Followup spam

Posted by Dave Yadallee on Thursday, August 13. 2026

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 13 Aug 2026 04:39:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.5 (FreeBSD))

(envelope-from )

id 1wuSpD-000000007Rr-2E2M

for dave@doctor.nl2k.ab.ca;

Thu, 13 Aug 2026 04:38:15 -0600

Resent-From: The Doctor

Resent-Date: Thu, 13 Aug 2026 04:38:15 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail.alterair.ua ([23.88.116.234]:60845)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.99.5 (FreeBSD))

(envelope-from )

id 1wuNNi-00000000JbN-0zLk

for doctor@doctor.nl2k.ab.ca;

Wed, 12 Aug 2026 22:49:38 -0600

DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=alterair.ua

; s=mail; h=Content-Transfer-Encoding:Content-Type:Message-ID:Reply-To:

Subject:To:From:Date:MIME-Version:Sender:Cc:Content-ID:Content-Description:

Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:

In-Reply-To:References:List-Id:List-Help:List-Unsubscribe:List-Subscribe:

List-Post:List-Owner:List-Archive;

bh=gbBda4qO2SUiJMMGNiDLmRcN4x21TaVoXWN2O8XmAhQ=; b=X9xKJp2pU3KhxitkDLaRV/wObx

fJVSs23ShE4Ix2kGm7g2xPzb9oF+4zZRW1V2l2W2Wb2oLqbG3XjmfMDK5NUrqQm6Bmnr45VAPa73q

UASIxm4ajMKgZymnlTqWXGD5ewnU3XFCeOzhCZJmtycOXpTqrUlrNrCGGGUFLmWwbwGZ1lfa9iwAj

atY4v5WmN5W8uXPaK7Az2YkwrxMKMl8s4F4UVqriJ8W3CagH2UgwzLVnn8IwUBhfFJuFUIRIgpUdk

wSzVXEre2966SwNgmQGVB4S7osEODie3nab4mD4uZJfFfaw1Kl/dJfbEnQefB5PhmcvdJGpKDlzRd

4mvX+bvA==;

Received: from [127.0.0.1] (helo=webmail.alterair.ua)

by mail.alterair.ua with esmtpa (Exim 4.97)

(envelope-from )

id 1wuNKo-00000007u1b-24lV;

Thu, 13 Aug 2026 07:46:30 +0300

MIME-Version: 1.0

Date: Thu, 13 Aug 2026 00:46:30 -0400

From: Gong Zhengyang

To: undisclosed-recipients:;

Subject: Re:

Reply-To: gzhengyang008@gmail.com

Mail-Reply-To: gzhengyang008@gmail.com

Message-ID: <764039c184612bb6b44763db6fca7255@alterair.ua>

X-Sender: buh@alterair.ua

X-Priority: 1 (Highest)

Content-Type: text/plain; charset=US-ASCII;

format=flowed

Content-Transfer-Encoding: 7bit

X-Spam_score: 5.7

X-Spam_score_int: 57

X-Spam_bar: +++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.

Content preview: Hello, I hope this message finds you well. Following up on

my Monday email regarding new developments AND it benefits to us. I'd appreciate

your response.

Content analysis details: (5.7 points, 5.0 required)

pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[23.88.116.234 listed in will-spam-for-food.eu.org]

[23.88.116.234 listed in will-spam-for-food.eu.org]

[23.88.116.234 listed in will-spam-for-food.eu.org]

[23.88.116.234 listed in will-spam-for-food.eu.org]

[23.88.116.234 listed in will-spam-for-food.eu.org]

[23.88.116.234 listed in will-spam-for-food.eu.org]

[23.88.116.234 listed in will-spam-for-food.eu.org]

[23.88.116.234 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[23.88.116.234 listed in dnsbl.ahbl.org]

[23.88.116.234 listed in dnsbl.ahbl.org]

[23.88.116.234 listed in dnsbl.ahbl.org]

[23.88.116.234 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[23.88.116.234 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[23.88.116.234 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[23.88.116.234 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[23.88.116.234 listed in dnsbl.ahbl.org]

-0.0 SPF_PASS SPF: sender matches SPF record

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

1.5 GR_DOMAIN_UNDISC1 To contains undisclosed recipient (undisc)

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in digit

[gzhengyang008(at)gmail.com]

-0.0 T_RP_MATCHES_RCVD Envelope sender domain matches handover relay

domain

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

0.0 ODD_FREEM_REPTO Has unusual reply-to header

2.5 FREEMAIL_FORGED_REPLYTO Freemail in Reply-To, but not From

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[23.88.116.234 listed in bl.score.senderscore.com]

Subject: {SPAM?} Re:

Hello,

I hope this message finds you well.

Following up on my Monday email regarding new developments AND it

benefits to us. I'd appreciate your response.

Kind regards,

Gong Zhengyang

Business partnership spam from Google Gmail

Posted by Dave Yadallee on Thursday, August 13. 2026

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 13 Aug 2026 04:37:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.5 (FreeBSD))

(envelope-from )

id 1wuSnS-000000005I0-0NF0

for dave@doctor.nl2k.ab.ca;

Thu, 13 Aug 2026 04:36:26 -0600

Resent-From: The Doctor

Resent-Date: Thu, 13 Aug 2026 04:36:25 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-pj2-f8.google.com ([74.125.227.136]:48044)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.99.5 (FreeBSD))

(envelope-from <09847@fangwit.ac.th>)

id 1wuM29-000000004DB-3ZNp

for doctor@nl2k.ab.ca;

Wed, 12 Aug 2026 21:23:19 -0600

Received: by mail-pj2-f8.google.com with SMTP id d9443c01a7336-2d313798bf8so2105915ad.0

for ; Wed, 12 Aug 2026 20:22:23 -0700 (PDT)

ARC-Seal: i=1; a=rsa-sha256; t=1786591337; cv=none;

d=google.com; s=arc-20260327;

b=dDC+62v8zNKNO816o4rC7Psu+h4AeIk9+eOrMmoWrq2V+vyvL0rzwr4HiUodaZWyOy

bmHaNRDSqm5KsNXk0JDm8nSwBje1Lu4wQE4qr56P7AtMlU25VBMk4X4boQAm1Zd5hwPQ

HVq8i8Dwx7JVkE+DKBpy5O7iQMurQPuEZUV4jDUk8vFswi4rPNXBnLojkZYrQuPqMl6N

kESJ0Ng+77bRvV+lrlt0FtPjL4TP8j66sgwxITud3a878MUc8iEopEiWKb+tjuCkzExu

sbVSHqZmaPe3i4IsQQEdaryfUpc64bSEaU45fWvaiP815nANsoXFEywDpjjgS6bvRl8q

EC1Q==

ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20260327;

h=to:subject:message-id:date:from:reply-to:mime-version

:dkim-signature;

bh=4ydknHW2P8pjMeI4eFN3sPnhGEUQ1abgHhXUhIuZNGw=;

fh=fWNYHWtrc3T3iQI3l3sz6ErjIMHVnpXv6a2Uyndq/ZE=;

b=lbl1QoZ5W/LUQ/rRfpooptxzdOekpgxDmcA9ZP/S4yZH5v6IUjUzG2bbw+bv8gsiwt

lgcO2LceHd4vfJuBQuye/cSTQChnH22pu7ib5FMIISNnTK5gEjfkL/MRFPYlaQGcQ426

VYHmILWCNVCywRiMGxSZvJ9IAe6FXiSrax2XZKf+brcpPNrkFssvbSBPfMLLrmtbiXXH

b/aGDhoykt4g4ifIYfQC7jtoIxBrpjkjiDNYBzONR98eUVziNasgSmJGe6w6eqoPYPeS

x7qnbKNi/uzzLROpmsa7yddGK+BNZhUktghn0bjSFyCK3eypXZRrGaYIH5d111bdP31t

kAZA==;

darn=nl2k.ab.ca

ARC-Authentication-Results: i=1; mx.google.com; arc=none

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=fangwit.ac.th; s=google; t=1786591337; x=1787196137; darn=nl2k.ab.ca;

h=content-type:to:subject:message-id:date:from:reply-to:mime-version

:from:to:cc:subject:date:message-id:reply-to:content-type;

bh=4ydknHW2P8pjMeI4eFN3sPnhGEUQ1abgHhXUhIuZNGw=;

b=lKadZEsfEKLkTikfN+f+yx+8Ct5mGOoEyBQX3eRv33j9yvjaPeENujdddJNbaqYgB3

kC76cFJfRNRVHLg4GwZcp/Ah4RLgsQvzoaGOwsiTdikEBCDOGBy92/9MhjHF6NfmGvnP

zst2JRp6IqJn6ySHmBvJJE3RG5vA83naABXCNAcJsSfkVMCYQ4FUB/oL+tmn+vqzW1iy

M4ZB2ZPLnVGNRsIsukMZIHqzX08rRcbISWSIvyQvB3nPWjKJBEl/SrVAhmc9EmhIo8Wp

h2Y4O/34MfvBIzjcc1qmebGVKAo/2UYm72g4+stCdocDEFlr4GeASoBa3jt9qvTHd/8r

Qa3Q==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20251104; t=1786591337; x=1787196137;

h=content-type:to:subject:message-id:date:from:reply-to:mime-version

:x-gm-gg:x-gm-message-state:from:to:cc:subject:date:message-id

:reply-to:content-type;

bh=4ydknHW2P8pjMeI4eFN3sPnhGEUQ1abgHhXUhIuZNGw=;

b=owfPeOH4OgxxJwu7mmOkdrld+VYaBMB5bYwyJw1rLzHe7dxH8noc0/0KI5okuvPxlA

IrAtr8MWVsQivsmjPy6mTIOSFaegdMyQlBuPtQRA0ppXUico5rff7cb/CHAL7wbbqInf

gxXiI57TxLrYACqliICIwJqJ1mSPdKYpYPZh+H8mU9juT9WvYqywH7KDVOSAZwYi2PpA

6lgM+pU3va0Avo/f3yxTbbYDOi8KpbxUIVxTs7pjH7HSUVhrQeFpZUzuwuPjth9DOB2i

MPKdyuSW3F7HKr93+w8qfT57HnZs3eQTajzPxPbr4bis/zRyEDp9NnIEakFLlu2A1BTh

1irQ==

X-Forwarded-Encrypted: i=1; AHgh+RoEEXxVeHchVRzLgKCNDVI3TF0z7UZ/NRc7gqY85aORMUbt9Y0PRk5SvJrBf9LpK1BfIMOIt2U=@nl2k.ab.ca

X-Gm-Message-State: AOJu0Yx5a5W1Wfk4zToOx+r4mrwLAtpyd1SX44zZrO8mmcqraJXYB5oA

H33HTfj1Z6Ti/CqnT1JR40IRGYzcQEt0sRE3hQrKtUrTfVDU1ALZ1VONkheEOSYoD9w/FwWaQ6F

D4eURwjIo1GD0EdQ0kPp8fhWmNDAvcmUbcJU5qjsYFQ==

X-Gm-Gg: AR+sD11kfVTc1trvoL8YN2+jrvGcUrCI6FMJ/z1x+gg/NTfARTOL0Q2Si6mZHqdeSFk

IbhU/dja0h938tyBcTVheGxXexmgiZkMb1mxAv92IhOIu7q4/d7JdEzu0qyfKPv/1AshQEB8YU5

KA/9VmNEfhw4Et0/QMhJduv8Aiqr3kkH+ltXHs78VHPsvm1ZVjNKIWI3OiAZnoWUL+0hWnlFShO

3PVEApb3qDCOoQ/5x03jLmoJO01qwekDRvxETGNabq+DfWFfhtixrHXzQlpCSVUUATbRg8Fbhu1

iVmKLv+GsobeaIQCiOCtHq1FS1RdyI/8KhXfW3BXDyBmicIkmw5oX/DfXiOiy1Ro9F3DzKFqQeE

Cqu6TOAFEpNV4hiCakf7M+hkGzGJZRVILGFKrHQrs/MpqPO8r3geODZQUPGA=

X-Received: by 2002:a05:6a21:6b02:b0:3ab:2fa:756c with SMTP id

adf61e73a8af0-3cc54f9616emr4198498637.1.1786591336774; Wed, 12 Aug 2026

20:22:16 -0700 (PDT)

MIME-Version: 1.0

Reply-To: norah111555@proton.me

From: =?UTF-8?B?4LiZ4Liy4Lii4LiX4Lix4Lio4LiZ4Lix4LiiIOC4leC4uOC4oeC5gOC4geC4qeC4l+C4tQ==?= <09847@fangwit.ac.th>

Date: Wed, 12 Aug 2026 20:22:04 -0700

X-Gm-Features: AUfX_mxxJp3ez1F1t3GUsOo2X2AV-RXO3mtIqkPuX05ji1Y8WweKWONbuCrG6Uc

Message-ID:

Subject: My Dear Partner ,

To: undisclosed-recipients:;

Content-Type: multipart/alternative; boundary="000000000000fcce740658e53526"

Bcc: doctor@nl2k.ab.ca

X-Spam_score: 11.4

X-Spam_score_int: 114

X-Spam_bar: +++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.

Content preview: My Dear Partner , Due to my tight schedules I could not contact

you earlier. now.I'm happy to inform you about my success in getting those

funds transferred under the cooperation of a new partner. Now [...]

Content analysis details: (11.4 points, 5.0 required)

pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[74.125.227.136 listed in will-spam-for-food.eu.org]

[74.125.227.136 listed in will-spam-for-food.eu.org]

[74.125.227.136 listed in will-spam-for-food.eu.org]

[74.125.227.136 listed in will-spam-for-food.eu.org]

[74.125.227.136 listed in will-spam-for-food.eu.org]

[74.125.227.136 listed in will-spam-for-food.eu.org]

[74.125.227.136 listed in will-spam-for-food.eu.org]

[74.125.227.136 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[74.125.227.136 listed in dnsbl.ahbl.org]

[74.125.227.136 listed in dnsbl.ahbl.org]

[74.125.227.136 listed in dnsbl.ahbl.org]

[74.125.227.136 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[74.125.227.136 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[74.125.227.136 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[74.125.227.136 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[74.125.227.136 listed in dnsbl.ahbl.org]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[74.125.227.136 listed in list.dnswl.org]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[74.125.227.136 listed in wl.mailspike.net]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[74.125.227.136 listed in bl.score.senderscore.com]

-0.0 SPF_PASS SPF: sender matches SPF record

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

1.5 GR_DOMAIN_UNDISC1 To contains undisclosed recipient (undisc)

1.5 HK_SCAM_N8 BODY: No description available.

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HK_SCAM No description available.

0.0 LOTS_OF_MONEY Huge... sums of money

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

1.5 MONEY_ATM_CARD Lots of money on an ATM card

0.0 T_FILL_THIS_FORM_SHORT Fill in a short form with personal information

1.3 MONEY_FORM_SHORT Lots of money if you fill out a short form

2.0 ADVANCE_FEE_2_NEW_MONEY Advance Fee fraud and lots of money

2.4 UNDISC_MONEY Undisclosed recipients + money/fraud signs

Subject: {SPAM?} My Dear Partner ,

--000000000000fcce740658e53526

Content-Type: text/plain; charset="UTF-8"

My Dear Partner ,

Due to my tight schedules I could not contact you earlier. now.I'm happy to

inform you about my success in getting those funds transferred under the

cooperation of a new partner.

Now contact my secretary Name is: Mr.Ben Mark Email address:(

janenorah64@gmail.com) Tell him to send you the ATM card, a total sum of US

US$10.5 million which I kept for your compensation for all your past

efforts and attempts to assist me in this transaction, which was applied in

your name. I appreciate your efforts at that time so much.

Best Regards

--000000000000fcce740658e53526

Content-Type: text/html; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable

My Dear Partner ,
Due to my tight schedules I could not=

contact you earlier. now.I'm happy to inform you about my success in g=

etting those funds transferred under the cooperation of a new partner.
N=

ow contact my secretary Name is: Mr.Ben Mark Email address:(
lto:janenorah64@gmail.com">janenorah64@gmail.com) Tell him to send you =

the ATM card, a total sum of US US$10.5 million which I kept for your compe=

nsation for all your past efforts and attempts to assist me in this transac=

tion, which was applied in your name. I appreciate your efforts at that tim=

e so much.
Best Regards

--000000000000fcce740658e53526--

Nigerian Spam from Google Gmail

Posted by Dave Yadallee on Thursday, August 13. 2026

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 13 Aug 2026 04:37:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.5 (FreeBSD))

(envelope-from )

id 1wuSnN-000000005GI-46cL

for dave@doctor.nl2k.ab.ca;

Thu, 13 Aug 2026 04:36:21 -0600

Resent-From: The Doctor

Resent-Date: Thu, 13 Aug 2026 04:36:21 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-pj2-f8.google.com ([74.125.227.136]:48753)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.99.5 (FreeBSD))

(envelope-from <09847@fangwit.ac.th>)

id 1wuM29-000000004DC-3ZKR

for doctor@mail.nl2k.ab.ca;

Wed, 12 Aug 2026 21:23:19 -0600

Received: by mail-pj2-f8.google.com with SMTP id d9443c01a7336-2d313798bf8so2106025ad.0

for ; Wed, 12 Aug 2026 20:22:23 -0700 (PDT)

ARC-Seal: i=1; a=rsa-sha256; t=1786591337; cv=none;

d=google.com; s=arc-20260327;

b=hA9+GHnnVfgS2MxtJraFObJyHlsYq3U2hMXaWe8mx4+EBRTyLV9ymeX4SpkFXbO0KE

WtU9ut4EFGLEHjIvuxA718EWXfyBmGM+4U7+WqZxuqdgCLxD97kuR5PTCNxmby+eQrXa

01vdj+mG44nJRpFM7l1CvrwMMXuH7OPSrMOkBesxqBdUdeTdbdxFfs4gkn4f9WPOB0ab

VsDXF7rK01ENNmFGT2Bbx8FECpb1voXiPwSZBHYxhvqRptGR7aAcHnWv5AbswU/lkU02

tk5Uy546k3UTgkr0q9DpQSusVE1Pjzre+VehuDJH/dkrDl5zlC8FyOhkNiKUEGNj5Wmr

35YQ==

ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20260327;

h=to:subject:message-id:date:from:reply-to:mime-version

:dkim-signature;

bh=4ydknHW2P8pjMeI4eFN3sPnhGEUQ1abgHhXUhIuZNGw=;

fh=HgIkBaNQuy42WG1XFGkOnz/8M6eWJrMMNbfDKG5Rnxs=;

b=ClH8CZuTCzXhbqXmyjhS2P86fiMHYrT1jsm/h0UslXaJyohYqFXj4TYuj+YVefCw/i

9B0fpoFNQFVXhMOAlPBXGw58ftM9A/uRResimHXeLCqcOfDUOzooDQvZWVb9DIAS7N8T

aTzLcfJZWqHXonAgQSxb/RxI5E6FpcC7kn4R5Fl+93eyyZXr3PdTn+ZZCCXhSO+1CqmE

kL8pV0VHDoOq41eNAi6uCGi2HVeCTXBOe1AJXlzR269PRoMMLUGISAbotpNFL9/VDBLH

CmUMSuE4LHHO9FULdJNa/5H58WvClM33uTenZKM4zwhvk4MsHWJOLpZQIaggiLMYX+hG

a74A==;

darn=mail.nl2k.ab.ca

ARC-Authentication-Results: i=1; mx.google.com; arc=none

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=fangwit.ac.th; s=google; t=1786591337; x=1787196137; darn=mail.nl2k.ab.ca;

h=content-type:to:subject:message-id:date:from:reply-to:mime-version

:from:to:cc:subject:date:message-id:reply-to:content-type;

bh=4ydknHW2P8pjMeI4eFN3sPnhGEUQ1abgHhXUhIuZNGw=;

b=iUaw3cylwS2fCtAJT4Hk15F83xLQV7lGVL1boZzNHYv+t8nl7gD3KciWB1vh5MyyU/

0Yg/7yLUSolEZ3oDKKKFWJ8ybjNkeZBOyG7FI/Uonyz1Xts4Hda9OEfGBM3NcAQMTV6X

ErHDba83kl4/TkeGn7eYciEH6vGhMeq/clZOa2TPt3nNE8fRwZLnIrEkxxPx3/3zVAnK

A25LGgP1WK2MQv+BqUzXylpGBDgJpqU2CSjVmFKg98bA5TbRN0/DvE1ushUNqhO8EF7M

K3j5iED02vTR9yx7xiSKO0K/ICbOq1WOtFF3HrrPiM9ZIBBjPMAs7r2rkeKGBfawuVZF

eIjw==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20251104; t=1786591337; x=1787196137;

h=content-type:to:subject:message-id:date:from:reply-to:mime-version

:x-gm-gg:x-gm-message-state:from:to:cc:subject:date:message-id

:reply-to:content-type;

bh=4ydknHW2P8pjMeI4eFN3sPnhGEUQ1abgHhXUhIuZNGw=;

b=o5XDH8ZAONsIukBTVfJ8fS9Tr0aSnggw/2/ZFXE3xnkdIZEoKG1iVT+8AIkVC8kw1z

CidaMsoXkezT5JQvSdpYsC1IPxNa2Eh932AURKptXOu4BA0IUSckXmOStlCCVbVR+8kw

54LoluofL5eQFIGRq90kTz5eEFE0W9WV/M6vzP0Z0IqGDDbIsVAOARfsAbM7q6kRulP8

NZfsJINBGwGNiAjTgnUBVGIPQdSv/J+bZK45vutH1NOaWl64/wH6b5sa1ok7KmXDf62h

neJXQ0lPvPTRitmAakuPd1ikgB2/Urht35lSBOd1mYw2ZMzTaSa9j/MetG9vwPYZjLtF

whzg==

X-Forwarded-Encrypted: i=1; AHgh+RoDzRUboHGPLitHB3VFvNMkqGwTUsCy/o3L3pBZrVcwNAPwoJDCX/tgyKivUh4/6lDGLtRcF5I=@mail.nl2k.ab.ca

X-Gm-Message-State: AOJu0YwF3Tt5/qC3wxH528pW9oN+AkYvWtt96q94BS3oMqmWdJUaAGzb

atrZGHbnWevGkmaYNswzBacK4Wy0jJAxYQpXX44KGD3YBtSUBy9hgDqD6plqtGFMVIRhNf9LN5R

/QgxYyHoBXiQkUImA9Lm9I6nf0YdTVK7FIOf/D6qKqg==

X-Gm-Gg: AR+sD112TuRefrX8ViPzz2GAXjcVpJzI7N3A9uGGTNR3fioE/eRhktZ6a2hbMCjYCQI

LtS2gLYWUrgWl+0raOR1qLKwvp4mfT3k3wIdQIJ3ZD6JvTqZqEUyo6wrJ7cJBteBEsGPRvMBXRb

2R9ZY+EM6RivXikWUR70ui/e6sTSO6KPHZyexXWRdjrfh29oC4huFffWRhKhhmz6I9l8+cRzSaU

6ev7PNSucf5sDqsr7U+tmspEsoJjtYDhDqZrnsIkYW/dhFH5u9aBDDEix0HRKiZSZfG58ENRblz

aRQJWLydBb+t+UVPxt5yvcBTixV0HJEvFzlhV0XK24tkLTrpb4+Oz95+tHp9a+9wqSunV5QoDui

qt/Ji7yyo8kbyBAtUQjTBYAX4/emNal+eK7xM4Yf7l2NP9xaC2XrUZTS5E2Q=

X-Received: by 2002:a05:6a21:6b02:b0:3ab:2fa:756c with SMTP id

adf61e73a8af0-3cc54f9616emr4198498637.1.1786591336774; Wed, 12 Aug 2026

20:22:16 -0700 (PDT)

MIME-Version: 1.0

Reply-To: norah111555@proton.me

From: =?UTF-8?B?4LiZ4Liy4Lii4LiX4Lix4Lio4LiZ4Lix4LiiIOC4leC4uOC4oeC5gOC4geC4qeC4l+C4tQ==?= <09847@fangwit.ac.th>

Date: Wed, 12 Aug 2026 20:22:04 -0700

X-Gm-Features: AUfX_mxxJp3ez1F1t3GUsOo2X2AV-RXO3mtIqkPuX05ji1Y8WweKWONbuCrG6Uc

Message-ID:

Subject: My Dear Partner ,

To: undisclosed-recipients:;

Content-Type: multipart/alternative; boundary="000000000000fcce740658e53526"

Bcc: doctor@mail.nl2k.ab.ca

X-Spam_score: 11.4

X-Spam_score_int: 114

X-Spam_bar: +++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.

Content preview: My Dear Partner , Due to my tight schedules I could not contact

you earlier. now.I'm happy to inform you about my success in getting those

funds transferred under the cooperation of a new partner. Now [...]

Content analysis details: (11.4 points, 5.0 required)

pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[74.125.227.136 listed in will-spam-for-food.eu.org]

[74.125.227.136 listed in will-spam-for-food.eu.org]

[74.125.227.136 listed in will-spam-for-food.eu.org]

[74.125.227.136 listed in will-spam-for-food.eu.org]

[74.125.227.136 listed in will-spam-for-food.eu.org]

[74.125.227.136 listed in will-spam-for-food.eu.org]

[74.125.227.136 listed in will-spam-for-food.eu.org]

[74.125.227.136 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[74.125.227.136 listed in dnsbl.ahbl.org]

[74.125.227.136 listed in dnsbl.ahbl.org]

[74.125.227.136 listed in dnsbl.ahbl.org]

[74.125.227.136 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[74.125.227.136 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[74.125.227.136 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[74.125.227.136 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[74.125.227.136 listed in dnsbl.ahbl.org]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[74.125.227.136 listed in list.dnswl.org]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[74.125.227.136 listed in wl.mailspike.net]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[74.125.227.136 listed in bl.score.senderscore.com]

-0.0 SPF_PASS SPF: sender matches SPF record

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

1.5 GR_DOMAIN_UNDISC1 To contains undisclosed recipient (undisc)

1.5 HK_SCAM_N8 BODY: No description available.

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

0.0 HK_SCAM No description available.

0.0 LOTS_OF_MONEY Huge... sums of money

0.0 T_FILL_THIS_FORM_SHORT Fill in a short form with personal information

1.5 MONEY_ATM_CARD Lots of money on an ATM card

1.3 MONEY_FORM_SHORT Lots of money if you fill out a short form

2.4 UNDISC_MONEY Undisclosed recipients + money/fraud signs

2.0 ADVANCE_FEE_2_NEW_MONEY Advance Fee fraud and lots of money

Subject: {SPAM?} My Dear Partner ,

--000000000000fcce740658e53526

Content-Type: text/plain; charset="UTF-8"

My Dear Partner ,

Due to my tight schedules I could not contact you earlier. now.I'm happy to

inform you about my success in getting those funds transferred under the

cooperation of a new partner.

Now contact my secretary Name is: Mr.Ben Mark Email address:(

janenorah64@gmail.com) Tell him to send you the ATM card, a total sum of US

US$10.5 million which I kept for your compensation for all your past

efforts and attempts to assist me in this transaction, which was applied in

your name. I appreciate your efforts at that time so much.

Best Regards

--000000000000fcce740658e53526

Content-Type: text/html; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable

--000000000000fcce740658e53526--

Microsoft Temas phish

Posted by Dave Yadallee on Thursday, August 13. 2026

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 13 Aug 2026 07:11:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.5 (FreeBSD))

(envelope-from )

id 1wuVCU-00000000P9p-0qvR

for dave@doctor.nl2k.ab.ca;

Thu, 13 Aug 2026 07:10:26 -0600

Resent-From: The Doctor

Resent-Date: Thu, 13 Aug 2026 07:10:26 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from smtp.telepacific.net ([208.57.4.233]:39623)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.99.5 (FreeBSD))

(envelope-from )

id 1wuTlM-00000000FUL-21pG

for sales@nk.ca;

Thu, 13 Aug 2026 05:38:29 -0600

Received: from CNABAL-PC10.king.local (unknown [64.60.196.69])

by smtp.telepacific.net (Postfix) with ESMTP id 6167E12524D;

Wed, 12 Aug 2026 19:33:52 -0700 (PDT)

Content-Type: multipart/alternative; boundary="===============1462528628=="

MIME-Version: 1.0

Subject: New Message on Microsoft Teams Meeting

To: Recipients

From: "Microsoft Teams"

Date: Wed, 12 Aug 2026 19:32:52 -0700

X-Spam_score: 8.2

X-Spam_score_int: 82

X-Spam_bar: ++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.

Content preview: Microsoft Teams Secure collaboration Work chat Hi, 1 unread

mention Your teammates are trying to reach you in Microsoft Teams Someone

sent a message in a high-priority chat Reply, Go to conversation Microsoft

Teams

Content analysis details: (8.2 points, 5.0 required)

pts rule name description

---- ---------------------- --------------------------------------------------

0.1 MISSING_MID Missing Message-Id: header

-0.7 RCVD_IN_DNSWL_LOW RBL: Sender listed at http://www.dnswl.org/, low

trust

[208.57.4.233 listed in list.dnswl.org]

1.2 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a relay in bl.spamcop.net

[Blocked - see ]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[64.60.196.69 listed in will-spam-for-food.eu.org]

[64.60.196.69 listed in will-spam-for-food.eu.org]

[64.60.196.69 listed in will-spam-for-food.eu.org]

[64.60.196.69 listed in will-spam-for-food.eu.org]

[64.60.196.69 listed in will-spam-for-food.eu.org]

[64.60.196.69 listed in will-spam-for-food.eu.org]

[64.60.196.69 listed in will-spam-for-food.eu.org]

[64.60.196.69 listed in will-spam-for-food.eu.org]

[208.57.4.233 listed in will-spam-for-food.eu.org]

[208.57.4.233 listed in will-spam-for-food.eu.org]

[208.57.4.233 listed in will-spam-for-food.eu.org]

[208.57.4.233 listed in will-spam-for-food.eu.org]

[208.57.4.233 listed in will-spam-for-food.eu.org]

[208.57.4.233 listed in will-spam-for-food.eu.org]

[208.57.4.233 listed in will-spam-for-food.eu.org]

[208.57.4.233 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[64.60.196.69 listed in dnsbl.ahbl.org]

[64.60.196.69 listed in dnsbl.ahbl.org]

[64.60.196.69 listed in dnsbl.ahbl.org]

[64.60.196.69 listed in dnsbl.ahbl.org]

[208.57.4.233 listed in dnsbl.ahbl.org]

[208.57.4.233 listed in dnsbl.ahbl.org]

[208.57.4.233 listed in dnsbl.ahbl.org]

[208.57.4.233 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[64.60.196.69 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[64.60.196.69 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[64.60.196.69 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[64.60.196.69 listed in dnsbl.ahbl.org]

3.6 RCVD_IN_SBL_CSS RBL: Received via a relay in Spamhaus SBL-CSS

[64.60.196.69 listed in zen.spamhaus.org]

1.5 RCVD_IN_SBL_XBL RBL: Received via a relay in Spamhaus SBL+XBL

[64.60.196.69 listed in sbl-xbl.spamhaus.org]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

0.7 SPF_NEUTRAL SPF: sender does not match SPF record (neutral)

0.5 NO_RDNS Sending MTA has no reverse DNS (Postfix variant)

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 HTML_MESSAGE BODY: HTML included in message

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[208.57.4.233 listed in bl.score.senderscore.com]

Subject: {SPAM?} New Message on Microsoft Teams Meeting

You will not see this in a MIME-aware mail reader.

--===============1462528628==

Content-Type: text/plain; charset="iso-8859-1"

MIME-Version: 1.0

Content-Transfer-Encoding: quoted-printable

Content-Description: Mail message body

=

Microsoft Teams

Secure collaboration Work chat

=

Hi, =

1 unread mention

=

Your teammates are trying to reach you in Microsoft Teams

Someone sent a message in a high-priority chat

Reply, Go to conversation Microsoft Teams

=

Regards,

Microsoft Teams

Microsoft Teams 2026 Microsoft Corporation, One Microsoft Way, Redmond, W=

A 98052

You're receiving this because someone mentioned you in a chat on Microsoft=

Teams.

--===============1462528628==

Content-Type: text/html; charset="iso-8859-1"

MIME-Version: 1.0

Content-Transfer-Encoding: quoted-printable

Content-Description: Mail message body

Microsoft Teams

Microsoft Teams

Secure collaboration Work chat

Hi,

1 unread mention

Your teammates are trying to reach you in Microsoft Te=

ams

Someone sent a message in a high-priority chat

ss=3Dcta-button href=3D"https://t.co/SfwfxfBZXv">Reply, Go to conversation<=

/A> =

Microsoft Teams

AIN>

--===============1462528628==--

Microsoft Teams phish

Posted by Dave Yadallee on Thursday, August 13. 2026

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 13 Aug 2026 07:11:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.5 (FreeBSD))

(envelope-from )

id 1wuVCb-00000000PBN-1603

for dave@doctor.nl2k.ab.ca;

Thu, 13 Aug 2026 07:10:33 -0600

Resent-From: The Doctor

Resent-Date: Thu, 13 Aug 2026 07:10:33 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from smtpout.telepacific.net ([208.57.4.233]:36331 helo=smtp.telepacific.net)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.99.5 (FreeBSD))

(envelope-from )

id 1wuU5L-00000000KAh-2G9L

for doctor@nl2k.ab.ca;

Thu, 13 Aug 2026 05:59:09 -0600

Received: from CNABAL-PC10.king.local (unknown [64.60.196.69])

by smtp.telepacific.net (Postfix) with ESMTP id 69CD1125365;

Wed, 12 Aug 2026 19:34:01 -0700 (PDT)

Content-Type: multipart/alternative; boundary="===============1666873558=="

MIME-Version: 1.0

Subject: New Message on Microsoft Teams Meeting

To: Recipients

From: "Microsoft Teams"

Date: Wed, 12 Aug 2026 19:33:01 -0700

X-Spam_score: 8.2

X-Spam_score_int: 82

X-Spam_bar: ++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.

Content preview: Microsoft Teams Secure collaboration Work chat Hi, 1 unread

mention Your teammates are trying to reach you in Microsoft Teams Someone

sent a message in a high-priority chat Reply, Go to conversation Microsoft

Teams

Content analysis details: (8.2 points, 5.0 required)

pts rule name description

---- ---------------------- --------------------------------------------------

0.1 MISSING_MID Missing Message-Id: header

-0.7 RCVD_IN_DNSWL_LOW RBL: Sender listed at http://www.dnswl.org/, low

trust

[208.57.4.233 listed in list.dnswl.org]

1.2 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a relay in bl.spamcop.net

[Blocked - see ]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[64.60.196.69 listed in will-spam-for-food.eu.org]

[64.60.196.69 listed in will-spam-for-food.eu.org]

[64.60.196.69 listed in will-spam-for-food.eu.org]

[64.60.196.69 listed in will-spam-for-food.eu.org]

[64.60.196.69 listed in will-spam-for-food.eu.org]

[64.60.196.69 listed in will-spam-for-food.eu.org]

[64.60.196.69 listed in will-spam-for-food.eu.org]

[64.60.196.69 listed in will-spam-for-food.eu.org]

[208.57.4.233 listed in will-spam-for-food.eu.org]

[208.57.4.233 listed in will-spam-for-food.eu.org]

[208.57.4.233 listed in will-spam-for-food.eu.org]

[208.57.4.233 listed in will-spam-for-food.eu.org]

[208.57.4.233 listed in will-spam-for-food.eu.org]

[208.57.4.233 listed in will-spam-for-food.eu.org]

[208.57.4.233 listed in will-spam-for-food.eu.org]

[208.57.4.233 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[64.60.196.69 listed in dnsbl.ahbl.org]

[64.60.196.69 listed in dnsbl.ahbl.org]

[64.60.196.69 listed in dnsbl.ahbl.org]

[64.60.196.69 listed in dnsbl.ahbl.org]

[208.57.4.233 listed in dnsbl.ahbl.org]

[208.57.4.233 listed in dnsbl.ahbl.org]

[208.57.4.233 listed in dnsbl.ahbl.org]

[208.57.4.233 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[64.60.196.69 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[64.60.196.69 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[64.60.196.69 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[64.60.196.69 listed in dnsbl.ahbl.org]

3.6 RCVD_IN_SBL_CSS RBL: Received via a relay in Spamhaus SBL-CSS

[64.60.196.69 listed in zen.spamhaus.org]

1.5 RCVD_IN_SBL_XBL RBL: Received via a relay in Spamhaus SBL+XBL

[64.60.196.69 listed in sbl-xbl.spamhaus.org]

0.7 SPF_NEUTRAL SPF: sender does not match SPF record (neutral)

0.5 NO_RDNS Sending MTA has no reverse DNS (Postfix variant)

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[208.57.4.233 listed in bl.score.senderscore.com]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 HTML_MESSAGE BODY: HTML included in message

Subject: {SPAM?} New Message on Microsoft Teams Meeting

You will not see this in a MIME-aware mail reader.

--===============1666873558==

Content-Type: text/plain; charset="iso-8859-1"

MIME-Version: 1.0

Content-Transfer-Encoding: quoted-printable

Content-Description: Mail message body

=

Microsoft Teams

Secure collaboration Work chat

=

Hi, =

1 unread mention

=

Your teammates are trying to reach you in Microsoft Teams

Someone sent a message in a high-priority chat

Reply, Go to conversation Microsoft Teams

=

Regards,

Microsoft Teams

Microsoft Teams 2026 Microsoft Corporation, One Microsoft Way, Redmond, W=

A 98052

You're receiving this because someone mentioned you in a chat on Microsoft=

Teams.

--===============1666873558==

Content-Type: text/html; charset="iso-8859-1"

MIME-Version: 1.0

Content-Transfer-Encoding: quoted-printable

Content-Description: Mail message body

Microsoft Teams

Microsoft Teams

Secure collaboration Work chat

Hi,

1 unread mention

Your teammates are trying to reach you in Microsoft Te=

ams

Someone sent a message in a high-priority chat

ss=3Dcta-button href=3D"https://t.co/SfwfxfBZXv">Reply, Go to conversation<=

/A> =

Microsoft Teams

AIN>

--===============1666873558==--

Microsoft Teams phish

Posted by Dave Yadallee on Thursday, August 13. 2026

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 13 Aug 2026 07:11:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.5 (FreeBSD))

(envelope-from )

id 1wuVCQ-00000000P8b-0k9a

for dave@doctor.nl2k.ab.ca;

Thu, 13 Aug 2026 07:10:22 -0600

Resent-From: The Doctor

Resent-Date: Thu, 13 Aug 2026 07:10:22 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from smtpout.telepacific.net ([208.57.4.233]:33877 helo=smtp.telepacific.net)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.99.5 (FreeBSD))

(envelope-from )

id 1wuTKC-00000000AS9-2ggY

for doctor@netknow.ca;

Thu, 13 Aug 2026 05:10:26 -0600

Received: from CNABAL-PC10.king.local (unknown [64.60.196.69])

by smtp.telepacific.net (Postfix) with ESMTP id BA9801250CA;

Wed, 12 Aug 2026 19:33:39 -0700 (PDT)

Content-Type: multipart/alternative; boundary="===============0546516147=="

MIME-Version: 1.0

Subject: New Message on Microsoft Teams Meeting

To: Recipients

From: "Microsoft Teams"

Date: Wed, 12 Aug 2026 19:32:39 -0700

X-Spam_score: 8.2

X-Spam_score_int: 82

X-Spam_bar: ++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.

Content preview: Microsoft Teams Secure collaboration Work chat Hi, 1 unread

mention Your teammates are trying to reach you in Microsoft Teams Someone

sent a message in a high-priority chat Reply, Go to conversation Microsoft

Teams

Content analysis details: (8.2 points, 5.0 required)

pts rule name description

---- ---------------------- --------------------------------------------------

0.1 MISSING_MID Missing Message-Id: header

-0.7 RCVD_IN_DNSWL_LOW RBL: Sender listed at http://www.dnswl.org/, low

trust

[208.57.4.233 listed in list.dnswl.org]

1.2 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a relay in bl.spamcop.net

[Blocked - see ]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[64.60.196.69 listed in will-spam-for-food.eu.org]

[64.60.196.69 listed in will-spam-for-food.eu.org]

[64.60.196.69 listed in will-spam-for-food.eu.org]

[64.60.196.69 listed in will-spam-for-food.eu.org]

[64.60.196.69 listed in will-spam-for-food.eu.org]

[64.60.196.69 listed in will-spam-for-food.eu.org]

[64.60.196.69 listed in will-spam-for-food.eu.org]

[64.60.196.69 listed in will-spam-for-food.eu.org]

[208.57.4.233 listed in will-spam-for-food.eu.org]

[208.57.4.233 listed in will-spam-for-food.eu.org]

[208.57.4.233 listed in will-spam-for-food.eu.org]

[208.57.4.233 listed in will-spam-for-food.eu.org]

[208.57.4.233 listed in will-spam-for-food.eu.org]

[208.57.4.233 listed in will-spam-for-food.eu.org]

[208.57.4.233 listed in will-spam-for-food.eu.org]

[208.57.4.233 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[64.60.196.69 listed in dnsbl.ahbl.org]

[64.60.196.69 listed in dnsbl.ahbl.org]

[64.60.196.69 listed in dnsbl.ahbl.org]

[64.60.196.69 listed in dnsbl.ahbl.org]

[208.57.4.233 listed in dnsbl.ahbl.org]

[208.57.4.233 listed in dnsbl.ahbl.org]

[208.57.4.233 listed in dnsbl.ahbl.org]

[208.57.4.233 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[64.60.196.69 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[64.60.196.69 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[64.60.196.69 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[64.60.196.69 listed in dnsbl.ahbl.org]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

3.6 RCVD_IN_SBL_CSS RBL: Received via a relay in Spamhaus SBL-CSS

[64.60.196.69 listed in zen.spamhaus.org]

1.5 RCVD_IN_SBL_XBL RBL: Received via a relay in Spamhaus SBL+XBL

[64.60.196.69 listed in sbl-xbl.spamhaus.org]

0.7 SPF_NEUTRAL SPF: sender does not match SPF record (neutral)

0.5 NO_RDNS Sending MTA has no reverse DNS (Postfix variant)

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[208.57.4.233 listed in bl.score.senderscore.com]

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 HTML_MESSAGE BODY: HTML included in message

Subject: {SPAM?} New Message on Microsoft Teams Meeting

You will not see this in a MIME-aware mail reader.

--===============0546516147==

Content-Type: text/plain; charset="iso-8859-1"

MIME-Version: 1.0

Content-Transfer-Encoding: quoted-printable

Content-Description: Mail message body

=

Microsoft Teams

Secure collaboration Work chat

=

Hi, =

1 unread mention

=

Your teammates are trying to reach you in Microsoft Teams

Someone sent a message in a high-priority chat

Reply, Go to conversation Microsoft Teams

=

Regards,

Microsoft Teams

Microsoft Teams 2026 Microsoft Corporation, One Microsoft Way, Redmond, W=

A 98052

You're receiving this because someone mentioned you in a chat on Microsoft=

Teams.

--===============0546516147==

Content-Type: text/html; charset="iso-8859-1"

MIME-Version: 1.0

Content-Transfer-Encoding: quoted-printable

Content-Description: Mail message body

Microsoft Teams

Microsoft Teams

Secure collaboration Work chat

Hi,

1 unread mention

Your teammates are trying to reach you in Microsoft Te=

ams

Someone sent a message in a high-priority chat

ss=3Dcta-button href=3D"https://t.co/SfwfxfBZXv">Reply, Go to conversation<=

/A> =

Microsoft Teams

AIN>

--===============0546516147==--

Microsoft Teams phish

Posted by Dave Yadallee on Thursday, August 13. 2026

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 13 Aug 2026 04:36:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.5 (FreeBSD))

(envelope-from )

id 1wuSmz-0000000056o-21iW

for dave@doctor.nl2k.ab.ca;

Thu, 13 Aug 2026 04:35:57 -0600

Resent-From: The Doctor

Resent-Date: Thu, 13 Aug 2026 04:35:57 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from smtp.telepacific.net ([208.57.4.233]:45663)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.99.5 (FreeBSD))

(envelope-from )

id 1wuPqH-00000000Mdb-0tXw

for doctor@edmontonab.ca;

Thu, 13 Aug 2026 01:27:21 -0600

Received: from CNABAL-PC10.king.local (unknown [64.60.196.69])

by smtp.telepacific.net (Postfix) with ESMTP id 4BC1E124435;

Wed, 12 Aug 2026 19:31:43 -0700 (PDT)

Content-Type: multipart/alternative; boundary="===============1502743536=="

MIME-Version: 1.0

Subject: New Message on Microsoft Teams Meeting

To: Recipients

From: "Microsoft Teams"

Date: Wed, 12 Aug 2026 19:30:43 -0700

X-Spam_score: 8.2

X-Spam_score_int: 82

X-Spam_bar: ++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.

Content preview: Microsoft Teams Secure collaboration Work chat Hi, 1 unread

mention Your teammates are trying to reach you in Microsoft Teams Someone

sent a message in a high-priority chat Reply, Go to conversation Microsoft

Teams

Content analysis details: (8.2 points, 5.0 required)

pts rule name description

---- ---------------------- --------------------------------------------------

0.1 MISSING_MID Missing Message-Id: header

-0.7 RCVD_IN_DNSWL_LOW RBL: Sender listed at http://www.dnswl.org/, low

trust

[208.57.4.233 listed in list.dnswl.org]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

3.6 RCVD_IN_SBL_CSS RBL: Received via a relay in Spamhaus SBL-CSS

[64.60.196.69 listed in zen.spamhaus.org]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[208.57.4.233 listed in bl.score.senderscore.com]

1.5 RCVD_IN_SBL_XBL RBL: Received via a relay in Spamhaus SBL+XBL

[64.60.196.69 listed in sbl-xbl.spamhaus.org]

1.2 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a relay in bl.spamcop.net

[Blocked - see ]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[64.60.196.69 listed in will-spam-for-food.eu.org]

[64.60.196.69 listed in will-spam-for-food.eu.org]

[64.60.196.69 listed in will-spam-for-food.eu.org]

[64.60.196.69 listed in will-spam-for-food.eu.org]

[64.60.196.69 listed in will-spam-for-food.eu.org]

[64.60.196.69 listed in will-spam-for-food.eu.org]

[64.60.196.69 listed in will-spam-for-food.eu.org]

[64.60.196.69 listed in will-spam-for-food.eu.org]

[208.57.4.233 listed in will-spam-for-food.eu.org]

[208.57.4.233 listed in will-spam-for-food.eu.org]

[208.57.4.233 listed in will-spam-for-food.eu.org]

[208.57.4.233 listed in will-spam-for-food.eu.org]

[208.57.4.233 listed in will-spam-for-food.eu.org]

[208.57.4.233 listed in will-spam-for-food.eu.org]

[208.57.4.233 listed in will-spam-for-food.eu.org]

[208.57.4.233 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[64.60.196.69 listed in dnsbl.ahbl.org]

[64.60.196.69 listed in dnsbl.ahbl.org]

[64.60.196.69 listed in dnsbl.ahbl.org]

[64.60.196.69 listed in dnsbl.ahbl.org]

[208.57.4.233 listed in dnsbl.ahbl.org]

[208.57.4.233 listed in dnsbl.ahbl.org]

[208.57.4.233 listed in dnsbl.ahbl.org]

[208.57.4.233 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[64.60.196.69 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[64.60.196.69 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[64.60.196.69 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[64.60.196.69 listed in dnsbl.ahbl.org]

0.7 SPF_NEUTRAL SPF: sender does not match SPF record (neutral)

0.5 NO_RDNS Sending MTA has no reverse DNS (Postfix variant)

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 HTML_MESSAGE BODY: HTML included in message

Subject: {SPAM?} New Message on Microsoft Teams Meeting

You will not see this in a MIME-aware mail reader.

--===============1502743536==

Content-Type: text/plain; charset="iso-8859-1"

MIME-Version: 1.0

Content-Transfer-Encoding: quoted-printable

Content-Description: Mail message body

=

Microsoft Teams

Secure collaboration Work chat

=

Hi, =

1 unread mention

=

Your teammates are trying to reach you in Microsoft Teams

Someone sent a message in a high-priority chat

Reply, Go to conversation Microsoft Teams

=

Regards,

Microsoft Teams

Microsoft Teams 2026 Microsoft Corporation, One Microsoft Way, Redmond, W=

A 98052

You're receiving this because someone mentioned you in a chat on Microsoft=

Teams.

--===============1502743536==

Content-Type: text/html; charset="iso-8859-1"

MIME-Version: 1.0

Content-Transfer-Encoding: quoted-printable

Content-Description: Mail message body

Microsoft Teams

Microsoft Teams

Secure collaboration Work chat

Hi,

1 unread mention

Your teammates are trying to reach you in Microsoft Te=

ams

Someone sent a message in a high-priority chat

ss=3Dcta-button href=3D"https://t.co/SfwfxfBZXv">Reply, Go to conversation<=

/A> =

Microsoft Teams

AIN>

--===============1502743536==--

Microsoft Teams phish

Posted by Dave Yadallee on Thursday, August 13. 2026

Microsoft Teams

Secure collaboration Work chat

Hi,

1 unread mention

Your teammates are trying to reach you in Microsoft Te=

ams

Someone sent a message in a high-priority chat

ss=3Dcta-button href=3D"https://t.co/SfwfxfBZXv">Reply, Go to conversation<=

/A> =

Microsoft Teams

AIN>

--===============1502743536==--

Microsoft teams phish

Posted by Dave Yadallee on Thursday, August 13. 2026

Microsoft Teams

Secure collaboration Work chat

Hi,

1 unread mention

Your teammates are trying to reach you in Microsoft Te=

ams

Someone sent a message in a high-priority chat

ss=3Dcta-button href=3D"https://t.co/SfwfxfBZXv">Reply, Go to conversation<=

/A> =

Microsoft Teams

AIN>

--===============1502743536==--

Microsoft Teams phish

Posted by Dave Yadallee on Thursday, August 13. 2026

Microsoft Teams

Secure collaboration Work chat

Hi,

1 unread mention

Your teammates are trying to reach you in Microsoft Te=

ams

Someone sent a message in a high-priority chat

ss=3Dcta-button href=3D"https://t.co/SfwfxfBZXv">Reply, Go to conversation<=

/A> =

Microsoft Teams

AIN>

--===============1502743536==--

Microsoft Teams phish

Posted by Dave Yadallee on Thursday, August 13. 2026

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 13 Aug 2026 04:36:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.5 (FreeBSD))

(envelope-from )

id 1wuSms-0000000053M-0mx1

for dave@doctor.nl2k.ab.ca;

Thu, 13 Aug 2026 04:35:50 -0600

Resent-From: The Doctor

Resent-Date: Thu, 13 Aug 2026 04:35:50 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from smtp-out.telepacific.net ([208.57.4.233]:49911 helo=smtp.telepacific.net)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.99.5 (FreeBSD))

(envelope-from )

id 1wuMCt-000000006Am-0OkK

for doctor@edmontonab.ca;

Wed, 12 Aug 2026 21:34:24 -0600

Received: from CNABAL-PC10.king.local (unknown [64.60.196.69])

by smtp.telepacific.net (Postfix) with ESMTP id 1A242123296;

Wed, 12 Aug 2026 19:28:55 -0700 (PDT)

Content-Type: multipart/alternative; boundary="===============0532043777=="

MIME-Version: 1.0

Subject: New Message on Microsoft Teams Meeting

To: Recipients

From: "Microsoft Teams"

Date: Wed, 12 Aug 2026 19:27:55 -0700

X-Spam_score: 8.2

X-Spam_score_int: 82

X-Spam_bar: ++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.

Content preview: Microsoft Teams Secure collaboration Work chat Hi, 1 unread

mention Your teammates are trying to reach you in Microsoft Teams Someone

sent a message in a high-priority chat Reply, Go to conversation Microsoft

Teams

Content analysis details: (8.2 points, 5.0 required)

pts rule name description

---- ---------------------- --------------------------------------------------

0.1 MISSING_MID Missing Message-Id: header

-0.7 RCVD_IN_DNSWL_LOW RBL: Sender listed at http://www.dnswl.org/, low

trust

[208.57.4.233 listed in list.dnswl.org]

1.2 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a relay in bl.spamcop.net

[Blocked - see ]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[64.60.196.69 listed in dnsbl.ahbl.org]

[64.60.196.69 listed in dnsbl.ahbl.org]

[64.60.196.69 listed in dnsbl.ahbl.org]

[64.60.196.69 listed in dnsbl.ahbl.org]

[208.57.4.233 listed in dnsbl.ahbl.org]

[208.57.4.233 listed in dnsbl.ahbl.org]

[208.57.4.233 listed in dnsbl.ahbl.org]

[208.57.4.233 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[64.60.196.69 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[64.60.196.69 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[64.60.196.69 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[64.60.196.69 listed in dnsbl.ahbl.org]

3.6 RCVD_IN_SBL_CSS RBL: Received via a relay in Spamhaus SBL-CSS

[64.60.196.69 listed in zen.spamhaus.org]

1.5 RCVD_IN_SBL_XBL RBL: Received via a relay in Spamhaus SBL+XBL

[64.60.196.69 listed in sbl-xbl.spamhaus.org]

0.7 SPF_NEUTRAL SPF: sender does not match SPF record (neutral)

0.5 NO_RDNS Sending MTA has no reverse DNS (Postfix variant)

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 HTML_MESSAGE BODY: HTML included in message

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[208.57.4.233 listed in bl.score.senderscore.com]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[208.57.4.233 listed in will-spam-for-food.eu.org]

[208.57.4.233 listed in will-spam-for-food.eu.org]

[208.57.4.233 listed in will-spam-for-food.eu.org]

[208.57.4.233 listed in will-spam-for-food.eu.org]

[208.57.4.233 listed in will-spam-for-food.eu.org]

[208.57.4.233 listed in will-spam-for-food.eu.org]

[208.57.4.233 listed in will-spam-for-food.eu.org]

[208.57.4.233 listed in will-spam-for-food.eu.org]

[64.60.196.69 listed in will-spam-for-food.eu.org]

[64.60.196.69 listed in will-spam-for-food.eu.org]

[64.60.196.69 listed in will-spam-for-food.eu.org]

[64.60.196.69 listed in will-spam-for-food.eu.org]

[64.60.196.69 listed in will-spam-for-food.eu.org]

[64.60.196.69 listed in will-spam-for-food.eu.org]

[64.60.196.69 listed in will-spam-for-food.eu.org]

[64.60.196.69 listed in will-spam-for-food.eu.org]

Subject: {SPAM?} New Message on Microsoft Teams Meeting

You will not see this in a MIME-aware mail reader.

--===============0532043777==

Content-Type: text/plain; charset="iso-8859-1"

MIME-Version: 1.0

Content-Transfer-Encoding: quoted-printable

Content-Description: Mail message body

=

Microsoft Teams

Secure collaboration Work chat

=

Hi, =

1 unread mention

=

Your teammates are trying to reach you in Microsoft Teams

Someone sent a message in a high-priority chat

Reply, Go to conversation Microsoft Teams

=

Regards,

Microsoft Teams

Microsoft Teams 2026 Microsoft Corporation, One Microsoft Way, Redmond, W=

A 98052

You're receiving this because someone mentioned you in a chat on Microsoft=

Teams.

--===============0532043777==

Content-Type: text/html; charset="iso-8859-1"

MIME-Version: 1.0

Content-Transfer-Encoding: quoted-printable

Content-Description: Mail message body

Microsoft Teams

Microsoft Teams

Secure collaboration Work chat

Hi,

1 unread mention

Your teammates are trying to reach you in Microsoft Te=

ams

Someone sent a message in a high-priority chat

ss=3Dcta-button href=3D"https://t.co/SfwfxfBZXv">Reply, Go to conversation<=

/A> =

Microsoft Teams

AIN>

--===============0532043777==--

Loan phish from Google Gmail

Posted by Dave Yadallee on Wednesday, August 12. 2026

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Wed, 12 Aug 2026 14:58:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.5 (FreeBSD))

(envelope-from )

id 1wuG1H-000000006oP-28e8

for dave@doctor.nl2k.ab.ca;

Wed, 12 Aug 2026 14:57:51 -0600

Resent-From: The Doctor

Resent-Date: Wed, 12 Aug 2026 14:57:51 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-pf1-f181.google.com ([209.85.210.181]:42046)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.99.5 (FreeBSD))

(envelope-from )

id 1wuFkv-000000003HO-1Cjn

for sales@nk.ca;

Wed, 12 Aug 2026 14:41:05 -0600

Received: by mail-pf1-f181.google.com with SMTP id d2e1a72fcca58-84847482584so266266b3a.0

for ; Wed, 12 Aug 2026 13:40:09 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=kesefmarketing.com; s=google; t=1786567204; x=1787172004; darn=nk.ca;

h=list-unsubscribe-post:list-unsubscribe:in-reply-to:references

:message-id:date:to:from:subject:mime-version:content-type:from:to

:cc:subject:date:message-id:reply-to:content-type;

bh=tbZIXyF/GNVVf8IjUiKQ+oV/jqy4i5laBakVQZhtqkY=;

b=EYBGAeo33Zcg2OG0YC0bcK2kJBeffD0WtKoDiiHN4WUuehJ24U4VeiNlHX2v/AjK7b

NCrmIa+OFdE34Owonou3Ga51SnyJ7GW+uJDvKhE7ZPtbe6FZeAMNTcRqS+cdDZsoElnj

1kQ4TpSRbhMOZ3KQ52QaAY1szfqnHAHxnN5nOB6vCd5WBbZy+M/wL8fSQ1TKqyqQF6gD

0eesvF3tzU3Oi0D1ZwzCAnxLQt5ytGMTW7ojbwrtUn3IYCcSk6eHvaeBKpsf/fbAWwZP

uNlSj5xCYR0SuUSFFp0dU+barUCAQQhVxaBd8DCOZiIIwfOhMRTjeOA+fPqhvZgcnrV4

FJ/A==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20251104; t=1786567204; x=1787172004;

h=list-unsubscribe-post:list-unsubscribe:in-reply-to:references

:message-id:date:to:from:subject:mime-version:content-type:x-gm-gg

:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to

:content-type;

bh=tbZIXyF/GNVVf8IjUiKQ+oV/jqy4i5laBakVQZhtqkY=;

b=kvjrmShxRPm7Inmjf59poq+05M1BuSt5vuZP29mSns2/u05YNrQsVAqkJfiWxuzRH/

3MBmBDWqVm9R0W8IX1PjNmreE7xK4n2gx4HHE8OC8fAcSy2cV9A3duLQZXw6183iGlaY

DaCT3UCYznoPVBULureC7Z6JZGltL81/9NkfQ4i2LTdNGKuTGqHRui8UwvdSsRG11KWo

ECVHff/2gWiaoxkirYafg72xZUCFpaomZuZuluJuxEab6JCCUcb38ndewITEgAKaGkTk

BSry/7Ftjee1ma8ZeZYU20z4BMXDssDSzzf75UvxEjDRs6T1xB2fjkZJVWr3rMC12QS1

QGCQ==

X-Gm-Message-State: AOJu0Yw1AOcTHfbfQ/jJrMBQA1dQwMR3cpRKOyO3mIZaI8STo5kE4NZf

yf2wb3h6BDvpl36KwniUtjIkrwCS/h9XjRd6x4HF2ySu9l6pV9IzVdpf/kMC54biaFE3CB2Qmty

xR5Qx

X-Gm-Gg: AR+sD11t3seTxUqVbrNXpvLfZicFGyHG6GS5mYzW9qZrtNqO9k/dr2NAsJhSRYouF24

YW9GL8CdAfvYI10gVLyG+ocmEwWS7Vs6BoSn/YGMMNTcfCRIJYrgcrvTZlmtkQ2oYICNGkHA2Bg

zCVLn/OZ03KmScpyJWiafS7nLt+U+mhgjRwwcJehZiVey+oBlTcXeDesupLe+oJdyUCo92dbIlJ

V/bWQjrIs6B6LOxeYr3iuGVrwi62wA/nkHtG1IYYG+/H39VGnzKjNfq92uxw6gCKl97cmiMsK/R

DueJszsJyvNOYkzDrZcmdvo2clcDW+IProQ1gHiXFkVX8rHF6eIIodA8gkt0g3c2Tq2RfbjPTrt

oVca6U+le+hOb6kqHNlHnhS2nIqgjZtmLSbNJo6nfk+oCzDgQ3nelxzc0uyNZsGc1Q6bdllnqCT

Dy0s5BPfD+hjMhpAuFqeAJgOfdqzStv9XM0Ewg1TEpSmK9p8CXuD/uB7RkwXNGNE8QdA3goRok4

/YXulMX9c3Mb78D3xHhGEWfMimz8beqH4iCznTJmoM=

X-Received: by 2002:a05:6a00:14d5:b0:847:70f4:613f with SMTP id d2e1a72fcca58-84fc7c1ec38mr395443b3a.12.1786567203427;

Wed, 12 Aug 2026 13:40:03 -0700 (PDT)

Received: from smtpgw.close.com (am11-natgw-c0.close.com. [54.200.191.154])

by smtp.gmail.com with ESMTPSA id d2e1a72fcca58-84fc5a68c60sm114648b3a.48.2026.08.12.13.40.02

for

(version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256);

Wed, 12 Aug 2026 13:40:02 -0700 (PDT)

Content-Type: multipart/mixed; boundary="===============7946878310728263274=="

MIME-Version: 1.0

Subject: Re: Kesef Marketing | Smarter Access to Business Loans

From: =?utf-8?q?Lilian_Llanillo?=

To: =?utf-8?q?Gurkirat_Wirring?=

Date: Wed, 12 Aug 2026 20:40:02 +0000

Message-ID: <178656720216.7.1487486787664217380@smtpgw.close.com>

X-CLOSEIO-EMAIL-ID: acti_nk8LpFsOBhJSXuOowoxSS5NguctysG6eZdZgsfW6yYW

References: <178646337461.7.1240611996543057914@smtpgw.close.com> <178646337461.7.8575171778634196756@smtpgw.close.com>

In-Reply-To: <178646337461.7.1240611996543057914@smtpgw.close.com>

List-Unsubscribe:

List-Unsubscribe-Post: List-Unsubscribe=One-Click

--===============7946878310728263274==

Content-Type: multipart/alternative; boundary="===============6079678544044073755=="

MIME-Version: 1.0

--===============6079678544044073755==

Content-Type: text/plain; charset="utf-8"

MIME-Version: 1.0

Content-Transfer-Encoding: quoted-printable

**Hi Gurkirat, **

=20

**We noticed your Cash Advance application is still incomplete.**

=20

**You=E2=80=99re just a few steps away from securing up to $800,000 in fund=

ing within

48 hours.**

=20

**To move forward, please complete your application here: =20

**

[**Click to Start your Application

here**](https://form.jotform.com/260672364104452?lead_id=3Dlead_1MVGGnNXqVx=

8dbGrHgSfKaWzWuBT6yMLDjaGHIpxaD3&legalBusiness=3DN

K

MAINTENANCE&fullName\[first\]=3DGurkirat&fullName\[last\]=3DWirring&leadTyp=

e=3DAutomation)

=20

**and upload your last 3 months of bank statements. This will allow us to

finalize your review and match you with the best available funding options.=

**

=20

**If you have any questions or would prefer to speak directly, feel free to

call me at +1-866-216-5475 or 873-771-7630**

=20

**Best regards, =20

**

=20

**Lilian Llanillo**

**FUNDING ADVISOR**

=20

![email $16px$.png](https://closeio-

filepicker.s3.amazonaws.com/2026-05-14%2F1RDDVOgmo8WoImXFkS0Dtk%2F177877403=

9066-email+%2816px%29.png)****[**lilian@kesefmarketing.com**](https://lilia=

n@kesefmarketing.com)

![phone-call $16px$.png](https://closeio-

filepicker.s3.amazonaws.com/2026-05-14%2F1RDDVOgmo8WoImXFkS0Dtk%2F177877413=

7354-phone-

call+%2816px%29.png)**+1 (873) 771-7630**

**____________________________**

![IMG_5340.jpg](https://closeio-

filepicker.s3.amazonaws.com/2026-05-14%2F1RDDVOgmo8WoImXFkS0Dtk%2F177877416=

5068-IMG_5340.jpg)

=20

To stop receiving these emails, click

[here](https://app.close.com/go/unsubscribe/orga_WJQdcK5MUUa02rLIty6GVDnil9=

kHSKU8WElV6ueTPiF/sales%40nk.ca/GK6U1JDQJSfaf6

--tg9gajA9HdvShNSyH_DgbhmTyc8=3D/).

=20

=20

On Aug 11, 2026, at 09:49 AM, Lilian Llanillo

wrote: =20

> **Hi Gurkirat,**

>

> =20

>

>

> **This is Lilian Llanillo from Kesef Marketing.**

>

> =20

>

>

> **Welcome! I wanted to personally reach out and thank you for your intere=

st

> in business funding. We work with lenders across Canada to provide reliab=

le

> funding solutions that support growth, manage cash flow, and cover upcomi=

ng

> expenses=E2=80=94while helping you access competitive interest rates.**

>

> =20

>

>

> **If you=E2=80=99re open to exploring your options, you can get started h=

ere: =20

> **[**Click Here To Start Your

> Application**](https://form.jotform.com/260672364104452?lead_id=3Dlead_1M=

VGGnNXqVx8dbGrHgSfKaWzWuBT6yMLDjaGHIpxaD3&legalBusiness=3DN

> K

> MAINTENANCE&fullName\[first\]=3DGurkirat&fullName\[last\]=3DWirring&leadT=

ype=3DAutomation)

>

> **Once submitted, our team will review your information and present the b=

est

> available funding options tailored to your needs.**

>

> =20

>

>

> **If you have any questions or would prefer to speak directly, feel free =

to

> call me at +1-866-216-5475 or 873-771-7630**

>

> =20

>

>

> **Looking forward to connecting.**

>

> =20

>

>

> **Best regards, =20

> **

>

> =20

>

>

> **Lilian Llanillo**

>

> **FUNDING ADVISOR**

>

> =20

>

>

> ![email $16px$.png](https://closeio-

> filepicker.s3.amazonaws.com/2026-05-14%2F1RDDVOgmo8WoImXFkS0Dtk%2F1778774=

039066-email+%2816px%29.png)****[**lilian@kesefmarketing.com**](https://lil=

ian@kesefmarketing.com)

>

> ![phone-call $16px$.png](https://closeio-

> filepicker.s3.amazonaws.com/2026-05-14%2F1RDDVOgmo8WoImXFkS0Dtk%2F1778774=

137354-phone-

> call+%2816px%29.png)**+1 (873) 771-7630**

>

> **____________________________**

>

> ![IMG_5340.jpg](https://closeio-

> filepicker.s3.amazonaws.com/2026-05-14%2F1RDDVOgmo8WoImXFkS0Dtk%2F1778774=

165068-IMG_5340.jpg)

>

> =20

>

>

> To stop receiving these emails, click

> [here](https://app.close.com/go/unsubscribe/orga_WJQdcK5MUUa02rLIty6GVDni=

l9kHSKU8WElV6ueTPiF/sales%40nk.ca/GK6U1JDQJSfaf6

> --tg9gajA9HdvShNSyH_DgbhmTyc8=3D/).

--===============6079678544044073755==

Content-Type: text/html; charset="utf-8"

MIME-Version: 1.0

Content-Transfer-Encoding: quoted-printable

Hi Gurkirat,

W=

e noticed your Cash Advance application is still incomplete.

You=E2=80=99re just a few steps away from secur=

ing up to $800,000 in funding within 48 hours.

To move forward, please complete your application here:

strong>

id=3Dlead_1MVGGnNXqVx8dbGrHgSfKaWzWuBT6yMLDjaGHIpxaD3&legalBusiness=3DN=

K MAINTENANCE&fullName[first]=3DGurkirat&fullName[last]=3DWirring&=

amp;leadType=3DAutomation" rel=3D"noopener noreferrer nofollow">Cli=

ck to Start your Application here

rong>and upload your last 3 months of bank statements. This will allow us t=

o finalize your review and match you with the best available funding option=

s.

If you have any questions or w=

ould prefer to speak directly, feel free to call me at +1-866-216-5475 or 8=

73-771-7630

Best regards,

ont-weight: 700;">Lilian Llanillo

tyle=3D"font-weight: 700; color: rgb(57, 208, 150);">FUNDING ADVISOR=

3.amazonaws.com/2026-05-14%2F1RDDVOgmo8WoImXFkS0Dtk%2F1778774039066-email+%=

2816px%29.png" alt=3D"email (16px).png">
700;">
et=3D"_blank" rel=3D"noopener noreferrer nofollow">
ont-weight: 700;">lilian@kesefmarketing.com

<=

img src=3D"https://closeio-filepicker.s3.amazonaws.com/2026-05-14%2F1RDDVOg=

mo8WoImXFkS0Dtk%2F1778774137354-phone-call+%2816px%29.png" alt=3D"phone-cal=

l (16px).png"> +1 (873) 771-7630<=

/span>

_______=

_____________________

-filepicker.s3.amazonaws.com/2026-05-14%2F1RDDVOgmo8WoImXFkS0Dtk%2F17787741=

65068-IMG_5340.jpg" alt=3D"IMG_5340.jpg" style=3D"width: 159px; height: 64.=

1129px;">

ribe-footer">

To stop receiv=

ing these emails, click
a_WJQdcK5MUUa02rLIty6GVDnil9kHSKU8WElV6ueTPiF/sales%40nk.ca/GK6U1JDQJSfaf6-=

-tg9gajA9HdvShNSyH_DgbhmTyc8=3D/" target=3D"_blank" rel=3D"noopener norefer=

rer nofollow">here.

ed-text">

On Aug 11, 2026, at 09:49 AM, Lilian Llanillo <lilian@k=

esefmarketing.com> wrote:

Hi G=

urkirat,

This is Lilian Llanillo =

from Kesef Marketing.

Welcome! I =

wanted to personally reach out and thank you for your interest in business =

funding. We work with lenders across Canada to provide reliable funding sol=

utions that support growth, manage cash flow, and cover upcoming expenses=

=E2=80=94while helping you access competitive interest rates.
>

If you=E2=80=99re open to exploring your optio=

ns, you can get started here:

om/260672364104452?lead_id=3Dlead_1MVGGnNXqVx8dbGrHgSfKaWzWuBT6yMLDjaGHIpxa=

D3&legalBusiness=3DN K MAINTENANCE&fullName[first]=3DGurkirat&f=

ullName[last]=3DWirring&leadType=3DAutomation" rel=3D"noopener noreferr=

er nofollow">Click Here To Start Your Application
>
Once submitted, our team will review your information and pre=

sent the best available funding options tailored to your needs.
iv>

If you have any questions or would prefer to=

speak directly, feel free to call me at +1-866-216-5475 or 873-771-7630
trong>

Looking forward to connecting.
ong>

Best regards,

data-system-generated=3D"signature">

eight: 700;">Lilian Llanillo

=3D"font-weight: 700; color: rgb(57, 208, 150);">FUNDING ADVISOR
rong>

azonaws.com/2026-05-14%2F1RDDVOgmo8WoImXFkS0Dtk%2F1778774039066-email+%2816=

px%29.png" alt=3D"email (16px).png">
;">
=3D"_blank" rel=3D"noopener noreferrer nofollow">
t-weight: 700;">lilian@kesefmarketing.com

g src=3D"https://closeio-filepicker.s3.amazonaws.com/2026-05-14%2F1RDDVOgmo=

8WoImXFkS0Dtk%2F1778774137354-phone-call+%2816px%29.png" alt=3D"phone-call =

(16px).png"> +1 (873) 771-7630
pan>
_________=

___________________

ilepicker.s3.amazonaws.com/2026-05-14%2F1RDDVOgmo8WoImXFkS0Dtk%2F1778774165=

068-IMG_5340.jpg" alt=3D"IMG_5340.jpg" style=3D"width: 159px; height: 64.11=

29px;">

be-footer">
To stop receivin=

g these emails, click
WJQdcK5MUUa02rLIty6GVDnil9kHSKU8WElV6ueTPiF/sales%40nk.ca/GK6U1JDQJSfaf6--t=

g9gajA9HdvShNSyH_DgbhmTyc8=3D/" target=3D"_blank" rel=3D"noopener noreferre=

r nofollow">here.

://ml.closeml.com/t/nk8LpFsOBhJSXuOowoxSS5NguctysG6eZdZgsfW6yYW/YVFsbTnwSw.=

png" alt=3D"" width=3D"1" height=3D"1" />

--===============6079678544044073755==--

--===============7946878310728263274==--

Categories: Google Gmail Spam, Phish

0 Comments

Charity donation spam from Google Gmail
Posted by Dave Yadallee on Wednesday, August 12. 2026

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Wed, 12 Aug 2026 14:58:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.5 (FreeBSD))

(envelope-from )

id 1wuG0b-000000006hr-3kqP

for dave@doctor.nl2k.ab.ca;

Wed, 12 Aug 2026 14:57:09 -0600

Resent-From: The Doctor

Resent-Date: Wed, 12 Aug 2026 14:57:09 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-oo1-f43.google.com ([209.85.161.43]:44210)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.99.5 (FreeBSD))

(envelope-from )

id 1wuDtw-000000008wZ-3cYs

for bin@nl2k.ab.ca;

Wed, 12 Aug 2026 12:42:17 -0600

Received: by mail-oo1-f43.google.com with SMTP id 006d021491bc7-6a168dc590cso1061657eaf.0

for ; Wed, 12 Aug 2026 11:41:21 -0700 (PDT)

ARC-Seal: i=1; a=rsa-sha256; t=1786560075; cv=none;

d=google.com; s=arc-20260327;

b=ojh/dmeC/zE/1v2xPiZ910wq3lSSgwQaHOpvdEtUzfNo1DAKIIV7ksZqBjTmy3WDcs

NTZq4XZ86BMrbAZzeQdkvU9Sc9uVpo27q3N953eUSCrl480psPBd/8H2rEPxkwV4nazg

2KvbkeCK56DpqXJWTSc5S3UKVEQkqUCEs/GYTowh5nScCKoquq/paEt1EkjTu7snuF28

u8fmsmH4AoMsePED9Qp78T8zL/0RgnA4MqDBlIGGVsn6tIswPiuT1TQWYwZp9de99gv7

beZz6QO1yKVPQKnbQUH7E8Qsmd6jw2nykWgGa46Yg+h2Z7Vr+qbfLJNzpaxhJWu1cOQR

fIlg==

ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20260327;

h=to:subject:message-id:date:from:reply-to:mime-version

:dkim-signature;

bh=sCEQzu8upI9ZeYLWO1+SO/xtyTcIxNZesGTV7nuZiic=;

fh=Q/dGJ/Cv89OtrXCiLLKR7ggGXIAbJq64SMOAMdngurI=;

b=kyr6BhhjNF+qP3WR1cJz7+8M6c1e6rSYlXKE+36S3ZGc3Mnl523uLMm0Mtv4TnxA0R

8ukXwB9Hr2egUzLzwVHtzs1TN5PAw6E+xh+JOtn53xcaOFB8uivvjCMT6qfIXkgn7WgA

u65zTAXqNE6D0bF9F+XUGNch5892Fra5kEAXv7MV6u6VkIQEpskoQGxJb+lY9NpAb0wb

rvtgb8ohzv3JeH7pi8UYF/AYzaRyqa6UAeN31cIt4tqFu1TmcZ0HKPnZ3Qtg0iBmUzbb

yhR4tpweGVzfKw9V1Fq4MrQeV/kf22CSAXmHtcCCh7BqLI0rqAn0/gyFVQGjrPdYiF7v

eXFw==;

darn=nl2k.ab.ca

ARC-Authentication-Results: i=1; mx.google.com; arc=none

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=jisuniversity.ac.in; s=google; t=1786560075; x=1787164875; darn=nl2k.ab.ca;

h=content-type:to:subject:message-id:date:from:reply-to:mime-version

:from:to:cc:subject:date:message-id:reply-to:content-type;

bh=sCEQzu8upI9ZeYLWO1+SO/xtyTcIxNZesGTV7nuZiic=;

b=U3MeQaTAUTVs/zsdNrp8sDCiMkp7UaTOgmX2VJZeU4fhGWYKltbOkRvF8Z7quVQEI3

IRE/mCdGusx0X9c0B8U9kDH2TSq2uju3UNVOpXBFmAQEsOICTwYaGe1j9xL5H/CMvzF+

StSTCnnke6XFHzfvXpPZLuXWddeBcUo47V8nRdZZkCAQFB50R9Sv75obALlqdNLOi2r7

+6tk90ydvbtFPeXAAGpe0nlGwOTxw/hstC9Nh9zibZ7W1TMoBa58JqiVMWO7GE2MMh2T

+q8Ond5U8G+GqQAX9F+3gDT8eIiK6eZtRqDYQrCuOd+7ZPffqGChLxZY/rk/h39jnXMk

9tDA==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20251104; t=1786560075; x=1787164875;

h=content-type:to:subject:message-id:date:from:reply-to:mime-version

:x-gm-gg:x-gm-message-state:from:to:cc:subject:date:message-id

:reply-to:content-type;

bh=sCEQzu8upI9ZeYLWO1+SO/xtyTcIxNZesGTV7nuZiic=;

b=bs+nSTKPM7AWEYpymJjI1kNhihDKrGgHf9xMwasR7U5jzhx0ZSf5xFEZD/wwJbUtTx

fz7RrPZEmP7msfgUEJ3sWUHYLDXyij/JoLqyv9bTysY2VNJn3BMNb8oXDYVt7wM1V5AC

kPnP6Q+baHQ7vucqqylsrQF4jIVPhC0Y65nEnW8Y0hdDRhIjHM82IW6o6krFF2PeEGMn

lDRWb353Db+tvKPDiC1KnREJl0ErcdK7RzQVZZ2pokGZfjN9ADBM1C5L3ZcN8w3e5aWr

ENxA4D9AOSyq24RiWhNACd2Iy+Lq0Mt9qDbHy4AhChlMQTkzwLYO2bRLZyIhh/0xliIQ

w38w==

X-Forwarded-Encrypted: i=1; AHgh+RpfbEhYGtZauJlTjnR4sN1kyTeYxGA5ZnyZK0MYNeCV1RfAfsod5d05qnDqg88ualMN+xQ=@nl2k.ab.ca

X-Gm-Message-State: AOJu0Yx0JFr/4RtFSm4rxsVMnbs0q4ntc/fYvopI7VYhgB3ZbUg0T6Ij

vIpcLej6q/7MqOHBW4nfUKW6HRCUuIRkcJeLoOhidRAAIcHIF0H83fUtW/Oe6zdcqbcqqS7LaG9

yqLVzRswL4GSjez2Tt0BR5a8R3J4xi4yPbFebQs2Ueg==

X-Gm-Gg: AR+sD11/3pInu6WrEdjTNQJHfLLTSD35Mc/4aVp1sgfD5w5z5j1UuuzCwvnDfNux3Ks

x+TRNIUI4qe42yermMNCtdGaiRbaMfB9WeG9tmd81EQGvfOPnm7OPAG5nLzGiyPEfR1Hb9Mv9GQ

QX4ErxKEB+TFyHQq29knHCpce3Jm9Jdvl+jaTWSWH3njoCbfy6Og1nSjIbmvIQORYMnJd4M0JTv

zYjN86XvBCpdUYWFbXbXKK/WVL3t3pc4r81M3FZbdzSD1X/PmJzYcQ2omIhIG+iYLylsZuOstaO

twNWrN0kN5MK8UpWwWY4KR4/K8u1ka+uCyxRMBTr73c5L6TWRHCWSciaCVu8h+Pk6wy0+PDw9CF

bOA==

X-Received: by 2002:a05:6820:8c9:b0:6a1:44aa:86ce with SMTP id

006d021491bc7-6b0c435bc25mr501805eaf.22.1786560074541; Wed, 12 Aug 2026

11:41:14 -0700 (PDT)

MIME-Version: 1.0

Reply-To: santiagodiannahmeed@gmail.com

From: Diann Ahmed Santiago

Date: Wed, 12 Aug 2026 19:41:02 +0100

X-Gm-Features: AUfX_mwI6FZqwYJDSL5F64IXpeFztPNffmEl5X3tDqkYeAL4Slc2dFRjN1Xqii8

Message-ID:

Subject: CHARITY DONATION

To: undisclosed-recipients:;

Content-Type: multipart/alternative; boundary="0000000000009cfc0a0658ddee7c"

Bcc: bin@nl2k.ab.ca

X-Spam_score: 16.8

X-Spam_score_int: 168

X-Spam_bar: ++++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.

Content preview: -- Dear Beloved as a formal introduction I'm Diann Ahmed Santiago

an Indonesia citizens, I'm in the hospital undergoing serious treatment for

Esophageal cancer. I was recently transferred from the Jam [...]

Content analysis details: (16.8 points, 5.0 required)

pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[209.85.161.43 listed in will-spam-for-food.eu.org]

[209.85.161.43 listed in will-spam-for-food.eu.org]

[209.85.161.43 listed in will-spam-for-food.eu.org]

[209.85.161.43 listed in will-spam-for-food.eu.org]

[209.85.161.43 listed in will-spam-for-food.eu.org]

[209.85.161.43 listed in will-spam-for-food.eu.org]

[209.85.161.43 listed in will-spam-for-food.eu.org]

[209.85.161.43 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[209.85.161.43 listed in dnsbl.ahbl.org]

[209.85.161.43 listed in dnsbl.ahbl.org]

[209.85.161.43 listed in dnsbl.ahbl.org]

[209.85.161.43 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[209.85.161.43 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[209.85.161.43 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[209.85.161.43 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[209.85.161.43 listed in dnsbl.ahbl.org]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[209.85.161.43 listed in list.dnswl.org]

-0.0 SPF_PASS SPF: sender matches SPF record

1.5 GR_DOMAIN_UNDISC1 To contains undisclosed recipient (undisc)

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

1.6 SUBJ_ALL_CAPS Subject is all capitals

-0.0 RCVD_IN_MSPIKE_H3 RBL: Good reputation (+3)

[209.85.161.43 listed in wl.mailspike.net]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[209.85.161.43 listed in bl.score.senderscore.com]

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 HTML_MESSAGE BODY: HTML included in message

-0.0 RCVD_IN_MSPIKE_WL Mailspike good senders

1.0 FREEMAIL_REPLYTO Reply-To/From or Reply-To/body contain different

freemails

0.0 LOTS_OF_MONEY Huge... sums of money

2.5 FREEMAIL_FORGED_REPLYTO Freemail in Reply-To, but not From

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

0.0 MONEY_FREEMAIL_REPTO Lots of money from someone using free email?

2.9 UNDISC_FREEM Undisclosed recipients + freemail reply-to

2.4 UNDISC_MONEY Undisclosed recipients + money/fraud signs

0.0 MONEY_FRAUD_5 Lots of money and many fraud phrases

3.6 ADVANCE_FEE_3_NEW_MONEY Advance Fee fraud and lots of money

Subject: {SPAM?} CHARITY DONATION

--0000000000009cfc0a0658ddee7c

Content-Type: text/plain; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable

--=20

Dear Beloved as a formal introduction I'm Diann Ahmed Santiago an Indonesia

citizens, I'm in the hospital undergoing serious treatment for

Esophageal cancer. I was recently transferred from the James OSU Cancer

Centre

in Columbus Ohio United States of America to United Kingdom. I

have since lost my ability to talk and my Doctors have told me that I

have only a few months to live, due to my serious illness, I, therefore,

seize this opportunity to

notify you that I Diann Ahmed Santiago have decided to make you a

beneficiary to my ''WILL'' which based on my personal visit & search

in the export promotion council from the internet where your details

was well convinced to me of you been a reliable and trustworthy

fellow, I want you to assure me that you will not betray nor

disappoint my trust in you at the end of the transaction.

My Beloved, I and my late husband left the sum of Ten Million

Pounds (=C2=A310,000,000.00) in two trunks of metal boxes with

a security company as family valuables. I know this might sound

unbelievable to you, but I

tell you it's real and true.

I have decided to do this based on my short notice and limited time

state by my doctors, I decided in my mind that I should give this

resources to you, where I desire that you help take good care of

the needy ones in your country or around your region, such as

motherless baby's homes, widows, hurricane victims, and churches...Note

also, that before my illness. I have been carrying out the assignment

similar to this project just after the death of my husband.

As soon as I know your readiness to work and help me on this issue, I

shall provide the security company contact information for you to be sworn

into action.

You are humbly advised to contact me through my email

address as santiagodiannahmed@gmail.com

Remain Blessed,

Diann Ahmed Santiago

santiagodiannahmed@gmail.com

--0000000000009cfc0a0658ddee7c

Content-Type: text/html; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable

"gmail_signature_prefix">--

ature" data-smartmail=3D"gmail_signature">
Dear Beloved as =

a formal introduction I'm Diann Ahmed Santiago an Indonesia
citizens=

, I'm in the hospital undergoing serious treatment for
Esophageal ca=

ncer. I was recently transferred from the James OSU Cancer Centre
in Co=

lumbus Ohio United States of America to United Kingdom. I
have since los=

t my ability to talk and my Doctors have told me that I
have only a few =

months to live, due to my serious illness, I, therefore,
seize this opp=

ortunity to
notify you that I Diann Ahmed Santiago have decided to make =

you a
beneficiary to my ''WILL'' which based on my perso=

nal visit & search
in the export promotion council from the internet=

where your details
was well convinced to me of you been a reliable and =

trustworthy
fellow, I want you to assure me that you will not betray nor=

disappoint my trust in you at the end of the transaction.

My Bel=

oved, I and my late husband left the sum of Ten Million
Pounds (=C2=A310=

,000,000.00) in two trunks of metal boxes with
a security company as fam=

ily valuables. I know this might sound unbelievable to you, but I
tell y=

ou it's real and true.

I have decided to do this based on my sho=

rt notice and limited time
state by my doctors, I decided in my mind tha=

t I should give this
resources to you, where I desire that you help take=

good care of
the needy ones in your country or around your region, such=

as
motherless baby's homes, widows, hurricane victims, and churches=

...Note
also, that before my illness. I have been carrying out the assig=

nment
similar to this project just after the death of my husband.

>As soon as I know your readiness to work and help me on this issue, I
s=

hall provide the security company contact information for you to be sworn i=

nto action.
You are humbly advised to contact me through my email
add=

ress as s=

antiagodiannahmed@gmail.com

Remain Blessed,
Diann Ahmed Santi=

ago
sa=

ntiagodiannahmed@gmail.com

--0000000000009cfc0a0658ddee7c--

Categories: Google Gmail Spam

0 Comments

Intelcom Phish
Posted by Dave Yadallee on Wednesday, August 12. 2026

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Wed, 12 Aug 2026 14:57:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.5 (FreeBSD))

(envelope-from )

id 1wuG0Q-000000006fp-0KQJ

for dave@doctor.nl2k.ab.ca;

Wed, 12 Aug 2026 14:56:58 -0600

Resent-From: The Doctor

Resent-Date: Wed, 12 Aug 2026 14:56:57 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from vps.fslocal.com ([199.83.208.249]:46158)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.99.5 (FreeBSD))

(envelope-from )

id 1wuDSa-00000000LyF-32zb

for sales@nk.ca;

Wed, 12 Aug 2026 12:14:03 -0600

DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed;

d=laravel.perksona.com; s=default; h=MIME-Version:Date:

Content-Transfer-Encoding:Message-ID:Subject:To:From:Content-Type:Sender:

Reply-To:Cc:Content-ID:Content-Description:Resent-Date:Resent-From:

Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:In-Reply-To:References:

List-Id:List-Help:List-Unsubscribe:List-Subscribe:List-Post:List-Owner:

List-Archive; bh=/McdDXbMdaxgJ6ulkQo9xWuZbF1iRwDyuEIZ8YTRZOw=; b=c0AQULgFqBX3

E/f6D40isL5BFbq2sNZXCyf0RFBrJm1ah0zlCfAaKy3ADil+Q3diWsVbEeC/7Oadm9YRi9+fAjXBH

A2JaFl6Y9JNiYNM4S+8XZ6LGds+bG9AcTfOe7LHIfCxkF7krx7MVGQqYYjxYvqSu4VwCLgBQ6n1BK

q4XZh6vj/jfRU8BLiV17i0g2b8pMWHftBot+ye6tPIC2x1sobGVR9fZQnK28n7vmJxMhegQiM7Ald

g3hN9ibQ+Uk6eD6OOfL4kd2gZ1hPDVOrwTEmlfSBXvvqg4QuRpBesIZsTJI89smXQ4LJ5H9KAMIPO

mxibc/TvAwe2fDrT6rHGWg==;

Received: from [196.75.231.148] (port=62198 helo=[127.0.0.1])

by vps.fslocal.com with esmtpsa (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.99.5)

(envelope-from )

id 1wuDRO-00000001uhm-3xBU

for sales@nk.ca;

Wed, 12 Aug 2026 14:12:59 -0400

Content-Type: text/html

From: Intelcom

To: sales@nk.ca

Subject: Intelcom Delivery Notification

Message-ID: <1b29bfb9-63f1-28aa-b050-5822b1aaa86b@laravel.perksona.com>

Content-Transfer-Encoding: quoted-printable

Date: Wed, 12 Aug 2026 18:12:35 +0000

MIME-Version: 1.0

X-AntiAbuse: This header was added to track abuse, please include it with any abuse report

X-AntiAbuse: Primary Hostname - vps.fslocal.com

X-AntiAbuse: Original Domain - nk.ca

X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12]

X-AntiAbuse: Sender Address Domain - laravel.perksona.com

X-Get-Message-Sender-Via: vps.fslocal.com: authenticated_id: info-mjqu@laravel.perksona.com

X-Authenticated-Sender: vps.fslocal.com: info-mjqu@laravel.perksona.com

X-Source:

X-Source-Args:

X-Source-Dir:

X-Spam_score: 6.2

X-Spam_score_int: 62

X-Spam_bar: ++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.

Content preview: Intelcom Delivery Update

Content analysis details: (6.2 points, 5.0 required)

pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[196.75.231.148 listed in dnsbl.ahbl.org]

[196.75.231.148 listed in dnsbl.ahbl.org]

[196.75.231.148 listed in dnsbl.ahbl.org]

[196.75.231.148 listed in dnsbl.ahbl.org]

[199.83.208.249 listed in dnsbl.ahbl.org]

[199.83.208.249 listed in dnsbl.ahbl.org]

[199.83.208.249 listed in dnsbl.ahbl.org]

[199.83.208.249 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[196.75.231.148 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[196.75.231.148 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[196.75.231.148 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[196.75.231.148 listed in dnsbl.ahbl.org]

-0.0 SPF_PASS SPF: sender matches SPF record

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[199.83.208.249 listed in bl.score.senderscore.com]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[196.75.231.148 listed in will-spam-for-food.eu.org]

[196.75.231.148 listed in will-spam-for-food.eu.org]

[196.75.231.148 listed in will-spam-for-food.eu.org]

[196.75.231.148 listed in will-spam-for-food.eu.org]

[196.75.231.148 listed in will-spam-for-food.eu.org]

[196.75.231.148 listed in will-spam-for-food.eu.org]

[196.75.231.148 listed in will-spam-for-food.eu.org]

[196.75.231.148 listed in will-spam-for-food.eu.org]

[199.83.208.249 listed in will-spam-for-food.eu.org]

[199.83.208.249 listed in will-spam-for-food.eu.org]

[199.83.208.249 listed in will-spam-for-food.eu.org]

[199.83.208.249 listed in will-spam-for-food.eu.org]

[199.83.208.249 listed in will-spam-for-food.eu.org]

[199.83.208.249 listed in will-spam-for-food.eu.org]

[199.83.208.249 listed in will-spam-for-food.eu.org]

[199.83.208.249 listed in will-spam-for-food.eu.org]

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 HTML_MESSAGE BODY: HTML included in message

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

1.0 VOWEL_URI_5 URI hostname with 5 consecutive vowels

2.0 RATWR8_MESSID Message-ID with excessive dashes and dollars

0.8 SARE_FROM_SPAM_WORD3 I don't know people named this!

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

Subject: {SPAM?} Intelcom Delivery Notification

MARGIN: 30px auto; border-radius: 10px; box-shadow: 0 4px 10px rgba(0,0,0,0=

.08)">

center; PADDING-TOP: 20px; PADDING-LEFT: 20px; PADDING-RIGHT: 20px">

Intelcom

TEXT-ALIGN: center; PADDING-TOP: 30px; PADDING-LEFT: 30px; PADDING-RIGHT: =

30px">

Delivery Update

Your package is currently being processed and =

requires a small fee for customs handling.

18px; FONT-WEIGHT: bold; COLOR: #04ab94">Amount due: 2.96 CAD

Please confirm your delivery =

details to ensure a smooth delivery experience.

org/Intelcom/Contactez-support-Intelcom.ca/" style=3D"TEXT-DECORATION: =

none; BACKGROUND: #04ab94; MARGIN-TOP: 20px; FONT-WEIGHT: bold; COLOR: =

#ffffff; PADDING-BOTTOM: 12px; PADDING-TOP: 12px; PADDING-LEFT: 25px; =

DISPLAY: inline-block; PADDING-RIGHT: 25px; border-radius: 6px">Manage My =

Delivery

BACKGROUND: #f1f1f1; COLOR: #888; PADDING-BOTTOM: 20px; TEXT-ALIGN: center;=

PADDING-TOP: 20px; PADDING-LEFT: 20px; PADDING-RIGHT: 20px">

This is an automated message. Please do not reply.=

© 2026 Intelcom Express

Categories: Phish

0 Comments

Wealthsimple Phish from Google
Posted by Dave Yadallee on Wednesday, August 12. 2026

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Wed, 12 Aug 2026 14:57:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.5 (FreeBSD))

(envelope-from )

id 1wuG0J-000000006em-127C

for dave@doctor.nl2k.ab.ca;

Wed, 12 Aug 2026 14:56:51 -0600

Resent-From: The Doctor

Resent-Date: Wed, 12 Aug 2026 14:56:51 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from weall04.weiyuzhishiw.com ([35.217.83.89]:51393)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.99.5 (FreeBSD))

(envelope-from )

id 1wuD5v-000000009Kn-2wBf

for doctor@nk.ca;

Wed, 12 Aug 2026 11:50:35 -0600

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; s=default; d=weall04.weiyuzhishiw.com;

h=Content-Type:MIME-Version:From:To:Subject:Date:Message-ID;

i=UOVDZS@weall04.weiyuzhishiw.com;

bh=+uJBQiwcPS9ZW9Qp2u2m1mf4t9zqzQ9e3ZuBAlKBz6I=;

b=isUQmnm8uQz+fOPGBsjMnhcm9hAR0RhASwqSbZh8jU++z0z7Zl9IexGSSMbc6HC/lSCNHZNzQNSZ

Tobb8bL1NdWqcfr4aSYHdBqgzXHSwSK5fCBiEYBW1n//NijLJTgI/cb4kPF3izGHzxW0ukQn6H4w

61oQolEuOnLDQn0nuVtGJ9B4eATI81jlj5JpPPtzZnjM9hSQ2VAq23e7W1RH8KFbV4zOoDpltK/V

cy07Lj/pbWdoa4MRBLD26f9l5ZpwyM5Ogap8JhkaEcWalK6AW1RQ6c9BVNwnxjP1V/2h5PO+REsm

WIcbM3MU6hvybFSgkkoOIZy7a2tNG5gii2sm+w==

Content-Type: multipart/alternative;

boundary="===============8869485953320447085=="

MIME-Version: 1.0

From:

=?utf-8?b?V+KAi2XigIth4oCLbOKAi3TigIto4oCLc+KAi2nigItt4oCLcOKAi2zigItl4oCLIOKAi0PigIts4oCLaeKAi2XigItu4oCLdOKAiyDigItT4oCLdeKAi3DigItw4oCLb+KAi3LigIt0?=

To: doctor@nk.ca

Subject: =?utf-8?q?Transfer_Pause_in_Effect_=E2=80=94_Verify_Your_Identity_T?=

=?utf-8?q?oday_-_Suspension_de_transfert_en_vigueur_=E2=80=94_Verifiez_votr?=

=?utf-8?q?e_identite_aujourdhui?=

Date: Wed, 12 Aug 2026 13:49:39 -0400

Message-ID: <178655697959.3782.14659689807189522119@weall04.weiyuzhishiw.com>

X-Spam_score: 12.1

X-Spam_score_int: 121

X-Spam_bar: ++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.

Content preview: TRANSFERS CURRENTLY PAUSED â€” ACTION REQUIRED Transfer Pause

in Effect â€” Verify Your Identity Today ================================================================

Content analysis details: (12.1 points, 5.0 required)

pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[35.217.83.89 listed in will-spam-for-food.eu.org]

[35.217.83.89 listed in will-spam-for-food.eu.org]

[35.217.83.89 listed in will-spam-for-food.eu.org]

[35.217.83.89 listed in will-spam-for-food.eu.org]

[35.217.83.89 listed in will-spam-for-food.eu.org]

[35.217.83.89 listed in will-spam-for-food.eu.org]

[35.217.83.89 listed in will-spam-for-food.eu.org]

[35.217.83.89 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[35.217.83.89 listed in dnsbl.ahbl.org]

[35.217.83.89 listed in dnsbl.ahbl.org]

[35.217.83.89 listed in dnsbl.ahbl.org]

[35.217.83.89 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[35.217.83.89 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[35.217.83.89 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[35.217.83.89 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[35.217.83.89 listed in dnsbl.ahbl.org]

2.5 URIBL_DBL_SPAM Contains a spam URL listed in the DBL blocklist

[URI: npclw.com]

[URI: hqkjweb.com]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-0.0 SPF_HELO_PASS SPF: HELO matches SPF record

-0.0 SPF_PASS SPF: sender matches SPF record

-0.0 T_RP_MATCHES_RCVD Envelope sender domain matches handover relay

domain

1.9 URIBL_ABUSE_SURBL Contains an URL listed in the ABUSE SURBL blocklist

[URI: login.hqkjweb.com]

[URI: login.npclw.com]

1.9 URIBL_JP_SURBL Contains an URL listed in the JP SURBL blocklist

[URI: npclw.com]

[URI: hqkjweb.com]

0.0 URIBL_PH_SURBL Contains an URL listed in the PH SURBL blocklist

[URI: npclw.com]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[35.217.83.89 listed in bl.score.senderscore.com]

1.5 MR_STRANGE_QUESTION URI: No description available.

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

1.0 VOWEL_URI_5 URI hostname with 5 consecutive vowels

1.0 ACCT_PHISHING Possible phishing for account information

0.9 URI_PHISH Phishing using web form

Subject: {SPAM?} =?utf-8?q?Transfer_Pause_in_Effect_=E2=80=94_Verify_Your_Identity_T?=

=?utf-8?q?oday_-_Suspension_de_transfert_en_vigueur_=E2=80=94_Verifiez_votr?=

=?utf-8?q?e_identite_aujourdhui?=

Categories: Google Gmail Spam, Phish

0 Comments

Page 1290 of 1290, totaling 19337 entries

previous page

No entries to print

Mon	Tue	Wed	Thu	Fri	Sat	Sun
← Back	August '26					Forward →
					1	2
3	4	5	6	7	8	9
10	11	12	13	14	15	16
17	18	19	20	21	22	23
24	25	26	27	28	29	30
31

Your teammates are trying to reach you in Microsoft Te= ams

Your teammates are trying to reach you in Microsoft Te= ams

Your teammates are trying to reach you in Microsoft Te= ams

Your teammates are trying to reach you in Microsoft Te= ams

Your teammates are trying to reach you in Microsoft Te= ams

Your teammates are trying to reach you in Microsoft Te= ams

Your teammates are trying to reach you in Microsoft Te= ams

Your teammates are trying to reach you in Microsoft Te= ams

Intelcom

Delivery Update

Your teammates are trying to reach you in Microsoft Te=

ams

Your teammates are trying to reach you in Microsoft Te=

ams

Your teammates are trying to reach you in Microsoft Te=

ams

Your teammates are trying to reach you in Microsoft Te=

ams

Your teammates are trying to reach you in Microsoft Te=

ams

Your teammates are trying to reach you in Microsoft Te=

ams

Your teammates are trying to reach you in Microsoft Te=

ams

Your teammates are trying to reach you in Microsoft Te=

ams