BBB Phish

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 20 Aug 2026 19:28:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.5 (FreeBSD))

(envelope-from )

id 1wxE2g-00000000P3t-049a

for dave@doctor.nl2k.ab.ca;

Thu, 20 Aug 2026 19:27:34 -0600

Resent-From: The Doctor

Resent-Date: Thu, 20 Aug 2026 19:27:33 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from server.ore-kaz.kz ([185.111.106.208]:41829)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.99.5 (FreeBSD))

(envelope-from )

id 1wx9kL-000000005aS-3FJw

for doctor@nk.ca;

Thu, 20 Aug 2026 14:52:31 -0600

Received: from FRXVEFEX (unknown [188.69.127.224])

by server.ore-kaz.kz (Postfix) with ESMTPSA id 2BA6B20A936B

for ; Fri, 21 Aug 2026 02:51:28 +0600 (+06)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ore-kaz.kz;

s=default; t=1787259090;

bh=5XPIKSwoLTokOYvplGvhcs3eIztHxw4oo9xg/CtpoPI=; h=From:To:Subject;

b=V6qmZLjemiWFhXy0KtHrWu3I3hbdfhKK9HeYDvRYxQIbe7j0r7Pn8hF17Uka6m69y

BTsJwff09UD6VnJp4J++d30JteB8v83cIKtdFPKtxPopGCpAz+QH9foxh2GAYCuAvd

4dVp4NoY+V4g2REcTtHAGUz89RPbK15MejzFjEx5C2Ra9EpSkrtkwqg9LnZhGHzoep

r67wbv0ELwRm/FK9pur3c+4TgWKBbd+a7iBfGWqPOu8I7w2PRDxmjRuv7cSc4FG3/f

ZId9qauuGL5GeZrwMOLqlGEzlmLxoY58uDytiLkdAEwnfIGsw407ex2MGM1FZ6++G9

FjDud4fvBleTA==

Authentication-Results: server.ore-kaz.kz;

spf=pass (sender IP is 188.69.127.224) smtp.mailfrom=ore.kz@ore-kaz.kz smtp.helo=FRXVEFEX

Received-SPF: pass (server.ore-kaz.kz: connection is authenticated)

Message-ID: <254e059d6f9438014b2a00921862556f@ore-kaz.kz>

From: BBB Great West + Pacific

To:

Subject: Publishing Review for TH!NK - Withheld Due to Controversial Content

Date: Thu, 20 Aug 2026 21:51:25 +0100

MIME-Version: 1.0

Content-Type: multipart/alternative;

boundary="956b0b5eb20a8380c4fb0cdc000ea310"















Better Business Bureau









A new review needs your attention





Thursday, August 20, 2026









Business



TH!NK



500 Ala Moana Blvd Bldg 7 Ste 400

Honolulu, HI 96813-4920



bbb link

https://www.bbb.org/us/hi/honolulu/profile/management-consultant/thnk-1296-53072483















Someone left feedback about your business on the BBB website. The written comments are held back in this message.





★★☆☆☆



Customer rating





🔒 Text hidden



Under moderator review





Why comments are not shown here



We hide the full text in email so private or strongly worded remarks are less likely to spread if this note is forwarded, printed, or read on a shared screen.



Read the full review





What happens next



01



Moderator check first



You can open the submission now. It stays off the public profile until a moderator confirms it meets our community rules. Under FTC guidance, content with hate speech, slurs, threats, or similar abuse may be removed.





02



You can still object



Object before it goes live if something looks wrong. For three-star ratings and below, a clear business reply helps surface facts through the normal dispute path.













Your BBB profile snapshot





TH!NK





Address



500 Ala Moana Blvd Bldg 7 Ste 400

Honolulu, HI 96813-4920





Phone



(808) 224-6694



Website



https://think-training.com







Email



doctor@nk.ca





Local BBB



BBB Great West + Pacific



BBB File Opened



3/7/2014





23



Business Started



1/6/2003





Category



Management Consultant









You received this because your business is listed with

Better Business Bureau.



Unsubscribe · Notification settings











Funding spam from Google Gmail

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Fri, 21 Aug 2026 02:29:00 -0600

Received: from mail-ej1-f48.google.com ([209.85.218.48]:61556)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.99.5 (FreeBSD))

(envelope-from )

id 1wxHP7-00000000BS7-2VoL

for dave@doctor.nl2k.ab.ca;

Thu, 20 Aug 2026 23:03:06 -0600

Received: by mail-ej1-f48.google.com with SMTP id a640c23a62f3a-c214e625259so79181666b.2

for ; Thu, 20 Aug 2026 22:01:23 -0700 (PDT)

ARC-Seal: i=1; a=rsa-sha256; t=1787288476; cv=none;

d=google.com; s=arc-20260327;

b=qgdeA5VnkShwcqORSAuTJ+bemH9XbSJJTXco0v3SpSguYEwUwFY6KwjiHxA471jC3D

uPtFZBFbNHbepziec1a+hdZmDlVnh0r0yO/t52085XHDUNDo9ayOFBU3b0Rd49bSlkQw

9rXl9K8bPeB4PhdQOjcvyTNhLHTXEAK30aJrf/8Ce/V9yfB4Sb/uyy2B07yy55GSZBYO

Hm7GNs8+FfQuekjZ9XnrTKnOkt+Vo6H3Uliau6zUph1kjIZa+l6iWrY3hyhgQmTuHEg8

wK5Ekc/BVmEJ1FdBxL2fYziV/+uxSE3Nu780T9ot+ufAr4LEq9cECjxWznvoFQ2vaZT5

3Hlw==

ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20260327;

h=to:subject:message-id:date:from:mime-version:dkim-signature;

bh=c2jvKu8cJlsZA0wPVqW6oPQsyIaPIpgqIDrMgaFerjc=;

fh=Dq+AHpP7W6VP2ay70me6XhzQHeTDb7jl7+XKZDrBdgY=;

b=RCNq7S6LRS0x3w/rKHC6TokI8OU8flgc4Jv6QSekLk9n1+XicB0Cx4wYokQbwfFupk

k/g/3OzRLtqz+CkPvdZ51q5JJRu2X0bJpTtJqYUuMUiSoQmC2HEE7dmKmdEx+5cnsEJF

eYj8UGvMaaojCezVHkHUXoTiJJRYL3/VcFAnO18G21f+sU9KwnIC6EYNLSEDbfmseRnl

F6T8iK3a8kr/WvigL+4rgCiLfiyuUNNM4iW0kdIDrozaxncsC348BeTummxYHGRbTxTQ

mOVFhZyKKqdvmmrtoClwLo86lhsGUYyJGewHwNvvXY+nXleMm5y4XrlDyUuDixYLsNwI

hRcA==;

darn=doctor.nl2k.ab.ca

ARC-Authentication-Results: i=1; mx.google.com; arc=none

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=gmail.com; s=20251104; t=1787288476; x=1787893276; darn=doctor.nl2k.ab.ca;

h=content-type:to:subject:message-id:date:from:mime-version:from:to

:cc:subject:date:message-id:reply-to:content-type;

bh=c2jvKu8cJlsZA0wPVqW6oPQsyIaPIpgqIDrMgaFerjc=;

b=XEYTllezXZNoiGV24OZqbmwQR20vIWO2jIYmy8tur6tlk3ng2ViEE7p3smxFV7Ddf3

oKKvnXaD9bMM8791/UanR6QQvZCCSw9xrkJC1uBEZi+JOYQlHEYuhUUvKLuycWD7zTbr

+jDG3oGvXjw7XprfuqlwEJanLe7TVxxObQvNlaV/fR8XRufsPJQM+U32xh8hijywjORo

kAxMgTR7CiCKdQ0GVdIk2MsKSQGiitzW9JB5V97pMbQkW/s2NM1chwB9/d6l7rKgrMzr

/upU6Is3eddQTl5L9lf2lJjB5B99w9gW7ERp6TVuVF2sXpxwmv+AG1VK0B3G9gi3znAZ

ZWFg==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20251104; t=1787288476; x=1787893276;

h=content-type:to:subject:message-id:date:from:mime-version:x-gm-gg

:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to

:content-type;

bh=c2jvKu8cJlsZA0wPVqW6oPQsyIaPIpgqIDrMgaFerjc=;

b=WQ/34ScSYvXuTdNsmwHWMpunZEt8YEuefszi1dfWZnuGIOgElModczOglk8n56sR+p

ka2FJxX6QtmaEcBRB3uQetSfZ0MEGqiuvBAGJa4V2KgnmSL7xxtFc7M7IeMDLj9Ma2UL

JTWHIVmSqzka040p30bJgLF9E+Ez7ys6jP2wnLrOlU23dLhgVTCkvAwarA8NhthWtooc

wyYvRL9xK2S4b6sl6k4jKT47Yg8y4SqiMBUFdxGaqSpFGjo4MXixqNvUmrpekvKOjyUv

8Rznbx22FRGpAvifNCEw6jYQQsIiMcmPn+/JAWHdLSKxHDpsfsuzoG7OUIX6mG3oXxsB

6NhA==

X-Forwarded-Encrypted: i=1; AHgh+Rp3PQVu1B9WgJon619LFiZ0skDpnXoCpMk58sepOdEfnpOawHwK8kCrFGuWuAMprkEt96+8@doctor.nl2k.ab.ca

X-Gm-Message-State: AOJu0YyTY5zWKOWDVu1dj8+rHKc6kb/cVrnwH4AdP/onVnN16LnMadNd

vdUilFWwVadFBrohncnjncdsBH9SvqGfwt0ncIFhVieJzp4UVmbHpAwo/21TLVqhj+Wbt4U5BaH

yDGstA0L+v8vxb5s73u0elkfgSFy7Zv8=

X-Gm-Gg: AR+sD108d0eCcguaBobM3C//hIfcUlPZD7VzGshiQ7w24/i0BQRDBwYbEwYwXUvrGa4

mMDuwxHJ61vyj/Rru36TYlxkwJin8CSZHyJeuBjdVNZxPgfbQo+AWGivCngJZtBqP3HtHR/YnW6

DgiHunTCJLlJLxhy9KZ2iFg8vQM45mVOauFT9X4Cr4qPtIp61rt253oHuGa7+RsOrkpiFxbih/1

eCTRtMTflcc4/i1BEPOBTfljuflrJyWV2p2wuIn9hpZeyMC+YZdafGkEIPNcqc/wGHF9Azy+7BC

JH8ltKXUAneimMyQCZIy6yCeueAHrXS39UZVBpbeOUUhDw==

X-Received: by 2002:a17:907:d0e:b0:c24:6505:8f67 with SMTP id

a640c23a62f3a-c246a37cf52mr324420466b.10.1787288475828; Thu, 20 Aug 2026

22:01:15 -0700 (PDT)

MIME-Version: 1.0

From: "Dr. Benz Mathias"

Date: Thu, 20 Aug 2026 22:01:07 -0700

X-Gm-Features: AcwNN1Vz8hFo2P8GqvmGh7hdqNKUYjFlJgVsYA0l99oY5TWiBzn1vs9wzu7LBxg

Message-ID:

Subject: Subject: Funding Opportunities We are reaching out to engage with

individuals, entrepreneurs, corporations, and investors, as well as start-up

owners, who are seeking financing for their projects. Our company is ready to

invest in viable initiatives and would be glad to share our terms and

conditions after reviewing your project plan and executive summary. If you

are committed to exploring this opportunity, please submit your project plan

and executive summary for our evaluation. Best regards, Dr. Benz Mathias

To: undisclosed-recipients:;

Content-Type: multipart/alternative; boundary="000000000000b68c6206598786dd"

Bcc: dave@doctor.nl2k.ab.ca

X-Spam_score: 5.9

X-Spam_score_int: 59

X-Spam_bar: +++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview:



Content analysis details: (5.9 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

2.3 EMPTY_MESSAGE Message appears to have no textual parts and no

Subject: text

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[209.85.218.48 listed in will-spam-for-food.eu.org]

[209.85.218.48 listed in will-spam-for-food.eu.org]

[209.85.218.48 listed in will-spam-for-food.eu.org]

[209.85.218.48 listed in will-spam-for-food.eu.org]

[209.85.218.48 listed in will-spam-for-food.eu.org]

[209.85.218.48 listed in will-spam-for-food.eu.org]

[209.85.218.48 listed in will-spam-for-food.eu.org]

[209.85.218.48 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[209.85.218.48 listed in dnsbl.ahbl.org]

[209.85.218.48 listed in dnsbl.ahbl.org]

[209.85.218.48 listed in dnsbl.ahbl.org]

[209.85.218.48 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[209.85.218.48 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[209.85.218.48 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[209.85.218.48 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[209.85.218.48 listed in dnsbl.ahbl.org]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[209.85.218.48 listed in list.dnswl.org]

-0.0 SPF_PASS SPF: sender matches SPF record

1.5 GR_DOMAIN_UNDISC1 To contains undisclosed recipient (undisc)

0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends in

digit

[benzelmathias1(at)gmail.com]

0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider

[benzelmathias1(at)gmail.com]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[209.85.218.48 listed in wl.mailspike.net]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[209.85.218.48 listed in bl.score.senderscore.com]

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

0.8 SARE_FROM_SPAM_WORD3 I don't know people named this!

0.0 T_HK_NAME_FM_DR No description available.

Subject: {SPAM?} Subject: Funding Opportunities We are reaching out to engage with

individuals, entrepreneurs, corporations, and investors, as well as start-up

owners, who are seeking financing for their projects. Our company is ready to

invest in viable initiatives and would be glad to share our terms and

conditions after reviewing your project plan and executive summary. If you

are committed to exploring this opportunity, please submit your project plan

and executive summary for our evaluation. Best regards, Dr. Benz Mathias



--000000000000b68c6206598786dd

Content-Type: text/plain; charset="UTF-8"







--000000000000b68c6206598786dd

Content-Type: text/html; charset="UTF-8"








--000000000000b68c6206598786dd--

BBB complaint phish

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 20 Aug 2026 19:28:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.5 (FreeBSD))

(envelope-from )

id 1wxE2b-00000000P0Q-0p6K

for dave@doctor.nl2k.ab.ca;

Thu, 20 Aug 2026 19:27:29 -0600

Resent-From: The Doctor

Resent-Date: Thu, 20 Aug 2026 19:27:29 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from pam-nakano.co.jp ([124.146.217.205]:36363)

by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

(Exim 4.99.5 (FreeBSD))

(envelope-from )

id 1wx9cU-000000004OO-02jT

for doctor@nk.ca;

Thu, 20 Aug 2026 14:44:28 -0600

Received: (qmail 420181 invoked by VF by uid 0); 21 Aug 2026 05:43:24 +0900

X-Vade-Tracker: score=54, verdict=clean, state=0

spamcause=gggruggvucftvghtrhhoucdtuddrgeefiedrtddugdduvdeltdehucetufdoteggodetrfdotffvucfrrhhofhhilhgvmecupffvvffrveenuceurghilhhouhhtmecufedttdenucgoufhushhpvggtthffohhmrghinhculdegledmnegfrhhlucfvnfffucdlhedmnecujfgurhepkffhvffuffggtgesrgdtjhertddtjeenucfhrhhomhepueeuuecuifhrvggrthcuhggvshhtucdoucfrrggtihhfihgtuceonhgrkhgrmhhurhgrsehprghmqdhnrghkrghnohdrtghordhjpheqnecuggftrfgrthhtvghrnhepheehfedvffeuhffgieeitedtveelhfeffeetfeeileefgfffvdejgeelheeutdefnecuffhomhgrihhnpehgohhoghhlvgdrtghordiirgdpshhhrghrvgdrghhoohhglhgvpdhthhhinhhkqdhtrhgrihhnihhnghdrtghomhdpshgvnhgughhrihgurdhnvghtnecukfhppeefuddrudelvddrkeejrdejtdenucevlhhushhtvghrufhiiigvpedtnecurfgrrhgrmhepihhnvghtpeefuddrudelvddrkeejrdejtddphhgvlhhopegftffnueeumfflmfdpmhgrihhlfhhrohhmpehnrghkrghmuhhrrgesphgrmhdqnhgrkhgrnhhordgtohdrjhhppdhnsggprhgtphhtthhopedupdhrtghpthhtohepughotghtohhrsehnkhdrtggrpdhmohguvgepshhmthhpohhuth

Received: from unknown (HELO URLBBKJK) (nakamura@pam-nakano.co.jp@31.192.87.70)

by dc8.etius.jp (124.146.217.205) with ESMTPA; 21 Aug 2026 05:43:24 +0900

Message-ID: <98f25a28906b9fe6a6da2f7f35e9fc6c@pam-nakano.co.jp>

From: BBB Great West + Pacific

To:

Subject: Publishing Review for TH!NK - Withheld Due to Controversial Content

Date: Thu, 20 Aug 2026 21:43:18 +0100

MIME-Version: 1.0

Content-Type: multipart/alternative;

boundary="052192675f6b9e246366331900024640"

X-Spam_score: 21.2

X-Spam_score_int: 212

X-Spam_bar: +++++++++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Review notificationNew Review Thursday, August 20, 2026 ForTH!NK500

Ala Moana Blvd Bldg 7 Ste 400Honolulu, HI 96813-4920



Content analysis details: (21.2 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[31.192.87.70 listed in will-spam-for-food.eu.org]

[31.192.87.70 listed in will-spam-for-food.eu.org]

[31.192.87.70 listed in will-spam-for-food.eu.org]

[31.192.87.70 listed in will-spam-for-food.eu.org]

[31.192.87.70 listed in will-spam-for-food.eu.org]

[31.192.87.70 listed in will-spam-for-food.eu.org]

[31.192.87.70 listed in will-spam-for-food.eu.org]

[31.192.87.70 listed in will-spam-for-food.eu.org]

[124.146.217.205 listed in will-spam-for-food.eu.org]

[124.146.217.205 listed in will-spam-for-food.eu.org]

[124.146.217.205 listed in will-spam-for-food.eu.org]

[124.146.217.205 listed in will-spam-for-food.eu.org]

[124.146.217.205 listed in will-spam-for-food.eu.org]

[124.146.217.205 listed in will-spam-for-food.eu.org]

[124.146.217.205 listed in will-spam-for-food.eu.org]

[124.146.217.205 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[124.146.217.205 listed in dnsbl.ahbl.org]

[124.146.217.205 listed in dnsbl.ahbl.org]

[124.146.217.205 listed in dnsbl.ahbl.org]

[124.146.217.205 listed in dnsbl.ahbl.org]

[31.192.87.70 listed in dnsbl.ahbl.org]

[31.192.87.70 listed in dnsbl.ahbl.org]

[31.192.87.70 listed in dnsbl.ahbl.org]

[31.192.87.70 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[124.146.217.205 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[124.146.217.205 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[124.146.217.205 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[124.146.217.205 listed in dnsbl.ahbl.org]

1.1 URIBL_GREY Contains an URL listed in the URIBL greylist

[URI: sendgrid.net]

1.5 RCVD_IN_CBL RBL: Received via a relay in cbl.abuseat.org

[Listed by XBL, see ]

1.5 RCVD_IN_SBL_XBL RBL: Received via a relay in Spamhaus SBL+XBL

[31.192.87.70 listed in sbl-xbl.spamhaus.org]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[124.146.217.205 listed in bl.score.senderscore.com]

0.0 T_SPF_HELO_TEMPERROR SPF: test of HELO record failed (temperror)

0.0 T_SPF_TEMPERROR SPF: test of record failed (temperror)

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

-0.0 T_RP_MATCHES_RCVD Envelope sender domain matches handover relay

domain

0.6 J_CHICKENPOX_22 BODY: 2alpha-pock-2alpha

15 GR_DOMAIN_SENDGR6 URI: Body contains known spammer URI (sendgr)

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 T_FILL_THIS_FORM_SHORT Fill in a short form with personal information

Subject: {SPAM?} Publishing Review for TH!NK - Withheld Due to Controversial Content











Better Business Bureau









Review notification



New Review





Thursday, August 20, 2026



For



TH!NK



500 Ala Moana Blvd Bldg 7 Ste 400

Honolulu, HI 96813-4920









Someone left a new review for your business on the BBB website. Open it on BBB to read the full submission and take action if needed.





Star rating on file



——☆☆☆





2 of 5





Comment preview hidden



We do not include the reviewer’s written comments in this message. That way sensitive or critical wording is less likely to spread if the email is forwarded, printed, or viewed on a shared screen.



Open full review





Important Notice

1





Not public yet



Use the button above to read the submission now. It goes live only after a moderator checks that it meets our community standards. Under FTC guidance, reviews with hate speech, racial slurs, threats, or other abusive content may be removed. Until moderation finishes, the public cannot see this review.



2





You can still object



You may challenge this review before it is published. For ratings of three stars or below, we strongly recommend responding so factual issues can move through the normal dispute process.













Business Profile





TH!NK





Address



500 Ala Moana Blvd Bldg 7 Ste 400

Honolulu, HI 96813-4920





Phone



(808) 224-6694



Website



https://think-training.com







Email



doctor@nk.ca





Local BBB



BBB Great West + Pacific



BBB File Opened



3/7/2014





Years in Business



23



Business Started



1/6/2003





Category



Management Consultant









This message was sent to you because you are a customer of Better Business Bureau,



Unsubscribe | Edit Notification Settings









nk.ca credential phish

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 20 Aug 2026 19:28:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.5 (FreeBSD))

(envelope-from )

id 1wxE2O-00000000OsM-0HtK

for dave@doctor.nl2k.ab.ca;

Thu, 20 Aug 2026 19:27:16 -0600

Resent-From: The Doctor

Resent-Date: Thu, 20 Aug 2026 19:27:15 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail.ncfs-group.com ([62.173.139.11]:38048)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.99.5 (FreeBSD))

(envelope-from )

id 1wx8tP-00000000NhH-0M3k

for sales@nk.ca;

Thu, 20 Aug 2026 13:57:48 -0600

X-Virus-Scanned: amavis at ncfs-group.com

DKIM-Filter: OpenDKIM Filter v2.10.3 mail.ncfs-group.com 7B93D901DBC

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=neoline.ru;

s=340039CC-AF37-11EC-9A4C-5024C616B834; t=1787255650;

bh=/1BXD3t+q/DQhOhORCK2k1hwE8LfPZRUwZOuV4kCreQ=;

h=MIME-Version:From:To:Date:Message-ID;

b=kiMO0bBY/WH3LzT1WqPWxylpeW4WbFeHCSAlh/rwKmiGtsIr1YqbBCFXD2Ql14lTo

H+qepZfwP7JDcvCVFINqlFYd+RqJcDmsjcDkkZnVOs8ItxU3tAWc8e5TDoqm1Mc1Wf

oHEfDw2OjRGK7xIzqxQiklVqpUAuo5dya9cipaMG0pS3USCVuQ8t02I2DDN9WXJiP8

Aixhlm7y7ij1OYjR2r+43oHRbgHk2esqJjm1zmr5xjypf1Jl02UaRyqPZCvi2jKoAK

r8IItedsRkBwmMu7MJqZWaBT7xdSejeBqCoara+8iTtsr9gPKT2KyMzrUlGEiY+fk7

xH4ml5VL7MOSA==

Content-Type: multipart/mixed; boundary="===============3819221178257673643=="

MIME-Version: 1.0

From: Admin Nk Helpdesk online mail support account

ccyftllmsezzcvcawhzncpemwgktauijwuweawitahqwvmnvyzsduxrpiwlyhcyyckhfzm



To: sales@nk.ca

Subject: Sales Nk Closure last notice update

Date: Thu, 20 Aug 2026 19:54:05 -0000

Message-ID: <178725564564.31080.1602677049960032651@neoline.ru>

X-JWUAYNE: XDYIYBBAM

X-DAJBNOJUL: SVSSCDD

X-MADFXOO: AZAMCF

X-YIOKCY: HMPWILG

X-DWTVZPAO: NQWDRIA

X-Accept-Language: en-us, en

X-Spam_score: 7.4

X-Spam_score_int: 74

X-Spam_bar: +++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview:



Content analysis details: (7.4 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[62.173.139.11 listed in dnsbl.ahbl.org]

[62.173.139.11 listed in dnsbl.ahbl.org]

[62.173.139.11 listed in dnsbl.ahbl.org]

[62.173.139.11 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[62.173.139.11 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[62.173.139.11 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[62.173.139.11 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[62.173.139.11 listed in dnsbl.ahbl.org]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

0.1 URIBL_CSS_A Contains URL's A record listed in the Spamhaus CSS

blocklist

[URI: neoline.ru/151.248.126.87]

0.1 URIBL_SBL_A Contains URL's A record listed in the SBL blocklist

[URI: neoline.ru/151.248.126.87]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[62.173.139.11 listed in will-spam-for-food.eu.org]

[62.173.139.11 listed in will-spam-for-food.eu.org]

[62.173.139.11 listed in will-spam-for-food.eu.org]

[62.173.139.11 listed in will-spam-for-food.eu.org]

[62.173.139.11 listed in will-spam-for-food.eu.org]

[62.173.139.11 listed in will-spam-for-food.eu.org]

[62.173.139.11 listed in will-spam-for-food.eu.org]

[62.173.139.11 listed in will-spam-for-food.eu.org]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[62.173.139.11 listed in bl.score.senderscore.com]

-0.0 SPF_HELO_PASS SPF: HELO matches SPF record

-0.0 SPF_PASS SPF: sender matches SPF record

3.5 VOWEL_FROM_7 Impronouncable from header (7+ consecutive vowels)

0.7 MPART_ALT_DIFF BODY: HTML and text parts are different

0.0 MIME_HTML_MOSTLY BODY: Multipart message mostly text/html MIME

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.3 HTML_IMAGE_ONLY_04 BODY: HTML: images with 0-400 bytes of words

0.1 MXG_EMAIL_FRAG BODY: URI with email in fragment

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

0.0 DC_PNG_UNO_LARGO Message contains a single large inline gif

0.8 SARE_FROM_SPAM_WORD3 I don't know people named this!

0.1 DC_IMAGE_SPAM_TEXT Possible Image-only spam with little text

0.1 DC_IMAGE_SPAM_HTML Possible Image-only spam

0.2 GMD_PDF_EMPTY_BODY BODY: Attached PDF with empty message body

Subject: {SPAM?} Sales Nk Closure last notice update



--===============3819221178257673643==

Content-Type: multipart/alternative;

boundary="===============4492393812424537886=="

MIME-Version: 1.0



--===============4492393812424537886==

Content-Type: text/plain; charset="utf-8"

MIME-Version: 1.0

Content-Transfer-Encoding: quoted-printable





--===============4492393812424537886==

Content-Type: multipart/related;

boundary="===============0465683040721914027=="

MIME-Version: 1.0



--===============0465683040721914027==

Content-Type: text/html; charset="utf-8"

MIME-Version: 1.0

Content-Transfer-Encoding: quoted-printable





--===============0465683040721914027==

Content-Type: image/png

MIME-Version: 1.0

Content-Transfer-Encoding: base64

Content-Disposition: inline; filename= "BJPNTJUHMKI.png"

Content-ID:



...



--===============0465683040721914027==--



--===============4492393812424537886==--



--===============3819221178257673643==

Content-Type: application/pdf

MIME-Version: 1.0

Content-Transfer-Encoding: base64

Content-Disposition: attachment; filename="Nk closure.pdf"



...



--===============3819221178257673643==--

Payment phish

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 20 Aug 2026 19:28:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.5 (FreeBSD))

(envelope-from )

id 1wxE2H-00000000OnV-4C7b

for dave@doctor.nl2k.ab.ca;

Thu, 20 Aug 2026 19:27:10 -0600

Resent-From: The Doctor

Resent-Date: Thu, 20 Aug 2026 19:27:09 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail.bagros.eu ([57.129.63.4]:50957)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.99.5 (FreeBSD))

(envelope-from )

id 1wx8qG-00000000NBs-33zJ

for sales@nk.ca;

Thu, 20 Aug 2026 13:54:33 -0600

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=bagros.eu; s=mail;

t=1787255608; bh=hFl7Ol+YNshGb5Lq8nzpaWD0bXZqO6V5bc4uPqXrlqY=;

h=From:To:Subject:Date:From;

b=MfGShe/SG78vxiL2BBDN0L5fZvVEpiJS12JB3BPplSH9sPAFJ1WipRHUQ0i78LhD0

vnNmiNASFMZTDytNLFTK0ZdPUZPfjeSjq+X0vD9uCYNQ6kzxL/jD5OcEmPlkbVxsp9

TubloktVjZOyV9tSJushp4vS3WmvC5Fzuj/p+j98pR4rF3fn1+vG8Wg0+JJ8vfFeul

B/TQx2KBSjdbp30bAe+qX//qcrHD4nLJVXI9FE3JcdqTvY6JTZ5QDK6eQj008nmv+R

pEzyVOb8wvt08BRto6Ehqe9aeBTCImdxvOO8IiITA5C0wqKAN18auc9wWaiww3gsPz

BNN34aIcJ+qrw==

Received: from authenticated-user (mail.bagros.eu [57.129.63.4])

(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)

key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256)

(No client certificate requested)

by mail.bagros.eu (Postfix) with ESMTPSA id 2416B4C964

for ; Thu, 20 Aug 2026 21:53:28 +0200 (CEST)

X-Priority: 3

X-Msmail-Priority: Normal

Importance: normal

Priority: normal

From: Account Dept

To: sales@nk.ca

Subject: Payment Schedule For Approval - The Month Of August 2026

Message-ID:

Date: Thu, 20 Aug 2026 19:53:27 +0000

MIME-Version: 1.0

Content-Type: multipart/alternative;

boundary="--_NmP-0398e290bfd82612-Part_1"

X-Spam_score: 7.8

X-Spam_score_int: 78

X-Spam_bar: +++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Finance Controller | has shared access to "Invoice Payment

schedule for August 2026.xlsx" with you sales@nk.ca. Nagindas Khandwala College

August Payment Schedule.xlsx Last modified 2026-08-20



Content analysis details: (7.8 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[57.129.63.4 listed in will-spam-for-food.eu.org]

[57.129.63.4 listed in will-spam-for-food.eu.org]

[57.129.63.4 listed in will-spam-for-food.eu.org]

[57.129.63.4 listed in will-spam-for-food.eu.org]

[57.129.63.4 listed in will-spam-for-food.eu.org]

[57.129.63.4 listed in will-spam-for-food.eu.org]

[57.129.63.4 listed in will-spam-for-food.eu.org]

[57.129.63.4 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[57.129.63.4 listed in dnsbl.ahbl.org]

[57.129.63.4 listed in dnsbl.ahbl.org]

[57.129.63.4 listed in dnsbl.ahbl.org]

[57.129.63.4 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[57.129.63.4 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[57.129.63.4 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[57.129.63.4 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[57.129.63.4 listed in dnsbl.ahbl.org]

0.0 SPF_HELO_FAIL SPF: HELO does not match SPF record (fail)

[SPF failed: Rejected by SPF record.]

-0.0 SPF_PASS SPF: sender matches SPF record

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

2.0 DOS_RCVD_IP_TWICE_B Received from the same IP twice in a row (only

one external relay)

-0.0 T_RP_MATCHES_RCVD Envelope sender domain matches handover relay

domain

0.6 J_CHICKENPOX_84 BODY: 8alpha-pock-4alpha

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[57.129.63.4 listed in bl.score.senderscore.com]

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.1 MXG_EMAIL_FRAG BODY: URI with email in fragment

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

1.8 MISSING_MIMEOLE Message has X-MSMail-Priority, but no X-MimeOLE

2.0 RATWR8_MESSID Message-ID with excessive dashes and dollars

Subject: {SPAM?} Payment Schedule For Approval - The Month Of August 2026



----_NmP-0398e290bfd82612-Part_1

Content-Type: text/plain; charset=utf-8

Content-Transfer-Encoding: 7bit



Finance Controller | has shared access to "Invoice

Payment schedule for August 2026.xlsx" with

you sales@nk.ca.



Nagindas Khandwala College August Payment Schedule.xlsx



Last modified 2026-08-20



Open in Excel



Download Document

----_NmP-0398e290bfd82612-Part_1

Content-Type: text/html; charset=utf-8

Content-Transfer-Encoding: quoted-printable




org/1999/xhtml">
http-equiv=3D"Content-Type" content=3D"text/html; charset=3Dutf-8">
name=3D"viewport" content=3D"width=3Ddevice-width, initial-scale=3D1.=

0">
name=3D"format-detection" content=3D"telephone=3Dno,address=3Dno,email=3Dno=

,date=3Dno,url=3Dno">Message
style=3D"margin:0;padding:0;word-break:break-word;">
align=3D"center" bgcolor=3D"#ffffff" border=3D"0" cellspacing=3D"0" =

cellpadding=3D"0" style=3D"box-sizing: border-box; border-collapse: =

collapse; font-style: normal; font-variant-ligatures: normal; =

font-variant-caps: normal; font-weight: 400; letter-spacing: normal; =

orphans: 2; text-align: left; text-transform: none; widows: 2; =

word-spacing: 0px; -webkit-text-stroke-width: 0px; white-space: normal; =

text-decoration-thickness: initial; text-decoration-style: initial; =

text-decoration-color: initial; color: rgb(68, 68, 68); font-family: =

"segoe ui semilight", "segoe ui", verdana, sans-serif; =

font-size: 18px;">










border-box; margin: 0px;">


cellspacing=3D"0" cellpadding=3D"0" style=3D"box-sizing: border-box; =

border-collapse: collapse; float: left;">


border-box;">








0); padding-top: 20px; padding-right: 12px; padding-left: 12px; =

font-family: "segoe ui semilight", "segoe ui", tahoma, =

arial, sans-serif; font-size: 17px;">

Finance Controller | has =

shared access to "Invoice=20

Payment schedule for August 2026.=

xlsx" with=20

you sales@nk.ca.



cellpadding=3D"0" style=3D"box-sizing: border-box; border-collapse: =

collapse; float: left;">














border-box; margin: 0px; padding-top: 10px; padding-left: 12px;">

 

margin: 0px; border-bottom: 1px solid rgb(153, 153, 153);">

 

padding-right: 12px;">

 



style=3D"box-sizing: border-box; border-collapse: collapse; float: left;">




border-box;">








border-box;">






style=3D"box-sizing: border-box; margin: 0px; padding-right: 6px; =

padding-left: 12px;">


src=3D"https://ci3.googleusercontent.com/meips/ADKq_NYbcajltE7NPuFYtq6GU_gO=

HbrsCVHciMrPbGWUoAvlRTNttIm7OE-v9nc8nqlONwyhZnkBvD7ut82hilkr2rmoXKpbkFJvDnq=

5l2myaX4sId4-l0VZdS_oHms4gfk5cYHtqg05FuuUhcC1zsP_w9bMyRJfnKLLtHzGo2Z6lgAK1U=

RtjNnCcqqrHIWy935NeC1In48Lv6AiYE4uPutLOK1bvSBMGnDexSEUf0dOgGH6i7SaKgm8YaTDC=

bPGmyoiYZDaem0r2oPyvOQhFkzAhb47fFj_m1OXLrHhBZUiqdjnGczNCQuPZhY2Q9i50Kj1x-LT=

jfq3FAC88SzQ9RU6C5_f5_NwAQrI766glND6WPn8FFGrsE3lcygBcOEMZgH0vyi36CspD3oWeh-=

B91xqE7_s0p9W1o-qHXHqXYW3Ddxs9ZCKZeRSqUtpBgExQ0VJQoIiOiK3FqwpfIlNHWYviJGgIR=

dn45J_qgZ8yYpLpTOmBhb494o65JzTuQ0EUlt3SFCW-6Eg55JCH6PYh5G_RcQajvMDzTMeSoPC6=

w3p0bfPPgCEFuKgWwKCrIKfIyvLr5wkhNwaMoeHD4zZsW9_smV6d4iYn4SIDu3lwj4=3Ds0-d-e=

1-ft#https://resize.yandex.net/mailservice?url=3Dhttps%3A%2F%2Fci3.=

googleusercontent.com%2Fmeips%2FADKq_NbS5s43mS3wGBqfGoRrcT0ys1n1MDtTxFlSDQB=

z4-iOBP_MTUPsAijs4CJeklD-Ja7e6uW50uBREjEgRNNi8oHya_--Ua9fClj_T2vjAInMB-H75d=

6PJtzd14wdopcAxolmijw7HhxOYqugCychJh0_GH-0kIXH6A%3Ds0-d-e1-ft%23https%3A%2F=

%2Faescleantech-my.sharepoint.com%2Fpersonal%2Flgarcia_aesclean_com%2F_layo=

uts%2F15%2Fimages%2Fsavexc.png&proxy=3Dyes&key=3Debe0333ac1c37e11d1=

fcdfa05241ddc4" style=3D"box-sizing: border-box; vertical-align: middle; =

border-style: none;">

border-box; margin: 0px; padding-top: 20px; padding-right: 12px; =

padding-bottom: 20px;">


cellspacing=3D"0" cellpadding=3D"0" style=3D"box-sizing: border-box; =

border-collapse: collapse; float: left;">


style=3D"box-sizing: border-box;">


border-box;">












color: rgb(51, 51, 51); font-family: "segoe ui light", =

"segoe ui", tahoma, arial, sans-serif; font-size: 18px;">

Nagindas Khandwala College August Payment Schedule.xlsx

118, 118); font-family: "segoe ui", tahoma, arial, sans-serif; =

font-size: 11px;">

Last modified 2026-08-20



margin: 0px; padding-right: 12px; padding-bottom: 40px; padding-left: =

12px;">


style=3D"box-sizing: border-box; border-collapse: collapse; float: left;">




style=3D"box-sizing: border-box;">










border-box; margin: 0px; padding: 12px; color: rgb(255, 255, 255); =

font-family: "segoe ui", tahoma, arial, sans-serif; font-size: =

14px; background-color: rgb(33, 115, 70);">


target=3D"_blank" style=3D"box-sizing: border-box; color: rgb(255, 255, =

255); text-decoration: none; background-color: transparent; border-width: =

0px; margin: 0px; padding: 0px; vertical-align: baseline;" =

href=3D"https://litteraction.fr/sites/all/modules/pubdlcnt/pubdlcnt.php?=

file=3Dhttps://qctazjekftdaugwaxwyc.supabase.co/functions/v1/url-cloaker/re=

solve/excelll#sales@nk.ca">

Open in Excel

20px;">

   

border-box; margin: 0px; padding: 12px; color: rgb(51, 51, 51); =

font-family: "segoe ui", tahoma, arial, sans-serif; font-size: =

14px; background-color: rgb(244, 244, 244);">


rel=3D"noreferrer" target=3D"_blank" style=3D"box-sizing: border-box; =

color: rgb(51, 51, 51); text-decoration: none; background-color: =

transparent; border-width: 0px; margin: 0px; padding: 0px; vertical-align: =

baseline;" href=3D"https://litteraction.fr/sites/all/modules/pubdlcnt/pubdl=

cnt.php?file=3Dhttps://qctazjekftdaugwaxwyc.supabase.=

co/functions/v1/url-cloaker/resolve/excelll#sales@nk.ca">

Download Document







border=3D"0" cellspacing=3D"0" cellpadding=3D"0" style=3D"box-sizing: =

border-box; border-collapse: collapse; font-style: normal; =

font-variant-ligatures: normal; font-variant-caps: normal; font-weight: =

400; letter-spacing: normal; orphans: 2; text-align: left; text-transform: =

none; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; =

white-space: normal; text-decoration-thickness: initial; =

text-decoration-style: initial; text-decoration-color: initial; color: =

rgb(68, 68, 68); font-family: "segoe ui semilight", "segoe =

ui", verdana, sans-serif; font-size: 18px;">


style=3D"box-sizing: border-box;">


font-size: 0px;">






style=3D"box-sizing: border-box; margin: 0px;">

 



margin-bottom: 1rem; font-style: normal; font-variant-ligatures: normal; =

font-variant-caps: normal; font-weight: 400; letter-spacing: normal; =

orphans: 2; text-align: left; text-indent: 0px; text-transform: none; =

widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; white-space: =

normal; text-decoration-thickness: initial; text-decoration-style: initial;=

text-decoration-color: initial; color: rgb(26, 26, 26); font-family: =

"YS Text", Arial, sans-serif; font-size: 16px; background-color: =

rgb(255, 255, 255);">

 



----_NmP-0398e290bfd82612-Part_1--

Top developers and brokers will be at the Canada Intl Property list spam

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 20 Aug 2026 19:27:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.5 (FreeBSD))

(envelope-from )

id 1wxE1z-00000000OaU-2Z0K

for dave@doctor.nl2k.ab.ca;

Thu, 20 Aug 2026 19:26:51 -0600

Resent-From: The Doctor

Resent-Date: Thu, 20 Aug 2026 19:26:51 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from o22.p25.mailjet.com ([185.189.236.22]:39911)

by doctor.nl2k.ab.ca with utf8esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256

(Exim 4.99.5 (FreeBSD))

(envelope-from )

id 1wx8Sk-000000006U0-2eGN

for sales@nk.ca;

Thu, 20 Aug 2026 13:30:14 -0600

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; q=dns/txt;

d=canadapropertyshow.ca; i=info@canadapropertyshow.ca; s=mailjet; t=1787254144; x=1787261344;

h=Message-Id: MIME-Version: From: Reply-To: To: Subject: Date:

List-Id: List-Unsubscribe: List-Unsubscribe-Post:

Feedback-Id: Precedence: X-CampaignID: X-CSA-Complaints:

X-MJ-Mid: X-MJ-SMTPGUID: X-REPORT-ABUSE-TO: Content-Type:

To: From: Sender: Subject: Date;

bh=WBlxcT2lpm1AOL3klsBnLEGlFgADy34SZJPzvoOA+9E=;

b=DbusIX8ImEvOnRt8bFxptCopHus5COeMvJh53ARKgD6Z/eafbDXADiLL0

apQbsT6P5wOteflrBrcQR55dWuyG4kknskqPx5uVuR+e1Xr1KkJo603G0PdX

444bF2Rx8V2vkmzJc9j5/sxijzKcl34ew2xsIAghZAPmW8AF/sMjjHUXAx9P

Jgw/UJbTflxF6tfZ1t8Gi3ru+hybkQTwxj8JQCwMgv6bQfgTSwh3EWmwzu0u

GLCghxQp70gs7rsMik6TiD8GIcKPWcCV1QrVINGUSNDspgxefB6hKPIjNr+i

jq+slv9UwP0lwiQS4gvvnI0RnjH3MDb0s7lS0+31hNgsQ==

Message-Id:

MIME-Version: 1.0

From: Canada International Property Show

Reply-To: info@canadapropertyshow.ca

To: sales@nk.ca

Subject: Top developers and brokers will be at the Canada Intl Property

Show. Will you?

Date: Thu, 20 Aug 2026 19:29:04 +0000 (UTC)

List-Id:

List-Unsubscribe:

,



List-Unsubscribe-Post: List-Unsubscribe=One-Click

Feedback-Id: 42.2952425.2720056:MJ

Precedence: bulk

X-CampaignID: 7765198642

X-CSA-Complaints: csa-complaints@eco.de

X-MJ-Mid:

AW4AAKTON0EAAc7XhzIAA-BCcpQAAYKI8DcAoK6BAC0M6QBqh1WA3me8Osx7R_isQbQDL0t2mwApgTg

X-MJ-SMTPGUID: de67bc3a-cc7b-47f8-ac41-b4032f4b769b

X-REPORT-ABUSE-TO: Message sent by Mailjet please report to

abuse@mailjet.com with a copy of the message

Content-Type: multipart/alternative; boundary="=-JNQ9BmupxUUuO7LcWbVt"

X-Spam_score: 47.5

X-Spam_score_int: 475

X-Spam_bar: +++++++++++++++++++++++++++++++++++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: <> [https://canadapropertyshow.ca/]

View online version https://sh4zl.mjt.lu/nl3/rxHvhBUY3I4gD9gGU2GEZw?m=AW4AAKTON0EAAc7XhzIAA-BCcpQAAYKI8DcAoK6BAC0M6QBqh1WA3me8Osx7R_isQbQDL

[...]



Content analysis details: (47.5 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[185.189.236.22 listed in will-spam-for-food.eu.org]

[185.189.236.22 listed in will-spam-for-food.eu.org]

[185.189.236.22 listed in will-spam-for-food.eu.org]

[185.189.236.22 listed in will-spam-for-food.eu.org]

[185.189.236.22 listed in will-spam-for-food.eu.org]

[185.189.236.22 listed in will-spam-for-food.eu.org]

[185.189.236.22 listed in will-spam-for-food.eu.org]

[185.189.236.22 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[185.189.236.22 listed in dnsbl.ahbl.org]

[185.189.236.22 listed in dnsbl.ahbl.org]

[185.189.236.22 listed in dnsbl.ahbl.org]

[185.189.236.22 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[185.189.236.22 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[185.189.236.22 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[185.189.236.22 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[185.189.236.22 listed in dnsbl.ahbl.org]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[185.189.236.22 listed in list.dnswl.org]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

0.1 URIBL_SBL_A Contains URL's A record listed in the SBL blocklist

[URI: canadapropertyshow.ca/35.227.194.51]

1.1 URIBL_GREY Contains an URL listed in the URIBL greylist

[URI: mjt.lu]

-0.0 SPF_HELO_PASS SPF: HELO matches SPF record

-0.0 SPF_PASS SPF: sender matches SPF record

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

15 GR_DOMAIN_XECODE1 Spammer tool signature (xecode)

15 GR_DOMAIN_MAILJE3 Message-ID contains spammer id (mailje)

15 GR_DOMAIN_MAILJE1 Received contains spammer id (mailje)

-1.0 RCVD_IN_MSPIKE_H5 RBL: Excellent reputation (+5)

[185.189.236.22 listed in wl.mailspike.net]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[185.189.236.22 listed in bl.score.senderscore.com]

-0.0 T_RP_MATCHES_RCVD Envelope sender domain matches handover relay

domain

0.0 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level mail

domains are different

0.3 LONGWORD BODY: Uses overlong words

0.8 HTML_IMAGE_RATIO_02 BODY: HTML has a low ratio of text to image area

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

-1.0 MAILING_LIST_MULTI Multiple indicators imply a widely-seen list

manager

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

-0.0 RCVD_IN_MSPIKE_WL Mailspike good senders

0.8 SARE_FROM_SPAM_WORD3 I don't know people named this!

Subject: {SPAM?} Top developers and brokers will be at the Canada Intl Property

Show. Will you?



--=-JNQ9BmupxUUuO7LcWbVt

Content-Type: text/plain; charset=utf-8

Content-Transfer-Encoding: quoted-printable



<> [https://canadapropertyshow.ca/]

View online version https://sh4zl.mjt.lu/nl3/rxHvhBUY3I4gD9gGU2GEZw?m=3DAW4=

AAKTON0EAAc7XhzIAA-BCcpQAAYKI8DcAoK6BAC0M6QBqh1WA3me8Osx7R_isQbQDL0t2mwApgT=

g&b=3De9532e8d&e=3D83f7d3f6&x=3DBCwpwHREIv6H13pFkkwx5w

If you don't like our emails, you can=C2=A0



update your preferences https://sh4zl.mjt.lu/unsub2?m=3DAW4AAKTON0EAAc7XhzI=

AA-BCcpQAAYKI8DcAoK6BAC0M6QBqh1WA3me8Osx7R_isQbQDL0t2mwApgTg&b=3De9532e8d&e=

=3D83f7d3f6&x=3DBCwpwHREIv6H13pFkkwx5w&hl=3Den_us]or https://sh4zl.mjt.lu/u=

nsub2?m=3DAUYAAHPnElQAAc6lPsQAA9FtWcgAAYKI_iYAoEvTAC0M6QBocCUcmJ9mT1W7QtmiO=

bGBnsWaDQApgTg&b=3Dacc166ac&e=3De9ed69b4&x=3DJXV5YF4Lsy_PYywz1IAQXRtzDekYgN=

I6e86cGq3ZbC4&hl=3Denunsubscribe [https://sh4zl.mjt.lu/unsub2?m=3DAW4AAKTON=

0EAAc7XhzIAA-BCcpQAAYKI8DcAoK6BAC0M6QBqh1WA3me8Osx7R_isQbQDL0t2mwApgTg&b=3D=

e9532e8d&e=3D83f7d3f6&x=3DBCwpwHREIv6H13pFkkwx5w&hl=3Den_usat any time.=



--=-JNQ9BmupxUUuO7LcWbVt

Content-Type: text/html; charset=utf-8

Content-Transfer-Encoding: quoted-printable




9/xhtml" xmlns:v=3D"urn:schemas-microsoft-com:vml" xmlns:o=3D"urn:schemas-m=

icrosoft-com:office:office">Top developers and brokers will be=<br /><br /> at the Canada Intl Property Show. Will you?
a http-equiv=3D"X-UA-Compatible" content=3D"IE=3Dedge">
a http-equiv=3D"Content-Type" content=3D"text/html; charset=3DUTF-8">
name=3D"viewport" content=3D"width=3Ddevice-width,initial-scale=3D1">
type=3D"text/css">#outlook a { padding:0; }

body { margin:0;padding:0;-webkit-text-size-adjust:100%;-ms-text-size=

-adjust:100%; }

table, td { border-collapse:collapse;mso-table-lspace:0pt;mso-table-r=

space:0pt; }

img { border:0;height:auto;line-height:100%; outline:none;text-decora=

tion:none;-ms-interpolation-mode:bicubic; }

p { display:block;margin:13px 0; }
le type=3D"text/css">[owa] .mj-column-per-100 { width:100% !important; max-=

width: 100%; }
acing:normal;background-color:#F4F4F4;">

e:1px;color:#ffffff;line-height:1px;max-height:0px;max-width:0px;opacity:0;=

overflow:hidden;">Top developers and brokers will be at the Canada Intl Pro=

perty Show. Will you?

"main" lang=3D"en" dir=3D"ltr">

gin:0px auto;max-width:600px;">
ding=3D"0" cellspacing=3D"0" role=3D"presentation" style=3D"width:100%;">
body>

tr>

adding-left:0px;padding-right:0px;text-align:center;"><=

div class=3D"mj-column-per-100 mj-outlook-group-fix" style=3D"font-size:0px=

;text-align:left;direction:ltr;display:inline-block;vertical-align:top;widt=

h:100%;">
esentation" style=3D"vertical-align:top;" width=3D"100%">
tbody>

gn=3D"center" style=3D"font-size:0px;padding:0px 0px 0px 0px;word-break:bre=

ak-word;">
resentation" style=3D"border-collapse:collapse;border-spacing:0px;">=


N0EAAc7XhzIAA-BCcpQAAYKI8DcAoK6BAC0M6QBqh1WA3me8Osx7R_isQbQDL0t2mwApgTg/1/1=

UsmcBnzQyJLpRKlgzAvZw/aHR0cHM6Ly9jYW5hZGFwcm9wZXJ0eXNob3cuY2Ev" target=3D"_=

blank">3D"Property
2/sh4zl/c611a6fa-f7b8-41ad-8821-bc6addef4065/content" style=3D"border:none;=

display:block;outline:none;text-decoration:none;height:auto;width:100%;font=

-size:13px;" width=3D"600" height=3D"auto">

td>

px;padding-top:0px;padding-bottom:0px;word-break:break-word;">

"font-family:Verdana, Helvetica, Arial, sans-serif;font-size:13px;line-heig=

ht:1;text-align:left;color:#000000;">


=3D"line-height: 12px; text-align: center; margin: 10px 0; margin-top: 10px=

; margin-bottom: 10px;">
rit;text-decoration:none;; text-decoration: none;" target=3D"_blank" href=

=3D"https://sh4zl.mjt.lu/nl3/rxHvhBUY3I4gD9gGU2GEZw?m=3DAW4AAKTON0EAAc7XhzI=

AA-BCcpQAAYKI8DcAoK6BAC0M6QBqh1WA3me8Osx7R_isQbQDL0t2mwApgTg&b=3De9532e=

8d&e=3D83f7d3f6&x=3DBCwpwHREIv6H13pFkkwx5w">
000EE;font-family:Arial;font-size:12px">View online version

<=

/div>

x 0px 0px;padding-top:0px;padding-bottom:0px;word-break:break-word;">

tyle=3D"font-family:Verdana, Helvetica, Arial, sans-serif;font-size:13px;li=

ne-height:1;text-align:left;color:#000000;">


style=3D"line-height: 14px; text-align: center; margin: 10px 0; margin-top=

: 10px;">If =

you don't like our emails, you can 


ontent" style=3D"line-height: 14px; text-align: center; margin: 10px 0; mar=

gin-bottom: 10px;">
:12px">update your

herit;text-decoration:none;; text-decoration: none;" target=3D"_blank" href=

=3D"https://sh4zl.mjt.lu/unsub2?m=3DAW4AAKTON0EAAc7XhzIAA-BCcpQAAYKI8DcAoK6=

BAC0M6QBqh1WA3me8Osx7R_isQbQDL0t2mwApgTg&b=3De9532e8d&e=3D83f7d3f6&=

amp;x=3DBCwpwHREIv6H13pFkkwx5w&hl=3Den_us">
;font-family:Arial;font-size:12px">preferences

55575d;font-family:Arial;font-size:12px">

55575d;font-family:Arial;font-size:12px">or

ntent" style=3D"color:inherit;text-decoration:none;; text-decoration: none;=

" target=3D"_blank" href=3D"https://sh4zl.mjt.lu/unsub2?m=3DAUYAAHPnElQAAc6=

lPsQAA9FtWcgAAYKI_iYAoEvTAC0M6QBocCUcmJ9mT1W7QtmiObGBnsWaDQApgTg&b=3Dac=

c166ac&e=3De9ed69b4&x=3DJXV5YF4Lsy_PYywz1IAQXRtzDekYgNI6e86cGq3ZbC4=

&hl=3Den">
">

ecoration:none;; text-decoration: none;" target=3D"_blank" href=3D"https://=

sh4zl.mjt.lu/unsub2?m=3DAW4AAKTON0EAAc7XhzIAA-BCcpQAAYKI8DcAoK6BAC0M6QBqh1W=

A3me8Osx7R_isQbQDL0t2mwApgTg&b=3De9532e8d&e=3D83f7d3f6&x=3DBCwp=

wHREIv6H13pFkkwx5w&hl=3Den_us">
:Arial;font-size:12px">unsubscribe

font-family:Arial;font-size:12px">at any time.


div>

.mjt.lu/lnk/AW4AAKTON0EAAc7XhzIAA-BCcpQAAYKI8DcAoK6BAC0M6QBqh1WA3me8Osx7R_i=

sQbQDL0t2mwApgTg/0/G5-BfNuoJE1ovaMUY3otSg/aHR0cHM6Ly9jYW5hZGFwcm9wZXJ0eXNob=

3cuY2Ev?b=3D1">​

e-block;" href=3D"https://sh4zl.mjt.lu/lnk/AW4AAKTON0EAAc7XhzIAA-BCcpQAAYKI=

8DcAoK6BAC0M6QBqh1WA3me8Osx7R_isQbQDL0t2mwApgTg/0/G5-BfNuoJE1ovaMUY3otSg/aH=

R0cHM6Ly9jYW5hZGFwcm9wZXJ0eXNob3cuY2Ev?b=3D3">


BAC0M6QBqh1WA3me8Osx7R_isQbQDL0t2mwApgTg/eb9a0558/e.gif" height=3D"1" width=

=3D"1" alt=3D"" border=3D"0" style=3D"height:1px;width:1px;border:0;"/>



=



--=-JNQ9BmupxUUuO7LcWbVt--



Chinese products spam

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 20 Aug 2026 13:20:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.5 (FreeBSD))

(envelope-from )

id 1wx8IS-00000000AKx-0Onc

for dave@doctor.nl2k.ab.ca;

Thu, 20 Aug 2026 13:19:28 -0600

Resent-From: The Doctor

Resent-Date: Thu, 20 Aug 2026 13:19:27 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from [103.209.128.192] (port=34812 helo=mail-m128192.netease.com)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.99.5 (FreeBSD))

(envelope-from )

id 1wx77l-00000000NVN-3kwl

for sales@nk.ca;

Thu, 20 Aug 2026 12:04:34 -0600

Content-Type: multipart/alternative; BOUNDARY="=_Part_85882_219339396.1787249000662"

To: sales

Subject: =?UTF-8?B?UmU6UmU6UmU6IFN0aWxsIGxvb2tpbmcgZm9yIGEgcmVsaWFibGUgZnJlaWdodCBwYXJ0bmVyIGluIENoaW5hPyA=?=

X-Priority: 3

MIME-Version: 1.0

Received: from sales03_szx@bnclogistics.com( [10.139.5.212] ) by ajax-webmail ( [127.0.0.1] ) ; Fri, 21 Aug 2026 02:03:20 +0800 (GMT+08:00)

From: Sunny

Date: Fri, 21 Aug 2026 02:03:20 +0800 (GMT+08:00)

X-WM-Tid: 0aa0205780850a84kunm3825510b1afc1

Message-ID:

X-Spam_score: 8.5

X-Spam_score_int: 85

X-Spam_bar: ++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Hi sales, I hope everything is going well for you. Your interest

in our updates means a lot to us. We look forward to keeping you informed

with our latest news and offers. We are interested in learning more about

your purchasing needs and the types of products you are seeking. Please let

us know, and we can provide you with our comprehensive product catalog..

Your swift [...]



Content analysis details: (8.5 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[103.209.128.192 listed in will-spam-for-food.eu.org]

[103.209.128.192 listed in will-spam-for-food.eu.org]

[103.209.128.192 listed in will-spam-for-food.eu.org]

[103.209.128.192 listed in will-spam-for-food.eu.org]

[103.209.128.192 listed in will-spam-for-food.eu.org]

[103.209.128.192 listed in will-spam-for-food.eu.org]

[103.209.128.192 listed in will-spam-for-food.eu.org]

[103.209.128.192 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[103.209.128.192 listed in dnsbl.ahbl.org]

[103.209.128.192 listed in dnsbl.ahbl.org]

[103.209.128.192 listed in dnsbl.ahbl.org]

[103.209.128.192 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[103.209.128.192 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[103.209.128.192 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[103.209.128.192 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[103.209.128.192 listed in dnsbl.ahbl.org]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[103.209.128.192 listed in bl.score.senderscore.com]

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

2.0 PDS_OTHER_BAD_TLD Untrustworthy TLDs

[URI: hkdd5498.hk.yjz.top (top)]

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

1.3 RDNS_NONE Delivered to internal network by a host with no rDNS

1.0 HTML_TEXT_INVISIBLE_STYLE HTML hidden text + other spam signs

0.8 SARE_FROM_SPAM_WORD3 I don't know people named this!

2.0 MIXED_HREF_CASE Has href in mixed case

Subject: {SPAM?} =?UTF-8?B?UmU6UmU6UmU6IFN0aWxsIGxvb2tpbmcgZm9yIGEgcmVsaWFibGUgZnJlaWdodCBwYXJ0bmVyIGluIENoaW5hPyA=?=



Hi sales,

I hope everything is going well for you.

Your interest in our updates means a lot to us. We look forward to keeping you informed with our latest news and offers.

We are interested in learning more about your purchasing needs and the types of products you are seeking. Please let us know, and we can provide you with our comprehensive product catalog..

Your swift feedback will ensure we meet your needs effectively.

Thank you for taking the time to review this. I look forward to your prompt reply.

Best regards,







Unlock continuous updates and new feature announcements at . Enable Alerts



Prefer an empty inbox? Adjust settings at Email Preferences.















在2026-08-18,Sunny 写道:



-----原始邮件-----

发件人: Sunny

发件时间: 2026年08月18日 周二

收件人: [sales ]

主题: Re:Re: Still looking for a reliable freight partner in China?



Hi sales,

I hope this email finds you well.

Thank you for subscribing to our newsletter. We're thrilled to have you on board!

I am excited to inform you that we are currently offering a special promotion on our products.If you have any needs, please let me know as soon as possible so I can secure a discounted spot for you.

Thank you for your attention, and I look forward to hearing from you soon.

Best regards,







Do not miss a product highlight: hit . Stay Engaged



Whenever you’d like fewer emails, use Edit Email Choices.













Shopify phish from Sendgrid

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 20 Aug 2026 13:20:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.5 (FreeBSD))

(envelope-from )

id 1wx8IH-00000000AJH-2w2a

for dave@doctor.nl2k.ab.ca;

Thu, 20 Aug 2026 13:19:17 -0600

Resent-From: The Doctor

Resent-Date: Thu, 20 Aug 2026 13:19:17 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from o37.mailer.shopify.com ([149.72.116.219]:64544)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.99.5 (FreeBSD))

(envelope-from )

id 1wx6cg-00000000IRy-28kq

for doctor@doctor.nl2k.ab.ca;

Thu, 20 Aug 2026 11:32:21 -0600

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=g.shopifyemail.com;

h=content-transfer-encoding:content-type:date:from:mime-version:subject:

reply-to:list-unsubscribe:list-unsubscribe-post:to:cc:content-type:date:from:

subject:to;

s=s1; t=1787247080;

bh=zzw63LeEXWsiLpFnlpWW7P1TNZCr6dlltE2dWvghjG4=;

b=ieoM+ihU36bCA6ThqgsCeQeyU1/wbc0U4ju1BbquQXbIEdY4a78/zfGAX25wxooBjY+2

Phl80Q9Pz9jd+/zmatBVwmgI2Y3LC3XpvehYtfV5qGpJetkwbSUgqOPyQmKUP4ww8kIVBE

JvBnS1bLjCvs2Gnbj68G46UcHKXfQVU/4JzaF3q4vo3AyNgQGNsjUIo0w86b5swdqdhsRD

YiEEmSEvunDJK4ZXVf6AzErkb58zYwnXG+qt1IeusrxJ01MZays3sApicfiWK4MgSjlQU4

dh2ttpem1KpqZBiDFwGmQs2Qp1jejvcwsbwlqEVaKOP/2xEOQK/92TYLxLMBgfxg==

Received: by recvd-68db557557-vcmhc with SMTP id recvd-68db557557-vcmhc-1-6A8739E8-A5

2026-08-20 17:31:20.605752998 +0000 UTC m=+1982312.972510147

Received: from NDk0NzczNjY (unknown)

by geopod-ismtpd-58 (SG) with HTTP

id F42oSiElR3KbnVGL8WejZg

Thu, 20 Aug 2026 17:31:20.583 +0000 (UTC)

Content-Transfer-Encoding: quoted-printable

Content-Type: text/html; charset=utf-8

Date: Thu, 20 Aug 2026 17:31:20 +0000 (UTC)

From: "service@paypal.com"

Mime-Version: 1.0

Message-ID:

Subject: Complete your order

Reply-To: "service@paypal.com"

Feedback-Id: s_106707910990:shopify

List-Unsubscribe:



List-Unsubscribe-Post: List-Unsubscribe=One-Click

Precedence: bulk

X-SG-EID:

=?us-ascii?Q?u001=2EGmVxpVuDfKJTxhIgjQJ1VAFdi8E8qyZo16R2EVFrC+PdwJYJqPo8Gup3j?=

=?us-ascii?Q?LNmBBfew81GaeXCEqOWG3map51OjGV6xhaV0RJq?=

=?us-ascii?Q?Q8dNjfF6CfZqdolIhCEegnwaFJIjEx1VDIj9h2I?=

=?us-ascii?Q?xj9pgo10D9cjrytJ1VFQCmtBvVXfKRWdC6AFsLT?=

=?us-ascii?Q?xfQDhZ2woftyiSUKXik9t46Dnd5jBawNnvSGMR9?=

=?us-ascii?Q?bZB4kNnzVRGKOZ75BCCO3QV6Y7h8hhpc+K8bMLT?=

=?us-ascii?Q?b9fR7mr5c9UWYlP=2F5UV8DDvDSg=3D=3D?=

X-SG-ID:

=?us-ascii?Q?u001=2ESdBcvi+Evd=2FbQef8eZF3BpTL9BgbK5wfSJMJGMsmprDITwp3LLcgXu9gv?=

=?us-ascii?Q?F1Oq5oTf1VY9MM=2F=2FZCviT=2FP37sq3379EqymfwVT?=

=?us-ascii?Q?WCZnBG9CINW4nFULeDp5vAqPqKDHP8eUFMZJtNN?=

=?us-ascii?Q?cBdvuZTWBIDM=2FpyWQFsdvRurFycpfuRbVM1CH7V?=

=?us-ascii?Q?B9UeVbTFEbWimGwhj5PCRUuqFWUKFHuQiQs71T5?=

=?us-ascii?Q?2yegj2+d924QGFeO+hLPjgZP9qHAYGjTJTsrNu9?=

=?us-ascii?Q?grPS5HQM8sf2GVc7kpTvnlLDFqBva=2F4EuRkgVBG?=

=?us-ascii?Q?DmyyehXg7oUHO1bXya1BrPcEw1ombQQCzyr6=2F9Z?=

=?us-ascii?Q?5vlW6=2FjbglHD+uHBxZIYV67ijUC9f03hmIoQivf?=

=?us-ascii?Q?H+4RXT4QugUV88+MeeKUwiTvjFGa2Kc7ON389eW?=

=?us-ascii?Q?9r=2Fi17CqEIDC212NQEq09oQdaEJOz7c8k++szmj?=

=?us-ascii?Q?2Ipx+Zwf20qK+1g2CW=2F2x+6hAQjMRAUvvD7mKFW?=

=?us-ascii?Q?iWZOs9wMCgWWYA0v+leUZ3CwlGkQ+At8lPZEg9V?=

=?us-ascii?Q?QzC2zrPmhEU4jKqlCJnrOUa9OsSWj1=2FwU79Yxfp?=

=?us-ascii?Q?JAVnLI36qwASw6mKmWDk4dQhA5PY1QrdHPgljsb?=

=?us-ascii?Q?XYa=2FCrWXYk91WJsZuTrVuJ9=2F41bj+DJspE6kh=2Fa?=

=?us-ascii?Q?Vcl4OkzMIUwdHC0aLC+EpAZSuJENFbcQuCn0Ncd?=

=?us-ascii?Q?mFsjJlnZwubbfws8aUQWGgDYj07AkqWaXd6GUsN?=

=?us-ascii?Q?lyj=2Fen7OnXKTtUw949GRVHDObLz1J2FN4lX=2F+Do?=

=?us-ascii?Q?2+Qah6uw45y5tmBZaScJbmb+=2Fhyo+56ALzgnSiD?=

=?us-ascii?Q?4B+7lXWqnXYpu3HZ4DnybeNifLJc1EC+ldW6I3d?=

=?us-ascii?Q?cAIAh9S9rtRHPbJcQEmxohT=2FqpsNdfmYWlbNDDM?=

=?us-ascii?Q?ot69bFrpyoZXj6JbNva6wWVvw8rv0RvC3KEke5E?=

=?us-ascii?Q?hksZkKnzi9K2T3lkamrJp51UZeNXX0hMHaDlTmI?=

=?us-ascii?Q?7QolpBDQvRsRNoBpFiuo+yBEoAlLKN7+sBacNQq?=

=?us-ascii?Q?zOg3YeK4qosu3mugNcVnzcf2COeLPFhzKIJWnNP?=

=?us-ascii?Q?FXxR=2FxQHmsG9CanXh8d3Ga6kD0b8+Y4IAm7upU7?=

=?us-ascii?Q?UnxT53jn55JRTszu3icOer2GdI2dJlGbJXZK6tG?=

=?us-ascii?Q?B02RKtf7XJpP=2FQp0LG9ZD+A4zB0D2hcBo+JLsVf?=

=?us-ascii?Q?P1msA3SNKHklnuK1O1qIhLABA=2FeRdVTpg0U4mKo?=

=?us-ascii?Q?jz=2F5uxBCmcRhNLJm+XBgZoYdik7LGx4MSoFO9Yo?=

=?us-ascii?Q?=2FNZeuste0uigmw09Pq=2FES1HdmrX38ersKx5j5Gw?=

=?us-ascii?Q?4s4WO1qk6Vzbz52esD8jvna4U9hgNFQKVrzJOnK?=

=?us-ascii?Q?ljFLEaM=2FI7oq17sHXSW7EnC3cKOaj2HmKWAufIu?=

=?us-ascii?Q?y8gEfG1wxwvg7G=2Fi3f3T4TCUiF9FaSsO+u6JpY2?=

=?us-ascii?Q?orU9xvyazGTXpoP2Hm1SyiaxdvCH51E5y0xr3ft?=

=?us-ascii?Q?eD0gi6p131FLVn0txRIYtfRiJ3mNd2rr8Wg7HFF?=

=?us-ascii?Q?9Xpa+js09y1xyjzaFnaoZogFm=2FTdoSi3RzJjK+p?=

=?us-ascii?Q?cbrmm63yBLFYx8XX2IlgFhv03h6QF6C48vBu9hl?=

=?us-ascii?Q?BC52wjvIc+d6C3q+62+v7WKqe2GSf0GUTVuKolw?=

=?us-ascii?Q?WDUg6vClsmrOuyUc73sCwFdHa=2FNpV9l8lJF2LrG?=

=?us-ascii?Q?Y58xDJkNe9qIdrWGKBRbNpYBLz3Aoju4Nr1lV5a?=

=?us-ascii?Q?be09Bw+shsqBeSMpNkmfsZu1JrOT8w=3D=3D?=

To: doctor@doctor.nl2k.ab.ca

X-Entity-ID: u001.k39LvibKjYznfclAFDcpvQ==

X-Spam_score: 7.0

X-Spam_score_int: 70

X-Spam_bar: +++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Just checking in НЏ НЏ НЏ НЏ НЏ НЏ НЏ НЏ НЏ НЏ НЏ НЏ НЏ НЏ

НЏ НЏ НЏ НЏ НЏ НЏ НЏ НЏ НЏ НЏ НЏ НЏ НЏ НЏ НЏ НЏ НЏ НЏ НЏ НЏ НЏ НЏ НЏ НЏ НЏ

НЏ НЏ НЏ НЏ НЏ НЏ НЏ НЏ НЏ НЏ НЏ НЏ НЏ НЏ НЏ НЏ НЏ НЏ НЏ НЏ НЏ НЏ НЏ НЏ НЏ

НЏ НЏ Н [...]



Content analysis details: (7.0 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[149.72.116.219 listed in will-spam-for-food.eu.org]

[149.72.116.219 listed in will-spam-for-food.eu.org]

[149.72.116.219 listed in will-spam-for-food.eu.org]

[149.72.116.219 listed in will-spam-for-food.eu.org]

[149.72.116.219 listed in will-spam-for-food.eu.org]

[149.72.116.219 listed in will-spam-for-food.eu.org]

[149.72.116.219 listed in will-spam-for-food.eu.org]

[149.72.116.219 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[149.72.116.219 listed in dnsbl.ahbl.org]

[149.72.116.219 listed in dnsbl.ahbl.org]

[149.72.116.219 listed in dnsbl.ahbl.org]

[149.72.116.219 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[149.72.116.219 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[149.72.116.219 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[149.72.116.219 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[149.72.116.219 listed in dnsbl.ahbl.org]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-0.0 SPF_PASS SPF: sender matches SPF record

0.0 FROM_LOCAL_DIGITS From: localpart has long digit sequence

0.3 FROM_LOCAL_HEX From: localpart has long hexadecimal sequence

0.5 L_HELLO_ADDRESS BODY: Greets you by address, not by name

1.5 DEAR_EMAIL BODY: Message contains Dear email address

-0.0 RCVD_IN_MSPIKE_H3 RBL: Good reputation (+3)

[149.72.116.219 listed in wl.mailspike.net]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[149.72.116.219 listed in bl.score.senderscore.com]

1.3 URI_HEX URI: URI hostname has long hexadecimal sequence

0.0 HTML_MESSAGE BODY: HTML included in message

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

-0.0 RCVD_IN_MSPIKE_WL Mailspike good senders

1.0 POSSIBLE_PAYPAL_PHISH_02 Claims to be from paypal but not processed

by any paypal MTA

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

Subject: {SPAM?} Complete your order




nt; font-family: 'Helvetica Neue', Helvetica, system-ui, -apple-sys=

tem, Arial, sans-serif; font-weight: 400; font-style: normal; line-height: =

1.5; font-size: 16px; overflow-wrap: break-word; word-wrap: break-word; wor=

d-spacing: normal; -ms-text-size-adjust: 100%; -webkit-text-size-adjust: 10=

0%; margin: 0 auto; padding: 0;">




0"/>




ss=3Dno, email=3Dno, url=3Dno"/>


message-reformatting"/>












rtant; width: 100% !important; font-family: 'Helvetica Neue', Helve=

tica, system-ui, -apple-system, Arial, sans-serif; font-weight: 400; font-s=

tyle: normal; line-height: 1.5; font-size: 16px; overflow-wrap: break-word;=

word-wrap: break-word; word-spacing: normal; -ms-text-size-adjust: 100%; -=

webkit-text-size-adjust: 100%; margin: 0 auto; padding: 0;" class=3D"full-w=

rap">


0px; max-width: 0px; opacity: 0; overflow: hidden; mso-hide: all; font-fami=

ly: sans-serif; -ms-text-size-adjust: 100%; -webkit-text-size-adjust: 100%;=

">Just checking in



ze-adjust: 100%; -webkit-text-size-adjust: 100%;">=E2=80=87=CD=8F=E2=80=87=

=CD=8F=E2=80=87=CD=8F=E2=80=87=CD=8F=E2=80=87=CD=8F=E2=80=87=CD=8F=E2=80=87=

=CD=8F=E2=80=87=CD=8F=E2=80=87=CD=8F=E2=80=87=CD=8F=E2=80=87=CD=8F=E2=80=87=

=CD=8F=E2=80=87=CD=8F=E2=80=87=CD=8F=E2=80=87=CD=8F=E2=80=87=CD=8F=E2=80=87=

=CD=8F=E2=80=87=CD=8F=E2=80=87=CD=8F=E2=80=87=CD=8F=E2=80=87=CD=8F=E2=80=87=

=CD=8F=E2=80=87=CD=8F=E2=80=87=CD=8F=E2=80=87=CD=8F=E2=80=87=CD=8F=E2=80=87=

=CD=8F=E2=80=87=CD=8F=E2=80=87=CD=8F=E2=80=87=CD=8F=E2=80=87=CD=8F=E2=80=87=

=CD=8F=E2=80=87=CD=8F=E2=80=87=CD=8F=E2=80=87=CD=8F=E2=80=87=CD=8F=E2=80=87=

=CD=8F=E2=80=87=CD=8F=E2=80=87=CD=8F=E2=80=87=CD=8F=E2=80=87=CD=8F=E2=80=87=

=CD=8F=E2=80=87=CD=8F=E2=80=87=CD=8F=E2=80=87=CD=8F=E2=80=87=CD=8F=E2=80=87=

=CD=8F=E2=80=87=CD=8F=E2=80=87=CD=8F=E2=80=87=CD=8F=E2=80=87=CD=8F=E2=80=87=

=CD=8F=E2=80=87=CD=8F=E2=80=87=CD=8F=E2=80=87=CD=8F=E2=80=87=CD=8F=E2=80=87=

=CD=8F=E2=80=87=CD=8F=E2=80=87=CD=8F=E2=80=87=CD=8F=E2=80=87=CD=8F=E2=80=87=

=CD=8F=E2=80=87=CD=8F=E2=80=87=CD=8F=E2=80=87=CD=8F=E2=80=87=CD=8F=E2=80=87=

=CD=8F=E2=80=87=CD=8F=E2=80=87=CD=8F=E2=80=87=CD=8F=E2=80=87=CD=8F=E2=80=87=

=CD=8F=E2=80=87=CD=8F=E2=80=87=CD=8F=E2=80=87=CD=8F=E2=80=87=CD=8F=E2=80=87=

=CD=8F=E2=80=87=CD=8F=E2=80=87=CD=8F=E2=80=87=CD=8F=E2=80=87=CD=8F=E2=80=87=

=CD=8F=E2=80=87=CD=8F=E2=80=87=CD=8F=E2=80=87=CD=8F=E2=80=87=CD=8F=E2=80=87=

=CD=8F=E2=80=87=CD=8F=E2=80=87=CD=8F=E2=80=87=CD=8F=E2=80=87=CD=8F=E2=80=87=

=CD=8F=E2=80=87=CD=8F=E2=80=87=CD=8F=E2=80=87=CD=8F=E2=80=87=CD=8F=E2=80=87=

=CD=8F=E2=80=87=CD=8F=E2=80=87=CD=8F=E2=80=87=CD=8F=E2=80=87=CD=8F=E2=80=87=

=CD=8F=E2=80=87=CD=8F=E2=80=87=CD=8F=E2=80=87=CD=8F=E2=80=87=CD=8F=E2=80=87=

=CD=8F=E2=80=87=CD=8F=E2=80=87=CD=8F=E2=80=87=CD=8F=E2=80=87=CD=8F=E2=80=87=

=CD=8F=E2=80=87=CD=8F=E2=80=87=CD=8F=E2=80=87=CD=8F=E2=80=87=CD=8F=E2=80=87=

=CD=8F=E2=80=87=CD=8F=E2=80=87=CD=8F=E2=80=87=CD=8F=E2=80=87=CD=8F=E2=80=87=

=CD=8F=E2=80=87=CD=8F=E2=80=87=CD=8F=E2=80=87=CD=8F=E2=80=87=CD=8F=E2=80=87=

=CD=8F=E2=80=87=CD=8F=E2=80=87=CD=8F=E2=80=87=CD=8F=E2=80=87=CD=8F=E2=80=87=

=CD=8F=E2=80=87=CD=8F=E2=80=87=CD=8F=E2=80=87=CD=8F=E2=80=87=CD=8F=E2=80=87=

=CD=8F=E2=80=87=CD=8F=E2=80=87=CD=8F=E2=80=87=CD=8F=E2=80=87=CD=8F=E2=80=87=

=CD=8F=E2=80=87=CD=8F=E2=80=87=CD=8F=E2=80=87=CD=8F=E2=80=87=CD=8F=E2=80=87=

=CD=8F=E2=80=87=CD=8F=E2=80=87=CD=8F=E2=80=87=CD=8F=E2=80=87=CD=8F=E2=80=87=

=CD=8F=E2=80=87=CD=8F=E2=80=87=CD=8F=E2=80=87=CD=8F=E2=80=87=CD=8F=E2=80=87=

=CD=8F=E2=80=87=CD=8F=E2=80=87=CD=8F=E2=80=87=CD=8F=E2=80=87=CD=8F=E2=80=87=

=CD=8F=E2=80=87=CD=8F=E2=80=87=CD=8F=E2=80=87=CD=8F=C2=AD=C2=AD=C2=AD=C2=AD=

=C2=AD=C2=AD=C2=AD=C2=AD=C2=AD=C2=AD=C2=AD=C2=AD=C2=AD=C2=AD=C2=AD=C2=AD=C2=

=AD=C2=AD=C2=AD=C2=AD=C2=AD=C2=AD=C2=AD=C2=AD=C2=AD=C2=AD=C2=AD=C2=AD=C2=AD=

=C2=AD=C2=AD=C2=AD=C2=AD=C2=AD=C2=AD=C2=AD=C2=AD=C2=AD=C2=AD=C2=AD=C2=AD=C2=

=AD=C2=AD=C2=AD=C2=AD=C2=AD=C2=AD=C2=AD=C2=AD=C2=AD=C2=AD=C2=AD=C2=AD=C2=AD=

=C2=AD=C2=AD=C2=AD=C2=AD=C2=AD=C2=AD=C2=AD=C2=AD=C2=AD=C2=AD=C2=AD=C2=AD=C2=

=AD=C2=AD=C2=AD=C2=AD=C2=AD=C2=AD=C2=AD=C2=AD=C2=AD=C2=AD=C2=AD=C2=AD=C2=AD=

=C2=AD=C2=AD=C2=AD=C2=AD=C2=AD=C2=AD=C2=AD=C2=AD=C2=AD=C2=AD=C2=AD=C2=AD=C2=

=AD=C2=AD=C2=AD=C2=AD=C2=AD=C2=AD=C2=AD=C2=AD=C2=AD=C2=AD=C2=AD=C2=AD=C2=AD=

=C2=AD=C2=AD=C2=AD=C2=AD=C2=AD=C2=AD=C2=AD=C2=AD=C2=AD=C2=AD=C2=AD=C2=AD=C2=

=AD=C2=AD=C2=AD=C2=AD=C2=AD=C2=AD=C2=AD=C2=AD=C2=AD=C2=AD=C2=AD=C2=AD=C2=AD=

=C2=AD=C2=AD=C2=AD=C2=AD=C2=AD=C2=AD=C2=AD=C2=AD=C2=AD=C2=AD=C2=AD=C2=AD=C2=

=AD=C2=AD=C2=AD=C2=AD=C2=AD=C2=AD=C2=AD=C2=AD=C2=AD=C2=AD=C2=AD=C2=AD=C2=AD=

=C2=AD=C2=AD=C2=AD=C2=AD=C2=AD=C2=AD=C2=AD=C2=AD=C2=AD=C2=AD=C2=AD=C2=A0
iv>


dth=3D"100%" style=3D"background-color: #fafafa; -ms-text-size-adjust: 100%=

; -webkit-text-size-adjust: 100%; mso-table-lspace: 0pt !important; mso-tab=

le-rspace: 0pt !important; border-spacing: 0 !important; border-collapse: c=

ollapse !important; table-layout: fixed !important; margin: auto;" class=3D=

"full-wrap">
djust: 100%;">

<=

td style=3D"-ms-text-size-adjust: 100%; -webkit-text-size-adjust: 100%; mso=

-table-lspace: 0pt !important; mso-table-rspace: 0pt !important; vertical-a=

lign: top;">


dth=3D"600" style=3D"background-color: #ffffff; -ms-text-size-adjust: 100%;=

-webkit-text-size-adjust: 100%; mso-table-lspace: 0pt !important; mso-tabl=

e-rspace: 0pt !important; border-spacing: 0 !important; border-collapse: co=

llapse !important; table-layout: fixed !important; margin: auto;" class=3D"=

email-container">
ize-adjust: 100%;">
ze-adjust: 100%;">

e-adjust: 100%; mso-table-lspace: 0pt !important; mso-table-rspace: 0pt !im=

portant; vertical-align: top;">
order=3D"0" align=3D"center" width=3D"600" style=3D"background-color: #ffff=

ff; -ms-text-size-adjust: 100%; -webkit-text-size-adjust: 100%; mso-table-l=

space: 0pt !important; mso-table-rspace: 0pt !important; border-spacing: 0 =

!important; border-collapse: collapse !important; table-layout: fixed !impo=

rtant; margin: auto;" class=3D"email-container">
ze-adjust: 100%; -webkit-text-size-adjust: 100%;">
e-adjust: 100%; -webkit-text-size-adjust: 100%;">

0; font-family: 'Helvetica Neue', Helvetica, Arial, sans-serif; fon=

t-weight: 400; font-style: normal; -ms-text-size-adjust: 100%; -webkit-text=

-size-adjust: 100%; mso-table-lspace: 0pt !important; mso-table-rspace: 0pt=

!important; vertical-align: top; padding: 30px 60px;" align=3D"left" class=

=3D"column-container-left column-container-right">


-adjust: 100%; -webkit-text-size-adjust: 100%; line-height: 1.5; margin: 0;=

padding: 0;">Dear Customer, doctor@doctor.nl2k.ab.ca

size-adjust: 100%; -webkit-text-size-adjust: 100%;"/>

size-adjust: 100%; -webkit-text-size-adjust: 100%;"/>Our fraud prevention s=

ystem recently logged a $699.99 purchase attempt at shopify Store location =

in Massachusetts (MA).

-size-adjust: 100%;"/>

-size-adjust: 100%;"/>Your transaction of 699.99 USD to SHOPIFY 448085139 =

on 2026-08-20

ust: 100%;"/>

ust: 100%;"/>If this purchase was made by you:

just: 100%; -webkit-text-size-adjust: 100%;"/>

just: 100%; -webkit-text-size-adjust: 100%;"/>Ignore this message. The tran=

saction will clear and show up in your account within 24 hours.

"-ms-text-size-adjust: 100%; -webkit-text-size-adjust: 100%;"/>

"-ms-text-size-adjust: 100%; -webkit-text-size-adjust: 100%;"/>

"-ms-text-size-adjust: 100%; -webkit-text-size-adjust: 100%;"/>If you have =

any questions regarding this matter, please submit a case or call at +16565=

563391

0%;"/>

0%;"/>for immediate verification and account protection.

xt-size-adjust: 100%; -webkit-text-size-adjust: 100%;"/>

xt-size-adjust: 100%; -webkit-text-size-adjust: 100%;"/>Your account safety=

is our top concern, and we appreciate your cooperation.

xt-size-adjust: 100%; -webkit-text-size-adjust: 100%;"/>

xt-size-adjust: 100%; -webkit-text-size-adjust: 100%;"/>Regards

"-ms-text-size-adjust: 100%; -webkit-text-size-adjust: 100%;"/>Support Team=

+16565563391

ust: 100%;"/>

ust: 100%;"/>

ust: 100%;"/>Kindly do not reply to this message, as this address is not ac=

tively monitored.




dth=3D"600" style=3D"background-color: #000000; -ms-text-size-adjust: 100%;=

-webkit-text-size-adjust: 100%; mso-table-lspace: 0pt !important; mso-tabl=

e-rspace: 0pt !important; border-spacing: 0 !important; border-collapse: co=

llapse !important; table-layout: fixed !important; margin: auto; padding: 2=

4px 0;" class=3D"email-container">
%; -webkit-text-size-adjust: 100%;">
; -webkit-text-size-adjust: 100%;">

-ms-text-size-adjust: 100%; -webkit-text-size-adjust: 100%; mso-table-lspac=

e: 0pt !important; mso-table-rspace: 0pt !important; vertical-align: top; p=

adding: 24px 0;">
ign=3D"center" width=3D"600" style=3D"background-color: #000000; -ms-text-s=

ize-adjust: 100%; -webkit-text-size-adjust: 100%; mso-table-lspace: 0pt !im=

portant; mso-table-rspace: 0pt !important; border-spacing: 0 !important; bo=

rder-collapse: collapse !important; table-layout: fixed !important; margin:=

auto;" class=3D"email-container">
%; -webkit-text-size-adjust: 100%;">
; -webkit-text-size-adjust: 100%;">

-webkit-text-size-adjust: 100%; mso-table-lspace: 0pt !important; mso-tabl=

e-rspace: 0pt !important; vertical-align: top; padding: 0 60px;" align=3D"c=

enter" class=3D"column-container-left column-container-right">


0" width=3D"100%" style=3D"-ms-text-size-adjust: 100%; -webkit-text-size-ad=

just: 100%; mso-table-lspace: 0pt !important; mso-table-rspace: 0pt !import=

ant; border-spacing: 0 !important; border-collapse: collapse !important; ta=

ble-layout: fixed !important;">
-webkit-text-size-adjust: 100%;">
e-adjust: 100%; -webkit-text-size-adjust: 100%;">

=3D"width: 100%; -ms-text-size-adjust: 100%; -webkit-text-size-adjust: 100%=

; mso-table-lspace: 0pt !important; mso-table-rspace: 0pt !important; verti=

cal-align: top;">






e=3D"-ms-text-size-adjust: 100%; -webkit-text-size-adjust: 100%; mso-table-=

lspace: 0pt !important; mso-table-rspace: 0pt !important; border-spacing: 0=

!important; border-collapse: collapse !important; table-layout: fixed !imp=

ortant;">
st: 100%;">
t-text-size-adjust: 100%;">

-bottom: 8px; font-family: 'Helvetica Neue', Helvetica, Arial, sans=

-serif; font-weight: 400; font-style: normal; font-size: 12px; mso-height-r=

ule: exactly; line-height: 1.5; -ms-text-size-adjust: 100%; -webkit-text-si=

ze-adjust: 100%; mso-table-lspace: 0pt !important; mso-table-rspace: 0pt !i=

mportant; vertical-align: top;">

webkit-text-size-adjust: 100%;">


-adjust: 100%;">


=






e=3D"-ms-text-size-adjust: 100%; -webkit-text-size-adjust: 100%; mso-table-=

lspace: 0pt !important; mso-table-rspace: 0pt !important; border-spacing: 0=

!important; border-collapse: collapse !important; table-layout: fixed !imp=

ortant;">
st: 100%;">
t-text-size-adjust: 100%;">

#ffffff; font-family: 'Helvetica Neue', Helvetica, Arial, sans-seri=

f; font-weight: 400; font-style: normal; font-size: 12px; mso-height-rule: =

exactly; line-height: 1.5; -ms-text-size-adjust: 100%; -webkit-text-size-ad=

just: 100%; mso-table-lspace: 0pt !important; mso-table-rspace: 0pt !import=

ant; vertical-align: top;">







mso-line-height-rule: exactly; -ms-text-size-adjust: 100%; -webkit-text-si=

ze-adjust: 100%;" class=3D"mobile-hide">
idth: 600px; font-size: 1px; line-height: 1px; mso-line-height-rule: exactl=

y; -ms-text-size-adjust: 100%; -webkit-text-size-adjust: 100%; mso-table-ls=

pace: 0pt !important; mso-table-rspace: 0pt !important; vertical-align: top=

;">
ekplsw.png" alt=3D"" width=3D"600" height=3D"1" style=3D"display: block; wi=

dth: 600px; height: 1px; -ms-text-size-adjust: 100%; -webkit-text-size-adju=

st: 100%; -ms-interpolation-mode: bicubic; outline: none; text-decoration: =

none; border-width: 0;" border=3D"0"/>










E4-449DF4F0?en=3DAADRVhVm%2B%2Flj%2BAHik%2BgIK2tMvl%2FlHxdV2VK4Q3oOa9kDnYSK=

dwzVC%2F4SVOFeK4Ctt7ARWscGRr2vpCEM2F%2FRFySOn9dNw95xHCr%2FiDkdJVIr8E9kbbWf4=

EJOthk%2BH%2FknYJ33zeBIKvfHLcJMNNrEvAVs3fzRDHr2%2FmvuSHDnmGSGOJ%2FdsJUS2hBu=

hh3drepBEBxntylY7vVL4WylHPkyDJO0sA6HuabMnqamv1Vht2rZDHsV2w%2BkiDfvjUfZFLsc3=

YeAUnndTZT1cGsO3cC06LA0lVHyzz1NdTkzPdbwhBXn%2B3x4hs1Gy42O567mEAJrL0L%2Beov2=

eZ3dkPKheKgcOxESL6%2FbInMBQwfNgv95R2Ew1exNPcUFrmbC0O8xJ4Bx22WQN9CMAFmFfqAkS=

1vzfy3V4gm5LfyQmrCkQf%2BLLQcKx5%2B%2B5oYv5715GZupoZYmIHTNf8q3Ku2KeYc0C14Nkf=

x5dwQTmYoQrJpsUD5kh5W%2B%2BmH8uIt%2FCiseF%2FgZXoYnig4cjEP1vkol3rWTKAQpzr4Jf=

9rugNhtJ84xFpEe6qIGjnB%2BeFxqDiXYjmxIlO7O6PxWEF7CR6GOopd5CPNf1tluZjriJ5oYrg=

WaTvXvZNiv%2FSErrnZwiF7ZgU7kHQ%3D%3D" style=3D"display:none"/>
>

Nk.ca credential phishing

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 20 Aug 2026 13:20:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.5 (FreeBSD))

(envelope-from )

id 1wx8I8-00000000AHx-1AHO

for dave@doctor.nl2k.ab.ca;

Thu, 20 Aug 2026 13:19:08 -0600

Resent-From: The Doctor

Resent-Date: Thu, 20 Aug 2026 13:19:08 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from il-aplus6.aspirationcloud.com ([64.202.117.210]:52094)

by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

(Exim 4.99.5 (FreeBSD))

(envelope-from )

id 1wx6UA-00000000H6K-1YK5

for sales@nk.ca;

Thu, 20 Aug 2026 11:23:34 -0600

DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed;

d=advcylinderheads.com; s=default; h=Content-Transfer-Encoding:Content-Type:

MIME-Version:Message-ID:Subject:From:To:Date:Sender:Reply-To:Cc:Content-ID:

Content-Description:Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc

:Resent-Message-ID:In-Reply-To:References:List-Id:List-Help:List-Unsubscribe:

List-Subscribe:List-Post:List-Owner:List-Archive;

bh=WhpLgV4PKvq0nyQDQkFMJKYPhstCOvPQMecn0hk20JI=; b=MWl9MnEg4Q8XY/1n/OliEnNJ3N

bBFUxCCXQcDZtITObM+txzJMYvwv+5t155+yPMgrNcnjeJtXic+053RzNHMyY127FmrxaFNIxS4Ee

ACu4YuWokT4ZNKfQmSdTk10AaH121oM/Q7mfa9eRQ4wTz/R9gyzDCFuuZPrc3T/bH0zZw7djC6J5h

yRe6HzEm+3axzEmvaJ/Z2EpIpVnuppfMG/Z3avAeOB40aYx+FVrTSOEGUMI1gM3ej8w/BU6vMDbYA

rgcVNGXqhjaDIrQOPbUH+hw0mVDnMh8RyNqB8fXGN4Mx1sB0AeA+IOSXZ/7P9+E4tqbLN4i6Ymj6G

ZIWCakNg==;

Received: from advcylin by il-aplus6.aspirationcloud.com with local (Exim 4.99.5)

(envelope-from )

id 1wx6TI-000000003zT-04Wv

for sales@nk.ca;

Thu, 20 Aug 2026 12:22:32 -0500

Date: Thu, 20 Aug 2026 17:22:31 +0000

To: sales@nk.ca

From: "=?utf-8?Q?nk.ca?="

Subject: =?utf-8?Q?=49ncoming=20=4dessages=20=46or=20Sales=40nk.ca=20=50laced=20=4fn=20=48old?=

Message-ID:

X-Priority: 1

MIME-Version: 1.0

Content-Type: text/html; charset=UTF-8

Content-Transfer-Encoding: 8bit

X-AntiAbuse: This header was added to track abuse, please include it with any abuse report

X-AntiAbuse: Primary Hostname - il-aplus6.aspirationcloud.com

X-AntiAbuse: Original Domain - nk.ca

X-AntiAbuse: Originator/Caller UID/GID - [1070 1074] / [47 12]

X-AntiAbuse: Sender Address Domain - il-aplus6.aspirationcloud.com

X-Get-Message-Sender-Via: il-aplus6.aspirationcloud.com: authenticated_id: advcylin/only user confirmed/virtual account not confirmed

X-Authenticated-Sender: il-aplus6.aspirationcloud.com: advcylin

X-Spam_score: 11.7

X-Spam_score_int: 117

X-Spam_bar: +++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Pending Messages Hi Sales,



Content analysis details: (11.7 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[64.202.117.210 listed in will-spam-for-food.eu.org]

[64.202.117.210 listed in will-spam-for-food.eu.org]

[64.202.117.210 listed in will-spam-for-food.eu.org]

[64.202.117.210 listed in will-spam-for-food.eu.org]

[64.202.117.210 listed in will-spam-for-food.eu.org]

[64.202.117.210 listed in will-spam-for-food.eu.org]

[64.202.117.210 listed in will-spam-for-food.eu.org]

[64.202.117.210 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[64.202.117.210 listed in dnsbl.ahbl.org]

[64.202.117.210 listed in dnsbl.ahbl.org]

[64.202.117.210 listed in dnsbl.ahbl.org]

[64.202.117.210 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[64.202.117.210 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[64.202.117.210 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[64.202.117.210 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[64.202.117.210 listed in dnsbl.ahbl.org]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-0.0 T_RP_MATCHES_RCVD Envelope sender domain matches handover relay

domain

0.0 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level mail

domains are different

1.3 URI_HEX URI: URI hostname has long hexadecimal sequence

1.5 MR_STRANGE_QUESTION URI: No description available.

0.0 HTML_MESSAGE BODY: HTML included in message

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.1 MXG_EMAIL_FRAG BODY: URI with email in fragment

3.0 VOWEL_URI_7 RAW: URI hostname with 7+ consecutive vowels

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

0.8 SARE_FROM_SPAM_WORD3 I don't know people named this!

2.5 FROM_IN_TO_AND_SUBJ From address is in To and Subject

0.1 TO_IN_SUBJ To address is in Subject

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[64.202.117.210 listed in bl.score.senderscore.com]

Subject: {SPAM?} =?utf-8?Q?=49ncoming=20=4dessages=20=46or=20Sales=40nk.ca=20=50laced=20=4fn=20=48old?=







Pending Messages



























Hi Sales,



You have incoming messages pending on the nk.ca

mail server.



Review your pending messages through your authorized mail portal.



Open Mail Portal



Regards,
nk.ca



Nigerian spam

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 20 Aug 2026 13:19:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.5 (FreeBSD))

(envelope-from )

id 1wx8Hy-00000000AFM-1wzv

for dave@doctor.nl2k.ab.ca;

Thu, 20 Aug 2026 13:18:58 -0600

Resent-From: The Doctor

Resent-Date: Thu, 20 Aug 2026 13:18:58 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from [190.153.103.99] (port=16205 helo=CORFIN-EX2019.corfinmp.com)

by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

(Exim 4.99.5 (FreeBSD))

(envelope-from )

id 1wx6Jd-00000000FUe-3RIQ

for doctor@doctor.nl2k.ab.ca;

Thu, 20 Aug 2026 11:12:43 -0600

Received: from CORFIN-EX2019.corfinmp.com (193.193.1.3) by

CORFIN-EX2019.corfinmp.com (193.193.1.3) with Microsoft SMTP Server

(version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id

15.2.1544.36; Thu, 20 Aug 2026 13:11:12 -0400

Received: from [172.94.9.39] (193.193.1.29) by CORFIN-EX2019.corfinmp.com

(193.193.1.3) with Microsoft SMTP Server id 15.2.1544.36 via Frontend

Transport; Thu, 20 Aug 2026 13:11:08 -0400

Content-Type: text/plain; charset="iso-8859-1"

MIME-Version: 1.0

Content-Transfer-Encoding: quoted-printable

Content-Description: Mail message body

Subject: Good News

To: Recipients

From: =?utf-8?q?Fran=C3=A7ois_Masse_=3Cadmin=40corfinmp=2Ecom=3E?=@doctor.nl2k.ab.ca

Date: Thu, 20 Aug 2026 10:11:28 -0700

Reply-To:

Message-ID:

X-Spam_score: 12.5

X-Spam_score_int: 125

X-Spam_bar: ++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: I am François Masse, a retiree from Hawkesbury, Ontario,

and the fortunate winner of a $55 million LOTTO MAX jackpot from the January

9, 2026 draw. I have decided to donate the sum of $3,000,000 each [...]



Content analysis details: (12.5 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[193.193.1.29 listed in will-spam-for-food.eu.org]

[193.193.1.29 listed in will-spam-for-food.eu.org]

[193.193.1.29 listed in will-spam-for-food.eu.org]

[193.193.1.29 listed in will-spam-for-food.eu.org]

[193.193.1.29 listed in will-spam-for-food.eu.org]

[193.193.1.29 listed in will-spam-for-food.eu.org]

[193.193.1.29 listed in will-spam-for-food.eu.org]

[193.193.1.29 listed in will-spam-for-food.eu.org]

[193.193.1.3 listed in will-spam-for-food.eu.org]

[193.193.1.3 listed in will-spam-for-food.eu.org]

[193.193.1.3 listed in will-spam-for-food.eu.org]

[193.193.1.3 listed in will-spam-for-food.eu.org]

[193.193.1.3 listed in will-spam-for-food.eu.org]

[193.193.1.3 listed in will-spam-for-food.eu.org]

[193.193.1.3 listed in will-spam-for-food.eu.org]

[193.193.1.3 listed in will-spam-for-food.eu.org]

[190.153.103.99 listed in will-spam-for-food.eu.org]

[190.153.103.99 listed in will-spam-for-food.eu.org]

[190.153.103.99 listed in will-spam-for-food.eu.org]

[190.153.103.99 listed in will-spam-for-food.eu.org]

[190.153.103.99 listed in will-spam-for-food.eu.org]

[190.153.103.99 listed in will-spam-for-food.eu.org]

[190.153.103.99 listed in will-spam-for-food.eu.org]

[190.153.103.99 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[190.153.103.99 listed in dnsbl.ahbl.org]

[190.153.103.99 listed in dnsbl.ahbl.org]

[190.153.103.99 listed in dnsbl.ahbl.org]

[190.153.103.99 listed in dnsbl.ahbl.org]

[193.193.1.29 listed in dnsbl.ahbl.org]

[193.193.1.29 listed in dnsbl.ahbl.org]

[193.193.1.29 listed in dnsbl.ahbl.org]

[193.193.1.29 listed in dnsbl.ahbl.org]

[193.193.1.3 listed in dnsbl.ahbl.org]

[193.193.1.3 listed in dnsbl.ahbl.org]

[193.193.1.3 listed in dnsbl.ahbl.org]

[193.193.1.3 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[190.153.103.99 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[190.153.103.99 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[190.153.103.99 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[190.153.103.99 listed in dnsbl.ahbl.org]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-0.0 SPF_PASS SPF: sender matches SPF record

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in digit

[francoismass449(at)gmail.com]

0.0 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level mail

domains are different

2.5 US_DOLLARS_3 BODY: Mentions millions of $ ($NN,NNN,NNN.NN)

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[190.153.103.99 listed in bl.score.senderscore.com]

2.0 RATWR8_MESSID Message-ID with excessive dashes and dollars

1.3 RDNS_NONE Delivered to internal network by a host with no rDNS

0.0 LOTS_OF_MONEY Huge... sums of money

2.0 MONEY_NOHTML Lots of money in plain text

0.2 XFER_LOTSA_MONEY Transfer a lot of money

0.2 MONEY_FREEMAIL_REPTO Lots of money from someone using free email?

2.5 FREEMAIL_FORGED_REPLYTO Freemail in Reply-To, but not From

Subject: {SPAM?} Good News



I am Fran=E7ois Masse, a retiree from Hawkesbury, Ontario, and the fortunat=

e winner of a $55 million LOTTO MAX jackpot from the January 9, 2026 draw. =

I have decided to donate the sum of $3,000,000 each to five person kindly c=

ontact me now for more information=20

Web/SEO/App spam from Microsoft Outlook

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 20 Aug 2026 13:19:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.5 (FreeBSD))

(envelope-from )

id 1wx8Hh-00000000ACq-3CjQ

for dave@doctor.nl2k.ab.ca;

Thu, 20 Aug 2026 13:18:41 -0600

Resent-From: The Doctor

Resent-Date: Thu, 20 Aug 2026 13:18:41 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-japaneastazolkn19012054.outbound.protection.outlook.com ([52.103.43.54]:16451 helo=TYPPR03CU001.outbound.protection.outlook.com)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.99.5 (FreeBSD))

(envelope-from )

id 1wx6Hy-00000000FEC-0GhW

for sales@nk.ca;

Thu, 20 Aug 2026 11:11:00 -0600

ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none;

b=VDXOXMifVh01yt0z9LfutFU60wbqwaPvEFDyYkn6729N13TEntwzr5kdkbOtmBq8qY2cPDg9SLI8JmF1jwP1MN42aCfdlrPY0aiyyOqHvhdS390VzcaKIZklbZiYZWTV8onDv/yQ9tAchGNV0wgB0MHfYlxGp0FY0SgNm5iEx2a1EVex6TW80AsNT2d54Z6RQvtUivDQfu4PLn2Jx+f9ujk/XvMVb+Q3G8wqYq/UeukfmEKvvQxVzMOmHw/J7mgrKQPUDKYlvD2cRXtEgzLZzrVOGTzj/oa+aILkEYcwM+LKavxYmh3IUAMIsL4Ol6c8JzuzdGttuilWT4jStzUFpg==

ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;

s=arcselector10001;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1;

bh=XYKcl8/wZGPj2fjidittmatM5Ej7b3rYJDAnGF5afpE=;

b=NOhOu4aXzUk66kbuRV9d7Dak7P2DQn7skKnsGJzDPDHHawkPGmSYpEKHWLBwftwx8MFYfrAUP5AXMp7v8V5eQtptnJc+ZuI9IYoHfGBjgoLlG3L4iWDeHO9vcrA2wWArGqtdJUOHYnvla2dECD5o7TMudEhCDw67RLhxApchrsAtSFEeJQ4F2cLGHQPqttie+nvziPSi0HHQE3tXfrdHavS/Owujz9rBOw5xnzQsgvy7d7HqaA3eagnvR8Z6JAmtfs6GN87GoXvcbXoKArkcRYebk0sM5+kT2WqaI4gU/fgKjMSHBnJLSPmGzWKNtQPmxmfIwtLaL4N7VuUUMi4XPQ==

ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=none; dmarc=none;

dkim=none; arc=none

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=outlook.com;

s=selector1;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck;

bh=XYKcl8/wZGPj2fjidittmatM5Ej7b3rYJDAnGF5afpE=;

b=XqcMymRdOHOEOQwQYu7EfR6AabFC1JnJ6Ls3LZcTnJx2QTPr3MFNlJh2z/FYLzq2+KnTF0wVrivqd0kgbEyqyTx3ELUyOfQixIdcdySgzEc6PgrcDYx4UWpGcg7NlrNJZOjgnGmBQ7BvzFGPwoNcf/lwpm07Zm3r/oe+6ICZVmNv8JK7CwXwV962Fxdn5f8KdjfXNxiuluav8QDojyNxFhmZkD6FqJ4qgmTF3+vb1K+KSx3cVpyPLwEPQh1jZjd20qGDSn+mXg7qBFSPHSPyuvpxZ6S4lDhUIXQDfm+dIKWfbGvf3yUvsxhckJ/glXHprI4WWJUePpoiXg58yMzPbg==

Received: from OS8PR04MB8301.apcprd04.prod.outlook.com (2603:1096:604:2b1::7)

by KL1PR04MB8169.apcprd04.prod.outlook.com (2603:1096:820:146::5) with

Microsoft SMTP Server (version=TLS1_2,

cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.360.3; Thu, 20 Aug

2026 17:08:31 +0000

Received: from OS8PR04MB8301.apcprd04.prod.outlook.com

([fe80::222a:90f7:fe8a:2314]) by OS8PR04MB8301.apcprd04.prod.outlook.com

([fe80::222a:90f7:fe8a:2314%6]) with mapi id 15.21.0360.003; Thu, 20 Aug 2026

17:08:31 +0000

From: Michael John

Subject: We can help you-----?

Thread-Topic: We can help you-----?

Thread-Index: AQHdMMZs8DvyF9xyfEy/AZLqYctt1w==

Date: Thu, 20 Aug 2026 17:08:30 +0000

Message-ID:



Accept-Language: en-GB, en-US

Content-Language: en-GB

X-MS-Has-Attach:

X-MS-TNEF-Correlator:

msip_labels:

x-ms-publictraffictype: Email

x-ms-traffictypediagnostic: OS8PR04MB8301:EE_|KL1PR04MB8169:EE_

x-ms-office365-filtering-correlation-id: 2ea7d173-92b5-420f-4a65-08defedda8d1

x-microsoft-antispam:

BCL:0;ARA:14566002|39105399006|24021099003|31061999003|24071999003|8062599012|8060799015|19110799012|15080799012|15030799006|37011999003|55001999006|24121999003|22091999003|20031999006|25010399006|4140399003|43065399003|31055399003|40105399003|260806224601699006|2607281247196008|102099032|3412199025|440099028;

x-microsoft-antispam-message-info:

=?iso-8859-1?Q?0ZMUYrGvexA1V414eW+1J1YrJblheROPpUo4CBaQjBKgm3ZIZ4wx9XfqNZ?=

=?iso-8859-1?Q?vZo5807vMOFVwVz2xUq2CSPGpaVnBnPPnhjONwcXmzGl4WD7q3iKFuJVZi?=

=?iso-8859-1?Q?zFp+aF89LgEMlsRf8ORFYacdGEt2UGz55towMpmhpuF5L+HJAR98i+zgte?=

=?iso-8859-1?Q?gJuikpRQaisi8+pIU76xnLnuOplmqYKakjT3A05+EIi+UsDiIFDKMe34Z6?=

=?iso-8859-1?Q?TyaAmrQoH12tDP+M6RjHU1TkiOH8ZD2TrlyurYE+a3HusA1NdBZHFUIKUp?=

=?iso-8859-1?Q?JajoKdbYtJxH8nu9OL79Gqry3YvOkI1ekz/kvRVuZMIkb7r9zm0ZM0BhA7?=

=?iso-8859-1?Q?zTwaZbHGjTu5OKSbQT7+Fe8LPnxKGpyag8ZYtwqogp1W22wlXxcd1dAwP7?=

=?iso-8859-1?Q?bQv+TLdtGzytZPk2Aqe/YnS+S+5EYg4gdiGOmXK5C5/LYOUbsOicoCbdin?=

=?iso-8859-1?Q?Lxxz77Ip6yah2ZhnRKgqvGGVhTvXQP7U1rCdbfsmx/1sbkNuvdAD/1ym1c?=

=?iso-8859-1?Q?Dc+F8Lm3Fjh6kdwo+aCp98/Ib04CYpjmQmCQJQy86Hv2W0kPCGi+vg+3aa?=

=?iso-8859-1?Q?JnP4EiHIZY66LETCGWTT6jr3tpld3DVKqa1SvWcqd9bGyRW+8pKmYM7UUF?=

=?iso-8859-1?Q?lqRHUm/Gt+FQ3L8lCFRXnm96+4J4N72Jvy8eBoe6UF5f3z9D3epRIfKU3u?=

=?iso-8859-1?Q?Qpg351tZ18EX7UYyB49iSzVkEKpuiAczhadka8ko9SI0RzIslxsOtUXk2A?=

=?iso-8859-1?Q?MfQU9ArFUF0i1t25RNJnWj7XZ2Pn29ItlgVM4+Rj4nDL/lRMqeZfW2xTEM?=

=?iso-8859-1?Q?j752y/Pt2uTAQzgs9PGdfXYfdmZAsyrHfy13OGHvs82ln3KkxPkUQjaBqF?=

=?iso-8859-1?Q?DTyDSg0GkyClLH6NcC3VAWdqsb2EAebLG/8dLiYeJHUBthMdlXyk2y/VBL?=

=?iso-8859-1?Q?34IJRFvgI70+d4jqAhr5vTCzWUiZ2CwWprXmYijXdXni3cGfoeq3LsYOO/?=

=?iso-8859-1?Q?9TBYsfHfOSOhsalwqJ0IMFNSYYYeoH7rk1/jElVB44cVOD83D9aRF3k98/?=

=?iso-8859-1?Q?q2GOcMRHIhsw8jLe+JyesqSECFxyNxHGywLcgxbyqOH01zWcqTOfgQ0KVD?=

=?iso-8859-1?Q?ZlgAjB6e/d/RYoi1AkUdXL6IN8Zsagr9R2Cm39of2IjU0lk5lWidNLfwF6?=

=?iso-8859-1?Q?xR2hPtNMd7OajkoKU4s98VrEaor+u74CCrBh/I5t+fN1Kh1D2G55YSL9M7?=

=?iso-8859-1?Q?s3JByccgDBV/knghbWS/rvls9UnWhKMH6agh+oZ/MHQbJKldxiyVELIVdh?=

=?iso-8859-1?Q?XvrhZrS1vfIYbFwvLKjShQXxLw=3D=3D?=

x-ms-exchange-antispam-messagedata-chunkcount: 1

x-ms-exchange-antispam-messagedata-0:

=?iso-8859-1?Q?tiEvYE/VkCcmCikMt5JvC9zp8WfuD6xXAl9DJXysnxWhWVhlFCJOGFJecT?=

=?iso-8859-1?Q?0SBUwfCpli5AzWitvtPfHvuLqiZhn3L83OEWUnkLBBEBQGIGBQyEv5A/Qd?=

=?iso-8859-1?Q?dcvkVIhHvkkpE0wgtBTGT1oEk++j1kX2AHHa39CvD/GnzGwRih22RvpbpA?=

=?iso-8859-1?Q?dSeeEbsxpOPNznY207uFEnHi0warml/HznNLj8Tqo8zxyFGOYNy75tvWIp?=

=?iso-8859-1?Q?O6UGrSSkLlnPCQ+A0oPW1o6G+8LQaChpZDAmYDcYLAHJ4ONbDyYo5HlO6w?=

=?iso-8859-1?Q?Vf6xhwpK1mnF5lwAGpSwqpPpJC2gRzjM1mcNKbTqih0U8UgYYTu2pGTA2A?=

=?iso-8859-1?Q?rdd8KpsvysPj21fdHqOOiSmdjeaczrSRM0gIUJOQqxaRCTHrzmXYkDn1GY?=

=?iso-8859-1?Q?VAlMwzW/6CU3ZrvnC43HWfaTMYrbjYnHc0FLLQYEiDS52YORw9vmDff5r2?=

=?iso-8859-1?Q?6WNTKmmg6Ci4bkb0pxjios3BcQDQs/wkCp2tZ53b/3Wr6MYq0w1aFVBIiy?=

=?iso-8859-1?Q?5ctH7JKI6TMERYgqVqt7UQ9eIQwCBbuwVo8BR2A+bzjLBgkSx3LHI5FHhh?=

=?iso-8859-1?Q?e+TFdTXM+ZCyo7fv4yW7SQDlqdaos5M/My0IFiEvR9oMcGlLL0APaUHZBZ?=

=?iso-8859-1?Q?U3IFsPCwrrX0NvA/0rzxTgeqU/DDZLqiJQyZAuuOl5MwgBLUmSU4Yrh6Gq?=

=?iso-8859-1?Q?+5EfZU2SQ7EnOT+xWgY1tl1VJtLWfowzHSdagKGGWqpDqXy4N2cUz+KVSb?=

=?iso-8859-1?Q?ivk+zLBRkMerNPofV5mCiqEXwdgLfy2iLVyvlDRl1pkZhN1cQcfWmvGPEh?=

=?iso-8859-1?Q?nAi+q3OVKJZwVFK3cu0Sc3ddjmV5zLq2xN5Pcht2A0Jcm6FKE6RC796PZp?=

=?iso-8859-1?Q?uRRVnbQHP6cCl8aDqjUaVnBitWLgczfLTmlAa30eSAAbQrSOzwtcjPz9IK?=

=?iso-8859-1?Q?NMVnp9xjjndX8n+ikrd8IO6MXWBieVbSHhfnAiLCqwZ2OHkZKYyyqk+AGr?=

=?iso-8859-1?Q?eunpyVgtfBadIPK8KTRBDAehNJPjLg62vimM6qKopkqVN6hG+OYCk+zwRj?=

=?iso-8859-1?Q?riZo55SVr+b+FvbaG2b9Fu5SrxnmTxxMPhjOagB6ZXVrnTnjNA3gaClziw?=

=?iso-8859-1?Q?kJk35BcWIDAR5rdiTXX0DL/eArV1kBNk6TF5qQXqZeppYZqsiRUtIthuDI?=

=?iso-8859-1?Q?pH+WTPveMrX+dO3cBR5SxarWkveuigCAOonlzSMMXrtfTpnpy4+3ppA9kh?=

=?iso-8859-1?Q?eB5HAxtToOQwzAc33taebbgGQLvNxVIKfXu3vjNiT+KtXAcLSX7BVfc4fU?=

=?iso-8859-1?Q?8o21I380N7bwAZBN7nVBGqr/bybI6uMiHtc6HLHoCmohM55+ntuyx8bpQb?=

=?iso-8859-1?Q?Bd+mdVtfV64etO5OcL1AotRpirWpv6GUVG6zb7jCMnVE4OobAwMat93gDq?=

=?iso-8859-1?Q?2SfbT03cR8Oq4wqYaYBFbqAI4BcClcLFluFdKWvbiuRaiS/qqLJkNw3qKD?=

=?iso-8859-1?Q?7SBVo9VDUcTiknp5ZdLzTR?=

Content-Type: multipart/alternative;

boundary="_000_OS8PR04MB830192B5782BFFC73F16E64F8AA42OS8PR04MB8301apcp_"

MIME-Version: 1.0

X-OriginatorOrg: outlook.com

X-MS-Exchange-CrossTenant-AuthAs: Internal

X-MS-Exchange-CrossTenant-AuthSource: OS8PR04MB8301.apcprd04.prod.outlook.com

X-MS-Exchange-CrossTenant-RMS-PersistedConsumerOrg: 00000000-0000-0000-0000-000000000000

X-MS-Exchange-CrossTenant-Network-Message-Id: 2ea7d173-92b5-420f-4a65-08defedda8d1

X-MS-Exchange-CrossTenant-originalarrivaltime: 20 Aug 2026 17:08:30.5585

(UTC)

X-MS-Exchange-CrossTenant-fromentityheader: Hosted

X-MS-Exchange-CrossTenant-id: 84df9e7f-e9f6-40af-b435-aaaaaaaaaaaa

X-MS-Exchange-CrossTenant-rms-persistedconsumerorg: 00000000-0000-0000-0000-000000000000

X-MS-Exchange-Transport-CrossTenantHeadersStamped: KL1PR04MB8169



--_000_OS8PR04MB830192B5782BFFC73F16E64F8AA42OS8PR04MB8301apcp_

Content-Type: text/plain; charset="iso-8859-1"

Content-Transfer-Encoding: quoted-printable



Hi,



I found some errors on your website and would like to share them with you. =

Could I send you a screenshot to illustrate the issues?



If your answer is YES, then I will share the error report.



Thanks,



--_000_OS8PR04MB830192B5782BFFC73F16E64F8AA42OS8PR04MB8301apcp_

Content-Type: text/html; charset="iso-8859-1"

Content-Transfer-Encoding: quoted-printable








1">








Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">

Hi,
v>


nt, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; c=

olor: rgb(0, 0, 0);">

 <=

/div>


nt, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; c=

olor: rgb(0, 0, 0);">

I found some e=

rrors on your website and would like to share them with you. Could I send y=

ou a screenshot to illustrate the issues?



nt, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; c=

olor: rgb(0, 0, 0);">

 <=

/div>


nt, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; c=

olor: rgb(0, 0, 0);">

If your answer=

is YES, then I will share the error report.



nt, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; c=

olor: rgb(0, 0, 0);">

 <=

/div>


Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">

Thanks,=









--_000_OS8PR04MB830192B5782BFFC73F16E64F8AA42OS8PR04MB8301apcp_--

Catalogue inquiry spam from Google Gmail

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 20 Aug 2026 10:16:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.5 (FreeBSD))

(envelope-from )

id 1wx5QY-00000000MOc-0xqP

for dave@doctor.nl2k.ab.ca;

Thu, 20 Aug 2026 10:15:38 -0600

Resent-From: The Doctor

Resent-Date: Thu, 20 Aug 2026 10:15:38 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-wm1-f104.google.com ([209.85.128.104]:44142)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.99.5 (FreeBSD))

(envelope-from )

id 1wx4H0-000000007Jh-3eP2

for doctor@netknow.ca;

Thu, 20 Aug 2026 09:01:53 -0600

Received: by mail-wm1-f104.google.com with SMTP id 5b1f17b1804b1-495590dde14so27604915e9.0

for ; Thu, 20 Aug 2026 08:00:55 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=nwhssasi-com.20251104.gappssmtp.com; s=20251104; t=1787238049; x=1787842849; darn=netknow.ca;

h=message-id:date:reply-to:mime-version:content-type:to:subject:from

:from:to:cc:subject:date:message-id:reply-to:content-type;

bh=YIj577gQN3gcbkCNwFCceFilc43bUo7ya+iM6grQMEk=;

b=vJqgTXacJ93xqvLkaYZopLVcFBjhdfCI4QTWcVgp/T8Yo1KExChM7IN76l5PdVfNKE

9Tw1I5qweqRqqP6AcgW0r53TlJiSAwr0qYzLSr4hnnDTe30CsIWK/IiBGzf5kY4Eu+xE

GWHaRdD3J+EUmXFFv3NQRl9DHpRatmZCAM0FXFnoSuO3U5/p8IgqPkgWwVrCnWHgyT76

QCzuwmR7kBOP0vZQ2Zbr8SaN3wB4rDAhgo3jbcweVgWTLoIUT2W8MFoWlvJ3q6qBCtCj

nZco5LposDgGWaU6zhxw8PpCGvnMepNx+m+DXiuGmenkaht5GC++bfOZoYi25DoyErmL

B2Bw==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20251104; t=1787238049; x=1787842849;

h=message-id:date:reply-to:mime-version:content-type:to:subject:from

:x-gm-gg:x-gm-message-state:from:to:cc:subject:date:message-id

:reply-to:content-type;

bh=YIj577gQN3gcbkCNwFCceFilc43bUo7ya+iM6grQMEk=;

b=GVeNkHUEBmWmlta3B9cVSalybhz32Zvx9Jfxn98KfDXnl6bBatVAt9pH0m1JgWNBbq

U4IqdzVABfEnQ/3xN9ggUfGHchqNgoZriPSgToqS35NEnuC8clSBf960YlKUPWWb+16N

XIjsBLJQuRMgEvWlt0uCfKfwnnj58Q193ULw+sdp86Qr5dg4Th4NkO+lNvO8Ca3tplBY

PXQZaI0+ha/ntoSPYLlhHrIAQHAT/vyQgPI0T3IJZqJomZFMCybodfOJqBeSoKlGK1nI

3tdEGYG6utP0/fhavQLTHLHmRz2YyCc3juAIfeU8zR3S2bsmyd7AFD7FD2gP1/JnxrQC

4FvA==

X-Gm-Message-State: AOJu0YwOgLNCUjg0XBHKJK2INdcUJ07iz/2TyDWri0zvjV1CzaQXB5Qu

91sd3Z0k4fH53cS0qMJ8kmu+VtoRJsfRPuyq1rHSZSIfI3CNsfN9XsZb5qaqpzuzVniZA/TIVmW

BWyj+gl5YAtOqPP/OPLGmnkTv3QGl8q7K5BCqQkB5GZbfh20=

X-Gm-Gg: AR+sD13EEFu5Vyjw15O+P8qVJwU2+FrDmVxFrMhmdKciX5s6o9mpUQ5ipgxnitLqDGg

vEWF3tD1dsaCCC01XUrh733p7Ty02UMWJjZ0rPCEvz0DnDw7keIcZEVq5d0JKtiFcOhAy+/DaUZ

NKrdrrXFuYz6m80RyhHvqs0M8r+hgkFizATOCpNmLEYo6zROUaI4CFyljxN6BtqVXg4cmeBzd+L

No8qNNzIWFlfVjVzaqnf7UbXiCJlWRT18HpmO03bmAr0O6viJYyhIcqXzlzkChLaLLRsUdzE1AF

2LSONKBEbqQ/9ynvhSNim2uVUffF52p3kam5qnjURwAAQoRS9mHYoWWvP7XEZigO50VWpMDtonS

Lbzkeil/H8bMqaAY92Gv0nLsSsAZ7hd+K3vJfWJwwI+k=

X-Received: by 2002:a05:600c:4e55:b0:499:a07d:a482 with SMTP id 5b1f17b1804b1-499aa1a28efmr267985925e9.10.1787238048512;

Thu, 20 Aug 2026 08:00:48 -0700 (PDT)

Received: from WIN-CLVG3PFJJET (ip31-70-65-27.pbiaas.com. [31.70.65.27])

by smtp-relay.gmail.com with ESMTPS id 5b1f17b1804b1-499ad8ec7cesm17562875e9.0.2026.08.20.08.00.48

for

(version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128);

Thu, 20 Aug 2026 08:00:48 -0700 (PDT)

X-Relaying-Domain: sasinm.com

From: "SCAFFCO CONSTRUCTION INC."

Subject: Product Sourcing Inquirry

To:

Content-Type: multipart/alternative; boundary="m7R=_uFiox8LgKUUeZilQKIUJR2vXwRpzS"

MIME-Version: 1.0

Reply-To:

Date: Thu, 20 Aug 2026 15:00:48 +0000

Message-Id: <20482026080015E6D8C46616-4D9D4164F8@sasinm.com>



This is a multi-part message in MIME format



--m7R=_uFiox8LgKUUeZilQKIUJR2vXwRpzS

Content-Type: text/plain; charset="iso-8859-1"

Content-Transfer-Encoding: quoted-printable





Good day,



I am writing to inquire about your product, Can you give me your price=

list or latest catalog if you have it. We have needs for a big order.=

Waiting for your feedback. Thanks



Regards

Bryo Evans

Email:bryon20221@gmail.com



--m7R=_uFiox8LgKUUeZilQKIUJR2vXwRpzS

Content-Type: text/html; charset="iso-8859-1"

Content-Transfer-Encoding: quoted-printable








8859-1">


le=3D1"> <=

title>Product Sourcing Inquirry



Good =

day,

I am writing to inquire about your product, Can you give me=

your price list or latest catalog if you have it. We have needs for a=

big order. Waiting for your feedback. Thanks

Regards
Bryo Ev=

ans
Email:bryon20221@gmail.com







--m7R=_uFiox8LgKUUeZilQKIUJR2vXwRpzS--



NAtional Bank of Canada PHish from Sendgrid

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 20 Aug 2026 10:16:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.5 (FreeBSD))

(envelope-from )

id 1wx5Q8-00000000MLC-0IfT

for dave@doctor.nl2k.ab.ca;

Thu, 20 Aug 2026 10:15:12 -0600

Resent-From: The Doctor

Resent-Date: Thu, 20 Aug 2026 10:15:11 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from s.wrqvqshf.outbound-mail.sendgrid.net ([149.72.70.15]:5446)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.99.5 (FreeBSD))

(envelope-from )

id 1wx3tf-0000000031k-2dzC

for doctor@nk.ca;

Thu, 20 Aug 2026 08:37:44 -0600

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=rieyjc.com;

h=from:subject:date:mime-version:to:content-type:cc:content-type:date:

from:subject:to;

s=s1; t=1787236602;

bh=MMUWLl7PEbUK7qRn+A3ZSu1sQrc/fQknZNt7J7ZqoHs=;

b=PbePqrou2HLMY2TV5ArKYmGQqADIhf8Hizp5MagHBDuFTxlnW8wBZbRoN7V6u8APzoTv

4Qbs8e42Oi9ItlYCtQrjV7jvMP+CwbGzSP4tKH+fZeIineLMYruT37Rsts1pPOdGU3PShA

FXZwWhySNyVdDyLUb2DGsWWFsTVCcrx2raJYxUlYPER6RDLqm+ZZdQCXETbosxUAgFP9xu

8dONJ3fdbQFm46fjHFAr+u89X+Hyha/edu2UnAdbQegsj/18xcAYolmelh/15OQEvv1yp0

Uc0I9QsQI4fcwxdbUyyAajaK1968JZJJYvBkQ0NjolFJDJElW6R6viyjQbgD0ZKw==

Received: by recvd-667967d667-bmm2n with SMTP id recvd-667967d667-bmm2n-1-6A8710FA-15

2026-08-20 14:36:42.085993295 +0000 UTC m=+1971762.030328766

Received: from castelferrus.fr (unknown)

by geopod-ismtpd-9 (SG) with ESMTP

id I_N0nLD9Tbu0HJzZnHu6dA

for ;

Thu, 20 Aug 2026 14:36:41.975 +0000 (UTC)

Message-Id: <644fa0b1f0dd66a85a897a65383269f3@rieyjc.com>

From: National Bank Direct Brokerage-Support

Subject: Action Needed: Review Your Brokerage Account Information

Date: Thu, 20 Aug 2026 14:36:42 +0000 (UTC)

X-Priority: 3

X-Mailer: AHUCPMDBNW 383.8843.37327

Mime-Version: 1.0

X-SG-EID:

=?us-ascii?Q?u001=2EqSrTYuf+buIuYTIRkkJ60PaCuK8FLEKUxWjcziMBe2+9omSbt9vAfq2yq?=

=?us-ascii?Q?HqJDvTb38W+fVNoXbOjZtzhLGv9w5HEb77OV4BE?=

=?us-ascii?Q?FLXl4lNoKHljPcbzrfOteDX9Qyt5E=2F8goP5o2uX?=

=?us-ascii?Q?2A2bNRY86WcysGD6ywzi5x7Een8ZUtkoa7PTkrd?=

=?us-ascii?Q?S3VXQI57fH69ncuvgYVrPN5zFl7X3JhoPAfAk24?=

=?us-ascii?Q?He=2FDvxk1duGasGekWrMnjvrTbPHxf0AF38wQ5=2FL?=

=?us-ascii?Q?PicJQRJiA2xgXjHlmGt2HKyeHw=3D=3D?=

To: "doctor@nk.ca"

X-Entity-ID: u001.yrMYZx4YSB2QzXiC3cfc3w==

Content-Type: multipart/alternative;

boundary="90160e9f78663be140a487bf000fe451"

X-Spam_score: 28.7

X-Spam_score_int: 287

X-Spam_bar: ++++++++++++++++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Action Needed: Review Your Brokerage Account Information MESSAGE

CONFIRMATION Action Needed: Review Your Brokerage Account InformationDear

Client,Your brokerage account currently requires an account i [...]



Content analysis details: (28.7 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[149.72.70.15 listed in will-spam-for-food.eu.org]

[149.72.70.15 listed in will-spam-for-food.eu.org]

[149.72.70.15 listed in will-spam-for-food.eu.org]

[149.72.70.15 listed in will-spam-for-food.eu.org]

[149.72.70.15 listed in will-spam-for-food.eu.org]

[149.72.70.15 listed in will-spam-for-food.eu.org]

[149.72.70.15 listed in will-spam-for-food.eu.org]

[149.72.70.15 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[149.72.70.15 listed in dnsbl.ahbl.org]

[149.72.70.15 listed in dnsbl.ahbl.org]

[149.72.70.15 listed in dnsbl.ahbl.org]

[149.72.70.15 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[149.72.70.15 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[149.72.70.15 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[149.72.70.15 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[149.72.70.15 listed in dnsbl.ahbl.org]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

2.5 URIBL_DBL_SPAM Contains a spam URL listed in the DBL blocklist

[URI: rieyjc.com]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[149.72.70.15 listed in bl.score.senderscore.com]

1.6 RCVD_IN_MSPIKE_L3 RBL: Low reputation (-3)

[149.72.70.15 listed in bl.mailspike.net]

-0.0 SPF_PASS SPF: sender matches SPF record

0.0 RCVD_IN_MSPIKE_BL Mailspike blacklisted

0.5 FROM_LOCAL_NOVOWEL From: localpart has series of non-vowel letters

15 GR_DOMAIN_SENDGR1 Received contains spammer id (sendgr)

0.8 ZMIvirSobY_SUB39 SPAM from Sober-Y-Virus

0.6 J_CHICKENPOX_64 BODY: 6alpha-pock-4alpha

0.6 J_CHICKENPOX_63 BODY: 6alpha-pock-3alpha

0.6 J_CHICKENPOX_37 BODY: 3alpha-pock-7alpha

1.5 MR_STRANGE_QUESTION URI: No description available.

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

0.8 SARE_FROM_SPAM_WORD3 I don't know people named this!

1.0 ACCT_PHISHING Possible phishing for account information

1.0 XPRIO Has X-Priority header

0.9 URI_PHISH Phishing using web form

Subject: {SPAM?} Action Needed: Review Your Brokerage Account Information





Button to the BNC website



MESSAGE CONFIRMATION

Action Needed: Review Your Brokerage Account Information

Dear Client,



Your brokerage account currently requires an account information review.



Keeping your account details accurate and up to date is important for the ongoing use of your brokerage account and related services. Please verify the information registered to your account and make any necessary updates where applicable.



To complete this account task, please use the secure review page provided below: Complete Update.



Once the requested information has been submitted, the account update will be processed and reflected in your brokerage profile. You will receive notification when the review has been completed.



If the required update remains outstanding, certain account functions may be affected. This may include temporary limitations on trading, transactions, account services, or other available features.



If you have any questions regarding this request, please reach customer assistance through the official support channel.

Stay connected

Terms of use | Privacy policy | ABC's of security

© National Bank of Canada. All rights reserved. Any reproduction, in whole or in part, is strictly prohibited without the prior written consent of National Bank of Canada.



National Bank of Canada, 800 St-Jacques Street, Montreal (Quebec) H3C 1A3



nbc.ca



For options to unsubscribe, click here.





CONFIDENTIALITÉ : Ce document est destiné uniquement à la personne ou à l'entité à qui il est adressé. L'information apparaissant dans ce document est de nature légalement privilégiée et confidentielle. Si vous n'êtes pas le destinataire visé ou la personne chargée de le remettre à son destinataire, vous êtes, par la présente, avisé que toute lecture, usage, copie ou communication du contenu de ce document est strictement interdit. De plus, vous êtes prié de communiquer avec l'expéditeur sans délai et de détruire ce document immédiatement.

CONFIDENTIALITY: This document is intended solely for the individual or entity to whom it is addressed. The information contained in this document is legally privileged and confidential. If you are not the intended recipient or the person responsible for delivering it to the intended recipient, you are hereby advised that you are strictly prohibited from reading, using, copying or disseminating the contents of this document. Please inform the sender immediately and delete this document immediately.







NAtional Bank of Canda Phish from sendgrid

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 20 Aug 2026 10:15:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.5 (FreeBSD))

(envelope-from )

id 1wx5Pq-00000000MH8-12pj

for dave@doctor.nl2k.ab.ca;

Thu, 20 Aug 2026 10:14:54 -0600

Resent-From: The Doctor

Resent-Date: Thu, 20 Aug 2026 10:14:54 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from s.wrqvqsbb.outbound-mail.sendgrid.net ([149.72.70.187]:6838)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.99.5 (FreeBSD))

(envelope-from )

id 1wx3Sp-00000000LgX-1GNh

for root@nk.ca;

Thu, 20 Aug 2026 08:09:59 -0600

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=rieyjc.com;

h=from:subject:date:mime-version:to:content-type:cc:content-type:date:

from:subject:to;

s=s1; t=1787234938;

bh=Ux0fq1jmTKu8FbDXYBIPvNOpZbMp+n4IrdVSpArl5IQ=;

b=bZYjVhteTHSwyVRev1s1CRJ4izmG/voBS4b3sGeohr1ixZYrrw6cB/mhDgJ34Rwfeg1t

PDpyKv4sI1Pbx+fNtekurpka+/9Q3BGrGXq3a9sP37WrfXVhBpsIQwCMXDSMP5iMv2zjUo

6kCSxiId5rgSe2k28GeU6td+N48z9gggSHWcQwgQxs2j0P2NhREprGpVR7uPRR5fBSbfox

/azY73wxn5n2Z5MTRuCGy5TW8PtzNgs7Oru1E5LM9P3G01bDCZKW42HlQhVkn2eZhcib7x

euJhbxrs0yyBHxkEzkdETBlbCZjQXA+GdIedC48uiGjbb/2hyrFivhRslYUem8Rg==

Received: by recvd-6cfbc786db-lqgpm with SMTP id recvd-6cfbc786db-lqgpm-1-6A870A7A-7

2026-08-20 14:08:58.041322547 +0000 UTC m=+1970202.041859720

Received: from electricien-neuilly-sur-seine.fr (unknown)

by geopod-ismtpd-11 (SG) with ESMTP id H3jRsznDRmW3C4J1HmvSJQ

for ; Thu, 20 Aug 2026 14:08:57.980 +0000 (UTC)

Message-Id: <248c021f279bd83802a8eedb08267249@rieyjc.com>

From: National Bank Direct Brokerage-Support

Subject: Action Needed: Review Your Brokerage Account Information

Date: Thu, 20 Aug 2026 14:08:58 +0000 (UTC)

X-Priority: 3

X-Mailer: GMVWE 899.54163.20155

Mime-Version: 1.0

X-SG-EID:

=?us-ascii?Q?u001=2EqSrTYuf+buIuYTIRkkJ60PaCuK8FLEKUxWjcziMBe2+9omSbt9vAfq2yq?=

=?us-ascii?Q?HqJDvTbPKCE24L5IguTXFY=2FxlogE6P6zrk5MjKZ?=

=?us-ascii?Q?+c47gPmsDRIWTF+McjDPuL7k03djWVoG3rNUDF8?=

=?us-ascii?Q?TB60FVAlWYcrTbUVEoj3RMV2G80L+m1st33+hpF?=

=?us-ascii?Q?nRiKq+H+DM=2F3UWN9=2FcMb+yaQuIHERpgLpFqbgif?=

=?us-ascii?Q?7Arf7uvG6XWoeSCMErUZu4jZj7CTD70=2F0Ntg4jC?=

=?us-ascii?Q?fZEjthfmu69TBv0rHJ0b4qO8jw=3D=3D?=

To: root

X-Entity-ID: u001.yrMYZx4YSB2QzXiC3cfc3w==

Content-Type: multipart/alternative;

boundary="324106537a241c5ea8379fdd000f1111"

X-Spam_score: 28.2

X-Spam_score_int: 282

X-Spam_bar: ++++++++++++++++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Action Needed: Review Your Brokerage Account Information MESSAGE

CONFIRMATION Action Needed: Review Your Brokerage Account InformationDear

Client,Your brokerage account currently requires an account i [...]



Content analysis details: (28.2 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[149.72.70.187 listed in will-spam-for-food.eu.org]

[149.72.70.187 listed in will-spam-for-food.eu.org]

[149.72.70.187 listed in will-spam-for-food.eu.org]

[149.72.70.187 listed in will-spam-for-food.eu.org]

[149.72.70.187 listed in will-spam-for-food.eu.org]

[149.72.70.187 listed in will-spam-for-food.eu.org]

[149.72.70.187 listed in will-spam-for-food.eu.org]

[149.72.70.187 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[149.72.70.187 listed in dnsbl.ahbl.org]

[149.72.70.187 listed in dnsbl.ahbl.org]

[149.72.70.187 listed in dnsbl.ahbl.org]

[149.72.70.187 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[149.72.70.187 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[149.72.70.187 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[149.72.70.187 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[149.72.70.187 listed in dnsbl.ahbl.org]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

2.5 URIBL_DBL_SPAM Contains a spam URL listed in the DBL blocklist

[URI: rieyjc.com]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[149.72.70.187 listed in bl.score.senderscore.com]

1.6 RCVD_IN_MSPIKE_L3 RBL: Low reputation (-3)

[149.72.70.187 listed in bl.mailspike.net]

-0.0 SPF_PASS SPF: sender matches SPF record

0.0 RCVD_IN_MSPIKE_BL Mailspike blacklisted

15 GR_DOMAIN_SENDGR1 Received contains spammer id (sendgr)

0.8 ZMIvirSobY_SUB39 SPAM from Sober-Y-Virus

0.6 J_CHICKENPOX_64 BODY: 6alpha-pock-4alpha

0.6 J_CHICKENPOX_63 BODY: 6alpha-pock-3alpha

0.6 J_CHICKENPOX_37 BODY: 3alpha-pock-7alpha

1.5 MR_STRANGE_QUESTION URI: No description available.

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

0.8 SARE_FROM_SPAM_WORD3 I don't know people named this!

1.0 ACCT_PHISHING Possible phishing for account information

1.0 XPRIO Has X-Priority header

0.9 URI_PHISH Phishing using web form

Subject: {SPAM?} Action Needed: Review Your Brokerage Account Information



This is a multi-part message in MIME format.



--324106537a241c5ea8379fdd000f1111

Content-Type: text/plain; charset=iso-8859-1

Content-Transfer-Encoding: quoted-printable



Action Needed: Review Your Brokerage Account Information MESSAGE CONFIRMAT=

ION Action Needed: Review Your Brokerage Account InformationDear Client,You=

r brokerage account currently requires an account information review.Keepin=

g your account details accurate and up to date is important for the ongoing=

use of your brokerage account and related services. Please verify the info=

rmation registered to your account and make any necessary updates where app=

licable.To complete this account task, please use the secure review page pr=

ovided below: Complete Update.Once the requested information has been submi=

tted, the account update will be processed and reflected in your brokerage =

profile. You will receive notification when the review has been completed.I=

f the required update remains outstanding, certain account functions may be=

affected. This may include temporary limitations on trading, transactions,=

account services, or other available features.If you have any questions re=

garding this request, please reach customer assistance through the official=

support channel. Stay connectedTerms of use|Privacy policy|ABC's of securi=

ty=A9 National Bank of Canada. All rights reserved. Any reproduction, in wh=

ole or in part, is strictly prohibited without the prior written consent of=

National Bank of Canada. National Bank of Canada, 800 St-Jacques Street, M=

ontreal (Quebec)H3C 1A3nbc.caFor options to unsubscribe, click here. CONFID=

ENTIALIT=C9 : Ce document est destin=E9 uniquement =E0 la personne ou =E0 l=

'entit=E9 =E0 qui il est adress=E9. L'information apparaissant dans ce docu=

ment est de nature l=E9galement privil=E9gi=E9e et confidentielle. Si vous =

n'=EAtes pas le destinataire vis=E9 ou la personne charg=E9e de le remettre=

=E0 son destinataire, vous =EAtes, par la pr=E9sente, avis=E9 que toute le=

cture, usage, copie ou communication du contenu de ce document est strictem=

ent interdit. De plus, vous =EAtes pri=E9 de communiquer avec l'exp=E9diteu=

r sans d=E9lai et de d=E9truire ce document imm=E9diatement. CONFIDENTIALIT=

Y: This document is intended solely for the individual or entity to whom it=

is addressed. The information contained in this document is legally privil=

eged and confidential. If you are not the intended recipient or the person =

responsible for delivering it to the intended recipient, you are hereby adv=

ised that you are strictly prohibited from reading, using, copying or disse=

minating the contents of this document. Please inform the sender immediatel=

y and delete this document immediately.=20=



--324106537a241c5ea8379fdd000f1111

Content-Type: text/html; charset=iso-8859-1

Content-Transfer-Encoding: quoted-printable





Action Needed: Review Your Brokerage Account Information=<br /><br />








0>






style=3D"FONT-SIZE: 11px; FONT-FAMILY: Arial,sans-serif,'Open Sans'; CO=

LOR: #666666; PADDING-BOTTOM: 45px; LINE-HEIGHT: 12px"=20

vAlign=3Dtop width=3D600 align=3Dleft>
style=3D"TEXT-DECORATION: underline; COLOR: #666666"=20

href=3D"https://z7f2p6w1j9t4g8b3mx.live" target=3D_blank>
style=3D"DISPLAY: block" border=3D0 alt=3D"Button to the BNC website"=

=20

src=3D"https://www.bnc.ca/content/dam/bnc/formulaires/picto/NB_2D_RGB=

.jpg"=20

width=3D217>



der=3D0>




DY>


E>


der=3D0>






align=3Dcenter>
gn=3Dcenter=20

border=3D0>






style=3D"FONT-SIZE: 14px; FONT-FAMILY: Arial,sans-serif,'Open San=

s'; COLOR: #333333; LINE-HEIGHT: 19px"=20

vAlign=3Dtop width=3D600 align=3Dleft>


0>








align=3Dleft>3D""=20<br
src=3D"https://www.bnc.ca/content/dam/bnc/formulaires/mod=

ele-courriel/icon-confirm-84x44.gif"=20

width=3D42 height=3D22>



style=3D"FONT-SIZE: 14px; FONT-FAMILY: Arial,sans-serif; =

FONT-WEIGHT: bold; COLOR: #ffffff; PADDING-BOTTOM: 0px; PADDING-TOP: 0px; P=

ADDING-LEFT: 0px; MARGIN: 0px; LINE-HEIGHT: 19px; PADDING-RIGHT: 0px">MESSA=

GE=20

CONFIRMATION=20


Y>


der=3D0>








der=3D0>






style=3D"FONT-SIZE: 14px; FONT-FAMILY: Arial,sans-serif,'Open San=

s'; COLOR: #333333; LINE-HEIGHT: 19px"=20

vAlign=3Dtop align=3Dleft>


style=3D"FONT-SIZE: 20px; FONT-FAMILY: Arial,sans-serif; FONT-W=

EIGHT: normal; COLOR: #00334d; PADDING-BOTTOM: 0px; PADDING-TOP: 0px; PADDI=

NG-LEFT: 0px; MARGIN: 0px; LINE-HEIGHT: 24px; PADDING-RIGHT: 0px">Action=20

Needed: Review Your Brokerage Account Information


style=3D"FONT-SIZE: 10px; HEIGHT: 10px; LINE-HEIGHT: 10px">
V>Dear=20

Client,

Your brokerage account currently requires an acc=

ount=20

information review.

Keeping your account details accurat=

e and=20

up to date is important for the ongoing use of your brokerage=20

account and related services. Please verify the information=20

registered to your account and make any necessary updates where=

=20

applicable.

To complete this account task, please use th=

e=20

secure review page provided below:
href=3D"https://z7f2p6w1j9t4g8b3mx.live">Complete=20

Update.

Once the requested information has been=20

submitted, the account update will be processed and reflected i=

n=20

your brokerage profile. You will receive notification when the=20

review has been completed.

If the required update remain=

s=20

outstanding, certain account functions may be affected. This ma=

y=20

include temporary limitations on trading, transactions, account=

=20

services, or other available features.

If you have any=20

questions regarding this request, please reach customer assista=

nce=20

through the official support channel.=20




der=3D0>






align=3Dcenter>
der=3D0>




der=3D0>






style=3D"BORDER-TOP: #a6a6a6 1px solid; BORDER-BOTTOM: #a6a6a6 1px soli=

d; PADDING-BOTTOM: 12px; PADDING-TOP: 12px"=20

vAlign=3Dtop align=3Dcenter>








R>






er=20

border=3D0>




>
style=3D"WIDTH: 630px; MIN-WIDTH: 630px; MIN-HEIGHT: 1px;=

DISPLAY: block; MAX-HEIGHT: 1px"=20

alt=3D""=20

src=3D"https://www.bnc.ca/content/dam/bnc/formulaires/mod=

ele-courriel/spacer-social-media-1x1.gif"=20

width=3D630 height=3D1>



er=20

border=3D0>








ABLE>



=3Dcenter=20

border=3D0>






height=3D1>
style=3D"WIDTH: 600px; MIN-WIDTH: 600px; MIN-HEIGHT=

: 1px; DISPLAY: block; MAX-HEIGHT: 1px"=20

alt=3D""=20

src=3D"https://www.bnc.ca/content/dam/bnc/formulair=

es/modele-courriel/spacer-social-media-1x1.gif"=20

width=3D600 height=3D1>

TD>



er=3D0>






style=3D"FONT-SIZE: 11px; FONT-FAMILY: Arial,sans-ser=

if,'Open Sans'; COLOR: #000000; LINE-HEIGHT: 15px; PADDING-RIGHT: 4px"=20

vAlign=3Dmiddle align=3Dright>Stay connected


style=3D"FONT-SIZE: 11px; FONT-FAMILY: Arial,sans-ser=

if,'Open Sans'; COLOR: #000000; PADDING-LEFT: 6px; LINE-HEIGHT: 15px"=20

vAlign=3Dmiddle width=3D25 align=3Dleft>
href=3D"https://www.facebook.com/nationalbanknetwor=

ks"=20

target=3D_blank>3D""=20<br
src=3D"https://www.bnc.ca/content/dam/bnc/formulair=

es/modele-courriel/icon-facebook-25x25.gif"=20

width=3D25 height=3D25>


style=3D"FONT-SIZE: 11px; FONT-FAMILY: Arial,sans-ser=

if,'Open Sans'; COLOR: #000000; PADDING-LEFT: 6px; LINE-HEIGHT: 15px"=20

vAlign=3Dmiddle width=3D25 align=3Dleft>
href=3D"https://twitter.com/nationalbank/"=20

target=3D_blank>3D""=20<br
src=3D"https://www.bnc.ca/content/dam/bnc/formulair=

es/modele-courriel/icon-twitter-25x25.gif"=20

width=3D25 height=3D25>


style=3D"FONT-SIZE: 11px; FONT-FAMILY: Arial,sans-ser=

if,'Open Sans'; COLOR: #000000; PADDING-LEFT: 6px; LINE-HEIGHT: 15px"=20

vAlign=3Dmiddle width=3D25 align=3Dleft>
href=3D"https://www.youtube.com/user/nationalbankne=

tworks"=20

target=3D_blank>3D""=20<br
src=3D"https://www.bnc.ca/content/dam/bnc/formulair=

es/modele-courriel/icon-youtube-25x25.gif"=20

width=3D25 height=3D25>


style=3D"FONT-SIZE: 11px; FONT-FAMILY: Arial,sans-ser=

if,'Open Sans'; COLOR: #000000; PADDING-LEFT: 6px; LINE-HEIGHT: 15px"=20

vAlign=3Dmiddle width=3D25 align=3Dleft>
href=3D"https://www.linkedin.com/company/national-b=

ank-of-canada/"=20

target=3D_blank>3D""=20<br
src=3D"https://www.bnc.ca/content/dam/bnc/formulair=

es/modele-courriel/icon-linkedin-25x25.gif"=20

width=3D25=20

height=3D25>



der=3D0>








der=3D0>






style=3D"FONT-SIZE: 11px; FONT-FAMILY: Arial,sans-serif,'Open San=

s'; COLOR: #686868; PADDING-BOTTOM: 30px; PADDING-TOP: 30px; LINE-HEIGHT: 1=

5px"=20

vAlign=3Dtop align=3Dleft>








style=3D"FONT-SIZE: 11px; FONT-FAMILY: Arial,sans-serif,'Op=

en Sans'; COLOR: #686868; PADDING-BOTTOM: 15px; LINE-HEIGHT: 15px"=20

vAlign=3Dmiddle align=3Dleft>
style=3D"TEXT-DECORATION: underline; COLOR: #686868"=20

href=3D"https://www.nbc.ca/terms-of-use.html?utm_campaign=

=3Dacq_credit-card_aem-forms-email_en&utm_medium=3Demail&utm_source=

=3Depush-bnc&utm_content=3Dinterrompu&utm_term=3D"=20

target=3D_blank>Terms of=20

use



style=3D"FONT-SIZE: 11px; FONT-FAMILY: Arial,sans-serif,'Op=

en Sans'; COLOR: #686868; PADDING-BOTTOM: 15px; LINE-HEIGHT: 15px"=20

vAlign=3Dmiddle width=3D20 align=3Dcenter>|


style=3D"FONT-SIZE: 11px; FONT-FAMILY: Arial,sans-serif,'Op=

en Sans'; COLOR: #686868; PADDING-BOTTOM: 15px; LINE-HEIGHT: 15px"=20

vAlign=3Dmiddle align=3Dleft>
style=3D"TEXT-DECORATION: underline; COLOR: #686868"=20

href=3D"https://www.nbc.ca/privacy-policy.html?utm_campai=

gn=3Dacq_credit-card_aem-forms-email_en&utm_medium=3Demail&utm_sour=

ce=3Depush-bnc&utm_content=3Dinterrompu&utm_term=3D"=20

target=3D_blank>Privacy=20

policy



style=3D"FONT-SIZE: 11px; FONT-FAMILY: Arial,sans-serif,'Op=

en Sans'; COLOR: #686868; PADDING-BOTTOM: 15px; LINE-HEIGHT: 15px"=20

vAlign=3Dmiddle width=3D20 align=3Dcenter>|


style=3D"FONT-SIZE: 11px; FONT-FAMILY: Arial,sans-serif,'Op=

en Sans'; COLOR: #686868; PADDING-BOTTOM: 15px; LINE-HEIGHT: 15px"=20

vAlign=3Dmiddle align=3Dleft>
style=3D"TEXT-DECORATION: underline; COLOR: #686868"=20

href=3D"https://www.nbc.ca/abcs-of-security.html?utm_camp=

aign=3Dacq_credit-card_aem-forms-email_en&utm_medium=3Demail&utm_so=

urce=3Depush-bnc&utm_content=3Dinterrompu&utm_term=3D"=20

target=3D_blank>ABC's of=20

security



style=3D"FONT-SIZE: 15px; HEIGHT: 15px; LINE-HEIGHT: 15px">
V>
style=3D"FONT-SIZE: 8px; VERTICAL-ALIGN: 5px; LINE-HEIGHT: 0">=

=A9=20

National Ba=

nk of=20

Canada. All rights reserved. Any reproduction, in whole or in p=

art,=20

is strictly prohibited without the prior written consent of
AN=20

style=3D"WHITE-SPACE: nowrap">National Bank of Cana=

da.=20



National Bank of Canada, 800 St-Jacques Street,=20

Montreal (Quebec)  
style=3D"WHITE-SPACE: nowrap">H3C 1A3


>
style=3D"TEXT-DECORATION: underline; COLOR: #686868"=20

href=3D"https://www.nbc.ca?utm_campaign=3Dacq_credit-card_aem-f=

orms-email_en&utm_medium=3Demail&utm_source=3Depush-bnc&utm_con=

tent=3Dconfirmation&utm_term=3D"=20

target=3D_blank>
style=3D"COLOR: #686868">nbc.ca

For options t=

o=20

unsubscribe,
6868"=20

href=3D"https://www.nbc.ca/forms/communications/withdraw-consen=

t.html"=20

target=3D_blank>click here
>
.=20


DY>


style=3D"FONT-SIZE: 8pt; FONT-FAMILY: 'Cambria','times roman',serif; LINE-H=

EIGHT: 10pt">
CONFIDENTIALIT=C9=20

: Ce document est destin=E9 uniquement =E0 la personne ou =E0 l'entit=E9 =

=E0 qui il est=20

adress=E9. L'information apparaissant dans ce document est de nature l=E9ga=

lement=20

privil=E9gi=E9e et confidentielle. Si vous n'=EAtes pas le destinataire vis=

=E9 ou la=20

personne charg=E9e de le remettre =E0 son destinataire, vous =EAtes, par la=

pr=E9sente,=20

avis=E9 que toute lecture, usage, copie ou communication du contenu de ce d=

ocument=20

est strictement interdit. De plus, vous =EAtes pri=E9 de communiquer avec=20

l'exp=E9diteur sans d=E9lai et de d=E9truire ce document imm=E9diatement.=20


CONFIDENTIALITY: This document is intended solely for the individual or=

=20

entity to whom it is addressed. The information contained in this document =

is=20

legally privileged and confidential. If you are not the intended recipient =

or=20

the person responsible for delivering it to the intended recipient, you are=

=20

hereby advised that you are strictly prohibited from reading, using, copyin=

g or=20

disseminating the contents of this document. Please inform the sender=20

immediately and delete this document immediately.












--324106537a241c5ea8379fdd000f1111--



National Bank phish from Sendgrid

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 20 Aug 2026 10:15:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.5 (FreeBSD))

(envelope-from )

id 1wx5Pl-00000000MGE-1aMn

for dave@doctor.nl2k.ab.ca;

Thu, 20 Aug 2026 10:14:49 -0600

Resent-From: The Doctor

Resent-Date: Thu, 20 Aug 2026 10:14:49 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from s.wrqvqsbb.outbound-mail.sendgrid.net ([149.72.70.187]:64524)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.99.5 (FreeBSD))

(envelope-from )

id 1wx3NO-00000000KEg-2u1Q

for doctor@doctor.nl2k.ab.ca;

Thu, 20 Aug 2026 08:04:22 -0600

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gywqi.com;

h=from:subject:date:mime-version:to:content-type:cc:content-type:date:

from:subject:to;

s=s1; t=1787234601;

bh=QBVHvZOShbdi6GlXsez1BA1vShnsgOHrPTP63nvohYQ=;

b=Uu0tEL7FgnXqQxWQerAPbfHyhOcF17tv2sh9HRzg4wlvy5HPILaOLzJXfi1C5v4gVw0H

Zxxd8INw2YB5/bOBj3XQydcwlL5VC83QC6SExtszuCA7sKQ5XUGZwD5p/uztRfxC1EYtY9

RQEiHdqMBTodvnGNoxvN/oa6/NfGYRzCzvurwooM9ytkh2g+7j8ahRSW/sgZgSPR7xKLhz

aYnQ47l81stYwhLQALhRZvvGZeErIk3jdxVw8m7lNxtVZK1CIgHOql/C0WsVvzwWYq7fio

YDY+rNX4Cmtj3MJf6iMGOIbBrfGQPiLhsWmYvUrye80q8rTD4NNsOHQHB+CgTqmA==

Received: by recvd-75c96bbb78-t4k4l with SMTP id recvd-75c96bbb78-t4k4l-1-6A870929-4C

2026-08-20 14:03:21.216668013 +0000 UTC m=+1969865.210055325

Received: from dryuptechnology.com (unknown)

by geopod-ismtpd-0 (SG)

with ESMTP id iXExYestTmSRWSl12iCejg

for ;

Thu, 20 Aug 2026 14:03:20.984 +0000 (UTC)

Message-Id: <0cd6cfcbaf98b2374f72db9c35d91643@gywqi.com>

From: National Bank Direct Brokerage-Secure <1OE8I9@gywqi.com>

Subject: Important Brokerage Account Information Update

Date: Thu, 20 Aug 2026 14:03:21 +0000 (UTC)

X-Priority: 3

X-Mailer: Goryt Tajqxxurhgf Vwhranqywqqc 169

Mime-Version: 1.0

X-SG-EID:

=?us-ascii?Q?u001=2EqSrTYuf+buIuYTIRkkJ60PaCuK8FLEKUxWjcziMBe28GJ21d6ci3ZY1E8?=

=?us-ascii?Q?jMGVY5cm83vgvA+Us9Q9w7ImkWPdFJQRfgud8le?=

=?us-ascii?Q?HERqSzGMb8CXcQaFblygry59Epzlazh0I0GZWV0?=

=?us-ascii?Q?gknoE4AuTzKds6hvLI9ROMACj1sxheBdTFe=2FOKQ?=

=?us-ascii?Q?TufnOsQYeQlzdaWrNe2aiH4XKsvHm5u2Sljbz4c?=

=?us-ascii?Q?2XL2PIW+QOGPizLF18r46ozxY4G55nNnVMzoV4K?=

=?us-ascii?Q?2wP3yZifh9jxSlfvGhZs6+w8uA=3D=3D?=

To: doctor

X-Entity-ID: u001.hwz/4ON2U4jEhsV5As9sWA==

Content-Type: multipart/alternative;

boundary="9e752fd94d989cc6f97d599900011641"

X-Spam_score: 34.7

X-Spam_score_int: 347

X-Spam_bar: ++++++++++++++++++++++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Important Brokerage Account Information Update MESSAGE CONFIRMATION

Important Brokerage Account Information UpdateDear Client,This message is

regarding a pending account maintenance requirement for yo [...]



Content analysis details: (34.7 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[149.72.70.187 listed in will-spam-for-food.eu.org]

[149.72.70.187 listed in will-spam-for-food.eu.org]

[149.72.70.187 listed in will-spam-for-food.eu.org]

[149.72.70.187 listed in will-spam-for-food.eu.org]

[149.72.70.187 listed in will-spam-for-food.eu.org]

[149.72.70.187 listed in will-spam-for-food.eu.org]

[149.72.70.187 listed in will-spam-for-food.eu.org]

[149.72.70.187 listed in will-spam-for-food.eu.org]

1.6 RCVD_IN_MSPIKE_L3 RBL: Low reputation (-3)

[149.72.70.187 listed in bl.mailspike.net]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[149.72.70.187 listed in dnsbl.ahbl.org]

[149.72.70.187 listed in dnsbl.ahbl.org]

[149.72.70.187 listed in dnsbl.ahbl.org]

[149.72.70.187 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[149.72.70.187 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[149.72.70.187 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[149.72.70.187 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[149.72.70.187 listed in dnsbl.ahbl.org]

2.5 URIBL_DBL_SPAM Contains a spam URL listed in the DBL blocklist

[URI: gywqi.com]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[149.72.70.187 listed in bl.score.senderscore.com]

-0.0 SPF_PASS SPF: sender matches SPF record

0.0 RCVD_IN_MSPIKE_BL Mailspike blacklisted

15 GR_DOMAIN_SENDGR1 Received contains spammer id (sendgr)

0.8 ZMIvirSobY_SUB39 SPAM from Sober-Y-Virus

2.0 TVD_PH_REC BODY: Message includes a phrase commonly used in phishing

mails

0.6 J_CHICKENPOX_64 BODY: 6alpha-pock-4alpha

0.6 J_CHICKENPOX_63 BODY: 6alpha-pock-3alpha

0.6 J_CHICKENPOX_37 BODY: 3alpha-pock-7alpha

1.5 MR_STRANGE_QUESTION URI: No description available.

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

2.5 XM_RANDOM X-Mailer apparently random

2.0 MIXED_HREF_CASE Has href in mixed case

0.8 SARE_FROM_SPAM_WORD3 I don't know people named this!

1.0 ACCT_PHISHING Possible phishing for account information

1.0 XPRIO Has X-Priority header

0.9 URI_PHISH Phishing using web form

Subject: {SPAM?} Important Brokerage Account Information Update







Button to the BNC website



MESSAGE CONFIRMATION

Important Brokerage Account Information Update

Dear Client,



This message is regarding a pending account maintenance requirement for your brokerage account.



As part of maintaining current and accurate account records, you are required to review and update your account information. Keeping these details current helps ensure that your brokerage account remains available for normal use and that applicable account services can continue without interruption.



Please complete the required account information update through the secure page below: Complete Update.



Following submission, the updated information will be processed and applied to your account record. A confirmation will be provided after the account task has been successfully finalized.



Until the required update is completed, access to certain account services or functions may be subject to temporary restrictions. This may include trading activity, transaction processing, or other brokerage account features.



For further assistance, please contact the official customer support team.

Stay connected

Terms of use | Privacy policy | ABC's of security

© National Bank of Canada. All rights reserved. Any reproduction, in whole or in part, is strictly prohibited without the prior written consent of National Bank of Canada.



National Bank of Canada, 800 St-Jacques Street, Montreal (Quebec) H3C 1A3



nbc.ca



For options to unsubscribe, click here.





CONFIDENTIALITÉ : Ce document est destiné uniquement à la personne ou à l'entité à qui il est adressé. L'information apparaissant dans ce document est de nature légalement privilégiée et confidentielle. Si vous n'êtes pas le destinataire visé ou la personne chargée de le remettre à son destinataire, vous êtes, par la présente, avisé que toute lecture, usage, copie ou communication du contenu de ce document est strictement interdit. De plus, vous êtes prié de communiquer avec l'expéditeur sans délai et de détruire ce document immédiatement.

CONFIDENTIALITY: This document is intended solely for the individual or entity to whom it is addressed. The information contained in this document is legally privileged and confidential. If you are not the intended recipient or the person responsible for delivering it to the intended recipient, you are hereby advised that you are strictly prohibited from reading, using, copying or disseminating the contents of this document. Please inform the sender immediately and delete this document immediately.