Instagram phish from Google Gmail

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Wed, 03 Jun 2026 17:53:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wUvNi-00000000H2O-3uFO

for dave@doctor.nl2k.ab.ca;

Wed, 03 Jun 2026 17:52:18 -0600

Resent-From: The Doctor

Resent-Date: Wed, 3 Jun 2026 17:52:18 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-dy1-f198.google.com ([74.125.82.198]:44082)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.99.3 (FreeBSD))

(envelope-from <3C3sgaggJBdoDFYZcWYfCI6EH.8KIO6HAOJG.86@maestro.bounces.google.com>)

id 1wUqvS-000000000Iw-3hLT

for sales@nk.ca;

Wed, 03 Jun 2026 13:06:58 -0600

Received: by mail-dy1-f198.google.com with SMTP id 5a478bee46e88-30761ab3483so892232eec.0

for ; Wed, 03 Jun 2026 12:06:04 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=gmail.com; s=20251104; t=1780513558; x=1781118358; darn=nk.ca;

h=content-transfer-encoding:to:from:subject:date:message-id

:mime-version:from:to:cc:subject:date:message-id:reply-to;

bh=Nk1X77ROWPND4KkUVa6jMZOsIHCAYHPgVKMCQ0eaG28=;

b=NdmO1Ckl+fNQfOM4jWmjKAbDtEHoAQtV6FaQMBhKeRL77T+A8XU35mLqL24l497/qK

OsPyctjDOizxOlxzqYtD9IVFjE/mkmzPqc1r+bWts1gknSEkE/XIibRGjtbuJBxHJeSb

Lbbam7ZZ3b4cbH+xd4P9eRSxoRIaoArTQZnlNtNyl4UbDCumihe3LwhFx5GlOq6KReSe

Cmx2QgvGUCT2RG9Mr9O0WwO8otCH/qB1cXDWEgOshBbun2gur4hYHGAX/ubKW5xlrejv

fnKqEvwXkv48hkxoCiF1CpfHZh9skOa9gExOr54Ewwz3bWw6SXJMzqcxxNBLeST6WqfC

n2DA==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20251104; t=1780513558; x=1781118358;

h=content-transfer-encoding:to:from:subject:date:message-id

:mime-version:x-gm-message-state:from:to:cc:subject:date:message-id

:reply-to;

bh=Nk1X77ROWPND4KkUVa6jMZOsIHCAYHPgVKMCQ0eaG28=;

b=NAjkY+FmTAZd+uaTXiMlxUSkJYGkj9tWIuWZrkzle4WwPNt9k3mwqUg/zEMJ3ViDxo

EHNxMmHD2rVDHu6UbvGw1rL01qdWDdYklMpXZIHwjIiJ82vW0ujVcwJWZ9lvCy24zAQ9

yoYuvHq1H0sgQxhrArMfTkCB9RIMoK61+0Fc43gExKGDX1G3u0zL+3tt7kFHLg5ZVp+S

hViwXvrjf7fUCM/Fi14IFqQrU5MDWqOksTO3RdVNcdPhl7Jnjn8gfebnU2fa72aGS1FQ

rl29jTiPccygdaNjgPWJvIVAFon/HUU7M8Lr5VH92qTuD9hPrE3glxnET5Y6/7tboHUx

LzMg==

X-Gm-Message-State: AOJu0Yz89+c9xrUA/9Eto95ApcTAA9ZZmtGn0H8qGd8nIpcrEyIm/rXC

2qsSrkDd7hvuK1TxplmAIHAPhPGpaS9dFYOhZp45VQmFq6SkFEHa+mZsDgdfHPXYoKsphpG/a7v

fYj7MCA==

MIME-Version: 1.0

X-Received: by 2002:a05:6102:5091:b0:6d6:c2ca:1c20 with SMTP id

ada2fe7eead31-6ec4504f3a1mr2684478137.14.1780513547799; Wed, 03 Jun 2026

12:05:47 -0700 (PDT)

Message-ID:

Date: Wed, 03 Jun 2026 19:05:47 +0000

Subject: Netknow Internet Service, Get More 100,000 Instagram Followers and

100,000 Facebook Likes here

From: hj236029@gmail.com

To: sales@nk.ca

Content-Type: text/plain; charset="UTF-8"; format=flowed; delsp=yes

Content-Transfer-Encoding: base64

X-Spam_score: 6.2

X-Spam_score_int: 62

X-Spam_bar: ++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Hi, Netknow Internet Service, Get More 100,000 Instagram Followers

and 100,000 Facebook Likes here Sorry to interrupt your time. We offer social

media services, If you're interested, please visit our Website. If you're

not interested, please skip this step.



Content analysis details: (6.2 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[74.125.82.198 listed in dnsbl.ahbl.org]

[74.125.82.198 listed in dnsbl.ahbl.org]

[74.125.82.198 listed in dnsbl.ahbl.org]

[74.125.82.198 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[74.125.82.198 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[74.125.82.198 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[74.125.82.198 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[74.125.82.198 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[74.125.82.198 listed in will-spam-for-food.eu.org]

[74.125.82.198 listed in will-spam-for-food.eu.org]

[74.125.82.198 listed in will-spam-for-food.eu.org]

[74.125.82.198 listed in will-spam-for-food.eu.org]

[74.125.82.198 listed in will-spam-for-food.eu.org]

[74.125.82.198 listed in will-spam-for-food.eu.org]

[74.125.82.198 listed in will-spam-for-food.eu.org]

[74.125.82.198 listed in will-spam-for-food.eu.org]

2.5 URIBL_DBL_PHISH Contains a Phishing URL listed in the DBL blocklist

[URI: instatool.site]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[74.125.82.198 listed in list.dnswl.org]

-0.0 SPF_PASS SPF: sender matches SPF record

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider

[hj236029(at)gmail.com]

-0.0 T_RP_MATCHES_RCVD Envelope sender domain matches handover relay

domain

0.0 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level mail

domains are different

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[74.125.82.198 listed in bl.score.senderscore.com]

-0.0 RCVD_IN_MSPIKE_H3 RBL: Good reputation (+3)

[74.125.82.198 listed in wl.mailspike.net]

2.0 RATWR8_MESSID Message-ID with excessive dashes and dollars

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

-0.0 RCVD_IN_MSPIKE_WL Mailspike good senders

0.2 FREEMAIL_FORGED_FROMDOMAIN 2nd level domains in From and EnvelopeFrom

freemail headers are different

Subject: {SPAM?} Netknow Internet Service, Get More 100,000 Instagram Followers and

100,000 Facebook Likes here





Hi, Netknow Internet Service, Get More 100,000 Instagram Followers and 100,000 Facebook Likes here

Sorry to interrupt your time.



We offer social media services,

If you're interested, please visit our Website.

If you're not interested, please skip this step.



We will help you increase your social media presence to another level.

( Threads, Instagram, Twitter, Youtube, Facebook, etc. )



Are you interested in a free trial ?

Special For You Bonus Extra $2 - $5 FREE BALANCE TODAY SIGNUP NOW..!!!

GET 100K Followers Instagram NOW !!!

Order here :



[ https://instatool.site/store/free/?netknowyeg ]





Take free trial service today only...!!

10 -101K Instagram Followers



- Instant Start

- Safest Methods

- Privacy Protection

- Speed 200K Followers/day

- High Quality Followers

- Drop-Back Guarantee

- Trusted Seller testimony

- Starting get 100K Followers Instagram

- Guaranteed to be the cheapest



Thank you,

Regards,



Copyright © 2014 - 2026 instatool.site

Instagram phish from Google Gmail

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Wed, 03 Jun 2026 17:53:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wUvNm-00000000H3U-4ATS

for dave@doctor.nl2k.ab.ca;

Wed, 03 Jun 2026 17:52:22 -0600

Resent-From: The Doctor

Resent-Date: Wed, 3 Jun 2026 17:52:22 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-ua1-f70.google.com ([209.85.222.70]:44306)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wUqvW-000000000JN-2sK6

for sales@nk.ca;

Wed, 03 Jun 2026 13:07:02 -0600

Received: by mail-ua1-f70.google.com with SMTP id a1e0cc1a2514c-96396658728so1739299241.1

for ; Wed, 03 Jun 2026 12:06:08 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=gmail.com; s=20251104; t=1780513562; x=1781118362; darn=nk.ca;

h=content-transfer-encoding:to:from:subject:date:message-id

:mime-version:from:to:cc:subject:date:message-id:reply-to;

bh=Nk1X77ROWPND4KkUVa6jMZOsIHCAYHPgVKMCQ0eaG28=;

b=NaaXqUbQAcM7U/1UB7aZ7XjMHzhfu+0cnZ6+SXUDmbBnTGjMntY6yS+qM97cwr3jEn

7rROVw1+QNdwCd5vSN6D6XTjkKrc9SqnN5JkZBfor/6n7G639WLZsBPYoUcHrNnIo4D4

39xHcZbn5bVBvlvj9Ri9fVg31i9+GTmE9eZGWPY8uzvbaXB+yqgs6FsqlHm5Wibegosn

ECgLuaH3RqzOX5/x5N/VHvQ2H1UbUVtIiI1C2nqdiHHu016281RNymzUCcDlU1nBXrTO

QzQxaJsDv8B7eBO4pftkbfdr3cbmqcgVfkotutFVbLfUIIvvSJ+PYvkyZbTdQb7C/Cis

V4pw==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20251104; t=1780513562; x=1781118362;

h=content-transfer-encoding:to:from:subject:date:message-id

:mime-version:x-gm-message-state:from:to:cc:subject:date:message-id

:reply-to;

bh=Nk1X77ROWPND4KkUVa6jMZOsIHCAYHPgVKMCQ0eaG28=;

b=pBBrzLYeQLz1ymrZd+nay1oWbJfut/xH4EL6ybjZrPwTvyEo2Xwthze6Shl8yIPi6F

IKSoH2TJziwjVP/3hGSAe6LaOVcdlQhLQVy5RFAuD6T80xdBaUKVq75UPdzajjt1jqFR

VRQ0IgUd7GedcBwCDb2vtXaj3S//xGj334AvWF38/hDeXwQnRp/JuA/f6tzDvYr9pjuT

ySBFbXg2gVf8tVAm0T/2rK8gabdpefHt7fQWmx5nOrCPL7qjHoIlAXywV4kOpF87bifN

XN0WY67lysB//2iDrNo6NZJJJ97nOhKMOT0sXVEUNZ8gAJHijlexv0aO44ls77wmV6j4

8POA==

X-Gm-Message-State: AOJu0YynOUYiFOeoQnielB1Km/SdFgig2yx0TW5LgfMvrOxVXn7gnMwd

w/w7NG5bY7iTQNPU7T4YvbKuiNdVgDqTxp4LKrDwgBBKbGKrOrGAHTKhzjBft/u9O1htrDJo/JO

fEhfa+w==

MIME-Version: 1.0

X-Received: by 2002:a05:6122:4d12:b0:573:a779:62cf with SMTP id

71dfb90a1353d-5a6e5ddeb96mr3050410e0c.7.1780513562069; Wed, 03 Jun 2026

12:06:02 -0700 (PDT)

Message-ID:

Date: Wed, 03 Jun 2026 19:06:02 +0000

Subject: Netknow Internet Service, Get More 100,000 Instagram Followers and

100,000 Facebook Likes here

From: tutugnangko836@gmail.com

To: sales@nk.ca

Content-Type: text/plain; charset="UTF-8"; format=flowed; delsp=yes

Content-Transfer-Encoding: base64

X-Spam_score: 5.8

X-Spam_score_int: 58

X-Spam_bar: +++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Hi, Netknow Internet Service, Get More 100,000 Instagram Followers

and 100,000 Facebook Likes here Sorry to interrupt your time. We offer social

media services, If you're interested, please visit our Website. If you're

not interested, please skip this step.



Content analysis details: (5.8 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[209.85.222.70 listed in dnsbl.ahbl.org]

[209.85.222.70 listed in dnsbl.ahbl.org]

[209.85.222.70 listed in dnsbl.ahbl.org]

[209.85.222.70 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[209.85.222.70 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[209.85.222.70 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[209.85.222.70 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[209.85.222.70 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[209.85.222.70 listed in will-spam-for-food.eu.org]

[209.85.222.70 listed in will-spam-for-food.eu.org]

[209.85.222.70 listed in will-spam-for-food.eu.org]

[209.85.222.70 listed in will-spam-for-food.eu.org]

[209.85.222.70 listed in will-spam-for-food.eu.org]

[209.85.222.70 listed in will-spam-for-food.eu.org]

[209.85.222.70 listed in will-spam-for-food.eu.org]

[209.85.222.70 listed in will-spam-for-food.eu.org]

2.5 URIBL_DBL_PHISH Contains a Phishing URL listed in the DBL blocklist

[URI: instatool.site]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[209.85.222.70 listed in list.dnswl.org]

-0.0 SPF_PASS SPF: sender matches SPF record

0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends in

digit

[tutugnangko836(at)gmail.com]

0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider

[tutugnangko836(at)gmail.com]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[209.85.222.70 listed in bl.score.senderscore.com]

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[209.85.222.70 listed in wl.mailspike.net]

2.0 RATWR8_MESSID Message-ID with excessive dashes and dollars

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

Subject: {SPAM?} Netknow Internet Service, Get More 100,000 Instagram Followers and

100,000 Facebook Likes here





Hi, Netknow Internet Service, Get More 100,000 Instagram Followers and 100,000 Facebook Likes here

Sorry to interrupt your time.



We offer social media services,

If you're interested, please visit our Website.

If you're not interested, please skip this step.



We will help you increase your social media presence to another level.

( Threads, Instagram, Twitter, Youtube, Facebook, etc. )



Are you interested in a free trial ?

Special For You Bonus Extra $2 - $5 FREE BALANCE TODAY SIGNUP NOW..!!!

GET 100K Followers Instagram NOW !!!

Order here :



[ https://instatool.site/store/free/?netknowyeg ]





Take free trial service today only...!!

10 -101K Instagram Followers



- Instant Start

- Safest Methods

- Privacy Protection

- Speed 200K Followers/day

- High Quality Followers

- Drop-Back Guarantee

- Trusted Seller testimony

- Starting get 100K Followers Instagram

- Guaranteed to be the cheapest



Thank you,

Regards,



Copyright © 2014 - 2026 instatool.site

BBB complaints phish Part 2

Posted by Dave Yadallee on




BBB LOGO





BBB Great West + Pacific sent you a message about

Complaint Received: ID 27621257





TH!NK



Address:

500 Ala Moana Blvd Bldg 7 Ste 400

Honolulu, HI 96813-4920



Phone: (808) 224-6694



Website: https://think-training.com



Email: doctor@nk.ca



Local BBB: BBB Great West + Pacific



BBB File Opened: 3/7/2014



Years in Business: 23



Business Started: 1/6/2003



Category: Management Consultant



⚠ This business is NOT BBB Accredited.





Respond Within 10 Days

Your BBB received a complaint about your business. The complaint was submitted on May 8, 2026 and assigned ID 27621257. Although BBB makes no judgment on validity, we recognize there are two sides to every dispute. We request your good faith effort to resolve it outside the legal system.

⚠ PAY ATTENTION! Nature of complaint: Unsatisfactory product/service quality and delayed delivery! Requested resolution: Full refund plus written apology. The complainant submitted all known details about TH!NK and referenced the email address doctor@nk.ca. Please respond promptly to resolve this matter.

Respond to this Complaint



Please understand that the consumer’s complaint and your response may be publicly posted on the BBB web site (BBB reserves the right to not post in accordance with BBB policy). By submitting your response, you are representing that it is a truthful account of your experience with this consumer. BBB may edit the complaint or your response to protect privacy rights and to remove inappropriate language.





Key Details







Complaint ID: 27621257



Submitted: May 8, 2026



Access Code: 27621257-3D67D



Complainant: click to reveal



Category: Product Quality & Delivery



Business: TH!NK



If you received this complaint via Postal Mail, you may respond online using the link below or respond by mail using the address above.



To access/respond to this complaint online:



Go to:respond-bbb-org/letter/



Enter the following code: 27621257-3D67D





Sender Details









Service Representative - (609) 588-0808 Ext: 11 - complaints@bbb.org



BBB Great West + Pacific





Facebook



Instagram



LinkedIn



Twitter



YouTube





Better Business Bureau® | BBB.org



© 2026, International Association of Better Business Bureaus, Inc., separately incorporated Better Business Bureau organizations in the US and Canada, and BBB Institute for Marketplace Trust, Inc. All rights reserved.



Unsubscribe | Privacy | Log In



BBB Complaints phish Part 1

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Wed, 03 Jun 2026 17:53:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wUvO9-00000000I7b-2KID

for dave@doctor.nl2k.ab.ca;

Wed, 03 Jun 2026 17:52:45 -0600

Resent-From: The Doctor

Resent-Date: Wed, 3 Jun 2026 17:52:45 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from leaf104.mfilter.dimenoc.com ([72.29.89.7]:56392)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wUsD4-000000005ky-0USL

for doctor@nk.ca;

Wed, 03 Jun 2026 14:29:15 -0600

Received: from localhost (localhost [127.0.0.1])

by leaf104.mfilter.dimenoc.com (Postfix) with ESMTP id 1D1BB5D1510

for ; Wed, 3 Jun 2026 16:28:03 -0400 (EDT)

X-Virus-Scanned: amavisd-new at leaf.mfilter.dimenoc.com

Received: from leaf104.mfilter.dimenoc.com ([127.0.0.1])

by localhost (leaf104.mfilter.dimenoc.com [127.0.0.1]) (amavisd-new, port 10024)

with ESMTP id UFK6DpHjymSm for ;

Wed, 3 Jun 2026 16:28:00 -0400 (EDT)

Received: from pass11.dizinc.com (pass11.dizinc.com [72.29.75.247])

by leaf104.mfilter.dimenoc.com (Postfix) with ESMTP

for ; Wed, 3 Jun 2026 16:28:00 -0400 (EDT)

Received: from hst-144-26.orlandonet.net ([83.143.144.26]:26936 helo=KDEEGBYL)

by pass11.dizinc.com with esmtpsa (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

(Exim 4.99.4)

(envelope-from )

id 1wUrYX-00000001GJA-1tGH

for doctor@nk.ca;

Wed, 03 Jun 2026 15:47:17 -0400

Message-ID:

From: BBB Great West + Pacific

To:

Subject: =?utf-8?B?WW91ciBCQkIgR3JlYXQgV2VzdCArIFBhY2lmaWMgcmVjZWl2?=

=?utf-8?B?ZWQgYSBjb21wbGFpbnQgYWJvdXQgeW91ciBidXNpbmVzcy4=?=

Date: Wed, 03 Jun 2026 20:47:14 +0100

MIME-Version: 1.0

Content-Type: multipart/alternative;

boundary="f147dd5acfb15e9f078cfe2a00041590"

X-AntiAbuse: This header was added to track abuse, please include it with any abuse report

X-AntiAbuse: Primary Hostname - pass11.dizinc.com

X-AntiAbuse: Original Domain - nk.ca

X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12]

X-AntiAbuse: Sender Address Domain - j-peters.com

X-Get-Message-Sender-Via: pass11.dizinc.com: authenticated_id: info@j-peters.com

X-Authenticated-Sender: pass11.dizinc.com: info@j-peters.com

X-Source:

X-Source-Args:

X-Source-Dir:

X-Spam_score: 11.4

X-Spam_score_int: 114

X-Spam_bar: +++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview:   MAIN 600px CONTAINER   -->   LOGO / HEADER

  -->



Content analysis details: (11.4 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[83.143.144.26 listed in will-spam-for-food.eu.org]

[83.143.144.26 listed in will-spam-for-food.eu.org]

[83.143.144.26 listed in will-spam-for-food.eu.org]

[83.143.144.26 listed in will-spam-for-food.eu.org]

[83.143.144.26 listed in will-spam-for-food.eu.org]

[83.143.144.26 listed in will-spam-for-food.eu.org]

[83.143.144.26 listed in will-spam-for-food.eu.org]

[83.143.144.26 listed in will-spam-for-food.eu.org]

[72.29.75.247 listed in will-spam-for-food.eu.org]

[72.29.75.247 listed in will-spam-for-food.eu.org]

[72.29.75.247 listed in will-spam-for-food.eu.org]

[72.29.75.247 listed in will-spam-for-food.eu.org]

[72.29.75.247 listed in will-spam-for-food.eu.org]

[72.29.75.247 listed in will-spam-for-food.eu.org]

[72.29.75.247 listed in will-spam-for-food.eu.org]

[72.29.75.247 listed in will-spam-for-food.eu.org]

[72.29.89.7 listed in will-spam-for-food.eu.org]

[72.29.89.7 listed in will-spam-for-food.eu.org]

[72.29.89.7 listed in will-spam-for-food.eu.org]

[72.29.89.7 listed in will-spam-for-food.eu.org]

[72.29.89.7 listed in will-spam-for-food.eu.org]

[72.29.89.7 listed in will-spam-for-food.eu.org]

[72.29.89.7 listed in will-spam-for-food.eu.org]

[72.29.89.7 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[72.29.75.247 listed in dnsbl.ahbl.org]

[72.29.75.247 listed in dnsbl.ahbl.org]

[72.29.75.247 listed in dnsbl.ahbl.org]

[72.29.75.247 listed in dnsbl.ahbl.org]

[72.29.89.7 listed in dnsbl.ahbl.org]

[72.29.89.7 listed in dnsbl.ahbl.org]

[72.29.89.7 listed in dnsbl.ahbl.org]

[72.29.89.7 listed in dnsbl.ahbl.org]

[83.143.144.26 listed in dnsbl.ahbl.org]

[83.143.144.26 listed in dnsbl.ahbl.org]

[83.143.144.26 listed in dnsbl.ahbl.org]

[83.143.144.26 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[72.29.75.247 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[72.29.75.247 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[72.29.75.247 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[72.29.75.247 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_CBL RBL: Received via a relay in cbl.abuseat.org

[Listed by XBL, see ]

1.5 RCVD_IN_SBL_XBL RBL: Received via a relay in Spamhaus SBL+XBL

[83.143.144.26 listed in sbl-xbl.spamhaus.org]

[83.143.144.26 listed in sbl-xbl.spamhaus.org]

1.2 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a relay in bl.spamcop.net

[Blocked - see ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

3.6 RCVD_IN_SBL_CSS RBL: Received via a relay in Spamhaus SBL-CSS

[83.143.144.26 listed in zen.spamhaus.org]

-0.0 RCVD_IN_MSPIKE_H3 RBL: Good reputation (+3)

[72.29.89.7 listed in wl.mailspike.net]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[72.29.89.7 listed in bl.score.senderscore.com]

-0.0 SPF_HELO_PASS SPF: HELO matches SPF record

-0.0 RCVD_IN_MSPIKE_WL Mailspike good senders

0.6 J_CHICKENPOX_22 BODY: 2alpha-pock-2alpha

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 URI_TRUNCATED BODY: Message contained a URI which was truncated

0.0 HTML_FONT_LOW_CONTRAST BODY: HTML font color similar or identical to

background

0.0 HTML_MESSAGE BODY: HTML included in message

0.8 SARE_FROM_SPAM_WORD3 I don't know people named this!

1.0 VOWEL_URI_5 URI hostname with 5 consecutive vowels

Subject: {SPAM?} =?utf-8?B?WW91ciBCQkIgR3JlYXQgV2VzdCArIFBhY2lmaWMgcmVjZWl2?=

=?utf-8?B?ZWQgYSBjb21wbGFpbnQgYWJvdXQgeW91ciBidXNpbmVzcy4=?=

BBB Complaints phish Part 1

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Wed, 03 Jun 2026 17:52:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wUvNE-00000000GvL-3OwR

for dave@doctor.nl2k.ab.ca;

Wed, 03 Jun 2026 17:51:48 -0600

Resent-From: The Doctor

Resent-Date: Wed, 3 Jun 2026 17:51:48 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from wm4-131.speedhosting.co.kr ([111.92.189.131]:35644)

by doctor.nl2k.ab.ca with esmtp (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wUqNV-00000000OqY-03fD

for doctor@nk.ca;

Wed, 03 Jun 2026 12:31:54 -0600

X-AuthUser: kschoi@hanulit.co.kr

Received: from WYWUFTKV ([62.42.154.199]:55843)

by wm4-131.speedhosting.co.kr with [XMail 1.27 Inames120228 ESMTP Server]

id for from ;

Thu, 4 Jun 2026 03:30:38 +0900

Message-ID:

From: BBB Great West + Pacific

To:

Subject: =?utf-8?B?WW91ciBCQkIgR3JlYXQgV2VzdCArIFBhY2lmaWMgcmVjZWl2?=

=?utf-8?B?ZWQgYSBjb21wbGFpbnQgYWJvdXQgeW91ciBidXNpbmVzcy4=?=

Date: Wed, 03 Jun 2026 19:30:33 +0100

MIME-Version: 1.0

Content-Type: multipart/alternative;

boundary="cde5c482645115291312cfd40003efb0"

X-Spam_score: 10.9

X-Spam_score_int: 109

X-Spam_bar: ++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: MAIN 600.0px CONTAINER   -->  LOGO / HEADER  

--> CARD 1: HEADLINE / INTRO   -->BBB Great West + Pacific sent you

a message about Complaint Received: ID 27621257  NEW CARD: B [...]



Content analysis details: (10.9 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[111.92.189.131 listed in dnsbl.ahbl.org]

[111.92.189.131 listed in dnsbl.ahbl.org]

[111.92.189.131 listed in dnsbl.ahbl.org]

[111.92.189.131 listed in dnsbl.ahbl.org]

[62.42.154.199 listed in dnsbl.ahbl.org]

[62.42.154.199 listed in dnsbl.ahbl.org]

[62.42.154.199 listed in dnsbl.ahbl.org]

[62.42.154.199 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[111.92.189.131 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[111.92.189.131 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[111.92.189.131 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[111.92.189.131 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[62.42.154.199 listed in will-spam-for-food.eu.org]

[62.42.154.199 listed in will-spam-for-food.eu.org]

[62.42.154.199 listed in will-spam-for-food.eu.org]

[62.42.154.199 listed in will-spam-for-food.eu.org]

[62.42.154.199 listed in will-spam-for-food.eu.org]

[62.42.154.199 listed in will-spam-for-food.eu.org]

[62.42.154.199 listed in will-spam-for-food.eu.org]

[62.42.154.199 listed in will-spam-for-food.eu.org]

[111.92.189.131 listed in will-spam-for-food.eu.org]

[111.92.189.131 listed in will-spam-for-food.eu.org]

[111.92.189.131 listed in will-spam-for-food.eu.org]

[111.92.189.131 listed in will-spam-for-food.eu.org]

[111.92.189.131 listed in will-spam-for-food.eu.org]

[111.92.189.131 listed in will-spam-for-food.eu.org]

[111.92.189.131 listed in will-spam-for-food.eu.org]

[111.92.189.131 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_SBL_XBL RBL: Received via a relay in Spamhaus SBL+XBL

[62.42.154.199 listed in sbl-xbl.spamhaus.org]

[62.42.154.199 listed in sbl-xbl.spamhaus.org]

3.6 RCVD_IN_SBL_CSS RBL: Received via a relay in Spamhaus SBL-CSS

[62.42.154.199 listed in zen.spamhaus.org]

1.5 RCVD_IN_CBL RBL: Received via a relay in cbl.abuseat.org

[Listed by XBL, see ]

1.2 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a relay in bl.spamcop.net

[Blocked - see ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[111.92.189.131 listed in bl.score.senderscore.com]

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

0.6 J_CHICKENPOX_22 BODY: 2alpha-pock-2alpha

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 URI_TRUNCATED BODY: Message contained a URI which was truncated

0.0 HTML_MESSAGE BODY: HTML included in message

1.0 VOWEL_URI_5 URI hostname with 5 consecutive vowels

Subject: {SPAM?} =?utf-8?B?WW91ciBCQkIgR3JlYXQgV2VzdCArIFBhY2lmaWMgcmVjZWl2?=

=?utf-8?B?ZWQgYSBjb21wbGFpbnQgYWJvdXQgeW91ciBidXNpbmVzcy4=?=



BBB Complaints phish Part 2

Posted by Dave Yadallee on


BBB LOGO





BBB Great West + Pacific sent you a message about

Complaint Received: ID 27621257





TH!NK



Address:

500 Ala Moana Blvd Bldg 7 Ste 400

Honolulu, HI 96813-4920



Phone: (808) 224-6694



Website:https://think-training.com



Email: doctor@nk.ca



Local BBB: BBB Great West + Pacific



BBB File Opened: 3/7/2014



Years in Business: 23



Business Started: 1/6/2003



Category: Management Consultant



⚠ This business is NOT BBB Accredited.





Respond Within 10 Days

Your BBB received a complaint about your business. The complaint was submitted on May 8, 2026 and assigned ID 27621257. Although BBB makes no judgment on validity, we recognize there are two sides to every dispute. We request your good faith effort to resolve it outside the legal system.

⚠ PAY ATTENTION! Nature of complaint: Unsatisfactory product/service quality and delayed delivery! Requested resolution: Full refund plus written apology. The complainant submitted all known details about TH!NK and referenced the email address doctor@nk.ca. Please respond promptly to resolve this matter.

Respond to this Complaint



Please understand that the consumer’s complaint and your response may be publicly posted on the BBB web site (BBB reserves the right to not post in accordance with BBB policy). By submitting your response, you are representing that it is a truthful account of your experience with this consumer. BBB may edit the complaint or your response to protect privacy rights and to remove inappropriate language.





Key Details







Complaint ID: 27621257



Submitted: May 8, 2026



Access Code: 27621257-3D67D



Complainant: click to reveal



Category: Product Quality & Delivery



Business: TH!NK



If you received this complaint via Postal Mail, you may respond online using the link below or respond by mail using the address above.



To access/respond to this complaint online:



Go to:respond-bbb-org/letter/



Enter the following code: 27621257-3D67D





Sender Details









Service Representative - (609) 588-0808 Ext: 11 - complaints@bbb.org



BBB Great West + Pacific





Facebook



Instagram



LinkedIn



Twitter



YouTube





Better Business Bureau® | BBB.org



© 2026, International Association of Better Business Bureaus, Inc., separately incorporated Better Business Bureau organizations in the US and Canada, and BBB Institute for Marketplace Trust, Inc. All rights reserved.



Unsubscribe | Privacy | Log In

BBB Complaints phish Part 2

Posted by Dave Yadallee on


BBB LOGO





BBB Great West + Pacific sent you a message about

Complaint Received: ID 27621257





TH!NK



Address:

500 Ala Moana Blvd Bldg 7 Ste 400

Honolulu, HI 96813-4920



Phone: (808) 224-6694



Website: https://think-training.com



Email: doctor@nk.ca



Local BBB: BBB Great West + Pacific



BBB File Opened: 3/7/2014



Years in Business: 23



Business Started: 1/6/2003



Category: Management Consultant



⚠ This business is NOT BBB Accredited.





Respond Within 10 Days

Your BBB received a complaint about your business. The complaint was submitted on May 8, 2026 and assigned ID 27621257. Although BBB makes no judgment on validity, we recognize there are two sides to every dispute. We request your good faith effort to resolve it outside the legal system.

⚠ PAY ATTENTION! Nature of complaint: Unsatisfactory product/service quality and delayed delivery! Requested resolution: Full refund plus written apology. The complainant submitted all known details about TH!NK and referenced the email address doctor@nk.ca. Please respond promptly to resolve this matter.

Respond to this Complaint



Please understand that the consumer’s complaint and your response may be publicly posted on the BBB web site (BBB reserves the right to not post in accordance with BBB policy). By submitting your response, you are representing that it is a truthful account of your experience with this consumer. BBB may edit the complaint or your response to protect privacy rights and to remove inappropriate language.





Key Details







Complaint ID: 27621257



Submitted: May 8, 2026



Access Code: 27621257-3D67D



Complainant:𜝸click to reveal



Category: Product Quality & Delivery



Business: TH!NK



If you received this complaint via Postal Mail, you may respond online using the link below or respond by mail using the address above.



To access/respond to this complaint online:



Go to:respond-bbb-org/letter/



Enter the following code: 27621257-3D67D





Sender Details









Service Representative - (609) 588-0808 Ext: 11 - complaints@bbb.org



BBB Great West + Pacific





Facebook



Instagram



LinkedIn



Twitter



YouTube





Better Business Bureau® | BBB.org



© 2026, International Association of Better Business Bureaus, Inc., separately incorporated Better Business Bureau organizations in the US and Canada, and BBB Institute for Marketplace Trust, Inc. All rights reserved.



Unsubscribe | Privacy | Log In



BBB Complaints phish Part 1

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Wed, 03 Jun 2026 17:52:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wUvN8-00000000GOZ-1hto

for dave@doctor.nl2k.ab.ca;

Wed, 03 Jun 2026 17:51:42 -0600

Resent-From: The Doctor

Resent-Date: Wed, 3 Jun 2026 17:51:42 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from gamma.tagtech.ru ([83.166.99.196]:40515)

by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

(Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wUq9o-00000000OAX-29DM

for doctor@nk.ca;

Wed, 03 Jun 2026 12:17:49 -0600

DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=rzhevsky.net; s=mail;

h=Content-Type:MIME-Version:Date:Subject:To:From:Message-ID; bh=gBPVGMku9zrpFVXjuMKd8RH5PhMFqMWAe9/Crv1GXrE=;

b=ZDc7p9LqCsSV3FsCnnjt0xRnk/L6X0aJVX7eUjyhm/PQOlfd34LKYI6PNfaB3DoufcCyqP22kOva+knrtxjIgZeDgr2BwQKmSRTyFUcV+fMN81M3ph62ToBdi/iTqoUnp0g2BiIwNAcWW32VlLgdYloMq98kaOuFnvER9iUUMOE=;

Received: from 84-216-123-141.customers.ownit.se ([84.216.123.141] helo=QLITFQJV)

by gamma.tagtech.ru with esmtpsa (UNKNOWN:AES256-GCM-SHA384:256)

(Exim 4.77)

(envelope-from )

id 1wUq91-0005Ma-JU

for doctor@nk.ca; Wed, 03 Jun 2026 21:16:48 +0300

Message-ID: <3998f58fe533c142d158ccb5359d4ca4@rzhevsky.net>

From: BBB Great West + Pacific

To:

Subject: =?utf-8?B?WW91ciBCQkIgR3JlYXQgV2VzdCArIFBhY2lmaWMgcmVjZWl2?=

=?utf-8?B?ZWQgYSBjb21wbGFpbnQgYWJvdXQgeW91ciBidXNpbmVzcy4=?=

Date: Wed, 03 Jun 2026 19:16:42 +0100

MIME-Version: 1.0

Content-Type: multipart/alternative;

boundary="dc378f2d9c91c5721b21a48400022a40"

X-User: 4682

X-Spam_score: 9.0

X-Spam_score_int: 90

X-Spam_bar: +++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: BBB Great West + Pacific sent you a message about Complaint

Received: ID 27621257



Content analysis details: (9.0 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[83.166.99.196 listed in dnsbl.ahbl.org]

[83.166.99.196 listed in dnsbl.ahbl.org]

[83.166.99.196 listed in dnsbl.ahbl.org]

[83.166.99.196 listed in dnsbl.ahbl.org]

[84.216.123.141 listed in dnsbl.ahbl.org]

[84.216.123.141 listed in dnsbl.ahbl.org]

[84.216.123.141 listed in dnsbl.ahbl.org]

[84.216.123.141 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[83.166.99.196 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[83.166.99.196 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[83.166.99.196 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[83.166.99.196 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_SBL_XBL RBL: Received via a relay in Spamhaus SBL+XBL

[84.216.123.141 listed in sbl-xbl.spamhaus.org]

3.6 RCVD_IN_SBL_CSS RBL: Received via a relay in Spamhaus SBL-CSS

[84.216.123.141 listed in zen.spamhaus.org]

1.2 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a relay in bl.spamcop.net

[Blocked - see ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-0.0 SPF_HELO_PASS SPF: HELO matches SPF record

-0.0 SPF_PASS SPF: sender matches SPF record

0.6 J_CHICKENPOX_22 BODY: 2alpha-pock-2alpha

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[84.216.123.141 listed in will-spam-for-food.eu.org]

[84.216.123.141 listed in will-spam-for-food.eu.org]

[84.216.123.141 listed in will-spam-for-food.eu.org]

[84.216.123.141 listed in will-spam-for-food.eu.org]

[84.216.123.141 listed in will-spam-for-food.eu.org]

[84.216.123.141 listed in will-spam-for-food.eu.org]

[84.216.123.141 listed in will-spam-for-food.eu.org]

[84.216.123.141 listed in will-spam-for-food.eu.org]

[83.166.99.196 listed in will-spam-for-food.eu.org]

[83.166.99.196 listed in will-spam-for-food.eu.org]

[83.166.99.196 listed in will-spam-for-food.eu.org]

[83.166.99.196 listed in will-spam-for-food.eu.org]

[83.166.99.196 listed in will-spam-for-food.eu.org]

[83.166.99.196 listed in will-spam-for-food.eu.org]

[83.166.99.196 listed in will-spam-for-food.eu.org]

[83.166.99.196 listed in will-spam-for-food.eu.org]

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[83.166.99.196 listed in wl.mailspike.net]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[83.166.99.196 listed in bl.score.senderscore.com]

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 URI_TRUNCATED BODY: Message contained a URI which was truncated

0.0 HTML_FONT_LOW_CONTRAST BODY: HTML font color similar or identical to

background

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

1.0 VOWEL_URI_5 URI hostname with 5 consecutive vowels

Subject: {SPAM?} =?utf-8?B?WW91ciBCQkIgR3JlYXQgV2VzdCArIFBhY2lmaWMgcmVjZWl2?=

=?utf-8?B?ZWQgYSBjb21wbGFpbnQgYWJvdXQgeW91ciBidXNpbmVzcy4=?=

BBB Compaints phish Part 1

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Wed, 03 Jun 2026 17:52:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wUvMm-00000000FVH-198c

for dave@doctor.nl2k.ab.ca;

Wed, 03 Jun 2026 17:51:20 -0600

Resent-From: The Doctor

Resent-Date: Wed, 3 Jun 2026 17:51:20 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from [69.160.61.48] (port=64839 helo=1loudgt.nexcess.net)

by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256

(Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wUpq4-00000000Gtp-2nHg

for doctor@nk.ca;

Wed, 03 Jun 2026 11:57:20 -0600

Received: (qmail 23777 invoked by uid 108); 3 Jun 2026 13:56:19 -0400

Received: from unknown (HELO 1loudgt.nexcess.net) (127.0.0.1)

by 1loudgt.nexcess.net with SMTP; 3 Jun 2026 13:56:19 -0400

Received: from SLVKVFOW ([82.49.212.43])

by 1loudgt.nexcess.net with ESMTPSA

id N92aCMJqIGrfXAAAzWod9Q

(envelope-from )

for ; Wed, 03 Jun 2026 13:56:18 -0400

Message-ID:

From: BBB Great West + Pacific

To:

Subject: =?utf-8?B?WW91ciBCQkIgR3JlYXQgV2VzdCArIFBhY2lmaWMgcmVjZWl2?=

=?utf-8?B?ZWQgYSBjb21wbGFpbnQgYWJvdXQgeW91ciBidXNpbmVzcy4=?=

Date: Wed, 03 Jun 2026 18:56:14 +0100

MIME-Version: 1.0

Content-Type: multipart/alternative;

boundary="443f9197c69030d35528e1d10005be10"

X-Spam_score: 7.7

X-Spam_score_int: 77

X-Spam_bar: +++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: BBB Great West + Pacific sent you a message about Complaint

Received: ID 27621257



Content analysis details: (7.7 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[69.160.61.48 listed in dnsbl.ahbl.org]

[69.160.61.48 listed in dnsbl.ahbl.org]

[69.160.61.48 listed in dnsbl.ahbl.org]

[69.160.61.48 listed in dnsbl.ahbl.org]

[82.49.212.43 listed in dnsbl.ahbl.org]

[82.49.212.43 listed in dnsbl.ahbl.org]

[82.49.212.43 listed in dnsbl.ahbl.org]

[82.49.212.43 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[69.160.61.48 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[69.160.61.48 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[69.160.61.48 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[69.160.61.48 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[82.49.212.43 listed in will-spam-for-food.eu.org]

[82.49.212.43 listed in will-spam-for-food.eu.org]

[82.49.212.43 listed in will-spam-for-food.eu.org]

[82.49.212.43 listed in will-spam-for-food.eu.org]

[82.49.212.43 listed in will-spam-for-food.eu.org]

[82.49.212.43 listed in will-spam-for-food.eu.org]

[82.49.212.43 listed in will-spam-for-food.eu.org]

[82.49.212.43 listed in will-spam-for-food.eu.org]

[69.160.61.48 listed in will-spam-for-food.eu.org]

[69.160.61.48 listed in will-spam-for-food.eu.org]

[69.160.61.48 listed in will-spam-for-food.eu.org]

[69.160.61.48 listed in will-spam-for-food.eu.org]

[69.160.61.48 listed in will-spam-for-food.eu.org]

[69.160.61.48 listed in will-spam-for-food.eu.org]

[69.160.61.48 listed in will-spam-for-food.eu.org]

[69.160.61.48 listed in will-spam-for-food.eu.org]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[69.160.61.48 listed in bl.score.senderscore.com]

1.0 SPF_SOFTFAIL SPF: sender does not match SPF record (softfail)

0.6 J_CHICKENPOX_22 BODY: 2alpha-pock-2alpha

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 URI_TRUNCATED BODY: Message contained a URI which was truncated

0.0 HTML_FONT_LOW_CONTRAST BODY: HTML font color similar or identical to

background

0.0 HTML_MESSAGE BODY: HTML included in message

1.0 VOWEL_URI_5 URI hostname with 5 consecutive vowels

0.0 NO_RDNS2 Sending MTA has no reverse DNS

1.3 RDNS_NONE Delivered to internal network by a host with no rDNS

2.5 NORDNS_LOW_CONTRAST No rDNS + hidden text

Subject: {SPAM?} =?utf-8?B?WW91ciBCQkIgR3JlYXQgV2VzdCArIFBhY2lmaWMgcmVjZWl2?=

=?utf-8?B?ZWQgYSBjb21wbGFpbnQgYWJvdXQgeW91ciBidXNpbmVzcy4=?=

BBB Compaints phish Part 2

Posted by Dave Yadallee on




BBB LOGO





BBB Great West + Pacific sent you a message about

Complaint Received: ID 27621257





TH!NK



Address:

500 Ala Moana Blvd Bldg 7 Ste 400

Honolulu, HI 96813-4920



Phone: (808) 224-6694



Website: https://think-training.com



Email: doctor@nk.ca



Local BBB: BBB Great West + Pacific



BBB File Opened: 3/7/2014



Years in Business: 23



Business Started: 1/6/2003



Category: Management Consultant



⚠ This business is NOT BBB Accredited.





Respond Within 10 Days

Your BBB received a complaint about your business. The complaint was submitted on May 8, 2026 and assigned ID 27621257. Although BBB makes no judgment on validity, we recognize there are two sides to every dispute. We request your good faith effort to resolve it outside the legal system.

⚠ PAY ATTENTION! Nature of complaint: Unsatisfactory product/service quality and delayed delivery! Requested resolution: Full refund plus written apology. The complainant submitted all known details about TH!NK and referenced the email address doctor@nk.ca. Please respond promptly to resolve this matter.

Respond to this Complaint



Please understand that the consumer’s complaint and your response may be publicly posted on the BBB web site (BBB reserves the right to not post in accordance with BBB policy). By submitting your response, you are representing that it is a truthful account of your experience with this consumer. BBB may edit the complaint or your response to protect privacy rights and to remove inappropriate language.





Key Details







Complaint ID: 27621257



Submitted: May 8, 2026



Access Code: 27621257-3D67D



Complainant: click to reveal



Category: Product Quality & Delivery



Business: TH!NK



If you received this complaint via Postal Mail, you may respond online using the link below or respond by mail using the address above.



To access/respond to this complaint online:



Go to:respond-bbb-org/letter/



Enter the following code: 27621257-3D67D





Sender Details









Service Representative - (609) 588-0808 Ext: 11 - complaints@bbb.org



BBB Great West + Pacific





Facebook



Instagram



LinkedIn



Twitter



YouTube





Better Business Bureau® | BBB.org



© 2026, International Association of Better Business Bureaus, Inc., separately incorporated Better Business Bureau organizations in the US and Canada, and BBB Institute for Marketplace Trust, Inc. All rights reserved.



Unsubscribe | Privacy | Log In



BBB compaints phish from Japan Part 2

Posted by Dave Yadallee on




BBB LOGO





BBB Great West + Pacific sent you a message about

Complaint Received: ID 27621257





TH!NK



Address:

500 Ala Moana Blvd Bldg 7 Ste 400

Honolulu, HI 96813-4920



Phone: (808) 224-6694



Website: https://think-training.com



Email: doctor@nk.ca



Local BBB: BBB Great West + Pacific



BBB File Opened: 3/7/2014



Years in Business: 23



Business Started: 1/6/2003



Category: Management Consultant



⚠ This business is NOT BBB Accredited.





Respond Within 10 Days

Your BBB received a complaint about your business. The complaint was submitted on May 8, 2026 and assigned ID 27621257. Although BBB makes no judgment on validity, we recognize there are two sides to every dispute. We request your good faith effort to resolve it outside the legal system.

⚠ PAY ATTENTION! Nature of complaint: Unsatisfactory product/service quality and delayed delivery! Requested resolution: Full refund plus written apology. The complainant submitted all known details about TH!NK and referenced the email address doctor@nk.ca. Please respond promptly to resolve this matter.

Respond to this Complaint



Please understand that the consumer’s complaint and your response may be publicly posted on the BBB web site (BBB reserves the right to not post in accordance with BBB policy). By submitting your response, you are representing that it is a truthful account of your experience with this consumer. BBB may edit the complaint or your response to protect privacy rights and to remove inappropriate language.





Key Details







Complaint ID: 27621257



Submitted: May 8, 2026



Access Code: 27621257-3D67D



Complainant: click to reveal



Category: Product Quality & Delivery



Business: TH!NK



If you received this complaint via Postal Mail, you may respond online using the link below or respond by mail using the address above.



To access/respond to this complaint online:



Go to:respond-bbb-org/letter/



Enter the following code: 27621257-3D67D





Sender Details









Service Representative - (609) 588-0808 Ext: 11 - complaints@bbb.org



BBB Great West + Pacific





Facebook



Instagram



LinkedIn



Twitter



YouTube





Better Business Bureau® | BBB.org



© 2026, International Association of Better Business Bureaus, Inc., separately incorporated Better Business Bureau organizations in the US and Canada, and BBB Institute for Marketplace Trust, Inc. All rights reserved.



Unsubscribe | Privacy | Log In



BBB compaints phish from Japan Part 1

Posted by Dave Yadallee on


X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Wed, 03 Jun 2026 17:52:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wUvMb-00000000FSH-2ZPz

for dave@doctor.nl2k.ab.ca;

Wed, 03 Jun 2026 17:51:09 -0600

Resent-From: The Doctor

Resent-Date: Wed, 3 Jun 2026 17:51:09 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from nomad.or.jp ([163.44.7.92]:42368)

by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

(Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wUpSH-00000000CEL-3Ley

for doctor@nk.ca;

Wed, 03 Jun 2026 11:32:46 -0600

Received: (qmail 29549 invoked by VF by uid 0); 4 Jun 2026 02:31:44 +0900

X-Vade-Tracker: score=549, verdict=spam:high, state=1

spamcause=gggruggvucftvghtrhhoucdtuddrgeefhedrtddtgddukeehvddtucetufdoteggodetrfdotffvucfrrhhofhhilhgvmecupffvvffrveenuceurghilhhouhhtmecufedttdenucgoufhushhpvggtthffohhmrghinhculdegledmnegoufhprghmgfhmrghilhdqohhuthculdehtddtmdenucfjughrpefkhffvufffgggtsegrtdhjredttdejnecuhfhrohhmpeeuueeuucfirhgvrghtucghvghsthcuodcurfgrtghifhhitgcuoehsqdihrghmrghmohhtohesnhhomhgrugdrohhrrdhjpheqnecuggftrfgrthhtvghrnhepteeihefgvddtkedvjeejjeehlefgvdduveeuvddtgeehkefhgeehleekleeuteehnecuffhomhgrihhnpegssggsrdhorhhgpdhthhhinhhkqdhtrhgrihhnihhnghdrtghomhdpsghlohhgshhpohhtrdgtohhmpdhgohhoghhlvgdrtghomhdpfhgrtggvsghoohhkrdgtohhmpdhinhhsthgrghhrrghmrdgtohhmpdhlihhnkhgvughinhdrtghomhdpthifihhtthgvrhdrtghomhdphihouhhtuhgsvgdrtghomhenucfkphepleegrdduudegrdduhedtrdelleenucfuphgrmhfkphepleegrdduudegrdduhedtrdelleenucfuphgrmhfgmhgrihhlpegtohhmphhlrghinhhtshessggssgdrohhrghenucfuphgrmhetlhhphhgrufhusghjvggtthephihouhhrjihfrhhomhgprghlihgrshilrhgvtggvihhvvggurggtohhmphhlrghinhhtrggsohhuthihohhurhgsuhhsihh

nvghsshenucevlhhushhtvghrufhiiigvpedtnecurfgrrhgrmhepihhnvghtpeelgedruddugedrudehtddrleelpdhhvghlohephffrfgfuiffuuegipdhmrghilhhfrhhomhepshdqhigrmhgrmhhothhosehnohhmrggurdhorhdrjhhppdhnsggprhgtphhtthhopedupdhrtghpthhtohepughotghtohhrsehnkhdrtggrpdhmohguvgepshhmthhpohhuthenucfuphgrmhfkphepleegrdduudegrdduhedtrdelle

Received: from unknown (HELO FPUSGSBX) (s-yamamoto@nomad.or.jp@94.114.150.99)

by dc58.etius.jp (163.44.7.92) with ESMTPA; 4 Jun 2026 02:31:44 +0900

Message-ID:

From: BBB Great West + Pacific

To:

Subject: =?utf-8?B?WW91ciBCQkIgR3JlYXQgV2VzdCArIFBhY2lmaWMgcmVjZWl2?=

=?utf-8?B?ZWQgYSBjb21wbGFpbnQgYWJvdXQgeW91ciBidXNpbmVzcy4=?=

Date: Wed, 03 Jun 2026 18:31:38 +0100

MIME-Version: 1.0

Content-Type: multipart/alternative;

boundary="5bc8b310a424306c638b71c8000670b0"

X-Spam_score: 8.1

X-Spam_score_int: 81

X-Spam_bar: ++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: BBB Great West + Pacific sent you a message about Complaint

Received: ID 27621257



Content analysis details: (8.1 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[163.44.7.92 listed in dnsbl.ahbl.org]

[163.44.7.92 listed in dnsbl.ahbl.org]

[163.44.7.92 listed in dnsbl.ahbl.org]

[163.44.7.92 listed in dnsbl.ahbl.org]

[94.114.150.99 listed in dnsbl.ahbl.org]

[94.114.150.99 listed in dnsbl.ahbl.org]

[94.114.150.99 listed in dnsbl.ahbl.org]

[94.114.150.99 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[163.44.7.92 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[163.44.7.92 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[163.44.7.92 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[163.44.7.92 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[94.114.150.99 listed in will-spam-for-food.eu.org]

[94.114.150.99 listed in will-spam-for-food.eu.org]

[94.114.150.99 listed in will-spam-for-food.eu.org]

[94.114.150.99 listed in will-spam-for-food.eu.org]

[94.114.150.99 listed in will-spam-for-food.eu.org]

[94.114.150.99 listed in will-spam-for-food.eu.org]

[94.114.150.99 listed in will-spam-for-food.eu.org]

[94.114.150.99 listed in will-spam-for-food.eu.org]

[163.44.7.92 listed in will-spam-for-food.eu.org]

[163.44.7.92 listed in will-spam-for-food.eu.org]

[163.44.7.92 listed in will-spam-for-food.eu.org]

[163.44.7.92 listed in will-spam-for-food.eu.org]

[163.44.7.92 listed in will-spam-for-food.eu.org]

[163.44.7.92 listed in will-spam-for-food.eu.org]

[163.44.7.92 listed in will-spam-for-food.eu.org]

[163.44.7.92 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_SBL_XBL RBL: Received via a relay in Spamhaus SBL+XBL

[94.114.150.99 listed in sbl-xbl.spamhaus.org]

3.6 RCVD_IN_SBL_CSS RBL: Received via a relay in Spamhaus SBL-CSS

[94.114.150.99 listed in zen.spamhaus.org]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-0.0 SPF_HELO_PASS SPF: HELO matches SPF record

-0.0 SPF_PASS SPF: sender matches SPF record

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

-0.0 T_RP_MATCHES_RCVD Envelope sender domain matches handover relay

domain

0.6 J_CHICKENPOX_22 BODY: 2alpha-pock-2alpha

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[163.44.7.92 listed in bl.score.senderscore.com]

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 URI_TRUNCATED BODY: Message contained a URI which was truncated

0.0 HTML_MESSAGE BODY: HTML included in message

1.0 VOWEL_URI_5 URI hostname with 5 consecutive vowels

Subject: {SPAM?} =?utf-8?B?WW91ciBCQkIgR3JlYXQgV2VzdCArIFBhY2lmaWMgcmVjZWl2?=

=?utf-8?B?ZWQgYSBjb21wbGFpbnQgYWJvdXQgeW91ciBidXNpbmVzcy4=?=

French rental demand phish from Google Gmail Part 2

Posted by Dave Yadallee on
--0000000000003bca7f06535dd183

Content-Type: text/plain; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable



Chers locataires,



Nous esp=C3=A9rons que vous allez bien.



Nous vous =C3=A9crivons afin de vous informer d'un changement important

concernant le paiement de votre loyer. Dans un souci de simplification, de

rapidit=C3=A9 et de s=C3=A9curit=C3=A9, nous vous invitons =C3=A0 effectuer=

vos paiements par

virement Interac, et ce =C3=A0 compter de ce mois-ci.



Ce nouveau mode de paiement nous permettra :



- de suivre plus facilement les transactions ;

- de r=C3=A9duire les d=C3=A9lais de traitement ;

- et de nous assurer que chaque loyer est bien re=C3=A7u =C3=A0 temps.



Informations pour le virement :





Adresse courriel du destinataire : agenceimmobilier1990@outlook.com



Question de s=C3=A9curit=C3=A9 : VIREMENT





R=C3=A9ponse : INTERAC



Une fois le virement effectu=C3=A9, merci de nous en informer par retour de

courriel. Si possible, nous vous invitons =C3=A0 joindre une capture d'=C3=

=A9cran ou

une confirmation du virement afin de faciliter la mise =C3=A0 jour rapide d=

e

votre dossier.



Nous comprenons que ce changement puisse n=C3=A9cessiter un temps d'adaptat=

ion.

Soyez assur=C3=A9(e) que nous restons disponibles pour vous accompagner tou=

t au

long de cette transition.



N=E2=80=99h=C3=A9sitez pas =C3=A0 nous contacter pour toute question ou pou=

r obtenir de

l'aide lors de votre premier virement.



Nous vous remercions pour votre collaboration et votre confiance. Votre

confort et votre tranquillit=C3=A9 d=E2=80=99esprit demeurent nos priorit=

=C3=A9s.



Pour toute demande, vous pouvez nous =C3=A9crire =C3=A0 :

agenceimmobilier1990@outlook.com



Bien cordialement,





Service Locative



--0000000000003bca7f06535dd183

Content-Type: text/html; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable



Chers locataires,

Nous esp=C3=A9rons que vous=

allez bien.

Nous vous =C3=A9crivons afin de vous informer d'un c=

hangement important concernant le paiement de votre loyer. Dans un souci de=

simplification, de rapidit=C3=A9 et de s=C3=A9curit=C3=A9, nous vous invit=

ons =C3=A0 effectuer vos paiements par virement Interac, et ce =C3=A0 compt=

er de ce mois-ci.

Ce nouveau mode de paiement nous permettra :


>
  • de suivre plus facilement les transactions ;
  • de r=C3=A9duire l=

    es d=C3=A9lais de traitement ;
  • et de nous assurer que chaque loyer =

    est bien re=C3=A7u =C3=A0 temps.

    • Informations pour le v=

    irement :


    Adresse courriel du destinataire :
    color=3D"#0000ff">=C2=A0
    ,246);font-family:"Google Sans",Roboto;font-size:14px;text-align:=

    center">
    ook.com" target=3D"_blank">agenceimmobilier1990@outlook.com
    n>

    Question de s=C3=A9curit=C3=A9 :=C2=A0
    s,Aptos_EmbeddedFont,Aptos_MSFontService,Calibri,Helvetica,sans-serif;color=

    :rgb(200,38,19)">VIREMENT


    R=C3=A9ponse :=C2=A0
    =3D"font-family:Aptos,Aptos_EmbeddedFont,Aptos_MSFontService,Calibri,Helvet=

    ica,sans-serif;font-size:16px;color:rgb(200,38,19)">
    tyle=3D"vertical-align:inherit">
    inherit">INTERAC

    Une fois le virement effectu=

    =C3=A9, merci de nous en informer par retour de courriel. Si possible, nous=

    vous invitons =C3=A0 joindre une capture d'=C3=A9cran ou une confirmat=

    ion du virement afin de faciliter la mise =C3=A0 jour rapide de votre dossi=

    er.

    Nous comprenons que ce changement puisse n=C3=A9cessiter un temps=

    d'adaptation. Soyez assur=C3=A9(e) que nous restons disponibles pour v=

    ous accompagner tout au long de cette transition.

    N=E2=80=99h=C3=A9si=

    tez pas =C3=A0 nous contacter pour toute question ou pour obtenir de l'=

    aide lors de votre premier virement.

    Nous vous remercions pour votre =

    collaboration et votre confiance. Votre confort et votre tranquillit=C3=A9 =

    d=E2=80=99esprit demeurent nos priorit=C3=A9s.

    Pour toute demande, vo=

    us pouvez nous =C3=A9crire =C3=A0 :=C2=A0
    b(233,238,246);font-family:"Google Sans",Roboto;font-size:14px;te=

    xt-align:center">
    1990@outlook.com" target=3D"_blank">agenceimmobilier1990@outlook.com
    ont>

    Bien cordialement,


    Service Locative





    --0000000000003bca7f06535dd183--

    French rental demand phish from Google Gmail Part 1

    Posted by Dave Yadallee on
    X-Mozilla-Status: 0001

    X-Mozilla-Status2: 00000000

    Return-path:

    Envelope-to: dave@doctor.nl2k.ab.ca

    Delivery-date: Wed, 03 Jun 2026 12:46:00 -0600

    Received: from mail-dl1-f48.google.com ([74.125.82.48]:48466)

    by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

    (Exim 4.99.3 (FreeBSD))

    (envelope-from )

    id 1wUqaf-00000000PWE-2lZ4

    for dave@doctor.nl2k.ab.ca;

    Wed, 03 Jun 2026 12:45:30 -0600

    Received: by mail-dl1-f48.google.com with SMTP id a92af1059eb24-137dd523634so6690896c88.1

    for ; Wed, 03 Jun 2026 11:44:33 -0700 (PDT)

    ARC-Seal: i=1; a=rsa-sha256; t=1780512268; cv=none;

    d=google.com; s=arc-20240605;

    b=lROFAqEKpNULqImhAoOmCP3sMsPBvTZpORL5ZZNn/QU6xbPk1T5W1+XgsxMAQ6Sud+

    wWMZiZF5im2ZvI7XbFpkN2jsnA9A0//e3yX6z50f2dQpJrRQXCzY3tVv1ZeK2rtfew9Q

    lbtemD0mPvOoYrQAarvlesu4aDcb1Syo5PEz9n3DwsjW9+5xc6oVicr+nxMl3dLg0HFY

    aq8itXxcWDl55fuxyPx1vjYyI/bTQCQHZRKkEfhIHZARM9xa3bF6TjY04LmsfkDLy+04

    oWjDXThlca32wytLoLYsaMCFrrI5htqJnq8qZJhzNLej9KLE7CWiYjarhWOmJtsWgy3m

    u/TQ==

    ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20240605;

    h=to:subject:message-id:date:from:reply-to:mime-version

    :dkim-signature;

    bh=O/5wFZUtNunhXLGC5aJYw/gHqbalIm305kc+HXYesNY=;

    fh=zVbOMpQjN1ElltPgYQHeloHI1ULle2HETGB3YJEe754=;

    b=AkIed8FKjZ2zIGaARfsGaanXUZrUL0c10xqqIBFBEURXScjs1BDFWXxqv35VIWCnYk

    l5Nt2WtEGBA6HPniJq7Gdj9Nsd1+RFwPue2p9ZvB8W2/iTQUHgSV2uR2r/NuYiueigMm

    xcW/cJ8Hxu0nnsbW5yE6/M9H36MRMs6Q/f9z4l/oKEpT0G4idh6LDqnKxPmoXwvOkH1w

    oJfPmORsC1LpP6jrss0DsGoTm8xFWHcfxodanrBmaei9Ra6p9jpQ3ytqrZGqXbir0ioi

    nWi+rWjLsM7eKhs5MrhGhdTb6C5NwZD87egOWSCDqd8TyQc5eS3fZWaDF5d4d93QRc7A

    0BoQ==;

    darn=doctor.nl2k.ab.ca

    ARC-Authentication-Results: i=1; mx.google.com; arc=none

    DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

    d=edutec-sed-ms-gov-br.20251104.gappssmtp.com; s=20251104; t=1780512268; x=1781117068; darn=doctor.nl2k.ab.ca;

    h=to:subject:message-id:date:from:reply-to:mime-version:from:to:cc

    :subject:date:message-id:reply-to;

    bh=O/5wFZUtNunhXLGC5aJYw/gHqbalIm305kc+HXYesNY=;

    b=GzScLCVnafy9HCuKhLZeCNrBvyoWCDYvML3W8f9D/pEZ/ZHnTkQ3iXxGnTyhV3H6wF

    /4/NghM0JfynWn6FcY2sixceWF9M6UNR0zPhDmfvncXb1oEWgmp6np6CVwfwc2cJkpRa

    NHpdLGaqa74UxYgk1GqDH+XuIuD/A6Vstel/4/ixFXq5O2PNWrHuJqKZ5iSAyyw8OLUA

    CqxVw0WwnC0DTZzhj8akaWZa97HonDaOogs522yA47HZKfXGTAHt1ht9R/sGS/L8v9Bl

    QYWQtGIhN5mHjxzWOwEaXQvkOU4K21HGHI6oeoAB9Op1zQpwXF6zMxosGthB5bllkrq9

    Xc7w==

    X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

    d=1e100.net; s=20251104; t=1780512268; x=1781117068;

    h=to:subject:message-id:date:from:reply-to:mime-version:x-gm-gg

    :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to;

    bh=O/5wFZUtNunhXLGC5aJYw/gHqbalIm305kc+HXYesNY=;

    b=a7lWdL9JdxVpnmd+8tlZPBrtxQ6SAfv0vfBoVtCcaUaVM6fRd426LCwNLoEkdYKYJH

    qn8K7Jl2BcJZ85wWtt0GAt1HNTy8ukroOHGD78gEGfuCI2EdZa/R03Tk0iU6jJBgYV93

    4rw5g788cPj7GwWS2smj4/FwW/AAtuY5/gfhNctHVfhQ+oJg3neg0fKcR8Eq3twxhAKN

    5D5huIdO2PAMTwSRPMJZm/Kj3hevaYr7SrVoF+a69pivQkGLJKFpSI+c9cmUMzax0SwC

    e+hVWL85eZxtcut+CUX42MmjScfozQBf+298LPs83ccHAPC0C7RBNyqJh6pQg1v4Ohmi

    cjCQ==

    X-Forwarded-Encrypted: i=1; AFNElJ8v4rZW1ja2PEzIY9Hk615FP78PIjK5SceI/inDF29vHRjmPIFls7YMrboto4xkb1a/JAMz@doctor.nl2k.ab.ca

    X-Gm-Message-State: AOJu0Yxj5tF+g7uhYh/jMl5uT6uyjQInQ+xgKMu6bcHXYaobApsaYCNc

    gBjBizkhfARqff7yhkP66sx5vQeSH2QpOIowtsF7vXLty8HGlOVBSGviA9loqFqBBml5g6PErVp

    pTzIQL5/8Fg4ALCqTb0+oxJBHXYPNXdC8YMbyXrxKsw==

    X-Gm-Gg: Acq92OGBOM9Rk1EhY0vhEB4pDkquu5rDBjeqdFHNHwZuoVRYqSVoQLy1T9DU5elIwak

    TLbsjMDZboB5rwImGmWrmvyhB2frGgEgDjXz8kXf+9f34GqvcdM3KBwenRnrnXnkFQtGIx4fDme

    jyFaGaDcVNdMlnej9358NAclSyeHCIYwsLCJNJW3yIHdGOpaUlf2NTZXcI24e8FKaYc0jT8eDKT

    AgK3h4S/77tzqJSPsm6tQyTt/ckD2CRSuQCOeeKZAgR0HK4PwWB/r4Gu24wwEkBhCaeIuRqwwqJ

    EaxaKfbdAzjGKf5l99sI

    X-Received: by 2002:a05:7022:7a4:b0:136:fac0:84dc with SMTP id

    a92af1059eb24-137f693a12amr1817845c88.3.1780512267680; Wed, 03 Jun 2026

    11:44:27 -0700 (PDT)

    MIME-Version: 1.0

    Reply-To: servicelocative10@gmail.com

    From: Service Locative

    Date: Wed, 3 Jun 2026 20:44:07 +0200

    X-Gm-Features: AVHnY4L-_t2ltkxYbpdNMkg7WtLilyqSwEwp1Qz6Fb5N1eO5NUDf5udQOqiiLmI

    Message-ID:

    Subject: =?UTF-8?Q?Re=3A_Rappel_=3A_Loyer_Mai_=2D_r=C3=A9gulariser_votre_paiement?=

    =?UTF-8?Q?_=F0=9F=8F=A0?=

    To: undisclosed-recipients:;

    Content-Type: multipart/alternative; boundary="0000000000003bca7f06535dd183"

    Bcc: dave@doctor.nl2k.ab.ca

    X-Spam_score: 9.5

    X-Spam_score_int: 95

    X-Spam_bar: +++++++++

    X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

    has identified this incoming email as possible spam. The original

    message has been attached to this so you can view it or label

    similar future email. If you have any questions, see

    @@CONTACT_ADDRESS@@ for details.



    Content preview: Chers locataires, Nous espérons que vous allez bien. Nous

    vous écrivons afin de vous informer d'un changement important concernant

    le paiement de votre loyer. Dans un souci de simplification, de rapidité

    et de sécurité, nous vous invitons à effectu [...]



    Content analysis details: (9.5 points, 5.0 required)



    pts rule name description

    ---- ---------------------- --------------------------------------------------

    1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

    [74.125.82.48 listed in dnsbl.ahbl.org]

    [74.125.82.48 listed in dnsbl.ahbl.org]

    [74.125.82.48 listed in dnsbl.ahbl.org]

    [74.125.82.48 listed in dnsbl.ahbl.org]

    0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

    [74.125.82.48 listed in dnsbl.ahbl.org]

    1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

    [74.125.82.48 listed in dnsbl.ahbl.org]

    0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

    [74.125.82.48 listed in dnsbl.ahbl.org]

    0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

    [74.125.82.48 listed in dnsbl.ahbl.org]

    1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

    [74.125.82.48 listed in will-spam-for-food.eu.org]

    [74.125.82.48 listed in will-spam-for-food.eu.org]

    [74.125.82.48 listed in will-spam-for-food.eu.org]

    [74.125.82.48 listed in will-spam-for-food.eu.org]

    [74.125.82.48 listed in will-spam-for-food.eu.org]

    [74.125.82.48 listed in will-spam-for-food.eu.org]

    [74.125.82.48 listed in will-spam-for-food.eu.org]

    [74.125.82.48 listed in will-spam-for-food.eu.org]

    -0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

    trust

    [74.125.82.48 listed in list.dnswl.org]

    -2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

    safe-sa@returnpath.net

    [Excessive Number of Queries | ]

    -3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

    cert-sa@returnpath.net

    [Excessive Number of Queries | ]

    -0.0 RCVD_IN_MSPIKE_H3 RBL: Good reputation (+3)

    [74.125.82.48 listed in wl.mailspike.net]

    1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

    https://senderscore.org/blacklistlookup/

    [74.125.82.48 listed in bl.score.senderscore.com]

    -0.0 SPF_PASS SPF: sender matches SPF record

    -0.0 RCVD_IN_MSPIKE_WL Mailspike good senders

    1.5 GR_DOMAIN_UNDISC1 To contains undisclosed recipient (undisc)

    0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

    headers

    0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in digit

    [servicelocative10(at)gmail.com]

    0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

    0.0 HTML_MESSAGE BODY: HTML included in message

    0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

    1.0 FREEMAIL_REPLYTO Reply-To/From or Reply-To/body contain different

    freemails

    2.5 FREEMAIL_FORGED_REPLYTO Freemail in Reply-To, but not From

    2.8 UNDISC_FREEM Undisclosed recipients + freemail reply-to

    Subject: {SPAM?} =?UTF-8?Q?Re=3A_Rappel_=3A_Loyer_Mai_=2D_r=C3=A9gulariser_votre_paiement?=

    =?UTF-8?Q?_=F0=9F=8F=A0?=

    Geek Squad phish from Microsoft Outlook Part 3

    Posted by Dave Yadallee on
    1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

    [209.85.221.69 listed in will-spam-for-food.eu.org]

    [209.85.221.69 listed in will-spam-for-food.eu.org]

    [209.85.221.69 listed in will-spam-for-food.eu.org]

    [209.85.221.69 listed in will-spam-for-food.eu.org]

    [209.85.221.69 listed in will-spam-for-food.eu.org]

    [209.85.221.69 listed in will-spam-for-food.eu.org]

    [209.85.221.69 listed in will-spam-for-food.eu.org]

    [209.85.221.69 listed in will-spam-for-food.eu.org]

    [2603:10b6:408:106:cafe:0:0:53 listed in]

    [will-spam-for-food.eu.org]

    [2603:10b6:408:106:cafe:0:0:53 listed in]

    [will-spam-for-food.eu.org]

    [2603:10b6:408:106:cafe:0:0:53 listed in]

    [will-spam-for-food.eu.org]

    [2603:10b6:408:106:cafe:0:0:53 listed in]

    [will-spam-for-food.eu.org]

    [2603:10b6:408:106:cafe:0:0:53 listed in]

    [will-spam-for-food.eu.org]

    [2603:10b6:408:106:cafe:0:0:53 listed in]

    [will-spam-for-food.eu.org]

    [2603:10b6:408:106:cafe:0:0:53 listed in]

    [will-spam-for-food.eu.org]

    [2603:10b6:408:106:cafe:0:0:53 listed in]

    [will-spam-for-food.eu.org]

    [2603:10b6:408:106:0:0:0:29 listed in]

    [will-spam-for-food.eu.org]

    [2603:10b6:408:106:0:0:0:29 listed in]

    [will-spam-for-food.eu.org]

    [2603:10b6:408:106:0:0:0:29 listed in]

    [will-spam-for-food.eu.org]

    [2603:10b6:408:106:0:0:0:29 listed in]

    [will-spam-for-food.eu.org]

    [2603:10b6:408:106:0:0:0:29 listed in]

    [will-spam-for-food.eu.org]

    [2603:10b6:408:106:0:0:0:29 listed in]

    [will-spam-for-food.eu.org]

    [2603:10b6:408:106:0:0:0:29 listed in]

    [will-spam-for-food.eu.org]

    [2603:10b6:408:106:0:0:0:29 listed in]

    [will-spam-for-food.eu.org]

    [40.93.20.59 listed in will-spam-for-food.eu.org]

    [40.93.20.59 listed in will-spam-for-food.eu.org]

    [40.93.20.59 listed in will-spam-for-food.eu.org]

    [40.93.20.59 listed in will-spam-for-food.eu.org]

    [40.93.20.59 listed in will-spam-for-food.eu.org]

    [40.93.20.59 listed in will-spam-for-food.eu.org]

    [40.93.20.59 listed in will-spam-for-food.eu.org]

    [40.93.20.59 listed in will-spam-for-food.eu.org]

    -0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

    trust

    [40.93.20.59 listed in list.dnswl.org]

    -2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

    safe-sa@returnpath.net

    [Excessive Number of Queries | ]

    -3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

    cert-sa@returnpath.net

    [Excessive Number of Queries | ]

    -0.0 SPF_HELO_PASS SPF: HELO matches SPF record

    -0.0 SPF_PASS SPF: sender matches SPF record

    1.0 HK_RANDOM_REPLYTO Reply-To username looks random

    1.0 HK_RANDOM_FROM From username looks random

    0.5 FROM_LOCAL_NOVOWEL From: localpart has series of non-vowel letters

    3.5 VOWEL_FROM_7 Impronouncable from header (7+ consecutive vowels)

    1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

    https://senderscore.org/blacklistlookup/

    [40.93.20.59 listed in bl.score.senderscore.com]

    -0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

    [40.93.20.59 listed in wl.mailspike.net]

    0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in digit

    [haressaznzxrrsxaxz321(at)gmail.com]

    0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider

    [haressaznzxrrsxaxz321(at)gmail.com]

    -0.0 T_RP_MATCHES_RCVD Envelope sender domain matches handover relay

    domain

    0.0 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level mail

    domains are different

    0.1 TW_RW BODY: Odd Letter Triples with RW

    0.6 MEGALONGWORD BODY: Uses really overlong words

    0.3 LONGWORD BODY: Uses overlong words

    0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

    0.0 HTML_MESSAGE BODY: HTML included in message

    0.2 FREEMAIL_FORGED_FROMDOMAIN 2nd level domains in From and EnvelopeFrom

    freemail headers are different

    0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

    2.0 RATWR8_MESSID Message-ID with excessive dashes and dollars

    0.1 TO_IN_SUBJ To address is in Subject

    3.0 LONG_INVISIBLE_TEXT Long block of hidden text - bayes poison?

    Subject: {SPAM?} =?UTF-8?Q?Pozv=C3=A1nky=3A_Geek_Squad_Renewal_Transaction_Record_=40_s?=

    =?UTF-8?Q?t_3=2E_j=C3=BAn_=2D_=C5=A1t_4=2E_j=C3=BAn_2026_=28cynthiaperez389903=40groups=2Eoutl?=

    =?UTF-8?Q?ook=2Ecom=29?=