Docusign phish from google Gmail

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Fri, 28 Aug 2026 20:48:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.100 (FreeBSD))

(envelope-from )

id 1x096J-000000005kJ-1m4v

for dave@doctor.nl2k.ab.ca;

Fri, 28 Aug 2026 20:47:23 -0600

Resent-From: The Doctor

Resent-Date: Fri, 28 Aug 2026 20:47:23 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-wm1-f102.google.com ([209.85.128.102]:42370)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.100 (FreeBSD))

(envelope-from )

id 1x08yh-000000004T4-0EMq

for doctor@netknow.ca;

Fri, 28 Aug 2026 20:39:40 -0600

Received: by mail-wm1-f102.google.com with SMTP id 5b1f17b1804b1-495437bb891so10819905e9.1

for ; Fri, 28 Aug 2026 19:38:43 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=brushme-com-ua.20251104.gappssmtp.com; s=20251104; t=1787971117; x=1788575917; darn=netknow.ca;

h=content-type:mime-version:date:message-id:subject:to:from:from:to

:cc:subject:date:message-id:reply-to:content-type;

bh=ecFgV2Mg7lNOcdQYVoSakzRe7/55dyBNG3/w3YUA8ys=;

b=FMTzC6ixf6rgdA/C19eVlynExVQp5G06Hhz0AtBvjscRTqUMdxKur8fq9Qz1FsZ4rR

5j1DAkDjj7omqwWVBs7PuB76+1zkJONtuLpIe0mOl1viZWJZ42/ZeBcggoLlAQHebxmY

6c44rlNkBi53A/dpSUTHIwVzSn9u+zmRrwQP5lAvgcM0TS8NxA+0uhVoC9kveYTCoxoV

sRtULVc1DIOuruWU9tZdCDk6KtO8gu7ZFXBp8/ZHTDNc1VK9+kmexF/ipfyCtni092Ok

gff05e2AJkXsCRd2TH2cO3Tw2lxFybSJVYKmF9O0rMwXCMzECSKbgvzagO2NGPLqCu2e

0fYA==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20251104; t=1787971117; x=1788575917;

h=content-type:mime-version:date:message-id:subject:to:from:x-gm-gg

:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to

:content-type;

bh=ecFgV2Mg7lNOcdQYVoSakzRe7/55dyBNG3/w3YUA8ys=;

b=ITEKc30VOGH92DOnJLY9cOc14DlzEQkuzIRlsXVNY2TIkUwRusZM32C2M9kLbxxLKS

SjBwAICDKDA8HoxTvd6nEL1RoiQq1kPBvbUJq+i3GxLh6BozWY7H2mSoEyJY12E0OAhV

yjvMQvT2+q9ZAVfzEbyvVdQkd/k3gC3L5D51n9nbb8fPAbObe1TH+rjMPmcw/C6wyh+E

wTlr66znk6idXJnQAGZ7O2JcAnxON3IYR8jHPDjSkjEyIx8UhAVqqbNjsqhN6gcZWRI6

I+MW5i0dG+Z/8XZCpIWyFOl3Iqa0dV59AbWDIz8TicCOmrlSQeYfYFvRYDxE7jAxUXjG

SOEg==

X-Gm-Message-State: AFuF++lWSyZaJkxXFNp/UAV3Uw9/LbH/cvC5ev2Y/kxvuOoa9WhUFajv

h4PAN3VuNttgbk2AUrCxpA0P/Mdf9+LTmoDNUfJs8EvWBIb+1hmHwb4vTSNTFU7YEiztfvtsN+Z

aBJ4suaR8LhHqLpSuzvMT0U/7MIkm4cR9ZH9aN4/cKVSCkwo=

X-Gm-Gg: AR+sD11i4xD7ZKEJc5YG29PyAKWR92tvKVl8ADcXnEvpwMVy5zC94N3ZnX6Y14hqmtE

eTiwzKpYdJN6sgFXaNF6wzHLft/YtmSY6lKdaOdjtQ2GA2xz+ZXyCsKH3PRKAzfR7jChhRY/0qL

e9iDIi/6/S10gRME6MnpapRX22mdQ8IjqwJOEs+/Klxffq+Nc6xlBjB4wksA91vw8xtuyhdvsTH

GOE/JeDbXGW1m0oHGHwD8Mkm5YSt/4u9QGMc2Hy/I6Nac3qGxGrlJVI5v743fMyXuUW56hL//QF

auKcovAdEKvgWWJb8rENIHLDUqTDhm44TT0+x7+N6oEY2dUBVD3SCCmOxG8ErsWO1ocP4aYdP36

o/mdqp0H/Fses2yvAuYKYqch3BX6V1BshfbwYERn0Dnw=

X-Received: by 2002:a05:600c:3b27:b0:49c:a2f3:fe9a with SMTP id 5b1f17b1804b1-49cca312bc5mr48656975e9.7.1787971116864;

Fri, 28 Aug 2026 19:38:36 -0700 (PDT)

Received: from brushmestore.de (ip31-70-65-27.pbiaas.com. [31.70.65.27])

by smtp-relay.gmail.com with ESMTPS id 5b1f17b1804b1-49b95021540sm9851435e9.14.2026.08.28.19.38.36

for

(version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256);

Fri, 28 Aug 2026 19:38:36 -0700 (PDT)

X-Relaying-Domain: brushmestore.de

From: support@brushmestore.de

To: doctor@netknow.ca

Subject: Notification

Message-ID:

Date: Sat, 29 Aug 2026 02:38:36 +0000

MIME-Version: 1.0

Content-Type: multipart/mixed; boundary="--_NmP-dc0c61cf5cd7b08f-Part_1"

X-Spam_score: 6.3

X-Spam_score_int: 63

X-Spam_bar: ++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Incoming Fax Document This email is from trusted netknow

server.



Content analysis details: (6.3 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[31.70.65.27 listed in will-spam-for-food.eu.org]

[31.70.65.27 listed in will-spam-for-food.eu.org]

[31.70.65.27 listed in will-spam-for-food.eu.org]

[31.70.65.27 listed in will-spam-for-food.eu.org]

[31.70.65.27 listed in will-spam-for-food.eu.org]

[31.70.65.27 listed in will-spam-for-food.eu.org]

[31.70.65.27 listed in will-spam-for-food.eu.org]

[31.70.65.27 listed in will-spam-for-food.eu.org]

[209.85.128.102 listed in will-spam-for-food.eu.org]

[209.85.128.102 listed in will-spam-for-food.eu.org]

[209.85.128.102 listed in will-spam-for-food.eu.org]

[209.85.128.102 listed in will-spam-for-food.eu.org]

[209.85.128.102 listed in will-spam-for-food.eu.org]

[209.85.128.102 listed in will-spam-for-food.eu.org]

[209.85.128.102 listed in will-spam-for-food.eu.org]

[209.85.128.102 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[31.70.65.27 listed in dnsbl.ahbl.org]

[31.70.65.27 listed in dnsbl.ahbl.org]

[31.70.65.27 listed in dnsbl.ahbl.org]

[31.70.65.27 listed in dnsbl.ahbl.org]

[209.85.128.102 listed in dnsbl.ahbl.org]

[209.85.128.102 listed in dnsbl.ahbl.org]

[209.85.128.102 listed in dnsbl.ahbl.org]

[209.85.128.102 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[31.70.65.27 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[31.70.65.27 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[31.70.65.27 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[31.70.65.27 listed in dnsbl.ahbl.org]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[209.85.128.102 listed in list.dnswl.org]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

0.0 URIBL_PH_SURBL Contains an URL listed in the PH SURBL blocklist

[URI: yogapantsdaily.net]

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[209.85.128.102 listed in wl.mailspike.net]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[209.85.128.102 listed in bl.score.senderscore.com]

-0.0 SPF_PASS SPF: sender matches SPF record

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.1 MXG_EMAIL_FRAG BODY: URI with email in fragment

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

2.0 RATWR8_MESSID Message-ID with excessive dashes and dollars

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

2.0 URI_WP_HACKED_2 URI for compromised WordPress site, possible malware

Subject: {SPAM?} Notification



----_NmP-dc0c61cf5cd7b08f-Part_1

Content-Type: text/html; charset=utf-8

Content-Transfer-Encoding: quoted-printable












initial-scale=3D1.0">

Incoming Fax Document








border=3D"0" width=3D"100%">









=20









=20

















This email is from trusted netknow server.









You have an incoming fax document containing 3(three) =

pages for your review.



=20



=20



Link expires after 3 Hours of Document sharing.



=20








This message was sent from an un-monitored email =

address. Please do not reply to this message.



 









----_NmP-dc0c61cf5cd7b08f-Part_1

Content-Type: image/png; name=download.png

Content-Transfer-Encoding: base64

Content-Disposition: attachment; filename=download.png



iVBORw0KGgoAAAANSUhEUgAAAXEAAACICAMAAAAmsyvzAAABFFBMVEX///8dHR0ZS6AAAAD//v//

//0YTKAaGhqlpqr8/PyRkpaysbUZS6IYGBgVFRUZS6QAQ47k7fQZTJ0APZUAPpMODg7Z2dnw8PAI

CAjv+P4APorj4+OVlZX19fXZ5O7S0tLB0+PHx8dGRka4uLjN2eCrw9wmJiZQUFCMjIyYmJhYWFh8

fHw6OjqxxtdkZGTAwMAvLy9vb290j7qDg4NoaGhJSUn7//U+Pj4AO40AOZZOcKBbeqorKysoUpsU

RosnUZM8YKKXsslqh7M7YJeJoLwqWpZFZqWqucxUead9lruns9Ta7e28099xjqsALYhviK0AMoFn

hqARTIaEn7iGoMaUp77///IwXapEY5TX4fFMdJhYeKcSd82fAAAXy0lEQVR4nO1dCUPbRreVPZZk

FVmSJXmVV0xsY4OBAI4DAcKSUJp8pe97aV7S/v//8e6dRZs3oKYuqU4bFi1j+8ydM3fuvSMkKUGC

BAkSJEiQIEGCBAkSJEiQIEGCBAkSJEiQIEGCBAniKBXbnex2rbad7bS9OhzQtHW/pR8XpXZttF8m

FOyb2qs11/2ufkSgEWvt/ibwbKhqKgTVIGR/u57Y+aqhtYcFUs6lZiJHChtSwvjKAFQWD1OkoM6m

m1k6GdUTzlcFrdMj5UV0U5A39XW/0R8CmlTPdomxjG5EebDuN/tDoL6tkmnzVnOGUTBysRNke93v

9oUDnA8tm4rzbaBPqL7pjY4Gm+/QOyz4s6laKK37Pb90dN5F+Ua2e4edpk+s5jWzwzfAemLkfxXo

XBcHJOwMgtt9XGvOmh1LnREp4yW5nb/9jf4wAEHph+dLg5RHGws0wxsSauSJrDwZzX0SzJNl0ltE

N/XYN/B60v673t+PBjDwXGDe3b63/A7pAMScbPwNb+5HhLdJAr43O9oDgoMaNfJk6nwa9nwFL5DR

A+OCmtQzEsafiJpwCQ0yKj70pvoAvZVEVZ4A7YArSo70Hhz31ko71D0kD+6h50RlCppMT8iSzAA/

ymt+kz60ASecdPcecVuW3lU4Dh0qro396hSs84v3p3eXrTxwrslyRv7nEF4/JlxQ+o8KvXZITs2R

VODTtLuEdNfkK9pRpNO6aZqKZU0m1vvXuxXZN/R/ALRemRn4zmMNdPvN/v5hyY+Qe+hdGmS5V/kc

sGdAAdZ1xbZdx75qSfJ4LW9sBkbUwlUyfEJuIXLLkPZcebiqN/Yo6HGkAYqtpHVd0ZW0ObnepTae

Wcu7i+CQE955QtJSi9yySf1LY3OFb+7hSM+Dwr7pivVtC/Q8s2Zl0cAPZ4SvQH6PGePHy698Bsym

m5k6fldM3X57I8vjdWcJ62puVYRLfRbYqq2gqcdjro0L7s20brsn9bXPnpylziraqqfKqkq668l8

BtTS/wIjV/A3+N/W04qZfp9HytfIep0mjwsHq2mtdJBKHawpduvLNvgmCoJOnvA1De6Kz7+tf/gk

o3e+njcpSVzFV7dqXF/FkDBp2zadt67rTgCu44J12zrnHLrBNO0TTf66Rsa3kXE1te7ZZAUQkmLq

VqtB8b31+fLuo+WAoNhCZhQ97X5Zq41vs4V66eVTLoTDTE8afiQF/uVfnbgRZ1GZfF/n7NlkjK9I

x9cJn1LbbUiZDF/o0O+tE9c2Qdxx9kRj/yhrEcblCCRtvKA/4AJsU+a3sUMZcPM5wrIKhyV6Qs6M

ZX/lNWDhv+MXnzkLjBgY90HtfCzdWrZu+8Ly9rMU4TQjj+XxGL7xW7S5Y0CDU2PoELghCNPA7UGn

hXsLf8f4mfwVesJ/ydJ+mQWx9vvtF50h9t2RCOMS/dxj+fuZLRafim7+HCUUFkVo2pV8Pl/RJCFI

M16D90UFrqxUJIlauxTlORN0F40PB+/Cb6U+YLmIXJkUNodZVoz/ArGIcbC0RtX2l5/2JB+7ovLq

7uTCcp2JdXFy16pIcxiHSxu/XF2fu44zOX9/dfuJiUtGzm8JfC4F7MveZ/94PdxeJ8UTbmqugOVW

O4PD7F7xpRn8bFWRhEpLu67Nzdy0nUs8gREWlGDp81XVddHPwXij7jjWf75LqCCZsIUisZXba/A3

TVxRwYRgO+5Ji4nQ7q8ug/PrK7+vZOm+WuXHf8uHGNckbWOTBGl8NUdr3kjq+GB7z3sxTkzgi8QY

B+BUJ9+nbboWxVjiiUQzQiAlMsyrVdtfIjG4zmkDiPTnV6oyGfmXiyr0iOm/EjTlfPuOl+06PF6p

O69kMUnK0mtc6OJR04qOKizF6u8QYsS2QaDFdwf9vRdh7osYp1remNiKmWYL/vOKLIz/bqKYisLk

RugSfHFuQlFGemH+owPmrZu64BunBMWe3ErIuDjogo37bgkwzodVjHEW5fayAxJnHXkHgz/eXlGW

of58jv8SxoGWU2RIp0tPd4uKijbOf3PttC3cGOHSm2n7rHqKkd2ggc/nLMMRxAzQqE3d/LUVMA49

FbFxhTGuTDEuoDW3R6lw4axfv8IKWP4SmtsDaJvsD5vPsq0i0HFnpo3L8q2TpsYMGuLsMv3NX7s2

2CkoBUgEWiyNxmBUxtSdkwp4fRJzR6SWhcepRmBoDKQJ6AfG05MbKcp41MZZ98xlHKEVswf7ZGo3

CriPe/OY0pZPs15NqJZaJqPnkCmfcXsG4xJaXMPhDqKiu7+jA6Np3/yEBY056tSGhWi4f6Cw4GfO

yFuWHZi2Yp/ZNESmKLZ7h/0RYTzIMr1OK8xDWsg4hdcZduMKkyMHMxmv1+DS/sLmigckXLFbfldf

vZUvZVyuWArTamD8Bm1cunfTQiMUG5alYYEBG57cyLjkAcIrF6GeMXV6FcqLXr3D6oy/zLgW6Hpk

ZwqZtQMlWwB/XiVH85vzDkSpuU/5M0QVljEOvDDLpIzfo+/RcmwzzaOKwKTjOi64kIIk4NXZGmdo

avTeCaQe6HbeOi56kia0g+vQBYxTGZ+v43GUNnoRsuKmrElej9dyzS7Mgr6r9+N8p8IF0OCbetMi

oxU72Y3mowbCclWRLmxh4+lTZPzaxCwFlxTr6rbVal2eWtSb4Yf/ZMGTRlXxTdx0L+7gyts/q/qZ

+z94eoWM4ycujsJ6EK+MyPqDQO3ObqPTnbGjKFQAXarBpBGru/P6+3Rj9OZjPKSlNi6BjYcZl3ct

3aREgkNRvfvE/ZL8laMoYsKrbmEEBUxcSI1tn9/yBenW9duf6R2Z+Yy7NAH1CBunaHcDaSHZ4Lgm

lQYhNmdmNSJXgMcjfiF7rAUYANChasHP+sGg8HzRL+w/IuKwnHHt3FZYTYWevgLSTtKccbhll0cC

M6DuN1X0D/E6036NM2ze8sXdvvhErTqjjeX8PYuzr5xxqb7jUx6pRekYEcWZUT+3UfavUEn5aKPZ

VSNjZa9LxFlR7Vg/DIlQuIOXYbmqVKoKU2PQ8TvwDF1T57mh6i8s+EKvg0URcxdxLXQGQi7d+nya

1tZYo6FDjGNJrORo9YxLnr+TtiAYB/McUov1vUgSrRAFYy2NfJtWibpdwrI59ivbOqQNQzsE3rDb

Oqlgl8bjSl+WMA4UfXfFNGm6v0vy7ltT4XVE78Fqx7If9K781zbpGd2utuDolT9tWjdynV7I1qsa

j9bOZVx/GuNsJwSzcb8ygm9gIcMdlXMaV4C9gm+sZbKNZ0uie8o4A5c2w+RSqy8dxUR/qtH5WMg4

xlPlW4uFRGxbd3cl6X8dnU+SzqWkZfwrgc+bqs7iAaZ1CQfeC8Z1K58Z+2FYEWBcwDhdND3Bxnlu

LqS/Wo2apwHDfp9rbsTh09CABXngyJdo+VZPdAFqvrcfcWHwUFst8yHhD5yHz51LGAduTm0+USrm

pAGWK0JSyqQRSwq1qizmpZjob4MaCcY/Spnp4sWFjNtPY7xfFgwwR67IzJOWhnJpBu8j7Mx5b3wD

Ju/4qSNxCERFq0cJx324fBuSQcr7Bpcb8vCHuCxRFW2cP0+bPGJln1ck6aMpVjUX8aRPvoqzKzKu

wBTbcBUevXJez8oOhRnXkfHIKv9pjPf41GkMuIEbKVH7rBUEiaFPB4Lte41kSJ83RAk32FHcxjIq

hwmHCaLESqpz5LhTkkpBPz4Uixinknvj6mkm3KZ9CjS9F/l9/UO8YqhimTazcftnYNwRNu58mVUQ

HWdcCjH+2BUQR9EXFXTi2lzBd5p0emTnIl5FSFEKuT3m19cHBNasBwbXClrsr5aDvUd9lZ3aQY41

MapijLcXrIkE4bodix1mWLaxUdX5kh6ueAVH3ovKLf06Xuhct6nCI+On0vj7xLfxL7MSoHHGg2te

s1d8JOPA6oDzor4DuRhxBefF/awYQDXqweWhTXOkR2UIju2UVXIojbClwkiqow2TwmHzwKdcpQYu

tgxwryaqKodkcz7lQpTNOOPI91jTPoqsm6LbVgVcu49+1e3ZOMo4Oo78FDruQcKOqspUOXREx90w

41c28+sfyTjffEJNnIdIVHJc5LJN99CmyofB5e1yoCjicLtgFGDW1VLIK/wAhEKflXh/+dLS9QO5

gvFwAGBIFjno8xinQcKxfOqLsa47dzjwf3aFWEw+xXhsOYJx5wZmznO/wOjjrIrFEOOK4l6GLjl9

CuPAYMAKj7IUysEHHxa4TvCrYf4LnHCxkoRj5Njj8qTua9KwTHrFsKNPGxkFviBjXFVD7wS3pAc9

OwVhlGY0I8G2/+RPXJ+1tF5tUBfQZUd0ylKI8Yx051KqwJl2MMPzwb/XasCKCC/NhK+P+CpfRAIf

XuNCofmLRzGO9eUBKzk2tx0FG1GkTaoxflCxNPD7J1fmPop3DIQfwowr1ehmRJg33xQ2UIB2QqFJ

NVIFzRg3QsFKurFgQQ2wYDzQ8QwryoLPfnuBtVrM2mD5c0fLHXaraZpC0xXlWsKdWcAiTrHjMYYD

qD+u25MtOHbqx8atL9CDtA+x7kfmvMswKPzuZMEvDPFKeUuhKYnH2fhGbE2iorMXoBQuhtakZsr3

+QyV232WGIXCHj1NfXdUinadLqxCmpKLksmULFhwMcJz+0t1HIN7n4LthHAif3kRlMEBxfZZhVYN

5au2zUKCZ84llgixlf5Yk+4sm+c89QvcsvXKxUpdKvtW4yu9EObarxksK8KeHUtbQajL+oSrKTkD

7fxuQW8+kvGQ18GlNlaPv8d8Di63tdCyvcsIL6KBD9igoKodLJWyIcIL3WggjK25AldlKH6fS7lP

qnLe4GvwSn5r9+666tp+PTkadZXuBxpnpBOd5x/MNKxBtYzMy5wvLR5jTNvmPa7cwFZ5YF1RLj7B

lTRNkcnfj6mNozVPfBt3b2QseZPlr/lz23yMr4JpidA6hhvikRfdbXWIOpFjQRGvF3pyRcHD60qH

xDDodIc30WABdz80EPWgM8tvYjHyGmPYY5fy0QC9Pb9aWnxkG9PCiIszqzpxcVGv6CJNr9iYl4SJ

dAzkvpqYbDbVzbPJTWXMNCh/hT1EZRwEaota/pXOIzB22j6/xfUpjJHWxeSUzZKypFX9Pk1Pdtn6

/9MH0XEPZRw/diQFpDJnOYI3aNQ5GnDKskAhW6HTcEB9uwA+4RthvR5SbPRYj0VEnAzi8RPqj6vv

6CMuqS+PVw0XpaTFJ1ZMZrmiIsL2f8Ykve1eMfc8A0PgA0/8KsitdfWq1Wr9cgWuII0/YSRXP2F2

/32Cq1WFekKKe3Gz22rdnjr2mXPFgrxj6T1uM+Jd7pxCS7v30JDI6D1QVdr7UQMnRlaKf+QSs9Ny

1uvssB/JOwxt4ZTn9ctENUIqRMcDEfnpftA6UBlvmDJuHNPDPAJD5vspIcapbaZ9o07zLSr8q129

l4NX2p2cs/mUMVWtwpjwC4AUnDcbfIl5z/oGV+xYk1K1LBePKNV7tr6CtY5pBmVG2JJli8qWBzLu

HUWe3gQCHtoq60P404SImEhfOzIwI3SwSXBT0GbRv4mauB8N8HzCVXBephqmOm5s4gmWZ5p51WzG

50FPn7+9k4O64ox8lQ7SlzothhB864ptmtUbvqiX62fhmha8CjdEQ+84NJWfkXcd2wy9ELhEPKf6

UMZLh9HkpEFG3qwtJ+3IMKAE820XBQODtELBEQeR51QMRVwlN3MjKV9Ytettlkg1yN7UOHgw47RO

ENTdRO86tD9Cq1xbwcinF/mCr4MAnWLdNwuab53TWh86fdq0gELBwgAzXaX+N66SeL0XG1Am7zd9

Tk1WnO9+9GmeObI5J6JUDDPOpkihNDAqhsF0qLHhkOty1jSRDSqoM/cg8cFDCDfw5SnPeXSbacoN

fHFO87Qc2a9ty2j5D1iMyDw47sjpzNJ13T2pZ3jSAZyTXUu36QjAXed4C1YI4eRavaET5ZeqmVbE

FA0tIdf6/9E2sWcY49GdASG+CzHL3e8E9h29Q+sG0oOrSno8Sx+QQI7CVGpsQ7Nv4my9jzfFtIq3

XQ8/Cpq6pNrMNxtgapO4wgyXBQF1vcp3iYfKlIHP/LeqzaqCdN/Q8XczPfmjwpI9yDirglNQrG3b

HwcKJjeU31qYh/sE60t4yTMhJKj7569cnA4QVn5WeIB+9Q7LURe80M3OG82a8OKwX8riSUIy5u93

xFO2tHYWnxDPLjR2xH0sOqbGyjFCL+SH5PGRLw/ZimfGQReUSIoNnkj1ZFeTx7FPTZ321xN8ZEJ4

ByiWHVrVSzlSW/tV/nRtoegEco2pDcV2bulcLG85Zzg8RHQMXr76uTGB6RP7ExiXShsxdJDy4kHs

6cCGMdoTFUPxO0BpMvV95uMV9n/a8080JebsFTc2+l32nPguczd4KLC50TkkqlpIDTvsDqEZbb+N

LIveglTtdDDWEH/xqRqXuJrgyAbJNR3Xtb7dNCS2m2R6/4+09dFxzaDkihYdun/CDVo4FYcBmsv/

8mwQS4JCx9jOdYMNdllunafN0FrLPt8Fr9KmqQ2FMt7/KYqspO31YsU8Rm7w03aWh2282B39Do4L

r0uMXEEdbYfO7HGDbR6kRP+p7Auv0d2Dpg7290c1cYcIynZCrewUMODYY4v/bOzdTj+ozo1jMpmA

j/bh57vdPN86Mp4WJAwaaq0/q66ri5nRca37LardoSGHl2lS5fZb1cE5gTLrOOd/7CLZeF7LjPP3

EywPANNXTKd6n5elxm9vHVbI/9ssxrM7sQVPoTBgXcHgxW74qUNprdeOd0bRE7yOYipEgDPhERrn

XrypWYz/dHgwGrX5DLIRv2OK8dYMbDXyUUWcubkHTD//6u7acl3woy9O7nYr1P2YdakkNX65em9N

qlW3+v7+thFqFAdQ4/LPM+hliw0qSS4Fb6Uul7IhwOjvFaL+t0qMITspIkxeNoa2PO8E7YoSX/Sr

BRLKsJXLmEKO3yGEei9+QhDbmXciRNxMBFn6+eBX0p1XLIOx+MpKvpHP43QZfVhLhlo7nqxI0Zle

ZtWJIbSPyhHzhtmqux1feE/Pn3P9Y1o+x6TbIN3DdpY94JYWphvdxfc98MSymsSFfs1UWxoNAtKd

iHIk9j2rVUm0q8WSdRGKxQ+i7Ch0XT37JvZw9wLZmeufPAyg4WWWfT7GSn/64JXcm85wB2fR59nk

ErPt8IbLpe+WPeiGAXfBLnqRTGC8mdj40TIR53l6wNGNvaV+LiYnZTLw13eh7s7EsfAMzWOofOWU

DYLo3t52Z1Fb8VOzTzyERk7QAy8THC19Qh83cfFl6uXEP9Fs5D7oS29IYg8bJ7nDkPcb+XAPZgmr

J6DVcoqtd2hAJVpf8QTGpdlHo2RMzY2P2X8vR77Nuyjg8CGNxX/JxlfzpLdRX66RS7FHi/gP+HJy

UPBN/N+OZti+8U8q1VaxpU2j7RplwTDTFKO3gqZ5+y8XHmec7SCsreqxNpjcofESyo2ISf0jHrW6

ZmjSkC3BU8eHK9slC354yqA5Bv4bi3Ut2Zr1UHi13uZRR3updo7lU81ms1ha5bMPNG2zEC6EYCJu

7KyEoxo52tjb7qZe7Hh5Fks5CFVOaTwHvyJN6ZeLnueVpG1SfKlW/gzIRgjnhefLMmYPQ5N4Horg

UKrtJ4wLwGQcopc9aS5VHq1kPI360HwTGvWk5I+FCGibBhEVQJrwPo3HbFlbAGAbGK93gPHhaibi

Fw9UkVChGi8BUsureXCFBkyjquAmotp6nv/8zwNqCh/vmlTkW0tWpgDMxodYUnGQ2DjDqGCMxM9e

ihO+sr9TS3W8WIeJWUt0nAGWl35VoacGe35W1ryHM2eH1GvJn5JjGBXUHLfnothk1V+hH9cnRbql

qE+8xDtEeITHq3BfBZeUxbWCj8U2GWU7tXcvd825YsByxxhQ4xNl/ismHOMqg97By42rrBo9g6Ud

tKGo/0w8imdFHf8CM+lo7R2ew0enYt1v6odGiT1zWDwcJZckfZ4b9ciDzArq8zxkL0EIO+HHOx2/

iAeBvnAE+0xy6IYnFv7sEBtN1LX9Nb1/HbZpWVCZHNYTCf+bkM0RUh6u528X/huBj5NsNl/oI/pf

JhIpSZAgQYIECRIkSJAgQYIECRIkSJAgQYIECf5e/D+k9gbPj/4sqAAAAABJRU5ErkJggg==

----_NmP-dc0c61cf5cd7b08f-Part_1--

Nk.CA Credential phish from Google Gmail

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Fri, 28 Aug 2026 17:10:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.100 (FreeBSD))

(envelope-from )

id 1x05ho-00000000P2v-3nHj

for dave@doctor.nl2k.ab.ca;

Fri, 28 Aug 2026 17:09:52 -0600

Resent-From: The Doctor

Resent-Date: Fri, 28 Aug 2026 17:09:52 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-wr1-f103.google.com ([209.85.221.103]:40263)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.100 (FreeBSD))

(envelope-from )

id 1x04xZ-00000000Gnd-1RIH

for doctor@netknow.ca;

Fri, 28 Aug 2026 16:22:14 -0600

Received: by mail-wr1-f103.google.com with SMTP id ffacd0b85a97d-482e06fda73so182013f8f.1

for ; Fri, 28 Aug 2026 15:21:18 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=fullybookeddoctors-com.20251104.gappssmtp.com; s=20251104; t=1787955671; x=1788560471; darn=netknow.ca;

h=message-id:date:reply-to:mime-version:content-type:to:subject:from

:from:to:cc:subject:date:message-id:reply-to:content-type;

bh=1Vy3HhA0Ottpxq/YS0IKFHFr9L9kKZg7OaTkmMuk16w=;

b=CfR+UHoQEQ4OsG6e4vqE1sqEHZni9Mf0oEvXfN83qUGT8kqNaYTNL4JeauZ22A6sXW

KkIXJE2hAGz2ectenCNmX+YYQsOxmlQPwaPiHGj0NxvaJmmv8eL/+XpUK7akY/5Da8mt

P6tdZZYDhoU52AXbaY9OMkfxnJZItwtvfsAMgBHKG+h1HGcKddZ3UuPmAvtzlU5eQzu6

D/KatfDSMnmoXEiqLfmW2gYUhA3VCMb8twUBTtof5rYvEvKP+NfzSoobnQPUAMgVON4w

COLirdv9hC8qhfV4kMOQOcif2tcw22+BqNzwwk4yxR6OGHABSJKszr/hsUsBGURXUGH7

OSnw==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20251104; t=1787955671; x=1788560471;

h=message-id:date:reply-to:mime-version:content-type:to:subject:from

:x-gm-gg:x-gm-message-state:from:to:cc:subject:date:message-id

:reply-to:content-type;

bh=1Vy3HhA0Ottpxq/YS0IKFHFr9L9kKZg7OaTkmMuk16w=;

b=T6xa8PahiGb1NOrZV0CKY2VKQl6BJ+5VmJ45wATi8s5QQn7UAGtGesYDUP/m/paeSC

xHm/KweKJlSsLsjdQKu9wwkD6LKcvHZi2JVEPXRD+KaaR37n8zlN885qsQU0yQ1Mbj2s

7Q4zaWmfT4zv1sMGE7kzL02GuWB5z1K9BzYEka/PB2jRzr7Z+oWGGKOPMeGBQ8yUbPJ0

9a22YCGVhxWsdgDtS3qy5F3pOKDhkZ4cdrzPg2tCtoheYmSuZpc3UA0JNduLbiNh5+to

4VX15mk8/PL4h0ir3nMr5kU21Xq2lZTUsBC2Qdk3up7hTOczfjuBnc4C6j4qs/G24hfH

pwZg==

X-Gm-Message-State: AFuF++kJ9N4LU9+7UFOhQDoz4GaQTg0oVNwrfh1ymjyH9YqGb0fgL71E

Ily6N8iXr1Hb34FDhwc6IdEhFIgdmAjAZt9xbsCT55kBRdMCGIufKpGvA7Jkgn9NTRGo7Nv6yr7

jWfIYdRqTDQhy1UK9EgVsMqgObsfP1S3hBe64eU8gZ3wG+J4=

X-Gm-Gg: AR+sD11oWhjZxBTbEuEmBUVqTqZx0WesTPrhZIG3ZKWKZvIip0Aj9JFWXF5bJQuXF/2

eIx8wb3Dv25to5ekvAZYJwohKxrLolYk8snPs4+QVklo5n+KgNfigNYSbafRcaNH0LJ3AhMvOqe

sO/8QNVPG35n3mEA54iGiacmvIS1nbk1la00PU63IHwQ46DRyN6q3wn+ZpAlE/b31HU3OZPM9Ii

JRj7eWI29kjni9cvHapJoXLiLrXiQZqv1+KMA+ZblWPjYvKPahf5Px7h/7mx9FqDJgObV+rGCHI

Eo2ijqi1a4sfXW3VPjs2ngPZUDa1dfZ60ZQ2iP881ylyg3wHIZx3iMNXd8blSknlYwCoIAX85Bw

7FCBoRLmAK9PIROzv8hCbRKlTz2S/UynsY4x8HWawXgbdBVk9Q5sX

X-Received: by 2002:a05:600c:4686:b0:499:d95a:41f with SMTP id 5b1f17b1804b1-49b91bd68famr82225925e9.0.1787955671383;

Fri, 28 Aug 2026 15:21:11 -0700 (PDT)

Received: from WIN-CLVG3PFJJET (ip31-70-65-27.pbiaas.com. [31.70.65.27])

by smtp-relay.gmail.com with ESMTPS id 5b1f17b1804b1-49b950202c3sm8704765e9.12.2026.08.28.15.21.11

for

(version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128);

Fri, 28 Aug 2026 15:21:11 -0700 (PDT)

X-Relaying-Domain: fullybookeddoctors.com

From: "netknow.ca Support"

Subject: Message Delivery Failure

To:

Content-Type: multipart/alternative; boundary="m7R=_uFiox8LgKUUeZilQKIUJR2vXwRpzS"

MIME-Version: 1.0

Reply-To:

Date: Fri, 28 Aug 2026 22:21:11 +0000

Message-Id: <28112026082122E613A2627B-B8009BA275@fullybookeddoctors.com>

X-Spam_score: 6.0

X-Spam_score_int: 60

X-Spam_bar: ++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: doctor@netknow.ca PORTAL Notification: Some Incoming messages

have been delayed due to a server error. To restore normal service and recover

your delayed messages, please click release message



Content analysis details: (6.0 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[31.70.65.27 listed in will-spam-for-food.eu.org]

[31.70.65.27 listed in will-spam-for-food.eu.org]

[31.70.65.27 listed in will-spam-for-food.eu.org]

[31.70.65.27 listed in will-spam-for-food.eu.org]

[31.70.65.27 listed in will-spam-for-food.eu.org]

[31.70.65.27 listed in will-spam-for-food.eu.org]

[31.70.65.27 listed in will-spam-for-food.eu.org]

[31.70.65.27 listed in will-spam-for-food.eu.org]

[209.85.221.103 listed in will-spam-for-food.eu.org]

[209.85.221.103 listed in will-spam-for-food.eu.org]

[209.85.221.103 listed in will-spam-for-food.eu.org]

[209.85.221.103 listed in will-spam-for-food.eu.org]

[209.85.221.103 listed in will-spam-for-food.eu.org]

[209.85.221.103 listed in will-spam-for-food.eu.org]

[209.85.221.103 listed in will-spam-for-food.eu.org]

[209.85.221.103 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[209.85.221.103 listed in dnsbl.ahbl.org]

[209.85.221.103 listed in dnsbl.ahbl.org]

[209.85.221.103 listed in dnsbl.ahbl.org]

[209.85.221.103 listed in dnsbl.ahbl.org]

[31.70.65.27 listed in dnsbl.ahbl.org]

[31.70.65.27 listed in dnsbl.ahbl.org]

[31.70.65.27 listed in dnsbl.ahbl.org]

[31.70.65.27 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[209.85.221.103 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[209.85.221.103 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[209.85.221.103 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[209.85.221.103 listed in dnsbl.ahbl.org]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[209.85.221.103 listed in list.dnswl.org]

0.0 T_SPF_PERMERROR SPF: test of record failed (permerror)

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[209.85.221.103 listed in wl.mailspike.net]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[209.85.221.103 listed in bl.score.senderscore.com]

0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in digit

[bryon20221(at)gmail.com]

0.1 MXG_EMAIL_FRAG BODY: URI with email in fragment

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

2.5 FREEMAIL_FORGED_REPLYTO Freemail in Reply-To, but not From

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

2.0 URI_WP_HACKED_2 URI for compromised WordPress site, possible malware

Subject: {SPAM?} Message Delivery Failure



This is a multi-part message in MIME format



--m7R=_uFiox8LgKUUeZilQKIUJR2vXwRpzS

Content-Type: text/plain; charset="iso-8859-1"

Content-Transfer-Encoding: quoted-printable





doctor@netknow.ca PORTAL



Notification: Some Incoming messages have been delayed due to a server=

error.



To restore normal service and recover your delayed messages, please cl=

ick release message=20



http://webmail.streamlineapparel.in/#NOP



through the official portal.



Release Messages https://abm-wellness.com/wp-content/plugins/fix/#doct=

or@netknow.ca



This is an automated system notification from the streamlineapparel ad=

ministrator. Please do not reply directly to this message.



--m7R=_uFiox8LgKUUeZilQKIUJR2vXwRpzS

Content-Type: text/html; charset="iso-8859-1"

Content-Transfer-Encoding: quoted-printable








8859-1">

Message Delivery Failure




ss=3DrcmBody>
DTH: 580px; BORDER-TOP: rgb(229,231,235) 1px solid; FONT-FAMILY: 'Sego=

e UI', Tahoma, Geneva, Verdana, sans-serif; BORDER-RIGHT: rgb(229,231,=

235) 1px solid; WIDTH: 580px; WHITE-SPACE: normal; WORD-SPACING: 0px; =

BORDER-COLLAPSE: collapse !important; BORDER-BOTTOM: rgb(229,231,235) =

1px solid; TEXT-TRANSFORM: none; FONT-WEIGHT: 400; COLOR: rgb(51,51,51=

); FONT-STYLE: normal; BORDER-SPACING: 0px; BORDER-LEFT: rgb(229,231,2=

35) 1px solid; ORPHANS: 2; WIDOWS: 2; MARGIN: 30px auto; BACKGROUND-CO=

LOR: rgb(255,255,255); border-image: none; font-variant-ligatures: nor=

mal; font-variant-caps: normal; -webkit-text-stroke-width: 0px; text-d=

ecoration-thickness: initial; text-decoration-style: initial; text-dec=

oration-color: initial" cellSpacing=3D0 cellPadding=3D0 align=3Dcenter=

>

: 0px; MARGIN: 0px; LINE-HEIGHT: 6px; PADDING-RIGHT: 0px; BACKGROUND-C=

OLOR: rgb(6,104,217)"> 

20px; PADDING-TOP: 35px; PADDING-LEFT: 30px; MARGIN: 0px; PADDING-RIG=

HT: 30px">
ONT-WEIGHT: 800; COLOR: rgb(6,104,217)">doctor@netknow.ca  PORTAL=


: 40px; PADDING-TOP: 0px; PADDING-LEFT: 30px; MARGIN: 0px; LINE-HEIGHT=

: 1.6; PADDING-RIGHT: 30px">

) 1px solid; BORDER-RIGHT: rgb(254,243,199) 1px solid; BORDER-BOTTOM: =

rgb(254,243,199) 1px solid; PADDING-BOTTOM: 18px; PADDING-TOP: 18px; P=

ADDING-LEFT: 22px; BORDER-LEFT: rgb(254,243,199) 1px solid; MARGIN: 0p=

x 0px 25px; PADDING-RIGHT: 22px; BACKGROUND-COLOR: rgb(255,251,235); b=

order-image: none">


OR: rgb(6,104,217); PADDING-BOTTOM: 0px; PADDING-TOP: 0px; PADDING-LEF=

T: 0px; MARGIN: 0px; PADDING-RIGHT: 0px">Notification: Some Incoming m=

essages have been delayed due to a server error.


"FONT-SIZE: 15px; PADDING-BOTTOM: 0px; PADDING-TOP: 0px; PADDING-LEFT:=

0px; MARGIN: 0px 0px 30px; PADDING-RIGHT: 0px">To restore normal serv=

ice and recover your delayed messages, please click release message
RONG> 
R: transparent" href=3D"http://webmail.streamlineapparel.in/#NOP" rel=3D=

noreferrer>
 through the official portal.


b(229,231,235) 1px solid; COLOR: rgb(107,114,128); PADDING-BOTTOM: 25p=

x; PADDING-TOP: 25px; PADDING-LEFT: 30px; MARGIN: 0px; PADDING-RIGHT: =

30px; BACKGROUND-COLOR: rgb(249,250,251)">


0px; PADDING-TOP: 0px; PADDING-LEFT: 0px; MARGIN: 0px 0px 10px; PADDI=

NG-RIGHT: 0px">This is an automated system notification from the strea=

mlineapparel administrator. Please do not reply directly to this messa=

ge.


=








--m7R=_uFiox8LgKUUeZilQKIUJR2vXwRpzS--



Kesef Marketing Loan phish from Google Gmail

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Fri, 28 Aug 2026 17:10:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.100 (FreeBSD))

(envelope-from )

id 1x05hc-00000000P1G-0aSj

for dave@doctor.nl2k.ab.ca;

Fri, 28 Aug 2026 17:09:40 -0600

Resent-From: The Doctor

Resent-Date: Fri, 28 Aug 2026 17:09:40 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-pl1-f177.google.com ([209.85.214.177]:53368)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.100 (FreeBSD))

(envelope-from )

id 1x04YZ-00000000Beh-1E66

for sales@nk.ca;

Fri, 28 Aug 2026 15:56:26 -0600

Received: by mail-pl1-f177.google.com with SMTP id d9443c01a7336-2ceab75934dso15995525ad.2

for ; Fri, 28 Aug 2026 14:55:30 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=kesefmarketing.com; s=google; t=1787954123; x=1788558923; darn=nk.ca;

h=list-unsubscribe-post:list-unsubscribe:in-reply-to:references

:message-id:date:to:from:subject:mime-version:content-type:from:to

:cc:subject:date:message-id:reply-to:content-type;

bh=U3OansXPNCj7OT1s6TjnqRideCSi5SK/89YZtKSuX6w=;

b=pALpHkhMPAmfcsU2P+ydtixy1Mqana/Xm6rLPEodTKExjYQ8PSQ6Vcw9f0LFsx3mp5

pr0pxW4S6CzDMau4rYlU2bh8YntD4NtU9kQY73/9rgVu4ul6znqAbVsGPmoabtPlbMug

TJsXWBLATVyZZQrcZRKAhiCB7+ZuakdTb8S3n8QhO8AL4O81LXALaX8At51GgszYaSZg

6LC9Mlz1AN5hYBjdQZTjVnvknjwI/bPYvantbTg3dPfBb8eIwGduT4d0BgxhZs7chcUy

+416/IcjMiy/EODar7oPuhRZ4yrcTNGS6HTlf49teWxuwvpPcRs5UC91EUyRmelx+Avb

Xk1g==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20251104; t=1787954123; x=1788558923;

h=list-unsubscribe-post:list-unsubscribe:in-reply-to:references

:message-id:date:to:from:subject:mime-version:content-type:x-gm-gg

:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to

:content-type;

bh=U3OansXPNCj7OT1s6TjnqRideCSi5SK/89YZtKSuX6w=;

b=J1opZ8U64LUeO75D+Ip6TUacqvdGnJB2WjQkDazFjbUygcGku28hEspvi5N16AvyGP

2PGNytNu82UbCg+xRne12WPhH9DNTBn6icy2OJAbjflCm2lYIH5MG1L3kEWqXf9N+X6Y

ApzyTtjrf76UPIua+SzZjXgpZzqqQbuIhA9Y0HX1Wh6Zhdip9QBmpgwWzHxDoXlWy5kp

Fhu1ixnRnmZU3+cQbgLYovt2MDxgfYWjAlPG/GHZO3avnPyRGFHFApSmmpiGuuqn6WXW

xB62m1hmqxmDGjiDcrYnCghqigjajHHZJFGgxqu7X6E8Px2oDaHl/ML2Gi0DefObJr4m

Lkhg==

X-Gm-Message-State: AFuF++m97t1/mLrXwI5rrizuNWBZU56ZLOWvJG6BwYZ9EVPCJqI9ppox

WvpbecOzW0l3ZKwcROc7vDVhy74YQfBRlUKX9ZnQx8UhfmHhkW9mkIC3g/CWwoHOS8G1TCLE0iH

Ay7ZpmYY=

X-Gm-Gg: AYBFou0HrZqkrUzwfdIq4yk4v8iZXXeD2wiOe4gJAShi3Gxk6L2jrrFtzO9bZaHtjQI

JX1dnhwG2jXGZ6H7Twqc5oukLTm6Izel8DelrE4BXEefQQyhEsVO5hwK1RYns5ybRvW48oi1C2j

wQuk1K9UQjZjgDkB4VChVbnexY/46Qldr47dypFVel9HkeKUXhW9LSRsZFhMm9T5nPNM3bPSRpx

RnIIxi0OiBg/HvtagbBxaIKyjnoIE/CiRvzSmPKhKAG602WnEGOtGI9miMz7m6y+gjdyl3fR79e

StR+8UiIacdWGiqdW/ODdBvrZqwyX3OD8UZPCl0ec1vBEaxU5LbqIqaI05cxtkQPxsdU22+dyRI

0SF7a86Co96oJHFJBAproyQgPgdllfVnCfOjv9STy38YAph0ZxMRea6rM7xftb+OfbJy3jqClXy

hEou2bDDH60lP44d14i2ojxEvTD42mcxNr+leD4eDKgxzvjWy4y6jUPyPZl9wu06gInqfD/QuzH

9Xo48HI00i32+2nV6l53bKmrB2+GguyOX6MHNSPfAlknxELO730t8+3jA==

X-Received: by 2002:a17:903:2f0d:b0:2c9:aae1:a61a with SMTP id d9443c01a7336-2d74e07003dmr185908155ad.14.1787954123251;

Fri, 28 Aug 2026 14:55:23 -0700 (PDT)

Received: from smtpgw.close.com (am11-natgw-b0.close.com. [54.186.6.46])

by smtp.gmail.com with ESMTPSA id d9443c01a7336-2d759869e3fsm9402775ad.44.2026.08.28.14.55.21

for

(version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256);

Fri, 28 Aug 2026 14:55:22 -0700 (PDT)

Content-Type: multipart/mixed; boundary="===============8958320557362251486=="

MIME-Version: 1.0

Subject: Re: Kesef Marketing | Smarter Access to Business Loans

From: =?utf-8?q?Anna_Kesef_Marketing?=

To: =?utf-8?q?Gurkirat_Wirring?=

Date: Fri, 28 Aug 2026 21:55:21 +0000

Message-ID: <178795412146.7.8559586588892536181@smtpgw.close.com>

X-CLOSEIO-EMAIL-ID: acti_NNwnCSSdZTCeViiOfkhe3ihO5wXwTc60xPVCzcRIlTf

References: <178646337461.7.1240611996543057914@smtpgw.close.com> <178656720216.7.1487486787664217380@smtpgw.close.com> <178665638576.8.14493170454529970862@smtpgw.close.com> <178665638576.8.10004896856150860707@smtpgw.close.com> <178674436134.7.13789459120733539838@smtpgw.close.com> <178674436134.7.15043001032031211174@smtpgw.close.com> <178717590920.7.11514546446340323981@smtpgw.close.com> <178717590920.7.6698188364795184228@smtpgw.close.com> <178777788923.8.15758713330881978271@smtpgw.close.com> <178777788923.8.13100416135937699766@smtpgw.close.com>

In-Reply-To: <178777788923.8.15758713330881978271@smtpgw.close.com>

List-Unsubscribe:

List-Unsubscribe-Post: List-Unsubscribe=One-Click



--===============8958320557362251486==

Content-Type: multipart/alternative; boundary="===============8590275346147705057=="

MIME-Version: 1.0



--===============8590275346147705057==

Content-Type: text/plain; charset="utf-8"

MIME-Version: 1.0

Content-Transfer-Encoding: quoted-printable



**Hi Gurkirat,**



=20



**This is Anna Sanchez from Kesef Marketing.**



=20



**I just wanted to check one last time before we move your file forward.**



=20



**If you'd like to proceed, you can start here: =20

**[**CLICK HERE TO START YOUR

APPLICATION**](https://form.jotform.com/260672364104452?lead_id=3Dlead_1MVG=

GnNXqVx8dbGrHgSfKaWzWuBT6yMLDjaGHIpxaD3&legalBusiness=3DN

K

MAINTENANCE&fullName\[first\]=3DGurkirat&fullName\[last\]=3DWirring&leadTyp=

e=3DAutomation)



=20



**If you need any assistance or have questions, feel free to reach out.**



=20



**Best regards,**



=20



=20



=20



** =20

**



**Anna Sanchez**



**SALES MANAGER**



** =20

**





anna@kesefmarketing.com

+1 (873) 502-8068

____________________________



To stop receiving these emails, click here.







On Aug 26, 2026, at 02:58 PM, Anna Kesef Marketing wrote:

> Hi Gurkirat,

>

> This is Anna Sanchez from Kesef Marketing.

>

> We still have your request open on our end.

>

> If you'd like to move forward, you can start here:

> CLICK HERE TO START YOUR APPLICATION

>

> If you have any questions or would prefer to speak directly, feel free to call me at 1-866-216-5475 or 873-502-8068

>

> Best regards,

>

>

>

>

> Anna Sanchez

> SALES MANAGER

>

> anna@kesefmarketing.com

> +1 (873) 502-8068

> ____________________________

>

> To stop receiving these emails, click here.

>

>

>

> On Aug 19, 2026, at 03:45 PM, Anna Kesef Marketing wrote:

>> Hi Gurkirat

>>

>> This is Anna Sanchez from Kesef Marketing.

>>

>> Just reaching out again in case the timing wasn’t right earlier.

>>

>> You can explore your options anytime here:

>> CLICK HERE TO START YOUR APPLICATION

>>

>> If you have any questions or would prefer to speak directly, feel free to call me at 1-866-216-5475 or 873-502-8068

>>

>> Best regards,

>>

>>

>>

>>

>> Anna Sanchez

>> SALES MANAGER

>>

>> anna@kesefmarketing.com

>> +1 (873) 502-8068

>> ____________________________

>>

>> To stop receiving these emails, click here.

>>

>>

>>

>> On Aug 14, 2026, at 03:52 PM, Lilian Llanillo wrote:

>>> Hi Gurkirat,

>>>

>>> This is Lilian Llanillo from Kesef Marketing.

>>>

>>> I wanted to follow up and see if funding is still something you're considering for your business.

>>>

>>> If so, you can review your options here:

>>> CLICK HERE TO START YOUR APPLICATION

>>>

>>> If you have any questions or would prefer to speak directly, feel free to call me at 1-866-216-5475 or 873-771-7630

>>>

>>> Best regards,

>>>

>>>

>>>

>>> Lilian Llanillo

>>> FUNDING ADVISOR

>>>

>>> email (16px).png lilian@kesefmarketing.com

>>> phone-call (16px).png +1 (873) 771-7630

>>> ____________________________

>>> IMG_5340.jpg

>>>

>>> To stop receiving these emails, click here.

>>>

>>>

>>>

>>> On Aug 13, 2026, at 03:26 PM, Lilian Llanillo wrote:

>>>> Hi Gurkirat,

>>>>

>>>> This is Lilian Llanillo from Kesef Marketing.

>>>>

>>>> Many businesses are currently reviewing their funding options to stay ahead.

>>>>

>>>> If this is something you’re considering, you can check your options here:

>>>> CLICK HERE TO START YOUR APPLICATION

>>>>

>>>> If you have any questions or would prefer to speak directly, feel free to call me at +1-866-216-5475 or 873-771-7630

>>>>

>>>> Best regards,

>>>>

>>>>

>>>>

>>>> Lilian Llanillo

>>>> FUNDING ADVISOR

>>>>

>>>> email (16px).png lilian@kesefmarketing.com

>>>> phone-call (16px).png +1 (873) 771-7630

>>>> ____________________________

>>>> IMG_5340.jpg

>>>>

>>>> To stop receiving these emails, click here.

>>>>

>>>>

>>>>

>>>> On Aug 12, 2026, at 02:40 PM, Lilian Llanillo wrote:

>>>>> Hi Gurkirat,

>>>>>

>>>>> We noticed your Cash Advance application is still incomplete.

>>>>>

>>>>> You’re just a few steps away from securing up to $800,000 in funding within 48 hours.

>>>>>

>>>>> To move forward, please complete your application here:

>>>>> Click to Start your Application here

>>>>>

>>>>> and upload your last 3 months of bank statements. This will allow us to finalize your review and match you with the best available funding options.

>>>>>

>>>>> If you have any questions or would prefer to speak directly, feel free to call me at +1-866-216-5475 or 873-771-7630

>>>>>

>>>>> Best regards,

>>>>>

>>>>> Lilian Llanillo

>>>>> FUNDING ADVISOR

>>>>>

>>>>> email (16px).png lilian@kesefmarketing.com

>>>>> phone-call (16px).png +1 (873) 771-7630

>>>>> ____________________________

>>>>> IMG_5340.jpg

>>>>>

>>>>> To stop receiving these emails, click here.

>>>>>

>>>>>

>>>>>

>>>>> On Aug 11, 2026, at 09:49 AM, Lilian Llanillo wrote:

>>>>>> Hi Gurkirat,

>>>>>>

>>>>>> This is Lilian Llanillo from Kesef Marketing.

>>>>>>

>>>>>> Welcome! I wanted to personally reach out and thank you for your interest in business funding. We work with lenders across Canada to provide reliable funding solutions that support growth, manage cash flow, and cover upcoming expenses—while helping you access competitive interest rates.

>>>>>>

>>>>>> If you’re open to exploring your options, you can get started here:

>>>>>> Click Here To Start Your Application

>>>>>> Once submitted, our team will review your information and present the best available funding options tailored to your needs.

>>>>>>

>>>>>> If you have any questions or would prefer to speak directly, feel free to call me at +1-866-216-5475 or 873-771-7630

>>>>>>

>>>>>> Looking forward to connecting.

>>>>>>

>>>>>> Best regards,

>>>>>>

>>>>>> Lilian Llanillo

>>>>>> FUNDING ADVISOR

>>>>>>

>>>>>> email (16px).png lilian@kesefmarketing.com

>>>>>> phone-call (16px).png +1 (873) 771-7630

>>>>>> ____________________________

>>>>>> IMG_5340.jpg

>>>>>>

>>>>>> To stop receiving these emails, click here.

>>>>>>

Donation spam

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Fri, 28 Aug 2026 12:59:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.100 (FreeBSD))

(envelope-from )

id 1x01mF-000000002ph-3zEL

for dave@doctor.nl2k.ab.ca;

Fri, 28 Aug 2026 12:58:11 -0600

Resent-From: The Doctor

Resent-Date: Fri, 28 Aug 2026 12:58:11 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from cronus.internetguys.ca ([65.110.12.179]:33389)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.100 (FreeBSD))

(envelope-from )

id 1wzyj5-00000000JDR-29Rm

for www@nl2k.ab.ca;

Fri, 28 Aug 2026 09:42:52 -0600

DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=fsjmail.ca;

s=default; h=Content-Transfer-Encoding:Content-Type:MIME-Version:Message-ID:

Date:Subject:To:From:Reply-To:Sender:Cc:Content-ID:Content-Description:

Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:

In-Reply-To:References:List-Id:List-Help:List-Unsubscribe:List-Subscribe:

List-Post:List-Owner:List-Archive;

bh=dxAlClQ8y5Q6tq7CIaVd2aUcXb8te/l6Zzv1EN5B+eE=; b=Ohn0uJ2Iiqb8Be7OAMLXX0RB/9

GJ+OsLR5HwekV+u9hUJELhr0J3WIzVXmOxR8UG1DCT8nlO31q3LU4WhE0j6dJHE0T0NuljshyxhRH

R7m0p2RXqtuYO6jysNuBpP+NmctJbnSPaxqtnScbW5enuuySAOB0tkTsIXk4WRP4FJCg=;

Received: from kd027084177035.ppp-bb.dion.ne.jp ([27.84.177.35]:5435)

by cronus.internetguys.ca with esmtpsa (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

(Exim 4.99.5)

(envelope-from )

id 1wzyhP-0000000AVfp-05lf

for www@nl2k.ab.ca;

Fri, 28 Aug 2026 08:40:57 -0700

Reply-To: williamben5790@gmail.com

From: Mr. Cheng Saephan

To: www@nl2k.ab.ca

Subject: DONATION FUNDS !!!

Date: 28 Aug 2026 08:40:54 -0700

Message-ID: <20260828084052.D3526A4F16769890@fsjmail.ca>

MIME-Version: 1.0

Content-Type: text/plain;

charset="utf-8"

Content-Transfer-Encoding: quoted-printable

X-internetguys-MailScanner-Information: Please contact the ISP for more information

X-internetguys-MailScanner-ID: 1wzyhP-0000000AVfp-05lf

X-internetguys-MailScanner: Not scanned: please contact your Internet E-Mail Service Provider for details

X-internetguys-MailScanner-SpamCheck:

X-internetguys-MailScanner-From: wward2@fsjmail.ca

X-Spam-Status: No

X-AntiAbuse: This header was added to track abuse, please include it with any abuse report

X-AntiAbuse: Primary Hostname - cronus.internetguys.ca

X-AntiAbuse: Original Domain - nl2k.ab.ca

X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12]

X-AntiAbuse: Sender Address Domain - fsjmail.ca

X-Get-Message-Sender-Via: cronus.internetguys.ca: authenticated_id: wward2@fsjmail.ca

X-Authenticated-Sender: cronus.internetguys.ca: wward2@fsjmail.ca

X-Source:

X-Source-Args:

X-Source-Dir:

X-Spam_score: 18.1

X-Spam_score_int: 181

X-Spam_bar: ++++++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Dear Winner My name is Mr. Cheng Saephan, the fortunate winner

of a $1.3 billion powerball jackpot in 2024. I am giving away funds to five

randomly selected individuals. If you have received this email, it means

[...]



Content analysis details: (18.1 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[27.84.177.35 listed in will-spam-for-food.eu.org]

[27.84.177.35 listed in will-spam-for-food.eu.org]

[27.84.177.35 listed in will-spam-for-food.eu.org]

[27.84.177.35 listed in will-spam-for-food.eu.org]

[27.84.177.35 listed in will-spam-for-food.eu.org]

[27.84.177.35 listed in will-spam-for-food.eu.org]

[27.84.177.35 listed in will-spam-for-food.eu.org]

[27.84.177.35 listed in will-spam-for-food.eu.org]

[65.110.12.179 listed in will-spam-for-food.eu.org]

[65.110.12.179 listed in will-spam-for-food.eu.org]

[65.110.12.179 listed in will-spam-for-food.eu.org]

[65.110.12.179 listed in will-spam-for-food.eu.org]

[65.110.12.179 listed in will-spam-for-food.eu.org]

[65.110.12.179 listed in will-spam-for-food.eu.org]

[65.110.12.179 listed in will-spam-for-food.eu.org]

[65.110.12.179 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[27.84.177.35 listed in dnsbl.ahbl.org]

[27.84.177.35 listed in dnsbl.ahbl.org]

[27.84.177.35 listed in dnsbl.ahbl.org]

[27.84.177.35 listed in dnsbl.ahbl.org]

[65.110.12.179 listed in dnsbl.ahbl.org]

[65.110.12.179 listed in dnsbl.ahbl.org]

[65.110.12.179 listed in dnsbl.ahbl.org]

[65.110.12.179 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[27.84.177.35 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[27.84.177.35 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[27.84.177.35 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[27.84.177.35 listed in dnsbl.ahbl.org]

-0.0 SPF_PASS SPF: sender matches SPF record

-0.0 SPF_HELO_PASS SPF: HELO matches SPF record

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

1.5 RCVD_IN_CBL RBL: Received via a relay in cbl.abuseat.org

[Listed by XBL, see ]

1.5 RCVD_IN_SBL_XBL RBL: Received via a relay in Spamhaus SBL+XBL

[27.84.177.35 listed in sbl-xbl.spamhaus.org]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

1.6 SUBJ_ALL_CAPS Subject is all capitals

0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in digit

[williamben5790(at)gmail.com]

3.1 DEAR_WINNER BODY: Spam with generic salutation of "dear winner"

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[65.110.12.179 listed in bl.score.senderscore.com]

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

0.7 TO_NO_BRKTS_FROM_MSSP Multiple formatting errors

0.0 LOTS_OF_MONEY Huge... sums of money

1.4 MONEY_NOHTML Lots of money in plain text

0.0 HK_NAME_MR_MRS No description available.

2.5 FREEMAIL_FORGED_REPLYTO Freemail in Reply-To, but not From

0.4 MONEY_FREEMAIL_REPTO Lots of money from someone using free email?

1.3 MONEY_FORM_SHORT Lots of money if you fill out a short form

0.0 T_FILL_THIS_FORM_SHORT Fill in a short form with personal information

0.4 FILL_THIS_FORM_FRAUD_PHISH Answer suspicious question(s)

0.0 T_FILL_THIS_FORM_FRAUD_PHISH Answer suspicious question(s)

2.0 ADVANCE_FEE_2_NEW_MONEY Advance Fee fraud and lots of money

Subject: {SPAM?} DONATION FUNDS !!!



Dear Winner



My name is Mr. Cheng Saephan, the fortunate winner of a $1.3=20

billion powerball jackpot in 2024. I am giving away funds to five=20

randomly selected individuals. If you have received this email,=20

it means you were chosen in the selection process. I have donated=20

a significant portion of my wealth to various charities, but due=20

to my deteriorating health and limited time, I have decided to=20

contribute $10 million to you as one of the chosen five. You can=20

verify my winnings by watching the video linked below.



Click here to watch:

https://youtu.be/YH0ZPmf9VEE?si=3DEeAtBhFkLwde1c-d



YOUR CODE IS: [0043035]



Please respond to this email with the code [0043035] at=20

williamben5790@gmail.com and provide your details below, and he=20

will assist you with the next steps for receiving your donation.



You are advised to send your details as stated below.

your Full name,

your Home address

your WhatsApp number

your Occupation

your ID Card



Contact My Personal Manager

Name: Mr. William Ben

WhatsApp Only :+1(754)207-5509

Email: williamben5790@gmail.com



I hope this brings joy to you and your family.



Best regards,

Mr. Cheng Saephan

Donation spam

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Fri, 28 Aug 2026 12:59:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.100 (FreeBSD))

(envelope-from )

id 1x01m5-000000002oB-3sRP

for dave@doctor.nl2k.ab.ca;

Fri, 28 Aug 2026 12:58:01 -0600

Resent-From: The Doctor

Resent-Date: Fri, 28 Aug 2026 12:58:01 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from cronus.internetguys.ca ([65.110.12.179]:32987)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.100 (FreeBSD))

(envelope-from )

id 1wzyEu-00000000DiU-2v3Y

for support@nk.ca;

Fri, 28 Aug 2026 09:11:41 -0600

DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=fsjmail.ca;

s=default; h=Content-Transfer-Encoding:Content-Type:MIME-Version:Message-ID:

Date:Subject:To:From:Reply-To:Sender:Cc:Content-ID:Content-Description:

Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:

In-Reply-To:References:List-Id:List-Help:List-Unsubscribe:List-Subscribe:

List-Post:List-Owner:List-Archive;

bh=dxAlClQ8y5Q6tq7CIaVd2aUcXb8te/l6Zzv1EN5B+eE=; b=0a+S//bVHO8Qw7Hteoo3KUVzpv

TMCoerH2eAelcnHTSSGuJVcNgaH5iE4tmm8fsKJ9+WvQgoQsEgg0TjyFM/EulTfQM/N5aoHeyKmkw

+gQi44rv8CEQmv6Iz5obDr+U+FM6aDMTrigXwuzFIq2Xl1diTbFHogfPNn2X8jGosrFw=;

Received: from kd027084177035.ppp-bb.dion.ne.jp ([27.84.177.35]:6238)

by cronus.internetguys.ca with esmtpsa (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

(Exim 4.99.5)

(envelope-from )

id 1wzyCJ-0000000ACU9-3BgO

for support@nk.ca;

Fri, 28 Aug 2026 08:08:50 -0700

Reply-To: williamben5790@gmail.com

From: Mr. Cheng Saephan

To: support@nk.ca

Subject: DONATION FUNDS !!!

Date: 28 Aug 2026 08:08:46 -0700

Message-ID: <20260828080846.8615553299CE8E07@fsjmail.ca>

MIME-Version: 1.0

Content-Type: text/plain;

charset="utf-8"

Content-Transfer-Encoding: quoted-printable

X-internetguys-MailScanner-Information: Please contact the ISP for more information

X-internetguys-MailScanner-ID: 1wzyCJ-0000000ACU9-3BgO

X-internetguys-MailScanner: Not scanned: please contact your Internet E-Mail Service Provider for details

X-internetguys-MailScanner-SpamCheck:

X-internetguys-MailScanner-From: wward2@fsjmail.ca

X-Spam-Status: No

X-AntiAbuse: This header was added to track abuse, please include it with any abuse report

X-AntiAbuse: Primary Hostname - cronus.internetguys.ca

X-AntiAbuse: Original Domain - nk.ca

X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12]

X-AntiAbuse: Sender Address Domain - fsjmail.ca

X-Get-Message-Sender-Via: cronus.internetguys.ca: authenticated_id: wward2@fsjmail.ca

X-Authenticated-Sender: cronus.internetguys.ca: wward2@fsjmail.ca

X-Source:

X-Source-Args:

X-Source-Dir:

X-Spam_score: 18.1

X-Spam_score_int: 181

X-Spam_bar: ++++++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Dear Winner My name is Mr. Cheng Saephan, the fortunate winner

of a $1.3 billion powerball jackpot in 2024. I am giving away funds to five

randomly selected individuals. If you have received this email, it means

[...]



Content analysis details: (18.1 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[27.84.177.35 listed in will-spam-for-food.eu.org]

[27.84.177.35 listed in will-spam-for-food.eu.org]

[27.84.177.35 listed in will-spam-for-food.eu.org]

[27.84.177.35 listed in will-spam-for-food.eu.org]

[27.84.177.35 listed in will-spam-for-food.eu.org]

[27.84.177.35 listed in will-spam-for-food.eu.org]

[27.84.177.35 listed in will-spam-for-food.eu.org]

[27.84.177.35 listed in will-spam-for-food.eu.org]

[65.110.12.179 listed in will-spam-for-food.eu.org]

[65.110.12.179 listed in will-spam-for-food.eu.org]

[65.110.12.179 listed in will-spam-for-food.eu.org]

[65.110.12.179 listed in will-spam-for-food.eu.org]

[65.110.12.179 listed in will-spam-for-food.eu.org]

[65.110.12.179 listed in will-spam-for-food.eu.org]

[65.110.12.179 listed in will-spam-for-food.eu.org]

[65.110.12.179 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[27.84.177.35 listed in dnsbl.ahbl.org]

[27.84.177.35 listed in dnsbl.ahbl.org]

[27.84.177.35 listed in dnsbl.ahbl.org]

[27.84.177.35 listed in dnsbl.ahbl.org]

[65.110.12.179 listed in dnsbl.ahbl.org]

[65.110.12.179 listed in dnsbl.ahbl.org]

[65.110.12.179 listed in dnsbl.ahbl.org]

[65.110.12.179 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[27.84.177.35 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[27.84.177.35 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[27.84.177.35 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[27.84.177.35 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_SBL_XBL RBL: Received via a relay in Spamhaus SBL+XBL

[27.84.177.35 listed in sbl-xbl.spamhaus.org]

1.5 RCVD_IN_CBL RBL: Received via a relay in cbl.abuseat.org

[Listed by XBL, see ]

-0.0 SPF_PASS SPF: sender matches SPF record

-0.0 SPF_HELO_PASS SPF: HELO matches SPF record

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

1.6 SUBJ_ALL_CAPS Subject is all capitals

0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in digit

[williamben5790(at)gmail.com]

3.1 DEAR_WINNER BODY: Spam with generic salutation of "dear winner"

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[65.110.12.179 listed in bl.score.senderscore.com]

0.0 HK_NAME_MR_MRS No description available.

0.0 LOTS_OF_MONEY Huge... sums of money

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

2.5 FREEMAIL_FORGED_REPLYTO Freemail in Reply-To, but not From

0.7 TO_NO_BRKTS_FROM_MSSP Multiple formatting errors

1.4 MONEY_NOHTML Lots of money in plain text

0.0 T_FILL_THIS_FORM_SHORT Fill in a short form with personal information

0.0 T_FILL_THIS_FORM_FRAUD_PHISH Answer suspicious question(s)

0.4 MONEY_FREEMAIL_REPTO Lots of money from someone using free email?

0.4 FILL_THIS_FORM_FRAUD_PHISH Answer suspicious question(s)

1.3 MONEY_FORM_SHORT Lots of money if you fill out a short form

2.0 ADVANCE_FEE_2_NEW_MONEY Advance Fee fraud and lots of money

Subject: {SPAM?} DONATION FUNDS !!!



Dear Winner



My name is Mr. Cheng Saephan, the fortunate winner of a $1.3=20

billion powerball jackpot in 2024. I am giving away funds to five=20

randomly selected individuals. If you have received this email,=20

it means you were chosen in the selection process. I have donated=20

a significant portion of my wealth to various charities, but due=20

to my deteriorating health and limited time, I have decided to=20

contribute $10 million to you as one of the chosen five. You can=20

verify my winnings by watching the video linked below.



Click here to watch:

https://youtu.be/YH0ZPmf9VEE?si=3DEeAtBhFkLwde1c-d



YOUR CODE IS: [0043035]



Please respond to this email with the code [0043035] at=20

williamben5790@gmail.com and provide your details below, and he=20

will assist you with the next steps for receiving your donation.



You are advised to send your details as stated below.

your Full name,

your Home address

your WhatsApp number

your Occupation

your ID Card



Contact My Personal Manager

Name: Mr. William Ben

WhatsApp Only :+1(754)207-5509

Email: williamben5790@gmail.com



I hope this brings joy to you and your family.



Best regards,

Mr. Cheng Saephan

Donation spam

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Fri, 28 Aug 2026 12:58:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.100 (FreeBSD))

(envelope-from )

id 1x01lv-000000002lc-3zLm

for dave@doctor.nl2k.ab.ca;

Fri, 28 Aug 2026 12:57:51 -0600

Resent-From: The Doctor

Resent-Date: Fri, 28 Aug 2026 12:57:51 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from cronus.internetguys.ca ([65.110.12.179]:60101)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.100 (FreeBSD))

(envelope-from )

id 1wzxnP-000000008UR-1R8u

for sales@nk.ca;

Fri, 28 Aug 2026 08:43:16 -0600

DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=fsjmail.ca;

s=default; h=Content-Transfer-Encoding:Content-Type:MIME-Version:Message-ID:

Date:Subject:To:From:Reply-To:Sender:Cc:Content-ID:Content-Description:

Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:

In-Reply-To:References:List-Id:List-Help:List-Unsubscribe:List-Subscribe:

List-Post:List-Owner:List-Archive;

bh=dxAlClQ8y5Q6tq7CIaVd2aUcXb8te/l6Zzv1EN5B+eE=; b=xZ5JNfS4oud9tEmkVfkQJyLhrF

8AUP96PGceczXgLLUQrnwLGpTPrXYJ7Pk7udOfAo+aZIVFr9kBe0tuHs6/a2rOKqPORUDNJxnAwc3

hPQFR2j1ja+av61ZwKygAIzC9ZPK2Pspt71d6vX4yKXnL3VNeEWzGCt/H+SkD8BTbRKw=;

Received: from kd027084177035.ppp-bb.dion.ne.jp ([27.84.177.35]:14612)

by cronus.internetguys.ca with esmtpsa (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

(Exim 4.99.5)

(envelope-from )

id 1wzxjx-00000009un6-2mIw

for sales@nk.ca;

Fri, 28 Aug 2026 07:39:32 -0700

Reply-To: williamben5790@gmail.com

From: Mr. Cheng Saephan

To: sales@nk.ca

Subject: DONATION FUNDS !!!

Date: 28 Aug 2026 07:39:25 -0700

Message-ID: <20260828073925.4C5886E3C98B40A0@fsjmail.ca>

MIME-Version: 1.0

Content-Type: text/plain;

charset="utf-8"

Content-Transfer-Encoding: quoted-printable

X-internetguys-MailScanner-Information: Please contact the ISP for more information

X-internetguys-MailScanner-ID: 1wzxjx-00000009un6-2mIw

X-internetguys-MailScanner: Not scanned: please contact your Internet E-Mail Service Provider for details

X-internetguys-MailScanner-SpamCheck:

X-internetguys-MailScanner-From: wward2@fsjmail.ca

X-Spam-Status: No

X-AntiAbuse: This header was added to track abuse, please include it with any abuse report

X-AntiAbuse: Primary Hostname - cronus.internetguys.ca

X-AntiAbuse: Original Domain - nk.ca

X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12]

X-AntiAbuse: Sender Address Domain - fsjmail.ca

X-Get-Message-Sender-Via: cronus.internetguys.ca: authenticated_id: wward2@fsjmail.ca

X-Authenticated-Sender: cronus.internetguys.ca: wward2@fsjmail.ca

X-Source:

X-Source-Args:

X-Source-Dir:

X-Spam_score: 18.1

X-Spam_score_int: 181

X-Spam_bar: ++++++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Dear Winner My name is Mr. Cheng Saephan, the fortunate winner

of a $1.3 billion powerball jackpot in 2024. I am giving away funds to five

randomly selected individuals. If you have received this email, it means

[...]



Content analysis details: (18.1 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[27.84.177.35 listed in will-spam-for-food.eu.org]

[27.84.177.35 listed in will-spam-for-food.eu.org]

[27.84.177.35 listed in will-spam-for-food.eu.org]

[27.84.177.35 listed in will-spam-for-food.eu.org]

[27.84.177.35 listed in will-spam-for-food.eu.org]

[27.84.177.35 listed in will-spam-for-food.eu.org]

[27.84.177.35 listed in will-spam-for-food.eu.org]

[27.84.177.35 listed in will-spam-for-food.eu.org]

[65.110.12.179 listed in will-spam-for-food.eu.org]

[65.110.12.179 listed in will-spam-for-food.eu.org]

[65.110.12.179 listed in will-spam-for-food.eu.org]

[65.110.12.179 listed in will-spam-for-food.eu.org]

[65.110.12.179 listed in will-spam-for-food.eu.org]

[65.110.12.179 listed in will-spam-for-food.eu.org]

[65.110.12.179 listed in will-spam-for-food.eu.org]

[65.110.12.179 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_SBL_XBL RBL: Received via a relay in Spamhaus SBL+XBL

[27.84.177.35 listed in sbl-xbl.spamhaus.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[27.84.177.35 listed in dnsbl.ahbl.org]

[27.84.177.35 listed in dnsbl.ahbl.org]

[27.84.177.35 listed in dnsbl.ahbl.org]

[27.84.177.35 listed in dnsbl.ahbl.org]

[65.110.12.179 listed in dnsbl.ahbl.org]

[65.110.12.179 listed in dnsbl.ahbl.org]

[65.110.12.179 listed in dnsbl.ahbl.org]

[65.110.12.179 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[27.84.177.35 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[27.84.177.35 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[27.84.177.35 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[27.84.177.35 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_CBL RBL: Received via a relay in cbl.abuseat.org

[Listed by XBL, see ]

-0.0 SPF_PASS SPF: sender matches SPF record

-0.0 SPF_HELO_PASS SPF: HELO matches SPF record

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

1.6 SUBJ_ALL_CAPS Subject is all capitals

0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in digit

[williamben5790(at)gmail.com]

3.1 DEAR_WINNER BODY: Spam with generic salutation of "dear winner"

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[65.110.12.179 listed in bl.score.senderscore.com]

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

0.0 HK_NAME_MR_MRS No description available.

0.0 LOTS_OF_MONEY Huge... sums of money

0.4 MONEY_FREEMAIL_REPTO Lots of money from someone using free email?

1.4 MONEY_NOHTML Lots of money in plain text

0.7 TO_NO_BRKTS_FROM_MSSP Multiple formatting errors

2.5 FREEMAIL_FORGED_REPLYTO Freemail in Reply-To, but not From

0.0 T_FILL_THIS_FORM_SHORT Fill in a short form with personal information

0.4 FILL_THIS_FORM_FRAUD_PHISH Answer suspicious question(s)

2.0 ADVANCE_FEE_2_NEW_MONEY Advance Fee fraud and lots of money

0.0 T_FILL_THIS_FORM_FRAUD_PHISH Answer suspicious question(s)

1.3 MONEY_FORM_SHORT Lots of money if you fill out a short form

Subject: {SPAM?} DONATION FUNDS !!!



Dear Winner



My name is Mr. Cheng Saephan, the fortunate winner of a $1.3=20

billion powerball jackpot in 2024. I am giving away funds to five=20

randomly selected individuals. If you have received this email,=20

it means you were chosen in the selection process. I have donated=20

a significant portion of my wealth to various charities, but due=20

to my deteriorating health and limited time, I have decided to=20

contribute $10 million to you as one of the chosen five. You can=20

verify my winnings by watching the video linked below.



Click here to watch:

https://youtu.be/YH0ZPmf9VEE?si=3DEeAtBhFkLwde1c-d



YOUR CODE IS: [0043035]



Please respond to this email with the code [0043035] at=20

williamben5790@gmail.com and provide your details below, and he=20

will assist you with the next steps for receiving your donation.



You are advised to send your details as stated below.

your Full name,

your Home address

your WhatsApp number

your Occupation

your ID Card



Contact My Personal Manager

Name: Mr. William Ben

WhatsApp Only :+1(754)207-5509

Email: williamben5790@gmail.com



I hope this brings joy to you and your family.



Best regards,

Mr. Cheng Saephan

Donation spam

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Fri, 28 Aug 2026 12:58:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.100 (FreeBSD))

(envelope-from )

id 1x01lq-000000002ko-41CQ

for dave@doctor.nl2k.ab.ca;

Fri, 28 Aug 2026 12:57:46 -0600

Resent-From: The Doctor

Resent-Date: Fri, 28 Aug 2026 12:57:46 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from cronus.internetguys.ca ([65.110.12.179]:41691)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.100 (FreeBSD))

(envelope-from )

id 1wzxdC-000000006ZD-0Akt

for root@nl2k.ca;

Fri, 28 Aug 2026 08:32:43 -0600

DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=fsjmail.ca;

s=default; h=Content-Transfer-Encoding:Content-Type:MIME-Version:Message-ID:

Date:Subject:To:From:Reply-To:Sender:Cc:Content-ID:Content-Description:

Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:

In-Reply-To:References:List-Id:List-Help:List-Unsubscribe:List-Subscribe:

List-Post:List-Owner:List-Archive;

bh=dxAlClQ8y5Q6tq7CIaVd2aUcXb8te/l6Zzv1EN5B+eE=; b=RnAovrBlY3ZOoQAzfPPS5lDAZD

ZopaUldtzc3NP4fPCuJFJoJnAWAX2l94LPkQZSflpvC2gkXlJ0t8P9Z1J2jyy4REwMoQFSERpvLq/

vcjGMrDxNezCbGu6+MSaRxXmcZ+02ofdL7L01WU2Lxes/r1wNKglns5nK7J0iKY6x6bs=;

Received: from kd027084177035.ppp-bb.dion.ne.jp ([27.84.177.35]:24080)

by cronus.internetguys.ca with esmtpsa (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

(Exim 4.99.5)

(envelope-from )

id 1wzxcI-00000009ps0-3I6t

for root@nl2k.ca;

Fri, 28 Aug 2026 07:31:37 -0700

Reply-To: williamben5790@gmail.com

From: Mr. Cheng Saephan

To: root@nl2k.ca

Subject: DONATION FUNDS !!!

Date: 28 Aug 2026 07:31:34 -0700

Message-ID: <20260828073133.B2C2D17EE283C608@fsjmail.ca>

MIME-Version: 1.0

Content-Type: text/plain;

charset="utf-8"

Content-Transfer-Encoding: quoted-printable

X-internetguys-MailScanner-Information: Please contact the ISP for more information

X-internetguys-MailScanner-ID: 1wzxcI-00000009ps0-3I6t

X-internetguys-MailScanner: Not scanned: please contact your Internet E-Mail Service Provider for details

X-internetguys-MailScanner-SpamCheck:

X-internetguys-MailScanner-From: wward2@fsjmail.ca

X-Spam-Status: No

X-AntiAbuse: This header was added to track abuse, please include it with any abuse report

X-AntiAbuse: Primary Hostname - cronus.internetguys.ca

X-AntiAbuse: Original Domain - nl2k.ca

X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12]

X-AntiAbuse: Sender Address Domain - fsjmail.ca

X-Get-Message-Sender-Via: cronus.internetguys.ca: authenticated_id: wward2@fsjmail.ca

X-Authenticated-Sender: cronus.internetguys.ca: wward2@fsjmail.ca

X-Source:

X-Source-Args:

X-Source-Dir:

X-Spam_score: 18.1

X-Spam_score_int: 181

X-Spam_bar: ++++++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Dear Winner My name is Mr. Cheng Saephan, the fortunate winner

of a $1.3 billion powerball jackpot in 2024. I am giving away funds to five

randomly selected individuals. If you have received this email, it means

[...]



Content analysis details: (18.1 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[27.84.177.35 listed in will-spam-for-food.eu.org]

[27.84.177.35 listed in will-spam-for-food.eu.org]

[27.84.177.35 listed in will-spam-for-food.eu.org]

[27.84.177.35 listed in will-spam-for-food.eu.org]

[27.84.177.35 listed in will-spam-for-food.eu.org]

[27.84.177.35 listed in will-spam-for-food.eu.org]

[27.84.177.35 listed in will-spam-for-food.eu.org]

[27.84.177.35 listed in will-spam-for-food.eu.org]

[65.110.12.179 listed in will-spam-for-food.eu.org]

[65.110.12.179 listed in will-spam-for-food.eu.org]

[65.110.12.179 listed in will-spam-for-food.eu.org]

[65.110.12.179 listed in will-spam-for-food.eu.org]

[65.110.12.179 listed in will-spam-for-food.eu.org]

[65.110.12.179 listed in will-spam-for-food.eu.org]

[65.110.12.179 listed in will-spam-for-food.eu.org]

[65.110.12.179 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[27.84.177.35 listed in dnsbl.ahbl.org]

[27.84.177.35 listed in dnsbl.ahbl.org]

[27.84.177.35 listed in dnsbl.ahbl.org]

[27.84.177.35 listed in dnsbl.ahbl.org]

[65.110.12.179 listed in dnsbl.ahbl.org]

[65.110.12.179 listed in dnsbl.ahbl.org]

[65.110.12.179 listed in dnsbl.ahbl.org]

[65.110.12.179 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[27.84.177.35 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[27.84.177.35 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[27.84.177.35 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[27.84.177.35 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_SBL_XBL RBL: Received via a relay in Spamhaus SBL+XBL

[27.84.177.35 listed in sbl-xbl.spamhaus.org]

1.5 RCVD_IN_CBL RBL: Received via a relay in cbl.abuseat.org

[Listed by XBL, see ]

-0.0 SPF_PASS SPF: sender matches SPF record

-0.0 SPF_HELO_PASS SPF: HELO matches SPF record

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

1.6 SUBJ_ALL_CAPS Subject is all capitals

0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in digit

[williamben5790(at)gmail.com]

3.1 DEAR_WINNER BODY: Spam with generic salutation of "dear winner"

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[65.110.12.179 listed in bl.score.senderscore.com]

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

0.0 HK_NAME_MR_MRS No description available.

0.0 LOTS_OF_MONEY Huge... sums of money

0.7 TO_NO_BRKTS_FROM_MSSP Multiple formatting errors

1.4 MONEY_NOHTML Lots of money in plain text

2.5 FREEMAIL_FORGED_REPLYTO Freemail in Reply-To, but not From

0.4 MONEY_FREEMAIL_REPTO Lots of money from someone using free email?

0.0 T_FILL_THIS_FORM_SHORT Fill in a short form with personal information

1.3 MONEY_FORM_SHORT Lots of money if you fill out a short form

0.0 T_FILL_THIS_FORM_FRAUD_PHISH Answer suspicious question(s)

0.4 FILL_THIS_FORM_FRAUD_PHISH Answer suspicious question(s)

2.0 ADVANCE_FEE_2_NEW_MONEY Advance Fee fraud and lots of money

Subject: {SPAM?} DONATION FUNDS !!!



Dear Winner



My name is Mr. Cheng Saephan, the fortunate winner of a $1.3=20

billion powerball jackpot in 2024. I am giving away funds to five=20

randomly selected individuals. If you have received this email,=20

it means you were chosen in the selection process. I have donated=20

a significant portion of my wealth to various charities, but due=20

to my deteriorating health and limited time, I have decided to=20

contribute $10 million to you as one of the chosen five. You can=20

verify my winnings by watching the video linked below.



Click here to watch:

https://youtu.be/YH0ZPmf9VEE?si=3DEeAtBhFkLwde1c-d



YOUR CODE IS: [0043035]



Please respond to this email with the code [0043035] at=20

williamben5790@gmail.com and provide your details below, and he=20

will assist you with the next steps for receiving your donation.



You are advised to send your details as stated below.

your Full name,

your Home address

your WhatsApp number

your Occupation

your ID Card



Contact My Personal Manager

Name: Mr. William Ben

WhatsApp Only :+1(754)207-5509

Email: williamben5790@gmail.com



I hope this brings joy to you and your family.



Best regards,

Mr. Cheng Saephan

Donation spam

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Fri, 28 Aug 2026 12:58:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.100 (FreeBSD))

(envelope-from )

id 1x01ln-000000002kH-113i

for dave@doctor.nl2k.ab.ca;

Fri, 28 Aug 2026 12:57:43 -0600

Resent-From: The Doctor

Resent-Date: Fri, 28 Aug 2026 12:57:43 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from cronus.internetguys.ca ([65.110.12.179]:48343)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.100 (FreeBSD))

(envelope-from )

id 1wzxeC-000000006jl-38y5

for root@doctor.nl2k.ab.ca;

Fri, 28 Aug 2026 08:33:45 -0600

DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=fsjmail.ca;

s=default; h=Content-Transfer-Encoding:Content-Type:MIME-Version:Message-ID:

Date:Subject:To:From:Reply-To:Sender:Cc:Content-ID:Content-Description:

Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:

In-Reply-To:References:List-Id:List-Help:List-Unsubscribe:List-Subscribe:

List-Post:List-Owner:List-Archive;

bh=dxAlClQ8y5Q6tq7CIaVd2aUcXb8te/l6Zzv1EN5B+eE=; b=SsG5ceQyKNKwmOPUo2m2ukAYJB

aS4tfSpsKWjtWh8E60f5AC/H2BCSyqFUW0XAXP7jVLMgpMpd0yCge+vQ31Ppml9ymYxvG5mGFjZFn

902KHg7z9MLr3UDlgNXyyKlY/a1iuiRJD1XLTH8UrJZhJ2BGqVCKGHdIP6fG2HdGjLSo=;

Received: from kd027084177035.ppp-bb.dion.ne.jp ([27.84.177.35]:52481)

by cronus.internetguys.ca with esmtpsa (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

(Exim 4.99.5)

(envelope-from )

id 1wzxcH-00000009paE-3Ktm

for root@doctor.nl2k.ab.ca;

Fri, 28 Aug 2026 07:31:36 -0700

Reply-To: williamben5790@gmail.com

From: Mr. Cheng Saephan

To: root@doctor.nl2k.ab.ca

Subject: DONATION FUNDS !!!

Date: 28 Aug 2026 07:31:33 -0700

Message-ID: <20260828073133.995F182139FF7C66@fsjmail.ca>

MIME-Version: 1.0

Content-Type: text/plain;

charset="utf-8"

Content-Transfer-Encoding: quoted-printable

X-internetguys-MailScanner-Information: Please contact the ISP for more information

X-internetguys-MailScanner-ID: 1wzxcH-00000009paE-3Ktm

X-internetguys-MailScanner: Not scanned: please contact your Internet E-Mail Service Provider for details

X-internetguys-MailScanner-SpamCheck:

X-internetguys-MailScanner-From: wward2@fsjmail.ca

X-Spam-Status: No

X-AntiAbuse: This header was added to track abuse, please include it with any abuse report

X-AntiAbuse: Primary Hostname - cronus.internetguys.ca

X-AntiAbuse: Original Domain - doctor.nl2k.ab.ca

X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12]

X-AntiAbuse: Sender Address Domain - fsjmail.ca

X-Get-Message-Sender-Via: cronus.internetguys.ca: authenticated_id: wward2@fsjmail.ca

X-Authenticated-Sender: cronus.internetguys.ca: wward2@fsjmail.ca

X-Source:

X-Source-Args:

X-Source-Dir:

X-Spam_score: 18.1

X-Spam_score_int: 181

X-Spam_bar: ++++++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Dear Winner My name is Mr. Cheng Saephan, the fortunate winner

of a $1.3 billion powerball jackpot in 2024. I am giving away funds to five

randomly selected individuals. If you have received this email, it means

[...]



Content analysis details: (18.1 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[27.84.177.35 listed in will-spam-for-food.eu.org]

[27.84.177.35 listed in will-spam-for-food.eu.org]

[27.84.177.35 listed in will-spam-for-food.eu.org]

[27.84.177.35 listed in will-spam-for-food.eu.org]

[27.84.177.35 listed in will-spam-for-food.eu.org]

[27.84.177.35 listed in will-spam-for-food.eu.org]

[27.84.177.35 listed in will-spam-for-food.eu.org]

[27.84.177.35 listed in will-spam-for-food.eu.org]

[65.110.12.179 listed in will-spam-for-food.eu.org]

[65.110.12.179 listed in will-spam-for-food.eu.org]

[65.110.12.179 listed in will-spam-for-food.eu.org]

[65.110.12.179 listed in will-spam-for-food.eu.org]

[65.110.12.179 listed in will-spam-for-food.eu.org]

[65.110.12.179 listed in will-spam-for-food.eu.org]

[65.110.12.179 listed in will-spam-for-food.eu.org]

[65.110.12.179 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_SBL_XBL RBL: Received via a relay in Spamhaus SBL+XBL

[27.84.177.35 listed in sbl-xbl.spamhaus.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[27.84.177.35 listed in dnsbl.ahbl.org]

[27.84.177.35 listed in dnsbl.ahbl.org]

[27.84.177.35 listed in dnsbl.ahbl.org]

[27.84.177.35 listed in dnsbl.ahbl.org]

[65.110.12.179 listed in dnsbl.ahbl.org]

[65.110.12.179 listed in dnsbl.ahbl.org]

[65.110.12.179 listed in dnsbl.ahbl.org]

[65.110.12.179 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[27.84.177.35 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[27.84.177.35 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[27.84.177.35 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[27.84.177.35 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_CBL RBL: Received via a relay in cbl.abuseat.org

[Listed by XBL, see ]

-0.0 SPF_PASS SPF: sender matches SPF record

-0.0 SPF_HELO_PASS SPF: HELO matches SPF record

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

1.6 SUBJ_ALL_CAPS Subject is all capitals

0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in digit

[williamben5790(at)gmail.com]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

3.1 DEAR_WINNER BODY: Spam with generic salutation of "dear winner"

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[65.110.12.179 listed in bl.score.senderscore.com]

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

0.0 LOTS_OF_MONEY Huge... sums of money

0.0 HK_NAME_MR_MRS No description available.

0.7 TO_NO_BRKTS_FROM_MSSP Multiple formatting errors

0.4 MONEY_FREEMAIL_REPTO Lots of money from someone using free email?

1.4 MONEY_NOHTML Lots of money in plain text

2.5 FREEMAIL_FORGED_REPLYTO Freemail in Reply-To, but not From

0.0 T_FILL_THIS_FORM_SHORT Fill in a short form with personal information

0.0 T_FILL_THIS_FORM_FRAUD_PHISH Answer suspicious question(s)

0.4 FILL_THIS_FORM_FRAUD_PHISH Answer suspicious question(s)

1.3 MONEY_FORM_SHORT Lots of money if you fill out a short form

2.0 ADVANCE_FEE_2_NEW_MONEY Advance Fee fraud and lots of money

Subject: {SPAM?} DONATION FUNDS !!!



Dear Winner



My name is Mr. Cheng Saephan, the fortunate winner of a $1.3=20

billion powerball jackpot in 2024. I am giving away funds to five=20

randomly selected individuals. If you have received this email,=20

it means you were chosen in the selection process. I have donated=20

a significant portion of my wealth to various charities, but due=20

to my deteriorating health and limited time, I have decided to=20

contribute $10 million to you as one of the chosen five. You can=20

verify my winnings by watching the video linked below.



Click here to watch:

https://youtu.be/YH0ZPmf9VEE?si=3DEeAtBhFkLwde1c-d



YOUR CODE IS: [0043035]



Please respond to this email with the code [0043035] at=20

williamben5790@gmail.com and provide your details below, and he=20

will assist you with the next steps for receiving your donation.



You are advised to send your details as stated below.

your Full name,

your Home address

your WhatsApp number

your Occupation

your ID Card



Contact My Personal Manager

Name: Mr. William Ben

WhatsApp Only :+1(754)207-5509

Email: williamben5790@gmail.com



I hope this brings joy to you and your family.



Best regards,

Mr. Cheng Saephan

Donation spam

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Fri, 28 Aug 2026 12:58:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.100 (FreeBSD))

(envelope-from )

id 1x01ln-000000002kH-113i

for dave@doctor.nl2k.ab.ca;

Fri, 28 Aug 2026 12:57:43 -0600

Resent-From: The Doctor

Resent-Date: Fri, 28 Aug 2026 12:57:43 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from cronus.internetguys.ca ([65.110.12.179]:48343)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.100 (FreeBSD))

(envelope-from )

id 1wzxeC-000000006jl-38y5

for root@doctor.nl2k.ab.ca;

Fri, 28 Aug 2026 08:33:45 -0600

DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=fsjmail.ca;

s=default; h=Content-Transfer-Encoding:Content-Type:MIME-Version:Message-ID:

Date:Subject:To:From:Reply-To:Sender:Cc:Content-ID:Content-Description:

Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:

In-Reply-To:References:List-Id:List-Help:List-Unsubscribe:List-Subscribe:

List-Post:List-Owner:List-Archive;

bh=dxAlClQ8y5Q6tq7CIaVd2aUcXb8te/l6Zzv1EN5B+eE=; b=SsG5ceQyKNKwmOPUo2m2ukAYJB

aS4tfSpsKWjtWh8E60f5AC/H2BCSyqFUW0XAXP7jVLMgpMpd0yCge+vQ31Ppml9ymYxvG5mGFjZFn

902KHg7z9MLr3UDlgNXyyKlY/a1iuiRJD1XLTH8UrJZhJ2BGqVCKGHdIP6fG2HdGjLSo=;

Received: from kd027084177035.ppp-bb.dion.ne.jp ([27.84.177.35]:52481)

by cronus.internetguys.ca with esmtpsa (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

(Exim 4.99.5)

(envelope-from )

id 1wzxcH-00000009paE-3Ktm

for root@doctor.nl2k.ab.ca;

Fri, 28 Aug 2026 07:31:36 -0700

Reply-To: williamben5790@gmail.com

From: Mr. Cheng Saephan

To: root@doctor.nl2k.ab.ca

Subject: DONATION FUNDS !!!

Date: 28 Aug 2026 07:31:33 -0700

Message-ID: <20260828073133.995F182139FF7C66@fsjmail.ca>

MIME-Version: 1.0

Content-Type: text/plain;

charset="utf-8"

Content-Transfer-Encoding: quoted-printable

X-internetguys-MailScanner-Information: Please contact the ISP for more information

X-internetguys-MailScanner-ID: 1wzxcH-00000009paE-3Ktm

X-internetguys-MailScanner: Not scanned: please contact your Internet E-Mail Service Provider for details

X-internetguys-MailScanner-SpamCheck:

X-internetguys-MailScanner-From: wward2@fsjmail.ca

X-Spam-Status: No

X-AntiAbuse: This header was added to track abuse, please include it with any abuse report

X-AntiAbuse: Primary Hostname - cronus.internetguys.ca

X-AntiAbuse: Original Domain - doctor.nl2k.ab.ca

X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12]

X-AntiAbuse: Sender Address Domain - fsjmail.ca

X-Get-Message-Sender-Via: cronus.internetguys.ca: authenticated_id: wward2@fsjmail.ca

X-Authenticated-Sender: cronus.internetguys.ca: wward2@fsjmail.ca

X-Source:

X-Source-Args:

X-Source-Dir:

X-Spam_score: 18.1

X-Spam_score_int: 181

X-Spam_bar: ++++++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Dear Winner My name is Mr. Cheng Saephan, the fortunate winner

of a $1.3 billion powerball jackpot in 2024. I am giving away funds to five

randomly selected individuals. If you have received this email, it means

[...]



Content analysis details: (18.1 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[27.84.177.35 listed in will-spam-for-food.eu.org]

[27.84.177.35 listed in will-spam-for-food.eu.org]

[27.84.177.35 listed in will-spam-for-food.eu.org]

[27.84.177.35 listed in will-spam-for-food.eu.org]

[27.84.177.35 listed in will-spam-for-food.eu.org]

[27.84.177.35 listed in will-spam-for-food.eu.org]

[27.84.177.35 listed in will-spam-for-food.eu.org]

[27.84.177.35 listed in will-spam-for-food.eu.org]

[65.110.12.179 listed in will-spam-for-food.eu.org]

[65.110.12.179 listed in will-spam-for-food.eu.org]

[65.110.12.179 listed in will-spam-for-food.eu.org]

[65.110.12.179 listed in will-spam-for-food.eu.org]

[65.110.12.179 listed in will-spam-for-food.eu.org]

[65.110.12.179 listed in will-spam-for-food.eu.org]

[65.110.12.179 listed in will-spam-for-food.eu.org]

[65.110.12.179 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_SBL_XBL RBL: Received via a relay in Spamhaus SBL+XBL

[27.84.177.35 listed in sbl-xbl.spamhaus.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[27.84.177.35 listed in dnsbl.ahbl.org]

[27.84.177.35 listed in dnsbl.ahbl.org]

[27.84.177.35 listed in dnsbl.ahbl.org]

[27.84.177.35 listed in dnsbl.ahbl.org]

[65.110.12.179 listed in dnsbl.ahbl.org]

[65.110.12.179 listed in dnsbl.ahbl.org]

[65.110.12.179 listed in dnsbl.ahbl.org]

[65.110.12.179 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[27.84.177.35 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[27.84.177.35 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[27.84.177.35 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[27.84.177.35 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_CBL RBL: Received via a relay in cbl.abuseat.org

[Listed by XBL, see ]

-0.0 SPF_PASS SPF: sender matches SPF record

-0.0 SPF_HELO_PASS SPF: HELO matches SPF record

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

1.6 SUBJ_ALL_CAPS Subject is all capitals

0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in digit

[williamben5790(at)gmail.com]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

3.1 DEAR_WINNER BODY: Spam with generic salutation of "dear winner"

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[65.110.12.179 listed in bl.score.senderscore.com]

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

0.0 LOTS_OF_MONEY Huge... sums of money

0.0 HK_NAME_MR_MRS No description available.

0.7 TO_NO_BRKTS_FROM_MSSP Multiple formatting errors

0.4 MONEY_FREEMAIL_REPTO Lots of money from someone using free email?

1.4 MONEY_NOHTML Lots of money in plain text

2.5 FREEMAIL_FORGED_REPLYTO Freemail in Reply-To, but not From

0.0 T_FILL_THIS_FORM_SHORT Fill in a short form with personal information

0.0 T_FILL_THIS_FORM_FRAUD_PHISH Answer suspicious question(s)

0.4 FILL_THIS_FORM_FRAUD_PHISH Answer suspicious question(s)

1.3 MONEY_FORM_SHORT Lots of money if you fill out a short form

2.0 ADVANCE_FEE_2_NEW_MONEY Advance Fee fraud and lots of money

Subject: {SPAM?} DONATION FUNDS !!!



Dear Winner



My name is Mr. Cheng Saephan, the fortunate winner of a $1.3=20

billion powerball jackpot in 2024. I am giving away funds to five=20

randomly selected individuals. If you have received this email,=20

it means you were chosen in the selection process. I have donated=20

a significant portion of my wealth to various charities, but due=20

to my deteriorating health and limited time, I have decided to=20

contribute $10 million to you as one of the chosen five. You can=20

verify my winnings by watching the video linked below.



Click here to watch:

https://youtu.be/YH0ZPmf9VEE?si=3DEeAtBhFkLwde1c-d



YOUR CODE IS: [0043035]



Please respond to this email with the code [0043035] at=20

williamben5790@gmail.com and provide your details below, and he=20

will assist you with the next steps for receiving your donation.



You are advised to send your details as stated below.

your Full name,

your Home address

your WhatsApp number

your Occupation

your ID Card



Contact My Personal Manager

Name: Mr. William Ben

WhatsApp Only :+1(754)207-5509

Email: williamben5790@gmail.com



I hope this brings joy to you and your family.



Best regards,

Mr. Cheng Saephan

Donation spam

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Fri, 28 Aug 2026 12:58:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.100 (FreeBSD))

(envelope-from )

id 1x01lj-000000002js-179h

for dave@doctor.nl2k.ab.ca;

Fri, 28 Aug 2026 12:57:39 -0600

Resent-From: The Doctor

Resent-Date: Fri, 28 Aug 2026 12:57:39 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from cronus.internetguys.ca ([65.110.12.179]:48827)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.100 (FreeBSD))

(envelope-from )

id 1wzxdC-000000006ZE-0AiT

for root@mail.nl2k.ab.ca;

Fri, 28 Aug 2026 08:32:43 -0600

DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=fsjmail.ca;

s=default; h=Content-Transfer-Encoding:Content-Type:MIME-Version:Message-ID:

Date:Subject:To:From:Reply-To:Sender:Cc:Content-ID:Content-Description:

Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:

In-Reply-To:References:List-Id:List-Help:List-Unsubscribe:List-Subscribe:

List-Post:List-Owner:List-Archive;

bh=dxAlClQ8y5Q6tq7CIaVd2aUcXb8te/l6Zzv1EN5B+eE=; b=tjBbYYaHyfpqFMJS1jvzWlP+3w

BoP0OgJRok5QhZzAXs/IG2Gne6XvLs/3s8VmN4m3To9hjs4p32TwiW2rk5YZGgZ6AA8FZ4c4uppBQ

8kZPfs/Z9uKSptIU/xiPQPa6tkLe9zWVeQIw/wM//nCrbg5UClM8i6j1fSfDRnEUUXAI=;

Received: from kd027084177035.ppp-bb.dion.ne.jp ([27.84.177.35]:11363)

by cronus.internetguys.ca with esmtpsa (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

(Exim 4.99.5)

(envelope-from )

id 1wzxcI-00000009pV9-21te

for root@mail.nl2k.ab.ca;

Fri, 28 Aug 2026 07:31:37 -0700

Reply-To: williamben5790@gmail.com

From: Mr. Cheng Saephan

To: root@mail.nl2k.ab.ca

Subject: DONATION FUNDS !!!

Date: 28 Aug 2026 07:31:33 -0700

Message-ID: <20260828073133.B65FCF7C23E304F4@fsjmail.ca>

MIME-Version: 1.0

Content-Type: text/plain;

charset="utf-8"

Content-Transfer-Encoding: quoted-printable

X-internetguys-MailScanner-Information: Please contact the ISP for more information

X-internetguys-MailScanner-ID: 1wzxcI-00000009pV9-21te

X-internetguys-MailScanner: Not scanned: please contact your Internet E-Mail Service Provider for details

X-internetguys-MailScanner-SpamCheck:

X-internetguys-MailScanner-From: wward2@fsjmail.ca

X-Spam-Status: No

X-AntiAbuse: This header was added to track abuse, please include it with any abuse report

X-AntiAbuse: Primary Hostname - cronus.internetguys.ca

X-AntiAbuse: Original Domain - mail.nl2k.ab.ca

X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12]

X-AntiAbuse: Sender Address Domain - fsjmail.ca

X-Get-Message-Sender-Via: cronus.internetguys.ca: authenticated_id: wward2@fsjmail.ca

X-Authenticated-Sender: cronus.internetguys.ca: wward2@fsjmail.ca

X-Source:

X-Source-Args:

X-Source-Dir:

X-Spam_score: 18.1

X-Spam_score_int: 181

X-Spam_bar: ++++++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Dear Winner My name is Mr. Cheng Saephan, the fortunate winner

of a $1.3 billion powerball jackpot in 2024. I am giving away funds to five

randomly selected individuals. If you have received this email, it means

[...]



Content analysis details: (18.1 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[27.84.177.35 listed in will-spam-for-food.eu.org]

[27.84.177.35 listed in will-spam-for-food.eu.org]

[27.84.177.35 listed in will-spam-for-food.eu.org]

[27.84.177.35 listed in will-spam-for-food.eu.org]

[27.84.177.35 listed in will-spam-for-food.eu.org]

[27.84.177.35 listed in will-spam-for-food.eu.org]

[27.84.177.35 listed in will-spam-for-food.eu.org]

[27.84.177.35 listed in will-spam-for-food.eu.org]

[65.110.12.179 listed in will-spam-for-food.eu.org]

[65.110.12.179 listed in will-spam-for-food.eu.org]

[65.110.12.179 listed in will-spam-for-food.eu.org]

[65.110.12.179 listed in will-spam-for-food.eu.org]

[65.110.12.179 listed in will-spam-for-food.eu.org]

[65.110.12.179 listed in will-spam-for-food.eu.org]

[65.110.12.179 listed in will-spam-for-food.eu.org]

[65.110.12.179 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[27.84.177.35 listed in dnsbl.ahbl.org]

[27.84.177.35 listed in dnsbl.ahbl.org]

[27.84.177.35 listed in dnsbl.ahbl.org]

[27.84.177.35 listed in dnsbl.ahbl.org]

[65.110.12.179 listed in dnsbl.ahbl.org]

[65.110.12.179 listed in dnsbl.ahbl.org]

[65.110.12.179 listed in dnsbl.ahbl.org]

[65.110.12.179 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[27.84.177.35 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[27.84.177.35 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[27.84.177.35 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[27.84.177.35 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_SBL_XBL RBL: Received via a relay in Spamhaus SBL+XBL

[27.84.177.35 listed in sbl-xbl.spamhaus.org]

1.5 RCVD_IN_CBL RBL: Received via a relay in cbl.abuseat.org

[Listed by XBL, see ]

-0.0 SPF_PASS SPF: sender matches SPF record

-0.0 SPF_HELO_PASS SPF: HELO matches SPF record

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

1.6 SUBJ_ALL_CAPS Subject is all capitals

0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in digit

[williamben5790(at)gmail.com]

3.1 DEAR_WINNER BODY: Spam with generic salutation of "dear winner"

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[65.110.12.179 listed in bl.score.senderscore.com]

0.7 TO_NO_BRKTS_FROM_MSSP Multiple formatting errors

0.0 LOTS_OF_MONEY Huge... sums of money

0.0 HK_NAME_MR_MRS No description available.

2.5 FREEMAIL_FORGED_REPLYTO Freemail in Reply-To, but not From

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

1.4 MONEY_NOHTML Lots of money in plain text

0.4 MONEY_FREEMAIL_REPTO Lots of money from someone using free email?

1.3 MONEY_FORM_SHORT Lots of money if you fill out a short form

0.0 T_FILL_THIS_FORM_SHORT Fill in a short form with personal information

0.4 FILL_THIS_FORM_FRAUD_PHISH Answer suspicious question(s)

0.0 T_FILL_THIS_FORM_FRAUD_PHISH Answer suspicious question(s)

2.0 ADVANCE_FEE_2_NEW_MONEY Advance Fee fraud and lots of money

Subject: {SPAM?} DONATION FUNDS !!!



Dear Winner



My name is Mr. Cheng Saephan, the fortunate winner of a $1.3=20

billion powerball jackpot in 2024. I am giving away funds to five=20

randomly selected individuals. If you have received this email,=20

it means you were chosen in the selection process. I have donated=20

a significant portion of my wealth to various charities, but due=20

to my deteriorating health and limited time, I have decided to=20

contribute $10 million to you as one of the chosen five. You can=20

verify my winnings by watching the video linked below.



Click here to watch:

https://youtu.be/YH0ZPmf9VEE?si=3DEeAtBhFkLwde1c-d



YOUR CODE IS: [0043035]



Please respond to this email with the code [0043035] at=20

williamben5790@gmail.com and provide your details below, and he=20

will assist you with the next steps for receiving your donation.



You are advised to send your details as stated below.

your Full name,

your Home address

your WhatsApp number

your Occupation

your ID Card



Contact My Personal Manager

Name: Mr. William Ben

WhatsApp Only :+1(754)207-5509

Email: williamben5790@gmail.com



I hope this brings joy to you and your family.



Best regards,

Mr. Cheng Saephan

Donation spam

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Fri, 28 Aug 2026 12:58:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.100 (FreeBSD))

(envelope-from )

id 1x01lc-000000002ih-3deA

for dave@doctor.nl2k.ab.ca;

Fri, 28 Aug 2026 12:57:32 -0600

Resent-From: The Doctor

Resent-Date: Fri, 28 Aug 2026 12:57:32 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from cronus.internetguys.ca ([65.110.12.179]:47107)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.100 (FreeBSD))

(envelope-from )

id 1wzxIV-000000002xD-41T3

for postmaster@nl2k.ab.ca;

Fri, 28 Aug 2026 08:11:21 -0600

DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=fsjmail.ca;

s=default; h=Content-Transfer-Encoding:Content-Type:MIME-Version:Message-ID:

Date:Subject:To:From:Reply-To:Sender:Cc:Content-ID:Content-Description:

Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:

In-Reply-To:References:List-Id:List-Help:List-Unsubscribe:List-Subscribe:

List-Post:List-Owner:List-Archive;

bh=dxAlClQ8y5Q6tq7CIaVd2aUcXb8te/l6Zzv1EN5B+eE=; b=hNOGHtaOogNzsWWQcBjY7QVPSw

CIet9zZCgraPDXG9J8tQL2KXGyCG+O+Y+jxiCS7GZctsn9/tkK2epUPo9tmXHv6ropBtxXaVF1rrd

y8Z3HmbmneG0XhR34IKCa6U8ShdWN23N1ISlx1IwmNTFBWCiMdAptx1EvaCnxHs/MVNA=;

Received: from kd027084177035.ppp-bb.dion.ne.jp ([27.84.177.35]:64025)

by cronus.internetguys.ca with esmtpsa (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

(Exim 4.99.5)

(envelope-from )

id 1wzxGu-00000009d1i-14PK

for postmaster@nl2k.ab.ca;

Fri, 28 Aug 2026 07:09:30 -0700

Reply-To: williamben5790@gmail.com

From: Mr. Cheng Saephan

To: postmaster@nl2k.ab.ca

Subject: DONATION FUNDS !!!

Date: 28 Aug 2026 07:09:23 -0700

Message-ID: <20260828070922.B8E4649384AA39E5@fsjmail.ca>

MIME-Version: 1.0

Content-Type: text/plain;

charset="utf-8"

Content-Transfer-Encoding: quoted-printable

X-internetguys-MailScanner-Information: Please contact the ISP for more information

X-internetguys-MailScanner-ID: 1wzxGu-00000009d1i-14PK

X-internetguys-MailScanner: Not scanned: please contact your Internet E-Mail Service Provider for details

X-internetguys-MailScanner-SpamCheck:

X-internetguys-MailScanner-From: wward2@fsjmail.ca

X-Spam-Status: No

X-AntiAbuse: This header was added to track abuse, please include it with any abuse report

X-AntiAbuse: Primary Hostname - cronus.internetguys.ca

X-AntiAbuse: Original Domain - nl2k.ab.ca

X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12]

X-AntiAbuse: Sender Address Domain - fsjmail.ca

X-Get-Message-Sender-Via: cronus.internetguys.ca: authenticated_id: wward2@fsjmail.ca

X-Authenticated-Sender: cronus.internetguys.ca: wward2@fsjmail.ca

X-Source:

X-Source-Args:

X-Source-Dir:

X-Spam_score: 18.1

X-Spam_score_int: 181

X-Spam_bar: ++++++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Dear Winner My name is Mr. Cheng Saephan, the fortunate winner

of a $1.3 billion powerball jackpot in 2024. I am giving away funds to five

randomly selected individuals. If you have received this email, it means

[...]



Content analysis details: (18.1 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[27.84.177.35 listed in will-spam-for-food.eu.org]

[27.84.177.35 listed in will-spam-for-food.eu.org]

[27.84.177.35 listed in will-spam-for-food.eu.org]

[27.84.177.35 listed in will-spam-for-food.eu.org]

[27.84.177.35 listed in will-spam-for-food.eu.org]

[27.84.177.35 listed in will-spam-for-food.eu.org]

[27.84.177.35 listed in will-spam-for-food.eu.org]

[27.84.177.35 listed in will-spam-for-food.eu.org]

[65.110.12.179 listed in will-spam-for-food.eu.org]

[65.110.12.179 listed in will-spam-for-food.eu.org]

[65.110.12.179 listed in will-spam-for-food.eu.org]

[65.110.12.179 listed in will-spam-for-food.eu.org]

[65.110.12.179 listed in will-spam-for-food.eu.org]

[65.110.12.179 listed in will-spam-for-food.eu.org]

[65.110.12.179 listed in will-spam-for-food.eu.org]

[65.110.12.179 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[27.84.177.35 listed in dnsbl.ahbl.org]

[27.84.177.35 listed in dnsbl.ahbl.org]

[27.84.177.35 listed in dnsbl.ahbl.org]

[27.84.177.35 listed in dnsbl.ahbl.org]

[65.110.12.179 listed in dnsbl.ahbl.org]

[65.110.12.179 listed in dnsbl.ahbl.org]

[65.110.12.179 listed in dnsbl.ahbl.org]

[65.110.12.179 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[27.84.177.35 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[27.84.177.35 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[27.84.177.35 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[27.84.177.35 listed in dnsbl.ahbl.org]

-0.0 SPF_PASS SPF: sender matches SPF record

-0.0 SPF_HELO_PASS SPF: HELO matches SPF record

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

1.5 RCVD_IN_SBL_XBL RBL: Received via a relay in Spamhaus SBL+XBL

[27.84.177.35 listed in sbl-xbl.spamhaus.org]

1.5 RCVD_IN_CBL RBL: Received via a relay in cbl.abuseat.org

[Listed by XBL, see ]

1.6 SUBJ_ALL_CAPS Subject is all capitals

0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in digit

[williamben5790(at)gmail.com]

3.1 DEAR_WINNER BODY: Spam with generic salutation of "dear winner"

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[65.110.12.179 listed in bl.score.senderscore.com]

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

0.7 TO_NO_BRKTS_FROM_MSSP Multiple formatting errors

0.0 LOTS_OF_MONEY Huge... sums of money

0.0 HK_NAME_MR_MRS No description available.

1.4 MONEY_NOHTML Lots of money in plain text

2.5 FREEMAIL_FORGED_REPLYTO Freemail in Reply-To, but not From

0.0 T_FILL_THIS_FORM_SHORT Fill in a short form with personal information

0.0 T_FILL_THIS_FORM_FRAUD_PHISH Answer suspicious question(s)

0.4 FILL_THIS_FORM_FRAUD_PHISH Answer suspicious question(s)

0.4 MONEY_FREEMAIL_REPTO Lots of money from someone using free email?

1.3 MONEY_FORM_SHORT Lots of money if you fill out a short form

2.0 ADVANCE_FEE_2_NEW_MONEY Advance Fee fraud and lots of money

Subject: {SPAM?} DONATION FUNDS !!!



Dear Winner



My name is Mr. Cheng Saephan, the fortunate winner of a $1.3=20

billion powerball jackpot in 2024. I am giving away funds to five=20

randomly selected individuals. If you have received this email,=20

it means you were chosen in the selection process. I have donated=20

a significant portion of my wealth to various charities, but due=20

to my deteriorating health and limited time, I have decided to=20

contribute $10 million to you as one of the chosen five. You can=20

verify my winnings by watching the video linked below.



Click here to watch:

https://youtu.be/YH0ZPmf9VEE?si=3DEeAtBhFkLwde1c-d



YOUR CODE IS: [0043035]



Please respond to this email with the code [0043035] at=20

williamben5790@gmail.com and provide your details below, and he=20

will assist you with the next steps for receiving your donation.



You are advised to send your details as stated below.

your Full name,

your Home address

your WhatsApp number

your Occupation

your ID Card



Contact My Personal Manager

Name: Mr. William Ben

WhatsApp Only :+1(754)207-5509

Email: williamben5790@gmail.com



I hope this brings joy to you and your family.



Best regards,

Mr. Cheng Saephan

Donation spam

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Fri, 28 Aug 2026 12:58:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.100 (FreeBSD))

(envelope-from )

id 1x01lS-000000002gp-0DEk

for dave@doctor.nl2k.ab.ca;

Fri, 28 Aug 2026 12:57:22 -0600

Resent-From: The Doctor

Resent-Date: Fri, 28 Aug 2026 12:57:21 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from cronus.internetguys.ca ([65.110.12.179]:38303)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.100 (FreeBSD))

(envelope-from )

id 1wzwhr-00000000M74-2jZ8

for www@doctor.nl2k.ab.ca;

Fri, 28 Aug 2026 07:33:28 -0600

DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=fsjmail.ca;

s=default; h=Content-Transfer-Encoding:Content-Type:MIME-Version:Message-ID:

Date:Subject:To:From:Reply-To:Sender:Cc:Content-ID:Content-Description:

Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:

In-Reply-To:References:List-Id:List-Help:List-Unsubscribe:List-Subscribe:

List-Post:List-Owner:List-Archive;

bh=dxAlClQ8y5Q6tq7CIaVd2aUcXb8te/l6Zzv1EN5B+eE=; b=MNt0ZhS7Jw+SmGAMbXN6DHw1FZ

2F01R5YVehHUa/tVvTfqjZv1Y7E9cibtWZgMw4/fv/O7rnqkMRlJBTpQfxLqV9tnRjRnTpGAC1n7w

1LYlYRCbslgSzOiTTQ4fTcqu0l/X2OnRu9d9QAGSMcnbhlbWLn/E0Q6B1ZzGTRzc+JuI=;

Received: from kd027084177035.ppp-bb.dion.ne.jp ([27.84.177.35]:21579)

by cronus.internetguys.ca with esmtpsa (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

(Exim 4.99.5)

(envelope-from )

id 1wzwgz-00000009F58-2lAE

for www@doctor.nl2k.ab.ca;

Fri, 28 Aug 2026 06:32:24 -0700

Reply-To: williamben5790@gmail.com

From: Mr. Cheng Saephan

To: www@doctor.nl2k.ab.ca

Subject: DONATION FUNDS !!!

Date: 28 Aug 2026 06:32:21 -0700

Message-ID: <20260828063220.16547C0ACE1FCB22@fsjmail.ca>

MIME-Version: 1.0

Content-Type: text/plain;

charset="utf-8"

Content-Transfer-Encoding: quoted-printable

X-internetguys-MailScanner-Information: Please contact the ISP for more information

X-internetguys-MailScanner-ID: 1wzwgz-00000009F58-2lAE

X-internetguys-MailScanner: Not scanned: please contact your Internet E-Mail Service Provider for details

X-internetguys-MailScanner-SpamCheck:

X-internetguys-MailScanner-From: wward2@fsjmail.ca

X-Spam-Status: No

X-AntiAbuse: This header was added to track abuse, please include it with any abuse report

X-AntiAbuse: Primary Hostname - cronus.internetguys.ca

X-AntiAbuse: Original Domain - doctor.nl2k.ab.ca

X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12]

X-AntiAbuse: Sender Address Domain - fsjmail.ca

X-Get-Message-Sender-Via: cronus.internetguys.ca: authenticated_id: wward2@fsjmail.ca

X-Authenticated-Sender: cronus.internetguys.ca: wward2@fsjmail.ca

X-Source:

X-Source-Args:

X-Source-Dir:

X-Spam_score: 18.1

X-Spam_score_int: 181

X-Spam_bar: ++++++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Dear Winner My name is Mr. Cheng Saephan, the fortunate winner

of a $1.3 billion powerball jackpot in 2024. I am giving away funds to five

randomly selected individuals. If you have received this email, it means

[...]



Content analysis details: (18.1 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[27.84.177.35 listed in will-spam-for-food.eu.org]

[27.84.177.35 listed in will-spam-for-food.eu.org]

[27.84.177.35 listed in will-spam-for-food.eu.org]

[27.84.177.35 listed in will-spam-for-food.eu.org]

[27.84.177.35 listed in will-spam-for-food.eu.org]

[27.84.177.35 listed in will-spam-for-food.eu.org]

[27.84.177.35 listed in will-spam-for-food.eu.org]

[27.84.177.35 listed in will-spam-for-food.eu.org]

[65.110.12.179 listed in will-spam-for-food.eu.org]

[65.110.12.179 listed in will-spam-for-food.eu.org]

[65.110.12.179 listed in will-spam-for-food.eu.org]

[65.110.12.179 listed in will-spam-for-food.eu.org]

[65.110.12.179 listed in will-spam-for-food.eu.org]

[65.110.12.179 listed in will-spam-for-food.eu.org]

[65.110.12.179 listed in will-spam-for-food.eu.org]

[65.110.12.179 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[65.110.12.179 listed in dnsbl.ahbl.org]

[65.110.12.179 listed in dnsbl.ahbl.org]

[65.110.12.179 listed in dnsbl.ahbl.org]

[65.110.12.179 listed in dnsbl.ahbl.org]

[27.84.177.35 listed in dnsbl.ahbl.org]

[27.84.177.35 listed in dnsbl.ahbl.org]

[27.84.177.35 listed in dnsbl.ahbl.org]

[27.84.177.35 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[65.110.12.179 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[65.110.12.179 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[65.110.12.179 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[65.110.12.179 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_SBL_XBL RBL: Received via a relay in Spamhaus SBL+XBL

[27.84.177.35 listed in sbl-xbl.spamhaus.org]

1.5 RCVD_IN_CBL RBL: Received via a relay in cbl.abuseat.org

[Listed by XBL, see ]

-0.0 SPF_PASS SPF: sender matches SPF record

-0.0 SPF_HELO_PASS SPF: HELO matches SPF record

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

1.6 SUBJ_ALL_CAPS Subject is all capitals

0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in digit

[williamben5790(at)gmail.com]

3.1 DEAR_WINNER BODY: Spam with generic salutation of "dear winner"

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[65.110.12.179 listed in bl.score.senderscore.com]

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

0.0 LOTS_OF_MONEY Huge... sums of money

0.0 HK_NAME_MR_MRS No description available.

0.4 MONEY_FREEMAIL_REPTO Lots of money from someone using free email?

0.0 T_FILL_THIS_FORM_SHORT Fill in a short form with personal information

2.5 FREEMAIL_FORGED_REPLYTO Freemail in Reply-To, but not From

0.7 TO_NO_BRKTS_FROM_MSSP Multiple formatting errors

1.4 MONEY_NOHTML Lots of money in plain text

1.3 MONEY_FORM_SHORT Lots of money if you fill out a short form

0.4 FILL_THIS_FORM_FRAUD_PHISH Answer suspicious question(s)

0.0 T_FILL_THIS_FORM_FRAUD_PHISH Answer suspicious question(s)

2.0 ADVANCE_FEE_2_NEW_MONEY Advance Fee fraud and lots of money

Subject: {SPAM?} DONATION FUNDS !!!



Dear Winner



My name is Mr. Cheng Saephan, the fortunate winner of a $1.3=20

billion powerball jackpot in 2024. I am giving away funds to five=20

randomly selected individuals. If you have received this email,=20

it means you were chosen in the selection process. I have donated=20

a significant portion of my wealth to various charities, but due=20

to my deteriorating health and limited time, I have decided to=20

contribute $10 million to you as one of the chosen five. You can=20

verify my winnings by watching the video linked below.



Click here to watch:

https://youtu.be/YH0ZPmf9VEE?si=3DEeAtBhFkLwde1c-d



YOUR CODE IS: [0043035]



Please respond to this email with the code [0043035] at=20

williamben5790@gmail.com and provide your details below, and he=20

will assist you with the next steps for receiving your donation.



You are advised to send your details as stated below.

your Full name,

your Home address

your WhatsApp number

your Occupation

your ID Card



Contact My Personal Manager

Name: Mr. William Ben

WhatsApp Only :+1(754)207-5509

Email: williamben5790@gmail.com



I hope this brings joy to you and your family.



Best regards,

Mr. Cheng Saephan

Notice Regarding Packaged Bread Claims — Ref Noº 4053106078 spam

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Fri, 28 Aug 2026 12:59:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.100 (FreeBSD))

(envelope-from )

id 1x01m9-000000002om-3oNU

for dave@doctor.nl2k.ab.ca;

Fri, 28 Aug 2026 12:58:05 -0600

Resent-From: The Doctor

Resent-Date: Fri, 28 Aug 2026 12:58:05 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mwp-ckd-mts-021c34.ocn.ad.jp ([210.154.209.35]:44341)

by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

(Exim 4.100 (FreeBSD))

(envelope-from )

id 1wzyIr-00000000EOu-0OIJ

for root@nk.ca;

Fri, 28 Aug 2026 09:15:47 -0600

Received: from mwp-spm-mts-003c1.ocn.ad.jp (mwp-spm-mts-003c1.ocn.ad.jp [210.154.199.196])

by mwp-ckd-mts-021c34.ocn.ad.jp (Postfix) with ESMTP id 246D52C0009B0

for ; Sat, 29 Aug 2026 00:14:41 +0900 (JST)

DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=copo.co.jp; s=bizmw;

t=1787930081; bh=afX/kg/Zyq788tb35EdFiJDFyL42jP/8pt1s66o/+JE=;

h=From:To:Date:Subject:From;

b=BnBCONBHkUm6g8jWLXMpZdt8iRtW98LoHt+Ih+hrwZztIyVHxXLTcSvaOwwi86GEn

6SokPAMhW3sdseXWqeddy7uf9YrRsK+X9CzfsMWhHPj0KX5qlwFdViyWhgzFCncRxJ

zmJphKV33L5A0xS61A1PQcpylLfw+AKGpDdsVs6M=

X-BIZ-RELAY: yes

Received: from mwp-vc-mts-008c1.ocn.ad.jp ([210.154.198.169])

by mwp-spm-mts-003c1 with ngmta

id 602439c5-18d000ef97189f5b; Sat, 29 Aug 2026 00:14:41 +0900

Received: from mwp-sdgw-mts-009c1.ocn.ad.jp ([210.145.253.196])

by mwp-vc-mts-008c1 with ngmta

id d29f8df5-18d000ef941556d1; Sat, 29 Aug 2026 00:14:41 +0900

Received: from c154iyjq.mwprem.net (c154iyjq.mwprem.net [122.17.146.91])

by mwp-sdgw-mts-009c1.ocn.ad.jp (Postfix) with SMTP id F059D14000096

for ; Sat, 29 Aug 2026 00:14:40 +0900 (JST)

Authentication-Results: c154iyjq.mwprem.net; arc=none smtp.remote-ip=18.179.53.64

ARC-Seal: i=1; a=rsa-sha256; d=mwprem.net; s=default; t=1787930081; cv=none;

b=CtJ9hi44PJduR7QY9v6+Un8bnSlSOQZcbp64DVKIcMuR5ANTFlXj8B0doJf+Ly5vkVY2BGBX6dNt+6hnDJh9qshmAWP4RVcfnJIREV0C0OjctjD5XhBqwsmRVwAYwMinx0PnqkHW9IbXbU0zSV4aGli1Azy45bO+IaWutOMESFk=

ARC-Message-Signature: i=1; a=rsa-sha256; d=mwprem.net; s=default;

t=1787930081; c=relaxed/relaxed;

bh=afX/kg/Zyq788tb35EdFiJDFyL42jP/8pt1s66o/+JE=;

h=DKIM-Signature:MIME-Version:From:To:Date:Subject:Message-Id; b=VdGGqGnJ90Qo5Mb5+40g011yOCLt08QWH1dGH13Qne3Z4Uu1Dnm7PPURGH7NClpwwC4pCfFWnPPTdh94nZn+M2J/kNN5KTxnIXAKZlMQrugejwJ251LG9ebyRUQeof9nANNbmaTR3/0fJ8bfMyLbL9n2t2izxObaX7BuwM3mOcc=

ARC-Authentication-Results: i=1; c154iyjq.mwprem.net

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=copo.co.jp; s=bizmw;

t=1787930081; bh=afX/kg/Zyq788tb35EdFiJDFyL42jP/8pt1s66o/+JE=;

h=From:To:Date:Subject:From;

b=Cr2G1kOvd0d3aEGvxi8DIv0SHNjxzZUKNAviEMNAZy7q6eYncfB7Al4YY6OXqjpu7

yV11rqpdNOBnislq5DhxQ57CAz1g+LMPNE6vltWjdHFz0LyJ0WOhXf1wDQyXyxL0EI

iD+7hSakzb7i373SosZYvIKI8M4QJLKoBoM9aus8=

MIME-Version: 1.0

From: "Canadian Bread Settlement"

To: root@nk.ca

Date: 28 Aug 2026 15:14:40 +0000

Subject: =?utf-8?B?Tm90aWNlIFJlZ2FyZGluZyBQYWNrYWdlZCBCcmVhZCBDbGFp?=

=?utf-8?B?bXMg4oCUIFJlZiBOb8K6IDQwNTMxMDYwNzggOC8yOC8yMDI2IDM6MTQ6?=

=?utf-8?B?NDAgUE0=?=

Content-Type: multipart/alternative;

boundary=--boundary_14429_c6059d66-5a77-460b-998a-0ab44478b06a

Message-Id: <20260828151441.2109E45999D1@c154iyjq.mwprem.net>





Settlement Information

Packaged Bread Class Actions



Information Notice

2026

Important Settlement Information

Loblaw/Weston

Packaged Bread Class Actions



Version française suit plus bas.

Recipient Information

You are receiving this email because you were identified as having claimed a $100 to $200 Loblaw Card from the Packaged Bread Loblaw Card Program and/or as having registered with the lawyers handling this class action.

Legal Notice

Authorized by the Superior Court of Justice for Ontario

01



Nature of the Proceedings

Class actions have been certified/authorized by the Ontario Superior Court of Justice and the Superior Court of Quebec on behalf of individuals and businesses resident in Canada who purchased Packaged Bread alleging certain manufacturers and retailers engaged in anticompetitive conduct resulting in overcharges for Packaged Bread sold in Canada.

The Courts have not yet made any decision on the merits of the claims or the defences in either of the actions.

National Settlement

$500 Million

$96 million already paid

02



Settlement Terms

The Plaintiffs in the actions have entered into a national settlement with Loblaw/Weston for $500 million and their cooperation in pursuing claims against non-settling defendants in the continuing actions.

If the settlement is approved by the Courts in both actions, the net settlement funds, after approved fees and expenses, will be distributed to and for the benefit of Settlement Class Members in accordance with the applicable distribution protocol.

03



Settlement Class Eligibility

If you are resident anywhere in Canada except Quebec and purchased Packaged Bread between January 1, 2008 and December 31, 2025, inclusive, and wish to participate in the Loblaw/Weston Settlement, please review the official settlement information and eligibility requirements.

Review Official Information

Please review the official settlement materials, eligibility requirements and applicable deadlines.

Apply Now Appliquez

Before submitting any information

Verify the settlement administrator, court notice, claim deadline and official website before providing personal or financial information.

This communication contains settlement information. Please consult the official settlement materials for the authoritative terms, eligibility requirements and deadlines.



https://www.canadianbreadsettlement.ca/ | Unsubscribe

WEb/SEO/App spam from Microsoft Outlook

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Fri, 28 Aug 2026 06:29:01 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.100 (FreeBSD))

(envelope-from )

id 1wzvhE-00000000AjZ-268v

for dave@doctor.nl2k.ab.ca;

Fri, 28 Aug 2026 06:28:36 -0600

Resent-From: The Doctor

Resent-Date: Fri, 28 Aug 2026 06:28:36 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-westeuropeazolkn19013013.outbound.protection.outlook.com ([52.103.33.13]:47226 helo=AM0PR02CU008.outbound.protection.outlook.com)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.100 (FreeBSD))

(envelope-from )

id 1wzvFO-00000000KAp-3hKj

for sales@nk.ca;

Fri, 28 Aug 2026 06:00:01 -0600

ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none;

b=UUulKK1Rp9EyYZuNYHjIZqk9pX2S3Sk+DSdZZkFuPASxADmRa8gytEfVJMaFb8UI3Sk7JnlaHVjbS3TGzE5xe3PqRpvIxAtVXQ5i9/JInHePNhAGjbArkTXMgw/ebnEN2ALQ6Kfblomt8QcAUFKMh7VaQVtzVo5Dc2xHuA5rhe0vw8Ov1/LzXLhz/9IHMHg6hLJoRTp65qLmwermRMVctJTb04Wm+HpoOC9xx0ZYnW9qjcd1a+ODynG+XduCGis3MDzNa8oMbL8yPv+5pd68IM8vo9c02h23VRVLjzT0HfWde1+0gGX8X78A5Xd7lIzyNe/HImHweiqu8r5QhkW9TQ==

ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;

s=arcselector10001;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1;

bh=QcOnfcFt6Oc0kfagLz9OlDJnLRKtu+U6br8G8+XhVs4=;

b=xYoIawBPoj7pce6/iZiWVHraLuO8aamJUkdRslsYi3b8aIuNFCYQEEy3wnK4TKKDtaG8bhmMeClHTrkbeYVnqzHPmWVXNvlI8ydQXg9ux/cBHz+O3bEJB9ofecNFE187cD8wKyC7MNeCBYwVUOUqZWGqb8EfTkkD3NenqYqjX0mVMBP85AB+Lnu/LoJ9bqOhXvOP9yxbeA3ceqKMs9tqVGKDb9o3pV+ks45v8bw6hBIFZaxhJLEdwSYLZIBgVuFcBCyinqkeovquouBdq7oKVCyOv9UMPMr5fk9aaDLImmEw0wUEpCtZxVqmGXBzW1exvXSiyC8PxAiW0yzmpx7WHQ==

ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=none; dmarc=none;

dkim=none; arc=none

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=hotmail.com;

s=selector1;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck;

bh=QcOnfcFt6Oc0kfagLz9OlDJnLRKtu+U6br8G8+XhVs4=;

b=ukVs/J0DUWJ0x/lnSBx0AoOaZaAR60w7AIdjqr/LLcq2HG+PI4JD7rDcT65o5WH364uQm6ele59ZUDnQVikILGWKhyViS1a/vBifu29FoJBappSciK1734TjCPGIOwWiqLkWzIJ9gpymCbGFpR2mNp7CKlJYopDHbS+T6XXx8fxafUgYWrJwbtqD1FmOLHdhGbk1U3qkEOZE10/LU1TD3vBsJhk3yiQcb5RDSE6PfT7cZ2yI7gd0rY3kiQvCQaI1My+HYwpquN/Pa4O+V5lyWObSako2Dz1zFOApJZwmtz44q6TBE9iBtGtp6+hCfrxFeTUBl9bTcuQz7VIMKl4qKA==

Received: from AM9PR02MB7515.eurprd02.prod.outlook.com (2603:10a6:20b:434::11)

by AMDPR02MB11199.eurprd02.prod.outlook.com (2603:10a6:20b:6cb::12) with

Microsoft SMTP Server (version=TLS1_2,

cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.360.11; Fri, 28 Aug

2026 11:58:51 +0000

Received: from AM9PR02MB7515.eurprd02.prod.outlook.com

([fe80::1ee4:282a:5e7a:35a1]) by AM9PR02MB7515.eurprd02.prod.outlook.com

([fe80::1ee4:282a:5e7a:35a1%4]) with mapi id 15.21.0360.008; Fri, 28 Aug 2026

11:58:51 +0000

From: Amiee Riviere

Subject: Re.:Service Issue by Website

Thread-Topic: Re.:Service Issue by Website

Thread-Index: AQHdNuSNy2xCAItReEiWNBIYoFS2hQ==

Date: Fri, 28 Aug 2026 11:58:51 +0000

Message-ID:

<0f97c66d7a224bd69a0965bf4576c5ddAM9PR02MB7515E6E6742C746B90B72D98FDAC2@AM9PR02MB7515.eurprd02.prod.outlook.com>

Accept-Language: en-US

Content-Language: en-US

X-MS-Has-Attach:

X-MS-TNEF-Correlator:

msip_labels:

x-ms-exchange-messagesentrepresentingtype: 1

x-ms-publictraffictype: Email

x-ms-traffictypediagnostic: AM9PR02MB7515:EE_|AMDPR02MB11199:EE_

x-ms-office365-filtering-correlation-id: 8ed79c4c-6ce1-4cd2-a531-08df04fbba06

x-ms-exchange-slblob-mailprops:

MQ+SOH4tIAGKfdrdgtyW0KkR8Rh8OAYU8iwtzj59C01hn6zWIFDmAzxsWJkiaG04sDlTrvhQDSKb0Ql5j1YZDFKOR0GSgXKbFkVD5Wtx4wJgnkn8MpKZn9WeVRqzVzk8xxz6fH1tlSp/z7F1MZZj7U45sUBtl37DrwZOprclqRs0Bg68jIKO6ktjqBGJeTtUgOXmwjqmxIJs7SXk4YbRekmtd/2s6AaSNH4/aReTTDC6CTTBVVcKDqn/2K6xytZIswIFRGy8xMQPY+UM2tgkJ4XB77AY36h1ydp0RKhn3hoxvKDlkaJULLBVVATKPY4Yn1fFkKXG93G5nF4bHQE+xFqLpsiY+vFbMoJHooy4PjQAOUK+j/uYZ4xl69Co7jsWhNvq1UqoVXOoL1S28ECWMboMlGSyUDhOBeqNrBZeXBg24oIMS1zw11fCv/lIqlxzan+plo89JOtULmk1uvale3mPDQi3D6F8w1my4sswPElkvmCuIjevzEfyGjkPqAkf6hyKWTqqko4L8O8tgZjBUVAdzwj9ktNX1aEGTxx9Awt1gIrC8fqG7Qq3ALR0fxiC/Cqu33ZbXDhlSkhnHnkqyYAvKdQ5RS5w6GEi4XJaON8Cyy3V1DBy6Q==

x-microsoft-antispam:

BCL:0;ARA:14566002|8062599012|8060799015|19110799012|37011999003|15080799012|51005399006|704163111799003|2604032031799003|15030799006|31061999003|24021099003|55001999006|25010399006|16051099003|40105399003|2607281247196008|102099032|3412199025|440099028;

x-microsoft-antispam-message-info:

=?iso-8859-1?Q?+N9iAaldKhPYL1XZCn8QRW715kQ22GhMPtDyxs0nyc1TLHZ3MyL7xqRMyE?=

=?iso-8859-1?Q?/S+5aHdcd4XV7+lt0p+HP8lnfYYb4FgrL07fpDUnJ2x5aScxMHwfoyzmwx?=

=?iso-8859-1?Q?H1bHGSddlFXDJpYJApGFc+PgOlgr1Vl7AVg6KrLtbgO6Iv/yBC3jDt1gVw?=

=?iso-8859-1?Q?9UvUDSz3apCa2S9T1B/AGTo2nxFt5REawF4XztHgCJ8Pph3YzbUfaTbYbg?=

=?iso-8859-1?Q?gHJ4E2hS7U8SzdxwSsWioGLszmu4WGC95tHDzWlobtQ+JIl2sO6SVQPIwI?=

=?iso-8859-1?Q?LkPVxhFAfRrzcZsLlWIzcUic/zIc0bwsfg0m3aIxMkRs1kOncJCU/BAhTv?=

=?iso-8859-1?Q?+Fhhe+VuErXFOBcocjlY/T3d32q1SavQHo/q0+2yJOUMJSwY4P51YX38qh?=

=?iso-8859-1?Q?SezBaB6Lq1WxbJtbY/+Irzzj3KFSj9dwjxwg0VKPWtl+afEdjGSjL1GIdv?=

=?iso-8859-1?Q?Px9S+lB0wNxOhsYs3La2IHcvyX8YCGpkYWoMh2tblGCiIb/7vfpCEeFqQs?=

=?iso-8859-1?Q?NZq5wcPNYDjc8JN1HBRV0ouYEqKK9X7BuX83hxig7CVix3wI4tKZ0PXQ2w?=

=?iso-8859-1?Q?zmSNEh42j2vYp+4YXvtkjlzsGo+DEmiS28Qpiu15izqtFdeKEZ9AFsJZz7?=

=?iso-8859-1?Q?2LCx1w3nIgLueeuEX6XitVemkwyiw3R+M7wV4D3M3nmxnSF/YeveDvhZB2?=

=?iso-8859-1?Q?65piCSvNOdvzLASFS3ghVT/qdEP34ZhTSDebX32KleqJzolzrzyYHKniYC?=

=?iso-8859-1?Q?H0DIGcrRPug/bulvmM9L6M9OD9N/LVNYOvHl8r2bG6h0r6Mau4/3ZrGFim?=

=?iso-8859-1?Q?cY2RuqhLzfxvj7sCAhpozNRXyxe/HfW19RCvYMWrH2TGoDDgQ95VhGN2zW?=

=?iso-8859-1?Q?lm+gSh4qDlnnD0pJNNdmpPU32X6ulFJK7TuvWNUfYzdW0r5Dbtodnwmmwd?=

=?iso-8859-1?Q?M54yxIQGFQaqYpF65UoZQ3r1NgqKAFcMtlXFg6K8JhzbxdQucnqIy+GXfC?=

=?iso-8859-1?Q?PDaJJzzntr3mFuj6+psL6Yw33eVM4OABx7Kja/NC3DOQFslaJ9ZMglLrhq?=

=?iso-8859-1?Q?chU+3rqMFRJC1SluR14ubKBCWCwesB0YGsG3209XUAsF7SF2VVV5QjLH3L?=

=?iso-8859-1?Q?OYa8gjGAolz9HzWDz3D7xHxbGnBI0HTgNBgQyn9DAGsCYJ1dVf/yytqqaO?=

=?iso-8859-1?Q?1/dG7QCKe/OASg=3D=3D?=

x-ms-exchange-antispam-messagedata-chunkcount: 1

x-ms-exchange-antispam-messagedata-0:

=?iso-8859-1?Q?ZVqODxOky0rdjjGTo91eeQmdbwNyj60opuWEorPjCvsdPnqpoUifT2puj7?=

=?iso-8859-1?Q?gGCO72TPREKIKzGi0bJ7ZES0MR3IKy35NWK/sqP7zk3OazoVxy/W3tso0P?=

=?iso-8859-1?Q?50b2cLK72Rcw/1oR01BGdrfcGgwi+Lwm5Jm6Ck2uSwJ2jbHNYd3GT1Hso1?=

=?iso-8859-1?Q?OzL28V+LbrK1+92J1P3ey3sYm7Iy7fSaTblKMbw7ycNDIjF58vtsedefp4?=

=?iso-8859-1?Q?nN6lIYuZf7WumCvBx4+q5IUGzLayWD90L+stfZATPzrMyiWCqvc03TuVRS?=

=?iso-8859-1?Q?0QT+/t0eC+klXUMJNPtXaANIeKWE+BbIBtABUuh7lAQRaoXnkkbE3ZDHCB?=

=?iso-8859-1?Q?JdOXVwuLgcJ4m/gDmV0rGZ5akMlIXfXz0HIp0HmxEgoYiNd5cLsfzYJm3Z?=

=?iso-8859-1?Q?ZBwIYRuLcM8RkBPAZk1d9X819EH2Gz/2pBlUPe/fSpa2I0O9QrHbt6q4SP?=

=?iso-8859-1?Q?zs6Pnp+bq/XgAoHgo/e6qGGbx9r7wWoCJnH91kVKj4Xpd0u4mYCOaPJbDN?=

=?iso-8859-1?Q?/fjaaCtXQqybOJx3rwaWMwjqtf43JSHzCsQN+yUGC27F58jcg5GMvgfRhM?=

=?iso-8859-1?Q?Cph5jcVN8shK95g8qj9n+RKfY5ffobjwpFLqwTBDJdOcc17G06l25rysJJ?=

=?iso-8859-1?Q?1cmqsgquzBHWaXxjJ33NkoQIqc0t2Sv6/9/oxW6bRxVAjJ1B1dJHOIOAWr?=

=?iso-8859-1?Q?ywsHCRbfZUmJyjPaCWVEoPI12DuO7wQ6PMkZ3ZaJg20zIqYCT8jlKhhHbD?=

=?iso-8859-1?Q?jP1ohPLCsaHTe8G+Sofl9X8B5iQ1WxgB4+/g3jcbYxQz48ywlSnpH2O5uO?=

=?iso-8859-1?Q?Yy2eshxCRj2mfdee46iw25nGqNRPUiSdpEqX1vwCrglgCsKY0dQ9K4nsyb?=

=?iso-8859-1?Q?RDjCRk3VTOiflAg4JOpQIdsg/QYtoyxJaY/AZ5fgb78xyfxGh+CNUan/lH?=

=?iso-8859-1?Q?UJWDYk2sjGyFjf0OCzRxB6LTnxj5jeauklkw7RVdoc0MdIqGN2nIfS/ZKK?=

=?iso-8859-1?Q?DkIch4ETtKicnYHBrYs6XCzZK+J2YZ5DQ2lGcVB08QmTahkIDXk895C2hj?=

=?iso-8859-1?Q?ODODNjBFFGgzdq2sgLQCxqD/kwjchBcXP6vgp9mont1bxowgqoo3NpHogr?=

=?iso-8859-1?Q?nyojl94NorPzpvCKIecz0rBJJjXN9/bG/7/LukhyjzOoG/qIPckPOM0tdK?=

=?iso-8859-1?Q?G9/LOwZ7ttfIrjHIXh5xgeCphkdDLFR66VLxoMiUkLQBf80ayRyW+kKmDf?=

=?iso-8859-1?Q?maNwnlQpMPfovEu0vrpYbwfXA5r66hjrN4zWpUP2jL35HGvANJ72XfnV1l?=

=?iso-8859-1?Q?Qo4v90pJo3aLNiO2lO0fEyeFuwHIfOyEQCXMW64XKjbvlW7db30r2LgAPx?=

=?iso-8859-1?Q?NgCJzIUVBfmgF/dLInakfaE1MHEPC0a+/SxPkhzDbf6P4X7ROeHvLdCI8i?=

=?iso-8859-1?Q?PnXfqF/tVQrQXZE2aQ5GkN/cz85jOa4jh26QcVkVwWBRnmemh+dg2ySTR1?=

=?iso-8859-1?Q?UO9TFh+A4BCembiL7a9Fos?=

Content-Type: text/plain; charset="iso-8859-1"

Content-ID: <72A49882EFF5B147B16E0F875FC1E388@eurprd02.prod.outlook.com>

Content-Transfer-Encoding: quoted-printable

MIME-Version: 1.0

X-OriginatorOrg: sct-15-20-9412-4-msonline-outlook-9f624.templateTenant

X-MS-Exchange-CrossTenant-AuthAs: Internal

X-MS-Exchange-CrossTenant-AuthSource: AM9PR02MB7515.eurprd02.prod.outlook.com

X-MS-Exchange-CrossTenant-RMS-PersistedConsumerOrg: 00000000-0000-0000-0000-000000000000

X-MS-Exchange-CrossTenant-Network-Message-Id: 8ed79c4c-6ce1-4cd2-a531-08df04fbba06

X-MS-Exchange-CrossTenant-originalarrivaltime: 28 Aug 2026 11:58:51.3854

(UTC)

X-MS-Exchange-CrossTenant-fromentityheader: Hosted

X-MS-Exchange-CrossTenant-id: 84df9e7f-e9f6-40af-b435-aaaaaaaaaaaa

X-MS-Exchange-CrossTenant-rms-persistedconsumerorg: 00000000-0000-0000-0000-000000000000

X-MS-Exchange-Transport-CrossTenantHeadersStamped: AMDPR02MB11199



Hello Dear,=0A=

I'm informing you.=0A=

Actually, I got error on your website , With your permission, I would like =

to send you a screenshot of those errors.=0A=

Because of these issues your website is not visible on Google.=0A=

Let me know by reply,=0A=

Thank you,=0A=

Amiee=0A=

New York, NY=A010018=

Chinese language spam from Google GMail

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Fri, 28 Aug 2026 06:29:01 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.100 (FreeBSD))

(envelope-from )

id 1wzvgs-00000000AfT-00ah

for dave@doctor.nl2k.ab.ca;

Fri, 28 Aug 2026 06:28:14 -0600

Resent-From: The Doctor

Resent-Date: Fri, 28 Aug 2026 06:28:13 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-lj1-f178.google.com ([209.85.208.178]:44229)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.100 (FreeBSD))

(envelope-from )

id 1wzuXN-00000000BBz-3Xhg

for webmaster@nl2k.ab.ca;

Fri, 28 Aug 2026 05:14:30 -0600

Received: by mail-lj1-f178.google.com with SMTP id 38308e7fff4ca-3a1585728b5so7287061fa.0

for ; Fri, 28 Aug 2026 04:13:35 -0700 (PDT)

ARC-Seal: i=1; a=rsa-sha256; t=1787915608; cv=none;

d=google.com; s=arc-20260327;

b=rOOTMJdLkionr5cSAGV5MWg/A30SN2feL5/60ox1sZmorE1QOlb4+42aEIPFQxOhyj

S+yk5id+weF3xf4vEEEbs+8oCdzCswhm3mDt5Mjc3kOElT511N1wjVlwLu8uHHEwlu0f

aZMEcdNCPJntFBZXf1GP2yu1W+I6gATmkjD+jx+BjOjzzclH9ZHyjzwRA3teZjgHEtre

rcP1X+SCWISifW4xsu9Q4gzNBYOjtgKCG/3uwWdTVTU9aeD9uBqgK0lLU9xJcUxQul1W

HgkM6dnjLBjHEiQggXhuZCLT/gjXeuxFy/YdvVNEhAwtLNyb75GDLLV47XmmGB4jiDud

fSbA==

ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20260327;

h=to:subject:message-id:date:from:mime-version:dkim-signature;

bh=3RepK7odJ1stmNQhgG89cCLmvPogww0hKF6GBzXfdbg=;

fh=rxiu268wq4HVsAWRudiXn83nI3t32zUOkR0t5oJm6zQ=;

b=MLYBz17rNKPfiZVQQXv/qBNODa29qk6r3thIkjzVDYIRLTx4Br13EY913a2XvltK7N

kK0O4rogtCsXB6O4Ns/nljL75NFimg3gMneUw3zC8GBa58ewzaf39qiMnjPl+3QnylCG

fYQtIwuwtC0HKv++zzTA6yCYZqsDXWh8oNDzOc7Ad5cr1y8b5N5jGH9TdjX3x1ZIWhlV

i6Q98rr05E+yUZZYO42eFNMneASWDBc7VgX5Sy2zmxgP8INZGVYFe0tk3RUBkt1+K2T3

aQEJPqzBKbHET4rsNNNsiYRKquXFpF/srS0iB1e54fFuJZa3RcB64VY5g5Pgt7sPzWxF

o/0w==;

darn=nl2k.ab.ca

ARC-Authentication-Results: i=1; mx.google.com; arc=none

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=gmail.com; s=20251104; t=1787915608; x=1788520408; darn=nl2k.ab.ca;

h=content-type:to:subject:message-id:date:from:mime-version:from:to

:cc:subject:date:message-id:reply-to:content-type;

bh=3RepK7odJ1stmNQhgG89cCLmvPogww0hKF6GBzXfdbg=;

b=o3FsuawtKRAaUgIKJjetB+CA1LQHZo7lFCfShi48CdptGvjuYMa6p/+JG4/zaN14+P

fNcozAr+wqlEJF6Bf5e//aaao0AU0RNB8g+zvrAn2ozgHKk3fyRA9f2TXlrZ3hp9CLP3

mQEO9pbbODuNyAj2jQraJVAykQL8VKzHVAgxCw7TeElYaMIylaggGZuxejtD3UJWuVzN

NZh1Wd1+g8JLpCowq2K3/5nnd7y0TBgngJx10DcvyLrWT+LWHjWKlceOdjxTDTqxKVQF

8nYzTBt11wSrVDCnxeU5ZHUe/zgvQ8wLcVWGktoJexgoT/aMK6wpXQ+YyJj7CbDPhUKv

teKQ==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20251104; t=1787915608; x=1788520408;

h=content-type:to:subject:message-id:date:from:mime-version:x-gm-gg

:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to

:content-type;

bh=3RepK7odJ1stmNQhgG89cCLmvPogww0hKF6GBzXfdbg=;

b=rVXAyJY5eJMOjou7l0k638jGqEHh5ZrXOg/34MzW9sYmDpUbLnZ31zaevlP8ofXeTy

S7UK1F/kHtI1rzTxOb/sQyPNxoW2aANFrzSRqXCxeZzM8m8Z9B4EVra5v7nnRw35ctFs

T8FX4BIRQtkVI3a1fN4FaxJA3hIALJplTMm+SbpiTsfEvzDjNYHKZok4CBx/l6BEEdDw

jV4vqJ2SfbHB8YaIa2gFlpds9sAJeAvpKHmIUC+cZGP/CRyEYr2sWRKLgALPJxrTJsww

ut1WRzGvvy9auP/mjbs59GN32M8QacUfIioapAbvr/E1Wj8brldeXal1mHXTGZ9xpG3u

gKmw==

X-Forwarded-Encrypted: i=1; AHgh+Rpa4z+QkAHBtjRYPkZtIsIeoqAkCtK/fNrnVBRvpuEoWTDLLxfi/vP//RsvWnWdxhhBglGOzc4km40=@nl2k.ab.ca

X-Gm-Message-State: AFuF++m1FrkG6QAW86RwFqaMPWCNizQ6j5ipxmE61igrZFWnDokS0kd8

5nPwiN7KjC/0Mn/BqsgDdwxhn+jOq2XVM1OXeD5DOKPylpUDOQ3t+Y0CdI45GK/efovRq6t9Kzf

2gallkgsw00qqKYQy9xZnLELfbbJpoGAd2g5A8cmVbkLerRw=

X-Gm-Gg: AR+sD12i88DiHgRmPv8VuDI1o7VXa7UJss2nb9b0YtLFZrY1O1jikpDIfZWl7g7QQN2

B+A/FE3NskbIx4tcBl/TmmfwKPMHSsRjcSjPt1Fsivpx5nCv6mYD1zHyzY1T8IKmeAmTQ1y+9QE

DdaFSvQS12hFgYQPHrbc/Qc2yOrjUrHSg54K/RjY6/EFsA1TcODHeWSr6aVE55Zjt2JOc2fysTI

fjzxROL77pdW1K5vIxMUc0tKpCSV+zHclO8Eg0X2j7yy6rEXiFFL+Jr5UcHwPVvEml4nt99l+7j

JGSm9hRH1HP7XgZ84H9vXsQECiEPWpS46e11dbmngAHmx+Gve/iS+9xhV77D85iSdfnV10BKwQ5

59BbfKspWsbHuQSS1rz+tb3Fkb+VS+cLrWQi4UYwNTrKzhKULS06fSOcLwwNiq2n6ESsIkKO2aS

G3IKkqm0bKKtD+z4SnQQ2pbmByRj7ZlAlWnvV//6dL

X-Received: by 2002:a05:651c:f1c:b0:3a3:364:f796 with SMTP id

38308e7fff4ca-3a30364fde5mr9658311fa.1.1787915605999; Fri, 28 Aug 2026

04:13:25 -0700 (PDT)

MIME-Version: 1.0

From: Kevin Zhou

Date: Fri, 28 Aug 2026 18:13:07 +0700

X-Gm-Features: AcwNN1X0gmBQHEIMzEwDpocaoYRXbux3wWyFae6D2MUNDA5HHIOy3x2jMfAJmbc

Message-ID:

Subject: =?UTF-8?B?5Lit5Yy777ya5Y+v5Lul5LiO55mM55eH5ZKM5bmz5YWx5aSE?=

To: webmaster@insuranceaudit.com, webmaster@nl2k.ab.ca,

webmaster@cybersurfers.net

Content-Type: multipart/alternative; boundary="00000000000095821e065a198a76"



你好吗?



癌症患者越来越多,治疗癌症的手段也越来越多,但是癌症的复发率仍然居高不下。有的癌症患者不断的和癌症斗争,最终还是死于癌症,或癌症治疗过程中的并发症。



为什么?是癌症太可怕,还是我们对癌症的认知和处理出了问题?



能避免癌症发生吗?答案是肯定的。只要注重日常的保养,并且保养有道得法,就能真正有效的预防癌症。



点击查看更多,不要错过任何重要信息!



https://sumo.ad/6yu-ai-zheng-he-ping-sheng-huo





祝你和你的家人好运!



---



历史会铭记,正义永不沉默