NetKnow Corporate Blog

Chinese prodcuts spam Part 2

Posted by Dave Yadallee on Friday, May 8. 2026

4.5 URIBL_AB_SURBL Contains an URL listed in the AB SURBL blocklist

[URI: ossedm.com]

2.2 URIBL_CT_SURBL Contains an URL listed in the CT SURBL blocklist

[URI: svip.ossedm.com]

1.6 RCVD_IN_BRBL_LASTEXT RBL: No description available.

[104.128.239.234 listed in bb.barracudacentral.org]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

2.5 URIBL_DBL_SPAM Contains a spam URL listed in the DBL blocklist

[URI: ossedm.com]

[URI: wwbniu.cn]

-0.0 SPF_PASS SPF: sender matches SPF record

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[104.128.239.234 listed in bl.score.senderscore.com]

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

-0.0 T_RP_MATCHES_RCVD Envelope sender domain matches handover relay

domain

1.6 HTML_IMAGE_ONLY_12 BODY: HTML: images with 800-1200 bytes of words

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

-1.0 MAILING_LIST_MULTI Multiple indicators imply a widely-seen list

manager

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

Subject: {SPAM?} Slipper Supplier for Walmart & Costco | Audit-Ready Factory

--_=_swift_v4_1778257025_a6b1765e163f8cfde711675250d4d3e7_=_

Content-Type: text/plain; charset=utf-8

Content-Transfer-Encoding: quoted-printable

Hi,

Managing a high-volume slipper category requires a partner who

unde=

rstands the stakes of compliance and delivery.

We are a specialized footw=

ear manufacturer currently serving as a

trusted vendor for Walmart and Co=

stco. Our factory is fully audited

(BSCI, Sedex, GRS) and optimized for m=

assive capacity without

compromising on Tier-1 pricing.

We'd love to he=

lp your company de-risk your supply chain for 2026.

Would you be open to =

give a try ? =C2=A0looking forward to hear you .

Best regards,

=C2=

=A0

Sam

Account Manager

Tel: 15021204501

Jiang Yin Kaiji Knitting C=

o.,Ltd

Addess=EF=BC=9ANo. 27 Fuyang New Village, Huachang Road, Zhutang T=

own,

Jiangyin City, Jiangsu Province,China

--_=_swift_v4_1778257025_a6b1765e163f8cfde711675250d4d3e7_=_

Content-Type: text/html; charset=utf-8

Content-Transfer-Encoding: quoted-printable

=09Slipper Supplier for Walmart & Costco | Audit-Ready Factory</titl= e> </head> <body>Hi, Managing a high-volume slipper category requires a partner who understands = the stakes of compliance and delivery. We are a specialized footwear manufacturer currently serving as a trusted v= endor for Walmart and Costco. Our factory is fully audited (BSCI, Sedex, GR= S) and optimized for massive capacity without compromising on Tier-1 pricin= g. We'd love to help your company de-risk your supply chain for 2026. Would yo= u be open to give a try ? =C2=A0looking forward to hear you . Best regards, =C2=A0 Sam Account Manager Tel: 15021204501 Jiang Yin Kaiji Knitting Co.,Ltd Addess=EF=BC=9ANo. 27 Fuyang New Village, Huachang Road, Zhutang Town, Jian= gyin City, Jiangsu Province,China<img width=3D"1" height=3D"1" src=3D"http:= //svip.ossedm.com/index.php/campaigns/sg4527fj3bd90/track-opening/nr219wl85= ba00" alt=3D"" /> </body> </html> --_=_swift_v4_1778257025_a6b1765e163f8cfde711675250d4d3e7_=_-- </div> <footer class="post-info"> <ul class="meta"> <li>Categories: <a href="https://www.nk.ca/blog/index.php?/categories/57-Chinese-Phish-Spam">Chinese Phish Spam</a></li> <li><a href="/blog/index.php?/archives/17628-Chinese-prodcuts-spam-Part-2.html#comments" title="0 Comments, 0 Trackbacks">0 Comments</a></li> </ul> </footer>  </article> <article class="post clearfix"> <header> <h2 class="post-title"><a href="/blog/index.php?/archives/17627-Chinese-prodcuts-spam-Part-1.html">Chinese prodcuts spam Part 1</a></h2> Posted by <a href="https://www.nk.ca/blog/index.php?/authors/1-Dave-Yadallee">Dave Yadallee</a> on <time datetime="2026-05-08T18:17:00+00:00">Friday, May 8. 2026</time> </header> <div class="clearfix"> X-Mozilla-Status: 0001 X-Mozilla-Status2: 00000000 Return-path: <doctor@doctor.nl2k.ab.ca> Envelope-to: dave@doctor.nl2k.ab.ca Delivery-date: Fri, 08 May 2026 12:19:00 -0600 Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD)) (envelope-from <doctor@doctor.nl2k.ab.ca>) id 1wLPmL-000000005jy-0R7h for dave@doctor.nl2k.ab.ca; Fri, 08 May 2026 12:18:25 -0600 Resent-From: The Doctor <doctor@doctor.nl2k.ab.ca> Resent-Date: Fri, 8 May 2026 12:18:24 -0600 Resent-Message-ID: <af4o8IQlBaFNwpC6@doctor.nl2k.ab.ca> Resent-To: Dave Yadallee <dave@doctor.nl2k.ab.ca> Received: from wwbniu.cn ([104.128.239.234]:44415 helo=smtp.wwbniu.cn) by doctor.nl2k.ab.ca with esmtp (Exim 4.98.2 (FreeBSD)) (envelope-from <manager@wwbniu.cn>) id 1wLNtp-00000000HvO-2yKG for doctor@nl2k.ab.ca; Fri, 08 May 2026 10:18:10 -0600 DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; s=ossljy; d=wwbniu.cn; h=Message-ID:Date:Subject:From:Reply-To:To:MIME-Version:Content-Type:List-Unsubscribe:List-Id; i=manager@wwbniu.cn; bh=ZN9NOe3yLxQSlYstowx5vpUTN8c=; b=Lg20/zcFxI8DzPCxtNVUfuRcKNl8kn8YvoMPPEJkb0unBPH+vJ/T8zRX8MEo0mT3KC79Nsr6Gqnp fCU02xEWSrPoYhh+qO8LJjSp43gebupCQI845kOzEfQjvZXCHpOdWO33DGEYCzsGbQYef2A03bkY Z0Q8J7SwaX8lLmfhC6idfNHe5NLMS9y1qVMXEHFWbzpTxl7o17giIkMR12PhMDD0APCz8FfxaXpx O+Fo27JmcR+FdW+bkHmjZef4ifwk2BZ4Y5bx9t529pVjGDRKcdurPw8vcoafL+vnv7kd7+HG9uFt 4TAmTPYvOLqBuaQ27gZ6xbgGlIRivC0nXS7JMw== DomainKey-Signature: a=rsa-sha1; c=nofws; q=dns; s=ossljy; d=wwbniu.cn; b=vJxJFDUlAFEW6bFIhDa1fCrnpUZJmUJV3/lJkZ8Zf0eyzomlFzJw3KOppFOqz2y752A1KBVrxnd6 qIGV15HTeo+u5K3QVnZKz1eOfUsCOU7gnnGOSB+KCNNKW66lXdxfTMIcUMqv7aHEgCdHreD811De QjK6O82ybElYDLZihGMVftX43iaSehIaCpoBo8lAoUzvKR4VUh+/lbdrEp4/f53hyEkmI7QrqzLH naJ/6yzDDbI5WH2J+1BKroarxHeNQnkBq230B7OV9ze2/wl6q7r+FBIan9+LH6y0uyp/x6LutEPw xegtVmG3xFBCooAX6IXsUBUu0rtKZ8GIeP/Clw==; Received: from svip.ossedm.com (182.106.136.53) by smtp.wwbniu.cn id hvo6bi0e97c5 for <doctor@nl2k.ab.ca>; Fri, 8 May 2026 16:17:07 +0000 (envelope-from <manager@wwbniu.cn>) Message-ID: <d8da51d488c9383445b0435ed723cfb5@wwbniu.cn> Date: Fri, 08 May 2026 16:17:05 +0000 Subject: Slipper Supplier for Walmart & Costco | Audit-Ready Factory From: sam Manager <manager@wwbniu.cn> Reply-To: sam Manager <sam@kaijisocks.com> To: "doctor@nl2k.ab.ca" <doctor@nl2k.ab.ca> MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="_=_swift_v4_1778257025_a6b1765e163f8cfde711675250d4d3e7_=_" X-Tracking-Did: 0 X-Subscriber-Uid: nr219wl85ba00 X-Report-Abuse: Please report abuse for this campaign here: http://svip.ossedm.com/index.php/campaigns/sg4527fj3bd90/report-abuse/wp669vd52kf2a/nr219wl85ba00 X-Mailer: SwiftMailer - 5.4.x X-EBS: http://svip.ossedm.com/index.php/lists/block-address X-Delivery-Sid: 255 X-Customer-Uid: yy586nmk8x395 X-Customer-Gid: 41 X-Campaign-Uid: sg4527fj3bd90 Precedence: bulk List-Unsubscribe-Post: List-Unsubscribe=One-Click List-Unsubscribe: <http://svip.ossedm.com/index.php/lists/wp669vd52kf2a/unsubscribe/nr219wl85ba00/sg4527fj3bd90?source=email-client-unsubscribe-button>, <mailto:sam@kaijisocks.com?subject=Campaign-Uid:sg4527fj3bd90 / Subscriber-Uid:nr219wl85ba00 - Unsubscribe request&body=Please unsubscribe me!> List-Id: wp669vd52kf2a <3.9> Feedback-ID: sg4527fj3bd90:regular:wp669vd52kf2a:yy586nmk8x395 X-Spam_score: 12.9 X-Spam_score_int: 129 X-Spam_bar: ++++++++++++ X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca", has identified this incoming email as possible spam. The original message has been attached to this so you can view it or label similar future email. If you have any questions, see @@CONTACT_ADDRESS@@ for details. Content preview: Hi, Managing a high-volume slipper category requires a partner who understands the stakes of compliance and delivery. We are a specialized footwear manufacturer currently serving as a trusted vendor f [...] Content analysis details: (12.9 points, 5.0 required) pts rule name description ---- ---------------------- -------------------------------------------------- 1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org [104.128.239.234 listed in dnsbl.ahbl.org] [104.128.239.234 listed in dnsbl.ahbl.org] [104.128.239.234 listed in dnsbl.ahbl.org] [104.128.239.234 listed in dnsbl.ahbl.org] [182.106.136.53 listed in dnsbl.ahbl.org] [182.106.136.53 listed in dnsbl.ahbl.org] [182.106.136.53 listed in dnsbl.ahbl.org] [182.106.136.53 listed in dnsbl.ahbl.org] 1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org [104.128.239.234 listed in dnsbl.ahbl.org] 0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org [104.128.239.234 listed in dnsbl.ahbl.org] 0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org [104.128.239.234 listed in dnsbl.ahbl.org] 0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org [104.128.239.234 listed in dnsbl.ahbl.org] 1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org [182.106.136.53 listed in will-spam-for-food.eu.org] [182.106.136.53 listed in will-spam-for-food.eu.org] [182.106.136.53 listed in will-spam-for-food.eu.org] [182.106.136.53 listed in will-spam-for-food.eu.org] [182.106.136.53 listed in will-spam-for-food.eu.org] [182.106.136.53 listed in will-spam-for-food.eu.org] [182.106.136.53 listed in will-spam-for-food.eu.org] [182.106.136.53 listed in will-spam-for-food.eu.org] [104.128.239.234 listed in will-spam-for-food.eu.org] [104.128.239.234 listed in will-spam-for-food.eu.org] [104.128.239.234 listed in will-spam-for-food.eu.org] [104.128.239.234 listed in will-spam-for-food.eu.org] [104.128.239.234 listed in will-spam-for-food.eu.org] [104.128.239.234 listed in will-spam-for-food.eu.org] [104.128.239.234 listed in will-spam-for-food.eu.org] [104.128.239.234 listed in will-spam-for-food.eu.org] </div> <footer class="post-info"> <ul class="meta"> <li>Categories: <a href="https://www.nk.ca/blog/index.php?/categories/57-Chinese-Phish-Spam">Chinese Phish Spam</a></li> <li><a href="/blog/index.php?/archives/17627-Chinese-prodcuts-spam-Part-1.html#comments" title="0 Comments, 0 Trackbacks">0 Comments</a></li> </ul> </footer>  </article> <article class="post clearfix"> <header> <h2 class="post-title"><a href="/blog/index.php?/archives/17626-WebSEOApp-spam-from-Google-Gmail.html">Web/SEO/App spam from Google Gmail</a></h2> Posted by <a href="https://www.nk.ca/blog/index.php?/authors/1-Dave-Yadallee">Dave Yadallee</a> on <time datetime="2026-05-08T18:15:00+00:00">Friday, May 8. 2026</time> </header> <div class="clearfix"> X-Mozilla-Status: 0001 X-Mozilla-Status2: 00000000 Return-path: <doctor@doctor.nl2k.ab.ca> Envelope-to: dave@doctor.nl2k.ab.ca Delivery-date: Fri, 08 May 2026 07:31:00 -0600 Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD)) (envelope-from <doctor@doctor.nl2k.ab.ca>) id 1wLLI0-000000002eJ-0pxo for dave@doctor.nl2k.ab.ca; Fri, 08 May 2026 07:30:48 -0600 Resent-From: The Doctor <doctor@doctor.nl2k.ab.ca> Resent-Date: Fri, 8 May 2026 07:30:48 -0600 Resent-Message-ID: <af3liJjRN6uuDz3M@doctor.nl2k.ab.ca> Resent-To: Dave Yadallee <dave@doctor.nl2k.ab.ca> Received: from mail-wm1-f43.google.com ([209.85.128.43]:60863) by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256 (Exim 4.98.2 (FreeBSD)) (envelope-from <brandonparles@gmail.com>) id 1wLKEt-00000000OIk-1lj4 for root@nk.ca; Fri, 08 May 2026 06:23:40 -0600 Received: by mail-wm1-f43.google.com with SMTP id 5b1f17b1804b1-4891e86fabeso23426895e9.1 for <root@nk.ca>; Fri, 08 May 2026 05:22:44 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1778242957; cv=none; d=google.com; s=arc-20240605; b=Sxh9Rxzi7G2/UtVL9AoF2Gqpm3ZTp5SCc0v6/KGpKgjD7MAdj4PKqjj/QICZmq5W8T Q7bxDZHwCW8jHL1DDmMmhlV1bAKfQS5D6aYZ8vzkBo77M96TvDrwLeUfqMSZT8ASp7kG Ky5SRQFL47ENdvqVC54oNEhJLwRWVQxqZQRywqsoGt3ZXvamgtyIzU91aeDQ0WGCoeEZ 78hmx2abDD8EryOtUXBR4bGuULV16z7Lz681hGFDtomOdWGxNnx2+VJjP5R9ThrACF2S p3EyzWLy88iF/dE1WGYWvTcD4Gcf0U7kNtn3FWoiEcC8FJOkf5a54b7jCFZUJj+sm+pI ReaQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20240605; h=to:subject:message-id:date:from:mime-version:dkim-signature; bh=347aY+mC7wrPtZjHc3McN+ulroAqX+FvUBtGDS/xB84=; fh=ny7+SATv4n6lSNl0rVMQyaj6POVJTUZJLShjjgjSTJg=; b=i5dd81EQcCnn5AXt1JUaHf9lHFuL+nwKbLTuiKIL41uN7Eecjaa5wSXr9B4NzWITJ+ /h0zF1IWkw/ngscMMKdW6+yO1pokX7CfhVXFi4OzEOYkmZ2N3LdydI8qlhfWshKaFqvk KVHMlUdH31KK5cFXxAHRwY6FGYvMAInCG9b+1npq3GL79GMZy/WeElTt5ziDfIW6IOj0 t56cAQHRDgdfTq2IYAURIGay3vYaKqGaTLdS8rQV4ic9lVgHBqAui/I8saiC/BpukzAr L8oPe3q7tOUqL1DE0Sll33mQmVOw7jNFibhguDw8rAICO6gJvAqheEVUq+KQMf6Mhs1I jZ9Q==; darn=nk.ca ARC-Authentication-Results: i=1; mx.google.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1778242957; x=1778847757; darn=nk.ca; h=to:subject:message-id:date:from:mime-version:from:to:cc:subject :date:message-id:reply-to; bh=347aY+mC7wrPtZjHc3McN+ulroAqX+FvUBtGDS/xB84=; b=lmflev4yBceYnbuhZDs4YZKh6uwrL8GznwylQ2dR9Nm9XdacnYuaCgzaw05cGOFZxQ AMcUaZKgN7t2VhKl0zL+AAOdt4ItgdIOpxJFzvHuttqdMgQUs4nyVemGN5jbvBo6L6u3 Ri7f69X2N9ASi6ETinR7dTVL9+prXRGCGtzNGKS7DZLLF0TopW/4CohX3i6elRlqQzbB w/VB5XOkDVq0RIw6Zh3gZL4ySB5Ct0xQpF49/4KrtdCoLuumz6Wjzp6++sYXmokv3yn0 T/ZnNkL+34QTshZ21mwsCP1E8oGn9nE6ogF8m+0/0WequMfUvyWo284ZxQyKp0Z4PApk +MnA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1778242957; x=1778847757; h=to:subject:message-id:date:from:mime-version:x-gm-gg :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to; bh=347aY+mC7wrPtZjHc3McN+ulroAqX+FvUBtGDS/xB84=; b=eUUfjItPSGMbrB/4Y96Hx/I7YDFo1sSt5ttlB6aPijFyx7v9eW2D/jrF2CQCEIV0bP owTjS2nsBDRXpn2kkCH6AfOSmQOHcAivjl9tXR8ht6Rekpg/ZdR9d09fC23gbzD3vLUT S0J76RJDWIb8l3UrqOa9o/3DAJcgcps+Fwf4wB35+lZPgtR2Y4+VhKG4+LXXJAi8UDjS 6z/y4ujxGk5jUasoMDh2bnOoo5BSVmMpcmpKqrpBdvRFjsQxgH5gU2zy97vy/Vl8G+A5 3Z/Y+f+jq6jeFmNjVdftWdz/eINzcC/GcG6lRJ8hKSqb+m3nl3f0f6RLBX3+1x4eD2O1 0xZw== X-Gm-Message-State: AOJu0YxU8BM+RrkaJoWhR0cMxkD1uzVhreHwb6r/lprK92CadxA32aWb 7XfoFCfcgpf8vMZtiN2OBQQdSrGRbp6yUR0L2tL1dblgsyS0036J30x6Wb5hy+u4t4aowbNTy8s JgYHPc9Kg9fEuxa4QyswS6fA/J/9KJDBp+MPD X-Gm-Gg: AeBDiesuDdX9NuQMnsjReG2PSnxcBpJt/21SRgKFRMREbnbulACMitobzipFT3ni4fa UDUeJY8jFU0gqMQunp4+sd7HkGYJtOGFClVSGxK1HYQBoDx2bc3QF/gK9tP4SX690MrHGUctg8K M69MG0AG0XNcOLjziTNCxrSLoGASxsrzUpCnXR897xWEJ1g+yMV7CywQnNrYUMc0INEHk83lHQ7 Jnp3UeX/kQxK1d/qEbQhVngpkWEob0vWYXvJJjakJwl4BanDA54BiYGo8IY69MTvbvG84CyVrsw utYcbWMpUcEoFJ/Vn1uaSPs= X-Received: by 2002:a05:600c:8011:b0:48a:80cb:1bb4 with SMTP id 5b1f17b1804b1-48e51f3b00emr191282485e9.22.1778242956906; Fri, 08 May 2026 05:22:36 -0700 (PDT) Received: from 1008170693301 named unknown by gmailapi.google.com with HTTPREST; Fri, 8 May 2026 05:22:36 -0700 Received: from 1008170693301 named unknown by gmailapi.google.com with HTTPREST; Fri, 8 May 2026 05:22:36 -0700 MIME-Version: 1.0 From: brandonparles@gmail.com Date: Fri, 8 May 2026 05:22:36 -0700 X-Gm-Features: AVHnY4IWj2y_a0qk10ZnhM4ehIcJMFUUrYTgHd_U48t0nD7AXNer7sqsQDfXkVY Message-ID: <CAAu7_pQa_=HKymfOpWmm33BuaziPD9sU_h5iTHNU2QqP-XRiwg@mail.gmail.com> Subject: =?UTF-8?B?V2ViIHNpdGUgY29uc3VsdGFudOKApi4uLi4uLi4uLi4uLi4uLj8/?= To: root@nk.ca Content-Type: multipart/alternative; boundary="000000000000c5524606514d734a" --000000000000c5524606514d734a Content-Type: text/plain; charset="UTF-8" Hello, Would you be interested in building a new website, or possibly rebuilding/repairing your existing website . I can send you more details on the action/portfolio/past work details/price list. Brandon --000000000000c5524606514d734a Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable <div>Hello,</div><div> </div><div>Would you be interested in building a = new website, or possibly rebuilding/repairing your existing website .</div>= <div> </div><div>I can send you more details on the action/portfolio/pas= t work details/price list.</div><div> </div><div>Brandon</div><div> <= /div> --000000000000c5524606514d734a-- </div> <footer class="post-info"> <ul class="meta"> <li>Categories: <a href="https://www.nk.ca/blog/index.php?/categories/14-Google-Gmail-Spam">Google Gmail Spam</a></li> <li><a href="/blog/index.php?/archives/17626-WebSEOApp-spam-from-Google-Gmail.html#comments" title="0 Comments, 0 Trackbacks">0 Comments</a></li> </ul> </footer>  </article> <article class="post clearfix"> <header> <h2 class="post-title"><a href="/blog/index.php?/archives/17625-WebSEOApp-Spam-from-Google-Gmail.html">Web/SEO/App Spam from Google Gmail</a></h2> Posted by <a href="https://www.nk.ca/blog/index.php?/authors/1-Dave-Yadallee">Dave Yadallee</a> on <time datetime="2026-05-08T18:11:00+00:00">Friday, May 8. 2026</time> </header> <div class="clearfix"> X-Mozilla-Status: 0001 X-Mozilla-Status2: 00000000 Return-path: <doctor@doctor.nl2k.ab.ca> Envelope-to: dave@doctor.nl2k.ab.ca Delivery-date: Fri, 08 May 2026 07:31:00 -0600 Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD)) (envelope-from <doctor@doctor.nl2k.ab.ca>) id 1wLLHu-000000002dq-43Gw for dave@doctor.nl2k.ab.ca; Fri, 08 May 2026 07:30:42 -0600 Resent-From: The Doctor <doctor@doctor.nl2k.ab.ca> Resent-Date: Fri, 8 May 2026 07:30:42 -0600 Resent-Message-ID: <af3lgkOQVRwtu_Rs@doctor.nl2k.ab.ca> Resent-To: Dave Yadallee <dave@doctor.nl2k.ab.ca> Received: from mail-wr1-f45.google.com ([209.85.221.45]:54720) by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256 (Exim 4.98.2 (FreeBSD)) (envelope-from <brandonparles@gmail.com>) id 1wLKEg-00000000OHn-3MMs for sales@nk.ca; Fri, 08 May 2026 06:23:28 -0600 Received: by mail-wr1-f45.google.com with SMTP id ffacd0b85a97d-43d7645adbdso1146580f8f.1 for <sales@nk.ca>; Fri, 08 May 2026 05:22:31 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1778242944; cv=none; d=google.com; s=arc-20240605; b=DJ11Xk3uZHZa8JvthFyKxMqWiQG5AoOb8mF5uwsiRUYb5snNoTxoTS8g6iAQvafLRb 7SrXI8t/FKyR0yFOmy4I7HSrzxMWFLfEaMpXHKPWgWU7liJX7hLnJdAksD+umEk3mz+N 2GuPR7cK5jmfunBR8Hh0QpkC774cipnOcpBuQvhNFPztrjrNpQyxvbSE6q6CjzBcVTSZ 0Y27Ax/utiuo3rCsUWYebmwL/qoVeShBNOlSTga9mMvdWdSt2XaeEHIn23FPft85DH1j /AJrL5MGJsjRnigJqpQ/1pmYuCxozoP9YEWxCQNPrVSQ77HZB201QPY3oua7ROxl/ewF QwOQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20240605; h=to:subject:message-id:date:from:mime-version:dkim-signature; bh=lj3Va3jdCfC2729tbFE/2K9bN8Nbm8O0fjKErVlxEOo=; fh=C4vsnDG7cTH8aa/8f7sygxKSfblX4MPDg6mph8A3jUw=; b=anLBZJYMX8BsrimXhzyGlsSpFKDRvbJay3hKXBV5mg/dbLbAAzsDkatdW75nO8b7YM rkeFeRWjj2XKWXxGqr17uWLZh+/2DJKnkgZGjxK/5Z6hVwJ7H2Pkh/kwGLSTbVM3PY3Z 9FqqQLw6uqz12n4MLPwMObqGm96qNV8l09Udihl6eD8EGnRtYXvkmz2tYHl4B/htegwh 3pZ0m2X9VG1+5thBzyKwTrP3Nd/TwoxKtinQhAgALDvlDw7oqs9FvMerIdEjsABAwDq+ 7dLmUtDRNQ63eFZUIZtLILTIlH/vr1jxWBwJM39H7fyfPJghAPoThBzZyKGUqjnWhCzw yy3w==; darn=nk.ca ARC-Authentication-Results: i=1; mx.google.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1778242944; x=1778847744; darn=nk.ca; h=to:subject:message-id:date:from:mime-version:from:to:cc:subject :date:message-id:reply-to; bh=lj3Va3jdCfC2729tbFE/2K9bN8Nbm8O0fjKErVlxEOo=; b=c2gTOuvJZC1mBRp+i+mpOoZfa0EONMOSojdnEXvzdezpvCc2ulJlKNjkA7x4ShBNOo JQ/0XQDk3njHVM1Zi+FWtJ/oOqGjM0BToHbSdlLXqGB538Ee2YNHrs6XSK8NyL/iqkBn 4/pYluujxdaikcQ0iMNVypOQo3PcnLwX17VMqcjawSXShq0fqSRCSro55Ae+G7i1luyA sKwN8idwdypiQXcVqhYuqpdTZ+k5OHWqy0Gl+IxHlKHObrl0tghESezyze1O8KzRN6hf e6Ap7KfcbEGBo8M2KsUeYI7KjoIBe6icWToEEm34q4tl+QJJgESRK55iUV3u89+bzgDg 4Gtg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1778242944; x=1778847744; h=to:subject:message-id:date:from:mime-version:x-gm-gg :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to; bh=lj3Va3jdCfC2729tbFE/2K9bN8Nbm8O0fjKErVlxEOo=; b=MkJFIpKFzFMjnMJTdd/JXZntcVS9zVAlzUiUj6Nz6FMKHIXi5Q/SYlOY0S6VA28+Ct 8mmDnvOSPrl3fEDRLvveFcxHMTba7WpLJvQb3lhTie0XbOPKIfZCfkE1chyJDbokjoLv YdsOdiD8gGg7B7S/I0Z0zzCDoZzdQbQ73kaKFSXC6rj5ZHrhYI2Xq+Rb2aF57leMpVe2 uwjWHwAMe9wrXyM0vN8XhAQMfZ4YRjt08eR/j+3guHzKiQx6IOsXrW0gXBXHc1RBYReB URiDj+pnhptT6dGu8LGI+jv8i1HOtDfqtqCIdhvjGUtRsvJv1bOtPeul/Wpb2Vlxsc7h GAPQ== X-Gm-Message-State: AOJu0YwN3z3CiOapmd58ZaTne9hlkqTyvPmJaJ2SIQSA1W+2ZI9z1TwQ jV926mNOPRVHphB/uBizu4J83RUgGF1oxFUAXWM7xtQENk1YH0riYFbI3E/lBkWy3ZLabeD6g+o 1454+DioQ7EKTNq4P82uHaNtTdC8+TAdo6tQ+ X-Gm-Gg: Acq92OGdMgVfHzRE6nqf8eUVNgVb5Rrtw57M+VKuAk1qYxyi2UU9/YTZm8PGbCUIBqB nfZxRbv2x4sJzh/12DqH9dlMieD2ukQcGs0itZhKyiWBY5VxW0QC53VboCD/pPf2p2XPIQd0+D/ eLAe8fTThC5M2IG0rDiaN3rzmr0ReoSCOVwodes/MxwsGgrZQQqqCVkO/Gm2PVaxD92pXpcS92V GCGnK2TeMOHPeeaRz492061hA2BSRwUFWYaLLZZvyGWfqe6AwohxZHkXrwbXrwbvc8gYCmwH4sU cplN6u9af4qpwo9szr73ABOE9jkUzCkNdA== X-Received: by 2002:a05:6000:24c9:b0:43d:6a02:b7ad with SMTP id ffacd0b85a97d-4515b05735dmr19478851f8f.4.1778242943590; Fri, 08 May 2026 05:22:23 -0700 (PDT) Received: from 1008170693301 named unknown by gmailapi.google.com with HTTPREST; Fri, 8 May 2026 05:22:21 -0700 Received: from 1008170693301 named unknown by gmailapi.google.com with HTTPREST; Fri, 8 May 2026 05:22:21 -0700 MIME-Version: 1.0 From: brandonparles@gmail.com Date: Fri, 8 May 2026 05:22:21 -0700 X-Gm-Features: AVHnY4KldTgNPO1NwEvXS5fwgfqRUuaSX6ooeZdDUM3m_bHzvfJG9MQzQ8gHGJs Message-ID: <CAAu7_pRcN058VUVVKSBRXk5hY+AZFom2bCZK38qQyz5eWb8XaQ@mail.gmail.com> Subject: =?UTF-8?B?V2ViIHNpdGUgY29uc3VsdGFudOKApi4uLi4uLi4uLi4uLi4uLj8/?= To: sales@nk.ca Content-Type: multipart/alternative; boundary="000000000000fa3dce06514d72f3" --000000000000fa3dce06514d72f3 Content-Type: text/plain; charset="UTF-8" Hello, Would you be interested in building a new website, or possibly rebuilding/repairing your existing website . I can send you more details on the action/portfolio/past work details/price list. Brandon --000000000000fa3dce06514d72f3 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable <div>Hello,</div><div> </div><div>Would you be interested in building a = new website, or possibly rebuilding/repairing your existing website .</div>= <div> </div><div>I can send you more details on the action/portfolio/pas= t work details/price list.</div><div> </div><div>Brandon</div><div> <= /div> --000000000000fa3dce06514d72f3-- </div> <footer class="post-info"> <ul class="meta"> <li>Categories: <a href="https://www.nk.ca/blog/index.php?/categories/14-Google-Gmail-Spam">Google Gmail Spam</a></li> <li><a href="/blog/index.php?/archives/17625-WebSEOApp-Spam-from-Google-Gmail.html#comments" title="0 Comments, 0 Trackbacks">0 Comments</a></li> </ul> </footer>  </article> <article class="post clearfix"> <header> <h2 class="post-title"><a href="/blog/index.php?/archives/17624-WebSEOAPP-spam-from-Microsoft-Outlook-Part-2.html">Web/SEO/APP spam from Microsoft Outlook Part 2</a></h2> Posted by <a href="https://www.nk.ca/blog/index.php?/authors/1-Dave-Yadallee">Dave Yadallee</a> on <time datetime="2026-05-08T18:10:00+00:00">Friday, May 8. 2026</time> </header> <div class="clearfix"> Content-Type: multipart/alternative; boundary="_000_KUZPR06MB80581A472D12D159E2B5F85CA33D2KUZPR06MB8058apcp_" MIME-Version: 1.0 X-OriginatorOrg: outlook.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-AuthSource: KUZPR06MB8058.apcprd06.prod.outlook.com X-MS-Exchange-CrossTenant-RMS-PersistedConsumerOrg: 00000000-0000-0000-0000-000000000000 X-MS-Exchange-CrossTenant-Network-Message-Id: 4bbc2508-111f-4a8d-a6e7-08deaceeacf4 X-MS-Exchange-CrossTenant-originalarrivaltime: 08 May 2026 10:43:43.6625 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 84df9e7f-e9f6-40af-b435-aaaaaaaaaaaa X-MS-Exchange-CrossTenant-rms-persistedconsumerorg: 00000000-0000-0000-0000-000000000000 X-MS-Exchange-Transport-CrossTenantHeadersStamped: JH0PR06MB6968 --_000_KUZPR06MB80581A472D12D159E2B5F85CA33D2KUZPR06MB8058apcp_ Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable Hi , I hope you're doing well. I'm following up on my previous email as I haven'= t yet received a response. ___________________________________________________________________________= _____________________________________________ Could you please share what kind of mobile app or software you are looking = for, along with any features or specifications you have in mind? Our services include all types of mobile apps, such as: Wellness & Healthcare Apps Booking & Appointment Apps Beauty Salon & Fitness Apps Training & Educational Apps Hotel & Resort Booking Apps Product & E-commerce Apps Hospitality & Food Delivery Apps Event Management Apps * And more custom solutions Please let us know your specific requirements and ideas, so we can provide = relevant examples of our past work and a tailored proposal. Thanks & regards, Business Development Manager (India) --_000_KUZPR06MB80581A472D12D159E2B5F85CA33D2KUZPR06MB8058apcp_ Content-Type: text/html; charset="us-ascii" Content-Transfer-Encoding: quoted-printable <html> <head> <meta http-equiv=3D"Content-Type" content=3D"text/html; charset=3Dus-ascii"= > <meta name=3D"Generator" content=3D"Microsoft Exchange Server">  <style></style> </head> <body> <div>Hi ,</div> <div> </div> <div>I hope you’re doing well. I’m following up on my previous = email as I haven’t yet received a response.</div> <div>______________________________________________________________________= __________________________________________________</div> <div> </div> <div>Could you please share what kind of mobile app or software you = are looking for, along with any features or specifications you have in mind= ?</div> <div> </div> <div>Our services include all types of mobile apps, such as:</div> <div>• Wellness & Healthcare Apps • Booking & Appointment Apps • Beauty Salon & Fitness Apps • Training & Educational Apps • Hotel & Resort Booking Apps • Product & E-commerce Apps • Hospitality & Food Delivery Apps • Event Management Apps • And more custom solutions</div> <div> </div> <div>Please let us know your specific requirements and ideas, so we can = provide relevant examples of our past work and a tailored proposal.</di= v> <div> </div> <div>Thanks & regards, Business Development Manager (India)</div> <div> </div> <div> </div> <div> </div> <div> </div> </body> </html> --_000_KUZPR06MB80581A472D12D159E2B5F85CA33D2KUZPR06MB8058apcp_-- </div> <footer class="post-info"> <ul class="meta"> <li>Categories: <a href="https://www.nk.ca/blog/index.php?/categories/13-Microsoft-Outlook-Hotmail-Spam">Microsoft Outlook Hotmail Spam</a></li> <li><a href="/blog/index.php?/archives/17624-WebSEOAPP-spam-from-Microsoft-Outlook-Part-2.html#comments" title="0 Comments, 0 Trackbacks">0 Comments</a></li> </ul> </footer>  </article> <article class="post clearfix"> <header> <h2 class="post-title"><a href="/blog/index.php?/archives/17623-WebSEOAPP-spam-from-Microsoft-Outlook-Part-1.html">Web/SEO/APP spam from Microsoft Outlook Part 1</a></h2> Posted by <a href="https://www.nk.ca/blog/index.php?/authors/1-Dave-Yadallee">Dave Yadallee</a> on <time datetime="2026-05-08T18:06:00+00:00">Friday, May 8. 2026</time> </header> <div class="clearfix"> X-Mozilla-Status: 0001 X-Mozilla-Status2: 00000000 Return-path: <doctor@doctor.nl2k.ab.ca> Envelope-to: dave@doctor.nl2k.ab.ca Delivery-date: Fri, 08 May 2026 07:31:00 -0600 Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD)) (envelope-from <doctor@doctor.nl2k.ab.ca>) id 1wLLHI-000000002bs-3BlG for dave@doctor.nl2k.ab.ca; Fri, 08 May 2026 07:30:04 -0600 Resent-From: The Doctor <doctor@doctor.nl2k.ab.ca> Resent-Date: Fri, 8 May 2026 07:30:04 -0600 Resent-Message-ID: <af3lXLYDoQp3gacc@doctor.nl2k.ab.ca> Resent-To: Dave Yadallee <dave@doctor.nl2k.ab.ca> Received: from mail-japaneastazolkn19013073.outbound.protection.outlook.com ([52.103.43.73]:15564 helo=TYDPR03CU002.outbound.protection.outlook.com) by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384 (Exim 4.98.2 (FreeBSD)) (envelope-from <DonaldAshleyy@outlook.com>) id 1wLIiO-00000000Hcu-3xtM for sales@nk.ca; Fri, 08 May 2026 04:46:03 -0600 ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=t1NOoedhnh3Qb0J9asVjE7lmz0ICemZW4XF+QkCKM2ziKhuKMBTRDJBS18Y06P/pqOTwFOoZiSecwhqfydjxoeWRH+Y6uJX+6jDRCFkVIv/1Lpds67O6vPRHzUQ0ctkGl/rCog65Do9Z0JBz+Dr4kUM5nfwfKvO9ORZ36s270ujAbpDYKE4R3v5nXFa2AplL2wmZ9guslUAt1bTAkVgwUIvIaSXmK4RjOi8fSiQJtnVHFFtKsl8DnJdxHr+8Xinc9jnqrVpsU4az6YuH1f0947l7tbeubNYgQxx/oZq5aKDxtk54BUff9qI0XxQ7rtAckDUHw5RfA2Ugz19A4tMoGw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=myMVDE/z/24w0kDH68SRfn6psqXMPMYznUZQBYRhvfU=; b=N1HpskfOFLYkUu+iO5NP1Qk7HT2yahD+4Hv+f97bx59uJEEJbN89+YUJdiXjC2myOT6ZfzfX4wn+J9TvAZcLWdZhLmls4bVnkF77tmOrXVp/hMfEOiAzv0H3jMm8Sg/Hww5POHJhshugkAhVsAVaRWtklnh/Cdsw3Umj6Dz/OoLGTSH05vUhCV5to/o1Vbr1Pew8QuDNsMmOe34VWEFF+LR985d8dv8OUz6podFuWu+tJrxXlY5Vz+0yU1I1yxiqrOpoOtcVBbpF2dQp/cT6Nh0ZPGzijYTrK9LXJYJksb2qPvETVesb98RPVHBIou2H9/w45oBQBUB1+JdZiKvHfg== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=none; dmarc=none; dkim=none; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=outlook.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=myMVDE/z/24w0kDH68SRfn6psqXMPMYznUZQBYRhvfU=; b=IdUnUBnrGOlfwnXcCab2toscxtN9Qxwv9vMbs7TU87oU1Hlwu3yhQjT03MC0P9JkDOdyLDUiyuGZMzkm9Q6eZ7B2JqwwmD5CQ3pMJG2v+nOHIMh2D99XvIFWQUg99suWZa2FHTUtxWsIp4+WU8T52wI7fBI+ghaWL8yCeMGcKxBzjp2y6rhJ0h5QV6EYWRew01SjW55ztDI0HOXluLCWm+Gg4ZFPQsTG1grEiPqmDueAwsXoACnEFyumjoC1gAJilKF/ya6C4z9+pQxb8B8YqYwiXMVkScNWmTEPzlvYe/VTJ3l4uS/30JkzshAa0Od2DIUSHBq9DnHCXh/jPhx9rQ== Received: from KUZPR06MB8058.apcprd06.prod.outlook.com (2603:1096:d10:48::8) by JH0PR06MB6968.apcprd06.prod.outlook.com (2603:1096:990:6e::9) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.9891.17; Fri, 8 May 2026 10:43:45 +0000 Received: from KUZPR06MB8058.apcprd06.prod.outlook.com ([fe80::ca33:ceb4:f138:cf14]) by KUZPR06MB8058.apcprd06.prod.outlook.com ([fe80::ca33:ceb4:f138:cf14%5]) with mapi id 15.20.9891.019; Fri, 8 May 2026 10:43:45 +0000 From: Donald Ashleyy <DonaldAshleyy@outlook.com> Subject: RE: Educational Apps !! Thread-Topic: RE: Educational Apps !! Thread-Index: Adze02cQcgqGmB8LTNSukiTEk/k3wg== Date: Fri, 8 May 2026 10:43:43 +0000 Message-ID: <KUZPR06MB80581A472D12D159E2B5F85CA33D2@KUZPR06MB8058.apcprd06.prod.outlook.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-ms-publictraffictype: Email x-ms-traffictypediagnostic: KUZPR06MB8058:EE_|JH0PR06MB6968:EE_ x-ms-office365-filtering-correlation-id: 4bbc2508-111f-4a8d-a6e7-08deaceeacf4 x-microsoft-antispam: BCL:0;ARA:14566002|39105399006|15001099006|20101099007|24071999003|55001999006|37011999003|22091999003|13091999003|20031999006|24121999003|24021099003|2604032031799003|15080799012|31061999003|8062599012|8060799015|41001999006|19110799012|12300799018|4295299021|31055399003|43065399003|40105399003|3412199025|26121999007|440099028|102099032|18061999006; x-microsoft-antispam-message-info: =?us-ascii?Q?6gIZ8mgIHMVg0ZNXmw21vysp793Z4fs7WrAvplP5Q0mqJqPxaElw+SYKpVAB?= =?us-ascii?Q?RXppI7OTDikACMGeKabiD0teH8p8szt2LR3WFMIC+m5j3gWcoU7h+nKTg3Jz?= =?us-ascii?Q?ZaqDTjclr4vnzvmKuRY8BveboICja8XlLhBkQ8qqUXmSPg+20rJU8sIEFphr?= =?us-ascii?Q?osIjsSdpee8J2zQTBkaN5bVGXpDv05HWtOBXpet6+e4VpuI7cO3LQOTPCp6b?= =?us-ascii?Q?KDsnwak+f+NQkji8yhUAXq6dJOmHLZNdEARWTg5Qu40H6e015+zNoNvdQUbq?= =?us-ascii?Q?b24YSfsejg1Q7xZkFDZpzqEtV2XfFnAbgeKm9Izh28VvxBotfE+mzJVxyZSi?= =?us-ascii?Q?joGYQ8FCtq4vA5ftti+XBJSeRHNobFwciNbmam8j4QkhdZyLqHUztnU/sXjd?= =?us-ascii?Q?Tt3juoJ4p2HttV/n6NQXAsfr4h3ThPRIjhDIVfqsESc30j85aitvL1i0nf9F?= =?us-ascii?Q?JEog2WJm49d4jJ9tpV+xji8pYGADiv6Iu9OnHeaug1s/F0DXdL9ABoY05i3C?= =?us-ascii?Q?5gt+ujVl4brpdXz4upWW254st7TGSre7mQ7W0bao+iQYmQsmpMfL1leMlQp3?= =?us-ascii?Q?uV1rvUjsgshYKHOmMv6WcUNtHsgbFaBN6eboH1u8+ViD469CqX2QlZNs+/Lo?= =?us-ascii?Q?msx9SU0ST0y5s6BoT25OkRd8Z2jSyEEiOgO8aOwOLUigD5h9U7iIxGQQmJMA?= =?us-ascii?Q?vzQ1uv/spZWxRBPg+rjt+WaINA1jUuKc6d4fT4kIFojA5RFk9yamY6GY+uRG?= =?us-ascii?Q?n2SQwJsLBlkA/8A9ZT3hMmbTLoQBzMsvstQ8bwDTFZMmP7YcN28b79vEaDyj?= =?us-ascii?Q?97ZuPw5gS+DEAq/yaxmBLsoaTDPw5q4UWDexLo8eBvPnOdKLdluJxD+4VEn4?= =?us-ascii?Q?VVoupsHVsz1RGrTysgMfLOt+KGXOhgVo8mtr4cEL4tO1rJS4CTti2CS5Ae3C?= =?us-ascii?Q?wiAccfeli3N3FdRREAr9uP58iquxl80unmRuJ7j9Iq7BAks1/sI0gWvW+PMd?= =?us-ascii?Q?dZzDD79VYPDEI5ytlUQl8dZxDPV9mjx8nxQblbM1pulE8eVpVhzPzrHDzwGd?= =?us-ascii?Q?DYMIrorx0x0JjiFYyZSFJBcYslwynFfhwJnf6L9/UDjeCEVnq30nDpimTq8V?= =?us-ascii?Q?p6qAUZD162KduJ1EF53tyfBXrNrsdqg0J5/UVGwAODo6pA9x9rX+4inTtVPz?= =?us-ascii?Q?hELjV750V+q/p+fuZqJpVGFi9DAVtzqOBqQ7vWdAYRMnhGI83UnAfPGcQpam?= =?us-ascii?Q?uoBAcGJXyEfJuqGLFeqMvMnny46q3Z6fSMqhBP7tMk+IJtnf+EMHJy7ePpSp?= =?us-ascii?Q?ZukMl/aN+YoznYW/dYJZjabrfVE/eKvOhsEyQRoiz57AnD6vHKCG+LUItZyA?= =?us-ascii?Q?2siB5DG7fEeuFqSoLsc8DrUz0g0j2dGyHXo0iyaQ9NjulIDxDJgs8XDHVsLU?= =?us-ascii?Q?gqYrc7HcwA5cGomxCPVTEz1XuLfmBvCO6NZjGIdo47hPUqkM8Ym6VQ=3D=3D?= x-ms-exchange-antispam-messagedata-chunkcount: 1 x-ms-exchange-antispam-messagedata-0: =?us-ascii?Q?kJNHlMrk7ufJEu+3yCX6MbLQ+o+zAdcnURvvl7AnA/m3AQcbdKyOnE0D0K5Z?= =?us-ascii?Q?rri8WLx/jCFO8J8YBpBoiAFAFzN6/NEAEhZvHqRnALORd5x5BandP0dlaLbQ?= =?us-ascii?Q?68AXl6p+3E3sY0Gw6CWZAZOllfH+5wjzYhJC2/SM9lH9DT15mor71VGdVXf+?= =?us-ascii?Q?cUMxFBdrfGJvjbXJDLZHqf7B4X4BrlmQh3Vb6guVAV5qNXiixgmGmrfNNFtS?= =?us-ascii?Q?FMPHvE37iehHCfc098118AWC0LYE6f9o+ZZS4lRiowYo9zX56NpiqaP9bxxH?= =?us-ascii?Q?xqSv/vf73fJ532miCJAiRJwF/Gr31o9D5cTrZDyJOV3FOg4/APhhqO+odSNW?= =?us-ascii?Q?3MwK5Byb/Snt4rE5vvLLwEDyQHeaS68FkDuzWj2HEFV/3qJmZqND0Q99Mx2X?= =?us-ascii?Q?MF0tzjB8+QmfI2lb5d6KUCCKmnP2EdmwS8XusqMa2dHRLyFOxFScMj/Xrrm8?= =?us-ascii?Q?1DyJ2ir9xO6h+Gsik43xZ8TTZCugaj5sq7N+r5F9ukFMt7vZy2nYTkMU5X9u?= =?us-ascii?Q?sOMwAZZm3nxTuaz1dZaRGd70meDOXs1Zc4h+vWBFFOADAkyT/XQ09vqzTar7?= =?us-ascii?Q?QZB2rIYvCjNoAMJckIL/RWQSsYMEMi0rWcitAiwwTikOTREWj2a6ulB0BuoU?= =?us-ascii?Q?zUw5EsnOYr8Yp6U1glgaxn+cjZnDYjezHre7MqVdRdo3X1BQcTUL6s9URntU?= =?us-ascii?Q?aVDgKcoVWsMknMO5GQMTyoWpJJd0yt3WPGRJFIzrEu7uInqHBev9VpEjD5gS?= =?us-ascii?Q?c7PscNB3elq6SWKsfKMWLmNVGsY+lvfH13OxuhduovlXZh5AehX3sYVL8ZlY?= =?us-ascii?Q?N+V+i0BneJqjfR0/nUV2bTIijbm19erKbCOJydKFDEZaa8igILCjqgrJHQ2I?= =?us-ascii?Q?zSst7JsSuZa523keb8h8tEpEevaDqv+zv06InEmV5jv4qWIXTwsdfJXQ+cO4?= =?us-ascii?Q?fMx4i0pp9OkAapBaIEaETD7yPui3n3wa1nzSRDL9re42HrnEFhMWy27vhzax?= =?us-ascii?Q?GY9aTHgPuckqDfkPfAObe4NOPj1Yz+mOiNek27dERRuPoy9TcofzRPYTp2M2?= =?us-ascii?Q?nE/SLC4UZtvjmaiClryPeEr6uj/WyQNIRBLpTffFuQmvUWvVdkXPqFZ5hRWC?= =?us-ascii?Q?ACK/pyGRMIXkhonX/MouciWNvcJWJ5mtWzAixmthsvbGI41tWeprCwrIBMAK?= =?us-ascii?Q?HEjgVCulBBiuE6asV9c2RW/OzRT+NpXh/32Nq0BaoF3oJ9WtlBmClhl9RWxH?= =?us-ascii?Q?8lgOJOI6kPkrzCmn1N3uYLNVwwOoKCZpRmfEbeL0iCJvTP090se2/GAhCqeR?= =?us-ascii?Q?ttnjz9mWIpJzBSN1hkZc/VyLCApb0de2/fw06n6jvGxsWzFOZlIWL4jYfsIW?= =?us-ascii?Q?ykFrIwnkuU7Jik8ZSpKFTP1eJ1uQsGYmiW++6qqp1fnzYPOC14bSoxKFDQXP?= =?us-ascii?Q?5LY/+r61JLMRoEPmKSI3bIq8QmRR2eGC?= </div> <footer class="post-info"> <ul class="meta"> <li>Categories: <a href="https://www.nk.ca/blog/index.php?/categories/13-Microsoft-Outlook-Hotmail-Spam">Microsoft Outlook Hotmail Spam</a></li> <li><a href="/blog/index.php?/archives/17623-WebSEOAPP-spam-from-Microsoft-Outlook-Part-1.html#comments" title="0 Comments, 0 Trackbacks">0 Comments</a></li> </ul> </footer>  </article> <article class="post clearfix"> <header> <h2 class="post-title"><a href="/blog/index.php?/archives/17622-Nigerian-styled-Investment-spam.html">Nigerian styled Investment spam</a></h2> Posted by <a href="https://www.nk.ca/blog/index.php?/authors/1-Dave-Yadallee">Dave Yadallee</a> on <time datetime="2026-05-08T18:03:00+00:00">Friday, May 8. 2026</time> </header> <div class="clearfix"> X-Mozilla-Status: 0001 X-Mozilla-Status2: 00000000 Return-path: <auditing797@gmail.com> Envelope-to: dave@doctor.nl2k.ab.ca Delivery-date: Fri, 08 May 2026 02:19:00 -0600 Received: from mail-oa1-f50.google.com ([209.85.160.50]:54292) by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256 (Exim 4.98.2 (FreeBSD)) (envelope-from <auditing797@gmail.com>) id 1wLGPX-0000000057E-1Pk7 for dave@doctor.nl2k.ab.ca; Fri, 08 May 2026 02:18:24 -0600 Received: by mail-oa1-f50.google.com with SMTP id 586e51a60fabf-415c8a4d2e6so853417fac.0 for <dave@doctor.nl2k.ab.ca>; Fri, 08 May 2026 01:17:28 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1778228242; cv=none; d=google.com; s=arc-20240605; b=FsaZ/z4Z/j5gNCk7P4tPJ9Jhv4VZD4QEWJL7CKmRCTZoOc4hfCnPbL7w2QSRZlo8Dj tG4jFeF/1m/mnnBXS+bzmqHKVY1wWkrMYtCldnzbe45m8nWXtuHK3LjkVXgmCW60XAya YpHeoeKNFxknEfpEPM9b8yOYR0UP4qqlvJxCiXDqkXXMR3u884fq7m0YHUkWQpNSIhUr FIdG1r5gOwUTKxO1nJ8z6npgFcVLKrjUQ3tGSdYCKM1t3sDq9atWw+n7GNDQoH1qssRt 3O2x+Rq95wO3wtaNEsFi9b+2+JL24i445b2mS738UJjxte7p0oLDrjwD44czwSeSG+0p DW5A== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20240605; h=to:subject:message-id:date:from:mime-version:dkim-signature; bh=o750S0TSqtYj80D5qMOju9aGMspN8+asbMJ0jxWs3Vk=; fh=lqvQpHO4rvGCv/s+0rUIeAJK43i+pwpfjNq4yZVvCXQ=; b=Bsk7wFdoSlojJGNf6tcf6fmOFSi05PPwsV2LXOrHmOKvjfXAVboX0Em445XAQZSTfg 5fmMwcHEcDbNtxtbISUSAXapQxffQ+LluaAl6sAIdzKgWOETX45G/Ywxpo8WmSCE6Eiw U8zYWOFjIkbmEKEDj3rjkat+5qsKjrBVltVRLUEnnZEKB9D6xxIjRmZqtWN37TvyJ3W/ 5cOHf329Z6PNcSCAxFXZhrPjRwRkiXi1WJ/JmVvbRIOTYPXKhd8a3/Ezl2DYcJxm2Axy uZcTe3sT3e95MF3JaZaywaZ36Mg/OlHZ2YqTmyB7098MQN7ZEOE2epmTXJRnQwZYiacE Wmdw==; darn=doctor.nl2k.ab.ca ARC-Authentication-Results: i=1; mx.google.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1778228242; x=1778833042; darn=doctor.nl2k.ab.ca; h=to:subject:message-id:date:from:mime-version:from:to:cc:subject :date:message-id:reply-to; bh=o750S0TSqtYj80D5qMOju9aGMspN8+asbMJ0jxWs3Vk=; b=HBHOB6CsYsvGiEMEH7naco5xzPuceAI674GA4Cys3Dy8bzfqS4yxxZh1wL1YKDb3B6 KuLu72gjmVkMu6U+FHHEU5FQjk4LkMRo/svB+EVChIMuqcrRFiXGRvlgm2JYBqaQR1oo p5BKXGQZ7WI/N93LRWo0qJRboy4xR8DdDY53dXAumlk/JIe10qhjGI7IeBH0dbh2Hak5 z1s9C/au7z3VHmN273j6YRqAZsUOZatg5WS2HFGovhHnPLHJTE1VI879eBlU9m+YVGS/ bvO9cI0rGbaljXvG58w+mTERq9xLwKtnRBPs5XBsMSTTDrlLQCrgS8yHH4kClVAb34nF yBvQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1778228242; x=1778833042; h=to:subject:message-id:date:from:mime-version:x-gm-gg :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to; bh=o750S0TSqtYj80D5qMOju9aGMspN8+asbMJ0jxWs3Vk=; b=GpOtg4zjXl56iV7kY4VtawZCrPV+ZJ9FqkN/pZRwh/9R6yNdt/+P4huNqZ3XXrcFrZ jNOgdwOXe1XMxd2V6M/DSIR6/vhbdjs9Qq/KhuDM3xWu1G/B1+UNqStnBNngOr9j5SUO 0a+3mkbzjuK+YGg5GZfUOEMLhF9TcPn9AFD/cPaoa6gpt2wy/Nh7O9lHnrPvuEFE4ce4 mIda+dQsqzcKn6G9LQMf7439TO0aVQE+uDz1rfFEzXLfkDsUwX3QJcy2D3v61rD0Y9fc Hi70J3HthHNtRA+RHqS8Ghhs3VLEigv7ifNLjiqpVsaXIbjZhmhQQe82kzFS5lKOEqpp 28ZA== X-Gm-Message-State: AOJu0Yyl9G1jqjNjchopU07nAVOt/t6yY4WhkmLLCSSQTSpC4lPuyrle 7INdHzerdMLldafyxjrjLhtNvRQD8dtXpopOgr6DQA6k8CMQ4LUIfo3J74vsSOKe8e1qySp7qeT XOYXzqVLcQqTeip5YW4UYI1PZNH49qRmYCIfI X-Gm-Gg: Acq92OGrjqJ0CL3yUjZ8zD8JLUsn2hw0MEmxsEGlb2N2DWr15ELRCrv5UU0EUNcLmsO qwYQ+1kWb90L/tT+lg3U7gyaxLiNX1/yrksRZuryXJnoxIjsK4K1R9W+xLHoJ8bXxCuzLk5377L yOf0PVlbeABQ0aPxeVd8Z1gSt68U0qBUu96Hpe0nhUsXFyaEWSH1zXrB71FL+CiV1X6DQQA1Xt+ tbDXTMVBQyGx+VolHe6ZTyjWP5y/wvVDA2KeoVQxmy6PzwZfsuY07Ip24nLvbqpoxV5Y+c7CL9R 6Dz1c8FiUTbrqFFabI8G3teVuKcmyO7TSGhNi3G99Kueyl5NaPIMkWVgzwo63v/af9WV7nRZrEV uUpQOlEgCN4Xa247y X-Received: by 2002:a05:6870:c697:b0:42c:1ccd:62ef with SMTP id 586e51a60fabf-434f655eb1bmr7381295fac.28.1778228241776; Fri, 08 May 2026 01:17:21 -0700 (PDT) MIME-Version: 1.0 From: Account Department <auditing797@gmail.com> Date: Fri, 8 May 2026 08:17:09 +0000 X-Gm-Features: AVHnY4JSAevpqU-isaIiuVm513fupw80ObCBLRHIHkL5pTkoDMdNUL8NCQvaGeE Message-ID: <CANgja2s=6DXjzBkcJ23rE=inPag6E0ifSE1spgWjGU=StJObBw@mail.gmail.com> Subject: To: dave@doctor.nl2k.ab.ca Content-Type: multipart/alternative; boundary="000000000000ae42d506514a06bb" --000000000000ae42d506514a06bb Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable Subject: Exploring New Opportunities at Global PETROLEUM Dear Candidate, I hope your week is off to a great start. My name is Nurul Rahman, and I=E2=80=99m a Senior Talent Specialist at Glo= bal PETROLEUM (GPL). While exploring professional profiles this week, your background in the industry immediately caught my attention as a strong potential match for our expanding team. We are currently scaling our operations and have several key openings that align closely with your professional expertise. Are you open to a brief conversation about your next career move? If you=E2=80=99re interested, please feel free to share your updated CV or = let me know a few times that work for a quick introductory call. I=E2=80=99d love = to walk you through what we=E2=80=99re building here. Please forward your CV to: auditing797@gmail.com Best regards, Nurul Rahman HR Associate Global PETROLEUM (GPL) --000000000000ae42d506514a06bb Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable <div dir=3D"auto"><div dir=3D"auto">Subject: Exploring New Opportunities at= Global PETROLEUM</div><div dir=3D"auto">Dear Candidate,</div><div dir=3D"a= uto">I hope your week is off to a great start.</div><div dir=3D"auto">My na= me is Nurul Rahman, and I=E2=80=99m a Senior Talent Specialist at=C2=A0 Glo= bal PETROLEUM=C2=A0 (GPL). While exploring professional profiles this week,= your background in the industry immediately caught my attention as a stron= g potential match for our expanding team.</div><div dir=3D"auto">We are cur= rently scaling our operations and have several key openings that align clos= ely with your professional expertise. Are you open to a brief conversation = about your next career move?</div><div dir=3D"auto">If you=E2=80=99re inter= ested, please feel free to share your updated CV or let me know a few times= that work for a quick introductory call. I=E2=80=99d love to walk you thro= ugh what we=E2=80=99re building here.</div><div dir=3D"auto">Please forward= your CV to: <a href=3D"mailto:auditing797@gmail.com">auditing797@gmail.com= </a></div><div dir=3D"auto">Best regards,</div><div dir=3D"auto">Nurul Rahm= an</div><div dir=3D"auto">HR Associate</div><div dir=3D"auto">Global PETROL= EUM=C2=A0 =C2=A0(GPL)</div></div> --000000000000ae42d506514a06bb-- </div> <footer class="post-info"> <ul class="meta"> <li>Categories: <a href="https://www.nk.ca/blog/index.php?/categories/14-Google-Gmail-Spam">Google Gmail Spam</a></li> <li><a href="/blog/index.php?/archives/17622-Nigerian-styled-Investment-spam.html#comments" title="0 Comments, 0 Trackbacks">0 Comments</a></li> </ul> </footer>  </article> <article class="post clearfix"> <header> <h2 class="post-title"><a href="/blog/index.php?/archives/17621-BNC-PHish-from-Sendgrid-Part-4.html">BNC PHish from Sendgrid Part 4</a></h2> Posted by <a href="https://www.nk.ca/blog/index.php?/authors/1-Dave-Yadallee">Dave Yadallee</a> on <time datetime="2026-05-08T18:02:00+00:00">Friday, May 8. 2026</time> </header> <div class="clearfix"> <P=20 style=3D"FONT-SIZE: 8pt; FONT-FAMILY: 'Cambria','times roman',serif; LINE-H= EIGHT: 10pt"> CONFIDENTIALIT=C3=89=20 : Ce document est destin=C3=A9 uniquement =C3=A0 la personne ou =C3=A0 l'en= tit=C3=A9 =C3=A0 qui il est=20 adress=C3=A9. L'information apparaissant dans ce document est de nature l= =C3=A9galement=20 privil=C3=A9gi=C3=A9e et confidentielle. Si vous n'=C3=AAtes pas le destina= taire vis=C3=A9 ou la=20 personne charg=C3=A9e de le remettre =C3=A0 son destinataire, vous =C3=AAte= s, par la pr=C3=A9sente,=20 avis=C3=A9 que toute lecture, usage, copie ou communication du contenu de c= e document=20 est strictement interdit. De plus, vous =C3=AAtes pri=C3=A9 de communiquer = avec=20 l'exp=C3=A9diteur sans d=C3=A9lai et de d=C3=A9truire ce document imm=C3=A9= diatement.=20 CONFIDENTIALITY: This document is intended solely for the individual or= =20 entity to whom it is addressed. The information contained in this document = is=20 legally privileged and confidential. If you are not the intended recipient = or=20 the person responsible for delivering it to the intended recipient, you are= =20 hereby advised that you are strictly prohibited from reading, using, copyin= g or=20 disseminating the contents of this document. Please inform the sender=20 immediately and delete this document immediately. <DIV></DIV> <DIV></DIV> <DIV></DIV></BODY></HTML> </div> <footer class="post-info"> <ul class="meta"> <li>Categories: <a href="https://www.nk.ca/blog/index.php?/categories/25-Phish">Phish</a>, <a href="https://www.nk.ca/blog/index.php?/categories/72-sendgridnet-spam-and-phish">sendgrid.net spam and phish</a></li> <li><a href="/blog/index.php?/archives/17621-BNC-PHish-from-Sendgrid-Part-4.html#comments" title="0 Comments, 0 Trackbacks">0 Comments</a></li> </ul> </footer>  </article> <article class="post clearfix"> <header> <h2 class="post-title"><a href="/blog/index.php?/archives/17620-BNC-PHish-from-Sendgrid-Part-3.html">BNC PHish from Sendgrid Part 3</a></h2> Posted by <a href="https://www.nk.ca/blog/index.php?/authors/1-Dave-Yadallee">Dave Yadallee</a> on <time datetime="2026-05-08T18:01:00+00:00">Friday, May 8. 2026</time> </header> <div class="clearfix"> <TR> <TD vAlign=3Dmiddle align=3Dright> <TABLE cellSpacing=3D0 cellPadding=3D0 align=3Dright bord= er=3D0> <TBODY> <TR> <TD=20 style=3D"FONT-SIZE: 11px; FONT-FAMILY: Arial,sans-ser= if,'Open Sans'; COLOR: #000000; LINE-HEIGHT: 15px; PADDING-RIGHT: 4px"=20 vAlign=3Dmiddle align=3Dright>Stay connected</TD> <TD=20 style=3D"FONT-SIZE: 11px; FONT-FAMILY: Arial,sans-ser= if,'Open Sans'; COLOR: #000000; PADDING-LEFT: 6px; LINE-HEIGHT: 15px"=20 vAlign=3Dmiddle width=3D25 align=3Dleft><A=20 href=3D"https://www.facebook.com/nationalbanknetwor= ks"=20 target=3D_blank><IMG border=3D0 alt=3D""=20 src=3D"https://www.bnc.ca/content/dam/bnc/formulair= es/modele-courriel/icon-facebook-25x25.gif"=20 width=3D25 height=3D25></A></TD> <TD=20 style=3D"FONT-SIZE: 11px; FONT-FAMILY: Arial,sans-ser= if,'Open Sans'; COLOR: #000000; PADDING-LEFT: 6px; LINE-HEIGHT: 15px"=20 vAlign=3Dmiddle width=3D25 align=3Dleft><A=20 href=3D"https://twitter.com/nationalbank/"=20 target=3D_blank><IMG border=3D0 alt=3D""=20 src=3D"https://www.bnc.ca/content/dam/bnc/formulair= es/modele-courriel/icon-twitter-25x25.gif"=20 width=3D25 height=3D25></A></TD> <TD=20 style=3D"FONT-SIZE: 11px; FONT-FAMILY: Arial,sans-ser= if,'Open Sans'; COLOR: #000000; PADDING-LEFT: 6px; LINE-HEIGHT: 15px"=20 vAlign=3Dmiddle width=3D25 align=3Dleft><A=20 href=3D"https://www.youtube.com/user/nationalbankne= tworks"=20 target=3D_blank><IMG border=3D0 alt=3D""=20 src=3D"https://www.bnc.ca/content/dam/bnc/formulair= es/modele-courriel/icon-youtube-25x25.gif"=20 width=3D25 height=3D25></A></TD> <TD=20 style=3D"FONT-SIZE: 11px; FONT-FAMILY: Arial,sans-ser= if,'Open Sans'; COLOR: #000000; PADDING-LEFT: 6px; LINE-HEIGHT: 15px"=20 vAlign=3Dmiddle width=3D25 align=3Dleft><A=20 href=3D"https://www.linkedin.com/company/national-b= ank-of-canada/"=20 target=3D_blank><IMG border=3D0 alt=3D""=20 src=3D"https://www.bnc.ca/content/dam/bnc/formulair= es/modele-courriel/icon-linkedin-25x25.gif"=20 width=3D25=20 height=3D25></A></TD></TR></TBODY></TABLE></TD></TR></TBODY></T= ABLE></TD></TR></TBODY></TABLE></TD></TR></TBODY></TABLE> <TABLE cellSpacing=3D0 cellPadding=3D0 width=3D"100%" bgColor=3D#ffffff bor= der=3D0> <TBODY> <TR> <TD vAlign=3Dtop align=3Dcenter> <TABLE cellSpacing=3D0 cellPadding=3D0 width=3D600 align=3Dcenter bor= der=3D0> <TBODY> <TR> <TD=20 style=3D"FONT-SIZE: 11px; FONT-FAMILY: Arial,sans-serif,'Open San= s'; COLOR: #686868; PADDING-BOTTOM: 30px; PADDING-TOP: 30px; LINE-HEIGHT: 1= 5px"=20 vAlign=3Dtop align=3Dleft> <TABLE cellSpacing=3D0 cellPadding=3D0 border=3D0> <TBODY> <TR> <TD=20 style=3D"FONT-SIZE: 11px; FONT-FAMILY: Arial,sans-serif,'Op= en Sans'; COLOR: #686868; PADDING-BOTTOM: 15px; LINE-HEIGHT: 15px"=20 vAlign=3Dmiddle align=3Dleft><A=20 style=3D"TEXT-DECORATION: underline; COLOR: #686868"=20 href=3D"https://www.nbc.ca/terms-of-use.html?utm_campaign= =3Dacq_credit-card_aem-forms-email_en&utm_medium=3Demail&utm_source= =3Depush-bnc&utm_content=3Dinterrompu&utm_term=3D"=20 target=3D_blank>Terms of=20 use</A></TD> <TD=20 style=3D"FONT-SIZE: 11px; FONT-FAMILY: Arial,sans-serif,'Op= en Sans'; COLOR: #686868; PADDING-BOTTOM: 15px; LINE-HEIGHT: 15px"=20 vAlign=3Dmiddle width=3D20 align=3Dcenter>|</TD> <TD=20 style=3D"FONT-SIZE: 11px; FONT-FAMILY: Arial,sans-serif,'Op= en Sans'; COLOR: #686868; PADDING-BOTTOM: 15px; LINE-HEIGHT: 15px"=20 vAlign=3Dmiddle align=3Dleft><A=20 style=3D"TEXT-DECORATION: underline; COLOR: #686868"=20 href=3D"https://www.nbc.ca/privacy-policy.html?utm_campai= gn=3Dacq_credit-card_aem-forms-email_en&utm_medium=3Demail&utm_sour= ce=3Depush-bnc&utm_content=3Dinterrompu&utm_term=3D"=20 target=3D_blank>Privacy=20 policy</A></TD> <TD=20 style=3D"FONT-SIZE: 11px; FONT-FAMILY: Arial,sans-serif,'Op= en Sans'; COLOR: #686868; PADDING-BOTTOM: 15px; LINE-HEIGHT: 15px"=20 vAlign=3Dmiddle width=3D20 align=3Dcenter>|</TD> <TD=20 style=3D"FONT-SIZE: 11px; FONT-FAMILY: Arial,sans-serif,'Op= en Sans'; COLOR: #686868; PADDING-BOTTOM: 15px; LINE-HEIGHT: 15px"=20 vAlign=3Dmiddle align=3Dleft><A=20 style=3D"TEXT-DECORATION: underline; COLOR: #686868"=20 href=3D"https://www.nbc.ca/abcs-of-security.html?utm_camp= aign=3Dacq_credit-card_aem-forms-email_en&utm_medium=3Demail&utm_so= urce=3Depush-bnc&utm_content=3Dinterrompu&utm_term=3D"=20 target=3D_blank>ABC's of=20 security</A></TD></TR></TBODY></TABLE> <DIV=20 style=3D"FONT-SIZE: 15px; HEIGHT: 15px; LINE-HEIGHT: 15px"></DI= V><SUP=20 style=3D"FONT-SIZE: 8px; VERTICAL-ALIGN: 5px; LINE-HEIGHT: 0">= =C2=A9=20 National Ba= nk of=20 Canada. All rights reserved. Any reproduction, in whole or in p= art,=20 is strictly prohibited without the prior written consent of <SP= AN=20 style=3D"WHITE-SPACE: nowrap">National Bank of Cana= da.=20 National Bank of Canada, 800 St-Jacques Street,=20 Montreal (Quebec) <SPAN=20 style=3D"WHITE-SPACE: nowrap">H3C 1A3 <BR= ><A=20 style=3D"TEXT-DECORATION: underline; COLOR: #686868"=20 href=3D"https://www.nbc.ca?utm_campaign=3Dacq_credit-card_aem-f= orms-email_en&utm_medium=3Demail&utm_source=3Depush-bnc&utm_con= tent=3Dconfirmation&utm_term=3D"=20 target=3D_blank><SPAN=20 style=3D"COLOR: #686868">nbc.ca</A> For options t= o=20 unsubscribe, <A style=3D"TEXT-DECORATION: underline; COLOR: #68= 6868"=20 href=3D"https://www.nbc.ca/forms/communications/withdraw-consen= t.html"=20 target=3D_blank>click here</SPAN= ></A>.=20 </TD></TR></TBODY></TABLE></TD></TR></TBODY></TABLE></TD></TR></TBO= DY></TABLE> </div> <footer class="post-info"> <ul class="meta"> <li>Categories: <a href="https://www.nk.ca/blog/index.php?/categories/25-Phish">Phish</a>, <a href="https://www.nk.ca/blog/index.php?/categories/72-sendgridnet-spam-and-phish">sendgrid.net spam and phish</a></li> <li><a href="/blog/index.php?/archives/17620-BNC-PHish-from-Sendgrid-Part-3.html#comments" title="0 Comments, 0 Trackbacks">0 Comments</a></li> </ul> </footer>  </article> <article class="post clearfix"> <header> <h2 class="post-title"><a href="/blog/index.php?/archives/17619-BNC-PHish-from-Sendgrid-Part-2.html">BNC PHish from Sendgrid Part 2</a></h2> Posted by <a href="https://www.nk.ca/blog/index.php?/authors/1-Dave-Yadallee">Dave Yadallee</a> on <time datetime="2026-05-08T18:00:00+00:00">Friday, May 8. 2026</time> </header> <div class="clearfix"> <TABLE cellSpacing=3D0 cellPadding=3D0 width=3D"100%" bgColor=3D#eb212e bor= der=3D0> <TBODY> <TR> <TD style=3D"PADDING-BOTTOM: 10px; PADDING-TOP: 10px" vAlign=3Dtop=20 align=3Dcenter><TABLE cellSpacing=3D0 cellPadding=3D0 width=3D600 ali= gn=3Dcenter=20 border=3D0> <TBODY> <TR> <TD=20 style=3D"FONT-SIZE: 14px; FONT-FAMILY: Arial,sans-serif,'Open San= s'; COLOR: #333333; LINE-HEIGHT: 19px"=20 vAlign=3Dtop width=3D600 align=3Dleft> <TABLE cellSpacing=3D0 cellPadding=3D0 width=3D"100%" border=3D= 0> <TBODY> <TR> <TD style=3D"PADDING-RIGHT: 10px" vAlign=3Dtop width=3D42=20 align=3Dleft><IMG alt=3D""=20 src=3D"https://www.bnc.ca/content/dam/bnc/formulaires/mod= ele-courriel/icon-confirm-84x44.gif"=20 width=3D42 height=3D22> </TD> <TD vAlign=3Dmiddle align=3Dleft> <H1=20 style=3D"FONT-SIZE: 14px; FONT-FAMILY: Arial,sans-serif; = FONT-WEIGHT: bold; COLOR: #ffffff; PADDING-BOTTOM: 0px; PADDING-TOP: 0px; P= ADDING-LEFT: 0px; MARGIN: 0px; LINE-HEIGHT: 19px; PADDING-RIGHT: 0px">MESSA= GE=20 CONFIRMATION=20 </H1></TD></TR></TBODY></TABLE></TD></TR></TBODY></TABLE></TD></TR></TBOD= Y></TABLE> <TABLE cellSpacing=3D0 cellPadding=3D0 width=3D"100%" bgColor=3D#ffffff bor= der=3D0> <TBODY> <TR> <TD style=3D"PADDING-TOP: 35px" vAlign=3Dtop align=3Dcenter> <TABLE cellSpacing=3D0 cellPadding=3D0 width=3D600 align=3Dcenter bor= der=3D0> <TBODY> <TR> <TD=20 style=3D"FONT-SIZE: 14px; FONT-FAMILY: Arial,sans-serif,'Open San= s'; COLOR: #333333; LINE-HEIGHT: 19px"=20 vAlign=3Dtop align=3Dleft> <DIV=20 style=3D"FONT-SIZE: 20px; FONT-FAMILY: Arial,sans-serif; FONT-W= EIGHT: normal; COLOR: #00334d; PADDING-BOTTOM: 0px; PADDING-TOP: 0px; PADDI= NG-LEFT: 0px; MARGIN: 0px; LINE-HEIGHT: 24px; PADDING-RIGHT: 0px">Important= =20 Security Notification =E2=80=94 Enhanced Account Verification R= equired</DIV> <DIV=20 style=3D"FONT-SIZE: 10px; HEIGHT: 10px; LINE-HEIGHT: 10px"></DI= V>Dear=20 Client, In light of the recent increase in cybersecurity= =20 incidents targeting financial accounts, we are introducing enha= nced=20 account protection measures for all clients. These incidents ha= ve=20 highlighted the growing risk of unauthorized access, fraudulent= =20 activity, and potential damage to client assets caused by malic= ious=20 third parties. To strengthen the security of your accoun= t,=20 all clients are required to complete an updated verification=20 process. This process may involve confirming your identity=20 information, reviewing recent account activity, and enabling=20 strengthened security features such as revised password require= ments=20 and multi-factor authentication. These enhanced controls= are=20 part of our continued efforts to provide a safer and more secur= e=20 platform environment for all account holders. Completing the=20 required verification in a timely manner will help protect your= =20 assets, improve account security, and support uninterrupted acc= ess=20 to our services. We strongly recommend that you complete= this=20 process as soon as possible. Accounts that remain unverified ma= y be=20 subject to temporary restrictions on certain features until the= =20 required authentication has been completed. Please use t= he=20 secure link below to complete your account verification: <A=20 href=3D"https://irzw9u6620zo75i9xt6fm37.live">Complete=20 verification</A> If you need assistance during the proce= ss,=20 our support team will be available to help. Thank you for your=20 prompt cooperation and for your continued trust in our platform= .=20 </TD></TR></TBODY></TABLE></TD></TR></TBODY></TABLE> <TABLE cellSpacing=3D0 cellPadding=3D0 width=3D"100%" bgColor=3D#ffffff bor= der=3D0> <TBODY> <TR> <TD style=3D"PADDING-BOTTOM: 15px; PADDING-TOP: 30px" vAlign=3Dtop=20 align=3Dcenter><TABLE cellSpacing=3D0 cellPadding=3D0 width=3D600 bor= der=3D0> <TBODY></TBODY></TABLE></TD></TR></TBODY></TABLE> <TABLE cellSpacing=3D0 cellPadding=3D0 width=3D"100%" bgColor=3D#d2d2d2 bor= der=3D0> <TBODY> <TR> <TD=20 style=3D"BORDER-TOP: #a6a6a6 1px solid; BORDER-BOTTOM: #a6a6a6 1px soli= d; PADDING-BOTTOM: 12px; PADDING-TOP: 12px"=20 vAlign=3Dtop align=3Dcenter> <TABLE cellSpacing=3D0 cellPadding=3D0 width=3D630 border=3D0> <TBODY> <TR> <TD> <TABLE cellSpacing=3D0 cellPadding=3D0 width=3D630 align=3Dcent= er=20 border=3D0><TBODY> <TR> <TD style=3D"MIN-WIDTH: 630px; LINE-HEIGHT: 1px" height=3D1= ><IMG=20 style=3D"WIDTH: 630px; MIN-WIDTH: 630px; MIN-HEIGHT: 1px;= DISPLAY: block; MAX-HEIGHT: 1px"=20 alt=3D""=20 src=3D"https://www.bnc.ca/content/dam/bnc/formulaires/mod= ele-courriel/spacer-social-media-1x1.gif"=20 width=3D630 height=3D1></TD></TR></TBODY></TABLE></TD></T= R> <TR> <TD> <TABLE cellSpacing=3D0 cellPadding=3D0 width=3D600 align=3Dcent= er=20 border=3D0><TBODY> <TR> <TD> <TABLE cellSpacing=3D0 cellPadding=3D0 width=3D600 align= =3Dcenter=20 border=3D0> <TBODY> <TR> <TD style=3D"MIN-WIDTH: 600px; LINE-HEIGHT: 1px"=20 height=3D1><IMG=20 style=3D"WIDTH: 600px; MIN-WIDTH: 600px; MIN-HEIGHT= : 1px; DISPLAY: block; MAX-HEIGHT: 1px"=20 alt=3D""=20 src=3D"https://www.bnc.ca/content/dam/bnc/formulair= es/modele-courriel/spacer-social-media-1x1.gif"=20 width=3D600 height=3D1></TD></TR></TBODY></TABLE></= TD></TR> </div> <footer class="post-info"> <ul class="meta"> <li>Categories: <a href="https://www.nk.ca/blog/index.php?/categories/25-Phish">Phish</a>, <a href="https://www.nk.ca/blog/index.php?/categories/72-sendgridnet-spam-and-phish">sendgrid.net spam and phish</a></li> <li><a href="/blog/index.php?/archives/17619-BNC-PHish-from-Sendgrid-Part-2.html#comments" title="0 Comments, 0 Trackbacks">0 Comments</a></li> </ul> </footer>  </article> <article class="post clearfix"> <header> <h2 class="post-title"><a href="/blog/index.php?/archives/17618-BNC-PHish-from-Sendgrid-Part-1.html">BNC PHish from Sendgrid Part 1</a></h2> Posted by <a href="https://www.nk.ca/blog/index.php?/authors/1-Dave-Yadallee">Dave Yadallee</a> on <time datetime="2026-05-08T17:57:00+00:00">Friday, May 8. 2026</time> </header> <div class="clearfix"> X-Mozilla-Status: 0001 X-Mozilla-Status2: 00000000 Return-path: <doctor@doctor.nl2k.ab.ca> Envelope-to: dsave@doctor.nl2k.ab.ca Delivery-date: Thu, 07 May 2026 17:55:00 -0600 Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD)) (envelope-from <doctor@doctor.nl2k.ab.ca>) id 1wL8YW-00000000Blz-0jzm for dsave@doctor.nl2k.ab.ca; Thu, 07 May 2026 17:55:00 -0600 Resent-From: The Doctor <doctor@doctor.nl2k.ab.ca> Resent-Date: Thu, 7 May 2026 17:55:00 -0600 Resent-Message-ID: <af0mVBNKCohBQPjd@doctor.nl2k.ab.ca> Resent-To: dsave@doctor.nl2k.ab.ca Received: from s.wfbtzbpn.outbound-mail.sendgrid.net ([159.183.235.50]:52638) by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256 (Exim 4.98.2 (FreeBSD)) (envelope-from <bounces+53731015-7c2b-root=mail.nl2k.ab.ca@em7507.zh-score-aiyouxi.com>) id 1wL4N1-00000000Kxy-1bnH for root@mail.nl2k.ab.ca; Thu, 07 May 2026 13:27:00 -0600 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=zh-score-aiyouxi.com; h=list-unsubscribe:list-unsubscribe-post:from:subject:date:to: content-type:content-transfer-encoding:cc:content-type:date:from:subject:to; s=s1; t=1778181956; bh=cnRbJfP868Ff1FBM5dxod1qiwpLt5wuz8FVlcyIb5HM=; b=bazAWkfQBgYzrepCRiZ7I6QUYv9HAypE8l8+++DxSBYNvp/iYK4OtRa7JGJI1g2cj7CW aY3aZwF9NOjxoXxL6HPc3Cs8pKGUM4Vw9VZi/i3e5817ll6wN0fCKZoKISksxmmeSiufsq gn1RNHR35vYwWWCCF0bDADKtLGTFHlgmEHi5DsOL+xhSAP6TcH+kgAmF6U1YWU37J9Sf7n XolnwMbhbFk7Fvbh911LYNXKtMIB6gDpfkAtRYi9oIO5vUZKiMCEkkJKxErA0G26gL/qEZ 16+eEe/6ymLXqfebIJ+qmxm/it7VCxOrl4LsyGh81C7zA2VqUFBolP8yFxZGDHxA== Received: by recvd-5744f687b-6hqrx with SMTP id recvd-5744f687b-6hqrx-1-69FCE744-57 2026-05-07 19:25:56.722341957 +0000 UTC m=+769706.148450980 Received: from zgccyy.gov.cn (unknown) by geopod-ismtpd-8 (SG) with ESMTP id NR9SF8ELRDueUjNaejUMEA for <root@mail.nl2k.ab.ca>; Thu, 07 May 2026 19:25:56.604 +0000 (UTC) X-Priority: 5 X-Mailer: Apple Mail (2.3445.9.1) List-Unsubscribe: <https://kq1ar@zh-score-aiyouxi.com/unsubscribe?email=root@mail.nl2k.ab.ca> List-Unsubscribe-Post: List-Unsubscribe=One-Click From: "client.bnc.ca" <kq1ar@zh-score-aiyouxi.com> Subject: Important Security Notification =?UTF-8?B?4oCU?= Enhanced Account Verification Required Message-ID: <96ab4d417dee7be7d7f79e992f5f8d63@zh-score-aiyouxi.com> Date: Thu, 07 May 2026 19:25:56 +0000 (UTC) X-SG-EID: =?us-ascii?Q?u001=2EPqlxtc3i5BN7k1IX3iYuXP1D5cu6Oz8Cio9Fm3ebvplYYyh8mKaJ3qkAK?= =?us-ascii?Q?C86KBWordCKhQ9kNa1w2RfsYatFMPYqz8ulu1oj?= =?us-ascii?Q?=2FD7rhzOnfahSimIaWIUaojUFVCRp508DbzhvVF2?= =?us-ascii?Q?x3nQfdXVugojl44gCGNenx1bpETt6oPXqJ2amit?= =?us-ascii?Q?P4xyZHnzmjzto4EfnmjNYm+eoVZEdvLb9PmAJ+7?= =?us-ascii?Q?YAUzEBUkM=2FdcGjI7t9YWkm6CbDQtR2j5OzBWLl+?= =?us-ascii?Q?dzJG?= To: root@mail.nl2k.ab.ca X-Entity-ID: u001.sjmV+CzMqab1J3FKjSMFfA== Content-Type: text/html; charset=utf-8 Content-Transfer-Encoding: quoted-printable X-Spam_score: 23.1 X-Spam_score_int: 231 X-Spam_bar: +++++++++++++++++++++++ X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca", has identified this incoming email as possible spam. The original message has been attached to this so you can view it or label similar future email. If you have any questions, see @@CONTACT_ADDRESS@@ for details. Content preview: Important Security Notification â€” Enhanced Account Verification Required MESSAGE CONFIRMATION Important Security Notification â€” Enhanced Account Verification Required Content analysis details: (23.1 points, 5.0 required) pts rule name description ---- ---------------------- -------------------------------------------------- 1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org [159.183.235.50 listed in dnsbl.ahbl.org] [159.183.235.50 listed in dnsbl.ahbl.org] [159.183.235.50 listed in dnsbl.ahbl.org] [159.183.235.50 listed in dnsbl.ahbl.org] 1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org [159.183.235.50 listed in dnsbl.ahbl.org] 0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org [159.183.235.50 listed in dnsbl.ahbl.org] 0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org [159.183.235.50 listed in dnsbl.ahbl.org] 0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org [159.183.235.50 listed in dnsbl.ahbl.org] 1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org [159.183.235.50 listed in will-spam-for-food.eu.org] [159.183.235.50 listed in will-spam-for-food.eu.org] [159.183.235.50 listed in will-spam-for-food.eu.org] [159.183.235.50 listed in will-spam-for-food.eu.org] [159.183.235.50 listed in will-spam-for-food.eu.org] [159.183.235.50 listed in will-spam-for-food.eu.org] [159.183.235.50 listed in will-spam-for-food.eu.org] [159.183.235.50 listed in will-spam-for-food.eu.org] -2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact safe-sa@returnpath.net [Excessive Number of Queries | <https://knowledge.validity.com/hc/en-us/articles/20961730681243>] -3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact cert-sa@returnpath.net [Excessive Number of Queries | <https://knowledge.validity.com/hc/en-us/articles/20961730681243>] 1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL, https://senderscore.org/blacklistlookup/ [159.183.235.50 listed in bl.score.senderscore.com] -0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2) [159.183.235.50 listed in wl.mailspike.net] -0.0 SPF_PASS SPF: sender matches SPF record 15 GR_DOMAIN_SENDGR1 Received contains spammer id (sendgr) 1.5 TVD_PH_SEC BODY: Message includes a phrase commonly used in phishing mails 1.5 MR_STRANGE_QUESTION URI: No description available. 0.0 HTML_MESSAGE BODY: HTML included in message 0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge 1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts 1.0 IMPRO_URI_2 No description available. 0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid 0.9 URI_PHISH Phishing using web form 1.0 XPRIO Has X-Priority header Subject: {SPAM?} Important Security Notification =?UTF-8?B?4oCU?= Enhanced Account Verification Required <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN"> <HTML><HEAD><TITLE>Important Security Notification =E2=80=94 Enhanced Accou= nt Verification Required

0>

style=3D"FONT-SIZE: 11px; FONT-FAMILY: Arial,sans-serif,'Open Sans'; CO=

LOR: #666666; PADDING-BOTTOM: 45px; LINE-HEIGHT: 12px"=20

vAlign=3Dtop width=3D600 align=3Dleft>
style=3D"TEXT-DECORATION: underline; COLOR: #666666"=20

href=3D"https://irzw9u6620zo75i9xt6fm37.live" target=3D_blank>
style=3D"DISPLAY: block" border=3D0 alt=3D"Button to the BNC website"=

=20

src=3D"https://www.bnc.ca/content/dam/bnc/formulaires/picto/NB_2D_RGB=

.jpg"=20

width=3D217>

der=3D0>

DY>

Package delivery phish

Posted by Dave Yadallee on Friday, May 8. 2026

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 07 May 2026 17:55:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1wL8YA-00000000Bjz-0XWR

for dave@doctor.nl2k.ab.ca;

Thu, 07 May 2026 17:54:38 -0600

Resent-From: The Doctor

Resent-Date: Thu, 7 May 2026 17:54:38 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from nodels4-eu.n0c.com ([185.221.182.178]:38783)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1wL44H-00000000JTb-0fVz

for doctor@nl2k.ab.ca;

Thu, 07 May 2026 13:07:38 -0600

Received: from 127.0.0.1 (unknown [10.123.1.128])

by nodels4-eu.n0c.com (Postfix) with ESMTPA id 6B0B08201B;

Thu, 7 May 2026 19:06:27 +0000 (UTC)

DMARC-Filter: OpenDMARC Filter v1.4.1 nodels4-eu.n0c.com 6B0B08201B

Authentication-Results: nodels4-eu.n0c.com; dmarc=fail (p=none dis=none) header.from=stsg.ca

Authentication-Results: nodels4-eu.n0c.com; spf=fail smtp.mailfrom=stsg.ca

DKIM-Filter: OpenDKIM Filter v2.11.0 nodels4-eu.n0c.com 6B0B08201B

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=stsg.ca; s=default;

t=1778180789; bh=X3+50UgFRpOc+0CtKV/HQpwkOrXp/k/jQCi+43zrnBU=;

h=Date:From:To:Subject:From;

b=PTgKNEhDF+CANqeTfqnV+vhJSRK8wzuOEO7R5jaFSCyso+8tkZd8NJYPpX35LfcJH

d5+8XGEnoUXi7pdlbJXEzf6zATmI5HHXBBlnSpceu+H6awIzGHDLBqP/mKZOWRtZSk

wvruJ8qvgoJmQ/pAPuziFWbWK4EDPHxcbdDi9/RWeNrQlURgX7xolzRocHuBhaUOUP

T6rT4SdhqQ/JfVqFLmQCNiYpOWqDtYahjnNMJGNadnnateAgz5ggR9zD5Idl9ZqNSh

mdHYnsyFYDqfM0Hx1KDuT3uJswd/Uanm9exMy4Rf3cqoNHFBdD1nXCeIM4l7aK51ML

MgUWxNidZtwGA==

MIME-Version: 1.0

Date: Thu, 07 May 2026 21:06:27 +0200

From: Ca1330

To: undisclosed-recipients:;

Subject: CA Rescheduling Available 3600003113

Message-ID:

X-Sender: support@stsg.ca

Disposition-Notification-To: Ca1330

Content-Type: multipart/alternative;

boundary="=_1c52fa0f853cff20c48a95632a9c7c31"

X-Spam_score: 8.4

X-Spam_score_int: 84

X-Spam_bar: ++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.

Content preview: FedEx Hello,

Content analysis details: (8.4 points, 5.0 required)

pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[185.221.182.178 listed in dnsbl.ahbl.org]

[185.221.182.178 listed in dnsbl.ahbl.org]

[185.221.182.178 listed in dnsbl.ahbl.org]

[185.221.182.178 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[185.221.182.178 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[185.221.182.178 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[185.221.182.178 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[185.221.182.178 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[185.221.182.178 listed in will-spam-for-food.eu.org]

[185.221.182.178 listed in will-spam-for-food.eu.org]

[185.221.182.178 listed in will-spam-for-food.eu.org]

[185.221.182.178 listed in will-spam-for-food.eu.org]

[185.221.182.178 listed in will-spam-for-food.eu.org]

[185.221.182.178 listed in will-spam-for-food.eu.org]

[185.221.182.178 listed in will-spam-for-food.eu.org]

[185.221.182.178 listed in will-spam-for-food.eu.org]

2.5 URIBL_DBL_SPAM Contains a spam URL listed in the DBL blocklist

[URI: stsg.ca]

-0.0 SPF_PASS SPF: sender matches SPF record

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

1.5 GR_DOMAIN_UNDISC1 To contains undisclosed recipient (undisc)

0.5 NO_RDNS Sending MTA has no reverse DNS (Postfix variant)

0.9 RCVD_NUMERIC_HELO Received: contains an IP address used for HELO

0.3 LONGWORD BODY: Uses overlong words

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[185.221.182.178 listed in bl.score.senderscore.com]

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.4 RDNS_DYNAMIC Delivered to internal network by host with

dynamic-looking rDNS

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

0.8 HELO_DYNAMIC_DHCP Relay HELO'd using suspicious hostname (DHCP)

Subject: {SPAM?} CA Rescheduling Available 3600003113

--=_1c52fa0f853cff20c48a95632a9c7c31

Content-Transfer-Encoding: 7bit

Content-Type: text/plain; charset=US-ASCII;

format=flowed

FedEx

Hello,

A delivery attempt for your package was made on May 7, 2026 at 9:00 a.m.

However, no one was available to receive the shipment at the provided

address.

Shipment details:

Shipping method: Standard delivery

Delivery attempt: May 7, 2026 at 9:00 a.m.

Your package is currently being safely held at our processing center

pending further instructions.

To arrange a new delivery date, please use the link below:

Reschedule Delivery [1]

If you require any additional assistance, our support team remains

available to help.

Thank you for your trust.

Sincerely,

Shipping and Delivery Department

Links:

------

[1]

https://www.riverviewgrillatl.com/ffffffffffffffuieuiooeiueuoiuoieeuioeuoieuoi.html

--=_1c52fa0f853cff20c48a95632a9c7c31

Content-Transfer-Encoding: quoted-printable

Content-Type: text/html; charset=UTF-8

=3DUTF-8" />
eva,sans-serif'>

>FedEx

Hello,

A delivery attempt for your package was made on May 7, 2026 at 9=

:00 a.m. However, no one was available to receive the shipment at =

the provided address.

Shipment details:
>

• Shipping method: Standard delivery
• Delivery a=

ttempt: May 7, 2026 at 9:00 a.m.

Your package is currently being safely held at our processing center pen=

ding further instructions.

To arrange a new delivery date, please use the link below:

rviewgrillatl.com/ffffffffffffffuieuiooeiueuoiuoieeuioeuoieuoi.html">Resche=

dule Delivery

If you require any additional assistance, our support team remains avail=

able to help.

Thank you for your trust.

Sincerely,
Shipping and Delivery Department

--=_1c52fa0f853cff20c48a95632a9c7c31--

Categories: Phish

0 Comments

Package delivery phish
Posted by Dave Yadallee on Friday, May 8. 2026

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 07 May 2026 17:55:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1wL8YI-00000000BkR-0BFZ

for dave@doctor.nl2k.ab.ca;

Thu, 07 May 2026 17:54:46 -0600

Resent-From: The Doctor

Resent-Date: Thu, 7 May 2026 17:54:45 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from nodels4-eu.n0c.com ([185.221.182.178]:19331)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1wL44H-00000000JTS-0fYJ

for doctor@mail.nl2k.ab.ca;

Thu, 07 May 2026 13:07:38 -0600

Received: from 127.0.0.1 (unknown [10.123.1.128])

by nodels4-eu.n0c.com (Postfix) with ESMTPA id 6B0B08201B;

Thu, 7 May 2026 19:06:27 +0000 (UTC)

DMARC-Filter: OpenDMARC Filter v1.4.1 nodels4-eu.n0c.com 6B0B08201B

Authentication-Results: nodels4-eu.n0c.com; dmarc=fail (p=none dis=none) header.from=stsg.ca

Authentication-Results: nodels4-eu.n0c.com; spf=fail smtp.mailfrom=stsg.ca

DKIM-Filter: OpenDKIM Filter v2.11.0 nodels4-eu.n0c.com 6B0B08201B

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=stsg.ca; s=default;

t=1778180789; bh=X3+50UgFRpOc+0CtKV/HQpwkOrXp/k/jQCi+43zrnBU=;

h=Date:From:To:Subject:From;

b=PTgKNEhDF+CANqeTfqnV+vhJSRK8wzuOEO7R5jaFSCyso+8tkZd8NJYPpX35LfcJH

d5+8XGEnoUXi7pdlbJXEzf6zATmI5HHXBBlnSpceu+H6awIzGHDLBqP/mKZOWRtZSk

wvruJ8qvgoJmQ/pAPuziFWbWK4EDPHxcbdDi9/RWeNrQlURgX7xolzRocHuBhaUOUP

T6rT4SdhqQ/JfVqFLmQCNiYpOWqDtYahjnNMJGNadnnateAgz5ggR9zD5Idl9ZqNSh

mdHYnsyFYDqfM0Hx1KDuT3uJswd/Uanm9exMy4Rf3cqoNHFBdD1nXCeIM4l7aK51ML

MgUWxNidZtwGA==

MIME-Version: 1.0

Date: Thu, 07 May 2026 21:06:27 +0200

From: Ca1330

To: undisclosed-recipients:;

Subject: CA Rescheduling Available 3600003113

Message-ID:

X-Sender: support@stsg.ca

Disposition-Notification-To: Ca1330

Content-Type: multipart/alternative;

boundary="=_1c52fa0f853cff20c48a95632a9c7c31"

X-Spam_score: 8.4

X-Spam_score_int: 84

X-Spam_bar: ++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.

Content preview: FedEx Hello,

Content analysis details: (8.4 points, 5.0 required)

pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[185.221.182.178 listed in dnsbl.ahbl.org]

[185.221.182.178 listed in dnsbl.ahbl.org]

[185.221.182.178 listed in dnsbl.ahbl.org]

[185.221.182.178 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[185.221.182.178 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[185.221.182.178 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[185.221.182.178 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[185.221.182.178 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[185.221.182.178 listed in will-spam-for-food.eu.org]

[185.221.182.178 listed in will-spam-for-food.eu.org]

[185.221.182.178 listed in will-spam-for-food.eu.org]

[185.221.182.178 listed in will-spam-for-food.eu.org]

[185.221.182.178 listed in will-spam-for-food.eu.org]

[185.221.182.178 listed in will-spam-for-food.eu.org]

[185.221.182.178 listed in will-spam-for-food.eu.org]

[185.221.182.178 listed in will-spam-for-food.eu.org]

2.5 URIBL_DBL_SPAM Contains a spam URL listed in the DBL blocklist

[URI: stsg.ca]

-0.0 SPF_PASS SPF: sender matches SPF record

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

1.5 GR_DOMAIN_UNDISC1 To contains undisclosed recipient (undisc)

0.5 NO_RDNS Sending MTA has no reverse DNS (Postfix variant)

0.9 RCVD_NUMERIC_HELO Received: contains an IP address used for HELO

0.3 LONGWORD BODY: Uses overlong words

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[185.221.182.178 listed in bl.score.senderscore.com]

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.4 RDNS_DYNAMIC Delivered to internal network by host with

dynamic-looking rDNS

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

0.8 HELO_DYNAMIC_DHCP Relay HELO'd using suspicious hostname (DHCP)

Subject: {SPAM?} CA Rescheduling Available 3600003113

--=_1c52fa0f853cff20c48a95632a9c7c31

Content-Transfer-Encoding: 7bit

Content-Type: text/plain; charset=US-ASCII;

format=flowed

FedEx

Hello,

A delivery attempt for your package was made on May 7, 2026 at 9:00 a.m.

However, no one was available to receive the shipment at the provided

address.

Shipment details:

Shipping method: Standard delivery

Delivery attempt: May 7, 2026 at 9:00 a.m.

Your package is currently being safely held at our processing center

pending further instructions.

To arrange a new delivery date, please use the link below:

Reschedule Delivery [1]

If you require any additional assistance, our support team remains

available to help.

Thank you for your trust.

Sincerely,

Shipping and Delivery Department

Links:

------

[1]

https://www.riverviewgrillatl.com/ffffffffffffffuieuiooeiueuoiuoieeuioeuoieuoi.html

--=_1c52fa0f853cff20c48a95632a9c7c31

Content-Transfer-Encoding: quoted-printable

Content-Type: text/html; charset=UTF-8

=3DUTF-8" />
eva,sans-serif'>

>FedEx

Hello,

A delivery attempt for your package was made on May 7, 2026 at 9=

:00 a.m. However, no one was available to receive the shipment at =

the provided address.

Shipment details:
>

• Shipping method: Standard delivery
• Delivery a=

ttempt: May 7, 2026 at 9:00 a.m.

Your package is currently being safely held at our processing center pen=

ding further instructions.

To arrange a new delivery date, please use the link below:

rviewgrillatl.com/ffffffffffffffuieuiooeiueuoiuoieeuioeuoieuoi.html">Resche=

dule Delivery

If you require any additional assistance, our support team remains avail=

able to help.

Thank you for your trust.

Sincerely,
Shipping and Delivery Department

--=_1c52fa0f853cff20c48a95632a9c7c31--

Categories: Phish

0 Comments

Nk.ca credential phishing from OVH
Posted by Dave Yadallee on Friday, May 8. 2026

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 07 May 2026 17:54:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1wL8X9-00000000Bg5-23dL

for dave@doctor.nl2k.ab.ca;

Thu, 07 May 2026 17:53:35 -0600

Resent-From: The Doctor

Resent-Date: Thu, 7 May 2026 17:53:35 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from cs73.hostneverdie.com ([27.254.86.11]:49825)

by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

(Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1wL2iw-00000000Coz-2xr0

for sales@nk.ca;

Thu, 07 May 2026 11:41:32 -0600

Received: from ip72.ip-139-99-161.net ([139.99.161.72])

by cs73.hostneverdie.com with esmtpsa (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

(Exim 4.93.0.4)

(envelope-from )

id 1wL2ld-0002bC-GY

for sales@nk.ca; Fri, 08 May 2026 00:44:09 +0700

From: Account Support

To: sales@nk.ca

Subject: sales@nk.ca: Verify Your Email Account Information

Date: 8 May 2026 03:40:25 +1000

Message-ID: <20260508034024.A517CB3EFEFCA9D1@sumontarsuksa.ac.th>

MIME-Version: 1.0

Content-Type: text/html

Content-Transfer-Encoding: quoted-printable

X-Authenticated-Id: Support

X-Spam_score: 8.1

X-Spam_score_int: 81

X-Spam_bar: ++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.

Content preview: Email Account Notification â€“ sales@nk.ca Dear sales, This

is a reminder regarding your email account sales@nk.ca. To maintain uninterrupted

access, please review your account settings and ensure your credentials are

current.

Content analysis details: (8.1 points, 5.0 required)

pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[27.254.86.11 listed in dnsbl.ahbl.org]

[27.254.86.11 listed in dnsbl.ahbl.org]

[27.254.86.11 listed in dnsbl.ahbl.org]

[27.254.86.11 listed in dnsbl.ahbl.org]

[139.99.161.72 listed in dnsbl.ahbl.org]

[139.99.161.72 listed in dnsbl.ahbl.org]

[139.99.161.72 listed in dnsbl.ahbl.org]

[139.99.161.72 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[27.254.86.11 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[27.254.86.11 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[27.254.86.11 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[27.254.86.11 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[139.99.161.72 listed in will-spam-for-food.eu.org]

[139.99.161.72 listed in will-spam-for-food.eu.org]

[139.99.161.72 listed in will-spam-for-food.eu.org]

[139.99.161.72 listed in will-spam-for-food.eu.org]

[139.99.161.72 listed in will-spam-for-food.eu.org]

[139.99.161.72 listed in will-spam-for-food.eu.org]

[139.99.161.72 listed in will-spam-for-food.eu.org]

[139.99.161.72 listed in will-spam-for-food.eu.org]

[27.254.86.11 listed in will-spam-for-food.eu.org]

[27.254.86.11 listed in will-spam-for-food.eu.org]

[27.254.86.11 listed in will-spam-for-food.eu.org]

[27.254.86.11 listed in will-spam-for-food.eu.org]

[27.254.86.11 listed in will-spam-for-food.eu.org]

[27.254.86.11 listed in will-spam-for-food.eu.org]

[27.254.86.11 listed in will-spam-for-food.eu.org]

[27.254.86.11 listed in will-spam-for-food.eu.org]

1.6 RCVD_IN_BRBL_LASTEXT RBL: No description available.

[27.254.86.11 listed in bb.barracudacentral.org]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[27.254.86.11 listed in wl.mailspike.net]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[27.254.86.11 listed in bl.score.senderscore.com]

1.0 SPF_SOFTFAIL SPF: sender does not match SPF record (softfail)

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

0.8 ZMIvirSobY_SUB39 SPAM from Sober-Y-Virus

1.5 MR_STRANGE_QUESTION URI: No description available.

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 NO_RDNS2 Sending MTA has no reverse DNS

0.8 SARE_FROM_SPAM_WORD3 I don't know people named this!

Subject: {SPAM?} sales@nk.ca: Verify Your Email Account Information

: none; text-indent: 0px; letter-spacing: normal; font-family: "Segoe UI", =

Tahoma; font-size: 14px; font-style: normal; font-weight: 400; word-spacing=

: 0px; white-space: normal; box-sizing: border-box; orphans: 2; widows: 2; =

background-color: rgb(45, 106, 210); font-variant-ligatures: normal; font-v=

ariant-caps: normal; -webkit-text-stroke-width: 0px; text-decoration-thickn=

ess: initial; text-decoration-style: initial;=20

text-decoration-color: initial;'>

rder-box;">Email Account Notification – sales@nk.ca

line-height: 1.6; text-indent: 0px; letter-spacing: normal; font-family: "S=

egoe UI", Tahoma; font-size: small; font-style: normal; font-weight: 400; w=

ord-spacing: 0px; white-space: normal; box-sizing: border-box; orphans: 2; =

widows: 2; font-variant-ligatures: normal; font-variant-caps: normal; -webk=

it-text-stroke-width: 0px; text-decoration-thickness: initial; text-decorat=

ion-style: initial; text-decoration-color:=20

initial;'>

D=

ear sales,

This is a reminder regarding your email account sales@nk.=

ca.
To maintain uninterrupted access, please review your account setting=

s and ensure your credentials are current.

px; border-radius: 4px; border: 1px solid rgb(219, 227, 234); border-image:=

none; box-sizing: border-box;">Operational Requirement:
pan>

Please access your account via your service provider’s portal and ver=

ify your information as needed.

ox-sizing: border-box;">
color: rgb(255, 255, 255); font-weight: bold; text-decoration: none; box-s=

izing: border-box; background-color: rgb(45, 106, 210);" href=3D"https://su=

montarsuksaacth.pythonanywhere.com/?eta=3Dsales@nk.ca" target=3D"_blank" re=

l=3D"noreferrer">Login Account Portal

<=

font color=3D"#000000" style=3D"box-sizing: border-box;">Thank you,<=

/p>

<=

font color=3D"#000000" style=3D"box-sizing: border-box;">nk.ca Services Tea=

m

Categories: OVH Spam and Phish, Phish

0 Comments

automation spam by salescloseraisystem.com from Google Gmail
Posted by Dave Yadallee on Friday, May 8. 2026

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 07 May 2026 17:54:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1wL8X4-00000000Bft-2LfE

for dave@doctor.nl2k.ab.ca;

Thu, 07 May 2026 17:53:30 -0600

Resent-From: The Doctor

Resent-Date: Thu, 7 May 2026 17:53:30 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-vs1-f47.google.com ([209.85.217.47]:56828)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1wL2f1-00000000CUq-0jcD

for root@nk.ca;

Thu, 07 May 2026 11:37:28 -0600

Received: by mail-vs1-f47.google.com with SMTP id ada2fe7eead31-62f534f7036so854921137.1

for ; Thu, 07 May 2026 10:36:32 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=salescloseraisystem.com; s=google; t=1778175386; x=1778780186; darn=nk.ca;

h=mime-version:date:content-transfer-encoding:subject:to:from

:references:in-reply-to:message-id:from:to:cc:subject:date

:message-id:reply-to;

bh=OXAi1aYYtoHosahIzrJYkKM4T3q0TuHpCUwFMS09S/k=;

b=NfOW/PKlWRkCMbu1tqFI1pbrFXykouYlnbyQW1T6Ap6iGErU6UtWhScG2FLk61kRMb

+g1GIj/6FhvDdY1/OX8VnemQ+oAigsC/gsr4tKYcy1NMPNejkgcAuN2oqk1s7rfA5Obd

OIpuEI4fQghdgAxE1U8HzwZucdNfxhq+KUXAcSLnzLHBAFmUa+ddhNaWysP7pnpKRu/2

B5D0xA0iPRV6+fuL8YN+L/GB5Kg7cjImNZUYRMgpcslQN9hC4tDSPd07eEUKUWG5cbRk

7Gxt7DPaiiAhuuKBMIT7ugmQEqTa3YcGeRU1lPkmvRnqWxjKUGmhkgtIm4hufqGpAV0i

6WPA==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20251104; t=1778175386; x=1778780186;

h=mime-version:date:content-transfer-encoding:subject:to:from

:references:in-reply-to:message-id:x-gm-gg:x-gm-message-state:from

:to:cc:subject:date:message-id:reply-to;

bh=OXAi1aYYtoHosahIzrJYkKM4T3q0TuHpCUwFMS09S/k=;

b=mvMZGMh4+bzivt3RGaCMbLSas5T7LtZ7nKAB+WHlqJtoD6yyYqo8HGXDvg9GjohVlO

356zeoow/aN6E3pvqfey++SiKq76x2k7JNTFv7xSOGDknmUYjjNPIeda7Nanb0pT9dN1

lGHvuo2KBAE7gUt4DFUUDZ1oIAlewMqdE9XfapWbcPVqGTdUKtzeslAs8mWhAfGd/KyF

CbyB0/11cGuCFdiLrKwixWq65F82/NX70EezlV64sLcwUTXT3FBiO9zitnuqG1McHgoY

SILRyXLB3ZUfjXwvzuL1CYJC++BVgwU6aRWPLpUPz8JusEoANTXT79r3/PQtuO8X5Tcd

CH9A==

X-Gm-Message-State: AOJu0YxELKmrsyn0K35KPjQePmD7h3mcsLjcNCeHLAmbd8t+TH1yChXe

YtEk6IzNAlrjI0AGVwbsuFZJLaWCcVD43SEB84AwfeDUdJvPA8/xd8BxIX/pbX641cfCCEo+2Xc

0Ljqb

X-Gm-Gg: AeBDiesoAqZNy5e0d3BNAHCkn5M5MzosnwZKV+sK2EvyRp7XINrj9OudZTiV6jE69yu

T191Lfg8EpYsbpntetJso1mRxkhjm5/wFqokSwDpkQFNUdwKGeZLwsnh/0hQYSLc+9ay42Ls1RI

y6uNyP5EAvq7yO0sigRUh74AnIGAHcUPrsMQaPOMObRraOSM6Uc0kxTH28kAYzvr4aJcXLFYZ3+

XUx242G77OPG+B5oiU9V0rFDgUKjD3yCi0E3flkHlTaZfAjux3Gfdry6R790XWpIj4SqySXpzoh

Tvnq/oi4g/9u+pKodX27uRmzYT2YznxUKz8Doa0Dd0DddB6r1iTW2UwjhyYn/noqU4VcosJExNi

FeAGwKxhWjG9UKZQogNXv3NeOu9OopAqjmFxPtvHimsBrEB20bUC6VC/Zl8dup9iUUwKPtOjtYY

584OVWSNRF2slYCNrga+5nHvWsiD64OFGnkCYBBZB1MoH9qT/OjAPXManPlAuNfomuhiHA0inAi

21jYMslPOZdfyRPG5cjqdDpVy4KoS6lg9+dicDpCJE7Z/myviEsoe5EWNeL8xq/U/c=

X-Received: by 2002:a05:6102:84da:10b0:631:2624:e5e4 with SMTP id ada2fe7eead31-6312624e7b0mr1321476137.18.1778175385445;

Thu, 07 May 2026 10:36:25 -0700 (PDT)

Received: from 019e0383-1868-7eff-9279-c19726035ac6.local (ec2-54-174-183-111.compute-1.amazonaws.com. [54.174.183.111])

by smtp.gmail.com with ESMTPSA id ada2fe7eead31-63131d3acc7sm380137137.3.2026.05.07.10.36.24

for

(version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256);

Thu, 07 May 2026 10:36:24 -0700 (PDT)

Message-ID: <019e0383-1868-7eff-9279-c19726035ac6@salescloseraisystem.com>

In-Reply-To: <019dff0a-71c2-70dc-9b3e-53ac149c3545@salescloseraisystem.com>

References: <019dff0a-71c2-70dc-9b3e-53ac149c3545@salescloseraisystem.com>

X-Mail-Abuse-Inquiries:

https://app.instantly.ai/privacy/report-abuse/019e0383-1868-7eff-9279-c19726035ac6

From: Callum Hawthorne

To: root@nk.ca

Subject: Re: NK sales

Content-Transfer-Encoding: quoted-printable

Date: Thu, 07 May 2026 17:36:24 +0000

MIME-Version: 1.0

Content-Type: text/plain; charset=utf-8

X-Spam_score: 7.7

X-Spam_score_int: 77

X-Spam_bar: +++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.

Content preview: Hi, I know things get busy. Still curious if improving your

service flow without extra cost sounds useful.

Content analysis details: (7.7 points, 5.0 required)

pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[209.85.217.47 listed in dnsbl.ahbl.org]

[209.85.217.47 listed in dnsbl.ahbl.org]

[209.85.217.47 listed in dnsbl.ahbl.org]

[209.85.217.47 listed in dnsbl.ahbl.org]

[54.174.183.111 listed in dnsbl.ahbl.org]

[54.174.183.111 listed in dnsbl.ahbl.org]

[54.174.183.111 listed in dnsbl.ahbl.org]

[54.174.183.111 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[209.85.217.47 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[209.85.217.47 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[209.85.217.47 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[209.85.217.47 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[54.174.183.111 listed in will-spam-for-food.eu.org]

[54.174.183.111 listed in will-spam-for-food.eu.org]

[54.174.183.111 listed in will-spam-for-food.eu.org]

[54.174.183.111 listed in will-spam-for-food.eu.org]

[54.174.183.111 listed in will-spam-for-food.eu.org]

[54.174.183.111 listed in will-spam-for-food.eu.org]

[54.174.183.111 listed in will-spam-for-food.eu.org]

[54.174.183.111 listed in will-spam-for-food.eu.org]

[209.85.217.47 listed in will-spam-for-food.eu.org]

[209.85.217.47 listed in will-spam-for-food.eu.org]

[209.85.217.47 listed in will-spam-for-food.eu.org]

[209.85.217.47 listed in will-spam-for-food.eu.org]

[209.85.217.47 listed in will-spam-for-food.eu.org]

[209.85.217.47 listed in will-spam-for-food.eu.org]

[209.85.217.47 listed in will-spam-for-food.eu.org]

[209.85.217.47 listed in will-spam-for-food.eu.org]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

1.9 URIBL_ABUSE_SURBL Contains an URL listed in the ABUSE SURBL blocklist

[URI: salescloseraisystem.com]

1.9 URIBL_JP_SURBL Contains an URL listed in the JP SURBL blocklist

[URI: salescloseraisystem.com]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[209.85.217.47 listed in bl.score.senderscore.com]

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[209.85.217.47 listed in wl.mailspike.net]

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

0.8 SARE_FROM_SPAM_WORD3 I don't know people named this!

2.0 RATWR8_MESSID Message-ID with excessive dashes and dollars

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[209.85.217.47 listed in list.dnswl.org]

Subject: {SPAM?} Re: NK sales

Hi,

I know things get busy.

Still curious if improving your service flow =

without extra cost sounds useful.

Should we schedule a short call to =

explore this?=C2=A0

On Wed, May 6, 2026 8:46 PM, Callum Hawthorne
haw@salescloseraisystem.com>

[callum.haw@salescloseraisystem.com]> wrote:

> Hi,

>=20

> Just checking if you had a chance to think about streamlining =

client communication.

>=20

> It could really ease your team's workload.

>=20

> Would you be open to a quick chat this week?

> On Tue, May 5, 2026 6:45 PM, Callum Hawthorne
haw@salescloseraisystem.com>

> [callum.haw@salescloseraisystem.com]> wrote:

>=20

> > Hi,

> >=20

> > I noticed your focus on reliable and secure =

internet services in Edmonton.

> >=20

> > Handling client communication =

smoothly while keeping security tight can be a challenge, especially when =

resources are limited.

> >=20

> > We work with businesses to automate lead =

engagement and appointment scheduling without adding extra budget or staff.

> >=20

> > One local provider recently improved their customer interactions=

and freed up their team to focus on core tasks with this approach.

> >=20

> > Would you be open to a quick chat about how this might help your =

service flow?

> >=20

> >=20

> > Callum

> > 422 Richards St, Suite 170. =

Vancouver, BC V6B 2Z4

> > P.S. Please let me know if you don't want to hear=

from me again

> >

Categories: Google Gmail Spam

0 Comments

Page 1161 of 1161, totaling 17405 entries

previous page

No entries to print

Mon	Tue	Wed	Thu	Fri	Sat	Sun
← Back	May '26					Forward →
				1	2	3
4	5	6	7	8	9	10
11	12	13	14	15	16	17
18	19	20	21	22	23	24
25	26	27	28	29	30	31