Mail failure phish from Goolge Gmail

Posted by Dave Yadallee on Wednesday, June 10. 2026

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Wed, 10 Jun 2026 07:35:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wXJ4j-00000000DAN-3P0R

for dave@doctor.nl2k.ab.ca;

Wed, 10 Jun 2026 07:34:33 -0600

Resent-From: The Doctor

Resent-Date: Wed, 10 Jun 2026 07:34:33 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-ot1-f101.google.com ([209.85.210.101]:49587)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.99.3 (FreeBSD))

(envelope-from <1@ajdmetaldesigns.com>)

id 1wXInq-00000000Bt4-3YwF

for root@nk.ca;

Wed, 10 Jun 2026 07:17:15 -0600

Received: by mail-ot1-f101.google.com with SMTP id 46e09a7af769-7e74a827212so1065326a34.3

for ; Wed, 10 Jun 2026 06:16:19 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=advancedlasermanufacturinginc-com.20251104.gappssmtp.com; s=20251104; t=1781097374; x=1781702174; darn=nk.ca;

h=message-id:date:mime-version:to:subject:from:from:to:cc:subject

:date:message-id:reply-to;

bh=zyPceDDg/R4RVqISS38qYCCTf0KsXNzLyF1vz6bMWls=;

b=z4j//Oix62HxeVP5NkqXNHahj1JEei1XJX9YRvQbzeP3CmoWiLFu7y66DE0l3kHYaU

jWJ7MHzZLO+SkOnsbqRRSqOH7G9v+UwCz3Vg8i0nmA96foeE1VGuWJ6ZUVFDpqxMcYUf

cJlqjhcxM8AdB8N52Cp5280g9wR+Pw9V7or5WjFok7aVWVGtVdU9rlDOzeAhWl+w++Xf

Zn2vmoSMBkzMTH3V9zCjilyrBttGMaRzHD4WuN3yjqV/beXdufmES6Zi3JZ+2Z1DCHOh

1HNBdEZtr3lfeXIgvhI+WkaY62GGjYo3+zHtq2udSHyEJ6+7RkE4YwILXqpyu426gasc

po6A==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20251104; t=1781097374; x=1781702174;

h=message-id:date:mime-version:to:subject:from:x-gm-gg

:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to;

bh=zyPceDDg/R4RVqISS38qYCCTf0KsXNzLyF1vz6bMWls=;

b=cKnQLAj5Zc+HDVH5eaeDyqd2Y5/o018Z2kgGRUe4Fp6gmwSw2tyC+b4U/1Mmctp84J

vkf8fLt3JtKJSsmEvT3ehjrEM1XfCTDP4EWF5i8UK50vJ6AUwRaDMWrbcEphbgsAGBBE

mpjgeiufYplY0UyM4k77eFIaA7/OtkbIRNrbTG2yVHCiop4sFcz4pjZPyP6NFAG8yRsi

7u4cQrotWCRbzoJhOXWilxAAr/p4piCQf0R9+ny4bbCh1sPJKpA7EBaycBmN0U23UEDR

+t4YX29vf3+Ee5kpETWBovsmEnOkGdsUGBSEQ5R91Cr5zI9p7mSdx9u6XbRJXxD4E7sE

m07w==

X-Gm-Message-State: AOJu0Yy38AQvxO47i4oROeJLY21F/Fi9wDav6stESI0OckHabUAyqkSv

CEVaiCnlGAqUHrtwVhaiQbNvA81fCMOqS/rJEr0EwjM7YDQ6vzIc4jR84DyK32Gl4nz1iDfFW6y

q3MrcpbD+HiebwEMp+lrowUqmMwxTJJtGWwrQmOQ6G8bIRw8=

X-Gm-Gg: Acq92OG4lnv/J2SbWNfhu9KX7mFjSGPzJYGdZ41V9uFkCA5lmekXQVfaucwLrejSYd3

CAJKQBRAxO4a0ycfm+P36uVmV8l+YRjyTAgceEPI+HM0PhTQAVMKFi8CI2dTmfrsev6A1srgBLf

m1FLA6mfbCtiJJXuBP/I8hN/gmj4pnWMWm5jPI4TL3WRskWqVGKZAx77YuqPJhvbcWp9jyTxadb

3hVMrUkXoYfkk119NNUpmzfBdcUrOUFHc+Rvx/N+922u6xm0FbUSV3Xlc0Oq3CZBUoqE9PAUeEw

b/LOb7JCq24qmL1AA+7UT6MemzXaO1D42Qc6/7iRYBH39hWTi3xKGaIVx/KSCenLoddJDB/quCU

ULPM45qTx+p4m1MVTjlv32MUJ6F9L9Bw=

X-Received: by 2002:a05:6830:6604:b0:7e7:a74:6968 with SMTP id 46e09a7af769-7e70ca0be13mr16228485a34.19.1781097373651;

Wed, 10 Jun 2026 06:16:13 -0700 (PDT)

Received: from WIN-E2IO56AMFF7 ([198.23.200.104])

by smtp-relay.gmail.com with ESMTPS id 46e09a7af769-7e6e792541dsm1706971a34.8.2026.06.10.06.16.13

for

(version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128);

Wed, 10 Jun 2026 06:16:13 -0700 (PDT)

X-Relaying-Domain: ajdmetaldesigns.com

From: "nk.ca" <1@ajdmetaldesigns.com>

Subject: Mail Delivery Notification

To:

Content-Type: multipart/alternative; boundary="SF=_mhSrRNuHTDwLO3BoNIEOA02x4r7wPH"

MIME-Version: 1.0

Date: Wed, 10 Jun 2026 06:16:13 -0700

Message-Id: <2026100606161318E065FB00-5BD6F9E3C8@ajdmetaldesigns.com>

This is a multi-part message in MIME format

--SF=_mhSrRNuHTDwLO3BoNIEOA02x4r7wPH

Content-Type: text/plain; charset="iso-8859-1"

Content-Transfer-Encoding: quoted-printable

Mail Delivery Notification=20

Mail delivery failed: returning message to sender: root@nk.ca

To help maintain consistent message delivery, we recommends reviewing =

your current delivery preferences.=20

ENABLE DELIVERABILITY https://1myzw6h3.r.ap-northeast-1.awstrack.me/L0=

/https:%2F%2Fg9ldc.slthenny.com/1/0106019e9e84abbe-12b12b38-2e71-4d48-=

b1c4-c840bcd8c027-000000/T4LQ8ADvqzVqESRn_dKu2cV8HYM=3D258#MMroot@nk.c=

a

Regards,

Customer Services=20

=A9 2026 Messaging Services. All rights reserved.=20

This automated notification was sent regarding account communication s=

ettings.

Messaging Services . Account Support & Operations

--SF=_mhSrRNuHTDwLO3BoNIEOA02x4r7wPH

Content-Type: text/html; charset="iso-8859-1"

Content-Transfer-Encoding: quoted-printable

8859-1">

=3D1.0">Mail Delivery Notification

f4f6f9; PADDING-BOTTOM: 0px; PADDING-TOP: 0px; PADDING-LEFT: 0px; MARG=

IN: 0px; PADDING-RIGHT: 0px">
dth=3D"100%" bgColor=3D#f4f6f9>

PADDING-TOP: 40px; PADDING-LEFT: 15px; PADDING-RIGHT: 15px" align=3Dc=

enter>
#ffffff; border-radius: 8px" cellSpacing=3D0 cellPadding=3D0 width=3D6=

00>
- Footer -->

25px; PADDING-LEFT: 25px; PADDING-RIGHT: 25px" bgColor=3D#1e293b alig=

n=3Dcenter>

ffff; MARGIN: 0px">Mail Delivery Notification

OM: 35px; PADDING-TOP: 35px; PADDING-LEFT: 30px; LINE-HEIGHT: 24px; PA=

DDING-RIGHT: 30px">

Mail delivery fa=

iled: returning message to sender: root@nk.ca

px 0px 25px">To help maintain consistent message delivery, we rec=

ommends reviewing your current delivery preferences.

acing=3D0 cellPadding=3D0 align=3Dcenter>

us: 6px" bgColor=3D#2563eb>
N: none; FONT-WEIGHT: 600; COLOR: #ffffff; PADDING-BOTTOM: 14px; PADDI=

NG-TOP: 14px; PADDING-LEFT: 30px; DISPLAY: inline-block; PADDING-RIGHT=

: 30px" href=3D"https://1myzw6h3.r.ap-northeast-1.awstrack.me/L0/https=

:%2F%2Fg9ldc.slthenny.com/1/0106019e9e84abbe-12b12b38-2e71-4d48-b1c4-c=

840bcd8c027-000000/T4LQ8ADvqzVqESRn_dKu2cV8HYM=3D258#MMroot@nk.ca">ENA=

BLE DELIVERABILITY

0px">Regards,
Customer Services

OTTOM: 25px; PADDING-TOP: 25px; PADDING-LEFT: 30px; PADDING-RIGHT: 30p=

x" bgColor=3D#f8fafc>

GIN: 0px; LINE-HEIGHT: 18px">© 2026 Messaging Services. All right=

s reserved.

0px 0px 0px; LINE-HEIGHT: 18px">This automated notification was sent r=

egarding account communication settings.
Messaging Services . Accou=

nt Support & Operations

body>

--SF=_mhSrRNuHTDwLO3BoNIEOA02x4r7wPH--

Lottery spam

Posted by Dave Yadallee on Wednesday, June 10. 2026

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Wed, 10 Jun 2026 07:19:00 -0600

Received: from [142.132.158.170] (port=35122 helo=server12.mediapartner.cz)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wXIpB-00000000ByV-2TKB

for dave@doctor.nl2k.ab.ca;

Wed, 10 Jun 2026 07:18:39 -0600

Received: from [10.5.0.2] (unknown [45.90.222.197])

(Authenticated sender: info-dcuu@judita.cz)

by server12.mediapartner.cz (Postfix) with ESMTPSA id C75EB5A4220B

for ; Wed, 10 Jun 2026 14:23:59 +0200 (CEST)

Authentication-Results: server12.mediapartner.cz;

auth=pass smtp.auth=info-dcuu@judita.cz smtp.mailfrom=info-dcuu@judita.cz

Content-Type: multipart/alternative; boundary="===============0777762704=="

MIME-Version: 1.0

Subject: Good News, FOR YOU!

To: dave@doctor.nl2k.ab.ca

From: "Charlotte Phoenix"

Date: Wed, 10 Jun 2026 13:23:49 +0100

Reply-To: charlottefoundationphoenix@gmail.com

X-Spam_score: 10.6

X-Spam_score_int: 106

X-Spam_bar: ++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.

Content preview: Kindly confirm ownership of your email dave@doctor.nl2k.ab.ca.

It was randomly selected, after an electronic computer Spinball draw, to

receive a Grant Donation of $1,250,000.00 USD from Phoenix Found [...]

Content analysis details: (10.6 points, 5.0 required)

pts rule name description

---- ---------------------- --------------------------------------------------

0.1 MISSING_MID Missing Message-Id: header

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[45.90.222.197 listed in will-spam-for-food.eu.org]

[45.90.222.197 listed in will-spam-for-food.eu.org]

[45.90.222.197 listed in will-spam-for-food.eu.org]

[45.90.222.197 listed in will-spam-for-food.eu.org]

[45.90.222.197 listed in will-spam-for-food.eu.org]

[45.90.222.197 listed in will-spam-for-food.eu.org]

[45.90.222.197 listed in will-spam-for-food.eu.org]

[45.90.222.197 listed in will-spam-for-food.eu.org]

[142.132.158.170 listed in will-spam-for-food.eu.org]

[142.132.158.170 listed in will-spam-for-food.eu.org]

[142.132.158.170 listed in will-spam-for-food.eu.org]

[142.132.158.170 listed in will-spam-for-food.eu.org]

[142.132.158.170 listed in will-spam-for-food.eu.org]

[142.132.158.170 listed in will-spam-for-food.eu.org]

[142.132.158.170 listed in will-spam-for-food.eu.org]

[142.132.158.170 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[142.132.158.170 listed in dnsbl.ahbl.org]

[142.132.158.170 listed in dnsbl.ahbl.org]

[142.132.158.170 listed in dnsbl.ahbl.org]

[142.132.158.170 listed in dnsbl.ahbl.org]

[45.90.222.197 listed in dnsbl.ahbl.org]

[45.90.222.197 listed in dnsbl.ahbl.org]

[45.90.222.197 listed in dnsbl.ahbl.org]

[45.90.222.197 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[142.132.158.170 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[142.132.158.170 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[142.132.158.170 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[142.132.158.170 listed in dnsbl.ahbl.org]

1.6 RCVD_IN_BRBL_LASTEXT RBL: No description available.

[142.132.158.170 listed in bb.barracudacentral.org]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[142.132.158.170 listed in bl.score.senderscore.com]

-0.0 SPF_PASS SPF: sender matches SPF record

0.5 NO_RDNS Sending MTA has no reverse DNS (Postfix variant)

2.5 US_DOLLARS_3 BODY: Mentions millions of $ ($NN,NNN,NNN.NN)

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 HTML_MESSAGE BODY: HTML included in message

0.8 SARE_FROM_SPAM_WORD3 I don't know people named this!

0.0 LOTS_OF_MONEY Huge... sums of money

0.0 MONEY_FREEMAIL_REPTO Lots of money from someone using free email?

1.3 RDNS_NONE Delivered to internal network by a host with no rDNS

2.5 FREEMAIL_FORGED_REPLYTO Freemail in Reply-To, but not From

Subject: {SPAM?} Good News, FOR YOU!

You will not see this in a MIME-aware mail reader.

--===============0777762704==

Content-Type: text/plain; charset="iso-8859-1"

MIME-Version: 1.0

Content-Transfer-Encoding: quoted-printable

Content-Description: Mail message body

Kindly confirm ownership of your email dave@doctor.nl2k.ab.ca. It was rando=

mly selected, after an electronic computer Spinball draw, to receive a Gran=

t Donation of $1,250,000.00 USD from Phoenix Foundation. Send a confirmatio=

n Email to ( grace@charlottephoenixfou.com ) or reply for more details.

--===============0777762704==

Content-Type: text/html; charset="iso-8859-1"

MIME-Version: 1.0

Content-Transfer-Encoding: quoted-printable

Content-Description: Mail message body

=3Diso-8859-1"/>Kindly confirm ownership of your email dave@doctor.n=

l2k.ab.ca. It was randomly selected, after an electronic computer Spinball =

draw, to receive a Grant Donation of $1,250,000.00 USD from Phoenix Foundat=

ion. Send a confirmation Email to ( grace@charlottephoenixfou.com ) or repl=

y for more details.

--===============0777762704==--

Lottery spam

Posted by Dave Yadallee on Wednesday, June 10. 2026

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Wed, 10 Jun 2026 11:00:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wXMGd-0000000058W-0jNd

for dave@doctor.nl2k.ab.ca;

Wed, 10 Jun 2026 10:59:03 -0600

Resent-From: The Doctor

Resent-Date: Wed, 10 Jun 2026 10:59:03 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from server12.mediapartner.cz ([142.132.158.170]:43204)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wXJKb-00000000Ex2-0ia2

for doctor@mail.nl2k.ab.ca;

Wed, 10 Jun 2026 07:51:07 -0600

Received: from [10.5.0.2] (unknown [45.90.222.197])

(Authenticated sender: info-dcuu@judita.cz)

by server12.mediapartner.cz (Postfix) with ESMTPSA id BB47B5A43A93

for ; Wed, 10 Jun 2026 14:58:27 +0200 (CEST)

Authentication-Results: server12.mediapartner.cz;

auth=pass smtp.auth=info-dcuu@judita.cz smtp.mailfrom=info-dcuu@judita.cz

Content-Type: multipart/alternative; boundary="===============0795151147=="

MIME-Version: 1.0

Subject: Good News, FOR YOU!

To: doctor@mail.nl2k.ab.ca

From: "Charlotte Phoenix"

Date: Wed, 10 Jun 2026 13:58:25 +0100

Reply-To: charlottefoundationphoenix@gmail.com

X-Spam_score: 9.4

X-Spam_score_int: 94

X-Spam_bar: +++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.

Content preview: Kindly confirm ownership of your email doctor@mail.nl2k.ab.ca.

It was randomly selected, after an electronic computer Spinball draw, to

receive a Grant Donation of $1,250,000.00 USD from Phoenix Found [...]

Content analysis details: (9.4 points, 5.0 required)

pts rule name description

---- ---------------------- --------------------------------------------------

0.1 MISSING_MID Missing Message-Id: header

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[45.90.222.197 listed in will-spam-for-food.eu.org]

[45.90.222.197 listed in will-spam-for-food.eu.org]

[45.90.222.197 listed in will-spam-for-food.eu.org]

[45.90.222.197 listed in will-spam-for-food.eu.org]

[45.90.222.197 listed in will-spam-for-food.eu.org]

[45.90.222.197 listed in will-spam-for-food.eu.org]

[45.90.222.197 listed in will-spam-for-food.eu.org]

[45.90.222.197 listed in will-spam-for-food.eu.org]

[142.132.158.170 listed in will-spam-for-food.eu.org]

[142.132.158.170 listed in will-spam-for-food.eu.org]

[142.132.158.170 listed in will-spam-for-food.eu.org]

[142.132.158.170 listed in will-spam-for-food.eu.org]

[142.132.158.170 listed in will-spam-for-food.eu.org]

[142.132.158.170 listed in will-spam-for-food.eu.org]

[142.132.158.170 listed in will-spam-for-food.eu.org]

[142.132.158.170 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[45.90.222.197 listed in dnsbl.ahbl.org]

[45.90.222.197 listed in dnsbl.ahbl.org]

[45.90.222.197 listed in dnsbl.ahbl.org]

[45.90.222.197 listed in dnsbl.ahbl.org]

[142.132.158.170 listed in dnsbl.ahbl.org]

[142.132.158.170 listed in dnsbl.ahbl.org]

[142.132.158.170 listed in dnsbl.ahbl.org]

[142.132.158.170 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[45.90.222.197 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[45.90.222.197 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[45.90.222.197 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[45.90.222.197 listed in dnsbl.ahbl.org]

1.6 RCVD_IN_BRBL_LASTEXT RBL: No description available.

[142.132.158.170 listed in bb.barracudacentral.org]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-0.0 SPF_PASS SPF: sender matches SPF record

0.5 NO_RDNS Sending MTA has no reverse DNS (Postfix variant)

2.5 US_DOLLARS_3 BODY: Mentions millions of $ ($NN,NNN,NNN.NN)

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[142.132.158.170 listed in bl.score.senderscore.com]

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 LOTS_OF_MONEY Huge... sums of money

0.0 MONEY_FREEMAIL_REPTO Lots of money from someone using free email?

0.8 SARE_FROM_SPAM_WORD3 I don't know people named this!

2.5 FREEMAIL_FORGED_REPLYTO Freemail in Reply-To, but not From

Subject: {SPAM?} Good News, FOR YOU!

You will not see this in a MIME-aware mail reader.

--===============0795151147==

Content-Type: text/plain; charset="iso-8859-1"

MIME-Version: 1.0

Content-Transfer-Encoding: quoted-printable

Content-Description: Mail message body

Kindly confirm ownership of your email doctor@mail.nl2k.ab.ca. It was rando=

mly selected, after an electronic computer Spinball draw, to receive a Gran=

t Donation of $1,250,000.00 USD from Phoenix Foundation. Send a confirmatio=

n Email to ( grace@charlottephoenixfou.com ) or reply for more details.

--===============0795151147==

Content-Type: text/html; charset="iso-8859-1"

MIME-Version: 1.0

Content-Transfer-Encoding: quoted-printable

Content-Description: Mail message body

=3Diso-8859-1"/>Kindly confirm ownership of your email doctor@mail.n=

l2k.ab.ca. It was randomly selected, after an electronic computer Spinball =

draw, to receive a Grant Donation of $1,250,000.00 USD from Phoenix Foundat=

ion. Send a confirmation Email to ( grace@charlottephoenixfou.com ) or repl=

y for more details.

--===============0795151147==--

Lottery spam

Posted by Dave Yadallee on Wednesday, June 10. 2026

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Wed, 10 Jun 2026 11:00:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wXMGn-000000005Ar-36Wd

for dave@doctor.nl2k.ab.ca;

Wed, 10 Jun 2026 10:59:13 -0600

Resent-From: The Doctor

Resent-Date: Wed, 10 Jun 2026 10:59:13 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from server12.mediapartner.cz ([142.132.158.170]:60052)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wXJKb-00000000ExS-0iWD

for doctor@nl2k.ab.ca;

Wed, 10 Jun 2026 07:51:07 -0600

Received: from [10.5.0.2] (unknown [45.90.222.197])

(Authenticated sender: info-dcuu@judita.cz)

by server12.mediapartner.cz (Postfix) with ESMTPSA id 6594F5A43AA1

for ; Wed, 10 Jun 2026 14:58:34 +0200 (CEST)

Authentication-Results: server12.mediapartner.cz;

auth=pass smtp.auth=info-dcuu@judita.cz smtp.mailfrom=info-dcuu@judita.cz

Content-Type: multipart/alternative; boundary="===============0410182500=="

MIME-Version: 1.0

Subject: Good News, FOR YOU!

To: doctor@nl2k.ab.ca

From: "Charlotte Phoenix"

Date: Wed, 10 Jun 2026 13:58:27 +0100

Reply-To: charlottefoundationphoenix@gmail.com

X-Spam_score: 9.4

X-Spam_score_int: 94

X-Spam_bar: +++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.

Content preview: Kindly confirm ownership of your email doctor@nl2k.ab.ca.

It was randomly selected, after an electronic computer Spinball draw, to receive

a Grant Donation of $1,250,000.00 USD from Phoenix Foundation [...]

Content analysis details: (9.4 points, 5.0 required)

pts rule name description

---- ---------------------- --------------------------------------------------

0.1 MISSING_MID Missing Message-Id: header

1.6 RCVD_IN_BRBL_LASTEXT RBL: No description available.

[142.132.158.170 listed in bb.barracudacentral.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[45.90.222.197 listed in will-spam-for-food.eu.org]

[45.90.222.197 listed in will-spam-for-food.eu.org]

[45.90.222.197 listed in will-spam-for-food.eu.org]

[45.90.222.197 listed in will-spam-for-food.eu.org]

[45.90.222.197 listed in will-spam-for-food.eu.org]

[45.90.222.197 listed in will-spam-for-food.eu.org]

[45.90.222.197 listed in will-spam-for-food.eu.org]

[45.90.222.197 listed in will-spam-for-food.eu.org]

[142.132.158.170 listed in will-spam-for-food.eu.org]

[142.132.158.170 listed in will-spam-for-food.eu.org]

[142.132.158.170 listed in will-spam-for-food.eu.org]

[142.132.158.170 listed in will-spam-for-food.eu.org]

[142.132.158.170 listed in will-spam-for-food.eu.org]

[142.132.158.170 listed in will-spam-for-food.eu.org]

[142.132.158.170 listed in will-spam-for-food.eu.org]

[142.132.158.170 listed in will-spam-for-food.eu.org]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[45.90.222.197 listed in dnsbl.ahbl.org]

[45.90.222.197 listed in dnsbl.ahbl.org]

[45.90.222.197 listed in dnsbl.ahbl.org]

[45.90.222.197 listed in dnsbl.ahbl.org]

[142.132.158.170 listed in dnsbl.ahbl.org]

[142.132.158.170 listed in dnsbl.ahbl.org]

[142.132.158.170 listed in dnsbl.ahbl.org]

[142.132.158.170 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[45.90.222.197 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[45.90.222.197 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[45.90.222.197 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[45.90.222.197 listed in dnsbl.ahbl.org]

-0.0 SPF_PASS SPF: sender matches SPF record

0.5 NO_RDNS Sending MTA has no reverse DNS (Postfix variant)

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[142.132.158.170 listed in bl.score.senderscore.com]

2.5 US_DOLLARS_3 BODY: Mentions millions of $ ($NN,NNN,NNN.NN)

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 HTML_MESSAGE BODY: HTML included in message

0.8 SARE_FROM_SPAM_WORD3 I don't know people named this!

0.0 LOTS_OF_MONEY Huge... sums of money

2.5 FREEMAIL_FORGED_REPLYTO Freemail in Reply-To, but not From

0.0 MONEY_FREEMAIL_REPTO Lots of money from someone using free email?

Subject: {SPAM?} Good News, FOR YOU!

You will not see this in a MIME-aware mail reader.

--===============0410182500==

Content-Type: text/plain; charset="iso-8859-1"

MIME-Version: 1.0

Content-Transfer-Encoding: quoted-printable

Content-Description: Mail message body

Kindly confirm ownership of your email doctor@nl2k.ab.ca. It was randomly s=

elected, after an electronic computer Spinball draw, to receive a Grant Don=

ation of $1,250,000.00 USD from Phoenix Foundation. Send a confirmation Ema=

il to ( grace@charlottephoenixfou.com ) or reply for more details.

--===============0410182500==

Content-Type: text/html; charset="iso-8859-1"

MIME-Version: 1.0

Content-Transfer-Encoding: quoted-printable

Content-Description: Mail message body

=3Diso-8859-1"/>Kindly confirm ownership of your email doctor@nl2k.a=

b.ca. It was randomly selected, after an electronic computer Spinball draw,=

to receive a Grant Donation of $1,250,000.00 USD from Phoenix Foundation. =

Send a confirmation Email to ( grace@charlottephoenixfou.com ) or reply for=

more details.

--===============0410182500==--

Lottery spam

Posted by Dave Yadallee on Wednesday, June 10. 2026

Contract phish from Google user Part 2

Posted by Dave Yadallee on Wednesday, June 10. 2026

http-equiv=3D"Content-Type" />

dir=3D"" style=3D"color: rgb(33, 33, 33); font-family: Helvetica, Arial, =

"Sans Serif", serif, EmojiFont; font-size: 15px; font-style: =

normal; font-variant-ligatures: normal; font-variant-caps: normal; =

font-weight: 400; letter-spacing: normal; orphans: 2; text-align: start; =

text-transform: none; widows: 2; word-spacing: 0px; =

-webkit-text-stroke-width: 0px; white-space: normal; =

text-decoration-thickness: initial; text-decoration-style: initial; =

text-decoration-color: initial;" width=3D"100%">

Helvetica, Arial, "Sans Serif", serif, EmojiFont; font-size: =

11px; color: rgb(102, 102, 102); padding: 2px 5px 0px 0px;">

This is an aut‍ogenerated noti‍fication.

255, 255); max-width: 640px;">

Contract phish from Google user Part 3

Posted by Dave Yadallee on Wednesday, June 10. 2026

border=3D"0" cellpadding=3D"0" cellspacing=3D"0" height=3D"182" =

style=3D"background-color: rgb(33, 78, 159); color: rgb(255, 255, 255);" =

width=3D"100%">

style=3D"padding: 28px 10px 36px; border-radius: 2px; background-color: =

rgb(33, 78, 159); color: rgb(255, 255, 255); font-size: 16px; font-family: =

Helvetica, Arial, "Sans Serif"; width: 572.031px; text-align: =

center;">

width=3D"100%">

align=3D"center" style=3D"padding-top: 24px; font-size: 16px; font-family: =

Helvetica, Arial, "Sans Serif"; border: none; text-align: center;=

color: rgb(255, 255, 255);">Nagindas Khandwala College

You have reci‍eved some bu‍siness =

f‍iles on DocuSi‍gn.

cellspacing=3D"0" width=3D"100%">

Arial, "Sans Serif", serif, EmojiFont;">

cellpadding=3D"0" cellspacing=3D"0">

style=3D"font-size: 14px; color: rgb(255, 255, 255); font-family: Helvetica=

, Arial, "Sans Serif"; font-weight: bold; text-align: center; =

text-decoration: none; border-radius: 2px; border: 1px solid rgb(255, 255, =

255); background-color: rgb(33, 78, 159); height: 44.0039px; display: =

block;">
w=3DJboUTP7jcaLgRFIqV2a8nUx6wQ0beyjoyFhO55BJvBo.eyJ1IjoiaHR0cHM6Ly93d3cuZ29=

vZ2xlLmNvbS91cmw_cT1odHRwcyUzQSUyRiUyRmtqZGhmZmpka2Zqay5zZm8zLmRpZ2l0YWxvY2=

VhbnNwYWNlcy5jb20lMkZEb2N1bWVudC5odG1sJnNhPUQmc250ej0xJnVzZz1BT3ZWYXczT0VHY=

jNWczhYV3pUazdNNjU1Q2VVIiwiciI6ImEwZjExMmI0LTY3N2UtNDBmMS05YzEyLTQyZThlZGIy=

MTI2ZCIsIm0iOiJscCJ9#sales@nk.ca" rel=3D"noopener noreferrer" =

style=3D"font-size: 14px; background-color: #ffc820; font-family: Helvetica=

, Arial, "Sans Serif"; font-weight: bold; text-align: center; =

text-decoration: none; display: inline-block; padding-left:12px; =

padding-right:12px; padding-top:0px; padding-bottom:0px" =

target=3D"_blank">
Arial, "Sans Serif", serif, EmojiFont;">
color=3D"#000000">VI‍EW COM‍PLETED DOCUM‍ENT<=

/td>

0px 24px 24px; color: rgb(0, 0, 0); font-size: 16px; font-family: =

Helvetica, Arial, "Sans Serif"; background-color: white;">

, "Sans Serif", serif, EmojiFont; font-weight: bold; line-height:=

18px; font-size: 15px; color: rgb(51, 51, 51);">Sec‍ure Docu‍ment =

sent to:

Helvetica, Arial, "Sans Serif", serif, EmojiFont; line-height: =

18px; font-size: 15px; color: rgb(102, 102, 102);">sales@nk.ca

Helvetica, Arial, "Sans Serif"; line-height: 20px;">Kindly =

l‍og in with the link ab‍ove to view your completed docu‍ment.=

Thank you,

Helvetica, Arial, "Sans Serif"; line-height: 20px;">This =

sec‍ure li‍nk expires by undefined (CST).

The Nagindas Khandwala College =

Doc‍s Te‍am

255); font-family: Helvetica, Arial, "Sans Serif"; font-size: =

11px; color: rgb(102, 102, 102);">

cellpadding=3D"0" cellspacing=3D"0">

Serif"; font-size: 11px; color: rgb(102, 102, 102); vertical-align: =

top;" valign=3D"top">

style=3D"font-family: Helvetica, Arial, "Sans Serif", serif, =

EmojiFont; font-size: 11px; color: rgb(102, 102, 102); padding: 2px 5px 0px=

0px;">Powered by
51); font-size: 12px;">DocuSi‍gn for Nagindas Khandwala =

College
font-size: 12px;">.

rgb(234, 234, 234);">

Helvetica, Arial, "Sans Serif"; font-size: 13px; color: rgb(234, =

234, 234); line-height: 18px;">071f11493d1e57d9807a2e06f6e468d2

"Sans Serif"; font-size: 13px; color: rgb(102, 102, 102); =

line-height: 18px;">Do Not Share This Email

This email contains a sec‍ure link to DocuS‍ign. Please do =

not share or forward this email, li‍nk, or access co‍de with others=

.

font-family: Helvetica, Arial, "Sans Serif"; font-size: 13px; =

color: rgb(102, 102, 102); line-height: 18px;">About =

DocuS‍ign

Sign do‍cuments electronically in just =

minutes. It's safe, secure, and legally binding. Whether you're in =

an office, at home, on-the-go -- or even across the globe -- Do‍cuSign =

provides a professional trusted solution for Digital Transactions .

wq5M8kJj

Contract phish from Google user Part 1

Posted by Dave Yadallee on Wednesday, June 10. 2026

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Wed, 10 Jun 2026 05:32:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wXH9X-000000004os-45N1

for dave@doctor.nl2k.ab.ca;

Wed, 10 Jun 2026 05:31:23 -0600

Resent-From: The Doctor

Resent-Date: Wed, 10 Jun 2026 05:31:23 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from server.theclickgroup.rw ([66.29.142.190]:48874)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wXFab-000000005yY-0533

for sales@nk.ca;

Wed, 10 Jun 2026 03:51:22 -0600

DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed;

d=umuhuza.org.rw; s=default; h=Content-Type:MIME-Version:Date:

Content-Transfer-Encoding:Message-ID:Subject:To:From:Sender:Reply-To:Cc:

Content-ID:Content-Description:Resent-Date:Resent-From:Resent-Sender:

Resent-To:Resent-Cc:Resent-Message-ID:In-Reply-To:References:List-Id:

List-Help:List-Unsubscribe:List-Subscribe:List-Post:List-Owner:List-Archive;

bh=b03VWb6a36mFC1knOV2oNr7sJk3JpRj02n0QvT3vFTs=; b=LC3a/alT4tsPUvOLR6ezvYmfrh

hyFprnjOaRDkdzdcLtIKWdsJRVrOGOntGTZuYDKmNgXvhPjC1QDEzauFr3bNrBpVw219cP2DKbbpL

YaJiydcUkooPmCKVW1VQUbtUeEPwWwYtfxx9QXhmqNnjaSXe252Jq5iop9ysfHKlYRu0JkSmbEeAr

VcAbnNeOxyVh21Jwnz0ieD3+x+j4pbxEGJGdUXRl0C/x/QG1tUUPtQpDwo22t1pp9OkW/TEGUN4N7

dxOQLPPvpBDTRJKX5hpfY6n53g8RvpY66mh0stTvasoKGP97scP68huUi9bxS5Pz5hPiZSc8tGSnv

jN4Jg2Rw==;

Received: from 32.97.227.35.bc.googleusercontent.com ([35.227.97.32]:46050 helo=[127.0.0.1])

by server.theclickgroup.rw with esmtpsa (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.99.4)

(envelope-from )

id 1wXFZj-0000000AEy0-00MB

for sales@nk.ca;

Wed, 10 Jun 2026 11:50:16 +0200

From: "Nagindas Khandwala College eSignatures /O189433 =FIRST

ORGANIZATION/OU=EXCHANGE ADMINISTRATIVE GROUP /Garett Lemke-Lang"

To: sales@nk.ca

Subject: Completed: Nagindas Khandwala College Contract Agreement

06/10/2026 ref:eUc0vrV/449392

Message-ID:

Content-Transfer-Encoding: quoted-printable

Date: Wed, 10 Jun 2026 09:49:55 +0000

MIME-Version: 1.0

Content-Type: text/html; charset=utf-8

X-AntiAbuse: This header was added to track abuse, please include it with any abuse report

X-AntiAbuse: Primary Hostname - server.theclickgroup.rw

X-AntiAbuse: Original Domain - nk.ca

X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12]

X-AntiAbuse: Sender Address Domain - umuhuza.org.rw

X-Get-Message-Sender-Via: server.theclickgroup.rw: authenticated_id: shyakachristian@umuhuza.org.rw

X-Authenticated-Sender: server.theclickgroup.rw: shyakachristian@umuhuza.org.rw

X-Source:

X-Source-Args:

X-Source-Dir:

X-Spam_score: 9.6

X-Spam_score_int: 96

X-Spam_bar: +++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.

Content preview: This is an autâ€ogenerated notiâ€fication. Nagindas Khandwala

College You have reciâ€eved some buâ€siness fâ€iles on DocuSiâ€gn. VIâ€EW

COMâ€PLETED DOCUMâ€ENT

Content analysis details: (9.6 points, 5.0 required)

pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[35.227.97.32 listed in will-spam-for-food.eu.org]

[35.227.97.32 listed in will-spam-for-food.eu.org]

[35.227.97.32 listed in will-spam-for-food.eu.org]

[35.227.97.32 listed in will-spam-for-food.eu.org]

[35.227.97.32 listed in will-spam-for-food.eu.org]

[35.227.97.32 listed in will-spam-for-food.eu.org]

[35.227.97.32 listed in will-spam-for-food.eu.org]

[35.227.97.32 listed in will-spam-for-food.eu.org]

[66.29.142.190 listed in will-spam-for-food.eu.org]

[66.29.142.190 listed in will-spam-for-food.eu.org]

[66.29.142.190 listed in will-spam-for-food.eu.org]

[66.29.142.190 listed in will-spam-for-food.eu.org]

[66.29.142.190 listed in will-spam-for-food.eu.org]

[66.29.142.190 listed in will-spam-for-food.eu.org]

[66.29.142.190 listed in will-spam-for-food.eu.org]

[66.29.142.190 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[66.29.142.190 listed in dnsbl.ahbl.org]

[66.29.142.190 listed in dnsbl.ahbl.org]

[66.29.142.190 listed in dnsbl.ahbl.org]

[66.29.142.190 listed in dnsbl.ahbl.org]

[35.227.97.32 listed in dnsbl.ahbl.org]

[35.227.97.32 listed in dnsbl.ahbl.org]

[35.227.97.32 listed in dnsbl.ahbl.org]

[35.227.97.32 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[66.29.142.190 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[66.29.142.190 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[66.29.142.190 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[66.29.142.190 listed in dnsbl.ahbl.org]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-0.0 SPF_PASS SPF: sender matches SPF record

-0.0 SPF_HELO_PASS SPF: HELO matches SPF record

2.3 MANGLED_LINKS BODY: mangled link(s)

1.1 TRACKER_ID BODY: Incorporates a tracking ID number

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[66.29.142.190 listed in bl.score.senderscore.com]

0.1 MXG_EMAIL_FRAG BODY: URI with email in fragment

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_LOW_CONTRAST BODY: HTML font color similar or identical to

background

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

2.0 RATWR8_MESSID Message-ID with excessive dashes and dollars

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

1.7 FONT_INVIS_MSGID Invisible text + suspicious message ID

Subject: {SPAM?} Completed: Nagindas Khandwala College Contract Agreement

06/10/2026 ref:eUc0vrV/449392

WEb/SEO/App spam from Google Gmail Part 2

Posted by Dave Yadallee on Wednesday, June 10. 2026

X-Received: by 2002:a17:90b:3503:b0:368:ed92:6f6 with SMTP id

98e67ed59e1d1-370ee830360mr23869198a91.1.1781082515537; Wed, 10 Jun 2026

02:08:35 -0700 (PDT)

MIME-Version: 1.0

References:

In-Reply-To:

From: Ketrina Cullins

Date: Wed, 10 Jun 2026 14:38:23 +0530

X-Gm-Features: AVVi8CclF169aY6EnqyWzOHruua59XbP32YTY6ygsLy885QK7YbFTxw8Vmtm4Z8

Message-ID:

Subject: Re: Real Estate & Property CRM Mobile App

To: undisclosed-recipients:;

Content-Type: multipart/alternative; boundary="000000000000a782d00653e2965e"

Bcc: cullinsk05@digitalappsdev.com

X-Original-Sender: cullinsk76@gmail.com

X-Original-Authentication-Results: mx.google.com; dkim=pass

header.i=@gmail.com header.s=20251104 header.b=cTgguLQr; arc=pass

(i=1); spf=pass (google.com: domain of cullinsk76@gmail.com designates

209.85.220.65 as permitted sender) smtp.mailfrom=cullinsk76@gmail.com;

dmarc=pass (p=NONE sp=QUARANTINE dis=NONE) header.from=gmail.com;

dara=neutral header.i=@digitalappsdev.com

Precedence: list

Mailing-list: list cullinsk05@digitalappsdev.com; contact cullinsk05+owners@digitalappsdev.com

List-ID:

X-Spam-Checked-In-Group: cullinsk05@digitalappsdev.com

X-Google-Group-Id: 216687259047

List-Post: ,

List-Help: ,

List-Archive:

List-Subscribe: ,

List-Unsubscribe: ,

--000000000000a782d00653e2965e

Content-Type: text/plain; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable

Hello,

Do you have a mobile app idea in mind? I=E2=80=99d be happy to help you bri=

ng it to

life.

Thank you!

Ketrina

If you'd rather not hear from me again, simply reply "unsubscribe" and

I'll make sure you don't receive any further emails.

On Wed, May 27, 2026 at 6:56=E2=80=AFPM Ketrina Cullins
om>

wrote:

> Hi,

>

> We provide professional Mobile App Development services for iOS, Android,

> Hybrid, and Native platforms.

>

>

> Our experience includes building:

> =E2=9E=BA On-Demand Service Apps

> =E2=9E=BA Cleaning Service Apps

> =E2=9E=BA Booking & Delivery Apps

> =E2=9E=BA Logistics / Transportation Apps

> =E2=9E=BA Healthcare Apps

> =E2=9E=BA E-commerce Apps

> =E2=9E=BA Real Estate Apps

> =E2=9E=BA Staff Management & Scheduling Apps

>

> If you are planning to build a mobile application, please share the

> features and services you need.

>

> We would be happy to discuss your project.

>

> Thank you!

> Ketrina

>

--000000000000a782d00653e2965e

Content-Type: text/html; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable

Hello,

Do you h=

ave a mobile app idea in mind? I=E2=80=99d be happy to help you bring it to=

life.

Thank you!

Ketrina

>If you'd rather not hear from me again, simply reply=C2=A0
">"unsubscribe"=C2=A0and I'll make sure you don't rec=

eive any further emails.

uote gmail_quote_container">

On Wed, M=

ay 27, 2026 at 6:56=E2=80=AFPM Ketrina Cullins <
sk76@gmail.com">cullinsk76@gmail.com> wrote:

ass=3D"gmail_quote" style=3D"margin:0px 0px 0px 0.8ex;border-left:1px solid=

rgb(204,204,204);padding-left:1ex">

sans-serif">Hi,

We provide professional Mobile App Development serv=

ices for iOS, Android, Hybrid, and Native platforms.

Our experien=

ce includes building:

=E2=9E=BA On-Demand Service Apps
=E2=9E=

=BA Cleaning Service Apps
=E2=9E=BA Booking & Delivery Apps
=E2=

=9E=BA Logistics / Transportation Apps
=E2=9E=BA Healthcare Apps
=E2=

=9E=BA E-commerce Apps
=E2=9E=BA Real Estate Apps
=E2=9E=BA Staff Man=

agement & Scheduling Apps

If you are planning to build a mobile =

application, please share the features and services you need.

We wou=

ld be happy to discuss your project.

Thank you!

e=3D"verdana, sans-serif">Ketrina

--000000000000a782d00653e2965e--

WEb/SEO/App spam from Google Gmail Part 1

Posted by Dave Yadallee on Wednesday, June 10. 2026

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Wed, 10 Jun 2026 05:32:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wXH9G-000000003CM-4BN6

for dave@doctor.nl2k.ab.ca;

Wed, 10 Jun 2026 05:31:06 -0600

Resent-From: The Doctor

Resent-Date: Wed, 10 Jun 2026 05:31:06 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-pj1-f69.google.com ([209.85.216.69]:61594)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wXEwW-000000002OV-1OGI

for root@nk.ca;

Wed, 10 Jun 2026 03:09:58 -0600

Received: by mail-pj1-f69.google.com with SMTP id 98e67ed59e1d1-36d98b74447sf5155303a91.2

for ; Wed, 10 Jun 2026 02:09:01 -0700 (PDT)

ARC-Seal: i=3; a=rsa-sha256; t=1781082535; cv=pass;

d=google.com; s=arc-20240605;

b=YePa0bS/ztI/eApvctnB9a5XSn0JJKLp8VyZU/dyDntRyKkubfumakASQd2uR7kW+c

1Txs173HHoVhw6sZqwnChdOZderNeiHO+WTzKTNw7LknvtbjzaeIpjzBHJIUOvYl9Smb

CUgCmNehboJvqYpXm/qOegSACvpKcyKgHVQXW8L3RkWYxiJOw+JnTQhX+RyAQToL5WM+

ctZVdzI+5625RRTFyI6UIi4VQEYuUdeBnbC/xa1PZWiRsD+aX0LVc7ymCGHCVIzoZLQH

vIb8eCAcDfhwElJTGC5I6VQqGFE5oPnNZTcuCmb7Ysc2tDNI6J/PZwM0FB6Gd5xtaY7t

GAIg==

ARC-Message-Signature: i=3; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20240605;

h=list-unsubscribe:list-subscribe:list-archive:list-help:list-post

:list-id:mailing-list:precedence:to:subject:message-id:date:from

:in-reply-to:references:mime-version:dkim-signature;

bh=ATuQQ057ud1yusInrMg6yVNBUGE4rwoohjvSzxYYes4=;

fh=iNkiVqVTBaSCdfI63qB9mJDnRqan516xsF7Odd+n51c=;

b=Q5K6QB5S3HlJ2+3AM/pc2OtAw0A/XFQkva4fxpQwkPDinvM6T7OFB1Xz8G7GDML3JN

wcbFtk915ZaMJncmSAHjm35dNT8Avl8qo3lSuihFRXp7dUhwvt2T/1OZgR5ixauOJ9pX

c5EzaP8FZ1n4A6z70Tgu1BCxOjj5btSPgcoP0qVCja6F2pmmwMNa6kF+UXARtL7sAKXG

3rVM1Xs/EauMwvQF4LI218naapgWz0m91HWhELeCJ2fTQyXzH2plXr1+OWCkdgiASF92

pp9r2irqXXa1CIPNYpHaDiNds38w5+Zz9Y6nPE0SF3+lUOC7ESTpwFbjLOi/+ZoVXiqx

zQwg==;

darn=nk.ca

ARC-Authentication-Results: i=3; mx.google.com;

dkim=pass header.i=@gmail.com header.s=20251104 header.b=cTgguLQr;

arc=pass (i=1);

spf=pass (google.com: domain of cullinsk76@gmail.com designates 209.85.220.65 as permitted sender) smtp.mailfrom=cullinsk76@gmail.com;

dmarc=pass (p=NONE sp=QUARANTINE dis=NONE) header.from=gmail.com;

dara=neutral header.i=@digitalappsdev.com

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=digitalappsdev-com.20251104.gappssmtp.com; s=20251104; t=1781082535; x=1781687335; darn=nk.ca;

h=list-unsubscribe:list-subscribe:list-archive:list-help:list-post

:list-id:mailing-list:precedence:x-original-authentication-results

:x-original-sender:to:subject:message-id:date:from:in-reply-to

:references:mime-version:from:to:cc:subject:date:message-id:reply-to;

bh=ATuQQ057ud1yusInrMg6yVNBUGE4rwoohjvSzxYYes4=;

b=A7GmV1XTIsgm4T8uSjtP/Ju7x1M+aw2zAdWcppDzjJJiLCZVvQTzRnQy9OTanJTlwY

vXbqpVyfCVn+aIuzt0VnT/B2AreebA3l/5d1Ja0UqP1XmJmuJH2HXd9ONB8In/y+mIyc

fno9CoQtLrkhdo9s7A+s57DWAKj/sfXT6FMJ3DO53IrzH7WFIBjBd7onNuGgyylIYWsX

ucPgFkVZMS9d4kErIJ0Z+a+Jo5YtVAJgSBgqig0oxh6vlEfO7P0G0luuuj0SpOBXTTZX

WCpnQsIkxNfB5Ap7ochreaGPS9GA+7YtC9vQTTn8D6SxpwbJEZE7vK2xNmR5royMgUgy

t/AA==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20251104; t=1781082535; x=1781687335;

h=list-unsubscribe:list-subscribe:list-archive:list-help:list-post

:x-spam-checked-in-group:list-id:mailing-list:precedence

:x-original-authentication-results:x-original-sender:to:subject

:message-id:date:from:in-reply-to:references:mime-version:x-gm-gg

:x-beenthere:x-gm-message-state:from:to:cc:subject:date:message-id

:reply-to;

bh=ATuQQ057ud1yusInrMg6yVNBUGE4rwoohjvSzxYYes4=;

b=gsWkTBXRBhcIPDQRR7Ul5n6przoGb6JhWEVsVrcRTZtftZ1ihjmtWt91KNXY/i8TAr

xjbaXBxnQ7BVIghoSe+cFluLHYNdVNqqy7cz3KmovZ9OWngplml+HRrQY5+mYLiHRQAw

X8vRe4I0ivn/eYUMr5DQ0kNRbGjhTqZd9wxP4AJYB+5QID+oH9I20k5Kh7pivXlM8Emq

AlwTboki38Oqj41SmP3zO6sbxK3cxO7mWkLPz277reHehpxtgna1rIAaKl/Jj1kC+OB3

ukW513BnbudGTqDPBkG9tMZGOfISkDkT4cKtlBVhe+hV+3na7qXpB4BTmfSl6Yb7B1VW

90Ow==

X-Forwarded-Encrypted: i=3; AFNElJ+nYhXxFCabtP1esqYmhuxWzY94jnvirpfzLAive8rq6VHfbvKhdiL4jXyxMeP3sak1Lzm0@nk.ca

X-Gm-Message-State: AOJu0YxWX5gUVKimnwM4yDWxuNOapQ3jalOnrUoPeX3xWSQ3mZYyB3sQ

lzwR1Ma3hVjurnx1VRXnntOYJ9GRB8AaTmU1g4hdpQ/DEkawf2UaKZLjK3bIhZcbeJY=

X-Received: by 2002:a17:90b:5544:b0:369:f48a:f24b with SMTP id 98e67ed59e1d1-370ec0f41aemr27670384a91.0.1781082535250;

Wed, 10 Jun 2026 02:08:55 -0700 (PDT)

X-BeenThere: cullinsk05@digitalappsdev.com; h="AX0PUUcVehaZvl7aagoG9CNre4pxeFqsj6ZdK0azFoy9HwvQRw=="

Received: by 2002:a17:90a:d60b:b0:365:fbb7:4636 with SMTP id

98e67ed59e1d1-36f61f63594ls7524218a91.0.-pod-prod-09-us; Wed, 10 Jun 2026

02:08:36 -0700 (PDT)

X-Forwarded-Encrypted: i=3; AFNElJ//3Y5D/dVD+W3gm6dv1Q5zT4dCWC/Qp7XsoHSmAAqCjA6XA5v3Osf8UNsUXi2iUfRzcxw/eFAOaWLO@digitalappsdev.com

X-Received: by 2002:a17:90b:580e:b0:368:b4a5:c4dd with SMTP id 98e67ed59e1d1-370ee82f071mr24465719a91.2.1781082516199;

Wed, 10 Jun 2026 02:08:36 -0700 (PDT)

ARC-Seal: i=2; a=rsa-sha256; t=1781082516; cv=pass;

d=google.com; s=arc-20240605;

b=TVDfhyUtBCJv3XIlPIcMgqgCDbMNc4FC4VhbxqaE+UlP54Qt8iitRPZoRNpqstoSU+

ziQ0eQm1e7PGroeaXpv/LuKGOrJUqMuKaInyolzmLTq6GEvZk0/jWfqpotu2ytRwCZIF

WKQkeZ9sthRhhn0AHcnScirG+eeMXcw25N1xPT5NwxWM7WUgjnxtnF0a5FQ4jC/ZdbtV

X4GEACrCGOtjjhLf7H4pjBMzGQdsSLt8lO5oCkNIHDygyujewRFmnHe+49AnMSOh0A+m

ppeVDrzdIvCjuSJd1WMGMVHZ4QDwO9IrDn6Sv3mvlPV75e7KDTWkrLZT7ERufjSN3kJV

2B4g==

ARC-Message-Signature: i=2; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20240605;

h=to:subject:message-id:date:from:in-reply-to:references:mime-version

:dkim-signature;

bh=ATuQQ057ud1yusInrMg6yVNBUGE4rwoohjvSzxYYes4=;

fh=/fhJ1WEZwE0o8iqfgMa6M60jzxkxX36gntJTRE90CZc=;

b=cQDOt7yc+NAOpPoRwMNdnFn+OML/dihx8wJvqX2rlJNOZG0CSkQsVVjYdDaTQrz9pt

TpvfFq78wl9XACqMOAzzUKOJeqBbO2QCJUWbj5VTHogw/WJxsoPaA9JePV37pbVGr797

KXSw8hKEDX3SkxaZbHkTi26LGVgSASQmgc38/MUESKdm0eAdzYarBVPcLxK6KD0wftwM

YoPUEg2h3fAMqeqxKE3ISVkj1Y+bn00v3K6hKnQX3h147pslotAt28uwr+AhDnJBQJeo

xXE60JCjahvAe8OJn3RYoD4amo/qgV8RPuGbwgLxVlVPySLgt/AfBe0DOYF9oq9/ELn6

pA7A==;

dara=google.com

ARC-Authentication-Results: i=2; mx.google.com;

dkim=pass header.i=@gmail.com header.s=20251104 header.b=cTgguLQr;

arc=pass (i=1);

spf=pass (google.com: domain of cullinsk76@gmail.com designates 209.85.220.65 as permitted sender) smtp.mailfrom=cullinsk76@gmail.com;

dmarc=pass (p=NONE sp=QUARANTINE dis=NONE) header.from=gmail.com;

dara=neutral header.i=@digitalappsdev.com

Received: from mail-sor-f65.google.com (mail-sor-f65.google.com. [209.85.220.65])

by mx.google.com with SMTPS id 98e67ed59e1d1-36e22acb91fsor11909803a91.5.2026.06.10.02.08.36

for

(Google Transport Security);

Wed, 10 Jun 2026 02:08:36 -0700 (PDT)

Received-SPF: pass (google.com: domain of cullinsk76@gmail.com designates 209.85.220.65 as permitted sender) client-ip=209.85.220.65;

ARC-Seal: i=1; a=rsa-sha256; t=1781082516; cv=none;

d=google.com; s=arc-20240605;

b=AkxaIOPeoi2McgWAzBEKfRm6bkW3z+AoQC6oTqBPCKIB+u4S2FjEM4G/jRXKgVPZig

lsf7z4k82iK8imAYzfM0zktUICsxfigcXrVnhS0kR8V0FsOxTuMzvD8wuwaSw9QIzNFz

BGTVS77Ognh8ceVVfISZyIK/vZVnAr5gPsywSigzlPQdhiUW2pf3HrOxp5B81GXozz2u

WRahLXtgzpQRbvwsJ/u0G2ql5PKmjm89Hu6K6WPOyiSDapuRc1EG5aHmgejZSyl8RJCB

OhLdw4o/XDovZUKa30ll+AFVVFx+cxjOA6aMvtFp5FEPY/xz0psFEehkm1GjC8Tedq6p

cuVA==

ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20240605;

h=to:subject:message-id:date:from:in-reply-to:references:mime-version

:dkim-signature;

bh=ATuQQ057ud1yusInrMg6yVNBUGE4rwoohjvSzxYYes4=;

fh=/fhJ1WEZwE0o8iqfgMa6M60jzxkxX36gntJTRE90CZc=;

b=aG7ggHWCsKFVBls/eV4kYBd9yZ6+mTvCfA/IJd73mWkjg0ZEo3VjCbQw9cv3qdM9Jm

p7GaRSrN+F5CqiC7e4eTrEzGsCt7MJgMMtvOltpdDQIfw1BQUW9Lwc+SGbKh0btVBFuw

mosjodoDS2AbulPlzmMQY+kGiB+vix9JXRUausLpDf3Xq3qp5eY9RFoSxooKAZSvT+NU

GZ75XJNTYwrzsZReF79eG44lB3rtpOWok3L2OsKx72SP1qdd2WT/s8qam4oBd10Vjjxi

JUYo5HnsVxEA7LgkzhXppBUo7SAaj6V4NIXSSA1R+M25upgJtTQqQcRP/AT5+s2PbBSk

Qy/g==;

darn=digitalappsdev.com

ARC-Authentication-Results: i=1; mx.google.com; arc=none

X-Forwarded-Encrypted: i=1; AFNElJ9MeSKH9I12RgDQ5YJT1Nsmz0eEJeiMulzuPHbpUWpU48HDByni6CNT4zQWTRcGyUreQMeiKGVaL4fV@digitalappsdev.com

X-Gm-Gg: Acq92OHthDLVUZ4l1UlfEf66DDAa3AbKsD1B1v5jEp2TgeSsNti/hcrapig3zgmNC7A

dWPhkd8P+hjLVD3U53ZIkdAjIvywv/caDaamBlALdKByPuSoaPJz6iFR4x2IiJ6WRMjgqJlK3O+

3wao33DJ8UDggzpCNpfym0Yrrliw0VmBIi4Etxl/zLKJFLitgpzo+BzICXZlQw2ll4LytOxZec5

VOzlqgFbsEupLINcR8qgRq9cVEhD0fqsTqNC5ZK1NAXMcPvRdDC/ucEmGoEm1nH40Te0jhhZKAt

SAMMxRx40XOfI529HJ9Q5zt5zgABSG8S2/wdAQ8b2SlsOjgSSw==

Chinese products spam Part 2

Posted by Dave Yadallee on Wednesday, June 10. 2026

------=_Part_312081_885067890.1781077947025

Content-Type: text/html; charset="utf-8"

Content-Transfer-Encoding: 7bit

Dear Purchasing Manager,

Good day!

This is Vivian from a professional hotel furniture manufacturer in China.

We specialize in custom hotel bedroom sets, lobby furniture, restaurant and resort furniture for global clients.

We can handle both small projects and large hotel chain orders with stable quality and fast lead time.

Our products are widely sold to America, Europe, the Middle East, Southeast Asia, Australia and other international markets. We have rich experience working with hotel contractors, project designers and furniture wholesalers.

We provide one-stop service including custom design, OEM/ODM, factory direct price, quality inspection and after-sales support.

If you are looking for a reliable, cost-effective and professional hotel furniture supplier, we are your best choice.

Welcome to contact us for catalogs, factory pictures, or quotation anytime.

Best regards,

Vivian

Foshan RHT Furniture Co.,Ltd.

WhatsApp/WeChat: 0086-19290112590

Email: vivian6634@163.com

Website: http://www.rongtaif.com/

------=_Part_312081_885067890.1781077947025--

------=_Part_312080_1165617387.1781077947025--

Chinese productus spam Part 1

Posted by Dave Yadallee on Wednesday, June 10. 2026

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Wed, 10 Jun 2026 05:31:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wXH8Y-000000000eR-2Lng

for dave@doctor.nl2k.ab.ca;

Wed, 10 Jun 2026 05:30:22 -0600

Resent-From: The Doctor

Resent-Date: Wed, 10 Jun 2026 05:30:22 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from dmd100.mail84.iemailforce.com ([61.147.84.100]:43307)

by doctor.nl2k.ab.ca with esmtp (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wXDkf-00000000LCm-3q04

for doctor@nl2k.ab.ca;

Wed, 10 Jun 2026 01:53:48 -0600

DKIM-Signature: v=1; a=rsa-sha256; d=edm1.sqeee.com; s=iemdkim; c=relaxed/relaxed;

bh=1KMIHp5e7HMYOyPWuoirP0QKysI5FMo7w072EjBoMaI=;

h=from:reply-to:subject:date:to:cc:resent-date:resent-from:resent-to:

resent-cc; t=1781077947;

b=nD3KPq4li8U2jYJ2yXEv7lRgOUIbRHSEFt20vFMInA9o7ayNQjSLmxSc57d+u56URBH6mKCWl

uJQxTWhSAcfKuSuP5D3rB0k/yW8A08iNHdzgM9hyYfmgueVKI7N8s/H59tlSqEvjeI9I2usLOmM

uRDUsTcjj64Nh2k+RqXIipFhL3FkQfsdKDMhklGdtX7L0P69jBa0LeIZ2gEg/ITv2WpbpMmbs0+

JqCKvCU1xNsscsY9L0be8wd7/nHYsKS4mWt9syttvTnod2MXT7DgGHJhWnfrpZ2RZ/EGJ0D7nj6

DkKecA7RjpPgKzCKGWxG13CJFdIJgnawRWIhkHXwlhaw==;

Date: Wed, 10 Jun 2026 15:52:27 +0800 (CST)

From: vivian

Reply-To: "vivian6634@163.com"

To: doctor@nl2k.ab.ca

Message-ID:

Subject: Re: Hotel furniture factory

MIME-Version: 1.0

Content-Type: multipart/mixed;

boundary="----=_Part_312080_1165617387.1781077947025"

List-Unsubscribe: ,

List-Unsubscribe-Post: List-Unsubscribe=One-Click

X-Iemail-Message-Id:

Feedback-ID: 3a686e9debd94bdb906880472c8d0b19:journey_iEmailMailing_181562_1781076989254_358096:normal:iemail

X-System: P9vr5pzQYFye

X-Spam_score: 9.3

X-Spam_score_int: 93

X-Spam_bar: +++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.

Content preview: Re: Hotel furniture factory Hello doctor@nl2k.ab.ca, It looks

like your email software does not support HTML. Please visit the webpage

below in order to read this message in your webbrowser: https://iem-tracking.dmartech.cn/x/weblink?p=JY7NisMwDITvfpcU_

[...]

Content analysis details: (9.3 points, 5.0 required)

pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[61.147.84.100 listed in will-spam-for-food.eu.org]

[61.147.84.100 listed in will-spam-for-food.eu.org]

[61.147.84.100 listed in will-spam-for-food.eu.org]

[61.147.84.100 listed in will-spam-for-food.eu.org]

[61.147.84.100 listed in will-spam-for-food.eu.org]

[61.147.84.100 listed in will-spam-for-food.eu.org]

[61.147.84.100 listed in will-spam-for-food.eu.org]

[61.147.84.100 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[61.147.84.100 listed in dnsbl.ahbl.org]

[61.147.84.100 listed in dnsbl.ahbl.org]

[61.147.84.100 listed in dnsbl.ahbl.org]

[61.147.84.100 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[61.147.84.100 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[61.147.84.100 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[61.147.84.100 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[61.147.84.100 listed in dnsbl.ahbl.org]

1.6 RCVD_IN_BRBL_LASTEXT RBL: No description available.

[61.147.84.100 listed in bb.barracudacentral.org]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[61.147.84.100 listed in list.dnswl.org]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[61.147.84.100 listed in bl.score.senderscore.com]

-0.0 SPF_PASS SPF: sender matches SPF record

0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in digit

[vivian6634(at)163.com]

0.3 LONGWORD BODY: Uses overlong words

0.5 L_HELLO_ADDRESS BODY: Greets you by address, not by name

0.6 MEGALONGWORD BODY: Uses really overlong words

0.7 HTML_IMAGE_ONLY_28 BODY: HTML: images with 2400-2800 bytes of words

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

2.5 FREEMAIL_FORGED_REPLYTO Freemail in Reply-To, but not From

1.5 IMPRONONCABLE_2 Too much mixed numbers and lower-case letters

Subject: {SPAM?} Re: Hotel furniture factory

------=_Part_312080_1165617387.1781077947025

Content-Type: multipart/alternative;

boundary="----=_Part_312081_885067890.1781077947025"

------=_Part_312081_885067890.1781077947025

Content-Type: text/plain; charset="utf-8"

Content-Transfer-Encoding: 7bit

Re: Hotel furniture factory

Hello doctor@nl2k.ab.ca,

It looks like your email software does not support HTML.

Please visit the webpage below in order to read this message in your webbrowser:

https://iem-tracking.dmartech.cn/x/weblink?p=JY7NisMwDITvfpcU_0s-BPbSQwvtwkJh20uQLbukTZOSpLDdp1_DSugwzIhv0jK2hjz6HDhHDjZyDNIjSgs6IcuogkivZZ0eee56bqXWLhptmlKCaqwD06CL2FgdldPBoOIgcstTWqf5Yxz0fUNxk0gM9bkwUZCOoy3J-qqMAShSJp0cUJZiqSGdKaGDAgnIQg7EKtRhzwqMSlGsNXSbXvOY312_fVA_HOr147VTqJzXnQJUEnzAoJ3tjEMZvBDr0v4bUFsKurdcsmJ0dYkssgmVQFh8TgyVR7XNdWynbA_d-7k777-_4PkD92Her-NleB_nk9udf198umznz-E42T8

Dragonfly/Intelcom phish Part 2

Posted by Dave Yadallee on Wednesday, June 10. 2026

This is a multi-part message in MIME format.

--139dc9e2d192e62775ad5c3baa93d99ea

Content-Type: text/plain; charset=UTF-8

Content-Transfer-Encoding: 8bit

French version follows

Intelcom is now Dragonfly!

Valued customer,

A package addressed to you has been held due to non-payment of applicable customs duties, in accordance with the Canada Border Services Agencyâ€™s terms and conditions. Please pay these customs duties using our secure form below and schedule delivery at a time that is convenient for you:Â Â

Access secure form

Failure to comply with this notice will result in your package being returned to the sender.

Important:Â Dragonfly may collect duties and taxes when required by border authorities.

This is an automated email. Please do not reply.

Â

Intelcom est maintenant Dragonfly!

Cher(e) client(e),

Un colis qui vous est destinÃ© a Ã©tÃ© retenu en raison du non-paiement des droits de douane applicables, conformÃ©ment aux conditions gÃ©nÃ©rales de l'Agence des services frontaliers du Canada. Veuillez rÃ©gler ces droits de douane Ã l'aide de notre formulaire sÃ©curisÃ© ci-dessous et choisir une heure de livraison qui vous convient :Â

AccÃ©der au formulaire sÃ©curisÃ©

Le non-respect de cet avis entrainera la rÃ©expÃ©dition de votre colis Ã son expÃ©diteur.

Important :Â Dragonfly peut percevoir des droits et taxes lorsque les autoritÃ©s frontaliÃ¨res lâ€™exigent.

Ceci est un message automatisÃ©. Veuillez ne pas rÃ©pondre Ã ce courriel.

--139dc9e2d192e62775ad5c3baa93d99ea

Content-Type: text/html; charset=UTF-8

Content-Transfer-Encoding: 8bit

French version follows

Intelcom is now Dragonfly!

Valued customer,

A package addressed to you has been held due to non-payment of applicable customs duties, in accordance with the Canada Border Services Agencyâ€™s terms and conditions. Please pay these customs duties using our secure form below and schedule delivery at a time that is convenient for you:Â Â

Access secure form

Failure to comply with this notice will result in your package being returned to the sender.

Important:Â Dragonfly may collect duties and taxes when required by border authorities.

Intelcom est maintenant Dragonfly!

Cher(e) client(e),

Un colis qui vous est destinÃ© a Ã©tÃ© retenu en raison du non-paiement des droits de douane applicables, conformÃ©ment aux conditions gÃ©nÃ©rales de l'Agence des services frontaliers du Canada. Veuillez rÃ©gler ces droits de douane Ã l'aide de notre formulaire sÃ©curisÃ© ci-dessous et choisir une heure de livraison qui vous convient :Â

--139dc9e2d192e62775ad5c3baa93d99ea--

Aramco based Nigerian spam

Posted by Dave Yadallee on Wednesday, June 10. 2026

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Wed, 10 Jun 2026 07:34:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wXJ46-00000000D7Z-2q10

for dave@doctor.nl2k.ab.ca;

Wed, 10 Jun 2026 07:33:54 -0600

Resent-From: The Doctor

Resent-Date: Wed, 10 Jun 2026 07:33:54 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from [160.187.143.98] (port=40560 helo=roob.crystalcorex.com)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wXHao-00000000LHe-47aj

for root@nl2k.ab.ca;

Wed, 10 Jun 2026 05:59:44 -0600

DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed;

d=rimaugroup.co.id; s=default; h=Content-Transfer-Encoding:Content-Type:

MIME-Version:Message-ID:Date:Subject:To:From:Reply-To:Sender:Cc:Content-ID:

Content-Description:Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc

:Resent-Message-ID:In-Reply-To:References:List-Id:List-Help:List-Unsubscribe:

List-Subscribe:List-Post:List-Owner:List-Archive;

bh=ezTyp9dJKStRIfNBj+icmouDCGqSfrzazmnhrFjF1qw=; b=Gc2lax+gwr0eqnJZG/mXBMHTTY

PlcrAL/LdI0iIw4Z+Hu/oshUKRZbXUXjRMuF4TEYGW8oey3pykMw2mwUBm+CHGmRt+22C9V2Y3fC2

bvJysyKRhvbeoDqF1mh9usK8MgdzOpc/WgAr6uRcbNWcczWI12rw7KYTyJEcuCmkgiyS7ShoaUgQ3

PW7x8NiWy1GoCsIC0z/e/6SHZ1kjNVgKEN/TTbCOAQUbu8bOw/hirLtfOmBzSYIVXDXqekq8ueYup

rzBQJC5t8N4sA/bsUaOp39SMwN+rnvHucp+7gNhmxvIG/LPTo5GPGQ1qY5ovU6GJSezCFpi4N5Q9Z

t0c1oKdg==;

Received: from [38.255.61.36] (port=49469 helo=rdcpharm.com)

by server.rimaugroup.co.id with esmtpsa (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

(Exim 4.99.4)

(envelope-from )

id 1wUMpD-0000000A76T-0PZ9

for root@nl2k.ab.ca;

Tue, 02 Jun 2026 16:28:22 +0530

Reply-To: raschidmario1@gmail.com

From: "Mr. Mario Raschid"

To: root@nl2k.ab.ca

Subject: Investment Project Venture

Date: 02 Jun 2026 12:58:20 +0200

Message-ID: <20260602125819.ECBCA509BE54A9F1@rdcpharm.com>

MIME-Version: 1.0

Content-Type: text/html

Content-Transfer-Encoding: quoted-printable

X-AntiAbuse: This header was added to track abuse, please include it with any abuse report

X-AntiAbuse: Primary Hostname - server.rimaugroup.co.id

X-AntiAbuse: Original Domain - nl2k.ab.ca

X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12]

X-AntiAbuse: Sender Address Domain - rdcpharm.com

X-Get-Message-Sender-Via: server.rimaugroup.co.id: authenticated_id: sherma.yunita@rimaugroup.co.id

X-Authenticated-Sender: server.rimaugroup.co.id: sherma.yunita@rimaugroup.co.id

X-Source:

X-Source-Args:

X-Source-Dir:

X-Spam_score: 16.0

X-Spam_score_int: 160

X-Spam_bar: ++++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.

Content preview: Saudi Aramco Ventures. Al-Midra Tower, 11th Floor, West Wing,

Dhahran 31311 Kingdom of Saudi Arabia Greetings,

Content analysis details: (16.0 points, 5.0 required)

pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[38.255.61.36 listed in will-spam-for-food.eu.org]

[38.255.61.36 listed in will-spam-for-food.eu.org]

[38.255.61.36 listed in will-spam-for-food.eu.org]

[38.255.61.36 listed in will-spam-for-food.eu.org]

[38.255.61.36 listed in will-spam-for-food.eu.org]

[38.255.61.36 listed in will-spam-for-food.eu.org]

[38.255.61.36 listed in will-spam-for-food.eu.org]

[38.255.61.36 listed in will-spam-for-food.eu.org]

[160.187.143.98 listed in will-spam-for-food.eu.org]

[160.187.143.98 listed in will-spam-for-food.eu.org]

[160.187.143.98 listed in will-spam-for-food.eu.org]

[160.187.143.98 listed in will-spam-for-food.eu.org]

[160.187.143.98 listed in will-spam-for-food.eu.org]

[160.187.143.98 listed in will-spam-for-food.eu.org]

[160.187.143.98 listed in will-spam-for-food.eu.org]

[160.187.143.98 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[160.187.143.98 listed in dnsbl.ahbl.org]

[160.187.143.98 listed in dnsbl.ahbl.org]

[160.187.143.98 listed in dnsbl.ahbl.org]

[160.187.143.98 listed in dnsbl.ahbl.org]

[38.255.61.36 listed in dnsbl.ahbl.org]

[38.255.61.36 listed in dnsbl.ahbl.org]

[38.255.61.36 listed in dnsbl.ahbl.org]

[38.255.61.36 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[160.187.143.98 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[160.187.143.98 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[160.187.143.98 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[160.187.143.98 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_SBL_XBL RBL: Received via a relay in Spamhaus SBL+XBL

[38.255.61.36 listed in sbl-xbl.spamhaus.org]

1.5 RCVD_IN_CBL RBL: Received via a relay in cbl.abuseat.org

[Listed by XBL, see ]

1.6 RCVD_IN_BRBL_LASTEXT RBL: No description available.

[160.187.143.98 listed in bb.barracudacentral.org]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[160.187.143.98 listed in bl.score.senderscore.com]

0.0 SPF_HELO_FAIL SPF: HELO does not match SPF record (fail)

[SPF failed: Rejected by SPF record.]

0.0 T_SPF_PERMERROR SPF: test of record failed (permerror)

0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in digit

[raschidmario1(at)gmail.com]

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 HTML_MESSAGE BODY: HTML included in message

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

1.3 RDNS_NONE Delivered to internal network by a host with no rDNS

0.0 HK_NAME_MR_MRS No description available.

2.5 FREEMAIL_FORGED_REPLYTO Freemail in Reply-To, but not From

2.0 MIXED_HREF_CASE Has href in mixed case

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

0.8 SARE_FROM_SPAM_WORD3 I don't know people named this!

1.0 VOWEL_URI_5 URI hostname with 5 consecutive vowels

0.5 VOWEL_FROM_5 Impronouncable from header (6 consecutive vowels)

0.0 FROM_MISSP_REPLYTO From misspaced, has Reply-To

0.0 FROM_MISSPACED From: missing whitespace

0.7 TO_NO_BRKTS_FROM_MSSP Multiple formatting errors

Subject: {SPAM?} Investment Project Venture

Saudi Aramco Ventures.
Al-Midra Tower, 11th Floor, West Wing,
Dhah=

ran 31311 Kingdom of Saudi Arabia

Greetings,

I hope this message finds you well.

I am writing to explore the possibility of a mutually beneficial busines=

s collaboration with your esteemed organization. We have identified a poten=

tially lucrative opportunity and would like to inquire whether you would be=

interested in acting as an agent partner in managing related business cont=

racts.

If this opportunity aligns with your interests, we would appreciate the =

chance to discuss it further.

For further information please feel free to contact me directly via emai=

l: raschidmario1@gmail.com
P>

Sincerely,
Mr. Mario Raschid,
Director of Sales/Business Developme=

nt
Saudi Aramco Ventures
Website:
om">https://aramcoventures.com

Dragonfly/Intelcom phish Part 1

Posted by Dave Yadallee on Wednesday, June 10. 2026

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Tue, 09 Jun 2026 21:05:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wX9FN-00000000LvP-2uhr

for dave@doctor.nl2k.ab.ca;

Tue, 09 Jun 2026 21:04:53 -0600

Resent-From: The Doctor

Resent-Date: Tue, 9 Jun 2026 21:04:53 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from [169.239.183.22] (port=42112 helo=bond.schaeffler.com)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wX7tZ-00000000E7d-3u4A

for sales@nk.ca;

Tue, 09 Jun 2026 19:38:21 -0600

Received: by bond.schaeffler.com (Postfix, from userid 33)

id 8A34DFE90E; Wed, 10 Jun 2026 03:33:49 +0200 (SAST)

Date: Wed, 10 Jun 2026 03:32:47 +0200

To: sales@nk.ca

From: =?UTF-8?Q?Dragonfly_Notification=C2=AE?=

Reply-To: noreply@dragonflyshipping.com.ca

Subject: =?UTF-8?Q?Your_package_has_been_held_by_the_CBSA_due_to_unpaid_customs_du?=

=?UTF-8?Q?ties._/_Votre_colis_a_=C3=A9t=C3=A9_retenu_par_l=E2=80=99ASFC_e?=

=?UTF-8?Q?n_raison_de_droits_de_douane_impay=C3=A9s.?=

Message-ID: <8a5b8afa108a7eb17a7e5774c5f18b0c@dragonflyshipping.com.ca>

List-Unsubscribe: mailto:bounce770-iHaHqGsA4T80jqS@dragonflyshipping.com.ca?subject=list-unsubscribe

MIME-Version: 1.0

Content-Type: multipart/alternative;

boundary="139dc9e2d192e62775ad5c3baa93d99ea"

Content-Transfer-Encoding: 8bit

X-Spam_score: 7.1

X-Spam_score_int: 71

X-Spam_bar: +++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.

Content preview: French version follows Intelcom is now Dragonfly!

Content analysis details: (7.1 points, 5.0 required)

pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[169.239.183.22 listed in will-spam-for-food.eu.org]

[169.239.183.22 listed in will-spam-for-food.eu.org]

[169.239.183.22 listed in will-spam-for-food.eu.org]

[169.239.183.22 listed in will-spam-for-food.eu.org]

[169.239.183.22 listed in will-spam-for-food.eu.org]

[169.239.183.22 listed in will-spam-for-food.eu.org]

[169.239.183.22 listed in will-spam-for-food.eu.org]

[169.239.183.22 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[169.239.183.22 listed in dnsbl.ahbl.org]

[169.239.183.22 listed in dnsbl.ahbl.org]

[169.239.183.22 listed in dnsbl.ahbl.org]

[169.239.183.22 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[169.239.183.22 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[169.239.183.22 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[169.239.183.22 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[169.239.183.22 listed in dnsbl.ahbl.org]

2.5 URIBL_DBL_PHISH Contains a Phishing URL listed in the DBL blocklist

[URI: scanned.page]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

0.0 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level mail

domains are different

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[169.239.183.22 listed in bl.score.senderscore.com]

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 HTML_MESSAGE BODY: HTML included in message

1.3 RDNS_NONE Delivered to internal network by a host with no rDNS

0.0 SARE_FROM_SPAM_WORD4 From address suggests this may be spam

Subject: {SPAM?} =?UTF-8?Q?Your_package_has_been_held_by_the_CBSA_due_to_unpaid_customs_du?=

=?UTF-8?Q?ties._/_Votre_colis_a_=C3=A9t=C3=A9_retenu_par_l=E2=80=99ASFC_e?=

=?UTF-8?Q?n_raison_de_droits_de_douane_impay=C3=A9s.?=

Mon	Tue	Wed	Thu	Fri	Sat	Sun
← Back	June '26					Forward →
1	2	3	4	5	6	7
8	9	10	11	12	13	14
15	16	17	18	19	20	21
22	23	24	25	26	27	28
29	30