Nigerian spam

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Sun, 21 Jun 2026 20:21:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wbUHC-0000000013Z-2WTW

for dave@doctor.nl2k.ab.ca;

Sun, 21 Jun 2026 20:20:42 -0600

Resent-From: The Doctor

Resent-Date: Sun, 21 Jun 2026 20:20:42 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from smtp1.hukvm.de ([193.201.183.163]:9127)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wbSwk-00000000DIS-04QD

for root@doctor.nl2k.ab.ca;

Sun, 21 Jun 2026 18:55:38 -0600

DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple;

d=hukvm.de; i=@hukvm.de; q=dns/txt; s=mail2;

t=1782089730; x=1813625730;

h=from:to:subject:date:message-id:mime-version;

bh=ouWN5M9Ewbinr3DwVfFv0e4qikVrKtwEOsY20ywIb2I=;

b=CAJOOg80PlKMPWE/5Wr06v/mm8uQ37pomjsHeQoQfP/tA90yNPLtKEOF

9bX7U05baFg+Tv7A7vKWQ8/I1ooHWlHhLTgOb/igB5x4TrbtnWpV8yRGw

AvcOIJLmwV6GEyL93gPDezzxRCsGtovYQiqaRk+iQi7+Ky60IflP+tXgk

o=;

X-CSE-ConnectionGUID: bjnAT2BuSXWmGw8uYLWlRw==

X-CSE-MsgGUID: +wO+zXS6Q+a1XHYaPkUOoQ==

From: "HUK Vertrauensmann Stecker, Michael"

To: "lpjobswelll@gmail.com"

Subject: Congratulations!!!

Thread-Topic: Congratulations!!!

Thread-Index: Ad0B4aovvTDlMAqKQk+1sQ1o67xE0w==

Date: Mon, 22 Jun 2026 00:54:32 +0000

Message-ID:

Accept-Language: de-DE, en-US

Content-Language: en-US

X-MS-Has-Attach:

X-MS-TNEF-Correlator:

x-originating-ip: [10.148.148.66]

Content-Type: multipart/alternative;

boundary="_000_da0c97fd456040dcaa41b2c70ae0f345hukvmde_"

MIME-Version: 1.0



--_000_da0c97fd456040dcaa41b2c70ae0f345hukvmde_

Content-Type: text/plain; charset="us-ascii"

Content-Transfer-Encoding: quoted-printable



You have been selected to receive a Grant Donation; please contact lpjobswe=

lll@gmail.com for further details and claim i=

nformation.



Please Note: We have been trying to contact you several times.



Best regards



--_000_da0c97fd456040dcaa41b2c70ae0f345hukvmde_

Content-Type: text/html; charset="us-ascii"

Content-Transfer-Encoding: quoted-printable








>


>



Congratulations!!!





You have been selected to receive a Grant Donatio=

n; please contact

lpjo=

bswelll@gmail.com for further details and=

claim information.



Please Note: We have been trying to contact you s=

everal times.



Best regards









--_000_da0c97fd456040dcaa41b2c70ae0f345hukvmde_--

Amazon Prime phish from OVH Part 2

Posted by Dave Yadallee on












Prime - Membership Update













prime









Your membership has been paused



Hello,





We were unable to charge your payment method. We've paused your Prime membership and your benefits are currently on hold.





To resume your membership, update your payment method and plan settings.





Thank you,


Customer Service






Update payment method









You expected your Prime membership to continue?





We can help you re-activate your Prime membership. Reach out to Customer Service for help.






Contact Customer Service









©2026 Prime, Inc. or its affiliates. Prime and all related marks are trademarks of Prime, Inc. or its affiliates. Mailing address: Prime ULC, 410 Terry Avenue N., Seattle, WA 98109-5210, c/o Prime Services LLC. If you have any questions and wish to contact us, click here.











Amazon Prime phish from OVH Part 1

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Sun, 21 Jun 2026 17:24:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wbRVU-000000005Yf-3D9A

for dave@doctor.nl2k.ab.ca;

Sun, 21 Jun 2026 17:23:16 -0600

Resent-From: The Doctor

Resent-Date: Sun, 21 Jun 2026 17:23:16 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from server.chroniclesnews.live ([66.116.206.87]:57488)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wbNQn-0000000017l-0DH8

for www@nl2k.ab.ca;

Sun, 21 Jun 2026 13:02:19 -0600

DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed;

d=chroniclesnews.live; s=default; h=Content-Transfer-Encoding:Content-Type:

MIME-Version:List-Unsubscribe:From:To:Reply-To:Message-Id:Subject:Date:Sender

:Cc:Content-ID:Content-Description:Resent-Date:Resent-From:Resent-Sender:

Resent-To:Resent-Cc:Resent-Message-ID:In-Reply-To:References:List-Id:

List-Help:List-Subscribe:List-Post:List-Owner:List-Archive;

bh=gVnCm19bSIvDIeo/dz6BzYKtFfjqJAd38lB80TgpQfA=; b=ZbCmG0Qo6rWaxPrHR9pON/U6XJ

Jx5N4nuKGr9krxkrbVU+HALedCZhcoqmBCs25DNDlDrT0aSPUm5l/8bFaL4ixPE0bT/9AsInvQoKX

MQnfBMKHzbSMmXztJSwaIgXFLzw4QSyDp8PuFVJQLTLa2grcw31G2+wofuHEP+mjRtL0cyu7ufGJR

dtKsZ9Z9viJajO6Zlg+nXGlIEJ3E4HD120+HrxsFOpTIIXWcc1mWRXNvHDuNFn/tnfceyN/G+5iGq

27hLinvz+9IEwYE2dmf/PJMtDz9vVlm5FYrLd3JTDheGhg8CFekUhFlFjuPrvlxNM1NgAFlVsdUc4

DYzobnqw==;

Received: from ip18.ip-192-99-159.net ([192.99.159.18]:60924 helo=vps12783)

by server.chroniclesnews.live with esmtpsa (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.99.2)

(envelope-from )

id 1wbNPp-0000000AnmK-3cqa

for www@nl2k.ab.ca;

Sun, 21 Jun 2026 13:01:10 -0600

Date: Sun, 21 Jun 2026 12:01:06 -0700

Subject: Your Prime membership has been paused [Ref: 3976C]

Message-Id: <13CCQKO7LTU4.7KN23T2LL4RW@vps12783>

Reply-To: Prime <>

To: www@nl2k.ab.ca

From: Prime

X-Mailer: Thunderbird 78.11.0

List-Unsubscribe:

MIME-Version: 1.0

Content-Type: text/html; charset=utf-8

Content-Transfer-Encoding: 8bit

X-AntiAbuse: This header was added to track abuse, please include it with any abuse report

X-AntiAbuse: Primary Hostname - server.chroniclesnews.live

X-AntiAbuse: Original Domain - nl2k.ab.ca

X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12]

X-AntiAbuse: Sender Address Domain - chroniclesnews.live

X-Get-Message-Sender-Via: server.chroniclesnews.live: authenticated_id: client@chroniclesnews.live

X-Authenticated-Sender: server.chroniclesnews.live: client@chroniclesnews.live

X-Source:

X-Source-Args:

X-Source-Dir:

X-Spam_score: 5.4

X-Spam_score_int: 54

X-Spam_bar: +++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Prime - Membership Update prime



Content analysis details: (5.4 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[192.99.159.18 listed in will-spam-for-food.eu.org]

[192.99.159.18 listed in will-spam-for-food.eu.org]

[192.99.159.18 listed in will-spam-for-food.eu.org]

[192.99.159.18 listed in will-spam-for-food.eu.org]

[192.99.159.18 listed in will-spam-for-food.eu.org]

[192.99.159.18 listed in will-spam-for-food.eu.org]

[192.99.159.18 listed in will-spam-for-food.eu.org]

[192.99.159.18 listed in will-spam-for-food.eu.org]

[66.116.206.87 listed in will-spam-for-food.eu.org]

[66.116.206.87 listed in will-spam-for-food.eu.org]

[66.116.206.87 listed in will-spam-for-food.eu.org]

[66.116.206.87 listed in will-spam-for-food.eu.org]

[66.116.206.87 listed in will-spam-for-food.eu.org]

[66.116.206.87 listed in will-spam-for-food.eu.org]

[66.116.206.87 listed in will-spam-for-food.eu.org]

[66.116.206.87 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[192.99.159.18 listed in dnsbl.ahbl.org]

[192.99.159.18 listed in dnsbl.ahbl.org]

[192.99.159.18 listed in dnsbl.ahbl.org]

[192.99.159.18 listed in dnsbl.ahbl.org]

[66.116.206.87 listed in dnsbl.ahbl.org]

[66.116.206.87 listed in dnsbl.ahbl.org]

[66.116.206.87 listed in dnsbl.ahbl.org]

[66.116.206.87 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[192.99.159.18 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[192.99.159.18 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[192.99.159.18 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[192.99.159.18 listed in dnsbl.ahbl.org]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

1.6 RCVD_IN_BRBL_LASTEXT RBL: No description available.

[66.116.206.87 listed in bb.barracudacentral.org]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[66.116.206.87 listed in bl.score.senderscore.com]

-0.0 SPF_PASS SPF: sender matches SPF record

-0.0 T_RP_MATCHES_RCVD Envelope sender domain matches handover relay

domain

1.3 URI_HEX URI: URI hostname has long hexadecimal sequence

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

Subject: {SPAM?} Your Prime membership has been paused [Ref: 3976C]

Chinese products spam

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Sun, 21 Jun 2026 12:21:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wbMm9-00000000LUt-18mS

for dave@doctor.nl2k.ab.ca;

Sun, 21 Jun 2026 12:20:09 -0600

Resent-From: The Doctor

Resent-Date: Sun, 21 Jun 2026 12:20:09 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-m81214.netease.com ([47.88.81.214]:46800)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wbKuy-000000009bQ-0Av3

for sales@nk.ca;

Sun, 21 Jun 2026 10:21:20 -0600

Content-Type: multipart/alternative; BOUNDARY="=_Part_1438358_1062877719.1782058805223"

To: sales

Reply-To: serenatam@lebaijk.com

Subject: =?UTF-8?B?Q3VzdG9tIFNob2UgU29sZSBTb2x1dGlvbnMgZm9yIEZvb3R3ZWFyIEJyYW5kcw==?=

X-Priority: 3

MIME-Version: 1.0

Received: from daisy@vexacentertrade.com( [10.139.4.149] ) by ajax-webmail ( [127.0.0.1] ) ; Mon, 22 Jun 2026 00:20:05 +0800 (GMT+08:00)

From: SerenaTam

Date: Mon, 22 Jun 2026 00:20:05 +0800 (GMT+08:00)

X-WM-Tid: 0a9eeafb67d9d0bdkusy9ad71f541ce192

DKIM-Signature: a=rsa-sha256;

b=kV8GSlJnhAlshxH4drkiBSlPKqSbSHP+nQ7LH7lqTNAcdfE1AYBfNSoEW7mN02l/exIQK+0dJWs6KWY0hH03fCbd0sIiDbls9wW3JfyDV0/B2lrgrWngobxOjWBrKEF2j4GpQ2SX086iE62wxKGnO8lMKZOCRzbda1ezLMV59EI=; c=relaxed/relaxed; s=default; d=vexacentertrade.com; v=1;

bh=lWRG7NRaDgjQiH8ebQekJZ7olMsdhmkkRW0lJnKgBZE=;

h=date:mime-version:subject:message-id:from;

Message-ID:





Hi Sales，



We specialize in custom shoe soles, including natural rubber and bio-based sole solutions for footwear brands and manufacturers.



Would you be interested in seeing some of our latest sole designs?



Reply interested if you do.





Best regards,



Maintain your product-savvy edge with . Stay Updated on News



If you prefer to exit, choose Review Communication Options.





SerenaTam

serenatam@lebaijk.com

OVH Amazon Phish from Cox Part 2

Posted by Dave Yadallee on














Prime - Membership Update













prime









Your membership has been paused



Hello,





We were unable to charge your payment method. We've paused your Prime membership and your benefits are currently on hold.





To resume your membership, update your payment method and plan settings.





Thank you,


Customer Service






Update payment method









You expected your Prime membership to continue?





We can help you re-activate your Prime membership. Reach out to Customer Service for help.






Contact Customer Service









©2026 Prime, Inc. or its affiliates. Prime and all related marks are trademarks of Prime, Inc. or its affiliates. Mailing address: Prime ULC, 410 Terry Avenue N., Seattle, WA 98109-5210, c/o Prime Services LLC. If you have any questions and wish to contact us, click here.











OVH Amazon Phish from Cox Part 1

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Sun, 21 Jun 2026 08:42:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wbJMf-00000000MEk-48k4

for dave@doctor.nl2k.ab.ca;

Sun, 21 Jun 2026 08:41:37 -0600

Resent-From: The Doctor

Resent-Date: Sun, 21 Jun 2026 08:41:37 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from wsip-72-198-249-30.tu.ok.cox.net ([72.198.249.30]:53016)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wbITj-00000000HJY-2I1Q

for www@nl2k.ab.ca;

Sun, 21 Jun 2026 07:45:01 -0600

DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed;

d=covenantfamilychurchtulsa.com; s=default; h=Content-Transfer-Encoding:

Content-Type:MIME-Version:List-Unsubscribe:From:To:Reply-To:Message-Id:

Subject:Date:Sender:Cc:Content-ID:Content-Description:Resent-Date:Resent-From

:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:In-Reply-To:References:

List-Id:List-Help:List-Subscribe:List-Post:List-Owner:List-Archive;

bh=gVnCm19bSIvDIeo/dz6BzYKtFfjqJAd38lB80TgpQfA=; b=ptwGDsjG5OFmdvuFiaYmmCRk3t

JoC3riCBwDZhY+HxY7WZHTSRKMN6Q0DP1Vr+frYj1bCmp3IRcyGTa5W6ESaOsIDtPYO1CB5pV+ojI

mgUuXeunSkeGNORta30MhI97+ocUrJm8OMJhClmmi7Obf19zYlLK7HU4IBO0fF8URhpVkEqWJRF8d

QJyJI1wTWZdECl9ykv5OFPX0WzPXe5vjmDyZW8/MycbqNq9tyyATHjNBbC7/ts3Qwqf6U4hwuqtCc

TKfIbjEWXeU/XwYi0QtcWKjCbHcSQq2GBjRtQdqgwDPTGlGqBMhd6oes8gT9L5tQfgsGI5401yrCp

hKXBbGVg==;

Received: from ip18.ip-192-99-159.net ([192.99.159.18]:60920 helo=vps12783)

by hop.hopenetsolutions.com with esmtpsa (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.99.4)

(envelope-from )

id 1wbISr-0000000CX7D-0LJ5

for www@nl2k.ab.ca;

Sun, 21 Jun 2026 08:43:57 -0500

Date: Sun, 21 Jun 2026 06:43:55 -0700

Subject: Your Prime membership has been paused [Ref: 253AA]

Message-Id: <6YDUD595LTU4.4M3FMUBFPICF2@vps12783>

Reply-To: Prime <>

To: www@nl2k.ab.ca

From: Prime

X-Mailer: Microsoft Office Outlook 15.0

List-Unsubscribe:

MIME-Version: 1.0

Content-Type: text/html; charset=utf-8

Content-Transfer-Encoding: 8bit

X-AntiAbuse: This header was added to track abuse, please include it with any abuse report

X-AntiAbuse: Primary Hostname - hop.hopenetsolutions.com

X-AntiAbuse: Original Domain - nl2k.ab.ca

X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12]

X-AntiAbuse: Sender Address Domain - covenantfamilychurchtulsa.com

X-Get-Message-Sender-Via: hop.hopenetsolutions.com: authenticated_id: hosting@covenantfamilychurchtulsa.com

X-Authenticated-Sender: hop.hopenetsolutions.com: hosting@covenantfamilychurchtulsa.com

X-Source:

X-Source-Args:

X-Source-Dir:

X-Spam_score: 9.0

X-Spam_score_int: 90

X-Spam_bar: +++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Prime - Membership Update prime



Content analysis details: (9.0 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[72.198.249.30 listed in dnsbl.ahbl.org]

[72.198.249.30 listed in dnsbl.ahbl.org]

[72.198.249.30 listed in dnsbl.ahbl.org]

[72.198.249.30 listed in dnsbl.ahbl.org]

[192.99.159.18 listed in dnsbl.ahbl.org]

[192.99.159.18 listed in dnsbl.ahbl.org]

[192.99.159.18 listed in dnsbl.ahbl.org]

[192.99.159.18 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[72.198.249.30 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[72.198.249.30 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[72.198.249.30 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[72.198.249.30 listed in dnsbl.ahbl.org]

1.6 RCVD_IN_BRBL_LASTEXT RBL: No description available.

[72.198.249.30 listed in bb.barracudacentral.org]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-0.0 SPF_PASS SPF: sender matches SPF record

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[192.99.159.18 listed in will-spam-for-food.eu.org]

[192.99.159.18 listed in will-spam-for-food.eu.org]

[192.99.159.18 listed in will-spam-for-food.eu.org]

[192.99.159.18 listed in will-spam-for-food.eu.org]

[192.99.159.18 listed in will-spam-for-food.eu.org]

[192.99.159.18 listed in will-spam-for-food.eu.org]

[192.99.159.18 listed in will-spam-for-food.eu.org]

[192.99.159.18 listed in will-spam-for-food.eu.org]

[72.198.249.30 listed in will-spam-for-food.eu.org]

[72.198.249.30 listed in will-spam-for-food.eu.org]

[72.198.249.30 listed in will-spam-for-food.eu.org]

[72.198.249.30 listed in will-spam-for-food.eu.org]

[72.198.249.30 listed in will-spam-for-food.eu.org]

[72.198.249.30 listed in will-spam-for-food.eu.org]

[72.198.249.30 listed in will-spam-for-food.eu.org]

[72.198.249.30 listed in will-spam-for-food.eu.org]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[72.198.249.30 listed in bl.score.senderscore.com]

1.3 URI_HEX URI: URI hostname has long hexadecimal sequence

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 FORGED_OUTLOOK_HTML Outlook can't send HTML message only

0.4 RDNS_DYNAMIC Delivered to internal network by host with

dynamic-looking rDNS

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

3.2 HELO_DYNAMIC_IPADDR Relay HELO'd using suspicious hostname (IP addr

1)

Subject: {SPAM?} Your Prime membership has been paused [Ref: 253AA]

Document phish from sendgrid

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Sun, 21 Jun 2026 05:32:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wbGOh-00000000LNK-2tI1

for dave@doctor.nl2k.ab.ca;

Sun, 21 Jun 2026 05:31:31 -0600

Resent-From: The Doctor

Resent-Date: Sun, 21 Jun 2026 05:31:31 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from wrqvcftr.outbound-mail.sendgrid.net ([149.72.207.117]:36028)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wbE5M-000000006ii-2qAr

for sales@nk.ca;

Sun, 21 Jun 2026 03:03:33 -0600

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=p3-i.com;

h=content-type:mime-version:from:subject:date:to:cc:content-type:date:

from:subject:to;

s=s1; t=1782032551;

bh=RRkDnOi0P2tMynw2T1RybKdX/x0KHqMvT3WgsDj6c0E=;

b=SZhOxbwJyFOPxxJzRQEaiezKmDpKj4oPuMeLQuaCjtTmir8WDhD2c/TYDzq7n13uNfKz

OmR1bMeIkvgufOEbVl3QqWlrhqLKyYFRn/osKcLUosrEi6eYGeM0wVNUXlBuQBeJ8bszQi

Y2CYCdg+6aQYtxd1MqZr/jDAMuL63YtLp6PBuINHUz33pUORB8C+G+pWD0ES7wghiHs5xn

OmxJq/FqxMG+x1x5w/O9pjW+aeATcjgCVYMp4KTc+7p3I7U5w9TTrtq5RNuQODXqBLNLKH

FIYbR8Ne7FAqPJg0ptkf8onXZXgDAmAU4gLg5NACQaq2L96kaLwyHNYr8kHcYaDA==

Received: by recvd-75586bd7d8-d4kqx with SMTP id recvd-75586bd7d8-d4kqx-1-6A37A8A7-6

2026-06-21 09:02:31.046117084 +0000 UTC m=+378627.690296285

Received: from [154.38.165.235] (unknown)

by geopod-ismtpd-25 (SG)

with ESMTP id G8LNT4TtSImDJiJN_Mo1JA

for ;

Sun, 21 Jun 2026 09:02:30.914 +0000 (UTC)

Content-Type: multipart/alternative; boundary="===============7540931904844975849=="

MIME-Version: 1.0

From: Docusend

Subject: You Have a New Secured Document

Date: Sun, 21 Jun 2026 09:02:31 +0000 (UTC)

Message-ID: <178203255046.14396.4451825813358312601@vmi2857862>

X-Mailer: Mailer-4985

X-SG-EID:

=?us-ascii?Q?u001=2Es9z3FKz3theG7asXgt6ElAca8kF7UH1zSPQkdebr12z1S4ULEooo0QM4q?=

=?us-ascii?Q?+52j8OhsDOMjRDtkxywGhq+PSF4dKdsXa=2FUYXIy?=

=?us-ascii?Q?KdF+0Y95d1mrun6=2FOwUEPGooaBBRNeH1n5xiN0O?=

=?us-ascii?Q?X=2FdKvQpQHuWMXon10DFJ5AbTvU4EK+chr0eTd9r?=

=?us-ascii?Q?RezDV6O7xrqPnIf5gIxmpYK7PcUORuSp4AQw7r1?=

=?us-ascii?Q?=2F1XpXZpMbWLgAljo14XEy8=3D?=

To: sales@nk.ca

X-Entity-ID: u001.imBUo2waVNFQ1splhTmG4A==

X-Spam_score: 39.2

X-Spam_score_int: 392

X-Spam_bar: +++++++++++++++++++++++++++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Shared Document Hello,



Content analysis details: (39.2 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[154.38.165.235 listed in will-spam-for-food.eu.org]

[154.38.165.235 listed in will-spam-for-food.eu.org]

[154.38.165.235 listed in will-spam-for-food.eu.org]

[154.38.165.235 listed in will-spam-for-food.eu.org]

[154.38.165.235 listed in will-spam-for-food.eu.org]

[154.38.165.235 listed in will-spam-for-food.eu.org]

[154.38.165.235 listed in will-spam-for-food.eu.org]

[154.38.165.235 listed in will-spam-for-food.eu.org]

[149.72.207.117 listed in will-spam-for-food.eu.org]

[149.72.207.117 listed in will-spam-for-food.eu.org]

[149.72.207.117 listed in will-spam-for-food.eu.org]

[149.72.207.117 listed in will-spam-for-food.eu.org]

[149.72.207.117 listed in will-spam-for-food.eu.org]

[149.72.207.117 listed in will-spam-for-food.eu.org]

[149.72.207.117 listed in will-spam-for-food.eu.org]

[149.72.207.117 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[149.72.207.117 listed in dnsbl.ahbl.org]

[149.72.207.117 listed in dnsbl.ahbl.org]

[149.72.207.117 listed in dnsbl.ahbl.org]

[149.72.207.117 listed in dnsbl.ahbl.org]

[154.38.165.235 listed in dnsbl.ahbl.org]

[154.38.165.235 listed in dnsbl.ahbl.org]

[154.38.165.235 listed in dnsbl.ahbl.org]

[154.38.165.235 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[149.72.207.117 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[149.72.207.117 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[149.72.207.117 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[149.72.207.117 listed in dnsbl.ahbl.org]

1.7 URIBL_CT_SURBL Contains an URL listed in the CT SURBL blocklist

[URI: u56462072.ct.sendgrid.net]

1.6 RCVD_IN_BRBL_LASTEXT RBL: No description available.

[149.72.207.117 listed in bb.barracudacentral.org]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

1.1 URIBL_GREY Contains an URL listed in the URIBL greylist

[URI: sendgrid.net]

-0.0 SPF_PASS SPF: sender matches SPF record

15 GR_DOMAIN_SENDGR1 Received contains spammer id (sendgr)

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[149.72.207.117 listed in wl.mailspike.net]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[149.72.207.117 listed in bl.score.senderscore.com]

15 GR_DOMAIN_SENDGR6 URI: Body contains known spammer URI (sendgr)

0.7 MPART_ALT_DIFF BODY: HTML and text parts are different

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 MIME_BASE64_TEXT RAW: Message text disguised using base64 encoding

0.0 MIME_HTML_ONLY_MULTI Multipart message only has text/html MIME parts

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

0.0 SARE_FROM_SPAM_WORD4 From address suggests this may be spam

1.8 COMBO_IMAGEONLY1 Appears to be an image only message

Subject: {SPAM?} You Have a New Secured Document







Hello,



A shared document has been made available for your review. Please use the secure access button below to open and view the file.







Shared Document for Review



Access the document securely using the link below.

Review Shared Document



Important



For security and confidentiality, please do not share or forward this access link unless authorized.





Thank you,

Docsend



This email was sent to notify you that a document has been shared for review.



© 2026. All rights reserved.

Instagram followers phish from Google Gmail

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Sun, 21 Jun 2026 05:30:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wbGNB-00000000H63-1PJX

for dave@doctor.nl2k.ab.ca;

Sun, 21 Jun 2026 05:29:57 -0600

Resent-From: The Doctor

Resent-Date: Sun, 21 Jun 2026 05:29:57 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-qk1-f200.google.com ([209.85.222.200]:47565)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.99.3 (FreeBSD))

(envelope-from <3yT43ag0JBXwrflfrfqnfsx3mlrfnq.htrxfqjxsp.hf@maestro.bounces.google.com>)

id 1wb72G-0000000065q-2gU8

for sales@nk.ca;

Sat, 20 Jun 2026 19:31:52 -0600

Received: by mail-qk1-f200.google.com with SMTP id af79cd13be357-915d1d4fc5aso589588685a.3

for ; Sat, 20 Jun 2026 18:30:56 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=gmail.com; s=20251104; t=1782005450; x=1782610250; darn=nk.ca;

h=content-transfer-encoding:to:from:subject:date:message-id

:mime-version:from:to:cc:subject:date:message-id:reply-to;

bh=eO3Xe5Ch1grL/sk0AQP0FLJ/o+MA7iAPZeaig3dGN4Q=;

b=ZkqIs9gEb5YC7lK/0ojnxrkQDI0bo8q79sLdswHBJm+vRCmoc50GWM990qS3vjhwIk

th/l1VYLkqfSIthTBqLeQDYVD59yDA1XBbSNfZiwvbXJYCV1gj83+EW+kZUgBz4MMFMN

HlCBuTREcUXH6iOajjzvhu1kvAATR+ufyN/FgaZmP0YYm9lDKLPyNWPWrhoAnVtb6J1e

d1opBgDZf3RSD1+ryK+kzjrI6U8QAnMCLWXr1qcw1DJ+JJk6lJrciar7hJhtgX/WaCjt

vdde1z7dO+hBTr5TnkzGOlqdm+594Nu2dljmR0M9eRV5YpCnurLGGvqQ0mQmyltdehhk

fI/w==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20251104; t=1782005450; x=1782610250;

h=content-transfer-encoding:to:from:subject:date:message-id

:mime-version:x-gm-message-state:from:to:cc:subject:date:message-id

:reply-to;

bh=eO3Xe5Ch1grL/sk0AQP0FLJ/o+MA7iAPZeaig3dGN4Q=;

b=rsxYgrq/o5QelaDjm49KM5MLEPrsdiFuVV6UY6MS6zbQAZZqvJo85ai0zoJEc23xBm

HQBcW3CPz+nXKeEJGvJA1IG8V7+sfvcuVKNGboNvw/iSKfVqKUQt/575w4acTEZ6O3Sr

z9GosnSJfxnVJ/HMMy4vM28xdVs1KfA4ubrzwQXsKwMng2mTpH/0hHn5i5aTH3XFbSym

xCROCJdu8wRosP9kBP5GG1BN815NDpcCOyZq4/VL72Sq5FXuTk6L6tn7gLUwq1No2tyO

/3lpNJOup6CbBmIx+BsS4z0e1Aoxg6N2vryewE69WPhFYEsM3G50KRHGn3/7rdNED4dT

WjAw==

X-Gm-Message-State: AOJu0Yz6/bo2m1Fq6WTaXBrjCYqODFbUPMe7Mlwm8sr555EDfC/XQQvV

SosR4eqOJZssOH1s25z7o808/uCaHMz1+42IcCbb4kUNqkpl/SAzbMthqm3iROqLk+bbDPadGpL

krPvURw==

MIME-Version: 1.0

X-Received: by 2002:a05:620a:198b:b0:918:42b4:2c9a with SMTP id

af79cd13be357-920d40386b7mr1345255285a.29.1782005449969; Sat, 20 Jun 2026

18:30:49 -0700 (PDT)

Message-ID:

Date: Sun, 21 Jun 2026 01:30:49 +0000

Subject: daveyadallee, Get More 100,000 Instagram Followers

From: magamaliansyh@gmail.com

To: sales@nk.ca

Content-Type: text/plain; charset="UTF-8"; format=flowed; delsp=yes

Content-Transfer-Encoding: base64

X-Spam_score: 5.8

X-Spam_score_int: 58

X-Spam_bar: +++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Hi, daveyadallee, Get More 100,000 Instagram Followers Sorry

to interrupt your time. We offer social media services, If you're interested,

please visit our Website. If you're not interested, please skip this step.





Content analysis details: (5.8 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[209.85.222.200 listed in will-spam-for-food.eu.org]

[209.85.222.200 listed in will-spam-for-food.eu.org]

[209.85.222.200 listed in will-spam-for-food.eu.org]

[209.85.222.200 listed in will-spam-for-food.eu.org]

[209.85.222.200 listed in will-spam-for-food.eu.org]

[209.85.222.200 listed in will-spam-for-food.eu.org]

[209.85.222.200 listed in will-spam-for-food.eu.org]

[209.85.222.200 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[209.85.222.200 listed in dnsbl.ahbl.org]

[209.85.222.200 listed in dnsbl.ahbl.org]

[209.85.222.200 listed in dnsbl.ahbl.org]

[209.85.222.200 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[209.85.222.200 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[209.85.222.200 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[209.85.222.200 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[209.85.222.200 listed in dnsbl.ahbl.org]

2.5 URIBL_DBL_PHISH Contains a Phishing URL listed in the DBL blocklist

[URI: instatool.site]

-0.0 SPF_PASS SPF: sender matches SPF record

-0.0 T_RP_MATCHES_RCVD Envelope sender domain matches handover relay

domain

0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider

[magamaliansyh(at)gmail.com]

0.0 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level mail

domains are different

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[209.85.222.200 listed in wl.mailspike.net]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[209.85.222.200 listed in bl.score.senderscore.com]

0.2 FREEMAIL_FORGED_FROMDOMAIN 2nd level domains in From and EnvelopeFrom

freemail headers are different

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

2.0 RATWR8_MESSID Message-ID with excessive dashes and dollars

Subject: {SPAM?} daveyadallee, Get More 100,000 Instagram Followers



Hi, daveyadallee, Get More 100,000 Instagram Followers

Sorry to interrupt your time.



We offer social media services,

If you're interested, please visit our Website.

If you're not interested, please skip this step.



We will help you increase your social media presence to another level.

( Threads, Instagram, Twitter, Youtube, Facebook, etc. )



Are you interested in a free trial ?

Special For You Bonus Extra $2 - $5 FREE BALANCE TODAY SIGNUP NOW..!!!

GET 100K Followers Instagram NOW !!!

Order here :



[ https://instatool.site/store/free/?daveyadallee ]





Take free trial service today only...!!

10 -101K Instagram Followers



- Instant Start

- Safest Methods

- Privacy Protection

- Speed 200K Followers/day

- High Quality Followers

- Drop-Back Guarantee

- Trusted Seller testimony

- Starting get 100K Followers Instagram

- Guaranteed to be the cheapest



Thank you,

Regards,



Copyright © 2014 - 2026 instatool.site

Nigerian Compensation spam from Google Gmail Part 2

Posted by Dave Yadallee on
--000000000000012f4e0654b4a67c

Content-Type: text/plain; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable



Subject: Midland Financial Recovery Bureau =E2=80=93 Victim Compensation Pr=

ogram

Compensation Award: USD $1,500,000.00

Reference ID: MF1122-CRX00491

Address: 8600 Westfield Avenue, Suite 210, Houston, TX 77040, USA



Dear Recipient,



We are contacting you as a listed beneficiary in a federally supported

restitution initiative established to compensate victims of financial

fraud. This action follows the prosecution and sentencing of

individuals=E2=80=94namely Andrew Collins, Eric Mateo, and Linda Frost=E2=

=80=94who were

recently convicted of operating fraudulent schemes while posing as

representatives of financial and government institutions.



As part of the outcome, the Midland Financial Recovery Bureau, in

collaboration with U.S. regulatory authorities, has approved a compensation

payment of USD $1,500,000.00 to be issued in your name. Disbursement will

be made through a secure ATM-enabled payment card, and all standard

transaction and delivery costs will be covered by the issuing entity.



To confirm your eligibility and initiate the processing of your payment,

please provide the following information for verification and compliance

review:



Full Legal Name



Residential Mailing Address



Current Occupation



Active Contact Number



Government-Issued Photo Identification (valid)



Please be advised that a nominal Processing and Verification Fee will be

required to complete the official endorsement and release of funds. There

will be no additional fees once this has been fulfilled.



This compensation program is part of a broader effort to assist fraud

victims and reinforce public confidence in financial institutions.



Sincerely,

Mr. Thomas E. Ralston

Director, Compensation Oversight Division

Midland Financial Recovery Bureau



--000000000000012f4e0654b4a67c

Content-Type: text/html; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable





=3D"gmail_signature" data-smartmail=3D"gmail_signature">

iv>Subject: Midland Financial Recovery Bureau =E2=80=93 Victim Compensation=

Program
Compensation Award: USD $1,500,000.00
Referenc=

e ID: MF1122-CRX00491
Address: 8600 Westfield Avenue, Suite 210, =

Houston, TX 77040, USA

Dear Recipient,
<=

br>
We are contacting you as a listed beneficiary in a federally =

supported restitution initiative established to compensate victims of finan=

cial fraud. This action follows the prosecution and sentencing of individua=

ls=E2=80=94namely Andrew Collins, Eric Mateo, and Linda Frost=E2=80=94who w=

ere recently convicted of operating fraudulent schemes while posing as repr=

esentatives of financial and government institutions.

<=

div>As part of the outcome, the Midland Financial Recovery Bureau, in colla=

boration with U.S. regulatory authorities, has approved a compensation paym=

ent of USD $1,500,000.00 to be issued in your name. Disbursement will be ma=

de through a secure ATM-enabled payment card, and all standard transaction =

and delivery costs will be covered by the issuing entity.


iv>
To confirm your eligibility and initiate the processing of your pay=

ment, please provide the following information for verification and complia=

nce review:

Full Legal Name


iv>Residential Mailing Address

Current Occupation<=

/div>

Active Contact Number

Gov=

ernment-Issued Photo Identification (valid)

Please=

be advised that a nominal Processing and Verification Fee will be required=

to complete the official endorsement and release of funds. There will be n=

o additional fees once this has been fulfilled.

Th=

is compensation program is part of a broader effort to assist fraud victims=

and reinforce public confidence in financial institutions.

<=

/div>
Sincerely,
Mr. Thomas E. Ralston
Director, Co=

mpensation Oversight Division
Midland Financial Recovery Bureau
div>




--000000000000012f4e0654b4a67c--

Nigerian compensation spam from Google Gmail Part 1

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Sat, 20 Jun 2026 14:07:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wb1xy-00000000OMi-3RWC

for dave@doctor.nl2k.ab.ca;

Sat, 20 Jun 2026 14:06:58 -0600

Resent-From: The Doctor

Resent-Date: Sat, 20 Jun 2026 14:06:58 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-lf1-f67.google.com ([209.85.167.67]:47532)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wb1ln-00000000Mqq-3dFq

for doctor@doctor.nl2k.ab.ca;

Sat, 20 Jun 2026 13:54:33 -0600

Received: by mail-lf1-f67.google.com with SMTP id 2adb3069b0e04-5aa5edf347eso2202818e87.3

for ; Sat, 20 Jun 2026 12:53:37 -0700 (PDT)

ARC-Seal: i=1; a=rsa-sha256; t=1781985211; cv=none;

d=google.com; s=arc-20240605;

b=FqFdqQ7naVc89QXMrfy25hrzOg776Sl7/1TJMuylWB72yP1z2b0moeZuLVILvOEfoo

+LElJ+VJcUN1UC4fktJPwTkfUuDt6Yf3W1SW8P0i7mbH9kFrKVu31h5RfYC/eLiXr06i

AO29SW0D5jeo8EoUtWO8rkZefLZtYONSCUDR/N6Ab2i0aihgxwDEr+nlRF3CIHNaywVI

E6+rIEdsaEnNlcm/QNkdfUPQRnDWkDLbH5rq1/xGve6gm+9saEs42H/2kEy0+3HHfBWM

PATipgAKC3WfaFll3wWHK4K/svpnBtwDJQ3MgnJ87sYpkxzwFTF6+kwwugszXGbw5F/a

S/MQ==

ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20240605;

h=to:subject:message-id:date:from:reply-to:mime-version

:dkim-signature;

bh=em15lI1mKGVSJdQKVfxc2yi8Xza15rcXvqiJNGJzY8s=;

fh=lLH90XBES8EHzIqFf9luySOCy4F32zJMq6DiT4mnFsY=;

b=WtswqaPUdmL8tOt7L0MCHvj/OLb9rPMLty6ZPh7XizRvF2ZGZ7kO5hGjB7lbUOnDuS

s+5UE+3o6zIzpDQca9tvRlAREoFys6Sc+kWH7RuWnIrp6m7YOiGEyMIQayXr3U2I/WnK

/mIvvhMJIrxg48QQjcfGnIAaVg2ejcXKfKL3evWnNpoVXRkyzuBTEX6zPKhdHaC5bhED

B4U9YOgRM0iB2tXWXwYxLV6eD9ys9kf8dfzUe+stTekjzspYzjIe/weXquxQoxpprTaB

6sTcQVbbm6dHJjzdKM1LnKbU1FPKJrPVDKH4IYZ9VD3TLjSVP3dcK9awkIKOzv5T8QsE

YaZA==;

darn=doctor.nl2k.ab.ca

ARC-Authentication-Results: i=1; mx.google.com; arc=none

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=gmail.com; s=20251104; t=1781985211; x=1782590011; darn=doctor.nl2k.ab.ca;

h=to:subject:message-id:date:from:reply-to:mime-version:from:to:cc

:subject:date:message-id:reply-to;

bh=em15lI1mKGVSJdQKVfxc2yi8Xza15rcXvqiJNGJzY8s=;

b=rCXemlQC4s2xN/0CPlJ7R/UI8lB1KNtsjtm9KIO1Xv9iZcoB0Y2qxlJxQxMcKeEVHP

xzDbgZ5MjS+fEu5D/b5F4JAft109r3RZk3Q70K0EJbzZuFhrbSgY6eMN+p0qIE7Uk5Md

6jeZcWlgUEUFRukdZEv5/gZnd7xo52jOixh/aTyWmcJ/rqBz87l7qw1NH3buWCb+m5rW

JWavy59TmbeHqRGW6A9HBX9Kj/EYALApDWYVWVKTi/o07sDYcJYr1+fMZbPN/imzXNzv

INF9WOK8YDGENshZ8nt1rV432bBybjTJpXbCPCoCQCFBpvF178r8Z3UB+7+E026cy21W

5cTw==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20251104; t=1781985211; x=1782590011;

h=to:subject:message-id:date:from:reply-to:mime-version:x-gm-gg

:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to;

bh=em15lI1mKGVSJdQKVfxc2yi8Xza15rcXvqiJNGJzY8s=;

b=Eequat+TJjahUhxJaHReDUIiBIHlW+Mu9z29245CyufPDhXIJTq7wc3v/p36MS/+lc

Pc/jRGXgJcEljgaiTErYkaXzDKRgzai5OxDwo4v4f+sQ8PBjYFflhkmfI3EDv8sePf0a

eZKh2OvxJOQIFlzN2zfgZnU3YX/cBf9fJgB1aLIGlzpzvl6Gnx+/5kQDsB36X1t4KZfG

tFmJCVY997ppUf3vpqCImajFC9jRLpAFZ5I5egG1ow7LlJSaLHhFcoD4ENlhFmeDN3iv

yBf6K4+4tkkX5YNrepe8gmpMcQWIg2y8HDfIre3TxaGTwWP5A0c2+TKksIrKYBYxfo78

+fxg==

X-Forwarded-Encrypted: i=1; AFNElJ/puNU8uD8Kk4McoPHwOA6VJrS6ME57hfch+Felhywf/DkzlIPrcofWBIO6dTJc6HyKJOKpYvU=@doctor.nl2k.ab.ca

X-Gm-Message-State: AOJu0YyIjuFCR0p/pOpJ1ixwpfGqhzd70WqVVx5g2Dkfv9zRBy+If5fA

LTeicDQRdcOGW3ylZGRVSXSf2TM2Ykv/jH1QTgghxTyzoY6ZxqBRrShe0C2uc0XTp+zpiI2KmII

TpPNjrXHTdYeSTpVNnrmv266rX3j9XYA=

X-Gm-Gg: AfdE7ckHe7//fV08lnn8J2vPf2vOpqfouHq3pRYMS7/Jqc66dALglW/Qg/yxmKPPA+k

ttCg7BmA5lAtCVTB3fadCoUN8xwjsK8FTXcDeNlPCm/JwkAfWX4FuUx9AUAY6oTYsfAavx8HTwH

aOWQU5KwhYAPi4vRSIDH+KWrmrlmhKBN7lFFUM3oVfXk3rIL+GFXmawtrhMSEBSxmj7TZejoD5b

ebbGQD2+FHikamQfBJmuE2OyANWWkN+Gs9NELAWX7D/oxJvRXKVnzdeNq9/fvaQvYaRfgh9ag==

X-Received: by 2002:a2e:a9a5:0:b0:396:9966:50cf with SMTP id

38308e7fff4ca-3998e4092d7mr16710201fa.9.1781984716204; Sat, 20 Jun 2026

12:45:16 -0700 (PDT)

MIME-Version: 1.0

Reply-To: citibank.co.usa@gmail.com

From: Michael Corbat

Date: Sat, 20 Jun 2026 12:44:41 -0700

X-Gm-Features: AVVi8Cee6rCzcsUfU88IFtFAIMaK7YU6-UAmDxNctI4bo92nl-eibb70H8m3-qc

Message-ID:

Subject: Compensation Award

To: undisclosed-recipients:;

Content-Type: multipart/alternative; boundary="000000000000012f4e0654b4a67c"

Bcc: doctor@doctor.nl2k.ab.ca

X-Spam_score: 16.4

X-Spam_score_int: 164

X-Spam_bar: ++++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Subject: Midland Financial Recovery Bureau – Victim Compensation

Program Compensation Award: USD $1,500,000.00 Reference ID: MF1122-CRX00491

Address: 8600 Westfield Avenue, Suite 210, Houston, TX 77 [...]



Content analysis details: (16.4 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[209.85.167.67 listed in will-spam-for-food.eu.org]

[209.85.167.67 listed in will-spam-for-food.eu.org]

[209.85.167.67 listed in will-spam-for-food.eu.org]

[209.85.167.67 listed in will-spam-for-food.eu.org]

[209.85.167.67 listed in will-spam-for-food.eu.org]

[209.85.167.67 listed in will-spam-for-food.eu.org]

[209.85.167.67 listed in will-spam-for-food.eu.org]

[209.85.167.67 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[209.85.167.67 listed in dnsbl.ahbl.org]

[209.85.167.67 listed in dnsbl.ahbl.org]

[209.85.167.67 listed in dnsbl.ahbl.org]

[209.85.167.67 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[209.85.167.67 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[209.85.167.67 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[209.85.167.67 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[209.85.167.67 listed in dnsbl.ahbl.org]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[209.85.167.67 listed in list.dnswl.org]

-0.0 SPF_PASS SPF: sender matches SPF record

1.5 GR_DOMAIN_UNDISC1 To contains undisclosed recipient (undisc)

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider

[jeegael37(at)gmail.com]

1.0 FORGED_GMAIL_RCVD 'From' gmail.com does not match 'Received' headers

0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends in

digit

[jeegael37(at)gmail.com]

2.5 US_DOLLARS_3 BODY: Mentions millions of $ ($NN,NNN,NNN.NN)

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[209.85.167.67 listed in bl.score.senderscore.com]

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[209.85.167.67 listed in wl.mailspike.net]

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 LOTS_OF_MONEY Huge... sums of money

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

1.0 FREEMAIL_REPLYTO Reply-To/From or Reply-To/body contain different

freemails

2.8 UNDISC_FREEM Undisclosed recipients + freemail reply-to

0.0 MONEY_FREEMAIL_REPTO Lots of money from someone using free email?

0.0 T_FILL_THIS_FORM_SHORT Fill in a short form with personal information

0.4 FILL_THIS_FORM_FRAUD_PHISH Answer suspicious question(s)

0.0 T_FILL_THIS_FORM_FRAUD_PHISH Answer suspicious question(s)

1.3 MONEY_FORM_SHORT Lots of money if you fill out a short form

0.0 MONEY_FRAUD_5 Lots of money and many fraud phrases

0.0 FORM_FRAUD_5 Fill a form and many fraud phrases

2.6 UNDISC_MONEY Undisclosed recipients + money/fraud signs

2.0 ADVANCE_FEE_2_NEW_MONEY Advance Fee fraud and lots of money

Subject: {SPAM?} Compensation Award

Nigerian compensation spam from Google Gmail Part 2

Posted by Dave Yadallee on
--000000000000012f4e0654b4a67c

Content-Type: text/plain; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable



Subject: Midland Financial Recovery Bureau =E2=80=93 Victim Compensation Pr=

ogram

Compensation Award: USD $1,500,000.00

Reference ID: MF1122-CRX00491

Address: 8600 Westfield Avenue, Suite 210, Houston, TX 77040, USA



Dear Recipient,



We are contacting you as a listed beneficiary in a federally supported

restitution initiative established to compensate victims of financial

fraud. This action follows the prosecution and sentencing of

individuals=E2=80=94namely Andrew Collins, Eric Mateo, and Linda Frost=E2=

=80=94who were

recently convicted of operating fraudulent schemes while posing as

representatives of financial and government institutions.



As part of the outcome, the Midland Financial Recovery Bureau, in

collaboration with U.S. regulatory authorities, has approved a compensation

payment of USD $1,500,000.00 to be issued in your name. Disbursement will

be made through a secure ATM-enabled payment card, and all standard

transaction and delivery costs will be covered by the issuing entity.



To confirm your eligibility and initiate the processing of your payment,

please provide the following information for verification and compliance

review:



Full Legal Name



Residential Mailing Address



Current Occupation



Active Contact Number



Government-Issued Photo Identification (valid)



Please be advised that a nominal Processing and Verification Fee will be

required to complete the official endorsement and release of funds. There

will be no additional fees once this has been fulfilled.



This compensation program is part of a broader effort to assist fraud

victims and reinforce public confidence in financial institutions.



Sincerely,

Mr. Thomas E. Ralston

Director, Compensation Oversight Division

Midland Financial Recovery Bureau



--000000000000012f4e0654b4a67c

Content-Type: text/html; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable





=3D"gmail_signature" data-smartmail=3D"gmail_signature">

iv>Subject: Midland Financial Recovery Bureau =E2=80=93 Victim Compensation=

Program
Compensation Award: USD $1,500,000.00
Referenc=

e ID: MF1122-CRX00491
Address: 8600 Westfield Avenue, Suite 210, =

Houston, TX 77040, USA

Dear Recipient,
<=

br>
We are contacting you as a listed beneficiary in a federally =

supported restitution initiative established to compensate victims of finan=

cial fraud. This action follows the prosecution and sentencing of individua=

ls=E2=80=94namely Andrew Collins, Eric Mateo, and Linda Frost=E2=80=94who w=

ere recently convicted of operating fraudulent schemes while posing as repr=

esentatives of financial and government institutions.

<=

div>As part of the outcome, the Midland Financial Recovery Bureau, in colla=

boration with U.S. regulatory authorities, has approved a compensation paym=

ent of USD $1,500,000.00 to be issued in your name. Disbursement will be ma=

de through a secure ATM-enabled payment card, and all standard transaction =

and delivery costs will be covered by the issuing entity.


iv>
To confirm your eligibility and initiate the processing of your pay=

ment, please provide the following information for verification and complia=

nce review:

Full Legal Name


iv>Residential Mailing Address

Current Occupation<=

/div>

Active Contact Number

Gov=

ernment-Issued Photo Identification (valid)

Please=

be advised that a nominal Processing and Verification Fee will be required=

to complete the official endorsement and release of funds. There will be n=

o additional fees once this has been fulfilled.

Th=

is compensation program is part of a broader effort to assist fraud victims=

and reinforce public confidence in financial institutions.

<=

/div>
Sincerely,
Mr. Thomas E. Ralston
Director, Co=

mpensation Oversight Division
Midland Financial Recovery Bureau
div>




--000000000000012f4e0654b4a67c--

Nigerian compensation spam from Google Gmail Part 1

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Sat, 20 Jun 2026 14:07:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wb1xv-00000000OMF-1FBX

for dave@doctor.nl2k.ab.ca;

Sat, 20 Jun 2026 14:06:55 -0600

Resent-From: The Doctor

Resent-Date: Sat, 20 Jun 2026 14:06:55 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-lf1-f68.google.com ([209.85.167.68]:46082)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wb1l6-00000000MoU-2UDL

for doctor@nl2k.ab.ca;

Sat, 20 Jun 2026 13:53:49 -0600

Received: by mail-lf1-f68.google.com with SMTP id 2adb3069b0e04-5aa61e3d3f3so3199762e87.0

for ; Sat, 20 Jun 2026 12:52:53 -0700 (PDT)

ARC-Seal: i=1; a=rsa-sha256; t=1781985167; cv=none;

d=google.com; s=arc-20240605;

b=O8OxZ3F1zRGk4FCVxp8fJPAMV9dz8mD2SQ0UmSHvxCrk1otvdsMH3yOPCj6gjJZkLn

JI5kG0kVGJ5HqyihWKCvR1eIMgWuELOnD+VQ0SXTGKpwuv96K+rW/eNATGWdH+tHLKm6

bx5S0c9/QFbe4tt43JXAdv/OjcK73rtVvy5Md6DflZexNLZxosHTjSX5MHDUAkgAWuNO

WljV9ybZve6RhSt4pvzs/c1OefxiLGZFYhW5hsZf9jnU1zYBoQohWT4qe77aGhsZP5fp

qTLFI5v0Gh2VP8RgMO97On8S/Ln0nSgM4B52JuzqTWemL1X+8ZyLFq9zmtniGzWfxmUm

cXkA==

ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20240605;

h=to:subject:message-id:date:from:reply-to:mime-version

:dkim-signature;

bh=em15lI1mKGVSJdQKVfxc2yi8Xza15rcXvqiJNGJzY8s=;

fh=orJp/q+dnqXd0NVruQJu/MGd1eiLPBDdRK99mjGHmPU=;

b=TjD3w0Gf1nNQj5txJEDu0OgVmYY+I4/SWXxcb8lO3omdkBkMWezEOxSJWSsUJLg4N2

zqoed9diUmgG7MW3XQC2opo14BetV5gQuBa0z1ntah+jql0xrjMWJaowHdUK+2CnLyFz

cBLptHdiGY1AIac9HrMHmjcrRZVVadvyKOEjH5Qt1rZs+Y6bPSWByb1e3MeGJc3fxqK4

Vt5e9bS1XVyOMIk4kmUTV/xBIo1nOPCfG3a2w29ANRO+HWWgNRIa6VbNWwmNbBCycVmY

+KaYn3Wv9oTgVooR3h/i9UXKmXy2jeOEeu07LsCTkGPDoiBFTqFlPqU/k4dwX2+e2Bwx

ONmg==;

darn=nl2k.ab.ca

ARC-Authentication-Results: i=1; mx.google.com; arc=none

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=gmail.com; s=20251104; t=1781985167; x=1782589967; darn=nl2k.ab.ca;

h=to:subject:message-id:date:from:reply-to:mime-version:from:to:cc

:subject:date:message-id:reply-to;

bh=em15lI1mKGVSJdQKVfxc2yi8Xza15rcXvqiJNGJzY8s=;

b=SIrP388Mo0eU6ugRRtSbh82EiAznjdkZG2q0EnTNk/ceBaVrp9xrPB3AD+TUIr4QYL

6qUNj648kAOwI+EEoJabQ/gAC6UlDiedQ4rAzB+MQl16TLFmHTJTPLa4cXHL3UjGEn81

CRXxErsrPtS9dIv/uHX3Q+ob60TQr/crcwW6JSagQ/zM5zOUlW9WkHg4BAIupmURwtIS

XeO0etrrT3t2MTB3TJ2V5sJKrc1+EJGejqE+VUllW5Mt8XApHSYrI1TlsyfWgVgXdPgh

TJxemyYumaRJyutgKHmpdejSQT0Vvv0pdUYg4HnITWBr3rKjFfl3WMto+8vXj37UM0+Q

KgRA==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20251104; t=1781985167; x=1782589967;

h=to:subject:message-id:date:from:reply-to:mime-version:x-gm-gg

:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to;

bh=em15lI1mKGVSJdQKVfxc2yi8Xza15rcXvqiJNGJzY8s=;

b=Ru2qu+qMXT81Jy/DQL61lPyWSoX/xm1uXKtflGaLOYZeBNwGnSzCLD8oNGfqlEQo0H

vABBlUE2tLaqnuD4lbLnzIEjLQWCwfQtKfQ75zw8mnphUE2sL04Hv5rUzf+TyO/3ROUD

xal5++FBDHTeTkkXyA4NvarpHv3QzteI2Cm8X1rX+lnYr3b3kSSAYHDOxr00grxdjq0G

PhBAJsDc6Jw8+cxhnmpedmnEBuAl/cjH/EUbiciMURatiZ4TubfiLX/8MTB44vLU1LfB

PSRzOPh4q8MUGgqZ3IO23Ht3jNKrkIjBTudRqCDJHpBRmAOqdLde26XDa/pb3xrmUNWW

fmIQ==

X-Forwarded-Encrypted: i=1; AFNElJ9SzlNSTSGOT7NvVtIn9rz75ViNxgz6Ho9k/3fg3KIJYFy7li4upAiMaLjnLKJIa0DoOZVmTk8=@nl2k.ab.ca

X-Gm-Message-State: AOJu0Yy6vM5NJBJaWYs0hRq7YCD/v1nmlrbWSc2GufAiL1AV8hjklCSv

4RVtPQ3RooGz6PTR1t/r95WTYFT3hN0N4W72whtuMnICmjkQw/DZqsvD6uixRmXw8P9f0kuEsWs

14TfgFxWyt4dqMEEAoZ7SKXOvzSji578=

X-Gm-Gg: AfdE7cl7GRDwcLUB6kZSzFy2W/qUNb05nh7wSRfuMVo3CRek9SM0oY1SgWfuTiTW9q8

hLRrnWTZHcnJGvFTJ26y44RFva/QrF6OfPVLm17L0U3ysnQ/3oMNHwOw93s0pBOmlBfJpk35WWE

FbnHWUN39HB7sXakFpJolvRNyy9C52WV9TaKkymJcUr9WdOBfIZUjJgwDB1OcGMUuyskpD6jiSI

m0vca4/I7jk+oJfFMOjlj2HTvG9p0/2ebViPy/yiZjYMaViOaTRHvmKyh7kN1DtfHIsD8MUf5Qc

hph+T8GT

X-Received: by 2002:a2e:a9a5:0:b0:396:9966:50cf with SMTP id

38308e7fff4ca-3998e4092d7mr16710201fa.9.1781984716204; Sat, 20 Jun 2026

12:45:16 -0700 (PDT)

MIME-Version: 1.0

Reply-To: citibank.co.usa@gmail.com

From: Michael Corbat

Date: Sat, 20 Jun 2026 12:44:41 -0700

X-Gm-Features: AVVi8Cee6rCzcsUfU88IFtFAIMaK7YU6-UAmDxNctI4bo92nl-eibb70H8m3-qc

Message-ID:

Subject: Compensation Award

To: undisclosed-recipients:;

Content-Type: multipart/alternative; boundary="000000000000012f4e0654b4a67c"

Bcc: doctor@nl2k.ab.ca

X-Spam_score: 16.4

X-Spam_score_int: 164

X-Spam_bar: ++++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Subject: Midland Financial Recovery Bureau – Victim Compensation

Program Compensation Award: USD $1,500,000.00 Reference ID: MF1122-CRX00491

Address: 8600 Westfield Avenue, Suite 210, Houston, TX 77 [...]



Content analysis details: (16.4 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[209.85.167.68 listed in will-spam-for-food.eu.org]

[209.85.167.68 listed in will-spam-for-food.eu.org]

[209.85.167.68 listed in will-spam-for-food.eu.org]

[209.85.167.68 listed in will-spam-for-food.eu.org]

[209.85.167.68 listed in will-spam-for-food.eu.org]

[209.85.167.68 listed in will-spam-for-food.eu.org]

[209.85.167.68 listed in will-spam-for-food.eu.org]

[209.85.167.68 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[209.85.167.68 listed in dnsbl.ahbl.org]

[209.85.167.68 listed in dnsbl.ahbl.org]

[209.85.167.68 listed in dnsbl.ahbl.org]

[209.85.167.68 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[209.85.167.68 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[209.85.167.68 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[209.85.167.68 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[209.85.167.68 listed in dnsbl.ahbl.org]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[209.85.167.68 listed in list.dnswl.org]

-0.0 SPF_PASS SPF: sender matches SPF record

1.5 GR_DOMAIN_UNDISC1 To contains undisclosed recipient (undisc)

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider

[jeegael37(at)gmail.com]

1.0 FORGED_GMAIL_RCVD 'From' gmail.com does not match 'Received' headers

0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends in

digit

[jeegael37(at)gmail.com]

2.5 US_DOLLARS_3 BODY: Mentions millions of $ ($NN,NNN,NNN.NN)

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[209.85.167.68 listed in bl.score.senderscore.com]

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[209.85.167.68 listed in wl.mailspike.net]

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

0.0 LOTS_OF_MONEY Huge... sums of money

0.0 T_FILL_THIS_FORM_SHORT Fill in a short form with personal information

1.0 FREEMAIL_REPLYTO Reply-To/From or Reply-To/body contain different

freemails

2.8 UNDISC_FREEM Undisclosed recipients + freemail reply-to

0.0 MONEY_FREEMAIL_REPTO Lots of money from someone using free email?

0.0 MONEY_FRAUD_5 Lots of money and many fraud phrases

0.4 FILL_THIS_FORM_FRAUD_PHISH Answer suspicious question(s)

0.0 T_FILL_THIS_FORM_FRAUD_PHISH Answer suspicious question(s)

2.6 UNDISC_MONEY Undisclosed recipients + money/fraud signs

1.3 MONEY_FORM_SHORT Lots of money if you fill out a short form

0.0 FORM_FRAUD_5 Fill a form and many fraud phrases

2.0 ADVANCE_FEE_2_NEW_MONEY Advance Fee fraud and lots of money

Subject: {SPAM?} Compensation Award

Nigerian compensation spam from Google Gmail Part 2

Posted by Dave Yadallee on
--000000000000012f4e0654b4a67c

Content-Type: text/plain; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable



Subject: Midland Financial Recovery Bureau =E2=80=93 Victim Compensation Pr=

ogram

Compensation Award: USD $1,500,000.00

Reference ID: MF1122-CRX00491

Address: 8600 Westfield Avenue, Suite 210, Houston, TX 77040, USA



Dear Recipient,



We are contacting you as a listed beneficiary in a federally supported

restitution initiative established to compensate victims of financial

fraud. This action follows the prosecution and sentencing of

individuals=E2=80=94namely Andrew Collins, Eric Mateo, and Linda Frost=E2=

=80=94who were

recently convicted of operating fraudulent schemes while posing as

representatives of financial and government institutions.



As part of the outcome, the Midland Financial Recovery Bureau, in

collaboration with U.S. regulatory authorities, has approved a compensation

payment of USD $1,500,000.00 to be issued in your name. Disbursement will

be made through a secure ATM-enabled payment card, and all standard

transaction and delivery costs will be covered by the issuing entity.



To confirm your eligibility and initiate the processing of your payment,

please provide the following information for verification and compliance

review:



Full Legal Name



Residential Mailing Address



Current Occupation



Active Contact Number



Government-Issued Photo Identification (valid)



Please be advised that a nominal Processing and Verification Fee will be

required to complete the official endorsement and release of funds. There

will be no additional fees once this has been fulfilled.



This compensation program is part of a broader effort to assist fraud

victims and reinforce public confidence in financial institutions.



Sincerely,

Mr. Thomas E. Ralston

Director, Compensation Oversight Division

Midland Financial Recovery Bureau



--000000000000012f4e0654b4a67c

Content-Type: text/html; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable





=3D"gmail_signature" data-smartmail=3D"gmail_signature">

iv>Subject: Midland Financial Recovery Bureau =E2=80=93 Victim Compensation=

Program
Compensation Award: USD $1,500,000.00
Referenc=

e ID: MF1122-CRX00491
Address: 8600 Westfield Avenue, Suite 210, =

Houston, TX 77040, USA

Dear Recipient,
<=

br>
We are contacting you as a listed beneficiary in a federally =

supported restitution initiative established to compensate victims of finan=

cial fraud. This action follows the prosecution and sentencing of individua=

ls=E2=80=94namely Andrew Collins, Eric Mateo, and Linda Frost=E2=80=94who w=

ere recently convicted of operating fraudulent schemes while posing as repr=

esentatives of financial and government institutions.

<=

div>As part of the outcome, the Midland Financial Recovery Bureau, in colla=

boration with U.S. regulatory authorities, has approved a compensation paym=

ent of USD $1,500,000.00 to be issued in your name. Disbursement will be ma=

de through a secure ATM-enabled payment card, and all standard transaction =

and delivery costs will be covered by the issuing entity.


iv>
To confirm your eligibility and initiate the processing of your pay=

ment, please provide the following information for verification and complia=

nce review:

Full Legal Name


iv>Residential Mailing Address

Current Occupation<=

/div>

Active Contact Number

Gov=

ernment-Issued Photo Identification (valid)

Please=

be advised that a nominal Processing and Verification Fee will be required=

to complete the official endorsement and release of funds. There will be n=

o additional fees once this has been fulfilled.

Th=

is compensation program is part of a broader effort to assist fraud victims=

and reinforce public confidence in financial institutions.

<=

/div>
Sincerely,
Mr. Thomas E. Ralston
Director, Co=

mpensation Oversight Division
Midland Financial Recovery Bureau
div>




--000000000000012f4e0654b4a67c--

Nigerian compensation spam from Google Gmail Part 1

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Sat, 20 Jun 2026 14:07:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wb1xn-00000000OKs-0H9n

for dave@doctor.nl2k.ab.ca;

Sat, 20 Jun 2026 14:06:47 -0600

Resent-From: The Doctor

Resent-Date: Sat, 20 Jun 2026 14:06:46 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-lf1-f67.google.com ([209.85.167.67]:46510)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wb1k6-00000000Mgj-2Z3k

for doctor@nl2k.ca;

Sat, 20 Jun 2026 13:52:47 -0600

Received: by mail-lf1-f67.google.com with SMTP id 2adb3069b0e04-5aa7a7ad475so3538427e87.1

for ; Sat, 20 Jun 2026 12:51:51 -0700 (PDT)

ARC-Seal: i=1; a=rsa-sha256; t=1781985104; cv=none;

d=google.com; s=arc-20240605;

b=OMZEP8OkxeJCecAdXhyNiNUCJ8oxNVhPhmlEEqOhaiy9KdZ8jZxIffJx1L1mhO0zlS

kW3b9MP3zUgY+DuJH/fCIWh/hQUD9dkax8qDs1ceD6MHBYEPxymbZNIsL20q1qkcpXhV

fBjd4fxf+Ap588EsD0MeZ7K1WMKTjBmLCgpsI2zzJPsQGWeCnZlJg39AxGP4+QZEoja4

TvQMmsJ/jVORy8lkNOdeRKugnMpTQiwcRga3gnSeX4YW/6570zJtZafceDyzdNwDM63z

eBkuK9NwtG8JN6XWDKNGJ1T/EW3QFkIwJKW/OcDbyuhL+s7Fs8CvpmXd7HS6IixUk7lI

c0aQ==

ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20240605;

h=to:subject:message-id:date:from:reply-to:mime-version

:dkim-signature;

bh=em15lI1mKGVSJdQKVfxc2yi8Xza15rcXvqiJNGJzY8s=;

fh=RW2ZSSgvfk59hEzSy6zADBunmMvzuXd8ZQ4mh1Sqbj4=;

b=fYnrnrNtZ2gbh61njLuX1awm/SWeSkNhfil8b8vJkEYGf3yBR6ZSMHcnMn89ZJLlRM

OLd8lfeL+LVRXcOy2Z80AiZJF1GMp9SOOtGARnOXSz9ybPligcRB9iuhFKVSKyOfyf7B

CQOz8WCrDSdE/f6a9v9wIyKaRLmtUChPx1mGJNJRmrBers5a/y//4BDUYj1dK0b4OrRb

eLoHRQP4UmTnINqfcKrKGmzhRcrL4YvwIplbh7uEht62zuOUIqFZzx2CKvE34nfYXuP5

Zf9yvBDHjRhnolA/DSLSMx6N9jAxW6xVJgjoZhQwPK9RK3YXw5wwvjuyVIpuh2C6s5Og

6w3Q==;

darn=nl2k.ca

ARC-Authentication-Results: i=1; mx.google.com; arc=none

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=gmail.com; s=20251104; t=1781985104; x=1782589904; darn=nl2k.ca;

h=to:subject:message-id:date:from:reply-to:mime-version:from:to:cc

:subject:date:message-id:reply-to;

bh=em15lI1mKGVSJdQKVfxc2yi8Xza15rcXvqiJNGJzY8s=;

b=ipBDa0NQBtQN6Xnt7DAj+foldjz5IXWQYPpzfP6oYLu7BTYqAY8Y8GIXm7i7tuB66L

sPhedzeAvv+xRppl/i/SLeqCihY+0LIRgYGDEujPop9JUZSSRyKyjgTv4uSb2bCbss7p

jp8L50HBIIgAZ/6itu/a/xuL1nr4MjHONXkzlyGu8rC+mIiHoLgl0+eoDRGGcPMcwlG2

jV4qZSYTQgxtm/wrMWSzYZ6JjuBYVl4cwRTR4QG1hW5EvdtUgpp2e58UJj7MgUiyQO0/

FrGBmeuLeJFtrGjE5tuf8oNp6T8lGNDGjz2YH5QoEOGbysG97wAu7mrcXTclUcY+InqU

UZ3w==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20251104; t=1781985104; x=1782589904;

h=to:subject:message-id:date:from:reply-to:mime-version:x-gm-gg

:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to;

bh=em15lI1mKGVSJdQKVfxc2yi8Xza15rcXvqiJNGJzY8s=;

b=pR2nm4iX5ClHGUD4nh+IEyKih2qQPBNu5BYHm4LA7z4yQOcFJPNjlAlgJ9mN5e6h6a

HcmF7UY1qLKV3Fm31XChckeEMjnpsNN8ancRl0RmSERo7gJuNcgt/D5Mmaz5BUbuyffw

5G4GjGeOKt8BTo3rzT19X7ha8+I87wv4PkI2/gG8uAaB1FbDNqVf4J5NoZqNGtj+FW1B

ombA8E2T0PV+B+ONqLisni3pgRGW11ZHbVwjgkgR9sws+Rp763ftwQx3aYbNl8JcKeWN

b6gExfAYmR1rM8IqOKvTlaArs1drDEufm9AxC0lEPzWPbqjcJrP51LV+TLt0MKyIxDsE

s3KQ==

X-Forwarded-Encrypted: i=1; AFNElJ8lgkB0TuiIJ8u1CKvA58VFhS1D3weSvyxtGCnr70nqkGyeNdAcnsbXfD4I5OJhQsqHTlQxzf4=@nl2k.ca

X-Gm-Message-State: AOJu0YyGtEsalk3zD4CTqiun6vx9CxEuQUX7UX2s4AQr2TUZJdCH1rdW

RfoEv2WyW/75jdBBCzxwJdAksV4UH9kRFjNWSd8FMCnophrkJjC4bbYzjM9VcwfjQpqX3rtz3Qm

b/6ReKWT97pHr7N+69V/AlcD3V/IecIc=

X-Gm-Gg: AfdE7cnyJbD2BBOgstlmlLCckHAvXqMhU34ClvEuBKv9r8IbTBKyVPncDzKNl/wfJkp

iKsStlZeIDVIbbwG3MOI5e59sGxN4pW0WAhjoYoae8UO4wYSO0brGVATRsLE56rWuFFurn1bL+D

S3BKNnxc4z9Yqve81Fir81FgwfAMtD+TIfu/HyHBXX8gwbk7DMvKvKdEz1uDrmrYjTnpzYuX6em

fs2Hd7yPRnsGsdFLHwk4y5WOzZjl/GXootdNPJ66ZZvzvY9XiQQ9zCq//UcOVciBmMslUffwA==

X-Received: by 2002:a2e:a9a5:0:b0:396:9966:50cf with SMTP id

38308e7fff4ca-3998e4092d7mr16710201fa.9.1781984716204; Sat, 20 Jun 2026

12:45:16 -0700 (PDT)

MIME-Version: 1.0

Reply-To: citibank.co.usa@gmail.com

From: Michael Corbat

Date: Sat, 20 Jun 2026 12:44:41 -0700

X-Gm-Features: AVVi8Cee6rCzcsUfU88IFtFAIMaK7YU6-UAmDxNctI4bo92nl-eibb70H8m3-qc

Message-ID:

Subject: Compensation Award

To: undisclosed-recipients:;

Content-Type: multipart/alternative; boundary="000000000000012f4e0654b4a67c"

Bcc: doctor@nl2k.ca

X-Spam_score: 16.4

X-Spam_score_int: 164

X-Spam_bar: ++++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Subject: Midland Financial Recovery Bureau – Victim Compensation

Program Compensation Award: USD $1,500,000.00 Reference ID: MF1122-CRX00491

Address: 8600 Westfield Avenue, Suite 210, Houston, TX 77 [...]



Content analysis details: (16.4 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[209.85.167.67 listed in will-spam-for-food.eu.org]

[209.85.167.67 listed in will-spam-for-food.eu.org]

[209.85.167.67 listed in will-spam-for-food.eu.org]

[209.85.167.67 listed in will-spam-for-food.eu.org]

[209.85.167.67 listed in will-spam-for-food.eu.org]

[209.85.167.67 listed in will-spam-for-food.eu.org]

[209.85.167.67 listed in will-spam-for-food.eu.org]

[209.85.167.67 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[209.85.167.67 listed in dnsbl.ahbl.org]

[209.85.167.67 listed in dnsbl.ahbl.org]

[209.85.167.67 listed in dnsbl.ahbl.org]

[209.85.167.67 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[209.85.167.67 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[209.85.167.67 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[209.85.167.67 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[209.85.167.67 listed in dnsbl.ahbl.org]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[209.85.167.67 listed in list.dnswl.org]

-0.0 SPF_PASS SPF: sender matches SPF record

1.5 GR_DOMAIN_UNDISC1 To contains undisclosed recipient (undisc)

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider

[jeegael37(at)gmail.com]

1.0 FORGED_GMAIL_RCVD 'From' gmail.com does not match 'Received' headers

0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends in

digit

[jeegael37(at)gmail.com]

2.5 US_DOLLARS_3 BODY: Mentions millions of $ ($NN,NNN,NNN.NN)

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[209.85.167.67 listed in bl.score.senderscore.com]

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[209.85.167.67 listed in wl.mailspike.net]

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

0.0 LOTS_OF_MONEY Huge... sums of money

1.0 FREEMAIL_REPLYTO Reply-To/From or Reply-To/body contain different

freemails

2.8 UNDISC_FREEM Undisclosed recipients + freemail reply-to

0.0 MONEY_FREEMAIL_REPTO Lots of money from someone using free email?

2.6 UNDISC_MONEY Undisclosed recipients + money/fraud signs

0.0 T_FILL_THIS_FORM_SHORT Fill in a short form with personal information

0.0 MONEY_FRAUD_5 Lots of money and many fraud phrases

2.0 ADVANCE_FEE_2_NEW_MONEY Advance Fee fraud and lots of money

0.0 FORM_FRAUD_5 Fill a form and many fraud phrases

0.4 FILL_THIS_FORM_FRAUD_PHISH Answer suspicious question(s)

0.0 T_FILL_THIS_FORM_FRAUD_PHISH Answer suspicious question(s)

1.3 MONEY_FORM_SHORT Lots of money if you fill out a short form

Subject: {SPAM?} Compensation Award

Nigerian Compensation spam from Google Gmail Part 2

Posted by Dave Yadallee on
--000000000000012f4e0654b4a67c

Content-Type: text/plain; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable



Subject: Midland Financial Recovery Bureau =E2=80=93 Victim Compensation Pr=

ogram

Compensation Award: USD $1,500,000.00

Reference ID: MF1122-CRX00491

Address: 8600 Westfield Avenue, Suite 210, Houston, TX 77040, USA



Dear Recipient,



We are contacting you as a listed beneficiary in a federally supported

restitution initiative established to compensate victims of financial

fraud. This action follows the prosecution and sentencing of

individuals=E2=80=94namely Andrew Collins, Eric Mateo, and Linda Frost=E2=

=80=94who were

recently convicted of operating fraudulent schemes while posing as

representatives of financial and government institutions.



As part of the outcome, the Midland Financial Recovery Bureau, in

collaboration with U.S. regulatory authorities, has approved a compensation

payment of USD $1,500,000.00 to be issued in your name. Disbursement will

be made through a secure ATM-enabled payment card, and all standard

transaction and delivery costs will be covered by the issuing entity.



To confirm your eligibility and initiate the processing of your payment,

please provide the following information for verification and compliance

review:



Full Legal Name



Residential Mailing Address



Current Occupation



Active Contact Number



Government-Issued Photo Identification (valid)



Please be advised that a nominal Processing and Verification Fee will be

required to complete the official endorsement and release of funds. There

will be no additional fees once this has been fulfilled.



This compensation program is part of a broader effort to assist fraud

victims and reinforce public confidence in financial institutions.



Sincerely,

Mr. Thomas E. Ralston

Director, Compensation Oversight Division

Midland Financial Recovery Bureau



--000000000000012f4e0654b4a67c

Content-Type: text/html; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable





=3D"gmail_signature" data-smartmail=3D"gmail_signature">

iv>Subject: Midland Financial Recovery Bureau =E2=80=93 Victim Compensation=

Program
Compensation Award: USD $1,500,000.00
Referenc=

e ID: MF1122-CRX00491
Address: 8600 Westfield Avenue, Suite 210, =

Houston, TX 77040, USA

Dear Recipient,
<=

br>
We are contacting you as a listed beneficiary in a federally =

supported restitution initiative established to compensate victims of finan=

cial fraud. This action follows the prosecution and sentencing of individua=

ls=E2=80=94namely Andrew Collins, Eric Mateo, and Linda Frost=E2=80=94who w=

ere recently convicted of operating fraudulent schemes while posing as repr=

esentatives of financial and government institutions.

<=

div>As part of the outcome, the Midland Financial Recovery Bureau, in colla=

boration with U.S. regulatory authorities, has approved a compensation paym=

ent of USD $1,500,000.00 to be issued in your name. Disbursement will be ma=

de through a secure ATM-enabled payment card, and all standard transaction =

and delivery costs will be covered by the issuing entity.


iv>
To confirm your eligibility and initiate the processing of your pay=

ment, please provide the following information for verification and complia=

nce review:

Full Legal Name


iv>Residential Mailing Address

Current Occupation<=

/div>

Active Contact Number

Gov=

ernment-Issued Photo Identification (valid)

Please=

be advised that a nominal Processing and Verification Fee will be required=

to complete the official endorsement and release of funds. There will be n=

o additional fees once this has been fulfilled.

Th=

is compensation program is part of a broader effort to assist fraud victims=

and reinforce public confidence in financial institutions.

<=

/div>
Sincerely,
Mr. Thomas E. Ralston
Director, Co=

mpensation Oversight Division
Midland Financial Recovery Bureau
div>




--000000000000012f4e0654b4a67c--