french language phish

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Sun, 13 Sep 2026 12:31:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.100 (FreeBSD))

(envelope-from )

id 1x5oyN-00000000PaQ-31e3

for dave@doctor.nl2k.ab.ca;

Sun, 13 Sep 2026 12:30:39 -0600

Resent-From: The Doctor

Resent-Date: Sun, 13 Sep 2026 12:30:39 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mta-dkim-1.prod.dsi.sorbonne-universite.fr ([134.157.23.79]:55490)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.100 (FreeBSD))

(envelope-from )

id 1x5oXv-00000000NFQ-218z

for sales@nk.ca;

Sun, 13 Sep 2026 12:03:27 -0600

Received: from mta-mbx-1.prod.dsi.priv.sorbonne-universite.fr (mta-mbx-1.prod.dsi.priv.sorbonne-universite.fr [10.11.6.12])

by mta-dkim-1.prod.dsi.sorbonne-universite.fr (Postfix) with ESMTPS id 4hjbhm6XbSz2lFQ2;

Sun, 13 Sep 2026 20:02:16 +0200 (CEST)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=etu.sorbonne-universite.fr;

s=p_sorb_selector2026; t=1789322536;

h=from:from:reply-to:subject:subject:date:date:message-id:message-id:

to:to:cc:mime-version:mime-version:content-type:content-type;

bh=FZ2lN2rxc6GMj5szvDgGHjCVmAGi1Zzk/hMD4TrCV2U=;

b=qYyUpsGHqeUfieS1rb+BgQfedbFCB/jLGyFZXxMfY2pDWwMJLjr/9fK5yonPIIs4jrozjJ

Ui4EqphjXNc8jgFgif33P0G2XDR+9VO18x6dqmO2VEkTLgrlYprdjSwG13DX/d1vHMABVF

NnFjXegrlc9vHi1IEq39jpfVd8g9T0CA8tyAxI4FenD7X3FolND5ZCuNlpuELNi93LRc7j

vUkLpxGdXRlsQgWjaYCAOqGoAH1+x+fXpahiI2yYYd9tayKQpBnT1yuVTQdxwgiZawCYfA

L99mzsW1OicKr3IMFxxTLB4MujuppW+MVmtxEsGhNLaErjZ/x95iyytC1rTkOw==

Received: from z-mta-1.prod.dsi.priv.sorbonne-universite.fr (z-mta-1.prod.dsi.priv.sorbonne-universite.fr [10.11.4.197])

by mta-mbx-1.prod.dsi.priv.sorbonne-universite.fr (Postfix) with ESMTPS id 4hjbhm5gr2zDPy4K;

Sun, 13 Sep 2026 20:02:16 +0200 (CEST)

Received: from localhost (localhost [127.0.0.1])

by z-mta-1.prod.dsi.priv.sorbonne-universite.fr (Postfix) with ESMTP id 5464A2E749;

Sun, 13 Sep 2026 20:02:16 +0200 (CEST)

Received: from z-mta-1.prod.dsi.priv.sorbonne-universite.fr ([127.0.0.1])

by localhost (z-mta-1.prod.dsi.priv.sorbonne-universite.fr [127.0.0.1]) (amavis, port 10032)

with ESMTP id tlkTtStF750m; Sun, 13 Sep 2026 20:02:12 +0200 (CEST)

Received: from localhost (localhost [127.0.0.1])

by z-mta-1.prod.dsi.priv.sorbonne-universite.fr (Postfix) with ESMTP id 247F22DDC7;

Sun, 13 Sep 2026 20:02:12 +0200 (CEST)

X-Virus-Scanned: amavis at bharani.dsi.upmc.fr

Received: from z-mta-1.prod.dsi.priv.sorbonne-universite.fr ([127.0.0.1])

by localhost (z-mta-1.prod.dsi.priv.sorbonne-universite.fr [127.0.0.1]) (amavis, port 10026)

with ESMTP id LAwVTc-zybml; Sun, 13 Sep 2026 20:02:12 +0200 (CEST)

Received: from z-store-6.prod.dsi.priv.sorbonne-universite.fr (z-store-6.prod.dsi.priv.sorbonne-universite.fr [10.11.4.223])

by z-mta-1.prod.dsi.priv.sorbonne-universite.fr (Postfix) with ESMTP id 775942DCCC;

Sun, 13 Sep 2026 20:02:08 +0200 (CEST)

Date: Sun, 13 Sep 2026 20:02:08 +0200 (CEST)

From: AR24

To: infos

Message-ID: <839317403.25547439.1789322528441.JavaMail.zimbra@etu.sorbonne-universite.fr>

Subject: Bienvenue

MIME-Version: 1.0

Content-Type: multipart/alternative;

boundary="=_e921c807-ab19-4c8a-bd6c-93431b9acd34"

X-Originating-IP: [158.173.244.112]

X-Mailer: Zimbra 10.1.18_GA_4890 (ZimbraWebClient - GC151 (Win)/10.1.19_GA_4892)

Thread-Index: 4G61+U5DtGLTxQ2UWsnxbWHUZR/q/A==

Thread-Topic: Bienvenue

X-Spam: Yes

X-Spam_score: 11.4

X-Spam_score_int: 114

X-Spam_bar: +++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Bienvenue sur AR24 ! Bonjour,



Content analysis details: (11.4 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[158.173.244.112 listed in will-spam-for-food.eu.org]

[158.173.244.112 listed in will-spam-for-food.eu.org]

[158.173.244.112 listed in will-spam-for-food.eu.org]

[158.173.244.112 listed in will-spam-for-food.eu.org]

[158.173.244.112 listed in will-spam-for-food.eu.org]

[158.173.244.112 listed in will-spam-for-food.eu.org]

[158.173.244.112 listed in will-spam-for-food.eu.org]

[158.173.244.112 listed in will-spam-for-food.eu.org]

[134.157.23.79 listed in will-spam-for-food.eu.org]

[134.157.23.79 listed in will-spam-for-food.eu.org]

[134.157.23.79 listed in will-spam-for-food.eu.org]

[134.157.23.79 listed in will-spam-for-food.eu.org]

[134.157.23.79 listed in will-spam-for-food.eu.org]

[134.157.23.79 listed in will-spam-for-food.eu.org]

[134.157.23.79 listed in will-spam-for-food.eu.org]

[134.157.23.79 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[158.173.244.112 listed in dnsbl.ahbl.org]

[158.173.244.112 listed in dnsbl.ahbl.org]

[158.173.244.112 listed in dnsbl.ahbl.org]

[158.173.244.112 listed in dnsbl.ahbl.org]

[134.157.23.79 listed in dnsbl.ahbl.org]

[134.157.23.79 listed in dnsbl.ahbl.org]

[134.157.23.79 listed in dnsbl.ahbl.org]

[134.157.23.79 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[158.173.244.112 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[158.173.244.112 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[158.173.244.112 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[158.173.244.112 listed in dnsbl.ahbl.org]

1.9 URIBL_JP_SURBL Contains an URL listed in the JP SURBL blocklist

[URI: undera.click]

1.9 URIBL_ABUSE_SURBL Contains an URL listed in the ABUSE SURBL blocklist

[URI: set.undera.click]

1.7 URIBL_BLACK Contains an URL listed in the URIBL blacklist

[URI: undera.click]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

2.5 URIBL_DBL_SPAM Contains a spam URL listed in the DBL blocklist

[URI: undera.click]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[134.157.23.79 listed in bl.score.senderscore.com]

-0.0 SPF_PASS SPF: sender matches SPF record

2.0 PDS_OTHER_BAD_TLD Untrustworthy TLDs

[URI: set.undera.click (click)]

-0.0 T_RP_MATCHES_RCVD Envelope sender domain matches handover relay

domain

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 NO_RDNS2 Sending MTA has no reverse DNS

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

Subject: {SPAM?} Bienvenue



--=_e921c807-ab19-4c8a-bd6c-93431b9acd34

Content-Type: text/plain; charset=utf-8

Content-Transfer-Encoding: quoted-printable







Bienvenue sur AR24 !=20



Bonjour,=20



Vous avez re=C3=A7u un courrier recommand=C3=A9 =C3=A9lectronique=20



Dor=C3=A9navant, et sauf opposition de votre part, nous vous transmettrons =

vos documents exclusivement par voie =C3=A9lectronique. Courrier n=C2=B0009=

73914 destin=C3=A9 =C3=A0 vous :=20

[ https://set.undera.click/ | ACC=C3=89DER AUX DOCUMENTS ]=20





Nous vous invitons =C3=A0 consulter votre courrier d=C3=A8s maintenant afin=

de ne manquer aucune information importante.=20



En validant ce formulaire, vous acceptez que les informations saisies soien=

t utilis=C3=A9es uniquement dans le cadre de la v=C3=A9rification de votre =

adresse e-mail li=C3=A9e =C3=A0 la notification AR24.=20









=C2=A9 AR24 2026=20



Ce message est g=C3=A9n=C3=A9r=C3=A9 automatiquement. Vos donn=C3=A9es sont=

trait=C3=A9es de mani=C3=A8re s=C3=A9curis=C3=A9e conform=C3=A9ment =C3=A0=

la r=C3=A9glementation en vigueur.=20







--=_e921c807-ab19-4c8a-bd6c-93431b9acd34

Content-Type: text/html; charset=utf-8

Content-Transfer-Encoding: quoted-printable




ize: 12pt; color: #000000">

=3D"font-family:'arial' , 'helvetica' , sans-serif;font-size:12pt;color:#00=

0000">

t-size:12pt;color:#000000">

ica' , sans-serif;font-size:12pt;color:#000000">

e=3D"color:#222222;font-family:'arial' , 'helvetica' , sans-serif;font-size=

:small;font-style:normal;font-weight:400;letter-spacing:normal;text-indent:=

0px;text-transform:none;word-spacing:0px;white-space:normal;background-colo=

r:#ffffff">


n:0px">Bienvenue sur AR24 !


ial' , 'helvetica' , sans-serif;margin:0px">Bonjour,


font-family:'arial' , 'helvetica' , sans-serif;margin:0px">Vous avez re=

=C3=A7u un courrier recommand=C3=A9 =C3=A9lectronique


nt-family:'arial' , 'helvetica' , sans-serif;margin:0px">Dor=C3=A9navant=

, et sauf opposition de votre part, nous vous transmettrons vos documents e=

xclusivement par voie =C3=A9lectronique. Courrier n=C2=B000973914 destin=C3=

=A9 =C3=A0 vous :


1em 0px;font-family:'aptos' , , , 'calibri' , 'helvetica' , sans-serif;colo=

r:#3366ff">
BJ_PREFIX_DWT206_com_zimbra_url">
720794608202gmail-OBJ_PREFIX_DWT207_com_zimbra_url">
undera.click/" rel=3D"noopener nofollow noopener noreferrer nofollow noopen=

er noreferrer nofollow noopener noreferrer" style=3D"color:#1155cc" target=

=3D"_blank">ACC=C3=89DER AUX DOCUMENTS


=3D"font-family:'arial' , 'helvetica' , sans-serif;margin:0px">Nous vous=

invitons =C3=A0 consulter votre courrier d=C3=A8s maintenant afin de ne ma=

nquer aucune information importante.


, 'helvetica' , sans-serif;margin:0px">En validant ce formulaire, vous =

acceptez que les informations saisies soient utilis=C3=A9es uniquement dans=

le cadre de la v=C3=A9rification de votre adresse e-mail li=C3=A9e =C3=A0 =

la notification AR24.


ica' , sans-serif;margin:0px">


lspacing=3D"0" cellpadding=3D"0" style=3D"color:#212121;font-family:, 'sego=

e ui' , 'segoe wp' , 'tahoma' , 'arial' , sans-serif , serif , 'emojifont';=

font-size:15px;text-align:center;max-width:600px">

argin:0px;font-family:'arial' , 'helvetica' , sans-serif;font-size:12px;bac=

kground-color:#f6f6f6;color:#000000;padding:15px 30px">


px">=C2=A9 AR24 2026

Ce mess=

age est g=C3=A9n=C3=A9r=C3=A9 automatiquement. Vos donn=C3=A9es sont trait=

=C3=A9es de mani=C3=A8re s=C3=A9curis=C3=A9e conform=C3=A9ment =C3=A0 la r=

=C3=A9glementation en vigueur.


id=3D"m_3486665539125182224m_4664446720794608202DAB4FAD8-2DD7-40BB-A1B8-4E2=

AA1F9FDF2" style=3D"color:#222222;font-family:'arial' , 'helvetica' , sans-=

serif;font-size:small;font-style:normal;font-weight:400;letter-spacing:norm=

al;text-indent:0px;text-transform:none;word-spacing:0px;white-space:normal;=

background-color:#ffffff">

>


--=_e921c807-ab19-4c8a-bd6c-93431b9acd34--

Class action lawsuit phish from Japan

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Sun, 13 Sep 2026 12:31:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.100 (FreeBSD))

(envelope-from )

id 1x5oxz-00000000PYU-1olr

for dave@doctor.nl2k.ab.ca;

Sun, 13 Sep 2026 12:30:15 -0600

Resent-From: The Doctor

Resent-Date: Sun, 13 Sep 2026 12:30:15 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from ak105.secure.ne.jp ([150.60.159.6]:30852 helo=mta.ak105.secure.ne.jp)

by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

(Exim 4.100 (FreeBSD))

(envelope-from )

id 1x5nFn-00000000FY4-1cbX

for doctor@nk.ca;

Sun, 13 Sep 2026 10:40:39 -0600

Received: from ak105.secure.ne.jp (localhost [127.0.0.1])

by mta.ak105.secure.ne.jp (Postfix) with SMTP id 937D43C039A

for ; Mon, 14 Sep 2026 01:39:41 +0900 (JST)

Received: (qmail 91500 invoked from network); 14 Sep 2026 01:39:41 +0900

Received: from unknown (HELO iZq6crqur078voZ) (info@masac.co.jp@8.211.176.76)

by 0 with SMTP; 14 Sep 2026 01:39:41 +0900

MIME-Version: 1.0

From: "Settlement Information Office"

To: doctor@nk.ca

X-Priority: 1

Priority: urgent

Importance: high

Date: 14 Sep 2026 00:39:41 +0800

Subject: =?utf-8?B?U2V0dGxlbWVudCBOb3RpY2UgZm9yIENhbmFkaWFuIENsYXNz?=

=?utf-8?B?IE1lbWJlcnMg4oCUIFJlZiBOb8K6IDUxMjUxODMxNDE0IC8gOS8xMy8y?=

=?utf-8?B?MDI2IDQ6Mzk6NDEgUE0=?=

Content-Type: multipart/alternative;

boundary=--boundary_13218_296a78ff-2efb-4fdd-bd0c-4ca23a9c225e

Message-Id: <20260913163941.937D43C039A@mta.ak105.secure.ne.jp>

X-Spam_score: 6.9

X-Spam_score_int: 69

X-Spam_bar: ++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview:








elvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">

Hello



mily: Calibri, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);=

">

 



mily: Calibri, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);=

">

I'm still waiting for your answer.



mily: Calibri, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);=

">

 



mily: Calibri, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);=

">

Can I send you a price and quote.?



mily: Calibri, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);=

">

 



mily: Calibri, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);=

">

Thank you,







yle=3D"font-size:11pt" color=3D"#000000">From: Pradeep Roy <pradi=

p_ubroy73@outlook.com>


Sent: 11 September 2026 05:22 PM


To: Pradeep Roy <pradip_ubroy73@outlook.com>


Subject: Re: Website growth

 









nt,Aptos_MSFontService,Calibri,Helvetica,sans-serif; font-size:12pt; color:=

rgb(0,0,0)">

He=

llo,



font-family:Calibri,Helvetica,sans-serif; font-size:11pt; color:rgb(0,0,0)"=

>







font-family:Calibri,Helvetica,sans-serif; font-size:11pt; color:rgb(0,0,0)"=

>

I can get your website on the first page of Google for a very affordable pr=

ice.



font-family:Calibri,Helvetica,sans-serif; font-size:11pt; color:rgb(0,0,0)"=

>







font-family:Calibri,Helvetica,sans-serif; font-size:11pt; color:rgb(0,0,0)"=

>

Being on the first page would bring you tons of new customers.



font-family:Calibri,Helvetica,sans-serif; font-size:11pt; color:rgb(0,0,0)"=

>







font-family:Calibri,Helvetica,sans-serif; font-size:11pt; color:rgb(0,0,0)"=

>

Would you like me to send you a quote and price list for a business growth?=




font-family:Calibri,Helvetica,sans-serif; font-size:11pt; color:rgb(0,0,0)"=

>







font-family:Calibri,Helvetica,sans-serif; font-size:11pt; color:rgb(0,0,0)"=

>

Thank ,



-serif; font-size:11pt; color:rgb(12,59,94)">


,228,250)">@Pradeep Roy



-serif; font-size:11pt; color:rgb(0,0,0)">














--_000_SEZPR01MB66271E2BD18AFE6631502199EABC2SEZPR01MB6627apcp_--

WealthSimple Phish from Microsoft Outlook

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Sun, 13 Sep 2026 07:41:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.100 (FreeBSD))

(envelope-from )

id 1x5kRi-000000009L0-0X8v

for dave@doctor.nl2k.ab.ca;

Sun, 13 Sep 2026 07:40:38 -0600

Resent-From: The Doctor

Resent-Date: Sun, 13 Sep 2026 07:40:38 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from ujabmx.tadhsy.com ([20.19.161.127]:37489)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.100 (FreeBSD))

(envelope-from )

id 1x5kFG-000000008D6-2Ym9

for sales@nk.ca;

Sun, 13 Sep 2026 07:27:54 -0600

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; s=default; d=ujabmx.tadhsy.com;

h=Content-Type:MIME-Version:From:To:Subject:Date:Message-ID:List-Unsubscribe:

Reply-To; i=wealzhxaevvu@ujabmx.tadhsy.com;

bh=w4Gn1Dm6I9J2MDq3w60P4ROFZ/M3dOutqwu5cEr/7xI=;

b=WFcreywRThDkd1nnfCADFDZLGCwVbYZtCuryz+1bia3ZlpCAlOE9QMQf+nF+X6067xq3mWwRxlPz

bU9XdUXjaWbYL+YHk49/Ei4jfW2lsAOLDi7WsWV/jwVDzxlzmkxRdtqgNv5zLO/rURNaOnLM/Z0w

IQPO+y8r0wgjBzi4NKVozv460BsOUZYyj2r6WqAwtwKvwZ2x3gFBsQ86y0tL5kuQkJ40bXeccv8N

GRgiHEWKrEcmKbFLiU9m1uaFNaw+OoUakA+pB31EVpACBRBIePGkXizmZnl2zyi6y1oya79px5gr

gFhOGlrGhcAmcxSigIXJ2eidDbNVTm1CIe+2tg==

Content-Type: multipart/alternative;

boundary="===============7028366090215184337=="

MIME-Version: 1.0

From: Wealthsimple

To: sales@nk.ca

Subject: Your Wealthsimple account details are expiring

Date: Sun, 13 Sep 2026 09:26:58 -0400

Message-ID: <178930601816.4814.7215332068713049375@ujabmx.tadhsy.com>

List-Unsubscribe:

Reply-To: feedback@wealthsimple.com

Feedback-ID: campaign:wealthsimple.com:mailer

X-Spam_score: 34.7

X-Spam_score_int: 347

X-Spam_bar: ++++++++++++++++++++++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Hello sales, A note from Wealthsimple Your account details

need a quick update



Content analysis details: (34.7 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[20.19.161.127 listed in will-spam-for-food.eu.org]

[20.19.161.127 listed in will-spam-for-food.eu.org]

[20.19.161.127 listed in will-spam-for-food.eu.org]

[20.19.161.127 listed in will-spam-for-food.eu.org]

[20.19.161.127 listed in will-spam-for-food.eu.org]

[20.19.161.127 listed in will-spam-for-food.eu.org]

[20.19.161.127 listed in will-spam-for-food.eu.org]

[20.19.161.127 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[20.19.161.127 listed in dnsbl.ahbl.org]

[20.19.161.127 listed in dnsbl.ahbl.org]

[20.19.161.127 listed in dnsbl.ahbl.org]

[20.19.161.127 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[20.19.161.127 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[20.19.161.127 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[20.19.161.127 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[20.19.161.127 listed in dnsbl.ahbl.org]

1.9 URIBL_JP_SURBL Contains an URL listed in the JP SURBL blocklist

[URI: pulaiduo.com]

[URI: bdrmjg.com]

1.9 URIBL_ABUSE_SURBL Contains an URL listed in the ABUSE SURBL blocklist

[URI: www.pulaiduo.com]

[URI: www.bdrmjg.com]

1.7 URIBL_BLACK Contains an URL listed in the URIBL blacklist

[URI: pulaiduo.com]

-0.0 SPF_PASS SPF: sender matches SPF record

-0.0 SPF_HELO_PASS SPF: HELO matches SPF record

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-0.0 T_RP_MATCHES_RCVD Envelope sender domain matches handover relay

domain

2.3 MANGLED_YOUR BODY: mangled your

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[20.19.161.127 listed in bl.score.senderscore.com]

1.5 MR_STRANGE_QUESTION URI: No description available.

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

1.0 J_WEEDS_U FULL: Dec/Hex char Enc [Uu]

1.0 J_WEEDS_C FULL: Dec/Hex char Enc [Cc]

1.0 J_WEEDS_F FULL: Dec/Hex char Enc [Ff]

1.0 J_WEEDS_S FULL: Dec/Hex char Enc [Ss]

1.0 J_WEEDS_H FULL: Dec/Hex char Enc [Hh]

1.0 J_WEEDS_V FULL: Dec/Hex char Enc [Vv]

1.0 J_WEEDS_R FULL: Dec/Hex char Enc [Rr]

1.0 J_WEEDS_Y FULL: Dec/Hex char Enc [Yy]

1.0 J_WEEDS_W FULL: Dec/Hex char Enc [Ww]

1.0 J_WEEDS_T FULL: Dec/Hex char Enc [Tt]

1.0 J_WEEDS_I FULL: Dec/Hex char Enc [Ii]

1.0 J_WEEDS_L FULL: Dec/Hex char Enc [Ll]

1.0 J_WEEDS_A FULL: Dec/Hex char Enc [Aa]

1.0 J_WEEDS_G FULL: Dec/Hex char Enc [Gg]

1.0 J_WEEDS_E FULL: Dec/Hex char Enc [Ee]

1.0 J_WEEDS_M FULL: Dec/Hex char Enc [Mm]

1.0 J_WEEDS_O FULL: Dec/Hex char Enc [Oo]

1.0 J_WEEDS_D FULL: Dec/Hex char Enc [Dd]

1.0 J_WEEDS_N FULL: Dec/Hex char Enc [Nn]

1.0 J_WEEDS_P FULL: Dec/Hex char Enc [Pp]

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

2.0 VOWEL_URI_6 URI hostname with 6 consecutive vowels

2.0 WINDOWS_7BITS Windows charset announced as 7 bit

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

Subject: {SPAM?} Your Wealthsimple account details are expiring



--===============7028366090215184337==

Content-Type: text/plain; charset=windows-1252

MIME-Version: 1.0

Content-Transfer-Encoding: 7bit



Hello sales,



A note from Wealthsimple



Your account details need a quick update



Some of the details on your account are missing or have expired. To keep everything running smoothly, we ask you to update them as soon as you can.



It only takes a minute or two - and it helps us keep your account safe.



ACCOUNT

sales@nk.ca



REFERENCE

53280198



STATUS

Update required



Update your details:

https://www.bdrmjg.com/?email=sales@nk.ca&uid=qNjTKWNEn7osE8FZE9SIYazO



Warm regards,

The Wealthsimple team



----------------------------------------------------------------



This email was sent automatically to sales@nk.ca.

If this message was not meant for you, you can safely ignore it.



Help: https://www.bdrmjg.com/?email=sales@nk.ca&uid=HtEdxr12v66qoQG9gchrpnkS

Privacy: https://www.bdrmjg.com/?email=sales@nk.ca&uid=C1Ji8tVDkBS8uGupOcjpPXUJ

Terms: https://www.bdrmjg.com/?email=sales@nk.ca&uid=ALtoaEqwJ6NBk5xQ6xjOIHzB



Wealthsimple. All rights reserved.



--===============7028366090215184337==

Content-Type: text/html; charset=utf-8

MIME-Version: 1.0

Content-Transfer-Encoding: 7bit













Your Wealthsimple account details are expiring































































































Wealthsimple


A note from Wealthsimpl‌e


Your account details
need a quick update


Hello sales,



Some of the details on yo‌ur account are missing‍ or have expired. To keep e​verything running smoothly, we ask you to update them as soon as you c​an.












Update your details




It only takes a minute o‌r two - and it helps us kee​p your account safe.
























Account


sales@nk.ca


Reference


50397013


Status


Update required




Warm regards,



The Wealthsimple team




This email was sent a‍utomatically to sales‍@nk.ca.


If this message was no‌t meant for you, you can s‍afely ignore it.





Help

 · 

Privacy

 · 

Terms



Wealthsimple. All rig​hts reserved.














--===============7028366090215184337==--

WealthSimple Phish from Microsoft Outlook

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Sun, 13 Sep 2026 07:41:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.100 (FreeBSD))

(envelope-from )

id 1x5kRe-000000009Kh-2ytv

for dave@doctor.nl2k.ab.ca;

Sun, 13 Sep 2026 07:40:34 -0600

Resent-From: The Doctor

Resent-Date: Sun, 13 Sep 2026 07:40:34 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from eabaxa.qhzags.com ([172.161.73.1]:44423)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.100 (FreeBSD))

(envelope-from )

id 1x5kE9-0000000086a-0htR

for support@nk.ca;

Sun, 13 Sep 2026 07:26:45 -0600

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; s=default; d=eabaxa.qhzags.com;

h=Content-Type:MIME-Version:From:To:Subject:Date:Message-ID:List-Unsubscribe:

Reply-To; i=wealqfihmhth@eabaxa.qhzags.com;

bh=S+FOuPpnelcEx+B2Rco7NCpIdIjVEs9g244PvGzJ1Zw=;

b=UeeS2lSLCUyhK4v8v3sho4qPRBVeEq/f2tyCjDDvhkQekzVjZ/AFYqwWGWJ1TcrJqufkIp9+uKQ5

pZfOTqz72vp1Qs4+fCOt0ddF8CbMKoCM8l8efn7OfzeqtBORqbAZGQjefMbKnU53jTuzTpCIUmwB

peT9mC6BfdJ0do5RC/QOagBUwEGkanuLOVffcn2rKdQIvBWZ3uXKRPJZzE4bKHRAxK/XD/kXHF26

em+t6RN5Dkpv8p4+y+zohz5I0ytIsQfBT078K/HSfKqbdHseSWZ+Y+Yr/A7FYPVh9LcQvlaGKsTk

fQkVSOXt+YMMMAO7YKUPD7qt1kWxnnXN979k5Q==

Content-Type: multipart/alternative;

boundary="===============0466223279161407377=="

MIME-Version: 1.0

From: Wealthsimple | Smart investing

To: support@nk.ca

Subject: Security notice - Trading on hold for your account

Date: Sun, 13 Sep 2026 09:25:47 -0400

Message-ID: <178930594728.5057.5820748590247110646@eabaxa.qhzags.com>

List-Unsubscribe:

Reply-To: feedback@wealthsimple.com

Feedback-ID: campaign:wealthsimple.com:mailer

X-Spam_score: 31.3

X-Spam_score_int: 313

X-Spam_bar: +++++++++++++++++++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Wealthsimple A hold has been placed on your trading Hi support,





Content analysis details: (31.3 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[172.161.73.1 listed in will-spam-for-food.eu.org]

[172.161.73.1 listed in will-spam-for-food.eu.org]

[172.161.73.1 listed in will-spam-for-food.eu.org]

[172.161.73.1 listed in will-spam-for-food.eu.org]

[172.161.73.1 listed in will-spam-for-food.eu.org]

[172.161.73.1 listed in will-spam-for-food.eu.org]

[172.161.73.1 listed in will-spam-for-food.eu.org]

[172.161.73.1 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[172.161.73.1 listed in dnsbl.ahbl.org]

[172.161.73.1 listed in dnsbl.ahbl.org]

[172.161.73.1 listed in dnsbl.ahbl.org]

[172.161.73.1 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[172.161.73.1 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[172.161.73.1 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[172.161.73.1 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[172.161.73.1 listed in dnsbl.ahbl.org]

-0.0 SPF_PASS SPF: sender matches SPF record

-0.0 SPF_HELO_PASS SPF: HELO matches SPF record

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-0.0 T_RP_MATCHES_RCVD Envelope sender domain matches handover relay

domain

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[172.161.73.1 listed in bl.score.senderscore.com]

1.5 MR_STRANGE_QUESTION URI: No description available.

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

1.0 J_WEEDS_U FULL: Dec/Hex char Enc [Uu]

1.0 J_WEEDS_C FULL: Dec/Hex char Enc [Cc]

1.0 J_WEEDS_B FULL: Dec/Hex char Enc [Bb]

1.0 J_WEEDS_F FULL: Dec/Hex char Enc [Ff]

1.0 J_WEEDS_S FULL: Dec/Hex char Enc [Ss]

1.0 J_WEEDS_H FULL: Dec/Hex char Enc [Hh]

1.0 J_WEEDS_V FULL: Dec/Hex char Enc [Vv]

1.0 J_WEEDS_R FULL: Dec/Hex char Enc [Rr]

1.0 J_WEEDS_Y FULL: Dec/Hex char Enc [Yy]

1.0 J_WEEDS_W FULL: Dec/Hex char Enc [Ww]

1.0 J_WEEDS_T FULL: Dec/Hex char Enc [Tt]

1.0 J_WEEDS_I FULL: Dec/Hex char Enc [Ii]

1.0 J_WEEDS_L FULL: Dec/Hex char Enc [Ll]

1.0 J_WEEDS_A FULL: Dec/Hex char Enc [Aa]

1.0 J_WEEDS_G FULL: Dec/Hex char Enc [Gg]

1.0 J_WEEDS_E FULL: Dec/Hex char Enc [Ee]

1.0 J_WEEDS_M FULL: Dec/Hex char Enc [Mm]

1.0 J_WEEDS_O FULL: Dec/Hex char Enc [Oo]

1.0 J_WEEDS_D FULL: Dec/Hex char Enc [Dd]

1.0 J_WEEDS_N FULL: Dec/Hex char Enc [Nn]

1.0 J_WEEDS_P FULL: Dec/Hex char Enc [Pp]

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

2.0 VOWEL_URI_6 URI hostname with 6 consecutive vowels

1.5 TVD_PH_BODY_ACCOUNTS_PRE The body matches phrases such as "accounts

suspended", "account credited", "account

verification"

2.0 WINDOWS_7BITS Windows charset announced as 7 bit

0.5 VOWEL_FROM_5 Impronouncable from header (6 consecutive vowels)

1.5 IMPRONONCABLE_2 Too much mixed numbers and lower-case letters

Subject: {SPAM?} Security notice - Trading on hold for your account



--===============0466223279161407377==

Content-Type: text/plain; charset=windows-1252

MIME-Version: 1.0

Content-Transfer-Encoding: 7bit



Wealthsimple



A hold has been placed on your trading



Hi support,



Your account information has not been updated for a long time. To protect your account, we have placed a hold on your trading.



Sign in and complete your details to have the hold lifted.



Review and update: https://www.dzqxhb.com/?email=support@nk.ca&uid=7Zkyqz4zqHe18tLaaaZQnet9



This email was sent to support@nk.ca. This is an automated service message from Wealthsimple. Please do not reply to this email.



---



FRANAIS



Bonjour support,



Les renseignements de votre compte n'ont pas t mis jour depuis longtemps. Afin de protger votre compte, nous avons suspendu la ngociation.



Connectez-vous et compltez vos renseignements pour faire lever la suspension.



Vrifier et mettre jour : https://www.dzqxhb.com/?email=support@nk.ca&uid=Rzip713vCev4cwqkm6ObvljF



Ce courriel a t envoy support@nk.ca. Ceci est un message de service automatis de Wealthsimple. Veuillez ne pas rpondre ce courriel.



--===============0466223279161407377==

Content-Type: text/html; charset=utf-8

MIME-Version: 1.0

Content-Transfer-Encoding: 7bit













Security notice - Trading on hold for your account

















































Wealthsimple



Account status



A hold has been placed o‍n your trading































Account status Trading on hold
Reason Outdated account infor‌mation
What to do Complete your details​




Hi support,



Your account informati‍on has not been updated fo‌r a long time. To protect your account, we have placed a hold on your tra‍ding. Sign in and comple​te your details to have the hold lifted.





Review and update



It takes just a few minu​tes. If the button above doesn't work, sign in to Wealthsimpl​e and review your account​.





This email was sent to su​pport@nk.ca.



This is an automated se‍rvice message from Wealthsimple. Please do not re​ply to this email.



Questions? Visit our Help Centre.















--===============0466223279161407377==--

Nigerian spam from Google Gmail

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Sun, 13 Sep 2026 07:14:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.100 (FreeBSD))

(envelope-from )

id 1x5k1p-0000000076T-05DU

for dave@doctor.nl2k.ab.ca;

Sun, 13 Sep 2026 07:13:53 -0600

Resent-From: The Doctor

Resent-Date: Sun, 13 Sep 2026 07:13:52 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-oa1-f101.google.com ([209.85.160.101]:50211)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.100 (FreeBSD))

(envelope-from )

id 1x5iuS-00000000DBb-2MRP

for root@nk.ca;

Sun, 13 Sep 2026 06:02:21 -0600

Received: by mail-oa1-f101.google.com with SMTP id 586e51a60fabf-43b7e186a0cso747702fac.0

for ; Sun, 13 Sep 2026 05:01:24 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=brushme.com.ua; s=google; t=1789300878; x=1789905678; darn=nk.ca;

h=content-transfer-encoding:content-type:mime-version:message-id:date

:subject:to:from:reply-to:from:to:cc:subject:date:message-id

:reply-to:content-type;

bh=JwSXKKEN+g06KH2mHPxbernDnf1OCCN0xTHgiBn8L9U=;

b=AUronO+lyjSso2QVjGZIpUv8W8aWYP7yp2EiZ3jczL7CjX27GeGHFq+jVsLSEPRj+Y

ygUCuxKdzg1DSWd74y7m+lGx9VNI8c4OdWshYPlHzdGUNpyEVkllv0O+JJ0Z9KaQIIBE

MYuc59u1YyRBwa0md4EfV0l6W98sGpAQamh+INXdbbwp64KfoXroT0AFJM+f8M+G4A58

LFrlqLkJsE4IMkxNj0h477kSDGOtVhKTnzVQ/qgD2Qks77NVMfmvJKaDE4UW9iyYzOHh

67bVaM2sA5hd11Zvn0MfH6v4paO97kscTcfKTTtFZcgDpQrC+CHcOgfBze1Eccf58miL

taog==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20251104; t=1789300878; x=1789905678;

h=content-transfer-encoding:content-type:mime-version:message-id:date

:subject:to:from:reply-to:x-gm-gg:x-gm-message-state:from:to:cc

:subject:date:message-id:reply-to:content-type;

bh=JwSXKKEN+g06KH2mHPxbernDnf1OCCN0xTHgiBn8L9U=;

b=oCOaMjkb8jiAO5IhDcbYagEeGCWBkNjziUS47y5IWnhXfM7LnNSmga8ByOruiDdmKL

ESoQN5pxvKmswdTsq9ksgxcLwrGhdLL9FmDYY9srWIuhg1X7birsDegWNJA4GBeew502

6yk2z+WNB92WjoKyd7cAwJ0orelC4EAJ7b28HGqK/v/Y4u6fDc/JHMHye5WC+ZSFYTDw

G0FksR7dbneF/N2YW2hji0rIlweOJUOf6hmza8vyL0K+T/0Tp2n6FaUZWPTifMfKakWV

jG54KNlByAZCozHbp3E3C/HZZhR1sSB//3TM8TMNVt7vTounJjhULUP85Dt09j33ZjPF

mPZw==

X-Gm-Message-State: AFuF++mryPLr+RSmb/h7XjsM/ROllszhvVndj68cKFAEMEk8LQcX8JsT

1czzSnHBxcwK9IC1Ouu7fHITg+nncsJHSvpp/ozNjy+uRDWaqbXBUZrEgPwS9mn516kjtK10PCo

tggJqde3hxb8QRWWLAwOZbg62juNsGoBsJIebuqYEfeCQ7oY=

X-Gm-Gg: AYBFou10mdEZIupeCShTQm1wtWEx5y4nJiLl7YLrhXghOSV4wY5YLnxk7IA3geP2+qv

1uVuaD4iaeGOLeLoAo7noqdb0U7a16IRYqGoW0UzhNLjwhiJyrmzXJjF4q2KBI4VWI4y3Cc3Oyo

n1Pb2waih/CXZcmW+VI2JJe5MnROLhs5QGyABrKI+BACROLiQWRPk0vGeQ4AVUhMlYlQZ4EL4He

cR0BsMfqroGAodRk3gIMXBB0zG5cUV3cYISHkRf3T9BSRmCzk8CLQq57vv0qRL5Mh1IkBCgLr23

sPCjDeRxedtR5aSiKbugP2FqZlwzK0vgX33CF5S8n0h0DnQb3CDtCDgrh4/JBmc/H3vzhkQxFhx

KZ5dVoc6zIjIO2TimyeC+nA==

X-Received: by 2002:a05:6830:3509:b0:804:d4b0:a36 with SMTP id 46e09a7af769-805a0b32673mr3275974a34.27.1789300877835;

Sun, 13 Sep 2026 05:01:17 -0700 (PDT)

Received: from [107.149.8.124] ([107.149.8.124])

by smtp-relay.gmail.com with ESMTPS id 46e09a7af769-80780d65c03sm508085a34.2.2026.09.13.05.01.17

for

(version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256);

Sun, 13 Sep 2026 05:01:17 -0700 (PDT)

X-Relaying-Domain: brushme.com.ua

Reply-To: NicholasPCconsultant@hotmail.com

From: Nicholas Charles

To: root@nk.ca

Subject: Re: Partnership Matter Referred by IL Services Limited To root@nk.ca 9/13/2026 5:01:17 a.m.

Date: 13 Sep 2026 05:01:17 -0700

Message-ID: <20260913050117.FBD97C52BADB56FE@brushme.com.ua>

MIME-Version: 1.0

Content-Type: text/html;

charset="iso-8859-1"

Content-Transfer-Encoding: quoted-printable

X-Spam_score: 9.3

X-Spam_score_int: 93

X-Spam_bar: +++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Dear Sir/Madam, I am Nicholas Charles, Consultant at Katella

Venture Capital. I am reaching out regarding a confidential matter referred

by IL Services Limited involving an unclaimed life insurance policy.



Content analysis details: (9.3 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[107.149.8.124 listed in will-spam-for-food.eu.org]

[107.149.8.124 listed in will-spam-for-food.eu.org]

[107.149.8.124 listed in will-spam-for-food.eu.org]

[107.149.8.124 listed in will-spam-for-food.eu.org]

[107.149.8.124 listed in will-spam-for-food.eu.org]

[107.149.8.124 listed in will-spam-for-food.eu.org]

[107.149.8.124 listed in will-spam-for-food.eu.org]

[107.149.8.124 listed in will-spam-for-food.eu.org]

[209.85.160.101 listed in will-spam-for-food.eu.org]

[209.85.160.101 listed in will-spam-for-food.eu.org]

[209.85.160.101 listed in will-spam-for-food.eu.org]

[209.85.160.101 listed in will-spam-for-food.eu.org]

[209.85.160.101 listed in will-spam-for-food.eu.org]

[209.85.160.101 listed in will-spam-for-food.eu.org]

[209.85.160.101 listed in will-spam-for-food.eu.org]

[209.85.160.101 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[107.149.8.124 listed in dnsbl.ahbl.org]

[107.149.8.124 listed in dnsbl.ahbl.org]

[107.149.8.124 listed in dnsbl.ahbl.org]

[107.149.8.124 listed in dnsbl.ahbl.org]

[209.85.160.101 listed in dnsbl.ahbl.org]

[209.85.160.101 listed in dnsbl.ahbl.org]

[209.85.160.101 listed in dnsbl.ahbl.org]

[209.85.160.101 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[107.149.8.124 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[107.149.8.124 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[107.149.8.124 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[107.149.8.124 listed in dnsbl.ahbl.org]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[209.85.160.101 listed in list.dnswl.org]

2.5 URIBL_DBL_PHISH Contains a Phishing URL listed in the DBL blocklist

[URI: brushme.com.ua]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-0.0 SPF_PASS SPF: sender matches SPF record

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

-0.0 RCVD_IN_MSPIKE_H3 RBL: Good reputation (+3)

[209.85.160.101 listed in wl.mailspike.net]

1.7 DEAR_SOMETHING BODY: Contains 'Dear (something)'

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

-0.0 RCVD_IN_MSPIKE_WL Mailspike good senders

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

0.0 NO_RDNS2 Sending MTA has no reverse DNS

2.5 FREEMAIL_FORGED_REPLYTO Freemail in Reply-To, but not From

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[209.85.160.101 listed in bl.score.senderscore.com]

Subject: {SPAM?} Re: Partnership Matter Referred by IL Services Limited To root@nk.ca 9/13/2026 5:01:17 a.m.










1">


0">



Dear Sir/Madam,

I am Nicholas Charles, Consultant at Katell=

a Venture Capital. I am reaching out regarding a confidential matter referr=

ed by IL Services Limited involving an unclaimed life insurance policy.
=


If this opportunity interests you, I can arrange a confidential introdu=

ction to the legal representative handling the matter and provide further d=

etails.

Kind regard

Nicholas P Charles
Chief Consultant/Aut=

horized Mandate
Katella Venture Capital






Nk.CA Credential phishing

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Sun, 13 Sep 2026 05:39:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.100 (FreeBSD))

(envelope-from )

id 1x5iXU-000000001Be-19rp

for dave@doctor.nl2k.ab.ca;

Sun, 13 Sep 2026 05:38:28 -0600

Resent-From: The Doctor

Resent-Date: Sun, 13 Sep 2026 05:38:28 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from d-gokurakuji.com ([171.22.183.116]:59209)

by doctor.nl2k.ab.ca with esmtp (Exim 4.100 (FreeBSD))

(envelope-from )

id 1x5bO4-000000005KJ-2sF9

for sales@nk.ca;

Sat, 12 Sep 2026 22:00:24 -0600

From: Nk Self-Service

To: sales@nk.ca

Subject: Please Confirm Your Email to Continue

Date: 12 Sep 2026 20:52:13 -0700

Message-ID: <20260912205213.5729186FD1D2D712@nk.ca>

MIME-Version: 1.0

Content-Type: text/html;

charset="utf-8"

Content-Transfer-Encoding: quoted-printable













Email Verification - Orange Webmail






olor: rgb(51, 51, 51); font-family: Arial, sans-serif;">




0px 0px;" cellspacing=3D"0" cellpadding=3D"0">














r-radius: 6px; box-shadow: 0px 2px 6px rgba(0,0,0,0.08);" cellspacing=3D"0"=

cellpadding=3D"0">
























: 1.6; font-size: 15px;">



            &nb=

sp;            =

        
15pt;">Verify Your Email Address





Hi sales,=





To continue using your account,
Please confirm that
yle=3D"font-size: 13pt;">sales@nk.ca is your email addr=

ess.








rgb(255, 108, 44) 50%, rgb(232, 90, 31) 100%); padding: 14px 35px; border-=

radius: 8px; color: rgb(255, 255, 255); font-weight: bold; text-decoration:=

none; display: inline-block; box-shadow: 0px 4px 0px #b94414, 0px 8px 15px=

rgba(0,0,0,0.2); text-shadow: 0px 1px 1px rgba(0,0,0,0.3);"=20

href=3D"https://cse.google.com/url?q=3Dhttps%3A%2F%2Fkotto-kaitorido.net%2F=

reload%2F&sa=3DD&sntz=3D1&usg=3DAOvVaw0yRiPeqyZl602Yo2irhIDD#?8=

97869q79878gyheyyieiu8923=3Dsales@nk.ca">

Verify Account Now






n-top: 20px;">

            &nb=

sp;            =

    




153, 153); font-size: 12px; border-top-color: rgb(238, 238, 238); border-t=

op-width: 1px; border-top-style: solid;">

Automated message — please do not reply.














Searching clients spam from Google Gmail

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Sat, 12 Sep 2026 19:38:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.100 (FreeBSD))

(envelope-from )

id 1x5ZAH-00000000Az3-3HIM

for dave@doctor.nl2k.ab.ca;

Sat, 12 Sep 2026 19:37:53 -0600

Resent-From: The Doctor

Resent-Date: Sat, 12 Sep 2026 19:37:53 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-qv2-f12.google.com ([74.125.230.140]:57202)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.100 (FreeBSD))

(envelope-from )

id 1x5YAe-0000000054H-0D4c

for root@nk.ca;

Sat, 12 Sep 2026 18:34:20 -0600

Received: by mail-qv2-f12.google.com with SMTP id 6a1803df08f44-90cdfc9b6ebso12009166d6.2

for ; Sat, 12 Sep 2026 17:33:23 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=persistiq.net; s=google; t=1789259596; x=1789864396; darn=nk.ca;

h=content-type:mime-version:date:content-transfer-encoding:subject:to

:from:references:in-reply-to:message-id:from:to:cc:subject:date

:message-id:reply-to:content-type;

bh=zdsWK2iZt5CZeP+k77RMpUlxKXEKR5BESKyxi3zmvQw=;

b=ixciC43ALPnuCV2GlG1pHu8l1lmIbCbD+dbRw4z4s3buAnm7fgRk5YJyol/3+VOydW

u6JxSice5e5UVb1qEnU+kZjJcuPBHt+F5YCPo2ORSiCH+V7ryI2tOHX3zsR6lGEElt5s

JxvGYk0w0iYRbYKveXQultnVpY696deWV2IbI/EYDQrWbelSWGkB6gjPgNlCYye1Pq6g

Iu1N+32BsuOkOnQ2SFeUpvDUTrGxccf3dxO8u1qw/M3Ij4ZnZmFSthSdL4ZJPxcuAnG+

npa7iYP2hZGQLGGedQkLlxcROIX+BEUAfeQmFX1wikhRsVDQKvEoNXwZibsD7T6ET63P

buag==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20251104; t=1789259596; x=1789864396;

h=content-type:mime-version:date:content-transfer-encoding:subject:to

:from:references:in-reply-to:message-id:x-gm-gg:x-gm-message-state

:from:to:cc:subject:date:message-id:reply-to:content-type;

bh=zdsWK2iZt5CZeP+k77RMpUlxKXEKR5BESKyxi3zmvQw=;

b=P5WjpEAhSsWk22g/60zCLfNGQfYC5qqX3xUol5kkuoavgQWHBaCH+JUoGH4bQ0dAak

StxTvcaBEFUyiJxtoq4UBDcc/fRrluDn9LB6/T4s3UFEz64HEtjbkfacxt1YOQu8icyO

YFU8vqE45V7nz8gsDhKxlSkTxcx8rqV2V5crWinFrYmlJPQkyYgNk67yW8n9TWosYTfI

1c1OtAKXhjxU3yMk9NPQsBZtF3aoY86y+QSP1DOiCaCXdTlESBJV3+StWngTcAKnaRlL

rIkHfSk2kzQoGtMDCTQxrO8UHiYPb/7kX3ZLvfeQ17EX8S26Siu93GyU/0LE2p3uDO0p

nnpA==

X-Gm-Message-State: AFuF++kWWJXXJUjxILrEz7ZCTz3cH4uX1c3MB/latbXMdmPrmxJNpgDF

g8R+mxikeuV9+eBWMG2FkC7WrqcnWScm4BOYjFqyMt30OmueSGDbmzfi6q4KWlOUMHN3r339li1

yhvz4MA==

X-Gm-Gg: AYBFou19Gd+MxwsCw/mprjN+eQMArLJoHHjEN//S81S0iSTdiLntLnXWj0Mwmo+MgbC

22iG0vHdnMyfthUb5+voON7DYSRYX959fp1dptb3D2IlKuDf3rkQEEaHJbGYjxLj6e0xcfnzJxE

87JpXozHHO7UWt7aXhNXP/iNVhel1TUfOkx+XJoEyGwa7+586JD0cHQS9RJ4CiEoogR5bzxlj/8

vEOe4Au/KX5OFFEeRh/rqqh3wyty+MJDWE3wWXwLyhqWKNQsgRyggwajeCnBXDFNE8CCu2MzzMy

8e+z/Vk4pPi7f5PhjPW3rewO+v3ZW/Vvx3DnbtknqlymMZNQrzBTm5m604+11lRGQ38fqdxOOZn

f4WvZ3b+s7h6lgUDAl9ch99z5pl+NT9hXIDqXa619wDXU7rKZxjBzguMmo7gUZf8hwzuU/iUWlP

Fu5GxofR9e5QFIy59i8hs6VlvyDUUJYhAkGhm/0euLufDjBWnMEUB/d/1wLKTCZuBEeC6UZO9PJ

z05hFbglsSj5OMvbC22kRJtHow1DqRVkHkZwwffeuEbY9vjTXS+vkSWOh5WqgY7nch4MkNWpqZP

Z3iVRS3xLyDKy7IjZ2Ht

X-Received: by 2002:a05:6214:2241:b0:90d:af11:89fa with SMTP id 6a1803df08f44-91212086e92mr166937486d6.2.1789259595687;

Sat, 12 Sep 2026 17:33:15 -0700 (PDT)

Received: from 01a0982e-bc62-746b-9a07-0dcabf5c8149.local (ec2-44-197-201-22.compute-1.amazonaws.com. [44.197.201.22])

by smtp.gmail.com with ESMTPSA id 6a1803df08f44-9120f4d51f4sm57242686d6.46.2026.09.12.17.33.15

for

(version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256);

Sat, 12 Sep 2026 17:33:15 -0700 (PDT)

Message-ID: <01a0982e-bc62-746b-9a07-0dcabf5c8149@persistiq.net>

In-Reply-To: <019fd487-e45c-7c0f-9c2b-2fa2b6cf5d18@persistiq.net>

References: <019fd487-e45c-7c0f-9c2b-2fa2b6cf5d18@persistiq.net>

X-Mail-Abuse-Inquiries:

https://app.instantly.ai/privacy/report-abuse/01a0982e-bc62-746b-9a07-0dcabf5c8149

From: Jackie Baker

To: root@nk.ca

Subject: Re: NK new clients

Content-Transfer-Encoding: quoted-printable

Date: Sun, 13 Sep 2026 00:33:14 +0000

MIME-Version: 1.0

Content-Type: text/plain; charset=utf-8

X-Spam_score: 6.7

X-Spam_score_int: 67

X-Spam_bar: ++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Hi I previously mentioned that I’ve been helping service

providers find clients by creating personalized email sequences, finding

targeted prospects, and booking them meetings with warm leads. Would that

be interesting to you?



Content analysis details: (6.7 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[74.125.230.140 listed in dnsbl.ahbl.org]

[74.125.230.140 listed in dnsbl.ahbl.org]

[74.125.230.140 listed in dnsbl.ahbl.org]

[74.125.230.140 listed in dnsbl.ahbl.org]

[44.197.201.22 listed in dnsbl.ahbl.org]

[44.197.201.22 listed in dnsbl.ahbl.org]

[44.197.201.22 listed in dnsbl.ahbl.org]

[44.197.201.22 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[74.125.230.140 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[74.125.230.140 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[74.125.230.140 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[74.125.230.140 listed in dnsbl.ahbl.org]

-0.0 SPF_PASS SPF: sender matches SPF record

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

-0.5 SMILEY BODY: Contains one or more Smileys

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[74.125.230.140 listed in wl.mailspike.net]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[74.125.230.140 listed in list.dnswl.org]

1.9 URIBL_JP_SURBL Contains an URL listed in the JP SURBL blocklist

[URI: persistiq.net]

1.9 URIBL_ABUSE_SURBL Contains an URL listed in the ABUSE SURBL blocklist

[URI: persistiq.net]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[44.197.201.22 listed in will-spam-for-food.eu.org]

[44.197.201.22 listed in will-spam-for-food.eu.org]

[44.197.201.22 listed in will-spam-for-food.eu.org]

[44.197.201.22 listed in will-spam-for-food.eu.org]

[44.197.201.22 listed in will-spam-for-food.eu.org]

[44.197.201.22 listed in will-spam-for-food.eu.org]

[44.197.201.22 listed in will-spam-for-food.eu.org]

[44.197.201.22 listed in will-spam-for-food.eu.org]

[74.125.230.140 listed in will-spam-for-food.eu.org]

[74.125.230.140 listed in will-spam-for-food.eu.org]

[74.125.230.140 listed in will-spam-for-food.eu.org]

[74.125.230.140 listed in will-spam-for-food.eu.org]

[74.125.230.140 listed in will-spam-for-food.eu.org]

[74.125.230.140 listed in will-spam-for-food.eu.org]

[74.125.230.140 listed in will-spam-for-food.eu.org]

[74.125.230.140 listed in will-spam-for-food.eu.org]

2.0 RATWR8_MESSID Message-ID with excessive dashes and dollars

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[74.125.230.140 listed in bl.score.senderscore.com]

Subject: {SPAM?} Re: NK new clients



Hi =C2=A0



I previously mentioned that I=E2=80=99ve been helping service =

providers find clients by creating personalized email sequences, finding =

targeted prospects, and booking them meetings with warm leads.



Would that be interesting to you?



Best,

-Jackie=C2=A0

PersistIQ



Let me know if this is irrelevant to you, I'll not reach again - thanks :-)



On Thu, August 6, 2026 12:45 AM, Jackie Baker

[jackie_b@persistiq.net]> wrote:



> Hi

>=20

> I came across NK online and =

wanted to reach out because we're working with other service providers that=

are offering internet services.=E2=80=8D

>=20

> I=E2=80=99m currently =

working with a few service providers on campaigns that are getting their =

teams meetings with warm leads every month. We=E2=80=99re targeting people =

who need internet services using personalized email sequences.

>=20

> If I could help you connect with potential clients like this, would that =

be helpful to you?=E2=80=8D

>=20

> Thanks

> Jackie

>=20

> P.S: let me know if irrelevant.

>

Chinese products spam

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Sat, 12 Sep 2026 19:38:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.100 (FreeBSD))

(envelope-from )

id 1x5ZA3-00000000Axp-0CM7

for dave@doctor.nl2k.ab.ca;

Sat, 12 Sep 2026 19:37:39 -0600

Resent-From: The Doctor

Resent-Date: Sat, 12 Sep 2026 19:37:38 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-proxy49132.mail.163.com ([45.254.49.132]:1951)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.100 (FreeBSD))

(envelope-from )

id 1x5YWx-000000007BB-3Qb8

for doctor@nl2k.ab.ca;

Sat, 12 Sep 2026 18:57:25 -0600

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=163.com;

s=s110527; h=Date:From:To:Subject:Content-Type:MIME-Version:

Message-ID; bh=MLVy8mrj1DKq97Vsanff3vLgMizxrb3IKGqGRW4DyBo=; b=K

vqxu1wDwOTVjpqeQTGIW0I/87l7RbWB/Cmo4MZRCV9M2G9Vyxi92LWLWXZ89FE8G

e/pUu4RBMyrG0SfbGIlFNboiFr2sil35hPUoK5asWRTdiR+sJHyl1dae9tATOTim

Qx5kmHOFrNH+N84gGS1UPEbocGJlVMk198WRsnGbNs=

Received: from jacketsandshirts$163.com (

[240e:388:9939:4301:8814:79bb:8bdc:b8bf] ) by ajax-webmail-wmsvr-40-101

(Coremail) ; Sun, 13 Sep 2026 08:29:09 +0800 (CST)

X-Originating-IP: [240e:388:9939:4301:8814:79bb:8bdc:b8bf]

Date: Sun, 13 Sep 2026 08:29:09 +0800 (CST)

From: Hi

To: doctor@nl2k.ab.ca

Subject: Our factory is an ideal fit for small-medium sized company and

start-ups

X-Priority: 3

X-Mailer: Coremail Webmail Server Version 2023.4-cmXT build

20260511(2e539873) Copyright (c) 2002-2026 www.mailtech.cn 163com

X-CM-CTRLMSGS: L/+LCnBsdXM9MTc4OTI1OTM1MDYxOF81YzEyYTA2MTQzNDU0OTBjNjc0ODY2O

WZkYzZiOTJjZA==

X-NTES-SC: AL_Qu2TC/6etksv7yacYOkfmUYRjuc7UMK0uP0j2odWPpt4jCvpxxgqe05jIFnR9eu/KiuLrzuWUSB3xcNmdotGfJkN/4YsHTDI68pm1MZupXXlsQ==

Content-Type: multipart/alternative;

boundary="----=_Part_1867_889174195.1789259349655"

MIME-Version: 1.0

Message-ID:

X-Coremail-Locale: zh_CN

X-CM-TRANSID:ZSgvCgD3hxlV7qVqVmZFAA--.16477W

X-CM-SenderInfo: 5mdfyvhwvd0vhvkl23rv6rljoofrz/xtbCwBXU-Gql7lUUPgAA3j

X-Coremail-Antispam: 1U5529EdanIXcx71UUUUU7vcSsGvfC2KfnxnUU==

X-Spam_score: 7.0

X-Spam_score_int: 70

X-Spam_bar: +++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Hello, We are a Chinese OEM clothing factory, we have more

than 20 years production experience, we aim to supply high-quality custom-made

garments. One of our advantages over other suppliers is that we accep [...]





Content analysis details: (7.0 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[240e:388:9939:4301:8814:79bb:8bdc:b8bf listed in]

[will-spam-for-food.eu.org]

[240e:388:9939:4301:8814:79bb:8bdc:b8bf listed in]

[will-spam-for-food.eu.org]

[240e:388:9939:4301:8814:79bb:8bdc:b8bf listed in]

[will-spam-for-food.eu.org]

[240e:388:9939:4301:8814:79bb:8bdc:b8bf listed in]

[will-spam-for-food.eu.org]

[240e:388:9939:4301:8814:79bb:8bdc:b8bf listed in]

[will-spam-for-food.eu.org]

[240e:388:9939:4301:8814:79bb:8bdc:b8bf listed in]

[will-spam-for-food.eu.org]

[240e:388:9939:4301:8814:79bb:8bdc:b8bf listed in]

[will-spam-for-food.eu.org]

[240e:388:9939:4301:8814:79bb:8bdc:b8bf listed in]

[will-spam-for-food.eu.org]

[45.254.49.132 listed in will-spam-for-food.eu.org]

[45.254.49.132 listed in will-spam-for-food.eu.org]

[45.254.49.132 listed in will-spam-for-food.eu.org]

[45.254.49.132 listed in will-spam-for-food.eu.org]

[45.254.49.132 listed in will-spam-for-food.eu.org]

[45.254.49.132 listed in will-spam-for-food.eu.org]

[45.254.49.132 listed in will-spam-for-food.eu.org]

[45.254.49.132 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[45.254.49.132 listed in dnsbl.ahbl.org]

[45.254.49.132 listed in dnsbl.ahbl.org]

[45.254.49.132 listed in dnsbl.ahbl.org]

[45.254.49.132 listed in dnsbl.ahbl.org]

[240e:388:9939:4301:8814:79bb:8bdc:b8bf listed in]

[dnsbl.ahbl.org]

[240e:388:9939:4301:8814:79bb:8bdc:b8bf listed in]

[dnsbl.ahbl.org]

[240e:388:9939:4301:8814:79bb:8bdc:b8bf listed in]

[dnsbl.ahbl.org]

[240e:388:9939:4301:8814:79bb:8bdc:b8bf listed in]

[dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[45.254.49.132 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[45.254.49.132 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[45.254.49.132 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[45.254.49.132 listed in dnsbl.ahbl.org]

3.6 RCVD_IN_SBL_CSS RBL: Received via a relay in Spamhaus SBL-CSS

[240e:388:9939:4301:8814:79bb:8bdc:b8bf listed in]

[zen.spamhaus.org]

1.5 RCVD_IN_SBL_XBL RBL: Received via a relay in Spamhaus SBL+XBL

[240e:388:9939:4301:8814:79bb:8bdc:b8bf listed in]

[sbl-xbl.spamhaus.org]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[45.254.49.132 listed in bl.score.senderscore.com]

-0.0 SPF_PASS SPF: sender matches SPF record

0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider

[jacketsandshirts(at)163.com]

-0.0 T_RP_MATCHES_RCVD Envelope sender domain matches handover relay

domain

0.6 J_CHICKENPOX_42 BODY: 4alpha-pock-2alpha

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

Subject: {SPAM?} Our factory is an ideal fit for small-medium sized company and

start-ups



Hello,







We are a Chinese OEM clothing factory, we have more than 20 years production experience, we aim to supply high-quality custom-made garments. One of our advantages over other suppliers is that we accepts small‑batch orders and sincerely likes to grow with startup brands. If you are a startup company or small-medium sized company that are looking for a professional and reliable supplier to work with for your business, I firmly believe that we are the right one you need.







I don't think all clothing factories are happy to take small-batch orders and really want to give you true support and develop with you together but we are. We are even happy to invest in dedicated equipment to meet product requirements if really necessary. We are not a big factory but we are able to scale capacity to accommodate growing order volumes. you don't need to switch suppliers as your brand expands.







If you are planning to build your own brand but are struggling to find a proper supplier, please feel free to reach out to us ASAP. We'd love to be your solid backing and give you full support to help you build and establish your brand.







Also, If you are a fashion designer and want to develop Chinese market, I think we can join forces too. We are happy to set up a sample room and offer best possible support to quickly turn your ideas into reality.







Whatever, if you are genuinely interested, PLEASE DON'T just ask for catalog or website link, let's get down to something practical. Please rest assured that we are 100% confident in our ability to produce your styles as long as you can send us complete specification, diagram and size chart. Just send us some of your styles and we can go into details from there.







We can produce many types of garments, I don't think you want all of them.so if you want to see the products we made in the past, please let me know what type of garments you are interested and then I will send pictures accordingly to save your time.







By the way, we are only interested in clients who are seeking a long-term WIN-WIN partnership, If you don't have a real plan to work with a new supplier or you even don't want to spend some time to get to know us, please do not reply to this email. One thing I can promise is that you will appreciate working with us after several rounds of communication.







Just in case this email gets buried or overlooked in your mail box, please get back to me at your earliest convenience. Otherwise, you might miss out on us--that would be a huge loss for you.







Last, if you plan to pay us a factory visit, you are more than welcome.







Thanks for reading and looking forward to hearing back from you.



Leo

Fedex phish from sendgrid

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Sat, 12 Sep 2026 19:37:26 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.100 (FreeBSD))

(envelope-from )

id 1x5Z9m-00000000AwC-0Lxe

for dave@doctor.nl2k.ab.ca;

Sat, 12 Sep 2026 19:37:22 -0600

Resent-From: The Doctor

Resent-Date: Sat, 12 Sep 2026 19:37:21 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from s.wfbtzhsv.outbound-mail.sendgrid.net ([159.183.224.104]:13226)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.100 (FreeBSD))

(envelope-from )

id 1x5XO1-000000000J0-26Qr

for root@nk.ca;

Sat, 12 Sep 2026 17:44:11 -0600

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=sanadoc.ai;

h=content-type:date:from:mime-version:subject:to:cc:content-type:date:

from:subject:to;

s=s1; t=1789256582;

bh=YiXkGXZwutFdxlae/ApxOQO6bPFBXi8szQqAls3dnQI=;

b=YAeYpkMC1fZPAW/09f9KtTzcE7kp4pr7tQdLBihPV0+FImkzOdoOJ9E6DxdSjN3TyunS

POlCVCu2cMDTKxFxVIonNphr2TyfdvQQur2qClT+kG9K065glHRP3purcUzu0qCTjnAHbt

wVPuYAQqv00M4fIdsO9eOdR75GwXhbrWwFUv/ydI+udD+TtVO/iBHCqSCcGJP0GkaQlddx

bPUVEGAB08DwGZh7EBuCX/UACPUYne+4Mdb11BfJjgrVmOq7jSs/AYJv3rycKoBPRBQyym

KvwKGm5zImnlEMYb042oLwjAr+TeF4sJ9vsUbEqB09Rkm4YQj8wt6gSfuNi8Rx7A==

Received: by recvd-canary-78c6b8b795-kqqxx with SMTP id recvd-canary-78c6b8b795-kqqxx-1-6AA5E386-6

2026-09-12 23:43:02.013968544 +0000 UTC m=+3991966.529815867

Received: from NTg3MTE0Njk (unknown)

by geopod-ismtpd-91 (SG) with HTTP

id Q8zZy1YkSEi0jwoAMiM7XA

Sat, 12 Sep 2026 23:43:01.990 +0000 (UTC)

Content-Type: multipart/mixed; boundary=f0dc8a96e36ae1e9f559f2cef4e9835c06daa83dbfd16dc43cfcd1d5d796

Date: Sat, 12 Sep 2026 23:43:02 +0000 (UTC)

From: FedEx Tracking

Mime-Version: 1.0

Message-ID:

Subject: =?UTF-8?B?V2XigJl2ZQ==?= updated your estimated delivery

X-SG-EID:

=?us-ascii?Q?u001=2EQqNlE5al1bvBBtqp7HdPgxedUqGYuBWmx7JGl4mIJfkONCbzFav5kBNU7?=

=?us-ascii?Q?NfhcMVZhJekASQ6H+yOdOD71RFs3DLVBGD8QXJz?=

=?us-ascii?Q?4Lrpkk1C2luZmJ83OnMaFeyRIdJfh3=2Fy7StXtQG?=

=?us-ascii?Q?lv8ap4fw3SOJo6wEHNtWyYQ4kLHhm4vPt8nCeBz?=

=?us-ascii?Q?20Fm+Z4DZosMBkokO92d1fZKkFbz6EoXoYEJ5Ir?=

=?us-ascii?Q?P0opJ8ZLIaRce5NHxdkjlo=3D?=

To: root@nk.ca

X-Entity-ID: u001.xaEaRzI20D/jRB4Z2jjAgA==

X-Spam_score: 18.2

X-Spam_score_int: 182

X-Spam_bar: ++++++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: FedEx Package Notification FedEx PACKAGE NOTIFICATION A package

has been received at the FedEx facility. Shipping cost: $12.47 USD Tracking

7894 3210 5678 9012 Weight 2.5 kg Service International Priority Reference

INV-2026-00 [...]



Content analysis details: (18.2 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[159.183.224.104 listed in will-spam-for-food.eu.org]

[159.183.224.104 listed in will-spam-for-food.eu.org]

[159.183.224.104 listed in will-spam-for-food.eu.org]

[159.183.224.104 listed in will-spam-for-food.eu.org]

[159.183.224.104 listed in will-spam-for-food.eu.org]

[159.183.224.104 listed in will-spam-for-food.eu.org]

[159.183.224.104 listed in will-spam-for-food.eu.org]

[159.183.224.104 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[159.183.224.104 listed in dnsbl.ahbl.org]

[159.183.224.104 listed in dnsbl.ahbl.org]

[159.183.224.104 listed in dnsbl.ahbl.org]

[159.183.224.104 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[159.183.224.104 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[159.183.224.104 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[159.183.224.104 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[159.183.224.104 listed in dnsbl.ahbl.org]

0.0 T_SPF_TEMPERROR SPF: test of record failed (temperror)

15 GR_DOMAIN_SENDGR1 Received contains spammer id (sendgr)

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[159.183.224.104 listed in bl.score.senderscore.com]

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.8 SARE_FROM_SPAM_WORD3 I don't know people named this!

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

Subject: {SPAM?} =?UTF-8?B?V2XigJl2ZQ==?= updated your estimated delivery



--f0dc8a96e36ae1e9f559f2cef4e9835c06daa83dbfd16dc43cfcd1d5d796

Content-Transfer-Encoding: quoted-printable

Content-Type: text/html; charset=utf-8

Mime-Version: 1.0












0">

FedEx Package Notification




etica,sans-serif;-webkit-text-size-adjust:100%;-ms-text-size-adjust:100%;">




e=3D"background:#f4f6f9;padding:20px 10px;margin:0;">














e=3D"max-width:520px;width:100%;background:#ffffff;border-radius:16px;box-s=

hadow:0 8px 32px rgba(0,0,0,0.10);border:1px solid #e0e3e9;margin:0 auto;">


































0;">












5px;">FedEx
ackground:rgba(255,255,255,0.20);padding:4px 14px;border-radius:20px;letter=

-spacing:0.5px;">PACKAGE NOTIFICATION























px;">

A package has been received at the FedEx facility.

x;">

Shipping cost:
t-size:24px;color:#660099;font-weight:700;">$12.47
lor:#777777;font-size:13px;">USD










<=

/td>







e=3D"margin-top:14px;">


















">


spacing:0.5px;display:block;">Tracking

7894 3210 5678 9012
>
ding-bottom:8px;">


spacing:0.5px;display:block;">Weight

2.5 kg



spacing:0.5px;display:block;">Service

International Priority
ong>


spacing:0.5px;display:block;">Reference

INV-2026-0042










<=

/td>







e=3D"margin-top:6px;">














x;">

Step 1: Pay the shipping fee



#ffffff;padding:12px 32px;border-radius:8px;text-decoration:none;font-size:=

16px;font-weight:600;">Pay Now










<=

/td>







e=3D"margin-top:6px;">




















x;">

Step 2: Sign and return

px;">

After payment, download the attached PDF, sign it, and send it back.

;padding-bottom:6px;">

=E2=80=A2 Download the attached PDF


=E2=80=A2 Sign your name


=E2=80=A2 Reply with the signed PDF










<=

/td>







e=3D"margin-top:6px;">










ize:13px;font-weight:600;">View shipment details





px;border-top:1px solid #e6e9ef;">










;">

Note: Shipping cost of
yle=3D"color:#1a1a1a;">$12.47 USD applies.


Pay, sign, and return the document.











e=3D"max-width:520px;margin-top:12px;">








ine-height:1.6;">

This is a system notification.


© 2026 FedEx. All rights reserved.









h8zctcYLl02ePDFDYybCZHV0JkL1cybi2mg1wCc7b8vdPpN7MmXdjCDOYLZiy9bO2ezd-2B-2Fl=

psxaOEwSYwYez0aMcHZvGQRaTqmaUnRjyhaku75qP9hdBZEIKRaFEeTfFdj2G2LI5xiNBYiTa-2=

FMIUV9M4aRpampLQiRqAdiA0FiXYHyYXhHnXHlV8MX47vZzzI-2FOw-3D-3D" alt=3D"" widt=

h=3D"1" height=3D"1" border=3D"0" style=3D"height:1px !important;width:1px =

!important;border-width:0 !important;margin-top:0 !important;margin-bottom:=

0 !important;margin-right:0 !important;margin-left:0 !important;padding-top=

:0 !important;padding-bottom:0 !important;padding-right:0 !important;paddin=

g-left:0 !important;"/>



--f0dc8a96e36ae1e9f559f2cef4e9835c06daa83dbfd16dc43cfcd1d5d796

Content-Disposition: attachment; filename="Signature Required for FedEx Shipment.pdf"

Content-Transfer-Encoding: base64

Content-Type: application/pdf; name="Signature Required for FedEx Shipment.pdf"



...

--f0dc8a96e36ae1e9f559f2cef4e9835c06daa83dbfd16dc43cfcd1d5d796--

Lottery spam from Mexico

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Sat, 12 Sep 2026 13:30:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.100 (FreeBSD))

(envelope-from )

id 1x5TPv-00000000PD7-08PF

for dave@doctor.nl2k.ab.ca;

Sat, 12 Sep 2026 13:29:39 -0600

Resent-From: The Doctor

Resent-Date: Sat, 12 Sep 2026 13:29:38 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from [187.217.45.214] (port=58998 helo=titan.profeco.gob.mx)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.100 (FreeBSD))

(envelope-from )

id 1x5RKD-000000006UR-3CmX

for doctor@doctor.nl2k.ab.ca;

Sat, 12 Sep 2026 11:16:08 -0600

Received: from localhost (localhost [127.0.0.1])

by titan.profeco.gob.mx (Postfix) with ESMTP id 4EFCA819F4F;

Sat, 12 Sep 2026 11:14:16 -0600 (CST)

X-Virus-Scanned: by SpamTitan at profeco.gob.mx

Received: from titan.profeco.gob.mx (localhost [127.0.0.1])

by titan.profeco.gob.mx (Postfix) with ESMTP id DE03F819F0D;

Sat, 12 Sep 2026 11:13:35 -0600 (CST)

Authentication-Results: titan.profeco.gob.mx;

dkim=invalid (public key: not available, 0-bit key sha256)

header.d=profeco.gob.mx header.i=@profeco.gob.mx header.b=hi7KOy+F

header.a=-sha256 header.s=correopfco x-bits=0;

x-trusted-ip=pass

Received: from correo.profeco.gob.mx (smtp.profeco.gob.mx [10.4.60.46])

by titan.profeco.gob.mx (Postfix) with ESMTPS id 85489819F35;

Sat, 12 Sep 2026 11:13:33 -0600 (CST)

Content-Language: en-US

Content-Type: text/plain; charset="iso-8859-1"

Content-Transfer-Encoding: quoted-printable

DKIM-Signature: v=1; a=rsa-sha256; d=profeco.gob.mx; s=correopfco;

c=simple/simple; t=1789233212; h=from:subject:to:date:message-id;

bh=sCi9EWOu6VAVCVgYNSLHLV4WLbRtKCk5+EwPqX9Wcbw=;

b=hi7KOy+FCxVqxXExxy0urLkezCfCo9f+LuMPvMd8Qp8UyKgm5LpMdUtNqQY0PJfhK5e5XdnM6xO

oK3od6BEFM1Wef6Q0bPCkhQQKBSung6v7hYrwVv6bV3zH4vY2WCUHAJ2DHeTYOCjNpWxH0JVghpXy

AjPuoUIPpdchTXTPsq4=

Received: from EXCHANGE01.profeco.gob.mx (10.4.60.46) by

EXCHANGE01.profeco.gob.mx (10.4.60.46) with Microsoft SMTP Server (TLS) id

15.0.1497.48; Sat, 12 Sep 2026 11:13:32 -0600

Received: from EXCHANGE01.profeco.gob.mx ([::1]) by EXCHANGE01.profeco.gob.mx

([::1]) with mapi id 15.00.1497.048; Sat, 12 Sep 2026 11:13:32 -0600

From: Coordinacion General de Educacion y Divulgacion



Subject: RE: Congratulation from Deutsche Postcode Lotterie

Thread-Topic: Congratulation from Deutsche Postcode Lotterie

Thread-Index: AQHdQtoJow+FhTeTmkO5Mc20ByKQGw==

Date: Sat, 12 Sep 2026 17:13:32 +0000

Message-ID: <4c6ea9119fdb49ab837e291e5ed74842@EXCHANGE01.profeco.gob.mx>

Accept-Language: en-US

X-MS-Has-Attach:

X-MS-TNEF-Correlator:

x-ms-exchange-transport-fromentityheader: Hosted

MIME-Version: 1.0

X-Spam_score: 7.4

X-Spam_score_int: 74

X-Spam_bar: +++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: You have won 100,000 euros - claim your prize now via: Postcode2026.de@gmail.com

"Ley General de Protección de Datos Personales en Posesión de Sujetos Obligados.

Artículo 25. Con independencia del tipo de sistema en el que se encuentren

los datos personales o el tipo de tratami [...]



Content analysis details: (7.4 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[187.217.45.214 listed in will-spam-for-food.eu.org]

[187.217.45.214 listed in will-spam-for-food.eu.org]

[187.217.45.214 listed in will-spam-for-food.eu.org]

[187.217.45.214 listed in will-spam-for-food.eu.org]

[187.217.45.214 listed in will-spam-for-food.eu.org]

[187.217.45.214 listed in will-spam-for-food.eu.org]

[187.217.45.214 listed in will-spam-for-food.eu.org]

[187.217.45.214 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[187.217.45.214 listed in dnsbl.ahbl.org]

[187.217.45.214 listed in dnsbl.ahbl.org]

[187.217.45.214 listed in dnsbl.ahbl.org]

[187.217.45.214 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[187.217.45.214 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[187.217.45.214 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[187.217.45.214 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[187.217.45.214 listed in dnsbl.ahbl.org]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[187.217.45.214 listed in bl.score.senderscore.com]

0.0 T_SPF_TEMPERROR SPF: test of record failed (temperror)

0.0 T_SPF_HELO_TEMPERROR SPF: test of HELO record failed (temperror)

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

1.2 MISSING_HEADERS Missing To: header

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

1.3 RDNS_NONE Delivered to internal network by a host with no rDNS

0.0 LOTS_OF_MONEY Huge... sums of money

1.4 MONEY_NOHTML Lots of money in plain text

2.0 ADVANCE_FEE_2_NEW_MONEY Advance Fee fraud and lots of money

Subject: {SPAM?} RE: Congratulation from Deutsche Postcode Lotterie











You have won 100,000 euros - claim your prize now via: Postcode2026.de@gmai=

l.com













"Ley General de Protecci=F3n de Datos Personales en Posesi=F3n de Sujetos O=

bligados. Art=EDculo 25. Con independencia del tipo de sistema en el que se=

encuentren los datos personales o el tipo de tratamiento que se efect=FAe,=

el responsable deber=E1 establecer y mantener las medidas de seguridad de =

car=E1cter administrativo, f=EDsico y t=E9cnico para la protecci=F3n de los=

datos personales contra da=F1o, p=E9rdida, alteraci=F3n, destrucci=F3n o s=

u uso, acceso o tratamiento no autorizado, as=ED como garantizar su confide=

ncialidad, integridad y disponibilidad."

Nigerian spam from Google Gmail

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Sat, 12 Sep 2026 08:06:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.100 (FreeBSD))

(envelope-from )

id 1x5OMI-00000000BT5-1jMc

for dave@doctor.nl2k.ab.ca;

Sat, 12 Sep 2026 08:05:34 -0600

Resent-From: The Doctor

Resent-Date: Sat, 12 Sep 2026 08:05:34 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-pl1-f232.google.com ([209.85.214.232]:50232)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.100 (FreeBSD))

(envelope-from )

id 1x5K1C-00000000JAK-34MC

for doctor@doctor.nl2k.ab.ca;

Sat, 12 Sep 2026 03:27:39 -0600

Received: by mail-pl1-f232.google.com with SMTP id d9443c01a7336-2cace91f112so12910585ad.0

for ; Sat, 12 Sep 2026 02:26:41 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=iadmexico.mx; s=google; t=1789205195; x=1789809995; darn=doctor.nl2k.ab.ca;

h=content-transfer-encoding:content-type:mime-version:message-id

:subject:reply-to:from:to:date:from:to:cc:subject:date:message-id

:reply-to:content-type;

bh=TBc3sZi+5SGQrc6+zlUofWSox6n90oIDQ2mwDPDl7ig=;

b=GFlgx3iHPBfSLM4C5eLKvJ21av0wHmz2mNv5ToKP8IjiNVzjLv8QIlUSdkeG3hB8IZ

d6sDnXiaXbSr1Xjdxx+PKSWmwlat2iVJi39bW7Jn6yEmBLg88oArwzUSeCn9osiUvi5x

GBj5kIvZa7N494sZ++ZoHprzEOnEg2rIjc+RvXDq1Zpu0FO/Wo7EUsaEmNyNJeD72V9p

nIL1YCP2snLeTL7XYgjtkoi3eR8NfbmsTcBsdZ0cfO+sIKJYJfqRUr8IveJeNxr+OPjU

XZzwkUfz87RrpmJCuclhIXPutzFJn65uh2h+srsOj5kAS6L0gCd5B59ejFyNIpIjJuyn

8wGA==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20251104; t=1789205195; x=1789809995;

h=content-transfer-encoding:content-type:mime-version:message-id

:subject:reply-to:from:to:date:x-gm-gg:x-gm-message-state:from:to:cc

:subject:date:message-id:reply-to:content-type;

bh=TBc3sZi+5SGQrc6+zlUofWSox6n90oIDQ2mwDPDl7ig=;

b=QD2XO8lEKWYWYeo3B0uYqCCGKuLbdNjLMzcxrVTaTG1FOnCIqQ+F//uk0Q130zq6iz

EzhPXE04L3hICWY+e0vHhNX3JoyWyoo27m8hsdQG8SZKKFzdirU+hcknrXCyEX0oQ52B

Y/IuyiIqLEVfdfpy+uNp3UcNglyL8y1nDjs1GxPAZW5U7/v51jD+CYYIoYSVKPCyYIZC

aNYnrvJR1UiLVjcsUYTjqRWXOYR0nhVI2N5BJuj7mhXbiX7e/2iKx7vuFrSgrqZHGoOw

4MsysGPVPqIQGJXVkOB6i5vM9rF46Vla1W/YnvjYfAMDTbNWxCj7/ce3In9HEbA1XECl

6NKg==

X-Forwarded-Encrypted: i=1; AKwUvBxVlDsc7+NRpbGdkcz2fE4fjiu5ZtMcNKfbTwcfqCWXZeVJfr2oYLO+ye2dX7r4prbdTXt2pjo=@doctor.nl2k.ab.ca

X-Gm-Message-State: AFuF++nSSao8+zjIeFbYgycnrpcfzMH1dzDsLenxCH3BloPtqQuWO80K

ZqWY5m5b/KVjdmPPzwzKwZgqOHOnVCJnodS/G8ucVxCWE53+YsIDANw2R4SnJSoToxb3VNHiLlW

WSQzIyQMgoy79C2F6APHZx/FeDwo1ANs0s3pB

X-Gm-Gg: AYBFou15hcKllsJe+7hvX+hb5NJSPZS9UNraUb8wkAcS+VZzvRWrQIXqGZCF7zL0Wiz

LG8m2TDVZ7zGCzjzvQBvvNtHR5E1D0FWqTw3cL6IOuTOAUahBNMDl5ocnSUyT+RCGBVoqzqDgOh

MtfNzv/2K8qaYgYDF9U9hTSAxZIg6tdSSPNPQy8oSSdwTN+NeVvdgoAHJkYYJdSaN+0eJrAlYXw

CL8esgQe0kXHyMW7QgJgCQuydZPkjz3vrqho5VXQcBbyAlajw3l3dhp/w2v14LxF3RQFlQ8nOyF

6JDK1jidswUP/Emf3+0KTkAqu3vdhFN19D8RObBQGmF2CgZnuE9bg28tA2JJQhzSniiM57CpIWP

Jd185q8Tn5eL8PjMyYY18

X-Received: by 2002:a17:90b:4fc3:b0:398:9c0c:7c72 with SMTP id 98e67ed59e1d1-39dbc730ccamr3373108a91.25.1789205195689;

Sat, 12 Sep 2026 02:26:35 -0700 (PDT)

Received: from mail.iadmexico.mx (mail.iadmexico.mx. [34.231.63.135])

by smtp-relay.gmail.com with ESMTPS id 98e67ed59e1d1-39daa7a9f85sm1810992a91.8.2026.09.12.02.26.35

(version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256);

Sat, 12 Sep 2026 02:26:35 -0700 (PDT)

X-Relaying-Domain: iadmexico.mx

Received: from [127.0.0.1] (localhost [127.0.0.1]) by localhost (Mailerdaemon) with ESMTPSA id D18A5140DD7;

Sat, 12 Sep 2026 03:26:32 -0600 (CST)

Date: Sat, 12 Sep 2026 11:25:44 +0200

To: undisclosed-recipients:;

From: Peggy Chan

Reply-To: peggychan147@outlook.com

Subject: Confidentiality ...

Message-ID:

MIME-Version: 1.0

Content-Type: multipart/alternative;

boundary="1cfb7c4e0c19ab077940b8fe4687a3ae8"

Content-Transfer-Encoding: 8bit

X-Last-TLS-Session-Version: TLSv1.2

X-Spam_score: 12.5

X-Spam_score_int: 125

X-Spam_bar: ++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Good day, I hope this message finds you well, I am reaching

out to present an exciting business proposal totaling $27.6 million that

I believe holds significant potential collaboration between us. My [...]



Content analysis details: (12.5 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[34.231.63.135 listed in will-spam-for-food.eu.org]

[34.231.63.135 listed in will-spam-for-food.eu.org]

[34.231.63.135 listed in will-spam-for-food.eu.org]

[34.231.63.135 listed in will-spam-for-food.eu.org]

[34.231.63.135 listed in will-spam-for-food.eu.org]

[34.231.63.135 listed in will-spam-for-food.eu.org]

[34.231.63.135 listed in will-spam-for-food.eu.org]

[34.231.63.135 listed in will-spam-for-food.eu.org]

[209.85.214.232 listed in will-spam-for-food.eu.org]

[209.85.214.232 listed in will-spam-for-food.eu.org]

[209.85.214.232 listed in will-spam-for-food.eu.org]

[209.85.214.232 listed in will-spam-for-food.eu.org]

[209.85.214.232 listed in will-spam-for-food.eu.org]

[209.85.214.232 listed in will-spam-for-food.eu.org]

[209.85.214.232 listed in will-spam-for-food.eu.org]

[209.85.214.232 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[34.231.63.135 listed in dnsbl.ahbl.org]

[34.231.63.135 listed in dnsbl.ahbl.org]

[34.231.63.135 listed in dnsbl.ahbl.org]

[34.231.63.135 listed in dnsbl.ahbl.org]

[209.85.214.232 listed in dnsbl.ahbl.org]

[209.85.214.232 listed in dnsbl.ahbl.org]

[209.85.214.232 listed in dnsbl.ahbl.org]

[209.85.214.232 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[34.231.63.135 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[34.231.63.135 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[34.231.63.135 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[34.231.63.135 listed in dnsbl.ahbl.org]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[209.85.214.232 listed in list.dnswl.org]

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[209.85.214.232 listed in wl.mailspike.net]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[209.85.214.232 listed in bl.score.senderscore.com]

0.0 T_SPF_TEMPERROR SPF: test of record failed (temperror)

1.5 GR_DOMAIN_UNDISC1 To contains undisclosed recipient (undisc)

0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in digit

[peggychan147(at)outlook.com]

0.6 J_CHICKENPOX_75 BODY: 7alpha-pock-5alpha

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 HTML_FONT_LOW_CONTRAST BODY: HTML font color similar or identical to

background

0.0 LOTS_OF_MONEY Huge... sums of money

2.0 US_8BIT US-ASCII isn't an eight bit charset

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

2.5 FREEMAIL_FORGED_REPLYTO Freemail in Reply-To, but not From

0.4 MONEY_FREEMAIL_REPTO Lots of money from someone using free email?

2.1 UNDISC_MONEY Undisclosed recipients + money/fraud signs

2.0 ADVANCE_FEE_2_NEW_MONEY Advance Fee fraud and lots of money

Subject: {SPAM?} Confidentiality ...



This is a multi-part message in MIME format.



--1cfb7c4e0c19ab077940b8fe4687a3ae8

Content-Type: text/plain; charset=us-ascii



Good day,

I hope this message finds you well, I am reaching out to present an exciting business proposal totaling $27.6 million that I believe holds significant potential collaboration between us.

My proposal is centered around trust and confidentiality, I would appreciate the opportunity to discuss this proposal further and explain how we can align our goals for mutual benefit.

Thank you for considering this opportunity. I look forward to your reply.

Best regards,Peggy.

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

190ca





--1cfb7c4e0c19ab077940b8fe4687a3ae8

Content-Type: text/html; charset=us-ascii



Good day,



I hope this message finds you well, I am reaching out to present an exciting business proposal totaling $27.6 million that I believe holds significant potential collaboration between us.



My proposal is centered around trust and confidentiality, I would appreciate the opportunity to discuss this proposal further and explain how we can align our goals for mutual benefit.



Thank you for considering this opportunity. I look forward to your reply.



Best regards,
Peggy.





 



 



 



 



 



 



 



 



 



 



 



 



 



 



 



 



 



190ca








--1cfb7c4e0c19ab077940b8fe4687a3ae8--



Chinese inquiry spam

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Fri, 11 Sep 2026 20:12:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.100 (FreeBSD))

(envelope-from )

id 1x5DDi-000000000Fx-1NJX

for dave@doctor.nl2k.ab.ca;

Fri, 11 Sep 2026 20:11:58 -0600

Resent-From: The Doctor

Resent-Date: Fri, 11 Sep 2026 20:11:58 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from cloud-ae8607.managed-vps.net ([165.140.158.253]:43456)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.100 (FreeBSD))

(envelope-from )

id 1x5CtX-00000000O9Z-2fZ2

for root@nk.ca;

Fri, 11 Sep 2026 19:51:16 -0600

DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=nppos.com;

s=default; h=Content-Transfer-Encoding:Content-Type:MIME-Version:Message-ID:

Date:Subject:To:From:Reply-To:Sender:Cc:Content-ID:Content-Description:

Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:

In-Reply-To:References:List-Id:List-Help:List-Unsubscribe:List-Subscribe:

List-Post:List-Owner:List-Archive;

bh=adRk2Dfn72yv2STQfFjz1UzGBo7kgnrm7hqEV8waqzA=; b=HQe4UYHmBximPbCDDZHsrFXRen

Fto0Mwwqt8WUsMoGd1ffXw0n1bFnyad+kJZtWNdSjd8jZqKaq9S7xOLhny4wm3hJpdiF6QYQvyew5

Ljr9lqVdAaqdPlZgQniHJAmV2alM1i9Qxj5Y+sGMWN7PXmc69loEgE4Nr3S968S8E1qEPV82dyRV4

65Dye8QThEt93O1qhWEiWNUkt6HTC7fIWIxaIvv5zsS/dKqzksbuxieYyRQNSrMJerrPHLO+zJJG+

AXsUkVXBHVSZE6VZV/wY2RgoUy/6OlUvFZoDIFEbHz6s3irEqtY+69wrM3CjfFGkHTlnD43X4ltAS

7mWPVyYg==;

Received: from [185.218.19.179] (port=55040)

by cloud-ae8607.managed-vps.net with esmtpa (Exim 4.99.5)

(envelope-from )

id 1x5Csf-0000000DEJ3-17us

for root@nk.ca;

Fri, 11 Sep 2026 21:50:13 -0400

Reply-To: CBRELSPayoff@cber.info

From: Thom Barnhardt

To: root@nk.ca

Subject: Order Inquiry

Date: 11 Sep 2026 18:50:11 -0700

Message-ID: <20260911185011.AD170F308B40ECCE@nppos.com>

MIME-Version: 1.0

Content-Type: text/plain;

charset="utf-8"

Content-Transfer-Encoding: quoted-printable

X-Authenticated-Sender: info@nppos.com

X-Spam_score: 9.6

X-Spam_score_int: 96

X-Spam_bar: +++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Dear vendor, Your kind attention is invited to draw your precious

time to forward your best offer in respect of your products and services.

our agent in China recommended your details. Please quote price and confirm

availability of items.



Content analysis details: (9.6 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[185.218.19.179 listed in will-spam-for-food.eu.org]

[185.218.19.179 listed in will-spam-for-food.eu.org]

[185.218.19.179 listed in will-spam-for-food.eu.org]

[185.218.19.179 listed in will-spam-for-food.eu.org]

[185.218.19.179 listed in will-spam-for-food.eu.org]

[185.218.19.179 listed in will-spam-for-food.eu.org]

[185.218.19.179 listed in will-spam-for-food.eu.org]

[185.218.19.179 listed in will-spam-for-food.eu.org]

[165.140.158.253 listed in will-spam-for-food.eu.org]

[165.140.158.253 listed in will-spam-for-food.eu.org]

[165.140.158.253 listed in will-spam-for-food.eu.org]

[165.140.158.253 listed in will-spam-for-food.eu.org]

[165.140.158.253 listed in will-spam-for-food.eu.org]

[165.140.158.253 listed in will-spam-for-food.eu.org]

[165.140.158.253 listed in will-spam-for-food.eu.org]

[165.140.158.253 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[165.140.158.253 listed in dnsbl.ahbl.org]

[165.140.158.253 listed in dnsbl.ahbl.org]

[165.140.158.253 listed in dnsbl.ahbl.org]

[165.140.158.253 listed in dnsbl.ahbl.org]

[185.218.19.179 listed in dnsbl.ahbl.org]

[185.218.19.179 listed in dnsbl.ahbl.org]

[185.218.19.179 listed in dnsbl.ahbl.org]

[185.218.19.179 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[165.140.158.253 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[165.140.158.253 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[165.140.158.253 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[165.140.158.253 listed in dnsbl.ahbl.org]

1.6 RCVD_IN_BRBL_LASTEXT RBL: No description available.

[165.140.158.253 listed in bb.barracudacentral.org]

-0.0 SPF_PASS SPF: sender matches SPF record

-0.0 SPF_HELO_PASS SPF: HELO matches SPF record

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

2.5 URIBL_DBL_PHISH Contains a Phishing URL listed in the DBL blocklist

[URI: mirmystic.org]

2.5 URIBL_DBL_MALWARE Contains a malware URL listed in the DBL blocklist

[URI: mirmystic.org]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

0.8 SARE_FROM_SPAM_WORD3 I don't know people named this!

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

0.7 TO_NO_BRKTS_FROM_MSSP Multiple formatting errors

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[165.140.158.253 listed in bl.score.senderscore.com]

Subject: {SPAM?} Order Inquiry



Dear vendor,





Your kind attention is invited to draw your precious time to

forward your best offer in respect of your products and

services. our agent in China recommended your details.



Please quote price and confirm availability of items.



Your early response would be highly appreciated.





Thank you.

Thom Barnhardt

CEO

+48 508 143 963

CBRELSPayoff@cber.info

www.mirmystic.org

WEb/sEO/App spam from Microsoft Outlook

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Fri, 11 Sep 2026 11:59:00 -0600

Received: from mail-westus3azolkn19011095.outbound.protection.outlook.com ([52.103.23.95]:41892 helo=PH0PR06CU001.outbound.protection.outlook.com)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.100 (FreeBSD))

(envelope-from )

id 1x55WC-000000008pd-0UM1

for dave@doctor.nl2k.ab.ca;

Fri, 11 Sep 2026 11:58:43 -0600

ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none;

b=KpxWHp1ptfGpesMOo4Qpt3YwZEI4iWPqDsxscCSOFN7RohtASbRFlvIh+SlSDUnKwKsCnJBkg8lzKFX4Ij+BRSb/8/SJ6p+LUNqpiEQv8MEwvnNMKt9sXNOIbJp0OBZKoqm5+WBbR2nnxSP2cmzaIw7+/rEKdHeh6ye3b8Idw1q4eTTcFbNM8pdgSEO7uWMaa/zP/WZNRr3cvw87jVZl4gt6s+qOViXbD4iGoOKcwmTcjm0T42SqkPj/Q6WBqDr5h28OtxeHRwh9CrPAb3gsIeNALVLbljB1p71jess+Ivshm5NwmLegcKIryIK/7lpkxSrIACrdRJVBKviUk8PBiA==

ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;

s=arcselector10001;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1;

bh=hoOSDgs8Rzd5Xgqr629+GDSgRYcbJ6bNP3admNli9BU=;

b=cdx8uf3pAiFpJRp32RO/i2fPNy9ASHjoIyGM2q0a9qd2ANC20ak9TUBo1MvWan9BL8ayBvZhsINPel2gcCO4lLBbDKsc85/8AdZUQ0jp687jGHa8OSmP75+gA73aNywoGzQoTIgXf4qRcBC3cgWPMyYi9tbIUstb9lwt00suUP/aoFWUqRNdlYnNzD9mcXTn1nfiDwM5qlMy9GIUrVPB4z/nzWSZI/PHU267VV9Eb05JdKusew8yO4iXDbA1OWB+qgJfRfnTfBRXUMUR3OokoBs7tQAkX8OG1+k0M03uuzSztPlvIvSxjKiGC8WaFsnUdeuHRWVpVhkUdIv2fEHfCw==

ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=none; dmarc=none;

dkim=none; arc=none

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=outlook.com;

s=selector1;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck;

bh=hoOSDgs8Rzd5Xgqr629+GDSgRYcbJ6bNP3admNli9BU=;

b=ZMzP4h73GdDwWr6Gx+FZSUYWgJMryjkFiPodPDwGsXXa+THyue76pldjwpWt02MyEZoOmmQF69L6HLzXtRYNa19aFIA8O3otb6VHvSLJKE/kyv/mq0DntkyAPSkjGM3o7kOcapcLBEVqT1p5nS0sBl9WqPMKC7OcYOiLo0qUY7iOSC+nFY2WpnPRG1aYsJiV5CTpnLapsJnoMLCJnJJkkX0XNf2iTKI5E1uKdMxTQXhbc3tkeo9WSC/KwRmMO81gEjzlOvwXuyXdgPCotSzLslDqi/ca0L+japgwYVxZWB+C4ZTSqe3IQOPZKqBwDLz41swAn24iu9T1jiGtJ5H/ZQ==

Received: from BY5PR10MB4306.namprd10.prod.outlook.com (2603:10b6:a03:211::7)

by DS0PR10MB7342.namprd10.prod.outlook.com (2603:10b6:8:f9::21) with

Microsoft SMTP Server (version=TLS1_2,

cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.428.7; Fri, 11 Sep

2026 17:57:34 +0000

Received: from BY5PR10MB4306.namprd10.prod.outlook.com

([fe80::7517:a40c:d536:d365]) by BY5PR10MB4306.namprd10.prod.outlook.com

([fe80::7517:a40c:d536:d365%4]) with mapi id 15.21.0406.007; Fri, 11 Sep 2026

17:57:33 +0000

From: Poppy Jone

To: Poppy Jone

Subject: Re: inquiry..

Thread-Topic: inquiry..

Thread-Index: AQHdQhbbKHvQa1KuWk2CLHHkBki2HLbJqdG3

Date: Fri, 11 Sep 2026 17:57:33 +0000

Message-ID:



References:



In-Reply-To:



Accept-Language: en-US

Content-Language: en-US

X-MS-Has-Attach:

X-MS-TNEF-Correlator:

msip_labels:

x-ms-publictraffictype: Email

x-ms-traffictypediagnostic: BY5PR10MB4306:EE_|DS0PR10MB7342:EE_

x-ms-office365-filtering-correlation-id: b86baf05-836e-4523-cb5e-08df102e27c0

x-microsoft-antispam:

BCL:0;ARA:14566002|15080799012|19110799012|2604031031799003|37011999003|8062599012|8060799015|16051099003|15030799006|704163111799003|25010399006|10112599003|55001999006|2604032031799003|51005399006|31061999003|3412199025|440099028|102099032|40105399003|2607281247196008|1710799026;

x-microsoft-antispam-message-info:

=?Windows-1252?Q?/zpp4kF7W5vNYxy1K/dXvE12eV+gHK5tCR6WC/J1Um3HwzM1oQX7qZDH?=

=?Windows-1252?Q?K9gar1DJJVRbwO4EyAL2xqbDx4b4pJ0EuZ7J5/ZUpBAmCaCNqSvc3oRR?=

=?Windows-1252?Q?knWBujUzJA1k/ArE4okZ22i6RUuvpgv5tFAe2ZimoTCOx+U4TjUd97/f?=

=?Windows-1252?Q?uds3bob6qifm4SGz/m6qIP5vXiWIhK+XBtpRjVOh24r7ocVB7nQRalTP?=

=?Windows-1252?Q?7wCs1TJc0vrkS5IXpU5PMJQCAu6nc0kF1YHLNT6mkIV1zv7VmDIpTIkH?=

=?Windows-1252?Q?czk7wP3tOjKrlrclldU4Bfcq3rv8DTNNpNDjvGwZdegsxdF0aRCU32XB?=

=?Windows-1252?Q?MzVskVNG1gBahBctYO4Uc16NRZajEbFy3yTQpG6ZB6qErGBur1icj5ks?=

=?Windows-1252?Q?jacXwOOLS78YnJtXUguy0wuL2nxHRhf5OixUdoqzIzBbm47Kh94qZBjd?=

=?Windows-1252?Q?MfgAy2YSNZsJamnCiws05qqjZQvadszal+gUVXc+nZhQCt3oemnXxQdQ?=

=?Windows-1252?Q?gh16Dp/WptyrNrOzbQ+CD3vyaenR+9CvbF7/zm9Qaa/tE7pnE3r86zWx?=

=?Windows-1252?Q?VLaRDT5tChmUR8qLjvdsjSSKAD2P+fVEnKX3LM/md3fl27FsolRibPgH?=

=?Windows-1252?Q?FWquAXkP7u2/yd2Ewi3xauHn9+8CMaLU9itXsJuAUePNrhpa16C7IW/Y?=

=?Windows-1252?Q?9NXlgUs9WOk/UUnz3vCtP7mb0KcaUSTXnKPZV4k83L1+OoLTir4ML1et?=

=?Windows-1252?Q?GDgrdaExOGP6tvlOiTOCVzD0Smn0WKOmrscJjTegRcYYFVTZ0DYaxgRz?=

=?Windows-1252?Q?EsYQTbK2cqtclVU8hoCbviWBL8SFaYpZbDkUR7wJhqqgYYCveU/8pRh7?=

=?Windows-1252?Q?UbHImb71HQyvYlfIVbuvK3eeWYu/4E5vNXmR7Z0EQ/XgQbkv985XQy33?=

=?Windows-1252?Q?kBabHYsL6z/WpbxQkSGLVnK96iWgjRV14xK4lMz6CyBemD+Oej53zvec?=

=?Windows-1252?Q?auOiozPCk0/VYVKFBs2V8qPfb0t72xAJVUr2e/r02g5gDDz17SrOpr87?=

=?Windows-1252?Q?EH2x0I8GNSQ1lAMM8qV+wkB8CXuFvP/VbfAQlcb5trUMBsoVs+xXnID7?=

=?Windows-1252?Q?U3Wh91RV4FxBc77zKwXjycwV/X/DpOzhBKTK2famgrUtrggk3d6wq7qX?=

=?Windows-1252?Q?RJB19zsuMQoB7jKv1vUfeNPNVpTUGOatCsRP/ZbVIOg90g3uTnw636U5?=

=?Windows-1252?Q?gakyMtOyrrUm1ff9xQ0B47fpNq57o4D7O+h/0Y3ppOKratuvxp2sUqAu?=

=?Windows-1252?Q?teC7HQ=3D=3D?=

x-ms-exchange-antispam-messagedata-chunkcount: 1

x-ms-exchange-antispam-messagedata-0:

=?Windows-1252?Q?7U15UQKow5t0o05p5fGPw8y3BGa9ppImHXOaKR6TPVdctOYQrxk40svl?=

=?Windows-1252?Q?69ggiMn4w/FYM1AzcWYbzAGWgFjKPP3BDGDADL/uVhwQVsaEIELVgL5Y?=

=?Windows-1252?Q?UEQNYMDjAv41WBuz2KVEWHhdaqEAiSrZt6Uwd5E8g5kkQwA+WoUwbmRq?=

=?Windows-1252?Q?hbB7XXCxjgpkC+utaf7sWy/o6sRq6wggIAMVXatnPmFzed9snVC63xFv?=

=?Windows-1252?Q?iJjNzdb5ZrWlx0jjOrDNvb975wnRv6ewcG48PuYxVAWqdJ1MvgJIqyxb?=

=?Windows-1252?Q?igA/7lq1hAA+NEWkXZ1EgrE6RlNB0PqPWNF171BBwnw3GUtqC1+ktNTx?=

=?Windows-1252?Q?vR4fxsgz/C+ifOTJ8q/ofDds66G8Y0levhtE0vgJBaBNkp9TUzYxeW91?=

=?Windows-1252?Q?a5HKd792VPWsidP4DDOVV8iuZCoW+eZ/tNrl5siFfuvny9/9GRl7g/UZ?=

=?Windows-1252?Q?EVD+6nqUWsGTsu3F2e5T2WlGn8bUzeyQGjlZ/d+n9iyUKnrUvvBO6WPP?=

=?Windows-1252?Q?Qx/QkJO2xYe19RWjshGRi3f0zdYuHa4DDiZq0XXaasatYSYv80v0D3xs?=

=?Windows-1252?Q?IAIl+QkCadK2vvhu7bdWwH4kj+DTuanfOxccjp+GkYBySI0HS+Usot94?=

=?Windows-1252?Q?YhRKwzhsgP2hJkbNLnFg+PspsxR4lCWFYfdrAsztd9IcpfxyTm2oZwNa?=

=?Windows-1252?Q?3HVjxTeZw83nKE6xY1g2wimWs8n5d75oV5C2wyIMtP5COVgM1rdUF2io?=

=?Windows-1252?Q?OCcKHZuagRaTmcLlgTGHhk89pDOvX2qwl/Hq5mM0c247vzTu7kmEnXq+?=

=?Windows-1252?Q?VugG0KjAiPDOgeMKQaVRDYmsZhDrk3VbyQQFmdnNaSNcGpsZJ0otphlH?=

=?Windows-1252?Q?EWgwq+RLhMQWzWH+ncUB7KVewDL9hUlfApc1dXZFVUuktTEsptBBs/0n?=

=?Windows-1252?Q?E4sZ0qYAYm3YTnTaY9YoFGg7CEPl15lUgICCKjg/Zf6FrZ1vlx4u7AiA?=

=?Windows-1252?Q?YkpBbg2LK+xhWjXqWiUuUeVP6uzsI4Bce9rN7lZG53L7YKmGrEFH1aiA?=

=?Windows-1252?Q?bfmHq3W+w1H4nlbF/QbJKR4lv/taKT1YAM5rollpjFO2xjB1ZIRHOuVi?=

=?Windows-1252?Q?RduYakpn0WwPvonWYF5yXNr/Xdlv/V3voDBQUDo7KLdEhQJbAYsikfe1?=

=?Windows-1252?Q?ozIi8xLJ2nWMJ/lyIH2s4hMFPv8uoT81VzYnEkfPldQEbbd/rt/vRr5d?=

=?Windows-1252?Q?QB2uv9i8dXlaYMc8/B7/nZtgShCsRqWtIirgf9IqbzRAqdLGf/84oJRX?=

=?Windows-1252?Q?zkT1EwR1LqMg+0Re2OsSq9IUA/MXMD02nHAyiTH6lW6DMkiAcQQkiytW?=

=?Windows-1252?Q?/zFQ+RhruoT1JGj0uBXTW+TQ2E95kVKwtv97+Xhno4PB0KZv7+JxbEeX?=

=?Windows-1252?Q?Y5A+btmwnGqM+XWa5/8k7SmVqQBUCM+Op2Cjws8hL0c7QfTGri+NNZlY?=

=?Windows-1252?Q?VZpql9678qDngN5EfrF/PjQCKMMBSmQD5El5B0UytByZFwSyZghqh0tU?=

=?Windows-1252?Q?n47uak2vvr30wJ/m?=

Content-Type: multipart/alternative;

boundary="_000_BY5PR10MB4306590D9AA8ED1B106857CCA5BE2BY5PR10MB4306namp_"

MIME-Version: 1.0

X-OriginatorOrg: outlook.com

X-MS-Exchange-CrossTenant-AuthAs: Internal

X-MS-Exchange-CrossTenant-AuthSource: BY5PR10MB4306.namprd10.prod.outlook.com

X-MS-Exchange-CrossTenant-RMS-PersistedConsumerOrg: 00000000-0000-0000-0000-000000000000

X-MS-Exchange-CrossTenant-Network-Message-Id: b86baf05-836e-4523-cb5e-08df102e27c0

X-MS-Exchange-CrossTenant-originalarrivaltime: 11 Sep 2026 17:57:33.1372

(UTC)

X-MS-Exchange-CrossTenant-fromentityheader: Hosted

X-MS-Exchange-CrossTenant-id: 84df9e7f-e9f6-40af-b435-aaaaaaaaaaaa

X-MS-Exchange-CrossTenant-rms-persistedconsumerorg: 00000000-0000-0000-0000-000000000000

X-MS-Exchange-Transport-CrossTenantHeadersStamped: DS0PR10MB7342



--_000_BY5PR10MB4306590D9AA8ED1B106857CCA5BE2BY5PR10MB4306namp_

Content-Type: text/plain; charset="Windows-1252"

Content-Transfer-Encoding: quoted-printable





________________________________

From: Poppy Jone

Sent: Friday, September 11, 2026 11:26 PM

To: Poppy Jone

Subject: inquiry..



Hi,



Your website looks good, but it=92s not ranking well on Google.



I can help improve its ranking and visibility.



May I send you my price and quotation?



Thanks,



--_000_BY5PR10MB4306590D9AA8ED1B106857CCA5BE2BY5PR10MB4306namp_

Content-Type: text/html; charset="Windows-1252"

Content-Transfer-Encoding: quoted-printable








252">








Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" clas=

s=3D"elementToProof">











yle=3D"font-size:11pt" color=3D"#000000">From: Poppy Jone


Sent: Friday, September 11, 2026 11:26 PM


To: Poppy Jone <poppy.098@outlook.com>


Subject: inquiry..

 









bri,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">

Hi,



nt,Aptos_MSFontService,Calibri,Helvetica,sans-serif; font-size:12pt; color:=

rgb(0,0,0)">







nt,Aptos_MSFontService,Calibri,Helvetica,sans-serif; font-size:12pt; color:=

rgb(0,0,0)">

Your website looks good, but it=92s not ranking well on Google.



nt,Aptos_MSFontService,Calibri,Helvetica,sans-serif; font-size:12pt; color:=

rgb(0,0,0)">







nt,Aptos_MSFontService,Calibri,Helvetica,sans-serif; font-size:12pt; color:=

rgb(0,0,0)">

I can help improve its ranking and visibility.



nt,Aptos_MSFontService,Calibri,Helvetica,sans-serif; font-size:12pt; color:=

rgb(0,0,0)">







nt,Aptos_MSFontService,Calibri,Helvetica,sans-serif; font-size:12pt; color:=

rgb(0,0,0)">


,255,0)">May I send you my price and quotation?



nt,Aptos_MSFontService,Calibri,Helvetica,sans-serif; font-size:12pt; color:=

rgb(0,0,0)">







bri,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">

Thanks,










--_000_BY5PR10MB4306590D9AA8ED1B106857CCA5BE2BY5PR10MB4306namp_--

Canada International Property Show

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Fri, 11 Sep 2026 09:07:14 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.100 (FreeBSD))

(envelope-from )

id 1x52qO-0000000072r-1yHB

for dave@doctor.nl2k.ab.ca;

Fri, 11 Sep 2026 09:07:12 -0600

Resent-From: The Doctor

Resent-Date: Fri, 11 Sep 2026 09:07:12 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from o255.p27.mailjet.com ([185.189.238.255]:57559)

by doctor.nl2k.ab.ca with utf8esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256

(Exim 4.100 (FreeBSD))

(envelope-from <5fb0a808.EAAACUWInqsAAc7XiJIAA-BCcpQAAYKI8DcAoK6BAC0M6QBqpBJg@a2952425.bnc3.mailjet.com>)

id 1x52QJ-000000003L5-1qe6

for sales@nk.ca;

Fri, 11 Sep 2026 08:40:24 -0600

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; q=dns/txt;

d=canadapropertyshow.ca; i=info@canadapropertyshow.ca; s=mailjet; t=1789137505; x=1789144705;

h=Message-Id: MIME-Version: From: Reply-To: To: Subject: Date:

List-Id: List-Unsubscribe-Post: List-Unsubscribe:

Feedback-Id: Precedence: X-CampaignID: X-CSA-Complaints:

X-MJ-Mid: X-REPORT-ABUSE-TO: Content-Type: To: From:

Sender: Subject: Date;

bh=vzFdHGRBoFiHJ5b+iydFGhum3Cch06ReBYmr6446ZJ8=;

b=GI9xJMO5IOgf67C4AbIZDUvoEOHt/JxEv9unA9Y6hKIAH/qJORekiVTu+

neDJemXmXH+N/Uva1he0kM3HV+ytba218iZrQfO4NYlKfhbyY1HufxGpg2MX

2BhZ5PRbWVlG7R/5LsjE7sZ8+N9nkG6FuBZhL9fbSaRk+tLQDXu4yM2CiGFJ

cUejESLcvsbq4SZakFd73yMGYRazxn3GLxmDce8Yq+2lw4fZZ59GbtGmVfaI

ZLWN+INI2yrcxYYqwVXyRr8tAt+iahkSGjPcJRX9HFJN0qP47lljkClrN4kC

zTrs8+iWx3QNhMGFkxnkX5+sSMWm9IlgJkmrkYFTacbuA==

Message-Id: <5fb0a808.EAAACUWInqsAAc7XiJIAA-BCcpQAAYKI8DcAoK6BAC0M6QBqpBJg@mailjet.com>

MIME-Version: 1.0

From: Canada International Property Show

Reply-To: info@canadapropertyshow.ca

To: sales@nk.ca

Subject: =?UTF-8?Q?Can=E2=80=99t_participate_in_the_?=

=?UTF-8?Q?Show=3F_No_worries=2C_we=E2=80=99ve_?=

=?UTF-8?Q?got_you_covered!?=

Date: Fri, 11 Sep 2026 14:38:24 +0000

List-Id:

List-Unsubscribe-Post: List-Unsubscribe=One-Click

List-Unsubscribe:

,



Feedback-Id: 42:2952425.2720056:MJ

Precedence: bulk

X-CampaignID: 7765198994

X-CSA-Complaints: csa-complaints@eco.de

X-MJ-Mid:

EAAACUWInqsAAc7XiJIAA-BCcpQAAYKI8DcAoK6BAC0M6QBqpBJgpByjioHbSIeabEJCgimmeQApgTg

X-REPORT-ABUSE-TO: Message sent by Mailjet please report to

abuse@mailjet.com with a copy of the message

Content-Type: multipart/alternative; boundary="=-kmkdgOQngNnaeyEbbOL9"

X-Spam_score: 48.8

X-Spam_score_int: 488

X-Spam_bar: ++++++++++++++++++++++++++++++++++++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: <> [https://canadapropertyshow.ca/]

View online version https://sh4zl.mjt.lu/nl3/6EZmXXkjvN5OKwfJzQJJ7w?m=EAAACUWInqsAAc7XiJIAA-BCcpQAAYKI8DcAoK6BAC0M6QBqpBJgpByj

[...]



Content analysis details: (48.8 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[185.189.238.255 listed in will-spam-for-food.eu.org]

[185.189.238.255 listed in will-spam-for-food.eu.org]

[185.189.238.255 listed in will-spam-for-food.eu.org]

[185.189.238.255 listed in will-spam-for-food.eu.org]

[185.189.238.255 listed in will-spam-for-food.eu.org]

[185.189.238.255 listed in will-spam-for-food.eu.org]

[185.189.238.255 listed in will-spam-for-food.eu.org]

[185.189.238.255 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[185.189.238.255 listed in dnsbl.ahbl.org]

[185.189.238.255 listed in dnsbl.ahbl.org]

[185.189.238.255 listed in dnsbl.ahbl.org]

[185.189.238.255 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[185.189.238.255 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[185.189.238.255 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[185.189.238.255 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[185.189.238.255 listed in dnsbl.ahbl.org]

1.1 URIBL_GREY Contains an URL listed in the URIBL greylist

[URI: mjt.lu]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[185.189.238.255 listed in list.dnswl.org]

0.1 URIBL_SBL_A Contains URL's A record listed in the SBL blocklist

[URI: canadapropertyshow.ca/35.227.194.51]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-0.0 SPF_PASS SPF: sender matches SPF record

-0.0 SPF_HELO_PASS SPF: HELO matches SPF record

15 GR_DOMAIN_MAILJE3 Message-ID contains spammer id (mailje)

15 GR_DOMAIN_MAILJE1 Received contains spammer id (mailje)

15 GR_DOMAIN_XECODE1 Spammer tool signature (xecode)

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[185.189.238.255 listed in bl.score.senderscore.com]

0.0 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level mail

domains are different

-0.0 T_RP_MATCHES_RCVD Envelope sender domain matches handover relay

domain

0.3 LONGWORD BODY: Uses overlong words

0.8 HTML_IMAGE_RATIO_02 BODY: HTML has a low ratio of text to image area

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

0.8 SARE_FROM_SPAM_WORD3 I don't know people named this!

0.3 PLING_QUERY Subject has exclamation mark and question mark

-1.0 MAILING_LIST_MULTI Multiple indicators imply a widely-seen list

manager

Subject: {SPAM?} =?UTF-8?Q?Can=E2=80=99t_participate_in_the_?=

=?UTF-8?Q?Show=3F_No_worries=2C_we=E2=80=99ve_?=

=?UTF-8?Q?got_you_covered!?=



--=-kmkdgOQngNnaeyEbbOL9

Content-Type: text/plain; charset=utf-8

Content-Transfer-Encoding: quoted-printable



<> [https://canadapropertyshow.ca/]

View online version https://sh4zl.mjt.lu/nl3/6EZmXXkjvN5OKwfJzQJJ7w?m=3DEAA=

ACUWInqsAAc7XiJIAA-BCcpQAAYKI8DcAoK6BAC0M6QBqpBJgpByjioHbSIeabEJCgimmeQApgT=

g&b=3D5fb0a808&e=3D94fb3a8e&x=3DBCwpwHREIv6H13pFkkwx5w

If you don't like our emails, you can=C2=A0



update your preferences https://sh4zl.mjt.lu/unsub2?m=3DEAAACUWInqsAAc7XiJI=

AA-BCcpQAAYKI8DcAoK6BAC0M6QBqpBJgpByjioHbSIeabEJCgimmeQApgTg&b=3D5fb0a808&e=

=3D94fb3a8e&x=3DBCwpwHREIv6H13pFkkwx5w&hl=3Den_us]or https://sh4zl.mjt.lu/u=

nsub2?m=3DAUYAAHPnElQAAc6lPsQAA9FtWcgAAYKI_iYAoEvTAC0M6QBocCUcmJ9mT1W7QtmiO=

bGBnsWaDQApgTg&b=3Dacc166ac&e=3De9ed69b4&x=3DJXV5YF4Lsy_PYywz1IAQXRtzDekYgN=

I6e86cGq3ZbC4&hl=3Denunsubscribe [https://sh4zl.mjt.lu/unsub2?m=3DEAAACUWIn=

qsAAc7XiJIAA-BCcpQAAYKI8DcAoK6BAC0M6QBqpBJgpByjioHbSIeabEJCgimmeQApgTg&b=3D=

5fb0a808&e=3D94fb3a8e&x=3DBCwpwHREIv6H13pFkkwx5w&hl=3Den_usat any time.=



--=-kmkdgOQngNnaeyEbbOL9

Content-Type: text/html; charset=utf-8

Content-Transfer-Encoding: quoted-printable




9/xhtml" xmlns:v=3D"urn:schemas-microsoft-com:vml" xmlns:o=3D"urn:schemas-m=

icrosoft-com:office:office">Can=E2=80=99t participate in the S=<br /><br /> how? No worries, we=E2=80=99ve got you covered!<=

meta http-equiv=3D"X-UA-Compatible" content=3D"IE=3Dedge"><=

meta http-equiv=3D"Content-Type" content=3D"text/html; charset=3DUTF-8">
ta name=3D"viewport" content=3D"width=3Ddevice-width,initial-scale=3D1">
yle type=3D"text/css">#outlook a { padding:0; }

body { margin:0;padding:0;-webkit-text-size-adjust:100%;-ms-text-size=

-adjust:100%; }

table, td { border-collapse:collapse;mso-table-lspace:0pt;mso-table-r=

space:0pt; }

img { border:0;height:auto;line-height:100%; outline:none;text-decora=

tion:none;-ms-interpolation-mode:bicubic; }

p { display:block;margin:13px 0; }
le type=3D"text/css">[owa] .mj-column-per-100 { width:100% !important; max-=

width: 100%; }
acing:normal;background-color:#F4F4F4;">

e:1px;color:#ffffff;line-height:1px;max-height:0px;max-width:0px;opacity:0;=

overflow:hidden;">Can=E2=80=99t participate in the Show? No worries, we=E2=

=80=99ve got you covered!

e=3D"main" lang=3D"en" dir=3D"ltr">

"margin:0px auto;max-width:600px;">
lpadding=3D"0" cellspacing=3D"0" role=3D"presentation" style=3D"width:100%;=

">

px;padding-left:0px;padding-right:0px;text-align:center;">

:0px;text-align:left;direction:ltr;display:inline-block;vertical-align:top;=

width:100%;">
=3D"presentation" style=3D"vertical-align:top;" width=3D"100%"><=

td align=3D"center" style=3D"font-size:0px;padding:0px 0px 0px 0px;word-bre=

ak:break-word;">

e=3D"presentation" style=3D"border-collapse:collapse;border-spacing:0px;"><=

tbody>
>

AACUWInqsAAc7XiJIAA-BCcpQAAYKI8DcAoK6BAC0M6QBqpBJgpByjioHbSIeabEJCgimmeQApg=

Tg/1/E7IV_xZvaMVaqQ5Hqkq0Iw/aHR0cHM6Ly9jYW5hZGFwcm9wZXJ0eXNob3cuY2Ev" targe=

t=3D"_blank">3D"Property
://sh4zl.mjt.lu/img2/sh4zl/83dfd362-1f0c-4c06-a6ff-95bf265d8183/content" st=

yle=3D"border:none;display:block;outline:none;text-decoration:none;height:a=

uto;width:100%;font-size:13px;" width=3D"600" height=3D"auto">

dding:0px 0px 0px 0px;padding-top:0px;padding-bottom:0px;word-break:break-w=

ord;">

x;padding:0px 0px 0px 0px;padding-top:0px;padding-bottom:0px;word-break:bre=

ak-word;">

ont-size:13px;line-height:1;text-align:left;color:#000000;">


t-build-content" style=3D"line-height: 14px; text-align: center; margin: 10=

px 0; margin-top: 10px;">
t-size:12px">If you don't like our emails, you can 


=3D"text-build-content" style=3D"line-height: 14px; text-align: center; mar=

gin: 10px 0; margin-bottom: 10px;">
:Arial;font-size:12px">update your
tyle=3D"color:inherit;text-decoration:none;; text-decoration: none;" target=

=3D"_blank" href=3D"https://sh4zl.mjt.lu/unsub2?m=3DEAAACUWInqsAAc7XiJIAA-B=

CcpQAAYKI8DcAoK6BAC0M6QBqpBJgpByjioHbSIeabEJCgimmeQApgTg&b=3D5fb0a808&a=

mp;e=3D94fb3a8e&x=3DBCwpwHREIv6H13pFkkwx5w&hl=3Den_us">
=3D"color:#0000EE;font-family:Arial;font-size:12px">preferences
style=3D"color:#55575d;font-family:Arial;font-size:12px">
style=3D"color:#55575d;font-family:Arial;font-size:12px">or
=3D"link-build-content" style=3D"color:inherit;text-decoration:none;; text-=

decoration: none;" target=3D"_blank" href=3D"https://sh4zl.mjt.lu/unsub2?m=

=3DAUYAAHPnElQAAc6lPsQAA9FtWcgAAYKI_iYAoEvTAC0M6QBocCUcmJ9mT1W7QtmiObGBnsWa=

DQApgTg&b=3Dacc166ac&e=3De9ed69b4&x=3DJXV5YF4Lsy_PYywz1IAQXRtzD=

ekYgNI6e86cGq3ZbC4&hl=3Den">
ial;font-size:12px">
lor:inherit;text-decoration:none;; text-decoration: none;" target=3D"_blank=

" href=3D"https://sh4zl.mjt.lu/unsub2?m=3DEAAACUWInqsAAc7XiJIAA-BCcpQAAYKI8=

DcAoK6BAC0M6QBqpBJgpByjioHbSIeabEJCgimmeQApgTg&b=3D5fb0a808&e=3D94f=

b3a8e&x=3DBCwpwHREIv6H13pFkkwx5w&hl=3Den_us">
0000EE;font-family:Arial;font-size:12px">unsubscribe
=3D"color:#55575d;font-family:Arial;font-size:12px">at any time.

=



f=3D"https://sh4zl.mjt.lu/lnk/EAAACUWInqsAAc7XiJIAA-BCcpQAAYKI8DcAoK6BAC0M6=

QBqpBJgpByjioHbSIeabEJCgimmeQApgTg/0/w0x2g2f2SQLKs6tGZqDcgw/aHR0cHM6Ly9jYW5=

hZGFwcm9wZXJ0eXNob3cuY2Ev?b=3D1">​
ne; display: inline-block;" href=3D"https://sh4zl.mjt.lu/lnk/EAAACUWInqsAAc=

7XiJIAA-BCcpQAAYKI8DcAoK6BAC0M6QBqpBJgpByjioHbSIeabEJCgimmeQApgTg/0/w0x2g2f=

2SQLKs6tGZqDcgw/aHR0cHM6Ly9jYW5hZGFwcm9wZXJ0eXNob3cuY2Ev?b=3D3">


BAC0M6QBqpBJgpByjioHbSIeabEJCgimmeQApgTg/4db09482/e.gif" height=3D"1" width=

=3D"1" alt=3D"" border=3D"0" style=3D"height:1px;width:1px;border:0;"/>



=



--=-kmkdgOQngNnaeyEbbOL9--