Paypal bitcoin Phish from Microsoft Part 4

Posted by Dave Yadallee on
Attendees:



cynthiaperez389903@groups.outlook.com





Pripojiť sa cez Google Meet

Odkaz na stretnutie

meet.google.com/xmn-nhqt-gdh

Dear Customer,



Thank you for your payment. We have successfully received your PayPal transaction for your Bitcoin order.



Order Details:

Payment Method: PayPal

Purchase Type: Bitcoin (BTC)

Total Amount: $750.00

Current Status: Under Review



Your transaction is being verified and will be processed within the standard timeframe.



If this activity was not initiated by you, call +1 804 522 8914 right away.



Best Regards,

Transaction Support Team

Kedy

štvrtok 14. máj 2026

Organizátor

Haresasz Nxysarwsa

haressaznzxrrsxaxz321@gmail.com

Hostia

(Zoznam hostí bol na žiadosť organizátora skrytý)

Odpoveď na cynthiaperez389903@groups.outlook.com

Áno



Nie



Možno

Ďalšie možnosti



Pozvánka z Kalendára Google



Túto správu ste dostali, pretože ste účastníkom danej udalosti.



Ak túto pozvánku prepošlete, ktorýkoľvek jej príjemca bude môcť odoslať odpoveď organizátorovi, byť pridaný do zoznamu hostí, pozývať iných bez ohľadu na ich vlastný stav pozvánky alebo meniť vaše potvrdenie účasti. Ďalšie informácie



Paypal bitcoin Phish from Microsoft Part 3

Posted by Dave Yadallee on
1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[209.85.128.73 listed in will-spam-for-food.eu.org]

[209.85.128.73 listed in will-spam-for-food.eu.org]

[209.85.128.73 listed in will-spam-for-food.eu.org]

[209.85.128.73 listed in will-spam-for-food.eu.org]

[209.85.128.73 listed in will-spam-for-food.eu.org]

[209.85.128.73 listed in will-spam-for-food.eu.org]

[209.85.128.73 listed in will-spam-for-food.eu.org]

[209.85.128.73 listed in will-spam-for-food.eu.org]

[2603:10b6:a03:59e:cafe:0:0:dc listed in]

[will-spam-for-food.eu.org]

[2603:10b6:a03:59e:cafe:0:0:dc listed in]

[will-spam-for-food.eu.org]

[2603:10b6:a03:59e:cafe:0:0:dc listed in]

[will-spam-for-food.eu.org]

[2603:10b6:a03:59e:cafe:0:0:dc listed in]

[will-spam-for-food.eu.org]

[2603:10b6:a03:59e:cafe:0:0:dc listed in]

[will-spam-for-food.eu.org]

[2603:10b6:a03:59e:cafe:0:0:dc listed in]

[will-spam-for-food.eu.org]

[2603:10b6:a03:59e:cafe:0:0:dc listed in]

[will-spam-for-food.eu.org]

[2603:10b6:a03:59e:cafe:0:0:dc listed in]

[will-spam-for-food.eu.org]

[2603:10b6:a03:59e:0:0:0:11 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:a03:59e:0:0:0:11 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:a03:59e:0:0:0:11 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:a03:59e:0:0:0:11 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:a03:59e:0:0:0:11 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:a03:59e:0:0:0:11 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:a03:59e:0:0:0:11 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:a03:59e:0:0:0:11 listed in]

[will-spam-for-food.eu.org]

[40.93.12.17 listed in will-spam-for-food.eu.org]

[40.93.12.17 listed in will-spam-for-food.eu.org]

[40.93.12.17 listed in will-spam-for-food.eu.org]

[40.93.12.17 listed in will-spam-for-food.eu.org]

[40.93.12.17 listed in will-spam-for-food.eu.org]

[40.93.12.17 listed in will-spam-for-food.eu.org]

[40.93.12.17 listed in will-spam-for-food.eu.org]

[40.93.12.17 listed in will-spam-for-food.eu.org]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[40.93.12.17 listed in list.dnswl.org]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-0.0 SPF_PASS SPF: sender matches SPF record

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[40.93.12.17 listed in bl.score.senderscore.com]

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[40.93.12.17 listed in wl.mailspike.net]

-0.0 SPF_HELO_PASS SPF: HELO matches SPF record

0.5 FROM_LOCAL_NOVOWEL From: localpart has series of non-vowel letters

3.5 VOWEL_FROM_7 Impronouncable from header (7+ consecutive vowels)

1.0 HK_RANDOM_REPLYTO Reply-To username looks random

1.0 HK_RANDOM_FROM From username looks random

0.0 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level mail

domains are different

0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider

[haressaznzxrrsxaxz321(at)gmail.com]

-0.0 T_RP_MATCHES_RCVD Envelope sender domain matches handover relay

domain

0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in digit

[haressaznzxrrsxaxz321(at)gmail.com]

0.3 LONGWORD BODY: Uses overlong words

0.1 TW_NH BODY: Odd Letter Triples with NH

0.1 TW_GD BODY: Odd Letter Triples with GD

0.1 TW_RW BODY: Odd Letter Triples with RW

0.1 TW_HQ BODY: Odd Letter Triples with HQ

0.6 MEGALONGWORD BODY: Uses really overlong words

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

2.0 RATWR8_MESSID Message-ID with excessive dashes and dollars

0.6 LONG_INVISIBLE_TEXT Long block of hidden text - bayes poison?

0.2 FREEMAIL_FORGED_FROMDOMAIN 2nd level domains in From and EnvelopeFrom

freemail headers are different

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

0.1 TO_IN_SUBJ To address is in Subject

Subject: {SPAM?} =?UTF-8?Q?Pozv=C3=A1nky=3A_Confirmation_of_PayPal_Payment_for_BTC_Pu?=

=?UTF-8?Q?rchase_=40_=C5=A1t_14=2E_m=C3=A1j_2026_=28cynthiaperez389903=40groups=2Eoutloo?=

=?UTF-8?Q?k=2Ecom=29?=





Haresasz Nxysarwsa has invited you to Confirmation of PayPal Payment for BTC Purchase

Title: Confirmation of PayPal Payment for BTC Purchase

Location: https://meet.google.com/xmn-nhqt-gdh

When: May 14, 2026

Organizer:

Haresasz Nxysarwsa

Description: Dear Customer,



Thank you for your payment. We have successfully received your PayPal transaction for your Bitcoin order.



Order Details:

Payment Method: PayPal

Purchase Type: Bitcoin (BTC)

Total Amount: $750.00

Current Status: Under Review



Your transaction is being verified and will be processed within the standard timeframe.



If this activity was not initiated by you, call +1 804 522 8914 right away.



Best Regards,

Transaction Support Team



-::~:~::~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~::~:~::-

Pripojiť sa cez Google Meet: https://meet.google.com/xmn-nhqt-gdh



Viac o službe Meet sa dozviete na https://support.google.com/a/users/answer/9282720



Túto sekciu neupravujte.

-::~:~::~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~::~:~::-

Paypal bitcoin Phish from Microsoft Part 2

Posted by Dave Yadallee on
X-Microsoft-Antispam-Message-Info:

=?utf-8?B?OHdvSVZzSi9FMS9DRUg2SDNTQzFHQUs2Y1BLdUhkUGQ0SFcxNmI1eVFHVmlo?=

=?utf-8?B?MXZSbjRxa04vQ1ZvNE1lRnJjUFhWZ2lPSS9QZHhEQkdPNVhLeGJXMWtzTk5p?=

=?utf-8?B?OHNseDJydUloeFJXZ3JIWXcveGIyL1dudGtXTGxwdnk5UXRXNXRtNDZVTjVR?=

=?utf-8?B?dUM4aU5uYSt1NU51MjlCbW16ZmN1UFNxVllNa2V3S3pBTEYxMkF4KzBzZVoz?=

=?utf-8?B?R1NpakVHZkNWMk9SS3drbVJvczhzdXUxOEhId2JZbTBpRTBNc3pXVjQweTlQ?=

=?utf-8?B?bm8wWktPOUZRSkh0UnlUcEkrYjN2eHdINmpiT1ZQNnA0RjgyWlcyT0RFRERm?=

=?utf-8?B?RmJXNEo2Z1V5Ukd5WmwwaDl5QkhZd3U0Sk9lT3JlNHdEM0FLdnl2Yk03cDc4?=

=?utf-8?B?YjZFNWxJMzNTSldaOUF2QXZZN3ZWb1NYVWN6dXdDdWt0c3pQTlVwM2lQUFgw?=

=?utf-8?B?WHFEMTNQUmd4WlRhQ3ZLb2dWR3dwcU4xVkM0a1hQd0JiYURmMEJ2TExPWmto?=

=?utf-8?B?N05OWllOT05xL3BveDJveHYwcTllVjZqcDNWMDNYTnlURTNLOFJ5SFRDTHFu?=

=?utf-8?B?SWI0TGNTeVpzVGN0WjRNNVFIcnpOaDFGSm1hd0xpaVoyVmtDQUlaQ0xGZ0NV?=

=?utf-8?B?TWI3eXcwTnk2Mi9MTUZiYmVuVUttdkJXLzMvblk5YVM5WXdkVnMxYTdlaWc0?=

=?utf-8?B?clBjdlVTa3lxMzBEODBLc0Y4ajRBZm1abG5RTkxkVW5ZWUZPY1lKU0FaWU5B?=

=?utf-8?B?L2lTemFhT2JoMVA4b3BhaGc1TXBST0N1cW5WZ2drczRsZzIrczdDVS9wNWFi?=

=?utf-8?B?U2NueitVcGw1dVFJUzMxRmRKNk5tanFNTjhoejI3cDhHKzdibkxkdHhWTXFN?=

=?utf-8?B?TURiWVEvUWQ1dTN1cFd5ekRDcjgyaGx6K1g1ZUw3NnFodzhTU1FJSVg1QlZB?=

=?utf-8?B?T005ZGRWSUlnaEw4WVgyNjFaMFBzTVpicTd0dlgvb2dHNjZMd2VIT1lzYTQ4?=

=?utf-8?B?SGlveVFsUE9oQzNhdE5NbFF0ZjZ0YTBSUTVaOVpnL0NxVEVpYlpCaDhDOTM2?=

=?utf-8?B?NURhNEJoQXVMZWdZSks4ZUVDVDB1cFljcG9iRkIvOS90RkgrRnQ1cm1qbitW?=

=?utf-8?B?TUtFcnNyd0M0OU82Z2xkZ1VjZkhtN0svb2MyL3RENnVBUkdVQ05qRTlQMVVW?=

=?utf-8?B?RU55Y3c4TjdXS0U5WlRaOTM2R0lCZUUweWtBSWJHdjBGbUlCS01QY1dlV0M3?=

=?utf-8?B?WkR5Umhrc1RpWHRSQ0xLZU95eTFsekdaSWVCNHMzWTArUUVvaUx4TGdwK0Fq?=

=?utf-8?B?MjRtbTJ6UFJrNU5RNmNORjlKSjBZZnp3UnBJeS9zMGZ5YmMrOVRpTDhyd0hK?=

=?utf-8?B?RUQ0d2FLV1V0cDJoeHJScUxvcDZZMFdxV3B3OTY1TkFpTWhWZGR6bURsSkI0?=

=?utf-8?B?b3piVDhmSDY1T0RncHorbGc5cjl6QWIrZ2hDQ1BpQmpHTmt1YnpvTVJzTFl3?=

=?utf-8?B?Z0pJUCtBMzhKZzFmbURVRlgwRTl4QkxjOVlQMmZEdmozQTVBbWU4MG9Damxh?=

=?utf-8?B?THV6VWJseHkzclZOU1ZMeFNZbnRKajBUUlhtYVRGWEg0N1FBWmhoNDRXd0wz?=

=?utf-8?B?R2NoZGhnd3BNK0wrU3R4aGtWaDN6YlRuWWllTm5xQmRnSzUyZ0pob1R6QXVJ?=

=?utf-8?B?b2o4ZE9Ya09BMWFDY3JLSnVMUjRaZm5qVitMVGhwcW5nazFGYjBpTFJKNFJO?=

=?utf-8?B?TGEyY3RuT05HdXpkU2ZudlczV2pucGMyaVh1WlhRK01tWEoyTGRyazJaaTM3?=

=?utf-8?B?OU4vVG51SnRsMXQyVmFobHdkZXl5TzR6RUhzNnBpSVNBdjJVc2FIT3hybGJJ?=

=?utf-8?B?ejk2Szh1a3haOHIya3h0cHNqSlZNWFNCM3JZTEZSYjFpRFJYMnVPZUgxZ1Uz?=

=?utf-8?B?ZVVtaTFDV1U1Mk9wVFBzVXA4YmJ5NHg0bzI1RVFFSnY4RjhMS0s2MGYvSDNq?=

=?utf-8?B?RjJkekJTN0hmNTZFMVZoL253WTBQQUd3TU5mY3E5QkVIRklXVythY1laOE1J?=

=?utf-8?B?Z2I3RWpUUzNQRXNsZDhNY1N2ZXArMnVjZkNXK0tkeDhjTmhLSjdFRVFMakFU?=

=?utf-8?B?TG50K3NZMitZeDVVbWpVWlNucC9yT1c3VkhJMTgzMlRDVFNTZlJlaDRxTzha?=

=?utf-8?B?MkdXQWsrSFlZWGYrY2poaDR5Y0FJQnBmVmQxYXcrbU5OWUQ4bmE5eEg1dlBr?=

=?utf-8?B?TGVzeXVjckZPRDlyQXBqN0lXY1lHRlYvRDFwb3BNck1aZHM2OVprNWxnVGRO?=

=?utf-8?B?RFRoZS9FUmdlSFNZaGxkTnk4UWVPK1AxVCtjbm5HV1dTei96STFra1I5U2hn?=

=?utf-8?B?Z2VoK1ZyZ0RiMmEvSit1UFFoVHIza2RvSDc0Mk9Eb0xXc081eDFzWXBVWXA1?=

=?utf-8?B?VWZxSFJkaWRhWWkzWGV2TWp3V1MvVmlDeGg4SDM4NENJdHA4dXpORSswNCti?=

=?utf-8?B?RXJLaWx1eldLVVliWGdTWFYzM0dsVDJKcDB0NjZhdm04a1B0UmFoeCtVNk5L?=

=?utf-8?B?eTFzNEIxL0UxTzNFeHBzaGtzTTVZcndKVFRpd3NlYktnOWNEeFZYc3VQT1pr?=

=?utf-8?B?UHZTalgvTGp5WUp4eENkL05pR3loVjBoZm4reXZNR3hWckhXV3N5MVYzclho?=

=?utf-8?B?NEYzQXl0Q2RsTzhTejFEcWZtekY4VXdXaE9GSEdwV1JOalFweUh3WURMTVZW?=

=?utf-8?B?VFBJZXJJN3RxWmtVMWlkNWRMNzUyOHhKaEJUUFlheUxUK1R1eFdzS3BRRGgv?=

=?utf-8?B?Q2lCRlB5ZUoyK0tZK1hmQXRTMEYzVFJ2MXFzbWFDWnRDWmlkV1RyeFB3MUhn?=

=?utf-8?B?M1RIUFJjR2VuWEtuN0ZwOHVHeUp4QzVDTTUwd2RNSDB4M2lZYno0MjVOdEZM?=

=?utf-8?B?VjNFRzJaUXlqRTg1d2NYNjRGUHZSTThMT1d3aFpoYzIwY0hzVEtnK3hkSjR3?=

=?utf-8?B?Y0d4RVlkeVl5aU10NHJ4OVZNM1M2ZmpTbUtLdWU0UVdkYXVTOWRQSGRDSXR4?=

=?utf-8?B?U0pXSjdLUVRDQmJWbnAwMzZyN09KS2NEMUNTVDQzVmZGenJGWDhZUmxCOHlh?=

=?utf-8?B?OGd1dXAvSEJTZGxjRW1EYkdtU2ozNkVSTkVSa09TdUc2Z0JZSldwYVowa2hr?=

=?utf-8?B?V0dyZ0FwWitSalFqU25JQloyQUxqOGZlQWdETW5wdUplV1ZmQzVTVlI2YlJr?=

=?utf-8?B?S3BaRERnRnNyMnIrV3V0a3N1UUxFejVwZHpFbHJOaEVZOVFtV2VWOGkzWDdN?=

=?utf-8?B?cENtallGcFpCRXc3c01HZWR4bTNDaElia3c2V01kTHlNaEYzdXB2d0NZWCs1?=

=?utf-8?B?Znl0SS91SXZDay9vNUUrQTQwYnF3NHhGd3UzS3VtZndMUGVWZC9oTkViUT09?=

X-Auto-Response-Suppress: DR, OOF, AutoReply

X-OriginatorOrg: sct-15-20-9412-4-msonline-outlook-090a5.templateTenant

X-MS-Exchange-CrossTenant-OriginalArrivalTime: 14 May 2026 15:32:52.7749

(UTC)

X-MS-Exchange-CrossTenant-Network-Message-Id: 46182bad-2620-48eb-c7be-08deb1ce104e

X-MS-Exchange-CrossTenant-Id: 84df9e7f-e9f6-40af-b435-aaaaaaaaaaaa

X-MS-Exchange-CrossTenant-AuthSource: SJ5PEPF000001D6.namprd05.prod.outlook.com

X-MS-Exchange-CrossTenant-AuthAs: Anonymous

X-MS-Exchange-CrossTenant-FromEntityHeader: Internet

X-MS-Exchange-Transport-CrossTenantHeadersStamped: DM3PPF30084BD26

X-Spam_score: 11.5

X-Spam_score_int: 115

X-Spam_bar: +++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Confirmation of PayPal Payment for BTC Purchase Å¡tvrtok 14.

máj 2026 Pripojiť sa cez Google Meet https://meet.google.com/xmn-nhqt-gdh?hs=224

Dear Customer,



Content analysis details: (11.5 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[40.93.12.17 listed in dnsbl.ahbl.org]

[40.93.12.17 listed in dnsbl.ahbl.org]

[40.93.12.17 listed in dnsbl.ahbl.org]

[40.93.12.17 listed in dnsbl.ahbl.org]

[209.85.128.73 listed in dnsbl.ahbl.org]

[209.85.128.73 listed in dnsbl.ahbl.org]

[209.85.128.73 listed in dnsbl.ahbl.org]

[209.85.128.73 listed in dnsbl.ahbl.org]

[2603:10b6:a03:59e:cafe:0:0:dc listed in]

[dnsbl.ahbl.org]

[2603:10b6:a03:59e:cafe:0:0:dc listed in]

[dnsbl.ahbl.org]

[2603:10b6:a03:59e:cafe:0:0:dc listed in]

[dnsbl.ahbl.org]

[2603:10b6:a03:59e:cafe:0:0:dc listed in]

[dnsbl.ahbl.org]

[2603:10b6:a03:59e:0:0:0:11 listed in]

[dnsbl.ahbl.org]

[2603:10b6:a03:59e:0:0:0:11 listed in]

[dnsbl.ahbl.org]

[2603:10b6:a03:59e:0:0:0:11 listed in]

[dnsbl.ahbl.org]

[2603:10b6:a03:59e:0:0:0:11 listed in]

[dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[40.93.12.17 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[40.93.12.17 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[40.93.12.17 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[40.93.12.17 listed in dnsbl.ahbl.org]

Paypal bitcoin Phish from Microsoft Part 1

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 14 May 2026 11:11:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wNZa7-00000000Gsb-1nxW

for dave@doctor.nl2k.ab.ca;

Thu, 14 May 2026 11:10:43 -0600

Resent-From: The Doctor

Resent-Date: Thu, 14 May 2026 11:10:43 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-eastus2azlp17010017.outbound.protection.outlook.com ([40.93.12.17]:11462 helo=BN1PR04CU002.outbound.protection.outlook.com)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wNY4X-000000008wc-1C9k

for doctor@doctor.nl2k.ab.ca;

Thu, 14 May 2026 09:34:18 -0600

Received: from BY1P220CA0043.NAMP220.PROD.OUTLOOK.COM (2603:10b6:a03:59e::11)

by DM3PPF30084BD26.namprd18.prod.outlook.com (2603:10b6:f:fc00::69a) with

Microsoft SMTP Server (version=TLS1_2,

cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.9846.26; Thu, 14 May

2026 15:32:53 +0000

Received: from SJ5PEPF000001D6.namprd05.prod.outlook.com

(2603:10b6:a03:59e:cafe::dc) by BY1P220CA0043.outlook.office365.com

(2603:10b6:a03:59e::11) with Microsoft SMTP Server (version=TLS1_3,

cipher=TLS_AES_256_GCM_SHA384) id 15.20.9891.23 via Frontend Transport; Thu,

14 May 2026 15:32:52 +0000

Authentication-Results: spf=pass (sender IP is 209.85.128.73)

smtp.mailfrom=gmail.com; dkim=pass (signature was verified)

header.d=google.com;dkim=pass (signature was verified)

header.d=gmail.com;dmarc=pass action=none header.from=gmail.com;compauth=pass

reason=100

Received-SPF: Pass (protection.outlook.com: domain of gmail.com designates

209.85.128.73 as permitted sender) receiver=protection.outlook.com;

client-ip=209.85.128.73; helo=mail-wm1-f73.google.com; pr=C

Received: from mail-wm1-f73.google.com (209.85.128.73) by

SJ5PEPF000001D6.mail.protection.outlook.com (10.167.242.58) with Microsoft

SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.25.13

via Frontend Transport; Thu, 14 May 2026 15:32:52 +0000

X-IncomingTopHeaderMarker:

OriginalChecksum:421EB98917E2CC71C1B111CB8827183A29135EF3C9EE4CE2491D382220053BF5;UpperCasedChecksum:6E7496D79C7C7CD1AF8BD7D5DFFBA5FB11FC5E084886D0A30C33B660B3971EF5;SizeAsReceived:3411;Count:15

Received: by mail-wm1-f73.google.com with SMTP id 5b1f17b1804b1-488d1b5bca0so39961395e9.2

for ; Thu, 14 May 2026 08:32:52 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=google.com; s=20251104; t=1778772771; x=1779377571; darn=groups.outlook.com;

h=to:from:subject:date:message-id:sender:reply-to:mime-version:from

:to:cc:subject:date:message-id:reply-to;

bh=qLVyEFC6lgRfkDXdETII17q9tEncztgeDnxy9+o/95o=;

b=l3dixg/GE+WBh7jsKuarkBKYjjC/QGAUiwoUFO6epmx3vs8iP95IzzmTaNNAg/oQD6

+BxBHCL8AT40zVTodVSkPMxa2jLMlBbQHYqsgwXwGhi5SyW7neFh+1A6usIGbm0LIsu+

DpgsuQAXmwvEZvxyqeANXdksY8Ca3olGbE1wCmrgp7XdMrZ9dheQziNjGd8f8fj+6DsY

iEYdupQ2xlQ6j7EYlspYykZcK4Igdi9k3hNpus6hCzDHjZW1K8pYmqXc4oBno8PtqJZ5

ogrnHcGewBbPBP8HFPvmSd2AIrPTTUeWrWRFDmsnbDwofwPAoNUCzl7bkR+0KSfkzyIE

AasQ==

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=gmail.com; s=20251104; t=1778772771; x=1779377571; darn=groups.outlook.com;

h=to:from:subject:date:message-id:sender:reply-to:mime-version:from

:to:cc:subject:date:message-id:reply-to;

bh=qLVyEFC6lgRfkDXdETII17q9tEncztgeDnxy9+o/95o=;

b=YHu+ivkZ1TzrGjigHay+kGx3Ss5bnomRv0b9zprvwWM8vA4Agwt1DjSB5RmxrdgFo4

fhB3IPu7D0MwFgJkHeC/l4vIF5RSwKfPbMksb61LM7aK+/jGAF6TXRvGztyKULu91UYN

YFbucmjNBlfry00k5IRHielccsXZgELRylCrdhR9DcYtR8Q0NY2Mv/feRqaGYzh/TsJs

YVhAPQ/f+vVvraAjCnHStpOjXmG28/IZhDDpC7sVzXjlSOun+fMfK4JWwN4mv01lDThe

UF/raSK1zdyBqO3LEjPuIQQxX2HW7vp7eD0PrBpYhMuX6u5xhSiyOjHPc/Xuo5fgz3b2

l60Q==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20251104; t=1778772771; x=1779377571;

h=to:from:subject:date:message-id:sender:reply-to:mime-version

:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to;

bh=qLVyEFC6lgRfkDXdETII17q9tEncztgeDnxy9+o/95o=;

b=ngg08kUkFCCwZA+rUI91VsxnlSfufBVqJ61s+LnvoivIM0NrTtT37IOvxiBfyR40PH

KE6oRHjPIR0hNHo7+Nsq/nDUBgxSVq4f2kBsQ6vKKHVIdiB8ScRiZ+PPkhthHEJHeQOU

ZGZ/+bAUcSe7b/Q6eQGZABm8pbH5QluuUlqGVuh6b6aiDyPJbLHld5j1WWJwr8Kplx6i

1xvkxMQ4BYGLqdo2IRHD70RG0Kmr1468MwQ1XxvU9RW23+Z9EfD16JMARvJ7Xrx8TDNx

fZ8bANX2SUaZJ4bATEhdW7yqHgvfkir4Bl6UPrch6T7s7H6J5e7CE54vTogjcWW0dROY

QELg==

X-Gm-Message-State: AOJu0YxvBHFnQaxyxybkbnSAkXsITbwb4aCgwP91LAQkvTdn4F6iC4mu

8yfbTflhhSI/ysnS17mrGaKYHGuMIiWFNRP4yFeSlq+mBTXOwwqXJ+lzVjB0NLGdo62nK+QyDRj

WFL5nUlPYfpp6JUVsgGwggjMzOxAVqrtKyvM=

MIME-Version: 1.0

X-Received: by 2002:a05:600c:3507:b0:488:aa33:dcbd with SMTP id

5b1f17b1804b1-48fc9a4b04emr123509115e9.26.1778772771190; Thu, 14 May 2026

08:32:51 -0700 (PDT)

Reply-To: Haresasz Nxysarwsa

Sender: =?UTF-8?Q?Kalend=C3=A1r_Google?=

Message-ID:

Date: Thu, 14 May 2026 15:32:51 +0000

Subject: =?UTF-8?Q?Pozv=C3=A1nky=3A_Confirmation_of_PayPal_Payment_for_BTC_Pu?=

=?UTF-8?Q?rchase_=40_=C5=A1t_14=2E_m=C3=A1j_2026_=28cynthiaperez389903=40groups=2Eoutloo?=

=?UTF-8?Q?k=2Ecom=29?=

From: Haresasz Nxysarwsa

To: cynthiaperez389903@groups.outlook.com

Content-Type: multipart/mixed; boundary="00000000000029bd210651c8cf64"

X-IncomingHeaderCount: 15

X-EOPAttributedMessage: 0

X-EOPTenantAttributedMessage: 84df9e7f-e9f6-40af-b435-aaaaaaaaaaaa:0

X-MS-PublicTrafficType: Email

X-MS-TrafficTypeDiagnostic: SJ5PEPF000001D6:EE_|DM3PPF30084BD26:EE_

X-MS-Office365-Filtering-Correlation-Id: 46182bad-2620-48eb-c7be-08deb1ce104e

X-MS-Exchange-EOPDirect: true

X-Sender-IP: 209.85.128.73

X-SID-PRA: HARESSAZNZXRRSXAXZ321@GMAIL.COM

X-SID-Result: PASS

X-MS-Consumer-Group-Expansion-Loop: cynthiaperez389903@groups.outlook.com

X-MS-Exchange-Group-Expansion-Loop: cynthiaperez389903@groups.outlook.com

X-Microsoft-Antispam:

BCL:0;ARA:1444111002|26000799027|6092099016|3151999006|1680799066|32020799003|22000799015|34130799006|29080799009|5139299004|4040799016|6149299003|9400799043|9020799019|6019299003|970799063|9000799056|16200799027|24102599021|26130799012|1360799030|1041999012|1380799030|21002599022;

Nigerian spam

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 14 May 2026 11:10:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wNZYr-00000000Gm9-3D3b

for dave@doctor.nl2k.ab.ca;

Thu, 14 May 2026 11:09:25 -0600

Resent-From: The Doctor

Resent-Date: Thu, 14 May 2026 11:09:25 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from vmi3264491.contaboserver.net ([80.241.221.132]:46330 helo=server.rss.pt)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wNVlj-00000000Om3-1y6i

for root@nk.ca;

Thu, 14 May 2026 07:06:36 -0600

Received: by server.rss.pt (Postfix, from userid 1002)

id ECF5FCE7E5; Thu, 14 May 2026 15:05:26 +0200 (CEST)

To: root@nk.ca

Subject: Attention

X-PHP-Originating-Script: 1002:newiz.php

From: From Mavine Sollah

Content-Type: text/html; charset=ISO-8859-1

Message-Id: <20260514130526.ECF5FCE7E5@server.rss.pt>

Date: Thu, 14 May 2026 15:05:26 +0200 (CEST)

X-Spam_score: 8.1

X-Spam_score_int: 81

X-Spam_bar: ++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: From Mavine Sollah Attention Are you looking for SBLC/BG Instruments

or personal loan, look no further? We are certified financial Instrument

providers, duly focus on BG/SBLC for Lease and purchase pu [...]



Content analysis details: (8.1 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[80.241.221.132 listed in dnsbl.ahbl.org]

[80.241.221.132 listed in dnsbl.ahbl.org]

[80.241.221.132 listed in dnsbl.ahbl.org]

[80.241.221.132 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[80.241.221.132 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[80.241.221.132 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[80.241.221.132 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[80.241.221.132 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[80.241.221.132 listed in will-spam-for-food.eu.org]

[80.241.221.132 listed in will-spam-for-food.eu.org]

[80.241.221.132 listed in will-spam-for-food.eu.org]

[80.241.221.132 listed in will-spam-for-food.eu.org]

[80.241.221.132 listed in will-spam-for-food.eu.org]

[80.241.221.132 listed in will-spam-for-food.eu.org]

[80.241.221.132 listed in will-spam-for-food.eu.org]

[80.241.221.132 listed in will-spam-for-food.eu.org]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[80.241.221.132 listed in bl.score.senderscore.com]

0.0 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level mail

domains are different

0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider

[mavine.sollah(at)yandex.com]

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

2.0 MIME_HEADER_CTYPE_ONLY 'Content-Type' found without required MIME

headers

0.6 HTML_MIME_NO_HTML_TAG HTML-only message, but there is no HTML tag

0.2 FREEMAIL_FORGED_FROMDOMAIN 2nd level domains in From and EnvelopeFrom

freemail headers are different

0.0 T_HK_NAME_FM_FROM No description available.

0.0 LOTS_OF_MONEY Huge... sums of money

0.9 PHP_ORIG_SCRIPT Sent by bot & other signs

0.4 KHOP_HELO_FCRDNS Relay HELO differs from its IP's reverse DNS

0.7 TO_NO_BRKTS_FROM_MSSP Multiple formatting errors

0.7 SPOOFED_FREEMAIL No description available.

0.0 FROM_MISSP_FREEMAIL From misspaced + freemail provider

Subject: {SPAM?} Attention



>From Mavine Sollah



Attention



Are you looking for SBLC/BG Instruments or personal loan, look no further?



We are certified financial Instrument providers, duly focus on BG/SBLC for Lease and purchase purposes.



Our Lease BG/SBLC is 4+2% and purchase at 32+2% from AAA top rated banks in Europe. Our expertise lies in opening Bank Guarantees and Standby Letters of Credit, along with a suite of other Financial and Banking Instruments, is it for leasing or purchasing purposes, we have got you covered.



Purchase Instrument of BG/SBLC : 32%+2% Minimum Face Value = EUR/USD 1M-10B.



Lease Instrument of BG/SBLC : 4%+2% Minimum Face Value = EUR/USD 1M-10B.



The procedure.



i. LESSEE: After proper due diligence, the Lessee will fill, sign and mail the Deed Of Agreement [DOA] to the Lessor.



ii. LESSOR: After proper diligence, the Lessor will fill and countersign the Dead Of Agreement [DOA] “hereby the Deed of Agreement will be rendered as a full recourse contract”. Then the Lessor will email a copy of the contract to the Buyer.



iii. LESSOR: Within the period of two banking days, the Lessor will advise the issuing bank officer to transmit RWA LETTER [ready, willing and able] by BANK TO BANK SECURED EMAIL SYSTEM to the Lessee’s receiving bank.





We also offer personal and business loans ranging from USD$50,000 to USD$1M. As soon as you express interest, we will guide you through our detailed bureaucratic terms.



Financial Aid Consultant

Yours Faithfully,

Mavine Sollah



Accounting spam from Microsoft Outlook Part 3

Posted by Dave Yadallee on


 
span>



Please let me know =

a convenient time.



 
span>



Best regards,<=

/o:p>



Sabina Morgan<=

/o:p>



 
span>






0in 0in">


e">From: Sab=

ina Morgan




Sent: Tuesday, May 12, 2026 5:15 PM


To: sabina.morgan.02@outlook.com


Subject: Re: Simplifying Canadian Taxes & Payroll
an>







 



Hi,
n>



 
span>



I hope you’re=

doing well.



 
span>



I wanted to follow =

up on my previous email regarding our accounting and finance support servic=

es. We help businesses streamline bookkeeping, payroll, tax filings, GST/HS=

T compliance, and CRA reconciliations

with accurate and timely support.



 
span>



I understand priori=

ties can get busy, but I’d be happy to schedule a quick 10-minute con=

versation to see if there’s any area where we could support your curr=

ent workflow.



 
span>



Please let me know =

a time that works best for you.



 
span>



Best regards,<=

/o:p>



Sabina Morgan<=

/o:p>



 
span>






0in 0in">


e">From: Sab=

ina Morgan




Sent: Monday, May 11, 2026 4:34 PM


To: sabina.morgan.02=

@outlook.com


Subject: Canadian Accounting & Tax Services
>





 



Hello,



 



Hope you are well.



 



I wanted to reach out to see if you’re current=

ly exploring reliable accounting and finance support.



 



Our team provides end-to-end accounting solutions=

, including:



 




=3D"0" width=3D"843" style=3D"width:632.0pt;margin-left:-.15pt;border-colla=

pse:collapse">






































r:solid windowtext 1.0pt;padding:0in 5.4pt 0in 5.4pt;height:15.0pt">


ze:11.0pt;line-height:115%;color:black;mso-ligatures:none">Tax Filings=
er:solid windowtext 1.0pt;border-left:none;padding:0in 5.4pt 0in 5.4pt;heig=

ht:15.0pt">


11.0pt;line-height:115%;color:black;mso-ligatures:none">T2 Corporate Tax Re=

turns, T4/T4A Information Slips, T5018 Construction Subcontractor Filings, =

Dividend Reporting.

r:solid windowtext 1.0pt;border-top:none;padding:0in 5.4pt 0in 5.4pt;height=

:15.0pt">


ze:11.0pt;line-height:115%;color:black;mso-ligatures:none">Sales Tax
o:p>
er-top:none;border-left:none;border-bottom:solid windowtext 1.0pt;border-ri=

ght:solid windowtext 1.0pt;padding:0in 5.4pt 0in 5.4pt;height:15.0pt">


11.0pt;line-height:115%;color:black;mso-ligatures:none">GST/HST Return Prep=

aration, PST Compliance, and ITC (Input Tax Credit) Optimization.
>

r:solid windowtext 1.0pt;border-top:none;padding:0in 5.4pt 0in 5.4pt;height=

:15.0pt">


ze:11.0pt;line-height:115%;color:black;mso-ligatures:none">Audit Defense
p>
er-top:none;border-left:none;border-bottom:solid windowtext 1.0pt;border-ri=

ght:solid windowtext 1.0pt;padding:0in 5.4pt 0in 5.4pt;height:15.0pt">


11.0pt;line-height:115%;color:black;mso-ligatures:none">CRA Account Reconci=

liation (RP, RC, RT), Matching Opening Balances to T2, Adjusting Journal En=

tries.

r:solid windowtext 1.0pt;border-top:none;padding:0in 5.4pt 0in 5.4pt;height=

:15.0pt">


ze:11.0pt;line-height:115%;color:black;mso-ligatures:none">Payroll
p>
er-top:none;border-left:none;border-bottom:solid windowtext 1.0pt;border-ri=

ght:solid windowtext 1.0pt;padding:0in 5.4pt 0in 5.4pt;height:15.0pt">


11.0pt;line-height:115%;color:black;mso-ligatures:none">QBO & QBD Payro=

ll Management, Source Deduction Remittances, PD7A Reporting.
an>


 



We deliver accurate, timely, and compliant financial=

support tailored to your needs.



 



Would you be open to a short 10-minute chat to se=

e how it could fit your workflow?



 



Best regards,



Sabina Morgan











--_000_CH3P220MB16827BA544E10A05C0B8DC94D0072CH3P220MB1682NAMP_--

Accounting spam from Microsoft Outlook Part 2

Posted by Dave Yadallee on
Hi,



I hope you're doing well.



Just following up on my previous emails regarding our accounting and financ=

e support services for Canadian businesses. We help with bookkeeping, payro=

ll, tax filings, GST/HST compliance, CRA reconciliations, and related accou=

nting support.



If you're open to it, I'd be happy to schedule a quick 10-minute call to se=

e how we can support your workflow.



Please let me know a convenient time.



Best regards,

Sabina Morgan



From: Sabina Morgan

Sent: Tuesday, May 12, 2026 5:15 PM

To: sabina.morgan.02@outlook.com

Subject: Re: Simplifying Canadian Taxes & Payroll



Hi,



I hope you're doing well.



I wanted to follow up on my previous email regarding our accounting and fin=

ance support services. We help businesses streamline bookkeeping, payroll, =

tax filings, GST/HST compliance, and CRA reconciliations with accurate and =

timely support.



I understand priorities can get busy, but I'd be happy to schedule a quick =

10-minute conversation to see if there's any area where we could support yo=

ur current workflow.



Please let me know a time that works best for you.



Best regards,

Sabina Morgan



From: Sabina Morgan

Sent: Monday, May 11, 2026 4:34 PM

To: sabina.morgan.02@outlook.com

Subject: Canadian Accounting & Tax Services



Hello,



Hope you are well.



I wanted to reach out to see if you're currently exploring reliable account=

ing and finance support.



Our team provides end-to-end accounting solutions, including:



Tax Filings

T2 Corporate Tax Returns, T4/T4A Information Slips, T5018 Construction Subc=

ontractor Filings, Dividend Reporting.

Sales Tax

GST/HST Return Preparation, PST Compliance, and ITC (Input Tax Credit) Opti=

mization.

Audit Defense

CRA Account Reconciliation (RP, RC, RT), Matching Opening Balances to T2, A=

djusting Journal Entries.

Payroll

QBO & QBD Payroll Management, Source Deduction Remittances, PD7A Reporting.



We deliver accurate, timely, and compliant financial support tailored to yo=

ur needs.



Would you be open to a short 10-minute chat to see how it could fit your wo=

rkflow?



Best regards,

Sabina Morgan



--_000_CH3P220MB16827BA544E10A05C0B8DC94D0072CH3P220MB1682NAMP_

Content-Type: text/html; charset="us-ascii"

Content-Transfer-Encoding: quoted-printable




osoft-com:office:office" xmlns:w=3D"urn:schemas-microsoft-com:office:word" =

xmlns:m=3D"http://schemas.microsoft.com/office/2004/12/omml" xmlns=3D"http:=

//www.w3.org/TR/REC-html40">




>








break-word">



Hi,
n>



 
span>



I hope you’re=

doing well.



 
span>



Just following up o=

n my previous emails regarding our accounting and finance support services =

for Canadian businesses. We help with bookkeeping, payroll, tax filings, GS=

T/HST compliance, CRA reconciliations,

and related accounting support.



 
span>



If you’re ope=

n to it, I’d be happy to schedule a quick 10-minute call to see how w=

e can support your workflow.

Accounting spam from Microsoft Outlook Part 1

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 14 May 2026 06:18:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wNV0U-00000000IHi-10ag

for dave@doctor.nl2k.ab.ca;

Thu, 14 May 2026 06:17:38 -0600

Resent-From: The Doctor

Resent-Date: Thu, 14 May 2026 06:17:38 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-centralusazolkn19011031.outbound.protection.outlook.com ([52.103.13.31]:58128 helo=DM5PR21CU001.outbound.protection.outlook.com)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wNUvX-00000000HqR-0sWK

for root@nk.ca;

Thu, 14 May 2026 06:12:41 -0600

ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none;

b=Q7swoeCFMyLJE7f9ZJQO5AgP+PN3L0tvPpNaznSh7SS0X+pv7DgpnEwraNkuPncJFvAVAixbReM7bJejkZvcAjhbnI3C7MKMX0sSiO/Sz3a4Bh9y2vJGb6YmIe0G4hPwUnFg6K0YL2ltcbnmN5x3jJcmNQ2q7VrrDTjX/w6kvWnLJPosHE5jauT6qy3hiR5oNJz7cd8xv3bqY5hfueNohnRIlDXuBnxMcbJ+IpHPrG4cGhMCjqKAXH55095fDA/ERRTkP2ju7zSJmlHMUVqDG3+MQTurIE/DaecPbgxjob8QF5cTaC850AUJScfrBlKay9be78OSIlBAEz77hERjYg==

ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;

s=arcselector10001;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1;

bh=rn9XYskGwtvNA37vJXwJa/Rg3eQtEgH5Og0mzf/0Uro=;

b=O75LZ09PxfCxHUqBOnzdlddLB3Dnb9hW4+Q/o5uop8e5j8Jkd74ZPlK46JYEp7XussLlvHndlyL77fBzBJdBMliPnC6bLXeqg8oqC2aEdTUxmDNkN/FnjDsCkemeUbkV2jbDva5CYrI0Lq6pjRolVsL4GKRO5p/I4rubfJ5VvL5a3AydHRGrSl3oLtaP1l4blinIlpigpWrvSNrwBntAiXjaF24iXhZfMxuoLoRLWfK8iSJI1c5pG4RcsUjLM7ft1rHdn99L2JUiQf1HoAOQpWIWmluZm4bMmqA5yh5XRJIOXTcaWCJ4suDPVPvjm7j4PkqLPIGS3D7mWhvQRG+EZQ==

ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=none; dmarc=none;

dkim=none; arc=none

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=outlook.com;

s=selector1;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck;

bh=rn9XYskGwtvNA37vJXwJa/Rg3eQtEgH5Og0mzf/0Uro=;

b=F7GDmAMOppGUW4fqPxNFavYzeWveH3JO/vf9U5Om1Kqs6Buadvnw5Re5oyznMwVvz9i926gUk1FnG9yvm+7uXHqAo1yN4Q4VGLqwfWrYgILM5QL1mVWdM/lze13/FkFLfvJS0P5SSYFAYmx/onn9YEwi+abt/OycCyOyi6jB+ER8T14/2S+Ykbdj2IU1k6ellY3IhkjZ6yE9zOfCuQ+fgzkzDHWbFIhu8e9xXLaKrstKUzw7WYVC4NMfSRZBnZn3nK9PakkXnPm/+lngX0XSqNZ6+BV+e+BOG3ceIOfyNa28l9f/xx2S4dplbjS9RTlvl6wNV/WuxLNGXtVVgYnIbw==

Received: from CH3P220MB1682.NAMP220.PROD.OUTLOOK.COM (2603:10b6:610:1c5::19)

by EA2P220MB1642.NAMP220.PROD.OUTLOOK.COM (2603:10b6:303:256::14) with

Microsoft SMTP Server (version=TLS1_2,

cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.9913.12; Thu, 14 May

2026 12:11:27 +0000

Received: from CH3P220MB1682.NAMP220.PROD.OUTLOOK.COM

([fe80::bbf2:4535:dcea:17db]) by CH3P220MB1682.NAMP220.PROD.OUTLOOK.COM

([fe80::bbf2:4535:dcea:17db%5]) with mapi id 15.20.9913.009; Thu, 14 May 2026

12:11:27 +0000

From: Sabina Morgan

To: Sabina Morgan

Subject: Re: Canadian Business Tax & Payroll Solutions

Thread-Topic: Canadian Business Tax & Payroll Solutions

Thread-Index: AQHc45rJ58d1i2QfqUmddMxh7PBaCg==

Disposition-Notification-To: Sabina Morgan

Date: Thu, 14 May 2026 12:11:25 +0000

Message-ID:



References:















In-Reply-To:



Accept-Language: en-US

Content-Language: en-US

X-MS-Has-Attach:

X-MS-TNEF-Correlator:

x-ms-publictraffictype: Email

x-ms-traffictypediagnostic: CH3P220MB1682:EE_|EA2P220MB1642:EE_

x-ms-office365-filtering-correlation-id: d755d4e9-ed6e-4caa-4c26-08deb1b1eca3

x-microsoft-antispam:

BCL:0;ARA:14566002|55001999006|16051099003|24021099003|15080799012|2604032031799003|31061999003|24121999003|22091999003|37011999003|704163111799003|13091999003|39105399006|12121999013|48001999003|8062599012|12050799012|19110799012|8060799015|41001999006|41105399003|39145399003|40105399003|3412199025|440099028|18071099003|102099032|1710799026;

x-microsoft-antispam-message-info:

=?us-ascii?Q?VrBtXF9VVHRTzi6+/QyGgBZTOYLNDwyGwjpyycPiNtMnQXCaou/LNRD/m4Rw?=

=?us-ascii?Q?AFmkkEjpH10Ipw2zzjt53Y1d9xHfEVZ5ADVzAtgoCkK/4gxfkT2ygAna1zWm?=

=?us-ascii?Q?sC7BngtJDMqtbXnef/PaHVF3VmEJEfSixJbdrNJfKWbuQHA3iDzt8H8Eus1l?=

=?us-ascii?Q?KNgBDnFrTK60lbSkAGZ0qd1aHw3M3QJZlBrR1A+fznLbz7Y4CSb24fjsggyr?=

=?us-ascii?Q?sTylg5Hi0c/HPn0JLbx0++cvBodFJwB0nncRAhcfj25FQwcjAS7P1+goY70P?=

=?us-ascii?Q?xKTqQIWQkIBX1eVodsSLdzje9PjeYgPGVYSqeawnGTvSWo9rBx0aHAepEeC6?=

=?us-ascii?Q?17YhALeZeYyOuv+4l0bjK2bkKfpIDO4gQAtj9OTDId6Fw1B6I1RmxVfQ1TOo?=

=?us-ascii?Q?f4kpHMl0TUufquk5TlqQPsnjJ9HmjoEujCKXo0eQGv+1pgW5x5ox+wwXEOW9?=

=?us-ascii?Q?LUfgJFZPFlMkWoUcI3TGuxdSzBqgvbYpoGqzdEwNita/Y7IxlBQok8V4Gxi7?=

=?us-ascii?Q?EjCYgu3k2MWVhMNcaesJX4SzKUMjJz4JMuJrUU64YqpsyipyXGCbd46ulMoH?=

=?us-ascii?Q?l7sfN59LgGy7UygX+Y315PnLnVp5WP6iUfkq/vsAAa8MjcID5tTAxxJDEDDy?=

=?us-ascii?Q?NOGShSAKk961FVPQBkNl0ZkStuBUChh/rFuKYStWXCQVAWmq8TfbRd0w0fx3?=

=?us-ascii?Q?4OAdfpcKhHiTZkaOcMV91+VPRoT4JL0JjjuTy2yISYwJSNdBJVaGPbA+nUig?=

=?us-ascii?Q?1rJrpcSeEqMRhkUvx80924fkbXdGU29MyJhs60GFI0JGJmwElXywT6mtdmP5?=

=?us-ascii?Q?qRLZrrKVycsmQiVMpjyQ5edEtReAse40Kul51tUwCLXSIgyBOMROC6jqn4N+?=

=?us-ascii?Q?DEV/0Vl+sYsBIfpVC1mG0MPTKYCe7EMYVHaWQPbV1G3lpu1eYFguzP8Uu987?=

=?us-ascii?Q?aCwOzoxS3j67lSHO4INnQzMt4LIMH0OyZR5sBb4gXVu1yn8yefv9BkApov9D?=

=?us-ascii?Q?SIRDN2qe0xWVaAXkiZJepzh/PyKdDn3V1gOKddkyELf6bBCT1FfzHxxSnbWW?=

=?us-ascii?Q?nZb63w/uI0LD4EOewz7itOkrgJLV7yj2YmyhGDmujgYy2jPb7T7l4I98lOy2?=

=?us-ascii?Q?m/BEMzGDlWjcXZ4ffp4N1vStmrHhkFJ4n9ZW1Os8ypmmePvhNNDd2PRUB2yG?=

=?us-ascii?Q?7HXslNVY2BmXO24IbGejm33RvFesjGBRfycpQ7xPNlEf1qz2Fi0bXlXPA6fz?=

=?us-ascii?Q?8PKF4t3wX1NzbhSOfs9knHlmN5mHjmxJtOlwgQpJFDDvqd9r6CJZL4zOQLrC?=

=?us-ascii?Q?CpqdmoRpcrFDs66eYfaEam2xc9r5NVO3lYVUr0HJ3aEw5JJBHo7UcAvDrzuU?=

=?us-ascii?Q?dMFYypYgpt0r4JDJbRKxVBDh6pclXFxGGnhlLYn8y4oUoyVbLRbIfQaqyMc6?=

=?us-ascii?Q?q66lw1rMrKwoQNRBs5pV4l47lXuwaCD+Mcq9sjMM3Oapz/5KxrjugA=3D=3D?=

x-ms-exchange-antispam-messagedata-chunkcount: 1

x-ms-exchange-antispam-messagedata-0:

=?us-ascii?Q?B2iYfql98EMDnX0b2bWqmaBvoqUt9VKSJYzmPXkm0DjG4DlGGfwTWeL9XZp2?=

=?us-ascii?Q?hg9Qi4C894U/ncM3o5JZXE9PFDgluz+JO6BJbARW+sD68/N6QJ6b7aDKomb0?=

=?us-ascii?Q?a8us9NYOUi2C1LVhQfdCoAH38S6N981CjuzrmTufiZgpYMy6c/mYFl3/hhAj?=

=?us-ascii?Q?WCJmTcimjrRyMhXk970bYYRhQt8D7gO0JQRfCJQyAxFUBkzO6EDtXfQ8cKxh?=

=?us-ascii?Q?A1yN8soQxdL2SFtvKfqJwXUOd8+qwsi5lXyLqr0b4fBO1nm1wR6lsEu88A4g?=

=?us-ascii?Q?s4BalODSdt7tZTyJkHe8BrLis/AHSJaH6/PN8cVlPSWmntrK2veMJQhVOYGG?=

=?us-ascii?Q?OdSDLT6rtbMVQLeWYmr0HNsgDCuU89kaFXwOd1w5zf5ZUCxPktVpv5uRtGIL?=

=?us-ascii?Q?KpMwI+6gh8WEKwgNtxvSHMUQdaAWwCzax2JnOuj23cOHZ38Sko0+sRgIkdtK?=

=?us-ascii?Q?6T2Ddk7uN+ZE07VpUI8PuRx6aCQr7SXa3jMwMunMCNvXqSi90uasZJ+K8dbz?=

=?us-ascii?Q?wIHumgaVkBDCkrt0IRMsI0pLq5T6g5p8LaDhY6xPOHk2s7PorQrn5HO+oQ6s?=

=?us-ascii?Q?TIHvwMGYZCNpyCH1BlPGoAn2q8gJru14QN71eegwhdyNoSCzzuOcSMvxzjkO?=

=?us-ascii?Q?iDnPMtcHCUhmXTNuTeMX0ncefZNFjCytZ20EEyyAy+++y2J4NlCXnTkyzRsf?=

=?us-ascii?Q?sCdRK9sGVh20U/leMRQc28MNZEIh30w8LjetUyYZEzgINX7Sa+T39RmXCfE0?=

=?us-ascii?Q?/qeDWYl8a5GqR4jVn1ErshjY75diyO59vgiEbCpmTMzN17CiLJN9y0soQ9xl?=

=?us-ascii?Q?qvcRMCyMR918t6NVX4WdN8Tw32ezvqINYO/Xg8O+X8mOHzOQyZTFzOFQ6sZT?=

=?us-ascii?Q?0vWennWUX/9rLsLpq3363jw/HyfUpekEVwdxQPczxBm80f4XQPiFXineNhtT?=

=?us-ascii?Q?JzQlmtvi87u5Bme33ug4tBihnpf5JRxyolMHardTaRkXsipXEnirrxOj2NE+?=

=?us-ascii?Q?jwLqwYKHkrzyaD/Bs/QpKwxz9W5HOkaAqRdaVmLsLsvbC/crKzIumRipPFAa?=

=?us-ascii?Q?NeQECxCvN2dxWKjcAf9CkfPiUk3XqB3FKK+YBIGQoVIxR72QPKxEuCcQy//v?=

=?us-ascii?Q?jactwnRrtfmP0B2CoHXWS1E7EVSg5ItHDwbX4a4d9gzXxdZAQfUAGn0rfP7q?=

=?us-ascii?Q?4/JXjIkFyamzSAHwLUYC6F51RLzwq6BPVvk2GHeHGqp+5vzwgbkN727HV0eA?=

=?us-ascii?Q?/rGZFtSQz/TVRjnebhxYYcRFy99LhaJx9bBLFWToZYL+h+bsjVQNhuXxvN6j?=

=?us-ascii?Q?JujP8/Z3CfkFIjkTA6p5HrYoB0eKDGTjs7E2dQtitNuvM4LNoDZJi4OPwXXV?=

=?us-ascii?Q?p7Qq8MYVuF452jEVZiB8MUNJCLNu?=

Content-Type: multipart/alternative;

boundary="_000_CH3P220MB16827BA544E10A05C0B8DC94D0072CH3P220MB1682NAMP_"

MIME-Version: 1.0

X-OriginatorOrg: outlook.com

X-MS-Exchange-CrossTenant-AuthAs: Internal

X-MS-Exchange-CrossTenant-AuthSource: CH3P220MB1682.NAMP220.PROD.OUTLOOK.COM

X-MS-Exchange-CrossTenant-RMS-PersistedConsumerOrg: 00000000-0000-0000-0000-000000000000

X-MS-Exchange-CrossTenant-Network-Message-Id: d755d4e9-ed6e-4caa-4c26-08deb1b1eca3

X-MS-Exchange-CrossTenant-originalarrivaltime: 14 May 2026 12:11:25.6538

(UTC)

X-MS-Exchange-CrossTenant-fromentityheader: Hosted

X-MS-Exchange-CrossTenant-id: 84df9e7f-e9f6-40af-b435-aaaaaaaaaaaa

X-MS-Exchange-CrossTenant-rms-persistedconsumerorg: 00000000-0000-0000-0000-000000000000

X-MS-Exchange-Transport-CrossTenantHeadersStamped: EA2P220MB1642



--_000_CH3P220MB16827BA544E10A05C0B8DC94D0072CH3P220MB1682NAMP_

Content-Type: text/plain; charset="us-ascii"

Content-Transfer-Encoding: quoted-printable

Sensitive document phish

Posted by Dave Yadallee on
Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 14 May 2026 06:18:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wNV0C-00000000IGR-1WYc

for dave@doctor.nl2k.ab.ca;

Thu, 14 May 2026 06:17:20 -0600

Resent-From: The Doctor

Resent-Date: Thu, 14 May 2026 06:17:20 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from pl14.fakat.net ([46.4.55.35]:59083)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wNTp1-000000000l6-0P0e

for sales@nk.ca;

Thu, 14 May 2026 05:01:52 -0600

DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed;

d=resortunapark.ba; s=default; h=Content-Type:MIME-Version:Date:

Content-Transfer-Encoding:Message-ID:Subject:To:From:Sender:Reply-To:Cc:

Content-ID:Content-Description:Resent-Date:Resent-From:Resent-Sender:

Resent-To:Resent-Cc:Resent-Message-ID:In-Reply-To:References:List-Id:

List-Help:List-Unsubscribe:List-Subscribe:List-Post:List-Owner:List-Archive;

bh=7Pa6IgtKT4HxdBlbBjrQLSP1e90+Pn5SBConkm96FXM=; b=bywo8RSPxs1McxCrGO7TMCg6P0

z/gG8jpdCFJar4sZynNRHPhwI3tAH5pOByqepY2yVLP9cfKzL9+WpOZbWy/4w30O9jypzYwNZxxHd

Faa8L2hUYS5WuN0NxXuHtWES68Kl/T27osCRCRn/uO9sdCF1TN2j8LI0Az6UoFePeO9b0DOuJxoBR

U0SpY0DVK4H80xe9sxBwfVlqtORiy+5ufUIsQSmw+K8ihEtF6uS6eaWPeDxVYoXGfyrTpxc/OAtvZ

v/sXAhe5czqzEjs5SaTcpzUCEkg8cFYY/fnIgA5enIxU7ZfkwaZELe1HRAATwLR5ndaaN1LxlU0sC

eCOfwGDg==;

Received: from v2202109156138162946.hotsrv.de ([202.61.201.108]:56692 helo=[127.0.0.1])

by pl14.fakat.net with esmtpsa (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.99.2)

(envelope-from )

id 1wNTo4-00000004Ncn-1xpI

for sales@nk.ca;

Thu, 14 May 2026 13:00:44 +0200

X-Mailer: PHP/5.6.30

X-Ms-Exchange-Organization-Messagedirectionality: Originating

X-Ms-Exchange-Organization-Authas: Internal

X-Ms-Exchange-Organization-Authmechanism: 87

X-Ms-Exchange-Organization-Authsource: T4kKBMB7364.prod.outlook.com

X-Ms-Exchange-Organization-Network-Message-ID:

7bd12b92e8a54c33bf293d70737eb5f3

X-Ma4-Node: false

From: Leo Parker

To: sales@nk.ca

Subject: Invoicing Information - IDENTIFIER: oYkuQGlvbrAeRps

Message-ID: <62f45315-a092-5307-7d17-9618d9aa69b6@resortunapark.ba>

Content-Transfer-Encoding: quoted-printable

Date: Thu, 14 May 2026 11:00:43 +0000

MIME-Version: 1.0

Content-Type: text/html; charset=utf-8

X-AntiAbuse: This header was added to track abuse, please include it with any abuse report

X-AntiAbuse: Primary Hostname - pl14.fakat.net

X-AntiAbuse: Original Domain - nk.ca

X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12]

X-AntiAbuse: Sender Address Domain - resortunapark.ba

X-Get-Message-Sender-Via: pl14.fakat.net: authenticated_id: resortun/from_h

X-Authenticated-Sender: pl14.fakat.net: resortun@resortunapark.ba

X-Source:

X-Source-Args:

X-Source-Dir:

X-Spam_score: 5.9

X-Spam_score_int: 59

X-Spam_bar: +++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: You've been granted acsf_rand(3,20)cess to protected docsf_rand(3,20)ument...

Accsf_rand(3,20)ess Docsf_rand(3,20)ument



Content analysis details: (5.9 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[46.4.55.35 listed in dnsbl.ahbl.org]

[46.4.55.35 listed in dnsbl.ahbl.org]

[46.4.55.35 listed in dnsbl.ahbl.org]

[46.4.55.35 listed in dnsbl.ahbl.org]

[202.61.201.108 listed in dnsbl.ahbl.org]

[202.61.201.108 listed in dnsbl.ahbl.org]

[202.61.201.108 listed in dnsbl.ahbl.org]

[202.61.201.108 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[46.4.55.35 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[46.4.55.35 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[46.4.55.35 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[46.4.55.35 listed in dnsbl.ahbl.org]

-0.0 SPF_PASS SPF: sender matches SPF record

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[202.61.201.108 listed in will-spam-for-food.eu.org]

[202.61.201.108 listed in will-spam-for-food.eu.org]

[202.61.201.108 listed in will-spam-for-food.eu.org]

[202.61.201.108 listed in will-spam-for-food.eu.org]

[202.61.201.108 listed in will-spam-for-food.eu.org]

[202.61.201.108 listed in will-spam-for-food.eu.org]

[202.61.201.108 listed in will-spam-for-food.eu.org]

[202.61.201.108 listed in will-spam-for-food.eu.org]

[46.4.55.35 listed in will-spam-for-food.eu.org]

[46.4.55.35 listed in will-spam-for-food.eu.org]

[46.4.55.35 listed in will-spam-for-food.eu.org]

[46.4.55.35 listed in will-spam-for-food.eu.org]

[46.4.55.35 listed in will-spam-for-food.eu.org]

[46.4.55.35 listed in will-spam-for-food.eu.org]

[46.4.55.35 listed in will-spam-for-food.eu.org]

[46.4.55.35 listed in will-spam-for-food.eu.org]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[46.4.55.35 listed in bl.score.senderscore.com]

0.1 TW_LV BODY: Odd Letter Triples with LV

0.1 TW_VB BODY: Odd Letter Triples with VB

1.3 HTML_IMAGE_ONLY_24 BODY: HTML: images with 2000-2400 bytes of words

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 HTML_OBFUSCATE_05_10 BODY: Message is 5% to 10% HTML obfuscation

2.0 RATWR8_MESSID Message-ID with excessive dashes and dollars

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

0.0 MANY_SPAN_IN_TEXT Many tags embedded within text

0.0 T_REMOTE_IMAGE Message contains an external image

Subject: {SPAM?} Invoicing Information - IDENTIFIER: oYkuQGlvbrAeRps








charset=3Dutf-8">
padding:0; margin:0; font-family: 'Open Sans', Arial, sans-serif; =

font-size: 14px">


url('https://s3.us-east-2.amazonaws.com/myoppeml/assets/big_O_bkgd@1x.png')=

no-repeat top left;">










border-top-left-radius: 10px; border-top-right-radius: 10px; padding: 30px =

20px; font-size: 20px;">


src=3D"https://auth.services.adobe.com/img/generic/adobe_logo_white.svg" =

width=3D"100">



bold;">





s: 10px; border-bottom-right-radius: 10px; padding: 30px; font-size: 16px; =

line-height: 1.7em;">



You've been granted acsf_rand(3,=

20)cess to protected docsf_rand(3,=

20)ument...









Only users in this organisation has =

access to view or modify this dosf_rand(3,=

20)cument.




12px;">

 






alt=3D"">

WEb/SEo/App Spam from Google Gmail

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 14 May 2026 04:47:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wNTaZ-00000000MvL-2Hjc

for dave@doctor.nl2k.ab.ca;

Thu, 14 May 2026 04:46:47 -0600

Resent-From: The Doctor

Resent-Date: Thu, 14 May 2026 04:46:47 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-dl1-f70.google.com ([74.125.82.70]:44404)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wNRte-000000008km-3bYV

for sales@nk.ca;

Thu, 14 May 2026 02:58:31 -0600

Received: by mail-dl1-f70.google.com with SMTP id a92af1059eb24-13312be8a31so4409292c88.1

for ; Thu, 14 May 2026 01:57:35 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=websitedevelopercalifornia.com; s=google; t=1778749049; x=1779353849; darn=nk.ca;

h=to:from:subject:date:message-id:reply-to:mime-version:from:to:cc

:subject:date:message-id:reply-to;

bh=GFW8FyAlZspjQ8CjjgGEaVUxDaDh500kkQyan8VMbNc=;

b=koUhv5Ljg2Qhsk0PCpWXBTEuNzpbLd2OfxT7R9wDiCJxSB72U3h3eX66ai3QpASApv

TwfWh/YQasMVGsdGrChcmh1hmBlWRXpDhb5DudNbIBx1dCEMw331bDSTZxU9+XpHFExf

zNs0gNWH6UY/t9WJm0Kfc6h3kOONlzm8g+r8U=

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20251104; t=1778749049; x=1779353849;

h=to:from:subject:date:message-id:reply-to:mime-version

:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to;

bh=GFW8FyAlZspjQ8CjjgGEaVUxDaDh500kkQyan8VMbNc=;

b=mrIlgA9bsmkXDnR4RttSPAK9PHP+Se4aMAGGaGR1rpktCN9OAx0BMG1p8ZIvhGediw

5eXjSfG2D9JRJ4YHwIEjxYXNBxtqVEgBJidku2axko+y486ZBBRzwtbFyKd3N/4PBFyQ

KF7mc9Qw3giLRbhkA7nqTGtM+/UPhASXgsu2kPQbvm0PznyoBzZjk0Cr6ZowDMLxlyED

uPKYlPxYuDBIIzExoZ8Q5ewLySmf5znL+PqIwwyLG/9D9AULOVvEC0Y95hAkK+5w9CW1

3xSZjvjZkjky5MHi/ShdPDie2CaPPgO63fr5JOtb93r8/s+ghYHgnqRbYwhdd27L2Fn7

Y2KA==

X-Gm-Message-State: AOJu0YwHGF2OPlEckd//XkQ0Sy6ml5dAqIYcI3WF5/Y8lAVGjmDAVNwu

9iqmxROTBGvhID7AVYt62WxBLBjfLvob1cOHELtxwbbrL35HH1IZDL/AJ2zHS/WY8TwAQX+s5HV

MzLaODKHd1D9mjpvuP5bfPA==

MIME-Version: 1.0

X-Received: by 2002:a05:690c:6e83:b0:7bd:6a98:58db with SMTP id

00721157ae682-7c6aa413740mr71877597b3.22.1778748593613; Thu, 14 May 2026

01:49:53 -0700 (PDT)

Reply-To: Info@websitedevelopercalifornia.com

Message-ID:

Date: Thu, 14 May 2026 08:49:53 +0000

Subject: Re: Could we set up a meeting?

From: june@websitedevelopercalifornia.com

To: sales@nk.ca

Content-Type: multipart/alternative; boundary="000000000000113bf80651c32e7f"

X-Spam_score: 9.1

X-Spam_score_int: 91

X-Spam_bar: +++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Hi, I came across your website www.nk.ca and noticed it has

strong potential. With SEO, your business can gain more visibility, attract

targeted customers, and achieve steady growth compared to ads. Without SEO,

however, competitors may capture your audience, your online presence may

stay restricted, and valuable opportunities can be missed.



Content analysis details: (9.1 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[74.125.82.70 listed in dnsbl.ahbl.org]

[74.125.82.70 listed in dnsbl.ahbl.org]

[74.125.82.70 listed in dnsbl.ahbl.org]

[74.125.82.70 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[74.125.82.70 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[74.125.82.70 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[74.125.82.70 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[74.125.82.70 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[74.125.82.70 listed in will-spam-for-food.eu.org]

[74.125.82.70 listed in will-spam-for-food.eu.org]

[74.125.82.70 listed in will-spam-for-food.eu.org]

[74.125.82.70 listed in will-spam-for-food.eu.org]

[74.125.82.70 listed in will-spam-for-food.eu.org]

[74.125.82.70 listed in will-spam-for-food.eu.org]

[74.125.82.70 listed in will-spam-for-food.eu.org]

[74.125.82.70 listed in will-spam-for-food.eu.org]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-0.0 SPF_PASS SPF: sender matches SPF record

1.7 URIBL_BLACK Contains an URL listed in the URIBL blacklist

[URI: websitedevelopercalifornia.com]

1.9 URIBL_JP_SURBL Contains an URL listed in the JP SURBL blocklist

[URI: websitedevelopercalifornia.com]

1.9 URIBL_ABUSE_SURBL Contains an URL listed in the ABUSE SURBL blocklist

[URI: websitedevelopercalifornia.com]

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[74.125.82.70 listed in list.dnswl.org]

-0.0 RCVD_IN_MSPIKE_H3 RBL: Good reputation (+3)

[74.125.82.70 listed in wl.mailspike.net]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[74.125.82.70 listed in bl.score.senderscore.com]

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

2.0 RATWR8_MESSID Message-ID with excessive dashes and dollars

-0.0 RCVD_IN_MSPIKE_WL Mailspike good senders

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

Subject: {SPAM?} Re: Could we set up a meeting?



--000000000000113bf80651c32e7f

Content-Type: text/plain; charset="UTF-8"; format=flowed; delsp=yes



Hi,



I came across your website www.nk.ca and noticed it has strong potential.

With SEO, your business can gain more visibility, attract targeted

customers, and achieve steady growth compared to ads.



Without SEO, however, competitors may capture your audience, your online

presence may stay restricted, and valuable opportunities can be missed.



Would you like me to share a tailored SEO plan with details?



Thank You!!



--000000000000113bf80651c32e7f

Content-Type: text/html; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable



Hi,

I came across your website www.nk.ca and noticed it has strong p=

otential. With SEO, your business can gain more visibility, attract targete=

d customers, and achieve steady growth compared to ads.

Without SEO,=

however, competitors may capture your audience, your online presence may s=

tay restricted, and valuable opportunities can be missed.

Would you =

like me to share a tailored SEO plan with details?

Thank You!!


--000000000000113bf80651c32e7f--

Chinese spam

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@nk.ca

Delivery-date: Thu, 14 May 2026 00:45:00 -0600

Received: from out0-7.static.mail.aliyun.com ([59.82.0.7]:35038)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wNPnu-00000000M8i-3TXY

for dave@nk.ca;

Thu, 14 May 2026 00:44:28 -0600

X-Alimail-AntiSpam:AC=CONTINUE;BC=0.8502186|0.7928596;BR=01201311R841S95rulernew999_84748_200303;CH=yellow;DM=|SPAM|false|;DS=CONTINUE|ham_alarm|0.107512-0.0794212-0.813067;FP=2274828657281376505|0|0|0|0|-1|-1|-1;HT=maildocker-contentspam033045213054;MF=jojo.x@win-globaldata.com;NM=1;PH=DS;RN=58;RT=0;SR=0;TI=SMTPD_---.hWpp.oN_1778741000;

Received: from OS-20250105HJWK(mailfrom:jojo.x@win-globaldata.com fp:SMTPD_---.hWpp.oN_1778741000 cluster:ay29)

by smtp.aliyun-inc.com;

Thu, 14 May 2026 14:43:23 +0800

Date: Thu, 14 May 2026 14:43:20 +0800

From: jojo.x

Message-ID:

Subject: =?utf-8?B?6auY6YCa6IOA5pe25Luj77yMMjAyNuW5tOiuoeeul+WFieWIuw==?=

=?utf-8?B?6L2v5Lu26KGM5Lia5biC5Zy66LCD5p+l5pWw5o2u5oql5ZGK?=

X-Mailer: MailMasterPC/4.19.4.1001 (Win10 22H2)

X-MailMaster-ShowOneRcpt: 1

X-CUSTOM-MAIL-MASTER-SENT-ID: A03FDEE3-6D0D-491A-9E92-0FA1F79526FB

MIME-Version: 1.0

Content-Type: text/html; charset="utf-8"

Content-Transfer-Encoding: base64





您好，近期我司出版一份付费市场调查报告—《2026年全球与中国计算光刻软件市场现状及未来发展趋势》。

报告着重研究计算光刻软件行业竞争格局，重点分析全球主要厂商产能、销量、收入、产品价格和市场份额，全球产地、销地分布情况等。

此外针对计算光刻软件行业产品分类、应用、产业链、生产模式、销售模式、行业政策、行业发展有利因素、不利因素和进入壁垒也做了详细分析。

如果您有兴趣了解更多内容，可以为您提供一份样品（可选中、英文），以供参考。

全球及国内主要厂商包括：

ASML, KLA, Siemens, Synopsys, Cadence, Dongfang Jingyuan Electron Co., Ltd., Yuwei Optics

......

如果此份报告不适合您，请帮忙转发给贵司的市场部或管理层，感谢您的协助。此外，我司还出版其他产品的调查分析，如有需要，烦请告知。

谢谢您的阅读，顺祝商祺！





------------------

Best Regards

Jojo Yang | Global Sales Manager

E-mail: jojo@winmarketresearch.com

Phone/WeChat/WhatsApp: +86-18026352358 (7*24)

TEL: US: +1-888-365-4458(US) +1-202-499-1434(Int'L)

USA Office: 17890 Castleton Street Suite 369 City of Industry CA 91748 United States

China Office: VILI International Building No.167 Tianhe District Guangzhou City China

Nexcess Phish Part 2

Posted by Dave Yadallee on


------=_NextPart_000_7695_5E87E50C.E1ECABF9

Content-Type: text/plain;

charset="utf-8"

Content-Transfer-Encoding: quoted-printable







Notice Ref: ADMIN-BILL-77291

Mandatory Update of Account Billing Information

Dear sales@nk.ca,

During a recent administrative audit of your Nexcess Services account, our =

system identified that your current billing credentials are either incomple=

te or have expired.

Attention: Failure to maintain valid billing information may result in a di=

sruption of your hosted services and automated suspension of your account a=

ccess.

To ensure uninterrupted service continuity, we require you to verify and up=

date your administrative profile through our secure billing portal immediat=

ely.

Access Billing Management Panel

For further assistance regarding this compliance requirement, please contac=

t our billing department directly at support@Nexcess.net.







Best Regards,

Billing Administration Department

Nexcess Services

This is a system-generated administrative notification. Please do not reply=

directly to this email.

=C2=A9 2026 Nexcess Services. All Rights Reserved.=20=



------=_NextPart_000_7695_5E87E50C.E1ECABF9

Content-Type: text/html;

charset="utf-8"

Content-Transfer-Encoding: quoted-printable







Urgent: Account Administrative Action Requir=<br /><br /> ed










acing=3D0 cols=3D1 cellPadding=3D0 width=3D"100%" align=3Dleft border=3D0><=

tbody>




lPadding=3D0 width=3D"100%" align=3Dleft border=3D0>







3D"Nexce=<br
ss" src=3D"https://sm.pcmag.com/pcmag_me/review/n/nexcess-we/nexcess-web-ho=

sting_x5sc.jpg">=20





Notice Ref: ADMIN-BILL-77291


Mandatory Up=

date of=20

Account Billing Information



Dear sales@nk.ca,



During a recent administrative audit of your Nexcess=20

Services account, our system identified that your current billing=

=20

credentials are either incomplete or have expired.



Attention: Failure to maintain va=

lid=20

billing information may result in a disruption of your hosted services and=

=20

automated suspension of your account access.


To ensure uninterrupted service continuity, we require =

you=20

to verify and update your administrative profile through our secure billing=

=20

portal immediately.





For further assistance regar=

ding=20

this compliance requirement, please contact our billing department directly=

at=20

support@Nexcess.net.




0px; BORDER-LEFT: 0px; MARGIN: 25px 0px">



Best Regards,
Billing=20

Administration Department
Nexcess Services



This is a system-generated administrative notificatio=

n. Please=20

do not reply directly to this email.
=C2=A9 2026 Nexcess Services. All R=

ights=20

Reserved.




------=_NextPart_000_7695_5E87E50C.E1ECABF9--

Follow up spam from Google Gmail

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 14 May 2026 04:47:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wNTZv-00000000MfK-1HoY

for dave@doctor.nl2k.ab.ca;

Thu, 14 May 2026 04:46:07 -0600

Resent-From: The Doctor

Resent-Date: Thu, 14 May 2026 04:46:07 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-qk1-f196.google.com ([209.85.222.196]:61834)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wNPNb-00000000K68-2WD4

for root@nk.ca;

Thu, 14 May 2026 00:17:17 -0600

Received: by mail-qk1-f196.google.com with SMTP id af79cd13be357-90f850473f9so204738485a.3

for ; Wed, 13 May 2026 23:16:20 -0700 (PDT)

ARC-Seal: i=1; a=rsa-sha256; t=1778739374; cv=none;

d=google.com; s=arc-20240605;

b=AIYS9l4qmeyuoe7lYRi+2ShgNEdmKRSaqRR405SFLKq3CJ+5Q3dQTg4CYB2GweSDsO

DK62omFJ8ZkbB1ltndXMkV67lANvdEozFCaL504G6hk/C2Zv2hhAlsEJndVbgwxwqOUu

QhxAoXKIBEkKuceOX9SdUq43HgN4HfYmp6OgjJ6nTKj3DwTYuzFntXtIBps8LNBUwmon

X/JqBj3kd/IItcNMUNm6EqGzrwas2OIS09PyUgV/75noKMCVdANzMhPkoaVh3bWdLPfo

+dA83yjusUOXwtDaBfWQb23A75yFG5N0I0fi3ZweRL/CPxUksaX5qtez1b64J/8+ByTU

OFog==

ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20240605;

h=to:subject:message-id:date:from:mime-version:dkim-signature;

bh=jAhtNbVkyUYVopTduQYINAuDwGdf5tSkX5IbrBSumbE=;

fh=ny7+SATv4n6lSNl0rVMQyaj6POVJTUZJLShjjgjSTJg=;

b=ThVB6k1/T2v16u42eGCakbXuKAt4kjFLNau65S2W1c83/eGeQftQKGsk130kLEDmk+

ZnppLhgo+24saviLGt0JAvSLFHbv+pMaiw11U8X3laMr8xdbfBXT4eKuLmTIJ48uBSNz

fmzCVsnS8SNeBLCMuAcA3rhCGHQwjVxqYG+IUkgtDQGIQbOto0pZptxUn5JP31+xD9bY

evfB9xCuUe6c7zQAF795sL15oDRGjy//s3Sjo9gkam/ch5Oq5D7cneIzK3VF+hTnQaPQ

txNt4lJUM9vl8Xo1jhUvGCFsglaiILB5nHX8Hr3b2utixV4tD6mFwsKg3ezpsSpfn2Il

CmhQ==;

darn=nk.ca

ARC-Authentication-Results: i=1; mx.google.com; arc=none

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=gmail.com; s=20251104; t=1778739374; x=1779344174; darn=nk.ca;

h=to:subject:message-id:date:from:mime-version:from:to:cc:subject

:date:message-id:reply-to;

bh=jAhtNbVkyUYVopTduQYINAuDwGdf5tSkX5IbrBSumbE=;

b=pHOVymijtOl77TLwRUlHBKq1Z+ms0H7/t5kqQDfS715yt7jc3uVpJxB17Q8uCFIK3e

jqOwfhcgOkmJaQHLwcNPBpQCz4FMaIcvjorDR2QHbYFQnOo6kPqH120wbABlDSpMOMHW

So97dCLb7hQWV/BszfoR4/gY7wyjPMuetyliCL29/iuLYuliU4PBmLjW23WVvHfQb2TP

Jg4nIQetYgms6mkBuYA4uJc58ufStFcRFNR0SU4m+wePEkJ5c5h4J7yTVAXcYo8dPrJM

0rtfONB2m6bMtDTStKfLIf5FjL/Riuv78jYJB9jTqfRCF3MCYuWwnDiiipcZZR75H5fF

BCRQ==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20251104; t=1778739374; x=1779344174;

h=to:subject:message-id:date:from:mime-version:x-gm-gg

:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to;

bh=jAhtNbVkyUYVopTduQYINAuDwGdf5tSkX5IbrBSumbE=;

b=jjqgbr8c2Dyft9l7Ued3wDcXfwGFVv9l3hles7wlY+Jq7Sjk2t2las92Q4EfQ3CFcT

cjARUPxHg3PAFG2KPR6Abb/hoUgKqma9OTa38q3u0C1XdDowXik/iJ3B7d771uOuDt2Z

avzFAar65gp6+hJgfGTz0zvZN6VgQKB0kR/B0vZ/CvMWUSZMbAi+jgcZHHEsB6+bw7b/

T4c0BE7Zgsznw/xwtEK+vDggXnwP+L4O+eV0GcbVJ5dOwGdM62pmkWLNPbsnZ0gS73de

Vsoe7LnrtGP/zdEympF0xg3QO/rh96x4AipVtGIbr3VNHx+RdEckPlZ+bn3y4xHJqwjP

//bw==

X-Gm-Message-State: AOJu0YyOyr4DDj7+SB5lUSP2tX2VV3ibBEXPaVw51swVMk9CDzgjS+Ik

TH77tmFFkOhIOyDKw5lsHEvkaEGcmMAi2WeaN15AxrAYATFixx1JZ2ECLjH5uPwtt/6Md3iYTOk

TuM0N86ElkfnsJb+n+plUEMBh4yi54c9q2SatWPLglh//

X-Gm-Gg: Acq92OHGBy01D95od3+rHF+BwSSm0BRuzTPLlXneesZcJSRSehqfPf/Su13FZx8E19w

AFnqHMk0g5PbA0/6XxLSPT35ZpUY6JLIeutY2O0GY4vK4yvAaYw4QGm9+Lo/TRGl54OMKH8r1dX

g5lcY67VArroBGCPaDIQm6r/VC2SZwrw9Ss1kdDn6n6vq1pzpYBrTVFf7XQc7wny8uggCWA7N5L

H1eI+A6pZ7gdsnSzs+WD4M3OIeVh0pV1+rt0uWrojBc4kSAhH/sZ0TRPYda7WQaQWaPyKxk8yBc

LiAwpN+ZgI4Am2S3qfURM+Q=

X-Received: by 2002:a05:620a:7107:b0:90f:786c:8961 with SMTP id

af79cd13be357-90facf9e2cfmr937189385a.39.1778739373361; Wed, 13 May 2026

23:16:13 -0700 (PDT)

MIME-Version: 1.0

From: Onur Genc

Date: Thu, 14 May 2026 07:15:50 +0100

X-Gm-Features: AVHnY4IYDxhUXdQlZEACQ8gHHyzahuNliApfmKWM53P_bfzYX1GghqFxTpfobiI

Message-ID:

Subject: Service request

To: root@nk.ca

Content-Type: multipart/alternative; boundary="0000000000007f4ef30651c108b5"



--0000000000007f4ef30651c108b5

Content-Type: text/plain; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable



Greetings,



I have tried to reach out to you in the past but you seems not active,

Let me know if it's okay for me to send specifics of a proposal to your

email address since I have it from LinkedIn.



Warm regards,

Onur Gen=C3=A7..

Chief Executive Officer.



[image: Your profile picture]



--0000000000007f4ef30651c108b5

Content-Type: text/html; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable





=3D"gmail_signature" data-smartmail=3D"gmail_signature">

iv style=3D"color:rgb(34,34,34);font-family:"Helvetica Neue",Helv=

etica,Arial,sans-serif">

f">Greetings,

nt-family:Arial,Helvetica,sans-serif"><=

br>
<=

span style=3D"color:rgb(0,0,0)">I have tried to reach out to you =C2=A0i=

n the past but you seems not active, Let me know if it's okay for me to=

send specifics of a proposal to your email address since I have it from Li=

nkedIn.

f">

y:Arial,Helvetica,sans-serif">
Warm =

regards,
Onur Gen=C3=A7=

..
Chief Executive Officer.

>

t=3D"Your profile picture" width=3D"96" height=3D"96" style=3D"border-width=

:medium;border-style:none;border-color:currentcolor;border-radius:50%;max-w=

idth:288px;font-family:"Google Sans Flex","Google Sans Text&=

quot;,"Google Sans",Roboto,Arial,sans-serif;background-color:rgb(=

248,250,253)">
<=

/div>




--0000000000007f4ef30651c108b5--

Nexcess Phish Part 1

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Wed, 13 May 2026 19:56:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wNLIQ-000000004Kv-2bDR

for dave@doctor.nl2k.ab.ca;

Wed, 13 May 2026 19:55:30 -0600

Resent-From: The Doctor

Resent-Date: Wed, 13 May 2026 19:55:30 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from smtp2-2213.emaillabs.net.pl ([185.243.31.188]:35606)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wNKWp-00000000GXJ-2klb

for sales@nk.ca;

Wed, 13 May 2026 19:06:29 -0600

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=newsletter.noreplaysender.xyz; s=default; t=1778720725;

bh=bGrCBiVjpnHKJpJVEFwX4SxWgtJJnNKYtvvqxxghY14=;

h=From:To:Subject:Date:Feedback-ID;

b=KVmLepF7ODFOQOUkSLQXzz13vKY88twYfbsJZ6KKbt4BEeUrcSgpOY/lyc6rx/9Ur

BqrBAVWAZWdtC82r7FUo4/Mf4t7GrOeaPs2rnOtfjxe6tFth5HHEBIHsMu2Jv8r1kE

0BHdVxoH857NH9iACb2zmYTHEzBMDorfD3y8Hi8Jcn0a00JX43xVnIypQTijp3v6PC

a9n6FST1fGMfcEQLcod26z0GLb3K70G5DxvQZos41FLOL1UcmEgoYCCcmg5/rHeZlJ

fJYYy2j+zD1X8AIGlV28ZtLgRkhQaPY5PeusNpwvU9krFtWshT1kNJnydT4Nfu7Hyu

WF5BkW4qblcLw==

MIME-Version: 1.0

X-Mailer: Microsoft Outlook 14.0

Reply-To: "Nexcess"

Message-ID:

X-Priority: 1 (Highest)

From: "Nexcess"

To: sales@nk.ca

Subject: Urgent: Account Administrative Action Required

Date: Wed, 13 May 2026 21:05:00 -0400

Content-Type: multipart/alternative;

boundary="----=_NextPart_000_7695_5E87E50C.E1ECABF9"

Feedback-ID: :click.newsletter.noreplaysender.xyz:1.nexuscrafttrading.smtp:default

X-Sid: info@newsletter.noreplaysender.xyz

X-Return-Path:

X-Spam_score: 11.9

X-Spam_score_int: 119

X-Spam_bar: +++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Notice Ref: ADMIN-BILL-77291 Mandatory Update of Account

Billing Information Dear sales@nk.ca, During a recent administrative audit

of your Nexcess Services account, our system identified that your cu [...]





Content analysis details: (11.9 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[185.243.31.188 listed in dnsbl.ahbl.org]

[185.243.31.188 listed in dnsbl.ahbl.org]

[185.243.31.188 listed in dnsbl.ahbl.org]

[185.243.31.188 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[185.243.31.188 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[185.243.31.188 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[185.243.31.188 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[185.243.31.188 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[185.243.31.188 listed in will-spam-for-food.eu.org]

[185.243.31.188 listed in will-spam-for-food.eu.org]

[185.243.31.188 listed in will-spam-for-food.eu.org]

[185.243.31.188 listed in will-spam-for-food.eu.org]

[185.243.31.188 listed in will-spam-for-food.eu.org]

[185.243.31.188 listed in will-spam-for-food.eu.org]

[185.243.31.188 listed in will-spam-for-food.eu.org]

[185.243.31.188 listed in will-spam-for-food.eu.org]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-0.0 SPF_PASS SPF: sender matches SPF record

0.7 FROM_FMBLA_NEWDOM From domain was registered in last 7 days

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[185.243.31.188 listed in bl.score.senderscore.com]

2.0 PDS_OTHER_BAD_TLD Untrustworthy TLDs

[URI: newsletter.noreplaysender.xyz]

[(xyz)]

1.5 DEAR_EMAIL BODY: Message contains Dear email address

0.5 L_HELLO_ADDRESS BODY: Greets you by address, not by name

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.5 FROM_SUSPICIOUS_NTLD From abused NTLD

2.0 FROM_SUSPICIOUS_NTLD_FP From abused NTLD

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

0.8 SARE_FROM_SPAM_WORD3 I don't know people named this!

1.0 XPRIO Has X-Priority header

1.4 DOS_OUTLOOK_TO_MX Delivered direct to MX with Outlook headers

Subject: {SPAM?} Urgent: Account Administrative Action Required

Follow up spam from Google Gmail

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Wed, 13 May 2026 19:56:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wNLI2-000000003no-3wz0

for dave@doctor.nl2k.ab.ca;

Wed, 13 May 2026 19:55:06 -0600

Resent-From: The Doctor

Resent-Date: Wed, 13 May 2026 19:55:06 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-ej1-f65.google.com ([209.85.218.65]:50660)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wNIZ0-000000007Ct-1fdc

for root@nk.ca;

Wed, 13 May 2026 17:00:35 -0600

Received: by mail-ej1-f65.google.com with SMTP id a640c23a62f3a-bcb5370bb0dso1076404966b.1

for ; Wed, 13 May 2026 15:59:38 -0700 (PDT)

ARC-Seal: i=1; a=rsa-sha256; t=1778713171; cv=none;

d=google.com; s=arc-20240605;

b=b82SU/UmttVfeG9wkLxFVb5rn348LU6KvlcKNpt1negB5Kv0lPM8/iapmfoZY2ckvj

/4GX0g7KZZeYpRNsTn1c2gVBhpxhESU5UX2f1QvqQcj1Wg9snBhfBep7EniDEpDPDwLO

vbw0AKwD0iyS4HZ5civSGwaKwAQrpMaLHdFCeBPmnuMXT1hZ4XFgBYiHckLBP/aPiMov

goJfTFK+URCzRs+1irNV4V0RbRqZdMBBM5xsLi9kvcmt/JmVwM5AesM8PCM/Xm+3vNYv

jGRCjB8HoWVksgP+M3hQCX780a8jMMb28QJEUhpFV9r8qMu8heHOKjRKMQdZQ8kStrr1

Ajlg==

ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20240605;

h=to:subject:message-id:date:from:mime-version:dkim-signature;

bh=IeyKm+J5Zin1MRG7E74zjOvTTyuq+EJ0fBPrB7qPr5g=;

fh=okLrRxdcQ5S5mQ3G3iQaC7KbaU25FN62J8W+dLvpK/A=;

b=RIkg3OEYAT6SLpLq8nNlT4fnxeoFF5uClrVVohPRYMUyhAGCZ2uesm1ayV5Mh/xT7X

74JLGUeBOp8eZrxcr1GORnnFV36/UOarayH4FW06vT99Luo+EuSa6qpCD5wMbtjFzwDb

FC3o3EgOGVkfAP+vyQSkgrdxP2Dxtt64ehyUHNyuj/f6BdFRH+jHmgJ1rmvyyQlF5Sxp

aDqBbh6U9fAZQazvqAUKULRE8KI/+Jc4BzysyP6W96cldiyxltmcbgn93zem+JJrycJ4

OSmcRA/dtmUNpmOGJq9syaEGW/KCsBcYbvkTRE8MPz7FS/P0QpJdmMQlJkpMMh54GQrO

9B6g==;

darn=nk.ca

ARC-Authentication-Results: i=1; mx.google.com; arc=none

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=gmail.com; s=20251104; t=1778713171; x=1779317971; darn=nk.ca;

h=to:subject:message-id:date:from:mime-version:from:to:cc:subject

:date:message-id:reply-to;

bh=IeyKm+J5Zin1MRG7E74zjOvTTyuq+EJ0fBPrB7qPr5g=;

b=qzt06iPq4ODeBl9dJk3+YVhlEVxPxTEulXnZykbrWPtjoLZ2HfaLfVxHAPVj+13v7B

uabh4U0GrEhYsj7hYKJhrjpGUqkKocTphf0+6Wy+5zbCp5Kj7hic5vLgc9gJSpYaaL83

2QTs4ocqcU1d5jaxaHvFOLgZTkAHHwlpCZk5pMYMzVeCYWoqQArttTNr/uvRob9aZRzS

8CwEB2hgIqM4Mh4KqCVnfWus/MXkATdTlixB2iXMf03Xn7f4FHJzZJWkODNUlFMaoPtk

jLIdmvzTnShvH/qNdtnpBm1yCiolp7FUgNhId8fzfGoRoSqYrw950BOzikWN7X0Xf6KA

Y+UA==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20251104; t=1778713171; x=1779317971;

h=to:subject:message-id:date:from:mime-version:x-gm-gg

:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to;

bh=IeyKm+J5Zin1MRG7E74zjOvTTyuq+EJ0fBPrB7qPr5g=;

b=gq8GXbmdmW0OvHsasJ33NpX5fT7KJ+nHV7ML28nR5+Sf3WoCD8pDV7dMsGv89NUNc+

aLL54AAbCySeEG3aOJYaIWlvTPybSrkMdf5EWmSKu7cwAA3jRPX05Q5KoEdke3ay9XwG

zYyJ8n/pgAIkC5aqIgykowBAGbZMxncmfga01aSy8XRw2jRZ7FyyU8aGB0S1PfsXRDrE

if5HZWzbAPkS+DSeVL4QTuEZCBgIpsHcK5S5EQQTTK1EfXgYzOvlKLdWoBZHP/qkhP44

P2QczK6/LDfQyn+y1BIiQbGf+dMvG7Z5sLEl2/cfQPEqJH6YFEK3AV7BpFUi8QCYWmFk

rR2g==

X-Forwarded-Encrypted: i=1; AFNElJ9wqneOd3s/edYgJ6Ebn8WsRk3/vllJBCr0x/skKf08Ed3mNdA9df5Q40/1dO8gitJ3daAD@nk.ca

X-Gm-Message-State: AOJu0YzupOlQBCCAvdA4FhyG0za8Y+8QMbnnJ1F/88F57xgj79VZHKAX

J9fptdGzLoVm91G+2E85yBAV00EsZce4scWtDK1+SSwp8xFSO8QadVQkvqDQhP84d2+F4JFNTvj

WjprVIbzXBPqDPbK3z/mC2BvFjKUDDYY=

X-Gm-Gg: Acq92OHA5cuauQmyGL+YYIMD7VRzfNWCn4y1GTLhXifHuNL4Ks2Ow96UqLriU6BY31U

1anmMfH674wgFOZ3DEz/JoibCP+L6mQk23mxfvPOGCmMeHVjyouS7NBT3+RC1yybi/FLro0/ejK

e78yA8WgLFmqaEHj1HIVKvFgbunNX5rCKvePCoO1gRChYoW0pVHQe1lCcEPYCuxCtkCvw4h4QJR

nRL4MB6FUTeMeEnkzdfjaXCnFug/YsO2KFuDaMsgq2oah8wuXjZxCiPAvSv2UF1RdNp9dbr7lHT

yCRPf8b+ZOyCIJPNKwpNeMM2

X-Received: by 2002:a17:907:7f8b:b0:bc4:c901:20fc with SMTP id

a640c23a62f3a-bd3c1400c9emr357009566b.30.1778713171556; Wed, 13 May 2026

15:59:31 -0700 (PDT)

MIME-Version: 1.0

Received: by 2002:a17:906:af48:b0:bc2:a455:439 with HTTP; Wed, 13 May 2026

15:59:30 -0700 (PDT)

From: Jessica Jessica

Date: Wed, 13 May 2026 15:59:30 -0700

X-Gm-Features: AVHnY4K70BRIU3AhRrUjnO5dqHkKmVJDAMu82rLsFOh6ZEPHFk2m6kEo7l6sG4Y

Message-ID:

Subject: hello

To: undisclosed-recipients:;

Content-Type: multipart/alternative; boundary="000000000000bf7f030651baeea4"

Bcc: root@nk.ca



--000000000000bf7f030651baeea4

Content-Type: text/plain; charset="UTF-8"



Good day,

I didn't get your response from my previous

email. Kindly get back to me as soon as

possible.



Thank you.

jessica



--000000000000bf7f030651baeea4

Content-Type: text/html; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable



Good day,
I didn't get your response from my previous
email. Kind=

ly get back to me as soon as
possible.

Thank you.=C2=A0
>
jessica=C2=A0




--000000000000bf7f030651baeea4--