Business Development Spam from Google Gmail Part 2

Posted by Dave Yadallee on




------=_NextPart_000_081C_01DD0F8B.7E0572E0

Content-Type: text/html;

charset="us-ascii"

Content-Transfer-Encoding: quoted-printable




xmlns:o=3D"urn:schemas-microsoft-com:office:office" =

xmlns:w=3D"urn:schemas-microsoft-com:office:word" =

xmlns:m=3D"http://schemas.microsoft.com/office/2004/12/omml" =

xmlns=3D"http://www.w3.org/TR/REC-html40">
HTTP-EQUIV=3D"Content-Type" CONTENT=3D"text/html; =

charset=3Dus-ascii">
(filtered medium)">
style=3D'word-wrap:break-word'>


class=3DMsoNormal>Hi, hope you’re =

doing well!


style=3D'color:black'> 


class=3DMsoNormal>Would you be interested in =

reaching Decision-makers at companies using Hosting infrastructure =

and CMS technologies across the USA and =

Canada?


style=3D'color:black'> 


class=3DMsoNormal>Technologies users =

included:


style=3D'color:black'>·       &=

nbsp; cPanel


style=3D'color:black'>·       &=

nbsp; Plesk


style=3D'color:black'>·       &=

nbsp; WHMCS


style=3D'color:black'>·       &=

nbsp; Cloud Linux


style=3D'color:black'>·       &=

nbsp; LiteSpeed


style=3D'color:black'>·       &=

nbsp; VMware


style=3D'color:black'>·       &=

nbsp; WordPress


style=3D'color:black'>·       &=

nbsp; Drupal


style=3D'color:black'>·       &=

nbsp; Joomla and more


style=3D'color:black'> 


class=3DMsoNormal>If this sounds useful, we =

can share details along with counts and rates based on your =

target criteria.


style=3D'color:black'> 


class=3DMsoNormal>Just let us know your =

preferred technology, geography, and job =

titles.


style=3D'color:black'> 


class=3DMsoNormal>Please let me know your =

thoughts.
style=3D'mso-ligatures:none'>


class=3DMsoNormal>
style=3D'mso-ligatures:none'> 


class=3DMsoNormal>
style=3D'font-size:11.5pt;mso-ligatures:none'>Best Regards, =


style=3D'font-size:11.5pt;mso-ligatures:none'>Emily Parker | Business =

Development Executive


class=3DMsoNormal>If =

you would like to no longer receive emails, reply =

“remove”



------=_NextPart_000_081C_01DD0F8B.7E0572E0--



Business Development Spam from Google Gmail Part 1

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 09 Jul 2026 09:06:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1whqJB-00000000CER-2Baz

for dave@doctor.nl2k.ab.ca;

Thu, 09 Jul 2026 09:05:01 -0600

Resent-From: The Doctor

Resent-Date: Thu, 9 Jul 2026 09:05:01 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-oa1-f51.google.com ([209.85.160.51]:41789)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1whpVW-00000000Pdv-30QC

for sales@nk.ca;

Thu, 09 Jul 2026 08:13:52 -0600

Received: by mail-oa1-f51.google.com with SMTP id 586e51a60fabf-4498f3b4910so76567fac.3

for ; Thu, 09 Jul 2026 07:12:55 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=leadzenixb2b-com.20251104.gappssmtp.com; s=20251104; t=1783606369; x=1784211169; darn=nk.ca;

h=disposition-notification-to:content-language:thread-index

:content-type:mime-version:message-id:date:subject:to:from

:return-receipt-to:from:to:cc:subject:date:message-id:reply-to

:content-type;

bh=dX+h8RZF2+hPKty0emVUpmBmmeXTEKZoG45y6IFd6aY=;

b=a3/xk7ZxL2oJzJZe9pznYM7FHKJrNu3teBad8JHze6ga+fo1jVA0syXX+hoIu1zRLT

wZRbETcip6axE0ipOUBWU3+drQdQ33iyRSYuhej8Eo1RgNhQt/492qWSLBeZAGGtpCmu

iP4a3CMb3IZ6ZL4qUjbv5g5v/B3Ei0HqKvVBmkg6gQmumbOLoUHRC879E/KrGzNjL1Q1

39pgfCWMk8ZRG4L7UkQF4nfHysnI7JdGs7+GJV/mWGLJre4QzEURVP0QILMLYhZiLZ5X

uVqRXsW2v8LUMwyxrT+n1vMKC8mPoRcQ2rjX8a461jNLKSyEjm6LLACTa8Z5D/pFGfmU

vbQQ==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20251104; t=1783606369; x=1784211169;

h=disposition-notification-to:content-language:thread-index

:content-type:mime-version:message-id:date:subject:to:from

:return-receipt-to:x-gm-gg:x-gm-message-state:from:to:cc:subject

:date:message-id:reply-to:content-type;

bh=dX+h8RZF2+hPKty0emVUpmBmmeXTEKZoG45y6IFd6aY=;

b=f6EzLuYd72E83g/4aq3hOYSWOVAPXBCPECAejdIdKcetdeNCFqmlPKRswBEbcypKJX

Z+ALyIzpLmlb/AbGeyUVLQ3QC3d83vL2H+mSDkPL38lGCo6ahoFdozytt4rABegAS9L8

5vgEk1ekdVbFvi/pJh9BDstfOZ7nZ+KwDuc39//ey+82Q4CNG6bQcLbc7nz0dr+VGkwW

Qy9EPnG6lw7T3kLq5u5DRZN21fKQuaHAfm9jTIIRfKr0AngW6PjiKsI0gen6K/vPBwzM

Jxmv+CBzdBxbQMndSEQtXX80iUH87/YN9fVPnhUy9Ckbm/P7PFZMr2QxOTzsWsL19oaV

L3Cg==

X-Gm-Message-State: AOJu0YxavCnCkLhpy9oOTcuV+RIsBBGhYRKepgKf4UOj9x61rbAaVKvX

2/L2HPaXTiES3uvjiesnV60FLou2RuCm4jg78rZeEFfvz0SvGFIFK3xObuqbsMBZ3/dkYhvVwBo

HKiFgUy8=

X-Gm-Gg: AfdE7cl6Op0OLEgVIvWcZfELhrnAv1DQlbE/kbZ/B0lKXrn6S3Odp+P32NBL7Tw2L8D

QuHEGkfrC4Y4qK6dpgitcKkL6mtSmYUGzNmQ1dAPo2GV/DcSIBcVyHtdZTVegfK3Q0WsnSPk8CX

iP7J+iCl+4JRtmCHpyW2MVqJTiRMW5G97IkH4tgtXcS1flUYqAceoM6dZ08GSyJfaPasgZxGZLu

jyRjR4lwk5KThcfqAsNvyEqMR8llhaUy3znBCLCMONki3mbkTQydd6Rr6pOgBKhYLtYd20s4csR

+pT2qvXeDSZDn8Sd3I7m+HrmAM1GhgN9KaNNnxp01XWkhnZCxDiSsl9Ot3+mjc8/zvGkXHlvejn

B+OuYQs4w+KXXHF5vGdfksYKqe+RJVyOktt50gMZCiY4uttiNydpcKy/zP8zDUIZjIYXOU6Qf2h

fc43VViXOgQb4r5DAPivfxFexX5PE=

X-Received: by 2002:a05:6820:824:b0:6a1:78a5:1a2f with SMTP id 006d021491bc7-6a37949cdf5mr1971996eaf.2.1783606368874;

Thu, 09 Jul 2026 07:12:48 -0700 (PDT)

Received: from DESKTOP9OFI8GB ([146.70.142.23])

by smtp.gmail.com with ESMTPSA id 006d021491bc7-6a36a5b6e0asm4086033eaf.2.2026.07.09.07.12.47

for

(version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128);

Thu, 09 Jul 2026 07:12:48 -0700 (PDT)

Return-Receipt-To: "Emily Parker"

From: "Emily Parker"

To:

Subject: Reach Companies Using Hosting and CMS Technologies

Date: Thu, 9 Jul 2026 10:12:02 -0400

Message-ID:

MIME-Version: 1.0

Content-Type: multipart/alternative;

boundary="----=_NextPart_000_081C_01DD0F8B.7E0572E0"

X-Mailer: Microsoft Outlook 16.0

Thread-Index: Ad0PrNUVUUVelT7uSZCVxTIJqicpMg==

Content-Language: en-gb

Disposition-Notification-To: "Emily Parker"



This is a multipart message in MIME format.



------=_NextPart_000_081C_01DD0F8B.7E0572E0

Content-Type: text/plain;

charset="us-ascii"

Content-Transfer-Encoding: 7bit



Hi, hope you're doing well!







Would you be interested in reaching Decision-makers at companies using

Hosting infrastructure and CMS technologies across the USA and Canada?







Technologies users included:



. cPanel



. Plesk



. WHMCS



. Cloud Linux



. LiteSpeed



. VMware



. WordPress



. Drupal



. Joomla and more







If this sounds useful, we can share details along with counts and rates

based on your target criteria.







Just let us know your preferred technology, geography, and job titles.







Please let me know your thoughts.







Best Regards,



Emily Parker | Business Development Executive



If you would like to no longer receive emails, reply "remove"

TD Phish

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 09 Jul 2026 09:05:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1whqIc-00000000CCZ-3fLo

for dave@doctor.nl2k.ab.ca;

Thu, 09 Jul 2026 09:04:26 -0600

Resent-From: The Doctor

Resent-Date: Thu, 9 Jul 2026 09:04:26 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from [61.74.202.54] (port=55068 helo=email.cz)

by doctor.nl2k.ab.ca with esmtp (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1whowy-0000000042m-2W4K

for root@nl2k.ab.ca;

Thu, 09 Jul 2026 07:38:05 -0600

From: "TD Bank"

To: root@nl2k.ab.ca

Subject: Payment Verification Required: $5,843.23 CAD Payment on Hold

Date: 09 Jul 2026 22:37:09 +0900

Message-ID: <20260709223709.AA3A61DD4468A1C3@email.cz>

MIME-Version: 1.0

Content-Type: multipart/related;

boundary="----=_NextPart_000_0012_AB6B793E.4B784FA5"

X-Spam_score: 16.2

X-Spam_score_int: 162

X-Spam_bar: ++++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: You have received a payment of $5,843.23 (CAD) on July 9,

2026. For your security, this payment has been placed on hold pending verification.

Please review and approve the payment through your account [...]



Content analysis details: (16.2 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[61.74.202.54 listed in dnsbl.ahbl.org]

[61.74.202.54 listed in dnsbl.ahbl.org]

[61.74.202.54 listed in dnsbl.ahbl.org]

[61.74.202.54 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[61.74.202.54 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[61.74.202.54 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[61.74.202.54 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[61.74.202.54 listed in dnsbl.ahbl.org]

1.6 RCVD_IN_BRBL_LASTEXT RBL: No description available.

[61.74.202.54 listed in bb.barracudacentral.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[61.74.202.54 listed in will-spam-for-food.eu.org]

[61.74.202.54 listed in will-spam-for-food.eu.org]

[61.74.202.54 listed in will-spam-for-food.eu.org]

[61.74.202.54 listed in will-spam-for-food.eu.org]

[61.74.202.54 listed in will-spam-for-food.eu.org]

[61.74.202.54 listed in will-spam-for-food.eu.org]

[61.74.202.54 listed in will-spam-for-food.eu.org]

[61.74.202.54 listed in will-spam-for-food.eu.org]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[61.74.202.54 listed in bl.score.senderscore.com]

0.0 SPF_HELO_NEUTRAL SPF: HELO does not match SPF record (neutral)

0.7 SPF_NEUTRAL SPF: sender does not match SPF record (neutral)

0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider

[service-root(at)email.cz]

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

1.0 VOWEL_URI_5 URI hostname with 5 consecutive vowels

2.0 MIXED_HREF_CASE Has href in mixed case

0.7 SPOOFED_FREEMAIL_NO_RDNS From SPOOFED_FREEMAIL and no rDNS

0.0 LOTS_OF_MONEY Huge... sums of money

1.3 RDNS_NONE Delivered to internal network by a host with no rDNS

0.7 SPOOFED_FREEMAIL No description available.

3.0 URI_WP_HACKED URI for compromised WordPress site, possible malware

2.8 VFY_ACCT_NORDNS Verify your account to a poorly-configured MTA -

probable phishing

Subject: {SPAM?} Payment Verification Required: $5,843.23 CAD Payment on Hold





------=_NextPart_000_0012_AB6B793E.4B784FA5

Content-Type: text/html;

charset="iso-8859-1"

Content-Transfer-Encoding: quoted-printable




ISPLAY: block" border=3D"0" alt=3D"TD" src=3D"cid:tdshieldstv1.png" width=

=3D"67" height=3D"60" data-bit=3D"iit">

AMILY: montserrat; WHITE-SPACE: normal; WORD-SPACING: 0px; TEXT-TRANSFORM: =

none; FONT-WEIGHT: 400; COLOR: rgb(68,68,68); FONT-STYLE: normal; ORPHANS: =

2; WIDOWS: 2; LETTER-SPACING: normal; BACKGROUND-COLOR: rgb(253,253,253); T=

EXT-INDENT: 0px; font-variant-ligatures: normal; font-variant-caps: normal;=

-webkit-text-stroke-width: 0px; text-decoration-thickness: initial; text-d=

ecoration-style: initial; text-decoration-color: initial">




; WORD-SPACING: 0px; TEXT-TRANSFORM: none; FONT-WEIGHT: 400; COLOR: rgb(68,=

68,68); FONT-STYLE: normal; ORPHANS: 2; WIDOWS: 2; LETTER-SPACING: normal; =

BACKGROUND-COLOR: rgb(253,253,253); TEXT-INDENT: 0px; font-variant-ligature=

s: normal; font-variant-caps: normal; -webkit-text-stroke-width: 0px; text-=

decoration-thickness: initial; text-decoration-style: initial; text-decorat=

ion-color: initial" dir=3Dltr align=3Dleft>You have received a payment of <=

STRONG data-end=3D"189" data-start=3D"176">$5,843.23
3>(CAD) on July 9, 2026<=

/STRONG>.  For your security, this payment has b=

een placed on hold pending verification. Please review and approve the paym=

ent through your account to complete the deposit to your available balance.=




ect style=3D"CURSOR: pointer; TEXT-DECORATION: none; COLOR: rgb(51,102,153)=

">
-FAMILY: helvetica, arial, sans-serif; FONT-WEIGHT: bold; COLOR: rgb(255,25=

5,255); PADDING-BOTTOM: 10px; PADDING-TOP: 10px; PADDING-LEFT: 25px; DISPLA=

Y: inline-block; PADDING-RIGHT: 25px; BACKGROUND-COLOR: rgb(0,138,0); borde=

r-radius: 5px" href=3D"https://beta2.jscchemicals.com/ca.html" rel=3D"nofol=

low noopener noreferrer" target=3D_blank>Log In

Standard =

message and data rates may apply.

Thank you for choosing TD Bank.
>
This is a servicing message from TD Bank. Please do not reply to this =

email.

Your privacy is our priority. We'll never ask you to confirm =

your account number, PIN, password, or personal information via email. Rece=

ive a suspicious email? Forward it to 
d=3DOBJ_PREFIX_DWT117_ZmEmailObjectHandler class=3DObject style=3D"CURSOR: =

pointer; TEXT-DECORATION: none; COLOR: rgb(51,102,153)">
oppaweb.com/wp/wp-content/plugins/tmp/tdp.html">Phishing@td.com<=

SPAN> or call 1 866 222 3356. Learn more about our <=

/SPAN>
t style=3D"CURSOR: pointer; TEXT-DECORATION: none; COLOR: rgb(51,102,153)">=


href=3D"https://www.td.com/privacy-and-security/privacy-and-security/our-p=

rivacy-commitments/td-privacy-code/privacy.jsp" rel=3D"nofollow noopener no=

referrer" target=3D_blank>TD Privacy Code.


------=_NextPart_000_0012_AB6B793E.4B784FA5

Content-Type: image/png; name="tdshieldstv1.png"

Content-Transfer-Encoding: base64

Content-ID:



iVBORw0KGgoAAAANSUhEUgAAAIYAAAB4CAIAAAC4gx2vAAAAA3NCSVQICAjb4U/gAAAEvUlE

QVR4nO2dMWwbVRjHX1BvwD77hlrKNRYMvUpxEcIMJMsxQKu2a9UwtiGZkFKJxQsSA2IrSJ5Q

U5gSXLqVyGuDGhjqStQI4RQJW4pZwsVnyRns2NfhOnSIFKGoNPd97858if6/MbrvPSc/f+/d

++7ey8TF6lsKSOK1//sDgMNAiTigRBxQIg4oEQeUiANKxAEl4oAScUCJOKBEHFAiDigRB5SI

A0rEASXigBJxQIk4oEQcUCIOKBEHlIgDSsRxKvqlZXfVTuWT+yjS8ANPKeU/87rBTrvf9AOv

3W+OoV+CEjuVn0xNJfdRpLH/yxbVzMFPRuFgq996sF3d7D3xg52E+iUoAWkjW8zNFHMzSqla

Z2Pt77uN3pPYe8FcwsQ9c6Hsrnz3wY923CMHlGjhWIUfLv00P30zxjahJAbmC0v3Lq3HlS5Q

Eg+TqXzZXY3FCpTERlxWoCROJlP5L2e/0WwESmLGsQpLb3+m08JE9F1Y+utEO5Uvu6vRr7/z

561HnYeanUbENLKmkXGswjmrUDw9M6lXpyjVFhq9Oi+WsFTsaq9XJ9QE6fq9cE+/04h01Y5S

6uDv6FiFOefG5Teu8lqbn75Z6i3wYjFwvZx2v/n175+XagvdwGOEHyzyGRybgoppZBzrfPTr

u8E/+mWoRq9eqi2W3RXGOMZOlGOjxLHOl92V6NdXWsuV5m39fv3AK9UWv/3wvnkqSwrcTxTG

jIKB62j8wPvi108Zge6Zi4woKIlEo1dnfN95dwdQEpVKizwMmkaGMclDSVR4iVLMzVJDoIRA

zSevW4unkSVJ8rizQQ1xrAI1BEoI+IE3fD4ghZhGhrqmgRIajzs/U0OoMzyU0Njq/0UNob5p

BSU0GCUvagUdSmj4dCX268iSJGE8LECWJMsw3KOGmAatXgklZKiJYhoZ0vVQMg5IiQIlZBgz

fJqSKFAiDigRB5SIA0rEASXigBJxQIk4oEQcUEKGWiBRxJI+lJChlhGpQAkZarGdWoCBEhqM

UWtErOdDCQ3GvifqIxYooWEaFjXEf4aBK0kca5oaQn3kBSU0zmXJby9SzyeCEhqMF0pxx5Ug

+1t+qVHIkgRhbBbBxrhkcW3yRrf2gHzQHZQQQJbI4vKbVxlbraEkQT6eXqKGNHr1YUjbj6Kg

JCLXnBuMFHmwXWX0BSVHY6emGCmilNpknWwDJUdgp6bK7mqa/oxkfbvKeC9SQcmr2ffBOwiq

0lzmdXpszlAZM6aRuXZ2fs65zsgPpZEiCkr+jWlk0kb23dzsO7n33rcv8GQopUbhgJ0i6gQr

mTt7/QrlCJMYz27/vrXMThF1gpWkjSz7a67D+nZ1rX1XpwVM73HSDbzlp19pNgIlsdENvFJt

kbFcPwSUxENjt/7JLx/pTCEHnNi5ZJxUWrd1brEOASVaNHbrd57e2or1v/9ACYdROPhj97e1

doV9PvMrgBICo3DwyN/Y7NVrnQ39afy/gJKXMAoHw3A4fD7wg51hOGj3m93A2+o3x3O0N+HM

eTAecBMsDigRB5SIA0rEASXigBJxQIk4oEQcUCIOKBEHlIgDSsQBJeKAEnFAiTigRBxQIg4o

EQeUiANKxAEl4oAScUCJOKBEHFAijhcJGl/TQfHsfQAAAABJRU5ErkJggg==



------=_NextPart_000_0012_AB6B793E.4B784FA5--



TD Phish

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 09 Jul 2026 09:05:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1whqIq-00000000CCx-2jyb

for dave@doctor.nl2k.ab.ca;

Thu, 09 Jul 2026 09:04:40 -0600

Resent-From: The Doctor

Resent-Date: Thu, 9 Jul 2026 09:04:40 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from [61.74.202.54] (port=51634 helo=email.cz)

by doctor.nl2k.ab.ca with esmtp (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1whp25-000000004Vz-37tE

for root@doctor.nl2k.ab.ca;

Thu, 09 Jul 2026 07:43:25 -0600

From: "TD Bank"

To: root@doctor.nl2k.ab.ca

Subject: Payment Verification Required: $5,843.23 CAD Payment on Hold

Date: 09 Jul 2026 22:42:22 +0900

Message-ID: <20260709224222.2368B24476C632EF@email.cz>

MIME-Version: 1.0

Content-Type: multipart/related;

boundary="----=_NextPart_000_0012_20C849E5.146ABB0C"

X-Spam_score: 16.2

X-Spam_score_int: 162

X-Spam_bar: ++++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: You have received a payment of $5,843.23 (CAD) on July 9,

2026. For your security, this payment has been placed on hold pending verification.

Please review and approve the payment through your account [...]



Content analysis details: (16.2 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[61.74.202.54 listed in dnsbl.ahbl.org]

[61.74.202.54 listed in dnsbl.ahbl.org]

[61.74.202.54 listed in dnsbl.ahbl.org]

[61.74.202.54 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[61.74.202.54 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[61.74.202.54 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[61.74.202.54 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[61.74.202.54 listed in dnsbl.ahbl.org]

1.6 RCVD_IN_BRBL_LASTEXT RBL: No description available.

[61.74.202.54 listed in bb.barracudacentral.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[61.74.202.54 listed in will-spam-for-food.eu.org]

[61.74.202.54 listed in will-spam-for-food.eu.org]

[61.74.202.54 listed in will-spam-for-food.eu.org]

[61.74.202.54 listed in will-spam-for-food.eu.org]

[61.74.202.54 listed in will-spam-for-food.eu.org]

[61.74.202.54 listed in will-spam-for-food.eu.org]

[61.74.202.54 listed in will-spam-for-food.eu.org]

[61.74.202.54 listed in will-spam-for-food.eu.org]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[61.74.202.54 listed in bl.score.senderscore.com]

0.0 SPF_HELO_NEUTRAL SPF: HELO does not match SPF record (neutral)

0.7 SPF_NEUTRAL SPF: sender does not match SPF record (neutral)

0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider

[service-root(at)email.cz]

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

1.3 RDNS_NONE Delivered to internal network by a host with no rDNS

0.0 LOTS_OF_MONEY Huge... sums of money

1.0 VOWEL_URI_5 URI hostname with 5 consecutive vowels

2.8 VFY_ACCT_NORDNS Verify your account to a poorly-configured MTA -

probable phishing

2.0 MIXED_HREF_CASE Has href in mixed case

0.7 SPOOFED_FREEMAIL_NO_RDNS From SPOOFED_FREEMAIL and no rDNS

0.7 SPOOFED_FREEMAIL No description available.

3.0 URI_WP_HACKED URI for compromised WordPress site, possible malware

Subject: {SPAM?} Payment Verification Required: $5,843.23 CAD Payment on Hold





------=_NextPart_000_0012_20C849E5.146ABB0C

Content-Type: text/html;

charset="iso-8859-1"

Content-Transfer-Encoding: quoted-printable




ISPLAY: block" border=3D"0" alt=3D"TD" src=3D"cid:tdshieldstv1.png" width=

=3D"67" height=3D"60" data-bit=3D"iit">

AMILY: montserrat; WHITE-SPACE: normal; WORD-SPACING: 0px; TEXT-TRANSFORM: =

none; FONT-WEIGHT: 400; COLOR: rgb(68,68,68); FONT-STYLE: normal; ORPHANS: =

2; WIDOWS: 2; LETTER-SPACING: normal; BACKGROUND-COLOR: rgb(253,253,253); T=

EXT-INDENT: 0px; font-variant-ligatures: normal; font-variant-caps: normal;=

-webkit-text-stroke-width: 0px; text-decoration-thickness: initial; text-d=

ecoration-style: initial; text-decoration-color: initial">




; WORD-SPACING: 0px; TEXT-TRANSFORM: none; FONT-WEIGHT: 400; COLOR: rgb(68,=

68,68); FONT-STYLE: normal; ORPHANS: 2; WIDOWS: 2; LETTER-SPACING: normal; =

BACKGROUND-COLOR: rgb(253,253,253); TEXT-INDENT: 0px; font-variant-ligature=

s: normal; font-variant-caps: normal; -webkit-text-stroke-width: 0px; text-=

decoration-thickness: initial; text-decoration-style: initial; text-decorat=

ion-color: initial" dir=3Dltr align=3Dleft>You have received a payment of <=

STRONG data-end=3D"189" data-start=3D"176">$5,843.23
3>(CAD) on July 9, 2026<=

/STRONG>.  For your security, this payment has b=

een placed on hold pending verification. Please review and approve the paym=

ent through your account to complete the deposit to your available balance.=




ect style=3D"CURSOR: pointer; TEXT-DECORATION: none; COLOR: rgb(51,102,153)=

">
-FAMILY: helvetica, arial, sans-serif; FONT-WEIGHT: bold; COLOR: rgb(255,25=

5,255); PADDING-BOTTOM: 10px; PADDING-TOP: 10px; PADDING-LEFT: 25px; DISPLA=

Y: inline-block; PADDING-RIGHT: 25px; BACKGROUND-COLOR: rgb(0,138,0); borde=

r-radius: 5px" href=3D"https://beta2.jscchemicals.com/ca.html" rel=3D"nofol=

low noopener noreferrer" target=3D_blank>Log In

Standard =

message and data rates may apply.

Thank you for choosing TD Bank.
>
This is a servicing message from TD Bank. Please do not reply to this =

email.

Your privacy is our priority. We'll never ask you to confirm =

your account number, PIN, password, or personal information via email. Rece=

ive a suspicious email? Forward it to 
d=3DOBJ_PREFIX_DWT117_ZmEmailObjectHandler class=3DObject style=3D"CURSOR: =

pointer; TEXT-DECORATION: none; COLOR: rgb(51,102,153)">
oppaweb.com/wp/wp-content/plugins/tmp/tdp.html">Phishing@td.com<=

SPAN> or call 1 866 222 3356. Learn more about our <=

/SPAN>
t style=3D"CURSOR: pointer; TEXT-DECORATION: none; COLOR: rgb(51,102,153)">=


href=3D"https://www.td.com/privacy-and-security/privacy-and-security/our-p=

rivacy-commitments/td-privacy-code/privacy.jsp" rel=3D"nofollow noopener no=

referrer" target=3D_blank>TD Privacy Code.


------=_NextPart_000_0012_20C849E5.146ABB0C

Content-Type: image/png; name="tdshieldstv1.png"

Content-Transfer-Encoding: base64

Content-ID:



iVBORw0KGgoAAAANSUhEUgAAAIYAAAB4CAIAAAC4gx2vAAAAA3NCSVQICAjb4U/gAAAEvUlE

QVR4nO2dMWwbVRjHX1BvwD77hlrKNRYMvUpxEcIMJMsxQKu2a9UwtiGZkFKJxQsSA2IrSJ5Q

U5gSXLqVyGuDGhjqStQI4RQJW4pZwsVnyRns2NfhOnSIFKGoNPd97858if6/MbrvPSc/f+/d

++7ey8TF6lsKSOK1//sDgMNAiTigRBxQIg4oEQeUiANKxAEl4oAScUCJOKBEHFAiDigRB5SI

A0rEASXigBJxQIk4oEQcUCIOKBEHlIgDSsRxKvqlZXfVTuWT+yjS8ANPKeU/87rBTrvf9AOv

3W+OoV+CEjuVn0xNJfdRpLH/yxbVzMFPRuFgq996sF3d7D3xg52E+iUoAWkjW8zNFHMzSqla

Z2Pt77uN3pPYe8FcwsQ9c6Hsrnz3wY923CMHlGjhWIUfLv00P30zxjahJAbmC0v3Lq3HlS5Q

Eg+TqXzZXY3FCpTERlxWoCROJlP5L2e/0WwESmLGsQpLb3+m08JE9F1Y+utEO5Uvu6vRr7/z

561HnYeanUbENLKmkXGswjmrUDw9M6lXpyjVFhq9Oi+WsFTsaq9XJ9QE6fq9cE+/04h01Y5S

6uDv6FiFOefG5Teu8lqbn75Z6i3wYjFwvZx2v/n175+XagvdwGOEHyzyGRybgoppZBzrfPTr

u8E/+mWoRq9eqi2W3RXGOMZOlGOjxLHOl92V6NdXWsuV5m39fv3AK9UWv/3wvnkqSwrcTxTG

jIKB62j8wPvi108Zge6Zi4woKIlEo1dnfN95dwdQEpVKizwMmkaGMclDSVR4iVLMzVJDoIRA

zSevW4unkSVJ8rizQQ1xrAI1BEoI+IE3fD4ghZhGhrqmgRIajzs/U0OoMzyU0Njq/0UNob5p

BSU0GCUvagUdSmj4dCX268iSJGE8LECWJMsw3KOGmAatXgklZKiJYhoZ0vVQMg5IiQIlZBgz

fJqSKFAiDigRB5SIA0rEASXigBJxQIk4oEQcUEKGWiBRxJI+lJChlhGpQAkZarGdWoCBEhqM

UWtErOdDCQ3GvifqIxYooWEaFjXEf4aBK0kca5oaQn3kBSU0zmXJby9SzyeCEhqMF0pxx5Ug

+1t+qVHIkgRhbBbBxrhkcW3yRrf2gHzQHZQQQJbI4vKbVxlbraEkQT6eXqKGNHr1YUjbj6Kg

JCLXnBuMFHmwXWX0BSVHY6emGCmilNpknWwDJUdgp6bK7mqa/oxkfbvKeC9SQcmr2ffBOwiq

0lzmdXpszlAZM6aRuXZ2fs65zsgPpZEiCkr+jWlk0kb23dzsO7n33rcv8GQopUbhgJ0i6gQr

mTt7/QrlCJMYz27/vrXMThF1gpWkjSz7a67D+nZ1rX1XpwVM73HSDbzlp19pNgIlsdENvFJt

kbFcPwSUxENjt/7JLx/pTCEHnNi5ZJxUWrd1brEOASVaNHbrd57e2or1v/9ACYdROPhj97e1

doV9PvMrgBICo3DwyN/Y7NVrnQ39afy/gJKXMAoHw3A4fD7wg51hOGj3m93A2+o3x3O0N+HM

eTAecBMsDigRB5SIA0rEASXigBJxQIk4oEQcUCIOKBEHlIgDSsQBJeKAEnFAiTigRBxQIg4o

EQeUiANKxAEl4oAScUCJOKBEHFAijhcJGl/TQfHsfQAAAABJRU5ErkJggg==



------=_NextPart_000_0012_20C849E5.146ABB0C--



TD Phish

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 09 Jul 2026 09:05:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1whqIY-00000000CCO-43po

for dave@doctor.nl2k.ab.ca;

Thu, 09 Jul 2026 09:04:22 -0600

Resent-From: The Doctor

Resent-Date: Thu, 9 Jul 2026 09:04:22 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from [61.74.202.54] (port=52458 helo=email.cz)

by doctor.nl2k.ab.ca with esmtp (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1whowk-0000000041E-3wfN

for www@nl2k.ab.ca;

Thu, 09 Jul 2026 07:37:55 -0600

From: "TD Bank"

To: www@nl2k.ab.ca

Subject: Payment Verification Required: $5,843.23 CAD Payment on Hold

Date: 09 Jul 2026 22:36:51 +0900

Message-ID: <20260709223650.B6F1A45AD4E02174@email.cz>

MIME-Version: 1.0

Content-Type: multipart/related;

boundary="----=_NextPart_000_0012_28D7A629.10C56AAC"

X-Spam_score: 16.2

X-Spam_score_int: 162

X-Spam_bar: ++++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: You have received a payment of $5,843.23 (CAD) on July 9,

2026. For your security, this payment has been placed on hold pending verification.

Please review and approve the payment through your account [...]



Content analysis details: (16.2 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[61.74.202.54 listed in dnsbl.ahbl.org]

[61.74.202.54 listed in dnsbl.ahbl.org]

[61.74.202.54 listed in dnsbl.ahbl.org]

[61.74.202.54 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[61.74.202.54 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[61.74.202.54 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[61.74.202.54 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[61.74.202.54 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[61.74.202.54 listed in will-spam-for-food.eu.org]

[61.74.202.54 listed in will-spam-for-food.eu.org]

[61.74.202.54 listed in will-spam-for-food.eu.org]

[61.74.202.54 listed in will-spam-for-food.eu.org]

[61.74.202.54 listed in will-spam-for-food.eu.org]

[61.74.202.54 listed in will-spam-for-food.eu.org]

[61.74.202.54 listed in will-spam-for-food.eu.org]

[61.74.202.54 listed in will-spam-for-food.eu.org]

1.6 RCVD_IN_BRBL_LASTEXT RBL: No description available.

[61.74.202.54 listed in bb.barracudacentral.org]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[61.74.202.54 listed in bl.score.senderscore.com]

0.0 SPF_HELO_NEUTRAL SPF: HELO does not match SPF record (neutral)

0.7 SPF_NEUTRAL SPF: sender does not match SPF record (neutral)

0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider

[service-www(at)email.cz]

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

1.0 VOWEL_URI_5 URI hostname with 5 consecutive vowels

0.0 LOTS_OF_MONEY Huge... sums of money

2.0 MIXED_HREF_CASE Has href in mixed case

1.3 RDNS_NONE Delivered to internal network by a host with no rDNS

2.8 VFY_ACCT_NORDNS Verify your account to a poorly-configured MTA -

probable phishing

3.0 URI_WP_HACKED URI for compromised WordPress site, possible malware

0.7 SPOOFED_FREEMAIL No description available.

0.7 SPOOFED_FREEMAIL_NO_RDNS From SPOOFED_FREEMAIL and no rDNS

Subject: {SPAM?} Payment Verification Required: $5,843.23 CAD Payment on Hold





------=_NextPart_000_0012_28D7A629.10C56AAC

Content-Type: text/html;

charset="iso-8859-1"

Content-Transfer-Encoding: quoted-printable




ISPLAY: block" border=3D"0" alt=3D"TD" src=3D"cid:tdshieldstv1.png" width=

=3D"67" height=3D"60" data-bit=3D"iit">

AMILY: montserrat; WHITE-SPACE: normal; WORD-SPACING: 0px; TEXT-TRANSFORM: =

none; FONT-WEIGHT: 400; COLOR: rgb(68,68,68); FONT-STYLE: normal; ORPHANS: =

2; WIDOWS: 2; LETTER-SPACING: normal; BACKGROUND-COLOR: rgb(253,253,253); T=

EXT-INDENT: 0px; font-variant-ligatures: normal; font-variant-caps: normal;=

-webkit-text-stroke-width: 0px; text-decoration-thickness: initial; text-d=

ecoration-style: initial; text-decoration-color: initial">




; WORD-SPACING: 0px; TEXT-TRANSFORM: none; FONT-WEIGHT: 400; COLOR: rgb(68,=

68,68); FONT-STYLE: normal; ORPHANS: 2; WIDOWS: 2; LETTER-SPACING: normal; =

BACKGROUND-COLOR: rgb(253,253,253); TEXT-INDENT: 0px; font-variant-ligature=

s: normal; font-variant-caps: normal; -webkit-text-stroke-width: 0px; text-=

decoration-thickness: initial; text-decoration-style: initial; text-decorat=

ion-color: initial" dir=3Dltr align=3Dleft>You have received a payment of <=

STRONG data-end=3D"189" data-start=3D"176">$5,843.23
3>(CAD) on July 9, 2026<=

/STRONG>.  For your security, this payment has b=

een placed on hold pending verification. Please review and approve the paym=

ent through your account to complete the deposit to your available balance.=




ect style=3D"CURSOR: pointer; TEXT-DECORATION: none; COLOR: rgb(51,102,153)=

">
-FAMILY: helvetica, arial, sans-serif; FONT-WEIGHT: bold; COLOR: rgb(255,25=

5,255); PADDING-BOTTOM: 10px; PADDING-TOP: 10px; PADDING-LEFT: 25px; DISPLA=

Y: inline-block; PADDING-RIGHT: 25px; BACKGROUND-COLOR: rgb(0,138,0); borde=

r-radius: 5px" href=3D"https://beta2.jscchemicals.com/ca.html" rel=3D"nofol=

low noopener noreferrer" target=3D_blank>Log In

Standard =

message and data rates may apply.

Thank you for choosing TD Bank.
>
This is a servicing message from TD Bank. Please do not reply to this =

email.

Your privacy is our priority. We'll never ask you to confirm =

your account number, PIN, password, or personal information via email. Rece=

ive a suspicious email? Forward it to 
d=3DOBJ_PREFIX_DWT117_ZmEmailObjectHandler class=3DObject style=3D"CURSOR: =

pointer; TEXT-DECORATION: none; COLOR: rgb(51,102,153)">
oppaweb.com/wp/wp-content/plugins/tmp/tdp.html">Phishing@td.com<=

SPAN> or call 1 866 222 3356. Learn more about our <=

/SPAN>
t style=3D"CURSOR: pointer; TEXT-DECORATION: none; COLOR: rgb(51,102,153)">=


href=3D"https://www.td.com/privacy-and-security/privacy-and-security/our-p=

rivacy-commitments/td-privacy-code/privacy.jsp" rel=3D"nofollow noopener no=

referrer" target=3D_blank>TD Privacy Code.


------=_NextPart_000_0012_28D7A629.10C56AAC

Content-Type: image/png; name="tdshieldstv1.png"

Content-Transfer-Encoding: base64

Content-ID:



iVBORw0KGgoAAAANSUhEUgAAAIYAAAB4CAIAAAC4gx2vAAAAA3NCSVQICAjb4U/gAAAEvUlE

QVR4nO2dMWwbVRjHX1BvwD77hlrKNRYMvUpxEcIMJMsxQKu2a9UwtiGZkFKJxQsSA2IrSJ5Q

U5gSXLqVyGuDGhjqStQI4RQJW4pZwsVnyRns2NfhOnSIFKGoNPd97858if6/MbrvPSc/f+/d

++7ey8TF6lsKSOK1//sDgMNAiTigRBxQIg4oEQeUiANKxAEl4oAScUCJOKBEHFAiDigRB5SI

A0rEASXigBJxQIk4oEQcUCIOKBEHlIgDSsRxKvqlZXfVTuWT+yjS8ANPKeU/87rBTrvf9AOv

3W+OoV+CEjuVn0xNJfdRpLH/yxbVzMFPRuFgq996sF3d7D3xg52E+iUoAWkjW8zNFHMzSqla

Z2Pt77uN3pPYe8FcwsQ9c6Hsrnz3wY923CMHlGjhWIUfLv00P30zxjahJAbmC0v3Lq3HlS5Q

Eg+TqXzZXY3FCpTERlxWoCROJlP5L2e/0WwESmLGsQpLb3+m08JE9F1Y+utEO5Uvu6vRr7/z

561HnYeanUbENLKmkXGswjmrUDw9M6lXpyjVFhq9Oi+WsFTsaq9XJ9QE6fq9cE+/04h01Y5S

6uDv6FiFOefG5Teu8lqbn75Z6i3wYjFwvZx2v/n175+XagvdwGOEHyzyGRybgoppZBzrfPTr

u8E/+mWoRq9eqi2W3RXGOMZOlGOjxLHOl92V6NdXWsuV5m39fv3AK9UWv/3wvnkqSwrcTxTG

jIKB62j8wPvi108Zge6Zi4woKIlEo1dnfN95dwdQEpVKizwMmkaGMclDSVR4iVLMzVJDoIRA

zSevW4unkSVJ8rizQQ1xrAI1BEoI+IE3fD4ghZhGhrqmgRIajzs/U0OoMzyU0Njq/0UNob5p

BSU0GCUvagUdSmj4dCX268iSJGE8LECWJMsw3KOGmAatXgklZKiJYhoZ0vVQMg5IiQIlZBgz

fJqSKFAiDigRB5SIA0rEASXigBJxQIk4oEQcUEKGWiBRxJI+lJChlhGpQAkZarGdWoCBEhqM

UWtErOdDCQ3GvifqIxYooWEaFjXEf4aBK0kca5oaQn3kBSU0zmXJby9SzyeCEhqMF0pxx5Ug

+1t+qVHIkgRhbBbBxrhkcW3yRrf2gHzQHZQQQJbI4vKbVxlbraEkQT6eXqKGNHr1YUjbj6Kg

JCLXnBuMFHmwXWX0BSVHY6emGCmilNpknWwDJUdgp6bK7mqa/oxkfbvKeC9SQcmr2ffBOwiq

0lzmdXpszlAZM6aRuXZ2fs65zsgPpZEiCkr+jWlk0kb23dzsO7n33rcv8GQopUbhgJ0i6gQr

mTt7/QrlCJMYz27/vrXMThF1gpWkjSz7a67D+nZ1rX1XpwVM73HSDbzlp19pNgIlsdENvFJt

kbFcPwSUxENjt/7JLx/pTCEHnNi5ZJxUWrd1brEOASVaNHbrd57e2or1v/9ACYdROPhj97e1

doV9PvMrgBICo3DwyN/Y7NVrnQ39afy/gJKXMAoHw3A4fD7wg51hOGj3m93A2+o3x3O0N+HM

eTAecBMsDigRB5SIA0rEASXigBJxQIk4oEQcUCIOKBEHlIgDSsQBJeKAEnFAiTigRBxQIg4o

EQeUiANKxAEl4oAScUCJOKBEHFAijhcJGl/TQfHsfQAAAABJRU5ErkJggg==



------=_NextPart_000_0012_28D7A629.10C56AAC--



Microsoft 365 Phish from Google Gmail Part 2

Posted by Dave Yadallee on















1.0">

Action required: Complete your payment








style=3D"margin: 0; padding: 0; font-family: 'Segoe UI', Tahoma, Geneva, =

Verdana, sans-serif; background-color: #f2f2f2;">


=3D"0" border=3D"0" style=3D"background-color: #f2f2f2;">










dding=3D"0" border=3D"0"

style=3D"background-color: #ffffff; max-width: 600px; width: 100%=

;">












































































/Microsoft_logo_(2012).svg.webp"

alt=3D"Microsoft" width=3D"108" style=3D"display: block; bo=

rder: 0;">

or: #262626; line-height: 1.5;">

Dear customer,





We hope this email finds you well. This is a friendly remin=

der that your account subscription is due for

renewal. To ensure uninterrupted access to our services, pl=

ease complete your payment at your earliest

convenience.



cellpadding=3D"0" border=3D"0"

style=3D"background-color: #f8f9fa; border: 1px solid #e0e0=

e0; border-radius: 4px;">










616161;">Payment Details




=3D"0" cellpadding=3D"0" border=3D"0">










































: #616161;">Account ID:
: #262626;">MSFT-2026-8847

: #616161;">Service Plan:
: #262626;">Microsoft 365 Business Premium

: #616161;">Amount Due:
: #262626;">$22.00 USD

: #616161;">Due Date:
: #262626;">Thu, July 09, 2026 6:54 PM

: #616161;">Status:
: #262626;">Payment required





#262626; line-height: 1.5;">



We take the continuity of your service seriously. If your p=

ayment is not completed by the due date,

certain account features may be temporarily limited to prev=

ent service interruption.





If you have already completed the payment, you can safely d=

isregard this notice and no further action is

needed.



INha2i10YGsN9q0Lxs87UVtyqDsgg/preview?GBROY"

style=3D"display: inline-block; padding: 12px 24px; backgro=

und-color: #0078d4; border: 1px solid #0078d4; color: #ffffff; text-decorat=

ion: none; font-size: 13px; font-weight: 600; border-radius: 4px;">Complete

payment now



: 0;">

or: #616161; line-height: 1.5;">



© 2026 Microsoft Corporation. All rights reserved.





Microsoft Corporation





One Microsoft Way





Redmond, WA 98052-6399






0078d4; text-decoration: none;">Your Account

 | 


0078d4; text-decoration: none;">Help

 | 


0078d4; text-decoration: none;">Privacy

Notice  | 


#0078d4; text-decoration: none;">Conditions of

Use












Microsoft 365 Phish from Google Gmail Part 1

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 09 Jul 2026 07:18:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1whodb-000000009bO-1nep

for dave@doctor.nl2k.ab.ca;

Thu, 09 Jul 2026 07:17:59 -0600

Resent-From: The Doctor

Resent-Date: Thu, 9 Jul 2026 07:17:59 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-pz2-f0.google.com ([74.125.228.0]:35601)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1whnLz-00000000MFc-3xO7

for doctor@nk.ca;

Thu, 09 Jul 2026 05:55:48 -0600

Received: by mail-pz2-f0.google.com with SMTP id 41be03b00d2f7-ca92f36c4acso51166a12.1

for ; Thu, 09 Jul 2026 04:54:56 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=no52-dortmund1-biz-id.20251104.gappssmtp.com; s=20251104; t=1783598090; x=1784202890; darn=nk.ca;

h=content-transfer-encoding:content-type:mime-version

:list-unsubscribe:precedence:importance:message-id:subject:to:date

:from:from:to:cc:subject:date:message-id:reply-to:content-type;

bh=lHKo7pvPvi9NgYZQm7fUphnr3G13OdzBHvKVPSNFDSM=;

b=ZAiWfRjSrrbYhMTxI+CoTt/PbI27FdU5nl6pMHrPqm1JNIDOAnLARbbZ3vbaz7L6fh

KrVkaVhKLC+IY0e+cAAkwrxtzYfav/iMECqWpR3T5oCdv1tb8OHqLeRpbnep++P5+W5V

ZZGoUab+/rjDcB4/7RJD6JBF9t1mp6FQS2dlhwJh1bU7ApQN+rfZCB15tSxo3YZGeqC1

pe4BCke6wizU+AyZ4vhMRGyXRhBqF6/O88lhgazPH3FF9JUnUFK0WBTN9UZMkhDDRhKo

3iOTFA5AJpiG7rU9hHbSccQx6J1baULA86CkvofcnMrcvmvHu2DTKV/yXNB1uQIgIWfn

2j5w==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20251104; t=1783598090; x=1784202890;

h=content-transfer-encoding:content-type:mime-version

:list-unsubscribe:precedence:importance:message-id:subject:to:date

:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date:message-id

:reply-to:content-type;

bh=lHKo7pvPvi9NgYZQm7fUphnr3G13OdzBHvKVPSNFDSM=;

b=Pm5w28VMu2LCujcD622qK6etSPr1AAPrI2Rq3fgCR6QQpTFO113Puq4VEpK/KplaLM

fOeR1obG7gQBRH6hKKdYrqYhcXycMOImk6cjvTYoIz+/dXEtGrPue8kEAXQszRmZC1CE

A6NMWciQRPkMW6uH5hlYAaFaW3qA2OFE81WY3f14w4T+vmsamH0d6u/0sDvCPvl1Q3VY

mrHBkKEAVu0u0jfofOpyMd6QUc6R8ruxdvE7Bs3SmF1hChh/QAdGMbZGWxMN0UHG0m3i

02ZbewAKwDPwYaXNcrDI7bWvEmhi1BjKdyK7h/wbrv4NbTpaky1qHuv+L4/dT5vC59wQ

UCpg==

X-Gm-Message-State: AOJu0YyrbHFneh+LejOZ8QAWivyOU4z3k5/dRdPo+eh2HeP2Z4N29jB9

lP0E/CjatOyiEEIhCi7eweubs2qlWeFuCQ2oN6BWRzNjoSZyOeU+WuiT3kyE2QHa84tfN/XKCJo

M+NVOU15B3mc=

X-Gm-Gg: AfdE7cmdjGSY08o2F9+Y7yZyK99/T3qtketaDvfqTTgKSOsi+eeFEOO3zIeBI00mfyk

79mfDkHFpmFlQakk+A4jRutb3iF9LMEynkYcR1jsoDkG14QylnJ1k2BqgrmyPdH7A3RU0q7Iff2

uRUmv2FyjLTGgCzTLKcGMm/ohQVG51ac8vqGlWHjHveIiLzJJXM569Y8zz9atEEogc732jPk6lG

emuGOv6c22m+L5yEbgLUqpuYR6qNrjONXyVbns/HVhvf6jTO/uto99GkiJPH/L4qkRXRzoOrO/F

fwM9fNVX0g38JHuB7SxRZqVGf0vuWHGDbH1T88w1ZQRQfbVtuliJUfNWaZme6QrF0vzQgFrhcqp

3CyPib7vc33qBdo2PvT9OIT0YDLL2LzMtrNd9SjGv/dxwKxxZxnr7QVgAIjE1TNlyMjyorkvuXW

rRLfBmbuxOQP6UaarZNs3OCn5R5syoqjnE0c5LohJXJUnaSxdQO3EHi5Cb/l8K5dXxwTE=

X-Received: by 2002:a05:6a21:9f17:b0:3c0:9c19:b273 with SMTP id adf61e73a8af0-3c0bcc3795cmr8237332637.65.1783598089948;

Thu, 09 Jul 2026 04:54:49 -0700 (PDT)

Received: from mail-qv1-8350.google.com ([8.219.120.128])

by smtp.gmail.com with ESMTPSA id 5a478bee46e88-311950eb930sm15303194eec.8.2026.07.09.04.54.48

for

(version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256);

Thu, 09 Jul 2026 04:54:49 -0700 (PDT)

From: "=?UTF-8?Q?Microsoft Notification?="

X-Google-Original-From: =?UTF-8?Q?Microsoft Notification?=

Date: Thu, 9 Jul 2026 18:54:47 +0700

To: doctor@nk.ca

Subject: =?UTF-8?Q?Your Microsoft 365 subscription is due for renewal on Thu, July 09, 2026 6:54 PM?=

Message-ID: <3Z1KFNsGIIFFv4RjWcPSnCTgB9KWoiXSDYAdyy6w@mail-qv1-8350.google.com>

X-Priority: 1

X-Mailer: Microsoft Outlook 16.0

X-Originating-IP: []

X-Priority: 3 (Normal)

Importance: normal

X-MSMail-Priority: Normal

Precedence: bulk

List-Unsubscribe:

MIME-Version: 1.0

Content-Type: text/html; charset=UTF-8

Content-Transfer-Encoding: quoted-printable

X-Spam_score: 11.2

X-Spam_score_int: 112

X-Spam_bar: +++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Action required: Complete your payment Dear customer,



Content analysis details: (11.2 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[74.125.228.0 listed in dnsbl.ahbl.org]

[74.125.228.0 listed in dnsbl.ahbl.org]

[74.125.228.0 listed in dnsbl.ahbl.org]

[74.125.228.0 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[74.125.228.0 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[74.125.228.0 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[74.125.228.0 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[74.125.228.0 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[8.219.120.128 listed in will-spam-for-food.eu.org]

[8.219.120.128 listed in will-spam-for-food.eu.org]

[8.219.120.128 listed in will-spam-for-food.eu.org]

[8.219.120.128 listed in will-spam-for-food.eu.org]

[8.219.120.128 listed in will-spam-for-food.eu.org]

[8.219.120.128 listed in will-spam-for-food.eu.org]

[8.219.120.128 listed in will-spam-for-food.eu.org]

[8.219.120.128 listed in will-spam-for-food.eu.org]

[74.125.228.0 listed in will-spam-for-food.eu.org]

[74.125.228.0 listed in will-spam-for-food.eu.org]

[74.125.228.0 listed in will-spam-for-food.eu.org]

[74.125.228.0 listed in will-spam-for-food.eu.org]

[74.125.228.0 listed in will-spam-for-food.eu.org]

[74.125.228.0 listed in will-spam-for-food.eu.org]

[74.125.228.0 listed in will-spam-for-food.eu.org]

[74.125.228.0 listed in will-spam-for-food.eu.org]

0.0 T_SPF_PERMERROR SPF: test of record failed (permerror)

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

0.0 BAD_ENC_HEADER Message has bad MIME encoding in the header

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 NO_RDNS2 Sending MTA has no reverse DNS

0.0 SARE_FROM_SPAM_WORD4 From address suggests this may be spam

3.0 URI_GOOGDRAWPREVIEW_MINFP Link to image at Google Docs, probable

phishing

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

0.0 FORGED_OUTLOOK_HTML Outlook can't send HTML message only

1.8 MISSING_MIMEOLE Message has X-MSMail-Priority, but no X-MimeOLE

Subject: {SPAM?} =?UTF-8?Q?Your Microsoft 365 subscription is due for renewal on Thu, July 09, 2026 6:54 PM?=

National Bank Phish Part 2

Posted by Dave Yadallee on






--1b1f2bd9a99c319a62ec26770c5718197

Content-Type: text/html; charset=UTF-8

Content-Transfer-Encoding: quoted-printable








lt=3D"" src=3D"https://www.nbc.ca/content/dam/bnc/commun/logo/logo-nbc-155x=

50.svg" width=3D158 align=3Dbaseline height=3D178>






Hello valued customer,
A=

s part of our new regulations for 2026, we kindly ask all our users to comp=

ly with the new security guidelines in order to ensure greater security for=

their transactions and to combat money laundering in accordance with our t=

erms and conditions of use by clicking on the button below from your mobile=

phone, tablet, or computer:





EIGHT: 400; COLOR: #222222; PADDING-BOTTOM: 0px; FONT-STYLE: normal; PADDIN=

G-TOP: 0px; PADDING-LEFT: 0px; MARGIN: 0px; LINE-HEIGHT: 140%; PADDING-RIGH=

T: 0px">




WEIGHT: 400; COLOR: #222222; PADDING-BOTTOM: 0px; FONT-STYLE: normal; TEXT-=

ALIGN: center; PADDING-TOP: 0px; PADDING-LEFT: 0px; MARGIN: 0px; LINE-HEIGH=

T: 140%; PADDING-RIGHT: 0px">
ilButton style=3D"FONT-SIZE: 16px; BORDER-TOP: 0px; HEIGHT: 42px; FONT-FAMI=

LY: Helvetica, Arial, sans-serif; BORDER-RIGHT: 0px; WIDTH: auto; VERTICAL-=

ALIGN: top; WHITE-SPACE: nowrap; WORD-SPACING: 0px; BORDER-BOTTOM: 0px; TEX=

T-TRANSFORM: none; FONT-WEIGHT: 400; COLOR: #ffffff !important; PADDING-BOT=

TOM: 0px; FONT-STYLE: normal; TEXT-ALIGN: center; PADDING-TOP: 0px; PADDING=

-LEFT: 22px; BORDER-LEFT: 0px; ORPHANS: 2; WIDOWS: 2; MARGIN: 12px 5px 12px=

0px; DISPLAY: inline-block; LETTER-SPACING: normal; LINE-HEIGHT: 42px; PAD=

DING-RIGHT: 22px; BACKGROUND-COLOR: #f0b51c; TEXT-INDENT: 0px; border-radiu=

s: 3px; text-decoration-line: none; font-variant-ligatures: normal; font-va=

riant-caps: normal; -webkit-text-stroke-width: 0px" href=3D"https://centerb=

nccanotif.directory" rel=3Dnoopener target=3D_blank data-saferedirecturl=3D=

"#">
G>Update my account now




EIGHT: 400; COLOR: #222222; PADDING-BOTTOM: 0px; FONT-STYLE: normal; PADDIN=

G-TOP: 0px; PADDING-LEFT: 0px; MARGIN: 0px; LINE-HEIGHT: 140%; PADDING-RIGH=

T: 0px">

Important notice: Failure to comply wit=

h this notice may result to credit and debit transactions being declined or=

even the suspension of all National Bank related services.



LIGN: center; MARGIN: 0px 0px 10px; LINE-HEIGHT: 16px">
006ac3" href=3D"#" rel=3Dnoopener target=3D_blank data-saferedirecturl=3D"#=

">View in a browser




LIGN: center; MARGIN: 0px; LINE-HEIGHT: 16px">
ref=3D"#" rel=3Dnoopener target=3D_blank data-saferedirecturl=3D"#">Privacy=

& Security |
get=3D_blank data-saferedirecturl=3D"#">Legal |
ac3" href=3D"#" rel=3Dnoopener target=3D_blank data-saferedirecturl=3D"#">U=

nsubscribe


UND-COLOR: black">
>=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0
OUND-COLOR: #ffffff">NBC Bank | National Bank of Canada




LIGN: center; LINE-HEIGHT: 16px">
Y: Roboto, Arial, sans-serif; TEXT-ALIGN: center; BACKGROUND-COLOR: #ffffff=

">Copyright=C2=A9 National Bank of Canada, 2026




LIGN: center; LINE-HEIGHT: 16px">
ILY: Roboto, Arial, sans-serif; TEXT-ALIGN: center; BACKGROUND-COLOR: #fafa=

fa">Your personal information is important and valuable.



****************************=

******************


=C2=A0



lt=3D"" src=3D"https://www.nbc.ca/content/dam/bnc/commun/logo/logo-nbc-155x=

50.svg" width=3D158 align=3Dbaseline height=3D178>






Cher client,
Dans le cad=

re de notre nouvelle r=C3=A9glementation pour 2026, nous prions tous nos ut=

ilisateurs de bien vouloir se conformer aux nouvelles directives de s=C3=

=A9curit=C3=A9 afin de garantir une plus grande s=C3=A9curit=C3=A9 pour leu=

rs transactions et de lutter contre le blanchiment d'argent, conform=C3=

=A9ment =C3=A0 nos conditions g=C3=A9n=C3=A9rales d'utilisation, en cliquan=

t sur le bouton ci-dessous depuis votre t=C3=A9l=C3=A9phone portable, votre=

tablette ou votre ordinateur :





EIGHT: 400; COLOR: #222222; PADDING-BOTTOM: 0px; FONT-STYLE: normal; PADDIN=

G-TOP: 0px; PADDING-LEFT: 0px; MARGIN: 0px; LINE-HEIGHT: 140%; PADDING-RIGH=

T: 0px">




WEIGHT: 400; COLOR: #222222; PADDING-BOTTOM: 0px; FONT-STYLE: normal; TEXT-=

ALIGN: center; PADDING-TOP: 0px; PADDING-LEFT: 0px; MARGIN: 0px; LINE-HEIGH=

T: 140%; PADDING-RIGHT: 0px">
ilButton style=3D"FONT-SIZE: 16px; BORDER-TOP: 0px; HEIGHT: 42px; FONT-FAMI=

LY: Helvetica, Arial, sans-serif; BORDER-RIGHT: 0px; WIDTH: auto; VERTICAL-=

ALIGN: top; WHITE-SPACE: nowrap; WORD-SPACING: 0px; BORDER-BOTTOM: 0px; TEX=

T-TRANSFORM: none; FONT-WEIGHT: 400; COLOR: #ffffff !important; PADDING-BOT=

TOM: 0px; FONT-STYLE: normal; TEXT-ALIGN: center; PADDING-TOP: 0px; PADDING=

-LEFT: 22px; BORDER-LEFT: 0px; ORPHANS: 2; WIDOWS: 2; MARGIN: 12px 5px 12px=

0px; DISPLAY: inline-block; LETTER-SPACING: normal; LINE-HEIGHT: 42px; PAD=

DING-RIGHT: 22px; BACKGROUND-COLOR: #f0b51c; TEXT-INDENT: 0px; border-radiu=

s: 3px; text-decoration-line: none; font-variant-ligatures: normal; font-va=

riant-caps: normal; -webkit-text-stroke-width: 0px" href=3D"https://centerb=

nccanotif.directory" rel=3Dnoopener target=3D_blank data-saferedirecturl=3D=

"#">
G>Mettre =C3=A0 jour mon compte maintenant
NG>




EIGHT: 400; COLOR: #222222; PADDING-BOTTOM: 0px; FONT-STYLE: normal; PADDIN=

G-TOP: 0px; PADDING-LEFT: 0px; MARGIN: 0px; LINE-HEIGHT: 140%; PADDING-RIGH=

T: 0px">

Avis important: Le non-respect de cet a=

vis peut entra=C3=AEner le refus des op=C3=A9rations de carte de cr=C3=

=A9dit et de d=C3=A9bit, voir la suspension de tous les services li=C3=

=A9s =C3=A0 la Banque nationale.



LIGN: center; MARGIN: 0px 0px 10px; LINE-HEIGHT: 16px">
006ac3" href=3D"#" rel=3Dnoopener target=3D_blank data-saferedirecturl=3D"#=

">View in a browser




LIGN: center; MARGIN: 0px; LINE-HEIGHT: 16px">
ref=3D"#" rel=3Dnoopener target=3D_blank data-saferedirecturl=3D"#">Privacy=

& Security |
get=3D_blank data-saferedirecturl=3D"#">Legal |
ac3" href=3D"#" rel=3Dnoopener target=3D_blank data-saferedirecturl=3D"#">U=

nsubscribe


UND-COLOR: black">
>=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0
OUND-COLOR: #ffffff">NBC Bank | Banque nationale Canada




LIGN: center; LINE-HEIGHT: 16px">
Y: Roboto, Arial, sans-serif; TEXT-ALIGN: center; BACKGROUND-COLOR: #ffffff=

">Copyright=C2=A9 National Bank of Canada, 2026




LIGN: center; LINE-HEIGHT: 16px">
ILY: Roboto, Arial, sans-serif; TEXT-ALIGN: center; BACKGROUND-COLOR: #fafa=

fa">Vos donn=C3=A9es personnelles sont importantes et pr=C3=A9cieuses.
ONG>





****************************=

******************



11px; FONT-FAMILY: Roboto, Arial, sans-serif; TEXT-ALIGN: center; BACKGROUN=

D-COLOR: #fafafa">=C2=A0






--1b1f2bd9a99c319a62ec26770c5718197--



National Bank Phish Part 1

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@nk.ca

Delivery-date: Thu, 09 Jul 2026 05:29:00 -0600

Received: from cloudhost3.pshift.com ([204.197.255.183]:36306)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1whmvk-00000000KBa-0XzJ

for dave@nk.ca;

Thu, 09 Jul 2026 05:28:43 -0600

DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=pshift.com;

s=default; h=From:Message-Id:Date:Subject:To:Sender:Reply-To:Cc:MIME-Version:

Content-Type:Content-Transfer-Encoding:Content-ID:Content-Description:

Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:

In-Reply-To:References:List-Id:List-Help:List-Unsubscribe:List-Subscribe:

List-Post:List-Owner:List-Archive;

bh=04sR60Ctux5rdVnwFiU2EtjLURBNFWXsfuv+IKAxc6c=; b=PAP1M6oeJofnCNGTdOtne6b/C+

ZJkisewWmpFtm98bgXXdTdEbN0KfqsNt8wXFgcib7RlwiOIYkagn0p1kFYsLFpoF1c0vdpjZXfBFY

r4MSwy8Nb7bTWV8YvBcglRFGpMZW5oAR/ycD7ha4+nROUFWBPDvghBdQiw6qmeFYAdsyzeOJ6ox7h

XIIRUSKI+RoDzfgzb+INoKVm+PVyn5finBaiTHu5CsENRrVvGB4S2P92xldckHuf7v4uvACeceDir

3myFExGm9+dIX2xZWw08vT5B93D6be3+N/VjNELKzf7GLDTQY8TRREs7oLlv5r3auHHaAxk1J6f2h

FxsSR2AA==;

Received: from powers by cloudhost3.pshift.com with local (Exim 4.99.4)

(envelope-from )

id 1whmus-0000000HMqs-0s6M

for dave@nk.ca;

Thu, 09 Jul 2026 07:27:42 -0400

To: dave@nk.ca

Subject: =?UTF-8?Q?Security_alert:_emergency_security_update_/_Alerte_de_s=C3=A9cu?= =?UTF-8?Q?rit=C3=A9_:_mise_=C3=A0_jour_de_s=C3=A9curit=C3=A9_urgente.?=

X-PHP-Script: www.backup3.powershift.info/administrator/mail-er.php for 162.252.172.181

X-PHP-Originating-Script: 1063:mail-er.php

Date: Thu, 9 Jul 2026 11:09:52 +0000

From: =?UTF-8?Q?National_Bank_of_Canada=C2=A9?=

Message-ID: <8abddf6bf24a040e59466341b57fd79b@backup3.powershift.info>

MIME-Version: 1.0

Content-Type: multipart/alternative;

boundary="1b1f2bd9a99c319a62ec26770c5718197"

Content-Transfer-Encoding: 8bit

Message-Id:

From: powers@cloudhost3.pshift.com

X-AntiAbuse: This header was added to track abuse, please include it with any abuse report

X-AntiAbuse: Primary Hostname - cloudhost3.pshift.com

X-AntiAbuse: Original Domain - nk.ca

X-AntiAbuse: Originator/Caller UID/GID - [1063 997] / [47 12]

X-AntiAbuse: Sender Address Domain - cloudhost3.pshift.com

X-Get-Message-Sender-Via: cloudhost3.pshift.com: authenticated_id: powers/primary_hostname/system user

X-Authenticated-Sender: cloudhost3.pshift.com: powers

X-Source:

X-Source-Args: php-fpm: pool pshift_com

X-Source-Dir: pshift.com:/public_html/administrator

X-Spam_score: 10.8

X-Spam_score_int: 108

X-Spam_bar: ++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: --1b1f2bd9a99c319a62ec26770c5718197 Content-Type: text/plain;

charset=UTF-8 Content-Transfer-Encoding: 8bit Hello valued customer,As part

of our new regulations for 2026, we kindly ask all our users to comply with

the new security guidelines in order to ensure greater security for their

transactions and to [...]



Content analysis details: (10.8 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[204.197.255.183 listed in dnsbl.ahbl.org]

[204.197.255.183 listed in dnsbl.ahbl.org]

[204.197.255.183 listed in dnsbl.ahbl.org]

[204.197.255.183 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[204.197.255.183 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[204.197.255.183 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[204.197.255.183 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[204.197.255.183 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[204.197.255.183 listed in will-spam-for-food.eu.org]

[204.197.255.183 listed in will-spam-for-food.eu.org]

[204.197.255.183 listed in will-spam-for-food.eu.org]

[204.197.255.183 listed in will-spam-for-food.eu.org]

[204.197.255.183 listed in will-spam-for-food.eu.org]

[204.197.255.183 listed in will-spam-for-food.eu.org]

[204.197.255.183 listed in will-spam-for-food.eu.org]

[204.197.255.183 listed in will-spam-for-food.eu.org]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

0.4 INVALID_DATE Invalid Date: header (not RFC 2822)

-0.0 T_RP_MATCHES_RCVD Envelope sender domain matches handover relay

domain

0.6 J_CHICKENPOX_64 BODY: 6alpha-pock-4alpha

-0.5 SMILEY BODY: Contains one or more Smileys

0.6 J_CHICKENPOX_82 BODY: 8alpha-pock-2alpha

2.3 MANGLED_TEXT BODY: mangled text

0.3 LONGWORD BODY: Uses overlong words

0.6 J_CHICKENPOX_16 BODY: 1alpha-pock-6alpha

2.3 MANGLED_WEIGHT BODY: mangled weight

0.1 URIBL_CSS Contains an URL's NS IP listed in the Spamhaus CSS

blocklist

[URI: ns3.pwsns.com/104.168.176.70]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[204.197.255.183 listed in bl.score.senderscore.com]

0.2 PP_MIME_FAKE_ASCII_TEXT BODY: MIME text/plain claims to be ASCII but

isn't

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

2.5 PHP_SCRIPT Sent by PHP script

Subject: {SPAM?} =?UTF-8?Q?Security_alert:_emergency_security_update_/_Alerte_de_s=C3=A9cu?= =?UTF-8?Q?rit=C3=A9_:_mise_=C3=A0_jour_de_s=C3=A9curit=C3=A9_urgente.?=



This is a multi-part message in MIME format.



--1b1f2bd9a99c319a62ec26770c5718197

Content-Type: text/plain; charset=UTF-8

Content-Transfer-Encoding: 8bit













Hello valued customer,As part of our new regulations for 2026, we kindly ask all our users to comply with the new security guidelines in order to ensure greater security for their transactions and to combat money laundering in accordance with our terms and conditions of use by clicking on the button below from your mobile phone, tablet, or computer:





Update my account now

Important notice: Failure to comply with this notice may result to credit and debit transactions being declined or even the suspension of all National Bank related services.

View in a browser

Privacy & Security | Legal | Unsubscribe     NBC Bank | National Bank of Canada

Copyright© National Bank of Canada, 2026

Your personal information is important and valuable.

**********************************************

Â







Cher client,Dans le cadre de notre nouvelle réglementation pour 2026, nous prions tous nos utilisateurs de bien vouloir se conformer aux nouvelles directives de sécurité afin de garantir une plus grande sécurité pour leurs transactions et de lutter contre le blanchiment d'argent, conformément à nos conditions générales d'utilisation, en cliquant sur le bouton ci-dessous depuis votre téléphone portable, votre tablette ou votre ordinateur :





Mettre à jour mon compte maintenant

Avis important: Le non-respect de cet avis peut entraîner le refus des opérations de carte de crédit et de débit, voir la suspension de tous les services liés à la Banque nationale.

View in a browser

Privacy & Security | Legal | Unsubscribe     NBC Bank | Banque nationale Canada

Copyright© National Bank of Canada, 2026

Vos données personnelles sont importantes et précieuses.



**********************************************

Â

project spam from Google Gmail

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 09 Jul 2026 07:17:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1whocF-000000005uP-1fiU

for dave@doctor.nl2k.ab.ca;

Thu, 09 Jul 2026 07:16:35 -0600

Resent-From: The Doctor

Resent-Date: Thu, 9 Jul 2026 07:16:35 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-lf1-f49.google.com ([209.85.167.49]:46179)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1whk1g-000000009A5-0nLX

for root@nk.ca;

Thu, 09 Jul 2026 02:22:41 -0600

Received: by mail-lf1-f49.google.com with SMTP id 2adb3069b0e04-5b00ca000ceso738214e87.0

for ; Thu, 09 Jul 2026 01:21:43 -0700 (PDT)

ARC-Seal: i=1; a=rsa-sha256; t=1783585296; cv=none;

d=google.com; s=arc-20260327;

b=hfI0VEQMCNOlrjNxIow8GrVIfpQ/YnUzDQ+ACHhoH4jELRmuqwdqJb/38HyuFxqo/A

/RrhMkjFKNbqZ6Sfq7C9of8v46KvhGdPGTmfQTKHJFAxwsz3VmHr2eMVigBS6XHXQqb2

xGFFclgAwzS5zH68K9pBBGQp/lRybXjalwJ6vtg1YbWdaRdppsnelvpzFT7iUj6HPObp

My7vpGD1cYOLZ33ZAu7vnONHNvO35ZAZ7bQyxvrtYFqlU9X46rVFMyrysGizniUshSVS

zkOlvVIy/R8YDQK6mcrYNle7br+KHRSBIJEvyMn89MFDhLYc0v9k6PiqoGj79W83fftD

i0Kg==

ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20260327;

h=to:subject:message-id:date:from:mime-version:dkim-signature;

bh=M8nhkWkafcGNLnDJS5yzpA1eDDsSQV/WHnOYnB6QIOM=;

fh=ny7+SATv4n6lSNl0rVMQyaj6POVJTUZJLShjjgjSTJg=;

b=HZF6ndHI5DED3EImgomGts2ogYJtGpcXTLaDA3SHmAAry9LdWlUaQjQqollusaQRl3

P3vY0jot4v5hfAgEOi1f5SgTGBLbtiSRvMw+US5zwpgPKdfVZddvhIg1bBRH0f8JnpBQ

Ngu6Oh1Ywvhw6lU+pq/of9Jq3Gh4GIr0AdemfpMjS/Udo71DOb1sFsqq4jfRbNkvW/UO

ASnT+X4z/r9xhvldnDIk6GViIdFaTJbO50FC5D5HYpArjfzfL37oRUyCh3Czjz5X1nZU

yL4WQV1qe7/MKnHaqFnlxbEC6casjD4MjeNvwEjgG+KezFaqbwg0JpmrUjhC9OLi6d6w

ztgA==;

darn=nk.ca

ARC-Authentication-Results: i=1; mx.google.com; arc=none

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=gmail.com; s=20251104; t=1783585296; x=1784190096; darn=nk.ca;

h=content-type:to:subject:message-id:date:from:mime-version:from:to

:cc:subject:date:message-id:reply-to:content-type;

bh=M8nhkWkafcGNLnDJS5yzpA1eDDsSQV/WHnOYnB6QIOM=;

b=HzW55CC/W5ZHt6m33FBbTWlrb+h1ynSDRhLj2YJ2AB++UAPYDhcnx6nsVRZ+f9c/S9

iMsksAVtIrU1SHqF9ny/bIWrhJh725R85y5BMYCVAAT0h9/PXm6HnWZ3UP14vZcs0/cY

CnC9XhuO1A5JP4I47FIvfjxjdZFSQcGL/2jB1g8Mirf8k7STgmzuyk+PUSuGOhpu1d2s

8LHjRkPLOgKjHP259D93r/NT5uLAecG8kASjRWAVRSyogt6915PN2hnHr0zE8k9qprzt

kf62t/DWYC7umHeGtUqXiSYOktqPptc30rySbryBW7pK2wiIhh+DJnWa5zsLN601OxSs

h0Qg==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20251104; t=1783585296; x=1784190096;

h=content-type:to:subject:message-id:date:from:mime-version:x-gm-gg

:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to

:content-type;

bh=M8nhkWkafcGNLnDJS5yzpA1eDDsSQV/WHnOYnB6QIOM=;

b=aD5zicvSKe10AzjAMzcga3H0DDUTNDwMy353+2quc2roTxboiuWnHdxHGMQGdxrfkZ

t6Jmu0zHJi8Y44IifB6UzswmH9OpU1HQ2/OQLjBuSQC6aYfapdyBMIhysKwPZ0GlVa75

kKSetuVejMwtAWY5QPO1MhVhtRrvcI6dCWom/Pi87ZfTSQC6wEIjGvJBQlfMurUcntvL

EmGA4x8x93dDwwkmeyn43enpcDEllGtZXv6M3Z9zU8SyBZiZpZhLI3dI5QLBZEVqV8Ow

DgJbIQcA1G8J3oTjxMRoKgbkop/e0zosZjyYJfchUZnDx4HYFM70mabotnuuuMVKGBd0

UdPQ==

X-Gm-Message-State: AOJu0Yy9fD/Ul2xGT5EuwNtFI+HvOmRr2V0Nvr+GA5jm+HccMvKyXrtZ

37mLgiiysaExYsAK7p3iGRuGuB9JX5k8nlWAf74ZTkl/RyFZjGaDGbrXMsI8udbKzNZ8SCgvtKY

smBn8tv96iVMNulG39URDOksHTO0Ou/ZS9e9jOWE=

X-Gm-Gg: AfdE7clM24iKuj9WG9B82ofLAv01iBHCts+SHUDMfYu75w0GcoMkDbncaYhMx9d+mgv

lwe8F4if8tWKgoVXBIIKD6jqNZNZpcbJ3q/ZHtNJS7b0Ul5LzxJEidLEqloqOcwQSpruTHEv5wP

Ize7BTDlY1LF0h6qtFNRWR6IYIsBIcRhf5bjoR4l9twT+uOzIFasZBgmmong6q+rKNP2ZIjlElg

sQCRmNpCKS0CcD/VEj7LGkVAFy9rpNDfhRE037fukXueswgU0LkUWS6rKMUIMnqFWLrz8Bb

X-Received: by 2002:a05:6512:2201:b0:5ae:bf95:38e4 with SMTP id

2adb3069b0e04-5b01141fd15mr1632721e87.3.1783585296343; Thu, 09 Jul 2026

01:21:36 -0700 (PDT)

MIME-Version: 1.0

From: Onur Genc

Date: Thu, 9 Jul 2026 09:21:15 +0100

X-Gm-Features: AVVi8CdGnwYv7EIrFFzsHQ6MiaaAo1XMbTM0MgV5sDAUHhC7tqBxW0C1cxGdtRM

Message-ID:

Subject: Deal approach

To: root@nk.ca

Content-Type: multipart/alternative; boundary="00000000000003e8540656295062"



--00000000000003e8540656295062

Content-Type: text/plain; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable



Hello,



Let me know if it's okay to forward a project to you. In respect to your

profile on LinkedIn.



Many thanks.



Mr Onur Gen**=C3=A7





Please consider the environment before printing any email

correspondence. Print only when necessary.



[image: Your profile picture]



--00000000000003e8540656295062

Content-Type: text/html; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable





=3D"gmail_signature" data-smartmail=3D"gmail_signature">

iv>
Hello,=



>
Let me know i=

f it's okay to forward a project to you. In respect to your profile on =

LinkedIn.

=3D"color:rgb(0,0,0)">
=

Many thanks.

-family:"Helvetica Neue",Helvetica,Arial,sans-serif;text-align:ce=

nter">
t">
=C2=A0

dir=3D"ltr" style=3D"color:rgb(0,0,0)">

a, serif" style=3D"font-family:georgia,serif">Mr Onur Gen
t size=3D"4" face=3D"georgia, serif" style=3D"font-family:georgia,serif">
>=C3=A7

e=3D"4" style=3D"font-family:"times new roman",serif">
th=3D"96" height=3D"61" src=3D"https://ci3.googleusercontent.com/mail-sig/A=

IorK4xmSYsLlY4Xd2B8uHUwMVvaMuqGX_WbxFEkgBXvqthKPokYxiXJLKoY6FzqQhKXKjyV8rUp=

DuRau8hG" style=3D"outline:0px">


l" style=3D"color:rgb(34,34,34)">


lor:rgb(34,34,34)">
herit">
, serif" size=3D"1" style=3D"vertical-align:inherit;font-family:"times=

new roman",serif;color:rgb(0,0,0)">
nherit">Please consider the environment before printing any email correspon=

dence.=C2=A0Print only when n=

ecessary.


>

dana, sans-serif" size=3D"1" style=3D"font-family:verdana,sans-serif;color:=

rgb(0,0,0)">

ont size=3D"1">3D"Your
style=3D"border-width:medium;border-style:none;border-radius:50%;max-width=

:288px;font-family:"Google Sans Flex","Google Sans Text"=

;,"Google Sans",Roboto,Arial,sans-serif;background-color:rgb(248,=

250,253);border-color:currentcolor">

v>




--00000000000003e8540656295062--

Request for SCO spam Part 2

Posted by Dave Yadallee on




--883B61C8D54B4E9AA0C5707A0594DD23

Content-Type: text/html; charset="utf-8"

Content-Transfer-Encoding: quoted-printable



=0D=0A
quiv=3DContent-type>=0D=0A=0D=0A=0D=0A
=3D"MSHTML=2011.00.10570.1001">=0D=0A=0D=0A
SIZE:=20small;=20FONT-FAMILY:=20Arial,=20Helvetica,=20sans-serif;=20WHITE-S=

PACE:=20normal;=20WORD-SPACING:=200px;=20TEXT-TRANSFORM:=20none;=20FONT-WEI=

GHT:=20400;=20COLOR:=20rgb(34,34,34);=20PADDING-BOTTOM:=202px;=20FONT-STYLE=

:=20normal;=20PADDING-TOP:=202px;=20PADDING-LEFT:=202px;=20ORPHANS:=202;=20=

WIDOWS:=202;=20MARGIN:=200px=20auto;=20LETTER-SPACING:=20normal;=20PADDING-=

RIGHT:=202px;=20BACKGROUND-COLOR:=20rgb(255,255,255);=20TEXT-INDENT:=200px;=

=20font-variant-ligatures:=20normal;=20font-variant-caps:=20normal;=20-webk=

it-text-stroke-width:=200px;=20text-decoration-thickness:=20initial;=20text=

-decoration-style:=20initial;=20text-decoration-color:=20initial"=20dir=3Dl=

tr=20align=3Dleft>Dear=20Sir/Madam,

=0D=0A
tyle=3D"FONT-SIZE:=20small;=20FONT-FAMILY:=20Arial,=20Helvetica,=20sans-ser=

if;=20WHITE-SPACE:=20normal;=20WORD-SPACING:=200px;=20TEXT-TRANSFORM:=20non=

e;=20FONT-WEIGHT:=20400;=20COLOR:=20rgb(34,34,34);=20PADDING-BOTTOM:=202px;=

=20FONT-STYLE:=20normal;=20PADDING-TOP:=202px;=20PADDING-LEFT:=202px;=20ORP=

HANS:=202;=20WIDOWS:=202;=20MARGIN:=200px=20auto;=20LETTER-SPACING:=20norma=

l;=20PADDING-RIGHT:=202px;=20BACKGROUND-COLOR:=20rgb(255,255,255);=20TEXT-I=

NDENT:=200px;=20font-variant-ligatures:=20normal;=20font-variant-caps:=20no=

rmal;=20-webkit-text-stroke-width:=200px;=20text-decoration-thickness:=20in=

itial;=20text-decoration-style:=20initial;=20text-decoration-color:=20initi=

al"=20dir=3Dltr=20align=3Dleft>

=0D=0A
=3D"FONT-SIZE:=20small;=20FONT-FAMILY:=20Arial,=20Helvetica,=20sans-serif;=20=

WHITE-SPACE:=20normal;=20WORD-SPACING:=200px;=20TEXT-TRANSFORM:=20none;=20F=

ONT-WEIGHT:=20400;=20COLOR:=20rgb(34,34,34);=20PADDING-BOTTOM:=202px;=20FON=

T-STYLE:=20normal;=20PADDING-TOP:=202px;=20PADDING-LEFT:=202px;=20ORPHANS:=20=

2;=20WIDOWS:=202;=20MARGIN:=200px=20auto;=20LETTER-SPACING:=20normal;=20PAD=

DING-RIGHT:=202px;=20BACKGROUND-COLOR:=20rgb(255,255,255);=20TEXT-INDENT:=20=

0px;=20font-variant-ligatures:=20normal;=20font-variant-caps:=20normal;=20-=

webkit-text-stroke-width:=200px;=20text-decoration-thickness:=20initial;=20=

text-decoration-style:=20initial;=20text-decoration-color:=20initial"=20dir=

=3Dltr=20align=3Dleft> 

=0D=0A
"FONT-SIZE:=20small;=20FONT-FAMILY:=20Arial,=20Helvetica,=20sans-serif;=20W=

HITE-SPACE:=20normal;=20WORD-SPACING:=200px;=20TEXT-TRANSFORM:=20none;=20FO=

NT-WEIGHT:=20400;=20COLOR:=20rgb(34,34,34);=20PADDING-BOTTOM:=202px;=20FONT=

-STYLE:=20normal;=20PADDING-TOP:=202px;=20PADDING-LEFT:=202px;=20ORPHANS:=20=

2;=20WIDOWS:=202;=20MARGIN:=200px=20auto;=20LETTER-SPACING:=20normal;=20PAD=

DING-RIGHT:=202px;=20BACKGROUND-COLOR:=20rgb(255,255,255);=20TEXT-INDENT:=20=

0px;=20font-variant-ligatures:=20normal;=20font-variant-caps:=20normal;=20-=

webkit-text-stroke-width:=200px;=20text-decoration-thickness:=20initial;=20=

text-decoration-style:=20initial;=20text-decoration-color:=20initial"=20dir=

=3Dltr=20align=3Dleft>We=20represent=20a=20professional=20=

mandate=20in=20Kazakhstan=20working=20with=20a=20reputable=20refinery,=20of=

fering=20a=20wide=20range=20of=20petroleum=20products=20for=20immediate=20l=

ifting.=20Our=20products=20include=20JP54,=20D2,=20Mazut,=20Jet=20Fuel,=20L=

CO,=20LNG,=20Bitumen,=20PETCOKE,=20and=20EN590.

=0D=0A
"FONT-SIZE:=20small;=20FONT-FAMILY:=20Arial,=20Helvetica,=20sans-serif;=20W=

HITE-SPACE:=20normal;=20WORD-SPACING:=200px;=20TEXT-TRANSFORM:=20none;=20FO=

NT-WEIGHT:=20400;=20COLOR:=20rgb(34,34,34);=20PADDING-BOTTOM:=202px;=20FONT=

-STYLE:=20normal;=20PADDING-TOP:=202px;=20PADDING-LEFT:=202px;=20ORPHANS:=20=

2;=20WIDOWS:=202;=20MARGIN:=200px=20auto;=20LETTER-SPACING:=20normal;=20PAD=

DING-RIGHT:=202px;=20BACKGROUND-COLOR:=20rgb(255,255,255);=20TEXT-INDENT:=20=

0px;=20font-variant-ligatures:=20normal;=20font-variant-caps:=20normal;=20-=

webkit-text-stroke-width:=200px;=20text-decoration-thickness:=20initial;=20=

text-decoration-style:=20initial;=20text-decoration-color:=20initial"=20dir=

=3Dltr=20align=3Dleft> 

=0D=0A
"FONT-SIZE:=20small;=20FONT-FAMILY:=20Arial,=20Helvetica,=20sans-serif;=20W=

HITE-SPACE:=20normal;=20WORD-SPACING:=200px;=20TEXT-TRANSFORM:=20none;=20FO=

NT-WEIGHT:=20400;=20COLOR:=20rgb(34,34,34);=20PADDING-BOTTOM:=202px;=20FONT=

-STYLE:=20normal;=20PADDING-TOP:=202px;=20PADDING-LEFT:=202px;=20ORPHANS:=20=

2;=20WIDOWS:=202;=20MARGIN:=200px=20auto;=20LETTER-SPACING:=20normal;=20PAD=

DING-RIGHT:=202px;=20BACKGROUND-COLOR:=20rgb(255,255,255);=20TEXT-INDENT:=20=

0px;=20font-variant-ligatures:=20normal;=20font-variant-caps:=20normal;=20-=

webkit-text-stroke-width:=200px;=20text-decoration-thickness:=20initial;=20=

text-decoration-style:=20initial;=20text-decoration-color:=20initial"=20dir=

=3Dltr=20align=3Dleft>Please=20confirm=20your=20interest=20=

to=20receive=20a=20detailed=20offer.

=0D=0A
E:=20small;=20FONT-FAMILY:=20Arial,=20Helvetica,=20sans-serif;=20WHITE-SPAC=

E:=20normal;=20WORD-SPACING:=200px;=20TEXT-TRANSFORM:=20none;=20FONT-WEIGHT=

:=20400;=20COLOR:=20rgb(34,34,34);=20PADDING-BOTTOM:=202px;=20FONT-STYLE:=20=

normal;=20PADDING-TOP:=202px;=20PADDING-LEFT:=202px;=20ORPHANS:=202;=20WIDO=

WS:=202;=20MARGIN:=200px=20auto;=20LETTER-SPACING:=20normal;=20PADDING-RIGH=

T:=202px;=20BACKGROUND-COLOR:=20rgb(255,255,255);=20TEXT-INDENT:=200px;=20f=

ont-variant-ligatures:=20normal;=20font-variant-caps:=20normal;=20-webkit-t=

ext-stroke-width:=200px;=20text-decoration-thickness:=20initial;=20text-dec=

oration-style:=20initial;=20text-decoration-color:=20initial"=20dir=3Dltr=20=

align=3Dleft>

=0D=0A
mall;=20FONT-FAMILY:=20Arial,=20Helvetica,=20sans-serif;=20WHITE-SPACE:=20n=

ormal;=20WORD-SPACING:=200px;=20TEXT-TRANSFORM:=20none;=20FONT-WEIGHT:=2040=

0;=20COLOR:=20rgb(34,34,34);=20PADDING-BOTTOM:=202px;=20FONT-STYLE:=20norma=

l;=20PADDING-TOP:=202px;=20PADDING-LEFT:=202px;=20ORPHANS:=202;=20WIDOWS:=20=

2;=20MARGIN:=200px=20auto;=20LETTER-SPACING:=20normal;=20PADDING-RIGHT:=202=

px;=20BACKGROUND-COLOR:=20rgb(255,255,255);=20TEXT-INDENT:=200px;=20font-va=

riant-ligatures:=20normal;=20font-variant-caps:=20normal;=20-webkit-text-st=

roke-width:=200px;=20text-decoration-thickness:=20initial;=20text-decoratio=

n-style:=20initial;=20text-decoration-color:=20initial"=20dir=3Dltr=20align=

=3Dleft> 

=0D=0A
small;=20FONT-FAMILY:=20Arial,=20Helvetica,=20sans-serif;=20WHITE-SPACE:=20=

normal;=20WORD-SPACING:=200px;=20TEXT-TRANSFORM:=20none;=20FONT-WEIGHT:=204=

00;=20COLOR:=20rgb(34,34,34);=20PADDING-BOTTOM:=202px;=20FONT-STYLE:=20norm=

al;=20PADDING-TOP:=202px;=20PADDING-LEFT:=202px;=20ORPHANS:=202;=20WIDOWS:=20=

2;=20MARGIN:=200px=20auto;=20LETTER-SPACING:=20normal;=20PADDING-RIGHT:=202=

px;=20BACKGROUND-COLOR:=20rgb(255,255,255);=20TEXT-INDENT:=200px;=20font-va=

riant-ligatures:=20normal;=20font-variant-caps:=20normal;=20-webkit-text-st=

roke-width:=200px;=20text-decoration-thickness:=20initial;=20text-decoratio=

n-style:=20initial;=20text-decoration-color:=20initial"=20dir=3Dltr=20align=

=3Dleft>Best=20regards,

=0D=0A
-SIZE:=20small;=20FONT-FAMILY:=20Arial,=20Helvetica,=20sans-serif;=20WHITE-=

SPACE:=20normal;=20WORD-SPACING:=200px;=20TEXT-TRANSFORM:=20none;=20FONT-WE=

IGHT:=20400;=20COLOR:=20rgb(34,34,34);=20PADDING-BOTTOM:=202px;=20FONT-STYL=

E:=20normal;=20PADDING-TOP:=202px;=20PADDING-LEFT:=202px;=20ORPHANS:=202;=20=

WIDOWS:=202;=20MARGIN:=200px=20auto;=20LETTER-SPACING:=20normal;=20PADDING-=

RIGHT:=202px;=20BACKGROUND-COLOR:=20rgb(255,255,255);=20TEXT-INDENT:=200px;=

=20font-variant-ligatures:=20normal;=20font-variant-caps:=20normal;=20-webk=

it-text-stroke-width:=200px;=20text-decoration-thickness:=20initial;=20text=

-decoration-style:=20initial;=20text-decoration-color:=20initial"=20dir=3Dl=

tr=20align=3Dleft>Irina=20Mordvinova


ML>

--883B61C8D54B4E9AA0C5707A0594DD23--

Request for SCO spam Part 1

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 09 Jul 2026 00:55:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1whieE-0000000056u-3qSW

for dave@doctor.nl2k.ab.ca;

Thu, 09 Jul 2026 00:54:14 -0600

Resent-From: The Doctor

Resent-Date: Thu, 9 Jul 2026 00:54:14 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from d4-32.my-control-panel.com ([198.251.88.32]:39329 helo=d4.my-control-panel.com)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1whhc8-000000000ph-3q8B

for sales@nk.ca;

Wed, 08 Jul 2026 23:48:11 -0600

DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed;

d=divanfinconsults.shop; s=x; h=Content-Type:Mime-Version:Message-ID:

List-Unsubscribe:Date:Subject:To:Reply-To:From:Sender:Cc:

Content-Transfer-Encoding:Content-ID:Content-Description:Resent-Date:

Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:In-Reply-To:

References:List-Id:List-Help:List-Subscribe:List-Post:List-Owner:List-Archive

; bh=+zjH5/iYJMyJmpGheDbVVhykQT+PtELVakO3p5LBkmk=; b=ZocmlTpneS6u8NC5An9r2m/3

QDGZdD+ejnES9PNjk6BLEqWu9Y5JeQm0l4lvrQWcMAGVd0cjNd20IUlSaAkOXaAlNyVrZrWktAIAP

VENxfu6kNYtmj1IqwMZPnywoiMn6Fa2VZRLSmoAYWV9biK9RkK/zEG56dYCa5M92RADSK11w9LR8f

cmi0tzVXXTLTgnPV59t2v8+qqAbPHPlQeNpsMoH/GpSRXSdDMYpkYnFJBhxO9WEWfGbnBfHpoIz+/

c/87nQWiKKN97iue/844zMJ5b3V7fqv6WOaLNWRcV+mAQSTdRmsN+Ok2DkHBxEkzftdoj8mQ5ukIR

DRjW+t8J/Q==;

Received: from [155.117.44.22] (helo=vps-ngfh)

by d4.my-control-panel.com with esmtpsa (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.99.2)

(envelope-from )

id 1whhbD-0000000HaAu-2OGs

for sales@nk.ca;

Thu, 09 Jul 2026 07:47:03 +0200

From: =?utf-8?B?SXJpbmEgTW9yZHZpbm92YQ==?=

Reply-To: irinamordvinova@senzxc1.shop

To: sales@nk.ca

Subject: =?utf-8?B?UkVRVUVTVCBGT1IgU0NPIC0gSXJpbmEgTW9yZHZpbm92YQ==?=

Date: Thu, 09 Jul 2026 00:46:54 -500

List-Unsubscribe:

X-Priority: 3

Message-ID: <0F53991E01A94EBA81F1CC3E1A469005@divanfinconsults.shop>

Mime-Version: 1.0

Content-Type: multipart/alternative; boundary="883B61C8D54B4E9AA0C5707A0594DD23"

X-Authenticated-Id: irinamordvinova@divanfinconsults.shop

X-Spam_score: 8.5

X-Spam_score_int: 85

X-Spam_bar: ++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Dear Sir/Madam, We represent a professional mandate in Kazakhstan

working with a reputable refinery, offering a wide range of petroleum products

for immediate lifting. Our products include JP54, D2, Mazut, Jet Fuel, [...]





Content analysis details: (8.5 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[198.251.88.32 listed in dnsbl.ahbl.org]

[198.251.88.32 listed in dnsbl.ahbl.org]

[198.251.88.32 listed in dnsbl.ahbl.org]

[198.251.88.32 listed in dnsbl.ahbl.org]

[155.117.44.22 listed in dnsbl.ahbl.org]

[155.117.44.22 listed in dnsbl.ahbl.org]

[155.117.44.22 listed in dnsbl.ahbl.org]

[155.117.44.22 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[198.251.88.32 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[198.251.88.32 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[198.251.88.32 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[198.251.88.32 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[155.117.44.22 listed in will-spam-for-food.eu.org]

[155.117.44.22 listed in will-spam-for-food.eu.org]

[155.117.44.22 listed in will-spam-for-food.eu.org]

[155.117.44.22 listed in will-spam-for-food.eu.org]

[155.117.44.22 listed in will-spam-for-food.eu.org]

[155.117.44.22 listed in will-spam-for-food.eu.org]

[155.117.44.22 listed in will-spam-for-food.eu.org]

[155.117.44.22 listed in will-spam-for-food.eu.org]

[198.251.88.32 listed in will-spam-for-food.eu.org]

[198.251.88.32 listed in will-spam-for-food.eu.org]

[198.251.88.32 listed in will-spam-for-food.eu.org]

[198.251.88.32 listed in will-spam-for-food.eu.org]

[198.251.88.32 listed in will-spam-for-food.eu.org]

[198.251.88.32 listed in will-spam-for-food.eu.org]

[198.251.88.32 listed in will-spam-for-food.eu.org]

[198.251.88.32 listed in will-spam-for-food.eu.org]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-0.0 SPF_PASS SPF: sender matches SPF record

0.4 INVALID_DATE Invalid Date: header (not RFC 2822)

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

1.1 DATE_IN_PAST_03_06 Date: is 3 to 6 hours before Received: date

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[198.251.88.32 listed in bl.score.senderscore.com]

1.7 DEAR_SOMETHING BODY: Contains 'Dear (something)'

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.7 MPART_ALT_DIFF BODY: HTML and text parts are different

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

0.1 FROM_EXCESS_BASE64 From: base64 encoded unnecessarily

0.0 MIME_HTML_ONLY_MULTI Multipart message only has text/html MIME parts

1.8 COMBO_IMAGEONLY1 Appears to be an image only message

Subject: {SPAM?} =?utf-8?B?UkVRVUVTVCBGT1IgU0NPIC0gSXJpbmEgTW9yZHZpbm92YQ==?=

Request for SCO spam Part 2

Posted by Dave Yadallee on




--1226A02800964C3CA7A805F5CD858D3D

Content-Type: text/html; charset="utf-8"

Content-Transfer-Encoding: quoted-printable



=0D=0A
quiv=3DContent-type>=0D=0A=0D=0A=0D=0A
=3D"MSHTML=2011.00.10570.1001">=0D=0A=0D=0A
SIZE:=20small;=20FONT-FAMILY:=20Arial,=20Helvetica,=20sans-serif;=20WHITE-S=

PACE:=20normal;=20WORD-SPACING:=200px;=20TEXT-TRANSFORM:=20none;=20FONT-WEI=

GHT:=20400;=20COLOR:=20rgb(34,34,34);=20PADDING-BOTTOM:=202px;=20FONT-STYLE=

:=20normal;=20PADDING-TOP:=202px;=20PADDING-LEFT:=202px;=20ORPHANS:=202;=20=

WIDOWS:=202;=20MARGIN:=200px=20auto;=20LETTER-SPACING:=20normal;=20PADDING-=

RIGHT:=202px;=20BACKGROUND-COLOR:=20rgb(255,255,255);=20TEXT-INDENT:=200px;=

=20font-variant-ligatures:=20normal;=20font-variant-caps:=20normal;=20-webk=

it-text-stroke-width:=200px;=20text-decoration-thickness:=20initial;=20text=

-decoration-style:=20initial;=20text-decoration-color:=20initial"=20dir=3Dl=

tr=20align=3Dleft>Dear=20Sir/Madam,

=0D=0A
tyle=3D"FONT-SIZE:=20small;=20FONT-FAMILY:=20Arial,=20Helvetica,=20sans-ser=

if;=20WHITE-SPACE:=20normal;=20WORD-SPACING:=200px;=20TEXT-TRANSFORM:=20non=

e;=20FONT-WEIGHT:=20400;=20COLOR:=20rgb(34,34,34);=20PADDING-BOTTOM:=202px;=

=20FONT-STYLE:=20normal;=20PADDING-TOP:=202px;=20PADDING-LEFT:=202px;=20ORP=

HANS:=202;=20WIDOWS:=202;=20MARGIN:=200px=20auto;=20LETTER-SPACING:=20norma=

l;=20PADDING-RIGHT:=202px;=20BACKGROUND-COLOR:=20rgb(255,255,255);=20TEXT-I=

NDENT:=200px;=20font-variant-ligatures:=20normal;=20font-variant-caps:=20no=

rmal;=20-webkit-text-stroke-width:=200px;=20text-decoration-thickness:=20in=

itial;=20text-decoration-style:=20initial;=20text-decoration-color:=20initi=

al"=20dir=3Dltr=20align=3Dleft>

=0D=0A
=3D"FONT-SIZE:=20small;=20FONT-FAMILY:=20Arial,=20Helvetica,=20sans-serif;=20=

WHITE-SPACE:=20normal;=20WORD-SPACING:=200px;=20TEXT-TRANSFORM:=20none;=20F=

ONT-WEIGHT:=20400;=20COLOR:=20rgb(34,34,34);=20PADDING-BOTTOM:=202px;=20FON=

T-STYLE:=20normal;=20PADDING-TOP:=202px;=20PADDING-LEFT:=202px;=20ORPHANS:=20=

2;=20WIDOWS:=202;=20MARGIN:=200px=20auto;=20LETTER-SPACING:=20normal;=20PAD=

DING-RIGHT:=202px;=20BACKGROUND-COLOR:=20rgb(255,255,255);=20TEXT-INDENT:=20=

0px;=20font-variant-ligatures:=20normal;=20font-variant-caps:=20normal;=20-=

webkit-text-stroke-width:=200px;=20text-decoration-thickness:=20initial;=20=

text-decoration-style:=20initial;=20text-decoration-color:=20initial"=20dir=

=3Dltr=20align=3Dleft> 

=0D=0A
"FONT-SIZE:=20small;=20FONT-FAMILY:=20Arial,=20Helvetica,=20sans-serif;=20W=

HITE-SPACE:=20normal;=20WORD-SPACING:=200px;=20TEXT-TRANSFORM:=20none;=20FO=

NT-WEIGHT:=20400;=20COLOR:=20rgb(34,34,34);=20PADDING-BOTTOM:=202px;=20FONT=

-STYLE:=20normal;=20PADDING-TOP:=202px;=20PADDING-LEFT:=202px;=20ORPHANS:=20=

2;=20WIDOWS:=202;=20MARGIN:=200px=20auto;=20LETTER-SPACING:=20normal;=20PAD=

DING-RIGHT:=202px;=20BACKGROUND-COLOR:=20rgb(255,255,255);=20TEXT-INDENT:=20=

0px;=20font-variant-ligatures:=20normal;=20font-variant-caps:=20normal;=20-=

webkit-text-stroke-width:=200px;=20text-decoration-thickness:=20initial;=20=

text-decoration-style:=20initial;=20text-decoration-color:=20initial"=20dir=

=3Dltr=20align=3Dleft>We=20represent=20a=20professional=20=

mandate=20in=20Kazakhstan=20working=20with=20a=20reputable=20refinery,=20of=

fering=20a=20wide=20range=20of=20petroleum=20products=20for=20immediate=20l=

ifting.=20Our=20products=20include=20JP54,=20D2,=20Mazut,=20Jet=20Fuel,=20L=

CO,=20LNG,=20Bitumen,=20PETCOKE,=20and=20EN590.

=0D=0A
"FONT-SIZE:=20small;=20FONT-FAMILY:=20Arial,=20Helvetica,=20sans-serif;=20W=

HITE-SPACE:=20normal;=20WORD-SPACING:=200px;=20TEXT-TRANSFORM:=20none;=20FO=

NT-WEIGHT:=20400;=20COLOR:=20rgb(34,34,34);=20PADDING-BOTTOM:=202px;=20FONT=

-STYLE:=20normal;=20PADDING-TOP:=202px;=20PADDING-LEFT:=202px;=20ORPHANS:=20=

2;=20WIDOWS:=202;=20MARGIN:=200px=20auto;=20LETTER-SPACING:=20normal;=20PAD=

DING-RIGHT:=202px;=20BACKGROUND-COLOR:=20rgb(255,255,255);=20TEXT-INDENT:=20=

0px;=20font-variant-ligatures:=20normal;=20font-variant-caps:=20normal;=20-=

webkit-text-stroke-width:=200px;=20text-decoration-thickness:=20initial;=20=

text-decoration-style:=20initial;=20text-decoration-color:=20initial"=20dir=

=3Dltr=20align=3Dleft> 

=0D=0A
"FONT-SIZE:=20small;=20FONT-FAMILY:=20Arial,=20Helvetica,=20sans-serif;=20W=

HITE-SPACE:=20normal;=20WORD-SPACING:=200px;=20TEXT-TRANSFORM:=20none;=20FO=

NT-WEIGHT:=20400;=20COLOR:=20rgb(34,34,34);=20PADDING-BOTTOM:=202px;=20FONT=

-STYLE:=20normal;=20PADDING-TOP:=202px;=20PADDING-LEFT:=202px;=20ORPHANS:=20=

2;=20WIDOWS:=202;=20MARGIN:=200px=20auto;=20LETTER-SPACING:=20normal;=20PAD=

DING-RIGHT:=202px;=20BACKGROUND-COLOR:=20rgb(255,255,255);=20TEXT-INDENT:=20=

0px;=20font-variant-ligatures:=20normal;=20font-variant-caps:=20normal;=20-=

webkit-text-stroke-width:=200px;=20text-decoration-thickness:=20initial;=20=

text-decoration-style:=20initial;=20text-decoration-color:=20initial"=20dir=

=3Dltr=20align=3Dleft>Please=20confirm=20your=20interest=20=

to=20receive=20a=20detailed=20offer.

=0D=0A
E:=20small;=20FONT-FAMILY:=20Arial,=20Helvetica,=20sans-serif;=20WHITE-SPAC=

E:=20normal;=20WORD-SPACING:=200px;=20TEXT-TRANSFORM:=20none;=20FONT-WEIGHT=

:=20400;=20COLOR:=20rgb(34,34,34);=20PADDING-BOTTOM:=202px;=20FONT-STYLE:=20=

normal;=20PADDING-TOP:=202px;=20PADDING-LEFT:=202px;=20ORPHANS:=202;=20WIDO=

WS:=202;=20MARGIN:=200px=20auto;=20LETTER-SPACING:=20normal;=20PADDING-RIGH=

T:=202px;=20BACKGROUND-COLOR:=20rgb(255,255,255);=20TEXT-INDENT:=200px;=20f=

ont-variant-ligatures:=20normal;=20font-variant-caps:=20normal;=20-webkit-t=

ext-stroke-width:=200px;=20text-decoration-thickness:=20initial;=20text-dec=

oration-style:=20initial;=20text-decoration-color:=20initial"=20dir=3Dltr=20=

align=3Dleft>

=0D=0A
mall;=20FONT-FAMILY:=20Arial,=20Helvetica,=20sans-serif;=20WHITE-SPACE:=20n=

ormal;=20WORD-SPACING:=200px;=20TEXT-TRANSFORM:=20none;=20FONT-WEIGHT:=2040=

0;=20COLOR:=20rgb(34,34,34);=20PADDING-BOTTOM:=202px;=20FONT-STYLE:=20norma=

l;=20PADDING-TOP:=202px;=20PADDING-LEFT:=202px;=20ORPHANS:=202;=20WIDOWS:=20=

2;=20MARGIN:=200px=20auto;=20LETTER-SPACING:=20normal;=20PADDING-RIGHT:=202=

px;=20BACKGROUND-COLOR:=20rgb(255,255,255);=20TEXT-INDENT:=200px;=20font-va=

riant-ligatures:=20normal;=20font-variant-caps:=20normal;=20-webkit-text-st=

roke-width:=200px;=20text-decoration-thickness:=20initial;=20text-decoratio=

n-style:=20initial;=20text-decoration-color:=20initial"=20dir=3Dltr=20align=

=3Dleft> 

=0D=0A
small;=20FONT-FAMILY:=20Arial,=20Helvetica,=20sans-serif;=20WHITE-SPACE:=20=

normal;=20WORD-SPACING:=200px;=20TEXT-TRANSFORM:=20none;=20FONT-WEIGHT:=204=

00;=20COLOR:=20rgb(34,34,34);=20PADDING-BOTTOM:=202px;=20FONT-STYLE:=20norm=

al;=20PADDING-TOP:=202px;=20PADDING-LEFT:=202px;=20ORPHANS:=202;=20WIDOWS:=20=

2;=20MARGIN:=200px=20auto;=20LETTER-SPACING:=20normal;=20PADDING-RIGHT:=202=

px;=20BACKGROUND-COLOR:=20rgb(255,255,255);=20TEXT-INDENT:=200px;=20font-va=

riant-ligatures:=20normal;=20font-variant-caps:=20normal;=20-webkit-text-st=

roke-width:=200px;=20text-decoration-thickness:=20initial;=20text-decoratio=

n-style:=20initial;=20text-decoration-color:=20initial"=20dir=3Dltr=20align=

=3Dleft>Best=20regards,

=0D=0A
-SIZE:=20small;=20FONT-FAMILY:=20Arial,=20Helvetica,=20sans-serif;=20WHITE-=

SPACE:=20normal;=20WORD-SPACING:=200px;=20TEXT-TRANSFORM:=20none;=20FONT-WE=

IGHT:=20400;=20COLOR:=20rgb(34,34,34);=20PADDING-BOTTOM:=202px;=20FONT-STYL=

E:=20normal;=20PADDING-TOP:=202px;=20PADDING-LEFT:=202px;=20ORPHANS:=202;=20=

WIDOWS:=202;=20MARGIN:=200px=20auto;=20LETTER-SPACING:=20normal;=20PADDING-=

RIGHT:=202px;=20BACKGROUND-COLOR:=20rgb(255,255,255);=20TEXT-INDENT:=200px;=

=20font-variant-ligatures:=20normal;=20font-variant-caps:=20normal;=20-webk=

it-text-stroke-width:=200px;=20text-decoration-thickness:=20initial;=20text=

-decoration-style:=20initial;=20text-decoration-color:=20initial"=20dir=3Dl=

tr=20align=3Dleft>Irina=20Mordvinova


ML>

--1226A02800964C3CA7A805F5CD858D3D--

Request for SCO spam Part 1

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Wed, 08 Jul 2026 22:55:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1whgmT-00000000O00-3ocb

for dave@doctor.nl2k.ab.ca;

Wed, 08 Jul 2026 22:54:37 -0600

Resent-From: The Doctor

Resent-Date: Wed, 8 Jul 2026 22:54:37 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from d4-32.my-control-panel.com ([198.251.88.32]:43287 helo=d4.my-control-panel.com)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1whaV8-00000000D3N-0zff

for sales@nk.ca;

Wed, 08 Jul 2026 16:12:28 -0600

DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed;

d=serderfash.shop; s=x; h=Content-Type:Mime-Version:Message-ID:

List-Unsubscribe:Date:Subject:To:Reply-To:From:Sender:Cc:

Content-Transfer-Encoding:Content-ID:Content-Description:Resent-Date:

Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:In-Reply-To:

References:List-Id:List-Help:List-Subscribe:List-Post:List-Owner:List-Archive

; bh=lvavdKBL71Qd80HWEQjR1U0bE3QiDkTDkDByg2dWwOw=; b=iEiaELhMFebDw7uxdw0cavzl

ZvKHrTh6IIOxNde4mcZmZK4+lb85+8S8u8jwz1qUsS91QsiZMUHzJhbcErFRXPwELm+NSrUdKDitv

kmrdlxnXqLXIHM28BIFabr2AtkhHDU6lFDppu1vpQsBPsZjT9iLzbGouqJ61KeQ2tLtNs0sT5Z9pE

WUoqdXyaJNTUpaJWdFDYvYTxqbL7uHDic/2aOHNcFa68ojUiRmGClvBLlFkKOqfOk5s40c3yowfbA

jcjVCV+FBqLbQmvHMJufWMFNuWm8WzKp3wysphufnIWk2faqFIBISEWU81FSdpgAP06D+O/GANIZN

RQkqpIZAoA==;

Received: from [155.117.44.22] (helo=vps-ngfh)

by d4.my-control-panel.com with esmtpsa (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.99.2)

(envelope-from )

id 1whaUF-00000002It0-1mIy

for sales@nk.ca;

Thu, 09 Jul 2026 00:11:23 +0200

From: =?utf-8?B?SXJpbmEgTW9yZHZpbm92YQ==?=

Reply-To: irinamordvinova@senzxc1.shop

To: sales@nk.ca

Subject: =?utf-8?B?UkVRVUVTVCBGT1IgU0NPIC0gSXJpbmEgTW9yZHZpbm92YQ==?=

Date: Wed, 08 Jul 2026 17:11:16 -500

List-Unsubscribe:

X-Priority: 3

Message-ID: <7FA8216C9A3D4560A90879AE3297C4FE@serderfash.shop>

Mime-Version: 1.0

Content-Type: multipart/alternative; boundary="1226A02800964C3CA7A805F5CD858D3D"

X-Authenticated-Id: irinamordvinova@serderfash.shop

X-Spam_score: 8.5

X-Spam_score_int: 85

X-Spam_bar: ++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Dear Sir/Madam, We represent a professional mandate in Kazakhstan

working with a reputable refinery, offering a wide range of petroleum products

for immediate lifting. Our products include JP54, D2, Mazut, Jet Fuel, [...]





Content analysis details: (8.5 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[198.251.88.32 listed in dnsbl.ahbl.org]

[198.251.88.32 listed in dnsbl.ahbl.org]

[198.251.88.32 listed in dnsbl.ahbl.org]

[198.251.88.32 listed in dnsbl.ahbl.org]

[155.117.44.22 listed in dnsbl.ahbl.org]

[155.117.44.22 listed in dnsbl.ahbl.org]

[155.117.44.22 listed in dnsbl.ahbl.org]

[155.117.44.22 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[198.251.88.32 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[198.251.88.32 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[198.251.88.32 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[198.251.88.32 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[155.117.44.22 listed in will-spam-for-food.eu.org]

[155.117.44.22 listed in will-spam-for-food.eu.org]

[155.117.44.22 listed in will-spam-for-food.eu.org]

[155.117.44.22 listed in will-spam-for-food.eu.org]

[155.117.44.22 listed in will-spam-for-food.eu.org]

[155.117.44.22 listed in will-spam-for-food.eu.org]

[155.117.44.22 listed in will-spam-for-food.eu.org]

[155.117.44.22 listed in will-spam-for-food.eu.org]

[198.251.88.32 listed in will-spam-for-food.eu.org]

[198.251.88.32 listed in will-spam-for-food.eu.org]

[198.251.88.32 listed in will-spam-for-food.eu.org]

[198.251.88.32 listed in will-spam-for-food.eu.org]

[198.251.88.32 listed in will-spam-for-food.eu.org]

[198.251.88.32 listed in will-spam-for-food.eu.org]

[198.251.88.32 listed in will-spam-for-food.eu.org]

[198.251.88.32 listed in will-spam-for-food.eu.org]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-0.0 SPF_PASS SPF: sender matches SPF record

0.4 INVALID_DATE Invalid Date: header (not RFC 2822)

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

1.1 DATE_IN_PAST_03_06 Date: is 3 to 6 hours before Received: date

1.7 DEAR_SOMETHING BODY: Contains 'Dear (something)'

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[198.251.88.32 listed in bl.score.senderscore.com]

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.7 MPART_ALT_DIFF BODY: HTML and text parts are different

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

0.1 FROM_EXCESS_BASE64 From: base64 encoded unnecessarily

0.0 MIME_HTML_ONLY_MULTI Multipart message only has text/html MIME parts

1.8 COMBO_IMAGEONLY1 Appears to be an image only message

Subject: {SPAM?} =?utf-8?B?UkVRVUVTVCBGT1IgU0NPIC0gSXJpbmEgTW9yZHZpbm92YQ==?=

Shoppers Drug mart phish

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Wed, 08 Jul 2026 22:57:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1whgnu-00000000O5E-353H

for dave@doctor.nl2k.ab.ca;

Wed, 08 Jul 2026 22:56:06 -0600

Resent-From: The Doctor

Resent-Date: Wed, 8 Jul 2026 22:56:06 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from yonehei-yousui.net ([116.80.5.18]:44976)

by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

(Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1whbQi-000000006gA-2Mwl

for doctor@nl2k.ab.ca;

Wed, 08 Jul 2026 17:11:58 -0600

Received: (qmail 29191 invoked by VF by uid 0); 9 Jul 2026 08:10:55 +0900

X-Vade-Tracker: score=0, verdict=clean, state=0

spamcause=gggruggvucftvghtrhhoucdtuddrgeefiedrtddugdejheduucetufdoteggodetrfdotffvucfrrhhofhhilhgvmecupffvvffrveenuceurghilhhouhhtmecufedttdenucenucfjughrpegghffvfffutgfgsehhsgdttddttdejnecuhfhrohhmpedfufhhohhpphgvrhhsucffrhhughcuofgrrhhtfdcuoegrughmihhnseihohhnvghhvghiqdihohhushhuihdrnhgvtheqnecuggftrfgrthhtvghrnhepleffieetieehvdeigfdthfejveejteduudeitdefudfgvefhgfeukefgteeiiedtnecuffhomhgrihhnpeifrghonhdqphhrohguuhgtthhiohhnshdrjhhpnecukfhppeelvddrudduvddrudefuddrudehkeenucfuphgrmhfuuhgsjhgvtghtpeevohhmphhlvghtvgcuqfhurhcuufhurhhvvgihucgrnhguucfivghtucihohhurhcuufhhohhpphgvrhhsucffrhhughcuofgrrhhtucftvgifrghrugcvnecuufhprghmtehlphhhrgfuuhgsjhgvtghtpegtohhmphhlvghtvghouhhrshhurhhvvgihrghnughgvghthihouhhrjihfrhhomhgprghlihgrshilrhgvfigrrhgunecuvehluhhsthgvrhfuihiivgepudegnecurfgrrhgrmhepihhnvghtpeelvddrudduvddrudefuddrudehkedphhgvlhhopefgvedvtefotegkqdfihffnpffopffmpdhmrghilhhfrhhomheprggumhhinheshihonhgvhhgvihdqhihouhhsuhhirdhnvghtpdhnsggprhgtphhtthhopedupdhrtghpthhtohepugh

otghtohhrsehnlhdvkhdrrggsrdgtrgdpmhhouggvpehsmhhtphhouhht

Received: from unknown (HELO EC2AMAZ-GFLNMNK) (admin@yonehei-yousui.net@92.112.131.158)

by dc100.etius.jp (116.80.5.18) with ESMTPA; 9 Jul 2026 08:10:55 +0900

MIME-Version: 1.0

From: "Shoppers Drug Mart"

To: doctor@nl2k.ab.ca

Date: 8 Jul 2026 23:10:55 +0000

Subject: Complete Our Survey and Get your Shoppers Drug Mart Reward!

Content-Type: text/html; charset=utf-8

Content-Transfer-Encoding: base64

X-Spam_score: 10.5

X-Spam_score_int: 105

X-Spam_bar: ++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Shoppers Drug Mart 🎉 surprise Something exciting awaits

You have been selected for our customer satisfaction survey. As a thank you

for your time, we have a surprise gift waiting for you:



Content analysis details: (10.5 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

0.1 MISSING_MID Missing Message-Id: header

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[116.80.5.18 listed in dnsbl.ahbl.org]

[116.80.5.18 listed in dnsbl.ahbl.org]

[116.80.5.18 listed in dnsbl.ahbl.org]

[116.80.5.18 listed in dnsbl.ahbl.org]

[92.112.131.158 listed in dnsbl.ahbl.org]

[92.112.131.158 listed in dnsbl.ahbl.org]

[92.112.131.158 listed in dnsbl.ahbl.org]

[92.112.131.158 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[116.80.5.18 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[116.80.5.18 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[116.80.5.18 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[116.80.5.18 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[92.112.131.158 listed in will-spam-for-food.eu.org]

[92.112.131.158 listed in will-spam-for-food.eu.org]

[92.112.131.158 listed in will-spam-for-food.eu.org]

[92.112.131.158 listed in will-spam-for-food.eu.org]

[92.112.131.158 listed in will-spam-for-food.eu.org]

[92.112.131.158 listed in will-spam-for-food.eu.org]

[92.112.131.158 listed in will-spam-for-food.eu.org]

[92.112.131.158 listed in will-spam-for-food.eu.org]

[116.80.5.18 listed in will-spam-for-food.eu.org]

[116.80.5.18 listed in will-spam-for-food.eu.org]

[116.80.5.18 listed in will-spam-for-food.eu.org]

[116.80.5.18 listed in will-spam-for-food.eu.org]

[116.80.5.18 listed in will-spam-for-food.eu.org]

[116.80.5.18 listed in will-spam-for-food.eu.org]

[116.80.5.18 listed in will-spam-for-food.eu.org]

[116.80.5.18 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_SBL_XBL RBL: Received via a relay in Spamhaus SBL+XBL

[92.112.131.158 listed in sbl-xbl.spamhaus.org]

1.5 RCVD_IN_CBL RBL: Received via a relay in cbl.abuseat.org

[Listed by XBL, see ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[116.80.5.18 listed in bl.score.senderscore.com]

-0.0 SPF_HELO_PASS SPF: HELO matches SPF record

-0.0 SPF_PASS SPF: sender matches SPF record

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

-0.0 T_RP_MATCHES_RCVD Envelope sender domain matches handover relay

domain

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.6 HTML_MIME_NO_HTML_TAG HTML-only message, but there is no HTML tag

4.1 DOS_BODY_HIGH_NO_MID High bit body and no message ID header

Subject: {SPAM?} Complete Our Survey and Get your Shoppers Drug Mart Reward!



Shoppers Drug Mart 🎉 surprise



Something exciting awaits



You have been selected for our customer satisfaction survey. As a thank you for your time, we have a surprise gift waiting for you:





🎀



Premium collection



Luxury fragrances • Age-defying formulas • Advanced razors



Your feedback helps us improve and innovate.

Open Surprise →



2026 Shoppers Drug Mart Surprise Team| Limited time | customer: doctor@nl2k.ab.ca.