Canada REvenue Agency Phish from Barracuda/Amazon

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Wed, 22 Jul 2026 07:39:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wmX9Z-00000000AGK-0ADO

for dave@doctor.nl2k.ab.ca;

Wed, 22 Jul 2026 07:38:29 -0600

Resent-From: The Doctor

Resent-Date: Wed, 22 Jul 2026 07:38:28 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from egress-ip36b.ess.ca.barracuda.com ([15.222.16.245]:53060)

by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

(Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wmWaH-000000002A3-3Cf0

for sales@nk.ca;

Wed, 22 Jul 2026 07:02:10 -0600

Received: from yk-prod-fe2.internal.messaging (s199-85-226-114.nt.northwestel.net [199.85.226.114]) by mx-outbound22-134.ca-central-1b.ess.aws.cudaops.com; Wed, 22 Jul 2026 13:01:07 +0000

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; s=northwestel;

d=northwestel.net;

h=Date:To:From:Subject:Message-Id:MIME-Version:Sender;

bh=Qt06mb5bhEhuWc1vrJR1EoGV0nOwNQwb4FPJjW4PS7M=;

b=xn6+VKc5FsHSXZUSl5HwlLopHxeJRzBjn47QaWjRm1QTCWeiiJZ0ga6uRUs6NfbpAwaPmQPt64Pj

dVLDRymqfYAXCTXfQh1bGIQkWiSbc5ILsCSjbu/x8EXkif3GudGA0QReKUqefA0XhrjJSEdNFtbY

dHp/mvwNBfx29X15+iQ+NAfjbkMyMiBVywGrbjq/qNr4xBX0UbgBathBFvbu07w0dIqB+rb41nX8

LXfZr9i/2MxiS5zwlY+YAhAv1B+fHReWfIQC5Mqctq08drP+4H8+FmW1c3VvpdzytbIQ2g0G6Kmw

4l9eweRQRQGFDm67woNnvMsroIgW+VOm7BUWKg==

MIME-version: 1.0

Content-transfer-encoding: 7BIT

Content-type: text/html

Received: from dkim-sign.northwestel.ca-daemon by

yk-prod-fe2.internal.messaging

(Oracle Communications Messaging Server 8.1.0.28.20251016 64bit (built Oct 16

2025)) id <0TIK1I4005IA6J00@yk-prod-fe2.internal.messaging> for sales@nk.ca;

Tue, 21 Jul 2026 22:01:07 -0600 (MDT)

Received: from [14.192.212.27] ([172.19.112.111])

by yk-prod-fe2.internal.messaging

(Oracle Communications Messaging Server 8.1.0.28.20251016 64bit (built Oct 16

2025)) with ESMTPA id <0TIK1H9SS5TSZD70@yk-prod-fe2.internal.messaging> for

sales@nk.ca; Tue, 21 Jul 2026 22:01:07 -0600 (MDT)

From:

"Canada Revenue Agency / Agence du Revenu du Canada"

To: sales@nk.ca

Subject:

=?UTF-8?B?UGF5bWVudCBBcHByb3ZlZCAtIENhbmFkYSBSZXZlbnVlIEFnZW5jeSAvIFBhaWVtZW50IGFwcHJvdXbDqSAtIEFnZW5jZSBkdSByZXZlbnUgZHUgQ2FuYWRh?=

Date: 21 Jul 2026 23:01:02 -0500

Message-id: <20260721230101.B6B11ED9F646409E@northwestel.net>

X-BESS-ID: 1784725267-405766-7809-82038-1

X-BESS-VER: 2019.1_20260702.2137

X-BESS-Apparent-Source-IP: 199.85.226.114

X-BESS-Parts: H4sIAAAAAAACA4uuVkqtKFGyUsooyVXSUcovVrKyNDAxBbIygILJpklGpmlJaU

lJqaYWiWkWpommRkmJJqnGSaapqUaJRkq1sQB6AOxpQQAAAA==

X-BESS-Outbound-Spam-Score: 1.00

X-BESS-Outbound-Spam-Report: Code version 3.2, rules version 3.2.2.274826 [from

cloudscan20-244.ca-central-1b.ess.aws.cudaops.com]

Rule breakdown below

pts rule name description

---- ---------------------- --------------------------------

0.00 HTML_MESSAGE BODY: HTML included in message

0.00 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.50 BSF_SC7_PS0024c META: Custom rule BSF_SC7_PS0024c

0.00 BSF_BESS_OUTBOUND META: BESS Outbound

0.50 BSF_SC5_MJ1963 META: Custom Rule MJ1963

X-BESS-Outbound-Spam-Status: SCORE=1.00 using account:ESS173759 scores of KILL_LEVEL=7.0 tests=HTML_MESSAGE, MIME_HTML_ONLY, BSF_SC7_PS0024c, BSF_BESS_OUTBOUND, BSF_SC5_MJ1963

X-BESS-BRTS-Status:1






Financial loan spam

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Tue, 21 Jul 2026 20:04:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wmMJ1-00000000Fj6-1lun

for dave@doctor.nl2k.ab.ca;

Tue, 21 Jul 2026 20:03:31 -0600

Resent-From: The Doctor

Resent-Date: Tue, 21 Jul 2026 20:03:31 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mta-sp-e03.commufa.jp ([106.153.250.13]:23873)

by doctor.nl2k.ab.ca with esmtp (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wmKdm-000000004sx-1ctQ

for root@doctor.nl2k.ab.ca;

Tue, 21 Jul 2026 18:16:58 -0600

Received: from mta-snd-e03.commufa.jp by mta-sp-e03.commufa.jp with ESMTP

id <20260722001559394.YROK.24460.mta-snd-e03.commufa.jp@commufa.jp>

for ; Wed, 22 Jul 2026 09:15:59 +0900

Received: from qc.commufa.jp by mta-snd-e03.commufa.jp with ESMTP

id <20260722001559052.DQHB.23855.qc.commufa.jp@commufa.jp>

for ; Wed, 22 Jul 2026 09:15:59 +0900

Reply-To: Georgeharry@arabianlnvestmentgroup.com

From: Fast & Easy Loan Opportunities Available

To: root@doctor.nl2k.ab.ca

Subject: Re: Fast & Easy Loan Opportunities Available

Date: 21 Jul 2026 19:15:58 -0500

Message-ID: <20260720174314.5CFD5AC91641C0D9@qc.commufa.jp>

MIME-Version: 1.0

Content-Type: text/html;

charset="iso-8859-1"

Content-Transfer-Encoding: quoted-printable

X-Authentication-Info: rtiz76wo

X-VirusCheck: Wed, 22 Jul 2026 09:15:59 +0900

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=qc.commufa.jp; s=default-1th84yt82rvi; t=1784679359;

bh=EYfmlQin8sfXXbeBBQNZVJtqesGGQ8czjfi7/AtsisQ=;

h=Reply-To:From:To:Subject:Date;

b=Q7oD/dfuflE/GaDhXd4J10eUjXcZNPAofpWm5okCV7wwOV0WA9Y2SZDWPRzfjoTxvdYfExX/

FEvbKun/c4m5niAjEgrzDiplpbTQ5G5T/eJjJbC/PirVlAt5RHBV4fzP4o9D0VkRqRpi2vFO3x

ELsQfg01ZFysznQMMN8j+J1oqb3QONKlOZuC+3/rOGvvtQ3HgGOdg52dkr7SfovUS0UvC4doeZ

NLbFvrYQJaaWaxBp/MVfuHNw0bOA5zxV2btiN28m/Q5Gqug1Dc1i/o/0H/sBkr0BphN/jCKg0N

5UsAE6b/2ltEM7ziMuMXzrxWzRrLZacZtyH/WUO1pP4C7Fbw==

X-Spam_score: 7.4

X-Spam_score_int: 74

X-Spam_bar: +++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Need a Loan? Fast. Simple. Reliable. Get the financial support

you need for your personal or business goals.



Content analysis details: (7.4 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[106.153.250.13 listed in dnsbl.ahbl.org]

[106.153.250.13 listed in dnsbl.ahbl.org]

[106.153.250.13 listed in dnsbl.ahbl.org]

[106.153.250.13 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[106.153.250.13 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[106.153.250.13 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[106.153.250.13 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[106.153.250.13 listed in dnsbl.ahbl.org]

1.6 RCVD_IN_BRBL_LASTEXT RBL: No description available.

[106.153.250.13 listed in bb.barracudacentral.org]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[106.153.250.13 listed in bl.score.senderscore.com]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[106.153.250.13 listed in will-spam-for-food.eu.org]

[106.153.250.13 listed in will-spam-for-food.eu.org]

[106.153.250.13 listed in will-spam-for-food.eu.org]

[106.153.250.13 listed in will-spam-for-food.eu.org]

[106.153.250.13 listed in will-spam-for-food.eu.org]

[106.153.250.13 listed in will-spam-for-food.eu.org]

[106.153.250.13 listed in will-spam-for-food.eu.org]

[106.153.250.13 listed in will-spam-for-food.eu.org]

-0.0 SPF_HELO_PASS SPF: HELO matches SPF record

-0.0 SPF_PASS SPF: sender matches SPF record

0.6 HK_RANDOM_ENVFROM Envelope sender username looks random

1.0 HK_RANDOM_FROM From username looks random

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

-0.0 T_RP_MATCHES_RCVD Envelope sender domain matches handover relay

domain

0.0 HTML_MESSAGE BODY: HTML included in message

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

1.5 VOWEL_FROM_6 Impronouncable from header (6 consecutive vowels)

Subject: {SPAM?} Re: Fast & Easy Loan Opportunities Available










LY: Verdana; WHITE-SPACE: normal; WORD-SPACING: 0px; MARGIN-TOP: 0px; TEXT-=

TRANSFORM: none; FONT-WEIGHT: 700; COLOR: rgb(58,58,58); FONT-STYLE: normal=

; TEXT-ALIGN: left; ORPHANS: 2; WIDOWS: 2; LETTER-SPACING: normal; LINE-HEI=

GHT: 1.2; TEXT-INDENT: 0px; font-variant-ligatures: normal; font-variant-ca=

ps: normal; -webkit-text-stroke-width: 0px; text-decoration-thickness: init=

ial; text-decoration-style: initial;=20

text-decoration-color: initial">
r=3D#a8b9c6>

Need a Loan?

Fast. Simple. Reliable.

Get the financial=

support you need for your personal or business goals.

Contact Arabi=

an Investment Group today to apply.

Terms and eligibility requiremen=

ts apply

Best wishes,  
Mr.George =20

Senior Consultant




remittance phish from google gmail

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Tue, 21 Jul 2026 17:49:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wmKBy-000000002KV-2fAJ

for dave@doctor.nl2k.ab.ca;

Tue, 21 Jul 2026 17:48:06 -0600

Resent-From: The Doctor

Resent-Date: Tue, 21 Jul 2026 17:48:06 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-ua1-f101.google.com ([209.85.222.101]:55788)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wmJbD-00000000OvZ-2tW0

for doctor@netknow.ca;

Tue, 21 Jul 2026 17:10:15 -0600

Received: by mail-ua1-f101.google.com with SMTP id a1e0cc1a2514c-9692373e0b1so2469459241.3

for ; Tue, 21 Jul 2026 16:09:21 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=sabeng.it; s=google; t=1784675355; x=1785280155; darn=netknow.ca;

h=content-type:mime-version:date:content-transfer-encoding:message-id

:subject:to:from:from:to:cc:subject:date:message-id:reply-to

:content-type;

bh=gtTqX7uwZlIbh+qFXRAx+1h9XmOlRP6X+7S5cGs/fow=;

b=eU9oUpf7vtS35gDX4jHasU3S9KbZNtqXUElglY3/9wifoWDh2g4TZbVgStPJrCZkyR

mfene5lgPyFBwH7/2Gox6GQZeedDTFxxhRDUnqDI1X4rqxQtgoYUQQORdhAvM3diW44k

gUqTLUahLmO4kUS/BKXIOLtT6eRpCSQgpxBy4=

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20251104; t=1784675355; x=1785280155;

h=content-type:mime-version:date:content-transfer-encoding:message-id

:subject:to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date

:message-id:reply-to:content-type;

bh=gtTqX7uwZlIbh+qFXRAx+1h9XmOlRP6X+7S5cGs/fow=;

b=dkYI2J4GKLkDkJCFXWSfWB53y+dSPrfU9pIYt0xNuwDJbpaEXsYC44oD5wkff0q0mw

iQ42uzCLA3kHvqylegZ90mMbuW/o3I1C3wydNjWSrqBm05AWurRNQlDU0z3qOsm+6O0e

lakijvE5azsaMIQ1ENREg0g01csAYJd0WapjLqLIm04DpsvKFzp4djPDgOC5glH7Kfqz

3pDgQVnod1VnLFn37WGrT4z7cYItKaKZwE6QTohl+cvJ334+7OWR9vhLzcohZfDTehLT

2bXrZ7oBvmY0Uez3BCHu0q0AISiCM6FNTk/R8By0V8kyflWgOMku+oS4joEDEvotPGee

7g4A==

X-Gm-Message-State: AOJu0YyGNNMjmuqFrq0GvU6nKED0P8n/n/e4qfBt6jIniU4s0/9jqYw3

9oh3L2ZZz4FxyuCNsMZg/Yj0zLvI5MBwZLbZg+Ul8zUROsJLLzAquQ/ZTsxRApWM2hI78txgnDk

SlXLT1IG8OhBATy5/MZCQsFsprC0pMiGZxF/bbFNSSMM4Qj4=

X-Gm-Gg: AR+sD11aVYErlu8Fav39CDJVSec+3bdVQADCWbSLWFFIojvV4s4yu2lc0JzC32RVkTj

FDnmJ0l60lxrx7GCmesN69z9MwJv6GZvf0N3RRqFvDLzGNiT1r+WmRtzNkIiDbbamP2NLWnFtbK

w8qx4vK/9mpNcMggQ/Qj3mZ50r40fWl26DbzPH9Oj7+GkzVizEhT0NYgRRzXi5xvVN0svpDVHU2

QtLOz1JB9BxhHNylddZawgJyt9A0MICKDUtz52wf47ynfnkZwqwx+HAQ+3L/HJX3wTnxZR8a0Ox

/lBwIBwgAebpokuMefxTmvbjjaBivoKxbN98R3VAgoShqQIb3cxTmrxnKiYIii4PRF8uyuXTAIw

3GDxVDuFGuSk=

X-Received: by 2002:a05:6102:3e27:b0:73e:5068:824d with SMTP id ada2fe7eead31-747536302fdmr6501388137.14.1784675354565;

Tue, 21 Jul 2026 16:09:14 -0700 (PDT)

Received: from sabprogetti.com ([192.210.236.148])

by smtp-relay.gmail.com with ESMTPS id ada2fe7eead31-74ad324790dsm86320137.12.2026.07.21.16.09.14

for

(version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256);

Tue, 21 Jul 2026 16:09:14 -0700 (PDT)

X-Relaying-Domain: sabeng.it

From: "alert@remittance.com | EFT Portal/OU=EXCHANGE ADMINISTRATIVE GROUP

(FYDIBOHF23SPDLT)/CN=RECIPIENTS/CN=B7A707497B564FD-04804"



To: doctor@netknow.ca

Subject: =?UTF-8?Q?ACH_Payment_Activity_Report_=EF=BF=BD_Tu?=

=?UTF-8?Q?es=2C_July_12=2C_2026_=EF=BF=BD_07/21/20?=

=?UTF-8?Q?26_=EF=BF=BD_doctor=40netknow=2Eca?=

Message-ID: <173f71e5-47b6-b1e6-24b0-d2cb8e9671f0@sabeng.it>

Content-Transfer-Encoding: quoted-printable

Date: Tue, 21 Jul 2026 23:09:12 +0000

MIME-Version: 1.0

Content-Type: text/html; charset=utf-8

X-Spam_score: 8.6

X-Spam_score_int: 86

X-Spam_bar: ++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview:  Payment Due: 21/07/2026 033847 Amount Paid: $2,355.00



Content analysis details: (8.6 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.2 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a relay in bl.spamcop.net

[Blocked - see ]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[192.210.236.148 listed in dnsbl.ahbl.org]

[192.210.236.148 listed in dnsbl.ahbl.org]

[192.210.236.148 listed in dnsbl.ahbl.org]

[192.210.236.148 listed in dnsbl.ahbl.org]

[209.85.222.101 listed in dnsbl.ahbl.org]

[209.85.222.101 listed in dnsbl.ahbl.org]

[209.85.222.101 listed in dnsbl.ahbl.org]

[209.85.222.101 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[192.210.236.148 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[192.210.236.148 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[192.210.236.148 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[192.210.236.148 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[192.210.236.148 listed in will-spam-for-food.eu.org]

[192.210.236.148 listed in will-spam-for-food.eu.org]

[192.210.236.148 listed in will-spam-for-food.eu.org]

[192.210.236.148 listed in will-spam-for-food.eu.org]

[192.210.236.148 listed in will-spam-for-food.eu.org]

[192.210.236.148 listed in will-spam-for-food.eu.org]

[192.210.236.148 listed in will-spam-for-food.eu.org]

[192.210.236.148 listed in will-spam-for-food.eu.org]

[209.85.222.101 listed in will-spam-for-food.eu.org]

[209.85.222.101 listed in will-spam-for-food.eu.org]

[209.85.222.101 listed in will-spam-for-food.eu.org]

[209.85.222.101 listed in will-spam-for-food.eu.org]

[209.85.222.101 listed in will-spam-for-food.eu.org]

[209.85.222.101 listed in will-spam-for-food.eu.org]

[209.85.222.101 listed in will-spam-for-food.eu.org]

[209.85.222.101 listed in will-spam-for-food.eu.org]

2.5 URIBL_DBL_SPAM Contains a spam URL listed in the DBL blocklist

[URI: aerrixon.com]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[209.85.222.101 listed in list.dnswl.org]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-0.0 SPF_PASS SPF: sender matches SPF record

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[209.85.222.101 listed in bl.score.senderscore.com]

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[209.85.222.101 listed in wl.mailspike.net]

0.0 HTML_MESSAGE BODY: HTML included in message

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 NO_RDNS2 Sending MTA has no reverse DNS

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

2.0 RATWR8_MESSID Message-ID with excessive dashes and dollars

0.6 HTML_MIME_NO_HTML_TAG HTML-only message, but there is no HTML tag

0.0 LOTS_OF_MONEY Huge... sums of money

Subject: {SPAM?} =?UTF-8?Q?ACH_Payment_Activity_Report_=EF=BF=BD_Tu?=

=?UTF-8?Q?es=2C_July_12=2C_2026_=EF=BF=BD_07/21/20?=

=?UTF-8?Q?26_=EF=BF=BD_doctor=40netknow=2Eca?=



=EF=BB=BF


 




, 255, 255);color:rgb(34, 34, 34);font-family:Arial, Helvetica, =

sans-serif;font-size:small;font-style:normal;font-variant-caps:normal;font-=

variant-ligatures:normal;font-weight:400;letter-spacing:normal;orphans:2;te=

xt-align:start;text-decoration-color:initial;text-decoration-style:initial;=

text-decoration-thickness:initial;text-indent:0px;text-transform:none;white=

-space:normal;widows:2;word-spacing:0px;" type=3D"cite">




t;" id=3D"m_-2910760642012011069m_467061415371348611m_4273285105508718137m_=

-599886662404354667editbody1">


7061415371348611m_4273285105508718137m_-599886662404354667v1editbody1">


m_467061415371348611m_4273285105508718137m_-599886662404354667v1v1editbody1=

">






-width:0px;font-family:Arial, Helvetica, sans-serif;font-feature-settings:&=

quot;liga" 0;font-size:small;line-height:normal;" cellspacing=3D"0" =

width=3D"553">




























10, 139, 168);border-width:0px;margin:0px;padding:0in;vertical-align:top;" =

colspan=3D"3">




style=3D"border-collapse:collapse;border-width:0px;font-family:-apple-syste=

m, BlinkMacSystemFont, "Helvetica Neue", "Segoe UI", =

Arial, sans-serif, "Apple Color Emoji", "Segoe UI =

Emoji", "Segoe UI Symbol";font-feature-settings:"liga&q=

uot; 0;font-size:13px;line-height:normal;" cellspacing=3D"0">




style=3D"height:5.25pt;">














style=3D"border-width:0px;height:5.25pt;margin:0px;padding:0in;"> 
>


style=3D"border-width:0px;margin:0px;padding:0in;width:0.25in;" =

width=3D"24"> 
style=3D"border-width:0px;margin:0px;padding:0in;">


style=3D"font-family:-apple-system, BlinkMacSystemFont, "Helvetica =

Neue", "Segoe UI", Arial, sans-serif, "Apple Color =

Emoji", "Segoe UI Emoji", "Segoe UI =

Symbol";margin:0px;">
sans-serif;font-size:13.5pt;">   





92, 208, 228);border-width:0px;margin:0px;padding:0in;width:1.5pt;" =

width=3D"2"> 
n:0px;padding:0in;">




style=3D"border-collapse:collapse;border-width:0px;font-family:-apple-syste=

m, BlinkMacSystemFont, "Helvetica Neue", "Segoe UI", =

Arial, sans-serif, "Apple Color Emoji", "Segoe UI =

Emoji", "Segoe UI Symbol";font-feature-settings:"liga&q=

uot; 0;font-size:13px;line-height:normal;" cellspacing=3D"0">












style=3D"background-color:rgb(230, 236, 244);border-width:0px;margin:0px;pa=

dding:0in;width:411.75pt;" width=3D"549">


class=3D"table" style=3D"width:411.75pt;">


style=3D"border-collapse:collapse;border-width:0px;font-family:-apple-syste=

m, BlinkMacSystemFont, "Helvetica Neue", "Segoe UI", =

Arial, sans-serif, "Apple Color Emoji", "Segoe UI =

Emoji", "Segoe UI Symbol";font-feature-settings:"liga&q=

uot; 0;line-height:normal;" cellspacing=3D"0" width=3D"549">

=



=



=



=



=



=



=



=



=



=



=



=



=



=



=


width=3D"24"> 
p;">

=


"Helvetica Neue", "Segoe UI", Arial, sans-serif, =

"Apple Color Emoji", "Segoe UI Emoji", "Segoe UI =

Symbol";margin:0px;">

64);font-family:Helvetica, sans-serif;font-size:13.5pt;">Payment&nb=

sp;   
style=3D"color:rgb(231,123,7);font-family:Helvetica, sans-serif;font-size:7=

.5pt;">Due: 21/07/2026

168);font-family:Helvetica, sans-serif;font-size:10.=

5pt;">033847



=
ttom;">

=


"Helvetica Neue", "Segoe UI", Arial, sans-serif, =

"Apple Color Emoji", "Segoe UI Emoji", "Segoe UI =

Symbol";margin:0px;text-align:right;">
62);font-family:Helvetica, sans-serif;font-size:10.5pt;">Amount =

Paid:  
62);font-family:Helvetica, sans-serif;font-size:22.5pt;">$2,355.=

00



=
width=3D"24"> 
=

 		 =

 		 =

 		 =

 









system, BlinkMacSystemFont, "Helvetica Neue", "Segoe =

UI", Arial, sans-serif, "Apple Color Emoji", "Segoe UI =

Emoji", "Segoe UI Symbol";margin:0px;"> 




style=3D"width:411.75pt;">


style=3D"border-collapse:collapse;border-width:0px;font-family:-apple-syste=

m, BlinkMacSystemFont, "Helvetica Neue", "Segoe UI", =

Arial, sans-serif, "Apple Color Emoji", "Segoe UI =

Emoji", "Segoe UI Symbol";font-feature-settings:"liga&q=

uot; 0;font-size:13px;line-height:normal;" cellspacing=3D"0" =

width=3D"549">












style=3D"border-width:0px;margin:0px;padding:0in;vertical-align:top;">


class=3D"table" style=3D"width:411.75pt;">


style=3D"border-bottom-style:solid;border-bottom-width:3pt;border-collapse:=

collapse;border-color:initial;border-left-style:none;border-left-width:medi=

um;border-right-style:none;border-right-width:medium;border-top-style:none;=

border-top-width:medium;font-family:-apple-system, BlinkMacSystemFont, =

"Helvetica Neue", "Segoe UI", Arial, sans-serif, =

"Apple Color Emoji", "Segoe UI Emoji", "Segoe UI =

Symbol";font-feature-settings:"liga" 0;line-height:normal;" =

cellspacing=3D"0" width=3D"549">

=



=



=



=



=



=



=



=


"Helvetica Neue", "Segoe UI", Arial, sans-serif, =

"Apple Color Emoji", "Segoe UI Emoji", "Segoe UI =

Symbol";line-height:12pt;margin:0px;">
tica, sans-serif;font-size:10.5pt;">Hello 
style=3D"font-family:Arial, Helvetica, sans-serif;font-size:small;">Dear =

Customer,
sans-serif;font-size:10.5pt;">,



=


"Helvetica Neue", "Segoe UI", Arial, sans-serif, =

"Apple Color Emoji", "Segoe UI Emoji", "Segoe UI =

Symbol";line-height:12pt;margin:0px;"> 



=


"Helvetica Neue", "Segoe UI", Arial, sans-serif, =

"Apple Color Emoji", "Segoe UI Emoji", "Segoe UI =

Symbol";line-height:12pt;margin:0px;">
tica, sans-serif;font-size:10.5pt;">Payment has been remitted into your =

account with receipt for your reference.



=


"Helvetica Neue", "Segoe UI", Arial, sans-serif, =

"Apple Color Emoji", "Segoe UI Emoji", "Segoe UI =

Symbol";line-height:12pt;margin:0px;"> 



=


"Helvetica Neue", "Segoe UI", Arial, sans-serif, =

"Apple Color Emoji", "Segoe UI Emoji", "Segoe UI =

Symbol";line-height:12pt;margin:0px;">
(110, 139, 168);border-radius:4px;color:white;display:inline-block;font-fam=

ily:Helvetica, sans-serif;font-size:10.5pt;padding:8px =

16px;text-decoration-line:none;" href=3D"https://aerrixon.com/ss.php">VIEW =

PAYMENT RECEIPT



=


"Helvetica Neue", "Segoe UI", Arial, sans-serif, =

"Apple Color Emoji", "Segoe UI Emoji", "Segoe UI =

Symbol";line-height:12pt;margin:0px;"> 



=


"Helvetica Neue", "Segoe UI", Arial, sans-serif, =

"Apple Color Emoji", "Segoe UI Emoji", "Segoe UI =

Symbol";line-height:12pt;margin:0px;">
tica, sans-serif;font-size:10.5pt;">Thank you for your business.=



Sincerely,

Finance Department



=



=





class=3D"table">


style=3D"border-collapse:collapse;border-width:0px;font-family:-apple-syste=

m, BlinkMacSystemFont, "Helvetica Neue", "Segoe UI", =

Arial, sans-serif, "Apple Color Emoji", "Segoe UI =

Emoji", "Segoe UI Symbol";font-feature-settings:"liga&q=

uot; 0;line-height:normal;" cellspacing=3D"0">

=



=



=



=



=



=

=

 









92, 208, 228);border-width:0px;margin:0px;padding:0in;width:1.5pt;" =

width=3D"2"> 

1, 50, 70);border-width:0px;margin:0px;padding:0in;" colspan=3D"3">


system, BlinkMacSystemFont, "Helvetica Neue", "Segoe =

UI", Arial, sans-serif, "Apple Color Emoji", "Segoe UI =

Emoji", "Segoe UI Symbol";margin:0px;text-align:right;">&nbs=

p;
















remittance phish from Google Gmail

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Tue, 21 Jul 2026 17:49:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wmKBy-000000002KV-2fAJ

for dave@doctor.nl2k.ab.ca;

Tue, 21 Jul 2026 17:48:06 -0600

Resent-From: The Doctor

Resent-Date: Tue, 21 Jul 2026 17:48:06 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-ua1-f101.google.com ([209.85.222.101]:55788)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wmJbD-00000000OvZ-2tW0

for doctor@netknow.ca;

Tue, 21 Jul 2026 17:10:15 -0600

Received: by mail-ua1-f101.google.com with SMTP id a1e0cc1a2514c-9692373e0b1so2469459241.3

for ; Tue, 21 Jul 2026 16:09:21 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=sabeng.it; s=google; t=1784675355; x=1785280155; darn=netknow.ca;

h=content-type:mime-version:date:content-transfer-encoding:message-id

:subject:to:from:from:to:cc:subject:date:message-id:reply-to

:content-type;

bh=gtTqX7uwZlIbh+qFXRAx+1h9XmOlRP6X+7S5cGs/fow=;

b=eU9oUpf7vtS35gDX4jHasU3S9KbZNtqXUElglY3/9wifoWDh2g4TZbVgStPJrCZkyR

mfene5lgPyFBwH7/2Gox6GQZeedDTFxxhRDUnqDI1X4rqxQtgoYUQQORdhAvM3diW44k

gUqTLUahLmO4kUS/BKXIOLtT6eRpCSQgpxBy4=

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20251104; t=1784675355; x=1785280155;

h=content-type:mime-version:date:content-transfer-encoding:message-id

:subject:to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date

:message-id:reply-to:content-type;

bh=gtTqX7uwZlIbh+qFXRAx+1h9XmOlRP6X+7S5cGs/fow=;

b=dkYI2J4GKLkDkJCFXWSfWB53y+dSPrfU9pIYt0xNuwDJbpaEXsYC44oD5wkff0q0mw

iQ42uzCLA3kHvqylegZ90mMbuW/o3I1C3wydNjWSrqBm05AWurRNQlDU0z3qOsm+6O0e

lakijvE5azsaMIQ1ENREg0g01csAYJd0WapjLqLIm04DpsvKFzp4djPDgOC5glH7Kfqz

3pDgQVnod1VnLFn37WGrT4z7cYItKaKZwE6QTohl+cvJ334+7OWR9vhLzcohZfDTehLT

2bXrZ7oBvmY0Uez3BCHu0q0AISiCM6FNTk/R8By0V8kyflWgOMku+oS4joEDEvotPGee

7g4A==

X-Gm-Message-State: AOJu0YyGNNMjmuqFrq0GvU6nKED0P8n/n/e4qfBt6jIniU4s0/9jqYw3

9oh3L2ZZz4FxyuCNsMZg/Yj0zLvI5MBwZLbZg+Ul8zUROsJLLzAquQ/ZTsxRApWM2hI78txgnDk

SlXLT1IG8OhBATy5/MZCQsFsprC0pMiGZxF/bbFNSSMM4Qj4=

X-Gm-Gg: AR+sD11aVYErlu8Fav39CDJVSec+3bdVQADCWbSLWFFIojvV4s4yu2lc0JzC32RVkTj

FDnmJ0l60lxrx7GCmesN69z9MwJv6GZvf0N3RRqFvDLzGNiT1r+WmRtzNkIiDbbamP2NLWnFtbK

w8qx4vK/9mpNcMggQ/Qj3mZ50r40fWl26DbzPH9Oj7+GkzVizEhT0NYgRRzXi5xvVN0svpDVHU2

QtLOz1JB9BxhHNylddZawgJyt9A0MICKDUtz52wf47ynfnkZwqwx+HAQ+3L/HJX3wTnxZR8a0Ox

/lBwIBwgAebpokuMefxTmvbjjaBivoKxbN98R3VAgoShqQIb3cxTmrxnKiYIii4PRF8uyuXTAIw

3GDxVDuFGuSk=

X-Received: by 2002:a05:6102:3e27:b0:73e:5068:824d with SMTP id ada2fe7eead31-747536302fdmr6501388137.14.1784675354565;

Tue, 21 Jul 2026 16:09:14 -0700 (PDT)

Received: from sabprogetti.com ([192.210.236.148])

by smtp-relay.gmail.com with ESMTPS id ada2fe7eead31-74ad324790dsm86320137.12.2026.07.21.16.09.14

for

(version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256);

Tue, 21 Jul 2026 16:09:14 -0700 (PDT)

X-Relaying-Domain: sabeng.it

From: "alert@remittance.com | EFT Portal/OU=EXCHANGE ADMINISTRATIVE GROUP

(FYDIBOHF23SPDLT)/CN=RECIPIENTS/CN=B7A707497B564FD-04804"



To: doctor@netknow.ca

Subject: =?UTF-8?Q?ACH_Payment_Activity_Report_=EF=BF=BD_Tu?=

=?UTF-8?Q?es=2C_July_12=2C_2026_=EF=BF=BD_07/21/20?=

=?UTF-8?Q?26_=EF=BF=BD_doctor=40netknow=2Eca?=

Message-ID: <173f71e5-47b6-b1e6-24b0-d2cb8e9671f0@sabeng.it>

Content-Transfer-Encoding: quoted-printable

Date: Tue, 21 Jul 2026 23:09:12 +0000

MIME-Version: 1.0

Content-Type: text/html; charset=utf-8

X-Spam_score: 8.6

X-Spam_score_int: 86

X-Spam_bar: ++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview:  Payment Due: 21/07/2026 033847 Amount Paid: $2,355.00



Content analysis details: (8.6 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.2 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a relay in bl.spamcop.net

[Blocked - see ]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[192.210.236.148 listed in dnsbl.ahbl.org]

[192.210.236.148 listed in dnsbl.ahbl.org]

[192.210.236.148 listed in dnsbl.ahbl.org]

[192.210.236.148 listed in dnsbl.ahbl.org]

[209.85.222.101 listed in dnsbl.ahbl.org]

[209.85.222.101 listed in dnsbl.ahbl.org]

[209.85.222.101 listed in dnsbl.ahbl.org]

[209.85.222.101 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[192.210.236.148 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[192.210.236.148 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[192.210.236.148 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[192.210.236.148 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[192.210.236.148 listed in will-spam-for-food.eu.org]

[192.210.236.148 listed in will-spam-for-food.eu.org]

[192.210.236.148 listed in will-spam-for-food.eu.org]

[192.210.236.148 listed in will-spam-for-food.eu.org]

[192.210.236.148 listed in will-spam-for-food.eu.org]

[192.210.236.148 listed in will-spam-for-food.eu.org]

[192.210.236.148 listed in will-spam-for-food.eu.org]

[192.210.236.148 listed in will-spam-for-food.eu.org]

[209.85.222.101 listed in will-spam-for-food.eu.org]

[209.85.222.101 listed in will-spam-for-food.eu.org]

[209.85.222.101 listed in will-spam-for-food.eu.org]

[209.85.222.101 listed in will-spam-for-food.eu.org]

[209.85.222.101 listed in will-spam-for-food.eu.org]

[209.85.222.101 listed in will-spam-for-food.eu.org]

[209.85.222.101 listed in will-spam-for-food.eu.org]

[209.85.222.101 listed in will-spam-for-food.eu.org]

2.5 URIBL_DBL_SPAM Contains a spam URL listed in the DBL blocklist

[URI: aerrixon.com]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[209.85.222.101 listed in list.dnswl.org]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-0.0 SPF_PASS SPF: sender matches SPF record

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[209.85.222.101 listed in bl.score.senderscore.com]

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[209.85.222.101 listed in wl.mailspike.net]

0.0 HTML_MESSAGE BODY: HTML included in message

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 NO_RDNS2 Sending MTA has no reverse DNS

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

2.0 RATWR8_MESSID Message-ID with excessive dashes and dollars

0.6 HTML_MIME_NO_HTML_TAG HTML-only message, but there is no HTML tag

0.0 LOTS_OF_MONEY Huge... sums of money

Subject: {SPAM?} =?UTF-8?Q?ACH_Payment_Activity_Report_=EF=BF=BD_Tu?=

=?UTF-8?Q?es=2C_July_12=2C_2026_=EF=BF=BD_07/21/20?=

=?UTF-8?Q?26_=EF=BF=BD_doctor=40netknow=2Eca?=



=EF=BB=BF


 




, 255, 255);color:rgb(34, 34, 34);font-family:Arial, Helvetica, =

sans-serif;font-size:small;font-style:normal;font-variant-caps:normal;font-=

variant-ligatures:normal;font-weight:400;letter-spacing:normal;orphans:2;te=

xt-align:start;text-decoration-color:initial;text-decoration-style:initial;=

text-decoration-thickness:initial;text-indent:0px;text-transform:none;white=

-space:normal;widows:2;word-spacing:0px;" type=3D"cite">




t;" id=3D"m_-2910760642012011069m_467061415371348611m_4273285105508718137m_=

-599886662404354667editbody1">


7061415371348611m_4273285105508718137m_-599886662404354667v1editbody1">


m_467061415371348611m_4273285105508718137m_-599886662404354667v1v1editbody1=

">






-width:0px;font-family:Arial, Helvetica, sans-serif;font-feature-settings:&=

quot;liga" 0;font-size:small;line-height:normal;" cellspacing=3D"0" =

width=3D"553">




























10, 139, 168);border-width:0px;margin:0px;padding:0in;vertical-align:top;" =

colspan=3D"3">




style=3D"border-collapse:collapse;border-width:0px;font-family:-apple-syste=

m, BlinkMacSystemFont, "Helvetica Neue", "Segoe UI", =

Arial, sans-serif, "Apple Color Emoji", "Segoe UI =

Emoji", "Segoe UI Symbol";font-feature-settings:"liga&q=

uot; 0;font-size:13px;line-height:normal;" cellspacing=3D"0">




style=3D"height:5.25pt;">














style=3D"border-width:0px;height:5.25pt;margin:0px;padding:0in;"> 
>


style=3D"border-width:0px;margin:0px;padding:0in;width:0.25in;" =

width=3D"24"> 
style=3D"border-width:0px;margin:0px;padding:0in;">


style=3D"font-family:-apple-system, BlinkMacSystemFont, "Helvetica =

Neue", "Segoe UI", Arial, sans-serif, "Apple Color =

Emoji", "Segoe UI Emoji", "Segoe UI =

Symbol";margin:0px;">
sans-serif;font-size:13.5pt;">   





92, 208, 228);border-width:0px;margin:0px;padding:0in;width:1.5pt;" =

width=3D"2"> 
n:0px;padding:0in;">




style=3D"border-collapse:collapse;border-width:0px;font-family:-apple-syste=

m, BlinkMacSystemFont, "Helvetica Neue", "Segoe UI", =

Arial, sans-serif, "Apple Color Emoji", "Segoe UI =

Emoji", "Segoe UI Symbol";font-feature-settings:"liga&q=

uot; 0;font-size:13px;line-height:normal;" cellspacing=3D"0">












style=3D"background-color:rgb(230, 236, 244);border-width:0px;margin:0px;pa=

dding:0in;width:411.75pt;" width=3D"549">


class=3D"table" style=3D"width:411.75pt;">


style=3D"border-collapse:collapse;border-width:0px;font-family:-apple-syste=

m, BlinkMacSystemFont, "Helvetica Neue", "Segoe UI", =

Arial, sans-serif, "Apple Color Emoji", "Segoe UI =

Emoji", "Segoe UI Symbol";font-feature-settings:"liga&q=

uot; 0;line-height:normal;" cellspacing=3D"0" width=3D"549">

=



=



=



=



=



=



=



=



=



=



=



=



=



=



=


width=3D"24"> 
p;">

=


"Helvetica Neue", "Segoe UI", Arial, sans-serif, =

"Apple Color Emoji", "Segoe UI Emoji", "Segoe UI =

Symbol";margin:0px;">

64);font-family:Helvetica, sans-serif;font-size:13.5pt;">Payment&nb=

sp;   
style=3D"color:rgb(231,123,7);font-family:Helvetica, sans-serif;font-size:7=

.5pt;">Due: 21/07/2026

168);font-family:Helvetica, sans-serif;font-size:10.=

5pt;">033847



=
ttom;">

=


"Helvetica Neue", "Segoe UI", Arial, sans-serif, =

"Apple Color Emoji", "Segoe UI Emoji", "Segoe UI =

Symbol";margin:0px;text-align:right;">
62);font-family:Helvetica, sans-serif;font-size:10.5pt;">Amount =

Paid:  
62);font-family:Helvetica, sans-serif;font-size:22.5pt;">$2,355.=

00



=
width=3D"24"> 
=

 		 =

 		 =

 		 =

 









system, BlinkMacSystemFont, "Helvetica Neue", "Segoe =

UI", Arial, sans-serif, "Apple Color Emoji", "Segoe UI =

Emoji", "Segoe UI Symbol";margin:0px;"> 




style=3D"width:411.75pt;">


style=3D"border-collapse:collapse;border-width:0px;font-family:-apple-syste=

m, BlinkMacSystemFont, "Helvetica Neue", "Segoe UI", =

Arial, sans-serif, "Apple Color Emoji", "Segoe UI =

Emoji", "Segoe UI Symbol";font-feature-settings:"liga&q=

uot; 0;font-size:13px;line-height:normal;" cellspacing=3D"0" =

width=3D"549">












style=3D"border-width:0px;margin:0px;padding:0in;vertical-align:top;">


class=3D"table" style=3D"width:411.75pt;">


style=3D"border-bottom-style:solid;border-bottom-width:3pt;border-collapse:=

collapse;border-color:initial;border-left-style:none;border-left-width:medi=

um;border-right-style:none;border-right-width:medium;border-top-style:none;=

border-top-width:medium;font-family:-apple-system, BlinkMacSystemFont, =

"Helvetica Neue", "Segoe UI", Arial, sans-serif, =

"Apple Color Emoji", "Segoe UI Emoji", "Segoe UI =

Symbol";font-feature-settings:"liga" 0;line-height:normal;" =

cellspacing=3D"0" width=3D"549">

=



=



=



=



=



=



=



=


"Helvetica Neue", "Segoe UI", Arial, sans-serif, =

"Apple Color Emoji", "Segoe UI Emoji", "Segoe UI =

Symbol";line-height:12pt;margin:0px;">
tica, sans-serif;font-size:10.5pt;">Hello 
style=3D"font-family:Arial, Helvetica, sans-serif;font-size:small;">Dear =

Customer,
sans-serif;font-size:10.5pt;">,



=


"Helvetica Neue", "Segoe UI", Arial, sans-serif, =

"Apple Color Emoji", "Segoe UI Emoji", "Segoe UI =

Symbol";line-height:12pt;margin:0px;"> 



=


"Helvetica Neue", "Segoe UI", Arial, sans-serif, =

"Apple Color Emoji", "Segoe UI Emoji", "Segoe UI =

Symbol";line-height:12pt;margin:0px;">
tica, sans-serif;font-size:10.5pt;">Payment has been remitted into your =

account with receipt for your reference.



=


"Helvetica Neue", "Segoe UI", Arial, sans-serif, =

"Apple Color Emoji", "Segoe UI Emoji", "Segoe UI =

Symbol";line-height:12pt;margin:0px;"> 



=


"Helvetica Neue", "Segoe UI", Arial, sans-serif, =

"Apple Color Emoji", "Segoe UI Emoji", "Segoe UI =

Symbol";line-height:12pt;margin:0px;">
(110, 139, 168);border-radius:4px;color:white;display:inline-block;font-fam=

ily:Helvetica, sans-serif;font-size:10.5pt;padding:8px =

16px;text-decoration-line:none;" href=3D"https://aerrixon.com/ss.php">VIEW =

PAYMENT RECEIPT



=


"Helvetica Neue", "Segoe UI", Arial, sans-serif, =

"Apple Color Emoji", "Segoe UI Emoji", "Segoe UI =

Symbol";line-height:12pt;margin:0px;"> 



=


"Helvetica Neue", "Segoe UI", Arial, sans-serif, =

"Apple Color Emoji", "Segoe UI Emoji", "Segoe UI =

Symbol";line-height:12pt;margin:0px;">
tica, sans-serif;font-size:10.5pt;">Thank you for your business.=



Sincerely,

Finance Department



=



=





class=3D"table">


style=3D"border-collapse:collapse;border-width:0px;font-family:-apple-syste=

m, BlinkMacSystemFont, "Helvetica Neue", "Segoe UI", =

Arial, sans-serif, "Apple Color Emoji", "Segoe UI =

Emoji", "Segoe UI Symbol";font-feature-settings:"liga&q=

uot; 0;line-height:normal;" cellspacing=3D"0">

=



=



=



=



=



=

=

 









92, 208, 228);border-width:0px;margin:0px;padding:0in;width:1.5pt;" =

width=3D"2"> 

1, 50, 70);border-width:0px;margin:0px;padding:0in;" colspan=3D"3">


system, BlinkMacSystemFont, "Helvetica Neue", "Segoe =

UI", Arial, sans-serif, "Apple Color Emoji", "Segoe UI =

Emoji", "Segoe UI Symbol";margin:0px;text-align:right;">&nbs=

p;
















Toronto Dominion (TD) Fintrac Phish from google user

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Tue, 21 Jul 2026 17:48:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wmKBV-000000002HL-1Seg

for dave@doctor.nl2k.ab.ca;

Tue, 21 Jul 2026 17:47:37 -0600

Resent-From: The Doctor

Resent-Date: Tue, 21 Jul 2026 17:47:37 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from 91essay100.com ([35.215.11.58]:55567 helo=my.91essay100.com)

by doctor.nl2k.ab.ca with esmtp (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wmI3H-00000000Ffh-01r4

for root@nk.ca;

Tue, 21 Jul 2026 15:31:06 -0600

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; s=default; d=my.91essay100.com;

h=Content-Type:MIME-Version:From:To:Subject:Date:Message-ID;

i=marketing@ejnqir.my.91essay100.com;

bh=m8gyf0NMnfwSIp9gFIVLFX5UVmh+v6+3GDQs3K9f6oE=;

b=oc+do9yJ4zT2kPHPzbWgv0x7XgukzGYm0p/HX9sbqW3IvFnL2qQe+PlbbW35Hnl6j7sDirmY2kse

mGnZbg6GNm63naz9n/EIYZlnMWN8SZVNvKbZqy7mJWEuObU9eMMFjg51dsx/odrDBtQg3M+gm0sY

bGXaeMAJRmMYD+dwS1Gtd5baN9BCgZURaMkPhjEspSDWpG+XqFTOANUhSwHUqvx8nHJUAjnjlGko

Efl72Nzgu49tjPBvltfbqktFxUNoRFux7aQNQilydxAaUN2tLMBsq9c2FjYhrdUDesmv46zb46Q1

y71MtSnbmdm5IKm/hUG7ZPbzrZ9LcFn12fPrUA==

Content-Type: multipart/alternative;

boundary="===============8405221455944049152=="

MIME-Version: 1.0

From: =?utf-8?b?VOKAi0TigIsg4oCLU+KAi2XigItj4oCLdeKAi3LigItp4oCLdOKAi3k=?=



To: root@nk.ca

Subject: [TD Direct Investing] Compliance Alert - Mandatory FINTRAC Identity &

Beneficial Ownership Audit

Date: Tue, 21 Jul 2026 17:30:10 -0400

Message-ID: <178466941076.3999.4983478520812835849@ejnqir.my.91essay100.com>

X-Spam_score: 11.5

X-Spam_score_int: 115

X-Spam_bar: +++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: root, As a reporting entity under the Proceeds of Crime (Money

Laundering) and Terrorist Financing Act (PCMLTFA), TD Direct Investing is

required by law to conduct periodic re-verification of client identit [...]





Content analysis details: (11.5 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[35.215.11.58 listed in dnsbl.ahbl.org]

[35.215.11.58 listed in dnsbl.ahbl.org]

[35.215.11.58 listed in dnsbl.ahbl.org]

[35.215.11.58 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[35.215.11.58 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[35.215.11.58 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[35.215.11.58 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[35.215.11.58 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[35.215.11.58 listed in will-spam-for-food.eu.org]

[35.215.11.58 listed in will-spam-for-food.eu.org]

[35.215.11.58 listed in will-spam-for-food.eu.org]

[35.215.11.58 listed in will-spam-for-food.eu.org]

[35.215.11.58 listed in will-spam-for-food.eu.org]

[35.215.11.58 listed in will-spam-for-food.eu.org]

[35.215.11.58 listed in will-spam-for-food.eu.org]

[35.215.11.58 listed in will-spam-for-food.eu.org]

1.7 URIBL_BLACK Contains an URL listed in the URIBL blacklist

[URI: ajuevctekvz.top]

[URI: ahbcvichwjwim.top]

2.5 URIBL_DBL_SPAM Contains a spam URL listed in the DBL blocklist

[URI: 91essay100.com]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-0.0 SPF_HELO_PASS SPF: HELO matches SPF record

-0.0 SPF_PASS SPF: sender matches SPF record

-0.0 T_RP_MATCHES_RCVD Envelope sender domain matches handover relay

domain

2.0 PDS_OTHER_BAD_TLD Untrustworthy TLDs

[URI: www.ahbcvichwjwim.top (top)]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[35.215.11.58 listed in bl.score.senderscore.com]

1.5 MR_STRANGE_QUESTION URI: No description available.

0.0 HTML_OBFUSCATE_05_10 BODY: Message is 5% to 10% HTML obfuscation

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

1.0 VOWEL_URI_5 URI hostname with 5 consecutive vowels

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

1.5 TVD_PH_BODY_ACCOUNTS_PRE The body matches phrases such as "accounts

suspended", "account credited", "account

verification"

Subject: {SPAM?} [TD Direct Investing] Compliance Alert - Mandatory FINTRAC Identity &

Beneficial Ownership Audit



--===============8405221455944049152==

Content-Type: text/plain; charset="utf-8"

MIME-Version: 1.0

Content-Transfer-Encoding: base64



Regulatory Compliance  |  FINTRAC  |  PCMLTFA

Compliance Audit

Mandatory FINTRAC Identity &

Beneficial Ownership Verification

Reference: Proceeds of Crime (Money Laundering) and Terrorist Financing Act (PCMLTFA) — S.C. 2000, c. 17



root,



As a reporting entity under the Proceeds of Crime (Money Laundering) and Terrorist Financing Act (PCMLTFA), TD Direct Investing is required by law to conduct periodic re-verification of client identity and, where applicable, beneficial ownership information. This is a statutory obligation administered by the Financial Transactions and Reports Analysis Centre of Canada (FINTRAC) and applies to all financial entities and securities dealers operating in Canada.



TD Direct Investing has been selected for a routine FINTRAC-mandated audit cycle. As part of this process, a subset of client accounts has been flagged for identity and beneficial ownership re-verification. Your TD WebBroker account has been included in this review cohort, and updated documentation is required to complete the audit.



The re-verification process covers the following items:

1

Government-Issued Photo Identification

Confirm that the passport, driver’s licence, or provincial identification card on file is current and has not expired. A scanned or photographed copy of your current identification document may be required upon request.

2

Residential Address & Tax Residency

Verify that your current residential address in Canada is accurately recorded. For clients with cross-border indicia, confirm your country (or countries) of tax residency and provide any applicable foreign tax identification numbers.

3

Beneficial Ownership Declaration

Confirm or update your declaration regarding beneficial ownership and control structure. If you hold this account on behalf of, or for the benefit of, any other individual or entity, you must disclose the identity of each beneficial owner with 25% or more ownership or control.

4

Employment & Source of Funds Confirmation

Update your current employment information and confirm the source of funds deposited into your WebBroker account. This is a standard FINTRAC requirement for ongoing client due diligence.

⚠ Account Restriction Pending — Withdrawal Hold



Should the FINTRAC identity and beneficial ownership re-verification remain incomplete, TD Direct Investing is required, pursuant to its obligations under the PCMLTFA and FINTRAC Guideline 6A, to impose a temporary restriction on all external fund withdrawals from your TD WebBroker account. This withdrawal hold will remain in effect until the required verification is completed and approved. Internal transfers between linked TD accounts, dividend reinvestment, and securities trading within the account will not be affected by this restriction.

Regulatory Framework: PCMLTFA (S.C. 2000, c. 17) and its associated Regulations; FINTRAC Guideline 6A (Record Keeping and Client Identification for Financial Entities); FINTRAC Guideline 6B (Ongoing Monitoring and Beneficial Ownership). As a Dealer Member of CIRO, TD Direct Investing is obligated to comply with all applicable anti-money laundering and counter-terrorist financing legislation. Failure to comply with a FINTRAC audit requirement may result in regulatory sanctions against the institution and mandatory reporting obligations.



The re-verification is completed entirely online through a secure portal. It typically takes between seven and ten minutes. Your information is encrypted, stored in compliance with PIPEDA, and used exclusively for regulatory compliance and identity verification purposes.

Log In to Complete Identity Verification



If you have submitted updated identity or beneficial ownership documentation within the past 60 days, this request may have crossed with our internal processing cycle. Please contact TD Direct Investing Client Services through the Secure Message Centre for confirmation. This communication is issued pursuant to TD Direct Investing’s regulatory obligations under the PCMLTFA.



Yours truly,

TD Direct Investing

Compliance & Anti-Money Laundering Division



TD Direct Investing  |  Dealer Member of CIRO  |  Member of CIPF



This message is an automated regulatory compliance notification issued pursuant to the PCMLTFA and FINTRAC guidelines.

Please direct all inquiries through the Secure Message Centre within your WebBroker account.



© 2026 TD Direct Investing. All rights reserved. TD Direct Investing is a division of TD Waterhouse Canada Inc., a subsidiary of The Toronto-Dominion Bank.

Dementia food spam

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Tue, 21 Jul 2026 17:48:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wmKBL-000000002GM-0VI6

for dave@doctor.nl2k.ab.ca;

Tue, 21 Jul 2026 17:47:27 -0600

Resent-From: The Doctor

Resent-Date: Tue, 21 Jul 2026 17:47:26 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from ometv.website ([185.75.242.29]:60029)

by doctor.nl2k.ab.ca with esmtp (Exim 4.99.3 (FreeBSD))

id 1wmHrU-00000000E3s-2aPR

for doctor@doctor.nl2k.ab.ca;

Tue, 21 Jul 2026 15:18:56 -0600

DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; s=smtp; d=doctor.nl2k.ab.ca;

h=Date:To:From:Subject:Content-Type:Mime-Version; i=doctor@doctor.nl2k.ab.ca;

bh=DtgOmF14lMwohW+3G8Btix+iuBk=;

b=m3qAzejpoBRqYietXyww5Ht+e5JLdXAvqqAWlx5DUiFSxIexsdWb8PildouC818zlUjHh/UAw/0u

NmTVM2vEinaRK9uGrf43U4qAV+blDOtW3QcSEqCzbAg6k9RObfY/Q3+kv9zTTG1VRpj8DhDvjvV2

4obgo9nQBZl607DNoR3wM4C1O1HyRTMOXfXUhtu0yzYIzeAIwjisYS00AGnm5zDQG7mbynOCC6C6

uivGtE8nphyEPx8y1ebgw7YjoF5iw0Ah58mbM2DNjUjhx0x1/Agvz3bC88jS0jOX1MMpEfEKu9BI

eI4CXOgXRIZ/8pQsmOHf+u/yNYDYWg45+iD3yA==

DomainKey-Signature: a=rsa-sha1; c=nofws; q=dns; s=smtp; d=doctor.nl2k.ab.ca;

b=CyWHphdv9YbxYWkSA80drA48s2st5bcCcf7qkCo9Co/N+GeYgfPcbh0vxuD33gZZPWAbptlgeg+n

wYiJ69HhOYx3IrGvpAt3If2Vl5H7y9L6hSO0PX7IloikuA1FN+boJUeDCOxnC9Y+2LpFIBNMCy4b

/GegEuf+6vAZFzkmo37M1yYGRk/GaRTf+x5+tFbggMw/d2nM5h5AZUB9cvUmYb18lb7UUZUBUjH6

xYTE0riEQ+uVyOaNXGFyacY0KWgtvw33KnGLFOMpKs53YpvwCnOMwv4zBn4RmPujkxooYWGDFxY0

5O626JzFIaZwImrUXDsDv8i7DCCglolRzNkO3A==;

Date: Tue, 21 Jul 2026 21:17:59 +0000

To: doctor@doctor.nl2k.ab.ca

From: MemoryLoss

Subject: Throw Out These 4 Summer Dishes Immediately (Dementia Risk)

Content-Type: text/html

Mime-Version: 1.0

X-Spam_score: 10.9

X-Spam_score_int: 109

X-Spam_bar: ++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: 4 Common Summer Dishes that Increase Dementia Risk (Throw

these out today!) If you're planning on having any of these 4 classic summer

favorites at your next cookout...



Content analysis details: (10.9 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

0.1 MISSING_MID Missing Message-Id: header

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[185.75.242.29 listed in dnsbl.ahbl.org]

[185.75.242.29 listed in dnsbl.ahbl.org]

[185.75.242.29 listed in dnsbl.ahbl.org]

[185.75.242.29 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[185.75.242.29 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[185.75.242.29 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[185.75.242.29 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[185.75.242.29 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[185.75.242.29 listed in will-spam-for-food.eu.org]

[185.75.242.29 listed in will-spam-for-food.eu.org]

[185.75.242.29 listed in will-spam-for-food.eu.org]

[185.75.242.29 listed in will-spam-for-food.eu.org]

[185.75.242.29 listed in will-spam-for-food.eu.org]

[185.75.242.29 listed in will-spam-for-food.eu.org]

[185.75.242.29 listed in will-spam-for-food.eu.org]

[185.75.242.29 listed in will-spam-for-food.eu.org]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[185.75.242.29 listed in bl.score.senderscore.com]

1.9 URIBL_ABUSE_SURBL Contains an URL listed in the ABUSE SURBL blocklist

[URI: 89.252.175.132]

1.9 URIBL_JP_SURBL Contains an URL listed in the JP SURBL blocklist

[URI: 89.252.175.132]

-0.0 SPF_HELO_PASS SPF: HELO matches SPF record

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

0.0 NORMAL_HTTP_TO_IP URI: URI host has a public dotted-decimal IPv4

address

0.0 HTML_MESSAGE BODY: HTML included in message

1.3 HTML_IMAGE_ONLY_24 BODY: HTML: images with 2000-2400 bytes of words

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

2.5 STY_INVIS_DIRECT HTML hidden text + direct-to-MX

0.0 TO_EQ_FM_HTML_DIRECT To == From and HTML only, direct-to-MX

0.4 TO_EQ_FM_DIRECT_MX To == From and direct-to-MX

Subject: {SPAM?} Throw Out These 4 Summer Dishes Immediately (Dementia Risk)































4 Common Summer Dishes that Increase Dementia Risk (Throw these out today!)






src="https://pbs.twimg.com/media/HNx6ROkW0AAIec-?format=png&name=small">





If you're planning on having any of these 4 classic summer favorites at your next cookout...





You need to stop everything and throw these out immediately.





Because these common foods increase your dementia risk significantly.



The answer may shock you...





Which one should you throw away?







A. Cheeseburgers


B. Corn on the Cob


C. Macaroni Salad


D. Watermelon


E. All of the Above
















Unsubscribe


3100 Technology Dr, Suite 200 Plano Texas 75047




src="http://89.252.175.132/track/3Frqcm1711DHWw18gjbfbkysyq27NUNNOKCASVDNDHG7910EGCT322b1"

width="1"

height="1"

border="0"

alt=""

style="display:none;">

Dementia food spam

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Tue, 21 Jul 2026 17:48:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wmKBH-000000002Fv-13Vl

for dave@doctor.nl2k.ab.ca;

Tue, 21 Jul 2026 17:47:23 -0600

Resent-From: The Doctor

Resent-Date: Tue, 21 Jul 2026 17:47:23 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from ometv.website ([185.75.242.29]:45059)

by doctor.nl2k.ab.ca with esmtp (Exim 4.99.3 (FreeBSD))

id 1wmHrP-00000000E1a-2V1l

for doctor@nl2k.ab.ca;

Tue, 21 Jul 2026 15:18:52 -0600

DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; s=smtp; d=nl2k.ab.ca;

h=Date:To:From:Subject:Content-Type:Mime-Version; i=doctor@nl2k.ab.ca;

bh=hf9bcquDfOcP4B+BGDda26IhuG0=;

b=DTkr9zN6VcBoYA1Fea0cO+mt9ibDal6h3nKgqmFHMdkigmzJyxWaJrUNgmf1RmirBF9a0lAGBFQd

t8bd+xrEFTRb4kUaXT2cl+NLL6hsV7Fe+36yLSYhyuuh5LbQtFlQpBSyyiV1lQ+xpxg1175Swt37

ei3w+SWA/j22LZtPsQ46wfz8p9RCS07Tm/VeXv5H+WtDTp5BsP9uozIhxXzr2chQSSDP9fyaOl8i

Ly9aqYzIsrpRjd/6EkEFc/8OaLOkeNsc/nu4sgEXayHR0dGAE4Y4ihsgZ+5yDIxP9rUSQAmy6Kbo

6ZtIP3BWlxmZ6qqaW0Wf8/YNuc8QjNFTYlpC8g==

DomainKey-Signature: a=rsa-sha1; c=nofws; q=dns; s=smtp; d=nl2k.ab.ca;

b=f6A4dBYgDHkjaBaB4HdGyM5d8NhS+Y+3HIfwXkyxgkwaobvFMmCdupKy+X5wMnMEDwb7pXn87JdE

4AHfH266qzafFNRC1VV6xUnnODa9fOuOwreFxs7X3WiMiCp00oWZaqYufQcZ9kyoAAbegxdwkMzw

3NaLCA8+5OKDiGvY/L2/mTDrsPzok/is+vpja5UmiU0+8/YcplLcwpvLbHTxQhRQ2YXl9Fjej7va

WXbWa535Grm+upTkqKHR65KRmcYOVojAHqYTj8p+GdLXgbHWmkjjLUj8W3TE9OxITlDN/ldLbA9Q

0+gfu0cyce7NGeIruq76AFfplPGvCUJrQ+Xvwg==;

Date: Tue, 21 Jul 2026 21:17:45 +0000

To: doctor@nl2k.ab.ca

From: MemoryLoss

Subject: Throw Out These 4 Summer Dishes Immediately (Dementia Risk)

Content-Type: text/html

Mime-Version: 1.0

X-Spam_score: 10.9

X-Spam_score_int: 109

X-Spam_bar: ++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: 4 Common Summer Dishes that Increase Dementia Risk (Throw

these out today!) If you're planning on having any of these 4 classic summer

favorites at your next cookout...



Content analysis details: (10.9 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

0.1 MISSING_MID Missing Message-Id: header

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[185.75.242.29 listed in dnsbl.ahbl.org]

[185.75.242.29 listed in dnsbl.ahbl.org]

[185.75.242.29 listed in dnsbl.ahbl.org]

[185.75.242.29 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[185.75.242.29 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[185.75.242.29 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[185.75.242.29 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[185.75.242.29 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[185.75.242.29 listed in will-spam-for-food.eu.org]

[185.75.242.29 listed in will-spam-for-food.eu.org]

[185.75.242.29 listed in will-spam-for-food.eu.org]

[185.75.242.29 listed in will-spam-for-food.eu.org]

[185.75.242.29 listed in will-spam-for-food.eu.org]

[185.75.242.29 listed in will-spam-for-food.eu.org]

[185.75.242.29 listed in will-spam-for-food.eu.org]

[185.75.242.29 listed in will-spam-for-food.eu.org]

1.9 URIBL_ABUSE_SURBL Contains an URL listed in the ABUSE SURBL blocklist

[URI: 89.252.175.132]

1.9 URIBL_JP_SURBL Contains an URL listed in the JP SURBL blocklist

[URI: 89.252.175.132]

-0.0 SPF_HELO_PASS SPF: HELO matches SPF record

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[185.75.242.29 listed in bl.score.senderscore.com]

0.0 NORMAL_HTTP_TO_IP URI: URI host has a public dotted-decimal IPv4

address

0.0 HTML_MESSAGE BODY: HTML included in message

1.3 HTML_IMAGE_ONLY_24 BODY: HTML: images with 2000-2400 bytes of words

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

0.4 TO_EQ_FM_DIRECT_MX To == From and direct-to-MX

2.5 STY_INVIS_DIRECT HTML hidden text + direct-to-MX

0.0 TO_EQ_FM_HTML_DIRECT To == From and HTML only, direct-to-MX

Subject: {SPAM?} Throw Out These 4 Summer Dishes Immediately (Dementia Risk)































4 Common Summer Dishes that Increase Dementia Risk (Throw these out today!)






src="https://pbs.twimg.com/media/HNx6ROkW0AAIec-?format=png&name=small">





If you're planning on having any of these 4 classic summer favorites at your next cookout...





You need to stop everything and throw these out immediately.





Because these common foods increase your dementia risk significantly.



The answer may shock you...





Which one should you throw away?







A. Cheeseburgers


B. Corn on the Cob


C. Macaroni Salad


D. Watermelon


E. All of the Above
















Unsubscribe


3100 Technology Dr, Suite 200 Plano Texas 75047




src="http://89.252.175.132/track/3CyfAj1711sctk18atpuhvevet27AMVFEGHQPTDOVGV1697EIWQ322F1"

width="1"

height="1"

border="0"

alt=""

style="display:none;">

Dementia food spam

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Tue, 21 Jul 2026 17:48:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wmKBA-000000002FH-1Ymh

for dave@doctor.nl2k.ab.ca;

Tue, 21 Jul 2026 17:47:16 -0600

Resent-From: The Doctor

Resent-Date: Tue, 21 Jul 2026 17:47:16 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from ometv.website ([185.75.242.29]:48585)

by doctor.nl2k.ab.ca with esmtp (Exim 4.99.3 (FreeBSD))

id 1wmHp5-00000000Dln-2ZoW

for games@nl2k.ab.ca;

Tue, 21 Jul 2026 15:16:33 -0600

DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; s=smtp; d=nl2k.ab.ca;

h=Date:To:From:Subject:Content-Type:Mime-Version; i=games@nl2k.ab.ca;

bh=j2dehRmMfdUPwVWO69ff9ZTmerA=;

b=Ijd6w7Dv2rXx2zjYa9Z06XJnBlCMB7W5ndCR4jMYnkt6cDzUvn92A0Z4jpk9N3Hdnr7zcWpvbljj

0D6YkpMf+1fzatPlyNO03cT+L9/9q4pzwczQRlWEw25/RFvZpSMcOL+lZkPk5WpuFooZPdnz8Tfy

FXN6X1VdYpqRgjZcmqyw7H16tkT+jsTGPCu9axW/J0AZGQHSL+qojT7keg4a6OlAXihFnkOt79HF

n4/UMdeQwA1HEi1IhGPbo8oGabrvQA+0MhvMTN7smpVdZCgj+SXK90kopWLCxdO3l2lHVJrComrK

DUVnfl3nYDAB31sqrrKkKhZCwEKvhzyytEzIiQ==

DomainKey-Signature: a=rsa-sha1; c=nofws; q=dns; s=smtp; d=nl2k.ab.ca;

b=jgtWf772EEB5bBYGS7xl1sVCcN6ktfwN4u1dAhBzqQ4iY/ScnxqVUvKgEcPLamWKSJB5aai37qD+

XFt0aLzCRQoWaP9+M8SdMdjw1CRXIgo+7CLMlW+ID2cFbwZZmeM9vxD4G8iAumcYsBLgVzUTrLlc

chb2e8pfNeSKb5axhpglSgb/q491FjZINK93DDoabkfQ1EHxH48WsuNPmpz0RMVZbjDDfog5pwA4

U5OQk1LW9akeJ3/PCYupt7XXlpwufFLX+Y7dQaIRVgYOrdcmCMqyyOy43C4ed4QCkNZpOWT5sV67

kNx1oD8ppyFd8/B7xZSwNpH+EBvOwixgxWbF3g==;

Date: Tue, 21 Jul 2026 21:15:42 +0000

To: games@nl2k.ab.ca

From: MemoryLoss

Subject: Throw Out These 4 Summer Dishes Immediately (Dementia Risk)

Content-Type: text/html

Mime-Version: 1.0

X-Spam_score: 10.9

X-Spam_score_int: 109

X-Spam_bar: ++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: 4 Common Summer Dishes that Increase Dementia Risk (Throw

these out today!) If you're planning on having any of these 4 classic summer

favorites at your next cookout...



Content analysis details: (10.9 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

0.1 MISSING_MID Missing Message-Id: header

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[185.75.242.29 listed in dnsbl.ahbl.org]

[185.75.242.29 listed in dnsbl.ahbl.org]

[185.75.242.29 listed in dnsbl.ahbl.org]

[185.75.242.29 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[185.75.242.29 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[185.75.242.29 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[185.75.242.29 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[185.75.242.29 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[185.75.242.29 listed in will-spam-for-food.eu.org]

[185.75.242.29 listed in will-spam-for-food.eu.org]

[185.75.242.29 listed in will-spam-for-food.eu.org]

[185.75.242.29 listed in will-spam-for-food.eu.org]

[185.75.242.29 listed in will-spam-for-food.eu.org]

[185.75.242.29 listed in will-spam-for-food.eu.org]

[185.75.242.29 listed in will-spam-for-food.eu.org]

[185.75.242.29 listed in will-spam-for-food.eu.org]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[185.75.242.29 listed in bl.score.senderscore.com]

1.9 URIBL_JP_SURBL Contains an URL listed in the JP SURBL blocklist

[URI: 89.252.175.132]

1.9 URIBL_ABUSE_SURBL Contains an URL listed in the ABUSE SURBL blocklist

[URI: 89.252.175.132]

-0.0 SPF_HELO_PASS SPF: HELO matches SPF record

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

0.0 NORMAL_HTTP_TO_IP URI: URI host has a public dotted-decimal IPv4

address

0.0 HTML_MESSAGE BODY: HTML included in message

1.3 HTML_IMAGE_ONLY_24 BODY: HTML: images with 2000-2400 bytes of words

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

0.4 TO_EQ_FM_DIRECT_MX To == From and direct-to-MX

0.0 TO_EQ_FM_HTML_DIRECT To == From and HTML only, direct-to-MX

2.5 STY_INVIS_DIRECT HTML hidden text + direct-to-MX

Subject: {SPAM?} Throw Out These 4 Summer Dishes Immediately (Dementia Risk)































4 Common Summer Dishes that Increase Dementia Risk (Throw these out today!)






src="https://pbs.twimg.com/media/HNx6ROkW0AAIec-?format=png&name=small">





If you're planning on having any of these 4 classic summer favorites at your next cookout...





You need to stop everything and throw these out immediately.





Because these common foods increase your dementia risk significantly.



The answer may shock you...





Which one should you throw away?







A. Cheeseburgers


B. Corn on the Cob


C. Macaroni Salad


D. Watermelon


E. All of the Above
















Unsubscribe


3100 Technology Dr, Suite 200 Plano Texas 75047




src="http://89.252.175.132/track/3zdSaz1711zzhf18wacoilqmjn30ZPCBACEPOMXANNN82475TSER322n1"

width="1"

height="1"

border="0"

alt=""

style="display:none;">

Dementia food spam

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Tue, 21 Jul 2026 17:48:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wmKB1-000000002EH-3Ray

for dave@doctor.nl2k.ab.ca;

Tue, 21 Jul 2026 17:47:07 -0600

Resent-From: The Doctor

Resent-Date: Tue, 21 Jul 2026 17:47:07 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from ometv.website ([185.75.242.29]:38939)

by doctor.nl2k.ab.ca with esmtp (Exim 4.99.3 (FreeBSD))

id 1wmHp5-00000000DlZ-2Zlk

for root@nl2k.ab.ca;

Tue, 21 Jul 2026 15:16:33 -0600

DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; s=smtp; d=nl2k.ab.ca;

h=Date:To:From:Subject:Content-Type:Mime-Version; i=root@nl2k.ab.ca;

bh=CvzJmKkqOwNzjqinjrVOSgNGXUU=;

b=JWZLiyi8Amw0op2HQSClZD3JTl6a1O2euMg82O3z7kjE34qh0m6e6ABD92hOU9icIhApkkbONWzt

4yxG5ZObPJqNubsVslDIHZSBtH2FAHv0N6IvxH45p177IVjHuN+xL1KfEvUvy1j5z9VXJ50AF1Ic

xmZvi65HtDITFk12aSuCr8OMxqgqxATF26ZtyY+vQIp6i2C/NRRo/nrODGxxgr8oFL+25fbhHsaq

/MYAgfYA6QRKwh9Tcl5iVnjpS4D2OFCsPk5DnwmzuFzOMgzURKKDeKvWqbrRsIn1su5Ns5yskuCn

jCeMYHZv0n1gIiLMrsMgRSDIXgLbNMCdMUKbgw==

DomainKey-Signature: a=rsa-sha1; c=nofws; q=dns; s=smtp; d=nl2k.ab.ca;

b=XcmL/2eLf5WM3S9AR89tetrDY+eLwzfsoyjs9Tq4zvXV/vUJq8UbzTzpMX+xsR9vSmf7fsfapTMT

L+LWm1E9Fb8cr3nIpw7UwwR66HRygXlJ8isXswV4/+DcokN0pGapjIDi0HvzF7XkKFSYxHsmBSBc

vMFtH0eHIX0uJGwBTtgMb1wHkwfidxnl0KwBXHyt+tcDkpZ+6Ib3t25KGw0l4U/w/8oUY5AHtUhL

0RF0gTrgU7kQKuqSRxoItxP42/s/hcDgX5AgeDbS+miUU5JRFYWv0I1XCrCkuLk6aJCd7MtHVBv4

qmHkpAyVyJEYtIiK0dv4dKvaMEGRqgPI4cgC4Q==;

Date: Tue, 21 Jul 2026 21:15:42 +0000

To: root@nl2k.ab.ca

From: MemoryLoss

Subject: Throw Out These 4 Summer Dishes Immediately (Dementia Risk)

Content-Type: text/html

Mime-Version: 1.0

X-Spam_score: 10.9

X-Spam_score_int: 109

X-Spam_bar: ++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: 4 Common Summer Dishes that Increase Dementia Risk (Throw

these out today!) If you're planning on having any of these 4 classic summer

favorites at your next cookout...



Content analysis details: (10.9 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

0.1 MISSING_MID Missing Message-Id: header

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[185.75.242.29 listed in dnsbl.ahbl.org]

[185.75.242.29 listed in dnsbl.ahbl.org]

[185.75.242.29 listed in dnsbl.ahbl.org]

[185.75.242.29 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[185.75.242.29 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[185.75.242.29 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[185.75.242.29 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[185.75.242.29 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[185.75.242.29 listed in will-spam-for-food.eu.org]

[185.75.242.29 listed in will-spam-for-food.eu.org]

[185.75.242.29 listed in will-spam-for-food.eu.org]

[185.75.242.29 listed in will-spam-for-food.eu.org]

[185.75.242.29 listed in will-spam-for-food.eu.org]

[185.75.242.29 listed in will-spam-for-food.eu.org]

[185.75.242.29 listed in will-spam-for-food.eu.org]

[185.75.242.29 listed in will-spam-for-food.eu.org]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[185.75.242.29 listed in bl.score.senderscore.com]

1.9 URIBL_ABUSE_SURBL Contains an URL listed in the ABUSE SURBL blocklist

[URI: 89.252.175.132]

1.9 URIBL_JP_SURBL Contains an URL listed in the JP SURBL blocklist

[URI: 89.252.175.132]

-0.0 SPF_HELO_PASS SPF: HELO matches SPF record

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

0.0 NORMAL_HTTP_TO_IP URI: URI host has a public dotted-decimal IPv4

address

0.0 HTML_MESSAGE BODY: HTML included in message

1.3 HTML_IMAGE_ONLY_24 BODY: HTML: images with 2000-2400 bytes of words

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

2.5 STY_INVIS_DIRECT HTML hidden text + direct-to-MX

0.0 TO_EQ_FM_HTML_DIRECT To == From and HTML only, direct-to-MX

0.4 TO_EQ_FM_DIRECT_MX To == From and direct-to-MX

Subject: {SPAM?} Throw Out These 4 Summer Dishes Immediately (Dementia Risk)































4 Common Summer Dishes that Increase Dementia Risk (Throw these out today!)






src="https://pbs.twimg.com/media/HNx6ROkW0AAIec-?format=png&name=small">





If you're planning on having any of these 4 classic summer favorites at your next cookout...





You need to stop everything and throw these out immediately.





Because these common foods increase your dementia risk significantly.



The answer may shock you...





Which one should you throw away?







A. Cheeseburgers


B. Corn on the Cob


C. Macaroni Salad


D. Watermelon


E. All of the Above
















Unsubscribe


3100 Technology Dr, Suite 200 Plano Texas 75047




src="http://89.252.175.132/track/3bRjfM1711RiCn18mdaizrlahc30KFPNOFPJOPENYLV80607LXLX322Z1"

width="1"

height="1"

border="0"

alt=""

style="display:none;">

Dimentia phish spam

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Tue, 21 Jul 2026 17:48:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wmKAy-000000002Dq-03Xp

for dave@doctor.nl2k.ab.ca;

Tue, 21 Jul 2026 17:47:04 -0600

Resent-From: The Doctor

Resent-Date: Tue, 21 Jul 2026 17:47:03 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from ometv.website ([185.75.242.29]:59189)

by doctor.nl2k.ab.ca with esmtp (Exim 4.99.3 (FreeBSD))

id 1wmHp5-00000000DkC-2ZeC

for support@nk.ca;

Tue, 21 Jul 2026 15:16:33 -0600

DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; s=smtp; d=nk.ca;

h=Date:To:From:Subject:Content-Type:Mime-Version; i=support@nk.ca;

bh=Yqcgkv+YGPchITDkpPIwUfuDK38=;

b=OTDAJEAvEU8QUeVR4Fu/cxx7ceRpy8XjdcvSzu6dk3Q33UYdWf9EJkTH/R7TvMW+qCBPB7kZw9Q3

2kh9WiBN5DKXK1nAtS1ScsLzXk681IL5zaMjR619daVI5nNw1X3gCpT1AtbSzHmd/BzZIzBvJQk8

YHwFS8mgBwiIcM4ExkDUAmr/Qch2102X54kQm4Vo29io7j5ykZopyZnKVfdynyeTu82J7imF+j2Z

ul0RYz9gEkP4Qcv4A1H4hOcirvjLDnLS6PkPOUzktIaNd/gih1IvDcZlTQXX+ZldfvZVKO3GycJ5

P2c4UkwnRzeSSTIeXmHg9DEMOKYsO+mKwNsXLQ==

DomainKey-Signature: a=rsa-sha1; c=nofws; q=dns; s=smtp; d=nk.ca;

b=g+gF3TYZsANeXbC8hODk8BH9q/d0c/wk0QI0+fPKSG6R/gisHCB/PoPekGsyCd9CSpWSnY5eT2Hw

+lg+MIr2Zk5L2zqYyfs6vgmqZC6rVHBpecgKDOG2gKGSHExWyZ5bxa1jTpjeJH6eV7p7vy67a6YT

8CM5OmbQJNhVE27oiR/gos82eO4I3dsZNOy+i6ljv2aQnpaqmwWpiJyMzowmrMRuHCmAHiP4IRcm

tAvlmd6D+neV48947NNmkONbX3vmMj5uyY882Z6Libwc9C9QyuBW6Y6/QUFXtMQ3Ci/fYNGHtsgn

H0L/K0xKeqEhXlX3Axlq57CmXb+KHi5T1fsXMQ==;

Date: Tue, 21 Jul 2026 21:15:30 +0000

To: support@nk.ca

From: MemoryLoss

Subject: Throw Out These 4 Summer Dishes Immediately (Dementia Risk)

Content-Type: text/html

Mime-Version: 1.0

X-Spam_score: 10.9

X-Spam_score_int: 109

X-Spam_bar: ++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: 4 Common Summer Dishes that Increase Dementia Risk (Throw

these out today!) If you're planning on having any of these 4 classic summer

favorites at your next cookout...



Content analysis details: (10.9 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

0.1 MISSING_MID Missing Message-Id: header

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[185.75.242.29 listed in dnsbl.ahbl.org]

[185.75.242.29 listed in dnsbl.ahbl.org]

[185.75.242.29 listed in dnsbl.ahbl.org]

[185.75.242.29 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[185.75.242.29 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[185.75.242.29 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[185.75.242.29 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[185.75.242.29 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[185.75.242.29 listed in will-spam-for-food.eu.org]

[185.75.242.29 listed in will-spam-for-food.eu.org]

[185.75.242.29 listed in will-spam-for-food.eu.org]

[185.75.242.29 listed in will-spam-for-food.eu.org]

[185.75.242.29 listed in will-spam-for-food.eu.org]

[185.75.242.29 listed in will-spam-for-food.eu.org]

[185.75.242.29 listed in will-spam-for-food.eu.org]

[185.75.242.29 listed in will-spam-for-food.eu.org]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[185.75.242.29 listed in bl.score.senderscore.com]

1.9 URIBL_ABUSE_SURBL Contains an URL listed in the ABUSE SURBL blocklist

[URI: 89.252.175.132]

1.9 URIBL_JP_SURBL Contains an URL listed in the JP SURBL blocklist

[URI: 89.252.175.132]

-0.0 SPF_HELO_PASS SPF: HELO matches SPF record

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

0.0 NORMAL_HTTP_TO_IP URI: URI host has a public dotted-decimal IPv4

address

0.0 HTML_MESSAGE BODY: HTML included in message

1.3 HTML_IMAGE_ONLY_24 BODY: HTML: images with 2000-2400 bytes of words

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

0.4 TO_EQ_FM_DIRECT_MX To == From and direct-to-MX

2.5 STY_INVIS_DIRECT HTML hidden text + direct-to-MX

0.0 TO_EQ_FM_HTML_DIRECT To == From and HTML only, direct-to-MX

Subject: {SPAM?} Throw Out These 4 Summer Dishes Immediately (Dementia Risk)































4 Common Summer Dishes that Increase Dementia Risk (Throw these out today!)






src="https://pbs.twimg.com/media/HNx6ROkW0AAIec-?format=png&name=small">





If you're planning on having any of these 4 classic summer favorites at your next cookout...





You need to stop everything and throw these out immediately.





Because these common foods increase your dementia risk significantly.



The answer may shock you...





Which one should you throw away?







A. Cheeseburgers


B. Corn on the Cob


C. Macaroni Salad


D. Watermelon


E. All of the Above
















Unsubscribe


3100 Technology Dr, Suite 200 Plano Texas 75047




src="http://89.252.175.132/track/3XnJsN1711Bhki18yoepydwldy30ELCXIMPTSVSRFNW67625YHKU322k1"

width="1"

height="1"

border="0"

alt=""

style="display:none;">

dementia risk spam

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Tue, 21 Jul 2026 17:48:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wmKAy-000000002Dq-03Xp

for dave@doctor.nl2k.ab.ca;

Tue, 21 Jul 2026 17:47:04 -0600

Resent-From: The Doctor

Resent-Date: Tue, 21 Jul 2026 17:47:03 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from ometv.website ([185.75.242.29]:59189)

by doctor.nl2k.ab.ca with esmtp (Exim 4.99.3 (FreeBSD))

id 1wmHp5-00000000DkC-2ZeC

for support@nk.ca;

Tue, 21 Jul 2026 15:16:33 -0600

DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; s=smtp; d=nk.ca;

h=Date:To:From:Subject:Content-Type:Mime-Version; i=support@nk.ca;

bh=Yqcgkv+YGPchITDkpPIwUfuDK38=;

b=OTDAJEAvEU8QUeVR4Fu/cxx7ceRpy8XjdcvSzu6dk3Q33UYdWf9EJkTH/R7TvMW+qCBPB7kZw9Q3

2kh9WiBN5DKXK1nAtS1ScsLzXk681IL5zaMjR619daVI5nNw1X3gCpT1AtbSzHmd/BzZIzBvJQk8

YHwFS8mgBwiIcM4ExkDUAmr/Qch2102X54kQm4Vo29io7j5ykZopyZnKVfdynyeTu82J7imF+j2Z

ul0RYz9gEkP4Qcv4A1H4hOcirvjLDnLS6PkPOUzktIaNd/gih1IvDcZlTQXX+ZldfvZVKO3GycJ5

P2c4UkwnRzeSSTIeXmHg9DEMOKYsO+mKwNsXLQ==

DomainKey-Signature: a=rsa-sha1; c=nofws; q=dns; s=smtp; d=nk.ca;

b=g+gF3TYZsANeXbC8hODk8BH9q/d0c/wk0QI0+fPKSG6R/gisHCB/PoPekGsyCd9CSpWSnY5eT2Hw

+lg+MIr2Zk5L2zqYyfs6vgmqZC6rVHBpecgKDOG2gKGSHExWyZ5bxa1jTpjeJH6eV7p7vy67a6YT

8CM5OmbQJNhVE27oiR/gos82eO4I3dsZNOy+i6ljv2aQnpaqmwWpiJyMzowmrMRuHCmAHiP4IRcm

tAvlmd6D+neV48947NNmkONbX3vmMj5uyY882Z6Libwc9C9QyuBW6Y6/QUFXtMQ3Ci/fYNGHtsgn

H0L/K0xKeqEhXlX3Axlq57CmXb+KHi5T1fsXMQ==;

Date: Tue, 21 Jul 2026 21:15:30 +0000

To: support@nk.ca

From: MemoryLoss

Subject: Throw Out These 4 Summer Dishes Immediately (Dementia Risk)

Content-Type: text/html

Mime-Version: 1.0

X-Spam_score: 10.9

X-Spam_score_int: 109

X-Spam_bar: ++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: 4 Common Summer Dishes that Increase Dementia Risk (Throw

these out today!) If you're planning on having any of these 4 classic summer

favorites at your next cookout...



Content analysis details: (10.9 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

0.1 MISSING_MID Missing Message-Id: header

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[185.75.242.29 listed in dnsbl.ahbl.org]

[185.75.242.29 listed in dnsbl.ahbl.org]

[185.75.242.29 listed in dnsbl.ahbl.org]

[185.75.242.29 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[185.75.242.29 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[185.75.242.29 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[185.75.242.29 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[185.75.242.29 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[185.75.242.29 listed in will-spam-for-food.eu.org]

[185.75.242.29 listed in will-spam-for-food.eu.org]

[185.75.242.29 listed in will-spam-for-food.eu.org]

[185.75.242.29 listed in will-spam-for-food.eu.org]

[185.75.242.29 listed in will-spam-for-food.eu.org]

[185.75.242.29 listed in will-spam-for-food.eu.org]

[185.75.242.29 listed in will-spam-for-food.eu.org]

[185.75.242.29 listed in will-spam-for-food.eu.org]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[185.75.242.29 listed in bl.score.senderscore.com]

1.9 URIBL_ABUSE_SURBL Contains an URL listed in the ABUSE SURBL blocklist

[URI: 89.252.175.132]

1.9 URIBL_JP_SURBL Contains an URL listed in the JP SURBL blocklist

[URI: 89.252.175.132]

-0.0 SPF_HELO_PASS SPF: HELO matches SPF record

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

0.0 NORMAL_HTTP_TO_IP URI: URI host has a public dotted-decimal IPv4

address

0.0 HTML_MESSAGE BODY: HTML included in message

1.3 HTML_IMAGE_ONLY_24 BODY: HTML: images with 2000-2400 bytes of words

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

0.4 TO_EQ_FM_DIRECT_MX To == From and direct-to-MX

2.5 STY_INVIS_DIRECT HTML hidden text + direct-to-MX

0.0 TO_EQ_FM_HTML_DIRECT To == From and HTML only, direct-to-MX

Subject: {SPAM?} Throw Out These 4 Summer Dishes Immediately (Dementia Risk)































4 Common Summer Dishes that Increase Dementia Risk (Throw these out today!)






src="https://pbs.twimg.com/media/HNx6ROkW0AAIec-?format=png&name=small">





If you're planning on having any of these 4 classic summer favorites at your next cookout...





You need to stop everything and throw these out immediately.





Because these common foods increase your dementia risk significantly.



The answer may shock you...





Which one should you throw away?







A. Cheeseburgers


B. Corn on the Cob


C. Macaroni Salad


D. Watermelon


E. All of the Above
















Unsubscribe


3100 Technology Dr, Suite 200 Plano Texas 75047




src="http://89.252.175.132/track/3XnJsN1711Bhki18yoepydwldy30ELCXIMPTSVSRFNW67625YHKU322k1"

width="1"

height="1"

border="0"

alt=""

style="display:none;">

Remittance phish from Google Gmail

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Tue, 21 Jul 2026 17:47:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wmKAb-000000002BG-1TxS

for dave@doctor.nl2k.ab.ca;

Tue, 21 Jul 2026 17:46:41 -0600

Resent-From: The Doctor

Resent-Date: Tue, 21 Jul 2026 17:46:41 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-vs1-f102.google.com ([209.85.217.102]:42402)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wmHJC-00000000Ap2-1eu4

for www@doctor.nl2k.ab.ca;

Tue, 21 Jul 2026 14:43:30 -0600

Received: by mail-vs1-f102.google.com with SMTP id ada2fe7eead31-74ae4c75b20so39731137.1

for ; Tue, 21 Jul 2026 13:42:35 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=sabeng.it; s=google; t=1784666549; x=1785271349; darn=doctor.nl2k.ab.ca;

h=content-type:mime-version:date:content-transfer-encoding:message-id

:subject:to:from:from:to:cc:subject:date:message-id:reply-to

:content-type;

bh=gtTqX7uwZlIbh+qFXRAx+1h9XmOlRP6X+7S5cGs/fow=;

b=FB3yXE1+6zvjpgxsD1gHSJ5VFqThdLIBx9LQZz2mm5oqcxFCqlkNhtfhGrmA7z8pqA

dM+nPu5VtzPXTZxZgYgbCSuk6XJAQfs73Q+tPS5emfcc+ZMYBjz1CH9Wb48DYVrOd+rm

qiw18Xa8LHpZxl5V1HuZrtvm5tkg/GFoxC/H0=

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20251104; t=1784666549; x=1785271349;

h=content-type:mime-version:date:content-transfer-encoding:message-id

:subject:to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date

:message-id:reply-to:content-type;

bh=gtTqX7uwZlIbh+qFXRAx+1h9XmOlRP6X+7S5cGs/fow=;

b=CfhlaPNWN80OUaMwdfUQcinyaBrybvFafjV6A2lAeN7mi5v0N/nri6ofsjv/NooAQA

BHg3APB6qlGeKyGgBQgF9jnoSA+Ll+XNxSs56x69OLiPXMT2qJvRe68//ENH5OSj6Ag3

ATGhjh9H3EnXjpnNabhvx56G35x47ELPVv+8MIWN50asC5ZWuPctTrMEWZTbx92pNAwk

IYjEvvAcJVJenMGYIkeB5OpXBHBaEroUSv1Wsq8fapE+ZtbC8QaU8BnpYD/Wg07muSn5

NqnYTDV+SRfpOgRBT7sibEG80yk/hDil+aulZihswcyYUqyRG+qH0bx+t5KEqdYlbr9g

/kHA==

X-Gm-Message-State: AOJu0YzF3FLRjcYZBFRdzOACS9VNaQVCHUo9gRP69Bo4qzcF6ybf8hOE

PecCyvQZxLtkzy2eGWIAL7znUUcYCuuYTSsO5Bcwx3TNAFmiSjP18AQwga0f6FBYWgD6LFotjxn

+kurTasrcPBEytGqfkMNukVgi0N2c8RjwktC++i9498Q3Pxs=

X-Gm-Gg: AR+sD121RUguiw+JnB83ZbhOtguFB1/fvrrkRjHi6kL9yfSNX1VjXgbtmUseCTj5Ypd

hE2WicHGLMCE+0lhNPBIM9gifF/Tc572cYLCL9/GDjsq1Dduul2EI7k7L7UKPrIkbbIfPAjWOqm

nmwqXvPUpVevARPIWdD7MXd9+PIZM3QHhIbL9QnMwDnqWhj00iOrUYnfv4iqELPfQLURNRzrdJb

8lcwL4WeQGDlj6fL4oUv4YjcBweMHwM7ebBEO1aICbK44L1ZWpR1iTAYH+oGgbE037cPzd9wdfw

ZWbVGRqt251gfyQy5rMvaFd++VXx/UhwyScyQJf7ulB/IgXV+IUNQLaEdr26LrouT0SmcTk4v0m

8e9g0moY=

X-Received: by 2002:a05:6102:5e8b:b0:6ef:dd17:a04b with SMTP id ada2fe7eead31-74ad17506f9mr595896137.13.1784666549452;

Tue, 21 Jul 2026 13:42:29 -0700 (PDT)

Received: from sabprogetti.com ([192.210.236.148])

by smtp-relay.gmail.com with ESMTPS id ada2fe7eead31-74ad3244e78sm54571137.7.2026.07.21.13.42.29

for

(version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256);

Tue, 21 Jul 2026 13:42:29 -0700 (PDT)

X-Relaying-Domain: sabeng.it

From: "alert@remittance.com | EFT Portal/OU=EXCHANGE ADMINISTRATIVE GROUP

(FYDIBOHF23SPDLT)/CN=RECIPIENTS/CN=B7A707497B564FD-62362"

To: www@doctor.nl2k.ab.ca

Subject: =?UTF-8?Q?ACH_Payment_Activity_Report_=EF=BF=BD_Tu?=

=?UTF-8?Q?es=2C_July_12=2C_2026_=EF=BF=BD_07/21/20?=

=?UTF-8?Q?26_=EF=BF=BD_www=40doctor=2Enl2k=2Eab=2E?= =?UTF-8?Q?ca?=

Message-ID: <963bde32-3ccc-df4d-b66a-f6310aa0b668@sabeng.it>

Content-Transfer-Encoding: quoted-printable

Date: Tue, 21 Jul 2026 20:42:27 +0000

MIME-Version: 1.0

Content-Type: text/html; charset=utf-8

X-Spam_score: 7.3

X-Spam_score_int: 73

X-Spam_bar: +++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview:  Payment Due: 21/07/2026 033847 Amount Paid: $2,355.00



Content analysis details: (7.3 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[192.210.236.148 listed in dnsbl.ahbl.org]

[192.210.236.148 listed in dnsbl.ahbl.org]

[192.210.236.148 listed in dnsbl.ahbl.org]

[192.210.236.148 listed in dnsbl.ahbl.org]

[209.85.217.102 listed in dnsbl.ahbl.org]

[209.85.217.102 listed in dnsbl.ahbl.org]

[209.85.217.102 listed in dnsbl.ahbl.org]

[209.85.217.102 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[192.210.236.148 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[192.210.236.148 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[192.210.236.148 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[192.210.236.148 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[192.210.236.148 listed in will-spam-for-food.eu.org]

[192.210.236.148 listed in will-spam-for-food.eu.org]

[192.210.236.148 listed in will-spam-for-food.eu.org]

[192.210.236.148 listed in will-spam-for-food.eu.org]

[192.210.236.148 listed in will-spam-for-food.eu.org]

[192.210.236.148 listed in will-spam-for-food.eu.org]

[192.210.236.148 listed in will-spam-for-food.eu.org]

[192.210.236.148 listed in will-spam-for-food.eu.org]

[209.85.217.102 listed in will-spam-for-food.eu.org]

[209.85.217.102 listed in will-spam-for-food.eu.org]

[209.85.217.102 listed in will-spam-for-food.eu.org]

[209.85.217.102 listed in will-spam-for-food.eu.org]

[209.85.217.102 listed in will-spam-for-food.eu.org]

[209.85.217.102 listed in will-spam-for-food.eu.org]

[209.85.217.102 listed in will-spam-for-food.eu.org]

[209.85.217.102 listed in will-spam-for-food.eu.org]

2.5 URIBL_DBL_SPAM Contains a spam URL listed in the DBL blocklist

[URI: aerrixon.com]

-0.0 SPF_PASS SPF: sender matches SPF record

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[209.85.217.102 listed in list.dnswl.org]

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[209.85.217.102 listed in wl.mailspike.net]

0.0 HTML_MESSAGE BODY: HTML included in message

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 NO_RDNS2 Sending MTA has no reverse DNS

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

2.0 RATWR8_MESSID Message-ID with excessive dashes and dollars

0.6 HTML_MIME_NO_HTML_TAG HTML-only message, but there is no HTML tag

0.0 LOTS_OF_MONEY Huge... sums of money

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[209.85.217.102 listed in bl.score.senderscore.com]

Subject: {SPAM?} =?UTF-8?Q?ACH_Payment_Activity_Report_=EF=BF=BD_Tu?=

=?UTF-8?Q?es=2C_July_12=2C_2026_=EF=BF=BD_07/21/20?=

=?UTF-8?Q?26_=EF=BF=BD_www=40doctor=2Enl2k=2Eab=2E?= =?UTF-8?Q?ca?=



=EF=BB=BF


 




, 255, 255);color:rgb(34, 34, 34);font-family:Arial, Helvetica, =

sans-serif;font-size:small;font-style:normal;font-variant-caps:normal;font-=

variant-ligatures:normal;font-weight:400;letter-spacing:normal;orphans:2;te=

xt-align:start;text-decoration-color:initial;text-decoration-style:initial;=

text-decoration-thickness:initial;text-indent:0px;text-transform:none;white=

-space:normal;widows:2;word-spacing:0px;" type=3D"cite">




t;" id=3D"m_-2910760642012011069m_467061415371348611m_4273285105508718137m_=

-599886662404354667editbody1">


7061415371348611m_4273285105508718137m_-599886662404354667v1editbody1">


m_467061415371348611m_4273285105508718137m_-599886662404354667v1v1editbody1=

">






-width:0px;font-family:Arial, Helvetica, sans-serif;font-feature-settings:&=

quot;liga" 0;font-size:small;line-height:normal;" cellspacing=3D"0" =

width=3D"553">




























10, 139, 168);border-width:0px;margin:0px;padding:0in;vertical-align:top;" =

colspan=3D"3">




style=3D"border-collapse:collapse;border-width:0px;font-family:-apple-syste=

m, BlinkMacSystemFont, "Helvetica Neue", "Segoe UI", =

Arial, sans-serif, "Apple Color Emoji", "Segoe UI =

Emoji", "Segoe UI Symbol";font-feature-settings:"liga&q=

uot; 0;font-size:13px;line-height:normal;" cellspacing=3D"0">




style=3D"height:5.25pt;">














style=3D"border-width:0px;height:5.25pt;margin:0px;padding:0in;"> 
>


style=3D"border-width:0px;margin:0px;padding:0in;width:0.25in;" =

width=3D"24"> 
style=3D"border-width:0px;margin:0px;padding:0in;">


style=3D"font-family:-apple-system, BlinkMacSystemFont, "Helvetica =

Neue", "Segoe UI", Arial, sans-serif, "Apple Color =

Emoji", "Segoe UI Emoji", "Segoe UI =

Symbol";margin:0px;">
sans-serif;font-size:13.5pt;">   





92, 208, 228);border-width:0px;margin:0px;padding:0in;width:1.5pt;" =

width=3D"2"> 
n:0px;padding:0in;">




style=3D"border-collapse:collapse;border-width:0px;font-family:-apple-syste=

m, BlinkMacSystemFont, "Helvetica Neue", "Segoe UI", =

Arial, sans-serif, "Apple Color Emoji", "Segoe UI =

Emoji", "Segoe UI Symbol";font-feature-settings:"liga&q=

uot; 0;font-size:13px;line-height:normal;" cellspacing=3D"0">












style=3D"background-color:rgb(230, 236, 244);border-width:0px;margin:0px;pa=

dding:0in;width:411.75pt;" width=3D"549">


class=3D"table" style=3D"width:411.75pt;">


style=3D"border-collapse:collapse;border-width:0px;font-family:-apple-syste=

m, BlinkMacSystemFont, "Helvetica Neue", "Segoe UI", =

Arial, sans-serif, "Apple Color Emoji", "Segoe UI =

Emoji", "Segoe UI Symbol";font-feature-settings:"liga&q=

uot; 0;line-height:normal;" cellspacing=3D"0" width=3D"549">

=



=



=



=



=



=



=



=



=



=



=



=



=



=



=


width=3D"24"> 
p;">

=


"Helvetica Neue", "Segoe UI", Arial, sans-serif, =

"Apple Color Emoji", "Segoe UI Emoji", "Segoe UI =

Symbol";margin:0px;">

64);font-family:Helvetica, sans-serif;font-size:13.5pt;">Payment&nb=

sp;   
style=3D"color:rgb(231,123,7);font-family:Helvetica, sans-serif;font-size:7=

.5pt;">Due: 21/07/2026

168);font-family:Helvetica, sans-serif;font-size:10.=

5pt;">033847



=
ttom;">

=


"Helvetica Neue", "Segoe UI", Arial, sans-serif, =

"Apple Color Emoji", "Segoe UI Emoji", "Segoe UI =

Symbol";margin:0px;text-align:right;">
62);font-family:Helvetica, sans-serif;font-size:10.5pt;">Amount =

Paid:  
62);font-family:Helvetica, sans-serif;font-size:22.5pt;">$2,355.=

00



=
width=3D"24"> 
=

 		 =

 		 =

 		 =

 









system, BlinkMacSystemFont, "Helvetica Neue", "Segoe =

UI", Arial, sans-serif, "Apple Color Emoji", "Segoe UI =

Emoji", "Segoe UI Symbol";margin:0px;"> 




style=3D"width:411.75pt;">


style=3D"border-collapse:collapse;border-width:0px;font-family:-apple-syste=

m, BlinkMacSystemFont, "Helvetica Neue", "Segoe UI", =

Arial, sans-serif, "Apple Color Emoji", "Segoe UI =

Emoji", "Segoe UI Symbol";font-feature-settings:"liga&q=

uot; 0;font-size:13px;line-height:normal;" cellspacing=3D"0" =

width=3D"549">












style=3D"border-width:0px;margin:0px;padding:0in;vertical-align:top;">


class=3D"table" style=3D"width:411.75pt;">


style=3D"border-bottom-style:solid;border-bottom-width:3pt;border-collapse:=

collapse;border-color:initial;border-left-style:none;border-left-width:medi=

um;border-right-style:none;border-right-width:medium;border-top-style:none;=

border-top-width:medium;font-family:-apple-system, BlinkMacSystemFont, =

"Helvetica Neue", "Segoe UI", Arial, sans-serif, =

"Apple Color Emoji", "Segoe UI Emoji", "Segoe UI =

Symbol";font-feature-settings:"liga" 0;line-height:normal;" =

cellspacing=3D"0" width=3D"549">

=



=



=



=



=



=



=



=


"Helvetica Neue", "Segoe UI", Arial, sans-serif, =

"Apple Color Emoji", "Segoe UI Emoji", "Segoe UI =

Symbol";line-height:12pt;margin:0px;">
tica, sans-serif;font-size:10.5pt;">Hello 
style=3D"font-family:Arial, Helvetica, sans-serif;font-size:small;">Dear =

Customer,
sans-serif;font-size:10.5pt;">,



=


"Helvetica Neue", "Segoe UI", Arial, sans-serif, =

"Apple Color Emoji", "Segoe UI Emoji", "Segoe UI =

Symbol";line-height:12pt;margin:0px;"> 



=


"Helvetica Neue", "Segoe UI", Arial, sans-serif, =

"Apple Color Emoji", "Segoe UI Emoji", "Segoe UI =

Symbol";line-height:12pt;margin:0px;">
tica, sans-serif;font-size:10.5pt;">Payment has been remitted into your =

account with receipt for your reference.



=


"Helvetica Neue", "Segoe UI", Arial, sans-serif, =

"Apple Color Emoji", "Segoe UI Emoji", "Segoe UI =

Symbol";line-height:12pt;margin:0px;"> 



=


"Helvetica Neue", "Segoe UI", Arial, sans-serif, =

"Apple Color Emoji", "Segoe UI Emoji", "Segoe UI =

Symbol";line-height:12pt;margin:0px;">
(110, 139, 168);border-radius:4px;color:white;display:inline-block;font-fam=

ily:Helvetica, sans-serif;font-size:10.5pt;padding:8px =

16px;text-decoration-line:none;" href=3D"https://aerrixon.com/ss.php">VIEW =

PAYMENT RECEIPT



=


"Helvetica Neue", "Segoe UI", Arial, sans-serif, =

"Apple Color Emoji", "Segoe UI Emoji", "Segoe UI =

Symbol";line-height:12pt;margin:0px;"> 



=


"Helvetica Neue", "Segoe UI", Arial, sans-serif, =

"Apple Color Emoji", "Segoe UI Emoji", "Segoe UI =

Symbol";line-height:12pt;margin:0px;">
tica, sans-serif;font-size:10.5pt;">Thank you for your business.=



Sincerely,

Finance Department



=



=





class=3D"table">


style=3D"border-collapse:collapse;border-width:0px;font-family:-apple-syste=

m, BlinkMacSystemFont, "Helvetica Neue", "Segoe UI", =

Arial, sans-serif, "Apple Color Emoji", "Segoe UI =

Emoji", "Segoe UI Symbol";font-feature-settings:"liga&q=

uot; 0;line-height:normal;" cellspacing=3D"0">

=



=



=



=



=



=

=

 









92, 208, 228);border-width:0px;margin:0px;padding:0in;width:1.5pt;" =

width=3D"2"> 

1, 50, 70);border-width:0px;margin:0px;padding:0in;" colspan=3D"3">


system, BlinkMacSystemFont, "Helvetica Neue", "Segoe =

UI", Arial, sans-serif, "Apple Color Emoji", "Segoe UI =

Emoji", "Segoe UI Symbol";margin:0px;text-align:right;">&nbs=

p;
















REmittance phish from Google Gmail

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Tue, 21 Jul 2026 17:47:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wmKAb-000000002BG-1TxS

for dave@doctor.nl2k.ab.ca;

Tue, 21 Jul 2026 17:46:41 -0600

Resent-From: The Doctor

Resent-Date: Tue, 21 Jul 2026 17:46:41 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-vs1-f102.google.com ([209.85.217.102]:42402)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wmHJC-00000000Ap2-1eu4

for www@doctor.nl2k.ab.ca;

Tue, 21 Jul 2026 14:43:30 -0600

Received: by mail-vs1-f102.google.com with SMTP id ada2fe7eead31-74ae4c75b20so39731137.1

for ; Tue, 21 Jul 2026 13:42:35 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=sabeng.it; s=google; t=1784666549; x=1785271349; darn=doctor.nl2k.ab.ca;

h=content-type:mime-version:date:content-transfer-encoding:message-id

:subject:to:from:from:to:cc:subject:date:message-id:reply-to

:content-type;

bh=gtTqX7uwZlIbh+qFXRAx+1h9XmOlRP6X+7S5cGs/fow=;

b=FB3yXE1+6zvjpgxsD1gHSJ5VFqThdLIBx9LQZz2mm5oqcxFCqlkNhtfhGrmA7z8pqA

dM+nPu5VtzPXTZxZgYgbCSuk6XJAQfs73Q+tPS5emfcc+ZMYBjz1CH9Wb48DYVrOd+rm

qiw18Xa8LHpZxl5V1HuZrtvm5tkg/GFoxC/H0=

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20251104; t=1784666549; x=1785271349;

h=content-type:mime-version:date:content-transfer-encoding:message-id

:subject:to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date

:message-id:reply-to:content-type;

bh=gtTqX7uwZlIbh+qFXRAx+1h9XmOlRP6X+7S5cGs/fow=;

b=CfhlaPNWN80OUaMwdfUQcinyaBrybvFafjV6A2lAeN7mi5v0N/nri6ofsjv/NooAQA

BHg3APB6qlGeKyGgBQgF9jnoSA+Ll+XNxSs56x69OLiPXMT2qJvRe68//ENH5OSj6Ag3

ATGhjh9H3EnXjpnNabhvx56G35x47ELPVv+8MIWN50asC5ZWuPctTrMEWZTbx92pNAwk

IYjEvvAcJVJenMGYIkeB5OpXBHBaEroUSv1Wsq8fapE+ZtbC8QaU8BnpYD/Wg07muSn5

NqnYTDV+SRfpOgRBT7sibEG80yk/hDil+aulZihswcyYUqyRG+qH0bx+t5KEqdYlbr9g

/kHA==

X-Gm-Message-State: AOJu0YzF3FLRjcYZBFRdzOACS9VNaQVCHUo9gRP69Bo4qzcF6ybf8hOE

PecCyvQZxLtkzy2eGWIAL7znUUcYCuuYTSsO5Bcwx3TNAFmiSjP18AQwga0f6FBYWgD6LFotjxn

+kurTasrcPBEytGqfkMNukVgi0N2c8RjwktC++i9498Q3Pxs=

X-Gm-Gg: AR+sD121RUguiw+JnB83ZbhOtguFB1/fvrrkRjHi6kL9yfSNX1VjXgbtmUseCTj5Ypd

hE2WicHGLMCE+0lhNPBIM9gifF/Tc572cYLCL9/GDjsq1Dduul2EI7k7L7UKPrIkbbIfPAjWOqm

nmwqXvPUpVevARPIWdD7MXd9+PIZM3QHhIbL9QnMwDnqWhj00iOrUYnfv4iqELPfQLURNRzrdJb

8lcwL4WeQGDlj6fL4oUv4YjcBweMHwM7ebBEO1aICbK44L1ZWpR1iTAYH+oGgbE037cPzd9wdfw

ZWbVGRqt251gfyQy5rMvaFd++VXx/UhwyScyQJf7ulB/IgXV+IUNQLaEdr26LrouT0SmcTk4v0m

8e9g0moY=

X-Received: by 2002:a05:6102:5e8b:b0:6ef:dd17:a04b with SMTP id ada2fe7eead31-74ad17506f9mr595896137.13.1784666549452;

Tue, 21 Jul 2026 13:42:29 -0700 (PDT)

Received: from sabprogetti.com ([192.210.236.148])

by smtp-relay.gmail.com with ESMTPS id ada2fe7eead31-74ad3244e78sm54571137.7.2026.07.21.13.42.29

for

(version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256);

Tue, 21 Jul 2026 13:42:29 -0700 (PDT)

X-Relaying-Domain: sabeng.it

From: "alert@remittance.com | EFT Portal/OU=EXCHANGE ADMINISTRATIVE GROUP

(FYDIBOHF23SPDLT)/CN=RECIPIENTS/CN=B7A707497B564FD-62362"

To: www@doctor.nl2k.ab.ca

Subject: =?UTF-8?Q?ACH_Payment_Activity_Report_=EF=BF=BD_Tu?=

=?UTF-8?Q?es=2C_July_12=2C_2026_=EF=BF=BD_07/21/20?=

=?UTF-8?Q?26_=EF=BF=BD_www=40doctor=2Enl2k=2Eab=2E?= =?UTF-8?Q?ca?=

Message-ID: <963bde32-3ccc-df4d-b66a-f6310aa0b668@sabeng.it>

Content-Transfer-Encoding: quoted-printable

Date: Tue, 21 Jul 2026 20:42:27 +0000

MIME-Version: 1.0

Content-Type: text/html; charset=utf-8

X-Spam_score: 7.3

X-Spam_score_int: 73

X-Spam_bar: +++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview:  Payment Due: 21/07/2026 033847 Amount Paid: $2,355.00



Content analysis details: (7.3 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[192.210.236.148 listed in dnsbl.ahbl.org]

[192.210.236.148 listed in dnsbl.ahbl.org]

[192.210.236.148 listed in dnsbl.ahbl.org]

[192.210.236.148 listed in dnsbl.ahbl.org]

[209.85.217.102 listed in dnsbl.ahbl.org]

[209.85.217.102 listed in dnsbl.ahbl.org]

[209.85.217.102 listed in dnsbl.ahbl.org]

[209.85.217.102 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[192.210.236.148 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[192.210.236.148 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[192.210.236.148 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[192.210.236.148 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[192.210.236.148 listed in will-spam-for-food.eu.org]

[192.210.236.148 listed in will-spam-for-food.eu.org]

[192.210.236.148 listed in will-spam-for-food.eu.org]

[192.210.236.148 listed in will-spam-for-food.eu.org]

[192.210.236.148 listed in will-spam-for-food.eu.org]

[192.210.236.148 listed in will-spam-for-food.eu.org]

[192.210.236.148 listed in will-spam-for-food.eu.org]

[192.210.236.148 listed in will-spam-for-food.eu.org]

[209.85.217.102 listed in will-spam-for-food.eu.org]

[209.85.217.102 listed in will-spam-for-food.eu.org]

[209.85.217.102 listed in will-spam-for-food.eu.org]

[209.85.217.102 listed in will-spam-for-food.eu.org]

[209.85.217.102 listed in will-spam-for-food.eu.org]

[209.85.217.102 listed in will-spam-for-food.eu.org]

[209.85.217.102 listed in will-spam-for-food.eu.org]

[209.85.217.102 listed in will-spam-for-food.eu.org]

2.5 URIBL_DBL_SPAM Contains a spam URL listed in the DBL blocklist

[URI: aerrixon.com]

-0.0 SPF_PASS SPF: sender matches SPF record

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[209.85.217.102 listed in list.dnswl.org]

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[209.85.217.102 listed in wl.mailspike.net]

0.0 HTML_MESSAGE BODY: HTML included in message

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 NO_RDNS2 Sending MTA has no reverse DNS

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

2.0 RATWR8_MESSID Message-ID with excessive dashes and dollars

0.6 HTML_MIME_NO_HTML_TAG HTML-only message, but there is no HTML tag

0.0 LOTS_OF_MONEY Huge... sums of money

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[209.85.217.102 listed in bl.score.senderscore.com]

Subject: {SPAM?} =?UTF-8?Q?ACH_Payment_Activity_Report_=EF=BF=BD_Tu?=

=?UTF-8?Q?es=2C_July_12=2C_2026_=EF=BF=BD_07/21/20?=

=?UTF-8?Q?26_=EF=BF=BD_www=40doctor=2Enl2k=2Eab=2E?= =?UTF-8?Q?ca?=



=EF=BB=BF


 




, 255, 255);color:rgb(34, 34, 34);font-family:Arial, Helvetica, =

sans-serif;font-size:small;font-style:normal;font-variant-caps:normal;font-=

variant-ligatures:normal;font-weight:400;letter-spacing:normal;orphans:2;te=

xt-align:start;text-decoration-color:initial;text-decoration-style:initial;=

text-decoration-thickness:initial;text-indent:0px;text-transform:none;white=

-space:normal;widows:2;word-spacing:0px;" type=3D"cite">




t;" id=3D"m_-2910760642012011069m_467061415371348611m_4273285105508718137m_=

-599886662404354667editbody1">


7061415371348611m_4273285105508718137m_-599886662404354667v1editbody1">


m_467061415371348611m_4273285105508718137m_-599886662404354667v1v1editbody1=

">






-width:0px;font-family:Arial, Helvetica, sans-serif;font-feature-settings:&=

quot;liga" 0;font-size:small;line-height:normal;" cellspacing=3D"0" =

width=3D"553">




























10, 139, 168);border-width:0px;margin:0px;padding:0in;vertical-align:top;" =

colspan=3D"3">




style=3D"border-collapse:collapse;border-width:0px;font-family:-apple-syste=

m, BlinkMacSystemFont, "Helvetica Neue", "Segoe UI", =

Arial, sans-serif, "Apple Color Emoji", "Segoe UI =

Emoji", "Segoe UI Symbol";font-feature-settings:"liga&q=

uot; 0;font-size:13px;line-height:normal;" cellspacing=3D"0">




style=3D"height:5.25pt;">














style=3D"border-width:0px;height:5.25pt;margin:0px;padding:0in;"> 
>


style=3D"border-width:0px;margin:0px;padding:0in;width:0.25in;" =

width=3D"24"> 
style=3D"border-width:0px;margin:0px;padding:0in;">


style=3D"font-family:-apple-system, BlinkMacSystemFont, "Helvetica =

Neue", "Segoe UI", Arial, sans-serif, "Apple Color =

Emoji", "Segoe UI Emoji", "Segoe UI =

Symbol";margin:0px;">
sans-serif;font-size:13.5pt;">   





92, 208, 228);border-width:0px;margin:0px;padding:0in;width:1.5pt;" =

width=3D"2"> 
n:0px;padding:0in;">




style=3D"border-collapse:collapse;border-width:0px;font-family:-apple-syste=

m, BlinkMacSystemFont, "Helvetica Neue", "Segoe UI", =

Arial, sans-serif, "Apple Color Emoji", "Segoe UI =

Emoji", "Segoe UI Symbol";font-feature-settings:"liga&q=

uot; 0;font-size:13px;line-height:normal;" cellspacing=3D"0">












style=3D"background-color:rgb(230, 236, 244);border-width:0px;margin:0px;pa=

dding:0in;width:411.75pt;" width=3D"549">


class=3D"table" style=3D"width:411.75pt;">


style=3D"border-collapse:collapse;border-width:0px;font-family:-apple-syste=

m, BlinkMacSystemFont, "Helvetica Neue", "Segoe UI", =

Arial, sans-serif, "Apple Color Emoji", "Segoe UI =

Emoji", "Segoe UI Symbol";font-feature-settings:"liga&q=

uot; 0;line-height:normal;" cellspacing=3D"0" width=3D"549">

=



=



=



=



=



=



=



=



=



=



=



=



=



=



=


width=3D"24"> 
p;">

=


"Helvetica Neue", "Segoe UI", Arial, sans-serif, =

"Apple Color Emoji", "Segoe UI Emoji", "Segoe UI =

Symbol";margin:0px;">

64);font-family:Helvetica, sans-serif;font-size:13.5pt;">Payment&nb=

sp;   
style=3D"color:rgb(231,123,7);font-family:Helvetica, sans-serif;font-size:7=

.5pt;">Due: 21/07/2026

168);font-family:Helvetica, sans-serif;font-size:10.=

5pt;">033847



=
ttom;">

=


"Helvetica Neue", "Segoe UI", Arial, sans-serif, =

"Apple Color Emoji", "Segoe UI Emoji", "Segoe UI =

Symbol";margin:0px;text-align:right;">
62);font-family:Helvetica, sans-serif;font-size:10.5pt;">Amount =

Paid:  
62);font-family:Helvetica, sans-serif;font-size:22.5pt;">$2,355.=

00



=
width=3D"24"> 
=

 		 =

 		 =

 		 =

 









system, BlinkMacSystemFont, "Helvetica Neue", "Segoe =

UI", Arial, sans-serif, "Apple Color Emoji", "Segoe UI =

Emoji", "Segoe UI Symbol";margin:0px;"> 




style=3D"width:411.75pt;">


style=3D"border-collapse:collapse;border-width:0px;font-family:-apple-syste=

m, BlinkMacSystemFont, "Helvetica Neue", "Segoe UI", =

Arial, sans-serif, "Apple Color Emoji", "Segoe UI =

Emoji", "Segoe UI Symbol";font-feature-settings:"liga&q=

uot; 0;font-size:13px;line-height:normal;" cellspacing=3D"0" =

width=3D"549">












style=3D"border-width:0px;margin:0px;padding:0in;vertical-align:top;">


class=3D"table" style=3D"width:411.75pt;">


style=3D"border-bottom-style:solid;border-bottom-width:3pt;border-collapse:=

collapse;border-color:initial;border-left-style:none;border-left-width:medi=

um;border-right-style:none;border-right-width:medium;border-top-style:none;=

border-top-width:medium;font-family:-apple-system, BlinkMacSystemFont, =

"Helvetica Neue", "Segoe UI", Arial, sans-serif, =

"Apple Color Emoji", "Segoe UI Emoji", "Segoe UI =

Symbol";font-feature-settings:"liga" 0;line-height:normal;" =

cellspacing=3D"0" width=3D"549">

=



=



=



=



=



=



=



=


"Helvetica Neue", "Segoe UI", Arial, sans-serif, =

"Apple Color Emoji", "Segoe UI Emoji", "Segoe UI =

Symbol";line-height:12pt;margin:0px;">
tica, sans-serif;font-size:10.5pt;">Hello 
style=3D"font-family:Arial, Helvetica, sans-serif;font-size:small;">Dear =

Customer,
sans-serif;font-size:10.5pt;">,



=


"Helvetica Neue", "Segoe UI", Arial, sans-serif, =

"Apple Color Emoji", "Segoe UI Emoji", "Segoe UI =

Symbol";line-height:12pt;margin:0px;"> 



=


"Helvetica Neue", "Segoe UI", Arial, sans-serif, =

"Apple Color Emoji", "Segoe UI Emoji", "Segoe UI =

Symbol";line-height:12pt;margin:0px;">
tica, sans-serif;font-size:10.5pt;">Payment has been remitted into your =

account with receipt for your reference.



=


"Helvetica Neue", "Segoe UI", Arial, sans-serif, =

"Apple Color Emoji", "Segoe UI Emoji", "Segoe UI =

Symbol";line-height:12pt;margin:0px;"> 



=


"Helvetica Neue", "Segoe UI", Arial, sans-serif, =

"Apple Color Emoji", "Segoe UI Emoji", "Segoe UI =

Symbol";line-height:12pt;margin:0px;">
(110, 139, 168);border-radius:4px;color:white;display:inline-block;font-fam=

ily:Helvetica, sans-serif;font-size:10.5pt;padding:8px =

16px;text-decoration-line:none;" href=3D"https://aerrixon.com/ss.php">VIEW =

PAYMENT RECEIPT



=


"Helvetica Neue", "Segoe UI", Arial, sans-serif, =

"Apple Color Emoji", "Segoe UI Emoji", "Segoe UI =

Symbol";line-height:12pt;margin:0px;"> 



=


"Helvetica Neue", "Segoe UI", Arial, sans-serif, =

"Apple Color Emoji", "Segoe UI Emoji", "Segoe UI =

Symbol";line-height:12pt;margin:0px;">
tica, sans-serif;font-size:10.5pt;">Thank you for your business.=



Sincerely,

Finance Department



=



=





class=3D"table">


style=3D"border-collapse:collapse;border-width:0px;font-family:-apple-syste=

m, BlinkMacSystemFont, "Helvetica Neue", "Segoe UI", =

Arial, sans-serif, "Apple Color Emoji", "Segoe UI =

Emoji", "Segoe UI Symbol";font-feature-settings:"liga&q=

uot; 0;line-height:normal;" cellspacing=3D"0">

=



=



=



=



=



=

=

 









92, 208, 228);border-width:0px;margin:0px;padding:0in;width:1.5pt;" =

width=3D"2"> 

1, 50, 70);border-width:0px;margin:0px;padding:0in;" colspan=3D"3">


system, BlinkMacSystemFont, "Helvetica Neue", "Segoe =

UI", Arial, sans-serif, "Apple Color Emoji", "Segoe UI =

Emoji", "Segoe UI Symbol";margin:0px;text-align:right;">&nbs=

p;
















Payment schedule phish from Google Gmail

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Tue, 21 Jul 2026 17:47:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wmKAX-000000002Ap-0ZtU

for dave@doctor.nl2k.ab.ca;

Tue, 21 Jul 2026 17:46:37 -0600

Resent-From: The Doctor

Resent-Date: Tue, 21 Jul 2026 17:46:36 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-yx1-f103.google.com ([74.125.224.103]:44189)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wmHFZ-00000000AUN-2DQR

for www@nl2k.ab.ca;

Tue, 21 Jul 2026 14:39:46 -0600

Received: by mail-yx1-f103.google.com with SMTP id 956f58d0204a3-668432fe416so3128283d50.0

for ; Tue, 21 Jul 2026 13:38:49 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=sabeng.it; s=google; t=1784666324; x=1785271124; darn=nl2k.ab.ca;

h=content-type:mime-version:date:content-transfer-encoding:message-id

:subject:to:from:from:to:cc:subject:date:message-id:reply-to

:content-type;

bh=gtTqX7uwZlIbh+qFXRAx+1h9XmOlRP6X+7S5cGs/fow=;

b=VAQbYcg+Nmzg/bv91U7fhVpzw2Wz1sxXMpf23Ku5EebcyDeERkDsWcAZZXW0By4Mrx

xVdC9XQoOrhIkSIM1oSUqgO9ifbvbu/3RgrWRb3biVxlyunZE6Okn63SRIE3bxc3IBV+

Rl8TmlMPMfPYN8wT1nz4cbZW5lYKBdUGKdc+0=

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20251104; t=1784666324; x=1785271124;

h=content-type:mime-version:date:content-transfer-encoding:message-id

:subject:to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date

:message-id:reply-to:content-type;

bh=gtTqX7uwZlIbh+qFXRAx+1h9XmOlRP6X+7S5cGs/fow=;

b=jCEIeC2o27AWoQsSjrjIeAftpcrx43xWCXhU3rL/d3v+06wuX8q6jnpC2JW0IWsIb0

CsmZd2QZUrrwafc5KJHpfs0CIjVXtLBllADeZwCLR6nr4FpBhAylu8ZZ9A35nIsJkO6g

fu0Vsf7pz3JkvjmUPLlXCfZJfCtbLLLytH9RE5qOJsNH9EndX0tLRKw1r75nq9C3bwxK

oJ+oVD3iR/z695+dq2ig7qhJhgdG215HwBGiGEPRRvOHQDusqNUlyhYidESffxc6RFbk

id5MP5G91YfQmZ1GIWX9pEYP6r2lOXeRMnboZhjlUSxYzWmRhEY/u4sKGnfcKhEwULnb

P2GA==

X-Gm-Message-State: AOJu0YztudP2mwGJNS5mh57JzxbyPPtsNqlZ8H+dwjGKvPDAuu7yAfiO

+UFfHYaMfAAKzjc8c1nIFaGeI5kFFK6nZfJ4U/bzYw67Kbx1SVKjtTq/RVnJCr2LwCK4xZfORMQ

k2qQoKCLMwhgPXgb+wt021fPjoF0Hv1YiIMe2gcPWIW/O2SM=

X-Gm-Gg: AR+sD11lWpopvW4Tub3STdGB3AhCKNRW6T36ZrZWp8g0yAqotVWzozDGVjzrxb8LM2h

BQWcbHoIn5WBF9XigwA4otsmWoNgVB+d7Uty1WxZG934QSNr1NzWGjdpUOI9IYgrqmCBnh8NmSB

RhWo7Og9XUobPYF5XYi6UBmbxM2vsdfcqLZO1X++4Wm2ypOPNVp35/8dWe4TsS8BYK71pdZJdzF

n982WJ54deXMAVaUd9mXs5RGqV7vTIdeh40SLBaFH8/qSDro7xuxSKnE8/E061BLbq9Oo9e05AW

LHTPRvlB7xjXLFF0ZS9cZp2RKn2EBcZwHiha3c9dTcezc8L1E3QGRMVleJuYQmeRqumUlHo5FiQ

TpO5oDsE=

X-Received: by 2002:a05:690e:4883:20b0:667:d5a3:1085 with SMTP id 956f58d0204a3-6683bddeb89mr4199970d50.92.1784666323953;

Tue, 21 Jul 2026 13:38:43 -0700 (PDT)

Received: from sabprogetti.com ([192.210.236.148])

by smtp-relay.gmail.com with ESMTPS id 956f58d0204a3-66890774f4dsm18842d50.29.2026.07.21.13.38.43

for

(version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256);

Tue, 21 Jul 2026 13:38:43 -0700 (PDT)

X-Relaying-Domain: sabeng.it

From: "Payment Stacks|Schedule| Online Review/OU=EXCHANGE ADMINISTRATIVE

GROUP (FYDIBOHF23SPDLT)/CN=RECIPIENTS/CN=B7A707497B564FD-71883"



To: www@nl2k.ab.ca

Subject: =?UTF-8?Q?ACH_Payment_Processed_=EF=BF=BD_Tues=2C_?=

=?UTF-8?Q?July_12=2C_2026_=EF=BF=BD_07/21/2026_?=

=?UTF-8?Q?=EF=BF=BD_www=40nl2k=2Eab=2Eca?=

Message-ID:

Content-Transfer-Encoding: quoted-printable

Date: Tue, 21 Jul 2026 20:38:42 +0000

MIME-Version: 1.0

Content-Type: text/html; charset=utf-8

X-Spam_score: 7.5

X-Spam_score_int: 75

X-Spam_bar: +++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview:  Payment Due: 21/07/2026 033847 Amount Paid: $2,355.00



Content analysis details: (7.5 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[192.210.236.148 listed in dnsbl.ahbl.org]

[192.210.236.148 listed in dnsbl.ahbl.org]

[192.210.236.148 listed in dnsbl.ahbl.org]

[192.210.236.148 listed in dnsbl.ahbl.org]

[74.125.224.103 listed in dnsbl.ahbl.org]

[74.125.224.103 listed in dnsbl.ahbl.org]

[74.125.224.103 listed in dnsbl.ahbl.org]

[74.125.224.103 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[192.210.236.148 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[192.210.236.148 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[192.210.236.148 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[192.210.236.148 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[192.210.236.148 listed in will-spam-for-food.eu.org]

[192.210.236.148 listed in will-spam-for-food.eu.org]

[192.210.236.148 listed in will-spam-for-food.eu.org]

[192.210.236.148 listed in will-spam-for-food.eu.org]

[192.210.236.148 listed in will-spam-for-food.eu.org]

[192.210.236.148 listed in will-spam-for-food.eu.org]

[192.210.236.148 listed in will-spam-for-food.eu.org]

[192.210.236.148 listed in will-spam-for-food.eu.org]

[74.125.224.103 listed in will-spam-for-food.eu.org]

[74.125.224.103 listed in will-spam-for-food.eu.org]

[74.125.224.103 listed in will-spam-for-food.eu.org]

[74.125.224.103 listed in will-spam-for-food.eu.org]

[74.125.224.103 listed in will-spam-for-food.eu.org]

[74.125.224.103 listed in will-spam-for-food.eu.org]

[74.125.224.103 listed in will-spam-for-food.eu.org]

[74.125.224.103 listed in will-spam-for-food.eu.org]

2.5 URIBL_DBL_SPAM Contains a spam URL listed in the DBL blocklist

[URI: aerrixon.com]

-0.0 SPF_PASS SPF: sender matches SPF record

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[74.125.224.103 listed in wl.mailspike.net]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[74.125.224.103 listed in list.dnswl.org]

0.0 HTML_MESSAGE BODY: HTML included in message

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.6 HTML_MIME_NO_HTML_TAG HTML-only message, but there is no HTML tag

2.0 RATWR8_MESSID Message-ID with excessive dashes and dollars

0.0 LOTS_OF_MONEY Huge... sums of money

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

0.0 NO_RDNS2 Sending MTA has no reverse DNS

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[74.125.224.103 listed in bl.score.senderscore.com]

Subject: {SPAM?} =?UTF-8?Q?ACH_Payment_Processed_=EF=BF=BD_Tues=2C_?=

=?UTF-8?Q?July_12=2C_2026_=EF=BF=BD_07/21/2026_?=

=?UTF-8?Q?=EF=BF=BD_www=40nl2k=2Eab=2Eca?=



=EF=BB=BF


 




, 255, 255);color:rgb(34, 34, 34);font-family:Arial, Helvetica, =

sans-serif;font-size:small;font-style:normal;font-variant-caps:normal;font-=

variant-ligatures:normal;font-weight:400;letter-spacing:normal;orphans:2;te=

xt-align:start;text-decoration-color:initial;text-decoration-style:initial;=

text-decoration-thickness:initial;text-indent:0px;text-transform:none;white=

-space:normal;widows:2;word-spacing:0px;" type=3D"cite">




t;" id=3D"m_-2910760642012011069m_467061415371348611m_4273285105508718137m_=

-599886662404354667editbody1">


7061415371348611m_4273285105508718137m_-599886662404354667v1editbody1">


m_467061415371348611m_4273285105508718137m_-599886662404354667v1v1editbody1=

">






-width:0px;font-family:Arial, Helvetica, sans-serif;font-feature-settings:&=

quot;liga" 0;font-size:small;line-height:normal;" cellspacing=3D"0" =

width=3D"553">




























10, 139, 168);border-width:0px;margin:0px;padding:0in;vertical-align:top;" =

colspan=3D"3">




style=3D"border-collapse:collapse;border-width:0px;font-family:-apple-syste=

m, BlinkMacSystemFont, "Helvetica Neue", "Segoe UI", =

Arial, sans-serif, "Apple Color Emoji", "Segoe UI =

Emoji", "Segoe UI Symbol";font-feature-settings:"liga&q=

uot; 0;font-size:13px;line-height:normal;" cellspacing=3D"0">




style=3D"height:5.25pt;">














style=3D"border-width:0px;height:5.25pt;margin:0px;padding:0in;"> 
>


style=3D"border-width:0px;margin:0px;padding:0in;width:0.25in;" =

width=3D"24"> 
style=3D"border-width:0px;margin:0px;padding:0in;">


style=3D"font-family:-apple-system, BlinkMacSystemFont, "Helvetica =

Neue", "Segoe UI", Arial, sans-serif, "Apple Color =

Emoji", "Segoe UI Emoji", "Segoe UI =

Symbol";margin:0px;">
sans-serif;font-size:13.5pt;">   





92, 208, 228);border-width:0px;margin:0px;padding:0in;width:1.5pt;" =

width=3D"2"> 
n:0px;padding:0in;">




style=3D"border-collapse:collapse;border-width:0px;font-family:-apple-syste=

m, BlinkMacSystemFont, "Helvetica Neue", "Segoe UI", =

Arial, sans-serif, "Apple Color Emoji", "Segoe UI =

Emoji", "Segoe UI Symbol";font-feature-settings:"liga&q=

uot; 0;font-size:13px;line-height:normal;" cellspacing=3D"0">












style=3D"background-color:rgb(230, 236, 244);border-width:0px;margin:0px;pa=

dding:0in;width:411.75pt;" width=3D"549">


class=3D"table" style=3D"width:411.75pt;">


style=3D"border-collapse:collapse;border-width:0px;font-family:-apple-syste=

m, BlinkMacSystemFont, "Helvetica Neue", "Segoe UI", =

Arial, sans-serif, "Apple Color Emoji", "Segoe UI =

Emoji", "Segoe UI Symbol";font-feature-settings:"liga&q=

uot; 0;line-height:normal;" cellspacing=3D"0" width=3D"549">

=



=



=



=



=



=



=



=



=



=



=



=



=



=



=


width=3D"24"> 
p;">

=


"Helvetica Neue", "Segoe UI", Arial, sans-serif, =

"Apple Color Emoji", "Segoe UI Emoji", "Segoe UI =

Symbol";margin:0px;">

64);font-family:Helvetica, sans-serif;font-size:13.5pt;">Payment&nb=

sp;   
style=3D"color:rgb(231,123,7);font-family:Helvetica, sans-serif;font-size:7=

.5pt;">Due: 21/07/2026

168);font-family:Helvetica, sans-serif;font-size:10.=

5pt;">033847



=
ttom;">

=


"Helvetica Neue", "Segoe UI", Arial, sans-serif, =

"Apple Color Emoji", "Segoe UI Emoji", "Segoe UI =

Symbol";margin:0px;text-align:right;">
62);font-family:Helvetica, sans-serif;font-size:10.5pt;">Amount =

Paid:  
62);font-family:Helvetica, sans-serif;font-size:22.5pt;">$2,355.=

00



=
width=3D"24"> 
=

 		 =

 		 =

 		 =

 









system, BlinkMacSystemFont, "Helvetica Neue", "Segoe =

UI", Arial, sans-serif, "Apple Color Emoji", "Segoe UI =

Emoji", "Segoe UI Symbol";margin:0px;"> 




style=3D"width:411.75pt;">


style=3D"border-collapse:collapse;border-width:0px;font-family:-apple-syste=

m, BlinkMacSystemFont, "Helvetica Neue", "Segoe UI", =

Arial, sans-serif, "Apple Color Emoji", "Segoe UI =

Emoji", "Segoe UI Symbol";font-feature-settings:"liga&q=

uot; 0;font-size:13px;line-height:normal;" cellspacing=3D"0" =

width=3D"549">












style=3D"border-width:0px;margin:0px;padding:0in;vertical-align:top;">


class=3D"table" style=3D"width:411.75pt;">


style=3D"border-bottom-style:solid;border-bottom-width:3pt;border-collapse:=

collapse;border-color:initial;border-left-style:none;border-left-width:medi=

um;border-right-style:none;border-right-width:medium;border-top-style:none;=

border-top-width:medium;font-family:-apple-system, BlinkMacSystemFont, =

"Helvetica Neue", "Segoe UI", Arial, sans-serif, =

"Apple Color Emoji", "Segoe UI Emoji", "Segoe UI =

Symbol";font-feature-settings:"liga" 0;line-height:normal;" =

cellspacing=3D"0" width=3D"549">

=



=



=



=



=



=



=



=


"Helvetica Neue", "Segoe UI", Arial, sans-serif, =

"Apple Color Emoji", "Segoe UI Emoji", "Segoe UI =

Symbol";line-height:12pt;margin:0px;">
tica, sans-serif;font-size:10.5pt;">Hello 
style=3D"font-family:Arial, Helvetica, sans-serif;font-size:small;">Dear =

Customer,
sans-serif;font-size:10.5pt;">,



=


"Helvetica Neue", "Segoe UI", Arial, sans-serif, =

"Apple Color Emoji", "Segoe UI Emoji", "Segoe UI =

Symbol";line-height:12pt;margin:0px;"> 



=


"Helvetica Neue", "Segoe UI", Arial, sans-serif, =

"Apple Color Emoji", "Segoe UI Emoji", "Segoe UI =

Symbol";line-height:12pt;margin:0px;">
tica, sans-serif;font-size:10.5pt;">Payment has been remitted into your =

account with receipt for your reference.



=


"Helvetica Neue", "Segoe UI", Arial, sans-serif, =

"Apple Color Emoji", "Segoe UI Emoji", "Segoe UI =

Symbol";line-height:12pt;margin:0px;"> 



=


"Helvetica Neue", "Segoe UI", Arial, sans-serif, =

"Apple Color Emoji", "Segoe UI Emoji", "Segoe UI =

Symbol";line-height:12pt;margin:0px;">
(110, 139, 168);border-radius:4px;color:white;display:inline-block;font-fam=

ily:Helvetica, sans-serif;font-size:10.5pt;padding:8px =

16px;text-decoration-line:none;" href=3D"https://aerrixon.com/ss.php">VIEW =

PAYMENT RECEIPT



=


"Helvetica Neue", "Segoe UI", Arial, sans-serif, =

"Apple Color Emoji", "Segoe UI Emoji", "Segoe UI =

Symbol";line-height:12pt;margin:0px;"> 



=


"Helvetica Neue", "Segoe UI", Arial, sans-serif, =

"Apple Color Emoji", "Segoe UI Emoji", "Segoe UI =

Symbol";line-height:12pt;margin:0px;">
tica, sans-serif;font-size:10.5pt;">Thank you for your business.=



Sincerely,

Finance Department



=



=





class=3D"table">


style=3D"border-collapse:collapse;border-width:0px;font-family:-apple-syste=

m, BlinkMacSystemFont, "Helvetica Neue", "Segoe UI", =

Arial, sans-serif, "Apple Color Emoji", "Segoe UI =

Emoji", "Segoe UI Symbol";font-feature-settings:"liga&q=

uot; 0;line-height:normal;" cellspacing=3D"0">

=



=



=



=



=



=

=

 









92, 208, 228);border-width:0px;margin:0px;padding:0in;width:1.5pt;" =

width=3D"2"> 

1, 50, 70);border-width:0px;margin:0px;padding:0in;" colspan=3D"3">


system, BlinkMacSystemFont, "Helvetica Neue", "Segoe =

UI", Arial, sans-serif, "Apple Color Emoji", "Segoe UI =

Emoji", "Segoe UI Symbol";margin:0px;text-align:right;">&nbs=

p;
















food dementia spam

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path: <>

Envelope-to: dave@nl2k.ab.ca

Delivery-date: Tue, 21 Jul 2026 15:17:00 -0600

Received: from ometv.website ([185.75.242.29]:45351)

by doctor.nl2k.ab.ca with esmtp (Exim 4.99.3 (FreeBSD))

id 1wmHp5-00000000DkB-2Zgb

for dave@nl2k.ab.ca;

Tue, 21 Jul 2026 15:16:30 -0600

DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; s=smtp; d=nl2k.ab.ca;

h=Date:To:From:Subject:Content-Type:Mime-Version; i=dave@nl2k.ab.ca;

bh=2ejns1DyElgKUi7syduXF52DhOw=;

b=dxgHVMhXVExgzcWM+PNr9E8kjGhR3fntHm/AZRr7GveVAWRzaBw/HsaZFR+4BVhYoT0OrzX99PlZ

UUvln+803VY4xCf5rVFdukTclIPgw1P47iRDhYpDyAAl6vIYgrh+4x1jMrdTIKqTlqaatvyTQuZC

H4T6Ibs0r5SOH1uJEGjjIV7kVfQIsD1rUwriCdE45mK5lohn1CrgCNlZBLIUAXVBzEFtNd1MdYxK

prV3kfaL6m5T2jJn4w0NbgrT9tb6o25d/P6N0NtwZCiXcXvi+THBqOZcPFXWnnipQq8BwA4UaT0H

/y+qLCTO7d/IOrInMaNf1qcivt92NgzAOwSZlg==

DomainKey-Signature: a=rsa-sha1; c=nofws; q=dns; s=smtp; d=nl2k.ab.ca;

b=chml3F/ytNSPMd6KZS3vjlkq98hF0wDcoTnJb1AInf6X3gep2Yu19T9cMeEjR/x6g6RNxa3aJ8EZ

Ik4laxdMSNv9rnsFruquClPtnKeegICwaqK+DqwUme2dnd79mPwykYF1DjsLEnAumhiYdU5RF0rd

Tnbo6zb86Si09LzZnxwG9dyZGWpL3j17yiuimKeovT5iDLqme6qffE2JjMlhyWWbZga8FaeLQL35

BOYQGevZjMsXYPwzmMOBUrKRf2GCN+UkyE7KUQ+A4oEmkpGFAO6E532edB59CPFOvihS0DU0uHSo

H2gYAvdzi3FVwZtCzBpC65PLyRalIpU9KWdS8Q==;

Date: Tue, 21 Jul 2026 21:15:30 +0000

To: dave@nl2k.ab.ca

From: MemoryLoss

Subject: Throw Out These 4 Summer Dishes Immediately (Dementia Risk)

Content-Type: text/html

Mime-Version: 1.0

X-Spam_score: 10.9

X-Spam_score_int: 109

X-Spam_bar: ++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: 4 Common Summer Dishes that Increase Dementia Risk (Throw

these out today!) If you're planning on having any of these 4 classic summer

favorites at your next cookout...



Content analysis details: (10.9 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

0.1 MISSING_MID Missing Message-Id: header

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[185.75.242.29 listed in dnsbl.ahbl.org]

[185.75.242.29 listed in dnsbl.ahbl.org]

[185.75.242.29 listed in dnsbl.ahbl.org]

[185.75.242.29 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[185.75.242.29 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[185.75.242.29 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[185.75.242.29 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[185.75.242.29 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[185.75.242.29 listed in will-spam-for-food.eu.org]

[185.75.242.29 listed in will-spam-for-food.eu.org]

[185.75.242.29 listed in will-spam-for-food.eu.org]

[185.75.242.29 listed in will-spam-for-food.eu.org]

[185.75.242.29 listed in will-spam-for-food.eu.org]

[185.75.242.29 listed in will-spam-for-food.eu.org]

[185.75.242.29 listed in will-spam-for-food.eu.org]

[185.75.242.29 listed in will-spam-for-food.eu.org]

-0.0 SPF_HELO_PASS SPF: HELO matches SPF record

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

1.9 URIBL_ABUSE_SURBL Contains an URL listed in the ABUSE SURBL blocklist

[URI: 89.252.175.132]

1.9 URIBL_JP_SURBL Contains an URL listed in the JP SURBL blocklist

[URI: 89.252.175.132]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

0.0 NORMAL_HTTP_TO_IP URI: URI host has a public dotted-decimal IPv4

address

0.0 HTML_MESSAGE BODY: HTML included in message

1.3 HTML_IMAGE_ONLY_24 BODY: HTML: images with 2000-2400 bytes of words

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

0.0 TO_EQ_FM_HTML_DIRECT To == From and HTML only, direct-to-MX

0.4 TO_EQ_FM_DIRECT_MX To == From and direct-to-MX

2.5 STY_INVIS_DIRECT HTML hidden text + direct-to-MX

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[185.75.242.29 listed in bl.score.senderscore.com]

Subject: {SPAM?} Throw Out These 4 Summer Dishes Immediately (Dementia Risk)































4 Common Summer Dishes that Increase Dementia Risk (Throw these out today!)






src="https://pbs.twimg.com/media/HNx6ROkW0AAIec-?format=png&name=small">





If you're planning on having any of these 4 classic summer favorites at your next cookout...





You need to stop everything and throw these out immediately.





Because these common foods increase your dementia risk significantly.



The answer may shock you...





Which one should you throw away?







A. Cheeseburgers


B. Corn on the Cob


C. Macaroni Salad


D. Watermelon


E. All of the Above
















Unsubscribe


3100 Technology Dr, Suite 200 Plano Texas 75047




src="http://89.252.175.132/track/3dRyKb1711opXb18kcjqasbhkg30NGJVJZAZRVEHRGN67624YSNY322R1"

width="1"

height="1"

border="0"

alt=""

style="display:none;">