Chinese Frieght broker spam

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Mon, 17 Aug 2026 11:28:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.5 (FreeBSD))

(envelope-from )

id 1ww17I-00000000NH1-0XsC

for dave@doctor.nl2k.ab.ca;

Mon, 17 Aug 2026 11:27:20 -0600

Resent-From: The Doctor

Resent-Date: Mon, 17 Aug 2026 11:27:20 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-m83201.xmail.ntesmail.com ([156.224.83.201]:41496)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.99.5 (FreeBSD))

(envelope-from )

id 1ww0p3-00000000Cyx-03O7

for sales@nk.ca;

Mon, 17 Aug 2026 11:08:38 -0600

Content-Type: multipart/alternative; BOUNDARY="=_Part_581537_246478220.1786986391736"

To: sales

Subject: =?UTF-8?B?UmU6UmU6IFN0aWxsIGxvb2tpbmcgZm9yIGEgcmVsaWFibGUgZnJlaWdodCBwYXJ0bmVyIGluIENoaW5hPyA=?=

X-Priority: 3

MIME-Version: 1.0

Received: from sales03_szx@bnclogistics.com( [10.139.4.160] ) by ajax-webmail ( [127.0.0.1] ) ; Tue, 18 Aug 2026 01:06:31 +0800 (GMT+08:00)

From: Sunny

Date: Tue, 18 Aug 2026 01:06:31 +0800 (GMT+08:00)

X-WM-Tid: 0aa010b0688c00f5kunm8d1bd201b7563

Message-ID:





Hi sales,

I hope this email finds you well.

Thank you for subscribing to our newsletter. We're thrilled to have you on board!

I am excited to inform you that we are currently offering a special promotion on our products.If you have any needs, please let me know as soon as possible so I can secure a discounted spot for you.

Thank you for your attention, and I look forward to hearing from you soon.

Best regards,







Do not miss a product highlight: hit . Stay Engaged



Whenever you’d like fewer emails, use Edit Email Choices.













Chinese products spam

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Mon, 17 Aug 2026 11:25:50 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.5 (FreeBSD))

(envelope-from )

id 1ww15J-00000000MXO-47hj

for dave@doctor.nl2k.ab.ca;

Mon, 17 Aug 2026 11:25:17 -0600

Resent-From: The Doctor

Resent-Date: Mon, 17 Aug 2026 11:25:17 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from [103.209.128.223] (port=63398 helo=mail-m128223.netease.com)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.99.5 (FreeBSD))

(envelope-from )

id 1wvyKG-00000000O0T-2Ggx

for sales@nk.ca;

Mon, 17 Aug 2026 08:28:46 -0600

Content-Type: multipart/alternative; BOUNDARY="=_Part_544939_211004546.1786976850860"

To: sales

Subject: =?UTF-8?B?UmU6TmVlZCBhIHJlbGlhYmxlIHN1cHBsaWVyIGZvciBnb2xmIGNhcnRzPw==?=

X-Priority: 3

MIME-Version: 1.0

Received: from park@hxcarts.com( [10.139.4.149] ) by ajax-webmail ( [127.0.0.1] ) ; Mon, 17 Aug 2026 22:27:30 +0800 (GMT+08:00)

From: Lilly

Date: Mon, 17 Aug 2026 22:27:30 +0800 (GMT+08:00)

X-WM-Tid: 0aa0101ed36100f5kunm2d3ca415ab6de

DKIM-Signature: a=rsa-sha256;

b=lXHqm5T0dEvINmUaYQO9wDltBl6lBosd5X3c8UJ6sn8Nx9y4AoI2MPWLfye4PRPvNJLhaDI/6OdQikGIQjVRWbHIy9jNRSBuftsoPEAY6WKmQMPN2xLDwVOtcoRZS918IWdJPbxmmQMolNED+Hw2Ar8iPPZ2bY2qISnWvXG9fFweyqJE3RpMasR5v+UjYFPEtnfjA7LWlwZ+oih5Cizh8kRQNNpQzVIenJW6Q/xWEeE14d+gaiM3OkJwnuvZg56sKt2SPEznsEt87kCtHNhlV6O8GMOaUuRarLHK4xpEMFGtkxH5kPKp4GAaHpWw1O1wVkhDQ/xLdTY7cmcGoy98yA==; s=default; c=relaxed/relaxed; d=hxcarts.com; v=1;

bh=/9BiRJFnJENXe+2H73kpfP9MZFdhtHd/6rxPp+P4oEs=;

h=date:mime-version:subject:message-id:from;

Message-ID:

X-Spam_score: 8.4

X-Spam_score_int: 84

X-Spam_bar: ++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Hi sales, I hope this email finds you well. Thank you for

reading our introductory email. We're here to assist if you have any further

questions or need more information. I am excited to inform you that we are

currently offering a special promotion on our products.If you have any needs,

please let me know as soon as possible so I can secure a discounted spot

for you. T [...]



Content analysis details: (8.4 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[103.209.128.223 listed in dnsbl.ahbl.org]

[103.209.128.223 listed in dnsbl.ahbl.org]

[103.209.128.223 listed in dnsbl.ahbl.org]

[103.209.128.223 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[103.209.128.223 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[103.209.128.223 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[103.209.128.223 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[103.209.128.223 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[103.209.128.223 listed in will-spam-for-food.eu.org]

[103.209.128.223 listed in will-spam-for-food.eu.org]

[103.209.128.223 listed in will-spam-for-food.eu.org]

[103.209.128.223 listed in will-spam-for-food.eu.org]

[103.209.128.223 listed in will-spam-for-food.eu.org]

[103.209.128.223 listed in will-spam-for-food.eu.org]

[103.209.128.223 listed in will-spam-for-food.eu.org]

[103.209.128.223 listed in will-spam-for-food.eu.org]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[103.209.128.223 listed in bl.score.senderscore.com]

-0.0 RCVD_IN_MSPIKE_H4 RBL: Very Good reputation (+4)

[103.209.128.223 listed in wl.mailspike.net]

-0.0 SPF_PASS SPF: sender matches SPF record

-0.0 RCVD_IN_MSPIKE_WL Mailspike good senders

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 HTML_MESSAGE BODY: HTML included in message

1.3 RDNS_NONE Delivered to internal network by a host with no rDNS

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

2.0 HTML_FONT_TINY_NORDNS Font too small to read, no rDNS

1.0 HTML_TEXT_INVISIBLE_STYLE HTML hidden text + other spam signs

2.0 MIXED_HREF_CASE Has href in mixed case

0.6 LONG_INVISIBLE_TEXT Long block of hidden text - bayes poison?

0.0 T_REMOTE_IMAGE Message contains an external image

Subject: {SPAM?} =?UTF-8?B?UmU6TmVlZCBhIHJlbGlhYmxlIHN1cHBsaWVyIGZvciBnb2xmIGNhcnRzPw==?=





Hi sales,

I hope this email finds you well.

Thank you for reading our introductory email. We're here to assist if you have any further questions or need more information.

I am excited to inform you that we are currently offering a special promotion on our products.If you have any needs, please let me know as soon as possible so I can secure a discounted spot for you.

Thank you for your attention, and I look forward to hearing from you soon.

Best regards,







Lock in your recurring product news by tapping . Receive Our Updates



Turn off occasional mailings anytime: Adjust Your Preferences.





Park

park@hxcarts.com









在2026-08-12，Lilly 写道:



-----原始邮件-----

发件人： Lilly

发件时间: 2026年08月12日 周三

收件人： [sales ]

主题： Need a reliable supplier for golf carts?



Hi Sales,

We make golf carts and electric tricycles. Factory direct. Fully customizable.

What that means for you:

- 30-50% lower cost than most brands

- Your logo, your color, your specs

- CE/EEC certified – ready for your market

We deliver 800+ units monthly from our China and Vietnam facilities. If you're currently sourcing these products, I'd love to send you our catalog and price list. Would you be open to a quick look?

This is my WhatsApp. Feel free to reach out anytime if there's any issue.



Whatsapp

Best regards, Lilly Anhui Huaxin Electric Technology Co., LTD





Stay informed with our latest news and enhancements by selecting . Stay Connected



If emails aren’t for you, hit Change Preferences.





Enable regular insights and our product’s newest features by hittinging . Continue Updates



If you’d rather not get more emails, just hit Adjust Settings at any time.



Park





park@hxcarts.com







在2026-07-10，Lilly 写道:



-----原始邮件-----

发件人： Lilly

发件时间: 2026年07月10日 周五

收件人： [sales ]

主题： Need a reliable supplier for golf carts?



Hi Sales,

We make golf carts and electric tricycles. Factory direct. Fully customizable.

What that means for you:

- 30-50% lower cost than most brands

- Your logo, your color, your specs

- CE/EEC certified – ready for your market

We deliver 800+ units monthly from our China and Vietnam facilities. If you're currently sourcing these products, I'd love to send you our catalog and price list. Would you be open to a quick look?

This is my WhatsApp. Feel free to reach out anytime if there's any issue.



Whatsapp

Best regards, Lilly Anhui Huaxin Electric Technology Co., LTD





Stay informed with our latest news and enhancements by selecting . Stay Connected



If emails aren’t for you, hit Change Preferences.





Enable regular insights and our product’s newest features by hittinging . Continue Updates



If you’d rather not get more emails, just hit Adjust Settings at any time.



Park





park@hxcarts.com









Business Buyer spam from Google Gmail

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Mon, 17 Aug 2026 11:25:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.5 (FreeBSD))

(envelope-from )

id 1ww14x-00000000MPw-1RrE

for dave@doctor.nl2k.ab.ca;

Mon, 17 Aug 2026 11:24:55 -0600

Resent-From: The Doctor

Resent-Date: Mon, 17 Aug 2026 11:24:55 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-pf1-f172.google.com ([209.85.210.172]:44336)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.99.5 (FreeBSD))

(envelope-from )

id 1wvy8M-00000000LQf-3nvS

for sales@nk.ca;

Mon, 17 Aug 2026 08:16:23 -0600

Received: by mail-pf1-f172.google.com with SMTP id d2e1a72fcca58-848643382fcso3550655b3a.1

for ; Mon, 17 Aug 2026 07:15:28 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=bankingtheadvisoryib.com; s=google; t=1786976122; x=1787580922; darn=nk.ca;

h=content-type:mime-version:date:content-transfer-encoding:subject:to

:from:message-id:from:to:cc:subject:date:message-id:reply-to

:content-type;

bh=8c6Kr94NMFpOPW0aQ75oxZ3gDTZPmJyVZruJdn8JFXY=;

b=eov0QZzoVV6GiO6ssMec2xbxqxYeIwxRMEqBOnny1Joy55PaSbybWRS/NGbXit+g7G

IWmCdF/rq2SXBKZBI8cTeDjaCr3EeFFK6SP6RQX7yAkzIWkwRReYEX0qdnOubdlOB6yl

xSBUS/qJgZf6+YcM85cFhully18Gr928BojS0k/E/3lPBuV5ijFdVhvoCs6MSLDbzIpX

bqGiJp5x/y81z+7HTT3fAvsEaUa9jMpTFqX14PfYMyTXoGx4BfMZFds/IMAe2wbrHWVT

VuHSrrAxy2RtUl3thtMUuBx7LN71gIbz35I74gA58tQ/k+cLf9ywpeuyOtgApgc9CGiI

UADQ==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20251104; t=1786976122; x=1787580922;

h=content-type:mime-version:date:content-transfer-encoding:subject:to

:from:message-id:x-gm-gg:x-gm-message-state:from:to:cc:subject:date

:message-id:reply-to:content-type;

bh=8c6Kr94NMFpOPW0aQ75oxZ3gDTZPmJyVZruJdn8JFXY=;

b=QWPaZ/wym4K6Y7RwkKYgGFD0JonTdYtBpInf1zdJh1U65ABmysYCqEk2kM0N/btgfa

r/o5yA0qhwxmMFlHir+xOeP1tFuHLAbje5d5DjehdQqi3TJIhPlEKwaTKPBy1uTpM9wZ

GJ0KY5o2mQjbJc30yDJsQZYnyjqm27G+OGI9sgZfUfW6bXL5fKUwk+tglJlg2VuFMV5I

TxL5O0fNH7EzMwBmLFv5aQ2AvUxjEGeKcG+DGX+lEd7+vKIoCsUVmYbwTWuPxTakOwXW

16mv9gahDkD2sli7T+NKHRvNM9ijJ1i9GVePkrYSejcuvFTLwpTKFLyy3hXsquu4U9b3

EsKg==

X-Gm-Message-State: AOJu0Yw0I12qmvOmKVQKQpjY032qYgcQr2uqj1Cn9aXFdDLu02Z8Rh9c

j1r1v3RkeLB8hqnEt/1QkjjNIbJK1GxgnRA2AydLseIM7YRm0TV3Qggfr01agkxYIRPfzxpHgzD

rtN6bmw==

X-Gm-Gg: AR+sD11nguA+rjstJtrpFxxcDc7jim+/4bVvkE5wysnjfmHmLrO9VTcZJ9GkpWeWWPv

dBXPY8FqZPtESmhvJQV3xuyFyAmgl3wS9e1l+Ch9eifwJ7jMYslTSxHbRjMmSxXj/JjzMG6ki5H

BJiRFVYX5u88+dsAh5cLe1be54wQoRbg5cP7sf1t7u2mIJqIE2KLQuJ17YQf2f6/2pqIRAWQXEk

oDJ785Ratto6oLXx8DOyb9xVIqX5igiKso0PhAtsrblnir8L+YtwwV75IiFDNHHxK2lJ6UIZ8tb

L5splbGyCCqamsIEkb9nsaGLSy7BCqWAGSAotb8vuW0eMSEK4uZXYgFqgRKIAtwKBq3gfykh92e

KfZPzOLv92R7p9ac+7ngoY5f5lplZ6MjLiTHj37JSoWCTFYda8WOcf6FV5J7Cf2J5C/xaro6SCx

6K6wfDgVfGyLB2lHK8aMESLZtiTzHWLZBAfvTop+bnq8wLj64lIazFGZ35/Lje9Qsa5kwX+QxSN

+i2R+NgJrP1tBzc2FfkCmdQoL08aXEyCHAXf6en1JAIIh3+1Daa8NFnUKpzfb21o7tI84gkCuHR

coVXK6GT6zbM

X-Received: by 2002:a05:690e:85:b0:66a:b22d:9c2b with SMTP id 956f58d0204a3-66cb9dae845mr263659d50.31.1786975796331;

Mon, 17 Aug 2026 07:09:56 -0700 (PDT)

Received: from 01a0100e-b9f5-703d-8d3b-111f37b9c027.local (ec2-3-90-89-111.compute-1.amazonaws.com. [3.90.89.111])

by smtp.gmail.com with ESMTPSA id 956f58d0204a3-66cb3eb8367sm846048d50.4.2026.08.17.07.09.55

for

(version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256);

Mon, 17 Aug 2026 07:09:56 -0700 (PDT)

Message-ID: <01a0100e-b9f5-703d-8d3b-111f37b9c027@bankingtheadvisoryib.com>

X-Mail-Abuse-Inquiries:

https://app.instantly.ai/privacy/report-abuse/01a0100e-b9f5-703d-8d3b-111f37b9c027

From: Oliver Bogner

To: sales@nk.ca

Subject: Buyer for Netknow Internet Knowledge

Content-Transfer-Encoding: quoted-printable

Date: Mon, 17 Aug 2026 14:09:55 +0000

MIME-Version: 1.0

Content-Type: text/plain; charset=utf-8

X-Spam_score: 8.5

X-Spam_score_int: 85

X-Spam_bar: ++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Hey, We're the number 1-ranked lower middle market investment

bank in the US (Axial, 2026) and there's a buyer who reached out specifically

regarding Netknow Internet Knowledge. I understand your journey firsthand

- personally sold five-plus companies, and that's precisely why I founded

The Advisory, to assist founders like yourself in selling their businesses.





Content analysis details: (8.5 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[209.85.210.172 listed in dnsbl.ahbl.org]

[209.85.210.172 listed in dnsbl.ahbl.org]

[209.85.210.172 listed in dnsbl.ahbl.org]

[209.85.210.172 listed in dnsbl.ahbl.org]

[3.90.89.111 listed in dnsbl.ahbl.org]

[3.90.89.111 listed in dnsbl.ahbl.org]

[3.90.89.111 listed in dnsbl.ahbl.org]

[3.90.89.111 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[209.85.210.172 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[209.85.210.172 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[209.85.210.172 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[209.85.210.172 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[3.90.89.111 listed in will-spam-for-food.eu.org]

[3.90.89.111 listed in will-spam-for-food.eu.org]

[3.90.89.111 listed in will-spam-for-food.eu.org]

[3.90.89.111 listed in will-spam-for-food.eu.org]

[3.90.89.111 listed in will-spam-for-food.eu.org]

[3.90.89.111 listed in will-spam-for-food.eu.org]

[3.90.89.111 listed in will-spam-for-food.eu.org]

[3.90.89.111 listed in will-spam-for-food.eu.org]

[209.85.210.172 listed in will-spam-for-food.eu.org]

[209.85.210.172 listed in will-spam-for-food.eu.org]

[209.85.210.172 listed in will-spam-for-food.eu.org]

[209.85.210.172 listed in will-spam-for-food.eu.org]

[209.85.210.172 listed in will-spam-for-food.eu.org]

[209.85.210.172 listed in will-spam-for-food.eu.org]

[209.85.210.172 listed in will-spam-for-food.eu.org]

[209.85.210.172 listed in will-spam-for-food.eu.org]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[209.85.210.172 listed in list.dnswl.org]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

1.9 URIBL_ABUSE_SURBL Contains an URL listed in the ABUSE SURBL blocklist

[URI: bankingtheadvisoryib.com]

1.9 URIBL_JP_SURBL Contains an URL listed in the JP SURBL blocklist

[URI: bankingtheadvisoryib.com]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-0.0 SPF_PASS SPF: sender matches SPF record

1.5 SUBJ_BUY Subject line starts with Buy or Buying

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[209.85.210.172 listed in bl.score.senderscore.com]

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[209.85.210.172 listed in wl.mailspike.net]

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

2.0 RATWR8_MESSID Message-ID with excessive dashes and dollars

Subject: {SPAM?} Buyer for Netknow Internet Knowledge



Hey,



We're the number 1-ranked lower middle market investment bank in the =

US (Axial, 2026) and there's a buyer who reached out specifically regarding=

Netknow Internet Knowledge.



I understand your journey firsthand - =

personally sold five-plus companies, and that's precisely why I founded The=

Advisory, to assist founders like yourself in selling their businesses.



Through my previous ventures, my work led to features in Forbes 30 under 30=

and an INC 5000 CEO designation, and currently, The Advisory holds a =

ranking as a leading investment bank in the US.



Valuations are very high =

right now - we see companies in your space go for up to 10x.



Would you be open to a brief call early next week?



Oliver Bogner

Managing Partner | The Advisory Investment Bank

Q1 2026 #1 Lower Middle =

Market Investment Bank on Axial

5x Top 5 Lower Middle Market Investment =

Bank on Axial

2x Forbes 30 Under 30 Alumni | 2x Inc 5,000 =

CEO

WealthSimple phish from Googel Cloud

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Mon, 17 Aug 2026 07:50:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.5 (FreeBSD))

(envelope-from )

id 1wvxic-000000002DA-06Mo

for dave@doctor.nl2k.ab.ca;

Mon, 17 Aug 2026 07:49:38 -0600

Resent-From: The Doctor

Resent-Date: Mon, 17 Aug 2026 07:49:37 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from weal03.l8cf9.com ([35.212.180.17]:59441)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.99.5 (FreeBSD))

(envelope-from )

id 1wvxXd-0000000009q-1Eyi

for doctor@nk.ca;

Mon, 17 Aug 2026 07:38:24 -0600

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; s=default; d=weal03.l8cf9.com;

h=Content-Type:MIME-Version:From:To:Subject:Date:Message-ID:List-Unsubscribe;

i=cvivnxdd@weal03.l8cf9.com;

bh=4qHOKB5LXLK8ThoFh756YD09DB+53l3/r/Q/Oub60RY=;

b=rjusQLK13Co2DzAXm8pDNNw3zDP+EzXKsU5U3cYgJvBJl/ORN1Gu8FIOKbPrfti6PYD2ZdgmModp

DBuG4lLdJF6HtsDT70IvpGNQba/QQvDofd3uOs1MZUMgdTSI1F49PQ9CJSmSSgiPf/mnKYA2dZoE

jRO8oyU8lLPIk2iJZTRImXPE6MDV7d+MCm3MhMoAWNEVV4rNbfDnvuKQ3CytUD7KTRc8GtCrsqQv

uagpX4WTrg1u+Dvef41CI0j4i44W/53fZtdWOa4QSFFibP4PBZX3aN8qRzcLMsIq+I3He6SKe/Mi

0pmzK0VOJlOC9O30D8M9Fw2fV1ArmbqsNyGo2A==

Content-Type: multipart/alternative;

boundary="===============4075441428081619561=="

MIME-Version: 1.0

From:

=?utf-8?b?V+KAi2XigIth4oCLbOKAi3TigIto4oCLc+KAi2nigItt4oCLcOKAi2zigItl4oCLIOKAi1PigIt14oCLcOKAi3DigItv4oCLcuKAi3Q=?=



To: doctor@nk.ca

Subject: Your 1% cash match is pending - claim it before the window closes -

Votre contrepartie de 1 % est en attente - reclamez-la avant la fermeture de

la periode d'offre

Date: Mon, 17 Aug 2026 09:37:29 -0400

Message-ID: <178697384991.5089.1547660197569891232@weal03.l8cf9.com>

X-Auto-Response-Suppress: OOF, DR, RN, NRN

List-Unsubscribe:

X-Spam_score: 8.8

X-Spam_score_int: 88

X-Spam_bar: ++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: YOUR 1% CASH MATCH IS PENDING ACTIVATION Your 1% cash match

is pending - claim it before the window closes ================================================================





Content analysis details: (8.8 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[35.212.180.17 listed in dnsbl.ahbl.org]

[35.212.180.17 listed in dnsbl.ahbl.org]

[35.212.180.17 listed in dnsbl.ahbl.org]

[35.212.180.17 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[35.212.180.17 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[35.212.180.17 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[35.212.180.17 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[35.212.180.17 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[35.212.180.17 listed in will-spam-for-food.eu.org]

[35.212.180.17 listed in will-spam-for-food.eu.org]

[35.212.180.17 listed in will-spam-for-food.eu.org]

[35.212.180.17 listed in will-spam-for-food.eu.org]

[35.212.180.17 listed in will-spam-for-food.eu.org]

[35.212.180.17 listed in will-spam-for-food.eu.org]

[35.212.180.17 listed in will-spam-for-food.eu.org]

[35.212.180.17 listed in will-spam-for-food.eu.org]

1.9 URIBL_ABUSE_SURBL Contains an URL listed in the ABUSE SURBL blocklist

[URI: www.qhdyskj.com]

1.9 URIBL_JP_SURBL Contains an URL listed in the JP SURBL blocklist

[URI: qhdyskj.com]

-0.0 SPF_PASS SPF: sender matches SPF record

-0.0 SPF_HELO_PASS SPF: HELO matches SPF record

0.6 HK_RANDOM_ENVFROM Envelope sender username looks random

1.0 HK_RANDOM_FROM From username looks random

-0.0 T_RP_MATCHES_RCVD Envelope sender domain matches handover relay

domain

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[35.212.180.17 listed in bl.score.senderscore.com]

1.5 MR_STRANGE_QUESTION URI: No description available.

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

0.5 VOWEL_FROM_5 Impronouncable from header (6 consecutive vowels)

0.0 LOTS_OF_MONEY Huge... sums of money

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

Subject: {SPAM?} Your 1% cash match is pending - claim it before the window closes -

Votre contrepartie de 1 % est en attente - reclamez-la avant la fermeture de

la periode d'offre





Wealthsimple

doctor, your 1% match is waiting — don’t let it expire unclaimed



When you move an existing investment account to Wealthsimple, we add 1% of the value to your account in real cash — not points, not credits. Your offer is still pending activation, and it won’t wait forever. If the offer window closes before you start your transfer, the match is gone.

YOUR PERSONAL OFFER

1%

CASH MATCH — PENDING ACTIVATION

Status: Not yet activated — expires if not claimed

WHAT YOU TRANSFERYOUR CASH MATCH

$10,000+$100

$50,000+$500

$100,000+$1,000



This offer is tied to your account and is time-limited. If the window closes before you begin a transfer, the 1% match is lost — it cannot be reinstated once the period ends.

HOW IT WORKS



Start your transfer in the app — we handle the paperwork with your current institution

Track your assets as they move securely, with updates along the way

Your 1% lands in cash as soon as the transfer settles — yours to keep, invest, or withdraw



Claim my match



Log in to activate your offer before the window closes.



Real cash, not a promo rate that disappears after three months. Whether you’re moving a TFSA, an RRSP, or a non-registered account, the same 1% applies. Millions of Canadians already invest with Wealthsimple — don’t leave your match on the table.

SECTION FRANÇAISE

Wealthsimple

doctor, votre contrepartie de 1 % vous attend — ne la laissez pas expirer



Lorsque vous transférez un compte de placement existant vers Wealthsimple, nous ajoutons 1 % de la valeur à votre compte en argent réel — pas des points, pas des crédits. Votre offre est toujours en attente d’activation, et elle n’attendra pas indéfiniment. Si la période d’offre se ferme avant que vous ne démarriez votre transfert, la contrepartie disparaît.

VOTRE OFFRE PERSONNELLE

1 %

CONTREPARTIE EN ESPÈCES — ACTIVATION EN ATTENTE

Statut : Non activée — expire si non réclamée

CE QUE VOUS TRANSFÉREZVOTRE CONTREPARTIE

10 000 $+100 $

50 000 $+500 $

100 000 $+1 000 $



Cette offre est liée à votre compte et est à durée limitée. Si la période se ferme avant que vous ne commenciez un transfert, la contrepartie de 1 % est perdue — elle ne peut pas être rétablie une fois la période terminée.

COMMENT ÇA FONCTIONNE



Démarrez votre transfert dans l’application — nous nous occupons des formalités avec votre institution actuelle

Suivez vos actifs pendant qu’ils se déplacent en toute sécurité, avec des mises à jour en cours de route

Votre 1 % est déposé en espèces dès que le transfert est réglé — à vous de le conserver, l’investir ou le retirer



Réclamer ma contrepartie



Connectez-vous pour activer votre offre avant la fermeture de la période.



De l’argent réel, pas un taux promotionnel qui disparaît après trois mois. Que vous transfériez un CELI, un REER ou un compte non enregistré, le même 1 % s’applique. Des millions de Canadiens investissent déjà avec Wealthsimple — ne laissez pas votre contrepartie sur la table.

Wealthsimple · Wealthsimple Investments Inc. · Member of CIPF

This is an automated offer notification sent to doctor. Terms and conditions apply. This offer may be modified or withdrawn at any time. Please review the full terms on our website before initiating a transfer.

© 2026 Wealthsimple. All rights reserved.

National Imprint Canada Show 2026: Full Attendee Profiles spam from Google Gmail

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Mon, 17 Aug 2026 07:50:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.5 (FreeBSD))

(envelope-from )

id 1wvxiQ-000000002BQ-1DVr

for dave@doctor.nl2k.ab.ca;

Mon, 17 Aug 2026 07:49:26 -0600

Resent-From: The Doctor

Resent-Date: Mon, 17 Aug 2026 07:49:26 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-ua1-f47.google.com ([209.85.222.47]:42215)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.99.5 (FreeBSD))

(envelope-from )

id 1wvx7D-00000000KmM-3sAp

for root@doctor.nl2k.ab.ca;

Mon, 17 Aug 2026 07:11:09 -0600

Received: by mail-ua1-f47.google.com with SMTP id a1e0cc1a2514c-97bf8775803so2041514241.0

for ; Mon, 17 Aug 2026 06:10:13 -0700 (PDT)

ARC-Seal: i=1; a=rsa-sha256; t=1786972206; cv=none;

d=google.com; s=arc-20260327;

b=NAFORQm+4q+LSB9HItpg011I5c/ZLU5WDI4psZVnDjHd+QQPhfLxgRpX7xJlbV31g+

w8Q9vBMcTxNgzUGs3KgxZXPKqjLPE3GBugbFbQWm5qHtyjmfLVIrCj8KPv+7lcyyeY7F

velRlLcQD9RRbDA7LZlR49j5jwfjHOTOOS2eOdZez1oIolwLqKmwMhhR6Bp9PZ6VWBtu

MXuYkMN9AN0hk10iifCDXB0nGaMswwdRdfrid/A6IoC2Na8zFNuwxpqrCPkw/ncj/js+

N3wQskzQsUGjviug7ydX+MrF84rZcJOHqz2yMxxwi8KvhBqNwtRMXI96pW/I5p9ROHX0

I7Ww==

ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20260327;

h=to:subject:message-id:date:from:mime-version:dkim-signature;

bh=3PLE70d/ZaRcXWTdfJ4spVfdmR5hhDzZLGvUga+iVs0=;

fh=e5VD+W3OJSu9XTveALTcrvrZBdIy2F6WYzkhx5/JJTo=;

b=Jpu69cXNAEpi4+bsbnnJBfoYD17x32+oQlHctGgErlNfsp8Z0+WV7q+qFLOF86us0l

ZGavnLscfl52ETb81YxWwAQ3jZNW9L31HYIlJb69r8092bcVtEy2+EPEUxrFHaCOpBX3

B/XgCEURECKK96NVG5n8UKKYqhV4DIPXXli6Qx+ZbZfdtA0TU6gDCnX8z+8qN5fXHPnQ

fY+Jcu7NrhsE5seDyVQwfLKUlrIoYWuRI3hLXU7erk8gHK9vUBzN5KDfWCv2cmzVHhV9

FRHaYGCc6Z2A0Qx+BeO69v+88/Eux+mlqlX5jnoTaouZX3FsGzXM6k6kHdY32nv/X6f/

WulA==;

darn=doctor.nl2k.ab.ca

ARC-Authentication-Results: i=1; mx.google.com; arc=none

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=gmail.com; s=20251104; t=1786972206; x=1787577006; darn=doctor.nl2k.ab.ca;

h=content-type:to:subject:message-id:date:from:mime-version:from:to

:cc:subject:date:message-id:reply-to:content-type;

bh=3PLE70d/ZaRcXWTdfJ4spVfdmR5hhDzZLGvUga+iVs0=;

b=Iorw9lexhnxjVXA8t8HVgJU0FSbnr5Ujl29F+JiJiuqYOQCzs1qOz5p7ohGPSBvrLf

6WXFwCex6lxRMzrvcDJiH7jRB+CRHju+soa7uF1kK9c0MVqES1nzgyvTsl4a/dleoF1g

J0FA02A4Tvd6y6Nv91wc5xel+KJQUsN8t7I45UzI8fM4tOndMlBljoFi4MuQ2ignvL2t

hGi7S38ERPQMRrcyHp0mmtbKOpEooO36pxpJdwnQ9F8YH7w1TU35NRDr7tRWz8cZj0xw

EIicVsmDb4Nf5qY4suLeTvSNoJ7iOS2+SEp+eFfxx5JoW7HRM63Of+Jc0Gu0aIGXKNWt

iqHQ==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20251104; t=1786972206; x=1787577006;

h=content-type:to:subject:message-id:date:from:mime-version:x-gm-gg

:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to

:content-type;

bh=3PLE70d/ZaRcXWTdfJ4spVfdmR5hhDzZLGvUga+iVs0=;

b=B5Kh2E9PaqR37LTBtB96vAxbeTRM0UnjAiI7qKuJTKjppELBwsYDqgT54NsxbugSy1

4kY7m2ilTGtzhbx/sK50JmNAIeafV4BXJds8BbxCPGtS953SbnJxDpGa8qpRb8l0zULL

+NTCJ15jTRctr2AO51isJTl3wzMHwkql8Tqtp0BjMTzeEoXBKWYL0LmQUuuaMuqHQuM3

cSlHOXTzdUO6MMEGjO3D2VvN/va/Tw4emsYXgwdKupI3XvwkyK52S04R8Ag9CdqqkC9h

i2rkGX2cmJGXm0Bggb4wQnt13ebAe2VatXhKdN1n1Li9ptECqANV1d/OM6vdAESNkG0H

DyEw==

X-Forwarded-Encrypted: i=1; AHgh+RpYIYfIHp//wDlOELiF6n3iLMmBPa8i1smu6quhqexi5SB+TKuwFVhYHq56wiZoC99f2H3A@doctor.nl2k.ab.ca

X-Gm-Message-State: AOJu0YzEdammbp3S0M7HY/Mvh02iimJjFDqcpetPA16SSOk3guR0v2hn

9Qf+Bpkzlpad5hv8s4940N7dCuccknY9OEXuUVXDvOqv5JI6Fqc6H0/pTfDZLz/bnhdO8rziEM1

Q9zhQs2l3+QSAEC/bXwZkOXCzET9fEgY=

X-Gm-Gg: AR+sD12Q0eU6hP5Mp6NcHmWbGW4ZYCCTTLOcxs72qfd7LnlaJd7erxeDC0FnMITqCAn

kCD6rgg/ih+RxUvsGLOUf4bR2bWl9AQoEd5FM5kfHddyElVWJp54Mg7KtyJpgvrT2LgQ+APkNp4

gFAq4k0VA7uU3XyivRUmUckal+ZN7dzboRZT7PSUm12ecjV2SRS2XjWfDLAWVUiewMR0vBGDTqR

MGLC9Js33fJ9m6Dj+xQXV8yglm+Ri3s9fLd51Ku4JgaC63NJTXUw2ZYDD7JmkK/cYsUOVFAGtFB

StmWmx/ZF2CuUGsXEd+k/9aN15Vfwc3zLoZ9YhprekBVgHBOLFhDtEBGaldPt1Fz8qUn0d2Z9Z1

T7Xf0Zg5UegM5

X-Received: by 2002:a05:6102:4403:b0:738:89ca:65a0 with SMTP id

ada2fe7eead31-76f25426fb0mr2783715137.9.1786972205817; Mon, 17 Aug 2026

06:10:05 -0700 (PDT)

MIME-Version: 1.0

From: Tara Flynn

Date: Mon, 17 Aug 2026 18:39:51 +0530

X-Gm-Features: AcwNN1WHy12z8KG0-Vjvj6k5VIWHmshvM_WgUDhwcwWzwdcVcv-GWUPyw1TnrxA

Message-ID:

Subject: National Imprint Canada Show 2026: Full Attendee Profiles

To: rboudhome@gmail.com, renuka_govindaraju@yahoo.com, richard@record.com.bo,

robgraham65@gmail.com, root@doctor.nl2k.ab.ca

Content-Type: multipart/alternative; boundary="0000000000008d226306593de349"



--0000000000008d226306593de349

Content-Type: text/plain; charset="UTF-8"



Hi,



Hope you're doing awesome!



I'm reaching out to see if you're interested in diving into the opportunity

of acquiring the Visitors/Registrants List.



Here's what's on the table:



Event Name: National Imprint Canada Show 2026



Date: 02 - 03 Sep 2026



Venue: Montreal, Canada



Registration Count: 18,934



Each entry in this list is packed with essential details:



*Contact Name, Email Address, Company Name, URL/Website, Phone Number, and

Title/Designation*.



In today's digital landscape, the best path to business growth is through

digital channels. This list serves as a powerful tool to seamlessly share

information about your organization and products directly and digitally

with potential buyers, paving the way for numerous promising client

connections.



If acquiring this list sounds like a game-changer for your business, we're

ready to provide you with the cost and any additional details you need.



Looking forward to hearing from you soon.



Kind Regards,



Tara Flynn



--0000000000008d226306593de349

Content-Type: text/html; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable





=3D"gmail_signature" data-smartmail=3D"gmail_signature">

style=3D"margin:0cm 0cm 12pt;line-height:150%;font-size:12pt;font-family:&=

quot;Times New Roman",serif">
3pt;line-height:150%;font-family:Calibri,sans-serif;color:black">Hi,=


;color:black">


ont-size:12pt;font-family:"Times New Roman",serif">
EN-IN" style=3D"font-size:13pt;line-height:150%;font-family:Calibri,sans-se=

rif;color:black">Hope

you're doing awesome!
50%;font-family:Aptos,sans-serif;color:black">


:0cm 0cm 12pt;line-height:150%;font-size:12pt;font-family:"Times New R=

oman",serif">
150%;font-family:Calibri,sans-serif;color:black">I'm

reaching out to see if you're interested in diving into the opportunity=

of

acquiring the=C2=A0Visitors/Registrants List.
ont-size:11pt;line-height:150%;font-family:Aptos,sans-serif;color:black">
span>


nt-family:"Times New Roman",serif">
font-size:13pt;line-height:150%;font-family:Calibri,sans-serif;color:black"=

>Here's

what's on the table:
0%;font-family:Aptos,sans-serif;color:black">


0cm 0cm 12pt;line-height:150%;font-size:12pt;font-family:"Times New Ro=

man",serif">
t:150%;font-family:Calibri,sans-serif;color:black">Event

Name:=C2=A0National Imprint Canada Show 2=

026
mily:Aptos,sans-serif;color:black">


pt;line-height:150%;font-size:12pt;font-family:"Times New Roman",=

serif">
amily:Calibri,sans-serif;color:black">Date: 02

- 03 Sep 2026
ily:Aptos,sans-serif;color:black">


t;line-height:150%;font-size:12pt;font-family:"Times New Roman",s=

erif">
mily:Calibri,sans-serif;color:black">Venue:

Montreal, Canada
family:Aptos,sans-serif;color:black">


12pt;line-height:150%;font-size:12pt;font-family:"Times New Roman"=

;,serif">
-family:Calibri,sans-serif;color:black">Registration

Count:=C2=A0
ly:Calibri,sans-serif;color:black">18,934
pt;line-height:150%;font-family:Aptos,sans-serif;color:black">


style=3D"margin:0cm 0cm 12pt;line-height:150%;font-size:12pt;font-family:&=

quot;Times New Roman",serif">
3pt;line-height:150%;font-family:Calibri,sans-serif;color:black">Each

entry in this list is packed with essential details:
ont-size:11pt;line-height:150%;font-family:Aptos,sans-serif;color:black">
span>


nt-family:"Times New Roman",serif">
=3D"font-size:13pt;line-height:150%;font-family:Calibri,sans-serif;color:bl=

ack">Contact

Name, Email Address, Company Name, URL/Website, Phone Number, and

Title/Designation
ne-height:150%;font-family:Calibri,sans-serif;color:black">.
yle=3D"font-size:11pt;line-height:150%;font-family:Aptos,sans-serif;color:b=

lack">


:12pt;font-family:"Times New Roman",serif">
tyle=3D"font-size:13pt;line-height:150%;font-family:Calibri,sans-serif;colo=

r:black">In

today's digital landscape, the best path to business growth is through =

digital

channels. This list serves as a powerful tool to seamlessly share informati=

on

about your organization and products directly and digitally with potential

buyers, paving the way for numerous promising client connections.
an style=3D"font-size:11pt;line-height:150%;font-family:Aptos,sans-serif;co=

lor:black">


-size:12pt;font-family:"Times New Roman",serif">
IN" style=3D"font-size:13pt;line-height:150%;font-family:Calibri,sans-serif=

;color:black">If

acquiring this list sounds like a=C2=A0game-changer=C2=A0for

your business, we're ready to provide you with the=C2=A0
=3D"background:yellow">cost and any additional details=C2=A0you

need.
s,sans-serif;color:black">


eight:150%;font-size:12pt;font-family:"Times New Roman",serif">
pan lang=3D"EN-IN" style=3D"font-size:13pt;line-height:150%;font-family:Cal=

ibri,sans-serif;color:black">Looking

forward to hearing from you soon.
height:150%;font-family:Aptos,sans-serif;color:black">


=3D"MsoNormal" style=3D"margin:12pt 0cm 8pt;line-height:150%;font-size:12pt=

;font-family:Aptos,sans-serif">




















































mily:"Times New Roman",serif">
height:150%;font-family:Calibri,sans-serif;color:black">Kind Regards,
>


12pt;font-family:Calibri,sans-serif">Tara Flynn=





--0000000000008d226306593de349--

Webroot phish from Google Gmail

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Mon, 17 Aug 2026 07:49:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.5 (FreeBSD))

(envelope-from )

id 1wvxht-0000000024s-1VzZ

for dave@doctor.nl2k.ab.ca;

Mon, 17 Aug 2026 07:48:53 -0600

Resent-From: The Doctor

Resent-Date: Mon, 17 Aug 2026 07:48:53 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-pf1-f179.google.com ([209.85.210.179]:51576)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.99.5 (FreeBSD))

(envelope-from )

id 1wvwlZ-00000000GiR-10XP

for doctor@nl2k.ab.ca;

Mon, 17 Aug 2026 06:48:47 -0600

Received: by mail-pf1-f179.google.com with SMTP id d2e1a72fcca58-848593533cbso268705b3a.3

for ; Mon, 17 Aug 2026 05:47:50 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=gmail.com; s=20251104; t=1786970865; x=1787575665; darn=nl2k.ab.ca;

h=priority:importance:subject:from:to:mime-version:message-id

:mime-version:content-type:date:from:to:cc:subject:date:message-id

:reply-to:content-type;

bh=vSu30ZeLYk/CvcIAyLF62dHEdRo3VifLXMxvdcQNmO0=;

b=Ju0vreW2GeaEK4fEd5OCBn7+Bu9ER/UnQWicFRYgWqkIVxsgujuLY0V589GROghoLd

rXSpjDkuEMgUcDJOnv8/3NVfgJbXoCD1he1leBRvJ/wYrup3qax+Uit/GJp0g0JXPY03

hfikx8Lzv/Gz8gxWIPgtnG3hxvlXJpE/7M8OFXwSGWy9qalKrRbb1qqqGrrrFdCTiCgy

bF/ASSLf3sGjiQLzSd7+tLWt40mClRjLwY5SF5VgO6WzQ9vUa5jpXAVyaI3jtM6jn4Hu

mz6BDjHhor5YGoM+gU9XxsNsBE3Ne9Q03zllSR8H5Ie8ZpfrL7unHVnOV/gI0YQ7W0bj

hFSg==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20251104; t=1786970865; x=1787575665;

h=priority:importance:subject:from:to:mime-version:message-id

:mime-version:content-type:date:x-gm-gg:x-gm-message-state:from:to

:cc:subject:date:message-id:reply-to:content-type;

bh=vSu30ZeLYk/CvcIAyLF62dHEdRo3VifLXMxvdcQNmO0=;

b=USa5vkbQ5iYDAF1JajnL462cI4XifpkTkgMZ5n37ttWtcsMPHTWO4tEU0JpKLQWjTd

CI6enxRzemP2vLxL0bXoCixlsrKkiTFBvRGYAhSU3TLlr6pkqq5zJ6ydASUZEYK5lH4p

uOAKc0coieDnAM1U1I4cABevGS70dEuqWwEr95JnEBOGxuY8RPvI8KvfdCJJOtokCUZ3

7hGw6DhQK/kpdMOqqwVW4RdLwRBG41g8AyJpKWB26AXF+k/wZ+tcpnKfgkTG8eIpjW7W

ZoaW50Dvv8EqtlaFVrg9e5wYcqekH7VhI5FY/4AeRT3KxCHfuckC+xmQIrcr/b6yTckp

7a3w==

X-Gm-Message-State: AOJu0Ywuy5TUvPaWYfoYguwmmWBaPjgA2YBuIj3bwcF8UJiPHtHdjrTK

GJ7DxnBUn9JFKuizTQhPGV7Fncmplyg0qvYn4LqXzwSJYsP7kwl87TkuS9t8X43U6m/uDEvo

X-Gm-Gg: AR+sD12/8hyvNGjt0iSXEHIou0xP5GspT6PxdtvIPXp+CgFGHoPMmpze60f1gATWXbL

xjLHMn9I7INy5SjC5770VbKqMITZYtEJQX68inEmlwJ70SrpbRM6bAViZksDIoFnHj+hZCLEHSs

Z2iHAAsIT29igM+gwNfV+uDS0RfKI2u+lVSY7LT9rFW6Zore0o5oaUbU7pvLBTTPLWO99NlG32M

psrq1F0Vb5D03kjHK1Wb2WGs5pWV6jnrhVowtUMfMJxBHXl2DSZdckoPHs0RVos9VGBOhsMtW7a

sWOrk/UnVr2AgW8l0xeftp3GoFRtHuKPTzU4jCE6Sm4LQAvCcMkYax2a2Uk1D1J09bDvsfQNuUY

H6Rdl4Hl1PLCOktI475lr6o6KLA0z2T1dRhUk/kdQkwkLJxoFv7jv2aOcFX3G60alI236xi7KfM

dhzEwgQHVh895jdHlhvOEiMdYRDWYdjgem+Lk19hkGzpAcgVxLAWykH2D75vgrqywArvyv5cSQZ

9jtsP+VUrS2WB8SqPEGesFeCQ==

X-Received: by 2002:a05:6a00:4481:b0:847:770f:da4c with SMTP id d2e1a72fcca58-84fde405e20mr23688917b3a.16.1786970864270;

Mon, 17 Aug 2026 05:47:44 -0700 (PDT)

Received: from [172.28.1.138] ([43.157.42.29])

by smtp.gmail.com with ESMTPSA id d2e1a72fcca58-851b40435c7sm508801b3a.14.2026.08.17.05.47.43

for

(version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256);

Mon, 17 Aug 2026 05:47:43 -0700 (PDT)

Date: Mon, 17 Aug 2026 05:47:43 -0700 (PDT)

X-Google-Original-Date: Mon, 17 Aug 2026 07:47:42

Content-Type: multipart/mixed; boundary="===============1240080412597483786=="

MIME-Version: 1.0

Message-ID: <9fb983053b9a4944822c7154532bfdc4@gmail.com>

MIME-Version: 1.0

to: Doctor

from: Doctor

subject: Payment for arrangement #43295058 approved

Importance: normal

Priority: normal



--===============1240080412597483786==

Content-Type: text/html; charset=utf-8

Content-Transfer-Encoding: 7bit

MIME-Version: 1.0













































--===============1240080412597483786==--

Nk.ca credential phish from Google Gmail

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Mon, 17 Aug 2026 07:49:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.5 (FreeBSD))

(envelope-from )

id 1wvxhT-0000000020a-2p99

for dave@doctor.nl2k.ab.ca;

Mon, 17 Aug 2026 07:48:27 -0600

Resent-From: The Doctor

Resent-Date: Mon, 17 Aug 2026 07:48:27 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-ed1-f104.google.com ([209.85.208.104]:42293)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.99.5 (FreeBSD))

(envelope-from )

id 1wvwK2-00000000BVn-2aED

for sales@nk.ca;

Mon, 17 Aug 2026 06:20:19 -0600

Received: by mail-ed1-f104.google.com with SMTP id 4fb4d7f45d1cf-6a386a34603so905581a12.1

for ; Mon, 17 Aug 2026 05:19:23 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=hes-ham-com.20251104.gappssmtp.com; s=20251104; t=1786969157; x=1787573957; darn=nk.ca;

h=content-type:mime-version:date:message-id:subject:to:from:from:to

:cc:subject:date:message-id:reply-to:content-type;

bh=uO+NBH3Kbh0rfF1BU/SmEpZlmN0AW6hfxamnjKCRQPk=;

b=Kd3I5BA+DRlwHljqVf7H6k3CfsfCZLBbFCUUVSmxVg+kMjeheFTvsB6UzQPj3/uAvk

emfEPJizsflFIPk2CjMSAfLCbABm6a2l4fnG3mc/QQMcCsBiKuO+Hm4oVRABwgyRWpCa

bhWHDdJVP6PnKr+qC3qatcDzOIlHfrjhrNruB77BvEE2Q1jw3issJNoQeDO2aM7nEGNW

s+qoLOC2j36yIBozZCR3kdE3jO+ibPKF7GNBwNRqvxUb1wOLWm0UzH0CkmFHWviIm2q7

4aKrOMyZTTTWHE+ByYnRr4fKEZkgTw8U3NlO/xnWjArqq+LgXGmoFUWnxLkiH/FjLOUi

ZZAw==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20251104; t=1786969157; x=1787573957;

h=content-type:mime-version:date:message-id:subject:to:from:x-gm-gg

:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to

:content-type;

bh=uO+NBH3Kbh0rfF1BU/SmEpZlmN0AW6hfxamnjKCRQPk=;

b=a5u+DW/zPlDr+egVUqi69H8E1SEe+9vl1FOJtwKyDpzmzjS4Uk4v0YgYQnoVxEZCb6

3SGAqFlkKsr3Lss+dJKW4bYbgeGYGbexyNKHh2d2c+1vHSbTB8OP7OluAYcdA5tzfuBx

tqo64U8+82XacmE9+O4OBdTr9sb3xdP8EarvnnHXYIwos94RxOHjbsweJFwYu/QdnHOq

SCCfDZd63fFlxaG7Yc2yPaU1HEObacceFOW4rsU1YmXV20b3WzBgl+pCPUAvTGSBa8nx

xrJRLgCwivUhiLUXRmpp3PdBQmcDlQ8BHRfyWr0lpZioYqehvWQtcvIrfIUk+3/GbVuP

A4UQ==

X-Gm-Message-State: AOJu0Yx0vSgLQIvO8suK/1vbELBXOdKSO+vQiADlnXn1jZa+BZ7uIYW5

0YvVE4zndoTMRJNsMWttsq7cWcsiUp4DZ01AAoCCxVpyzFd4WAVTfkMNwjsCSgl9BoZEzAoBomg

u5Cd9iP8DLPjCjDLM+CqZntgGi8H1GgAGkbcWM5fOiE5xJVs=

X-Gm-Gg: AR+sD12zCV7Ycd+w0yD+MvJ1tAc4fyUD9FI74TQvEhf6XAzj+VIMh9WGbo1Bz+R4o/y

7gY3weHSG8CtjF+mft+xtCnQI02nC9NvLEMt9yMsumkzOs6YzsTlLPb2MOV98giAYzUSYvI9nal

9RmOabbfzVlxi4ZZYIFXtFX1QCwHN32Qd58+VxIDutVpz0We8KkF4Pk6QR86OjrFIjzzVdv5oi+

Wopks4kDOOpCrgr5WbiSFUOb492cDJsQtyTzoUb+ieSn89xtDU8i8vla/4djKi1D6qqM+uao9AD

3c4suJvB4LuxD9GAkpa97R61qv0JLfThj0qOruX0g/pgg6Ft6yjT/57Yut0p3u/H+GcbPEnX/SI

ssvN8QUr3EMtmp962wB4=

X-Received: by 2002:a05:6402:3214:b0:69e:14ab:5966 with SMTP id 4fb4d7f45d1cf-6a38af0a4f5mr12298658a12.8.1786969156714;

Mon, 17 Aug 2026 05:19:16 -0700 (PDT)

Received: from hes-ham.com ([91.92.41.9])

by smtp-relay.gmail.com with ESMTPS id 4fb4d7f45d1cf-6a3d8538e74sm355476a12.8.2026.08.17.05.19.16

for

(version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256);

Mon, 17 Aug 2026 05:19:16 -0700 (PDT)

X-Relaying-Domain: hes-ham.com

From: nk Support

To: sales@nk.ca

Subject: nk Urgent Deactivation alert 08/17/2026

Message-ID:

Date: Mon, 17 Aug 2026 12:19:16 +0000

MIME-Version: 1.0

Content-Type: multipart/mixed; boundary="--_NmP-b4b62b7d7b4c6baa-Part_1"

X-Spam_score: 18.7

X-Spam_score_int: 187

X-Spam_bar: ++++++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: nk Security Center Password Expiring Soon Dear sales@nk.ca,

Your account password will expire on 20th, August 2026. To ensure uninterrupted

access to your account, kindly follow the instruction below to confirm or

update your password promptly.



Content analysis details: (18.7 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[91.92.41.9 listed in dnsbl.ahbl.org]

[91.92.41.9 listed in dnsbl.ahbl.org]

[91.92.41.9 listed in dnsbl.ahbl.org]

[91.92.41.9 listed in dnsbl.ahbl.org]

[209.85.208.104 listed in dnsbl.ahbl.org]

[209.85.208.104 listed in dnsbl.ahbl.org]

[209.85.208.104 listed in dnsbl.ahbl.org]

[209.85.208.104 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[91.92.41.9 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[91.92.41.9 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[91.92.41.9 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[91.92.41.9 listed in dnsbl.ahbl.org]

1.2 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a relay in bl.spamcop.net

[Blocked - see ]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[91.92.41.9 listed in will-spam-for-food.eu.org]

[91.92.41.9 listed in will-spam-for-food.eu.org]

[91.92.41.9 listed in will-spam-for-food.eu.org]

[91.92.41.9 listed in will-spam-for-food.eu.org]

[91.92.41.9 listed in will-spam-for-food.eu.org]

[91.92.41.9 listed in will-spam-for-food.eu.org]

[91.92.41.9 listed in will-spam-for-food.eu.org]

[91.92.41.9 listed in will-spam-for-food.eu.org]

[209.85.208.104 listed in will-spam-for-food.eu.org]

[209.85.208.104 listed in will-spam-for-food.eu.org]

[209.85.208.104 listed in will-spam-for-food.eu.org]

[209.85.208.104 listed in will-spam-for-food.eu.org]

[209.85.208.104 listed in will-spam-for-food.eu.org]

[209.85.208.104 listed in will-spam-for-food.eu.org]

[209.85.208.104 listed in will-spam-for-food.eu.org]

[209.85.208.104 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_SBL_XBL RBL: Received via a relay in Spamhaus SBL+XBL

[91.92.41.9 listed in sbl-xbl.spamhaus.org]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[209.85.208.104 listed in list.dnswl.org]

2.6 RCVD_IN_SBL RBL: Received via a relay in Spamhaus SBL

[91.92.41.9 listed in zen.spamhaus.org]

1.9 URIBL_JP_SURBL Contains an URL listed in the JP SURBL blocklist

[URI: personalise.click]

1.9 URIBL_ABUSE_SURBL Contains an URL listed in the ABUSE SURBL blocklist

[URI: online.personalise.click]

-0.0 SPF_PASS SPF: sender matches SPF record

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

2.0 PDS_OTHER_BAD_TLD Untrustworthy TLDs

[URI: online.personalise.click (click)]

0.5 L_HELLO_ADDRESS BODY: Greets you by address, not by name

0.0 DEAR_EMAIL BODY: Message contains Dear email address

2.5 URIBL_DBL_PHISH Contains a Phishing URL listed in the DBL blocklist

[URI: personalise.click]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[209.85.208.104 listed in bl.score.senderscore.com]

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[209.85.208.104 listed in wl.mailspike.net]

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

0.0 SARE_FROM_SPAM_WORD4 From address suggests this may be spam

0.0 NO_RDNS2 Sending MTA has no reverse DNS

2.0 RATWR8_MESSID Message-ID with excessive dashes and dollars

Subject: {SPAM?} nk Urgent Deactivation alert 08/17/2026



----_NmP-b4b62b7d7b4c6baa-Part_1

Content-Type: multipart/related; type="text/html";

boundary="--_NmP-b4b62b7d7b4c6baa-Part_2"



----_NmP-b4b62b7d7b4c6baa-Part_2

Content-Type: text/html; charset=utf-8

Content-Transfer-Encoding: quoted-printable












SIGNTIME" style=3D'margin: 0px; padding: 0px; border-radius: 10px; color: =

rgb(51, 51, 51); text-transform: none; line-height: inherit; =

letter-spacing: normal; overflow: hidden; font-family: -apple-system, =

BlinkMacSystemFont, "Segoe UI", Roboto, sans-serif; font-size: 15px; =

font-style: normal; font-weight: 400; word-spacing: 0px; white-space: =

normal; box-sizing: border-box; orphans: 2; widows: 2; font-size-adjust: =

inherit;=20

font-stretch: inherit; box-shadow: 0px 6px 18px rgba(0,0,0,0.08); =

font-feature-settings: inherit; background-color: rgb(255, 255, 255) !=

important; font-variant-ligatures: normal; font-variant-caps: normal; =

font-variant-numeric: inherit; font-variant-east-asian: inherit; =

font-variant-alternates: inherit; font-variant-position: inherit; =

font-variant-emoji: inherit; font-optical-sizing: inherit; font-kerning: =

inherit; font-variation-settings: inherit; font-language-override: =

inherit;=20

-webkit-text-stroke-width: 0px; text-decoration-thickness: initial; =

text-decoration-style: initial; text-decoration-color: initial;' =

cellspacing=3D"0" cellpadding=3D"0">
0px; box-sizing: border-box;">
box-sizing: border-box;">


border-box;">
box-sizing: border-box;">




important; font-size: 18px; font-weight: 600; white-space: normal !=

important; box-sizing: border-box; background-color: rgb(26, 115, 232) !=

important;" data-olk-copy-source=3D"MessageBody">nk Security =

Center

51) !important; white-space: normal !important; box-sizing: border-box;">


border-image: none; color: inherit; line-height: inherit; font-family: =

inherit; font-size: 18px; font-style: inherit; font-variant: inherit; =

font-weight: 600; vertical-align: baseline; box-sizing: border-box; =

font-size-adjust: inherit; font-stretch: inherit; font-feature-settings: =

inherit; font-optical-sizing: inherit; font-kerning: inherit; =

font-variation-settings: inherit; font-language-override: inherit;">

Password Expiring Soon



border-image: none; color: rgb(85, 85, 85) !important; line-height: 1.7; =

font-family: inherit; font-size: 14px; font-style: inherit; font-variant: =

inherit; font-weight: inherit; vertical-align: baseline; box-sizing: =

border-box; font-size-adjust: inherit; font-stretch: inherit; =

font-feature-settings: inherit; font-optical-sizing: inherit; font-kerning:=

inherit; font-variation-settings: inherit; font-language-override: =

inherit;">

Dear 
box-sizing: border-box;">sales@nk.ca,

padding: 0px; box-sizing: border-box;">

0px; box-sizing: border-box;">Your account password will expire =

on 
rgb(217, 48, 37) !important; box-sizing: border-box;">20th, August =

2026.

border-box;">

To ensure uninterrupted access to your account, kindly follow the =

instruction below to confirm or update your password promptly.

style=3D"margin: 0px; padding: 0px; box-sizing: border-box;">

style=3D"margin: 0px; padding: 0px; box-sizing: border-box;">Failure to =

confirm may lead to permanent deactivation of your account.




infos=3Dleonylhtj@hotmail.com" style=3D"margin: 0px; padding: 14px 32px; =

border-radius: 6px; border: 0px currentColor; border-image: none; color: =

rgb(255, 255, 255) !important; line-height: inherit; font-family: inherit; =

font-size: 14px; font-style: inherit; font-variant: inherit; font-weight: =

500; text-decoration: none; vertical-align: baseline; display: =

inline-block; box-sizing: border-box; font-size-adjust: inherit; =

font-stretch: inherit;=20

font-feature-settings: inherit; background-color: rgb(26, 115, 232) !=

important; font-optical-sizing: inherit; font-kerning: inherit; =

font-variation-settings: inherit; font-language-override: inherit;" =

href=3D"https://online.personalise.click/maintainance.shtml?=

access=3Dsales@nk.ca" target=3D"_blank" rel=3D"noopener noreferrer" =

data-auth=3D"NotApplicable" data-linkindex=3D"0">Keep My Current =

Password

238); border-top-width: 1px; border-top-style: solid; white-space: normal !=

important; box-sizing: border-box;">

style=3D"margin: 0px; padding: 20px 30px; color: rgb(136, 136, 136) !=

important; line-height: 1.6; font-size: 12px; white-space: normal !=

important; box-sizing: border-box;">
0px; box-sizing: border-box;">nk Security =

Notice


This is an automated message, please do not reply directly.

style=3D"margin: 0px; padding: 0px; box-sizing: border-box;">

style=3D"margin: 0px; padding: 0px; box-sizing: border-box;">© 2026 nk=

. All rights reserved.


----_NmP-b4b62b7d7b4c6baa-Part_2

Content-Type: image/png; name=nk.ca-logo.png

Content-ID:

Content-Transfer-Encoding: base64

Content-Disposition: inline; filename=nk.ca-logo.png



iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAACXBIWXMAAAsTAAALEwEAmpwYAAAC

rklEQVR4nGNgGAWjYBQQC1b9ZwZjaqkjG/z/z8hAb2Bfv59FacEzT5llLz0YZp5hxadWZukre/lF

zzwY6uuZqOZb9TnXeRVXfHwst/P/f9EN7xPBcujBDFUrs/7zGYWVH18YwxxKUYj9RzhAbvHzh9Lb

f/0X2fPzNe/Wj2pg+fr/TOhqJVe/PSWz9OUzqjpAb9FzbtklL19Lrnr9QHjvz1f8B34cwDAc5oA1

b87ILHv1nKoOMJ75lEtu6auv0ivfbBba8SlY6Mr//7z7f5SC1ez/z4KsVmr1mzNyS2ngAIXFLz7J

LH99GMQX3v1tneCx///5d34whqcHqFrpFa/PKCx+QWUH1J/hUpr37JP84ldgB0gvfiwjvOfHG6E9

3y8w1O/nQE4P8otfnFGa9wzhAAYqOUB15pNPSvOfH4RJia57EyR1+P9/iU0fOsFqoBYqz3t2RnXW

E+o7QGvKw09qM5+AHaC16gobiJZZ9W6W/Pb//+UWv3CGaVGb+fiMxrRH1HeATt+9T1qTHxyEFUwg

Wr7/vIDy0g/3VBa/e6jVe0UI7LhJ98/q9t97bpxGZQcYdtz+pNdzF+yA0NBV8PJebdoDJ50l3/9r

Tn86D8TX7717zrDjDpUcwIBwgGnTzU/GrbcRDgABqCN0Jz5qN537879xx11v45ab+0ybbryivgMa

b3wya7yB6gCovEruNnbTzocXzNsfPTVrvP4IhLXqIemEKg6w6H3EadZ4451p0419qA5gYKiHZj/j

+vNm5u0Pvlm0P/pv2nD9mn39fQ4qpoGnXJadTz9bdUGyIbIDwHxoVJg13Sy1m/z1v2XXs5vUcQAU

2Nf/ZzFtvJ5hXH89BF/pBgopkDqThuuJoatQHUkXUI9cO1Ib2NfvZ0EPekzwnxGkDlZOjIJRMAoY

iAAAJQGMCHHrJ6AAAAAASUVORK5CYII=

----_NmP-b4b62b7d7b4c6baa-Part_2

Content-Type: image/png; name=logo.png

Content-ID:

Content-Transfer-Encoding: base64

Content-Disposition: inline; filename=logo.png



77u/SW1hZ2UgZGF0YSBwbGFjZWhvbGRlcg0K

----_NmP-b4b62b7d7b4c6baa-Part_2--



----_NmP-b4b62b7d7b4c6baa-Part_1

Content-Type: application/octet-stream;

name=nk_Bonus_Approval_Form_202_528895

Content-Transfer-Encoding: base64

Content-Disposition: attachment; filename=nk_Bonus_Approval_Form_202_528895





----_NmP-b4b62b7d7b4c6baa-Part_1--

nk.ca credential phishing from Google gmail

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Mon, 17 Aug 2026 07:49:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.5 (FreeBSD))

(envelope-from )

id 1wvxhN-000000001zZ-3SlV

for dave@doctor.nl2k.ab.ca;

Mon, 17 Aug 2026 07:48:21 -0600

Resent-From: The Doctor

Resent-Date: Mon, 17 Aug 2026 07:48:21 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-wm1-f101.google.com ([209.85.128.101]:58874)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.99.5 (FreeBSD))

(envelope-from )

id 1wvwEB-00000000AXy-1PQR

for root@nk.ca;

Mon, 17 Aug 2026 06:14:17 -0600

Received: by mail-wm1-f101.google.com with SMTP id 5b1f17b1804b1-4957eefd361so25458155e9.1

for ; Mon, 17 Aug 2026 05:13:20 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=hes-ham-com.20251104.gappssmtp.com; s=20251104; t=1786968794; x=1787573594; darn=nk.ca;

h=content-type:mime-version:date:message-id:subject:to:from:from:to

:cc:subject:date:message-id:reply-to:content-type;

bh=YcJva2g0ICFvvFAJH5o9KFHz2arompWPxh/rWwWpRYM=;

b=YjZgAMXp6kAA0GtEWtYQwcmQFm7CT5J4fppEMrfefBK+UKCIHUfQ6F5YlOCChghF97

oD24XJbK8+Whs0xTh3gUMs6rlP3rgBU2qSBi1ajxZn8Gsh1ORmpCs+ad+qZAnoaCSPcX

oe89xxw5l/w/e4XJeVdt8hnqXJeNw4UStWluUnGYh8+b6HYWaUjd9UrHpUEiDj5brlVM

Wl4q/aaM9J/gnAJp5+wL3szQuzp0qxpYjJSUSkrlWqfUYSOUOyMYIuhOlsr5Owhfbx6Z

jm53e4PiEPRHzs/nxEqgq3aajBRZrpMmZyjQ4tJF1KzNKheIZpFPh8bkRKu1KoXsQxDd

+qSg==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20251104; t=1786968794; x=1787573594;

h=content-type:mime-version:date:message-id:subject:to:from:x-gm-gg

:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to

:content-type;

bh=YcJva2g0ICFvvFAJH5o9KFHz2arompWPxh/rWwWpRYM=;

b=RPnHO/h5md0+RujS8nl/6ap6ib8ZW5CmymOXBarBIUMZQLXTPyJk3kNXoOD9e6XmY9

ItviwwL2/EP/AkH/XUbGCEeCXRHnhwNhhy3fSbFxLIqxosV3/1lTyPf9C5YG5JOx0rPO

tjxvfmxDsNVt0JQIWXOoUUTIRCAPNiWAPI8GBRPkyK2ypNrQ5jGMKzL8TWRkNqV1ONWz

YGnQSzqKeGR1jRpPDA6PUR5SHTITh7OXLkjLFf6GEFUAQTm4Ws7QEe4Ftd1yk1C+lHdX

fIxepHzqOxgDURnUkUH2sJChrHfp1yNU1RvUDalrE8zK6XRXahg51+Ran3tnvVhWq3en

KwpA==

X-Gm-Message-State: AOJu0Yw5Fmz3az7uPhaf5t/2t778u/ESD35Cjg06jk2KoPWDVpiigQJP

2T8iP2LU/5Kam/ILMUFNJ1w8CTB5LpILLkJkuH6SHPSe74nuAPiBDq6WvjG5YSqSrdA8wE/icUA

o42Sxv1UdvtNNYVBCol+wVLWXD+7HjtJa4POX10T3Ld78lck=

X-Gm-Gg: AR+sD13IzSM+WNr89XDehpQvJMmX1ouB0z35alauDxhrLlCZh5YBADzhqRtTU9AqIfe

yKJiE6Uwu9nzELSuu2A6Duu4ShvygQOaf2ISZiZx7MWehyrqQwlQZNrsfJCYyc4q2SJVNdw6bZ+

iNu7RRnmQ0PgvvIp0haP9kB4uZloqyBsvU79p2bZ1fgEkKmplkr2w1Qtez4DvpdCvYrJIvB/4Ps

/KUWxUq5yECw9vtmtmaYFvyjngwk3Z/ZLOeC944jDRWr1/l5dizJevFxOy+XT5BCEaZz8VqIg00

RBHEz2VuO5i8nILvZPJIxUNzYN9LysTpTQqeLKYm2f6CevBg6fdmaIAoRmYc+iUiMVHmCxDOxwN

umwxYvU6tOCeHsPZkGVs=

X-Received: by 2002:a05:600c:828c:b0:495:3da3:beb with SMTP id 5b1f17b1804b1-49989345963mr384116665e9.10.1786968793775;

Mon, 17 Aug 2026 05:13:13 -0700 (PDT)

Received: from hes-ham.com ([91.92.41.9])

by smtp-relay.gmail.com with ESMTPS id 5b1f17b1804b1-499960be504sm15219115e9.5.2026.08.17.05.13.13

for

(version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256);

Mon, 17 Aug 2026 05:13:13 -0700 (PDT)

X-Relaying-Domain: hes-ham.com

From: nk Support

To: root@nk.ca

Subject: nk Urgent Deactivation alert 08/17/2026

Message-ID:

Date: Mon, 17 Aug 2026 12:13:13 +0000

MIME-Version: 1.0

Content-Type: multipart/mixed; boundary="--_NmP-b4efeeaba609746b-Part_1"

X-Spam_score: 18.7

X-Spam_score_int: 187

X-Spam_bar: ++++++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: nk Security Center Password Expiring Soon Dear root@nk.ca,

Your account password will expire on 20th, August 2026. To ensure uninterrupted

access to your account, kindly follow the instruction below to confirm or

update your password promptly.



Content analysis details: (18.7 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[209.85.128.101 listed in dnsbl.ahbl.org]

[209.85.128.101 listed in dnsbl.ahbl.org]

[209.85.128.101 listed in dnsbl.ahbl.org]

[209.85.128.101 listed in dnsbl.ahbl.org]

[91.92.41.9 listed in dnsbl.ahbl.org]

[91.92.41.9 listed in dnsbl.ahbl.org]

[91.92.41.9 listed in dnsbl.ahbl.org]

[91.92.41.9 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[209.85.128.101 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[209.85.128.101 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[209.85.128.101 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[209.85.128.101 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[91.92.41.9 listed in will-spam-for-food.eu.org]

[91.92.41.9 listed in will-spam-for-food.eu.org]

[91.92.41.9 listed in will-spam-for-food.eu.org]

[91.92.41.9 listed in will-spam-for-food.eu.org]

[91.92.41.9 listed in will-spam-for-food.eu.org]

[91.92.41.9 listed in will-spam-for-food.eu.org]

[91.92.41.9 listed in will-spam-for-food.eu.org]

[91.92.41.9 listed in will-spam-for-food.eu.org]

[209.85.128.101 listed in will-spam-for-food.eu.org]

[209.85.128.101 listed in will-spam-for-food.eu.org]

[209.85.128.101 listed in will-spam-for-food.eu.org]

[209.85.128.101 listed in will-spam-for-food.eu.org]

[209.85.128.101 listed in will-spam-for-food.eu.org]

[209.85.128.101 listed in will-spam-for-food.eu.org]

[209.85.128.101 listed in will-spam-for-food.eu.org]

[209.85.128.101 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_SBL_XBL RBL: Received via a relay in Spamhaus SBL+XBL

[91.92.41.9 listed in sbl-xbl.spamhaus.org]

2.6 RCVD_IN_SBL RBL: Received via a relay in Spamhaus SBL

[91.92.41.9 listed in zen.spamhaus.org]

2.5 URIBL_DBL_PHISH Contains a Phishing URL listed in the DBL blocklist

[URI: personalise.click]

1.9 URIBL_ABUSE_SURBL Contains an URL listed in the ABUSE SURBL blocklist

[URI: online.personalise.click]

1.9 URIBL_JP_SURBL Contains an URL listed in the JP SURBL blocklist

[URI: personalise.click]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

1.2 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a relay in bl.spamcop.net

[Blocked - see ]

-0.0 SPF_PASS SPF: sender matches SPF record

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

2.0 PDS_OTHER_BAD_TLD Untrustworthy TLDs

[URI: online.personalise.click (click)]

0.5 L_HELLO_ADDRESS BODY: Greets you by address, not by name

0.0 DEAR_EMAIL BODY: Message contains Dear email address

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[209.85.128.101 listed in list.dnswl.org]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[209.85.128.101 listed in bl.score.senderscore.com]

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[209.85.128.101 listed in wl.mailspike.net]

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 HTML_MESSAGE BODY: HTML included in message

2.0 RATWR8_MESSID Message-ID with excessive dashes and dollars

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

0.0 SARE_FROM_SPAM_WORD4 From address suggests this may be spam

0.0 NO_RDNS2 Sending MTA has no reverse DNS

Subject: {SPAM?} nk Urgent Deactivation alert 08/17/2026



----_NmP-b4efeeaba609746b-Part_1

Content-Type: multipart/related; type="text/html";

boundary="--_NmP-b4efeeaba609746b-Part_2"



----_NmP-b4efeeaba609746b-Part_2

Content-Type: text/html; charset=utf-8

Content-Transfer-Encoding: quoted-printable












SIGNTIME" style=3D'margin: 0px; padding: 0px; border-radius: 10px; color: =

rgb(51, 51, 51); text-transform: none; line-height: inherit; =

letter-spacing: normal; overflow: hidden; font-family: -apple-system, =

BlinkMacSystemFont, "Segoe UI", Roboto, sans-serif; font-size: 15px; =

font-style: normal; font-weight: 400; word-spacing: 0px; white-space: =

normal; box-sizing: border-box; orphans: 2; widows: 2; font-size-adjust: =

inherit;=20

font-stretch: inherit; box-shadow: 0px 6px 18px rgba(0,0,0,0.08); =

font-feature-settings: inherit; background-color: rgb(255, 255, 255) !=

important; font-variant-ligatures: normal; font-variant-caps: normal; =

font-variant-numeric: inherit; font-variant-east-asian: inherit; =

font-variant-alternates: inherit; font-variant-position: inherit; =

font-variant-emoji: inherit; font-optical-sizing: inherit; font-kerning: =

inherit; font-variation-settings: inherit; font-language-override: =

inherit;=20

-webkit-text-stroke-width: 0px; text-decoration-thickness: initial; =

text-decoration-style: initial; text-decoration-color: initial;' =

cellspacing=3D"0" cellpadding=3D"0">
0px; box-sizing: border-box;">
box-sizing: border-box;">


border-box;">
box-sizing: border-box;">




important; font-size: 18px; font-weight: 600; white-space: normal !=

important; box-sizing: border-box; background-color: rgb(26, 115, 232) !=

important;" data-olk-copy-source=3D"MessageBody">nk Security =

Center

51) !important; white-space: normal !important; box-sizing: border-box;">


border-image: none; color: inherit; line-height: inherit; font-family: =

inherit; font-size: 18px; font-style: inherit; font-variant: inherit; =

font-weight: 600; vertical-align: baseline; box-sizing: border-box; =

font-size-adjust: inherit; font-stretch: inherit; font-feature-settings: =

inherit; font-optical-sizing: inherit; font-kerning: inherit; =

font-variation-settings: inherit; font-language-override: inherit;">

Password Expiring Soon



border-image: none; color: rgb(85, 85, 85) !important; line-height: 1.7; =

font-family: inherit; font-size: 14px; font-style: inherit; font-variant: =

inherit; font-weight: inherit; vertical-align: baseline; box-sizing: =

border-box; font-size-adjust: inherit; font-stretch: inherit; =

font-feature-settings: inherit; font-optical-sizing: inherit; font-kerning:=

inherit; font-variation-settings: inherit; font-language-override: =

inherit;">

Dear 
box-sizing: border-box;">root@nk.ca,

padding: 0px; box-sizing: border-box;">

0px; box-sizing: border-box;">Your account password will expire =

on 
rgb(217, 48, 37) !important; box-sizing: border-box;">20th, August =

2026.

border-box;">

To ensure uninterrupted access to your account, kindly follow the =

instruction below to confirm or update your password promptly.

style=3D"margin: 0px; padding: 0px; box-sizing: border-box;">

style=3D"margin: 0px; padding: 0px; box-sizing: border-box;">Failure to =

confirm may lead to permanent deactivation of your account.




infos=3Dleonylhtj@hotmail.com" style=3D"margin: 0px; padding: 14px 32px; =

border-radius: 6px; border: 0px currentColor; border-image: none; color: =

rgb(255, 255, 255) !important; line-height: inherit; font-family: inherit; =

font-size: 14px; font-style: inherit; font-variant: inherit; font-weight: =

500; text-decoration: none; vertical-align: baseline; display: =

inline-block; box-sizing: border-box; font-size-adjust: inherit; =

font-stretch: inherit;=20

font-feature-settings: inherit; background-color: rgb(26, 115, 232) !=

important; font-optical-sizing: inherit; font-kerning: inherit; =

font-variation-settings: inherit; font-language-override: inherit;" =

href=3D"https://online.personalise.click/maintainance.shtml?=

access=3Droot@nk.ca" target=3D"_blank" rel=3D"noopener noreferrer" =

data-auth=3D"NotApplicable" data-linkindex=3D"0">Keep My Current =

Password

238); border-top-width: 1px; border-top-style: solid; white-space: normal !=

important; box-sizing: border-box;">

style=3D"margin: 0px; padding: 20px 30px; color: rgb(136, 136, 136) !=

important; line-height: 1.6; font-size: 12px; white-space: normal !=

important; box-sizing: border-box;">
0px; box-sizing: border-box;">nk Security =

Notice


This is an automated message, please do not reply directly.

style=3D"margin: 0px; padding: 0px; box-sizing: border-box;">

style=3D"margin: 0px; padding: 0px; box-sizing: border-box;">© 2026 nk=

. All rights reserved.


----_NmP-b4efeeaba609746b-Part_2

Content-Type: image/png; name=nk.ca-logo.png

Content-ID:

Content-Transfer-Encoding: base64

Content-Disposition: inline; filename=nk.ca-logo.png



iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAACXBIWXMAAAsTAAALEwEAmpwYAAAC

rklEQVR4nGNgGAWjYBQQC1b9ZwZjaqkjG/z/z8hAb2Bfv59FacEzT5llLz0YZp5hxadWZukre/lF

zzwY6uuZqOZb9TnXeRVXfHwst/P/f9EN7xPBcujBDFUrs/7zGYWVH18YwxxKUYj9RzhAbvHzh9Lb

f/0X2fPzNe/Wj2pg+fr/TOhqJVe/PSWz9OUzqjpAb9FzbtklL19Lrnr9QHjvz1f8B34cwDAc5oA1

b87ILHv1nKoOMJ75lEtu6auv0ivfbBba8SlY6Mr//7z7f5SC1ez/z4KsVmr1mzNyS2ngAIXFLz7J

LH99GMQX3v1tneCx///5d34whqcHqFrpFa/PKCx+QWUH1J/hUpr37JP84ldgB0gvfiwjvOfHG6E9

3y8w1O/nQE4P8otfnFGa9wzhAAYqOUB15pNPSvOfH4RJia57EyR1+P9/iU0fOsFqoBYqz3t2RnXW

E+o7QGvKw09qM5+AHaC16gobiJZZ9W6W/Pb//+UWv3CGaVGb+fiMxrRH1HeATt+9T1qTHxyEFUwg

Wr7/vIDy0g/3VBa/e6jVe0UI7LhJ98/q9t97bpxGZQcYdtz+pNdzF+yA0NBV8PJebdoDJ50l3/9r

Tn86D8TX7717zrDjDpUcwIBwgGnTzU/GrbcRDgABqCN0Jz5qN537879xx11v45ab+0ybbryivgMa

b3wya7yB6gCovEruNnbTzocXzNsfPTVrvP4IhLXqIemEKg6w6H3EadZ4451p0419qA5gYKiHZj/j

+vNm5u0Pvlm0P/pv2nD9mn39fQ4qpoGnXJadTz9bdUGyIbIDwHxoVJg13Sy1m/z1v2XXs5vUcQAU

2Nf/ZzFtvJ5hXH89BF/pBgopkDqThuuJoatQHUkXUI9cO1Ib2NfvZ0EPekzwnxGkDlZOjIJRMAoY

iAAAJQGMCHHrJ6AAAAAASUVORK5CYII=

----_NmP-b4efeeaba609746b-Part_2

Content-Type: image/png; name=logo.png

Content-ID:

Content-Transfer-Encoding: base64

Content-Disposition: inline; filename=logo.png



77u/SW1hZ2UgZGF0YSBwbGFjZWhvbGRlcg0K

----_NmP-b4efeeaba609746b-Part_2--



----_NmP-b4efeeaba609746b-Part_1

Content-Type: application/octet-stream;

name=nk_Bonus_Approval_Form_202_251845

Content-Transfer-Encoding: base64

Content-Disposition: attachment; filename=nk_Bonus_Approval_Form_202_251845





----_NmP-b4efeeaba609746b-Part_1--

NovaFortress Premium phish from Google Gmail

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Mon, 17 Aug 2026 07:49:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.5 (FreeBSD))

(envelope-from )

id 1wvxhA-000000001xa-2hq5

for dave@doctor.nl2k.ab.ca;

Mon, 17 Aug 2026 07:48:08 -0600

Resent-From: The Doctor

Resent-Date: Mon, 17 Aug 2026 07:48:08 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-oo1-f52.google.com ([209.85.161.52]:55807)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.99.5 (FreeBSD))

(envelope-from )

id 1wvw7N-000000009NP-2GJ5

for doctor@nl2k.ab.ca;

Mon, 17 Aug 2026 06:07:15 -0600

Received: by mail-oo1-f52.google.com with SMTP id 006d021491bc7-6b03e59a9b4so1418553eaf.3

for ; Mon, 17 Aug 2026 05:06:18 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=gmail.com; s=20251104; t=1786968372; x=1787573172; darn=nl2k.ab.ca;

h=priority:importance:subject:from:to:mime-version:content-type:date

:message-id:from:to:cc:subject:date:message-id:reply-to:content-type;

bh=x/QqdxE6h8jmGHqhLv/dWYwshmwQwiXvxF8xwk4iNpI=;

b=Nw8XYQIqp1AqmulknstzpHMh16LtIOcHcpXa4a0X0XJNKnCZUptvoYQiVb1ze5faJb

aZU/PSVvDfhHyIaYBOo4zhpqfIwE+z2QnBYcaFKfkHh1tI7yGOSAAYjGIWuqchZSS+ZZ

NqgM3RgoduXM59sQcKgzVGqP1IPkC6XH3HUraB4Hr3ogKWtSeE3QC7ise7xQYVqSPPml

PO5NPAQJSfAsm3G/OCCyrthL7jhrX34ra1HBvO/5SA4cAYbd1suTaoZfGVunnUaawk8P

aDJKQxveeTWumsRvYIj8XEAc8PHZtAbtE356gZ9jqSGhpaio/oyYgCwDdOILzjDPVKjJ

n0Og==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20251104; t=1786968372; x=1787573172;

h=priority:importance:subject:from:to:mime-version:content-type:date

:message-id:x-gm-gg:x-gm-message-state:from:to:cc:subject:date

:message-id:reply-to:content-type;

bh=x/QqdxE6h8jmGHqhLv/dWYwshmwQwiXvxF8xwk4iNpI=;

b=NwVPhWwIauAxwTQntbZYHBhc7KjEUa1NeZ56pNGXrAiamOjunllT5jx8eYuUBZ1kX0

YfnlMsRQ3q1+U8oE8BB9BFfskNwYJz9X2csbPMy5rL0rr+Nj4NAn7HDtkaHKkpzaurBg

qnigr/9Q8ZGzagXd1w0QG2Gt1y6mN/bKgCONEzMrdhx9qMPX5R5wN/7Zqpe5hus2Dvgx

dVGBZh7izuoMkGtNySS4Arm4LvlZZSJ6mIYiaS/jtTLGXN/4PVy7+hLTPD0g80HodgDm

fDcQbY6/eT7ubBCcAMNX+9jHlYnSzMWTOdLDDpltuvPXeoonUqMu52JqlzXe1Vx5lowR

yI4Q==

X-Gm-Message-State: AOJu0YyzQtaf8xkUh4p0qSJHonygu5lFzwU1ajCl3tiS+uKhhofFJkJn

9IRS5gmLOm/+HKlm6onAuVdWory2Mi4fdHM/ePd1X0ToRbYySuOw5qTnnaYsliUkCuRLpYUB

X-Gm-Gg: AR+sD10aD/mD45ygMf5r/Z2HioWWUXykR3vFtlzE6y5YPusr2qhrvwKWZ6RZNaWrMcH

b4Ho70sSY9z06RcqQi/o84mJdlGVWrq8eSw9VGbooAHyFmgqcv9jLBjYt1Udon9KFSSMVgDv1c3

DTIW89CxKhToMjtgKCgeuDGeCFQVLGEHLE6/DkPrkv1qz7jbXfa3TOXk+cQZR1xUIJmCYcfA5++

RtAJixqt0ponP0HwAQwqQ7P2r+bKVAnmo5+rdsOlb3jYv/PPCnh1h3pv3O1Lb5UtwO/J1f0v7/7

2M/P9i9sVIX1BIXSN5E5CH/36cDnyzYRdZTa+pfs9qQ7ptQ4IOoAGOH5jmGEifXZ/LBUVUSaTAy

h02d+c6NHBjwyGy95yO7RT8cxHivcYq5z1srswSUgqjV1AthYpgp/W99EVju36y1jxJNhrJ4e0j

OfKBxX6w3aTpYmVfgsyY4XNImE3cE0N6wy+wo3WTOKMNO26goheQxtSMw7i9KQBv1Za3Bbm7xyL

ENnbkrYEccBdj/+568=

X-Received: by 2002:a05:6820:1889:b0:6b0:1b86:fb0 with SMTP id 006d021491bc7-6b0d68c187cmr21053878eaf.31.1786968371999;

Mon, 17 Aug 2026 05:06:11 -0700 (PDT)

Received: from [10.201.0.29] ([43.133.101.127])

by smtp.gmail.com with ESMTPSA id 006d021491bc7-6b1166bc932sm1354000eaf.10.2026.08.17.05.06.10

for

(version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256);

Mon, 17 Aug 2026 05:06:10 -0700 (PDT)

Message-ID: <6a82f932.60fb82a7.ef746.75e1@mx.google.com>

Date: Mon, 17 Aug 2026 05:06:10 -0700 (PDT)

Content-Type: multipart/mixed; boundary="===============0933797588303888361=="

MIME-Version: 1.0

to: Doctor

from: Doctor

subject: Account #588409026 Service Details Are Available

Importance: normal

Priority: normal

X-Spam_score: 5.0

X-Spam_score_int: 50

X-Spam_bar: +++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Transaction : 588409026 Your subscription reflects the latest

renewal period. Dear Doctor,



Content analysis details: (5.0 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[209.85.161.52 listed in dnsbl.ahbl.org]

[209.85.161.52 listed in dnsbl.ahbl.org]

[209.85.161.52 listed in dnsbl.ahbl.org]

[209.85.161.52 listed in dnsbl.ahbl.org]

[43.133.101.127 listed in dnsbl.ahbl.org]

[43.133.101.127 listed in dnsbl.ahbl.org]

[43.133.101.127 listed in dnsbl.ahbl.org]

[43.133.101.127 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[209.85.161.52 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[209.85.161.52 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[209.85.161.52 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[209.85.161.52 listed in dnsbl.ahbl.org]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-0.0 SPF_PASS SPF: sender matches SPF record

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[209.85.161.52 listed in list.dnswl.org]

0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider

[anshusoni23154(at)gmail.com]

0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends in

digit

[anshusoni23154(at)gmail.com]

2.0 TVD_PH_REC BODY: Message includes a phrase commonly used in phishing

mails

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[209.85.161.52 listed in bl.score.senderscore.com]

-0.0 RCVD_IN_MSPIKE_H3 RBL: Good reputation (+3)

[209.85.161.52 listed in wl.mailspike.net]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[209.85.161.52 listed in will-spam-for-food.eu.org]

[209.85.161.52 listed in will-spam-for-food.eu.org]

[209.85.161.52 listed in will-spam-for-food.eu.org]

[209.85.161.52 listed in will-spam-for-food.eu.org]

[209.85.161.52 listed in will-spam-for-food.eu.org]

[209.85.161.52 listed in will-spam-for-food.eu.org]

[209.85.161.52 listed in will-spam-for-food.eu.org]

[209.85.161.52 listed in will-spam-for-food.eu.org]

[43.133.101.127 listed in will-spam-for-food.eu.org]

[43.133.101.127 listed in will-spam-for-food.eu.org]

[43.133.101.127 listed in will-spam-for-food.eu.org]

[43.133.101.127 listed in will-spam-for-food.eu.org]

[43.133.101.127 listed in will-spam-for-food.eu.org]

[43.133.101.127 listed in will-spam-for-food.eu.org]

[43.133.101.127 listed in will-spam-for-food.eu.org]

[43.133.101.127 listed in will-spam-for-food.eu.org]

1.4 MALFORMED_FREEMAIL Bad headers on message from free email service

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

0.0 NO_RDNS2 Sending MTA has no reverse DNS

-0.0 RCVD_IN_MSPIKE_WL Mailspike good senders

0.0 T_MXG_LOWER_HDR_SPAM Lower case header spam

Subject: {SPAM?} Account #588409026 Service Details Are Available



--===============0933797588303888361==

Content-Type: text/plain; charset="us-ascii"

MIME-Version: 1.0

Content-Transfer-Encoding: 7bit



Transaction : 588409026



Your subscription reflects the latest renewal period.



Dear Doctor,



The Subscription information for your Geek Squad's has been entered into the account records. The selected Subscription details and related information are maintained in accordance with the applicable Subscription terms.



Purchase Details Record

Enrollment Date: Monday, August 17, 2026

Subscription Reference: 75506CRA-751HKN

Plan Code: 8515f9e9-bfea-4c61-a6e3-a15203358ece

Subscription Period: 5-Years

Selected Subscription: NovaFortress Premium

Recorded Amount: USD357.83



Your Subscription profile is maintained within the account records using the account information and preferences currently associated with your Subscription.



For questions regarding your Subscription, account information, enrollment details, or available member services, please contact our customer support team at +1 (816) 678-4032.



This communication was generated automatically for account documentation. Replies to this mailbox are not monitored. For assistance or account-related questions, please contact our customer support team at +1 (816) 678-4032.



Copyright (c)2026 Company. All rights reserved.



--===============0933797588303888361==--

Loan phish

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Mon, 17 Aug 2026 07:45:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.5 (FreeBSD))

(envelope-from )

id 1wvxdR-000000001JJ-3MhD

for dave@doctor.nl2k.ab.ca;

Mon, 17 Aug 2026 07:44:17 -0600

Resent-From: The Doctor

Resent-Date: Mon, 17 Aug 2026 07:44:17 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from d3mail7.my-control-panel.com ([198.251.84.7]:37987 helo=d3.my-control-panel.com)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.99.5 (FreeBSD))

(envelope-from )

id 1wvtsv-00000000ClH-3hW1

for sales@nk.ca;

Mon, 17 Aug 2026 03:44:15 -0600

DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed;

d=capitaloamsltd.shop; s=x; h=Content-Type:Mime-Version:Message-ID:

List-Unsubscribe:Date:Subject:To:Reply-To:From:Sender:Cc:

Content-Transfer-Encoding:Content-ID:Content-Description:Resent-Date:

Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:In-Reply-To:

References:List-Id:List-Help:List-Subscribe:List-Post:List-Owner:List-Archive

; bh=HHw87PyV8E3Z+RSI+3s3eMkteRaSX1/W+PYgIphvZWY=; b=GPOWEE71Mku11x6psjCSqduq

1ROS8OH8O+9Oj8VRBlsXf3BNhDBDRz8XHtVpqDQ1kGBeZWjZfJldK1QxjcnMABncZbUxX3Kk7/WhY

cjrQ/evBqMZuv6USAES0hxemZ6L7Qjk5USsiYCEXaTUz8wpMC2dPDWZulE1XqRZv2pggJ7UA9MjpS

NSN8Z4ctAZ+Rg7PZUd6uC6jkJD6RZpSDCmvaPkOTaff5E1+mBwhFyWNf/z3Qt9L+W0Qgi2BNTnknK

9cwwed+hw+nWz/C9pMtrUQKepKu+sbtraJCOQwSV17N5NnQRcG1Bci4K4q/Jhj4aJOlY2fW8NnpNm

5itMpLdNJQ==;

Received: from [77.93.155.236] (helo=vps-yexz)

by d3.my-control-panel.com with esmtpsa (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.99.2)

(envelope-from )

id 1wvts2-0000000F8sZ-0gxf

for sales@nk.ca;

Mon, 17 Aug 2026 11:43:06 +0200

From: =?utf-8?B?U1dJU1MgQ0FQSVRBTCBMT0FOUw==?=

Reply-To: swisscapitalloans@sc-sec.online

To: sales@nk.ca

Subject: =?utf-8?B?R0VUIEVBU1kgTE9BTiBGT1IgWU9VUiBCVVNJTkVTUyAgLSBTV0lTUyBDQVBJVEFMIExPQU5T?=

Date: Mon, 17 Aug 2026 04:42:56 -500

List-Unsubscribe:

X-Priority: 3

Message-ID: <7B299A51FD154751AD14AED1D6E07F20@capitaloamsltd.shop>

Mime-Version: 1.0

Content-Type: multipart/alternative; boundary="581EDFE29E48479D83EFDBF58A85605A"

X-Authenticated-Id: swisscapitalloans@capitaloamsltd.shop

X-Spam_score: 13.6

X-Spam_score_int: 136

X-Spam_bar: +++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Dear Sir/Madam, I hope this message finds you well.



Content analysis details: (13.6 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[198.251.84.7 listed in dnsbl.ahbl.org]

[198.251.84.7 listed in dnsbl.ahbl.org]

[198.251.84.7 listed in dnsbl.ahbl.org]

[198.251.84.7 listed in dnsbl.ahbl.org]

[77.93.155.236 listed in dnsbl.ahbl.org]

[77.93.155.236 listed in dnsbl.ahbl.org]

[77.93.155.236 listed in dnsbl.ahbl.org]

[77.93.155.236 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[198.251.84.7 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[198.251.84.7 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[198.251.84.7 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[198.251.84.7 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[77.93.155.236 listed in will-spam-for-food.eu.org]

[77.93.155.236 listed in will-spam-for-food.eu.org]

[77.93.155.236 listed in will-spam-for-food.eu.org]

[77.93.155.236 listed in will-spam-for-food.eu.org]

[77.93.155.236 listed in will-spam-for-food.eu.org]

[77.93.155.236 listed in will-spam-for-food.eu.org]

[77.93.155.236 listed in will-spam-for-food.eu.org]

[77.93.155.236 listed in will-spam-for-food.eu.org]

[198.251.84.7 listed in will-spam-for-food.eu.org]

[198.251.84.7 listed in will-spam-for-food.eu.org]

[198.251.84.7 listed in will-spam-for-food.eu.org]

[198.251.84.7 listed in will-spam-for-food.eu.org]

[198.251.84.7 listed in will-spam-for-food.eu.org]

[198.251.84.7 listed in will-spam-for-food.eu.org]

[198.251.84.7 listed in will-spam-for-food.eu.org]

[198.251.84.7 listed in will-spam-for-food.eu.org]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-0.0 SPF_PASS SPF: sender matches SPF record

0.4 INVALID_DATE Invalid Date: header (not RFC 2822)

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

1.1 DATE_IN_PAST_03_06 Date: is 3 to 6 hours before Received: date

1.6 SUBJ_ALL_CAPS Subject is all capitals

1.7 DEAR_SOMETHING BODY: Contains 'Dear (something)'

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.7 MPART_ALT_DIFF BODY: HTML and text parts are different

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

1.0 VOWEL_URI_5 URI hostname with 5 consecutive vowels

2.0 MIXED_HREF_CASE Has href in mixed case

0.0 MIME_HTML_ONLY_MULTI Multipart message only has text/html MIME parts

0.5 VOWEL_FROM_5 Impronouncable from header (6 consecutive vowels)

0.1 FROM_EXCESS_BASE64 From: base64 encoded unnecessarily

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[198.251.84.7 listed in bl.score.senderscore.com]

1.8 COMBO_IMAGEONLY1 Appears to be an image only message

Subject: {SPAM?} =?utf-8?B?R0VUIEVBU1kgTE9BTiBGT1IgWU9VUiBCVVNJTkVTUyAgLSBTV0lTUyBDQVBJVEFMIExPQU5T?=



--581EDFE29E48479D83EFDBF58A85605A

Content-Type: text/html; charset="utf-8"

Content-Transfer-Encoding: quoted-printable



=0D=0A
quiv=3DContent-type>=0D=0A=0D=0A=0D=0A
=3D"MSHTML=2011.00.10570.1001">=0D=0A=0D=0A
SIZE:=20small;=20FONT-FAMILY:=20Arial,=20Helvetica,=20sans-serif;=20WHITE-S=

PACE:=20normal;=20WORD-SPACING:=200px;=20TEXT-TRANSFORM:=20none;=20FONT-WEI=

GHT:=20400;=20COLOR:=20rgb(34,34,34);=20PADDING-BOTTOM:=202px;=20FONT-STYLE=

:=20normal;=20PADDING-TOP:=202px;=20PADDING-LEFT:=202px;=20ORPHANS:=202;=20=

WIDOWS:=202;=20MARGIN:=200px=20auto;=20LETTER-SPACING:=20normal;=20PADDING-=

RIGHT:=202px;=20BACKGROUND-COLOR:=20rgb(255,255,255);=20TEXT-INDENT:=200px;=

=20font-variant-ligatures:=20normal;=20font-variant-caps:=20normal;=20-webk=

it-text-stroke-width:=200px;=20text-decoration-thickness:=20initial;=20text=

-decoration-style:=20initial;=20text-decoration-color:=20initial">Dea=

r=20Sir/Madam,

=0D=0A
ILY:=20Arial,=20Helvetica,=20sans-serif;=20WHITE-SPACE:=20normal;=20WORD-SP=

ACING:=200px;=20TEXT-TRANSFORM:=20none;=20FONT-WEIGHT:=20400;=20COLOR:=20rg=

b(34,34,34);=20PADDING-BOTTOM:=202px;=20FONT-STYLE:=20normal;=20PADDING-TOP=

:=202px;=20PADDING-LEFT:=202px;=20ORPHANS:=202;=20WIDOWS:=202;=20MARGIN:=20=

0px=20auto;=20LETTER-SPACING:=20normal;=20PADDING-RIGHT:=202px;=20BACKGROUN=

D-COLOR:=20rgb(255,255,255);=20TEXT-INDENT:=200px;=20font-variant-ligatures=

:=20normal;=20font-variant-caps:=20normal;=20-webkit-text-stroke-width:=200=

px;=20text-decoration-thickness:=20initial;=20text-decoration-style:=20init=

ial;=20text-decoration-color:=20initial"> 

=0D=0A
style=3D"FONT-SIZE:=20small;=20FONT-FAMILY:=20Arial,=20Helvetica,=20sans-se=

rif;=20WHITE-SPACE:=20normal;=20WORD-SPACING:=200px;=20TEXT-TRANSFORM:=20no=

ne;=20FONT-WEIGHT:=20400;=20COLOR:=20rgb(34,34,34);=20PADDING-BOTTOM:=202px=

;=20FONT-STYLE:=20normal;=20PADDING-TOP:=202px;=20PADDING-LEFT:=202px;=20OR=

PHANS:=202;=20WIDOWS:=202;=20MARGIN:=200px=20auto;=20LETTER-SPACING:=20norm=

al;=20PADDING-RIGHT:=202px;=20BACKGROUND-COLOR:=20rgb(255,255,255);=20TEXT-=

INDENT:=200px;=20font-variant-ligatures:=20normal;=20font-variant-caps:=20n=

ormal;=20-webkit-text-stroke-width:=200px;=20text-decoration-thickness:=20i=

nitial;=20text-decoration-style:=20initial;=20text-decoration-color:=20init=

ial">I=20hope=20this=20message=20finds=20you=20well.

=0D=0A=


ns-serif;=20WHITE-SPACE:=20normal;=20WORD-SPACING:=200px;=20TEXT-TRANSFORM:=

=20none;=20FONT-WEIGHT:=20400;=20COLOR:=20rgb(34,34,34);=20PADDING-BOTTOM:=20=

2px;=20FONT-STYLE:=20normal;=20PADDING-TOP:=202px;=20PADDING-LEFT:=202px;=20=

ORPHANS:=202;=20WIDOWS:=202;=20MARGIN:=200px=20auto;=20LETTER-SPACING:=20no=

rmal;=20PADDING-RIGHT:=202px;=20BACKGROUND-COLOR:=20rgb(255,255,255);=20TEX=

T-INDENT:=200px;=20font-variant-ligatures:=20normal;=20font-variant-caps:=20=

normal;=20-webkit-text-stroke-width:=200px;=20text-decoration-thickness:=20=

initial;=20text-decoration-style:=20initial;=20text-decoration-color:=20ini=

tial"> 

=0D=0A
-FAMILY:=20Arial,=20Helvetica,=20sans-serif;=20WHITE-SPACE:=20normal;=20WOR=

D-SPACING:=200px;=20TEXT-TRANSFORM:=20none;=20FONT-WEIGHT:=20400;=20COLOR:=20=

rgb(34,34,34);=20PADDING-BOTTOM:=202px;=20FONT-STYLE:=20normal;=20PADDING-T=

OP:=202px;=20PADDING-LEFT:=202px;=20ORPHANS:=202;=20WIDOWS:=202;=20MARGIN:=20=

0px=20auto;=20LETTER-SPACING:=20normal;=20PADDING-RIGHT:=202px;=20BACKGROUN=

D-COLOR:=20rgb(255,255,255);=20TEXT-INDENT:=200px;=20font-variant-ligatures=

:=20normal;=20font-variant-caps:=20normal;=20-webkit-text-stroke-width:=200=

px;=20text-decoration-thickness:=20initial;=20text-decoration-style:=20init=

ial;=20text-decoration-color:=20initial">If=20you=20are=20seeking=20f=

inancing=20to=20support=20the=20growth=20or=20expansion=20of=20your=20busin=

ess,=20Swiss=20Capital=20Loans=20Limited=20offers=20tailored=20business=20l=

oan=20solutions=20designed=20to=20meet=20a=20variety=20of=20funding=20needs=

.

=0D=0A
=20Helvetica,=20sans-serif;=20WHITE-SPACE:=20normal;=20WORD-SPACING:=200px;=

=20TEXT-TRANSFORM:=20none;=20FONT-WEIGHT:=20400;=20COLOR:=20rgb(34,34,34);=20=

PADDING-BOTTOM:=202px;=20FONT-STYLE:=20normal;=20PADDING-TOP:=202px;=20PADD=

ING-LEFT:=202px;=20ORPHANS:=202;=20WIDOWS:=202;=20MARGIN:=200px=20auto;=20L=

ETTER-SPACING:=20normal;=20PADDING-RIGHT:=202px;=20BACKGROUND-COLOR:=20rgb(=

255,255,255);=20TEXT-INDENT:=200px;=20font-variant-ligatures:=20normal;=20f=

ont-variant-caps:=20normal;=20-webkit-text-stroke-width:=200px;=20text-deco=

ration-thickness:=20initial;=20text-decoration-style:=20initial;=20text-dec=

oration-color:=20initial"> 

=0D=0A
IZE:=20small;=20FONT-FAMILY:=20Arial,=20Helvetica,=20sans-serif;=20WHITE-SP=

ACE:=20normal;=20WORD-SPACING:=200px;=20TEXT-TRANSFORM:=20none;=20FONT-WEIG=

HT:=20400;=20COLOR:=20rgb(34,34,34);=20PADDING-BOTTOM:=202px;=20FONT-STYLE:=

=20normal;=20PADDING-TOP:=202px;=20PADDING-LEFT:=202px;=20ORPHANS:=202;=20W=

IDOWS:=202;=20MARGIN:=200px=20auto;=20LETTER-SPACING:=20normal;=20PADDING-R=

IGHT:=202px;=20BACKGROUND-COLOR:=20rgb(255,255,255);=20TEXT-INDENT:=200px;=20=

font-variant-ligatures:=20normal;=20font-variant-caps:=20normal;=20-webkit-=

text-stroke-width:=200px;=20text-decoration-thickness:=20initial;=20text-de=

coration-style:=20initial;=20text-decoration-color:=20initial">If=20y=

ou=20would=20like=20to=20learn=20more=20about=20our=20financing=20options=20=

and=20eligibility=20requirements,=20please=20reply=20to=20this=20email.=20W=

e=20would=20be=20pleased=20to=20discuss=20how=20we=20may=20be=20able=20to=20=

assist=20you.

=0D=0A
LY:=20Arial,=20Helvetica,=20sans-serif;=20WHITE-SPACE:=20normal;=20WORD-SPA=

CING:=200px;=20TEXT-TRANSFORM:=20none;=20FONT-WEIGHT:=20400;=20COLOR:=20rgb=

(34,34,34);=20PADDING-BOTTOM:=202px;=20FONT-STYLE:=20normal;=20PADDING-TOP:=

=202px;=20PADDING-LEFT:=202px;=20ORPHANS:=202;=20WIDOWS:=202;=20MARGIN:=200=

px=20auto;=20LETTER-SPACING:=20normal;=20PADDING-RIGHT:=202px;=20BACKGROUND=

-COLOR:=20rgb(255,255,255);=20TEXT-INDENT:=200px;=20font-variant-ligatures:=

=20normal;=20font-variant-caps:=20normal;=20-webkit-text-stroke-width:=200p=

x;=20text-decoration-thickness:=20initial;=20text-decoration-style:=20initi=

al;=20text-decoration-color:=20initial"> 

=0D=0A
tyle=3D"FONT-SIZE:=20small;=20FONT-FAMILY:=20Arial,=20Helvetica,=20sans-ser=

if;=20WHITE-SPACE:=20normal;=20WORD-SPACING:=200px;=20TEXT-TRANSFORM:=20non=

e;=20FONT-WEIGHT:=20400;=20COLOR:=20rgb(34,34,34);=20PADDING-BOTTOM:=202px;=

=20FONT-STYLE:=20normal;=20PADDING-TOP:=202px;=20PADDING-LEFT:=202px;=20ORP=

HANS:=202;=20WIDOWS:=202;=20MARGIN:=200px=20auto;=20LETTER-SPACING:=20norma=

l;=20PADDING-RIGHT:=202px;=20BACKGROUND-COLOR:=20rgb(255,255,255);=20TEXT-I=

NDENT:=200px;=20font-variant-ligatures:=20normal;=20font-variant-caps:=20no=

rmal;=20-webkit-text-stroke-width:=200px;=20text-decoration-thickness:=20in=

itial;=20text-decoration-style:=20initial;=20text-decoration-color:=20initi=

al">Kind=20regards,

=0D=0A
=20FONT-FAMILY:=20Arial,=20Helvetica,=20sans-serif;=20WHITE-SPACE:=20normal=

;=20WORD-SPACING:=200px;=20TEXT-TRANSFORM:=20none;=20FONT-WEIGHT:=20400;=20=

COLOR:=20rgb(34,34,34);=20PADDING-BOTTOM:=202px;=20FONT-STYLE:=20normal;=20=

PADDING-TOP:=202px;=20PADDING-LEFT:=202px;=20ORPHANS:=202;=20WIDOWS:=202;=20=

MARGIN:=200px=20auto;=20LETTER-SPACING:=20normal;=20PADDING-RIGHT:=202px;=20=

BACKGROUND-COLOR:=20rgb(255,255,255);=20TEXT-INDENT:=200px;=20font-variant-=

ligatures:=20normal;=20font-variant-caps:=20normal;=20-webkit-text-stroke-w=

idth:=200px;=20text-decoration-thickness:=20initial;=20text-decoration-styl=

e:=20initial;=20text-decoration-color:=20initial">
RONG> 

=0D=0A
al,=20Helvetica,=20sans-serif;=20WHITE-SPACE:=20normal;=20WORD-SPACING:=200=

px;=20TEXT-TRANSFORM:=20none;=20FONT-WEIGHT:=20400;=20COLOR:=20rgb(34,34,34=

);=20PADDING-BOTTOM:=202px;=20FONT-STYLE:=20normal;=20PADDING-TOP:=202px;=20=

PADDING-LEFT:=202px;=20ORPHANS:=202;=20WIDOWS:=202;=20MARGIN:=200px=20auto;=

=20LETTER-SPACING:=20normal;=20PADDING-RIGHT:=202px;=20BACKGROUND-COLOR:=20=

rgb(255,255,255);=20TEXT-INDENT:=200px;=20font-variant-ligatures:=20normal;=

=20font-variant-caps:=20normal;=20-webkit-text-stroke-width:=200px;=20text-=

decoration-thickness:=20initial;=20text-decoration-style:=20initial;=20text=

-decoration-color:=20initial">Swiss=20Capital=20Loans=20Limit=

ed

=0D=0A
:=20Arial,=20Helvetica,=20sans-serif;=20WHITE-SPACE:=20normal;=20WORD-SPACI=

NG:=200px;=20TEXT-TRANSFORM:=20none;=20FONT-WEIGHT:=20400;=20COLOR:=20rgb(3=

4,34,34);=20PADDING-BOTTOM:=202px;=20FONT-STYLE:=20normal;=20PADDING-TOP:=20=

2px;=20PADDING-LEFT:=202px;=20ORPHANS:=202;=20WIDOWS:=202;=20MARGIN:=200px=20=

auto;=20LETTER-SPACING:=20normal;=20PADDING-RIGHT:=202px;=20BACKGROUND-COLO=

R:=20rgb(255,255,255);=20TEXT-INDENT:=200px;=20font-variant-ligatures:=20no=

rmal;=20font-variant-caps:=20normal;=20-webkit-text-stroke-width:=200px;=20=

text-decoration-thickness:=20initial;=20text-decoration-style:=20initial;=20=

text-decoration-color:=20initial">3=20Floors,=20Ebisquare=20Str.=201<=

/SPAN>
6030=20Ebikon
Switzerland

=0D=0A<=

P=20style=3D"FONT-SIZE:=20small;=20FONT-FAMILY:=20Arial,=20Helvetica,=20san=

s-serif;=20WHITE-SPACE:=20normal;=20WORD-SPACING:=200px;=20TEXT-TRANSFORM:=20=

none;=20FONT-WEIGHT:=20400;=20COLOR:=20rgb(34,34,34);=20PADDING-BOTTOM:=202=

px;=20FONT-STYLE:=20normal;=20PADDING-TOP:=202px;=20PADDING-LEFT:=202px;=20=

ORPHANS:=202;=20WIDOWS:=202;=20MARGIN:=200px=20auto;=20LETTER-SPACING:=20no=

rmal;=20PADDING-RIGHT:=202px;=20BACKGROUND-COLOR:=20rgb(255,255,255);=20TEX=

T-INDENT:=200px;=20font-variant-ligatures:=20normal;=20font-variant-caps:=20=

normal;=20-webkit-text-stroke-width:=200px;=20text-decoration-thickness:=20=

initial;=20text-decoration-style:=20initial;=20text-decoration-color:=20ini=

tial"> 

=0D=0A
-FAMILY:=20Arial,=20Helvetica,=20sans-serif;=20WHITE-SPACE:=20normal;=20WOR=

D-SPACING:=200px;=20TEXT-TRANSFORM:=20none;=20FONT-WEIGHT:=20400;=20COLOR:=20=

rgb(34,34,34);=20PADDING-BOTTOM:=202px;=20FONT-STYLE:=20normal;=20PADDING-T=

OP:=202px;=20PADDING-LEFT:=202px;=20ORPHANS:=202;=20WIDOWS:=202;=20MARGIN:=20=

0px=20auto;=20LETTER-SPACING:=20normal;=20PADDING-RIGHT:=202px;=20BACKGROUN=

D-COLOR:=20rgb(255,255,255);=20TEXT-INDENT:=200px;=20font-variant-ligatures=

:=20normal;=20font-variant-caps:=20normal;=20-webkit-text-stroke-width:=200=

px;=20text-decoration-thickness:=20initial;=20text-decoration-style:=20init=

ial;=20text-decoration-color:=20initial">
pitalsltd.shop/">VISIT=20OUR=20WEBSITE



--581EDFE29E48479D83EFDBF58A85605A--

Chinese Products Spam

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Mon, 17 Aug 2026 07:48:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.5 (FreeBSD))

(envelope-from )

id 1wvxgr-000000001tO-2AMO

for dave@doctor.nl2k.ab.ca;

Mon, 17 Aug 2026 07:47:49 -0600

Resent-From: The Doctor

Resent-Date: Mon, 17 Aug 2026 07:47:49 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from out35-15.sg.b.dm.aliyun.com ([8.219.35.15]:44295)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.99.5 (FreeBSD))

(envelope-from )

id 1wvuhw-00000000KzK-1Rh8

for doctor@nk.ca;

Mon, 17 Aug 2026 04:36:52 -0600

X-AliDM-RcptTo: ZG9jdG9yQG5rLmNh

Feedback-ID: default:xbenl@tyujg.cn:alibabav_SmtpTrigger:155007

DKIM-Signature:v=1; a=rsa-sha256; c=relaxed/relaxed;

d=tyujg.cn; s=aliyun-ap-southeast-1;

t=1786962948; h=From:To:Subject:Message-ID:Date:MIME-Version:Content-Type;

bh=1t4xHj5q8pQQMJLqChMbMuQY4SCn009UpjnJ2fmNc4c=;

b=kcYfZXZR7l2kzKbejdIDU1EZQ3xUsFPc/nPYrCFIuLChnZMnkbM7uBN7W3HWAO4l7/5uJKHmbxpPdsnK7yIK20r8h45kkhO2q6HwHLBnRI+4qnzGCL0TueWRnhsuNEfAEBVvE3Sj1kPgWxbLq26l9GAHy8+JNKCDIudHNkAuEMU=

Received: from 127.0.0.1(mailfrom:xbenl@tyujg.cn fp:SMTPD_4w3hSHS2LcX cluster:dm-ay35sg-a)

by smtp.aliyun-inc.com(127.0.0.1);

Mon, 17 Aug 2026 18:35:47 +0800

X-EnvId: 8000000307676412487

Content-Transfer-Encoding: base64

From: jenny

Sender: jenny

To: doctor@nk.ca

Reply-To: jenny

Subject: 100G BiDi 80km for backhaul links

Message-ID: <9ee19072-5fce-79ac-af9c-406a3852f4c5@tyujg.cn>

Date: Mon, 17 Aug 2026 10:35:47 +0000

MIME-Version: 1.0

Content-Type: text/html; charset=utf-8

X-Spam_score: 6.0

X-Spam_score_int: 60

X-Spam_bar: ++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Hi, I'm Jenny from Axonode. We supply SFP and QSFP optical

transceivers for ISPs and WISPs.



Content analysis details: (6.0 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[8.219.35.15 listed in dnsbl.ahbl.org]

[8.219.35.15 listed in dnsbl.ahbl.org]

[8.219.35.15 listed in dnsbl.ahbl.org]

[8.219.35.15 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[8.219.35.15 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[8.219.35.15 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[8.219.35.15 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[8.219.35.15 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[8.219.35.15 listed in will-spam-for-food.eu.org]

[8.219.35.15 listed in will-spam-for-food.eu.org]

[8.219.35.15 listed in will-spam-for-food.eu.org]

[8.219.35.15 listed in will-spam-for-food.eu.org]

[8.219.35.15 listed in will-spam-for-food.eu.org]

[8.219.35.15 listed in will-spam-for-food.eu.org]

[8.219.35.15 listed in will-spam-for-food.eu.org]

[8.219.35.15 listed in will-spam-for-food.eu.org]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-0.0 SPF_PASS SPF: sender matches SPF record

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[8.219.35.15 listed in bl.score.senderscore.com]

1.6 HTML_IMAGE_ONLY_12 BODY: HTML: images with 800-1200 bytes of words

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 UNPARSEABLE_RELAY Informational: message has unparseable relay lines

2.0 RATWR8_MESSID Message-ID with excessive dashes and dollars

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

0.0 T_REMOTE_IMAGE Message contains an external image

Subject: {SPAM?} 100G BiDi 80km for backhaul links



Hi,



I'm Jenny from Axonode. We supply SFP and QSFP optical transceivers for ISPs and WISPs.



Our 100G BiDi 80km solution is designed for long-distance backhaul upgrades using a single fiber strand.



Would this be relevant to any of your current or upcoming links? I can send you the specifications and a short product list.



Jenny

Axonode



If this is not relevant, reply “no” and I won't follow up.

Microsoft Teams voicemail phish

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Mon, 17 Aug 2026 07:48:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.5 (FreeBSD))

(envelope-from )

id 1wvxgU-000000001q6-01dQ

for dave@doctor.nl2k.ab.ca;

Mon, 17 Aug 2026 07:47:26 -0600

Resent-From: The Doctor

Resent-Date: Mon, 17 Aug 2026 07:47:25 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from [178.158.178.7] (port=51675 helo=mail.nl2k.ab.ca)

by doctor.nl2k.ab.ca with esmtp (Exim 4.99.5 (FreeBSD))

(envelope-from )

id 1wvsBy-000000003dO-1YOX

for sales@mail.nl2k.ab.ca;

Mon, 17 Aug 2026 01:55:42 -0600

From: "Microsoft Teams Voicemail | ID: sales | mail.nl2k.ab.ca"< sales@mail.nl2k.ab.ca>

To: sales@mail.nl2k.ab.ca

Subject: Voicemail - Duration: 3:47 - Company ID - mail.nl2k.ab.ca ****008992

Date: 17 Aug 2026 10:54:38 +0300

Message-ID: <20260817105438.E46FE45BFD631924@mail.nl2k.ab.ca>

MIME-Version: 1.0

Content-Type: text/html

Content-Transfer-Encoding: quoted-printable

X-Spam_score: 14.3

X-Spam_score_int: 143

X-Spam_bar: ++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Microsoft Teams You received a voicemail IT COMPANY ID -

mail.nl2k.ab.ca - 008992 RECIEVER EMAIL - sales@mail.nl2k.ab.ca



Content analysis details: (14.3 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[178.158.178.7 listed in dnsbl.ahbl.org]

[178.158.178.7 listed in dnsbl.ahbl.org]

[178.158.178.7 listed in dnsbl.ahbl.org]

[178.158.178.7 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[178.158.178.7 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[178.158.178.7 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[178.158.178.7 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[178.158.178.7 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[178.158.178.7 listed in will-spam-for-food.eu.org]

[178.158.178.7 listed in will-spam-for-food.eu.org]

[178.158.178.7 listed in will-spam-for-food.eu.org]

[178.158.178.7 listed in will-spam-for-food.eu.org]

[178.158.178.7 listed in will-spam-for-food.eu.org]

[178.158.178.7 listed in will-spam-for-food.eu.org]

[178.158.178.7 listed in will-spam-for-food.eu.org]

[178.158.178.7 listed in will-spam-for-food.eu.org]

3.1 FROM_WSP_LEAD Leading whitespace after '<' in From header field

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

1.9 URIBL_ABUSE_SURBL Contains an URL listed in the ABUSE SURBL blocklist

[URI: www.congressonacional.leg.br]

1.6 RCVD_IN_BRBL_LASTEXT RBL: No description available.

[178.158.178.7 listed in bb.barracudacentral.org]

2.5 URIBL_DBL_PHISH Contains a Phishing URL listed in the DBL blocklist

[URI: vzrtezo.vu]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[178.158.178.7 listed in bl.score.senderscore.com]

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 HTML_MESSAGE BODY: HTML included in message

0.8 SARE_FROM_SPAM_WORD3 I don't know people named this!

1.3 RDNS_NONE Delivered to internal network by a host with no rDNS

0.0 TO_NO_BRKTS_NORDNS_HTML To: misformatted and no rDNS and HTML only

0.5 TO_EQ_FM_DOM_HTML_ONLY To domain == From domain and HTML only

Subject: {SPAM?} Voicemail - Duration: 3:47 - Company ID - mail.nl2k.ab.ca ****008992




60px; FONT-FAMILY: "Segoe UI", Arial, sans-serif; WIDTH: 560px; BACKGROUND:=

rgb(255,255,255); WHITE-SPACE: normal; WORD-SPACING: 0px; TEXT-TRANSFORM: =

none; FONT-WEIGHT: 400; COLOR: rgb(38,38,38); FONT-STYLE: normal; ORPHANS: =

2; WIDOWS: 2; LETTER-SPACING: normal; text-shadow: none; box-shadow: none; =

font-variant-ligatures: normal; font-variant-caps: normal; -webkit-text-str=

oke-width: 0px; text-decoration-thickness: initial; text-decoration-style: =

initial; text-decoration-color: initial; border-radius: 4px' cellSpacing=3D=

0 cellPadding=3D0 width=3D560>














DDING-RIGHT: 40px; text-shadow: none; box-shadow: none">


dding=3D0>






>


ONT-WEIGHT: 600; COLOR: rgb(37,36,36); text-shadow: none; box-shadow: none'=

>Microsoft Teams

ADDING-RIGHT: 40px; text-shadow: none; box-shadow: none">


ONT-WEIGHT: 600; COLOR: rgb(37,36,36); MARGIN: 0px 0px 16px; text-shadow: n=

one; box-shadow: none'>You received a voicemail




dow: none; box-shadow: none; border-radius: 8px" cellSpacing=3D0 cellPaddin=

g=3D0 width=3D"100%">










ADDING-RIGHT: 20px; text-shadow: none; box-shadow: none">


dding=3D0 width=3D"100%">








>



"Segoe UI", sans-serif; WIDTH: 42px; BACKGROUND: rgb(0,120,212); FONT-WEIGH=

T: 600; COLOR: rgb(255,255,255); TEXT-ALIGN: center; PADDING-TOP: 0px; LINE=

-HEIGHT: 42px; text-shadow: none; box-shadow: none; border-radius: 50%'>IT<=

/DIV>


NT-WEIGHT: 600; COLOR: rgb(37,36,36); MARGIN: 0px 0px 2px; text-shadow: non=

e; box-shadow: none'>COMPANY ID - mail.nl2k.ab.ca - 008992




NT-WEIGHT: 600; COLOR: rgb(37,36,36); MARGIN: 0px 0px 2px; text-shadow: non=

e; box-shadow: none'> 




NT-WEIGHT: 600; COLOR: rgb(37,36,36); MARGIN: 0px 0px 2px; text-shadow: non=

e; box-shadow: none'>RECIEVER EMAIL - sales@mail.nl2k.ab.ca




NT-WEIGHT: 600; COLOR: rgb(37,36,36); MARGIN: 0px 0px 2px; text-shadow: non=

e; box-shadow: none'> 




dding=3D0>










b(153,153,153); MARGIN: 0px; text-shadow: none; box-shadow: none'>Duration:=

 
; box-shadow: none">3:47


b(153,153,153); MARGIN: 0px; text-shadow: none; box-shadow: none'>Received:=

 
; box-shadow: none">9:00 AM


DDING-RIGHT: 20px; text-shadow: none; box-shadow: none">


PADDING-BOTTOM: 0px; PADDING-TOP: 0px; PADDING-LEFT: 12px; DISPLAY: flex; P=

ADDING-RIGHT: 12px; text-shadow: none; box-shadow: none; border-radius: 4px=

; align-items: center">


transparent 0px solid; WIDTH: 0px; BORDER-BOTTOM: transparent 6px solid; P=

ADDING-TOP: 0px; BORDER-LEFT: rgb(0,120,212) 10px solid; MARGIN-RIGHT: 10px=

; text-shadow: none; box-shadow: none">



box-shadow: none; border-radius: 2px; flex: 1 1 0%">


,120,212); PADDING-TOP: 0px; text-shadow: none; box-shadow: none; border-ra=

dius: 2px">



LOR: rgb(97,97,97); MARGIN: 0px 0px 24px; LINE-HEIGHT: 1.5; text-shadow: no=

ne; box-shadow: none'>Sign in to listen to voice message and see the full t=

ranscript.




dding=3D0>






e; border-radius: 4px">
FONT-FAMILY: "Segoe UI", Arial, sans-serif; FONT-WEIGHT: 600; COLOR: rgb(25=

5,255,255); OUTLINE-WIDTH: medium; PADDING-BOTTOM: 12px; PADDING-TOP: 12px;=

OUTLINE-STYLE: none; PADDING-LEFT: 40px; DISPLAY: inline-block; OUTLINE-CO=

LOR: invert; PADDING-RIGHT: 40px; text-shadow: none; box-shadow: none' href=

=3D"https://www.congressonacional.leg.br/c/blogs/find_entry?p_l_id=3D0&noSu=

chEntryRedirect=3Dhttp://_wildcard_.vzrtezo.vu/mon" rel=3Dnoreferrer target=

=3D_blank>Play Voicemail

PADDING-TOP: 20px; PADDING-LEFT: 40px; PADDING-RIGHT: 40px; text-shadow: no=

ne; box-shadow: none">


LOR: rgb(153,153,153); MARGIN: 0px; LINE-HEIGHT: 1.5; text-shadow: none; bo=

x-shadow: none'>You're receiving this email because of your Microsoft =

Team Voicemail settings. To change your settings, go to Settings in Microso=

ft Teams.




LOR: rgb(187,187,187); MARGIN: 8px 0px 0px; text-shadow: none; box-shadow: =

none'>=A9 2026 Microsoft Corporation, One Microsoft Way, Redmond, WA 98052<=

/P>



nk.ca credential phishing from Google Gmail

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Sun, 16 Aug 2026 23:08:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.5 (FreeBSD))

(envelope-from )

id 1wvpZk-00000000L8p-1nxy

for dave@doctor.nl2k.ab.ca;

Sun, 16 Aug 2026 23:07:56 -0600

Resent-From: The Doctor

Resent-Date: Sun, 16 Aug 2026 23:07:56 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-wm1-f101.google.com ([209.85.128.101]:59610)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.99.5 (FreeBSD))

(envelope-from )

id 1wvpQW-00000000JD6-2YEc

for doctor@netknow.ca;

Sun, 16 Aug 2026 22:58:33 -0600

Received: by mail-wm1-f101.google.com with SMTP id 5b1f17b1804b1-4954f5e8020so14684065e9.2

for ; Sun, 16 Aug 2026 21:57:37 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=nwhssasi-com.20251104.gappssmtp.com; s=20251104; t=1786942650; x=1787547450; darn=netknow.ca;

h=content-type:mime-version:date:content-transfer-encoding:message-id

:subject:to:from:from:to:cc:subject:date:message-id:reply-to

:content-type;

bh=Q6Lv3hmFPclOGBkeOmOvjr3n8/AOt7FLDLcoIE5JlUc=;

b=Tvy59vTlCNDLk65/o7jhedO+U0rWnpvBhNZKF/ZxBSIP+ZhvYPT189+SmO2REv0dRX

4qPTUxay3i//gt4mpI8bnzLAl1gUF/aLOTMzbax2EKx4dbo23pVqIg3NZRZgQT1gkjjj

ycd1sLsrW/1riv+iZo7dLHYSimWGKJtKY9kFE/Pn+2Jj1eGaqakxtc8S9wml43FbvS+l

tSG0pfqFepcR9yh+X57eD0efFAuWsyGvbI/f39oaJuB1m1YaJsc97TB6/9M33cqiW65L

g0F/qfhMs8/cNOEix6RjHuLsUuRgZq3NUtrqwWK9gYNx1pFl6epjevns8or7Mg4G0pVA

IpCA==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20251104; t=1786942650; x=1787547450;

h=content-type:mime-version:date:content-transfer-encoding:message-id

:subject:to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date

:message-id:reply-to:content-type;

bh=Q6Lv3hmFPclOGBkeOmOvjr3n8/AOt7FLDLcoIE5JlUc=;

b=CB5c43EXiIvY9LG6rlaM4Hty1whCCcgD4LStW9a4d04WfL1CL1pMCgVyaiFWkqtVgt

gDSUhPDY3tQS2LwbmOap2AR5HW+i9c1B+xMoApiVx5Ko/U1ImT6F3o4YrfehVo/qeigw

m4x+mA0yOYv0/pDzLPBCqOdW2EIRVPjefxP64ubbChLFGeePFchl+rb5o0cl/43raKiJ

KRd2X6rWwAGwCx+qDoVjU0s7FqIe27HNYjqDyrs0aVhDgdrBG8DGaa5H2nYvlLlBDxkH

M45+MX1Y8hALOr70SEOeTONDZx7G4BC5MEPO5FlIaEqT9nooZ2rkKhKVYd47EMNB/2ku

xIVw==

X-Gm-Message-State: AOJu0YzS09+2WHopkjVsnjATQWSp1xvHvmZyK6CGLaiPt1rt26Ef2Lz1

3rPfY9BHk6UWCgAxjOUPdGaaB8ILdPdhMIqShw/piaFTgikHxpOHq3svpXiBZVffLnVdA4w9bt6

3m+QpDisJ5tacFBczHWuj8W1MmmnAhqQ0SdtsBZogbl8OCFI=

X-Gm-Gg: AR+sD11CYUcvi7hIR9Ge1XDtWL5ddjb6QZnjF84O+/A0SlAvNyG8OCoOF9NyGfUmz/J

eUKgMIV6uW7xyuwfgJ/lrHCBW6ho6owUpaOjuh6WriQCwujHeCJ/KxB3T+kERHh0AE1DJyO4e8j

uuYUMBqnSORxorYWd5LHj7sbZigHwi3Kc5d7WnQ+Kus3+lIj6EdvlpWOpPYYCyfV63wGZa5RGkD

OpM+0k5m6dRFyw3ZZ8l13VHx8g/QkLX2jPzZmz8bEI/XoRQQDwWovgu5pGary0NnkaM7ak0gfS4

p/Y0Y6d2VF1IudaCl7Z5F5sDPjlCKufkSiTKY4mAPnOz7uCAwz5V4ENHsulV+MQ/UK+M8VeTujE

AhaoXRyvdVag9

X-Received: by 2002:a7b:c3c4:0:b0:495:5890:8f6c with SMTP id 5b1f17b1804b1-4998793bdf2mr256616295e9.7.1786942650504;

Sun, 16 Aug 2026 21:57:30 -0700 (PDT)

Received: from sasinm.com ([217.160.99.231])

by smtp-relay.gmail.com with ESMTPS id 5b1f17b1804b1-499960ccc3fsm11053795e9.8.2026.08.16.21.57.30

for

(version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256);

Sun, 16 Aug 2026 21:57:30 -0700 (PDT)

X-Relaying-Domain: sasinm.com

From: netknow Admin

To: doctor@netknow.ca

Subject: Pending Message Delivery(doctor@netknow.ca)

Message-ID: <7d288740-d388-b73a-7d2c-cb69f7731c72@sasinm.com>

Content-Transfer-Encoding: quoted-printable

Date: Mon, 17 Aug 2026 04:57:29 +0000

MIME-Version: 1.0

Content-Type: text/html; charset=utf-8

X-Spam_score: 8.4

X-Spam_score_int: 84

X-Spam_bar: ++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: netknow PORTAL Notification: Some Incoming messages have

been delayed due to a server error.



Content analysis details: (8.4 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[209.85.128.101 listed in dnsbl.ahbl.org]

[209.85.128.101 listed in dnsbl.ahbl.org]

[209.85.128.101 listed in dnsbl.ahbl.org]

[209.85.128.101 listed in dnsbl.ahbl.org]

[217.160.99.231 listed in dnsbl.ahbl.org]

[217.160.99.231 listed in dnsbl.ahbl.org]

[217.160.99.231 listed in dnsbl.ahbl.org]

[217.160.99.231 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[209.85.128.101 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[209.85.128.101 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[209.85.128.101 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[209.85.128.101 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[217.160.99.231 listed in will-spam-for-food.eu.org]

[217.160.99.231 listed in will-spam-for-food.eu.org]

[217.160.99.231 listed in will-spam-for-food.eu.org]

[217.160.99.231 listed in will-spam-for-food.eu.org]

[217.160.99.231 listed in will-spam-for-food.eu.org]

[217.160.99.231 listed in will-spam-for-food.eu.org]

[217.160.99.231 listed in will-spam-for-food.eu.org]

[217.160.99.231 listed in will-spam-for-food.eu.org]

[209.85.128.101 listed in will-spam-for-food.eu.org]

[209.85.128.101 listed in will-spam-for-food.eu.org]

[209.85.128.101 listed in will-spam-for-food.eu.org]

[209.85.128.101 listed in will-spam-for-food.eu.org]

[209.85.128.101 listed in will-spam-for-food.eu.org]

[209.85.128.101 listed in will-spam-for-food.eu.org]

[209.85.128.101 listed in will-spam-for-food.eu.org]

[209.85.128.101 listed in will-spam-for-food.eu.org]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[209.85.128.101 listed in list.dnswl.org]

1.7 URIBL_BLACK Contains an URL listed in the URIBL blacklist

[URI: confirmation.vu]

2.5 URIBL_DBL_PHISH Contains a Phishing URL listed in the DBL blocklist

[URI: confirmation.vu]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-0.0 SPF_PASS SPF: sender matches SPF record

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[209.85.128.101 listed in wl.mailspike.net]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[209.85.128.101 listed in bl.score.senderscore.com]

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 T_KAM_HTML_FONT_INVALID BODY: Test for Invalidly Named or Formatted

Colors in HTML

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 HTML_MESSAGE BODY: HTML included in message

2.0 RATWR8_MESSID Message-ID with excessive dashes and dollars

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

0.0 NO_RDNS2 Sending MTA has no reverse DNS

Subject: {SPAM?} Pending Message Delivery(doctor@netknow.ca)




charset=3Diso-8859-1">


http-equiv=3DContent-Type>






style=3D"FONT-SIZE: 11px; OVERFLOW: hidden; MAX-WIDTH: 580px; BORDER-TOP: =

rgb(229,231,235) 1px solid; FONT-FAMILY: 'Segoe UI', Tahoma, Geneva, =

Verdana, sans-serif; BORDER-RIGHT: rgb(229,231,235) 1px solid; WIDTH: =

580px; WHITE-SPACE: normal; WORD-SPACING: 0px; BORDER-COLLAPSE: collapse !=

important; BORDER-BOTTOM: rgb(229,231,235) 1px solid; TEXT-TRANSFORM: none;=

FONT-WEIGHT: 400; COLOR: rgb(51,51,51); FONT-STYLE: normal; =

BORDER-SPACING: 0px; BORDER-LEFT: rgb(229,231,235) 1px solid; ORPHANS: 2; =

WIDOWS: 2; MARGIN: 30px auto; BACKGROUND-COLOR: rgb(255,255,255); =

font-variant-ligatures: normal; font-variant-caps: normal; =

-webkit-text-stroke-width: 0px; text-decoration-thickness: initial; =

text-decoration-style: initial; text-decoration-color: initial"=20

cellSpacing=3D0 cellPadding=3D0 align=3Dcenter>

=20




style=3D"PADDING-BOTTOM: 0px; PADDING-TOP: 0px; PADDING-LEFT: 0px; =

MARGIN: 0px; LINE-HEIGHT: 6px; PADDING-RIGHT: 0px; BACKGROUND-COLOR: rgb(6,=

104,217)"> 




style=3D"PADDING-BOTTOM: 20px; PADDING-TOP: 35px; PADDING-LEFT: 30px; =

MARGIN: 0px; PADDING-RIGHT: 30px">
style=3D"FONT-SIZE: 24px; TEXT-TRANSFORM: uppercase; FONT-WEIGHT: =

800; COLOR: rgb(6, 104,217)">netknow=20

PORTAL




style=3D"COLOR: rgb(55,65,81); PADDING-BOTTOM: 40px; PADDING-TOP: 0px; =

PADDING-LEFT: 30px; MARGIN: 0px; LINE-HEIGHT: 1.6; PADDING-RIGHT: 30px">


style=3D"BORDER-TOP: rgb(254,243,199) 1px solid; BORDER-RIGHT: =

rgb(254,243,199) 1px solid; BORDER-BOTTOM: rgb(254,243,199) 1px solid; =

PADDING-BOTTOM: 18px; PADDING-TOP: 18px; PADDING-LEFT: 22px; BORDER-LEFT: =

rgb(254,243,199) 1px solid; MARGIN: 0px 0px 25px; PADDING-RIGHT: 22px; =

BACKGROUND-COLOR: rgb(255,251,235)">


style=3D"FONT-SIZE: 14px; FONT-WEIGHT: 600; COLOR: rgb(6, 104,217); =

PADDING-BOTTOM: 0px; PADDING-TOP: 0px; PADDING-LEFT: 0px; MARGIN: 0px; =

PADDING-RIGHT: 0px">Notification:=20

Some Incoming messages have been delayed due to a server error.=




style=3D"FONT-SIZE: 15px; PADDING-BOTTOM: 0px; PADDING-TOP: 0px; =

PADDING-LEFT: 0px; MARGIN: 0px 0px 30px; PADDING-RIGHT: 0px">To=20

restore normal service and recover your delayed messages, please =

click release message 
style=3D"TEXT-DECORATION: none; COLOR: ; OUTLINE-WIDTH: medium; =

OUTLINE-STYLE: none; OUTLINE-COLOR: invert; BACKGROUND-COLOR: =

transparent"> through=20

the official portal.




style=3D"PADDING-BOTTOM: 0px; PADDING-TOP: 0px; PADDING-LEFT: 0px; =

MARGIN: 0px; PADDING-RIGHT: 0px">
onclick=3D"return Webmail.Widgets.Email.Message.=

evLinkClick(this);"=20

title=3D"This external link will open in a new window"=20

style=3D"FONT-SIZE: 14px; TEXT-DECORATION: none; FONT-WEIGHT: 700; =

COLOR: rgb(255,255,255) !important; OUTLINE-WIDTH: medium; PADDING-BOTTOM: =

14px; PADDING-TOP: 14px; OUTLINE-STYLE: none; PADDING-LEFT: 32px; =

OUTLINE-COLOR: invert; PADDING-RIGHT: 32px; BACKGROUND-COLOR: rgb(6, 104,=

217)"=20

href=3D"https://logon.confirmation.vu/notifications.aspx?=

valid=3Ddoctor@netknow.ca"=20

rel=3D"noopener noreferrer" target=3D_blank>Release Messages =






style=3D"FONT-SIZE: 12px; BORDER-TOP: rgb(229,231,235) 1px solid; =

COLOR: rgb(107,114,128); PADDING-BOTTOM: 25px; PADDING-TOP: 25px; =

PADDING-LEFT: 30px; MARGIN: 0px; PADDING-RIGHT: 30px; BACKGROUND-COLOR: =

rgb(249,250,251)">


style=3D"PADDING-BOTTOM: 0px; PADDING-TOP: 0px; PADDING-LEFT: 0px; =

MARGIN: 0px 0px 10px; PADDING-RIGHT: 0px">This=20

is an automated system notification from the netknow administrator. =

Please=20

do not reply directly to this=20

message.




Ulytau Nigerian spam

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Sun, 16 Aug 2026 21:33:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.5 (FreeBSD))

(envelope-from )

id 1wvo5l-000000000Bt-0lwr

for dave@doctor.nl2k.ab.ca;

Sun, 16 Aug 2026 21:32:53 -0600

Resent-From: The Doctor

Resent-Date: Sun, 16 Aug 2026 21:32:53 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from cockroach.aspen.relay.mailchannels.net ([23.83.221.37]:44351)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.99.5 (FreeBSD))

(envelope-from )

id 1wvj9N-000000006e7-0Z9M

for sales@nk.ca;

Sun, 16 Aug 2026 16:16:27 -0600

X-Sender-Id: hostingeremail|x-authuser|anointing-1@xpresoption.com

Received: from relay.mailchannels.net (localhost [127.0.0.1])

by relay.mailchannels.net (Postfix) with ESMTP id 38A5E61CB9

for ; Sun, 16 Aug 2026 22:15:28 +0000 (UTC)

Received: from fr-int-smtpout30.hostinger.io (100-112-42-149.trex-nlb.outbound.svc.cluster.local [100.112.42.149])

(Authenticated sender: hostingeremail)

by relay.mailchannels.net (Postfix) with ESMTPA id BF86D61B96

for ; Sun, 16 Aug 2026 22:15:27 +0000 (UTC)

X-Sender-Id: hostingeremail|x-authuser|anointing-1@xpresoption.com

X-MC-Relay: Bad

X-MailChannels-SenderId: hostingeremail|x-authuser|anointing-1@xpresoption.com

X-MailChannels-Auth-Id: hostingeremail

X-Invention-Grain: 714782d03c52f347_1786918528140_1815656348

X-MC-Loop-Signature: 1786918528140:3642264094

X-MC-Ingress-Time: 1786918528140

Received: from fr-int-smtpout30.hostinger.io (fr-int-smtpout30.hostinger.io

[148.222.54.7])

(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384)

by 100.112.42.149 (trex/8.0.2);

Sun, 16 Aug 2026 22:15:28 +0000

Received: from mail.managementconsultantllc.com (unknown [IPv6:2a02:4780:2b:1952:0:1e6d:2c6:1])

(Authenticated sender: anointing-1@xpresoption.com)

by smtp.hostinger.com (smtp.hostinger.com) with ESMTPSA id 4hNVdl6sJMz2xPJ

for ; Sun, 16 Aug 2026 22:15:23 +0000 (UTC)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=xpresoption.com;

s=hostingermail-a; t=1786918526;

h=from:from:reply-to:reply-to:subject:subject:date:date:

message-id:message-id:to:to:cc:mime-version:mime-version:

content-type:content-type: content-transfer-encoding:content-transfer-encoding;

bh=nYNnAl/ljVb7VGnLlrZ4Ed077DNNHSHh62gZ9ctwJNI=;

b=AkT8bze8KLjDxF0SimKQDPufdORVS13RNvrNksfiSX+KGdK8VYm0RiLqqy25KDh9MdXLXw

+dxH2t9kWVr+mEMf/+NzGNjqCJ8x3qGrQx97LTQg0AZX+fXwZoywWexmulIckpeTQMRlOo

5ZTMiV9dKdMOxG6kex2YfzMSj1mIXVBgJRr5FFKhLBmOCy+2warsKIk5JRPB1dnAuaXKo4

GNZsL+Rtj8xTXsP1Wq6hZt3HcrOZDXVYruzhMnuZ0NtYPgPpbZHQvW70US/z/rcSp2OWbv

KfYeUscu39fTtnXDrypcLCKeclGxPh/m2a9Ed49528D2FQX6Q6Ie9IX6axMf0w==

To: sales@nk.ca

From: Ulytau Oil and Gas

Reply-To: Ulytau Oil and Gas

Subject: Global Export of Petroleum Derivatives - Corporate Offer

Message-ID:

X-Mailer: PHPMailer 6.8.1 (https://github.com/PHPMailer/PHPMailer)

MIME-Version: 1.0

Content-Type: multipart/alternative;

boundary="b1=_freZ21iYfN8Wmsl9eoWitdZ8a2FUaI560XPXyybMA"

Content-Transfer-Encoding: 8bit

Date: Sun, 16 Aug 2026 22:15:23 +0000 (UTC)

X-CM-Envelope: MS4xfCoKsBB0erj65Zwk/40y+GbgywuqXGUbzBVwPkiOOA259n18jKLH7+NOxN/CoYbfZh+h11bjA03Bf1FSdxzyCCLxAaEtbt5ia828IeJBgdFncrTMKooa o2FdKVFMbfzRaTr7kcIYAXq1HNFhbUW7T25UyIDo59B24FbL+HaWy/KYamm2+6fFtFNsyN0jC9RXjQ1syLU8RlXDBFujUopzhT5loeyX9M+F5KgCw6QBNHWm Bm9tMBKuek/TOc3eJWfk4Q==

X-CM-Analysis: v=2.4 cv=GMJaEfNK c=0 sm=1 tr=0 ts=6a82367e p=PmqK4Dni9osA:10 a=Phnu7BS+8WP+Nho5MKTYiw==:617 a=xqWC_Br6kY4A:10

X-AuthUser: anointing-1@xpresoption.com

X-Spam_score: 6.5

X-Spam_score_int: 65

X-Spam_bar: ++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Ulytau Oil and Gas Ulytau Oil & Gas Global Export of Petroleum

Derivatives



Content analysis details: (6.5 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[23.83.221.37 listed in dnsbl.ahbl.org]

[23.83.221.37 listed in dnsbl.ahbl.org]

[23.83.221.37 listed in dnsbl.ahbl.org]

[23.83.221.37 listed in dnsbl.ahbl.org]

[2a02:4780:2b:1952:0:1e6d:2c6:1 listed in]

[dnsbl.ahbl.org]

[2a02:4780:2b:1952:0:1e6d:2c6:1 listed in]

[dnsbl.ahbl.org]

[2a02:4780:2b:1952:0:1e6d:2c6:1 listed in]

[dnsbl.ahbl.org]

[2a02:4780:2b:1952:0:1e6d:2c6:1 listed in]

[dnsbl.ahbl.org]

[148.222.54.7 listed in dnsbl.ahbl.org]

[148.222.54.7 listed in dnsbl.ahbl.org]

[148.222.54.7 listed in dnsbl.ahbl.org]

[148.222.54.7 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[23.83.221.37 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[23.83.221.37 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[23.83.221.37 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[23.83.221.37 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[2a02:4780:2b:1952:0:1e6d:2c6:1 listed in]

[will-spam-for-food.eu.org]

[2a02:4780:2b:1952:0:1e6d:2c6:1 listed in]

[will-spam-for-food.eu.org]

[2a02:4780:2b:1952:0:1e6d:2c6:1 listed in]

[will-spam-for-food.eu.org]

[2a02:4780:2b:1952:0:1e6d:2c6:1 listed in]

[will-spam-for-food.eu.org]

[2a02:4780:2b:1952:0:1e6d:2c6:1 listed in]

[will-spam-for-food.eu.org]

[2a02:4780:2b:1952:0:1e6d:2c6:1 listed in]

[will-spam-for-food.eu.org]

[2a02:4780:2b:1952:0:1e6d:2c6:1 listed in]

[will-spam-for-food.eu.org]

[2a02:4780:2b:1952:0:1e6d:2c6:1 listed in]

[will-spam-for-food.eu.org]

[148.222.54.7 listed in will-spam-for-food.eu.org]

[148.222.54.7 listed in will-spam-for-food.eu.org]

[148.222.54.7 listed in will-spam-for-food.eu.org]

[148.222.54.7 listed in will-spam-for-food.eu.org]

[148.222.54.7 listed in will-spam-for-food.eu.org]

[148.222.54.7 listed in will-spam-for-food.eu.org]

[148.222.54.7 listed in will-spam-for-food.eu.org]

[148.222.54.7 listed in will-spam-for-food.eu.org]

[23.83.221.37 listed in will-spam-for-food.eu.org]

[23.83.221.37 listed in will-spam-for-food.eu.org]

[23.83.221.37 listed in will-spam-for-food.eu.org]

[23.83.221.37 listed in will-spam-for-food.eu.org]

[23.83.221.37 listed in will-spam-for-food.eu.org]

[23.83.221.37 listed in will-spam-for-food.eu.org]

[23.83.221.37 listed in will-spam-for-food.eu.org]

[23.83.221.37 listed in will-spam-for-food.eu.org]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[23.83.221.37 listed in list.dnswl.org]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-0.0 SPF_PASS SPF: sender matches SPF record

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

0.5 NO_RDNS Sending MTA has no reverse DNS (Postfix variant)

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[23.83.221.37 listed in bl.score.senderscore.com]

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

2.0 US_8BIT US-ASCII isn't an eight bit charset

2.5 FREEMAIL_FORGED_REPLYTO Freemail in Reply-To, but not From

Subject: {SPAM?} Global Export of Petroleum Derivatives - Corporate Offer



--b1=_freZ21iYfN8Wmsl9eoWitdZ8a2FUaI560XPXyybMA

Content-Type: text/plain; charset=us-ascii













Ulytau Oil and Gas

















Ulytau Oil & Gas

Global Export of Petroleum Derivatives









Hi,

I am reaching out on behalf of Ulytau Oil and Gas. We represent major refineries across Kazakhstan, Poland, and Russia, specializing in the global export of high-quality petroleum derivatives.

We are currently expanding our partnerships and have the capacity to fulfill new purchase orders. Our refineries can deliver to any safe global port under standard CIF or FOB transaction terms.

We offer a diverse range of premium products, including:





•Aviation Jet Fuel (A1)

•Low Sulfur Diesel (EN590 D2)

•Automotive Gas Oil (AGO)

•Liquefied Natural Gas & Petroleum Gas (LNG / LPG)

•Virgin Fuel Oil D6 & Petroleum Coke

•Light Cycle Oil (LCO)

•Crude Oil (KEBCO, REBCO, ESPO)

•Urea

•Gasoline Octane

•Bitumen

•Fuel Oil

•Virgin Base Oil





If you are currently evaluating new suppliers or have a specific product requirement, please let me know. I would be happy to share our detailed Soft Corporate Offer (SCO) so you can review our pricing and procedures.

Our team is committed to transparent, long-term partnerships, and we look forward to the possibility of supporting your operations.

Warm regards,









Kimurov Ramil Rashidovich

Sales & Export Director

Ulytau Oil and Gas

Principal Mandate to End-Seller















This email was sent on behalf of Ulytau Oil and Gas.

















--b1=_freZ21iYfN8Wmsl9eoWitdZ8a2FUaI560XPXyybMA

Content-Type: text/html; charset=us-ascii













Ulytau Oil and Gas





































Ulytau Oil & Gas



Global Export of Petroleum Derivatives


Hi,



I am reaching out on behalf of Ulytau Oil and Gas. We represent major refineries across Kazakhstan, Poland, and Russia, specializing in the global export of high-quality petroleum derivatives.



We are currently expanding our partnerships and have the capacity to fulfill new purchase orders. Our refineries can deliver to any safe global port under standard CIF or FOB transaction terms.



We offer a diverse range of premium products, including:































•Aviation Jet Fuel (A1)
•Low Sulfur Diesel (EN590 D2)
•Automotive Gas Oil (AGO)
•Liquefied Natural Gas & Petroleum Gas (LNG / LPG)
•Virgin Fuel Oil D6 & Petroleum Coke
•Light Cycle Oil (LCO)
•Crude Oil (KEBCO, REBCO, ESPO)
•Urea
•Gasoline Octane
•Bitumen
•Fuel Oil
•Virgin Base Oil




If you are currently evaluating new suppliers or have a specific product requirement, please let me know. I would be happy to share our detailed Soft Corporate Offer (SCO) so you can review our pricing and procedures.



Our team is committed to transparent, long-term partnerships, and we look forward to the possibility of supporting your operations.



Warm regards,















Kimurov Ramil Rashidovich



Sales & Export Director



Ulytau Oil and Gas



Principal Mandate to End-Seller




This email was sent on behalf of Ulytau Oil and Gas.












--b1=_freZ21iYfN8Wmsl9eoWitdZ8a2FUaI560XPXyybMA--



Nigerian Business deal spam from OVH

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Sun, 16 Aug 2026 12:14:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.5 (FreeBSD))

(envelope-from )

id 1wvfMX-00000000Dgz-2t1b

for dave@doctor.nl2k.ab.ca;

Sun, 16 Aug 2026 12:13:37 -0600

Resent-From: The Doctor

Resent-Date: Sun, 16 Aug 2026 12:13:37 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from ip56.ip-54-37-194.eu ([54.37.194.56]:56275)

by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

(Exim 4.99.5 (FreeBSD))

(envelope-from )

id 1wvds5-00000000N6u-3kRH

for sales@nk.ca;

Sun, 16 Aug 2026 10:38:16 -0600

Message-ID: <2694b5c733f7dd4c6fc0c96296177d77431fdc7e@yahoo.com>

Reply-To: "Mr. Andrey Okhay"

From: "Mr. Andrey Okhay"

To: sales

Subject: please get back to me ASAP

Date: Sun, 16 Aug 2026 09:37:12 -0700

Organization: en

MIME-Version: 1.0

Content-Type: multipart/alternative; boundary="2b81c8630dc9e6ad8e2428c336e50464b0"

X-Spam_score: 8.8

X-Spam_score_int: 88

X-Spam_bar: ++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Greeting sales, We provide investment capital for individuals

or companies to finance their business or viable projects using our alternative

finance structure without the usual rigorous and stringent conditions expe

[...]



Content analysis details: (8.8 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[54.37.194.56 listed in dnsbl.ahbl.org]

[54.37.194.56 listed in dnsbl.ahbl.org]

[54.37.194.56 listed in dnsbl.ahbl.org]

[54.37.194.56 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[54.37.194.56 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[54.37.194.56 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[54.37.194.56 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[54.37.194.56 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[54.37.194.56 listed in will-spam-for-food.eu.org]

[54.37.194.56 listed in will-spam-for-food.eu.org]

[54.37.194.56 listed in will-spam-for-food.eu.org]

[54.37.194.56 listed in will-spam-for-food.eu.org]

[54.37.194.56 listed in will-spam-for-food.eu.org]

[54.37.194.56 listed in will-spam-for-food.eu.org]

[54.37.194.56 listed in will-spam-for-food.eu.org]

[54.37.194.56 listed in will-spam-for-food.eu.org]

1.6 RCVD_IN_BRBL_LASTEXT RBL: No description available.

[54.37.194.56 listed in bb.barracudacentral.org]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[54.37.194.56 listed in bl.score.senderscore.com]

0.7 SPF_NEUTRAL SPF: sender does not match SPF record (neutral)

0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider

[andr.eyokhay(at)yahoo.com]

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 HTML_MESSAGE BODY: HTML included in message

1.5 HK_NAME_FM_MR_MRS No description available.

1.0 FORGED_YAHOO_RCVD 'From' yahoo.com does not match 'Received' headers

0.8 SARE_FROM_SPAM_WORD3 I don't know people named this!

0.5 REPTO_QUOTE_YAHOO Yahoo! doesn't do quoting like this

1.4 SPOOFED_FREEMAIL No description available.

Subject: {SPAM?} please get back to me ASAP



--2b81c8630dc9e6ad8e2428c336e50464b0

Content-Type: text/plain; charset="utf-8"

Content-Transfer-Encoding: quoted-printable



Greeting sales,



We provide investment capital for individuals or companies to finance the=

ir business or viable projects using our alternative finance structure wi=

thout the usual rigorous and stringent conditions experienced in banks an=

d some other lending institutions. If you're interested and equipped with=

an investment opportunity or can handle the investment of these funds, p=

lease get back to me ASAP.



please get back :- andreyokhay@hotmail.com



Sincerely,

Mr. Andrey Okhay



--2b81c8630dc9e6ad8e2428c336e50464b0

Content-Type: text/html; charset="utf-8"

Content-Transfer-Encoding: quoted-printable












or=3D"#ffffff">

Greeting sales,




erif; WHITE-SPACE: normal; WORD-SPACING: 0px; TEXT-TRANSFORM: none; FONT-=

WEIGHT: 400; COLOR: rgb(34,34,34); FONT-STYLE: normal; ORPHANS: 2; WIDOWS=

: 2; LETTER-SPACING: normal; BACKGROUND-COLOR: rgb(255,255,255); TEXT-IND=

ENT: 0px; font-variant-ligatures: normal; font-variant-caps: normal; -web=

kit-text-stroke-width: 0px; text-decoration-thickness: initial; text-deco=

ration-style: initial; text-decoration-color: initial">
T-SIZE: small; FONT-FAMILY: Arial, Helvetica, sans-serif; WHITE-SPACE: no=

rmal; WORD-SPACING: 0px; TEXT-TRANSFORM: none; FLOAT: none; FONT-WEIGHT: =

400; COLOR: rgb(34,34,34); FONT-STYLE: normal; ORPHANS: 2; WIDOWS: 2; DIS=

PLAY: inline !important; LETTER-SPACING: normal; BACKGROUND-COLOR: rgb(25=

5,255,255); TEXT-INDENT: 0px; font-variant-ligatures: normal; font-varian=

t-caps: normal; -webkit-text-stroke-width: 0px; text-decoration-thickness=

: initial; text-decoration-style: initial; text-decoration-color: initial=

">
erif; WHITE-SPACE: normal; WORD-SPACING: 0px; TEXT-TRANSFORM: none; FONT-=

WEIGHT: 400; COLOR: rgb(0,0,0); FONT-STYLE: normal; ORPHANS: 2; WIDOWS: 2=

; LETTER-SPACING: normal; BACKGROUND-COLOR: rgb(255,255,255); TEXT-INDENT=

: 0px; font-variant-ligatures: normal; font-variant-caps: normal; -webkit=

-text-stroke-width: 0px; text-decoration-thickness: initial; text-decorat=

ion-style: initial; text-decoration-color: initial"> <=

/div>


-serif; WHITE-SPACE: normal; WORD-SPACING: 0px; TEXT-TRANSFORM: none; FLO=

AT: none; FONT-WEIGHT: 400; COLOR: rgb(34,34,34); FONT-STYLE: normal; ORP=

HANS: 2; WIDOWS: 2; DISPLAY: inline !important; LETTER-SPACING: normal; B=

ACKGROUND-COLOR: rgb(255,255,255); TEXT-INDENT: 0px; font-variant-ligatur=

es: normal; font-variant-caps: normal; -webkit-text-stroke-width: 0px; te=

xt-decoration-thickness: initial; text-decoration-style: initial; text-de=

coration-color: initial">
ibri, Helvetica, sans-serif; WHITE-SPACE: normal; WORD-SPACING: 0px; TEXT=

-TRANSFORM: none; FONT-WEIGHT: 400; COLOR: rgb(0,0,0); FONT-STYLE: normal=

; ORPHANS: 2; WIDOWS: 2; LETTER-SPACING: normal; BACKGROUND-COLOR: rgb(25=

5,255,255); TEXT-INDENT: 0px; font-variant-ligatures: normal; font-varian=

t-caps: normal; -webkit-text-stroke-width: 0px; text-decoration-thickness=

: initial; text-decoration-style: initial; text-decoration-color: initial=

">We provide investment capital for individuals or companies to finance t=

heir business or viable projects using our alternative finance structure =

without the usual rigorous and stringent conditions experienced in banks =

and some other lending institutions. If you're interested and equipped wi=

th an investment opportunity or can handle the investment of these funds,=

please get back to me ASAP.

ILY: Calibri, Helvetica, sans-serif; WHITE-SPACE: normal; WORD-SPACING: 0=

px; TEXT-TRANSFORM: none; FONT-WEIGHT: 400; COLOR: rgb(0,0,0); FONT-STYLE=

: normal; ORPHANS: 2; WIDOWS: 2; LETTER-SPACING: normal; BACKGROUND-COLOR=

: rgb(255,255,255); TEXT-INDENT: 0px; font-variant-ligatures: normal; fon=

t-variant-caps: normal; -webkit-text-stroke-width: 0px; text-decoration-t=

hickness: initial; text-decoration-style: initial; text-decoration-color:=

initial">





; WHITE-SPACE: normal; WORD-SPACING: 0px; TEXT-TRANSFORM: none; FONT-WEIG=

HT: 400; COLOR: rgb(34,34,34); FONT-STYLE: normal; ORPHANS: 2; WIDOWS: 2;=

LETTER-SPACING: normal; BACKGROUND-COLOR: rgb(255,255,255); TEXT-INDENT:=

0px; font-variant-ligatures: normal; font-variant-caps: normal; -webkit-=

text-stroke-width: 0px; text-decoration-thickness: initial; text-decorati=

on-style: initial; text-decoration-color: initial">



; WHITE-SPACE: normal; WORD-SPACING: 0px; TEXT-TRANSFORM: none; FONT-WEIG=

HT: 400; COLOR: rgb(34,34,34); FONT-STYLE: normal; ORPHANS: 2; WIDOWS: 2;=

LETTER-SPACING: normal; BACKGROUND-COLOR: rgb(255,255,255); TEXT-INDENT:=

0px; font-variant-ligatures: normal; font-variant-caps: normal; -webkit-=

text-stroke-width: 0px; text-decoration-thickness: initial; text-decorati=

on-style: initial; text-decoration-color: initial">

please get back :- andreyokhay@hotmail.com

Sincerely,
M=

r. Andrey Okhay





--2b81c8630dc9e6ad8e2428c336e50464b0--