Nigerian style conference spam from Google Gmail

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Wed, 06 May 2026 06:47:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1wKbdn-000000002ly-288B

for dave@doctor.nl2k.ab.ca;

Wed, 06 May 2026 06:46:15 -0600

Resent-From: The Doctor

Resent-Date: Wed, 6 May 2026 06:46:15 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-ej1-f51.google.com ([209.85.218.51]:53553)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1wKXvQ-000000002m5-22dv

for root@nk.ca;

Wed, 06 May 2026 02:48:21 -0600

Received: by mail-ej1-f51.google.com with SMTP id a640c23a62f3a-bc3582acc23so372536266b.3

for ; Wed, 06 May 2026 01:47:24 -0700 (PDT)

ARC-Seal: i=1; a=rsa-sha256; t=1778057237; cv=none;

d=google.com; s=arc-20240605;

b=g4aLNNwQVyJCF761QY8Zdt1rMo6aEuWKZIU0RROgb12r7B63YoP8diFmL4tavDyKxn

lrheuqiImqZki4x4JEFW6YaQHHAlZGnTkpO4LFW5nsVRKB9k9KFkChuArfkH75xfw2Ej

8E8WYq/bjyAfY46hjGsh/+hUsGMTb6dIn3U8nrAK9c07Of0voRysfV5ohg7UGYVAsVBy

U8578CEzDLZgD4t91tpxzx/2/zxuApj8CVzeVJAscoruZNbUcQ6ypn5j/y9QW9qWXxNl

KkrRrSXg0hlt4xkZDYq1EgFwquBOfl6qXtWIKjYqIEMMT20OqK5IgnNhAAs6HKXiryp3

qvQw==

ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20240605;

h=to:subject:message-id:date:from:mime-version:dkim-signature;

bh=swpDvZlZWaI/Nn3X8UIjVvYoW2rQSSUQUlHJapCyFCI=;

fh=ny7+SATv4n6lSNl0rVMQyaj6POVJTUZJLShjjgjSTJg=;

b=YdW5qFZZSWL7OCeOk5E8vJgbaW9lBWFxsPeP/Ueh2xSyp8RpsKt9w1G8nEatxMZCCC

wEjgdP5sgrfyIX1hv1DmZvxbbCdj0w32C0esOCJtX5C2wsqNNM8uDqz/nKwL8z9P/Z7O

JuxSo99zXsabCfNyf0OtxSyC0QXQn3Yey9uzkV1SBGI9RygGQYXJT16Z785e/VhL7a3r

gsHd3o/NamOnC2KwtL/xahDzfmS0AirUs/xJxuvHsPmy23ML6svdFf1xMUBm/bjVcn2e

AX7mM/a3f8lP7M0damxaPq7Mmp+yPG4IPuXs52lUNla9q6Qu7AcaX5kbJOw/5l2oi2Xi

sAdQ==;

darn=nk.ca

ARC-Authentication-Results: i=1; mx.google.com; arc=none

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=gmail.com; s=20251104; t=1778057237; x=1778662037; darn=nk.ca;

h=to:subject:message-id:date:from:mime-version:from:to:cc:subject

:date:message-id:reply-to;

bh=swpDvZlZWaI/Nn3X8UIjVvYoW2rQSSUQUlHJapCyFCI=;

b=VeCuaGj+E/ujukhsoRlQGqyJ9xplr3Mj86DKgaQ52tR5iPlap1d3dGwwVgoyrGkgHz

N3bqalSUZpJCkIn5UPeDvua/rjZCbFzQIGFoiBNJXkmgNvvt0AmGjOXnNpOBaRTjeYZn

cqRouz/S6+PPvG5EC7ZO7QAIcLpqc7NuImklMzBZFv0+tpj3nPtSPBshySjR2qhozXIh

vGiqMv1gC+iwtAPQGsPKR/UQR18St7Yu0N+CxCOyf0xhb+oMMJFTxYo/ZM5zI8me6z9l

1bViZuRvHGyEV1hguDyj2EvnhDBV+cQvno/6BCpo6DTF85y+FD5fShOXmK66AQ8YLnjC

i3XQ==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20251104; t=1778057237; x=1778662037;

h=to:subject:message-id:date:from:mime-version:x-gm-gg

:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to;

bh=swpDvZlZWaI/Nn3X8UIjVvYoW2rQSSUQUlHJapCyFCI=;

b=UITXWOMXGhddFqEOSTknjW1p8ooc69qTNTJ1GilAAqeegFEqSUQ0ex+lPT6q7stdt8

ERU3rYOGxpkc/SLQbwo+cm3goPrUm7+YBHu9COFaca2TV30/7w0e3KGFrsi89Cx74VHm

L6b5KQ/bNsoUW8PyBREmOrk0X4FrIRk/HGbUSxX4BjtWi/hDxujdtO8igYZu4SGSAsnK

icR8yATeoG7xZC6rND25v9Kbikvp0fN1HMKsLWZrAJmkOnlav8kE0zhHi3XryG+wEKkL

TN6D9VW1cPayYsdGC2SCXF/Np4YyQStV+V9OsMEvZugGZVs6KkDHUkDt5qxnAOsPzrQG

VD5g==

X-Gm-Message-State: AOJu0Yx8V9KMyCg3zuYoIXa/l2Cu+T85jk3Ykv0KINpfbAPg+X1cgqEv

sN68y08Cv7TLEQYrAvV8aJOKCYhu9QO5Inxh7mKqfjhmfEbdSLxd22DLh48jo1NAzGcY8+H1DNK

ea8aIyrz3kiaVG6Cn2ZYCMpjmFQARlDTqfQ==

X-Gm-Gg: AeBDievPr5oUNl5ZdtVgW0HyBosXFSbeRslI1OaoBshTzim1XyDah0W2v0c3JsylN3w

Kxa/13cXgDzkF9CAa7yThMEyB2TAuUulCTxwM6rPt32wW1ezAzuPv0oZ0dAzXuBmBxF/s0i342s

EUwlISXaaWmlW3pb3eQRBan95TdN9gyOi6Etuv4zU9d3aRYP4XjuqkrGbCHmiiFQ/NNufa/Ktg2

oDibhfV+tupvqrYsPZE6OaU3gH6PvNd3NyoojmIDc0pb93ULPzDj3IXktZ8/QTVGEa1hjBfAuSV

hd+mQ4pCVjQ7HDQ9gYhyU+4BSfuG8oFiy0onIfPyf6D/RdqbdeGJHBGV4v58

X-Received: by 2002:a17:906:f584:b0:bc4:12f1:d7b1 with SMTP id

a640c23a62f3a-bc56da0a10cmr100734866b.40.1778057236496; Wed, 06 May 2026

01:47:16 -0700 (PDT)

MIME-Version: 1.0

Received: by 2002:a17:906:190e:b0:b98:3ae:8856 with HTTP; Wed, 6 May 2026

01:47:15 -0700 (PDT)

From: anania Mwambona

Date: Wed, 6 May 2026 14:17:15 +0530

X-Gm-Features: AVHnY4IwLzdW9e4J6J8HfP1y3eTiW9pC4P46Ckuq7ULqzIU8cnvinpyJAqY2s0s

Message-ID:

Subject: Shaping the Future of Tech | Tokyo Invitation

To: root@nk.ca

Content-Type: multipart/alternative; boundary="000000000000f8c4410651223591"



--000000000000f8c4410651223591

Content-Type: text/plain; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable



Hi Sir/Ma'am,



With how fast technology is evolving, meaningful conversations between

leaders are more important than ever.



That=E2=80=99s exactly why we=E2=80=99re hosting *Tech Horizon 2030 in Toky=

o*, and you=E2=80=99ve

been nominated to be part of it.



Event overview: https://konceptconference.com/schedule-overview



Can we schedule a quick 10-minute call to share more?

https://calendly.com/d/cxcw-7vp-7x8/participation-discussion



Best,



Fathima



PS: If you=E2=80=99re not interested, reply REMOVE, and I=E2=80=99ll stop c=

ontacting you.



--000000000000f8c4410651223591

Content-Type: text/html; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable



Hi Sir/=

Ma'am,


f" title=3D"">With how fast technology is evolving, meaningful conversation=

s between leaders are more important than ever.


"font-family:Verdana,Geneva,sans-serif" title=3D"">That=E2=80=99s exactly w=

hy we=E2=80=99re hosting Tech Horizon 2030 in Tokyo, and y=

ou=E2=80=99ve been nominated to be part of it.


font-family:Verdana,Geneva,sans-serif" title=3D"">Event overview:
=3D"https://konceptconference.com/schedule-overview" rel=3D"noopener" targe=

t=3D"_new" title=3D"">https://konceptconference.com/schedule-overview
span>


">Can we schedule a quick 10-minute call to share more?

://calendly.com/d/cxcw-7vp-7x8/participation-discussion" rel=3D"noopener" t=

arget=3D"_new" title=3D"">https://calendly.com/d/cxcw-7vp-7x8/participation=

-discussion


-serif" title=3D"">Best,

Fathima

PS: If you=E2=80=99re =

not interested, reply REMOVE, and I=E2=80=99ll stop contacting you.

<=

br>





--000000000000f8c4410651223591--

Broker spam

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Wed, 06 May 2026 06:47:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1wKbda-000000002fm-1Paw

for dave@doctor.nl2k.ab.ca;

Wed, 06 May 2026 06:46:02 -0600

Resent-From: The Doctor

Resent-Date: Wed, 6 May 2026 06:46:02 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail.cottonink.co.id ([103.93.57.62]:57316 helo=hungry-einstein.103-93-57-62.plesk.page)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1wKXil-000000002D9-2XrR

for www@nl2k.ab.ca;

Wed, 06 May 2026 02:35:16 -0600

Received: from webmail.cottonink.co.id (localhost.localdomain [IPv6:::1])

by hungry-einstein.103-93-57-62.plesk.page (Postfix) with ESMTPSA id 10C2818E9B6;

Wed, 6 May 2026 08:33:42 +0000 (UTC)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cottonink.co.id;

s=default; t=1778056443;

bh=2QabvStzH4LATc1k1w2Mmoqrl2QpqcuHXaUqQwI9sLc=; h=From:To:Subject;

b=aArQIatqlsSXU27LeGnAGblY2LYgTF1QlZMrnmQnvGNf8ia5LJApcNorlJXb5fQin

jM4hlKgMxjIqMk+/r3eUZ8R9Gh1w3JmPL/tfvtCfhkfuRhSWlweNJfb1XDUztBO5Vu

8MFX/WmuDLtNhiuF+JHtvw5PcuvdSM/cJJXcbDrY=

Authentication-Results: cottonink-svr;

spf=pass (sender IP is ::1) smtp.mailfrom=root@cottonink.co.id smtp.helo=webmail.cottonink.co.id

Received-SPF: pass (cottonink-svr: connection is authenticated)

MIME-Version: 1.0

Date: Wed, 06 May 2026 10:33:41 +0200

From: Wilsom Export

To: undisclosed-recipients:;

Subject: REP

Reply-To: gabmit92@gmail.com

User-Agent: Roundcube Webmail/1.4.15

Message-ID: <147e8bf4d70cdb0357344e7dc94e82ed@cottonink.co.id>

X-Sender: root@cottonink.co.id

Content-Type: text/plain; charset=US-ASCII;

format=flowed

Content-Transfer-Encoding: 7bit

X-PPP-Message-ID:

<177805643095.1785.823085962884674021@hungry-einstein.103-93-57-62.plesk.page>

X-PPP-Vhost: cottonink.co.id

X-Spam_score: 5.7

X-Spam_score_int: 57

X-Spam_bar: +++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: -- Wilson Import Export Broker is seeking a motivated Company/Person

representatives on part time basis with good salary structure. Reply for

more details.



Content analysis details: (5.7 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[103.93.57.62 listed in dnsbl.ahbl.org]

[103.93.57.62 listed in dnsbl.ahbl.org]

[103.93.57.62 listed in dnsbl.ahbl.org]

[103.93.57.62 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[103.93.57.62 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[103.93.57.62 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[103.93.57.62 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[103.93.57.62 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[103.93.57.62 listed in will-spam-for-food.eu.org]

[103.93.57.62 listed in will-spam-for-food.eu.org]

[103.93.57.62 listed in will-spam-for-food.eu.org]

[103.93.57.62 listed in will-spam-for-food.eu.org]

[103.93.57.62 listed in will-spam-for-food.eu.org]

[103.93.57.62 listed in will-spam-for-food.eu.org]

[103.93.57.62 listed in will-spam-for-food.eu.org]

[103.93.57.62 listed in will-spam-for-food.eu.org]

-0.0 SPF_PASS SPF: sender matches SPF record

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

1.5 GR_DOMAIN_UNDISC1 To contains undisclosed recipient (undisc)

-0.0 T_RP_MATCHES_RCVD Envelope sender domain matches handover relay

domain

0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in digit

[gabmit92(at)gmail.com]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

2.5 FREEMAIL_FORGED_REPLYTO Freemail in Reply-To, but not From

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[103.93.57.62 listed in bl.score.senderscore.com]

Subject: {SPAM?} REP







--

Wilson Import Export Broker is seeking a motivated Company/Person

representatives on part time basis with good salary structure. Reply for

more details.

Scotiabank phish

Posted by Dave Yadallee on


X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Tue, 05 May 2026 22:31:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1wKTtl-00000000AcK-2qHX

for dave@doctor.nl2k.ab.ca;

Tue, 05 May 2026 22:30:13 -0600

Resent-From: The Doctor

Resent-Date: Tue, 5 May 2026 22:30:13 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from system1-156.zeptomail.ca ([199.67.87.156]:12111)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1wKTYD-000000008Mn-2dDO

for doctor@doctor.nl2k.ab.ca;

Tue, 05 May 2026 22:08:07 -0600

ARC-Seal: i=1; a=rsa-sha256; t=1778040422; cv=none;

d=zohomail360.ca; s=zohoarc;

b=fFcrG93kiS5ceN3e5Ju59jiLekMKiBqc6AQYuLQN4MDXtMDeDcxbAnX81rm0+VaYoL0qkyhjUn4r+t/HGsEV2OwegLoj0MnvjaBlb9oFNWvt4s//TpTZu/XLMaIwenjCQfHlxvJ7n016PKalS7Fk/XyWqrhi5J04GJwJJO7q0zY=

ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail360.ca; s=zohoarc;

t=1778040422; h=Content-Type:Date:Date:From:From:MIME-Version:Message-ID:Reply-To:Reply-To:Subject:Subject:To:To:Message-Id:Cc;

bh=mRNTU6Y3+OOegONPzwt9YOOSyYSQ9BKfA+Z9ffauyjM=;

b=D/T3zXVwAhWelyqdI9+bjH4VphnH7MT7wnH4pppwci5mt8qecVG8qMeZaRVwS2svUd6PEwLqlaJRYO7sXYW+pIcJxz+E/orjXDn0Mp1ShqR53Tinni12Je6hQ2y/pU3JPDDxLz0vI+Z2O6n8KF9m1vrSS4nSKAeHIZBQFXxjIbU=

ARC-Authentication-Results: i=1; mx.zohomail360.ca;

dkim=pass header.i=sender.zohobooks.ca;

spf=pass smtp.mailfrom=bounces+06de1a50-4901-11f1-84cb-2655081e6903_vt1@sender.zohobooks.ca;

dmarc=pass header.from=

Received: by mx.zohocloud.ca with SMTPS id 177804042035058.53438753066655;

Wed, 6 May 2026 00:07:00 -0400 (EDT)

DKIM-Signature: a=rsa-sha256; b=GyhNhfpJ8kNTRHNoJN7j2iK6z8eYmIk0DBOaF5Vl9JJN8csqIKBeTXRy80AwMs7Pvex8OQzGlq2PsrP1Yw23wXdaNnqkCqW2vvNc7PVvA4Amp2I2I4DTiHkD4c4OfI+Zpfn5jQ8pVxbrjmiHSCSlA3R+UJpAHRMWKQh/RNBzapo=; c=relaxed/relaxed; s=26101337; d=sender.zohobooks.ca; v=1; bh=mRNTU6Y3+OOegONPzwt9YOOSyYSQ9BKfA+Z9ffauyjM=; h=date:from:reply-to:to:message-id:subject:mime-version:content-type:date:from:reply-to:to:message-id:subject;

Date: Wed, 6 May 2026 00:07:00 -0400 (EDT)

From: | Scotiabank Canada

Reply-To: john.boellaard@hotmail.com

To: doctor@doctor.nl2k.ab.ca

Message-ID: <3b2f8.30244354e41f396e.m1.06de1a50-4901-11f1-84cb-2655081e6903.19dfb77b075@sender.zohobooks.ca>

Subject: Scotiabank : Check your secure messages

MIME-Version: 1.0

Content-Type: multipart/mixed;

boundary="----=_Part_654389_1431428946.1778040420174"

X-Mailer-Orig: Zoho Books Mailer

Original-Envelope-Id: 3b2f8.30244354e41f396e.m1.06de1a50-4901-11f1-84cb-2655081e6903.19dfb77b075

X-JID: 3b2f8.30244354e41f396e.m1.06de1a50-4901-11f1-84cb-2655081e6903.19dfb77b075

TM-MAIL-JID: 3b2f8.30244354e41f396e.m1.06de1a50-4901-11f1-84cb-2655081e6903.19dfb77b075

X-App-Message-ID: 3b2f8.30244354e41f396e.m1.06de1a50-4901-11f1-84cb-2655081e6903.19dfb77b075

X-ZeM-FID: 744000000014016

X-Report-Abuse:

X-Zoho-Virus-Status: 1

X-Zoho-AV-Stamp: zmail-av-0.1.0.1.4.3/278.37.27

X-ZohoMailClient: External

X-Spam_score: 5.6

X-Spam_score_int: 56

X-Spam_bar: +++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Dear Customer, This is to inform you that we have sent you

a secure message containing important updates about your account. We use

secure messages to ensure you are promptly notified of any changes [...]



Content analysis details: (5.6 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[199.67.87.156 listed in dnsbl.ahbl.org]

[199.67.87.156 listed in dnsbl.ahbl.org]

[199.67.87.156 listed in dnsbl.ahbl.org]

[199.67.87.156 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[199.67.87.156 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[199.67.87.156 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[199.67.87.156 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[199.67.87.156 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[199.67.87.156 listed in will-spam-for-food.eu.org]

[199.67.87.156 listed in will-spam-for-food.eu.org]

[199.67.87.156 listed in will-spam-for-food.eu.org]

[199.67.87.156 listed in will-spam-for-food.eu.org]

[199.67.87.156 listed in will-spam-for-food.eu.org]

[199.67.87.156 listed in will-spam-for-food.eu.org]

[199.67.87.156 listed in will-spam-for-food.eu.org]

[199.67.87.156 listed in will-spam-for-food.eu.org]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-0.0 SPF_PASS SPF: sender matches SPF record

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[199.67.87.156 listed in bl.score.senderscore.com]

1.6 HTML_IMAGE_ONLY_12 BODY: HTML: images with 800-1200 bytes of words

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

2.5 FREEMAIL_FORGED_REPLYTO Freemail in Reply-To, but not From

0.0 T_REMOTE_IMAGE Message contains an external image

Subject: {SPAM?} Scotiabank : Check your secure messages



------=_Part_654389_1431428946.1778040420174

Content-Type: multipart/alternative;

boundary="----=_Part_654390_649793664.1778040420174"



------=_Part_654390_649793664.1778040420174

Content-Type: text/plain; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable





Dear Customer,

This is to inform you that we have sent you a secure message containing imp=

ortant updates about your account.

We use secure messages to ensure you are promptly notified of any changes o=

r activities related to your account's security.

View Secure Message (https://replug.link/4ddee639)

This message contains sensitive information related to your Scotiabank acco=

unt. Please log in to your account to view the full details.

Thank you for banking with Scotiabank.

Scotiabank

Digital Banking Team

 

------=_Part_654390_649793664.1778040420174

Content-Type: text/html; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable




=3D"https://encrypted-tbn0.gstatic.com/images?q=3Dtbn:ANd9GcSVPuc4Ou0bYSkjz=

9HCRTb_FXsWdmX-co79fg&s" alt=3D"" width=3D"166" height=3D"105" />
ng>


Dear Customer,


This is to inform y=

ou that we have sent you a secure message containing important updates abou=

t your account.


We use secure messages to ensure you are promptly=

notified of any changes or activities related to your account's security.<=

/p>

View Secure Mess=

age


This message contains sensitive information rela=

ted to your Scotiabank account. Please log in to your account to view the f=

ull details.


Thank you for banking with Scotiabank.



rong>Scotiabank
Digital Banking Team


=


px;"> 






f396e/mk06de1a50-4901-11f1-84cb-2655081e6903_hkdbe74eee0ce9452479537b31257a=

589593db091806898183d6fa06c8e314c03e.gif" height=3D"1" width=3D"1" alt=3D""=

/>

------=_Part_654390_649793664.1778040420174--





------=_Part_654389_1431428946.1778040420174

Content-Type: application/pdf; name=QT-000001.pdf

Content-Transfer-Encoding: base64

Content-Disposition: attachment; filename=QT-000001.pdf





...



------=_Part_654389_1431428946.1778040420174--

loan spam

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Tue, 05 May 2026 17:54:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1wKPaI-000000003M6-3Rx9

for dave@doctor.nl2k.ab.ca;

Tue, 05 May 2026 17:53:50 -0600

Resent-From: The Doctor

Resent-Date: Tue, 5 May 2026 17:53:50 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from ai.hypertranslator.com ([94.236.201.99]:4490)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1wKPJ6-00000000Cz0-0RIy

for sales@nk.ca;

Tue, 05 May 2026 17:36:14 -0600

Received: by ai.hypertranslator.com (Postfix, from userid 5030)

id B4ABD252C7EF; Wed, 6 May 2026 02:34:09 +0300 (EEST)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=paint-point.bg;

s=default; t=1778024049; h=from:from:reply-to:reply-to:subject:subject:date:date:

message-id:message-id:to:to:cc:mime-version:mime-version:

content-type:content-type:

content-transfer-encoding:content-transfer-encoding:list-unsubscribe:

list-unsubscribe-post; bh=AMV94b0rQDAkS1oEwgElYBb8/3c67Og31NhktsX3b/M=;

b=TV9IIji9js1yEMITL8ZL7LR+PCGkuBuRd64FH8Iem19R3/8/0MY873qXNF7SsDvxQLhWFd

yg4sA1ELXA75ZxZj7nHVzKYpMDw89+X63R9qcj7011NytRY4ywGyiLbU0I9XXrQ5hKD3+v

9NSrT+bpD13ucL4efbKL6YYogn4TN3QRGIecUAVkUmPH2lhF9Ln6DJMOg121WYG6SF84DR

7eW6YEs73foW5eYwtdb/HkfqM/rd9ybQ0mlOC3aV6d7H1ZR2wGH7geNAAswne0+e/3/kbW

rkW2g8/mwsKPsfck/RPcC6WZc7WGo1w+P5ND4KgAGoD/Khe27Eu1cQo4CGg3YQ==

MIME-Version: 1.0

Date: Tue, 05 May 2026 23:34:09 +0000

Message-ID:

From: Arab Saudi Investors

To: sales@nk.ca

Subject: Project Investment Funding

Reply-To: info@faisalrasheed.com

List-Unsubscribe:

List-Unsubscribe-Post: List-Unsubscribe=One-Click

Precedence: bulk

Content-Type: text/plain; charset=UTF-8

Content-Transfer-Encoding: quoted-printable



Assalamu alaikum,=0A=0AMy name is Rasheed Faisal. I represent a group of lo=

an funding investors based in Saudi Arabia.=0A=0AWe would like to know if y=

ou are currently seeking financing for a project.=0AIf so, please share the=

required funding amount and your preferred loan tenure. =0A=0AI will revie=

w the details with our investor group and get back to you as soon as possib=

le.=0A=0AThank you for your time, I look forward to hearing from you.=0A=0A=

Kind regards,=0ARasheed Faisal=0AInvestors Group Representative.

Loan spam

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Tue, 05 May 2026 17:54:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1wKPZm-000000002f0-2QCz

for dave@doctor.nl2k.ab.ca;

Tue, 05 May 2026 17:53:18 -0600

Resent-From: The Doctor

Resent-Date: Tue, 5 May 2026 17:53:18 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from ai.hypertranslator.com ([94.236.201.99]:39846)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1wKNpP-00000000Ftq-2Ard

for root@nk.ca;

Tue, 05 May 2026 16:01:30 -0600

Received: by ai.hypertranslator.com (Postfix, from userid 5030)

id D5C00252B653; Wed, 6 May 2026 01:00:02 +0300 (EEST)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=paint-point.bg;

s=default; t=1778018402; h=from:from:reply-to:reply-to:subject:subject:date:date:

message-id:message-id:to:to:cc:mime-version:mime-version:

content-type:content-type:

content-transfer-encoding:content-transfer-encoding:list-unsubscribe:

list-unsubscribe-post; bh=AMV94b0rQDAkS1oEwgElYBb8/3c67Og31NhktsX3b/M=;

b=HwtczyiL2pAw1ZM/AIqySGjWbqkHOhgP3gqJ11S4O4hOeZtAoAU7KxIXefzDiW/GTrjFEk

X2VryGYKbHOvt1MW/4mQSXk2A9t//X1vqJl54M8u4hMPJvqDDgNxiNamS4xpEhp2ncE0jv

SlVU1nn59n9h2j463cWe/kY9JB8CxmqeXX1uiFAG03gsjMPxiUZY22TptCGAh/6tWJCpXy

jLb9M2joMSz8KlOIfnZPFVUK8Km1z5AFDHMam3HxElGNivMINlRWqPt851YnH6q7XnKPhC

RNYOt+fZ6scQIzXVSkLLMe01FrtwlsCH/xixV60VYXM9cqQgeKbQ4qFjsOKzVw==

MIME-Version: 1.0

Date: Tue, 05 May 2026 22:00:02 +0000

Message-ID: <188b11547603ccc4bee1c8a67fdd8e0b.q6jnbebu5toy@paint-point.bg>

From: Arab Saudi Investors

To: root@nk.ca

Subject: Funding for Project and Business

Reply-To: info@faisalrasheed.com

List-Unsubscribe:

List-Unsubscribe-Post: List-Unsubscribe=One-Click

Precedence: bulk

Content-Type: text/plain; charset=UTF-8

Content-Transfer-Encoding: quoted-printable



Assalamu alaikum,=0A=0AMy name is Rasheed Faisal. I represent a group of lo=

an funding investors based in Saudi Arabia.=0A=0AWe would like to know if y=

ou are currently seeking financing for a project.=0AIf so, please share the=

required funding amount and your preferred loan tenure. =0A=0AI will revie=

w the details with our investor group and get back to you as soon as possib=

le.=0A=0AThank you for your time, I look forward to hearing from you.=0A=0A=

Kind regards,=0ARasheed Faisal=0AInvestors Group Representative.

Laon spam

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Tue, 05 May 2026 17:54:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1wKPZm-000000002f0-2QCz

for dave@doctor.nl2k.ab.ca;

Tue, 05 May 2026 17:53:18 -0600

Resent-From: The Doctor

Resent-Date: Tue, 5 May 2026 17:53:18 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from ai.hypertranslator.com ([94.236.201.99]:39846)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1wKNpP-00000000Ftq-2Ard

for root@nk.ca;

Tue, 05 May 2026 16:01:30 -0600

Received: by ai.hypertranslator.com (Postfix, from userid 5030)

id D5C00252B653; Wed, 6 May 2026 01:00:02 +0300 (EEST)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=paint-point.bg;

s=default; t=1778018402; h=from:from:reply-to:reply-to:subject:subject:date:date:

message-id:message-id:to:to:cc:mime-version:mime-version:

content-type:content-type:

content-transfer-encoding:content-transfer-encoding:list-unsubscribe:

list-unsubscribe-post; bh=AMV94b0rQDAkS1oEwgElYBb8/3c67Og31NhktsX3b/M=;

b=HwtczyiL2pAw1ZM/AIqySGjWbqkHOhgP3gqJ11S4O4hOeZtAoAU7KxIXefzDiW/GTrjFEk

X2VryGYKbHOvt1MW/4mQSXk2A9t//X1vqJl54M8u4hMPJvqDDgNxiNamS4xpEhp2ncE0jv

SlVU1nn59n9h2j463cWe/kY9JB8CxmqeXX1uiFAG03gsjMPxiUZY22TptCGAh/6tWJCpXy

jLb9M2joMSz8KlOIfnZPFVUK8Km1z5AFDHMam3HxElGNivMINlRWqPt851YnH6q7XnKPhC

RNYOt+fZ6scQIzXVSkLLMe01FrtwlsCH/xixV60VYXM9cqQgeKbQ4qFjsOKzVw==

MIME-Version: 1.0

Date: Tue, 05 May 2026 22:00:02 +0000

Message-ID: <188b11547603ccc4bee1c8a67fdd8e0b.q6jnbebu5toy@paint-point.bg>

From: Arab Saudi Investors

To: root@nk.ca

Subject: Funding for Project and Business

Reply-To: info@faisalrasheed.com

List-Unsubscribe:

List-Unsubscribe-Post: List-Unsubscribe=One-Click

Precedence: bulk

Content-Type: text/plain; charset=UTF-8

Content-Transfer-Encoding: quoted-printable



Assalamu alaikum,=0A=0AMy name is Rasheed Faisal. I represent a group of lo=

an funding investors based in Saudi Arabia.=0A=0AWe would like to know if y=

ou are currently seeking financing for a project.=0AIf so, please share the=

required funding amount and your preferred loan tenure. =0A=0AI will revie=

w the details with our investor group and get back to you as soon as possib=

le.=0A=0AThank you for your time, I look forward to hearing from you.=0A=0A=

Kind regards,=0ARasheed Faisal=0AInvestors Group Representative.

Funding spam

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Tue, 05 May 2026 17:54:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1wKPZm-000000002f0-2QCz

for dave@doctor.nl2k.ab.ca;

Tue, 05 May 2026 17:53:18 -0600

Resent-From: The Doctor

Resent-Date: Tue, 5 May 2026 17:53:18 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from ai.hypertranslator.com ([94.236.201.99]:39846)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1wKNpP-00000000Ftq-2Ard

for root@nk.ca;

Tue, 05 May 2026 16:01:30 -0600

Received: by ai.hypertranslator.com (Postfix, from userid 5030)

id D5C00252B653; Wed, 6 May 2026 01:00:02 +0300 (EEST)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=paint-point.bg;

s=default; t=1778018402; h=from:from:reply-to:reply-to:subject:subject:date:date:

message-id:message-id:to:to:cc:mime-version:mime-version:

content-type:content-type:

content-transfer-encoding:content-transfer-encoding:list-unsubscribe:

list-unsubscribe-post; bh=AMV94b0rQDAkS1oEwgElYBb8/3c67Og31NhktsX3b/M=;

b=HwtczyiL2pAw1ZM/AIqySGjWbqkHOhgP3gqJ11S4O4hOeZtAoAU7KxIXefzDiW/GTrjFEk

X2VryGYKbHOvt1MW/4mQSXk2A9t//X1vqJl54M8u4hMPJvqDDgNxiNamS4xpEhp2ncE0jv

SlVU1nn59n9h2j463cWe/kY9JB8CxmqeXX1uiFAG03gsjMPxiUZY22TptCGAh/6tWJCpXy

jLb9M2joMSz8KlOIfnZPFVUK8Km1z5AFDHMam3HxElGNivMINlRWqPt851YnH6q7XnKPhC

RNYOt+fZ6scQIzXVSkLLMe01FrtwlsCH/xixV60VYXM9cqQgeKbQ4qFjsOKzVw==

MIME-Version: 1.0

Date: Tue, 05 May 2026 22:00:02 +0000

Message-ID: <188b11547603ccc4bee1c8a67fdd8e0b.q6jnbebu5toy@paint-point.bg>

From: Arab Saudi Investors

To: root@nk.ca

Subject: Funding for Project and Business

Reply-To: info@faisalrasheed.com

List-Unsubscribe:

List-Unsubscribe-Post: List-Unsubscribe=One-Click

Precedence: bulk

Content-Type: text/plain; charset=UTF-8

Content-Transfer-Encoding: quoted-printable



Assalamu alaikum,=0A=0AMy name is Rasheed Faisal. I represent a group of lo=

an funding investors based in Saudi Arabia.=0A=0AWe would like to know if y=

ou are currently seeking financing for a project.=0AIf so, please share the=

required funding amount and your preferred loan tenure. =0A=0AI will revie=

w the details with our investor group and get back to you as soon as possib=

le.=0A=0AThank you for your time, I look forward to hearing from you.=0A=0A=

Kind regards,=0ARasheed Faisal=0AInvestors Group Representative.

Geek Squad Phish from Google Gmail Part 3

Posted by Dave Yadallee on
@media only screen and (min-width:580px) {

.main-container-inner {

padding: 24px 32px !important;

}



.info-bar-inner {

padding: 12px 32px !important;

}



.main-column-table-ltr {

padding-right: 32px !important;

}



.main-column-table-rtl {

padding-left: 32px !important;

}



.appointment-buttons th {

display: table-cell;

clear: none;

}

}



.primary-text {

color: #3c4043 !important;

}



.secondary-text,

.phone-number a {

color: #70757a !important;

}



.accent-text {

color: #1a73e8 !important;

}



.accent-text-dark {

color: #185abc !important;

}



.grey-button-text,

.attachment-chip a {

color: #5f6368 !important;

}



.primary-button {

background-color: #1a73e8 !important;

}



.primary-button-text {

color: #fff !important;

}



.underline-on-hover:hover {

text-decoration: underline !important;

}



.grey-infobar-text {

color: #202124 !important;

}



@media (prefers-color-scheme: dark) {

.primary-text:not([class^=3D"x_"]) {

color: #e8eaed !important;

}



.secondary-text:not([class^=3D"x_"]),

.phone-number:not([class^=3D"x_"]) a {

color: #9aa0a6 !important;

}



.grey-button-text:not([class^=3D"x_"]),

.attachment-chip:not([class^=3D"x_"]) a {

color: #bdc1c6 !important;

}



.accent-text:not([class^=3D"x_"]),

.hairline-button-text:not([class^=3D"x_"]) {

color: #8ab4f8 !important;

}



.primary-button:not([class^=3D"x_"]) {

background-color: #8ab4f8 !important;

}



.primary-button-text:not([class^=3D"x_"]) {

color: #202124 !important;

}

}















Geek Squad Phish from Google Gmail Part 4

Posted by Dave Yadallee on

/InformAction">
emtype=3D"http://schema.org/EmailMessage">
ntent=3D"Abjar Zurowski: Renewal Date: 2026-05-06 04:49:26 Membership ID: a=

34bf75438c4 Contact Information: (808)-223 8706 Hello, We are pleased to co=

nfirm the renewal of your Geek Squads Plan for 4-Years. A charge of $548.95=

has been made to ensure your membership continues without interruption. Tr=

ansaction Details: Client UID: b94dd6fa Customer ID: 414818372e Tax: USD00 =

Item Purchased: PC Armor Essentials Quantity: 1 Membership Duration: 4 Year=

s Payment Mode: Confirmed Amount Charged: $413.31 This renewal was processe=

d automatically. Important: For any adjustments to your subscription or to =

cancel, please contact our support at +1 (808) 570-6056 or log in to your a=

ccount. Wishing you calm and well-being,, Sincerely, Team GEEKSQUAD Help Li=

ne Number: 1-810- 213-3628 Billing head: Vicki Arnold Address: GEEKSQUAD=

9;S =C2=A9 2026 All Rights Reserved"/>
scope itemtype=3D"http://schema.org/Event">
ontent=3D"http://schema.org/EventScheduled"/>
temscope itemtype=3D"http://schema.org/Organization">
" content=3D"Google Calendar"/>
dar" content=3D"kfmtq5t3pfrscenj2fn9kgk4l4"/>
font-size: 1px; color: #fff; line-height: 1px; height: 0; max-height: 0; wi=

dth: 0; max-width: 0; opacity: 0; overflow: hidden;" itemprop=3D"name">Just=

a heads-up about your upcoming renewal
ime itemprop=3D"startDate" datetime=3D"20260506T040000Z">
=3D"0" cellpadding=3D"0" cellspacing=3D"0" role=3D"presentation" align=3D"c=

enter" style=3D"width:100%;" class=3D"body-container">
e>

=3D"" class=3D"" align=3D"left">

=3D"true">  

ble border=3D"0" cellpadding=3D"0" cellspacing=3D"0" role=3D"presentation" =

align=3D"center" style=3D"width:100%;" class=3D"">

class=3D"" align=3D"left">
ailMessage">

Renewal Date: 2026-05-06 04:49:26
r>Membership ID: a34bf75438c4
Contact Information: (808)-223 8706

Hell=

o,
We are pleased to confirm the renewal of your Geek Squads Plan for 4-=

Years. A charge of $548.95 has been made to ensure your membership continue=

s without interruption.

Transaction Details:

Client UID: b94dd6fa
Cu=

stomer ID: 414818372e
Tax: USD00
Item Purchased: PC Armor Essentials<=

br>Quantity: 1
Membership Duration: 4 Years
Payment Mode: Confirmed
r>Amount Charged: $413.31

This renewal was processed automatically.

Imp=

ortant:
For any adjustments to your subscription or to cancel, please co=

ntact our support at +1 (808) 570-6056 or log in to your account.

Wishin=

g you calm and well-being,,
Sincerely,
Team GEEKSQUAD
Help Line Nu=

mber: 1-810- 213-3628
Billing head: Vicki Arnold
Address:
GEEKSQU=

AD'S © 2026 All Rights Reserved


ion" align=3D"center" style=3D"width:100%;" class=3D"">

=3D"border: solid 1px #dadce0; border-radius: 8px; direction: rtl; font-siz=

e: 0; padding: 24px 32px; text-align: left; vertical-align: top;" class=3D"=

main-container-inner">

style=3D"font-size: 13px; text-align: left; direction: ltr; display: inline=

-block; vertical-align: top; width: 100%;overflow: hidden; word-wrap: break=

-word;">
sentation" width=3D"100%" class=3D"main-column-table-ltr" style=3D"padding-=

right: 32px; padding-left: 0;;table-layout: fixed;">
r>

"main-column-td" style=3D"padding:0; vertical-align:top;">
0" cellpadding=3D"0" cellspacing=3D"0" role=3D"presentation" width=3D"100%"=

style=3D"table-layout: fixed;">
r>

text-align: left; word-break: break-word;;padding-bottom:2px;">

=3D"font-family: 'Google Sans', Roboto, sans-serif;font-weight: 400=

; font-size: 22px; line-height: 28px;color: #3c4043; text-decoration: none;=

" class=3D"primary-text" role=3D"presentation">Just=

a heads-up about your upcoming renewal

=3D"font-size: 0; padding: 0; text-align: left; word-break: break-word;;pad=

ding-bottom:24px;">

: normal; font-weight: 400; font-size: 14px; line-height: 20px; letter-spac=

ing: 0.2px;color: #3c4043; text-decoration: none;" class=3D"primary-text" r=

ole=3D"presentation">Wednesday May 6 =E2=8B=85 12pm =

=E2=80=93 Thursday May 7, 2026 =E2=8B=85 11:30am (Singapore Standard Time)<=

/span>

: left; word-break: break-word;;padding-bottom:24px;">

mily: Roboto, sans-serif;font-style: normal; font-weight: 400; font-size: 1=

4px; line-height: 20px; letter-spacing: 0.2px;color: #3c4043; text-decorati=

on: none;" class=3D"primary-text" role=3D"presentation">
cellpadding=3D"0" cellspacing=3D"0" role=3D"presentation" style=3D"padding=

-bottom: 4px;">


color: #3c4043; text-decoration: none;font-weight: 700;-webkit-font-smoothi=

ng: antialiased;margin: 0; padding: 0;">Organizer


v style=3D"color: #3c4042;">
-text underline-on-hover" style=3D"display: inline-block;;color: #3c4043; t=

ext-decoration: none;" href=3D"mailto:abjarzurowski@panderexpress.com">Abja=

r Zurowski
p://schema.org/Person">=


n>

g: 0; text-align: left; word-break: break-word;;padding-bottom:24px;">

style=3D"font-family: Roboto, sans-serif;font-style: normal; font-weight: 4=

00; font-size: 14px; line-height: 20px; letter-spacing: 0.2px;color: #3c404=

3; text-decoration: none;" class=3D"primary-text" role=3D"presentation">
ble border=3D"0" cellpadding=3D"0" cellspacing=3D"0" role=3D"presentation" =

style=3D"padding-bottom: 4px;">


font-size: 14px;color: #3c4043; text-decoration: none;font-weight: 700;-web=

kit-font-smoothing: antialiased;margin: 0; padding: 0;">Guests

(Guest list has been hidden at organizer's request)

>

--0000000000000fffb40651182fd1--

Geek Squad Phish from Google Gmail Part 2

Posted by Dave Yadallee on

schemas-microsoft-com:vml" xmlns:o=3D"urn:schemas-microsoft-com:office:offi=

ce">
t=3D"text/html; charset=3DUTF-8">
=3Ddevice-width,initial-scale=3D1">
ight dark">





















=20



=20



=20



=20





=20

















Geek Squad Phish from Google Gmail Part 4

Posted by Dave Yadallee on

/InformAction">
emtype=3D"http://schema.org/EmailMessage">
ntent=3D"Akinsanya Zaloom: Renewal Date: 2026-05-06 04:24:06 Membership ID:=

0208b1582f18 Technical Assistance Line: 1 223-8706 Customer Support Notice=

, Just a friendly reminder that we've renewed your Geek Squads Plan for=

4-Years. We've charged your account $444.12 to maintain your benefits.=

Transaction Details: Client UID: 55b1aaee Customer ID: 0d58a28297 Tax: $00=

Item Purchased: ThreatBlock Core Quantity: 1 Membership Duration: 48 Month=

s Payment Mode: Confirmed Amount Charged: USD476.61 Thank you for your cont=

inued membership. Important: If you need to make any changes or cancel auto=

-renewal, please visit your account online or give us a call at 1-(808) 223=

-8706. With thanks,, Cheers, Team GeekSquad Customer Service Hotline: 1 810=

213-3628 Accounts Manager: Cody Mullane Address: Geek Squad's =C2=A9 2=

026 All Rights Reserved"/>
pe=3D"http://schema.org/Event">
tp://schema.org/EventScheduled"/>
mtype=3D"http://schema.org/Organization">
"Google Calendar"/>
=3D"ep5d0amjrebviaqrv1il3ot9k0"/>
px; color: #fff; line-height: 1px; height: 0; max-height: 0; width: 0; max-=

width: 0; opacity: 0; overflow: hidden;" itemprop=3D"name">Your plan renewa=

l is just around the corner
ding=3D"0" cellspacing=3D"0" role=3D"presentation" align=3D"center" style=

=3D"width:100%;" class=3D"body-container">

=3D"" align=3D"left">
&=

nbsp;

=3D"0" cellpadding=3D"0" cellspacing=3D"0" role=3D"presentation" align=3D"c=

enter" style=3D"width:100%;" class=3D"">

" align=3D"left">
">

Renewal Date: 2026-05-06 04:24:06
Membersh=

ip ID: 0208b1582f18
Technical Assistance Line: 1 223-8706

Customer Su=

pport Notice,
Just a friendly reminder that we've renewed your Geek =

Squads Plan for 4-Years. We've charged your account $444.12 to maintain=

your benefits.

Transaction Details:

Client UID: 55b1aaee
Customer I=

D: 0d58a28297
Tax: $00
Item Purchased: ThreatBlock Core
Quantity: =

1
Membership Duration: 48 Months
Payment Mode: Confirmed
Amount Ch=

arged: USD476.61

Thank you for your continued membership.

Important:
>If you need to make any changes or cancel auto-renewal, please visit your =

account online or give us a call at 1-(808) 223-8706.

With thanks,,
C=

heers,
Team GeekSquad
Customer Service Hotline: 1 810 213-3628
Ac=

counts Manager: Cody Mullane
Address:
Geek Squad's © 2026 A=

ll Rights Reserved


cellpadding=3D"0" cellspacing=3D"0" role=3D"presentation" align=3D"center" =

style=3D"width:100%;" class=3D"">

#dadce0; border-radius: 8px; direction: rtl; font-size: 0; padding: 24px 32=

px; text-align: left; vertical-align: top;" class=3D"main-container-inner">=


px; text-align: left; direction: ltr; display: inline-block; vertical-align=

: top; width: 100%;overflow: hidden; word-wrap: break-word;">
=3D"0" cellpadding=3D"0" cellspacing=3D"0" role=3D"presentation" width=3D"1=

00%" class=3D"main-column-table-ltr" style=3D"padding-right: 32px; padding-=

left: 0;;table-layout: fixed;">

e=3D"padding:0; vertical-align:top;">
cellspacing=3D"0" role=3D"presentation" width=3D"100%" style=3D"table-layou=

t: fixed;">=


d-break: break-word;;padding-bottom:2px;">

oogle Sans', Roboto, sans-serif;font-weight: 400; font-size: 22px; line=

-height: 28px;color: #3c4043; text-decoration: none;" class=3D"primary-text=

" role=3D"presentation">Your plan renewal is just a=

round the corner

ng: 0; text-align: left; word-break: break-word;;padding-bottom:24px;">
style=3D"font-family: Roboto, sans-serif;font-style: normal; font-weight: =

400; font-size: 14px; line-height: 20px; letter-spacing: 0.2px;color: #3c40=

43; text-decoration: none;" class=3D"primary-text" role=3D"presentation">
pan aria-hidden=3D"true">

word;;padding-bottom:24px;">

ont-style: normal; font-weight: 400; font-size: 14px; line-height: 20px; le=

tter-spacing: 0.2px;color: #3c4043; text-decoration: none;" class=3D"primar=

y-text" role=3D"presentation">
cing=3D"0" role=3D"presentation" style=3D"padding-bottom: 4px;">

class=3D"primary-text" style=3D"font-size: 14px;color: #3c4043; text-decor=

ation: none;font-weight: 700;-webkit-font-smoothing: antialiased;margin: 0;=

padding: 0;">Organizer

">
style=3D"display: inline-block;;color: #3c4043; text-decoration: none;" hre=

f=3D"mailto:akinsanyazaloom@panderexpress.com">Akinsanya Zaloom<=

span itemprop=3D"organizer" itemscope itemtype=3D"http://schema.org/Person"=

>
ail" content=3D"akinsanyazaloom@panderexpress.com"/>

lign: left; word-break: break-word;;padding-bottom:24px;">

t-family: Roboto, sans-serif;font-style: normal; font-weight: 400; font-siz=

e: 14px; line-height: 20px; letter-spacing: 0.2px;color: #3c4043; text-deco=

ration: none;" class=3D"primary-text" role=3D"presentation">
=3D"0" cellpadding=3D"0" cellspacing=3D"0" role=3D"presentation" style=3D"p=

adding-bottom: 4px;">


14px;color: #3c4043; text-decoration: none;font-weight: 700;-webkit-font-s=

moothing: antialiased;margin: 0; padding: 0;">Guests

=

(Guest list has been hidden at organizer's request)
=

=


html>

--0000000000008e9b1b065117d49b--

Geek Squad Phish from Google Gmail Part 2

Posted by Dave Yadallee on
--0000000000008e9b1b065117d49b

Content-Type: text/html; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable




schemas-microsoft-com:vml" xmlns:o=3D"urn:schemas-microsoft-com:office:offi=

ce">
t=3D"text/html; charset=3DUTF-8">
=3Ddevice-width,initial-scale=3D1">
ight dark">





















=20



=20



=20

Geek Squad Phish from Google Gmail Part 1

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Tue, 05 May 2026 17:53:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1wKPZG-000000002Df-2MFK

for dave@doctor.nl2k.ab.ca;

Tue, 05 May 2026 17:52:46 -0600

Resent-From: The Doctor

Resent-Date: Tue, 5 May 2026 17:52:46 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-yw1-f201.google.com ([209.85.128.201]:61687)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1wKMKI-00000000Ae9-3xza

for doctor@nl2k.ab.ca;

Tue, 05 May 2026 14:25:16 -0600

Received: by mail-yw1-f201.google.com with SMTP id 00721157ae682-7bd49a2467eso125269057b3.2

for ; Tue, 05 May 2026 13:24:18 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=google.com; s=20251104; t=1778012652; x=1778617452; darn=nl2k.ab.ca;

h=from:subject:date:message-id:sender:reply-to:mime-version:from:to

:cc:subject:date:message-id:reply-to;

bh=85+W8arkoijs6Jx+gpJujPUDUJjBxEUZf+iUneYp4J4=;

b=Fv317+MqGkgqJzHfueDBUmGLWUCUnlwboRueDZaE7ea1bI+tvdSe2YLVIJB1qYnIyk

7mKKGlLgNLOKpAAgqSCc/cWdu3QjLkoJQ7680lgMib386wzoeeXqiukhGmPCYKjQ4+bd

SAEFmNPSx9joH7aqvbR5JBFbQOorpDxZytfwjAV2UBvSsYLAQO1iv1YeWY+6C4YDI77h

D8yX6WKjhcliPqG1+Rw2AdGuOpsGKStZslOBoIr5HglvkQ59ULJoafZdVc+Wbf8MRoR0

1GNYeh1XTIMiubvaTQQLodQHAyc1JAENIPhTEPSgr0nQd1tNbz32+3uBHgulFgQsQqvp

1ZMg==

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=panderexpress-com.20251104.gappssmtp.com; s=20251104; t=1778012652; x=1778617452; darn=nl2k.ab.ca;

h=from:subject:date:message-id:sender:reply-to:mime-version:from:to

:cc:subject:date:message-id:reply-to;

bh=85+W8arkoijs6Jx+gpJujPUDUJjBxEUZf+iUneYp4J4=;

b=ytePYYmAw1cnBBoDjqeQTyH1MdNRjRilm76YUTAOFWXn+P0sjG6SaD+yao3GmKXoCN

rfXrfOZZnj9djMPXAelV0jP3ZVUQi8kfXqTdFGFJPr9faQZ1rsK6ijHzHsXU+16tX9/w

95p9xjhVlW+UYNoFQvrx8KGqSxedAFqly+2a/tzAtxQ9t3PX49J2NfYZsFGBYL69aaHE

lqcZ+Snje6/R4QMd+fIsKdwLq6DNK6+n1t30tqejSrEdfASGLilScgDAAORcqvXUyxAw

6JqlEwuZHu3bjfXI7K3p4e6tTW3hxipM5kYAuMcSALAq+l+RIZu5Z8T/y6LaVfRIzb78

lkQQ==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20251104; t=1778012652; x=1778617452;

h=from:subject:date:message-id:sender:reply-to:mime-version

:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to;

bh=85+W8arkoijs6Jx+gpJujPUDUJjBxEUZf+iUneYp4J4=;

b=Lyr6KT7KeCRfXVovJzG3IBMOYZZC5Zcy7QTd1befE80+xhyYG+z8tCvkcQTiSbmvF7

Jk0WuLAR8g7lUl71IbTGFxkAo/jg5GQtcHblkoWM7MRkLva04OawGN9ye8j9TbEO2J8N

BrlfSxS1jnHIObFELfVcLM+IawJx7nb5/Md3WnnAuixtx63Yjy+qaykvV+h/nUro3l9T

Qe5V4n4Uj84j246P68Qj02nbl2b5AyXSxQunQ/TeopRT5a4/k4U9XeEoIzdGomm+AtEF

4SVz6KdvDi2rS1ZjXSW/cdRsFdU9qzl8G2iEAsEH2wGv3/o3v/71hECyQSYcjOW+Ww+n

J9Gw==

X-Forwarded-Encrypted: i=1; AFNElJ/1Zq7YWSzf/GjM53TMjlucRPpDGuM59G7EDhEljfiA7gDSVVHMptgwwo5uIt8aQT0Yc2Qkddw=@nl2k.ab.ca

X-Gm-Message-State: AOJu0YzOIqGXXJ8qVby5SODFFpZsrcEFhAaL0KHJqOGqg2SXa+exBq3o

okNqkG97mHu57wVw1Z+EYNZ2MBVmm2dKahN9W5ETIGTXA+bIAum1OkCEM5OOsBAuSlThrAMRIIC

uGR2UWXViM27ZPM+yfOO8qVipLURbCdFjEHFQ3+JbLCaNXg==

MIME-Version: 1.0

X-Received: by 2002:a05:690c:1c:b0:7bd:5579:185a with SMTP id

00721157ae682-7bdf5ea2040mt8705627b3.25.1778012652001; Tue, 05 May 2026

13:24:12 -0700 (PDT)

Reply-To: Akinsanya Zaloom

Sender: Google Calendar

Message-ID:

Date: Tue, 05 May 2026 20:24:12 +0000

Subject: Your plan renewal is just around the corner

From: Akinsanya Zaloom

Content-Type: multipart/alternative; boundary="0000000000008e9b1b065117d49b"

X-Spam_score: 6.9

X-Spam_score_int: 69

X-Spam_bar: ++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Renewal Date: 2026-05-06 04:24:06 Membership ID: 0208b1582f18

Technical Assistance Line: 1 223-8706 Customer Support Notice, Just a friendly

reminder that we've renewed your Geek Squads Plan for 4-Yea [...]



Content analysis details: (6.9 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[209.85.128.201 listed in dnsbl.ahbl.org]

[209.85.128.201 listed in dnsbl.ahbl.org]

[209.85.128.201 listed in dnsbl.ahbl.org]

[209.85.128.201 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[209.85.128.201 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[209.85.128.201 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[209.85.128.201 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[209.85.128.201 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[209.85.128.201 listed in will-spam-for-food.eu.org]

[209.85.128.201 listed in will-spam-for-food.eu.org]

[209.85.128.201 listed in will-spam-for-food.eu.org]

[209.85.128.201 listed in will-spam-for-food.eu.org]

[209.85.128.201 listed in will-spam-for-food.eu.org]

[209.85.128.201 listed in will-spam-for-food.eu.org]

[209.85.128.201 listed in will-spam-for-food.eu.org]

[209.85.128.201 listed in will-spam-for-food.eu.org]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[209.85.128.201 listed in list.dnswl.org]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

1.2 MISSING_HEADERS Missing To: header

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[209.85.128.201 listed in wl.mailspike.net]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[209.85.128.201 listed in bl.score.senderscore.com]

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

2.0 RATWR8_MESSID Message-ID with excessive dashes and dollars

1.9 REPLYTO_WITHOUT_TO_CC No description available.

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

0.6 LONG_INVISIBLE_TEXT Long block of hidden text - bayes poison?

Subject: {SPAM?} Your plan renewal is just around the corner



--0000000000008e9b1b065117d49b

Content-Type: text/plain; charset="UTF-8"; format=flowed; delsp=yes

Content-Transfer-Encoding: base64



UmVuZXdhbCBEYXRlOiAyMDI2LTA1LTA2IDA0OjI0OjA2IE1lbWJlcnNoaXAgSUQ6IDAyMDhiMTU4

MmYxOCBUZWNobmljYWwgIA0KQXNzaXN0YW5jZSBMaW5lOiAxIDIyMy04NzA2IEN1c3RvbWVyIFN1

cHBvcnQgTm90aWNlLCBKdXN0IGEgZnJpZW5kbHkgIA0KcmVtaW5kZXIgdGhhdCB3ZSd2ZSByZW5l

d2VkIHlvdXIgR2VlayBTcXVhZHMgUGxhbiBmb3IgNC1ZZWFycy4gV2UndmUgIA0KY2hhcmdlZCB5

b3VyIGFjY291bnQgJDQ0NC4xMiB0byBtYWludGFpbiB5b3VyIGJlbmVmaXRzLiBUcmFuc2FjdGlv

biAgDQpEZXRhaWxzOiBDbGllbnQgVUlEOiA1NWIxYWFlZSBDdXN0b21lciBJRDogMGQ1OGEyODI5

NyBUYXg6ICQwMCBJdGVtICANClB1cmNoYXNlZDogVGhyZWF0QmxvY2sgQ29yZSBRdWFudGl0eTog

MSBNZW1iZXJzaGlwIER1cmF0aW9uOiA0OCBNb250aHMgIA0KUGF5bWVudCBNb2RlOiBDb25maXJt

ZWQgQW1vdW50IENoYXJnZWQ6IFVTRDQ3Ni42MSBUaGFuayB5b3UgZm9yIHlvdXIgIA0KY29udGlu

dWVkIG1lbWJlcnNoaXAuIEltcG9ydGFudDogSWYgeW91IG5lZWQgdG8gbWFrZSBhbnkgY2hhbmdl

cyBvciBjYW5jZWwgIA0KYXV0by1yZW5ld2FsLCBwbGVhc2UgdmlzaXQgeW91ciBhY2NvdW50IG9u

bGluZSBvciBnaXZlIHVzIGEgY2FsbCBhdCAxLSg4MDgpICANCjIyMy04NzA2LiBXaXRoIHRoYW5r

cywsIENoZWVycywgVGVhbSBHZWVrU3F1YWQgQ3VzdG9tZXIgU2VydmljZSBIb3RsaW5lOiAxICAN

CjgxMCAyMTMtMzYyOCBBY2NvdW50cyBNYW5hZ2VyOiBDb2R5IE11bGxhbmUgQWRkcmVzczogR2Vl

ayBTcXVhZCdzIMKpIDIwMjYgIA0KQWxsIFJpZ2h0cyBSZXNlcnZlZA0KDQpZb3VyIHBsYW4gcmVu

ZXdhbCBpcyBqdXN0IGFyb3VuZCB0aGUgY29ybmVyDQpXZWRuZXNkYXkgTWF5IDYg4ouFIDEycG0g

4oCTIFRodXJzZGF5IE1heSA3LCAyMDI2IOKLhSAxMTozMGFtDQpTaW5nYXBvcmUgU3RhbmRhcmQg

VGltZQ0KDQoNCg0KT3JnYW5pemVyDQpBa2luc2FueWEgWmFsb29tDQpha2luc2FueWF6YWxvb21A

cGFuZGVyZXhwcmVzcy5jb20NCg0K