Nk.CA Credential Phishing

Posted by Dave Yadallee on Saturday, August 22. 2026

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Sat, 22 Aug 2026 10:34:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.100 (FreeBSD))

(envelope-from )

id 1wxof7-000000008aG-0jcv

for dave@doctor.nl2k.ab.ca;

Sat, 22 Aug 2026 10:33:41 -0600

Resent-From: The Doctor

Resent-Date: Sat, 22 Aug 2026 10:33:41 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail.emergingrating.com ([103.16.72.108]:60178)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.100 (FreeBSD))

(envelope-from )

id 1wxnMZ-00000000OPK-1xY0

for sales@nk.ca;

Sat, 22 Aug 2026 09:10:38 -0600

Received: from localhost (localhost.localdomain [127.0.0.1])

by mail.emergingrating.com (Postfix) with ESMTP id 040233E3FE2

for ; Sat, 22 Aug 2026 21:13:48 +0600 (+06)

Received: from mail.emergingrating.com ([127.0.0.1])

by localhost (mail.emergingrating.com [127.0.0.1]) (amavis, port 10032)

with ESMTP id ABkzDZ6xayNb for ;

Sat, 22 Aug 2026 21:13:47 +0600 (+06)

Received: from localhost (localhost.localdomain [127.0.0.1])

by mail.emergingrating.com (Postfix) with ESMTP id 89F8E40DEAF

for ; Sat, 22 Aug 2026 21:13:47 +0600 (+06)

X-Virus-Scanned: amavis at emergingrating.com

Received: from mail.emergingrating.com ([127.0.0.1])

by localhost (mail.emergingrating.com [127.0.0.1]) (amavis, port 10026)

with ESMTP id pHGn8B5ogJpz for ;

Sat, 22 Aug 2026 21:13:47 +0600 (+06)

Received: from 96e973dc.com (unknown [62.169.135.177])

by mail.emergingrating.com (Postfix) with ESMTPSA id D76C113F8314

for ; Sat, 22 Aug 2026 21:13:28 +0600 (+06)

Content-Type: multipart/mixed; boundary="===============1045353409688801620=="

MIME-Version: 1.0

From: Admin Nk Helpdesk online mail support account

imgfjqniwktkargewvphetsxffzcgkqsrtwdqcbvnlyitfaocsjjrpdyzljjsdmcxslloo

To: sales@nk.ca

Subject: Sales Nk Closure last notice update

Date: Sat, 22 Aug 2026 15:09:04 -0000

Message-ID: <178741134466.243240.6383465376943250951@emergingrating.com>

X-YRLMSZ: NBOBNT

X-TOQMD: QTWFCZCBF

X-Accept-Language: en-us, en

X-Spam_score: 13.0

X-Spam_score_int: 130

X-Spam_bar: +++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.

Content preview:

Content analysis details: (13.0 points, 5.0 required)

pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[62.169.135.177 listed in will-spam-for-food.eu.org]

[62.169.135.177 listed in will-spam-for-food.eu.org]

[62.169.135.177 listed in will-spam-for-food.eu.org]

[62.169.135.177 listed in will-spam-for-food.eu.org]

[62.169.135.177 listed in will-spam-for-food.eu.org]

[62.169.135.177 listed in will-spam-for-food.eu.org]

[62.169.135.177 listed in will-spam-for-food.eu.org]

[62.169.135.177 listed in will-spam-for-food.eu.org]

[103.16.72.108 listed in will-spam-for-food.eu.org]

[103.16.72.108 listed in will-spam-for-food.eu.org]

[103.16.72.108 listed in will-spam-for-food.eu.org]

[103.16.72.108 listed in will-spam-for-food.eu.org]

[103.16.72.108 listed in will-spam-for-food.eu.org]

[103.16.72.108 listed in will-spam-for-food.eu.org]

[103.16.72.108 listed in will-spam-for-food.eu.org]

[103.16.72.108 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[103.16.72.108 listed in dnsbl.ahbl.org]

[103.16.72.108 listed in dnsbl.ahbl.org]

[103.16.72.108 listed in dnsbl.ahbl.org]

[103.16.72.108 listed in dnsbl.ahbl.org]

[62.169.135.177 listed in dnsbl.ahbl.org]

[62.169.135.177 listed in dnsbl.ahbl.org]

[62.169.135.177 listed in dnsbl.ahbl.org]

[62.169.135.177 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[103.16.72.108 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[103.16.72.108 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[103.16.72.108 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[103.16.72.108 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_SBL_XBL RBL: Received via a relay in Spamhaus SBL+XBL

[62.169.135.177 listed in sbl-xbl.spamhaus.org]

3.6 RCVD_IN_SBL_CSS RBL: Received via a relay in Spamhaus SBL-CSS

[62.169.135.177 listed in zen.spamhaus.org]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[103.16.72.108 listed in bl.score.senderscore.com]

-0.0 SPF_PASS SPF: sender matches SPF record

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

3.5 VOWEL_FROM_7 Impronouncable from header (7+ consecutive vowels)

0.5 NO_RDNS Sending MTA has no reverse DNS (Postfix variant)

-0.0 T_RP_MATCHES_RCVD Envelope sender domain matches handover relay

domain

0.0 NORMAL_HTTP_TO_IP URI: URI host has a public dotted-decimal IPv4

address

0.7 MPART_ALT_DIFF BODY: HTML and text parts are different

0.0 MIME_HTML_MOSTLY BODY: Multipart message mostly text/html MIME

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.3 HTML_IMAGE_ONLY_04 BODY: HTML: images with 0-400 bytes of words

0.1 MXG_EMAIL_FRAG BODY: URI with email in fragment

0.8 SARE_FROM_SPAM_WORD3 I don't know people named this!

0.0 NO_RDNS2 Sending MTA has no reverse DNS

0.0 DC_PNG_UNO_LARGO Message contains a single large inline gif

0.1 DC_IMAGE_SPAM_HTML Possible Image-only spam

0.1 DC_IMAGE_SPAM_TEXT Possible Image-only spam with little text

0.2 GMD_PDF_EMPTY_BODY BODY: Attached PDF with empty message body

Subject: {SPAM?} Sales Nk Closure last notice update

Nkclosure.pdf

Web/SEO/App spam from Google Gmail

Posted by Dave Yadallee on Saturday, August 22. 2026

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Sat, 22 Aug 2026 07:31:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.100 (FreeBSD))

(envelope-from )

id 1wxlny-00000000BQ8-1wyn

for dave@doctor.nl2k.ab.ca;

Sat, 22 Aug 2026 07:30:38 -0600

Resent-From: The Doctor

Resent-Date: Sat, 22 Aug 2026 07:30:38 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-lj1-f173.google.com ([209.85.208.173]:55566)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.100 (FreeBSD))

(envelope-from )

id 1wxkSA-00000000Ffs-2Vod

for sales@nk.ca;

Sat, 22 Aug 2026 06:04:10 -0600

Received: by mail-lj1-f173.google.com with SMTP id 38308e7fff4ca-39f91ba1ef7so14743951fa.3

for ; Sat, 22 Aug 2026 05:03:15 -0700 (PDT)

ARC-Seal: i=1; a=rsa-sha256; t=1787400189; cv=none;

d=google.com; s=arc-20260327;

b=AKOw9Jpcc0+f8KMiN1Ii2nag4U6FO3vig0dU3N/WzSRuOCs/61eTq9fCN1GCCo/Owo

MHYoQDKn0sdfZ2gaF0Sdo3BH1iDsdziOQv3MPb5e3U+44fsWrznkaeUwpsuJ+0XRm+1p

7mzLKPz51jTWT2tEY0oPACptKPUqvCRH0IAq0hTwVfX2/jd3MD+WknxqZkI4wNzUpYQ+

1ghNyfsKZPmMtM7VfsOa9p+ZfnhSvkMpKTANgxArzvWA/2goS+X8cExjnxPEF93eihRK

XXOVJLtO4iNwavUwoUTrHojrNajQaiWWI67hhG9xADg4umPHXAUmJ/p5Ggc8N1ol7D7+

Sg1w==

ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20260327;

h=to:subject:message-id:date:reply-to:from:sender:mime-version

:dkim-signature;

bh=ARrCOozyN6Qh1FlKclQkEOx6He0MstnsEcSEj5+w6l0=;

fh=K4YXDlBzh75jp+umpiVSGKtavKLbAmcgNobJ9O4QpWc=;

b=c7ivSIro8veL2e2Gfy0tTxwT9Dti0zzxw3dS4oWRy0PYzS48MhikM1ZibcS5vN97Qn

A8E+F7jwjnkBmRIQfEGYy1W8NYXSF2VSAAZp56t0AeP6GBDLeBPXcWDonYZa5XXldIok

JAywgyy73TNe56mXILBeMXG/8v2b0WY3Fvcegfmt1v4reU0prwTzhYLqKWa6zkzdG7yS

KHfALucb5f84JmDZDblNO2kJiQaRf9jyxBESHyEjv8uQyGWhRln/1NdZWmidO3zMB1YJ

/QMGfYO/u6wc329Snyfbv/JGR6WcWXDQe3qOWbc4tsTWqhS9Mdww0S7pamd5l5RBFBs6

HLwA==;

darn=nk.ca

ARC-Authentication-Results: i=1; mx.google.com; arc=none

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=zubintech.com; s=google; t=1787400189; x=1788004989; darn=nk.ca;

h=content-type:to:subject:message-id:date:reply-to:from:sender

:mime-version:from:to:cc:subject:date:message-id:reply-to

:content-type;

bh=ARrCOozyN6Qh1FlKclQkEOx6He0MstnsEcSEj5+w6l0=;

b=Z2WcSlnM07H4E4EdDPuzqsk2LX3z5axMDUIrcMpUfNBaCTj3xydhvp8HyiwNlzqBPo

qva5c1TPnBKIyRj8KwtdkizwNsmAnVhQLTh7ZMW+zfxA+8nppR3qrkMRJf5hkDzNTyYC

C/TxMXKY2EThgGgCS7rYHAPZUKxUC7b6K2rMg=

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20251104; t=1787400189; x=1788004989;

h=content-type:to:subject:message-id:date:reply-to:from:sender

:mime-version:x-gm-gg:x-gm-message-state:from:to:cc:subject:date

:message-id:reply-to:content-type;

bh=ARrCOozyN6Qh1FlKclQkEOx6He0MstnsEcSEj5+w6l0=;

b=YamQVgWSXa13XYrGQYlPOtmOtdi+4UUUrTo/ylhoM6haVlI+p34nsetRTlqn8D3Pkf

fvaqU/ygcpeZx9yof+xUWNLizdeMDpb64KWh9dFev+oZUjyAkogGytMQRAgM58JuB8RK

SVOjH2Dl/Vml7ZO0BRBet2/Hz+o20i4U8j8H/AWbGfGuMthtp2IDVEDuY5w3JKcYKJtx

KS0rdGhoJMhyL4YFsnUxL/qfcVTQ64L3HnOI0lN5pWMTAzGyeVkqjmrRG03I1D78X+6R

+aAlj3IxIVm9HVl+PJo5uJUI9jDFQuOceYGJ+npk40HYzREi7Q8lHR2JQtikvjIbpgiE

zbMQ==

X-Gm-Message-State: AFuF++kV5e4BCgMoEF7AcTULg4sfoyvjHYUo1Ej2m+t238TvrOfslKF5

3q0uxWi6vwROKePQ4KHuToxvHQJKK6freQn/PbYXEUkDGivdgf/3oqOnIP4CSds6F3TKh5RfBB5

wB9YvlCBxZf/9EN79f5Kky7Yk8dmZ960S50r2CntCrr84BU1C+mTpYU3Z

X-Gm-Gg: AR+sD10rmkdf2R616X/mOoyGgPHCz5/MV346xvj7R94DNn1BgLWoDbcs1xcaDWLXdjG

VMxNVp6CbWEMRCCfseqSgsJNFmFK2TDRzULeeI0p4Y9njtz33KXjX6yVgEwDB58hFI/ugROZ+s9

zOYb1fHgOWENApT8QwOBJqSEj0ti93IQrNUV6vj5HgZ+mY5GrAuYFr/0EMP+pCCm4/K/znGRNLb

51zD9sn3rlWfVQaanXXHZU22ruGnxms7T4AGiusQi1BxxXS4fLnN/FbM0U80TTSSKe1sRMkCLuu

M9YMmJzzz0UuoKDZZBz0JhXse4EAd/N1E+8Xo65OJRRpLMVTjyvR2HYjVAK246SrD2LSEvipTOJ

pO/+kyncri2QP0J+wzVgfKtVT8Ig6I6pXoqU6Hv/4A/h2k57C6Fvu410w8eM=

X-Received: by 2002:a05:651c:a0a:b0:39a:da70:2c83 with SMTP id

38308e7fff4ca-3a1c1e211f0mr12316531fa.7.1787400188442; Sat, 22 Aug 2026

05:03:08 -0700 (PDT)

Received: from 52669349336 named unknown by gmailapi.google.com with HTTPREST;

Sat, 22 Aug 2026 07:03:07 -0500

Received: from 52669349336 named unknown by gmailapi.google.com with HTTPREST;

Sat, 22 Aug 2026 05:03:06 -0700

MIME-Version: 1.0

Sender: Jeff Marsh

From: Jeff Marsh

Reply-To: sales@converthink.com

Date: Sat, 22 Aug 2026 07:03:07 -0500

X-Google-Sender-Auth: 2xu06FoARBfpubezedjOLI-QG8M

X-Gm-Features: AcwNN1Wy9H1JmL9tveZSVoIAQXfhQA2Km7DHcJ6Kch_5ozTMaMJ9_z7zhae-xP8

Message-ID:

Subject: A quick note about nk.ca

To: Sales

Content-Type: multipart/alternative; boundary="0000000000004dc2eb0659a1898c"

--0000000000004dc2eb0659a1898c

Content-Type: text/plain; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable

Hi nk.ca

1msQxqtGEYqw1IhkalopoAGpr6XwiNRwLOasZ46AsPTqE_Kl9U0_ElVfeWx9kLpHUTr_xBAhXjJ=

kkSRgJO3S-CPuaD0o6D1aURGB71-98jqqlQKINLWrwErW6-ykajdahP86OY_BRg8pzw>

,

I came across nk.ca

QtOydtKDw6LXtoxnalopoAEwpXY_gavq6hZpWmJXdO7H_iAwXi80a_flxoLVzuraepC4s_WKIzU=

8a5chTCkpHMGKMDO00vX6qVPmfm4meETBd7H-jzH8wtUDmhti2Nnb1THElyoP2ugjPg>

today and spent some time looking through the pages.

I noticed the SEO areas need attention and affect the pages to appear in

search results.

I wanted to point this out because these areas can be addressed with the

right changes.

If you=E2=80=99d like, I can share the specific points I found. Just reply =

Yes to

this email, and I=E2=80=99ll send them over.

If it's more convenient, you can also share your WhatsApp Number, for more

and quick communication.

Best Regards,

Jeff Marsh

Business Manager

Note: - Our next conversation will be on my corporate Email ID. If this is

something you are interested in, please respond to this email. If this is

not your interest, don't worry, we will not email you again.

[image: beacon]

--0000000000004dc2eb0659a1898c

Content-Type: text/html; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable

a3-b154cefc5b6c">

gin-bottom:0pt">
);font-family:Calibri,sans-serif;font-size:12pt;font-weight:700;white-space=

:pre-wrap">Hi
bSsM84fzmsgWlIMUilJw64RI1msQxqtGEYqw1IhkalopoAGpr6XwiNRwLOasZ46AsPTqE_Kl9U0=

_ElVfeWx9kLpHUTr_xBAhXjJkkSRgJO3S-CPuaD0o6D1aURGB71-98jqqlQKINLWrwErW6-ykaj=

dahP86OY_BRg8pzw" rel=3D"nofollow">nk.ca,

e=3D"line-height:1.2;margin-top:0pt;margin-bottom:0pt">
ght:normal">

0pt;margin-bottom:0pt">
ns-serif;color:rgb(0,0,0);background-color:transparent;font-weight:400;font=

-style:normal;font-variant:normal;text-decoration:none;vertical-align:basel=

ine;white-space:pre-wrap">I came across
t;font-family:Calibri,sans-serif;color:rgb(0,0,0);background-color:transpar=

ent;font-weight:700;font-style:normal;font-variant:normal;text-decoration:n=

one;vertical-align:baseline;white-space:pre-wrap">
ech-dot-yamm-track.appspot.com/224eNd3JbhBPxeevSGZeXnErvP25kQtOydtKDw6LXtox=

nalopoAEwpXY_gavq6hZpWmJXdO7H_iAwXi80a_flxoLVzuraepC4s_WKIzU8a5chTCkpHMGKMD=

O00vX6qVPmfm4meETBd7H-jzH8wtUDmhti2Nnb1THElyoP2ugjPg" rel=3D"nofollow">nk.c=

a
lor:rgb(0,0,0);background-color:transparent;font-weight:400;font-style:norm=

al;font-variant:normal;text-decoration:none;vertical-align:baseline;white-s=

pace:pre-wrap"> today and spent some time looking through the pages.=

t">

-height:1.2;margin-top:0pt;margin-bottom:0pt">
;font-family:Calibri,sans-serif;color:rgb(0,0,0);background-color:transpare=

nt;font-weight:400;font-style:normal;font-variant:normal;text-decoration:no=

ne;vertical-align:baseline;white-space:pre-wrap">I noticed the SEO areas ne=

ed attention and affect the pages to appear in search results.

dir=3D"ltr" style=3D"line-height:1.2;margin-top:0pt;margin-bottom:0pt">
style=3D"font-weight:normal">

t:1.2;margin-top:0pt;margin-bottom:0pt">
family:Calibri,sans-serif;color:rgb(0,0,0);background-color:transparent;fon=

t-weight:400;font-style:normal;font-variant:normal;text-decoration:none;ver=

tical-align:baseline;white-space:pre-wrap">I wanted to point this out becau=

se these areas can be addressed with the right changes.

"ltr" style=3D"line-height:1.2;margin-top:0pt;margin-bottom:0pt">
=3D"font-weight:normal">

;margin-top:0pt;margin-bottom:0pt">
y:Calibri,sans-serif;color:rgb(0,0,0);background-color:transparent;font-wei=

ght:400;font-style:normal;font-variant:normal;text-decoration:none;vertical=

-align:baseline;white-space:pre-wrap">If you=E2=80=99d like, I can share th=

e specific points I found. Just reply
font-family:Calibri,sans-serif;color:rgb(0,0,0);background-color:transparen=

t;font-weight:700;font-style:normal;font-variant:normal;text-decoration:non=

e;vertical-align:baseline;white-space:pre-wrap">Yes
nt-size:12pt;font-family:Calibri,sans-serif;color:rgb(0,0,0);background-col=

or:transparent;font-weight:400;font-style:normal;font-variant:normal;text-d=

ecoration:none;vertical-align:baseline;white-space:pre-wrap"> to this email=

, and I=E2=80=99ll send them over.

eight:1.2;margin-top:0pt;margin-bottom:0pt">
>

bottom:0pt">
lor:rgb(0,0,0);background-color:transparent;font-weight:400;font-style:norm=

al;font-variant:normal;text-decoration:none;vertical-align:baseline;white-s=

pace:pre-wrap">If it's more convenient, you can also share your =

0);background-color:transparent;font-weight:700;font-style:normal;font-vari=

ant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wra=

p">WhatsApp Number
sans-serif;color:rgb(0,0,0);background-color:transparent;font-weight:400;fo=

nt-style:normal;font-variant:normal;text-decoration:none;vertical-align:bas=

eline;white-space:pre-wrap">, for more and quick communication.

<=

p dir=3D"ltr" style=3D"line-height:1.2;margin-top:0pt;margin-bottom:0pt">
style=3D"font-weight:normal">

ht:1.2;margin-top:0pt;margin-bottom:0pt">
-family:Calibri,sans-serif;color:rgb(0,0,0);background-color:transparent;fo=

nt-weight:700;font-style:normal;font-variant:normal;text-decoration:none;ve=

rtical-align:baseline;white-space:pre-wrap">Best Regards,

=3D"ltr" style=3D"line-height:1.2;margin-top:0pt;margin-bottom:0pt">
tyle=3D"font-size:12pt;font-family:Calibri,sans-serif;color:rgb(0,0,0);back=

ground-color:transparent;font-weight:700;font-style:normal;font-variant:nor=

mal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap">
=

gb(0,0,0);background-color:transparent;font-weight:700;font-style:normal;fo=

nt-variant:normal;text-decoration:none;vertical-align:baseline;white-space:=

pre-wrap">Jeff Marsh

in-top:0pt;margin-bottom:0pt">
ibri,sans-serif;color:rgb(0,0,0);background-color:transparent;font-weight:7=

00;font-style:normal;font-variant:normal;text-decoration:none;vertical-alig=

n:baseline;white-space:pre-wrap">Business Manager

style=3D"line-height:1.2;margin-top:0pt;margin-bottom:0pt">
-weight:normal">

top:0pt;margin-bottom:0pt">
i,sans-serif;color:rgb(0,0,0);background-color:transparent;font-weight:400;=

font-style:normal;font-variant:normal;text-decoration:none;vertical-align:b=

aseline;white-space:pre-wrap">Note: - Our next conversation will be on my c=

orporate Email ID. If this is something you are interested in, please respo=

nd to this email. If this is not your interest, don't worry, we will no=

t email you again.

-top:0pt;margin-bottom:0pt">
ri,sans-serif;color:rgb(0,0,0);background-color:transparent;font-weight:400=

;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:=

baseline;white-space:pre-wrap">=C2=A0

e-height:1.2;margin-top:0pt;margin-bottom:0pt">

erchange-newline">

semaLiVkD6IoqQ8FHx6-JayY7xealopoAFlE-gtXgVMujrQqQY5rCMNQsdgscxzii7SaO57s6E-=

qiNeYocZ_dn5e6YoGglCxqc-WMpzwIir4vQVDFnbr_1xq58wLQf7t4sZH_kcfjehM9IALg" wid=

th=3D"1" height=3D"1" alt=3D"beacon" style=3D"display:none; display:none!im=

portant;">

--0000000000004dc2eb0659a1898c--

Chinese products spam

Posted by Dave Yadallee on Saturday, August 22. 2026

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Fri, 21 Aug 2026 23:06:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.100 (FreeBSD))

(envelope-from )

id 1wxdvM-00000000E0n-1pgy

for dave@doctor.nl2k.ab.ca;

Fri, 21 Aug 2026 23:05:44 -0600

Resent-From: The Doctor

Resent-Date: Fri, 21 Aug 2026 23:05:44 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-m158132.netease.com ([47.251.158.132]:38854)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.100 (FreeBSD))

(envelope-from )

id 1wxcV2-000000001iS-3Mwj

for sales@nk.ca;

Fri, 21 Aug 2026 21:34:44 -0600

Content-Type: multipart/mixed; BOUNDARY="=_Part_258855_631013743.1787369605805"

To: sales

Subject: =?UTF-8?B?T2lsIEZyYWdyYW5jZSBoaWdoIHF1YWxpdHkgaG90ZWwgc2hhbXBvbyBzaG93ZXIgZ2VsIGNvbmRpdGlvbmVy?=

X-Priority: 3

MIME-Version: 1.0

Received: from emily@ylhotelsupply.com( [10.139.4.160] ) by ajax-webmail ( [127.0.0.1] ) ; Sat, 22 Aug 2026 11:33:25 +0800 (GMT+08:00)

From: Emily

Date: Sat, 22 Aug 2026 11:33:25 +0800 (GMT+08:00)

X-WM-Tid: 0aa02787c85cd068kusy5221c6a14b08f

Message-ID:

Subject:

Oil Fragrance high quality hotel shampoo shower gel conditioner

From:

Emily

Date:

8/21/26, 21:33

To:

sales

Good day General Manager and Purchasing,

Have you considered offering the most popular oil fragrance hotel shampoo shower gel conditioner body lotion?

Every guest is speaking highly our range of attached picture and admit this is most nicest range that they like.

It has 380ml and 50ml range, etc. Different dispenser bottles and sizes are available. What's more, our cost is very attractive.

Wall mounted brackets are in ABS material and stainless steel. Single, double and triple brackets can be sold by carton.

Dental kit, shaving kit, vanity kit, shower cap, sewing kit, loofah, comb, sanitary bag, pen, pencil, hotel slipper, laundry bag, tea tray, rubbish bin, toilet paper, tissue paper are offered with world's most updated design and cheap cost.

International shipping service is offered as well!

Kindest regards,

Emily

Yuelong Hotel Amenities

www.yuelonghotelamenities.com

Mobile/WeChat/Whatsapp:0086-13480795524

20250716155454 (47).jpg

20250716155454 (52).jpg

20250716155454 (54).jpg

20250716155454 (55).jpg

20250716155454 (60).jpg

20250716155454 (70).jpg

20250716155454 (74).jpg

20250716155454 (78).jpg

20250716155454 (91).jpg

Sugarcane Paper box set.jpg

20251225161450_513_109.jpg

20251225161439_509_109.jpg

20251225161442_510_109.jpg

20251225161448_512_109.jpg

Attachments:

20250716155454 (47).jpg 41.8 KB

20250716155454 (52).jpg 76.6 KB

20250716155454 (54).jpg 65.9 KB

20250716155454 (55).jpg 71.3 KB

20250716155454 (60).jpg 367 KB

20250716155454 (70).jpg 68.6 KB

20250716155454 (74).jpg 52.1 KB

20250716155454 (78).jpg 72.5 KB

20250716155454 (91).jpg 44.9 KB

Sugarcane Paper box set.jpg 90.4 KB

20251225161450_513_109.jpg 64.0 KB

20251225161439_509_109.jpg 132 KB

20251225161442_510_109.jpg 142 KB

20251225161448_512_109.jpg 167 KB

Casino spam from Google Gmail

Posted by Dave Yadallee on Saturday, August 22. 2026

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Fri, 21 Aug 2026 19:51:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.100 (FreeBSD))

(envelope-from )

id 1wxasb-000000004H3-0RBk

for dave@doctor.nl2k.ab.ca;

Fri, 21 Aug 2026 19:50:41 -0600

Resent-From: The Doctor

Resent-Date: Fri, 21 Aug 2026 19:50:41 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-ua1-f70.google.com ([209.85.222.70]:44045)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.100 (FreeBSD))

(envelope-from )

id 1wxZ3V-00000000PXB-3lO6

for root@nk.ca;

Fri, 21 Aug 2026 17:53:57 -0600

Received: by mail-ua1-f70.google.com with SMTP id a1e0cc1a2514c-97bf8f6b90cso230396241.0

for ; Fri, 21 Aug 2026 16:53:02 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=beaconite.edu.pk; s=google; t=1787356376; x=1787961176; darn=nk.ca;

h=content-type:to:from:subject:date:message-id:mime-version:from:to

:cc:subject:date:message-id:reply-to:content-type;

bh=oO+q9f7AMDQ1B9aa90OWtB+/EfJJ1vJ0XK5BMbOThaQ=;

b=GH/ChvvhdjJJMjyDfzw9I68CDAqxy8PQn420VtGr/RjPxRbI+CLux+e/a5axzpvmlC

tRU76w+kFsKoDbQhhiwpIQfIi7NIRb3mc2v/JH+/hfRvMKWdOzuqxt9Sc2QoDLQ3q248

o0FVzu7rRHNvDOl8jGcR/MPu7G42mP3P7ilf5kX6OjAbEQd0POOqWKWr+D5d5KJs++4b

ZnSjTCx7bXBvHAUaljzdez0eKtt5kmhj2uC5t/+/5fr2IeXnxLID4gTsH5X90lIiWao7

jDiKr8ppECIjFwaQfBZyXtyMcDr0RtkXMvKkBtScLZ5Dyp5qaCEIfaIlQmSmP9lT3EBc

9qiA==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20251104; t=1787356376; x=1787961176;

h=content-type:to:from:subject:date:message-id:mime-version

:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to

:content-type;

bh=oO+q9f7AMDQ1B9aa90OWtB+/EfJJ1vJ0XK5BMbOThaQ=;

b=AMGmalZXki20anbRHKbiD0xWMzvwwHTPKr+//kH1mUX+jd4VvVfmkzsKBLubwlcexE

aOwfY8O/S3X2LTgTfxw7/Z5O4quGO6gkYLKVfKnDHbE29n0olNMZp3xySQCvfg+SAPK0

zEqLV+PDyTV3nC1vsNuRuFnfMCc2SONmScQmLqXgnRpuJJwKWXU5QYj3hLB++UzdAqLz

Ri2ds09nHTc79NFjtGnZYV/ufErhAHyi8l4Det+wXbI9m86wPEdYZnc1/snMVT27q48r

0zIun48Lc9/nsvZFL4Zhih8CHILHyxofh+QIF2t5nezGDoFexfpNVw0ijODDcoYkFwjP

FwCA==

X-Gm-Message-State: AFuF++lrSBOUGZ8sEAzdoOwDE1umKNPYsCJOOP5xS9f0EHrN5OowdKrt

pX9+An8rOQcXjmqFfnNNS70r33wUW8dADGI4+p7Cf+vXPST6Lt9qFyDivjOkKc7AJ3HLo1ZWWc/

ZpBd6syJTNVq5/hUbwRxVzw==

MIME-Version: 1.0

X-Received: by 2002:a05:6102:5087:b0:77a:7cd:8481 with SMTP id

ada2fe7eead31-77a634526aamr3469871137.4.1787356375900; Fri, 21 Aug 2026

16:52:55 -0700 (PDT)

Message-ID:

Date: Fri, 21 Aug 2026 23:52:55 +0000

Subject: =?UTF-8?Q?Your_1000=25_Welcome_Match_is_ready_=E2=80=94_up_to_C=2415=2C000?=

From: Rivo Rewards

To: root@nk.ca

Content-Type: multipart/alternative; boundary="000000000000df78ca06599755a9"

X-Spam_score: 8.3

X-Spam_score_int: 83

X-Spam_bar: ++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.

Content preview: Your 1000% Welcome Match is sitting in your account â€” up

to C$15,000. Follow the fox and claim it before it resets. RIVO FOLLOW THE

FOX Your Welcome Package is ready

Content analysis details: (8.3 points, 5.0 required)

pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[209.85.222.70 listed in will-spam-for-food.eu.org]

[209.85.222.70 listed in will-spam-for-food.eu.org]

[209.85.222.70 listed in will-spam-for-food.eu.org]

[209.85.222.70 listed in will-spam-for-food.eu.org]

[209.85.222.70 listed in will-spam-for-food.eu.org]

[209.85.222.70 listed in will-spam-for-food.eu.org]

[209.85.222.70 listed in will-spam-for-food.eu.org]

[209.85.222.70 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[209.85.222.70 listed in dnsbl.ahbl.org]

[209.85.222.70 listed in dnsbl.ahbl.org]

[209.85.222.70 listed in dnsbl.ahbl.org]

[209.85.222.70 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[209.85.222.70 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[209.85.222.70 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[209.85.222.70 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[209.85.222.70 listed in dnsbl.ahbl.org]

2.5 URIBL_DBL_SPAM Contains a spam URL listed in the DBL blocklist

[URI: 358-casino.co]

0.0 URIBL_RED Contains an URL listed in the URIBL redlist

[URI: 358-casino.co]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[209.85.222.70 listed in list.dnswl.org]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-0.0 SPF_PASS SPF: sender matches SPF record

1.0 OPT_OUT BODY: No description available.

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[209.85.222.70 listed in wl.mailspike.net]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[209.85.222.70 listed in bl.score.senderscore.com]

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

1.0 J_BACKHAIR_27 RAW: 2 alpha-tag-7 alpha

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

0.0 LOTS_OF_MONEY Huge... sums of money

2.0 RATWR8_MESSID Message-ID with excessive dashes and dollars

0.8 SARE_FROM_SPAM_WORD3 I don't know people named this!

Subject: {SPAM?} =?UTF-8?Q?Your_1000=25_Welcome_Match_is_ready_=E2=80=94_up_to_C=2415=2C000?=

--000000000000df78ca06599755a9

Content-Type: text/plain; charset="UTF-8"; format=flowed; delsp=yes

Content-Transfer-Encoding: base64

WW91ciAxMDAwJSBXZWxjb21lIE1hdGNoIGlzIHNpdHRpbmcgaW4geW91ciBhY2NvdW50IOKAlCB1

cCB0byBDJDE1LDAwMC4gIA0KRm9sbG93IHRoZSBmb3ggYW5kIGNsYWltIGl0IGJlZm9yZSBpdCBy

ZXNldHMuDQoNCg0KDQoNClJJVk8NCkZPTExPVyBUSEUgRk9YDQoNCg0KDQpZb3VyIFdlbGNvbWUg

UGFja2FnZSBpcyByZWFkeQ0KDQpBIDEwMDAlIG1hdGNoIGlzDQp3YWl0aW5nIG9uIHlvdXIgZmly

c3QgZGVwb3NpdA0KDQoNCg0KdXAgdG8gQyQxNSwwMDANCg0KKyB5b3VyIGZ1bGwgU2xvdHMgV2Vs

Y29tZSBQYWNrYWdlDQoNCg0KDQpIZXJlJ3MgdGhlIHNpbXBsZSBwYXJ0Lg0KDQpNYWtlIHlvdXIg

Zmlyc3QgZGVwb3NpdCBhbmQgUml2byBtdWx0aXBsaWVzIGl0IGJ5IHRlbi4gRGVwb3NpdCBDJDUw

LCBwbGF5ICANCndpdGggQyQ1NTAuIFRoYXQncyBodW5kcmVkcyBvZiBleHRyYSBzcGlucyBhY3Jv

c3MgdGhlIHNsb3RzIGFuZCBsaXZlIHRhYmxlcyAgDQrigJQgb24gdGhlIGhvdXNlLg0KDQpUaGUg

Zm94IGFscmVhZHkga25vd3Mgd2hlcmUgdGhlIGdvb2QgZ2FtZXMgYXJlLiBGb2xsb3cgaGltIGlu

IGFuZCBzZWUgd2hlcmUgIA0KeW91ciBuZXh0IHNwaW4gbGFuZHMuDQoNCg0KDQoNCkNsYWltIG15

IDEwMDAlIGJvbnVzIOKGkg0KDQoNCk5ldyBwbGF5ZXJzIG9ubHkgwrcgMTgrIMK3IFRha2VzIHVu

ZGVyIDIgbWludXRlcw0KDQoNCg0KDQoNCg0KVGhlbiBldmVyeSB3ZWVrZW5kDQoNCkZvcnR1bmUg

VmF1bHQgRnJpZGF5DQoNCkEgMjAwJSBib251cyB1cCB0byBDJDMsMDAwIHRvIHJlbG9hZCBhbmQg

a2VlcCB0aGUgcmVlbHMgc3Bpbm5pbmcgaW50byB0aGUgIA0Kd2Vla2VuZC4NClN0YXJ0IHBsYXlp

bmcgYXQgUml2byDihpINCg0KDQpPZmZlciBmb3IgbmV3IHBsYXllcnMgb25seSwgMTgrLiBHYW1i

bGluZyBpcyBhIGZvcm0gb2YgZW50ZXJ0YWlubWVudCwgbm90IGEgIA0Kd2F5IHRvIG1ha2UgbW9u

ZXkuIFBsZWFzZSBwbGF5IHJlc3BvbnNpYmx5LiBJZiBnYW1ibGluZyBzdG9wcyBiZWluZyBmdW4g

4oCUICANCmFuIHVyZ2UgdG8ga2VlcCBwbGF5aW5nLCBjaGFzaW5nIGxvc3Nlcywgb3IgYm9ycm93

aW5nIHRvIHBsYXkg4oCUIGhlbHAgaXMgIA0KYXZhaWxhYmxlLiBUZXJtcyBhbmQgd2FnZXJpbmcg

cmVxdWlyZW1lbnRzIGFwcGx5Lg0KDQoNCg0KWW91IGFyZSByZWNlaXZpbmcgdGhpcyBiZWNhdXNl

IHlvdSBvcHRlZCBpbiB0byBvZmZlcnMgbGlrZSB0aGlzIG9uZS4NCg0KVW5zdWJzY3JpYmUgwrcg

T3B0IG91dCBvZiBhbGwgZnV0dXJlIGVtYWlscw0KDQoNCg0KDQo=

--000000000000df78ca06599755a9

Content-Type: text/html; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable

w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

0"/>

Rivo

=3D"0" style=3D"background:#0d0b14;">

g=3D"0" cellspacing=3D"0" style=3D"width:600px;max-width:600px;background:#=

15111f;border:1px solid #2a2136;border-radius:16px;overflow:hidden;">

#241b31;" align=3D"center">

26px;font-weight:700;letter-spacing:5px;color:#f6c945;">RIVO

ing:2px;color:#8a7fa6;margin-top:4px;">FOLLOW THE FOX

ter">

:700;letter-spacing:3px;color:#c9a24b;text-transform:uppercase;">Your Welco=

me Package is ready

f;font-size:38px;line-height:44px;font-weight:800;color:#ffffff;margin:14px=

0 6px 0;">A 1000% match is
waiting on your first deposit

x;">

if;font-size:52px;line-height:56px;font-weight:800;color:#f6c945;">up to C$=

15,000

d0;margin-top:4px;">+ your full Slots Welcome Package

t">

5px;color:#d9d2ea;margin:0 0 16px 0;">Here’s the simple part.

5px;color:#d9d2ea;margin:0 0 16px 0;">Make your first deposit and Rivo mult=

iplies it by ten. Deposit C$50, p=

lay with C$550. That’s hundreds of extra spins across the slots and l=

ive tables — on the house.

5px;color:#d9d2ea;margin:0 0 4px 0;">The fox already knows where the good g=

ames are. Follow him in and see where your next spin lands.

der-radius:40px;background:#f6c945;">

=3D"_blank" style=3D"display:inline-block;padding:16px 46px;font-family:'Tr=

ebuchet MS',Arial,sans-serif;font-size:18px;font-weight:800;color:#1a1206;t=

ext-decoration:none;border-radius:40px;letter-spacing:0.5px;">Claim my 1000=

% bonus →

a6;margin-top:12px;">New players only · 18+ · Takes under 2 m=

inutes

1px;background:#241b31;line-height:1px;font-size:0;">

">

:700;letter-spacing:2px;color:#c9a24b;text-transform:uppercase;">Then every=

weekend

2px;font-weight:800;color:#ffffff;margin:8px 0 4px 0;">Fortune Vault Friday=

3px;color:#c7bfdd;margin:0 0 18px 0;">A 20=

0% bonus up to C$3,000 to reload and keep the reels spinning into =

the weekend.

_blank" style=3D"font-family:Arial,sans-serif;font-size:15px;font-weight:70=

0;color:#f6c945;text-decoration:underline;">Start playing at Rivo →
>

t">

8px;color:#6f6689;margin:0;">Offer for new players only, 18+. Gambling is a=

form of entertainment, not a way to make money. Please play responsibly. I=

f gambling stops being fun — an urge to keep playing, chasing losses,=

or borrowing to play — help is available. Terms and wagering require=

ments apply.

x solid #241b31;" align=3D"center">

9px;color:#7b7295;margin:0 0 8px 0;">You are receiving this because you opt=

ed in to offers like this one.

9px;color:#7b7295;margin:0;">

=3D"_blank" style=3D"color:#9a90b8;text-decoration:underline;">Unsubscribe<=

/a>

·

=3D"_blank" style=3D"color:#9a90b8;text-decoration:underline;">Opt out of a=

ll future emails

ght=3D"1" alt=3D"">

--000000000000df78ca06599755a9--

German language spam from Google Gmail

Posted by Dave Yadallee on Saturday, August 22. 2026

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Fri, 21 Aug 2026 11:11:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.5 (FreeBSD))

(envelope-from )

id 1wxSlZ-00000000764-2cFk

for dave@doctor.nl2k.ab.ca;

Fri, 21 Aug 2026 11:10:53 -0600

Resent-From: The Doctor

Resent-Date: Fri, 21 Aug 2026 11:10:53 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-qt1-f179.google.com ([209.85.160.179]:60511)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.99.5 (FreeBSD))

(envelope-from )

id 1wxQEg-00000000KCk-3KgA

for doctor@doctor.nl2k.ab.ca;

Fri, 21 Aug 2026 08:28:55 -0600

Received: by mail-qt1-f179.google.com with SMTP id d75a77b69052e-51c2cce930cso9977981cf.0

for ; Fri, 21 Aug 2026 07:28:00 -0700 (PDT)

ARC-Seal: i=1; a=rsa-sha256; t=1787322474; cv=none;

d=google.com; s=arc-20260327;

b=UbJ51eKzOZHjwoS5S/bPP0Pd5o1jIKpygV7sN3ZqQJG6M339F1LzIsxqP/5xDXeyZ5

+TqwNJVvsmLXzVc9kBlyWDISyQ+HfGDigou4sF9TF+GuGU4YL/S0ich74uoSrM8Tg4zo

KvUyC4lQ21WuKwABsmMSmv/LKrFiWllZp9jHAVaLCYtsXfARJISnBGEur/xhbgQ2vXUZ

MQonB0BxFHn3jG36J30ZS2IJbXH1Dv3JMFSipVfd6zd475Czedx0bD374j6/t/16jKSE

FakIpxUx4iVkWU3d2SlT/aLdsAJsz57sGb4X6B82ucqblYz6Ai0E39k4Nirv2FN5mkW7

6YnQ==

ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20260327;

h=to:subject:message-id:date:from:reply-to:mime-version

:dkim-signature;

bh=wOX6BpqH3So5LgKt8GneAqTSTAPs09Y73IcfWrzHvV8=;

fh=pRgcWmOSOXn8W66CMFyqliyXjPcT6wOwkZfUNhmR3v4=;

b=XUf6PzdbRYslFfZCeZEmpuCWZz6eWGk5nHbo1AFGIi/qRbyW/v59kNP3K58NbWIDJq

ggSqHk28RSkr+Q+zxqfNU6FXxF6g3cliW4eKvJHrnEluhf6oZTlTsd6mRyR8tlfYg/fb

rABG2WajM2xC9jSlBAhMof8DhMZPy0/AbAO+tdXqyZBxW5+at14qL9I1ajxcbUGIH97v

TxTzJcgQC5nAXs71Ki2+GM0/CBmEReqEMQPmyHbkEtJEICK2YYqie3I6oYkQBq8Etch+

Jpe1ZhDJeItAk5tHq2giy8OR4zy+iO1jH4BEjijrk3ETavQub4Y8nydArR1KZ4t13GO/

zoAg==;

darn=doctor.nl2k.ab.ca

ARC-Authentication-Results: i=1; mx.google.com; arc=none

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=gmail.com; s=20251104; t=1787322474; x=1787927274; darn=doctor.nl2k.ab.ca;

h=content-type:to:subject:message-id:date:from:reply-to:mime-version

:from:to:cc:subject:date:message-id:reply-to:content-type;

bh=wOX6BpqH3So5LgKt8GneAqTSTAPs09Y73IcfWrzHvV8=;

b=O2j6weRUuCWtKfW6jTyt3gke4Nvr86jJb7dtKu3SQtcslVcBMxQv6RkKeBo+ZVbnTQ

qC2C4wQXBU4NkFMDSwPN+gdpQc32uR+geLMWxReiLtaVqnJfWUcV4iDIk+vdZiUQGwwP

lg7QAq4MjPocjRNtBUXQPYV4iD6z3DqATN0bIJhNFmCoisAfwNAJFsf+n30yB1OYFGLg

BevWYVZlwhejPDKGT+2gUd7o2FuJuugNUFQW3I914I2MobZ+kO3MGrgef9R59lJl92bG

LMx2KFUxY9L7kKp7gtJx1+8XwANwCRaw1K12OJ6fFbM0wSWjerGBnX5BR1GNk0gpo6LS

Fb0g==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20251104; t=1787322474; x=1787927274;

h=content-type:to:subject:message-id:date:from:reply-to:mime-version

:x-gm-gg:x-gm-message-state:from:to:cc:subject:date:message-id

:reply-to:content-type;

bh=wOX6BpqH3So5LgKt8GneAqTSTAPs09Y73IcfWrzHvV8=;

b=RZijhQKo4OqyhqHWiFXa/SL//pQ+GDti5OzTSqB8RulQygasaUt+F3Miwx773kSauv

IcpGbncc9hH+ZquPRvfHmWNDKcBjOdmY3hdzWEVrUfCaQHpX0tXJNOxMfveuoIO5mdvp

DgDRIqpWR8giNIMZ8qQJKjCH1L64Zv1Of3viu8XGcTdD1wSiC5bSZCYiNmlv724FuJZv

saqlufYczEDPth6LPFy6BUlZ1pfX3xOaVzGnTt02xunROmzp4yXIFnxV/MBbw3aQlOKJ

IE/XeEaKakJOm9MuwaLeHW66ytcOaMaBPd0Ye3u0hW7Y/v9gveE5/g/xbH1Cttq/5d4d

Gs3g==

X-Forwarded-Encrypted: i=1; AHgh+RpJ1LYcPVYosMoW9MoD7WPLeePQspsa/3EwEZev8RfmkyYEVmCGYC5CcJ6aPI153Nqm1fb1Oiw=@doctor.nl2k.ab.ca

X-Gm-Message-State: AOJu0Yw54BiAQnsg3JAWq+5imfA5Bu1u/0+JXu1vNEod3MkVVe9cCUag

bBOv3vk/wPiJOSv2UIB0rJeWqSr11GQHHrl9ghmxzSQ177YDGQ5kf0w0anR5BqU301okyXciEG3

lnpzzdG1cIHLxqrwvHx/m6W+VkYxqrOU=

X-Gm-Gg: AR+sD11/aggC5TF3zvkg6iOPrbZNgRAhrozwcmuI2QcMAGKDWBYPlN+1zUrMI5sYltj

aCwDNawmCORNahCarYlAGtxoR4UoG5lVgS88w6cNIXdqUu9ie1a51g5HaIrmNHzaEdHzNlaCNE4

SfFo5P8hq/QFhM+2U+muWrT5T6bdWkyywSLj9f/PUu2OlpNVpitoOywLwLq9o5K/wDaIIrtm5vQ

+DEOU6MgH89QD4nmdDSZdTqWP9RhOWgUYI6pC8qbS0vlLt8exxD/1yt8q+himhy9zlNUkWoDvoj

tEmkIdqQfXv5BdG/E4JV4iLW6n0y+HwSVgLrg5Zo3ZUi8eGIl8jLkZhwjk2FTcsWrjfhr16aa/U

j62Xp1tTu3Rro9g6tdOdzqCgYgw==

X-Received: by 2002:ac8:5895:0:b0:51a:8b64:69e2 with SMTP id

d75a77b69052e-52df56315e4mr61207541cf.7.1787322473469; Fri, 21 Aug 2026

07:27:53 -0700 (PDT)

MIME-Version: 1.0

Reply-To: ubabankafrican205@gmail.com

From: "Mrs. Kristalina"

Date: Fri, 21 Aug 2026 14:28:39 -0700

X-Gm-Features: AcwNN1W5TtBxxJ362fItgGqTaEQ4li_84XiAyexq40pJDeg93AW5GQl145oHac4

Message-ID:

Subject: ACHTUNG. LIEBER E-MAIL-INHABER

To: ikechukwu7020@gmail.com

Content-Type: multipart/alternative; boundary="0000000000002161c106598f71ad"

Bcc: doctor@doctor.nl2k.ab.ca

X-Spam_score: 7.4

X-Spam_score_int: 74

X-Spam_bar: +++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.

Content preview: *Sehr geehrte/r FondsempfÃ¤nger/in,ich habe Ihnen dieses Schreiben

vor einem Monat zugesandt, aber da ich keine RÃ¼ckmeldung erhalten habe,

bin ich mir nicht sicher, ob es angekommen ist. Daher wieder [...]

Content analysis details: (7.4 points, 5.0 required)

pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[209.85.160.179 listed in will-spam-for-food.eu.org]

[209.85.160.179 listed in will-spam-for-food.eu.org]

[209.85.160.179 listed in will-spam-for-food.eu.org]

[209.85.160.179 listed in will-spam-for-food.eu.org]

[209.85.160.179 listed in will-spam-for-food.eu.org]

[209.85.160.179 listed in will-spam-for-food.eu.org]

[209.85.160.179 listed in will-spam-for-food.eu.org]

[209.85.160.179 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[209.85.160.179 listed in dnsbl.ahbl.org]

[209.85.160.179 listed in dnsbl.ahbl.org]

[209.85.160.179 listed in dnsbl.ahbl.org]

[209.85.160.179 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[209.85.160.179 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[209.85.160.179 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[209.85.160.179 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[209.85.160.179 listed in dnsbl.ahbl.org]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[209.85.160.179 listed in list.dnswl.org]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-0.0 SPF_PASS SPF: sender matches SPF record

1.6 SUBJ_ALL_CAPS Subject is all capitals

0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in digit

[ubabankafrican205(at)gmail.com]

1.0 FORGED_GMAIL_RCVD 'From' gmail.com does not match 'Received' headers

0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider

[bagwelmickael(at)gmail.com]

0.0 DATE_IN_FUTURE_06_12 Date: is 6 to 12 hours after Received: date

0.6 J_CHICKENPOX_63 BODY: 6alpha-pock-3alpha

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[209.85.160.179 listed in bl.score.senderscore.com]

-0.0 RCVD_IN_MSPIKE_H3 RBL: Good reputation (+3)

[209.85.160.179 listed in wl.mailspike.net]

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

-0.0 RCVD_IN_MSPIKE_WL Mailspike good senders

0.0 LOTS_OF_MONEY Huge... sums of money

1.5 HK_NAME_FM_MR_MRS No description available.

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

1.0 FREEMAIL_REPLYTO Reply-To/From or Reply-To/body contain different

freemails

0.2 MONEY_FREEMAIL_REPTO Lots of money from someone using free email?

Subject: {SPAM?} ACHTUNG. LIEBER E-MAIL-INHABER

--0000000000002161c106598f71ad

Content-Type: text/plain; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable

Sehr geehrte/r Fondsempf=C3=A4nger/in,ich habe Ihnen dieses Schreiben vor =

einem

Monat zugesandt, aber da ich keine R=C3=BCckmeldung erhalten habe, bin ich =

mir

nicht sicher, ob es angekommen ist. Daher wiederhole ich: Ich bin

Kristalina Georgieva, CEO und Pr=C3=A4sidentin des Internationalen

W=C3=A4hrungsfonds.Wir haben alle Hindernisse und Probleme im Zusammenhang =

mit

Ihrer unvollst=C3=A4ndigen Transaktion und Ihrer Unf=C3=A4higkeit, die Ihne=

n f=C3=BCr

fr=C3=BChere =C3=9Cberweisungen berechneten Geb=C3=BChren zu begleichen, ge=

pr=C3=BCft. Bitte

besuchen Sie unsere Website zur Best=C3=A4tigung (38=C2=B053=E2=80=B256=E2=

=80=B3N 77=C2=B02=E2=80=B239=E2=80=B3W).Wir, der

Verwaltungsrat der Weltbank und des Internationalen W=C3=A4hrungsfonds (IWF=

) in

Washington, D.C., zusammen mit dem US-Finanzministerium und einigen anderen

relevanten Forschungseinrichtungen in den Vereinigten Staaten von Amerika,

haben unsere Abteilung f=C3=BCr Auslands=C3=BCberweisungen, die United Bank=

of Africa

in Lom=C3=A9, Togo, angewiesen, Ihnen eine VISA-Karte auszustellen, auf die=

Ihr

Fonds in H=C3=B6he von 1.500.000,00 USD f=C3=BCr eine sp=C3=A4tere Abhebung=

geladen

wird.Im Zuge unserer Untersuchung stellten wir mit Bedauern fest, dass Ihre

Zahlung unn=C3=B6tigerweise durch korrupte Bankangestellte verz=C3=B6gert w=

urde, die

versuchten, Ihr Geld auf ihre Privatkonten umzuleiten.Wir m=C3=B6chten Sie =

heute

dar=C3=BCber informieren, dass Ihr Guthaben von der UBA Bank Ihrer VISA-Kar=

te

gutgeschrieben wurde und zur Auslieferung bereitsteht. Bitte kontaktieren

Sie nun den Sekret=C3=A4r der UBA Bank, Herrn Joseph C. Keshi, E-Mail:

ubabankafrican205@gmail.com . Senden Sie ihm

die folgenden Informationen, damit Ihre akkreditierte VISA-Bankkarte an

Ihre Adresse geliefert werden kann.Ihr vollst=C3=A4ndiger Name

=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3DIhr Herkunftsland =

=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3DIhre Stadt

=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3DIhr Beruf =3D=3D=3D=3D=3D=3D=3D=

=3D=3D=3D=3D=3D=3D=3DIhr Reisepass/Personalausweis

=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3DIhr Alter =3D=3D=3D=3D=3D=3D=3D=

=3D=3D=3D=3D=3D=3D=3DIhre Adresse =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=

=3DIhre

Telefonnummer =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=

=3D=3D=3D=3DVerwenden Sie diesen Code (Ref:

CLIENTE-966/16) als Betreff Ihrer E-Mail zur Identifizierung und geben Sie

die oben genannten Informationen bitte an die folgenden Mitarbeiter der

Visa Multibanco-Kartenausgabe weiter:Ich werde dem Bankmitarbeiter

empfehlen, eine separate E-Mail-Adresse mit einer neuen Telefonnummer

einzurichten, um diese Zahlung und die =C3=9Cberweisungskommunikation zu

best=C3=A4tigen und so weitere Verz=C3=B6gerungen oder den Missbrauch der G=

elder zu

vermeiden. Kontaktieren Sie die United Bank for Africa jetzt unter:

ubabankafrican205@gmail.com Ansprechpartner:

Herr Oliver AlawubaAbteilung Clearing Transfer (United Bank for

Africa)E-Mail: ubabankafrican205@gmail.com Wir

erwarten dringend eine Antwort auf diese E-Mail, um weitere Verz=C3=B6gerun=

gen

zu vermeiden.Mit freundlichen Gr=C3=BC=C3=9Fen, Frau Kristalina

--0000000000002161c106598f71ad

Content-Type: text/html; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable

Sehr geehrte/r Fondsem=

pf=C3=A4nger/in,

ich habe Ihnen dieses Schreiben vor einem Monat zug=

esandt, aber da ich keine R=C3=BCckmeldung erhalten habe, bin ich mir nicht=

sicher, ob es angekommen ist. Daher wiederhole ich: Ich bin Kristalina Geo=

rgieva, CEO und Pr=C3=A4sidentin des Internationalen W=C3=A4hrungsfonds.
>
Wir haben alle Hindernisse und Probleme im Zusammenhang mit Ihrer unvo=

llst=C3=A4ndigen Transaktion und Ihrer Unf=C3=A4higkeit, die Ihnen f=C3=BCr=

fr=C3=BChere =C3=9Cberweisungen berechneten Geb=C3=BChren zu begleichen, g=

epr=C3=BCft. Bitte besuchen Sie unsere Website zur Best=C3=A4tigung (38=C2=

=B053=E2=80=B256=E2=80=B3N 77=C2=B02=E2=80=B239=E2=80=B3W).

Wir, der=

Verwaltungsrat der Weltbank und des Internationalen W=C3=A4hrungsfonds (IW=

F) in Washington, D.C., zusammen mit dem US-Finanzministerium und einigen a=

nderen relevanten Forschungseinrichtungen in den Vereinigten Staaten von Am=

erika, haben unsere Abteilung f=C3=BCr Auslands=C3=BCberweisungen, die Unit=

ed Bank of Africa in Lom=C3=A9, Togo, angewiesen, Ihnen eine VISA-Karte aus=

zustellen, auf die Ihr Fonds in H=C3=B6he von 1.500.000,00 USD f=C3=BCr ein=

e sp=C3=A4tere Abhebung geladen wird.

Im Zuge unserer Untersuchung s=

tellten wir mit Bedauern fest, dass Ihre Zahlung unn=C3=B6tigerweise durch =

korrupte Bankangestellte verz=C3=B6gert wurde, die versuchten, Ihr Geld auf=

ihre Privatkonten umzuleiten.

Wir m=C3=B6chten Sie heute dar=C3=BCb=

er informieren, dass Ihr Guthaben von der UBA Bank Ihrer VISA-Karte gutgesc=

hrieben wurde und zur Auslieferung bereitsteht. Bitte kontaktieren Sie nun =

den Sekret=C3=A4r der UBA Bank, Herrn Joseph C. Keshi, E-Mail:
ailto:ubabankafrican205@gmail.com">ubabankafrican205@gmail.com. Senden =

Sie ihm die folgenden Informationen, damit Ihre akkreditierte VISA-Bankkart=

e an Ihre Adresse geliefert werden kann.

Ihr vollst=C3=A4ndiger Name=

=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
Ihr Herkunfts=

land =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
Ihre Stadt =3D=3D=3D=3D=

=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
Ihr Beruf =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=

=3D=3D=3D=3D
Ihr Reisepass/Personalausweis =3D=3D=3D=3D=3D=3D=3D=3D=3D=

=3D=3D=3D=3D=3D
Ihr Alter =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
=

Ihre Adresse =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
Ihre Telefonnumm=

er =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=

Verwenden Sie diesen Code (Ref: CLIENTE-966/16) als Betreff Ihrer E=

-Mail zur Identifizierung und geben Sie die oben genannten Informationen bi=

tte an die folgenden Mitarbeiter der Visa Multibanco-Kartenausgabe weiter:<=

br>
Ich werde dem Bankmitarbeiter empfehlen, eine separate E-Mail-Adress=

e mit einer neuen Telefonnummer einzurichten, um diese Zahlung und die =C3=

=9Cberweisungskommunikation zu best=C3=A4tigen und so weitere Verz=C3=B6ger=

ungen oder den Missbrauch der Gelder zu vermeiden. Kontaktieren Sie die Uni=

ted Bank for Africa jetzt unter:
com">ubabankafrican205@gmail.com
Ansprechpartner: Herr Oliver Alawub=

a
Abteilung Clearing Transfer (United Bank for Africa)
E-Mail:
f=3D"mailto:ubabankafrican205@gmail.com">ubabankafrican205@gmail.com
>Wir erwarten dringend eine Antwort auf diese E-Mail, um weitere Verz=C3=B6=

gerungen zu vermeiden.

Mit freundlichen Gr=C3=BC=C3=9Fen, Frau Krist=

alina

--0000000000002161c106598f71ad--

Dragonfly phish

Posted by Dave Yadallee on Saturday, August 22. 2026

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Fri, 21 Aug 2026 19:50:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.100 (FreeBSD))

(envelope-from )

id 1wxarh-000000003fs-39Iu

for dave@doctor.nl2k.ab.ca;

Fri, 21 Aug 2026 19:49:45 -0600

Resent-From: The Doctor

Resent-Date: Fri, 21 Aug 2026 19:49:45 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from vps.fslocal.com ([199.83.208.249]:55204)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.100 (FreeBSD))

(envelope-from )

id 1wxVbq-000000005hj-0lL8

for sales@nk.ca;

Fri, 21 Aug 2026 14:13:15 -0600

DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed;

d=laravel.perksona.com; s=default; h=MIME-Version:Date:

Content-Transfer-Encoding:Message-ID:Subject:To:From:Content-Type:Sender:

Reply-To:Cc:Content-ID:Content-Description:Resent-Date:Resent-From:

Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:In-Reply-To:References:

List-Id:List-Help:List-Unsubscribe:List-Subscribe:List-Post:List-Owner:

List-Archive; bh=LfZj7rc3TmHGvNxFzFRUld6qJTeDDYsBdOHrEbuhyds=; b=DvvlqfgZCdmQ

aaHfYLs7loLioRlnmfw+GZyU/l661zkwO36LKriNORE2Jk/aFqqOkyRm9Bap2AinES68fLegUrm3x

6MVCOQdyASMtDsrcbMLV8sW9dSUfjn/q1D2RJCmDiKpdI36Qx47VnkzP8YRXMVQSbf4YKJIz+xYYZ

jLaqwKgeWBSBcqW7Ny3fIHgaJzuspCSNeiIDen173AipKZDe0EmOO8yIV79VsbikLlTos3+tQ/ISs

BGIh3iwHEs8ujn7N3/4PoYV+ykthFBQbT9s4VchdPIY77005SKGNdcl/PRIKRK9BOFD2h/j419/TM

MOzhRh1gjFAr5vh6UUWovw==;

Received: from [196.65.208.58] (port=58289 helo=[127.0.0.1])

by vps.fslocal.com with esmtpsa (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.99.5)

(envelope-from )

id 1wxVaa-00000003KcV-1N7y

for sales@nk.ca;

Fri, 21 Aug 2026 16:12:08 -0400

Content-Type: text/html

From: Dragonfly

To: sales@nk.ca

Subject: Dragonfly Delivery Notification

Message-ID:

Content-Transfer-Encoding: quoted-printable

Date: Fri, 21 Aug 2026 20:11:41 +0000

MIME-Version: 1.0

X-AntiAbuse: This header was added to track abuse, please include it with any abuse report

X-AntiAbuse: Primary Hostname - vps.fslocal.com

X-AntiAbuse: Original Domain - nk.ca

X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12]

X-AntiAbuse: Sender Address Domain - laravel.perksona.com

X-Get-Message-Sender-Via: vps.fslocal.com: authenticated_id: info-mjqu@laravel.perksona.com

X-Authenticated-Sender: vps.fslocal.com: info-mjqu@laravel.perksona.com

X-Source:

X-Source-Args:

X-Source-Dir:

X-Spam_score: 7.8

X-Spam_score_int: 78

X-Spam_bar: +++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.

Content preview: Dragonfly Express. Dear Customer,

Content analysis details: (7.8 points, 5.0 required)

pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[196.65.208.58 listed in will-spam-for-food.eu.org]

[196.65.208.58 listed in will-spam-for-food.eu.org]

[196.65.208.58 listed in will-spam-for-food.eu.org]

[196.65.208.58 listed in will-spam-for-food.eu.org]

[196.65.208.58 listed in will-spam-for-food.eu.org]

[196.65.208.58 listed in will-spam-for-food.eu.org]

[196.65.208.58 listed in will-spam-for-food.eu.org]

[196.65.208.58 listed in will-spam-for-food.eu.org]

[199.83.208.249 listed in will-spam-for-food.eu.org]

[199.83.208.249 listed in will-spam-for-food.eu.org]

[199.83.208.249 listed in will-spam-for-food.eu.org]

[199.83.208.249 listed in will-spam-for-food.eu.org]

[199.83.208.249 listed in will-spam-for-food.eu.org]

[199.83.208.249 listed in will-spam-for-food.eu.org]

[199.83.208.249 listed in will-spam-for-food.eu.org]

[199.83.208.249 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[199.83.208.249 listed in dnsbl.ahbl.org]

[199.83.208.249 listed in dnsbl.ahbl.org]

[199.83.208.249 listed in dnsbl.ahbl.org]

[199.83.208.249 listed in dnsbl.ahbl.org]

[196.65.208.58 listed in dnsbl.ahbl.org]

[196.65.208.58 listed in dnsbl.ahbl.org]

[196.65.208.58 listed in dnsbl.ahbl.org]

[196.65.208.58 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[199.83.208.249 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[199.83.208.249 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[199.83.208.249 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[199.83.208.249 listed in dnsbl.ahbl.org]

-0.0 SPF_PASS SPF: sender matches SPF record

1.6 RCVD_IN_BRBL_LASTEXT RBL: No description available.

[199.83.208.249 listed in bb.barracudacentral.org]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

0.0 HTML_MESSAGE BODY: HTML included in message

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

1.0 VOWEL_URI_5 URI hostname with 5 consecutive vowels

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

0.8 SARE_FROM_SPAM_WORD3 I don't know people named this!

2.0 RATWR8_MESSID Message-ID with excessive dashes and dollars

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[199.83.208.249 listed in bl.score.senderscore.com]

Subject: {SPAM?} Dragonfly Delivery Notification

hidden; MAX-WIDTH: 600px; BACKGROUND: #fff; MARGIN: 20px auto; =

border-radius: 10px; box-shadow: 0 4px 8px rgba(0,0,0,.10)">

align-items: center; justify-content: center">

30px; FONT-WEIGHT: bold; COLOR: #fff; FONT-STYLE: italic">Dragonfly Express=

.

PADDING-TOP: 24px; PADDING-LEFT: 20px; PADDING-RIGHT: 20px">

DISPLAY: inline-block; PADDING-RIGHT: 6px">Dear Customer,

1.6">

Goods imported into Canada may be subject to applicable duties =

and/or taxes. Carriers are authorized by the. to process occasional =

shipments on behalf of the importer or owner and may remit applicable =

duties and taxes.

However, a parcel belonging to you has been held =

by customs due to missing declaration details from the sender. Please pay: =

4.95 CAD

in duties and taxes as soon as =

possible using the button below: taxes, or other charges are actually owed.=

href=3D"https://dragonfly-express.duckdns.org/Dragonfly_Shipping/" =

style=3D"FONT-SIZE: 14px; TEXT-DECORATION: none; BACKGROUND: #04ab94; =

FONT-WEIGHT: bold; COLOR: #fff; PADDING-BOTTOM: 10px; PADDING-TOP: 10px; =

PADDING-LEFT: 20px; DISPLAY: inline-block; PADDING-RIGHT: 20px; =

border-radius: 5px">Track my package

COLOR: #000">Thank you for choosing Dragonfly Express.

COLOR: #717171; PADDING-BOTTOM: 20px; TEXT-ALIGN: center; PADDING-TOP: =

20px; PADDING-LEFT: 20px; MARGIN: 0px auto; PADDING-RIGHT: 20px; =

border-radius: 10px; box-shadow: 0 4px 8px rgba(0,0,0,.10)">

This email was sent by an automated system=

. Please do not reply official:

Product Sourcing Inquiry from Google Gmail

Posted by Dave Yadallee on Saturday, August 22. 2026

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Fri, 21 Aug 2026 12:16:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.5 (FreeBSD))

(envelope-from )

id 1wxTlh-000000003ri-3qob

for dave@doctor.nl2k.ab.ca;

Fri, 21 Aug 2026 12:15:05 -0600

Resent-From: The Doctor

Resent-Date: Fri, 21 Aug 2026 12:15:05 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-ed1-f101.google.com ([209.85.208.101]:56642)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.99.5 (FreeBSD))

(envelope-from )

id 1wxTW3-00000000NrC-2E53

for doctor@netknow.ca;

Fri, 21 Aug 2026 11:59:05 -0600

Received: by mail-ed1-f101.google.com with SMTP id 4fb4d7f45d1cf-6a051b737d8so1834199a12.1

for ; Fri, 21 Aug 2026 10:58:07 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=nwhssasi-com.20251104.gappssmtp.com; s=20251104; t=1787335081; x=1787939881; darn=netknow.ca;

h=message-id:date:reply-to:mime-version:content-type:to:subject:from

:from:to:cc:subject:date:message-id:reply-to:content-type;

bh=YIj577gQN3gcbkCNwFCceFilc43bUo7ya+iM6grQMEk=;

b=TyedWPo71fCB4Rfp6WG0psmS5OREBkq4eF6Vw+WFP4GBL6nxb8cqfsn7nHCn4Y2dK3

s/pj8kzzPpVLLilI5hcRVD7ndjakboin2ak+COLGnr5Cp47qp5OwDGgsHnBn6tfu/jfa

efW5rbq2gX89aj20QngVxXT8XG3kSCMfqVYd2sXOoOKjQmaSQbTApgttLBfbNZrw54M2

JapnInVeuAGQVYdy73TbvA33oL5iIjwADjT7Ne2hNfv4+QEYpw/uoSBRY/kFjcHI6KIw

TD8hkjwmL1RMgKA5VCPs3g/VHz9k5IQvNgx4mEwMkrJ80QZzQ6xnDZoCwxJhPVs2pvWL

DrMw==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20251104; t=1787335081; x=1787939881;

h=message-id:date:reply-to:mime-version:content-type:to:subject:from

:x-gm-gg:x-gm-message-state:from:to:cc:subject:date:message-id

:reply-to:content-type;

bh=YIj577gQN3gcbkCNwFCceFilc43bUo7ya+iM6grQMEk=;

b=LBQ/+xLhag5LP9VTWTMnlbMPNbSvQ7xDKKVcWFqSlAp5ORpWIjfhX31tQnn2zT7VzS

DWzZ3iI+qAhun8cYG/H+Ej88wnjqLV8DRUdjkQAfdCfgQdg4Z38sVoo78nOkdAfrhcFN

bg2IFpcFujuXf0yhhA8M9XWggqU2DRyvxemEf8XM6jxj5okFFU9GMAFSQKOxVE9dposZ

XrvSRSU/pxgEMvcMynCqP0JOTYmbrkPO3lAnpput6V5R8DCpBWgDgxU+8ZIBfq8qn1UD

e6HQ+qDHw+Y9C/yvKvWEWgDBHc7LQ3AKvNsI4RjUAPvzSnckzpa61znEdPQvq19hClDP

vHUA==

X-Gm-Message-State: AFuF++lI9rm0RolMq7JjpkW+c3RgjjpqfYP9PWZ3fVcEs/gfCn64FWi4

t5a7Sdv8iQioQNItq1xHd04VLF8RsINd/K3GJi+L8lMA3TIq2GPLNQReg4NgsQtumA82h1rKhuY

40cO4m8awke8xJlKohuv5wIHWIKWd+UzKNVL1uVzPVq5JiKo=

X-Gm-Gg: AR+sD10R3qKYlmeGEBJfW4+nQ0rTbdXkqFc2HeOqKv1nFXRB32BGDTq9hGR/kDVe0PW

CEY48yctE1kfNHsWzL3IujzrZCY5HBsNVXA9Fa9sfYoajhCvExukbPSXLb3HPZClGj92rm11B5B

TVxSPWQGsB57EFl/kabIJs12OsFBOJzQYGYGoZwY1WZ6dMlLC/lYHw4k/qrKoxP5OMy64qA96Bb

A4amzgmkIKZoNLmKJQ4tw/IYGUn/grPke1gHfdazXY0pmyFxpNpaf5xGdVEC3msqenjS5yYnSjo

70/pfTnFcpOVH8JLhc0irEQcgsrHYWsDZGDRLfQ7M0goMRdu/eiRLjA/ESwh5nkpTABUfuJbz/J

AFyiAnkfjHmmZ9vJQLEK52mSRARrkpncxstQpw/9J8B4=

X-Received: by 2002:a05:6402:320c:b0:6a3:fdb0:c374 with SMTP id 4fb4d7f45d1cf-6a42f2054b1mr9489333a12.13.1787335080959;

Fri, 21 Aug 2026 10:58:00 -0700 (PDT)

Received: from WIN-CLVG3PFJJET (ip31-70-65-27.pbiaas.com. [31.70.65.27])

by smtp-relay.gmail.com with ESMTPS id 4fb4d7f45d1cf-6a3fe165c71sm2948595a12.0.2026.08.21.10.58.00

for

(version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128);

Fri, 21 Aug 2026 10:58:00 -0700 (PDT)

X-Relaying-Domain: sasinm.com

From: "SCAFFCO CONSTRUCTION INC."

Subject: Product Sourcing Inquirry

To:

Content-Type: multipart/alternative; boundary="m7R=_uFiox8LgKUUeZilQKIUJR2vXwRpzS"

MIME-Version: 1.0

Reply-To:

Date: Fri, 21 Aug 2026 17:58:00 +0000

Message-Id: <20262108175800C34F8D19F5-7A349DB0B9@sasinm.com>

This is a multi-part message in MIME format

--m7R=_uFiox8LgKUUeZilQKIUJR2vXwRpzS

Content-Type: text/plain; charset="iso-8859-1"

Content-Transfer-Encoding: quoted-printable

Good day,

I am writing to inquire about your product, Can you give me your price=

list or latest catalog if you have it. We have needs for a big order.=

Waiting for your feedback. Thanks

Regards

Bryo Evans

Email:bryon20221@gmail.com

--m7R=_uFiox8LgKUUeZilQKIUJR2vXwRpzS

Content-Type: text/html; charset="iso-8859-1"

Content-Transfer-Encoding: quoted-printable

8859-1">

le=3D1"> <=

title>Product Sourcing Inquirry

Good =

day,

I am writing to inquire about your product, Can you give me=

your price list or latest catalog if you have it. We have needs for a=

big order. Waiting for your feedback. Thanks

Regards
Bryo Ev=

ans
Email:bryon20221@gmail.com

--m7R=_uFiox8LgKUUeZilQKIUJR2vXwRpzS--

Web/SEO/App spam from Google Gmail

Posted by Dave Yadallee on Saturday, August 22. 2026

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Fri, 21 Aug 2026 11:11:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.5 (FreeBSD))

(envelope-from )

id 1wxSlH-0000000074D-26xk

for dave@doctor.nl2k.ab.ca;

Fri, 21 Aug 2026 11:10:35 -0600

Resent-From: The Doctor

Resent-Date: Fri, 21 Aug 2026 11:10:35 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-lj1-f197.google.com ([209.85.208.197]:60539)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.99.5 (FreeBSD))

(envelope-from )

id 1wxSYE-00000000Hkc-04qC

for root@nk.ca;

Fri, 21 Aug 2026 10:57:15 -0600

Received: by mail-lj1-f197.google.com with SMTP id 38308e7fff4ca-39d93e881b3sf5729561fa.0

for ; Fri, 21 Aug 2026 09:56:22 -0700 (PDT)

ARC-Seal: i=3; a=rsa-sha256; t=1787331375; cv=pass;

d=google.com; s=arc-20260327;

b=XBYgZboDkATerqUb2xzYsunC/lYvJNZYC+rz9WonfRolH2zj3uo7LCPUzqko44Ov+/

AY1BtexOPyV1XujnPNVuHkNW9uXduoLwR+2Vtww2NPq78tbP5DAe0lVLos7SSWRyj4Qk

aarXNkWOjZlw003B6fl/WCUO9WwRw+6M98X0eAN0UgL7I5NAZ2q1LdDSMRKRMxGYu23S

aHgOAbPHFwj81fP3e3t6pngL1QXRSbLdhd+P/kc7xDzeDf/1UtkX2/w01ms4nRNA31ZH

IpPF0dfTaeNUhFrmLQXX4zANHdV1XQGV8zrQsGDuRVllapzRZLBCGkMUsrDzo9MbRKES

lWVw==

ARC-Message-Signature: i=3; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20260327;

h=list-unsubscribe:list-subscribe:list-archive:list-help:list-post

:list-id:mailing-list:precedence:to:subject:message-id:date:from

:in-reply-to:references:mime-version:sender:dkim-signature;

bh=6EexJoaNjhPmOHzUvx6ZISqUdUNgZH1TwlxrJX1cT+A=;

fh=Olfic5Hpg+lATT7Arlnr5ygr+R5NJmrb+6mdX5qgtD0=;

b=Ij0ARw6dVuL865I9i2YNyRZB5bhORlSUfVFukzbKbIdKYHCJCQuh0IpWVXWO8Xp4yr

p6Sfoh1WIXwPXusIc+HuOrYPvXZOMdllpw0K2l+QXKRe1yWTYgfQBlMxksaR367yCbL9

hoL8N3ncD6IPMaag/taZY6ZgEsloM4qboVDAeIfrkDy0TQ481VNzhjCuoUSJW7nq/qNb

Kge+ZS8U3ADE/GMalqHBC8HfVpL/gY0LwfKeo0W7EV3wtrXderZguj8Zxnnb5AloZilh

f64uzk+Zhypfg5MJCqEh0EmlrkU+okOiAOZVk3nb3Q8NH3QXHnaJVRqpBdxrCotYJG21

1vhA==;

darn=nk.ca

ARC-Authentication-Results: i=3; mx.google.com;

dkim=pass header.i=@gmail.com header.s=20251104 header.b=I38D9DrB;

arc=pass (i=1);

spf=pass (google.com: domain of anaya.singh3226@gmail.com designates 209.85.220.65 as permitted sender) smtp.mailfrom=anaya.singh3226@gmail.com;

dmarc=pass (p=NONE sp=QUARANTINE dis=NONE) header.from=gmail.com;

dara=neutral header.i=@rankbeacon.xyz

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=rankbeacon.xyz; s=google; t=1787331375; x=1787936175; darn=nk.ca;

h=list-unsubscribe:list-subscribe:list-archive:list-help:list-post

:list-id:mailing-list:precedence:x-original-authentication-results

:x-original-sender:content-type:to:subject:message-id:date:from

:in-reply-to:references:mime-version:sender:from:to:cc:subject:date

:message-id:reply-to:content-type;

bh=6EexJoaNjhPmOHzUvx6ZISqUdUNgZH1TwlxrJX1cT+A=;

b=OUNrgSz5ATn0hvE5xSIaEQtRrCMiyFEb4NMh4+aVqqs2JsqSRiAgta78gGo7u75n6B

S0SO9kJVFtWWlX3v4KD336DqdqyfSwvBLi4Cks9UICZd4MaBz0i/85MJpiVa5gnfWGnb

qlFzXDkhC2CzX3eiKcIO87iRH9u1PnvVLC9kYWgAVspVspuz8tIjcXMLPAP8t8t1SZ+W

iCmyVlSgnNNgcnWqlGKWERh2HIM5rkTBg0Ppo+Dtrtplb5rjbhROWv+lphi43GjXPyqI

qxzDzVNnu/wml6JrGZuPCvmFUQrZCqWuYTbJjHBVGMwHwXUajdPaGLP79osf3IdHzMGo

ePrg==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20251104; t=1787331375; x=1787936175;

h=list-unsubscribe:list-subscribe:list-archive:list-help:list-post

:x-spam-checked-in-group:list-id:mailing-list:precedence

:x-original-authentication-results:x-original-sender:content-type:to

:subject:message-id:date:from:in-reply-to:references:mime-version

:x-gm-gg:x-beenthere:x-gm-message-state:sender:from:to:cc:subject

:date:message-id:reply-to:content-type;

bh=6EexJoaNjhPmOHzUvx6ZISqUdUNgZH1TwlxrJX1cT+A=;

b=BJO5iNfyhD+vzMBHkPTpZufnKTyByEXNZE8dnzozaNQNC87MbV8rb4aQYCNzn61UNA

5mukZWXCeAhAzt5Aog9kT2zMJy9W+f0pYmtwUGgOdTJ4k4xjZP00GQhA0U39Wc3ms34A

rbLuLvUhlYxiMXB3riBVg3N0hOPGyWj3zKE2YHdo6W5Gl122RV6fWmq+FW4o+7mYu9nr

SiBAB8kHhng5pq/Ai3ro1+QtvAEJYQ+IR1KPUCWaULwE34BhUWKtTqb8HCi+koQ0ZnPz

i3WtMAW7SCe/FK+1HMV8gZOxCo75xGG4k9bHoMKcKicv8v7wGEBOlYOIXPsvFiKxX0N/

ZJ1w==

Sender: google_seo@rankbeacon.xyz

X-Forwarded-Encrypted: i=3; AHgh+Rp+yWE80gtfXJ78JCheZnKcR/HKdoRiYWmoPit5nXVXH6KuXLfQ5Hai1T8v9iPXER+ljyJz@nk.ca

X-Gm-Message-State: AFuF++mtuhfxuyx2rT4+3lxMGCwap1g45cJhTuVsDEl4o2PenD1nTZoY

BC/OK444575WAH1HWODvtjd3R0K7s5O3JXtGZUH0kxfR5MZpisvQWq5HZVwkmvfMAO4=

X-Received: by 2002:a05:651c:220a:b0:39d:93e8:7ffe with SMTP id 38308e7fff4ca-3a1aebc7019mr18070041fa.4.1787331375137;

Fri, 21 Aug 2026 09:56:15 -0700 (PDT)

X-BeenThere: google_seo@rankbeacon.xyz; h="ATskLdeQB7k/O1Tk4I3QxARa/kf0M529dMDr0AFrPMBqws8wlA=="

Received: by 2002:a05:651c:a205:10b0:3a1:2462:25b2 with SMTP id

38308e7fff4ca-3a195fee8cfls3722201fa.0.-pod-prod-09-eu; Fri, 21 Aug 2026

09:54:00 -0700 (PDT)

X-Received: by 2002:a05:651c:b0c:b0:394:635:70b1 with SMTP id 38308e7fff4ca-3a1aeba1317mr19010091fa.3.1787331240349;

Fri, 21 Aug 2026 09:54:00 -0700 (PDT)

ARC-Seal: i=2; a=rsa-sha256; t=1787331240; cv=pass;

d=google.com; s=arc-20260327;

b=FLtNCS/J1q/T3ELE3SQ8cB4nkHOlfpOD770kac7CdFhh0npKeHCwTij/Pny3DKggY0

et49n0jjffj27UoI2+fn4Np6GZLJY9PWOEM/xVzWL+WlHrra+49DHp/GmyCYWYNFGSIO

o3ojcX56OFeMJcJRbbxybFtcxqC7mEbgLY+cJmVJHLctKDdeMcvsJaPC5mlLe1LaM5z0

kGOIRXZnNsWIRiFCN/he+VPaaiDVPgkATjMUW9ZzrJFO+7SxSEcyQICgT2+zRruud4CK

J+4cBs5Y4Y0uWK1utmlrKtejgICfrvAg0afA0DcMEkm4BcopMO5ofbLGEhfnKFA26CTj

6oIw==

ARC-Message-Signature: i=2; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20260327;

h=to:subject:message-id:date:from:in-reply-to:references:mime-version

:dkim-signature;

bh=i+Io8aXSWTtzx7xfEtknMdZW/mDaSkO45qWyqwfJ96M=;

fh=PWSUFaEq1CkbsfShP2jell5RPg3MDtCYx7KzhsUuaJc=;

b=DWsGX7giZDjDn34FyKPzCRtHYzBRAnmt3KAQ1MsE5MlhQVhqMxisOgsZt0cdmAqIrb

vTngkbaYCa5iruiBH15hKYQ8jO4gLyKUYOuH5xy+lqoJtP5U/EXjL597KeTMUzkOSbpF

TUB7OO5Ub3hOqxNWX/1RnhK79lySwiXxpumQi+pu8XkrRDaHPq26cre/2jHkhz5goMxz

FTPuNAuJhlzvvO61nv0g9o9VUQkro6jDeN6DknossW0HtCZVNcIBUMTLfuAf12UJmuC7

UecR7tldSTfVBvuTeBV/BT1EKeYOQsJEK4Ba1w9W6gnDy1sACas4FYAE8RndedcdvmmW

Ui1A==;

dara=google.com

ARC-Authentication-Results: i=2; mx.google.com;

dkim=pass header.i=@gmail.com header.s=20251104 header.b=I38D9DrB;

arc=pass (i=1);

spf=pass (google.com: domain of anaya.singh3226@gmail.com designates 209.85.220.65 as permitted sender) smtp.mailfrom=anaya.singh3226@gmail.com;

dmarc=pass (p=NONE sp=QUARANTINE dis=NONE) header.from=gmail.com;

dara=neutral header.i=@rankbeacon.xyz

Received: from mail-sor-f65.google.com (mail-sor-f65.google.com. [209.85.220.65])

by mx.google.com with SMTPS id 38308e7fff4ca-3a189dfb3cfsor11172191fa.21.2026.08.21.09.54.00

for

(Google Transport Security);

Fri, 21 Aug 2026 09:54:00 -0700 (PDT)

Received-SPF: pass (google.com: domain of anaya.singh3226@gmail.com designates 209.85.220.65 as permitted sender) client-ip=209.85.220.65;

ARC-Seal: i=1; a=rsa-sha256; t=1787331240; cv=none;

d=google.com; s=arc-20260327;

b=hmLSWgeNICw4EG7lyCagYYGYNlrlpPUw295WMKKdDUbCJKXRy7RBRq539dUJTWc2XZ

Ddk5bgvZ/dWTvq1/gHtOs/8kahusX66X36MAAmwP8EPUBJrnL9NYhO8Hczm3YZdVq0gw

u5tgSzKSjOaVfXfLwECuv9xf2xpUQLsAYnSG81Qt10FmfCv0dEDfsp8xPcvAdKSKjouV

3II+FSVa9J/RL71RrjXAZgKiWO0OlVe94aqdOzgUwn4wtSzFMdwuxCUJgnaVdrjHiN0+

Ico/ZrGvaGLnvfWOENTeNORsDH6rM8vDJh7/zJz+Fl9WE1yxALex5tYkDLrMwStxz2Bw

HdvA==

ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20260327;

h=to:subject:message-id:date:from:in-reply-to:references:mime-version

:dkim-signature;

bh=i+Io8aXSWTtzx7xfEtknMdZW/mDaSkO45qWyqwfJ96M=;

fh=PWSUFaEq1CkbsfShP2jell5RPg3MDtCYx7KzhsUuaJc=;

b=mRU8CWZXdeJhcbO4fm+SSdhzhE9RliTOFUVay7WSW3ltQVNj2yLyUee0tSGeNCTgzt

LnFHTobrtXvk7J7gwFwr+BxA1PUyabBfsloP/8ksLpuTp4loHBGkAySmBtA5ET+l03yB

H6g8RXXXH9bZCRZRGDMRJ4/pweFpOesn9aLGztLJyiMuNc4r/i1i93yYA8g+87FJBops

AR0Fn7vJcjHO9KCzSwr+u2dQZ939eq3t7Ubo7/+U+MCqyiPbKPf6MEIOWQWwhfmNBOld

00imqfu795wWqTA6ADdHIKvX08sCn9oQ7Bz0YSjyI3AnlmbDgjkHW+aWC+LoIrPzzKRS

MAbg==;

darn=rankbeacon.xyz

ARC-Authentication-Results: i=1; mx.google.com; arc=none

X-Gm-Gg: AR+sD12XndX6czykZcWpwjbXzlRdamg2DTNamir5vFFXLy+7we9VGsLdT8CWyIC3IvS

tpKKW3tbmVNXwOvOKVV9lrcKtHcJ7520AdhjrUTxY+nIXoXtmmQBTtMRwLtjYj3JINoptENzE2t

6aTEKtZcRlglLMgShYI9wtwGacRmbxeQhRh/DnPOy9uqxknR/Ae34tMzqI/L8tUmjK/Ty8voosA

8wixSYNciHw0Q6sJM9CgChaAohoCfsj/8H8ptizWQccn1+KHQLew1aW/3sQGCqXYKlP4eQp5oKs

AYi6W2lUi97cGKoxbrU6ngBFY2YjYSll+8dOitnkRKBMdDdhOJLe5KiK51OkQsQWdlv/Pw421o6

lheGM3xBozvgXe5yeD6gUzRXu4rJnOZA+AczBxlQw1+AVChZkhhddLskHEw==

X-Received: by 2002:a05:651c:144c:b0:3a1:a1f6:3af7 with SMTP id

38308e7fff4ca-3a1aee72788mr18838981fa.12.1787331239775; Fri, 21 Aug 2026

09:53:59 -0700 (PDT)

MIME-Version: 1.0

References:

In-Reply-To:

From: Anaya Singh

Date: Fri, 21 Aug 2026 22:25:53 +0530

X-Gm-Features: AcwNN1U6KUHOYVOuD3uUb4ftWHBxKs6GYk1QCGbEBOs7_LwPysOW7UlAJhMzvjg

Message-ID:

Subject: Re: Few improvements for your website !!!

To: google_seo@rankbeacon.xyz

Content-Type: multipart/alternative; boundary="000000000000a491e00659917b48"

X-Original-Sender: anaya.singh3226@gmail.com

X-Original-Authentication-Results: mx.google.com; dkim=pass

header.i=@gmail.com header.s=20251104 header.b=I38D9DrB; arc=pass

(i=1); spf=pass (google.com: domain of anaya.singh3226@gmail.com

designates 209.85.220.65 as permitted sender) smtp.mailfrom=anaya.singh3226@gmail.com;

dmarc=pass (p=NONE sp=QUARANTINE dis=NONE) header.from=gmail.com;

dara=neutral header.i=@rankbeacon.xyz

Precedence: list

Mailing-list: list google_seo@rankbeacon.xyz; contact google_seo+owners@rankbeacon.xyz

List-ID:

X-Spam-Checked-In-Group: google_seo@rankbeacon.xyz

X-Google-Group-Id: 1054195051699

List-Post: ,

List-Help: ,

List-Archive:

List-Subscribe: ,

List-Unsubscribe: ,

X-Spam_score: 8.0

X-Spam_score_int: 80

X-Spam_bar: ++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.

Content preview: Just following up on my last email regarding a few website

improvements that could help increase your traffic, leads, and conversions.

I still have the quick snapshot ready for you. Reply *â€œOK â€“ SENDâ€

and Iâ€™ll share it over.

Content analysis details: (8.0 points, 5.0 required)

pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[209.85.220.65 listed in will-spam-for-food.eu.org]

[209.85.220.65 listed in will-spam-for-food.eu.org]

[209.85.220.65 listed in will-spam-for-food.eu.org]

[209.85.220.65 listed in will-spam-for-food.eu.org]

[209.85.220.65 listed in will-spam-for-food.eu.org]

[209.85.220.65 listed in will-spam-for-food.eu.org]

[209.85.220.65 listed in will-spam-for-food.eu.org]

[209.85.220.65 listed in will-spam-for-food.eu.org]

[209.85.208.197 listed in will-spam-for-food.eu.org]

[209.85.208.197 listed in will-spam-for-food.eu.org]

[209.85.208.197 listed in will-spam-for-food.eu.org]

[209.85.208.197 listed in will-spam-for-food.eu.org]

[209.85.208.197 listed in will-spam-for-food.eu.org]

[209.85.208.197 listed in will-spam-for-food.eu.org]

[209.85.208.197 listed in will-spam-for-food.eu.org]

[209.85.208.197 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[209.85.208.197 listed in dnsbl.ahbl.org]

[209.85.208.197 listed in dnsbl.ahbl.org]

[209.85.208.197 listed in dnsbl.ahbl.org]

[209.85.208.197 listed in dnsbl.ahbl.org]

[209.85.220.65 listed in dnsbl.ahbl.org]

[209.85.220.65 listed in dnsbl.ahbl.org]

[209.85.220.65 listed in dnsbl.ahbl.org]

[209.85.220.65 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[209.85.208.197 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[209.85.208.197 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[209.85.208.197 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[209.85.208.197 listed in dnsbl.ahbl.org]

2.5 URIBL_DBL_SPAM Contains a spam URL listed in the DBL blocklist

[URI: rankbeacon.xyz]

-0.0 SPF_PASS SPF: sender matches SPF record

1.7 URIBL_BLACK Contains an URL listed in the URIBL blacklist

[URI: rankbeacon.xyz]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

2.0 PDS_OTHER_BAD_TLD Untrustworthy TLDs

[URI: rankbeacon.xyz (xyz)]

0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider

[anaya.singh3226(at)gmail.com]

0.0 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level mail

domains are different

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[209.85.208.197 listed in list.dnswl.org]

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[209.85.208.197 listed in wl.mailspike.net]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[209.85.208.197 listed in bl.score.senderscore.com]

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

1.0 BULK_RE_SUSP_NTLD Precedence bulk and RE: from a suspicious TLD

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

-1.0 MAILING_LIST_MULTI Multiple indicators imply a widely-seen list

manager

0.5 FROM_SUSPICIOUS_NTLD From abused NTLD

0.2 FREEMAIL_FORGED_FROMDOMAIN 2nd level domains in From and EnvelopeFrom

freemail headers are different

Subject: {SPAM?} Re: Few improvements for your website !!!

--000000000000a491e00659917b48

Content-Type: text/plain; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable

Just following up on my last email regarding a few website improvements

that could help increase your traffic, leads, and conversions.

I still have the quick snapshot ready for you.

Reply =E2=80=9COK =E2=80=93 SEND=E2=80=9D *and I=E2=80=99ll share it over.

Thanks,

On Sat, 25 Jul 2026 at 21:59, Anaya Singh wrote=

:

> Hi,

>

> Many local businesses are missing opportunities because they're not

> visible enough online.

>

> We help businesses generate more calls, inquiries, and customers through

> Google.

>

> Reply "Sure" and let's connect.

>

> Thanks,

>

To unsubscribe from this group and stop receiving emails from it, send an e=

mail to google_seo+unsubscribe@rankbeacon.xyz.

--000000000000a491e00659917b48

Content-Type: text/html; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable

Just following up on my last email regarding a=C2=A0=

few website improvements that could help increase your traffic, leads, and =

conversions.

I still have the=C2=A0quick snapshot ready for yo=

u.

Reply=C2=A0=E2=80=9COK =E2=80=93 SEND=E2=80=9D=C2=A0and=

I=E2=80=99ll share it over.

Thanks,

=3D"gmail_quote gmail_quote_container">

">On Sat, 25 Jul 2026 at 21:59, Anaya Singh <
gh3226@gmail.com">anaya.singh3226@gmail.com> wrote:

uote class=3D"gmail_quote" style=3D"margin:0px 0px 0px 0.8ex;border-left:1p=

x solid rgb(204,204,204);padding-left:1ex">

Hi,

Many=

local businesses are missing opportunities because they're not visible=

enough online.

We help businesses generate more calls, inquiries, a=

nd customers through Google.

Reply "Sure" and let's co=

nnect.

Thanks,

To unsubscribe from this group and stop receiving emails from it, send an e=

mail to google_seo=

+unsubscribe@rankbeacon.xyz.

--000000000000a491e00659917b48--

Webroot phish from Google Gmail

Posted by Dave Yadallee on Saturday, August 22. 2026

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Fri, 21 Aug 2026 11:09:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.5 (FreeBSD))

(envelope-from )

id 1wxSjD-000000006nQ-3ghW

for dave@doctor.nl2k.ab.ca;

Fri, 21 Aug 2026 11:08:27 -0600

Resent-From: The Doctor

Resent-Date: Fri, 21 Aug 2026 11:08:27 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-pl1-f175.google.com ([209.85.214.175]:51253)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.99.5 (FreeBSD))

(envelope-from )

id 1wxQPO-00000000LqF-04oP

for doctor@nl2k.ab.ca;

Fri, 21 Aug 2026 08:40:00 -0600

Received: by mail-pl1-f175.google.com with SMTP id d9443c01a7336-2cc891373e0so12796385ad.2

for ; Fri, 21 Aug 2026 07:39:02 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=gmail.com; s=20251104; t=1787323136; x=1787927936; darn=nl2k.ab.ca;

h=priority:importance:subject:from:to:mime-version:date:message-id

:mime-version:content-type:from:to:cc:subject:date:message-id

:reply-to:content-type;

bh=gzENY788Lsx7EdfBBjpqZuiSda+fg3F+AC83XFhhs7Y=;

b=f5o8OGmBg8ExiU+Sb+AAIBphXs+hrz1GdkPynMFcPXd+x7ytKkJJWPweFYafYXNY2v

vTioD4slk1mz4qKjpvQ738FTVpW1T47B5V+Ze1UMsneeFNId18Wadc9fmfES/aKsF2c6

24xAzQbuRlLMQ1Fs21qepA1tAVr27+OKFoT9QF/5IwDmmx+azGHkaga41X/+lqAvjG/p

cTrjPMWSByFf3UlK6m+SsOCVSm9Qc2suIbnK6Gu/WrCP7Vzfl+1MTGwdbS85/5mAQ3bx

lcDgdpkSIoTvDVTVgFTjXy1NbAZR4qNMFmDg4hYbEgQhRaPis4/yWoVV+qnvoyHV8gxW

57Zw==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20251104; t=1787323136; x=1787927936;

h=priority:importance:subject:from:to:mime-version:date:message-id

:mime-version:content-type:x-gm-gg:x-gm-message-state:from:to:cc

:subject:date:message-id:reply-to:content-type;

bh=gzENY788Lsx7EdfBBjpqZuiSda+fg3F+AC83XFhhs7Y=;

b=jUKtzNcCFdd5OOjQmHrt011eAMIzUbroSzI1gjFeEDgFgrGfxpygGFTJVKCYi+1S1g

TP4EQQ7o5WVpu1WpOhYqko/8MwUaUO/bH3dUxEfgOh9TMKX2/bbUqUQs7aN933tQ5H1m

QWeyTsZIkiCtIUTLOnaUkse6nWYZCaX1tgJGGbyEkilA3kzkyXA2XlFsmDQcHG+qXHCs

yu8GmTIeYJ9uc2qo3sdyVEJTZc1eRodkWin9knqJ8BZd0Vx6JTzbGtuGFyJQASUEQUeC

NEXUgtE6ctEzL6sJtS25GSZzZcbas/QS9K3jLxzUUsY+N1ZDVdqCyhKGeo7Kb+eTERlC

6IDA==

X-Gm-Message-State: AFuF++m6OSJbh/8HUJxZ6rser483niRy1BT2XXlTKrct/kPHeZ6jngBc

SCWFL0IBzOwWzbEfVqjyOjVu156gZlT6Mlx4ZBaGdQXk7AKCRfZnQdVw17VMl7lR2UYbakZNs4p

OOgXn

X-Gm-Gg: AR+sD130W+soJsBltE1/X0AYvazbxS1UF1kC63uq17yAJT9Jf2PjslwMryP2/GwuOCO

kn9Il+ZLF5gMsqz+/d/aB9WD1Mvq75far8ZkG9XMX+ELmD8yMb9WZP5cuxpfyvWPYwNfzId+6+q

l+fJdzwjZpv1c2Spcf8cyi5WZQgX0uYAi9EH5kHRBQOMgQCSwGBhmWp3aKjsTTbkMlmxlhk9tib

fHK/xP8uRKAuCc5W8hx1wE9bGyKUH7IG4MldlkQpLIv91XFpzuv+jhdgYXJYWRbFCLzZ+YBhtFT

bcZf9IeDGyCgc0m35IWUyxPBHUwS3509FEojyo+S3AjRz9lwmJkIH1JvWm0D88HnWmtIkLoZRDp

2gG1CYgK+wVIUp+xT1YFJEe9Arw+H7F13MjqbzU3SQOIY7dUQG0yl9oIKtvo4ETdnlG3E8DA6pS

enxtmvthhEL2YzmhtUoQYRRY6EHj5eSezM4D+y1U7cC0Kwcsk4yEDSJgV6n8hfj9AzUZnCzOPjF

gbWepGxY1l6Z4LmDzNvVYqqc/JcExVe+1zoNVQ=

X-Received: by 2002:a17:903:b07:b0:2d0:8b28:517c with SMTP id d9443c01a7336-2d64ade4afdmr135056985ad.3.1787323136204;

Fri, 21 Aug 2026 07:38:56 -0700 (PDT)

Received: from [172.26.17.98] ([49.51.191.79])

by smtp.gmail.com with ESMTPSA id 5a478bee46e88-327c98ba384sm24080079eec.30.2026.08.21.07.38.55

for

(version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256);

Fri, 21 Aug 2026 07:38:55 -0700 (PDT)

Content-Type: multipart/mixed; boundary="===============4507908623042572438=="

MIME-Version: 1.0

Message-ID: <9c137902804641efa25302f3d63d37d3@gmail.com>

Date: Fri, 21 Aug 2026 09:38:54

MIME-Version: 1.0

to: Doctor

from: Doctor

subject: Your Order has been paid

Importance: normal

Priority: normal

--===============4507908623042572438==

Content-Type: text/html; charset=utf-8

Content-Transfer-Encoding: 7bit

MIME-Version: 1.0

WEBROOT

Order Date & Time: Friday, August 21, 2026 (09:38:54)
Order No: 07396659
Payment Id: 22590JOE-498HKQ-676WJT701

Your Membership Has Been Renewed

Dear Doctor,

This message provides an update regarding your Webroot membership. Your current membership is scheduled to renew automatically on Friday, August 21, 2026 under the terms of your existing plan.

Sale Summary
Product: Webroot
Membership Plan: Cloud backup & restore
Activation Key: EA97C2AB-0EC7-410A-8C7F-8A5A53878507
Registered Email: doctor@nl2k.ab.ca
Subscription Term: 2 Years
Payment Method: Bank Card
Renewal Amount: $354.66

Please take a moment to confirm that the membership information remains current. If you need to make changes to your plan, payment details, or renewal settings, please use the official account or support information provided below.

No action is required if your membership information is already correct.

Thank you,
Webroot SecureAnywhere
+1 (779) 335-7396
+1 (806) 438-8367

--===============4507908623042572438==--

Chinese products spam

Posted by Dave Yadallee on Saturday, August 22. 2026

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Fri, 21 Aug 2026 11:11:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.5 (FreeBSD))

(envelope-from )

id 1wxSkl-00000000708-0UJ4

for dave@doctor.nl2k.ab.ca;

Fri, 21 Aug 2026 11:10:03 -0600

Resent-From: The Doctor

Resent-Date: Fri, 21 Aug 2026 11:10:03 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from out21-142.dm.aliyun.com ([115.124.21.142]:31095)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.99.5 (FreeBSD))

(envelope-from )

id 1wxQnO-00000000Pu0-2oga

for doctor@nl2k.ab.ca;

Fri, 21 Aug 2026 09:04:49 -0600

X-AliDM-RcptTo: ZG9jdG9yQG5sMmsuYWIuY2E=

Feedback-ID: default:vip@vip.eclatkelly.ltd:alibabak_WebBatch:512266

DKIM-Signature:v=1; a=rsa-sha256; c=relaxed/relaxed;

d=vip.eclatkelly.ltd; s=aliyun-cn-hangzhou;

t=1787324623; h=Date:From:To:Message-ID:Subject:MIME-Version:Content-Type;

bh=woW2lpZi+RwOGYVyREsJiB1hOAzkIvY3yQz/JlwTDVc=;

b=nudL1zXPKRgtUZ+JkQ/p61+xcGNG0iTMKgxCUWhbu4wPqeXizL0popCfw3vcYY6M5HwS58HfalfLb+Ur9QwY5g1niQkqlsAVHP76f+bXL09PXZtrrL6R2cX0GO5DXX/P8Vj/wPkDt+vZMMtqS0aR+S3GlM2dnYBFOv5m7Kt7HcE=

DKIM-Signature:v=1; a=rsa-sha256; c=relaxed/relaxed;

d=dm-fbl.aliyuncs.com; s=feedback;

t=1787324623; h=Date:From:To:Message-ID:Subject:MIME-Version:Content-Type;

bh=woW2lpZi+RwOGYVyREsJiB1hOAzkIvY3yQz/JlwTDVc=;

b=y5bi+3YvcVeBgJcrGs6nUZ0Nj6MzVYN8Dr0ln/hhC6uWIacCGkuv6a3+Ug3YY86xvR7g17fBSXXrEwxROlAwukLVWkHp2ICpCUgGEefBPHpNNttrjOtCx5tJmhKLkrN/mDM1WD1NGoHfnEhI9cCakuz2/t/LmV8n21jP3qx5ANE=

Received: from chitu-hsf(mailfrom:vip@vip.eclatkelly.ltd fp:ma_600000349084952820 cluster:AY35D)

by smtp.aliyun-inc.com(127.0.0.1);

Fri, 21 Aug 2026 23:02:24 +0800

Date: Fri, 21 Aug 2026 23:02:24 +0800

From: "Kelly"

To:

Reply-To:

Message-ID: <730c0903-b4ac-4f63-8600-fb5a69cdb865@alibaba.com>

Subject: =?UTF-8?B?TWFudWZhY3R1cmVyIG9mIFJEUCwgSFBNQywgUFZBLCBQUCBGaWJlcnM=?=

X-Priority: 3

MIME-Version: 1.0

X-EnvId: 600000349084952823

X-AliDM-Settings: eyJPdXRib3VuZElwIjp7IklwTGlzdCI6W10sIklwUG9vbElkIjoiIn0sIlVuc3Vic2NyaWJlIjp7IkZpbHRlckxldmVsIjoiZGVmYXVsdCIsIkxpbmtUeXBlIjoiZGVmYXVsdCJ9LCJWZXJzaW9uIjoiMS4wIn0=

Content-Type: text/html; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable

X-Spam_score: 6.1

X-Spam_score_int: 61

X-Spam_bar: ++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.

Content preview: Dear Purchasing Team, We are Tianjin Eclat Co., Ltd. Supplying

global chemical distributors and formulators, we offer stable, high-spec

raw materials ideal for the North American market. We mainly produce high-purity

addit [...]

Content analysis details: (6.1 points, 5.0 required)

pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[115.124.21.142 listed in will-spam-for-food.eu.org]

[115.124.21.142 listed in will-spam-for-food.eu.org]

[115.124.21.142 listed in will-spam-for-food.eu.org]

[115.124.21.142 listed in will-spam-for-food.eu.org]

[115.124.21.142 listed in will-spam-for-food.eu.org]

[115.124.21.142 listed in will-spam-for-food.eu.org]

[115.124.21.142 listed in will-spam-for-food.eu.org]

[115.124.21.142 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[115.124.21.142 listed in dnsbl.ahbl.org]

[115.124.21.142 listed in dnsbl.ahbl.org]

[115.124.21.142 listed in dnsbl.ahbl.org]

[115.124.21.142 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[115.124.21.142 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[115.124.21.142 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[115.124.21.142 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[115.124.21.142 listed in dnsbl.ahbl.org]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[115.124.21.142 listed in bl.score.senderscore.com]

-0.0 SPF_PASS SPF: sender matches SPF record

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[115.124.21.142 listed in wl.mailspike.net]

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

0.4 SALES_REPLY Your parents named you sales?

0.6 J_CHICKENPOX_93 BODY: 9alpha-pock-3alpha

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[115.124.21.142 listed in list.dnswl.org]

0.0 HTML_MESSAGE BODY: HTML included in message

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 MIME_QP_LONG_LINE RAW: Quoted-printable line longer than 76 chars

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

0.6 HTML_MIME_NO_HTML_TAG HTML-only message, but there is no HTML tag

2.0 RATWR8_MESSID Message-ID with excessive dashes and dollars

0.0 UNPARSEABLE_RELAY Informational: message has unparseable relay lines

Subject: {SPAM?} =?UTF-8?B?TWFudWZhY3R1cmVyIG9mIFJEUCwgSFBNQywgUFZBLCBQUCBGaWJlcnM=?=

Dear Purchasing=

Team,

tyle=3D"font-size:16px">We are Tianjin Eclat Co., Ltd. Supplying global c=

hemical distributors and formulators, we offer stable, high-spec raw materials=

ideal for the North American market. We mainly produce high-purity additives(=

PVA, CMC, PP Fibers, HPMC, PCE, etc.)

px">

Brief introductio=

n of Tianjin Eclat., Ltd is:

=E2=80=

=A2 specializing in
yle=3D"color: rgb(0, 0, 255);">
5);">construction additives since 1992
55);">

=E2=80=A2
style=3D"color: rgb(0, 0, 255);">
255);">11 automated production lines
5);"> and 12 reaction kettles

e:16px">=E2=80=A2
le=3D"color: rgb(0, 0, 255);">annual output of 114,000 tons

<=

p>=E2=80=A2
, 255);">ISO9001, ISO
n style=3D"color: rgb(0, 0, 255);">14001
255);">, ISO45001 certified
an>.
: rgb(0, 0, 255);">

e:16px">

Types of our produc=

ts are:

=E2=80=A2
=3D"color: rgb(0, 0, 255);">HPMC - viscosity: 300 - 240,000 mPa.s<=

/span>

=E2=80=A2
r: rgb(0, 0, 255);">HEMC: viscosity: 700 - 6400 mPa.s

n style=3D"font-size:16px">=E2=80=A2
;">PVA powder: 0588, 1788, 1799, 2488, 2499

"font-size:16px">=E2=80=A2 PCE pow=

der: solid content - 98%-99%

">=E2=80=A2 PP Fibers: 3mm-=

19mm

=E2=80=A2
r: rgb(0, 0, 255);">RDP powder: Flexible, semi-flexible, rigid, Hydroph=

obic

in-left: 9px;margin-right: 9px;border: none">
r style=3D"height:88px">=

gn=3D"top" colspan=3D"2" style=3D"width: 484px;padding: 0 7px;border-width: 1p=

x;border-color: windowtext">

-size:16px;;font-family:times new roman">Why choose us?

;padding: 0 7px;border-left-width: 1px;border-left-color: windowtext;border-ri=

ght-width: 1px;border-right-color: windowtext;border-top: none;border-bottom-w=

idth: 1px;border-bottom-color: windowtext">

nt-family:times new roman">=E2=80=A2 Offer direct factory source <=

/p>

=E2=80=A2&nbs=

p;OEM packing

w roman">=E2=80=A2 Technical support

e:16px;font-family:times new roman">=E2=80=A2 Customized formulations sup=

port

ding: 0 7px;border-width: 1px;border-color: windowtext">

-size:16px;font-family:times new roman">=E2=80=A2 Free samples

=

=E2=80=A2 D=

irect factory shipment

times new roman">=E2=80=A2 One-stop mixed container dispatch

>=E2=

=80=A2
">Reliable Strict QA for each batch

tives-2.jpg" _src=3D"https://i.postimg.cc/jtvyYVrN/Construction-additives-2.jp=

g" referrerpolicy=3D"no-referrer"/>

:16px">Please feel free to contact us for quotations with TDS, free testing sa=

mples, or OEM and trial order inquiries.

:16px">

Best wishes
p>

ze:16px">Kelly

Tianjin Eclat Co., =

Ltd

WhatsApp and WeChat: +86155225=

15351

577775&env=3D600000349084952823&mac=3D512266&mf=3Dvip%40vip.eclatkelly.ltd&msg=

id=3D730c0903-b4ac-4f63-8600-fb5a69cdb865%40alibaba.com&sac=3D0&tag=3D57-chemi=

cal-2&tid=3D2577775&to=3Ddoctor%40nl2k.ab.ca&tpl=3D&ts=3D1787324544&type=3D1&u=

rl=3D&v=3D1.0&sign=3Da4a1984c7e0b0dd1772d1b89ff1fdf2d&urlts=3D1787324623" alt=3D=

"" style=3D"display: none; width: 1px; height: 1px;" />

Geek Squad phish from Google Gmail

Posted by Dave Yadallee on Saturday, August 22. 2026

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Fri, 21 Aug 2026 11:10:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.5 (FreeBSD))

(envelope-from )

id 1wxSjm-000000006sH-0len

for dave@doctor.nl2k.ab.ca;

Fri, 21 Aug 2026 11:09:02 -0600

Resent-From: The Doctor

Resent-Date: Fri, 21 Aug 2026 11:09:02 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-pf1-f182.google.com ([209.85.210.182]:55723)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.99.5 (FreeBSD))

(envelope-from )

id 1wxPQY-00000000P6p-3u87

for doctor@nl2k.ab.ca;

Fri, 21 Aug 2026 07:37:09 -0600

Received: by mail-pf1-f182.google.com with SMTP id d2e1a72fcca58-84a652535dcso548446b3a.3

for ; Fri, 21 Aug 2026 06:36:12 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=gmail.com; s=20251104; t=1787319366; x=1787924166; darn=nl2k.ab.ca;

h=priority:importance:subject:from:to:mime-version:content-type:date

:message-id:from:to:cc:subject:date:message-id:reply-to:content-type;

bh=+mXOZh4U8l5lIq+KgnekAKS4/ObtBECEpKlBDlkJg28=;

b=KYcbKoxrTLD9zFpzKlWA8O8KkA7EZLQmZ3LialgkTH0jvzLKi9lZ2sZsZpkWlO2MY8

gs3nMQhh8KZ2VIltvO8miFpFAbKds2Vrtr6o/TOvsy9C3WmBs5xRyjouExa+cQ2gadZV

CJo6bqNF7qovVqLFCFkoackBBBkUNzNKHyj0ssf25zQH5QlxoiI6u06oWiG8o4gyyEQr

JReutFuSCoCLEv+O5pyJrrUxJ8ByPug/ljfprsEbc4nERNcQlv/1Sl3LsaciJqqRS9F+

POTk4NVBzEyHTAqkYnFSfDRbHJ833+ztKvf2F+77qb/sbkF6iMHadIdtG4LBh4RW3Ke4

fP6Q==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20251104; t=1787319366; x=1787924166;

h=priority:importance:subject:from:to:mime-version:content-type:date

:message-id:x-gm-gg:x-gm-message-state:from:to:cc:subject:date

:message-id:reply-to:content-type;

bh=+mXOZh4U8l5lIq+KgnekAKS4/ObtBECEpKlBDlkJg28=;

b=bLT4sboLzS3htk99Y2TUZvv8Qkq1zB+K2ychuvBMZr09LK3yupEx8GfSRsWC2eZWwW

4DtnW2mluOT1R7TG/a8dj36pDrRBpH/dYl0rvXRNDurhE67mvK/Cu82mYa5IQXqCg5f8

vtSrGcBncEsQlGr3vcfU1xT9oDt3TGTA1UhXCBzG/Xdz4QHxhts+joj/rpiCJ+3YGO0H

Y/obAbVCoZ2VGDuc6fqyFxIlOId6xFYG2SUtVRlSiMocmHYPk26Lxl7JrJ8vzgMcHvaf

R1UnZY/snSqTSNLjnqTcyBOHO0IO70/xG7/1nTQ2twQxLCo8wEiXw6l8mxv8DcUm4U8W

dXGQ==

X-Gm-Message-State: AFuF++loV45UoPo5ny0BOrsAqZkSLqlTpUUVfN84MUDj1RdwLq2uRsDr

VRwmW0fR5vw24l/QY1erkHkwKB5ct+0MSqqH8g56Ngf2GSie6NtM+wlWyGuIvVnYEV4=

X-Gm-Gg: AR+sD113sL5qhz6e+E4YINE9BGC65PvOziSnANHghvFgVfUKaJiIJ6aK/K//CyKVd+o

IsrWk0oD2OhT3dgVsJZBEtQ3sdhEGXyQTSH23Hw7ffQIvU8RjxJVr1OyiGh1FQwOUxZUSt0WO2d

LtEmtvY/iRM3RICZ9YMRo/D7mlES/W5F5a0q3Kbrztd16Thk2PckeVauhxCeSEehf7fjpVtzBY0

4tyZyMAmfPjnPCQPjgZCaCK1jvH6Vh1xA07skFWZsTuxDtnnD2F1PaybrnhRhFWmOZsVQVqskGu

jG198MOnFy45g6cGujxrvk1BvtPsJ6w1vFJviMgLbBvLVkSFnB2lkbmNtB5Z/YKoCDElrPNZ50q

TGOfFYiR3YxwVKvvsUfVbzxkFBdsu5CeoQjzXbwAbScgTyo+L4PdwwK5nINRYeUDOezWxjYuHQl

7q46rzj3twMoH1T7gCcyG6Wr46v9codceTvFe9g7LXqLlGMUokAfrmDYhzMH7fonfismWGfmDaC

MgQ24brSf2RaL0ZjDH45n8FDnVGFRr3

X-Received: by 2002:a05:6a00:1bc5:b0:845:e9e8:645c with SMTP id d2e1a72fcca58-851f9ccd34emr11156745b3a.6.1787319366081;

Fri, 21 Aug 2026 06:36:06 -0700 (PDT)

Received: from [172.29.2.185] ([43.133.253.56])

by smtp.gmail.com with ESMTPSA id d2e1a72fcca58-851d366f028sm2891066b3a.53.2026.08.21.06.36.05

for

(version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256);

Fri, 21 Aug 2026 06:36:05 -0700 (PDT)

Message-ID: <6a885445.400acb00.28821.7a14@mx.google.com>

Date: Fri, 21 Aug 2026 06:36:05 -0700 (PDT)

Content-Type: multipart/mixed; boundary="===============5456860123192664044=="

MIME-Version: 1.0

to: Doctor

from: Doctor

subject: Renewal #68712137 Account Information Is Recorded

Importance: normal

Priority: normal

X-Spam_score: 7.3

X-Spam_score_int: 73

X-Spam_bar: +++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.

Content preview: Geek Squad Care & Protection Plan Transaction date: Friday,

August 21, 2026 21:36:03 Transaction : 68712137 The latest service period

now appears in your account. Hey Doctor,

Content analysis details: (7.3 points, 5.0 required)

pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[43.133.253.56 listed in will-spam-for-food.eu.org]

[43.133.253.56 listed in will-spam-for-food.eu.org]

[43.133.253.56 listed in will-spam-for-food.eu.org]

[43.133.253.56 listed in will-spam-for-food.eu.org]

[43.133.253.56 listed in will-spam-for-food.eu.org]

[43.133.253.56 listed in will-spam-for-food.eu.org]

[43.133.253.56 listed in will-spam-for-food.eu.org]

[43.133.253.56 listed in will-spam-for-food.eu.org]

[209.85.210.182 listed in will-spam-for-food.eu.org]

[209.85.210.182 listed in will-spam-for-food.eu.org]

[209.85.210.182 listed in will-spam-for-food.eu.org]

[209.85.210.182 listed in will-spam-for-food.eu.org]

[209.85.210.182 listed in will-spam-for-food.eu.org]

[209.85.210.182 listed in will-spam-for-food.eu.org]

[209.85.210.182 listed in will-spam-for-food.eu.org]

[209.85.210.182 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[209.85.210.182 listed in dnsbl.ahbl.org]

[209.85.210.182 listed in dnsbl.ahbl.org]

[209.85.210.182 listed in dnsbl.ahbl.org]

[209.85.210.182 listed in dnsbl.ahbl.org]

[43.133.253.56 listed in dnsbl.ahbl.org]

[43.133.253.56 listed in dnsbl.ahbl.org]

[43.133.253.56 listed in dnsbl.ahbl.org]

[43.133.253.56 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[209.85.210.182 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[209.85.210.182 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[209.85.210.182 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[209.85.210.182 listed in dnsbl.ahbl.org]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[209.85.210.182 listed in list.dnswl.org]

-0.0 SPF_PASS SPF: sender matches SPF record

0.8 ZMIvirSobY_SUB39 SPAM from Sober-Y-Virus

0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends in

digit

[mminhajmolla623(at)gmail.com]

0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider

[mminhajmolla623(at)gmail.com]

2.0 TVD_PH_REC BODY: Message includes a phrase commonly used in phishing

mails

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-0.0 RCVD_IN_MSPIKE_H3 RBL: Good reputation (+3)

[209.85.210.182 listed in wl.mailspike.net]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[209.85.210.182 listed in bl.score.senderscore.com]

-0.0 RCVD_IN_MSPIKE_WL Mailspike good senders

1.5 TVD_PH_BODY_ACCOUNTS_PRE The body matches phrases such as "accounts

suspended", "account credited", "account

verification"

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

0.0 NO_RDNS2 Sending MTA has no reverse DNS

1.4 MALFORMED_FREEMAIL Bad headers on message from free email service

0.0 T_MXG_LOWER_HDR_SPAM Lower case header spam

Subject: {SPAM?} Renewal #68712137 Account Information Is Recorded

--===============5456860123192664044==

Content-Type: text/plain; charset="us-ascii"

MIME-Version: 1.0

Content-Transfer-Encoding: 7bit

Geek Squad Care & Protection Plan Transaction date: Friday, August 21, 2026 21:36:03

Transaction : 68712137

The latest service period now appears in your account.

Hey Doctor,

This communication provides a summary of the Membership information currently maintained for your Geek Squad's account for the applicable One Year service period. The account records show an associated amount of $248.53 in connection with the membership.

The selected FortressAxis Premium plan remains listed with the services and features associated with your current membership.

Purchase Verification Record

Membership Reference:- 600895

Selected Plan:- FortressAxis Premium

Quantity on Record:- 3x

Service Period:- One Year

Membership Status:- Active

Amount Recorded:- $ 248.53

The information above reflects the membership details currently maintained within the applicable account records.

For questions concerning your Membership, account information, billing records, or related services, please contact our customer support team at 1 812 552 8828.

Sincerely yours,

Kim Tyus

(c)2026 Company. All rights reserved.

Company Address: 8189 Center St Lithonia Ga 30058-7627 United States

--===============5456860123192664044==--

Bookkeeper accountant spam from Microsoft Outlook

Posted by Dave Yadallee on Saturday, August 22. 2026

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Fri, 21 Aug 2026 08:29:01 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.5 (FreeBSD))

(envelope-from )

id 1wxPPM-00000000Nur-3J01

for dave@doctor.nl2k.ab.ca;

Fri, 21 Aug 2026 07:35:44 -0600

Resent-From: The Doctor

Resent-Date: Fri, 21 Aug 2026 07:35:44 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-uksouthazolkn19011079.outbound.protection.outlook.com ([52.103.37.79]:14160 helo=LO2P265CU024.outbound.protection.outlook.com)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.99.5 (FreeBSD))

(envelope-from )

id 1wxLIO-000000000X1-1S4d

for root@nk.ca;

Fri, 21 Aug 2026 03:12:26 -0600

ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none;

b=CeLFo0ersRMIll1Eb2JvTCo+O91U+oi+1C7AMxU4dda3n2RIj6uwf/MoZivqH+amtJEuKf344g25Zm7/H9s1ZxeTGv5LDjJOEL6gjDy77qsPDafx6Gim1BgOGCbSB3Yw4FjNxZRlsivNSkLk4F5VTNCyerQUTnPQdCtxjh7Y6l3cG9ckV1qKycPyw+NEwWIBuFsiqWNRRLUDA5ICnPiuIlxGRlPh91Z4nhdwhVhhRqZeB/1eC5oiHf6LapxRtILehurq3eurYo0PUZD3c6jCb5d92huE8zQlqXfCxTdjQ61R2AIc6ix+Be4V83AlRoKxKPb0VYbXPJ1Y2kZS2mf3+g==

ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;

s=arcselector10001;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1;

bh=E5yXugrOyb5NawuThAB1UpcrhvXqgGYMmAUADDwmQl0=;

b=jWwZuxGp54H4jAP8YeYXdajKvFct18yXsyZUQDccdw5V8F7BDMPVOsPNKK8u0+SCemEAo3VONVuN20FtefMtl51np6UCYI6G6id3ac7LTRZ9/F24nDQUz3OqW6ZxjNNy6HdW9LtOfdboATwMMGx27uff+6yGe84hNtfQQB9knqq+XvU97FM55gHwN/3OxfhgXjKtdtJFZ3YGdJQdzP7jPkngrjGHLgVLIomGu+xGssVa/ILJGJFi8N5KTDDl9G3291cijikarvhcdg1zaZi9QfHFr4J2KY2X1UczWk34CaQ2xfHTtl3xoEBmV/SvkNuFO/vU9YAkxMW03F1ujwup6g==

ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=none; dmarc=none;

dkim=none; arc=none

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=outlook.com;

s=selector1;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck;

bh=E5yXugrOyb5NawuThAB1UpcrhvXqgGYMmAUADDwmQl0=;

b=aCJQTv7FTFg101ifIN0BUVPjSts5mJ9spTVmGrWhi/IL0iiLpuFF53pRd8nhZrYmD2Ly4c/fmdxvz2vhWzy2zIXoijI1BqretCSnxJxxrP6tXWp1hUDP05AM1UkE47Qj4krO+8sRMllBKbtr6r3AZKSVivuJYskDs1zSQtxC+ExzLiSurz2vCg48xswWOG734cn4ynrwIcIaXwUPlVW/2P+Vhy9lTqn0tde1e6fzptLoll+44wbdjIueu8BsmQ34VrhzajWIvZyZXxATGfDQoaZqBTHgq/K577790aAy0V64mSQ5RV4qe2Jz24QxkV5T7uIkFBlv7xp2s/lIkn6nEQ==

Received: from CW1P302MB2415.GBRP302.PROD.OUTLOOK.COM (2603:10a6:400:274::7)

by LO0P302MB1629.GBRP302.PROD.OUTLOOK.COM (2603:10a6:600:40b::9) with

Microsoft SMTP Server (version=TLS1_2,

cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.339.11; Fri, 21 Aug

2026 09:11:16 +0000

Received: from CW1P302MB2415.GBRP302.PROD.OUTLOOK.COM

([fe80::392d:b3f2:7e0e:b7c4]) by CW1P302MB2415.GBRP302.PROD.OUTLOOK.COM

([fe80::392d:b3f2:7e0e:b7c4%4]) with mapi id 15.21.0339.010; Fri, 21 Aug 2026

09:11:15 +0000

From: Sofiya khan

To: Sofiya khan

Subject: RE: Full/Part - Time Bookkeeper/ Accountant?

Thread-Topic: Full/Part - Time Bookkeeper/ Accountant?

Thread-Index: AQHdL6neOP7dXIiSj0+mCkthDExUu7amaxLggAHPbMA=

Disposition-Notification-To: Sofiya khan

Date: Fri, 21 Aug 2026 09:11:15 +0000

Message-ID:

References:

In-Reply-To:

Accept-Language: en-US

Content-Language: en-US

X-MS-Has-Attach:

X-MS-TNEF-Correlator:

x-ms-publictraffictype: Email

x-ms-traffictypediagnostic: CW1P302MB2415:EE_|LO0P302MB1629:EE_

x-ms-office365-filtering-correlation-id: 2d2ea641-fe7f-4e64-e673-08deff64274b

x-microsoft-antispam:

BCL:0;ARA:14566002|4140399003|25010399006|12121999013|55001999006|19101099003|15080799012|13091999003|31061999003|39105399006|37011999003|24121999003|22091999003|19110799012|8060799015|8062599012|3412199025|440099028|102099032|31055399003|43065399003|40105399003|2607281247196008|18071099003|1710799026;

x-microsoft-antispam-message-info:

=?utf-8?B?REhFRmIrbUpKRFhueGFTRDF6dXdMUnlaT1hNWlJGTnVHcUMzNVB3MzMyYUEr?=

=?utf-8?B?aWtzVGplWWR5LzZpczFZdWxGRUxHblF2QTh3MWhReXp5K2hmM2FkWlBsMWZJ?=

=?utf-8?B?UXRFdTJDQnVCb0RDWmtOeFg4aFVTVlg3cnJGQUM3VFNYNE9wV1cxRHlSbzd4?=

=?utf-8?B?T3RvaEc3bFA2UUVaZUNVa25yeWo2bmhJa2FHSHIyaUxKWmFIaGtib0xsMWIv?=

=?utf-8?B?aWZRNVgvZkNTdms5TWI4c3J6N3RwSWpISTgwRllzWVd0RXVUMm82aEd1VkIx?=

=?utf-8?B?b1RNUU5wQ3RxTnV1d3BQTGc0RUNzbU1mUXRBSXNEVVBnUzFndkVVeDFCa0hY?=

=?utf-8?B?WGcwYkVCSW5tR0VoN3U1OVByenJuaUdxOFBzdEJWbm5qRUs0SGRIWmNxa0Rn?=

=?utf-8?B?R0hXL2xnN0RpRjR6VGdxeXFnL2JoMEQ1dysyYnNLdnlGMVpIZWlKTXd3MGEv?=

=?utf-8?B?RjV0UVhIVFFkb0RJOXJYb1VuZm5neWEzRHZCOURtRnRiQzZsOHZ5bWg2UU9B?=

=?utf-8?B?OHpJVE5tZmd1UEo3M2ltR2NlYlRxME9WV0VLOFRjdk1jYlRPNXBSUFRCa0U4?=

=?utf-8?B?cUFHTFZ2b3ZVd05DMlB0T1cyNkIwYjBzT0NSOWRuRmQ3SEd0aW00UzZNYjRE?=

=?utf-8?B?eklMT3Vjd29aODE5bUxueDBTb0xlVUtkOHBLbmlrRjY1NGloaG8rZzVSYVE4?=

=?utf-8?B?bFVYczRBbmJzQmEzbjUxN0hCMlAvU2kxaUxSUWdQZVZCWDJ1VE5MelVNNnJx?=

=?utf-8?B?cmkzOGV0dzdtZmVWTTd0NkJJRm93aExubzZXQlVPREhvd0RJWkdKWUUvSDNB?=

=?utf-8?B?RzdqaENKTDBrQ1prM0QxSVZnOXlQYjBjZW1FdzJyeVZLT2I1cCtIc0pWKzZP?=

=?utf-8?B?NEdvVGg5YmZWckVKOWlhUHF0ZkJkY2svNmVxYU5hY3o4MUsvMTYyOGFWdFhk?=

=?utf-8?B?RDRNYjgzemNJQ21xV1JqdkpaeHVGdlduNTNHZDI1SUY5Y3BoalFkbXNYZ3Mz?=

=?utf-8?B?cHJnQUw3K2FPenM4ZEhHLzJKN1p5VFp0L3VUVkN0amNnOSs5YVdVeEJoTGRw?=

=?utf-8?B?V2VlMW5kdktmZUZrM1VCaHcyMHJiZGNEaVNVbzNzWXIwbkRJelkyaENDTTVL?=

=?utf-8?B?RHl2Uzg0Q29PMFdmSUdPMFpXUm1EbU9nNUdTMHdWNE1EdXpra05LSjFZdGR3?=

=?utf-8?B?WWUrc2o0ZUY1ZWUwNGZ2cWNHVzRBUHZ4VWVYWXBYVk5OS2RORG1CN042eW56?=

=?utf-8?B?VWh0cURIbzZidVM2dkg2Wk10cWx4NElyTmJOaUlnTDVYSDRtRzZwOVcwZ0RQ?=

=?utf-8?B?SzhJQ2pRZzliSWdvM0ExUmJnVllINk54dG1pVTBEaWd4THFtRlJxSHdEclBY?=

=?utf-8?B?RkJEVkRJVnJmVW8rSDZHOXNwNThORHhYakpodEJIVTJDTUZNaml5ajNKWmJl?=

=?utf-8?B?NnRwR1ZpVjlIOU1maTBrY0E1T3R5Qi9ML05aUVZmb3N1SS9NcVVvQ0g1cjNW?=

=?utf-8?B?YUZ2cXRmSEN0R01JR2ZNOUxxY1RsbVpSNnBnaXd2NnBHVTk3OE90UlRWUS9s?=

=?utf-8?B?SkFycnd1OTBwRUptM0c2bGdUaThIR29QMlc5eExCQVQ2SnZFVnVEOSt4ZG9n?=

=?utf-8?B?U2NWQjJJZU55SU5WTzJvemlhb041WXJXRTVQaWd3blVvb2czaDF2TFQyNThL?=

=?utf-8?Q?naw5UNc+vQLgtRFK/e2S?=

x-ms-exchange-antispam-messagedata-chunkcount: 1

x-ms-exchange-antispam-messagedata-0:

=?utf-8?B?Yjd0QjZnZ2tNS3BMaCtuWFdHdGRxL0dEOWZoSlBFcnI4SExETUowMk53Tmdi?=

=?utf-8?B?alUyVXVEZ1JJWkNMSVI0aUhiNXpURXh2SkVnSnh3dHlPUGt1bEtmYzZjcXF4?=

=?utf-8?B?RG5iSHBIb1N4M3J3MDFQU1RwWFlmRElpYXBWdUNCNTd0N1BLUWpINy8wS2dX?=

=?utf-8?B?OHpOYy9jR1FXOVoxTzI3VmJjaVBYd3UwdkNnTkVXQmpsTGI1TmJheFd5b3Z5?=

=?utf-8?B?d0JoZyttbjRyc0QyQ2ZQYlhsSWlLVW9EZTUzd0p5bHlnNk82SG5BMHlUS25S?=

=?utf-8?B?a2hKbGw4NVd2RlNEYXhZM0h2ODkwWjdXUVM4MmJocmZuQmd0ejg2aGxhaTl4?=

=?utf-8?B?WU5vRUl4TUpFRGYvSWZrTGJoY2RWMDFjeFYxTWFuaFNNMGJrUVZYTFVINzNq?=

=?utf-8?B?b2xDcUdvOVQ0WVI5Z0U3aGQyeDFUQ2p1TCt2MHB5cmpCTWtCMHUxL0w5Sk4v?=

=?utf-8?B?aFF1dk56YjV4a1c1blFYc1ovdUFGZ24rYXJ3aGdab091NlhFWGFqNEQzSGRN?=

=?utf-8?B?clFRb2xRa0s5KzU3dVBOL1EvV0VXbThtOGpvcWgrL1g1d25ybEJNZVZMaVFn?=

=?utf-8?B?eWFTeUxqc2xOdmt1L1RtRHNqQ1p2OW9QcUp4dVhEc2pQSEFpdFRkeHQ5L3dy?=

=?utf-8?B?U3ltUUV0S0FIMXpScXJlYnNGQmxILzRqWkFBTmFuWUxpT1FBTDBZR3hURWN6?=

=?utf-8?B?VkZRZEIxaGxJWk1VNWdFTVo4WkRDQ1BzNURKSGlCc2hWOGNCMEh4NEROaEN5?=

=?utf-8?B?MUUzSzFiNFVHanFHMWxqdzNqOWhRZG4wYmxtUDl0YnJybVY1NkJHUVBMbGFo?=

=?utf-8?B?SXNjL0lMd0VoalI0NmlVTlE3anNQRENiUVdFNWNwRUlZckltWjNGZkszT25z?=

=?utf-8?B?Y2NIMWtENzhTLzNBQ1lXakNYWFptL3JjZXYrRFM2bDR6QmhqS0t4cDRnb0pH?=

=?utf-8?B?a1d3U0R0ZXlQWnBxMnp3dEFVU0lPZHJ3bEJXTzI0Nml5N2FtU2ZKa0ZiS2R3?=

=?utf-8?B?SHpTVHAxYjVORzJDakVHMHFzaTR1b2dEc045RlhSNUVTTlNUelB1RDFUam5U?=

=?utf-8?B?RlpMS2pOSWFVb1VuS2VML2h1d2lDVFZna2pMWjJ6L0pPWCs2aEhSWEtoRjFX?=

=?utf-8?B?ZzJOQUZQRUk3VDU4Zng2bXhMNjIrZE1jQ2JqL0c5SGRvV0ZwR1EveVRUWGpk?=

=?utf-8?B?YzN4d0wrdEF1WncrTk55dVJjSzltWDZJUERFRzJDcjVaT2N5ZkF3SHg2Um45?=

=?utf-8?B?aGk4ZlVZUG4wYmsxT2FuTXRvQ2k5QlhEMGlNNHpUbHlSajVXRHR0VGVDbGYz?=

=?utf-8?B?VytzVzlPVXl5WTJGUG5MVDgxclNGWE9SUzI5WUN6eGZiMnNLam9EeTdXd05I?=

=?utf-8?B?dG1aNkNKbURzMDcxYy9RNjhmSWdEWU81bkhaU2E4V1dvaTg0TEMyNHRsdktM?=

=?utf-8?B?WjJwV0hmbnBSU0RpQk54dnhBZTRtd1BLU0JNZGEzaHdRNzNsNUhCVmljU0Nj?=

=?utf-8?B?ZXNySkMrb2hkU3IrVmlHM0pjNkdZVHB2WGVPWnB5QWw4RnZHTkVXMFE3eFVR?=

=?utf-8?B?RzQxbkY5KzNJRkJtYThpNERkdEFENW5GZUxLbnI3eXZkV0tibmNhR29JL3FS?=

=?utf-8?B?WlR4cDdGQlU1RUU0dkJZM0J4Yjl0eGpmMzFCV2szVndXN1JkZ2hxdFdyeXB1?=

=?utf-8?B?bzVXcWRaeGZ5NjdHNXFzTTBqNUN5QU1jSkJIRUdMOTJtVHpJUVBDdzM3VVBs?=

=?utf-8?B?cWRlaXJoWGp5ajJnZ1haWkI3UGROM1I4RXpVZWhQcEdib3lOQ3FvbVZ0aGds?=

=?utf-8?Q?OKO392nDdOQr39BqVG5tqs/Mshv5IsP7Zyw74=3D?=

Content-Type: multipart/alternative;

boundary="_000_CW1P302MB2415D1792982736A3C0E806FE9A32CW1P302MB2415GBRP_"

MIME-Version: 1.0

X-OriginatorOrg: outlook.com

X-MS-Exchange-CrossTenant-AuthAs: Internal

X-MS-Exchange-CrossTenant-AuthSource: CW1P302MB2415.GBRP302.PROD.OUTLOOK.COM

X-MS-Exchange-CrossTenant-RMS-PersistedConsumerOrg: 00000000-0000-0000-0000-000000000000

X-MS-Exchange-CrossTenant-Network-Message-Id: 2d2ea641-fe7f-4e64-e673-08deff64274b

X-MS-Exchange-CrossTenant-originalarrivaltime: 21 Aug 2026 09:11:15.3823

(UTC)

X-MS-Exchange-CrossTenant-fromentityheader: Hosted

X-MS-Exchange-CrossTenant-id: 84df9e7f-e9f6-40af-b435-aaaaaaaaaaaa

X-MS-Exchange-CrossTenant-rms-persistedconsumerorg: 00000000-0000-0000-0000-000000000000

X-MS-Exchange-Transport-CrossTenantHeadersStamped: LO0P302MB1629

Hello,

Hope you're doing well.

We provide reliable accounting and finance support for businesses, including bookkeeping, Accounts Payable/Receivable, bank reconciliations, payroll, financial reporting, sales tax, 1099 filing, payroll tax filings, month-end/year-end close, QuickBooks (Online & Desktop), and tax-ready financials.

Our team ensures accurate, timely, and compliant financial management so you can focus on growing your business.

Would you prefer more details, or would a quick 15-minute call work better?

Best regards,

Sofiya Khan

From: Sofiya khan

Sent: Monday, August 17, 2026 1:09 PM

To: sofiya871@outlook.com

Subject: Accounting & Bookkeeping Made Easy

Hello,

Hope you are doing well.

Please, could you let me know whether you are interested to hire a Dedicated Remote Accountants or bookkeepers on full time or on hourly rates at a reasonable cost?

Our range of services include:

· Tax, Accounting, Bookkeeping & Year-end finalization

· Financial Reporting including Income & Expenditure Statement, Balance Sheet, & Cash Flow Statement, Bank Reconciliation & Payroll Processing.

· Tax Solutions etc.

Would you like me to send you more information, or would a quick 15-minute call work better for you?

Thanks,

Sofiya Khan

Social Media promotion spam from Google Gmail

Posted by Dave Yadallee on Saturday, August 22. 2026

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Fri, 21 Aug 2026 10:29:03 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.5 (FreeBSD))

(envelope-from )

id 1wxPPB-00000000MSy-3oLX

for dave@doctor.nl2k.ab.ca;

Fri, 21 Aug 2026 07:35:33 -0600

Resent-From: The Doctor

Resent-Date: Fri, 21 Aug 2026 07:35:33 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-wm1-f46.google.com ([209.85.128.46]:39674)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.99.5 (FreeBSD))

(envelope-from )

id 1wxKs6-00000000MUi-1I8I

for doctor@nl2k.ab.ca;

Fri, 21 Aug 2026 02:45:14 -0600

Received: by mail-wm1-f46.google.com with SMTP id 5b1f17b1804b1-4957952e0f8so683265e9.2

for ; Fri, 21 Aug 2026 01:44:17 -0700 (PDT)

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20251104; t=1787301851; x=1787906651;

h=content-type:date:mime-version:message-id:reply-to:subject:to:from

:x-gm-gg:x-gm-message-state:from:to:cc:subject:date:message-id

:reply-to:content-type;

bh=KZzRixupibr34hwcyU6nBd0gPCpdjO/EeSkT8w8xHxw=;

b=fU9q2RMrMdbODyP6eA1xRsjFJOb4cmmpqhmmmxR1AlddJiQWL1HdoZ1P1HbRaXkkzg

K4Mm/pLF+k67XFlq2613YHov7XQH3S59Ohk/ojv7lpZYlunLGqOmWomSNGqNqLrF0oQ8

lHB2yeUoV5MSJAdG/yS316jHL3ceOKaaYi/u531F2OvK+c2B6H5IgOjMOJ3qlqkiZM6+

A3DfTFWLY/hpRbB3n7ecdFnTaiegB2DARRoBSShcBZvi4jk5t4A75akO/JuN35ho8G48

Du5h9nHkYsfpKf0nDKomyh7xWpjdvJlDDgUpToIPzVKdLAuFh0tuAVC/DdOpSHvdW2nS

mU/Q==

X-Gm-Message-State: AOJu0Yy+muHM9QNv9c7tIHcMfh72P7LyGCv0SGvY/GbjBb/4LJ3y4vm3

wkieNWquSex2AGy1nhaSBxq8gzs3eEtpb1ifyNfr9knSczYLGYh3gbgWXauewi4D

X-Gm-Gg: AR+sD12avPzU79HxRsb1rii+UC5n/vQEfAPDaHI7mTlz+hk3LeUEg5PFfKqkXjEZMQR

7zdwvDtJSeRN5AfL8TeJnjz69aS1dfDdMqw8/31rikOqM7827yN4DBQ1/85fWtjX3CS/rDnUJQq

5/8YlHOqsOnjs8Cm8QH5bqrx5C61fsXKWMfytyNlDM6LlY01qxmIXMW3WIRtVJf/g10cFr38Yd6

kBVOJuYaWAbfSvgoA3N3h2z5UWndgATIGnkVdUBE24SA3uiFef33lGmMLX8fQU+n1uV/6mKKC7q

LGRzMiZGD/E30RILmOhRb4zM+wMnGI7WSQ2VpLsqtbFltKJJNDKdM9ylWvGIgiMuH2OUK63P90G

J7YBwDKr9yPqk7iI9oh3eiy0/zEA+gukDJWc+HtXCz/4MnAW56i0n87VGBnkA61VKEz4g6EBaau

gLZHpjESu7Min1olDBD93whVLU13qfncNNWBlVjdiwgoXnTewVAsyxeOTNr/o7TkdBcDJTUMZVK

a2oxnlFF9xPpR/HXyOoQgqE4m6KQzvlPfc=

X-Received: by 2002:a05:600c:1548:b0:499:59da:12b9 with SMTP id 5b1f17b1804b1-499b827237cmr33610475e9.0.1787301850626;

Fri, 21 Aug 2026 01:44:10 -0700 (PDT)

Received: from [127.0.0.1] (cpl109.main-hosting.eu. [93.127.192.152])

by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-499bda1cda1sm4286305e9.13.2026.08.21.01.44.09

for

(version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256);

Fri, 21 Aug 2026 01:44:10 -0700 (PDT)

From: Pixelesz

To: doctor@nl2k.ab.ca

Subject: Are you getting leads from your social media?

Reply-To: hello@pixelesz.com

Message-ID:

MIME-Version: 1.0

Date: Fri, 21 Aug 2026 08:44:10 +0000

Content-Type: multipart/alternative; boundary=f_54j-hi

X-Spam_score: 10.3

X-Spam_score_int: 103

X-Spam_bar: ++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.

Content preview: Hello, I wanted to share a quick idea â€” your social media

presence could achieve greater impact with the right level of engagement.

We assist businesses in sustaining that without added effort on their part.

Would you like to explore how? Warm regards, Sameer Sehrawala +92 333 235

26 09

Content analysis details: (10.3 points, 5.0 required)

pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[93.127.192.152 listed in will-spam-for-food.eu.org]

[93.127.192.152 listed in will-spam-for-food.eu.org]

[93.127.192.152 listed in will-spam-for-food.eu.org]

[93.127.192.152 listed in will-spam-for-food.eu.org]

[93.127.192.152 listed in will-spam-for-food.eu.org]

[93.127.192.152 listed in will-spam-for-food.eu.org]

[93.127.192.152 listed in will-spam-for-food.eu.org]

[93.127.192.152 listed in will-spam-for-food.eu.org]

[209.85.128.46 listed in will-spam-for-food.eu.org]

[209.85.128.46 listed in will-spam-for-food.eu.org]

[209.85.128.46 listed in will-spam-for-food.eu.org]

[209.85.128.46 listed in will-spam-for-food.eu.org]

[209.85.128.46 listed in will-spam-for-food.eu.org]

[209.85.128.46 listed in will-spam-for-food.eu.org]

[209.85.128.46 listed in will-spam-for-food.eu.org]

[209.85.128.46 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[209.85.128.46 listed in dnsbl.ahbl.org]

[209.85.128.46 listed in dnsbl.ahbl.org]

[209.85.128.46 listed in dnsbl.ahbl.org]

[209.85.128.46 listed in dnsbl.ahbl.org]

[93.127.192.152 listed in dnsbl.ahbl.org]

[93.127.192.152 listed in dnsbl.ahbl.org]

[93.127.192.152 listed in dnsbl.ahbl.org]

[93.127.192.152 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[209.85.128.46 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[209.85.128.46 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[209.85.128.46 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[209.85.128.46 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_CBL RBL: Received via a relay in cbl.abuseat.org

[Listed by XBL, see ]

1.5 RCVD_IN_SBL_XBL RBL: Received via a relay in Spamhaus SBL+XBL

[93.127.192.152 listed in sbl-xbl.spamhaus.org]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[209.85.128.46 listed in list.dnswl.org]

1.2 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a relay in bl.spamcop.net

[Blocked - see ]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-0.0 SPF_PASS SPF: sender matches SPF record

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends in

digit

[bitznpixelz059(at)gmail.com]

0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider

[bitznpixelz059(at)gmail.com]

0.0 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level mail

domains are different

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[209.85.128.46 listed in wl.mailspike.net]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[209.85.128.46 listed in bl.score.senderscore.com]

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

1.6 HTML_IMAGE_ONLY_12 BODY: HTML: images with 800-1200 bytes of words

0.5 FROM_SUSPICIOUS_NTLD From abused NTLD

0.2 FREEMAIL_FORGED_FROMDOMAIN 2nd level domains in From and EnvelopeFrom

freemail headers are different

0.1 HTML_SHORT_LINK_IMG_1 HTML is very short with a linked image

2.0 FROM_SUSPICIOUS_NTLD_FP From abused NTLD

0.0 T_REMOTE_IMAGE Message contains an external image

Subject: {SPAM?} Are you getting leads from your social media?

--f_54j-hi

Content-Type: text/plain; charset=utf-8

Content-Transfer-Encoding: quoted-printable

Hello,

I wanted to share a quick idea =E2=80=94 your social media presence cou=

ld achieve greater impact with the right level of engagement.

=20

=20

=20

We assist businesses in sustaining that without added effort on their p=

art. Would you like to explore how?

Warm regards,

Sameer Sehrawala

+92 333 235 26 09

--f_54j-hi

Content-Type: text/html; charset=utf-8

Content-Transfer-Encoding: quoted-printable

; max-width: 600px; margin: 0; text-align: left;">

Hello,

I wanted to share a quick idea =E2=80=94 your social media presence cou=

ld achieve greater impact with the right level of engagement.

tyle=3D"text-decoration: none;">

R-PK_fvv5a3.jpg" alt=3D"Pixelesz" style=3D"width: 100%; max-width: 600px; d=

isplay: block; border: 0;">

We assist businesses in sustaining that without added effort on their p=

art.

Would you like to explore how?

Warm regards,

Sameer Sehrawala

+92 333 235 26 09

382ee0a5161baca7fc39c27b1dafb3ea2781af098629d" width=3D"1" height=3D"1" sty=

le=3D"display:none" alt=3D"" />

--f_54j-hi--

Financial opportunities spam from Google Gmail

Posted by Dave Yadallee on Saturday, August 22. 2026

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Fri, 21 Aug 2026 08:29:01 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.5 (FreeBSD))

(envelope-from )

id 1wxPJs-00000000MHh-0XSu

for dave@doctor.nl2k.ab.ca;

Fri, 21 Aug 2026 07:30:04 -0600

Resent-From: The Doctor

Resent-Date: Fri, 21 Aug 2026 07:30:04 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-ej1-f51.google.com ([209.85.218.51]:50287)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.99.5 (FreeBSD))

(envelope-from )

id 1wxHPm-00000000BZS-42rG

for doctor@nl2k.ab.ca;

Thu, 20 Aug 2026 23:03:48 -0600

Received: by mail-ej1-f51.google.com with SMTP id a640c23a62f3a-c1671ec8692so90579466b.0

for ; Thu, 20 Aug 2026 22:02:06 -0700 (PDT)

ARC-Seal: i=1; a=rsa-sha256; t=1787288519; cv=none;

d=google.com; s=arc-20260327;

b=FAfGD2onxo58Qq6uo/T9MnyIYbrv1D6DDiVfWeE/gd8vPhm5ZMWcSBK/IxSmuRRBMM

V68tYhdcgcwt8tkmXdklbt92BDyxNglnnrey+cZoAhQfVowFia2MVk5F8Sy0jptWgj28

jf9SWDA84k/YwWQvcrC2iFiPkwQiHXbFmHtBIeaa2Cd+/EayJvVYhfxmFUNCjLqTgZnZ

saqgSR/TlSrQiSgtnjPF4m/tebncABHyyhXtfiswC9tbfURoVQ+RGeeS954Hf2SK061X

XyNbXKu9xbMkgo7KL8S0EyftPKFyP+HyaQSn0wmpvT+hBRDlZp47ibPAo3kySWV+uibJ

9wwg==

ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20260327;

h=to:subject:message-id:date:from:mime-version:dkim-signature;

bh=yH2dQclO8Bt484M/f/oQoy/VRhKpSAJbwLo3hM/Ez/M=;

fh=om1hgpMVWCoDnhIOYtJ/t1j1/ZqCdAW7PPY5lpMymSI=;

b=P98x6AQWv5z8TL1VnjBzv+BWr01OnAXQIFZrSYTofdNH7MZZ7mbudMEkT03LgPxStI

uRTNEYus2nN+a6mpGEA4ArY9n80EdeItcwFPPJNuhSRzTAgfulIDK3POJ8ab7NAfR7EN

soVPm0aSaqVsGguY7avqifvAc/uQTIpdfnH7epPYEFlnqXZyYey7eN8K9D7KyPdobr00

TyfZjSyBktFGO18blY4GCBOVVDqTXmCJgFxgMtO+5khWrjg1arrH2BmEh8+X1PxV6LkD

oCJ0UcLvIjJCSfkMA1yBC39IINAuz7DI0aX1JSaoQD1NUxLADs74SLbyNgNgX0zZ1/Wt

mEfg==;

darn=nl2k.ab.ca

ARC-Authentication-Results: i=1; mx.google.com; arc=none

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=gmail.com; s=20251104; t=1787288519; x=1787893319; darn=nl2k.ab.ca;

h=content-type:to:subject:message-id:date:from:mime-version:from:to

:cc:subject:date:message-id:reply-to:content-type;

bh=yH2dQclO8Bt484M/f/oQoy/VRhKpSAJbwLo3hM/Ez/M=;

b=WJm2ieAamtdvJpFMMAEzvkH3cQFom7xNOe4UwUjEa7ItEqfyIUfj81FBsLpLVdbUUh

R1Pusw8nipQTmuh9xz0cPauWl0ZEx2/lu5mki+LZYF2NEkWqL1UKWbmdd0ar/QP3MvPb

7RWiv4TsZwEz0InqwNQyF9X5+y/cRzTDp9GV5dIK127pHwEOBltWsw/lgOQx/nbtj8sJ

YhMwiTyW55/ZeP04sOndu3hMI6DuVTGVPeGr9pd4MDk8IJ41VugAgiyq2OnX5wnWwoDn

05AFWye8CdU9LuSZpQ+Ye/evWUb3BWTy8J7Tw+X5O6uQdM9XHCF8Sd/tiBA90MJm0JHz

HQcQ==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20251104; t=1787288519; x=1787893319;

h=content-type:to:subject:message-id:date:from:mime-version:x-gm-gg

:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to

:content-type;

bh=yH2dQclO8Bt484M/f/oQoy/VRhKpSAJbwLo3hM/Ez/M=;

b=TdLp2X16WjWs/KNveJLd4hsuhSvVl4j3MiwBoMs3Xk7lADg7D39AqIHCBMzKCjb7xt

dk84DxqvglPxLETF80gYrAXfnLG6+IiBwQc0YuTOJ4rUCLAI4Pj4rQtLdtIvjTnMDMxc

NrlPwbHijN8t2jCQsUrqzrNH/n28KwzcPV+J+MCBS9E2tOIu/h76XnkkJ9FhLHLlnsUi

43UKh6NIcWQ4Z1yRD0NupPMPJyWX8zLG+eT2pGkkajRa2RY+jhXGESctDQYqWBVsP/lZ

ZTzImLibCOp59HXfoo6OKfoxvWxN16oEmjm5wNOpOnO847iU8RjUHowzaBrMa18ZLyvk

owQA==

X-Forwarded-Encrypted: i=1; AHgh+RqG+8yRjRj4/ys6H6FKtCZU0QXM7nBaZkYj0Mks5bvkwJFu6JGtazqa3C8MziYm2Xzqer3SNjs=@nl2k.ab.ca

X-Gm-Message-State: AOJu0Yyc4rpqo0A7JI3dJqCIHKK7L82pB9xvgQ+w8b5L7e3FkFO/Mf9i

wa+2l3gv0YVfXoHfpc8PjqYQuceV3YjZ6uzj6H+eXQsm07g5safeh80lKSqXIYdywlJfe4PA5q1

JK8x6PX1jwRfOX/cR0pGVEppDC3q7AC0=

X-Gm-Gg: AR+sD104aOLr+WNQANwl665onHFXbJccxjF+31R0wyYhy5/RHB8dfkaJOuwU2fKUmv/

oLjTRoMkx/8q8Bev9BRKKC3yTMHtO8iUbRogkpAlEplmToi8zsil9UeMjDCqeiOWONYLzGcr2EC

mThgyO+Cx/ch24VsCp9F39IV3/zLrfwzaVzZPbwWyMEDJRWG3UbXhPODCkaKmo0JSjRUqI5LGmI

0JeV9lQk0Eu/wvZDiAt4ZG/Jmi3CZ9hBjMcrBq6eFjHGP3XicUvJmvcJl+dBFVFyDgGT7E1wQxV

Gpnt++xtfFP8Eh7nPpzJl9MVpshI7hjCnicPpOq3HqpW0w==

X-Received: by 2002:a17:907:3cc2:b0:c24:680a:1c42 with SMTP id

a640c23a62f3a-c246a4d3bb6mr360299566b.7.1787288519529; Thu, 20 Aug 2026

22:01:59 -0700 (PDT)

MIME-Version: 1.0

From: "Dr. Benz Mathias"

Date: Thu, 20 Aug 2026 22:01:51 -0700

X-Gm-Features: AcwNN1VhDrE6akYoLLYs9PsOkG8_Nj2lbdItIb4qQpt_3uC_H6nvP2AFusMPyM4

Message-ID:

Subject: Subject: Funding Opportunities We are reaching out to engage with

individuals, entrepreneurs, corporations, and investors, as well as start-up

owners, who are seeking financing for their projects. Our company is ready to

invest in viable initiatives and would be glad to share our terms and

conditions after reviewing your project plan and executive summary. If you

are committed to exploring this opportunity, please submit your project plan

and executive summary for our evaluation. Best regards, Dr. Benz Mathias

To: undisclosed-recipients:;

Content-Type: multipart/alternative; boundary="0000000000005158700659878957"

Bcc: doctor@nl2k.ab.ca

X-Spam_score: 9.4

X-Spam_score_int: 94

X-Spam_bar: +++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.

Content preview:

Content analysis details: (9.4 points, 5.0 required)

pts rule name description

---- ---------------------- --------------------------------------------------

2.3 EMPTY_MESSAGE Message appears to have no textual parts and no

Subject: text

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[209.85.218.51 listed in will-spam-for-food.eu.org]

[209.85.218.51 listed in will-spam-for-food.eu.org]

[209.85.218.51 listed in will-spam-for-food.eu.org]

[209.85.218.51 listed in will-spam-for-food.eu.org]

[209.85.218.51 listed in will-spam-for-food.eu.org]

[209.85.218.51 listed in will-spam-for-food.eu.org]

[209.85.218.51 listed in will-spam-for-food.eu.org]

[209.85.218.51 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[209.85.218.51 listed in dnsbl.ahbl.org]

[209.85.218.51 listed in dnsbl.ahbl.org]

[209.85.218.51 listed in dnsbl.ahbl.org]

[209.85.218.51 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[209.85.218.51 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[209.85.218.51 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[209.85.218.51 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[209.85.218.51 listed in dnsbl.ahbl.org]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[209.85.218.51 listed in list.dnswl.org]

-0.0 SPF_PASS SPF: sender matches SPF record

3.3 MIME_BOUND_DIGITS_15 MIME boundary contains all digits

1.5 GR_DOMAIN_UNDISC1 To contains undisclosed recipient (undisc)

0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends in

digit

[benzelmathias1(at)gmail.com]

0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider

[benzelmathias1(at)gmail.com]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 T_HK_NAME_FM_DR No description available.

0.8 SARE_FROM_SPAM_WORD3 I don't know people named this!

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

-0.0 RCVD_IN_MSPIKE_H3 RBL: Good reputation (+3)

[209.85.218.51 listed in wl.mailspike.net]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[209.85.218.51 listed in bl.score.senderscore.com]

-0.0 RCVD_IN_MSPIKE_WL Mailspike good senders

Subject: {SPAM?} Subject: Funding Opportunities We are reaching out to engage with

individuals, entrepreneurs, corporations, and investors, as well as start-up

owners, who are seeking financing for their projects. Our company is ready to

invest in viable initiatives and would be glad to share our terms and

conditions after reviewing your project plan and executive summary. If you

are committed to exploring this opportunity, please submit your project plan

and executive summary for our evaluation. Best regards, Dr. Benz Mathias

--0000000000005158700659878957

Content-Type: text/plain; charset="UTF-8"

--0000000000005158700659878957

Content-Type: text/html; charset="UTF-8"

--0000000000005158700659878957--

funding opportunities spam from Google Gmail

Posted by Dave Yadallee on Saturday, August 22. 2026

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Fri, 21 Aug 2026 08:29:01 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.5 (FreeBSD))

(envelope-from )

id 1wxPJz-00000000McD-1RYi

for dave@doctor.nl2k.ab.ca;

Fri, 21 Aug 2026 07:30:11 -0600

Resent-From: The Doctor

Resent-Date: Fri, 21 Aug 2026 07:30:11 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-ej1-f45.google.com ([209.85.218.45]:50282)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.99.5 (FreeBSD))

(envelope-from )

id 1wxHPp-00000000BZi-11yJ

for doctor@netknow.ca;

Thu, 20 Aug 2026 23:03:50 -0600

Received: by mail-ej1-f45.google.com with SMTP id a640c23a62f3a-c1671ec8692so90579766b.0

for ; Thu, 20 Aug 2026 22:02:06 -0700 (PDT)

ARC-Seal: i=1; a=rsa-sha256; t=1787288519; cv=none;

d=google.com; s=arc-20260327;

b=RBShT6P9Kn84+znLPfLllV2Y5NlFTpJMg4kt4L/hje5ZhqkTaRKqp6bSyG/Xln2k2o

TnZWP0PMVWTSN9SYxYfLcqPgnwiVWNOOmMCTtQPCUXhZQvnE4dSPkmx7EY3PfVOWsItI

0w+/a9nSmXtest3hMoOAwbQLTHyU8hHW4dnQ+V0EaopeC2Bg8IzSFpiortZIs6uRSb1f

XDgZJCKbiZbjyfKxJcD6h8AE0+vi0CzscsV7DLZLpqxm+Ymh/rANlB9XpzdiORqtC5t7

Pdo3vLQCxz2cVLZo01plkQk9pKebIsD10o3cxp1nlz3D6QmxB2fbxp/dxcyC+nu/WYrL

Ek6g==

ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20260327;

h=to:subject:message-id:date:from:mime-version:dkim-signature;

bh=yH2dQclO8Bt484M/f/oQoy/VRhKpSAJbwLo3hM/Ez/M=;

fh=C9lIRf5KOICE+cOeAdlg4XtAdTA5ykIdNQtWz/6x8U4=;

b=j1FI1qmQo+h527lsJZxoALLMbTkJC/YHoAR0g6/tILGt9j85Q92TcKBqc16J3PfeKu

3axSaSVEISKwi/Ls73VnWqzuCccmqNE3dSje0fE16ozvVUb+svWyn2W1eHYRxUg3WsxK

Z7QE2wsGb0erNySzIVi/pOuhBCQTBzZNJsfjOgBMcYzxc40TXfIi0VyFcL0kfJqJo7/X

Bw29Lo9bM5rXTYIIitXfM7i8RK6UsLd4n3BqsGaSPI6EGBQoaxqm8vCTGHc50CS3DKdj

ogUOx8IbHw9yw1gTSiTrFSeioxYKABIj0aRMWSsQvSBhjussl13yWpbaz+TbuAc9UOnM

nEMA==;

darn=netknow.ca

ARC-Authentication-Results: i=1; mx.google.com; arc=none

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=gmail.com; s=20251104; t=1787288519; x=1787893319; darn=netknow.ca;

h=content-type:to:subject:message-id:date:from:mime-version:from:to

:cc:subject:date:message-id:reply-to:content-type;

bh=yH2dQclO8Bt484M/f/oQoy/VRhKpSAJbwLo3hM/Ez/M=;

b=ALsuj80NJd0e5fW2dy/kIAV+tqe3fHGmwx4QbBnM1VFVxL0wfybPrNBGrAYq+8LyZk

vD64FwGUDc8nv4tCcJAgrGMnjbBXMv1VkskwN3HnQrhDnP/bqyG23u+9RkoygIUc2uRA

FnRzlSwy76T71toev8onTHBNHlh46Zq9x746y+07di3hKF6mN9skA8t+uNFQl+CthJVE

JMgu6nR9vPzHtt2Fh5T4Usy55uqaxwtJCPUVApC1Ylf/7muVt+1RX38a/XJqEMlW26hX

nGP6ydNudeyBjg/26sdIvbhkkyc4mBjF4rBl9tvoBkCDvAHvRmGQYUYH0yqs3ah1ZZnK

S/uw==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20251104; t=1787288519; x=1787893319;

h=content-type:to:subject:message-id:date:from:mime-version:x-gm-gg

:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to

:content-type;

bh=yH2dQclO8Bt484M/f/oQoy/VRhKpSAJbwLo3hM/Ez/M=;

b=fikz+hg7FxUvtOHxLzOcujsAo3LCG2jiWIqh71DrQk8G9MbahlfBn0g7NnI0EBgxbE

uAsFU8A/S14CcfE5AETmwuGH+Ca0x3a5tIuDCei7mpJM+iEeQy0k8buORFiW4G/OmOqF

Yp/lKhpYAy+ukwDq5EKkcQa9ci41vGkjerv8KAboZ0UAYpNoSjeAfPNgCFKp7L6igSUT

2Ip9tSMslEwG7HmCo5zwBkUJZVq9vPtTC1iAcG4olW/LyWHfkwqO4yceETQjhPS+ZtuU

Dftq4dTQGjZaQf/R+m1y9XT8bUQWU/knpl/hwdSJ0CPO8JebpQGa1/2WkI5slcwpUL1x

lJmA==

X-Forwarded-Encrypted: i=1; AHgh+RodGUCADAKvFX2Nw8+8Gbov+ToPEkH1myFal1QDlkOWMepkQ3d0eSdVChKcK7Z8AedfZKM6D/Q=@netknow.ca

X-Gm-Message-State: AOJu0YxUXbtZJqrfshAQnUV0bj1VGptz44FPlLqw/5MCBqaeJ87Y8pHz

4JhVQmNJGsrWTXFkv59b+vawsjqMamugl4tqnOiF78wKqJbyIyYVVgx683UE77DZiuqsZ/ZeZGF

ep8Lpg9BQuoXM5YUn23oedbMbixk+IrY=

X-Gm-Gg: AR+sD10apYTUMs3GpqRBgeTQZiqXhVKVTA1BJbc7m9YjKlU1j2gp2OZNhzb3TCa70Fs

7w8uvLvPcKqowkrDeqsO+rcbkvEG6WHiR0y+rnZLoiz8XkyDMB4hOIXihA1sKHv8d9eMM6OvrXx

8StjsIr0OssdTZwPir1xZ0z5LNx6UoQc4G9F54UxzWIYYIjq/2cX9RaWi7qeveYOv66dpD+PWxK

Rz80hOlerSYhUbtmcxHQN7cUZTdc03cMLZOnDqeq1lOiHM64/4bZcKC4H/+0RB8ulRonnPC9d8B

kPk+ETGRkmrecf/mLtAXUbDbqg8N7FU4NY97RBZB+b/R3Q==

X-Received: by 2002:a17:907:3cc2:b0:c24:680a:1c42 with SMTP id

a640c23a62f3a-c246a4d3bb6mr360299566b.7.1787288519529; Thu, 20 Aug 2026

22:01:59 -0700 (PDT)

MIME-Version: 1.0

From: "Dr. Benz Mathias"

Date: Thu, 20 Aug 2026 22:01:51 -0700

X-Gm-Features: AcwNN1VhDrE6akYoLLYs9PsOkG8_Nj2lbdItIb4qQpt_3uC_H6nvP2AFusMPyM4

Message-ID:

Subject: Subject: Funding Opportunities We are reaching out to engage with

individuals, entrepreneurs, corporations, and investors, as well as start-up

owners, who are seeking financing for their projects. Our company is ready to

invest in viable initiatives and would be glad to share our terms and

conditions after reviewing your project plan and executive summary. If you

are committed to exploring this opportunity, please submit your project plan

and executive summary for our evaluation. Best regards, Dr. Benz Mathias

To: undisclosed-recipients:;

Content-Type: multipart/alternative; boundary="0000000000005158700659878957"

Bcc: doctor@netknow.ca

X-Spam_score: 9.4

X-Spam_score_int: 94

X-Spam_bar: +++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.

Content preview:

Content analysis details: (9.4 points, 5.0 required)

pts rule name description

---- ---------------------- --------------------------------------------------

2.3 EMPTY_MESSAGE Message appears to have no textual parts and no

Subject: text

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[209.85.218.45 listed in will-spam-for-food.eu.org]

[209.85.218.45 listed in will-spam-for-food.eu.org]

[209.85.218.45 listed in will-spam-for-food.eu.org]

[209.85.218.45 listed in will-spam-for-food.eu.org]

[209.85.218.45 listed in will-spam-for-food.eu.org]

[209.85.218.45 listed in will-spam-for-food.eu.org]

[209.85.218.45 listed in will-spam-for-food.eu.org]

[209.85.218.45 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[209.85.218.45 listed in dnsbl.ahbl.org]

[209.85.218.45 listed in dnsbl.ahbl.org]

[209.85.218.45 listed in dnsbl.ahbl.org]

[209.85.218.45 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[209.85.218.45 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[209.85.218.45 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[209.85.218.45 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[209.85.218.45 listed in dnsbl.ahbl.org]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[209.85.218.45 listed in list.dnswl.org]

-0.0 SPF_PASS SPF: sender matches SPF record

3.3 MIME_BOUND_DIGITS_15 MIME boundary contains all digits

1.5 GR_DOMAIN_UNDISC1 To contains undisclosed recipient (undisc)

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends in

digit

[benzelmathias1(at)gmail.com]

0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider

[benzelmathias1(at)gmail.com]

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 T_HK_NAME_FM_DR No description available.

0.8 SARE_FROM_SPAM_WORD3 I don't know people named this!

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[209.85.218.45 listed in bl.score.senderscore.com]

-0.0 RCVD_IN_MSPIKE_H3 RBL: Good reputation (+3)

[209.85.218.45 listed in wl.mailspike.net]

-0.0 RCVD_IN_MSPIKE_WL Mailspike good senders

Subject: {SPAM?} Subject: Funding Opportunities We are reaching out to engage with

individuals, entrepreneurs, corporations, and investors, as well as start-up

owners, who are seeking financing for their projects. Our company is ready to

invest in viable initiatives and would be glad to share our terms and

conditions after reviewing your project plan and executive summary. If you

are committed to exploring this opportunity, please submit your project plan

and executive summary for our evaluation. Best regards, Dr. Benz Mathias

--0000000000005158700659878957

Content-Type: text/plain; charset="UTF-8"

--0000000000005158700659878957

Content-Type: text/html; charset="UTF-8"

--0000000000005158700659878957--

Mon	Tue	Wed	Thu	Fri	Sat	Sun
← Back	August '26					Forward →
					1	2
3	4	5	6	7	8	9
10	11	12	13	14	15	16
17	18	19	20	21	22	23
24	25	26	27	28	29	30
31