Canada Revenue agency phish

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Mon, 15 Jun 2026 18:51:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wZI0O-00000000Ogs-3UHt

for dave@doctor.nl2k.ab.ca;

Mon, 15 Jun 2026 18:50:16 -0600

Resent-From: The Doctor

Resent-Date: Mon, 15 Jun 2026 18:50:16 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from [92.113.145.149] (port=35502 helo=mail.voicemailvoip.online)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wZDfm-00000000D7g-43U9

for sales@nk.ca;

Mon, 15 Jun 2026 14:12:51 -0600

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=voicemailvoip.online;

s=default; t=1781554308;

bh=frcCV1k9oG9oKj3dpUqdJg1PxRT2RSN/XKdLCPjaYaY=;

h=List-Unsubscribe:From:To:Subject:Date;

b=KhpTTKZFStBwP3yyODI+2/eRoV/kgkLTS2E5mBa7m/5DKS4Nx6MDntFP3scJtAZ2r

/SMpCJ0eGy9t9M5ZI+1SA3kUrS4Mu5AF/o7BKrLr+KF+C6VFchmEZei9+H+JFd/puL

W/b3DqKPo6ZgfRgqissNd8z5C+k+5cKyeE+C39Bjc+wWaKjWSlX+Wc3orQLds2NMRf

5CxL47PxaBAYRWuEVNWe+xa+MljZ0EFPMQthqP+6zu1Jwua7Rfaw8Jbf5GrxVft2/c

OyLWNqVnYdcVkH5TZ/AT9utDXR3cAJlDVjGQ454pplTQ40poMZJbK7AGxmIZ+7+fiW

JaQcYML9Qummw==

Received: from [127.0.0.1] (vmi3373381.contaboserver.net [212.47.79.9])

by mail.voicemailvoip.online (Postfix) with ESMTPSA id 9B56C4223C

for ; Mon, 15 Jun 2026 20:11:48 +0000 (UTC)

Message-ID: <13c03ca1-4d67-452b-8309-27cac4ac581d@voicemailvoip.online>

List-Unsubscribe:

From: Canada Revenue Agency

To: sales@nk.ca

Subject: Canada Revenue Agency (CRA) shared a file

Date: Mon, 15 Jun 2026 20:11:48 +0000

MIME-Version: 1.0

Content-Type: text/plain

X-Spam_score: 16.0

X-Spam_score_int: 160

X-Spam_bar: ++++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview:



Content analysis details: (16.0 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

2.3 EMPTY_MESSAGE Message appears to have no textual parts and no

Subject: text

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[212.47.79.9 listed in will-spam-for-food.eu.org]

[212.47.79.9 listed in will-spam-for-food.eu.org]

[212.47.79.9 listed in will-spam-for-food.eu.org]

[212.47.79.9 listed in will-spam-for-food.eu.org]

[212.47.79.9 listed in will-spam-for-food.eu.org]

[212.47.79.9 listed in will-spam-for-food.eu.org]

[212.47.79.9 listed in will-spam-for-food.eu.org]

[212.47.79.9 listed in will-spam-for-food.eu.org]

[92.113.145.149 listed in will-spam-for-food.eu.org]

[92.113.145.149 listed in will-spam-for-food.eu.org]

[92.113.145.149 listed in will-spam-for-food.eu.org]

[92.113.145.149 listed in will-spam-for-food.eu.org]

[92.113.145.149 listed in will-spam-for-food.eu.org]

[92.113.145.149 listed in will-spam-for-food.eu.org]

[92.113.145.149 listed in will-spam-for-food.eu.org]

[92.113.145.149 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[92.113.145.149 listed in dnsbl.ahbl.org]

[92.113.145.149 listed in dnsbl.ahbl.org]

[92.113.145.149 listed in dnsbl.ahbl.org]

[92.113.145.149 listed in dnsbl.ahbl.org]

[212.47.79.9 listed in dnsbl.ahbl.org]

[212.47.79.9 listed in dnsbl.ahbl.org]

[212.47.79.9 listed in dnsbl.ahbl.org]

[212.47.79.9 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[92.113.145.149 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[92.113.145.149 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[92.113.145.149 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[92.113.145.149 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_SBL_XBL RBL: Received via a relay in Spamhaus SBL+XBL

[212.47.79.9 listed in sbl-xbl.spamhaus.org]

3.6 RCVD_IN_SBL_CSS RBL: Received via a relay in Spamhaus SBL-CSS

[212.47.79.9 listed in zen.spamhaus.org]

-0.0 SPF_PASS SPF: sender matches SPF record

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

0.0 T_PDS_OTHER_BAD_TLD Untrustworthy TLDs

[URI: voicemailvoip.online (online)]

1.3 BODY_EMPTY Empty message body !

1.3 RDNS_NONE Delivered to internal network by a host with no rDNS

2.0 RATWR8_MESSID Message-ID with excessive dashes and dollars

0.5 FROM_SUSPICIOUS_NTLD From abused NTLD

2.0 FROM_SUSPICIOUS_NTLD_FP From abused NTLD

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[92.113.145.149 listed in bl.score.senderscore.com]

Subject: {SPAM?} Canada Revenue Agency (CRA) shared a file



Canada Revenue agency phish

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Mon, 15 Jun 2026 18:51:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wZI0O-00000000Ogs-3UHt

for dave@doctor.nl2k.ab.ca;

Mon, 15 Jun 2026 18:50:16 -0600

Resent-From: The Doctor

Resent-Date: Mon, 15 Jun 2026 18:50:16 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from [92.113.145.149] (port=35502 helo=mail.voicemailvoip.online)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wZDfm-00000000D7g-43U9

for sales@nk.ca;

Mon, 15 Jun 2026 14:12:51 -0600

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=voicemailvoip.online;

s=default; t=1781554308;

bh=frcCV1k9oG9oKj3dpUqdJg1PxRT2RSN/XKdLCPjaYaY=;

h=List-Unsubscribe:From:To:Subject:Date;

b=KhpTTKZFStBwP3yyODI+2/eRoV/kgkLTS2E5mBa7m/5DKS4Nx6MDntFP3scJtAZ2r

/SMpCJ0eGy9t9M5ZI+1SA3kUrS4Mu5AF/o7BKrLr+KF+C6VFchmEZei9+H+JFd/puL

W/b3DqKPo6ZgfRgqissNd8z5C+k+5cKyeE+C39Bjc+wWaKjWSlX+Wc3orQLds2NMRf

5CxL47PxaBAYRWuEVNWe+xa+MljZ0EFPMQthqP+6zu1Jwua7Rfaw8Jbf5GrxVft2/c

OyLWNqVnYdcVkH5TZ/AT9utDXR3cAJlDVjGQ454pplTQ40poMZJbK7AGxmIZ+7+fiW

JaQcYML9Qummw==

Received: from [127.0.0.1] (vmi3373381.contaboserver.net [212.47.79.9])

by mail.voicemailvoip.online (Postfix) with ESMTPSA id 9B56C4223C

for ; Mon, 15 Jun 2026 20:11:48 +0000 (UTC)

Message-ID: <13c03ca1-4d67-452b-8309-27cac4ac581d@voicemailvoip.online>

List-Unsubscribe:

From: Canada Revenue Agency

To: sales@nk.ca

Subject: Canada Revenue Agency (CRA) shared a file

Date: Mon, 15 Jun 2026 20:11:48 +0000

MIME-Version: 1.0

Content-Type: text/plain

X-Spam_score: 16.0

X-Spam_score_int: 160

X-Spam_bar: ++++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview:



Content analysis details: (16.0 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

2.3 EMPTY_MESSAGE Message appears to have no textual parts and no

Subject: text

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[212.47.79.9 listed in will-spam-for-food.eu.org]

[212.47.79.9 listed in will-spam-for-food.eu.org]

[212.47.79.9 listed in will-spam-for-food.eu.org]

[212.47.79.9 listed in will-spam-for-food.eu.org]

[212.47.79.9 listed in will-spam-for-food.eu.org]

[212.47.79.9 listed in will-spam-for-food.eu.org]

[212.47.79.9 listed in will-spam-for-food.eu.org]

[212.47.79.9 listed in will-spam-for-food.eu.org]

[92.113.145.149 listed in will-spam-for-food.eu.org]

[92.113.145.149 listed in will-spam-for-food.eu.org]

[92.113.145.149 listed in will-spam-for-food.eu.org]

[92.113.145.149 listed in will-spam-for-food.eu.org]

[92.113.145.149 listed in will-spam-for-food.eu.org]

[92.113.145.149 listed in will-spam-for-food.eu.org]

[92.113.145.149 listed in will-spam-for-food.eu.org]

[92.113.145.149 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[92.113.145.149 listed in dnsbl.ahbl.org]

[92.113.145.149 listed in dnsbl.ahbl.org]

[92.113.145.149 listed in dnsbl.ahbl.org]

[92.113.145.149 listed in dnsbl.ahbl.org]

[212.47.79.9 listed in dnsbl.ahbl.org]

[212.47.79.9 listed in dnsbl.ahbl.org]

[212.47.79.9 listed in dnsbl.ahbl.org]

[212.47.79.9 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[92.113.145.149 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[92.113.145.149 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[92.113.145.149 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[92.113.145.149 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_SBL_XBL RBL: Received via a relay in Spamhaus SBL+XBL

[212.47.79.9 listed in sbl-xbl.spamhaus.org]

3.6 RCVD_IN_SBL_CSS RBL: Received via a relay in Spamhaus SBL-CSS

[212.47.79.9 listed in zen.spamhaus.org]

-0.0 SPF_PASS SPF: sender matches SPF record

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

0.0 T_PDS_OTHER_BAD_TLD Untrustworthy TLDs

[URI: voicemailvoip.online (online)]

1.3 BODY_EMPTY Empty message body !

1.3 RDNS_NONE Delivered to internal network by a host with no rDNS

2.0 RATWR8_MESSID Message-ID with excessive dashes and dollars

0.5 FROM_SUSPICIOUS_NTLD From abused NTLD

2.0 FROM_SUSPICIOUS_NTLD_FP From abused NTLD

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[92.113.145.149 listed in bl.score.senderscore.com]

Subject: {SPAM?} Canada Revenue Agency (CRA) shared a file



Bitcon PAypal phish from Microsoft Outlook PArt 3

Content analysis details: (16.3 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[209.85.128.72 listed in will-spam-for-food.eu.org]

[209.85.128.72 listed in will-spam-for-food.eu.org]

[209.85.128.72 listed in will-spam-for-food.eu.org]

[209.85.128.72 listed in will-spam-for-food.eu.org]

[209.85.128.72 listed in will-spam-for-food.eu.org]

[209.85.128.72 listed in will-spam-for-food.eu.org]

[209.85.128.72 listed in will-spam-for-food.eu.org]

[209.85.128.72 listed in will-spam-for-food.eu.org]

[2603:10b6:930:89:cafe:0:0:a5 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:930:89:cafe:0:0:a5 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:930:89:cafe:0:0:a5 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:930:89:cafe:0:0:a5 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:930:89:cafe:0:0:a5 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:930:89:cafe:0:0:a5 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:930:89:cafe:0:0:a5 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:930:89:cafe:0:0:a5 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:930:89:0:0:0:25 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:930:89:0:0:0:25 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:930:89:0:0:0:25 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:930:89:0:0:0:25 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:930:89:0:0:0:25 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:930:89:0:0:0:25 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:930:89:0:0:0:25 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:930:89:0:0:0:25 listed in]

[will-spam-for-food.eu.org]

[40.93.23.99 listed in will-spam-for-food.eu.org]

[40.93.23.99 listed in will-spam-for-food.eu.org]

[40.93.23.99 listed in will-spam-for-food.eu.org]

[40.93.23.99 listed in will-spam-for-food.eu.org]

[40.93.23.99 listed in will-spam-for-food.eu.org]

[40.93.23.99 listed in will-spam-for-food.eu.org]

[40.93.23.99 listed in will-spam-for-food.eu.org]

[40.93.23.99 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[40.93.23.99 listed in dnsbl.ahbl.org]

[40.93.23.99 listed in dnsbl.ahbl.org]

[40.93.23.99 listed in dnsbl.ahbl.org]

[40.93.23.99 listed in dnsbl.ahbl.org]

[209.85.128.72 listed in dnsbl.ahbl.org]

[209.85.128.72 listed in dnsbl.ahbl.org]

[209.85.128.72 listed in dnsbl.ahbl.org]

[209.85.128.72 listed in dnsbl.ahbl.org]

[2603:10b6:930:89:cafe:0:0:a5 listed in]

[dnsbl.ahbl.org]

[2603:10b6:930:89:cafe:0:0:a5 listed in]

[dnsbl.ahbl.org]

[2603:10b6:930:89:cafe:0:0:a5 listed in]

[dnsbl.ahbl.org]

[2603:10b6:930:89:cafe:0:0:a5 listed in]

[dnsbl.ahbl.org]

[2603:10b6:930:89:0:0:0:25 listed in]

[dnsbl.ahbl.org]

[2603:10b6:930:89:0:0:0:25 listed in]

[dnsbl.ahbl.org]

[2603:10b6:930:89:0:0:0:25 listed in]

[dnsbl.ahbl.org]

[2603:10b6:930:89:0:0:0:25 listed in]

[dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[40.93.23.99 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[40.93.23.99 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[40.93.23.99 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[40.93.23.99 listed in dnsbl.ahbl.org]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[40.93.23.99 listed in bl.score.senderscore.com]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[40.93.23.99 listed in list.dnswl.org]

-0.0 SPF_PASS SPF: sender matches SPF record

1.0 HK_RANDOM_REPLYTO Reply-To username looks random

Bitcon PAypal phish from Microsoft Outlook PArt 4







3.5 VOWEL_FROM_7 Impronouncable from header (7+ consecutive vowels)

0.5 FROM_LOCAL_NOVOWEL From: localpart has series of non-vowel letters

1.0 HK_RANDOM_FROM From username looks random

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[40.93.23.99 listed in wl.mailspike.net]

-0.0 T_RP_MATCHES_RCVD Envelope sender domain matches handover relay

domain

0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in digit

[haressaznzxrrsxaxz321(at)gmail.com]

0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider

[haressaznzxrrsxaxz321(at)gmail.com]

0.0 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level mail

domains are different

0.3 LONGWORD BODY: Uses overlong words

2.6 HK_SCAM_N13 BODY: No description available.

0.6 MEGALONGWORD BODY: Uses really overlong words

0.1 TW_RW BODY: Odd Letter Triples with RW

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

2.0 RATWR8_MESSID Message-ID with excessive dashes and dollars

0.2 FREEMAIL_FORGED_FROMDOMAIN 2nd level domains in From and EnvelopeFrom

freemail headers are different

0.1 TO_IN_SUBJ To address is in Subject

3.0 LONG_INVISIBLE_TEXT Long block of hidden text - bayes poison?

Subject: {SPAM?} =?UTF-8?Q?Pozv=C3=A1nky=3A_Important_Transaction_Alert_=2D_BTC_Order_S?=

=?UTF-8?Q?ubmitted_=40_po_15=2E_j=C3=BAn_2026_=28cynthiaperez389903=40groups=2Eoutlo?=

=?UTF-8?Q?ok=2Ecom=29?=





Haresasz Nxysarwsa has invited you to Important Transaction Alert – BTC Order Submitted

Title: Important Transaction Alert – BTC Order Submitted

When: June 15, 2026

Organizer:

Haresasz Nxysarwsa

Description: Dear Customer,



This email confirms that your PayPal payment for Bitcoin has been received and your order is now under review.



Transaction Overview:



Payment Method: PayPal

Asset Purchased: Bitcoin (BTC)

Amount Paid: $500.00

Current Status: Under Review



Our security team is currently validating the transaction. Once approved, your order will be completed automatically.



If you did not authorize this activity, please call +1 832 631 9067 immediately to prevent further processing.



Thank you for your prompt attention.



Sincerely,

Customer Support Team

Attendees:



cynthiaperez389903@groups.outlook.com





Dear Customer,



This email confirms that your PayPal payment for Bitcoin has been received and your order is now under review.



Transaction Overview:



Payment Method: PayPal

Asset Purchased: Bitcoin (BTC)

Amount Paid: $500.00

Current Status: Under Review



Our security team is currently validating the transaction. Once approved, your order will be completed automatically.



If you did not authorize this activity, please call +1 832 631 9067 immediately to prevent further processing.



Thank you for your prompt attention.



Sincerely,

Customer Support Team

Kedy

pondelok 15. jún 2026

Organizátor

Haresasz Nxysarwsa

haressaznzxrrsxaxz321@gmail.com

Hostia

(Zoznam hostí bol na žiadosť organizátora skrytý)

Odpoveď na cynthiaperez389903@groups.outlook.com

Áno



Nie



Možno

Ďalšie možnosti



Pozvánka z Kalendára Google



Túto správu ste dostali, pretože ste účastníkom danej udalosti.



Ak túto pozvánku prepošlete, ktorýkoľvek jej príjemca bude môcť odoslať odpoveď organizátorovi, byť pridaný do zoznamu hostí, pozývať iných bez ohľadu na ich vlastný stav pozvánky alebo meniť vaše potvrdenie účasti. Ďalšie informácie



Bitcon PAypal phish from Microsoft Outlook PArt 2

X-MS-PublicTrafficType: Email

X-MS-TrafficTypeDiagnostic: CY4PEPF0000FCC0:EE_|DM3PPFA15A4F67D:EE_

X-MS-Office365-Filtering-Correlation-Id: a86d4f73-f7f5-4f80-481c-08decb058942

X-MS-Exchange-EOPDirect: true

X-Sender-IP: 209.85.128.72

X-SID-PRA: HARESSAZNZXRRSXAXZ321@GMAIL.COM

X-SID-Result: PASS

X-MS-Consumer-Group-Expansion-Loop: cynthiaperez389903@groups.outlook.com

X-MS-Exchange-Group-Expansion-Loop: cynthiaperez389903@groups.outlook.com

X-Microsoft-Antispam:

BCL:0;ARA:1444111002|32020799003|26000799027|4040799016|9400799043|34130799006|9020799019|26130799012|9000799056|16001999021|1680799066|24102599021|6092099016|22000799015|5139299004|3151999006|6149299003|3069299007|6019299003|16200799027|29080799009|970799063|3412199025|4302099013|440099028|18021999003|30041999003|2145499017|1370799030|1360799030|1380799030|26104999009|21002599022;

X-Microsoft-Antispam-Message-Info:

=?utf-8?B?ZXlYaG9kQXJ3NjJza2Uvb1RLc3ArWXE2ZWp6V1BMRmQ3ZzBrVERxN0U3SzNi?=

=?utf-8?B?N0hYZmJMc1VuZTVseGkxV1BLbDRZMElxZ2pwVVNKek5OQXNibVJBdTZ6bmRL?=

=?utf-8?B?MEJhMENvYXBaVU1zaHpoY08vQ1p2Q3NWcDJFcU1WZmI5VEFISTdnYzk0REV0?=

=?utf-8?B?by9sNnF2d2l5UERxZHlvSFo5dzVPT2FseUhNYytuUTg1Wm9USlBMQzk1T21P?=

=?utf-8?B?b0VqenRWN1NkTWhLaWFGS1pCc1R0OVVuRy8xQkxGdTZCOS8rZmxkRng0V0xW?=

=?utf-8?B?NE5oaVZLbGxKWThaUzVMSkRFeDZVNGw0K2dUbG9EV1hiR0FyZnBzNW9XTHov?=

=?utf-8?B?eHZNd0JKT2JSdlo1U2Q3UG9LcFZyUjgzMTExUDRUOG1zYlNBejZSczArR1A2?=

=?utf-8?B?QVJoTkE1eGJHc1ZMeDRWQkJPQ3ZDUVJrc2R1YzBaTE5IeXEwUHpBWStuQlJw?=

=?utf-8?B?Zy84Z2p3QzE2VlByeWZSV2hnVUJ3Q2tibFJXWS9QMzZuUmFwV2Nwd2lsbVNC?=

=?utf-8?B?S3IzSzlIbktJTzBwZ0NhUHVlcld4MWtGbE01OXM2Q0FoZHFVc3ZzZjdnekxa?=

=?utf-8?B?S25RTjBHVVB2K1M1WjJYRGdFL0E1aGdkeDd1Y3k0SjgweU12cFhGS0QyalRn?=

=?utf-8?B?M200VnhlL3JlaWNxWG1wcTZ3VDFmdE04bXBwSXZIcGlIaityeFB4SGsvaGxN?=

=?utf-8?B?VXI4ZUF2VFk0ZEcvVkt1VXkrODFDeEV3VTRmUnJrMTFxRTZBcXBaRTh1aXhQ?=

=?utf-8?B?ZGtjcjBpN0M0T3c2aTdWaFBVR05rTWgrMTNBQk9YNXVEdGdnSGlEQW5xV3Qw?=

=?utf-8?B?c2pUUTZkajJ4S1c3djNzS0g1bHhxbDlCYURrMmNsTEJPMTZzZzYwMy9Jc2JY?=

=?utf-8?B?ZTdMSEx1YUp6VFpNeWJmODdIbjI3cXJUcVdndVlaSVVHTjdNMVorSGl2dGZv?=

=?utf-8?B?bnYrQTE5QkVaa2FFRi9rZStaOGZGTEE3ZWdJS2Rkc0Q5WUlacVNKVWQrZlk2?=

=?utf-8?B?UFBrbSthZkhQL3YzWWNWWGZNRTNqbDBNT1htZEp4bk04OThScS9KVnUwdmc4?=

=?utf-8?B?bXgxOUFuS281ZHVReCtuTU5PRm02ZUlWTkhzM1hObENwaXJvZlkzL2J0dlJl?=

=?utf-8?B?c3gxMEZWOHVFV3pTc25PS0hKY3NtNytJRmN6NmNzT2pXVjlNZHNmcFl3K0g3?=

=?utf-8?B?QTV4dHRpWms5cW1objNtbTNsa203VWZrZVpFK1NFeUc1WXh4WUI2MlphdXRS?=

=?utf-8?B?MWU5TGd1LzROVFNUZ1RJdmhqWTgxNHJ4OTBHcjB1dlN6NXE1bVdXZzIrYXNW?=

=?utf-8?B?OGx2VW9NNlpKYmNKMnRlRFV3eE1wQys5RUp6QkwxV243SkcxMzk0SXlLWUpY?=

=?utf-8?B?VGtpTmxIZ2xQU2ljZ3ZWOHIvdTFWeDcyWVY1MXlyckdRYjBUZWJUbmFXRXhD?=

=?utf-8?B?TFRCZy9CMGZ0UG8rWE12dWNzZ2hQQkJKVUJrRVNueTBzY3psUG1aalZVUFdQ?=

=?utf-8?B?TUNRN0pWdDIwTXhSd3plMlh6YmhTaFA0Z3lXOG5sYzY3VVl1TjcwSDVWWTVP?=

=?utf-8?B?aGFVcnhDRDdlaGdpckRLckZ1Skxucld2ek44NHhiREo1eGxBQ0FVQkxidG9M?=

=?utf-8?B?Q1FhYkE1Q2tvVmlvMDhTUnBPUTFqSEVWMUg0UmpSeTd2TWtrZDQyZWhVdEdY?=

=?utf-8?B?NFNockNyNFBCVEZ3RVozY3BxSEdWQmhCdCs3Z3NOU3RNSjFvV0pMelJRL0xi?=

=?utf-8?B?SUxVUkU5RWl0SmZ2ZXQyRzViQ2J0Z3loSWVpb0tPNFNQVEZrT2NuMmFkVWJS?=

=?utf-8?B?cXRoOGtLTWVnKzUybDZlVEtlMFF3L2U5Skk4ZnR1WFc5WFNXZHpYdUpQYS91?=

=?utf-8?B?TW5SVmRjc3dvUHpsVVY0U3c5RTBLRU9LMUd0aUg0djhxckRHWncxem9HNU1p?=

=?utf-8?B?Z294UFE2VzU5WnhiMUpOVzAvWCtmMjJhSEMvUy91dW03MDgrTURsaEtHTmho?=

=?utf-8?B?M2tNRUFGaUdiT2VzWHFFdTU3aEp1bzQ1ZUwrSDltNVlTdzFVdGJSTmtYdU9u?=

=?utf-8?B?bE9ubTA1RE5Gdyt6Z0YzeHJnUFhUa0RjRkNxVS9DUWM3RjdBaCt6V1hFZ2xu?=

=?utf-8?B?eXg0aFc5bjA4b3ZDSmtRdTRNSlBYbWlZY3phWEtnMWMxRkoza3ByQnY5Zklr?=

=?utf-8?B?WkFvb1gvM2QrTndTWUpRLzVsT1BHMTRZL1AxU2xrSGFGOU45SWVBMlBkeGFV?=

=?utf-8?B?dGYxZ1JiSVZQS25UcW5HTHhVVm9Hd2NkcklEYnUvdElVYStuUnZKYWNzM2VM?=

=?utf-8?B?NzVmVVRDZnE2ZndNUlRuNzBGVzhGYkxyT2NqeVlLODBJaUxhSnE2aTBlcmUx?=

=?utf-8?B?TWVnVlRJV2dsQ2hqQnpxNmNhTVlVNlZWbGtQTGhJbFBxSVIzbktiT3ZSOXJ5?=

=?utf-8?B?aTNLK3ZPa0tiSWJZUlJxQkhHTzJrQ3pZTVBrakk1cTgvRlNBa01yR28rVG1Y?=

=?utf-8?B?eWNLNGVHZVZsZ0dvUjdVb3BpLzBXa0hHNU1GdndRZjV0QWsvcDFTWjIwYmQz?=

=?utf-8?B?TXhweWh5SHhwQ2lVMU5LeHp3bWowd2Ezbm9YY1AxTitOd09nUWtacDEzYThL?=

=?utf-8?B?MmI2Z3VOaFFiU3NHL3BxMll4TFMrLythMHR2dWFTM3BJanVYYWZpVGxqSzkr?=

=?utf-8?B?T29peXEwVjNVZFhLaDB6UDNCQjh6UVpxWU1uT0w0RDRlN1dBd2gxblRiUFc0?=

=?utf-8?B?akdvdEgyUDVocE5OVnIraGpyTFViN3gvYUNTQkNaSFducU5FZkUxV0h6SFdK?=

=?utf-8?B?b21NNGs4OElJQWZYZTFtdjdxYnczQVUvbCt4b2ZJdGNPdWZxd1BuWDlDZ1VG?=

=?utf-8?B?K3o5SDJwMktXYmxieWJaRUc5UEI1NFRoRDNEelU5NktRWFhKNUZKYXJHcnpV?=

=?utf-8?B?K0dVcFJLR0J4ZW5pbFZaZXBERGh3RVNWMW8xcFQ4OXdXOW9abmFNQTZ6enhE?=

=?utf-8?B?L2J2cG83TGJOdERRZC9RMmNWN0tRUTUzOGExeXQ0cGNtM2xCbm41SGlsR3hu?=

=?utf-8?B?ZkxTVGhLS2dWcXYyZTZORytrbzBQeGlWSnFOTks2TTFYMzFqSkwxWVFBM2ov?=

=?utf-8?B?bk11RzkxZVpPeFJERGFkeVdoRlFOTmJYbDZXTktKWnljeDlaR3laRE50WXlD?=

=?utf-8?B?M3ZiNloyeGxjS25QSU5mZzRDTFZWU3RTN0lQamdxZDJPbU1qSHJteHFuYWl1?=

=?utf-8?B?QkFqWnN1ZHFMbTNZVzNZZlhsRDJCaVdpd1RMRTVLVEtiWWd4L3ZyV2dySEh5?=

=?utf-8?B?NXlZUEwydTkzYzJEWnlKd1gveWZvQkd6aGl5ZVpKejNaYnUvdDU1VU1iVlVI?=

=?utf-8?B?dW1ZaDFWVXNROENNdENnUGVDSWN1bGgxQmVLb2k5VStwa1VYTUl1V1RwN1V3?=

=?utf-8?B?M0VCYnFUR3dvNTU3dkdIL2hQeE5LbzlrMzBnUkVyTzc1OWNDYXFNTjBxRVRs?=

=?utf-8?B?YjJpdmxqL0hQbUxKRGhya2p5TU1LdERwanNOKzd5Zk84WWxxbjBLT1gzNmY1?=

=?utf-8?B?K0VJRm00Nm1PVmp1NytTNzlweXZzc1JoNlZma3hsWVMydFhTQmNxVmlCU0to?=

=?utf-8?B?Q1gyeGM4Yk0vUGdsM2JtWHl0VzBFakhXbkZBVW12TVJOTngxUk94QjFRQ0xH?=

=?utf-8?B?SU9zaW9tTlM3cTMwRmRndkNGcVZPcUVUMXhaTEhJZDNZUmdCVm1zUjJHeGRk?=

=?utf-8?B?L3o1U3o0QVhQdUE2V0V3OHVGVnVpTjdYK0F1UTJGNWRZVDZVSnpXYVlwUEJq?=

=?utf-8?B?Vnl0SkRqeHBkbkkxaWRjNGladHA0K25rVTRGKzdoeTVzUXNVQTVPeGFyWnBu?=

=?utf-8?B?b05xUHNZdHRxbThRL0RacHZwcUNXRGt2UVRxM2IzR3BpUkhaSTVtZS9RdXE5?=

=?utf-8?B?bHNoRnJKRndSQjdTOXBvb2R4K2xmcmpFbEF1U0x6dmlERWQ1TUV4TEp0TzBE?=

=?utf-8?B?MzZySWJsR3YwNjB2YlRGelZUSGFjT3IwS3JwZWRuNmNJeThkRDAxcHc9PQ==?=

X-Auto-Response-Suppress: DR, OOF, AutoReply

X-OriginatorOrg: sct-15-20-9412-4-msonline-outlook-090a5.templateTenant

X-MS-Exchange-CrossTenant-OriginalArrivalTime: 15 Jun 2026 17:42:57.1049

(UTC)

X-MS-Exchange-CrossTenant-Network-Message-Id: a86d4f73-f7f5-4f80-481c-08decb058942

X-MS-Exchange-CrossTenant-Id: 84df9e7f-e9f6-40af-b435-aaaaaaaaaaaa

X-MS-Exchange-CrossTenant-AuthSource: CY4PEPF0000FCC0.namprd03.prod.outlook.com

X-MS-Exchange-CrossTenant-AuthAs: Anonymous

X-MS-Exchange-CrossTenant-FromEntityHeader: Internet

X-MS-Exchange-Transport-CrossTenantHeadersStamped: DM3PPFA15A4F67D

X-Spam_score: 16.3

X-Spam_score_int: 163

X-Spam_bar: ++++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Important Transaction Alert – BTC Order Submitted pondelok

15. jún 2026 Dear Customer, This email confirms that your PayPal payment

for Bitcoin has been received and your order is now under review.

Bitcoin paypal phish from Microsoft Part 1

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Mon, 15 Jun 2026 18:50:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wZHzd-00000000M50-0BXs

for dave@doctor.nl2k.ab.ca;

Mon, 15 Jun 2026 18:49:29 -0600

Resent-From: The Doctor

Resent-Date: Mon, 15 Jun 2026 18:49:28 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-westus3azlp17010099.outbound.protection.outlook.com ([40.93.23.99]:30224 helo=PH7PR06CU001.outbound.protection.outlook.com)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wZBLm-00000000BTF-1pPh

for doctor@doctor.nl2k.ab.ca;

Mon, 15 Jun 2026 11:44:06 -0600

Received: from CYZPR05CA0004.namprd05.prod.outlook.com (2603:10b6:930:89::25)

by DM3PPFA15A4F67D.namprd18.prod.outlook.com (2603:10b6:f:fc00::6bb) with

Microsoft SMTP Server (version=TLS1_2,

cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.113.16; Mon, 15 Jun

2026 17:42:57 +0000

Received: from CY4PEPF0000FCC0.namprd03.prod.outlook.com

(2603:10b6:930:89:cafe::a5) by CYZPR05CA0004.outlook.office365.com

(2603:10b6:930:89::25) with Microsoft SMTP Server (version=TLS1_3,

cipher=TLS_AES_256_GCM_SHA384) id 15.21.139.11 via Frontend Transport; Mon,

15 Jun 2026 17:42:57 +0000

Authentication-Results: spf=pass (sender IP is 209.85.128.72)

smtp.mailfrom=gmail.com; dkim=pass (signature was verified)

header.d=google.com;dkim=pass (signature was verified)

header.d=gmail.com;dmarc=pass action=none header.from=gmail.com;compauth=pass

reason=100

Received-SPF: Pass (protection.outlook.com: domain of gmail.com designates

209.85.128.72 as permitted sender) receiver=protection.outlook.com;

client-ip=209.85.128.72; helo=mail-wm1-f72.google.com; pr=C

Received: from mail-wm1-f72.google.com (209.85.128.72) by

CY4PEPF0000FCC0.mail.protection.outlook.com (10.167.242.102) with Microsoft

SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.139.8

via Frontend Transport; Mon, 15 Jun 2026 17:42:57 +0000

X-IncomingTopHeaderMarker:

OriginalChecksum:ED5E595A5DC91789FCF5FFCDB3BD051C84EBDE0C105434EDCD7D71604EF4FE1C;UpperCasedChecksum:DC3A0034ED7646F3EECF717E6410C2048B579D7A40180C27775EFEF9B7D89BC4;SizeAsReceived:3409;Count:15

Received: by mail-wm1-f72.google.com with SMTP id 5b1f17b1804b1-490b0682d2fso32743765e9.0

for ; Mon, 15 Jun 2026 10:42:57 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=google.com; s=20251104; t=1781545375; x=1782150175; darn=groups.outlook.com;

h=to:from:subject:date:message-id:sender:reply-to:mime-version:from

:to:cc:subject:date:message-id:reply-to;

bh=LFDqi1X73Dl3P9kxl5V30roktBb+Yg1jwONMqwuE0fs=;

b=MZLJ16nMCBM5JFOLPnGkKVp6O1lNhTJpA3gDIboqiv6R/irxnPtq8ZuVmUZZS1h4Zj

n6Ac8dW4TvG+ytW+2MLYVC3fO0doOL4vBxYdmKCz1XWgPF/jLCZwMY4lEgO+rcbI9CRF

SpDhEAtkRzD28ecRjf+msnbQLAuXuIHCWmcT3r+olPzrIPEw0l0gkRvHtXialzxxwF+f

r+4BWDI+eIjpQcUzk47foX46aE25WEuBaK0XxH2jsPLckt3qrxDqvOvc5L6frGnvmmf0

ovpBB5LjwHpMM4sBoevqRImhLuwwFa7dEbdsRVzTXa0HzSgYNHmATqz12b/ipBMcMK7p

fLmQ==

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=gmail.com; s=20251104; t=1781545375; x=1782150175; darn=groups.outlook.com;

h=to:from:subject:date:message-id:sender:reply-to:mime-version:from

:to:cc:subject:date:message-id:reply-to;

bh=LFDqi1X73Dl3P9kxl5V30roktBb+Yg1jwONMqwuE0fs=;

b=H/jE2kED28avlpsdLGPgThXd28GEZO1dIo99l4sMaajMG+xB+kufrcLmdYOedfVPub

wwlKGNuy71K5rgi0d+xWj7u1Ljab5IuR7alennbtlFEdsoMDvSl3gdNZww6enIbyVtRM

dt0/ITjqBhrGnC9Tua71ZO3VI//XU6aP1TbfnF1HtWQsX8f2pfj7E0nFk6JIUgyjYibs

1aIKomuBuX8gWKW2phHpyi+Ru2cjMgJv9kRfSiTioQT1KMfDNiFH4nMzuJwPhyo8uQEU

zgCK/hZ6q0Tb8O4RscQ/43KF0W1+JPM60ZWz72KpemNY0duvHj4XpKPIFgzJpB9jRV1k

cM4A==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20251104; t=1781545375; x=1782150175;

h=to:from:subject:date:message-id:sender:reply-to:mime-version

:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to;

bh=LFDqi1X73Dl3P9kxl5V30roktBb+Yg1jwONMqwuE0fs=;

b=OarY8EeboeA8ILh/q1HxitaoF//S2hyH9asa7kmT8Z5UAVAv2dZKimcs0vWCf+xZCw

tljBmzN+8hhLwDH40c7PHM8Xnsm8ODYyJ7dmpobspO8v/GYn2jzV3Fjn2mlNzyfeAsCA

VRCkiia+pcYORmlCUIytgPvF55D5TyBfQrWuJC+BHIWX2suxc6Eal7m8o0uCr9TkBKCV

v1vm62KGKwy8dyUu+c/tagYo1ciAWzvE6lfMJ5JlNtR0l/GSrlN20HawF50uejCAX6OW

dg6rD6tuCBVpxa6XNAUOqTP+6PbqqTf9LjZECJqLg6h7lj80STDIg2qgkCHXBn9KH7Bl

navw==

X-Gm-Message-State: AOJu0YytWacb9rpbKQ0+xlPFHnFQoP4YKOJw8jkKT3RLF2VS1A5etZF+

6cmTgSyVfrdj8+eIWaeOXNTuCaNy+02WOu73wH5CtHvtVbuxc+8WAdoF/CuJcbh1asN4Tv/hyWT

HGFAGiFRNZnSOin7t54h/qn62jSiRMsKN/AE=

MIME-Version: 1.0

X-Received: by 2002:a05:600c:4e48:b0:490:e60b:6860 with SMTP id

5b1f17b1804b1-4922005e235mr143868745e9.7.1781545375111; Mon, 15 Jun 2026

10:42:55 -0700 (PDT)

Reply-To: Haresasz Nxysarwsa

Sender: =?UTF-8?Q?Kalend=C3=A1r_Google?=

Message-ID:

Date: Mon, 15 Jun 2026 17:42:55 +0000

Subject: =?UTF-8?Q?Pozv=C3=A1nky=3A_Important_Transaction_Alert_=2D_BTC_Order_S?=

=?UTF-8?Q?ubmitted_=40_po_15=2E_j=C3=BAn_2026_=28cynthiaperez389903=40groups=2Eoutlo?=

=?UTF-8?Q?ok=2Ecom=29?=

From: Haresasz Nxysarwsa

To: cynthiaperez389903@groups.outlook.com

Content-Type: multipart/mixed; boundary="0000000000003c1e6606544e5ba8"

X-IncomingHeaderCount: 15

X-EOPAttributedMessage: 0

X-EOPTenantAttributedMessage: 84df9e7f-e9f6-40af-b435-aaaaaaaaaaaa:0

chinese productus psam Part 2

hi 亲们

我们这边是深圳市云松跨境物流有限公司,专注于降低物流成本,

目前我们帮单一客户节省了30万美元的成本。我们擅长DDU,DDP,LDP等贸易条款,可以合理的帮您优化物流成本,减少支出。



下面是我们的DDP到门的价格,惊喜的是,不到RMB7.5/KG就可以发一箱货到加拿大,

下面是我们的海运散货价格,有需要多多联系哦。

烦请您动动发财小手扫下二维码,添加微信,方便联系沟通哦。

祝您万事如意,生意兴隆,货如轮转,财源滚滚。



整柜价格到门价格,DDP到门

起运港 目的港 价格(40HQ) 备注

深圳/广州/宁波/上海/义乌/青岛/天津/长沙/郑州/佛山/中山/泉州 温哥华 10220 整柜包含海运费,清关,关税,派送

埃德蒙顿 6814

卡尔加里 6814

多伦多 9880

蒙特利尔 9880

温尼泊 9993



散货价格

起运港 目的港 价格(40HQ) 备注

深圳/广州/宁波/上海/义乌/青岛/天津/长沙/郑州/佛山/中山/泉州 温哥华 8.3 散货包含海运费,清关,关税,派送

埃德蒙顿 7.5

卡尔加里 7.5

多伦多 8.1

蒙特利尔 8.1

温尼泊 8.2



举例,如果您的货物是散货,下面是一些价格参考,具体可以问我们,DDP到门。

起运港 目的港 价格 体积CBM 重量KG 总价RMB 备注

深圳/广州/宁波/上海/义乌/青岛/天津/长沙/郑州/佛山/中山/泉州 多伦多 8.1 1 150 1352.7 散货包含海运费,清关,关税,到仓库

8.1 3 450 4058.1

8.1 5 750 6763.5

8.1 8 1200 10821.6

8.1 10 1500 13527

8.1 15 2250 20290.5

8.1 20 3000 27054



















Stay ahead with timely announcements by tapping . Enable Future Notices



If you want to reduce emails, hit Control Frequency.





Miss Julin



深耕美加专线13年



DDU/DDP双清专线,让您省心省力省钱



Shenzhen Yunsong Cross-border Logistics Co.,Ltd



Room 2806, 28th Floor, Building 1, Evergrande Metropolis Plaza, Bantian Street, Longgang District,



Shenzhen City, Guangdong, China



深圳市龙岗区坂田街道马安堂社区环城南路15号



恒大都会广场1栋2806



Phone : 13798412845



Email: julin@yunsongfreight.com











在2026-06-13,Julin 写道:



-----原始邮件-----

发件人: Julin

发件时间: 2026年06月13日 周六

收件人: [sales ]

主题: 加拿大FOB/DDP/LDP ,一箱也能发



Hi 亲们



我是深圳市云松跨境物流有限公司的Julin,



我们专注于美加欧澳墨西哥国际物流13年,能做CIF,FOB ,DDU,DDP,LDP等条款.

下面是不同的重量发加拿大的价格,一箱也能发,几百元就到加拿大,双清包税到门。

欢迎扫码加微信,随时详聊!DDU/DDP双清专线让您省心省力省钱。

祝您万事如意,生意兴隆,货如轮转,财源滚滚。





散货价格

起运港 目的港 价格(40HQ) 备注

深圳/广州/宁波/上海/义乌/青岛/天津/长沙/郑州/佛山/中山/泉州 温哥华 8.3 散货包含海运费,清关,关税,派送

埃德蒙顿 7.5

卡尔加里 7.5

多伦多 8.1

蒙特利尔 8.1

温尼泊 8.2







Maintain your product-savvy edge with . Stay Updated on News



If you prefer to exit, choose Review Communication Options.





Miss Julin



深耕美加专线13年



DDU/DDP双清专线,让您省心省力省钱



Shenzhen Yunsong Cross-border Logistics Co.,Ltd



Room 2806, 28th Floor, Building 1, Evergrande Metropolis Plaza, Bantian Street, Longgang District,



Shenzhen City, Guangdong, China



深圳市龙岗区坂田街道马安堂社区环城南路15号



恒大都会广场1栋2806



Phone : 13798412845



Email: julin@yunsongfreight.com

Chinese productus spam part 1

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Mon, 15 Jun 2026 18:50:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wZHzU-00000000LuH-17kB

for dave@doctor.nl2k.ab.ca;

Mon, 15 Jun 2026 18:49:20 -0600

Resent-From: The Doctor

Resent-Date: Mon, 15 Jun 2026 18:49:20 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from [103.126.93.243] (port=57418 helo=mail-m93243.xmail.ntesmail.com)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wZBEe-00000000BFP-3VM4

for sales@nk.ca;

Mon, 15 Jun 2026 11:36:48 -0600

Content-Type: multipart/alternative; BOUNDARY="=_Part_68594_398023881.1781544932115"

To: sales

Reply-To: julin@yunsongtrans.com

Subject: =?UTF-8?B?5LuF6ZyA5Yeg55m+5YWD77yM6L275p2+5bCG6LSn54mp5Y+R6YCB6Iez5Yqg5ou/5aSn?=

X-Priority: 3

MIME-Version: 1.0

Received: from julin@yunsongtrans.com( [10.139.5.212] ) by ajax-webmail ( [127.0.0.1] ) ; Tue, 16 Jun 2026 01:35:32 +0800 (GMT+08:00)

From: Julin

Date: Tue, 16 Jun 2026 01:35:32 +0800 (GMT+08:00)

X-WM-Tid: 0a9ecc5a52b5d0bdkusydb6067e81632c

DKIM-Signature: a=rsa-sha256;

b=Su1oM+FnOotaYKp9U7tPXTox3CKT5yX9B4bTYyQR4qt7W0d3VkpHv6ktZnL+VajpEZJP2C0d2fmD+NWrjgT0QXlCr+rM9dwlvwbNMHIw8S8gMwsHKQuwVpLoGlIF4L6+o01CMHehqnGd87poBbUAvtjBgm1kvNkfKL4VAwItPp1D2BZ2g6w6fjIOD308tkNd5lR7BiZcDD2xSyji2kZE7pvLJWJJgmI0VpxsDDHNT7bjVh4B7Yqg3FlI8KzxXu0Ymiwsp84xRhDfP/JeLf3ZZD0EybZms5gG5CI9G7R800qa5egqll8dtrkPDBdo52XgA5zXz93jQ1kVnlK+bNJwaw==; c=relaxed/relaxed; s=default; d=yunsongfreight.cn; v=1;

bh=8hJY2x0Ef23jJ6KwyN641Vl6gqNwsB+k0bLz77nRDuU=;

h=date:mime-version:subject:message-id:from;

Message-ID:

X-Spam_score: 6.8

X-Spam_score_int: 68

X-Spam_bar: ++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: ä»…éœ€å‡ ç™¾å…ƒï¼Œè½»æ¾å°†è´§ç‰©å‘é€è‡³åŠ æ‹¿å¤§hi 亲们

我们这边是深圳市云松跨境物流有限公司,专注于降低物流成本,

目前我们帮单一客户节省了30万美元的æ [...]



Content analysis details: (6.8 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[103.126.93.243 listed in will-spam-for-food.eu.org]

[103.126.93.243 listed in will-spam-for-food.eu.org]

[103.126.93.243 listed in will-spam-for-food.eu.org]

[103.126.93.243 listed in will-spam-for-food.eu.org]

[103.126.93.243 listed in will-spam-for-food.eu.org]

[103.126.93.243 listed in will-spam-for-food.eu.org]

[103.126.93.243 listed in will-spam-for-food.eu.org]

[103.126.93.243 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[103.126.93.243 listed in dnsbl.ahbl.org]

[103.126.93.243 listed in dnsbl.ahbl.org]

[103.126.93.243 listed in dnsbl.ahbl.org]

[103.126.93.243 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[103.126.93.243 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[103.126.93.243 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[103.126.93.243 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[103.126.93.243 listed in dnsbl.ahbl.org]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[103.126.93.243 listed in bl.score.senderscore.com]

0.0 T_SPF_TEMPERROR SPF: test of record failed (temperror)

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 HTML_MESSAGE BODY: HTML included in message

1.3 RDNS_NONE Delivered to internal network by a host with no rDNS

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

1.0 VOWEL_URI_5 URI hostname with 5 consecutive vowels

3.0 LONG_INVISIBLE_TEXT Long block of hidden text - bayes poison?

Subject: {SPAM?} =?UTF-8?B?5LuF6ZyA5Yeg55m+5YWD77yM6L275p2+5bCG6LSn54mp5Y+R6YCB6Iez5Yqg5ou/5aSn?=















Web/SEo/App spam from Microsoft Outlook part 2



--_000_TY1PPF5D7DEE1509560F5E765E479BD870C8BE62TY1PPF5D7DEE150_

Content-Type: text/plain; charset="us-ascii"

Content-Transfer-Encoding: quoted-printable



Hi,



I am still waiting for your reply.



Please May I send you a Proposal? If you are interested!



Thank you,

________________________________

From: Paul Allen

Sent: Saturday, June 13, 2026 3:10 PM

Subject: okay



Hello,



Grow your website traffic and Google visibility with our complete SEO packa=

ge offer.



Can we send you the detailed proposal?



Thank you.



--_000_TY1PPF5D7DEE1509560F5E765E479BD870C8BE62TY1PPF5D7DEE150_

Content-Type: text/html; charset="us-ascii"

Content-Transfer-Encoding: quoted-printable








>








s-serif; font-size: 11pt; color: rgb(0, 0, 0);">

Hi,



s-serif; font-size: 11pt; color: rgb(0, 0, 0);">







s-serif; font-size: 11pt; color: rgb(0, 0, 0);">

I am still waiting for your reply.



s-serif; font-size: 11pt; color: rgb(0, 0, 0);">







s-serif; font-size: 11pt; color: rgb(0, 0, 0);">

Please May I send you a Proposal? If you are interested!



s-serif; font-size: 11pt; color: rgb(0, 0, 0);">







color: rgb(0, 0, 0);">

Thank you,








yle=3D"font-size:11pt" color=3D"#000000">From: Paul Allen <PaulAl=

len11225@outlook.com>


Sent: Saturday, June 13, 2026 3:10 PM


Subject: okay


 









-serif; font-size:11pt; color:rgb(0,0,0)">

Hello,



-serif; font-size:11pt; color:rgb(0,0,0)">







-serif; font-size:11pt; color:rgb(0,0,0)">

Grow your website traffic and Google visibility with our complete SEO packa=

ge offer.



-serif; font-size:11pt; color:rgb(0,0,0)">







-serif; font-size:11pt; color:rgb(0,0,0)">

Can we send you the detailed proposal?



-serif; font-size:11pt; color:rgb(0,0,0)">







or:rgb(0,0,0)">

Thank you.










--_000_TY1PPF5D7DEE1509560F5E765E479BD870C8BE62TY1PPF5D7DEE150_--

Web/SEo/App spam from Microsoft Outlook part 1

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Mon, 15 Jun 2026 18:49:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wZHyp-00000000J1x-0M0D

for dave@doctor.nl2k.ab.ca;

Mon, 15 Jun 2026 18:48:39 -0600

Resent-From: The Doctor

Resent-Date: Mon, 15 Jun 2026 18:48:38 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-japanwestazolkn19012054.outbound.protection.outlook.com ([52.103.66.54]:37621 helo=OS8PR02CU002.outbound.protection.outlook.com)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wZ9Ka-000000005wu-1dzv

for root@nk.ca;

Mon, 15 Jun 2026 09:34:42 -0600

ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none;

b=UgggXN4foAvwkMd/YawFwgOX67+/9qf3n478Hhnl7EZaWAjZJ+arUixWkBzKj9zmTdFNi+nTCB7FsPAgCiJRO7u3Pp8TZQVdw8YpBZBJsnhbHzUM0dKziTkUmd7jQ7yAPHXjBOLP91H3DM3rncwpGD+Z7J7SddcuPAavW9+/JyRcH9TS+/hXlJhuboBbO8bWwjfEtK5k3THgQJUxKQIfaipX4rEfSTEUNH4+o6fTgCH4QDjaQhEjbfupBiAPLJLINTASuKAwChyn5b/i3N2C2bNbODddoYo21DVYV4A83HjW3LbmFGDK98DdvFYPUrcG3/E1YFGzlsSTz8+Fp71Y9Q==

ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;

s=arcselector10001;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1;

bh=0Y7X/XEgDNo2GLeDp7vh2xMy8kz6QS3pMfNAOyWIoqQ=;

b=ivMiFwWhMQvH3J1b0F1LSAzZml8M/lyA8k+UKnB6fJjlpn+0EsBgGKlIwkg86sC5tEEvE7sd7mRbzYen6PkZ30gfJDbXpZVXiK/anus7S4uc0rsSuDrntgZ6vJokNWLLRbmt36Vp5E5rsEMxPoG5OyRfx3pJxeOmV8UCPElCsNk+ZY+epAvOcOg8/5HOUMCkuuLL6klP3JmEKm0yAjdvSFhkTPxNcP+3rqzCrzI7zuebkLC11M4TDOG5hOxqsJGKLNatDcSyw7JnfqC3A+1nM6111mmglPOMvImEohC5uwFIYV8faQMmM8ZJxw9OQ/ThTMP1y6onsj4RHi9d8shL4A==

ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=none; dmarc=none;

dkim=none; arc=none

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=outlook.com;

s=selector1;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck;

bh=0Y7X/XEgDNo2GLeDp7vh2xMy8kz6QS3pMfNAOyWIoqQ=;

b=gJHVqjMzFLtOFBQo4lmMqvhCI7o0Ohfss08jV5jyxPF+lRo8q7+b21T3FtCCUaAtbH+qVkjGWMvpc07dL//1CmnFGM4TQXM0y2+QQpH83JBjYL2f6I1K/IxijvEh0E3hWw33qtZNJXEDoUEA8EmvOaxn5CXTztLu2U1Pb6YjCfl7nyRuZzFJjndXHW35hkt0rcaeZTxhQySt4Po1T6XXlezi0XW7BQPqL0heNBuE9/8v2/EYJTAZNKjF6s/xr0t88ewNdveMe4kla2Cef/jMPCbQLAiT9Esbp9RvVET8jTPrvs3OhXEmtP6Qnpusfzwwzpey05FzEZwwDVoev2oAhA==

Received: from TY1PPF5D7DEE150.apcprd01.prod.exchangelabs.com

(2603:1096:408::32a) by JH0PR01MB5988.apcprd01.prod.exchangelabs.com

(2603:1096:990:6c::14) with Microsoft SMTP Server (version=TLS1_2,

cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.113.18; Mon, 15 Jun

2026 15:32:42 +0000

Received: from TY1PPF5D7DEE150.apcprd01.prod.exchangelabs.com

([fe80::f5a7:b5d4:8e25:db23]) by

TY1PPF5D7DEE150.apcprd01.prod.exchangelabs.com

([fe80::f5a7:b5d4:8e25:db23%5]) with mapi id 15.21.0113.015; Mon, 15 Jun 2026

15:32:42 +0000

From: Paul Allen

To: Paul Allen

Subject: Re: okay

Thread-Topic: okay

Thread-Index: AQHc+0a6944h/q4BiUyBx8pUNGUdYLY/wXy3

Date: Mon, 15 Jun 2026 15:32:26 +0000

Message-ID:



References:



In-Reply-To:



Accept-Language: en-US

Content-Language: en-US

X-MS-Has-Attach:

X-MS-TNEF-Correlator:

msip_labels:

x-ms-exchange-messagesentrepresentingtype: 1

x-ms-publictraffictype: Email

x-ms-traffictypediagnostic: TY1PPF5D7DEE150:EE_|JH0PR01MB5988:EE_

x-ms-office365-filtering-correlation-id: 48f78ebc-7cee-4a6d-3386-08decaf356eb

x-microsoft-antispam:

BCL:0;ARA:14566002|15080799012|48001999003|15030799006|8062599012|8060799015|37102599003|19110799012|31061999003|16051099003|45011099003|55001999006|41001999006|2604032031799003|37011999003|704163111799003|51005399006|15001099006|3412199025|440099028|12091999003|102099032|40105399003|56899033|1710799026;

x-microsoft-antispam-message-info:

=?us-ascii?Q?mHHhWwU+ycT7nJgpH1t8Y0EfymSnJ8BjLmO7I+neq2LhilLg4YLlgsYGBCRT?=

=?us-ascii?Q?G+ODFVTa6yS5G1fWCvjOnGJFR29ZZMJ+Faoo1Tsu3euS5/FgNYWbSm0coTXZ?=

=?us-ascii?Q?gn1IIMAO+v7164Zwy6o4jNfKPVWnM4anX8N8/bAWbjtXlUHah6LqCWA2IMtz?=

=?us-ascii?Q?/olqXoiY1xI2EZCp6dr6IYA8znRRugOTber7Y0waRsbi4jS+nJL1Z8auASmP?=

=?us-ascii?Q?Y1u06N4Q6XpLSpS0SeuIOD3sSmzpiZe+QgtU8KA/WW3kNp6//OEN34otIV57?=

=?us-ascii?Q?zwZJTrhEXAhiET12acDwh8AhG9WdpCdK16cOvWA/V3TiU7Kbr2Mu0kvGyzp/?=

=?us-ascii?Q?7rWHwz77x/48UT1sLfFR7MIUTs2fMIiXUYOtgH3uBmQDPCufUOjq2gjjUmob?=

=?us-ascii?Q?kQQHNlD2aKUe0VZpllxq2kigoXwSjQ0+ZTrJtNnG2Nm2FE9kWQ1iUJ9xyDF1?=

=?us-ascii?Q?RVPG0IWerDcuUGYcpCoDqgeC+IMNVAAZ7J4VtxA3lBUXy2/i9Q4+1u56W0Tj?=

=?us-ascii?Q?yQ4P0tQGkuLOlalmh4kD5TXNIcnQdwJVc6luo2XkOIC6f+UozpUM/7X8Igzd?=

=?us-ascii?Q?EWJDu8U9uI++YW37/SnXhoTAgggzU8gC/yluD67bWx/Nuoucrx2Q+mkJKN9Y?=

=?us-ascii?Q?rVa+fG4SsmstWOzaS2Std2Nk2sZiIi9VJ6lf9rNppxsItKiilsCaBVnPuMvo?=

=?us-ascii?Q?cdbSknfUI27iVDkfeCBZPcRfOXHZLkLfugv8LDiPg9obIU2HA9/Z9Ebi6e1Q?=

=?us-ascii?Q?WYWswQbTvQS4TLzjV0AxQ4lc6OUjViAx39ALi4Q8qbRjzVb92MSAfinq0b2u?=

=?us-ascii?Q?fYgbnAAt3czuxKrJIyX4vZ/aUZFLmBcUGgw/Ra5xIHlWFy0jED10Gbgvj8QQ?=

=?us-ascii?Q?CweSTUfDnnW+NwH4WW0rYz4ro6CceG9KEOTeMQKq34otksZ+RIDy6im934+q?=

=?us-ascii?Q?YEWdIzST3ebzC4Mj7hDoHwT731hFITBEuufXJQ6YxYuleIqvjwY2bq6L85oL?=

=?us-ascii?Q?NYfPjW5LvT9i65uqAjJFteTegNcpQGOTG26i0pc97UZgatCt92xzXb+dugE+?=

=?us-ascii?Q?IEizGM/ESNVIUQ8/0E34OAJyclfP/NhWd7GIlyy95hkxMw9EofiXVBGKLsQW?=

=?us-ascii?Q?ANG1t/OktUQsqoIyk81u38PXTs5I6YiQ7N6qJqJxF1T+xeDY/HIbArvfRlVj?=

=?us-ascii?Q?Ak3qD7VWUphEvyXk4b94JSAPGf+gvoTsabrLWGIcXAurzx0M02i/HcXCHaHU?=

=?us-ascii?Q?OGv2cxWIdLAUXBO4JuYsHAJhmskHJgQhqIP5v2zP5zU4sjDzUhFRLC8Vobiy?=

=?us-ascii?Q?UDyGRCbnkf0aRsSD3ltj91G57Klz54nkJ9Zj8tjYvTLDfA=3D=3D?=

x-ms-exchange-antispam-messagedata-chunkcount: 1

x-ms-exchange-antispam-messagedata-0:

=?us-ascii?Q?l2AAdp7kzkfB8vr4siBqHb/z0G17g0JdXqsmhlKL7t3Z5BJmzghITHXZFdVa?=

=?us-ascii?Q?N5YKg/Y2o3YV+5MePCc3mIr9PD7sxlAWwa6EJnTQPiqmQOlzivcVi1UPMUxq?=

=?us-ascii?Q?tuzeRUsAvbnCp5dQWbgkylAPNu1e/DcclHrEQx3qndlh7uoajldjpGqf+FU4?=

=?us-ascii?Q?P1hF7jxrFZ0oIvthF4rGHvBQOk2X2OQGRnIUYx5UwziQwK+PghxOSlLS1hlY?=

=?us-ascii?Q?f7u8PdpwZysT+OGPoRB7ng/w2O13cKyL0JC3GMZ33dAUMCTyKF1GD1wJXN67?=

=?us-ascii?Q?4MlBmE3gzN8q45++cEgp5paC9h+LaiLiqIw9VSW8Q3xhCtr7UpDJTlKbkNOO?=

=?us-ascii?Q?Hv3NUQ7nsXCX4HpRnXAXdhk7Qdu5Jx2ZON6CNPiNnlRYhvV0Zb49bHkUVgXU?=

=?us-ascii?Q?80yY8R/E81J0pkvoQHucRMWFkvnJC+7pi9joDv8fXL++yriC/ndp6ltI63Gw?=

=?us-ascii?Q?GS2sLa04tC8s3FYW9rOcQJxTHLW8zNGZcW7Z6S2030V7rOy/HEyH4b+P76Q9?=

=?us-ascii?Q?K9QkaWM2kkKNIa9Wh18iiQNUrw3CrjZLlUp4VTdyJpaDU+ffOoTGZ1I25Fv6?=

=?us-ascii?Q?5vl4b0VoF/JboMqBkH0I4ZkipGC9FS2E8ylWWK4Qex3wRpYNm77StC8jsMWE?=

=?us-ascii?Q?EvCQ0pe2nJd34tm0cJmpW7ou6g//fApKNda5tOgUHinhEyn32PHNx8pZQI3E?=

=?us-ascii?Q?vgOX/ZZNpPfogZE/pQp3zU4Jsj4UXSAWsQKJFllyOlksPKHDmbNBCPDhcKlL?=

=?us-ascii?Q?tGT102/ek8UpF5SGGDrLlku9Owenvdx+Qzho4KvA2xdczv4QMkXLckOMS00h?=

=?us-ascii?Q?KQR1t6594XMkb9CVZcOF2KuzJfrTN8sxgZBvunIFWWsHRS4SBc1VczqEemje?=

=?us-ascii?Q?FfwX0zL32yAVmkBdRrJOTicpZ3IRsjZ5SzUjZjXr7bCx3/N97dxqW1CRynLF?=

=?us-ascii?Q?cVfG1s4/BSOsFCdhqkjDD7HLm37CtmRqzCb6R4ZfVZ1Y3/JOZ4ZaLH8CFYsq?=

=?us-ascii?Q?w3g/VwOgSlw1t+GeAzAsA8TY8SVQmInbf4hr/JDEKzMdO3flXlwYFVmeHaPU?=

=?us-ascii?Q?ZaH1zbeIa/gYni1l9tq1/3nD64BM9LaUAkY7oLgUitr8xr6lwOpUcwZw4sHp?=

=?us-ascii?Q?O6z7tXI5Fi/98jykbKt0rixtR7QI2EZJsxGXXutAIxIr1gonCXwULGE4Hsqk?=

=?us-ascii?Q?DKZxsr0FnL+ii6FDYV9SEEMZjszIHvTdVP42aQinArukxcMJUJMAfmq8cIom?=

=?us-ascii?Q?MKlD3VjipzadrDhNyMZAUmk5SmahZwf2sNKzNbVio4OSnKm3jB5E0htdq+v2?=

=?us-ascii?Q?4UTQ5RO4ex8zkyJCCvotAlsrRlPa2/2ILyFJbhTBfSMbc5BGBB2+XsxyX7QS?=

=?us-ascii?Q?wrLAM3l4+8iWHfiIV5qoGFIndazZ4ldBA1i65TLAY8Pk2QGibLnc54bCm5u4?=

=?us-ascii?Q?ku1CqXAk2MjIjr64av/2xF5JFGEEf4Aq?=

Content-Type: multipart/alternative;

boundary="_000_TY1PPF5D7DEE1509560F5E765E479BD870C8BE62TY1PPF5D7DEE150_"

MIME-Version: 1.0

X-OriginatorOrg: outlook.com

X-MS-Exchange-CrossTenant-AuthAs: Internal

X-MS-Exchange-CrossTenant-AuthSource: TY1PPF5D7DEE150.apcprd01.prod.exchangelabs.com

X-MS-Exchange-CrossTenant-RMS-PersistedConsumerOrg: 00000000-0000-0000-0000-000000000000

X-MS-Exchange-CrossTenant-Network-Message-Id: 48f78ebc-7cee-4a6d-3386-08decaf356eb

X-MS-Exchange-CrossTenant-originalarrivaltime: 15 Jun 2026 15:32:26.8926

(UTC)

X-MS-Exchange-CrossTenant-fromentityheader: Hosted

X-MS-Exchange-CrossTenant-id: 84df9e7f-e9f6-40af-b435-aaaaaaaaaaaa

X-MS-Exchange-CrossTenant-rms-persistedconsumerorg: 00000000-0000-0000-0000-000000000000

X-MS-Exchange-Transport-CrossTenantHeadersStamped: JH0PR01MB5988

nk.ca credential phishing from Google User content

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Mon, 15 Jun 2026 07:28:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wZ7LP-00000000GJQ-31vb

for dave@doctor.nl2k.ab.ca;

Mon, 15 Jun 2026 07:27:15 -0600

Resent-From: The Doctor

Resent-Date: Mon, 15 Jun 2026 07:27:15 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from 196.17.127.34.bc.googleusercontent.com ([34.127.17.196]:54882 helo=[10.88.0.4])

by doctor.nl2k.ab.ca with esmtp (Exim 4.99.3 (FreeBSD))

id 1wZ5Uc-00000000Bep-1iyP

for root@nk.ca;

Mon, 15 Jun 2026 05:28:50 -0600

Content-Type: multipart/related; boundary="===============8017657657442611597=="

MIME-Version: 1.0

From: "Nagindas Khandwala College ."

To: root@nk.ca

Subject: =?utf-8?q?=5Broot=40nk=2Eca=5D=3A_Please_confirm_to_continue=2E?=

X-Priority: 2

X-Spam_score: 16.2

X-Spam_score_int: 162

X-Spam_bar: ++++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Nagindas Khandwala CollegeMail Hi Root



Content analysis details: (16.2 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

0.1 MISSING_MID Missing Message-Id: header

1.4 MISSING_DATE Missing Date: header

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[34.127.17.196 listed in will-spam-for-food.eu.org]

[34.127.17.196 listed in will-spam-for-food.eu.org]

[34.127.17.196 listed in will-spam-for-food.eu.org]

[34.127.17.196 listed in will-spam-for-food.eu.org]

[34.127.17.196 listed in will-spam-for-food.eu.org]

[34.127.17.196 listed in will-spam-for-food.eu.org]

[34.127.17.196 listed in will-spam-for-food.eu.org]

[34.127.17.196 listed in will-spam-for-food.eu.org]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[34.127.17.196 listed in bl.score.senderscore.com]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[34.127.17.196 listed in dnsbl.ahbl.org]

[34.127.17.196 listed in dnsbl.ahbl.org]

[34.127.17.196 listed in dnsbl.ahbl.org]

[34.127.17.196 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[34.127.17.196 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[34.127.17.196 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[34.127.17.196 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[34.127.17.196 listed in dnsbl.ahbl.org]

0.0 URIBL_PH_SURBL Contains an URL listed in the PH SURBL blocklist

[URI: inbrowser.link]

2.5 URIBL_DBL_PHISH Contains a Phishing URL listed in the DBL blocklist

[URI: inbrowser.link]

0.0 TVD_RCVD_IP Message was received from an IP address

0.5 URI_NOVOWEL URI: URI hostname has long non-vowel sequence

1.5 MR_STRANGE_QUESTION URI: No description available.

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 HTML_MESSAGE BODY: HTML included in message

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

3.0 VOWEL_URI_7 RAW: URI hostname with 7+ consecutive vowels

0.0 SARE_FROM_SPAM_WORD4 From address suggests this may be spam

0.6 HTML_MIME_NO_HTML_TAG HTML-only message, but there is no HTML tag

1.0 IMPRO_URI_3 No description available.

0.4 RDNS_DYNAMIC Delivered to internal network by host with

dynamic-looking rDNS

1.0 IMPRO_URI_2 No description available.

0.1 TO_IN_SUBJ To address is in Subject

0.2 HELO_MISC_IP Looking for more Dynamic IP Relays

0.4 KHOP_HELO_FCRDNS Relay HELO differs from its IP's reverse DNS

1.0 XPRIO Has X-Priority header

Subject: {SPAM?} =?utf-8?q?=5Broot=40nk=2Eca=5D=3A_Please_confirm_to_continue=2E?=



Nagindas Khandwala CollegeMail



Hi Root



Please note root@nk.ca authentication expires 16 June, 2026.



Continue




Please continue to keep or change your password.



Regards,

Nk Mail

nk.ca credential phishing from Google User content

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Mon, 15 Jun 2026 07:28:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wZ7LG-00000000GJ8-2DZP

for dave@doctor.nl2k.ab.ca;

Mon, 15 Jun 2026 07:27:06 -0600

Resent-From: The Doctor

Resent-Date: Mon, 15 Jun 2026 07:27:06 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from 196.17.127.34.bc.googleusercontent.com ([34.127.17.196]:54884 helo=[10.88.0.4])

by doctor.nl2k.ab.ca with esmtp (Exim 4.99.3 (FreeBSD))

id 1wZ5Uc-00000000Bes-1j6n

for sales@nk.ca;

Mon, 15 Jun 2026 05:28:46 -0600

Content-Type: multipart/related; boundary="===============9205993337077454948=="

MIME-Version: 1.0

From: "Nagindas Khandwala College ."

To: sales@nk.ca

Subject: =?utf-8?q?=5Bsales=40nk=2Eca=5D=3A_Please_confirm_to_continue=2E?=

X-Priority: 2

X-Spam_score: 16.2

X-Spam_score_int: 162

X-Spam_bar: ++++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Nagindas Khandwala CollegeMail Hi Sales



Content analysis details: (16.2 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.4 MISSING_DATE Missing Date: header

0.1 MISSING_MID Missing Message-Id: header

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[34.127.17.196 listed in will-spam-for-food.eu.org]

[34.127.17.196 listed in will-spam-for-food.eu.org]

[34.127.17.196 listed in will-spam-for-food.eu.org]

[34.127.17.196 listed in will-spam-for-food.eu.org]

[34.127.17.196 listed in will-spam-for-food.eu.org]

[34.127.17.196 listed in will-spam-for-food.eu.org]

[34.127.17.196 listed in will-spam-for-food.eu.org]

[34.127.17.196 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[34.127.17.196 listed in dnsbl.ahbl.org]

[34.127.17.196 listed in dnsbl.ahbl.org]

[34.127.17.196 listed in dnsbl.ahbl.org]

[34.127.17.196 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[34.127.17.196 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[34.127.17.196 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[34.127.17.196 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[34.127.17.196 listed in dnsbl.ahbl.org]

0.0 TVD_RCVD_IP Message was received from an IP address

2.5 URIBL_DBL_PHISH Contains a Phishing URL listed in the DBL blocklist

[URI: inbrowser.link]

0.0 URIBL_PH_SURBL Contains an URL listed in the PH SURBL blocklist

[URI: inbrowser.link]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[34.127.17.196 listed in bl.score.senderscore.com]

0.5 URI_NOVOWEL URI: URI hostname has long non-vowel sequence

1.5 MR_STRANGE_QUESTION URI: No description available.

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 HTML_MESSAGE BODY: HTML included in message

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

3.0 VOWEL_URI_7 RAW: URI hostname with 7+ consecutive vowels

1.0 IMPRO_URI_2 No description available.

0.4 RDNS_DYNAMIC Delivered to internal network by host with

dynamic-looking rDNS

1.0 IMPRO_URI_3 No description available.

0.6 HTML_MIME_NO_HTML_TAG HTML-only message, but there is no HTML tag

0.0 SARE_FROM_SPAM_WORD4 From address suggests this may be spam

0.4 KHOP_HELO_FCRDNS Relay HELO differs from its IP's reverse DNS

0.1 TO_IN_SUBJ To address is in Subject

1.0 XPRIO Has X-Priority header

0.2 HELO_MISC_IP Looking for more Dynamic IP Relays

Subject: {SPAM?} =?utf-8?q?=5Bsales=40nk=2Eca=5D=3A_Please_confirm_to_continue=2E?=



Nagindas Khandwala CollegeMail



Hi Sales



Please note sales@nk.ca authentication expires 16 June, 2026.



Continue




Please continue to keep or change your password.



Regards,

Nk Mail

nk.ca credential phishing from Google User content

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Mon, 15 Jun 2026 07:28:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wZ7LV-00000000GJX-0oeE

for dave@doctor.nl2k.ab.ca;

Mon, 15 Jun 2026 07:27:21 -0600

Resent-From: The Doctor

Resent-Date: Mon, 15 Jun 2026 07:27:21 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from 196.17.127.34.bc.googleusercontent.com ([34.127.17.196]:54908 helo=[10.88.0.4])

by doctor.nl2k.ab.ca with esmtp (Exim 4.99.3 (FreeBSD))

id 1wZ5Uf-00000000Bez-38AI

for doctor@netknow.ca;

Mon, 15 Jun 2026 05:28:50 -0600

Content-Type: multipart/related; boundary="===============2281347982039420509=="

MIME-Version: 1.0

From: "Netknow ."

To: doctor@netknow.ca

Subject: =?utf-8?q?=5Bdoctor=40netknow=2Eca=5D=3A_Please_confirm_to_continue=2E?=

X-Priority: 2

X-Spam_score: 16.2

X-Spam_score_int: 162

X-Spam_bar: ++++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: NetknowMail Hi Doctor



Content analysis details: (16.2 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.4 MISSING_DATE Missing Date: header

0.1 MISSING_MID Missing Message-Id: header

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[34.127.17.196 listed in will-spam-for-food.eu.org]

[34.127.17.196 listed in will-spam-for-food.eu.org]

[34.127.17.196 listed in will-spam-for-food.eu.org]

[34.127.17.196 listed in will-spam-for-food.eu.org]

[34.127.17.196 listed in will-spam-for-food.eu.org]

[34.127.17.196 listed in will-spam-for-food.eu.org]

[34.127.17.196 listed in will-spam-for-food.eu.org]

[34.127.17.196 listed in will-spam-for-food.eu.org]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[34.127.17.196 listed in bl.score.senderscore.com]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[34.127.17.196 listed in dnsbl.ahbl.org]

[34.127.17.196 listed in dnsbl.ahbl.org]

[34.127.17.196 listed in dnsbl.ahbl.org]

[34.127.17.196 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[34.127.17.196 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[34.127.17.196 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[34.127.17.196 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[34.127.17.196 listed in dnsbl.ahbl.org]

0.0 URIBL_PH_SURBL Contains an URL listed in the PH SURBL blocklist

[URI: inbrowser.link]

2.5 URIBL_DBL_PHISH Contains a Phishing URL listed in the DBL blocklist

[URI: inbrowser.link]

0.0 TVD_RCVD_IP Message was received from an IP address

0.5 URI_NOVOWEL URI: URI hostname has long non-vowel sequence

1.5 MR_STRANGE_QUESTION URI: No description available.

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 HTML_MESSAGE BODY: HTML included in message

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

3.0 VOWEL_URI_7 RAW: URI hostname with 7+ consecutive vowels

1.0 IMPRO_URI_2 No description available.

1.0 IMPRO_URI_3 No description available.

0.4 RDNS_DYNAMIC Delivered to internal network by host with

dynamic-looking rDNS

0.6 HTML_MIME_NO_HTML_TAG HTML-only message, but there is no HTML tag

0.0 SARE_FROM_SPAM_WORD4 From address suggests this may be spam

0.4 KHOP_HELO_FCRDNS Relay HELO differs from its IP's reverse DNS

0.1 TO_IN_SUBJ To address is in Subject

0.2 HELO_MISC_IP Looking for more Dynamic IP Relays

1.0 XPRIO Has X-Priority header

Subject: {SPAM?} =?utf-8?q?=5Bdoctor=40netknow=2Eca=5D=3A_Please_confirm_to_continue=2E?=



NetknowMail



Hi Doctor



Please note doctor@netknow.ca authentication expires 16 June, 2026.



Continue




Please continue to keep or change your password.



Regards,

Netknow Mail



nk.ca credential phishing from Google User content

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Mon, 15 Jun 2026 07:28:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wZ7LL-00000000GJK-1kx3

for dave@doctor.nl2k.ab.ca;

Mon, 15 Jun 2026 07:27:11 -0600

Resent-From: The Doctor

Resent-Date: Mon, 15 Jun 2026 07:27:11 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from 196.17.127.34.bc.googleusercontent.com ([34.127.17.196]:54938 helo=[10.88.0.4])

by doctor.nl2k.ab.ca with esmtp (Exim 4.99.3 (FreeBSD))

id 1wZ5Uc-00000000Bf3-1jHx

for doctor@nl2k.ab.ca;

Mon, 15 Jun 2026 05:28:46 -0600

Content-Type: multipart/related; boundary="===============0563310363451842819=="

MIME-Version: 1.0

From: "Nl2k ."

To: doctor@nl2k.ab.ca

Subject: =?utf-8?q?=5Bdoctor=40nl2k=2Eab=2Eca=5D=3A_Please_confirm_to_continue=2E?=

X-Priority: 2

X-Spam_score: 16.2

X-Spam_score_int: 162

X-Spam_bar: ++++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Nl2kMail Hi Doctor



Content analysis details: (16.2 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

0.1 MISSING_MID Missing Message-Id: header

1.4 MISSING_DATE Missing Date: header

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[34.127.17.196 listed in will-spam-for-food.eu.org]

[34.127.17.196 listed in will-spam-for-food.eu.org]

[34.127.17.196 listed in will-spam-for-food.eu.org]

[34.127.17.196 listed in will-spam-for-food.eu.org]

[34.127.17.196 listed in will-spam-for-food.eu.org]

[34.127.17.196 listed in will-spam-for-food.eu.org]

[34.127.17.196 listed in will-spam-for-food.eu.org]

[34.127.17.196 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[34.127.17.196 listed in dnsbl.ahbl.org]

[34.127.17.196 listed in dnsbl.ahbl.org]

[34.127.17.196 listed in dnsbl.ahbl.org]

[34.127.17.196 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[34.127.17.196 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[34.127.17.196 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[34.127.17.196 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[34.127.17.196 listed in dnsbl.ahbl.org]

0.0 TVD_RCVD_IP Message was received from an IP address

2.5 URIBL_DBL_PHISH Contains a Phishing URL listed in the DBL blocklist

[URI: inbrowser.link]

0.0 URIBL_PH_SURBL Contains an URL listed in the PH SURBL blocklist

[URI: inbrowser.link]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[34.127.17.196 listed in bl.score.senderscore.com]

0.5 URI_NOVOWEL URI: URI hostname has long non-vowel sequence

1.5 MR_STRANGE_QUESTION URI: No description available.

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 HTML_MESSAGE BODY: HTML included in message

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

3.0 VOWEL_URI_7 RAW: URI hostname with 7+ consecutive vowels

1.0 IMPRO_URI_2 No description available.

0.4 RDNS_DYNAMIC Delivered to internal network by host with

dynamic-looking rDNS

1.0 IMPRO_URI_3 No description available.

0.6 HTML_MIME_NO_HTML_TAG HTML-only message, but there is no HTML tag

0.0 SARE_FROM_SPAM_WORD4 From address suggests this may be spam

0.4 KHOP_HELO_FCRDNS Relay HELO differs from its IP's reverse DNS

0.1 TO_IN_SUBJ To address is in Subject

0.2 HELO_MISC_IP Looking for more Dynamic IP Relays

1.0 XPRIO Has X-Priority header

Subject: {SPAM?} =?utf-8?q?=5Bdoctor=40nl2k=2Eab=2Eca=5D=3A_Please_confirm_to_continue=2E?=



Nl2kMail



Hi Doctor



Please note doctor@nl2k.ab.ca authentication expires 16 June, 2026.



Continue




Please continue to keep or change your password.



Regards,

Nl2k Mail

NK.ca credential phishing from Google user content

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Mon, 15 Jun 2026 07:28:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wZ7LL-00000000GJK-1kx3

for dave@doctor.nl2k.ab.ca;

Mon, 15 Jun 2026 07:27:11 -0600

Resent-From: The Doctor

Resent-Date: Mon, 15 Jun 2026 07:27:11 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from 196.17.127.34.bc.googleusercontent.com ([34.127.17.196]:54938 helo=[10.88.0.4])

by doctor.nl2k.ab.ca with esmtp (Exim 4.99.3 (FreeBSD))

id 1wZ5Uc-00000000Bf3-1jHx

for doctor@nl2k.ab.ca;

Mon, 15 Jun 2026 05:28:46 -0600

Content-Type: multipart/related; boundary="===============0563310363451842819=="

MIME-Version: 1.0

From: "Nl2k ."

To: doctor@nl2k.ab.ca

Subject: =?utf-8?q?=5Bdoctor=40nl2k=2Eab=2Eca=5D=3A_Please_confirm_to_continue=2E?=

X-Priority: 2

X-Spam_score: 16.2

X-Spam_score_int: 162

X-Spam_bar: ++++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Nl2kMail Hi Doctor



Content analysis details: (16.2 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

0.1 MISSING_MID Missing Message-Id: header

1.4 MISSING_DATE Missing Date: header

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[34.127.17.196 listed in will-spam-for-food.eu.org]

[34.127.17.196 listed in will-spam-for-food.eu.org]

[34.127.17.196 listed in will-spam-for-food.eu.org]

[34.127.17.196 listed in will-spam-for-food.eu.org]

[34.127.17.196 listed in will-spam-for-food.eu.org]

[34.127.17.196 listed in will-spam-for-food.eu.org]

[34.127.17.196 listed in will-spam-for-food.eu.org]

[34.127.17.196 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[34.127.17.196 listed in dnsbl.ahbl.org]

[34.127.17.196 listed in dnsbl.ahbl.org]

[34.127.17.196 listed in dnsbl.ahbl.org]

[34.127.17.196 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[34.127.17.196 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[34.127.17.196 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[34.127.17.196 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[34.127.17.196 listed in dnsbl.ahbl.org]

0.0 TVD_RCVD_IP Message was received from an IP address

2.5 URIBL_DBL_PHISH Contains a Phishing URL listed in the DBL blocklist

[URI: inbrowser.link]

0.0 URIBL_PH_SURBL Contains an URL listed in the PH SURBL blocklist

[URI: inbrowser.link]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[34.127.17.196 listed in bl.score.senderscore.com]

0.5 URI_NOVOWEL URI: URI hostname has long non-vowel sequence

1.5 MR_STRANGE_QUESTION URI: No description available.

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 HTML_MESSAGE BODY: HTML included in message

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

3.0 VOWEL_URI_7 RAW: URI hostname with 7+ consecutive vowels

1.0 IMPRO_URI_2 No description available.

0.4 RDNS_DYNAMIC Delivered to internal network by host with

dynamic-looking rDNS

1.0 IMPRO_URI_3 No description available.

0.6 HTML_MIME_NO_HTML_TAG HTML-only message, but there is no HTML tag

0.0 SARE_FROM_SPAM_WORD4 From address suggests this may be spam

0.4 KHOP_HELO_FCRDNS Relay HELO differs from its IP's reverse DNS

0.1 TO_IN_SUBJ To address is in Subject

0.2 HELO_MISC_IP Looking for more Dynamic IP Relays

1.0 XPRIO Has X-Priority header

Subject: {SPAM?} =?utf-8?q?=5Bdoctor=40nl2k=2Eab=2Eca=5D=3A_Please_confirm_to_continue=2E?=



Nl2kMail



Hi Doctor



Please note doctor@nl2k.ab.ca authentication expires 16 June, 2026.



Continue



Please continue to keep or change your password.



Regards,

Nl2k Mail