Loan phish from Google Gmail
Posted by Dave Yadallee on
X-Mozilla-Status: 0001
X-Mozilla-Status2: 00000000
Return-path:
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Wed, 19 Aug 2026 20:29:00 -0600
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.5 (FreeBSD))
(envelope-from)
id 1wwsWN-00000000BFx-0fdk
for dave@doctor.nl2k.ab.ca;
Wed, 19 Aug 2026 20:28:47 -0600
Resent-From: The Doctor
Resent-Date: Wed, 19 Aug 2026 20:28:47 -0600
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from mail-pf1-f174.google.com ([209.85.210.174]:54451)
by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256
(Exim 4.99.5 (FreeBSD))
(envelope-from)
id 1wwo6m-000000006qR-2IhW
for sales@nk.ca;
Wed, 19 Aug 2026 15:46:14 -0600
Received: by mail-pf1-f174.google.com with SMTP id d2e1a72fcca58-84e3007a2b7so1253805b3a.0
for; Wed, 19 Aug 2026 14:45:16 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=kesefmarketing.com; s=google; t=1787175911; x=1787780711; darn=nk.ca;
h=list-unsubscribe-post:list-unsubscribe:in-reply-to:references
:message-id:date:to:from:subject:mime-version:content-type:from:to
:cc:subject:date:message-id:reply-to:content-type;
bh=B5zIoa1EifGMYDrb0hHML6rI1YG+5qj848gLj4qMyfM=;
b=Ql6AdghCLxOPlzhBurJs18EgjAA3cYka+M59o1fI9oQUyq8BtAGjCukoxrPM6nWR4T
6qHeR4S9E1KS7lhC5k1X7TquXervINEmbEi7Rxfdv7TtRo9WN4an0KR1AQ0T28aXDJSV
eTqZ94e21UMozKoUvN8pVwK9L7rlv9wuECVqA/YTi6piOCBV96gfNQjgAMM5xNvAHgV5
Ii03dHt5/Mq6bwbeERZGEqGoBY0o4bhlCBmBv6PQcCnI3msJzDaooY2dia2bGmQUig70
S8wMiHd2bQJiURTXYPrM7SB+sm9vxbVQKZTGXQPTqPDKaw5PtSCru2pkp98aQM4qwX8b
gsGw==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=1e100.net; s=20251104; t=1787175911; x=1787780711;
h=list-unsubscribe-post:list-unsubscribe:in-reply-to:references
:message-id:date:to:from:subject:mime-version:content-type:x-gm-gg
:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to
:content-type;
bh=B5zIoa1EifGMYDrb0hHML6rI1YG+5qj848gLj4qMyfM=;
b=N3mXpbBIJZN1orjzbT/e8/IOWdVOfrN3iVeHnxMGgMA7kjey/F6zsQTpTdAOX2PccD
/I7seX4OM3SY8YJcpbZbhfiTdvqGHvBYWC0sByE6rHdoLzUd3Y2wkduvFiANqyRfFyfU
0rJgR+YTRycMoTqQuugiqEnGplAC9TZKETnM/kksr1y8mHBx2txfBhv1KB9MXCLfaYVZ
UGyY6JE0T6vz46+dAIia965EHemYca11VwO0w53CgpPmSPoXCOd3vShQZjWxX9TwH8JZ
D5JMQrebmWht/MnJXjyTgZ0aGUnEjc9M3urc4Nci25w9r4c8imLjXmPrp5jXGsR+2lfT
+s8Q==
X-Gm-Message-State: AOJu0Yz+rBmlAaE5C0PnUyJiw8Si/sFQWAgGH2PCPB/sBQhvO0Up3qGJ
6OIngNFFGW/VuaAokul5I3AYXT8lWxYgANOmITTlnY6q1XDKuirKWPjSe5/nuhNY3/ExjE0dQ4N
mct1oe6Q=
X-Gm-Gg: AR+sD13PUggde+7xnt+d+wjwYLx2qLwmjuk3cW2noAxsc0KA+5WVkNodthZuIEejclJ
cuCfn9gFVmeOuHwne283nfLfAGmi+AwhpG+nE7ld8VOfYDGEus55nqzYEpCjuLwtYIzHjl8sVnb
pDDzElYIpB2jwG9/Ct0qWRbRkxnMSflwSbWUJn2KSzA/fS8a92Bf2FyH6yGVYHYRN8TowI80hFO
X0f9cgiBQ43jv4YAi3tJMlpazhBcABlyv99BG3cJrCYtEIAuf0PzE1G2KaR5mWwJUD7TNVCcAVI
zVZ/75SysvtzcXPe8EZl7Xl+KTlIm+BKqAEW7HL5ErPpZVhmI4oQf0McQF9Qu7qd11wcZAZRfEP
Z8Dl8voGx8X27H9Kfq0zlgF/r3VAiazQMDsw9yGHFePCWMS1jSKK63jaRorVnVwJND4Wki19MCj
LIs0WsbsLk43/9hzV1QpsW/WUvp+V3nAqmOMuxZ58jz5iqLZhPJ2/AGSkkZLisSWLrJUd/6WTPn
22y9/yCxWqsVkZ1OB6z0nQJh3gpG5DZdnNsQ4QbcmKzSggMBVkRdRhCvQ==
X-Received: by 2002:a05:6a00:4508:b0:847:77e9:acbb with SMTP id d2e1a72fcca58-851d393eca0mr13657997b3a.13.1787175910683;
Wed, 19 Aug 2026 14:45:10 -0700 (PDT)
Received: from smtpgw.close.com (am11-natgw-b0.close.com. [54.186.6.46])
by smtp.gmail.com with ESMTPSA id d2e1a72fcca58-851d36a2ef0sm1040100b3a.61.2026.08.19.14.45.09
for
(version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256);
Wed, 19 Aug 2026 14:45:09 -0700 (PDT)
Content-Type: multipart/mixed; boundary="===============1729742750236244615=="
MIME-Version: 1.0
Subject: Re: Kesef Marketing | Smarter Access to Business Loans
From: =?utf-8?q?Anna_Kesef_Marketing?=
To: =?utf-8?q?Gurkirat_Wirring?=
Date: Wed, 19 Aug 2026 21:45:09 +0000
Message-ID: <178717590920.7.6698188364795184228@smtpgw.close.com>
X-CLOSEIO-EMAIL-ID: acti_EYgVDEYcHgFFDZeN0FEvwPFU8HBzT9MkqJvB7z16Usx
References: <178646337461.7.1240611996543057914@smtpgw.close.com> <178646337461.7.8575171778634196756@smtpgw.close.com> <178656720216.7.719897199253237218@smtpgw.close.com> <178656720216.7.1487486787664217380@smtpgw.close.com> <178665638576.8.14493170454529970862@smtpgw.close.com> <178665638576.8.10004896856150860707@smtpgw.close.com> <178674436134.7.13789459120733539838@smtpgw.close.com> <178674436134.7.15043001032031211174@smtpgw.close.com>
In-Reply-To: <178674436134.7.13789459120733539838@smtpgw.close.com>
List-Unsubscribe:
List-Unsubscribe-Post: List-Unsubscribe=One-Click
--===============1729742750236244615==
Content-Type: multipart/alternative; boundary="===============5309721204484363179=="
MIME-Version: 1.0
--===============5309721204484363179==
Content-Type: text/plain; charset="utf-8"
MIME-Version: 1.0
Content-Transfer-Encoding: quoted-printable
**Hi Gurkirat**
=20
**This is Anna Sanchez from Kesef Marketing.**
=20
**Just reaching out again in case the timing wasn=E2=80=99t right earlier.**
=20
**You can explore your options anytime here: =20
**[**CLICK HERE TO START YOUR
APPLICATION**](https://form.jotform.com/260672364104452?lead_id=3Dlead_1MVG=
GnNXqVx8dbGrHgSfKaWzWuBT6yMLDjaGHIpxaD3&legalBusiness=3DN
K
MAINTENANCE&fullName\[first\]=3DGurkirat&fullName\[last\]=3DWirring&leadTyp=
e=3DAutomation)
=20
**If you have any questions or would prefer to speak directly, feel free to
call me at 1-866-216-5475 or 873-502-8068**
=20
**Best regards,**
=20
=20
=20
** =20
**
**Anna Sanchez**
**SALES MANAGER**
=20
To stop receiving these emails,
click[here](https://app.close.com/go/unsubscribe/orga_WJQdcK5MUUa02rLIty6GV=
Dnil9kHSKU8WElV6ueTPiF/sales%40nk.ca/GK6U1JDQJSfaf6
--tg9gajA9HdvShNSyH_DgbhmTyc8=3D/).
=20
=20
On Aug 14, 2026, at 03:52 PM, Lilian Llanillo
wrote: =20
> **Hi Gurkirat,**
>
> =20
>
>
> **This is Lilian Llanillo from Kesef Marketing.** =20
> =20
>
>
> **I wanted to follow up and see if funding is still something you're
> considering for your business.**
>
> =20
>
>
> **If so, you can review your options here: =20
> **[**CLICK HERE TO START YOUR
> APPLICATION**](https://form.jotform.com/260672364104452?lead_id=3Dlead_1M=
VGGnNXqVx8dbGrHgSfKaWzWuBT6yMLDjaGHIpxaD3&legalBusiness=3DN
> K
> MAINTENANCE&fullName\[first\]=3DGurkirat&fullName\[last\]=3DWirring&leadT=
ype=3DAutomation)
>
> =20
>
>
> **If you have any questions or would prefer to speak directly, feel free =
to
> call me at 1-866-216-5475 or 873-771-7630**
>
> =20
>
>
> **Best regards,**
>
> =20
>
>
> =20
>
>
> =20
>
>
> **Lilian Llanillo**
>
> **FUNDING ADVISOR**
>
> =20
>
>
> ****[**lilian@kesefmarketing.com**](https://lil=
ian@kesefmarketing.com)
>
> **+1 (873) 771-7630**
>
> **____________________________**
>
> 
>
> =20
>
>
> To stop receiving these emails, click
> [here](https://app.close.com/go/unsubscribe/orga_WJQdcK5MUUa02rLIty6GVDni=
l9kHSKU8WElV6ueTPiF/sales%40nk.ca/GK6U1JDQJSfaf6
> --tg9gajA9HdvShNSyH_DgbhmTyc8=3D/).
>
> =20
> =20
> On Aug 13, 2026, at 03:26 PM, Lilian Llanillo
> wrote: =20
>
>
>> **Hi Gurkirat,**
>>
>> =20
>
>>
>> **This is Lilian Llanillo from Kesef Marketing.** =20
> =20
>
>>
>> **Many businesses are currently reviewing their funding options to stay
ahead.**
>>
>> =20
>
>>
>> **If this is something you=E2=80=99re considering, you can check your op=
tions here: =20
> **[**CLICK HERE TO START YOUR
> APPLICATION**](https://form.jotform.com/260672364104452?lead_id=3Dlead_1M=
VGGnNXqVx8dbGrHgSfKaWzWuBT6yMLDjaGHIpxaD3&legalBusiness=3DN
> K
> MAINTENANCE&fullName\[first\]=3DGurkirat&fullName\[last\]=3DWirring&leadT=
ype=3DAutomation) =20
> =20
> **If you have any questions or would prefer to speak directly, feel free =
to
> call me at +1-866-216-5475 or 873-771-7630**
>>
>> =20
>
>>
>> **Best regards,**
>>
>> =20
>
>>
>> =20
>
>>
>> =20
>
>>
>> **Lilian Llanillo**
>>
>> **FUNDING ADVISOR**
>>
>> =20
>
>>
>> ****[**lilian@kesefmarketing.com**](https://lilia=
n@kesefmarketing.com)
>>
>> **+1 (873) 771-7630**
>>
>> **____________________________**
>>
>> 
>>
>> =20
>
>>
>> To stop receiving these emails, click
[here](https://app.close.com/go/unsubscribe/orga_WJQdcK5MUUa02rLIty6GVDnil9=
kHSKU8WElV6ueTPiF/sales%40nk.ca/GK6U1JDQJSfaf6
--tg9gajA9HdvShNSyH_DgbhmTyc8=3D/).
>>
>> =20
> =20
> On Aug 12, 2026, at 02:40 PM, Lilian Llanillo
> wrote: =20
>
>>
>>> **Hi Gurkirat, **
>>>
>>> =20
>
>>>
>>> **We noticed your Cash Advance application is still incomplete.**
>>>
>>> =20
>
>>>
>>> **You=E2=80=99re just a few steps away from securing up to $800,000 in =
funding
within 48 hours.**
>>>
>>> =20
>
>>>
>>> **To move forward, please complete your application here: =20
> **
>>>
>>> [**Click to Start your Application
here**](https://form.jotform.com/260672364104452?lead_id=3Dlead_1MVGGnNXqVx=
8dbGrHgSfKaWzWuBT6yMLDjaGHIpxaD3&legalBusiness=3DN
K
MAINTENANCE&fullName\[first\]=3DGurkirat&fullName\[last\]=3DWirring&leadTyp=
e=3DAutomation)
>>>
>>> =20
>
>>>
>>> **and upload your last 3 months of bank statements. This will allow us =
to
finalize your review and match you with the best available funding options.=
**
>>>
>>> =20
>
>>>
>>> **If you have any questions or would prefer to speak directly, feel free
to call me at +1-866-216-5475 or 873-771-7630**
>>>
>>> =20
> **Best regards, =20
> **
>>>
>>> =20
>
>>>
>>> **Lilian Llanillo**
>>>
>>> **FUNDING ADVISOR**
>>>
>>> =20
>
>>>
>>> ****[**lilian@kesefmarketing.com**](https://lilia=
n@kesefmarketing.com)
>>>
>>> **+1 (873) 771-7630**
>>>
>>> **____________________________**
>>>
>>> 
>>>
>>> =20
>
>>>
>>> To stop receiving these emails, click
[here](https://app.close.com/go/unsubscribe/orga_WJQdcK5MUUa02rLIty6GVDnil9=
kHSKU8WElV6ueTPiF/sales%40nk.ca/GK6U1JDQJSfaf6
--tg9gajA9HdvShNSyH_DgbhmTyc8=3D/).
>>>
>>> =20
> =20
> On Aug 11, 2026, at 09:49 AM, Lilian Llanillo
> wrote: =20
>
>>>
>>>> **Hi Gurkirat,**
>>>>
>>>> =20
>
>>>>
>>>> **This is Lilian Llanillo from Kesef Marketing.**
>>>>
>>>> =20
>
>>>>
>>>> **Welcome! I wanted to personally reach out and thank you for your
interest in business funding. We work with lenders across Canada to provide
reliable funding solutions that support growth, manage cash flow, and cover
upcoming expenses=E2=80=94while helping you access competitive interest rat=
es.**
>>>>
>>>> =20
>
>>>>
>>>> **If you=E2=80=99re open to exploring your options, you can get starte=
d here: =20
> **[**Click Here To Start Your
> Application**](https://form.jotform.com/260672364104452?lead_id=3Dlead_1M=
VGGnNXqVx8dbGrHgSfKaWzWuBT6yMLDjaGHIpxaD3&legalBusiness=3DN
> K
> MAINTENANCE&fullName\[first\]=3DGurkirat&fullName\[last\]=3DWirring&leadT=
ype=3DAutomation)
>>>>
>>>> **Once submitted, our team will review your information and present the
best available funding options tailored to your needs.**
>>>>
>>>> =20
>
>>>>
>>>> **If you have any questions or would prefer to speak directly, feel fr=
ee
to call me at +1-866-216-5475 or 873-771-7630**
>>>>
>>>> =20
>
>>>>
>>>> **Looking forward to connecting.**
>>>>
>>>> =20
>
>>>>
>>>> **Best regards, =20
> **
>>>>
>>>> =20
>
>>>>
>>>> **Lilian Llanillo**
>>>>
>>>> **FUNDING ADVISOR**
>>>>
>>>> =20
>
>>>>
>>>> ****[**lilian@kesefmarketing.com**](https://lilia=
n@kesefmarketing.com)
>>>>
>>>> **+1 (873) 771-7630**
>>>>
>>>> **____________________________**
>>>>
>>>> 
>>>>
>>>> =20
>
>>>>
>>>> To stop receiving these emails, click
[here](https://app.close.com/go/unsubscribe/orga_WJQdcK5MUUa02rLIty6GVDnil9=
kHSKU8WElV6ueTPiF/sales%40nk.ca/GK6U1JDQJSfaf6
--tg9gajA9HdvShNSyH_DgbhmTyc8=3D/).
--===============5309721204484363179==
Content-Type: text/html; charset="utf-8"
MIME-Version: 1.0
Content-Transfer-Encoding: quoted-printable
g>Just reaching out again in case the timing wasn=E2=80=99t right earlier.<=
/strong>
>If you have any questions or would prefer to speak directly, feel =
free to call me at 1-866-216-5475 or 873-502-8068
X-Mozilla-Status2: 00000000
Return-path:
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Wed, 19 Aug 2026 20:29:00 -0600
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.5 (FreeBSD))
(envelope-from
id 1wwsWN-00000000BFx-0fdk
for dave@doctor.nl2k.ab.ca;
Wed, 19 Aug 2026 20:28:47 -0600
Resent-From: The Doctor
Resent-Date: Wed, 19 Aug 2026 20:28:47 -0600
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from mail-pf1-f174.google.com ([209.85.210.174]:54451)
by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256
(Exim 4.99.5 (FreeBSD))
(envelope-from
id 1wwo6m-000000006qR-2IhW
for sales@nk.ca;
Wed, 19 Aug 2026 15:46:14 -0600
Received: by mail-pf1-f174.google.com with SMTP id d2e1a72fcca58-84e3007a2b7so1253805b3a.0
for
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=kesefmarketing.com; s=google; t=1787175911; x=1787780711; darn=nk.ca;
h=list-unsubscribe-post:list-unsubscribe:in-reply-to:references
:message-id:date:to:from:subject:mime-version:content-type:from:to
:cc:subject:date:message-id:reply-to:content-type;
bh=B5zIoa1EifGMYDrb0hHML6rI1YG+5qj848gLj4qMyfM=;
b=Ql6AdghCLxOPlzhBurJs18EgjAA3cYka+M59o1fI9oQUyq8BtAGjCukoxrPM6nWR4T
6qHeR4S9E1KS7lhC5k1X7TquXervINEmbEi7Rxfdv7TtRo9WN4an0KR1AQ0T28aXDJSV
eTqZ94e21UMozKoUvN8pVwK9L7rlv9wuECVqA/YTi6piOCBV96gfNQjgAMM5xNvAHgV5
Ii03dHt5/Mq6bwbeERZGEqGoBY0o4bhlCBmBv6PQcCnI3msJzDaooY2dia2bGmQUig70
S8wMiHd2bQJiURTXYPrM7SB+sm9vxbVQKZTGXQPTqPDKaw5PtSCru2pkp98aQM4qwX8b
gsGw==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=1e100.net; s=20251104; t=1787175911; x=1787780711;
h=list-unsubscribe-post:list-unsubscribe:in-reply-to:references
:message-id:date:to:from:subject:mime-version:content-type:x-gm-gg
:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to
:content-type;
bh=B5zIoa1EifGMYDrb0hHML6rI1YG+5qj848gLj4qMyfM=;
b=N3mXpbBIJZN1orjzbT/e8/IOWdVOfrN3iVeHnxMGgMA7kjey/F6zsQTpTdAOX2PccD
/I7seX4OM3SY8YJcpbZbhfiTdvqGHvBYWC0sByE6rHdoLzUd3Y2wkduvFiANqyRfFyfU
0rJgR+YTRycMoTqQuugiqEnGplAC9TZKETnM/kksr1y8mHBx2txfBhv1KB9MXCLfaYVZ
UGyY6JE0T6vz46+dAIia965EHemYca11VwO0w53CgpPmSPoXCOd3vShQZjWxX9TwH8JZ
D5JMQrebmWht/MnJXjyTgZ0aGUnEjc9M3urc4Nci25w9r4c8imLjXmPrp5jXGsR+2lfT
+s8Q==
X-Gm-Message-State: AOJu0Yz+rBmlAaE5C0PnUyJiw8Si/sFQWAgGH2PCPB/sBQhvO0Up3qGJ
6OIngNFFGW/VuaAokul5I3AYXT8lWxYgANOmITTlnY6q1XDKuirKWPjSe5/nuhNY3/ExjE0dQ4N
mct1oe6Q=
X-Gm-Gg: AR+sD13PUggde+7xnt+d+wjwYLx2qLwmjuk3cW2noAxsc0KA+5WVkNodthZuIEejclJ
cuCfn9gFVmeOuHwne283nfLfAGmi+AwhpG+nE7ld8VOfYDGEus55nqzYEpCjuLwtYIzHjl8sVnb
pDDzElYIpB2jwG9/Ct0qWRbRkxnMSflwSbWUJn2KSzA/fS8a92Bf2FyH6yGVYHYRN8TowI80hFO
X0f9cgiBQ43jv4YAi3tJMlpazhBcABlyv99BG3cJrCYtEIAuf0PzE1G2KaR5mWwJUD7TNVCcAVI
zVZ/75SysvtzcXPe8EZl7Xl+KTlIm+BKqAEW7HL5ErPpZVhmI4oQf0McQF9Qu7qd11wcZAZRfEP
Z8Dl8voGx8X27H9Kfq0zlgF/r3VAiazQMDsw9yGHFePCWMS1jSKK63jaRorVnVwJND4Wki19MCj
LIs0WsbsLk43/9hzV1QpsW/WUvp+V3nAqmOMuxZ58jz5iqLZhPJ2/AGSkkZLisSWLrJUd/6WTPn
22y9/yCxWqsVkZ1OB6z0nQJh3gpG5DZdnNsQ4QbcmKzSggMBVkRdRhCvQ==
X-Received: by 2002:a05:6a00:4508:b0:847:77e9:acbb with SMTP id d2e1a72fcca58-851d393eca0mr13657997b3a.13.1787175910683;
Wed, 19 Aug 2026 14:45:10 -0700 (PDT)
Received: from smtpgw.close.com (am11-natgw-b0.close.com. [54.186.6.46])
by smtp.gmail.com with ESMTPSA id d2e1a72fcca58-851d36a2ef0sm1040100b3a.61.2026.08.19.14.45.09
for
(version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256);
Wed, 19 Aug 2026 14:45:09 -0700 (PDT)
Content-Type: multipart/mixed; boundary="===============1729742750236244615=="
MIME-Version: 1.0
Subject: Re: Kesef Marketing | Smarter Access to Business Loans
From: =?utf-8?q?Anna_Kesef_Marketing?=
To: =?utf-8?q?Gurkirat_Wirring?=
Date: Wed, 19 Aug 2026 21:45:09 +0000
Message-ID: <178717590920.7.6698188364795184228@smtpgw.close.com>
X-CLOSEIO-EMAIL-ID: acti_EYgVDEYcHgFFDZeN0FEvwPFU8HBzT9MkqJvB7z16Usx
References: <178646337461.7.1240611996543057914@smtpgw.close.com> <178646337461.7.8575171778634196756@smtpgw.close.com> <178656720216.7.719897199253237218@smtpgw.close.com> <178656720216.7.1487486787664217380@smtpgw.close.com> <178665638576.8.14493170454529970862@smtpgw.close.com> <178665638576.8.10004896856150860707@smtpgw.close.com> <178674436134.7.13789459120733539838@smtpgw.close.com> <178674436134.7.15043001032031211174@smtpgw.close.com>
In-Reply-To: <178674436134.7.13789459120733539838@smtpgw.close.com>
List-Unsubscribe:
List-Unsubscribe-Post: List-Unsubscribe=One-Click
--===============1729742750236244615==
Content-Type: multipart/alternative; boundary="===============5309721204484363179=="
MIME-Version: 1.0
--===============5309721204484363179==
Content-Type: text/plain; charset="utf-8"
MIME-Version: 1.0
Content-Transfer-Encoding: quoted-printable
**Hi Gurkirat**
=20
**This is Anna Sanchez from Kesef Marketing.**
=20
**Just reaching out again in case the timing wasn=E2=80=99t right earlier.**
=20
**You can explore your options anytime here: =20
**[**CLICK HERE TO START YOUR
APPLICATION**](https://form.jotform.com/260672364104452?lead_id=3Dlead_1MVG=
GnNXqVx8dbGrHgSfKaWzWuBT6yMLDjaGHIpxaD3&legalBusiness=3DN
K
MAINTENANCE&fullName\[first\]=3DGurkirat&fullName\[last\]=3DWirring&leadTyp=
e=3DAutomation)
=20
**If you have any questions or would prefer to speak directly, feel free to
call me at 1-866-216-5475 or 873-502-8068**
=20
**Best regards,**
=20
=20
=20
** =20
**
**Anna Sanchez**
**SALES MANAGER**
=20
To stop receiving these emails,
click[here](https://app.close.com/go/unsubscribe/orga_WJQdcK5MUUa02rLIty6GV=
Dnil9kHSKU8WElV6ueTPiF/sales%40nk.ca/GK6U1JDQJSfaf6
--tg9gajA9HdvShNSyH_DgbhmTyc8=3D/).
=20
=20
On Aug 14, 2026, at 03:52 PM, Lilian Llanillo
wrote: =20
> **Hi Gurkirat,**
>
> =20
>
>
> **This is Lilian Llanillo from Kesef Marketing.** =20
> =20
>
>
> **I wanted to follow up and see if funding is still something you're
> considering for your business.**
>
> =20
>
>
> **If so, you can review your options here: =20
> **[**CLICK HERE TO START YOUR
> APPLICATION**](https://form.jotform.com/260672364104452?lead_id=3Dlead_1M=
VGGnNXqVx8dbGrHgSfKaWzWuBT6yMLDjaGHIpxaD3&legalBusiness=3DN
> K
> MAINTENANCE&fullName\[first\]=3DGurkirat&fullName\[last\]=3DWirring&leadT=
ype=3DAutomation)
>
> =20
>
>
> **If you have any questions or would prefer to speak directly, feel free =
to
> call me at 1-866-216-5475 or 873-771-7630**
>
> =20
>
>
> **Best regards,**
>
> =20
>
>
> =20
>
>
> =20
>
>
> **Lilian Llanillo**
>
> **FUNDING ADVISOR**
>
> =20
>
>
> ****[**lilian@kesefmarketing.com**](https://lil=
ian@kesefmarketing.com)
>
> **+1 (873) 771-7630**
>
> **____________________________**
>
> 
>
> =20
>
>
> To stop receiving these emails, click
> [here](https://app.close.com/go/unsubscribe/orga_WJQdcK5MUUa02rLIty6GVDni=
l9kHSKU8WElV6ueTPiF/sales%40nk.ca/GK6U1JDQJSfaf6
> --tg9gajA9HdvShNSyH_DgbhmTyc8=3D/).
>
> =20
> =20
> On Aug 13, 2026, at 03:26 PM, Lilian Llanillo
> wrote: =20
>
>
>> **Hi Gurkirat,**
>>
>> =20
>
>>
>> **This is Lilian Llanillo from Kesef Marketing.** =20
> =20
>
>>
>> **Many businesses are currently reviewing their funding options to stay
ahead.**
>>
>> =20
>
>>
>> **If this is something you=E2=80=99re considering, you can check your op=
tions here: =20
> **[**CLICK HERE TO START YOUR
> APPLICATION**](https://form.jotform.com/260672364104452?lead_id=3Dlead_1M=
VGGnNXqVx8dbGrHgSfKaWzWuBT6yMLDjaGHIpxaD3&legalBusiness=3DN
> K
> MAINTENANCE&fullName\[first\]=3DGurkirat&fullName\[last\]=3DWirring&leadT=
ype=3DAutomation) =20
> =20
> **If you have any questions or would prefer to speak directly, feel free =
to
> call me at +1-866-216-5475 or 873-771-7630**
>>
>> =20
>
>>
>> **Best regards,**
>>
>> =20
>
>>
>> =20
>
>>
>> =20
>
>>
>> **Lilian Llanillo**
>>
>> **FUNDING ADVISOR**
>>
>> =20
>
>>
>> ****[**lilian@kesefmarketing.com**](https://lilia=
n@kesefmarketing.com)
>>
>> **+1 (873) 771-7630**
>>
>> **____________________________**
>>
>> 
>>
>> =20
>
>>
>> To stop receiving these emails, click
[here](https://app.close.com/go/unsubscribe/orga_WJQdcK5MUUa02rLIty6GVDnil9=
kHSKU8WElV6ueTPiF/sales%40nk.ca/GK6U1JDQJSfaf6
--tg9gajA9HdvShNSyH_DgbhmTyc8=3D/).
>>
>> =20
> =20
> On Aug 12, 2026, at 02:40 PM, Lilian Llanillo
> wrote: =20
>
>>
>>> **Hi Gurkirat, **
>>>
>>> =20
>
>>>
>>> **We noticed your Cash Advance application is still incomplete.**
>>>
>>> =20
>
>>>
>>> **You=E2=80=99re just a few steps away from securing up to $800,000 in =
funding
within 48 hours.**
>>>
>>> =20
>
>>>
>>> **To move forward, please complete your application here: =20
> **
>>>
>>> [**Click to Start your Application
here**](https://form.jotform.com/260672364104452?lead_id=3Dlead_1MVGGnNXqVx=
8dbGrHgSfKaWzWuBT6yMLDjaGHIpxaD3&legalBusiness=3DN
K
MAINTENANCE&fullName\[first\]=3DGurkirat&fullName\[last\]=3DWirring&leadTyp=
e=3DAutomation)
>>>
>>> =20
>
>>>
>>> **and upload your last 3 months of bank statements. This will allow us =
to
finalize your review and match you with the best available funding options.=
**
>>>
>>> =20
>
>>>
>>> **If you have any questions or would prefer to speak directly, feel free
to call me at +1-866-216-5475 or 873-771-7630**
>>>
>>> =20
> **Best regards, =20
> **
>>>
>>> =20
>
>>>
>>> **Lilian Llanillo**
>>>
>>> **FUNDING ADVISOR**
>>>
>>> =20
>
>>>
>>> ****[**lilian@kesefmarketing.com**](https://lilia=
n@kesefmarketing.com)
>>>
>>> **+1 (873) 771-7630**
>>>
>>> **____________________________**
>>>
>>> 
>>>
>>> =20
>
>>>
>>> To stop receiving these emails, click
[here](https://app.close.com/go/unsubscribe/orga_WJQdcK5MUUa02rLIty6GVDnil9=
kHSKU8WElV6ueTPiF/sales%40nk.ca/GK6U1JDQJSfaf6
--tg9gajA9HdvShNSyH_DgbhmTyc8=3D/).
>>>
>>> =20
> =20
> On Aug 11, 2026, at 09:49 AM, Lilian Llanillo
> wrote: =20
>
>>>
>>>> **Hi Gurkirat,**
>>>>
>>>> =20
>
>>>>
>>>> **This is Lilian Llanillo from Kesef Marketing.**
>>>>
>>>> =20
>
>>>>
>>>> **Welcome! I wanted to personally reach out and thank you for your
interest in business funding. We work with lenders across Canada to provide
reliable funding solutions that support growth, manage cash flow, and cover
upcoming expenses=E2=80=94while helping you access competitive interest rat=
es.**
>>>>
>>>> =20
>
>>>>
>>>> **If you=E2=80=99re open to exploring your options, you can get starte=
d here: =20
> **[**Click Here To Start Your
> Application**](https://form.jotform.com/260672364104452?lead_id=3Dlead_1M=
VGGnNXqVx8dbGrHgSfKaWzWuBT6yMLDjaGHIpxaD3&legalBusiness=3DN
> K
> MAINTENANCE&fullName\[first\]=3DGurkirat&fullName\[last\]=3DWirring&leadT=
ype=3DAutomation)
>>>>
>>>> **Once submitted, our team will review your information and present the
best available funding options tailored to your needs.**
>>>>
>>>> =20
>
>>>>
>>>> **If you have any questions or would prefer to speak directly, feel fr=
ee
to call me at +1-866-216-5475 or 873-771-7630**
>>>>
>>>> =20
>
>>>>
>>>> **Looking forward to connecting.**
>>>>
>>>> =20
>
>>>>
>>>> **Best regards, =20
> **
>>>>
>>>> =20
>
>>>>
>>>> **Lilian Llanillo**
>>>>
>>>> **FUNDING ADVISOR**
>>>>
>>>> =20
>
>>>>
>>>> ****[**lilian@kesefmarketing.com**](https://lilia=
n@kesefmarketing.com)
>>>>
>>>> **+1 (873) 771-7630**
>>>>
>>>> **____________________________**
>>>>
>>>> 
>>>>
>>>> =20
>
>>>>
>>>> To stop receiving these emails, click
[here](https://app.close.com/go/unsubscribe/orga_WJQdcK5MUUa02rLIty6GVDnil9=
kHSKU8WElV6ueTPiF/sales%40nk.ca/GK6U1JDQJSfaf6
--tg9gajA9HdvShNSyH_DgbhmTyc8=3D/).
--===============5309721204484363179==
Content-Type: text/html; charset="utf-8"
MIME-Version: 1.0
Content-Transfer-Encoding: quoted-printable
Hi Gurkirat
This is =
Anna Sanchez from Kesef Marketing.
Anna Sanchez from Kesef Marketing.
g>Just reaching out again in case the timing wasn=E2=80=99t right earlier.<=
/strong>
You can explore your options anyt=
ime here:
ead_id=3Dlead_1MVGGnNXqVx8dbGrHgSfKaWzWuBT6yMLDjaGHIpxaD3&legalBusiness=
=3DN K MAINTENANCE&fullName[first]=3DGurkirat&fullName[last]=3DWirr=
ing&leadType=3DAutomation" rel=3D"noopener noreferrer nofollow">
>CLICK HERE TO START YOUR APPLICATION
ime here:
ead_id=3Dlead_1MVGGnNXqVx8dbGrHgSfKaWzWuBT6yMLDjaGHIpxaD3&legalBusiness=
=3DN K MAINTENANCE&fullName[first]=3DGurkirat&fullName[last]=3DWirr=
ing&leadType=3DAutomation" rel=3D"noopener noreferrer nofollow">
>CLICK HERE TO START YOUR APPLICATION
>If you have any questions or would prefer to speak directly, feel =
free to call me at 1-866-216-5475 or 873-502-8068
div>
Best regards,
iv>
Anna Sanchez
ng>
ng>
SALES MANAGER
>
>
"font-weight: 700;"> ...
Mansour Group Spam from Microsoft Outlook
Posted by Dave Yadallee on
X-Mozilla-Status: 0001
X-Mozilla-Status2: 00000000
Return-path:
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Wed, 19 Aug 2026 14:19:00 -0600
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.5 (FreeBSD))
(envelope-from)
id 1wwmkN-000000008qR-13tu
for dave@doctor.nl2k.ab.ca;
Wed, 19 Aug 2026 14:18:51 -0600
Resent-From: The Doctor
Resent-Date: Wed, 19 Aug 2026 14:18:51 -0600
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from mail-westeuropeazolkn19011028.outbound.protection.outlook.com ([52.103.33.28]:22355 helo=AS8PR04CU009.outbound.protection.outlook.com)
by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384
(Exim 4.99.5 (FreeBSD))
(envelope-from)
id 1wwmVY-000000006AN-0gd3
for doctor@doctor.nl2k.ab.ca;
Wed, 19 Aug 2026 14:03:41 -0600
ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none;
b=k2t0wApllbtGkxrRhBs2NtdHfV+fp+TmwUkEAawdVg6zpt1EJQQ5brPOuIos0jEWzKuPpel4o8dQBuXgX2h+7KVo20GCHR3q7Jph/WZHKmiqLmaqWSgPLZNIcdgSfyJYOqqY/vXibB2iqTeRMWxwYGAitPti1Eb4tC2UeqM9x5MrVUIBsoFBq9DClxcmOtVe/xfLLiznu+FxdA53Qjfzo7udHceCUJW1b2qKsvLA7p2EGV/2PP4DvZjrPSenfngw46XqhanOq3awQk+foPfn7tXSV3xmBIv7Sc1bdwnTgtp7zJDxp6ly0vfg4sPdbDqTNfDFomTWl5ZV4RZchbOmrA==
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;
s=arcselector10001;
h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1;
bh=edei1xzCDNnIVbCV9b0V9+QuEL4sxOXEOov9fDBrH+M=;
b=tjUV8iVnq7A7kTbwz2pN2uP4eorG34dhHs4C7WjjZW7h7MOv9crZV8J5ICWjxXKrLOuFn30OBr1m5PLhaq7VRSVhW8XPIeE7sBZWr2Iykeqfea+nBvmZssms6hLIyHVkPUzwEDE//2d8b0kWMyPHooxGQ1sRDXvmnHbqGAmHaX34sZq6zbApKZUzoaLXzED0ptx8kHdX/kgOXRxbuj8tFPD9I7hJtZ04uCdyoxwVbSLjz+/7sLVU8SswmtgHCUiL53oR3V9/5+6J82uCctJISVWI5nMllrSmqHyHaA4gtJID1yXQRgqtWKP+AgbukXMLwjrTUKS1r1TC3UQvz6WGkw==
ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=none; dmarc=none;
dkim=none; arc=none
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=outlook.com;
s=selector1;
h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck;
bh=edei1xzCDNnIVbCV9b0V9+QuEL4sxOXEOov9fDBrH+M=;
b=e5I0rW+tf0hQc8YSRKlOrigSfxRBkmg+oHZYBsyHWRr6KTdZ9c8GcSZdc7tvXn+yqYUIt/GVVdXftgC3fWlUSai0zk8BelRElm04ZwJ2CfF2/RdmSb6+C1K8oB3P6jW+wuPAJVggLa99l2wGNLOUZSCWY3K4AaF6jAlx6KrfUIUJKrZGbCDDzGbKBkr8jnurAm5Rg2ck9SCPdesSJ9NcxAjNBKhYIcFLNFs7F/FSeItw2Nbd5HvcI4maWDB0X9ebpUZkRgvdr6+TbWYD3H+3mWwsUhJGw9WR8Pyv2bjGz1t3dnY6w4QE4WLGUmxHcCvTh+uDoI18kv5+Mo6HzQzXyw==
Received: from GVUPR01MB12677.eurprd01.prod.exchangelabs.com
(2603:10a6:150:333::18) by AM7PPF9E4ED15B0.eurprd01.prod.exchangelabs.com
(2603:10a6:20f:fff1::79f) with Microsoft SMTP Server (version=TLS1_2,
cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.339.8; Wed, 19 Aug
2026 20:02:03 +0000
Received: from GVUPR01MB12677.eurprd01.prod.exchangelabs.com
([fe80::d860:f026:ccda:dc0b]) by
GVUPR01MB12677.eurprd01.prod.exchangelabs.com ([fe80::d860:f026:ccda:dc0b%4])
with mapi id 15.21.0339.007; Wed, 19 Aug 2026 20:02:03 +0000
From: Mansour Mohamed
Subject: CEO MANSOUR GROUP
Thread-Topic: CEO MANSOUR GROUP
Thread-Index: AQHdMBVS6TUgTwuaAUCo3I+0rtOYGQ==
Date: Wed, 19 Aug 2026 20:02:02 +0000
Message-ID:
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach: yes
X-MS-TNEF-Correlator:
msip_labels:
x-ms-publictraffictype: Email
x-ms-traffictypediagnostic: GVUPR01MB12677:EE_|AM7PPF9E4ED15B0:EE_
x-ms-office365-filtering-correlation-id: ee5c4ab6-a1d1-4069-264b-08defe2cbc7f
x-microsoft-antispam:
BCL:0;ARA:14566002|25010399006|41001999006|24121999003|22091999003|15001099006|4140399003|24021099003|37011999003|6092099016|31061999003|39105399006|2604032031799003|55001999006|16051099003|18010799003|704163111799003|22141099003|15080799012|15030799006|19110799012|8060799015|8062599012|20055399003|56899033|3412199025|440099028|34005399003|102099032|260806224601699006|39145399003|41105399003|40105399003|2607281247196008|2406899039;
x-microsoft-antispam-message-info:
=?utf-8?B?TGhTQjJ3REx0KzdMVG04Y1NEYkViaFMzaFZWdXF3SVh3dUw1Zjl3ekd5NEpl?=
=?utf-8?B?VFR0RmdDTmFJQ0NIVEMxT09RYzd5VnRpWEhMSVl0NitzcXRwSlFKTmhRU1VY?=
=?utf-8?B?SEd2b3AxWm4wdkJlcWhCd3VNbldZaGRKNXdFeTdZSTVCOStiZXFUdlNIVUd0?=
=?utf-8?B?eXJKRmlJQUpWdjhxVlJtVU5OVEFoRnJzRXdzN1BlQU0xWmkyekc1ZW1USkU4?=
=?utf-8?B?OG52Zmp4a0VkWUpDTTFWamFFWmIrVHhnYkw4cDZRalhrcytONCs4SWV0Nklk?=
=?utf-8?B?ZGRmay9OSy96dWpSNE9UQktrT1JuWUhWV0l4K2hEeUV2TzZTZ1FqQlhJM0s2?=
=?utf-8?B?eXRFK3JJcHdHOHlDWFdMK1lPb2hjMThsNmM3dCtBcDNVQTJ1QUYydXJpd0pM?=
=?utf-8?B?amk3cDMyVlY3Sm5PLzJMRkFZUkVSRVpLQmUwRW5LcE1CSHB1YW9kKzVXU2hV?=
=?utf-8?B?NHppbEFMbFVqUklWRnhGZVFWNFJERHUvR3lyZmovSzlpMGF5bjVLRFZ1bTZm?=
=?utf-8?B?eFFTOTBZa2xFNUZSRmYrUmdTT21qc3NjdzhpMU50bndJUURvZjFadUpaRzZr?=
=?utf-8?B?VWJVc1dzbUNIZFVDVmlzUnhibEtSTGFNUTdIUG12RnRBbVpLaGQwcGQzSUxO?=
=?utf-8?B?KzNKSzVURWZBZWx2blM4bUpyR1ZPRTNsVnBkT09DS01oZjZyQVdKZkxDTU1Y?=
=?utf-8?B?Y1Byb0swRlFKL21kZXVSV1FPa29DNVBiU2l3UmxPejZTRTU0L3FJOTd2bHJ4?=
=?utf-8?B?aEVuU1BoQlFndzJVRDRHdzdKVUQwaWhBVDhXbThyYUNnUitrUGtSaTFCZmI5?=
=?utf-8?B?eDZDNE9mYUM0YUZ4MnUwQkZUVHdTWjNXbk52bDhqUERjNkZzYVY1dlFyeXMw?=
=?utf-8?B?anBNMDJkMzdYeGxJSVhHSUIxaFVHN2d1eUgvSlBFN0djeFU1WHVvaVh0ZjFs?=
=?utf-8?B?SHpHMjdTVVRNL0JIcmRGa0lEaTN2WElrUk05TzFvQTUxYVo0ZEljdnd1aytS?=
=?utf-8?B?dWtOR0pGK1RlRldHSVM3UDA0Ni9RR3RPRVFOOFd0WWtkdFh5b0ZMbzhTU3M0?=
=?utf-8?B?Q3o2RE5xSnNBanQrWFkvaFdDampzOUMyUnV0VkRxMzJoR0tvVTU5T3EzdUNq?=
=?utf-8?B?N0JtOHpxdERuWGxIWGZDSWMzMWxHYUlucUk3NnRoTmJCL28yTDVxeWxZWWtl?=
=?utf-8?B?Q1NPajhwWWJtejkzeEhNVFRkNk5Dd2xDbTlGVUdKd1hlYUxHQndaeXB2ckdx?=
=?utf-8?B?eGNDOTRNWUZWY1h0VTNvMlBhdTdBbTRzZ1ZiQ0tLQ2JjK3lOekFYbERFM01Y?=
=?utf-8?B?NHBwb0twanNLamZxWFMvTWYyYkIzOXphOWk2SXRZMlBkV21HNWZMbVVyK3Bw?=
=?utf-8?B?enVpUEJnb2JUTDFoWm9ZRWI5dnkyRTlaSUd1ODMya3cwQlR2TkF6NGJsSHFv?=
=?utf-8?B?QmZYV0Vyc3VIRXNEZDI0YzBqMGwxcmoxdWdQUGc3Q0tSMzZFM1lsYXd2VHNG?=
=?utf-8?B?M1VaMDNMaFRiYUM0UTNNM3preDFXMTRpMkVuOFR4eDJRb1NPeHd2bE9PbUxV?=
=?utf-8?B?dzFIQ09qWmJvbDVzN3dQbDRhbmVHeElTaXBmZ000ckVNc2VqU1owREpxcmxN?=
=?utf-8?B?cGFXUnZ1NnJabUVZSjNiUFZwRkFBU08xelNmbTJBZ29ybVRKQkFwN2pRYWJL?=
=?utf-8?B?NFNacWFYM1lJcWtRWG9VaXRWVWJUOXVLelkzL1UvWGlrWEpjZWVnWmIzY3I1?=
=?utf-8?B?M3djem5uMVdlTy9yVEFuaU84YWRkWTM5M0R6clZsT1FaeERGL3N4Ukswdzdp?=
=?utf-8?B?ME9QbW1NMTBCSGx1OTM4c2xoVWlEMG5BM1M5RFg0VDZnTU5qNlhmMzNIdUh0?=
=?utf-8?B?aENZRmVEVGQwMHUrMTRFM0pxOE9xWWNHT2JiTjhqY05uN0l4ZFFiWG1idldp?=
=?utf-8?B?L3NtN0tIMjhXNG83SFNSelFGbCtNdVhja1NJQ2JrT2tBemZBRkpyR01pWWcy?=
=?utf-8?Q?ulklHlJE1YeeD/HM4/1SNl9mQRbpx8=3D?=
x-ms-exchange-antispam-messagedata-chunkcount: 1
x-ms-exchange-antispam-messagedata-0:
=?utf-8?B?L0dMVmJObEMreExWcUxQL3FZMGNmdEpOSUs3SWp5Uk5SM2JneHA5SkNOL01O?=
=?utf-8?B?bCtFS2ZnZVQ4WVMyMnhxY3pQYk1zSzZqSHhXNzRFdllkbEd6ajZQYkxhNGxV?=
=?utf-8?B?L2F6aWU1eERORDRwU2NhTnJQU3lHZVdCZXRRdkErWU9NVVhFRUg4OGJJLzFo?=
=?utf-8?B?SjhEY0xuZWlwR1JOYys1dmkzTzdOMEduOWFTMDBJeCtadVRsNTJyU0ZqUDU4?=
=?utf-8?B?aGFiRzNTSkZhY1MrNlNRejVScFA1aFNjWlc5eS93RVZsSnp2Z2lXODZjbDBB?=
=?utf-8?B?WHlCOGplbG83OTllMUgrUHcvellQd0xLR3BmaCtUd2RpRGdNMHZ6eUZGOGZh?=
=?utf-8?B?QnRkdlI5V2hUcXo2MU4vTkJVN0d3c3JGOUNDUGozRmthbWUyUXdqVERUTksz?=
=?utf-8?B?TjFzaUgrZUJKOWw0OUFVTmdtTGRIUHZZQkcvam4raEhCZ0EyeFNObGtubmx2?=
=?utf-8?B?N3EreCsrUUZtSDhyaWpITkVmRFk5eVVXa0pkbittMHMvbDdXWWxURkNCOUN1?=
=?utf-8?B?eGJ5ZTEzbGN0NllOZUFTTXo4Y244dGlWN2RIRzNMa0owY1RZblRrVzczdy9n?=
=?utf-8?B?Tk5OSG1XS0Fudi9xQ2tDRmZOUFBDY3kydDJxbXFaOGpwU3lCRUI2Z29lMHV0?=
=?utf-8?B?V25hVGhZQmp0a3BldFJRUjFkQjBleUpOUjJ3MjBaQW0zRjZsbjFTZ1NqamdX?=
=?utf-8?B?Ty9pZ1NQM2k2RkZiaEszLzNJbGIzR2NWcHdKNkZ6TTRjaDcwdTA5UG5aeE9l?=
=?utf-8?B?YmhldmNSSS8xU1FwK1FaTnlHeVJjbTV2YjJ3TlBqQms1dlBQWGtpbGVOT0JU?=
=?utf-8?B?SFlSYkhzeVRqR3ZZSWdra2VqaXpaOFhXdGhWSUNqcUwySkpDek9OdU90TU5E?=
=?utf-8?B?dGk1Q0hSc1R3U1lqOW00azcwZk9JL2lsLzh4czdnYUxLaXR1eVVScGFyK25P?=
=?utf-8?B?V2xOTEpqQ1JTV3lIMFF1bWgwckpmLzhQMHZ4ZzZYQmVYUTVZdldISHdROE9R?=
=?utf-8?B?SXFkUXRrVkZaYktRbVVjNDMxblJIOXZxRkNOWjFaZWlvWWhnSjNmKzlPWkdQ?=
=?utf-8?B?WUREYjVpaHJ3ZDFzcHFVeXM0TW9TOFhBV0huV1Rqd2JxWjFzajM3UmE2RjR5?=
=?utf-8?B?c29vU0pHKzd4VjhLeWs0dGQvWngySWs2Q08zcmptaTdzWFEveGNTTGg1Zkdt?=
=?utf-8?B?UTE5dExJSTc4NmMrR1R3Y254RlNqTUUzWUpMYmRrS2pmVTRJaVk0K2JPVjdM?=
=?utf-8?B?a29MOWlzQWxpbW9wQWRsOHFkSDZpOStYR2pyL1cwelZBb09McmxjNE40V01B?=
=?utf-8?B?UzBYREdLTXg1NFhjcnJjRHMxMjVBVERkTndNeVBSc2ZNUG5UeGk3TDNSQmty?=
=?utf-8?B?WVRMeWtEMG56Q29IVDMyaEhWM3FHc0dLSDRVcVhJaG9TVXBhLzJhajMwU1BW?=
=?utf-8?B?V1o4ODZkVWl5cC93OGRwT3E0QUcyYW5Ya01mVU9teElaL0o1azRQZjVtbXJq?=
=?utf-8?B?RnJ2ZG1vRGs1b3dOcEJ4ZHlFTTJzMCs1QTRQeW5rUG5TZzQvd2hlakxBNUk3?=
=?utf-8?B?bmZGdWo1VUpFSDVOSDNqbDVEb1FUZUlvRTdxVzFoZ1NMZGJmajFXS0Jpb2FZ?=
=?utf-8?B?TGtRdmJCK0pBRjdKTWFmMmk4andCZ3dEbzhkeVZoNmpIQTEvMnNrM3pSMzJm?=
=?utf-8?B?ZEltaEtVY21NWXpoVThyT21XeTZBa3RZaHpDYTZFQVNCWSsyWEVhMG5XSHFz?=
=?utf-8?B?ZFEwTXJFY05vbkpXSFc1bDc2RXRxMHNnM2NVSVZMMnFiMXpoZTlOUDdxUWY1?=
=?utf-8?B?U2hOaWVJY2JDZHBZTXFzTU1xajRKdTRaUTI3TmliTytoVUpQV3N6QUlmc1F5?=
=?utf-8?Q?r14aFmqBAPbEe?=
Content-Type: multipart/related;
boundary="_004_GVUPR01MB126774698CD65074EDACA951DB3A52GVUPR01MB12677eu_";
type="multipart/alternative"
MIME-Version: 1.0
X-OriginatorOrg: outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-AuthSource: GVUPR01MB12677.eurprd01.prod.exchangelabs.com
X-MS-Exchange-CrossTenant-RMS-PersistedConsumerOrg: 00000000-0000-0000-0000-000000000000
X-MS-Exchange-CrossTenant-Network-Message-Id: ee5c4ab6-a1d1-4069-264b-08defe2cbc7f
X-MS-Exchange-CrossTenant-originalarrivaltime: 19 Aug 2026 20:02:02.7557
(UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: 84df9e7f-e9f6-40af-b435-aaaaaaaaaaaa
X-MS-Exchange-CrossTenant-rms-persistedconsumerorg: 00000000-0000-0000-0000-000000000000
X-MS-Exchange-Transport-CrossTenantHeadersStamped: AM7PPF9E4ED15B0
X-Spam_score: 5.3
X-Spam_score_int: 53
X-Spam_bar: +++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: Greetings! My name is Mohamed Mansour (CEO Mansour Group).
I'm reaching out about the potential of a mutually beneficial partnership
between us, and i need your kind response to discuss further. Kindly reach
out at your earliest convenience.
Content analysis details: (5.3 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org
[2603:10a6:150:333:0:0:0:18 listed in]
[will-spam-for-food.eu.org]
[2603:10a6:150:333:0:0:0:18 listed in]
[will-spam-for-food.eu.org]
[2603:10a6:150:333:0:0:0:18 listed in]
[will-spam-for-food.eu.org]
[2603:10a6:150:333:0:0:0:18 listed in]
[will-spam-for-food.eu.org]
[2603:10a6:150:333:0:0:0:18 listed in]
[will-spam-for-food.eu.org]
[2603:10a6:150:333:0:0:0:18 listed in]
[will-spam-for-food.eu.org]
[2603:10a6:150:333:0:0:0:18 listed in]
[will-spam-for-food.eu.org]
[2603:10a6:150:333:0:0:0:18 listed in]
[will-spam-for-food.eu.org]
[52.103.33.28 listed in will-spam-for-food.eu.org]
[52.103.33.28 listed in will-spam-for-food.eu.org]
[52.103.33.28 listed in will-spam-for-food.eu.org]
[52.103.33.28 listed in will-spam-for-food.eu.org]
[52.103.33.28 listed in will-spam-for-food.eu.org]
[52.103.33.28 listed in will-spam-for-food.eu.org]
[52.103.33.28 listed in will-spam-for-food.eu.org]
[52.103.33.28 listed in will-spam-for-food.eu.org]
1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org
[2603:10a6:150:333:0:0:0:18 listed in]
[dnsbl.ahbl.org]
[2603:10a6:150:333:0:0:0:18 listed in]
[dnsbl.ahbl.org]
[2603:10a6:150:333:0:0:0:18 listed in]
[dnsbl.ahbl.org]
[2603:10a6:150:333:0:0:0:18 listed in]
[dnsbl.ahbl.org]
[52.103.33.28 listed in dnsbl.ahbl.org]
[52.103.33.28 listed in dnsbl.ahbl.org]
[52.103.33.28 listed in dnsbl.ahbl.org]
[52.103.33.28 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org
[2603:10a6:150:333:0:0:0:18 listed in]
[dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org
[2603:10a6:150:333:0:0:0:18 listed in]
[dnsbl.ahbl.org]
1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org
[2603:10a6:150:333:0:0:0:18 listed in]
[dnsbl.ahbl.org]
0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org
[2603:10a6:150:333:0:0:0:18 listed in]
[dnsbl.ahbl.org]
-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact
cert-sa@returnpath.net
[Excessive Number of Queries |]
-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact
safe-sa@returnpath.net
[Excessive Number of Queries |]
-0.0 SPF_HELO_PASS SPF: HELO matches SPF record
-0.0 SPF_PASS SPF: sender matches SPF record
1.2 MISSING_HEADERS Missing To: header
1.6 SUBJ_ALL_CAPS Subject is all capitals
-0.0 T_RP_MATCHES_RCVD Envelope sender domain matches handover relay
domain
0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider
[ceomansourgroup(at)outlook.com]
-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no
trust
[52.103.33.28 listed in list.dnswl.org]
1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,
https://senderscore.org/blacklistlookup/
[52.103.33.28 listed in bl.score.senderscore.com]
-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)
[52.103.33.28 listed in wl.mailspike.net]
0.0 HTML_MESSAGE BODY: HTML included in message
0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge
1.4 MALFORMED_FREEMAIL Bad headers on message from free email service
0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid
Subject: {SPAM?} CEO MANSOUR GROUP
Subject:
CEO MANSOUR GROUP
From:
Mansour Mohamed
Date:
8/19/26, 14:02
Greetings!
My name is Mohamed Mansour (CEO Mansour Group). I'm reaching out about the potential of a mutually beneficial partnership between us, and i need your kind response to discuss further.
Kindly reach out at your earliest convenience.
While i wait your kind response, please accept the assurances of our highest esteem.
Mohamed Mansour
Founder and Board Member
CEO Mansour Group
Address: No.17, Ummam Center Salah Eddeen Road, Malaz Riyadh, Kindgom of Saudi Arabia
Website: www.mansourgroup.com
The content of this email is confidential and intended for the recipient specified in message only. It is strictly forbidden to share any part of this message with any third party, without a written consent of the sender. If you received this message by mistake, please reply to this message and follow with its deletion, so that we can ensure such a mistake does not occur in the future.unsubscribe from email or ignore
X-Mozilla-Status2: 00000000
Return-path:
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Wed, 19 Aug 2026 14:19:00 -0600
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.5 (FreeBSD))
(envelope-from
id 1wwmkN-000000008qR-13tu
for dave@doctor.nl2k.ab.ca;
Wed, 19 Aug 2026 14:18:51 -0600
Resent-From: The Doctor
Resent-Date: Wed, 19 Aug 2026 14:18:51 -0600
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from mail-westeuropeazolkn19011028.outbound.protection.outlook.com ([52.103.33.28]:22355 helo=AS8PR04CU009.outbound.protection.outlook.com)
by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384
(Exim 4.99.5 (FreeBSD))
(envelope-from
id 1wwmVY-000000006AN-0gd3
for doctor@doctor.nl2k.ab.ca;
Wed, 19 Aug 2026 14:03:41 -0600
ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none;
b=k2t0wApllbtGkxrRhBs2NtdHfV+fp+TmwUkEAawdVg6zpt1EJQQ5brPOuIos0jEWzKuPpel4o8dQBuXgX2h+7KVo20GCHR3q7Jph/WZHKmiqLmaqWSgPLZNIcdgSfyJYOqqY/vXibB2iqTeRMWxwYGAitPti1Eb4tC2UeqM9x5MrVUIBsoFBq9DClxcmOtVe/xfLLiznu+FxdA53Qjfzo7udHceCUJW1b2qKsvLA7p2EGV/2PP4DvZjrPSenfngw46XqhanOq3awQk+foPfn7tXSV3xmBIv7Sc1bdwnTgtp7zJDxp6ly0vfg4sPdbDqTNfDFomTWl5ZV4RZchbOmrA==
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;
s=arcselector10001;
h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1;
bh=edei1xzCDNnIVbCV9b0V9+QuEL4sxOXEOov9fDBrH+M=;
b=tjUV8iVnq7A7kTbwz2pN2uP4eorG34dhHs4C7WjjZW7h7MOv9crZV8J5ICWjxXKrLOuFn30OBr1m5PLhaq7VRSVhW8XPIeE7sBZWr2Iykeqfea+nBvmZssms6hLIyHVkPUzwEDE//2d8b0kWMyPHooxGQ1sRDXvmnHbqGAmHaX34sZq6zbApKZUzoaLXzED0ptx8kHdX/kgOXRxbuj8tFPD9I7hJtZ04uCdyoxwVbSLjz+/7sLVU8SswmtgHCUiL53oR3V9/5+6J82uCctJISVWI5nMllrSmqHyHaA4gtJID1yXQRgqtWKP+AgbukXMLwjrTUKS1r1TC3UQvz6WGkw==
ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=none; dmarc=none;
dkim=none; arc=none
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=outlook.com;
s=selector1;
h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck;
bh=edei1xzCDNnIVbCV9b0V9+QuEL4sxOXEOov9fDBrH+M=;
b=e5I0rW+tf0hQc8YSRKlOrigSfxRBkmg+oHZYBsyHWRr6KTdZ9c8GcSZdc7tvXn+yqYUIt/GVVdXftgC3fWlUSai0zk8BelRElm04ZwJ2CfF2/RdmSb6+C1K8oB3P6jW+wuPAJVggLa99l2wGNLOUZSCWY3K4AaF6jAlx6KrfUIUJKrZGbCDDzGbKBkr8jnurAm5Rg2ck9SCPdesSJ9NcxAjNBKhYIcFLNFs7F/FSeItw2Nbd5HvcI4maWDB0X9ebpUZkRgvdr6+TbWYD3H+3mWwsUhJGw9WR8Pyv2bjGz1t3dnY6w4QE4WLGUmxHcCvTh+uDoI18kv5+Mo6HzQzXyw==
Received: from GVUPR01MB12677.eurprd01.prod.exchangelabs.com
(2603:10a6:150:333::18) by AM7PPF9E4ED15B0.eurprd01.prod.exchangelabs.com
(2603:10a6:20f:fff1::79f) with Microsoft SMTP Server (version=TLS1_2,
cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.339.8; Wed, 19 Aug
2026 20:02:03 +0000
Received: from GVUPR01MB12677.eurprd01.prod.exchangelabs.com
([fe80::d860:f026:ccda:dc0b]) by
GVUPR01MB12677.eurprd01.prod.exchangelabs.com ([fe80::d860:f026:ccda:dc0b%4])
with mapi id 15.21.0339.007; Wed, 19 Aug 2026 20:02:03 +0000
From: Mansour Mohamed
Subject: CEO MANSOUR GROUP
Thread-Topic: CEO MANSOUR GROUP
Thread-Index: AQHdMBVS6TUgTwuaAUCo3I+0rtOYGQ==
Date: Wed, 19 Aug 2026 20:02:02 +0000
Message-ID:
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach: yes
X-MS-TNEF-Correlator:
msip_labels:
x-ms-publictraffictype: Email
x-ms-traffictypediagnostic: GVUPR01MB12677:EE_|AM7PPF9E4ED15B0:EE_
x-ms-office365-filtering-correlation-id: ee5c4ab6-a1d1-4069-264b-08defe2cbc7f
x-microsoft-antispam:
BCL:0;ARA:14566002|25010399006|41001999006|24121999003|22091999003|15001099006|4140399003|24021099003|37011999003|6092099016|31061999003|39105399006|2604032031799003|55001999006|16051099003|18010799003|704163111799003|22141099003|15080799012|15030799006|19110799012|8060799015|8062599012|20055399003|56899033|3412199025|440099028|34005399003|102099032|260806224601699006|39145399003|41105399003|40105399003|2607281247196008|2406899039;
x-microsoft-antispam-message-info:
=?utf-8?B?TGhTQjJ3REx0KzdMVG04Y1NEYkViaFMzaFZWdXF3SVh3dUw1Zjl3ekd5NEpl?=
=?utf-8?B?VFR0RmdDTmFJQ0NIVEMxT09RYzd5VnRpWEhMSVl0NitzcXRwSlFKTmhRU1VY?=
=?utf-8?B?SEd2b3AxWm4wdkJlcWhCd3VNbldZaGRKNXdFeTdZSTVCOStiZXFUdlNIVUd0?=
=?utf-8?B?eXJKRmlJQUpWdjhxVlJtVU5OVEFoRnJzRXdzN1BlQU0xWmkyekc1ZW1USkU4?=
=?utf-8?B?OG52Zmp4a0VkWUpDTTFWamFFWmIrVHhnYkw4cDZRalhrcytONCs4SWV0Nklk?=
=?utf-8?B?ZGRmay9OSy96dWpSNE9UQktrT1JuWUhWV0l4K2hEeUV2TzZTZ1FqQlhJM0s2?=
=?utf-8?B?eXRFK3JJcHdHOHlDWFdMK1lPb2hjMThsNmM3dCtBcDNVQTJ1QUYydXJpd0pM?=
=?utf-8?B?amk3cDMyVlY3Sm5PLzJMRkFZUkVSRVpLQmUwRW5LcE1CSHB1YW9kKzVXU2hV?=
=?utf-8?B?NHppbEFMbFVqUklWRnhGZVFWNFJERHUvR3lyZmovSzlpMGF5bjVLRFZ1bTZm?=
=?utf-8?B?eFFTOTBZa2xFNUZSRmYrUmdTT21qc3NjdzhpMU50bndJUURvZjFadUpaRzZr?=
=?utf-8?B?VWJVc1dzbUNIZFVDVmlzUnhibEtSTGFNUTdIUG12RnRBbVpLaGQwcGQzSUxO?=
=?utf-8?B?KzNKSzVURWZBZWx2blM4bUpyR1ZPRTNsVnBkT09DS01oZjZyQVdKZkxDTU1Y?=
=?utf-8?B?Y1Byb0swRlFKL21kZXVSV1FPa29DNVBiU2l3UmxPejZTRTU0L3FJOTd2bHJ4?=
=?utf-8?B?aEVuU1BoQlFndzJVRDRHdzdKVUQwaWhBVDhXbThyYUNnUitrUGtSaTFCZmI5?=
=?utf-8?B?eDZDNE9mYUM0YUZ4MnUwQkZUVHdTWjNXbk52bDhqUERjNkZzYVY1dlFyeXMw?=
=?utf-8?B?anBNMDJkMzdYeGxJSVhHSUIxaFVHN2d1eUgvSlBFN0djeFU1WHVvaVh0ZjFs?=
=?utf-8?B?SHpHMjdTVVRNL0JIcmRGa0lEaTN2WElrUk05TzFvQTUxYVo0ZEljdnd1aytS?=
=?utf-8?B?dWtOR0pGK1RlRldHSVM3UDA0Ni9RR3RPRVFOOFd0WWtkdFh5b0ZMbzhTU3M0?=
=?utf-8?B?Q3o2RE5xSnNBanQrWFkvaFdDampzOUMyUnV0VkRxMzJoR0tvVTU5T3EzdUNq?=
=?utf-8?B?N0JtOHpxdERuWGxIWGZDSWMzMWxHYUlucUk3NnRoTmJCL28yTDVxeWxZWWtl?=
=?utf-8?B?Q1NPajhwWWJtejkzeEhNVFRkNk5Dd2xDbTlGVUdKd1hlYUxHQndaeXB2ckdx?=
=?utf-8?B?eGNDOTRNWUZWY1h0VTNvMlBhdTdBbTRzZ1ZiQ0tLQ2JjK3lOekFYbERFM01Y?=
=?utf-8?B?NHBwb0twanNLamZxWFMvTWYyYkIzOXphOWk2SXRZMlBkV21HNWZMbVVyK3Bw?=
=?utf-8?B?enVpUEJnb2JUTDFoWm9ZRWI5dnkyRTlaSUd1ODMya3cwQlR2TkF6NGJsSHFv?=
=?utf-8?B?QmZYV0Vyc3VIRXNEZDI0YzBqMGwxcmoxdWdQUGc3Q0tSMzZFM1lsYXd2VHNG?=
=?utf-8?B?M1VaMDNMaFRiYUM0UTNNM3preDFXMTRpMkVuOFR4eDJRb1NPeHd2bE9PbUxV?=
=?utf-8?B?dzFIQ09qWmJvbDVzN3dQbDRhbmVHeElTaXBmZ000ckVNc2VqU1owREpxcmxN?=
=?utf-8?B?cGFXUnZ1NnJabUVZSjNiUFZwRkFBU08xelNmbTJBZ29ybVRKQkFwN2pRYWJL?=
=?utf-8?B?NFNacWFYM1lJcWtRWG9VaXRWVWJUOXVLelkzL1UvWGlrWEpjZWVnWmIzY3I1?=
=?utf-8?B?M3djem5uMVdlTy9yVEFuaU84YWRkWTM5M0R6clZsT1FaeERGL3N4Ukswdzdp?=
=?utf-8?B?ME9QbW1NMTBCSGx1OTM4c2xoVWlEMG5BM1M5RFg0VDZnTU5qNlhmMzNIdUh0?=
=?utf-8?B?aENZRmVEVGQwMHUrMTRFM0pxOE9xWWNHT2JiTjhqY05uN0l4ZFFiWG1idldp?=
=?utf-8?B?L3NtN0tIMjhXNG83SFNSelFGbCtNdVhja1NJQ2JrT2tBemZBRkpyR01pWWcy?=
=?utf-8?Q?ulklHlJE1YeeD/HM4/1SNl9mQRbpx8=3D?=
x-ms-exchange-antispam-messagedata-chunkcount: 1
x-ms-exchange-antispam-messagedata-0:
=?utf-8?B?L0dMVmJObEMreExWcUxQL3FZMGNmdEpOSUs3SWp5Uk5SM2JneHA5SkNOL01O?=
=?utf-8?B?bCtFS2ZnZVQ4WVMyMnhxY3pQYk1zSzZqSHhXNzRFdllkbEd6ajZQYkxhNGxV?=
=?utf-8?B?L2F6aWU1eERORDRwU2NhTnJQU3lHZVdCZXRRdkErWU9NVVhFRUg4OGJJLzFo?=
=?utf-8?B?SjhEY0xuZWlwR1JOYys1dmkzTzdOMEduOWFTMDBJeCtadVRsNTJyU0ZqUDU4?=
=?utf-8?B?aGFiRzNTSkZhY1MrNlNRejVScFA1aFNjWlc5eS93RVZsSnp2Z2lXODZjbDBB?=
=?utf-8?B?WHlCOGplbG83OTllMUgrUHcvellQd0xLR3BmaCtUd2RpRGdNMHZ6eUZGOGZh?=
=?utf-8?B?QnRkdlI5V2hUcXo2MU4vTkJVN0d3c3JGOUNDUGozRmthbWUyUXdqVERUTksz?=
=?utf-8?B?TjFzaUgrZUJKOWw0OUFVTmdtTGRIUHZZQkcvam4raEhCZ0EyeFNObGtubmx2?=
=?utf-8?B?N3EreCsrUUZtSDhyaWpITkVmRFk5eVVXa0pkbittMHMvbDdXWWxURkNCOUN1?=
=?utf-8?B?eGJ5ZTEzbGN0NllOZUFTTXo4Y244dGlWN2RIRzNMa0owY1RZblRrVzczdy9n?=
=?utf-8?B?Tk5OSG1XS0Fudi9xQ2tDRmZOUFBDY3kydDJxbXFaOGpwU3lCRUI2Z29lMHV0?=
=?utf-8?B?V25hVGhZQmp0a3BldFJRUjFkQjBleUpOUjJ3MjBaQW0zRjZsbjFTZ1NqamdX?=
=?utf-8?B?Ty9pZ1NQM2k2RkZiaEszLzNJbGIzR2NWcHdKNkZ6TTRjaDcwdTA5UG5aeE9l?=
=?utf-8?B?YmhldmNSSS8xU1FwK1FaTnlHeVJjbTV2YjJ3TlBqQms1dlBQWGtpbGVOT0JU?=
=?utf-8?B?SFlSYkhzeVRqR3ZZSWdra2VqaXpaOFhXdGhWSUNqcUwySkpDek9OdU90TU5E?=
=?utf-8?B?dGk1Q0hSc1R3U1lqOW00azcwZk9JL2lsLzh4czdnYUxLaXR1eVVScGFyK25P?=
=?utf-8?B?V2xOTEpqQ1JTV3lIMFF1bWgwckpmLzhQMHZ4ZzZYQmVYUTVZdldISHdROE9R?=
=?utf-8?B?SXFkUXRrVkZaYktRbVVjNDMxblJIOXZxRkNOWjFaZWlvWWhnSjNmKzlPWkdQ?=
=?utf-8?B?WUREYjVpaHJ3ZDFzcHFVeXM0TW9TOFhBV0huV1Rqd2JxWjFzajM3UmE2RjR5?=
=?utf-8?B?c29vU0pHKzd4VjhLeWs0dGQvWngySWs2Q08zcmptaTdzWFEveGNTTGg1Zkdt?=
=?utf-8?B?UTE5dExJSTc4NmMrR1R3Y254RlNqTUUzWUpMYmRrS2pmVTRJaVk0K2JPVjdM?=
=?utf-8?B?a29MOWlzQWxpbW9wQWRsOHFkSDZpOStYR2pyL1cwelZBb09McmxjNE40V01B?=
=?utf-8?B?UzBYREdLTXg1NFhjcnJjRHMxMjVBVERkTndNeVBSc2ZNUG5UeGk3TDNSQmty?=
=?utf-8?B?WVRMeWtEMG56Q29IVDMyaEhWM3FHc0dLSDRVcVhJaG9TVXBhLzJhajMwU1BW?=
=?utf-8?B?V1o4ODZkVWl5cC93OGRwT3E0QUcyYW5Ya01mVU9teElaL0o1azRQZjVtbXJq?=
=?utf-8?B?RnJ2ZG1vRGs1b3dOcEJ4ZHlFTTJzMCs1QTRQeW5rUG5TZzQvd2hlakxBNUk3?=
=?utf-8?B?bmZGdWo1VUpFSDVOSDNqbDVEb1FUZUlvRTdxVzFoZ1NMZGJmajFXS0Jpb2FZ?=
=?utf-8?B?TGtRdmJCK0pBRjdKTWFmMmk4andCZ3dEbzhkeVZoNmpIQTEvMnNrM3pSMzJm?=
=?utf-8?B?ZEltaEtVY21NWXpoVThyT21XeTZBa3RZaHpDYTZFQVNCWSsyWEVhMG5XSHFz?=
=?utf-8?B?ZFEwTXJFY05vbkpXSFc1bDc2RXRxMHNnM2NVSVZMMnFiMXpoZTlOUDdxUWY1?=
=?utf-8?B?U2hOaWVJY2JDZHBZTXFzTU1xajRKdTRaUTI3TmliTytoVUpQV3N6QUlmc1F5?=
=?utf-8?Q?r14aFmqBAPbEe?=
Content-Type: multipart/related;
boundary="_004_GVUPR01MB126774698CD65074EDACA951DB3A52GVUPR01MB12677eu_";
type="multipart/alternative"
MIME-Version: 1.0
X-OriginatorOrg: outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-AuthSource: GVUPR01MB12677.eurprd01.prod.exchangelabs.com
X-MS-Exchange-CrossTenant-RMS-PersistedConsumerOrg: 00000000-0000-0000-0000-000000000000
X-MS-Exchange-CrossTenant-Network-Message-Id: ee5c4ab6-a1d1-4069-264b-08defe2cbc7f
X-MS-Exchange-CrossTenant-originalarrivaltime: 19 Aug 2026 20:02:02.7557
(UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: 84df9e7f-e9f6-40af-b435-aaaaaaaaaaaa
X-MS-Exchange-CrossTenant-rms-persistedconsumerorg: 00000000-0000-0000-0000-000000000000
X-MS-Exchange-Transport-CrossTenantHeadersStamped: AM7PPF9E4ED15B0
X-Spam_score: 5.3
X-Spam_score_int: 53
X-Spam_bar: +++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: Greetings! My name is Mohamed Mansour (CEO Mansour Group).
I'm reaching out about the potential of a mutually beneficial partnership
between us, and i need your kind response to discuss further. Kindly reach
out at your earliest convenience.
Content analysis details: (5.3 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org
[2603:10a6:150:333:0:0:0:18 listed in]
[will-spam-for-food.eu.org]
[2603:10a6:150:333:0:0:0:18 listed in]
[will-spam-for-food.eu.org]
[2603:10a6:150:333:0:0:0:18 listed in]
[will-spam-for-food.eu.org]
[2603:10a6:150:333:0:0:0:18 listed in]
[will-spam-for-food.eu.org]
[2603:10a6:150:333:0:0:0:18 listed in]
[will-spam-for-food.eu.org]
[2603:10a6:150:333:0:0:0:18 listed in]
[will-spam-for-food.eu.org]
[2603:10a6:150:333:0:0:0:18 listed in]
[will-spam-for-food.eu.org]
[2603:10a6:150:333:0:0:0:18 listed in]
[will-spam-for-food.eu.org]
[52.103.33.28 listed in will-spam-for-food.eu.org]
[52.103.33.28 listed in will-spam-for-food.eu.org]
[52.103.33.28 listed in will-spam-for-food.eu.org]
[52.103.33.28 listed in will-spam-for-food.eu.org]
[52.103.33.28 listed in will-spam-for-food.eu.org]
[52.103.33.28 listed in will-spam-for-food.eu.org]
[52.103.33.28 listed in will-spam-for-food.eu.org]
[52.103.33.28 listed in will-spam-for-food.eu.org]
1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org
[2603:10a6:150:333:0:0:0:18 listed in]
[dnsbl.ahbl.org]
[2603:10a6:150:333:0:0:0:18 listed in]
[dnsbl.ahbl.org]
[2603:10a6:150:333:0:0:0:18 listed in]
[dnsbl.ahbl.org]
[2603:10a6:150:333:0:0:0:18 listed in]
[dnsbl.ahbl.org]
[52.103.33.28 listed in dnsbl.ahbl.org]
[52.103.33.28 listed in dnsbl.ahbl.org]
[52.103.33.28 listed in dnsbl.ahbl.org]
[52.103.33.28 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org
[2603:10a6:150:333:0:0:0:18 listed in]
[dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org
[2603:10a6:150:333:0:0:0:18 listed in]
[dnsbl.ahbl.org]
1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org
[2603:10a6:150:333:0:0:0:18 listed in]
[dnsbl.ahbl.org]
0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org
[2603:10a6:150:333:0:0:0:18 listed in]
[dnsbl.ahbl.org]
-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact
cert-sa@returnpath.net
[Excessive Number of Queries |
-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact
safe-sa@returnpath.net
[Excessive Number of Queries |
-0.0 SPF_HELO_PASS SPF: HELO matches SPF record
-0.0 SPF_PASS SPF: sender matches SPF record
1.2 MISSING_HEADERS Missing To: header
1.6 SUBJ_ALL_CAPS Subject is all capitals
-0.0 T_RP_MATCHES_RCVD Envelope sender domain matches handover relay
domain
0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider
[ceomansourgroup(at)outlook.com]
-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no
trust
[52.103.33.28 listed in list.dnswl.org]
1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,
https://senderscore.org/blacklistlookup/
[52.103.33.28 listed in bl.score.senderscore.com]
-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)
[52.103.33.28 listed in wl.mailspike.net]
0.0 HTML_MESSAGE BODY: HTML included in message
0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge
1.4 MALFORMED_FREEMAIL Bad headers on message from free email service
0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid
Subject: {SPAM?} CEO MANSOUR GROUP
Subject:
CEO MANSOUR GROUP
From:
Mansour Mohamed
Date:
8/19/26, 14:02
Greetings!
My name is Mohamed Mansour (CEO Mansour Group). I'm reaching out about the potential of a mutually beneficial partnership between us, and i need your kind response to discuss further.
Kindly reach out at your earliest convenience.
While i wait your kind response, please accept the assurances of our highest esteem.
Mohamed Mansour
Founder and Board Member
CEO Mansour Group
Address: No.17, Ummam Center Salah Eddeen Road, Malaz Riyadh, Kindgom of Saudi Arabia
Website: www.mansourgroup.com
The content of this email is confidential and intended for the recipient specified in message only. It is strictly forbidden to share any part of this message with any third party, without a written consent of the sender. If you received this message by mistake, please reply to this message and follow with its deletion, so that we can ensure such a mistake does not occur in the future.unsubscribe from email or ignore
Mansour group spam from Microsoft Outlook
Posted by Dave Yadallee on
X-Mozilla-Status: 0001
X-Mozilla-Status2: 00000000
Return-path:
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Wed, 19 Aug 2026 14:19:00 -0600
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.5 (FreeBSD))
(envelope-from)
id 1wwmkJ-000000008pj-1ghi
for dave@doctor.nl2k.ab.ca;
Wed, 19 Aug 2026 14:18:47 -0600
Resent-From: The Doctor
Resent-Date: Wed, 19 Aug 2026 14:18:47 -0600
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from mail-northeuropeazolkn19011027.outbound.protection.outlook.com ([52.103.32.27]:27127 helo=DU2PR03CU002.outbound.protection.outlook.com)
by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384
(Exim 4.99.5 (FreeBSD))
(envelope-from)
id 1wwmUx-0000000063e-0tfc
for doctor@doctor.nl2k.ab.ca;
Wed, 19 Aug 2026 14:03:04 -0600
ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none;
b=a1hz4/FtNfiYahUe4BXpwOXoEzgcQzIasOeGGqmiBx5eEB1LgI5FK8VIRWJ3o0E1qDv7fOs8M9K7Ck1EOdC4W0RjgciU9kyy5+zl9ketU0fbxACV6Gg/oWRfwDQzzafCrhwf/IXTBkERAQDz4R8sNW5tkOeFO/a8KGe9e6mTgl2eEpbMB4hmbg7QuYa3UwIm2gxIk6IIgVwBLNe9XM7jYB60SRGo639YbcDs6XKYhDez6iJ3uFSwBpxjGarTdBDkuDLy7+mnDNRtYN0z6fjKIcOEztnECyZ2U6zFlbrqGloVD7qd8ACp+DFtYCuMcALedK8s8yygXxbNoJLw91LCkA==
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;
s=arcselector10001;
h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1;
bh=WjaRdakUfAaYzOIY2w1I3uj44IfEY80/vp0NFHVWlCw=;
b=pAzs80yTGPzAIQZBX5WIr+dIoXFvnQ23+foGdaAgrSo+xaDCrqchvIxhSiArQHWgybvAPgac/ayN03nhi+1gz83bOSA0Oyjxt3t2f3pOu4IfmcWrT8crtNNodZB8L8Kr8Y/PgeP5XAr5YTYLnufCu4RoqpDBBk+tCYVg9Gteygu9GwXo0fygEo9P8VwRajGhboGxLMyqGC2T6XtKReZ96RSK9mjtoVxiQtMLQmWAj60d/xThkfXn5EFo/LCqxDVBraVga1GfAMLWj86vvSe+0wXu7ALYwHfWRGwFjB+GHF6VPyTmg98bjOnZLAxyBKApBCP11QhmvRL0bViunLbs5A==
ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=none; dmarc=none;
dkim=none; arc=none
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=outlook.com;
s=selector1;
h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck;
bh=WjaRdakUfAaYzOIY2w1I3uj44IfEY80/vp0NFHVWlCw=;
b=SOeM6RKrLjITxAM+96f0XMf8RQiI+pTQJO+2oYpARBJZg2NF3jJPCx104h1DLVbxSwwuuj54rIkT4Zw/OmXT2oCg3qW/xadAqutb8Czg/nXP/punHKOFIhrIKB1dnD8mb7VPtyfr7Zsnc0x081fCRrVL3JZ1ghRJ8NaPA+VTfEMmWwyhyz8iFpDb7BaYTFCVRKCWgaeZ0X6ioxfSoTVlYv2Dgm80gvPIGyW4RIfkUj2715cfAXkYGDJ3LeNgenjPmVtbbRTBs76uHkAvWD5R/DsQVqckMyNP31/AO6T5uFia9deIes61zRuNOEdudU9i4yc78bBIvHX+TIRSVbS1uQ==
Received: from GVUPR01MB12677.eurprd01.prod.exchangelabs.com
(2603:10a6:150:333::18) by AM7PPF9E4ED15B0.eurprd01.prod.exchangelabs.com
(2603:10a6:20f:fff1::79f) with Microsoft SMTP Server (version=TLS1_2,
cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.339.8; Wed, 19 Aug
2026 20:01:57 +0000
Received: from GVUPR01MB12677.eurprd01.prod.exchangelabs.com
([fe80::d860:f026:ccda:dc0b]) by
GVUPR01MB12677.eurprd01.prod.exchangelabs.com ([fe80::d860:f026:ccda:dc0b%4])
with mapi id 15.21.0339.007; Wed, 19 Aug 2026 20:01:57 +0000
From: Mansour Mohamed
Subject: CEO MANSOUR GROUP
Thread-Topic: CEO MANSOUR GROUP
Thread-Index: AQHdMBVVCdHPN66/dEuErFSkSUH1EA==
Date: Wed, 19 Aug 2026 20:01:56 +0000
Message-ID:
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach: yes
X-MS-TNEF-Correlator:
msip_labels:
x-ms-publictraffictype: Email
x-ms-traffictypediagnostic: GVUPR01MB12677:EE_|AM7PPF9E4ED15B0:EE_
x-ms-office365-filtering-correlation-id: 67a2f9eb-7d4d-49ec-3590-08defe2cb8f9
x-microsoft-antispam:
BCL:0;ARA:14566002|25010399006|41001999006|24121999003|22091999003|4140399003|24021099003|37011999003|6092099016|31061999003|39105399006|2604032031799003|55001999006|16051099003|704163111799003|15080799012|15030799006|22121099003|19110799012|8060799015|8062599012|20055399003|56899033|3412199025|440099028|34005399003|102099032|260806224601699006|39145399003|41105399003|40105399003|2607281247196008|2406899039;
x-microsoft-antispam-message-info:
=?utf-8?B?WjNxckgvU3loU1Baa0VaWlRmV1BQYk1rMTQveHN2R1FycHNUN1NJd2xNbnVQ?=
=?utf-8?B?eCtsNitwam9FYXRYb293RlBXeEVTR1lQRHVENGhWN01TcDZNNmwzdC9veXpB?=
=?utf-8?B?SG9yRFczMGRFcHlJT24rbEVUNnE3dlFDRFkyb0xEU3lmQ3Y1ZG9wVTZoMDg4?=
=?utf-8?B?S1QyWWFMbGtkMzRjVWtLRkxYelg3WENNd2plNC9WWE43c010QXhvb2UvUXRj?=
=?utf-8?B?MDdudnBlSW1Mdm1FQ3d0c2dUeUsxSkJNQ0lWNjY4NDZITXhjcEtmblU4S2lR?=
=?utf-8?B?a3dzSWQwaW8wTHJkMWVEaU1wRFVNSEJYWDczWnd5V3Y1MEFXOFkwZlVxejBh?=
=?utf-8?B?cUN5dFVOZ05PSFNwV2V5N21MaFUxQUNlK3RGQWUzbzlqQkdlcjhuK1RIVnhP?=
=?utf-8?B?cm5TZ1hFTVBqaDlGNFJDbHA5SmwxN2tKNkZnbjFDcEFpcCtxQkwwMlloVkpD?=
=?utf-8?B?L3Bqbi83UTJ4UjVtR05IMnZ4ZXNzb2R2NldqSG1FbWY4UVZ5clhnbGQ0ODVK?=
=?utf-8?B?S3JvelhYb2lPVjA3eGR5M2RTTDBFLzE3d1VlVkxOMm1mUDJMYnFVTy9sUiti?=
=?utf-8?B?Uk5qdEx3ZzdMOVVtb08zZ3h4aXNwNWxiMWxCUVEybE1OOHp3NXloTVNkV2N4?=
=?utf-8?B?U1FpZXJmQ01vRTg2WVVFMm82Z1JwQzRWZjlVMVFzaTdRVk9lTE1sSjA1TERX?=
=?utf-8?B?SU1Qd20zNTdUQW5EblA1bklFaXZ2bUY1aHZKMlJyblBEcmJ4bm0yREJkWFM4?=
=?utf-8?B?LzB0OWx3dEZpaEs2Y0piWXpCbVRNUzUyemM4a1lWbjIrYzF3L0xWRnBJRVNK?=
=?utf-8?B?RjN6VzdKVkJiWThjckp6L2h6ZHNzeXNLRzJ0YXNGR3NsazZ1azBiTjMvMlZC?=
=?utf-8?B?Nk9wM0xqZXFIWXhQTVhNS0xlMlFIRFViSWdIbW8wRm5FeC9xS3Zma1c4TThO?=
=?utf-8?B?dDZCVFYzUjZxblhCeHJhUzIyQ1BkODhUaEQyTDYvWjg0NmZZVTlUNmFZRVBk?=
=?utf-8?B?bWdzSS9qeDZNMk11SnJpdkRuNkdwUXgwNFlaZFFxek04aklXV2VzYitodGsw?=
=?utf-8?B?UVExMjAxTVAvUzltM3Q1OXNGaDJKMkpadDArRTZvZ01TT3Y0aWRkRFZOaEdi?=
=?utf-8?B?R3lGcEdyQVBBWlB6bkdES3Z3dzVjbXhhRzJYOW8yUW9HY083ZlJoT1N0eEZi?=
=?utf-8?B?N2ZYSlc3TW1RWmlqdXBoam00OC9NekhzYnpyOTZXdnVyYmZJZS9nYjdiM2Vx?=
=?utf-8?B?SlA4akRnMDZ1RWcvRHptY1dKaTgzQS9DelJvOCtJRlpGb1BGc2t3VEdjWWs1?=
=?utf-8?B?WmNOSFljc2szRldXa0N6ZTRvWWROdGVjdi9PaFBFRjA0Tm1FOUZKMyt6K2tH?=
=?utf-8?B?cmQ5RGRJbTJtTTVuVzdWdGtRaTJubWVvNTJkZ2hEc3pIRUpDN0pteFlCOGlM?=
=?utf-8?B?ZHhJZmd0cWIraUhmdy9sMWtvaTR0SkZROXgrNDZMbXovWDFycXRGYld1VVIw?=
=?utf-8?B?UFNGUlllWGdPa3VrU1hEMFlNd1dNU2NCeW9LdkREU3c0UXBLQU91cklLYjlC?=
=?utf-8?B?dHFyNEZVOHBBMFdNTGlHNGIxVXBJYjkzWXVQUmU5Y0xTRGFUeGlSNE9HbDdz?=
=?utf-8?B?M1RjbFdwblYyMEd5ZmdISFJlTEVLVVZSWUN5MFpLMFR3SkJMNkRKYy9kb0RP?=
=?utf-8?B?MEdxL1A1SmlaWXh0Zi93MDdTSm5NZXo5clp6R2x6V3FWWFJlQklXbG9tT3Rx?=
=?utf-8?B?NDlrczZDdDhXcUROUXBiM3hETFI0cDlmd3NCbUU5VmR2NnBLYU9VOUNtK2ZX?=
=?utf-8?B?WkR3WXBEQUVSTXhkVzFpN1h5SjlKckxVY3J1dFI4bGRIRE53OEc1ekg0MW1V?=
=?utf-8?B?YTYzVmE0aFJENGdGbVpYQmk5TjIrVmZKeld3VG4vM3VVbzhzdWgwaUMwVmJX?=
=?utf-8?Q?ObkXphwIJJ8=3D?=
x-ms-exchange-antispam-messagedata-chunkcount: 1
x-ms-exchange-antispam-messagedata-0:
=?utf-8?B?dzVhNVdQRWhCSVk1a1JSQzlYYmRrL1VkMWhKclorZzdmRDZVcHBld3hrM3lw?=
=?utf-8?B?TGdja1RKaXJMTHlrUkNkWnlZZExUQmNNRnM3WUR1UGdwU1FSUjVCWG0xTjAz?=
=?utf-8?B?eGdjSmRheE12T3E3U2pzMmdSOEdENGVUYzBqcDBmanQvaGlsU3U5NzBzMnRN?=
=?utf-8?B?QWt1YW5ZR1NqS29YVGlTMmVBVjFzUE1mYlVyNVdUd3o2MmdIeWFDTXdONHp1?=
=?utf-8?B?aklnWUdaczdQN2NoWVdKZVhtL3lqN2tqV2JJSGo0WU51U0tkWFlISUhuaEht?=
=?utf-8?B?bmZZdHZuVW5TS0FDZmNmSElGMldSSUNieTZJQVEydmVmRG9Xd2xIcHlIWEV2?=
=?utf-8?B?NUVyblM0NFp2aTd6ZnVNOUN2R2ZSVk5sWVRLV1g4TUN4UXNoQjlrV1dpNFFO?=
=?utf-8?B?U0ZtSmJYU0NYbVVPT0NSMW1MUzNteWtiNzh0b1RuYzl1aXA1VFh4SlUwYVZ6?=
=?utf-8?B?b1BCZHdtNVBaWnh0RjREUnZqUWxiM2NNandpeEFZTTFnWU5xVVAwRUtZOEls?=
=?utf-8?B?Y0tXOGwrblNsSzJTcmlsa3M3SkdsU0FBOWE5bzY3MnVjdGpQdzI0cU8zRkI5?=
=?utf-8?B?RXZ1dEZQMjdFN0dpK2xqTFp5MFY2VDdlK2NtRXYvek5MZmlmK25sTVF4SXE5?=
=?utf-8?B?NVVSblhCUXlINjRoNE5RLysrcldhcjZpeEoxUjMzUS95Q3dyTXFTNTVZNith?=
=?utf-8?B?dFBxeXc0akY2YmluR0hMemkva2JsdHZSV1AwNG1NbjZzN1dMaTRpQjR6MW5h?=
=?utf-8?B?akxpQ2dIUURtRndtSWpMakhFSjkwKzZEYUdOSW94TzU3d29haUFkOFR2ZWRD?=
=?utf-8?B?TG5uUi9OTG1saHQzWXdPWmRtSTZkbEpJNy9MakZGV1ExU2laMjd4QmgweUpE?=
=?utf-8?B?cGtkZEVNRlpRekVCQUQxbGFHcWJGZ2hSZEhhTEkyeUhLMHNrVzNkdWNPb3R4?=
=?utf-8?B?b0ozYzIzZ1IrYWt6MVRVb1RFdjlWc01sSUhDQ0xiTUpsdHp4dlFiK1czUXRN?=
=?utf-8?B?YkprZUxlUDUzQU8wWGJrYnBiMjFoakZEU09pdCs2OGVsd0lUY2tQcnFwYkVD?=
=?utf-8?B?VExTcjc2SDdoQk1leXZ5d1VWenN6eFplazBYZm5na2lLeGZqV2s4dW1wQ3cz?=
=?utf-8?B?bW45N0pNbzFJV3VWRmxJeDhmbkIyT1Q1MktMZjNjYkFjK3ZzNXNmUklWbGxI?=
=?utf-8?B?RDFDc3YzSzVrT3pYR1NwZ2RhWGRUM0VHQUtVMkJjNnA5YUpYb1N6Ritnd2c5?=
=?utf-8?B?SlZ5aWRNeXR3cDdlY0lFWVBIQjhTRHVOcFVZODlwRXRobTEwQmwwZHcyZ0xi?=
=?utf-8?B?YkZWdGgyM2RaY3dGeXBuMlFqQ3ZKUG1peGp2MllnYllBc0E0Si9XUFVkRkZa?=
=?utf-8?B?Y21DV1B5cHM3UWdZU3k4Tms2RTJSQlhWdTBvTmxaVTgvV2lYRm1ycXd5ZDlz?=
=?utf-8?B?dXZqdFR2VUwwbzgrU2dPUkRON1dhRUQxMnFIVGtNUUVscStCbmduRVdRbC9K?=
=?utf-8?B?VTV4RDdPcDY0dE5zaG96OWk4SlY0UGdzV2ZCeVV1Q2ZWcjhYL294RTdvcGJw?=
=?utf-8?B?QXZOTjlWY0IzbFRKdjh0RGp6NzJxb0Q1dXN4SVhaenI4T3UvM2NBWEZxMFp0?=
=?utf-8?B?dU1OdTYzdmhLdEVFSmFnWTYvZG1FWGh2YU9NbGM5bjlPWEoxQ1o5dFp5TTYy?=
=?utf-8?B?Wk1xWitKR0orZ0ZYazlZVFBWSmV3eVBGTXEzSjNzN0c3V3EydEV1czNvWUdo?=
=?utf-8?B?QlY1WHVBd0RIYzdIdjNDaEtkMGxYZ09sNkp4dWY1TEJKUDVsekUxUFQ4dUV4?=
=?utf-8?B?RDUvOHh2WkFONllzV1NiNG5mODlDYnFmNFhsNG4zMmxUVUlZVEtuUE5TTEJh?=
=?utf-8?Q?0OgpWK1iOL3Gl?=
Content-Type: multipart/related;
boundary="_004_GVUPR01MB12677D01237D8DF4E8BB1D0FAB3A52GVUPR01MB12677eu_";
type="multipart/alternative"
MIME-Version: 1.0
X-OriginatorOrg: outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-AuthSource: GVUPR01MB12677.eurprd01.prod.exchangelabs.com
X-MS-Exchange-CrossTenant-RMS-PersistedConsumerOrg: 00000000-0000-0000-0000-000000000000
X-MS-Exchange-CrossTenant-Network-Message-Id: 67a2f9eb-7d4d-49ec-3590-08defe2cb8f9
X-MS-Exchange-CrossTenant-originalarrivaltime: 19 Aug 2026 20:01:56.8332
(UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: 84df9e7f-e9f6-40af-b435-aaaaaaaaaaaa
X-MS-Exchange-CrossTenant-rms-persistedconsumerorg: 00000000-0000-0000-0000-000000000000
X-MS-Exchange-Transport-CrossTenantHeadersStamped: AM7PPF9E4ED15B0
X-Spam_score: 5.3
X-Spam_score_int: 53
X-Spam_bar: +++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: Greetings! My name is Mohamed Mansour (CEO Mansour Group).
I'm reaching out about the potential of a mutually beneficial partnership
between us, and i need your kind response to discuss further. Kindly reach
out at your earliest convenience.
Content analysis details: (5.3 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org
[2603:10a6:150:333:0:0:0:18 listed in]
[will-spam-for-food.eu.org]
[2603:10a6:150:333:0:0:0:18 listed in]
[will-spam-for-food.eu.org]
[2603:10a6:150:333:0:0:0:18 listed in]
[will-spam-for-food.eu.org]
[2603:10a6:150:333:0:0:0:18 listed in]
[will-spam-for-food.eu.org]
[2603:10a6:150:333:0:0:0:18 listed in]
[will-spam-for-food.eu.org]
[2603:10a6:150:333:0:0:0:18 listed in]
[will-spam-for-food.eu.org]
[2603:10a6:150:333:0:0:0:18 listed in]
[will-spam-for-food.eu.org]
[2603:10a6:150:333:0:0:0:18 listed in]
[will-spam-for-food.eu.org]
[52.103.32.27 listed in will-spam-for-food.eu.org]
[52.103.32.27 listed in will-spam-for-food.eu.org]
[52.103.32.27 listed in will-spam-for-food.eu.org]
[52.103.32.27 listed in will-spam-for-food.eu.org]
[52.103.32.27 listed in will-spam-for-food.eu.org]
[52.103.32.27 listed in will-spam-for-food.eu.org]
[52.103.32.27 listed in will-spam-for-food.eu.org]
[52.103.32.27 listed in will-spam-for-food.eu.org]
1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org
[52.103.32.27 listed in dnsbl.ahbl.org]
[52.103.32.27 listed in dnsbl.ahbl.org]
[52.103.32.27 listed in dnsbl.ahbl.org]
[52.103.32.27 listed in dnsbl.ahbl.org]
[2603:10a6:150:333:0:0:0:18 listed in]
[dnsbl.ahbl.org]
[2603:10a6:150:333:0:0:0:18 listed in]
[dnsbl.ahbl.org]
[2603:10a6:150:333:0:0:0:18 listed in]
[dnsbl.ahbl.org]
[2603:10a6:150:333:0:0:0:18 listed in]
[dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org
[52.103.32.27 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org
[52.103.32.27 listed in dnsbl.ahbl.org]
1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org
[52.103.32.27 listed in dnsbl.ahbl.org]
0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org
[52.103.32.27 listed in dnsbl.ahbl.org]
-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no
trust
[52.103.32.27 listed in list.dnswl.org]
-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact
cert-sa@returnpath.net
[Excessive Number of Queries |]
-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact
safe-sa@returnpath.net
[Excessive Number of Queries |]
-0.0 SPF_HELO_PASS SPF: HELO matches SPF record
-0.0 SPF_PASS SPF: sender matches SPF record
1.2 MISSING_HEADERS Missing To: header
1.6 SUBJ_ALL_CAPS Subject is all capitals
-0.0 T_RP_MATCHES_RCVD Envelope sender domain matches handover relay
domain
0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider
[ceomansourgroup(at)outlook.com]
-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)
[52.103.32.27 listed in wl.mailspike.net]
1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,
https://senderscore.org/blacklistlookup/
[52.103.32.27 listed in bl.score.senderscore.com]
0.0 HTML_MESSAGE BODY: HTML included in message
0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge
0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid
1.4 MALFORMED_FREEMAIL Bad headers on message from free email service
Subject: {SPAM?} CEO MANSOUR GROUP
Greetings!
My name is Mohamed Mansour (CEO Mansour Group). I'm reaching out about the potential of a mutually beneficial partnership between us, and i need your kind response to discuss further.
Kindly reach out at your earliest convenience.
While i wait your kind response, please accept the assurances of our highest esteem.
Mohamed Mansour
Founder and Board Member
CEO Mansour Group
Address: No.17, Ummam Center Salah Eddeen Road, Malaz Riyadh, Kindgom of Saudi Arabia
Website: www.mansourgroup.com
The content of this email is confidential and intended for the recipient specified in message only. It is strictly forbidden to share any part of this message with any third party, without a written consent of the sender. If you received this message by mistake, please reply to this message and follow with its deletion, so that we can ensure such a mistake does not occur in the future.unsubscribe from email or ignore
X-Mozilla-Status2: 00000000
Return-path:
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Wed, 19 Aug 2026 14:19:00 -0600
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.5 (FreeBSD))
(envelope-from
id 1wwmkJ-000000008pj-1ghi
for dave@doctor.nl2k.ab.ca;
Wed, 19 Aug 2026 14:18:47 -0600
Resent-From: The Doctor
Resent-Date: Wed, 19 Aug 2026 14:18:47 -0600
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from mail-northeuropeazolkn19011027.outbound.protection.outlook.com ([52.103.32.27]:27127 helo=DU2PR03CU002.outbound.protection.outlook.com)
by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384
(Exim 4.99.5 (FreeBSD))
(envelope-from
id 1wwmUx-0000000063e-0tfc
for doctor@doctor.nl2k.ab.ca;
Wed, 19 Aug 2026 14:03:04 -0600
ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none;
b=a1hz4/FtNfiYahUe4BXpwOXoEzgcQzIasOeGGqmiBx5eEB1LgI5FK8VIRWJ3o0E1qDv7fOs8M9K7Ck1EOdC4W0RjgciU9kyy5+zl9ketU0fbxACV6Gg/oWRfwDQzzafCrhwf/IXTBkERAQDz4R8sNW5tkOeFO/a8KGe9e6mTgl2eEpbMB4hmbg7QuYa3UwIm2gxIk6IIgVwBLNe9XM7jYB60SRGo639YbcDs6XKYhDez6iJ3uFSwBpxjGarTdBDkuDLy7+mnDNRtYN0z6fjKIcOEztnECyZ2U6zFlbrqGloVD7qd8ACp+DFtYCuMcALedK8s8yygXxbNoJLw91LCkA==
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;
s=arcselector10001;
h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1;
bh=WjaRdakUfAaYzOIY2w1I3uj44IfEY80/vp0NFHVWlCw=;
b=pAzs80yTGPzAIQZBX5WIr+dIoXFvnQ23+foGdaAgrSo+xaDCrqchvIxhSiArQHWgybvAPgac/ayN03nhi+1gz83bOSA0Oyjxt3t2f3pOu4IfmcWrT8crtNNodZB8L8Kr8Y/PgeP5XAr5YTYLnufCu4RoqpDBBk+tCYVg9Gteygu9GwXo0fygEo9P8VwRajGhboGxLMyqGC2T6XtKReZ96RSK9mjtoVxiQtMLQmWAj60d/xThkfXn5EFo/LCqxDVBraVga1GfAMLWj86vvSe+0wXu7ALYwHfWRGwFjB+GHF6VPyTmg98bjOnZLAxyBKApBCP11QhmvRL0bViunLbs5A==
ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=none; dmarc=none;
dkim=none; arc=none
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=outlook.com;
s=selector1;
h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck;
bh=WjaRdakUfAaYzOIY2w1I3uj44IfEY80/vp0NFHVWlCw=;
b=SOeM6RKrLjITxAM+96f0XMf8RQiI+pTQJO+2oYpARBJZg2NF3jJPCx104h1DLVbxSwwuuj54rIkT4Zw/OmXT2oCg3qW/xadAqutb8Czg/nXP/punHKOFIhrIKB1dnD8mb7VPtyfr7Zsnc0x081fCRrVL3JZ1ghRJ8NaPA+VTfEMmWwyhyz8iFpDb7BaYTFCVRKCWgaeZ0X6ioxfSoTVlYv2Dgm80gvPIGyW4RIfkUj2715cfAXkYGDJ3LeNgenjPmVtbbRTBs76uHkAvWD5R/DsQVqckMyNP31/AO6T5uFia9deIes61zRuNOEdudU9i4yc78bBIvHX+TIRSVbS1uQ==
Received: from GVUPR01MB12677.eurprd01.prod.exchangelabs.com
(2603:10a6:150:333::18) by AM7PPF9E4ED15B0.eurprd01.prod.exchangelabs.com
(2603:10a6:20f:fff1::79f) with Microsoft SMTP Server (version=TLS1_2,
cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.339.8; Wed, 19 Aug
2026 20:01:57 +0000
Received: from GVUPR01MB12677.eurprd01.prod.exchangelabs.com
([fe80::d860:f026:ccda:dc0b]) by
GVUPR01MB12677.eurprd01.prod.exchangelabs.com ([fe80::d860:f026:ccda:dc0b%4])
with mapi id 15.21.0339.007; Wed, 19 Aug 2026 20:01:57 +0000
From: Mansour Mohamed
Subject: CEO MANSOUR GROUP
Thread-Topic: CEO MANSOUR GROUP
Thread-Index: AQHdMBVVCdHPN66/dEuErFSkSUH1EA==
Date: Wed, 19 Aug 2026 20:01:56 +0000
Message-ID:
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach: yes
X-MS-TNEF-Correlator:
msip_labels:
x-ms-publictraffictype: Email
x-ms-traffictypediagnostic: GVUPR01MB12677:EE_|AM7PPF9E4ED15B0:EE_
x-ms-office365-filtering-correlation-id: 67a2f9eb-7d4d-49ec-3590-08defe2cb8f9
x-microsoft-antispam:
BCL:0;ARA:14566002|25010399006|41001999006|24121999003|22091999003|4140399003|24021099003|37011999003|6092099016|31061999003|39105399006|2604032031799003|55001999006|16051099003|704163111799003|15080799012|15030799006|22121099003|19110799012|8060799015|8062599012|20055399003|56899033|3412199025|440099028|34005399003|102099032|260806224601699006|39145399003|41105399003|40105399003|2607281247196008|2406899039;
x-microsoft-antispam-message-info:
=?utf-8?B?WjNxckgvU3loU1Baa0VaWlRmV1BQYk1rMTQveHN2R1FycHNUN1NJd2xNbnVQ?=
=?utf-8?B?eCtsNitwam9FYXRYb293RlBXeEVTR1lQRHVENGhWN01TcDZNNmwzdC9veXpB?=
=?utf-8?B?SG9yRFczMGRFcHlJT24rbEVUNnE3dlFDRFkyb0xEU3lmQ3Y1ZG9wVTZoMDg4?=
=?utf-8?B?S1QyWWFMbGtkMzRjVWtLRkxYelg3WENNd2plNC9WWE43c010QXhvb2UvUXRj?=
=?utf-8?B?MDdudnBlSW1Mdm1FQ3d0c2dUeUsxSkJNQ0lWNjY4NDZITXhjcEtmblU4S2lR?=
=?utf-8?B?a3dzSWQwaW8wTHJkMWVEaU1wRFVNSEJYWDczWnd5V3Y1MEFXOFkwZlVxejBh?=
=?utf-8?B?cUN5dFVOZ05PSFNwV2V5N21MaFUxQUNlK3RGQWUzbzlqQkdlcjhuK1RIVnhP?=
=?utf-8?B?cm5TZ1hFTVBqaDlGNFJDbHA5SmwxN2tKNkZnbjFDcEFpcCtxQkwwMlloVkpD?=
=?utf-8?B?L3Bqbi83UTJ4UjVtR05IMnZ4ZXNzb2R2NldqSG1FbWY4UVZ5clhnbGQ0ODVK?=
=?utf-8?B?S3JvelhYb2lPVjA3eGR5M2RTTDBFLzE3d1VlVkxOMm1mUDJMYnFVTy9sUiti?=
=?utf-8?B?Uk5qdEx3ZzdMOVVtb08zZ3h4aXNwNWxiMWxCUVEybE1OOHp3NXloTVNkV2N4?=
=?utf-8?B?U1FpZXJmQ01vRTg2WVVFMm82Z1JwQzRWZjlVMVFzaTdRVk9lTE1sSjA1TERX?=
=?utf-8?B?SU1Qd20zNTdUQW5EblA1bklFaXZ2bUY1aHZKMlJyblBEcmJ4bm0yREJkWFM4?=
=?utf-8?B?LzB0OWx3dEZpaEs2Y0piWXpCbVRNUzUyemM4a1lWbjIrYzF3L0xWRnBJRVNK?=
=?utf-8?B?RjN6VzdKVkJiWThjckp6L2h6ZHNzeXNLRzJ0YXNGR3NsazZ1azBiTjMvMlZC?=
=?utf-8?B?Nk9wM0xqZXFIWXhQTVhNS0xlMlFIRFViSWdIbW8wRm5FeC9xS3Zma1c4TThO?=
=?utf-8?B?dDZCVFYzUjZxblhCeHJhUzIyQ1BkODhUaEQyTDYvWjg0NmZZVTlUNmFZRVBk?=
=?utf-8?B?bWdzSS9qeDZNMk11SnJpdkRuNkdwUXgwNFlaZFFxek04aklXV2VzYitodGsw?=
=?utf-8?B?UVExMjAxTVAvUzltM3Q1OXNGaDJKMkpadDArRTZvZ01TT3Y0aWRkRFZOaEdi?=
=?utf-8?B?R3lGcEdyQVBBWlB6bkdES3Z3dzVjbXhhRzJYOW8yUW9HY083ZlJoT1N0eEZi?=
=?utf-8?B?N2ZYSlc3TW1RWmlqdXBoam00OC9NekhzYnpyOTZXdnVyYmZJZS9nYjdiM2Vx?=
=?utf-8?B?SlA4akRnMDZ1RWcvRHptY1dKaTgzQS9DelJvOCtJRlpGb1BGc2t3VEdjWWs1?=
=?utf-8?B?WmNOSFljc2szRldXa0N6ZTRvWWROdGVjdi9PaFBFRjA0Tm1FOUZKMyt6K2tH?=
=?utf-8?B?cmQ5RGRJbTJtTTVuVzdWdGtRaTJubWVvNTJkZ2hEc3pIRUpDN0pteFlCOGlM?=
=?utf-8?B?ZHhJZmd0cWIraUhmdy9sMWtvaTR0SkZROXgrNDZMbXovWDFycXRGYld1VVIw?=
=?utf-8?B?UFNGUlllWGdPa3VrU1hEMFlNd1dNU2NCeW9LdkREU3c0UXBLQU91cklLYjlC?=
=?utf-8?B?dHFyNEZVOHBBMFdNTGlHNGIxVXBJYjkzWXVQUmU5Y0xTRGFUeGlSNE9HbDdz?=
=?utf-8?B?M1RjbFdwblYyMEd5ZmdISFJlTEVLVVZSWUN5MFpLMFR3SkJMNkRKYy9kb0RP?=
=?utf-8?B?MEdxL1A1SmlaWXh0Zi93MDdTSm5NZXo5clp6R2x6V3FWWFJlQklXbG9tT3Rx?=
=?utf-8?B?NDlrczZDdDhXcUROUXBiM3hETFI0cDlmd3NCbUU5VmR2NnBLYU9VOUNtK2ZX?=
=?utf-8?B?WkR3WXBEQUVSTXhkVzFpN1h5SjlKckxVY3J1dFI4bGRIRE53OEc1ekg0MW1V?=
=?utf-8?B?YTYzVmE0aFJENGdGbVpYQmk5TjIrVmZKeld3VG4vM3VVbzhzdWgwaUMwVmJX?=
=?utf-8?Q?ObkXphwIJJ8=3D?=
x-ms-exchange-antispam-messagedata-chunkcount: 1
x-ms-exchange-antispam-messagedata-0:
=?utf-8?B?dzVhNVdQRWhCSVk1a1JSQzlYYmRrL1VkMWhKclorZzdmRDZVcHBld3hrM3lw?=
=?utf-8?B?TGdja1RKaXJMTHlrUkNkWnlZZExUQmNNRnM3WUR1UGdwU1FSUjVCWG0xTjAz?=
=?utf-8?B?eGdjSmRheE12T3E3U2pzMmdSOEdENGVUYzBqcDBmanQvaGlsU3U5NzBzMnRN?=
=?utf-8?B?QWt1YW5ZR1NqS29YVGlTMmVBVjFzUE1mYlVyNVdUd3o2MmdIeWFDTXdONHp1?=
=?utf-8?B?aklnWUdaczdQN2NoWVdKZVhtL3lqN2tqV2JJSGo0WU51U0tkWFlISUhuaEht?=
=?utf-8?B?bmZZdHZuVW5TS0FDZmNmSElGMldSSUNieTZJQVEydmVmRG9Xd2xIcHlIWEV2?=
=?utf-8?B?NUVyblM0NFp2aTd6ZnVNOUN2R2ZSVk5sWVRLV1g4TUN4UXNoQjlrV1dpNFFO?=
=?utf-8?B?U0ZtSmJYU0NYbVVPT0NSMW1MUzNteWtiNzh0b1RuYzl1aXA1VFh4SlUwYVZ6?=
=?utf-8?B?b1BCZHdtNVBaWnh0RjREUnZqUWxiM2NNandpeEFZTTFnWU5xVVAwRUtZOEls?=
=?utf-8?B?Y0tXOGwrblNsSzJTcmlsa3M3SkdsU0FBOWE5bzY3MnVjdGpQdzI0cU8zRkI5?=
=?utf-8?B?RXZ1dEZQMjdFN0dpK2xqTFp5MFY2VDdlK2NtRXYvek5MZmlmK25sTVF4SXE5?=
=?utf-8?B?NVVSblhCUXlINjRoNE5RLysrcldhcjZpeEoxUjMzUS95Q3dyTXFTNTVZNith?=
=?utf-8?B?dFBxeXc0akY2YmluR0hMemkva2JsdHZSV1AwNG1NbjZzN1dMaTRpQjR6MW5h?=
=?utf-8?B?akxpQ2dIUURtRndtSWpMakhFSjkwKzZEYUdOSW94TzU3d29haUFkOFR2ZWRD?=
=?utf-8?B?TG5uUi9OTG1saHQzWXdPWmRtSTZkbEpJNy9MakZGV1ExU2laMjd4QmgweUpE?=
=?utf-8?B?cGtkZEVNRlpRekVCQUQxbGFHcWJGZ2hSZEhhTEkyeUhLMHNrVzNkdWNPb3R4?=
=?utf-8?B?b0ozYzIzZ1IrYWt6MVRVb1RFdjlWc01sSUhDQ0xiTUpsdHp4dlFiK1czUXRN?=
=?utf-8?B?YkprZUxlUDUzQU8wWGJrYnBiMjFoakZEU09pdCs2OGVsd0lUY2tQcnFwYkVD?=
=?utf-8?B?VExTcjc2SDdoQk1leXZ5d1VWenN6eFplazBYZm5na2lLeGZqV2s4dW1wQ3cz?=
=?utf-8?B?bW45N0pNbzFJV3VWRmxJeDhmbkIyT1Q1MktMZjNjYkFjK3ZzNXNmUklWbGxI?=
=?utf-8?B?RDFDc3YzSzVrT3pYR1NwZ2RhWGRUM0VHQUtVMkJjNnA5YUpYb1N6Ritnd2c5?=
=?utf-8?B?SlZ5aWRNeXR3cDdlY0lFWVBIQjhTRHVOcFVZODlwRXRobTEwQmwwZHcyZ0xi?=
=?utf-8?B?YkZWdGgyM2RaY3dGeXBuMlFqQ3ZKUG1peGp2MllnYllBc0E0Si9XUFVkRkZa?=
=?utf-8?B?Y21DV1B5cHM3UWdZU3k4Tms2RTJSQlhWdTBvTmxaVTgvV2lYRm1ycXd5ZDlz?=
=?utf-8?B?dXZqdFR2VUwwbzgrU2dPUkRON1dhRUQxMnFIVGtNUUVscStCbmduRVdRbC9K?=
=?utf-8?B?VTV4RDdPcDY0dE5zaG96OWk4SlY0UGdzV2ZCeVV1Q2ZWcjhYL294RTdvcGJw?=
=?utf-8?B?QXZOTjlWY0IzbFRKdjh0RGp6NzJxb0Q1dXN4SVhaenI4T3UvM2NBWEZxMFp0?=
=?utf-8?B?dU1OdTYzdmhLdEVFSmFnWTYvZG1FWGh2YU9NbGM5bjlPWEoxQ1o5dFp5TTYy?=
=?utf-8?B?Wk1xWitKR0orZ0ZYazlZVFBWSmV3eVBGTXEzSjNzN0c3V3EydEV1czNvWUdo?=
=?utf-8?B?QlY1WHVBd0RIYzdIdjNDaEtkMGxYZ09sNkp4dWY1TEJKUDVsekUxUFQ4dUV4?=
=?utf-8?B?RDUvOHh2WkFONllzV1NiNG5mODlDYnFmNFhsNG4zMmxUVUlZVEtuUE5TTEJh?=
=?utf-8?Q?0OgpWK1iOL3Gl?=
Content-Type: multipart/related;
boundary="_004_GVUPR01MB12677D01237D8DF4E8BB1D0FAB3A52GVUPR01MB12677eu_";
type="multipart/alternative"
MIME-Version: 1.0
X-OriginatorOrg: outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-AuthSource: GVUPR01MB12677.eurprd01.prod.exchangelabs.com
X-MS-Exchange-CrossTenant-RMS-PersistedConsumerOrg: 00000000-0000-0000-0000-000000000000
X-MS-Exchange-CrossTenant-Network-Message-Id: 67a2f9eb-7d4d-49ec-3590-08defe2cb8f9
X-MS-Exchange-CrossTenant-originalarrivaltime: 19 Aug 2026 20:01:56.8332
(UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: 84df9e7f-e9f6-40af-b435-aaaaaaaaaaaa
X-MS-Exchange-CrossTenant-rms-persistedconsumerorg: 00000000-0000-0000-0000-000000000000
X-MS-Exchange-Transport-CrossTenantHeadersStamped: AM7PPF9E4ED15B0
X-Spam_score: 5.3
X-Spam_score_int: 53
X-Spam_bar: +++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: Greetings! My name is Mohamed Mansour (CEO Mansour Group).
I'm reaching out about the potential of a mutually beneficial partnership
between us, and i need your kind response to discuss further. Kindly reach
out at your earliest convenience.
Content analysis details: (5.3 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org
[2603:10a6:150:333:0:0:0:18 listed in]
[will-spam-for-food.eu.org]
[2603:10a6:150:333:0:0:0:18 listed in]
[will-spam-for-food.eu.org]
[2603:10a6:150:333:0:0:0:18 listed in]
[will-spam-for-food.eu.org]
[2603:10a6:150:333:0:0:0:18 listed in]
[will-spam-for-food.eu.org]
[2603:10a6:150:333:0:0:0:18 listed in]
[will-spam-for-food.eu.org]
[2603:10a6:150:333:0:0:0:18 listed in]
[will-spam-for-food.eu.org]
[2603:10a6:150:333:0:0:0:18 listed in]
[will-spam-for-food.eu.org]
[2603:10a6:150:333:0:0:0:18 listed in]
[will-spam-for-food.eu.org]
[52.103.32.27 listed in will-spam-for-food.eu.org]
[52.103.32.27 listed in will-spam-for-food.eu.org]
[52.103.32.27 listed in will-spam-for-food.eu.org]
[52.103.32.27 listed in will-spam-for-food.eu.org]
[52.103.32.27 listed in will-spam-for-food.eu.org]
[52.103.32.27 listed in will-spam-for-food.eu.org]
[52.103.32.27 listed in will-spam-for-food.eu.org]
[52.103.32.27 listed in will-spam-for-food.eu.org]
1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org
[52.103.32.27 listed in dnsbl.ahbl.org]
[52.103.32.27 listed in dnsbl.ahbl.org]
[52.103.32.27 listed in dnsbl.ahbl.org]
[52.103.32.27 listed in dnsbl.ahbl.org]
[2603:10a6:150:333:0:0:0:18 listed in]
[dnsbl.ahbl.org]
[2603:10a6:150:333:0:0:0:18 listed in]
[dnsbl.ahbl.org]
[2603:10a6:150:333:0:0:0:18 listed in]
[dnsbl.ahbl.org]
[2603:10a6:150:333:0:0:0:18 listed in]
[dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org
[52.103.32.27 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org
[52.103.32.27 listed in dnsbl.ahbl.org]
1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org
[52.103.32.27 listed in dnsbl.ahbl.org]
0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org
[52.103.32.27 listed in dnsbl.ahbl.org]
-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no
trust
[52.103.32.27 listed in list.dnswl.org]
-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact
cert-sa@returnpath.net
[Excessive Number of Queries |
-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact
safe-sa@returnpath.net
[Excessive Number of Queries |
-0.0 SPF_HELO_PASS SPF: HELO matches SPF record
-0.0 SPF_PASS SPF: sender matches SPF record
1.2 MISSING_HEADERS Missing To: header
1.6 SUBJ_ALL_CAPS Subject is all capitals
-0.0 T_RP_MATCHES_RCVD Envelope sender domain matches handover relay
domain
0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider
[ceomansourgroup(at)outlook.com]
-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)
[52.103.32.27 listed in wl.mailspike.net]
1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,
https://senderscore.org/blacklistlookup/
[52.103.32.27 listed in bl.score.senderscore.com]
0.0 HTML_MESSAGE BODY: HTML included in message
0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge
0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid
1.4 MALFORMED_FREEMAIL Bad headers on message from free email service
Subject: {SPAM?} CEO MANSOUR GROUP
Greetings!
My name is Mohamed Mansour (CEO Mansour Group). I'm reaching out about the potential of a mutually beneficial partnership between us, and i need your kind response to discuss further.
Kindly reach out at your earliest convenience.
While i wait your kind response, please accept the assurances of our highest esteem.
Mohamed Mansour
Founder and Board Member
CEO Mansour Group
Address: No.17, Ummam Center Salah Eddeen Road, Malaz Riyadh, Kindgom of Saudi Arabia
Website: www.mansourgroup.com
The content of this email is confidential and intended for the recipient specified in message only. It is strictly forbidden to share any part of this message with any third party, without a written consent of the sender. If you received this message by mistake, please reply to this message and follow with its deletion, so that we can ensure such a mistake does not occur in the future.unsubscribe from email or ignore
Nigerian spam
Posted by Dave Yadallee on
X-Mozilla-Status: 0001
X-Mozilla-Status2: 00000000
Return-path:
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Wed, 19 Aug 2026 14:19:00 -0600
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.5 (FreeBSD))
(envelope-from)
id 1wwmkD-000000008ol-19Xy
for dave@doctor.nl2k.ab.ca;
Wed, 19 Aug 2026 14:18:41 -0600
Resent-From: The Doctor
Resent-Date: Wed, 19 Aug 2026 14:18:41 -0600
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from smtp152-cast-mx.amscloud.co.id ([103.234.208.152]:48924)
by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384
(Exim 4.99.5 (FreeBSD))
(envelope-from)
id 1wwl47-00000000Dvs-0xn6
for postmaster@nl2k.ab.ca;
Wed, 19 Aug 2026 12:31:21 -0600
Received: from localhost (localhost [127.0.0.1])
by mx0.amscloud.co.id (Postfix) with ESMTP id 9B06A81138
for; Thu, 20 Aug 2026 01:29:39 +0700 (WIB)
X-Virus-Scanned: amavis at mx0.amscloud.co.id
Received: from mx0.amscloud.co.id ([127.0.0.1])
by localhost (mx0.amscloud.co.id [127.0.0.1]) (amavis, port 10024) with ESMTP
id UiurVeLRSxkO for;
Thu, 20 Aug 2026 01:29:29 +0700 (WIB)
Received: from mail.trimitraswadaya.com (mail.trimitraswadaya.com [103.234.210.218])
(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)
key-exchange x25519 server-signature ECDSA (prime256v1) server-digest SHA256)
(No client certificate requested)
by mx0.amscloud.co.id (Postfix) with ESMTPS id 4A3A378A78
for; Thu, 20 Aug 2026 01:06:18 +0700 (WIB)
Received: from localhost (localhost [127.0.0.1])
by mail.trimitraswadaya.com (Postfix) with ESMTP id 8C6894B187C45
for; Thu, 20 Aug 2026 01:06:27 +0700 (WIB)
Received: from mail.trimitraswadaya.com ([127.0.0.1])
by localhost (mail.trimitraswadaya.com [127.0.0.1]) (amavisd-new, port 10032)
with ESMTP id HAzdT6IPyeF2 for;
Thu, 20 Aug 2026 01:06:27 +0700 (WIB)
Received: from localhost (localhost [127.0.0.1])
by mail.trimitraswadaya.com (Postfix) with ESMTP id A819845FDC9FE
for; Thu, 20 Aug 2026 01:03:00 +0700 (WIB)
DKIM-Filter: OpenDKIM Filter v2.10.3 mail.trimitraswadaya.com A819845FDC9FE
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=trimitraswadaya.com;
s=4434A248-C2D4-11EA-9DCA-C1A572C2DF1E; t=1787162580;
bh=rqsfSmDVd1jPiFCIzW7DqikTfxW0NOdXrEiIPS+QKts=;
h=From:To:MIME-Version:Date:Message-Id;
b=fmAfa8//qFclZGdjzWaCftCYnwLO364XmsDqcqmhbrLsbWl9MMh+peramq+68EKOh
wwANhmh3+p4Xx9xQNNXrQVShJv4N9mOq3cCCE4p4Dd8SK61ouxEgtr0nyzgSJA4s1g
Yf79qkO5bHHhphtUE5NHjkZLLvf1dH5uigXotVFtA90FuQhgtYw4r7F3R+zpOGEmci
uPmxB2WtwPbxM44D7RA/IMO5NxRTTDiXPglJcpsVzb+B9sTNsRLQdzKN3wPDCdxdoM
E5dy4kguRLLEZWR+iVpr3mxMn6GgX/BMDbUhpkVIeJ64A57V2xVLsfSi/QhPuY8o1v
TdBCOnYBqc4Og==
X-Virus-Scanned: amavisd-new at mail.trimitraswadaya.com
Received: from mail.trimitraswadaya.com ([127.0.0.1])
by localhost (mail.trimitraswadaya.com [127.0.0.1]) (amavisd-new, port 10026)
with ESMTP id 2xx97N5zCm0g for;
Thu, 20 Aug 2026 01:03:00 +0700 (WIB)
Received: from Dell (unknown [197.185.180.236])
by mail.trimitraswadaya.com (Postfix) with ESMTPSA id 84AE64B0299C3
for; Thu, 20 Aug 2026 01:00:20 +0700 (WIB)
From: "Mr. Alex Kortig"
Subject: HI: Is your email still active?
To:
Content-Type: multipart/alternative; boundary="fJrp111XHP8TVoTCbRXB9=_3RthZxt3B5w"
MIME-Version: 1.0
Reply-To:
Date: Wed, 19 Aug 2026 17:01:47 -0300
Message-Id: <20261908170146A1E8DD19D4-84E8D5D28E@trimitraswadaya.com>
X-Spam_score: 9.8
X-Spam_score_int: 98
X-Spam_bar: +++++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: My Name is Alex Kortig I am writing to discuss a confidential
and important matter concerning unclaimed inheritance funds that are reportedly
associated with your name. Kindly respond to my private email address at
Content analysis details: (9.8 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org
[197.185.180.236 listed in will-spam-for-food.eu.org]
[197.185.180.236 listed in will-spam-for-food.eu.org]
[197.185.180.236 listed in will-spam-for-food.eu.org]
[197.185.180.236 listed in will-spam-for-food.eu.org]
[197.185.180.236 listed in will-spam-for-food.eu.org]
[197.185.180.236 listed in will-spam-for-food.eu.org]
[197.185.180.236 listed in will-spam-for-food.eu.org]
[197.185.180.236 listed in will-spam-for-food.eu.org]
[103.234.210.218 listed in will-spam-for-food.eu.org]
[103.234.210.218 listed in will-spam-for-food.eu.org]
[103.234.210.218 listed in will-spam-for-food.eu.org]
[103.234.210.218 listed in will-spam-for-food.eu.org]
[103.234.210.218 listed in will-spam-for-food.eu.org]
[103.234.210.218 listed in will-spam-for-food.eu.org]
[103.234.210.218 listed in will-spam-for-food.eu.org]
[103.234.210.218 listed in will-spam-for-food.eu.org]
[103.234.208.152 listed in will-spam-for-food.eu.org]
[103.234.208.152 listed in will-spam-for-food.eu.org]
[103.234.208.152 listed in will-spam-for-food.eu.org]
[103.234.208.152 listed in will-spam-for-food.eu.org]
[103.234.208.152 listed in will-spam-for-food.eu.org]
[103.234.208.152 listed in will-spam-for-food.eu.org]
[103.234.208.152 listed in will-spam-for-food.eu.org]
[103.234.208.152 listed in will-spam-for-food.eu.org]
1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org
[103.234.208.152 listed in dnsbl.ahbl.org]
[103.234.208.152 listed in dnsbl.ahbl.org]
[103.234.208.152 listed in dnsbl.ahbl.org]
[103.234.208.152 listed in dnsbl.ahbl.org]
[103.234.210.218 listed in dnsbl.ahbl.org]
[103.234.210.218 listed in dnsbl.ahbl.org]
[103.234.210.218 listed in dnsbl.ahbl.org]
[103.234.210.218 listed in dnsbl.ahbl.org]
[197.185.180.236 listed in dnsbl.ahbl.org]
[197.185.180.236 listed in dnsbl.ahbl.org]
[197.185.180.236 listed in dnsbl.ahbl.org]
[197.185.180.236 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org
[103.234.208.152 listed in dnsbl.ahbl.org]
0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org
[103.234.208.152 listed in dnsbl.ahbl.org]
1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org
[103.234.208.152 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org
[103.234.208.152 listed in dnsbl.ahbl.org]
1.5 RCVD_IN_CBL RBL: Received via a relay in cbl.abuseat.org
[Listed by XBL, see]
1.5 RCVD_IN_SBL_XBL RBL: Received via a relay in Spamhaus SBL+XBL
[197.185.180.236 listed in sbl-xbl.spamhaus.org]
-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact
cert-sa@returnpath.net
[Excessive Number of Queries |]
-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact
safe-sa@returnpath.net
[Excessive Number of Queries |]
-0.0 SPF_PASS SPF: sender matches SPF record
0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in
headers
0.5 NO_RDNS Sending MTA has no reverse DNS (Postfix variant)
1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,
https://senderscore.org/blacklistlookup/
[103.234.208.152 listed in bl.score.senderscore.com]
0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in digit
[alexkortig648(at)gmail.com]
0.0 HTML_MESSAGE BODY: HTML included in message
0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge
0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid
0.0 NO_RDNS2 Sending MTA has no reverse DNS
2.5 FREEMAIL_FORGED_REPLYTO Freemail in Reply-To, but not From
0.0 HK_NAME_MR_MRS No description available.
2.0 MIXED_HREF_CASE Has href in mixed case
0.0 T_FILL_THIS_FORM_SHORT Fill in a short form with personal information
Subject: {SPAM?} HI: Is your email still active?
This is a multi-part message in MIME format
--fJrp111XHP8TVoTCbRXB9=_3RthZxt3B5w
Content-Type: text/plain; charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
My Name is Alex Kortig
I am writing to discuss a confidential and important matter concerning=
unclaimed inheritance funds that are reportedly associated with your =
name.
Kindly respond to my private email address at=20
alexkortig648@gmail.com mailto:alexkortig648@gmail.com
at your earliest convenience so that I may provide you with the releva=
nt details and discuss the matter further.
Thank you for your prompt attention, I look forward to hearing from yo=
u.
Yours Sincerly
Mr. Alex Kortig
--fJrp111XHP8TVoTCbRXB9=_3RthZxt3B5w
Content-Type: text/html; charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
8859-1">
le=3D1"> <=
title>HI: Is your email still active?
--fJrp111XHP8TVoTCbRXB9=_3RthZxt3B5w--
X-Mozilla-Status2: 00000000
Return-path:
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Wed, 19 Aug 2026 14:19:00 -0600
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.5 (FreeBSD))
(envelope-from
id 1wwmkD-000000008ol-19Xy
for dave@doctor.nl2k.ab.ca;
Wed, 19 Aug 2026 14:18:41 -0600
Resent-From: The Doctor
Resent-Date: Wed, 19 Aug 2026 14:18:41 -0600
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from smtp152-cast-mx.amscloud.co.id ([103.234.208.152]:48924)
by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384
(Exim 4.99.5 (FreeBSD))
(envelope-from
id 1wwl47-00000000Dvs-0xn6
for postmaster@nl2k.ab.ca;
Wed, 19 Aug 2026 12:31:21 -0600
Received: from localhost (localhost [127.0.0.1])
by mx0.amscloud.co.id (Postfix) with ESMTP id 9B06A81138
for
X-Virus-Scanned: amavis at mx0.amscloud.co.id
Received: from mx0.amscloud.co.id ([127.0.0.1])
by localhost (mx0.amscloud.co.id [127.0.0.1]) (amavis, port 10024) with ESMTP
id UiurVeLRSxkO for
Thu, 20 Aug 2026 01:29:29 +0700 (WIB)
Received: from mail.trimitraswadaya.com (mail.trimitraswadaya.com [103.234.210.218])
(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)
key-exchange x25519 server-signature ECDSA (prime256v1) server-digest SHA256)
(No client certificate requested)
by mx0.amscloud.co.id (Postfix) with ESMTPS id 4A3A378A78
for
Received: from localhost (localhost [127.0.0.1])
by mail.trimitraswadaya.com (Postfix) with ESMTP id 8C6894B187C45
for
Received: from mail.trimitraswadaya.com ([127.0.0.1])
by localhost (mail.trimitraswadaya.com [127.0.0.1]) (amavisd-new, port 10032)
with ESMTP id HAzdT6IPyeF2 for
Thu, 20 Aug 2026 01:06:27 +0700 (WIB)
Received: from localhost (localhost [127.0.0.1])
by mail.trimitraswadaya.com (Postfix) with ESMTP id A819845FDC9FE
for
DKIM-Filter: OpenDKIM Filter v2.10.3 mail.trimitraswadaya.com A819845FDC9FE
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=trimitraswadaya.com;
s=4434A248-C2D4-11EA-9DCA-C1A572C2DF1E; t=1787162580;
bh=rqsfSmDVd1jPiFCIzW7DqikTfxW0NOdXrEiIPS+QKts=;
h=From:To:MIME-Version:Date:Message-Id;
b=fmAfa8//qFclZGdjzWaCftCYnwLO364XmsDqcqmhbrLsbWl9MMh+peramq+68EKOh
wwANhmh3+p4Xx9xQNNXrQVShJv4N9mOq3cCCE4p4Dd8SK61ouxEgtr0nyzgSJA4s1g
Yf79qkO5bHHhphtUE5NHjkZLLvf1dH5uigXotVFtA90FuQhgtYw4r7F3R+zpOGEmci
uPmxB2WtwPbxM44D7RA/IMO5NxRTTDiXPglJcpsVzb+B9sTNsRLQdzKN3wPDCdxdoM
E5dy4kguRLLEZWR+iVpr3mxMn6GgX/BMDbUhpkVIeJ64A57V2xVLsfSi/QhPuY8o1v
TdBCOnYBqc4Og==
X-Virus-Scanned: amavisd-new at mail.trimitraswadaya.com
Received: from mail.trimitraswadaya.com ([127.0.0.1])
by localhost (mail.trimitraswadaya.com [127.0.0.1]) (amavisd-new, port 10026)
with ESMTP id 2xx97N5zCm0g for
Thu, 20 Aug 2026 01:03:00 +0700 (WIB)
Received: from Dell (unknown [197.185.180.236])
by mail.trimitraswadaya.com (Postfix) with ESMTPSA id 84AE64B0299C3
for
From: "Mr. Alex Kortig"
Subject: HI: Is your email still active?
To:
Content-Type: multipart/alternative; boundary="fJrp111XHP8TVoTCbRXB9=_3RthZxt3B5w"
MIME-Version: 1.0
Reply-To:
Date: Wed, 19 Aug 2026 17:01:47 -0300
Message-Id: <20261908170146A1E8DD19D4-84E8D5D28E@trimitraswadaya.com>
X-Spam_score: 9.8
X-Spam_score_int: 98
X-Spam_bar: +++++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: My Name is Alex Kortig I am writing to discuss a confidential
and important matter concerning unclaimed inheritance funds that are reportedly
associated with your name. Kindly respond to my private email address at
Content analysis details: (9.8 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org
[197.185.180.236 listed in will-spam-for-food.eu.org]
[197.185.180.236 listed in will-spam-for-food.eu.org]
[197.185.180.236 listed in will-spam-for-food.eu.org]
[197.185.180.236 listed in will-spam-for-food.eu.org]
[197.185.180.236 listed in will-spam-for-food.eu.org]
[197.185.180.236 listed in will-spam-for-food.eu.org]
[197.185.180.236 listed in will-spam-for-food.eu.org]
[197.185.180.236 listed in will-spam-for-food.eu.org]
[103.234.210.218 listed in will-spam-for-food.eu.org]
[103.234.210.218 listed in will-spam-for-food.eu.org]
[103.234.210.218 listed in will-spam-for-food.eu.org]
[103.234.210.218 listed in will-spam-for-food.eu.org]
[103.234.210.218 listed in will-spam-for-food.eu.org]
[103.234.210.218 listed in will-spam-for-food.eu.org]
[103.234.210.218 listed in will-spam-for-food.eu.org]
[103.234.210.218 listed in will-spam-for-food.eu.org]
[103.234.208.152 listed in will-spam-for-food.eu.org]
[103.234.208.152 listed in will-spam-for-food.eu.org]
[103.234.208.152 listed in will-spam-for-food.eu.org]
[103.234.208.152 listed in will-spam-for-food.eu.org]
[103.234.208.152 listed in will-spam-for-food.eu.org]
[103.234.208.152 listed in will-spam-for-food.eu.org]
[103.234.208.152 listed in will-spam-for-food.eu.org]
[103.234.208.152 listed in will-spam-for-food.eu.org]
1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org
[103.234.208.152 listed in dnsbl.ahbl.org]
[103.234.208.152 listed in dnsbl.ahbl.org]
[103.234.208.152 listed in dnsbl.ahbl.org]
[103.234.208.152 listed in dnsbl.ahbl.org]
[103.234.210.218 listed in dnsbl.ahbl.org]
[103.234.210.218 listed in dnsbl.ahbl.org]
[103.234.210.218 listed in dnsbl.ahbl.org]
[103.234.210.218 listed in dnsbl.ahbl.org]
[197.185.180.236 listed in dnsbl.ahbl.org]
[197.185.180.236 listed in dnsbl.ahbl.org]
[197.185.180.236 listed in dnsbl.ahbl.org]
[197.185.180.236 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org
[103.234.208.152 listed in dnsbl.ahbl.org]
0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org
[103.234.208.152 listed in dnsbl.ahbl.org]
1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org
[103.234.208.152 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org
[103.234.208.152 listed in dnsbl.ahbl.org]
1.5 RCVD_IN_CBL RBL: Received via a relay in cbl.abuseat.org
[Listed by XBL, see
1.5 RCVD_IN_SBL_XBL RBL: Received via a relay in Spamhaus SBL+XBL
[197.185.180.236 listed in sbl-xbl.spamhaus.org]
-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact
cert-sa@returnpath.net
[Excessive Number of Queries |
-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact
safe-sa@returnpath.net
[Excessive Number of Queries |
-0.0 SPF_PASS SPF: sender matches SPF record
0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in
headers
0.5 NO_RDNS Sending MTA has no reverse DNS (Postfix variant)
1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,
https://senderscore.org/blacklistlookup/
[103.234.208.152 listed in bl.score.senderscore.com]
0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in digit
[alexkortig648(at)gmail.com]
0.0 HTML_MESSAGE BODY: HTML included in message
0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge
0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid
0.0 NO_RDNS2 Sending MTA has no reverse DNS
2.5 FREEMAIL_FORGED_REPLYTO Freemail in Reply-To, but not From
0.0 HK_NAME_MR_MRS No description available.
2.0 MIXED_HREF_CASE Has href in mixed case
0.0 T_FILL_THIS_FORM_SHORT Fill in a short form with personal information
Subject: {SPAM?} HI: Is your email still active?
This is a multi-part message in MIME format
--fJrp111XHP8TVoTCbRXB9=_3RthZxt3B5w
Content-Type: text/plain; charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
My Name is Alex Kortig
I am writing to discuss a confidential and important matter concerning=
unclaimed inheritance funds that are reportedly associated with your =
name.
Kindly respond to my private email address at=20
alexkortig648@gmail.com mailto:alexkortig648@gmail.com
at your earliest convenience so that I may provide you with the releva=
nt details and discuss the matter further.
Thank you for your prompt attention, I look forward to hearing from yo=
u.
Yours Sincerly
Mr. Alex Kortig
--fJrp111XHP8TVoTCbRXB9=_3RthZxt3B5w
Content-Type: text/html; charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
8859-1">
le=3D1"> <=
title>HI: Is your email still active?
My Na=
me is Alex Kortig
I am writing to discuss a confidential and imp=
ortant matter concerning unclaimed inheritance funds that are reported=
ly associated with your name.
Kindly respond to my private email=
address at alexkortig648@g=
mail.com at your earliest convenience so that I may provide you wi=
th the relevant details and discuss the matter further.
Thank you f=
or your prompt attention, I look forward to hearing from you.
Yo=
urs Sincerly
Mr. Alex Kortig
--fJrp111XHP8TVoTCbRXB9=_3RthZxt3B5w--
Nk.CA Phishing from ionos/1and1
Posted by Dave Yadallee on
X-Mozilla-Status: 0001
X-Mozilla-Status2: 00000000
Return-path:
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Wed, 19 Aug 2026 14:19:00 -0600
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.5 (FreeBSD))
(envelope-from)
id 1wwmk3-000000008nR-3jPW
for dave@doctor.nl2k.ab.ca;
Wed, 19 Aug 2026 14:18:31 -0600
Resent-From: The Doctor
Resent-Date: Wed, 19 Aug 2026 14:18:31 -0600
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from mail-ed1-f103.google.com ([209.85.208.103]:44477)
by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256
(Exim 4.99.5 (FreeBSD))
(envelope-from)
id 1wwm28-000000001KO-0ZdR
for doctor@netknow.ca;
Wed, 19 Aug 2026 13:33:16 -0600
Received: by mail-ed1-f103.google.com with SMTP id 4fb4d7f45d1cf-6a374bea882so2597742a12.1
for; Wed, 19 Aug 2026 12:32:22 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=nyrentcars-com.20251104.gappssmtp.com; s=20251104; t=1787167935; x=1787772735; darn=netknow.ca;
h=content-type:mime-version:date:message-id:subject:to:from:from:to
:cc:subject:date:message-id:reply-to:content-type;
bh=sfjFyDEb6Hx3/IPlKcOCXiRaaRYJgIdlWbfeZU0J6c8=;
b=KsBECLRNf3WBrQcykwTHc6sC71o4r9M5Y7HqkVEFHlPRrwm2xpYr9zvbsHn2Tk/uTR
HPdo5QRadE047Ok1XmZ+qwIupbSpwar1lFISC8aMLk4UH9iyOfsM8Ra1W23C3D3/I5cC
JYxd8SF8l+LdE43X+e2TbzcsiC42chkQcP+4FGrncfItDioYcruMzy1RSZOg+YyyI2AE
jafgQF3XEnEh3brCrUiDGUYByxEBDSA698O1M9zoeeMzG2f2x6/Q6GJ+0GekPWxrQPQ5
t5xR3+/tYEx2ZL8McGCLtM7fUU9W37G/7VIMH3fLFMJP5LJLM6Wb1uBOQcKuwAO1T2Fd
qcoQ==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=1e100.net; s=20251104; t=1787167935; x=1787772735;
h=content-type:mime-version:date:message-id:subject:to:from:x-gm-gg
:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to
:content-type;
bh=sfjFyDEb6Hx3/IPlKcOCXiRaaRYJgIdlWbfeZU0J6c8=;
b=ZRR0CdjQJyrgQ/o0m0RCQnofdSFMl1NEjCYOHh5hPZQlpT7p/1a91jCpmBPjsJ65vA
YIsj0nL2Ub/ix8niFB00qXs+QsnN+EEQOnitT5CxWq6gR5EeiSGlvBcdsYRS6XKC9M02
HV+buVIvbkEg3+XVGAidTSg1/pONCJJShoulGWskqOzO2+122uQ24HWDRRLwDqIB1fBO
I7XHSclf1/2pEaHE9FRE6ARzIiOpK/9SgvmGMKOSXRul0sB3QO3YLZedcjbaU4IK5+pW
e3t4U1HQpGawvQ0IoKi0lO7/fOC+bzzIPa0yPrT6z86DzA9PMivceLKmNXuvhncxuoOu
08fA==
X-Gm-Message-State: AFuF++nDyGymFblKDoObvG/riG0x7wuLpsFqGLUOvZzaQIYAX1gGAE0i
0W8xNr5WyCHNXb3X+avbKaIToYyrnB9k+NVvJl6yGQNwCpc+qNjQKajiKujZbg+3TMhm9ln7V5f
Uqv+C69HQ3TcnACSVBfQ5zt84pwwyKzR3LOD9VCPU/JG1flk=
X-Gm-Gg: AR+sD13Xp6Vq0KHhkuCFKS46EEQywTuDlmJ2Ews7ctg4YnMGQLTzNN3Ku7L5DqfXeYq
PkCTLRqcBm14xAVdrjgleSAaN1YPjtXmFK5JbbZHSWOeRsmn2HoMJA0HufxtNK5XLgw/6NioIcq
mUdQIXRbHp/BQ+QgyyQv9vcwYw1vS+z3CpUktGsyBx0QzX589N45WGKESRr4QFV88zB6q4KfbOj
hV22yip80y2AoN2gh7WYKdKfjSTX6XI4GF2BncKvJmrMsZLOWeG0XezOWHG2ys44fxP58K+ZJk7
PCrtO9YZePAdj7QVBsR4TSz6SmdRjdf2lhIh0bOY0fGJmseIpIiVT88RETLYGxEVHTKsaWZg2qy
Fw1jcHILFJntQmBzXLYda+1kcRk/b6TsiTz4=
X-Received: by 2002:a05:6402:5192:b0:6a1:b0b:ba6 with SMTP id 4fb4d7f45d1cf-6a40335d357mr3582897a12.15.1787167935118;
Wed, 19 Aug 2026 12:32:15 -0700 (PDT)
Received: from nyrentcars.com (ip31-70-65-27.pbiaas.com. [31.70.65.27])
by smtp-relay.gmail.com with ESMTPS id 4fb4d7f45d1cf-6a3fed56270sm1096410a12.15.2026.08.19.12.32.15
for
(version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256);
Wed, 19 Aug 2026 12:32:15 -0700 (PDT)
X-Relaying-Domain: nyrentcars.com
From: fax@nyrentcars.com
To: doctor@netknow.ca
Subject: Notification
Message-ID:
Date: Wed, 19 Aug 2026 19:32:14 +0000
MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="--_NmP-8ab0fdcd4d773289-Part_1"
X-Spam_score: 6.7
X-Spam_score_int: 67
X-Spam_bar: ++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: Account Deactivation Service Notice We are deactivating all
inactive accounts
Content analysis details: (6.7 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org
[31.70.65.27 listed in will-spam-for-food.eu.org]
[31.70.65.27 listed in will-spam-for-food.eu.org]
[31.70.65.27 listed in will-spam-for-food.eu.org]
[31.70.65.27 listed in will-spam-for-food.eu.org]
[31.70.65.27 listed in will-spam-for-food.eu.org]
[31.70.65.27 listed in will-spam-for-food.eu.org]
[31.70.65.27 listed in will-spam-for-food.eu.org]
[31.70.65.27 listed in will-spam-for-food.eu.org]
[209.85.208.103 listed in will-spam-for-food.eu.org]
[209.85.208.103 listed in will-spam-for-food.eu.org]
[209.85.208.103 listed in will-spam-for-food.eu.org]
[209.85.208.103 listed in will-spam-for-food.eu.org]
[209.85.208.103 listed in will-spam-for-food.eu.org]
[209.85.208.103 listed in will-spam-for-food.eu.org]
[209.85.208.103 listed in will-spam-for-food.eu.org]
[209.85.208.103 listed in will-spam-for-food.eu.org]
1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org
[209.85.208.103 listed in dnsbl.ahbl.org]
[209.85.208.103 listed in dnsbl.ahbl.org]
[209.85.208.103 listed in dnsbl.ahbl.org]
[209.85.208.103 listed in dnsbl.ahbl.org]
[31.70.65.27 listed in dnsbl.ahbl.org]
[31.70.65.27 listed in dnsbl.ahbl.org]
[31.70.65.27 listed in dnsbl.ahbl.org]
[31.70.65.27 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org
[209.85.208.103 listed in dnsbl.ahbl.org]
1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org
[209.85.208.103 listed in dnsbl.ahbl.org]
0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org
[209.85.208.103 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org
[209.85.208.103 listed in dnsbl.ahbl.org]
2.5 URIBL_DBL_SPAM Contains a spam URL listed in the DBL blocklist
[URI: ai-matogen.biz]
-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no
trust
[209.85.208.103 listed in list.dnswl.org]
-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact
safe-sa@returnpath.net
[Excessive Number of Queries |]
-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact
cert-sa@returnpath.net
[Excessive Number of Queries |]
-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)
[209.85.208.103 listed in wl.mailspike.net]
1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,
https://senderscore.org/blacklistlookup/
[209.85.208.103 listed in bl.score.senderscore.com]
0.0 HTML_MESSAGE BODY: HTML included in message
1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts
0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge
0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid
2.0 RATWR8_MESSID Message-ID with excessive dashes and dollars
Subject: {SPAM?} Notification
----_NmP-8ab0fdcd4d773289-Part_1
Content-Type: text/html; charset=utf-8
Content-Transfer-Encoding: quoted-printable
class=3D"message-htmlpart" id=3D"message-htmlpart1">
class=3D"rcmBody">
, 33, 33); text-transform: none; letter-spacing: normal; font-family: =
wf_segoe-ui_normal, "Segoe UI", "Segoe WP", Tahoma, Arial, sans-serif, =
serif, EmojiFont; font-size: 15px; font-style: normal; font-weight: 400; =
word-spacing: 0px; white-space: normal; border-collapse: collapse; orphans:=
2; widows: 2; box-shadow: none !important; text-shadow: none !important; =
background-color: rgb(255, 255, 255); font-variant-ligatures:=20
normal; font-variant-caps: normal; -webkit-text-stroke-width: 0px; =
text-decoration-thickness: initial; text-decoration-style: initial; =
text-decoration-color: initial;' border=3D"0" cellspacing=3D"0" =
cellpadding=3D"0">
box-shadow: none !important; text-shadow: none !important;">
style=3D"border-radius: 0px !important; box-shadow: none !important; =
text-shadow: none !important;">
box-shadow: none !important; text-shadow: none !important;">
style=3D"margin: 0px 0px 25px; border-radius: 0px !important; color: rgb(43=
, 43, 43); font-size: 28px; font-weight: 600; box-shadow: none !important; =
text-shadow: none !important;">Account Deactivation Service Notice
rgb(43, 43, 43); font-size: 15px; box-shadow: none !important; text-shadow:=
none !important;">We are deactivating all inactive accounts
rgb(43, 43, 43); line-height: 22px; font-size: 15px; box-shadow: none !=
important; text-shadow: none !important;">Please confirm if =
your doctor@netknow.ca is still active by =
verifying now.
rgb(43, 43, 43); font-size: 15px; box-shadow: none !important; text-shadow:=
none !important;">In 48 hours, all Inactive accounts will be deactivated..=
.
40px; border-collapse: collapse; box-shadow: none !important; text-shadow:=
none !important;" border=3D"0" cellspacing=3D"0" cellpadding=3D"0">
text-shadow: none !important;">
text-shadow: none !important;">
text-shadow: none !important;">
color: rgb(255, 255, 255) !important; font-size: 14px; font-weight: 500; =
text-decoration: underline; display: inline-block; box-shadow: none !=
important; text-shadow: none !important; background-color: rgb(0, 120, =
212);"=20
href=3D"https://adclick.g.doubleclick.net/pcs/click?=
sf_rand_string_mixed(3)=3DAKAOjstFA55hCSrFSTBDNko3225YAz6GkouTQlHjExWXRbT5O=
PMnSlE8Wh4LAVp-D7jWRr-LcKW0w-HH1g8lCVAK_eU-5azfUXfjqfTiHFOFWV9I8m2ZaGczGlov=
1iY8kMSnelCX-AHG6VYBmpcZJapT1XbdlOM3B9u9whYqpkxEpFLbkzwDao00-DL8JyS7UIxIApb=
_JHANRmtKLSuRcM8IWqFaP0cOc8n8jTedmwHc8oAw2MV2tRUaAnN3eaxaESpc8fovDeWslJ0A3d=
uo5g46YzCYxQ8A56RI5MGcQw4TZj6TeWuj6jRjAe7g0X18--IBmztC1sUi6XuHkB1Ew-z_h9bv1=
XK-s_9L6zeDfQPtMsI3hOqp8T8545VdgCoElxs&sig=3DCg0ArKJSzEpZ_YMvCKWCEAE&am=
p;ur
lfix=3D1&adurl=3Dhttp%3A%2F%2Fai-matogen.biz%2Foauth%2F#doctor@netknow.=
ca&target=3D_blank" target=3D"_blank" rel=3D"noreferrer">Verify =
account
center; color: rgb(33, 33, 33); text-transform: none; letter-spacing: =
normal; font-family: wf_segoe-ui_normal, "Segoe UI", "Segoe WP", Tahoma, =
Arial, sans-serif, serif, EmojiFont; font-size: 15px; font-style: normal; =
font-weight: 400; word-spacing: 0px; white-space: normal; border-collapse: =
collapse; orphans: 2; widows: 2; box-shadow: none !important; text-shadow: =
none !important; background-color: rgb(243, 242, 241);=20
font-variant-ligatures: normal; font-variant-caps: normal; =
-webkit-text-stroke-width: 0px; text-decoration-thickness: initial; =
text-decoration-style: initial; text-decoration-color: initial;' =
bgcolor=3D"#f3f2f1" border=3D"0" cellspacing=3D"0" cellpadding=3D"0">
text-shadow: none !important;">
text-shadow: none !important;">
94, 92); line-height: 18px; font-size: 12px; box-shadow: none !important; =
text-shadow: none !important;">
color: rgb(96, 94, 92); text-decoration: underline; box-shadow: none !=
important; text-shadow: none !important;" href=3D"http://webmail.=
streamlineapparel.in/#NOP" target=3D"_blank" rel=3D"noreferrer">Privacy =
Statement
text-shadow: none !important;">
color: rgb(0, 102, 204); font-size: 13px; box-shadow: none !important; =
text-shadow: none !important;" href=3D"http://webmail.streamlineapparel.=
in/#NOP" target=3D"_blank" rel=3D"noreferrer">netknow =
PORTAL
X-Mozilla-Status2: 00000000
Return-path:
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Wed, 19 Aug 2026 14:19:00 -0600
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.5 (FreeBSD))
(envelope-from
id 1wwmk3-000000008nR-3jPW
for dave@doctor.nl2k.ab.ca;
Wed, 19 Aug 2026 14:18:31 -0600
Resent-From: The Doctor
Resent-Date: Wed, 19 Aug 2026 14:18:31 -0600
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from mail-ed1-f103.google.com ([209.85.208.103]:44477)
by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256
(Exim 4.99.5 (FreeBSD))
(envelope-from
id 1wwm28-000000001KO-0ZdR
for doctor@netknow.ca;
Wed, 19 Aug 2026 13:33:16 -0600
Received: by mail-ed1-f103.google.com with SMTP id 4fb4d7f45d1cf-6a374bea882so2597742a12.1
for
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=nyrentcars-com.20251104.gappssmtp.com; s=20251104; t=1787167935; x=1787772735; darn=netknow.ca;
h=content-type:mime-version:date:message-id:subject:to:from:from:to
:cc:subject:date:message-id:reply-to:content-type;
bh=sfjFyDEb6Hx3/IPlKcOCXiRaaRYJgIdlWbfeZU0J6c8=;
b=KsBECLRNf3WBrQcykwTHc6sC71o4r9M5Y7HqkVEFHlPRrwm2xpYr9zvbsHn2Tk/uTR
HPdo5QRadE047Ok1XmZ+qwIupbSpwar1lFISC8aMLk4UH9iyOfsM8Ra1W23C3D3/I5cC
JYxd8SF8l+LdE43X+e2TbzcsiC42chkQcP+4FGrncfItDioYcruMzy1RSZOg+YyyI2AE
jafgQF3XEnEh3brCrUiDGUYByxEBDSA698O1M9zoeeMzG2f2x6/Q6GJ+0GekPWxrQPQ5
t5xR3+/tYEx2ZL8McGCLtM7fUU9W37G/7VIMH3fLFMJP5LJLM6Wb1uBOQcKuwAO1T2Fd
qcoQ==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=1e100.net; s=20251104; t=1787167935; x=1787772735;
h=content-type:mime-version:date:message-id:subject:to:from:x-gm-gg
:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to
:content-type;
bh=sfjFyDEb6Hx3/IPlKcOCXiRaaRYJgIdlWbfeZU0J6c8=;
b=ZRR0CdjQJyrgQ/o0m0RCQnofdSFMl1NEjCYOHh5hPZQlpT7p/1a91jCpmBPjsJ65vA
YIsj0nL2Ub/ix8niFB00qXs+QsnN+EEQOnitT5CxWq6gR5EeiSGlvBcdsYRS6XKC9M02
HV+buVIvbkEg3+XVGAidTSg1/pONCJJShoulGWskqOzO2+122uQ24HWDRRLwDqIB1fBO
I7XHSclf1/2pEaHE9FRE6ARzIiOpK/9SgvmGMKOSXRul0sB3QO3YLZedcjbaU4IK5+pW
e3t4U1HQpGawvQ0IoKi0lO7/fOC+bzzIPa0yPrT6z86DzA9PMivceLKmNXuvhncxuoOu
08fA==
X-Gm-Message-State: AFuF++nDyGymFblKDoObvG/riG0x7wuLpsFqGLUOvZzaQIYAX1gGAE0i
0W8xNr5WyCHNXb3X+avbKaIToYyrnB9k+NVvJl6yGQNwCpc+qNjQKajiKujZbg+3TMhm9ln7V5f
Uqv+C69HQ3TcnACSVBfQ5zt84pwwyKzR3LOD9VCPU/JG1flk=
X-Gm-Gg: AR+sD13Xp6Vq0KHhkuCFKS46EEQywTuDlmJ2Ews7ctg4YnMGQLTzNN3Ku7L5DqfXeYq
PkCTLRqcBm14xAVdrjgleSAaN1YPjtXmFK5JbbZHSWOeRsmn2HoMJA0HufxtNK5XLgw/6NioIcq
mUdQIXRbHp/BQ+QgyyQv9vcwYw1vS+z3CpUktGsyBx0QzX589N45WGKESRr4QFV88zB6q4KfbOj
hV22yip80y2AoN2gh7WYKdKfjSTX6XI4GF2BncKvJmrMsZLOWeG0XezOWHG2ys44fxP58K+ZJk7
PCrtO9YZePAdj7QVBsR4TSz6SmdRjdf2lhIh0bOY0fGJmseIpIiVT88RETLYGxEVHTKsaWZg2qy
Fw1jcHILFJntQmBzXLYda+1kcRk/b6TsiTz4=
X-Received: by 2002:a05:6402:5192:b0:6a1:b0b:ba6 with SMTP id 4fb4d7f45d1cf-6a40335d357mr3582897a12.15.1787167935118;
Wed, 19 Aug 2026 12:32:15 -0700 (PDT)
Received: from nyrentcars.com (ip31-70-65-27.pbiaas.com. [31.70.65.27])
by smtp-relay.gmail.com with ESMTPS id 4fb4d7f45d1cf-6a3fed56270sm1096410a12.15.2026.08.19.12.32.15
for
(version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256);
Wed, 19 Aug 2026 12:32:15 -0700 (PDT)
X-Relaying-Domain: nyrentcars.com
From: fax@nyrentcars.com
To: doctor@netknow.ca
Subject: Notification
Message-ID:
Date: Wed, 19 Aug 2026 19:32:14 +0000
MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="--_NmP-8ab0fdcd4d773289-Part_1"
X-Spam_score: 6.7
X-Spam_score_int: 67
X-Spam_bar: ++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: Account Deactivation Service Notice We are deactivating all
inactive accounts
Content analysis details: (6.7 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org
[31.70.65.27 listed in will-spam-for-food.eu.org]
[31.70.65.27 listed in will-spam-for-food.eu.org]
[31.70.65.27 listed in will-spam-for-food.eu.org]
[31.70.65.27 listed in will-spam-for-food.eu.org]
[31.70.65.27 listed in will-spam-for-food.eu.org]
[31.70.65.27 listed in will-spam-for-food.eu.org]
[31.70.65.27 listed in will-spam-for-food.eu.org]
[31.70.65.27 listed in will-spam-for-food.eu.org]
[209.85.208.103 listed in will-spam-for-food.eu.org]
[209.85.208.103 listed in will-spam-for-food.eu.org]
[209.85.208.103 listed in will-spam-for-food.eu.org]
[209.85.208.103 listed in will-spam-for-food.eu.org]
[209.85.208.103 listed in will-spam-for-food.eu.org]
[209.85.208.103 listed in will-spam-for-food.eu.org]
[209.85.208.103 listed in will-spam-for-food.eu.org]
[209.85.208.103 listed in will-spam-for-food.eu.org]
1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org
[209.85.208.103 listed in dnsbl.ahbl.org]
[209.85.208.103 listed in dnsbl.ahbl.org]
[209.85.208.103 listed in dnsbl.ahbl.org]
[209.85.208.103 listed in dnsbl.ahbl.org]
[31.70.65.27 listed in dnsbl.ahbl.org]
[31.70.65.27 listed in dnsbl.ahbl.org]
[31.70.65.27 listed in dnsbl.ahbl.org]
[31.70.65.27 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org
[209.85.208.103 listed in dnsbl.ahbl.org]
1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org
[209.85.208.103 listed in dnsbl.ahbl.org]
0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org
[209.85.208.103 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org
[209.85.208.103 listed in dnsbl.ahbl.org]
2.5 URIBL_DBL_SPAM Contains a spam URL listed in the DBL blocklist
[URI: ai-matogen.biz]
-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no
trust
[209.85.208.103 listed in list.dnswl.org]
-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact
safe-sa@returnpath.net
[Excessive Number of Queries |
-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact
cert-sa@returnpath.net
[Excessive Number of Queries |
-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)
[209.85.208.103 listed in wl.mailspike.net]
1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,
https://senderscore.org/blacklistlookup/
[209.85.208.103 listed in bl.score.senderscore.com]
0.0 HTML_MESSAGE BODY: HTML included in message
1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts
0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge
0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid
2.0 RATWR8_MESSID Message-ID with excessive dashes and dollars
Subject: {SPAM?} Notification
----_NmP-8ab0fdcd4d773289-Part_1
Content-Type: text/html; charset=utf-8
Content-Transfer-Encoding: quoted-printable
class=3D"message-htmlpart" id=3D"message-htmlpart1">
class=3D"rcmBody">
, 33, 33); text-transform: none; letter-spacing: normal; font-family: =
wf_segoe-ui_normal, "Segoe UI", "Segoe WP", Tahoma, Arial, sans-serif, =
serif, EmojiFont; font-size: 15px; font-style: normal; font-weight: 400; =
word-spacing: 0px; white-space: normal; border-collapse: collapse; orphans:=
2; widows: 2; box-shadow: none !important; text-shadow: none !important; =
background-color: rgb(255, 255, 255); font-variant-ligatures:=20
normal; font-variant-caps: normal; -webkit-text-stroke-width: 0px; =
text-decoration-thickness: initial; text-decoration-style: initial; =
text-decoration-color: initial;' border=3D"0" cellspacing=3D"0" =
cellpadding=3D"0">
box-shadow: none !important; text-shadow: none !important;">
style=3D"border-radius: 0px !important; box-shadow: none !important; =
text-shadow: none !important;">
box-shadow: none !important; text-shadow: none !important;">
style=3D"margin: 0px 0px 25px; border-radius: 0px !important; color: rgb(43=
, 43, 43); font-size: 28px; font-weight: 600; box-shadow: none !important; =
text-shadow: none !important;">Account Deactivation Service Notice
rgb(43, 43, 43); font-size: 15px; box-shadow: none !important; text-shadow:=
none !important;">We are deactivating all inactive accounts
rgb(43, 43, 43); line-height: 22px; font-size: 15px; box-shadow: none !=
important; text-shadow: none !important;">Please confirm if =
your doctor@netknow.ca is still active by =
verifying now.
rgb(43, 43, 43); font-size: 15px; box-shadow: none !important; text-shadow:=
none !important;">In 48 hours, all Inactive accounts will be deactivated..=
.
40px; border-collapse: collapse; box-shadow: none !important; text-shadow:=
none !important;" border=3D"0" cellspacing=3D"0" cellpadding=3D"0">
text-shadow: none !important;">
text-shadow: none !important;">
text-shadow: none !important;">
color: rgb(255, 255, 255) !important; font-size: 14px; font-weight: 500; =
text-decoration: underline; display: inline-block; box-shadow: none !=
important; text-shadow: none !important; background-color: rgb(0, 120, =
212);"=20
href=3D"https://adclick.g.doubleclick.net/pcs/click?=
sf_rand_string_mixed(3)=3DAKAOjstFA55hCSrFSTBDNko3225YAz6GkouTQlHjExWXRbT5O=
PMnSlE8Wh4LAVp-D7jWRr-LcKW0w-HH1g8lCVAK_eU-5azfUXfjqfTiHFOFWV9I8m2ZaGczGlov=
1iY8kMSnelCX-AHG6VYBmpcZJapT1XbdlOM3B9u9whYqpkxEpFLbkzwDao00-DL8JyS7UIxIApb=
_JHANRmtKLSuRcM8IWqFaP0cOc8n8jTedmwHc8oAw2MV2tRUaAnN3eaxaESpc8fovDeWslJ0A3d=
uo5g46YzCYxQ8A56RI5MGcQw4TZj6TeWuj6jRjAe7g0X18--IBmztC1sUi6XuHkB1Ew-z_h9bv1=
XK-s_9L6zeDfQPtMsI3hOqp8T8545VdgCoElxs&sig=3DCg0ArKJSzEpZ_YMvCKWCEAE&am=
p;ur
lfix=3D1&adurl=3Dhttp%3A%2F%2Fai-matogen.biz%2Foauth%2F#doctor@netknow.=
ca&target=3D_blank" target=3D"_blank" rel=3D"noreferrer">Verify =
account
center; color: rgb(33, 33, 33); text-transform: none; letter-spacing: =
normal; font-family: wf_segoe-ui_normal, "Segoe UI", "Segoe WP", Tahoma, =
Arial, sans-serif, serif, EmojiFont; font-size: 15px; font-style: normal; =
font-weight: 400; word-spacing: 0px; white-space: normal; border-collapse: =
collapse; orphans: 2; widows: 2; box-shadow: none !important; text-shadow: =
none !important; background-color: rgb(243, 242, 241);=20
font-variant-ligatures: normal; font-variant-caps: normal; =
-webkit-text-stroke-width: 0px; text-decoration-thickness: initial; =
text-decoration-style: initial; text-decoration-color: initial;' =
bgcolor=3D"#f3f2f1" border=3D"0" cellspacing=3D"0" cellpadding=3D"0">
text-shadow: none !important;">
text-shadow: none !important;">
94, 92); line-height: 18px; font-size: 12px; box-shadow: none !important; =
text-shadow: none !important;">
color: rgb(96, 94, 92); text-decoration: underline; box-shadow: none !=
important; text-shadow: none !important;" href=3D"http://webmail.=
streamlineapparel.in/#NOP" target=3D"_blank" rel=3D"noreferrer">Privacy =
Statement
text-shadow: none !important;">
color: rgb(0, 102, 204); font-size: 13px; box-shadow: none !important; =
text-shadow: none !important;" href=3D"http://webmail.streamlineapparel.=
in/#NOP" target=3D"_blank" rel=3D"noreferrer">netknow =
PORTAL