Nigerian spam from Google Gmail

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@nl2k.ab.ca

Delivery-date: Mon, 21 Sep 2026 08:20:31 -0600

Received: from mail-pz2-f12.google.com ([74.125.228.12]:53703)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.100.1 (FreeBSD))

(envelope-from )

id 1x8es8-00000000KTi-36vm

for dave@nl2k.ab.ca;

Mon, 21 Sep 2026 08:20:06 -0600

Received: by mail-pz2-f12.google.com with SMTP id 41be03b00d2f7-cc1cea4ae2cso2512379a12.0

for ; Mon, 21 Sep 2026 07:19:09 -0700 (PDT)

ARC-Seal: i=1; a=rsa-sha256; t=1790000343; cv=none;

d=google.com; s=arc-20260327;

b=lW06Kn76KM01oHeFeMOhWwqTBSgNh0jPTWXPBQGQ7/bQ0zUO9XBNnwopxbEFjpmVyd

5WXy8/w6tPirjgS3GH4WZWAnJUS/rCjkqd8Cgj+RrablXVxEPa0D7Tda7qRpQx8lRuLV

svzvMPvJ5eRV1no/tuXarHpsaULbkBIGyN9LQKWj9l1jrmZQsPa3SBuLQWjlSFtlFcX+

5D2Glq6sM6R2p2JhaS2C2Rf6ALS2szHtROZjovjH76X2OYMZxmPZi9/2jBvLlWhX6kwq

+XsWyMbc0boxALKvvC4yiamxAA1oTFPZtfZHzGUeqWmTA+7A/Kd9P+jwsckG4aOpUT1a

FIsg==

ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20260327;

h=to:subject:message-id:date:from:mime-version:dkim-signature;

bh=yKRCSYgqMEKFHtW8TGCOWN0XrLNv9FoUh22hHKtIqfI=;

fh=uWMryb96Izk6ZmDZCubdYP24Mnm+lNqDjLYVCVC8ZAA=;

b=WQ5OjwdM1j1V8fhdB9HahNKIv7DJcgSdqtcnfJi2Mz/3lXt+FHY80QskQQIZCoZcVh

JtWKd1mBj+pWHwjUq2du5KeJfj1q1Xq+dz6YakwVGiwY5csSFhMJH8YZ6wEL3w+Lhg2y

mA+spa1TFXa8L1vbPRLvz0NWojnX89OY/33fiV/9POHiUTt6LS83fkUxrRIsQQEPOH41

iPQzdfUPNK1OanlfppXyaPqCZcvb60TDDLn0z423yle8ZOXovnK2ipWist7S+HOZ+FuY

6d+Wj//u/CRe62Wz7DdEktHQ/j+G2XH6EtriW1dOL32f4511C5twGwpiBmzzO1Te6Spe

ojHA==;

darn=nl2k.ab.ca

ARC-Authentication-Results: i=1; mx.google.com; arc=none

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=gmail.com; s=20251104; t=1790000343; x=1790605143; darn=nl2k.ab.ca;

h=content-type:to:subject:message-id:date:from:mime-version:from:to

:cc:subject:date:message-id:reply-to:content-type;

bh=yKRCSYgqMEKFHtW8TGCOWN0XrLNv9FoUh22hHKtIqfI=;

b=Zl1MBi89C5Y9+cK/UrdRWTHSLc+ZIPqpHbT0gUsPsfT+7z2atwbWeMSIAhO1xyR+lT

Zp9og9KLyV7U/xKwV77cM6JCnlsBDZV6uQBMwLOFmOoQSx4gabKTWdc9BvlNnulOXHy5

FrDW+EgPmDtTjVxd/XTobgY9F/uDJtsFsBwhmuGdyVADE5iAn2mGbHqLJm36HhvvCCuj

/ttSQodWVPnFzIobIgmVXjnwjN+CA9igsuU6wMSzA021xmgXSGVijgpFrjFaGZiOMKp+

dEs+yKEfBTpPI0r/6v2QZeAQrMV+eUo4lwTUvM5Io7Fky/1F+Bp9vlIXxNvD0b3z4dN5

1ORA==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20260707; t=1790000343; x=1790605143;

h=content-type:to:subject:message-id:date:from:mime-version:x-gm-gg

:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to

:content-type;

bh=yKRCSYgqMEKFHtW8TGCOWN0XrLNv9FoUh22hHKtIqfI=;

b=WM2q4bUips+yiB/Oxum646RnY6jzmR+2tKuJAbr9iAPxPSRuCxq71z+fa8AzwgNGvS

a1xbe6o9CoR1BToDo3Q+k8BmwqmC20+TBbl1UuQMzIoqjdU7UtZH7FUYkEoFXFit9P9V

BH3/86hR3YFgcOWAYLuoepf4xn3oXF3e5gUj2mVh0PErImXkVkxQU/R8GCQiml3J5ZzP

zliltbYY5RTCIsrXvqKhxjlCPKWUjaNFo6SsKVyuQHgF0vUuTQ5tHYUWaTFVXLHu1Egj

yT99+1eC6bDbp8TClv+xzQ+7h1RWvHrTy3cuU7HZsmRj0c5zGl3tIRj/NgzFNjn+CRJK

codg==

X-Forwarded-Encrypted: i=1; AKwUvBxX9v8gSdz2/gAIXCz/Va0uCtKhMzU4uusM5KSWCw+Kh9v1N0NQLqSm2I9fa7h195hxBXd7@nl2k.ab.ca

X-Gm-Message-State: AFuF++kMGiMT7IZDTipjr3kkE9uIBaF/V0apD8KDNhTSydX+P/898Tlc

PADLyLpjJhL0gVRfoTYTwM6OT4TNx1hIeBJxr5IlMtrRnsuWxB4HXZUcGLC4qWVrktF+JmuUMpU

oUlDruaYNr+BciWlzCDdgo1lB1ROzD+2nEFc5p59puc7j

X-Gm-Gg: AYBFou0kkck1XbVsIp6yvoUFNp51r5PJ3NABKtTANKR/DjckTaoZyWlQIILTrMLPMA+

7PIlxuAaxz9OrKuOFurs8XLb0ejSAVCfPYiZBAPf4xSK/kc1nPUdJ1pIS724saXEcKlskgj3Rjc

IPK268qmN7xaaagS6qH0fPDJzdluKa5xBiM//wZ0HV89bQP7slskBD1g8+C/KwJaziPgypa+lpt

Tac9yw8evOry8RV+0wWv1rAp+1iML4kdwocE/j3YnNvg4sFpAu762yniw22xQiJ3vC+YHpgvEnJ

SuwRACOuyiu0+slg3LSDwu9FHUz/GXhXrYmSNy6EyvqznKNqugOWCCLG3hmk1SbUNmo+YtxGixh

7gZEAwbAqk1/hTQoqadXajqwH65jF+ey4ZfB/MBtTN8ozvURV

X-Received: by 2002:a05:690e:168e:b0:672:99e1:11cf with SMTP id

956f58d0204a3-67299e115demr2168950d50.108.1789999978269; Mon, 21 Sep 2026

07:12:58 -0700 (PDT)

MIME-Version: 1.0

From: "martingruenberg00@outlook.com"

Date: Mon, 21 Sep 2026 15:12:46 +0100

X-Gm-Features: AcwNN1UpLV2ftlA_VdtuHKouQpkSbtyin4jGxJlPdg-M4tzCQhAjXSf8kqv7lGg

Message-ID:

Subject: Confidential message

To: undisclosed-recipients:;

Content-Type: multipart/alternative; boundary="000000000000da4f35065bfed83e"

Bcc: dave@nl2k.ab.ca

X-Spam_score: 5.8

X-Spam_score_int: 58

X-Spam_bar: +++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Confidential message My name is Mr.Martin J. Gruenberg, and

I would like to present a business opportunity that may be advantageous for

both of us. In my position at the bank, I have come across funds [...]



Content analysis details: (5.8 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[74.125.228.12 listed in list.dnswl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[74.125.228.12 listed in will-spam-for-food.eu.org]

[74.125.228.12 listed in will-spam-for-food.eu.org]

[74.125.228.12 listed in will-spam-for-food.eu.org]

[74.125.228.12 listed in will-spam-for-food.eu.org]

[74.125.228.12 listed in will-spam-for-food.eu.org]

[74.125.228.12 listed in will-spam-for-food.eu.org]

[74.125.228.12 listed in will-spam-for-food.eu.org]

[74.125.228.12 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[74.125.228.12 listed in dnsbl.ahbl.org]

[74.125.228.12 listed in dnsbl.ahbl.org]

[74.125.228.12 listed in dnsbl.ahbl.org]

[74.125.228.12 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[74.125.228.12 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[74.125.228.12 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[74.125.228.12 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[74.125.228.12 listed in dnsbl.ahbl.org]

-0.0 SPF_PASS SPF: sender matches SPF record

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

1.5 GR_DOMAIN_UNDISC1 To contains undisclosed recipient (undisc)

0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends in

digit

[martin.gruenberg00(at)gmail.com]

0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider

[martin.gruenberg00(at)gmail.com]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[74.125.228.12 listed in wl.mailspike.net]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[74.125.228.12 listed in bl.score.senderscore.com]

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.7 PDS_FROM_2_EMAILS From header has multiple different addresses

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

2.1 UNDISC_MONEY Undisclosed recipients + money/fraud signs

Subject: {SPAM?} Confidential message



--000000000000da4f35065bfed83e

Content-Type: text/plain; charset="UTF-8"



Confidential message

My name is Mr.Martin J. Gruenberg, and I would like to present a business

opportunity that may be advantageous for both of us. In my position at the

bank, I have come across funds that belong to a deceased customer.



I have all the necessary documentation to facilitate the release of these

funds, and I am suggesting an equal division of the total amount. I kindly

ask for your response to discuss further details regarding the process and

your potential involvement. Rest assured, this opportunity is completely

risk-free.

to me



--000000000000da4f35065bfed83e

Content-Type: text/html; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable




Confidential message
My name is Mr.Martin J. Gruenb=

erg, and I would like to present a business opportunity that may be advanta=

geous for both of us. In my position at the bank, I have come across funds =

that belong to a deceased customer.

I have all the necessary documen=

tation to facilitate the release of these funds, and I am suggesting an equ=

al division of the total amount. I kindly ask for your response to discuss =

further details regarding the process and your potential involvement. Rest =

assured, this opportunity is completely risk-free.
to me




--000000000000da4f35065bfed83e--

WEalthsimple investment phish from Micfrosoft Outlook

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Mon, 21 Sep 2026 09:05:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.100.1 (FreeBSD))

(envelope-from )

id 1x8fZY-000000005jm-2G3t

for dave@doctor.nl2k.ab.ca;

Mon, 21 Sep 2026 09:04:48 -0600

Resent-From: The Doctor

Resent-Date: Mon, 21 Sep 2026 09:04:48 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from qhupl.tswenni.com ([20.240.194.100]:59893)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.100.1 (FreeBSD))

(envelope-from )

id 1x8e3H-00000000FIW-0itc

for root@nk.ca;

Mon, 21 Sep 2026 07:27:30 -0600

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; s=default; d=qhupl.tswenni.com;

h=Content-Type:MIME-Version:From:To:Subject:Date:Message-ID:Reply-To;

i=pnwtlfudo@qhupl.tswenni.com;

bh=kebY/a40L46UK6ZtTVSYqimbmv75m6Cz4GIpWVFmu7w=;

b=QkQtzdLwcZdVaRGAJaybWpok6OpHHVw613hmDFrseYAVnLyiF2BlEO4ewMRV79X79V2FBLnwWEtz

TxEjgZNDMTLkn+cGxW8XIWQPr3RWLGMvj+c/MN1AK0f8DG28n5RjDD3jou3pHS/Tlc1Itdqq6jJ9

GiNvNTYetLyTAcLU3vWoqPO2h/1ElKtZhoAXs6UUm1ckLnbYwKQhijzW7WN6cdsbZEqq8aL4gen4

hMSOI+fQyVRHefG6kFbCLNaM1vuBzJxiv3FZIOr/rq9rF4bp2mEwlsxPYiiONKoYyM5sFt1lcMuZ

QDv7R7hcp9EZXyLmql6TR3wL28ohcYO2hjW9+Q==

Content-Type: multipart/alternative;

boundary="===============3700870325063818660=="

MIME-Version: 1.0

From: Wealthsimple Team

To: root@nk.ca

Subject: Your tax details need an update

Date: Mon, 21 Sep 2026 09:26:35 -0400

Message-ID: <178999719504.30787.11039605708692946691@qhupl.tswenni.com>

Reply-To: feedback@wealthsimple.com

Feedback-ID: campaign:wealthsimple.com:mailer

X-Spam_score: 30.2

X-Spam_score_int: 302

X-Spam_bar: ++++++++++++++++++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Hello root, We noticed that the tax information on your account

is incomplete or out of date. To comply with current regulations, we ask

you to update it as soon as you can. Account: root@nk.ca Reference: 79012426

Status: Update required



Content analysis details: (30.2 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[20.240.194.100 listed in will-spam-for-food.eu.org]

[20.240.194.100 listed in will-spam-for-food.eu.org]

[20.240.194.100 listed in will-spam-for-food.eu.org]

[20.240.194.100 listed in will-spam-for-food.eu.org]

[20.240.194.100 listed in will-spam-for-food.eu.org]

[20.240.194.100 listed in will-spam-for-food.eu.org]

[20.240.194.100 listed in will-spam-for-food.eu.org]

[20.240.194.100 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[20.240.194.100 listed in dnsbl.ahbl.org]

[20.240.194.100 listed in dnsbl.ahbl.org]

[20.240.194.100 listed in dnsbl.ahbl.org]

[20.240.194.100 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[20.240.194.100 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[20.240.194.100 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[20.240.194.100 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[20.240.194.100 listed in dnsbl.ahbl.org]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-0.0 SPF_PASS SPF: sender matches SPF record

-0.0 SPF_HELO_PASS SPF: HELO matches SPF record

1.0 HK_RANDOM_FROM From username looks random

0.6 HK_RANDOM_ENVFROM Envelope sender username looks random

-0.0 T_RP_MATCHES_RCVD Envelope sender domain matches handover relay

domain

2.3 MANGLED_ACCNT BODY: mangled account(s)

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[20.240.194.100 listed in bl.score.senderscore.com]

1.5 MR_STRANGE_QUESTION URI: No description available.

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

1.0 J_WEEDS_U FULL: Dec/Hex char Enc [Uu]

1.0 J_WEEDS_C FULL: Dec/Hex char Enc [Cc]

1.0 J_WEEDS_F FULL: Dec/Hex char Enc [Ff]

1.0 J_WEEDS_K FULL: Dec/Hex char Enc [Kk]

1.0 J_WEEDS_S FULL: Dec/Hex char Enc [Ss]

1.0 J_WEEDS_H FULL: Dec/Hex char Enc [Hh]

1.0 J_WEEDS_R FULL: Dec/Hex char Enc [Rr]

1.0 J_WEEDS_Y FULL: Dec/Hex char Enc [Yy]

1.0 J_WEEDS_W FULL: Dec/Hex char Enc [Ww]

1.0 J_WEEDS_T FULL: Dec/Hex char Enc [Tt]

1.0 J_WEEDS_I FULL: Dec/Hex char Enc [Ii]

1.0 J_WEEDS_L FULL: Dec/Hex char Enc [Ll]

1.0 J_WEEDS_A FULL: Dec/Hex char Enc [Aa]

1.0 J_WEEDS_G FULL: Dec/Hex char Enc [Gg]

1.0 J_WEEDS_E FULL: Dec/Hex char Enc [Ee]

1.0 J_WEEDS_M FULL: Dec/Hex char Enc [Mm]

1.0 J_WEEDS_O FULL: Dec/Hex char Enc [Oo]

1.0 J_WEEDS_D FULL: Dec/Hex char Enc [Dd]

1.0 J_WEEDS_N FULL: Dec/Hex char Enc [Nn]

1.0 J_WEEDS_P FULL: Dec/Hex char Enc [Pp]

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

2.0 WINDOWS_7BITS Windows charset announced as 7 bit

1.5 VOWEL_FROM_6 Impronouncable from header (6 consecutive vowels)

0.0 GB_CUSTOM_HTM_URI Custom html uri

Subject: {SPAM?} Your tax details need an update



--===============3700870325063818660==

Content-Type: text/plain; charset=windows-1252

MIME-Version: 1.0

Content-Transfer-Encoding: 7bit



Hello root,



We noticed that the tax information on your account is incomplete or

out of date. To comply with current regulations, we ask you to update

it as soon as you can.



Account: root@nk.ca

Reference: 79012426

Status: Update required



Update your tax details:

https://www.huizegroup.com/?email=root@nk.ca&uid=lsiZEbByw4aKXXWPb2t5ezXq



It only takes a minute or two - and it helps you avoid withholding

tax at a higher rate.



Warm regards,

The Wealthsimple team



---

This email was sent automatically to root@nk.ca.

If this message was not meant for you, you can safely ignore it.



--===============3700870325063818660==

Content-Type: text/html; charset=utf-8

MIME-Version: 1.0

Content-Transfer-Encoding: 7bit















Your tax details need an update































































































Wealthsimple


A note from Wealthsimp‌le


Your tax details
need an update


Hello root,



We noticed that the tax​ information on your account is incomplete or ou​t of date. To comply with current regulations,​ we ask you to update it a‌s soon as you can.












Update your tax details




It only takes a minute‍ or two - and it helps you ‍avoid withholding tax at a higher rate.
























Account


root@nk.ca


Reference


98986909


Status


Update required




Warm regards,



The Wealthsimple team‌




This email was sent automatically to r​oot@nk.ca.


If this message was n‍ot meant for you, you can‌ safely ignore it.





Help

 · 

Privacy

 · 

Terms



Copyright Wealthsimp‍le Technologies Inc. Al‍l rights reserved.














--===============3700870325063818660==--

WEalthsimple investment phish from Micfrosoft Outlook

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Mon, 21 Sep 2026 09:05:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.100.1 (FreeBSD))

(envelope-from )

id 1x8fZP-000000005j0-35TR

for dave@doctor.nl2k.ab.ca;

Mon, 21 Sep 2026 09:04:39 -0600

Resent-From: The Doctor

Resent-Date: Mon, 21 Sep 2026 09:04:39 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from qhupl.tswenni.com ([20.240.194.100]:36327)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.100.1 (FreeBSD))

(envelope-from )

id 1x8e1f-00000000F6Q-2LzK

for doctor@nk.ca;

Mon, 21 Sep 2026 07:25:51 -0600

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; s=default; d=qhupl.tswenni.com;

h=Content-Type:MIME-Version:From:To:Subject:Date:Message-ID:Reply-To;

i=qnephqfss@qhupl.tswenni.com;

bh=6wEcFg+UK6gptLxLF1ObrRG9So55d7ZVi+57Y2NoBt0=;

b=MRbMbt3JZgdbljCBrXqwTNrQ3+HOeiFJn3qBnD85N/golk4ZYU8wh+3XS0+xxjGackWu2Q31yju+

egLSCGr+fi0TI/BYak7fpFkCd44iOE6IpZIChyjuD+zV7xgFL0/l3zNRZeUD6s9KwS6/kmSHh3ut

Q+bHbl0Q/Ggz/oqwomjzqNljp41qZt3AVC04391F/sGlTaF49db3GNfbdDjh0VdUmbk5pDqbd3Td

8FmuDKV9rX0LKMjrhd5tOB/gYx/9Ot7RooPGr+s/dPPdDdTBpMMpx5gEuyOGuSCsXhB9zXBTQHvY

ntEP7kwZea7NJer8wh/rjIVAmhPA0cosClzQ2Q==

Content-Type: multipart/alternative;

boundary="===============2890450572559252456=="

MIME-Version: 1.0

From: Wealthsimple investing

To: doctor@nk.ca

Subject: Your tax details need an update

Date: Mon, 21 Sep 2026 09:24:53 -0400

Message-ID: <178999709355.30787.11860610694060458852@qhupl.tswenni.com>

Reply-To: feedback@wealthsimple.com

Feedback-ID: campaign:wealthsimple.com:mailer

X-Spam_score: 31.9

X-Spam_score_int: 319

X-Spam_bar: +++++++++++++++++++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Hello doctor, We noticed that the tax information on your

account is incomplete or out of date. To comply with current regulations,

we ask you to update it as soon as you can. Account: doctor@nk.ca Reference:

68692127 Status: Update required



Content analysis details: (31.9 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[20.240.194.100 listed in will-spam-for-food.eu.org]

[20.240.194.100 listed in will-spam-for-food.eu.org]

[20.240.194.100 listed in will-spam-for-food.eu.org]

[20.240.194.100 listed in will-spam-for-food.eu.org]

[20.240.194.100 listed in will-spam-for-food.eu.org]

[20.240.194.100 listed in will-spam-for-food.eu.org]

[20.240.194.100 listed in will-spam-for-food.eu.org]

[20.240.194.100 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[20.240.194.100 listed in dnsbl.ahbl.org]

[20.240.194.100 listed in dnsbl.ahbl.org]

[20.240.194.100 listed in dnsbl.ahbl.org]

[20.240.194.100 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[20.240.194.100 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[20.240.194.100 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[20.240.194.100 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[20.240.194.100 listed in dnsbl.ahbl.org]

-0.0 SPF_PASS SPF: sender matches SPF record

-0.0 SPF_HELO_PASS SPF: HELO matches SPF record

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-0.0 T_RP_MATCHES_RCVD Envelope sender domain matches handover relay

domain

2.3 MANGLED_DOCTOR BODY: mangled doctor

2.3 MANGLED_ACCNT BODY: mangled account(s)

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[20.240.194.100 listed in bl.score.senderscore.com]

1.5 MR_STRANGE_QUESTION URI: No description available.

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

1.0 J_WEEDS_U FULL: Dec/Hex char Enc [Uu]

1.0 J_WEEDS_C FULL: Dec/Hex char Enc [Cc]

1.0 J_WEEDS_F FULL: Dec/Hex char Enc [Ff]

1.0 J_WEEDS_K FULL: Dec/Hex char Enc [Kk]

1.0 J_WEEDS_S FULL: Dec/Hex char Enc [Ss]

1.0 J_WEEDS_Q FULL: Dec/Hex char Enc [Qq]

1.0 J_WEEDS_H FULL: Dec/Hex char Enc [Hh]

1.0 J_WEEDS_R FULL: Dec/Hex char Enc [Rr]

1.0 J_WEEDS_Y FULL: Dec/Hex char Enc [Yy]

1.0 J_WEEDS_W FULL: Dec/Hex char Enc [Ww]

1.0 J_WEEDS_T FULL: Dec/Hex char Enc [Tt]

1.0 J_WEEDS_I FULL: Dec/Hex char Enc [Ii]

1.0 J_WEEDS_L FULL: Dec/Hex char Enc [Ll]

1.0 J_WEEDS_A FULL: Dec/Hex char Enc [Aa]

1.0 J_WEEDS_G FULL: Dec/Hex char Enc [Gg]

1.0 J_WEEDS_E FULL: Dec/Hex char Enc [Ee]

1.0 J_WEEDS_M FULL: Dec/Hex char Enc [Mm]

1.0 J_WEEDS_O FULL: Dec/Hex char Enc [Oo]

1.0 J_WEEDS_D FULL: Dec/Hex char Enc [Dd]

1.0 J_WEEDS_N FULL: Dec/Hex char Enc [Nn]

1.0 J_WEEDS_P FULL: Dec/Hex char Enc [Pp]

0.0 GB_CUSTOM_HTM_URI Custom html uri

1.5 VOWEL_FROM_6 Impronouncable from header (6 consecutive vowels)

2.0 WINDOWS_7BITS Windows charset announced as 7 bit

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

Subject: {SPAM?} Your tax details need an update



--===============2890450572559252456==

Content-Type: text/plain; charset=windows-1252

MIME-Version: 1.0

Content-Transfer-Encoding: 7bit



Hello doctor,



We noticed that the tax information on your account is incomplete or

out of date. To comply with current regulations, we ask you to update

it as soon as you can.



Account: doctor@nk.ca

Reference: 68692127

Status: Update required



Update your tax details:

https://www.jskxyl.com/?email=doctor@nk.ca&uid=pyvdTGHy8zhHHA89LSTf2ilK



It only takes a minute or two - and it helps you avoid withholding

tax at a higher rate.



Warm regards,

The Wealthsimple team



---

This email was sent automatically to doctor@nk.ca.

If this message was not meant for you, you can safely ignore it.



--===============2890450572559252456==

Content-Type: text/html; charset=utf-8

MIME-Version: 1.0

Content-Transfer-Encoding: 7bit















Your tax details need an update































































































Wealthsimple


A note from Wealthsim​ple


Your tax details
need an update


Hello doctor,



We noticed that the tax i​nformation on your acc‌ount is incomplete or out of date. To comply w‍ith current regulation‍s, we ask you to update it​ as soon as you can.












Update your tax details‌




It only takes a minute o‍r two - and it helps y​ou avoid withholding ta​x at a higher rate.
























Account


doctor@nk.ca


Reference


15302828


Status


Update required




Warm regards,



The Wealthsimple team




This email was sen‍t automatically to doctor@nk.ca.


If this message was not meant for you, you ca‌n safely ignore it.

​





Help

 · 

Privacy

 · 

Terms



Copyright Wealthsimpl‍e Technologies Inc. All rights reserved.














--===============2890450572559252456==--

Nigerian spam from Google GMail

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Mon, 21 Sep 2026 07:16:30 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.100.1 (FreeBSD))

(envelope-from )

id 1x8dsi-000000005Q2-30Lk

for dave@doctor.nl2k.ab.ca;

Mon, 21 Sep 2026 07:16:28 -0600

Resent-From: The Doctor

Resent-Date: Mon, 21 Sep 2026 07:16:28 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-vs2-f15.google.com ([74.125.227.15]:33116)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.100.1 (FreeBSD))

(envelope-from )

id 1x8ZEf-0000000005D-1B2D

for doctor@doctor.nl2k.ab.ca;

Mon, 21 Sep 2026 02:18:58 -0600

Received: by mail-vs2-f15.google.com with SMTP id 71dfb90a1353d-5c981b0d59cso1695301e0c.3

for ; Mon, 21 Sep 2026 01:17:34 -0700 (PDT)

ARC-Seal: i=1; a=rsa-sha256; t=1789978649; cv=none;

d=google.com; s=arc-20260327;

b=UEpYHECSIprMnRlyTi4btMNZ5fwroHhxqLyuLux6TUeULOP5l2J/4yih4pOh9q0Ju/

8iK+AraM/XGVEaj0WLtb3RRvzNRv9Pl2HpPhcnfLQItYce3eFUr2FSAxAcWfrH1YQSyB

72LLY/auE6Pa+Z1ORfIWlzfoW6V7PO7dzOXE5eqkph6J+HWmho3CCCycm6EZhuEE6nIM

94F6VqAGI13WB9LLZdLoAsOZiuijk8A+GtWfxjKE8MlNwhmppir8ZMAMhP+N8m9+/lvc

1x86nBMFeB64sEXx2bpuaI1S3ZrBUTvbu069xJxxoM+J2idcU0LYe6UeXEKT63ma9TKN

vG7A==

ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20260327;

h=to:subject:message-id:date:from:mime-version:dkim-signature;

bh=qLtEq47MTD8N1JiIKv5Taff3QQw25LQ4402UfIUTfio=;

fh=Cbj9vSK1W7yoRZRdOfZJMtquxUbc3jT+BV3cWtEo2fs=;

b=jDh70zaIKeJS+nKoFQcFy8pVgCM/aobQJqAmDpXS7X/yEojvNl8Ft49NXYs1E9dbH5

wZLppXZVU5qLid0AznSBEt0UEGGD8uSnQtLORKnwaPbyemF+VbseuLiBw279G7UXAH4S

5fHWHo0yKagcyaWkWc3wCs60aDvssl0K6eN0LPIGsalBLCFzX1br2DAQCZlbBafITWJt

fpNNqT8WixAM7WpDZOtJN+1o3tGxqU+/ecZL7ZqpXHRbgVjSLasTntrrnM55A0EVrwXF

NGjZ+c1IKa0tYUEmiuftSqcIFNJEcbkJ2cmNdvlOGZf1vLqJ6iD5ZcMhodYA/nerByln

gcyA==;

darn=doctor.nl2k.ab.ca

ARC-Authentication-Results: i=1; mx.google.com; arc=none

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=gmail.com; s=20251104; t=1789978649; x=1790583449; darn=doctor.nl2k.ab.ca;

h=content-type:to:subject:message-id:date:from:mime-version:from:to

:cc:subject:date:message-id:reply-to:content-type;

bh=qLtEq47MTD8N1JiIKv5Taff3QQw25LQ4402UfIUTfio=;

b=aFye5pB3L+ZAL6zStb19hnB8KFwjCvMrO2GoQYppgBvk88EA3Ygfc1PWT4ULMS7SrY

V1enXsCmnmuUqyxRkbieRZ7jI7mAJrCXWLsXuB7P6kuz/531LXY9AjmXlDbDowtwgNUV

Zozarhdy0Jpju8yj7kRVqqQd/y1bpBnXXGKtT9pF7ADe+shtwoTQn/HxBbpWyEX4X36y

oMkUKbi9DRWyU+fqe9IiF/9G9LSZf497GqJ/qcuIJdVDopCP+6xP3uP/PdmxtaOOZAwx

/OPlbc2JrYiXY5Nx9ZCJozuSioliztAFXE2DrArLSp56hn62hoBvLne3FOGkhctOy/Xg

pfpA==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20260707; t=1789978649; x=1790583449;

h=content-type:to:subject:message-id:date:from:mime-version:x-gm-gg

:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to

:content-type;

bh=qLtEq47MTD8N1JiIKv5Taff3QQw25LQ4402UfIUTfio=;

b=YJIrCd5VNe6887mFuLOYkFo27EU3HqgM+qH0jQiVu7XvYGr5QXe6JyxL+s1T6WyRlG

pvAGFpr9x8z3XL8QEsv8HbpBGhd8x1NXWee5oQFgkjOTXTUQiyTLpwvcsQP74a1keur/

N2kAJbqNwybg1OhZA1fRdOzcJE0SN+ySAMBjXCC0P3GTmnCzd39qseHEbZCn/+rcuYsz

yQE+x2thl5fFZDD7vLSlc+PYqLEiZY2KqG3sqnAiTropO9gutk6KuViEctS/7dqkCvpI

/mLyOuLcRY8GJwXmYcQaje+5u+9AL8HnNuO/z84NGrMac+DJRKmdcWhPE//sf7QENcFl

3m3g==

X-Forwarded-Encrypted: i=1; AKwUvBxc/s0T8XERZA0VOzxsDWY+Yt+evtS8FKVobNHd75srzYGpNwZ/CNPR02XU0elAszru0kic9ns=@doctor.nl2k.ab.ca

X-Gm-Message-State: AFuF++mD/Ly11nZObFTlbNXLpaHDRPB8pSo4rcEjxQKa2xo8bXi0CMvP

haMQvCxT7ckAqYtq0zwFitknTkVB54YuMvhFJkrrtrDZ4L8S1UL6LgzYxXL6IKdENoRgSq19oVe

Iv7FjpUkYwwe19VMXuiXXHajr/vuwLzsvhAS8YK0=

X-Gm-Gg: AYBFou2ukNH217j5Np9qBHujMhk7e5z8dCNS0FH5AmU2ZQGyKDcpbfndAFGTcuA0mS8

9hXmznScM52K/kdWO0CtfNXeDN0oiBzlqdMT3XMmG3HSngbOVHRNOUtu3Wad+uhUxY3Ue+lTnsZ

dqYC1EsCFUJL76jw5vX+vqtOY1xsnZ4mNeZYBT2+yOr6lIHUtDmMi/4dhPzF9pJ5pevqISM+Lvs

oIv8DtYw93oTTpGCdHEkz2dFHjNXLxxrO+4gbxz3lgxwuj1A+U8Ie0WRtMBLucXrPEq5Ea7BkKf

LKas5KrMv4qcaCR0wY7n5Z+gZNk3E0hV52B/tNZzexHmz1M8lasA/EMjxaZq8tUC0wjYhlOM1Po

hpwbsjss3gJa7zg==

X-Received: by 2002:a05:690e:1349:b0:671:8e1:2386 with SMTP id

956f58d0204a3-6717fcf014bmr2850265d50.44.1789978197126; Mon, 21 Sep 2026

01:09:57 -0700 (PDT)

MIME-Version: 1.0

From: "relieffunde@outlook.com"

Date: Mon, 21 Sep 2026 13:39:46 +0530

X-Gm-Features: AcwNN1XUbFwPZynzidLxneCpY8Aah1Xc9RFWlPxOam2yTgvODnIPZb1IIajwqLg

Message-ID:

Subject: UN HUMANITARIAN AID PROGRAM 2026

To: undisclosed-recipients:;

Content-Type: multipart/alternative; boundary="0000000000009871fd065bf9c651"

Bcc: doctor@doctor.nl2k.ab.ca

X-Spam_score: 20.5

X-Spam_score_int: 205

X-Spam_bar: ++++++++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: DEAR SIR/ MADAM, YOUR EMAIL HAS BEEN ELECTRICAL SELECTED FOR

UN HUMANITARIAN AID PROGRAM, TO CLAIM YOUR WINNING PRIZE, EMAIL US. relieffunde@outlook.com

YOUR FULL NAME: ADDRESS: NATIONALITY: MOBILE NUMBER: AGE: GENDER: OCCUPATION:





Content analysis details: (20.5 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[74.125.227.15 listed in will-spam-for-food.eu.org]

[74.125.227.15 listed in will-spam-for-food.eu.org]

[74.125.227.15 listed in will-spam-for-food.eu.org]

[74.125.227.15 listed in will-spam-for-food.eu.org]

[74.125.227.15 listed in will-spam-for-food.eu.org]

[74.125.227.15 listed in will-spam-for-food.eu.org]

[74.125.227.15 listed in will-spam-for-food.eu.org]

[74.125.227.15 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[74.125.227.15 listed in dnsbl.ahbl.org]

[74.125.227.15 listed in dnsbl.ahbl.org]

[74.125.227.15 listed in dnsbl.ahbl.org]

[74.125.227.15 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[74.125.227.15 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[74.125.227.15 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[74.125.227.15 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[74.125.227.15 listed in dnsbl.ahbl.org]

-0.0 SPF_PASS SPF: sender matches SPF record

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

1.5 GR_DOMAIN_UNDISC1 To contains undisclosed recipient (undisc)

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends in

digit

[kouamekouakouemmanuel49(at)gmail.com]

0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider

[kouamekouakouemmanuel49(at)gmail.com]

1.6 SUBJ_ALL_CAPS Subject is all capitals

1.7 DEAR_SOMETHING BODY: Contains 'Dear (something)'

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.7 PDS_FROM_2_EMAILS From header has multiple different addresses

1.2 UPPERCASE_75_100 message body is 75-100% uppercase

0.4 NAME_EMAIL_DIFF Sender NAME is an unrelated email address

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

3.5 POSSIBLE_GMAIL_PHISHER Apparent phishing email sent from a gmail

account

0.0 T_FILL_THIS_FORM_LONG Fill in a form with personal information

0.0 T_FILL_THIS_FORM_LOAN Answer loan question(s)

0.0 FILL_THIS_FORM Fill in a form with personal information

2.0 FILL_THIS_FORM_LONG Fill in a form with personal information

1.0 FREEMAIL_REPLY From and body contain different freemails

2.2 FILL_THIS_FORM_LOAN Answer loan question(s)

2.1 UNDISC_MONEY Undisclosed recipients + money/fraud signs

1.0 ADVANCE_FEE_4_NEW_FORM Advance Fee fraud and a form

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[74.125.227.15 listed in bl.score.senderscore.com]

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[74.125.227.15 listed in wl.mailspike.net]

Subject: {SPAM?} UN HUMANITARIAN AID PROGRAM 2026



--0000000000009871fd065bf9c651

Content-Type: text/plain; charset="UTF-8"



DEAR SIR/ MADAM,



YOUR EMAIL HAS BEEN ELECTRICAL SELECTED FOR UN HUMANITARIAN AID PROGRAM, TO

CLAIM YOUR WINNING PRIZE, EMAIL US. relieffunde@outlook.com



YOUR FULL NAME:

ADDRESS:

NATIONALITY:

MOBILE NUMBER:

AGE:

GENDER:

OCCUPATION:



--0000000000009871fd065bf9c651

Content-Type: text/html; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable



DEAR SIR=

/ MADAM,

ail=3D"gmail_signature">
=C2=A0=C2=A0
YOUR EMAIL HA=

S BEEN ELECTRICAL SELECTED FOR UN HUMANITARIAN AID PROGRAM, TO CLAIM YOUR W=

INNING PRIZE, EMAIL US.
=3D"_blank">relieffunde@outlook.com

YOUR FULL NAME:
ADDRESS: =


NATIONALITY:
MOBILE NUMBER:
AGE:
GENDER:
OCCUPATION:=C2=A0=





--0000000000009871fd065bf9c651--

Nigerian spam from Google Gmail

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Mon, 21 Sep 2026 07:16:30 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.100.1 (FreeBSD))

(envelope-from )

id 1x8dsZ-000000004vD-1txL

for dave@doctor.nl2k.ab.ca;

Mon, 21 Sep 2026 07:16:19 -0600

Resent-From: The Doctor

Resent-Date: Mon, 21 Sep 2026 07:16:19 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-vs2-f40.google.com ([74.125.227.40]:42177)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.100.1 (FreeBSD))

(envelope-from )

id 1x8ZDz-00000000Q0o-1IZ0

for doctor@nl2k.ab.ca;

Mon, 21 Sep 2026 02:18:17 -0600

Received: by mail-vs2-f40.google.com with SMTP id 71dfb90a1353d-5c9d8b323d9so262124e0c.1

for ; Mon, 21 Sep 2026 01:16:21 -0700 (PDT)

ARC-Seal: i=1; a=rsa-sha256; t=1789978575; cv=none;

d=google.com; s=arc-20260327;

b=OztxUv7ui6sVNCR/qywfp07DFT6IjX7d+T8zga+oVpMDxK3jxvc1vTme3CmwWEJvlj

aGYiXiUUMldN62ue1s2dBnsu5Wu0gk3+zCVtOodca+BYCnWGnxTIVHucDzH8e7LS8O8c

ttZP736nSC1nIAMtt9RSETnIWaxVRLfMjXoaEL2qpS1XJFmSCf1sPKA9Rn/bK/1wvrNi

kzFYpAdPTkGNOSIwCg7HcTT3eWH4AZzpLR61CRvZ5Bf1sLzLwG3gl3addHoGkne8XHCO

hkL1hYr3W0Su+pNa3CsqzIi4vuOELHOCJP1oKMs2c7hoUGuCDOmn0V3vIcMkVAv7cK5N

y1xQ==

ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20260327;

h=to:subject:message-id:date:from:mime-version:dkim-signature;

bh=qLtEq47MTD8N1JiIKv5Taff3QQw25LQ4402UfIUTfio=;

fh=w9KosX7+8a9wkLJKfYxbXKduy5eUK8cRyHHwq3AL2+8=;

b=Bh6mCG+8mwgJ6y+plcnvVXycBcFekFWcUp3x68KxLGBnIIuxjoED4n7yHsbFhrqmV5

7fuw2N1m4VEls0pe3J/yyCYRITFu580dycYTkJN5Qz3rLrd+XUbFEODg+KRIbQjKUVuP

BSEP9sRQAEslWUK2ahtLK99wGF+6FRTLHpDSwLivVTv7HRzmI1SiHeHVF+hdlf30jZ/s

Y8wb1TBwTaPOiLZEUEk7eYK5tRuVfjG7rNObQM5XsbOPYkHxPGsjcTL3QTT5NDfUP/WZ

EIfZ3xn0SJJ5f7Fxc86e1o8rcA1wKLkItb57fSOcPnq2AC7dEkZ4nUCxOX6F3wqsq7sZ

ZNRA==;

darn=nl2k.ab.ca

ARC-Authentication-Results: i=1; mx.google.com; arc=none

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=gmail.com; s=20251104; t=1789978575; x=1790583375; darn=nl2k.ab.ca;

h=content-type:to:subject:message-id:date:from:mime-version:from:to

:cc:subject:date:message-id:reply-to:content-type;

bh=qLtEq47MTD8N1JiIKv5Taff3QQw25LQ4402UfIUTfio=;

b=V/mOdTwkEjlN3G0V55LJ+L51ZLMroKLghgUlpBPlNaGnY8iNpwjRgcnJCQlSVN3dVJ

7YtLixQfgdODwq5dxL+Q40EOU5PCgXLTBHd/g7vqY+NvmR6O36w8+i24Ydr2xKUs/UL5

ENZojWbcGzqqLUAeVnbxX9ozrXAdOsHQWfPtrFZLRJF2OvFrlc8EGGzjTt6b0ZUgiAMR

smLm3GoQpVO/kmM7KqpSxryINkuFB3sUE4xZX5nR6Wx3IHkwfXms6HZJDyuhq4KHBAkl

kDMNDdBxP8rKZg7PQYojKZetJuLZeXu+LevpquSzxalyjtPRa0GWUEBiwc7WNoKqlgDN

1HPg==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20260707; t=1789978575; x=1790583375;

h=content-type:to:subject:message-id:date:from:mime-version:x-gm-gg

:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to

:content-type;

bh=qLtEq47MTD8N1JiIKv5Taff3QQw25LQ4402UfIUTfio=;

b=ASgV7d2SDtA8Brj09skq+H7fQz4jBrT7oykq0OqMS/62t4F8WQDjR5V6sd1It8N2u/

nUTUUm1rsa28jYwgIaat8opZDhL7JzKhwP9IDkyxIa13SQbxXHoi33o9O+VgJcG0POMO

UizNn+C+QY1EvQjPaScIb7j4j4dDkHebwHlqT2/MUrPi/YftAjk548nYR33FrHAq9Ji4

hB+JO7NRHC68EcrznIk0/DjRqCX3Pfd7FBwQ/P3KQT7AVheXakTdi03jJE49IKc320JF

MRouy5M4LMzpjzyZKmHEhDD56caanj82tFZwNNx9s9AwVbIDPefqPQELRVoPj8Iq1hM+

JrjQ==

X-Forwarded-Encrypted: i=1; AKwUvBzBURn9vm2/mHmEf2K3y3AUo5DGvShLnY+FPHvoojkDGwR2xh1qii9TXIHaiIhAjLS2UZjQ5vk=@nl2k.ab.ca

X-Gm-Message-State: AFuF++kluX411e8j19SZrwYQj3mmXg5B+f92kRoIEv+2IDHKUtCUJ0QE

b7cSyAvWM3cZISAPbcnMQ472SSfPx2o+FmWKOTISB5Y2xw1UjLY4DL8mKea1BZ7Mnh+Pkvd3gNq

Un9J8jaxwTCj5eBXZIhlZdr6Om6HsCbH0985jFhA=

X-Gm-Gg: AYBFou29sEMhD9/dVftckUbUE46//jLtgBDR0dBvbs/4IKr7W8knAzpUTNIz1/QApho

3BBQcFqUBUbz3XKglsnujkcH5Ik8IPRr3fyDFnRl1duMsMOMJSWlgILE7A1zSX46zdX741RsTxy

XipyS5oaZb9VmkZkGSoiajz5noyzXifwbXM88QFsOiroJX8CnCt005or9I6VKlsZraI5ks+rqKd

wyVOaOP+FY9i0YvibdMG81he//Wm0PSHOPX05/+s8OrQDN6qC/Da8WELjuMtWKdv35Z+hLGSvDS

pOWq5Gx2PqZeyu0jd+LklUJMt0iFxCGhJhSMQQkYISpDc8CvqDM0BvtFynS2P8xTDlTf6Mlmjg3

lVKbn+9PBs7eo

X-Received: by 2002:a05:690e:1349:b0:671:8e1:2386 with SMTP id

956f58d0204a3-6717fcf014bmr2850265d50.44.1789978197126; Mon, 21 Sep 2026

01:09:57 -0700 (PDT)

MIME-Version: 1.0

From: "relieffunde@outlook.com"

Date: Mon, 21 Sep 2026 13:39:46 +0530

X-Gm-Features: AcwNN1XUbFwPZynzidLxneCpY8Aah1Xc9RFWlPxOam2yTgvODnIPZb1IIajwqLg

Message-ID:

Subject: UN HUMANITARIAN AID PROGRAM 2026

To: undisclosed-recipients:;

Content-Type: multipart/alternative; boundary="0000000000009871fd065bf9c651"

Bcc: doctor@nl2k.ab.ca

X-Spam_score: 20.5

X-Spam_score_int: 205

X-Spam_bar: ++++++++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: DEAR SIR/ MADAM, YOUR EMAIL HAS BEEN ELECTRICAL SELECTED FOR

UN HUMANITARIAN AID PROGRAM, TO CLAIM YOUR WINNING PRIZE, EMAIL US. relieffunde@outlook.com

YOUR FULL NAME: ADDRESS: NATIONALITY: MOBILE NUMBER: AGE: GENDER: OCCUPATION:





Content analysis details: (20.5 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[74.125.227.40 listed in will-spam-for-food.eu.org]

[74.125.227.40 listed in will-spam-for-food.eu.org]

[74.125.227.40 listed in will-spam-for-food.eu.org]

[74.125.227.40 listed in will-spam-for-food.eu.org]

[74.125.227.40 listed in will-spam-for-food.eu.org]

[74.125.227.40 listed in will-spam-for-food.eu.org]

[74.125.227.40 listed in will-spam-for-food.eu.org]

[74.125.227.40 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[74.125.227.40 listed in dnsbl.ahbl.org]

[74.125.227.40 listed in dnsbl.ahbl.org]

[74.125.227.40 listed in dnsbl.ahbl.org]

[74.125.227.40 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[74.125.227.40 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[74.125.227.40 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[74.125.227.40 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[74.125.227.40 listed in dnsbl.ahbl.org]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-0.0 SPF_PASS SPF: sender matches SPF record

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

1.5 GR_DOMAIN_UNDISC1 To contains undisclosed recipient (undisc)

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[74.125.227.40 listed in bl.score.senderscore.com]

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[74.125.227.40 listed in wl.mailspike.net]

0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends in

digit

[kouamekouakouemmanuel49(at)gmail.com]

0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider

[kouamekouakouemmanuel49(at)gmail.com]

1.6 SUBJ_ALL_CAPS Subject is all capitals

1.7 DEAR_SOMETHING BODY: Contains 'Dear (something)'

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

3.5 POSSIBLE_GMAIL_PHISHER Apparent phishing email sent from a gmail

account

0.4 NAME_EMAIL_DIFF Sender NAME is an unrelated email address

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

1.2 UPPERCASE_75_100 message body is 75-100% uppercase

1.0 FREEMAIL_REPLY From and body contain different freemails

2.0 FILL_THIS_FORM_LONG Fill in a form with personal information

0.0 T_FILL_THIS_FORM_LONG Fill in a form with personal information

0.0 T_FILL_THIS_FORM_LOAN Answer loan question(s)

2.2 FILL_THIS_FORM_LOAN Answer loan question(s)

0.7 PDS_FROM_2_EMAILS From header has multiple different addresses

0.0 FILL_THIS_FORM Fill in a form with personal information

1.0 ADVANCE_FEE_4_NEW_FORM Advance Fee fraud and a form

2.1 UNDISC_MONEY Undisclosed recipients + money/fraud signs

Subject: {SPAM?} UN HUMANITARIAN AID PROGRAM 2026



--0000000000009871fd065bf9c651

Content-Type: text/plain; charset="UTF-8"



DEAR SIR/ MADAM,



YOUR EMAIL HAS BEEN ELECTRICAL SELECTED FOR UN HUMANITARIAN AID PROGRAM, TO

CLAIM YOUR WINNING PRIZE, EMAIL US. relieffunde@outlook.com



YOUR FULL NAME:

ADDRESS:

NATIONALITY:

MOBILE NUMBER:

AGE:

GENDER:

OCCUPATION:



--0000000000009871fd065bf9c651

Content-Type: text/html; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable



DEAR SIR=

/ MADAM,

ail=3D"gmail_signature">
=C2=A0=C2=A0
YOUR EMAIL HA=

S BEEN ELECTRICAL SELECTED FOR UN HUMANITARIAN AID PROGRAM, TO CLAIM YOUR W=

INNING PRIZE, EMAIL US.
=3D"_blank">relieffunde@outlook.com

YOUR FULL NAME:
ADDRESS: =


NATIONALITY:
MOBILE NUMBER:
AGE:
GENDER:
OCCUPATION:=C2=A0=





--0000000000009871fd065bf9c651--

Nigerian spam from Google Gmail

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Mon, 21 Sep 2026 07:16:30 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.100.1 (FreeBSD))

(envelope-from )

id 1x8dse-000000005Co-3Tvv

for dave@doctor.nl2k.ab.ca;

Mon, 21 Sep 2026 07:16:24 -0600

Resent-From: The Doctor

Resent-Date: Mon, 21 Sep 2026 07:16:24 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-vs2-f40.google.com ([74.125.227.40]:37398)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.100.1 (FreeBSD))

(envelope-from )

id 1x8ZDz-00000000020-21jS

for doctor@mail.nl2k.ab.ca;

Mon, 21 Sep 2026 02:18:17 -0600

Received: by mail-vs2-f40.google.com with SMTP id ada2fe7eead31-7a05d236f53so1487172137.1

for ; Mon, 21 Sep 2026 01:16:48 -0700 (PDT)

ARC-Seal: i=1; a=rsa-sha256; t=1789978602; cv=none;

d=google.com; s=arc-20260327;

b=s7DeJo7pKWIS3vkq78HA2fQ1ElIDkyUTLA2tWm7h8vq+bBlAaakA209XXtdAgEHwFB

W0Tujxh7YdLBpA9y+mZLSIMJPn52NnxZXsxu6lRh4asLL0SfRwKps3vsm/6lG9njkXTb

OjbjxnPCPbFeu0YfmMeGfg1xJruwE4/l+ZLXEEsw1w2+gr8cuKOEVGqWIiBltGREHjxJ

V4INLyvw8wH1cgp6jY15r4ObYLZy4IdiUraiuQhCloUFdINkrorqV1s9t5/FNuQ77eJz

jz6j+GR5wvixObWlVPZ+T2VVQkTNnBlBIKHiUnY9I4YX3NeWTLVvfSg1zR5w+bSZi2hP

7Hzg==

ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20260327;

h=to:subject:message-id:date:from:mime-version:dkim-signature;

bh=qLtEq47MTD8N1JiIKv5Taff3QQw25LQ4402UfIUTfio=;

fh=v7FrDHOmFdlqbSUe+de30mslTHOr7F3ITCzfdj0uJ4E=;

b=gVU0aSiWB/nx+FsF4mP1/84Rv04AjJbfaBtqYD/Fj9memRBj0Rrig5qNAiAjivMCSZ

gOR/nInvvXY4QbSoyf5aWoCmPZn8Q0OnP1SsGEd63WAGrOFP7BedadctgzEZ64JFR1ew

TMrNIzncEyEeVTdlW4tD6WD+l3II+pGEtO0az5RzknRiLdq9GuuDKUNTdOGTkzB+qRa2

r+oAJxBGXwXuEHm0bOA5V1FMwn1t25+Rrvbqz+KvM/wBCVH9SktViXtxk1EdeSxnHLaN

LZ8B+ttnu9MRy7ESWN6kgdP/Z3OAyufnCx4acHrW4qFeN8hYOg7sy00gwhfKbg7PWlQu

DO5w==;

darn=mail.nl2k.ab.ca

ARC-Authentication-Results: i=1; mx.google.com; arc=none

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=gmail.com; s=20251104; t=1789978602; x=1790583402; darn=mail.nl2k.ab.ca;

h=content-type:to:subject:message-id:date:from:mime-version:from:to

:cc:subject:date:message-id:reply-to:content-type;

bh=qLtEq47MTD8N1JiIKv5Taff3QQw25LQ4402UfIUTfio=;

b=jAL108uDJKeg/hdwGrbMOIBawhs1QYhZzX04oyzXyKPR/92N0uXZ1ojCuHslqDKFiv

HdI3Eroq0hu4AtqHFKA5QdZJBDcTgjXiSthb8UjS8zCdiYcT4uAs7gwB4OYIj1ibL6Ky

Tu4I2iHHqf9WwVEgE459gC8kvjRbrWZDma2S5Mgsd09uMk4M91YO9cYAA5kjO/qa32g1

UDKxaVs5B1dT9X7f4MacUeuPFXYZXZjILsYe/OyR79o/Ni9qKVIpd2zmBQWnORmPl/YF

bTmcF9tnbq5ezC+5n6iGxl63i0wiBmMwvpqcOTMkY9WZwCvQvzo2+vYDtXkonj2E2CKw

fItQ==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20260707; t=1789978602; x=1790583402;

h=content-type:to:subject:message-id:date:from:mime-version:x-gm-gg

:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to

:content-type;

bh=qLtEq47MTD8N1JiIKv5Taff3QQw25LQ4402UfIUTfio=;

b=eXmuX8C3hDQhPozBuFHdBtDATsBW8fhvBzLn1G58KDt0rvSbzP0fn2xj1rKqX2B8D/

2c6VVXbNx+xQKRQVsuQ1iIZVrO8NVqwEodZg2Vc9Y1mKcMzyheRt+rdqjLB++pQjTri+

ZLh84wuRKQ6zeStJ/b4ZHmop0g9j49VwnOPNwDuZ46FIWycq6feYxJ1XldDSi9wJwU9G

IAVlKlNKPAOk/y9DvTsGt8CHrZp5EhJrKA/yppnf3clWVd11eYWRBCUJAC35G+xF3JCC

1vpGLu9HDLPMvacUyfU+rVTB8nD9K9zP6jgDXU6hlOG864xYfa9D9Ip/WD3m2YTeh0pU

NsQw==

X-Forwarded-Encrypted: i=1; AKwUvBzUP3v6OjgSLkjFbMb1I1rk++Tk7mBQ2mpza9IV5zuBdP1mHa3iRj8rjKTeUDv3ZG/aNRFh9Gw=@mail.nl2k.ab.ca

X-Gm-Message-State: AFuF++kWLb0uzM78Aue9LHcajJJP49GnRz1PiFZxnLDRJjamr4oaJwY8

DbtI9SJ55ZPgQWzcJCzDMumKv6ZsdnID7ojsx6urGC4YMMTdL/mrVl/RZz1FASMkqdQREpV96/5

5rO2JiXo9K+jKIHSneLy7i66fVo2PmlaNFbmnMQY=

X-Gm-Gg: AYBFou1mknubPuUQA+CW6o0d2gK6v6ljkZpVvPc6AjTpjMAa+r9sz4amttrO0VpSSlb

JqbySegsF/f6fiU9MvzzrypDJ+D9CbRt/+Gi8AfWbWRY6tfCH+X/G7ZpDMzQHC+2yJaBmFuRIB7

hga3L3tk/saOqWoliUoKN5J2BJvHNbhHRlup59Kxk5OAQuRJFER1O0FXUPhEHEEO2IvojSx5OW2

AlHVhLxZcxc00zKYR3C6Gs1w+Pjon+IMWDvAEsxaQLNK7lW3JETHG+OBkrgP37W5nUobJKxZL2K

qq6+0Hb/3WsS2B/WIivE323IPg5+c+OXSpuHJOFVSb9dRH1LOlCP2336l8H3w2CoE+KbOjdUkTq

B+RWwgfvt9/HlxA==

X-Received: by 2002:a05:690e:1349:b0:671:8e1:2386 with SMTP id

956f58d0204a3-6717fcf014bmr2850265d50.44.1789978197126; Mon, 21 Sep 2026

01:09:57 -0700 (PDT)

MIME-Version: 1.0

From: "relieffunde@outlook.com"

Date: Mon, 21 Sep 2026 13:39:46 +0530

X-Gm-Features: AcwNN1XUbFwPZynzidLxneCpY8Aah1Xc9RFWlPxOam2yTgvODnIPZb1IIajwqLg

Message-ID:

Subject: UN HUMANITARIAN AID PROGRAM 2026

To: undisclosed-recipients:;

Content-Type: multipart/alternative; boundary="0000000000009871fd065bf9c651"

Bcc: doctor@mail.nl2k.ab.ca

X-Spam_score: 20.5

X-Spam_score_int: 205

X-Spam_bar: ++++++++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: DEAR SIR/ MADAM, YOUR EMAIL HAS BEEN ELECTRICAL SELECTED FOR

UN HUMANITARIAN AID PROGRAM, TO CLAIM YOUR WINNING PRIZE, EMAIL US. relieffunde@outlook.com

YOUR FULL NAME: ADDRESS: NATIONALITY: MOBILE NUMBER: AGE: GENDER: OCCUPATION:





Content analysis details: (20.5 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[74.125.227.40 listed in bl.score.senderscore.com]

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[74.125.227.40 listed in wl.mailspike.net]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[74.125.227.40 listed in will-spam-for-food.eu.org]

[74.125.227.40 listed in will-spam-for-food.eu.org]

[74.125.227.40 listed in will-spam-for-food.eu.org]

[74.125.227.40 listed in will-spam-for-food.eu.org]

[74.125.227.40 listed in will-spam-for-food.eu.org]

[74.125.227.40 listed in will-spam-for-food.eu.org]

[74.125.227.40 listed in will-spam-for-food.eu.org]

[74.125.227.40 listed in will-spam-for-food.eu.org]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[74.125.227.40 listed in dnsbl.ahbl.org]

[74.125.227.40 listed in dnsbl.ahbl.org]

[74.125.227.40 listed in dnsbl.ahbl.org]

[74.125.227.40 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[74.125.227.40 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[74.125.227.40 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[74.125.227.40 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[74.125.227.40 listed in dnsbl.ahbl.org]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-0.0 SPF_PASS SPF: sender matches SPF record

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

1.5 GR_DOMAIN_UNDISC1 To contains undisclosed recipient (undisc)

0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends in

digit

[kouamekouakouemmanuel49(at)gmail.com]

0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider

[kouamekouakouemmanuel49(at)gmail.com]

1.6 SUBJ_ALL_CAPS Subject is all capitals

1.7 DEAR_SOMETHING BODY: Contains 'Dear (something)'

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

1.2 UPPERCASE_75_100 message body is 75-100% uppercase

0.7 PDS_FROM_2_EMAILS From header has multiple different addresses

1.0 FREEMAIL_REPLY From and body contain different freemails

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

0.4 NAME_EMAIL_DIFF Sender NAME is an unrelated email address

3.5 POSSIBLE_GMAIL_PHISHER Apparent phishing email sent from a gmail

account

2.0 FILL_THIS_FORM_LONG Fill in a form with personal information

0.0 FILL_THIS_FORM Fill in a form with personal information

0.0 T_FILL_THIS_FORM_LONG Fill in a form with personal information

2.2 FILL_THIS_FORM_LOAN Answer loan question(s)

0.0 T_FILL_THIS_FORM_LOAN Answer loan question(s)

1.0 ADVANCE_FEE_4_NEW_FORM Advance Fee fraud and a form

2.1 UNDISC_MONEY Undisclosed recipients + money/fraud signs

Subject: {SPAM?} UN HUMANITARIAN AID PROGRAM 2026



--0000000000009871fd065bf9c651

Content-Type: text/plain; charset="UTF-8"



DEAR SIR/ MADAM,



YOUR EMAIL HAS BEEN ELECTRICAL SELECTED FOR UN HUMANITARIAN AID PROGRAM, TO

CLAIM YOUR WINNING PRIZE, EMAIL US. relieffunde@outlook.com



YOUR FULL NAME:

ADDRESS:

NATIONALITY:

MOBILE NUMBER:

AGE:

GENDER:

OCCUPATION:



--0000000000009871fd065bf9c651

Content-Type: text/html; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable



DEAR SIR=

/ MADAM,

ail=3D"gmail_signature">
=C2=A0=C2=A0
YOUR EMAIL HA=

S BEEN ELECTRICAL SELECTED FOR UN HUMANITARIAN AID PROGRAM, TO CLAIM YOUR W=

INNING PRIZE, EMAIL US.
=3D"_blank">relieffunde@outlook.com

YOUR FULL NAME:
ADDRESS: =


NATIONALITY:
MOBILE NUMBER:
AGE:
GENDER:
OCCUPATION:=C2=A0=





--0000000000009871fd065bf9c651--

Nigerian spam

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Tue, 22 Sep 2026 14:03:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.100.1 (FreeBSD))

(envelope-from )

id 1x96hD-000000001GC-23aC

for dave@doctor.nl2k.ab.ca;

Tue, 22 Sep 2026 14:02:31 -0600

Resent-From: The Doctor

Resent-Date: Tue, 22 Sep 2026 14:02:31 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from bsgw-00000288.cafe24.com ([118.219.235.58]:35247)

by doctor.nl2k.ab.ca with esmtp (Exim 4.100.1 (FreeBSD))

(envelope-from )

id 1x95Ak-00000000Hzp-0wh2

for root@nk.ca;

Tue, 22 Sep 2026 12:25:05 -0600

Received: from [130.254.47.122] ([::ffff:130.254.47.122])

(AUTH: LOGIN alsgud5488@nexpa.co.kr)

by bsgw-00000288.cafe24.com with esmtp; Mon, 21 Sep 2026 10:20:12 +0900

id 0000000005D89B62.000000006AB0864C.0000E214

Content-Type: text/plain; charset="iso-8859-1"

MIME-Version: 1.0

Content-Transfer-Encoding: quoted-printable

Content-Description: Mail message body

Subject: Re: Investment partnership

To: Recipients

From: "doha consultant"

Date: Sun, 20 Sep 2026 18:20:08 -0700

Reply-To: info@doha-consultant.com

Received-SPF: softfail (Address does not pass the Sender Policy Framework)

SPF=FROM;

sender=alsgud5488@nexpa.co.kr;

remoteip=::ffff:130.254.47.122;

remotehost=;

helo=[130.254.47.122];

receiver=bsgw-00000288.cafe24.com;

Message-ID:



Greetings



How are you doing? Do you need an investment partner for any of your projec=

ts? I have many investors who are willing and able to invest in your proje=

ct.



Send me your WhatsApp number or Mobile number for faster communications





Warm regards,

Ahmed Ahn Abudadi

investment consultant

Nigerian spam

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Tue, 22 Sep 2026 08:10:31 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.100.1 (FreeBSD))

(envelope-from )

id 1x91CX-00000000Jrg-48CC

for dave@doctor.nl2k.ab.ca;

Tue, 22 Sep 2026 08:10:29 -0600

Resent-From: The Doctor

Resent-Date: Tue, 22 Sep 2026 08:10:29 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from bsgw-00000288.cafe24.com ([118.219.235.58]:51792)

by doctor.nl2k.ab.ca with esmtp (Exim 4.100.1 (FreeBSD))

(envelope-from )

id 1x90no-00000000Gsq-3UxC

for root@nk.ca;

Tue, 22 Sep 2026 07:45:07 -0600

Received: from [130.254.47.122] ([::ffff:130.254.47.122])

(AUTH: LOGIN alsgud5488@nexpa.co.kr)

by bsgw-00000288.cafe24.com with esmtp; Mon, 21 Sep 2026 09:49:51 +0900

id 0000000005CA9548.000000006AB07F2F.00026F36

Content-Type: text/plain; charset="iso-8859-1"

MIME-Version: 1.0

Content-Transfer-Encoding: quoted-printable

Content-Description: Mail message body

Subject: Re: Investment partnership

To: Recipients

From: "doha consultant"

Date: Sun, 20 Sep 2026 17:49:48 -0700

Reply-To: info@doha-consultant.com

Received-SPF: softfail (Address does not pass the Sender Policy Framework)

SPF=FROM;

sender=alsgud5488@nexpa.co.kr;

remoteip=::ffff:130.254.47.122;

remotehost=;

helo=[130.254.47.122];

receiver=bsgw-00000288.cafe24.com;

Message-ID:



Greetings



How are you doing? Do you need an investment partner for any of your projec=

ts? I have many investors who are willing and able to invest in your proje=

ct.



Send me your WhatsApp number or Mobile number for faster communications





Warm regards,

Ahmed Ahn Abudadi

investment consultant

Nigerian spam from Google Gmail

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Mon, 21 Sep 2026 07:17:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.100.1 (FreeBSD))

(envelope-from )

id 1x8dsn-000000005dM-1FZQ

for dave@doctor.nl2k.ab.ca;

Mon, 21 Sep 2026 07:16:33 -0600

Resent-From: The Doctor

Resent-Date: Mon, 21 Sep 2026 07:16:33 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-vs2-f12.google.com ([74.125.227.12]:62942)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.100.1 (FreeBSD))

(envelope-from )

id 1x8ZFK-0000000007b-1H3L

for doctor@netknow.ca;

Mon, 21 Sep 2026 02:19:39 -0600

Received: by mail-vs2-f12.google.com with SMTP id 71dfb90a1353d-5c67e53002bso1546896e0c.0

for ; Mon, 21 Sep 2026 01:18:05 -0700 (PDT)

ARC-Seal: i=1; a=rsa-sha256; t=1789978679; cv=none;

d=google.com; s=arc-20260327;

b=JnXx7JhDBirtkC4wri4rb2RR5dTU7hbM9L/lAzX6XdQaMW/hr5knBUYnrZIjRZL+47

gxh8JGyYGZoqDPsgh4bG3ldLYmXxJGys7EDQUFu1KU2DgsOtM6weUj5Lpf9RvEqtuCX2

Y0obmf92FWR9lsrbwuJHekiDbJG0rumeO5e8tCuonZblaAhiTcyV+q8+FUYdGrUTVg0q

EqWY6e/F5yfzNbYafPojl8IC+Dop9Bo/+aMPQqu9iB8RnbU0oUF0oESVD52Z7F43JOCw

x3XYDk/16eISe59z7SynGQjhUtnH+20GIQxYUgc3AcvhOTh2r4K/oBgYczTaBIb/s0Z0

Cx2A==

ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20260327;

h=to:subject:message-id:date:from:mime-version:dkim-signature;

bh=qLtEq47MTD8N1JiIKv5Taff3QQw25LQ4402UfIUTfio=;

fh=tpQbCcdiUiekKUhLaHDY2Q/XS4l7J54HEaZAyxCHQp0=;

b=HIwY77UmajCCB0Wis+FfenQIoWw1ukCtcawX9pr1cmWp2T/rzfoa4cMPtSiG8yZKxe

GfWqOjxKYc0Mi0vCP6iJHvJn4u7VtbWqUXdBnu5WX0HW7+nokkPu02jXRsPoc5dCB1AQ

aIn2nv/iXGdx2v2Tt2JGzm7kxLJyg5gZw9W+lgP2e5IvkRXNybZl3oU/eXz/juT8toOR

6xDNewv6+r38UTJT/us3Z8WCfpR+KN/tqfTqfq5ML+me1HZi84vdB9mLWk/e3IvbNfJ7

rQN9v9cGU0QaeRVyMT+Yy4/5Ms6YGDVigJyUYwSs86KMFukP+sY+EaWy+XXzy1BKUVPD

+Y9g==;

darn=netknow.ca

ARC-Authentication-Results: i=1; mx.google.com; arc=none

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=gmail.com; s=20251104; t=1789978679; x=1790583479; darn=netknow.ca;

h=content-type:to:subject:message-id:date:from:mime-version:from:to

:cc:subject:date:message-id:reply-to:content-type;

bh=qLtEq47MTD8N1JiIKv5Taff3QQw25LQ4402UfIUTfio=;

b=fiAX53MhyaFQzrElVaYdfNHGoGL4xr+zsgaFUQObnUw6A6yFmnQ1Itg4Ag9gOQiAlu

W1yNb/1oRx0uH6D60AiXrshQ+OjDm1IGimuHyau2tc093TIZ6mIHEwJZ/o1A/H5jdOPg

7S97bNrJyBfzEg1Y8bxNKPXIvA+ShQlKcnu7wJV8rWYmDK9ZEp+oXbG/XXLA2+0t2DcC

+bmLVbi4yyohmdJBiEWJBTDcObp5gosSC47Wsx0pCUkzcRjhUgu5CwsKpTwsl2/iSxhZ

EyEhaXF7htJMtsFM/IXmhvZm/FEe86kmrI0A5GvUcZ2vojY7p0P5KKWv+3j21X+Cb4Xx

jE+A==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20260707; t=1789978679; x=1790583479;

h=content-type:to:subject:message-id:date:from:mime-version:x-gm-gg

:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to

:content-type;

bh=qLtEq47MTD8N1JiIKv5Taff3QQw25LQ4402UfIUTfio=;

b=daOx8PGU1MFoBeILT0X/mjLMrbC7kR+02idcJH16g50feBKpOyK/up7YJLwxv3SbeT

lp8fpRsztpeyQr8YkzkxByn/FgWNxLlQaOFp8VGSN3QACj/x7345wHUSxLDulyXhaVpW

BSgwTbPCb48dGV3+2gfEUxKxeKaAxrV4eePw5RW5WamQLz9Nu0zWOBurhOKP1QF+r4v+

tw7rONA5Qqh6v8E2WG8PwO1yYi8JZODZATANKOmrqVGysCCYAOx4Q3EQAowXOr7/k+aj

4LDn6CQ4IKd2bjBgXj4S3FVesFTnSQdJBnPr6dT34ZKa2RaXA62GMevYvxXOA8YnKLaw

0zZQ==

X-Forwarded-Encrypted: i=1; AKwUvBw+JC40Qq64qGmUvsa5n3KFilFcl+rekYu68QQ+qxo3o6mkIgYFviDdhhhFFR23QvsElSGcd2U=@netknow.ca

X-Gm-Message-State: AFuF++nCiwQj+TiOLA774eO5LpFkvpn5puDeCoXJAWhnPLx6IGTVfn7+

xhnXpsRLq8OUcDCMzsyB01S7PmSMcQyZrAR58xfdxIRt7QNKSHZt9X65hLMtoJD9unCiud7wgSK

HzVim3ylNjsxvIY51ArN1osiH+QSwfYeJg0ynhAc=

X-Gm-Gg: AYBFou3KOIDhwviYTfArDtp29wc3IFxIJfsW7OWvRQ4BvC0IAMoPbecocal6FeiOl77

BHCAm7CPdDYmEQ63vEfKdVDBvZcw6df0AVxKqaJ7hECk64aZjU68MHfy5bTS1H/xc0reqPE+x1M

gJR3fT7syTwxgJxXjdvE7amRR4ktvcleIotNBcapViYdeUz3ZYBzJlnXjx0pVrxtUCztQngmN+m

fJ9C20HzVY0a+CSIDyQw0UkwMAPAJtwZJtjQVfj48ZEa8YJxTOdSvQRGiMmnEm5nvKm455f4wju

iNPKoS8h5fHmJW6LURAXI8R0Sl1x+4o1DHLWnBw7BuIZ6iKyfs/llUyHPWTP2XmZI997OD01CzJ

DraY+eiZtcary

X-Received: by 2002:a05:690e:1349:b0:671:8e1:2386 with SMTP id

956f58d0204a3-6717fcf014bmr2850265d50.44.1789978197126; Mon, 21 Sep 2026

01:09:57 -0700 (PDT)

MIME-Version: 1.0

From: "relieffunde@outlook.com"

Date: Mon, 21 Sep 2026 13:39:46 +0530

X-Gm-Features: AcwNN1XUbFwPZynzidLxneCpY8Aah1Xc9RFWlPxOam2yTgvODnIPZb1IIajwqLg

Message-ID:

Subject: UN HUMANITARIAN AID PROGRAM 2026

To: undisclosed-recipients:;

Content-Type: multipart/alternative; boundary="0000000000009871fd065bf9c651"

Bcc: doctor@netknow.ca

X-Spam_score: 20.5

X-Spam_score_int: 205

X-Spam_bar: ++++++++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: DEAR SIR/ MADAM, YOUR EMAIL HAS BEEN ELECTRICAL SELECTED FOR

UN HUMANITARIAN AID PROGRAM, TO CLAIM YOUR WINNING PRIZE, EMAIL US. relieffunde@outlook.com

YOUR FULL NAME: ADDRESS: NATIONALITY: MOBILE NUMBER: AGE: GENDER: OCCUPATION:





Content analysis details: (20.5 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[74.125.227.12 listed in will-spam-for-food.eu.org]

[74.125.227.12 listed in will-spam-for-food.eu.org]

[74.125.227.12 listed in will-spam-for-food.eu.org]

[74.125.227.12 listed in will-spam-for-food.eu.org]

[74.125.227.12 listed in will-spam-for-food.eu.org]

[74.125.227.12 listed in will-spam-for-food.eu.org]

[74.125.227.12 listed in will-spam-for-food.eu.org]

[74.125.227.12 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[74.125.227.12 listed in dnsbl.ahbl.org]

[74.125.227.12 listed in dnsbl.ahbl.org]

[74.125.227.12 listed in dnsbl.ahbl.org]

[74.125.227.12 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[74.125.227.12 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[74.125.227.12 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[74.125.227.12 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[74.125.227.12 listed in dnsbl.ahbl.org]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[74.125.227.12 listed in list.dnswl.org]

-0.0 SPF_PASS SPF: sender matches SPF record

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

1.5 GR_DOMAIN_UNDISC1 To contains undisclosed recipient (undisc)

0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends in

digit

[kouamekouakouemmanuel49(at)gmail.com]

0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider

[kouamekouakouemmanuel49(at)gmail.com]

1.6 SUBJ_ALL_CAPS Subject is all capitals

1.7 DEAR_SOMETHING BODY: Contains 'Dear (something)'

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

3.5 POSSIBLE_GMAIL_PHISHER Apparent phishing email sent from a gmail

account

0.4 NAME_EMAIL_DIFF Sender NAME is an unrelated email address

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

1.2 UPPERCASE_75_100 message body is 75-100% uppercase

0.7 PDS_FROM_2_EMAILS From header has multiple different addresses

1.0 FREEMAIL_REPLY From and body contain different freemails

0.0 T_FILL_THIS_FORM_LONG Fill in a form with personal information

2.0 FILL_THIS_FORM_LONG Fill in a form with personal information

0.0 T_FILL_THIS_FORM_LOAN Answer loan question(s)

0.0 FILL_THIS_FORM Fill in a form with personal information

2.2 FILL_THIS_FORM_LOAN Answer loan question(s)

2.1 UNDISC_MONEY Undisclosed recipients + money/fraud signs

1.0 ADVANCE_FEE_4_NEW_FORM Advance Fee fraud and a form

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[74.125.227.12 listed in wl.mailspike.net]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[74.125.227.12 listed in bl.score.senderscore.com]

Subject: {SPAM?} UN HUMANITARIAN AID PROGRAM 2026



--0000000000009871fd065bf9c651

Content-Type: text/plain; charset="UTF-8"



DEAR SIR/ MADAM,



YOUR EMAIL HAS BEEN ELECTRICAL SELECTED FOR UN HUMANITARIAN AID PROGRAM, TO

CLAIM YOUR WINNING PRIZE, EMAIL US. relieffunde@outlook.com



YOUR FULL NAME:

ADDRESS:

NATIONALITY:

MOBILE NUMBER:

AGE:

GENDER:

OCCUPATION:



--0000000000009871fd065bf9c651

Content-Type: text/html; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable



DEAR SIR=

/ MADAM,

ail=3D"gmail_signature">
=C2=A0=C2=A0
YOUR EMAIL HA=

S BEEN ELECTRICAL SELECTED FOR UN HUMANITARIAN AID PROGRAM, TO CLAIM YOUR W=

INNING PRIZE, EMAIL US.
=3D"_blank">relieffunde@outlook.com

YOUR FULL NAME:
ADDRESS: =


NATIONALITY:
MOBILE NUMBER:
AGE:
GENDER:
OCCUPATION:=C2=A0=





--0000000000009871fd065bf9c651--

Web/SEO/App spam from Google Gmail

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Mon, 21 Sep 2026 07:15:30 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.100.1 (FreeBSD))

(envelope-from )

id 1x8drU-00000000NyF-2zy7

for dave@doctor.nl2k.ab.ca;

Mon, 21 Sep 2026 07:15:12 -0600

Resent-From: The Doctor

Resent-Date: Mon, 21 Sep 2026 07:15:12 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-pj2-f43.google.com ([74.125.227.171]:43270)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.100.1 (FreeBSD))

(envelope-from )

id 1x8WGm-000000006Fi-0SSz

for sales@nk.ca;

Sun, 20 Sep 2026 23:08:56 -0600

Received: by mail-pj2-f43.google.com with SMTP id 98e67ed59e1d1-39666bed444so192871a91.1

for ; Sun, 20 Sep 2026 22:08:00 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=theithubstudios.com; s=google; t=1789967274; x=1790572074; darn=nk.ca;

h=content-language:thread-index:content-type:mime-version:message-id

:date:subject:to:from:from:to:cc:subject:date:message-id:reply-to

:content-type;

bh=B53jV964AiH8Se+5cRigUdkpZ0vTl9VBLYmfjgMERUw=;

b=TvPId8gjKWua3RpDxJLzRzRdjYa7Qko8gvXSWHDsVAjtPIv9cnGQeURL90KNfNd6o5

ogVvwO/ICs8u4DBBousfemkKRFCsnWMEwnNT3UAZCzfY7q+NbyKjN6gEXFgpKIwmL0nW

ZdFKdCQbtS/keqGrEcyVYaMP2oh/eFAOFbHfFtm101u4L6EwC6scwPwNcG0GuQJ96pYl

7it6P1SWe7Ml0K/gaE39cxmjEd9VqWPetK4GZx5L8AxnSxa5ACdzMLbMHxTSTolWuDI1

pffl9qT/TVh9UFLpF2GMFJF2e9ph82/o9X7WirQTaz1/Q0Xsq6RNaZSqiboqX5bKO+v+

+nsA==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20260707; t=1789967274; x=1790572074;

h=content-language:thread-index:content-type:mime-version:message-id

:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject

:date:message-id:reply-to:content-type;

bh=B53jV964AiH8Se+5cRigUdkpZ0vTl9VBLYmfjgMERUw=;

b=ghGkfPqu6kHaGmEYhdc7N6KyiVOXPs9KIEhhIV+LIv83hFt77ctdUtTbSHirWP9k6f

X6+dfJxI4lX2bx3kPfPPC9njHsBQbjbqCjnbqwTYqfryGzd8X2ME4wlEAJ3ZQohO0kwC

S97O9fr7OUuTNLyYgD4FMAaB0+beqRGz+jP+PozYVyR/CF5t/CZqBgs8bXK/NOZlS95D

FUHY9AB/3+t4pV13eM5i7hno84HEcza2JMDS4OWN3Gii+9tSeQ4IJLPApnvrI10DWq1m

KGTJUBlXmcAiiKd2Q2U3XYoA6/pFsQmxrIq3BvfbirE2SuThXXbqrQoVUkppNVcMy1OZ

oNLg==

X-Gm-Message-State: AFuF++kbXzw6SzUm3fO4Uo1/kft0QgaUCE2O2F5pfKyqaVzVFezM06c9

iauVL9j7tWYM1Pt99eBWvL/A+fWTbsgnurnMlNToITYN6rHjWuKDO6zyrxDsWJwKUSlMz111fGE

sNp3x

X-Gm-Gg: AYBFou0K6MG5Yg8xMol8a7q8csj3DIj5FWF6+U+M9ONidxVhYy3ID8YQCMRSlI/M3YB

pkF4IE3plE6cEZB1T32N/pCs1OvGH0Ept+5QwGNW6zJ6cNiQCTKo93mdK4tfVLmtmLUDduoWNPj

SrDkbj08dg+VHMKv+NSIxptIkuE+8HyG8ZMPQQ5QrZH/DOimiIl7MikpYuztvSvPVco03a7TaTo

5Qbwm3C0LkToGh4u129qo7coa98bJG6ohUBto08+BTgb6KjrKsk6SEM9arFokdp8M0cuPu9DPts

zJfj7LdSn80ObnxWgKkV8QPg4s7yHi07b4w+e7IJprBg6xp1TMCt1/Hn0y3fjve1BC0HI9quccL

PiEcOLe3qoy0BHHZHSse90UDTRYiJOKKHNyC6/6GN0b2En1JIi5Q0dagFkn9gLLZulFr1NoxgWn

yGq6QYqOomHeVUda7lOf9+oQBHH6RSoMd+s67PlMt6we1kvr3UePJ8lNeYbkE2Niu5zmvxB0K/T

V0vvf/Us3j4iT30m/zjZXs=

X-Received: by 2002:a17:90b:58f0:b0:39e:261:4e13 with SMTP id 98e67ed59e1d1-39e54f42eefmr20207342a91.3.1789967274447;

Sun, 20 Sep 2026 22:07:54 -0700 (PDT)

Received: from DESKTOPL5RN3M6 ([2401:4900:8845:4648:a944:ec53:9887:cea0])

by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-39e6cb427casm12106608a91.17.2026.09.20.22.07.52

for

(version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128);

Sun, 20 Sep 2026 22:07:53 -0700 (PDT)

From: "Neile Adams"

To:

Subject: RE: 1st Page Ranking

Date: Mon, 21 Sep 2026 10:34:53 +0530

Message-ID:

MIME-Version: 1.0

Content-Type: multipart/alternative;

boundary="----=_NextPart_000_BBD6_01DD49B5.429C7140"

X-Mailer: Microsoft Outlook 14.0

Thread-Index: Ad1JfNHa9B9mogLSQQilKeT1u5scXA==

Content-Language: en-us

X-Spam_score: 5.2

X-Spam_score_int: 52

X-Spam_bar: +++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Hi, May I send you a web portfolio and prices? Please let

me know. Thank you,



Content analysis details: (5.2 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[2401:4900:8845:4648:a944:ec53:9887:cea0 listed]

[in will-spam-for-food.eu.org]

[2401:4900:8845:4648:a944:ec53:9887:cea0 listed]

[in will-spam-for-food.eu.org]

[2401:4900:8845:4648:a944:ec53:9887:cea0 listed]

[in will-spam-for-food.eu.org]

[2401:4900:8845:4648:a944:ec53:9887:cea0 listed]

[in will-spam-for-food.eu.org]

[2401:4900:8845:4648:a944:ec53:9887:cea0 listed]

[in will-spam-for-food.eu.org]

[2401:4900:8845:4648:a944:ec53:9887:cea0 listed]

[in will-spam-for-food.eu.org]

[2401:4900:8845:4648:a944:ec53:9887:cea0 listed]

[in will-spam-for-food.eu.org]

[2401:4900:8845:4648:a944:ec53:9887:cea0 listed]

[in will-spam-for-food.eu.org]

[74.125.227.171 listed in will-spam-for-food.eu.org]

[74.125.227.171 listed in will-spam-for-food.eu.org]

[74.125.227.171 listed in will-spam-for-food.eu.org]

[74.125.227.171 listed in will-spam-for-food.eu.org]

[74.125.227.171 listed in will-spam-for-food.eu.org]

[74.125.227.171 listed in will-spam-for-food.eu.org]

[74.125.227.171 listed in will-spam-for-food.eu.org]

[74.125.227.171 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[74.125.227.171 listed in dnsbl.ahbl.org]

[74.125.227.171 listed in dnsbl.ahbl.org]

[74.125.227.171 listed in dnsbl.ahbl.org]

[74.125.227.171 listed in dnsbl.ahbl.org]

[2401:4900:8845:4648:a944:ec53:9887:cea0 listed]

[in dnsbl.ahbl.org]

[2401:4900:8845:4648:a944:ec53:9887:cea0 listed]

[in dnsbl.ahbl.org]

[2401:4900:8845:4648:a944:ec53:9887:cea0 listed]

[in dnsbl.ahbl.org]

[2401:4900:8845:4648:a944:ec53:9887:cea0 listed]

[in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[74.125.227.171 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[74.125.227.171 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[74.125.227.171 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[74.125.227.171 listed in dnsbl.ahbl.org]

1.9 URIBL_JP_SURBL Contains an URL listed in the JP SURBL blocklist

[URI: theithubstudios.com]

1.9 URIBL_ABUSE_SURBL Contains an URL listed in the ABUSE SURBL blocklist

[URI: theithubstudios.com]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-0.0 SPF_PASS SPF: sender matches SPF record

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[74.125.227.171 listed in bl.score.senderscore.com]

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[74.125.227.171 listed in wl.mailspike.net]

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

Subject: {SPAM?} RE: 1st Page Ranking



This is a multipart message in MIME format.



------=_NextPart_000_BBD6_01DD49B5.429C7140

Content-Type: text/plain;

charset="us-ascii"

Content-Transfer-Encoding: 7bit



Hi,



May I send you a web portfolio and prices? Please let me know.



Thank you,







_____



From: Neile Adams

Sent: 02 September 2026 03:51 PM

To: sales@nk.ca

Subject: 1st Page Ranking



Hello,



We checked your website ''www.nk.ca" and see you have a good design and it

looks great, but it's not ranking on Google and other major search engine.



We are a SEO Expert and helped over 2500+ businesses rank on the (1st Page

on Google). Our rates are very affordable.



We can send you a price list?



Thanks

Neile Adams





------=_NextPart_000_BBD6_01DD49B5.429C7140

Content-Type: text/html;

charset="us-ascii"

Content-Transfer-Encoding: quoted-printable




xmlns:o=3D"urn:schemas-microsoft-com:office:office" =

xmlns:w=3D"urn:schemas-microsoft-com:office:word" =

xmlns:m=3D"http://schemas.microsoft.com/office/2004/12/omml" =

xmlns=3D"http://www.w3.org/TR/REC-html40">
HTTP-EQUIV=3D"Content-Type" CONTENT=3D"text/html; =

charset=3Dus-ascii">
(filtered medium)">

class=3DWordSection1>


style=3D'font-size:11.0pt;font-family:"Calibri","sans-serif"'>Hi,

=

May I send you a web portfolio and prices? Please let me =

know.

Thank you,


style=3D'font-size:11.0pt;font-family:"Calibri","sans-serif"'>=


style=3D'text-align:center'>
style=3D'font-size:11.0pt;font-family:"Calibri","sans-serif"'>

size=3D3 width=3D"100%" align=3Dcenter>


class=3DMsoNormal>
style=3D'font-size:11.0pt;font-family:"Calibri","sans-serif"'>From:
>
style=3D'font-size:11.0pt;font-family:"Calibri","sans-serif"'> Neile =

Adams
Sent: 02 September 2026 03:51 PM
To: =

sales@nk.ca
Subject: 1st Page Ranking

Hello,

We =

checked your website ‘‘www.nk.ca” and see you have a =

good design and it looks great, but it’s not ranking on Google and =

other major search engine.

We are a SEO Expert and helped over =

2500+ businesses rank on the (1st Page on Google). Our rates are very =

affordable.

We can send you a price =

list?

Thanks
Neile =

Adams



------=_NextPart_000_BBD6_01DD49B5.429C7140--



Crypto Database spam

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Sun, 20 Sep 2026 20:38:30 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.100.1 (FreeBSD))

(envelope-from )

id 1x8TvI-000000004nL-1jo2

for dave@doctor.nl2k.ab.ca;

Sun, 20 Sep 2026 20:38:28 -0600

Resent-From: The Doctor

Resent-Date: Sun, 20 Sep 2026 20:38:28 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from dehliz.cenayhosting.com ([95.173.177.4]:57066)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.100.1 (FreeBSD))

(envelope-from )

id 1x8OxH-00000000JWP-1j3Q

for sales@nk.ca;

Sun, 20 Sep 2026 15:20:21 -0600

DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed;

d=endtech.com.tr; s=default; h=Content-Transfer-Encoding:Content-Type:

MIME-Version:Date:Subject:To:From:Reply-To:Message-ID:Sender:Cc:Content-ID:

Content-Description:Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc

:Resent-Message-ID:In-Reply-To:References:List-Id:List-Help:List-Unsubscribe:

List-Unsubscribe-Post:List-Subscribe:List-Post:List-Owner:List-Archive;

bh=RrR0M4ngbg3RlrnwLNG7t74JDtTLbb8XdBw2bmYvV8w=; b=SE48MDf4DzuyYNUCDkSmrJHkAQ

18AEWkZYVlzTjONVFm4TrclsSzBUYLRGRH4ULgNgplL4dR7C7I7OlEmTXBWHH5uyaM9zqzaUc1/3p

zU33QMmkHHe6deC/pVafpaCxEMEWQ9qMHXGQnmBXmRX+UFFmivfAIZcge5QwffY4g4oaCyrrVq5Pa

vPg/Q+KuDUFjWC7+/uESDXcEl/G4nmIBkPWTVteC0hl1pDWySFRKqXXi1oSvobLIXNtmZONmhqcJM

3vnPr4bwUfQttrzTpjLLUpNeB4qXdA6NghuTjVx6vlEca4wOiHbjXdOrmjM03nPGCTfH7kwXrjfH8

MKRjsscg==;

Received: from ip68-231-132-74.tc.ph.cox.net ([68.231.132.74]:54270 helo=googlemail.com)

by dehliz.cenayhosting.com with esmtpsa (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.100)

(envelope-from )

id 1x8OnR-0000000GJbn-34Yx;

Mon, 21 Sep 2026 00:10:01 +0300

Message-ID: <2451274fbb7f555e7dd2cb6091d07a70c63f7eb0@endtech.com.tr>

Reply-To: Paul

From: Paul

To: Pia

Subject: 1win casino database for sale and cryptorino database for sale

Date: Sun, 20 Sep 2026 23:09:17 +0200

MIME-Version: 1.0

Content-Type: text/plain; charset="utf-8"

Content-Transfer-Encoding: quoted-printable

X-AntiAbuse: This header was added to track abuse, please include it with any abuse report

X-AntiAbuse: Primary Hostname - dehliz.cenayhosting.com

X-AntiAbuse: Original Domain - nk.ca

X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12]

X-AntiAbuse: Sender Address Domain - endtech.com.tr

X-Get-Message-Sender-Via: dehliz.cenayhosting.com: authenticated_id: ozgur.ozen@endtech.com.tr

X-Authenticated-Sender: dehliz.cenayhosting.com: ozgur.ozen@endtech.com.tr

X-Source:

X-Source-Args:

X-Source-Dir:



hello,



I am selling the following databases



All records contain contact details such as email addresses, names, physi=

cal addresses, phone numbers, and more.



cryptorino.io.sql (A crypto casino =E2=80=94 complete database)

Price: $900



1win.com.sql (An online casino =E2=80=94 very large)

63 million records

Price: $900



If you are interested contact me on Telegram at @paulxq9 or paulxq99 or p=

aulxq999 , if one username does not work try another.



I accept only bitcoin or another cryptocurrency as payment method.



Do not reply to this email, instead, contact me on Telegram if you are in=

terested!









checmtuxhvksvyorjgryxuxduubcgxjyrvumwfqasuyycwiavyhfzvcdwjrnyh

Fedex phish from Amazon

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Sun, 20 Sep 2026 20:38:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.100.1 (FreeBSD))

(envelope-from )

id 1x8Tuo-000000004h6-1r2Q

for dave@doctor.nl2k.ab.ca;

Sun, 20 Sep 2026 20:37:58 -0600

Resent-From: The Doctor

Resent-Date: Sun, 20 Sep 2026 20:37:58 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from a3-11.smtp-out.eu-west-1.amazonses.com ([54.240.3.11]:34379)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.100.1 (FreeBSD))

(envelope-from <010201a0c07636c3-0984e5b6-ad70-4c61-aa13-60c3dca3c635-000000@send.mikozod.ro>)

id 1x8NyA-00000000CrI-0qU7

for root@nk.ca;

Sun, 20 Sep 2026 14:17:11 -0600

DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/simple; s=resend;

d=mikozod.ro; t=1789935367;

h=From:To:Subject:Message-ID:Date:MIME-Version:Content-Type;

bh=/DiFIw90bwJcmnIG5O1bQdu3Jkw27RFLCPq29qPDYSY=;

b=n4uUuzExP4W4tyoWYvRrqQuz63FAIX5pWkdFUVPLJSi4O8iU5qYfCwFWrpRR4yg1

dq7sNiYhGQEk4P8l+OkpSFkTlBpe8bpobmtCvQ+GGlsLLKbAfq/GUAK/GSxNELbM34A

rLsyn2SUz1esP5zcaAkPRX7ya8OYq5T2lh6BmEwI=

DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/simple;

s=shh3fegwg5fppqsuzphvschd53n6ihuv; d=amazonses.com; t=1789935367;

h=From:To:Subject:Message-ID:Date:MIME-Version:Content-Type:Feedback-ID;

bh=/DiFIw90bwJcmnIG5O1bQdu3Jkw27RFLCPq29qPDYSY=;

b=M0cuM7H4rWB7K+KF3n/ekcnT54Z2VpZdO1zgWKzNX3QFsgJPsMl1/GYEfTN5hh7B

xXUKRawFE8oK3NpMt/8rr0M+BtL4zSpZMuc79t6/difblZf5I5wNbWkairRMbY1vf7N

8qr+RBEk0YcRqlELrBd7jkterNKBrtFfgND2jnLs=

From: FedEx Notifications

To: root@nk.ca

Subject: Your Delivery Update

Message-ID: <010201a0c07636c3-0984e5b6-ad70-4c61-aa13-60c3dca3c635-000000@eu-west-1.amazonses.com>

Date: Sun, 20 Sep 2026 20:16:07 +0000

MIME-Version: 1.0

Content-Type: multipart/alternative;

boundary="--_NmP-7708f40fd24cdab8-Part_1"

Feedback-ID: :1.eu-west-1.dQwBQNzPKritNaf0NHG9k176MlOysSyr2bsAae6jgUY+J7I/jo76YVL7xEFKf4s/l6mk/N7vtc8v5Eb4ECQY8FKO7lWMTyEVdxBicrB37J4W1t2cu4x5vAUfHiG95IvByNZ3W4MksJl0PernfhcWMmjRhLY3Xl7xFq6ZH9DgpEY=:1.eu-west-1.duyiEkLYPi4nGdRFd7LaGmAjRWieZlOvGu1wIBVR/Ks=:AmazonSES

X-SES-Outgoing: 2026.09.20-54.240.3.11

X-Spam_score: 8.3

X-Spam_score_int: 83

X-Spam_bar: ++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: FedEx SHIPMENT UPDATE A shipment has arrived at your local

FedEx facility and is awaiting final delivery confirmation. Outstanding balance:

$14.99 CAD Tracking 7894 3210 5678 9012 Weight 2.5 kg Service International

Priority Reference INV-2026-0042



Content analysis details: (8.3 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[54.240.3.11 listed in will-spam-for-food.eu.org]

[54.240.3.11 listed in will-spam-for-food.eu.org]

[54.240.3.11 listed in will-spam-for-food.eu.org]

[54.240.3.11 listed in will-spam-for-food.eu.org]

[54.240.3.11 listed in will-spam-for-food.eu.org]

[54.240.3.11 listed in will-spam-for-food.eu.org]

[54.240.3.11 listed in will-spam-for-food.eu.org]

[54.240.3.11 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[54.240.3.11 listed in dnsbl.ahbl.org]

[54.240.3.11 listed in dnsbl.ahbl.org]

[54.240.3.11 listed in dnsbl.ahbl.org]

[54.240.3.11 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[54.240.3.11 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[54.240.3.11 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[54.240.3.11 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[54.240.3.11 listed in dnsbl.ahbl.org]

2.5 URIBL_DBL_PHISH Contains a Phishing URL listed in the DBL blocklist

[URI: mikozod.ro]

[URI: load.bz]

-0.0 SPF_PASS SPF: sender matches SPF record

2.0 GR_DOMAIN_AMAZON1 Received contains spam friendly host (amazon)

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[54.240.3.11 listed in list.dnswl.org]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[54.240.3.11 listed in bl.score.senderscore.com]

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[54.240.3.11 listed in wl.mailspike.net]

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

0.8 SARE_FROM_SPAM_WORD3 I don't know people named this!

2.0 RATWR8_MESSID Message-ID with excessive dashes and dollars

Subject: {SPAM?} Your Delivery Update



----_NmP-7708f40fd24cdab8-Part_1

Content-Type: text/plain; charset=utf-8

Content-Transfer-Encoding: quoted-printable



FedEx SHIPMENT UPDATE



A shipment has arrived at your local FedEx facility =

and is awaiting final delivery confirmation. Outstanding balance: $14.99 =

CAD







Tracking 7894 3210 5678 9012 Weight 2.5 kg Service International =

Priority Reference INV-2026-0042







Review your shipment details Review =

Details https://load.bz//JABj







Confirmation process Once you review the =

shipment details, you can confirm the delivery information on the same page=

. =E2=80=A2 Review the shipment information

=E2=80=A2 Confirm the delivery =

address

=E2=80=A2 Track the package status







View shipment details =

https://load.bz//JABj



Final-mile delivery partner KOGO



The final-mile portion of your shipment is handled by our delivery partner.=

Keep this reference available for tracking.



The outstanding balance on =

this shipment is $14.99 CAD.

Review the shipment details to proceed with =

delivery confirmation.



This message was sent regarding a shipment =

associated with your address.

=C2=A9 2026 FedEx. All rights reserved.

----_NmP-7708f40fd24cdab8-Part_1

Content-Type: text/html; charset=utf-8

Content-Transfer-Encoding: quoted-printable



=EF=BB=BF








0">

Shipment Update - Delivery Confirmation Required




Helvetica,sans-serif;-webkit-text-size-adjust:100%;-ms-text-size-adjust:100=

%;">




border=3D"0" style=3D"background:#f4f6f9;padding:20px 10px;margin:0;">














cellpadding=3D"0" cellspacing=3D"0" border=3D"0" style=3D"max-width:520px;w=

idth:100%;background:#ffffff;border-radius:16px;box-shadow:0 8px 32px =

rgba(0,0,0,0.10);border:1px solid #e0e3e9;margin:0 auto;">












































16px 0 0;">


border=3D"0">










0;letter-spacing:0.5px;">FedEx
ackground:rgba(255,255,255,0.20);padding:4px 14px;border-radius:20px;letter=

-spacing:0.5px;">SHIPMENT UPDATE









border=3D"0">














7;padding-bottom:12px;">

A shipment has arrived at your local FedEx =

facility and is awaiting final delivery confirmation.

7;padding-bottom:8px;">

Outstanding =

balance:
00;">$14.99 CAD







cellpadding=3D"0" cellspacing=3D"0" border=3D"0">




style=3D"padding:14px 0 14px 0;border-bottom:2px dashed =

#dde0e7;">







style=3D"margin-top:14px;">


















color:#666666;padding-bottom:8px;">


999;text-transform:uppercase;letter-spacing:0.5px;display:block;">Tracking<=

/span>

7894 3210 5678 =

9012
style=3D"font-size:11px;color:#666666;padding-bottom:8px;">


spacing:0.5px;display:block;">Weight


style=3D"font-size:14px;color:#1a1a1a;">2.5 kg



spacing:0.5px;display:block;">Service


style=3D"font-size:13px;color:#1a1a1a;">International Priority
66;">


etter-spacing:0.5px;display:block;">Reference

INV-2026-0042







cellpadding=3D"0" cellspacing=3D"0" border=3D"0">




style=3D"padding:14px 0 14px 0;border-bottom:2px dashed =

#dde0e7;">







cellpadding=3D"0" cellspacing=3D"0" border=3D"0" style=3D"margin-top:6px;">














7;padding-bottom:8px;">

Review your =

shipment details

style=3D"padding:8px 0 12px 0;">


style=3D"display:inline-block;background:#4D148C;color:#ffffff;padding:12px=

32px;border-radius:8px;text-decoration:none;font-size:16px;font-weight:600=

;">Review Details











#dde0e7;">







cellpadding=3D"0" cellspacing=3D"0" border=3D"0" style=3D"margin-top:6px;">




















7;padding-bottom:8px;">

Confirmation =

process

;line-height:1.7;padding-bottom:10px;">

Once you review the shipment =

details, you can confirm the delivery information on the same page.

8;padding-left:10px;padding-bottom:6px;">

=E2=80=A2 Review the shipment =

information


=E2=80=A2 Confirm the delivery address


=E2=80=A2 Track the package status











#dde0e7;">







style=3D"margin-top:6px;">








2px 0;">


oration:underline;font-size:13px;font-weight:600;">View shipment =

details







cellpadding=3D"0" cellspacing=3D"0" border=3D"0" style=3D"border:1px solid =

#e5e7eb;border-radius:10px;">




















3px;padding-bottom:4px;">Final-mile delivery partner
etter-spacing:0.5px;">KOGO



0;font-size:12px;color:#555555;line-height:1.6;">

The final-mile portion of=

your shipment is handled by our delivery partner. Keep this reference =

available for tracking.



24px;border-radius:0 0 16px 16px;border-top:1px solid #e6e9ef;">










t:1.7;">

The outstanding balance on this shipment is
style=3D"color:#1a1a1a;">$14.99 CAD.


Review the shipment =

details to proceed with delivery confirmation.











style=3D"max-width:520px;margin-top:12px;">








style=3D"font-size:10px;color:#999999;text-align:center;padding:6px =

0;line-height:1.6;">

This message was sent regarding a shipment associated =

with your address.


© 2026 FedEx. All rights reserved.












----_NmP-7708f40fd24cdab8-Part_1--

WEb/SEo/App spam from Microsoft Outlook

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Sun, 20 Sep 2026 09:57:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.100.1 (FreeBSD))

(envelope-from )

id 1x8Ju3-00000000CMR-2jng

for dave@doctor.nl2k.ab.ca;

Sun, 20 Sep 2026 09:56:31 -0600

Resent-From: The Doctor

Resent-Date: Sun, 20 Sep 2026 09:56:31 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-francecentralazolkn19013081.outbound.protection.outlook.com ([52.103.46.81]:38288 helo=PA4PR04CU001.outbound.protection.outlook.com)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.100.1 (FreeBSD))

(envelope-from )

id 1x8IzZ-000000007UF-2T9L

for root@nk.ca;

Sun, 20 Sep 2026 08:58:19 -0600

ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none;

b=GZ1hGx7WAM7U9zXN2dOiibI+XueHwkmY5fkoLd6r3OhMQJ5yj6kXcEOdJGpTwND0T0fOnZU7QprFeN+7gvi013p7/uXSKWGEs2M7uSKrM5TmGpISr4kTq8nuCjlU/xAuJRoDxMYFDOZrZbkp5a0gi7w0ct6vD4eJO65qH278G3PNQcqqAfp3PtpfMnwBbZp3qIYHud5J6Gs/06ohbzTiigGhqXFvPlvU/s2dSBnVP6rTEPQY0YswR1FL/3OxDPTdhqotMainL1SzmKojdZKBoEV7dpIVWkwGjUNtCUfYqaliwMg8VzoFv8pjw4g3F59goaYXunTph3Zf84qsbKGUXA==

ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;

s=arcselector10001;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1;

bh=bYjj2KpAg/P/khfCy1cLohfe4tF6cTr/d9IR1NItwS4=;

b=XTsPNHYExv7qJhbsG/Lbyv/7idNxSwOHkExzgGzZi830yPAZZ9WzQvAuR5tqWqDBetKddi8LfpqlDJSSCBcFxOp5voUK/PN+s/BehgzDFkTFPC0kTHAHtuo1JcG2Zq8uiOzdUQj0T3lT6lvXxgrVmAsyAWBeshwYCeWUWkC/75ohTt5SBb5Y7OX1mR+bJZlxVax+4tLcc2+ygtBCOaKEewVrqtwMrmxXhU6AX4YLf25CEQ66X1q5DQzSIXpijzS0/I2R+Ech4GER1q5s2TYzLHM4XhHiQ7bdYqgzwUe8sBoRr4ViI+NqDHg4/hzeXOMb/viBoj085axW8PIeLqjjzg==

ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=none; dmarc=none;

dkim=none; arc=none

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=hotmail.com;

s=selector1;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck;

bh=bYjj2KpAg/P/khfCy1cLohfe4tF6cTr/d9IR1NItwS4=;

b=dP8PJe8OJmAfNb1vxEn265vamv3jjl+rDBlxI4jeaSho92yFJRAkKnWPRg++XFtokfsCcv8j6fK33zGvVYtLmOlK65snP+J0KUuZOpsMK0KQlIqL5WRCiWVhgvY7kyslr/UhQmfIlzGqyXebiLklFi93SKZCnFIYsQ8GmECGo8TJWWOIp38CUSAJ9F/tz1905wfjO2wjfKxSI3nrWNJOXkABwBvQebVPBnrP3IJ/fRvgOGQft/6kdXJPcusynzim4Ci0/HeMV9u++oTQp3e/98gjrwxHu/oHjb3D+6cUpW29L7djvfzYvFIRCQNBDXzCqCmY/F9twK1LmmG6i2iFVw==

Received: from FRZP193MB2610.EURP193.PROD.OUTLOOK.COM (2603:10a6:d10:13d::21)

by AM9P193MB0966.EURP193.PROD.OUTLOOK.COM (2603:10a6:20b:1f3::8) with

Microsoft SMTP Server (version=TLS1_2,

cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.428.16; Sun, 20 Sep

2026 14:57:12 +0000

Received: from FRZP193MB2610.EURP193.PROD.OUTLOOK.COM

([fe80::17fe:2c38:eeb2:4a49]) by FRZP193MB2610.EURP193.PROD.OUTLOOK.COM

([fe80::17fe:2c38:eeb2:4a49%6]) with mapi id 15.21.0428.015; Sun, 20 Sep 2026

14:57:12 +0000

From: Kiera Eisenhauer

To: "root@nk.ca"

Subject: Issue on nk.ca

Thread-Topic: Issue on nk.ca

Thread-Index: AQHdSRBR/s7vUEmm2EG8AyoIDv0bbg==

Date: Sun, 20 Sep 2026 14:57:12 +0000

Message-ID:



Accept-Language: en-US

Content-Language: en-US

X-MS-Has-Attach:

X-MS-TNEF-Correlator:

x-ms-publictraffictype: Email

x-ms-traffictypediagnostic: FRZP193MB2610:EE_|AM9P193MB0966:EE_

x-ms-office365-filtering-correlation-id: 910be72b-83c7-4c24-14b5-08df1727741b

x-microsoft-antispam:

BCL:0;ARA:14566002|15080799012|20031999006|38102599003|39105399006|4140399003|37011999003|8060799015|31061999003|8062599012|19110799012|55001999006|24021099003|24071999003|25010399006|4302099013|440099028|3412199025|102099032|1602099012|40105399003|2607281247196008|10035399007;

x-microsoft-antispam-message-info:

=?us-ascii?Q?YwiMqIjsYPXK6/B5PE00KELOa853d77yJZ3/DW+znPaJNck3kXLQAEML9g3P?=

=?us-ascii?Q?02g5J9Vqr0/fvQa3kQU3bXxF+zSOS+nLH35QdQQKQXjM6jzv3kjJazyVHiNS?=

=?us-ascii?Q?X+THos02wGI7VkhN5FEL69h0dqx7N956hCPAuwf+kwD5DMmDPn8y9CgB60pG?=

=?us-ascii?Q?wv2ELlL/bN3KfUwuK3poohS8qs7aFY4X7G0nbroyUfkQlcBEZksl0yEOWBUI?=

=?us-ascii?Q?zD1YLlbYR10TAwjbRK16hsi0b8mCEpn4mFzH98Xi8q7+LS0JzYh3bGe8rPVJ?=

=?us-ascii?Q?Y3bq4jvymCAOGqrWzWIlWIDfkcTL1VJTSeTtWsHgPk9gkxBM8glnl2xstL7K?=

=?us-ascii?Q?5TpQWK4C/2roPDR4q5R+Yd/vWHGQLVVVjBv8tAY6OKSLTl2MeUxfp5LnwlDw?=

=?us-ascii?Q?za18VdTZLTRP/uRzf5XqMpYsjeYYIwCforGxVMchEnuxZiDkMxfORM0YH1xG?=

=?us-ascii?Q?LZgRl0i0g3L/jlmts/8jfuR5ObtT8/1lFdikl+OdY65lAgVg7gjOcC+yoc7T?=

=?us-ascii?Q?Ia1Uv5hYYeKT5SLvCaA5iMh5eA0TmRBNMv5Trf5nTlWl0WjKlVxXLQV0dV1b?=

=?us-ascii?Q?8CJuhaNG7JtouSMRmRkTedaoKyJDx2gDe1feDKiYhgQbAVDdXQKMRFweCetT?=

=?us-ascii?Q?6IFOu/mIc7PMQWz+RUDeHZTJ0BOKT8Iil+uQ7HsdiG96eVK7FxtysK94gdD0?=

=?us-ascii?Q?gWfbhkQukgtQ+Ws/LvRbDPrPsvdrKxbxlYeCrjx2xysnJ+W7f9Js3ALA4wLl?=

=?us-ascii?Q?lg14p4sZDA5T+5xnKJ1vlvA7m9TZwrXLEzOHFJDINFMlVEa3d8cNCwSx66uG?=

=?us-ascii?Q?0tg3Y6uiCjvkxJPUGvcxaZnKQGtuD2N7WIMbHD5n9Ag8NW8tX/nN/kXgoFA5?=

=?us-ascii?Q?zIfRuU22/RW3h+ex3cpykmZBq4xr7SymBN1qcSme+9tshQT/SbIzDUGPt6+w?=

=?us-ascii?Q?KeHvexa4qnzgCJGmna2kTupyxZB6hE3Jfnh63Idnw8g6pw39zWoJGSmJcOsb?=

=?us-ascii?Q?AhgNLLkkNat9moJ0tbmmmLNmELP31lGGjNegIJIcbvrKie7WDqlCrAJ0U1dC?=

=?us-ascii?Q?Vi5g1mQ2WSNHdltJrlqhtiq0ubC2jdui5H1eLUcI5WZCc89kmw9KGPPAxl0P?=

=?us-ascii?Q?1Jbu+Qn4Ikpj?=

x-ms-exchange-antispam-messagedata-chunkcount: 1

x-ms-exchange-antispam-messagedata-0:

=?us-ascii?Q?ZQasHvYArsRcnWhMujBsc/dC0akNocQztXK+LcqH/vYvJdbiZHgEFc9SovJY?=

=?us-ascii?Q?yJQSd96oQX8BWs6KlHBd2PgXMdGZ5V1fm6arypMDocdU08vcBcovuxwmeiAv?=

=?us-ascii?Q?dGBXDtnTDa8M5wurYdqWf7l3hdHaSNloby2Sp3zCXYJMEyKxocy2WrUwiDsy?=

=?us-ascii?Q?ANrbb2wprYXX422wxAMgX1TdVKu4RaJovcSl0kq9wuft8NauXRu7vOI0cbsU?=

=?us-ascii?Q?D3+0a/nAewf0/Lb9sT/7UPAAESEj2wx26t39wZQjTZ3sCo5mqrFEw0/NoCxj?=

=?us-ascii?Q?orlY6ZW+RaD1U6Nd5Pd7xcKztOeEHlIctZnnuGylwnkpOwxZPqHQM92AG9MH?=

=?us-ascii?Q?Ud+FKkOqR+5JCE8O73mrBp00lUd5l8paPFN0ElygwP/3gzT4f4hh87NwNUNS?=

=?us-ascii?Q?DIw/RROzADyAT87q+QuJ4zUul+Qhp2SPava8K21oHDJpM4q1Wwgb/r072c5w?=

=?us-ascii?Q?fb9GNDltwfXWEMukC8iN7ICfdIkN71aWSjFecfHQSdC6VVC/S8vFcNjcNBbr?=

=?us-ascii?Q?H5jjSQF1qQmjKYXby6DG3MhEDuvqQRREM4B/ZWHLMEMhntGuTtjwD6gz21uy?=

=?us-ascii?Q?wqVPSBqsyeL2+UMNI+HOcQWIvs2GHMCg7x/zxJp7g0JPIUYJ9RK8sA7kPGs+?=

=?us-ascii?Q?C+M+cLacm+Wy+KZ6MrwdI9IKnCxBw0WAQFM90Dr0v++GtDUrZBPFrVE/ktee?=

=?us-ascii?Q?9EAvz1jRQNmX+sTqgh9ld5+Qo9llegXwIfzONOq4W/iU8lYb7duExTw3FpgP?=

=?us-ascii?Q?u5Z2Bwi3LRHT+uSvEcpAK4AD8+DTWshtmHJIBFHYbZVikyL6ZIR4/nD/U8KQ?=

=?us-ascii?Q?to1/s4/2n2ZHSHLL2ZpzyLX8okpt6amef5prUnzyxmTURSb44H6PQW5fKAqc?=

=?us-ascii?Q?oev6cNeUDCvix8H6bD/XgxaNunYns3IsfteIFNfKeRW4q2BRPVxSHw2o2QRI?=

=?us-ascii?Q?z2MdmpwfIm4UhsW7seVsihXF/6URi/9yVnx6JUN5CC7ofj/SqPmBhAiCpuQM?=

=?us-ascii?Q?JR4pA3h2EdGlKL1oHx5Y3LJtgKoOob5uVEburch/7+K8fkEvpp8AAybZKtcQ?=

=?us-ascii?Q?KlZ0jcKbLPr28YVqz+jdomT8iyLUmm2LGf3xIQjoEoqXBUFnHrJatw3lHtEz?=

=?us-ascii?Q?F5E7p+o6y+9KgxTxP6U9LwjGerJe4t5n7yW+3reu7YbDNVmpbjcmJt7afPtL?=

=?us-ascii?Q?LealRqN9FwRHoUSHyMSv1bdJI/woYPKmSVymqpThCrcJnrn2XBZjjyh2wKAN?=

=?us-ascii?Q?8S1/roJ6KdZQ/GZS5Je1bSEA+8XxXB8Abko18yezP++5Sq0r5K8FEsoj18sO?=

=?us-ascii?Q?5rh0JjXEJZhyVBe0m8NVHxMmuTi8J8jZm97d0z2O1YUpLtHaSjtKj/CR96G6?=

=?us-ascii?Q?ouItuGsRt2IfBdC3Seza4NwBpQCT?=

Content-Type: multipart/alternative;

boundary="_000_FRZP193MB26107DEBBCFA26A9A7AC4F80C7852FRZP193MB2610EURP_"

MIME-Version: 1.0

X-OriginatorOrg: sct-15-20-9412-4-msonline-outlook-b2714.templateTenant

X-MS-Exchange-CrossTenant-AuthAs: Internal

X-MS-Exchange-CrossTenant-AuthSource: FRZP193MB2610.EURP193.PROD.OUTLOOK.COM

X-MS-Exchange-CrossTenant-RMS-PersistedConsumerOrg: 00000000-0000-0000-0000-000000000000

X-MS-Exchange-CrossTenant-Network-Message-Id: 910be72b-83c7-4c24-14b5-08df1727741b

X-MS-Exchange-CrossTenant-originalarrivaltime: 20 Sep 2026 14:57:12.8605

(UTC)

X-MS-Exchange-CrossTenant-fromentityheader: Hosted

X-MS-Exchange-CrossTenant-id: 84df9e7f-e9f6-40af-b435-aaaaaaaaaaaa

X-MS-Exchange-CrossTenant-rms-persistedconsumerorg: 00000000-0000-0000-0000-000000000000

X-MS-Exchange-Transport-CrossTenantHeadersStamped: AM9P193MB0966



--_000_FRZP193MB26107DEBBCFA26A9A7AC4F80C7852FRZP193MB2610EURP_

Content-Type: text/plain; charset="us-ascii"

Content-Transfer-Encoding: quoted-printable



Hello there,



Actually, I got issues on your business website www.nk.ca . With your permi=

ssion, I would like to send you a screenshot of those errors. Which is on y=

our Website.



Because of these issues you aren't rankings on Google.



May I send you, error's Screenshot ?



Thank you



Kiera



--_000_FRZP193MB26107DEBBCFA26A9A7AC4F80C7852FRZP193MB2610EURP_

Content-Type: text/html; charset="us-ascii"

Content-Transfer-Encoding: quoted-printable








>





Hello there,



Actually, I got issues on your business website www.nk.ca . With your pe=

rmission, I would like to send you a screenshot of those errors. Which is o=

n your Website.



Because of these issues you aren't rankings on Google.



May I send you, error's Screenshot ?



Thank you



Kiera









--_000_FRZP193MB26107DEBBCFA26A9A7AC4F80C7852FRZP193MB2610EURP_--

Nk.CA credential phishing from Google Gmail

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path: <2029283526@intime.cz>

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Sat, 19 Sep 2026 19:41:30 -0600

Received: from mail-ed1-f102.google.com ([209.85.208.102]:56778)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.100.1 (FreeBSD))

(envelope-from <2029283526@intime.cz>)

id 1x86Xx-00000000GFM-3xXs

for dave@doctor.nl2k.ab.ca;

Sat, 19 Sep 2026 19:41:01 -0600

Received: by mail-ed1-f102.google.com with SMTP id 4fb4d7f45d1cf-6a051b737d8so426531a12.1

for ; Sat, 19 Sep 2026 18:40:02 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=intime.cz; s=google; t=1789868396; x=1790473196; darn=doctor.nl2k.ab.ca;

h=message-id:date:mime-version:content-type:to:subject:from:from:to

:cc:subject:date:message-id:reply-to:content-type;

bh=89XtZuhjfivm4T4NuuYC2M0sYZaaaMD9PplD6cBpQXk=;

b=JknbBUnAcKJB4ukkOmUurrtxuURZztaPwutSmTf330wYVgPk/S29coFS7YU1vXJ7uB

eNTHBhcSHC7Co56keZ6Oh0gtu7UPcwdUXfJsJ1XZYcrYlIw8g61FzELg2tFSw1U/XtBK

nk20MipGsvGOTN9wub+4I0V4afgJZQmszgDJWCDTRDugwkhk9eAQQNgc1CS0EW+kRGsw

e5sA2d5IFpuAUQobYy/wXg1j9ONoadvk0m/zbCDbEsOxdrw8y/vVIsdOR5Gn6Bd3PZEY

EIUrvzZpZvVhxzBI6xG/VDbklu1EzbLbecSIgttYcyCDIJc2c7g6JCX4nla1TDQUS5ZZ

zjIw==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20260707; t=1789868396; x=1790473196;

h=message-id:date:mime-version:content-type:to:subject:from:x-gm-gg

:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to

:content-type;

bh=89XtZuhjfivm4T4NuuYC2M0sYZaaaMD9PplD6cBpQXk=;

b=lMyrMPSb+Ch3y2dy9jXx8YZIbfZu7tNggqJfAqAb0pFl7/5U9jL5oZ2KrNTswM7bgX

PjwoQisCmIL1dCy4onKGCsOn2wqzQtnqODoziGd4D6Vrjwl5DVBIDus0aiDlEWEjZX0n

FsgBZh1AF6VocU90sACgP1PTYDBnEl7eYnxTBFy2WdR6s1C1mETI4IKPuLHQMEAa0OMg

IqL4Xv+Soag9/BajZqFxXQditJgBD4bsJAe8VJZHPvJiNZwdj8eehuSoRfqjxtdkj1Jn

OPgfvnH1mMX//gl6MPq8b4sHiDRwBRRGy/ZolPYPGo73MaInx5Q1/r+6Qq8nmGvZ6554

JAIA==

X-Gm-Message-State: AFuF++kN/wCth8gj2Kkgk2u/sP1MseXwliT1ig9AY0oMYCjMYedWC0j5

6zQ5C3G/6vGEzQTz9Iw0G/UXrbdS2mOiU3qjbRK6QN24KFCyafh3BnUT9YTFfWJ1FhZJkZ1u5i/

+GpCiINhyMvIHWEqM6Aj6pcChyPU4GqlHXalSl6KSwNW4ynY=

X-Gm-Gg: AYBFou0nu0MwWoxmzXwr8g+cF6aymWnC7fE1/aYQqaUEQoivWeoRlrQ4D7ydI/vkHPv

DIyBJgs2dUEbyGTZdc1/uT1QW5EQjdA4IqIcfvMOVMVf2yiQPEn5uwBTS0MXNcbp+RwDfcH50Gm

spsaqD+lzSzocZMpDFvBUgsVzhjuZSGYc12KAlKDHpmDcKm6HShz68/XfALuGkVWsbcFMhkuQci

13xPkMZ+D/HDvy4th5ejlz6GQaC6osoBuxmui4po2ossaHrW9I1KOxTS7BjZfEsvob/t6nZltg6

Cii74VpfI5jtNXW0Di/MDHqrcNheGAcFk7XjONz/SGE3QH/y1W7LHUd7AzYsmMgkOJ6owRY0I0v

E+EUoVimPbGCL

X-Received: by 2002:a05:6402:42d3:b0:6a3:fdb0:c374 with SMTP id 4fb4d7f45d1cf-6aa531254d4mr4617325a12.13.1789868395573;

Sat, 19 Sep 2026 18:39:55 -0700 (PDT)

Received: from WIN-3V1QAPPLHFQ ([156.146.61.24])

by smtp-relay.gmail.com with ESMTPS id 4fb4d7f45d1cf-6aa67e6402esm1885340a12.10.2026.09.19.18.39.55

for

(version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128);

Sat, 19 Sep 2026 18:39:55 -0700 (PDT)

X-Relaying-Domain: intime.cz

From: "doctor.nl2k.ab.ca Security Team" <2029283526@intime.cz>

Subject: Your dave@doctor.nl2k.ab.ca Password Has Expired 9/19/2026

To:

Content-Type: multipart/related; type="multipart/alternative"; boundary="XldARmASP2JwWs14CZm=_Yb1bGATTy2jvA"

MIME-Version: 1.0

Date: Sat, 19 Sep 2026 18:39:55 -0700

Message-Id: <202619091839558B1D5E5BE2-25261FAF13@intime.cz>

X-Spam_score: 7.5

X-Spam_score_int: 75

X-Spam_bar: +++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Dear dave,, Your dave@doctor.nl2k.ab.ca https://fuzzy-tan-h6iahs7m.edgeone.dev/?/#dave@doctor.nl2k.ab.ca





Content analysis details: (7.5 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[156.146.61.24 listed in will-spam-for-food.eu.org]

[156.146.61.24 listed in will-spam-for-food.eu.org]

[156.146.61.24 listed in will-spam-for-food.eu.org]

[156.146.61.24 listed in will-spam-for-food.eu.org]

[156.146.61.24 listed in will-spam-for-food.eu.org]

[156.146.61.24 listed in will-spam-for-food.eu.org]

[156.146.61.24 listed in will-spam-for-food.eu.org]

[156.146.61.24 listed in will-spam-for-food.eu.org]

[209.85.208.102 listed in will-spam-for-food.eu.org]

[209.85.208.102 listed in will-spam-for-food.eu.org]

[209.85.208.102 listed in will-spam-for-food.eu.org]

[209.85.208.102 listed in will-spam-for-food.eu.org]

[209.85.208.102 listed in will-spam-for-food.eu.org]

[209.85.208.102 listed in will-spam-for-food.eu.org]

[209.85.208.102 listed in will-spam-for-food.eu.org]

[209.85.208.102 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[209.85.208.102 listed in dnsbl.ahbl.org]

[209.85.208.102 listed in dnsbl.ahbl.org]

[209.85.208.102 listed in dnsbl.ahbl.org]

[209.85.208.102 listed in dnsbl.ahbl.org]

[156.146.61.24 listed in dnsbl.ahbl.org]

[156.146.61.24 listed in dnsbl.ahbl.org]

[156.146.61.24 listed in dnsbl.ahbl.org]

[156.146.61.24 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[209.85.208.102 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[209.85.208.102 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[209.85.208.102 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[209.85.208.102 listed in dnsbl.ahbl.org]

2.5 URIBL_DBL_PHISH Contains a Phishing URL listed in the DBL blocklist

[URI: edgeone.dev]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[209.85.208.102 listed in list.dnswl.org]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

1.7 URIBL_BLACK Contains an URL listed in the URIBL blacklist

[URI: edgeone.dev]

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[209.85.208.102 listed in wl.mailspike.net]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[209.85.208.102 listed in bl.score.senderscore.com]

1.5 MR_STRANGE_QUESTION URI: No description available.

0.1 MXG_EMAIL_FRAG BODY: URI with email in fragment

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 HTML_IMAGE_RATIO_06 BODY: HTML has a low ratio of text to image area

0.0 NO_RDNS2 Sending MTA has no reverse DNS

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

0.6 URIBL_SBL Contains an URL's NS IP listed in the SBL blocklist

[URI: ns3.dnsv2.com/163.177.5.55]

[URI: ns3.dnsv2.com/117.135.128.155]

[URI: ns3.dnsv2.com/220.196.136.55]

[URI: ns3.dnsv2.com/125.94.59.155]

[URI: ns4.dnsv2.com/101.227.168.55]

Subject: {SPAM?} Your dave@doctor.nl2k.ab.ca Password Has Expired 9/19/2026



This is a multi-part message in MIME format



--XldARmASP2JwWs14CZm=_Yb1bGATTy2jvA

Content-Type: multipart/alternative;

boundary="z0MuNPkloI2eDCiR=_bqNwj9Rbtdot0nQo"



--z0MuNPkloI2eDCiR=_bqNwj9Rbtdot0nQo

Content-Type: text/plain; charset="iso-8859-1"

Content-Transfer-Encoding: quoted-printable





Dear dave,,



Your=20



dave@doctor.nl2k.ab.ca https://fuzzy-tan-h6iahs7m.edgeone.dev/?/#dave@=

doctor.nl2k.ab.ca



password is valid until=20



9/19/2026 https://fuzzy-tan-h6iahs7m.edgeone.dev/?/#dave@doctor.nl2k.a=

b.ca



, Please Kindly use this to associate the following to keep the same p=

assword.



Continue ?



Sincerely,



doctor.nl2k.ab.ca Security=20



Team.



--z0MuNPkloI2eDCiR=_bqNwj9Rbtdot0nQo

Content-Type: text/html; charset="iso-8859-1"

Content-Transfer-Encoding: quoted-printable








8859-1">

Your dave@doctor.nl2k.ab.ca Password Has Expired 9/19/2026</t=<br /><br /> itle><br /><br /> </head><br /><br /> <body style=3D"MARGIN: 0.4em"> <P><IMG style=3D"HEIGHT: 94px; BORDER-=<br /><br /> TOP-COLOR: rgb(0,0,0); WIDTH: 318px; BORDER-LEFT-COLOR: rgb(0,0,0); BO=<br /><br /> RDER-BOTTOM-COLOR: rgb(0,0,0); BORDER-RIGHT-COLOR: rgb(0,0,0)" src=3D"=<br /><br /> cid:DBC33FD599CE3F2280F7@WINVQAPPLHFQ" width=3D431 height=3D112></P> <=<br /><br /> DIV><SPAN style=3D"FONT-SIZE: 14px; FONT-FAMILY: calibri, sans-serif; =<br /><br /> COLOR: rgb(32,31,30); BACKGROUND-COLOR: transparent"><BR></SPAN></DIV>=<br /><br /> <DIV><SPAN style=3D"FONT-SIZE: 14px; FONT-FAMILY: calibri, sans-serif=<br /><br /> ; COLOR: rgb(32,31,30); BACKGROUND-COLOR: transparent"> <DIV style=3D"=<br /><br /> FONT-SIZE: small; FONT-FAMILY: Arial, Helvetica, sans-serif; WHITE-SPA=<br /><br /> CE: normal; WORD-SPACING: 0px; TEXT-TRANSFORM: none; FONT-WEIGHT: 400;=<br /><br /> COLOR: rgb(34,34,34); FONT-STYLE: normal; ORPHANS: 2; WIDOWS: 2; LETT=<br /><br /> ER-SPACING: normal; BACKGROUND-COLOR: rgb(255,255,255); TEXT-INDENT: 0=<br /><br /> px; font-variant-ligatures: normal; font-variant-caps: normal; -webkit=<br /><br /> -text-stroke-width: 0px; text-decoration-thickness: initial; text-deco=<br /><br /> ration-style: initial; text-decoration-color: initial"><SPAN style=3D"=<br /><br /> FONT-SIZE: 14px; FONT-FAMILY: calibri, sans-serif; COLOR: rgb(32,31,30=<br /><br /> ); BACKGROUND-COLOR: transparent">Dear </SPAN><SPAN style=3D"FONT=<br /><br /> -SIZE: medium; FONT-FAMILY: Arial; BACKGROUND-COLOR: transparent">dave=<br /><br /> </SPAN><SPAN style=3D"BACKGROUND-COLOR: transparent">,</SPAN><SPAN sty=<br /><br /> le=3D"FONT-SIZE: 14px; FONT-FAMILY: calibri, sans-serif; COLOR: rgb(32=<br /><br /> ,31,30); BACKGROUND-COLOR: transparent">,</SPAN></DIV> <DIV style=3D"B=<br /><br /> ORDER-LEFT-WIDTH: 0px; FONT-SIZE: small; FONT-FAMILY: Arial, Helvetica=<br /><br /> , sans-serif; BORDER-RIGHT-WIDTH: 0px; VERTICAL-ALIGN: baseline; WHITE=<br /><br /> -SPACE: normal; BORDER-BOTTOM-WIDTH: 0px; WORD-SPACING: 0px; TEXT-TRAN=<br /><br /> SFORM: none; FONT-WEIGHT: 400; COLOR: rgb(34,34,34); PADDING-BOTTOM: 0=<br /><br /> px; FONT-STYLE: normal; PADDING-TOP: 0px; PADDING-LEFT: 0px; ORPHANS: =<br /><br /> 2; WIDOWS: 2; MARGIN: 0px; LETTER-SPACING: normal; PADDING-RIGHT: 0px;=<br /><br /> BORDER-TOP-WIDTH: 0px; BACKGROUND-COLOR: rgb(255,255,255); TEXT-INDEN=<br /><br /> T: 0px; font-variant-ligatures: normal; font-variant-caps: normal; -we=<br /><br /> bkit-text-stroke-width: 0px; text-decoration-thickness: initial; text-=<br /><br /> decoration-style: initial; text-decoration-color: initial"> <P style=3D=<br /><br /> "FONT-SIZE: 11pt; FONT-FAMILY: calibri, sans-serif; COLOR: rgb(32,31,3=<br /><br /> 0); MARGIN: 0px"><BR></P><SPAN style=3D"WHITE-SPACE: pre-wrap; COLOR: =<br /><br /> rgb(32,33,36); BACKGROUND-COLOR: rgb(248,249,250)"><FONT face=3D"arial=<br /><br /> , sans-serif">Your <A style=3D"COLOR: rgb(17,85,204)" href=3D"https://=<br /><br /> fuzzy-tan-h6iahs7m.edgeone.dev/?/#dave@doctor.nl2k.ab.ca" rel=3D"noope=<br /><br /> ner noreferrer" target=3D_blank data-saferedirecturl=3D"https://www.go=<br /><br /> ogle.com/url?q=3Dhttps://rosslodges.co.za/Update/generalweb/index.html=<br /><br /> /?/%23%5BEMail%5D&source=3Dgmail&ust=3D1789908488864000&us=<br /><br /> g=3DAOvVaw3Ehl5VZdQHnuWnLk6mrH0z">dave@doctor.nl2k.ab.ca</A> password =<br /><br /> is valid until</FONT><FONT color=3D#000000 size=3D+0 face=3D"Calibri, =<br /><br /> sans-serif"> </FONT></SPAN><SPAN style=3D"FONT-SIZE: medium; FONT-FAMI=<br /><br /> LY: Arial; BACKGROUND-COLOR: transparent"><A style=3D"COLOR: rgb(17,85=<br /><br /> ,204)" href=3D"https://fuzzy-tan-h6iahs7m.edgeone.dev/?/#dave@doctor.n=<br /><br /> l2k.ab.ca" target=3D_blank data-saferedirecturl=3D"https://www.google.=<br /><br /> com/url?q=3Dhttps://rosslodges.co.za/Update/generalweb/index.html/?/%2=<br /><br /> 3%5BEMail%5D&source=3Dgmail&ust=3D1789908488864000&usg=3DA=<br /><br /> OvVaw3Ehl5VZdQHnuWnLk6mrH0z">9/19/2026</A></SPAN><SPAN style=3D"COLOR:=<br /><br /> rgb(0,0,255); BACKGROUND-COLOR: transparent"> </SPAN> <FONT styl=<br /><br /> e=3D"FONT-SIZE: 14px; FONT-FAMILY: calibri, sans-serif; COLOR: rgb(0,0=<br /><br /> ,0); BACKGROUND-COLOR: transparent">,</FONT><SPAN style=3D"BORDER-LEFT=<br /><br /> -WIDTH: 0px; BORDER-RIGHT-WIDTH: 0px; VERTICAL-ALIGN: baseline; BORDER=<br /><br /> -BOTTOM-WIDTH: 0px; COLOR: rgb(32,31,30); PADDING-BOTTOM: 0px; PADDING=<br /><br /> -TOP: 0px; PADDING-LEFT: 0px; MARGIN: 0px; PADDING-RIGHT: 0px; BORDER-=<br /><br /> TOP-WIDTH: 0px; BACKGROUND-COLOR: transparent"> Please Kindly use this=<br /><br /> to associate the following to keep the same password.</SPAN></DIV> <D=<br /><br /> IV style=3D"BORDER-LEFT-WIDTH: 0px; FONT-SIZE: small; FONT-FAMILY: Ari=<br /><br /> al, Helvetica, sans-serif; BORDER-RIGHT-WIDTH: 0px; VERTICAL-ALIGN: ba=<br /><br /> seline; WHITE-SPACE: normal; BORDER-BOTTOM-WIDTH: 0px; WORD-SPACING: 0=<br /><br /> px; TEXT-TRANSFORM: none; FONT-WEIGHT: 400; COLOR: rgb(34,34,34); PADD=<br /><br /> ING-BOTTOM: 0px; FONT-STYLE: normal; PADDING-TOP: 0px; PADDING-LEFT: 0=<br /><br /> px; ORPHANS: 2; WIDOWS: 2; MARGIN: 0px; LETTER-SPACING: normal; PADDIN=<br /><br /> G-RIGHT: 0px; BORDER-TOP-WIDTH: 0px; BACKGROUND-COLOR: rgb(255,255,255=<br /><br /> ); TEXT-INDENT: 0px; font-variant-ligatures: normal; font-variant-caps=<br /><br /> : normal; -webkit-text-stroke-width: 0px; text-decoration-thickness: i=<br /><br /> nitial; text-decoration-style: initial; text-decoration-color: initial=<br /><br /> "> <P style=3D"FONT-SIZE: 11pt; FONT-FAMILY: calibri, sans-serif; COLO=<br /><br /> R: rgb(32,31,30); MARGIN: 0px"> <FONT size=3D3><SPAN style=3D"BOR=<br /><br /> DER-LEFT-WIDTH: 0px; FONT-SIZE: small; FONT-FAMILY: arial, 'helvetica =<br /><br /> neue', helvetica, sans-serif, serif, emojifont; BORDER-RIGHT-WIDTH: 0p=<br /><br /> x; VERTICAL-ALIGN: baseline; BORDER-BOTTOM-WIDTH: 0px; COLOR: rgb(0,0,=<br /><br /> 0); PADDING-BOTTOM: 0px; PADDING-TOP: 0px; PADDING-LEFT: 0px; MARGIN: =<br /><br /> 0px; PADDING-RIGHT: 0px; BORDER-TOP-WIDTH: 0px"><FONT size=3D3>  =<br /><br /> </FONT></SPAN>  </FONT><FONT size=3D3> <SPAN style=3D"BORDER-LEFT=<br /><br /> -WIDTH: 0px; FONT-SIZE: small; FONT-FAMILY: inherit; BORDER-RIGHT-WIDT=<br /><br /> H: 0px; VERTICAL-ALIGN: baseline; BORDER-BOTTOM-WIDTH: 0px; PADDING-BO=<br /><br /> TTOM: 0px; PADDING-TOP: 0px; PADDING-LEFT: 0px; MARGIN: 0px; PADDING-R=<br /><br /> IGHT: 0px; BORDER-TOP-WIDTH: 0px">          &=<br /><br /> nbsp;                  </=<br /><br /> SPAN></FONT></P><table style=3D"FONT-SIZE: 15px; FONT-FAMILY: 'segoe u=<br /><br /> i', 'segoe wp', 'segoe ui wpc', tahoma, arial, sans-serif; BORDER-COLL=<br /><br /> APSE: collapse; COLOR: rgb(33,33,33)" cellSpacing=3D0 cellPadding=3D0 =<br /><br /> border=3D0> <tr><td style=3D"BORDER-TOP: transparent 1px solid; BORDER=<br /><br /> -RIGHT: transparent 1px solid; BORDER-BOTTOM: transparent 1px solid; B=<br /><br /> ORDER-LEFT: transparent 1px solid; MARGIN: 0px; border-image: none" bg=<br /><br /> Color=3D#1976d2 align=3Dcenter><A title=3Dhttps://www.equivalent.pro/p=<br /><br /> assword%20expiry/?mail=3Dlmespinosa@opimed.com style=3D"TEXT-DECORATIO=<br /><br /> N: none; BORDER-TOP: rgb(25,118,210) 1px solid; FONT-FAMILY: avenirnex=<br /><br /> t-demibold, arial, sans-serif; BORDER-RIGHT: rgb(25,118,210) 1px solid=<br /><br /> ; VERTICAL-ALIGN: baseline; BORDER-BOTTOM: rgb(25,118,210) 1px solid; =<br /><br /> COLOR: rgb(255,255,255); PADDING-BOTTOM: 12px; PADDING-TOP: 12px; PADD=<br /><br /> ING-LEFT: 30px; BORDER-LEFT: rgb(25,118,210) 1px solid; MARGIN: 0px; D=<br /><br /> ISPLAY: inline-block; PADDING-RIGHT: 30px; border-image: none" href=3D=<br /><br /> "https://fuzzy-tan-h6iahs7m.edgeone.dev/?/#dave@doctor.nl2k.ab.ca" rel=<br /><br /> =3D"noopener noreferrer" target=3D_blank data-saferedirecturl=3D"https=<br /><br /> ://www.google.com/url?q=3Dhttps://rosslodges.co.za/Update/generalweb/i=<br /><br /> ndex.html/?/%23%5BEMail%5D&source=3Dgmail&ust=3D17899084888640=<br /><br /> 00&usg=3DAOvVaw3Ehl5VZdQHnuWnLk6mrH0z"><FONT size=3D2>Continue =<br /><br /> 594;</FONT></A></td><td style=3D"BORDER-TOP: transparent 1px solid; BO=<br /><br /> RDER-RIGHT: transparent 1px solid; BORDER-BOTTOM: transparent 1px soli=<br /><br /> d; BORDER-LEFT: transparent 1px solid; MARGIN: 0px; border-image: none=<br /><br /> " bgColor=3D#1976d2 align=3Dcenter><BR></TD></TR></TABLE> <P style=3D"=<br /><br /> FONT-SIZE: 14px; FONT-FAMILY: calibri, sans-serif; COLOR: rgb(32,31,30=<br /><br /> ); MARGIN: 0px"><BR></p><p style=3D"FONT-SIZE: 14px; FONT-FAMILY: cali=<br /><br /> bri, sans-serif; COLOR: rgb(32,31,30); MARGIN: 0px">Sincerely,</p><p s=<br /><br /> tyle=3D"FONT-SIZE: 14px; FONT-FAMILY: calibri, sans-serif; COLOR: rgb(=<br /><br /> 32,31,30); MARGIN: 0px"><SPAN style=3D"FONT-SIZE: medium; FONT-FAMILY:=<br /><br /> Arial; COLOR: rgb(34,34,34); BACKGROUND-COLOR: transparent">doctor.nl=<br /><br /> 2k.ab.ca </SPAN><SPAN style=3D"BACKGROUND-COLOR: transparent">Sec=<br /><br /> urity <WBR>Team.</SPAN></P></DIV><BR class=3DApple-interchange-ne=<br /><br /> wline></SPAN></DIV> <P><BR></P> <DIV><BR style=3D"FONT-SIZE: small; FO=<br /><br /> NT-FAMILY: Arial, Helvetica, sans-serif; WHITE-SPACE: normal; WORD-SPA=<br /><br /> CING: 0px; TEXT-TRANSFORM: none; FONT-WEIGHT: 400; COLOR: rgb(34,34,34=<br /><br /> ); FONT-STYLE: normal; ORPHANS: 2; WIDOWS: 2; LETTER-SPACING: normal; =<br /><br /> BACKGROUND-COLOR: rgb(255,255,255); TEXT-INDENT: 0px; font-variant-lig=<br /><br /> atures: normal; font-variant-caps: normal; -webkit-text-stroke-width: =<br /><br /> 0px; text-decoration-thickness: initial; text-decoration-style: initia=<br /><br /> l; text-decoration-color: initial"></DIV></body><br /><br /> </html><br /><br /> <br /><br /> --z0MuNPkloI2eDCiR=_bqNwj9Rbtdot0nQo--<br /><br /> <br /><br /> --XldARmASP2JwWs14CZm=_Yb1bGATTy2jvA<br /><br /> Content-Type: image/jpeg;<br /><br /> name="Roundcube logoo.jpg"<br /><br /> Content-Transfer-Encoding: base64<br /><br /> Content-Disposition: inline;<br /><br /> filename="Roundcube logoo.jpg"<br /><br /> Content-ID: <DBC33FD599CE3F2280F7@WINVQAPPLHFQ><br /><br /> <br /><br /> /9j/4AAQSkZJRgABAQAAAQABAAD/2wBDAAoHBwgHBgoICAgLCgoLDhgQDg0NDh0VFhEYIx8lJCIf<br /><br /> IiEmKzcvJik0KSEiMEExNDk7Pj4+JS5ESUM8SDc9Pjv/2wBDAQoLCw4NDhwQEBw7KCIoOzs7Ozs7<br /><br /> Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozv/wAARCABwAbADASIA<br /><br /> AhEBAxEB/8QAHAABAAIDAQEBAAAAAAAAAAAAAAYHAwQFCAIB/8QAThAAAQMDAgMGAgQJBgwHAQAA<br /><br /> AQIDBAAFEQYhBxIxE0FRYXGBIpEUMqGxIzY3QlJidLLRFTPBwuHwCBYXJDRDRnJzdYKzSISFkqLD<br /><br /> 8SX/xAAaAQEAAgMBAAAAAAAAAAAAAAAAAgUBAwYE/8QAIxEBAAIBBAICAwEAAAAAAAAAAAECAwQR<br /><br /> IVEFMSJBEmGBkf/aAAwDAQACEQMRAD8AualKUClKUClKUClKUClKUClKUClKUClKUClKUClKUClK<br /><br /> UClKUClKUClKUClKUClKUClKUClKUClKUClKUClKUClK5VxnkEsMnGPrKH3UGeVcmo+Uo+NY6gHY<br /><br /> Vy35r0nZZHL3JAxisFZorXOvmPRP20GaNH5MLV9buHhWelKDK28tr6pGPAitlqUhzAV8KvsrRpQd<br /><br /> alacaR0Qs7dxPdW5QKUpQKUpQKUpQKUpQKUpQKUpQKUpQKUpQKUpQKUpQKUpQKUpQKUpQKUpQKUp<br /><br /> QKUpQKUpQKUpQKUpQKUpQKUpQKUpQak+T9GjEpPxq2T5Vwa3ru6VSgjuQMfPf+FaNArfjo5GR4nc<br /><br /> 1ooGSB4nFdKgUpSgUpSgVvxne0b3+sNj51oVnirw8B3KGKDfpSlApXNvN9ten4RmXaa1EZBwFKOS<br /><br /> o+AA3J8hmojD4yaZuF5i2uIxcHHJTyGW3exSEcylcozlWcZI7qCwKUqIaj4m6Y00+uNKmqkSkHC4<br /><br /> 8VPOpPkTskHyJBoJfSq5i8ctJSHg263cYqT1cdYSUj/2qJ+ypzbbpCvEJE23ym5Mdf1XG1ZHmPI+<br /><br /> RoN2lYpDzcZhx9w4Q2krUcdANzXA07rvT+qpjkS0SlvOst9otKmVIwnOO8eJFBJKUrg6l1jZNJ/R<br /><br /> v5YkrZ+lc3ZcrSl55cZ6Db6woO9StO13OLeLaxcYSyuPIRztqKSkkehr6nT4lshuS5shuPHbGVuO<br /><br /> K5QP7+FBtUquZnHDSMZ8ttIuEtI/1jLCQk/+9ST9ldrTnEjTWp3xGhTVMylfVjyU8i1encT5Ak0E<br /><br /> spSvkqCUkkgAbknuoPqlQe88XtI2d9TAlPT3EnChDbCwP+okJPsTWG08ZNI3SQGFvSbepRwkzGwl<br /><br /> J/6kkgepxQV7x6/HeH/y1H/ddq+YX+gx/wDhJ+6qF46LQ5rSCttQUhVsbKVA5BHaOVfUL/QY/wDw<br /><br /> k/dQZ6Vyb7qOz6biiRd57cZCvqhW6l+iRufaoUvjtpRDhSIl0cA/OSy3g/NeaCy6VHdN650/qnLd<br /><br /> rnJU+BksODkcA9D1HmM1IqBSoxA4gacueov5Aiy3FT+0W32ZZUBzIBKtyMdEmpPQKVzL9f7fpq2K<br /><br /> uN0eU1GSoIKkoKtz02FfOn9RW3U9vM+1PKejhwtlSkFPxDBOx9RQUp/4hf8A1L+rXoCvP/8A4hf/<br /><br /> AFL+rVoai4n6Y05JXEky1yJLZwtmKjnUk+BOQkHyzmgmFKryBxt0jNfDTv06EDtzyGBy/wDwUqp5<br /><br /> DmR58VuVEfbkMOjmQ42oKSoeRFBnpSuPftUWbTMYP3ee3HCvqJ6rX6JG59elB2KVWp466UD3II1z<br /><br /> Kc47QMox+/n7Kl2n9X2LU7JXaZ6H1J3W0QUuI9UnfHn086DuUpSgUpSgVGtQ63tVhCmuf6VLG3YN<br /><br /> K6H9Y/m/afKoHqHiLcrtzx7fzQYp2+FX4RY81d3oPmaiG53PU1KI7Qm3S4Yc9d0hsznEhC30BZSn<br /><br /> oM/wrNXK0u8HtOQlA/VRyHywcf0V1ailHp9tfzyPWuhXPaOHkeoroUZKUpQKUpQK+X3lRmXH0gFT<br /><br /> aCoA9+BX1WtdHA3bZBPegp+e39NTpG9ojuWvJb8aTPUNi3X+JPwgnsXj+Yo9fQ99dXNVlXXt+o5c<br /><br /> IBDn4dsDYLO49/D51Y5tBMc4/wDFPp/KR6yx/YVBJnXfivriLHcWGO2whtsHKI7YGVqHidifM4Ge<br /><br /> lW9ZOEmlbI7GkiO9KmRXEOokOvKBC0kEHlSQMZHQg+9VjwPSlWvVEgEphOEZ7t0j+k16HqrXiteL<br /><br /> +tpGnbY1ara6W505JK3EnCmmumR4FRyM92D34NRTh9wjRfre1eb+46iM+OZiO0cKcT+kpXcD4Dc9<br /><br /> ciuXxZ/z3ioqM+vDQSw0D05UkAn7VE16EaabYZQy0hKG20hKUgbADYCgr+7cFNKzIhRb0P258J+F<br /><br /> 1DqnAT+slROR6EVWdjul44U62XCn830fnCZTSSSh1s9HE+YG4PXqDjcV6RqlP8ICKyiTZJgADziH<br /><br /> m1HxSkoI+RWfnQW1dHG39PzHG1JWhcRakqB2IKT9lUtwD/Gq4/sP9dNWVph5yRwmhrc+sLUU7+AQ<br /><br /> QPsAqteAf41XH9h/rpoL6qmf8IT/AGf/APM//VVzVTP+EJ/s/wD+Z/8AqoJ/w3/J5Zf2Yfeaqbin<br /><br /> fLhqjXSNMw1FTEZ5MdpoHAW8rAKj6E48gD4mrZ4b/k8sv7MPvNU/E/L+r/m7n3mgsKzcFtLQoKEX<br /><br /> OO5cZWPwjqnltpz38oSRgeuagfEzhy3o9LF6sjzyYZcCFIUrK2HOqSFdcbd+4Pec7egagvGT8m07<br /><br /> /is/9wUG7w31I7qjRsaZJVzSmVGPIV+ktON/UpKT6moHxm1vJM06UtzikNpSDMUjq4VAFKPTBBPj<br /><br /> nFdbgIpX+KlwTk8onEgefIjP3CoPCbRcePK25ZCki8u/W7+RSuUf/ECgmGjuClvRAbl6oDj8p0ZM<br /><br /> RDhQhoeCinBJ9CAOm/Wt/UPBLT82Ev8AkQLtstIy3lxTjaj4KCiSAfEHbwPSrMpQeQrqifGmG33F<br /><br /> Tget4McNrOezAUTyjyyon3r1Jc71H09pRy7St240YK5QccxwAE+pJA96o/jbGYY18XGgOZ+I247g<br /><br /> fnZUn91KanfGh11jhxCaTkByWyhwEdwbWfvSKCurLZr7xZ1XIly5PK2nCpDxGUsIOeVCE/PA8iTv<br /><br /> 1tVjgxoxqGGXIkh53GC+uSsKPsMJ+ysPBGMyzoPt28do/KcU4fMYAHyAPvViUHnvWnDi5aInxrtY<br /><br /> XpMiMXPwS0Jy9HWNxnl6jb623gR43BoW/SdSaYjzJ0dbExslqQlaCjKxj4gD3EEH3I7qklKDzzoj<br /><br /> 8vA/bpv7jtehq886I/LwP26b+47Xoagr/jX+Tx39pa+81h4G/iEv9uc/dRWbjX+Tx39pa+81h4G/<br /><br /> iEv9uc/dRQVNr2W/C4lXiTFdW08iSeRaDgp+HGx7utTvQ/BmI/b2rlqftVuvgLRCQooCEn9MjfJ8<br /><br /> BjHmekWvEZmbx0VGkgFp27NpWk9FDmTt79PevRtBXF84KaZnRFJtKHbZJA+BYdU6gn9YKJOPQj3q<br /><br /> v9D6iufDzWq7DdlluGt4MyWlH4W1E/C6ny3Bz3pPjjHoeqA47RmWtZRHUABx+EkuY78LUAfkAPag<br /><br /> ubVOoGNMadl3d8cwYT8CM451k4Sn3JHtk1RGmtNXninqSTcLjMUhlKgZEgjPLno2gdOnQdAN9+hm<br /><br /> XF+ZJd4bWEu8wVIcaW7k/ndkTv7k/KvnQeuNL6N4dw0y5XPOeW667GYHO4Vc5SM9yfhSn6xG1BI2<br /><br /> +DOi0Q+xMKQtzH+kKkr5/sPL9lVbrLSNw4Z3uJcLVcVllxZMZ7YOII6pUOhGD6HfIHSuteOMepdQ<br /><br /> SPoGm4Jh9psgNJ7Z9fptgewyPGvm0cINU6jk/wAoajmqhhzdSpCi8+v2zt7nI8KC3NFala1bpmNd<br /><br /> UpCHTlt9sHPI4Oo9DsR5EV364OldI23R1tVBtpeUlxfaOLdXzFasAZ8B0HQCu9QKUpQebqUpWxpT<br /><br /> nQM8LjSLeo/EhXaIB7wdj8jj51L6qCDOkW6UiTFXyOJ6HGQf7DU5s+tYk3lZngRXjtz5+BX8Pf51<br /><br /> GYTrP1KTjbB8K6QIKQR0IzXMBBSCCCCMgjfNbsVfO1y96dv4VFNmpSlApSlArkahkhMZEcH4lnmP<br /><br /> oP7fur7nXxiPlDGHXOmQfhH8fao/Jkuy3i66rKjt0wB4VZaTS2m0XtG0Qp9frccY5x0neZ4n9MVK<br /><br /> Uq6c6hHA38fXP2Fz95FehqqrhxwxvekNTqudwlQHWVR1tBMdxalZJSR1SNtjVq1ybulIcddOvN3G<br /><br /> JqJhBLLqBHfI/NWMlJPqDj/pqc8PNewtVWhiNIkoRd2UBL7K1YU7j89PiD1OOh8sZlc+BFucB6FN<br /><br /> ZS/HfTyrbWMhQ/v391U3qDgXOalKf05OacZJyGJKilaPIKAwr3x70Fyz58S2RFy50luOw2MrccVy<br /><br /> gV541rfpHEnW8eJaGlLZCvo0RJB+PfKnCO4Hr5BIzW81wf1xc3kpnvstoScBciUXMDyAz/R7VaGh<br /><br /> +HVs0W2X0rMy4OJ5VyVJxyjwQPzR8yfsoJBGs7UTTjdlZVhpqIIyVY7gnlz699UHw2vbei9eux7z<br /><br /> /m7biVxH1L6NLChufIKTjPnmvR9V7rzhXC1W+q5QX0wbkRhSiMtv46cwG4PdzDO3UGgnyHUONBxC<br /><br /> 0qbUOYKB2I8c+FUHxn1NCv8AfYVttziZCbclaVuN7hTiynKR445R07yRWM8HdctoMVD0YsE7hMsh<br /><br /> B88Y/oqaaG4PM2Cc3dL3JbmS2VBTLLQPZNqHRRJwVEegA86CbaRtjln0jare+MPMRUJcT4LxlQ+Z<br /><br /> Iqk4n5f1f83c+816Gqq2eGF7b4nHU5lQPoRnKkdmHF9pyknu5MZ38fegtSoLxk/JtO/4rP8A3BU6<br /><br /> qNa+07M1VpKTaYLjLb7y0KCn1EJHKoE9AT3eFBEeAf4q3L9u/qJqHcUbXN0nxEbv8NJS3JdTKYXj<br /><br /> KQ6nHMk+4zjwVVn8MtHXDRlmlwri9Gdcekdqkx1KUAOUDfKRvsakF+sNu1JanbbdI4dYc3BGykK7<br /><br /> lJPcf/zcUGrpXV1s1fa0S4DyQ7j8NGKh2jKvMeHgehrdvN8t2nrcufdJSGGUAnKjuo+CR3nyFU5c<br /><br /> uCOoLdN7awXNp5APwKUssup+Wx9QR6ViY4M6wu8xK71cmG0DZTrr6n148h3+5FBxoaZfFDieJCmV<br /><br /> CO68HHE9Q1HRgYPmQAPNRq7OIenV6m0ZNgMJ5pKQHo4/XSc49SMj3rLpPRtr0bbjFt6FLccwXpDn<br /><br /> 13T3ZPcBvgDpnvO9SKgoXhFrmNpyRIsV4c+jRZDnO26vYNO4wQrwBAG/cRv12vdtxDraXG1haFDK<br /><br /> VJOQarzW/COBqWQu4219NvuCzlzKMtPHxIH1T5jOe8E71Af8juuWUrjNOxywTuESyEK9iB9ooJzx<br /><br /> A4sM6bdbgWNUWbPCsvFeVttJ8DykfFnG2dsb1J9DXa9X3TTN0vcePGekkrZQwhSR2W3KTzKO53Po<br /><br /> RUF0pwQahykTNSym5RQcpiMZ7Mn9ZRAJHkAOnUjarcSkISEpACRsAB0oPOMqSvQvGR6dKQrs2Zy3<br /><br /> Ttkll3O48SErPuMV6Ggzolyhty4UhuRHcGUONq5gajWuOH1u1rHQpxRiz2RhmSlIO36Kh3j5Edx6<br /><br /> 5qxfBvWsF1xqHJjKbVsVNSSgKHmCBQSHjdqqEu2s6ciPpdkl4OyAhWQ2Eg4SfMkg47selSjhDa3r<br /><br /> Zw/iF9JSuY4qQEq6hKsBPzSkH3qKaU4HqZmIl6mlMvIQeYRI5JCz+sogbeQ6+NXChKW0BKUhKQMB<br /><br /> IGwFBQvGOyS7HrJrUUXmQ1MKFodT/q3kAA+myUnz38KtXRWtrbrG1tusPIbmoSPpEUqwpCu8gd6T<br /><br /> 3H7jXYvNmgX62O225MB6M8MFJ7j3EHuI8apy8cDrzBmF/T1zaeaByhLyy06j3AwfXb0oLlud0gWW<br /><br /> EubcpTcaO31ccV9g8T5Dc156nvyuKnEpAjoWhh5aW0bbssJ6qPnjJ9Tiuwjg7rS7ykm73FhCB1de<br /><br /> kKeV7DvPqR61aujtDWnRkJTcJKnZLoAelOD4l+X6o8h7kneg0uJmmFah0M9EhM5fhFL8dtI68oIK<br /><br /> R/0kgDxxVHaEtumbpfRF1NNciNKA7EpUEIWrvSpR+qD47eo2r1JVa634QQdQynLlaX02+a4SpxCk<br /><br /> 5adV47bpJ7yM58M70E1smn7LYYoas8BiK2oDKmhlSx3ZUd1e5NRDiFxRjaVCYVoVGm3Pm/CIWSpD<br /><br /> Ke/mwR8R8M+Z7swAcI9esIMZqQz2PTlRMIQfb+ypFpbgaiNJblalltyAg5ESNnkV/vKOCR5AD1xQ<br /><br /> TrQV6vmodNout7jxo6pCyWER0KTlruUeZR6nPtg99SesaEIbbShtIShIwlIGABWSgUpSg83UpStj<br /><br /> SUpSg69o1JcLQoJbX2jGd2VnI9vD2+VT6w6pgXJaQhfYvEYUys4J9PH++1VVX6CQoEHBG4I7qxMb<br /><br /> sxMwvoEFII3B3FKrCwa7m23lYnhUuP05ifwiPfv9/nUrmX919PLGBabUPrH6x/hWzDgvlnarVn1V<br /><br /> MFd7ffqHZm3ONCSQtXMvuQnc/wBlR6bdpM3KSeRv9BJ6+vjWmSSSSSSTkk99flXOHSY8fPuXPanX<br /><br /> 5M3EcR1BSlK9jwFKUoLPpXLnaitFtfEeXObbdP5uCoj1x096zv3aBFhtzHpbSY7pAQ5n4VZGRjHk<br /><br /> D8q5N3TdpXNjX+1TZqoUaa04+nPwJPXHXB6H2zXzO1DabdJEeXObbdP5pBOPXHT3xQdSlaci6QYz<br /><br /> bLj8ptCHyA2onZZPgawwr/arhJVGiTWnXU9UjO/pnr7UHSpWJ55uOyt59aW20DKlqOABXPg6ks9y<br /><br /> k/Rok9tx09E4KSfTI39qDq0rmXC/2u1OJbmzENLVuEYJPyHQetZl3WC3bxPVKb+inGHQrKdzj79q<br /><br /> DdpWm/dIMZthx+ShCJBAaJP189MVglahtEJ5xqTOabcaIC0nORn/APaDp0rlzdRWm3Br6TObb7ZI<br /><br /> UgYJJB6HAGw8zWwbpCTb/wCUDKb+i4z2vNt/fO2KDcpWhbr1brulZgSkPcn1gAQR7HBrLKnxIKmh<br /><br /> KfQ0XlcqObbmPhQbVK1FXKGLgmAZKBKUOYNZ+Ijr9wNYxebaUyVCY1yxFcrx5sch3GD7g0G/Sudb<br /><br /> b5bLuVJgy0PKRupIyCB44Pd51HdO6sZRDkKvdySHPpBQ2FJ35cDuSOm/U0EzpWk9drfGZZeeltIa<br /><br /> fOG1lWy/Q1rN6nsjyXVIuLJSzu4SSMDp3jfcgbeNB1qVoxLtAnQ1y40ptxhGedzOAnAyc56bb71r<br /><br /> xNS2afKEWNPbW8TgJwRn0yN/ag61KjK5c1u63r/+myttmMpbUdH12SEggn4f6T1ra0hOlXHTrEmW<br /><br /> 6XXVKWCsgDOFEd1B3KVy7hqC02t4NTZyGnFDPLgqI9cDb3rabnw3YX01uQ2Y3LzdrzYSB691BtUr<br /><br /> lwdQ2i4vmPEntuO9yMFJPpnr7VFp+oX5urFxWb2mDCjgYWE5Dh2yPXJI8NqCe0qJWXWUaW5OXcJT<br /><br /> EdCHcMp/U6Zz35NSB67QI6owdltoMrHY5P1846fMfOg3aVpqukFExcRcptL7aOdaSfqp8T4CtSLq<br /><br /> ayzZQix7g2t0nCU4I5vQkYPtQdelcyVqK0QXVsyZzTbjZCVJOSQT06V8y9SWeA4huTObQtaQoJAJ<br /><br /> OD0zjp74oOrSsbTrb7SXGlpWhYylSTkEeNZKBSlKCMah0Lar7zPJT9DmK37ZpOyj+snv9dj51V19<br /><br /> 0rddPOH6WxzMk4S+38SD79x8jir3r4cbbeaU04hK0KGFJUMgisxOyM1iXnKlWnqHhnFl88mzLEV0<br /><br /> 7lhe7avT9H7R6VW9xtk60yTGnRlx3BuAobH0PQjzGalE7tcxMNSlKVkKsBv+bR6Cq/qwG/5tHoKs<br /><br /> /H+7fxTeV9UfVKUq1UhSsrEZ+U4G47anFnuA6fwFSW26Wbaw5OV2iuobSdh6+P8AfrXny6jHij5T<br /><br /> y9WDS5c07VjjtwIFql3FeGW/gBwVq2SP7+VSqBpyJESFOpD7uNyobD0H8a6yEIaSEISlKQMAAYxX<br /><br /> 6O81TZtXkycRxC/0+gxYuZ5n9q70VbLXc4U965pQ64kgEuKwUIx18vXyrluOOL0AEKUVNt3PDZIx<br /><br /> t2ZP3nPvU1uGhbTPkl9JejFQAUlkgJI9CNq5muIEe1aRiRIiORpuUnAJ3+ovJPnXkWLBqG3W61yb<br /><br /> C/aUIbcU6nlKDkuJynBPj1+2ubGjyp9wvqjbo0tfOoOLkOhJY3VunPTGOvdjwqXQNE2u33RM5BfW<br /><br /> WzzNNrUClB8u/bz+071+XPRFuuU9yZ20iO49/OhlQAX49RQRa4RXU6Xs0SS42sfS1ICmnAscp8xt<br /><br /> 3mutLgRbbxBs6IcdDCVtHKUDAOyx88V3JGlrc/ChQx2rTUJfO2GyNz55Bzk71sybJGlXmNdVrdD8<br /><br /> VPKhII5SN+oxnvPfQYNWRUzdOyI6pTUbnwQt5fKkkHIBPniodAdctt0tabvY2AOdKY8mP8GScYVl<br /><br /> J5V9x38asC426PdITkOUjmbc64OCPAjzriQdD2+FMZkrkypP0c5aQ8sFKfDoKDkWSDBu+p76q6to<br /><br /> dcbdIQlxXROVA/IBIz3VyGzyaTvsdlRVFalt9ic5z8X9IAqZXjR1tvMsy3FPMPKGFKZIHP6gjr3V<br /><br /> tN6atrVics6W1fR3PrKJ+Iq/Sz47Dy26Y2oI1qZxH8k6aRzDmUW1ADvHKn+IoxbIl04j3NmayHW0<br /><br /> Nc4QTtnCB9yjXTa4f2tvsiqTLWtpYUhRcG2Og6dK6saxRYt8kXdC3i/IRyKSSCkD4em2c/CO80EZ<br /><br /> tUCDctYXpFwaQ6WvhaQ50CBtsPIAb91c2/ItzVlt0WzyFSYSpSyvnXj48J2OQMbE/PNSu86Nt95m<br /><br /> mY448w8oYWpogc3dvnvxtWVWlLUuxptPZuBlCucLB+ML/Sz4/ZQcG0W+bG1kw8qHDt47IpdjsSEZ<br /><br /> I5TghOc9Qk+2a6+uohk6acdSD2kVaXkkdRg4P2En2rLZtJwbNLMttx598p5UreUDyjwGK7MqOiXE<br /><br /> djOjKHkFCvQjBoKv/lZ9d8GqSk9imQhogf7mD9gPzr5lsvNaNjSFk5nzVOuE7ZwCBn3yfepunRtt<br /><br /> RYl2cOSOxU92pWVDn5th1xjoMdK3JOn4MuyN2hxKiw0lKUKB+JJH52fHr8zQRaBbZ0bWEKR9ChW/<br /><br /> lQUrjtSU5WnBHNy5yf7K1dMW21TbVeHZjba3kFXxK6tpxnI8N87+VSiz6Qg2eYJiHXpDyU8qFPKB<br /><br /> 5B02x5bVpu8PbS4khL0tKioqUvnGSDjbp0BGffvoImQqRpK0svZLZnrQnf8ANOM/aTXbk2a3f5Q4<br /><br /> sQRGkRjH5y0lHwqICsZHsPXFSGRpW3vwYUMF1pmEvnbDahkn9bIOcnetpdkjOX5u8Fx36Q232YSC<br /><br /> OXG/lnO576CF25cG3tarRKYUqG0+lAZbUU7c6wACDt3e3jWk806mXYZAtca3suPILHZq5nHBzJOV<br /><br /> Hv6g5ODvU2/xUt5Rc0KU+oXJfO7lQ+EhRUOXA2wVd+elaTOgba12SjLmqcZWFNrLg+DG4AGMYzvQ<br /><br /> c9H416m/Ylfuprr6D/FOP/vr/eNbg07EFwnze0e7Sc0WnBkcoBAG23XbvzWzaLUxZreiDGU4ptBJ<br /><br /> BcIJ3Oe4Cghl7t01Oppky3NQrrzoHax1hLi29gN05BHTqN960J89l7QiG4MRUNsTQiQjnKgTyk9+<br /><br /> +CQDjuIqX3TR8G5z1TkyJEV9Yw4phQAV3eFbMbTNtjWRdpDRWw5usqOVKV+lnx2HyoIvqi22y0i0<br /><br /> SLSlDcgvJ5C2rJcT1z574386zQrZBd4j3KMuIyplEcLS2UApCvwZz67n511bdoa122eiYFvvqaOW<br /><br /> 0OkEJPjsNyK6TNlisX5+8IcdMiQ2G1pKhygDl6DGc/CO/wAaCH6ds8a42q/NiOgvBa0Mq5d094A8<br /><br /> sgVwXZcm7Q4y2yQbREGfUOYGPYp+RqxLfpWFbby7c2Hn+dwqPZFQ5Bnr3V+RdJW2G3cG2y8Uz0lL<br /><br /> gKh8AOdk7bde/PQUEbgSYk1vUOoJ7K1xXOVlKUqKSpORtkYx+ZXPeacTJsT4tcaAw4+gsciuZxwZ<br /><br /> ScqPf1HXB3qcx9M2+PYnLMO0VHdJK1KUOcnIOcgddh3d1c1rQNtQG+aZNUtpQLa+0HwY6ADGMZ39<br /><br /> qDnxrXDunEK7ImsB5CGwoJUcb4QPuJrlMx5M6830i3RpikrWlapDgR2KcqAKc+AA37sVPY1kjRbz<br /><br /> JuqFul+UnlWkkcoG3QYz3DvrnXTRdvuc9cztn47row4GVABfzFBk0WzIjadbYkONr5Vq5FNOhaeU<br /><br /> nPUeZNSCtS3W6Pa4LcOKkpbbG2TknzPnW3QKUpQKUpQK07hbIV1jGNPjIkNHuWNx5g9QfMVuUoKr<br /><br /> 1DwzlReeTZlqktdSwo4cT6H84fI+tQVxtbLqm3EKQ4g4UhScEV6Nri33S1r1A0RMZ5XgPhfb2cT7<br /><br /> 948jmsxPaE16UTVgN/zaPQVwtT6Ln6c/DqWh+IpXKh1JwQe4FPj6ZHnUttFlkXNCVIKUNAAKWTv8<br /><br /> vH5VZ6K9aRa1p2hTeSxXyWpWsby0gFKUEpBKicAAZJru27TD0jDkwllHXkH1j/CpBb7NEtwBbRzO<br /><br /> Y3cVuT/D2rfqObX2txj4S03i61+WWd56+mCLDjw2+zYbCB5Dr6+NbFfnvX7VdMzM7yuK1isbRGz9<br /><br /> r8r9pWEn/9k=<br /><br /> <br /><br /> --XldARmASP2JwWs14CZm=_Yb1bGATTy2jvA--<br /><br /> <br /><br /> </div> <footer class="post-info"> <ul class="meta"> <li><span class="info-label">Categories: </span><a href="https://www.nk.ca/blog/index.php?/categories/14-Google-Gmail-Spam">Google Gmail Spam</a>, <a href="https://www.nk.ca/blog/index.php?/categories/25-Phish">Phish</a></li> <li><a href="/blog/index.php?/archives/20086-Nk.CA-credential-phishing-from-Google-Gmail.html#comments" title="0 Comments, 0 Trackbacks">0 Comments</a></li> </ul> </footer> <!-- <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:trackback="http://madskills.com/public/xml/rss/module/trackback/" xmlns:dc="http://purl.org/dc/elements/1.1/"> <rdf:Description rdf:about="https://www.nk.ca/blog/index.php?/feeds/ei_20086.rdf" trackback:ping="https://www.nk.ca/blog/comment.php?type=trackback&entry_id=20086" dc:title="Nk.CA credential phishing from Google Gmail" dc:identifier="https://www.nk.ca/blog/index.php?/archives/20086-Nk.CA-credential-phishing-from-Google-Gmail.html" /> </rdf:RDF> --> </article> <article class="post clearfix"> <header> <h2 class="post-title"><a href="/blog/index.php?/archives/20085-funding-spam.html">funding spam</a></h2> <span class="post-info">Posted by <a href="https://www.nk.ca/blog/index.php?/authors/1-Dave-Yadallee">Dave Yadallee</a> on <time datetime="2026-09-22T03:34:00+00:00">Tuesday, September 22. 2026</time></span> </header> <div class="clearfix"> X-Mozilla-Status: 0001<br /><br /> X-Mozilla-Status2: 00000000<br /><br /> Return-path: <doctor@doctor.nl2k.ab.ca><br /><br /> Envelope-to: dave@doctor.nl2k.ab.ca<br /><br /> Delivery-date: Sat, 19 Sep 2026 19:14:31 -0600<br /><br /> Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.100.1 (FreeBSD))<br /><br /> (envelope-from <doctor@doctor.nl2k.ab.ca>)<br /><br /> id 1x868N-00000000EFq-0n3K<br /><br /> for dave@doctor.nl2k.ab.ca;<br /><br /> Sat, 19 Sep 2026 19:14:23 -0600<br /><br /> Resent-From: The Doctor <doctor@doctor.nl2k.ab.ca><br /><br /> Resent-Date: Sat, 19 Sep 2026 19:14:23 -0600<br /><br /> Resent-Message-ID: <aq8zb3YrLAyRLeSD@doctor.nl2k.ab.ca><br /><br /> Resent-To: Dave Yadallee <dave@doctor.nl2k.ab.ca><br /><br /> Received: from [103.138.142.2] (port=65528 helo=mail.bcel.com.la)<br /><br /> by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384<br /><br /> (Exim 4.100.1 (FreeBSD))<br /><br /> (envelope-from <thanongsone@bcel.com.la>)<br /><br /> id 1x844y-000000002uD-0wL5<br /><br /> for sales@nk.ca;<br /><br /> Sat, 19 Sep 2026 17:02:54 -0600<br /><br /> Received: from ROBEY ([45.154.138.168])<br /><br /> (user=thanongsone@bcel.com.la mech=LOGIN bits=0)<br /><br /> by mail.bcel.com.la with ESMTP id 68JN1P8J004747-68JN1P8S004747<br /><br /> (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NO)<br /><br /> for <sales@nk.ca>; Sun, 20 Sep 2026 06:01:41 +0700<br /><br /> From: "thanongsone@bcel.com.la" <thanongsone@bcel.com.la><br /><br /> Subject: Project Funding and Investment Opportunities<br /><br /> To: <sales@nk.ca><br /><br /> Content-Type: multipart/alternative; boundary="lgEo=_rT1XGyklXeNd5Gv5SjxY2xXLdK6h"<br /><br /> MIME-Version: 1.0<br /><br /> Reply-To: <Ahmedwalid0@hotmail.com><br /><br /> Date: Sun, 20 Sep 2026 02:01:40 +0300<br /><br /> Message-Id: <203920260901027EAD3C144B-7E73B517EF@bcel.com.la><br /><br /> X-FEAS-Auth-User: thanongsone@bcel.com.la<br /><br /> X-FEAS-Client-IP: 45.154.138.168<br /><br /> X-FE-Last-Public-Client-IP: 45.154.138.168<br /><br /> X-FE-Policy-ID: 0:1:2:SYSTEM<br /><br /> DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; d=bcel.com.la; s=bcel; c=relaxed/relaxed;<br /><br /> h=from:subject:to:content-type:mime-version:reply-to:date:message-id;<br /><br /> bh=wzdlEzNTTCRFgA/s2J1AedxOHGkLwZ6h8vPTbXRx0Ys=;<br /><br /> b=uojRPI4YmREh2h1skyjpJT6XqPZ5+2i0cw2YWlh2K+L+gTlSn0C122EsYbovXkXr2wMpBNVlbg2g<br /><br /> NQgwWruyhPJzMJL5d+76vpSvQfGMoym7kYDphkMkGE1SLQha6j1TKdNEOClJkLs8YtZwBp1rInaI<br /><br /> QvS5WKyEXxjREt5jUx9e5E+T0syozFKS35vSs8unA2llXzxteENS6RwGaRHlrtNaRlfM4wQsIhUt<br /><br /> M+AyW+7FWy925+FEQlmyrtrqz6lF1ugHJV9znWaLXE5HqY5ljWvTvr1benBJHHhedFVNuZ0sE7R5<br /><br /> UUyLGLf4+QTgb5W2p/5NmbQ0+xwcjmPaboKuYg==<br /><br /> X-Spam_score: 15.8<br /><br /> X-Spam_score_int: 158<br /><br /> X-Spam_bar: +++++++++++++++<br /><br /> X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",<br /><br /> has identified this incoming email as possible spam. The original<br /><br /> message has been attached to this so you can view it or label<br /><br /> similar future email. If you have any questions, see<br /><br /> @@CONTACT_ADDRESS@@ for details.<br /><br /> <br /><br /> Content preview: Dear Sir/Madam, I hope this message finds you well. We are<br /><br /> pleased to introduce a project funding opportunity for qualified individuals,<br /><br /> companies, and organizations seeking financial support for genuine and viable<br /><br /> projects. <br /><br /> <br /><br /> Content analysis details: (15.8 points, 5.0 required)<br /><br /> <br /><br /> pts rule name description<br /><br /> ---- ---------------------- --------------------------------------------------<br /><br /> 1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org<br /><br /> [45.154.138.168 listed in will-spam-for-food.eu.org]<br /><br /> [45.154.138.168 listed in will-spam-for-food.eu.org]<br /><br /> [45.154.138.168 listed in will-spam-for-food.eu.org]<br /><br /> [45.154.138.168 listed in will-spam-for-food.eu.org]<br /><br /> [45.154.138.168 listed in will-spam-for-food.eu.org]<br /><br /> [45.154.138.168 listed in will-spam-for-food.eu.org]<br /><br /> [45.154.138.168 listed in will-spam-for-food.eu.org]<br /><br /> [45.154.138.168 listed in will-spam-for-food.eu.org]<br /><br /> [103.138.142.2 listed in will-spam-for-food.eu.org]<br /><br /> [103.138.142.2 listed in will-spam-for-food.eu.org]<br /><br /> [103.138.142.2 listed in will-spam-for-food.eu.org]<br /><br /> [103.138.142.2 listed in will-spam-for-food.eu.org]<br /><br /> [103.138.142.2 listed in will-spam-for-food.eu.org]<br /><br /> [103.138.142.2 listed in will-spam-for-food.eu.org]<br /><br /> [103.138.142.2 listed in will-spam-for-food.eu.org]<br /><br /> [103.138.142.2 listed in will-spam-for-food.eu.org]<br /><br /> 1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org<br /><br /> [103.138.142.2 listed in dnsbl.ahbl.org]<br /><br /> [103.138.142.2 listed in dnsbl.ahbl.org]<br /><br /> [103.138.142.2 listed in dnsbl.ahbl.org]<br /><br /> [103.138.142.2 listed in dnsbl.ahbl.org]<br /><br /> [45.154.138.168 listed in dnsbl.ahbl.org]<br /><br /> [45.154.138.168 listed in dnsbl.ahbl.org]<br /><br /> [45.154.138.168 listed in dnsbl.ahbl.org]<br /><br /> [45.154.138.168 listed in dnsbl.ahbl.org]<br /><br /> 0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org<br /><br /> [103.138.142.2 listed in dnsbl.ahbl.org]<br /><br /> 1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org<br /><br /> [103.138.142.2 listed in dnsbl.ahbl.org]<br /><br /> 0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org<br /><br /> [103.138.142.2 listed in dnsbl.ahbl.org]<br /><br /> 0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org<br /><br /> [103.138.142.2 listed in dnsbl.ahbl.org]<br /><br /> -0.0 SPF_PASS SPF: sender matches SPF record<br /><br /> 0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in<br /><br /> headers<br /><br /> -3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact<br /><br /> cert-sa@returnpath.net<br /><br /> [Excessive Number of Queries | <https://knowledge.validity.com/hc/en-us/articles/20961730681243>]<br /><br /> -2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact<br /><br /> safe-sa@returnpath.net<br /><br /> [Excessive Number of Queries | <https://knowledge.validity.com/hc/en-us/articles/20961730681243>]<br /><br /> 1.9 URIBL_ABUSE_SURBL Contains an URL listed in the ABUSE SURBL blocklist<br /><br /> [URI: bcel.com.la]<br /><br /> 1.9 URIBL_JP_SURBL Contains an URL listed in the JP SURBL blocklist<br /><br /> [URI: bcel.com.la]<br /><br /> 0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in digit<br /><br /> [ahmedwalid0(at)hotmail.com]<br /><br /> 1.7 DEAR_SOMETHING BODY: Contains 'Dear (something)'<br /><br /> 2.5 MILLION_USD BODY: Talks about millions of dollars<br /><br /> -0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)<br /><br /> [103.138.142.2 listed in wl.mailspike.net]<br /><br /> 1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,<br /><br /> https://senderscore.org/blacklistlookup/<br /><br /> [103.138.142.2 listed in bl.score.senderscore.com]<br /><br /> 0.0 HTML_MESSAGE BODY: HTML included in message<br /><br /> 0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge<br /><br /> 0.0 LOTS_OF_MONEY Huge... sums of money<br /><br /> 0.0 NO_RDNS2 Sending MTA has no reverse DNS<br /><br /> 0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid<br /><br /> 2.0 MIXED_HREF_CASE Has href in mixed case<br /><br /> 2.5 FREEMAIL_FORGED_REPLYTO Freemail in Reply-To, but not From<br /><br /> 1.3 RDNS_NONE Delivered to internal network by a host with no rDNS<br /><br /> 0.4 MONEY_FREEMAIL_REPTO Lots of money from someone using free email?<br /><br /> Subject: {SPAM?} Project Funding and Investment Opportunities<br /><br /> <br /><br /> This is a multi-part message in MIME format<br /><br /> <br /><br /> --lgEo=_rT1XGyklXeNd5Gv5SjxY2xXLdK6h<br /><br /> Content-Type: text/plain; charset="iso-8859-1"<br /><br /> Content-Transfer-Encoding: quoted-printable<br /><br /> <br /><br /> <br /><br /> Dear Sir/Madam,<br /><br /> <br /><br /> I hope this message finds you well.<br /><br /> <br /><br /> We are pleased to introduce a project funding opportunity for qualifie=<br /><br /> d individuals, companies, and organizations seeking financial support =<br /><br /> for genuine and viable projects.<br /><br /> <br /><br /> I am an international financial broker working with Premium34 Global Y=<br /><br /> atirim Companies. Through our network of funding partners and investor=<br /><br /> s, we facilitate access to project financing and capital ranging from =<br /><br /> USD 1 million to USD 100 million, subject to project assessment, due d=<br /><br /> iligence, and applicable terms and conditions.<br /><br /> <br /><br /> The proposed financing may include:<br /><br /> <br /><br /> <strong> Funding from USD 1 million up to USD 100 million<br /><br /> </strong> Competitive fixed annual interest rates, potentially as low as 2%, d=<br /><br /> epending on the project and financing structure<br /><br /> <strong> Flexible financing structures tailored to eligible projects<br /><br /> </strong> Grace periods of approximately 10 years and 12 months, where applica=<br /><br /> ble<br /><br /> <strong> Financing consideration for infrastructure, real estate, energy, man=<br /><br /> ufacturing, agriculture, technology, and other legitimate business pro=<br /><br /> jects<br /><br /> </strong> Professional review and assessment of the project proposal and suppo=<br /><br /> rting documentation<br /><br /> <br /><br /> Interested applicants are invited to provide a brief overview of their=<br /><br /> project, including the required funding amount, project location, bus=<br /><br /> iness plan, proposed use of funds, and relevant financial information.=<br /><br /> All applications are subject to verification, due diligence, investor=<br /><br /> approval, and the applicable financing requirements.<br /><br /> <br /><br /> If you are seeking reliable funding for a genuine and commercially via=<br /><br /> ble project, please contact us for further information regarding the a=<br /><br /> pplication process, eligibility requirements, documentation, and next =<br /><br /> steps.<br /><br /> <br /><br /> We look forward to hearing from you and exploring a potential financin=<br /><br /> g opportunity.<br /><br /> <br /><br /> Thank you for your time and consideration.<br /><br /> <br /><br /> Best regards,<br /><br /> <br /><br /> Walid Ahmed<br /><br /> International Financial Broker<br /><br /> Premium34 Global Yatirim Companies<br /><br /> Email:=20<br /><br /> <br /><br /> Ahmedwalid0@hotmail.com mailto:Ahmedwalid0@hotmail.com<br /><br /> <br /><br /> Tel/WhatsApp: +17862197362<br /><br /> <br /><br /> --lgEo=_rT1XGyklXeNd5Gv5SjxY2xXLdK6h<br /><br /> Content-Type: text/html; charset="iso-8859-1"<br /><br /> Content-Transfer-Encoding: quoted-printable<br /><br /> <br /><br /> <br /><br /> <html><head><br /><br /> <meta http-equiv=3D"Content-Type" content=3D"text/html; charset=3Diso-=<br /><br /> 8859-1"><br /><br /> <META name=3D"viewport" content=3D"width=3Ddevice-width, initial-sca=<br /><br /> le=3D1"> <META name=3D"format-detection" content=3D"telephone=3Dno"> <=<br /><br /> title>Project Funding and Investment Opportunities




=3Dleft>Dear Sir/Madam,


=3Dleft>I hope this message finds you well=

=2E

We are pleas=

ed to introduce a project funding opportunity for qualified individual=

s, companies, and organizations seeking financial support for genuine =

and viable projects.


rial>I am an international financial broker working with Premium34 Glo=

bal Yatirim Companies. Through our network of funding partners and inv=

estors, we facilitate access to project financing and capital ranging =

from USD 1 million to USD 100 million, subject to project assessment, =

due diligence, and applicable terms and conditions.


=3Dleft>The proposed financing may include=

:

Funding from=

USD 1 million up to USD 100 million
 Competitive fixed annual int=

erest rates, potentially as low as 2%, depending on the project and fi=

nancing structure
Flexible financing structures tailored to eligi=

ble projects
 Grace periods of approximately 10 years and 12 month=

s, where applicable
Financing consideration for infrastructure, r=

eal estate, energy, manufacturing, agriculture, technology, and other =

legitimate business projects
 Professional review and assessment o=

f the project proposal and supporting documentation


=3Dleft>Interested applicants are invited =

to provide a brief overview of their project, including the required f=

unding amount, project location, business plan, proposed use of funds,=

and relevant financial information. All applications are subject to v=

erification, due diligence, investor approval, and the applicable fina=

ncing requirements.


ial>If you are seeking reliable funding for a genuine and commercially=

viable project, please contact us for further information regarding t=

he application process, eligibility requirements, documentation, and n=

ext steps.

We lo=

ok forward to hearing from you and exploring a potential financing opp=

ortunity.

Thank =

you for your time and consideration.


ize=3D3 face=3DArial>Best regards,


e=3D3 face=3DArial>Walid Ahmed
International Financial Broker
Pr=

emium34 Global Yatirim Companies
Email:
d0@hotmail.com">Ahmedwalid0@hotmail.com
Tel/WhatsApp: +17862197=

362
  







--lgEo=_rT1XGyklXeNd5Gv5SjxY2xXLdK6h--