IPTV Phish from Google Users

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 01 Oct 2026 23:07:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.100.1 (FreeBSD))

(envelope-from )

id 1xCVTO-00000000Jrq-2lPB

for dave@doctor.nl2k.ab.ca;

Thu, 01 Oct 2026 23:06:18 -0600

Resent-From: The Doctor

Resent-Date: Thu, 1 Oct 2026 23:06:18 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from 153.48.155.104.bc.googleusercontent.com ([104.155.48.153]:39202 helo=googleusercontent.com)

by doctor.nl2k.ab.ca with esmtp (Exim 4.100.1 (FreeBSD))

(envelope-from )

id 1xCU43-00000000Kv5-085T

for doctor@nk.ca;

Thu, 01 Oct 2026 21:35:40 -0600

Received: by googleusercontent.com (Postfix, from userid 1000)

id A72F55F67; Fri, 2 Oct 2026 03:33:04 +0000 (UTC)

To: doctor@nk.ca

From:=?UTF-8?B?QWx0dXNUViA0SyBTdHJlYW1z?=

Subject:=?UTF-8?B?RGl0Y2ggY2FibGU6IFN0cmVhbSAzMiwwMDArIGNoYW5uZWxzICYgbW92aWVzIGluIHN0dW5uaW5nIDRL?=

MIME-Version: 1.0

Reply-To: =?UTF-8?B?cmVwbHk=?=

Content-Transfer-Encoding: base64

Content-Type: text/html; charset=utf-8

Message-Id: <20261002033409.A72F55F67@googleusercontent.com>

Date: Fri, 2 Oct 2026 03:33:03 +0000 (UTC)

X-Spam_score: 8.1

X-Spam_score_int: 81

X-Spam_bar: ++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview:  AltusTV - Premium IPTV AltusTV



Content analysis details: (8.1 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[104.155.48.153 listed in will-spam-for-food.eu.org]

[104.155.48.153 listed in will-spam-for-food.eu.org]

[104.155.48.153 listed in will-spam-for-food.eu.org]

[104.155.48.153 listed in will-spam-for-food.eu.org]

[104.155.48.153 listed in will-spam-for-food.eu.org]

[104.155.48.153 listed in will-spam-for-food.eu.org]

[104.155.48.153 listed in will-spam-for-food.eu.org]

[104.155.48.153 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[104.155.48.153 listed in dnsbl.ahbl.org]

[104.155.48.153 listed in dnsbl.ahbl.org]

[104.155.48.153 listed in dnsbl.ahbl.org]

[104.155.48.153 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[104.155.48.153 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[104.155.48.153 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[104.155.48.153 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[104.155.48.153 listed in dnsbl.ahbl.org]

0.0 SPF_HELO_NEUTRAL SPF: HELO does not match SPF record (neutral)

0.7 SPF_NEUTRAL SPF: sender does not match SPF record (neutral)

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

0.0 TVD_RCVD_IP Message was received from an IP address

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-0.0 T_RP_MATCHES_RCVD Envelope sender domain matches handover relay

domain

0.0 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level mail

domains are different

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[104.155.48.153 listed in bl.score.senderscore.com]

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 HTML_FONT_LOW_CONTRAST BODY: HTML font color similar or identical to

background

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 HTML_MESSAGE BODY: HTML included in message

0.4 RDNS_DYNAMIC Delivered to internal network by host with

dynamic-looking rDNS

0.1 FROM_EXCESS_BASE64 From: base64 encoded unnecessarily

3.0 URI_FIREBASEAPP Link to hosted firebase web application, possible

phishing

0.4 KHOP_HELO_FCRDNS Relay HELO differs from its IP's reverse DNS

0.0 PDS_RDNS_DYNAMIC_FP RDNS_DYNAMIC with FP steps

1.0 HDRS_MISSP Misspaced headers

Subject: {SPAM?} =?UTF-8?B?RGl0Y2ggY2FibGU6IFN0cmVhbSAzMiwwMDArIGNoYW5uZWxzICYgbW92aWVzIGluIHN0dW5uaW5nIDRL?=





AltusTV

AltusTV Premium Streaming 4K ⚡ Instant Activation

Stream 32,000+ Channels in 4K Quality



Ditch expensive cable bills and unlock ultimate entertainment. Access live sports, global news, and over 80,000 movies and series instantly on all your devices. Click here to view our latest plans & pricing!

32,000+

Live Channels

4K / FHD

Ultra HD Quality

Get Started Now

💬 Choose Your Plan

✓

99.9% Uptime: Stable, buffer-free streaming servers.

✓

All Devices Supported: Smart TV, Fire Stick, Android, iOS & PC.

✓

24/7 Support: Round-the-clock assistance via WhatsApp & Email.



© 2026 AltusTV. All rights reserved.

Need help? Contact our support team via website at altustv or WhatsApp.

Unsubscribe



Web/SEO/App spam from Google Gm

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 01 Oct 2026 23:06:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.100.1 (FreeBSD))

(envelope-from )

id 1xCVSz-00000000JOG-2ZAA

for dave@doctor.nl2k.ab.ca;

Thu, 01 Oct 2026 23:05:53 -0600

Resent-From: The Doctor

Resent-Date: Thu, 1 Oct 2026 23:05:53 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-dy2-f12.google.com ([74.125.229.12]:63762)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.100.1 (FreeBSD))

(envelope-from )

id 1xCT34-00000000DfU-0MJK

for sales@nk.ca;

Thu, 01 Oct 2026 20:30:36 -0600

Received: by mail-dy2-f12.google.com with SMTP id 5a478bee46e88-33be7dfcfc1so9098066eec.1

for ; Thu, 01 Oct 2026 19:29:30 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=gmail.com; s=20251104; t=1790908164; x=1791512964; darn=nk.ca;

h=content-type:mime-version:date:message-id:subject:to:from:from:to

:cc:subject:date:message-id:reply-to:content-type;

bh=0QqZ66hf7T+zf9Seok2ttHvk08cxyZsdkZ8xfGVvJRM=;

b=ZYBwxmPJa50FYN68rLUJX09Oxy1QNH72HhJNoH7WGaUxet6TLaGFrWjsTrY/KYlWzx

UOaoIYs4w9pD2AUlx3VbXTZyIGPqfKlo6sWNpunp13bpCPtJ/wyOkanwT7xzL7nnhFPl

c91QmGgyoI5nGJVzJ/fqilY2amrVZgQnHzq6AWXJomdFhznEaXYxR6DX5gh2ifL96/da

7sv3eJacv091EPFzuu3vY2kelB2tFn0zO9lWlSXKFzmPf2XgcrHYT8C7C45/vXs8OT8Z

QTKrGT36mSB7VsGvpMmvfylqDc/+7FlWWDOeZbnT+kgJaUmampKWzW3QIifbcH5/5+a3

62OA==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20260707; t=1790908164; x=1791512964;

h=content-type:mime-version:date:message-id:subject:to:from:x-gm-gg

:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to

:content-type;

bh=0QqZ66hf7T+zf9Seok2ttHvk08cxyZsdkZ8xfGVvJRM=;

b=HNLN7/BzMJ5CxKUSpUe+XQAtwgqU0D47d4n8x+FLlWc4OGXNkUPi18Uq/e+1C6GyNB

q2zfZDz0GbRqfDq4GC2Ch9HG7UclEH/bplOtZSm/5Kbd5/vYPWByu/qoMfBl/F5xvmbL

k/OAOyB/zNh01Vk3zFIJfKRoYEFuvBINdfWn53AaPKl7vOOH7oP7RB80n/OgCCPJjR95

peM9MqYqSJnlYFya3KDoLn0gs2QV6fzZDkloYSdXJPlgkZFNSN98op9exe+UfI1ssOr/

cRVIie8UwC5DD0jZ5FChOTLafvbP1htJR6As2azxLi8pl9PewxKYSOnyRHXllFO01UzV

YEng==

X-Gm-Message-State: AFuF++mgdEYFgiuW1Ka9aN3rlhfnCL1PcJb4uupzvUbD65n/Km1V0n36

Y/G9h4kkxmlltti9l2wowtoEfocR7Goip6MVrkvWOAexg74cT4a8pt3V8fPHpUMlvTY=

X-Gm-Gg: AYBFou2X4v7NcFSRf7657atNQYNhSRDL/hX0Ar3lD+8rLUmBEOTa7T3rzeNHgXu4OSS

kwcbh/e5yGZ//FrIJhMxolVTpn4fNMhRzVD6WUabjC2JuRilgsa4Y6x1c1ud5FvwYX9+275p0SC

DD8WMPAS4tJkU8LfI9v4KNfqWuSMCATDdmc7o55bcox8iVWtmfV1Nj2mNz7Q2IRbUnZiJEbxOoJ

/xFhCSEold5B1tEa6fs+s8GTuIkTXv8bPgHkCvEssMYnyi2HPJE3Y10FPw+gOg1chaLYZSdJCy2

BzRo/hoFE+jWrwQW+Fp8hQvn/iiT2EQK34s4SyuvbXOmkOVHiFnZyBEZm+EzpOyAY9fayjMZFEa

DjTiyqnnegFOcv9bxjR6rC/WNVWHU1cLhqkB2UVbiX55aH1hD38RxfvRaIXEkPrlbD5NWzT3z5a

4RFhs/XXKwOEfpBViL6hnwWr76r16CfBZgkPsuxBzfBha7NGwkmByECkdqdF8D04jGDZEMpidcM

2vlllP2Ip66BBxgwJ4fiRNlLXoMdQ==

X-Received: by 2002:a05:7300:de07:b0:34c:780a:425e with SMTP id 5a478bee46e88-34f150d0123mr1175541eec.19.1790908163839;

Thu, 01 Oct 2026 19:29:23 -0700 (PDT)

Received: from [127.0.0.1] ([103.87.59.116])

by smtp.gmail.com with ESMTPSA id 5a478bee46e88-34f14fd5620sm2166381eec.21.2026.10.01.19.29.22

for

(version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128);

Thu, 01 Oct 2026 19:29:23 -0700 (PDT)

From: Justice - LUX Media

X-Google-Original-From: "Justice - LUX Media"

X-Priority: 3

To: sales@nk.ca

Subject: Would Love to Show You Our Work

Message-ID: <953dfacc-f2c0-20da-687d-7df987c6e747@gmail.com>

Date: Fri, 02 Oct 2026 02:29:19 +0000

MIME-Version: 1.0

Content-Type: multipart/alternative;

boundary="--_NmP-7822817c89f2a73e-Part_1"

X-Spam_score: 7.8

X-Spam_score_int: 78

X-Spam_bar: +++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Hello, Just wanted to reach out and see if there’s anything

about your current website you’ve been thinking of changing. I’ve asked

our design team to start creating a website concept around your brand, so

you can get a feel for the direction we’d take.



Content analysis details: (7.8 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[103.87.59.116 listed in will-spam-for-food.eu.org]

[103.87.59.116 listed in will-spam-for-food.eu.org]

[103.87.59.116 listed in will-spam-for-food.eu.org]

[103.87.59.116 listed in will-spam-for-food.eu.org]

[103.87.59.116 listed in will-spam-for-food.eu.org]

[103.87.59.116 listed in will-spam-for-food.eu.org]

[103.87.59.116 listed in will-spam-for-food.eu.org]

[103.87.59.116 listed in will-spam-for-food.eu.org]

[74.125.229.12 listed in will-spam-for-food.eu.org]

[74.125.229.12 listed in will-spam-for-food.eu.org]

[74.125.229.12 listed in will-spam-for-food.eu.org]

[74.125.229.12 listed in will-spam-for-food.eu.org]

[74.125.229.12 listed in will-spam-for-food.eu.org]

[74.125.229.12 listed in will-spam-for-food.eu.org]

[74.125.229.12 listed in will-spam-for-food.eu.org]

[74.125.229.12 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[74.125.229.12 listed in dnsbl.ahbl.org]

[74.125.229.12 listed in dnsbl.ahbl.org]

[74.125.229.12 listed in dnsbl.ahbl.org]

[74.125.229.12 listed in dnsbl.ahbl.org]

[103.87.59.116 listed in dnsbl.ahbl.org]

[103.87.59.116 listed in dnsbl.ahbl.org]

[103.87.59.116 listed in dnsbl.ahbl.org]

[103.87.59.116 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[74.125.229.12 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[74.125.229.12 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[74.125.229.12 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[74.125.229.12 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_CBL RBL: Received via a relay in cbl.abuseat.org

[Listed by XBL, see ]

1.5 RCVD_IN_SBL_XBL RBL: Received via a relay in Spamhaus SBL+XBL

[103.87.59.116 listed in sbl-xbl.spamhaus.org]

1.2 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a relay in bl.spamcop.net

[Blocked - see ]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-0.0 SPF_PASS SPF: sender matches SPF record

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends in

digit

[justicemarc1489(at)gmail.com]

0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider

[justicemarc1489(at)gmail.com]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[74.125.229.12 listed in wl.mailspike.net]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[74.125.229.12 listed in bl.score.senderscore.com]

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

0.0 NO_RDNS2 Sending MTA has no reverse DNS

2.0 RATWR8_MESSID Message-ID with excessive dashes and dollars

Subject: {SPAM?} Would Love to Show You Our Work



----_NmP-7822817c89f2a73e-Part_1

Content-Type: text/plain; charset=utf-8

Content-Transfer-Encoding: quoted-printable



Hello,



Just wanted to reach out and see if there=E2=80=99s anything about =

your current website you=E2=80=99ve been thinking of changing.



I=E2=80=99ve asked our design team to start creating a website concept =

around your brand, so you can get a feel for the direction we=E2=80=99d =

take.



We keep it simple with a fixed one-time price of $499 for the =

complete website, with no monthly fees, hidden charges, or contract.



If you=E2=80=99d like to have a look at the concept, I=E2=80=99ll send it =

across once our design team has finished the last few touches.



Thank you.



Best,

Justice

Lux Media Network

Insta: @luxmedianetwork

----_NmP-7822817c89f2a73e-Part_1

Content-Type: text/html; charset=utf-8

Content-Transfer-Encoding: quoted-printable



Hello,

Just wanted to reach out and see if there=E2=80=99s =

anything about your current website you=E2=80=99ve been thinking of =

changing.

I=E2=80=99ve asked our design team to start creating a =

website concept around your brand, so you can get a feel for the direction =

we=E2=80=99d take.

We keep it simple with a fixed one-time price of =

$499 for the complete website, with no monthly fees, hidden charges, or =

contract.

If you=E2=80=99d like to have a look at the concept, =

I=E2=80=99ll send it across once our design team has finished the last few =

touches.

Thank you.

Best,
Justice
Lux Media =

Network
Insta: @luxmedianetwork



----_NmP-7822817c89f2a73e-Part_1--

CAA Phish

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 01 Oct 2026 23:06:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.100.1 (FreeBSD))

(envelope-from )

id 1xCVSi-00000000J4t-1GOq

for dave@doctor.nl2k.ab.ca;

Thu, 01 Oct 2026 23:05:36 -0600

Resent-From: The Doctor

Resent-Date: Thu, 1 Oct 2026 23:05:36 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from [103.191.92.115] (port=38685 helo=wiki.lat)

by doctor.nl2k.ab.ca with esmtp (Exim 4.100.1 (FreeBSD))

id 1xCT5o-00000000Dz8-2Yru

for root@nk.ca;

Thu, 01 Oct 2026 20:33:23 -0600

Date: Thu, 01 Oct 2026 22:16:13 -0400

From: =?UTF-8?B?Q0FBIE1lbWJlciBTdXBwb3J0?=

Reply-To: =?UTF-8?B?VXctY2xvdWRhY2NvdW50?=

To: root@nk.ca

Message-ID:

Subject: =?UTF-8?B?Q2xhaW0geW91ciBmcmVlIENBQSBEZWx1eGUgUm9hZHNpZGUgRW1lcmdlbmN5IEtpdA==?=

MIME-Version: 1.0

Content-Type: text/html; charset="UTF-8"

List-Id: "0" <4.yio6LTQtOFiJCaBwakKkWfrtv2YWSYc5.localhost.root>

List-Unsubscribe: ,

List-Unsubscribe-Post: List-Unsubscribe=One-Click

Feedback-ID: xpro-9985-1488:xpro-9985:MAILING:inxmailde

X-CSA-Complaints: csa-complaints@ining.fr

X-Mailer: Inxmail EE 4.8.48.825

X-Spam_score: 27.3

X-Spam_score_int: 273

X-Spam_bar: +++++++++++++++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Claim your CAA Deluxe Roadside Emergency Kit Verify your

new CAA Deluxe Emergency Kit claim!



Content analysis details: (27.3 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[103.191.92.115 listed in will-spam-for-food.eu.org]

[103.191.92.115 listed in will-spam-for-food.eu.org]

[103.191.92.115 listed in will-spam-for-food.eu.org]

[103.191.92.115 listed in will-spam-for-food.eu.org]

[103.191.92.115 listed in will-spam-for-food.eu.org]

[103.191.92.115 listed in will-spam-for-food.eu.org]

[103.191.92.115 listed in will-spam-for-food.eu.org]

[103.191.92.115 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[103.191.92.115 listed in dnsbl.ahbl.org]

[103.191.92.115 listed in dnsbl.ahbl.org]

[103.191.92.115 listed in dnsbl.ahbl.org]

[103.191.92.115 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[103.191.92.115 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[103.191.92.115 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[103.191.92.115 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[103.191.92.115 listed in dnsbl.ahbl.org]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[103.191.92.115 listed in bl.score.senderscore.com]

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

1.0 HK_RANDOM_FROM From username looks random

1.0 HK_RANDOM_REPLYTO Reply-To username looks random

0.5 FROM_LOCAL_NOVOWEL From: localpart has series of non-vowel letters

15 GR_DOMAIN_XECODE1 Spammer tool signature (xecode)

1.5 TVD_PH_SEC BODY: Message includes a phrase commonly used in phishing

mails

1.0 OPT_OUT BODY: No description available.

0.3 OFFER_2 BODY: Offers you Something (2)

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 HTML_MESSAGE BODY: HTML included in message

1.3 RDNS_NONE Delivered to internal network by a host with no rDNS

0.1 FROM_EXCESS_BASE64 From: base64 encoded unnecessarily

3.0 URI_FIREBASEAPP Link to hosted firebase web application, possible

phishing

Subject: {SPAM?} =?UTF-8?B?Q2xhaW0geW91ciBmcmVlIENBQSBEZWx1eGUgUm9hZHNpZGUgRW1lcmdlbmN5IEtpdA==?=





























Claim your CAA Deluxe Roadside Emergency Kit






style="margin: 0; padding: 20px; background-color: #ffffff; font-family: 'Helvetica Neue', Helvetica, Arial, sans-serif; -webkit-font-smoothing: antialiased;">


style="max-width: 400px; background-color: #ffffff; margin: 0 auto;">


































































style="background-color: #f0f2f2; padding: 25px 20px 25px 20px; text-align: center; border-radius: 4px; border-top: 3px solid #1d5cc6;">


style="font-size: 10.5px; line-height: 1.5; color: #555555; margin: 0 0 10px 0; font-family: Arial, sans-serif; text-align: center;">

caa.ca is a trading name for Canadian Automobile Association, 60 Commerce Valley Dr E, Thornhill, ON L3T 7P9, Canada.




style="font-size: 10.5px; line-height: 1.5; color: #555555; margin: 0 0 12px 0; font-family: Arial, sans-serif; text-align: center;">

Participation is voluntary. Limit one free emergency kit per member. Offer valid while supplies last. To opt out of future rewards, you can
style="color: #1d5cc6; text-decoration: underline;">unsubscribe here.




style="font-size: 10.5px; line-height: 1.5; color: #555555; margin: 0 0 15px 0; font-family: Arial, sans-serif; text-align: center;">

© 2026 Canadian Automobile Association. All rights reserved.







CAA Logo



style="font-size: 16px; font-weight: bold; color: #1d5cc6; margin: 0; font-family: 'Helvetica Neue', Helvetica, Arial, sans-serif; text-align: center;">

Verify your new CAA Deluxe Emergency Kit claim!



style="font-size: 13px; line-height: 1.5; color: #111111; margin: 0; font-family: 'Helvetica Neue', Helvetica, Arial, sans-serif; text-align: center;">

To claim your complimentary CAA Deluxe Roadside Emergency Kit (worth $79.99 CAD), please use the following link to take our short survey:


CAA Deluxe Roadside Emergency Kit



style="background-color: #1d5cc6; color: #ffffff; padding: 12px 26px; text-decoration: none; font-size: 16px; font-weight: bold; font-family: Arial, sans-serif; border-radius: 4px; display: inline-block; border: 1px solid #1651b7;">

START MY SURVEY



style="font-size: 13px; line-height: 1.5; color: #111111; margin: 0; font-family: 'Helvetica Neue', Helvetica, Arial, sans-serif; text-align: center;">

Don't share this promotional link with anyone. CAA takes your account security and membership benefits very seriously.










CAA


















CAA Phish

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 01 Oct 2026 23:06:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.100.1 (FreeBSD))

(envelope-from )

id 1xCVSe-00000000J0f-2Zuu

for dave@doctor.nl2k.ab.ca;

Thu, 01 Oct 2026 23:05:32 -0600

Resent-From: The Doctor

Resent-Date: Thu, 1 Oct 2026 23:05:32 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from [103.191.92.115] (port=38685 helo=wiki.lat)

by doctor.nl2k.ab.ca with esmtp (Exim 4.100.1 (FreeBSD))

id 1xCT5w-00000000Dz8-1yY1

for doctor@nk.ca;

Thu, 01 Oct 2026 20:33:28 -0600

Date: Thu, 01 Oct 2026 22:16:13 -0400

From: =?UTF-8?B?Q0FBIE1lbWJlciBTdXBwb3J0?=

Reply-To: =?UTF-8?B?VXctY2xvdWRhY2NvdW50?=

To: doctor@nk.ca

Message-ID:

Subject: =?UTF-8?B?Q2xhaW0geW91ciBmcmVlIENBQSBEZWx1eGUgUm9hZHNpZGUgRW1lcmdlbmN5IEtpdA==?=

MIME-Version: 1.0

Content-Type: text/html; charset="UTF-8"

List-Id: "0" <4.0qVK7ZHVpeiVwHEHEBX6n40f3zkA2OOC.localhost.doctor>

List-Unsubscribe: ,

List-Unsubscribe-Post: List-Unsubscribe=One-Click

Feedback-ID: xpro-9985-1488:xpro-9985:MAILING:inxmailde

X-CSA-Complaints: csa-complaints@llet.fr

X-Mailer: Inxmail EE 4.8.48.825

X-Spam_score: 27.3

X-Spam_score_int: 273

X-Spam_bar: +++++++++++++++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Claim your CAA Deluxe Roadside Emergency Kit Verify your

new CAA Deluxe Emergency Kit claim!



Content analysis details: (27.3 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[103.191.92.115 listed in bl.score.senderscore.com]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[103.191.92.115 listed in will-spam-for-food.eu.org]

[103.191.92.115 listed in will-spam-for-food.eu.org]

[103.191.92.115 listed in will-spam-for-food.eu.org]

[103.191.92.115 listed in will-spam-for-food.eu.org]

[103.191.92.115 listed in will-spam-for-food.eu.org]

[103.191.92.115 listed in will-spam-for-food.eu.org]

[103.191.92.115 listed in will-spam-for-food.eu.org]

[103.191.92.115 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[103.191.92.115 listed in dnsbl.ahbl.org]

[103.191.92.115 listed in dnsbl.ahbl.org]

[103.191.92.115 listed in dnsbl.ahbl.org]

[103.191.92.115 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[103.191.92.115 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[103.191.92.115 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[103.191.92.115 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[103.191.92.115 listed in dnsbl.ahbl.org]

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

1.0 HK_RANDOM_FROM From username looks random

1.0 HK_RANDOM_REPLYTO Reply-To username looks random

0.5 FROM_LOCAL_NOVOWEL From: localpart has series of non-vowel letters

15 GR_DOMAIN_XECODE1 Spammer tool signature (xecode)

1.5 TVD_PH_SEC BODY: Message includes a phrase commonly used in phishing

mails

1.0 OPT_OUT BODY: No description available.

0.3 OFFER_2 BODY: Offers you Something (2)

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 HTML_MESSAGE BODY: HTML included in message

0.1 FROM_EXCESS_BASE64 From: base64 encoded unnecessarily

3.0 URI_FIREBASEAPP Link to hosted firebase web application, possible

phishing

1.3 RDNS_NONE Delivered to internal network by a host with no rDNS

Subject: {SPAM?} =?UTF-8?B?Q2xhaW0geW91ciBmcmVlIENBQSBEZWx1eGUgUm9hZHNpZGUgRW1lcmdlbmN5IEtpdA==?=





























Claim your CAA Deluxe Roadside Emergency Kit






style="margin: 0; padding: 20px; background-color: #ffffff; font-family: 'Helvetica Neue', Helvetica, Arial, sans-serif; -webkit-font-smoothing: antialiased;">


style="max-width: 400px; background-color: #ffffff; margin: 0 auto;">


































































style="background-color: #f0f2f2; padding: 25px 20px 25px 20px; text-align: center; border-radius: 4px; border-top: 3px solid #1d5cc6;">


style="font-size: 10.5px; line-height: 1.5; color: #555555; margin: 0 0 10px 0; font-family: Arial, sans-serif; text-align: center;">

caa.ca is a trading name for Canadian Automobile Association, 60 Commerce Valley Dr E, Thornhill, ON L3T 7P9, Canada.




style="font-size: 10.5px; line-height: 1.5; color: #555555; margin: 0 0 12px 0; font-family: Arial, sans-serif; text-align: center;">

Participation is voluntary. Limit one free emergency kit per member. Offer valid while supplies last. To opt out of future rewards, you can
style="color: #1d5cc6; text-decoration: underline;">unsubscribe here.




style="font-size: 10.5px; line-height: 1.5; color: #555555; margin: 0 0 15px 0; font-family: Arial, sans-serif; text-align: center;">

© 2026 Canadian Automobile Association. All rights reserved.







CAA Logo



style="font-size: 16px; font-weight: bold; color: #1d5cc6; margin: 0; font-family: 'Helvetica Neue', Helvetica, Arial, sans-serif; text-align: center;">

Verify your new CAA Deluxe Emergency Kit claim!



style="font-size: 13px; line-height: 1.5; color: #111111; margin: 0; font-family: 'Helvetica Neue', Helvetica, Arial, sans-serif; text-align: center;">

To claim your complimentary CAA Deluxe Roadside Emergency Kit (worth $79.99 CAD), please use the following link to take our short survey:


CAA Deluxe Roadside Emergency Kit



style="background-color: #1d5cc6; color: #ffffff; padding: 12px 26px; text-decoration: none; font-size: 16px; font-weight: bold; font-family: Arial, sans-serif; border-radius: 4px; display: inline-block; border: 1px solid #1651b7;">

START MY SURVEY



style="font-size: 13px; line-height: 1.5; color: #111111; margin: 0; font-family: 'Helvetica Neue', Helvetica, Arial, sans-serif; text-align: center;">

Don't share this promotional link with anyone. CAA takes your account security and membership benefits very seriously.










CAA


















CAA Phish

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 01 Oct 2026 23:06:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.100.1 (FreeBSD))

(envelope-from )

id 1xCVSV-00000000Iq0-3yLW

for dave@doctor.nl2k.ab.ca;

Thu, 01 Oct 2026 23:05:23 -0600

Resent-From: The Doctor

Resent-Date: Thu, 1 Oct 2026 23:05:23 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from [103.82.93.29] (port=53505 helo=clevelandclinic.lat)

by doctor.nl2k.ab.ca with esmtp (Exim 4.100.1 (FreeBSD))

id 1xCT6I-00000000E1c-1LFV

for doctor@netknow.ca;

Thu, 01 Oct 2026 20:33:53 -0600

Date: Thu, 01 Oct 2026 22:16:12 -0400

From: =?UTF-8?B?Q0FBIE1lbWJlciBTdXBwb3J0?=

Reply-To: =?UTF-8?B?VXctY2xvdWRhY2NvdW50?=

To: doctor@netknow.ca

Message-ID:

Subject: =?UTF-8?B?Q2xhaW0geW91ciBmcmVlIENBQSBEZWx1eGUgUm9hZHNpZGUgRW1lcmdlbmN5IEtpdA==?=

MIME-Version: 1.0

Content-Type: text/html; charset="UTF-8"

List-Id: "0" <4.ywHBAnMMZihpghv9RuEORKLhaC3JTSl5.localhost.doctor>

List-Unsubscribe: ,

List-Unsubscribe-Post: List-Unsubscribe=One-Click

Feedback-ID: xpro-9985-1488:xpro-9985:MAILING:inxmailde

X-CSA-Complaints: csa-complaints@kevi.fr

X-Mailer: Inxmail EE 4.8.48.825

X-Spam_score: 27.8

X-Spam_score_int: 278

X-Spam_bar: +++++++++++++++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Claim your CAA Deluxe Roadside Emergency Kit Verify your

new CAA Deluxe Emergency Kit claim!



Content analysis details: (27.8 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[103.82.93.29 listed in will-spam-for-food.eu.org]

[103.82.93.29 listed in will-spam-for-food.eu.org]

[103.82.93.29 listed in will-spam-for-food.eu.org]

[103.82.93.29 listed in will-spam-for-food.eu.org]

[103.82.93.29 listed in will-spam-for-food.eu.org]

[103.82.93.29 listed in will-spam-for-food.eu.org]

[103.82.93.29 listed in will-spam-for-food.eu.org]

[103.82.93.29 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[103.82.93.29 listed in dnsbl.ahbl.org]

[103.82.93.29 listed in dnsbl.ahbl.org]

[103.82.93.29 listed in dnsbl.ahbl.org]

[103.82.93.29 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[103.82.93.29 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[103.82.93.29 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[103.82.93.29 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[103.82.93.29 listed in dnsbl.ahbl.org]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

1.0 HK_RANDOM_FROM From username looks random

1.0 HK_RANDOM_REPLYTO Reply-To username looks random

0.5 FROM_LOCAL_NOVOWEL From: localpart has series of non-vowel letters

15 GR_DOMAIN_XECODE1 Spammer tool signature (xecode)

1.5 TVD_PH_SEC BODY: Message includes a phrase commonly used in phishing

mails

1.0 OPT_OUT BODY: No description available.

0.3 OFFER_2 BODY: Offers you Something (2)

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[103.82.93.29 listed in bl.score.senderscore.com]

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 HTML_MESSAGE BODY: HTML included in message

3.0 URI_FIREBASEAPP Link to hosted firebase web application, possible

phishing

0.1 FROM_EXCESS_BASE64 From: base64 encoded unnecessarily

0.5 VOWEL_FROM_5 Impronouncable from header (6 consecutive vowels)

1.3 RDNS_NONE Delivered to internal network by a host with no rDNS

Subject: {SPAM?} =?UTF-8?B?Q2xhaW0geW91ciBmcmVlIENBQSBEZWx1eGUgUm9hZHNpZGUgRW1lcmdlbmN5IEtpdA==?=





























Claim your CAA Deluxe Roadside Emergency Kit






style="margin: 0; padding: 20px; background-color: #ffffff; font-family: 'Helvetica Neue', Helvetica, Arial, sans-serif; -webkit-font-smoothing: antialiased;">


style="max-width: 400px; background-color: #ffffff; margin: 0 auto;">


































































style="background-color: #f0f2f2; padding: 25px 20px 25px 20px; text-align: center; border-radius: 4px; border-top: 3px solid #1d5cc6;">


style="font-size: 10.5px; line-height: 1.5; color: #555555; margin: 0 0 10px 0; font-family: Arial, sans-serif; text-align: center;">

caa.ca is a trading name for Canadian Automobile Association, 60 Commerce Valley Dr E, Thornhill, ON L3T 7P9, Canada.




style="font-size: 10.5px; line-height: 1.5; color: #555555; margin: 0 0 12px 0; font-family: Arial, sans-serif; text-align: center;">

Participation is voluntary. Limit one free emergency kit per member. Offer valid while supplies last. To opt out of future rewards, you can
style="color: #1d5cc6; text-decoration: underline;">unsubscribe here.




style="font-size: 10.5px; line-height: 1.5; color: #555555; margin: 0 0 15px 0; font-family: Arial, sans-serif; text-align: center;">

© 2026 Canadian Automobile Association. All rights reserved.







CAA Logo



style="font-size: 16px; font-weight: bold; color: #1d5cc6; margin: 0; font-family: 'Helvetica Neue', Helvetica, Arial, sans-serif; text-align: center;">

Verify your new CAA Deluxe Emergency Kit claim!



style="font-size: 13px; line-height: 1.5; color: #111111; margin: 0; font-family: 'Helvetica Neue', Helvetica, Arial, sans-serif; text-align: center;">

To claim your complimentary CAA Deluxe Roadside Emergency Kit (worth $79.99 CAD), please use the following link to take our short survey:


CAA Deluxe Roadside Emergency Kit



style="background-color: #1d5cc6; color: #ffffff; padding: 12px 26px; text-decoration: none; font-size: 16px; font-weight: bold; font-family: Arial, sans-serif; border-radius: 4px; display: inline-block; border: 1px solid #1651b7;">

START MY SURVEY



style="font-size: 13px; line-height: 1.5; color: #111111; margin: 0; font-family: 'Helvetica Neue', Helvetica, Arial, sans-serif; text-align: center;">

Don't share this promotional link with anyone. CAA takes your account security and membership benefits very seriously.










CAA


















Chinese products spam

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 01 Oct 2026 18:53:13 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.100.1 (FreeBSD))

(envelope-from )

id 1xCRWG-000000004De-3IMW

for dave@doctor.nl2k.ab.ca;

Thu, 01 Oct 2026 18:53:00 -0600

Resent-From: The Doctor

Resent-Date: Thu, 1 Oct 2026 18:53:00 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-m16.yeah.net ([1.95.21.14]:49199)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.100.1 (FreeBSD))

(envelope-from )

id 1xCQza-000000001Bk-3seV

for doctor@nl2k.ab.ca;

Thu, 01 Oct 2026 18:18:52 -0600

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yeah.net;

s=s110527; h=Date:From:To:Subject:Content-Type:MIME-Version:

Message-ID; bh=ocylQro1OIfirqE/UiUfsCwXDeXJ9479ftQOlv+P2Rk=; b=d

CJZTTPY7RGnF+llxfA2zDCGcYsfHiGZIHASTBOmbG2RCUemcw4qG5OOTfiVxMONM

XGmKRILgeINOdM2jfi4qg5tbl/L6mL5RF5ELT1JxAA0L5P8rIi9maLi4Sbubnqud

gf5g5pP/Zq5V7yLoRUF+wC03YwiyrkTiVkDh/cMW2Y=

Received: from servetheworld$yeah.net (

[240e:388:9939:4301:19a9:912d:d337:acb1] ) by ajax-webmail-wmsvr-207-59

(Coremail) ; Fri, 2 Oct 2026 07:56:58 +0800 (CST)

X-Originating-IP: [240e:388:9939:4301:19a9:912d:d337:acb1]

Date: Fri, 2 Oct 2026 07:56:58 +0800 (CST)

X-CM-HeaderCharset: UTF-8

From: servetheworld

To: doctor@nl2k.ab.ca

Subject: Small commodities supplier from China

X-Priority: 3

X-Mailer: Coremail Webmail Server Version 2023.4-cmXT build

20260511(2e539873) Copyright (c) 2002-2026 www.mailtech.cn yeah

X-CM-CTRLMSGS: gu6tu3BsdXM9MTc5MDg5OTAxODQ4NF83NzI4ODc5NDNjMWZiYWZkMGE0NTY2Z

WFjN2Q4NzFhNQ==

X-NTES-SC: AL_Qu2SAvSStkgq7iKdZOkfnkcUjuY/Wcuxufog3YBXc+4KvhDf1CICQ019Nn3RwcGwOQmDsDu0bSF26MZgbalXHiZvnrBkWGBLKei//sytfg==

Content-Type: multipart/alternative;

boundary="----=_Part_574_1714490352.1790899018258"

MIME-Version: 1.0

Message-ID: <566718bf.82.1a0f9e65a12.Coremail.servetheworld@yeah.net>

X-Coremail-Locale: zh_CN

X-CM-TRANSID:O88vCgD3H7RK875qMFEGAA--.63031W

X-CM-SenderInfo: xvhu4v5wkh40xuogq5hhdkh0dhw/1tbiIgpZvGq+80plvAAA35

X-Coremail-Antispam: 1U5529EdanIXcx71UUUUU7vcSsGvfC2KfnxnUU==

X-Spam_score: 6.6

X-Spam_score_int: 66

X-Spam_bar: ++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Greetings from China, We are a trading company, specializing

in supplying ALL KINDS of small commodities, We offer both customization

and wholesale services.



Content analysis details: (6.6 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[240e:388:9939:4301:19a9:912d:d337:acb1 listed in]

[will-spam-for-food.eu.org]

[240e:388:9939:4301:19a9:912d:d337:acb1 listed in]

[will-spam-for-food.eu.org]

[240e:388:9939:4301:19a9:912d:d337:acb1 listed in]

[will-spam-for-food.eu.org]

[240e:388:9939:4301:19a9:912d:d337:acb1 listed in]

[will-spam-for-food.eu.org]

[240e:388:9939:4301:19a9:912d:d337:acb1 listed in]

[will-spam-for-food.eu.org]

[240e:388:9939:4301:19a9:912d:d337:acb1 listed in]

[will-spam-for-food.eu.org]

[240e:388:9939:4301:19a9:912d:d337:acb1 listed in]

[will-spam-for-food.eu.org]

[240e:388:9939:4301:19a9:912d:d337:acb1 listed in]

[will-spam-for-food.eu.org]

[1.95.21.14 listed in will-spam-for-food.eu.org]

[1.95.21.14 listed in will-spam-for-food.eu.org]

[1.95.21.14 listed in will-spam-for-food.eu.org]

[1.95.21.14 listed in will-spam-for-food.eu.org]

[1.95.21.14 listed in will-spam-for-food.eu.org]

[1.95.21.14 listed in will-spam-for-food.eu.org]

[1.95.21.14 listed in will-spam-for-food.eu.org]

[1.95.21.14 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[1.95.21.14 listed in dnsbl.ahbl.org]

[1.95.21.14 listed in dnsbl.ahbl.org]

[1.95.21.14 listed in dnsbl.ahbl.org]

[1.95.21.14 listed in dnsbl.ahbl.org]

[240e:388:9939:4301:19a9:912d:d337:acb1 listed in]

[dnsbl.ahbl.org]

[240e:388:9939:4301:19a9:912d:d337:acb1 listed in]

[dnsbl.ahbl.org]

[240e:388:9939:4301:19a9:912d:d337:acb1 listed in]

[dnsbl.ahbl.org]

[240e:388:9939:4301:19a9:912d:d337:acb1 listed in]

[dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[1.95.21.14 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[1.95.21.14 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[1.95.21.14 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[1.95.21.14 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_SBL_XBL RBL: Received via a relay in Spamhaus SBL+XBL

[240e:388:9939:4301:19a9:912d:d337:acb1 listed in]

[sbl-xbl.spamhaus.org]

3.6 RCVD_IN_SBL_CSS RBL: Received via a relay in Spamhaus SBL-CSS

[240e:388:9939:4301:19a9:912d:d337:acb1 listed in]

[zen.spamhaus.org]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[1.95.21.14 listed in list.dnswl.org]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[1.95.21.14 listed in bl.score.senderscore.com]

-0.0 SPF_PASS SPF: sender matches SPF record

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

-0.0 T_RP_MATCHES_RCVD Envelope sender domain matches handover relay

domain

0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider

[servetheworld(at)yeah.net]

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

Subject: {SPAM?} Small commodities supplier from China



Greetings from China,







We are a trading company, specializing in supplying ALL KINDS of small commodities,



We offer both customization and wholesale services.







We don't have a website to show all items we supply but if you send us a picture to



show what you want, then we will send you pictures of the same or similar products



for your choices. We've been doing this with our clients. it's very convenient. Sure,



we will control the quality for you and give you better price.







We supply these items below:



Tote bags, gift bags, canvas bags, paper bags, belts, keychains, buttons, zippers,



hair accessories, scarves, storage supplies, batchroom supplies, towels, kitchen



gadgets, photo frames, travel mugs, thermos, vacuum flask, pens, notebooks,



beauty tools, wigs, rainwear, Hardware, phone cases, cables, phone holders, lamp,



LED, socks, hats, gloves, hard hat, etc etc. we have all of them you need as long as they



are made in China. I am so good at sourcing and I know where is the right production base for them.







Please feel free to reach out if you have demand for any of these items. I am looking forward to doing business with you for long time.







Best regards,



Winner

Wealthsimple phish from Microsoft Outlook

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 01 Oct 2026 10:13:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.100.1 (FreeBSD))

(envelope-from )

id 1xCJOd-00000000EVO-0ln1

for dave@doctor.nl2k.ab.ca;

Thu, 01 Oct 2026 10:12:35 -0600

Resent-From: The Doctor

Resent-Date: Thu, 1 Oct 2026 10:12:35 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from awi.axureclub.com ([68.210.231.81]:41185)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.100.1 (FreeBSD))

(envelope-from )

id 1xCHvs-00000000Lrs-2Psz

for root@nk.ca;

Thu, 01 Oct 2026 08:38:23 -0600

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; s=default; d=awi.axureclub.com;

h=Content-Type:MIME-Version:From:To:Subject:Date:Message-ID:Reply-To;

i=lxwefnixw@awi.axureclub.com;

bh=HATglnR1RhJcBTyhi5/8lr++c0B5Q6PxJCExrNR7LDw=;

b=Si+9sMyr6Vfl+PbDTud4vgq6iLh4x6XxH9ScM0mdrem7OnOUrEkKzkAPx/eIflhlxaUOgjWGz7lC

hGRX63mOQsB4H0ALu10Q13LsrhMcxbE53FezZq7SH7CWqLGEuWU3ANVXDEmTY7Lm55XIzyUV4sjZ

/Bokq6LXALHom6llPWteGhEcdD0m+gUfrYNIcRTPDnmvoj1+NmhfVaUUn2qBGpoPhHPUBqpG78m+

Y+uasnfkdiyZ/Z/hwa0cQLdlX1zuwrpr2C9AMqWwdKMv2FpS7AtIOJHgOS8GIOUKY5fnCoEMHiIw

/xrlp8tsiXj7LWXqrKHXDGo3Wj2hbbAR/cLyJw==

Content-Type: multipart/alternative;

boundary="===============6694005316659739007=="

MIME-Version: 1.0

From: Wealthsimple

To: root@nk.ca

Subject: Update your tax details to avoid withholding tax

Date: Thu, 01 Oct 2026 09:37:21 -0500

Message-ID: <179086544133.6226.10731258806591587462@awi.axureclub.com>

Reply-To: feedback@wealthsimple.com

Feedback-ID: campaign:wealthsimple.com:mailer

X-Spam_score: 28.1

X-Spam_score_int: 281

X-Spam_bar: ++++++++++++++++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Hello root, We noticed that a few tax details on your account

have expired or are missing. If they are not updated, tax may be withheld

from your account at a higher rate. Account: root@nk.ca Reference: 88971955

Details to review: - Tax form (W-8BEN) - Tax residency information



Content analysis details: (28.1 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[68.210.231.81 listed in will-spam-for-food.eu.org]

[68.210.231.81 listed in will-spam-for-food.eu.org]

[68.210.231.81 listed in will-spam-for-food.eu.org]

[68.210.231.81 listed in will-spam-for-food.eu.org]

[68.210.231.81 listed in will-spam-for-food.eu.org]

[68.210.231.81 listed in will-spam-for-food.eu.org]

[68.210.231.81 listed in will-spam-for-food.eu.org]

[68.210.231.81 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[68.210.231.81 listed in dnsbl.ahbl.org]

[68.210.231.81 listed in dnsbl.ahbl.org]

[68.210.231.81 listed in dnsbl.ahbl.org]

[68.210.231.81 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[68.210.231.81 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[68.210.231.81 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[68.210.231.81 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[68.210.231.81 listed in dnsbl.ahbl.org]

-0.0 SPF_PASS SPF: sender matches SPF record

-0.0 SPF_HELO_PASS SPF: HELO matches SPF record

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-0.0 T_RP_MATCHES_RCVD Envelope sender domain matches handover relay

domain

2.3 MANGLED_ACCNT BODY: mangled account(s)

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[68.210.231.81 listed in bl.score.senderscore.com]

1.5 MR_STRANGE_QUESTION URI: No description available.

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 HTML_MESSAGE BODY: HTML included in message

1.0 J_WEEDS_O FULL: Dec/Hex char Enc [Oo]

1.0 J_WEEDS_P FULL: Dec/Hex char Enc [Pp]

1.0 J_WEEDS_E FULL: Dec/Hex char Enc [Ee]

1.0 J_WEEDS_M FULL: Dec/Hex char Enc [Mm]

1.0 J_WEEDS_I FULL: Dec/Hex char Enc [Ii]

1.0 J_WEEDS_U FULL: Dec/Hex char Enc [Uu]

1.0 J_WEEDS_H FULL: Dec/Hex char Enc [Hh]

1.0 J_WEEDS_C FULL: Dec/Hex char Enc [Cc]

1.0 J_WEEDS_W FULL: Dec/Hex char Enc [Ww]

1.0 J_WEEDS_V FULL: Dec/Hex char Enc [Vv]

1.0 J_WEEDS_N FULL: Dec/Hex char Enc [Nn]

1.0 J_WEEDS_Y FULL: Dec/Hex char Enc [Yy]

1.0 J_WEEDS_T FULL: Dec/Hex char Enc [Tt]

1.0 J_WEEDS_R FULL: Dec/Hex char Enc [Rr]

1.0 J_WEEDS_L FULL: Dec/Hex char Enc [Ll]

1.0 J_WEEDS_F FULL: Dec/Hex char Enc [Ff]

1.0 J_WEEDS_A FULL: Dec/Hex char Enc [Aa]

1.0 J_WEEDS_S FULL: Dec/Hex char Enc [Ss]

1.0 J_WEEDS_B FULL: Dec/Hex char Enc [Bb]

2.0 WINDOWS_7BITS Windows charset announced as 7 bit

2.0 VOWEL_URI_6 URI hostname with 6 consecutive vowels

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

Subject: {SPAM?} Update your tax details to avoid withholding tax



--===============6694005316659739007==

Content-Type: text/plain; charset=windows-1252

MIME-Version: 1.0

Content-Transfer-Encoding: 7bit



Hello root,



We noticed that a few tax details on your account have expired or are

missing. If they are not updated, tax may be withheld from your

account at a higher rate.



Account: root@nk.ca

Reference: 88971955

Details to review:

- Tax form (W-8BEN)

- Tax residency information



Update your details:

https://www.wxsmbj.com/?email=root@nk.ca&uid=gW43R73aHEPtNByLaZ1VRB1h



It only takes a minute or two - and it helps us apply the correct tax

rate to your account.



Warm regards,

The Wealthsimple team



---

This email was sent automatically to root@nk.ca.

If this message was not meant for you, you can safely ignore it.



--===============6694005316659739007==

Content-Type: text/html; charset=utf-8

MIME-Version: 1.0

Content-Transfer-Encoding: 7bit















Update your tax details to avoid withholding tax































































































Wealthsimple


A note from Wealthsimple


Some of your tax
details are expiring


Hello root,



We noticed that a few t‍ax details on your acc‍ount have expired or are​ missing. If they are not updated, tax may be wit‍hheld from your account​ at a higher rate.












Update your details




It only takes a minute o​r two - and it helps us ap​ply the correct tax rate t‍o your account.
























Account


root@nk.ca


Reference


97005671


Details to review


Tax form (W-8BEN)
Tax residency informa‌tion




Warm regards,



The Wealthsimple team




This email was sent automatically to root@‍nk.ca.


If this message was not​ meant for you, you can ‍safely ignore it.





Help

 · 

Privacy

 · 

Terms



Copyright Wealthsimpl‍e Technologies Inc. Al​l rights reserved.














--===============6694005316659739007==--

Wealthsimple phish from Microsoft

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 01 Oct 2026 10:13:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.100.1 (FreeBSD))

(envelope-from )

id 1xCJOZ-00000000EV3-1bZv

for dave@doctor.nl2k.ab.ca;

Thu, 01 Oct 2026 10:12:31 -0600

Resent-From: The Doctor

Resent-Date: Thu, 1 Oct 2026 10:12:31 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from stv.iwxapp.com ([20.106.127.112]:51479)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.100.1 (FreeBSD))

(envelope-from )

id 1xCHuy-00000000Lmf-1eAw

for sales@nk.ca;

Thu, 01 Oct 2026 08:37:27 -0600

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; s=default; d=stv.iwxapp.com;

h=Content-Type:MIME-Version:From:To:Subject:Date:Message-ID:Reply-To;

i=dynbcflvs@stv.iwxapp.com;

bh=WoULwfYrAd1Ku5s5QjxHLOgquI6QLnF+OCUziru3IVs=;

b=DaTAjo237wwlJfCmyKlmv5YiwAFFVFzoNWTMpbEA8AhbzrMFfTQKDHkb+ChECBLGNPN7mGDmy85N

yztTnheJ6Ef0uqK+yfLCyqo1/XznT2Yvf/+bRs+oPscc1KqMcrbFawSIGp0+L7yB3lN7g7N0nTJS

P+3USAxZk47N5ZjBXGi07JSF7t1ILXMXktQTNjodKVqCRe6jyvGAsU3GxYnJFnLDNwSvqc2jHg/E

+PgM4Eg6vP41ttK+4yWB6cS/Hdf7FEMBQVMxG589q0X6lsnlSrYB8tC8RWUl+jtjtivSRWbMANiz

qXwm/90ruorg444j8tGf0xFZa3XVtzj+dVAF1Q==

Content-Type: multipart/alternative;

boundary="===============6440781682195144814=="

MIME-Version: 1.0

From: Wealthsimple Team

To: sales@nk.ca

Subject: Update your tax details to avoid withholding tax

Date: Thu, 01 Oct 2026 09:36:31 -0500

Message-ID: <179086539127.5476.14126171970562003330@stv.iwxapp.com>

Reply-To: feedback@wealthsimple.com

Feedback-ID: campaign:wealthsimple.com:mailer

X-Spam_score: 37.0

X-Spam_score_int: 370

X-Spam_bar: +++++++++++++++++++++++++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Hello sales, We noticed that a few tax details on your account

have expired or are missing. If they are not updated, tax may be withheld

from your account at a higher rate. Account: sales@nk.ca Reference: 15569203

Details to review: - Tax form (W-8BEN) - Tax residency information



Content analysis details: (37.0 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[20.106.127.112 listed in will-spam-for-food.eu.org]

[20.106.127.112 listed in will-spam-for-food.eu.org]

[20.106.127.112 listed in will-spam-for-food.eu.org]

[20.106.127.112 listed in will-spam-for-food.eu.org]

[20.106.127.112 listed in will-spam-for-food.eu.org]

[20.106.127.112 listed in will-spam-for-food.eu.org]

[20.106.127.112 listed in will-spam-for-food.eu.org]

[20.106.127.112 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[20.106.127.112 listed in dnsbl.ahbl.org]

[20.106.127.112 listed in dnsbl.ahbl.org]

[20.106.127.112 listed in dnsbl.ahbl.org]

[20.106.127.112 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[20.106.127.112 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[20.106.127.112 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[20.106.127.112 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[20.106.127.112 listed in dnsbl.ahbl.org]

-0.0 SPF_PASS SPF: sender matches SPF record

-0.0 SPF_HELO_PASS SPF: HELO matches SPF record

1.0 HK_RANDOM_FROM From username looks random

3.5 VOWEL_FROM_7 Impronouncable from header (7+ consecutive vowels)

0.5 FROM_LOCAL_NOVOWEL From: localpart has series of non-vowel letters

0.6 HK_RANDOM_ENVFROM Envelope sender username looks random

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-0.0 T_RP_MATCHES_RCVD Envelope sender domain matches handover relay

domain

2.3 MANGLED_RATES BODY: mangled rate(s)

2.3 MANGLED_ACCNT BODY: mangled account(s)

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[20.106.127.112 listed in bl.score.senderscore.com]

1.5 MR_STRANGE_QUESTION URI: No description available.

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 HTML_MESSAGE BODY: HTML included in message

1.0 J_WEEDS_G FULL: Dec/Hex char Enc [Gg]

1.0 J_WEEDS_O FULL: Dec/Hex char Enc [Oo]

1.0 J_WEEDS_P FULL: Dec/Hex char Enc [Pp]

1.0 J_WEEDS_E FULL: Dec/Hex char Enc [Ee]

1.0 J_WEEDS_D FULL: Dec/Hex char Enc [Dd]

1.0 J_WEEDS_M FULL: Dec/Hex char Enc [Mm]

1.0 J_WEEDS_I FULL: Dec/Hex char Enc [Ii]

1.0 J_WEEDS_U FULL: Dec/Hex char Enc [Uu]

1.0 J_WEEDS_H FULL: Dec/Hex char Enc [Hh]

1.0 J_WEEDS_C FULL: Dec/Hex char Enc [Cc]

1.0 J_WEEDS_W FULL: Dec/Hex char Enc [Ww]

1.0 J_WEEDS_V FULL: Dec/Hex char Enc [Vv]

1.0 J_WEEDS_N FULL: Dec/Hex char Enc [Nn]

1.0 J_WEEDS_Y FULL: Dec/Hex char Enc [Yy]

1.0 J_WEEDS_T FULL: Dec/Hex char Enc [Tt]

1.0 J_WEEDS_R FULL: Dec/Hex char Enc [Rr]

1.0 J_WEEDS_L FULL: Dec/Hex char Enc [Ll]

1.0 J_WEEDS_F FULL: Dec/Hex char Enc [Ff]

1.0 J_WEEDS_A FULL: Dec/Hex char Enc [Aa]

1.0 J_WEEDS_S FULL: Dec/Hex char Enc [Ss]

2.0 WINDOWS_7BITS Windows charset announced as 7 bit

2.0 VOWEL_URI_6 URI hostname with 6 consecutive vowels

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

Subject: {SPAM?} Update your tax details to avoid withholding tax



--===============6440781682195144814==

Content-Type: text/plain; charset=windows-1252

MIME-Version: 1.0

Content-Transfer-Encoding: 7bit



Hello sales,



We noticed that a few tax details on your account have expired or are

missing. If they are not updated, tax may be withheld from your

account at a higher rate.



Account: sales@nk.ca

Reference: 15569203

Details to review:

- Tax form (W-8BEN)

- Tax residency information



Update your details:

https://www.mxvisa.com/?email=sales@nk.ca&uid=GIOWYa2djZfQJWz8yMET1HQq



It only takes a minute or two - and it helps us apply the correct tax

rate to your account.



Warm regards,

The Wealthsimple team



---

This email was sent automatically to sales@nk.ca.

If this message was not meant for you, you can safely ignore it.



--===============6440781682195144814==

Content-Type: text/html; charset=utf-8

MIME-Version: 1.0

Content-Transfer-Encoding: 7bit















Update your tax details to avoid withholding tax































































































Wealthsimple


A note from Wealthsimple


Some of your tax
details are expiring


Hello sales,



We noticed that a few tax‌ details on your accoun‌t have expired or are missing. If they are not u‍pdated, tax may be withheld from your account​ at a higher rate.












Update your details




It only takes a minute o​r two - and it helps us apply the correct tax ra​te to your account.
























Account


sales@nk.ca


Reference


02619815


Details to review


Tax form (W-8BEN)
Tax residency informat​ion




Warm regards,



The Wealthsimple team




This email was sen‍t automatically to sale‍s@nk.ca.


If this message w‌as not meant for you, you​ can safely ignore it.







Help

 · 

Privacy

 · 

Terms



Copyright Wealthsimpl​e Technologies Inc. All‍ rights reserved.














--===============6440781682195144814==--

Business Broker spam from Google Gmail

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 01 Oct 2026 06:29:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.100.1 (FreeBSD))

(envelope-from )

id 1xCFtl-00000000PRS-24YX

for dave@doctor.nl2k.ab.ca;

Thu, 01 Oct 2026 06:28:29 -0600

Resent-From: The Doctor

Resent-Date: Thu, 1 Oct 2026 06:28:29 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-qk2-f11.google.com ([74.125.230.203]:57199)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.100.1 (FreeBSD))

(envelope-from )

id 1xCFkY-00000000EEw-05Jy

for sales@nk.ca;

Thu, 01 Oct 2026 06:18:34 -0600

Received: by mail-qk2-f11.google.com with SMTP id d75a77b69052e-530d1d9f3b1so41545501cf.0

for ; Thu, 01 Oct 2026 05:17:37 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=bankingtheadvisoryib.com; s=google; t=1790857050; x=1791461850; darn=nk.ca;

h=content-type:mime-version:date:content-transfer-encoding:subject:to

:from:message-id:from:to:cc:subject:date:message-id:reply-to

:content-type;

bh=Ro04742bgKkQYCQV33cZqk4Ig77lRLk4e7HJ/WAwLZo=;

b=a7RYAIAKp751zcF9T3zeAaTC5gvxJOE5wlABq2Pj4QmZa78Muh32bsXwcrUx74UadQ

exKso1vI+5ei5sG2YS34n/Pi6UvUFWFlGzmDtIgvSij4j1Gv8HE2WP2JvGPkAS9thbmB

466IPYDDodXm9JnaW6WFoVjNHOruIZmqoA8p6FglHjDKTX563kO5+JJmpSCzXDWZf9Id

kfi+lqu2IsM7TY7SEVemnzto6Y9RqQoR6hX4aLC/mJbrvw1s2zOrqz/EfjgGzWGMfxWB

UBaarzwlk9jB7Dhud64zQlGz5Nx87OdomzCQyN70cn27PFTqeyeblHU/MBWnzX6T/v5W

JoGg==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20260707; t=1790857050; x=1791461850;

h=content-type:mime-version:date:content-transfer-encoding:subject:to

:from:message-id:x-gm-gg:x-gm-message-state:from:to:cc:subject:date

:message-id:reply-to:content-type;

bh=Ro04742bgKkQYCQV33cZqk4Ig77lRLk4e7HJ/WAwLZo=;

b=DC3NSPm4uFcaNahaWQWA44DkUDOs5s6UduJMyPqYkTchGuo/eFwoTUoK4xe/bcs2bB

GYtfhKcY15Hg6SeBUvBCHHUmmubVaGLZUVdQQptoqEDLis1QBeoK2vd7YGjrEzZm1iN4

gSqA+j5TmCS/zhIQ0psgR1CiCFnD+sDwnhQcsubhhy8GtdWbgzu/gedv+l5jPYalS6J/

mS0u0XXOj235g3zONpFQBmCKVY8dSI44tuM7J+WMQ40XFU3E1wmd7i8v8+ZpJAzuv1ia

UC9Q0seq1VR5IYt35cIfuc2dsf5N5ZehQZPTnoWecWqLPzK9EpayY8CkYSGhILfsQy0v

KhlA==

X-Gm-Message-State: AFuF++mjriHfhJ/Oqrr/LsANnivYV8nBsQG2O08t9fFfADyg38juRNzs

C4o7p3rCYaxuduKxxnrEab48zEZm9vd8mLpvQ3mcQBavC/+AngKaEwaLEwc1HLpJ1XgiIWIV6Rz

ztasGjZGX

X-Gm-Gg: AYBFou04hD05dgMPHop4gz8YjadKI6ST9m/uPJCe6B5iGvnq9TqOVgDmy12bKz0Hw0g

z5Jbr8L0hG5qFXdx7o0SEwAt7YxVk+fVOgC+tOq83aDlIbCgzEelm3KMuMo/YfeRmauBvFBKmXe

W/lSSEBT+2VbFBD2XV/ti2yMiA/rFl24A3wWb/g5xQuQlHbhJWHIeYqe2+XPnoGX6q5tMX33KNG

sEBOk+SqrCP6OjYhKtza3pfrIUzar96G9LvKKf/0iGKCrX4Uf+5USeo1a2FjwxhmpDSHkgd636u

F0j8lO+GLDkCLp/2x9wMUwRQLdrrOUH402g5Tf5jy4DVN4FqUgxB+bh0ryPMSsQNJThs/OJWB1g

KnjTflAlEulVddLnq3Es+dZ0GoZUx+M2ph9ot+CqbK8UcIElg21VirhmBtKDuWHca+mSpnDTQVk

N8hM3UPrXMPxZXWJC16a0ShsRB99LfASWjAqlW6VLCoFY3yl19n8CoMHInjgGH7YIbop7cPHVe3

Xtxh6M2uYtKHYJEeal+zkbnF/UDnOQPAM8Dx3GqCPBwb0Hk0cKHBDpu6dfB0PRGq6zUjICfyUs4

KXHZVZ7Qec5FVSiaELgBwjR7nO+yMINN+feoADw=

X-Received: by 2002:a05:622a:8e:b0:52f:b9ad:9dad with SMTP id d75a77b69052e-533743167c1mr75489881cf.36.1790857050533;

Thu, 01 Oct 2026 05:17:30 -0700 (PDT)

Received: from 01a0f765-f722-7239-93dd-5c6b9ea9742d.local (ec2-54-147-115-11.compute-1.amazonaws.com. [54.147.115.11])

by smtp.gmail.com with ESMTPSA id d75a77b69052e-5338618bb43sm18598571cf.18.2026.10.01.05.17.29

for

(version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256);

Thu, 01 Oct 2026 05:17:30 -0700 (PDT)

Message-ID: <01a0f765-f722-7239-93dd-5c6b9ea9742d@bankingtheadvisoryib.com>

X-Mail-Abuse-Inquiries:

https://app.instantly.ai/privacy/report-abuse/01a0f765-f722-7239-93dd-5c6b9ea9742d

From: Oliver Bogner

To: sales@nk.ca

Subject: Netknow Internet Knowledge Purchase

Content-Transfer-Encoding: quoted-printable

Date: Thu, 01 Oct 2026 12:17:29 +0000

MIME-Version: 1.0

Content-Type: text/plain; charset=utf-8

X-Spam_score: 7.2

X-Spam_score_int: 72

X-Spam_bar: +++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Hello, Multiples in your sector have seen a significant increase

over the past few months. We just saw it firsthand - successfully sold a

firm akin to Netknow Internet Knowledge, and the acquirer is still lo [...]





Content analysis details: (7.2 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[54.147.115.11 listed in will-spam-for-food.eu.org]

[54.147.115.11 listed in will-spam-for-food.eu.org]

[54.147.115.11 listed in will-spam-for-food.eu.org]

[54.147.115.11 listed in will-spam-for-food.eu.org]

[54.147.115.11 listed in will-spam-for-food.eu.org]

[54.147.115.11 listed in will-spam-for-food.eu.org]

[54.147.115.11 listed in will-spam-for-food.eu.org]

[54.147.115.11 listed in will-spam-for-food.eu.org]

[74.125.230.203 listed in will-spam-for-food.eu.org]

[74.125.230.203 listed in will-spam-for-food.eu.org]

[74.125.230.203 listed in will-spam-for-food.eu.org]

[74.125.230.203 listed in will-spam-for-food.eu.org]

[74.125.230.203 listed in will-spam-for-food.eu.org]

[74.125.230.203 listed in will-spam-for-food.eu.org]

[74.125.230.203 listed in will-spam-for-food.eu.org]

[74.125.230.203 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[74.125.230.203 listed in dnsbl.ahbl.org]

[74.125.230.203 listed in dnsbl.ahbl.org]

[74.125.230.203 listed in dnsbl.ahbl.org]

[74.125.230.203 listed in dnsbl.ahbl.org]

[54.147.115.11 listed in dnsbl.ahbl.org]

[54.147.115.11 listed in dnsbl.ahbl.org]

[54.147.115.11 listed in dnsbl.ahbl.org]

[54.147.115.11 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[74.125.230.203 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[74.125.230.203 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[74.125.230.203 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[74.125.230.203 listed in dnsbl.ahbl.org]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[74.125.230.203 listed in list.dnswl.org]

-0.0 SPF_PASS SPF: sender matches SPF record

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

1.9 URIBL_JP_SURBL Contains an URL listed in the JP SURBL blocklist

[URI: bankingtheadvisoryib.com]

1.9 URIBL_ABUSE_SURBL Contains an URL listed in the ABUSE SURBL blocklist

[URI: bankingtheadvisoryib.com]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[74.125.230.203 listed in wl.mailspike.net]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[74.125.230.203 listed in bl.score.senderscore.com]

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

2.0 RATWR8_MESSID Message-ID with excessive dashes and dollars

Subject: {SPAM?} Netknow Internet Knowledge Purchase



Hello,



Multiples in your sector have seen a significant increase over the =

past few months. We just saw it firsthand - successfully sold a firm akin =

to Netknow Internet Knowledge, and the acquirer is still looking for =

additional opportunities.



We're happy to discuss our observations should =

it be helpful.



Oliver Bogner

Managing Partner | The Advisory Investment =

Bank

Q1 2026 #1 Lower Middle Market Investment Bank on Axial

5x Top 5 Lower Middle Market Investment Bank on Axial

2x Forbes 30 Under 30 Alumni | 2x Inc 5,000 CEO

Dutch language phish from Google Gmail

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 01 Oct 2026 04:24:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.100.1 (FreeBSD))

(envelope-from )

id 1xCDxE-000000004HQ-3PHp

for dave@doctor.nl2k.ab.ca;

Thu, 01 Oct 2026 04:23:56 -0600

Resent-From: The Doctor

Resent-Date: Thu, 1 Oct 2026 04:23:56 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-pl1-f199.google.com ([209.85.214.199]:58502)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.100.1 (FreeBSD))

(envelope-from )

id 1xCDgn-000000001XK-1Ops

for doctor@nk.ca;

Thu, 01 Oct 2026 04:06:33 -0600

Received: by mail-pl1-f199.google.com with SMTP id d9443c01a7336-2e305755a01so8994285ad.0

for ; Thu, 01 Oct 2026 03:05:37 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=pbacademic.com; s=google; t=1790849131; x=1791453931; darn=nk.ca;

h=content-type:to:from:subject:date:message-id:mime-version:from:to

:cc:subject:date:message-id:reply-to:content-type;

bh=inwo1LBlwVm+9v18qhuWGHzzJAV+fHhBCp4ZcSQ20XE=;

b=Ylkr5aGzuLZQFUWFdclGAqcL4ZpZew2GutEdJeGNosIY58QdJOGKOeWESw0Zmxsmqw

pjxOrKD0A6iFeleYu2F3Ei5oyvx8ZIUZohjQDkHWqZ8FSeS9g1WvfY3RXJr9poNPmVp3

Ql7WT/Zk1l+W2fX168A9EYoMBX1+AFjxO9CV7a6al+Y7F2JZqV69oKv3DHbRu7nCY/bc

FkbiJf95yOrlg9doTlcFitBfqkn2l7+bThSmuckguvto6JIReGT2zDNFb/3hGSJQP/ip

PHyY66bHB3nnYEPuxzNwQ8YPSAg28Y6v4zW8PIGeGYjCI9OYtHILDT1KB3mFr3bVb8K/

tQIw==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20260707; t=1790849131; x=1791453931;

h=content-type:to:from:subject:date:message-id:mime-version

:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to

:content-type;

bh=inwo1LBlwVm+9v18qhuWGHzzJAV+fHhBCp4ZcSQ20XE=;

b=1ChPPTGKS6zGZwRMjvYK1ujimg0o65559OtCbL5wgc+bwLe0KO82sKa6X8en4rKBVQ

u9Hq2DOYrfo8U1+h82OM1YKYqDq5ek4lUHUZy7/lytHoWmU12Z+X5efqPFp/LQt0yFK0

/eFI5ShRyaiJL0QB2I6sKfiV2NiOfzGszRjRCtl42Zka1JNqkUuHqHr67m37cnONgFrJ

YxbTwtMIBhdHI6d8KFX8ongwajdhVWaDjLeJDiY8pco2V9Rdd0wOjBkyyXPV23/9mmXj

vbJBB8gU9fszmIpxXP/ffH6zzCVcjKWQ9fAJMcIz2WOuWGI51sFh6yDDeU3+qGfbrhum

RHsg==

X-Gm-Message-State: AFq9FYLDDOcD7KeHvj5PyLWR9dF3zQPM4/DHE0LjwftlrYgGAkM+zOTL

pOOEb2vB9M6y5zyn644xtnBzEk+LEH8pFublLuPtvG6w60Cvfd8TTmDY+Og/5wpf9N+F68ncUmd

JKaj06bae/OCHqmOUgRmtyg3I

MIME-Version: 1.0

X-Received: by 2002:a17:902:c411:b0:2df:a972:e48c with SMTP id

d9443c01a7336-2e2e4bab313mr31747995ad.55.1790849131477; Thu, 01 Oct 2026

03:05:31 -0700 (PDT)

Message-ID:

Date: Thu, 01 Oct 2026 10:05:31 +0000

Subject: =?UTF-8?Q?Uw_postcode_valt_nog_binnen_het_beschikbare_gebied_?=

=?UTF-8?Q?=E2=80=94_check_snel?=

From: Gemeente Energieloket

To: doctor@nk.ca

Content-Type: multipart/alternative; boundary="000000000000541ab3065cc48e91"

X-Spam_score: 9.8

X-Spam_score_int: 98

X-Spam_bar: +++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Landelijk Energieopslag Loket — Gemeentes Beschikbaarheidsmelding

Uw gemeente biedt thuisbatterijen aan via een gezamenlijke inkoopregeling.

Uw postcode staat nog op de lijst.



Content analysis details: (9.8 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[209.85.214.199 listed in will-spam-for-food.eu.org]

[209.85.214.199 listed in will-spam-for-food.eu.org]

[209.85.214.199 listed in will-spam-for-food.eu.org]

[209.85.214.199 listed in will-spam-for-food.eu.org]

[209.85.214.199 listed in will-spam-for-food.eu.org]

[209.85.214.199 listed in will-spam-for-food.eu.org]

[209.85.214.199 listed in will-spam-for-food.eu.org]

[209.85.214.199 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[209.85.214.199 listed in dnsbl.ahbl.org]

[209.85.214.199 listed in dnsbl.ahbl.org]

[209.85.214.199 listed in dnsbl.ahbl.org]

[209.85.214.199 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[209.85.214.199 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[209.85.214.199 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[209.85.214.199 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[209.85.214.199 listed in dnsbl.ahbl.org]

2.5 URIBL_DBL_SPAM Contains a spam URL listed in the DBL blocklist

[URI: silvergrid.info]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[209.85.214.199 listed in list.dnswl.org]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

1.9 URIBL_JP_SURBL Contains an URL listed in the JP SURBL blocklist

[URI: pbacademic.com]

1.9 URIBL_ABUSE_SURBL Contains an URL listed in the ABUSE SURBL blocklist

[URI: pbacademic.com]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-0.0 SPF_PASS SPF: sender matches SPF record

0.1 TW_IK BODY: Odd Letter Triples with IK

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[209.85.214.199 listed in bl.score.senderscore.com]

-0.0 RCVD_IN_MSPIKE_H3 RBL: Good reputation (+3)

[209.85.214.199 listed in wl.mailspike.net]

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 HTML_MESSAGE BODY: HTML included in message

2.0 RATWR8_MESSID Message-ID with excessive dashes and dollars

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

-0.0 RCVD_IN_MSPIKE_WL Mailspike good senders

Subject: {SPAM?} =?UTF-8?Q?Uw_postcode_valt_nog_binnen_het_beschikbare_gebied_?=

=?UTF-8?Q?=E2=80=94_check_snel?=



--000000000000541ab3065cc48e91

Content-Type: text/plain; charset="UTF-8"; format=flowed; delsp=yes

Content-Transfer-Encoding: base64



TGFuZGVsaWprIEVuZXJnaWVvcHNsYWcgTG9rZXQg4oCUIEdlbWVlbnRlcw0KDQoNCg0KQmVzY2hp

a2JhYXJoZWlkc21lbGRpbmcNCg0KVXcgZ2VtZWVudGUgYmllZHQgdGh1aXNiYXR0ZXJpamVuIGFh

biB2aWEgZWVuIGdlemFtZW5saWprZSBpbmtvb3ByZWdlbGluZy4gIA0KVXcgcG9zdGNvZGUgc3Rh

YXQgbm9nIG9wIGRlIGxpanN0Lg0KDQpWaWEgZGUgZ2VtZWVudGVsaWprZSBlbmVyZ2llb3BzbGFn

LXJlZ2VsaW5nIGt1bm5lbiB3b25pbmdlaWdlbmFyZW4gbWV0ICANCnpvbm5lcGFuZWxlbiBlZW4g

dGh1aXNiYXR0ZXJpaiBpbnN0YWxsZXJlbiDigJQgem9uZGVyIGFhbnNjaGFma29zdGVuLiBEZSAg

DQpnZW1lZW50ZSBjb8O2cmRpbmVlcnQgZGUgaW5rb29wIGVuIHN1YnNpZGllYWFudnJhYWcgdm9v

ciB1Lg0KDQpQbGFhdHNlbiB3b3JkZW4gcGVyIHdpamsgdG9lZ2V3ZXplbi4gWm9kcmEgZGUgd2lq

ayB2b2wgaXMsIHNsdWl0IGRlICANCmluc2NocmlqdmluZy4gQ29udHJvbGVlciBudSBvZiB1dyBh

ZHJlcyBub2cgYmVzY2hpa2JhYXIgaXMuDQoNCkdyYXRpcyBjaGVjayDigJQgZ2VlbiB2ZXJwbGlj

aHRpbmdlbi4NCg0KDQpDb250cm9sZWVyIHV3IHBvc3Rjb2RlIOKGkg0KDQoNCg0KDQoNClZpYSBk

ZSBnZW1lZW50ZS1yZWdlbGluZzoNCg0K4pyTIFRodWlzYmF0dGVyaWogem9uZGVyIGFhbnNjaGFm

a29zdGVuDQoNCuKckyBTdWJzaWRpZWFhbnZyYWFnIHdvcmR0IHZvb3IgdSBnZXJlZ2VsZA0KDQri

nJMgSW5zdGFsbGF0aWUgZG9vciBnZWNlcnRpZmljZWVyZCBpbnN0YWxsYXRldXINCg0K4pyTIEJl

c2NoaWtiYWFyIHZvb3Igd29uaW5nZWlnZW5hcmVuIG1ldCB6b25uZXBhbmVsZW4NCg0KDQoNCg0K

DQpMYW5kZWxpamsgRW5lcmdpZW9wc2xhZyBMb2tldCBmYWNpbGl0ZWVydCB0b2VnYW5nIHRvdCBn

ZW1lZW50ZWxpamtlICANCnJlZ2VsaW5nZW4uIEJlc2NoaWtiYWFyaGVpZCBwZXIgcG9zdGNvZGUg

a2FuIHZhcmnDq3Jlbi4gQWZtZWxkZW4/IEtsaWsgaGllci4NCg0KDQoNCg0K

--000000000000541ab3065cc48e91

Content-Type: text/html; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable




content=3D"width=3Ddevice-width,initial-scale=3D1">
rgin:0;padding:0;background:#f0f3f0;font-family:Arial,sans-serif">


center" style=3D"padding:24px 16px">


:600px;background:#fff;border-radius:6px;overflow:hidden">

<=

/tr>








;color:#fff;font-size:13px;font-weight:bold;letter-spacing:1.5px;text-trans=

form:uppercase">Landelijk Energieopslag Loket =E2=80=94 Gemeentes



text-transform:uppercase;letter-spacing:.8px">Beschikbaarheidsmelding




;line-height:1.35">Uw gemeente biedt thuisbatterijen aan via een gezamenlij=

ke inkoopregeling. Uw postcode staat nog op de lijst.



V=

ia de gemeentelijke energieopslag-regeling kunnen woningeigenaren met zonne=

panelen een thuisbatterij installeren =E2=80=94 zonder aanschafkost=

en. De gemeente co=C3=B6rdineert de inkoop en subsidieaanvraag voo=

r u.



P=

laatsen worden per wijk toegewezen. Zodra de wijk vol is, sluit de inschrij=

ving. Controleer nu of uw adres nog beschikbaar is.



G=

ratis check =E2=80=94 geen verplichtingen.




e5e2e;border-radius:4px">
da522d839" style=3D"display:block;padding:15px 34px;color:#fff;font-size:15=

px;font-weight:bold;text-decoration:none">Controleer uw postcode →=






ound:#f3f8f3;border:1px solid #b0d4b0;border-radius:4px">

adding:18px 22px">


2e">Via de gemeente-regeling:



=

=E2=9C=93 Thuisbatterij zonder aanschafkosten



=

=E2=9C=93 Subsidieaanvraag wordt voor u geregeld



=

=E2=9C=93 Installatie door gecertificeerd installateur



=E2=9C=

=93 Beschikbaar voor woningeigenaren met zonnepanelen






#eee">

Landelijk=

Energieopslag Loket faciliteert toegang tot gemeentelijke regelingen. Besc=

hikbaarheid per postcode kan vari=C3=ABren. Afmelden?
lvergrid.info/t/c/93afd96bf9bda522d839" style=3D"color:#bbb">Klik hier.=






eight=3D"1" alt=3D"">

--000000000000541ab3065cc48e91--

Web/SEo/App spam from Microsoft Outlook

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 01 Oct 2026 04:24:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.100.1 (FreeBSD))

(envelope-from )

id 1xCDx1-000000004G9-1qqB

for dave@doctor.nl2k.ab.ca;

Thu, 01 Oct 2026 04:23:43 -0600

Resent-From: The Doctor

Resent-Date: Thu, 1 Oct 2026 04:23:43 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-japaneastazolkn19013078.outbound.protection.outlook.com ([52.103.43.78]:42285 helo=TYDPR03CU002.outbound.protection.outlook.com)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.100.1 (FreeBSD))

(envelope-from )

id 1xCDbO-000000000yu-2BLm

for sales@nk.ca;

Thu, 01 Oct 2026 04:01:01 -0600

ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none;

b=uHkO19IaL2ayMEgDNQu4OFGsXFerfi90V0TobDW3WytVXh9+KGVxXkRDlDh62dOdNUIb3PVMa/Yj/p60VhCrtrDpzz3+G00+4Gtt+EofahEy+gV4d2l6E7eTcrHlgvYiDX4QHTybG9OA2h5KK2uj0oqp4K2g7m81sT09bgrmdwD0p7QSnI4ik2acZkiA0eG7HZ193bFwbEPoHYpCRWbYSW2OiczUxBl0eqvp/k2uZPkKgiUknSQ/kGbc4yLL5fiXD5OIL8VFLIdGgZrsVtllvmcENGUMcs6zbeYJwekuexonayyPkgO+Nh4PTR9Bjd+hd8jg/nb6kIWXhfhXSik/Nw==

ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;

s=arcselector10001;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1;

bh=P21OMA5lhVwncMI6Z3IYe9Uu4PSWKcomDzK13TmFeok=;

b=x/Y+JhcTka8+qYUY8j9R4YaCuMeO+bLc/DV7PLtKw2vADESY8AKYpjSNR5PC63TsjWNgSEPDbZVH2vwD4oSDOtWP5/vrA0gGpcq4MZPcuAV+II7SObKHdqQKFh5lN0X6z3K4lrONGSW3h1dGtE7L0AMiA9OWnzfZztGUYTXx+ImpUTHEz6yhtHJ30lHBDUKE9YB4/EedZtZlPTquA4zSrQPJpKG9r0bRlGmi3ZWXzQdmWGBVc0eH2rsAQ/FQPi4JB4l1crjxdt1cyZ4XTp+/stP/PLS/mxkWuItCxtnwcrNZW9hA0qTHmEP8+uN2pCXC84FzSoxQWIlALfZ5QxpkrA==

ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=none; dmarc=none;

dkim=none; arc=none

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=hotmail.com;

s=selector1;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck;

bh=P21OMA5lhVwncMI6Z3IYe9Uu4PSWKcomDzK13TmFeok=;

b=bmmGsEfbcg9Ipp4QLmTPyM8lx9jGes1G8gjuQ2IgxkZE6U+ETGRpGVNgZZZk8FKWJtEWtwq2gbhsPl06hY+AI1ch1zwxBwBp2fb4iPyRyqIaepEjCp3SdFNTaRqLWJSQeei1+6Th9gZF5J9srThYVwKgLNcGehWBUfaUouc1CAPkil5R9VYlHdO5ghy0R/JYBwiHEOxDDEIv+J76phjGZpFzMa/tHDcqoMz7vwulbbfiogzOL1F4RLWXRPI0fUWWi6i6osGX/xwO9Q2+/Ni/R9iqkN8r3hKxhHbP5Xki2evmjF745VJgLEToWKoXsDJQGTPtxjQRtqumVczCpD8paQ==

Received: from TYZPR03MB5937.apcprd03.prod.outlook.com (2603:1096:400:124::12)

by SI4PR03MB9889.apcprd03.prod.outlook.com (2603:1096:4:298::24) with

Microsoft SMTP Server (version=TLS1_2,

cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.451.24; Thu, 1 Oct

2026 09:59:13 +0000

Received: from TYZPR03MB5937.apcprd03.prod.outlook.com

([fe80::befd:12ab:7a8c:682c]) by TYZPR03MB5937.apcprd03.prod.outlook.com

([fe80::befd:12ab:7a8c:682c%4]) with mapi id 15.21.0451.026; Thu, 1 Oct 2026

09:59:13 +0000

From: Michael Smith

To: Michael Smith

Subject: =?utf-8?B?UmU6IEFmZm9yZGFibGUgbG9jYWwgU0VPIPCfmqg=?=

Thread-Topic: =?utf-8?B?QWZmb3JkYWJsZSBsb2NhbCBTRU8g8J+aqA==?=

Thread-Index: AQHdTkgHwPMls8zR6E+eEao8b6CWr7bh9bsKgAaC29uAAAFAzw==

Date: Thu, 1 Oct 2026 09:59:12 +0000

Message-ID:



References:







In-Reply-To:



Accept-Language: en-US

Content-Language: en-US

X-MS-Has-Attach:

X-MS-TNEF-Correlator:

msip_labels:

x-ms-publictraffictype: Email

x-ms-traffictypediagnostic: TYZPR03MB5937:EE_|SI4PR03MB9889:EE_

x-ms-office365-filtering-correlation-id: 0b1079a7-f4cd-47dc-444d-08df1fa2a541

x-microsoft-antispam:

BCL:0;ARA:14566002|8062599012|31061999003|19110799012|48001999003|8060799015|51005399006|24021099003|16051099003|55001999006|24121999003|15080799012|15030799006|37011999003|22091999003|25010399006|2604032031799003|704163111799003|102099032|440099028|3412199025|40105399003|2607281247196008|260806224601699006|26121999007|17111999006|1710799026;

x-microsoft-antispam-message-info:

=?utf-8?B?cDFxWUlzNTd2QjM1ZEdURjBoU1BNeU9qSHpaTXhEK2w4c242UEQ3WTRTc25k?=

=?utf-8?B?OGZ4WGhmWlNyV2lWMUJCdkNuQjdsQ0JDd2FyMnBLcndaTDR2bXJBRDBVZGM4?=

=?utf-8?B?NFJkSEZxUGttV1FsVElDTmVkVEJwZUJqa3ZyQVBvU2dnWUhvTk5rb2FtVHVB?=

=?utf-8?B?Um5UbzQzZ0dKKzdVNnVvSHVpREs2NEJ3a2RqVW5SUFovaDdDMzBsWEt2Ung1?=

=?utf-8?B?UEVqWm1GalJCdG1TbFB0bUpSWExwUjdLZjZtRWxsd3VRUm1QaXhlZUJOcHdD?=

=?utf-8?B?TVdtNTl6dWJkcjZObCtZUDhZT1JkVWhpT3VhRkJsamhrVXdKZnJWd3kveWlV?=

=?utf-8?B?aC9jRVQyN2NlSWtlcTFRNmhXUEU1c3VqelRBZXFYT2U3a2pvclRoMEY3UWFa?=

=?utf-8?B?a1NlRHlBZzU1U2F3a3ViUm00VnlESFpCNWtKL2R4aUJWdkt6NDR0RVpJL2tQ?=

=?utf-8?B?ZVpTaURiT0JMTk0yMW83ZW9pQlc4WHB3bTdCUmpYTzhKNjlCS3ZZL2srbytu?=

=?utf-8?B?dlg0cmhtWlJaaVh1L1RLb1ZzZTJObytmZTBJM2FVWkFaMTBkL0ZzSmpzVDdV?=

=?utf-8?B?Ymk0VkdPNGN1WHNzUFE1WFBEWEgzbGMxNSthTDc1VHRtMUlHSTA5TVR4cTNn?=

=?utf-8?B?RG1KNVZDZ21Bc1FiK0tIYVA5MXEyQWRmdXN3T01OYjVZVkZVNEszY3l4TDRK?=

=?utf-8?B?N2VsNGV0a3N4MjF1RGFOYjJoQU5EZWo3cnE0aE5RNXpRTkJiVVRhNHNCOURI?=

=?utf-8?B?STZ5akNDellodUFvRE9GK1RlWmttcDRYdVFwbXJXRTNKMEpBOUdsS3B5bTll?=

=?utf-8?B?cm5DN3VsaHlsSlJVZ2Vwbms0TVR0OE9xeVpnWEJMcFVBb055d0EwRDJHVU1V?=

=?utf-8?B?dEErQkYwVFZIUWlGSHB0VEdia0IxZ0lCMXZzQks0R0FhRjlZNk1JKzlvclRp?=

=?utf-8?B?WVRlVE1Ld3N4aXVvcys4MFAyalVtNUhjNDJzTml6cTVFVFFRWXUxMkpmNHdO?=

=?utf-8?B?MkN2YnJYdkxLODIvYSthRVNVU1JYcTBqelRRNEdIa1BSYkJlM2FKYUNNMnhi?=

=?utf-8?B?QkFHQmFOZ1dEVElkYS95MDhtSG1QUWJoUlRBM0xJaE1NYnE5V3E2UFRGU01B?=

=?utf-8?B?MmFjOC9SUXlZbW5aMjZyZjE0ekwyMnBGa0NwK2NYQkh6emw0U08vQzh2amVs?=

=?utf-8?B?SWM2VFZyY0xLTUNBcXVnaEltaVNWTW4vc3hSNDMyd0JleUk2Zk9MdHdoR2RJ?=

=?utf-8?B?dU9SMmQxdnhFQlJJYkxpcXdlV2t0YnUvcGQ2UDVnek9mUHJQVDhpY2ljdUZQ?=

=?utf-8?B?N0RKb1I5bHFScDA4anZqYUZwcGhQNHpxNUhFZUoxb0VmTGwzTjJ3M1JMekxR?=

=?utf-8?B?TmJVM1QvenRYTlFvcUJkUm5VTHpEbmFreXBSU25UTkRNeVpuTVBab09LWUpC?=

=?utf-8?B?Y3VMaUh5VmpFRHJMcXhmMEgzK2wwelpVdjNCYWVSM015ODBhc2MzOGpnR3F2?=

=?utf-8?B?SE1EMGU1VzFkMXI0djV0QUFBc2VZMTRQTk5tdDduOFM4T0QyZXl5N2s3ZHc3?=

=?utf-8?B?TjNmQUl5TzQyNXMxam5OSXVHUEg4VUdPN1JNak83bXNSNHRwYzV6S3V3bGRT?=

=?utf-8?B?bDJRRFI1VEQ4V0s5STJLVW1vbjI2QUpZU0VnMitBT2t2bUpjeWRDc0N3WThu?=

=?utf-8?B?ZEp4a0xtQjU0UThaNThWS0NNdEdPbFd6SUxHdXNDOFp5Um1mVG5XRDFxdmZl?=

=?utf-8?B?M2RJWFNaREhkNnBXZ0hhOVlXeFp0WVlhWDlmMlRMWkVHeWtPR0VXVnJ5WE1v?=

=?utf-8?B?a1hybFRlZkNQMEJic055bERvN3FkdnNnYTlLaFNRSklsY1BIWE04bEZ6ZWZX?=

=?utf-8?Q?lxVqXnr0PB09V?=

x-ms-exchange-antispam-messagedata-chunkcount: 1

x-ms-exchange-antispam-messagedata-0:

=?utf-8?B?NGtrTlg0QWJ6OElyUzQ1d0dWNnV5WStialhHblhnRVkvL1MyOWNxYlRYTWhI?=

=?utf-8?B?V1pabHI4S0NUYnpIYStuSHpEczRHazVWS3ZIbStlUGgyZCsxc0ViRjZlcmtW?=

=?utf-8?B?RnRZWWlZVWFsVmJQelBGOTNKbHJqQXNoVXN6WmdUcUdoU0p3ZUs3SFFPclVP?=

=?utf-8?B?ek5jZXNwYWwvNjdqK0xOV3oralY2dnFCcTJKOHpoUkc2WDhpU0c5RlRLQWJq?=

=?utf-8?B?cVdSajJIOHcvOFdFMHJwek1yU1hDT1RoWTZXQ3J3OXl2VThxRVd3SWlhSm5N?=

=?utf-8?B?TWJNczl6NitENVAvbkZFaHY2MGNEbGJHcWhBTkhwQnZGMTlKdXMvVUhTeTBo?=

=?utf-8?B?L2RpVU5ZbStKRDFJQ1lTZEFsazB0VU5qR3NtTWd3WDEyckZTU2ZaUlovVkhP?=

=?utf-8?B?YkVnRFR5TVlxYXpsTXBjV1lLNFp6a0NxU1dVbFJWTjRGMUZtODY4Qkh0R1VS?=

=?utf-8?B?K2wvOUp1SDVHS21DYVozbUtTT09IRXhnUTkvVVFkN3MyR0pYYmNOSGZWZ0kr?=

=?utf-8?B?SnZ3eFhVU054S0YvUXI0ajRtamNsSWtpUzhuVmpkWnR0OUlQZnNHeGlvamNq?=

=?utf-8?B?UVh1TWRhMTRUbFN0ekZGdFNJNHhnTTM3SllXbTNNMm54elVObExrYk9LaFEr?=

=?utf-8?B?bUxaOHdkSTh2WEtWVFRCQnZBRUVlUUwzNktLa1FjbFlTaHVVdERiVHk0UDZN?=

=?utf-8?B?WWVGdXJDU1lVOEU5VTdWcWdyTGsxcDNVaC9wbnUzWXp2Q1pvbFArMGhPUnNY?=

=?utf-8?B?TUFpQisyVzVLdnRneVhFR0YwdFJQa1lCYjJESUY1Z0x6ZjcwUGhEZVpWbDRr?=

=?utf-8?B?M1RjQk9WUTZncVM4WDhNNUhrVHpsWjBVZTdmN3Q4am1BR2lGSzcrQW53WlpK?=

=?utf-8?B?M2ZwOGREamY1aFVvaW1ZdmRvZGF5ekJJdzNSTThnOXQ5T1IzQ2lub01ZbGgr?=

=?utf-8?B?M1pXbmNJc2NmRlJZdUthS2gvS0JSREhybG8zc1hiV0YzMS9MQzdDaVIvcnFP?=

=?utf-8?B?VUQwcnlrYXB3R2xodXBCSExRUmxlZ1VuNS81VC82OEVLcUdXRU1YNjlGVE1G?=

=?utf-8?B?N2pYNnErY2Jjd3FTTi9HakcyRGlLUHg4d0x2cTJoVUZ1c1NSYTd6ZnRHU2VJ?=

=?utf-8?B?K05tSVlJMHdQZjY1QktINFowa1RhTmlwZVJKREJGYjdpaDNvU3UxZTNlRFBi?=

=?utf-8?B?akR4eDVsWXJqaWxJRzhBSXREak9WRHdiRkRvWjZCdTBLTkhUSjB6VUVZVjhn?=

=?utf-8?B?K0JTbWROZG8ra1Z4Nm9ZRmNyZ1QzR1lRQlV6ZGlUbndWQmdwTjBIbnpTOUFL?=

=?utf-8?B?bHhJWG8zVUphWGpOUnovUXBwN1RHNFhoN1ZiRHVXS3NKSmUrZXJ3NmIrNGJl?=

=?utf-8?B?b0xZV2pIUDJRQ1RONzFQMDZRSDBpcDZnQ3k2VHFNdDRuWXFZL3RWcHVvQ2RU?=

=?utf-8?B?Q08zQ1dHazhBT0EyNnhGT3ErRU9GbmFTY3dIWUV1TU9KZUVTVnZ0Sk5WMjM3?=

=?utf-8?B?MFBHeE84NVNmdS9ibUhuTWlVaXpxVnArOEpuRng1c1YvR1JlTzVVVXRna0Y3?=

=?utf-8?B?djgxRlgvd2c5bTJBVStDWWVNMjZrb2UwaVIvMkxoMWZoVXNyc2N5elhpTDVz?=

=?utf-8?B?M2V0TU1VTmdtSVdBMXFDYXB2dUVDTG9kZnN3ZzNibjFWSTM2WHgrNDJXWmdU?=

=?utf-8?B?aW8zMlAyUUF4OUZHb3hIRDN0eHNvZHdnMEN0YUFwbzdkQkxESDlkSHZ4ckFW?=

=?utf-8?B?WGxtalZuOFVtdE5UZHlqcUlkYkVnaGpEd0gwVitMQUZ5ODlEcTZjaEd3TERk?=

=?utf-8?B?TzZERU05SXE2bWtzNTE0UzNUckpHRjBpaVRlRmY0RDhIWnBaTVRVSzkxZlYx?=

=?utf-8?Q?uFa7RuWB02kXV?=

Content-Type: multipart/alternative;

boundary="_000_TYZPR03MB593730864250049F1E79B902AA8A2TYZPR03MB5937apcp_"

MIME-Version: 1.0

X-OriginatorOrg: sct-15-20-9343-9-msonline-outlook-fac1c.templateTenant

X-MS-Exchange-CrossTenant-AuthAs: Internal

X-MS-Exchange-CrossTenant-AuthSource: TYZPR03MB5937.apcprd03.prod.outlook.com

X-MS-Exchange-CrossTenant-RMS-PersistedConsumerOrg: 00000000-0000-0000-0000-000000000000

X-MS-Exchange-CrossTenant-Network-Message-Id: 0b1079a7-f4cd-47dc-444d-08df1fa2a541

X-MS-Exchange-CrossTenant-originalarrivaltime: 01 Oct 2026 09:59:12.7164

(UTC)

X-MS-Exchange-CrossTenant-fromentityheader: Hosted

X-MS-Exchange-CrossTenant-id: 84df9e7f-e9f6-40af-b435-aaaaaaaaaaaa

X-MS-Exchange-CrossTenant-rms-persistedconsumerorg: 00000000-0000-0000-0000-000000000000

X-MS-Exchange-Transport-CrossTenantHeadersStamped: SI4PR03MB9889



Hi,



Following up on my previous email. Interested in improving your Google rankings?



Reply for our SEO packages and pricing.



Thanks!



From: Michael Smith

Sent: Sunday, September 27, 2026 6:27 AM

To: Michael Smith

Subject: Re: Affordable local SEO 🚨



Hi,



I found your details on Google. and I have looked at your website.



I can help bring your website to the first page of Google.

    

If you were on page #1, you'd get so many new customers every day.



May I send you a proposal and price?





Thanks,

Web/SEo/App spam from Microsoft outlook

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 01 Oct 2026 04:22:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.100.1 (FreeBSD))

(envelope-from )

id 1xCDuo-000000003m9-21Xn

for dave@doctor.nl2k.ab.ca;

Thu, 01 Oct 2026 04:21:26 -0600

Resent-From: The Doctor

Resent-Date: Thu, 1 Oct 2026 04:21:26 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-koreacentralazolkn19013085.outbound.protection.outlook.com ([52.103.74.85]:42410 helo=SEYPR02CU001.outbound.protection.outlook.com)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.100.1 (FreeBSD))

(envelope-from )

id 1xCAn2-00000000PAU-0J3q

for sales@nk.ca;

Thu, 01 Oct 2026 01:00:51 -0600

ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none;

b=tnpJiS7G4tUDsOWX+QxBTuY+Pax18hj3XVgRVfsoIEuDboXgjyXkZs0mMYqIOgjo0yq+T6p79C55H3U+y+nmP8Z4DFxcYbrJU5IHIZqeyMfTPKafGEL6y7ff77VOb5FbFKBQg/grJim1x3XRTFoQPbYz17xoLmit8zISwlMT3CFqo19jEj5ACjijsb/uOcVwvosRrL6A3srCcy2/1f67rbLZ0ThtT2MhaD3KrqghXkZiWzxeFp0ALXiKa2PaZVLbgCNycPcGGezhRGikaMKkU3JStFFfPqxEBm/wel2HYBxU59OMYEsFJSVkd8VdZvWa3IodNw3K0vAx8MgvImDxsQ==

ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;

s=arcselector10001;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1;

bh=Zy8npBaD2o3uUkFW102P9lYK81PvVTZAxujx78/omY4=;

b=DgyENGx/+EtxwiYB9doosjoS1S7Dlb/AyjjkBMFuk3c8MipYSiA+cYfHe+sb/7GCIrqJjyEvcmcHONIkYRjAi+GxNDoAeyc1C3HXtPHBEKdcLL3qxZcTyDLC8qXUNhbDmEdifGwixwNsGqbuDfHQVzjlJzDTqoUOyMJ+zXAHtYlsVK+f4JDwO2Vl+3ZA1fWVa2xRbnnXcExSzDua0p3ra+eYix8RjmPZiP1fK/CqfBXijYfWMtWFBmjrNG3S/Jnkuyj8fhztXqJBmtyYe9xFRJ69MBO3XMGaTGPXl6bgtfdI3SyDGRzPDBC3JbC6pUQ/r37HFyAA5MgFh3bf3kOfBw==

ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=none; dmarc=none;

dkim=none; arc=none

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=hotmail.com;

s=selector1;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck;

bh=Zy8npBaD2o3uUkFW102P9lYK81PvVTZAxujx78/omY4=;

b=D8VkZKQm+lWhKeV6xJRvdYhGbb9FaQ0jklN/rKcYlpBr4FISLN0BfTPzwBCuWNnNK/cy0wlBm3T+/PrX9dVqp8WOFYnkezQwwXOsCc5kaxLAk/MiOowntE9Z/XCCZvBheZEJYV44PawkmAzGMOVuDXDi+XAB4opdTd8rGUcwS+u8XjXNBSK9MfM3DTr+K3dFpq/rcORlO0nQwl/T6PhYtZVo/lBT+7u70NA/GEewSP1jfu1SspIeLPLR/h+qLy/sqE1a8qPLta4eVhmsCpWlov26rV46a1kEPr8VQCrKTOwFpKFJ7sGvghdd53hCfMPDppODToZmOp7zLvaC3vkhTw==

Received: from KU4PR04MB9367.apcprd04.prod.outlook.com (2603:1096:d10:7b::16)

by KUXPR04MB9467.apcprd04.prod.outlook.com (2603:1096:d10:9d::13) with

Microsoft SMTP Server (version=TLS1_2,

cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.472.15; Thu, 1 Oct

2026 06:58:08 +0000

Received: from KU4PR04MB9367.apcprd04.prod.outlook.com

([fe80::d58c:667b:8e06:1861]) by KU4PR04MB9367.apcprd04.prod.outlook.com

([fe80::d58c:667b:8e06:1861%6]) with mapi id 15.21.0472.015; Thu, 1 Oct 2026

06:58:08 +0000

From: Arushi web

Subject: SEO & AI Services

Thread-Topic: SEO & AI Services

Thread-Index: AQHdUXHsZcq9rTlE+kiTElQh3cIMFQ==

Date: Thu, 1 Oct 2026 06:58:08 +0000

Message-ID:



Accept-Language: en-US

Content-Language: en-US

X-MS-Has-Attach:

X-MS-TNEF-Correlator:

msip_labels:

x-ms-publictraffictype: Email

x-ms-traffictypediagnostic: KU4PR04MB9367:EE_|KUXPR04MB9467:EE_

x-ms-office365-filtering-correlation-id: 3a28ef26-25aa-4b89-fbec-08df1f89598d

x-microsoft-antispam:

BCL:0;ARA:14566002|37011999003|24121999003|22091999003|55001999006|24021099003|39105399006|15030799006|15080799012|24071999003|7071999006|4140399003|25010399006|15001099006|20031999006|2604032031799003|8060799015|8062599012|19110799012|31061999003|2607281247196008|3412199025|440099028|102099032|260806224601699006|41105399003|39145399003|12091999003|40105399003;

x-microsoft-antispam-message-info:

=?Windows-1252?Q?wwlCCz39/C4NWWnQUJ7aV+moMtdkR04zwmu43Uryd1PtGJq+Yix4IifR?=

=?Windows-1252?Q?GtwJSJZl4Lco+y01wLBhLjhe5CDfigdLtljzSSzPBxWnN677TruksWmt?=

=?Windows-1252?Q?thnEfm3jBTTFsyYJT4uN+utcDB01SuWoBa7RT0Hm5I7JY6G0vRjcDeyJ?=

=?Windows-1252?Q?vw+JXU0QR610xYG+2lYqmGUdMmPTscLpbhPmMyc0IbcdWKsOsWpMIWzN?=

=?Windows-1252?Q?zLjRKed3e5GS8xvub14zIjG7ac3bcDhArVxWy2n13kHAEw1bxt2IV4oV?=

=?Windows-1252?Q?VORoGDESHr8AlOdoE8m4x3sRNrZmuAbsLAZenjxpSL9hT3MF/IPBjqST?=

=?Windows-1252?Q?tuAkmehyJCWLr7cw7mFw57XckyYevm9HwMTdrrehIWWgotqORZJPN1bE?=

=?Windows-1252?Q?R+b/8pHGalx2Cl4E24Sg9ix7QzD2lxtt6ZuDfydyOQeImfgPHiJjQYAr?=

=?Windows-1252?Q?wBTK0gLQorrreJlFWVSHKZXptbRH3K1u3mIS9WaJvdeffogIs+duoq26?=

=?Windows-1252?Q?5Xz6NtZFEMq41svjQZ8fjUkFC1LmVJNQ1V5IN2b+YrBYhB0ZH3pIXF+t?=

=?Windows-1252?Q?Su9nmeTfRDUzsU6NpsGofRoDFUAJAZGa7rEejSLd5R9GI6hloUohnqzA?=

=?Windows-1252?Q?+8bltrcLgKASyd/JTq/+LDlqpaWHK+6K3lxdJU6hhf72WWwAieWMtq5p?=

=?Windows-1252?Q?aDQzaRLbw8bbWcN5+qW3NcVjSoGYqaxb8EeYKDxdlv9I5/7HpjXtAzB6?=

=?Windows-1252?Q?Y0MZJcd+c7ng1/WdrBaxNeqvLniv2vOzOl0wvWWrvz2eUhuQEALgcd4G?=

=?Windows-1252?Q?DM9IjZaySIpNBjzRHWW84PKUUbFkQNf5FUK3MI6GkxPAoHe+byyvFxcX?=

=?Windows-1252?Q?7uDXQr8tSOgDARBAItempAIB6FocknCwhM0HLHrtifGYzt5uGEhbLzOZ?=

=?Windows-1252?Q?JQP7TatfP9plzArIAcXMHTYSFaHCBg6OxB1C5rvvDV0vf9+hCk8BnNVI?=

=?Windows-1252?Q?dHtR3fDUlofbPf7GEaPKfZx6q7Oszf3emk3FF7ks0wp/ytZ5fo3534Fg?=

=?Windows-1252?Q?+6lJrQELsgkcYz29mbGAAOcN1IVfCGm+vIg6oiiyDIk/LGZSzYByfV5o?=

=?Windows-1252?Q?y1PeFVmGajezaFoOak6GmYsnPdtsZX4ihDuTRqs4CsID49FeoJJZXR9H?=

=?Windows-1252?Q?cdL/2UONisNHmEuXUHrOzupTm4tnyYqYwoVekwivlqjqH4es14dwQ6xM?=

=?Windows-1252?Q?1V9jId/pcpeYY8rnhr2XQdl3X15C/TrJzh3eZ8wx1/tIbRz3UA36++ZX?=

=?Windows-1252?Q?cNl8XDydHxX8tuKAC14EtIVXbE7nDG49CS3pr2b0gdC6apSy52H8HbFJ?=

=?Windows-1252?Q?zYngX0FCxSwG1TFE0WBC7wuW6tqeyXwxdWaL37Tt1zn+Y3ZNFiRD6ZWg?=

=?Windows-1252?Q?cp/9svoUJVHiORZdc4pk0unvTahX8ubOuXcKGRI3OVUw6H9wMZbFRyTO?=

=?Windows-1252?Q?7E/FlSJnHqHwbebEDqPW9OzqYSFM+w=3D=3D?=

x-ms-exchange-antispam-messagedata-chunkcount: 1

x-ms-exchange-antispam-messagedata-0:

=?Windows-1252?Q?pNTz/EUAvYhCCxBE8kumvWk2EkqSokHIItuGfAIyW/9C3BHgwhrdiZEp?=

=?Windows-1252?Q?yyU1suBJq0arL0UJgN0JFdlDapnTTAnrk5/0wEAx+SeXRaCFcyGcgSHW?=

=?Windows-1252?Q?weSTgBF91xWP8uyw7iriki8OP+Sfml/Xdablv3/fbwqkp+8ueIwgbiAZ?=

=?Windows-1252?Q?3cilhAIay1zU6xGE7GqtUsswp8zMFljsQIsSwzc+IsuUTfhSbZgU7vTy?=

=?Windows-1252?Q?pc6JYUiavSC3pTEcgRQMcFx2ZWfN0cULNYXpchqNu4o/HzA68C72Ouih?=

=?Windows-1252?Q?LhynXpI7NnWiOPjgVjyJUX99UF84CRL1zptHNqZ9n6vL4aFyJrfHsiM1?=

=?Windows-1252?Q?oc6ZB5w87wtG7aE9hd6F5zu16ZeAbP9odb/Drpyb0x5VqBy9yBQu/5Hc?=

=?Windows-1252?Q?HTorx03v6rQmj2aKG5cPmX0hIL2wchI07MhFn3MAOk1cF4Jka5QkILkC?=

=?Windows-1252?Q?7XogJ1CgyPxYBSQBm2cYlJDWXHICKXsU5hpdSNCxZBOeq47ymCRJjDhl?=

=?Windows-1252?Q?Uef7Zl+kXXJPDe713CAfSAybC/pBwu8OQxHCaMbXSdaPQiOiqztBo9es?=

=?Windows-1252?Q?m+Vhciu8QINUOCqKkPs0NKnc0WUoSaPoZ0Uhydpnn3McJ/y6+Aq46LnI?=

=?Windows-1252?Q?9DCnEHgWWEPW6hfL88G7EGv+QmcjsJlxP3SfHx8g9ROwUv5Yk+/29eMb?=

=?Windows-1252?Q?piLy9pppE6qyKAlFUOCnZ3qob8h3k0MQ64QzjsBZC5Dx7PFAI3uEB2dg?=

=?Windows-1252?Q?zoMSau5+MVOMItQKHg/Eh9vSSGUfOYqbtAGui3oG6WGYhSyfSoxTzOs+?=

=?Windows-1252?Q?bwQzIsHjInKztvChHTAYW20AXDUMciJ+vM0QfHKmt5jMZWuX0lE5U/OA?=

=?Windows-1252?Q?4KgiF6od+RA/GuBCL2rQiGZUV4/f8QE5ScZ9duVVEoE5i7eF6Dyw+w0K?=

=?Windows-1252?Q?AwY+H12jETztGl8oSXZSVysV2MKBxWBwaykSf1eK/LSRgEp5TdTjXlqA?=

=?Windows-1252?Q?1EWNO9p8Jfby87R0mopCTdHRBekKbEXQKr+tJI4PNM8d4V3WDQ560bOc?=

=?Windows-1252?Q?o+K6fV7Vji5dzosbGY3kvkjExuLuajXO+bWFpzwzQoFhl3kUHKsuw6pu?=

=?Windows-1252?Q?nRHxW35RwyP7nbEKF24qkNJEg0W4e494ir7jKRIMwrkx5iNRGdAeLwSp?=

=?Windows-1252?Q?75IS4GoYBE5cVPE6/jkOCCnTj8dK2T9vJohPBsOI+I7ReTIOatm6v05g?=

=?Windows-1252?Q?o9PFe0bbSsNo6+6Qxy2D/DbE5Z+XizyOL/keo3s2hH2rTzon95BcqGNF?=

=?Windows-1252?Q?Ns8wEQ+LQyZ6WyWHHgjT0HwR7jEbZACDlVTybMx53qm5Ww/bZ6f2tRI2?=

=?Windows-1252?Q?koucmF9xJ9HiEA4JrImqXu29GxPNyhhERMbMarOjSbW4QLPlMMPk8bQy?=

=?Windows-1252?Q?XtAzwWJoplwUc+0FbI9ZR+oS0qUqt8rQZQpRvEVA+fdfUOntChZfh2Vl?=

=?Windows-1252?Q?fS3VFgQj?=

Content-Type: multipart/alternative;

boundary="_000_KU4PR04MB936762F5E1CD511684E9B4C9D28A2KU4PR04MB9367apcp_"

MIME-Version: 1.0

X-OriginatorOrg: sct-15-20-9412-4-msonline-outlook-c3e7a.templateTenant

X-MS-Exchange-CrossTenant-AuthAs: Internal

X-MS-Exchange-CrossTenant-AuthSource: KU4PR04MB9367.apcprd04.prod.outlook.com

X-MS-Exchange-CrossTenant-RMS-PersistedConsumerOrg: 00000000-0000-0000-0000-000000000000

X-MS-Exchange-CrossTenant-Network-Message-Id: 3a28ef26-25aa-4b89-fbec-08df1f89598d

X-MS-Exchange-CrossTenant-originalarrivaltime: 01 Oct 2026 06:58:08.2925

(UTC)

X-MS-Exchange-CrossTenant-fromentityheader: Hosted

X-MS-Exchange-CrossTenant-id: 84df9e7f-e9f6-40af-b435-aaaaaaaaaaaa

X-MS-Exchange-CrossTenant-rms-persistedconsumerorg: 00000000-0000-0000-0000-000000000000

X-MS-Exchange-Transport-CrossTenantHeadersStamped: KUXPR04MB9467



--_000_KU4PR04MB936762F5E1CD511684E9B4C9D28A2KU4PR04MB9367apcp_

Content-Type: text/plain; charset="Windows-1252"

Content-Transfer-Encoding: quoted-printable



Hi ,

Want more qualified leads from "Website "?

We help businesses grow with SEO, AEO, GEO & AI Search Optimization.

Share your target location and competitors, and we=92ll provide a free SEO =

& AI visibility audit.

Interested? I can send pricing and details.

Best regards,





--_000_KU4PR04MB936762F5E1CD511684E9B4C9D28A2KU4PR04MB9367apcp_

Content-Type: text/html; charset="Windows-1252"

Content-Transfer-Encoding: quoted-printable








252">








xt-indent: 0px; background-color: white; margin: 1em 0px; font-family: Apto=

s, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif;=

font-size: 12pt; color: black;">

Hi ,



xt-indent: 0px; background-color: white; margin: 1em 0px; font-family: Apto=

s, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif;=

font-size: 12pt; color: black;">

Want more qualified leads from "Website "?



xt-indent: 0px; background-color: white; margin: 1em 0px; font-family: Apto=

s, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif;=

font-size: 12pt; color: black;">

We help businesses grow with SEO, AEO, GEO & AI Search Optimization<=

/b>.



xt-indent: 0px; background-color: white; margin: 1em 0px; font-family: Apto=

s, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif;=

font-size: 12pt; color: black;">

Share your target location and competitors, and we=92ll provide a free S=

EO & AI visibility audit.



xt-indent: 0px; background-color: white; margin: 1em 0px; font-family: Apto=

s, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif;=

font-size: 12pt; color: rgb(237, 92, 87);">

Interested? I can send pricing and details.



xt-indent: 0px; background-color: white; margin: 1em 0px; font-family: Apto=

s, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif;=

font-size: 12pt; color: black;">

Best regards,



Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">












--_000_KU4PR04MB936762F5E1CD511684E9B4C9D28A2KU4PR04MB9367apcp_--

Metamask phish

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Wed, 30 Sep 2026 20:49:03 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.100.1 (FreeBSD))

(envelope-from )

id 1xC6qw-00000000Kvn-3Jjb

for dave@doctor.nl2k.ab.ca;

Wed, 30 Sep 2026 20:48:59 -0600

Resent-From: The Doctor

Resent-Date: Wed, 30 Sep 2026 20:48:58 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from host.blessbook.com ([64.91.238.77]:53692)

by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

(Exim 4.100.1 (FreeBSD))

(envelope-from )

id 1xC5Kj-000000008hI-0xCt

for sales@nk.ca;

Wed, 30 Sep 2026 19:11:12 -0600

Received: from [147.124.211.42] (port=51099 helo=73dv.maagicarpet.com)

by host.blessbook.com with esmtpsa (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

(Exim 4.100.1)

(envelope-from )

id 1xC5Ia-0000000081R-3ywo

for sales@nk.ca;

Thu, 01 Oct 2026 01:09:25 +0000

From: "MetamaskTeam"

To: sales@nk.ca

Subject: Verify Your Identity Now

Date: 30 Sep 2026 20:09:24 -0500

Message-ID: <20260930200924.85610A461AFD199B@norecapturetax.com>

MIME-Version: 1.0

Content-Type: text/html;

charset="iso-8859-1"

Content-Transfer-Encoding: quoted-printable

X-AntiAbuse: This header was added to track abuse, please include it with any abuse report

X-AntiAbuse: Primary Hostname - host.blessbook.com

X-AntiAbuse: Original Domain - nk.ca

X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12]

X-AntiAbuse: Sender Address Domain - norecapturetax.com

X-Get-Message-Sender-Via: host.blessbook.com: authenticated_id: flashgate747@norecapturetax.com

X-Authenticated-Sender: host.blessbook.com: flashgate747@norecapturetax.com

X-Source:

X-Source-Args:

X-Source-Dir:

X-Spam_score: 12.5

X-Spam_score_int: 125

X-Spam_bar: ++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: 🦊 MetaMask Security Notice 🦊 Security alert: Someone

just tried to log in to your MetaMask from an unrecognized location. Your

account has been temporarily blocked.



Content analysis details: (12.5 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_CBL RBL: Received via a relay in cbl.abuseat.org

[Listed by XBL, see ]

1.6 RCVD_IN_BRBL_LASTEXT RBL: No description available.

[64.91.238.77 listed in bb.barracudacentral.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[147.124.211.42 listed in will-spam-for-food.eu.org]

[147.124.211.42 listed in will-spam-for-food.eu.org]

[147.124.211.42 listed in will-spam-for-food.eu.org]

[147.124.211.42 listed in will-spam-for-food.eu.org]

[147.124.211.42 listed in will-spam-for-food.eu.org]

[147.124.211.42 listed in will-spam-for-food.eu.org]

[147.124.211.42 listed in will-spam-for-food.eu.org]

[147.124.211.42 listed in will-spam-for-food.eu.org]

[64.91.238.77 listed in will-spam-for-food.eu.org]

[64.91.238.77 listed in will-spam-for-food.eu.org]

[64.91.238.77 listed in will-spam-for-food.eu.org]

[64.91.238.77 listed in will-spam-for-food.eu.org]

[64.91.238.77 listed in will-spam-for-food.eu.org]

[64.91.238.77 listed in will-spam-for-food.eu.org]

[64.91.238.77 listed in will-spam-for-food.eu.org]

[64.91.238.77 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[147.124.211.42 listed in dnsbl.ahbl.org]

[147.124.211.42 listed in dnsbl.ahbl.org]

[147.124.211.42 listed in dnsbl.ahbl.org]

[147.124.211.42 listed in dnsbl.ahbl.org]

[64.91.238.77 listed in dnsbl.ahbl.org]

[64.91.238.77 listed in dnsbl.ahbl.org]

[64.91.238.77 listed in dnsbl.ahbl.org]

[64.91.238.77 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[147.124.211.42 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[147.124.211.42 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[147.124.211.42 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[147.124.211.42 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_SBL_XBL RBL: Received via a relay in Spamhaus SBL+XBL

[147.124.211.42 listed in sbl-xbl.spamhaus.org]

[147.124.211.42 listed in sbl-xbl.spamhaus.org]

3.6 RCVD_IN_SBL_CSS RBL: Received via a relay in Spamhaus SBL-CSS

[147.124.211.42 listed in zen.spamhaus.org]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[64.91.238.77 listed in bl.score.senderscore.com]

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 HTML_MESSAGE BODY: HTML included in message

1.0 ACCT_PHISHING Possible phishing for account information

0.9 URI_PHISH Phishing using web form

Subject: {SPAM?} Verify Your Identity Now














=3D1.0">

🦊 MetaMask Security Notice 🦊






font-family: 'Trebuchet MS', 'Helvetica', 'Arial', sans-serif;

font-size: 15px;

color: #661800;

line-height: 1.5;

-webkit-font-smoothing: antialiased">


font-size: 1px;

color: #ffffff;

line-height: 1px;

max-height: 0;

max-width: 0;

opacity: 0;

overflow: hidden" class=3D"preheader">Security alert: Someone j=

ust tried to log in to your MetaMask from an unrecognized location. Your ac=

count has been temporarily blocked.



margin: 0 auto;

background-color: #FF5C16;

padding: 0" class=3D"wrapper">







3D"MetaMask"
er.consensys.io/hs-fs/hubfs/Vector-2.png?width=3D200&upscale=3Dtrue&=

;name=3DVector-2.png">









3D"New
wsletter.consensys.io/hs-fs/hubfs/New%20This%20Month-1.png?width=3D1000&=

;upscale=3Dtrue&name=3DNew%20This%20Month-1.png">








padding: 35px 25px 40px;

margin: 0 20px;

border-radius: 10px" class=3D"content-block">


font-weight: bold;

color: #000000;

line-height: 115%;

margin-bottom: 15px" class=3D"greeting">Dear Customer,



line-height: 160%;

color: #000000;

font-family: 'Trebuchet MS', sans-serif" class=3D"content-text"=

>

We noticed that someon=

e just tried to log in to your MetaMask from location you have not used bef=

ore, so we want to make sure it's really you.






font-weight: bold;

font-size: 17px;

background-color: rgba(102, 24, 0, 0.10);

border-left: 5px solid #661800;

padding: 14px 18px;

border-radius: 6px;

display: block;

margin: 0 0 25px;

line-height: 150%" class=3D"highlight-text">

⚠️ Your account and your wallet have been =

temporarily blocked to prevent you from losing your assets.






font-weight: bold;

color: #000000;

line-height: 130%;

margin: 0 0 12px;

font-family: 'Trebuchet MS', sans-serif" class=3D"recovery-head=

ing">How can I recover my account?



    margin-bottom: 25px;

    font-size: 16px;

    line-height: 160%;

    color: #000000;

    font-family: 'Trebuchet MS', sans-serif" class=3D"instructions"=

    >


  1. padding-left: 4px">Click and follow the instructions to recover=

    your account and unblock it.



  2. padding-left: 4px">After completing the process, enable Two-Fac=

    tor Authentication







background-color: #661800;

color: #ffffff !important;

font-size: 16px;

font-weight: bold;

text-decoration: none;

padding: 16px 30px;

border-radius: 24px;

margin: 0;

white-space: nowrap;

letter-spacing: 0.3px" class=3D"cta-button" href=3D"http://chol=

lo-to.digidip.net/visit?url=3Dhttps://alisgrup.ro/n/index.html" target=3D"_=

blank">

RECOVER MY ACCOUNT NOW


vertical-align: middle;

margin-left: 6px;

width: 13px;

height: 13px" alt=3D"arrow" src=3D"https://newsletter.consensys=

=2Eio/hs-fs/hubfs/arrow.png?width=3D26&height=3D26&upscale=3Dtrue&a=

mp;name=3Darrow.png">












>

Consensys Software Inc


5049 Edwards Ranch Rd, Fort Worth, TX 76109 United Stat=

es





Email Preferences &=

nbsp;• 

Unsubscribe





3D"x/twitter"
src=3D"https://newsletter.consensys.io/hs-fs/hubfs/MetaMask%20Template%2020=

25/X.png?width=3D40&height=3D40&upscale=3Dtrue&name=3DX.png">
a>

3D"github"
=3D"https://newsletter.consensys.io/hs-fs/hubfs/MetaMask%20Template%202025/=

github.png?width=3D48&height=3D48&upscale=3Dtrue&name=3Dgithub.=

png">


px; height: 24px; object-fit: contain;" alt=3D"wrapcaster" src=3D"https://n=

ewsletter.consensys.io/hubfs/MetaMask%20Template%202025/wrapcaster.png">
>



3D"Header-1"
ewsletter.consensys.io/hs-fs/hubfs/Header-1.png?width=3D1200&height=3D1=

96&upscale=3Dtrue&name=3DHeader-1.png">











Nigerian spam

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Wed, 30 Sep 2026 20:46:17 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.100.1 (FreeBSD))

(envelope-from )

id 1xC6oE-00000000KcP-3fJH

for dave@doctor.nl2k.ab.ca;

Wed, 30 Sep 2026 20:46:11 -0600

Resent-From: The Doctor

Resent-Date: Wed, 30 Sep 2026 20:46:10 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mx02.hac.hr ([193.105.23.22]:38077 helo=mx01.hac.hr)

by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

(Exim 4.100.1 (FreeBSD))

(envelope-from )

id 1xC2d7-00000000A9p-0jDt

for sales@nk.ca;

Wed, 30 Sep 2026 16:18:01 -0600

DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple;

d=hac.hr; i=@hac.hr; q=dns/txt; s=s1; t=1790806673;

h=from:to:subject:date:message-id:reply-to:mime-version;

z=From:=20=3D?iso-8859-2?Q?Bruno_Crnkovi=3DE6?=3D=20
.Crnkovic@hac.hr>|To:=20=3D?iso-8859-2?Q?Bruno_Crnkovi=3D

E6?=3D=20|Subject:=20Hello|Date:

=20Wed,=2030=20Sep=202026=2022:16:15=20+0000|Message-ID:

=20<3a413299df7145bab22f391f63be5a26@hac.hr>|Reply-To:=20

"mfissolo387@gmail.com"=20

|MIME-Version:=201.0;

bh=lntmunxjq3TUR/Vay+0ZGIerSWw6b5a6gxUDbgmyMRQ=;

b=XNJ7G89rLLtpesEUOb1ngVvEhTe4Gr6vOjxjKoIj+rp4YUeBYq5HA7Y0

sTQ+KwPF4K6If+q1wmoiJZ64Wp0uiqzHIbcYCdl/pv+Rf3Q2saBYv9bGL

eVpRfyGjN7AudbhAclo5e3JPtXvVegscpNFwopfRV/TPHsj/B9S1HN0aC

Jo1JNskWe1WvPaH5B2I51NaW2QUkYlzLJdc9C7nFJEnCO51TmbevN/2V9

ItaI5vQe7gRSq0pB7FfZl7cmw7tRx4aUBrevMFuHJw/7IQ7hmgO17YcGO

s4HepGyKRHuKDO+3/Qez/gloiOylv8Jcfx1AfuS8uySMCvtaOFQ6bF9WU

g==;

X-CSE-ConnectionGUID: +jIVh5rJS6yMn8wDye3deQ==

X-CSE-MsgGUID: igobwZVnSy6cTU1rXyHfMw==

X-ThreatScanner-Verdict: Negative

X-IronPort-AV: E=Sophos;i="6.27,133,1787004000";

d="scan'208,217";a="6566956"

Received: from unknown (HELO wan.hac.lan) ([10.10.240.192])

by mx01.hac.hr with ESMTP; 01 Oct 2026 00:16:15 +0200

Received: from obi.hac.lan (10.10.240.191) by wan.hac.lan (10.10.240.192) with

Microsoft SMTP Server (version=TLS1_2,

cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.2507.44; Thu, 1 Oct

2026 00:16:15 +0200

Received: from obi.hac.lan ([10.10.240.191]) by obi.hac.lan ([10.10.240.191])

with mapi id 15.01.2507.044; Thu, 1 Oct 2026 00:16:15 +0200

From: =?iso-8859-2?Q?Bruno_Crnkovi=E6?=

To: =?iso-8859-2?Q?Bruno_Crnkovi=E6?=

Subject: Hello

Thread-Topic: Hello

Thread-Index: AQHdUSlOL7avL9AIvUmfphkfB2fj3g==

Date: Wed, 30 Sep 2026 22:16:15 +0000

Message-ID: <3a413299df7145bab22f391f63be5a26@hac.hr>

Reply-To: "mfissolo387@gmail.com"

Accept-Language: hr-HR, en-US

Content-Language: en-US

X-MS-Has-Attach:

X-MS-TNEF-Correlator:

x-originating-ip: [10.10.240.180]

Content-Type: multipart/alternative;

boundary="_000_3a413299df7145bab22f391f63be5a26hachr_"

MIME-Version: 1.0



--_000_3a413299df7145bab22f391f63be5a26hachr_

Content-Type: text/plain; charset="iso-8859-2"

Content-Transfer-Encoding: quoted-printable



Mrs Rafaela has a gift for you reply for more info.

















































































Ova poruka sadr=BEi podatke povjerljive prirode, isklju=E8ivo namijenjene o=

sobama ozna=E8enima kao primateljima te se pristup od strane bilo koje drug=

e osobe smatra neovla=B9tenim. Ukoliko niste ozna=E8eni primatelj, svaka di=

stribucija, kopiranje, umno=BEavanje ili otkrivanje sadr=BEaja tre=E6im oso=

bama je strogo zabranjeno i smatra se protuzakonitim. Ukoliko ste dobili ov=

u poruku, a niste ozna=E8eni primatelj, molimo Vas da =B9to prije obavijest=

ite po=B9iljatelja poruke i uni=B9tite sve postoje=E6e kopije. Ova napomena=

tako=F0er potvr=F0uje da je ova elektroni=E8ka poruka testirana na postoja=

nje ra=E8unalnih virusa.





The information in this email is confidential and it is intended solely for=

the addressee. Access to this email by anyone else is unauthorized. If you=

are not the intended recipient, any distribution, copying, duplication or =

disclosure is prohibited and may be unlawful. If you have received this ema=

il in error, please notify the sender immediately and destroy it, and all c=

opies of it. This footnote also confirms that this email message has been s=

wept for the presence of computer viruses.



--_000_3a413299df7145bab22f391f63be5a26hachr_

Content-Type: text/html; charset="iso-8859-2"

Content-Transfer-Encoding: quoted-printable




osoft-com:office:office" xmlns:w=3D"urn:schemas-microsoft-com:office:word" =

xmlns:m=3D"http://schemas.microsoft.com/office/2004/12/omml" xmlns=3D"http:=

//www.w3.org/TR/REC-html40">




2">












pt;font-family:"Verdana",sans-serif;color:#333333">Mrs Rafaela ha=

s a gift for you reply for more info.
;color:black">



 



 



 



 



 



 



 



 



 



 



 



 



 



 



 



 



 



 



 



 



 



 



 



 



 



 



 



 



 



 



 



 



 



 



 



 



 



 



 






lack">


Ova poruka sadr=BEi podatke povjerljive prirode, isklju=E8ivo namijenjene o=

sobama ozna=E8enima kao primateljima te se pristup od strane bilo koje drug=

e osobe smatra neovla=B9tenim. Ukoliko niste ozna=E8eni primatelj, svaka di=

stribucija, kopiranje, umno=BEavanje ili otkrivanje

sadr=BEaja tre=E6im osobama je strogo zabranjeno i smatra se protuzakoniti=

m. Ukoliko ste dobili ovu poruku, a niste ozna=E8eni primatelj, molimo Vas =

da =B9to prije obavijestite po=B9iljatelja poruke i uni=B9tite sve postoje=

=E6e kopije. Ova napomena tako=F0er potvr=F0uje da

je ova elektroni=E8ka poruka testirana na postojanje ra=E8unalnih virusa.<=

/span>







lack">


The information in this email is confidential and it is intended solely for=

the addressee. Access to this email by anyone else is unauthorized. If you=

are not the intended recipient, any distribution, copying, duplication or =

disclosure is prohibited and may

be unlawful. If you have received this email in error, please notify the s=

ender immediately and destroy it, and all copies of it. This footnote also =

confirms that this email message has been swept for the presence of compute=

r viruses.









--_000_3a413299df7145bab22f391f63be5a26hachr_--

Nigerian spam

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Wed, 30 Sep 2026 20:46:01 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.100.1 (FreeBSD))

(envelope-from )

id 1xC6o0-00000000Kaj-424t

for dave@doctor.nl2k.ab.ca;

Wed, 30 Sep 2026 20:45:57 -0600

Resent-From: The Doctor

Resent-Date: Wed, 30 Sep 2026 20:45:56 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mx01.hac.hr ([193.105.23.21]:24207 helo=mx02.hac.hr)

by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

(Exim 4.100.1 (FreeBSD))

(envelope-from )

id 1xC2cv-00000000A5V-0Tns

for root@nl2k.ab.ca;

Wed, 30 Sep 2026 16:17:49 -0600

DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple;

d=hac.hr; i=@hac.hr; q=dns/txt; s=s1; t=1790806660;

h=from:to:subject:date:message-id:reply-to:mime-version;

z=From:=20=3D?iso-8859-2?Q?Bruno_Crnkovi=3DE6?=3D=20
.Crnkovic@hac.hr>|To:=20=3D?iso-8859-2?Q?Bruno_Crnkovi=3D

E6?=3D=20|Subject:=20Hello|Date:

=20Wed,=2030=20Sep=202026=2022:15:47=20+0000|Message-ID:

=20<302dcc39febf4f378b6f3f972e25ce23@hac.hr>|Reply-To:=20

"mfissolo387@gmail.com"=20

|MIME-Version:=201.0;

bh=iDQDGJW2A45G7C6jwO50Dp0uNT160pSJpOLhoaO7dck=;

b=lXKb6Rc3vjGEhuJ5P0kir1+GGDLDT/kj/55+iiho28AUofDBhZMjgDKo

7h0iODnpr4zu5iWTC8EvnAjkcfhRS3xN+ZTqjWG7pdeIU8c9OKBQh5m76

xZ5Ugv1TGiEldK41sfGG2x0s30HT3O/nMbZPp02PVjt+yL1ILaOp9IIlg

Md2qLQcz2bHKaCZFUlb8/fSgxbSGieLqoIb6RpUkFQCG+5BgvONjOdwXG

KZEHTs7Bcn1e9FnGDgRngF7FQL6dakIRjylVBCcwH3IzlctNl6gDOWFPv

YHiKLDOYYhduY4+vzkzCwNrvSeYeXa0LwqywD7MCZl/lYcWovPTlFSj6l

A==;

X-CSE-ConnectionGUID: CUm5VdLER+26CKyxb3uuJQ==

X-CSE-MsgGUID: Nup+J4SNRxiTSSRKMWHlRg==

X-ThreatScanner-Verdict: Negative

X-IronPort-AV: E=Sophos;i="6.27,133,1787004000";

d="scan'208,217";a="10079878"

Received: from unknown (HELO kenobi.hac.lan) ([10.10.240.193])

by mx02.hac.hr with ESMTP; 01 Oct 2026 00:15:47 +0200

Received: from obi.hac.lan (10.10.240.191) by kenobi.hac.lan (10.10.240.193)

with Microsoft SMTP Server (version=TLS1_2,

cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.2507.44; Thu, 1 Oct

2026 00:15:47 +0200

Received: from obi.hac.lan ([10.10.240.191]) by obi.hac.lan ([10.10.240.191])

with mapi id 15.01.2507.044; Thu, 1 Oct 2026 00:15:47 +0200

From: =?iso-8859-2?Q?Bruno_Crnkovi=E6?=

To: =?iso-8859-2?Q?Bruno_Crnkovi=E6?=

Subject: Hello

Thread-Topic: Hello

Thread-Index: AQHdUSk+FyzWW9wJOEC1GiV5BV4CxA==

Date: Wed, 30 Sep 2026 22:15:47 +0000

Message-ID: <302dcc39febf4f378b6f3f972e25ce23@hac.hr>

Reply-To: "mfissolo387@gmail.com"

Accept-Language: hr-HR, en-US

Content-Language: en-US

X-MS-Has-Attach:

X-MS-TNEF-Correlator:

x-originating-ip: [10.10.240.180]

Content-Type: multipart/alternative;

boundary="_000_302dcc39febf4f378b6f3f972e25ce23hachr_"

MIME-Version: 1.0



--_000_302dcc39febf4f378b6f3f972e25ce23hachr_

Content-Type: text/plain; charset="iso-8859-2"

Content-Transfer-Encoding: quoted-printable



Mrs Rafaela has a gift for you reply for more info.

















































































Ova poruka sadr=BEi podatke povjerljive prirode, isklju=E8ivo namijenjene o=

sobama ozna=E8enima kao primateljima te se pristup od strane bilo koje drug=

e osobe smatra neovla=B9tenim. Ukoliko niste ozna=E8eni primatelj, svaka di=

stribucija, kopiranje, umno=BEavanje ili otkrivanje sadr=BEaja tre=E6im oso=

bama je strogo zabranjeno i smatra se protuzakonitim. Ukoliko ste dobili ov=

u poruku, a niste ozna=E8eni primatelj, molimo Vas da =B9to prije obavijest=

ite po=B9iljatelja poruke i uni=B9tite sve postoje=E6e kopije. Ova napomena=

tako=F0er potvr=F0uje da je ova elektroni=E8ka poruka testirana na postoja=

nje ra=E8unalnih virusa.





The information in this email is confidential and it is intended solely for=

the addressee. Access to this email by anyone else is unauthorized. If you=

are not the intended recipient, any distribution, copying, duplication or =

disclosure is prohibited and may be unlawful. If you have received this ema=

il in error, please notify the sender immediately and destroy it, and all c=

opies of it. This footnote also confirms that this email message has been s=

wept for the presence of computer viruses.



--_000_302dcc39febf4f378b6f3f972e25ce23hachr_

Content-Type: text/html; charset="iso-8859-2"

Content-Transfer-Encoding: quoted-printable




osoft-com:office:office" xmlns:w=3D"urn:schemas-microsoft-com:office:word" =

xmlns:m=3D"http://schemas.microsoft.com/office/2004/12/omml" xmlns=3D"http:=

//www.w3.org/TR/REC-html40">




2">












pt;font-family:"Verdana",sans-serif;color:#333333">Mrs Rafaela ha=

s a gift for you reply for more info.
;color:black">



 



 



 



 



 



 



 



 



 



 



 



 



 



 



 



 



 



 



 



 



 



 



 



 



 



 



 



 



 



 



 



 



 



 



 



 



 



 



 






lack">


Ova poruka sadr=BEi podatke povjerljive prirode, isklju=E8ivo namijenjene o=

sobama ozna=E8enima kao primateljima te se pristup od strane bilo koje drug=

e osobe smatra neovla=B9tenim. Ukoliko niste ozna=E8eni primatelj, svaka di=

stribucija, kopiranje, umno=BEavanje ili otkrivanje

sadr=BEaja tre=E6im osobama je strogo zabranjeno i smatra se protuzakoniti=

m. Ukoliko ste dobili ovu poruku, a niste ozna=E8eni primatelj, molimo Vas =

da =B9to prije obavijestite po=B9iljatelja poruke i uni=B9tite sve postoje=

=E6e kopije. Ova napomena tako=F0er potvr=F0uje da

je ova elektroni=E8ka poruka testirana na postojanje ra=E8unalnih virusa.<=

/span>







lack">


The information in this email is confidential and it is intended solely for=

the addressee. Access to this email by anyone else is unauthorized. If you=

are not the intended recipient, any distribution, copying, duplication or =

disclosure is prohibited and may

be unlawful. If you have received this email in error, please notify the s=

ender immediately and destroy it, and all copies of it. This footnote also =

confirms that this email message has been swept for the presence of compute=

r viruses.









--_000_302dcc39febf4f378b6f3f972e25ce23hachr_--