Business Proposal spam from Microsoft Outlook

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path: <2018187094@cumhuriyet.edu.tr>

Envelope-to: dave@nk.ca

Delivery-date: Tue, 26 May 2026 02:52:00 -0600

Received: from mail-northeuropeazon11022113.outbound.protection.outlook.com ([52.101.66.113]:1944 helo=DUZPR83CU001.outbound.protection.outlook.com)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.99.3 (FreeBSD))

(envelope-from <2018187094@cumhuriyet.edu.tr>)

id 1wRnVA-00000000DaE-1yBE

for dave@nk.ca;

Tue, 26 May 2026 02:51:20 -0600

ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none;

b=hp6vpyXI6npTVKZQh3Kp3CFpN1Qyun1TojgOFdbqT7Ltml9beIkebAAj3WS/aLg2LIWTFfelgkLD8LyPI7ZFd7gBiT4QDqJwn6lMW0bHeihyuQ7TMue7j9wwxzpEIvapkwk8KMgGTsBl7ynLgecBlApFPVa7AffuygInEZGFKS+fyEocuQBWm2SdgPQkWLYJoAtkW7EuGThQTrg7VbgPxqOsTrlGVUW7n211SwY84LsQats2Vg+eUrLcI70aYIIGhlbyjBxflTPafxxaopJFc+PUnxvmMQftesKJYzPUa/uU1MS1/21BGG2HdIGX6TBJis9Kk6RXBOUFrvhimm5Iog==

ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;

s=arcselector10001;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1;

bh=DkbBU310duij7ZNUA3XgiKJF5a2OO13Z6fb7Jm3V0Ao=;

b=BAb/wOEaPZTOVB5/zfZRbdmMFmHmzAQgq8LQ+c9EuhpkwP040Ova/mztrbay/2qsJ0R/yaLEdjj4K1tC0g1l+bfHIVdHMTQnixW7yr57lbyrDv5vIKebssutFlP2oHNGDIjadZomTUCXTHj005JjgYYnnLwC6NWvW8bg0ODBcEHk0s17qbkpM3IcII75LjMo1R6BWxhfbefLRwvWvLQoX2751OVKskC5NiJ9kw1jXH5ckgsqBvsEkJZ4+bZlk6Q0DW7R2w/dGfRNPDH2f0muWN0gpee9/wWtzyFeDxK1GPGN56EoJnmFFTvm5KT+6lAOuE5y0U+DWeHrNWbvWAZxUw==

ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass

smtp.mailfrom=cumhuriyet.edu.tr; dmarc=pass action=none

header.from=cumhuriyet.edu.tr; dkim=pass header.d=cumhuriyet.edu.tr; arc=none

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=cumhuriyetedutr.onmicrosoft.com;

s=selector2-cumhuriyetedutr-onmicrosoft-com;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck;

bh=DkbBU310duij7ZNUA3XgiKJF5a2OO13Z6fb7Jm3V0Ao=;

b=pIqfX76sj4uHFtDbyJMqqALdXoHy6XH+HnopxkU8fkEhsGjFqcclhSOtcOcHt+EfhdzU0v956IbS5uwQfBD5TvPvEx/0Nj0a0+dIOs/dWDqFQhArXxhBXxQDntH6ZoKzSpthx/HiJ3gHfvQWHOCJpY9P8DQt5joCznzhW3aM9qE=

Received: from VI0PR09MB8152.eurprd09.prod.outlook.com (2603:10a6:800:2ad::6)

by FRWPR09MB8305.eurprd09.prod.outlook.com (2603:10a6:d10:185::20) with

Microsoft SMTP Server (version=TLS1_2,

cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.48.19; Tue, 26 May

2026 08:50:07 +0000

Received: from VI0PR09MB8152.eurprd09.prod.outlook.com

([fe80::6487:b572:1544:e153]) by VI0PR09MB8152.eurprd09.prod.outlook.com

([fe80::6487:b572:1544:e153%6]) with mapi id 15.21.0071.010; Tue, 26 May 2026

08:50:07 +0000

From: =?utf-8?B?QVLEsEYgVEFO?= <2018187094@cumhuriyet.edu.tr>

To: =?utf-8?B?QVLEsEYgVEFO?= <2018187094@cumhuriyet.edu.tr>

Subject: =?utf-8?B?UmU6IFtHcmVldGluxJ/Fn10qKio=?=

Thread-Topic: =?utf-8?B?W0dyZWV0aW7En8WfXSoqKg==?=

Thread-Index: AQHc7Oto1KEAw8ciF0+WWZTYDZH2vbYgDuCA

Date: Tue, 26 May 2026 08:49:36 +0000

Message-ID: <81F940CE-2789-48CE-B9A1-C9BD6676403B@cumhuriyet.edu.tr>

References:

In-Reply-To:

Accept-Language: tr-TR, en-US

Content-Language: en-US

X-MS-Has-Attach:

X-MS-TNEF-Correlator:

authentication-results: dkim=none (message not signed)

header.d=none;dmarc=none action=none header.from=cumhuriyet.edu.tr;

x-ms-publictraffictype: Email

x-ms-traffictypediagnostic: VI0PR09MB8152:EE_|FRWPR09MB8305:EE_

x-ms-office365-filtering-correlation-id: 0880cbc8-4a35-4270-7cc1-08debb03c9b7

x-ld-processed: 048e1d7c-5205-48c0-88ae-7a05c05e0151,ExtFwd

x-ms-exchange-senderadcheck: 1

x-ms-exchange-antispam-relay: 0

x-microsoft-antispam:

BCL:0;ARA:13230040|786006|7416014|376014|1800799024|41320700013|366016|56012099003|18002099003|22082099003|38070700021;

x-microsoft-antispam-message-info:

XOmQFOsGud8OsqN2CaIyny+olS6/yy/jJT53BmBbq5qrcQyNPtgOTfNSrE0nqkDHY3KTTLLXIPCn4aBWoD9KKAgdvBzZZ7TiDzBW94Lw+cBNnLa0MbjuHDL3KWGudTjBP5xZZ1cJ/WxN0WmiS9Hd4c40oHW+zm/PKKib/WNB5Ap/qCY7zROcHAOlifwmg8PfdzWdin10yxPk4Kd8i8SeHAZOHwBy/our8suaDt0VzSAfUaAGUjQbYqtcRfBCdb22QWWYKZ5ZZoNSpbIl60CGvwLwumVXv5Zk+CS/mu+J9Oyv8Cqhc36gwZ2ddsvvn1zn9xos1CZpU9aNgmM652btSD/PwQprTl+skFreTMY1CmuqJcFt+W7llRuQuWYlMRnP10EkqRhCukb8TNbuIiS/gQ0HRZEFIlQsK0OkamlcVrwdNrGkCztmJLa9O/DE/YifC2rsFZw5IdFkde2tIAApoj5bhZi8NFbuwCIa3TGa/OqXC89QWoUh8s7O0GTwAZemQ/TbGKvmvVaZXZaJ5rJbrMTbdF1lRUrTuu24zP+J+k0uVtvveOQ5cuA3kTBTLMRyNiucmA0vtLikrE8p/Sy+dawUgvbN+izlQcRI3wcfua3v4SsHohI41NCzsYCNZ7StQgNcBPhFMcYHz1DjPmnAGutdRozerulC+tm2NjBmE+59K7vK+ToLdT4iy0YAsg1uq8BGqjCIrl8zQLCxpquvpcV5XoDpiByefY2kPcXfFzqkAQcXCNOOLFMZThlrNyJy

x-forefront-antispam-report:

CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:VI0PR09MB8152.eurprd09.prod.outlook.com;PTR:;CAT:NONE;SFS:(13230040)(786006)(7416014)(376014)(1800799024)(41320700013)(366016)(56012099003)(18002099003)(22082099003)(38070700021);DIR:OUT;SFP:1102;

x-ms-exchange-antispam-messagedata-chunkcount: 1

x-ms-exchange-antispam-messagedata-0:

=?utf-8?B?eDlyL3hKQlQ5QjRCUzZ1UGZ5QlpQR2FtdmpGNzRsa0lvcU5Ba1FKNXFUYVU4?=

=?utf-8?B?NGU0cmlrd0V0UnVibWkvWWZwTVE4Ym1Yb3FJOTl3K1BweDdjZkU3d3BueGRR?=

=?utf-8?B?ZlNIVWd0NTBMSm1tblVSanpwR0UxSk05aDRaNWZvMWpZNFEreENzQWVDd1lL?=

=?utf-8?B?a1JvMHZDU1FqcHJkQ0VwcjVXL1hJbFMwRTdWRGNVb1RURjIzVVh2TzJNVzNw?=

=?utf-8?B?UWpkWU5yUTIzdWRPY0ZZNFV6emtEc0tubE1qSG9VVXlHMTg1RTVRdUJaaDVR?=

=?utf-8?B?dzdSclhDMHdRTWY5QkdYM004M3VLS1NiZU5pNVpHUWFsOGIwSVdjWGUyWTV0?=

=?utf-8?B?Zmtwc1pTUm9oRW1tcWdoZC8zQXNraGRpanZpSFVOenBKNVJUSTE5Z1d2V2xz?=

=?utf-8?B?MzZ3bG9NVGo1UjFQdHNjblRxTkFxcEphNSsyY3E5cFZwTWNRSnBWU1BtYlRC?=

=?utf-8?B?TllLT0NoTlYxMFhVcE5aRDJlVlU5VThOTUk4ZFZtMDlJYVZad2JLMTh5OWw1?=

=?utf-8?B?azUwNFlQSFZwNGs1SjZLdWp5dEJ5YzNvYnU4Z0I5R2doZnhIYzlNenVBS0Mw?=

=?utf-8?B?NDArb3NNZTl6eVVHQmtBOHNna0NwT0VuK3MwaVFPWmt0WHk3ZVR5K0xBVTBo?=

=?utf-8?B?VTVUeklLQlBZM3JkNWhONjZaVHlhNkZseEp5NHRoS2FTQlVlRHRUbzl0OXlK?=

=?utf-8?B?Rmx6bVlvQnh5UHN5NkRoYmlmWTVhV08vQVhnazdta3hQY1JSemJtUVlITE1l?=

=?utf-8?B?WXlzcUtRNk1JUTBwRUhrN2t4VDZJZmp3MnQxYTBGOVdEaW94WWNaRlZ4N2pI?=

=?utf-8?B?alFUQ2dFYTY3RkkwcXUxd0ROa1Q0SUh2bmVra0w5dHZ5aHIvQTN0WGQ3a01y?=

=?utf-8?B?Z09JVVVPRlR3SVpVOXovSXdMZEduOVJuUjc3QjM0ZEFqZ3pnMnRJMXlWQnJ6?=

=?utf-8?B?OWNXTVJyT1pETDZoMDR0V2NyNlNNYzVJZ29MQ3B1Wm5OS0FFK2ZjRW9nV0gz?=

=?utf-8?B?Z0x4azRqdkd6OU1TeFMxNWoySW0rb3pMeXNtN0UyQTlJN1RCWERTZ2RwSGJr?=

=?utf-8?B?UHp0ekE0a3VVY2p5cVJ1azVzay9Qd0lGeDVkbCtiaWJjRytmT0hkZVdKdThq?=

=?utf-8?B?eW5vT0RCTW1tWThac2hlV2psVEJVR1JEUzRCS3hEeFBtL2hYWXJDSjNkRXB4?=

=?utf-8?B?WWhnc1ZaaUJBWklBbHNISkx4dUxHRExCYjVocEg1djczeE1MRUlLUGx5dW05?=

=?utf-8?B?TGhOUWVOcDdpOGtEeHpEWURSTEQ3MjFmc0tsdExVTUJaZHU1VVRrOXQweXdt?=

=?utf-8?B?T2pucStPc0lrWk9CR0hRS1VzKzF4akt6L1oycklGQlNqVnN2WmI5WHBZL1Bw?=

=?utf-8?B?MWVWV3F2RG9xbzNuei84YmdwN0NSTUtlSi9TQTBSKzV1THdRbjUzVTg0TFJn?=

=?utf-8?B?MXc4RllzUnJieWdOVkRhNjcrWGtTbHh1ekJKa29FWU5GNDhteHc1cEQ0Z1gx?=

=?utf-8?B?Z3hNcEdhUHdmR3ptbitwVi9aUWlaSGpBS0hhbmFxU2RXM21SaUpZYmc2R1l1?=

=?utf-8?B?MUZ6ZExKZEpOWkZiKzlHYnJJRGtVcFU3dk14U2duU3F6OVVvQmpkY1RyUUt3?=

=?utf-8?B?cGRzVjY3SnVWMXllb05wU1J4Smp2NmJXNmR2SkV6SGxLQ25neUhyQzhNSnBj?=

=?utf-8?B?THl4UlF3cGhSbWg2aGEwdEdSOTZ2YlNwM0xxVVNJeGlWYnNGakY0SVJNaUNW?=

=?utf-8?B?c284L3M5Ym1VYzluZ0RrT2RsZi9MK20vaFlubE1kTmZZOUEzT0NDSjJEWlh2?=

=?utf-8?B?SVdHc2srRGVoajNLUklsVC96N1BlZVJTWXYwcllMNXMveU1hY20zaU5KaUcv?=

=?utf-8?B?OHNrazNtYTlCSmJ0WkF4bHZMcFJ6Q3JHZUozOU45c3NrV3hvU21MeTVmZTlG?=

=?utf-8?B?N2s4SmJRcERoOWFmZzh1WkhDZFhyUnpmRG1oNUpzLzJyMVM0T21DSGJGVzRz?=

=?utf-8?B?eVUzOGg2Y3E3cXhiSVd1aHVGeEp2NWtTdUxBMW96eUpzYmxQRkkrL2ZVNEhZ?=

=?utf-8?B?V0NVM3V4MmtXVHhmWW1kamc1TmZuZW8ySU5yZXpKRXFvSEJxOENHY3ZDcjQr?=

=?utf-8?B?QWVCanJla1hCVWtRNERVSEV3dEQ2eUEvckVUT0xuRCs0R25ZQndJcUdTY0dW?=

=?utf-8?B?STRVU2d0UXE4N0dONWh6YnRob3h2T2xIcTZoMm43S1JhcGxoUDZvblRIdE91?=

=?utf-8?B?OFV3SUJQVXh6cHhGUlN0dk1sN1NUNGZtNmRwZVBGNnVvbG9iT2Z0Q3V1M2xZ?=

=?utf-8?B?VHlOZEJvcmxndUxpcldiSlA2TGU0ck9KeGE0QXpvT29CVG5TUndBZE03UGpw?=

=?utf-8?Q?KCytTabCmR0x12Ik=3D?=

Content-Type: text/plain; charset="utf-8"

Content-ID: <3CCDE1F8B0C98A458A9894951D8BD91B@eurprd09.prod.outlook.com>

Content-Transfer-Encoding: base64

MIME-Version: 1.0

X-OriginatorOrg: cumhuriyet.edu.tr

X-MS-Exchange-CrossTenant-AuthAs: Internal

X-MS-Exchange-CrossTenant-AuthSource: VI0PR09MB8152.eurprd09.prod.outlook.com

X-MS-Exchange-CrossTenant-Network-Message-Id: 0880cbc8-4a35-4270-7cc1-08debb03c9b7

X-MS-Exchange-CrossTenant-originalarrivaltime: 26 May 2026 08:49:36.3544

(UTC)

X-MS-Exchange-CrossTenant-fromentityheader: Hosted

X-MS-Exchange-CrossTenant-id: 048e1d7c-5205-48c0-88ae-7a05c05e0151

X-MS-Exchange-CrossTenant-mailboxtype: HOSTED

X-MS-Exchange-CrossTenant-userprincipalname: kcrizR0s1IK401VkbFozUY+5GeCHN1iE6xe4WY/147itev1+ZKrHV4IdQ5MoH9l8WM52wbwcbjMenMFZWtX4YLaenBZP5NtswpVVCfWDYAs=

X-MS-Exchange-Transport-CrossTenantHeadersStamped: FRWPR09MB8305



DQoNCu+7v09uIDUvMjYvMjYsIDk6NDEgQU0sICJBUsSwRiBUQU4iIDwyMDE4MTg3MDk0QGN1bWh1

cml5ZXQuZWR1LnRyIDxtYWlsdG86MjAxODE4NzA5NEBjdW1odXJpeWV0LmVkdS50cj4+IHdyb3Rl

Og0KDQoNCkkgaGF2ZSBhIGJ1xZ9pbmXFn8WfIG9mZmVyIHdpdGggeW91ciBsYcWfdCBuYW1lOg0K

DQoNCg0KDQoNCg==

Docusign Spoofing from Google Gmail Part 2

Posted by Dave Yadallee on




Content analysis details: (6.4 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[209.85.167.103 listed in dnsbl.ahbl.org]

[209.85.167.103 listed in dnsbl.ahbl.org]

[209.85.167.103 listed in dnsbl.ahbl.org]

[209.85.167.103 listed in dnsbl.ahbl.org]

[191.101.51.168 listed in dnsbl.ahbl.org]

[191.101.51.168 listed in dnsbl.ahbl.org]

[191.101.51.168 listed in dnsbl.ahbl.org]

[191.101.51.168 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[209.85.167.103 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[209.85.167.103 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[209.85.167.103 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[209.85.167.103 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[191.101.51.168 listed in will-spam-for-food.eu.org]

[191.101.51.168 listed in will-spam-for-food.eu.org]

[191.101.51.168 listed in will-spam-for-food.eu.org]

[191.101.51.168 listed in will-spam-for-food.eu.org]

[191.101.51.168 listed in will-spam-for-food.eu.org]

[191.101.51.168 listed in will-spam-for-food.eu.org]

[191.101.51.168 listed in will-spam-for-food.eu.org]

[191.101.51.168 listed in will-spam-for-food.eu.org]

[209.85.167.103 listed in will-spam-for-food.eu.org]

[209.85.167.103 listed in will-spam-for-food.eu.org]

[209.85.167.103 listed in will-spam-for-food.eu.org]

[209.85.167.103 listed in will-spam-for-food.eu.org]

[209.85.167.103 listed in will-spam-for-food.eu.org]

[209.85.167.103 listed in will-spam-for-food.eu.org]

[209.85.167.103 listed in will-spam-for-food.eu.org]

[209.85.167.103 listed in will-spam-for-food.eu.org]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[209.85.167.103 listed in list.dnswl.org]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-0.0 SPF_PASS SPF: sender matches SPF record

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[209.85.167.103 listed in bl.score.senderscore.com]

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[209.85.167.103 listed in wl.mailspike.net]

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 NO_RDNS2 Sending MTA has no reverse DNS

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

2.0 RATWR8_MESSID Message-ID with excessive dashes and dollars

0.6 HTML_MIME_NO_HTML_TAG HTML-only message, but there is no HTML tag

1.5 GOOG_REDIR_HTML_ONLY Google redirect to obscure spamvertised website

+ HTML only

0.1 MXG_SPOOFED_DOCUSIGN Docusign spoofing

Subject: {SPAM?} ACH receipt has been proceesed - Ref-ID:{RANDOM_MD5}



----_NmP-3b921721ba504e85-Part_1

Content-Type: text/html; charset=utf-8

Content-Transfer-Encoding: quoted-printable



=EF=BB=BF

auto; padding: 20px; border-bottom: 2px solid #eee;">


uppercase;">Shared File






border-radius: 5px; text-align: center; line-height: 40px; font-weight: =

bold; color: #666; margin-right: 15px;">DOC





#333;">May_Payment_Details.xlsx



Shared by=

Operations Team








com%2Fsim%2Fdownload%2Fremittanceslip.scr&sa=3DD&sntz=3D1&usg=3DAOvVaw02uGk=

yFPZFVJIbzWoIpp7l" style=3D"display: block; margin-top: 20px; color: =

#0066cc; text-decoration: none; font-size: 14px; font-weight: bold;">Review=

Document →



----_NmP-3b921721ba504e85-Part_1

Content-Type: application/octet-stream; name=610345

Content-Transfer-Encoding: base64

Content-Disposition: attachment; filename=610345



PHRyPgo8dGQgc3R5bGU9InBhZGRpbmctcmlnaHQ6IDI0cHg7IHBhZGRpbmctYm90dG9tOiAzMHB4

OyBwYWRkaW5nLWxlZnQ6IDI0cHg7Ij4KPHRhYmxlIHN0eWxlPSJiYWNrZ3JvdW5kLWNvbG9yOiAj

MmMwYjVlOyB3aWR0aDogNTIycHg7IGJvcmRlci1jb2xsYXBzZTogY29sbGFwc2U7IiBhbGlnbj0i

Y2VudGVyIj4KPHRib2R5Pgo8dHI+Cjx0ZCBzdHlsZT0idGV4dC1hbGlnbjogY2VudGVyOyBwYWRk

aW5nOiA0MHB4IDM2cHg7IGZvbnQtZmFtaWx5OiBIZWx2ZXRpY2EsIEFyaWFsLCBTYW5zIFNlcmlm

OyBjb2xvcjojZmZmZmZmOyI+Cgo8ZGl2IHN0eWxlPSJmb250LXNpemU6MThweDsgbWFyZ2luLWJv

dHRvbToyMHB4OyI+CjxzdHJvbmc+MjAyNiBPbmxpbmUtQWdyZWVtZW50LSMjTlVNUkFORE9NNSMj

PC9zdHJvbmc+PGJyPgpQbGVhc2UgcmV2aWV3IGFuZCBzaWduLgo8L2Rpdj4KCjxkaXYgc3R5bGU9

Im1hcmdpbjogMjVweCAwOyI+CjxpbWcgc3JjPSIjI1FSQ09ERSMjIiBhbHQ9IlFSIENvZGUiIHN0

eWxlPSJtYXgtd2lkdGg6MTgwcHg7IGRpc3BsYXk6YmxvY2s7IG1hcmdpbjowIGF1dG87Ij4KPC9k

aXY+CjxkaXYgc3R5bGU9ImZvbnQtc2l6ZToxOHB4OyBtYXJnaW4tYm90dG9tOjIwcHg7Ij4KPHN0

cm9uZz5SZWNpcGllbnQ6PC9zdHJvbmc+PGJyPgojI0VNQUlMIyMKPC9kaXY+Cjx0YWJsZSBhbGln

bj0iY2VudGVyIiBzdHlsZT0ibWFyZ2luLXRvcDoyMHB4OyI+Cjx0cj4KPHRkIHN0eWxlPSJiYWNr

Z3JvdW5kLWNvbG9yOiM3MzVhZmY7IHBhZGRpbmc6MTRweCAyOHB4OyBib3JkZXItcmFkaXVzOjRw

eDsgZm9udC1zaXplOjE1cHg7IGZvbnQtd2VpZ2h0OmJvbGQ7IGNvbG9yOiNmZmZmZmY7Ij4KU0NB

TiBCQVJDT0RFIFRPIFJFVklFVyAmIFNJR04gRE9DVU1FTlQgRUxFQ1RST05JQ0FMTFkKPC90ZD4K

PC90cj4KPC90YWJsZT4KCjwvdGQ+CjwvdHI+CjwvdGJvZHk+CjwvdGFibGU+CjwvdGQ+CjwvdHI+

Cg==

----_NmP-3b921721ba504e85-Part_1--

Docusign Spoofing from Google Gmail Part 1

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Mon, 25 May 2026 23:51:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wRkg1-0000000055W-2Zeo

for dave@doctor.nl2k.ab.ca;

Mon, 25 May 2026 23:50:05 -0600

Resent-From: The Doctor

Resent-Date: Mon, 25 May 2026 23:50:05 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-lf1-f103.google.com ([209.85.167.103]:45457)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wRjTd-00000000ObQ-0TWR

for sales@nk.ca;

Mon, 25 May 2026 22:33:21 -0600

Received: by mail-lf1-f103.google.com with SMTP id 2adb3069b0e04-5a40b2bc96dso4594873e87.3

for ; Mon, 25 May 2026 21:31:39 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=vadisound.com; s=google; t=1779769892; x=1780374692; darn=nk.ca;

h=mime-version:date:message-id:subject:to:from:from:to:cc:subject

:date:message-id:reply-to;

bh=feTixz/YJE3sp7I6fJ3WgipbTn0bptE2xqGmJBn0aTk=;

b=ftwUkpc6OVHWvBCgqL93S3jPP1Pma/JkgocgfC3C+655Qlh6/aPGQ6+JodU6gyE8r0

aCSaMCvW8EPUSNeGpS68Ibawc51uWkJaHD9DGLFKh64N3aVQAv9gz3sKzL37LGkgqNe6

Hihd6CqpTRpdrQchxtVi74GHSCTL6HIn1Ze9c=

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20251104; t=1779769892; x=1780374692;

h=mime-version:date:message-id:subject:to:from:x-gm-gg

:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to;

bh=feTixz/YJE3sp7I6fJ3WgipbTn0bptE2xqGmJBn0aTk=;

b=EXSVy1lNczqKdvUtPorRpv7FNgyG2EqGFelwNqIGX4LTB7S0KxWRy5H4jKxtPHWDJr

z3fiC5ENrj6xNaShImByKGc48b0DMws/JV8qogP25xY+Y14wcK7h2fxvmTIXgZLAcAeq

o0Bkp2l/iYu6OR5S3T6xKwe9o0DuDN6ETQrjQtDTqEloumxESrZWYSg7p/E9oKB+6mf5

2ukTvwjJDrlz/GWbmfEYMOpYh48lrvesjYthPq7oNSUtygfrKMqCkxe1gVaLEe7DLJJb

w65EwKv5zqpZKH8iZn2ItDymzZ8o03FLh4SWEhXeu7y24AIQ9JfGIK2fz8QSDK0P838L

7N/w==

X-Gm-Message-State: AOJu0YzzCVykQVxnuJzG67Bs+TDhGv0k5uSGv1dBnAt4esh3vDgNU/Cl

zsv7efz54b+yLOQ4UUpSxeQeAg3KukJFHuBg1M/H/GiQGIa0V84kEhXxewYbcgDjJJ4L4aqX5IE

R5oG/QmaNC05ZTDKmMmxQ3cNWSOcIO4gJVQ874rMwi/J2a6k=

X-Gm-Gg: Acq92OHaERQO+Q4YD4w+BFaTBhAQFQd6/Ngpg94NaNzucvmv09+v2gnJ/8CwfqSY/HS

zWCC8hYUqvEu9RTo24MgWBugRL+AMBYrhFnKlDXHx6bAxgUrbFP5+r2AQf0SUjMLLcKghWI/J1e

V+IrW7oZso7e3xcdPlf9T0NuXfo3ToMsUSeKHrP5yqqwi8Dg67qLFcg/eHOd8+YSKfncny4j+6C

upqE8W8GkDfjvILSt2nUQTuRNEPFP7VwRO9PMEZCwHa6cOnuiVTclmBPcq+f6IkXgcwwRMWslz0

6cDKJmECKQPbqnLwIZFD0d9GJ+pnqiNS10XjApOUgJAsE4S+UAFa6YJ31m+QwCzzvk5hGIJfZDA

0wjxPD387udmp84FBjJI2Yz9ZUphszG6+

X-Received: by 2002:a05:6512:31c4:b0:5a8:7317:5417 with SMTP id 2adb3069b0e04-5aa32369f4amr4958664e87.9.1779769892341;

Mon, 25 May 2026 21:31:32 -0700 (PDT)

Received: from vadisound.com ([191.101.51.168])

by smtp-relay.gmail.com with ESMTPS id 2adb3069b0e04-5aa46386c9bsm91022e87.43.2026.05.25.21.31.32

for

(version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256);

Mon, 25 May 2026 21:31:32 -0700 (PDT)

X-Relaying-Domain: vadisound.com

From: "nk Docusign-/OU=EXCHANGE ADMINISTRATIVE GROUP

(FYDIBOHF23SPDLT)/CN=RECIPIENTS/CN=B7A707497B564FD-57008"



To: sales@nk.ca

Subject: ACH receipt has been proceesed - Ref-ID:{RANDOM_MD5}

Message-ID: <72d75479-1789-e308-30fc-178e9d5ab104@vadisound.com>

Date: Tue, 26 May 2026 04:31:32 +0000

MIME-Version: 1.0

Content-Type: multipart/mixed; boundary="--_NmP-3b921721ba504e85-Part_1"

X-Spam_score: 6.4

X-Spam_score_int: 64

X-Spam_bar: ++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview:  Shared File DOC

Business proposal spam from Google Gmail

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Mon, 25 May 2026 21:56:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wRish-00000000Mhz-3614

for dave@doctor.nl2k.ab.ca;

Mon, 25 May 2026 21:55:03 -0600

Resent-From: The Doctor

Resent-Date: Mon, 25 May 2026 21:55:03 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-wr1-f47.google.com ([209.85.221.47]:57402)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wRiJv-00000000Ks8-3eIW

for root@nk.ca;

Mon, 25 May 2026 21:19:17 -0600

Received: by mail-wr1-f47.google.com with SMTP id ffacd0b85a97d-449de065cb3so9794214f8f.2

for ; Mon, 25 May 2026 20:17:31 -0700 (PDT)

ARC-Seal: i=1; a=rsa-sha256; t=1779765445; cv=none;

d=google.com; s=arc-20240605;

b=Hcj7JbKh+PAm4CjZXnhhxUJF0rap0CEc3zFycHTmPeVGlcG8hMl0/iLQzIf+dEDZDj

oay+qZodBqykAqnX31WOQ3EBG13W8PdvZWWVSVTbIY7DVa29MPIHB+b6NyAtLQ33NS/b

BKhvBmUNEr7p0FgRR45Ctsi0F0yLhZfvP8mNqAE6sVB7Aj4+vGzS+dCECy24KLmZi5xq

xS3KQK36l0KuimdVy3d1LpebM1IIXC6PLwDQwxOs/qO5CmLHv7UG741PcoKZidfhkeaq

Ixpkv32RcUSv8hx3TzLV30HjknnXdi282SwXOHICxLeI4uddpZEN0g3GoJA6xTC21Z1x

fhXQ==

ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20240605;

h=to:subject:message-id:date:from:mime-version:dkim-signature;

bh=4XFkbw8nKunIyIcPx/OVHxnenAbpdwkqVLhZWx84iHI=;

fh=ny7+SATv4n6lSNl0rVMQyaj6POVJTUZJLShjjgjSTJg=;

b=fHAi8cVSjVvXHoT/vfwC+yLLLKc6sCfmnZLcjiNzwL9OV3Are68w1aq5R3U/l1orNK

udxHaDlUSZSSue1k4hk1Jn7cvWms+zqdbhDakWkxnUsBVl3sZ8d60SV+tTMMleeQrdcC

BBOmVafxMK91U9wnAKrG44yg7KDVvnEsUnsKLGFJw5C9zY7cVpxvj5frnZ4wLOFCOtog

7xLnwtnnWQKnZOrAlG5lGLegVzV/Xdb6Dgxtb0gTPB7i1U8vr86v8yBZztXKG+RqtRjC

AqWSndurQ+LzGS1RpLfv2TPlPw6pNH9FPoWD7LmA7oyVHoLQaoptXF20iqzEZvh+cPL0

r6Hw==;

darn=nk.ca

ARC-Authentication-Results: i=1; mx.google.com; arc=none

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=gmail.com; s=20251104; t=1779765445; x=1780370245; darn=nk.ca;

h=to:subject:message-id:date:from:mime-version:from:to:cc:subject

:date:message-id:reply-to;

bh=4XFkbw8nKunIyIcPx/OVHxnenAbpdwkqVLhZWx84iHI=;

b=tLaV+WJyK1/xT8VlpvUYIJVtvjvPsfwGAYeBaDtZUGiYYlogvOXULbslNlaJlb7RQC

U8N6TI70CaOm+Yvk4QugYOQ8Y63B/IrzVnJfTyv7gKvTJ0DnPgFhxxcArx1YcqZVvdlc

734QSbt5hyGUXm/vgg2eNp16PXPI715Dh5uiseOktWnHGjaFYDnz4Sz5CFFWJVnFwMxN

hJegnXOUUsxiS92PiNR3LlbqoLN8d33Uij2QWJhET6Bx0pJZ/aFlIEBDvldYTeb7A1eh

S3ecjXe7UeQqkJ1U7ojQXr54KpQsT6UjU8fexUIslrP7yn7wfor7KCuY4jabJRg0InaA

ETZg==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20251104; t=1779765445; x=1780370245;

h=to:subject:message-id:date:from:mime-version:x-gm-gg

:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to;

bh=4XFkbw8nKunIyIcPx/OVHxnenAbpdwkqVLhZWx84iHI=;

b=pvzvqu76FJliSwmdloquEsxdfeoDu5aymBwKvpzUAkT46deJmZnBb1iNFFSQ8/7ibC

2lXQ2Zuk4BCsoisDu2MNI1pNe7Q9Nz4IaEZuLdhSGrx+oZx/5WizH9HmNrbQ9WQblb00

j+zIgCxDZOdqznEW5AX6gPC5QyCR1DivTxLhbghbQDB0T5TpbykY9DqwzwBWK/A08USY

N5mqSgpgKDcPo/2kJsKaPXgJBUfKL+3x2mlxwY8ceU9UH7UdiWWRAdRJjDPPWxKWrNnA

kCHvzlft4JA0y96SPcQqPosL/MIP/XeJ+SvbQ1UakDH3fL1912Nc9jW0Cl2Oqv1dNp2A

CBZw==

X-Gm-Message-State: AOJu0YwdvAj2VPnEEWRU9rte6bbNaMqQevl3+FkInMCvJ13g9FH8MUlA

9Kq+KPMD+Vd1jM6NF6XNOv8qxWc+u0mV15G3jH9MN6frCXQP3aej7T1I3oqkBQ2ndhymhnjolwJ

yHuwFwYcI9QpysEyq2qddFP8W5EP6Bi18jsQjoM4=

X-Gm-Gg: Acq92OFUE6Cef0epHeGChronF91FPe9MVu/Wzolo69edQZ0ZzUMSELOTLbhYDePrFPG

BlhgLxVwfVwGnxIhYQBRO7SjSDZzoVdzPBA4ZidBqoMB6R3Lz55IN2pJ1mlU1KPW0m08Tzg5fCy

B1dSWHGQhIxa4uz5owiBjhYRp3bEgrDkQZEWwL3XhHe0AzMD7sDtDXEZq6mjEIhB7jE4bVdwSn4

9OxYuP0AMli+o/IDhS2Rc4YU7YLmWjvMeuF/FAKyUgDbduNcKukxutCWTOu79Z6hCsievgpLjKR

1ptb+WI0NV6ngxutOZpnXV3zcfVj3lVgQA==

X-Received: by 2002:a05:6000:470b:b0:452:d03a:7aad with SMTP id

ffacd0b85a97d-45eb38a6d8cmr27717921f8f.36.1779765444503; Mon, 25 May 2026

20:17:24 -0700 (PDT)

MIME-Version: 1.0

From: Onur Genc

Date: Tue, 26 May 2026 04:17:11 +0100

X-Gm-Features: AVHnY4IWItGDH8Fbf_Pdcf6dcG1LoiLw0dz_rIp7c16XTmQpaqKtYWtwBj6Mw-Y

Message-ID:

Subject: Deal update

To: root@nk.ca

Content-Type: multipart/alternative; boundary="0000000000001a6d400652afeff6"



--0000000000001a6d400652afeff6

Content-Type: text/plain; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable



Hello,



I came across your LinkedIn profile, Could you please let me know if

sending a proposal's information to the above address is okay.



Warm regards,

Mr. Onur Gen=C3=A7..



Caution: This email has been scanned for viruses and malware, and may have

been automatically archived by Mimecast, a leader in email security and

cyber resilience. Mimecast integrates email defenses with brand protection,

security awareness training, web security, compliance and other essential

capabilities. Mimecast helps protect large and small organizations from

malicious activity, human error and technology failure; and to lead the

movement toward building a more resilient world. To find out more, visit

our website..



--0000000000001a6d400652afeff6

Content-Type: text/html; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable





=3D"gmail_signature" data-smartmail=3D"gmail_signature">

iv style=3D"color:rgb(34,34,34)">

Neue",Helvetica,Arial,sans-serif">
obotoDraft, Helvetica, Arial, sans-serif" color=3D"#000000">Hello,
>

etica,Arial,sans-serif">
vetica, Arial, sans-serif" color=3D"#000000">

>

serif">
otoDraft, Helvetica, Arial, sans-serif">I came across your LinkedIn profile=

,=C2=A0
,sans-serif">Could you please let me know if sending a proposal's infor=

mation to the above address is okay.=C2=A0

>

<=

/b>

>Warm regards,
Mr. Onur Gen=

=C3=A7..


an style=3D"font-size:x-small;font-family:georgia,serif">
0000">Caution
02,102);font-family:georgia,serif">: This email has been scanned for viruse=

s and malware, and may have been automatically archived by Mimecast, a lead=

er in email security and cyber resilience. Mimecast integrates email defens=

es with brand protection, security awareness training, web security, compli=

ance and other essential capabilities. Mimecast helps protect large and sma=

ll organizations from malicious activity, human error and technology failur=

e; and to lead the movement toward building a more resilient world. To find=

out more,=C2=A0
02);font-family:georgia,serif">visit our website..
=





--0000000000001a6d400652afeff6--

Business partnership spam

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Mon, 25 May 2026 21:54:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wRirc-00000000MeT-3gaR

for dave@doctor.nl2k.ab.ca;

Mon, 25 May 2026 21:53:56 -0600

Resent-From: The Doctor

Resent-Date: Mon, 25 May 2026 21:53:56 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from [37.228.64.18] (port=50868 helo=mail2.adaoil.kz)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wRd48-000000003bu-0k0M

for root@nk.ca;

Mon, 25 May 2026 15:42:38 -0600

Received: from localhost (localhost [127.0.0.1])

by mail2.adaoil.kz (Postfix) with ESMTP id 188B12ADD73E

for ; Tue, 26 May 2026 02:41:03 +0500 (+05)

Received: from mail2.adaoil.kz ([127.0.0.1])

by localhost (mail2.adaoil.kz [127.0.0.1]) (amavisd-new, port 10032)

with ESMTP id 7OZbv3YsHkmB for ;

Tue, 26 May 2026 02:41:02 +0500 (+05)

Received: from localhost (localhost [127.0.0.1])

by mail2.adaoil.kz (Postfix) with ESMTP id A60EB279C780

for ; Tue, 26 May 2026 02:34:37 +0500 (+05)

X-Virus-Scanned: amavisd-new at mail2.adaoil.kz

Received: from mail2.adaoil.kz ([127.0.0.1])

by localhost (mail2.adaoil.kz [127.0.0.1]) (amavisd-new, port 10026)

with ESMTP id F8TqvZKvjkZu for ;

Tue, 26 May 2026 02:34:37 +0500 (+05)

Received: from [130.94.59.229] (unknown [130.94.59.229])

by mail2.adaoil.kz (Postfix) with ESMTPSA id 047902830CF6

for ; Tue, 26 May 2026 02:22:24 +0500 (+05)

Reply-To: mrsreamnassersaudi@gmail.com

From: "Mrs. Reem Nasser"

To: root@nk.ca

Subject: RE: Business Proposal / Saudi Aramco Group

Date: 26 May 2026 05:22:07 +0800

Message-ID: <20260526052207.99AE64A4DDE60D5C@adaoil.kz>

MIME-Version: 1.0

Content-Type: text/html

Content-Transfer-Encoding: quoted-printable

X-Spam_score: 7.7

X-Spam_score_int: 77

X-Spam_bar: +++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Greetings root@nk.ca, I have a genuine and promising business

proposal that I believe could be mutually beneficial, and I would very much

like the opportunity to discuss it with you. Would you be open to exploring

this opportunity as a trustworthy partner? Please let me know if you are

interested, and I would be happy to provide more details at your convenience.





Content analysis details: (7.7 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[37.228.64.18 listed in dnsbl.ahbl.org]

[37.228.64.18 listed in dnsbl.ahbl.org]

[37.228.64.18 listed in dnsbl.ahbl.org]

[37.228.64.18 listed in dnsbl.ahbl.org]

[130.94.59.229 listed in dnsbl.ahbl.org]

[130.94.59.229 listed in dnsbl.ahbl.org]

[130.94.59.229 listed in dnsbl.ahbl.org]

[130.94.59.229 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[37.228.64.18 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[37.228.64.18 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[37.228.64.18 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[37.228.64.18 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[130.94.59.229 listed in will-spam-for-food.eu.org]

[130.94.59.229 listed in will-spam-for-food.eu.org]

[130.94.59.229 listed in will-spam-for-food.eu.org]

[130.94.59.229 listed in will-spam-for-food.eu.org]

[130.94.59.229 listed in will-spam-for-food.eu.org]

[130.94.59.229 listed in will-spam-for-food.eu.org]

[130.94.59.229 listed in will-spam-for-food.eu.org]

[130.94.59.229 listed in will-spam-for-food.eu.org]

[37.228.64.18 listed in will-spam-for-food.eu.org]

[37.228.64.18 listed in will-spam-for-food.eu.org]

[37.228.64.18 listed in will-spam-for-food.eu.org]

[37.228.64.18 listed in will-spam-for-food.eu.org]

[37.228.64.18 listed in will-spam-for-food.eu.org]

[37.228.64.18 listed in will-spam-for-food.eu.org]

[37.228.64.18 listed in will-spam-for-food.eu.org]

[37.228.64.18 listed in will-spam-for-food.eu.org]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[37.228.64.18 listed in wl.mailspike.net]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[37.228.64.18 listed in bl.score.senderscore.com]

-0.0 SPF_PASS SPF: sender matches SPF record

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

0.5 NO_RDNS Sending MTA has no reverse DNS (Postfix variant)

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HK_NAME_MR_MRS No description available.

1.3 RDNS_NONE Delivered to internal network by a host with no rDNS

0.7 TO_NO_BRKTS_FROM_MSSP Multiple formatting errors

0.0 NO_RDNS2 Sending MTA has no reverse DNS

2.5 FREEMAIL_FORGED_REPLYTO Freemail in Reply-To, but not From

0.0 FROM_MISSPACED From: missing whitespace

0.0 TO_NO_BRKTS_NORDNS_HTML To: misformatted and no rDNS and HTML only

0.3 FROM_MISSP_EH_MATCH From misspaced, matches envelope

Subject: {SPAM?} RE: Business Proposal / Saudi Aramco Group














right: 0.5em; padding-bottom: 0.5em; padding-left: 0.5em;"> Greetings root@=

nk.ca,







I have a genuine and promising business proposal that I believe could be mu=

tually beneficial, and I would very much like the opportunity to discuss it=

with you.





Would you be open to exploring this opportunity as a trustworthy partner? P=

lease let me know if you are interested, and I would be happy to provide mo=

re details at your convenience.





Thank you for your time and consideration.





Best regards,


Mrs. Reem Nasser,
Business Development Manager,
Saudi Aramco Grou=

p Oil Company.


NetKnow Now in Netcraft's Top 15350 Part 2

Posted by Dave Yadallee on


Platinum Communications





Platinum Communications Corp.

bought out by Xplornet .



Wild Rose Internet





Wild Rose Internet

ranks >2000000 from >2000000 and I wonder if this is another wireless branch of Tera-Byte and bought out by Xplornet





TIC Internet





TIC Internet

ranks >2000000 from >2000000 ( I do remember you).



Nisa Custom Internet Solutions





Nisa Custom Internet Solutions

ranks >2000000 from >2000000 by Netcraft



MediaShaker





Media Shakers of Edmonton

ranks >2000000 from >2000000





Koi Media





Koi Media

rank >2000000 from >2000000



WebFire





Webfire.ca

ranks >2000000 from >2000000 and seems to be connected with Shaw.



Core Network Solutions Inc.





Core Network Solutions Inc.

ranks at >2000000 from >2000000 .



The Network Centre





The Network Centre

ranks >2000000 from >2000000 and are linked with Telus high Speed.





Open Concept Internet, Inc.





Open Concept Internet, Inc.

rank > 2000000 from > 2000000





Techalta





Interspots of Edmonton

acquired by Techalta ;



Yegtel





Yegtel rank > 2000000 .



Internet Crossroads





Internet Crossroads Ltd of North Edmonton

rank nothing from nothing by Netcraft and seems to merged with Tera-Byte/ecn.ab.ca .



If I remember anymore, I will add to this entry, before Netcraft changes our ranking. Please watch this space and please feel free to peruse

our services.

NetKnow Now in Netcraft's Top 15350 Part 1

Posted by Dave Yadallee on
All data is from Netcraft Toolbar .

Looks as if there are major changes to the Netcraft algorithm after some years! Why did Avast clasify the extension as URL:Phishing?

This is not the Alexa Tool Bar!



NetKnow







Netknow now at 15345 from 14636 at Netcraft and pfs compliant



A significant decrease! We must do
  1. security audits regularly
  2. check on illegitimate traffic hitting the web server


    3. and
  3. keep design current!




How do we compare with other providers in

Edmonton, Alberta, Canada?



Telus and reviews



Next we have Telus.com

ranked by Netcraft at 3287 from 3312 .

Sometimes their Web Hosting is done by
title="Internet Names for Business">Internet Names for Business

is ranked by Netcraft at >2000000 from >2000000 .



Is Telus's ADSL network susceptible to Code Red Attacks and Attackers?

Reviews of Telus are available :





Rogers





Rogers Business Solutions

which rank 5430 from 5344 and are hosted in Europe.



Government of Alberta



The Government of Alberta Website

ranks 14657 from 14793 by Netcraft and seems to hosted on Cloudfare.



Netknow again





We at Netknow are at 15345 from 18857 since the start of 2026.



City of Edmonton







The City of Edmonton ranks 36235 from 35449 by Netcraft and hosted by Google.



University of Alberta







The University of Alberta ranks 47175 from 47360 hosted by Amazon Techonologies.



Juno and NetZero





We have Juno Internet ranked on top

at 306335 from 336161 who are the owners of

US Based Netzero at Netcraft Rank 82292 from 83219 .





NAIT / Northern Alberta Institute of Technology





NAIT ranks 124673 from 123989 hosted by Microsoft .





Grant MacEwen University





MacEwan ranks 129235 from 126399 .



TekSavvy



TekSavvy ranks 219230 from 228379 and are hosted by Microsoft



Shaw Cable





Next,

members.shaw.ca

ranks >2000000 from >2000000 and retired and

Shaw Cable

is next at Netcraft rank >20000000 from >20000000 . Hosted now by Akamei .

Their Network Hosting Arm,

Big Pipe is at

Netcraft rank 345961 from 349214 and hosted by Akamai in Europe .



Reviews of Shaw are available :





Internet Centre / CCINet



Internet Centre

rank 352698 from 380368 . Their partner Rack Nine ranks > 2000000.



Xplornet



xplornet

ranks >2000000 from >2000000 and are listed with

Cirrus9 and are joining up with Shaw.

Their new domain xplore.ca ranks 444878 from 451922 .

According to an article in the Sherwood Park Independent, they are also getting an Alberta Government subsidy.



Distributel / 3Web / CIA



Cybersurf

is ranked 971531 from 873158 and seems to be hosted in USA by DigitalOcean.



Primus



Primus

ranks >2000000 from >2000000 and now points to BLACKIRON_DataCentres ranked >2000000 from >2000000.



Northern lights Fiber







Northern lights Fiber are ranked by Netcraft >2000000 and uses AWS.



OkayVPN





OkayVPN

are ranked by Netcraft >2000000 and uses Cloudfare.



Radiant Communications / goco.ca





Radiant Communications

are ranked by Netcraft >2000000 and part of goco.ca

which ranks >2000000 .



Tera Byte Edmonton and reviews





Next is Tera-Byte

at Netcraft Rank >2000000 with

Tera-Byte.ca

ranking >2000000 from >2000000 and their wireless arm Tera-Byte Wireless

sold to Xplornet.

One of Tera-Byte's acquisitions

Edmonton Community Networks

ranks at >2000000 from >2000000 and

Go Edmonton ranks >2000000 from >2000000.

Alberta political blogger Daveberta ranks >2000000 from >2000000; interesting!!!

Reviews of Tera-byte is available at

here

and another here

and check Google for more reviews; just search tera byte.



MCSnet





MCSNET ranks >2000000 from >2000000 and are hosted by Microsoft .



Nucleus Internet Services





After that we have

Nucleus Information Services which can be found at Netcraft Rank >2000000 from >2000000 .





4Web





4web ranks >2000000 from >2000000 .



Alentus / Wolfpaw





Alentus

rank by Netcraft >2000000 from >2000000 and I note they are hosted in the USA .

wolfpaw.net

which ranks at >2000000 from >2000000



Yellowpencil





Yellowpencil Ranks >2000000 from >2000000



WSI Corporation





Next is WSI - We Simply The Internet of Toronto

at Netcraft Position >2000000 from >2000000 and are being hosted on Amazon.



Uniserve / Interbaun





Next, Uniserve

ranks on Netcraft >2000000 from >2000000

One of their acquisitions

interbaun

ranks with Netcraft ?????? from ?????? due to merging of sites.

One customer just came over from this organization in Nov 2006.



Clearwave Broadband





Clearwave Broadband ranks

at >2000000 from >2000000

Centex Phish

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Mon, 25 May 2026 13:58:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wRbQt-00000000IHz-244r

for dave@doctor.nl2k.ab.ca;

Mon, 25 May 2026 13:57:51 -0600

Resent-From: The Doctor

Resent-Date: Mon, 25 May 2026 13:57:51 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from ns1.robo.co.jp ([219.166.6.18]:57744 helo=mail.robo.co.jp)

by doctor.nl2k.ab.ca with esmtp (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wRaaz-000000005TP-2wJb

for sales@nk.ca;

Mon, 25 May 2026 13:04:25 -0600

Received: from synergyhub.com.my (unknown [104.223.84.134])

by mail.robo.co.jp (Postfix) with ESMTPA id 84AF162116

for ; Tue, 26 May 2026 04:00:22 +0900 (JST)

From: "Accounts Payable - (Stephanie Delanoy)"

To: sales@nk.ca

Subject: ref : EFT Payment Notification for Inv#76620

Date: 25 May 2026 12:03:22 -0700

Message-ID: <20260525120321.F9AE528F389EF2C0@synergyhub.com.my>

MIME-Version: 1.0

Content-Type: multipart/mixed;

boundary="----=_NextPart_000_0012_E0246A6A.51D43055"



This is a multi-part message in MIME format.



------=_NextPart_000_0012_E0246A6A.51D43055

Content-Type: multipart/related;

boundary="----=_NextPart_001_0013_E0246A6A.51D43055"



Dear sales,



Please find below your electronic remittance advice for Inv#16147



Payments will be post to your account within 1-5 business days of the attached remittance advise document.



Payment Secure Document for:sales@nk.ca

Scanned by: nk.ca Trusted AI Scanner Detector.

Attachment type: PDF

Date:5/25/2026 12:03:21 p.m.



If you do not receive this payment or have questions please do not hesitate to contact and reach out to us.







Thanks



Credit Team







CONFIDENTIALITY NOTE: This message is intended only for the use of the individual or entity to which it is addressed and may contain information that is privileged, confidential and exempt from disclosure under applicable law. If the reader of the message is not the intended recipient, you are hereby notified that any dissemination, distribution or copying of this communication is strictly prohibited. If you have received this communication in error, please notify us immediately and delete this message permanently from your files

WEb/SEO/APP spam from Google Gmail Part 1

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Mon, 25 May 2026 13:56:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wRbP1-00000000IAl-095F

for dave@doctor.nl2k.ab.ca;

Mon, 25 May 2026 13:55:55 -0600

Resent-From: The Doctor

Resent-Date: Mon, 25 May 2026 13:55:54 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-pl1-f174.google.com ([209.85.214.174]:51434)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wRaJl-00000000Kgh-3Ra4

for sales@nk.ca;

Mon, 25 May 2026 12:46:34 -0600

Received: by mail-pl1-f174.google.com with SMTP id d9443c01a7336-2ba21d32776so71909495ad.2

for ; Mon, 25 May 2026 11:45:38 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=lexxsolution.com; s=google; t=1779734732; x=1780339532; darn=nk.ca;

h=content-language:thread-index:mime-version:message-id:date:subject

:to:from:from:to:cc:subject:date:message-id:reply-to;

bh=SB8VPiQdctW8k/eCAB4poOjUWHx7BksusFsaudKUbcs=;

b=f+U8LK7dnQ74cJQ2/j1Ne1CGmhU4E57NZ887nM03Hnb5OGdailUvFNT4O5qQYjCAk6

X48Rn/CUTbsAI1VFYdv8JWFndMrbKMVGp8np7UFWi7wPg9zfnKP8LLuqdUjkzp8amEtu

TFTOKOoJgmQN05IVrbDnefZMnfYbzFPwZCf2gA/zD+cqdQA2rVa+8/1M0iOm32JmS2ZC

iV0AVOfTyHM4s1KvYeIOJToHrGfHN4mRObdkHdi9+L6CENSCENxVlHoSZPmFyuCf+XeK

GyIwnZQTONWrqXvWuXi9bzQQnoFKpxx23DhdVQ7Ma3z0YuyouqCPR1vJvFWpRLXkw5QT

2aTw==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20251104; t=1779734732; x=1780339532;

h=content-language:thread-index:mime-version:message-id:date:subject

:to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date

:message-id:reply-to;

bh=SB8VPiQdctW8k/eCAB4poOjUWHx7BksusFsaudKUbcs=;

b=pStC+qOtf2lSE7zZP9DZSrOx/+EZ4VPuUY6wiVMuRn/hzzx0tSWSCBuWmNl2gf6HBO

NGPaZU/XvC1L7q3dpsDCaZQRgFPQUtjE1jyqAqaQTmU3cQg++Jaezl2NdUsK1zPWHEZ7

7lr9yHB7AK4qrCX7Ow59AH+FC2WwrUGasokVDfs5QbKmCWnDEQCaHsA3DLExiyaAnmyJ

jypBa5i0O6wZjsj2VPIAb7TYDJ1m7FE6sJHxhbJUwvnBLiUnmLlpfhj1rdZxYiDFzyCu

wagZYL5O/VnObW4MJapYoBzsQHwoBJo0SVvdQW1h2+YQWeK3mNSYyK50OGnA8y6VKc+9

FU5A==

X-Gm-Message-State: AOJu0YyAVtBUaAaeRc4tc5Slwc8sNSmtdT/5IuNEfNZFPVlDFK4xQg5s

inmSunsrtBEqsTKVbVCtNOKASmiykJ9+QUOlFif83mxFyMg2Rr008Jc4TT9qsqqSGgvlVD1H1qG

gxdF5XrM=

X-Gm-Gg: Acq92OGuJCCEeQNI40K9y89+2PbKW+EJUhf9NcgRShvef8gAXKhHrtiU8ahFG5gebx4

Jg0yXY5OqFUPsXmyPpx8V29SwsRY0bv44xV1qB5qEM4BbWP93tV3J0gCyNFUiZ9vrczwROWDW1U

Cc8DJTalYOCvkqIbnlEEFy23PsST2I4xscykG0O5pRHjnI1jNZXQScv7rXVDPbHKiVmDcTv0UaS

naR2Hq8TFRSv1RL3l9UzLzIuBZeH7xF56naOoLam8V4w1hZ9++nj5Hv1GIaho9FlPKOzh5aHlzy

/K7RBMBaH+o5RScvWaaK+IxC8AYIqU9LqIrvmXR2WqnGM78gKLwoy3uvXjtAVJ5zdUpOmK4qMd3

RCzf1jMDCF8xZQ9T/RCUSVEMps7Tw2hyYTKcS1XgZA9o3K7KkMzK8qDXhEtWK1LiUzGZ4D7XpCQ

vQzUj4hMkuwrmV665rHy1R3QGPgKzctfGKLH2xEw==

X-Received: by 2002:a17:902:e550:b0:2b2:5491:e32f with SMTP id d9443c01a7336-2beb0378091mr179236125ad.16.1779734732129;

Mon, 25 May 2026 11:45:32 -0700 (PDT)

Received: from DESKTOPL0BFM60 ([2405:201:4019:8dc:8410:7160:64d2:7e98])

by smtp.gmail.com with ESMTPSA id d9443c01a7336-2beb56b5886sm91966175ad.20.2026.05.25.11.45.30

for

(version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128);

Mon, 25 May 2026 11:45:31 -0700 (PDT)

From: "Bryan Harris"

To:

Subject: Re: Bryan Harris

Date: Mon, 25 May 2026 21:05:47 +0530

Message-ID: <145001dcec5d$247abf10$6d703d30$@lexxsolution.com>

MIME-Version: 1.0

Content-Type: multipart/alternative;

boundary="----=_NextPart_000_1451_01DCEC8B.3E32FB10"

X-Mailer: Microsoft Outlook 16.0

Thread-Index: AdzsXY3yeTBKZiytSPSZzVsBCJzFfQ==

Content-Language: en-in

X-Spam_score: 6.3

X-Spam_score_int: 63

X-Spam_bar: ++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Hello, I trust you had a pleasant weekend. Are you planning

to upgrade your online presence with a new website or mobile application?

A modern digital platform can make it easier for customers to connect with

your business, improve accessibili [...]



Content analysis details: (6.3 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[209.85.214.174 listed in dnsbl.ahbl.org]

[209.85.214.174 listed in dnsbl.ahbl.org]

[209.85.214.174 listed in dnsbl.ahbl.org]

[209.85.214.174 listed in dnsbl.ahbl.org]

[2405:201:4019:8dc:8410:7160:64d2:7e98 listed in]

[dnsbl.ahbl.org]

[2405:201:4019:8dc:8410:7160:64d2:7e98 listed in]

[dnsbl.ahbl.org]

[2405:201:4019:8dc:8410:7160:64d2:7e98 listed in]

[dnsbl.ahbl.org]

[2405:201:4019:8dc:8410:7160:64d2:7e98 listed in]

[dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[209.85.214.174 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[209.85.214.174 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[209.85.214.174 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[209.85.214.174 listed in dnsbl.ahbl.org]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[209.85.214.174 listed in list.dnswl.org]

1.9 URIBL_JP_SURBL Contains an URL listed in the JP SURBL blocklist

[URI: lexxsolution.com]

1.9 URIBL_ABUSE_SURBL Contains an URL listed in the ABUSE SURBL blocklist

[URI: lexxsolution.com]

-0.0 SPF_PASS SPF: sender matches SPF record

1.1 DATE_IN_PAST_03_06 Date: is 3 to 6 hours before Received: date

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[209.85.214.174 listed in bl.score.senderscore.com]

-0.0 RCVD_IN_MSPIKE_H3 RBL: Good reputation (+3)

[209.85.214.174 listed in wl.mailspike.net]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[2405:201:4019:8dc:8410:7160:64d2:7e98 listed in]

[will-spam-for-food.eu.org]

[2405:201:4019:8dc:8410:7160:64d2:7e98 listed in]

[will-spam-for-food.eu.org]

[2405:201:4019:8dc:8410:7160:64d2:7e98 listed in]

[will-spam-for-food.eu.org]

[2405:201:4019:8dc:8410:7160:64d2:7e98 listed in]

[will-spam-for-food.eu.org]

[2405:201:4019:8dc:8410:7160:64d2:7e98 listed in]

[will-spam-for-food.eu.org]

[2405:201:4019:8dc:8410:7160:64d2:7e98 listed in]

[will-spam-for-food.eu.org]

[2405:201:4019:8dc:8410:7160:64d2:7e98 listed in]

[will-spam-for-food.eu.org]

[2405:201:4019:8dc:8410:7160:64d2:7e98 listed in]

[will-spam-for-food.eu.org]

[209.85.214.174 listed in will-spam-for-food.eu.org]

[209.85.214.174 listed in will-spam-for-food.eu.org]

[209.85.214.174 listed in will-spam-for-food.eu.org]

[209.85.214.174 listed in will-spam-for-food.eu.org]

[209.85.214.174 listed in will-spam-for-food.eu.org]

[209.85.214.174 listed in will-spam-for-food.eu.org]

[209.85.214.174 listed in will-spam-for-food.eu.org]

[209.85.214.174 listed in will-spam-for-food.eu.org]

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 HTML_MESSAGE BODY: HTML included in message

-0.0 RCVD_IN_MSPIKE_WL Mailspike good senders

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

Subject: {SPAM?} Re: Bryan Harris

WEb/SEO/APP spam from Google Gmail Part 2

Posted by Dave Yadallee on


This is a multipart message in MIME format.



------=_NextPart_000_1451_01DCEC8B.3E32FB10

Content-Type: text/plain;

charset="us-ascii"

Content-Transfer-Encoding: 7bit



Hello,



I trust you had a pleasant weekend.



Are you planning to upgrade your online presence with a new website or

mobile application? A modern digital platform can make it easier for

customers to connect with your business, improve accessibility, and support

long-term growth.



We create websites and mobile applications designed around each business's

specific goals, with the features and functionality needed to deliver the

right experience.



If this is something you're thinking about, I'd be glad to share more

information.



Thanks,



Bryan Harris



_____



From: Bryan Harris

Sent: Wednesday, May 20, 2026 2:33 PM

To: 'sales@nk.ca'

Subject: Bryan Harris



Hello,



Hope you're doing well.



Are you currently considering a new website or mobile app for your business?

With more customers relying on digital platforms for convenience and quick

access, having a strong website or mobile app can be a great way to improve

customer experience and create more opportunities for your business.



We specialize in developing custom websites and mobile apps tailored to each

business's goals and needs.



If this is something you'd be interested in exploring, I'd be happy to share

more details.



Thanks,



Bryan Harris





------=_NextPart_000_1451_01DCEC8B.3E32FB10

Content-Type: text/html;

charset="us-ascii"

Content-Transfer-Encoding: quoted-printable




xmlns:o=3D"urn:schemas-microsoft-com:office:office" =

xmlns:w=3D"urn:schemas-microsoft-com:office:word" =

xmlns:m=3D"http://schemas.microsoft.com/office/2004/12/omml" =

xmlns=3D"http://www.w3.org/TR/REC-html40">
HTTP-EQUIV=3D"Content-Type" CONTENT=3D"text/html; =

charset=3Dus-ascii">
(filtered medium)">
style=3D'word-wrap:break-word'>


class=3DMsoNormal>Hello,

I trust =

you had a pleasant weekend.

Are you planning to upgrade your =

online presence with a new website or mobile application? A modern =

digital platform can make it easier for customers to connect with your =

business, improve accessibility, and support long-term growth.

We =

create websites and mobile applications designed around each =

business’s specific goals, with the features and functionality =

needed to deliver the right experience.

If this is something =

you’re thinking about, I’d be glad to share more =

information.

Thanks,

Bryan =

Harris


style=3D'text-align:center'>

size=3D2 width=3D"100%" align=3Dcenter>


class=3DMsoNormal>
style=3D'line-height:115%'>From:
style=3D'line-height:115%'> Bryan =

Harris
Sent: Wednesday, May 20, 2026 2:33 =

PM
To: 'sales@nk.ca'
Subject: Bryan =

Harris

Hello,

Hope you’re doing well.

Are you =

currently considering a new website or mobile app for your business? =

With more customers relying on digital platforms for convenience and =

quick access, having a strong website or mobile app can be a great way =

to improve customer experience and create more opportunities for your =

business.

We specialize in developing custom websites and mobile =

apps tailored to each business’s goals and needs.

If this =

is something you’d be interested in exploring, I’d be happy =

to share more details.

Thanks,

Bryan =

Harris



------=_NextPart_000_1451_01DCEC8B.3E32FB10--



WEb/SEO/APP spam from Google Gmail PArt 2

Posted by Dave Yadallee on
Content analysis details: (6.1 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[2405:201:4019:8dc:8410:7160:64d2:7e98 listed in]

[dnsbl.ahbl.org]

[2405:201:4019:8dc:8410:7160:64d2:7e98 listed in]

[dnsbl.ahbl.org]

[2405:201:4019:8dc:8410:7160:64d2:7e98 listed in]

[dnsbl.ahbl.org]

[2405:201:4019:8dc:8410:7160:64d2:7e98 listed in]

[dnsbl.ahbl.org]

[209.85.219.50 listed in dnsbl.ahbl.org]

[209.85.219.50 listed in dnsbl.ahbl.org]

[209.85.219.50 listed in dnsbl.ahbl.org]

[209.85.219.50 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[2405:201:4019:8dc:8410:7160:64d2:7e98 listed in]

[dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[2405:201:4019:8dc:8410:7160:64d2:7e98 listed in]

[dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[2405:201:4019:8dc:8410:7160:64d2:7e98 listed in]

[dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[2405:201:4019:8dc:8410:7160:64d2:7e98 listed in]

[dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[2405:201:4019:8dc:8410:7160:64d2:7e98 listed in]

[will-spam-for-food.eu.org]

[2405:201:4019:8dc:8410:7160:64d2:7e98 listed in]

[will-spam-for-food.eu.org]

[2405:201:4019:8dc:8410:7160:64d2:7e98 listed in]

[will-spam-for-food.eu.org]

[2405:201:4019:8dc:8410:7160:64d2:7e98 listed in]

[will-spam-for-food.eu.org]

[2405:201:4019:8dc:8410:7160:64d2:7e98 listed in]

[will-spam-for-food.eu.org]

[2405:201:4019:8dc:8410:7160:64d2:7e98 listed in]

[will-spam-for-food.eu.org]

[2405:201:4019:8dc:8410:7160:64d2:7e98 listed in]

[will-spam-for-food.eu.org]

[2405:201:4019:8dc:8410:7160:64d2:7e98 listed in]

[will-spam-for-food.eu.org]

[209.85.219.50 listed in will-spam-for-food.eu.org]

[209.85.219.50 listed in will-spam-for-food.eu.org]

[209.85.219.50 listed in will-spam-for-food.eu.org]

[209.85.219.50 listed in will-spam-for-food.eu.org]

[209.85.219.50 listed in will-spam-for-food.eu.org]

[209.85.219.50 listed in will-spam-for-food.eu.org]

[209.85.219.50 listed in will-spam-for-food.eu.org]

[209.85.219.50 listed in will-spam-for-food.eu.org]

1.9 URIBL_JP_SURBL Contains an URL listed in the JP SURBL blocklist

[URI: lexxsolution.com]

1.9 URIBL_ABUSE_SURBL Contains an URL listed in the ABUSE SURBL blocklist

[URI: lexxsolution.com]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[209.85.219.50 listed in list.dnswl.org]

-0.0 SPF_PASS SPF: sender matches SPF record

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

1.1 DATE_IN_PAST_03_06 Date: is 3 to 6 hours before Received: date

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[209.85.219.50 listed in bl.score.senderscore.com]

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[209.85.219.50 listed in wl.mailspike.net]

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

Subject: {SPAM?} Re: Bryan Harris



This is a multipart message in MIME format.



------=_NextPart_000_1451_01DCEC8B.3E32FB10

Content-Type: text/plain;

charset="us-ascii"

Content-Transfer-Encoding: 7bit



Hello,



I trust you had a pleasant weekend.



Are you planning to upgrade your online presence with a new website or

mobile application? A modern digital platform can make it easier for

customers to connect with your business, improve accessibility, and support

long-term growth.



We create websites and mobile applications designed around each business's

specific goals, with the features and functionality needed to deliver the

right experience.



If this is something you're thinking about, I'd be glad to share more

information.



Thanks,



Bryan Harris



_____



From: Bryan Harris

Sent: Wednesday, May 20, 2026 2:33 PM

To: 'sales@nk.ca'

Subject: Bryan Harris



Hello,



Hope you're doing well.



Are you currently considering a new website or mobile app for your business?

With more customers relying on digital platforms for convenience and quick

access, having a strong website or mobile app can be a great way to improve

customer experience and create more opportunities for your business.



We specialize in developing custom websites and mobile apps tailored to each

business's goals and needs.



If this is something you'd be interested in exploring, I'd be happy to share

more details.



Thanks,



Bryan Harris

WEb/SEO/APP spam from Google Gmail PArt 3

Posted by Dave Yadallee on
------=_NextPart_000_1451_01DCEC8B.3E32FB10

Content-Type: text/html;

charset="us-ascii"

Content-Transfer-Encoding: quoted-printable




xmlns:o=3D"urn:schemas-microsoft-com:office:office" =

xmlns:w=3D"urn:schemas-microsoft-com:office:word" =

xmlns:m=3D"http://schemas.microsoft.com/office/2004/12/omml" =

xmlns=3D"http://www.w3.org/TR/REC-html40">
HTTP-EQUIV=3D"Content-Type" CONTENT=3D"text/html; =

charset=3Dus-ascii">
(filtered medium)">
style=3D'word-wrap:break-word'>


class=3DMsoNormal>Hello,

I trust =

you had a pleasant weekend.

Are you planning to upgrade your =

online presence with a new website or mobile application? A modern =

digital platform can make it easier for customers to connect with your =

business, improve accessibility, and support long-term growth.

We =

create websites and mobile applications designed around each =

business’s specific goals, with the features and functionality =

needed to deliver the right experience.

If this is something =

you’re thinking about, I’d be glad to share more =

information.

Thanks,

Bryan =

Harris


style=3D'text-align:center'>

size=3D2 width=3D"100%" align=3Dcenter>


class=3DMsoNormal>
style=3D'line-height:115%'>From:
style=3D'line-height:115%'> Bryan =

Harris
Sent: Wednesday, May 20, 2026 2:33 =

PM
To: 'sales@nk.ca'
Subject: Bryan =

Harris

Hello,

Hope you’re doing well.

Are you =

currently considering a new website or mobile app for your business? =

With more customers relying on digital platforms for convenience and =

quick access, having a strong website or mobile app can be a great way =

to improve customer experience and create more opportunities for your =

business.

We specialize in developing custom websites and mobile =

apps tailored to each business’s goals and needs.

If this =

is something you’d be interested in exploring, I’d be happy =

to share more details.

Thanks,

Bryan =

Harris



------=_NextPart_000_1451_01DCEC8B.3E32FB10--



WEb/SEO/APP spam from Google Gmail PArt 1

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Mon, 25 May 2026 13:56:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wRbOu-00000000IAI-0iGW

for dave@doctor.nl2k.ab.ca;

Mon, 25 May 2026 13:55:48 -0600

Resent-From: The Doctor

Resent-Date: Mon, 25 May 2026 13:55:47 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-qv1-f50.google.com ([209.85.219.50]:50413)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wRaJv-00000000KhX-2SHn

for sales@nk.ca;

Mon, 25 May 2026 12:46:43 -0600

Received: by mail-qv1-f50.google.com with SMTP id 6a1803df08f44-8acb3daf2aaso179170926d6.0

for ; Mon, 25 May 2026 11:45:48 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=lexxsolution.com; s=google; t=1779734742; x=1780339542; darn=nk.ca;

h=content-language:thread-index:mime-version:message-id:date:subject

:to:from:from:to:cc:subject:date:message-id:reply-to;

bh=SB8VPiQdctW8k/eCAB4poOjUWHx7BksusFsaudKUbcs=;

b=Px7AJGQ7p//CWSRw+ALGPD+5jmlInfXV2oeefh8U7rA74PTmGYQnTud0TEHa+DVjtl

eDrbds3WaVMCtHgEJiSVNXz2/AYnATNPDcI0ujDVLP0wgCsXN5XbBbs54eg70Mh6tWBq

L9owE9teRTARhvDf9jB/6Ixzq8F360NKKpdzkNExC/VF/GcFMRLEyal1qJtZ4q/Hgtxg

mmK461bEZ0pTy3rhaCEWEhrDEXyQGaEhOkYh/RJ6ikmz/No7lquyB6zd+ol44RVCAthC

hrxrYRi3ZLa4q3PV2Ny6DU1LRJK7A2pjnpncB7MDkJlXOLYLJLDiDoTzsK6duhH//wpo

TMNA==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20251104; t=1779734742; x=1780339542;

h=content-language:thread-index:mime-version:message-id:date:subject

:to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date

:message-id:reply-to;

bh=SB8VPiQdctW8k/eCAB4poOjUWHx7BksusFsaudKUbcs=;

b=jbzBgwYqBv0vBKp+p89CKY42in9P3hk1pEGrNuxudVy3HljxxEAA1tJEgXBAJxDqXz

QMacwht8mRIQ+H+8bj1Y3tMu2wi85nyhx+cjE+mXJAp/ErRAY/hIFQrxpLzDvYII3vOI

0lAockmMV8pIGTSz+LQ+Ds+T4qKl2lQIZS6j+cD/5iEqm3SYI/xSgFp6tAkveSwghWSM

qY/ibNMfyIDVhQUE1nKSLDdt/PEhNbAUrsTolBf1YLQq8pS0wOXfU9VPTHllFgqQZxLo

cEsKnZw9vrPQeYzvfomG9pAcCBtf3JATldkYpUnnQZiz4bz/eYacFdsxyPgsi88/++ZH

PMTg==

X-Gm-Message-State: AOJu0Yy7zz+OkPltT29S082EPe2Bmvt1gRULgPQ2+ce0oIQl3zo5p3RY

j5twvd1ItjPYfmV8ZmPVt7IpjNPs6Zo8iDvPWhXvESllfVb75giG2p0U5kqtdd+/blDnpeTaG60

QS0vymEM=

X-Gm-Gg: Acq92OF0iDKThyfbyjc2r5tRoce8JsJ9blNFpTUcj8Boyy3Dg8fxUBBgO4kmo2q3i16

2jGIjc3nKvMxdMnvPproSI6plw85FCRK2GUyEsl2fg7qC6Iq/yoogJ/zLK3OXYodcU2P79eXDAp

ePZVr7N/JteLCbF3RisNW6sLZIBFvANWyuNp/GQaGWndLxNJkRhfXp2wBzqPHlj3ncMzaZ2cZ5f

8c6yJax1Rm75WDtldafByHvsHCAhRyBFeZqjEtdU2UaWu84Npg2VtrfKekJ4NzTD4NnKzr0JhZF

qKsjEq9OIhw6ZrUrXM9iYOoBV5cbstWTrOq+/maDqsssGkbHW1AygNewOKy0U+5N6mepGwWN3Yr

7lIYwnIeXqkI/JAe51DuFBq6IVOKX8xgONfaWIMzmaTiG+b8gq//3UkK5p3OZhHnHGrWWdcvlLT

aGuvtMQSCdIkzw/vi8ytz18kjY1TkW11xbCaWicQ==

X-Received: by 2002:a17:902:e550:b0:2b2:5491:e32f with SMTP id d9443c01a7336-2beb0378091mr179236125ad.16.1779734732129;

Mon, 25 May 2026 11:45:32 -0700 (PDT)

Received: from DESKTOPL0BFM60 ([2405:201:4019:8dc:8410:7160:64d2:7e98])

by smtp.gmail.com with ESMTPSA id d9443c01a7336-2beb56b5886sm91966175ad.20.2026.05.25.11.45.30

for

(version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128);

Mon, 25 May 2026 11:45:31 -0700 (PDT)

From: "Bryan Harris"

To:

Subject: Re: Bryan Harris

Date: Mon, 25 May 2026 21:05:47 +0530

Message-ID: <145001dcec5d$247abf10$6d703d30$@lexxsolution.com>

MIME-Version: 1.0

Content-Type: multipart/alternative;

boundary="----=_NextPart_000_1451_01DCEC8B.3E32FB10"

X-Mailer: Microsoft Outlook 16.0

Thread-Index: AdzsXY3yeTBKZiytSPSZzVsBCJzFfQ==

Content-Language: en-in

X-Spam_score: 6.1

X-Spam_score_int: 61

X-Spam_bar: ++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Hello, I trust you had a pleasant weekend. Are you planning

to upgrade your online presence with a new website or mobile application?

A modern digital platform can make it easier for customers to connect with

your business, improve accessibili [...]

WEb/SEo/App spam from Google Gmail

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Mon, 25 May 2026 09:45:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wRXTF-00000000IYM-3rM6

for dave@doctor.nl2k.ab.ca;

Mon, 25 May 2026 09:44:01 -0600

Resent-From: The Doctor

Resent-Date: Mon, 25 May 2026 09:44:01 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-vk1-f197.google.com ([209.85.221.197]:42280)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wRVAf-00000000OOq-368X

for support@nk.ca;

Mon, 25 May 2026 07:16:51 -0600

Received: by mail-vk1-f197.google.com with SMTP id 71dfb90a1353d-575c242f1efso20958336e0c.1

for ; Mon, 25 May 2026 06:15:53 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=gmail.com; s=20251104; t=1779714865; x=1780319665; darn=nk.ca;

h=to:from:subject:date:message-id:mime-version:from:to:cc:subject

:date:message-id:reply-to;

bh=DhXRIUyaiuCN0eJ4CaF8kX86ZqT1ods8jGdkWla7+sk=;

b=ADmqMPa9N+o3CkvrZ8guODX/eWIkkPv/2cGvozHmXbOTH+7Dpo3GUNRIT8zLDtz2Nz

k+2j+UmdvGVFq7hoLdzh3j+qaLQrKJqbtCgtk/6LBfCgmRxkHMyZRW3nA/NVl9e/BKuz

60VPSW/7C4g6Zx5JBCRlIT13FG0Z3Dp56MZ09vw6c/0tSYowZ7w9ekAILBv7FRFdewEm

AYDkyXEWCTe7WAlf/jEt8wNeU38yrtplwQK4/qNSpggZBak0Ypj+GPk+0U2B9cp1GUvJ

4QzMfSSvjCEAIOc2fRhpbu+n3v6d3AjTaHPgWNfKuOInd8BUafFDbIaMza4NtnRhPwv9

Nyug==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20251104; t=1779714865; x=1780319665;

h=to:from:subject:date:message-id:mime-version:x-gm-message-state

:from:to:cc:subject:date:message-id:reply-to;

bh=DhXRIUyaiuCN0eJ4CaF8kX86ZqT1ods8jGdkWla7+sk=;

b=QGuWg0oli8P62bR+6MLOl+KA1ErsOwqBZfOMPO9lo89cIBvTdhnqKPNNJ8FoFMdhzN

y8S+NejUq2CPpGg16Ypu0VdZ/9q8dl5jlrL1OtAOc0VKqlfO8RTEcerYp0hr+sJ9MoXx

FMjQ1JzkSu57yOSXEwTb2kBY3VG8grILZLdiHWVGe19QifuztxmN3KzblF+WsQhuEFm6

z59myQ7xMiXMpD8JJnvsIqZKLKIbUu1nIJw+mF7ITxBISwUFuE7XKYwSnIwZ0MnCEsYy

GKSoC2cIJWbRvYlZoOtNMWDt8nVhPbgmexy2n1KBkCzuVZTcDfXmE4l184Dfi57p9F1D

XuIw==

X-Gm-Message-State: AOJu0Yy20RzhHiqppSyWxGn+gIJg2nlitJajqy2CjIxOGFoLI6q6xdGd

FMOif9c2S/iFdwnYPJjFOnnds5W0xtEEIisdeF3mTUfin7TQicGW7zo6xayS10zR4aDGi3ZWlKA

ddsysyQ==

MIME-Version: 1.0

X-Received: by 2002:a05:690e:b4d:b0:65e:d38f:b4c4 with SMTP id

956f58d0204a3-65ed38fbe32mr9722114d50.15.1779714852684; Mon, 25 May 2026

06:14:12 -0700 (PDT)

Message-ID:

Date: Mon, 25 May 2026 13:14:12 +0000

Subject: May I send you a inquiry 5/25/2026

From: petertergo282@gmail.com

To: support@nk.ca

Content-Type: multipart/alternative; boundary="0000000000009888490652a42771"



--0000000000009888490652a42771

Content-Type: text/plain; charset="UTF-8"; format=flowed; delsp=yes



Hello,

Have a great day dear,





I was going through your website, and I personally see a lot of potential

in your website and business.



I would like to send you a Proposal of your business website!



May I send you a inquiry?



Thanks,



--0000000000009888490652a42771

Content-Type: text/html; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable



Hello,
Have a great day dear,


I was going through your websit=

e, and I personally see a lot of potential in your website and business.
>
I would like to send you a Proposal of your business website!

M=

ay I send you a inquiry?

Thanks,

--0000000000009888490652a42771--

Dragonfly phish Part 2

Posted by Dave Yadallee on








This is an automated email. Please do not reply.







 





Intelcom est maintenant Dragonfly!







Cher(e) client(e),



Un colis qui vous est destiné a été retenu en raison du non-paiement des droits de douane applicables, conformément aux conditions générales de l'Agence des services frontaliers du Canada. Veuillez régler ces droits de douane à l'aide de notre formulaire sécurisé ci-dessous et choisir une heure de livraison qui vous convient : 



Accéder au formulaire sécurisé



Le non-respect de cet avis entrainera la réexpédition de votre colis à son expéditeur.



Important : Dragonfly peut percevoir des droits et taxes lorsque les autorités frontalières l’exigent.









Ceci est un message automatisé. Veuillez ne pas répondre à ce courriel.















--11e292c337a047cbde48a2365c3416c5a

Content-Type: text/html; charset=us-ascii















































































--11e292c337a047cbde48a2365c3416c5a--