Web/SEO/App spam from Google Gmail

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Fri, 21 Aug 2026 11:11:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.5 (FreeBSD))

(envelope-from )

id 1wxSlH-0000000074D-26xk

for dave@doctor.nl2k.ab.ca;

Fri, 21 Aug 2026 11:10:35 -0600

Resent-From: The Doctor

Resent-Date: Fri, 21 Aug 2026 11:10:35 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-lj1-f197.google.com ([209.85.208.197]:60539)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.99.5 (FreeBSD))

(envelope-from )

id 1wxSYE-00000000Hkc-04qC

for root@nk.ca;

Fri, 21 Aug 2026 10:57:15 -0600

Received: by mail-lj1-f197.google.com with SMTP id 38308e7fff4ca-39d93e881b3sf5729561fa.0

for ; Fri, 21 Aug 2026 09:56:22 -0700 (PDT)

ARC-Seal: i=3; a=rsa-sha256; t=1787331375; cv=pass;

d=google.com; s=arc-20260327;

b=XBYgZboDkATerqUb2xzYsunC/lYvJNZYC+rz9WonfRolH2zj3uo7LCPUzqko44Ov+/

AY1BtexOPyV1XujnPNVuHkNW9uXduoLwR+2Vtww2NPq78tbP5DAe0lVLos7SSWRyj4Qk

aarXNkWOjZlw003B6fl/WCUO9WwRw+6M98X0eAN0UgL7I5NAZ2q1LdDSMRKRMxGYu23S

aHgOAbPHFwj81fP3e3t6pngL1QXRSbLdhd+P/kc7xDzeDf/1UtkX2/w01ms4nRNA31ZH

IpPF0dfTaeNUhFrmLQXX4zANHdV1XQGV8zrQsGDuRVllapzRZLBCGkMUsrDzo9MbRKES

lWVw==

ARC-Message-Signature: i=3; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20260327;

h=list-unsubscribe:list-subscribe:list-archive:list-help:list-post

:list-id:mailing-list:precedence:to:subject:message-id:date:from

:in-reply-to:references:mime-version:sender:dkim-signature;

bh=6EexJoaNjhPmOHzUvx6ZISqUdUNgZH1TwlxrJX1cT+A=;

fh=Olfic5Hpg+lATT7Arlnr5ygr+R5NJmrb+6mdX5qgtD0=;

b=Ij0ARw6dVuL865I9i2YNyRZB5bhORlSUfVFukzbKbIdKYHCJCQuh0IpWVXWO8Xp4yr

p6Sfoh1WIXwPXusIc+HuOrYPvXZOMdllpw0K2l+QXKRe1yWTYgfQBlMxksaR367yCbL9

hoL8N3ncD6IPMaag/taZY6ZgEsloM4qboVDAeIfrkDy0TQ481VNzhjCuoUSJW7nq/qNb

Kge+ZS8U3ADE/GMalqHBC8HfVpL/gY0LwfKeo0W7EV3wtrXderZguj8Zxnnb5AloZilh

f64uzk+Zhypfg5MJCqEh0EmlrkU+okOiAOZVk3nb3Q8NH3QXHnaJVRqpBdxrCotYJG21

1vhA==;

darn=nk.ca

ARC-Authentication-Results: i=3; mx.google.com;

dkim=pass header.i=@gmail.com header.s=20251104 header.b=I38D9DrB;

arc=pass (i=1);

spf=pass (google.com: domain of anaya.singh3226@gmail.com designates 209.85.220.65 as permitted sender) smtp.mailfrom=anaya.singh3226@gmail.com;

dmarc=pass (p=NONE sp=QUARANTINE dis=NONE) header.from=gmail.com;

dara=neutral header.i=@rankbeacon.xyz

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=rankbeacon.xyz; s=google; t=1787331375; x=1787936175; darn=nk.ca;

h=list-unsubscribe:list-subscribe:list-archive:list-help:list-post

:list-id:mailing-list:precedence:x-original-authentication-results

:x-original-sender:content-type:to:subject:message-id:date:from

:in-reply-to:references:mime-version:sender:from:to:cc:subject:date

:message-id:reply-to:content-type;

bh=6EexJoaNjhPmOHzUvx6ZISqUdUNgZH1TwlxrJX1cT+A=;

b=OUNrgSz5ATn0hvE5xSIaEQtRrCMiyFEb4NMh4+aVqqs2JsqSRiAgta78gGo7u75n6B

S0SO9kJVFtWWlX3v4KD336DqdqyfSwvBLi4Cks9UICZd4MaBz0i/85MJpiVa5gnfWGnb

qlFzXDkhC2CzX3eiKcIO87iRH9u1PnvVLC9kYWgAVspVspuz8tIjcXMLPAP8t8t1SZ+W

iCmyVlSgnNNgcnWqlGKWERh2HIM5rkTBg0Ppo+Dtrtplb5rjbhROWv+lphi43GjXPyqI

qxzDzVNnu/wml6JrGZuPCvmFUQrZCqWuYTbJjHBVGMwHwXUajdPaGLP79osf3IdHzMGo

ePrg==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20251104; t=1787331375; x=1787936175;

h=list-unsubscribe:list-subscribe:list-archive:list-help:list-post

:x-spam-checked-in-group:list-id:mailing-list:precedence

:x-original-authentication-results:x-original-sender:content-type:to

:subject:message-id:date:from:in-reply-to:references:mime-version

:x-gm-gg:x-beenthere:x-gm-message-state:sender:from:to:cc:subject

:date:message-id:reply-to:content-type;

bh=6EexJoaNjhPmOHzUvx6ZISqUdUNgZH1TwlxrJX1cT+A=;

b=BJO5iNfyhD+vzMBHkPTpZufnKTyByEXNZE8dnzozaNQNC87MbV8rb4aQYCNzn61UNA

5mukZWXCeAhAzt5Aog9kT2zMJy9W+f0pYmtwUGgOdTJ4k4xjZP00GQhA0U39Wc3ms34A

rbLuLvUhlYxiMXB3riBVg3N0hOPGyWj3zKE2YHdo6W5Gl122RV6fWmq+FW4o+7mYu9nr

SiBAB8kHhng5pq/Ai3ro1+QtvAEJYQ+IR1KPUCWaULwE34BhUWKtTqb8HCi+koQ0ZnPz

i3WtMAW7SCe/FK+1HMV8gZOxCo75xGG4k9bHoMKcKicv8v7wGEBOlYOIXPsvFiKxX0N/

ZJ1w==

Sender: google_seo@rankbeacon.xyz

X-Forwarded-Encrypted: i=3; AHgh+Rp+yWE80gtfXJ78JCheZnKcR/HKdoRiYWmoPit5nXVXH6KuXLfQ5Hai1T8v9iPXER+ljyJz@nk.ca

X-Gm-Message-State: AFuF++mtuhfxuyx2rT4+3lxMGCwap1g45cJhTuVsDEl4o2PenD1nTZoY

BC/OK444575WAH1HWODvtjd3R0K7s5O3JXtGZUH0kxfR5MZpisvQWq5HZVwkmvfMAO4=

X-Received: by 2002:a05:651c:220a:b0:39d:93e8:7ffe with SMTP id 38308e7fff4ca-3a1aebc7019mr18070041fa.4.1787331375137;

Fri, 21 Aug 2026 09:56:15 -0700 (PDT)

X-BeenThere: google_seo@rankbeacon.xyz; h="ATskLdeQB7k/O1Tk4I3QxARa/kf0M529dMDr0AFrPMBqws8wlA=="

Received: by 2002:a05:651c:a205:10b0:3a1:2462:25b2 with SMTP id

38308e7fff4ca-3a195fee8cfls3722201fa.0.-pod-prod-09-eu; Fri, 21 Aug 2026

09:54:00 -0700 (PDT)

X-Received: by 2002:a05:651c:b0c:b0:394:635:70b1 with SMTP id 38308e7fff4ca-3a1aeba1317mr19010091fa.3.1787331240349;

Fri, 21 Aug 2026 09:54:00 -0700 (PDT)

ARC-Seal: i=2; a=rsa-sha256; t=1787331240; cv=pass;

d=google.com; s=arc-20260327;

b=FLtNCS/J1q/T3ELE3SQ8cB4nkHOlfpOD770kac7CdFhh0npKeHCwTij/Pny3DKggY0

et49n0jjffj27UoI2+fn4Np6GZLJY9PWOEM/xVzWL+WlHrra+49DHp/GmyCYWYNFGSIO

o3ojcX56OFeMJcJRbbxybFtcxqC7mEbgLY+cJmVJHLctKDdeMcvsJaPC5mlLe1LaM5z0

kGOIRXZnNsWIRiFCN/he+VPaaiDVPgkATjMUW9ZzrJFO+7SxSEcyQICgT2+zRruud4CK

J+4cBs5Y4Y0uWK1utmlrKtejgICfrvAg0afA0DcMEkm4BcopMO5ofbLGEhfnKFA26CTj

6oIw==

ARC-Message-Signature: i=2; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20260327;

h=to:subject:message-id:date:from:in-reply-to:references:mime-version

:dkim-signature;

bh=i+Io8aXSWTtzx7xfEtknMdZW/mDaSkO45qWyqwfJ96M=;

fh=PWSUFaEq1CkbsfShP2jell5RPg3MDtCYx7KzhsUuaJc=;

b=DWsGX7giZDjDn34FyKPzCRtHYzBRAnmt3KAQ1MsE5MlhQVhqMxisOgsZt0cdmAqIrb

vTngkbaYCa5iruiBH15hKYQ8jO4gLyKUYOuH5xy+lqoJtP5U/EXjL597KeTMUzkOSbpF

TUB7OO5Ub3hOqxNWX/1RnhK79lySwiXxpumQi+pu8XkrRDaHPq26cre/2jHkhz5goMxz

FTPuNAuJhlzvvO61nv0g9o9VUQkro6jDeN6DknossW0HtCZVNcIBUMTLfuAf12UJmuC7

UecR7tldSTfVBvuTeBV/BT1EKeYOQsJEK4Ba1w9W6gnDy1sACas4FYAE8RndedcdvmmW

Ui1A==;

dara=google.com

ARC-Authentication-Results: i=2; mx.google.com;

dkim=pass header.i=@gmail.com header.s=20251104 header.b=I38D9DrB;

arc=pass (i=1);

spf=pass (google.com: domain of anaya.singh3226@gmail.com designates 209.85.220.65 as permitted sender) smtp.mailfrom=anaya.singh3226@gmail.com;

dmarc=pass (p=NONE sp=QUARANTINE dis=NONE) header.from=gmail.com;

dara=neutral header.i=@rankbeacon.xyz

Received: from mail-sor-f65.google.com (mail-sor-f65.google.com. [209.85.220.65])

by mx.google.com with SMTPS id 38308e7fff4ca-3a189dfb3cfsor11172191fa.21.2026.08.21.09.54.00

for

(Google Transport Security);

Fri, 21 Aug 2026 09:54:00 -0700 (PDT)

Received-SPF: pass (google.com: domain of anaya.singh3226@gmail.com designates 209.85.220.65 as permitted sender) client-ip=209.85.220.65;

ARC-Seal: i=1; a=rsa-sha256; t=1787331240; cv=none;

d=google.com; s=arc-20260327;

b=hmLSWgeNICw4EG7lyCagYYGYNlrlpPUw295WMKKdDUbCJKXRy7RBRq539dUJTWc2XZ

Ddk5bgvZ/dWTvq1/gHtOs/8kahusX66X36MAAmwP8EPUBJrnL9NYhO8Hczm3YZdVq0gw

u5tgSzKSjOaVfXfLwECuv9xf2xpUQLsAYnSG81Qt10FmfCv0dEDfsp8xPcvAdKSKjouV

3II+FSVa9J/RL71RrjXAZgKiWO0OlVe94aqdOzgUwn4wtSzFMdwuxCUJgnaVdrjHiN0+

Ico/ZrGvaGLnvfWOENTeNORsDH6rM8vDJh7/zJz+Fl9WE1yxALex5tYkDLrMwStxz2Bw

HdvA==

ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20260327;

h=to:subject:message-id:date:from:in-reply-to:references:mime-version

:dkim-signature;

bh=i+Io8aXSWTtzx7xfEtknMdZW/mDaSkO45qWyqwfJ96M=;

fh=PWSUFaEq1CkbsfShP2jell5RPg3MDtCYx7KzhsUuaJc=;

b=mRU8CWZXdeJhcbO4fm+SSdhzhE9RliTOFUVay7WSW3ltQVNj2yLyUee0tSGeNCTgzt

LnFHTobrtXvk7J7gwFwr+BxA1PUyabBfsloP/8ksLpuTp4loHBGkAySmBtA5ET+l03yB

H6g8RXXXH9bZCRZRGDMRJ4/pweFpOesn9aLGztLJyiMuNc4r/i1i93yYA8g+87FJBops

AR0Fn7vJcjHO9KCzSwr+u2dQZ939eq3t7Ubo7/+U+MCqyiPbKPf6MEIOWQWwhfmNBOld

00imqfu795wWqTA6ADdHIKvX08sCn9oQ7Bz0YSjyI3AnlmbDgjkHW+aWC+LoIrPzzKRS

MAbg==;

darn=rankbeacon.xyz

ARC-Authentication-Results: i=1; mx.google.com; arc=none

X-Gm-Gg: AR+sD12XndX6czykZcWpwjbXzlRdamg2DTNamir5vFFXLy+7we9VGsLdT8CWyIC3IvS

tpKKW3tbmVNXwOvOKVV9lrcKtHcJ7520AdhjrUTxY+nIXoXtmmQBTtMRwLtjYj3JINoptENzE2t

6aTEKtZcRlglLMgShYI9wtwGacRmbxeQhRh/DnPOy9uqxknR/Ae34tMzqI/L8tUmjK/Ty8voosA

8wixSYNciHw0Q6sJM9CgChaAohoCfsj/8H8ptizWQccn1+KHQLew1aW/3sQGCqXYKlP4eQp5oKs

AYi6W2lUi97cGKoxbrU6ngBFY2YjYSll+8dOitnkRKBMdDdhOJLe5KiK51OkQsQWdlv/Pw421o6

lheGM3xBozvgXe5yeD6gUzRXu4rJnOZA+AczBxlQw1+AVChZkhhddLskHEw==

X-Received: by 2002:a05:651c:144c:b0:3a1:a1f6:3af7 with SMTP id

38308e7fff4ca-3a1aee72788mr18838981fa.12.1787331239775; Fri, 21 Aug 2026

09:53:59 -0700 (PDT)

MIME-Version: 1.0

References:

In-Reply-To:

From: Anaya Singh

Date: Fri, 21 Aug 2026 22:25:53 +0530

X-Gm-Features: AcwNN1U6KUHOYVOuD3uUb4ftWHBxKs6GYk1QCGbEBOs7_LwPysOW7UlAJhMzvjg

Message-ID:

Subject: Re: Few improvements for your website !!!

To: google_seo@rankbeacon.xyz

Content-Type: multipart/alternative; boundary="000000000000a491e00659917b48"

X-Original-Sender: anaya.singh3226@gmail.com

X-Original-Authentication-Results: mx.google.com; dkim=pass

header.i=@gmail.com header.s=20251104 header.b=I38D9DrB; arc=pass

(i=1); spf=pass (google.com: domain of anaya.singh3226@gmail.com

designates 209.85.220.65 as permitted sender) smtp.mailfrom=anaya.singh3226@gmail.com;

dmarc=pass (p=NONE sp=QUARANTINE dis=NONE) header.from=gmail.com;

dara=neutral header.i=@rankbeacon.xyz

Precedence: list

Mailing-list: list google_seo@rankbeacon.xyz; contact google_seo+owners@rankbeacon.xyz

List-ID:

X-Spam-Checked-In-Group: google_seo@rankbeacon.xyz

X-Google-Group-Id: 1054195051699

List-Post: ,

List-Help: ,



List-Archive:

List-Subscribe: ,



List-Unsubscribe: ,



X-Spam_score: 8.0

X-Spam_score_int: 80

X-Spam_bar: ++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Just following up on my last email regarding a few website

improvements that could help increase your traffic, leads, and conversions.

I still have the quick snapshot ready for you. Reply *“OK – SEND”

and I’ll share it over.



Content analysis details: (8.0 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[209.85.220.65 listed in will-spam-for-food.eu.org]

[209.85.220.65 listed in will-spam-for-food.eu.org]

[209.85.220.65 listed in will-spam-for-food.eu.org]

[209.85.220.65 listed in will-spam-for-food.eu.org]

[209.85.220.65 listed in will-spam-for-food.eu.org]

[209.85.220.65 listed in will-spam-for-food.eu.org]

[209.85.220.65 listed in will-spam-for-food.eu.org]

[209.85.220.65 listed in will-spam-for-food.eu.org]

[209.85.208.197 listed in will-spam-for-food.eu.org]

[209.85.208.197 listed in will-spam-for-food.eu.org]

[209.85.208.197 listed in will-spam-for-food.eu.org]

[209.85.208.197 listed in will-spam-for-food.eu.org]

[209.85.208.197 listed in will-spam-for-food.eu.org]

[209.85.208.197 listed in will-spam-for-food.eu.org]

[209.85.208.197 listed in will-spam-for-food.eu.org]

[209.85.208.197 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[209.85.208.197 listed in dnsbl.ahbl.org]

[209.85.208.197 listed in dnsbl.ahbl.org]

[209.85.208.197 listed in dnsbl.ahbl.org]

[209.85.208.197 listed in dnsbl.ahbl.org]

[209.85.220.65 listed in dnsbl.ahbl.org]

[209.85.220.65 listed in dnsbl.ahbl.org]

[209.85.220.65 listed in dnsbl.ahbl.org]

[209.85.220.65 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[209.85.208.197 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[209.85.208.197 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[209.85.208.197 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[209.85.208.197 listed in dnsbl.ahbl.org]

2.5 URIBL_DBL_SPAM Contains a spam URL listed in the DBL blocklist

[URI: rankbeacon.xyz]

-0.0 SPF_PASS SPF: sender matches SPF record

1.7 URIBL_BLACK Contains an URL listed in the URIBL blacklist

[URI: rankbeacon.xyz]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

2.0 PDS_OTHER_BAD_TLD Untrustworthy TLDs

[URI: rankbeacon.xyz (xyz)]

0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider

[anaya.singh3226(at)gmail.com]

0.0 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level mail

domains are different

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[209.85.208.197 listed in list.dnswl.org]

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[209.85.208.197 listed in wl.mailspike.net]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[209.85.208.197 listed in bl.score.senderscore.com]

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

1.0 BULK_RE_SUSP_NTLD Precedence bulk and RE: from a suspicious TLD

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

-1.0 MAILING_LIST_MULTI Multiple indicators imply a widely-seen list

manager

0.5 FROM_SUSPICIOUS_NTLD From abused NTLD

0.2 FREEMAIL_FORGED_FROMDOMAIN 2nd level domains in From and EnvelopeFrom

freemail headers are different

Subject: {SPAM?} Re: Few improvements for your website !!!



--000000000000a491e00659917b48

Content-Type: text/plain; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable



Just following up on my last email regarding a few website improvements

that could help increase your traffic, leads, and conversions.



I still have the quick snapshot ready for you.



Reply =E2=80=9COK =E2=80=93 SEND=E2=80=9D *and I=E2=80=99ll share it over.



Thanks,



On Sat, 25 Jul 2026 at 21:59, Anaya Singh wrote=

:



> Hi,

>

> Many local businesses are missing opportunities because they're not

> visible enough online.

>

> We help businesses generate more calls, inquiries, and customers through

> Google.

>

> Reply "Sure" and let's connect.

>

> Thanks,

>



To unsubscribe from this group and stop receiving emails from it, send an e=

mail to google_seo+unsubscribe@rankbeacon.xyz.



--000000000000a491e00659917b48

Content-Type: text/html; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable



Just following up on my last email regarding a=C2=A0=

few website improvements that could help increase your traffic, leads, and =

conversions.

I still have the=C2=A0quick snapshot ready for yo=

u.

Reply=C2=A0=E2=80=9COK =E2=80=93 SEND=E2=80=9D=C2=A0and=

I=E2=80=99ll share it over.

Thanks,



=3D"gmail_quote gmail_quote_container">

">On Sat, 25 Jul 2026 at 21:59, Anaya Singh <
gh3226@gmail.com">anaya.singh3226@gmail.com> wrote:

uote class=3D"gmail_quote" style=3D"margin:0px 0px 0px 0.8ex;border-left:1p=

x solid rgb(204,204,204);padding-left:1ex">
Hi,

Many=

local businesses are missing opportunities because they're not visible=

enough online.

We help businesses generate more calls, inquiries, a=

nd customers through Google.

Reply "Sure" and let's co=

nnect.

Thanks,










To unsubscribe from this group and stop receiving emails from it, send an e=

mail to google_seo=

+unsubscribe@rankbeacon.xyz.




--000000000000a491e00659917b48--

Webroot phish from Google Gmail

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Fri, 21 Aug 2026 11:09:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.5 (FreeBSD))

(envelope-from )

id 1wxSjD-000000006nQ-3ghW

for dave@doctor.nl2k.ab.ca;

Fri, 21 Aug 2026 11:08:27 -0600

Resent-From: The Doctor

Resent-Date: Fri, 21 Aug 2026 11:08:27 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-pl1-f175.google.com ([209.85.214.175]:51253)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.99.5 (FreeBSD))

(envelope-from )

id 1wxQPO-00000000LqF-04oP

for doctor@nl2k.ab.ca;

Fri, 21 Aug 2026 08:40:00 -0600

Received: by mail-pl1-f175.google.com with SMTP id d9443c01a7336-2cc891373e0so12796385ad.2

for ; Fri, 21 Aug 2026 07:39:02 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=gmail.com; s=20251104; t=1787323136; x=1787927936; darn=nl2k.ab.ca;

h=priority:importance:subject:from:to:mime-version:date:message-id

:mime-version:content-type:from:to:cc:subject:date:message-id

:reply-to:content-type;

bh=gzENY788Lsx7EdfBBjpqZuiSda+fg3F+AC83XFhhs7Y=;

b=f5o8OGmBg8ExiU+Sb+AAIBphXs+hrz1GdkPynMFcPXd+x7ytKkJJWPweFYafYXNY2v

vTioD4slk1mz4qKjpvQ738FTVpW1T47B5V+Ze1UMsneeFNId18Wadc9fmfES/aKsF2c6

24xAzQbuRlLMQ1Fs21qepA1tAVr27+OKFoT9QF/5IwDmmx+azGHkaga41X/+lqAvjG/p

cTrjPMWSByFf3UlK6m+SsOCVSm9Qc2suIbnK6Gu/WrCP7Vzfl+1MTGwdbS85/5mAQ3bx

lcDgdpkSIoTvDVTVgFTjXy1NbAZR4qNMFmDg4hYbEgQhRaPis4/yWoVV+qnvoyHV8gxW

57Zw==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20251104; t=1787323136; x=1787927936;

h=priority:importance:subject:from:to:mime-version:date:message-id

:mime-version:content-type:x-gm-gg:x-gm-message-state:from:to:cc

:subject:date:message-id:reply-to:content-type;

bh=gzENY788Lsx7EdfBBjpqZuiSda+fg3F+AC83XFhhs7Y=;

b=jUKtzNcCFdd5OOjQmHrt011eAMIzUbroSzI1gjFeEDgFgrGfxpygGFTJVKCYi+1S1g

TP4EQQ7o5WVpu1WpOhYqko/8MwUaUO/bH3dUxEfgOh9TMKX2/bbUqUQs7aN933tQ5H1m

QWeyTsZIkiCtIUTLOnaUkse6nWYZCaX1tgJGGbyEkilA3kzkyXA2XlFsmDQcHG+qXHCs

yu8GmTIeYJ9uc2qo3sdyVEJTZc1eRodkWin9knqJ8BZd0Vx6JTzbGtuGFyJQASUEQUeC

NEXUgtE6ctEzL6sJtS25GSZzZcbas/QS9K3jLxzUUsY+N1ZDVdqCyhKGeo7Kb+eTERlC

6IDA==

X-Gm-Message-State: AFuF++m6OSJbh/8HUJxZ6rser483niRy1BT2XXlTKrct/kPHeZ6jngBc

SCWFL0IBzOwWzbEfVqjyOjVu156gZlT6Mlx4ZBaGdQXk7AKCRfZnQdVw17VMl7lR2UYbakZNs4p

OOgXn

X-Gm-Gg: AR+sD130W+soJsBltE1/X0AYvazbxS1UF1kC63uq17yAJT9Jf2PjslwMryP2/GwuOCO

kn9Il+ZLF5gMsqz+/d/aB9WD1Mvq75far8ZkG9XMX+ELmD8yMb9WZP5cuxpfyvWPYwNfzId+6+q

l+fJdzwjZpv1c2Spcf8cyi5WZQgX0uYAi9EH5kHRBQOMgQCSwGBhmWp3aKjsTTbkMlmxlhk9tib

fHK/xP8uRKAuCc5W8hx1wE9bGyKUH7IG4MldlkQpLIv91XFpzuv+jhdgYXJYWRbFCLzZ+YBhtFT

bcZf9IeDGyCgc0m35IWUyxPBHUwS3509FEojyo+S3AjRz9lwmJkIH1JvWm0D88HnWmtIkLoZRDp

2gG1CYgK+wVIUp+xT1YFJEe9Arw+H7F13MjqbzU3SQOIY7dUQG0yl9oIKtvo4ETdnlG3E8DA6pS

enxtmvthhEL2YzmhtUoQYRRY6EHj5eSezM4D+y1U7cC0Kwcsk4yEDSJgV6n8hfj9AzUZnCzOPjF

gbWepGxY1l6Z4LmDzNvVYqqc/JcExVe+1zoNVQ=

X-Received: by 2002:a17:903:b07:b0:2d0:8b28:517c with SMTP id d9443c01a7336-2d64ade4afdmr135056985ad.3.1787323136204;

Fri, 21 Aug 2026 07:38:56 -0700 (PDT)

Received: from [172.26.17.98] ([49.51.191.79])

by smtp.gmail.com with ESMTPSA id 5a478bee46e88-327c98ba384sm24080079eec.30.2026.08.21.07.38.55

for

(version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256);

Fri, 21 Aug 2026 07:38:55 -0700 (PDT)

Content-Type: multipart/mixed; boundary="===============4507908623042572438=="

MIME-Version: 1.0

Message-ID: <9c137902804641efa25302f3d63d37d3@gmail.com>

Date: Fri, 21 Aug 2026 09:38:54

MIME-Version: 1.0

to: Doctor

from: Doctor

subject: Your Order has been paid

Importance: normal

Priority: normal



--===============4507908623042572438==

Content-Type: text/html; charset=utf-8

Content-Transfer-Encoding: 7bit

MIME-Version: 1.0













































--===============4507908623042572438==--

Chinese products spam

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Fri, 21 Aug 2026 11:11:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.5 (FreeBSD))

(envelope-from )

id 1wxSkl-00000000708-0UJ4

for dave@doctor.nl2k.ab.ca;

Fri, 21 Aug 2026 11:10:03 -0600

Resent-From: The Doctor

Resent-Date: Fri, 21 Aug 2026 11:10:03 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from out21-142.dm.aliyun.com ([115.124.21.142]:31095)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.99.5 (FreeBSD))

(envelope-from )

id 1wxQnO-00000000Pu0-2oga

for doctor@nl2k.ab.ca;

Fri, 21 Aug 2026 09:04:49 -0600

X-AliDM-RcptTo: ZG9jdG9yQG5sMmsuYWIuY2E=

Feedback-ID: default:vip@vip.eclatkelly.ltd:alibabak_WebBatch:512266

DKIM-Signature:v=1; a=rsa-sha256; c=relaxed/relaxed;

d=vip.eclatkelly.ltd; s=aliyun-cn-hangzhou;

t=1787324623; h=Date:From:To:Message-ID:Subject:MIME-Version:Content-Type;

bh=woW2lpZi+RwOGYVyREsJiB1hOAzkIvY3yQz/JlwTDVc=;

b=nudL1zXPKRgtUZ+JkQ/p61+xcGNG0iTMKgxCUWhbu4wPqeXizL0popCfw3vcYY6M5HwS58HfalfLb+Ur9QwY5g1niQkqlsAVHP76f+bXL09PXZtrrL6R2cX0GO5DXX/P8Vj/wPkDt+vZMMtqS0aR+S3GlM2dnYBFOv5m7Kt7HcE=

DKIM-Signature:v=1; a=rsa-sha256; c=relaxed/relaxed;

d=dm-fbl.aliyuncs.com; s=feedback;

t=1787324623; h=Date:From:To:Message-ID:Subject:MIME-Version:Content-Type;

bh=woW2lpZi+RwOGYVyREsJiB1hOAzkIvY3yQz/JlwTDVc=;

b=y5bi+3YvcVeBgJcrGs6nUZ0Nj6MzVYN8Dr0ln/hhC6uWIacCGkuv6a3+Ug3YY86xvR7g17fBSXXrEwxROlAwukLVWkHp2ICpCUgGEefBPHpNNttrjOtCx5tJmhKLkrN/mDM1WD1NGoHfnEhI9cCakuz2/t/LmV8n21jP3qx5ANE=

Received: from chitu-hsf(mailfrom:vip@vip.eclatkelly.ltd fp:ma_600000349084952820 cluster:AY35D)

by smtp.aliyun-inc.com(127.0.0.1);

Fri, 21 Aug 2026 23:02:24 +0800

Date: Fri, 21 Aug 2026 23:02:24 +0800

From: "Kelly"

To:

Reply-To:

Message-ID: <730c0903-b4ac-4f63-8600-fb5a69cdb865@alibaba.com>

Subject: =?UTF-8?B?TWFudWZhY3R1cmVyIG9mIFJEUCwgSFBNQywgUFZBLCBQUCBGaWJlcnM=?=

X-Priority: 3

MIME-Version: 1.0

X-EnvId: 600000349084952823

X-AliDM-Settings: eyJPdXRib3VuZElwIjp7IklwTGlzdCI6W10sIklwUG9vbElkIjoiIn0sIlVuc3Vic2NyaWJlIjp7IkZpbHRlckxldmVsIjoiZGVmYXVsdCIsIkxpbmtUeXBlIjoiZGVmYXVsdCJ9LCJWZXJzaW9uIjoiMS4wIn0=

Content-Type: text/html; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable

X-Spam_score: 6.1

X-Spam_score_int: 61

X-Spam_bar: ++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Dear Purchasing Team, We are Tianjin Eclat Co., Ltd. Supplying

global chemical distributors and formulators, we offer stable, high-spec

raw materials ideal for the North American market. We mainly produce high-purity

addit [...]



Content analysis details: (6.1 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[115.124.21.142 listed in will-spam-for-food.eu.org]

[115.124.21.142 listed in will-spam-for-food.eu.org]

[115.124.21.142 listed in will-spam-for-food.eu.org]

[115.124.21.142 listed in will-spam-for-food.eu.org]

[115.124.21.142 listed in will-spam-for-food.eu.org]

[115.124.21.142 listed in will-spam-for-food.eu.org]

[115.124.21.142 listed in will-spam-for-food.eu.org]

[115.124.21.142 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[115.124.21.142 listed in dnsbl.ahbl.org]

[115.124.21.142 listed in dnsbl.ahbl.org]

[115.124.21.142 listed in dnsbl.ahbl.org]

[115.124.21.142 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[115.124.21.142 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[115.124.21.142 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[115.124.21.142 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[115.124.21.142 listed in dnsbl.ahbl.org]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[115.124.21.142 listed in bl.score.senderscore.com]

-0.0 SPF_PASS SPF: sender matches SPF record

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[115.124.21.142 listed in wl.mailspike.net]

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

0.4 SALES_REPLY Your parents named you sales?

0.6 J_CHICKENPOX_93 BODY: 9alpha-pock-3alpha

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[115.124.21.142 listed in list.dnswl.org]

0.0 HTML_MESSAGE BODY: HTML included in message

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 MIME_QP_LONG_LINE RAW: Quoted-printable line longer than 76 chars

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

0.6 HTML_MIME_NO_HTML_TAG HTML-only message, but there is no HTML tag

2.0 RATWR8_MESSID Message-ID with excessive dashes and dollars

0.0 UNPARSEABLE_RELAY Informational: message has unparseable relay lines

Subject: {SPAM?} =?UTF-8?B?TWFudWZhY3R1cmVyIG9mIFJEUCwgSFBNQywgUFZBLCBQUCBGaWJlcnM=?=



Dear Purchasing=

Team,

 


tyle=3D"font-size:16px">We are Tianjin Eclat Co., Ltd. Supplying global c=

hemical distributors and formulators, we offer stable, high-spec raw materials=

ideal for the North American market. We mainly produce high-purity additives(=

PVA, CMC, PP Fibers, HPMC, PCE, etc.)


px"> 

 Brief introductio=

n of Tianjin Eclat., Ltd is:

=E2=80=

=A2 specializing in
yle=3D"color: rgb(0, 0, 255);"> 
5);">construction additives since 1992
55);"> 

=E2=80=A2
style=3D"color: rgb(0, 0, 255);"> 
255);">11 automated production lines
5);"> and 12 reaction kettles


e:16px">=E2=80=A2 
le=3D"color: rgb(0, 0, 255);">annual output of 114,000 tons

<=

p>=E2=80=A2 
, 255);">ISO9001, ISO
n style=3D"color: rgb(0, 0, 255);">14001
255);">, ISO45001 certified
an>.
: rgb(0, 0, 255);"> 


e:16px"> 

Types of our produc=

ts are:

=E2=80=A2 
=3D"color: rgb(0, 0, 255);">HPMC - viscosity: 300 - 240,000 mPa.s<=

/span>

=E2=80=A2 
r: rgb(0, 0, 255);">HEMC: viscosity: 700 - 6400 mPa.s


n style=3D"font-size:16px">=E2=80=A2 
;">PVA powder: 0588, 1788, 1799, 2488, 2499


"font-size:16px">=E2=80=A2 PCE pow=

der: solid content - 98%-99%


">=E2=80=A2 PP Fibers: 3mm-=

19mm

=E2=80=A2
r: rgb(0, 0, 255);">RDP powder: Flexible, semi-flexible, rigid, Hydroph=

obic



in-left: 9px;margin-right: 9px;border: none">
r style=3D"height:88px">=


gn=3D"top" colspan=3D"2" style=3D"width: 484px;padding: 0 7px;border-width: 1p=

x;border-color: windowtext">


-size:16px;;font-family:times new roman">Why choose us?


;padding: 0 7px;border-left-width: 1px;border-left-color: windowtext;border-ri=

ght-width: 1px;border-right-color: windowtext;border-top: none;border-bottom-w=

idth: 1px;border-bottom-color: windowtext">


nt-family:times new roman">=E2=80=A2 Offer direct factory source <=

/p>

=E2=80=A2&nbs=

p;OEM packing


w roman">=E2=80=A2 Technical support


e:16px;font-family:times new roman">=E2=80=A2 Customized formulations sup=

port


ding: 0 7px;border-width: 1px;border-color: windowtext">


-size:16px;font-family:times new roman">=E2=80=A2 Free samples

=

=E2=80=A2 D=

irect factory shipment


times new roman">=E2=80=A2 One-stop mixed container dispatch


>=E2=

=80=A2 
">Reliable Strict QA for each batch


tives-2.jpg" _src=3D"https://i.postimg.cc/jtvyYVrN/Construction-additives-2.jp=

g" referrerpolicy=3D"no-referrer"/>



:16px">Please feel free to contact us for quotations with TDS, free testing sa=

mples, or OEM and trial order inquiries.


:16px"> 

Best wishes
p>

 


ze:16px">Kelly

Tianjin Eclat Co., =

Ltd

WhatsApp and WeChat: +86155225=

15351


577775&env=3D600000349084952823&mac=3D512266&mf=3Dvip%40vip.eclatkelly.ltd&msg=

id=3D730c0903-b4ac-4f63-8600-fb5a69cdb865%40alibaba.com&sac=3D0&tag=3D57-chemi=

cal-2&tid=3D2577775&to=3Ddoctor%40nl2k.ab.ca&tpl=3D&ts=3D1787324544&type=3D1&u=

rl=3D&v=3D1.0&sign=3Da4a1984c7e0b0dd1772d1b89ff1fdf2d&urlts=3D1787324623" alt=3D=

"" style=3D"display: none; width: 1px; height: 1px;" />

Geek Squad phish from Google Gmail

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Fri, 21 Aug 2026 11:10:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.5 (FreeBSD))

(envelope-from )

id 1wxSjm-000000006sH-0len

for dave@doctor.nl2k.ab.ca;

Fri, 21 Aug 2026 11:09:02 -0600

Resent-From: The Doctor

Resent-Date: Fri, 21 Aug 2026 11:09:02 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-pf1-f182.google.com ([209.85.210.182]:55723)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.99.5 (FreeBSD))

(envelope-from )

id 1wxPQY-00000000P6p-3u87

for doctor@nl2k.ab.ca;

Fri, 21 Aug 2026 07:37:09 -0600

Received: by mail-pf1-f182.google.com with SMTP id d2e1a72fcca58-84a652535dcso548446b3a.3

for ; Fri, 21 Aug 2026 06:36:12 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=gmail.com; s=20251104; t=1787319366; x=1787924166; darn=nl2k.ab.ca;

h=priority:importance:subject:from:to:mime-version:content-type:date

:message-id:from:to:cc:subject:date:message-id:reply-to:content-type;

bh=+mXOZh4U8l5lIq+KgnekAKS4/ObtBECEpKlBDlkJg28=;

b=KYcbKoxrTLD9zFpzKlWA8O8KkA7EZLQmZ3LialgkTH0jvzLKi9lZ2sZsZpkWlO2MY8

gs3nMQhh8KZ2VIltvO8miFpFAbKds2Vrtr6o/TOvsy9C3WmBs5xRyjouExa+cQ2gadZV

CJo6bqNF7qovVqLFCFkoackBBBkUNzNKHyj0ssf25zQH5QlxoiI6u06oWiG8o4gyyEQr

JReutFuSCoCLEv+O5pyJrrUxJ8ByPug/ljfprsEbc4nERNcQlv/1Sl3LsaciJqqRS9F+

POTk4NVBzEyHTAqkYnFSfDRbHJ833+ztKvf2F+77qb/sbkF6iMHadIdtG4LBh4RW3Ke4

fP6Q==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20251104; t=1787319366; x=1787924166;

h=priority:importance:subject:from:to:mime-version:content-type:date

:message-id:x-gm-gg:x-gm-message-state:from:to:cc:subject:date

:message-id:reply-to:content-type;

bh=+mXOZh4U8l5lIq+KgnekAKS4/ObtBECEpKlBDlkJg28=;

b=bLT4sboLzS3htk99Y2TUZvv8Qkq1zB+K2ychuvBMZr09LK3yupEx8GfSRsWC2eZWwW

4DtnW2mluOT1R7TG/a8dj36pDrRBpH/dYl0rvXRNDurhE67mvK/Cu82mYa5IQXqCg5f8

vtSrGcBncEsQlGr3vcfU1xT9oDt3TGTA1UhXCBzG/Xdz4QHxhts+joj/rpiCJ+3YGO0H

Y/obAbVCoZ2VGDuc6fqyFxIlOId6xFYG2SUtVRlSiMocmHYPk26Lxl7JrJ8vzgMcHvaf

R1UnZY/snSqTSNLjnqTcyBOHO0IO70/xG7/1nTQ2twQxLCo8wEiXw6l8mxv8DcUm4U8W

dXGQ==

X-Gm-Message-State: AFuF++loV45UoPo5ny0BOrsAqZkSLqlTpUUVfN84MUDj1RdwLq2uRsDr

VRwmW0fR5vw24l/QY1erkHkwKB5ct+0MSqqH8g56Ngf2GSie6NtM+wlWyGuIvVnYEV4=

X-Gm-Gg: AR+sD113sL5qhz6e+E4YINE9BGC65PvOziSnANHghvFgVfUKaJiIJ6aK/K//CyKVd+o

IsrWk0oD2OhT3dgVsJZBEtQ3sdhEGXyQTSH23Hw7ffQIvU8RjxJVr1OyiGh1FQwOUxZUSt0WO2d

LtEmtvY/iRM3RICZ9YMRo/D7mlES/W5F5a0q3Kbrztd16Thk2PckeVauhxCeSEehf7fjpVtzBY0

4tyZyMAmfPjnPCQPjgZCaCK1jvH6Vh1xA07skFWZsTuxDtnnD2F1PaybrnhRhFWmOZsVQVqskGu

jG198MOnFy45g6cGujxrvk1BvtPsJ6w1vFJviMgLbBvLVkSFnB2lkbmNtB5Z/YKoCDElrPNZ50q

TGOfFYiR3YxwVKvvsUfVbzxkFBdsu5CeoQjzXbwAbScgTyo+L4PdwwK5nINRYeUDOezWxjYuHQl

7q46rzj3twMoH1T7gCcyG6Wr46v9codceTvFe9g7LXqLlGMUokAfrmDYhzMH7fonfismWGfmDaC

MgQ24brSf2RaL0ZjDH45n8FDnVGFRr3

X-Received: by 2002:a05:6a00:1bc5:b0:845:e9e8:645c with SMTP id d2e1a72fcca58-851f9ccd34emr11156745b3a.6.1787319366081;

Fri, 21 Aug 2026 06:36:06 -0700 (PDT)

Received: from [172.29.2.185] ([43.133.253.56])

by smtp.gmail.com with ESMTPSA id d2e1a72fcca58-851d366f028sm2891066b3a.53.2026.08.21.06.36.05

for

(version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256);

Fri, 21 Aug 2026 06:36:05 -0700 (PDT)

Message-ID: <6a885445.400acb00.28821.7a14@mx.google.com>

Date: Fri, 21 Aug 2026 06:36:05 -0700 (PDT)

Content-Type: multipart/mixed; boundary="===============5456860123192664044=="

MIME-Version: 1.0

to: Doctor

from: Doctor

subject: Renewal #68712137 Account Information Is Recorded

Importance: normal

Priority: normal

X-Spam_score: 7.3

X-Spam_score_int: 73

X-Spam_bar: +++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Geek Squad Care & Protection Plan Transaction date: Friday,

August 21, 2026 21:36:03 Transaction : 68712137 The latest service period

now appears in your account. Hey Doctor,



Content analysis details: (7.3 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[43.133.253.56 listed in will-spam-for-food.eu.org]

[43.133.253.56 listed in will-spam-for-food.eu.org]

[43.133.253.56 listed in will-spam-for-food.eu.org]

[43.133.253.56 listed in will-spam-for-food.eu.org]

[43.133.253.56 listed in will-spam-for-food.eu.org]

[43.133.253.56 listed in will-spam-for-food.eu.org]

[43.133.253.56 listed in will-spam-for-food.eu.org]

[43.133.253.56 listed in will-spam-for-food.eu.org]

[209.85.210.182 listed in will-spam-for-food.eu.org]

[209.85.210.182 listed in will-spam-for-food.eu.org]

[209.85.210.182 listed in will-spam-for-food.eu.org]

[209.85.210.182 listed in will-spam-for-food.eu.org]

[209.85.210.182 listed in will-spam-for-food.eu.org]

[209.85.210.182 listed in will-spam-for-food.eu.org]

[209.85.210.182 listed in will-spam-for-food.eu.org]

[209.85.210.182 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[209.85.210.182 listed in dnsbl.ahbl.org]

[209.85.210.182 listed in dnsbl.ahbl.org]

[209.85.210.182 listed in dnsbl.ahbl.org]

[209.85.210.182 listed in dnsbl.ahbl.org]

[43.133.253.56 listed in dnsbl.ahbl.org]

[43.133.253.56 listed in dnsbl.ahbl.org]

[43.133.253.56 listed in dnsbl.ahbl.org]

[43.133.253.56 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[209.85.210.182 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[209.85.210.182 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[209.85.210.182 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[209.85.210.182 listed in dnsbl.ahbl.org]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[209.85.210.182 listed in list.dnswl.org]

-0.0 SPF_PASS SPF: sender matches SPF record

0.8 ZMIvirSobY_SUB39 SPAM from Sober-Y-Virus

0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends in

digit

[mminhajmolla623(at)gmail.com]

0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider

[mminhajmolla623(at)gmail.com]

2.0 TVD_PH_REC BODY: Message includes a phrase commonly used in phishing

mails

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-0.0 RCVD_IN_MSPIKE_H3 RBL: Good reputation (+3)

[209.85.210.182 listed in wl.mailspike.net]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[209.85.210.182 listed in bl.score.senderscore.com]

-0.0 RCVD_IN_MSPIKE_WL Mailspike good senders

1.5 TVD_PH_BODY_ACCOUNTS_PRE The body matches phrases such as "accounts

suspended", "account credited", "account

verification"

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

0.0 NO_RDNS2 Sending MTA has no reverse DNS

1.4 MALFORMED_FREEMAIL Bad headers on message from free email service

0.0 T_MXG_LOWER_HDR_SPAM Lower case header spam

Subject: {SPAM?} Renewal #68712137 Account Information Is Recorded



--===============5456860123192664044==

Content-Type: text/plain; charset="us-ascii"

MIME-Version: 1.0

Content-Transfer-Encoding: 7bit



Geek Squad Care & Protection Plan Transaction date: Friday, August 21, 2026 21:36:03

Transaction : 68712137



The latest service period now appears in your account.



Hey Doctor,



This communication provides a summary of the Membership information currently maintained for your Geek Squad's account for the applicable One Year service period. The account records show an associated amount of $248.53 in connection with the membership.



The selected FortressAxis Premium plan remains listed with the services and features associated with your current membership.



Purchase Verification Record

Membership Reference:- 600895

Selected Plan:- FortressAxis Premium

Quantity on Record:- 3x

Service Period:- One Year

Membership Status:- Active

Amount Recorded:- $ 248.53



The information above reflects the membership details currently maintained within the applicable account records.



For questions concerning your Membership, account information, billing records, or related services, please contact our customer support team at 1 812 552 8828.



Sincerely yours,

Kim Tyus



(c)2026 Company. All rights reserved.

Company Address: 8189 Center St Lithonia Ga 30058-7627 United States

--===============5456860123192664044==--

Bookkeeper accountant spam from Microsoft Outlook

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Fri, 21 Aug 2026 08:29:01 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.5 (FreeBSD))

(envelope-from )

id 1wxPPM-00000000Nur-3J01

for dave@doctor.nl2k.ab.ca;

Fri, 21 Aug 2026 07:35:44 -0600

Resent-From: The Doctor

Resent-Date: Fri, 21 Aug 2026 07:35:44 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-uksouthazolkn19011079.outbound.protection.outlook.com ([52.103.37.79]:14160 helo=LO2P265CU024.outbound.protection.outlook.com)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.99.5 (FreeBSD))

(envelope-from )

id 1wxLIO-000000000X1-1S4d

for root@nk.ca;

Fri, 21 Aug 2026 03:12:26 -0600

ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none;

b=CeLFo0ersRMIll1Eb2JvTCo+O91U+oi+1C7AMxU4dda3n2RIj6uwf/MoZivqH+amtJEuKf344g25Zm7/H9s1ZxeTGv5LDjJOEL6gjDy77qsPDafx6Gim1BgOGCbSB3Yw4FjNxZRlsivNSkLk4F5VTNCyerQUTnPQdCtxjh7Y6l3cG9ckV1qKycPyw+NEwWIBuFsiqWNRRLUDA5ICnPiuIlxGRlPh91Z4nhdwhVhhRqZeB/1eC5oiHf6LapxRtILehurq3eurYo0PUZD3c6jCb5d92huE8zQlqXfCxTdjQ61R2AIc6ix+Be4V83AlRoKxKPb0VYbXPJ1Y2kZS2mf3+g==

ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;

s=arcselector10001;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1;

bh=E5yXugrOyb5NawuThAB1UpcrhvXqgGYMmAUADDwmQl0=;

b=jWwZuxGp54H4jAP8YeYXdajKvFct18yXsyZUQDccdw5V8F7BDMPVOsPNKK8u0+SCemEAo3VONVuN20FtefMtl51np6UCYI6G6id3ac7LTRZ9/F24nDQUz3OqW6ZxjNNy6HdW9LtOfdboATwMMGx27uff+6yGe84hNtfQQB9knqq+XvU97FM55gHwN/3OxfhgXjKtdtJFZ3YGdJQdzP7jPkngrjGHLgVLIomGu+xGssVa/ILJGJFi8N5KTDDl9G3291cijikarvhcdg1zaZi9QfHFr4J2KY2X1UczWk34CaQ2xfHTtl3xoEBmV/SvkNuFO/vU9YAkxMW03F1ujwup6g==

ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=none; dmarc=none;

dkim=none; arc=none

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=outlook.com;

s=selector1;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck;

bh=E5yXugrOyb5NawuThAB1UpcrhvXqgGYMmAUADDwmQl0=;

b=aCJQTv7FTFg101ifIN0BUVPjSts5mJ9spTVmGrWhi/IL0iiLpuFF53pRd8nhZrYmD2Ly4c/fmdxvz2vhWzy2zIXoijI1BqretCSnxJxxrP6tXWp1hUDP05AM1UkE47Qj4krO+8sRMllBKbtr6r3AZKSVivuJYskDs1zSQtxC+ExzLiSurz2vCg48xswWOG734cn4ynrwIcIaXwUPlVW/2P+Vhy9lTqn0tde1e6fzptLoll+44wbdjIueu8BsmQ34VrhzajWIvZyZXxATGfDQoaZqBTHgq/K577790aAy0V64mSQ5RV4qe2Jz24QxkV5T7uIkFBlv7xp2s/lIkn6nEQ==

Received: from CW1P302MB2415.GBRP302.PROD.OUTLOOK.COM (2603:10a6:400:274::7)

by LO0P302MB1629.GBRP302.PROD.OUTLOOK.COM (2603:10a6:600:40b::9) with

Microsoft SMTP Server (version=TLS1_2,

cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.339.11; Fri, 21 Aug

2026 09:11:16 +0000

Received: from CW1P302MB2415.GBRP302.PROD.OUTLOOK.COM

([fe80::392d:b3f2:7e0e:b7c4]) by CW1P302MB2415.GBRP302.PROD.OUTLOOK.COM

([fe80::392d:b3f2:7e0e:b7c4%4]) with mapi id 15.21.0339.010; Fri, 21 Aug 2026

09:11:15 +0000

From: Sofiya khan

To: Sofiya khan

Subject: RE: Full/Part - Time Bookkeeper/ Accountant?

Thread-Topic: Full/Part - Time Bookkeeper/ Accountant?

Thread-Index: AQHdL6neOP7dXIiSj0+mCkthDExUu7amaxLggAHPbMA=

Disposition-Notification-To: Sofiya khan

Date: Fri, 21 Aug 2026 09:11:15 +0000

Message-ID:



References:













































In-Reply-To:



Accept-Language: en-US

Content-Language: en-US

X-MS-Has-Attach:

X-MS-TNEF-Correlator:

x-ms-publictraffictype: Email

x-ms-traffictypediagnostic: CW1P302MB2415:EE_|LO0P302MB1629:EE_

x-ms-office365-filtering-correlation-id: 2d2ea641-fe7f-4e64-e673-08deff64274b

x-microsoft-antispam:

BCL:0;ARA:14566002|4140399003|25010399006|12121999013|55001999006|19101099003|15080799012|13091999003|31061999003|39105399006|37011999003|24121999003|22091999003|19110799012|8060799015|8062599012|3412199025|440099028|102099032|31055399003|43065399003|40105399003|2607281247196008|18071099003|1710799026;

x-microsoft-antispam-message-info:

=?utf-8?B?REhFRmIrbUpKRFhueGFTRDF6dXdMUnlaT1hNWlJGTnVHcUMzNVB3MzMyYUEr?=

=?utf-8?B?aWtzVGplWWR5LzZpczFZdWxGRUxHblF2QTh3MWhReXp5K2hmM2FkWlBsMWZJ?=

=?utf-8?B?UXRFdTJDQnVCb0RDWmtOeFg4aFVTVlg3cnJGQUM3VFNYNE9wV1cxRHlSbzd4?=

=?utf-8?B?T3RvaEc3bFA2UUVaZUNVa25yeWo2bmhJa2FHSHIyaUxKWmFIaGtib0xsMWIv?=

=?utf-8?B?aWZRNVgvZkNTdms5TWI4c3J6N3RwSWpISTgwRllzWVd0RXVUMm82aEd1VkIx?=

=?utf-8?B?b1RNUU5wQ3RxTnV1d3BQTGc0RUNzbU1mUXRBSXNEVVBnUzFndkVVeDFCa0hY?=

=?utf-8?B?WGcwYkVCSW5tR0VoN3U1OVByenJuaUdxOFBzdEJWbm5qRUs0SGRIWmNxa0Rn?=

=?utf-8?B?R0hXL2xnN0RpRjR6VGdxeXFnL2JoMEQ1dysyYnNLdnlGMVpIZWlKTXd3MGEv?=

=?utf-8?B?RjV0UVhIVFFkb0RJOXJYb1VuZm5neWEzRHZCOURtRnRiQzZsOHZ5bWg2UU9B?=

=?utf-8?B?OHpJVE5tZmd1UEo3M2ltR2NlYlRxME9WV0VLOFRjdk1jYlRPNXBSUFRCa0U4?=

=?utf-8?B?cUFHTFZ2b3ZVd05DMlB0T1cyNkIwYjBzT0NSOWRuRmQ3SEd0aW00UzZNYjRE?=

=?utf-8?B?eklMT3Vjd29aODE5bUxueDBTb0xlVUtkOHBLbmlrRjY1NGloaG8rZzVSYVE4?=

=?utf-8?B?bFVYczRBbmJzQmEzbjUxN0hCMlAvU2kxaUxSUWdQZVZCWDJ1VE5MelVNNnJx?=

=?utf-8?B?cmkzOGV0dzdtZmVWTTd0NkJJRm93aExubzZXQlVPREhvd0RJWkdKWUUvSDNB?=

=?utf-8?B?RzdqaENKTDBrQ1prM0QxSVZnOXlQYjBjZW1FdzJyeVZLT2I1cCtIc0pWKzZP?=

=?utf-8?B?NEdvVGg5YmZWckVKOWlhUHF0ZkJkY2svNmVxYU5hY3o4MUsvMTYyOGFWdFhk?=

=?utf-8?B?RDRNYjgzemNJQ21xV1JqdkpaeHVGdlduNTNHZDI1SUY5Y3BoalFkbXNYZ3Mz?=

=?utf-8?B?cHJnQUw3K2FPenM4ZEhHLzJKN1p5VFp0L3VUVkN0amNnOSs5YVdVeEJoTGRw?=

=?utf-8?B?V2VlMW5kdktmZUZrM1VCaHcyMHJiZGNEaVNVbzNzWXIwbkRJelkyaENDTTVL?=

=?utf-8?B?RHl2Uzg0Q29PMFdmSUdPMFpXUm1EbU9nNUdTMHdWNE1EdXpra05LSjFZdGR3?=

=?utf-8?B?WWUrc2o0ZUY1ZWUwNGZ2cWNHVzRBUHZ4VWVYWXBYVk5OS2RORG1CN042eW56?=

=?utf-8?B?VWh0cURIbzZidVM2dkg2Wk10cWx4NElyTmJOaUlnTDVYSDRtRzZwOVcwZ0RQ?=

=?utf-8?B?SzhJQ2pRZzliSWdvM0ExUmJnVllINk54dG1pVTBEaWd4THFtRlJxSHdEclBY?=

=?utf-8?B?RkJEVkRJVnJmVW8rSDZHOXNwNThORHhYakpodEJIVTJDTUZNaml5ajNKWmJl?=

=?utf-8?B?NnRwR1ZpVjlIOU1maTBrY0E1T3R5Qi9ML05aUVZmb3N1SS9NcVVvQ0g1cjNW?=

=?utf-8?B?YUZ2cXRmSEN0R01JR2ZNOUxxY1RsbVpSNnBnaXd2NnBHVTk3OE90UlRWUS9s?=

=?utf-8?B?SkFycnd1OTBwRUptM0c2bGdUaThIR29QMlc5eExCQVQ2SnZFVnVEOSt4ZG9n?=

=?utf-8?B?U2NWQjJJZU55SU5WTzJvemlhb041WXJXRTVQaWd3blVvb2czaDF2TFQyNThL?=

=?utf-8?Q?naw5UNc+vQLgtRFK/e2S?=

x-ms-exchange-antispam-messagedata-chunkcount: 1

x-ms-exchange-antispam-messagedata-0:

=?utf-8?B?Yjd0QjZnZ2tNS3BMaCtuWFdHdGRxL0dEOWZoSlBFcnI4SExETUowMk53Tmdi?=

=?utf-8?B?alUyVXVEZ1JJWkNMSVI0aUhiNXpURXh2SkVnSnh3dHlPUGt1bEtmYzZjcXF4?=

=?utf-8?B?RG5iSHBIb1N4M3J3MDFQU1RwWFlmRElpYXBWdUNCNTd0N1BLUWpINy8wS2dX?=

=?utf-8?B?OHpOYy9jR1FXOVoxTzI3VmJjaVBYd3UwdkNnTkVXQmpsTGI1TmJheFd5b3Z5?=

=?utf-8?B?d0JoZyttbjRyc0QyQ2ZQYlhsSWlLVW9EZTUzd0p5bHlnNk82SG5BMHlUS25S?=

=?utf-8?B?a2hKbGw4NVd2RlNEYXhZM0h2ODkwWjdXUVM4MmJocmZuQmd0ejg2aGxhaTl4?=

=?utf-8?B?WU5vRUl4TUpFRGYvSWZrTGJoY2RWMDFjeFYxTWFuaFNNMGJrUVZYTFVINzNq?=

=?utf-8?B?b2xDcUdvOVQ0WVI5Z0U3aGQyeDFUQ2p1TCt2MHB5cmpCTWtCMHUxL0w5Sk4v?=

=?utf-8?B?aFF1dk56YjV4a1c1blFYc1ovdUFGZ24rYXJ3aGdab091NlhFWGFqNEQzSGRN?=

=?utf-8?B?clFRb2xRa0s5KzU3dVBOL1EvV0VXbThtOGpvcWgrL1g1d25ybEJNZVZMaVFn?=

=?utf-8?B?eWFTeUxqc2xOdmt1L1RtRHNqQ1p2OW9QcUp4dVhEc2pQSEFpdFRkeHQ5L3dy?=

=?utf-8?B?U3ltUUV0S0FIMXpScXJlYnNGQmxILzRqWkFBTmFuWUxpT1FBTDBZR3hURWN6?=

=?utf-8?B?VkZRZEIxaGxJWk1VNWdFTVo4WkRDQ1BzNURKSGlCc2hWOGNCMEh4NEROaEN5?=

=?utf-8?B?MUUzSzFiNFVHanFHMWxqdzNqOWhRZG4wYmxtUDl0YnJybVY1NkJHUVBMbGFo?=

=?utf-8?B?SXNjL0lMd0VoalI0NmlVTlE3anNQRENiUVdFNWNwRUlZckltWjNGZkszT25z?=

=?utf-8?B?Y2NIMWtENzhTLzNBQ1lXakNYWFptL3JjZXYrRFM2bDR6QmhqS0t4cDRnb0pH?=

=?utf-8?B?a1d3U0R0ZXlQWnBxMnp3dEFVU0lPZHJ3bEJXTzI0Nml5N2FtU2ZKa0ZiS2R3?=

=?utf-8?B?SHpTVHAxYjVORzJDakVHMHFzaTR1b2dEc045RlhSNUVTTlNUelB1RDFUam5U?=

=?utf-8?B?RlpMS2pOSWFVb1VuS2VML2h1d2lDVFZna2pMWjJ6L0pPWCs2aEhSWEtoRjFX?=

=?utf-8?B?ZzJOQUZQRUk3VDU4Zng2bXhMNjIrZE1jQ2JqL0c5SGRvV0ZwR1EveVRUWGpk?=

=?utf-8?B?YzN4d0wrdEF1WncrTk55dVJjSzltWDZJUERFRzJDcjVaT2N5ZkF3SHg2Um45?=

=?utf-8?B?aGk4ZlVZUG4wYmsxT2FuTXRvQ2k5QlhEMGlNNHpUbHlSajVXRHR0VGVDbGYz?=

=?utf-8?B?VytzVzlPVXl5WTJGUG5MVDgxclNGWE9SUzI5WUN6eGZiMnNLam9EeTdXd05I?=

=?utf-8?B?dG1aNkNKbURzMDcxYy9RNjhmSWdEWU81bkhaU2E4V1dvaTg0TEMyNHRsdktM?=

=?utf-8?B?WjJwV0hmbnBSU0RpQk54dnhBZTRtd1BLU0JNZGEzaHdRNzNsNUhCVmljU0Nj?=

=?utf-8?B?ZXNySkMrb2hkU3IrVmlHM0pjNkdZVHB2WGVPWnB5QWw4RnZHTkVXMFE3eFVR?=

=?utf-8?B?RzQxbkY5KzNJRkJtYThpNERkdEFENW5GZUxLbnI3eXZkV0tibmNhR29JL3FS?=

=?utf-8?B?WlR4cDdGQlU1RUU0dkJZM0J4Yjl0eGpmMzFCV2szVndXN1JkZ2hxdFdyeXB1?=

=?utf-8?B?bzVXcWRaeGZ5NjdHNXFzTTBqNUN5QU1jSkJIRUdMOTJtVHpJUVBDdzM3VVBs?=

=?utf-8?B?cWRlaXJoWGp5ajJnZ1haWkI3UGROM1I4RXpVZWhQcEdib3lOQ3FvbVZ0aGds?=

=?utf-8?Q?OKO392nDdOQr39BqVG5tqs/Mshv5IsP7Zyw74=3D?=

Content-Type: multipart/alternative;

boundary="_000_CW1P302MB2415D1792982736A3C0E806FE9A32CW1P302MB2415GBRP_"

MIME-Version: 1.0

X-OriginatorOrg: outlook.com

X-MS-Exchange-CrossTenant-AuthAs: Internal

X-MS-Exchange-CrossTenant-AuthSource: CW1P302MB2415.GBRP302.PROD.OUTLOOK.COM

X-MS-Exchange-CrossTenant-RMS-PersistedConsumerOrg: 00000000-0000-0000-0000-000000000000

X-MS-Exchange-CrossTenant-Network-Message-Id: 2d2ea641-fe7f-4e64-e673-08deff64274b

X-MS-Exchange-CrossTenant-originalarrivaltime: 21 Aug 2026 09:11:15.3823

(UTC)

X-MS-Exchange-CrossTenant-fromentityheader: Hosted

X-MS-Exchange-CrossTenant-id: 84df9e7f-e9f6-40af-b435-aaaaaaaaaaaa

X-MS-Exchange-CrossTenant-rms-persistedconsumerorg: 00000000-0000-0000-0000-000000000000

X-MS-Exchange-Transport-CrossTenantHeadersStamped: LO0P302MB1629





Hello,







Hope you're doing well.







We provide reliable accounting and finance support for businesses, including bookkeeping, Accounts Payable/Receivable, bank reconciliations, payroll, financial reporting, sales tax, 1099 filing, payroll tax filings, month-end/year-end close, QuickBooks (Online & Desktop), and tax-ready financials.







Our team ensures accurate, timely, and compliant financial management so you can focus on growing your business.







Would you prefer more details, or would a quick 15-minute call work better?







Best regards,



Sofiya Khan







From: Sofiya khan

Sent: Monday, August 17, 2026 1:09 PM

To: sofiya871@outlook.com

Subject: Accounting & Bookkeeping Made Easy







Hello,







Hope you are doing well.







Please, could you let me know whether you are interested to hire a Dedicated Remote Accountants or bookkeepers on full time or on hourly rates at a reasonable cost?







Our range of services include:







· Tax, Accounting, Bookkeeping & Year-end finalization



· Financial Reporting including Income & Expenditure Statement, Balance Sheet, & Cash Flow Statement, Bank Reconciliation & Payroll Processing.



· Tax Solutions etc.







Would you like me to send you more information, or would a quick 15-minute call work better for you?







Thanks,



Sofiya Khan

Social Media promotion spam from Google Gmail

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Fri, 21 Aug 2026 10:29:03 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.5 (FreeBSD))

(envelope-from )

id 1wxPPB-00000000MSy-3oLX

for dave@doctor.nl2k.ab.ca;

Fri, 21 Aug 2026 07:35:33 -0600

Resent-From: The Doctor

Resent-Date: Fri, 21 Aug 2026 07:35:33 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-wm1-f46.google.com ([209.85.128.46]:39674)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.99.5 (FreeBSD))

(envelope-from )

id 1wxKs6-00000000MUi-1I8I

for doctor@nl2k.ab.ca;

Fri, 21 Aug 2026 02:45:14 -0600

Received: by mail-wm1-f46.google.com with SMTP id 5b1f17b1804b1-4957952e0f8so683265e9.2

for ; Fri, 21 Aug 2026 01:44:17 -0700 (PDT)

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20251104; t=1787301851; x=1787906651;

h=content-type:date:mime-version:message-id:reply-to:subject:to:from

:x-gm-gg:x-gm-message-state:from:to:cc:subject:date:message-id

:reply-to:content-type;

bh=KZzRixupibr34hwcyU6nBd0gPCpdjO/EeSkT8w8xHxw=;

b=fU9q2RMrMdbODyP6eA1xRsjFJOb4cmmpqhmmmxR1AlddJiQWL1HdoZ1P1HbRaXkkzg

K4Mm/pLF+k67XFlq2613YHov7XQH3S59Ohk/ojv7lpZYlunLGqOmWomSNGqNqLrF0oQ8

lHB2yeUoV5MSJAdG/yS316jHL3ceOKaaYi/u531F2OvK+c2B6H5IgOjMOJ3qlqkiZM6+

A3DfTFWLY/hpRbB3n7ecdFnTaiegB2DARRoBSShcBZvi4jk5t4A75akO/JuN35ho8G48

Du5h9nHkYsfpKf0nDKomyh7xWpjdvJlDDgUpToIPzVKdLAuFh0tuAVC/DdOpSHvdW2nS

mU/Q==

X-Gm-Message-State: AOJu0Yy+muHM9QNv9c7tIHcMfh72P7LyGCv0SGvY/GbjBb/4LJ3y4vm3

wkieNWquSex2AGy1nhaSBxq8gzs3eEtpb1ifyNfr9knSczYLGYh3gbgWXauewi4D

X-Gm-Gg: AR+sD12avPzU79HxRsb1rii+UC5n/vQEfAPDaHI7mTlz+hk3LeUEg5PFfKqkXjEZMQR

7zdwvDtJSeRN5AfL8TeJnjz69aS1dfDdMqw8/31rikOqM7827yN4DBQ1/85fWtjX3CS/rDnUJQq

5/8YlHOqsOnjs8Cm8QH5bqrx5C61fsXKWMfytyNlDM6LlY01qxmIXMW3WIRtVJf/g10cFr38Yd6

kBVOJuYaWAbfSvgoA3N3h2z5UWndgATIGnkVdUBE24SA3uiFef33lGmMLX8fQU+n1uV/6mKKC7q

LGRzMiZGD/E30RILmOhRb4zM+wMnGI7WSQ2VpLsqtbFltKJJNDKdM9ylWvGIgiMuH2OUK63P90G

J7YBwDKr9yPqk7iI9oh3eiy0/zEA+gukDJWc+HtXCz/4MnAW56i0n87VGBnkA61VKEz4g6EBaau

gLZHpjESu7Min1olDBD93whVLU13qfncNNWBlVjdiwgoXnTewVAsyxeOTNr/o7TkdBcDJTUMZVK

a2oxnlFF9xPpR/HXyOoQgqE4m6KQzvlPfc=

X-Received: by 2002:a05:600c:1548:b0:499:59da:12b9 with SMTP id 5b1f17b1804b1-499b827237cmr33610475e9.0.1787301850626;

Fri, 21 Aug 2026 01:44:10 -0700 (PDT)

Received: from [127.0.0.1] (cpl109.main-hosting.eu. [93.127.192.152])

by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-499bda1cda1sm4286305e9.13.2026.08.21.01.44.09

for

(version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256);

Fri, 21 Aug 2026 01:44:10 -0700 (PDT)

From: Pixelesz

To: doctor@nl2k.ab.ca

Subject: Are you getting leads from your social media?

Reply-To: hello@pixelesz.com

Message-ID:

MIME-Version: 1.0

Date: Fri, 21 Aug 2026 08:44:10 +0000

Content-Type: multipart/alternative; boundary=f_54j-hi

X-Spam_score: 10.3

X-Spam_score_int: 103

X-Spam_bar: ++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Hello, I wanted to share a quick idea — your social media

presence could achieve greater impact with the right level of engagement.

We assist businesses in sustaining that without added effort on their part.

Would you like to explore how? Warm regards, Sameer Sehrawala +92 333 235

26 09



Content analysis details: (10.3 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[93.127.192.152 listed in will-spam-for-food.eu.org]

[93.127.192.152 listed in will-spam-for-food.eu.org]

[93.127.192.152 listed in will-spam-for-food.eu.org]

[93.127.192.152 listed in will-spam-for-food.eu.org]

[93.127.192.152 listed in will-spam-for-food.eu.org]

[93.127.192.152 listed in will-spam-for-food.eu.org]

[93.127.192.152 listed in will-spam-for-food.eu.org]

[93.127.192.152 listed in will-spam-for-food.eu.org]

[209.85.128.46 listed in will-spam-for-food.eu.org]

[209.85.128.46 listed in will-spam-for-food.eu.org]

[209.85.128.46 listed in will-spam-for-food.eu.org]

[209.85.128.46 listed in will-spam-for-food.eu.org]

[209.85.128.46 listed in will-spam-for-food.eu.org]

[209.85.128.46 listed in will-spam-for-food.eu.org]

[209.85.128.46 listed in will-spam-for-food.eu.org]

[209.85.128.46 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[209.85.128.46 listed in dnsbl.ahbl.org]

[209.85.128.46 listed in dnsbl.ahbl.org]

[209.85.128.46 listed in dnsbl.ahbl.org]

[209.85.128.46 listed in dnsbl.ahbl.org]

[93.127.192.152 listed in dnsbl.ahbl.org]

[93.127.192.152 listed in dnsbl.ahbl.org]

[93.127.192.152 listed in dnsbl.ahbl.org]

[93.127.192.152 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[209.85.128.46 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[209.85.128.46 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[209.85.128.46 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[209.85.128.46 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_CBL RBL: Received via a relay in cbl.abuseat.org

[Listed by XBL, see ]

1.5 RCVD_IN_SBL_XBL RBL: Received via a relay in Spamhaus SBL+XBL

[93.127.192.152 listed in sbl-xbl.spamhaus.org]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[209.85.128.46 listed in list.dnswl.org]

1.2 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a relay in bl.spamcop.net

[Blocked - see ]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-0.0 SPF_PASS SPF: sender matches SPF record

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends in

digit

[bitznpixelz059(at)gmail.com]

0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider

[bitznpixelz059(at)gmail.com]

0.0 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level mail

domains are different

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[209.85.128.46 listed in wl.mailspike.net]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[209.85.128.46 listed in bl.score.senderscore.com]

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

1.6 HTML_IMAGE_ONLY_12 BODY: HTML: images with 800-1200 bytes of words

0.5 FROM_SUSPICIOUS_NTLD From abused NTLD

0.2 FREEMAIL_FORGED_FROMDOMAIN 2nd level domains in From and EnvelopeFrom

freemail headers are different

0.1 HTML_SHORT_LINK_IMG_1 HTML is very short with a linked image

2.0 FROM_SUSPICIOUS_NTLD_FP From abused NTLD

0.0 T_REMOTE_IMAGE Message contains an external image

Subject: {SPAM?} Are you getting leads from your social media?



--f_54j-hi

Content-Type: text/plain; charset=utf-8

Content-Transfer-Encoding: quoted-printable



Hello,

I wanted to share a quick idea =E2=80=94 your social media presence cou=

ld achieve greater impact with the right level of engagement.

=20

=20

=20

We assist businesses in sustaining that without added effort on their p=

art. Would you like to explore how?

Warm regards,

Sameer Sehrawala

+92 333 235 26 09

--f_54j-hi

Content-Type: text/html; charset=utf-8

Content-Transfer-Encoding: quoted-printable




; max-width: 600px; margin: 0; text-align: left;">

Hello,



I wanted to share a quick idea =E2=80=94 your social media presence cou=

ld achieve greater impact with the right level of engagement.




tyle=3D"text-decoration: none;">


R-PK_fvv5a3.jpg" alt=3D"Pixelesz" style=3D"width: 100%; max-width: 600px; d=

isplay: block; border: 0;">




We assist businesses in sustaining that without added effort on their p=

art.

Would you like to explore how?



Warm regards,


Sameer Sehrawala


+92 333 235 26 09


382ee0a5161baca7fc39c27b1dafb3ea2781af098629d" width=3D"1" height=3D"1" sty=

le=3D"display:none" alt=3D"" />

--f_54j-hi--



Financial opportunities spam from Google Gmail

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Fri, 21 Aug 2026 08:29:01 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.5 (FreeBSD))

(envelope-from )

id 1wxPJs-00000000MHh-0XSu

for dave@doctor.nl2k.ab.ca;

Fri, 21 Aug 2026 07:30:04 -0600

Resent-From: The Doctor

Resent-Date: Fri, 21 Aug 2026 07:30:04 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-ej1-f51.google.com ([209.85.218.51]:50287)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.99.5 (FreeBSD))

(envelope-from )

id 1wxHPm-00000000BZS-42rG

for doctor@nl2k.ab.ca;

Thu, 20 Aug 2026 23:03:48 -0600

Received: by mail-ej1-f51.google.com with SMTP id a640c23a62f3a-c1671ec8692so90579466b.0

for ; Thu, 20 Aug 2026 22:02:06 -0700 (PDT)

ARC-Seal: i=1; a=rsa-sha256; t=1787288519; cv=none;

d=google.com; s=arc-20260327;

b=FAfGD2onxo58Qq6uo/T9MnyIYbrv1D6DDiVfWeE/gd8vPhm5ZMWcSBK/IxSmuRRBMM

V68tYhdcgcwt8tkmXdklbt92BDyxNglnnrey+cZoAhQfVowFia2MVk5F8Sy0jptWgj28

jf9SWDA84k/YwWQvcrC2iFiPkwQiHXbFmHtBIeaa2Cd+/EayJvVYhfxmFUNCjLqTgZnZ

saqgSR/TlSrQiSgtnjPF4m/tebncABHyyhXtfiswC9tbfURoVQ+RGeeS954Hf2SK061X

XyNbXKu9xbMkgo7KL8S0EyftPKFyP+HyaQSn0wmpvT+hBRDlZp47ibPAo3kySWV+uibJ

9wwg==

ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20260327;

h=to:subject:message-id:date:from:mime-version:dkim-signature;

bh=yH2dQclO8Bt484M/f/oQoy/VRhKpSAJbwLo3hM/Ez/M=;

fh=om1hgpMVWCoDnhIOYtJ/t1j1/ZqCdAW7PPY5lpMymSI=;

b=P98x6AQWv5z8TL1VnjBzv+BWr01OnAXQIFZrSYTofdNH7MZZ7mbudMEkT03LgPxStI

uRTNEYus2nN+a6mpGEA4ArY9n80EdeItcwFPPJNuhSRzTAgfulIDK3POJ8ab7NAfR7EN

soVPm0aSaqVsGguY7avqifvAc/uQTIpdfnH7epPYEFlnqXZyYey7eN8K9D7KyPdobr00

TyfZjSyBktFGO18blY4GCBOVVDqTXmCJgFxgMtO+5khWrjg1arrH2BmEh8+X1PxV6LkD

oCJ0UcLvIjJCSfkMA1yBC39IINAuz7DI0aX1JSaoQD1NUxLADs74SLbyNgNgX0zZ1/Wt

mEfg==;

darn=nl2k.ab.ca

ARC-Authentication-Results: i=1; mx.google.com; arc=none

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=gmail.com; s=20251104; t=1787288519; x=1787893319; darn=nl2k.ab.ca;

h=content-type:to:subject:message-id:date:from:mime-version:from:to

:cc:subject:date:message-id:reply-to:content-type;

bh=yH2dQclO8Bt484M/f/oQoy/VRhKpSAJbwLo3hM/Ez/M=;

b=WJm2ieAamtdvJpFMMAEzvkH3cQFom7xNOe4UwUjEa7ItEqfyIUfj81FBsLpLVdbUUh

R1Pusw8nipQTmuh9xz0cPauWl0ZEx2/lu5mki+LZYF2NEkWqL1UKWbmdd0ar/QP3MvPb

7RWiv4TsZwEz0InqwNQyF9X5+y/cRzTDp9GV5dIK127pHwEOBltWsw/lgOQx/nbtj8sJ

YhMwiTyW55/ZeP04sOndu3hMI6DuVTGVPeGr9pd4MDk8IJ41VugAgiyq2OnX5wnWwoDn

05AFWye8CdU9LuSZpQ+Ye/evWUb3BWTy8J7Tw+X5O6uQdM9XHCF8Sd/tiBA90MJm0JHz

HQcQ==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20251104; t=1787288519; x=1787893319;

h=content-type:to:subject:message-id:date:from:mime-version:x-gm-gg

:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to

:content-type;

bh=yH2dQclO8Bt484M/f/oQoy/VRhKpSAJbwLo3hM/Ez/M=;

b=TdLp2X16WjWs/KNveJLd4hsuhSvVl4j3MiwBoMs3Xk7lADg7D39AqIHCBMzKCjb7xt

dk84DxqvglPxLETF80gYrAXfnLG6+IiBwQc0YuTOJ4rUCLAI4Pj4rQtLdtIvjTnMDMxc

NrlPwbHijN8t2jCQsUrqzrNH/n28KwzcPV+J+MCBS9E2tOIu/h76XnkkJ9FhLHLlnsUi

43UKh6NIcWQ4Z1yRD0NupPMPJyWX8zLG+eT2pGkkajRa2RY+jhXGESctDQYqWBVsP/lZ

ZTzImLibCOp59HXfoo6OKfoxvWxN16oEmjm5wNOpOnO847iU8RjUHowzaBrMa18ZLyvk

owQA==

X-Forwarded-Encrypted: i=1; AHgh+RqG+8yRjRj4/ys6H6FKtCZU0QXM7nBaZkYj0Mks5bvkwJFu6JGtazqa3C8MziYm2Xzqer3SNjs=@nl2k.ab.ca

X-Gm-Message-State: AOJu0Yyc4rpqo0A7JI3dJqCIHKK7L82pB9xvgQ+w8b5L7e3FkFO/Mf9i

wa+2l3gv0YVfXoHfpc8PjqYQuceV3YjZ6uzj6H+eXQsm07g5safeh80lKSqXIYdywlJfe4PA5q1

JK8x6PX1jwRfOX/cR0pGVEppDC3q7AC0=

X-Gm-Gg: AR+sD104aOLr+WNQANwl665onHFXbJccxjF+31R0wyYhy5/RHB8dfkaJOuwU2fKUmv/

oLjTRoMkx/8q8Bev9BRKKC3yTMHtO8iUbRogkpAlEplmToi8zsil9UeMjDCqeiOWONYLzGcr2EC

mThgyO+Cx/ch24VsCp9F39IV3/zLrfwzaVzZPbwWyMEDJRWG3UbXhPODCkaKmo0JSjRUqI5LGmI

0JeV9lQk0Eu/wvZDiAt4ZG/Jmi3CZ9hBjMcrBq6eFjHGP3XicUvJmvcJl+dBFVFyDgGT7E1wQxV

Gpnt++xtfFP8Eh7nPpzJl9MVpshI7hjCnicPpOq3HqpW0w==

X-Received: by 2002:a17:907:3cc2:b0:c24:680a:1c42 with SMTP id

a640c23a62f3a-c246a4d3bb6mr360299566b.7.1787288519529; Thu, 20 Aug 2026

22:01:59 -0700 (PDT)

MIME-Version: 1.0

From: "Dr. Benz Mathias"

Date: Thu, 20 Aug 2026 22:01:51 -0700

X-Gm-Features: AcwNN1VhDrE6akYoLLYs9PsOkG8_Nj2lbdItIb4qQpt_3uC_H6nvP2AFusMPyM4

Message-ID:

Subject: Subject: Funding Opportunities We are reaching out to engage with

individuals, entrepreneurs, corporations, and investors, as well as start-up

owners, who are seeking financing for their projects. Our company is ready to

invest in viable initiatives and would be glad to share our terms and

conditions after reviewing your project plan and executive summary. If you

are committed to exploring this opportunity, please submit your project plan

and executive summary for our evaluation. Best regards, Dr. Benz Mathias

To: undisclosed-recipients:;

Content-Type: multipart/alternative; boundary="0000000000005158700659878957"

Bcc: doctor@nl2k.ab.ca

X-Spam_score: 9.4

X-Spam_score_int: 94

X-Spam_bar: +++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview:



Content analysis details: (9.4 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

2.3 EMPTY_MESSAGE Message appears to have no textual parts and no

Subject: text

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[209.85.218.51 listed in will-spam-for-food.eu.org]

[209.85.218.51 listed in will-spam-for-food.eu.org]

[209.85.218.51 listed in will-spam-for-food.eu.org]

[209.85.218.51 listed in will-spam-for-food.eu.org]

[209.85.218.51 listed in will-spam-for-food.eu.org]

[209.85.218.51 listed in will-spam-for-food.eu.org]

[209.85.218.51 listed in will-spam-for-food.eu.org]

[209.85.218.51 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[209.85.218.51 listed in dnsbl.ahbl.org]

[209.85.218.51 listed in dnsbl.ahbl.org]

[209.85.218.51 listed in dnsbl.ahbl.org]

[209.85.218.51 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[209.85.218.51 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[209.85.218.51 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[209.85.218.51 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[209.85.218.51 listed in dnsbl.ahbl.org]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[209.85.218.51 listed in list.dnswl.org]

-0.0 SPF_PASS SPF: sender matches SPF record

3.3 MIME_BOUND_DIGITS_15 MIME boundary contains all digits

1.5 GR_DOMAIN_UNDISC1 To contains undisclosed recipient (undisc)

0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends in

digit

[benzelmathias1(at)gmail.com]

0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider

[benzelmathias1(at)gmail.com]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 T_HK_NAME_FM_DR No description available.

0.8 SARE_FROM_SPAM_WORD3 I don't know people named this!

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

-0.0 RCVD_IN_MSPIKE_H3 RBL: Good reputation (+3)

[209.85.218.51 listed in wl.mailspike.net]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[209.85.218.51 listed in bl.score.senderscore.com]

-0.0 RCVD_IN_MSPIKE_WL Mailspike good senders

Subject: {SPAM?} Subject: Funding Opportunities We are reaching out to engage with

individuals, entrepreneurs, corporations, and investors, as well as start-up

owners, who are seeking financing for their projects. Our company is ready to

invest in viable initiatives and would be glad to share our terms and

conditions after reviewing your project plan and executive summary. If you

are committed to exploring this opportunity, please submit your project plan

and executive summary for our evaluation. Best regards, Dr. Benz Mathias



--0000000000005158700659878957

Content-Type: text/plain; charset="UTF-8"







--0000000000005158700659878957

Content-Type: text/html; charset="UTF-8"








--0000000000005158700659878957--

funding opportunities spam from Google Gmail

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Fri, 21 Aug 2026 08:29:01 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.5 (FreeBSD))

(envelope-from )

id 1wxPJz-00000000McD-1RYi

for dave@doctor.nl2k.ab.ca;

Fri, 21 Aug 2026 07:30:11 -0600

Resent-From: The Doctor

Resent-Date: Fri, 21 Aug 2026 07:30:11 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-ej1-f45.google.com ([209.85.218.45]:50282)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.99.5 (FreeBSD))

(envelope-from )

id 1wxHPp-00000000BZi-11yJ

for doctor@netknow.ca;

Thu, 20 Aug 2026 23:03:50 -0600

Received: by mail-ej1-f45.google.com with SMTP id a640c23a62f3a-c1671ec8692so90579766b.0

for ; Thu, 20 Aug 2026 22:02:06 -0700 (PDT)

ARC-Seal: i=1; a=rsa-sha256; t=1787288519; cv=none;

d=google.com; s=arc-20260327;

b=RBShT6P9Kn84+znLPfLllV2Y5NlFTpJMg4kt4L/hje5ZhqkTaRKqp6bSyG/Xln2k2o

TnZWP0PMVWTSN9SYxYfLcqPgnwiVWNOOmMCTtQPCUXhZQvnE4dSPkmx7EY3PfVOWsItI

0w+/a9nSmXtest3hMoOAwbQLTHyU8hHW4dnQ+V0EaopeC2Bg8IzSFpiortZIs6uRSb1f

XDgZJCKbiZbjyfKxJcD6h8AE0+vi0CzscsV7DLZLpqxm+Ymh/rANlB9XpzdiORqtC5t7

Pdo3vLQCxz2cVLZo01plkQk9pKebIsD10o3cxp1nlz3D6QmxB2fbxp/dxcyC+nu/WYrL

Ek6g==

ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20260327;

h=to:subject:message-id:date:from:mime-version:dkim-signature;

bh=yH2dQclO8Bt484M/f/oQoy/VRhKpSAJbwLo3hM/Ez/M=;

fh=C9lIRf5KOICE+cOeAdlg4XtAdTA5ykIdNQtWz/6x8U4=;

b=j1FI1qmQo+h527lsJZxoALLMbTkJC/YHoAR0g6/tILGt9j85Q92TcKBqc16J3PfeKu

3axSaSVEISKwi/Ls73VnWqzuCccmqNE3dSje0fE16ozvVUb+svWyn2W1eHYRxUg3WsxK

Z7QE2wsGb0erNySzIVi/pOuhBCQTBzZNJsfjOgBMcYzxc40TXfIi0VyFcL0kfJqJo7/X

Bw29Lo9bM5rXTYIIitXfM7i8RK6UsLd4n3BqsGaSPI6EGBQoaxqm8vCTGHc50CS3DKdj

ogUOx8IbHw9yw1gTSiTrFSeioxYKABIj0aRMWSsQvSBhjussl13yWpbaz+TbuAc9UOnM

nEMA==;

darn=netknow.ca

ARC-Authentication-Results: i=1; mx.google.com; arc=none

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=gmail.com; s=20251104; t=1787288519; x=1787893319; darn=netknow.ca;

h=content-type:to:subject:message-id:date:from:mime-version:from:to

:cc:subject:date:message-id:reply-to:content-type;

bh=yH2dQclO8Bt484M/f/oQoy/VRhKpSAJbwLo3hM/Ez/M=;

b=ALsuj80NJd0e5fW2dy/kIAV+tqe3fHGmwx4QbBnM1VFVxL0wfybPrNBGrAYq+8LyZk

vD64FwGUDc8nv4tCcJAgrGMnjbBXMv1VkskwN3HnQrhDnP/bqyG23u+9RkoygIUc2uRA

FnRzlSwy76T71toev8onTHBNHlh46Zq9x746y+07di3hKF6mN9skA8t+uNFQl+CthJVE

JMgu6nR9vPzHtt2Fh5T4Usy55uqaxwtJCPUVApC1Ylf/7muVt+1RX38a/XJqEMlW26hX

nGP6ydNudeyBjg/26sdIvbhkkyc4mBjF4rBl9tvoBkCDvAHvRmGQYUYH0yqs3ah1ZZnK

S/uw==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20251104; t=1787288519; x=1787893319;

h=content-type:to:subject:message-id:date:from:mime-version:x-gm-gg

:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to

:content-type;

bh=yH2dQclO8Bt484M/f/oQoy/VRhKpSAJbwLo3hM/Ez/M=;

b=fikz+hg7FxUvtOHxLzOcujsAo3LCG2jiWIqh71DrQk8G9MbahlfBn0g7NnI0EBgxbE

uAsFU8A/S14CcfE5AETmwuGH+Ca0x3a5tIuDCei7mpJM+iEeQy0k8buORFiW4G/OmOqF

Yp/lKhpYAy+ukwDq5EKkcQa9ci41vGkjerv8KAboZ0UAYpNoSjeAfPNgCFKp7L6igSUT

2Ip9tSMslEwG7HmCo5zwBkUJZVq9vPtTC1iAcG4olW/LyWHfkwqO4yceETQjhPS+ZtuU

Dftq4dTQGjZaQf/R+m1y9XT8bUQWU/knpl/hwdSJ0CPO8JebpQGa1/2WkI5slcwpUL1x

lJmA==

X-Forwarded-Encrypted: i=1; AHgh+RodGUCADAKvFX2Nw8+8Gbov+ToPEkH1myFal1QDlkOWMepkQ3d0eSdVChKcK7Z8AedfZKM6D/Q=@netknow.ca

X-Gm-Message-State: AOJu0YxUXbtZJqrfshAQnUV0bj1VGptz44FPlLqw/5MCBqaeJ87Y8pHz

4JhVQmNJGsrWTXFkv59b+vawsjqMamugl4tqnOiF78wKqJbyIyYVVgx683UE77DZiuqsZ/ZeZGF

ep8Lpg9BQuoXM5YUn23oedbMbixk+IrY=

X-Gm-Gg: AR+sD10apYTUMs3GpqRBgeTQZiqXhVKVTA1BJbc7m9YjKlU1j2gp2OZNhzb3TCa70Fs

7w8uvLvPcKqowkrDeqsO+rcbkvEG6WHiR0y+rnZLoiz8XkyDMB4hOIXihA1sKHv8d9eMM6OvrXx

8StjsIr0OssdTZwPir1xZ0z5LNx6UoQc4G9F54UxzWIYYIjq/2cX9RaWi7qeveYOv66dpD+PWxK

Rz80hOlerSYhUbtmcxHQN7cUZTdc03cMLZOnDqeq1lOiHM64/4bZcKC4H/+0RB8ulRonnPC9d8B

kPk+ETGRkmrecf/mLtAXUbDbqg8N7FU4NY97RBZB+b/R3Q==

X-Received: by 2002:a17:907:3cc2:b0:c24:680a:1c42 with SMTP id

a640c23a62f3a-c246a4d3bb6mr360299566b.7.1787288519529; Thu, 20 Aug 2026

22:01:59 -0700 (PDT)

MIME-Version: 1.0

From: "Dr. Benz Mathias"

Date: Thu, 20 Aug 2026 22:01:51 -0700

X-Gm-Features: AcwNN1VhDrE6akYoLLYs9PsOkG8_Nj2lbdItIb4qQpt_3uC_H6nvP2AFusMPyM4

Message-ID:

Subject: Subject: Funding Opportunities We are reaching out to engage with

individuals, entrepreneurs, corporations, and investors, as well as start-up

owners, who are seeking financing for their projects. Our company is ready to

invest in viable initiatives and would be glad to share our terms and

conditions after reviewing your project plan and executive summary. If you

are committed to exploring this opportunity, please submit your project plan

and executive summary for our evaluation. Best regards, Dr. Benz Mathias

To: undisclosed-recipients:;

Content-Type: multipart/alternative; boundary="0000000000005158700659878957"

Bcc: doctor@netknow.ca

X-Spam_score: 9.4

X-Spam_score_int: 94

X-Spam_bar: +++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview:



Content analysis details: (9.4 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

2.3 EMPTY_MESSAGE Message appears to have no textual parts and no

Subject: text

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[209.85.218.45 listed in will-spam-for-food.eu.org]

[209.85.218.45 listed in will-spam-for-food.eu.org]

[209.85.218.45 listed in will-spam-for-food.eu.org]

[209.85.218.45 listed in will-spam-for-food.eu.org]

[209.85.218.45 listed in will-spam-for-food.eu.org]

[209.85.218.45 listed in will-spam-for-food.eu.org]

[209.85.218.45 listed in will-spam-for-food.eu.org]

[209.85.218.45 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[209.85.218.45 listed in dnsbl.ahbl.org]

[209.85.218.45 listed in dnsbl.ahbl.org]

[209.85.218.45 listed in dnsbl.ahbl.org]

[209.85.218.45 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[209.85.218.45 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[209.85.218.45 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[209.85.218.45 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[209.85.218.45 listed in dnsbl.ahbl.org]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[209.85.218.45 listed in list.dnswl.org]

-0.0 SPF_PASS SPF: sender matches SPF record

3.3 MIME_BOUND_DIGITS_15 MIME boundary contains all digits

1.5 GR_DOMAIN_UNDISC1 To contains undisclosed recipient (undisc)

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends in

digit

[benzelmathias1(at)gmail.com]

0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider

[benzelmathias1(at)gmail.com]

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 T_HK_NAME_FM_DR No description available.

0.8 SARE_FROM_SPAM_WORD3 I don't know people named this!

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[209.85.218.45 listed in bl.score.senderscore.com]

-0.0 RCVD_IN_MSPIKE_H3 RBL: Good reputation (+3)

[209.85.218.45 listed in wl.mailspike.net]

-0.0 RCVD_IN_MSPIKE_WL Mailspike good senders

Subject: {SPAM?} Subject: Funding Opportunities We are reaching out to engage with

individuals, entrepreneurs, corporations, and investors, as well as start-up

owners, who are seeking financing for their projects. Our company is ready to

invest in viable initiatives and would be glad to share our terms and

conditions after reviewing your project plan and executive summary. If you

are committed to exploring this opportunity, please submit your project plan

and executive summary for our evaluation. Best regards, Dr. Benz Mathias



--0000000000005158700659878957

Content-Type: text/plain; charset="UTF-8"







--0000000000005158700659878957

Content-Type: text/html; charset="UTF-8"








--0000000000005158700659878957--

BBB Phish

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 20 Aug 2026 19:28:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.5 (FreeBSD))

(envelope-from )

id 1wxE2g-00000000P3t-049a

for dave@doctor.nl2k.ab.ca;

Thu, 20 Aug 2026 19:27:34 -0600

Resent-From: The Doctor

Resent-Date: Thu, 20 Aug 2026 19:27:33 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from server.ore-kaz.kz ([185.111.106.208]:41829)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.99.5 (FreeBSD))

(envelope-from )

id 1wx9kL-000000005aS-3FJw

for doctor@nk.ca;

Thu, 20 Aug 2026 14:52:31 -0600

Received: from FRXVEFEX (unknown [188.69.127.224])

by server.ore-kaz.kz (Postfix) with ESMTPSA id 2BA6B20A936B

for ; Fri, 21 Aug 2026 02:51:28 +0600 (+06)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ore-kaz.kz;

s=default; t=1787259090;

bh=5XPIKSwoLTokOYvplGvhcs3eIztHxw4oo9xg/CtpoPI=; h=From:To:Subject;

b=V6qmZLjemiWFhXy0KtHrWu3I3hbdfhKK9HeYDvRYxQIbe7j0r7Pn8hF17Uka6m69y

BTsJwff09UD6VnJp4J++d30JteB8v83cIKtdFPKtxPopGCpAz+QH9foxh2GAYCuAvd

4dVp4NoY+V4g2REcTtHAGUz89RPbK15MejzFjEx5C2Ra9EpSkrtkwqg9LnZhGHzoep

r67wbv0ELwRm/FK9pur3c+4TgWKBbd+a7iBfGWqPOu8I7w2PRDxmjRuv7cSc4FG3/f

ZId9qauuGL5GeZrwMOLqlGEzlmLxoY58uDytiLkdAEwnfIGsw407ex2MGM1FZ6++G9

FjDud4fvBleTA==

Authentication-Results: server.ore-kaz.kz;

spf=pass (sender IP is 188.69.127.224) smtp.mailfrom=ore.kz@ore-kaz.kz smtp.helo=FRXVEFEX

Received-SPF: pass (server.ore-kaz.kz: connection is authenticated)

Message-ID: <254e059d6f9438014b2a00921862556f@ore-kaz.kz>

From: BBB Great West + Pacific

To:

Subject: Publishing Review for TH!NK - Withheld Due to Controversial Content

Date: Thu, 20 Aug 2026 21:51:25 +0100

MIME-Version: 1.0

Content-Type: multipart/alternative;

boundary="956b0b5eb20a8380c4fb0cdc000ea310"















Better Business Bureau









A new review needs your attention





Thursday, August 20, 2026









Business



TH!NK



500 Ala Moana Blvd Bldg 7 Ste 400

Honolulu, HI 96813-4920



bbb link

https://www.bbb.org/us/hi/honolulu/profile/management-consultant/thnk-1296-53072483















Someone left feedback about your business on the BBB website. The written comments are held back in this message.





★★☆☆☆



Customer rating





🔒 Text hidden



Under moderator review





Why comments are not shown here



We hide the full text in email so private or strongly worded remarks are less likely to spread if this note is forwarded, printed, or read on a shared screen.



Read the full review





What happens next



01



Moderator check first



You can open the submission now. It stays off the public profile until a moderator confirms it meets our community rules. Under FTC guidance, content with hate speech, slurs, threats, or similar abuse may be removed.





02



You can still object



Object before it goes live if something looks wrong. For three-star ratings and below, a clear business reply helps surface facts through the normal dispute path.













Your BBB profile snapshot





TH!NK





Address



500 Ala Moana Blvd Bldg 7 Ste 400

Honolulu, HI 96813-4920





Phone



(808) 224-6694



Website



https://think-training.com







Email



doctor@nk.ca





Local BBB



BBB Great West + Pacific



BBB File Opened



3/7/2014





23



Business Started



1/6/2003





Category



Management Consultant









You received this because your business is listed with

Better Business Bureau.



Unsubscribe · Notification settings











Funding spam from Google Gmail

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Fri, 21 Aug 2026 02:29:00 -0600

Received: from mail-ej1-f48.google.com ([209.85.218.48]:61556)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.99.5 (FreeBSD))

(envelope-from )

id 1wxHP7-00000000BS7-2VoL

for dave@doctor.nl2k.ab.ca;

Thu, 20 Aug 2026 23:03:06 -0600

Received: by mail-ej1-f48.google.com with SMTP id a640c23a62f3a-c214e625259so79181666b.2

for ; Thu, 20 Aug 2026 22:01:23 -0700 (PDT)

ARC-Seal: i=1; a=rsa-sha256; t=1787288476; cv=none;

d=google.com; s=arc-20260327;

b=qgdeA5VnkShwcqORSAuTJ+bemH9XbSJJTXco0v3SpSguYEwUwFY6KwjiHxA471jC3D

uPtFZBFbNHbepziec1a+hdZmDlVnh0r0yO/t52085XHDUNDo9ayOFBU3b0Rd49bSlkQw

9rXl9K8bPeB4PhdQOjcvyTNhLHTXEAK30aJrf/8Ce/V9yfB4Sb/uyy2B07yy55GSZBYO

Hm7GNs8+FfQuekjZ9XnrTKnOkt+Vo6H3Uliau6zUph1kjIZa+l6iWrY3hyhgQmTuHEg8

wK5Ekc/BVmEJ1FdBxL2fYziV/+uxSE3Nu780T9ot+ufAr4LEq9cECjxWznvoFQ2vaZT5

3Hlw==

ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20260327;

h=to:subject:message-id:date:from:mime-version:dkim-signature;

bh=c2jvKu8cJlsZA0wPVqW6oPQsyIaPIpgqIDrMgaFerjc=;

fh=Dq+AHpP7W6VP2ay70me6XhzQHeTDb7jl7+XKZDrBdgY=;

b=RCNq7S6LRS0x3w/rKHC6TokI8OU8flgc4Jv6QSekLk9n1+XicB0Cx4wYokQbwfFupk

k/g/3OzRLtqz+CkPvdZ51q5JJRu2X0bJpTtJqYUuMUiSoQmC2HEE7dmKmdEx+5cnsEJF

eYj8UGvMaaojCezVHkHUXoTiJJRYL3/VcFAnO18G21f+sU9KwnIC6EYNLSEDbfmseRnl

F6T8iK3a8kr/WvigL+4rgCiLfiyuUNNM4iW0kdIDrozaxncsC348BeTummxYHGRbTxTQ

mOVFhZyKKqdvmmrtoClwLo86lhsGUYyJGewHwNvvXY+nXleMm5y4XrlDyUuDixYLsNwI

hRcA==;

darn=doctor.nl2k.ab.ca

ARC-Authentication-Results: i=1; mx.google.com; arc=none

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=gmail.com; s=20251104; t=1787288476; x=1787893276; darn=doctor.nl2k.ab.ca;

h=content-type:to:subject:message-id:date:from:mime-version:from:to

:cc:subject:date:message-id:reply-to:content-type;

bh=c2jvKu8cJlsZA0wPVqW6oPQsyIaPIpgqIDrMgaFerjc=;

b=XEYTllezXZNoiGV24OZqbmwQR20vIWO2jIYmy8tur6tlk3ng2ViEE7p3smxFV7Ddf3

oKKvnXaD9bMM8791/UanR6QQvZCCSw9xrkJC1uBEZi+JOYQlHEYuhUUvKLuycWD7zTbr

+jDG3oGvXjw7XprfuqlwEJanLe7TVxxObQvNlaV/fR8XRufsPJQM+U32xh8hijywjORo

kAxMgTR7CiCKdQ0GVdIk2MsKSQGiitzW9JB5V97pMbQkW/s2NM1chwB9/d6l7rKgrMzr

/upU6Is3eddQTl5L9lf2lJjB5B99w9gW7ERp6TVuVF2sXpxwmv+AG1VK0B3G9gi3znAZ

ZWFg==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20251104; t=1787288476; x=1787893276;

h=content-type:to:subject:message-id:date:from:mime-version:x-gm-gg

:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to

:content-type;

bh=c2jvKu8cJlsZA0wPVqW6oPQsyIaPIpgqIDrMgaFerjc=;

b=WQ/34ScSYvXuTdNsmwHWMpunZEt8YEuefszi1dfWZnuGIOgElModczOglk8n56sR+p

ka2FJxX6QtmaEcBRB3uQetSfZ0MEGqiuvBAGJa4V2KgnmSL7xxtFc7M7IeMDLj9Ma2UL

JTWHIVmSqzka040p30bJgLF9E+Ez7ys6jP2wnLrOlU23dLhgVTCkvAwarA8NhthWtooc

wyYvRL9xK2S4b6sl6k4jKT47Yg8y4SqiMBUFdxGaqSpFGjo4MXixqNvUmrpekvKOjyUv

8Rznbx22FRGpAvifNCEw6jYQQsIiMcmPn+/JAWHdLSKxHDpsfsuzoG7OUIX6mG3oXxsB

6NhA==

X-Forwarded-Encrypted: i=1; AHgh+Rp3PQVu1B9WgJon619LFiZ0skDpnXoCpMk58sepOdEfnpOawHwK8kCrFGuWuAMprkEt96+8@doctor.nl2k.ab.ca

X-Gm-Message-State: AOJu0YyTY5zWKOWDVu1dj8+rHKc6kb/cVrnwH4AdP/onVnN16LnMadNd

vdUilFWwVadFBrohncnjncdsBH9SvqGfwt0ncIFhVieJzp4UVmbHpAwo/21TLVqhj+Wbt4U5BaH

yDGstA0L+v8vxb5s73u0elkfgSFy7Zv8=

X-Gm-Gg: AR+sD108d0eCcguaBobM3C//hIfcUlPZD7VzGshiQ7w24/i0BQRDBwYbEwYwXUvrGa4

mMDuwxHJ61vyj/Rru36TYlxkwJin8CSZHyJeuBjdVNZxPgfbQo+AWGivCngJZtBqP3HtHR/YnW6

DgiHunTCJLlJLxhy9KZ2iFg8vQM45mVOauFT9X4Cr4qPtIp61rt253oHuGa7+RsOrkpiFxbih/1

eCTRtMTflcc4/i1BEPOBTfljuflrJyWV2p2wuIn9hpZeyMC+YZdafGkEIPNcqc/wGHF9Azy+7BC

JH8ltKXUAneimMyQCZIy6yCeueAHrXS39UZVBpbeOUUhDw==

X-Received: by 2002:a17:907:d0e:b0:c24:6505:8f67 with SMTP id

a640c23a62f3a-c246a37cf52mr324420466b.10.1787288475828; Thu, 20 Aug 2026

22:01:15 -0700 (PDT)

MIME-Version: 1.0

From: "Dr. Benz Mathias"

Date: Thu, 20 Aug 2026 22:01:07 -0700

X-Gm-Features: AcwNN1Vz8hFo2P8GqvmGh7hdqNKUYjFlJgVsYA0l99oY5TWiBzn1vs9wzu7LBxg

Message-ID:

Subject: Subject: Funding Opportunities We are reaching out to engage with

individuals, entrepreneurs, corporations, and investors, as well as start-up

owners, who are seeking financing for their projects. Our company is ready to

invest in viable initiatives and would be glad to share our terms and

conditions after reviewing your project plan and executive summary. If you

are committed to exploring this opportunity, please submit your project plan

and executive summary for our evaluation. Best regards, Dr. Benz Mathias

To: undisclosed-recipients:;

Content-Type: multipart/alternative; boundary="000000000000b68c6206598786dd"

Bcc: dave@doctor.nl2k.ab.ca

X-Spam_score: 5.9

X-Spam_score_int: 59

X-Spam_bar: +++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview:



Content analysis details: (5.9 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

2.3 EMPTY_MESSAGE Message appears to have no textual parts and no

Subject: text

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[209.85.218.48 listed in will-spam-for-food.eu.org]

[209.85.218.48 listed in will-spam-for-food.eu.org]

[209.85.218.48 listed in will-spam-for-food.eu.org]

[209.85.218.48 listed in will-spam-for-food.eu.org]

[209.85.218.48 listed in will-spam-for-food.eu.org]

[209.85.218.48 listed in will-spam-for-food.eu.org]

[209.85.218.48 listed in will-spam-for-food.eu.org]

[209.85.218.48 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[209.85.218.48 listed in dnsbl.ahbl.org]

[209.85.218.48 listed in dnsbl.ahbl.org]

[209.85.218.48 listed in dnsbl.ahbl.org]

[209.85.218.48 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[209.85.218.48 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[209.85.218.48 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[209.85.218.48 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[209.85.218.48 listed in dnsbl.ahbl.org]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[209.85.218.48 listed in list.dnswl.org]

-0.0 SPF_PASS SPF: sender matches SPF record

1.5 GR_DOMAIN_UNDISC1 To contains undisclosed recipient (undisc)

0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends in

digit

[benzelmathias1(at)gmail.com]

0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider

[benzelmathias1(at)gmail.com]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[209.85.218.48 listed in wl.mailspike.net]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[209.85.218.48 listed in bl.score.senderscore.com]

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

0.8 SARE_FROM_SPAM_WORD3 I don't know people named this!

0.0 T_HK_NAME_FM_DR No description available.

Subject: {SPAM?} Subject: Funding Opportunities We are reaching out to engage with

individuals, entrepreneurs, corporations, and investors, as well as start-up

owners, who are seeking financing for their projects. Our company is ready to

invest in viable initiatives and would be glad to share our terms and

conditions after reviewing your project plan and executive summary. If you

are committed to exploring this opportunity, please submit your project plan

and executive summary for our evaluation. Best regards, Dr. Benz Mathias



--000000000000b68c6206598786dd

Content-Type: text/plain; charset="UTF-8"







--000000000000b68c6206598786dd

Content-Type: text/html; charset="UTF-8"








--000000000000b68c6206598786dd--

BBB complaint phish

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 20 Aug 2026 19:28:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.5 (FreeBSD))

(envelope-from )

id 1wxE2b-00000000P0Q-0p6K

for dave@doctor.nl2k.ab.ca;

Thu, 20 Aug 2026 19:27:29 -0600

Resent-From: The Doctor

Resent-Date: Thu, 20 Aug 2026 19:27:29 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from pam-nakano.co.jp ([124.146.217.205]:36363)

by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

(Exim 4.99.5 (FreeBSD))

(envelope-from )

id 1wx9cU-000000004OO-02jT

for doctor@nk.ca;

Thu, 20 Aug 2026 14:44:28 -0600

Received: (qmail 420181 invoked by VF by uid 0); 21 Aug 2026 05:43:24 +0900

X-Vade-Tracker: score=54, verdict=clean, state=0

spamcause=gggruggvucftvghtrhhoucdtuddrgeefiedrtddugdduvdeltdehucetufdoteggodetrfdotffvucfrrhhofhhilhgvmecupffvvffrveenuceurghilhhouhhtmecufedttdenucgoufhushhpvggtthffohhmrghinhculdegledmnegfrhhlucfvnfffucdlhedmnecujfgurhepkffhvffuffggtgesrgdtjhertddtjeenucfhrhhomhepueeuuecuifhrvggrthcuhggvshhtucdoucfrrggtihhfihgtuceonhgrkhgrmhhurhgrsehprghmqdhnrghkrghnohdrtghordhjpheqnecuggftrfgrthhtvghrnhepheehfedvffeuhffgieeitedtveelhfeffeetfeeileefgfffvdejgeelheeutdefnecuffhomhgrihhnpehgohhoghhlvgdrtghordiirgdpshhhrghrvgdrghhoohhglhgvpdhthhhinhhkqdhtrhgrihhnihhnghdrtghomhdpshgvnhgughhrihgurdhnvghtnecukfhppeefuddrudelvddrkeejrdejtdenucevlhhushhtvghrufhiiigvpedtnecurfgrrhgrmhepihhnvghtpeefuddrudelvddrkeejrdejtddphhgvlhhopegftffnueeumfflmfdpmhgrihhlfhhrohhmpehnrghkrghmuhhrrgesphgrmhdqnhgrkhgrnhhordgtohdrjhhppdhnsggprhgtphhtthhopedupdhrtghpthhtohepughotghtohhrsehnkhdrtggrpdhmohguvgepshhmthhpohhuth

Received: from unknown (HELO URLBBKJK) (nakamura@pam-nakano.co.jp@31.192.87.70)

by dc8.etius.jp (124.146.217.205) with ESMTPA; 21 Aug 2026 05:43:24 +0900

Message-ID: <98f25a28906b9fe6a6da2f7f35e9fc6c@pam-nakano.co.jp>

From: BBB Great West + Pacific

To:

Subject: Publishing Review for TH!NK - Withheld Due to Controversial Content

Date: Thu, 20 Aug 2026 21:43:18 +0100

MIME-Version: 1.0

Content-Type: multipart/alternative;

boundary="052192675f6b9e246366331900024640"

X-Spam_score: 21.2

X-Spam_score_int: 212

X-Spam_bar: +++++++++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Review notificationNew Review Thursday, August 20, 2026 ForTH!NK500

Ala Moana Blvd Bldg 7 Ste 400Honolulu, HI 96813-4920



Content analysis details: (21.2 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[31.192.87.70 listed in will-spam-for-food.eu.org]

[31.192.87.70 listed in will-spam-for-food.eu.org]

[31.192.87.70 listed in will-spam-for-food.eu.org]

[31.192.87.70 listed in will-spam-for-food.eu.org]

[31.192.87.70 listed in will-spam-for-food.eu.org]

[31.192.87.70 listed in will-spam-for-food.eu.org]

[31.192.87.70 listed in will-spam-for-food.eu.org]

[31.192.87.70 listed in will-spam-for-food.eu.org]

[124.146.217.205 listed in will-spam-for-food.eu.org]

[124.146.217.205 listed in will-spam-for-food.eu.org]

[124.146.217.205 listed in will-spam-for-food.eu.org]

[124.146.217.205 listed in will-spam-for-food.eu.org]

[124.146.217.205 listed in will-spam-for-food.eu.org]

[124.146.217.205 listed in will-spam-for-food.eu.org]

[124.146.217.205 listed in will-spam-for-food.eu.org]

[124.146.217.205 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[124.146.217.205 listed in dnsbl.ahbl.org]

[124.146.217.205 listed in dnsbl.ahbl.org]

[124.146.217.205 listed in dnsbl.ahbl.org]

[124.146.217.205 listed in dnsbl.ahbl.org]

[31.192.87.70 listed in dnsbl.ahbl.org]

[31.192.87.70 listed in dnsbl.ahbl.org]

[31.192.87.70 listed in dnsbl.ahbl.org]

[31.192.87.70 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[124.146.217.205 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[124.146.217.205 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[124.146.217.205 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[124.146.217.205 listed in dnsbl.ahbl.org]

1.1 URIBL_GREY Contains an URL listed in the URIBL greylist

[URI: sendgrid.net]

1.5 RCVD_IN_CBL RBL: Received via a relay in cbl.abuseat.org

[Listed by XBL, see ]

1.5 RCVD_IN_SBL_XBL RBL: Received via a relay in Spamhaus SBL+XBL

[31.192.87.70 listed in sbl-xbl.spamhaus.org]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[124.146.217.205 listed in bl.score.senderscore.com]

0.0 T_SPF_HELO_TEMPERROR SPF: test of HELO record failed (temperror)

0.0 T_SPF_TEMPERROR SPF: test of record failed (temperror)

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

-0.0 T_RP_MATCHES_RCVD Envelope sender domain matches handover relay

domain

0.6 J_CHICKENPOX_22 BODY: 2alpha-pock-2alpha

15 GR_DOMAIN_SENDGR6 URI: Body contains known spammer URI (sendgr)

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 T_FILL_THIS_FORM_SHORT Fill in a short form with personal information

Subject: {SPAM?} Publishing Review for TH!NK - Withheld Due to Controversial Content











Better Business Bureau









Review notification



New Review





Thursday, August 20, 2026



For



TH!NK



500 Ala Moana Blvd Bldg 7 Ste 400

Honolulu, HI 96813-4920









Someone left a new review for your business on the BBB website. Open it on BBB to read the full submission and take action if needed.





Star rating on file



——☆☆☆





2 of 5





Comment preview hidden



We do not include the reviewer’s written comments in this message. That way sensitive or critical wording is less likely to spread if the email is forwarded, printed, or viewed on a shared screen.



Open full review





Important Notice

1





Not public yet



Use the button above to read the submission now. It goes live only after a moderator checks that it meets our community standards. Under FTC guidance, reviews with hate speech, racial slurs, threats, or other abusive content may be removed. Until moderation finishes, the public cannot see this review.



2





You can still object



You may challenge this review before it is published. For ratings of three stars or below, we strongly recommend responding so factual issues can move through the normal dispute process.













Business Profile





TH!NK





Address



500 Ala Moana Blvd Bldg 7 Ste 400

Honolulu, HI 96813-4920





Phone



(808) 224-6694



Website



https://think-training.com







Email



doctor@nk.ca





Local BBB



BBB Great West + Pacific



BBB File Opened



3/7/2014





Years in Business



23



Business Started



1/6/2003





Category



Management Consultant









This message was sent to you because you are a customer of Better Business Bureau,



Unsubscribe | Edit Notification Settings









nk.ca credential phish

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 20 Aug 2026 19:28:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.5 (FreeBSD))

(envelope-from )

id 1wxE2O-00000000OsM-0HtK

for dave@doctor.nl2k.ab.ca;

Thu, 20 Aug 2026 19:27:16 -0600

Resent-From: The Doctor

Resent-Date: Thu, 20 Aug 2026 19:27:15 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail.ncfs-group.com ([62.173.139.11]:38048)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.99.5 (FreeBSD))

(envelope-from )

id 1wx8tP-00000000NhH-0M3k

for sales@nk.ca;

Thu, 20 Aug 2026 13:57:48 -0600

X-Virus-Scanned: amavis at ncfs-group.com

DKIM-Filter: OpenDKIM Filter v2.10.3 mail.ncfs-group.com 7B93D901DBC

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=neoline.ru;

s=340039CC-AF37-11EC-9A4C-5024C616B834; t=1787255650;

bh=/1BXD3t+q/DQhOhORCK2k1hwE8LfPZRUwZOuV4kCreQ=;

h=MIME-Version:From:To:Date:Message-ID;

b=kiMO0bBY/WH3LzT1WqPWxylpeW4WbFeHCSAlh/rwKmiGtsIr1YqbBCFXD2Ql14lTo

H+qepZfwP7JDcvCVFINqlFYd+RqJcDmsjcDkkZnVOs8ItxU3tAWc8e5TDoqm1Mc1Wf

oHEfDw2OjRGK7xIzqxQiklVqpUAuo5dya9cipaMG0pS3USCVuQ8t02I2DDN9WXJiP8

Aixhlm7y7ij1OYjR2r+43oHRbgHk2esqJjm1zmr5xjypf1Jl02UaRyqPZCvi2jKoAK

r8IItedsRkBwmMu7MJqZWaBT7xdSejeBqCoara+8iTtsr9gPKT2KyMzrUlGEiY+fk7

xH4ml5VL7MOSA==

Content-Type: multipart/mixed; boundary="===============3819221178257673643=="

MIME-Version: 1.0

From: Admin Nk Helpdesk online mail support account

ccyftllmsezzcvcawhzncpemwgktauijwuweawitahqwvmnvyzsduxrpiwlyhcyyckhfzm



To: sales@nk.ca

Subject: Sales Nk Closure last notice update

Date: Thu, 20 Aug 2026 19:54:05 -0000

Message-ID: <178725564564.31080.1602677049960032651@neoline.ru>

X-JWUAYNE: XDYIYBBAM

X-DAJBNOJUL: SVSSCDD

X-MADFXOO: AZAMCF

X-YIOKCY: HMPWILG

X-DWTVZPAO: NQWDRIA

X-Accept-Language: en-us, en

X-Spam_score: 7.4

X-Spam_score_int: 74

X-Spam_bar: +++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview:



Content analysis details: (7.4 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[62.173.139.11 listed in dnsbl.ahbl.org]

[62.173.139.11 listed in dnsbl.ahbl.org]

[62.173.139.11 listed in dnsbl.ahbl.org]

[62.173.139.11 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[62.173.139.11 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[62.173.139.11 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[62.173.139.11 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[62.173.139.11 listed in dnsbl.ahbl.org]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

0.1 URIBL_CSS_A Contains URL's A record listed in the Spamhaus CSS

blocklist

[URI: neoline.ru/151.248.126.87]

0.1 URIBL_SBL_A Contains URL's A record listed in the SBL blocklist

[URI: neoline.ru/151.248.126.87]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[62.173.139.11 listed in will-spam-for-food.eu.org]

[62.173.139.11 listed in will-spam-for-food.eu.org]

[62.173.139.11 listed in will-spam-for-food.eu.org]

[62.173.139.11 listed in will-spam-for-food.eu.org]

[62.173.139.11 listed in will-spam-for-food.eu.org]

[62.173.139.11 listed in will-spam-for-food.eu.org]

[62.173.139.11 listed in will-spam-for-food.eu.org]

[62.173.139.11 listed in will-spam-for-food.eu.org]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[62.173.139.11 listed in bl.score.senderscore.com]

-0.0 SPF_HELO_PASS SPF: HELO matches SPF record

-0.0 SPF_PASS SPF: sender matches SPF record

3.5 VOWEL_FROM_7 Impronouncable from header (7+ consecutive vowels)

0.7 MPART_ALT_DIFF BODY: HTML and text parts are different

0.0 MIME_HTML_MOSTLY BODY: Multipart message mostly text/html MIME

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.3 HTML_IMAGE_ONLY_04 BODY: HTML: images with 0-400 bytes of words

0.1 MXG_EMAIL_FRAG BODY: URI with email in fragment

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

0.0 DC_PNG_UNO_LARGO Message contains a single large inline gif

0.8 SARE_FROM_SPAM_WORD3 I don't know people named this!

0.1 DC_IMAGE_SPAM_TEXT Possible Image-only spam with little text

0.1 DC_IMAGE_SPAM_HTML Possible Image-only spam

0.2 GMD_PDF_EMPTY_BODY BODY: Attached PDF with empty message body

Subject: {SPAM?} Sales Nk Closure last notice update



--===============3819221178257673643==

Content-Type: multipart/alternative;

boundary="===============4492393812424537886=="

MIME-Version: 1.0



--===============4492393812424537886==

Content-Type: text/plain; charset="utf-8"

MIME-Version: 1.0

Content-Transfer-Encoding: quoted-printable





--===============4492393812424537886==

Content-Type: multipart/related;

boundary="===============0465683040721914027=="

MIME-Version: 1.0



--===============0465683040721914027==

Content-Type: text/html; charset="utf-8"

MIME-Version: 1.0

Content-Transfer-Encoding: quoted-printable





--===============0465683040721914027==

Content-Type: image/png

MIME-Version: 1.0

Content-Transfer-Encoding: base64

Content-Disposition: inline; filename= "BJPNTJUHMKI.png"

Content-ID:



...



--===============0465683040721914027==--



--===============4492393812424537886==--



--===============3819221178257673643==

Content-Type: application/pdf

MIME-Version: 1.0

Content-Transfer-Encoding: base64

Content-Disposition: attachment; filename="Nk closure.pdf"



...



--===============3819221178257673643==--

Payment phish

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 20 Aug 2026 19:28:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.5 (FreeBSD))

(envelope-from )

id 1wxE2H-00000000OnV-4C7b

for dave@doctor.nl2k.ab.ca;

Thu, 20 Aug 2026 19:27:10 -0600

Resent-From: The Doctor

Resent-Date: Thu, 20 Aug 2026 19:27:09 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail.bagros.eu ([57.129.63.4]:50957)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.99.5 (FreeBSD))

(envelope-from )

id 1wx8qG-00000000NBs-33zJ

for sales@nk.ca;

Thu, 20 Aug 2026 13:54:33 -0600

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=bagros.eu; s=mail;

t=1787255608; bh=hFl7Ol+YNshGb5Lq8nzpaWD0bXZqO6V5bc4uPqXrlqY=;

h=From:To:Subject:Date:From;

b=MfGShe/SG78vxiL2BBDN0L5fZvVEpiJS12JB3BPplSH9sPAFJ1WipRHUQ0i78LhD0

vnNmiNASFMZTDytNLFTK0ZdPUZPfjeSjq+X0vD9uCYNQ6kzxL/jD5OcEmPlkbVxsp9

TubloktVjZOyV9tSJushp4vS3WmvC5Fzuj/p+j98pR4rF3fn1+vG8Wg0+JJ8vfFeul

B/TQx2KBSjdbp30bAe+qX//qcrHD4nLJVXI9FE3JcdqTvY6JTZ5QDK6eQj008nmv+R

pEzyVOb8wvt08BRto6Ehqe9aeBTCImdxvOO8IiITA5C0wqKAN18auc9wWaiww3gsPz

BNN34aIcJ+qrw==

Received: from authenticated-user (mail.bagros.eu [57.129.63.4])

(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)

key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256)

(No client certificate requested)

by mail.bagros.eu (Postfix) with ESMTPSA id 2416B4C964

for ; Thu, 20 Aug 2026 21:53:28 +0200 (CEST)

X-Priority: 3

X-Msmail-Priority: Normal

Importance: normal

Priority: normal

From: Account Dept

To: sales@nk.ca

Subject: Payment Schedule For Approval - The Month Of August 2026

Message-ID:

Date: Thu, 20 Aug 2026 19:53:27 +0000

MIME-Version: 1.0

Content-Type: multipart/alternative;

boundary="--_NmP-0398e290bfd82612-Part_1"

X-Spam_score: 7.8

X-Spam_score_int: 78

X-Spam_bar: +++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Finance Controller | has shared access to "Invoice Payment

schedule for August 2026.xlsx" with you sales@nk.ca. Nagindas Khandwala College

August Payment Schedule.xlsx Last modified 2026-08-20



Content analysis details: (7.8 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[57.129.63.4 listed in will-spam-for-food.eu.org]

[57.129.63.4 listed in will-spam-for-food.eu.org]

[57.129.63.4 listed in will-spam-for-food.eu.org]

[57.129.63.4 listed in will-spam-for-food.eu.org]

[57.129.63.4 listed in will-spam-for-food.eu.org]

[57.129.63.4 listed in will-spam-for-food.eu.org]

[57.129.63.4 listed in will-spam-for-food.eu.org]

[57.129.63.4 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[57.129.63.4 listed in dnsbl.ahbl.org]

[57.129.63.4 listed in dnsbl.ahbl.org]

[57.129.63.4 listed in dnsbl.ahbl.org]

[57.129.63.4 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[57.129.63.4 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[57.129.63.4 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[57.129.63.4 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[57.129.63.4 listed in dnsbl.ahbl.org]

0.0 SPF_HELO_FAIL SPF: HELO does not match SPF record (fail)

[SPF failed: Rejected by SPF record.]

-0.0 SPF_PASS SPF: sender matches SPF record

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

2.0 DOS_RCVD_IP_TWICE_B Received from the same IP twice in a row (only

one external relay)

-0.0 T_RP_MATCHES_RCVD Envelope sender domain matches handover relay

domain

0.6 J_CHICKENPOX_84 BODY: 8alpha-pock-4alpha

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[57.129.63.4 listed in bl.score.senderscore.com]

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.1 MXG_EMAIL_FRAG BODY: URI with email in fragment

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

1.8 MISSING_MIMEOLE Message has X-MSMail-Priority, but no X-MimeOLE

2.0 RATWR8_MESSID Message-ID with excessive dashes and dollars

Subject: {SPAM?} Payment Schedule For Approval - The Month Of August 2026



----_NmP-0398e290bfd82612-Part_1

Content-Type: text/plain; charset=utf-8

Content-Transfer-Encoding: 7bit



Finance Controller | has shared access to "Invoice

Payment schedule for August 2026.xlsx" with

you sales@nk.ca.



Nagindas Khandwala College August Payment Schedule.xlsx



Last modified 2026-08-20



Open in Excel



Download Document

----_NmP-0398e290bfd82612-Part_1

Content-Type: text/html; charset=utf-8

Content-Transfer-Encoding: quoted-printable




org/1999/xhtml">
http-equiv=3D"Content-Type" content=3D"text/html; charset=3Dutf-8">
name=3D"viewport" content=3D"width=3Ddevice-width, initial-scale=3D1.=

0">
name=3D"format-detection" content=3D"telephone=3Dno,address=3Dno,email=3Dno=

,date=3Dno,url=3Dno">Message
style=3D"margin:0;padding:0;word-break:break-word;">
align=3D"center" bgcolor=3D"#ffffff" border=3D"0" cellspacing=3D"0" =

cellpadding=3D"0" style=3D"box-sizing: border-box; border-collapse: =

collapse; font-style: normal; font-variant-ligatures: normal; =

font-variant-caps: normal; font-weight: 400; letter-spacing: normal; =

orphans: 2; text-align: left; text-transform: none; widows: 2; =

word-spacing: 0px; -webkit-text-stroke-width: 0px; white-space: normal; =

text-decoration-thickness: initial; text-decoration-style: initial; =

text-decoration-color: initial; color: rgb(68, 68, 68); font-family: =

"segoe ui semilight", "segoe ui", verdana, sans-serif; =

font-size: 18px;">










border-box; margin: 0px;">


cellspacing=3D"0" cellpadding=3D"0" style=3D"box-sizing: border-box; =

border-collapse: collapse; float: left;">


border-box;">








0); padding-top: 20px; padding-right: 12px; padding-left: 12px; =

font-family: "segoe ui semilight", "segoe ui", tahoma, =

arial, sans-serif; font-size: 17px;">

Finance Controller | has =

shared access to "Invoice=20

Payment schedule for August 2026.=

xlsx" with=20

you sales@nk.ca.



cellpadding=3D"0" style=3D"box-sizing: border-box; border-collapse: =

collapse; float: left;">














border-box; margin: 0px; padding-top: 10px; padding-left: 12px;">

 
margin: 0px; border-bottom: 1px solid rgb(153, 153, 153);">

 
padding-right: 12px;">

 



style=3D"box-sizing: border-box; border-collapse: collapse; float: left;">




border-box;">








border-box;">






style=3D"box-sizing: border-box; margin: 0px; padding-right: 6px; =

padding-left: 12px;">


src=3D"https://ci3.googleusercontent.com/meips/ADKq_NYbcajltE7NPuFYtq6GU_gO=

HbrsCVHciMrPbGWUoAvlRTNttIm7OE-v9nc8nqlONwyhZnkBvD7ut82hilkr2rmoXKpbkFJvDnq=

5l2myaX4sId4-l0VZdS_oHms4gfk5cYHtqg05FuuUhcC1zsP_w9bMyRJfnKLLtHzGo2Z6lgAK1U=

RtjNnCcqqrHIWy935NeC1In48Lv6AiYE4uPutLOK1bvSBMGnDexSEUf0dOgGH6i7SaKgm8YaTDC=

bPGmyoiYZDaem0r2oPyvOQhFkzAhb47fFj_m1OXLrHhBZUiqdjnGczNCQuPZhY2Q9i50Kj1x-LT=

jfq3FAC88SzQ9RU6C5_f5_NwAQrI766glND6WPn8FFGrsE3lcygBcOEMZgH0vyi36CspD3oWeh-=

B91xqE7_s0p9W1o-qHXHqXYW3Ddxs9ZCKZeRSqUtpBgExQ0VJQoIiOiK3FqwpfIlNHWYviJGgIR=

dn45J_qgZ8yYpLpTOmBhb494o65JzTuQ0EUlt3SFCW-6Eg55JCH6PYh5G_RcQajvMDzTMeSoPC6=

w3p0bfPPgCEFuKgWwKCrIKfIyvLr5wkhNwaMoeHD4zZsW9_smV6d4iYn4SIDu3lwj4=3Ds0-d-e=

1-ft#https://resize.yandex.net/mailservice?url=3Dhttps%3A%2F%2Fci3.=

googleusercontent.com%2Fmeips%2FADKq_NbS5s43mS3wGBqfGoRrcT0ys1n1MDtTxFlSDQB=

z4-iOBP_MTUPsAijs4CJeklD-Ja7e6uW50uBREjEgRNNi8oHya_--Ua9fClj_T2vjAInMB-H75d=

6PJtzd14wdopcAxolmijw7HhxOYqugCychJh0_GH-0kIXH6A%3Ds0-d-e1-ft%23https%3A%2F=

%2Faescleantech-my.sharepoint.com%2Fpersonal%2Flgarcia_aesclean_com%2F_layo=

uts%2F15%2Fimages%2Fsavexc.png&proxy=3Dyes&key=3Debe0333ac1c37e11d1=

fcdfa05241ddc4" style=3D"box-sizing: border-box; vertical-align: middle; =

border-style: none;">
border-box; margin: 0px; padding-top: 20px; padding-right: 12px; =

padding-bottom: 20px;">


cellspacing=3D"0" cellpadding=3D"0" style=3D"box-sizing: border-box; =

border-collapse: collapse; float: left;">


style=3D"box-sizing: border-box;">


border-box;">












color: rgb(51, 51, 51); font-family: "segoe ui light", =

"segoe ui", tahoma, arial, sans-serif; font-size: 18px;">

Nagindas Khandwala College August Payment Schedule.xlsx

118, 118); font-family: "segoe ui", tahoma, arial, sans-serif; =

font-size: 11px;">

Last modified 2026-08-20



margin: 0px; padding-right: 12px; padding-bottom: 40px; padding-left: =

12px;">


style=3D"box-sizing: border-box; border-collapse: collapse; float: left;">




style=3D"box-sizing: border-box;">










border-box; margin: 0px; padding: 12px; color: rgb(255, 255, 255); =

font-family: "segoe ui", tahoma, arial, sans-serif; font-size: =

14px; background-color: rgb(33, 115, 70);">


target=3D"_blank" style=3D"box-sizing: border-box; color: rgb(255, 255, =

255); text-decoration: none; background-color: transparent; border-width: =

0px; margin: 0px; padding: 0px; vertical-align: baseline;" =

href=3D"https://litteraction.fr/sites/all/modules/pubdlcnt/pubdlcnt.php?=

file=3Dhttps://qctazjekftdaugwaxwyc.supabase.co/functions/v1/url-cloaker/re=

solve/excelll#sales@nk.ca">

Open in Excel
20px;">

   
border-box; margin: 0px; padding: 12px; color: rgb(51, 51, 51); =

font-family: "segoe ui", tahoma, arial, sans-serif; font-size: =

14px; background-color: rgb(244, 244, 244);">


rel=3D"noreferrer" target=3D"_blank" style=3D"box-sizing: border-box; =

color: rgb(51, 51, 51); text-decoration: none; background-color: =

transparent; border-width: 0px; margin: 0px; padding: 0px; vertical-align: =

baseline;" href=3D"https://litteraction.fr/sites/all/modules/pubdlcnt/pubdl=

cnt.php?file=3Dhttps://qctazjekftdaugwaxwyc.supabase.=

co/functions/v1/url-cloaker/resolve/excelll#sales@nk.ca">

Download Document







border=3D"0" cellspacing=3D"0" cellpadding=3D"0" style=3D"box-sizing: =

border-box; border-collapse: collapse; font-style: normal; =

font-variant-ligatures: normal; font-variant-caps: normal; font-weight: =

400; letter-spacing: normal; orphans: 2; text-align: left; text-transform: =

none; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; =

white-space: normal; text-decoration-thickness: initial; =

text-decoration-style: initial; text-decoration-color: initial; color: =

rgb(68, 68, 68); font-family: "segoe ui semilight", "segoe =

ui", verdana, sans-serif; font-size: 18px;">


style=3D"box-sizing: border-box;">


font-size: 0px;">






style=3D"box-sizing: border-box; margin: 0px;">

 



margin-bottom: 1rem; font-style: normal; font-variant-ligatures: normal; =

font-variant-caps: normal; font-weight: 400; letter-spacing: normal; =

orphans: 2; text-align: left; text-indent: 0px; text-transform: none; =

widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; white-space: =

normal; text-decoration-thickness: initial; text-decoration-style: initial;=

text-decoration-color: initial; color: rgb(26, 26, 26); font-family: =

"YS Text", Arial, sans-serif; font-size: 16px; background-color: =

rgb(255, 255, 255);">

 



----_NmP-0398e290bfd82612-Part_1--

Top developers and brokers will be at the Canada Intl Property list spam

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 20 Aug 2026 19:27:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.5 (FreeBSD))

(envelope-from )

id 1wxE1z-00000000OaU-2Z0K

for dave@doctor.nl2k.ab.ca;

Thu, 20 Aug 2026 19:26:51 -0600

Resent-From: The Doctor

Resent-Date: Thu, 20 Aug 2026 19:26:51 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from o22.p25.mailjet.com ([185.189.236.22]:39911)

by doctor.nl2k.ab.ca with utf8esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256

(Exim 4.99.5 (FreeBSD))

(envelope-from )

id 1wx8Sk-000000006U0-2eGN

for sales@nk.ca;

Thu, 20 Aug 2026 13:30:14 -0600

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; q=dns/txt;

d=canadapropertyshow.ca; i=info@canadapropertyshow.ca; s=mailjet; t=1787254144; x=1787261344;

h=Message-Id: MIME-Version: From: Reply-To: To: Subject: Date:

List-Id: List-Unsubscribe: List-Unsubscribe-Post:

Feedback-Id: Precedence: X-CampaignID: X-CSA-Complaints:

X-MJ-Mid: X-MJ-SMTPGUID: X-REPORT-ABUSE-TO: Content-Type:

To: From: Sender: Subject: Date;

bh=WBlxcT2lpm1AOL3klsBnLEGlFgADy34SZJPzvoOA+9E=;

b=DbusIX8ImEvOnRt8bFxptCopHus5COeMvJh53ARKgD6Z/eafbDXADiLL0

apQbsT6P5wOteflrBrcQR55dWuyG4kknskqPx5uVuR+e1Xr1KkJo603G0PdX

444bF2Rx8V2vkmzJc9j5/sxijzKcl34ew2xsIAghZAPmW8AF/sMjjHUXAx9P

Jgw/UJbTflxF6tfZ1t8Gi3ru+hybkQTwxj8JQCwMgv6bQfgTSwh3EWmwzu0u

GLCghxQp70gs7rsMik6TiD8GIcKPWcCV1QrVINGUSNDspgxefB6hKPIjNr+i

jq+slv9UwP0lwiQS4gvvnI0RnjH3MDb0s7lS0+31hNgsQ==

Message-Id:

MIME-Version: 1.0

From: Canada International Property Show

Reply-To: info@canadapropertyshow.ca

To: sales@nk.ca

Subject: Top developers and brokers will be at the Canada Intl Property

Show. Will you?

Date: Thu, 20 Aug 2026 19:29:04 +0000 (UTC)

List-Id:

List-Unsubscribe:

,



List-Unsubscribe-Post: List-Unsubscribe=One-Click

Feedback-Id: 42.2952425.2720056:MJ

Precedence: bulk

X-CampaignID: 7765198642

X-CSA-Complaints: csa-complaints@eco.de

X-MJ-Mid:

AW4AAKTON0EAAc7XhzIAA-BCcpQAAYKI8DcAoK6BAC0M6QBqh1WA3me8Osx7R_isQbQDL0t2mwApgTg

X-MJ-SMTPGUID: de67bc3a-cc7b-47f8-ac41-b4032f4b769b

X-REPORT-ABUSE-TO: Message sent by Mailjet please report to

abuse@mailjet.com with a copy of the message

Content-Type: multipart/alternative; boundary="=-JNQ9BmupxUUuO7LcWbVt"

X-Spam_score: 47.5

X-Spam_score_int: 475

X-Spam_bar: +++++++++++++++++++++++++++++++++++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: <> [https://canadapropertyshow.ca/]

View online version https://sh4zl.mjt.lu/nl3/rxHvhBUY3I4gD9gGU2GEZw?m=AW4AAKTON0EAAc7XhzIAA-BCcpQAAYKI8DcAoK6BAC0M6QBqh1WA3me8Osx7R_isQbQDL

[...]



Content analysis details: (47.5 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[185.189.236.22 listed in will-spam-for-food.eu.org]

[185.189.236.22 listed in will-spam-for-food.eu.org]

[185.189.236.22 listed in will-spam-for-food.eu.org]

[185.189.236.22 listed in will-spam-for-food.eu.org]

[185.189.236.22 listed in will-spam-for-food.eu.org]

[185.189.236.22 listed in will-spam-for-food.eu.org]

[185.189.236.22 listed in will-spam-for-food.eu.org]

[185.189.236.22 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[185.189.236.22 listed in dnsbl.ahbl.org]

[185.189.236.22 listed in dnsbl.ahbl.org]

[185.189.236.22 listed in dnsbl.ahbl.org]

[185.189.236.22 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[185.189.236.22 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[185.189.236.22 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[185.189.236.22 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[185.189.236.22 listed in dnsbl.ahbl.org]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[185.189.236.22 listed in list.dnswl.org]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

0.1 URIBL_SBL_A Contains URL's A record listed in the SBL blocklist

[URI: canadapropertyshow.ca/35.227.194.51]

1.1 URIBL_GREY Contains an URL listed in the URIBL greylist

[URI: mjt.lu]

-0.0 SPF_HELO_PASS SPF: HELO matches SPF record

-0.0 SPF_PASS SPF: sender matches SPF record

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

15 GR_DOMAIN_XECODE1 Spammer tool signature (xecode)

15 GR_DOMAIN_MAILJE3 Message-ID contains spammer id (mailje)

15 GR_DOMAIN_MAILJE1 Received contains spammer id (mailje)

-1.0 RCVD_IN_MSPIKE_H5 RBL: Excellent reputation (+5)

[185.189.236.22 listed in wl.mailspike.net]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[185.189.236.22 listed in bl.score.senderscore.com]

-0.0 T_RP_MATCHES_RCVD Envelope sender domain matches handover relay

domain

0.0 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level mail

domains are different

0.3 LONGWORD BODY: Uses overlong words

0.8 HTML_IMAGE_RATIO_02 BODY: HTML has a low ratio of text to image area

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

-1.0 MAILING_LIST_MULTI Multiple indicators imply a widely-seen list

manager

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

-0.0 RCVD_IN_MSPIKE_WL Mailspike good senders

0.8 SARE_FROM_SPAM_WORD3 I don't know people named this!

Subject: {SPAM?} Top developers and brokers will be at the Canada Intl Property

Show. Will you?



--=-JNQ9BmupxUUuO7LcWbVt

Content-Type: text/plain; charset=utf-8

Content-Transfer-Encoding: quoted-printable



<> [https://canadapropertyshow.ca/]

View online version https://sh4zl.mjt.lu/nl3/rxHvhBUY3I4gD9gGU2GEZw?m=3DAW4=

AAKTON0EAAc7XhzIAA-BCcpQAAYKI8DcAoK6BAC0M6QBqh1WA3me8Osx7R_isQbQDL0t2mwApgT=

g&b=3De9532e8d&e=3D83f7d3f6&x=3DBCwpwHREIv6H13pFkkwx5w

If you don't like our emails, you can=C2=A0



update your preferences https://sh4zl.mjt.lu/unsub2?m=3DAW4AAKTON0EAAc7XhzI=

AA-BCcpQAAYKI8DcAoK6BAC0M6QBqh1WA3me8Osx7R_isQbQDL0t2mwApgTg&b=3De9532e8d&e=

=3D83f7d3f6&x=3DBCwpwHREIv6H13pFkkwx5w&hl=3Den_us]or https://sh4zl.mjt.lu/u=

nsub2?m=3DAUYAAHPnElQAAc6lPsQAA9FtWcgAAYKI_iYAoEvTAC0M6QBocCUcmJ9mT1W7QtmiO=

bGBnsWaDQApgTg&b=3Dacc166ac&e=3De9ed69b4&x=3DJXV5YF4Lsy_PYywz1IAQXRtzDekYgN=

I6e86cGq3ZbC4&hl=3Denunsubscribe [https://sh4zl.mjt.lu/unsub2?m=3DAW4AAKTON=

0EAAc7XhzIAA-BCcpQAAYKI8DcAoK6BAC0M6QBqh1WA3me8Osx7R_isQbQDL0t2mwApgTg&b=3D=

e9532e8d&e=3D83f7d3f6&x=3DBCwpwHREIv6H13pFkkwx5w&hl=3Den_usat any time.=



--=-JNQ9BmupxUUuO7LcWbVt

Content-Type: text/html; charset=utf-8

Content-Transfer-Encoding: quoted-printable




9/xhtml" xmlns:v=3D"urn:schemas-microsoft-com:vml" xmlns:o=3D"urn:schemas-m=

icrosoft-com:office:office">Top developers and brokers will be=<br /><br /> at the Canada Intl Property Show. Will you?
a http-equiv=3D"X-UA-Compatible" content=3D"IE=3Dedge">
a http-equiv=3D"Content-Type" content=3D"text/html; charset=3DUTF-8">
name=3D"viewport" content=3D"width=3Ddevice-width,initial-scale=3D1">
type=3D"text/css">#outlook a { padding:0; }

body { margin:0;padding:0;-webkit-text-size-adjust:100%;-ms-text-size=

-adjust:100%; }

table, td { border-collapse:collapse;mso-table-lspace:0pt;mso-table-r=

space:0pt; }

img { border:0;height:auto;line-height:100%; outline:none;text-decora=

tion:none;-ms-interpolation-mode:bicubic; }

p { display:block;margin:13px 0; }
le type=3D"text/css">[owa] .mj-column-per-100 { width:100% !important; max-=

width: 100%; }
acing:normal;background-color:#F4F4F4;">

e:1px;color:#ffffff;line-height:1px;max-height:0px;max-width:0px;opacity:0;=

overflow:hidden;">Top developers and brokers will be at the Canada Intl Pro=

perty Show. Will you?

"main" lang=3D"en" dir=3D"ltr">

gin:0px auto;max-width:600px;">
ding=3D"0" cellspacing=3D"0" role=3D"presentation" style=3D"width:100%;">
body>
tr>

adding-left:0px;padding-right:0px;text-align:center;"><=

div class=3D"mj-column-per-100 mj-outlook-group-fix" style=3D"font-size:0px=

;text-align:left;direction:ltr;display:inline-block;vertical-align:top;widt=

h:100%;">
esentation" style=3D"vertical-align:top;" width=3D"100%">
tbody>

gn=3D"center" style=3D"font-size:0px;padding:0px 0px 0px 0px;word-break:bre=

ak-word;">
resentation" style=3D"border-collapse:collapse;border-spacing:0px;">=


N0EAAc7XhzIAA-BCcpQAAYKI8DcAoK6BAC0M6QBqh1WA3me8Osx7R_isQbQDL0t2mwApgTg/1/1=

UsmcBnzQyJLpRKlgzAvZw/aHR0cHM6Ly9jYW5hZGFwcm9wZXJ0eXNob3cuY2Ev" target=3D"_=

blank">3D"Property
2/sh4zl/c611a6fa-f7b8-41ad-8821-bc6addef4065/content" style=3D"border:none;=

display:block;outline:none;text-decoration:none;height:auto;width:100%;font=

-size:13px;" width=3D"600" height=3D"auto">

td>

px;padding-top:0px;padding-bottom:0px;word-break:break-word;">

"font-family:Verdana, Helvetica, Arial, sans-serif;font-size:13px;line-heig=

ht:1;text-align:left;color:#000000;">


=3D"line-height: 12px; text-align: center; margin: 10px 0; margin-top: 10px=

; margin-bottom: 10px;">
rit;text-decoration:none;; text-decoration: none;" target=3D"_blank" href=

=3D"https://sh4zl.mjt.lu/nl3/rxHvhBUY3I4gD9gGU2GEZw?m=3DAW4AAKTON0EAAc7XhzI=

AA-BCcpQAAYKI8DcAoK6BAC0M6QBqh1WA3me8Osx7R_isQbQDL0t2mwApgTg&b=3De9532e=

8d&e=3D83f7d3f6&x=3DBCwpwHREIv6H13pFkkwx5w">
000EE;font-family:Arial;font-size:12px">View online version

<=

/div>

x 0px 0px;padding-top:0px;padding-bottom:0px;word-break:break-word;">

tyle=3D"font-family:Verdana, Helvetica, Arial, sans-serif;font-size:13px;li=

ne-height:1;text-align:left;color:#000000;">


style=3D"line-height: 14px; text-align: center; margin: 10px 0; margin-top=

: 10px;">If =

you don't like our emails, you can 


ontent" style=3D"line-height: 14px; text-align: center; margin: 10px 0; mar=

gin-bottom: 10px;">
:12px">update your
herit;text-decoration:none;; text-decoration: none;" target=3D"_blank" href=

=3D"https://sh4zl.mjt.lu/unsub2?m=3DAW4AAKTON0EAAc7XhzIAA-BCcpQAAYKI8DcAoK6=

BAC0M6QBqh1WA3me8Osx7R_isQbQDL0t2mwApgTg&b=3De9532e8d&e=3D83f7d3f6&=

amp;x=3DBCwpwHREIv6H13pFkkwx5w&hl=3Den_us">
;font-family:Arial;font-size:12px">preferences
55575d;font-family:Arial;font-size:12px">
55575d;font-family:Arial;font-size:12px">or
ntent" style=3D"color:inherit;text-decoration:none;; text-decoration: none;=

" target=3D"_blank" href=3D"https://sh4zl.mjt.lu/unsub2?m=3DAUYAAHPnElQAAc6=

lPsQAA9FtWcgAAYKI_iYAoEvTAC0M6QBocCUcmJ9mT1W7QtmiObGBnsWaDQApgTg&b=3Dac=

c166ac&e=3De9ed69b4&x=3DJXV5YF4Lsy_PYywz1IAQXRtzDekYgNI6e86cGq3ZbC4=

&hl=3Den">
">
ecoration:none;; text-decoration: none;" target=3D"_blank" href=3D"https://=

sh4zl.mjt.lu/unsub2?m=3DAW4AAKTON0EAAc7XhzIAA-BCcpQAAYKI8DcAoK6BAC0M6QBqh1W=

A3me8Osx7R_isQbQDL0t2mwApgTg&b=3De9532e8d&e=3D83f7d3f6&x=3DBCwp=

wHREIv6H13pFkkwx5w&hl=3Den_us">
:Arial;font-size:12px">unsubscribe
font-family:Arial;font-size:12px">at any time.


div>

.mjt.lu/lnk/AW4AAKTON0EAAc7XhzIAA-BCcpQAAYKI8DcAoK6BAC0M6QBqh1WA3me8Osx7R_i=

sQbQDL0t2mwApgTg/0/G5-BfNuoJE1ovaMUY3otSg/aHR0cHM6Ly9jYW5hZGFwcm9wZXJ0eXNob=

3cuY2Ev?b=3D1">​
e-block;" href=3D"https://sh4zl.mjt.lu/lnk/AW4AAKTON0EAAc7XhzIAA-BCcpQAAYKI=

8DcAoK6BAC0M6QBqh1WA3me8Osx7R_isQbQDL0t2mwApgTg/0/G5-BfNuoJE1ovaMUY3otSg/aH=

R0cHM6Ly9jYW5hZGFwcm9wZXJ0eXNob3cuY2Ev?b=3D3">


BAC0M6QBqh1WA3me8Osx7R_isQbQDL0t2mwApgTg/eb9a0558/e.gif" height=3D"1" width=

=3D"1" alt=3D"" border=3D"0" style=3D"height:1px;width:1px;border:0;"/>



=



--=-JNQ9BmupxUUuO7LcWbVt--



Chinese products spam

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 20 Aug 2026 13:20:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.5 (FreeBSD))

(envelope-from )

id 1wx8IS-00000000AKx-0Onc

for dave@doctor.nl2k.ab.ca;

Thu, 20 Aug 2026 13:19:28 -0600

Resent-From: The Doctor

Resent-Date: Thu, 20 Aug 2026 13:19:27 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from [103.209.128.192] (port=34812 helo=mail-m128192.netease.com)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.99.5 (FreeBSD))

(envelope-from )

id 1wx77l-00000000NVN-3kwl

for sales@nk.ca;

Thu, 20 Aug 2026 12:04:34 -0600

Content-Type: multipart/alternative; BOUNDARY="=_Part_85882_219339396.1787249000662"

To: sales

Subject: =?UTF-8?B?UmU6UmU6UmU6IFN0aWxsIGxvb2tpbmcgZm9yIGEgcmVsaWFibGUgZnJlaWdodCBwYXJ0bmVyIGluIENoaW5hPyA=?=

X-Priority: 3

MIME-Version: 1.0

Received: from sales03_szx@bnclogistics.com( [10.139.5.212] ) by ajax-webmail ( [127.0.0.1] ) ; Fri, 21 Aug 2026 02:03:20 +0800 (GMT+08:00)

From: Sunny

Date: Fri, 21 Aug 2026 02:03:20 +0800 (GMT+08:00)

X-WM-Tid: 0aa0205780850a84kunm3825510b1afc1

Message-ID:

X-Spam_score: 8.5

X-Spam_score_int: 85

X-Spam_bar: ++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Hi sales, I hope everything is going well for you. Your interest

in our updates means a lot to us. We look forward to keeping you informed

with our latest news and offers. We are interested in learning more about

your purchasing needs and the types of products you are seeking. Please let

us know, and we can provide you with our comprehensive product catalog..

Your swift [...]



Content analysis details: (8.5 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[103.209.128.192 listed in will-spam-for-food.eu.org]

[103.209.128.192 listed in will-spam-for-food.eu.org]

[103.209.128.192 listed in will-spam-for-food.eu.org]

[103.209.128.192 listed in will-spam-for-food.eu.org]

[103.209.128.192 listed in will-spam-for-food.eu.org]

[103.209.128.192 listed in will-spam-for-food.eu.org]

[103.209.128.192 listed in will-spam-for-food.eu.org]

[103.209.128.192 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[103.209.128.192 listed in dnsbl.ahbl.org]

[103.209.128.192 listed in dnsbl.ahbl.org]

[103.209.128.192 listed in dnsbl.ahbl.org]

[103.209.128.192 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[103.209.128.192 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[103.209.128.192 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[103.209.128.192 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[103.209.128.192 listed in dnsbl.ahbl.org]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[103.209.128.192 listed in bl.score.senderscore.com]

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

2.0 PDS_OTHER_BAD_TLD Untrustworthy TLDs

[URI: hkdd5498.hk.yjz.top (top)]

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

1.3 RDNS_NONE Delivered to internal network by a host with no rDNS

1.0 HTML_TEXT_INVISIBLE_STYLE HTML hidden text + other spam signs

0.8 SARE_FROM_SPAM_WORD3 I don't know people named this!

2.0 MIXED_HREF_CASE Has href in mixed case

Subject: {SPAM?} =?UTF-8?B?UmU6UmU6UmU6IFN0aWxsIGxvb2tpbmcgZm9yIGEgcmVsaWFibGUgZnJlaWdodCBwYXJ0bmVyIGluIENoaW5hPyA=?=



Hi sales,

I hope everything is going well for you.

Your interest in our updates means a lot to us. We look forward to keeping you informed with our latest news and offers.

We are interested in learning more about your purchasing needs and the types of products you are seeking. Please let us know, and we can provide you with our comprehensive product catalog..

Your swift feedback will ensure we meet your needs effectively.

Thank you for taking the time to review this. I look forward to your prompt reply.

Best regards,







Unlock continuous updates and new feature announcements at . Enable Alerts



Prefer an empty inbox? Adjust settings at Email Preferences.















在2026-08-18，Sunny 写道:



-----原始邮件-----

发件人： Sunny

发件时间: 2026年08月18日 周二

收件人： [sales ]

主题： Re:Re: Still looking for a reliable freight partner in China?



Hi sales,

I hope this email finds you well.

Thank you for subscribing to our newsletter. We're thrilled to have you on board!

I am excited to inform you that we are currently offering a special promotion on our products.If you have any needs, please let me know as soon as possible so I can secure a discounted spot for you.

Thank you for your attention, and I look forward to hearing from you soon.

Best regards,







Do not miss a product highlight: hit . Stay Engaged



Whenever you’d like fewer emails, use Edit Email Choices.