Webroot phish from Google Gmail

Posted by Dave Yadallee on Monday, August 17. 2026

WEBROOT

Transaction No: 43295058
Tracking Id: 867A25N18BZNWQA71

Order Confirmation

Hi Doctor,

Your Webroot membership is currently scheduled to renew on Monday, August 17, 2026. This notice provides a summary of the membership and renewal details associated with your account.

Renewal Summary
Service: Webroot
Current Plan: Text scam detection
Renewal Date: Monday, August 17, 2026
Membership Period: 1 Year
Billing Method: Bank Card
Scheduled Amount: $100.21

Your membership will remain active according to your current plan. You can review the information associated with your subscription, make changes to your account, or manage your renewal please contact us.

If you have already made changes to your membership, no additional action is required.

With appreciation,
Webroot SecureAnywhere
+1 (813) 735-0189

--===============1240080412597483786==--

Nk.ca credential phish from Google Gmail

Posted by Dave Yadallee on Monday, August 17. 2026

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Mon, 17 Aug 2026 07:49:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.5 (FreeBSD))

(envelope-from )

id 1wvxhT-0000000020a-2p99

for dave@doctor.nl2k.ab.ca;

Mon, 17 Aug 2026 07:48:27 -0600

Resent-From: The Doctor

Resent-Date: Mon, 17 Aug 2026 07:48:27 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-ed1-f104.google.com ([209.85.208.104]:42293)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.99.5 (FreeBSD))

(envelope-from )

id 1wvwK2-00000000BVn-2aED

for sales@nk.ca;

Mon, 17 Aug 2026 06:20:19 -0600

Received: by mail-ed1-f104.google.com with SMTP id 4fb4d7f45d1cf-6a386a34603so905581a12.1

for ; Mon, 17 Aug 2026 05:19:23 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=hes-ham-com.20251104.gappssmtp.com; s=20251104; t=1786969157; x=1787573957; darn=nk.ca;

h=content-type:mime-version:date:message-id:subject:to:from:from:to

:cc:subject:date:message-id:reply-to:content-type;

bh=uO+NBH3Kbh0rfF1BU/SmEpZlmN0AW6hfxamnjKCRQPk=;

b=Kd3I5BA+DRlwHljqVf7H6k3CfsfCZLBbFCUUVSmxVg+kMjeheFTvsB6UzQPj3/uAvk

emfEPJizsflFIPk2CjMSAfLCbABm6a2l4fnG3mc/QQMcCsBiKuO+Hm4oVRABwgyRWpCa

bhWHDdJVP6PnKr+qC3qatcDzOIlHfrjhrNruB77BvEE2Q1jw3issJNoQeDO2aM7nEGNW

s+qoLOC2j36yIBozZCR3kdE3jO+ibPKF7GNBwNRqvxUb1wOLWm0UzH0CkmFHWviIm2q7

4aKrOMyZTTTWHE+ByYnRr4fKEZkgTw8U3NlO/xnWjArqq+LgXGmoFUWnxLkiH/FjLOUi

ZZAw==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20251104; t=1786969157; x=1787573957;

h=content-type:mime-version:date:message-id:subject:to:from:x-gm-gg

:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to

:content-type;

bh=uO+NBH3Kbh0rfF1BU/SmEpZlmN0AW6hfxamnjKCRQPk=;

b=a5u+DW/zPlDr+egVUqi69H8E1SEe+9vl1FOJtwKyDpzmzjS4Uk4v0YgYQnoVxEZCb6

3SGAqFlkKsr3Lss+dJKW4bYbgeGYGbexyNKHh2d2c+1vHSbTB8OP7OluAYcdA5tzfuBx

tqo64U8+82XacmE9+O4OBdTr9sb3xdP8EarvnnHXYIwos94RxOHjbsweJFwYu/QdnHOq

SCCfDZd63fFlxaG7Yc2yPaU1HEObacceFOW4rsU1YmXV20b3WzBgl+pCPUAvTGSBa8nx

xrJRLgCwivUhiLUXRmpp3PdBQmcDlQ8BHRfyWr0lpZioYqehvWQtcvIrfIUk+3/GbVuP

A4UQ==

X-Gm-Message-State: AOJu0Yx0vSgLQIvO8suK/1vbELBXOdKSO+vQiADlnXn1jZa+BZ7uIYW5

0YvVE4zndoTMRJNsMWttsq7cWcsiUp4DZ01AAoCCxVpyzFd4WAVTfkMNwjsCSgl9BoZEzAoBomg

u5Cd9iP8DLPjCjDLM+CqZntgGi8H1GgAGkbcWM5fOiE5xJVs=

X-Gm-Gg: AR+sD12zCV7Ycd+w0yD+MvJ1tAc4fyUD9FI74TQvEhf6XAzj+VIMh9WGbo1Bz+R4o/y

7gY3weHSG8CtjF+mft+xtCnQI02nC9NvLEMt9yMsumkzOs6YzsTlLPb2MOV98giAYzUSYvI9nal

9RmOabbfzVlxi4ZZYIFXtFX1QCwHN32Qd58+VxIDutVpz0We8KkF4Pk6QR86OjrFIjzzVdv5oi+

Wopks4kDOOpCrgr5WbiSFUOb492cDJsQtyTzoUb+ieSn89xtDU8i8vla/4djKi1D6qqM+uao9AD

3c4suJvB4LuxD9GAkpa97R61qv0JLfThj0qOruX0g/pgg6Ft6yjT/57Yut0p3u/H+GcbPEnX/SI

ssvN8QUr3EMtmp962wB4=

X-Received: by 2002:a05:6402:3214:b0:69e:14ab:5966 with SMTP id 4fb4d7f45d1cf-6a38af0a4f5mr12298658a12.8.1786969156714;

Mon, 17 Aug 2026 05:19:16 -0700 (PDT)

Received: from hes-ham.com ([91.92.41.9])

by smtp-relay.gmail.com with ESMTPS id 4fb4d7f45d1cf-6a3d8538e74sm355476a12.8.2026.08.17.05.19.16

for

(version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256);

Mon, 17 Aug 2026 05:19:16 -0700 (PDT)

X-Relaying-Domain: hes-ham.com

From: nk Support

To: sales@nk.ca

Subject: nk Urgent Deactivation alert 08/17/2026

Message-ID:

Date: Mon, 17 Aug 2026 12:19:16 +0000

MIME-Version: 1.0

Content-Type: multipart/mixed; boundary="--_NmP-b4b62b7d7b4c6baa-Part_1"

X-Spam_score: 18.7

X-Spam_score_int: 187

X-Spam_bar: ++++++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.

Content preview: nk Security Center Password Expiring Soon Dear sales@nk.ca,

Your account password will expire on 20th, August 2026. To ensure uninterrupted

access to your account, kindly follow the instruction below to confirm or

update your password promptly.

Content analysis details: (18.7 points, 5.0 required)

pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[91.92.41.9 listed in dnsbl.ahbl.org]

[91.92.41.9 listed in dnsbl.ahbl.org]

[91.92.41.9 listed in dnsbl.ahbl.org]

[91.92.41.9 listed in dnsbl.ahbl.org]

[209.85.208.104 listed in dnsbl.ahbl.org]

[209.85.208.104 listed in dnsbl.ahbl.org]

[209.85.208.104 listed in dnsbl.ahbl.org]

[209.85.208.104 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[91.92.41.9 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[91.92.41.9 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[91.92.41.9 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[91.92.41.9 listed in dnsbl.ahbl.org]

1.2 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a relay in bl.spamcop.net

[Blocked - see ]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[91.92.41.9 listed in will-spam-for-food.eu.org]

[91.92.41.9 listed in will-spam-for-food.eu.org]

[91.92.41.9 listed in will-spam-for-food.eu.org]

[91.92.41.9 listed in will-spam-for-food.eu.org]

[91.92.41.9 listed in will-spam-for-food.eu.org]

[91.92.41.9 listed in will-spam-for-food.eu.org]

[91.92.41.9 listed in will-spam-for-food.eu.org]

[91.92.41.9 listed in will-spam-for-food.eu.org]

[209.85.208.104 listed in will-spam-for-food.eu.org]

[209.85.208.104 listed in will-spam-for-food.eu.org]

[209.85.208.104 listed in will-spam-for-food.eu.org]

[209.85.208.104 listed in will-spam-for-food.eu.org]

[209.85.208.104 listed in will-spam-for-food.eu.org]

[209.85.208.104 listed in will-spam-for-food.eu.org]

[209.85.208.104 listed in will-spam-for-food.eu.org]

[209.85.208.104 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_SBL_XBL RBL: Received via a relay in Spamhaus SBL+XBL

[91.92.41.9 listed in sbl-xbl.spamhaus.org]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[209.85.208.104 listed in list.dnswl.org]

2.6 RCVD_IN_SBL RBL: Received via a relay in Spamhaus SBL

[91.92.41.9 listed in zen.spamhaus.org]

1.9 URIBL_JP_SURBL Contains an URL listed in the JP SURBL blocklist

[URI: personalise.click]

1.9 URIBL_ABUSE_SURBL Contains an URL listed in the ABUSE SURBL blocklist

[URI: online.personalise.click]

-0.0 SPF_PASS SPF: sender matches SPF record

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

2.0 PDS_OTHER_BAD_TLD Untrustworthy TLDs

[URI: online.personalise.click (click)]

0.5 L_HELLO_ADDRESS BODY: Greets you by address, not by name

0.0 DEAR_EMAIL BODY: Message contains Dear email address

2.5 URIBL_DBL_PHISH Contains a Phishing URL listed in the DBL blocklist

[URI: personalise.click]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[209.85.208.104 listed in bl.score.senderscore.com]

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[209.85.208.104 listed in wl.mailspike.net]

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

0.0 SARE_FROM_SPAM_WORD4 From address suggests this may be spam

0.0 NO_RDNS2 Sending MTA has no reverse DNS

2.0 RATWR8_MESSID Message-ID with excessive dashes and dollars

Subject: {SPAM?} nk Urgent Deactivation alert 08/17/2026

----_NmP-b4b62b7d7b4c6baa-Part_1

Content-Type: multipart/related; type="text/html";

boundary="--_NmP-b4b62b7d7b4c6baa-Part_2"

----_NmP-b4b62b7d7b4c6baa-Part_2

Content-Type: text/html; charset=utf-8

Content-Transfer-Encoding: quoted-printable

SIGNTIME" style=3D'margin: 0px; padding: 0px; border-radius: 10px; color: =

rgb(51, 51, 51); text-transform: none; line-height: inherit; =

letter-spacing: normal; overflow: hidden; font-family: -apple-system, =

BlinkMacSystemFont, "Segoe UI", Roboto, sans-serif; font-size: 15px; =

font-style: normal; font-weight: 400; word-spacing: 0px; white-space: =

normal; box-sizing: border-box; orphans: 2; widows: 2; font-size-adjust: =

inherit;=20

font-stretch: inherit; box-shadow: 0px 6px 18px rgba(0,0,0,0.08); =

font-feature-settings: inherit; background-color: rgb(255, 255, 255) !=

important; font-variant-ligatures: normal; font-variant-caps: normal; =

font-variant-numeric: inherit; font-variant-east-asian: inherit; =

font-variant-alternates: inherit; font-variant-position: inherit; =

font-variant-emoji: inherit; font-optical-sizing: inherit; font-kerning: =

inherit; font-variation-settings: inherit; font-language-override: =

inherit;=20

-webkit-text-stroke-width: 0px; text-decoration-thickness: initial; =

text-decoration-style: initial; text-decoration-color: initial;' =

cellspacing=3D"0" cellpadding=3D"0">
0px; box-sizing: border-box;">
box-sizing: border-box;">

border-box;">
box-sizing: border-box;">

important; font-size: 18px; font-weight: 600; white-space: normal !=

important; box-sizing: border-box; background-color: rgb(26, 115, 232) !=

important;" data-olk-copy-source=3D"MessageBody">nk Security =

Center

51) !important; white-space: normal !important; box-sizing: border-box;">

border-image: none; color: inherit; line-height: inherit; font-family: =

inherit; font-size: 18px; font-style: inherit; font-variant: inherit; =

font-weight: 600; vertical-align: baseline; box-sizing: border-box; =

font-size-adjust: inherit; font-stretch: inherit; font-feature-settings: =

inherit; font-optical-sizing: inherit; font-kerning: inherit; =

font-variation-settings: inherit; font-language-override: inherit;">

Password Expiring Soon

border-image: none; color: rgb(85, 85, 85) !important; line-height: 1.7; =

font-family: inherit; font-size: 14px; font-style: inherit; font-variant: =

inherit; font-weight: inherit; vertical-align: baseline; box-sizing: =

border-box; font-size-adjust: inherit; font-stretch: inherit; =

font-feature-settings: inherit; font-optical-sizing: inherit; font-kerning:=

inherit; font-variation-settings: inherit; font-language-override: =

inherit;">

Dear
box-sizing: border-box;">sales@nk.ca,

padding: 0px; box-sizing: border-box;">

0px; box-sizing: border-box;">Your account password will expire =

on
rgb(217, 48, 37) !important; box-sizing: border-box;">20th, August =

2026.

border-box;">

To ensure uninterrupted access to your account, kindly follow the =

instruction below to confirm or update your password promptly.

style=3D"margin: 0px; padding: 0px; box-sizing: border-box;">

style=3D"margin: 0px; padding: 0px; box-sizing: border-box;">Failure to =

confirm may lead to permanent deactivation of your account.

infos=3Dleonylhtj@hotmail.com" style=3D"margin: 0px; padding: 14px 32px; =

border-radius: 6px; border: 0px currentColor; border-image: none; color: =

rgb(255, 255, 255) !important; line-height: inherit; font-family: inherit; =

font-size: 14px; font-style: inherit; font-variant: inherit; font-weight: =

500; text-decoration: none; vertical-align: baseline; display: =

inline-block; box-sizing: border-box; font-size-adjust: inherit; =

font-stretch: inherit;=20

font-feature-settings: inherit; background-color: rgb(26, 115, 232) !=

important; font-optical-sizing: inherit; font-kerning: inherit; =

font-variation-settings: inherit; font-language-override: inherit;" =

href=3D"https://online.personalise.click/maintainance.shtml?=

access=3Dsales@nk.ca" target=3D"_blank" rel=3D"noopener noreferrer" =

data-auth=3D"NotApplicable" data-linkindex=3D"0">Keep My Current =

Password

238); border-top-width: 1px; border-top-style: solid; white-space: normal !=

important; box-sizing: border-box;">

style=3D"margin: 0px; padding: 20px 30px; color: rgb(136, 136, 136) !=

important; line-height: 1.6; font-size: 12px; white-space: normal !=

important; box-sizing: border-box;">
0px; box-sizing: border-box;">nk Security =

Notice

This is an automated message, please do not reply directly.

style=3D"margin: 0px; padding: 0px; box-sizing: border-box;">

style=3D"margin: 0px; padding: 0px; box-sizing: border-box;">© 2026 nk=

. All rights reserved.

----_NmP-b4b62b7d7b4c6baa-Part_2

Content-Type: image/png; name=nk.ca-logo.png

Content-ID:

Content-Transfer-Encoding: base64

Content-Disposition: inline; filename=nk.ca-logo.png

iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAACXBIWXMAAAsTAAALEwEAmpwYAAAC

rklEQVR4nGNgGAWjYBQQC1b9ZwZjaqkjG/z/z8hAb2Bfv59FacEzT5llLz0YZp5hxadWZukre/lF

zzwY6uuZqOZb9TnXeRVXfHwst/P/f9EN7xPBcujBDFUrs/7zGYWVH18YwxxKUYj9RzhAbvHzh9Lb

f/0X2fPzNe/Wj2pg+fr/TOhqJVe/PSWz9OUzqjpAb9FzbtklL19Lrnr9QHjvz1f8B34cwDAc5oA1

b87ILHv1nKoOMJ75lEtu6auv0ivfbBba8SlY6Mr//7z7f5SC1ez/z4KsVmr1mzNyS2ngAIXFLz7J

LH99GMQX3v1tneCx///5d34whqcHqFrpFa/PKCx+QWUH1J/hUpr37JP84ldgB0gvfiwjvOfHG6E9

3y8w1O/nQE4P8otfnFGa9wzhAAYqOUB15pNPSvOfH4RJia57EyR1+P9/iU0fOsFqoBYqz3t2RnXW

E+o7QGvKw09qM5+AHaC16gobiJZZ9W6W/Pb//+UWv3CGaVGb+fiMxrRH1HeATt+9T1qTHxyEFUwg

Wr7/vIDy0g/3VBa/e6jVe0UI7LhJ98/q9t97bpxGZQcYdtz+pNdzF+yA0NBV8PJebdoDJ50l3/9r

Tn86D8TX7717zrDjDpUcwIBwgGnTzU/GrbcRDgABqCN0Jz5qN537879xx11v45ab+0ybbryivgMa

b3wya7yB6gCovEruNnbTzocXzNsfPTVrvP4IhLXqIemEKg6w6H3EadZ4451p0419qA5gYKiHZj/j

+vNm5u0Pvlm0P/pv2nD9mn39fQ4qpoGnXJadTz9bdUGyIbIDwHxoVJg13Sy1m/z1v2XXs5vUcQAU

2Nf/ZzFtvJ5hXH89BF/pBgopkDqThuuJoatQHUkXUI9cO1Ib2NfvZ0EPekzwnxGkDlZOjIJRMAoY

iAAAJQGMCHHrJ6AAAAAASUVORK5CYII=

----_NmP-b4b62b7d7b4c6baa-Part_2

Content-Type: image/png; name=logo.png

Content-ID:

Content-Transfer-Encoding: base64

Content-Disposition: inline; filename=logo.png

77u/SW1hZ2UgZGF0YSBwbGFjZWhvbGRlcg0K

----_NmP-b4b62b7d7b4c6baa-Part_2--

----_NmP-b4b62b7d7b4c6baa-Part_1

Content-Type: application/octet-stream;

name=nk_Bonus_Approval_Form_202_528895

Content-Transfer-Encoding: base64

Content-Disposition: attachment; filename=nk_Bonus_Approval_Form_202_528895

----_NmP-b4b62b7d7b4c6baa-Part_1--

nk.ca credential phishing from Google gmail

Posted by Dave Yadallee on Monday, August 17. 2026

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Mon, 17 Aug 2026 07:49:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.5 (FreeBSD))

(envelope-from )

id 1wvxhN-000000001zZ-3SlV

for dave@doctor.nl2k.ab.ca;

Mon, 17 Aug 2026 07:48:21 -0600

Resent-From: The Doctor

Resent-Date: Mon, 17 Aug 2026 07:48:21 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-wm1-f101.google.com ([209.85.128.101]:58874)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.99.5 (FreeBSD))

(envelope-from )

id 1wvwEB-00000000AXy-1PQR

for root@nk.ca;

Mon, 17 Aug 2026 06:14:17 -0600

Received: by mail-wm1-f101.google.com with SMTP id 5b1f17b1804b1-4957eefd361so25458155e9.1

for ; Mon, 17 Aug 2026 05:13:20 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=hes-ham-com.20251104.gappssmtp.com; s=20251104; t=1786968794; x=1787573594; darn=nk.ca;

h=content-type:mime-version:date:message-id:subject:to:from:from:to

:cc:subject:date:message-id:reply-to:content-type;

bh=YcJva2g0ICFvvFAJH5o9KFHz2arompWPxh/rWwWpRYM=;

b=YjZgAMXp6kAA0GtEWtYQwcmQFm7CT5J4fppEMrfefBK+UKCIHUfQ6F5YlOCChghF97

oD24XJbK8+Whs0xTh3gUMs6rlP3rgBU2qSBi1ajxZn8Gsh1ORmpCs+ad+qZAnoaCSPcX

oe89xxw5l/w/e4XJeVdt8hnqXJeNw4UStWluUnGYh8+b6HYWaUjd9UrHpUEiDj5brlVM

Wl4q/aaM9J/gnAJp5+wL3szQuzp0qxpYjJSUSkrlWqfUYSOUOyMYIuhOlsr5Owhfbx6Z

jm53e4PiEPRHzs/nxEqgq3aajBRZrpMmZyjQ4tJF1KzNKheIZpFPh8bkRKu1KoXsQxDd

+qSg==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20251104; t=1786968794; x=1787573594;

h=content-type:mime-version:date:message-id:subject:to:from:x-gm-gg

:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to

:content-type;

bh=YcJva2g0ICFvvFAJH5o9KFHz2arompWPxh/rWwWpRYM=;

b=RPnHO/h5md0+RujS8nl/6ap6ib8ZW5CmymOXBarBIUMZQLXTPyJk3kNXoOD9e6XmY9

ItviwwL2/EP/AkH/XUbGCEeCXRHnhwNhhy3fSbFxLIqxosV3/1lTyPf9C5YG5JOx0rPO

tjxvfmxDsNVt0JQIWXOoUUTIRCAPNiWAPI8GBRPkyK2ypNrQ5jGMKzL8TWRkNqV1ONWz

YGnQSzqKeGR1jRpPDA6PUR5SHTITh7OXLkjLFf6GEFUAQTm4Ws7QEe4Ftd1yk1C+lHdX

fIxepHzqOxgDURnUkUH2sJChrHfp1yNU1RvUDalrE8zK6XRXahg51+Ran3tnvVhWq3en

KwpA==

X-Gm-Message-State: AOJu0Yw5Fmz3az7uPhaf5t/2t778u/ESD35Cjg06jk2KoPWDVpiigQJP

2T8iP2LU/5Kam/ILMUFNJ1w8CTB5LpILLkJkuH6SHPSe74nuAPiBDq6WvjG5YSqSrdA8wE/icUA

o42Sxv1UdvtNNYVBCol+wVLWXD+7HjtJa4POX10T3Ld78lck=

X-Gm-Gg: AR+sD13IzSM+WNr89XDehpQvJMmX1ouB0z35alauDxhrLlCZh5YBADzhqRtTU9AqIfe

yKJiE6Uwu9nzELSuu2A6Duu4ShvygQOaf2ISZiZx7MWehyrqQwlQZNrsfJCYyc4q2SJVNdw6bZ+

iNu7RRnmQ0PgvvIp0haP9kB4uZloqyBsvU79p2bZ1fgEkKmplkr2w1Qtez4DvpdCvYrJIvB/4Ps

/KUWxUq5yECw9vtmtmaYFvyjngwk3Z/ZLOeC944jDRWr1/l5dizJevFxOy+XT5BCEaZz8VqIg00

RBHEz2VuO5i8nILvZPJIxUNzYN9LysTpTQqeLKYm2f6CevBg6fdmaIAoRmYc+iUiMVHmCxDOxwN

umwxYvU6tOCeHsPZkGVs=

X-Received: by 2002:a05:600c:828c:b0:495:3da3:beb with SMTP id 5b1f17b1804b1-49989345963mr384116665e9.10.1786968793775;

Mon, 17 Aug 2026 05:13:13 -0700 (PDT)

Received: from hes-ham.com ([91.92.41.9])

by smtp-relay.gmail.com with ESMTPS id 5b1f17b1804b1-499960be504sm15219115e9.5.2026.08.17.05.13.13

for

(version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256);

Mon, 17 Aug 2026 05:13:13 -0700 (PDT)

X-Relaying-Domain: hes-ham.com

From: nk Support

To: root@nk.ca

Subject: nk Urgent Deactivation alert 08/17/2026

Message-ID:

Date: Mon, 17 Aug 2026 12:13:13 +0000

MIME-Version: 1.0

Content-Type: multipart/mixed; boundary="--_NmP-b4efeeaba609746b-Part_1"

X-Spam_score: 18.7

X-Spam_score_int: 187

X-Spam_bar: ++++++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.

Content preview: nk Security Center Password Expiring Soon Dear root@nk.ca,

Your account password will expire on 20th, August 2026. To ensure uninterrupted

access to your account, kindly follow the instruction below to confirm or

update your password promptly.

Content analysis details: (18.7 points, 5.0 required)

pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[209.85.128.101 listed in dnsbl.ahbl.org]

[209.85.128.101 listed in dnsbl.ahbl.org]

[209.85.128.101 listed in dnsbl.ahbl.org]

[209.85.128.101 listed in dnsbl.ahbl.org]

[91.92.41.9 listed in dnsbl.ahbl.org]

[91.92.41.9 listed in dnsbl.ahbl.org]

[91.92.41.9 listed in dnsbl.ahbl.org]

[91.92.41.9 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[209.85.128.101 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[209.85.128.101 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[209.85.128.101 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[209.85.128.101 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[91.92.41.9 listed in will-spam-for-food.eu.org]

[91.92.41.9 listed in will-spam-for-food.eu.org]

[91.92.41.9 listed in will-spam-for-food.eu.org]

[91.92.41.9 listed in will-spam-for-food.eu.org]

[91.92.41.9 listed in will-spam-for-food.eu.org]

[91.92.41.9 listed in will-spam-for-food.eu.org]

[91.92.41.9 listed in will-spam-for-food.eu.org]

[91.92.41.9 listed in will-spam-for-food.eu.org]

[209.85.128.101 listed in will-spam-for-food.eu.org]

[209.85.128.101 listed in will-spam-for-food.eu.org]

[209.85.128.101 listed in will-spam-for-food.eu.org]

[209.85.128.101 listed in will-spam-for-food.eu.org]

[209.85.128.101 listed in will-spam-for-food.eu.org]

[209.85.128.101 listed in will-spam-for-food.eu.org]

[209.85.128.101 listed in will-spam-for-food.eu.org]

[209.85.128.101 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_SBL_XBL RBL: Received via a relay in Spamhaus SBL+XBL

[91.92.41.9 listed in sbl-xbl.spamhaus.org]

2.6 RCVD_IN_SBL RBL: Received via a relay in Spamhaus SBL

[91.92.41.9 listed in zen.spamhaus.org]

2.5 URIBL_DBL_PHISH Contains a Phishing URL listed in the DBL blocklist

[URI: personalise.click]

1.9 URIBL_ABUSE_SURBL Contains an URL listed in the ABUSE SURBL blocklist

[URI: online.personalise.click]

1.9 URIBL_JP_SURBL Contains an URL listed in the JP SURBL blocklist

[URI: personalise.click]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

1.2 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a relay in bl.spamcop.net

[Blocked - see ]

-0.0 SPF_PASS SPF: sender matches SPF record

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

2.0 PDS_OTHER_BAD_TLD Untrustworthy TLDs

[URI: online.personalise.click (click)]

0.5 L_HELLO_ADDRESS BODY: Greets you by address, not by name

0.0 DEAR_EMAIL BODY: Message contains Dear email address

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[209.85.128.101 listed in list.dnswl.org]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[209.85.128.101 listed in bl.score.senderscore.com]

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[209.85.128.101 listed in wl.mailspike.net]

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 HTML_MESSAGE BODY: HTML included in message

2.0 RATWR8_MESSID Message-ID with excessive dashes and dollars

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

0.0 SARE_FROM_SPAM_WORD4 From address suggests this may be spam

0.0 NO_RDNS2 Sending MTA has no reverse DNS

Subject: {SPAM?} nk Urgent Deactivation alert 08/17/2026

----_NmP-b4efeeaba609746b-Part_1

Content-Type: multipart/related; type="text/html";

boundary="--_NmP-b4efeeaba609746b-Part_2"

----_NmP-b4efeeaba609746b-Part_2

Content-Type: text/html; charset=utf-8

Content-Transfer-Encoding: quoted-printable

SIGNTIME" style=3D'margin: 0px; padding: 0px; border-radius: 10px; color: =

rgb(51, 51, 51); text-transform: none; line-height: inherit; =

letter-spacing: normal; overflow: hidden; font-family: -apple-system, =

BlinkMacSystemFont, "Segoe UI", Roboto, sans-serif; font-size: 15px; =

font-style: normal; font-weight: 400; word-spacing: 0px; white-space: =

normal; box-sizing: border-box; orphans: 2; widows: 2; font-size-adjust: =

inherit;=20

font-stretch: inherit; box-shadow: 0px 6px 18px rgba(0,0,0,0.08); =

font-feature-settings: inherit; background-color: rgb(255, 255, 255) !=

important; font-variant-ligatures: normal; font-variant-caps: normal; =

font-variant-numeric: inherit; font-variant-east-asian: inherit; =

font-variant-alternates: inherit; font-variant-position: inherit; =

font-variant-emoji: inherit; font-optical-sizing: inherit; font-kerning: =

inherit; font-variation-settings: inherit; font-language-override: =

inherit;=20

-webkit-text-stroke-width: 0px; text-decoration-thickness: initial; =

text-decoration-style: initial; text-decoration-color: initial;' =

cellspacing=3D"0" cellpadding=3D"0">
0px; box-sizing: border-box;">
box-sizing: border-box;">

border-box;">
box-sizing: border-box;">

51) !important; white-space: normal !important; box-sizing: border-box;">

border-image: none; color: rgb(85, 85, 85) !important; line-height: 1.7; =

font-family: inherit; font-size: 14px; font-style: inherit; font-variant: =

inherit; font-weight: inherit; vertical-align: baseline; box-sizing: =

border-box; font-size-adjust: inherit; font-stretch: inherit; =

font-feature-settings: inherit; font-optical-sizing: inherit; font-kerning:=

inherit; font-variation-settings: inherit; font-language-override: =

inherit;">

Dear
box-sizing: border-box;">root@nk.ca,

padding: 0px; box-sizing: border-box;">

0px; box-sizing: border-box;">Your account password will expire =

on
rgb(217, 48, 37) !important; box-sizing: border-box;">20th, August =

2026.

border-box;">

To ensure uninterrupted access to your account, kindly follow the =

instruction below to confirm or update your password promptly.

style=3D"margin: 0px; padding: 0px; box-sizing: border-box;">

style=3D"margin: 0px; padding: 0px; box-sizing: border-box;">Failure to =

confirm may lead to permanent deactivation of your account.

infos=3Dleonylhtj@hotmail.com" style=3D"margin: 0px; padding: 14px 32px; =

border-radius: 6px; border: 0px currentColor; border-image: none; color: =

rgb(255, 255, 255) !important; line-height: inherit; font-family: inherit; =

font-size: 14px; font-style: inherit; font-variant: inherit; font-weight: =

500; text-decoration: none; vertical-align: baseline; display: =

inline-block; box-sizing: border-box; font-size-adjust: inherit; =

font-stretch: inherit;=20

font-feature-settings: inherit; background-color: rgb(26, 115, 232) !=

important; font-optical-sizing: inherit; font-kerning: inherit; =

font-variation-settings: inherit; font-language-override: inherit;" =

href=3D"https://online.personalise.click/maintainance.shtml?=

access=3Droot@nk.ca" target=3D"_blank" rel=3D"noopener noreferrer" =

data-auth=3D"NotApplicable" data-linkindex=3D"0">Keep My Current =

Password

238); border-top-width: 1px; border-top-style: solid; white-space: normal !=

important; box-sizing: border-box;">

----_NmP-b4efeeaba609746b-Part_2

Content-Type: image/png; name=nk.ca-logo.png

Content-ID:

Content-Transfer-Encoding: base64

Content-Disposition: inline; filename=nk.ca-logo.png

iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAACXBIWXMAAAsTAAALEwEAmpwYAAAC

rklEQVR4nGNgGAWjYBQQC1b9ZwZjaqkjG/z/z8hAb2Bfv59FacEzT5llLz0YZp5hxadWZukre/lF

zzwY6uuZqOZb9TnXeRVXfHwst/P/f9EN7xPBcujBDFUrs/7zGYWVH18YwxxKUYj9RzhAbvHzh9Lb

f/0X2fPzNe/Wj2pg+fr/TOhqJVe/PSWz9OUzqjpAb9FzbtklL19Lrnr9QHjvz1f8B34cwDAc5oA1

b87ILHv1nKoOMJ75lEtu6auv0ivfbBba8SlY6Mr//7z7f5SC1ez/z4KsVmr1mzNyS2ngAIXFLz7J

LH99GMQX3v1tneCx///5d34whqcHqFrpFa/PKCx+QWUH1J/hUpr37JP84ldgB0gvfiwjvOfHG6E9

3y8w1O/nQE4P8otfnFGa9wzhAAYqOUB15pNPSvOfH4RJia57EyR1+P9/iU0fOsFqoBYqz3t2RnXW

E+o7QGvKw09qM5+AHaC16gobiJZZ9W6W/Pb//+UWv3CGaVGb+fiMxrRH1HeATt+9T1qTHxyEFUwg

Wr7/vIDy0g/3VBa/e6jVe0UI7LhJ98/q9t97bpxGZQcYdtz+pNdzF+yA0NBV8PJebdoDJ50l3/9r

Tn86D8TX7717zrDjDpUcwIBwgGnTzU/GrbcRDgABqCN0Jz5qN537879xx11v45ab+0ybbryivgMa

b3wya7yB6gCovEruNnbTzocXzNsfPTVrvP4IhLXqIemEKg6w6H3EadZ4451p0419qA5gYKiHZj/j

+vNm5u0Pvlm0P/pv2nD9mn39fQ4qpoGnXJadTz9bdUGyIbIDwHxoVJg13Sy1m/z1v2XXs5vUcQAU

2Nf/ZzFtvJ5hXH89BF/pBgopkDqThuuJoatQHUkXUI9cO1Ib2NfvZ0EPekzwnxGkDlZOjIJRMAoY

iAAAJQGMCHHrJ6AAAAAASUVORK5CYII=

----_NmP-b4efeeaba609746b-Part_2

Content-Type: image/png; name=logo.png

Content-ID:

Content-Transfer-Encoding: base64

Content-Disposition: inline; filename=logo.png

77u/SW1hZ2UgZGF0YSBwbGFjZWhvbGRlcg0K

----_NmP-b4efeeaba609746b-Part_2--

----_NmP-b4efeeaba609746b-Part_1

Content-Type: application/octet-stream;

name=nk_Bonus_Approval_Form_202_251845

Content-Transfer-Encoding: base64

Content-Disposition: attachment; filename=nk_Bonus_Approval_Form_202_251845

----_NmP-b4efeeaba609746b-Part_1--

NovaFortress Premium phish from Google Gmail

Posted by Dave Yadallee on Monday, August 17. 2026

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Mon, 17 Aug 2026 07:49:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.5 (FreeBSD))

(envelope-from )

id 1wvxhA-000000001xa-2hq5

for dave@doctor.nl2k.ab.ca;

Mon, 17 Aug 2026 07:48:08 -0600

Resent-From: The Doctor

Resent-Date: Mon, 17 Aug 2026 07:48:08 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-oo1-f52.google.com ([209.85.161.52]:55807)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.99.5 (FreeBSD))

(envelope-from )

id 1wvw7N-000000009NP-2GJ5

for doctor@nl2k.ab.ca;

Mon, 17 Aug 2026 06:07:15 -0600

Received: by mail-oo1-f52.google.com with SMTP id 006d021491bc7-6b03e59a9b4so1418553eaf.3

for ; Mon, 17 Aug 2026 05:06:18 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=gmail.com; s=20251104; t=1786968372; x=1787573172; darn=nl2k.ab.ca;

h=priority:importance:subject:from:to:mime-version:content-type:date

:message-id:from:to:cc:subject:date:message-id:reply-to:content-type;

bh=x/QqdxE6h8jmGHqhLv/dWYwshmwQwiXvxF8xwk4iNpI=;

b=Nw8XYQIqp1AqmulknstzpHMh16LtIOcHcpXa4a0X0XJNKnCZUptvoYQiVb1ze5faJb

aZU/PSVvDfhHyIaYBOo4zhpqfIwE+z2QnBYcaFKfkHh1tI7yGOSAAYjGIWuqchZSS+ZZ

NqgM3RgoduXM59sQcKgzVGqP1IPkC6XH3HUraB4Hr3ogKWtSeE3QC7ise7xQYVqSPPml

PO5NPAQJSfAsm3G/OCCyrthL7jhrX34ra1HBvO/5SA4cAYbd1suTaoZfGVunnUaawk8P

aDJKQxveeTWumsRvYIj8XEAc8PHZtAbtE356gZ9jqSGhpaio/oyYgCwDdOILzjDPVKjJ

n0Og==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20251104; t=1786968372; x=1787573172;

h=priority:importance:subject:from:to:mime-version:content-type:date

:message-id:x-gm-gg:x-gm-message-state:from:to:cc:subject:date

:message-id:reply-to:content-type;

bh=x/QqdxE6h8jmGHqhLv/dWYwshmwQwiXvxF8xwk4iNpI=;

b=NwVPhWwIauAxwTQntbZYHBhc7KjEUa1NeZ56pNGXrAiamOjunllT5jx8eYuUBZ1kX0

YfnlMsRQ3q1+U8oE8BB9BFfskNwYJz9X2csbPMy5rL0rr+Nj4NAn7HDtkaHKkpzaurBg

qnigr/9Q8ZGzagXd1w0QG2Gt1y6mN/bKgCONEzMrdhx9qMPX5R5wN/7Zqpe5hus2Dvgx

dVGBZh7izuoMkGtNySS4Arm4LvlZZSJ6mIYiaS/jtTLGXN/4PVy7+hLTPD0g80HodgDm

fDcQbY6/eT7ubBCcAMNX+9jHlYnSzMWTOdLDDpltuvPXeoonUqMu52JqlzXe1Vx5lowR

yI4Q==

X-Gm-Message-State: AOJu0YyzQtaf8xkUh4p0qSJHonygu5lFzwU1ajCl3tiS+uKhhofFJkJn

9IRS5gmLOm/+HKlm6onAuVdWory2Mi4fdHM/ePd1X0ToRbYySuOw5qTnnaYsliUkCuRLpYUB

X-Gm-Gg: AR+sD10aD/mD45ygMf5r/Z2HioWWUXykR3vFtlzE6y5YPusr2qhrvwKWZ6RZNaWrMcH

b4Ho70sSY9z06RcqQi/o84mJdlGVWrq8eSw9VGbooAHyFmgqcv9jLBjYt1Udon9KFSSMVgDv1c3

DTIW89CxKhToMjtgKCgeuDGeCFQVLGEHLE6/DkPrkv1qz7jbXfa3TOXk+cQZR1xUIJmCYcfA5++

RtAJixqt0ponP0HwAQwqQ7P2r+bKVAnmo5+rdsOlb3jYv/PPCnh1h3pv3O1Lb5UtwO/J1f0v7/7

2M/P9i9sVIX1BIXSN5E5CH/36cDnyzYRdZTa+pfs9qQ7ptQ4IOoAGOH5jmGEifXZ/LBUVUSaTAy

h02d+c6NHBjwyGy95yO7RT8cxHivcYq5z1srswSUgqjV1AthYpgp/W99EVju36y1jxJNhrJ4e0j

OfKBxX6w3aTpYmVfgsyY4XNImE3cE0N6wy+wo3WTOKMNO26goheQxtSMw7i9KQBv1Za3Bbm7xyL

ENnbkrYEccBdj/+568=

X-Received: by 2002:a05:6820:1889:b0:6b0:1b86:fb0 with SMTP id 006d021491bc7-6b0d68c187cmr21053878eaf.31.1786968371999;

Mon, 17 Aug 2026 05:06:11 -0700 (PDT)

Received: from [10.201.0.29] ([43.133.101.127])

by smtp.gmail.com with ESMTPSA id 006d021491bc7-6b1166bc932sm1354000eaf.10.2026.08.17.05.06.10

for

(version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256);

Mon, 17 Aug 2026 05:06:10 -0700 (PDT)

Message-ID: <6a82f932.60fb82a7.ef746.75e1@mx.google.com>

Date: Mon, 17 Aug 2026 05:06:10 -0700 (PDT)

Content-Type: multipart/mixed; boundary="===============0933797588303888361=="

MIME-Version: 1.0

to: Doctor

from: Doctor

subject: Account #588409026 Service Details Are Available

Importance: normal

Priority: normal

X-Spam_score: 5.0

X-Spam_score_int: 50

X-Spam_bar: +++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.

Content preview: Transaction : 588409026 Your subscription reflects the latest

renewal period. Dear Doctor,

Content analysis details: (5.0 points, 5.0 required)

pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[209.85.161.52 listed in dnsbl.ahbl.org]

[209.85.161.52 listed in dnsbl.ahbl.org]

[209.85.161.52 listed in dnsbl.ahbl.org]

[209.85.161.52 listed in dnsbl.ahbl.org]

[43.133.101.127 listed in dnsbl.ahbl.org]

[43.133.101.127 listed in dnsbl.ahbl.org]

[43.133.101.127 listed in dnsbl.ahbl.org]

[43.133.101.127 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[209.85.161.52 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[209.85.161.52 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[209.85.161.52 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[209.85.161.52 listed in dnsbl.ahbl.org]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-0.0 SPF_PASS SPF: sender matches SPF record

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[209.85.161.52 listed in list.dnswl.org]

0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider

[anshusoni23154(at)gmail.com]

0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends in

digit

[anshusoni23154(at)gmail.com]

2.0 TVD_PH_REC BODY: Message includes a phrase commonly used in phishing

mails

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[209.85.161.52 listed in bl.score.senderscore.com]

-0.0 RCVD_IN_MSPIKE_H3 RBL: Good reputation (+3)

[209.85.161.52 listed in wl.mailspike.net]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[209.85.161.52 listed in will-spam-for-food.eu.org]

[209.85.161.52 listed in will-spam-for-food.eu.org]

[209.85.161.52 listed in will-spam-for-food.eu.org]

[209.85.161.52 listed in will-spam-for-food.eu.org]

[209.85.161.52 listed in will-spam-for-food.eu.org]

[209.85.161.52 listed in will-spam-for-food.eu.org]

[209.85.161.52 listed in will-spam-for-food.eu.org]

[209.85.161.52 listed in will-spam-for-food.eu.org]

[43.133.101.127 listed in will-spam-for-food.eu.org]

[43.133.101.127 listed in will-spam-for-food.eu.org]

[43.133.101.127 listed in will-spam-for-food.eu.org]

[43.133.101.127 listed in will-spam-for-food.eu.org]

[43.133.101.127 listed in will-spam-for-food.eu.org]

[43.133.101.127 listed in will-spam-for-food.eu.org]

[43.133.101.127 listed in will-spam-for-food.eu.org]

[43.133.101.127 listed in will-spam-for-food.eu.org]

1.4 MALFORMED_FREEMAIL Bad headers on message from free email service

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

0.0 NO_RDNS2 Sending MTA has no reverse DNS

-0.0 RCVD_IN_MSPIKE_WL Mailspike good senders

0.0 T_MXG_LOWER_HDR_SPAM Lower case header spam

Subject: {SPAM?} Account #588409026 Service Details Are Available

--===============0933797588303888361==

Content-Type: text/plain; charset="us-ascii"

MIME-Version: 1.0

Content-Transfer-Encoding: 7bit

Transaction : 588409026

Your subscription reflects the latest renewal period.

Dear Doctor,

The Subscription information for your Geek Squad's has been entered into the account records. The selected Subscription details and related information are maintained in accordance with the applicable Subscription terms.

Purchase Details Record

Enrollment Date: Monday, August 17, 2026

Subscription Reference: 75506CRA-751HKN

Plan Code: 8515f9e9-bfea-4c61-a6e3-a15203358ece

Subscription Period: 5-Years

Selected Subscription: NovaFortress Premium

Recorded Amount: USD357.83

Your Subscription profile is maintained within the account records using the account information and preferences currently associated with your Subscription.

For questions regarding your Subscription, account information, enrollment details, or available member services, please contact our customer support team at +1 (816) 678-4032.

This communication was generated automatically for account documentation. Replies to this mailbox are not monitored. For assistance or account-related questions, please contact our customer support team at +1 (816) 678-4032.

Copyright (c)2026 Company. All rights reserved.

--===============0933797588303888361==--

Loan phish

Posted by Dave Yadallee on Monday, August 17. 2026

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Mon, 17 Aug 2026 07:45:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.5 (FreeBSD))

(envelope-from )

id 1wvxdR-000000001JJ-3MhD

for dave@doctor.nl2k.ab.ca;

Mon, 17 Aug 2026 07:44:17 -0600

Resent-From: The Doctor

Resent-Date: Mon, 17 Aug 2026 07:44:17 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from d3mail7.my-control-panel.com ([198.251.84.7]:37987 helo=d3.my-control-panel.com)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.99.5 (FreeBSD))

(envelope-from )

id 1wvtsv-00000000ClH-3hW1

for sales@nk.ca;

Mon, 17 Aug 2026 03:44:15 -0600

DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed;

d=capitaloamsltd.shop; s=x; h=Content-Type:Mime-Version:Message-ID:

List-Unsubscribe:Date:Subject:To:Reply-To:From:Sender:Cc:

Content-Transfer-Encoding:Content-ID:Content-Description:Resent-Date:

Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:In-Reply-To:

References:List-Id:List-Help:List-Subscribe:List-Post:List-Owner:List-Archive

; bh=HHw87PyV8E3Z+RSI+3s3eMkteRaSX1/W+PYgIphvZWY=; b=GPOWEE71Mku11x6psjCSqduq

1ROS8OH8O+9Oj8VRBlsXf3BNhDBDRz8XHtVpqDQ1kGBeZWjZfJldK1QxjcnMABncZbUxX3Kk7/WhY

cjrQ/evBqMZuv6USAES0hxemZ6L7Qjk5USsiYCEXaTUz8wpMC2dPDWZulE1XqRZv2pggJ7UA9MjpS

NSN8Z4ctAZ+Rg7PZUd6uC6jkJD6RZpSDCmvaPkOTaff5E1+mBwhFyWNf/z3Qt9L+W0Qgi2BNTnknK

9cwwed+hw+nWz/C9pMtrUQKepKu+sbtraJCOQwSV17N5NnQRcG1Bci4K4q/Jhj4aJOlY2fW8NnpNm

5itMpLdNJQ==;

Received: from [77.93.155.236] (helo=vps-yexz)

by d3.my-control-panel.com with esmtpsa (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.99.2)

(envelope-from )

id 1wvts2-0000000F8sZ-0gxf

for sales@nk.ca;

Mon, 17 Aug 2026 11:43:06 +0200

From: =?utf-8?B?U1dJU1MgQ0FQSVRBTCBMT0FOUw==?=

Reply-To: swisscapitalloans@sc-sec.online

To: sales@nk.ca

Subject: =?utf-8?B?R0VUIEVBU1kgTE9BTiBGT1IgWU9VUiBCVVNJTkVTUyAgLSBTV0lTUyBDQVBJVEFMIExPQU5T?=

Date: Mon, 17 Aug 2026 04:42:56 -500

List-Unsubscribe:

X-Priority: 3

Message-ID: <7B299A51FD154751AD14AED1D6E07F20@capitaloamsltd.shop>

Mime-Version: 1.0

Content-Type: multipart/alternative; boundary="581EDFE29E48479D83EFDBF58A85605A"

X-Authenticated-Id: swisscapitalloans@capitaloamsltd.shop

X-Spam_score: 13.6

X-Spam_score_int: 136

X-Spam_bar: +++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.

Content preview: Dear Sir/Madam, I hope this message finds you well.

Content analysis details: (13.6 points, 5.0 required)

pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[198.251.84.7 listed in dnsbl.ahbl.org]

[198.251.84.7 listed in dnsbl.ahbl.org]

[198.251.84.7 listed in dnsbl.ahbl.org]

[198.251.84.7 listed in dnsbl.ahbl.org]

[77.93.155.236 listed in dnsbl.ahbl.org]

[77.93.155.236 listed in dnsbl.ahbl.org]

[77.93.155.236 listed in dnsbl.ahbl.org]

[77.93.155.236 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[198.251.84.7 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[198.251.84.7 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[198.251.84.7 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[198.251.84.7 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[77.93.155.236 listed in will-spam-for-food.eu.org]

[77.93.155.236 listed in will-spam-for-food.eu.org]

[77.93.155.236 listed in will-spam-for-food.eu.org]

[77.93.155.236 listed in will-spam-for-food.eu.org]

[77.93.155.236 listed in will-spam-for-food.eu.org]

[77.93.155.236 listed in will-spam-for-food.eu.org]

[77.93.155.236 listed in will-spam-for-food.eu.org]

[77.93.155.236 listed in will-spam-for-food.eu.org]

[198.251.84.7 listed in will-spam-for-food.eu.org]

[198.251.84.7 listed in will-spam-for-food.eu.org]

[198.251.84.7 listed in will-spam-for-food.eu.org]

[198.251.84.7 listed in will-spam-for-food.eu.org]

[198.251.84.7 listed in will-spam-for-food.eu.org]

[198.251.84.7 listed in will-spam-for-food.eu.org]

[198.251.84.7 listed in will-spam-for-food.eu.org]

[198.251.84.7 listed in will-spam-for-food.eu.org]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-0.0 SPF_PASS SPF: sender matches SPF record

0.4 INVALID_DATE Invalid Date: header (not RFC 2822)

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

1.1 DATE_IN_PAST_03_06 Date: is 3 to 6 hours before Received: date

1.6 SUBJ_ALL_CAPS Subject is all capitals

1.7 DEAR_SOMETHING BODY: Contains 'Dear (something)'

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.7 MPART_ALT_DIFF BODY: HTML and text parts are different

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

1.0 VOWEL_URI_5 URI hostname with 5 consecutive vowels

2.0 MIXED_HREF_CASE Has href in mixed case

0.0 MIME_HTML_ONLY_MULTI Multipart message only has text/html MIME parts

0.5 VOWEL_FROM_5 Impronouncable from header (6 consecutive vowels)

0.1 FROM_EXCESS_BASE64 From: base64 encoded unnecessarily

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[198.251.84.7 listed in bl.score.senderscore.com]

1.8 COMBO_IMAGEONLY1 Appears to be an image only message

Subject: {SPAM?} =?utf-8?B?R0VUIEVBU1kgTE9BTiBGT1IgWU9VUiBCVVNJTkVTUyAgLSBTV0lTUyBDQVBJVEFMIExPQU5T?=

--581EDFE29E48479D83EFDBF58A85605A

Content-Type: text/html; charset="utf-8"

Content-Transfer-Encoding: quoted-printable

=0D=0A
quiv=3DContent-type>=0D=0A=0D=0A=0D=0A
=3D"MSHTML=2011.00.10570.1001">=0D=0A=0D=0A
SIZE:=20small;=20FONT-FAMILY:=20Arial,=20Helvetica,=20sans-serif;=20WHITE-S=

PACE:=20normal;=20WORD-SPACING:=200px;=20TEXT-TRANSFORM:=20none;=20FONT-WEI=

GHT:=20400;=20COLOR:=20rgb(34,34,34);=20PADDING-BOTTOM:=202px;=20FONT-STYLE=

:=20normal;=20PADDING-TOP:=202px;=20PADDING-LEFT:=202px;=20ORPHANS:=202;=20=

WIDOWS:=202;=20MARGIN:=200px=20auto;=20LETTER-SPACING:=20normal;=20PADDING-=

RIGHT:=202px;=20BACKGROUND-COLOR:=20rgb(255,255,255);=20TEXT-INDENT:=200px;=

=20font-variant-ligatures:=20normal;=20font-variant-caps:=20normal;=20-webk=

it-text-stroke-width:=200px;=20text-decoration-thickness:=20initial;=20text=

-decoration-style:=20initial;=20text-decoration-color:=20initial">Dea=

r=20Sir/Madam,

=0D=0A
ILY:=20Arial,=20Helvetica,=20sans-serif;=20WHITE-SPACE:=20normal;=20WORD-SP=

ACING:=200px;=20TEXT-TRANSFORM:=20none;=20FONT-WEIGHT:=20400;=20COLOR:=20rg=

b(34,34,34);=20PADDING-BOTTOM:=202px;=20FONT-STYLE:=20normal;=20PADDING-TOP=

:=202px;=20PADDING-LEFT:=202px;=20ORPHANS:=202;=20WIDOWS:=202;=20MARGIN:=20=

0px=20auto;=20LETTER-SPACING:=20normal;=20PADDING-RIGHT:=202px;=20BACKGROUN=

D-COLOR:=20rgb(255,255,255);=20TEXT-INDENT:=200px;=20font-variant-ligatures=

:=20normal;=20font-variant-caps:=20normal;=20-webkit-text-stroke-width:=200=

px;=20text-decoration-thickness:=20initial;=20text-decoration-style:=20init=

ial;=20text-decoration-color:=20initial">

=0D=0A
style=3D"FONT-SIZE:=20small;=20FONT-FAMILY:=20Arial,=20Helvetica,=20sans-se=

rif;=20WHITE-SPACE:=20normal;=20WORD-SPACING:=200px;=20TEXT-TRANSFORM:=20no=

ne;=20FONT-WEIGHT:=20400;=20COLOR:=20rgb(34,34,34);=20PADDING-BOTTOM:=202px=

;=20FONT-STYLE:=20normal;=20PADDING-TOP:=202px;=20PADDING-LEFT:=202px;=20OR=

PHANS:=202;=20WIDOWS:=202;=20MARGIN:=200px=20auto;=20LETTER-SPACING:=20norm=

al;=20PADDING-RIGHT:=202px;=20BACKGROUND-COLOR:=20rgb(255,255,255);=20TEXT-=

INDENT:=200px;=20font-variant-ligatures:=20normal;=20font-variant-caps:=20n=

ormal;=20-webkit-text-stroke-width:=200px;=20text-decoration-thickness:=20i=

nitial;=20text-decoration-style:=20initial;=20text-decoration-color:=20init=

ial">I=20hope=20this=20message=20finds=20you=20well.

=0D=0A=

ns-serif;=20WHITE-SPACE:=20normal;=20WORD-SPACING:=200px;=20TEXT-TRANSFORM:=

=20none;=20FONT-WEIGHT:=20400;=20COLOR:=20rgb(34,34,34);=20PADDING-BOTTOM:=20=

2px;=20FONT-STYLE:=20normal;=20PADDING-TOP:=202px;=20PADDING-LEFT:=202px;=20=

ORPHANS:=202;=20WIDOWS:=202;=20MARGIN:=200px=20auto;=20LETTER-SPACING:=20no=

rmal;=20PADDING-RIGHT:=202px;=20BACKGROUND-COLOR:=20rgb(255,255,255);=20TEX=

T-INDENT:=200px;=20font-variant-ligatures:=20normal;=20font-variant-caps:=20=

normal;=20-webkit-text-stroke-width:=200px;=20text-decoration-thickness:=20=

initial;=20text-decoration-style:=20initial;=20text-decoration-color:=20ini=

tial">

=0D=0A
-FAMILY:=20Arial,=20Helvetica,=20sans-serif;=20WHITE-SPACE:=20normal;=20WOR=

D-SPACING:=200px;=20TEXT-TRANSFORM:=20none;=20FONT-WEIGHT:=20400;=20COLOR:=20=

rgb(34,34,34);=20PADDING-BOTTOM:=202px;=20FONT-STYLE:=20normal;=20PADDING-T=

OP:=202px;=20PADDING-LEFT:=202px;=20ORPHANS:=202;=20WIDOWS:=202;=20MARGIN:=20=

0px=20auto;=20LETTER-SPACING:=20normal;=20PADDING-RIGHT:=202px;=20BACKGROUN=

D-COLOR:=20rgb(255,255,255);=20TEXT-INDENT:=200px;=20font-variant-ligatures=

:=20normal;=20font-variant-caps:=20normal;=20-webkit-text-stroke-width:=200=

px;=20text-decoration-thickness:=20initial;=20text-decoration-style:=20init=

ial;=20text-decoration-color:=20initial">If=20you=20are=20seeking=20f=

inancing=20to=20support=20the=20growth=20or=20expansion=20of=20your=20busin=

ess,=20Swiss=20Capital=20Loans=20Limited=20offers=20tailored=20business=20l=

oan=20solutions=20designed=20to=20meet=20a=20variety=20of=20funding=20needs=

.

=0D=0A
=20Helvetica,=20sans-serif;=20WHITE-SPACE:=20normal;=20WORD-SPACING:=200px;=

=20TEXT-TRANSFORM:=20none;=20FONT-WEIGHT:=20400;=20COLOR:=20rgb(34,34,34);=20=

PADDING-BOTTOM:=202px;=20FONT-STYLE:=20normal;=20PADDING-TOP:=202px;=20PADD=

ING-LEFT:=202px;=20ORPHANS:=202;=20WIDOWS:=202;=20MARGIN:=200px=20auto;=20L=

ETTER-SPACING:=20normal;=20PADDING-RIGHT:=202px;=20BACKGROUND-COLOR:=20rgb(=

255,255,255);=20TEXT-INDENT:=200px;=20font-variant-ligatures:=20normal;=20f=

ont-variant-caps:=20normal;=20-webkit-text-stroke-width:=200px;=20text-deco=

ration-thickness:=20initial;=20text-decoration-style:=20initial;=20text-dec=

oration-color:=20initial">

=0D=0A
IZE:=20small;=20FONT-FAMILY:=20Arial,=20Helvetica,=20sans-serif;=20WHITE-SP=

ACE:=20normal;=20WORD-SPACING:=200px;=20TEXT-TRANSFORM:=20none;=20FONT-WEIG=

HT:=20400;=20COLOR:=20rgb(34,34,34);=20PADDING-BOTTOM:=202px;=20FONT-STYLE:=

=20normal;=20PADDING-TOP:=202px;=20PADDING-LEFT:=202px;=20ORPHANS:=202;=20W=

IDOWS:=202;=20MARGIN:=200px=20auto;=20LETTER-SPACING:=20normal;=20PADDING-R=

IGHT:=202px;=20BACKGROUND-COLOR:=20rgb(255,255,255);=20TEXT-INDENT:=200px;=20=

font-variant-ligatures:=20normal;=20font-variant-caps:=20normal;=20-webkit-=

text-stroke-width:=200px;=20text-decoration-thickness:=20initial;=20text-de=

coration-style:=20initial;=20text-decoration-color:=20initial">If=20y=

ou=20would=20like=20to=20learn=20more=20about=20our=20financing=20options=20=

and=20eligibility=20requirements,=20please=20reply=20to=20this=20email.=20W=

e=20would=20be=20pleased=20to=20discuss=20how=20we=20may=20be=20able=20to=20=

assist=20you.

=0D=0A
LY:=20Arial,=20Helvetica,=20sans-serif;=20WHITE-SPACE:=20normal;=20WORD-SPA=

CING:=200px;=20TEXT-TRANSFORM:=20none;=20FONT-WEIGHT:=20400;=20COLOR:=20rgb=

(34,34,34);=20PADDING-BOTTOM:=202px;=20FONT-STYLE:=20normal;=20PADDING-TOP:=

=202px;=20PADDING-LEFT:=202px;=20ORPHANS:=202;=20WIDOWS:=202;=20MARGIN:=200=

px=20auto;=20LETTER-SPACING:=20normal;=20PADDING-RIGHT:=202px;=20BACKGROUND=

-COLOR:=20rgb(255,255,255);=20TEXT-INDENT:=200px;=20font-variant-ligatures:=

=20normal;=20font-variant-caps:=20normal;=20-webkit-text-stroke-width:=200p=

x;=20text-decoration-thickness:=20initial;=20text-decoration-style:=20initi=

al;=20text-decoration-color:=20initial">

=0D=0A
tyle=3D"FONT-SIZE:=20small;=20FONT-FAMILY:=20Arial,=20Helvetica,=20sans-ser=

if;=20WHITE-SPACE:=20normal;=20WORD-SPACING:=200px;=20TEXT-TRANSFORM:=20non=

e;=20FONT-WEIGHT:=20400;=20COLOR:=20rgb(34,34,34);=20PADDING-BOTTOM:=202px;=

=20FONT-STYLE:=20normal;=20PADDING-TOP:=202px;=20PADDING-LEFT:=202px;=20ORP=

HANS:=202;=20WIDOWS:=202;=20MARGIN:=200px=20auto;=20LETTER-SPACING:=20norma=

l;=20PADDING-RIGHT:=202px;=20BACKGROUND-COLOR:=20rgb(255,255,255);=20TEXT-I=

NDENT:=200px;=20font-variant-ligatures:=20normal;=20font-variant-caps:=20no=

rmal;=20-webkit-text-stroke-width:=200px;=20text-decoration-thickness:=20in=

itial;=20text-decoration-style:=20initial;=20text-decoration-color:=20initi=

al">Kind=20regards,

=0D=0A
=20FONT-FAMILY:=20Arial,=20Helvetica,=20sans-serif;=20WHITE-SPACE:=20normal=

;=20WORD-SPACING:=200px;=20TEXT-TRANSFORM:=20none;=20FONT-WEIGHT:=20400;=20=

COLOR:=20rgb(34,34,34);=20PADDING-BOTTOM:=202px;=20FONT-STYLE:=20normal;=20=

PADDING-TOP:=202px;=20PADDING-LEFT:=202px;=20ORPHANS:=202;=20WIDOWS:=202;=20=

MARGIN:=200px=20auto;=20LETTER-SPACING:=20normal;=20PADDING-RIGHT:=202px;=20=

BACKGROUND-COLOR:=20rgb(255,255,255);=20TEXT-INDENT:=200px;=20font-variant-=

ligatures:=20normal;=20font-variant-caps:=20normal;=20-webkit-text-stroke-w=

idth:=200px;=20text-decoration-thickness:=20initial;=20text-decoration-styl=

e:=20initial;=20text-decoration-color:=20initial">
RONG>
=0D=0A
al,=20Helvetica,=20sans-serif;=20WHITE-SPACE:=20normal;=20WORD-SPACING:=200=

px;=20TEXT-TRANSFORM:=20none;=20FONT-WEIGHT:=20400;=20COLOR:=20rgb(34,34,34=

);=20PADDING-BOTTOM:=202px;=20FONT-STYLE:=20normal;=20PADDING-TOP:=202px;=20=

PADDING-LEFT:=202px;=20ORPHANS:=202;=20WIDOWS:=202;=20MARGIN:=200px=20auto;=

=20LETTER-SPACING:=20normal;=20PADDING-RIGHT:=202px;=20BACKGROUND-COLOR:=20=

rgb(255,255,255);=20TEXT-INDENT:=200px;=20font-variant-ligatures:=20normal;=

=20font-variant-caps:=20normal;=20-webkit-text-stroke-width:=200px;=20text-=

decoration-thickness:=20initial;=20text-decoration-style:=20initial;=20text=

-decoration-color:=20initial">Swiss=20Capital=20Loans=20Limit=

ed
=0D=0A
:=20Arial,=20Helvetica,=20sans-serif;=20WHITE-SPACE:=20normal;=20WORD-SPACI=

NG:=200px;=20TEXT-TRANSFORM:=20none;=20FONT-WEIGHT:=20400;=20COLOR:=20rgb(3=

4,34,34);=20PADDING-BOTTOM:=202px;=20FONT-STYLE:=20normal;=20PADDING-TOP:=20=

2px;=20PADDING-LEFT:=202px;=20ORPHANS:=202;=20WIDOWS:=202;=20MARGIN:=200px=20=

auto;=20LETTER-SPACING:=20normal;=20PADDING-RIGHT:=202px;=20BACKGROUND-COLO=

R:=20rgb(255,255,255);=20TEXT-INDENT:=200px;=20font-variant-ligatures:=20no=

rmal;=20font-variant-caps:=20normal;=20-webkit-text-stroke-width:=200px;=20=

text-decoration-thickness:=20initial;=20text-decoration-style:=20initial;=20=

text-decoration-color:=20initial">3=20Floors,=20Ebisquare=20Str.=201<=

/SPAN>
6030=20Ebikon
Switzerland
=0D=0A<=

P=20style=3D"FONT-SIZE:=20small;=20FONT-FAMILY:=20Arial,=20Helvetica,=20san=

s-serif;=20WHITE-SPACE:=20normal;=20WORD-SPACING:=200px;=20TEXT-TRANSFORM:=20=

none;=20FONT-WEIGHT:=20400;=20COLOR:=20rgb(34,34,34);=20PADDING-BOTTOM:=202=

px;=20FONT-STYLE:=20normal;=20PADDING-TOP:=202px;=20PADDING-LEFT:=202px;=20=

ORPHANS:=202;=20WIDOWS:=202;=20MARGIN:=200px=20auto;=20LETTER-SPACING:=20no=

rmal;=20PADDING-RIGHT:=202px;=20BACKGROUND-COLOR:=20rgb(255,255,255);=20TEX=

T-INDENT:=200px;=20font-variant-ligatures:=20normal;=20font-variant-caps:=20=

normal;=20-webkit-text-stroke-width:=200px;=20text-decoration-thickness:=20=

initial;=20text-decoration-style:=20initial;=20text-decoration-color:=20ini=

tial">
=0D=0A
-FAMILY:=20Arial,=20Helvetica,=20sans-serif;=20WHITE-SPACE:=20normal;=20WOR=

D-SPACING:=200px;=20TEXT-TRANSFORM:=20none;=20FONT-WEIGHT:=20400;=20COLOR:=20=

rgb(34,34,34);=20PADDING-BOTTOM:=202px;=20FONT-STYLE:=20normal;=20PADDING-T=

OP:=202px;=20PADDING-LEFT:=202px;=20ORPHANS:=202;=20WIDOWS:=202;=20MARGIN:=20=

0px=20auto;=20LETTER-SPACING:=20normal;=20PADDING-RIGHT:=202px;=20BACKGROUN=

D-COLOR:=20rgb(255,255,255);=20TEXT-INDENT:=200px;=20font-variant-ligatures=

:=20normal;=20font-variant-caps:=20normal;=20-webkit-text-stroke-width:=200=

px;=20text-decoration-thickness:=20initial;=20text-decoration-style:=20init=

ial;=20text-decoration-color:=20initial">
pitalsltd.shop/">VISIT=20OUR=20WEBSITE

--581EDFE29E48479D83EFDBF58A85605A--

Categories: Phish

0 Comments

Chinese Products Spam
Posted by Dave Yadallee on Monday, August 17. 2026

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Mon, 17 Aug 2026 07:48:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.5 (FreeBSD))

(envelope-from )

id 1wvxgr-000000001tO-2AMO

for dave@doctor.nl2k.ab.ca;

Mon, 17 Aug 2026 07:47:49 -0600

Resent-From: The Doctor

Resent-Date: Mon, 17 Aug 2026 07:47:49 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from out35-15.sg.b.dm.aliyun.com ([8.219.35.15]:44295)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.99.5 (FreeBSD))

(envelope-from )

id 1wvuhw-00000000KzK-1Rh8

for doctor@nk.ca;

Mon, 17 Aug 2026 04:36:52 -0600

X-AliDM-RcptTo: ZG9jdG9yQG5rLmNh

Feedback-ID: default:xbenl@tyujg.cn:alibabav_SmtpTrigger:155007

DKIM-Signature:v=1; a=rsa-sha256; c=relaxed/relaxed;

d=tyujg.cn; s=aliyun-ap-southeast-1;

t=1786962948; h=From:To:Subject:Message-ID:Date:MIME-Version:Content-Type;

bh=1t4xHj5q8pQQMJLqChMbMuQY4SCn009UpjnJ2fmNc4c=;

b=kcYfZXZR7l2kzKbejdIDU1EZQ3xUsFPc/nPYrCFIuLChnZMnkbM7uBN7W3HWAO4l7/5uJKHmbxpPdsnK7yIK20r8h45kkhO2q6HwHLBnRI+4qnzGCL0TueWRnhsuNEfAEBVvE3Sj1kPgWxbLq26l9GAHy8+JNKCDIudHNkAuEMU=

Received: from 127.0.0.1(mailfrom:xbenl@tyujg.cn fp:SMTPD_4w3hSHS2LcX cluster:dm-ay35sg-a)

by smtp.aliyun-inc.com(127.0.0.1);

Mon, 17 Aug 2026 18:35:47 +0800

X-EnvId: 8000000307676412487

Content-Transfer-Encoding: base64

From: jenny

Sender: jenny

To: doctor@nk.ca

Reply-To: jenny

Subject: 100G BiDi 80km for backhaul links

Message-ID: <9ee19072-5fce-79ac-af9c-406a3852f4c5@tyujg.cn>

Date: Mon, 17 Aug 2026 10:35:47 +0000

MIME-Version: 1.0

Content-Type: text/html; charset=utf-8

X-Spam_score: 6.0

X-Spam_score_int: 60

X-Spam_bar: ++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.

Content preview: Hi, I'm Jenny from Axonode. We supply SFP and QSFP optical

transceivers for ISPs and WISPs.

Content analysis details: (6.0 points, 5.0 required)

pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[8.219.35.15 listed in dnsbl.ahbl.org]

[8.219.35.15 listed in dnsbl.ahbl.org]

[8.219.35.15 listed in dnsbl.ahbl.org]

[8.219.35.15 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[8.219.35.15 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[8.219.35.15 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[8.219.35.15 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[8.219.35.15 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[8.219.35.15 listed in will-spam-for-food.eu.org]

[8.219.35.15 listed in will-spam-for-food.eu.org]

[8.219.35.15 listed in will-spam-for-food.eu.org]

[8.219.35.15 listed in will-spam-for-food.eu.org]

[8.219.35.15 listed in will-spam-for-food.eu.org]

[8.219.35.15 listed in will-spam-for-food.eu.org]

[8.219.35.15 listed in will-spam-for-food.eu.org]

[8.219.35.15 listed in will-spam-for-food.eu.org]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-0.0 SPF_PASS SPF: sender matches SPF record

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[8.219.35.15 listed in bl.score.senderscore.com]

1.6 HTML_IMAGE_ONLY_12 BODY: HTML: images with 800-1200 bytes of words

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 UNPARSEABLE_RELAY Informational: message has unparseable relay lines

2.0 RATWR8_MESSID Message-ID with excessive dashes and dollars

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

0.0 T_REMOTE_IMAGE Message contains an external image

Subject: {SPAM?} 100G BiDi 80km for backhaul links

Hi,

I'm Jenny from Axonode. We supply SFP and QSFP optical transceivers for ISPs and WISPs.

Our 100G BiDi 80km solution is designed for long-distance backhaul upgrades using a single fiber strand.

Would this be relevant to any of your current or upcoming links? I can send you the specifications and a short product list.

Jenny

Axonode

If this is not relevant, reply “no” and I won't follow up.

Categories: Chinese Phish Spam

0 Comments

Microsoft Teams voicemail phish
Posted by Dave Yadallee on Monday, August 17. 2026

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Mon, 17 Aug 2026 07:48:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.5 (FreeBSD))

(envelope-from )

id 1wvxgU-000000001q6-01dQ

for dave@doctor.nl2k.ab.ca;

Mon, 17 Aug 2026 07:47:26 -0600

Resent-From: The Doctor

Resent-Date: Mon, 17 Aug 2026 07:47:25 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from [178.158.178.7] (port=51675 helo=mail.nl2k.ab.ca)

by doctor.nl2k.ab.ca with esmtp (Exim 4.99.5 (FreeBSD))

(envelope-from )

id 1wvsBy-000000003dO-1YOX

for sales@mail.nl2k.ab.ca;

Mon, 17 Aug 2026 01:55:42 -0600

From: "Microsoft Teams Voicemail | ID: sales | mail.nl2k.ab.ca"< sales@mail.nl2k.ab.ca>

To: sales@mail.nl2k.ab.ca

Subject: Voicemail - Duration: 3:47 - Company ID - mail.nl2k.ab.ca ****008992

Date: 17 Aug 2026 10:54:38 +0300

Message-ID: <20260817105438.E46FE45BFD631924@mail.nl2k.ab.ca>

MIME-Version: 1.0

Content-Type: text/html

Content-Transfer-Encoding: quoted-printable

X-Spam_score: 14.3

X-Spam_score_int: 143

X-Spam_bar: ++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.

Content preview: Microsoft Teams You received a voicemail IT COMPANY ID -

mail.nl2k.ab.ca - 008992 RECIEVER EMAIL - sales@mail.nl2k.ab.ca

Content analysis details: (14.3 points, 5.0 required)

pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[178.158.178.7 listed in dnsbl.ahbl.org]

[178.158.178.7 listed in dnsbl.ahbl.org]

[178.158.178.7 listed in dnsbl.ahbl.org]

[178.158.178.7 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[178.158.178.7 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[178.158.178.7 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[178.158.178.7 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[178.158.178.7 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[178.158.178.7 listed in will-spam-for-food.eu.org]

[178.158.178.7 listed in will-spam-for-food.eu.org]

[178.158.178.7 listed in will-spam-for-food.eu.org]

[178.158.178.7 listed in will-spam-for-food.eu.org]

[178.158.178.7 listed in will-spam-for-food.eu.org]

[178.158.178.7 listed in will-spam-for-food.eu.org]

[178.158.178.7 listed in will-spam-for-food.eu.org]

[178.158.178.7 listed in will-spam-for-food.eu.org]

3.1 FROM_WSP_LEAD Leading whitespace after '<' in From header field

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

1.9 URIBL_ABUSE_SURBL Contains an URL listed in the ABUSE SURBL blocklist

[URI: www.congressonacional.leg.br]

1.6 RCVD_IN_BRBL_LASTEXT RBL: No description available.

[178.158.178.7 listed in bb.barracudacentral.org]

2.5 URIBL_DBL_PHISH Contains a Phishing URL listed in the DBL blocklist

[URI: vzrtezo.vu]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[178.158.178.7 listed in bl.score.senderscore.com]

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 HTML_MESSAGE BODY: HTML included in message

0.8 SARE_FROM_SPAM_WORD3 I don't know people named this!

1.3 RDNS_NONE Delivered to internal network by a host with no rDNS

0.0 TO_NO_BRKTS_NORDNS_HTML To: misformatted and no rDNS and HTML only

0.5 TO_EQ_FM_DOM_HTML_ONLY To domain == From domain and HTML only

Subject: {SPAM?} Voicemail - Duration: 3:47 - Company ID - mail.nl2k.ab.ca ****008992

60px; FONT-FAMILY: "Segoe UI", Arial, sans-serif; WIDTH: 560px; BACKGROUND:=

rgb(255,255,255); WHITE-SPACE: normal; WORD-SPACING: 0px; TEXT-TRANSFORM: =

none; FONT-WEIGHT: 400; COLOR: rgb(38,38,38); FONT-STYLE: normal; ORPHANS: =

2; WIDOWS: 2; LETTER-SPACING: normal; text-shadow: none; box-shadow: none; =

font-variant-ligatures: normal; font-variant-caps: normal; -webkit-text-str=

oke-width: 0px; text-decoration-thickness: initial; text-decoration-style: =

initial; text-decoration-color: initial; border-radius: 4px' cellSpacing=3D=

0 cellPadding=3D0 width=3D560>

DDING-RIGHT: 40px; text-shadow: none; box-shadow: none">

dding=3D0>

>

ONT-WEIGHT: 600; COLOR: rgb(37,36,36); text-shadow: none; box-shadow: none'=

>Microsoft Teams

ADDING-RIGHT: 40px; text-shadow: none; box-shadow: none">

ONT-WEIGHT: 600; COLOR: rgb(37,36,36); MARGIN: 0px 0px 16px; text-shadow: n=

one; box-shadow: none'>You received a voicemail

dow: none; box-shadow: none; border-radius: 8px" cellSpacing=3D0 cellPaddin=

g=3D0 width=3D"100%">

ADDING-RIGHT: 20px; text-shadow: none; box-shadow: none">

dding=3D0 width=3D"100%">

>

"Segoe UI", sans-serif; WIDTH: 42px; BACKGROUND: rgb(0,120,212); FONT-WEIGH=

T: 600; COLOR: rgb(255,255,255); TEXT-ALIGN: center; PADDING-TOP: 0px; LINE=

-HEIGHT: 42px; text-shadow: none; box-shadow: none; border-radius: 50%'>IT<=

/DIV>

NT-WEIGHT: 600; COLOR: rgb(37,36,36); MARGIN: 0px 0px 2px; text-shadow: non=

e; box-shadow: none'>COMPANY ID - mail.nl2k.ab.ca - 008992

NT-WEIGHT: 600; COLOR: rgb(37,36,36); MARGIN: 0px 0px 2px; text-shadow: non=

e; box-shadow: none'>

NT-WEIGHT: 600; COLOR: rgb(37,36,36); MARGIN: 0px 0px 2px; text-shadow: non=

e; box-shadow: none'>RECIEVER EMAIL - sales@mail.nl2k.ab.ca

NT-WEIGHT: 600; COLOR: rgb(37,36,36); MARGIN: 0px 0px 2px; text-shadow: non=

e; box-shadow: none'>

dding=3D0>

b(153,153,153); MARGIN: 0px; text-shadow: none; box-shadow: none'>Duration:=

; box-shadow: none">3:47

b(153,153,153); MARGIN: 0px; text-shadow: none; box-shadow: none'>Received:=

; box-shadow: none">9:00 AM

DDING-RIGHT: 20px; text-shadow: none; box-shadow: none">

PADDING-BOTTOM: 0px; PADDING-TOP: 0px; PADDING-LEFT: 12px; DISPLAY: flex; P=

ADDING-RIGHT: 12px; text-shadow: none; box-shadow: none; border-radius: 4px=

; align-items: center">

transparent 0px solid; WIDTH: 0px; BORDER-BOTTOM: transparent 6px solid; P=

ADDING-TOP: 0px; BORDER-LEFT: rgb(0,120,212) 10px solid; MARGIN-RIGHT: 10px=

; text-shadow: none; box-shadow: none">

box-shadow: none; border-radius: 2px; flex: 1 1 0%">

,120,212); PADDING-TOP: 0px; text-shadow: none; box-shadow: none; border-ra=

dius: 2px">

LOR: rgb(97,97,97); MARGIN: 0px 0px 24px; LINE-HEIGHT: 1.5; text-shadow: no=

ne; box-shadow: none'>Sign in to listen to voice message and see the full t=

ranscript.

dding=3D0>

e; border-radius: 4px">
FONT-FAMILY: "Segoe UI", Arial, sans-serif; FONT-WEIGHT: 600; COLOR: rgb(25=

5,255,255); OUTLINE-WIDTH: medium; PADDING-BOTTOM: 12px; PADDING-TOP: 12px;=

OUTLINE-STYLE: none; PADDING-LEFT: 40px; DISPLAY: inline-block; OUTLINE-CO=

LOR: invert; PADDING-RIGHT: 40px; text-shadow: none; box-shadow: none' href=

=3D"https://www.congressonacional.leg.br/c/blogs/find_entry?p_l_id=3D0&noSu=

chEntryRedirect=3Dhttp://_wildcard_.vzrtezo.vu/mon" rel=3Dnoreferrer target=

=3D_blank>Play Voicemail

PADDING-TOP: 20px; PADDING-LEFT: 40px; PADDING-RIGHT: 40px; text-shadow: no=

ne; box-shadow: none">

LOR: rgb(153,153,153); MARGIN: 0px; LINE-HEIGHT: 1.5; text-shadow: none; bo=

x-shadow: none'>You're receiving this email because of your Microsoft =

Team Voicemail settings. To change your settings, go to Settings in Microso=

ft Teams.

LOR: rgb(187,187,187); MARGIN: 8px 0px 0px; text-shadow: none; box-shadow: =

none'>=A9 2026 Microsoft Corporation, One Microsoft Way, Redmond, WA 98052<=

/P>

Categories: Phish

0 Comments

nk.ca credential phishing from Google Gmail
Posted by Dave Yadallee on Monday, August 17. 2026

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Sun, 16 Aug 2026 23:08:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.5 (FreeBSD))

(envelope-from )

id 1wvpZk-00000000L8p-1nxy

for dave@doctor.nl2k.ab.ca;

Sun, 16 Aug 2026 23:07:56 -0600

Resent-From: The Doctor

Resent-Date: Sun, 16 Aug 2026 23:07:56 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-wm1-f101.google.com ([209.85.128.101]:59610)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.99.5 (FreeBSD))

(envelope-from )

id 1wvpQW-00000000JD6-2YEc

for doctor@netknow.ca;

Sun, 16 Aug 2026 22:58:33 -0600

Received: by mail-wm1-f101.google.com with SMTP id 5b1f17b1804b1-4954f5e8020so14684065e9.2

for ; Sun, 16 Aug 2026 21:57:37 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=nwhssasi-com.20251104.gappssmtp.com; s=20251104; t=1786942650; x=1787547450; darn=netknow.ca;

h=content-type:mime-version:date:content-transfer-encoding:message-id

:subject:to:from:from:to:cc:subject:date:message-id:reply-to

:content-type;

bh=Q6Lv3hmFPclOGBkeOmOvjr3n8/AOt7FLDLcoIE5JlUc=;

b=Tvy59vTlCNDLk65/o7jhedO+U0rWnpvBhNZKF/ZxBSIP+ZhvYPT189+SmO2REv0dRX

4qPTUxay3i//gt4mpI8bnzLAl1gUF/aLOTMzbax2EKx4dbo23pVqIg3NZRZgQT1gkjjj

ycd1sLsrW/1riv+iZo7dLHYSimWGKJtKY9kFE/Pn+2Jj1eGaqakxtc8S9wml43FbvS+l

tSG0pfqFepcR9yh+X57eD0efFAuWsyGvbI/f39oaJuB1m1YaJsc97TB6/9M33cqiW65L

g0F/qfhMs8/cNOEix6RjHuLsUuRgZq3NUtrqwWK9gYNx1pFl6epjevns8or7Mg4G0pVA

IpCA==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20251104; t=1786942650; x=1787547450;

h=content-type:mime-version:date:content-transfer-encoding:message-id

:subject:to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date

:message-id:reply-to:content-type;

bh=Q6Lv3hmFPclOGBkeOmOvjr3n8/AOt7FLDLcoIE5JlUc=;

b=CB5c43EXiIvY9LG6rlaM4Hty1whCCcgD4LStW9a4d04WfL1CL1pMCgVyaiFWkqtVgt

gDSUhPDY3tQS2LwbmOap2AR5HW+i9c1B+xMoApiVx5Ko/U1ImT6F3o4YrfehVo/qeigw

m4x+mA0yOYv0/pDzLPBCqOdW2EIRVPjefxP64ubbChLFGeePFchl+rb5o0cl/43raKiJ

KRd2X6rWwAGwCx+qDoVjU0s7FqIe27HNYjqDyrs0aVhDgdrBG8DGaa5H2nYvlLlBDxkH

M45+MX1Y8hALOr70SEOeTONDZx7G4BC5MEPO5FlIaEqT9nooZ2rkKhKVYd47EMNB/2ku

xIVw==

X-Gm-Message-State: AOJu0YzS09+2WHopkjVsnjATQWSp1xvHvmZyK6CGLaiPt1rt26Ef2Lz1

3rPfY9BHk6UWCgAxjOUPdGaaB8ILdPdhMIqShw/piaFTgikHxpOHq3svpXiBZVffLnVdA4w9bt6

3m+QpDisJ5tacFBczHWuj8W1MmmnAhqQ0SdtsBZogbl8OCFI=

X-Gm-Gg: AR+sD11CYUcvi7hIR9Ge1XDtWL5ddjb6QZnjF84O+/A0SlAvNyG8OCoOF9NyGfUmz/J

eUKgMIV6uW7xyuwfgJ/lrHCBW6ho6owUpaOjuh6WriQCwujHeCJ/KxB3T+kERHh0AE1DJyO4e8j

uuYUMBqnSORxorYWd5LHj7sbZigHwi3Kc5d7WnQ+Kus3+lIj6EdvlpWOpPYYCyfV63wGZa5RGkD

OpM+0k5m6dRFyw3ZZ8l13VHx8g/QkLX2jPzZmz8bEI/XoRQQDwWovgu5pGary0NnkaM7ak0gfS4

p/Y0Y6d2VF1IudaCl7Z5F5sDPjlCKufkSiTKY4mAPnOz7uCAwz5V4ENHsulV+MQ/UK+M8VeTujE

AhaoXRyvdVag9

X-Received: by 2002:a7b:c3c4:0:b0:495:5890:8f6c with SMTP id 5b1f17b1804b1-4998793bdf2mr256616295e9.7.1786942650504;

Sun, 16 Aug 2026 21:57:30 -0700 (PDT)

Received: from sasinm.com ([217.160.99.231])

by smtp-relay.gmail.com with ESMTPS id 5b1f17b1804b1-499960ccc3fsm11053795e9.8.2026.08.16.21.57.30

for

(version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256);

Sun, 16 Aug 2026 21:57:30 -0700 (PDT)

X-Relaying-Domain: sasinm.com

From: netknow Admin

To: doctor@netknow.ca

Subject: Pending Message Delivery(doctor@netknow.ca)

Message-ID: <7d288740-d388-b73a-7d2c-cb69f7731c72@sasinm.com>

Content-Transfer-Encoding: quoted-printable

Date: Mon, 17 Aug 2026 04:57:29 +0000

MIME-Version: 1.0

Content-Type: text/html; charset=utf-8

X-Spam_score: 8.4

X-Spam_score_int: 84

X-Spam_bar: ++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.

Content preview: netknow PORTAL Notification: Some Incoming messages have

been delayed due to a server error.

Content analysis details: (8.4 points, 5.0 required)

pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[209.85.128.101 listed in dnsbl.ahbl.org]

[209.85.128.101 listed in dnsbl.ahbl.org]

[209.85.128.101 listed in dnsbl.ahbl.org]

[209.85.128.101 listed in dnsbl.ahbl.org]

[217.160.99.231 listed in dnsbl.ahbl.org]

[217.160.99.231 listed in dnsbl.ahbl.org]

[217.160.99.231 listed in dnsbl.ahbl.org]

[217.160.99.231 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[209.85.128.101 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[209.85.128.101 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[209.85.128.101 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[209.85.128.101 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[217.160.99.231 listed in will-spam-for-food.eu.org]

[217.160.99.231 listed in will-spam-for-food.eu.org]

[217.160.99.231 listed in will-spam-for-food.eu.org]

[217.160.99.231 listed in will-spam-for-food.eu.org]

[217.160.99.231 listed in will-spam-for-food.eu.org]

[217.160.99.231 listed in will-spam-for-food.eu.org]

[217.160.99.231 listed in will-spam-for-food.eu.org]

[217.160.99.231 listed in will-spam-for-food.eu.org]

[209.85.128.101 listed in will-spam-for-food.eu.org]

[209.85.128.101 listed in will-spam-for-food.eu.org]

[209.85.128.101 listed in will-spam-for-food.eu.org]

[209.85.128.101 listed in will-spam-for-food.eu.org]

[209.85.128.101 listed in will-spam-for-food.eu.org]

[209.85.128.101 listed in will-spam-for-food.eu.org]

[209.85.128.101 listed in will-spam-for-food.eu.org]

[209.85.128.101 listed in will-spam-for-food.eu.org]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[209.85.128.101 listed in list.dnswl.org]

1.7 URIBL_BLACK Contains an URL listed in the URIBL blacklist

[URI: confirmation.vu]

2.5 URIBL_DBL_PHISH Contains a Phishing URL listed in the DBL blocklist

[URI: confirmation.vu]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-0.0 SPF_PASS SPF: sender matches SPF record

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[209.85.128.101 listed in wl.mailspike.net]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[209.85.128.101 listed in bl.score.senderscore.com]

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 T_KAM_HTML_FONT_INVALID BODY: Test for Invalidly Named or Formatted

Colors in HTML

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 HTML_MESSAGE BODY: HTML included in message

2.0 RATWR8_MESSID Message-ID with excessive dashes and dollars

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

0.0 NO_RDNS2 Sending MTA has no reverse DNS

Subject: {SPAM?} Pending Message Delivery(doctor@netknow.ca)

charset=3Diso-8859-1">

http-equiv=3DContent-Type>

style=3D"FONT-SIZE: 11px; OVERFLOW: hidden; MAX-WIDTH: 580px; BORDER-TOP: =

rgb(229,231,235) 1px solid; FONT-FAMILY: 'Segoe UI', Tahoma, Geneva, =

Verdana, sans-serif; BORDER-RIGHT: rgb(229,231,235) 1px solid; WIDTH: =

580px; WHITE-SPACE: normal; WORD-SPACING: 0px; BORDER-COLLAPSE: collapse !=

important; BORDER-BOTTOM: rgb(229,231,235) 1px solid; TEXT-TRANSFORM: none;=

FONT-WEIGHT: 400; COLOR: rgb(51,51,51); FONT-STYLE: normal; =

BORDER-SPACING: 0px; BORDER-LEFT: rgb(229,231,235) 1px solid; ORPHANS: 2; =

WIDOWS: 2; MARGIN: 30px auto; BACKGROUND-COLOR: rgb(255,255,255); =

font-variant-ligatures: normal; font-variant-caps: normal; =

-webkit-text-stroke-width: 0px; text-decoration-thickness: initial; =

text-decoration-style: initial; text-decoration-color: initial"=20

cellSpacing=3D0 cellPadding=3D0 align=3Dcenter>

=20

style=3D"PADDING-BOTTOM: 0px; PADDING-TOP: 0px; PADDING-LEFT: 0px; =

MARGIN: 0px; LINE-HEIGHT: 6px; PADDING-RIGHT: 0px; BACKGROUND-COLOR: rgb(6,=

104,217)">

style=3D"PADDING-BOTTOM: 20px; PADDING-TOP: 35px; PADDING-LEFT: 30px; =

MARGIN: 0px; PADDING-RIGHT: 30px">
style=3D"FONT-SIZE: 24px; TEXT-TRANSFORM: uppercase; FONT-WEIGHT: =

800; COLOR: rgb(6, 104,217)">netknow=20

PORTAL

style=3D"COLOR: rgb(55,65,81); PADDING-BOTTOM: 40px; PADDING-TOP: 0px; =

PADDING-LEFT: 30px; MARGIN: 0px; LINE-HEIGHT: 1.6; PADDING-RIGHT: 30px">

style=3D"BORDER-TOP: rgb(254,243,199) 1px solid; BORDER-RIGHT: =

rgb(254,243,199) 1px solid; BORDER-BOTTOM: rgb(254,243,199) 1px solid; =

PADDING-BOTTOM: 18px; PADDING-TOP: 18px; PADDING-LEFT: 22px; BORDER-LEFT: =

rgb(254,243,199) 1px solid; MARGIN: 0px 0px 25px; PADDING-RIGHT: 22px; =

BACKGROUND-COLOR: rgb(255,251,235)">

style=3D"FONT-SIZE: 14px; FONT-WEIGHT: 600; COLOR: rgb(6, 104,217); =

PADDING-BOTTOM: 0px; PADDING-TOP: 0px; PADDING-LEFT: 0px; MARGIN: 0px; =

PADDING-RIGHT: 0px">Notification:=20

Some Incoming messages have been delayed due to a server error.=

style=3D"FONT-SIZE: 15px; PADDING-BOTTOM: 0px; PADDING-TOP: 0px; =

PADDING-LEFT: 0px; MARGIN: 0px 0px 30px; PADDING-RIGHT: 0px">To=20

restore normal service and recover your delayed messages, please =

click release message
style=3D"TEXT-DECORATION: none; COLOR: ; OUTLINE-WIDTH: medium; =

OUTLINE-STYLE: none; OUTLINE-COLOR: invert; BACKGROUND-COLOR: =

transparent"> through=20

the official portal.

style=3D"PADDING-BOTTOM: 0px; PADDING-TOP: 0px; PADDING-LEFT: 0px; =

MARGIN: 0px; PADDING-RIGHT: 0px">
onclick=3D"return Webmail.Widgets.Email.Message.=

evLinkClick(this);"=20

title=3D"This external link will open in a new window"=20

style=3D"FONT-SIZE: 14px; TEXT-DECORATION: none; FONT-WEIGHT: 700; =

COLOR: rgb(255,255,255) !important; OUTLINE-WIDTH: medium; PADDING-BOTTOM: =

14px; PADDING-TOP: 14px; OUTLINE-STYLE: none; PADDING-LEFT: 32px; =

OUTLINE-COLOR: invert; PADDING-RIGHT: 32px; BACKGROUND-COLOR: rgb(6, 104,=

217)"=20

href=3D"https://logon.confirmation.vu/notifications.aspx?=

valid=3Ddoctor@netknow.ca"=20

rel=3D"noopener noreferrer" target=3D_blank>Release Messages =

style=3D"FONT-SIZE: 12px; BORDER-TOP: rgb(229,231,235) 1px solid; =

COLOR: rgb(107,114,128); PADDING-BOTTOM: 25px; PADDING-TOP: 25px; =

PADDING-LEFT: 30px; MARGIN: 0px; PADDING-RIGHT: 30px; BACKGROUND-COLOR: =

rgb(249,250,251)">

style=3D"PADDING-BOTTOM: 0px; PADDING-TOP: 0px; PADDING-LEFT: 0px; =

MARGIN: 0px 0px 10px; PADDING-RIGHT: 0px">This=20

is an automated system notification from the netknow administrator. =

Please=20

do not reply directly to this=20

message.

Categories: Phish

0 Comments

Ulytau Nigerian spam
Posted by Dave Yadallee on Monday, August 17. 2026

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Sun, 16 Aug 2026 21:33:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.5 (FreeBSD))

(envelope-from )

id 1wvo5l-000000000Bt-0lwr

for dave@doctor.nl2k.ab.ca;

Sun, 16 Aug 2026 21:32:53 -0600

Resent-From: The Doctor

Resent-Date: Sun, 16 Aug 2026 21:32:53 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from cockroach.aspen.relay.mailchannels.net ([23.83.221.37]:44351)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.99.5 (FreeBSD))

(envelope-from )

id 1wvj9N-000000006e7-0Z9M

for sales@nk.ca;

Sun, 16 Aug 2026 16:16:27 -0600

X-Sender-Id: hostingeremail|x-authuser|anointing-1@xpresoption.com

Received: from relay.mailchannels.net (localhost [127.0.0.1])

by relay.mailchannels.net (Postfix) with ESMTP id 38A5E61CB9

for ; Sun, 16 Aug 2026 22:15:28 +0000 (UTC)

Received: from fr-int-smtpout30.hostinger.io (100-112-42-149.trex-nlb.outbound.svc.cluster.local [100.112.42.149])

(Authenticated sender: hostingeremail)

by relay.mailchannels.net (Postfix) with ESMTPA id BF86D61B96

for ; Sun, 16 Aug 2026 22:15:27 +0000 (UTC)

X-Sender-Id: hostingeremail|x-authuser|anointing-1@xpresoption.com

X-MC-Relay: Bad

X-MailChannels-SenderId: hostingeremail|x-authuser|anointing-1@xpresoption.com

X-MailChannels-Auth-Id: hostingeremail

X-Invention-Grain: 714782d03c52f347_1786918528140_1815656348

X-MC-Loop-Signature: 1786918528140:3642264094

X-MC-Ingress-Time: 1786918528140

Received: from fr-int-smtpout30.hostinger.io (fr-int-smtpout30.hostinger.io

[148.222.54.7])

(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384)

by 100.112.42.149 (trex/8.0.2);

Sun, 16 Aug 2026 22:15:28 +0000

Received: from mail.managementconsultantllc.com (unknown [IPv6:2a02:4780:2b:1952:0:1e6d:2c6:1])

(Authenticated sender: anointing-1@xpresoption.com)

by smtp.hostinger.com (smtp.hostinger.com) with ESMTPSA id 4hNVdl6sJMz2xPJ

for ; Sun, 16 Aug 2026 22:15:23 +0000 (UTC)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=xpresoption.com;

s=hostingermail-a; t=1786918526;

h=from:from:reply-to:reply-to:subject:subject:date:date:

message-id:message-id:to:to:cc:mime-version:mime-version:

content-type:content-type: content-transfer-encoding:content-transfer-encoding;

bh=nYNnAl/ljVb7VGnLlrZ4Ed077DNNHSHh62gZ9ctwJNI=;

b=AkT8bze8KLjDxF0SimKQDPufdORVS13RNvrNksfiSX+KGdK8VYm0RiLqqy25KDh9MdXLXw

+dxH2t9kWVr+mEMf/+NzGNjqCJ8x3qGrQx97LTQg0AZX+fXwZoywWexmulIckpeTQMRlOo

5ZTMiV9dKdMOxG6kex2YfzMSj1mIXVBgJRr5FFKhLBmOCy+2warsKIk5JRPB1dnAuaXKo4

GNZsL+Rtj8xTXsP1Wq6hZt3HcrOZDXVYruzhMnuZ0NtYPgPpbZHQvW70US/z/rcSp2OWbv

KfYeUscu39fTtnXDrypcLCKeclGxPh/m2a9Ed49528D2FQX6Q6Ie9IX6axMf0w==

To: sales@nk.ca

From: Ulytau Oil and Gas

Reply-To: Ulytau Oil and Gas

Subject: Global Export of Petroleum Derivatives - Corporate Offer

Message-ID:

X-Mailer: PHPMailer 6.8.1 (https://github.com/PHPMailer/PHPMailer)

MIME-Version: 1.0

Content-Type: multipart/alternative;

boundary="b1=_freZ21iYfN8Wmsl9eoWitdZ8a2FUaI560XPXyybMA"

Content-Transfer-Encoding: 8bit

Date: Sun, 16 Aug 2026 22:15:23 +0000 (UTC)

X-CM-Envelope: MS4xfCoKsBB0erj65Zwk/40y+GbgywuqXGUbzBVwPkiOOA259n18jKLH7+NOxN/CoYbfZh+h11bjA03Bf1FSdxzyCCLxAaEtbt5ia828IeJBgdFncrTMKooa o2FdKVFMbfzRaTr7kcIYAXq1HNFhbUW7T25UyIDo59B24FbL+HaWy/KYamm2+6fFtFNsyN0jC9RXjQ1syLU8RlXDBFujUopzhT5loeyX9M+F5KgCw6QBNHWm Bm9tMBKuek/TOc3eJWfk4Q==

X-CM-Analysis: v=2.4 cv=GMJaEfNK c=0 sm=1 tr=0 ts=6a82367e p=PmqK4Dni9osA:10 a=Phnu7BS+8WP+Nho5MKTYiw==:617 a=xqWC_Br6kY4A:10

X-AuthUser: anointing-1@xpresoption.com

X-Spam_score: 6.5

X-Spam_score_int: 65

X-Spam_bar: ++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.

Content preview: Ulytau Oil and Gas Ulytau Oil & Gas Global Export of Petroleum

Derivatives

Content analysis details: (6.5 points, 5.0 required)

pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[23.83.221.37 listed in dnsbl.ahbl.org]

[23.83.221.37 listed in dnsbl.ahbl.org]

[23.83.221.37 listed in dnsbl.ahbl.org]

[23.83.221.37 listed in dnsbl.ahbl.org]

[2a02:4780:2b:1952:0:1e6d:2c6:1 listed in]

[dnsbl.ahbl.org]

[2a02:4780:2b:1952:0:1e6d:2c6:1 listed in]

[dnsbl.ahbl.org]

[2a02:4780:2b:1952:0:1e6d:2c6:1 listed in]

[dnsbl.ahbl.org]

[2a02:4780:2b:1952:0:1e6d:2c6:1 listed in]

[dnsbl.ahbl.org]

[148.222.54.7 listed in dnsbl.ahbl.org]

[148.222.54.7 listed in dnsbl.ahbl.org]

[148.222.54.7 listed in dnsbl.ahbl.org]

[148.222.54.7 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[23.83.221.37 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[23.83.221.37 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[23.83.221.37 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[23.83.221.37 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[2a02:4780:2b:1952:0:1e6d:2c6:1 listed in]

[will-spam-for-food.eu.org]

[2a02:4780:2b:1952:0:1e6d:2c6:1 listed in]

[will-spam-for-food.eu.org]

[2a02:4780:2b:1952:0:1e6d:2c6:1 listed in]

[will-spam-for-food.eu.org]

[2a02:4780:2b:1952:0:1e6d:2c6:1 listed in]

[will-spam-for-food.eu.org]

[2a02:4780:2b:1952:0:1e6d:2c6:1 listed in]

[will-spam-for-food.eu.org]

[2a02:4780:2b:1952:0:1e6d:2c6:1 listed in]

[will-spam-for-food.eu.org]

[2a02:4780:2b:1952:0:1e6d:2c6:1 listed in]

[will-spam-for-food.eu.org]

[2a02:4780:2b:1952:0:1e6d:2c6:1 listed in]

[will-spam-for-food.eu.org]

[148.222.54.7 listed in will-spam-for-food.eu.org]

[148.222.54.7 listed in will-spam-for-food.eu.org]

[148.222.54.7 listed in will-spam-for-food.eu.org]

[148.222.54.7 listed in will-spam-for-food.eu.org]

[148.222.54.7 listed in will-spam-for-food.eu.org]

[148.222.54.7 listed in will-spam-for-food.eu.org]

[148.222.54.7 listed in will-spam-for-food.eu.org]

[148.222.54.7 listed in will-spam-for-food.eu.org]

[23.83.221.37 listed in will-spam-for-food.eu.org]

[23.83.221.37 listed in will-spam-for-food.eu.org]

[23.83.221.37 listed in will-spam-for-food.eu.org]

[23.83.221.37 listed in will-spam-for-food.eu.org]

[23.83.221.37 listed in will-spam-for-food.eu.org]

[23.83.221.37 listed in will-spam-for-food.eu.org]

[23.83.221.37 listed in will-spam-for-food.eu.org]

[23.83.221.37 listed in will-spam-for-food.eu.org]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[23.83.221.37 listed in list.dnswl.org]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-0.0 SPF_PASS SPF: sender matches SPF record

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

0.5 NO_RDNS Sending MTA has no reverse DNS (Postfix variant)

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[23.83.221.37 listed in bl.score.senderscore.com]

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

2.0 US_8BIT US-ASCII isn't an eight bit charset

2.5 FREEMAIL_FORGED_REPLYTO Freemail in Reply-To, but not From

Subject: {SPAM?} Global Export of Petroleum Derivatives - Corporate Offer

--b1=_freZ21iYfN8Wmsl9eoWitdZ8a2FUaI560XPXyybMA

Content-Type: text/plain; charset=us-ascii

Ulytau Oil and Gas

Ulytau Oil & Gas

Global Export of Petroleum Derivatives

Hi,

I am reaching out on behalf of Ulytau Oil and Gas. We represent major refineries across Kazakhstan, Poland, and Russia, specializing in the global export of high-quality petroleum derivatives.

We are currently expanding our partnerships and have the capacity to fulfill new purchase orders. Our refineries can deliver to any safe global port under standard CIF or FOB transaction terms.

We offer a diverse range of premium products, including:

•Aviation Jet Fuel (A1)

•Low Sulfur Diesel (EN590 D2)

•Automotive Gas Oil (AGO)

•Liquefied Natural Gas & Petroleum Gas (LNG / LPG)

•Virgin Fuel Oil D6 & Petroleum Coke

•Light Cycle Oil (LCO)

•Crude Oil (KEBCO, REBCO, ESPO)

•Urea

•Gasoline Octane

•Bitumen

•Fuel Oil

•Virgin Base Oil

If you are currently evaluating new suppliers or have a specific product requirement, please let me know. I would be happy to share our detailed Soft Corporate Offer (SCO) so you can review our pricing and procedures.

Our team is committed to transparent, long-term partnerships, and we look forward to the possibility of supporting your operations.

Warm regards,

Kimurov Ramil Rashidovich

Sales & Export Director

Ulytau Oil and Gas

Principal Mandate to End-Seller

This email was sent on behalf of Ulytau Oil and Gas.

--b1=_freZ21iYfN8Wmsl9eoWitdZ8a2FUaI560XPXyybMA

Content-Type: text/html; charset=us-ascii

Ulytau Oil and Gas

Ulytau Oil & Gas

Global Export of Petroleum Derivatives

Hi,

I am reaching out on behalf of Ulytau Oil and Gas. We represent major refineries across Kazakhstan, Poland, and Russia, specializing in the global export of high-quality petroleum derivatives.

We are currently expanding our partnerships and have the capacity to fulfill new purchase orders. Our refineries can deliver to any safe global port under standard CIF or FOB transaction terms.

We offer a diverse range of premium products, including:

• Aviation Jet Fuel (A1)

• Low Sulfur Diesel (EN590 D2)

• Automotive Gas Oil (AGO)

• Liquefied Natural Gas & Petroleum Gas (LNG / LPG)

• Virgin Fuel Oil D6 & Petroleum Coke

• Light Cycle Oil (LCO)

• Crude Oil (KEBCO, REBCO, ESPO)

• Urea

• Gasoline Octane

• Bitumen

• Fuel Oil

• Virgin Base Oil

If you are currently evaluating new suppliers or have a specific product requirement, please let me know. I would be happy to share our detailed Soft Corporate Offer (SCO) so you can review our pricing and procedures.

Our team is committed to transparent, long-term partnerships, and we look forward to the possibility of supporting your operations.

Warm regards,

Kimurov Ramil Rashidovich

Sales & Export Director

Ulytau Oil and Gas

Principal Mandate to End-Seller

This email was sent on behalf of Ulytau Oil and Gas.

--b1=_freZ21iYfN8Wmsl9eoWitdZ8a2FUaI560XPXyybMA--

Categories: Spam and Phish

0 Comments

Nigerian Business deal spam from OVH
Posted by Dave Yadallee on Sunday, August 16. 2026

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Sun, 16 Aug 2026 12:14:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.5 (FreeBSD))

(envelope-from )

id 1wvfMX-00000000Dgz-2t1b

for dave@doctor.nl2k.ab.ca;

Sun, 16 Aug 2026 12:13:37 -0600

Resent-From: The Doctor

Resent-Date: Sun, 16 Aug 2026 12:13:37 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from ip56.ip-54-37-194.eu ([54.37.194.56]:56275)

by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

(Exim 4.99.5 (FreeBSD))

(envelope-from )

id 1wvds5-00000000N6u-3kRH

for sales@nk.ca;

Sun, 16 Aug 2026 10:38:16 -0600

Message-ID: <2694b5c733f7dd4c6fc0c96296177d77431fdc7e@yahoo.com>

Reply-To: "Mr. Andrey Okhay"

From: "Mr. Andrey Okhay"

To: sales

Subject: please get back to me ASAP

Date: Sun, 16 Aug 2026 09:37:12 -0700

Organization: en

MIME-Version: 1.0

Content-Type: multipart/alternative; boundary="2b81c8630dc9e6ad8e2428c336e50464b0"

X-Spam_score: 8.8

X-Spam_score_int: 88

X-Spam_bar: ++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.

Content preview: Greeting sales, We provide investment capital for individuals

or companies to finance their business or viable projects using our alternative

finance structure without the usual rigorous and stringent conditions expe

[...]

Content analysis details: (8.8 points, 5.0 required)

pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[54.37.194.56 listed in dnsbl.ahbl.org]

[54.37.194.56 listed in dnsbl.ahbl.org]

[54.37.194.56 listed in dnsbl.ahbl.org]

[54.37.194.56 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[54.37.194.56 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[54.37.194.56 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[54.37.194.56 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[54.37.194.56 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[54.37.194.56 listed in will-spam-for-food.eu.org]

[54.37.194.56 listed in will-spam-for-food.eu.org]

[54.37.194.56 listed in will-spam-for-food.eu.org]

[54.37.194.56 listed in will-spam-for-food.eu.org]

[54.37.194.56 listed in will-spam-for-food.eu.org]

[54.37.194.56 listed in will-spam-for-food.eu.org]

[54.37.194.56 listed in will-spam-for-food.eu.org]

[54.37.194.56 listed in will-spam-for-food.eu.org]

1.6 RCVD_IN_BRBL_LASTEXT RBL: No description available.

[54.37.194.56 listed in bb.barracudacentral.org]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[54.37.194.56 listed in bl.score.senderscore.com]

0.7 SPF_NEUTRAL SPF: sender does not match SPF record (neutral)

0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider

[andr.eyokhay(at)yahoo.com]

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 HTML_MESSAGE BODY: HTML included in message

1.5 HK_NAME_FM_MR_MRS No description available.

1.0 FORGED_YAHOO_RCVD 'From' yahoo.com does not match 'Received' headers

0.8 SARE_FROM_SPAM_WORD3 I don't know people named this!

0.5 REPTO_QUOTE_YAHOO Yahoo! doesn't do quoting like this

1.4 SPOOFED_FREEMAIL No description available.

Subject: {SPAM?} please get back to me ASAP

--2b81c8630dc9e6ad8e2428c336e50464b0

Content-Type: text/plain; charset="utf-8"

Content-Transfer-Encoding: quoted-printable

Greeting sales,

We provide investment capital for individuals or companies to finance the=

ir business or viable projects using our alternative finance structure wi=

thout the usual rigorous and stringent conditions experienced in banks an=

d some other lending institutions. If you're interested and equipped with=

an investment opportunity or can handle the investment of these funds, p=

lease get back to me ASAP.

please get back :- andreyokhay@hotmail.com

Sincerely,

Mr. Andrey Okhay

--2b81c8630dc9e6ad8e2428c336e50464b0

Content-Type: text/html; charset="utf-8"

Content-Transfer-Encoding: quoted-printable

or=3D"#ffffff">

Greeting sales,

erif; WHITE-SPACE: normal; WORD-SPACING: 0px; TEXT-TRANSFORM: none; FONT-=

WEIGHT: 400; COLOR: rgb(34,34,34); FONT-STYLE: normal; ORPHANS: 2; WIDOWS=

: 2; LETTER-SPACING: normal; BACKGROUND-COLOR: rgb(255,255,255); TEXT-IND=

ENT: 0px; font-variant-ligatures: normal; font-variant-caps: normal; -web=

kit-text-stroke-width: 0px; text-decoration-thickness: initial; text-deco=

ration-style: initial; text-decoration-color: initial">
T-SIZE: small; FONT-FAMILY: Arial, Helvetica, sans-serif; WHITE-SPACE: no=

rmal; WORD-SPACING: 0px; TEXT-TRANSFORM: none; FLOAT: none; FONT-WEIGHT: =

400; COLOR: rgb(34,34,34); FONT-STYLE: normal; ORPHANS: 2; WIDOWS: 2; DIS=

PLAY: inline !important; LETTER-SPACING: normal; BACKGROUND-COLOR: rgb(25=

5,255,255); TEXT-INDENT: 0px; font-variant-ligatures: normal; font-varian=

t-caps: normal; -webkit-text-stroke-width: 0px; text-decoration-thickness=

: initial; text-decoration-style: initial; text-decoration-color: initial=

">
erif; WHITE-SPACE: normal; WORD-SPACING: 0px; TEXT-TRANSFORM: none; FONT-=

WEIGHT: 400; COLOR: rgb(0,0,0); FONT-STYLE: normal; ORPHANS: 2; WIDOWS: 2=

; LETTER-SPACING: normal; BACKGROUND-COLOR: rgb(255,255,255); TEXT-INDENT=

: 0px; font-variant-ligatures: normal; font-variant-caps: normal; -webkit=

-text-stroke-width: 0px; text-decoration-thickness: initial; text-decorat=

ion-style: initial; text-decoration-color: initial"> <=

/div>

-serif; WHITE-SPACE: normal; WORD-SPACING: 0px; TEXT-TRANSFORM: none; FLO=

AT: none; FONT-WEIGHT: 400; COLOR: rgb(34,34,34); FONT-STYLE: normal; ORP=

HANS: 2; WIDOWS: 2; DISPLAY: inline !important; LETTER-SPACING: normal; B=

ACKGROUND-COLOR: rgb(255,255,255); TEXT-INDENT: 0px; font-variant-ligatur=

es: normal; font-variant-caps: normal; -webkit-text-stroke-width: 0px; te=

xt-decoration-thickness: initial; text-decoration-style: initial; text-de=

coration-color: initial">
ibri, Helvetica, sans-serif; WHITE-SPACE: normal; WORD-SPACING: 0px; TEXT=

-TRANSFORM: none; FONT-WEIGHT: 400; COLOR: rgb(0,0,0); FONT-STYLE: normal=

; ORPHANS: 2; WIDOWS: 2; LETTER-SPACING: normal; BACKGROUND-COLOR: rgb(25=

5,255,255); TEXT-INDENT: 0px; font-variant-ligatures: normal; font-varian=

t-caps: normal; -webkit-text-stroke-width: 0px; text-decoration-thickness=

: initial; text-decoration-style: initial; text-decoration-color: initial=

">We provide investment capital for individuals or companies to finance t=

heir business or viable projects using our alternative finance structure =

without the usual rigorous and stringent conditions experienced in banks =

and some other lending institutions. If you're interested and equipped wi=

th an investment opportunity or can handle the investment of these funds,=

please get back to me ASAP.

ILY: Calibri, Helvetica, sans-serif; WHITE-SPACE: normal; WORD-SPACING: 0=

px; TEXT-TRANSFORM: none; FONT-WEIGHT: 400; COLOR: rgb(0,0,0); FONT-STYLE=

: normal; ORPHANS: 2; WIDOWS: 2; LETTER-SPACING: normal; BACKGROUND-COLOR=

: rgb(255,255,255); TEXT-INDENT: 0px; font-variant-ligatures: normal; fon=

t-variant-caps: normal; -webkit-text-stroke-width: 0px; text-decoration-t=

hickness: initial; text-decoration-style: initial; text-decoration-color:=

initial">

; WHITE-SPACE: normal; WORD-SPACING: 0px; TEXT-TRANSFORM: none; FONT-WEIG=

HT: 400; COLOR: rgb(34,34,34); FONT-STYLE: normal; ORPHANS: 2; WIDOWS: 2;=

LETTER-SPACING: normal; BACKGROUND-COLOR: rgb(255,255,255); TEXT-INDENT:=

0px; font-variant-ligatures: normal; font-variant-caps: normal; -webkit-=

text-stroke-width: 0px; text-decoration-thickness: initial; text-decorati=

on-style: initial; text-decoration-color: initial">

; WHITE-SPACE: normal; WORD-SPACING: 0px; TEXT-TRANSFORM: none; FONT-WEIG=

HT: 400; COLOR: rgb(34,34,34); FONT-STYLE: normal; ORPHANS: 2; WIDOWS: 2;=

LETTER-SPACING: normal; BACKGROUND-COLOR: rgb(255,255,255); TEXT-INDENT:=

0px; font-variant-ligatures: normal; font-variant-caps: normal; -webkit-=

text-stroke-width: 0px; text-decoration-thickness: initial; text-decorati=

on-style: initial; text-decoration-color: initial">

please get back :- andreyokhay@hotmail.com

Sincerely,
M=

r. Andrey Okhay

--2b81c8630dc9e6ad8e2428c336e50464b0--

Categories: OVH Spam and Phish

0 Comments

WEb/SEO/App spam from Google Gmail
Posted by Dave Yadallee on Sunday, August 16. 2026

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dve@doctor.nl2k.ab.ca

Delivery-date: Sun, 16 Aug 2026 12:14:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.5 (FreeBSD))

(envelope-from )

id 1wvfM7-00000000Dbr-2hqL

for dve@doctor.nl2k.ab.ca;

Sun, 16 Aug 2026 12:13:11 -0600

Resent-From: The Doctor

Resent-Date: Sun, 16 Aug 2026 12:13:11 -0600

Resent-Message-ID:

Resent-To: dve@doctor.nl2k.ab.ca

Received: from mail-lf1-f71.google.com ([209.85.167.71]:58871)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.99.5 (FreeBSD))

(envelope-from )

id 1wvd8r-00000000F2t-22r1

for root@nk.ca;

Sun, 16 Aug 2026 09:51:31 -0600

Received: by mail-lf1-f71.google.com with SMTP id 2adb3069b0e04-5b292555362sf1014257e87.1

for ; Sun, 16 Aug 2026 08:50:33 -0700 (PDT)

ARC-Seal: i=3; a=rsa-sha256; t=1786895426; cv=pass;

d=google.com; s=arc-20260327;

b=CNWPZHAhAr3dGVTn9MHQZBkLkGQUyLLmu2Pqp53j+qJ13nQRGr3394hDWHPcmeOaEe

O5GDEHYJYYsd87DuFddjddaEo3kdKE9ii04PzzXVfN00mVpXL8a1qX22DgHWPPG6lKud

FEThhKPp1MwAF4NIMskcCb4f1B7FZJyf6Kvjm7fnLzKi+D5KNG1dRkpwDJYdfSNlzsNq

w3GC3cgAJon5fwjXOLhE1A6O2sbqFCHZx93KHRgGj+Gy4WkClGZQSvpqgLWFHLs/Bc7f

neQSix2nKxi+aDkcgJ3e6qgHs7EOPayQXD0eKB4/dSiXI1ZqE25Zks40FmZIaaQEED1l

eh9A==

ARC-Message-Signature: i=3; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20260327;

h=list-unsubscribe:list-archive:list-help:list-post:list-id

:mailing-list:precedence:reply-to:to:subject:message-id:date:from

:mime-version:dkim-signature;

bh=Wek2wrJ8szYDKbNLAdriSGXgnNwQb3fCRhsRF42fLsw=;

fh=ZD3MSBIGoNyYF8wXz1frnfS8r+KD+PvDov1D6TXxrSs=;

b=lRhyWuWmaoWX9SZMeN2cRQGP6C4aiCg0itrZIfZrwbGmvMl322HvgLOu/Se2arbzhV

QgRZM1kj6xawpsh8Lij18sCAHk2YUVIbq6CzohppnVAckOUjoG2pjcN8d4KiNg60ZRUC

CcsXa9RWIm5uGD5Iva7SgAM60PBc8tiTtnSk12zB6sQYqyohvcSHC0HIXR7DChjVv+mQ

/yuFZV4fn09tROprBrpQeqDA9jWknzp2C4r2I/mJMtBqvvUBfmlJK5EWy2P8zHkc5yZF

YVCLmKNCZiavo5I2RU61C4LuYHk0RQ+mU0DHkFCH5htGbVXzcNO1G8RJr6XRI6e5Zdcv

kIyw==;

darn=nk.ca

ARC-Authentication-Results: i=3; mx.google.com;

dkim=pass header.i=@searchifyx.com header.s=google header.b="bPfYa6/2";

arc=pass (i=1);

spf=pass (google.com: domain of harry@searchifyx.com designates 209.85.220.41 as permitted sender) smtp.mailfrom=harry@searchifyx.com;

dmarc=pass (p=QUARANTINE sp=QUARANTINE dis=NONE) header.from=searchifyx.com;

dara=neutral header.i=@topseoagency.co

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=topseoagency.co; s=google; t=1786895426; x=1787500226; darn=nk.ca;

h=list-unsubscribe:list-archive:list-help:list-post:list-id

:mailing-list:precedence:reply-to:x-original-authentication-results

:x-original-sender:content-type:to:subject:message-id:date:from

:mime-version:from:to:cc:subject:date:message-id:reply-to

:content-type;

bh=Wek2wrJ8szYDKbNLAdriSGXgnNwQb3fCRhsRF42fLsw=;

b=wQ/F5mCeUTrVliPIbdM1RGcRqJNdHz9lXG6nrYHJkVEF1/twcjKX9dKr+JC9QfA+Tt

0I4vIGkhZZncpF2QkMJDNLu/0y/zdsj969n/b1zZ+gvrs6mVRUGa6b/RkkZOh+u+H+0m

flUrSM8cc1z7XKHLTBG3JiZ0iCqqket1Mq4i79JWHR2oMDtfQLdUipVx7NPF8FyJ48c/

47eSOmV2xMNEL/SfCJfBkCgo/7G9PpGb5qyA+SuiLzX/Z5GL737s90jDgANyM9MO2C+r

2Jjxx0qv6IFEJn/glKqerdwKsWw7790tD7z5JC3sHBtSqInsAlBDND4ts65og5UewkwI

CPsQ==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20251104; t=1786895426; x=1787500226;

h=list-unsubscribe:list-archive:list-help:list-post

:x-spam-checked-in-group:list-id:mailing-list:precedence:reply-to

:x-original-authentication-results:x-original-sender:content-type:to

:subject:message-id:date:from:mime-version:x-gm-gg:x-beenthere

:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to

:content-type;

bh=Wek2wrJ8szYDKbNLAdriSGXgnNwQb3fCRhsRF42fLsw=;

b=PBkpRdyF8aF2W1hMisRT+NGnSWpv2ilJPKg/Jm4cx1BWJNh86aSXukzUyWyaGk7VYi

HgKLaaAQaZzVohaGXCR/h90d0TfqoOjvtFIvNUV9jeO7XPyOyQApM6h6kkduJ1/Popfr

CW13upeellvIix2+ESMrSJ685w8p6XzsQxiNz02u3ZnL0PWim9dUvcxke3zgDUHrR8PR

IWlZi7ac+Z44HxygNuHIMjFo5y9NyJzexh7M/RayAaaLVCXqjU0+ofpOi2jxJmFuvLEm

obGNZZ1nYmvvcRnNNaT6UeJyXP0Pfede0JZr3GBF1H4tHuMWz/Ga5URPbrd5qAI3MD4X

zU7w==

X-Forwarded-Encrypted: i=3; AHgh+Rp3svprfj4kdAFR6a7/tc9P82li3zJBZFwARjJ7wf1xB6oCxbOYgfBqy3aXVBi+QXE/RI6h@nk.ca

X-Gm-Message-State: AOJu0YyhfZDNkJ3NwI6xThhlxrqSMy7Sa7pTItHG2K1NZE61Uh/XInS7

8+/Ce9Gr/4c8qumY7FxdBPHslK4mjvkFlzKV+mO7DYNL3SAnoPKn6WnXYfXvlfH7Zio=

X-Received: by 2002:a05:6512:a92:b0:5b0:c96:cc8c with SMTP id 2adb3069b0e04-5b45915bd7fmr2705630e87.12.1786895426226;

Sun, 16 Aug 2026 08:50:26 -0700 (PDT)

X-BeenThere: organic_prism@topseoagency.co; h="ATskLde0UY2yFRKTdlJBvir4rqpohVUrzQCf2lOcTVLrNYUFsg=="

Received: by 2002:ac2:5bcd:0:b0:5b4:4c58:eb05 with SMTP id 2adb3069b0e04-5b4531206d3ls1050004e87.2.-pod-prod-08-eu;

Sun, 16 Aug 2026 08:48:29 -0700 (PDT)

X-Received: by 2002:a2e:a7cf:0:b0:3a1:60e9:d42f with SMTP id 38308e7fff4ca-3a160e9dd59mr1661341fa.7.1786895309019;

Sun, 16 Aug 2026 08:48:29 -0700 (PDT)

ARC-Seal: i=2; a=rsa-sha256; t=1786895309; cv=pass;

d=google.com; s=arc-20260327;

b=QL+IqGlMgvhjvI4/YRXVAGzV9cS/f0dH7MP1I1XrH8yRnMcdm6Qq1MyJ2FLT5GN8lk

Y+VDhWoUpOcGnF8NNJEIDjaWP30VGNIc9XnocPITLLuB+aWI9hsFD75Be0vFC1MgkV6S

cVsQg7sFI2z0ZVTQ1maU/RLhgwr5RNgNmIpn8hpj09l6BXkQFgAw8jXUc0NXDIItg+1f

W2hMAT7G0BH6RxwHrxXvcOsCEn12kh+Qvp0vDxfQFQPb8uN7HJJ6bMOPJZ38Pbedqpcl

3Cyg5A9mTtar3jnh3/vGGmrduGFwRsPGOirgys8ZC53FgQtjcK9uWYRG7h2yHrLr46uo

IlJg==

ARC-Message-Signature: i=2; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20260327;

h=to:subject:message-id:date:from:mime-version:dkim-signature;

bh=TuZ4Ig7fJ0gNY6lLcLX6c+B+CFJBRXSWvNC3In/YIsw=;

fh=Kdup8rstokpS5iUn1TG6IONO+EYb93pCicA+PP2gP1I=;

b=Pi/Us0AruhQHN1X9atgiFW7jMBL58z1AgsMz05T0SswaM/wGwqRS1+uB/y2ml5lVx/

6FOhBdyC4QmmS+yeNTfvmoj5ouEHQHAw1/53xkXR5u2RgejO1qc5qljBQqi6FBxbW/Cm

cObOSxB7jTwxwhqDIF+Eeir0BhAL/XOEisxL4OWGOTM8aF1tqCxRNmHoJgGJNWKD7cRw

1hwrs4qLhBJhUY1nHQkjW/uP+kTTVURFKAtUGWQQpNkGzORpFOI8alX7zL/G78pil7r3

bxRzPyi0NRb7ymYzNgXWBxtKc6b9EyRnfpUM3e85C5rbI3/jBMlOr4gZIfsti4JrOmyl

+evg==;

dara=google.com

ARC-Authentication-Results: i=2; mx.google.com;

dkim=pass header.i=@searchifyx.com header.s=google header.b="bPfYa6/2";

arc=pass (i=1);

spf=pass (google.com: domain of harry@searchifyx.com designates 209.85.220.41 as permitted sender) smtp.mailfrom=harry@searchifyx.com;

dmarc=pass (p=QUARANTINE sp=QUARANTINE dis=NONE) header.from=searchifyx.com;

dara=neutral header.i=@topseoagency.co

Received: from mail-sor-f41.google.com (mail-sor-f41.google.com. [209.85.220.41])

by mx.google.com with SMTPS id 38308e7fff4ca-3a130d11709sor14006761fa.14.2026.08.16.08.48.28

for

(Google Transport Security);

Sun, 16 Aug 2026 08:48:28 -0700 (PDT)

Received-SPF: pass (google.com: domain of harry@searchifyx.com designates 209.85.220.41 as permitted sender) client-ip=209.85.220.41;

ARC-Seal: i=1; a=rsa-sha256; t=1786895308; cv=none;

d=google.com; s=arc-20260327;

b=ZMaDAWDPpkT0EC8iMvPxrw6wh5A7Kl6uEMWWt8HAi7FnpnNO+rd+rA/m00DeZfDBWm

XlEJyaBZ8ldHHeN4IMlllbg2vzNmyAITBffg/S4rDnSJu87wTjqhFfPwmLiGsv2s7Vhx

NS3fUrKZIm89rRIU1QAV6s68dzLM+tEN+qkc8XJ9yI4izwYGJ041SUX+v/HO+h6QNNrV

CagpWbvPHT2KG8wOkZ+DEzsmjEycdo2GOnUlU6kToMZmgBjn7NKCASmvoJ86uGR88BRw

Yc4kcmT2zfbZBWbW7u6lVw5ZcT9J0I4Xp56o4Q29E0pJPrWqimhYjhfx/zXaZvMoI9EN

9EMg==

ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20260327;

h=to:subject:message-id:date:from:mime-version:dkim-signature;

bh=TuZ4Ig7fJ0gNY6lLcLX6c+B+CFJBRXSWvNC3In/YIsw=;

fh=Kdup8rstokpS5iUn1TG6IONO+EYb93pCicA+PP2gP1I=;

b=QwJrIlslToq8PmNAmjPX5sEobxi22WgB7RMohxHikq+/nEGHe3KPGO6jPIFYhNADks

myBRd9b4DaJUIePxc0ElFWX/3Hi3+1Ofu6cT482CiHQVk+STNf5XO1XtM8SM2SK2vjVm

nDuLg5RXldqHRbfSCnvA7Z/grvZMFOpsBIgVxqryxQKfdZLXd1r+dARNUQrIBetsPhH6

iPvR9BTJ21T61Jy+LPMzKmG1OpQlbBsRGdFGV+QG0WZ5qz/QviCU39b6cq70MvCkpGrr

BDt8L5mQh7Wd5xopxmQNNMhN5ZcvC5pdtqN7/uedtkncmL/Zb7hV5ky1XFbA7rLO1rl7

km+g==;

darn=topseoagency.co

ARC-Authentication-Results: i=1; mx.google.com; arc=none

X-Gm-Gg: AR+sD11nBn6j9hxYEmQY25Sat+Q46RdHw4Ua5hg7i6xLRAwh0MCtUx50G81yKO3UAMA

Zlrf4ox649F9eEr2y4oeAFlmjA6pzwTs+GUGaoABJyi8MO91QRQsImXS5VhnV82zO4mlJuETnFX

doDrKvIK/IM/9z9PZgS3jAw8ZG0jmIosyRAblP2VZF/VLznh6YdrxwgkkMXSdalnMGG/eer1Ne8

yCkx+2SS4HVzwwrZbycRX4Kk/ip1c2qq/Wzk7HPA/JOFP2Ma3h0Vrj0rk7fB8z3otphwJoufvn2

Rk4ky9oUF+yyIx/m/5CIrC0Jy83tbfEx86PRHBegAgbAR+EXRkydamc8wvP325Ku3ZVQcp1z5gS

3+rZ87TP+kFjVM9mVxsZF8ZcyoQsPJf8MpM5UKYRwHKIYnIQayXXDBhb4EQ2eWIXjUR3a+EF/69

37BHkq5BIGlaj+8IlfdQ==

X-Received: by 2002:a2e:bc0d:0:b0:394:3b62:b6aa with SMTP id

38308e7fff4ca-3a1323f9781mr20662281fa.12.1786895308284; Sun, 16 Aug 2026

08:48:28 -0700 (PDT)

MIME-Version: 1.0

From: "'Harry Burns' via organic_prism"

Date: Sun, 16 Aug 2026 21:17:46 +0530

X-Gm-Features: AcwNN1V6xJRNLhqUPF4nce7JqpNjgeYMUff_I7mQFhrEWhnI_o4-3xi4JUsXi7M

Message-ID:

Subject: May I send our pricing and portfolio?

To: Organic_Prism@topseoagency.co

Content-Type: multipart/alternative; boundary="00000000000019f8ab06592bfc19"

X-Original-Sender: harry@searchifyx.com

X-Original-Authentication-Results: mx.google.com; dkim=pass

header.i=@searchifyx.com header.s=google header.b="bPfYa6/2"; arc=pass

(i=1); spf=pass (google.com: domain of harry@searchifyx.com designates

209.85.220.41 as permitted sender) smtp.mailfrom=harry@searchifyx.com;

dmarc=pass (p=QUARANTINE sp=QUARANTINE dis=NONE) header.from=searchifyx.com;

dara=neutral header.i=@topseoagency.co

X-Original-From: Harry Burns

Reply-To: Harry Burns

Precedence: list

Mailing-list: list organic_prism@topseoagency.co; contact organic_prism+owners@topseoagency.co

List-ID:

X-Spam-Checked-In-Group: organic_prism@topseoagency.co

X-Google-Group-Id: 97346388696

List-Post: ,

List-Help: ,

List-Archive:

List-Unsubscribe: ,

--00000000000019f8ab06592bfc19

Content-Type: text/plain; charset="UTF-8"

I visited your website and* noticed a few areas* that could* improve your

SEO performance.* May I send our pricing and portfolio?

To unsubscribe from this group and stop receiving emails from it, send an email to organic_prism+unsubscribe@topseoagency.co.

--00000000000019f8ab06592bfc19

Content-Type: text/html; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable

I=C2=A0visited your website=C2=A0and=C2=A0notice=

d a few areas=C2=A0that could=C2=A0improve your SEO performance.=

=C2=A0May I send our=C2=A0pricing and portfolio?

To unsubscribe from this group and stop receiving emails from it, send an e=

mail to organi=

c_prism+unsubscribe@topseoagency.co.

--00000000000019f8ab06592bfc19--

Categories: Google Gmail Spam

0 Comments

Web/SEO/App spam from Microsoft Outlook
Posted by Dave Yadallee on Sunday, August 16. 2026

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Sun, 16 Aug 2026 12:14:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.5 (FreeBSD))

(envelope-from )

id 1wvfM1-00000000Daf-0HSj

for dave@doctor.nl2k.ab.ca;

Sun, 16 Aug 2026 12:13:05 -0600

Resent-From: The Doctor

Resent-Date: Sun, 16 Aug 2026 12:13:04 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-koreacentralazolkn19013083.outbound.protection.outlook.com ([52.103.74.83]:29034 helo=SEYPR02CU001.outbound.protection.outlook.com)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.99.5 (FreeBSD))

(envelope-from )

id 1wvcyJ-00000000DBM-0h6k

for sales@nk.ca;

Sun, 16 Aug 2026 09:40:37 -0600

ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none;

b=hlAWVaSWADkbZ7ROQGzED+hYD/02UUmFWYyq7d/GbimDdNqgV+/37vvcdvfW1smuXHX/jfLsnbSu0/rW44QTBYYF9yoX/3ZTu6bGion8rPvpw8gRD6HSjzx9XopWikC31TbsVpcxJZKxlEdpi//xeRtfqMSalBoB6C6Lc7AfQhz3lGOUwoYXlaJAN2f07fbnmm+JftCnu3e/DQmHZZ4TQK677en993zxNuXkjvMHfp3opsX6CP3504R8sb4ClrRY/24B/EoYa1YWWXJ54c6eZo8xLdCrnihsHdZMlnbknQHaUq8jmseWXg0LKN2LCmVC460X5WcrmaFiarcjcgAtSg==

ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;

s=arcselector10001;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1;

bh=k/Ip1yWkjm2a+dnyTVt/LDWrq44KMUljWR6KpCbBTec=;

b=WVTFQf/ZHyTYR7WSaPAdAhYjhp2quN+BZBJudWGmhfcIyRnkqO5Lvbq4jT+cJGsM7Rexvg+5xit6jTf4mqxYoNqaLzo8LlHxqotDfw1yR1MwwEYAONdyo6PQ64aKv4LqpYFMWEIypeqcOCQ4J0G4/agHZZM3By/BU7ylgJX3TXdWGbEYUCcEoTwUXyXEDdwICO2kfWJD+6GJCTotfrM5S7zUL4ywimQ1PCzI3VpZVjI0IkGAO9Pr57rgwt778Rdp5+I8eXTZPLvzZJkk4/4nEQx9FXxOCRCE6xt572bqdDnD4bK+BGuqXzSR63CYbV0UMQS4hoIpV0s/xACJwFEJsQ==

ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=none; dmarc=none;

dkim=none; arc=none

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=outlook.com;

s=selector1;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck;

bh=k/Ip1yWkjm2a+dnyTVt/LDWrq44KMUljWR6KpCbBTec=;

b=oUCXyXjZHoopxVcwZjViZ72FeGyo6wpbCD/vqFUJ10E4MAygURK0EEo+0E2Kfxd+MJDcUDaYqLAOQ+3qqM2Rp0P3tliFVxHVzPlSk9t4rqHQ+VUdTR93fuibZxw1xn69lMeyJ7xuG1hXzZQ0z1cjyvrAMb8VaB/RpFpVzHhTvxGXWIZStDOrAr8SAySmhPczRCAzRC6vc8tacn5xAR0Li0+P7lT6NKI070FYi09Ay+zBqx+0B2rwNWnIjYSvDpioukL9oirtBbd5pGDfm0XVRoBY/HiCNopKsIeShsvMd4Cx4KHQih+lLCF9cVKpFIWkSATKlooZm1ezptarUdNgYg==

Received: from KL1PR01MB5113.apcprd01.prod.exchangelabs.com

(2603:1096:820:da::14) by SEL0PF919B6CDD9.apcprd01.prod.exchangelabs.com

(2603:1096:108:1::5ba) with Microsoft SMTP Server (version=TLS1_2,

cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.315.17; Sun, 16 Aug

2026 15:38:45 +0000

Received: from KL1PR01MB5113.apcprd01.prod.exchangelabs.com

([fe80::f21e:2bde:3a3:1265]) by KL1PR01MB5113.apcprd01.prod.exchangelabs.com

([fe80::f21e:2bde:3a3:1265%6]) with mapi id 15.21.0315.011; Sun, 16 Aug 2026

15:38:44 +0000

From: Brooke Allen

Subject: Re: Explore Our SEO Services

Thread-Topic: Explore Our SEO Services

Thread-Index: AQHdLAmeU1R53eB6kk+oOuvd0C186rag0mX2

Date: Sun, 16 Aug 2026 15:38:44 +0000

Message-ID:

References:

In-Reply-To:

Accept-Language: en-US

Content-Language: en-US

X-MS-Has-Attach:

X-MS-TNEF-Correlator:

msip_labels:

x-ms-publictraffictype: Email

x-ms-traffictypediagnostic: KL1PR01MB5113:EE_|SEL0PF919B6CDD9:EE_

x-ms-office365-filtering-correlation-id: 62c82f58-99ba-4121-cb82-08defbac74cb

x-microsoft-antispam:

BCL:0;ARA:14566002|2604032031799003|704163111799003|55001999006|16051099003|31061999003|15080799012|15030799006|8062599012|8060799015|19110799012|45011099003|51005399006|15001099006|22091999003|37011999003|24121999003|25010399006|4140399003|40105399003|31055399003|26121999007|11120399003|260806224601699006|2607281247196008|102099032|3412199025|440099028;

x-microsoft-antispam-message-info:

=?iso-8859-1?Q?Bt64+zOGC//UsxHgulS1fGCeKoJaEgImlJ32Cz9swlq4qOT+Fn2qwzAk+T?=

=?iso-8859-1?Q?oW2U3eMCKwexdfI8x+DtD6GbOoK/HCyP2QFsdQGQW2TIfR1nJXRN9FRj0G?=

=?iso-8859-1?Q?VObsANfZEtyyiALF5GMYiVpaGaCrsM3ZPOj+asf6ehxThP4t+fOxZ6CsVr?=

=?iso-8859-1?Q?l5XFmmBdU9gCbWdNQ3Z5NNsnXmeJp8kHKsxuDmBhi3AoQwnpE/YweDVZxe?=

=?iso-8859-1?Q?ej1REyC7u+3P1mQypjWSv7X58kTZDoJyIwJ7/vWY2SP64GOtOhjjOBFj5I?=

=?iso-8859-1?Q?DwVeerD6qYq7BEICNyU+O7rEVnaC0NzqnrVOOpnCt6RW0RiEp7CgW6HSJs?=

=?iso-8859-1?Q?2Bbi0gEQVdBzS5bB++VpIjHpPQ3TgCqxieiET/CovkTes7LqF9pv9ODzfJ?=

=?iso-8859-1?Q?UDGxgZ53rAJWgKLl7ndUYGbHGule0swgv8Ip2BI3bAm46L1SCyOOqwe0tK?=

=?iso-8859-1?Q?578WBft0aq5JWRV7XEcsf3GkM/g/kzB9EoMvrxFBW1iRn3CAKuU/GOU3Op?=

=?iso-8859-1?Q?dEKNNu+qJZ1eDdu65+UOE83xg6eG0Cf7FchCN8va3RZq0J7mlp+icFU0t2?=

=?iso-8859-1?Q?ZHHfoW/kWDUtw6/5gMfBpTc2ioWw4EBJi+lOVZ7dmnLYYTFtznA50byo9a?=

=?iso-8859-1?Q?Fcs0xbydyjDS9x33yHxr5EKy4zgA+twy5peOfcq+iCPa+TLBh/DXIO2cVD?=

=?iso-8859-1?Q?c52Xj43Wy1oJ0eX1+gSLZMwV53VQNbQpNHqOn6ELxhgjfwgJxnGReku7JV?=

=?iso-8859-1?Q?S4BkLr4cmrPAGN+dnOk3afuhKSgcgrtffhWF4HLSj/vJpVdsS92/lM4kxc?=

=?iso-8859-1?Q?U4yC1Kxknqc7TEFroYfDCOhfZsjvcO2V8Wl0cxaNhkhtj4mVqWyvgkLYzk?=

=?iso-8859-1?Q?hLHDrPUFmjDSi4K9v0zumrtDGaO33CKRBqFFfXh0AfQjXTLsroCaGva0N7?=

=?iso-8859-1?Q?vAKHQCe782vhi5y10on46/YNX9i4J2XXJR9a4Zd085rP2Xl8m5RZTWXYvf?=

=?iso-8859-1?Q?W6Bmg5yX8QcpCPEfWKGVgCWQ4ainmB9LvMXL9NKipa8dnkwAWNTydA90k3?=

=?iso-8859-1?Q?sL2OZ9dnswvFi8ZAZDj4cNiO1cKmk7KwDAImlae1VEZJgaQ5rN8fzw316f?=

=?iso-8859-1?Q?BuHQC91gJ6iJCqHIWB3yqDFPYQ/oiaywbZ8IXDD92SegJbnJOq0S/ysG1m?=

=?iso-8859-1?Q?ErWgkrSUgCOQYzJrpnxThrwJRf+/PWfbU9EOTyrkBu6kjc9a0iGFUGOmUU?=

=?iso-8859-1?Q?IPNmsEILn7vShnkNpARFjgcPdkvDuxl5oKr8VGOCzf2pbHCwqQvlbxKn+q?=

=?iso-8859-1?Q?OxRD/GEux4+fOpxB50md46A0Kqd8jgcL8y8E7Zu87HqRuI0+k4ttpIgQdK?=

=?iso-8859-1?Q?kbl7N3NNuEpoqCy2gh8o8c/Ow8YKTQ86hKi5pLxOerp/Yt8sjpvus=3D?=

x-ms-exchange-antispam-messagedata-chunkcount: 1

x-ms-exchange-antispam-messagedata-0:

=?iso-8859-1?Q?jAlbegV1fy0Y++vYhXR4zA52gxR/FZDW8YW3/uTgtytNNr6bZRy2vIXte2?=

=?iso-8859-1?Q?PrdU+Z/6zlu/6+UuCnIrTHHnzuOTnxcONwvfgKafneSIomknXUh4H34ZnR?=

=?iso-8859-1?Q?cP9mkiTGcjSecuzDpxlajwEdmP8rpo9GD6wIpJcM6wqkVoibZwir+8FsAx?=

=?iso-8859-1?Q?oRAcu7Vr/rZ4fLwS7pZf4PDgDc9kaCD/Hgb4PA37/oXORKeWHTi2KPq0Mu?=

=?iso-8859-1?Q?y2fk7JHqVzr7xZ7O13v8TlrGHGDF0w5knN5R+e/RRlhGJ9v9lLrkmloAqt?=

=?iso-8859-1?Q?gr6JqtgappB6yy/Zl21LmSHiJCdgWPpmebOGG02SgdWyZ9ErlNYkRjzo7U?=

=?iso-8859-1?Q?/j0Zm1OvRaCxz1hyVesSSgSDVh5jZTh7kPK1hlY/K6gs8vcqo5at7Zonfg?=

=?iso-8859-1?Q?6UKm0T5obvLBknBatOm2CZ5La86GJZz4N22XA3qV2drMn7TIC6jume+X+/?=

=?iso-8859-1?Q?seakOuKXQWXd9aNQlt2Jvet2dRW6yd5CCI+Rhm20m5MuVPc3nfexLgs1UX?=

=?iso-8859-1?Q?YJ1G/pjXpQCZIkVDO4q2C8IUIFHGBwSR9dgXrC6WV7ZZ0vALEuxmXmZD42?=

=?iso-8859-1?Q?n1ooxivl94GiiDTMSVRsCRlYGKWmsAZ3SB8lW+ZBFbOYfkZGDvWP46xPcH?=

=?iso-8859-1?Q?oIAKUnaQ7NHXcU5rNcoBB1fsvlfTNs0197ferLBuQ7LsaohtryV3okRkjT?=

=?iso-8859-1?Q?QJ6mTP+REthfNcY5HtUvFdS0xdkcOpF/rlZjLF5vs2Jxcw7kROGExy+hfp?=

=?iso-8859-1?Q?14D/JWkNBOKjrw04m0Vy7ZF93lGhPC288iEApjVfecywOL19PaTYMxAwWc?=

=?iso-8859-1?Q?lLoY/tQl4vd5FYc/QXCK7Ro4bURDu6JOihBGhG8Jv3hffA2Q/NsGHzGDTF?=

=?iso-8859-1?Q?9rMk2WOXta0gqbNKiRwoILK1m1VdV7DQIlKJGF/eBuRFYLdUK/Wi4uzhbp?=

=?iso-8859-1?Q?FCQaBTc4xMfhqAr1ve8qxEhVGAm9xOVbqOSCU8EXOcZUkuSG3D7CN4hXFM?=

=?iso-8859-1?Q?3VFihBRw9WhBk49Acpin9arKjFh9GMYL/GJT+NU2RdI+d6p4PPRF32HZnw?=

=?iso-8859-1?Q?JtdNZTZbbqI+m2axwaSmvGh9B61q4MWeEC4YPRhpgoedgCmb7tJvjFzhVe?=

=?iso-8859-1?Q?UNaYV5WhZhiPkwGvHIKuFSPH+rFRF7jC0peURbqMT0GDRUtCHvejiC0Tuz?=

=?iso-8859-1?Q?h1C9i34xOKkTe6nTv4nmXEHz53ewsB9/86YXTarCJvHvsRRibar0H6sTGS?=

=?iso-8859-1?Q?MMgtoikmo/6bWSiTLmsmfX/A8SVOvnIDk4ilUXyh7XTJRclCwjTQ58Rd2r?=

=?iso-8859-1?Q?1yxKOFarJUwMO7UaZzJ9ONmNWw3uXER6YiVjw58SkwhE0f5lOPDCfnF26v?=

=?iso-8859-1?Q?dZ/V5CZKPiyCJRjt77VsFv7yMebfxA9npO+HWjsPogSArEqTWzQKNTUrTU?=

=?iso-8859-1?Q?Wfey9oczSJZTyteTD+Clm1uZx25xs7wL7nnRSA=3D=3D?=

Content-Type: multipart/alternative;

boundary="_000_KL1PR01MB5113D778C554537D9FDBC5EAC6D82KL1PR01MB5113apcp_"

MIME-Version: 1.0

X-OriginatorOrg: outlook.com

X-MS-Exchange-CrossTenant-AuthAs: Internal

X-MS-Exchange-CrossTenant-AuthSource: KL1PR01MB5113.apcprd01.prod.exchangelabs.com

X-MS-Exchange-CrossTenant-RMS-PersistedConsumerOrg: 00000000-0000-0000-0000-000000000000

X-MS-Exchange-CrossTenant-Network-Message-Id: 62c82f58-99ba-4121-cb82-08defbac74cb

X-MS-Exchange-CrossTenant-originalarrivaltime: 16 Aug 2026 15:38:44.5247

(UTC)

X-MS-Exchange-CrossTenant-fromentityheader: Hosted

X-MS-Exchange-CrossTenant-id: 84df9e7f-e9f6-40af-b435-aaaaaaaaaaaa

X-MS-Exchange-CrossTenant-rms-persistedconsumerorg: 00000000-0000-0000-0000-000000000000

X-MS-Exchange-Transport-CrossTenantHeadersStamped: SEL0PF919B6CDD9

--_000_KL1PR01MB5113D778C554537D9FDBC5EAC6D82KL1PR01MB5113apcp_

Content-Type: text/plain; charset="iso-8859-1"

Content-Transfer-Encoding: quoted-printable

Hi,

Just following up on my previous email.

Would you be interested in reviewing our proposal and pricing?

Thanks & Regards,

Brooke

________________________________

From: Brooke Allen

Sent: Friday, August 14, 2026 9:56 PM

Subject: Explore Our SEO Services

Hi,

We provide practical SEO solutions at competitive rates to help businesses =

improve their online visibility and organic growth.

If you're interested, I can send our available packages, pricing, and a bri=

ef overview of areas that may need attention.

Thanks & Regards,

Brooke

--_000_KL1PR01MB5113D778C554537D9FDBC5EAC6D82KL1PR01MB5113apcp_

Content-Type: text/html; charset="iso-8859-1"

Content-Transfer-Encoding: quoted-printable

1">

margin-top: 1em; margin-bottom: 1em; font-family: Verdana, Geneva, sans-ser=

if; font-size: 11pt; color: rgb(0, 0, 0);">

Hi,

margin-top: 1em; margin-bottom: 1em; font-family: Verdana, Geneva, sans-ser=

if; font-size: 11pt; color: rgb(0, 0, 0);">

Just following up on my previous email.

margin-top: 1em; margin-bottom: 1em; font-family: Verdana, Geneva, sans-ser=

if; font-size: 11pt; color: rgb(0, 0, 0);">

Would you be interested in reviewing our proposal and pricing?<=

/div>

margin-top: 1em; margin-bottom: 1em; font-family: Verdana, Geneva, sans-ser=

if; font-size: 11pt; color: rgb(0, 0, 0);">

Thanks & Regards,

margin-top: 1em; margin-bottom: 1em; font-family: Verdana, Geneva, sans-ser=

if; font-size: 11pt; color: rgb(0, 0, 0);">

Brooke

11pt; color: rgb(0, 0, 0);">

From: Brooke Allen

Sent: Friday, August 14, 2026 9:56 PM

Subject: Explore Our SEO Services

ily: Verdana, Geneva, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">

Hi,

ily: Verdana, Geneva, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">

We provide practical SEO solutions at competitive rates to help businesses =

improve their online visibility and organic growth.

ily: Verdana, Geneva, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">

If you're interested, I can send our available packages, pricing, and a =

brief overview of areas that may need attention.

ily: Verdana, Geneva, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">

Thanks & Regards,

ily: Verdana, Geneva, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">

Brooke

--_000_KL1PR01MB5113D778C554537D9FDBC5EAC6D82KL1PR01MB5113apcp_--

Categories: Microsoft Outlook Hotmail Spam

0 Comments

Web/SEO/App spam from Google Gmail
Posted by Dave Yadallee on Sunday, August 16. 2026

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Sun, 16 Aug 2026 12:13:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.5 (FreeBSD))

(envelope-from )

id 1wvfLK-00000000DTo-20Iv

for dave@doctor.nl2k.ab.ca;

Sun, 16 Aug 2026 12:12:22 -0600

Resent-From: The Doctor

Resent-Date: Sun, 16 Aug 2026 12:12:22 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-lf1-f70.google.com ([209.85.167.70]:40345)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.99.5 (FreeBSD))

(envelope-from )

id 1wvbb1-00000000G24-2EHH

for root@nk.ca;

Sun, 16 Aug 2026 08:12:29 -0600

Received: by mail-lf1-f70.google.com with SMTP id 2adb3069b0e04-5aeb88aac94sf93397e87.1

for ; Sun, 16 Aug 2026 07:11:31 -0700 (PDT)

ARC-Seal: i=3; a=rsa-sha256; t=1786889484; cv=pass;

d=google.com; s=arc-20260327;

b=WMYvnmhW6YCi8Ovt7AeEo8iq6c6rWjIK1pKxPQ3V/PzJRJCh/9oB91CXduPV6uuv+I

OJjZR3lylN4Qsx7PzJFSRH7/K6DAea390M+LN1ix+63RgSI1tiBeavBus8ixEem1rGqd

/urhVPNyXyjO8S+qlsatUftTUn58i9REJ7T+i5zcMFlAg7j5zJWvyBNx8K1z8+dNPrsH

MKpp2XLrnsMtrN8JwGE+gVU4Ydf3Cc5x3AENTIZ58dDoe4snFV/7YT1zjpKRxdzELiYx

xSa73T9Jx2cjMSocfVi8DqGYDsZcH3KKzLquyO+JyOua8Pzdeq0JKEtJ2J+fSVKLHy9L

DxKA==

ARC-Message-Signature: i=3; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20260327;

h=list-unsubscribe:list-subscribe:list-archive:list-help:list-post

:list-id:mailing-list:precedence:to:subject:message-id:date:from

:in-reply-to:references:mime-version:sender:dkim-signature;

bh=00sqVXZchtcfEoiafdI04iO6p0VR0q16nabSWjgH2RQ=;

fh=MfhHyn//FEwqDjJFtYFVd89Yg/98/El2qC6YMhiTwyg=;

b=iA3vVd2r1mK059d0ipUQGbBwOJ5cItAYZkxQud/gpg3rfTODXB0HWll6UUKwmNxj6q

/ho5xZ6QSEJ7ssrQqavf6RS3WILPIhy2DM4AIUsvysHK5FlgMyej1nW4Amh5zaiGoZpb

hcoBH9EfbMj/4FdYCekQ9K0xpgkAGPA61p/gAPx8Ma7JRBSqzeLOCGvRyrTe/XnXav/A

tOhLAIujUvQbzasxsvOSRdovb5i4rasGL4wtWVcEOUOBddiIufAO+yCFshIPXS/MJApe

IrEjpgNlquY82FV6tbAcD7Wr6qcenzgWao1XtW5w/BMuKb8YQ1buJhdfwDcLrLF5sIlY

MPag==;

darn=nk.ca

ARC-Authentication-Results: i=3; mx.google.com;

dkim=pass header.i=@gmail.com header.s=20251104 header.b=n7SXJOek;

arc=pass (i=1);

spf=pass (google.com: domain of ella.white3180@gmail.com designates 209.85.220.65 as permitted sender) smtp.mailfrom=ella.white3180@gmail.com;

dmarc=pass (p=NONE sp=QUARANTINE dis=NONE) header.from=gmail.com;

dara=neutral header.i=@rankbeacon.xyz

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=rankbeacon.xyz; s=google; t=1786889484; x=1787494284; darn=nk.ca;

h=list-unsubscribe:list-subscribe:list-archive:list-help:list-post

:list-id:mailing-list:precedence:x-original-authentication-results

:x-original-sender:content-type:to:subject:message-id:date:from

:in-reply-to:references:mime-version:sender:from:to:cc:subject:date

:message-id:reply-to:content-type;

bh=00sqVXZchtcfEoiafdI04iO6p0VR0q16nabSWjgH2RQ=;

b=Fpp3XmPwJoMZH5KlaOjVk+zJz4NmdGWt/35RObOlb/snbRXP1ImOyg2U5i0e7aSAyu

v8oe/hw6X4slAnsSGtkipIsg87ONmLRiDQopcS5j6WoxtL0LZfzsblN2ivbuqoi9CeXn

MeXoDqR4RCJFCjFFjjtFijOFWsfgX3L1BlJ0qGDh6dy0fuwFwII/92Dvm7q5oQ8AqRi/

Sbc49tLI92wIl7gLhs+TMWm3TqpMTbtJsQ1GikUvKOsrDegQb18Y9oBySWXzsct6i8oj

yBJTviNe86b1b8Y5xfZs5Ao//Z4eCq3jjkWjFoLwdtjCnh5HTW4KvoOsWJoVzC5Og54W

Ok3w==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20251104; t=1786889484; x=1787494284;

h=list-unsubscribe:list-subscribe:list-archive:list-help:list-post

:x-spam-checked-in-group:list-id:mailing-list:precedence

:x-original-authentication-results:x-original-sender:content-type:to

:subject:message-id:date:from:in-reply-to:references:mime-version

:x-gm-gg:x-beenthere:x-gm-message-state:sender:from:to:cc:subject

:date:message-id:reply-to:content-type;

bh=00sqVXZchtcfEoiafdI04iO6p0VR0q16nabSWjgH2RQ=;

b=gguV+ePNTcxa/HtKrhsUSQzHUoBEkyNNNeuPkkSHTNsSjorjXRJEYcjO7K4yzyOFTA

XTcRqDJst3oKhoZ7sLe4gWprcqzIhCcqSkm6vLcc0hMs0b4Zc1BnFGdywK4OS/4X+HZt

+sMfbNH/G+u0Lcl2sS2iX2Pj6Kkrbs9TDi+2N7wKJE8JGzlwb9IxeGpR1vquN73vR9mC

95Qpj4QCtJ+9+w5qehZyVa8kY6h9rQ73luhzaF5DYqPW1na7lG4D2p8Pq+pKuAfAT50z

9CJzCH5pljUBTSczamtavahLKQMhO8fOd27AoHjiW0+/4HY38+h4NMeRqy8Hl5R1/pPG

gDgw==

Sender: google_seo@rankbeacon.xyz

X-Forwarded-Encrypted: i=3; AHgh+Rp/lGs7Dl+KJy+Q+utwct8Fvx2romsnaZikQwHGj+61jXwHxa1sQYP0O6DfDVMDuzrOczNz@nk.ca

X-Gm-Message-State: AOJu0YxC9Xe0jiDoiA+tVEdKEJ3IhocHXcODr1HaBagUYpUpRFjXC6Fn

Swr3lQ+3qe7YoIU5ZfcnNM+O1OJyqL51KXOI4GO8UrWSJTK5YOuh4kriE7FCBTSLkgM=

X-Received: by 2002:a05:6512:3c98:b0:5b2:8f21:9208 with SMTP id 2adb3069b0e04-5b459138277mr2860472e87.2.1786889483831;

Sun, 16 Aug 2026 07:11:23 -0700 (PDT)

X-BeenThere: google_seo@rankbeacon.xyz; h="ATskLdc5qA+kMioobIksA0pBwV5nWbfZyviqzAmDQj2vV53adw=="

Received: by 2002:ac2:4c2e:0:b0:5b0:1f26:8a3a with SMTP id 2adb3069b0e04-5b45310eff4ls1121923e87.1.-pod-prod-03-eu;

Sun, 16 Aug 2026 07:09:00 -0700 (PDT)

X-Received: by 2002:a05:6512:130f:b0:5b2:9238:5c36 with SMTP id 2adb3069b0e04-5b45918e87cmr2529894e87.27.1786889339893;

Sun, 16 Aug 2026 07:08:59 -0700 (PDT)

ARC-Seal: i=2; a=rsa-sha256; t=1786889339; cv=pass;

d=google.com; s=arc-20260327;

b=r6D4LeVHDmmYRZAmo5myGENEcce8johFo6LI2XF/C7J3Y+HqBKBQdQRXcGFgKOj9Zn

qEkXSlxYsW82RDKzzi3+fVO7hXUmtGDEiaNIsyyMiqw1UD18n9ThE8EHBRWRPydPZT9+

2oBkuXXwpPoz9m04mVniOD0cS0VC2lHyOBu4pb4FWbo64VvwXK+pxkNp6glGIc26lWvH

ZbKrj9Nh4PQqJFGpE3TyXWYDrm4kBmCalgD6xg1AJZ/1YVAG5W5nd3Ukl2ve1XDeZ3pc

FPQolj5Ug64nzWbk/xc56CvAOBHqfTGKNp+sAQOsVzZBV6HNDHboQS7DbaDkBOGtpXW6

KYFg==

ARC-Message-Signature: i=2; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20260327;

h=to:subject:message-id:date:from:in-reply-to:references:mime-version

:dkim-signature;

bh=6q7nRixXOGe11v8rzEdvRwsTcgzOZvxCh6SbCp5GjEM=;

fh=PWSUFaEq1CkbsfShP2jell5RPg3MDtCYx7KzhsUuaJc=;

b=S5JvEimiTX/L+UMhpaJYoVe8ans2UlIbuflUprcj8Y7KxVFy5iqG6nSIhLevdMJDB2

C49F9yHDyFNdwzmw5ODL/ZIpB5lTUZD65lzauWfgfQCDsmahPpL9m59ZoN6hqMT4zYYa

gHCMsxZkfXHTtmjqO/HAfc+y9otVyWKeQla2GKD/xZsZZ2ZClizvTC127xQ7Tpbz5HJd

3oT3npfeg6zkawnfZA1wtg0LbrqvXLPfKmb0SWZhnYdEBY6BTSLBNNOP//OA73/Z6//7

r2g3jkZiyZY26faRusKy7qo0uRghEqr7bJQXJIkyOpc5Fpbss21rrV765oI2x8UrsEK2

Sapw==;

dara=google.com

ARC-Authentication-Results: i=2; mx.google.com;

dkim=pass header.i=@gmail.com header.s=20251104 header.b=n7SXJOek;

arc=pass (i=1);

spf=pass (google.com: domain of ella.white3180@gmail.com designates 209.85.220.65 as permitted sender) smtp.mailfrom=ella.white3180@gmail.com;

dmarc=pass (p=NONE sp=QUARANTINE dis=NONE) header.from=gmail.com;

dara=neutral header.i=@rankbeacon.xyz

Received: from mail-sor-f65.google.com (mail-sor-f65.google.com. [209.85.220.65])

by mx.google.com with SMTPS id 2adb3069b0e04-5b458c08024sor518787e87.21.2026.08.16.07.08.59

for

(Google Transport Security);

Sun, 16 Aug 2026 07:08:59 -0700 (PDT)

Received-SPF: pass (google.com: domain of ella.white3180@gmail.com designates 209.85.220.65 as permitted sender) client-ip=209.85.220.65;

ARC-Seal: i=1; a=rsa-sha256; t=1786889339; cv=none;

d=google.com; s=arc-20260327;

b=SWAyJQhOLiPldnI9D1H1ARGV2t0hxgo8wCgu+4Ffww7YaFhHeok41zAuazeGGoayGt

02C/nyGkaiMcEYVpmFoXrqj5CxaLj55i/EAd4apLygflKtWllQmfy55clSDiS4kyudcJ

nn5YL1/IAWPu5gBcrOfklN4SgBkQ3RCbgm6q0ulgKFAatbYyFTAT09XrlB4lmlp/QijQ

pevLscJh445rk7Uplo4hCekM7SRb9pgQvwI14FAx67Eurp2vbrXbtHIdH7U8NWZFHLQ9

Tnoasa4znK9odLnurscr9tRMswGIywLasoQr6B6+2BZ+c2/O4X3uyniPaRqeZa56PWGu

1ymw==

ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20260327;

h=to:subject:message-id:date:from:in-reply-to:references:mime-version

:dkim-signature;

bh=6q7nRixXOGe11v8rzEdvRwsTcgzOZvxCh6SbCp5GjEM=;

fh=PWSUFaEq1CkbsfShP2jell5RPg3MDtCYx7KzhsUuaJc=;

b=VwrdKhcknyWGew92Tmc8BXUBnRF6S72J2OXkJWxSF/5+cWKs2PodqFVFU+AAp6+7I9

tiPUWbnnzTZUzcVFyOpKhAgEKVyuo2sR+/NyDE0ejmuPXtbR47ZLSwcHocv3aYjVgcaN

dyI8qiWg5cRq9/R4OI8JVInDfN+XUT7QIMJ/rAWpLf41BITMg1xAFaNVpxzVZbfhCpxY

RgX8JM7kGVBioJPedDrcNIyS4wE8NF/6UGa2qMmQmyY2vvqFaWu+FdyA9zR2bZJ419Vb

JfvgxwAVSwae0aynZRTz8iXcIgV2uHGMrvC/xBU4Rx+hhP5OgwfAoxUzjTsOxxbwLhxY

h0yA==;

darn=rankbeacon.xyz

ARC-Authentication-Results: i=1; mx.google.com; arc=none

X-Gm-Gg: AR+sD13SprCBaHxb33W6ach7mihb8tVzV4BxYFpDggLxICEdKmGx5QJi9n4X7WGMzNk

JXUi+OxpUgbDChW03ZL79Vde2nW9ZkqooKO9WDyIcZRedzw2u6jfMA/Za4uaIopb3ftE8qPYDF9

3NTxp/SPiA0AO9ItF/NrxuKMEtNGNRZQ7GTADyzIgaUvzfmHdfJwi3KpPSsmWefnaEGVU3GwLLu

5icGze4Okk3KIhgNKr8XL2zRXj3Bf9q5yH7PF9AHST5EXlXQ5D1DEA6JjrT3OioOaUUuI8eCaxm

nfG6wt/WU7aaJa7XG+osdcCf07iJ++eLe7dMsEaUd3JBu2X1kS0g/lXhMi6sR4toq9pVuC57OBQ

9teA9oO8DWNafKx8SaKT5DsnqUkRcXl5vo9BC

X-Received: by 2002:a05:6512:3a96:b0:5b2:e947:b3e6 with SMTP id

2adb3069b0e04-5b459163b2fmr2645524e87.2.1786889339337; Sun, 16 Aug 2026

07:08:59 -0700 (PDT)

MIME-Version: 1.0

References:

In-Reply-To:

From: Ella White

Date: Sun, 16 Aug 2026 19:40:52 +0530

X-Gm-Features: AcwNN1Xm8Yv2MLTR9ekpnG2ZZMcWeFJe9iycpdTIDBzCoX5H2UDyYWoRXQ9i0UY

Message-ID:

Subject: Re: I Found a few opportunities on your website

To: google_seo@rankbeacon.xyz

Content-Type: multipart/alternative; boundary="0000000000005300c606592a9879"

X-Original-Sender: ella.white3180@gmail.com

X-Original-Authentication-Results: mx.google.com; dkim=pass

header.i=@gmail.com header.s=20251104 header.b=n7SXJOek; arc=pass

(i=1); spf=pass (google.com: domain of ella.white3180@gmail.com

designates 209.85.220.65 as permitted sender) smtp.mailfrom=ella.white3180@gmail.com;

dmarc=pass (p=NONE sp=QUARANTINE dis=NONE) header.from=gmail.com;

dara=neutral header.i=@rankbeacon.xyz

Precedence: list

Mailing-list: list google_seo@rankbeacon.xyz; contact google_seo+owners@rankbeacon.xyz

List-ID:

X-Spam-Checked-In-Group: google_seo@rankbeacon.xyz

X-Google-Group-Id: 1054195051699

List-Post: ,

List-Help: ,

List-Archive:

List-Subscribe: ,

List-Unsubscribe: ,

X-Spam_score: 10.2

X-Spam_score_int: 102

X-Spam_bar: ++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.

Content preview: Just following up on my last email regarding a few website

improvements that could help increase your traffic, leads, and conversions.

I still have the quick snapshot ready for you. Reply *â€œOK â€“ SENDâ€

and Iâ€™ll share it over.

Content analysis details: (10.2 points, 5.0 required)

pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[209.85.167.70 listed in dnsbl.ahbl.org]

[209.85.167.70 listed in dnsbl.ahbl.org]

[209.85.167.70 listed in dnsbl.ahbl.org]

[209.85.167.70 listed in dnsbl.ahbl.org]

[209.85.220.65 listed in dnsbl.ahbl.org]

[209.85.220.65 listed in dnsbl.ahbl.org]

[209.85.220.65 listed in dnsbl.ahbl.org]

[209.85.220.65 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[209.85.167.70 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[209.85.167.70 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[209.85.167.70 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[209.85.167.70 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[209.85.220.65 listed in will-spam-for-food.eu.org]

[209.85.220.65 listed in will-spam-for-food.eu.org]

[209.85.220.65 listed in will-spam-for-food.eu.org]

[209.85.220.65 listed in will-spam-for-food.eu.org]

[209.85.220.65 listed in will-spam-for-food.eu.org]

[209.85.220.65 listed in will-spam-for-food.eu.org]

[209.85.220.65 listed in will-spam-for-food.eu.org]

[209.85.220.65 listed in will-spam-for-food.eu.org]

[209.85.167.70 listed in will-spam-for-food.eu.org]

[209.85.167.70 listed in will-spam-for-food.eu.org]

[209.85.167.70 listed in will-spam-for-food.eu.org]

[209.85.167.70 listed in will-spam-for-food.eu.org]

[209.85.167.70 listed in will-spam-for-food.eu.org]

[209.85.167.70 listed in will-spam-for-food.eu.org]

[209.85.167.70 listed in will-spam-for-food.eu.org]

[209.85.167.70 listed in will-spam-for-food.eu.org]

2.5 URIBL_DBL_SPAM Contains a spam URL listed in the DBL blocklist

[URI: rankbeacon.xyz]

-0.0 SPF_PASS SPF: sender matches SPF record

0.0 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level mail

domains are different

0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider

[ella.white3180(at)gmail.com]

2.0 PDS_OTHER_BAD_TLD Untrustworthy TLDs

[URI: rankbeacon.xyz (xyz)]

1.9 URIBL_ABUSE_SURBL Contains an URL listed in the ABUSE SURBL blocklist

[URI: rankbeacon.xyz]

1.9 URIBL_JP_SURBL Contains an URL listed in the JP SURBL blocklist

[URI: rankbeacon.xyz]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[209.85.167.70 listed in list.dnswl.org]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[209.85.167.70 listed in bl.score.senderscore.com]

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[209.85.167.70 listed in wl.mailspike.net]

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

0.5 FROM_SUSPICIOUS_NTLD From abused NTLD

-1.0 MAILING_LIST_MULTI Multiple indicators imply a widely-seen list

manager

0.2 FREEMAIL_FORGED_FROMDOMAIN 2nd level domains in From and EnvelopeFrom

freemail headers are different

1.0 BULK_RE_SUSP_NTLD Precedence bulk and RE: from a suspicious TLD

Subject: {SPAM?} Re: I Found a few opportunities on your website

--0000000000005300c606592a9879

Content-Type: text/plain; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable

Just following up on my last email regarding a few website improvements

that could help increase your traffic, leads, and conversions.

I still have the quick snapshot ready for you.

Reply =E2=80=9COK =E2=80=93 SEND=E2=80=9D and I=E2=80=99ll share it over.

Thanks,

On Sat, Jul 25, 2026 at 8:35=E2=80=AFPM Ella White
m> wrote:

> Hi there,

>

> I noticed a few things on your website that may be affecting how

> visitors engage with it.

>

> I documented a few recommendations* that could help improve results.

>

> Should I* send them over?*

>

> Thanks,

>

To unsubscribe from this group and stop receiving emails from it, send an e=

mail to google_seo+unsubscribe@rankbeacon.xyz.

--0000000000005300c606592a9879

Content-Type: text/html; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable

Just following up on my last email regarding a=C2=A0=

few website improvements that could help increase your traffic, leads, and =

conversions.
I still have the=C2=A0quick snapshot ready for yo=

u.
Reply=C2=A0=E2=80=9COK =E2=80=93 SEND=E2=80=9D=C2=A0and=

I=E2=80=99ll share it over.
Thanks,

=3D"gmail_quote gmail_quote_container">

">On Sat, Jul 25, 2026 at 8:35=E2=80=AFPM Ella White <
ella.white3180@gmail.com">ella.white3180@gmail.com> wrote:
=

left:1px solid rgb(204,204,204);padding-left:1ex">
Hi th=

ere,

I noticed a few things on your website that may b=

e affecting how visitors engage with it.

I documented a few r=

ecommendations that could help improve results.

Should I<=

b> send them over?

Thanks,

To unsubscribe from this group and stop receiving emails from it, send an e=

mail to google_seo=

+unsubscribe@rankbeacon.xyz.

--0000000000005300c606592a9879--

Categories: Google Gmail Spam

0 Comments

Swiftbridge loan phish from Google GMail
Posted by Dave Yadallee on Sunday, August 16. 2026

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Sat, 15 Aug 2026 19:36:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.5 (FreeBSD))

(envelope-from )

id 1wvPmn-00000000Koe-3ONb

for dave@doctor.nl2k.ab.ca;

Sat, 15 Aug 2026 19:35:41 -0600

Resent-From: The Doctor

Resent-Date: Sat, 15 Aug 2026 19:35:41 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-pl1-f170.google.com ([209.85.214.170]:44190)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.99.5 (FreeBSD))

(envelope-from )

id 1wvOXx-00000000DtT-3S0o

for sales@nk.ca;

Sat, 15 Aug 2026 18:16:26 -0600

Received: by mail-pl1-f170.google.com with SMTP id d9443c01a7336-2cf50c6f235so27131635ad.0

for ; Sat, 15 Aug 2026 17:15:30 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=swiftbridge.ca; s=google; t=1786839324; x=1787444124; darn=nk.ca;

h=references:list-unsubscribe-post:list-unsubscribe:message-id:date

:to:from:subject:mime-version:content-type:from:to:cc:subject:date

:message-id:reply-to:content-type;

bh=zMiyRCwPecnr+xJvDV+Xc0s/1rK4flKoB5iMeir0OJk=;

b=QuX2pHGUp3CL8diYThfLPPeObu6JU+AzOPaKjpsX/Wc+97mINN10MCwzF/4zkjZoAP

++g+U7CP03MiVZlKlu4S13rN6bb0yKK438lRIrvmvmG3bUcFhxE8A4RRrTX2MIzznQyL

Y0rOHwuOOi1xL85T/mXMFC4noTwQig//TsI+zk89F9ArxiKcQG2BWLJHrrW7NjK7qKz9

uFuw2/ykUJeAFnSZuiKa6X9HLtv6am+j5lbmJlHVBbubO16ipWfR6tc+3UwvzoLY0udw

cqbg/JLk70OQ+yM8RRjHUi6rrouev3SeYfatXT51Rq54XOH4l2gD/KhoDx+xMC6ajE06

i3eA==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20251104; t=1786839324; x=1787444124;

h=references:list-unsubscribe-post:list-unsubscribe:message-id:date

:to:from:subject:mime-version:content-type:x-gm-gg

:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to

:content-type;

bh=zMiyRCwPecnr+xJvDV+Xc0s/1rK4flKoB5iMeir0OJk=;

b=WFLiBPEoxhd5JhnaeOCEwadkTEKVFDjNTcoebrDaju9j2btCWVCBiD/EDLRSRy6HFx

OtUa7HXl7YArplXeyM10CWe2q8dMePKw+oQE4Mtl9egZBe5Me/KWKmYGi8dZvWVMiw1r

CPOgvnfiVnT27lqf5fET5AEOTOBPsZgspTSomhOJJCE1SW557DYF8CtNyD/ktii4WWSU

s4Oo1WV8x0pF0H3jDA1a8GgCsiJ92gjg84fmkKMXKSxgB53n62ADVvqV4r80TpYx6SlW

SyE1uhWTzt6rNYiXXqNHyuhKlvV8hrLsU2kBvz+CLgZ2SsZEiN2pOEI/bUcLQKoCDWR3

ZJMA==

X-Gm-Message-State: AOJu0YxL8Bas0Q+i7L4QnMCVfLvMoHmHFx5hTW4MWWO1RfYC8a9PxRXn

6SGLzjDCaxpZjf+n1ZTgUE1EFKVR9LNZ2AXg16NIcxTVSVG+dm6rx+F3RSxcShkcvK1G4cjRt/W

dCwlb6g==

X-Gm-Gg: AR+sD13pJPdrVjqUwrPN47/GGxopgfJPtEpBs2k224TxGsi9NuW2zlQv+h+qi+RWqTl

LZAvu5/q4NMjRguXlUcjHWJzSW1l8cJSpnK+1AKGeKNxMLjgAPjPYmDwwyg0XCtSIISaVcJtR9f

UOT1dad++nt5lLFA6sNSxgsQw2aPpuL1DaTxYnyRyW/Cx0oWIGY1LkLJPP8ekM5WyrXVmbZJaZc

XSiDqrVKdaUZ12qrFhEHxwJI5ocwzX3/97iSyEjQCwMHgCSx4erqkjJeIY4wQYhQTw+6/K8AUT3

xNz/4n+8IalfBKw2CKoNZj63VkCl4zeza4MoG5vbLLbbKF7rxahvIBIufjWN2w0SW/4VSe2ow1Y

/QXqGgUxGO4huBA8GPMJ7COzQPr0tBCPkkB89ydTgLTCpluiWOLrL5JF6Dr7N6mn6sS6PkeUD2A

AyG1f23LNIEk5hKrHXZM3e3WMmDtRvEZkZ/uDaIbeSvoHZ96FAAfk4G9Lf8aVZ8/9k2fJ540moN

UuhWGWk5gZXC8uzJ2cIhGasJIqMfVkMc0ZLJmhq9a9aCleE79Z3jcvDKvc3AlHt5w==

X-Received: by 2002:a17:903:22c6:b0:2bf:9760:b94d with SMTP id d9443c01a7336-2d3b0c93b9cmr159111625ad.15.1786839324483;

Sat, 15 Aug 2026 17:15:24 -0700 (PDT)

Received: from smtpgw.close.com (am11-natgw-c0.close.com. [54.200.191.154])

by smtp.gmail.com with ESMTPSA id d9443c01a7336-2d530ed40e2sm14901025ad.48.2026.08.15.17.15.22

for

(version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256);

Sat, 15 Aug 2026 17:15:23 -0700 (PDT)

Content-Type: multipart/mixed; boundary="===============7596885286746844966=="

MIME-Version: 1.0

Subject: quick question

From: =?utf-8?q?Operations_Department?=

To: sales@nk.ca

Date: Sun, 16 Aug 2026 00:15:22 +0000

Message-ID: <178683932262.7.12342631429046061327@smtpgw.close.com>

X-CLOSEIO-EMAIL-ID: acti_ZfJhzUsIAqxRjlMYoaQA433bKs3VvtFj8cCEh7nPZRP

List-Unsubscribe:

List-Unsubscribe-Post: List-Unsubscribe=One-Click

References: <178683932262.7.10029117434204695716@smtpgw.close.com>

X-Spam_score: 8.6

X-Spam_score_int: 86

X-Spam_bar: ++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.

Content preview: Hi Gurkirat, Are you currently open to additional capital

for ? Weâ€™ve been approving businesses for $25kâ€“$500k in under 48 hoursâ€”even

ones that were declined elsewhere.

Content analysis details: (8.6 points, 5.0 required)

pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[209.85.214.170 listed in dnsbl.ahbl.org]

[209.85.214.170 listed in dnsbl.ahbl.org]

[209.85.214.170 listed in dnsbl.ahbl.org]

[209.85.214.170 listed in dnsbl.ahbl.org]

[54.200.191.154 listed in dnsbl.ahbl.org]

[54.200.191.154 listed in dnsbl.ahbl.org]

[54.200.191.154 listed in dnsbl.ahbl.org]

[54.200.191.154 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[209.85.214.170 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[209.85.214.170 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[209.85.214.170 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[209.85.214.170 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[54.200.191.154 listed in will-spam-for-food.eu.org]

[54.200.191.154 listed in will-spam-for-food.eu.org]

[54.200.191.154 listed in will-spam-for-food.eu.org]

[54.200.191.154 listed in will-spam-for-food.eu.org]

[54.200.191.154 listed in will-spam-for-food.eu.org]

[54.200.191.154 listed in will-spam-for-food.eu.org]

[54.200.191.154 listed in will-spam-for-food.eu.org]

[54.200.191.154 listed in will-spam-for-food.eu.org]

[209.85.214.170 listed in will-spam-for-food.eu.org]

[209.85.214.170 listed in will-spam-for-food.eu.org]

[209.85.214.170 listed in will-spam-for-food.eu.org]

[209.85.214.170 listed in will-spam-for-food.eu.org]

[209.85.214.170 listed in will-spam-for-food.eu.org]

[209.85.214.170 listed in will-spam-for-food.eu.org]

[209.85.214.170 listed in will-spam-for-food.eu.org]

[209.85.214.170 listed in will-spam-for-food.eu.org]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[209.85.214.170 listed in list.dnswl.org]

1.9 URIBL_ABUSE_SURBL Contains an URL listed in the ABUSE SURBL blocklist

[URI: swiftbridge.ca]

1.9 URIBL_JP_SURBL Contains an URL listed in the JP SURBL blocklist

[URI: swiftbridge.ca]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-0.0 RCVD_IN_MSPIKE_H3 RBL: Good reputation (+3)

[209.85.214.170 listed in wl.mailspike.net]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[209.85.214.170 listed in bl.score.senderscore.com]

-0.0 SPF_PASS SPF: sender matches SPF record

-0.0 RCVD_IN_MSPIKE_WL Mailspike good senders

0.6 MEGALONGWORD BODY: Uses really overlong words

0.3 LONGWORD BODY: Uses overlong words

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

1.0 IMPRO_URI_2 No description available.

1.5 IMPRONONCABLE_2 Too much mixed numbers and lower-case letters

Subject: {SPAM?} quick question

--===============7596885286746844966==

Content-Type: multipart/alternative; boundary="===============3069496292633131665=="

MIME-Version: 1.0

--===============3069496292633131665==

Content-Type: text/plain; charset="utf-8"

MIME-Version: 1.0

Content-Transfer-Encoding: quoted-printable

Hi Gurkirat,

=20

Are you currently open to additional capital for ?

=20

We=E2=80=99ve been approving businesses for $25k=E2=80=93$500k in under 48 =

hours=E2=80=94even ones

that were declined elsewhere.

=20

Takes 2 minutes to check: =20

[Start here ! ](https://form.jotform.com/242605781483259)

=20

Want me to see what you=E2=80=99d qualify for?

=20

\-- =20

=20

=20

=20

--- =20

| | ![photo](https://ci3.googleusercontent.com/meips/ADKq_NZcwYaCAZ90rjgA_b=

jLpd4UBFKqUrHszw5qpzRZhK0SNMTtvlfq5zGViREQoOUAdVJMjeicSY8kTxvpVSSXmTyQwrq5M=

5IB26TVMQhTMEd-HXVMeR6WJ2TFGheuvLHxDzKlmbEZCoK7opGGGjR_q5TiTVefUnoNDMPitlcf=

bg=3Ds0-d-e1-ft#https://d36urhup7zbd7q.cloudfront.net/u/O6rlxveRayv/28587ed=

2-7c1a-49f7-92d8-ab9cbb1a3725__400x400__.jpeg)| **Noah Blake** =20

=20

| **Operations & Customer Support - **[**Apply

Here!**](https://form.jotform.com/261906027631252) =20

**Swiftbridge Funding** =20

--- =20

| [ +1 236-506-](tel:+1236-702-1731)7475 | [swiftbridge.ca](https://swift=

bridge.ca/) =20

--- =20

|

[![instagram](https://ci3.googleusercontent.com/meips/ADKq_NandMz9xr29JOnOo=

0ZGdt9IUU2uHaL1R39vaFC2NqcN17ttmyRblzHiisIgSKi6PYdfEsJSsbtXM30S6OiMDtOlnHuj=

8c9qwveZHk9y4bM-

WnzUlNF7=3Ds0-d-e1-ft#https://gifo.srv.wisestamp.com/s/inst/E4405F/48/0/bac=

kground.png)](https://instagram.com/swiftbridgefunding)|

[![linkedin](https://ci3.googleusercontent.com/meips/ADKq_NYWx_R1C52H8WTUFY=

iJQy38-AlU07dlE8P81d508aEMaVFWlSBbw-

iTGs8QQjhOzTvhy0I8TsN1QrcyihwN0sH39dCjRCrlp_Yv5H1m45hADcbKig=3Ds0-d-e1-ft#h=

ttps://gifo.srv.wisestamp.com/s/ld/0077b5/48/0/background.png)](https://www=

.linkedin.com/company/swift-

bridge-funding/) =20

---|--- =20

=20

To stop receiving these emails, click

[Unsubscribe](https://app.close.com/go/unsubscribe/orga_rkJepeCLpETmCWxJkfO=

SoXmVctXd0sGdXUBNuPxrS8x/sales%40nk.ca/VXBlw6Fuqe1NXDIkBcNws9nXSz1DrVPka6K2=

SzHPIME=3D/)

--===============3069496292633131665==

Content-Type: text/html; charset="utf-8"

MIME-Version: 1.0

Content-Transfer-Encoding: quoted-printable

Hi Gurkirat,

Are you currently open to additi=

onal capital for ?

We=E2=80=99ve been approving bu=

sinesses for $25k=E2=80=93$500k in under 48 hours=E2=80=94even ones that we=

re declined elsewhere.

Takes 2 minutes to check:
r>
ferrer nofollow">Start here !

Want me to see =

what you=E2=80=99d qualify for?

re">
--
pan>

ir=3D"ltr">
s-serif; font-size: 16px; direction: ltr; border-collapse: collapse;">
roup>
table>
ooter">
To stop receiving the=

se emails, click
eCLpETmCWxJkfOSoXmVctXd0sGdXUBNuPxrS8x/sales%40nk.ca/VXBlw6Fuqe1NXDIkBcNws9=

nXSz1DrVPka6K2SzHPIME=3D/" target=3D"_blank" rel=3D"noopener noreferrer nof=

ollow">Unsubscribe

/ZfJhzUsIAqxRjlMYoaQA433bKs3VvtFj8cCEh7nPZRP/1TRpq4kUQd.png" alt=3D"" width=

=3D"1" height=3D"1" />

--===============3069496292633131665==--

--===============7596885286746844966==--

Categories: Google Gmail Spam, Phish

0 Comments

nigerian spam
Posted by Dave Yadallee on Saturday, August 15. 2026

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Sat, 15 Aug 2026 16:12:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.5 (FreeBSD))

(envelope-from )

id 1wvMbG-000000005iG-1hcw

for dave@doctor.nl2k.ab.ca;

Sat, 15 Aug 2026 16:11:34 -0600

Resent-From: The Doctor

Resent-Date: Sat, 15 Aug 2026 16:11:34 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from [163.172.214.93] (port=43068 helo=ns186.ahcorporation.com)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.99.5 (FreeBSD))

(envelope-from )

id 1wvM4W-00000000Pec-3tUF

for doctor@doctor.nl2k.ab.ca;

Sat, 15 Aug 2026 15:38:00 -0600

DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed;

d=prestigeapparelmfg.com; s=default; h=Reply-To:Date:From:To:Subject:

Content-Description:Content-Transfer-Encoding:MIME-Version:Content-Type:

Sender:Message-ID:Cc:Content-ID:Resent-Date:Resent-From:Resent-Sender:

Resent-To:Resent-Cc:Resent-Message-ID:In-Reply-To:References:List-Id:

List-Help:List-Unsubscribe:List-Subscribe:List-Post:List-Owner:List-Archive;

bh=+ecfLGAE21ST/rWlKCqMKyHjAD/oM4Eicg22yAkewlE=; b=IE9Uzeoaqdt2AFzd4hyrrE5vTi

tnaJyeXoCMC/SriSfddXxGwlnn6znQvnmOrpMwIHHjqeJIZoRutxp8+kmAJ4T248/nCA37qSJ6UlS

Nn5+fz/fUEF1slzTKB55Y5SqcQKS9y+9rNyp3D/DlQ7w+ebBxsyIUiik3TKHv77s8Qphg/gxpGFF9

Txcq1QyjltCQnCVWDGZ8wCSdSWcswNtE4P0tNOsrWc9BV5sywosjTCvj02LzSRXFwvP7Xx/ocm06U

b+J0k/q9OWvk+JOPsFN5VrAHkmRbnrpB1ULJDoHEZkJQjPFu4T7NE3tg2CtaBB1lmQ7NbIqx1fL1s

ruqJuMNg==;

Received: from 102-219-162-91.ip.home-connect.co.za ([102.219.162.91]:55058 helo=[10.5.0.2])

by 163-172-214-93.cprapid.com with esmtpa (Exim 4.99.3)

(envelope-from )

id 1wvM3R-00000006wWT-1vwz;

Sat, 15 Aug 2026 21:36:34 +0000

Content-Type: text/plain; charset="iso-8859-1"

MIME-Version: 1.0

Content-Transfer-Encoding: quoted-printable

Content-Description: Mail message body

Subject: Hi, Is your email still active?

To: Recipients

From: Mr. Ugo Verni

Date: Sat, 15 Aug 2026 23:36:19 +0200

Reply-To: alexkortig61@gmail.com

X-AntiAbuse: This header was added to track abuse, please include it with any abuse report

X-AntiAbuse: Primary Hostname - 163-172-214-93.cprapid.com

X-AntiAbuse: Original Domain - doctor.nl2k.ab.ca

X-AntiAbuse: Originator/Caller UID/GID - [47 8] / [47 8]

X-AntiAbuse: Sender Address Domain - prestigeapparelmfg.com

X-Get-Message-Sender-Via: 163-172-214-93.cprapid.com: authenticated_id: support@prestigeapparelmfg.com

X-Authenticated-Sender: 163-172-214-93.cprapid.com: support@prestigeapparelmfg.com

X-Source:

X-Source-Args:

X-Source-Dir:

X-Spam_score: 10.8

X-Spam_score_int: 108

X-Spam_bar: ++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.

Content preview: PS: Is your email still active? I am Mr. Alex Kortig, I have

a very important transaction to discuss with you regarding unclaimed inheritance

funds linked to your Name. Kindly respond to my private em [...]

Content analysis details: (10.8 points, 5.0 required)

pts rule name description

---- ---------------------- --------------------------------------------------

0.1 MISSING_MID Missing Message-Id: header

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[163.172.214.93 listed in dnsbl.ahbl.org]

[163.172.214.93 listed in dnsbl.ahbl.org]

[163.172.214.93 listed in dnsbl.ahbl.org]

[163.172.214.93 listed in dnsbl.ahbl.org]

[102.219.162.91 listed in dnsbl.ahbl.org]

[102.219.162.91 listed in dnsbl.ahbl.org]

[102.219.162.91 listed in dnsbl.ahbl.org]

[102.219.162.91 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[163.172.214.93 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[163.172.214.93 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[163.172.214.93 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[163.172.214.93 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[102.219.162.91 listed in will-spam-for-food.eu.org]

[102.219.162.91 listed in will-spam-for-food.eu.org]

[102.219.162.91 listed in will-spam-for-food.eu.org]

[102.219.162.91 listed in will-spam-for-food.eu.org]

[102.219.162.91 listed in will-spam-for-food.eu.org]

[102.219.162.91 listed in will-spam-for-food.eu.org]

[102.219.162.91 listed in will-spam-for-food.eu.org]

[102.219.162.91 listed in will-spam-for-food.eu.org]

[163.172.214.93 listed in will-spam-for-food.eu.org]

[163.172.214.93 listed in will-spam-for-food.eu.org]

[163.172.214.93 listed in will-spam-for-food.eu.org]

[163.172.214.93 listed in will-spam-for-food.eu.org]

[163.172.214.93 listed in will-spam-for-food.eu.org]

[163.172.214.93 listed in will-spam-for-food.eu.org]

[163.172.214.93 listed in will-spam-for-food.eu.org]

[163.172.214.93 listed in will-spam-for-food.eu.org]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[163.172.214.93 listed in bl.score.senderscore.com]

0.0 T_SPF_HELO_TEMPERROR SPF: test of HELO record failed (temperror)

-0.0 SPF_PASS SPF: sender matches SPF record

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in digit

[alexkortig61(at)gmail.com]

2.6 HK_SCAM_N13 BODY: No description available.

0.0 HK_NAME_MR_MRS No description available.

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

1.3 RDNS_NONE Delivered to internal network by a host with no rDNS

2.5 FREEMAIL_FORGED_REPLYTO Freemail in Reply-To, but not From

2.5 ADVANCE_FEE_3_NEW Appears to be advance fee fraud (Nigerian 419)

Subject: {SPAM?} Hi, Is your email still active?

PS: Is your email still active? I am Mr. Alex Kortig, I have a very importa=

nt transaction to discuss with you regarding unclaimed inheritance funds li=

nked to your Name. Kindly respond to my private email: alexkortig61@gmail.c=

om

Mr. Alex

Categories: Spam and Phish

0 Comments

Page 1293 of 1293, totaling 19386 entries

previous page

No entries to print

Calendar

" rowspan=3D"1" style=3D"font-size: 0px; height: 12px; line-height: 0px;"><=

/td>

pacing=3D"0" border=3D"0" width=3D"100%" style=3D"width: 485px;">=

span=3D"1">
pse: collapse; line-height: 1.15;">
">
le>

owspan=3D"1" style=3D"vertical-align: top; padding: 0.01px 14px 0.01px 1px;=

width: 65px; text-align: center;">

tps://ci3.googleusercontent.com/meips/ADKq_NZcwYaCAZ90rjgA_bjLpd4UBFKqUrHsz=

w5qpzRZhK0SNMTtvlfq5zGViREQoOUAdVJMjeicSY8kTxvpVSSXmTyQwrq5M5IB26TVMQhTMEd-=

HXVMeR6WJ2TFGheuvLHxDzKlmbEZCoK7opGGGjR_q5TiTVefUnoNDMPitlcfbg=3Ds0-d-e1-ft=

#https://d36urhup7zbd7q.cloudfront.net/u/O6rlxveRayv/28587ed2-7c1a-49f7-92d=

8-ab9cbb1a3725__400x400__.jpeg" alt=3D"photo" style=3D"width: 65px; height:=

65px; vertical-align: middle; border-radius: 0px; border: 0px; display: bl=

ock;">

ing: 0.01px 0.01px 0.01px 14px; vertical-align: top; border-left: 1px solid=

rgb(189, 189, 189);">
Noah Blake

cellpadding=3D"0" cellspacing=3D"0" style=3D"border-collapse: collapse;">
olgroup>
>

=3D"1" rowspan=3D"1" style=3D"padding: 0.01px;">

line-height: 19.2px;">Operations & Customer Support - =

=3D"noopener noreferrer nofollow">Apply Here!

ng>
olor: rgb(100, 100, 100);">Swiftbridge Funding

able cellpadding=3D"0" cellspacing=3D"0" style=3D"border-collapse: collapse=

;">

pan=3D"1" rowspan=3D"1" width=3D"388" height=3D"0" style=3D"height: 0px; pa=

dding-top: 14px; width: 388px; font-family: Arial;">

; line-height: 10.89px; font-size: 11px;">
rget=3D"_blank" rel=3D"noopener noreferrer nofollow" style=3D"color: rgb(30=

, 144, 250); text-decoration: unset;">
olor: rgb(33, 33, 33);">+1 236-506-7475 |
ef=3D"https://swiftbridge.ca/" target=3D"_blank" rel=3D"noopener noreferrer=

nofollow" style=3D"color: rgb(30, 144, 250); text-decoration: unset;">
n style=3D"line-height: 13.2px; color: rgb(33, 33, 33);">swiftbridge.ca
an>

rowspan=3D"1" height=3D"0" style=3D"height: 0px; padding: 14px 0.01px 0.01p=

x;">
dth: 50px;">
th: 25px;">

eft" style=3D"padding-right: 6px; text-align: center; padding-top: 0px;">
style=3D"margin: 1px;">
" target=3D"_blank" rel=3D"noopener noreferrer nofollow" style=3D"color: rg=

b(30, 144, 250);">
NandMz9xr29JOnOo0ZGdt9IUU2uHaL1R39vaFC2NqcN17ttmyRblzHiisIgSKi6PYdfEsJSsbtX=

M30S6OiMDtOlnHuj8c9qwveZHk9y4bM-WnzUlNF7=3Ds0-d-e1-ft#https://gifo.srv.wise=

stamp.com/s/inst/E4405F/48/0/background.png" alt=3D"instagram" style=3D"wid=

th: 24px; height: 24px; float: left; border: none;">

n=3D"1" rowspan=3D"1" align=3D"left" style=3D"padding-right: 6px; text-alig=

n: center; padding-top: 0px;">

www.linkedin.com/company/swift-bridge-funding/" target=3D"_blank" rel=3D"no=

opener noreferrer nofollow" style=3D"color: rgb(30, 144, 250);">
"https://ci3.googleusercontent.com/meips/ADKq_NYWx_R1C52H8WTUFYiJQy38-AlU07=

dlE8P81d508aEMaVFWlSBbw-iTGs8QQjhOzTvhy0I8TsN1QrcyihwN0sH39dCjRCrlp_Yv5H1m4=

5hADcbKig=3Ds0-d-e1-ft#https://gifo.srv.wisestamp.com/s/ld/0077b5/48/0/back=

ground.png" alt=3D"linkedin" style=3D"width: 24px; height: 24px; float: lef=

t; border: none;">

Mon Tue Wed Thu Fri Sat Sun

← Back August '26 Forward →

1 2

3 4 5 6 7 8 9

10 11 12 13 14 15 16

17 18 19 20 21 22 23

24 25 26 27 28 29 30

31

Archives

August 2026

July 2026

June 2026

Recent...

Older...

Categories

Announcements

General

Involved in the Community

Canadian Club of Edmonton

Chamber Toastmasters

Chamber of Commerce Networking

The Edmonton Social Media Web 2.0 Meetup

Spam and Phish

AOL Spam

Adelphia Spam

AliceDSL.de Spam

Amazon Spam

Arcor-IP.net spam

Barracuda Network Spam

Bell Canada Spam

BellSouth Spam

Bezeqint Spam

British Telecom Spam

Charter Communications Spam

Chinese Phish Spam

Cogeco Cable Spam

Comcast Spam

Cox spam

Earthlink Spam

Eastlink Spam

Epix.net Spam

ExcelAds spam

GoDaddy Spam

Google Gmail Spam

Happeninstuff Spam

Hinet.net Spam

MailGun Spam and Phish

Mega Mail Servers Spam

Message Labs spam

Messagelabs spam

Microsoft Outlook Hotmail Spam

MSN Israeli Spam

Mindspring Spam

NEtia Spam from Poland

Network Solutions Spam

OVH Spam and Phish

Phish

Primus Spam

Proxad Spam

Roadrunner Spam

Roger's Spam

Shawmail Spam

Sophos spam

SourceCable Spam

StellarEstate Spam

T-online Germany Spam

TelecomItalia Spam

Telefonica Spain Spam

Telus Spam

Tera-Byte Spam

Tiscali Spam

Tucows Spam

UCLA Spam

Verizon Spam

Virgin Media Spam

Wanadoo Orange Spam

Who's Who Spam

Xplorenet spam

Yahoo! Spam

digital ocean spam

eToll spam

pppool.de spam

sendgrid.net spam and phish

Technical Issues

Windows Problems

Web Ranking

NetKnow and Edmonton Internet Service Providers (ISP) ranking

Web Ranking Articles

Syndicate This Blog

Blog Administration
Open login screen

Powered by

Serendipity PHP Weblog

NetKnow Navigation
Home

VPNs

Dialup Service

Web Design

Web Hosting

E-Commerce

Server Colocation

Domain Registration

Web Mail

Support

Testimonials

Client List

FAQs

Interested in NetKnow Services?

Links

Disclaimer

Acceptable Use

Security

Technorati Profile

Remote RSS/OPML-Blogroll Feed
No RSS/OPML feed selected

Error
serendipity error: could not include serendipity_plugin_statistics:9cbc0e29a86fd9359ac6748399d6ba5b - exiting.

addthis

Empire Avenue

Error
serendipity error: could not include serendipity_plugin_freetag:6c39baf097de002d8b1c2e33b9661474 - exiting.

Error
serendipity error: could not include serendipity_plugin_statistics:f520e0fa688ba61bd1ed85c0fd80d550 - exiting.

Error
serendipity error: could not include serendipity_plugin_twitter:b18e142d4998b6b0092d068ad858683d - exiting.

Syndicate This Blog

Comments

Error
serendipity error: could not include serendipity_plugin_spamblock_bee:7aefbb7ca9b764849be35e938b6fc9b2 - exiting.

Error
serendipity error: could not include serendipity_plugin_twitter:c7a92f670894afa9e3097574359fe38d - exiting.

Error
serendipity error: could not include serendipity_plugin_statistics:8b72cc4261ddc7ff15df253b17c29c23 - exiting.

Error
serendipity error: could not include serendipity_plugin_statistics:a0bd1a65cd9ff1c3e289829cc26557c4 - exiting.

Error
serendipity error: could not include serendipity_plugin_statistics:dcd26c048e45c234c054530ef1492953 - exiting.

Error
serendipity error: could not include serendipity_plugin_freetag:6d4c66aeb83aeb9524a7cc609051cf0f - exiting.

Error
serendipity error: could not include serendipity_plugin_freetag:acc1042e790905e499445a6890081492 - exiting.

Error
serendipity error: could not include serendipity_plugin_freetag:158fb50035b12269ec43107b29253af3 - exiting.

Error
serendipity error: could not include serendipity_plugin_topreferers:6b7e3336713d0a60294c7e310ca5cf1a - exiting.

Error
serendipity error: could not include serendipity_plugin_spamblock_bee:d3f047ee6f925c138fae56dcd7a99400 - exiting.

Error
serendipity error: could not include serendipity_plugin_spamblock_bee:5544ace5c8b19bb8592464810b48df10 - exiting.

Error
serendipity error: could not include serendipity_plugin_google_quicksearch:5624ac0b69cdbe32d0cdc40814d7eb41 - exiting.

Error
serendipity error: could not include serendipity_plugin_google_quicksearch:b8387d3a378247c1c9ede46fffb084e1 - exiting.

Error
serendipity error: could not include serendipity_plugin_google_last_query:bacdc0652131449ebc68ebde2bcb9ce2 - exiting.

Error
serendipity error: could not include serendipity_plugin_google_last_query:8c84ca587b64b627d986e9d5ce98ead1 - exiting.

Powered by Serendipity & the next theme.

Mon	Tue	Wed	Thu	Fri	Sat	Sun
← Back	August '26					Forward →
					1	2
3	4	5	6	7	8	9
10	11	12	13	14	15	16
17	18	19	20	21	22	23
24	25	26	27	28	29	30
31

WEBROOT

Order Confirmation

ONT-WEIGHT: 600; COLOR: rgb(37,36,36); MARGIN: 0px 0px 16px; text-shadow: n= one; box-shadow: none'>You received a voicemail

Ulytau Oil & Gas

Archives

Categories

Syndicate This Blog

Blog Administration

Powered by

NetKnow Navigation

Remote RSS/OPML-Blogroll Feed

Error

addthis

Empire Avenue

Error

Error

Error

Syndicate This Blog

Error

Error

Error

Error

Error

Error

Error

Error

Error

Error

Error

Error

Error

Error

Error

ONT-WEIGHT: 600; COLOR: rgb(37,36,36); MARGIN: 0px 0px 16px; text-shadow: n=

one; box-shadow: none'>You received a voicemail