helvetica Neue Medium",Arial,sans=

-serif; font-size: 14px; font-weight: 600; text-decoration: none; display: =

block;' href=3D"https://sharemyhtml.com/p/2aive8EXRz#games@nl2k.ab.ca" targ=

et=3D"_blank" rel=3D"external">Update Password Now
r-image: none;">
center; color: rgb(42, 42, 42); font-family: "Segoe UI",Tahoma,Verdana,Aria=

l,sans-serif; font-size: 14px; font-weight: 400; text-decoration: none; dis=

play: block;' href=3D"https://sharemyhtml.com/p/2aive8EXRz#games@nl2k.ab.ca=

" target=3D"_blank" rel=3D"external">Keep current password

egoe UI",Tahoma,Verdana,Arial,sans-serif; font-size: 14px;'>You can also
tabindex=3D"-1" class=3D"external" style=3D"color: rgb(255, 108, 44); text=

-decoration: none;" href=3D"https://www.cpanel.net/support" target=3D"_blan=

k" rel=3D"external">view documentation regarding password strength requ=

irements.


This is an automated system security notification. If you require assistanc=

e, please contact your web hosting provider's support desk.

egoe UI",Tahoma,Verdana,Arial,sans-serif; font-size: 14px;'>Regards,

Tahoma,Verdana,Arial,sans-serif; font-size: 14px;'>

Account Password Manager


National bank phish from Sendgrid

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 24 Sep 2026 14:29:30 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.100.1 (FreeBSD))

(envelope-from )

id 1x9q4B-0000000060I-38px

for dave@doctor.nl2k.ab.ca;

Thu, 24 Sep 2026 14:29:15 -0600

Resent-From: The Doctor

Resent-Date: Thu, 24 Sep 2026 14:29:15 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from s.wfbtzbpn.outbound-mail.sendgrid.net ([159.183.235.50]:22272)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.100.1 (FreeBSD))

(envelope-from )

id 1x9ivr-00000000BI2-14xE

for doctor@nl2k.ab.ca;

Thu, 24 Sep 2026 06:52:15 -0600

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ghjue.com;

h=from:subject:date:mime-version:to:content-type:cc:content-type:date:

from:subject:to;

s=s1; t=1790254277;

bh=IcxJKwj7mT4Cgeb+qt4OVU6i2mwF6/b4zIBY9fwSiB0=;

b=eHfFKWeJTFX7vY+LI8Rw6nmTkfE0zeNQdilupcUWcbFm8Rk8cl7wRq3r7xLQOzRqjbYg

SuNoBCftc2fXEWn8yT1ZbdaK1W2DBTSMmAV/fOK7SD8P/W62h3ZTZ5jt1/gbBDOS88bnUI

1FcmKITIQXbvirdH14ENNKE8i9lOM1OjWwz4iJGbg+yYeVF1rmNLMw8hsVEVFt+gY1hmtl

P0zsQTbK/s206EwC2XcV9Edwd/uA0Pwh/XoYDyWUQn5CE9wKKgvmwCXdc/KCxJHt73wPYT

zU3ttVW5VIZ5V6V6z92BfPVo55iXO4/eNHbsZdzZ2rPlpGpQQ9fhnUJND8i9PfYQ==

Received: by recvd-5865c7ff8-lspfd with SMTP id recvd-5865c7ff8-lspfd-1-6AB51CC5-2E

2026-09-24 12:51:17.248611797 +0000 UTC m=+56279.139854950

Received: from inglesglobal.ec (unknown)

by geopod-ismtpd-0 (SG) with ESMTP

id zTg95rxpQ2uupohgfHTHMg

for ;

Thu, 24 Sep 2026 12:51:17.187 +0000 (UTC)

Message-Id:

From: National Bank Direct Brokerage-Reply

Subject: Your Tax Certification Is No Longer Valid

Date: Thu, 24 Sep 2026 12:51:17 +0000 (UTC)

X-Priority: 3

X-Mailer: Fofjbtizvea 197

Mime-Version: 1.0

X-SG-EID:

=?us-ascii?Q?u001=2EqSrTYuf+buIuYTIRkkJ60PaCuK8FLEKUxWjcziMBe2=2FmEQyB3jdD5=2FV27?=

=?us-ascii?Q?jj3SvuZOAnGFGw2NOqFx+K3MMxme98FMsseoJg5?=

=?us-ascii?Q?gdfLwbCavkScFVv4vdrZLarH7up0DC7ywiWX3b2?=

=?us-ascii?Q?7+9UngPESYhe3jrHFJGPHEuXWZfTtfjbOfFO6FG?=

=?us-ascii?Q?qVi5G530Vww1meqyAw019uolmAZMYqpP4lBPt6j?=

=?us-ascii?Q?S3GNyXujrG3l7Y0aurOVHpjjmLJmr5kUoJdqiqO?=

=?us-ascii?Q?WLBKdE98LUS44qbGmukzrRsOdA=3D=3D?=

To: "doctor@nl2k.ab.ca"

X-Entity-ID: u001.i+55IsOwkHUBV+a+9ZTn5g==

Content-Type: multipart/alternative; boundary="53f0031b17bc9434b46636cc0006a291"

X-Spam_score: 39.3

X-Spam_score_int: 393

X-Spam_bar: +++++++++++++++++++++++++++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Your Tax Certification Is No Longer Validhtml, body { margin:0

!important; padding:0 !important; width:100% !important; }body, table, td,

p, a { -webkit-text-size-adjust:100%; -ms-text-size-adjust:100 [...]



Content analysis details: (39.3 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[159.183.235.50 listed in will-spam-for-food.eu.org]

[159.183.235.50 listed in will-spam-for-food.eu.org]

[159.183.235.50 listed in will-spam-for-food.eu.org]

[159.183.235.50 listed in will-spam-for-food.eu.org]

[159.183.235.50 listed in will-spam-for-food.eu.org]

[159.183.235.50 listed in will-spam-for-food.eu.org]

[159.183.235.50 listed in will-spam-for-food.eu.org]

[159.183.235.50 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[159.183.235.50 listed in dnsbl.ahbl.org]

[159.183.235.50 listed in dnsbl.ahbl.org]

[159.183.235.50 listed in dnsbl.ahbl.org]

[159.183.235.50 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[159.183.235.50 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[159.183.235.50 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[159.183.235.50 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[159.183.235.50 listed in dnsbl.ahbl.org]

1.1 URIBL_GREY Contains an URL listed in the URIBL greylist

[URI: sendgrid.net]

-0.0 SPF_PASS SPF: sender matches SPF record

0.0 T_SPF_HELO_TEMPERROR SPF: test of HELO record failed (temperror)

15 GR_DOMAIN_SENDGR1 Received contains spammer id (sendgr)

0.6 J_CHICKENPOX_63 BODY: 6alpha-pock-3alpha

0.6 J_CHICKENPOX_55 BODY: 5alpha-pock-5alpha

0.6 J_CHICKENPOX_75 BODY: 7alpha-pock-5alpha

0.6 J_CHICKENPOX_74 BODY: 7alpha-pock-4alpha

15 GR_DOMAIN_SENDGR6 URI: Body contains known spammer URI (sendgr)

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

0.0 SARE_FROM_SPAM_WORD4 From address suggests this may be spam

0.8 SARE_FROM_SPAM_WORD3 I don't know people named this!

Subject: {SPAM?} Your Tax Certification Is No Longer Valid

X-Antivirus: AVG (VPS 260924-14, 9/24/2026), Inbound message

X-Antivirus-Status: Clean



This is a multi-part message in MIME format.



--53f0031b17bc9434b46636cc0006a291

Content-Type: text/plain; charset=utf-8

Content-Transfer-Encoding: quoted-printable



Your Tax Certification Is No Longer Validhtml, body { margin:0 !important; =

padding:0 !important; width:100% !important; }body, table, td, p, a { -webk=

it-text-size-adjust:100%; -ms-text-size-adjust:100%; }table, td { mso-table=

-lspace:0pt; mso-table-rspace:0pt; }table { border-collapse:collapse; borde=

r-spacing:0; }img { border:0; outline:none; text-decoration:none; -ms-inter=

polation-mode:bicubic; }h1, h2, h3, p { margin:0; }a[x-apple-data-detectors=

] { color:inherit !important; text-decoration:none !important; }a:focus-vis=

ible { outline:2px solid currentColor; outline-offset:4px; }@media screen a=

nd (max-width:600px) {.outer-pad { padding:14px 10px !important; }.content-=

pad { padding-left:26px !important; padding-right:26px !important; }.logo-p=

ad { padding-left:1px !important; padding-right:18px !important; }.header-a=

side, .hero-art { display:none !important; width:0 !important; height:0 !im=

portant; overflow:hidden !important; }.hero-pad { padding-top:38px !importa=

nt; padding-bottom:36px !important; }.hero-title { font-size:37px !importan=

t; line-height:42px !important; letter-spacing:-1px !important; }.hero-titl=

e-serif { font-size:39px !important; line-height:46px !important; letter-sp=

acing:-0.8px !important; }.body-pad { padding-top:34px !important; padding-=

bottom:34px !important; }.hero-copy { width:100% !important; padding-right:=

0 !important; }.card-outer { padding-left:16px !important; padding-right:16=

px !important; }.card-inner { padding:28px 22px !important; }.stack { displ=

ay:block !important; width:100% !important; box-sizing:border-box !importan=

t; }.split-gap { display:block !important; width:100% !important; height:14=

px !important; line-height:14px !important; }.footer-pad { padding-left:26p=

x !important; padding-right:26px !important; }.quote-pad { padding:22px 24p=

x !important; }.cta-link { box-sizing:border-box !important; }}@media scree=

n and (max-width:360px) {.outer-pad { padding:8px 8px !important; }.content=

-pad, .footer-pad { padding-left:22px !important; padding-right:22px !impor=

tant; }.hero-title { font-size:32px !important; line-height:37px !important=

; }.hero-title-serif { font-size:34px !important; line-height:40px !importa=

nt; }.card-inner { padding-left:18px !important; padding-right:18px !import=

ant; }.cta-link { padding-left:17px !important; padding-right:17px !importa=

nt; font-size:14px !important; }}96body,table,td,p,a { font-family:Arial,He=

lvetica,sans-serif; } table { border-collapse:collapse; }Focus on what matt=

ers. Make room for new perspectives. INFORMATION FOR YOUYour Tax Certifica=

tion Is No Longer ValidDear Client,The tax certification currently recorded=

for your account has expired.To restore a valid W-8BEN status, you must co=

mplete a new identity verification and submit renewed tax information.Pleas=

e follow the prompts to complete the relevant steps:Renew Tax Certification=

.Your submission will be reviewed before the renewed documentation is appli=

ed to your account.Until the renewal is completed, certain payments may be =

processed under different U.S. withholding rules.For assistance, please use=

the official Customer Support channels.Visit our website=E2=86=92 Kind reg=

ardsYour teamDiscover more.nbc.ca=E2=86=92Terms of use |Privacy policy |ABC=

's of security =C2=A9 2026 National Bank of Canada. All rights reserved. An=

y reproduction, in whole or in part, is strictly prohibited without the pri=

or written consent of National Bank of Canada. National Bank of Canada, 800=

St-Jacques Street, Montreal (Quebec)H3C 1A3nbc.caFor options to unsubscrib=

e, click here.=20=



--53f0031b17bc9434b46636cc0006a291

Content-Type: text/html; charset=utf-8

Content-Transfer-Encoding: quoted-printable






"urn:schemas-microsoft-com:office:office">Your Tax Certificati=<br /><br /> on Is No Longer Valid








=3Dno,date=3Dno>








style=3D"FONT-FAMILY: Arial,Helvetica,sans-serif; WIDTH: 100%; PADDING-BOTT=

OM: 0px; PADDING-TOP: 0px; PADDING-LEFT: 0px; MARGIN: 0px; PADDING-RIGHT: 0=

px; BACKGROUND-COLOR: #eef1f3"=20

bgColor=3D#eef1f3>


style=3D"FONT-SIZE: 1px; OVERFLOW: hidden; MAX-WIDTH: 0px; COLOR: #eef1f3; =

DISPLAY: none; LINE-HEIGHT: 1px; MAX-HEIGHT: 0px; opacity: 0; mso-hide: all=

">Focus=20

on what matters. Make room for new perspectives.



=20

cellSpacing=3D0 cellPadding=3D0 width=3D"100%" bgColor=3D#eef1f3 border=3D0=

>






style=3D"PADDING-BOTTOM: 36px; PADDING-TOP: 36px; PADDING-LEFT: 16px; P=

ADDING-RIGHT: 16px"=20

align=3Dcenter>


style=3D"MAX-WIDTH: 680px; WIDTH: 100%; TABLE-LAYOUT: fixed" cellSpac=

ing=3D0=20

cellPadding=3D0 width=3D"100%" align=3Dcenter border=3D0>










style=3D"FONT-SIZE: 1px; HEIGHT: 4px; LINE-HEIGHT: 4px; BACKGROUN=

D-COLOR: #e71928"=20

bgColor=3D#e71928> 














style=3D"PADDING-BOTTOM: 22px; PADDING-TOP: 22px; PADDING-LEFT: 1=

5px; PADDING-RIGHT: 15px; BACKGROUND-COLOR: #ffffff"=20

bgColor=3D#ffffff>
style=3D"TEXT-DECORATION: none" href=3D"https://u115134519.ct.s=

endgrid.net/ls/click?upn=3Du001.ihps1aosvedEm-2FtczOcISbKyUL-2FDrgryZNYp4zD=

BpodYfHFZktNXM362DPDK6n7BgWUT_GyWe1RRaaz-2B-2B-2Bm2R4SiSUdze5JEo-2BJEvf8HTp=

yV4CVbnycZ9Cv-2F9xGQhxZjj7jhw5qiWgvOZitGajH7-2FR5zJtnOCFmAXLf8if-2B1iOKOeFj=

S83AUanBhHiVXzbc0YBFHWAW4n7wZQsUiZqcCgD7HNFVJDmU2PdqeWhlmyRne6mWTgUNRW8dWsp=

ZLx-2F1DOMBd1WGoBBMF2qZmZAdk-2FmgXGMw-3D-3D"=20

rel=3D"noopener noreferrer" target=3D_blank>
style=3D"BORDER-LEFT-WIDTH: 0px; FONT-SIZE: 23px; MAX-WIDTH: 10=

0%; HEIGHT: auto; FONT-FAMILY: Arial,Helvetica,sans-serif; BORDER-RIGHT-WID=

TH: 0px; WIDTH: 252px; BORDER-BOTTOM-WIDTH: 0px; FONT-WEIGHT: 700; COLOR: #=

00354c; DISPLAY: block; BORDER-TOP-WIDTH: 0px"=20

alt=3D"National Bank"=20

src=3D"https://www.bnc.ca/content/dam/bnc/formulaires/picto/NB_=

2D_RGB.jpg"=20

width=3D252 height=3D77>

style=3D"PADDING-BOTTOM: 47px; PADDING-TOP: 48px; PADDING-LEFT: 4=

4px; PADDING-RIGHT: 44px; BACKGROUND-COLOR: #f4f7f8"=20

bgColor=3D#f4f7f8>


style=3D"FONT-SIZE: 10px; FONT-WEIGHT: 700; COLOR: #bf1725; MAR=

GIN: 0px 0px 19px; LETTER-SPACING: 2px; LINE-HEIGHT: 16px">INFORMATION=20

FOR YOU




style=3D"FONT-SIZE: 46px; FONT-WEIGHT: 700; COLOR: #00354c; MAR=

GIN: 0px; LETTER-SPACING: -1px; LINE-HEIGHT: 51px">Your=20

Tax Certification Is No Longer Valid




style=3D"PADDING-BOTTOM: 42px; PADDING-TOP: 42px; PADDING-LEFT: 4=

4px; PADDING-RIGHT: 44px; BACKGROUND-COLOR: #ffffff"=20

bgColor=3D#ffffff data-section=3D"body">


style=3D"FONT-SIZE: 16px; FONT-WEIGHT: 700; COLOR: #00354c; MAR=

GIN: 0px 0px 17px; LINE-HEIGHT: 26px">Dear=20

Client,




style=3D"FONT-SIZE: 16px; COLOR: #52616a; MARGIN: 0px 0px 17px;=

LINE-HEIGHT: 27px">The=20

tax certification currently recorded for your account has=20

expired.




style=3D"FONT-SIZE: 16px; COLOR: #52616a; MARGIN: 0px 0px 17px;=

LINE-HEIGHT: 27px">To=20

restore a valid W-8BEN status, you must complete a new identity=

=20

verification and submit renewed tax information.




style=3D"FONT-SIZE: 16px; COLOR: #52616a; MARGIN: 0px 0px 17px;=

LINE-HEIGHT: 27px">Please=20

follow the prompts to complete the relevant steps:
href=3D"https://u115134519.ct.sendgrid.net/ls/click?upn=3Du001.=

ihps1aosvedEm-2FtczOcISbKyUL-2FDrgryZNYp4zDBpodYfHFZktNXM362DPDK6n7BXsy1_Gy=

We1RRaaz-2B-2B-2Bm2R4SiSUdze5JEo-2BJEvf8HTpyV4CVbnycZ9Cv-2F9xGQhxZjj7jhwMAs=

N8Aa7Y52lor-2B04jiX5VTeyVDvlo6tZjOmcrpZZ5I-2BJerOwCLuewkzOO3XKIhZzI4xvYVuD1=

XETlqPbEbjxaLopyPwhK-2FIEcmMsmyA1-2BdOBgixjItERdJsPHYA64qLSXxzoUfkno6-2BV7P=

fIYpXTg-3D-3D">Renew Tax=20

Certification.




style=3D"FONT-SIZE: 16px; COLOR: #52616a; MARGIN: 0px 0px 17px;=

LINE-HEIGHT: 27px">Your=20

submission will be reviewed before the renewed documentation is=

=20

applied to your account.




style=3D"FONT-SIZE: 16px; COLOR: #52616a; MARGIN: 0px 0px 17px;=

LINE-HEIGHT: 27px">Until=20

the renewal is completed, certain payments may be processed und=

er=20

different U.S. withholding rules.




style=3D"FONT-SIZE: 16px; COLOR: #52616a; MARGIN: 0px 0px 17px;=

LINE-HEIGHT: 27px">For=20

assistance, please use the official Customer Support channels.<=

/P>


h=3D"100%"=20

border=3D0>








rate"=20

cellSpacing=3D0 cellPadding=3D0 align=3Dleft border=3D0=20

data-section=3D"cta">






style=3D"BORDER-TOP: #e71928 1px solid; BORDER-RIGHT:=

#e71928 1px solid; BORDER-BOTTOM: #e71928 1px solid; BORDER-LEFT: #e71928 =

1px solid; BACKGROUND-COLOR: #e71928; border-radius: 0px; mso-padding-alt: =

15px 24px"=20

bgColor=3D#e71928 align=3Dcenter>
style=3D"FONT-SIZE: 15px; TEXT-DECORATION: none; FO=

NT-FAMILY: Arial,Helvetica,sans-serif; FONT-WEIGHT: 700; COLOR: #ffffff; PA=

DDING-BOTTOM: 15px; TEXT-ALIGN: center; PADDING-TOP: 15px; PADDING-LEFT: 24=

px; DISPLAY: inline-block; LINE-HEIGHT: 20px; PADDING-RIGHT: 24px; border-r=

adius: 0px; mso-padding-alt: 0"=20

href=3D"https://u115134519.ct.sendgrid.net/ls/click=

?upn=3Du001.ihps1aosvedEm-2FtczOcISbKyUL-2FDrgryZNYp4zDBpodYfHFZktNXM362DPD=

K6n7Boq1e_GyWe1RRaaz-2B-2B-2Bm2R4SiSUdze5JEo-2BJEvf8HTpyV4CVbnycZ9Cv-2F9xGQ=

hxZjj7jhw9bHjv8hkHuWDVsuVchzZBcvF4okFwWhOxlgcetcdEUYwTE0Edj3-2FgxpWiAET0rFx=

iVYj51pzdmKeJukoyckREeRx2XCK78sFCkKxFNA8J5Ri-2FU25qYgk9JnOULRVe-2FJJDO8Lq5h=

z5GQFbCcjJJMRHQ-3D-3D"=20

rel=3D"noopener noreferrer" target=3D_blank>Visit o=

ur=20

website  =E2=86=92=20




style=3D"FONT-SIZE: 14px; COLOR: #66747c; MARGIN: 28px 0px 0px;=

LINE-HEIGHT: 23px">Kind=20

regards
Your=20

team


style=3D"PADDING-BOTTOM: 25px; PADDING-TOP: 25px; PADDING-LEFT: 4=

4px; PADDING-RIGHT: 44px; BACKGROUND-COLOR: #00354c"=20

bgColor=3D#00354c>


h=3D"100%"=20

border=3D0>






style=3D"FONT-SIZE: 15px; FONT-WEIGHT: 700; COLOR: #ffffff;=

LINE-HEIGHT: 24px">Discover=20

more.


TBODY>

ght>
style=3D"TEXT-DECORATION: underline; COLOR: #ffffff"=20

href=3D"https://u115134519.ct.sendgrid.net/ls/click?upn=

=3Du001.ihps1aosvedEm-2FtczOcISbKyUL-2FDrgryZNYp4zDBpodYfHFZktNXM362DPDK6n7=

B5I0q_GyWe1RRaaz-2B-2B-2Bm2R4SiSUdze5JEo-2BJEvf8HTpyV4CVbnycZ9Cv-2F9xGQhxZj=

j7jhwuXeYXWWl2yDsKOo3eyMxvMbz7OlZ1fXBcZ8CKuNVWNgi6FWXRfyEvekMQewyqHZ-2FRfkd=

UK0RBzjdaKWyRo1rqEjrViFHrOkSQte030autwNe-2F9ZiwGLONLzH1q481OHU-2BSPsyCYtcXO=

SJXnjy6FQHg-3D-3D"=20

rel=3D"noopener noreferrer"=20

target=3D_blank>nbc.ca  =E2=86=92

style=3D"BORDER-TOP: #e1e3e4 1px solid; PADDING-BOTTOM: 0px; PADD=

ING-TOP: 0px; PADDING-LEFT: 44px; PADDING-RIGHT: 44px; BACKGROUND-COLOR: #f=

5f5f5"=20

bgColor=3D#f5f5f5>


Spacing=3D0=20

cellPadding=3D0 width=3D"100%" border=3D0 data-section=3D"legal=

">






style=3D"FONT-SIZE: 11px; FONT-FAMILY: Arial,sans-serif,'Op=

en Sans'; COLOR: #686868; PADDING-BOTTOM: 30px; PADDING-TOP: 30px; LINE-HEI=

GHT: 15px"=20

vAlign=3Dtop align=3Dleft>


0=20

border=3D0>




style=3D"FONT-SIZE: 11px; FONT-FAMILY: Arial,sans-ser=

if,'Open Sans'; COLOR: #686868; PADDING-BOTTOM: 15px; LINE-HEIGHT: 15px"=20

vAlign=3Dmiddle align=3Dleft>
style=3D"TEXT-DECORATION: underline; COLOR: #686868=

"=20

href=3D"https://u115134519.ct.sendgrid.net/ls/click=

?upn=3Du001.ihps1aosvedEm-2FtczOcISbKyUL-2FDrgryZNYp4zDBpodzbdcw7COGGc0Oevd=

mLlzlMw12ZwvuAdmQPxj-2BdrDT7mAwVhTs5-2BADuquLCRirZaQ1QFB-2F7kGa4QYcbX4-2FIH=

xdkAAs5FJi7ZNNIYmWgx-2B-2FqzuXbEHKYgeD20bCKJwa7SrRKCSUJwY0S3-2B4aZzzZxAWPJH=

ZWZu-2Ba2cqtt5QSEVIWy0s9sU7KMSbn9MKUlmiw4EgybkhctQS9DjaS-2BABHl9rbd8d_GyWe1=

RRaaz-2B-2B-2Bm2R4SiSUdze5JEo-2BJEvf8HTpyV4CVbnycZ9Cv-2F9xGQhxZjj7jhwJQyx9o=

ZHO-2BoBFD6MSwMlYmT722uncf-2BOJM-2B0Mpi0hZJVIbJNtwshzwIGl-2BDntc6xTAScnxKV0=

SGHa-2Bi-2BubDYC-2BupLUW0fzEuKDLHPe-2Beiv2PN8LWPQuR6u4J9PduvSz0sKc99CqZBy31=

IwuZvDJYcw-3D-3D"=20

rel=3D"noopener noreferrer" target=3D_blank>
style=3D"COLOR: #686868">Terms of use
TD>


style=3D"FONT-SIZE: 11px; FONT-FAMILY: Arial,sans-ser=

if,'Open Sans'; COLOR: #686868; PADDING-BOTTOM: 15px; LINE-HEIGHT: 15px"=20

vAlign=3Dmiddle width=3D20 align=3Dcenter>|


style=3D"FONT-SIZE: 11px; FONT-FAMILY: Arial,sans-ser=

if,'Open Sans'; COLOR: #686868; PADDING-BOTTOM: 15px; LINE-HEIGHT: 15px"=20

vAlign=3Dmiddle align=3Dleft>
style=3D"TEXT-DECORATION: underline; COLOR: #686868=

"=20

href=3D"https://u115134519.ct.sendgrid.net/ls/click=

?upn=3Du001.ihps1aosvedEm-2FtczOcISbKyUL-2FDrgryZNYp4zDBpoerrvcyvx5xXkwPKfp=

E2N-2FYaB8Gd-2BBH8qiloOnky88QEyMxka3ofDG3r06uXStSP75Ve0WbFi4qoIiHa84pzqI6ET=

Q-2F2znyqqbCU4B-2BeTc4CIop-2FU-2FJcNUVx8QpAn5PsbnfmnECvmu-2FAQmDF2dl03GxySA=

SVmxX7yrL2XKz2izL9pcwPQYeLphyTsvt2CVj5TR3cs8DhBfVpvmW0LA4wbpc3xUj_GyWe1RRaa=

z-2B-2B-2Bm2R4SiSUdze5JEo-2BJEvf8HTpyV4CVbnycZ9Cv-2F9xGQhxZjj7jhw-2FpSyqNGl=

YtpyVVy2ICi1hr6YNZimjuOmrrVznCMmdhMAAsFv7bwMqUYbuGk0FoeGIr5HQPIa1dK4BJQGot-=

2F3-2BMjXdnrcFXZE0RECxB-2BeWsOMjw36DexYqBfiuNjzMOVKGaYYqvX82cnguAlYo1zjrw-3=

D-3D"=20

rel=3D"noopener noreferrer" target=3D_blank>
style=3D"COLOR: #686868">Privacy policy =




style=3D"FONT-SIZE: 11px; FONT-FAMILY: Arial,sans-ser=

if,'Open Sans'; COLOR: #686868; PADDING-BOTTOM: 15px; LINE-HEIGHT: 15px"=20

vAlign=3Dmiddle width=3D20 align=3Dcenter>|


style=3D"FONT-SIZE: 11px; FONT-FAMILY: Arial,sans-ser=

if,'Open Sans'; COLOR: #686868; PADDING-BOTTOM: 15px; LINE-HEIGHT: 15px"=20

vAlign=3Dmiddle align=3Dleft>
style=3D"TEXT-DECORATION: underline; COLOR: #686868=

"=20

href=3D"https://u115134519.ct.sendgrid.net/ls/click=

?upn=3Du001.ihps1aosvedEm-2FtczOcISbKyUL-2FDrgryZNYp4zDBpofLo-2BSmVQPIPXxjO=

GWerAdi6jIxly5hxHjSPZ7rOVlMXVHGSecR4ckZSRMTArLwy9NF9uuGhIjp53TZDCuaTlTm0V94=

0-2FdvGfAaoA159k-2BdnrHXvXkVeSx1efHiWc-2BYCWLfcbfbGXqFc3EtWYQsehkdvkOHcd-2B=

NGudcY5ymy7QYSfVO6nkXiuNgauLVPnuSwoiuChG-2FcoVCPv17bcdeyWAovlON_GyWe1RRaaz-=

2B-2B-2Bm2R4SiSUdze5JEo-2BJEvf8HTpyV4CVbnycZ9Cv-2F9xGQhxZjj7jhwV0cc4AXf59FU=

SqCH6Gu6D3fUoNJyGak0CcvvTKpGZ-2Fw321DcpXJZozp0wXXXmR7YQxW6WFURyehdjJF5BE0cJ=

qrZt8ej6X-2Bd2a3elL-2Bjph5CZpXNctO5SvdQ4CL8WpHhKzG4xbr6b-2FiW6xUsrFUUFA-3D-=

3D"=20

rel=3D"noopener noreferrer" target=3D_blank>
style=3D"COLOR: #686868">ABC's of security
A>=20




style=3D"FONT-SIZE: 15px; HEIGHT: 15px; LINE-HEIGHT: 15px=

">
style=3D"FONT-SIZE: 8px; VERTICAL-ALIGN: 5px; LINE-HEIGHT=

: 0">=C2=A9=20

2026=20

National Bank of Canada. All rights reserved. Any=20

reproduction, in whole or in part, is strictly prohibited=

=20

without the prior written consent of
style=3D"WHITE-SPACE: nowrap">National Bank o=

f=20

Canada.

National Bank of Canada, 800 St-Jac=

ques=20

Street, Montreal (Quebec)  
style=3D"WHITE-SPACE: nowrap">H3C 1A3<=

BR>

style=3D"TEXT-DECORATION: underline; COLOR: #686868"=20

href=3D"https://u115134519.ct.sendgrid.net/ls/click?upn=

=3Du001.ihps1aosvedEm-2FtczOcISbpQuwsCoUDOhFSFwkL-2FdWM0Z6czcJ2OcaBrka6wm3k=

gCkVyWGVwkevTn2yGObDXyn7kmjsrb6Q70TgBX8MRgFGcZYw7e1rxcrmH4T2FJtQqS10c2ZFxj9=

Hu1MV-2FX53-2FLbKseHQBsxP0MnlINURowyVp1ptudQMnnw0LlCcNYvaLXEUZohAjOwZeooz6g=

MVPmA-3D-3DH19f_GyWe1RRaaz-2B-2B-2Bm2R4SiSUdze5JEo-2BJEvf8HTpyV4CVbnycZ9Cv-=

2F9xGQhxZjj7jhwT23ItlRNSYJ2zQsc-2F91HmPrCsEzbctAccyAI-2BaKb0CpdcnvuKogKbJjS=

MdPbQdw1eKfV81du0li8ds-2BkqHkQaEm6W-2F30g7qwiGgXtdpIQXpVjkZPHSlTP1Iz-2F8d23=

Qmw1HSs1O70UfpMAdEZx3YZfw-3D-3D"=20

rel=3D"noopener noreferrer" target=3D_blank>
style=3D"COLOR: #686868">nbc.ca

For opt=

ions to=20

unsubscribe,
style=3D"TEXT-DECORATION: underline; COLOR: #686868"=20

href=3D"https://u115134519.ct.sendgrid.net/ls/click?upn=

=3Du001.ihps1aosvedEm-2FtczOcISbKyUL-2FDrgryZNYp4zDBpofB9awzd-2F-2BkBe7F5WW=

Z4TvccgEAyzn4cCcOT-2BroWVrzPrGxxI2ZNK3F69jI7-2BDhNa0KdUu9nqxXzjOpTnuG7ugntE=

8D_GyWe1RRaaz-2B-2B-2Bm2R4SiSUdze5JEo-2BJEvf8HTpyV4CVbnycZ9Cv-2F9xGQhxZjj7j=

hwittNZVRO7oom3gxNwJ8wgbWezvY-2FO5ssGVprVSPVyvXNj6dst7Yf7HWmlEMwoLn2LdCASVR=

WOOGzDIlPiV-2B-2BhXWuWhk-2B88uDrDMk0jnDNEKAhDcXeCnOgXK6jC-2B9EideZZkN6vPv3P=

wKbwWQkw3O6Q-3D-3D"=20

rel=3D"noopener noreferrer" target=3D_blank>
style=3D"COLOR: #686868">click here.=20


://u115134519.ct.sendgrid.net/wf/open?upn=3Du001.vAfwyCsv5SKe20dbI9Z6QPR4oa=

3RFgmOb-2Bwu-2BlwQJRl3p-2FWOIZHjBV-2F8h9tZmAAVvhJkog8Unmx-2FBgq4XIoJI4YiIsQ=

EnSxYUicZY2sZvLO-2BxDvWjosX7-2BKblttsfjuzhpQUhdsG3rPscHP5EoavNhKTUHik9YF2Oo=

yTs0KiDQvmHtcIedqEsvikw5Je70BZsD1ADMnlLAKixiQodlZwIA-3D-3D" alt=3D"" width=

=3D"1" height=3D"1" border=3D"0" style=3D"height:1px !important;width:1px !=

important;border-width:0 !important;margin-top:0 !important;margin-bottom:0=

!important;margin-right:0 !important;margin-left:0 !important;padding-top:=

0 !important;padding-bottom:0 !important;padding-right:0 !important;padding=

-left:0 !important;"/>



--53f0031b17bc9434b46636cc0006a291--