NetKnow Corporate Blog

National Bank Phish from Sendgrid PArt 3

Posted by Dave Yadallee on Thursday, May 7. 2026

style=3D"FONT-SIZE: 11px; FONT-FAMILY: Arial,sans-ser=

if,'Open Sans'; COLOR: #000000; PADDING-LEFT: 6px; LINE-HEIGHT: 15px"=20

vAlign=3Dmiddle width=3D25 align=3Dleft>
href=3D"https://twitter.com/nationalbank/"=20

target=3D_blank> 3D""=20<br

src=3D"https://www.bnc.ca/content/dam/bnc/formulair=

es/modele-courriel/icon-twitter-25x25.gif"=20

width=3D25 height=3D25>

style=3D"FONT-SIZE: 11px; FONT-FAMILY: Arial,sans-ser=

if,'Open Sans'; COLOR: #000000; PADDING-LEFT: 6px; LINE-HEIGHT: 15px"=20

vAlign=3Dmiddle width=3D25 align=3Dleft>
href=3D"https://www.youtube.com/user/nationalbankne=

tworks"=20

target=3D_blank> 3D""=20<br

src=3D"https://www.bnc.ca/content/dam/bnc/formulair=

es/modele-courriel/icon-youtube-25x25.gif"=20

width=3D25 height=3D25>

style=3D"FONT-SIZE: 11px; FONT-FAMILY: Arial,sans-ser=

if,'Open Sans'; COLOR: #000000; PADDING-LEFT: 6px; LINE-HEIGHT: 15px"=20

vAlign=3Dmiddle width=3D25 align=3Dleft>
href=3D"https://www.linkedin.com/company/national-b=

ank-of-canada/"=20

target=3D_blank> 3D""=20<br

src=3D"https://www.bnc.ca/content/dam/bnc/formulair=

es/modele-courriel/icon-linkedin-25x25.gif"=20

width=3D25=20

height=3D25>
ABLE>

der=3D0>

der=3D0>

style=3D"FONT-SIZE: 11px; FONT-FAMILY: Arial,sans-serif,'Open San=

s'; COLOR: #686868; PADDING-BOTTOM: 30px; PADDING-TOP: 30px; LINE-HEIGHT: 1=

5px"=20

vAlign=3Dtop align=3Dleft>

style=3D"FONT-SIZE: 11px; FONT-FAMILY: Arial,sans-serif,'Op=

en Sans'; COLOR: #686868; PADDING-BOTTOM: 15px; LINE-HEIGHT: 15px"=20

vAlign=3Dmiddle align=3Dleft>
style=3D"TEXT-DECORATION: underline; COLOR: #686868"=20

href=3D"https://www.nbc.ca/terms-of-use.html?utm_campaign=

=3Dacq_credit-card_aem-forms-email_en&utm_medium=3Demail&utm_source=

=3Depush-bnc&utm_content=3Dinterrompu&utm_term=3D"=20

target=3D_blank>Terms of=20

use

style=3D"FONT-SIZE: 11px; FONT-FAMILY: Arial,sans-serif,'Op=

en Sans'; COLOR: #686868; PADDING-BOTTOM: 15px; LINE-HEIGHT: 15px"=20

vAlign=3Dmiddle width=3D20 align=3Dcenter>|

style=3D"FONT-SIZE: 11px; FONT-FAMILY: Arial,sans-serif,'Op=

en Sans'; COLOR: #686868; PADDING-BOTTOM: 15px; LINE-HEIGHT: 15px"=20

vAlign=3Dmiddle align=3Dleft>
style=3D"TEXT-DECORATION: underline; COLOR: #686868"=20

href=3D"https://www.nbc.ca/privacy-policy.html?utm_campai=

gn=3Dacq_credit-card_aem-forms-email_en&utm_medium=3Demail&utm_sour=

ce=3Depush-bnc&utm_content=3Dinterrompu&utm_term=3D"=20

target=3D_blank>Privacy=20

policy

style=3D"FONT-SIZE: 11px; FONT-FAMILY: Arial,sans-serif,'Op=

en Sans'; COLOR: #686868; PADDING-BOTTOM: 15px; LINE-HEIGHT: 15px"=20

vAlign=3Dmiddle width=3D20 align=3Dcenter>|

style=3D"FONT-SIZE: 11px; FONT-FAMILY: Arial,sans-serif,'Op=

en Sans'; COLOR: #686868; PADDING-BOTTOM: 15px; LINE-HEIGHT: 15px"=20

vAlign=3Dmiddle align=3Dleft>
style=3D"TEXT-DECORATION: underline; COLOR: #686868"=20

href=3D"https://www.nbc.ca/abcs-of-security.html?utm_camp=

aign=3Dacq_credit-card_aem-forms-email_en&utm_medium=3Demail&utm_so=

urce=3Depush-bnc&utm_content=3Dinterrompu&utm_term=3D"=20

target=3D_blank>ABC's of=20

security

style=3D"FONT-SIZE: 15px; HEIGHT: 15px; LINE-HEIGHT: 15px">
V>
style=3D"FONT-SIZE: 8px; VERTICAL-ALIGN: 5px; LINE-HEIGHT: 0">=

=A9=20

National Ba=

nk of=20

Canada. All rights reserved. Any reproduction, in whole or in p=

art,=20

is strictly prohibited without the prior written consent of
AN=20

style=3D"WHITE-SPACE: nowrap">National Bank of Cana=

da.=20

National Bank of Canada, 800 St-Jacques Street,=20

Montreal (Quebec)
style=3D"WHITE-SPACE: nowrap">H3C 1A3

>
style=3D"TEXT-DECORATION: underline; COLOR: #686868"=20

href=3D"https://www.nbc.ca?utm_campaign=3Dacq_credit-card_aem-f=

orms-email_en&utm_medium=3Demail&utm_source=3Depush-bnc&utm_con=

tent=3Dconfirmation&utm_term=3D"=20

target=3D_blank>
style=3D"COLOR: #686868">nbc.ca

For options t=

o=20

unsubscribe,
6868"=20

href=3D"https://www.nbc.ca/forms/communications/withdraw-consen=

t.html"=20

target=3D_blank>click here
>.=20

DY>

style=3D"FONT-SIZE: 8pt; FONT-FAMILY: 'Cambria','times roman',serif; LINE-H=

EIGHT: 10pt">
CONFIDENTIALIT=C9=20

: Ce document est destin=E9 uniquement =E0 la personne ou =E0 l'entit=E9 =

=E0 qui il est=20

adress=E9. L'information apparaissant dans ce document est de nature l=E9ga=

lement=20

privil=E9gi=E9e et confidentielle. Si vous n'=EAtes pas le destinataire vis=

=E9 ou la=20

personne charg=E9e de le remettre =E0 son destinataire, vous =EAtes, par la=

pr=E9sente,=20

avis=E9 que toute lecture, usage, copie ou communication du contenu de ce d=

ocument=20

est strictement interdit. De plus, vous =EAtes pri=E9 de communiquer avec=20

l'exp=E9diteur sans d=E9lai et de d=E9truire ce document imm=E9diatement.=20

CONFIDENTIALITY: This document is intended solely for the individual or=

=20

entity to whom it is addressed. The information contained in this document =

is=20

legally privileged and confidential. If you are not the intended recipient =

or=20

the person responsible for delivering it to the intended recipient, you are=

=20

hereby advised that you are strictly prohibited from reading, using, copyin=

g or=20

disseminating the contents of this document. Please inform the sender=20

immediately and delete this document immediately.

National Bank Phish from Sendgrid PArt 2

Posted by Dave Yadallee on Thursday, May 7. 2026

der=3D0>

align=3Dcenter>
gn=3Dcenter=20

border=3D0>

style=3D"FONT-SIZE: 14px; FONT-FAMILY: Arial,sans-serif,'Open San=

s'; COLOR: #333333; LINE-HEIGHT: 19px"=20

vAlign=3Dtop width=3D600 align=3Dleft>

align=3Dleft> 3D""=20<br

src=3D"https://www.bnc.ca/content/dam/bnc/formulaires/mod=

ele-courriel/icon-confirm-84x44.gif"=20

width=3D42 height=3D22>

style=3D"FONT-SIZE: 14px; FONT-FAMILY: Arial,sans-serif; =

FONT-WEIGHT: bold; COLOR: #ffffff; PADDING-BOTTOM: 0px; PADDING-TOP: 0px; P=

ADDING-LEFT: 0px; MARGIN: 0px; LINE-HEIGHT: 19px; PADDING-RIGHT: 0px">MESSA=

GE=20

CONFIRMATION=20

Y>

der=3D0>

der=3D0>

style=3D"FONT-SIZE: 14px; FONT-FAMILY: Arial,sans-serif,'Open San=

s'; COLOR: #333333; LINE-HEIGHT: 19px"=20

vAlign=3Dtop align=3Dleft>

style=3D"FONT-SIZE: 20px; FONT-FAMILY: Arial,sans-serif; FONT-W=

EIGHT: normal; COLOR: #00334d; PADDING-BOTTOM: 0px; PADDING-TOP: 0px; PADDI=

NG-LEFT: 0px; MARGIN: 0px; LINE-HEIGHT: 24px; PADDING-RIGHT: 0px">Complianc=

e=20

Verification Update

style=3D"FONT-SIZE: 10px; HEIGHT: 10px; LINE-HEIGHT: 10px">
V>Dear=20

Client,

To support account security, regulatory complian=

ce,=20

and anti-money laundering controls, we are updating our investo=

r=20

identity verification procedures. These measures are intended t=

o=20

help protect financial accounts, reduce the risk of unauthorize=

d=20

activity, and ensure that investor information remains accurate=

and=20

current.

As part of this process, investors may be asked=

to=20

review identification details, confirm contact information, ver=

ify=20

account ownership, or update required documents. Completing the=

se=20

steps helps maintain a safer investment environment and support=

s our=20

compliance obligations under applicable securities and anti-mon=

ey=20

laundering rules.

Please proceed using the link below to=

=20

complete your verification:

href=3D"https://mjjwci7p5dtqvs0y4yk730e.live">Complete=20

verification

Thank you for your cooperation as we=20

continue working to protect investor accounts and maintain a se=

cure,=20

compliant investment platform.=20

der=3D0>

align=3Dcenter>
der=3D0>

der=3D0>

style=3D"BORDER-TOP: #a6a6a6 1px solid; BORDER-BOTTOM: #a6a6a6 1px soli=

d; PADDING-BOTTOM: 12px; PADDING-TOP: 12px"=20

vAlign=3Dtop align=3Dcenter>

R>

E>

Thai Language Canva Phish from Amazon Part 2

Posted by Dave Yadallee on Thursday, May 7. 2026

------=_Part_1405281_319353436.1778170629532

Content-Type: multipart/alternative;

boundary="----=_Part_1405280_1907887602.1778170629532"

------=_Part_1405280_1907887602.1778170629532

Content-Type: text/plain; charset=UTF-8

Content-Transfer-Encoding: quoted-printable

=E0=B8=A1=E0=B8=B5=E0=B8=94=E0=B8=B5=E0=B9=84=E0=B8=8B=E0=B8=99=E0=B9=8C=E0=

=B8=96=E0=B8=B9=E0=B8=81=E0=B9=81=E0=B8=8A=E0=B8=A3=E0=B9=8C=E0=B8=81=E0=B8=

=B1=E0=B8=9A=E0=B8=84=E0=B8=B8=E0=B8=93=E0=B9=82=E0=B8=94=E0=B8=A2 swp30000=

@swp.=EF=BB=BFac.=EF=BB=BFth=20

=C2=A0

=E0=B8=84=E0=B8=B8=E0=B8=93=E0=B8=A3=E0=B8=B9=E0=B9=89=E0=B8=88=E0=B8=B1=

=E0=B8=81=E0=B8=84=E0=B8=99=E0=B8=99=E0=B8=B5=E0=B9=89=E0=B8=A1=E0=B8=B1=E0=

=B9=89=E0=B8=A2?
=E0=B8=84=E0=B8=B3=E0=B9=80=E0=B8=8A=E0=B8=B4=E0=B8=

=8D Canva =E0=B8=99=E0=B8=B5=E0=B9=89=E0=B8=A1=E0=B8=B2=E0=B8=88=E0=B8=B2=

=E0=B8=81=E0=B8=84=E0=B8=99=E0=B8=97=E0=B8=B5=E0=B9=88=E0=B8=84=E0=B8=B8=E0=

=B8=93=E0=B8=AD=E0=B8=B2=E0=B8=88=E0=B9=84=E0=B8=A1=E0=B9=88=E0=B8=A3=E0=B8=

=B9=E0=B9=89=E0=B8=88=E0=B8=B1=E0=B8=81 =E0=B8=A3=E0=B8=B0=E0=B8=A7=E0=B8=

=B1=E0=B8=87=E0=B8=88=E0=B8=B0=E0=B8=96=E0=B8=B9=E0=B8=81=E0=B8=AB=E0=B8=A5=

=E0=B8=AD=E0=B8=81=E0=B8=99=E0=B8=B0
report-content/?disable_dsa=3Dtrue&category=3DJ&app=3Ddesign_share_email&so=

urce=3Ddesign&content_id=3DDAHJAKUnPbc">=E0=B8=A3=E0=B8=B2=E0=B8=A2=E0=B8=

=87=E0=B8=B2=E0=B8=99=E0=B9=84=E0=B8=94=E0=B9=89=E0=B9=80=E0=B8=A5=E0=B8=A2=

=E0=B8=96=E0=B9=89=E0=B8=B2=E0=B8=A3=E0=B8=B9=E0=B9=89=E0=B8=AA=E0=B8=B6=E0=

=B8=81=E0=B8=A7=E0=B9=88=E0=B8=B2=E0=B8=99=E0=B9=88=E0=B8=B2=E0=B8=AA=E0=B8=

=87=E0=B8=AA=E0=B8=B1=E0=B8=A2=C2=A0 =20

=C2=A0

User Paid 950.=EF=BB=BF99 USD for iPhone and Canva Premium via PayPal If=

not, Immediately call +1 816 544 2270.=EF=BB=BF #

=C2=A0=20

=C2=A0=E0=B9=80=E0=B8=9B=E0=B8=B4=E0=B8=94=E0=B9=83=E0=B8=99 Canva https://=

www.canva.com/design/DAHJAKUnPbc/share?invite=3DwB2dpOLL6nkXw_QuJZHMMA&acce=

ssToken=3DH3DFPfdAWVf_rWAZYzGuRQ&utm_campaign=3Ddesignshare&utm_medium=3Dem=

ail&utm_source=3DshareButton=C2=A0=20

=C2=A0

=C2=A0

=C2=A0

=E0=B8=84=E0=B8=B8=E0=B8=93=E0=B9=84=E0=B8=94=E0=B9=89=E0=B8=A3=E0=B8=B1=

=E0=B8=9A=E0=B8=AD=E0=B8=B5=E0=B9=80=E0=B8=A1=E0=B8=A5=E0=B8=89=E0=B8=9A=E0=

=B8=B1=E0=B8=9A=E0=B8=99=E0=B8=B5=E0=B9=89=E0=B9=80=E0=B8=99=E0=B8=B7=E0=B9=

=88=E0=B8=AD=E0=B8=87=E0=B8=88=E0=B8=B2=E0=B8=81=E0=B8=84=E0=B8=B8=E0=B8=93=

=E0=B8=A1=E0=B8=B5=E0=B8=9A=E0=B8=B1=E0=B8=8D=E0=B8=8A=E0=B8=B5 Canva =E0=

=B8=AD=E0=B8=B5=E0=B9=80=E0=B8=A1=E0=B8=A5=E0=B8=99=E0=B8=B5=E0=B9=89=E0=B9=

=84=E0=B8=A1=E0=B9=88=E0=B9=83=E0=B8=8A=E0=B9=88=E0=B8=AD=E0=B8=B5=E0=B9=80=

=E0=B8=A1=E0=B8=A5=E0=B8=81=E0=B8=B2=E0=B8=A3=E0=B8=95=E0=B8=A5=E0=B8=B2=E0=

=B8=94=E0=B8=AB=E0=B8=A3=E0=B8=B7=E0=B8=AD=E0=B8=AD=E0=B8=B5=E0=B9=80=E0=B8=

=A1=E0=B8=A5=E0=B8=AA=E0=B9=88=E0=B8=87=E0=B9=80=E0=B8=AA=E0=B8=A3=E0=B8=B4=

=E0=B8=A1=E0=B8=81=E0=B8=B2=E0=B8=A3=E0=B8=82=E0=B8=B2=E0=B8=A2 =E0=B8=99=

=E0=B8=B5=E0=B9=88=E0=B8=84=E0=B8=B7=E0=B8=AD=E0=B8=AA=E0=B8=B2=E0=B9=80=E0=

=B8=AB=E0=B8=95=E0=B8=B8=E0=B8=97=E0=B8=B5=E0=B9=88=E0=B8=AD=E0=B8=B5=E0=B9=

=80=E0=B8=A1=E0=B8=A5=E0=B8=99=E0=B8=B5=E0=B9=89=E0=B9=84=E0=B8=A1=E0=B9=88=

=E0=B8=A1=E0=B8=B5=E0=B8=A5=E0=B8=B4=E0=B8=87=E0=B8=81=E0=B9=8C=E0=B8=A2=E0=

=B8=81=E0=B9=80=E0=B8=A5=E0=B8=B4=E0=B8=81=E0=B8=81=E0=B8=B2=E0=B8=A3=E0=B8=

=AA=E0=B8=A1=E0=B8=B1=E0=B8=84=E0=B8=A3 =E0=B8=84=E0=B8=B8=E0=B8=93=E0=B8=

=88=E0=B8=B0=E0=B9=84=E0=B8=94=E0=B9=89=E0=B8=A3=E0=B8=B1=E0=B8=9A=E0=B8=AD=

=E0=B8=B5=E0=B9=80=E0=B8=A1=E0=B8=A5=E0=B8=99=E0=B8=B5=E0=B9=89=E0=B9=81=E0=

=B8=A1=E0=B9=89=E0=B8=A7=E0=B9=88=E0=B8=B2=E0=B8=84=E0=B8=B8=E0=B8=93=E0=B8=

=88=E0=B8=B0=E0=B8=A2=E0=B8=81=E0=B9=80=E0=B8=A5=E0=B8=B4=E0=B8=81=E0=B8=81=

=E0=B8=B2=E0=B8=A3=E0=B8=AA=E0=B8=A1=E0=B8=B1=E0=B8=84=E0=B8=A3=E0=B8=A3=E0=

=B8=B1=E0=B8=9A=E0=B8=AD=E0=B8=B5=E0=B9=80=E0=B8=A1=E0=B8=A5=E0=B8=81=E0=B8=

=B2=E0=B8=A3=E0=B8=95=E0=B8=A5=E0=B8=B2=E0=B8=94=E0=B8=82=E0=B8=AD=E0=B8=87=

Canva =E0=B9=81=E0=B8=A5=E0=B9=89=E0=B8=A7=E0=B8=81=E0=B9=87=E0=B8=95=E0=

=B8=B2=E0=B8=A1 =20

=C2=A0

=C2=A0

=E0=B8=AA=E0=B8=A3=E0=B9=89=E0=B8=B2=E0=B8=87=E0=B8=82=E0=B8=B6=E0=B9=89=E0=

=B8=99=E0=B9=80=E0=B8=9E=E0=B8=B7=E0=B9=88=E0=B8=AD=E0=B8=84=E0=B8=B8=E0=B8=

=93=E0=B8=94=E0=B9=89=E0=B8=A7=E0=B8=A2=E0=B8=88=E0=B8=B2=E0=B8=81 Canva

Canva Pty Ltd, 110 Kippax St, NSW 2010, Australia

ABN 80 158 929 938 | Privacy Policy https://www.canva.com/policies/privacy-=

policy/

Thai Language Canva Phish from Amaczon Part 1

Posted by Dave Yadallee on Thursday, May 7. 2026

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 07 May 2026 13:54:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1wL4mY-00000000Ifx-0NRw

for dave@doctor.nl2k.ab.ca;

Thu, 07 May 2026 13:53:14 -0600

Resent-From: The Doctor

Resent-Date: Thu, 7 May 2026 13:53:13 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from a76-100.smtp-out.amazonses.com ([54.240.76.100]:49859)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.98.2 (FreeBSD))

(envelope-from <0100019e033a8daa-890f8f2b-cacc-4d9f-a88e-4e28d3fa613b-000000@mail.canva.com>)

id 1wL1QJ-000000005zs-05gN

for doctor@doctor.nl2k.ab.ca;

Thu, 07 May 2026 10:18:11 -0600

DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/simple;

s=ypmurnb6l4uw7ik4ed3bnk2reh4kqpqm; d=canva.com; t=1778170629;

h=Date:From:To:Message-ID:Subject:MIME-Version:Content-Type:List-Unsubscribe-Post:List-Unsubscribe;

bh=2P4NMzfmrLHbtN90ErxV4NbJehd7CHHe/nniDzSXTKw=;

b=o4Wk1oB8hrj6jUNq5waLrGoQtrGrApsanmkIANoEyciNvcJZ84QcnX4yhszxSMHz

mbwA2ws0BPafz/OvBk5B7/iHmndnNIyzNjt4BBMqLN5DLtPbJCAVE2Y0kwtWeDde821

nRWiR85JOpEvCgw5SiCq3wWE3S3kJiUH2CfwtgUY=

DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/simple;

s=224i4yxa5dv7c2xz3womw6peuasteono; d=amazonses.com; t=1778170629;

h=Date:From:To:Message-ID:Subject:MIME-Version:Content-Type:List-Unsubscribe-Post:List-Unsubscribe:Feedback-ID;

bh=2P4NMzfmrLHbtN90ErxV4NbJehd7CHHe/nniDzSXTKw=;

b=Zr0WIeOK6zPRGaN7WAmaQtgEUPaf0iusCCdilrbqqo6ZX1ogZti9Pmd3Kz4NAOFW

g2Z0sT84nfOE+32mSRin+rqwwhQQrs48gdTEXyKniPHrFDmm2W0jqCEdIa5zfyK48nQ

DwQQVLQ1W6fEXUH8IODL8HcpzZX62H1CZ6HvsMAY=

Date: Thu, 7 May 2026 16:17:09 +0000

From: =?UTF-8?B?4Lic4Li54LmJ4LmD4LiK4LmJIENhbnZh?=

To: doctor@doctor.nl2k.ab.ca

Message-ID: <0100019e033a8daa-890f8f2b-cacc-4d9f-a88e-4e28d3fa613b-000000@email.amazonses.com>

Subject: =?UTF-8?B?4LiU4Li14LmE4LiL4LiZ4LmM4LiX4Li14LmI?=

=?UTF-8?B?4LmB4LiK4Lij4LmM4LiB4Lix4Lia4LiE4Li44LiT?=

MIME-Version: 1.0

Content-Type: multipart/related;

boundary="----=_Part_1405281_319353436.1778170629532"

List-Unsubscribe-Post: List-Unsubscribe=One-Click

List-Unsubscribe:

Feedback-ID: tem_01e0br4wrepyfn6getyc5tz3h6::1.us-east-1.DcdLQsUfV4bQ5Js81yJ5zbYh1g1N/Fje4R2eTpK5fRw=:AmazonSES

X-SES-Outgoing: 2026.05.07-54.240.76.100

X-Spam_score: 5.3

X-Spam_score_int: 53

X-Spam_bar: +++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.

Content preview: à¸¡à¸µà¸”à¸µà¹„à¸‹à¸™à¹Œà¸–à¸¹à¸à¹à¸Šà¸£à¹Œà¸à¸±à¸šà¸„à¸¸à¸“à¹‚à¸”à¸¢

swp30000@swp.ï»¿ac.ï»¿th à¸„à¸¸à¸“à¸£à¸¹à¹‰à¸ˆà¸±à¸à¸„à¸™à¸™à¸µà¹‰à¸¡à¸±à¹‰à¸¢?
à¸„à¸³à¹€à¸Šà¸´à¸

Canva à¸™à¸µà¹‰à¸¡à¸²à¸ˆà¸²à¸à¸„à¸™à¸—à¸µà¹ˆà¸„à¸¸à¸“à¸à¸²à¸ˆà¹„à¸¡à¹ˆà¸£à¸¹à¹‰à¸ˆà¸±à¸

à¸£à¸°à¸§à¸±à¸‡à¸ˆà¸°à¸– [...]

Content analysis details: (5.3 points, 5.0 required)

pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[54.240.76.100 listed in dnsbl.ahbl.org]

[54.240.76.100 listed in dnsbl.ahbl.org]

[54.240.76.100 listed in dnsbl.ahbl.org]

[54.240.76.100 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[54.240.76.100 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[54.240.76.100 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[54.240.76.100 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[54.240.76.100 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[54.240.76.100 listed in will-spam-for-food.eu.org]

[54.240.76.100 listed in will-spam-for-food.eu.org]

[54.240.76.100 listed in will-spam-for-food.eu.org]

[54.240.76.100 listed in will-spam-for-food.eu.org]

[54.240.76.100 listed in will-spam-for-food.eu.org]

[54.240.76.100 listed in will-spam-for-food.eu.org]

[54.240.76.100 listed in will-spam-for-food.eu.org]

[54.240.76.100 listed in will-spam-for-food.eu.org]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[54.240.76.100 listed in list.dnswl.org]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[54.240.76.100 listed in bl.score.senderscore.com]

-0.0 SPF_PASS SPF: sender matches SPF record

2.0 GR_DOMAIN_AMAZON1 Received contains spam friendly host (amazon)

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 SARE_FROM_SPAM_WORD4 From address suggests this may be spam

2.0 RATWR8_MESSID Message-ID with excessive dashes and dollars

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

Subject: {SPAM?} =?UTF-8?B?4LiU4Li14LmE4LiL4LiZ4LmM4LiX4Li14LmI?=

=?UTF-8?B?4LmB4LiK4Lij4LmM4LiB4Lix4Lia4LiE4Li44LiT?=

Geek Squad Phish from Microsoft Outlook Part 3

Posted by Dave Yadallee on Thursday, May 7. 2026

Content analysis details: (11.5 points, 5.0 required)

pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[40.93.12.8 listed in dnsbl.ahbl.org]

[40.93.12.8 listed in dnsbl.ahbl.org]

[40.93.12.8 listed in dnsbl.ahbl.org]

[40.93.12.8 listed in dnsbl.ahbl.org]

[209.85.221.74 listed in dnsbl.ahbl.org]

[209.85.221.74 listed in dnsbl.ahbl.org]

[209.85.221.74 listed in dnsbl.ahbl.org]

[209.85.221.74 listed in dnsbl.ahbl.org]

[2603:10a6:400:292:0:0:0:13 listed in]

[dnsbl.ahbl.org]

[2603:10a6:400:292:0:0:0:13 listed in]

[dnsbl.ahbl.org]

[2603:10a6:400:292:0:0:0:13 listed in]

[dnsbl.ahbl.org]

[2603:10a6:400:292:0:0:0:13 listed in]

[dnsbl.ahbl.org]

[2603:10a6:400:292:cafe:0:0:a5 listed in]

[dnsbl.ahbl.org]

[2603:10a6:400:292:cafe:0:0:a5 listed in]

[dnsbl.ahbl.org]

[2603:10a6:400:292:cafe:0:0:a5 listed in]

[dnsbl.ahbl.org]

[2603:10a6:400:292:cafe:0:0:a5 listed in]

[dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[40.93.12.8 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[40.93.12.8 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[40.93.12.8 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[40.93.12.8 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[209.85.221.74 listed in will-spam-for-food.eu.org]

[209.85.221.74 listed in will-spam-for-food.eu.org]

[209.85.221.74 listed in will-spam-for-food.eu.org]

[209.85.221.74 listed in will-spam-for-food.eu.org]

[209.85.221.74 listed in will-spam-for-food.eu.org]

[209.85.221.74 listed in will-spam-for-food.eu.org]

[209.85.221.74 listed in will-spam-for-food.eu.org]

[209.85.221.74 listed in will-spam-for-food.eu.org]

[2603:10a6:400:292:cafe:0:0:a5 listed in]

[will-spam-for-food.eu.org]

[2603:10a6:400:292:cafe:0:0:a5 listed in]

[will-spam-for-food.eu.org]

[2603:10a6:400:292:cafe:0:0:a5 listed in]

[will-spam-for-food.eu.org]

[2603:10a6:400:292:cafe:0:0:a5 listed in]

[will-spam-for-food.eu.org]

[2603:10a6:400:292:cafe:0:0:a5 listed in]

[will-spam-for-food.eu.org]

[2603:10a6:400:292:cafe:0:0:a5 listed in]

[will-spam-for-food.eu.org]

[2603:10a6:400:292:cafe:0:0:a5 listed in]

[will-spam-for-food.eu.org]

[2603:10a6:400:292:cafe:0:0:a5 listed in]

[will-spam-for-food.eu.org]

[2603:10a6:400:292:0:0:0:13 listed in]

[will-spam-for-food.eu.org]

[2603:10a6:400:292:0:0:0:13 listed in]

[will-spam-for-food.eu.org]

[2603:10a6:400:292:0:0:0:13 listed in]

[will-spam-for-food.eu.org]

[2603:10a6:400:292:0:0:0:13 listed in]

[will-spam-for-food.eu.org]

[2603:10a6:400:292:0:0:0:13 listed in]

[will-spam-for-food.eu.org]

[2603:10a6:400:292:0:0:0:13 listed in]

[will-spam-for-food.eu.org]

[2603:10a6:400:292:0:0:0:13 listed in]

[will-spam-for-food.eu.org]

[2603:10a6:400:292:0:0:0:13 listed in]

[will-spam-for-food.eu.org]

[40.93.12.8 listed in will-spam-for-food.eu.org]

[40.93.12.8 listed in will-spam-for-food.eu.org]

[40.93.12.8 listed in will-spam-for-food.eu.org]

[40.93.12.8 listed in will-spam-for-food.eu.org]

[40.93.12.8 listed in will-spam-for-food.eu.org]

[40.93.12.8 listed in will-spam-for-food.eu.org]

[40.93.12.8 listed in will-spam-for-food.eu.org]

[40.93.12.8 listed in will-spam-for-food.eu.org]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[40.93.12.8 listed in list.dnswl.org]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-0.0 SPF_PASS SPF: sender matches SPF record

-0.0 SPF_HELO_PASS SPF: HELO matches SPF record

0.5 FROM_LOCAL_NOVOWEL From: localpart has series of non-vowel letters

3.5 VOWEL_FROM_7 Impronouncable from header (7+ consecutive vowels)

1.0 HK_RANDOM_REPLYTO Reply-To username looks random

1.0 HK_RANDOM_FROM From username looks random

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[40.93.12.8 listed in bl.score.senderscore.com]

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[40.93.12.8 listed in wl.mailspike.net]

0.0 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level mail

domains are different

0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider

[haressaznzxrrsxaxz321(at)gmail.com]

-0.0 T_RP_MATCHES_RCVD Envelope sender domain matches handover relay

domain

0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in digit

[haressaznzxrrsxaxz321(at)gmail.com]

0.3 LONGWORD BODY: Uses overlong words

0.1 TW_RW BODY: Odd Letter Triples with RW

0.1 TW_GW BODY: Odd Letter Triples with GW

0.6 MEGALONGWORD BODY: Uses really overlong words

0.1 TW_VG BODY: Odd Letter Triples with VG

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.2 FREEMAIL_FORGED_FROMDOMAIN 2nd level domains in From and EnvelopeFrom

freemail headers are different

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

2.0 RATWR8_MESSID Message-ID with excessive dashes and dollars

0.1 TO_IN_SUBJ To address is in Subject

0.6 LONG_INVISIBLE_TEXT Long block of hidden text - bayes poison?

Subject: {SPAM?} =?UTF-8?Q?Pozv=C3=A1nky=3A_Subscription_Renewal_Confirmation_=2D_Geek_?=

=?UTF-8?Q?Squad_Protection_=40_=C5=A1t_7=2E_m=C3=A1j_2026_=28cynthiaperez389903=40grou?=

=?UTF-8?Q?ps=2Eoutlook=2Ecom=29?=

Geek Squad Phish from Microsoft Outlook Part 4

Posted by Dave Yadallee on Thursday, May 7. 2026

Haresasz Nxysarwsa has invited you to Subscription Renewal Confirmation – Geek Squad Protection

Title: Subscription Renewal Confirmation – Geek Squad Protection

Location: https://meet.google.com/fys-vgwn-yza

When: May 7, 2026

Organizer:

Haresasz Nxysarwsa

Description: Dear Customer,

We appreciate your continued trust in Geek Squad Protection Services. Your membership for the 365 Premium Security Plan has been renewed successfully for the next 3 years.

The renewal amount of $249.99 will be deducted from your registered billing method shortly, and it may take up to 24 hours for the transaction to appear on your statement.

Subscription Information:

Service Plan: 365 Premium Security Plan

Coverage Duration: 3 Years

Renewal Charge: $249.99

If you believe this renewal was made in error or would like to cancel the subscription before processing is completed, please contact our billing department immediately at +1 802 252 5593.

Thank you for choosing Geek Squad Protection Services.

Best Regards,

Geek Squad Billing Team

-::~:~::~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~::~:~::-

Pripojiť sa cez Google Meet: https://meet.google.com/fys-vgwn-yza

Viac o službe Meet sa dozviete na https://support.google.com/a/users/answer/9282720

Túto sekciu neupravujte.

-::~:~::~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~::~:~::-

Attendees:

cynthiaperez389903@groups.outlook.com

Subscription Renewal Confirmation – Geek Squad Protection

Pripojiť sa cez Google Meet – Dear Customer, We appreciate your continued trust in Geek Squad Protection Services. Your membership for the 365 Premium Security Plan has been renewed successfully for the next 3 years. The renewal

Pripojiť sa cez Google Meet

Odkaz na stretnutie

meet.google.com/fys-vgwn-yza

Dear Customer,

We appreciate your continued trust in Geek Squad Protection Services. Your membership for the 365 Premium Security Plan has been renewed successfully for the next 3 years.

The renewal amount of $249.99 will be deducted from your registered billing method shortly, and it may take up to 24 hours for the transaction to appear on your statement.

Subscription Information:

Service Plan: 365 Premium Security Plan

Coverage Duration: 3 Years

Renewal Charge: $249.99

If you believe this renewal was made in error or would like to cancel the subscription before processing is completed, please contact our billing department immediately at +1 802 252 5593.

Thank you for choosing Geek Squad Protection Services.

Best Regards,

Geek Squad Billing Team

Kedy

štvrtok 7. máj 2026

Organizátor

Haresasz Nxysarwsa

haressaznzxrrsxaxz321@gmail.com

Hostia

(Zoznam hostí bol na žiadosť organizátora skrytý)

Odpoveď na cynthiaperez389903@groups.outlook.com

Áno

Nie

Možno

Ďalšie možnosti

Pozvánka z Kalendára Google

Túto správu ste dostali, pretože ste účastníkom danej udalosti.

Ak túto pozvánku prepošlete, ktorýkoľvek jej príjemca bude môcť odoslať odpoveď organizátorovi, byť pridaný do zoznamu hostí, pozývať iných bez ohľadu na ich vlastný stav pozvánky alebo meniť vaše potvrdenie účasti. Ďalšie informácie

Geek Squad Phish from Microsoft Outlook Part 2

Posted by Dave Yadallee on Thursday, May 7. 2026

X-Microsoft-Antispam-Message-Info:

=?utf-8?B?THQrRkZaY0RrUlRRSHRqd0xPVHFuRnM4NUtjWHlFL2Y0Rk83ZjFMdUpvdVYr?=

=?utf-8?B?MHpCTm53WFFsclk2cFMwUXpkRXg5czZEdzZBK3ZPQzBndU9QanNWc2o1MWpj?=

=?utf-8?B?WFczZHBLWnFuTStLanpEWWUwT3k1QjROMjBtWnNscTF5OWhlSFB0OEd2ZHlm?=

=?utf-8?B?ZEZDbkgrbERvOWUrbFJTUHE1akJvNjBZYi9MZUdiUFo4a1Z4UkpieG5xWllG?=

=?utf-8?B?cS9TUHkyOUc4aHN0RkpRVzZraWxLVkdrcnNzeC9MNWJCdHU4L3VDMlNXMlVr?=

=?utf-8?B?dXlTaCtmYmcyZDdwNVlXZnVlbGc1dzFlNTI2M04vWGc4dy9PQkR1TTZ5Zm5p?=

=?utf-8?B?R0NJaHpUdzBrVnhuS1FSaytLb0Y3dkNIYW9hemVuZUtpT0ZDWnQyam52Skt2?=

=?utf-8?B?TnZTMEhONURDV1EwUnU5QlExY3NLT05kaFIvVzhRQ0o1M2dvelU0VTRFVzNS?=

=?utf-8?B?Y0tjMWtUYnp2dk9BYm5XSStOQzdLK0RNenpjM3lqajIwbHhEY2J1dDkzaW1M?=

=?utf-8?B?QTBiNDlKRFdMRGEvdzJySndnQnBRaXNFQzlGN0Vtd2owMFhrTWt2OXhGYVNU?=

=?utf-8?B?QW1JdHQwaU12MEpzb0lmN2FKaE9GZUdUQktnUnVLSWx2MkVsWVh5TTMyaWV6?=

=?utf-8?B?dVNkemJ4Q1djR2FxZTByM05NK2ZXK1RSaCt1TitGV0xockpmTWFYT3g5VEF6?=

=?utf-8?B?NnFuZUNJMEVtbTFqSnJ5T05uYkwyZzlNdy83dkYyc1I0UVIvYU90SWllWHF1?=

=?utf-8?B?RmxZUVNTZjZGVU8zWTJoMlJEcUEvaDZtZFE3SmZhSTVCUXRaRXNkc1RMd0VT?=

=?utf-8?B?YkYzWEtSL1RDSDlLQUdYQ2ZQTWhzbnhrQjZ4Q09KQ0ZlT3Z1aUhRbWxOdVMr?=

=?utf-8?B?RmlJamVTeXc0OXVtNkdFMTdjRnBrY1JhcHNmMDBRb2xvbTFvbTlYKy9FdnV4?=

=?utf-8?B?U0I5YWp3V1A2ZzBRTUxmM1g2MVdEQmQ5ZDRJaE1xODVKcHhyaGVtSHh4Y3pp?=

=?utf-8?B?cWgrcmpHc3RwOWMveDBZdGk1THo1N2JaODVWbE5DZUJvZmxHZS9uUUloRjd0?=

=?utf-8?B?VUxtcHlaeWN6NUtZY3VXRjM4QmNOSWd2ZGd2eHpCTTZjTWxBdTlEeEZhWTY3?=

=?utf-8?B?SzJzWW9EaXhjQTFRY1lwVkZub1dXeHNOS0x5bFBmVnNCVklyN2llRnhkZnN4?=

=?utf-8?B?azd5OWQxTUNEK2gxVENKYjQrTTRPYjRkMjVkR08xZkc1S25zUS85NVloSlpN?=

=?utf-8?B?R1dlaGxJTkNLN3p4NDhBZ1pvWlBRTURFMkxjNnNQek91SjAwdmNrWk1CalNZ?=

=?utf-8?B?c01uRWx4dzZOMEhJVThQenVkQmFLekJNMHB3YnFGSFpsTFJSdFpCWG5mSGN1?=

=?utf-8?B?UHRDMzh2bnY0d3ppMkEyZ2c2Mk5CSWd3TGF0aXlaL2VwdmhtejQvNDJCZklo?=

=?utf-8?B?YkNEQStyZVozNzQ4blRJb2t5WEpOL1ZzdWo2MnVlOVJsNFZySlZvY1RSOEdv?=

=?utf-8?B?U0JNSFlydnl2TlBNUDNLZ0N4R3RJYXUwcVVKZnFqVW5jQlJUYjJaRjUrK3Yr?=

=?utf-8?B?dFNVUTVlZm9WaDJWa2JFWnB4Rlp6K3VUR3hBQ3dXME5KeEs4Ujh2MERMN2sy?=

=?utf-8?B?d1dKV3FJSEs0d0hIdkVTOEdzUklyeDdKeEU0bjlhU096YUxSN3Zrb0RmaUhI?=

=?utf-8?B?UFhVZUV5L00zY3MyOG92eDRzVFBwU0VwU2QydlRiazF6RFViQkdDd1pZWmpk?=

=?utf-8?B?d0V1b0x5R1BvaXZlTjl6TWVLSEppaFlvbUZLZDhGcDYvS2U0SWs4NkVSMEpa?=

=?utf-8?B?V2gxSFh1bEhqSGFzbFhvSFNuMWVhSWw1cHpaMTVrKzByZnVkMlg1TzJDS0tW?=

=?utf-8?B?K1dCdzNJOUxDMGxVL0dZYXlIU21FdDdBTm9ITGpid2RSeVdYSVJBaUE5SmE5?=

=?utf-8?B?SzhsRk9yNmdFTEUrRkIzMnNCUUsxd1pxWHF5aWhqMW9qTEhic1pSL0NiNGdG?=

=?utf-8?B?ZnAzY3ZnN3NpRit5UHZoY0NKOFZHbTRTRUJtbVlhbFpyUWxEVG5VK1pXbFRp?=

=?utf-8?B?akVnZGUyOWdTbTFVbWhxOHNyRE9VOGpBN29tRlRTNEdUcFgybnYrdjEzelJS?=

=?utf-8?B?Q2tzRFo0V2EyY0FXdEpvcDRLZ2VIbEdEaFFieUxwRExWOXA3NnlMdlF3MTQ2?=

=?utf-8?B?NjZKK0habVRrRnh3b2tmNHZ4R0lrMFUraU1MWmZmNlZTbmtoSmlnZmVHNGQ5?=

=?utf-8?B?N0lVNlpSaVRvYzJUMGRPTU1ETDRlUUVnb2x6bVQvZW5YUm1aenhkZ1ZHLzdt?=

=?utf-8?B?Qk8vTTYzcEtBbXJEOWg0Ym41MzVjSVpmZTFDcjBsZEVsQlg3MUs3N3QvOHBp?=

=?utf-8?B?VnZGenZRZnlKMHNDWVdscFZ4WFdMeU16aTg2TjlXM3FSZzR4TlJnb252dnY4?=

=?utf-8?B?bmZlS2dIMXIvL1ZtbEx4OE4xSEdpOG9ZSEZLQmZUU2Z1eHV5YndYT1JNWXNB?=

=?utf-8?B?enJrb0FiaDU1MGNFNFZvUzlmWkljbkxMWXJmT1VQQWtNKzhvQ0kzQ3oxMWs5?=

=?utf-8?B?bGFVcldDdmpYTGp3OVZvWnNUNWpEM1VvWnVKcitHNFRjbG0yNXJPdnpSM0d2?=

=?utf-8?B?QVhWcU4yeUJ5a3NCYmc5bG1TZ3crdlh4RDNSZWt2enRWN0JOT3EzRW9sNzV1?=

=?utf-8?B?OThGWlk0VGNwSDNJMjlXSmNVbExILzZINkNjRmQ2U1VKMjdicXYxU1J2eFM1?=

=?utf-8?B?YnFubUlzU2tSK0NCN0hMSGtZeGlUWmQ1c1crc2JBenNCZ1dTZkJEYlpqM05K?=

=?utf-8?B?YU1XWjdWMFZJa2dlN2NDU1dSS0JpT0ZHLzVwb0J4VkVEdXNKcmU0Sy9hQ0J6?=

=?utf-8?B?VHlXcDZhalVETEx3dlJIOGZIQUg0MWZFTHgwcHlpZ1FSWDVlTDdQdWZUck5l?=

=?utf-8?B?c2k0L2ZtaXRKbzgyT2lmS2Z0emZEeVRNak9aV3Q2N1c3UjIyc1BmcEFyeWQx?=

=?utf-8?B?c3ZaOW41WlErMW5MakRSSUNoeC9SblhlK0VYeG8ycUR2VDczbkFsUjJHR3hh?=

=?utf-8?B?V1JlK0ZZTit4TXVnPT0=?=

X-Auto-Response-Suppress: DR, OOF, AutoReply

X-OriginatorOrg: sct-15-20-9412-4-msonline-outlook-090a5.templateTenant

X-MS-Exchange-CrossTenant-OriginalArrivalTime: 07 May 2026 16:39:09.8914

(UTC)

X-MS-Exchange-CrossTenant-Network-Message-Id: 9d457af0-0897-4458-b0ba-08deac5729f0

X-MS-Exchange-CrossTenant-Id: 84df9e7f-e9f6-40af-b435-aaaaaaaaaaaa

X-MS-Exchange-CrossTenant-AuthSource: AM3PEPF0000A794.eurprd04.prod.outlook.com

X-MS-Exchange-CrossTenant-AuthAs: Anonymous

X-MS-Exchange-CrossTenant-FromEntityHeader: Internet

X-MS-Exchange-Transport-CrossTenantHeadersStamped: MW4PR18MB5033

X-Spam_score: 11.5

X-Spam_score_int: 115

X-Spam_bar: +++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.

Content preview: Subscription Renewal Confirmation â€“ Geek Squad Protection

Å¡tvrtok 7. mÃ¡j 2026 PripojiÅ¥ sa cez Google Meet https://meet.google.com/fys-vgwn-yza?hs=224

Dear Customer,

Geek Squad Phish from Microsoft Outlook Part 1

Posted by Dave Yadallee on Thursday, May 7. 2026

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 07 May 2026 13:54:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1wL4mo-00000000Ihb-19uE

for dave@doctor.nl2k.ab.ca;

Thu, 07 May 2026 13:53:30 -0600

Resent-From: The Doctor

Resent-Date: Thu, 7 May 2026 13:53:30 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-eastus2azlp17011008.outbound.protection.outlook.com ([40.93.12.8]:11997 helo=BN8PR05CU002.outbound.protection.outlook.com)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1wL1ln-000000007ix-0jSj

for doctor@doctor.nl2k.ab.ca;

Thu, 07 May 2026 10:40:27 -0600

Received: from CW1P123CA0022.GBRP123.PROD.OUTLOOK.COM (2603:10a6:400:292::13)

by MW4PR18MB5033.namprd18.prod.outlook.com (2603:10b6:303:1b8::17) with

Microsoft SMTP Server (version=TLS1_2,

cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.9891.18; Thu, 7 May

2026 16:39:10 +0000

Received: from AM3PEPF0000A794.eurprd04.prod.outlook.com

(2603:10a6:400:292:cafe::a5) by CW1P123CA0022.outlook.office365.com

(2603:10a6:400:292::13) with Microsoft SMTP Server (version=TLS1_3,

cipher=TLS_AES_256_GCM_SHA384) id 15.20.9891.17 via Frontend Transport; Thu,

7 May 2026 16:39:09 +0000

Authentication-Results: spf=pass (sender IP is 209.85.221.74)

smtp.mailfrom=gmail.com; dkim=pass (signature was verified)

header.d=google.com;dkim=pass (signature was verified)

header.d=gmail.com;dmarc=pass action=none header.from=gmail.com;compauth=pass

reason=100

Received-SPF: Pass (protection.outlook.com: domain of gmail.com designates

209.85.221.74 as permitted sender) receiver=protection.outlook.com;

client-ip=209.85.221.74; helo=mail-wr1-f74.google.com; pr=C

Received: from mail-wr1-f74.google.com (209.85.221.74) by

AM3PEPF0000A794.mail.protection.outlook.com (10.167.16.123) with Microsoft

SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.20.9891.9

via Frontend Transport; Thu, 7 May 2026 16:39:09 +0000

X-IncomingTopHeaderMarker:

OriginalChecksum:5099C10017152062934CF62A3378BD971DC856670924E2350AFC5857060B853F;UpperCasedChecksum:BB5C06D8FE324B27EF356B36297845BC08356305F15A69C699C1EF29801F43FF;SizeAsReceived:3421;Count:15

Received: by mail-wr1-f74.google.com with SMTP id ffacd0b85a97d-44a122a5128so845535f8f.0

for ; Thu, 07 May 2026 09:39:09 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=google.com; s=20251104; t=1778171949; x=1778776749; darn=groups.outlook.com;

h=to:from:subject:date:message-id:sender:reply-to:mime-version:from

:to:cc:subject:date:message-id:reply-to;

bh=Fdqip5EXI7TLINs0Gk5fJVwECba3V6CjBMm8ETqUIM0=;

b=OiUlwRl/CM8sPdbhZVwiAjO5PTOHtjN+ynRioeM6Csi8mPP1KoKRu1eHkZygkYZkPs

8PSASFL0sBKMNsraDBzbBKuOOYzA7MA3CXCrtK5aMBIF2Up+NDl+UybR8+GBJK8Ybzd5

1jtInVnodtRlxOmiRyIkm7VIu30SFu9mZnIOCG61B6hQnbsfqsaRlYEZeeSOuxORWUuw

Mm332pOxoMahJk+Mn/aUUqoRR/gKgRG4EotptIFxzZhOgJolnowuTl+M81UrM1anXD/w

lR6noU6OKf4LmqcybSh88RVWROYPAKSHDOnYxoti1xpUIrpVmIxcrUPUK4Q/E0WUjtvx

XCsg==

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=gmail.com; s=20251104; t=1778171949; x=1778776749; darn=groups.outlook.com;

h=to:from:subject:date:message-id:sender:reply-to:mime-version:from

:to:cc:subject:date:message-id:reply-to;

bh=Fdqip5EXI7TLINs0Gk5fJVwECba3V6CjBMm8ETqUIM0=;

b=s4kGdidbY7p0XaB/ZPFYvD9wtnRvxHBDJr4zjUCUUUwtWJkyFUCnqnmlPdfi8QhcfT

HTxg+4/wmtlUHeSLNTBXJWW869G+fCtiZwSpp/fvfSpcgyuiO411pcIPgAYG1eLH35j3

bOjRElroK35cbCx0pVBgd4ZoG+84gOrF1VTERk4hFZEMNRw45NRv4VIsfd6cR+x8W7ur

oQIWY1sDrA/yPomacrFlVW8GuUXYDd/GXkVKlL1RA7ROsJ3/vZoPtZIlnu9mm2Ivjwmd

UcOQuDcT57++zSPP5FDmsRBuww9aQko2ZOEzqv149A108AwM8SGYjlz/LQdT0ygCnZgb

8BwQ==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20251104; t=1778171949; x=1778776749;

h=to:from:subject:date:message-id:sender:reply-to:mime-version

:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to;

bh=Fdqip5EXI7TLINs0Gk5fJVwECba3V6CjBMm8ETqUIM0=;

b=oujuhr55a8EI89mVtJq20jvmeT3tgPW0l18aKstTLWunhOkZmHpapHlQNpEBbzQSKQ

pZxL8Hy5H6zChokamrVA/cvYaNHyTi2iRtOXQcB1Gj/zpSCk9NO28FDUkZ7lWUlxCLOo

y1MoE61MA5Vh6nwEBeXyxTOJPrSFTFOa9q1lDtsactC2nrDNoSIksDZHjQ8CKHtbIgiX

Aao2HdzuEvbLevC8oPwymmGP7Pj3I7TZ0XvYU9yjdx4YU5jr2/rq/pJo/Km5Bh269n0E

NjGDx1dad1g0dAnt/mV+Vq99XHNmqQYYVpGoyurqutNQJNIBNwZtut05Yc5yGeYImOSf

8wEw==

X-Gm-Message-State: AOJu0YyFa8QiN3JAPMGog2zLEc3Ze2zf8YflzjuLMfjoCovzsXn/146m

sDHLKcNcttmrKBNnOU1hmA+V5+aowaNtYFY/jL3qFS6dlrH+wO0wAyfQ9aHje298ELLvekBfub0

GbB9nWOr8ptiSeHYPbFyxCk33L8fUewt2f5s=

MIME-Version: 1.0

X-Received: by 2002:a05:600c:6095:b0:485:39b2:a47c with SMTP id

5b1f17b1804b1-48e51f48352mr142397145e9.25.1778171949500; Thu, 07 May 2026

09:39:09 -0700 (PDT)

Reply-To: Haresasz Nxysarwsa

Sender: =?UTF-8?Q?Kalend=C3=A1r_Google?=

Message-ID:

Date: Thu, 07 May 2026 16:39:09 +0000

Subject: =?UTF-8?Q?Pozv=C3=A1nky=3A_Subscription_Renewal_Confirmation_=2D_Geek_?=

=?UTF-8?Q?Squad_Protection_=40_=C5=A1t_7=2E_m=C3=A1j_2026_=28cynthiaperez389903=40grou?=

=?UTF-8?Q?ps=2Eoutlook=2Ecom=29?=

From: Haresasz Nxysarwsa

To: cynthiaperez389903@groups.outlook.com

Content-Type: multipart/mixed; boundary="0000000000006652c106513ceb0a"

X-IncomingHeaderCount: 15

X-EOPAttributedMessage: 0

X-EOPTenantAttributedMessage: 84df9e7f-e9f6-40af-b435-aaaaaaaaaaaa:0

X-MS-PublicTrafficType: Email

X-MS-TrafficTypeDiagnostic: AM3PEPF0000A794:EE_|MW4PR18MB5033:EE_

X-MS-Office365-Filtering-Correlation-Id: 9d457af0-0897-4458-b0ba-08deac5729f0

X-MS-Exchange-EOPDirect: true

X-Sender-IP: 209.85.221.74

X-SID-PRA: HARESSAZNZXRRSXAXZ321@GMAIL.COM

X-SID-Result: PASS

X-MS-Consumer-Group-Expansion-Loop: cynthiaperez389903@groups.outlook.com

X-MS-Exchange-Group-Expansion-Loop: cynthiaperez389903@groups.outlook.com

X-Microsoft-Antispam:

BCL:0;ARA:1444111002|9020799019|26130799012|26000799027|29080799009|9400799043|6019299003|5139299004|51080799003|100100799003|4040799016|1680799066|6092099016|16200799027|3069299007|9000799056|461199028|1370799030|1380799030|1360799030|1602099012|440099028|3412199025|4302099013|2145499017|30041999003|26104999009;

CBS / Paramount Phish from Google Gmail

Posted by Dave Yadallee on Thursday, May 7. 2026

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 07 May 2026 13:54:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1wL4n3-00000000Iia-3pm4

for dave@doctor.nl2k.ab.ca;

Thu, 07 May 2026 13:53:45 -0600

Resent-From: The Doctor

Resent-Date: Thu, 7 May 2026 13:53:45 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from notify.vobie.mobi ([34.168.17.114]:63746)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1wL2JV-00000000AhY-3QM4

for root@doctor.nl2k.ab.ca;

Thu, 07 May 2026 11:15:15 -0600

Received: from ec2-52-40-185-211.us-west-2.compute.amazonaws.com ([52.40.185.211] helo=[127.0.0.1])

by notify.vobie.mobi with esmtpa (Exim 4.92)

(envelope-from )

id 1wL2Ij-0004CM-Bu

for root@doctor.nl2k.ab.ca; Fri, 08 May 2026 01:14:17 +0800

Content-Type: multipart/mixed; boundary="===============7483429206826906490=="

MIME-Version: 1.0

From: Vobile Compliance

To: root@doctor.nl2k.ab.ca

Subject: Notice of Claimed Infringement - Case ID 42a4300cb130e7cd642f

Reply-To: p2p@copyright-notice.com

X-Originator: p2p@copyright-notice.com

Message-Id: d6720824-eddb-4e2b-8fe9-5540ae4a22fc@copyright-notice.com>

X-Mail-From: p2p@copyright-notice.com

X-Message-ID: d6720824-eddb-4e2b-8fe9-5540ae4a22fc@copyright-notice.com>

X-Notice-ID: 42a4300cb130e7cd642f

Auto-Submitted: auto-generated

Date: Fri, 08 May 2026 01:14:17 +0800

X-Spam_score: 6.1

X-Spam_score_int: 61

X-Spam_bar: ++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.

Content preview: -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Notice ID: 42a4300cb130e7cd642f

Notice Date: 2026-05-07T17:14:17Z WorldGate

Content analysis details: (6.1 points, 5.0 required)

pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[34.168.17.114 listed in dnsbl.ahbl.org]

[34.168.17.114 listed in dnsbl.ahbl.org]

[34.168.17.114 listed in dnsbl.ahbl.org]

[34.168.17.114 listed in dnsbl.ahbl.org]

[52.40.185.211 listed in dnsbl.ahbl.org]

[52.40.185.211 listed in dnsbl.ahbl.org]

[52.40.185.211 listed in dnsbl.ahbl.org]

[52.40.185.211 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[34.168.17.114 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[34.168.17.114 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[34.168.17.114 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[34.168.17.114 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[52.40.185.211 listed in will-spam-for-food.eu.org]

[52.40.185.211 listed in will-spam-for-food.eu.org]

[52.40.185.211 listed in will-spam-for-food.eu.org]

[52.40.185.211 listed in will-spam-for-food.eu.org]

[52.40.185.211 listed in will-spam-for-food.eu.org]

[52.40.185.211 listed in will-spam-for-food.eu.org]

[52.40.185.211 listed in will-spam-for-food.eu.org]

[52.40.185.211 listed in will-spam-for-food.eu.org]

[34.168.17.114 listed in will-spam-for-food.eu.org]

[34.168.17.114 listed in will-spam-for-food.eu.org]

[34.168.17.114 listed in will-spam-for-food.eu.org]

[34.168.17.114 listed in will-spam-for-food.eu.org]

[34.168.17.114 listed in will-spam-for-food.eu.org]

[34.168.17.114 listed in will-spam-for-food.eu.org]

[34.168.17.114 listed in will-spam-for-food.eu.org]

[34.168.17.114 listed in will-spam-for-food.eu.org]

-0.0 SPF_PASS SPF: sender matches SPF record

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-0.0 SPF_HELO_PASS SPF: HELO matches SPF record

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[34.168.17.114 listed in bl.score.senderscore.com]

0.3 LONGWORD BODY: Uses overlong words

1.7 DEAR_SOMETHING BODY: Contains 'Dear (something)'

1.2 INVALID_MSGID Message-Id is not valid, according to RFC 2822

1.5 IMPRONONCABLE_2 Too much mixed numbers and lower-case letters

0.1 PDS_BTC_ID FP reduced Bitcoin ID

Subject: {SPAM?} Notice of Claimed Infringement - Case ID 42a4300cb130e7cd642f

-----BEGIN PGP SIGNED MESSAGE-----

Hash: SHA1

Notice ID: 42a4300cb130e7cd642f

Notice Date: 2026-05-07T17:14:17Z

WorldGate

Dear Sir or Madam:

I certify under penalty of perjury that I am authorized to act on behalf of the Paramount Global companies CBS Broadcasting Inc., CBS Studios Inc., Paramount Pictures Corporation, Showtime Networks Inc., Viacom International, Inc., Black Entertainment Television LLC, and other Paramount Global subsidiaries and affiliates (collectively, the “Rights Owners”), the owners of certain exclusive intellectual property rights in the copyrighted work(s) identified in this notice. I have a good faith belief that the information in this notice is accurate.

We have become aware that the below IP addresses have been using your service for distributing video files, which contain infringing video content that is exclusively owned by the Rights Owners.

We have a good faith belief that the Rights Owners’ video content that is described in the below report has not been authorized for sharing or distribution by the copyright owner, its agent, or the law. Such copying and use of this material constitutes clear infringement of the Rights Owners' rights under the Copyright Act and its counterpart laws around the world.

We are requesting your immediate assistance in removing and disabling access to the infringing material from your network. We also ask that you ensure the user and/or IP address owner refrains from future use and sharing of the Rights Owners’ materials and property.

In complying with this notice, you should not destroy any evidence that may be relevant in a lawsuit relating to the infringement alleged; including all associated electronic documents and data relating to the presence of the infringing items on your site, which shall be preserved while disabling public access, irrespective of any document retention or corporate policy to the contrary.

Nothing in this letter shall be construed as a waiver or relinquishment of any right, remedy, or claims possessed by the Rights Owners, or any affiliated party, all of which are expressly reserved.

Should you have any questions, please contact me at the information below.

Ben Sodos

Vobile, Inc.

Address: 2880 Lakeside Drive, Suite 200

Santa Clara, CA 95054, United States

Email: p2p@copyright-notice.com

408.217.5026

42a4300cb130e7cd642f

Open

Normal

Paramount Global

Vobile - Compliance

2880 Lakeside Drive, Suite 200

Santa Clara, CA 95054

+1 (408) 492 1100

p2p@copyright-notice.com

WorldGate

root@doctor.nl2k.ab.ca

2026-05-07T17:14:10Z

204.209.81.1

51378

BitTorrent

1

2026-05-07T17:14:10Z

The Neighborhood

The.Neighborhood.S02.1080p.WEBRip.x265-RARBG

7829052900

ba77ead3142d266b9eb0f7586ca58d81fa19b09b

-----BEGIN PGP SIGNATURE-----

Version: GnuPG v2.0.22 (GNU/Linux)

iQEcBAEBAgAGBQJp/MhpAAoJEN5LM3Etqs/WD4cH/RYy9bzTnyB3lKCZZatpMKlC

OqgIT9ktDSetDU/rimhPffOn1IO9AflbG6Cyv5ai76RtBVtUxj/sHijWCczq567z

EWKIH2wThaY3Hmmf5NKnwj7Q2z8mI+3peVoc8PG4iFmu1pSPJXvBLnv1qFJHq/nk

6qno4IzCfn52f2iek61UtyJ5ewv8Yas2S5YDMJ/kHCBWD4HVagWAMld4J7KNPO7d

083gipfEt4GKSG5dGJGe3Jt3N1yFAfSScqqy8WmBQdPh6AHVAnlTdNVG+h1tTlV+

528eb3Ai9VUTnWPfPykpWM046bOtCYrCxWV23zOcO9Dbyujj6TBNb0Dedpd537g=

=oGlm

-----END PGP SIGNATURE-----

Shipping phish

Posted by Dave Yadallee on Thursday, May 7. 2026

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 07 May 2026 12:38:00 -0600

Received: from nodels16-ca.n0c.com ([209.16.158.204]:44385)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1wL3bD-00000000HC1-2ZQf

for dave@doctor.nl2k.ab.ca;

Thu, 07 May 2026 12:37:37 -0600

Received: from 127.0.0.1 (unknown [10.123.1.155])

by nodels16-ca.n0c.com (Postfix) with ESMTPA id 215DA806F2;

Thu, 7 May 2026 18:36:29 +0000 (UTC)

DMARC-Filter: OpenDMARC Filter v1.4.1 nodels16-ca.n0c.com 215DA806F2

Authentication-Results: nodels16-ca.n0c.com; dmarc=fail (p=none dis=none) header.from=stsg.ca

Authentication-Results: nodels16-ca.n0c.com; spf=fail smtp.mailfrom=stsg.ca

DKIM-Filter: OpenDKIM Filter v2.11.0 nodels16-ca.n0c.com 215DA806F2

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=stsg.ca; s=default;

t=1778178991; bh=OcO2UfG0GAZo+DCpANLW2A1e6LIkEw7aN6Iaf1j0fsI=;

h=Date:From:To:Subject:From;

b=H9KAeZuNCqo/I6b/8LWRNMq7KxgMQe3m8kxdOlXH4b2RzdGYtvodCpWx86HYFS9Qs

Rdt7tt8DOCvhSyZEIUsm8wa9oTslGZB5QXvND7LEQp2WIi4hfN1t8WaPx+em1921t4

b4x8pO+BVQSly5/Sh0A1dM6y1x8delLINgH9a8/vvQjn56jpxmtISNoiaRSt+A3sWy

OJFfbUJtXpZpemBnE9LmOtBmvQ4dw4esyIvvxmhH5yCEquZ2SQusZsKP313AZqHB1P

36PKFeLUI4xvVoMYrbcD/JB38GYOltrAF15k4T6uoutQrBR1DGJy1iMzvqtDZwPqAI

muT374nc6xqaQ==

MIME-Version: 1.0

Date: Thu, 07 May 2026 20:36:28 +0200

From: admin@stsg.ca

To: undisclosed-recipients:;

Subject: Delivery Rescheduling Available 10265600118

Message-ID: <97a91f84758743ff362645e6f8f89d7b@stsg.ca>

X-Sender: admin@stsg.ca

Disposition-Notification-To: admin@stsg.ca

Content-Type: multipart/alternative;

boundary="=_149ed28edce994f55bd69c53f3350327"

X-Spam_score: 8.0

X-Spam_score_int: 80

X-Spam_bar: ++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.

Content preview: FedEx Hello,

Content analysis details: (8.0 points, 5.0 required)

pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[209.16.158.204 listed in dnsbl.ahbl.org]

[209.16.158.204 listed in dnsbl.ahbl.org]

[209.16.158.204 listed in dnsbl.ahbl.org]

[209.16.158.204 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[209.16.158.204 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[209.16.158.204 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[209.16.158.204 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[209.16.158.204 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[209.16.158.204 listed in will-spam-for-food.eu.org]

[209.16.158.204 listed in will-spam-for-food.eu.org]

[209.16.158.204 listed in will-spam-for-food.eu.org]

[209.16.158.204 listed in will-spam-for-food.eu.org]

[209.16.158.204 listed in will-spam-for-food.eu.org]

[209.16.158.204 listed in will-spam-for-food.eu.org]

[209.16.158.204 listed in will-spam-for-food.eu.org]

[209.16.158.204 listed in will-spam-for-food.eu.org]

-0.0 SPF_PASS SPF: sender matches SPF record

2.5 URIBL_DBL_SPAM Contains a spam URL listed in the DBL blocklist

[URI: stsg.ca]

1.5 GR_DOMAIN_UNDISC1 To contains undisclosed recipient (undisc)

0.5 NO_RDNS Sending MTA has no reverse DNS (Postfix variant)

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

0.9 RCVD_NUMERIC_HELO Received: contains an IP address used for HELO

0.3 LONGWORD BODY: Uses overlong words

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[209.16.158.204 listed in wl.mailspike.net]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[209.16.158.204 listed in bl.score.senderscore.com]

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

0.4 RDNS_DYNAMIC Delivered to internal network by host with

dynamic-looking rDNS

0.8 HELO_DYNAMIC_DHCP Relay HELO'd using suspicious hostname (DHCP)

Subject: {SPAM?} Delivery Rescheduling Available 10265600118

--=_149ed28edce994f55bd69c53f3350327

Content-Transfer-Encoding: 7bit

Content-Type: text/plain; charset=US-ASCII;

format=flowed

FedEx

Hello,

A delivery attempt for your package was made on May 7, 2026 at 9:00 a.m.

However, no one was available to receive the shipment at the provided

address.

Shipment details:

Shipping method: Standard delivery

Delivery attempt: May 7, 2026 at 9:00 a.m.

Your package is currently being safely held at our processing center

pending further instructions.

To arrange a new delivery date, please use the link below:

Reschedule Delivery [1]

If you require any additional assistance, our support team remains

available to help.

Thank you for your trust.

Sincerely,

Shipping and Delivery Department

Links:

------

[1]

https://www.mchughluxury.com/fffffffffffffffffuioeuioeoiueuoiueioueiouiouio.html

--=_149ed28edce994f55bd69c53f3350327

Content-Transfer-Encoding: quoted-printable

Content-Type: text/html; charset=UTF-8

=3DUTF-8" />
eva,sans-serif'>

>FedEx

Hello,

A delivery attempt for your package was made on May 7, 2026 at 9=

:00 a.m. However, no one was available to receive the shipment at =

the provided address.

Shipment details:
>

• Shipping method: Standard delivery
• Delivery a=

ttempt: May 7, 2026 at 9:00 a.m.

Your package is currently being safely held at our processing center pen=

ding further instructions.

To arrange a new delivery date, please use the link below:

ghluxury.com/fffffffffffffffffuioeuioeoiueuoiueioueiouiouio.html">Reschedul=

e Delivery

If you require any additional assistance, our support team remains avail=

able to help.

Thank you for your trust.

Sincerely,
Shipping and Delivery Department

--=_149ed28edce994f55bd69c53f3350327--

Categories: Phish

0 Comments

Package Phishing
Posted by Dave Yadallee on Thursday, May 7. 2026

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 07 May 2026 12:38:00 -0600

Received: from nodels16-ca.n0c.com ([209.16.158.204]:44385)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1wL3bD-00000000HC1-2ZQf

for dave@doctor.nl2k.ab.ca;

Thu, 07 May 2026 12:37:37 -0600

Received: from 127.0.0.1 (unknown [10.123.1.155])

by nodels16-ca.n0c.com (Postfix) with ESMTPA id 215DA806F2;

Thu, 7 May 2026 18:36:29 +0000 (UTC)

DMARC-Filter: OpenDMARC Filter v1.4.1 nodels16-ca.n0c.com 215DA806F2

Authentication-Results: nodels16-ca.n0c.com; dmarc=fail (p=none dis=none) header.from=stsg.ca

Authentication-Results: nodels16-ca.n0c.com; spf=fail smtp.mailfrom=stsg.ca

DKIM-Filter: OpenDKIM Filter v2.11.0 nodels16-ca.n0c.com 215DA806F2

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=stsg.ca; s=default;

t=1778178991; bh=OcO2UfG0GAZo+DCpANLW2A1e6LIkEw7aN6Iaf1j0fsI=;

h=Date:From:To:Subject:From;

b=H9KAeZuNCqo/I6b/8LWRNMq7KxgMQe3m8kxdOlXH4b2RzdGYtvodCpWx86HYFS9Qs

Rdt7tt8DOCvhSyZEIUsm8wa9oTslGZB5QXvND7LEQp2WIi4hfN1t8WaPx+em1921t4

b4x8pO+BVQSly5/Sh0A1dM6y1x8delLINgH9a8/vvQjn56jpxmtISNoiaRSt+A3sWy

OJFfbUJtXpZpemBnE9LmOtBmvQ4dw4esyIvvxmhH5yCEquZ2SQusZsKP313AZqHB1P

36PKFeLUI4xvVoMYrbcD/JB38GYOltrAF15k4T6uoutQrBR1DGJy1iMzvqtDZwPqAI

muT374nc6xqaQ==

MIME-Version: 1.0

Date: Thu, 07 May 2026 20:36:28 +0200

From: admin@stsg.ca

To: undisclosed-recipients:;

Subject: Delivery Rescheduling Available 10265600118

Message-ID: <97a91f84758743ff362645e6f8f89d7b@stsg.ca>

X-Sender: admin@stsg.ca

Disposition-Notification-To: admin@stsg.ca

Content-Type: multipart/alternative;

boundary="=_149ed28edce994f55bd69c53f3350327"

X-Spam_score: 8.0

X-Spam_score_int: 80

X-Spam_bar: ++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.

Content preview: FedEx Hello,

Content analysis details: (8.0 points, 5.0 required)

pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[209.16.158.204 listed in dnsbl.ahbl.org]

[209.16.158.204 listed in dnsbl.ahbl.org]

[209.16.158.204 listed in dnsbl.ahbl.org]

[209.16.158.204 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[209.16.158.204 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[209.16.158.204 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[209.16.158.204 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[209.16.158.204 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[209.16.158.204 listed in will-spam-for-food.eu.org]

[209.16.158.204 listed in will-spam-for-food.eu.org]

[209.16.158.204 listed in will-spam-for-food.eu.org]

[209.16.158.204 listed in will-spam-for-food.eu.org]

[209.16.158.204 listed in will-spam-for-food.eu.org]

[209.16.158.204 listed in will-spam-for-food.eu.org]

[209.16.158.204 listed in will-spam-for-food.eu.org]

[209.16.158.204 listed in will-spam-for-food.eu.org]

-0.0 SPF_PASS SPF: sender matches SPF record

2.5 URIBL_DBL_SPAM Contains a spam URL listed in the DBL blocklist

[URI: stsg.ca]

1.5 GR_DOMAIN_UNDISC1 To contains undisclosed recipient (undisc)

0.5 NO_RDNS Sending MTA has no reverse DNS (Postfix variant)

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

0.9 RCVD_NUMERIC_HELO Received: contains an IP address used for HELO

0.3 LONGWORD BODY: Uses overlong words

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[209.16.158.204 listed in wl.mailspike.net]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[209.16.158.204 listed in bl.score.senderscore.com]

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

0.4 RDNS_DYNAMIC Delivered to internal network by host with

dynamic-looking rDNS

0.8 HELO_DYNAMIC_DHCP Relay HELO'd using suspicious hostname (DHCP)

Subject: {SPAM?} Delivery Rescheduling Available 10265600118

--=_149ed28edce994f55bd69c53f3350327

Content-Transfer-Encoding: 7bit

Content-Type: text/plain; charset=US-ASCII;

format=flowed

FedEx

Hello,

A delivery attempt for your package was made on May 7, 2026 at 9:00 a.m.

However, no one was available to receive the shipment at the provided

address.

Shipment details:

Shipping method: Standard delivery

Delivery attempt: May 7, 2026 at 9:00 a.m.

Your package is currently being safely held at our processing center

pending further instructions.

To arrange a new delivery date, please use the link below:

Reschedule Delivery [1]

If you require any additional assistance, our support team remains

available to help.

Thank you for your trust.

Sincerely,

Shipping and Delivery Department

Links:

------

[1]

https://www.mchughluxury.com/fffffffffffffffffuioeuioeoiueuoiueioueiouiouio.html

--=_149ed28edce994f55bd69c53f3350327

Content-Transfer-Encoding: quoted-printable

Content-Type: text/html; charset=UTF-8

=3DUTF-8" />
eva,sans-serif'>

>FedEx

Hello,

A delivery attempt for your package was made on May 7, 2026 at 9=

:00 a.m. However, no one was available to receive the shipment at =

the provided address.

Shipment details:
>

• Shipping method: Standard delivery
• Delivery a=

ttempt: May 7, 2026 at 9:00 a.m.

Your package is currently being safely held at our processing center pen=

ding further instructions.

To arrange a new delivery date, please use the link below:

ghluxury.com/fffffffffffffffffuioeuioeoiueuoiueioueiouiouio.html">Reschedul=

e Delivery

If you require any additional assistance, our support team remains avail=

able to help.

Thank you for your trust.

Sincerely,
Shipping and Delivery Department

--=_149ed28edce994f55bd69c53f3350327--

Categories: Phish

0 Comments

turksh e-mail spam from Google Gmail Part 2
Posted by Dave Yadallee on Thursday, May 7. 2026

--_000_GV2PR01MB12888541462B836CE6B2E58C4FB3C2GV2PR01MB12888eu_

Content-Type: text/html; charset="windows-1254"

Content-Transfer-Encoding: quoted-printable

254">

15px; color: rgb(36, 36, 36);" class=3D"elementToProof">

Say=FDn Yetkili,

15px; color: rgb(36, 36, 36);" class=3D"elementToProof">

Artan enerji maliyetleri i=FEletmeler i=E7in =F6nemli bir y=FCk haline geli=

rken, do=F0ru y=F6netim ve do=F0ru tedarik=E7i ile bu maliyetleri kesin ola=

rak d=FC=FE=FCrmek m=FCmk=FCnd=FCr.

15px; color: rgb(36, 36, 36);" class=3D"elementToProof">

Remus Enerji olarak, i=FEletmelerin elektrik giderlerini somut ve =F6l=E7=

=FClebilir =FEekilde azalt=FDyoruz. Geli=FEtirdi=F0imiz sistemler ve sundu=

=F0umuz =F6zel tarifeler sayesinde:

15px; color: rgb(36, 36, 36);" class=3D"elementToProof">

=95 Elektrik maliyetlerinizi net =FEekilde d=FC=FE=FCr=FCyoruz,

=95 %100 ye=FEil enerji ile s=FCrd=FCr=FClebilir ve avantajl=FD tedarik sa=

=F0l=FDyoruz,

=95 T=FCketiminizi anl=FDk olarak izleyip gereksiz harcamalar=FD ortadan ka=

ld=FDr=FDyoruz,

=95 Fatura y=F6netiminizi sadele=FEtirerek operasyonel y=FCk=FCn=FCz=FC aza=

lt=FDyoruz.

15px; color: rgb(36, 36, 36);" class=3D"elementToProof">

Yapay zek=E2 destekli altyap=FDm=FDz, piyasadaki en uygun fiyatlar=FD anl=

=FDk analiz ederek sizi her zaman avantajl=FD konumda tutar. Ayr=FDca anla=

=FEmal=FD bankalar =FCzerinden faizsiz ve komisyonsuz kredi kart=FD =F6deme=

imk=E2n=FD ve =FCcretsiz enerji verimlili=F0i uygulamam=FDz ile tasarrufun=

uzu

garanti alt=FDna al=FDyoruz.

15px; color: rgb(36, 36, 36);" class=3D"elementToProof">

Mevcut m=FC=FEterilerimizde sa=F0lad=FD=F0=FDm=FDz maliyet d=FC=FE=FC=FEler=

ini, sizin i=FEletmenizde de k=FDsa s=FCrede ger=E7ekle=FEtirebiliriz.

15px; color: rgb(36, 36, 36);" class=3D"elementToProof">

Sizin i=E7in en uygun enerji =E7=F6z=FCm=FCn=FC birlikte belirleyelim.

Son iki d=F6nem elektrik faturan=FDz ve OSOS/OSF verilerinizi payla=FEman=

=FDz halinde, tamamen =FCcretsiz analiz ve tasarruf raporunuzu hemen sunal=

=FDm.

15px; color: rgb(36, 36, 36);" class=3D"elementToProof">

G=F6r=FC=FEmek dile=F0iyle,

edFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif, serif, EmojiFo=

nt; font-size: 12pt; color: black;" class=3D"elementToProof">

eight: 39px;" data-outlook-trace=3D"F:19|T:19" src=3D"cid:3f1704c3-d9d2-42c=

4-82f6-df3ac8a71d67">

36, 36);" class=3D"elementToProof">

r", "Segoe UI Symbol", "Helvetica Neue", Arial, sa=

ns-serif, serif, EmojiFont; color: rgb(51, 51, 51);">Furkan =D6zbay

| Energy Advisor

;, "Segoe UI Web Regular", "Segoe UI Symbol", "Hel=

vetica Neue", Arial, sans-serif, serif, EmojiFont; font-size: 7.5pt; c=

olor: rgb(51, 51, 51);" class=3D"elementToProof">

Bar=FD=FE SB Mah. 5003 Sk. Marmara Teknokent

;, "Segoe UI Web Regular", "Segoe UI Symbol", "Hel=

vetica Neue", Arial, sans-serif, serif, EmojiFont; font-size: 7.5pt; c=

olor: rgb(51, 51, 51);" class=3D"elementToProof">

Teksen Kadir Has Binas=FD =DD=E7 Kap=FD No: Z02 Gebze / Kocaeli

;, "Segoe UI Web Regular", "Segoe UI Symbol", "Hel=

vetica Neue", Arial, sans-serif, serif, EmojiFont; font-size: 7.5pt; c=

olor: rgb(51, 51, 51);" class=3D"elementToProof">

M. 0537 479 5882

136, 136);" class=3D"elementToProof">

_x_x_x_x_gmail-x_gmail-x_gmail-x_gmail-x_gmail-x_gmail-x_gmail-x_gmail-x_x_=

x_x_x_x_x_x_gmail-x_x_gmail-x_x_x_x_x_x_gmail-x_gmail-x_gmail-x_gmail-x_gma=

il-x_gmail-x_gmail-x_gmail-x_x_gmail-x_gmail-x_gmail-x_gmail-OWA4431cc00-8a=

84-08bb-8418-bd1dc5b6f46e" class=3D"x_x_x_x_x_x_x_x_x_x_x_x_x_x_x_x_x_x_OWA=

AutoLink" title=3D"http://www.remusenerji.com/" data-auth=3D"NotApplicable"=

style=3D"margin: 0px;">www.remusenerji.com

--_000_GV2PR01MB12888541462B836CE6B2E58C4FB3C2GV2PR01MB12888eu_--

--_005_GV2PR01MB12888541462B836CE6B2E58C4FB3C2GV2PR01MB12888eu_

Content-Type: image/png; name="Outlook-image.png.png"

--_006_GV2PR01MB12888541462B836CE6B2E58C4FB3C2GV2PR01MB12888eu_--

Categories: Google Gmail Spam

0 Comments

Turkish E-mail spam from Google Gmail Part 1
Posted by Dave Yadallee on Thursday, May 7. 2026

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 07 May 2026 04:47:00 -0600

Received: from mail-pl1-f173.google.com ([209.85.214.173]:58583)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1wKwEq-00000000K0r-1Tnb

for dave@doctor.nl2k.ab.ca;

Thu, 07 May 2026 04:46:07 -0600

Received: by mail-pl1-f173.google.com with SMTP id d9443c01a7336-2b9fcf7c91bso6327795ad.0

for ; Thu, 07 May 2026 03:45:04 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=partner.remusenerji.com; s=google; t=1778150699; x=1778755499; darn=doctor.nl2k.ab.ca;

h=mime-version:msip_labels:content-language:accept-language

:message-id:date:thread-index:thread-topic:subject:from:from:to:cc

:subject:date:message-id:reply-to;

bh=dgSztAB/+a84XftVHYBMJfQU60sdJ0U2WeOqQjQIZ34=;

b=HYB5GBht4nhesTc70r5p0qfwMQquu1C8RiFSdNMcOr3m4LozzmcCDugC31vZjK44Pc

FShU8/zM42ASRjB2FoCFKn1FovZvSlJAJTziFte/VoDDzFzgS442ewU6AD4VGpDc9dds

Pab4ZX9Adan1HWlU3cpu+aVTQv4SRAe29vvA7tMqyv1ARM+Y49VdP0GpkQKmI4qUGZ50

/4bIOaRU5WFi5lz52FUs7SNUcHu1axqLDtbE+ktMBIaFs6nOK24doQSpqo6qdD5pUCZC

lgNSaQPlgCDopq8Xjvk8XuY6vYc10pdGo9zFGvrQZMWsNYiiasLtsZLxLI0KlMDSuGRS

SGQA==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20251104; t=1778150699; x=1778755499;

h=mime-version:msip_labels:content-language:accept-language

:message-id:date:thread-index:thread-topic:subject:from:x-gm-gg

:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to;

bh=dgSztAB/+a84XftVHYBMJfQU60sdJ0U2WeOqQjQIZ34=;

b=sPXOgSmYing9kmU+Sli8vI6VEE6BsIL1PepMwKLWkr7512dFnmC/TJUq4vgogfccdv

6357XbepvUXH5lTlTT5KVgHTXNEj6VKyBZI4ypdSik7jS0wrdeSUmO6rSevJh56uLzL7

sYp7v/SfsbA8REniv2uzWLfx39msrLj2WBz7vEiN/JkyU1VUqHv7Kuriu0J15mD3dU7R

V0mbQ5lit1Yp73RiGStNhotUfcz9iDZh5mq/qOnyAcOoxF2zP/LedqSEeP/0vftR82tw

7IdcdS2IFrECD5J7AC5UGjRnv88ZVVc0Q3xpRlTyfD1U4pImbIR5hBeyRtJvFFQ9Kyy6

LVxg==

X-Forwarded-Encrypted: i=1; AFNElJ8fZN+7n9sK8uWY1U26ZqDrdohtTT6WwUABluGCrjkW+qJaXFjQwWtfaurDmTSNeh0gLj8r@doctor.nl2k.ab.ca

X-Gm-Message-State: AOJu0YwZ15uIxPGl8BZHszflQtxZJ7G+hxxnO7WCs0mbWDnzxdWmXtVZ

CmfRwoNnl9ey9kmojA5owqK/3wkQ2L30KCZ0/CiafwSPZSpwgv3qoExIubIy4NsI5WI=

X-Gm-Gg: AeBDiesmgtEoJsh3/wcjyTrvCJLjMYgKtT4jO7KKmvoFon/+SdJI+MherBuD1b2TnT+

y1ASuKDVIPRGJYUawgjjlmk4ixc/afsJ3R43Wsc8p65jDNQhVyECzm+fHJiRLqU2dKcfQW8cTxx

dpRTk678CZGAItxLhOQ72pnn6kRhPhjxJB30yVpMS5YGJjzAAvysoXAZxyILEPwwXo6vL19n+0l

MfmXaesnRk99WsstKXp/kOZmP6KlOoMDDC+HAXlBTExkKIX35LE6a63du+S9JtOA80jCmanK5DR

pk8cuLfMZctvR2QSEJq/OPVjaIEZ9b/USpMwTHxxfEu0NE35zkydq33gjPdStUY5wYpQjmxPGoT

HihIljttzdwa5A2QFKKIHVXV0TI7tW6fqoziJ3XAtVpoxH5TWSMUICql0nl+Og1WsJwxi6MhflW

Fh2wzMWM560XgI6SU+cOJaDTZ0VUqw+NP6ADwI+LogJ/36gaQXVLi71UcfSBIf4QIH6XKIGppCb

a550UECubB/EYFYd5iXgtq8vZ5q22+paoYmRg6DDPNStfRB4ILMFDlgiOqfLWY6GA==

X-Received: by 2002:a17:902:cf09:b0:2b9:cd2d:6f14 with SMTP id d9443c01a7336-2ba79291d71mr91107015ad.2.1778150697699;

Thu, 07 May 2026 03:44:57 -0700 (PDT)

Received: from GV2PR01MB12888.eurprd01.prod.exchangelabs.com ([2603:1026:c11:cdc::5])

by smtp.gmail.com with ESMTPSA id d9443c01a7336-2babadd1d93sm19954345ad.40.2026.05.07.03.44.29

(version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256);

Thu, 07 May 2026 03:44:55 -0700 (PDT)

From: =?windows-1254?Q?Furkan_=D6zbay?=

Subject: =?windows-1254?Q?Elektrik_Faturan=FDz=FD_Kesin_Olarak_Azalt=FDyoruz?=

Thread-Topic:

=?windows-1254?Q?Elektrik_Faturan=FDz=FD_Kesin_Olarak_Azalt=FDyoruz?=

Thread-Index: AQHc3g52qeCiVovqBU6WLjUKYzKD7Q==

X-MS-Exchange-MessageSentRepresentingType: 1

Date: Thu, 7 May 2026 10:44:27 +0000

Message-ID:

Accept-Language: tr-TR, en-US

Content-Language: tr-TR

X-MS-Has-Attach: yes

X-MS-Exchange-Organization-SCL: -1

X-MS-TNEF-Correlator:

X-MS-Exchange-Organization-RecordReviewCfmType: 0

msip_labels:

Content-Type: multipart/mixed;

boundary="_006_GV2PR01MB12888541462B836CE6B2E58C4FB3C2GV2PR01MB12888eu_"

MIME-Version: 1.0

--_006_GV2PR01MB12888541462B836CE6B2E58C4FB3C2GV2PR01MB12888eu_

Content-Type: multipart/related;

boundary="_005_GV2PR01MB12888541462B836CE6B2E58C4FB3C2GV2PR01MB12888eu_";

type="multipart/alternative"

--_005_GV2PR01MB12888541462B836CE6B2E58C4FB3C2GV2PR01MB12888eu_

Content-Type: multipart/alternative;

boundary="_000_GV2PR01MB12888541462B836CE6B2E58C4FB3C2GV2PR01MB12888eu_"

--_000_GV2PR01MB12888541462B836CE6B2E58C4FB3C2GV2PR01MB12888eu_

Content-Type: text/plain; charset="windows-1254"

Content-Transfer-Encoding: quoted-printable

Say=FDn Yetkili,

Artan enerji maliyetleri i=FEletmeler i=E7in =F6nemli bir y=FCk haline geli=

rken, do=F0ru y=F6netim ve do=F0ru tedarik=E7i ile bu maliyetleri kesin ola=

rak d=FC=FE=FCrmek m=FCmk=FCnd=FCr.

Remus Enerji olarak, i=FEletmelerin elektrik giderlerini somut ve =F6l=E7=

=FClebilir =FEekilde azalt=FDyoruz. Geli=FEtirdi=F0imiz sistemler ve sundu=

=F0umuz =F6zel tarifeler sayesinde:

=95 Elektrik maliyetlerinizi net =FEekilde d=FC=FE=FCr=FCyoruz,

=95 %100 ye=FEil enerji ile s=FCrd=FCr=FClebilir ve avantajl=FD tedarik sa=

=F0l=FDyoruz,

=95 T=FCketiminizi anl=FDk olarak izleyip gereksiz harcamalar=FD ortadan ka=

ld=FDr=FDyoruz,

=95 Fatura y=F6netiminizi sadele=FEtirerek operasyonel y=FCk=FCn=FCz=FC aza=

lt=FDyoruz.

Yapay zek=E2 destekli altyap=FDm=FDz, piyasadaki en uygun fiyatlar=FD anl=

=FDk analiz ederek sizi her zaman avantajl=FD konumda tutar. Ayr=FDca anla=

=FEmal=FD bankalar =FCzerinden faizsiz ve komisyonsuz kredi kart=FD =F6deme=

imk=E2n=FD ve =FCcretsiz enerji verimlili=F0i uygulamam=FDz ile tasarrufun=

uzu garanti alt=FDna al=FDyoruz.

Mevcut m=FC=FEterilerimizde sa=F0lad=FD=F0=FDm=FDz maliyet d=FC=FE=FC=FEler=

ini, sizin i=FEletmenizde de k=FDsa s=FCrede ger=E7ekle=FEtirebiliriz.

Sizin i=E7in en uygun enerji =E7=F6z=FCm=FCn=FC birlikte belirleyelim.

Son iki d=F6nem elektrik faturan=FDz ve OSOS/OSF verilerinizi payla=FEman=

=FDz halinde, tamamen =FCcretsiz analiz ve tasarruf raporunuzu hemen sunal=

=FDm.

G=F6r=FC=FEmek dile=F0iyle,

[image.png]

Furkan =D6zbay | Energy Advisor

Bar=FD=FE SB Mah. 5003 Sk. Marmara Teknokent

Teksen Kadir Has Binas=FD =DD=E7 Kap=FD No: Z02 Gebze / Kocaeli

M. 0537 479 5882

www.remusenerji.com

Categories: Google Gmail Spam

0 Comments

Chinese products spam
Posted by Dave Yadallee on Thursday, May 7. 2026

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 07 May 2026 04:14:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1wKvju-00000000LVA-0Ga8

for dave@doctor.nl2k.ab.ca;

Thu, 07 May 2026 04:13:54 -0600

Resent-From: The Doctor

Resent-Date: Thu, 7 May 2026 04:13:53 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-proxy50252.vip.163.com ([45.254.50.252]:20236)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1wKus9-000000000G7-1OqB

for doctor@nl2k.ab.ca;

Thu, 07 May 2026 03:18:32 -0600

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=vip.163.com; s=s110527; h=Date:From:To:Subject:Content-Type:

MIME-Version:Message-ID; bh=95ngNGefskUKpM23/zBNmFDmFgdpSOFUC9k9

gkuQYQc=; b=lmFCMpgHbt/nPLNhfuj82PvTrBDqMqx8syWfxOmErVN101MEvj+I

znYuFai4/2jeacX/4NJJ/HxrRTOKJcFNLsUKBMibtM3xKssgxAj5tcsXN2i9P1gY

NZ5W+X03fA4VhTeImLS5baShyDY7k29el0imU/sQJSzYJ69GGRlQs+A=

Received: from qianfana2$vip.163.com ( [183.48.244.118] ) by

ajax-webmail-wmsvr-207-13 (Coremail) ; Thu, 7 May 2026 15:25:19 +0800 (CST)

X-Originating-IP: [183.48.244.118]

Date: Thu, 7 May 2026 15:25:19 +0800 (CST)

From: qianfana2

To: doctor@nl2k.ab.ca

Subject: =?GBK?Q?Quote_for_Solid_beverages=A3=ACdrinks_And_Related_Products?=

X-Priority: 3

X-Mailer: Coremail Webmail Server Version 2023.4-cmXT build

20260403(27802f6d) Copyright (c) 2002-2026 www.mailtech.cn 163vip

X-NTES-SC: AL_Qu2cCv2Yt08q7yScbOkfmU8VhO4+WcOzs/gm3YBTN5F4jBDk/jIgR3RIAXH19c+DNCOPixipUiNq585wYatIe4AmARFT641fwbwdJq+exT26MA==

Content-Type: multipart/alternative;

boundary="----=_Part_66890_1416758203.1778138719455"

MIME-Version: 1.0

Message-ID: <6141f4b.4701.19e0153a4e0.Coremail.qianfana2@vip.163.com>

X-Coremail-Locale: zh_CN

X-CM-TRANSID:Dc8vCgD3t4pfPvxp8MddAA--.59594W

X-CM-SenderInfo: htld0whdqdjqxylshiywtou0bp/1tbiNR9Av2n8Pl8LhgAA3s

X-Coremail-Antispam: 1U5529EdanIXcx71UUUUU7vcSsGvfC2KfnxnUU==

Hello,

We are a Chinese importer and distributor, boasting a mature supply chain network covering Shenzhen, Guangzhou,Hong Kong and Singapore. We are currently seeking high-quality manufacturers and suppliers of Solid beverages，drinks.Please feel free to contact us if you are interested in the Asian market.

Best regards,

Qanfan TEAM

Categories: Chinese Phish Spam

0 Comments

er=20

border=3D0>

>
style=3D"WIDTH: 630px; MIN-WIDTH: 630px; MIN-HEIGHT: 1px;=

DISPLAY: block; MAX-HEIGHT: 1px"=20

alt=3D""=20

src=3D"https://www.bnc.ca/content/dam/bnc/formulaires/mod=

ele-courriel/spacer-social-media-1x1.gif"=20

width=3D630 height=3D1>

er=20

border=3D0>

=3Dcenter=20

border=3D0>

height=3D1>
style=3D"WIDTH: 600px; MIN-WIDTH: 600px; MIN-HEIGHT=

: 1px; DISPLAY: block; MAX-HEIGHT: 1px"=20

alt=3D""=20

src=3D"https://www.bnc.ca/content/dam/bnc/formulair=

es/modele-courriel/spacer-social-media-1x1.gif"=20

width=3D600 height=3D1>

TD>

er=3D0>

style=3D"FONT-SIZE: 11px; FONT-FAMILY: Arial,sans-ser=

if,'Open Sans'; COLOR: #000000; LINE-HEIGHT: 15px; PADDING-RIGHT: 4px"=20

vAlign=3Dmiddle align=3Dright>Stay connected

style=3D"FONT-SIZE: 11px; FONT-FAMILY: Arial,sans-ser=

if,'Open Sans'; COLOR: #000000; PADDING-LEFT: 6px; LINE-HEIGHT: 15px"=20

vAlign=3Dmiddle width=3D25 align=3Dleft>
href=3D"https://www.facebook.com/nationalbanknetwor=

ks"=20

target=3D_blank> 3D""=20<br

src=3D"https://www.bnc.ca/content/dam/bnc/formulair=

es/modele-courriel/icon-facebook-25x25.gif"=20

width=3D25 height=3D25>

National Bank Phish from Sendgrid PArt 1

Posted by Dave Yadallee on Thursday, May 7. 2026

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 07 May 2026 06:17:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1wKxf1-000000008SK-1R5f

for dave@doctor.nl2k.ab.ca;

Thu, 07 May 2026 06:16:59 -0600

Resent-From: The Doctor

Resent-Date: Thu, 7 May 2026 06:16:59 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from s.wfbtzhsw.outbound-mail.sendgrid.net ([159.183.224.105]:17950)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1wKxKB-00000000EzT-3EPn

for doctor@netknow.ca;

Thu, 07 May 2026 05:55:31 -0600

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=zh-info-mktiyu.com;

h=list-unsubscribe:list-unsubscribe-post:from:subject:date:to:

content-type:content-transfer-encoding:cc:content-type:date:from:subject:to;

s=s1; t=1778154872;

bh=hZCz4eO6e5MX7s0IQ7O3qrmKVcxeKQuCrNuB9DfUH0k=;

b=SVl+Np4Sa5NE8/zGR/yjTytsWhRAN2X7BIDt3d/XgaRGq3WdONPw/cRuJJqbzeQtyb9e

yihTSh2xTeHzsaWJOiE01bfrWXOPeiW0cPBZTlwz5BmvMfg7DkhBT4s3fXNHOhMcyepL5Y

SklHhLPXDksUavkJB/X+cTRPnwza1WPwKxh2HtdqyAXlCxpODxTby4TvGf3DvxBfLp7s3/

LWXC0wV/0u3LzGCdZ8BUmvbl86g6bw6CSVQumZJdUzF1ETTR0VGpnEiOwzFYPgt+I6VQ/z

GGNSqzdqdxudlOU8AjofjdhkAD54631F0vnsgEQiawn0hM9fc7oo+Hh7T3SYGBhw==

Received: by recvd-canary-8df78fc55-887j2 with SMTP id recvd-canary-8df78fc55-887j2-1-69FC7D78-17

2026-05-07 11:54:32.496912256 +0000 UTC m=+742872.801977485

Received: from chuangmeng.net (unknown)

by geopod-ismtpd-20 (SG) with ESMTP

id di2KQhtjSfC49LyXCoqcLQ

for ;

Thu, 07 May 2026 11:54:32.354 +0000 (UTC)

X-Priority: 5

X-Mailer: Apple Mail (2.3445.9.1)

List-Unsubscribe:

List-Unsubscribe-Post: List-Unsubscribe=One-Click

From: National Bank Direct Brokerage

Subject: Compliance Verification Update

Message-ID: <542b386385e883de790c3ec605351e09@zh-info-mktiyu.com>

Date: Thu, 07 May 2026 11:54:32 +0000 (UTC)

X-SG-EID:

=?us-ascii?Q?u001=2EqSrTYuf+buIuYTIRkkJ60PaCuK8FLEKUxWjcziMBe29vlItGCdu71=2FBuH?=

=?us-ascii?Q?7huuoZ3F6oE7l56gCfGkHNzwD+8zO+9NH0g4fdE?=

=?us-ascii?Q?U9JZzRSkPVbKCLdP+pZXEGN9QexGqJUpsjQfhBe?=

=?us-ascii?Q?TDlMq9LEUKiSvAK9dK5RIwV+azYZNvn0xDV11Nw?=

=?us-ascii?Q?=2FGDFSd+Mp9EX53hi4SWoT+rCBmiSRpCOPvVcwz3?=

=?us-ascii?Q?RXcavuLFqiQ7fp4obV3OKVz83Y3JwpwsI6JgXnx?=

=?us-ascii?Q?xnFdANl2TCidLa+CfLZTJGRImA=3D=3D?=

To: doctor@netknow.ca

X-Entity-ID: u001.EgAWfq/KHWaYWE8dhB1RNg==

Content-Type: text/html; charset=iso-8859-1

Content-Transfer-Encoding: quoted-printable

X-Spam_score: 23.9

X-Spam_score_int: 239

X-Spam_bar: +++++++++++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.

Content preview: Compliance Verification Update MESSAGE CONFIRMATION Compliance

Verification Update

Content analysis details: (23.9 points, 5.0 required)

pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[159.183.224.105 listed in dnsbl.ahbl.org]

[159.183.224.105 listed in dnsbl.ahbl.org]

[159.183.224.105 listed in dnsbl.ahbl.org]

[159.183.224.105 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[159.183.224.105 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[159.183.224.105 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[159.183.224.105 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[159.183.224.105 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[159.183.224.105 listed in will-spam-for-food.eu.org]

[159.183.224.105 listed in will-spam-for-food.eu.org]

[159.183.224.105 listed in will-spam-for-food.eu.org]

[159.183.224.105 listed in will-spam-for-food.eu.org]

[159.183.224.105 listed in will-spam-for-food.eu.org]

[159.183.224.105 listed in will-spam-for-food.eu.org]

[159.183.224.105 listed in will-spam-for-food.eu.org]

[159.183.224.105 listed in will-spam-for-food.eu.org]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-0.0 SPF_PASS SPF: sender matches SPF record

15 GR_DOMAIN_SENDGR1 Received contains spammer id (sendgr)

1.5 MR_STRANGE_QUESTION URI: No description available.

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

1.0 VOWEL_URI_5 URI hostname with 5 consecutive vowels

1.5 TVD_PH_BODY_ACCOUNTS_PRE The body matches phrases such as "accounts

suspended", "account credited", "account

verification"

0.8 SARE_FROM_SPAM_WORD3 I don't know people named this!

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

1.0 XPRIO Has X-Priority header

Subject: {SPAM?} Compliance Verification Update

Compliance Verification Update

0>

style=3D"FONT-SIZE: 11px; FONT-FAMILY: Arial,sans-serif,'Open Sans'; CO=

LOR: #666666; PADDING-BOTTOM: 45px; LINE-HEIGHT: 12px"=20

vAlign=3Dtop width=3D600 align=3Dleft>
style=3D"TEXT-DECORATION: underline; COLOR: #666666"=20

href=3D"https://mjjwci7p5dtqvs0y4yk730e.live" target=3D_blank>
style=3D"DISPLAY: block" border=3D0 alt=3D"Button to the BNC website"=

=20

src=3D"https://www.bnc.ca/content/dam/bnc/formulaires/picto/NB_2D_RGB=

.jpg"=20

width=3D217>

der=3D0>

DY>

Mon	Tue	Wed	Thu	Fri	Sat	Sun
← Back	May '26	Forward →
				1	2	3
4	5	6	7	8	9	10
11	12	13	14	15	16	17
18	19	20	21	22	23	24
25	26	27	28	29	30	31

Archives

May 2026

April 2026

March 2026

Recent...

Older...

Categories

Announcements

General

Involved in the Community

Canadian Club of Edmonton

Chamber Toastmasters

Chamber of Commerce Networking

The Edmonton Social Media Web 2.0 Meetup

Spam and Phish

AOL Spam

Adelphia Spam

AliceDSL.de Spam

Amazon Spam

Arcor-IP.net spam

Barracuda Network Spam

Bell Canada Spam

BellSouth Spam

Bezeqint Spam

British Telecom Spam

Charter Communications Spam

Chinese Phish Spam

Cogeco Cable Spam

Comcast Spam

Cox spam

Earthlink Spam

Eastlink Spam

Epix.net Spam

ExcelAds spam

GoDaddy Spam

Google Gmail Spam

Happeninstuff Spam

Hinet.net Spam

MailGun Spam and Phish

Mega Mail Servers Spam

Message Labs spam

Messagelabs spam

Microsoft Outlook Hotmail Spam

MSN Israeli Spam

Mindspring Spam

NEtia Spam from Poland

Network Solutions Spam

OVH Spam and Phish

Phish

Primus Spam

Proxad Spam

Roadrunner Spam

Roger's Spam

Shawmail Spam

Sophos spam

SourceCable Spam

StellarEstate Spam

T-online Germany Spam

TelecomItalia Spam

Telefonica Spain Spam

Telus Spam

Tera-Byte Spam

Tiscali Spam

Tucows Spam

UCLA Spam

Verizon Spam

Virgin Media Spam

Wanadoo Orange Spam

Who's Who Spam

Xplorenet spam

Yahoo! Spam

digital ocean spam

eToll spam

pppool.de spam

sendgrid.net spam and phish

Technical Issues

Windows Problems

Web Ranking

NetKnow and Edmonton Internet Service Providers (ISP) ranking

Web Ranking Articles

Syndicate This Blog

Blog Administration
Open login screen

Powered by

Serendipity PHP Weblog

NetKnow Navigation
Home

VPNs

Dialup Service

Web Design

Web Hosting

E-Commerce

Server Colocation

Domain Registration

Web Mail

Support

Testimonials

Client List

FAQs

Interested in NetKnow Services?

Links

Disclaimer

Acceptable Use

Security

Technorati Profile

Remote RSS/OPML-Blogroll Feed
No RSS/OPML feed selected

Error
serendipity error: could not include serendipity_plugin_statistics:9cbc0e29a86fd9359ac6748399d6ba5b - exiting.

addthis

Empire Avenue

Error
serendipity error: could not include serendipity_plugin_freetag:6c39baf097de002d8b1c2e33b9661474 - exiting.

Error
serendipity error: could not include serendipity_plugin_statistics:f520e0fa688ba61bd1ed85c0fd80d550 - exiting.

Error
serendipity error: could not include serendipity_plugin_twitter:b18e142d4998b6b0092d068ad858683d - exiting.

Syndicate This Blog

Comments

Error
serendipity error: could not include serendipity_plugin_spamblock_bee:7aefbb7ca9b764849be35e938b6fc9b2 - exiting.

Error
serendipity error: could not include serendipity_plugin_twitter:c7a92f670894afa9e3097574359fe38d - exiting.

Error
serendipity error: could not include serendipity_plugin_statistics:8b72cc4261ddc7ff15df253b17c29c23 - exiting.

Error
serendipity error: could not include serendipity_plugin_statistics:a0bd1a65cd9ff1c3e289829cc26557c4 - exiting.

Error
serendipity error: could not include serendipity_plugin_statistics:dcd26c048e45c234c054530ef1492953 - exiting.

Error
serendipity error: could not include serendipity_plugin_freetag:6d4c66aeb83aeb9524a7cc609051cf0f - exiting.

Error
serendipity error: could not include serendipity_plugin_freetag:acc1042e790905e499445a6890081492 - exiting.

Error
serendipity error: could not include serendipity_plugin_freetag:158fb50035b12269ec43107b29253af3 - exiting.

Error
serendipity error: could not include serendipity_plugin_topreferers:6b7e3336713d0a60294c7e310ca5cf1a - exiting.

Error
serendipity error: could not include serendipity_plugin_spamblock_bee:d3f047ee6f925c138fae56dcd7a99400 - exiting.

Error
serendipity error: could not include serendipity_plugin_spamblock_bee:5544ace5c8b19bb8592464810b48df10 - exiting.

Error
serendipity error: could not include serendipity_plugin_google_quicksearch:5624ac0b69cdbe32d0cdc40814d7eb41 - exiting.

Error
serendipity error: could not include serendipity_plugin_google_quicksearch:b8387d3a378247c1c9ede46fffb084e1 - exiting.

Error
serendipity error: could not include serendipity_plugin_google_last_query:bacdc0652131449ebc68ebde2bcb9ce2 - exiting.

Error
serendipity error: could not include serendipity_plugin_google_last_query:8c84ca587b64b627d986e9d5ce98ead1 - exiting.

Powered by Serendipity & the next theme.