Digital cloud services phish from Google Gmail

Posted by Dave Yadallee on
Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Sun, 19 Oct 2025 16:41:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vAc4m-00000000KBu-2Cmm

for dave@doctor.nl2k.ab.ca;

Sun, 19 Oct 2025 16:40:32 -0600

Resent-From: The Doctor

Resent-Date: Sun, 19 Oct 2025 16:40:32 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-ua1-f69.google.com ([209.85.222.69]:53464)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vAaNB-00000000Pdl-2B1M

for doctor@netknow.ca;

Sun, 19 Oct 2025 14:51:32 -0600

Received: by mail-ua1-f69.google.com with SMTP id a1e0cc1a2514c-932c8a0d8faso253617241.2

for ; Sun, 19 Oct 2025 13:50:39 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=firebaseapp.com; s=20230601; t=1760907033; x=1761511833; darn=netknow.ca;

h=to:from:subject:date:message-id:mime-version:from:to:cc:subject

:date:message-id:reply-to;

bh=EHrGvPv7tQAMbFU+C2oENDZjRxh3hlgMt5B/MSlB+B8=;

b=TJFX3QZuB37g6zhYcgWcbYjWnW7wPTwf8f+TX6XxNmeXY4MNcbSP79FXj+ITQtTIDX

iCRmD1jTxZF2adTjgeFcYxcwrcgUEjq6RUaGPHCwLPn1VpyjhQpIJz20G+otr1O9exgo

fEbZcZy68vBSTHqjIvCXgwDq+2zjYRe2CFxhDeM5jxJY5eJNeHcXDtk3BvSNaMGtFnY2

7XNzM8K+cn/fLvqIoro4njmw3zz4jGAQH+yvC9Jba77uVsuxL8y+Z4uxYT7CFzlfdFTK

icuT+MB7ZOcDD+S5MbBHWWqDDz5wm/CFd6OiaTrNzKNU5cnj6cgip0ovkhp8aWVLQyUE

QcoQ==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20230601; t=1760907033; x=1761511833;

h=to:from:subject:date:message-id:mime-version:x-gm-message-state

:from:to:cc:subject:date:message-id:reply-to;

bh=EHrGvPv7tQAMbFU+C2oENDZjRxh3hlgMt5B/MSlB+B8=;

b=pqi3P151IqdzabGAyyzE7Pn9TouzS23gEi5ppVzIKA+1hiCE8g3o3EMKyPZLoBqLIU

IaZRHX9k/7MhG67zrlfvLTFQGKFzFO1edbDIvZKlPERlORc3/K6BnjRroXw6ZgpSM+YS

6K0y2uG0q6TqwZ8sikbrpdej7TmgsCn+ssEAnjH7ZJjDKVYiTKNv3vd96ka9uEhhPVGn

GQyU6nf999uLyTk2JDCNuXLpB3WsbTY8lmjLNU7nOnhRsBPOyWJiKloKHbJOB4Qkpvbu

6hj/BDo5FyDYj3RbAmjLJtvU0dcggfxbbkRaen4mDfElXotTrlaD56MY0zJdiVcrU4ni

bOOg==

X-Gm-Message-State: AOJu0YwQL7QDVWEjqG564f+07gG3KIzHrrx11hTbfroy1rn5jL9PesMI

yFNaWJ7eATkKZN/UdryEwHHE39f0Ea1otZlFseDCUPoM3p3zwPfPKBPqMZxja1L6PYG6Z6vENEQ

4ZjRGqafnjQ==

X-Google-Smtp-Source: AGHT+IGVvRY/AE/zPzg46iZpZSlar50m5yKSEUDQjsQmOOkMcckX3AlZQ1dBnX+7aF0RKmxXOFW4pA6q03QihdU=

MIME-Version: 1.0

X-Received: by 2002:a05:6102:3e91:b0:52a:4903:95af with SMTP id

ada2fe7eead31-5d7dd5d328amr3334436137.19.1760907032839; Sun, 19 Oct 2025

13:50:32 -0700 (PDT)

Message-ID: <0000000000002cc4e40641891e1c@google.com>

Date: Sun, 19 Oct 2025 20:50:32 +0000

Subject: =?UTF-8?Q?=F0=9F=92=94_Each_Day_You_Wait=2C_Another_Memory_Fades_Away_=2D_?=

=?UTF-8?Q?Save_Them_Before_It=E2=80=99s_Too_Late?=

From: =?UTF-8?Q?=F0=9F=92=8C_iMemories_Team?=

To: doctor@netknow.ca

Content-Type: multipart/alternative; boundary="0000000000002cc4d40641891e19"

X-Spam_score: 9.4

X-Spam_score_int: 94

X-Spam_bar: +++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Image 1 Image 2 Device Width Images



Content analysis details: (9.4 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[209.85.222.69 listed in will-spam-for-food.eu.org]

[209.85.222.69 listed in will-spam-for-food.eu.org]

[209.85.222.69 listed in will-spam-for-food.eu.org]

[209.85.222.69 listed in will-spam-for-food.eu.org]

[209.85.222.69 listed in will-spam-for-food.eu.org]

[209.85.222.69 listed in will-spam-for-food.eu.org]

[209.85.222.69 listed in will-spam-for-food.eu.org]

[209.85.222.69 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[209.85.222.69 listed in dnsbl.ahbl.org]

[209.85.222.69 listed in dnsbl.ahbl.org]

[209.85.222.69 listed in dnsbl.ahbl.org]

[209.85.222.69 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[209.85.222.69 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[209.85.222.69 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[209.85.222.69 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[209.85.222.69 listed in dnsbl.ahbl.org]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[209.85.222.69 listed in list.dnswl.org]

0.1 URIBL_SBL_A Contains URL's A record listed in the SBL blocklist

[URI: click.convertkit-mail2.com/3.141.222.179]

[URI: click.convertkit-mail2.com/18.220.225.51]

[URI: click.convertkit-mail2.com/3.18.56.123]

2.7 RCVD_IN_PSBL RBL: Received via a relay in PSBL

[209.85.222.69 listed in psbl.surriel.com]

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[209.85.222.69 listed in wl.mailspike.net]

-0.0 SPF_PASS SPF: sender matches SPF record

-0.1 DKIM_VALID Message has at least one valid DKIM or DK signature

0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid

0.7 HTML_IMAGE_ONLY_20 BODY: HTML: images with 1600-2000 bytes of words

0.0 HTML_MESSAGE BODY: HTML included in message

0.7 MPART_ALT_DIFF BODY: HTML and text parts are different

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.3 HTML_SHORT_LINK_IMG_3 HTML is very short with a linked image

0.0 T_REMOTE_IMAGE Message contains an external image

Subject: {SPAM?} =?UTF-8?Q?=F0=9F=92=94_Each_Day_You_Wait=2C_Another_Memory_Fades_Away_=2D_?=

=?UTF-8?Q?Save_Them_Before_It=E2=80=99s_Too_Late?=



--0000000000002cc4d40641891e19

Content-Type: text/plain; charset="UTF-8"; format=flowed; delsp=yes



Image 1 Image 2







--0000000000002cc4d40641891e19

Content-Type: text/html; charset="UTF-8"













Device Width Images

















--0000000000002cc4d40641891e19--

Digital cloud services from Google Gmail

Posted by Dave Yadallee on
Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Sun, 19 Oct 2025 16:41:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vAc5D-00000000KG4-1g99

for dave@doctor.nl2k.ab.ca;

Sun, 19 Oct 2025 16:40:59 -0600

Resent-From: The Doctor

Resent-Date: Sun, 19 Oct 2025 16:40:59 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-vs1-f71.google.com ([209.85.217.71]:47262)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vAbOd-0000000053w-1jWo

for doctor@nk.ca;

Sun, 19 Oct 2025 15:57:06 -0600

Received: by mail-vs1-f71.google.com with SMTP id ada2fe7eead31-5d5eb99cf08so8100427137.2

for ; Sun, 19 Oct 2025 14:56:13 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=firebaseapp.com; s=20230601; t=1760910967; x=1761515767; darn=nk.ca;

h=to:from:subject:date:message-id:mime-version:from:to:cc:subject

:date:message-id:reply-to;

bh=OASj2BrCuMBFxYQmrt3RoAKUfxNTVfiyy/UB4hZmFn4=;

b=b4ZD5l7WpmocYNrgQsPM1Zj7mLXS/SSpl5bLNrEkSQv7LpBSzPoq7xPuiZTP3M//HG

O3zGfM5zV/5spojFPQC1x+QXxnKPNDn0SsH+6spM/+J3G6l+Mujbwb4z0va7CXmCagfw

wPsMC0iJ26kzUTXXlMU61xuxiKXT0AtWAKIwAwn1L1e4ubFQIajQZHUopv5BsKR7dQzj

lmSw1Ht6qKRs7BFu6w+m8b5LcLkAH2DdXnYNaQhmUY9QjXk4pPKgpEHmTSoqhW+7P9L+

jDb7WwySPR5SpsDVUtsbl1MdyjNEgGOnNVp9GIHb+SerjWAwp8WMSTTYqbal+Iow3ZZT

2ltw==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20230601; t=1760910967; x=1761515767;

h=to:from:subject:date:message-id:mime-version:x-gm-message-state

:from:to:cc:subject:date:message-id:reply-to;

bh=OASj2BrCuMBFxYQmrt3RoAKUfxNTVfiyy/UB4hZmFn4=;

b=SiNA0tJRIfYeoF1j22CQmPjod2KK/G7pB7DOlVXC/s6VUYCYebifqKPWdY7dZqE36h

KCGA7Bv2q50iby+pTs+j3AXe+GUWKyfTyxpMjSdpg97988bYSBlpo9nJjjOmNdNy7waG

S4SbUR+0MywSlU5rdOMEmTMD9PuJHq6pW/qrT0BGvUPYoi4YasNZMOjTQ5Pz0AfW05wH

7BLUiMMAAnaE6o8ngv/y0HU6jBkUn0h3yDB6gfFb8qirKSrG+S6KbbOPleHJF0mg5m3W

EcSwVzyYiLBvUouljFdp02SAV0fgaudEcA2bGJ4lGVPULo3Py7fn160jWYDkYzWu7Id7

ea9w==

X-Gm-Message-State: AOJu0YxY7G5UlT5V9pNXWr0IggTncL+DdoAZm4lD8V2IUHyIfzLSOyAF

VRA1MDivt1aTO4O2ldVNI3ybP9q1IKnBgKhEeWZfegE+Xf8qrAFXYM2xbpIci1Az+OnqykIxOBR

bJ0FBvPkRKg==

X-Google-Smtp-Source: AGHT+IG2DCHWG5rYUQnIvdN518mzVGXKeiFcdB2hw1Va1GumbbUpNB9UFb1CWGO6guAzglUoE7aCE3QNBUYS37c=

MIME-Version: 1.0

X-Received: by 2002:a05:6102:2913:b0:5d5:f6ae:38f0 with SMTP id

ada2fe7eead31-5d7dd62b983mr3682064137.39.1760910967702; Sun, 19 Oct 2025

14:56:07 -0700 (PDT)

Message-ID: <000000000000b604db06418a084f@google.com>

Date: Sun, 19 Oct 2025 21:56:07 +0000

Subject: =?UTF-8?Q?=F0=9F=92=94_Each_Day_You_Wait=2C_Another_Memory_Fades_Away_=2D_?=

=?UTF-8?Q?Save_Them_Before_It=E2=80=99s_Too_Late?=

From: =?UTF-8?Q?=F0=9F=92=8C_iMemories_Team?=

To: doctor@nk.ca

Content-Type: multipart/alternative; boundary="000000000000b604cd06418a084c"

X-Spam_score: 8.6

X-Spam_score_int: 86

X-Spam_bar: ++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Image 1 Image 2 Device Width Images



Content analysis details: (8.6 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[209.85.217.71 listed in list.dnswl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[209.85.217.71 listed in will-spam-for-food.eu.org]

[209.85.217.71 listed in will-spam-for-food.eu.org]

[209.85.217.71 listed in will-spam-for-food.eu.org]

[209.85.217.71 listed in will-spam-for-food.eu.org]

[209.85.217.71 listed in will-spam-for-food.eu.org]

[209.85.217.71 listed in will-spam-for-food.eu.org]

[209.85.217.71 listed in will-spam-for-food.eu.org]

[209.85.217.71 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[209.85.217.71 listed in dnsbl.ahbl.org]

[209.85.217.71 listed in dnsbl.ahbl.org]

[209.85.217.71 listed in dnsbl.ahbl.org]

[209.85.217.71 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[209.85.217.71 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[209.85.217.71 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[209.85.217.71 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[209.85.217.71 listed in dnsbl.ahbl.org]

1.9 URIBL_ABUSE_SURBL Contains an URL listed in the ABUSE SURBL blocklist

[URI: digitalmemoryexperts-canadateam.s3.amazonaws.com]

0.1 URIBL_SBL_A Contains URL's A record listed in the SBL blocklist

[URI: click.convertkit-mail2.com/3.141.222.179]

[URI: click.convertkit-mail2.com/3.18.56.123]

[URI: click.convertkit-mail2.com/18.220.225.51]

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[209.85.217.71 listed in wl.mailspike.net]

-0.0 SPF_PASS SPF: sender matches SPF record

-0.1 DKIM_VALID Message has at least one valid DKIM or DK signature

0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid

0.7 HTML_IMAGE_ONLY_20 BODY: HTML: images with 1600-2000 bytes of words

0.0 HTML_MESSAGE BODY: HTML included in message

0.7 MPART_ALT_DIFF BODY: HTML and text parts are different

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.3 HTML_SHORT_LINK_IMG_3 HTML is very short with a linked image

0.0 T_REMOTE_IMAGE Message contains an external image

Subject: {SPAM?} =?UTF-8?Q?=F0=9F=92=94_Each_Day_You_Wait=2C_Another_Memory_Fades_Away_=2D_?=

=?UTF-8?Q?Save_Them_Before_It=E2=80=99s_Too_Late?=



--000000000000b604cd06418a084c

Content-Type: text/plain; charset="UTF-8"; format=flowed; delsp=yes



Image 1 Image 2







--000000000000b604cd06418a084c

Content-Type: text/html; charset="UTF-8"













Device Width Images

















--000000000000b604cd06418a084c--

Web/SEO/App spam from Microsoft Outlook

Posted by Dave Yadallee on
Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Sun, 19 Oct 2025 12:28:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vAY83-00000000DjD-2Hnf

for dave@doctor.nl2k.ab.ca;

Sun, 19 Oct 2025 12:27:39 -0600

Resent-From: The Doctor

Resent-Date: Sun, 19 Oct 2025 12:27:39 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-norwaywestazolkn19010003.outbound.protection.outlook.com ([52.103.52.3]:62298 helo=SVZP279CU002.outbound.protection.outlook.com)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vAVJw-00000000F6O-1S39

for root@nk.ca;

Sun, 19 Oct 2025 09:27:55 -0600

ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none;

b=sATKKwqqGVQiMjprkmX1POrUmvhpR2I74oHVz6dBontWjQv/a3BgNeBT3lASh0Ii8A8tV5E87o0HIrEMVKz+P26X4CfxeG3AuRNKGPShnFNlDCk5XAmoDRN9d/bsK3VPE/YF/xdqXKNy8NHP6y+bs75Lpz/T1tkdjfHbXeWRsPgw69NKrwuvlwVwHo2oY/kAyMVvBoYOmgpDF97VxZRiVfEONbfbpWdqmSI4flmlo2xOiPK5qGm9FJkZl+uxTytpw9FlxYxiW1Nz9OGj2t0R1DScbyzBcEBG6zqjp9e0AhAK4IzwSwBY21pFPRhs9/H95N3ChJBAZu2+eI2CZc/aQQ==

ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;

s=arcselector10001;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1;

bh=3ugM4iIxB6hf+yzBdodeDqHD96Ky1EdtRH7IHpNF9IY=;

b=berxcvHSVME3nZ8TCTOhQaLJ56+AF4fxpekweWme/bwgbGzwiFgdjclxdxbkXweYE54NzI4bjAN/CHD2EEJF9vH4k2N9095+upHbtXnMIQJKNRXjlxg/hRVzo9kcn3QXJCQsoIxW7Q/s1M7xyqz3nV3b3CikZiNz7ElXU2VuNU/L+ZuIMEKLB2Dor0TgQ+ZX5aJQtYS41p8vzGhnUzA7urNXQFtzZZXuEBv46lp6axi8n7dYD3Qg9eLtjC4Gt90pMqoc0w8sc9VsLzFMoKrLhgisLVCm6Usv2qNFNoI3BRsE+JjYe/Z0ar3GfVa80eS0Fudt76n3l/8eA4KvDePu+A==

ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=none; dmarc=none;

dkim=none; arc=none

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=outlook.com;

s=selector1;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck;

bh=3ugM4iIxB6hf+yzBdodeDqHD96Ky1EdtRH7IHpNF9IY=;

b=GhZsc/+nKNqm+iSafrnEp9jncsh59SKFXGQGpJV7582mPB7un5priJ3A3m43KacimODeNV9UA7I1KohjHZkd2vDwI3zDMXGgbPeNz2hRKgv6BtClCqMB/sL64wxM/z1WBaTiPTxilJOR/xDzogPt8InDMZ4+FZs0TTpU5qv7S19Q+BbT2BaNVZBGKnh1MbNUYe/1WMVIvfhAziseYhrI1GiDP5eE8tpuQ5Ui0M4NfxSA1mhnwBWfxnKEY+3GsYbVHLZ6+rrlDCO/rq0tzETNyhi+GfEozQLkYfaw5w3nYo4e3KVGwPq5UzU/1wA4JJvYa5UP+Vh5VBR0+G+ftrQnbQ==

Received: from OS6P279MB1483.NORP279.PROD.OUTLOOK.COM (2603:10a6:e10:8a::5) by

OS6P279MB0728.NORP279.PROD.OUTLOOK.COM (2603:10a6:e10:46::11) with Microsoft

SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id

15.20.9228.16; Sun, 19 Oct 2025 15:26:34 +0000

Received: from OS6P279MB1483.NORP279.PROD.OUTLOOK.COM

([fe80::e41d:7af7:1f2b:d02a]) by OS6P279MB1483.NORP279.PROD.OUTLOOK.COM

([fe80::e41d:7af7:1f2b:d02a%5]) with mapi id 15.20.9228.015; Sun, 19 Oct 2025

15:26:34 +0000

From: Jenny Howard

Subject: Re: SEO Improve?

Thread-Topic: SEO Improve?

Thread-Index: AQHcQQzABANPV/WM/EWuNQXyiJGkwQ==

Date: Sun, 19 Oct 2025 15:26:33 +0000

Message-ID:



Accept-Language: en-US

Content-Language: en-US

X-MS-Has-Attach:

X-MS-TNEF-Correlator:

msip_labels:

x-ms-publictraffictype: Email

x-ms-traffictypediagnostic: OS6P279MB1483:EE_|OS6P279MB0728:EE_

x-ms-office365-filtering-correlation-id: fe07bfd0-0ada-4702-81e1-08de0f23e2f4

x-microsoft-antispam:

BCL:0;ARA:14566002|8062599012|8060799015|15030799006|15080799012|19110799012|31061999003|461199028|40105399003|51005399003|51015399003|39105399003|3412199025|440099028|102099032;

x-microsoft-antispam-message-info:

=?utf-8?B?U3dGYU5hUzU4Nk9YUTFSMEZjRnpnak5hUmI1VjMxcUVoOHR3RzBxaHZRYzgy?=

=?utf-8?B?WVhUbWZmYW4rS0xBNitxdk4wV0tkN2ZKUGpSREs2bm9uMlIxWXVmVTZpMDkv?=

=?utf-8?B?TnlMY1ZwRXNEVkw4dEpWWWU3Ny9JbTdaNWdxR3l0UkFJYkY4YWVIS2Y5OVZ6?=

=?utf-8?B?VWEvYjdvVUpvNGlCVXh1aWQ0N0VZdkc4M2d4b0l3c2VCbys0NFJYbHpoN3dn?=

=?utf-8?B?cDFaeFBSVExRa2JSWTU1TnZxS1RRb2o1K0xxQW5neXVRMmt0L0hjTVdsbU5J?=

=?utf-8?B?dldHQ2VSWi81Y0FTL29FcXQzYXd1ZFFIVW05c2R6SW1DWVF5YnkvNnlCK3pW?=

=?utf-8?B?L1ZzcjJZcnBLTWxNS1pqRXM5bHJkUEF2cmFtcVZMUGVzUWhXQW1FUG9WMWZm?=

=?utf-8?B?MVk1czlHQXpxQk95V1ZJM0x4OTJ2OWhLb215WFNkeU10TXdodmtNQmMxczBK?=

=?utf-8?B?MkJDWjlwYU9wQ01UQi8rWU9LK3VFRDRSejJFd2UzelZnWnFmUkZRbDM1SWd3?=

=?utf-8?B?NnVlMlVBT0pibnhXZURSWG9LaEJLNUgrNjB4ZmpMcWVkNFpvWXRBTGVIdmEz?=

=?utf-8?B?S2lsV01mNXNQQzVDejZveFQxb2ZvYUNtMFZtQUsyaXpaTU1HNGlvbEgxUkhH?=

=?utf-8?B?b1hOYTZqcWtCY1dUQWwvR09WcHMxWGJKcXRBT0luemFONHNFb0MxSksvNWRV?=

=?utf-8?B?bGZrQ0NSTjMzU0dOWmljMGc5bDMvVlBXZFNzZ01GYWd5c2MrT2hVditZUUpM?=

=?utf-8?B?ZEw4ditvalpZVFIvdHAveUhxbHJmM05wVjRVdWIyRTh3aU1UbFVuZzk1Qnhv?=

=?utf-8?B?NlpTNUZzVU13dmxYMnlKaS9GcmxqSURNU056OTRHMVV1aU9TRjY5VVJKalpD?=

=?utf-8?B?MUxqVktuc0ZiU0NicWhPVHB5UGk1eFRmd1dwclIrUVBHSTBoNlhVVGdlTlNh?=

=?utf-8?B?K3ZvTVdVSVNkUmtIUWFDZDIybHBPeTdiWWN6SUhTOWsrZDJEUzROZTFWa1FQ?=

=?utf-8?B?dEtyVGkveW5MbzJON2JIZDZiaGtrOXNZSUJQWjhBZEFlNUtiQ2xOazhHUTVD?=

=?utf-8?B?MWNmQlErSEpjeUdZVEtTb0ZLUWVBU2d4aUQ4R2tuS3ZhNUJFT2k5cGJnbElq?=

=?utf-8?B?cGwyUUIxZEI2dUNRRXhvTWF4UWVYckFNR3dFQ1d3SkZQMjBFajE3ZVR5OVBq?=

=?utf-8?B?YkJRWmMrR3R2VExOUi94S3R2Q21rM3F4b1c0NFpJOVJEMW9zVWRLdHQ4SmU3?=

=?utf-8?B?VmVreUlxNVZvWXY3R215RVpmbjc5Mk92TFRkVXJwTXBjNUE4bTFqc3N6UjBY?=

=?utf-8?B?d0gxN3N1ZnVRT3duRXJ1aXhUcTE2KzZUV0FYMjM5Z09XdCtYMTJGdCtnYTBy?=

=?utf-8?B?VlpWMEhkQjd6T1IxbjRNTHY0eTRLUWo5TlZsS3Y1bXhubWwvMmo4VFlXYXBV?=

=?utf-8?B?bGxtMHRtZ1g1U0tjb2pJbjg5aUJFenh0OTBTazFwOTU1Wk5LMjZPVldTWU1Y?=

=?utf-8?B?WlprdElKaklxNkQ2N0ZqOW8wWU9ocjlYRWVQWk9SUVB4QXlMV1lBQVJXM2hS?=

=?utf-8?B?YWE0SERJaHZBQWFRU3ZMaER0NC9xWFRuSCt5ejQ5ckNCS1k2NW9SdlpFSWdD?=

=?utf-8?B?Q1E4RHRqd2dEdXp5eGpubE03SXZBQVdpaXBwTys3TEpJc3lURm9HbHJEbVd0?=

=?utf-8?B?NWJ3d1EyVTVWa0YvdjlDbGpFQnlZVEpmcjVWTjVDaktCY0JtWjBiUUdBPT0=?=

x-ms-exchange-antispam-messagedata-chunkcount: 1

x-ms-exchange-antispam-messagedata-0:

=?utf-8?B?S0VVdExtMjZzSVd3K1FBQkJiZVdKcC9WbllaRVlSQ1dySjhWL1phZFBqMk9y?=

=?utf-8?B?T3YvYUJBQWgxQnN0TTUvUlVuZmVPcFF6a2l6c1B5UzJWQ3hNL3V4QjFLeUxz?=

=?utf-8?B?WDQwdWZvOFhLWHl0ejRHMHFFQlpTK2tBbk52UUllZ3dPWG04TXZKUlg4SUIy?=

=?utf-8?B?UnlmVUo4NklZa2R6RW1EczI4UnRyNk56cUJtZVZXSThXcHV2MGtZQXo3S1pR?=

=?utf-8?B?QWZRK3Vod1ZIa2RPQjl5Sk9wWjExV1JDL3ZKOXg4ZytsdndEM3djNW9nS1RT?=

=?utf-8?B?NmYvcU1kTS92RzlLSTVnaldUZXk3bUR0MEFFdmV3MmlEYlRMN2YrSHBKcnFB?=

=?utf-8?B?M0JBUE5RYzUzR2JISUJ3MHY1Ri9TeE1SLy80bDhwTk5mc1NaRGlLRks0L0I4?=

=?utf-8?B?RXBsbEFqRzhLM0tJTjZPTVhjQ3lGZG1ldzN1d0k0a2N2MEdJekxxV0R4UmRH?=

=?utf-8?B?a2RCZ1JwQjhlc1FwOWNpVFlzL0ZVSHo3djg1T2c1MzVVL1hwbFpSYnh2Mktp?=

=?utf-8?B?RzYwZ1NISk5sZHZTTDZWZnU2OGN3S3hrTXF5VTlXbzQwNGVZUkJvaFV5TUhk?=

=?utf-8?B?VGlNMDZpcituRFR0TklSeS9mT1N1WkpuQ0lOc1dXSFkzaml2ZnA4WTR6Sno1?=

=?utf-8?B?QlVkYWxTeGFZT1k1aTNlcmlOMGpGRWhzZUxMc0tRVlcvNUxBenVZUzc2eWRl?=

=?utf-8?B?MUlYWU9sQmhuQ1dsSW1aeUh4RURDWktqOEs3TEtJSlJ4WG1ZMWE3WVZHa1pX?=

=?utf-8?B?SnU2RTJqTXpHcDFHQzNZeXhNVm1ucFhDaUNGWVk3UUZNemhmSlV2TjUxNUdx?=

=?utf-8?B?N2VST1ZDZzVIbHh5WW5mK3R5U0RIMjhxbDY1SGg0ZmNCd1Zxdmowa1hIQU5R?=

=?utf-8?B?dUU1SVAzVFZmMXRndWpRZVd2UWVzbnFnZTc3elp1Ykd4VHJhRkVScWtxOFFP?=

=?utf-8?B?UWhqWml1L0NKbXI4a1kwdDluMzF6dXlXWmRMMW8wTmliS2dmVnpxOFBzVXVE?=

=?utf-8?B?a3g1WWRmeGF5aFZyMEM3MjFkc3FVbm5vNitlTTBqeXU2UGNDTWpZaUV6M3dL?=

=?utf-8?B?WHVSaXpTMERsWG1LVy9PdTF4YlJEeUlwcTRMbzh0RVZPMUVGdjM2VDErSUxr?=

=?utf-8?B?QXhMMHBhLzFCYnJwMHlnZ2I1clJCblpoN1dTd0hZV2R5bUJtRjl1UmxMQXBz?=

=?utf-8?B?UTdObEFJdGZKZ3dPQmRZV1JwUVNCWHBpRi90cktZZmNPeGpicmdyZlg4bGk3?=

=?utf-8?B?eGVVRjdka0tMREp6VTZTMlhKYUxvMWpiUU0rR0ZXVlFYdHRrR0ZaL0pYbzlv?=

=?utf-8?B?eDl1SDVaMTdkek40d0x5WW9FUDcvNWpaZldZb3Erdm5aUWFBazEvUWNaK0tr?=

=?utf-8?B?VExkWjI0dkR3Y2wwUUNwbEE1OU1RYUVaWTk2UUlMVlkzbEJSS0t6czhjaVFP?=

=?utf-8?B?SFBVVngzZ1VjeUxKT1dWdXEyQ3M2Y1RMVDBOdTAxdzlOeG4yNnpFRHMrVlcy?=

=?utf-8?B?ZlE1SmRkc0oxTnVHMC9GYjl0emRMVUl1WTV5WTVRdHJMRXNUOGVTT09ZWVRs?=

=?utf-8?B?Lzd5L201ZnJvK21RZm1OeTNPMFFiZ3NNNG1ZbDFkUU52ZHFBUFM4L2g4Ti81?=

=?utf-8?B?eUtuTTVOTFlFTHMzUFRTQ1BnKzVaQ3BVQVhDYzFaMHB4R250V05POEUxbzBT?=

=?utf-8?B?WlNlNjFEZjlQUVJTalk2eTRMSmRNdXpsay9uNDVLb0JCWnZjKzNFdm1Qd2hq?=

=?utf-8?Q?8+q3Gsj0ZbKWCuYfsTiWLmE0Oe7d0TFKkgAzT2r?=

Content-Type: multipart/alternative;

boundary="_000_OS6P279MB1483A25EB6BF80A807D6BEACAEF4AOS6P279MB1483NORP_"

MIME-Version: 1.0

X-OriginatorOrg: outlook.com

X-MS-Exchange-CrossTenant-AuthAs: Internal

X-MS-Exchange-CrossTenant-AuthSource: OS6P279MB1483.NORP279.PROD.OUTLOOK.COM

X-MS-Exchange-CrossTenant-RMS-PersistedConsumerOrg: 00000000-0000-0000-0000-000000000000

X-MS-Exchange-CrossTenant-Network-Message-Id: fe07bfd0-0ada-4702-81e1-08de0f23e2f4

X-MS-Exchange-CrossTenant-originalarrivaltime: 19 Oct 2025 15:26:33.8679

(UTC)

X-MS-Exchange-CrossTenant-fromentityheader: Hosted

X-MS-Exchange-CrossTenant-id: 84df9e7f-e9f6-40af-b435-aaaaaaaaaaaa

X-MS-Exchange-CrossTenant-rms-persistedconsumerorg: 00000000-0000-0000-0000-000000000000

X-MS-Exchange-Transport-CrossTenantHeadersStamped: OS6P279MB0728

X-Spam_score: 7.5

X-Spam_score_int: 75

X-Spam_bar: +++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Hi, I sent you an email on Friday, but you didn't respond.

Let me know if you're interested. in hiring a “Dedicated SEO a reasonable

cost”? Can I send you a price list? Thank you! Jenny, On Fri, O [...]



Content analysis details: (7.5 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[2603:10a6:e10:8a:0:0:0:5 listed in]

[will-spam-for-food.eu.org]

[2603:10a6:e10:8a:0:0:0:5 listed in]

[will-spam-for-food.eu.org]

[2603:10a6:e10:8a:0:0:0:5 listed in]

[will-spam-for-food.eu.org]

[2603:10a6:e10:8a:0:0:0:5 listed in]

[will-spam-for-food.eu.org]

[2603:10a6:e10:8a:0:0:0:5 listed in]

[will-spam-for-food.eu.org]

[2603:10a6:e10:8a:0:0:0:5 listed in]

[will-spam-for-food.eu.org]

[2603:10a6:e10:8a:0:0:0:5 listed in]

[will-spam-for-food.eu.org]

[2603:10a6:e10:8a:0:0:0:5 listed in]

[will-spam-for-food.eu.org]

[52.103.52.3 listed in will-spam-for-food.eu.org]

[52.103.52.3 listed in will-spam-for-food.eu.org]

[52.103.52.3 listed in will-spam-for-food.eu.org]

[52.103.52.3 listed in will-spam-for-food.eu.org]

[52.103.52.3 listed in will-spam-for-food.eu.org]

[52.103.52.3 listed in will-spam-for-food.eu.org]

[52.103.52.3 listed in will-spam-for-food.eu.org]

[52.103.52.3 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[52.103.52.3 listed in dnsbl.ahbl.org]

[52.103.52.3 listed in dnsbl.ahbl.org]

[52.103.52.3 listed in dnsbl.ahbl.org]

[52.103.52.3 listed in dnsbl.ahbl.org]

[2603:10a6:e10:8a:0:0:0:5 listed in]

[dnsbl.ahbl.org]

[2603:10a6:e10:8a:0:0:0:5 listed in]

[dnsbl.ahbl.org]

[2603:10a6:e10:8a:0:0:0:5 listed in]

[dnsbl.ahbl.org]

[2603:10a6:e10:8a:0:0:0:5 listed in]

[dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[52.103.52.3 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[52.103.52.3 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[52.103.52.3 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[52.103.52.3 listed in dnsbl.ahbl.org]

-0.0 SPF_PASS SPF: sender matches SPF record

-0.1 DKIM_VALID Message has at least one valid DKIM or DK signature

-0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from author's

domain

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[52.103.52.3 listed in wl.mailspike.net]

0.0 ARC_SIGNED Message has a ARC signature

0.0 ARC_VALID Message has a valid ARC signature

-0.1 DKIM_VALID_EF Message has a valid DKIM or DK signature from

envelope-from domain

0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid

0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends in

digit

[jennywebservice1923(at)outlook.com]

0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider

[jennywebservice1923(at)outlook.com]

1.2 MISSING_HEADERS Missing To: header

-0.0 T_RP_MATCHES_RCVD Envelope sender domain matches handover relay

domain

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

1.4 MALFORMED_FREEMAIL Bad headers on message from free email service

Subject: {SPAM?} Re: SEO Improve?



--_000_OS6P279MB1483A25EB6BF80A807D6BEACAEF4AOS6P279MB1483NORP_

Content-Type: text/plain; charset="utf-8"

Content-Transfer-Encoding: base64



SGksDQpJIHNlbnQgeW91IGFuIGVtYWlsIG9uIEZyaWRheSwgYnV0IHlvdSBkaWRuJ3QgcmVzcG9u

ZC4gTGV0IG1lIGtub3cgaWYgeW91J3JlIGludGVyZXN0ZWQuIGluIGhpcmluZyBhIOKAnERlZGlj

YXRlZCBTRU8gYSByZWFzb25hYmxlIGNvc3TigJ0/DQpDYW4gSSBzZW5kIHlvdSBhIHByaWNlIGxp

c3Q/DQpUaGFuayB5b3UhDQpKZW5ueSwNCk9uIEZyaSwgT2N0IDEwLCAyMDI1LCAzOjU34oCvUE0g

PCA+IHdyb3RlOg0KSGksDQpBcmUgeW91IGludGVyZXN0ZWQgaW4gZ3Jvd2luZyB5b3VyIGJ1c2lu

ZXNzIHdpdGggU0VPPyBMZXQgdXMgaGVscCB5b3UgZ2V0IG9uIEdvb2dsZeKAmXMgMXN0IHBhZ2Uu

DQpTaGFyZSB5b3VyIHdlYnNpdGUgYW5kIHRhcmdldCBjaXR5IGZvciBhIHByb3Bvc2FsIGFuZCBx

dW90ZS4NClNpbmNlcmVseSwNCkplbm55LA0KDQo=



--_000_OS6P279MB1483A25EB6BF80A807D6BEACAEF4AOS6P279MB1483NORP_

Content-Type: text/html; charset="utf-8"

Content-Transfer-Encoding: base64



PGh0bWw+DQo8aGVhZD4NCjxtZXRhIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSIgY29udGVudD0i

dGV4dC9odG1sOyBjaGFyc2V0PXV0Zi04Ij4NCjxzdHlsZSB0eXBlPSJ0ZXh0L2NzcyIgc3R5bGU9

ImRpc3BsYXk6bm9uZTsiPiBQIHttYXJnaW4tdG9wOjA7bWFyZ2luLWJvdHRvbTowO30gPC9zdHls

ZT4NCjwvaGVhZD4NCjxib2R5IGRpcj0ibHRyIj4NCjxkaXYgc3R5bGU9ImxpbmUtaGVpZ2h0OiAx

LjM4OyBtYXJnaW46IDBpbiAwaW4gMTBwdDsgZm9udC1mYW1pbHk6IEFwdG9zLCBBcHRvc19FbWJl

ZGRlZEZvbnQsIEFwdG9zX01TRm9udFNlcnZpY2UsIENhbGlicmksIEhlbHZldGljYSwgc2Fucy1z

ZXJpZjsgZm9udC1zaXplOiAxMnB0OyBjb2xvcjogcmdiKDAsIDAsIDApOyIgY2xhc3M9ImVsZW1l

bnRUb1Byb29mIj4NCkhpLDwvZGl2Pg0KPGRpdiBzdHlsZT0ibGluZS1oZWlnaHQ6IDEuMzg7IG1h

cmdpbjogMGluIDBpbiAxMHB0OyBmb250LWZhbWlseTogQXB0b3MsIEFwdG9zX0VtYmVkZGVkRm9u

dCwgQXB0b3NfTVNGb250U2VydmljZSwgQ2FsaWJyaSwgSGVsdmV0aWNhLCBzYW5zLXNlcmlmOyBm

b250LXNpemU6IDEycHQ7IGNvbG9yOiByZ2IoMCwgMCwgMCk7IiBjbGFzcz0iZWxlbWVudFRvUHJv

b2YiPg0KSSBzZW50IHlvdSBhbiBlbWFpbCBvbiBGcmlkYXksIGJ1dCB5b3UgZGlkbid0IHJlc3Bv

bmQuIExldCBtZSBrbm93IGlmIHlvdSdyZSBpbnRlcmVzdGVkLiBpbiBoaXJpbmcgYSDigJxEZWRp

Y2F0ZWQgU0VPIGEgcmVhc29uYWJsZSBjb3N04oCdPzwvZGl2Pg0KPGRpdiBzdHlsZT0ibGluZS1o

ZWlnaHQ6IDEuMzg7IG1hcmdpbjogMGluIDBpbiAxMHB0OyBmb250LWZhbWlseTogQXB0b3MsIEFw

dG9zX0VtYmVkZGVkRm9udCwgQXB0b3NfTVNGb250U2VydmljZSwgQ2FsaWJyaSwgSGVsdmV0aWNh

LCBzYW5zLXNlcmlmOyBmb250LXNpemU6IDEycHQ7IGNvbG9yOiByZ2IoMCwgMCwgMCk7IiBjbGFz

cz0iZWxlbWVudFRvUHJvb2YiPg0KPGI+Q2FuIEkgc2VuZCB5b3UgYSBwcmljZSBsaXN0PzwvYj48

L2Rpdj4NCjxkaXYgc3R5bGU9ImxpbmUtaGVpZ2h0OiAxLjM4OyBtYXJnaW46IDBpbiAwaW4gMTBw

dDsgZm9udC1mYW1pbHk6IEFwdG9zLCBBcHRvc19FbWJlZGRlZEZvbnQsIEFwdG9zX01TRm9udFNl

cnZpY2UsIENhbGlicmksIEhlbHZldGljYSwgc2Fucy1zZXJpZjsgZm9udC1zaXplOiAxMnB0OyBj

b2xvcjogcmdiKDAsIDAsIDApOyIgY2xhc3M9ImVsZW1lbnRUb1Byb29mIj4NClRoYW5rIHlvdSE8

L2Rpdj4NCjxkaXYgc3R5bGU9ImxpbmUtaGVpZ2h0OiAxLjM4OyBtYXJnaW46IDBpbiAwaW4gMTBw

dDsgZm9udC1mYW1pbHk6IEFwdG9zLCBBcHRvc19FbWJlZGRlZEZvbnQsIEFwdG9zX01TRm9udFNl

cnZpY2UsIENhbGlicmksIEhlbHZldGljYSwgc2Fucy1zZXJpZjsgZm9udC1zaXplOiAxMnB0OyBj

b2xvcjogcmdiKDAsIDAsIDApOyIgY2xhc3M9ImVsZW1lbnRUb1Byb29mIj4NCkplbm55LDwvZGl2

Pg0KPGRpdiBzdHlsZT0ibGluZS1oZWlnaHQ6IDEuMzg7IG1hcmdpbjogMGluIDBpbiAxMHB0OyBm

b250LWZhbWlseTogQXB0b3MsIEFwdG9zX0VtYmVkZGVkRm9udCwgQXB0b3NfTVNGb250U2Vydmlj

ZSwgQ2FsaWJyaSwgSGVsdmV0aWNhLCBzYW5zLXNlcmlmOyBmb250LXNpemU6IDEycHQ7IGNvbG9y

OiByZ2IoMCwgMCwgMCk7IiBjbGFzcz0iZWxlbWVudFRvUHJvb2YiPg0KT24gRnJpLCBPY3QgMTAs

IDIwMjUsIDM6NTfigK9QTSAmbHQ7ICZndDsgd3JvdGU6PC9kaXY+DQo8ZGl2IHN0eWxlPSJsaW5l

LWhlaWdodDogMS4zODsgbWFyZ2luOiAwaW4gMGluIDEwcHQ7IGZvbnQtZmFtaWx5OiBBcHRvcywg

QXB0b3NfRW1iZWRkZWRGb250LCBBcHRvc19NU0ZvbnRTZXJ2aWNlLCBDYWxpYnJpLCBIZWx2ZXRp

Y2EsIHNhbnMtc2VyaWY7IGZvbnQtc2l6ZTogMTJwdDsgY29sb3I6IHJnYigwLCAwLCAwKTsiIGNs

YXNzPSJlbGVtZW50VG9Qcm9vZiI+DQpIaSw8L2Rpdj4NCjxkaXYgc3R5bGU9ImxpbmUtaGVpZ2h0

OiAxLjM4OyBtYXJnaW46IDBpbiAwaW4gMTBwdDsgZm9udC1mYW1pbHk6IEFwdG9zLCBBcHRvc19F

bWJlZGRlZEZvbnQsIEFwdG9zX01TRm9udFNlcnZpY2UsIENhbGlicmksIEhlbHZldGljYSwgc2Fu

cy1zZXJpZjsgZm9udC1zaXplOiAxMnB0OyBjb2xvcjogcmdiKDAsIDAsIDApOyIgY2xhc3M9ImVs

ZW1lbnRUb1Byb29mIj4NCkFyZSB5b3UgaW50ZXJlc3RlZCBpbiBncm93aW5nIHlvdXIgYnVzaW5l

c3Mgd2l0aCBTRU8/IExldCB1cyBoZWxwIHlvdSBnZXQgb24gR29vZ2xl4oCZcyAxc3QgcGFnZS48

L2Rpdj4NCjxkaXYgc3R5bGU9ImxpbmUtaGVpZ2h0OiAxLjM4OyBtYXJnaW46IDBpbiAwaW4gMTBw

dDsgZm9udC1mYW1pbHk6IEFwdG9zLCBBcHRvc19FbWJlZGRlZEZvbnQsIEFwdG9zX01TRm9udFNl

cnZpY2UsIENhbGlicmksIEhlbHZldGljYSwgc2Fucy1zZXJpZjsgZm9udC1zaXplOiAxMnB0OyBj

b2xvcjogcmdiKDAsIDAsIDApOyIgY2xhc3M9ImVsZW1lbnRUb1Byb29mIj4NCjxiPlNoYXJlIHlv

dXIgd2Vic2l0ZSBhbmQgdGFyZ2V0IGNpdHkgZm9yIGEgcHJvcG9zYWwgYW5kIHF1b3RlLjwvYj48

L2Rpdj4NCjxkaXYgc3R5bGU9ImxpbmUtaGVpZ2h0OiAxLjM4OyBtYXJnaW46IDBpbiAwaW4gMTBw

dDsgZm9udC1mYW1pbHk6IEFwdG9zLCBBcHRvc19FbWJlZGRlZEZvbnQsIEFwdG9zX01TRm9udFNl

cnZpY2UsIENhbGlicmksIEhlbHZldGljYSwgc2Fucy1zZXJpZjsgZm9udC1zaXplOiAxMnB0OyBj

b2xvcjogcmdiKDAsIDAsIDApOyIgY2xhc3M9ImVsZW1lbnRUb1Byb29mIj4NClNpbmNlcmVseSw8

L2Rpdj4NCjxkaXYgc3R5bGU9ImxpbmUtaGVpZ2h0OiAxLjM4OyBtYXJnaW46IDBpbiAwaW4gMTBw

dDsgZm9udC1mYW1pbHk6IEFwdG9zLCBBcHRvc19FbWJlZGRlZEZvbnQsIEFwdG9zX01TRm9udFNl

cnZpY2UsIENhbGlicmksIEhlbHZldGljYSwgc2Fucy1zZXJpZjsgZm9udC1zaXplOiAxMnB0OyBj

b2xvcjogcmdiKDAsIDAsIDApOyIgY2xhc3M9ImVsZW1lbnRUb1Byb29mIj4NCkplbm55LDwvZGl2

Pg0KPGRpdiBzdHlsZT0iZm9udC1mYW1pbHk6IEFwdG9zLCBBcHRvc19FbWJlZGRlZEZvbnQsIEFw

dG9zX01TRm9udFNlcnZpY2UsIENhbGlicmksIEhlbHZldGljYSwgc2Fucy1zZXJpZjsgZm9udC1z

aXplOiAxMnB0OyBjb2xvcjogcmdiKDAsIDAsIDApOyIgY2xhc3M9ImVsZW1lbnRUb1Byb29mIj4N

Cjxicj4NCjwvZGl2Pg0KPC9ib2R5Pg0KPC9odG1sPg0K



--_000_OS6P279MB1483A25EB6BF80A807D6BEACAEF4AOS6P279MB1483NORP_--

Wellheater phish from Google Gmail

Posted by Dave Yadallee on
Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Sun, 19 Oct 2025 12:28:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vAY7Y-00000000Dg7-35d7

for dave@doctor.nl2k.ab.ca;

Sun, 19 Oct 2025 12:27:08 -0600

Resent-From: The Doctor

Resent-Date: Sun, 19 Oct 2025 12:27:08 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-vs1-f70.google.com ([209.85.217.70]:59887)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vAUXD-000000008j3-1cuc

for doctor@nk.ca;

Sun, 19 Oct 2025 08:37:30 -0600

Received: by mail-vs1-f70.google.com with SMTP id ada2fe7eead31-5d6131f8ee0so2548877137.3

for ; Sun, 19 Oct 2025 07:36:32 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=firebaseapp.com; s=20230601; t=1760884586; x=1761489386; darn=nk.ca;

h=to:from:subject:date:message-id:mime-version:from:to:cc:subject

:date:message-id:reply-to;

bh=bBf8jwy4hpGjI+6mGjsZN/hp0fDtXz476aV7U/uQTcY=;

b=JG28Uo+PsyuDgZpjizBWo0q90ergdrINYpi4DPGCuLvOVGSd1v7ZVJZy2Y+NTeIr39

rlg1ZHwZDpSQ9U8jDcG5Jb1GAnwfaXIHhAYnbVdT+HAaMOecOq+DUtxcUTy2EhDs5cAd

xqnyce6hOcu9IZ2Au4/epoVzPRLIe15ezbgT7zGJ8TekzgXrMYJWB3Q+qbWhoE/zRKUO

oagYbUPsjhY5Nt2HygCA1xPh6wcHPdoXZ69pL8cnIrNl4Sxj7gEOdI2MQXW4sDskvaNF

5iclnjjrvU+vtuRRFlhlWcGXyUNyffnTigrmochZxD7IRSCV/+KLetKX/NL3vCbRQnqm

UI2A==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20230601; t=1760884586; x=1761489386;

h=to:from:subject:date:message-id:mime-version:x-gm-message-state

:from:to:cc:subject:date:message-id:reply-to;

bh=bBf8jwy4hpGjI+6mGjsZN/hp0fDtXz476aV7U/uQTcY=;

b=JWab3bMCkhgpu8UXUZxoXywuLiVfjJL0DbNQ0Jnd7rfFjtCJpUMuHWFX7EsYuac57P

J8N4T4kkQ+HWSEfBV8wEiusHgSMpRLxBX4ShAjBPGKtTWwrG972hia/rVVTyGmptPHeh

wS2F995ppqyJv+CbD60UgCG2QQswTbBAQ9mqYZLhVd6mrtMj64M6qw0Ye81h9xDyTwgK

UMB7YE8/UcsUSiHYVkFjHzwBNp7Z7i6okiA36TGu9XZhIhlZBVTpiZXNtcnL9F9N3d/5

qEBeA74yrTbbXrgqQpuDfb8zO344mA0a99NRiceNYO/+ZSL9/SI5y2WmLQaPey9qVpQ2

JB/Q==

X-Gm-Message-State: AOJu0YyDnW/brSPnzuu4ad8CQFL1R2R1ClLzFyzSXOW/kNyEW6exGbkj

sINrWOT/dCtZMGp44E5IltTbUDOJM9mGl9B7y0/2vcHy9IKLJs9vLmyF3ubSPqphAuGYpvB2sC8

FYe73By0JaQ==

X-Google-Smtp-Source: AGHT+IEfd1TZP97H9dnzNtQld0h4bLYTj3uQJ99cgLewrmCvZiP4k4sskt1WUXtC2aB5+AsBj0cHQMQCwiU5h2Q=

MIME-Version: 1.0

X-Received: by 2002:a05:6102:ccf:b0:5d5:dcfb:e39 with SMTP id

ada2fe7eead31-5d7dd67cdecmr3232787137.29.1760884586631; Sun, 19 Oct 2025

07:36:26 -0700 (PDT)

Message-ID: <00000000000046d074064183e42a@google.com>

Date: Sun, 19 Oct 2025 14:36:26 +0000

Subject: =?UTF-8?Q?=F0=9F=94=A5_Feel_Cozy_Fast_with_WellHeater_=2D_Say_Goodbye_to?=

=?UTF-8?Q?_Cold_Nights_Forever?=

From: Home Comfort Team

To: doctor@nk.ca

Content-Type: multipart/alternative; boundary="00000000000046d066064183e427"

X-Spam_score: 9.0

X-Spam_score_int: 90

X-Spam_bar: +++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview:



Content analysis details: (9.0 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

2.3 EMPTY_MESSAGE Message appears to have no textual parts and no

Subject: text

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[209.85.217.70 listed in will-spam-for-food.eu.org]

[209.85.217.70 listed in will-spam-for-food.eu.org]

[209.85.217.70 listed in will-spam-for-food.eu.org]

[209.85.217.70 listed in will-spam-for-food.eu.org]

[209.85.217.70 listed in will-spam-for-food.eu.org]

[209.85.217.70 listed in will-spam-for-food.eu.org]

[209.85.217.70 listed in will-spam-for-food.eu.org]

[209.85.217.70 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[209.85.217.70 listed in dnsbl.ahbl.org]

[209.85.217.70 listed in dnsbl.ahbl.org]

[209.85.217.70 listed in dnsbl.ahbl.org]

[209.85.217.70 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[209.85.217.70 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[209.85.217.70 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[209.85.217.70 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[209.85.217.70 listed in dnsbl.ahbl.org]

0.1 URIBL_SBL_A Contains URL's A record listed in the SBL blocklist

[URI: click.convertkit-mail2.com/3.18.56.123]

[URI: click.convertkit-mail2.com/3.141.222.179]

[URI: click.convertkit-mail2.com/18.220.225.51]

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[209.85.217.70 listed in wl.mailspike.net]

-0.0 SPF_PASS SPF: sender matches SPF record

-0.1 DKIM_VALID Message has at least one valid DKIM or DK signature

0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid

0.0 MIME_HTML_MOSTLY BODY: Multipart message mostly text/html MIME

0.0 HTML_MESSAGE BODY: HTML included in message

0.7 MPART_ALT_DIFF BODY: HTML and text parts are different

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

1.0 VOWEL_URI_5 URI hostname with 5 consecutive vowels

0.0 T_REMOTE_IMAGE Message contains an external image

Subject: {SPAM?} =?UTF-8?Q?=F0=9F=94=A5_Feel_Cozy_Fast_with_WellHeater_=2D_Say_Goodbye_to?=

=?UTF-8?Q?_Cold_Nights_Forever?=



--00000000000046d066064183e427

Content-Type: text/plain; charset="UTF-8"; format=flowed; delsp=yes



--00000000000046d066064183e427

Content-Type: text/html; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable






















dding=3D"0" cellspacing=3D"0" class=3D"email" style=3D"background:#f7f7f7 !=

important;width:100%" bgcolor=3D"#ffffff">


ft:0;padding-bottom:30px;padding-right:0;margin:0 auto;max-width:100%">
le cellpadding=3D"0" cellspacing=3D"0" bgcolor=3D"#f7f7f7" style=3D"width:1=

00%;margin:0 auto;background-color:#f7f7f7">





o;max-width:640px">




ing-alt:0px 0px 0px 0px" bgcolor=3D"transparent">

tion ck-padding-left-none ck-padding-right-none" style=3D"padding:0px 0px 0=

px 0px">
<=

table width=3D"100%" border=3D"0" cellspacing=3D"0" cellpadding=3D"0" style=

=3D"text-align:center;table-layout:fixed;float:none" class=3D"email-image">=


tom:12px;margin-left:0;margin-right:0;max-width:100%;width:100%">
=3D"display:block" href=3D"https://click.convertkit-mail2.com/o8up4z8qrdcqh=

6ggg20hvhq4dm8rrcohq2ex4/z2hghnheexewlosp/aHR0cHM6Ly9idWZmLmx5L2RFZHNEeXE=

=3D" target=3D"_blank" rel=3D"noopener noreferrer" class=3D"kit-image-link"=

url-id=3D"1797030055">
1.s3.amazonaws.com/WellHeater.png" width=3D"100%" height=3D"auto" style=3D"=

display:block;border-radius:0px 0px 0px 0px;width:100%;height:auto;object-f=

it:contain">
nk" rel=3D"noopener noreferrer" class=3D"kit-image-link" url-id=3D"17970300=

56">
Comfort.png" width=3D"100%" height=3D"auto" style=3D"display:block;border-r=

adius:0px 0px 0px 0px;width:100%;height:auto;object-fit:contain">
re>


















--00000000000046d066064183e427--

Wellheater phish from Google Gmail

Posted by Dave Yadallee on
Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Sun, 19 Oct 2025 12:28:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vAY7c-00000000Dga-2Wni

for dave@doctor.nl2k.ab.ca;

Sun, 19 Oct 2025 12:27:12 -0600

Resent-From: The Doctor

Resent-Date: Sun, 19 Oct 2025 12:27:12 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-vk1-f199.google.com ([209.85.221.199]:43075)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vAUYp-00000000AjW-2Wd0

for doctor@nl2k.ab.ca;

Sun, 19 Oct 2025 08:39:10 -0600

Received: by mail-vk1-f199.google.com with SMTP id 71dfb90a1353d-54bbe14a05dso10601526e0c.0

for ; Sun, 19 Oct 2025 07:38:20 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=firebaseapp.com; s=20230601; t=1760884695; x=1761489495; darn=nl2k.ab.ca;

h=to:from:subject:date:message-id:mime-version:from:to:cc:subject

:date:message-id:reply-to;

bh=BZqJGh/+kfDFgHx90o381WRLIXvh51kU1Gj/FhAwY9g=;

b=LusQFQUuyrSynJmDCEmU5cp5Fot3lCVeoVs5nBHVAk74MlWJFp4NyUsPoKqqdRUMtK

/N4niF80XdfOp71g09FTe2LDYOhh+r9sXdlUnPvseB2NTZHy6H/+89G/RBuRpL1F6Lnc

NoqaMU8grfrjR1sHMdcTHR/viSD/3dOBvidJGZWBz57xPf1Z1RypqyarQkNxmGgRQFBQ

cUeUpfAvHbllv3Rbv88lnx9b1uJNme/WrMUiXYdxVWE+LkhnXyAU9RIQm6CWELRFhTin

5O+YIKw5Y4WlBD9rCQbVa3El8fCAmnt/SLwk6uG0splFd2QJ2kZ24H+980G7DIbvuPIc

wgFQ==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20230601; t=1760884695; x=1761489495;

h=to:from:subject:date:message-id:mime-version:x-gm-message-state

:from:to:cc:subject:date:message-id:reply-to;

bh=BZqJGh/+kfDFgHx90o381WRLIXvh51kU1Gj/FhAwY9g=;

b=gOwI2MEeLhadNx9VK+FYYOnKT8NNzGTvzXBuECYNI3OCDJGQSoFCypMmd6wy20anZS

qDK6WpxTegWBdspb11AEvgK9e33WztcKOtE3HzhXF1Lmt+xi1oSjMfY8mxV4LmYRzPWV

ytIO/yH8AXYVW+NFrlPX6gH2yFDlMLJwm5me5WuLikK33owpoVeZZ/80ZuogO+UJrxO5

+J5GGoXToMi/9v9UmSX0n8ohPyA9cPkbRkWfkLwaZWLGKPzJmcHPSzY+yC4pSXCyorB7

5j4rhnLgLMAA836UsKHdNXvxQM5GHjR9U73G9ypVGoMdFi140hFzWKkEMfGHzjBZk2w3

9Xrg==

X-Gm-Message-State: AOJu0Yyb+0ZBnKftnKWEgcuSzoEgxH3hTuOPKbczogTWzwg261+tX8rt

oIkbILF1/9Gvf4Dlrf/A7tknQHFrRqKCOOOL6K5i7sXEqqHTdLPyb26KabXk4qpeiLYIOQTVfIr

DczegYXdzNw==

X-Google-Smtp-Source: AGHT+IFYUzNSr6bQGxAVMQmtcr5mgqU/Gnt33Sl59IYkOCdan/TbWLwX3TXKOt1LMgTX7ako3YMwyCUswXG9kcI=

MIME-Version: 1.0

X-Received: by 2002:a05:6122:6ab:b0:554:e069:d7b with SMTP id

71dfb90a1353d-5563feb71d6mr3760033e0c.0.1760884694872; Sun, 19 Oct 2025

07:38:14 -0700 (PDT)

Message-ID: <000000000000ba7232064183ea0d@google.com>

Date: Sun, 19 Oct 2025 14:38:14 +0000

Subject: =?UTF-8?Q?=F0=9F=94=A5_Feel_Cozy_Fast_with_WellHeater_=2D_Say_Goodbye_to?=

=?UTF-8?Q?_Cold_Nights_Forever?=

From: Home Comfort Team

To: doctor@nl2k.ab.ca

Content-Type: multipart/alternative; boundary="000000000000ba7225064183ea0a"

X-Spam_score: 11.7

X-Spam_score_int: 117

X-Spam_bar: +++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview:



Content analysis details: (11.7 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

2.3 EMPTY_MESSAGE Message appears to have no textual parts and no

Subject: text

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[209.85.221.199 listed in will-spam-for-food.eu.org]

[209.85.221.199 listed in will-spam-for-food.eu.org]

[209.85.221.199 listed in will-spam-for-food.eu.org]

[209.85.221.199 listed in will-spam-for-food.eu.org]

[209.85.221.199 listed in will-spam-for-food.eu.org]

[209.85.221.199 listed in will-spam-for-food.eu.org]

[209.85.221.199 listed in will-spam-for-food.eu.org]

[209.85.221.199 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[209.85.221.199 listed in dnsbl.ahbl.org]

[209.85.221.199 listed in dnsbl.ahbl.org]

[209.85.221.199 listed in dnsbl.ahbl.org]

[209.85.221.199 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[209.85.221.199 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[209.85.221.199 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[209.85.221.199 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[209.85.221.199 listed in dnsbl.ahbl.org]

2.7 RCVD_IN_PSBL RBL: Received via a relay in PSBL

[209.85.221.199 listed in psbl.surriel.com]

0.1 URIBL_SBL_A Contains URL's A record listed in the SBL blocklist

[URI: click.convertkit-mail2.com/18.220.225.51]

[URI: click.convertkit-mail2.com/3.141.222.179]

[URI: click.convertkit-mail2.com/3.18.56.123]

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[209.85.221.199 listed in wl.mailspike.net]

-0.0 SPF_PASS SPF: sender matches SPF record

-0.1 DKIM_VALID Message has at least one valid DKIM or DK signature

0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid

0.0 MIME_HTML_MOSTLY BODY: Multipart message mostly text/html MIME

0.0 HTML_MESSAGE BODY: HTML included in message

0.7 MPART_ALT_DIFF BODY: HTML and text parts are different

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

1.0 VOWEL_URI_5 URI hostname with 5 consecutive vowels

0.0 T_REMOTE_IMAGE Message contains an external image

Subject: {SPAM?} =?UTF-8?Q?=F0=9F=94=A5_Feel_Cozy_Fast_with_WellHeater_=2D_Say_Goodbye_to?=

=?UTF-8?Q?_Cold_Nights_Forever?=



--000000000000ba7225064183ea0a

Content-Type: text/plain; charset="UTF-8"; format=flowed; delsp=yes



--000000000000ba7225064183ea0a

Content-Type: text/html; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable






















dding=3D"0" cellspacing=3D"0" class=3D"email" style=3D"background:#f7f7f7 !=

important;width:100%" bgcolor=3D"#ffffff">


ft:0;padding-bottom:30px;padding-right:0;margin:0 auto;max-width:100%">
le cellpadding=3D"0" cellspacing=3D"0" bgcolor=3D"#f7f7f7" style=3D"width:1=

00%;margin:0 auto;background-color:#f7f7f7">





o;max-width:640px">




ing-alt:0px 0px 0px 0px" bgcolor=3D"transparent">

tion ck-padding-left-none ck-padding-right-none" style=3D"padding:0px 0px 0=

px 0px">
<=

table width=3D"100%" border=3D"0" cellspacing=3D"0" cellpadding=3D"0" style=

=3D"text-align:center;table-layout:fixed;float:none" class=3D"email-image">=


tom:12px;margin-left:0;margin-right:0;max-width:100%;width:100%">
=3D"display:block" href=3D"https://click.convertkit-mail2.com/o8up4z8qrdcqh=

6ggg20hvhq4dm8rrcohq2ex4/z2hghnheexewlosp/aHR0cHM6Ly9idWZmLmx5L2RFZHNEeXE=

=3D" target=3D"_blank" rel=3D"noopener noreferrer" class=3D"kit-image-link"=

url-id=3D"1797030055">
1.s3.amazonaws.com/WellHeater.png" width=3D"100%" height=3D"auto" style=3D"=

display:block;border-radius:0px 0px 0px 0px;width:100%;height:auto;object-f=

it:contain">
nk" rel=3D"noopener noreferrer" class=3D"kit-image-link" url-id=3D"17970300=

56">
Comfort.png" width=3D"100%" height=3D"auto" style=3D"display:block;border-r=

adius:0px 0px 0px 0px;width:100%;height:auto;object-fit:contain">
re>


















--000000000000ba7225064183ea0a--

Wellheater phish from Google Gmail

Posted by Dave Yadallee on
Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Sun, 19 Oct 2025 12:28:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vAY7g-00000000Dgv-3Auy

for dave@doctor.nl2k.ab.ca;

Sun, 19 Oct 2025 12:27:16 -0600

Resent-From: The Doctor

Resent-Date: Sun, 19 Oct 2025 12:27:16 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-vs1-f70.google.com ([209.85.217.70]:43434)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vAUcJ-00000000BBP-2A9E

for sales@nk.ca;

Sun, 19 Oct 2025 08:42:46 -0600

Received: by mail-vs1-f70.google.com with SMTP id ada2fe7eead31-5b431158f27so8237610137.1

for ; Sun, 19 Oct 2025 07:41:53 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=firebaseapp.com; s=20230601; t=1760884907; x=1761489707; darn=nk.ca;

h=to:from:subject:date:message-id:mime-version:from:to:cc:subject

:date:message-id:reply-to;

bh=8tNTzx728vYPiJyDxBJolLtJ729JxugUbTkd0cyUvEQ=;

b=D3y0hcI+KuWSuzM6rAkmMItwZobH4O4GYFSH83py2dKxcgpRbRb7NaTZ9dcRvFv24+

yFHCURfz/YOfTfBE1QNvluGo7wXSFQjS15udRi+XW1N3rJyHRzspYLirZo04OVIysac5

fIyZwx/Pk80gaCprBd3ln+QWhqCKjcSGNk5VeSeTl6bob8ccx9/VRc9Up/7Vau0fU6rU

CaURh/WVHGn8ZxebfABKz8okWqZ1y88eueeFuRogUplDFjavXdmPaO9HBn+1BIuUSF8d

eOeZtYMl7HKfNqM7tf++GqMwFkzSnBeCLI25R9jnVVDLoaNNu6z94yFpayF1ZaHJBQW8

SpIQ==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20230601; t=1760884907; x=1761489707;

h=to:from:subject:date:message-id:mime-version:x-gm-message-state

:from:to:cc:subject:date:message-id:reply-to;

bh=8tNTzx728vYPiJyDxBJolLtJ729JxugUbTkd0cyUvEQ=;

b=Xjuflu7w86HL5Z+WOOWcxE8tKk2NpP2a9kbCHroLArPmv6uL0Qt4rTWBQTYeMeHWnY

75TLHyt78nZMRzBPOJkRn8WgPJzExJeNNoA7aOs1HzZDD0epKcBWS+2/SD6OAABqzQ7S

8TYJMey6dYkV4fztt8NA7H3tGpELWcLr5VlhXd+AwW0EK9L4Gm4Ly3rtWLSImv3cEoy/

bd5+Q55b+yjQzs1BMfNUWs4vD/LrKa7Jmtej6KPKkfOmWfiBZymywrpQ9jTAUxFgfjdl

uCYeI1/EAund7TU+XFsQQATKiXcZI1/dc0mbMqr2bLf2ukiQNkxo8jHEdM8tqEccVeKx

M1aA==

X-Gm-Message-State: AOJu0Ywa090nUBsUdi5u/oMOnl6IReyEBex0m5Ao6WloND96ECS3brou

8zoaKYC0brlnALVFJE55mc0+U2UbsnsDY3HFELjTaSlT8ht9EpGORr99dIKxCtV2DOEdeUjRYP4

qz7F8G3Gjag==

X-Google-Smtp-Source: AGHT+IFmNikJ6NTVTeru0xRtDkWUyWEZ6aCqjBJeTWSp8O8e28bIdKNOoVTC+BZFHUbydWe1uyHJFD9D0eIryz8=

MIME-Version: 1.0

X-Received: by 2002:a05:6102:dd4:b0:5a4:60ff:80c3 with SMTP id

ada2fe7eead31-5d7dd678ddamr3664639137.14.1760884907143; Sun, 19 Oct 2025

07:41:47 -0700 (PDT)

Message-ID: <000000000000617156064183f746@google.com>

Date: Sun, 19 Oct 2025 14:41:47 +0000

Subject: =?UTF-8?Q?=F0=9F=94=A5_Feel_Cozy_Fast_with_WellHeater_=2D_Say_Goodbye_to?=

=?UTF-8?Q?_Cold_Nights_Forever?=

From: Home Comfort Team

To: sales@nk.ca

Content-Type: multipart/alternative; boundary="00000000000061714d064183f743"

X-Spam_score: 9.0

X-Spam_score_int: 90

X-Spam_bar: +++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview:



Content analysis details: (9.0 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

2.3 EMPTY_MESSAGE Message appears to have no textual parts and no

Subject: text

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[209.85.217.70 listed in will-spam-for-food.eu.org]

[209.85.217.70 listed in will-spam-for-food.eu.org]

[209.85.217.70 listed in will-spam-for-food.eu.org]

[209.85.217.70 listed in will-spam-for-food.eu.org]

[209.85.217.70 listed in will-spam-for-food.eu.org]

[209.85.217.70 listed in will-spam-for-food.eu.org]

[209.85.217.70 listed in will-spam-for-food.eu.org]

[209.85.217.70 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[209.85.217.70 listed in dnsbl.ahbl.org]

[209.85.217.70 listed in dnsbl.ahbl.org]

[209.85.217.70 listed in dnsbl.ahbl.org]

[209.85.217.70 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[209.85.217.70 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[209.85.217.70 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[209.85.217.70 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[209.85.217.70 listed in dnsbl.ahbl.org]

0.1 URIBL_SBL_A Contains URL's A record listed in the SBL blocklist

[URI: click.convertkit-mail2.com/18.220.225.51]

[URI: click.convertkit-mail2.com/3.18.56.123]

[URI: click.convertkit-mail2.com/3.141.222.179]

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[209.85.217.70 listed in wl.mailspike.net]

-0.0 SPF_PASS SPF: sender matches SPF record

-0.1 DKIM_VALID Message has at least one valid DKIM or DK signature

0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid

0.0 MIME_HTML_MOSTLY BODY: Multipart message mostly text/html MIME

0.0 HTML_MESSAGE BODY: HTML included in message

0.7 MPART_ALT_DIFF BODY: HTML and text parts are different

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

1.0 VOWEL_URI_5 URI hostname with 5 consecutive vowels

0.0 T_REMOTE_IMAGE Message contains an external image

Subject: {SPAM?} =?UTF-8?Q?=F0=9F=94=A5_Feel_Cozy_Fast_with_WellHeater_=2D_Say_Goodbye_to?=

=?UTF-8?Q?_Cold_Nights_Forever?=



--00000000000061714d064183f743

Content-Type: text/plain; charset="UTF-8"; format=flowed; delsp=yes



--00000000000061714d064183f743

Content-Type: text/html; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable






















dding=3D"0" cellspacing=3D"0" class=3D"email" style=3D"background:#f7f7f7 !=

important;width:100%" bgcolor=3D"#ffffff">


ft:0;padding-bottom:30px;padding-right:0;margin:0 auto;max-width:100%">
le cellpadding=3D"0" cellspacing=3D"0" bgcolor=3D"#f7f7f7" style=3D"width:1=

00%;margin:0 auto;background-color:#f7f7f7">





o;max-width:640px">




ing-alt:0px 0px 0px 0px" bgcolor=3D"transparent">

tion ck-padding-left-none ck-padding-right-none" style=3D"padding:0px 0px 0=

px 0px">
<=

table width=3D"100%" border=3D"0" cellspacing=3D"0" cellpadding=3D"0" style=

=3D"text-align:center;table-layout:fixed;float:none" class=3D"email-image">=


tom:12px;margin-left:0;margin-right:0;max-width:100%;width:100%">
=3D"display:block" href=3D"https://click.convertkit-mail2.com/o8up4z8qrdcqh=

6ggg20hvhq4dm8rrcohq2ex4/z2hghnheexewlosp/aHR0cHM6Ly9idWZmLmx5L2RFZHNEeXE=

=3D" target=3D"_blank" rel=3D"noopener noreferrer" class=3D"kit-image-link"=

url-id=3D"1797030055">
1.s3.amazonaws.com/WellHeater.png" width=3D"100%" height=3D"auto" style=3D"=

display:block;border-radius:0px 0px 0px 0px;width:100%;height:auto;object-f=

it:contain">
nk" rel=3D"noopener noreferrer" class=3D"kit-image-link" url-id=3D"17970300=

56">
Comfort.png" width=3D"100%" height=3D"auto" style=3D"display:block;border-r=

adius:0px 0px 0px 0px;width:100%;height:auto;object-fit:contain">
re>


















--00000000000061714d064183f743--

Smart TV Phish from Google Gmail

Posted by Dave Yadallee on
Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Sat, 18 Oct 2025 17:13:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vAG69-00000000Iw7-3aWH

for dave@doctor.nl2k.ab.ca;

Sat, 18 Oct 2025 17:12:29 -0600

Resent-From: The Doctor

Resent-Date: Sat, 18 Oct 2025 17:12:29 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-vk1-f197.google.com ([209.85.221.197]:47526)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vADru-00000000754-0HoI

for support@nk.ca;

Sat, 18 Oct 2025 14:49:45 -0600

Received: by mail-vk1-f197.google.com with SMTP id 71dfb90a1353d-54a7e0cbb98so5566654e0c.3

for ; Sat, 18 Oct 2025 13:48:51 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=firebaseapp.com; s=20230601; t=1760820525; x=1761425325; darn=nk.ca;

h=to:from:subject:date:message-id:mime-version:from:to:cc:subject

:date:message-id:reply-to;

bh=2AEmjjZB+hkiq0gNMZcnJNai5Tov7UWQZwjoxZqA01E=;

b=PTfMTpGyF7lxrEEePZC8kVaQiDO41mKzObLJbYkJjweVAwVZxtD/H6EaaInr4RHlJz

lyoN1f4a7yqO1/fYUkn3cS5QhQQI9jHkfC78GVWE8AGCZOzZnn2MkCr0PiDnVnRJ37O5

oTdc8GnT4iyVI/l9TJirS1xtA9pvFgloQN+B1/tTK3zxTWVP0Bl/oHLckl3oGCGeflvK

lDknmhJC4V5WucLD5yhzd0AaKwagWFLAE5GlIe1hOSJIrUqxW+fVWnFK3+HkBxEiM6ls

mArx2jmk63yyRU6zYZiI8Ic429QnEwwHLu/ReLSZIShKYT/71SkpuVX2/1JywavS1Hyu

3lYA==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20230601; t=1760820525; x=1761425325;

h=to:from:subject:date:message-id:mime-version:x-gm-message-state

:from:to:cc:subject:date:message-id:reply-to;

bh=2AEmjjZB+hkiq0gNMZcnJNai5Tov7UWQZwjoxZqA01E=;

b=vpbF9xAZqVUrJ/QYLsbSKXrLsOVc8xLJTIPZ1PJHYQYC4AkZ7wg1sBFuk7nGZ/O2vO

HvNMpd1jbmn4PKq5xHxVwSUHNYWuzS5TvCKXq663CEsA3NBGg43y74YWGH6QWcZMLG/F

38rzmdsUg5grE0C1di99OhUREi2kmR44D/qfJCerqA3sIOHUwiyl5bum7qUCo+XpEuh+

TF5E4Pdm/fMkyU6n72nCL7rehBswwePusn3JokQa8deEVLVhrAROMeXqRr7NxFixdq9R

JdWNCTwOXcHWoJeSFbl8c+pmYsgSO5ZkKfRPJFMbi0E1p/yPSTzC52u4I2u8WOsVxifz

0+Ug==

X-Gm-Message-State: AOJu0YwbyPP3GhwEKWHs6GXijHY8gbDzj+fveoC05cG/mS+3oYW2LFgv

O5vS2C181cMqAQtyJlsb2ktYxEPGvndfP4uPP1BafJN6/iqPtKrppFljNxXTlR5s/ATh7tRDCJw

ZC3ZB9jjHmA==

X-Google-Smtp-Source: AGHT+IFKwtyzRV6wO7Z/3qF+OFIHBMoRNWDuIcf96MzoJWA80ZQ4fq1J+XjpHdsNkUCE8mreeZ/pz4Md2+CF0GA=

MIME-Version: 1.0

X-Received: by 2002:a05:6122:2502:b0:54b:bea5:87ee with SMTP id

71dfb90a1353d-5564ee91e27mr2683274e0c.7.1760820525759; Sat, 18 Oct 2025

13:48:45 -0700 (PDT)

Message-ID: <000000000000f37e69064174f950@google.com>

Date: Sat, 18 Oct 2025 20:48:45 +0000

Subject: =?UTF-8?Q?=E2=9A=A1_Turn_your_TV_into_a_Smart_TV_=2D_Flixy_Special_Off?=

=?UTF-8?Q?er=21?=

From: Your Smart TV partner

To: support@nk.ca

Content-Type: multipart/alternative; boundary="000000000000f37e5b064174f94d"

X-Spam_score: 9.3

X-Spam_score_int: 93

X-Spam_bar: +++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview:



Content analysis details: (9.3 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

2.3 EMPTY_MESSAGE Message appears to have no textual parts and no

Subject: text

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[209.85.221.197 listed in will-spam-for-food.eu.org]

[209.85.221.197 listed in will-spam-for-food.eu.org]

[209.85.221.197 listed in will-spam-for-food.eu.org]

[209.85.221.197 listed in will-spam-for-food.eu.org]

[209.85.221.197 listed in will-spam-for-food.eu.org]

[209.85.221.197 listed in will-spam-for-food.eu.org]

[209.85.221.197 listed in will-spam-for-food.eu.org]

[209.85.221.197 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[209.85.221.197 listed in dnsbl.ahbl.org]

[209.85.221.197 listed in dnsbl.ahbl.org]

[209.85.221.197 listed in dnsbl.ahbl.org]

[209.85.221.197 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[209.85.221.197 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[209.85.221.197 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[209.85.221.197 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[209.85.221.197 listed in dnsbl.ahbl.org]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[209.85.221.197 listed in list.dnswl.org]

0.1 URIBL_SBL_A Contains URL's A record listed in the SBL blocklist

[URI: click.convertkit-mail2.com/3.141.222.179]

[URI: click.convertkit-mail2.com/3.18.56.123]

[URI: click.convertkit-mail2.com/18.220.225.51]

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[209.85.221.197 listed in wl.mailspike.net]

-0.0 SPF_PASS SPF: sender matches SPF record

-0.1 DKIM_VALID Message has at least one valid DKIM or DK signature

0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid

0.3 SPECIAL_OFFER BODY: Special Offer

0.0 MIME_HTML_MOSTLY BODY: Multipart message mostly text/html MIME

0.0 HTML_MESSAGE BODY: HTML included in message

0.7 MPART_ALT_DIFF BODY: HTML and text parts are different

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

1.0 VOWEL_URI_5 URI hostname with 5 consecutive vowels

0.0 T_REMOTE_IMAGE Message contains an external image

Subject: {SPAM?} =?UTF-8?Q?=E2=9A=A1_Turn_your_TV_into_a_Smart_TV_=2D_Flixy_Special_Off?=

=?UTF-8?Q?er=21?=



--000000000000f37e5b064174f94d

Content-Type: text/plain; charset="UTF-8"; format=flowed; delsp=yes



--000000000000f37e5b064174f94d

Content-Type: text/html; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable






















dding=3D"0" cellspacing=3D"0" class=3D"email" style=3D"background:#f7f7f7 !=

important;width:100%" bgcolor=3D"#ffffff">


ft:0;padding-bottom:30px;padding-right:0;margin:0 auto;max-width:100%">
le cellpadding=3D"0" cellspacing=3D"0" bgcolor=3D"#f7f7f7" style=3D"width:1=

00%;margin:0 auto;background-color:#f7f7f7">





o;max-width:640px">




ing-alt:0px 0px 0px 0px" bgcolor=3D"transparent">

tion ck-padding-left-none ck-padding-right-none" style=3D"padding:0px 0px 0=

px 0px">
<=

table width=3D"100%" border=3D"0" cellspacing=3D"0" cellpadding=3D"0" style=

=3D"text-align:center;table-layout:fixed;float:none" class=3D"email-image">=


tom:12px;margin-left:0;margin-right:0;max-width:100%;width:100%">
=3D"display:block" href=3D"https://click.convertkit-mail2.com/o8up4z8qrdcqh=

6ggg20hvhq4dm8rrcohq2ex4/z2hghnheexewlosp/aHR0cHM6Ly9idWZmLmx5L2RFZHNEeXE=

=3D" target=3D"_blank" rel=3D"noopener noreferrer" class=3D"kit-image-link"=

url-id=3D"1797030055">
1.s3.amazonaws.com/WellHeater.png" width=3D"100%" height=3D"auto" style=3D"=

display:block;border-radius:0px 0px 0px 0px;width:100%;height:auto;object-f=

it:contain">
nk" rel=3D"noopener noreferrer" class=3D"kit-image-link" url-id=3D"17970300=

56">
Comfort.png" width=3D"100%" height=3D"auto" style=3D"display:block;border-r=

adius:0px 0px 0px 0px;width:100%;height:auto;object-fit:contain">
re>


















--000000000000f37e5b064174f94d--

Smart TV Phish from Google Gmail

Posted by Dave Yadallee on
Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Sat, 18 Oct 2025 17:13:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vAG64-00000000IvQ-0mR7

for dave@doctor.nl2k.ab.ca;

Sat, 18 Oct 2025 17:12:24 -0600

Resent-From: The Doctor

Resent-Date: Sat, 18 Oct 2025 17:12:24 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-ua1-f72.google.com ([209.85.222.72]:49312)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vADpC-000000006da-0uJG

for doctor@netknow.ca;

Sat, 18 Oct 2025 14:46:57 -0600

Received: by mail-ua1-f72.google.com with SMTP id a1e0cc1a2514c-930bc148794so1073469241.2

for ; Sat, 18 Oct 2025 13:46:03 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=firebaseapp.com; s=20230601; t=1760820357; x=1761425157; darn=netknow.ca;

h=to:from:subject:date:message-id:mime-version:from:to:cc:subject

:date:message-id:reply-to;

bh=tFp9Uj6d/ivQIaMQCH6spk5uqiBXn4Bwabc2gnHgXX4=;

b=akQsqdkMqGuynHJB7/QQdxLBUUipJ3/SAr9b09+yaqYd/H9VcDA+PflZw+VsM9Khd9

o0mG78SbP2Hju6zNpmrSICEaHDsyTiQNe4MiLR+gwfhm6ZWIAsjlIuU10Onax0tG+YlI

4Tihenr6q4BR6aAC6OHBlJ3j1N1jN7IclrR79qcGhlssbZKeW1Voziyp7TDqSDhkbtbD

UrMbsGg5a32edSzitDtt2+OpqP7qp+3Nyi/QTMdABlwP5XAYWO49DO4PAH16BmBMdVnv

KPzBBXeWojjulhwps9KaQXb8Gt7FdHmuUqQEIquzfsnam20RpbkeBuJiQie/2MS2bGY9

2nEA==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20230601; t=1760820357; x=1761425157;

h=to:from:subject:date:message-id:mime-version:x-gm-message-state

:from:to:cc:subject:date:message-id:reply-to;

bh=tFp9Uj6d/ivQIaMQCH6spk5uqiBXn4Bwabc2gnHgXX4=;

b=kpn9rysl+WN5yo89UmvopUbKVj5svRGIbXCnat3XRB8H02v/LpHOOkU4o94puivsNm

lpZHWNkcxbyzzXTLz3MbiFQHSKSWs7kKUl2mH5iPiHca753Er7nqey3LunpkYV8phMJH

TZZUwhYaYXDuKsdvViPaJ+aBHws7C56Yzm1qBqbCuvoG9HBzjiuslHV2uruuYrSJ25ZI

Ha3z9h+7N6rHqhK+5T157mwgbnjYWpfHscqfGxihPkUo3Vmumjk9O99UTfBWpQujJql6

kvb33Ff9ia7vKeq2V8IYRee4bjcJrKpQpqHDk3fdUMjEbaegFp5URfXSjuzBDjJgpb+q

mZzA==

X-Gm-Message-State: AOJu0Yx76BK+ld8dpZxnetqDpVkSV+LbklCg70e1aBw4RROy5ZGnpnjp

hdJrytTlQK7qD+cJPifVOW5funyfX+UeHReu93GgUc/j8xGiZK46+H8AqD0NK9bk+Xud3A1oKjJ

RxjsU8XU77Q==

X-Google-Smtp-Source: AGHT+IHPpNdq92nDYOXfkqcWuWrH6XQxLAwm5cTezOdwHHo6rA5G5eikEgDyyKz/ITGAlWrdYn1qN07HvE+X4Xk=

MIME-Version: 1.0

X-Received: by 2002:a05:6102:304a:b0:5d6:18cc:6087 with SMTP id

ada2fe7eead31-5d7dd6d67e3mr2340371137.30.1760820356896; Sat, 18 Oct 2025

13:45:56 -0700 (PDT)

Message-ID: <000000000000e2da63064174efd8@google.com>

Date: Sat, 18 Oct 2025 20:45:56 +0000

Subject: =?UTF-8?Q?=E2=9A=A1_Turn_your_TV_into_a_Smart_TV_=2D_Flixy_Special_Off?=

=?UTF-8?Q?er=21?=

From: Your Smart TV partner

To: doctor@netknow.ca

Content-Type: multipart/alternative; boundary="000000000000e2da4c064174efd5"

X-Spam_score: 8.3

X-Spam_score_int: 83

X-Spam_bar: ++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview:



Content analysis details: (8.3 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

2.3 EMPTY_MESSAGE Message appears to have no textual parts and no

Subject: text

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[209.85.222.72 listed in will-spam-for-food.eu.org]

[209.85.222.72 listed in will-spam-for-food.eu.org]

[209.85.222.72 listed in will-spam-for-food.eu.org]

[209.85.222.72 listed in will-spam-for-food.eu.org]

[209.85.222.72 listed in will-spam-for-food.eu.org]

[209.85.222.72 listed in will-spam-for-food.eu.org]

[209.85.222.72 listed in will-spam-for-food.eu.org]

[209.85.222.72 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[209.85.222.72 listed in dnsbl.ahbl.org]

[209.85.222.72 listed in dnsbl.ahbl.org]

[209.85.222.72 listed in dnsbl.ahbl.org]

[209.85.222.72 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[209.85.222.72 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[209.85.222.72 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[209.85.222.72 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[209.85.222.72 listed in dnsbl.ahbl.org]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[209.85.222.72 listed in list.dnswl.org]

0.1 URIBL_SBL_A Contains URL's A record listed in the SBL blocklist

[URI: click.convertkit-mail2.com/18.220.225.51]

[URI: click.convertkit-mail2.com/3.18.56.123]

[URI: click.convertkit-mail2.com/3.141.222.179]

0.0 RCVD_IN_VALIDITY_CERTIFIED_BLOCKED RBL: ADMINISTRATOR NOTICE: The

query to Validity was blocked. See

https://knowledge.validity.com/hc/en-us/articles/20961730681243

for more information.

[209.85.222.72 listed in sa-trusted.bondedsender.org]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

0.0 RCVD_IN_VALIDITY_SAFE_BLOCKED RBL: ADMINISTRATOR NOTICE: The query to

Validity was blocked. See

https://knowledge.validity.com/hc/en-us/articles/20961730681243

for more information.

[209.85.222.72 listed in sa-accredit.habeas.com]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[209.85.222.72 listed in wl.mailspike.net]

-0.0 SPF_PASS SPF: sender matches SPF record

-0.1 DKIM_VALID Message has at least one valid DKIM or DK signature

0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid

0.3 SPECIAL_OFFER BODY: Special Offer

0.0 RCVD_IN_VALIDITY_RPBL_BLOCKED RBL: ADMINISTRATOR NOTICE: The query to

Validity was blocked. See

https://knowledge.validity.com/hc/en-us/articles/20961730681243

for more information.

[209.85.222.72 listed in bl.score.senderscore.com]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[209.85.222.72 listed in bl.score.senderscore.com]

0.0 MIME_HTML_MOSTLY BODY: Multipart message mostly text/html MIME

0.0 HTML_MESSAGE BODY: HTML included in message

0.7 MPART_ALT_DIFF BODY: HTML and text parts are different

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

1.0 VOWEL_URI_5 URI hostname with 5 consecutive vowels

0.0 T_REMOTE_IMAGE Message contains an external image

2.7 RCVD_IN_PSBL RBL: Received via a relay in PSBL

[209.85.222.72 listed in psbl.surriel.com]

Subject: {SPAM?} =?UTF-8?Q?=E2=9A=A1_Turn_your_TV_into_a_Smart_TV_=2D_Flixy_Special_Off?=

=?UTF-8?Q?er=21?=



--000000000000e2da4c064174efd5

Content-Type: text/plain; charset="UTF-8"; format=flowed; delsp=yes



--000000000000e2da4c064174efd5

Content-Type: text/html; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable






















dding=3D"0" cellspacing=3D"0" class=3D"email" style=3D"background:#f7f7f7 !=

important;width:100%" bgcolor=3D"#ffffff">


ft:0;padding-bottom:30px;padding-right:0;margin:0 auto;max-width:100%">
le cellpadding=3D"0" cellspacing=3D"0" bgcolor=3D"#f7f7f7" style=3D"width:1=

00%;margin:0 auto;background-color:#f7f7f7">





o;max-width:640px">




ing-alt:0px 0px 0px 0px" bgcolor=3D"transparent">

tion ck-padding-left-none ck-padding-right-none" style=3D"padding:0px 0px 0=

px 0px">
<=

table width=3D"100%" border=3D"0" cellspacing=3D"0" cellpadding=3D"0" style=

=3D"text-align:center;table-layout:fixed;float:none" class=3D"email-image">=


tom:12px;margin-left:0;margin-right:0;max-width:100%;width:100%">
=3D"display:block" href=3D"https://click.convertkit-mail2.com/o8up4z8qrdcqh=

6ggg20hvhq4dm8rrcohq2ex4/z2hghnheexewlosp/aHR0cHM6Ly9idWZmLmx5L2RFZHNEeXE=

=3D" target=3D"_blank" rel=3D"noopener noreferrer" class=3D"kit-image-link"=

url-id=3D"1797030055">
1.s3.amazonaws.com/WellHeater.png" width=3D"100%" height=3D"auto" style=3D"=

display:block;border-radius:0px 0px 0px 0px;width:100%;height:auto;object-f=

it:contain">
nk" rel=3D"noopener noreferrer" class=3D"kit-image-link" url-id=3D"17970300=

56">
Comfort.png" width=3D"100%" height=3D"auto" style=3D"display:block;border-r=

adius:0px 0px 0px 0px;width:100%;height:auto;object-fit:contain">
re>


















--000000000000e2da4c064174efd5--

Popmart exclusive offers phish from Google Gmail

Posted by Dave Yadallee on
Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Sat, 18 Oct 2025 13:15:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vACNt-00000000Do0-1vXc

for dave@doctor.nl2k.ab.ca;

Sat, 18 Oct 2025 13:14:33 -0600

Resent-From: The Doctor

Resent-Date: Sat, 18 Oct 2025 13:14:33 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-ua1-f69.google.com ([209.85.222.69]:58692)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vAAjP-000000004Sh-3v52

for sales@nk.ca;

Sat, 18 Oct 2025 11:28:46 -0600

Received: by mail-ua1-f69.google.com with SMTP id a1e0cc1a2514c-932ca066facso187239241.1

for ; Sat, 18 Oct 2025 10:27:53 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=firebaseapp.com; s=20230601; t=1760808467; x=1761413267; darn=nk.ca;

h=to:from:subject:date:message-id:mime-version:from:to:cc:subject

:date:message-id:reply-to;

bh=ib+gZ52XpwikEwMloBEexRIUJuW29528jnZqkYDW23k=;

b=jAu9arX84XrF/R/c6pHQb9zSP5LoBS3pzCKohIPayzIWiv4BJHc12ILOTnUc9VtwR6

Do1aYr0ZVRBJtJkOX7hx2ctYfXh1Jle414ySXo6i5ivUhdquy099awnSnv6PQPhcRgtC

KSud250uLtGfaLCX6WsA0b+3hKT8xvbH89LEPuZq9aYAandX85XxB71RvQ6CyB2v3n0w

q9Cl1BpgkWnfds16vjkQKgmKCi9XBUae2/elFYvfQxbAZ0z6uKuKg1c/vnUhwfq2+fZs

6FLgsHZjoEMECifUfHxppUuFmsrpseIwRlOaMVTzjAmjIhCS3h7d5oYgySZCY+iFE98E

X0bQ==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20230601; t=1760808467; x=1761413267;

h=to:from:subject:date:message-id:mime-version:x-gm-message-state

:from:to:cc:subject:date:message-id:reply-to;

bh=ib+gZ52XpwikEwMloBEexRIUJuW29528jnZqkYDW23k=;

b=hSxTQH726/TNHy9ajvX8WN/PVIah6PG0zUf+xee+Thfjmi2LR5y3LqNqOAdbJK+y2O

ANQggYhYtqgUf1hGBXe/NvLkhy/tzVKxqqPqOhTl+V/HVbgnFvGK3u3Gg00nTNWEZuiB

WqYBJYtsmwI/enMWz5a2JZS1/cVhj12K8E7Edkv5bEayq5zpMUxQnLqB/iG9nL/TnQiu

rl86fWSLAU8i7jAEpn2x/9VYYDN1mzLOA0RyvIfKkGA+6Uccm0fZOdnjrXIEYAAx89YR

opBuJacC242RjYS0mNt+MBQiweIAdSX71xiOKAskTdz11zcm6MRwBvyzxzaAl+WMhT3P

LLHw==

X-Gm-Message-State: AOJu0YwFULgy/Q6j+EBEU33bFzgNHigJZotkTANM5zmywTBTMCdnv8Xn

AParhtl8RT5Y20YGvvhNxM76tsMjd012wNU8tV/hl0AV7IzH1XK8ETCT+ITK0mkaPmZuXKXq878

z6SB9R7wRVA==

X-Google-Smtp-Source: AGHT+IHOVsrkS2fwiSstyUGlfSxkc+VvahNrsqdpakKqZgU4Rka3lJBnre6/okIPWKkmwNDVn5ML8uJaelfyBTc=

MIME-Version: 1.0

X-Received: by 2002:a05:6122:1d44:b0:54a:dcde:fa5b with SMTP id

71dfb90a1353d-5564ef630f6mr2345494e0c.12.1760808467372; Sat, 18 Oct 2025

10:27:47 -0700 (PDT)

Message-ID: <0000000000003719fa0641722bf9@google.com>

Date: Sat, 18 Oct 2025 17:27:47 +0000

Subject: =?UTF-8?Q?=F0=9F=8E=81_Congratulations=21_You=E2=80=99ve_Been_Chosen_for_an_Ex?=

=?UTF-8?Q?clusive_Macaron_Monsters_Offer=21?=

From: Popmart Exclusive Offers

To: sales@nk.ca

Content-Type: multipart/alternative; boundary="0000000000003719e80641722bf6"



--0000000000003719e80641722bf6

Content-Type: text/plain; charset="UTF-8"; format=flowed; delsp=yes



View in Browser











--0000000000003719e80641722bf6

Content-Type: text/html; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable






osoft-com:office:office" lang=3D"en">





Say Goodbye to Foot Pain . Comfort Starts Today!




=3D1.0">


"stylesheet" type=3D"text/css">








: 0; -webkit-text-size-adjust: none; text-size-adjust: none;">


" cellspacing=3D"0" role=3D"presentation" style=3D"mso-table-lspace: 0pt; m=

so-table-rspace: 0pt; background-color: #ffffff;">














" cellpadding=3D"0" cellspacing=3D"0" role=3D"presentation" style=3D"mso-ta=

ble-lspace: 0pt; mso-table-rspace: 0pt;">














ellpadding=3D"0" cellspacing=3D"0" role=3D"presentation" style=3D"mso-table=

-lspace: 0pt; mso-table-rspace: 0pt; border-radius: 0; color: #000000; widt=

h: 660px; margin: 0 auto;" width=3D"660">












-lspace: 0pt; mso-table-rspace: 0pt; font-weight: 400; text-align: left; pa=

dding-bottom: 5px; padding-top: 5px; vertical-align: top;">


=3D"0" cellpadding=3D"10" cellspacing=3D"0" role=3D"presentation" style=3D"=

mso-table-lspace: 0pt; mso-table-rspace: 0pt;">










t-family: Montserrat, Trebuchet MS, Lucida Grande, Lucida Sans Unicode, Luc=

ida Sans, Tahoma, sans-serif; font-size: 14px; font-weight: 700; letter-spa=

cing: normal; line-height: 1.2; text-align: center; margin-top: 0; margin-b=

ottom: 0; mso-line-height-alt: 17px;">
tyle=3D"word-break: break-word;">
com/gkumg9r35os5hl66mrkcrh8dxm699bmho4ng2/reh8hohmmzqx7kt2/aHR0cHM6Ly9idWZm=

Lmx5L1VMVWZlWDM=3D" target=3D"_blank" style=3D"text-decoration: none; color=

: #e70a0a;" rel=3D"noopener">
" style=3D"word-break: break-word; position: relative;" id=3D"95e3830b-1193=

-4f62-a0ed-6362d6f281f9" data-position=3D"10-0-0" data-qa=3D"tinyeditor-roo=

t-element">
ord;">View in Browser



0" cellpadding=3D"0" cellspacing=3D"0" role=3D"presentation" style=3D"mso-t=

able-lspace: 0pt; mso-table-rspace: 0pt;">








ing-left:0px;">




ef=3D"https://click.convertkit-mail2.com/gkumg9r35os5hl66mrkcrh8dxm699bmho4=

ng2/reh8hohmmzqx7kt2/aHR0cHM6Ly9idWZmLmx5L1VMVWZlWDM=3D" target=3D"_blank">=


10d5bda/68f3cacf7f9c467c1803b6cc/84f27794b77a771f1f42402e762b9d3b.original.=

png" style=3D"display: block; height: auto; border: 0; width: 100%;" width=

=3D"627" alt title height=3D"auto">










--0000000000003719e80641722bf6--

Popmart exclusive offers phish from Google Gmail

Posted by Dave Yadallee on
Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Sat, 18 Oct 2025 13:15:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vACNa-00000000Dml-3oKE

for dave@doctor.nl2k.ab.ca;

Sat, 18 Oct 2025 13:14:14 -0600

Resent-From: The Doctor

Resent-Date: Sat, 18 Oct 2025 13:14:14 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-ua1-f69.google.com ([209.85.222.69]:56500)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vAAgM-000000004EI-3TQF

for doctor@nk.ca;

Sat, 18 Oct 2025 11:25:37 -0600

Received: by mail-ua1-f69.google.com with SMTP id a1e0cc1a2514c-932ce8647b0so621811241.0

for ; Sat, 18 Oct 2025 10:24:44 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=firebaseapp.com; s=20230601; t=1760808278; x=1761413078; darn=nk.ca;

h=to:from:subject:date:message-id:mime-version:from:to:cc:subject

:date:message-id:reply-to;

bh=W0TDWuTis6WDF2ypLaFmG5Sp/wwCmd81bqgcyHOqjdY=;

b=iePwCVUA3Ny6wJVvRYQ0w7UzMnp3jJERkJQnsRFITTu/uoWbl+rGTx4wLMRGrnh/mK

LvXQ5UzeT/qRkfAGtd3p+OOVLNgDqNe3HvFyAYSqK1dh4397wNDh8dJCrMy7fXVdLq4r

+/IgkslQOvAYiReDLenhiVtRwZd5oGeN3FJeCeVnOQnnEbSs3CzOAna9HjymE+/YTM1R

E22JStaZXElui9wV97pWsR28cZSE1e48zynJUYQsBbNI74Yb1TIKoWUayQgsVH6Vpwmi

Cwtsa//ICvWs7S8iyebrDTovOv6wgcvcxRT4hxI5erS7iNZSi/6T5dj5fQSbileB+zT6

13hw==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20230601; t=1760808278; x=1761413078;

h=to:from:subject:date:message-id:mime-version:x-gm-message-state

:from:to:cc:subject:date:message-id:reply-to;

bh=W0TDWuTis6WDF2ypLaFmG5Sp/wwCmd81bqgcyHOqjdY=;

b=n6n3WlhZ0uQH5AB/mSCXie5Qqz2C5kLMGp3cPeV3SHifAnpTpdc5ZY4D1ckChVbSTY

Ujxstx8mj4iBpNfBwqhxw50LZdk7NGR4an6wcJwKBrCLwGkvsxDneIBZxhHJpDUA/VLO

piY4Q4p4zyF8V9UTzjlGfzqVlURmOITuwU0G+Fak3AJoHqhWD3KinPW+J9WfLJFDfufl

9xN7znLzLWdfwU2KE/IrtKmpq6nDO4hSStE7hoiFb13Crtx2zh8+8hm9w8gvAJsZMMUZ

K9N1QZVZQ/ZqTcQXBlVRSCh6k6Up38HGU50+ud+xtO7nO4uE2UXW48Hf8jRnRSCf8abF

/r9g==

X-Gm-Message-State: AOJu0YxgcpCoxiRTaBEHGUT3pqoQ4zt4IOGmD1NTorM8VNkDLZ/TilsV

n54EvhuWsqBceqxoJcEcNWd1szkZlNxPRGBxP6sSESFlIpUHnWnmZ4L/TDm4K6uLXHRzCKz1wxJ

cMjKuYcVqkg==

X-Google-Smtp-Source: AGHT+IEwY5nFmA08/o0KoXvmVjHdrt8u46xklrbWx6UMMtGhIjLtO+wqYmp7kWOIh5DO1BGU9n4p6/r4zrglIso=

MIME-Version: 1.0

X-Received: by 2002:a05:6102:c89:b0:5d5:f6ae:38fa with SMTP id

ada2fe7eead31-5d7dd62020dmr2965418137.39.1760808278547; Sat, 18 Oct 2025

10:24:38 -0700 (PDT)

Message-ID: <000000000000f5dca40641721f19@google.com>

Date: Sat, 18 Oct 2025 17:24:38 +0000

Subject: =?UTF-8?Q?=F0=9F=8E=81_Congratulations=21_You=E2=80=99ve_Been_Chosen_for_an_Ex?=

=?UTF-8?Q?clusive_Macaron_Monsters_Offer=21?=

From: Popmart Exclusive Offers

To: doctor@nk.ca

Content-Type: multipart/alternative; boundary="000000000000f5dc9c0641721f16"

X-Spam_score: 6.7

X-Spam_score_int: 67

X-Spam_bar: ++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: View in Browser Say Goodbye to Foot Pain . Comfort Starts

Today! View in Browser



Content analysis details: (6.7 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[209.85.222.69 listed in list.dnswl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[209.85.222.69 listed in will-spam-for-food.eu.org]

[209.85.222.69 listed in will-spam-for-food.eu.org]

[209.85.222.69 listed in will-spam-for-food.eu.org]

[209.85.222.69 listed in will-spam-for-food.eu.org]

[209.85.222.69 listed in will-spam-for-food.eu.org]

[209.85.222.69 listed in will-spam-for-food.eu.org]

[209.85.222.69 listed in will-spam-for-food.eu.org]

[209.85.222.69 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[209.85.222.69 listed in dnsbl.ahbl.org]

[209.85.222.69 listed in dnsbl.ahbl.org]

[209.85.222.69 listed in dnsbl.ahbl.org]

[209.85.222.69 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[209.85.222.69 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[209.85.222.69 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[209.85.222.69 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[209.85.222.69 listed in dnsbl.ahbl.org]

0.1 URIBL_SBL_A Contains URL's A record listed in the SBL blocklist

[URI: click.convertkit-mail2.com/18.220.225.51]

[URI: click.convertkit-mail2.com/3.18.56.123]

[URI: click.convertkit-mail2.com/3.141.222.179]

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[209.85.222.69 listed in wl.mailspike.net]

-0.0 SPF_PASS SPF: sender matches SPF record

-0.1 DKIM_VALID Message has at least one valid DKIM or DK signature

0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid

1.0 ADDR_OFFER From address contains OFFER

0.0 MIME_HTML_MOSTLY BODY: Multipart message mostly text/html MIME

0.0 HTML_MESSAGE BODY: HTML included in message

0.8 HTML_IMAGE_RATIO_02 BODY: HTML has a low ratio of text to image area

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 T_REMOTE_IMAGE Message contains an external image

Subject: {SPAM?} =?UTF-8?Q?=F0=9F=8E=81_Congratulations=21_You=E2=80=99ve_Been_Chosen_for_an_Ex?=

=?UTF-8?Q?clusive_Macaron_Monsters_Offer=21?=



--000000000000f5dc9c0641721f16

Content-Type: text/plain; charset="UTF-8"; format=flowed; delsp=yes



View in Browser











--000000000000f5dc9c0641721f16

Content-Type: text/html; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable






osoft-com:office:office" lang=3D"en">





Say Goodbye to Foot Pain . Comfort Starts Today!




=3D1.0">


"stylesheet" type=3D"text/css">








: 0; -webkit-text-size-adjust: none; text-size-adjust: none;">


" cellspacing=3D"0" role=3D"presentation" style=3D"mso-table-lspace: 0pt; m=

so-table-rspace: 0pt; background-color: #ffffff;">














" cellpadding=3D"0" cellspacing=3D"0" role=3D"presentation" style=3D"mso-ta=

ble-lspace: 0pt; mso-table-rspace: 0pt;">














ellpadding=3D"0" cellspacing=3D"0" role=3D"presentation" style=3D"mso-table=

-lspace: 0pt; mso-table-rspace: 0pt; border-radius: 0; color: #000000; widt=

h: 660px; margin: 0 auto;" width=3D"660">












-lspace: 0pt; mso-table-rspace: 0pt; font-weight: 400; text-align: left; pa=

dding-bottom: 5px; padding-top: 5px; vertical-align: top;">


=3D"0" cellpadding=3D"10" cellspacing=3D"0" role=3D"presentation" style=3D"=

mso-table-lspace: 0pt; mso-table-rspace: 0pt;">










t-family: Montserrat, Trebuchet MS, Lucida Grande, Lucida Sans Unicode, Luc=

ida Sans, Tahoma, sans-serif; font-size: 14px; font-weight: 700; letter-spa=

cing: normal; line-height: 1.2; text-align: center; margin-top: 0; margin-b=

ottom: 0; mso-line-height-alt: 17px;">
tyle=3D"word-break: break-word;">
com/gkumg9r35os5hl66mrkcrh8dxm699bmho4ng2/reh8hohmmzqx7kt2/aHR0cHM6Ly9idWZm=

Lmx5L1VMVWZlWDM=3D" target=3D"_blank" style=3D"text-decoration: none; color=

: #e70a0a;" rel=3D"noopener">
" style=3D"word-break: break-word; position: relative;" id=3D"95e3830b-1193=

-4f62-a0ed-6362d6f281f9" data-position=3D"10-0-0" data-qa=3D"tinyeditor-roo=

t-element">
ord;">View in Browser



0" cellpadding=3D"0" cellspacing=3D"0" role=3D"presentation" style=3D"mso-t=

able-lspace: 0pt; mso-table-rspace: 0pt;">








ing-left:0px;">




ef=3D"https://click.convertkit-mail2.com/gkumg9r35os5hl66mrkcrh8dxm699bmho4=

ng2/reh8hohmmzqx7kt2/aHR0cHM6Ly9idWZmLmx5L1VMVWZlWDM=3D" target=3D"_blank">=


10d5bda/68f3cacf7f9c467c1803b6cc/84f27794b77a771f1f42402e762b9d3b.original.=

png" style=3D"display: block; height: auto; border: 0; width: 100%;" width=

=3D"627" alt title height=3D"auto">










--000000000000f5dc9c0641721f16--

Cloud credentials phishing from Google Gmail

Posted by Dave Yadallee on
Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Sat, 18 Oct 2025 13:15:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vACNM-00000000Dlp-3gkf

for dave@doctor.nl2k.ab.ca;

Sat, 18 Oct 2025 13:14:00 -0600

Resent-From: The Doctor

Resent-Date: Sat, 18 Oct 2025 13:14:00 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-ua1-f72.google.com ([209.85.222.72]:43153)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vAAYv-000000003WV-0iuB

for sales@nk.ca;

Sat, 18 Oct 2025 11:17:57 -0600

Received: by mail-ua1-f72.google.com with SMTP id a1e0cc1a2514c-8f7f2a191ccso7745716241.0

for ; Sat, 18 Oct 2025 10:17:01 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=firebaseapp.com; s=20230601; t=1760807815; x=1761412615; darn=nk.ca;

h=to:from:subject:date:message-id:mime-version:from:to:cc:subject

:date:message-id:reply-to;

bh=I3s4YP1UHzT2lklnjGgEDtqRTKazX4Bj7Twe6oMnWVE=;

b=RuKBYbU9OBeUBfDPSG/wAF4IYMQ1RL0nh6hzwYOPW71kRTmn+ebdIzsQEJF4o4vROc

FL2EIVDLpx7JT08fCDKyKFYds5JLzlGENVLTAUvD6OcKhWYYR+A/mjqC+DS+wQhFAZFi

x7baBGFac8tOuni/q/ZlytmNcJ+sylkXXlDiC8GOEdkNZBeiuBY1vPfe+X66DX2/L4/k

51s2H17ElHAN/4enOeuStz7P9Y++TXI/bMn1vsEXp4batjcQIU52B1q7yrnAM2H31kaq

FPo82W2ZR0KQrHOKBiPIWpdAYwj3125WjfgscwnkrS+Thqaf08DEnk2QtoEzkYFHnFH8

f/rQ==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20230601; t=1760807815; x=1761412615;

h=to:from:subject:date:message-id:mime-version:x-gm-message-state

:from:to:cc:subject:date:message-id:reply-to;

bh=I3s4YP1UHzT2lklnjGgEDtqRTKazX4Bj7Twe6oMnWVE=;

b=g6JlOd7mdvBhXv8DTLcSmCObVpzlyjHURInAMxzLCdq/j46y8tLCgZCGD5n6GHscnx

EZVtGkAI5eU67aSOhY+Cu9UE5MU5jj7rGZfpljnS9Ffisz6YkDhdCdg9B1KG9COPxqTz

CoAyskpY3dtvLhryQTyEL6DoIVcxAO4lnEriJge97QtSc8SD8hrwh0pihxcMk1SWxVRQ

1KIz1B+dHtOydOYtZ93mSQXTpabbKaJri44pbesoVKayzKFy1kZ50Luu+ByzdmgbVknC

G8QWRcx90qvcE5DebTxZoD9hvrcjSnYMhFqEBQFxkwiBurIdsnDaNn/qEnx13iqp3F4j

n/bw==

X-Gm-Message-State: AOJu0YwGoRxATbJzm8BTRJE9ctb99jjfEy4gcIeT2YsvlZuV3wgGxOaW

9sAY/YdhxHQWJVE4RNmwehm5EZL1GCAqL85hSr+iQdT4iERnGOR8YXhwO3D+pCFlxtt1nkIgLRf

sk2jFa8UN3Q==

X-Google-Smtp-Source: AGHT+IEpCbGTx0eradZPftiY+M1kebax68xWQMno+K2YCI+Vnviz2M6csxdjUQdO4WNoJMiB52SvmkekHdmLWY8=

MIME-Version: 1.0

X-Received: by 2002:a67:e096:0:b0:5d5:f6ae:3902 with SMTP id

ada2fe7eead31-5d7ce7be166mr3236440137.19.1760807815736; Sat, 18 Oct 2025

10:16:55 -0700 (PDT)

Message-ID: <0000000000005fef650641720447@google.com>

Date: Sat, 18 Oct 2025 17:16:55 +0000

Subject: Reset your password for mcgj-b5d2e

From: noreply@mcgj-b5d2e.firebaseapp.com

To: sales@nk.ca

Content-Type: multipart/alternative; boundary="0000000000005fef5a0641720444"



--0000000000005fef5a0641720444

Content-Type: text/plain; charset="UTF-8"; format=flowed; delsp=yes



Hello,



Follow this link to reset your mcgj-b5d2e password for your sales@nk.ca

account.



https://mcgj-b5d2e.firebaseapp.com/__/auth/action?mode=resetPassword&oobCode=zYjudfmi47SaohM6JJs47gi3irozXgU8NNlMb-v8ZlYAAAGZ-FMI8A&apiKey=AIzaSyDNxvkQAlGvZb4c8hVPP5vOs4HNjzV0DJU&lang=en



If you didn't ask to reset your password, you can ignore this email.



Thanks,



Your mcgj-b5d2e team



--0000000000005fef5a0641720444

Content-Type: text/html; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable



Hello,



Follow this link to reset your mcgj-b5d2e password for your sales@nk.ca =

account.




tPassword&oobCode=3DzYjudfmi47SaohM6JJs47gi3irozXgU8NNlMb-v8ZlYAAAGZ-FM=

I8A&apiKey=3DAIzaSyDNxvkQAlGvZb4c8hVPP5vOs4HNjzV0DJU&lang=3Den'>htt=

ps://mcgj-b5d2e.firebaseapp.com/__/auth/action?mode=3DresetPassword&oob=

Code=3DzYjudfmi47SaohM6JJs47gi3irozXgU8NNlMb-v8ZlYAAAGZ-FMI8A&apiKey=3D=

AIzaSyDNxvkQAlGvZb4c8hVPP5vOs4HNjzV0DJU&lang=3Den



If you didn=E2=80=99t ask to reset your password, you can ignore this em=

ail.



Thanks,



Your mcgj-b5d2e team



--0000000000005fef5a0641720444--

Popmart exclusive offers phish from Google Gmail

Posted by Dave Yadallee on
Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Sat, 18 Oct 2025 13:15:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vACNW-00000000DmR-0zB9

for dave@doctor.nl2k.ab.ca;

Sat, 18 Oct 2025 13:14:10 -0600

Resent-From: The Doctor

Resent-Date: Sat, 18 Oct 2025 13:14:10 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-vs1-f71.google.com ([209.85.217.71]:43467)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vAAfl-000000004Bd-0Uvx

for doctor@nl2k.ab.ca;

Sat, 18 Oct 2025 11:25:00 -0600

Received: by mail-vs1-f71.google.com with SMTP id ada2fe7eead31-5b431158f27so7096887137.1

for ; Sat, 18 Oct 2025 10:24:06 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=firebaseapp.com; s=20230601; t=1760808240; x=1761413040; darn=nl2k.ab.ca;

h=to:from:subject:date:message-id:mime-version:from:to:cc:subject

:date:message-id:reply-to;

bh=JiMuIzxubJGG4aQDIyVdg/aQl4Qhhy5Zsc3fi3BUqFk=;

b=KS4UsSvbxOdh15lLBlHE4IzWaLfixmd7KYwfNrcDMbXGQGPqcyRvWnhr/bEQ5my4yS

vUqCVDnatwVAT3FHlx2/c+2uEOq408pNvcdSV6KTeAtB6ynu/ENgNNyu2508ovef/aAS

lzKFX9tZ9ysYgP48N9zd4t7W9kgHS9klTICpUpoX7neTrd5f0ijm4K0VG42EGZy341Sp

yGdhGiBaTtJHY4R6DPCUcERWZZEuoi9Z610t5BYIqKhy5lR9Aiaw7IBI4dcA7adjcgQA

LgkoFqx66MXHem/NadmlVrhfLzaSme4tfviyQIGrrRMu+hNXIWIPylQkhpGF8nyvUET3

KnVg==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20230601; t=1760808240; x=1761413040;

h=to:from:subject:date:message-id:mime-version:x-gm-message-state

:from:to:cc:subject:date:message-id:reply-to;

bh=JiMuIzxubJGG4aQDIyVdg/aQl4Qhhy5Zsc3fi3BUqFk=;

b=ST5bblsSG1CMByX/KrAiwi2UqQLqW84ZXQkhfj1hmSqOTGAx06pOgUXYtY3FIVsWe/

XzLlC/KR4KYBzZRfGAdKmLNtSgVutzdMnhm1EnDcvLEh3hiKvgauICp9XgMK2jrj0cmC

oFn1yIk7Bm/MtHpakCC4T2UqetYidgDVDJr7CxnxwUfwiw0l0LQzfrAzg/RxRv+1/i9l

COw2u43bucY2BJjaXXdn3/PC1mi544/HW0W/c86vvhSUKzZS+2p0JOPoN+j3S0ctNSLA

d+eDlLl48oHM9j1Og80/KchqjSy7ZHZJkJ9f5B2klUjOS2ve0gs8Q83ueI0bklrnHtZE

76pg==

X-Gm-Message-State: AOJu0YywfG/sdDnN7cLjltVirQB1A94vE61jEO9gEC3jAb/Rzrc2SecK

h7RNEYTqvF7H6R0NnB/ZjOnAhN4Jp4c+h9YkxApWUuTLt/JTy+UtNJlxAHSnE5ZNgQ6Jxha59eo

JEm20cFmD8w==

X-Google-Smtp-Source: AGHT+IG6y517h25IgfOuWS5yanpiSUjk6IPNMPtIzWRPHjsRydRZkKR417/gujHpl0AuFpDbWuRCYFkRjfQ61bw=

MIME-Version: 1.0

X-Received: by 2002:a05:6102:c54:b0:4e5:8d09:7b12 with SMTP id

ada2fe7eead31-5d7dd561de7mr3103665137.7.1760808240301; Sat, 18 Oct 2025

10:24:00 -0700 (PDT)

Message-ID: <000000000000ae48db0641721df6@google.com>

Date: Sat, 18 Oct 2025 17:24:00 +0000

Subject: =?UTF-8?Q?=F0=9F=8E=81_Congratulations=21_You=E2=80=99ve_Been_Chosen_for_an_Ex?=

=?UTF-8?Q?clusive_Macaron_Monsters_Offer=21?=

From: Popmart Exclusive Offers

To: doctor@nl2k.ab.ca

Content-Type: multipart/alternative; boundary="000000000000ae48ce0641721df3"

X-Spam_score: 6.7

X-Spam_score_int: 67

X-Spam_bar: ++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: View in Browser Say Goodbye to Foot Pain . Comfort Starts

Today! View in Browser



Content analysis details: (6.7 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[209.85.217.71 listed in list.dnswl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[209.85.217.71 listed in will-spam-for-food.eu.org]

[209.85.217.71 listed in will-spam-for-food.eu.org]

[209.85.217.71 listed in will-spam-for-food.eu.org]

[209.85.217.71 listed in will-spam-for-food.eu.org]

[209.85.217.71 listed in will-spam-for-food.eu.org]

[209.85.217.71 listed in will-spam-for-food.eu.org]

[209.85.217.71 listed in will-spam-for-food.eu.org]

[209.85.217.71 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[209.85.217.71 listed in dnsbl.ahbl.org]

[209.85.217.71 listed in dnsbl.ahbl.org]

[209.85.217.71 listed in dnsbl.ahbl.org]

[209.85.217.71 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[209.85.217.71 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[209.85.217.71 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[209.85.217.71 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[209.85.217.71 listed in dnsbl.ahbl.org]

0.1 URIBL_SBL_A Contains URL's A record listed in the SBL blocklist

[URI: click.convertkit-mail2.com/3.141.222.179]

[URI: click.convertkit-mail2.com/3.18.56.123]

[URI: click.convertkit-mail2.com/18.220.225.51]

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[209.85.217.71 listed in wl.mailspike.net]

-0.0 SPF_PASS SPF: sender matches SPF record

-0.1 DKIM_VALID Message has at least one valid DKIM or DK signature

0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid

1.0 ADDR_OFFER From address contains OFFER

0.0 MIME_HTML_MOSTLY BODY: Multipart message mostly text/html MIME

0.0 HTML_MESSAGE BODY: HTML included in message

0.8 HTML_IMAGE_RATIO_02 BODY: HTML has a low ratio of text to image area

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 T_REMOTE_IMAGE Message contains an external image

Subject: {SPAM?} =?UTF-8?Q?=F0=9F=8E=81_Congratulations=21_You=E2=80=99ve_Been_Chosen_for_an_Ex?=

=?UTF-8?Q?clusive_Macaron_Monsters_Offer=21?=



--000000000000ae48ce0641721df3

Content-Type: text/plain; charset="UTF-8"; format=flowed; delsp=yes



View in Browser











--000000000000ae48ce0641721df3

Content-Type: text/html; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable






osoft-com:office:office" lang=3D"en">





Say Goodbye to Foot Pain . Comfort Starts Today!




=3D1.0">


"stylesheet" type=3D"text/css">








: 0; -webkit-text-size-adjust: none; text-size-adjust: none;">


" cellspacing=3D"0" role=3D"presentation" style=3D"mso-table-lspace: 0pt; m=

so-table-rspace: 0pt; background-color: #ffffff;">














" cellpadding=3D"0" cellspacing=3D"0" role=3D"presentation" style=3D"mso-ta=

ble-lspace: 0pt; mso-table-rspace: 0pt;">














ellpadding=3D"0" cellspacing=3D"0" role=3D"presentation" style=3D"mso-table=

-lspace: 0pt; mso-table-rspace: 0pt; border-radius: 0; color: #000000; widt=

h: 660px; margin: 0 auto;" width=3D"660">












-lspace: 0pt; mso-table-rspace: 0pt; font-weight: 400; text-align: left; pa=

dding-bottom: 5px; padding-top: 5px; vertical-align: top;">


=3D"0" cellpadding=3D"10" cellspacing=3D"0" role=3D"presentation" style=3D"=

mso-table-lspace: 0pt; mso-table-rspace: 0pt;">










t-family: Montserrat, Trebuchet MS, Lucida Grande, Lucida Sans Unicode, Luc=

ida Sans, Tahoma, sans-serif; font-size: 14px; font-weight: 700; letter-spa=

cing: normal; line-height: 1.2; text-align: center; margin-top: 0; margin-b=

ottom: 0; mso-line-height-alt: 17px;">
tyle=3D"word-break: break-word;">
com/gkumg9r35os5hl66mrkcrh8dxm699bmho4ng2/reh8hohmmzqx7kt2/aHR0cHM6Ly9idWZm=

Lmx5L1VMVWZlWDM=3D" target=3D"_blank" style=3D"text-decoration: none; color=

: #e70a0a;" rel=3D"noopener">
" style=3D"word-break: break-word; position: relative;" id=3D"95e3830b-1193=

-4f62-a0ed-6362d6f281f9" data-position=3D"10-0-0" data-qa=3D"tinyeditor-roo=

t-element">
ord;">View in Browser



0" cellpadding=3D"0" cellspacing=3D"0" role=3D"presentation" style=3D"mso-t=

able-lspace: 0pt; mso-table-rspace: 0pt;">








ing-left:0px;">




ef=3D"https://click.convertkit-mail2.com/gkumg9r35os5hl66mrkcrh8dxm699bmho4=

ng2/reh8hohmmzqx7kt2/aHR0cHM6Ly9idWZmLmx5L1VMVWZlWDM=3D" target=3D"_blank">=


10d5bda/68f3cacf7f9c467c1803b6cc/84f27794b77a771f1f42402e762b9d3b.original.=

png" style=3D"display: block; height: auto; border: 0; width: 100%;" width=

=3D"627" alt title height=3D"auto">










--000000000000ae48ce0641721df3--

Web/SEO/App spam from Microsoft Outlook

Posted by Dave Yadallee on
Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Sat, 18 Oct 2025 13:15:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vACNg-00000000Dn2-1ZYr

for dave@doctor.nl2k.ab.ca;

Sat, 18 Oct 2025 13:14:20 -0600

Resent-From: The Doctor

Resent-Date: Sat, 18 Oct 2025 13:14:20 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-japanwestazolkn19011012.outbound.protection.outlook.com ([52.103.66.12]:18641 helo=OS0P286CU010.outbound.protection.outlook.com)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vAAhg-000000004KK-3yGO

for root@nk.ca;

Sat, 18 Oct 2025 11:27:04 -0600

ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none;

b=rgIBPGRyDDmtHKsL4LqKhSysCkJarL5zRkl+710WkWsVzyd4tbMSJD4KCS5Vjcw4IIhbhOe8zwnw3skcWEyJfTG2FlL7WZGITdpb6Unn2MzXoDvCAGkAcPUqOnqkx1fszIdrMQJUAo4E6BbKAybXapforeCSLu65fnYJ87YwyKTa+K9MO+PCMknA9RpUYBTCGhsb/u0XyA6JmDKHloQ7XE0sLSRruBBsOXVSVHMwfikCql++3YJXb61puOQQ0q35My8SoA/XCAL4HhnCWc1SdAxCShnKbGE1c4fvtpLdbTRFoWtAqyCFU1zq1rJiV2xaXydt2QTqRKuKakpDB7T+/g==

ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;

s=arcselector10001;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1;

bh=7lbLbx2w+e5oHkK7cjHXejZfjGev3RURRQ2rqDAfiX0=;

b=vscPbvJJT/4izXsdPe8xTJjgN+ypMTOk2+IzVlK1iXqvDKOPAnX1f6ll/FEAqDpEgHteXFTr4lcK9jgfRzbG6q6MRz6BFH1WslvHKAa3+XIljyoZoH+ZHHjKC8sv5RGKuJbH/84ynroL7c60RTho2iwBiUyZJFtUuwL/b81UhMQwTaAF6+bqvVf2FRqyz7b/U0mrdg2GMCMlwn0yWxJSQXpEhk1nm0B3Snjz/0e0PA2Z2z3NmDzIC7iRzv8G6jcKmk2tXqJCuHAl6UOT3La0JlhnssnPiYjLO3c9xv6n2vlDfkRdIMrFDW+Kwo+ukIRayvFIA31qPSPvAL25WZUmeA==

ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=none; dmarc=none;

dkim=none; arc=none

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=outlook.com;

s=selector1;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck;

bh=7lbLbx2w+e5oHkK7cjHXejZfjGev3RURRQ2rqDAfiX0=;

b=ZLlWAiYNtadyfb4bcP/6kiwxIBgPe1NE7jC97DjaRYIL5stQBfga/d1PGLf3uHDCBBQJkNlOQOch19MFT2yFt8SMBaqGzCc1V3encZB7ogyfGNuSANag6CFkzNBQDw28r5dJKPn84MV+89lMRurHjrgN/NS2A+Aj+9uf7ux+CSjXQkeaM63z7APEdXqZTiDWHab6cKZC5dK2V3Nrnx5C1tXtkhzfg+Z6V3uCcIXpnArG+qOVwhZuVo8xwDQ57SWZ/fyxbqh0i+zqjFGI3Kn95SmE8JmHSeqS6On/ip6uEAP/LkIc3IoZSAl7eXL+UwTjfFfnSGDkL4GmptG35BngPA==

Received: from TYCPR01MB11172.jpnprd01.prod.outlook.com (2603:1096:400:3c4::7)

by TYRPR01MB12857.jpnprd01.prod.outlook.com (2603:1096:405:1b1::14) with

Microsoft SMTP Server (version=TLS1_2,

cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.9253.10; Sat, 18 Oct

2025 17:25:18 +0000

Received: from TYCPR01MB11172.jpnprd01.prod.outlook.com

([fe80::9a5b:9ddd:ac6a:c24c]) by TYCPR01MB11172.jpnprd01.prod.outlook.com

([fe80::9a5b:9ddd:ac6a:c24c%6]) with mapi id 15.20.9253.005; Sat, 18 Oct 2025

17:25:18 +0000

From: Axel Carse

Subject: Re: Price...

Thread-Topic: Price...

Thread-Index: AQHcQFN42rs7pdC1IU2qmBfh2FyQEw==

Date: Sat, 18 Oct 2025 17:25:18 +0000

Message-ID:



Accept-Language: en-GB, en-US

Content-Language: en-GB

X-MS-Has-Attach:

X-MS-TNEF-Correlator:

msip_labels:

x-ms-publictraffictype: Email

x-ms-traffictypediagnostic: TYCPR01MB11172:EE_|TYRPR01MB12857:EE_

x-ms-office365-filtering-correlation-id: 967d2cd7-6522-4b14-7aeb-08de0e6b4f43

x-microsoft-antispam:

BCL:0;ARA:14566002|36102599003|31061999003|7071999006|15080799012|15030799006|461199028|19110799012|8060799015|8062599012|51005399003|39105399003|41105399003|40105399003|39145399003|3412199025|440099028|102099032;

x-microsoft-antispam-message-info:

=?Windows-1252?Q?ZnjLRC7qXvlABTR3xNjt0t412/Bkp7G9PmkkOwLbMNexXK9WIIr6Je9B?=

=?Windows-1252?Q?AdmlYlDC3gtLlY7wmbR6gF0Ek0lwuFSVX/lvjJTZIbTarOyqqGDr8oK2?=

=?Windows-1252?Q?aYdVTcMivqenDfc5KO+GtXV+u8GRU0rbARCvhy/pWaAvxqiubTQz2jw1?=

=?Windows-1252?Q?HsR79TQLRVMAsMvsK2V6sl1QRzjbNOaBHTmgW3eepTQqJyf+mtpsUn4v?=

=?Windows-1252?Q?S6px5SBjbtN7x7zrSwFGivzf25lVjGC21ZaH9kXU9gExz6XtRHsld8QJ?=

=?Windows-1252?Q?A1FXc7Rzqkdq1U/OzOfOoUSS4Zlq4gL9U5z/oZh0bCpTUqimQbuEUvKS?=

=?Windows-1252?Q?MwcnW0zU9Nm4fTI00xx2NqmGIzFCUfLQLmxtMZk+trYt7e/EkCfdxBNZ?=

=?Windows-1252?Q?WSEhr3FMeWQcnFuwLyLa5P8xHGEAPOFGtGyvP5aIqXA1bfft/7vq3Sca?=

=?Windows-1252?Q?FKgroGLKC6jv/K0+Hw3UUmM4SJH980DQywuhy7vYYPQRE8U5WpTfjT5F?=

=?Windows-1252?Q?m3c+S/Uj/mR/HgHgcv2KMewzJooVVXxJM3TjZSbH/qngHwR0HqY9bNOG?=

=?Windows-1252?Q?FbB2s5ks0BoXh14NbRbuD75SfKvlPPEHH+W4X5krd8S8wuN+VWUDfhXS?=

=?Windows-1252?Q?oYJxBMmj8eS21xjouAiVCyUJqsu2UcbTzsWZj4CzwDClKWWLbVwO3J9y?=

=?Windows-1252?Q?HLiN1hZ6r7svx9YxEhXzg0kt5XN0rPoArOMtrM/fBGiNXX1Y9a6KznFN?=

=?Windows-1252?Q?Xp4Bm7Ket3uMqlNkGAmMndhei2ZaD3qstdkmV8bCBij11pv0lEUX6QCu?=

=?Windows-1252?Q?3rHeSY5uC0prBzXYXqnu9v75Rfac1p+ASyx576EQsKvN8g/ocDsNuZtR?=

=?Windows-1252?Q?7tWqD/WWxSmuUdbtQRAxjvDLW1YtTy7My+/4WtElfkNbse4nccymucu2?=

=?Windows-1252?Q?mUrg323k4ByUSjgBNzV2M17Y3HAU31dRfXpR2UuX3uan6mH/UFENWiNN?=

=?Windows-1252?Q?8Cx2xu/HjKppYKyxaOLSuC0akQRsSoRZJkNiX86rn/O4dntf6C+PrC/S?=

=?Windows-1252?Q?OWaLgasskwnRQLDNN4KhG5HXGCoSZTnWdf2E8S1OtGrHnV3WcpyYYOXg?=

=?Windows-1252?Q?KP+1mQPImwJKOEh30xyp+neBkYelAB1gM1r/71FwAaovLpGoQ+b7Iow7?=

=?Windows-1252?Q?IwJEDprE9qO9YaDlaPOggbKH8sl0d/iMnnKX95S+T0+7zIc7lyDQWSkz?=

=?Windows-1252?Q?H9WbPUb/kefcEWESXx6lvP2BhA/OATajn2aUB0BuFed2uQRFnISZZGoH?=

=?Windows-1252?Q?B7sWNTL2u1dIlrhyG2KUNVWzaVgaaoY6p2D1E7RWhy2vHEHeKOa8TUFf?=

=?Windows-1252?Q?qOGkzR9v92Cz1E5kGW7qqqjJdDo2edalKq+lbCvFA6zO18umoXcQA2bd?=

=?Windows-1252?Q?ENxf5TmkFmEElCvKKdjD+kdmF+MyW343u2PJ8T69zIY=3D?=

x-ms-exchange-antispam-messagedata-chunkcount: 1

x-ms-exchange-antispam-messagedata-0:

=?Windows-1252?Q?vRpbwtjUfdIcetLjvtar2w7vSYk/MxnnGCTRz4qdgxleTjrwNkN0yzdI?=

=?Windows-1252?Q?NMFftJ2dsyGtbxlUcfMJVz9QwaVd1G0N+728SmPdxartBq9zoMqu6T9C?=

=?Windows-1252?Q?wNmH/NYyvG48I4XBXtMy+Cl0pD29O8nU6wWMLlhgsoQDaFNyCYETj/R8?=

=?Windows-1252?Q?Ek+VXvtdYoKlMxm4L1BBKxqyf91xLZQtLMAZXSv2QRWwVacIyZUC68DP?=

=?Windows-1252?Q?PajDPKAB1+Lo2pfBlubLWmhSHaQuYeSDjoovAWadl0wG8OvdwJOKacxn?=

=?Windows-1252?Q?dAVIW0PFGA+L1vQ3s0ETSOKG2MJCI4B3qk8eD8P8m4L/TdbzVA0YZpsp?=

=?Windows-1252?Q?0AqdFBSmP5jmsEMYiRyMulMSZBGgmNFF/B2uo4Yd5zEAhaNi2NL7r/XM?=

=?Windows-1252?Q?16auOJnVp4gjAIeIlorngoKwNTNPZLgLX/Zt4iHlQxcje83Aq08sutvN?=

=?Windows-1252?Q?LeLPLqA+qltVNnDIs7NKFSrSkqBt596A2KVrEpb1lHJGio/F4HajlABz?=

=?Windows-1252?Q?q5MHARdbDPu310A3rWaQTPrsANGKxDdyFulQhBBksIUDY30wfpcj3s3w?=

=?Windows-1252?Q?SCENa59GvCyEY5X0vuRh+I5NK+VQ2boqnJGY4xAO5X9ssDOqhM4RG3gs?=

=?Windows-1252?Q?rxFsTi2D/PTSrrp+A2n5tZUwx9KQASzxqRdAHSYppWMXPYJZY5Zod1yp?=

=?Windows-1252?Q?u97wTJwHK1V8khv45UqARpufbCbtTc74A6dEn/zPaSJIo4zzoZ5f1dRT?=

=?Windows-1252?Q?jXG6+Qazlx7Rij3u8BQTRWGKowt/efHdf+nTOq3a4h5yyZADp411uE1Y?=

=?Windows-1252?Q?zG2piReIOQf1tV5K1FCegbGNktzvGK4jYJtiUJdYf6onJASV/Q5iF0nw?=

=?Windows-1252?Q?UFj7QFbgfEWsKVvEIg1LPyrDNNaCGo7cHugu5U9xvtMJrE9cFRjtkEpt?=

=?Windows-1252?Q?gcF9NgljFesNu1hNSaUIxUL/S4N2MavXSpXRe04oY1QxTHtPnjWGs4qi?=

=?Windows-1252?Q?SodvClxUnZ7LJf6CF2AtBSG0xZAhqdqlPRsssB1g17/ND0HG5di6xQvv?=

=?Windows-1252?Q?L2LeqgvMr1aJEShecSvxPeFMRuAKKEEQ7IKPHvbFzC9vWqfl5iLzOCeP?=

=?Windows-1252?Q?zRZWcwNj5Fs5fIdIldeHnAX2EsBEwruXNRabe7YU1GTHc9VnPIErAu70?=

=?Windows-1252?Q?VMrKmOuZTliCxLxnkZVlaML44VP0jraSYFmXY+uSw+0Dbs42Kv0rNUeV?=

=?Windows-1252?Q?aN9nLPXlQmQnlKh6GVJGTMuE726ygPBMuYW7i53npSTgEW0r3Lc52D+K?=

=?Windows-1252?Q?RRJ5Ii6JfLKAqXMWKcUi11WPuTrTy5XCpvvvAsudXjxvcjF+bSyk29ls?=

=?Windows-1252?Q?hXPc8f1FMD3xEOPlRNaN0lutKGZFD6s4DRM=3D?=

Content-Type: multipart/alternative;

boundary="_000_TYCPR01MB111720A342C8B1D55AE1EAFA7AAF7ATYCPR01MB11172jp_"

MIME-Version: 1.0

X-OriginatorOrg: outlook.com

X-MS-Exchange-CrossTenant-AuthAs: Internal

X-MS-Exchange-CrossTenant-AuthSource: TYCPR01MB11172.jpnprd01.prod.outlook.com

X-MS-Exchange-CrossTenant-RMS-PersistedConsumerOrg: 00000000-0000-0000-0000-000000000000

X-MS-Exchange-CrossTenant-Network-Message-Id: 967d2cd7-6522-4b14-7aeb-08de0e6b4f43

X-MS-Exchange-CrossTenant-originalarrivaltime: 18 Oct 2025 17:25:18.7006

(UTC)

X-MS-Exchange-CrossTenant-fromentityheader: Hosted

X-MS-Exchange-CrossTenant-id: 84df9e7f-e9f6-40af-b435-aaaaaaaaaaaa

X-MS-Exchange-CrossTenant-rms-persistedconsumerorg: 00000000-0000-0000-0000-000000000000

X-MS-Exchange-Transport-CrossTenantHeadersStamped: TYRPR01MB12857

X-Spam_score: 7.2

X-Spam_score_int: 72

X-Spam_bar: +++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Hello, I was checking your website and see you have a good

design and it looks great, but it’s not ranking on Google and other major

search engine. We can place your website on the 1st page of Google, Yahoo

and a better presence on Facebook, LinkedIn, YouTube, Instagram, Pinterest

etc.



Content analysis details: (7.2 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[2603:1096:400:3c4:0:0:0:7 listed in]

[will-spam-for-food.eu.org]

[2603:1096:400:3c4:0:0:0:7 listed in]

[will-spam-for-food.eu.org]

[2603:1096:400:3c4:0:0:0:7 listed in]

[will-spam-for-food.eu.org]

[2603:1096:400:3c4:0:0:0:7 listed in]

[will-spam-for-food.eu.org]

[2603:1096:400:3c4:0:0:0:7 listed in]

[will-spam-for-food.eu.org]

[2603:1096:400:3c4:0:0:0:7 listed in]

[will-spam-for-food.eu.org]

[2603:1096:400:3c4:0:0:0:7 listed in]

[will-spam-for-food.eu.org]

[2603:1096:400:3c4:0:0:0:7 listed in]

[will-spam-for-food.eu.org]

[52.103.66.12 listed in will-spam-for-food.eu.org]

[52.103.66.12 listed in will-spam-for-food.eu.org]

[52.103.66.12 listed in will-spam-for-food.eu.org]

[52.103.66.12 listed in will-spam-for-food.eu.org]

[52.103.66.12 listed in will-spam-for-food.eu.org]

[52.103.66.12 listed in will-spam-for-food.eu.org]

[52.103.66.12 listed in will-spam-for-food.eu.org]

[52.103.66.12 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[52.103.66.12 listed in dnsbl.ahbl.org]

[52.103.66.12 listed in dnsbl.ahbl.org]

[52.103.66.12 listed in dnsbl.ahbl.org]

[52.103.66.12 listed in dnsbl.ahbl.org]

[2603:1096:400:3c4:0:0:0:7 listed in]

[dnsbl.ahbl.org]

[2603:1096:400:3c4:0:0:0:7 listed in]

[dnsbl.ahbl.org]

[2603:1096:400:3c4:0:0:0:7 listed in]

[dnsbl.ahbl.org]

[2603:1096:400:3c4:0:0:0:7 listed in]

[dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[52.103.66.12 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[52.103.66.12 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[52.103.66.12 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[52.103.66.12 listed in dnsbl.ahbl.org]

-0.0 SPF_HELO_PASS SPF: HELO matches SPF record

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[52.103.66.12 listed in list.dnswl.org]

-0.0 SPF_PASS SPF: sender matches SPF record

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[52.103.66.12 listed in wl.mailspike.net]

-0.1 DKIM_VALID Message has at least one valid DKIM or DK signature

-0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from author's

domain

0.0 ARC_SIGNED Message has a ARC signature

0.0 ARC_VALID Message has a valid ARC signature

-0.1 DKIM_VALID_EF Message has a valid DKIM or DK signature from

envelope-from domain

0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid

0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider

[axelcarse(at)outlook.com]

1.2 MISSING_HEADERS Missing To: header

-0.0 T_RP_MATCHES_RCVD Envelope sender domain matches handover relay

domain

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

1.4 MALFORMED_FREEMAIL Bad headers on message from free email service

Subject: {SPAM?} Re: Price...



--_000_TYCPR01MB111720A342C8B1D55AE1EAFA7AAF7ATYCPR01MB11172jp_

Content-Type: text/plain; charset="Windows-1252"

Content-Transfer-Encoding: quoted-printable



Hello,



I was checking your website and see you have a good design and it looks gre=

at, but it=92s not ranking on Google and other major search engine.



We can place your website on the 1st page of Google, Yahoo and a better pre=

sence on Facebook, LinkedIn, YouTube, Instagram, Pinterest etc.



May I send you an Proposal..?



Thank You,



--_000_TYCPR01MB111720A342C8B1D55AE1EAFA7AAF7ATYCPR01MB11172jp_

Content-Type: text/html; charset="Windows-1252"

Content-Transfer-Encoding: quoted-printable








252">








Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" clas=

s=3D"elementToProof">

Hello,



Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" clas=

s=3D"elementToProof">

 



Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" clas=

s=3D"elementToProof">

I was checking your website and see you have a good design and it looks gre=

at, but it=92s not ranking on Google and other major search engine.



Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" clas=

s=3D"elementToProof">

 



Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" clas=

s=3D"elementToProof">

We can place your website on the 1st page of Google, Yahoo and a better pre=

sence on Facebook, LinkedIn, YouTube, Instagram, Pinterest etc.



Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" clas=

s=3D"elementToProof">

 



Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" clas=

s=3D"elementToProof">

May I send you an  Proposal..?



Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" clas=

s=3D"elementToProof">

 



Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" clas=

s=3D"elementToProof">

Thank You,








--_000_TYCPR01MB111720A342C8B1D55AE1EAFA7AAF7ATYCPR01MB11172jp_--

Cloud credentials phishing from Google Gmail

Posted by Dave Yadallee on
Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Sat, 18 Oct 2025 13:14:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vACNG-00000000Dkk-0Vdz

for dave@doctor.nl2k.ab.ca;

Sat, 18 Oct 2025 13:13:54 -0600

Resent-From: The Doctor

Resent-Date: Sat, 18 Oct 2025 13:13:54 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-vk1-f197.google.com ([209.85.221.197]:57394)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vAAVX-000000003HJ-0fmn

for doctor@nl2k.ab.ca;

Sat, 18 Oct 2025 11:14:27 -0600

Received: by mail-vk1-f197.google.com with SMTP id 71dfb90a1353d-54a8d35ed64so5611212e0c.2

for ; Sat, 18 Oct 2025 10:13:32 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=firebaseapp.com; s=20230601; t=1760807606; x=1761412406; darn=nl2k.ab.ca;

h=to:from:subject:date:message-id:mime-version:from:to:cc:subject

:date:message-id:reply-to;

bh=tWwoa3WTezFVCZppMan13+h8F0wEliryrYblrje/o70=;

b=G5BIcBPRqIprhQPswNai6rTXCoMsE40tka+zwmuEdaeJ1GyqHe2bEFAHvnmX6LTGEB

ASpc+frBEymhqpjFtIJvOaBK7XhVrYeEKsOF4BYNmmbUFD8aIh5d8rh/GMWY1VhAWAue

jwifL54GZ6z2xaB3l87zEfmzDNSqAQV8Hl/5vDes2+DMBzPFETF30mhwyygdN4u/zvIA

ABkKInCGKl9oRPoV1GjQ9kPv6ScIpz9Jn9asva9ZE5v3BPVlTmfm//v+yAeZwojzpJ1P

1cC1x7zuRsxxOjSY7l/CVemEShTGLz388iSbnPuB7wdStM2Ek2zr3zSdLmf3E5IwX6HW

jZ4A==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20230601; t=1760807606; x=1761412406;

h=to:from:subject:date:message-id:mime-version:x-gm-message-state

:from:to:cc:subject:date:message-id:reply-to;

bh=tWwoa3WTezFVCZppMan13+h8F0wEliryrYblrje/o70=;

b=VUfLYAH2vGpKr4M3LHJCdnt6EvwmXiDBKJzmWTwG9q7UOk+u5BXQ4WQqsXlnu0pI41

aTRmk+o8f8b7YzO8Rhd6uVt59tptoy7Z1fVJAAvjZ3CkxmNG3fa6BmkuwzQ4R/zeccyT

10ZdOeiqikaujHqiOJP9LSr1W8+M562BTqGPs4KY1z9SiRwx8mYzMd1LlR9hPRh8rQrE

HeA192GLtF/7iQ4rzNBwxW6iWFaBVzjroEAUaSkyFDb7ZPsljoQ2UfgIIazl0Hsq/2FV

pcNnUxFMKDLwFgxfervXh8OAaEbRafLTTgXoDxlI2AjKxQWFZFE+KTmIhZ2btflAgsfb

PC4Q==

X-Gm-Message-State: AOJu0YwoVT/OLYyhbMsJqgILVdCIyu+Isyn3+JP8aa8+Du4kHrmWxDWq

GktCg15an06XHn1wHDq/uPHA/I1InZeT2Qiecc2T2w4ch2RFYG7pqpCMFmxrIgrhD88iveDaFph

Kgw1xVRXGLg==

X-Google-Smtp-Source: AGHT+IFAOGSIPUNZUE5TbwMkTPI3hNV4Lhw1g87ZU+59KqMsQrYaVoq/2LYNd/y2BKXaYQVND6W4T+iEaDM39zY=

MIME-Version: 1.0

X-Received: by 2002:a05:6122:8c06:b0:54a:c54a:6d96 with SMTP id

71dfb90a1353d-5564ee56e6cmr3103826e0c.4.1760807606682; Sat, 18 Oct 2025

10:13:26 -0700 (PDT)

Message-ID: <000000000000ea0518064171f7a0@google.com>

Date: Sat, 18 Oct 2025 17:13:26 +0000

Subject: Reset your password for hfyq-d0a7d

From: noreply@hfyq-d0a7d.firebaseapp.com

To: doctor@nl2k.ab.ca

Content-Type: multipart/alternative; boundary="000000000000ea050c064171f79d"

X-Spam_score: 8.3

X-Spam_score_int: 83

X-Spam_bar: ++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Hello, Follow this link to reset your hfyq-d0a7d password

for your doctor@nl2k.ab.ca account. https://hfyq-d0a7d.firebaseapp.com/__/auth/action?mode=resetPassword&oobCode=Z5O_Ni0XG3GZ81acyxNgcVZPds_1DL3fYMMzH9NwQyAAAAGZ-E_Ytw&apiKey=AIzaSyCbZKYTQela8kIRhDbCAzkN2e4D8DylOzo&lang=en





Content analysis details: (8.3 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[209.85.221.197 listed in will-spam-for-food.eu.org]

[209.85.221.197 listed in will-spam-for-food.eu.org]

[209.85.221.197 listed in will-spam-for-food.eu.org]

[209.85.221.197 listed in will-spam-for-food.eu.org]

[209.85.221.197 listed in will-spam-for-food.eu.org]

[209.85.221.197 listed in will-spam-for-food.eu.org]

[209.85.221.197 listed in will-spam-for-food.eu.org]

[209.85.221.197 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[209.85.221.197 listed in dnsbl.ahbl.org]

[209.85.221.197 listed in dnsbl.ahbl.org]

[209.85.221.197 listed in dnsbl.ahbl.org]

[209.85.221.197 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[209.85.221.197 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[209.85.221.197 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[209.85.221.197 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[209.85.221.197 listed in dnsbl.ahbl.org]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[209.85.221.197 listed in list.dnswl.org]

-0.0 SPF_PASS SPF: sender matches SPF record

-0.1 DKIM_VALID Message has at least one valid DKIM or DK signature

0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid

0.3 LONGWORD BODY: Uses overlong words

0.1 TW_HF BODY: Odd Letter Triples with HF

0.1 TW_FY BODY: Odd Letter Triples with FY

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[209.85.221.197 listed in wl.mailspike.net]

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 SARE_FROM_SPAM_WORD4 From address suggests this may be spam

3.0 URI_FIREBASEAPP Link to hosted firebase web application, possible

phishing

Subject: {SPAM?} Reset your password for hfyq-d0a7d



--000000000000ea050c064171f79d

Content-Type: text/plain; charset="UTF-8"; format=flowed; delsp=yes



Hello,



Follow this link to reset your hfyq-d0a7d password for your

doctor@nl2k.ab.ca account.



https://hfyq-d0a7d.firebaseapp.com/__/auth/action?mode=resetPassword&oobCode=Z5O_Ni0XG3GZ81acyxNgcVZPds_1DL3fYMMzH9NwQyAAAAGZ-E_Ytw&apiKey=AIzaSyCbZKYTQela8kIRhDbCAzkN2e4D8DylOzo&lang=en



If you didn't ask to reset your password, you can ignore this email.



Thanks,



Your hfyq-d0a7d team



--000000000000ea050c064171f79d

Content-Type: text/html; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable



Hello,



Follow this link to reset your hfyq-d0a7d password for your doctor@nl2k.=

ab.ca account.




tPassword&oobCode=3DZ5O_Ni0XG3GZ81acyxNgcVZPds_1DL3fYMMzH9NwQyAAAAGZ-E_=

Ytw&apiKey=3DAIzaSyCbZKYTQela8kIRhDbCAzkN2e4D8DylOzo&lang=3Den'>htt=

ps://hfyq-d0a7d.firebaseapp.com/__/auth/action?mode=3DresetPassword&oob=

Code=3DZ5O_Ni0XG3GZ81acyxNgcVZPds_1DL3fYMMzH9NwQyAAAAGZ-E_Ytw&apiKey=3D=

AIzaSyCbZKYTQela8kIRhDbCAzkN2e4D8DylOzo&lang=3Den



If you didn=E2=80=99t ask to reset your password, you can ignore this em=

ail.



Thanks,



Your hfyq-d0a7d team



--000000000000ea050c064171f79d--

Cloud credentials phishing from Google Gmail

Posted by Dave Yadallee on
Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Sat, 18 Oct 2025 13:14:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vACNC-00000000DkT-1uMb

for dave@doctor.nl2k.ab.ca;

Sat, 18 Oct 2025 13:13:50 -0600

Resent-From: The Doctor

Resent-Date: Sat, 18 Oct 2025 13:13:50 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-ua1-f69.google.com ([209.85.222.69]:51439)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vAAUk-000000003DY-2oKv

for doctor@nk.ca;

Sat, 18 Oct 2025 11:13:38 -0600

Received: by mail-ua1-f69.google.com with SMTP id a1e0cc1a2514c-930ffeb4ca0so5330080241.2

for ; Sat, 18 Oct 2025 10:12:44 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=firebaseapp.com; s=20230601; t=1760807558; x=1761412358; darn=nk.ca;

h=to:from:subject:date:message-id:mime-version:from:to:cc:subject

:date:message-id:reply-to;

bh=qSYymtMZyxtQKUzcpwSW9LTruSWZDRytBRLmG/dHLLg=;

b=cnxwLwHg0jg6P2cOVrTqJuvKiqo9srKmRwo5v2iM0dQ5RvZK8B1vCyOzlHkswJACbB

tCkN2ZUxtHXcFSQbp66BlYb/ARXRdIegkJxp/HE7hoSxlfNdEid+AymZz1crbBktHktV

/lit8+xb/NLv1dpRA6YWe35cbgiw84fhSrcWsR+AlkBTbIxfcACndwjYfMQPguS0kDlK

qpEWZplPS1ATeOnPrmOtfMOWT3unpjpruo6o9cSZWB6d+RBrsufR8QiBbt6STAefmrXc

p1s1Eoh0VsMV9ybSeFriTplxJl0s2miynu5RySE8mA15A9rjpqDRpMVML9LHlPga81rF

jISg==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20230601; t=1760807558; x=1761412358;

h=to:from:subject:date:message-id:mime-version:x-gm-message-state

:from:to:cc:subject:date:message-id:reply-to;

bh=qSYymtMZyxtQKUzcpwSW9LTruSWZDRytBRLmG/dHLLg=;

b=V1a65Nn2SZIult3GOzGXkvJk+9ebAH2xWDjhKuFchBCQE1ImLam4F6K2yizQFJbhIX

O+s086VgQ+/ER8k0o4cixCENkckKUujkuG9DmWl+PuKe2hSo3bsWlmQr0Xtm0Fel4FdG

oiGoYRX9a/hpsI1i/cXtpx8ZUztmFabWUq6amHzJ3Hj2d40UnepoDfneSwbVaCW51Hp4

2xIjM4RnIE8RapYU8nx4hU5tl0KIki7z6qu+iUjRraxrMQ1RXi6h5hGereIo7BzGqZ8l

jUx7Wo3su5Dvu2CGMVB5cDSk5Ka7P7k0QAt0ma2Xoy+O9HP3oaCkbw8wc2zFIdYBfuHc

APfQ==

X-Gm-Message-State: AOJu0YzYwV4K7DVhiBS82qzoqsUdrLHRjBTDw4VZfScvS1wWbN4AU7zH

7cN+/af+AQFEnyY0jrLFU79nCWP6RnrnDAJ9OrPfitrj9mKIlZ/6TcNfc8P2eBm6F7lFErcfXPR

+ZSvvM3pIaw==

X-Google-Smtp-Source: AGHT+IG5HLBLyt0Ykc87lw1w4NxZjV4JboNVE6N7R0Xy5/xCNS5c2cJIYx+WZkMD4NhfKP2Qp8UdXLriq27KAWs=

MIME-Version: 1.0

X-Received: by 2002:a05:6102:26d4:b0:530:f657:c40 with SMTP id

ada2fe7eead31-5d7dd65d04dmr3193802137.22.1760807558196; Sat, 18 Oct 2025

10:12:38 -0700 (PDT)

Message-ID: <000000000000062ca7064171f53e@google.com>

Date: Sat, 18 Oct 2025 17:12:38 +0000

Subject: Reset your password for sfvp-881d6

From: noreply@sfvp-881d6.firebaseapp.com

To: doctor@nk.ca

Content-Type: multipart/alternative; boundary="000000000000062c9e064171f53b"

X-Spam_score: 8.2

X-Spam_score_int: 82

X-Spam_bar: ++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Hello, Follow this link to reset your sfvp-881d6 password

for your doctor@nk.ca account. https://sfvp-881d6.firebaseapp.com/__/auth/action?mode=resetPassword&oobCode=AUFDkOydRJT7DwyQgFgT1XFXVBBcW-jgJ-LnyJIHGs4AAAGZ-E8bJA&apiKey=AIzaSyAFPPGHezoOtDbPylq9oRxkaoBOWgRtpTk&lang=en





Content analysis details: (8.2 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[209.85.222.69 listed in list.dnswl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[209.85.222.69 listed in will-spam-for-food.eu.org]

[209.85.222.69 listed in will-spam-for-food.eu.org]

[209.85.222.69 listed in will-spam-for-food.eu.org]

[209.85.222.69 listed in will-spam-for-food.eu.org]

[209.85.222.69 listed in will-spam-for-food.eu.org]

[209.85.222.69 listed in will-spam-for-food.eu.org]

[209.85.222.69 listed in will-spam-for-food.eu.org]

[209.85.222.69 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[209.85.222.69 listed in dnsbl.ahbl.org]

[209.85.222.69 listed in dnsbl.ahbl.org]

[209.85.222.69 listed in dnsbl.ahbl.org]

[209.85.222.69 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[209.85.222.69 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[209.85.222.69 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[209.85.222.69 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[209.85.222.69 listed in dnsbl.ahbl.org]

-0.0 SPF_PASS SPF: sender matches SPF record

-0.1 DKIM_VALID Message has at least one valid DKIM or DK signature

0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid

0.3 LONGWORD BODY: Uses overlong words

0.1 TW_FV BODY: Odd Letter Triples with FV

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[209.85.222.69 listed in wl.mailspike.net]

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

3.0 URI_FIREBASEAPP Link to hosted firebase web application, possible

phishing

0.0 SARE_FROM_SPAM_WORD4 From address suggests this may be spam

Subject: {SPAM?} Reset your password for sfvp-881d6



--000000000000062c9e064171f53b

Content-Type: text/plain; charset="UTF-8"; format=flowed; delsp=yes



Hello,



Follow this link to reset your sfvp-881d6 password for your doctor@nk.ca

account.



https://sfvp-881d6.firebaseapp.com/__/auth/action?mode=resetPassword&oobCode=AUFDkOydRJT7DwyQgFgT1XFXVBBcW-jgJ-LnyJIHGs4AAAGZ-E8bJA&apiKey=AIzaSyAFPPGHezoOtDbPylq9oRxkaoBOWgRtpTk&lang=en



If you didn't ask to reset your password, you can ignore this email.



Thanks,



Your sfvp-881d6 team



--000000000000062c9e064171f53b

Content-Type: text/html; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable



Hello,



Follow this link to reset your sfvp-881d6 password for your doctor@nk.ca=

account.




tPassword&oobCode=3DAUFDkOydRJT7DwyQgFgT1XFXVBBcW-jgJ-LnyJIHGs4AAAGZ-E8=

bJA&apiKey=3DAIzaSyAFPPGHezoOtDbPylq9oRxkaoBOWgRtpTk&lang=3Den'>htt=

ps://sfvp-881d6.firebaseapp.com/__/auth/action?mode=3DresetPassword&oob=

Code=3DAUFDkOydRJT7DwyQgFgT1XFXVBBcW-jgJ-LnyJIHGs4AAAGZ-E8bJA&apiKey=3D=

AIzaSyAFPPGHezoOtDbPylq9oRxkaoBOWgRtpTk&lang=3Den



If you didn=E2=80=99t ask to reset your password, you can ignore this em=

ail.



Thanks,



Your sfvp-881d6 team



--000000000000062c9e064171f53b--