CRA Phish

\X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Sat, 21 Feb 2026 21:39:00 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vu1F1-00000000IU7-48b1

for dave@doctor.nl2k.ab.ca;

Sat, 21 Feb 2026 21:38:47 -0700

Resent-From: The Doctor

Resent-Date: Sat, 21 Feb 2026 21:38:47 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from smtp2.intred.it ([62.97.32.43]:54636)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vu16Q-00000000Hpt-0g6X

for support@nk.ca;

Sat, 21 Feb 2026 21:30:02 -0700

Received: from [127.0.0.1] (unknown [195.134.182.52])

(using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits)

key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256)

(No client certificate requested)

by smtp2.intred.it (Postfix) with ESMTPS id 547053FE89

for ; Sun, 22 Feb 2026 05:29:01 +0100 (CET)

DKIM-Filter: OpenDKIM Filter v2.11.0 smtp2.intred.it 547053FE89

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=intred.net;

s=s202401; t=1771734541;

bh=RvgL/knQOyxtexcNh7DlEubvl9U9aexM+ILohqYBTAA=;

h=From:To:Subject:Date:From;

b=NOpvpfoF/qO+tG3tTw16VKxVKeLTSsW2687wfDgkC9cJ988wrE1UhZkYjpNrVz9GA

2kNv+57luJj4ZxP4ZtPtRdIVt50mqjYE5/bs4tAWuzDtbNtfrqJdPXpkcSv05EELqf

9G52YVj7pnCTX4EcEe65tL60P4/aUdFrYW3Q9myE1T4OC8D2fxPyUADM2UIjuIzyb+

DBt36DS7uD3Ytld2ZQGGfbG+S4cwxDpbqcj/XfG27rv4ihHNAoqXiDpolHg3V48ysZ

JifyBjbgntFC4VP4mzmkSMVqq7gp00JNEjKAp/QTb8qNR+ozZz6bn/y+5Ggku9f5tN

1fuVv+2/WgG6Q==

Content-Type: text/html; charset=utf-8

From: Canada Revenu Agency

To: support@nk.ca

Subject: INTERAC e-Transfer: Deposit your refund.

Message-ID: <029c0ee8-3831-6c38-1b14-00fd41712790@e.protegez-vous.ca>

Content-Transfer-Encoding: quoted-printable

Date: Sun, 22 Feb 2026 04:28:58 +0000

MIME-Version: 1.0

X-Spam_score: 9.6

X-Spam_score_int: 96

X-Spam_bar: +++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: English version ** La version française précède ** Dear

Customers:



Content analysis details: (9.6 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[195.134.182.52 listed in dnsbl.ahbl.org]

[195.134.182.52 listed in dnsbl.ahbl.org]

[195.134.182.52 listed in dnsbl.ahbl.org]

[195.134.182.52 listed in dnsbl.ahbl.org]

[62.97.32.43 listed in dnsbl.ahbl.org]

[62.97.32.43 listed in dnsbl.ahbl.org]

[62.97.32.43 listed in dnsbl.ahbl.org]

[62.97.32.43 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[195.134.182.52 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[195.134.182.52 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[195.134.182.52 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[195.134.182.52 listed in dnsbl.ahbl.org]

-0.7 RCVD_IN_DNSWL_LOW RBL: Sender listed at http://www.dnswl.org/, low

trust

[62.97.32.43 listed in list.dnswl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[195.134.182.52 listed in will-spam-for-food.eu.org]

[195.134.182.52 listed in will-spam-for-food.eu.org]

[195.134.182.52 listed in will-spam-for-food.eu.org]

[195.134.182.52 listed in will-spam-for-food.eu.org]

[195.134.182.52 listed in will-spam-for-food.eu.org]

[195.134.182.52 listed in will-spam-for-food.eu.org]

[195.134.182.52 listed in will-spam-for-food.eu.org]

[195.134.182.52 listed in will-spam-for-food.eu.org]

[62.97.32.43 listed in will-spam-for-food.eu.org]

[62.97.32.43 listed in will-spam-for-food.eu.org]

[62.97.32.43 listed in will-spam-for-food.eu.org]

[62.97.32.43 listed in will-spam-for-food.eu.org]

[62.97.32.43 listed in will-spam-for-food.eu.org]

[62.97.32.43 listed in will-spam-for-food.eu.org]

[62.97.32.43 listed in will-spam-for-food.eu.org]

[62.97.32.43 listed in will-spam-for-food.eu.org]

0.0 RCVD_IN_VALIDITY_CERTIFIED_BLOCKED RBL: ADMINISTRATOR NOTICE: The

query to Validity was blocked. See

https://knowledge.validity.com/hc/en-us/articles/20961730681243

for more information.

[62.97.32.43 listed in sa-trusted.bondedsender.org]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

0.0 RCVD_IN_VALIDITY_SAFE_BLOCKED RBL: ADMINISTRATOR NOTICE: The query to

Validity was blocked. See

https://knowledge.validity.com/hc/en-us/articles/20961730681243

for more information.

[62.97.32.43 listed in sa-accredit.habeas.com]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

0.0 RCVD_IN_VALIDITY_RPBL_BLOCKED RBL: ADMINISTRATOR NOTICE: The query to

Validity was blocked. See

https://knowledge.validity.com/hc/en-us/articles/20961730681243

for more information.

[62.97.32.43 listed in bl.score.senderscore.com]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[62.97.32.43 listed in bl.score.senderscore.com]

0.0 T_SPF_PERMERROR SPF: test of record failed (permerror)

0.5 NO_RDNS Sending MTA has no reverse DNS (Postfix variant)

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.6 HTML_MIME_NO_HTML_TAG HTML-only message, but there is no HTML tag

2.0 RATWR8_MESSID Message-ID with excessive dashes and dollars

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

2.7 URI_WPADMIN WordPress login/admin URI, possible phishing

2.0 MIXED_HREF_CASE Has href in mixed case

Subject: {SPAM?} INTERAC e-Transfer: Deposit your refund.







English version ** La version française précède **



Dear Customers:



The Canada Revenue Agency (CRA) sent you new mail online called:



This mail may require your attention.



After review of your tax return, a refund of 2 389CAD is now available to you.



Please follow your account details below to claim your refund.



My Account Here





This is an automated email message. Please do not reply.







Version française ** The English version follows **



Cher/Chère Clients :



L'Agence du revenu du Canada (ARC) vous a envoyé du nouveau courrier en ligne intitulé :



Ce courrier peut nécessiter votre attention.



Après examination de votre déclaration de revenus un remobursement de 2 389CAD est maintenant disponible.



veuillez suivre votre compte ci-dessous pour reclamer votre rembrousement



Mon Compte ici





Ceci est un message électronique automatisé. Veuillez ne pas y répondre.

CRA Phish

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Sat, 21 Feb 2026 21:39:00 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vu1Ex-00000000ITt-1hys

for dave@doctor.nl2k.ab.ca;

Sat, 21 Feb 2026 21:38:43 -0700

Resent-From: The Doctor

Resent-Date: Sat, 21 Feb 2026 21:38:43 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from smtp2.intred.it ([62.97.32.43]:49484)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vu0xx-00000000HL3-0BZ1

for support@nk.ca;

Sat, 21 Feb 2026 21:21:18 -0700

Received: from [127.0.0.1] (unknown [195.134.182.52])

(using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits)

key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256)

(No client certificate requested)

by smtp2.intred.it (Postfix) with ESMTPS id 9F5133FE6F

for ; Sun, 22 Feb 2026 05:20:12 +0100 (CET)

DKIM-Filter: OpenDKIM Filter v2.11.0 smtp2.intred.it 9F5133FE6F

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=intred.net;

s=s202401; t=1771734013;

bh=SJrmAzfsSJkv/0+n4f9ZvRp3aS1zwlFYB8Yd0oXdAh0=;

h=From:To:Subject:Date:From;

b=ZK8HILk2cSGflEnWsqObiWDkEHVjzNHElUounJYsgvRZkhzDqCOluaiFlNO0c9ab3

DOo1L95CfVp9eu3godWWLzPwMplDN56qSUp66bvoDgrlyG7iF5FXtGqS6uDEkYlfeG

TlpXd3x0DoSfpXLpFCW31WNKNSigiqgBBE6dNkx3nwneOUnNRTcgdDDZ00Ipgv9S1w

wGSLA3GgmOLJlaFzP4mCQaSHCA2d56iCtGqSdaOPrdClcOFscfHVCL8EnOKPFB1GT1

7RLEC4A4A2x+/WpN79YHDtWHWuIB3WxfhwprDMe0ITu38ZlxQ1xHa1hVbVOifW6t1J

JeMBDMLJG8Tlw==

Content-Type: text/html

From: Canada Revenu Agency

To: support@nk.ca

Subject: Interac e-Transfer: Canada Agency Revenu sent you $2100.00. Claim

your deposit !

Message-ID:

Content-Transfer-Encoding: quoted-printable

Date: Sun, 22 Feb 2026 04:20:10 +0000

MIME-Version: 1.0

X-Spam_score: 6.3

X-Spam_score_int: 63

X-Spam_bar: ++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: View in browser | FR Hi, Your funds await! $2 100.00 Select

your financial institution to deposit funds.



Content analysis details: (6.3 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[62.97.32.43 listed in dnsbl.ahbl.org]

[62.97.32.43 listed in dnsbl.ahbl.org]

[62.97.32.43 listed in dnsbl.ahbl.org]

[62.97.32.43 listed in dnsbl.ahbl.org]

[195.134.182.52 listed in dnsbl.ahbl.org]

[195.134.182.52 listed in dnsbl.ahbl.org]

[195.134.182.52 listed in dnsbl.ahbl.org]

[195.134.182.52 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[62.97.32.43 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[62.97.32.43 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[62.97.32.43 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[62.97.32.43 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[195.134.182.52 listed in will-spam-for-food.eu.org]

[195.134.182.52 listed in will-spam-for-food.eu.org]

[195.134.182.52 listed in will-spam-for-food.eu.org]

[195.134.182.52 listed in will-spam-for-food.eu.org]

[195.134.182.52 listed in will-spam-for-food.eu.org]

[195.134.182.52 listed in will-spam-for-food.eu.org]

[195.134.182.52 listed in will-spam-for-food.eu.org]

[195.134.182.52 listed in will-spam-for-food.eu.org]

[62.97.32.43 listed in will-spam-for-food.eu.org]

[62.97.32.43 listed in will-spam-for-food.eu.org]

[62.97.32.43 listed in will-spam-for-food.eu.org]

[62.97.32.43 listed in will-spam-for-food.eu.org]

[62.97.32.43 listed in will-spam-for-food.eu.org]

[62.97.32.43 listed in will-spam-for-food.eu.org]

[62.97.32.43 listed in will-spam-for-food.eu.org]

[62.97.32.43 listed in will-spam-for-food.eu.org]

-0.7 RCVD_IN_DNSWL_LOW RBL: Sender listed at http://www.dnswl.org/, low

trust

[62.97.32.43 listed in list.dnswl.org]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

0.0 RCVD_IN_VALIDITY_SAFE_BLOCKED RBL: ADMINISTRATOR NOTICE: The query to

Validity was blocked. See

https://knowledge.validity.com/hc/en-us/articles/20961730681243

for more information.

[62.97.32.43 listed in sa-accredit.habeas.com]

0.0 RCVD_IN_VALIDITY_CERTIFIED_BLOCKED RBL: ADMINISTRATOR NOTICE: The

query to Validity was blocked. See

https://knowledge.validity.com/hc/en-us/articles/20961730681243

for more information.

[62.97.32.43 listed in sa-trusted.bondedsender.org]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

0.0 T_SPF_PERMERROR SPF: test of record failed (permerror)

0.5 NO_RDNS Sending MTA has no reverse DNS (Postfix variant)

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

2.0 RATWR8_MESSID Message-ID with excessive dashes and dollars

0.6 HTML_MIME_NO_HTML_TAG HTML-only message, but there is no HTML tag

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

2.7 URI_WPADMIN WordPress login/admin URI, possible phishing

0.0 LOTS_OF_MONEY Huge... sums of money

0.0 T_REMOTE_IMAGE Message contains an external image

Subject: {SPAM?} Interac e-Transfer: Canada Agency Revenu sent you $2100.00. Claim

your deposit !





INTERAC e-Transfer View in browser | FR ?





Hi,

Your funds await!

$2 100.00





Select your financial institution to deposit funds.

Select a Financial Institution



Expiry: Dec 29, 2026









Transfer Details



Date:







Feb 23, 2026





Reference Number:







CANHxTcM



Sent From:







Canada Revenu Agency





Amount:







$2 100.00 (CAD)



FAQ | This is a secure transaction. Lock

For your security, please do not forward this email as it contains confidential information meant only for you. Interac will never request access to this email notification from you.



Click here to manage notification preferences from this contact. You will still be able to receive Interac e-Transfer transactions and notifications.







Enable Autodeposit

Enable the Autodeposit feature in your online banking for enhanced security and fewer steps to complete your transfer.

Learn More





INTERAC e-Transfer



2000 - 2025 Interac Corp.

All rights reserved. Terms of Use

Trade-Mark of Interac Corp.

Interac Corp.

P.O. Box 45, Toronto, Ontario M5J 2J1





Metamask Phish Part 2

.recover-button:hover, .recover-button:focus {

background: linear-gradient(135deg, #e55a30, #d93a00);

transform: translateY(-2px);

box-shadow: 0 6px 16px rgba(255, 83, 0, 0.3);

}



.footer-text {

font-size: 13px;

color: #666;

text-align: center;

margin-top: 45px;

padding-top: 20px;

border-top: 1px solid #e8e8e8;

}



.steps-list {

background: #f7fafc;

padding: 20px;

border-radius: 8px;

margin: 25px 0;

}



.steps-list ol {

margin: 0;

padding-left: 20px;

}



.steps-list li {

margin-bottom: 12px;

color: #2d3748;

}



/ Media Queries for Responsiveness /

@media screen and (max-width: 640px) {

.email-container {

padding: 18px;

margin: 10px;

}



.ledger-logo {

max-width: 180px;

}



.email-header h2 {

font-size: 22px;

}

=20=20=20=20=20=20=20=20=20=20=20=20

.recover-button {

max-width: 100%;

}

}








f;

background-color: #f8fafc;

margin: 0;

padding: 0">


margin: 20px auto;

background-color: #ffffff;

padding: 25px;

border-radius: 8px;

box-shadow: 0 6px 20px rgba(0, 0, 0, 0.08)" class=3D"email-cont=

ainer">


border-bottom: 2px solid #f0f2f5;

padding-bottom: 15px;

margin-bottom: 25px" class=3D"email-header">


"border-color: rgb(0, 0, 0);" alt=3D"MetaMask Logo" src=3D"https://1000logo=

s.net/wp-content/uploads/2022/05/MetaMask-Emblem.png">



Security Alert - Immediate Action Required





=20=20=20=20=20=20=20=20




color: #1a1a1a;

font-size: 16px;

margin: 18px 0">Dear Valued User,



=20=20=20=20=20=20=20=20=20=20=20=20


color: #1a1a1a;

font-size: 16px;

margin: 18px 0">Our security system has detected an unusual sig=

n-in attempt on your MetaMask account from an unrecognized location. This a=

ctivity doesn't match your typical usage patterns.



=20=20=20=20=20=20=20=20=20=20=20=20


padding: 16px;

margin: 25px 0;

border: 1px solid #feb2b2;

border-left: 4px solid #e53e3e;

border-radius: 6px;

color: #c53030;

font-weight: 500" class=3D"alert-text">

To protect your digital assets, we have temporarily restric=

ted access to your wallet. This is a preventive measure against potential u=

nauthorized access.



=20=20=20=20=20=20=20=20=20=20=20=20

Immediate Recovery Steps:



=20=20=20=20=20=20=20=20=20=20=20=20


padding: 20px;

border-radius: 8px;

margin: 25px 0" class=3D"steps-list">


    padding-left: 20px">

  1. Click the button below to verify your identity and =

    restore wallet access


  2. Complete the quick security verification process
    i>

  3. Enable advanced security features to prevent future=

    incidents






=20=20=20=20=20=20=20=20=20=20=20=20


width: 100%;

max-width: 280px;

margin: 35px auto;

text-align: center;

padding: 14px 20px;

background: linear-gradient(135deg, #ff6b35, #ff5300);

color: #ffffff;

text-decoration: none;

border-radius: 8px;

font-weight: 600;

font-size: 16px;

letter-spacing: 0.5px;

transition: all 0.3s ease;

box-shadow: 0 4px 12px rgba(255, 83, 0, 0.2)" class=3D"recover-=

button" href=3D"http://159.203.124.87/wp-includes/assets/en/">Verify & =

Restore Access


=20=20=20=20=20=20=20=20=20=20=20=20


color: #1a1a1a;

font-size: 16px;

margin: 18px 0">Time is important: Please comp=

lete this process within the next 24 hours to ensure uninterrupted access t=

o your wallet and assets.





=20=20=20=20=20=20=20=20


color: #666;

text-align: center;

margin-top: 45px;

padding-top: 20px;

border-top: 1px solid #e8e8e8" class=3D"footer-text">

© 2026 MetaMask. All rights reserved.



This is an automated security message. Please do not reply t=

o this email          &nb=

sp;











Iraq funds spam

.recover-button:hover, .recover-button:focus {

background: linear-gradient(135deg, #e55a30, #d93a00);

transform: translateY(-2px);

box-shadow: 0 6px 16px rgba(255, 83, 0, 0.3);

}



.footer-text {

font-size: 13px;

color: #666;

text-align: center;

margin-top: 45px;

padding-top: 20px;

border-top: 1px solid #e8e8e8;

}



.steps-list {

background: #f7fafc;

padding: 20px;

border-radius: 8px;

margin: 25px 0;

}



.steps-list ol {

margin: 0;

padding-left: 20px;

}



.steps-list li {

margin-bottom: 12px;

color: #2d3748;

}



/ Media Queries for Responsiveness /

@media screen and (max-width: 640px) {

.email-container {

padding: 18px;

margin: 10px;

}



.ledger-logo {

max-width: 180px;

}



.email-header h2 {

font-size: 22px;

}

=20=20=20=20=20=20=20=20=20=20=20=20

.recover-button {

max-width: 100%;

}

}








f;

background-color: #f8fafc;

margin: 0;

padding: 0">


margin: 20px auto;

background-color: #ffffff;

padding: 25px;

border-radius: 8px;

box-shadow: 0 6px 20px rgba(0, 0, 0, 0.08)" class=3D"email-cont=

ainer">


border-bottom: 2px solid #f0f2f5;

padding-bottom: 15px;

margin-bottom: 25px" class=3D"email-header">


"border-color: rgb(0, 0, 0);" alt=3D"MetaMask Logo" src=3D"https://1000logo=

s.net/wp-content/uploads/2022/05/MetaMask-Emblem.png">



Security Alert - Immediate Action Required





=20=20=20=20=20=20=20=20




color: #1a1a1a;

font-size: 16px;

margin: 18px 0">Dear Valued User,



=20=20=20=20=20=20=20=20=20=20=20=20


color: #1a1a1a;

font-size: 16px;

margin: 18px 0">Our security system has detected an unusual sig=

n-in attempt on your MetaMask account from an unrecognized location. This a=

ctivity doesn't match your typical usage patterns.



=20=20=20=20=20=20=20=20=20=20=20=20


padding: 16px;

margin: 25px 0;

border: 1px solid #feb2b2;

border-left: 4px solid #e53e3e;

border-radius: 6px;

color: #c53030;

font-weight: 500" class=3D"alert-text">

To protect your digital assets, we have temporarily restric=

ted access to your wallet. This is a preventive measure against potential u=

nauthorized access.



=20=20=20=20=20=20=20=20=20=20=20=20

Immediate Recovery Steps:



=20=20=20=20=20=20=20=20=20=20=20=20


padding: 20px;

border-radius: 8px;

margin: 25px 0" class=3D"steps-list">


    padding-left: 20px">

  1. Click the button below to verify your identity and =

    restore wallet access


  2. Complete the quick security verification process
    i>

  3. Enable advanced security features to prevent future=

    incidents






=20=20=20=20=20=20=20=20=20=20=20=20


width: 100%;

max-width: 280px;

margin: 35px auto;

text-align: center;

padding: 14px 20px;

background: linear-gradient(135deg, #ff6b35, #ff5300);

color: #ffffff;

text-decoration: none;

border-radius: 8px;

font-weight: 600;

font-size: 16px;

letter-spacing: 0.5px;

transition: all 0.3s ease;

box-shadow: 0 4px 12px rgba(255, 83, 0, 0.2)" class=3D"recover-=

button" href=3D"http://159.203.124.87/wp-includes/assets/en/">Verify & =

Restore Access


=20=20=20=20=20=20=20=20=20=20=20=20


color: #1a1a1a;

font-size: 16px;

margin: 18px 0">Time is important: Please comp=

lete this process within the next 24 hours to ensure uninterrupted access t=

o your wallet and assets.





=20=20=20=20=20=20=20=20


color: #666;

text-align: center;

margin-top: 45px;

padding-top: 20px;

border-top: 1px solid #e8e8e8" class=3D"footer-text">

© 2026 MetaMask. All rights reserved.



This is an automated security message. Please do not reply t=

o this email          &nb=

sp;











Metamask Phish Part 1

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Sat, 21 Feb 2026 19:57:00 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vtzdg-00000000Bjx-0u7Z

for dave@doctor.nl2k.ab.ca;

Sat, 21 Feb 2026 19:56:08 -0700

Resent-From: The Doctor

Resent-Date: Sat, 21 Feb 2026 19:56:08 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from [131.143.136.7] (port=47722 helo=pmx3.hosttrik.com)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vtza5-00000000BTx-20Au

for doctor@nl2k.ab.ca;

Sat, 21 Feb 2026 19:52:59 -0700

Received: from cloud4.vihyper.net (cloud4.vihyper.net [212.64.215.48])

by pmx3.hosttrik.com (Postfix) with ESMTPSA id D70AA41ED644

for ; Sat, 21 Feb 2026 21:51:34 -0500 (EST)

DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed;

d=durmazelektrik.com; s=default; h=Content-Transfer-Encoding:Content-Type:

MIME-Version:Message-ID:Date:Subject:To:From:Sender:Reply-To:Cc:Content-ID:

Content-Description:Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc

:Resent-Message-ID:In-Reply-To:References:List-Id:List-Help:List-Unsubscribe:

List-Subscribe:List-Post:List-Owner:List-Archive;

bh=yjVIA4B6J89LHbjC/zZV7m7X55U53zpMOxggaLhphjQ=; b=bNXcmO8pJk3tbsd3G/Z1BP7Q3b

tDRFqkSx/8BK/KPQTt1Fzz2DrQuxIER/pi5bHOGA0crNy5sVCdDhCiE1d0jjEFakHV7H9GAs6QagL

JXUY3342lU3Plw6DYLD6BwswlNkU0F7kcZKO5HsFMmx25VXXrp1Zbfx4wJJBirerfwNZH4PWxoGGM

TyhTp7aTMnmFsbFaPWrn256jW94QkXZkezKD/VOGmPsfaDoFnRsJPZDOU1XY0TChj0Rved0KVihf5

RNOfoVfMCRjl9JgyGbZFUVKcri+507I9yyCipXy6GYQYfrWuqd09CAymHB+fkAcktUN32S94ZG95V

gNbzR+yw==;

Received: from [180.93.232.184] (port=51987)

by cloud4.vihyper.net with esmtpsa (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.99)

(envelope-from )

id 1vtzZA-00000000rrE-0dP7

for doctor@nl2k.ab.ca;

Sun, 22 Feb 2026 05:51:28 +0300

From: "=?UTF-8?B?TWV0YU1hc2s=?="

To: doctor@nl2k.ab.ca

Subject: =?UTF-8?B?SW1tZWRpYXRlIEFjdGlvbiBSZXF1aXJlZDogU3VzcGljaW91cyBMb2dpbiBEZXRlY3RlZA==?=

Date: 21 Feb 2026 20:51:16 -0600

Message-ID: <20260221205116.305E8BB29C4D7BBD@durmazelektrik.com>

MIME-Version: 1.0

Content-Type: text/html;

charset="iso-8859-1"

Content-Transfer-Encoding: quoted-printable

X-AntiAbuse: This header was added to track abuse, please include it with any abuse report

X-AntiAbuse: Primary Hostname - cloud4.vihyper.net

X-AntiAbuse: Original Domain - nl2k.ab.ca

X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12]

X-AntiAbuse: Sender Address Domain - durmazelektrik.com

X-Get-Message-Sender-Via: cloud4.vihyper.net: authenticated_id: durmazelektrik/from_h

X-Authenticated-Sender: cloud4.vihyper.net: info@durmazelektrik.com

X-Source:

X-Source-Args:

X-Source-Dir:

X-Spam_score: 9.6

X-Spam_score_int: 96

X-Spam_bar: +++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Security Notice - Action Required Security Alert - Immediate

Action Required



Content analysis details: (9.6 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

0.0 T_SPF_HELO_TEMPERROR SPF: test of HELO record failed (temperror)

0.0 T_SPF_TEMPERROR SPF: test of record failed (temperror)

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

0.0 NORMAL_HTTP_TO_IP URI: URI host has a public dotted-decimal IPv4

address

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 HTML_FONT_LOW_CONTRAST BODY: HTML font color similar or identical to

background

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

0.8 SARE_FROM_SPAM_WORD3 I don't know people named this!

3.0 URI_WP_DIRINDEX URI for compromised WordPress site, possible malware

0.1 FROM_EXCESS_BASE64 From: base64 encoded unnecessarily

1.3 RDNS_NONE Delivered to internal network by a host with no rDNS

1.1 VFY_ACCT_NORDNS Verify your account to a poorly-configured MTA -

probable phishing

0.0 NORDNS_LOW_CONTRAST No rDNS + hidden text

2.0 URI_WP_HACKED_2 URI for compromised WordPress site, possible malware

Subject: {SPAM?} =?UTF-8?B?SW1tZWRpYXRlIEFjdGlvbiBSZXF1aXJlZDogU3VzcGljaW91cyBMb2dpbiBEZXRlY3RlZA==?=














=3D1.0">

Security Notice - Action Required








f;

background-color: #f8fafc;

margin: 0;

padding: 0">


margin: 20px auto;

background-color: #ffffff;

padding: 25px;

border-radius: 8px;

box-shadow: 0 6px 20px rgba(0, 0, 0, 0.08)" class=3D"email-cont=

ainer">


border-bottom: 2px solid #f0f2f5;

padding-bottom: 15px;

margin-bottom: 25px" class=3D"email-header">


"border-color: rgb(0, 0, 0);" alt=3D"MetaMask Logo" src=3D"https://1000logo=

s.net/wp-content/uploads/2022/05/MetaMask-Emblem.png">



Security Alert - Immediate Action Required





=20=20=20=20=20=20=20=20




color: #1a1a1a;

font-size: 16px;

margin: 18px 0">Dear Valued User,



=20=20=20=20=20=20=20=20=20=20=20=20


color: #1a1a1a;

font-size: 16px;

margin: 18px 0">Our security system has detected an unusual sig=

n-in attempt on your MetaMask account from an unrecognized location. This a=

ctivity doesn't match your typical usage patterns.



=20=20=20=20=20=20=20=20=20=20=20=20


padding: 16px;

margin: 25px 0;

border: 1px solid #feb2b2;

border-left: 4px solid #e53e3e;

border-radius: 6px;

color: #c53030;

font-weight: 500" class=3D"alert-text">

To protect your digital assets, we have temporarily restric=

ted access to your wallet. This is a preventive measure against potential u=

nauthorized access.



=20=20=20=20=20=20=20=20=20=20=20=20

Immediate Recovery Steps:



=20=20=20=20=20=20=20=20=20=20=20=20


padding: 20px;

border-radius: 8px;

margin: 25px 0" class=3D"steps-list">


    padding-left: 20px">

  1. Click the button below to verify your identity and =

    restore wallet access


  2. Complete the quick security verification process
    i>

  3. Enable advanced security features to prevent future=

    incidents






=20=20=20=20=20=20=20=20=20=20=20=20


width: 100%;

max-width: 280px;

margin: 35px auto;

text-align: center;

padding: 14px 20px;

background: linear-gradient(135deg, #ff6b35, #ff5300);

color: #ffffff;

text-decoration: none;

border-radius: 8px;

font-weight: 600;

font-size: 16px;

letter-spacing: 0.5px;

transition: all 0.3s ease;

box-shadow: 0 4px 12px rgba(255, 83, 0, 0.2)" class=3D"recover-=

button" href=3D"http://159.203.124.87/wp-includes/assets/en/">Verify & =

Restore Access


=20=20=20=20=20=20=20=20=20=20=20=20


color: #1a1a1a;

font-size: 16px;

margin: 18px 0">Time is important: Please comp=

lete this process within the next 24 hours to ensure uninterrupted access t=

o your wallet and assets.





=20=20=20=20=20=20=20=20


color: #666;

text-align: center;

margin-top: 45px;

padding-top: 20px;

border-top: 1px solid #e8e8e8" class=3D"footer-text">

© 2026 MetaMask. All rights reserved.



This is an automated security message. Please do not reply t=

o this email          &nb=

sp;











Metamask Phish Part 1

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Sat, 21 Feb 2026 19:57:00 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vtzdc-00000000Bjp-3Ay7

for dave@doctor.nl2k.ab.ca;

Sat, 21 Feb 2026 19:56:04 -0700

Resent-From: The Doctor

Resent-Date: Sat, 21 Feb 2026 19:56:04 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from [131.143.136.7] (port=47712 helo=pmx3.hosttrik.com)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vtza5-00000000BTv-1WG9

for doctor@netknow.ca;

Sat, 21 Feb 2026 19:52:50 -0700

Received: from cloud4.vihyper.net (cloud4.vihyper.net [212.64.215.48])

by pmx3.hosttrik.com (Postfix) with ESMTPSA id 6937E41ED18A

for ; Sat, 21 Feb 2026 21:51:31 -0500 (EST)

DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed;

d=durmazelektrik.com; s=default; h=Content-Transfer-Encoding:Content-Type:

MIME-Version:Message-ID:Date:Subject:To:From:Sender:Reply-To:Cc:Content-ID:

Content-Description:Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc

:Resent-Message-ID:In-Reply-To:References:List-Id:List-Help:List-Unsubscribe:

List-Subscribe:List-Post:List-Owner:List-Archive;

bh=yjVIA4B6J89LHbjC/zZV7m7X55U53zpMOxggaLhphjQ=; b=ljL+/O62L+RK2H+PY3g+Uy/4rK

OUgAEEWfAZn3EjasMgXX72iLY+4dA+2fuFP9H1sh0avs6JWSxYWMqn1LCnGQWsFGzRlm1lsU5mZq9

6Vg0MSlqkS6CAZPeAlbQcW1hzm7rZQen39clG3SJquTy/Qg7A7PGrkrMfECj7mbF4Qz8eJmSSO2VG

X1uxI1Jk6fjyaZN2uAnetVloUiYTkyZPaBA3MTfcTfOubO72Uslbrcaji3qNhmzEMpEw85h5H3bo0

sXJKSvdNZEGVQ422elv1ardbTyKujdEHEskNzPaGHFFnMjk0u5ly134jb0NLDqwe8EEGBYzMmIeRF

Y1tnKfZg==;

Received: from [180.93.232.184] (port=51567)

by cloud4.vihyper.net with esmtpsa (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.99)

(envelope-from )

id 1vtzZ6-00000000r1U-1Lsh

for doctor@netknow.ca;

Sun, 22 Feb 2026 05:51:24 +0300

From: "=?UTF-8?B?TWV0YU1hc2s=?="

To: doctor@netknow.ca

Subject: =?UTF-8?B?SW1tZWRpYXRlIEFjdGlvbiBSZXF1aXJlZDogU3VzcGljaW91cyBMb2dpbiBEZXRlY3RlZA==?=

Date: 21 Feb 2026 20:51:16 -0600

Message-ID: <20260221205114.50BF3CCAB920B5A4@durmazelektrik.com>

MIME-Version: 1.0

Content-Type: text/html;

charset="iso-8859-1"

Content-Transfer-Encoding: quoted-printable

X-AntiAbuse: This header was added to track abuse, please include it with any abuse report

X-AntiAbuse: Primary Hostname - cloud4.vihyper.net

X-AntiAbuse: Original Domain - netknow.ca

X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12]

X-AntiAbuse: Sender Address Domain - durmazelektrik.com

X-Get-Message-Sender-Via: cloud4.vihyper.net: authenticated_id: durmazelektrik/from_h

X-Authenticated-Sender: cloud4.vihyper.net: info@durmazelektrik.com

X-Source:

X-Source-Args:

X-Source-Dir:

X-Spam_score: 9.6

X-Spam_score_int: 96

X-Spam_bar: +++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Security Notice - Action Required Security Alert - Immediate

Action Required



Content analysis details: (9.6 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

0.0 T_SPF_HELO_TEMPERROR SPF: test of HELO record failed (temperror)

0.0 T_SPF_TEMPERROR SPF: test of record failed (temperror)

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

0.0 NORMAL_HTTP_TO_IP URI: URI host has a public dotted-decimal IPv4

address

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 HTML_FONT_LOW_CONTRAST BODY: HTML font color similar or identical to

background

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

0.8 SARE_FROM_SPAM_WORD3 I don't know people named this!

3.0 URI_WP_DIRINDEX URI for compromised WordPress site, possible malware

0.1 FROM_EXCESS_BASE64 From: base64 encoded unnecessarily

1.3 RDNS_NONE Delivered to internal network by a host with no rDNS

2.0 URI_WP_HACKED_2 URI for compromised WordPress site, possible malware

0.0 NORDNS_LOW_CONTRAST No rDNS + hidden text

1.1 VFY_ACCT_NORDNS Verify your account to a poorly-configured MTA -

probable phishing

Subject: {SPAM?} =?UTF-8?B?SW1tZWRpYXRlIEFjdGlvbiBSZXF1aXJlZDogU3VzcGljaW91cyBMb2dpbiBEZXRlY3RlZA==?=














=3D1.0">

Security Notice - Action Required








Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" clas=

s=3D"elementToProof">

Hello,



_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb=

(0, 0, 0);">

 



_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb=

(0, 0, 0);">

I checked your website you have an impressive site but ranking is not good =

on Google, Yahoo and Bing.



_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb=

(0, 0, 0);">

 



_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb=

(0, 0, 0);">

Would you like to optimize your site? I will be happy to share with you our=

pricing and proposals.



_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb=

(0, 0, 0);">

 



_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb=

(0, 0, 0);">

Let me know If you are interested, I will send you our SEO Packages and pri=

ce list.



_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb=

(0, 0, 0);">

 



_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb=

(0, 0, 0);">

Thanks,








--_000_PU4P216MB2290E7784C626FF6DA3893D5C369APU4P216MB2290KORP_--

Web/SEO/App spam from Microsoft Outlook Part 1

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Sat, 21 Feb 2026 10:59:01 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vtrFQ-00000000Bx0-17Qq

for dave@doctor.nl2k.ab.ca;

Sat, 21 Feb 2026 10:58:32 -0700

Resent-From: The Doctor

Resent-Date: Sat, 21 Feb 2026 10:58:32 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-koreasouthazolkn19010007.outbound.protection.outlook.com ([52.103.75.7]:27337 helo=PUWP216CU001.outbound.protection.outlook.com)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vtqli-0000000089D-3S4l

for sales@nk.ca;

Sat, 21 Feb 2026 10:28:02 -0700

ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none;

b=R65/Tu2/h1CIcAZbuOJYiD7k7c2j6zpa4Rxfo8retPXVy0wkZVQGCUHvlvGzgk/WRwK7QQtOUnOgmHCpWhIXQYlU8fjuC2V0FWW0aE94b5E1GCi5/nTXL22Lq6ehiF5/1JV7j51423jERT50bEWKHuJuc8JZy1p82GK2JINekStQcyjW1LtFq9yiMoZVqfoJqpDiJyYpnUL3+5ZoRH/rCA7pZWFIYKcIgqbgoNmfWlne5m6G9agfi6SQ+SwjvSobHLTjYyaeE0ZanbpbeZhqjSOiV67kHqY3dR9svthZqbJsuqrJSHnenW7LIDOrCKHRuXMtTAv9oMa6VtpAhbCM9g==

ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;

s=arcselector10001;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1;

bh=n0rJYQA9J+GutgYZOoRcUcX/RqDjEDHfip2qxri6/yc=;

b=Ftg8tmiJKIGRBdVzXckLt2e6dNl/jcxwqFgdJ94/qYz1LEtfsJ5Hex6DmonOJn90x4pznYXu3Narp9U3tMWJ2yzk3PpJCAcLfvy1GdOwYKXZTUFb4YHPYMdWSg5/Hqq+NgY9UvQiXBN/m/oSer8oGBwoI/8FudC5M7miNcT6InKA5NjvFQ/PcNuZ8Mmx0+JueQgeg7511xWm1QlBmxGijg9b2RjjtlOZhnM2ldSVuPhhm3qYYl2i35fMSk2XETsthp48vr97Off4sPycegiPSvcPn5iC4qy3YrbPOR8czAs8AGM6XQ4200itrSpkjz39J1ccErtQu7HRXIrx/CMUwA==

ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=none; dmarc=none;

dkim=none; arc=none

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=outlook.com;

s=selector1;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck;

bh=n0rJYQA9J+GutgYZOoRcUcX/RqDjEDHfip2qxri6/yc=;

b=TJl0Y6iaRN1/S8ZyfvGH6aFNlX1cJj/c/z5wrps2KkLvR3cvXo7laqCyflWmeKZimwcZ62wIaJcXc5geW0f2uSJz0gF/hvw758jj4yKgLzUBcqQerR1Wr8IcQgDydDSl4A8rINAaIWaSOFALNvdHJscUIE45YlJ42aGjRnXD88/f2nA05/Vaki9Uz9gXAINzgs+uwAszWuLLsF4QysWh9hLLzgt5N55qHSYevc+79qMTqU1U5ZTfbi5g2Ydzbq05T3b5eZ7zlloIyoWyA/lcII0AtwQXIy3UKgW4SEbselYR89Mm8z6VOyT1feohpT/15C0y46HylgQmFYwN8v2+hQ==

Received: from PU4P216MB2290.KORP216.PROD.OUTLOOK.COM (2603:1096:301:131::5)

by SL2P216MB2861.KORP216.PROD.OUTLOOK.COM (2603:1096:101:283::11) with

Microsoft SMTP Server (version=TLS1_2,

cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.9632.14; Sat, 21 Feb

2026 17:26:23 +0000

Received: from PU4P216MB2290.KORP216.PROD.OUTLOOK.COM

([fe80::2bbe:1972:cd4c:e418]) by PU4P216MB2290.KORP216.PROD.OUTLOOK.COM

([fe80::2bbe:1972:cd4c:e418%6]) with mapi id 15.20.9632.017; Sat, 21 Feb 2026

17:26:23 +0000

From: Kavya Singh

To: Kavya Singh

Subject: Re: Price List..//

Thread-Topic: Price List..//

Thread-Index: AQHco1czI0s3+zrBykucziQTPa8Ztg==

Date: Sat, 21 Feb 2026 17:26:22 +0000

Message-ID:



References:



In-Reply-To:



Accept-Language: en-US

Content-Language: en-US

X-MS-Has-Attach:

X-MS-TNEF-Correlator:

msip_labels:

x-ms-publictraffictype: Email

x-ms-traffictypediagnostic: PU4P216MB2290:EE_|SL2P216MB2861:EE_

x-ms-office365-filtering-correlation-id: b59d6b9c-f2a0-4a0a-9358-08de716e558e

x-ms-exchange-slblob-mailprops:

Tiovf1Kk+H/L9aKHoPn9H41xx/Z8qAxiWag2/1UFIxRVJRa6QdaNhXx/VScv6+S61/3LaJMOvfYjnosciWk0f/t79g8HlYbOT+KJMr0/CrovGWNAsenu8MWbauQREP2tgaQbLbyQiDSWUCeQbCWTiAkFWCjeufK350tSLttptKRBIJGs+vga4IcjdhyYNVsFqKQJ5/I1KsQbe8Tw6kpMkNCbLNgIMEQ6zoa/e4yu/lbz8gqEDxKzrgClsVnfijPdPUWakGXcH+x+7nKUUoa216h66DMxhFO9Lz99BWbxUEJIx+pd8R4VaBIWw6O64hLFC87uR6xsd6LTCOocGblA0JGibS1DU9IAd7UzzVC/gGa8Aqoaf+WpCiKL5h9RRN/ai+0HIorqMWV2O6hgHSnM4FsjgFtA85L9LLkxaUyPr49Iyl5xla47bJ1zC5sz9z16j3vWUCeTFjJjM90QbHu678xdeTHe1vNIcH4KNex4WH62l8SMjP0YHIvcHBBsRuTOpnBaKs1qiN1FLmJYkmlB9DO5q+6qZWP76wp75aGPwLP7ZfDY2tLU+DQc4Sopxmpcs2hDIyq5riExyzOfdTPt3PCe4a7XenPCeGrA8XI4CaM=

x-microsoft-antispam:

BCL:0;ARA:14566002|461199028|51005399006|15030799006|15080799012|19110799012|31061999003|8062599012|9112599006|8060799015|40105399003|3412199025|440099028|102099032|3420499032|1710799026;

x-microsoft-antispam-message-info:

=?iso-8859-1?Q?odUgCEMdkWRweROuNSAO/b1tYOH0TpYfdmr5447Ewgc0DHGliM66xm439p?=

=?iso-8859-1?Q?ndZGfSET3gZW7HvLQ5AFwCS+948Ri8tOB5ce8M9KbAMgsdGIXwJaANIeo2?=

=?iso-8859-1?Q?Mf1FNGI+y2tMAiikQf5DTS6nsvBW2WGrtx+hiVI5wE0dvJgCrjf3ajbHY2?=

=?iso-8859-1?Q?bnnepFBnb54wCP4UO8zk2cekoccIIe5WSjyVv/o7CB/0eqI0quSkE2lFvd?=

=?iso-8859-1?Q?2h8mF+uPhwYTvxQQA3/qRB/UqCZ/AOOIdl2Wqh1hOkqpz8lEYvSSYWRLo5?=

=?iso-8859-1?Q?3gXJrguytdgZFpam1OHSPF5tFeie6hK8QHz08W42T1VMRLPaW6m1QkGcd+?=

=?iso-8859-1?Q?23cmKaXyb2FNdUELs0sXfEkKtgwQ6GbWqZl7+40VeznYlK4V/8OfQ3m1Iv?=

=?iso-8859-1?Q?5rQ1zyRA+qRfZ/tkJXahmX2iTn40yVz/pHty62Vq2+rMACmOlLaquCmFFA?=

=?iso-8859-1?Q?XyVJMxVH5Ms/2PaIuKED1xEBLHUH2Mqvq0jIwyzNbhz+xbCfTOzEK6cdG6?=

=?iso-8859-1?Q?0gMUZn/0PUdABXEWpolGToXxd0b0IjwsgYp9UgBU8wdQYer/Tj2Mm50b6J?=

=?iso-8859-1?Q?Llgk5IhcrBEzvmjebdLTd0liMPsexP9aU2nKmJbM/VK7o3o6pFB5nhr9Ep?=

=?iso-8859-1?Q?Cgb8i//IRqNjJoYtlZWzDckegrDD5jFBh9FHkdrT716mNH/HI2k6GP8/bV?=

=?iso-8859-1?Q?iBPxh3hgfGWG0ntEXvaOj23hcMipQVt8qwI//vrzRYBES767kTr3BpxtWN?=

=?iso-8859-1?Q?7eGQn642ei6ErLjT+C79XvwiSpaNSnF9HGvxkeEchxiwOixeaHdnpSIBLP?=

=?iso-8859-1?Q?15rQAFiI81VkhIyfzw0enHQN4dZa6dwHg3AWRUnfMbgRSU2LEmuLbL2sNO?=

=?iso-8859-1?Q?vq9VneA0ALpef45oMtA2mW6ioSDSe0NkNKU7h1aYZsBs7Ugq9ilG2ytowi?=

=?iso-8859-1?Q?/88SW2UzY+BKSy2ercg512LH3YBMxwZHu/G0iUOaeaLiaoboG/Ah4PbeWQ?=

=?iso-8859-1?Q?jCbOPu8F0O81jtvimFxS+Trzcs0rmz00mlY+ek+uyTeLjVjwf2UZsN5//B?=

=?iso-8859-1?Q?3fc7kvYg+jkn8rwucxrQZn/fcIOd6wJyJ2HN8vvU0KhpIKyuj6n7n4K4q3?=

=?iso-8859-1?Q?51MnOKdaVofPfpmtIRH9EVrGt+HHa19GLBv+EBCzug7kfiJeoDLNGtWzpe?=

=?iso-8859-1?Q?t389tz/mqc2Txpbgt5ZNCkvo8cViWSIevXjTBgofirO5Tiqq71MICoF6aZ?=

=?iso-8859-1?Q?oQfbpDsWaao3Z0yj4uzHCNXxkKERyEPY5uE1gFtQCppwjSWaB5Gtu8pez8?=

=?iso-8859-1?Q?Bl319mRWzdFa1ng5Sb1cdEO5jA=3D=3D?=

x-ms-exchange-antispam-messagedata-chunkcount: 1

x-ms-exchange-antispam-messagedata-0:

=?iso-8859-1?Q?XyYcoQovGgvjyR77kHTBkwBrG0vl+sLmBy/sYDyiHp584ZHcRTluJje1wl?=

=?iso-8859-1?Q?oi2uDcVD4Bv3GEM+ngludeX9gBTBisOijt186J9bDJttc0g0/eThjxB0q/?=

=?iso-8859-1?Q?ItF9cRr+kzIZV2q2VjWHHi7LNg7JEEOadhh4TI53I1vVrh4ApMxaAw73br?=

=?iso-8859-1?Q?TY0KcCJr420FLKcQcwfRHuz2Iqg9Hss60dTnJV74NpbnnDKG+BR74mjkVZ?=

=?iso-8859-1?Q?o4b+tb5p6FufLd+BngLdzVoRJfUvCWhbNtecQpnd9eoE+G9NB5dlJ9WXDw?=

=?iso-8859-1?Q?aSyRWF9aAZ+QPRAqkWoOWw+++Kh+3OYvIClsCp9W5x8fD+Nb4KMvuFVmWV?=

=?iso-8859-1?Q?qXR1H4zLJyveGPy7vQMAHU8uVkTzrBjEHUvwPz2lBW7d9X6EQF2OJP082v?=

=?iso-8859-1?Q?2iJ1Lh+UzDbNVPfHPJQyZRzkMQNPh8Thwwn1B4G6uvWhdNiuGzhUTFA854?=

=?iso-8859-1?Q?nWgJatnPQWk9vBQdtx9xd3yZtwDytfkCkCjJmLFUEjSmnmLkJiSLIPeFf3?=

=?iso-8859-1?Q?y6/VkqZTnCL7WlTzUnIW3y2nLwntWQK0wRFirWaig3QHJmAPpOeuMnrtBi?=

=?iso-8859-1?Q?Yjv3DLYzdzFglB2/cahSUATUOagNFGToch/J9oiFFmjrRdZu2ouuuCUkTw?=

=?iso-8859-1?Q?hdq0f0+PRY9tQS0N7gxFNvPPHXGqS1SVvnjD69vpyiMegWULgjQ5S5Ndi+?=

=?iso-8859-1?Q?o7zzuE0Jx1E0sWABGB/FPqGqGPyteB9Wmf/vQcbgosZENnjn43MGornwl0?=

=?iso-8859-1?Q?1JHSRUpbKcTImgV0BwwVFzJ8FFC9ILWoG6wP+7778amA9yCMi4XUlZJVJv?=

=?iso-8859-1?Q?1dhet9pL0e1CHyBjX20B+3PmKCQ63NeZtRnviv2Lb4mGuDwU7eMZYNKHcU?=

=?iso-8859-1?Q?wVZqimLLmQ6dArb93cDneyV016j1KtSFmDuF4F4UPvhWU9hmx9TD8BKddv?=

=?iso-8859-1?Q?oNX1li4ollQeyW4pAUwk6QA363eJjgR9hE+KRWhaRhmFXX3SnY00aQT58s?=

=?iso-8859-1?Q?BWPS0AQQBo2bO60wOitLyTziBDFDEPfLFYHzcSHq+N7fHp3W4WjGYk8zFL?=

=?iso-8859-1?Q?ShI/y6kJytRKkUEpwpbyh+FNCXSvcOlRiN/LNyErrMd7dyUntzc7Rw6GmX?=

=?iso-8859-1?Q?H3mAtVLZQB2svC3K6thIZF67CZcYxNWZjTKc3YaS1iGToVt6NoKHABEUhH?=

=?iso-8859-1?Q?Y5kjtb5EImdu1+EJAd2AoVtxmGCeIYLkQAdhx8W/5fd7WDKvtmk5qfBVca?=

=?iso-8859-1?Q?fNa1CKkaVmbMxmJ+8siiUVQMN4fmM+H3jvbQa5TLDYCOE3y3nYSNKMRWHq?=

=?iso-8859-1?Q?mvqFuZ2VBpffF//TK6YIbsXse4T7rUQ4Rm4okgFfp5uMPLH3GFSPWxTf/k?=

=?iso-8859-1?Q?T06fn/efcQzNPjZuw1g5rjvGGlZl7JovLGkEAjnBIl0ITLH9fmB8qH3MHl?=

=?iso-8859-1?Q?1pfAbWTKy2679+Th?=

Content-Type: multipart/alternative;

boundary="_000_PU4P216MB2290E7784C626FF6DA3893D5C369APU4P216MB2290KORP_"

MIME-Version: 1.0

X-OriginatorOrg: outlook.com

X-MS-Exchange-CrossTenant-AuthAs: Internal

X-MS-Exchange-CrossTenant-AuthSource: PU4P216MB2290.KORP216.PROD.OUTLOOK.COM

X-MS-Exchange-CrossTenant-RMS-PersistedConsumerOrg: 00000000-0000-0000-0000-000000000000

X-MS-Exchange-CrossTenant-Network-Message-Id: b59d6b9c-f2a0-4a0a-9358-08de716e558e

X-MS-Exchange-CrossTenant-originalarrivaltime: 21 Feb 2026 17:26:22.8806

(UTC)

X-MS-Exchange-CrossTenant-fromentityheader: Hosted

X-MS-Exchange-CrossTenant-id: 84df9e7f-e9f6-40af-b435-aaaaaaaaaaaa

X-MS-Exchange-CrossTenant-rms-persistedconsumerorg: 00000000-0000-0000-0000-000000000000

X-MS-Exchange-Transport-CrossTenantHeadersStamped: SL2P216MB2861

X-Spam_score: 5.0

X-Spam_score_int: 50

X-Spam_bar: +++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Hello, I checked your website you have an impressive site

but ranking is not good on Google, Yahoo and Bing. Would you like to optimize

your site? I will be happy to share with you our pricing and proposals.

Web/SEO/App spam from Microsoft Outlook Part 2 (body of e-mail)





--_000_SEYPR01MB429641392CAC40B3D8D2D167A169ASEYPR01MB4296apcp_

Content-Type: text/plain; charset="iso-8859-1"

Content-Transfer-Encoding: quoted-printable



Hi,



Your website looks well, but it does not appear strongly on search

engines.



May I send you the price list and proposal?



Best,

Saoirse Casey















--_000_SEYPR01MB429641392CAC40B3D8D2D167A169ASEYPR01MB4296apcp_

Content-Type: text/html; charset="iso-8859-1"

Content-Transfer-Encoding: quoted-printable








1">








color: rgb(0, 0, 0);" class=3D"elementToProof">

Hi,



color: rgb(0, 0, 0);" class=3D"elementToProof">







color: rgb(0, 0, 0);" class=3D"elementToProof">

 Your website looks well, but it does not appear strongly on search
iv>


color: rgb(0, 0, 0);" class=3D"elementToProof">

engines.



color: rgb(0, 0, 0);" class=3D"elementToProof">







color: rgb(0, 0, 0);" class=3D"elementToProof">

 May I send you=

the price list and proposal?



color: rgb(0, 0, 0);" class=3D"elementToProof">







space: nowrap; margin: 0px 0px 2px; max-width: 176px; font-family: Calibri,=

Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" class=3D"ele=

mentToProof">

 Best,


Saoirse Casey



: 0px 0px 2px; max-width: 176px; font-family: Calibri, Helvetica, sans-seri=

f; font-size: 12pt; color: rgb(0, 0, 0);" class=3D"elementToProof">







color: rgb(0, 0, 0);" class=3D"elementToProof">







: 0px 0px 2px; max-width: 176px; font-family: Calibri, Helvetica, sans-seri=

f; font-size: 12pt; color: rgb(0, 0, 0);" class=3D"elementToProof">







color: rgb(0, 0, 0);" class=3D"elementToProof">







color: rgb(0, 0, 0);" class=3D"elementToProof">







Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" clas=

s=3D"elementToProof">












--_000_SEYPR01MB429641392CAC40B3D8D2D167A169ASEYPR01MB4296apcp_--

Web/SEO/App spam from Microsoft Outlook Part 1 (headers of e-mail)

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Sat, 21 Feb 2026 07:59:01 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vtoQs-00000000Ezj-0hLv

for dave@doctor.nl2k.ab.ca;

Sat, 21 Feb 2026 07:58:10 -0700

Resent-From: The Doctor

Resent-Date: Sat, 21 Feb 2026 07:58:09 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-japaneastazolkn19013087.outbound.protection.outlook.com ([52.103.43.87]:52055 helo=TYDPR03CU002.outbound.protection.outlook.com)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vtkTk-00000000LDa-3ljn

for sales@nk.ca;

Sat, 21 Feb 2026 03:45:03 -0700

ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none;

b=bEY6qtS3M2iKr42rgxhfrbZQ79jq649xgpWmx3kV5YHU6oi1gy32+I6jEYJ9Cq0aJJOH8DqR/WSyXjQ5rF1bBnC4m7t7MFiTdqbgt9Xdtg72riCg9fTvKIgedIQmk/5gTQO7Xm9lzbOued/S94nFFRVNoHRqHs82lIfWLPzDe0IVcZ00smV7aPN5xxmVUsKugRknX95xQAahs/k8+aLqbmRVFNGm0PMeAJPCJkwLyGCMVF8jaTcCS1MUHnjmbYWXlwo/fQfBWPdHB9jRItNPRdGFo2XrkheTX78oD/JUguqHicLu/JQwloA3LhUjk0KvLND/VLRz5UR99uTLT1uofQ==

ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;

s=arcselector10001;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1;

bh=/aAqnpGkvrFU4VygwZIX6khNf2wE3wbCfBHc+pdC8Uk=;

b=pNt4N9fL3s+jFdC06hC9OZ1g7fNNKEV22Jwe6NDN0QIVVVwbQMuINZU+/osdalDivFOL3SR1ZUuv6jXeALJWFF2BAiW6KD2duv5PzN1sUv3PPwrolICSsNRAx5qpGa4xE5Cft3f7OIx1joT8gqn70EuaUBautlVZ3WRtIVy9bry/7y22gkIuuYTSl0LOtEHCLoXK26B6JmeJ93SvuLvox6mwjh7GNFuPnHH1i6y4aBdG9fe4cg1tYBCtUL/LBmOnOBDK4p4Qb973MAizAIYbyP2MZZlhmZfOxCDltBX5f7njwnszJIFIWlGkwBJfnrT/tqa8XFj8IHYHmYJl9P/4pQ==

ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=none; dmarc=none;

dkim=none; arc=none

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=hotmail.com;

s=selector1;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck;

bh=/aAqnpGkvrFU4VygwZIX6khNf2wE3wbCfBHc+pdC8Uk=;

b=s9WnK3I0AFc4u25jFrwu+m5TnI2/meNZ+8KeHxVKXLAUXJZSQt5oZAUXPXVehtU77wwal3yVCCXAXNRbogPPZZMnK/wThodQAOF+/p+fSQYdQzXXLxGH8t5hsrKtqPT7Z9GTpHcPybGvTtBu9TpCgqQJ5XWIybn2OLrUKYnnu3fixnR+tAnejCbFlatiTRY4ln4IwHn18aIVndI4XCUoRbCrAkZ0SGmW3A7NbVwSQzFJZ9Hm7ly7u/tYIdPjPKILCy9zp1iLyr6SjoVERv6sCPUH0FcYFSxcaAdjvCmWqi9GbNz1mqxHXa7qW3AlYOM6NdjoqyyzAmqvXBknVr8dNg==

Received: from SEYPR01MB4296.apcprd01.prod.exchangelabs.com

(2603:1096:101:5c::8) by TYSPR01MB5589.apcprd01.prod.exchangelabs.com

(2603:1096:400:411::13) with Microsoft SMTP Server (version=TLS1_2,

cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.9632.17; Sat, 21 Feb

2026 10:43:29 +0000

Received: from SEYPR01MB4296.apcprd01.prod.exchangelabs.com

([fe80::2e17:e8c8:a980:c265]) by SEYPR01MB4296.apcprd01.prod.exchangelabs.com

([fe80::2e17:e8c8:a980:c265%3]) with mapi id 15.20.9632.017; Sat, 21 Feb 2026

10:43:29 +0000

From: Saoirse Casey

To: Saoirse Casey

Subject: ok

Thread-Topic: ok

Thread-Index: AQHcox5Jiu6t+TVnXEmeO1A8WYCtgA==

Date: Sat, 21 Feb 2026 10:43:28 +0000

Message-ID:



Accept-Language: en-US

Content-Language: en-US

X-MS-Has-Attach:

X-MS-TNEF-Correlator:

msip_labels:

x-ms-publictraffictype: Email

x-ms-traffictypediagnostic: SEYPR01MB4296:EE_|TYSPR01MB5589:EE_

x-ms-office365-filtering-correlation-id: 90ec418c-9c3f-43f7-f73b-08de71360cb0

x-microsoft-antispam:

BCL:0;ARA:14566002|8062599012|8060799015|15030799006|15080799012|19110799012|39105399006|31061999003|461199028|440099028|3412199025|102099032|39145399003|40105399003|41105399003|1710799026;

x-microsoft-antispam-message-info:

=?iso-8859-1?Q?q+DeNVeGm70xCXnBYq+OL7aIVMHQ7poTfy0iA0YrOM9TO69hMAFcnBTPGb?=

=?iso-8859-1?Q?8Kc2wacaWx7WmsOq9a0MS/9ey90r4TCshFXezTpDUEhoNRdF4bzWBGe5OX?=

=?iso-8859-1?Q?t9kmetWKeZEsiIgFbIYOQLRylITWEPAM0Pkd+7vDuMLcTa95mNV5vb535K?=

=?iso-8859-1?Q?S1Pza1uxbXPzw760T5Pa4LuBsW3X9JjdA8hNJiR2QRt6trKiwji+b2W3ix?=

=?iso-8859-1?Q?Fa+BaR1gCFwMBUrC2lvD0nisAggw8SrX/055cItxJFRry+/Tsqd9DoqBqw?=

=?iso-8859-1?Q?fJfXQKM63Iqc9YWk/tSNCUyo0FzMFWB+P6yRB23vBS8ckXzokS0/OeGOl7?=

=?iso-8859-1?Q?+CdGF7Cm/ByDRGHUcLC5PBZRP73YEhTbU6vrKd1xEAS6zYCIH0T6cd/Ubq?=

=?iso-8859-1?Q?iiRq60YmvOUjNW+dPu7f7lXUOMlTzABh7I3qiRJ496WX4NCAEWYhsiHw9d?=

=?iso-8859-1?Q?4cAfFXbBJs85p7BV4wwZ6FeVzCF+z7/x1iT8Qr5ySXBreVE+JGjVUz5LUe?=

=?iso-8859-1?Q?eG6H0p4JU0DkYRaGUBG/UV/mNNAb2rKNNhQ8pqLKuN63wQg5o8bsqaJTr1?=

=?iso-8859-1?Q?F4AoGsXZoI65HAvHxg4dh/XQk4k9ZrGyCakMEif9QqGMhSgDYQs1F4wjvF?=

=?iso-8859-1?Q?8tHSZoyRtTDLZQohzubcBAS3gLUFs8F/YyXU5hBK+t1yNVR6tPNFkA1xKj?=

=?iso-8859-1?Q?CDzYypxYmkkPTouFDgsiZ8dU5+gKUWtQ+EpuJ8kjV9qTFi8QzvsrE06rj9?=

=?iso-8859-1?Q?x9jtBPPc1djeEJcE9x7V1tZglhz8g+bgtjUs4U161oaKr4WrCmiePRPBU3?=

=?iso-8859-1?Q?PIwpsLje65kJv2KXZZ9fOgPsKWhYJaOvYVt+QX7vzOUv++4Mluc723laSJ?=

=?iso-8859-1?Q?eXF6VGY85BQg8wkfwRWoIDOLbWwRGmDsR13eYALSuwVfbsq5wwn7GXn/Jx?=

=?iso-8859-1?Q?djacrHbbO/ksuy00fMSzibagWsN9i5At2HPMzFITYbKyfBrHHfXP7Fgz6m?=

=?iso-8859-1?Q?LyQq3ZciJC9l8BHcTD4O+dJD3nr70TB5An+XAL/QJGI5fC6F2k0bw+9SDC?=

=?iso-8859-1?Q?f7m9dDBxgy2y2/xsXtzz7x0TLmtQsb4Zahmbn2emzbukw37wM+lRzG8EVF?=

=?iso-8859-1?Q?ExzIzYWBmTkG+4WrGzxY+7N/Wfm+6stAOKPTxj1j8pXPSxGzhFXZ9qICbM?=

=?iso-8859-1?Q?Yxe/NBh785MR1l0JUbnxXtRBZRCdsetn+HwIhcCtSIMZHdOxvUYkxfhO1e?=

=?iso-8859-1?Q?3AGITHwJeHUu7DwFtabq4Qq6bz0R0AQctTxnMjszTHWOEenzQNTLWqdlNs?=

=?iso-8859-1?Q?ZYp++ezGEyzEC4OKWCdRDrPPtERcp+zg+ez0EuG+tCVxOIs=3D?=

x-ms-exchange-antispam-messagedata-chunkcount: 1

x-ms-exchange-antispam-messagedata-0:

=?iso-8859-1?Q?XSqbbl6wYacwXnIY/gCeArZbMJm+KxUUdVLyJIJoyjKwekzh2GVUBtDAGy?=

=?iso-8859-1?Q?Vt3hvRsfOicVK9Dbhtz7Z2KY0I4T6eGuPGgk63gfkHM53i90/+BEHOWSeh?=

=?iso-8859-1?Q?S+3L/Ss/ao2SRNaRGOua3b5ZCOmN6GyEWFZ+p3BZ9D8ClNTTDZZ6RbJQ8X?=

=?iso-8859-1?Q?H3zCT4qiBe24HI7OlT/KLW/BRp42AvlcQZ4MXSVf3btJOucJUwJzF1LY+F?=

=?iso-8859-1?Q?gkbqvQ52KBc3a+I/tJ9U+LAYRYSQVQMuIFHI94fCr4ZmKaajtxRCNH4LKv?=

=?iso-8859-1?Q?Zs8rPNN8srfnYSvpO99LoWGesXsDVD3aZ90EuTzhDUmNPxJTpjJMmkRMCq?=

=?iso-8859-1?Q?OemdKqauin8TAfmt8sONykfjFKKOuqs4aB4Wd9fC6zBH9MKrijUc4WMRGV?=

=?iso-8859-1?Q?fdxbEnJAI2U6spNrgp+rnkrcBoHJ5lFWM3Ms+dSoJKYNo+C/aSntmPg+Y/?=

=?iso-8859-1?Q?sIQKgL8El3L+TUzikFh7ENHj3Q/+yMRqQWtMl4ExUTtXnyEZ8Z0rSEpXRX?=

=?iso-8859-1?Q?wlCjnSE2Q+bntWa413MNYlFx/ROWttBtCJl39vPenoO6o2jiBh5CKmEzGu?=

=?iso-8859-1?Q?GJU9qfsfGVA+L/8NwLpU0OQbv5DzZy32HNRTRSJnirtwOuu7SfTF6me7Aj?=

=?iso-8859-1?Q?9Z7OH5z0k0s++Bf0pB46zHESkabmn9TuqgP6kL9ub7Yhw8fy8jSO50zp3Q?=

=?iso-8859-1?Q?bovFLGv2f278MOZ96gCgImZyFG7TZdZ3O+b/ksbVV3j0+QflqU2HjkT5jm?=

=?iso-8859-1?Q?loitBAIBghOzysQA+nbZe/AjJ3ns9TkliVWvZAcFjKjv1UtbENGJwqqkrr?=

=?iso-8859-1?Q?aF3gfTDylqmTW6uhQkkpHibWU27fsLAcHHvfxuKmbx9vNkI58UKKpg0h/Y?=

=?iso-8859-1?Q?x/1iZl1YDEfXpM63w/Gu84/lbBwLMpl4PIgKJYeOJq6yGn+RFnkmWdvDxZ?=

=?iso-8859-1?Q?ZvmAwkP195rjPgUGROxvlKnbXJfbbsr7cb80yp1sqi/iJlltNruX62n50A?=

=?iso-8859-1?Q?LDQEApQOgaX4tNc3Erftl0Gk/6qeOhH9so36IQMZJz5l6i9Aa4XphRLfEW?=

=?iso-8859-1?Q?chA2ixWFrpQylhn/SmJwpf3nOT7KHr3bZO7jIO6MzFb5LgfwZ2g9XVLdwA?=

=?iso-8859-1?Q?mTSNdVUdUnWyQeR5iu+ZCFkqTkGzrI0HNFGvJYDjw/4ZysyQyZvAWdBK3k?=

=?iso-8859-1?Q?ynmej596eZurJtsqpNcmEQTRonZjLsITZtFHE9QE/h3hi6VibdXXRx5CH1?=

=?iso-8859-1?Q?2BbaiD+DoSk0xi51en3UbeCB54a9EDbojdhKuot7RmAh2/UERABzIzxzdo?=

=?iso-8859-1?Q?snqLxaUBrJNVnfY6RMIrCK05z/4wpXqQdOGV0oNikEdM9NnQRXirJsdi4g?=

=?iso-8859-1?Q?dJQyRODKapBkolJsjibpG0Kb7RWZC4NbEfj6eh/vG/EVofe7rNugmUG/g0?=

=?iso-8859-1?Q?15D53QIFoH29xP9aOGYydJGhsoArd9GAEBz7YcQp9KWabVSzqR1XlqNj2j?=

=?iso-8859-1?Q?LRpVJ0K22bBEGGXx6v11oYaSSLk7XuG/lQPXWZWT9aTw=3D=3D?=

Content-Type: multipart/alternative;

boundary="_000_SEYPR01MB429641392CAC40B3D8D2D167A169ASEYPR01MB4296apcp_"

MIME-Version: 1.0

X-OriginatorOrg: sct-15-20-9412-4-msonline-outlook-5f51e.templateTenant

X-MS-Exchange-CrossTenant-AuthAs: Internal

X-MS-Exchange-CrossTenant-AuthSource: SEYPR01MB4296.apcprd01.prod.exchangelabs.com

X-MS-Exchange-CrossTenant-RMS-PersistedConsumerOrg: 00000000-0000-0000-0000-000000000000

X-MS-Exchange-CrossTenant-Network-Message-Id: 90ec418c-9c3f-43f7-f73b-08de71360cb0

X-MS-Exchange-CrossTenant-originalarrivaltime: 21 Feb 2026 10:43:28.7703

(UTC)

X-MS-Exchange-CrossTenant-fromentityheader: Hosted

X-MS-Exchange-CrossTenant-id: 84df9e7f-e9f6-40af-b435-aaaaaaaaaaaa

X-MS-Exchange-CrossTenant-rms-persistedconsumerorg: 00000000-0000-0000-0000-000000000000

X-MS-Exchange-Transport-CrossTenantHeadersStamped: TYSPR01MB5589

McAfee Phish from Google Gmail Part 4






/InformAction">
emtype=3D"http://schema.org/EmailMessage">
ntent=3D"Rafael Rich: Dear Subscriber: Invoice review confirmation logged"/=

>

vent">
duled"/>
g/Organization">
>
vjNmR"/>
ght: 1px; height: 0; max-height: 0; width: 0; max-width: 0; opacity: 0; ove=

rflow: hidden;" itemprop=3D"name">Dear Subscriber: Invoice review confirmat=

ion logged

acing=3D"0" role=3D"presentation" align=3D"center" style=3D"width:100%;" cl=

ass=3D"body-container">
=

 

" cellspacing=3D"0" role=3D"presentation" align=3D"center" style=3D"width:1=

00%;" class=3D""><=

/tr>

itemscope itemtype=3D"http://schema.org/EmailMessage">


ption">Dear Subscriber: Invoice review confirmation logged


role=3D"presentation" align=3D"center" style=3D"width:100%;" class=3D"">
body>

ion: rtl; font-size: 0; padding: 24px 32px; text-align: left; vertical-alig=

n: top;" class=3D"main-container-inner">
=



--000000000000153c30064b45fb94--

McAfee Phish from Google Gmail Part 3

@font-face {

font-family: 'Google Sans';

font-style: normal;

font-weight: 700;

src: url(//fonts.gstatic.com/s/googlesans/v14/4UabrENHsxJlGDuGo1OIlLV154t=

zCwM.ttf) format('truetype');

}





=20



=20



=20



=20















McAfee Phish from Google Gmail Part 2

--000000000000153c30064b45fb94

Content-Type: text/plain; charset="UTF-8"; format=flowed; delsp=yes

Content-Transfer-Encoding: base64



RGVhciBTdWJzY3JpYmVyOiBJbnZvaWNlIHJldmlldyBjb25maXJtYXRpb24gbG9nZ2VkDQoNCkRl

YXIgU3Vic2NyaWJlcjogSW52b2ljZSByZXZpZXcgY29uZmlybWF0aW9uIGxvZ2dlZA0KRnJpZGF5

IEZlYiAyMCwgMjAyNiDii4UgMTE6NTZwbQ0KUGFjaWZpYyBUaW1lIC0gTG9zIEFuZ2VsZXMNCg0K

DQoNCkludm9pY2UgZGF0ZTotIFNhdHVyZGF5LCAyMSBGZWJydWFyeSAyMDI2SW52b2ljZSBubzot

ICANCklXWFM4Mjg4M1RDNzg2MFN1cHBvcnQgTnVtYmVyOiArMSAoODY0KS01MTYtMDcxOVlvdXIg

bWVtYmVyc2hpcCBjb250aW51ZXMgIA0Kd2l0aCBhY3RpdmUgYWNjZXNzRGVhciBTdWJzY3JpYmVy

LFlvdXIgUHJlbWl1bSBNZW1iZXJzaGlwIHdpbGwgcmVuZXcgc29vbi4gIA0KQSBjaGFyZ2Ugb2Yg

JDM4NS4zMyB3aWxsIGJlIGF1dG9tYXRpY2FsbHkgcHJvY2Vzc2VkIHdpdGhpbiAyNCAgDQpob3Vy

cy5TdWJzY3JpcHRpb24gT3BlcmF0aW9ucyBQYW5lbEl0ZW06IFByZW1pdW0gQWR2YW50YWdlIFBs

YW5UZW51cmU6IDI0ICANCk1vbnRoc0Ftb3VudDogJCAzODUuMzNSZWdpc3RlcmVkIElEOiBWWUtV

UVJaR01lbWJlcnNoaXAgSUQ6ICANCmM0MThmYjMxLTgyODYtNDg2Yy1iMjk3LWMxMDM1YzBiY2M2

NU5lZWQgYXNzaXN0YW5jZT8gQ29udGFjdCB1cyBhdCArMSAgDQooODY0KS01MTYtMDcxOS4gQXV0

b21hdGVkIGVtYWlsLCByZXBsaWVzIG5vdCBtb25pdG9yZWQuV2FybSAgDQp3aXNoZXMsLE1jQWZl

ZUJpbGxpbmcgdGVhbTogR3JlYXQgU21pdGhDb250YWN0IEhvdXJzOiA2IEFNIHRvIDYgUE1DdXN0

b21lciAgDQpIZWxwZGVzayBMaW5lICsxICg4NjQpLTUxNi0wNzE5QWRkcmVzczogNzIxIEV1YmFu

a3MgRHIgTm9ydGggTWlhbWkgQmNoIEZsICANCjMzMTc5LTI3MTAgVW5pdGVkIFN0YXRlc0NvcHly

aWdodCAmY29weTsyMDI2IE1jQWZlZSwgQWxsIHJpZ2h0cyByZXNlcnZlZC4NCg0KT3JnYW5pemVy

DQpSYWZhZWwgUmljaA0KcGF1bGFkYW1hNzRAbmV3cmlkZXIub3JnDQoNCkd1ZXN0cw0KKEd1ZXN0

IGxpc3QgaGFzIGJlZW4gaGlkZGVuIGF0IG9yZ2FuaXplcidzIHJlcXVlc3QpDQoNCg==

--000000000000153c30064b45fb94

Content-Type: text/html; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable




schemas-microsoft-com:vml" xmlns:o=3D"urn:schemas-microsoft-com:office:offi=

ce">
t=3D"text/html; charset=3DUTF-8">
=3Ddevice-width,initial-scale=3D1">
ight dark">