Nigerian compensation spam from Google Gmail Part 2

--000000000000012f4e0654b4a67c

Content-Type: text/plain; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable



Subject: Midland Financial Recovery Bureau =E2=80=93 Victim Compensation Pr=

ogram

Compensation Award: USD $1,500,000.00

Reference ID: MF1122-CRX00491

Address: 8600 Westfield Avenue, Suite 210, Houston, TX 77040, USA



Dear Recipient,



We are contacting you as a listed beneficiary in a federally supported

restitution initiative established to compensate victims of financial

fraud. This action follows the prosecution and sentencing of

individuals=E2=80=94namely Andrew Collins, Eric Mateo, and Linda Frost=E2=

=80=94who were

recently convicted of operating fraudulent schemes while posing as

representatives of financial and government institutions.



As part of the outcome, the Midland Financial Recovery Bureau, in

collaboration with U.S. regulatory authorities, has approved a compensation

payment of USD $1,500,000.00 to be issued in your name. Disbursement will

be made through a secure ATM-enabled payment card, and all standard

transaction and delivery costs will be covered by the issuing entity.



To confirm your eligibility and initiate the processing of your payment,

please provide the following information for verification and compliance

review:



Full Legal Name



Residential Mailing Address



Current Occupation



Active Contact Number



Government-Issued Photo Identification (valid)



Please be advised that a nominal Processing and Verification Fee will be

required to complete the official endorsement and release of funds. There

will be no additional fees once this has been fulfilled.



This compensation program is part of a broader effort to assist fraud

victims and reinforce public confidence in financial institutions.



Sincerely,

Mr. Thomas E. Ralston

Director, Compensation Oversight Division

Midland Financial Recovery Bureau



--000000000000012f4e0654b4a67c

Content-Type: text/html; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable





=3D"gmail_signature" data-smartmail=3D"gmail_signature">

iv>Subject: Midland Financial Recovery Bureau =E2=80=93 Victim Compensation=

Program
Compensation Award: USD $1,500,000.00
Referenc=

e ID: MF1122-CRX00491
Address: 8600 Westfield Avenue, Suite 210, =

Houston, TX 77040, USA

Dear Recipient,
<=

br>
We are contacting you as a listed beneficiary in a federally =

supported restitution initiative established to compensate victims of finan=

cial fraud. This action follows the prosecution and sentencing of individua=

ls=E2=80=94namely Andrew Collins, Eric Mateo, and Linda Frost=E2=80=94who w=

ere recently convicted of operating fraudulent schemes while posing as repr=

esentatives of financial and government institutions.

<=

div>As part of the outcome, the Midland Financial Recovery Bureau, in colla=

boration with U.S. regulatory authorities, has approved a compensation paym=

ent of USD $1,500,000.00 to be issued in your name. Disbursement will be ma=

de through a secure ATM-enabled payment card, and all standard transaction =

and delivery costs will be covered by the issuing entity.


iv>
To confirm your eligibility and initiate the processing of your pay=

ment, please provide the following information for verification and complia=

nce review:

Full Legal Name


iv>Residential Mailing Address

Current Occupation<=

/div>

Active Contact Number

Gov=

ernment-Issued Photo Identification (valid)

Please=

be advised that a nominal Processing and Verification Fee will be required=

to complete the official endorsement and release of funds. There will be n=

o additional fees once this has been fulfilled.

Th=

is compensation program is part of a broader effort to assist fraud victims=

and reinforce public confidence in financial institutions.

<=

/div>
Sincerely,
Mr. Thomas E. Ralston
Director, Co=

mpensation Oversight Division
Midland Financial Recovery Bureau
div>




--000000000000012f4e0654b4a67c--

Nigerian compensation spam from Google Gmail Part 1

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Sat, 20 Jun 2026 14:07:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wb1xv-00000000OMF-1FBX

for dave@doctor.nl2k.ab.ca;

Sat, 20 Jun 2026 14:06:55 -0600

Resent-From: The Doctor

Resent-Date: Sat, 20 Jun 2026 14:06:55 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-lf1-f68.google.com ([209.85.167.68]:46082)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wb1l6-00000000MoU-2UDL

for doctor@nl2k.ab.ca;

Sat, 20 Jun 2026 13:53:49 -0600

Received: by mail-lf1-f68.google.com with SMTP id 2adb3069b0e04-5aa61e3d3f3so3199762e87.0

for ; Sat, 20 Jun 2026 12:52:53 -0700 (PDT)

ARC-Seal: i=1; a=rsa-sha256; t=1781985167; cv=none;

d=google.com; s=arc-20240605;

b=O8OxZ3F1zRGk4FCVxp8fJPAMV9dz8mD2SQ0UmSHvxCrk1otvdsMH3yOPCj6gjJZkLn

JI5kG0kVGJ5HqyihWKCvR1eIMgWuELOnD+VQ0SXTGKpwuv96K+rW/eNATGWdH+tHLKm6

bx5S0c9/QFbe4tt43JXAdv/OjcK73rtVvy5Md6DflZexNLZxosHTjSX5MHDUAkgAWuNO

WljV9ybZve6RhSt4pvzs/c1OefxiLGZFYhW5hsZf9jnU1zYBoQohWT4qe77aGhsZP5fp

qTLFI5v0Gh2VP8RgMO97On8S/Ln0nSgM4B52JuzqTWemL1X+8ZyLFq9zmtniGzWfxmUm

cXkA==

ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20240605;

h=to:subject:message-id:date:from:reply-to:mime-version

:dkim-signature;

bh=em15lI1mKGVSJdQKVfxc2yi8Xza15rcXvqiJNGJzY8s=;

fh=orJp/q+dnqXd0NVruQJu/MGd1eiLPBDdRK99mjGHmPU=;

b=TjD3w0Gf1nNQj5txJEDu0OgVmYY+I4/SWXxcb8lO3omdkBkMWezEOxSJWSsUJLg4N2

zqoed9diUmgG7MW3XQC2opo14BetV5gQuBa0z1ntah+jql0xrjMWJaowHdUK+2CnLyFz

cBLptHdiGY1AIac9HrMHmjcrRZVVadvyKOEjH5Qt1rZs+Y6bPSWByb1e3MeGJc3fxqK4

Vt5e9bS1XVyOMIk4kmUTV/xBIo1nOPCfG3a2w29ANRO+HWWgNRIa6VbNWwmNbBCycVmY

+KaYn3Wv9oTgVooR3h/i9UXKmXy2jeOEeu07LsCTkGPDoiBFTqFlPqU/k4dwX2+e2Bwx

ONmg==;

darn=nl2k.ab.ca

ARC-Authentication-Results: i=1; mx.google.com; arc=none

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=gmail.com; s=20251104; t=1781985167; x=1782589967; darn=nl2k.ab.ca;

h=to:subject:message-id:date:from:reply-to:mime-version:from:to:cc

:subject:date:message-id:reply-to;

bh=em15lI1mKGVSJdQKVfxc2yi8Xza15rcXvqiJNGJzY8s=;

b=SIrP388Mo0eU6ugRRtSbh82EiAznjdkZG2q0EnTNk/ceBaVrp9xrPB3AD+TUIr4QYL

6qUNj648kAOwI+EEoJabQ/gAC6UlDiedQ4rAzB+MQl16TLFmHTJTPLa4cXHL3UjGEn81

CRXxErsrPtS9dIv/uHX3Q+ob60TQr/crcwW6JSagQ/zM5zOUlW9WkHg4BAIupmURwtIS

XeO0etrrT3t2MTB3TJ2V5sJKrc1+EJGejqE+VUllW5Mt8XApHSYrI1TlsyfWgVgXdPgh

TJxemyYumaRJyutgKHmpdejSQT0Vvv0pdUYg4HnITWBr3rKjFfl3WMto+8vXj37UM0+Q

KgRA==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20251104; t=1781985167; x=1782589967;

h=to:subject:message-id:date:from:reply-to:mime-version:x-gm-gg

:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to;

bh=em15lI1mKGVSJdQKVfxc2yi8Xza15rcXvqiJNGJzY8s=;

b=Ru2qu+qMXT81Jy/DQL61lPyWSoX/xm1uXKtflGaLOYZeBNwGnSzCLD8oNGfqlEQo0H

vABBlUE2tLaqnuD4lbLnzIEjLQWCwfQtKfQ75zw8mnphUE2sL04Hv5rUzf+TyO/3ROUD

xal5++FBDHTeTkkXyA4NvarpHv3QzteI2Cm8X1rX+lnYr3b3kSSAYHDOxr00grxdjq0G

PhBAJsDc6Jw8+cxhnmpedmnEBuAl/cjH/EUbiciMURatiZ4TubfiLX/8MTB44vLU1LfB

PSRzOPh4q8MUGgqZ3IO23Ht3jNKrkIjBTudRqCDJHpBRmAOqdLde26XDa/pb3xrmUNWW

fmIQ==

X-Forwarded-Encrypted: i=1; AFNElJ9SzlNSTSGOT7NvVtIn9rz75ViNxgz6Ho9k/3fg3KIJYFy7li4upAiMaLjnLKJIa0DoOZVmTk8=@nl2k.ab.ca

X-Gm-Message-State: AOJu0Yy6vM5NJBJaWYs0hRq7YCD/v1nmlrbWSc2GufAiL1AV8hjklCSv

4RVtPQ3RooGz6PTR1t/r95WTYFT3hN0N4W72whtuMnICmjkQw/DZqsvD6uixRmXw8P9f0kuEsWs

14TfgFxWyt4dqMEEAoZ7SKXOvzSji578=

X-Gm-Gg: AfdE7cl7GRDwcLUB6kZSzFy2W/qUNb05nh7wSRfuMVo3CRek9SM0oY1SgWfuTiTW9q8

hLRrnWTZHcnJGvFTJ26y44RFva/QrF6OfPVLm17L0U3ysnQ/3oMNHwOw93s0pBOmlBfJpk35WWE

FbnHWUN39HB7sXakFpJolvRNyy9C52WV9TaKkymJcUr9WdOBfIZUjJgwDB1OcGMUuyskpD6jiSI

m0vca4/I7jk+oJfFMOjlj2HTvG9p0/2ebViPy/yiZjYMaViOaTRHvmKyh7kN1DtfHIsD8MUf5Qc

hph+T8GT

X-Received: by 2002:a2e:a9a5:0:b0:396:9966:50cf with SMTP id

38308e7fff4ca-3998e4092d7mr16710201fa.9.1781984716204; Sat, 20 Jun 2026

12:45:16 -0700 (PDT)

MIME-Version: 1.0

Reply-To: citibank.co.usa@gmail.com

From: Michael Corbat

Date: Sat, 20 Jun 2026 12:44:41 -0700

X-Gm-Features: AVVi8Cee6rCzcsUfU88IFtFAIMaK7YU6-UAmDxNctI4bo92nl-eibb70H8m3-qc

Message-ID:

Subject: Compensation Award

To: undisclosed-recipients:;

Content-Type: multipart/alternative; boundary="000000000000012f4e0654b4a67c"

Bcc: doctor@nl2k.ab.ca

X-Spam_score: 16.4

X-Spam_score_int: 164

X-Spam_bar: ++++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Subject: Midland Financial Recovery Bureau – Victim Compensation

Program Compensation Award: USD $1,500,000.00 Reference ID: MF1122-CRX00491

Address: 8600 Westfield Avenue, Suite 210, Houston, TX 77 [...]



Content analysis details: (16.4 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[209.85.167.68 listed in will-spam-for-food.eu.org]

[209.85.167.68 listed in will-spam-for-food.eu.org]

[209.85.167.68 listed in will-spam-for-food.eu.org]

[209.85.167.68 listed in will-spam-for-food.eu.org]

[209.85.167.68 listed in will-spam-for-food.eu.org]

[209.85.167.68 listed in will-spam-for-food.eu.org]

[209.85.167.68 listed in will-spam-for-food.eu.org]

[209.85.167.68 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[209.85.167.68 listed in dnsbl.ahbl.org]

[209.85.167.68 listed in dnsbl.ahbl.org]

[209.85.167.68 listed in dnsbl.ahbl.org]

[209.85.167.68 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[209.85.167.68 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[209.85.167.68 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[209.85.167.68 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[209.85.167.68 listed in dnsbl.ahbl.org]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[209.85.167.68 listed in list.dnswl.org]

-0.0 SPF_PASS SPF: sender matches SPF record

1.5 GR_DOMAIN_UNDISC1 To contains undisclosed recipient (undisc)

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider

[jeegael37(at)gmail.com]

1.0 FORGED_GMAIL_RCVD 'From' gmail.com does not match 'Received' headers

0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends in

digit

[jeegael37(at)gmail.com]

2.5 US_DOLLARS_3 BODY: Mentions millions of $ ($NN,NNN,NNN.NN)

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[209.85.167.68 listed in bl.score.senderscore.com]

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[209.85.167.68 listed in wl.mailspike.net]

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

0.0 LOTS_OF_MONEY Huge... sums of money

0.0 T_FILL_THIS_FORM_SHORT Fill in a short form with personal information

1.0 FREEMAIL_REPLYTO Reply-To/From or Reply-To/body contain different

freemails

2.8 UNDISC_FREEM Undisclosed recipients + freemail reply-to

0.0 MONEY_FREEMAIL_REPTO Lots of money from someone using free email?

0.0 MONEY_FRAUD_5 Lots of money and many fraud phrases

0.4 FILL_THIS_FORM_FRAUD_PHISH Answer suspicious question(s)

0.0 T_FILL_THIS_FORM_FRAUD_PHISH Answer suspicious question(s)

2.6 UNDISC_MONEY Undisclosed recipients + money/fraud signs

1.3 MONEY_FORM_SHORT Lots of money if you fill out a short form

0.0 FORM_FRAUD_5 Fill a form and many fraud phrases

2.0 ADVANCE_FEE_2_NEW_MONEY Advance Fee fraud and lots of money

Subject: {SPAM?} Compensation Award

Nigerian compensation spam from Google Gmail Part 2

--000000000000012f4e0654b4a67c

Content-Type: text/plain; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable



Subject: Midland Financial Recovery Bureau =E2=80=93 Victim Compensation Pr=

ogram

Compensation Award: USD $1,500,000.00

Reference ID: MF1122-CRX00491

Address: 8600 Westfield Avenue, Suite 210, Houston, TX 77040, USA



Dear Recipient,



We are contacting you as a listed beneficiary in a federally supported

restitution initiative established to compensate victims of financial

fraud. This action follows the prosecution and sentencing of

individuals=E2=80=94namely Andrew Collins, Eric Mateo, and Linda Frost=E2=

=80=94who were

recently convicted of operating fraudulent schemes while posing as

representatives of financial and government institutions.



As part of the outcome, the Midland Financial Recovery Bureau, in

collaboration with U.S. regulatory authorities, has approved a compensation

payment of USD $1,500,000.00 to be issued in your name. Disbursement will

be made through a secure ATM-enabled payment card, and all standard

transaction and delivery costs will be covered by the issuing entity.



To confirm your eligibility and initiate the processing of your payment,

please provide the following information for verification and compliance

review:



Full Legal Name



Residential Mailing Address



Current Occupation



Active Contact Number



Government-Issued Photo Identification (valid)



Please be advised that a nominal Processing and Verification Fee will be

required to complete the official endorsement and release of funds. There

will be no additional fees once this has been fulfilled.



This compensation program is part of a broader effort to assist fraud

victims and reinforce public confidence in financial institutions.



Sincerely,

Mr. Thomas E. Ralston

Director, Compensation Oversight Division

Midland Financial Recovery Bureau



--000000000000012f4e0654b4a67c

Content-Type: text/html; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable





=3D"gmail_signature" data-smartmail=3D"gmail_signature">

iv>Subject: Midland Financial Recovery Bureau =E2=80=93 Victim Compensation=

Program
Compensation Award: USD $1,500,000.00
Referenc=

e ID: MF1122-CRX00491
Address: 8600 Westfield Avenue, Suite 210, =

Houston, TX 77040, USA

Dear Recipient,
<=

br>
We are contacting you as a listed beneficiary in a federally =

supported restitution initiative established to compensate victims of finan=

cial fraud. This action follows the prosecution and sentencing of individua=

ls=E2=80=94namely Andrew Collins, Eric Mateo, and Linda Frost=E2=80=94who w=

ere recently convicted of operating fraudulent schemes while posing as repr=

esentatives of financial and government institutions.

<=

div>As part of the outcome, the Midland Financial Recovery Bureau, in colla=

boration with U.S. regulatory authorities, has approved a compensation paym=

ent of USD $1,500,000.00 to be issued in your name. Disbursement will be ma=

de through a secure ATM-enabled payment card, and all standard transaction =

and delivery costs will be covered by the issuing entity.


iv>
To confirm your eligibility and initiate the processing of your pay=

ment, please provide the following information for verification and complia=

nce review:

Full Legal Name


iv>Residential Mailing Address

Current Occupation<=

/div>

Active Contact Number

Gov=

ernment-Issued Photo Identification (valid)

Please=

be advised that a nominal Processing and Verification Fee will be required=

to complete the official endorsement and release of funds. There will be n=

o additional fees once this has been fulfilled.

Th=

is compensation program is part of a broader effort to assist fraud victims=

and reinforce public confidence in financial institutions.

<=

/div>
Sincerely,
Mr. Thomas E. Ralston
Director, Co=

mpensation Oversight Division
Midland Financial Recovery Bureau
div>




--000000000000012f4e0654b4a67c--

Nigerian compensation spam from Google Gmail Part 1

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Sat, 20 Jun 2026 14:07:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wb1xn-00000000OKs-0H9n

for dave@doctor.nl2k.ab.ca;

Sat, 20 Jun 2026 14:06:47 -0600

Resent-From: The Doctor

Resent-Date: Sat, 20 Jun 2026 14:06:46 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-lf1-f67.google.com ([209.85.167.67]:46510)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wb1k6-00000000Mgj-2Z3k

for doctor@nl2k.ca;

Sat, 20 Jun 2026 13:52:47 -0600

Received: by mail-lf1-f67.google.com with SMTP id 2adb3069b0e04-5aa7a7ad475so3538427e87.1

for ; Sat, 20 Jun 2026 12:51:51 -0700 (PDT)

ARC-Seal: i=1; a=rsa-sha256; t=1781985104; cv=none;

d=google.com; s=arc-20240605;

b=OMZEP8OkxeJCecAdXhyNiNUCJ8oxNVhPhmlEEqOhaiy9KdZ8jZxIffJx1L1mhO0zlS

kW3b9MP3zUgY+DuJH/fCIWh/hQUD9dkax8qDs1ceD6MHBYEPxymbZNIsL20q1qkcpXhV

fBjd4fxf+Ap588EsD0MeZ7K1WMKTjBmLCgpsI2zzJPsQGWeCnZlJg39AxGP4+QZEoja4

TvQMmsJ/jVORy8lkNOdeRKugnMpTQiwcRga3gnSeX4YW/6570zJtZafceDyzdNwDM63z

eBkuK9NwtG8JN6XWDKNGJ1T/EW3QFkIwJKW/OcDbyuhL+s7Fs8CvpmXd7HS6IixUk7lI

c0aQ==

ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20240605;

h=to:subject:message-id:date:from:reply-to:mime-version

:dkim-signature;

bh=em15lI1mKGVSJdQKVfxc2yi8Xza15rcXvqiJNGJzY8s=;

fh=RW2ZSSgvfk59hEzSy6zADBunmMvzuXd8ZQ4mh1Sqbj4=;

b=fYnrnrNtZ2gbh61njLuX1awm/SWeSkNhfil8b8vJkEYGf3yBR6ZSMHcnMn89ZJLlRM

OLd8lfeL+LVRXcOy2Z80AiZJF1GMp9SOOtGARnOXSz9ybPligcRB9iuhFKVSKyOfyf7B

CQOz8WCrDSdE/f6a9v9wIyKaRLmtUChPx1mGJNJRmrBers5a/y//4BDUYj1dK0b4OrRb

eLoHRQP4UmTnINqfcKrKGmzhRcrL4YvwIplbh7uEht62zuOUIqFZzx2CKvE34nfYXuP5

Zf9yvBDHjRhnolA/DSLSMx6N9jAxW6xVJgjoZhQwPK9RK3YXw5wwvjuyVIpuh2C6s5Og

6w3Q==;

darn=nl2k.ca

ARC-Authentication-Results: i=1; mx.google.com; arc=none

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=gmail.com; s=20251104; t=1781985104; x=1782589904; darn=nl2k.ca;

h=to:subject:message-id:date:from:reply-to:mime-version:from:to:cc

:subject:date:message-id:reply-to;

bh=em15lI1mKGVSJdQKVfxc2yi8Xza15rcXvqiJNGJzY8s=;

b=ipBDa0NQBtQN6Xnt7DAj+foldjz5IXWQYPpzfP6oYLu7BTYqAY8Y8GIXm7i7tuB66L

sPhedzeAvv+xRppl/i/SLeqCihY+0LIRgYGDEujPop9JUZSSRyKyjgTv4uSb2bCbss7p

jp8L50HBIIgAZ/6itu/a/xuL1nr4MjHONXkzlyGu8rC+mIiHoLgl0+eoDRGGcPMcwlG2

jV4qZSYTQgxtm/wrMWSzYZ6JjuBYVl4cwRTR4QG1hW5EvdtUgpp2e58UJj7MgUiyQO0/

FrGBmeuLeJFtrGjE5tuf8oNp6T8lGNDGjz2YH5QoEOGbysG97wAu7mrcXTclUcY+InqU

UZ3w==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20251104; t=1781985104; x=1782589904;

h=to:subject:message-id:date:from:reply-to:mime-version:x-gm-gg

:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to;

bh=em15lI1mKGVSJdQKVfxc2yi8Xza15rcXvqiJNGJzY8s=;

b=pR2nm4iX5ClHGUD4nh+IEyKih2qQPBNu5BYHm4LA7z4yQOcFJPNjlAlgJ9mN5e6h6a

HcmF7UY1qLKV3Fm31XChckeEMjnpsNN8ancRl0RmSERo7gJuNcgt/D5Mmaz5BUbuyffw

5G4GjGeOKt8BTo3rzT19X7ha8+I87wv4PkI2/gG8uAaB1FbDNqVf4J5NoZqNGtj+FW1B

ombA8E2T0PV+B+ONqLisni3pgRGW11ZHbVwjgkgR9sws+Rp763ftwQx3aYbNl8JcKeWN

b6gExfAYmR1rM8IqOKvTlaArs1drDEufm9AxC0lEPzWPbqjcJrP51LV+TLt0MKyIxDsE

s3KQ==

X-Forwarded-Encrypted: i=1; AFNElJ8lgkB0TuiIJ8u1CKvA58VFhS1D3weSvyxtGCnr70nqkGyeNdAcnsbXfD4I5OJhQsqHTlQxzf4=@nl2k.ca

X-Gm-Message-State: AOJu0YyGtEsalk3zD4CTqiun6vx9CxEuQUX7UX2s4AQr2TUZJdCH1rdW

RfoEv2WyW/75jdBBCzxwJdAksV4UH9kRFjNWSd8FMCnophrkJjC4bbYzjM9VcwfjQpqX3rtz3Qm

b/6ReKWT97pHr7N+69V/AlcD3V/IecIc=

X-Gm-Gg: AfdE7cnyJbD2BBOgstlmlLCckHAvXqMhU34ClvEuBKv9r8IbTBKyVPncDzKNl/wfJkp

iKsStlZeIDVIbbwG3MOI5e59sGxN4pW0WAhjoYoae8UO4wYSO0brGVATRsLE56rWuFFurn1bL+D

S3BKNnxc4z9Yqve81Fir81FgwfAMtD+TIfu/HyHBXX8gwbk7DMvKvKdEz1uDrmrYjTnpzYuX6em

fs2Hd7yPRnsGsdFLHwk4y5WOzZjl/GXootdNPJ66ZZvzvY9XiQQ9zCq//UcOVciBmMslUffwA==

X-Received: by 2002:a2e:a9a5:0:b0:396:9966:50cf with SMTP id

38308e7fff4ca-3998e4092d7mr16710201fa.9.1781984716204; Sat, 20 Jun 2026

12:45:16 -0700 (PDT)

MIME-Version: 1.0

Reply-To: citibank.co.usa@gmail.com

From: Michael Corbat

Date: Sat, 20 Jun 2026 12:44:41 -0700

X-Gm-Features: AVVi8Cee6rCzcsUfU88IFtFAIMaK7YU6-UAmDxNctI4bo92nl-eibb70H8m3-qc

Message-ID:

Subject: Compensation Award

To: undisclosed-recipients:;

Content-Type: multipart/alternative; boundary="000000000000012f4e0654b4a67c"

Bcc: doctor@nl2k.ca

X-Spam_score: 16.4

X-Spam_score_int: 164

X-Spam_bar: ++++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Subject: Midland Financial Recovery Bureau – Victim Compensation

Program Compensation Award: USD $1,500,000.00 Reference ID: MF1122-CRX00491

Address: 8600 Westfield Avenue, Suite 210, Houston, TX 77 [...]



Content analysis details: (16.4 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[209.85.167.67 listed in will-spam-for-food.eu.org]

[209.85.167.67 listed in will-spam-for-food.eu.org]

[209.85.167.67 listed in will-spam-for-food.eu.org]

[209.85.167.67 listed in will-spam-for-food.eu.org]

[209.85.167.67 listed in will-spam-for-food.eu.org]

[209.85.167.67 listed in will-spam-for-food.eu.org]

[209.85.167.67 listed in will-spam-for-food.eu.org]

[209.85.167.67 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[209.85.167.67 listed in dnsbl.ahbl.org]

[209.85.167.67 listed in dnsbl.ahbl.org]

[209.85.167.67 listed in dnsbl.ahbl.org]

[209.85.167.67 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[209.85.167.67 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[209.85.167.67 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[209.85.167.67 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[209.85.167.67 listed in dnsbl.ahbl.org]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[209.85.167.67 listed in list.dnswl.org]

-0.0 SPF_PASS SPF: sender matches SPF record

1.5 GR_DOMAIN_UNDISC1 To contains undisclosed recipient (undisc)

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider

[jeegael37(at)gmail.com]

1.0 FORGED_GMAIL_RCVD 'From' gmail.com does not match 'Received' headers

0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends in

digit

[jeegael37(at)gmail.com]

2.5 US_DOLLARS_3 BODY: Mentions millions of $ ($NN,NNN,NNN.NN)

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[209.85.167.67 listed in bl.score.senderscore.com]

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[209.85.167.67 listed in wl.mailspike.net]

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

0.0 LOTS_OF_MONEY Huge... sums of money

1.0 FREEMAIL_REPLYTO Reply-To/From or Reply-To/body contain different

freemails

2.8 UNDISC_FREEM Undisclosed recipients + freemail reply-to

0.0 MONEY_FREEMAIL_REPTO Lots of money from someone using free email?

2.6 UNDISC_MONEY Undisclosed recipients + money/fraud signs

0.0 T_FILL_THIS_FORM_SHORT Fill in a short form with personal information

0.0 MONEY_FRAUD_5 Lots of money and many fraud phrases

2.0 ADVANCE_FEE_2_NEW_MONEY Advance Fee fraud and lots of money

0.0 FORM_FRAUD_5 Fill a form and many fraud phrases

0.4 FILL_THIS_FORM_FRAUD_PHISH Answer suspicious question(s)

0.0 T_FILL_THIS_FORM_FRAUD_PHISH Answer suspicious question(s)

1.3 MONEY_FORM_SHORT Lots of money if you fill out a short form

Subject: {SPAM?} Compensation Award

Nigerian Compensation spam from Google Gmail Part 2

--000000000000012f4e0654b4a67c

Content-Type: text/plain; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable



Subject: Midland Financial Recovery Bureau =E2=80=93 Victim Compensation Pr=

ogram

Compensation Award: USD $1,500,000.00

Reference ID: MF1122-CRX00491

Address: 8600 Westfield Avenue, Suite 210, Houston, TX 77040, USA



Dear Recipient,



We are contacting you as a listed beneficiary in a federally supported

restitution initiative established to compensate victims of financial

fraud. This action follows the prosecution and sentencing of

individuals=E2=80=94namely Andrew Collins, Eric Mateo, and Linda Frost=E2=

=80=94who were

recently convicted of operating fraudulent schemes while posing as

representatives of financial and government institutions.



As part of the outcome, the Midland Financial Recovery Bureau, in

collaboration with U.S. regulatory authorities, has approved a compensation

payment of USD $1,500,000.00 to be issued in your name. Disbursement will

be made through a secure ATM-enabled payment card, and all standard

transaction and delivery costs will be covered by the issuing entity.



To confirm your eligibility and initiate the processing of your payment,

please provide the following information for verification and compliance

review:



Full Legal Name



Residential Mailing Address



Current Occupation



Active Contact Number



Government-Issued Photo Identification (valid)



Please be advised that a nominal Processing and Verification Fee will be

required to complete the official endorsement and release of funds. There

will be no additional fees once this has been fulfilled.



This compensation program is part of a broader effort to assist fraud

victims and reinforce public confidence in financial institutions.



Sincerely,

Mr. Thomas E. Ralston

Director, Compensation Oversight Division

Midland Financial Recovery Bureau



--000000000000012f4e0654b4a67c

Content-Type: text/html; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable





=3D"gmail_signature" data-smartmail=3D"gmail_signature">

iv>Subject: Midland Financial Recovery Bureau =E2=80=93 Victim Compensation=

Program
Compensation Award: USD $1,500,000.00
Referenc=

e ID: MF1122-CRX00491
Address: 8600 Westfield Avenue, Suite 210, =

Houston, TX 77040, USA

Dear Recipient,
<=

br>
We are contacting you as a listed beneficiary in a federally =

supported restitution initiative established to compensate victims of finan=

cial fraud. This action follows the prosecution and sentencing of individua=

ls=E2=80=94namely Andrew Collins, Eric Mateo, and Linda Frost=E2=80=94who w=

ere recently convicted of operating fraudulent schemes while posing as repr=

esentatives of financial and government institutions.

<=

div>As part of the outcome, the Midland Financial Recovery Bureau, in colla=

boration with U.S. regulatory authorities, has approved a compensation paym=

ent of USD $1,500,000.00 to be issued in your name. Disbursement will be ma=

de through a secure ATM-enabled payment card, and all standard transaction =

and delivery costs will be covered by the issuing entity.


iv>
To confirm your eligibility and initiate the processing of your pay=

ment, please provide the following information for verification and complia=

nce review:

Full Legal Name


iv>Residential Mailing Address

Current Occupation<=

/div>

Active Contact Number

Gov=

ernment-Issued Photo Identification (valid)

Please=

be advised that a nominal Processing and Verification Fee will be required=

to complete the official endorsement and release of funds. There will be n=

o additional fees once this has been fulfilled.

Th=

is compensation program is part of a broader effort to assist fraud victims=

and reinforce public confidence in financial institutions.

<=

/div>
Sincerely,
Mr. Thomas E. Ralston
Director, Co=

mpensation Oversight Division
Midland Financial Recovery Bureau
div>




--000000000000012f4e0654b4a67c--

Nigerian Compensation spam from Google Gmail Part 1

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Sat, 20 Jun 2026 14:07:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wb1xc-00000000OJ6-0WQo

for dave@doctor.nl2k.ab.ca;

Sat, 20 Jun 2026 14:06:36 -0600

Resent-From: The Doctor

Resent-Date: Sat, 20 Jun 2026 14:06:36 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-lj1-f195.google.com ([209.85.208.195]:46192)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wb1ix-00000000Map-03E9

for doctor@edmontonab.ca;

Sat, 20 Jun 2026 13:51:36 -0600

Received: by mail-lj1-f195.google.com with SMTP id 38308e7fff4ca-396771119c4so28881631fa.0

for ; Sat, 20 Jun 2026 12:50:40 -0700 (PDT)

ARC-Seal: i=1; a=rsa-sha256; t=1781985033; cv=none;

d=google.com; s=arc-20240605;

b=Ux0tWqOGC5td5mYee2uicQc12Zpqk8t8lTG09qpOMQglILStzhKc/eWRt6CpdvoDCy

VHPGZB+EpaZznoadHGKCex4DxG1C4ddoHjeZuHVkrkCJ0WWLwgZ4GVXuzhkwmxxMGAMe

E7AH61wZ7yY/DazgPtnnpQMU2vDj//dETvqQv6wvi2apmE8YntRLlzEj5B11q58HudrL

NPXOQK40W6gHCySeSvzLD46il7uHgVwFE6XadN27M/6YERiTLNqsPzo14FShM3qefebN

MZCMOdnYBbe+NcaBKfGseBDrY09AA4ynmg2PASiuoDLNt3rBy78z1iGDbxkGpdyVnR33

AgDg==

ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20240605;

h=to:subject:message-id:date:from:reply-to:mime-version

:dkim-signature;

bh=em15lI1mKGVSJdQKVfxc2yi8Xza15rcXvqiJNGJzY8s=;

fh=hg6vW4OQ1KsWA5Su3uSbgN8Gu/vDhZetGdObmkbyWc0=;

b=S3RZqUZR3G5nzY3FBmEXRLtatutcSv+94PkGXgiSAcI3E21YR6CRq9ulJf/uMPXlAN

ztm8//H1tyFGOLLxHeu8Ro0gCg4XrFHylt7e36MMp6MO1LqfIdTs9Yt2Jlnook1v3H2j

UBUCWR0PACmBWcINGzJupDiKG4jK5HaCa4DXVLly9qzhRi8D8Oj8caAR7mNDEzT3g/Ru

4Pz8VcvKloQNavJfQnxOg0OvXW5zjbYNb7qPOykDkaMbLjcRXqpvno9+YsImBvysFYYP

ypIKDqWOwkImUiCSYNp/iwZwzF15Hf660XHfr1XTTTljozMcKpe4RJzoDVrG0xBHx/d6

nR6A==;

darn=edmontonab.ca

ARC-Authentication-Results: i=1; mx.google.com; arc=none

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=gmail.com; s=20251104; t=1781985033; x=1782589833; darn=edmontonab.ca;

h=to:subject:message-id:date:from:reply-to:mime-version:from:to:cc

:subject:date:message-id:reply-to;

bh=em15lI1mKGVSJdQKVfxc2yi8Xza15rcXvqiJNGJzY8s=;

b=MP2GqJVDzm//cduCh1YWSTsY5Wstz6+BYYKaKV2IMZAqxDMm1PN/A4r78GNxqTmWXF

ETkSDw09soZYwpSJAr1h93p+hyaYX5siKQlPpZqtVGHSA26ddL2OvF71ZE1FfAuCzA1c

pu7H+0ovIJ9AvRZDirLzl4DXmuXzSWCla5ljk+qh3Fm1F25lpN5W4ELxem2zJhWrlGLA

v7hylwo6LTgzDjccI2LQJlMkVrl0fyq45olenJ0mGkHMJClb8FDEHkxzx8PS0ATgt4is

RkoCpewHCLrZu16qFP22vYQvnvha2BT80J2weDNb9FFtVJbfCAX87RUFrW+2CNNu4i5W

Nj4Q==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20251104; t=1781985033; x=1782589833;

h=to:subject:message-id:date:from:reply-to:mime-version:x-gm-gg

:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to;

bh=em15lI1mKGVSJdQKVfxc2yi8Xza15rcXvqiJNGJzY8s=;

b=p0kWtEknbyn+e77W6qy0vJ13Ai/BBx0+gLaWoGQz3HsgNmS/TrAC314YwG3UtvlT9o

ohvluNNrSmlIO8FiUhx0TktQlCK+BQtv4LtP9Bv0v3C/nUsN7iuBForWtnoUpqwbCTgi

wrMLQ913C5HuSC/jbt7VUnB4HImLUQEe7AxSRr6SktxBVcPyoFesulMCDbRPu5dC1sZe

u6ql0aWr1zChiS8zHFZ/i2x8GVAQvJEM/WQBnUAOWYDFV9Nz+uQbt7+zoXjOOy0DAe1w

RD+fWmmMtv5Uara1dfdRLYO5kCeTWUXAPnAoaMYWYV9zYmRL4R6S/T/Cxp4ouVWeBc92

WpsA==

X-Forwarded-Encrypted: i=1; AFNElJ/cMdigm3f8a+GezgVJrHvvBra3tolLQy5FWUiRRG0BCo1Wf83yGoy5F384LRWH6hPalg1koHw=@edmontonab.ca

X-Gm-Message-State: AOJu0YwcNZA5POg+YXcs9X9uksM8oct2Jaa4JxrKxaZkVgQstYHGm8yi

lnd5SII5DX1byotiFw2PtCL7e7LGASGJ6QQX3KN28gPgN6qo3+wZvKcrYa244SpMFYVfKZrDe5O

cR7JeCJL5BaW+bd/xhUlySvO0N49wXl0q+pxg5Rxlrg==

X-Gm-Gg: AfdE7cmI+Agbse1og4LSHmUC655lVcFPYNnVeXsRGvQhCsSsohQodRD39vkMW2LMZjz

c+9hzkKd9EFUP15OisgoDfnyn5664YkycOLnBmLRZSqMUG1Q6JtlcJ+ow0kyh4YhdC/08kf1dul

aOoDjLDV1/QR73/FZmkk/4umRtyd0DYsctb8XkP1sTUa/ADP3QYvLW+OzhzlsamMPIBZV3VokV8

81wQYD2auDWT+i9ER14dg8bK3WCmWkxMVqgnJVM+X8K9BBj5cOqPZTrqWCvK37DqhKdVnfEOA==

X-Received: by 2002:a2e:a9a5:0:b0:396:9966:50cf with SMTP id

38308e7fff4ca-3998e4092d7mr16710201fa.9.1781984716204; Sat, 20 Jun 2026

12:45:16 -0700 (PDT)

MIME-Version: 1.0

Reply-To: citibank.co.usa@gmail.com

From: Michael Corbat

Date: Sat, 20 Jun 2026 12:44:41 -0700

X-Gm-Features: AVVi8Cee6rCzcsUfU88IFtFAIMaK7YU6-UAmDxNctI4bo92nl-eibb70H8m3-qc

Message-ID:

Subject: Compensation Award

To: undisclosed-recipients:;

Content-Type: multipart/alternative; boundary="000000000000012f4e0654b4a67c"

Bcc: doctor@edmontonab.ca

X-Spam_score: 16.4

X-Spam_score_int: 164

X-Spam_bar: ++++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Subject: Midland Financial Recovery Bureau – Victim Compensation

Program Compensation Award: USD $1,500,000.00 Reference ID: MF1122-CRX00491

Address: 8600 Westfield Avenue, Suite 210, Houston, TX 77 [...]



Content analysis details: (16.4 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[209.85.208.195 listed in will-spam-for-food.eu.org]

[209.85.208.195 listed in will-spam-for-food.eu.org]

[209.85.208.195 listed in will-spam-for-food.eu.org]

[209.85.208.195 listed in will-spam-for-food.eu.org]

[209.85.208.195 listed in will-spam-for-food.eu.org]

[209.85.208.195 listed in will-spam-for-food.eu.org]

[209.85.208.195 listed in will-spam-for-food.eu.org]

[209.85.208.195 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[209.85.208.195 listed in dnsbl.ahbl.org]

[209.85.208.195 listed in dnsbl.ahbl.org]

[209.85.208.195 listed in dnsbl.ahbl.org]

[209.85.208.195 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[209.85.208.195 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[209.85.208.195 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[209.85.208.195 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[209.85.208.195 listed in dnsbl.ahbl.org]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[209.85.208.195 listed in list.dnswl.org]

-0.0 SPF_PASS SPF: sender matches SPF record

1.5 GR_DOMAIN_UNDISC1 To contains undisclosed recipient (undisc)

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider

[jeegael37(at)gmail.com]

1.0 FORGED_GMAIL_RCVD 'From' gmail.com does not match 'Received' headers

0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends in

digit

[jeegael37(at)gmail.com]

2.5 US_DOLLARS_3 BODY: Mentions millions of $ ($NN,NNN,NNN.NN)

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[209.85.208.195 listed in bl.score.senderscore.com]

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[209.85.208.195 listed in wl.mailspike.net]

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

0.0 LOTS_OF_MONEY Huge... sums of money

1.0 FREEMAIL_REPLYTO Reply-To/From or Reply-To/body contain different

freemails

2.8 UNDISC_FREEM Undisclosed recipients + freemail reply-to

0.0 MONEY_FREEMAIL_REPTO Lots of money from someone using free email?

0.0 T_FILL_THIS_FORM_SHORT Fill in a short form with personal information

0.4 FILL_THIS_FORM_FRAUD_PHISH Answer suspicious question(s)

0.0 T_FILL_THIS_FORM_FRAUD_PHISH Answer suspicious question(s)

1.3 MONEY_FORM_SHORT Lots of money if you fill out a short form

2.6 UNDISC_MONEY Undisclosed recipients + money/fraud signs

0.0 FORM_FRAUD_5 Fill a form and many fraud phrases

2.0 ADVANCE_FEE_2_NEW_MONEY Advance Fee fraud and lots of money

0.0 MONEY_FRAUD_5 Lots of money and many fraud phrases

Subject: {SPAM?} Compensation Award

Nigerian Compensation spam from Google Gmail Part 1

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Sat, 20 Jun 2026 14:07:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wb1xi-00000000OK8-0GSa

for dave@doctor.nl2k.ab.ca;

Sat, 20 Jun 2026 14:06:42 -0600

Resent-From: The Doctor

Resent-Date: Sat, 20 Jun 2026 14:06:41 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-lf1-f65.google.com ([209.85.167.65]:47506)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wb1ir-00000000MaZ-3oHl

for doctor@netknow.ca;

Sat, 20 Jun 2026 13:51:31 -0600

Received: by mail-lf1-f65.google.com with SMTP id 2adb3069b0e04-5aa5edf347eso2202149e87.3

for ; Sat, 20 Jun 2026 12:50:31 -0700 (PDT)

ARC-Seal: i=1; a=rsa-sha256; t=1781985024; cv=none;

d=google.com; s=arc-20240605;

b=CgHgOdMkIAfWGrKET1xguDXzjLcRuiZeFjmntm9GdFnSf7gAdKjj+rO2wqSjy4JfLM

8fMJdv24ijIVlVVbpDVw5hFA9+d+60MqBr4OW+R21dOH21HHRvf6nvJHdhp/wHks8+Vo

JwvPFP3jVn0wjgUrxlq4gRQuKo/4ajTZrJTfH18d0U8Zf4j8VtTvtGyKW9aFTROQyYC1

ST+KZTYHDBHyghSdw3YstNR8lGbd3Cjs2vZEM/VyurkJ5NesRH/VE5xVPjafpU8g+IsE

vUsbsgyl7e79zNxFHI8bZmTO/naA6lvbZ+J9hvf75vMxfYI+CaERGh4QyctjzlXZxy1M

g1zQ==

ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20240605;

h=to:subject:message-id:date:from:reply-to:mime-version

:dkim-signature;

bh=em15lI1mKGVSJdQKVfxc2yi8Xza15rcXvqiJNGJzY8s=;

fh=eLgWUN41aUnp69WnMTguA4LkmrRBey2PdCsLZfURz9w=;

b=MztDUIYPZ7CbkrIBMm20edXWfrirv+ikoaH5FyNaDjGBrCzsH3m+LByapt0P0zVpOx

RVRDKWv/Nk1J67BlEEKEyBWPv10dY/NPVjAbHpaAbNHeIw7ZhGX6Fdmc7LphZFMW3bQg

ickHFNYUkBn3KktfS8R6H5CtLnRb4Tn1bF+hdhK4Me30Bwa7oaNyAeRYXvDIIRnmqKWJ

v1aKOyBZxfWe7kqucjR4yfGXC+EFYd6Q0/fNMCO8UFXcL4388BNdhBTYOpbqvSXlx+Ab

zF+LhZuzhDm4upnDYRKkSl1NqR6noVs3WubZeTW+FPUYWelrO9JldWqXykBfnX2sNqGn

G6uA==;

darn=netknow.ca

ARC-Authentication-Results: i=1; mx.google.com; arc=none

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=gmail.com; s=20251104; t=1781985024; x=1782589824; darn=netknow.ca;

h=to:subject:message-id:date:from:reply-to:mime-version:from:to:cc

:subject:date:message-id:reply-to;

bh=em15lI1mKGVSJdQKVfxc2yi8Xza15rcXvqiJNGJzY8s=;

b=O9FcDF/fGN3YJm1tj4wKgLsQE7ixrduU9lCWYOTX6dwhvYZUOu0ITGpAy6SZNS3Syy

GqbU7y+OOu6+3P1zSlIdvo2muObs75pH2TydS0C64nDxC0N+E7qa0IbzoeaajxOWm1Rr

1bljKii4z+YHPIGV/8wULSpIR0/NI68+LhCxg+HOuK+MtCbYtffTYkqaviLESxQevfUg

N0APOL6YOG/pScBlLfXYrE+8LHpRUfFol3JDDrMM2WqbAKIpYZAo7NC2Ep/C8cfdtINx

9m671so4dxKbBwm6s86/uScprxKk6dDKyQn5lU8IssrwIsU2rGoJa99/XW8Plg6Q3YUs

1N2Q==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20251104; t=1781985024; x=1782589824;

h=to:subject:message-id:date:from:reply-to:mime-version:x-gm-gg

:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to;

bh=em15lI1mKGVSJdQKVfxc2yi8Xza15rcXvqiJNGJzY8s=;

b=fJ4yIfO0JNN5lIiflUr71uq58SU5CTNVWM+EDo9Tv1ViueRIVI9L3K/n2hijy0xUWh

XxXEV0Byk8gVSHKmKMbW+qe2ftl4BIoJsqGC1Icm4p2N7+sw4NA7QYYVKUvETSDH8d5D

/UNv5iPfzcV0gzfZfoKP744G0QFCvidMmNC3AF/ctVzPFtg0poUKJ8uGvtXJjMOIE5/L

nUkKppylCDl5l8b2LMIpshf1OBMSSfE20CjK4hP8avt8OptX3r1U9nunBty6zofJG6tg

+gNm2LkLSH4s69RQSmIh0IFMdR44CYOQm2SBWhJfoB9YmsVHQdPwzqQfk89O/pckWOqg

6XqQ==

X-Forwarded-Encrypted: i=1; AFNElJ9fMhwbuiUHBcl7JMpZ6RKKF2eccoQLGRdITecPp/qTJK99pcrLXcUTF1vrtGV9YcWrqjVi0SU=@netknow.ca

X-Gm-Message-State: AOJu0YxP5W145a3lO30vLW7PNMpjIjhxX6CE8OHl8UFE15yOZr48O2Kb

neNBNLy2n8x0k+Y1YXX2vIP9qKPufLr8HVSvhKFsjDRXcoxIqg6RQUqqxaceaJzhV0qyk8sIENq

XVuCPD+hDj1x1xMCEYMXD4utg/YbJz3X6uLI5Pxv5ag==

X-Gm-Gg: AfdE7cl0lRwjoiRYHf6igIocFieHyMl9MmIT9Mcmv/HblQMVQsEmvbsIBVIqGBUhY9f

5vPQDelT5EAXH8HBqXol7d9bvpiN6amfDTr6rtxx6Iic/jCgrKL2FXmK0sYhM5bi5YIhjltn+t/

XipsPIqTcQ+ASsmXk8/Pfpsrv5RPnsfmap7V6IxGzWAUR3TqgWhV3zCuOKnMFM2vEqcrA/6aPJ+

D52/DqFNXNbMoKDUnV+aM8ESq5w6TFRjc08kSTJDdiSc71kB/8qXb3CQETQfVqAKvXGyP8Stg==

X-Received: by 2002:a2e:a9a5:0:b0:396:9966:50cf with SMTP id

38308e7fff4ca-3998e4092d7mr16710201fa.9.1781984716204; Sat, 20 Jun 2026

12:45:16 -0700 (PDT)

MIME-Version: 1.0

Reply-To: citibank.co.usa@gmail.com

From: Michael Corbat

Date: Sat, 20 Jun 2026 12:44:41 -0700

X-Gm-Features: AVVi8Cee6rCzcsUfU88IFtFAIMaK7YU6-UAmDxNctI4bo92nl-eibb70H8m3-qc

Message-ID:

Subject: Compensation Award

To: undisclosed-recipients:;

Content-Type: multipart/alternative; boundary="000000000000012f4e0654b4a67c"

Bcc: doctor@netknow.ca

X-Spam_score: 16.4

X-Spam_score_int: 164

X-Spam_bar: ++++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Subject: Midland Financial Recovery Bureau – Victim Compensation

Program Compensation Award: USD $1,500,000.00 Reference ID: MF1122-CRX00491

Address: 8600 Westfield Avenue, Suite 210, Houston, TX 77 [...]



Content analysis details: (16.4 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[209.85.167.65 listed in will-spam-for-food.eu.org]

[209.85.167.65 listed in will-spam-for-food.eu.org]

[209.85.167.65 listed in will-spam-for-food.eu.org]

[209.85.167.65 listed in will-spam-for-food.eu.org]

[209.85.167.65 listed in will-spam-for-food.eu.org]

[209.85.167.65 listed in will-spam-for-food.eu.org]

[209.85.167.65 listed in will-spam-for-food.eu.org]

[209.85.167.65 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[209.85.167.65 listed in dnsbl.ahbl.org]

[209.85.167.65 listed in dnsbl.ahbl.org]

[209.85.167.65 listed in dnsbl.ahbl.org]

[209.85.167.65 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[209.85.167.65 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[209.85.167.65 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[209.85.167.65 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[209.85.167.65 listed in dnsbl.ahbl.org]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[209.85.167.65 listed in list.dnswl.org]

-0.0 SPF_PASS SPF: sender matches SPF record

1.5 GR_DOMAIN_UNDISC1 To contains undisclosed recipient (undisc)

0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider

[jeegael37(at)gmail.com]

1.0 FORGED_GMAIL_RCVD 'From' gmail.com does not match 'Received' headers

0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends in

digit

[jeegael37(at)gmail.com]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

2.5 US_DOLLARS_3 BODY: Mentions millions of $ ($NN,NNN,NNN.NN)

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[209.85.167.65 listed in wl.mailspike.net]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[209.85.167.65 listed in bl.score.senderscore.com]

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 LOTS_OF_MONEY Huge... sums of money

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

1.0 FREEMAIL_REPLYTO Reply-To/From or Reply-To/body contain different

freemails

Nigerian Compensation spam from Google Gmail Part 2

2.8 UNDISC_FREEM Undisclosed recipients + freemail reply-to

0.0 MONEY_FREEMAIL_REPTO Lots of money from someone using free email?

0.0 T_FILL_THIS_FORM_SHORT Fill in a short form with personal information

0.4 FILL_THIS_FORM_FRAUD_PHISH Answer suspicious question(s)

0.0 T_FILL_THIS_FORM_FRAUD_PHISH Answer suspicious question(s)

1.3 MONEY_FORM_SHORT Lots of money if you fill out a short form

2.6 UNDISC_MONEY Undisclosed recipients + money/fraud signs

2.0 ADVANCE_FEE_2_NEW_MONEY Advance Fee fraud and lots of money

0.0 MONEY_FRAUD_5 Lots of money and many fraud phrases

0.0 FORM_FRAUD_5 Fill a form and many fraud phrases

Subject: {SPAM?} Compensation Award



--000000000000012f4e0654b4a67c

Content-Type: text/plain; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable



Subject: Midland Financial Recovery Bureau =E2=80=93 Victim Compensation Pr=

ogram

Compensation Award: USD $1,500,000.00

Reference ID: MF1122-CRX00491

Address: 8600 Westfield Avenue, Suite 210, Houston, TX 77040, USA



Dear Recipient,



We are contacting you as a listed beneficiary in a federally supported

restitution initiative established to compensate victims of financial

fraud. This action follows the prosecution and sentencing of

individuals=E2=80=94namely Andrew Collins, Eric Mateo, and Linda Frost=E2=

=80=94who were

recently convicted of operating fraudulent schemes while posing as

representatives of financial and government institutions.



As part of the outcome, the Midland Financial Recovery Bureau, in

collaboration with U.S. regulatory authorities, has approved a compensation

payment of USD $1,500,000.00 to be issued in your name. Disbursement will

be made through a secure ATM-enabled payment card, and all standard

transaction and delivery costs will be covered by the issuing entity.



To confirm your eligibility and initiate the processing of your payment,

please provide the following information for verification and compliance

review:



Full Legal Name



Residential Mailing Address



Current Occupation



Active Contact Number



Government-Issued Photo Identification (valid)



Please be advised that a nominal Processing and Verification Fee will be

required to complete the official endorsement and release of funds. There

will be no additional fees once this has been fulfilled.



This compensation program is part of a broader effort to assist fraud

victims and reinforce public confidence in financial institutions.



Sincerely,

Mr. Thomas E. Ralston

Director, Compensation Oversight Division

Midland Financial Recovery Bureau



--000000000000012f4e0654b4a67c

Content-Type: text/html; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable





=3D"gmail_signature" data-smartmail=3D"gmail_signature">

iv>Subject: Midland Financial Recovery Bureau =E2=80=93 Victim Compensation=

Program
Compensation Award: USD $1,500,000.00
Referenc=

e ID: MF1122-CRX00491
Address: 8600 Westfield Avenue, Suite 210, =

Houston, TX 77040, USA

Dear Recipient,
<=

br>
We are contacting you as a listed beneficiary in a federally =

supported restitution initiative established to compensate victims of finan=

cial fraud. This action follows the prosecution and sentencing of individua=

ls=E2=80=94namely Andrew Collins, Eric Mateo, and Linda Frost=E2=80=94who w=

ere recently convicted of operating fraudulent schemes while posing as repr=

esentatives of financial and government institutions.

<=

div>As part of the outcome, the Midland Financial Recovery Bureau, in colla=

boration with U.S. regulatory authorities, has approved a compensation paym=

ent of USD $1,500,000.00 to be issued in your name. Disbursement will be ma=

de through a secure ATM-enabled payment card, and all standard transaction =

and delivery costs will be covered by the issuing entity.


iv>
To confirm your eligibility and initiate the processing of your pay=

ment, please provide the following information for verification and complia=

nce review:

Full Legal Name


iv>Residential Mailing Address

Current Occupation<=

/div>

Active Contact Number

Gov=

ernment-Issued Photo Identification (valid)

Please=

be advised that a nominal Processing and Verification Fee will be required=

to complete the official endorsement and release of funds. There will be n=

o additional fees once this has been fulfilled.

Th=

is compensation program is part of a broader effort to assist fraud victims=

and reinforce public confidence in financial institutions.

<=

/div>
Sincerely,
Mr. Thomas E. Ralston
Director, Co=

mpensation Oversight Division
Midland Financial Recovery Bureau
div>




--000000000000012f4e0654b4a67c--

Nigerian Compensation spam from Google Gmail Part 2

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

0.0 LOTS_OF_MONEY Huge... sums of money

0.0 T_FILL_THIS_FORM_SHORT Fill in a short form with personal information

1.0 FREEMAIL_REPLYTO Reply-To/From or Reply-To/body contain different

freemails

0.0 T_FILL_THIS_FORM_FRAUD_PHISH Answer suspicious question(s)

1.3 MONEY_FORM_SHORT Lots of money if you fill out a short form

2.8 UNDISC_FREEM Undisclosed recipients + freemail reply-to

0.4 FILL_THIS_FORM_FRAUD_PHISH Answer suspicious question(s)

0.0 MONEY_FREEMAIL_REPTO Lots of money from someone using free email?

0.0 MONEY_FRAUD_5 Lots of money and many fraud phrases

2.6 UNDISC_MONEY Undisclosed recipients + money/fraud signs

2.0 ADVANCE_FEE_2_NEW_MONEY Advance Fee fraud and lots of money

0.0 FORM_FRAUD_5 Fill a form and many fraud phrases

Subject: {SPAM?} Compensation Award



--000000000000012f4e0654b4a67c

Content-Type: text/plain; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable



Subject: Midland Financial Recovery Bureau =E2=80=93 Victim Compensation Pr=

ogram

Compensation Award: USD $1,500,000.00

Reference ID: MF1122-CRX00491

Address: 8600 Westfield Avenue, Suite 210, Houston, TX 77040, USA



Dear Recipient,



We are contacting you as a listed beneficiary in a federally supported

restitution initiative established to compensate victims of financial

fraud. This action follows the prosecution and sentencing of

individuals=E2=80=94namely Andrew Collins, Eric Mateo, and Linda Frost=E2=

=80=94who were

recently convicted of operating fraudulent schemes while posing as

representatives of financial and government institutions.



As part of the outcome, the Midland Financial Recovery Bureau, in

collaboration with U.S. regulatory authorities, has approved a compensation

payment of USD $1,500,000.00 to be issued in your name. Disbursement will

be made through a secure ATM-enabled payment card, and all standard

transaction and delivery costs will be covered by the issuing entity.



To confirm your eligibility and initiate the processing of your payment,

please provide the following information for verification and compliance

review:



Full Legal Name



Residential Mailing Address



Current Occupation



Active Contact Number



Government-Issued Photo Identification (valid)



Please be advised that a nominal Processing and Verification Fee will be

required to complete the official endorsement and release of funds. There

will be no additional fees once this has been fulfilled.



This compensation program is part of a broader effort to assist fraud

victims and reinforce public confidence in financial institutions.



Sincerely,

Mr. Thomas E. Ralston

Director, Compensation Oversight Division

Midland Financial Recovery Bureau



--000000000000012f4e0654b4a67c

Content-Type: text/html; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable





=3D"gmail_signature" data-smartmail=3D"gmail_signature">

iv>Subject: Midland Financial Recovery Bureau =E2=80=93 Victim Compensation=

Program
Compensation Award: USD $1,500,000.00
Referenc=

e ID: MF1122-CRX00491
Address: 8600 Westfield Avenue, Suite 210, =

Houston, TX 77040, USA

Dear Recipient,
<=

br>
We are contacting you as a listed beneficiary in a federally =

supported restitution initiative established to compensate victims of finan=

cial fraud. This action follows the prosecution and sentencing of individua=

ls=E2=80=94namely Andrew Collins, Eric Mateo, and Linda Frost=E2=80=94who w=

ere recently convicted of operating fraudulent schemes while posing as repr=

esentatives of financial and government institutions.

<=

div>As part of the outcome, the Midland Financial Recovery Bureau, in colla=

boration with U.S. regulatory authorities, has approved a compensation paym=

ent of USD $1,500,000.00 to be issued in your name. Disbursement will be ma=

de through a secure ATM-enabled payment card, and all standard transaction =

and delivery costs will be covered by the issuing entity.


iv>
To confirm your eligibility and initiate the processing of your pay=

ment, please provide the following information for verification and complia=

nce review:

Full Legal Name


iv>Residential Mailing Address

Current Occupation<=

/div>

Active Contact Number

Gov=

ernment-Issued Photo Identification (valid)

Please=

be advised that a nominal Processing and Verification Fee will be required=

to complete the official endorsement and release of funds. There will be n=

o additional fees once this has been fulfilled.

Th=

is compensation program is part of a broader effort to assist fraud victims=

and reinforce public confidence in financial institutions.

<=

/div>
Sincerely,
Mr. Thomas E. Ralston
Director, Co=

mpensation Oversight Division
Midland Financial Recovery Bureau
div>




--000000000000012f4e0654b4a67c--

Nigerian Compensation spam Part 1

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Sat, 20 Jun 2026 14:07:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wb1xr-00000000OLU-325D

for dave@doctor.nl2k.ab.ca;

Sat, 20 Jun 2026 14:06:51 -0600

Resent-From: The Doctor

Resent-Date: Sat, 20 Jun 2026 14:06:51 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-lj1-f193.google.com ([209.85.208.193]:47268)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wb1jr-00000000Mfk-3ZSU

for doctor@nk.ca;

Sat, 20 Jun 2026 13:52:33 -0600

Received: by mail-lj1-f193.google.com with SMTP id 38308e7fff4ca-39677aed4d3so26710671fa.2

for ; Sat, 20 Jun 2026 12:51:37 -0700 (PDT)

ARC-Seal: i=1; a=rsa-sha256; t=1781985090; cv=none;

d=google.com; s=arc-20240605;

b=MLDZl2NPuQnb3G9u4TG9WsQDvzeh8EmnxT2dX3mNHVK6QB8BJ/ItvVG96x2DbgEdAX

MrbugZM7tJ9kaouzlMlv8C+GPOzFXcuPmfxCJeuJEeuOCheD5I+BwDH18JaWKdunb0bf

Dwrivb3/0C2QLsU90MKqNYMZsTuykmP3dvafr+/rPcbfqB1XmpgS/8PBPWltaDWJouV+

JIuot9uQMDamLjgsz5P30W7uAOWJVY8ZZ5ovS9xOrB4QweAlv60trcyNObMBH3UrrKK+

bZc9PPN7G44BNRDPDl8MGfh/X/U64KslmjweBfVVMnBhfdcQK7aUVbbsGGi3v+xn4ZAz

EYAw==

ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20240605;

h=to:subject:message-id:date:from:reply-to:mime-version

:dkim-signature;

bh=em15lI1mKGVSJdQKVfxc2yi8Xza15rcXvqiJNGJzY8s=;

fh=2/qc8Opyk4bxvL+K8xyZSX9PXUMx/90mitUCvHIx4UI=;

b=YJPDp+M8LmCDddsbiz3ebGAYVoU/pm/FMnKQ3sxt5l9mZMYwW9hIoQ/ygye4H6Fl7W

wfTBrX0NXgGEL5986NEYavaGJYXa2CJVa72B3d30LyJKxhYnbmJkB/eNV0XLPf2m6NsG

+QsRxquvg/PCa4q0YM/mSuhJxriehTZjXVboEZ9qjU/D3NEicR0hxxOXLWJSRJw57+6f

VuzLaacKH9f2cfKu96fZHrfEFcf7Q7UTbItCrKisR2Jf/+X3rTUaqxZq6lLKT9WNTpRs

s6nv+30OFKbY2Am8F49N8M+eelfoHPMOtKMeZ18Q8f88Spr4xDX4X+uKSmd/XuG8gLdo

/xhw==;

darn=nk.ca

ARC-Authentication-Results: i=1; mx.google.com; arc=none

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=gmail.com; s=20251104; t=1781985090; x=1782589890; darn=nk.ca;

h=to:subject:message-id:date:from:reply-to:mime-version:from:to:cc

:subject:date:message-id:reply-to;

bh=em15lI1mKGVSJdQKVfxc2yi8Xza15rcXvqiJNGJzY8s=;

b=mrdNhgmFgDJ6Rz3NrVGJBzeSB1WKgSIrtciQQbH+SjLSkubTWx3a9laTQYwghA/+jG

DteRuHLH5WvCb3VArAwEdh16V9kiY7db3junZMCCbLGqvCryqEuksPP8XdOMD9X3VsKh

TfZ9cYCN6ZDC7FqhsmB8HS8CwpyNObHz+X+D38m4p59BOPbFxaS8erWEfY2jKV1FQULp

r8OW2jz6p+MCZ4Iff+tK2n6GVU2Ist6spj5n4CHthyav+WT5eM4JOFFdCfx8DrfIcHTq

5d8MhhOra48Clb12TIPFTofbARQjoxDLQbzrXl5VlqFsFxJCq/qZSiTf+fCVs3gbI2n/

n6lg==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20251104; t=1781985090; x=1782589890;

h=to:subject:message-id:date:from:reply-to:mime-version:x-gm-gg

:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to;

bh=em15lI1mKGVSJdQKVfxc2yi8Xza15rcXvqiJNGJzY8s=;

b=bzmjaV8C8CIfmVMu8v3Wngkv+kA2gWc1THBkyiibux5BD/JKilpb0LwYD3YM9HdxL+

5GeUJM/6AztW05P5gBo9/eL4ZXA+z9PGhw/ZqIWDl4G5M4uHTgt9xXrXB+i5nCc+HQlZ

9+XoGsA43K+CQ5iFO4cAw8F8fsCiP2+eczJOeCYbrRDJ5V0PAKyw2oUATYZm4ksfHMr5

cxFVd1Vc06Ht7alON5tKV4blyGhq5aBhzrNBvGrUXM0jbnc2OgfDPxVHG5lVYu/dv5hQ

akUb0Ll/ZEHrwGSfPcdLIqagXdAbqOh0tfkmmZg6zV/h1ekxMfy2JPusKG+d4Sib3SWt

5foA==

X-Forwarded-Encrypted: i=1; AFNElJ/WfCd3aPEmfvzkskvVsthnNEiRZ6Z0GFvQASC8Oza0pAIFvg8t2qQb96tq186cuZ4hd8lLILA=@nk.ca

X-Gm-Message-State: AOJu0Yy9uYiBNHwdzKUNXgkcN7s1rxODaU9iaKPVwj1cOubfap3F2yPC

4LyBTqLPfRsXt8C2LShHY19jnoyjdDYTzxpPWMCShGKcCGChIEMFuakRYVtVFrE1oapFXdzLJ2L

6KfClzwgyNQEQDlVXfMeSrHSlw35ChoM=

X-Gm-Gg: AfdE7ckmayn7qAqPE8xAE1qHwP4zQagUQQ3oUKQNcs1LNZ8jWbWw3PFDk6JNZYYy6Kj

Mf44Ern/sdtdl+2rgLOSaEL3JDhIkV+e2fjBkf3AZtK6NI1lCzNDaMEwqGn+ViVhn09K3F63djx

gaU/VTl5t484juqSfSjd+km8Q+MBTG+0FMJ+PUbJCulnkPtmGfdFIX6YeWHmvMybOjSQZ6Eq/iQ

a5CmQy14y5Is0EootPq6mW/Eadxvg7pJeV9rFCyUrFXrOs/h8dVWMdfuVEZTrb8kF6Wowd/TEhW

y26u2xwM

X-Received: by 2002:a2e:a9a5:0:b0:396:9966:50cf with SMTP id

38308e7fff4ca-3998e4092d7mr16710201fa.9.1781984716204; Sat, 20 Jun 2026

12:45:16 -0700 (PDT)

MIME-Version: 1.0

Reply-To: citibank.co.usa@gmail.com

From: Michael Corbat

Date: Sat, 20 Jun 2026 12:44:41 -0700

X-Gm-Features: AVVi8Cee6rCzcsUfU88IFtFAIMaK7YU6-UAmDxNctI4bo92nl-eibb70H8m3-qc

Message-ID:

Subject: Compensation Award

To: undisclosed-recipients:;

Content-Type: multipart/alternative; boundary="000000000000012f4e0654b4a67c"

Bcc: doctor@nk.ca

X-Spam_score: 16.4

X-Spam_score_int: 164

X-Spam_bar: ++++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Subject: Midland Financial Recovery Bureau – Victim Compensation

Program Compensation Award: USD $1,500,000.00 Reference ID: MF1122-CRX00491

Address: 8600 Westfield Avenue, Suite 210, Houston, TX 77 [...]



Content analysis details: (16.4 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[209.85.208.193 listed in will-spam-for-food.eu.org]

[209.85.208.193 listed in will-spam-for-food.eu.org]

[209.85.208.193 listed in will-spam-for-food.eu.org]

[209.85.208.193 listed in will-spam-for-food.eu.org]

[209.85.208.193 listed in will-spam-for-food.eu.org]

[209.85.208.193 listed in will-spam-for-food.eu.org]

[209.85.208.193 listed in will-spam-for-food.eu.org]

[209.85.208.193 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[209.85.208.193 listed in dnsbl.ahbl.org]

[209.85.208.193 listed in dnsbl.ahbl.org]

[209.85.208.193 listed in dnsbl.ahbl.org]

[209.85.208.193 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[209.85.208.193 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[209.85.208.193 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[209.85.208.193 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[209.85.208.193 listed in dnsbl.ahbl.org]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[209.85.208.193 listed in list.dnswl.org]

-0.0 SPF_PASS SPF: sender matches SPF record

1.5 GR_DOMAIN_UNDISC1 To contains undisclosed recipient (undisc)

0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider

[jeegael37(at)gmail.com]

1.0 FORGED_GMAIL_RCVD 'From' gmail.com does not match 'Received' headers

0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends in

digit

[jeegael37(at)gmail.com]

2.5 US_DOLLARS_3 BODY: Mentions millions of $ ($NN,NNN,NNN.NN)

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[209.85.208.193 listed in wl.mailspike.net]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[209.85.208.193 listed in bl.score.senderscore.com]

Nigerian spam from Google Gmail Part 2





--000000000000f3d2300654b0a963

Content-Type: text/plain; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable



International Economic Stabilization Bureau (IESB)

Office of Global Restitution & Development

450 Constitution Avenue NW

Washington, D.C. 20530

United States



Grant Approval Notification



Global Recovery & Assistance Program

(Ref: IESB-447521-GRAP)



Dear Beneficiary,



The International Economic Stabilization Bureau (IESB) is pleased to notify

you of your approval for a Global Recovery Grant. This program was

established in partnership with the World Development Cooperative and the

Universal Economic Relief Fund to provide direct financial assistance to

individuals and communities adversely affected by global economic

disruptions and financial misconduct.



Program Background

Following comprehensive investigations conducted by international

regulators, significant assets were seized from dismantled fraudulent

operations across multiple continents. These funds have been allocated to

the Global Recovery & Assistance Program. After an independent audit and

eligibility review, your profile has been approved to receive a restitution

grant of US $1,500,000 (One Million, Five Hundred Thousand United States

Dollars).



Disbursement Method

Funds will be distributed via a secure Digital Payment Certificate linked

to the International Settlement Network, ensuring accessibility and secure

transfer in more than 120 countries.



Verification Process =E2=80=94 Required Action

To complete your registration and initiate the release of your grant,

kindly provide the following details:



Full Name (as listed on official records)



Residential Address & Country of Residence



Occupation/Field of Work



Direct Contact Number



A copy of any valid Government-issued Identification Document



Program Oversight & Certification

This notification is issued under the supervision of:



Dr. Maria Ellington =E2=80=93 Director, International Economic Stabilizatio=

n Bureau



Mr. Daniel Kovacs =E2=80=93 Chief Administrator, World Development Cooperat=

ive



Ms. Sophia Grant =E2=80=93 Global Treasurer, Universal Economic Relief Fund



Please respond promptly with the requested information to secure your grant

disbursement.



Sincerely,

Dr. Maria Ellington

Director, International Economic Stabilization Bureau (IESB)



--000000000000f3d2300654b0a963

Content-Type: text/html; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable





=3D"gmail_signature" data-smartmail=3D"gmail_signature">

iv>International Economic Stabilization Bureau (IESB)
Office of G=

lobal Restitution & Development
450 Constitution Avenue NW
iv>
Washington, D.C. 20530
United States

=

Grant Approval Notification

Global Recovery &=

amp; Assistance Program
(Ref: IESB-447521-GRAP)


iv>
Dear Beneficiary,

The International Econom=

ic Stabilization Bureau (IESB) is pleased to notify you of your approval fo=

r a Global Recovery Grant. This program was established in partnership with=

the World Development Cooperative and the Universal Economic Relief Fund t=

o provide direct financial assistance to individuals and communities advers=

ely affected by global economic disruptions and financial misconduct.
=


Program Background
Following comprehensive in=

vestigations conducted by international regulators, significant assets were=

seized from dismantled fraudulent operations across multiple continents. T=

hese funds have been allocated to the Global Recovery & Assistance Prog=

ram. After an independent audit and eligibility review, your profile has be=

en approved to receive a restitution grant of US $1,500,000 (One Million, F=

ive Hundred Thousand United States Dollars).

Disbu=

rsement Method
Funds will be distributed via a secure Digital Pay=

ment Certificate linked to the International Settlement Network, ensuring a=

ccessibility and secure transfer in more than 120 countries.

=

Verification Process =E2=80=94 Required Action
To comp=

lete your registration and initiate the release of your grant, kindly provi=

de the following details:

Full Name (as listed on =

official records)

Residential Address & Countr=

y of Residence

Occupation/Field of Work
=


Direct Contact Number

A copy of any=

valid Government-issued Identification Document

P=

rogram Oversight & Certification
This notification is issued =

under the supervision of:

Dr. Maria Ellington =E2=

=80=93 Director, International Economic Stabilization Bureau

=

Mr. Daniel Kovacs =E2=80=93 Chief Administrator, World Developme=

nt Cooperative

Ms. Sophia Grant =E2=80=93 Global T=

reasurer, Universal Economic Relief Fund

Please re=

spond promptly with the requested information to secure your grant disburse=

ment.

Sincerely,
Dr. Maria Ellington
v>
Director, International Economic Stabilization Bureau (IESB)

div>




--000000000000f3d2300654b0a963--

Nigerian spam from Google Gmail Part 1

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Sat, 20 Jun 2026 09:07:00 -0600

Received: from mail-ot1-f66.google.com ([209.85.210.66]:43210)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1waxGi-00000000IdY-3vqA

for dave@doctor.nl2k.ab.ca;

Sat, 20 Jun 2026 09:06:10 -0600

Received: by mail-ot1-f66.google.com with SMTP id 46e09a7af769-7e6deacafa8so2168172a34.0

for ; Sat, 20 Jun 2026 08:05:13 -0700 (PDT)

ARC-Seal: i=1; a=rsa-sha256; t=1781967907; cv=none;

d=google.com; s=arc-20240605;

b=NDEvGn6qUfKh88S8K/v+d19ovnl8FyNuFZKuEw9LCKL3k+Y2zTDb9gWNSjHVxG2JMV

7UW4PwdmQtTSNO2JcvaD/9BXAt4laWmJ4F6+Z1QzOXC/iRKomczikp8gp/ZVzcSJZYJC

kWrWUCLe6+tOqyr1e/lYeampNqPJ4u3Hp+4t8u8JJN6GlFaXCAjwKS5XSewaSJ12NEDi

EplGW/QydCRdxH5JyKeYTuXeda7AnROWhrNiMap9O8MVyeCltdC8TNjs9wobESPbpYfc

XW6B8uIPQuVJqMjXudwN0TeNDX/7IS0kg7aL6cqoAfGLX75QVdOyXjYtnAEuGNX53QyY

0ing==

ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20240605;

h=to:subject:message-id:date:from:reply-to:mime-version

:dkim-signature;

bh=NRa1yV8ekP8Z9Ym8P8T/6j9ZFPN0sqmrapO9e9e2gIo=;

fh=xSOtv5ID8ogNOZSFpG+Q1yeX32V/4/vtEuW7J0Qqrdo=;

b=FvCf2HVu+4CtygWZCYnWAVPaN5j++oukt0as8oaOnmHooFKzTaHkNHk2DPziHU6SQZ

JjjABR93yZmEgJHWJ/mb1qzEYuRN37ZC36pPq5XvYLdtxDctWzPCdUeRrz0ZjCVqwHS3

/dasKQuS4qHfVotvOHiG1S7nqZ4ThzMG820KScfHxvq/bi/tj1y0AVHXA/oN1CIdSLqv

WRYAfxs1UOxjrTiSJo+UikFitSK5NFJSN6ANFq36AkncTKgog2lv7wnSO/arBemzz8N4

uep030wjMXCWc6EeVCwjyZKpEyNGTw1YQXlSvupHa7E6atzObQMkmxySeE1at3RqDdsw

THGA==;

darn=doctor.nl2k.ab.ca

ARC-Authentication-Results: i=1; mx.google.com; arc=none

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=gmail.com; s=20251104; t=1781967907; x=1782572707; darn=doctor.nl2k.ab.ca;

h=to:subject:message-id:date:from:reply-to:mime-version:from:to:cc

:subject:date:message-id:reply-to;

bh=NRa1yV8ekP8Z9Ym8P8T/6j9ZFPN0sqmrapO9e9e2gIo=;

b=O7CgvYJKNr23cjxCDwTZDpAp5dUisf4E7yI3BC8ree8qSMQwyv2Tns4fmAmmOUup4P

dW7D6hnphr/ooCnqQvmd3uFVeOCC4++TzwnkjWi/8PZXxbws6rjuFFkr+BxHvjhFVQwW

QS0r3V/YzhO4qN9S/m9vRG5l2iaDSZ8zjjrl1p+1rFL92YnnnqcKeZIryQx6km426oS2

0gzNdSy94gS4dC2HXKeWq9QGmYAfJDXhUvYNUU62OgodjsXs76pYAo5Rhqs0/9fV6YcO

cAA73m8Vj5Nqog4ffuY/qqxPPdN7t6pAfrI+PLIQTZEsKHE2x0cQ5C/lCKCS3wrmkHqk

eS8w==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20251104; t=1781967907; x=1782572707;

h=to:subject:message-id:date:from:reply-to:mime-version:x-gm-gg

:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to;

bh=NRa1yV8ekP8Z9Ym8P8T/6j9ZFPN0sqmrapO9e9e2gIo=;

b=dUG5O1WsSGcq+EmeAX8qIlY4A9fuOmGTn1mWIOGfQ2rTWzTHzk7ZtA7FKsb9JiqZIO

T5CDeStQwsKcdUOf/NDzKaYz95IaapM+uhQ2QBoACZ9vzeuHiVYpBsl7KLDGAm7V8uBu

IpzUwewN0OyUlmqTNOaNtjhf6Fv/U6ylUtB2URYvMLQGqow5K4c9Gf5EJaaG0Xo2Xg1s

UIcTU+Iiy9LyBjWPZ9LR0CkIxgTVAo/855gq5ZElR6M/cEHsXvrYMj5T8P1Ri3TXS47r

cl86ayyyS++J/E+2FGgOa4zBNg5ULdiwMH5NlaBWXSRcjsD9JK+GS8Lk/Vipo3+CPyiB

J/Yw==

X-Forwarded-Encrypted: i=1; AFNElJ8QAO+zEhVX6UVLa2fEG26UoC2vL2Br38Jhdk/uAp626srGv+d/Kg32CTdBMQWb1YDtPlgl@doctor.nl2k.ab.ca

X-Gm-Message-State: AOJu0YwSrkkIk6J8CPdTAOtzjymXprPr/WCbgwRzLhdQtnOaSOBRvjk5

/rcis/qsFMCQIZcpreUQf0it3wIMHT3TlBI1A7evKX3W4Id6MrsL/NFKsJtaNiMRbTS6twWcqVl

kT2U6azfWBwnyEk3IgXCaJ26uM6p7PUpqh5NzB2JG/A==

X-Gm-Gg: AfdE7clsxYdZ4Y9Ggp/u4EYavjwKSoGnh9CbmrZ5o0PehOzKvm7FHwgTvoj2WBRXklI

EQDWxvPh4/KgkW2uXaGL+8BY7JT82taTo3ZbZsMNeiHlXJbZaoBKJv8hI/g6oc5dg7NORzXowX7

Voa7Iuo2W0WQE46q9BYxGLJmQspA7NA493ChuD1EvR5KRwYR0waqLX1OwiX9B3CyT/PBXzQuKiS

mFEAqs0qm9WKZdGqopPISIF7tClUye435VnInjcnu27TWqA08rirsmj7kELc6R/lsGasEBhsw==

X-Received: by 2002:a05:6820:220f:b0:696:72e9:f92e with SMTP id

006d021491bc7-6a0da01ce54mr4937306eaf.10.1781967602568; Sat, 20 Jun 2026

08:00:02 -0700 (PDT)

MIME-Version: 1.0

Reply-To: citibank.co.usa@gmail.com

From: "Dr. Michael Faulkender"

Date: Sat, 20 Jun 2026 07:59:28 -0700

X-Gm-Features: AVVi8CdZUg8ePfOUFljzVOOHVqdCSAwhbCy4T3INsbk0jtcUWkJBKRfdiEPE5bw

Message-ID:

Subject: Global Recovery & Assistance Program

To: undisclosed-recipients:;

Content-Type: multipart/alternative; boundary="000000000000f3d2300654b0a963"

Bcc: dave@doctor.nl2k.ab.ca

X-Spam_score: 21.5

X-Spam_score_int: 215

X-Spam_bar: +++++++++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: International Economic Stabilization Bureau (IESB) Office

of Global Restitution & Development 450 Constitution Avenue NW Washington,

D.C. 20530 United States Grant Approval Notification Global Recovery & Assistance

Program (Ref: IESB-447521-GRAP)



Content analysis details: (21.5 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[209.85.210.66 listed in will-spam-for-food.eu.org]

[209.85.210.66 listed in will-spam-for-food.eu.org]

[209.85.210.66 listed in will-spam-for-food.eu.org]

[209.85.210.66 listed in will-spam-for-food.eu.org]

[209.85.210.66 listed in will-spam-for-food.eu.org]

[209.85.210.66 listed in will-spam-for-food.eu.org]

[209.85.210.66 listed in will-spam-for-food.eu.org]

[209.85.210.66 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[209.85.210.66 listed in dnsbl.ahbl.org]

[209.85.210.66 listed in dnsbl.ahbl.org]

[209.85.210.66 listed in dnsbl.ahbl.org]

[209.85.210.66 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[209.85.210.66 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[209.85.210.66 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[209.85.210.66 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[209.85.210.66 listed in dnsbl.ahbl.org]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[209.85.210.66 listed in list.dnswl.org]

-0.0 SPF_PASS SPF: sender matches SPF record

1.5 GR_DOMAIN_UNDISC1 To contains undisclosed recipient (undisc)

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-0.0 RCVD_IN_MSPIKE_H3 RBL: Good reputation (+3)

[209.85.210.66 listed in wl.mailspike.net]

0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider

[samuelbenjamin.ou(at)gmail.com]

2.5 MILLION_USD BODY: Talks about millions of dollars

3.5 DEAR_BENEFICIARY BODY: Dear Beneficiary:

2.5 US_DOLLARS_3 BODY: Mentions millions of $ ($NN,NNN,NNN.NN)

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[209.85.210.66 listed in bl.score.senderscore.com]

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

0.8 SARE_FROM_SPAM_WORD3 I don't know people named this!

0.0 T_HK_NAME_FM_DR No description available.

0.0 LOTS_OF_MONEY Huge... sums of money

-0.0 RCVD_IN_MSPIKE_WL Mailspike good senders

1.0 FREEMAIL_REPLYTO Reply-To/From or Reply-To/body contain different

freemails

0.0 FILL_THIS_FORM Fill in a form with personal information

2.8 UNDISC_FREEM Undisclosed recipients + freemail reply-to

0.0 MONEY_FORM Lots of money if you fill out a form

0.0 MONEY_FREEMAIL_REPTO Lots of money from someone using free email?

2.6 UNDISC_MONEY Undisclosed recipients + money/fraud signs

3.1 MONEY_FRAUD_3 Lots of money and several fraud phrases

Subject: {SPAM?} Global Recovery & Assistance Program

Nigerian spam from Google Gmail Part 2

--000000000000f3d2300654b0a963

Content-Type: text/plain; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable



International Economic Stabilization Bureau (IESB)

Office of Global Restitution & Development

450 Constitution Avenue NW

Washington, D.C. 20530

United States



Grant Approval Notification



Global Recovery & Assistance Program

(Ref: IESB-447521-GRAP)



Dear Beneficiary,



The International Economic Stabilization Bureau (IESB) is pleased to notify

you of your approval for a Global Recovery Grant. This program was

established in partnership with the World Development Cooperative and the

Universal Economic Relief Fund to provide direct financial assistance to

individuals and communities adversely affected by global economic

disruptions and financial misconduct.



Program Background

Following comprehensive investigations conducted by international

regulators, significant assets were seized from dismantled fraudulent

operations across multiple continents. These funds have been allocated to

the Global Recovery & Assistance Program. After an independent audit and

eligibility review, your profile has been approved to receive a restitution

grant of US $1,500,000 (One Million, Five Hundred Thousand United States

Dollars).



Disbursement Method

Funds will be distributed via a secure Digital Payment Certificate linked

to the International Settlement Network, ensuring accessibility and secure

transfer in more than 120 countries.



Verification Process =E2=80=94 Required Action

To complete your registration and initiate the release of your grant,

kindly provide the following details:



Full Name (as listed on official records)



Residential Address & Country of Residence



Occupation/Field of Work



Direct Contact Number



A copy of any valid Government-issued Identification Document



Program Oversight & Certification

This notification is issued under the supervision of:



Dr. Maria Ellington =E2=80=93 Director, International Economic Stabilizatio=

n Bureau



Mr. Daniel Kovacs =E2=80=93 Chief Administrator, World Development Cooperat=

ive



Ms. Sophia Grant =E2=80=93 Global Treasurer, Universal Economic Relief Fund



Please respond promptly with the requested information to secure your grant

disbursement.



Sincerely,

Dr. Maria Ellington

Director, International Economic Stabilization Bureau (IESB)



--000000000000f3d2300654b0a963

Content-Type: text/html; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable





=3D"gmail_signature" data-smartmail=3D"gmail_signature">

iv>International Economic Stabilization Bureau (IESB)
Office of G=

lobal Restitution & Development
450 Constitution Avenue NW
iv>
Washington, D.C. 20530
United States

=

Grant Approval Notification

Global Recovery &=

amp; Assistance Program
(Ref: IESB-447521-GRAP)


iv>
Dear Beneficiary,

The International Econom=

ic Stabilization Bureau (IESB) is pleased to notify you of your approval fo=

r a Global Recovery Grant. This program was established in partnership with=

the World Development Cooperative and the Universal Economic Relief Fund t=

o provide direct financial assistance to individuals and communities advers=

ely affected by global economic disruptions and financial misconduct.
=


Program Background
Following comprehensive in=

vestigations conducted by international regulators, significant assets were=

seized from dismantled fraudulent operations across multiple continents. T=

hese funds have been allocated to the Global Recovery & Assistance Prog=

ram. After an independent audit and eligibility review, your profile has be=

en approved to receive a restitution grant of US $1,500,000 (One Million, F=

ive Hundred Thousand United States Dollars).

Disbu=

rsement Method
Funds will be distributed via a secure Digital Pay=

ment Certificate linked to the International Settlement Network, ensuring a=

ccessibility and secure transfer in more than 120 countries.

=

Verification Process =E2=80=94 Required Action
To comp=

lete your registration and initiate the release of your grant, kindly provi=

de the following details:

Full Name (as listed on =

official records)

Residential Address & Countr=

y of Residence

Occupation/Field of Work
=


Direct Contact Number

A copy of any=

valid Government-issued Identification Document

P=

rogram Oversight & Certification
This notification is issued =

under the supervision of:

Dr. Maria Ellington =E2=

=80=93 Director, International Economic Stabilization Bureau

=

Mr. Daniel Kovacs =E2=80=93 Chief Administrator, World Developme=

nt Cooperative

Ms. Sophia Grant =E2=80=93 Global T=

reasurer, Universal Economic Relief Fund

Please re=

spond promptly with the requested information to secure your grant disburse=

ment.

Sincerely,
Dr. Maria Ellington
v>
Director, International Economic Stabilization Bureau (IESB)

div>




--000000000000f3d2300654b0a963--

Nigerian spam from Google Gmail Part 1

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@nl2k.ab.ca

Delivery-date: Sat, 20 Jun 2026 09:08:00 -0600

Received: from mail-oi1-f195.google.com ([209.85.167.195]:43506)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1waxHj-00000000Ihs-13KW

for dave@nl2k.ab.ca;

Sat, 20 Jun 2026 09:07:12 -0600

Received: by mail-oi1-f195.google.com with SMTP id 5614622812f47-48670d35a87so2367654b6e.1

for ; Sat, 20 Jun 2026 08:06:16 -0700 (PDT)

ARC-Seal: i=1; a=rsa-sha256; t=1781967970; cv=none;

d=google.com; s=arc-20240605;

b=OGlom3+dDw9cLfBKuoQq/WESuZLwhPT7smN2UUeACAEkkAIkgoS65AXqpnbs1bxPjK

KK0rJsKHBjK/nzYUn15EB/06gGYNOmnKFVilJM4WX4rxW5snPcfr91SeKVi+sNh5TXZ3

5XfgXDPIWneQZpG8NLbQnidZJSqEhCD7hX3VIKRBsReC2Kz/Ll6qv2VRYeurV9KoUStE

RxdwW+Bn86BQgi9lgB07ul9PwsgrtggykuMK5o377VRAw8DSRAOkB0c5T/ctfGspwaT/

ykVcMLsAbwgkdFrNGlMltI8Ab/L6QWNsyf6Dox3qwoz3p0Sh42+gjn7mIfOAw2BzzrOv

ABZw==

ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20240605;

h=to:subject:message-id:date:from:reply-to:mime-version

:dkim-signature;

bh=NRa1yV8ekP8Z9Ym8P8T/6j9ZFPN0sqmrapO9e9e2gIo=;

fh=NfR8xDJjuLU8nXmj/yixzqcI+zCHIC1i/sDdVRnLoXs=;

b=lXdz3r7VtFCgYScFadzRDJ+g8UVkYLP7iX6MG0ox+sXSJn9VJlRlHp8sJ/6bvx51b2

ZJ643mp1Y19JE1KxDKJJ5qNPiDNHjVgVyfC0PWVryPi2ar8/99nknHjsJpecjpZ8Jk84

HKf0WA4NSuMehzJDKsPJEVcjJAyOxTNE4FNmBco2NY8gxOMwM2kDFLeld2kk/5ztf668

pLbpbqYPagVzMBax8gEXfj39Uk2vhmM40qNS7x/NyJvxaC5SQrhyq59XoB9oULWAc6yS

Hnpqgtkb3F/Qp8zi51x0Qxw8L6P3VJAFMCmIgQRwQyzN5FjlwFRfhg87mh5c6St/wVQ+

E4cg==;

darn=nl2k.ab.ca

ARC-Authentication-Results: i=1; mx.google.com; arc=none

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=gmail.com; s=20251104; t=1781967970; x=1782572770; darn=nl2k.ab.ca;

h=to:subject:message-id:date:from:reply-to:mime-version:from:to:cc

:subject:date:message-id:reply-to;

bh=NRa1yV8ekP8Z9Ym8P8T/6j9ZFPN0sqmrapO9e9e2gIo=;

b=XYBbAK2GUM4evCTKFzdquDdgTDV+CHW4SG54X/CUPVC7yeC1hpERVR1hILimCoU0jz

s0yNkxCCXc+JEhpgE1KnDBSjWnzgLewR4Ce1Dekjy3I/ESo6333zrmVzouEqdUYx4gOP

mJ8Wcp/9ZlLrZuJ7cIbwDPYZ8d/qZLaNM6SWmwh/CBWB60nLtxB/EAtZ1My14Xxah7Xk

VibxDXpObpcD2LnLOzfDgKSgV5Kqrk88MPRAH3YhVx5ycq4drqONd64CRLhhcdaNmAtb

XFWqTHsrZGSROYXk9tIt90BHYZcd3wno+5bucEgbbZf9wTK5nJZ0MVdzrJHYs+t7teAX

7XOQ==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20251104; t=1781967970; x=1782572770;

h=to:subject:message-id:date:from:reply-to:mime-version:x-gm-gg

:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to;

bh=NRa1yV8ekP8Z9Ym8P8T/6j9ZFPN0sqmrapO9e9e2gIo=;

b=Bwj/k8eBXDAf5LFjY+9I/Bv1zF4R7+7wCxnHzG4z0DvzPtT8trF9SBkuxiwL1OfcIe

rX15ODQQLkE5z/UyV4MkxVSQSzlU9XbjjV2tptl4ArvKkzfDsmu2SAdRCM50+k/ipD/G

dsqvCbcqFsSjG1cMOWAElJjDS/lpyamMzSFyDyxEiL88fk0B9u1g6MmpGpm7LngOnLrA

+IEef35Nw2pg9KG8LsW+uPK4zuvJZZKUm3oG5t09wQMUWoMx4AGhx3r9LzSfv11CP/43

0EMsppA+eCrvkkIAoKqq4NkBB7OnmsGc0kloX5md8srQ3by6+cjG1Queb3+TviHGeY3o

Ok5A==

X-Forwarded-Encrypted: i=1; AFNElJ/4O7FsaiKdd/DINNk1nF+sqdDZwJiPBnOc9sJ25kCjKGSybVprfF0bJRIgKC874qzHGdiH@nl2k.ab.ca

X-Gm-Message-State: AOJu0YwzfBop3LLZUafQ5RnI0SyqO+KVSzwHDJ8n+9ycGJLXgrQAf6D/

5TrhBMyq+nvA8+50qrVGGjz+fo5sLD7C+vahddELmug5AZeEZZeFt5fMlROM0eKJSkjMCrZLmxu

oxJNRYYvzBFMuDbBgeFdk6AH0oVEzU1g=

X-Gm-Gg: AfdE7ckwl/i1qduuO8C2XNgIyLWbfRKkt7+xtXvG+vqY/FfCpRYOvweEELvRefVMyzx

0c21u0b9qh7UAYxTf5BBGPnjVQwa40xd+HisG3JxN9T4UWsvwP3JBtpywe88nOeJHt7+PPqxnBV

QQ1xkXz9rMX882Z7dWmIui6JXPtqwClxUznrI+oE4wbCoCAUOCGs4WrhG6NfdigjiH85v9tM5CQ

oARqcg8NCXqObfu952royqcBSHD/KFHhLWCL3n0DN5zyljCAIz6jE6P8LZi7B/4f3ZlibHfsg==

X-Received: by 2002:a05:6820:220f:b0:696:72e9:f92e with SMTP id

006d021491bc7-6a0da01ce54mr4937306eaf.10.1781967602568; Sat, 20 Jun 2026

08:00:02 -0700 (PDT)

MIME-Version: 1.0

Reply-To: citibank.co.usa@gmail.com

From: "Dr. Michael Faulkender"

Date: Sat, 20 Jun 2026 07:59:28 -0700

X-Gm-Features: AVVi8CdZUg8ePfOUFljzVOOHVqdCSAwhbCy4T3INsbk0jtcUWkJBKRfdiEPE5bw

Message-ID:

Subject: Global Recovery & Assistance Program

To: undisclosed-recipients:;

Content-Type: multipart/alternative; boundary="000000000000f3d2300654b0a963"

Bcc: dave@nl2k.ab.ca

X-Spam_score: 21.4

X-Spam_score_int: 214

X-Spam_bar: +++++++++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: International Economic Stabilization Bureau (IESB) Office

of Global Restitution & Development 450 Constitution Avenue NW Washington,

D.C. 20530 United States Grant Approval Notification Global Recovery & Assistance

Program (Ref: IESB-447521-GRAP)



Content analysis details: (21.4 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[209.85.167.195 listed in will-spam-for-food.eu.org]

[209.85.167.195 listed in will-spam-for-food.eu.org]

[209.85.167.195 listed in will-spam-for-food.eu.org]

[209.85.167.195 listed in will-spam-for-food.eu.org]

[209.85.167.195 listed in will-spam-for-food.eu.org]

[209.85.167.195 listed in will-spam-for-food.eu.org]

[209.85.167.195 listed in will-spam-for-food.eu.org]

[209.85.167.195 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[209.85.167.195 listed in dnsbl.ahbl.org]

[209.85.167.195 listed in dnsbl.ahbl.org]

[209.85.167.195 listed in dnsbl.ahbl.org]

[209.85.167.195 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[209.85.167.195 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[209.85.167.195 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[209.85.167.195 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[209.85.167.195 listed in dnsbl.ahbl.org]

-0.0 SPF_PASS SPF: sender matches SPF record

1.5 GR_DOMAIN_UNDISC1 To contains undisclosed recipient (undisc)

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[209.85.167.195 listed in list.dnswl.org]

0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider

[samuelbenjamin.ou(at)gmail.com]

2.5 MILLION_USD BODY: Talks about millions of dollars

3.5 DEAR_BENEFICIARY BODY: Dear Beneficiary:

2.5 US_DOLLARS_3 BODY: Mentions millions of $ ($NN,NNN,NNN.NN)

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[209.85.167.195 listed in bl.score.senderscore.com]

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[209.85.167.195 listed in wl.mailspike.net]

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 LOTS_OF_MONEY Huge... sums of money

0.0 T_HK_NAME_FM_DR No description available.

0.8 SARE_FROM_SPAM_WORD3 I don't know people named this!

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

1.0 FREEMAIL_REPLYTO Reply-To/From or Reply-To/body contain different

freemails

0.0 MONEY_FREEMAIL_REPTO Lots of money from someone using free email?

2.8 UNDISC_FREEM Undisclosed recipients + freemail reply-to

0.0 FILL_THIS_FORM Fill in a form with personal information

0.0 MONEY_FORM Lots of money if you fill out a form

3.1 MONEY_FRAUD_3 Lots of money and several fraud phrases

2.6 UNDISC_MONEY Undisclosed recipients + money/fraud signs

Subject: {SPAM?} Global Recovery & Assistance Program

WEb/SEO/App spam from Microsoft Outlook Part 2

Content-Type: multipart/alternative;

boundary="_000_TYSPR01MB635814C750405026C09127B6D3E12TYSPR01MB6358apcp_"

MIME-Version: 1.0

X-OriginatorOrg: outlook.com

X-MS-Exchange-CrossTenant-AuthAs: Internal

X-MS-Exchange-CrossTenant-AuthSource: TYSPR01MB6358.apcprd01.prod.exchangelabs.com

X-MS-Exchange-CrossTenant-RMS-PersistedConsumerOrg: 00000000-0000-0000-0000-000000000000

X-MS-Exchange-CrossTenant-Network-Message-Id: 65e106b1-6548-4b04-2ed0-08decec05339

X-MS-Exchange-CrossTenant-originalarrivaltime: 20 Jun 2026 11:37:35.8155

(UTC)

X-MS-Exchange-CrossTenant-fromentityheader: Hosted

X-MS-Exchange-CrossTenant-id: 84df9e7f-e9f6-40af-b435-aaaaaaaaaaaa

X-MS-Exchange-CrossTenant-rms-persistedconsumerorg: 00000000-0000-0000-0000-000000000000

X-MS-Exchange-Transport-CrossTenantHeadersStamped: TY1PPFB7F81CC49



--_000_TYSPR01MB635814C750405026C09127B6D3E12TYSPR01MB6358apcp_

Content-Type: text/plain; charset="Windows-1252"

Content-Transfer-Encoding: quoted-printable



Hi



Your site looks good, but it=92s not ranking.



I=92ll sort it out and place it on Google=92s 1st page.



May I share price & quotation with you.



Thanks,



--_000_TYSPR01MB635814C750405026C09127B6D3E12TYSPR01MB6358apcp_

Content-Type: text/html; charset="Windows-1252"

Content-Transfer-Encoding: quoted-printable








252">








_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb=

(0, 0, 0);">

Hi



_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb=

(0, 0, 0);">







_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb=

(0, 0, 0);">

Your site looks good, but it=92s not ranking.



_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb=

(0, 0, 0);">







_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb=

(0, 0, 0);">

I=92ll sort it out and place it on Google=92s 1st page.



_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb=

(0, 0, 0);">







_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb=

(0, 0, 0);">

May I share price & quotation with you.



_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb=

(0, 0, 0);">







_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb=

(0, 0, 0);">

Thanks,








--_000_TYSPR01MB635814C750405026C09127B6D3E12TYSPR01MB6358apcp_--