PersistIQ spam from Google Gmail

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Tue, 26 May 2026 07:02:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wRrPG-00000000PoI-2NSg

for dave@doctor.nl2k.ab.ca;

Tue, 26 May 2026 07:01:14 -0600

Resent-From: The Doctor

Resent-Date: Tue, 26 May 2026 07:01:14 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-qk1-f176.google.com ([209.85.222.176]:42272)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wRppW-00000000KO1-3rcp

for root@nk.ca;

Tue, 26 May 2026 05:20:22 -0600

Received: by mail-qk1-f176.google.com with SMTP id af79cd13be357-914db83362aso215388885a.1

for ; Tue, 26 May 2026 04:19:28 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=persistiqengagehub.pro; s=google; t=1779794362; x=1780399162; darn=nk.ca;

h=mime-version:date:content-transfer-encoding:subject:to:from

:message-id:from:to:cc:subject:date:message-id:reply-to;

bh=4bcWKJxvKnQ0gV5dk3Zf1LnR1GA3A5NLvcE/1jwVTCA=;

b=ONzJymUiyk60gEhw3ADLd2Pfdd5RrFTbqGftHwrSiurzwJwJYG5cj3MYLMt7b0BAYa

B7TK6Na2QcKFFXn197PbBLLBWt7Z2ufSE+BOmsdJgxH0vDXruSoXXsCo9QE+4vOB8KMD

1K3M7HJNgwTYSfzaWnEaZ9GntFxLEa7kLZgX8IJPxLOBEf50tfPc20wSAbjxW7nXxTpP

Fljf94qLwr/YTA5j+YVaH/k6M+59x5HeNqRO2JwOSlQofW7cD5gRBADzVn12EPcXMaO7

lmNW2vZzfniY2rDaqHsdPuhvAKtz6NvWz/dr2EfYmL0I2CPD1rjRDosr5uyXc9RrDMeB

XisA==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20251104; t=1779794362; x=1780399162;

h=mime-version:date:content-transfer-encoding:subject:to:from

:message-id:x-gm-gg:x-gm-message-state:from:to:cc:subject:date

:message-id:reply-to;

bh=4bcWKJxvKnQ0gV5dk3Zf1LnR1GA3A5NLvcE/1jwVTCA=;

b=lCy6InvppDyP3ig8DPofR54HJvCkN9QLuSPIsKAfGKY6IrPV9ZGxMH4Km4zPyd0zwD

RaoQaaQ0c5RI40aBAvecUyUJYmxTjGJg1nsCJf+NwNKvRzBiZYxqxQRKZNC5VK0Il7Ih

JP1LlflQ2lqio5A3daEB24bgGrNs45fFzQeFwAF8h3dIZbAc/K01DPnhlxAYUx/W41dJ

mQ57wCF0ul+9i3L7P2K8qUNujMCLeoyPovswb+0+whuHUgaEVYWSi9o06/x9a9lNavjs

EYeTDYgkp/YGuAmbn3TN8U8qne/8NCEwT7MxOzu88WYOLtnwC9cfI7rHIoL+tEGR2UD3

Ycjg==

X-Gm-Message-State: AOJu0Yw8GFYyh0+XOUMPPXNgHZHjqyJCCA8yZSAlV6pzGyqAr64QVHzk

8mWG8rr1kdwUdu6us7IF+1GaJUmk+sDVG5epfKnM+GF+CAEoVMZVmYd8tRxKGT3zBRU1ayOVpRh

vdx1+CQ==

X-Gm-Gg: Acq92OEJnLo9n/jaAqW+viVMaQyZH1YwQ9iZQcdXbWdwsp0oouYZevDuUuZDF96SHMM

CHSD4hvbaaJFeGEBPS7PuEnz9DmNZuKdghlxg5yaeff0soD6H5e4P2toVVmNXq+nnE17YLS1Ybm

gy/Gj+WEC9tDtXTz1gFl7YeOuYSEJKHROJsX8vfVJ2J1wHAW1wldYoodASfaRHTPL5HQu1Zt7Iy

by/evWqta7oEnw2101Ud/DN/v82JREsyp2NVbdV2WhP1+rm2XfcmVM5gLYwcUi8Qk93HqWcl5/b

FcCelZFJxyMG+YdS51DAspZ6Z0BE329Dodj2G8Ug1cdjGv8K1PsPXDSFlP8VPf+WrMpczIemlUA

OOIB/UXVbkaGSkxjdLc0bCTT1LkklamyVrfA3P2l6s3SbqReBraZlQWKyJ4FKEwsubLgAl/9iPz

IkyhVYSXreQAHGp7S7vnpFh/OORjw5i4IZ5gY2kJYDPUsvNJ9q8Ytzixe9+nLmR97yJ9AvG9EFR

+/tIQ1+NYOWLp0DB2ohl/rExpCajqnMf3LILeHJGZJlwKehJhCaAbxSyTiDdnUJsqyQ

X-Received: by 2002:a05:620a:4506:b0:8eb:41de:fb38 with SMTP id af79cd13be357-914b50420dcmr2149417285a.7.1779794351677;

Tue, 26 May 2026 04:19:11 -0700 (PDT)

Received: from 019e6402-917a-72ec-a3fc-49447cea5f56.local (ec2-3-236-19-255.compute-1.amazonaws.com. [3.236.19.255])

by smtp.gmail.com with ESMTPSA id af79cd13be357-914f86e8e1esm183540285a.7.2026.05.26.04.19.10

for

(version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256);

Tue, 26 May 2026 04:19:10 -0700 (PDT)

Message-ID: <019e6402-917a-72ec-a3fc-49447cea5f56@persistiqengagehub.pro>

X-Mail-Abuse-Inquiries:

https://app.instantly.ai/privacy/report-abuse/019e6402-917a-72ec-a3fc-49447cea5f56

From: Bella Powell

To: root@nk.ca

Subject: about internet services clients

Content-Transfer-Encoding: quoted-printable

Date: Tue, 26 May 2026 11:19:10 +0000

MIME-Version: 1.0

Content-Type: text/plain; charset=utf-8

X-Spam_score: 7.0

X-Spam_score_int: 70

X-Spam_bar: +++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Hey, Came across NK, and wanted to check if you are looking

to bring in more clients for internet services? If yes, worth a quick chat

to see how we can help?



Content analysis details: (7.0 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[3.236.19.255 listed in dnsbl.ahbl.org]

[3.236.19.255 listed in dnsbl.ahbl.org]

[3.236.19.255 listed in dnsbl.ahbl.org]

[3.236.19.255 listed in dnsbl.ahbl.org]

[209.85.222.176 listed in dnsbl.ahbl.org]

[209.85.222.176 listed in dnsbl.ahbl.org]

[209.85.222.176 listed in dnsbl.ahbl.org]

[209.85.222.176 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[3.236.19.255 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[3.236.19.255 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[3.236.19.255 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[3.236.19.255 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[3.236.19.255 listed in will-spam-for-food.eu.org]

[3.236.19.255 listed in will-spam-for-food.eu.org]

[3.236.19.255 listed in will-spam-for-food.eu.org]

[3.236.19.255 listed in will-spam-for-food.eu.org]

[3.236.19.255 listed in will-spam-for-food.eu.org]

[3.236.19.255 listed in will-spam-for-food.eu.org]

[3.236.19.255 listed in will-spam-for-food.eu.org]

[3.236.19.255 listed in will-spam-for-food.eu.org]

[209.85.222.176 listed in will-spam-for-food.eu.org]

[209.85.222.176 listed in will-spam-for-food.eu.org]

[209.85.222.176 listed in will-spam-for-food.eu.org]

[209.85.222.176 listed in will-spam-for-food.eu.org]

[209.85.222.176 listed in will-spam-for-food.eu.org]

[209.85.222.176 listed in will-spam-for-food.eu.org]

[209.85.222.176 listed in will-spam-for-food.eu.org]

[209.85.222.176 listed in will-spam-for-food.eu.org]

1.9 URIBL_JP_SURBL Contains an URL listed in the JP SURBL blocklist

[URI: persistiqengagehub.pro]

1.9 URIBL_ABUSE_SURBL Contains an URL listed in the ABUSE SURBL blocklist

[URI: persistiqengagehub.pro]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[209.85.222.176 listed in list.dnswl.org]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-0.0 SPF_PASS SPF: sender matches SPF record

0.0 PDS_PRO_TLD .pro TLD

[URI: persistiqengagehub.pro (pro)]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[209.85.222.176 listed in bl.score.senderscore.com]

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

2.0 RATWR8_MESSID Message-ID with excessive dashes and dollars

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[209.85.222.176 listed in wl.mailspike.net]

Subject: {SPAM?} about internet services clients



Hey,



Came across NK, and wanted to check if you are looking to bring in =

more clients for internet services?



If yes, worth a quick chat to see how =

we can help?



-Bella



Thanks,

Bella

PersistIQ

422 Richards St, Suite 170. =

Vancouver, BC V6B 2Z4

P.S. Please let me know if you don't want to hear =

from me again

=C2=A0

PersistIQ spam from Google Gmail

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Tue, 26 May 2026 07:02:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wRrPL-0000000004f-287v

for dave@doctor.nl2k.ab.ca;

Tue, 26 May 2026 07:01:19 -0600

Resent-From: The Doctor

Resent-Date: Tue, 26 May 2026 07:01:19 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-qk1-f173.google.com ([209.85.222.173]:43156)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wRppP-00000000KNq-0BGQ

for root@nk.ca;

Tue, 26 May 2026 05:20:15 -0600

Received: by mail-qk1-f173.google.com with SMTP id af79cd13be357-90ca6f20872so1323358185a.0

for ; Tue, 26 May 2026 04:19:17 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=persistiqengagehub.pro; s=google; t=1779794352; x=1780399152; darn=nk.ca;

h=mime-version:date:content-transfer-encoding:subject:to:from

:message-id:from:to:cc:subject:date:message-id:reply-to;

bh=4bcWKJxvKnQ0gV5dk3Zf1LnR1GA3A5NLvcE/1jwVTCA=;

b=X5Lh3gOdOAOo3mRwfktPKJ7lyqVHLEV5F4TPXAzHmHhPtxBz/BMxyEtMiflw6JWQb3

rcwfci1icDlBbBYHzxAZXxm8+nRruFBmlnIVV4ApkKHc7CQKf2QhBWWKnhjcULfyxFwd

8WxHzOJsL8Dzcw6faX+r5f9izsHlzyNGj0Wv7QafzqF45Spc5XjGrIRq+JtOjErPW8zv

0elTh2kajfE1WUUvjvUmBYvhTVSzdWaOcOhHHHUpYSPRzKg+/PnNMi8coTFmT9hb4naa

m5DfynOmoSB1th2ZzGweD02u773ZYYTQKAAdL1N5vLOMsBo6sxLicPrA+yGKAys/uyZv

6fsg==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20251104; t=1779794352; x=1780399152;

h=mime-version:date:content-transfer-encoding:subject:to:from

:message-id:x-gm-gg:x-gm-message-state:from:to:cc:subject:date

:message-id:reply-to;

bh=4bcWKJxvKnQ0gV5dk3Zf1LnR1GA3A5NLvcE/1jwVTCA=;

b=jc9Tju0lHg5ZL79NJJX+CuXbQWnSrDa63c3OgAyd2jRk8e5Py4zT19J4Bwi2/4aoDq

G2CsLvWDJlU7WbSLLoI2Gry47asWmhXSzkP/v2I3vMYuXhI4UQyESGRU5uiZTG2V6Vy2

LmZQ4Rp/SY5h/iGy+aXLL2bwv1xNgexpYvMYADS+y20hotQGr6PiSr6XZI1sOZUCgaEW

LInI5gcZv8gxhxqSieXSij6/TzIUOuodfBGhxMsG64hQmDeju08mStyRaPq0bqVTTDSY

uNXtU/PQkq0oV3H4zqBpl8XIJkpEdXcrHHrWjWqcqTz4XQYpedmZOHBZkjAQNxqYJKVn

8V4g==

X-Gm-Message-State: AOJu0YwXLHlFkvu7c5EPVgbq6PHz0pHK9xXbNiFdAMayl0nL8aEVPpQT

midlk+tm4dP8b+xlakFd4fGs+m2tfr7qQmxA2n1mwEfLt0fO/wlXjxhnuKK8owGnLFucfo1GuY+

O3g/kTw==

X-Gm-Gg: Acq92OF7zLPN3j6HXFJPHxwg6hjYxVkeDoJWZX2Ud4aidoQwQFCz5zbcn1+TaMWUA96

Nv037wNgrj5UBx7rkz/4IXrqc8zwBdwivzAdu6YJYFISFQXIIf3on1Sjxpw+KGJYXADZBMHQTDf

yoPXWndaCLqM1ilb4QTw8uycXrTPLG7nudCSv9uQCvIr6zjbMovjh8mIZrmQ7iqWoS0a1GX6ooh

0681vuZK1A7ZnAJ7l+zLcv4xAdPdhHI6RD1xd345V8avmE5n/4jGI20/jVNOrTGDHCzbud8Utv4

K67U/YHVvOOGoVQdW/kaYiNiO/qvtiVMq98vDfr0vZf7alK94djqx9ZbzXXYslhBG83m1MfOBAE

6GqZWepJFdMulgzQO7V8VR7RziVNOve3KVXwZywWqqwCy9d5FvRdkJvSOK0dxh+OuN+aEorJdJi

F0RZMyH75ivx6BpMdKRyBZCzziqk11P9QoiuuULeZuEQ0PUlnYf+Z03fmRGKYqAk34z8aKrJOT1

Cm1wYhpOmFLZNiO2Z74oOP07uERNMET+gIzTd2DBraqaSHBLM9Lsa0Nww==

X-Received: by 2002:a05:620a:4506:b0:8eb:41de:fb38 with SMTP id af79cd13be357-914b50420dcmr2149417285a.7.1779794351677;

Tue, 26 May 2026 04:19:11 -0700 (PDT)

Received: from 019e6402-917a-72ec-a3fc-49447cea5f56.local (ec2-3-236-19-255.compute-1.amazonaws.com. [3.236.19.255])

by smtp.gmail.com with ESMTPSA id af79cd13be357-914f86e8e1esm183540285a.7.2026.05.26.04.19.10

for

(version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256);

Tue, 26 May 2026 04:19:10 -0700 (PDT)

Message-ID: <019e6402-917a-72ec-a3fc-49447cea5f56@persistiqengagehub.pro>

X-Mail-Abuse-Inquiries:

https://app.instantly.ai/privacy/report-abuse/019e6402-917a-72ec-a3fc-49447cea5f56

From: Bella Powell

To: root@nk.ca

Subject: about internet services clients

Content-Transfer-Encoding: quoted-printable

Date: Tue, 26 May 2026 11:19:10 +0000

MIME-Version: 1.0

Content-Type: text/plain; charset=utf-8

X-Spam_score: 7.0

X-Spam_score_int: 70

X-Spam_bar: +++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Hey, Came across NK, and wanted to check if you are looking

to bring in more clients for internet services? If yes, worth a quick chat

to see how we can help?



Content analysis details: (7.0 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[209.85.222.173 listed in dnsbl.ahbl.org]

[209.85.222.173 listed in dnsbl.ahbl.org]

[209.85.222.173 listed in dnsbl.ahbl.org]

[209.85.222.173 listed in dnsbl.ahbl.org]

[3.236.19.255 listed in dnsbl.ahbl.org]

[3.236.19.255 listed in dnsbl.ahbl.org]

[3.236.19.255 listed in dnsbl.ahbl.org]

[3.236.19.255 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[209.85.222.173 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[209.85.222.173 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[209.85.222.173 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[209.85.222.173 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[3.236.19.255 listed in will-spam-for-food.eu.org]

[3.236.19.255 listed in will-spam-for-food.eu.org]

[3.236.19.255 listed in will-spam-for-food.eu.org]

[3.236.19.255 listed in will-spam-for-food.eu.org]

[3.236.19.255 listed in will-spam-for-food.eu.org]

[3.236.19.255 listed in will-spam-for-food.eu.org]

[3.236.19.255 listed in will-spam-for-food.eu.org]

[3.236.19.255 listed in will-spam-for-food.eu.org]

[209.85.222.173 listed in will-spam-for-food.eu.org]

[209.85.222.173 listed in will-spam-for-food.eu.org]

[209.85.222.173 listed in will-spam-for-food.eu.org]

[209.85.222.173 listed in will-spam-for-food.eu.org]

[209.85.222.173 listed in will-spam-for-food.eu.org]

[209.85.222.173 listed in will-spam-for-food.eu.org]

[209.85.222.173 listed in will-spam-for-food.eu.org]

[209.85.222.173 listed in will-spam-for-food.eu.org]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[209.85.222.173 listed in list.dnswl.org]

1.9 URIBL_ABUSE_SURBL Contains an URL listed in the ABUSE SURBL blocklist

[URI: persistiqengagehub.pro]

1.9 URIBL_JP_SURBL Contains an URL listed in the JP SURBL blocklist

[URI: persistiqengagehub.pro]

-0.0 SPF_PASS SPF: sender matches SPF record

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

0.0 PDS_PRO_TLD .pro TLD

[URI: persistiqengagehub.pro (pro)]

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

2.0 RATWR8_MESSID Message-ID with excessive dashes and dollars

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[209.85.222.173 listed in wl.mailspike.net]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[209.85.222.173 listed in bl.score.senderscore.com]

Subject: {SPAM?} about internet services clients



Hey,



Came across NK, and wanted to check if you are looking to bring in =

more clients for internet services?



If yes, worth a quick chat to see how =

we can help?



-Bella



Thanks,

Bella

PersistIQ

422 Richards St, Suite 170. =

Vancouver, BC V6B 2Z4

P.S. Please let me know if you don't want to hear =

from me again

=C2=A0

Web/sEO/App spam from Microsoft Outlook PArt 2

Please let me know if you'd be open to a quick discussion this week to expl=

ore how we can support your team.







Best regards,



Ravika Sharma



From: Ravika Sharma

Sent: Friday, May 22, 2026 5:48 PM

To: Ravikasharma@hotmail.com

Subject: Complete remote business support - from calls to campaigns



Hi,



If your business is growing fast but managing the workload feels chaotic - =

we can help.



Our team supports you remotely with:



Admin assistance & calendar management

Calling & appointment setting

Customer & client support

Marketing, design & social media

Bookkeeping & back-office coordination

Web & app support



We work as an extension of your in-house staff, keeping things organized an=

d running smoothly.



Would you like to see how this model could improve your team's efficiency?



Thanks,

Ravika Sharma



--_000_TY0PR0101MB4190520AA7314E73C195B4E7CD0B2TY0PR0101MB4190_

Content-Type: text/html; charset="us-ascii"

Content-Transfer-Encoding: quoted-printable




osoft-com:office:office" xmlns:w=3D"urn:schemas-microsoft-com:office:word" =

xmlns:m=3D"http://schemas.microsoft.com/office/2004/12/omml" xmlns=3D"http:=

//www.w3.org/TR/REC-html40">




>








break-word">



Hi,



 



Just following up on my previous email regarding =

our remote support services.



 



We can help your business save time with appoi=

ntment scheduling, admin support, customer service, marketing campaigns, so=

cial media management, and development assistance.



 



Please let me know if you’d be open to a=

quick discussion this week to explore how we can support your team.
o:p>



 



Best regards,



Ravika Sharma



 
span>






0in 0in">


e">From:
Rav=

ika Sharma




Sent: Friday, May 22, 2026 5:48 PM


To: Ravikasharma@hotmail.com


Subject: Complete remote business support — from calls to camp=

aigns







 



Hi,




t;,serif"> 



If your business is growing fast but managing the wo=

rkload feels chaotic — we can help.




t;,serif"> 



Our team supports you remotely with:






• Admin assistance & calendar management


• Calling & appointment setting


• Customer & client support


• Marketing, design & social media


• Bookkeeping & back-office coordination


• Web & app support




t;,serif"> 



We work as an extension of your in-house staff, keep=

ing things organized and running smoothly.






Would you like to see how this model could improve your team’s effici=

ency?




t;,serif"> 



Thanks,


Ravika Sharma











--_000_TY0PR0101MB4190520AA7314E73C195B4E7CD0B2TY0PR0101MB4190_--

Web/sEO/App spam from Microsoft Outlook PArt 1

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Tue, 26 May 2026 07:01:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wRrP2-00000000PKQ-1DIw

for dave@doctor.nl2k.ab.ca;

Tue, 26 May 2026 07:01:00 -0600

Resent-From: The Doctor

Resent-Date: Tue, 26 May 2026 07:01:00 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-koreacentralazolkn19013086.outbound.protection.outlook.com ([52.103.74.86]:41649 helo=SEYPR02CU001.outbound.protection.outlook.com)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wRpiC-00000000K6K-3fk8

for root@nk.ca;

Tue, 26 May 2026 05:12:51 -0600

ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none;

b=BKAwojsAQA2tCN2NU0XK99/eicqVHVKL27inKZ1qw8ny3IEtiwWe/zsrHiFDOaKkFRncVvrQxIbALT1jY43b42dr7gVLQzBR96GtmiCOMotikbefX+FAOVRymYYiPDTU7mU1MMUJCfEJr4rEcI5K+DlMNc7s+zkMgTy8PmfUdfkcl9/oZNEBBC/FK/bjwsB4JzsILYstr7TsAJ/UDbWlD7txA7pBOJ0Pnomj2Bj6m0RGTKguUjYXkMifJll4ap+RAnOsdYe/Nj0DiykfFuAC+u+tYVKVu9zHVbzPPDt54XKhFIiXVRW7dtEi/zOoKanlZb/w8iVbUchNQy3w5NFYkA==

ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;

s=arcselector10001;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1;

bh=x+aDjBPVI4zhMFjWdz9kKNH/Wwe8pK19kIj+ERWMTVM=;

b=YfLFZGPnAAaCwJOqEPzSRWcRogKD0N8q5vtDDi9bD0/ga7ahNtwRS/oaArqBOLFyXOWdKoMYoFaaYEn3Fo5V2khhGX7yjDdKU53lI/kbNmZhTjaeCNBYT16LQxt+L7nHOflp9v9NYEQCAhX6Q1Nth7+g99IKSdSpP6Byg0+BElGqeQZ8tfCgcoxNrIJ7bLo6YbrLRF+/k+Kq0fv2Uprt9T7A4R8ppUBy8DTRExKH/v1Q5JGvbz4EbdsPusMn5iSaDYtFoqojSNMoT+qVh9vDCz8tLg2PdVN0FMZHOf0wVzfwD82SL4ENt9ildxrSvR2hQenn4TAGITWHx3uKrveFlA==

ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=none; dmarc=none;

dkim=none; arc=none

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=hotmail.com;

s=selector1;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck;

bh=x+aDjBPVI4zhMFjWdz9kKNH/Wwe8pK19kIj+ERWMTVM=;

b=exmkCPWUGFY4pZzEcNpSuDwg6ITDIL9J4Db8ZIhtVRo0Qg2OJT7PVI44yw6GTQVOw8nP5YqSD2J9OWIcmc8cg2yw224NArXoMecfSY2h64dFewGnjq/x7nQ8RMUEMnkHmLqbdZRjp8pAnu43R16D7AZELM4Q0J4r1le/Fl1GVwCJjKxXHh+r/Wjn2lKP9mraUUd+eSXk+mPrMurQsYuuneAAmybd5yFP/ipoVavnyQ28U36EK7uqqh7Lj81NJffcnl/xz7If7lQGd0uWvaSSjtP3VJwDwXT3PRhGC/Y+79zhSv5G1+h0VbqhmHXOk+cBfaa96H5udtbNXygU5OqFuQ==

Received: from TY0PR0101MB4190.apcprd01.prod.exchangelabs.com

(2603:1096:400:1ba::7) by JH0PR01MB5707.apcprd01.prod.exchangelabs.com

(2603:1096:990:f::6) with Microsoft SMTP Server (version=TLS1_2,

cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.48.20; Tue, 26 May

2026 11:10:52 +0000

Received: from TY0PR0101MB4190.apcprd01.prod.exchangelabs.com

([fe80::84f6:d86:b78d:fd11]) by

TY0PR0101MB4190.apcprd01.prod.exchangelabs.com ([fe80::84f6:d86:b78d:fd11%6])

with mapi id 15.21.0048.019; Tue, 26 May 2026 11:10:52 +0000

From: Ravika Sharma

To: Ravika Sharma

Subject: Re: Follow-Up: Campaign & Social Media Support

Thread-Topic: Follow-Up: Campaign & Social Media Support

Thread-Index: AQHc7QBPPuk55WJiekOSCze6jCMT2g==

Disposition-Notification-To: Ravika Sharma

Date: Tue, 26 May 2026 11:10:51 +0000

Message-ID:



References:

















In-Reply-To:



Accept-Language: en-US

Content-Language: en-US

X-MS-Has-Attach:

X-MS-TNEF-Correlator:

x-ms-publictraffictype: Email

x-ms-traffictypediagnostic: TY0PR0101MB4190:EE_|JH0PR01MB5707:EE_

x-ms-office365-filtering-correlation-id: 2e859448-f7eb-4319-5c15-08debb177278

x-microsoft-antispam:

BCL:0;ARA:14566002|15080799012|48001999003|31061999003|19110799012|13091999003|8060799015|8062599012|51005399006|24021099003|2604032081799003|22091999003|24121999003|55001999006|37011999003|3412199025|440099028|31101999003|12091999003|102099032|40105399003|1710799026;

x-microsoft-antispam-message-info:

=?us-ascii?Q?O5DauhPzMAWM7e4zQwfuSQk1igUZox8MKu35hBGLetyjoKnHv1D9GyeJilxV?=

=?us-ascii?Q?OxWwz9/5q6vHPfpVgkFGvCB3G9NsXaHagEHn5xvOjPoeMqxr2Ixb5BLqxH/u?=

=?us-ascii?Q?LEf+HZjP1bV6pwlqkuJEhAJUK00baP+UXYV4hjlZxUANn/x938SCIybjuzm4?=

=?us-ascii?Q?mp0BrxwaJZawZTOvz9rCvrA+8u3zX55OxZxvYVPI93qcsk4PNIb3Ly4hbKGm?=

=?us-ascii?Q?6YVdJn0ckGsFLX6jMuKD0YS0NbB5sUWMhROfZuwl3CuM1kwi2SxFbkGzHBP0?=

=?us-ascii?Q?9EIFMpilb+Nfgeis+RZd3dpsUR6VRNv81NWKe0XxF3ZgxgiPSZsgVVNxnOvv?=

=?us-ascii?Q?yywucB40uamRoJqLlKN23cI18bzBFP+Wgp/vTMlghbcY3uP6It/026DrbhrP?=

=?us-ascii?Q?lxZugWoYScMmThmkpyDGAOQqJnkp3c73iQ/g/oH4t7W4pReI6B6diKiNr8lg?=

=?us-ascii?Q?mi8WLaTiG84kHmScQH8orLbb1pe917OzyDhsOMIkWLOPCCj85Wxl/Kr1xJwy?=

=?us-ascii?Q?GsXN/58J3LNNWhHDEfChoBRLiJSlppvwmJ4bJicIHTSCdVp2WCdp4R5lY343?=

=?us-ascii?Q?o3RAJr9i1pRu74Ow/qOAyiGTQB48a/hrWu2Xv8knXqGBwzOwj9rjHRTnYVlu?=

=?us-ascii?Q?gQLOVvMAmmVvSILD+Qk48diMicHsi+VFus1eI9dZxbm49QXlcaICOgrbUsNb?=

=?us-ascii?Q?pHEkHcklXH24OrMfSwGrL1vKatZPrwIuuxhl5ygJFM9GCfnTsMc6bPKGVs9o?=

=?us-ascii?Q?98h3G+P/3MycjY5sFXbc9iVJ9RJRa/M9enT8XNEARBTQ5VlpIevn1VPx9Tkl?=

=?us-ascii?Q?143RDM2VHaZFJ66gnxFdVxFWtfw6jk0Z3oEPjJf+DnwlzgaiF538ygpVYaXj?=

=?us-ascii?Q?Ori/3Kx2opUZG3RUMP1ZEPUJ+jU58xRTgH9Az4Pz1xHIRr4UZM/EFTXiKWNX?=

=?us-ascii?Q?CLgrWgylbyXIJVBrl+MNBiPEg11xWG/n+U3SiN3WRBvKkiln5ryp1q+jAb+m?=

=?us-ascii?Q?yScd31llvLYZy1Fg2Elg7Gcudk+Ux1bbF3gpTF/Q/bmhn2bUGkYP2rGlO+tR?=

=?us-ascii?Q?rxmJdDCV/9TenBgNOCci6jI/cNM2GP9XLijsopaGJrymdrrBO6S5A2HHdxQG?=

=?us-ascii?Q?soo79lmC7DelsNxmHEalMFi4IfyJH79F5EZ1QvvqhAnXrOxoeWzw/hRczGjp?=

=?us-ascii?Q?WeNdoQ1QRKeF6FkUhI26lA2d07P+jNNZFQxoiGtHBn97T6Lnw23kLEL68eEk?=

=?us-ascii?Q?35k8cRgw5tWqrlKImzVY?=

x-ms-exchange-antispam-messagedata-chunkcount: 1

x-ms-exchange-antispam-messagedata-0:

=?us-ascii?Q?tv2esgh9P8D+tfzpHSI7a33nWIkBq5yrDp4dVbmPvrz9MYkkZrpBAVo1gPN2?=

=?us-ascii?Q?+ZJ9/LnS/cVTqDNu+UCBKWJcyEqRmxphkv/1e1ffoDI3aS5Qbuh85pc2at4K?=

=?us-ascii?Q?38LRUyuJ97jW8IUDEkwlRbpKyw3yvazy1iLm+IN2Ibyp33vg5C5UJgL+X8rC?=

=?us-ascii?Q?yabOe1Jmi4G5UFPRDVVzOgDMcnw+9I7hOvNOdrDlRg4blhJq81XNPfx5uIY1?=

=?us-ascii?Q?CXVZqU4meUNGKjdBHCbsRfIgcIIw/qWi4HoY5TFCyWwTm8jACNWrYE5H1Nbf?=

=?us-ascii?Q?8FWJxPNQbOcpPEizAqBfALjfMvcaRGvtUxiIHRg7lzR6BejjVOlz160BGQjM?=

=?us-ascii?Q?XhQQy8DKoJqEd9A27qDkWUxFlSbYaZqGE6H+Qje+vhsDcwziNXjdFz8sOEbS?=

=?us-ascii?Q?84iwO3KBineC/HgKAaH7SgSDthY7xTO8wJkuCglixtDlw9GpE5i75ZaoTgd1?=

=?us-ascii?Q?FNfw1XuI0CHayAnsWaj/Z0fXC/gv2fsP8RQ3ffzJatvZ1eHaiTTboTUKWtWk?=

=?us-ascii?Q?CgDa5Woln8w8KdSyyRlYVo19fRAZqbgqfrwkADJYxQbU7OGAq/n8s+VX9Pq6?=

=?us-ascii?Q?0cvqiqzq/H34zSyL5LzgIhdAcstiItc0VIziKkS1f3RjuEoPTPYthpJRSpDe?=

=?us-ascii?Q?7p9c5wln8cSz4hOIgXnPejmt4fTxfpOLpNxcAw5i5yPRILlyuSlusH/ffvBb?=

=?us-ascii?Q?1M+L4316xt6+wQsFm85+FLYRiw3ghkhFliHOvHxdBgEb9YeHpeyli+aLvYpK?=

=?us-ascii?Q?4d/Pw9W7eapwrYTztslQ+EqU2u0YZ+g6wn5eDAM8aEvicI/kjAgJbpfPHj9y?=

=?us-ascii?Q?baNfNU7bn2fw29YjxlyghlGzmCvo3r98tpmCou0h55J0RR8g3xyA7QFwsvel?=

=?us-ascii?Q?3YlMk4rEckyxMKrZtucuDuikUSXf6szzzc+n2gItgLdPIF62WUedEDmhWh8O?=

=?us-ascii?Q?x4IcT8FGRwnRurJJmXv2iOpIK4iemkEaaadENEfoBsp2mO8Hlv+f6stixx8W?=

=?us-ascii?Q?U/aQgD7WijCcd6+qzT6K8PcWIr3BEL9MzId06/f8hClzhuXyXsIyqtqkwqVQ?=

=?us-ascii?Q?WiSTYgKBFZ611OxToulI8uD9oKK/s1fR/c92nsijRCib2U2FsTq72eDsvZ4b?=

=?us-ascii?Q?mMd4xNY9XsXmF6NIR4L5/e2dthbZopDxCRFKV8QfE8TI3DjQ5cNI0JSC+i6n?=

=?us-ascii?Q?5Am1VMIZhIJGwuZ/U97n67chcu3Nj1/JInHDMsZpZ4WjEciaAxEO8MdUzwV5?=

=?us-ascii?Q?OL0U2JUY3+vqfteXE0GfqtQsPbN9Ifo2W+/FBQZcolcdPlXhRCQJ8eEBOXUG?=

=?us-ascii?Q?xrFaWu6XoB0WaQdzG5w86EJNHYRjYzQj9Dl/5NMvsXZvE63/lidjTyiyDMN2?=

=?us-ascii?Q?AwivXUM4MPdoEWuh4WSffiLeUYq4?=

Content-Type: multipart/alternative;

boundary="_000_TY0PR0101MB4190520AA7314E73C195B4E7CD0B2TY0PR0101MB4190_"

MIME-Version: 1.0

X-OriginatorOrg: sct-15-20-9412-4-msonline-outlook-3e488.templateTenant

X-MS-Exchange-CrossTenant-AuthAs: Internal

X-MS-Exchange-CrossTenant-AuthSource: TY0PR0101MB4190.apcprd01.prod.exchangelabs.com

X-MS-Exchange-CrossTenant-RMS-PersistedConsumerOrg: 00000000-0000-0000-0000-000000000000

X-MS-Exchange-CrossTenant-Network-Message-Id: 2e859448-f7eb-4319-5c15-08debb177278

X-MS-Exchange-CrossTenant-originalarrivaltime: 26 May 2026 11:10:51.2231

(UTC)

X-MS-Exchange-CrossTenant-fromentityheader: Hosted

X-MS-Exchange-CrossTenant-id: 84df9e7f-e9f6-40af-b435-aaaaaaaaaaaa

X-MS-Exchange-CrossTenant-rms-persistedconsumerorg: 00000000-0000-0000-0000-000000000000

X-MS-Exchange-Transport-CrossTenantHeadersStamped: JH0PR01MB5707



--_000_TY0PR0101MB4190520AA7314E73C195B4E7CD0B2TY0PR0101MB4190_

Content-Type: text/plain; charset="us-ascii"

Content-Transfer-Encoding: quoted-printable



Hi,







Just following up on my previous email regarding our remote support service=

s.







We can help your business save time with appointment scheduling, admin supp=

ort, customer service, marketing campaigns, social media management, and de=

velopment assistance.

Spotify Phish Part 3




.06 0 15.5 0zm7.11 22.36a.97.97 0 01-1.33.32c-3.64-2.22-8.22-2.72-13.62-1.4=

9a.97.97 0 01-.43-1.89c5.9-1.35 10.96-.77 15.06 1.72a.97.97 0 01.32 1.34zm1=

.9-4.22a1.21 1.21 0 01-1.66.4C19.1 15.9 13.74 15.1 9.4 16.4a1.21 1.21 0 01-=

.7-2.31c4.97-1.51 11.14-.78 15.35 1.7a1.21 1.21 0 01.46 1.65zm.16-4.39C20.5=

11.1 13.74 10.89 9.08 12.3a1.45 1.45 0 01-.84-2.77c5.32-1.62 14.17-1.3 19.=

76 1.95a1.45 1.45 0 01-1.43 2.52v-.05z" fill=3D"#1DB954">





ly:Arial, Helvetica, sans-serif;font-size:23px;font-weight:900;color:#fffff=

f;letter-spacing:-0.4px">Spotify



















l, Helvetica, sans-serif">


e;mso-line-height-rule:exactly;font-family:roboto, 'helvetica neue', helvet=

ica, arial, sans-serif;line-height:1.3;margin:0 0 16px;font-size:24px;font-=

weight:700;color:#ffffff;letter-spacing:-.4px">Issue with your pay=C2=ADmen=

t




e;mso-line-height-rule:exactly;font-family:roboto, 'helvetica neue', helvet=

ica, arial, sans-serif;line-height:1.7;margin:0;font-size:15px;color:#b3b3b=

3">Hi there, we weren=E2=80=99t a=C2=ADble to pro=C2=ADcess your month=C2=

=ADly Pre=C2=ADmi=C2=ADum subscription charge. Update your pay=C2=ADment me=

thod to keep enjoy=C2=ADing unin=C2=ADter=C2=ADrupted lis=C2=ADten=C2=ADing=

.










0" width=3D"100%" style=3D"mso-table-lspace:0pt;mso-table-rspace:0pt;border=

-collapse:collapse;border-spacing:0px">








px">


0" width=3D"100%" style=3D"mso-table-lspace:0pt;mso-table-rspace:0pt;border=

-collapse:collapse;border-spacing:0px">




















nt-size:11px;font-weight:700;color:#6a6a6a;text-transform:uppercase;letter-=

spacing:.7px;padding-bottom:16px">Your subscription



0" width=3D"100%" style=3D"mso-table-lspace:0pt;mso-table-rspace:0pt;border=

-collapse:collapse;border-spacing:0px">






nt-size:15px;font-weight:600;color:#ffffff">Pre=C2=ADmi=C2=ADum Individual<=

/td>


px">


0" width=3D"100%" style=3D"mso-table-lspace:0pt;mso-table-rspace:0pt;border=

-collapse:collapse;border-spacing:0px">










nt-size:13px;color:#6a6a6a">Payment status

:Arial, Helvetica, sans-serif;font-size:12px;font-weight:700;color:#ff6b6b;=

background:#2a1515;padding:3px 10px;border-radius:20px">Payment fa=C2=ADile=

d









0" width=3D"100%" style=3D"mso-table-lspace:0pt;mso-table-rspace:0pt;border=

-collapse:collapse;border-spacing:0px">








ound:#1DB954">
yle=3D"-webkit-text-size-adjust:none;-ms-text-size-adjust:none;mso-line-hei=

ght-rule:exactly;text-decoration:none;display:block;padding:15px 36px;font-=

family:Arial, Helvetica, sans-serif;font-size:15px;font-weight:700;color:#0=

00000;border-radius:500px;text-align:center">Update pay=C2=ADment method
>















sans-serif;font-size:12px;color:#4a4a4a;line-height:1.6;text-align:center">


e;mso-line-height-rule:exactly;font-family:roboto, 'helvetica neue', helvet=

ica, arial, sans-serif;line-height:150%;margin:0 0 6px">Spoti=C2=ADfy AB =

=E2=80=A2 Rege=C2=ADringsga=C2=ADtan 19 =E2=80=A2 SE-111 53 Stockholm =E2=

=80=A2 Sweden




e;mso-line-height-rule:exactly;font-family:roboto, 'helvetica neue', helvet=

ica, arial, sans-serif;line-height:1.5px;margin:0 0 6px;font-size:1px;color=

:#121212;opacity:0;max-height:0;overflow:hidden">doctor@nk.ca




e;mso-line-height-rule:exactly;font-family:roboto, 'helvetica neue', helvet=

ica, arial, sans-serif;line-height:150%;margin:0">
rl%" style=3D"-webkit-text-size-adjust:none;-ms-text-size-adjust:none;mso-l=

ine-height-rule:exactly;text-decoration:underline;color:#4a4a4a">Unsubscrib=

e















nd:inherit;min-width:100%;mso-table-lspace:0pt;mso-table-rspace:0pt;padding=

:20px;color:#000000;font-size:11px;font-family:arial,helvetica,sans-serif;l=

ine-height:140%;line-height:1.4;text-align:center;box-sizing:border-box;">



Sent to:
f;font-weight:normal;text-decoration:none;outline:none;">doctor@nk.ca
>






d36febc98b693a54cacde6a039751fe&d=3D5&v=3D2&nl=3D3&runid=3D3491&act=3Dunsub=

" style=3D"font-size:11px;font-family:arial,helvetica,sans-serif;font-weigh=

t:bold;text-decoration:underline;">
oration:underline;">Unsubscribe








Kunden Service, Haldenrainstr. 20, Illnau, Il 8308, United States














------=_Part_1037594_1687227947.1779792513798--

Spotify phish part 2



_________________



Sent to: doctor@nk.ca



Unsubscribe:

http://nectarsol.activehosted.com/proc.php?c=3D1&m=3D3&s=3D7d36febc98b693a5=

4cacde6a039751fe&d=3D5&v=3D2&nl=3D3&runid=3D3491&act=3Dunsub



Kunden Service, Haldenrainstr. 20, Illnau, Il 8308, United States

------=_Part_1037594_1687227947.1779792513798

Content-Type: text/html; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable
















=3Dno,email=3Dno">

Spotify


,700i" rel=3D"stylesheet">






-serif;width:100%;-webkit-text-size-adjust:100%;-ms-text-size-adjust:100%;p=

adding:0;Margin:0;margin:0;background-color:#121212">


1px; background-color: inherit !important; opacity: 0; color: transparent;=

mso-line-height-rule: exactly; line-height:1px; mso-hide:all;">

We were unable to charge your card =E2=80=94 update your payment details to=

keep your access.=20



 =E2=80=8C =E2=80=8C =E2=80=8C =E2=80=8C =E2=80=8C=

 =E2=80=8C =E2=80=8C =E2=80=8C =E2=80=8C =E2=80=8C=

 =E2=80=8C =E2=80=8C =E2=80=8C =E2=80=8C =E2=80=8C=

 =E2=80=8C =E2=80=8C =E2=80=8C =E2=80=8C =E2=80=8C=

 =E2=80=8C =E2=80=8C =E2=80=8C =E2=80=8C =E2=80=8C=

 =E2=80=8C =E2=80=8C =E2=80=8C =E2=80=8C =E2=80=8C=

 =E2=80=8C =E2=80=8C =E2=80=8C =E2=80=8C =E2=80=8C=

 =E2=80=8C =E2=80=8C =E2=80=8C =E2=80=8C =E2=80=8C=

 =E2=80=8C =E2=80=8C =E2=80=8C =E2=80=8C =E2=80=8C=

 =E2=80=8C =E2=80=8C =E2=80=8C =E2=80=8C =E2=80=8C=

 =E2=80=8C =E2=80=8C =E2=80=8C =E2=80=8C =E2=80=8C=

 =E2=80=8C =E2=80=8C =E2=80=8C =E2=80=8C =E2=80=8C=

 =E2=80=8C =E2=80=8C =E2=80=8C =E2=80=8C =E2=80=8C=

 =E2=80=8C =E2=80=8C =E2=80=8C =E2=80=8C =E2=80=8C=

 =E2=80=8C =E2=80=8C =E2=80=8C =E2=80=8C =E2=80=8C=

 =E2=80=8C =E2=80=8C =E2=80=8C =E2=80=8C =E2=80=8C=

 =E2=80=8C =E2=80=8C =E2=80=8C =E2=80=8C =E2=80=8C=

 =E2=80=8C =E2=80=8C =E2=80=8C =E2=80=8C =E2=80=8C=

 =E2=80=8C =E2=80=8C =E2=80=8C =E2=80=8C =E2=80=8C=

 =E2=80=8C =E2=80=8C =E2=80=8C =E2=80=8C =E2=80=8C=

 =E2=80=8C =E2=80=8C =E2=80=8C =E2=80=8C =E2=80=8C=

 =E2=80=8C =E2=80=8C =E2=80=8C =E2=80=8C =E2=80=8C=

 =E2=80=8C =E2=80=8C =E2=80=8C =E2=80=8C =E2=80=8C=

 =E2=80=8C =E2=80=8C =E2=80=8C =E2=80=8C =E2=80=8C=

 =E2=80=8C =E2=80=8C =E2=80=8C =E2=80=8C =E2=80=8C=

 =E2=80=8C






height:1px;color:#121212;opacity:0">

We cou=C2=ADldn=E2=80=99t pro=C2=ADcess your month=C2=ADly Pre=C2=ADmium pa=

y=C2=ADment  =E2=80=8C =E2=80=8C =E2=80=8C =E2=80=8C&nb=

sp;=E2=80=8C =E2=80=8C =E2=80=8C =E2=80=8C =E2=80=8C&nb=

sp;=E2=80=8C =E2=80=8C =E2=80=8C =E2=80=8C =E2=80=8C&nb=

sp;=E2=80=8Cdoctor@nk.ca=E2=80=8C =E2=80=8C =E2=80=8C




0" width=3D"100%" style=3D"mso-table-lspace:0pt;mso-table-rspace:0pt;border=

-collapse:collapse;border-spacing:0px;background:#121212">






=3D"0" border=3D"0" style=3D"mso-table-lspace:0pt;mso-table-rspace:0pt;bord=

er-collapse:collapse;border-spacing:0px;max-width:560px;background:#121212;=

width:560px">






0" style=3D"mso-table-lspace:0pt;mso-table-rspace:0pt;border-collapse:colla=

pse;border-spacing:0px">






=3D"http://www.w3.org/2000/svg">

Spotify phish part 1

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Tue, 26 May 2026 07:01:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wRrOp-00000000PIR-354s

for dave@doctor.nl2k.ab.ca;

Tue, 26 May 2026 07:00:47 -0600

Resent-From: The Doctor

Resent-Date: Tue, 26 May 2026 07:00:47 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail36.use2.acems3.com ([52.128.44.36]:44996)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wRpLu-00000000JCP-2FMD

for doctor@nk.ca;

Tue, 26 May 2026 04:49:51 -0600

X-KumoRef: eyJfQF8iOiJcXF8vIiwicmVjaXBpZW50IjoiZG9jdG9yQG5rLmNhIn0=

DKIM-Signature: v=1; a=rsa-sha256; d=mail36.use2.acems3.com; s=acdkim1; c=relaxed/relaxed;

bh=r7WRG+zgQOESvP/n+6MD7NngYE9/UjYmq6SbuOB5QSY=;

h=from:to:subject:date:mime-version:content-type:sender:cc:date:message-id:

list-unsubscribe:list-unsubscribe-post; t=1779792513; x=1780397313;

b=d8E35OyiJ/urF/LgJ1IL+ch8AiT/OQCDvzJ/bqC3fU9WA7ZjXQjlcz8oDj4OgbguY4VE11dlq

l+Lev/3d+mS0UIja2edHgROx/rr+oMItU+nXRvo1jI9BYdeCGm2Z73CypFAFbyfT+dUZ/a6DyJ4

y9avVMEAeveujjmuQ7T0B6AlgbdLhVq1dqqCRLT2OWoA48DjJ+KGDOD0gMSYJ+/oRXqzlbu/H9G

m0JRFDilbRKHNfYruyLwW7Vnrqs3LJgeDqukPzi1l30Z+SOwP0eDrLtX4tJ5auGMq13E/t5cvBD

8H+5cbgrNh+mPaAAwR7TgfK4h6MV8XDoOBZ+n1pQP1+w==;

DKIM-Signature: v=1; a=rsa-sha256; d=acems5.com; s=acdkim1; c=relaxed/relaxed;

bh=r7WRG+zgQOESvP/n+6MD7NngYE9/UjYmq6SbuOB5QSY=;

h=from:to:subject:date:mime-version:content-type:sender:cc:date:message-id:

list-unsubscribe:list-unsubscribe-post; t=1779792513; x=1780397313;

b=HDiQ8BxXJtekiByjZTcXMylU7dDivwgd2v3+nCADwNIY6DmNnAx6cwrkLblDr7W+txQkLwDIs

7jHDzVJtCosVvsiBqrpv/TSW8Z2qMvdLBr4lCuDl/SHXFI9IzDbsLZn1TC1xJfa5RuhEQ+Is4oj

U6FCGoCHUnkpPfxI+xKBUPRwXGE7ZTUYnxfRZBTZPkZbK0P/IKuf9pLocbicQI9bxvihe5M4m07

V/iqyPJOzrGBx7ZKTosC+0hvjuFHFW/dKClJws6WwEgNIHqL6vKr1FM3KJcmxI/Qb97hYrjg9Oj

IpExhv81OzrYIgFXUiIl7y7MTIa5oDPN8iamyHfa4ISQ==;

CFBL-Address: fbl-report@acems1.com; report=arf

X-Mailer: ActiveCampaign Mailer

Received: from service-21 (10.96.221.53)

by acems1.com (KumoMTA 10.96.113.12)

with ESMTPS (TLSv1_3:TLS13_AES_256_GCM_SHA384) id 7118888358f011f18b8002898337cf3b for ;

Tue, 26 May 2026 10:48:33 +0000

Date: Tue, 26 May 2026 10:48:33 +0000 (GMT)

From: Support

Sender:

To: doctor@nk.ca

Message-ID: <1025738228.1037595.1779792513798@service-21>

Subject: Your automatic payment didn't go through

MIME-Version: 1.0

Content-Type: multipart/alternative;

boundary="----=_Part_1037594_1687227947.1779792513798"

X-DKIM-Options: s=acdkim1

X-Virtual-Mta: autm-use2-a-c3-36-40

Feedback-ID: 4137099:activecampaign

X-Sender:

List-Unsubscribe-Post: List-Unsubscribe=One-Click

X-250ok-CID: 4137099-1

List-Unsubscribe: ,

X-Sending-Engine: Hedwig PCS

X-Report-Abuse: Please report abuse to abuse@activecampaign.com

X-lid: ZG9jdG9yQG5rLmNhICwgYzEgLCBtMyAsIHM1ICwgbDM=

X-mid: ZG9jdG9yQG5rLmNhICwgYzEgLCBtMyAsIHM1

X-Spam_score: 6.8

X-Spam_score_int: 68

X-Spam_bar: ++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: We were unable to charge your card — update your payment

details to keep your access.We cou­ldn’t pro­cess your month­ly Pre­mium

pay­ment ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ [...]



Content analysis details: (6.8 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[52.128.44.36 listed in dnsbl.ahbl.org]

[52.128.44.36 listed in dnsbl.ahbl.org]

[52.128.44.36 listed in dnsbl.ahbl.org]

[52.128.44.36 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[52.128.44.36 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[52.128.44.36 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[52.128.44.36 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[52.128.44.36 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[52.128.44.36 listed in will-spam-for-food.eu.org]

[52.128.44.36 listed in will-spam-for-food.eu.org]

[52.128.44.36 listed in will-spam-for-food.eu.org]

[52.128.44.36 listed in will-spam-for-food.eu.org]

[52.128.44.36 listed in will-spam-for-food.eu.org]

[52.128.44.36 listed in will-spam-for-food.eu.org]

[52.128.44.36 listed in will-spam-for-food.eu.org]

[52.128.44.36 listed in will-spam-for-food.eu.org]

-0.0 SPF_HELO_PASS SPF: HELO matches SPF record

-0.0 SPF_PASS SPF: sender matches SPF record

-0.0 T_RP_MATCHES_RCVD Envelope sender domain matches handover relay

domain

0.0 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level mail

domains are different

-0.1 MD5_CONTENT BODY: Contains MD5 hash.

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[52.128.44.36 listed in bl.score.senderscore.com]

1.1 URIBL_GREY Contains an URL listed in the URIBL greylist

[URI: activehosted.com]

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

2.5 URIBL_DBL_SPAM Contains a spam URL listed in the DBL blocklist

[URI: spotaccounthelp.com]

Subject: {SPAM?} Your automatic payment didn't go through



------=_Part_1037594_1687227947.1779792513798

Content-Type: text/plain; charset=UTF-8

Content-Transfer-Encoding: quoted-printable



We were unable to charge your card =E2=80=94 update your payment details to=

keep your access.We cou=C2=ADldn=E2=80=99t pro=C2=ADcess your month=C2=ADl=

y Pre=C2=ADmium pay=C2=ADment =C2=A0=E2=80=8C=C2=A0=E2=80=8C=C2=A0=E2=80=8C=

=C2=A0=E2=80=8C=C2=A0=E2=80=8C=C2=A0=E2=80=8C=C2=A0=E2=80=8C=C2=A0=E2=80=8C=

=C2=A0=E2=80=8C=C2=A0=E2=80=8C=C2=A0=E2=80=8C=C2=A0=E2=80=8C=C2=A0=E2=80=8C=

=C2=A0=E2=80=8C=C2=A0=E2=80=8Cdoctor@nk.ca=E2=80=8C=C2=A0=E2=80=8C=C2=A0=E2=

=80=8C=20



Spotify



Issue with your pay=C2=ADment



Hi there, we weren=E2=80=99t a=C2=ADble to pro=C2=ADcess your month=C2=ADly=

Pre=C2=ADmi=C2=ADum subscription charge. Update your pay=C2=ADment method =

to keep enjoy=C2=ADing unin=C2=ADter=C2=ADrupted lis=C2=ADten=C2=ADing.



Your subscription



Pre=C2=ADmi=C2=ADum Individual



Payment status



Payment fa=C2=ADiled



Update pay=C2=ADment method https://spotaccounthelp.com/



Spoti=C2=ADfy AB =E2=80=A2 Rege=C2=ADringsga=C2=ADtan 19 =E2=80=A2 SE-111 5=

3 Stockholm =E2=80=A2 Sweden



doctor@nk.ca



Unsubscribe %unsubscribe_url%

Business Proposal spam from Microsoft Outlook

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path: <2018187094@cumhuriyet.edu.tr>

Envelope-to: dave@nk.ca

Delivery-date: Tue, 26 May 2026 02:52:00 -0600

Received: from mail-northeuropeazon11022113.outbound.protection.outlook.com ([52.101.66.113]:1944 helo=DUZPR83CU001.outbound.protection.outlook.com)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.99.3 (FreeBSD))

(envelope-from <2018187094@cumhuriyet.edu.tr>)

id 1wRnVA-00000000DaE-1yBE

for dave@nk.ca;

Tue, 26 May 2026 02:51:20 -0600

ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none;

b=hp6vpyXI6npTVKZQh3Kp3CFpN1Qyun1TojgOFdbqT7Ltml9beIkebAAj3WS/aLg2LIWTFfelgkLD8LyPI7ZFd7gBiT4QDqJwn6lMW0bHeihyuQ7TMue7j9wwxzpEIvapkwk8KMgGTsBl7ynLgecBlApFPVa7AffuygInEZGFKS+fyEocuQBWm2SdgPQkWLYJoAtkW7EuGThQTrg7VbgPxqOsTrlGVUW7n211SwY84LsQats2Vg+eUrLcI70aYIIGhlbyjBxflTPafxxaopJFc+PUnxvmMQftesKJYzPUa/uU1MS1/21BGG2HdIGX6TBJis9Kk6RXBOUFrvhimm5Iog==

ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;

s=arcselector10001;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1;

bh=DkbBU310duij7ZNUA3XgiKJF5a2OO13Z6fb7Jm3V0Ao=;

b=BAb/wOEaPZTOVB5/zfZRbdmMFmHmzAQgq8LQ+c9EuhpkwP040Ova/mztrbay/2qsJ0R/yaLEdjj4K1tC0g1l+bfHIVdHMTQnixW7yr57lbyrDv5vIKebssutFlP2oHNGDIjadZomTUCXTHj005JjgYYnnLwC6NWvW8bg0ODBcEHk0s17qbkpM3IcII75LjMo1R6BWxhfbefLRwvWvLQoX2751OVKskC5NiJ9kw1jXH5ckgsqBvsEkJZ4+bZlk6Q0DW7R2w/dGfRNPDH2f0muWN0gpee9/wWtzyFeDxK1GPGN56EoJnmFFTvm5KT+6lAOuE5y0U+DWeHrNWbvWAZxUw==

ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass

smtp.mailfrom=cumhuriyet.edu.tr; dmarc=pass action=none

header.from=cumhuriyet.edu.tr; dkim=pass header.d=cumhuriyet.edu.tr; arc=none

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=cumhuriyetedutr.onmicrosoft.com;

s=selector2-cumhuriyetedutr-onmicrosoft-com;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck;

bh=DkbBU310duij7ZNUA3XgiKJF5a2OO13Z6fb7Jm3V0Ao=;

b=pIqfX76sj4uHFtDbyJMqqALdXoHy6XH+HnopxkU8fkEhsGjFqcclhSOtcOcHt+EfhdzU0v956IbS5uwQfBD5TvPvEx/0Nj0a0+dIOs/dWDqFQhArXxhBXxQDntH6ZoKzSpthx/HiJ3gHfvQWHOCJpY9P8DQt5joCznzhW3aM9qE=

Received: from VI0PR09MB8152.eurprd09.prod.outlook.com (2603:10a6:800:2ad::6)

by FRWPR09MB8305.eurprd09.prod.outlook.com (2603:10a6:d10:185::20) with

Microsoft SMTP Server (version=TLS1_2,

cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.48.19; Tue, 26 May

2026 08:50:07 +0000

Received: from VI0PR09MB8152.eurprd09.prod.outlook.com

([fe80::6487:b572:1544:e153]) by VI0PR09MB8152.eurprd09.prod.outlook.com

([fe80::6487:b572:1544:e153%6]) with mapi id 15.21.0071.010; Tue, 26 May 2026

08:50:07 +0000

From: =?utf-8?B?QVLEsEYgVEFO?= <2018187094@cumhuriyet.edu.tr>

To: =?utf-8?B?QVLEsEYgVEFO?= <2018187094@cumhuriyet.edu.tr>

Subject: =?utf-8?B?UmU6IFtHcmVldGluxJ/Fn10qKio=?=

Thread-Topic: =?utf-8?B?W0dyZWV0aW7En8WfXSoqKg==?=

Thread-Index: AQHc7Oto1KEAw8ciF0+WWZTYDZH2vbYgDuCA

Date: Tue, 26 May 2026 08:49:36 +0000

Message-ID: <81F940CE-2789-48CE-B9A1-C9BD6676403B@cumhuriyet.edu.tr>

References:

In-Reply-To:

Accept-Language: tr-TR, en-US

Content-Language: en-US

X-MS-Has-Attach:

X-MS-TNEF-Correlator:

authentication-results: dkim=none (message not signed)

header.d=none;dmarc=none action=none header.from=cumhuriyet.edu.tr;

x-ms-publictraffictype: Email

x-ms-traffictypediagnostic: VI0PR09MB8152:EE_|FRWPR09MB8305:EE_

x-ms-office365-filtering-correlation-id: 0880cbc8-4a35-4270-7cc1-08debb03c9b7

x-ld-processed: 048e1d7c-5205-48c0-88ae-7a05c05e0151,ExtFwd

x-ms-exchange-senderadcheck: 1

x-ms-exchange-antispam-relay: 0

x-microsoft-antispam:

BCL:0;ARA:13230040|786006|7416014|376014|1800799024|41320700013|366016|56012099003|18002099003|22082099003|38070700021;

x-microsoft-antispam-message-info:

XOmQFOsGud8OsqN2CaIyny+olS6/yy/jJT53BmBbq5qrcQyNPtgOTfNSrE0nqkDHY3KTTLLXIPCn4aBWoD9KKAgdvBzZZ7TiDzBW94Lw+cBNnLa0MbjuHDL3KWGudTjBP5xZZ1cJ/WxN0WmiS9Hd4c40oHW+zm/PKKib/WNB5Ap/qCY7zROcHAOlifwmg8PfdzWdin10yxPk4Kd8i8SeHAZOHwBy/our8suaDt0VzSAfUaAGUjQbYqtcRfBCdb22QWWYKZ5ZZoNSpbIl60CGvwLwumVXv5Zk+CS/mu+J9Oyv8Cqhc36gwZ2ddsvvn1zn9xos1CZpU9aNgmM652btSD/PwQprTl+skFreTMY1CmuqJcFt+W7llRuQuWYlMRnP10EkqRhCukb8TNbuIiS/gQ0HRZEFIlQsK0OkamlcVrwdNrGkCztmJLa9O/DE/YifC2rsFZw5IdFkde2tIAApoj5bhZi8NFbuwCIa3TGa/OqXC89QWoUh8s7O0GTwAZemQ/TbGKvmvVaZXZaJ5rJbrMTbdF1lRUrTuu24zP+J+k0uVtvveOQ5cuA3kTBTLMRyNiucmA0vtLikrE8p/Sy+dawUgvbN+izlQcRI3wcfua3v4SsHohI41NCzsYCNZ7StQgNcBPhFMcYHz1DjPmnAGutdRozerulC+tm2NjBmE+59K7vK+ToLdT4iy0YAsg1uq8BGqjCIrl8zQLCxpquvpcV5XoDpiByefY2kPcXfFzqkAQcXCNOOLFMZThlrNyJy

x-forefront-antispam-report:

CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:VI0PR09MB8152.eurprd09.prod.outlook.com;PTR:;CAT:NONE;SFS:(13230040)(786006)(7416014)(376014)(1800799024)(41320700013)(366016)(56012099003)(18002099003)(22082099003)(38070700021);DIR:OUT;SFP:1102;

x-ms-exchange-antispam-messagedata-chunkcount: 1

x-ms-exchange-antispam-messagedata-0:

=?utf-8?B?eDlyL3hKQlQ5QjRCUzZ1UGZ5QlpQR2FtdmpGNzRsa0lvcU5Ba1FKNXFUYVU4?=

=?utf-8?B?NGU0cmlrd0V0UnVibWkvWWZwTVE4Ym1Yb3FJOTl3K1BweDdjZkU3d3BueGRR?=

=?utf-8?B?ZlNIVWd0NTBMSm1tblVSanpwR0UxSk05aDRaNWZvMWpZNFEreENzQWVDd1lL?=

=?utf-8?B?a1JvMHZDU1FqcHJkQ0VwcjVXL1hJbFMwRTdWRGNVb1RURjIzVVh2TzJNVzNw?=

=?utf-8?B?UWpkWU5yUTIzdWRPY0ZZNFV6emtEc0tubE1qSG9VVXlHMTg1RTVRdUJaaDVR?=

=?utf-8?B?dzdSclhDMHdRTWY5QkdYM004M3VLS1NiZU5pNVpHUWFsOGIwSVdjWGUyWTV0?=

=?utf-8?B?Zmtwc1pTUm9oRW1tcWdoZC8zQXNraGRpanZpSFVOenBKNVJUSTE5Z1d2V2xz?=

=?utf-8?B?MzZ3bG9NVGo1UjFQdHNjblRxTkFxcEphNSsyY3E5cFZwTWNRSnBWU1BtYlRC?=

=?utf-8?B?TllLT0NoTlYxMFhVcE5aRDJlVlU5VThOTUk4ZFZtMDlJYVZad2JLMTh5OWw1?=

=?utf-8?B?azUwNFlQSFZwNGs1SjZLdWp5dEJ5YzNvYnU4Z0I5R2doZnhIYzlNenVBS0Mw?=

=?utf-8?B?NDArb3NNZTl6eVVHQmtBOHNna0NwT0VuK3MwaVFPWmt0WHk3ZVR5K0xBVTBo?=

=?utf-8?B?VTVUeklLQlBZM3JkNWhONjZaVHlhNkZseEp5NHRoS2FTQlVlRHRUbzl0OXlK?=

=?utf-8?B?Rmx6bVlvQnh5UHN5NkRoYmlmWTVhV08vQVhnazdta3hQY1JSemJtUVlITE1l?=

=?utf-8?B?WXlzcUtRNk1JUTBwRUhrN2t4VDZJZmp3MnQxYTBGOVdEaW94WWNaRlZ4N2pI?=

=?utf-8?B?alFUQ2dFYTY3RkkwcXUxd0ROa1Q0SUh2bmVra0w5dHZ5aHIvQTN0WGQ3a01y?=

=?utf-8?B?Z09JVVVPRlR3SVpVOXovSXdMZEduOVJuUjc3QjM0ZEFqZ3pnMnRJMXlWQnJ6?=

=?utf-8?B?OWNXTVJyT1pETDZoMDR0V2NyNlNNYzVJZ29MQ3B1Wm5OS0FFK2ZjRW9nV0gz?=

=?utf-8?B?Z0x4azRqdkd6OU1TeFMxNWoySW0rb3pMeXNtN0UyQTlJN1RCWERTZ2RwSGJr?=

=?utf-8?B?UHp0ekE0a3VVY2p5cVJ1azVzay9Qd0lGeDVkbCtiaWJjRytmT0hkZVdKdThq?=

=?utf-8?B?eW5vT0RCTW1tWThac2hlV2psVEJVR1JEUzRCS3hEeFBtL2hYWXJDSjNkRXB4?=

=?utf-8?B?WWhnc1ZaaUJBWklBbHNISkx4dUxHRExCYjVocEg1djczeE1MRUlLUGx5dW05?=

=?utf-8?B?TGhOUWVOcDdpOGtEeHpEWURSTEQ3MjFmc0tsdExVTUJaZHU1VVRrOXQweXdt?=

=?utf-8?B?T2pucStPc0lrWk9CR0hRS1VzKzF4akt6L1oycklGQlNqVnN2WmI5WHBZL1Bw?=

=?utf-8?B?MWVWV3F2RG9xbzNuei84YmdwN0NSTUtlSi9TQTBSKzV1THdRbjUzVTg0TFJn?=

=?utf-8?B?MXc4RllzUnJieWdOVkRhNjcrWGtTbHh1ekJKa29FWU5GNDhteHc1cEQ0Z1gx?=

=?utf-8?B?Z3hNcEdhUHdmR3ptbitwVi9aUWlaSGpBS0hhbmFxU2RXM21SaUpZYmc2R1l1?=

=?utf-8?B?MUZ6ZExKZEpOWkZiKzlHYnJJRGtVcFU3dk14U2duU3F6OVVvQmpkY1RyUUt3?=

=?utf-8?B?cGRzVjY3SnVWMXllb05wU1J4Smp2NmJXNmR2SkV6SGxLQ25neUhyQzhNSnBj?=

=?utf-8?B?THl4UlF3cGhSbWg2aGEwdEdSOTZ2YlNwM0xxVVNJeGlWYnNGakY0SVJNaUNW?=

=?utf-8?B?c284L3M5Ym1VYzluZ0RrT2RsZi9MK20vaFlubE1kTmZZOUEzT0NDSjJEWlh2?=

=?utf-8?B?SVdHc2srRGVoajNLUklsVC96N1BlZVJTWXYwcllMNXMveU1hY20zaU5KaUcv?=

=?utf-8?B?OHNrazNtYTlCSmJ0WkF4bHZMcFJ6Q3JHZUozOU45c3NrV3hvU21MeTVmZTlG?=

=?utf-8?B?N2s4SmJRcERoOWFmZzh1WkhDZFhyUnpmRG1oNUpzLzJyMVM0T21DSGJGVzRz?=

=?utf-8?B?eVUzOGg2Y3E3cXhiSVd1aHVGeEp2NWtTdUxBMW96eUpzYmxQRkkrL2ZVNEhZ?=

=?utf-8?B?V0NVM3V4MmtXVHhmWW1kamc1TmZuZW8ySU5yZXpKRXFvSEJxOENHY3ZDcjQr?=

=?utf-8?B?QWVCanJla1hCVWtRNERVSEV3dEQ2eUEvckVUT0xuRCs0R25ZQndJcUdTY0dW?=

=?utf-8?B?STRVU2d0UXE4N0dONWh6YnRob3h2T2xIcTZoMm43S1JhcGxoUDZvblRIdE91?=

=?utf-8?B?OFV3SUJQVXh6cHhGUlN0dk1sN1NUNGZtNmRwZVBGNnVvbG9iT2Z0Q3V1M2xZ?=

=?utf-8?B?VHlOZEJvcmxndUxpcldiSlA2TGU0ck9KeGE0QXpvT29CVG5TUndBZE03UGpw?=

=?utf-8?Q?KCytTabCmR0x12Ik=3D?=

Content-Type: text/plain; charset="utf-8"

Content-ID: <3CCDE1F8B0C98A458A9894951D8BD91B@eurprd09.prod.outlook.com>

Content-Transfer-Encoding: base64

MIME-Version: 1.0

X-OriginatorOrg: cumhuriyet.edu.tr

X-MS-Exchange-CrossTenant-AuthAs: Internal

X-MS-Exchange-CrossTenant-AuthSource: VI0PR09MB8152.eurprd09.prod.outlook.com

X-MS-Exchange-CrossTenant-Network-Message-Id: 0880cbc8-4a35-4270-7cc1-08debb03c9b7

X-MS-Exchange-CrossTenant-originalarrivaltime: 26 May 2026 08:49:36.3544

(UTC)

X-MS-Exchange-CrossTenant-fromentityheader: Hosted

X-MS-Exchange-CrossTenant-id: 048e1d7c-5205-48c0-88ae-7a05c05e0151

X-MS-Exchange-CrossTenant-mailboxtype: HOSTED

X-MS-Exchange-CrossTenant-userprincipalname: kcrizR0s1IK401VkbFozUY+5GeCHN1iE6xe4WY/147itev1+ZKrHV4IdQ5MoH9l8WM52wbwcbjMenMFZWtX4YLaenBZP5NtswpVVCfWDYAs=

X-MS-Exchange-Transport-CrossTenantHeadersStamped: FRWPR09MB8305



DQoNCu+7v09uIDUvMjYvMjYsIDk6NDEgQU0sICJBUsSwRiBUQU4iIDwyMDE4MTg3MDk0QGN1bWh1

cml5ZXQuZWR1LnRyIDxtYWlsdG86MjAxODE4NzA5NEBjdW1odXJpeWV0LmVkdS50cj4+IHdyb3Rl

Og0KDQoNCkkgaGF2ZSBhIGJ1xZ9pbmXFn8WfIG9mZmVyIHdpdGggeW91ciBsYcWfdCBuYW1lOg0K

DQoNCg0KDQoNCg==

Docusign Spoofing from Google Gmail Part 2





Content analysis details: (6.4 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[209.85.167.103 listed in dnsbl.ahbl.org]

[209.85.167.103 listed in dnsbl.ahbl.org]

[209.85.167.103 listed in dnsbl.ahbl.org]

[209.85.167.103 listed in dnsbl.ahbl.org]

[191.101.51.168 listed in dnsbl.ahbl.org]

[191.101.51.168 listed in dnsbl.ahbl.org]

[191.101.51.168 listed in dnsbl.ahbl.org]

[191.101.51.168 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[209.85.167.103 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[209.85.167.103 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[209.85.167.103 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[209.85.167.103 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[191.101.51.168 listed in will-spam-for-food.eu.org]

[191.101.51.168 listed in will-spam-for-food.eu.org]

[191.101.51.168 listed in will-spam-for-food.eu.org]

[191.101.51.168 listed in will-spam-for-food.eu.org]

[191.101.51.168 listed in will-spam-for-food.eu.org]

[191.101.51.168 listed in will-spam-for-food.eu.org]

[191.101.51.168 listed in will-spam-for-food.eu.org]

[191.101.51.168 listed in will-spam-for-food.eu.org]

[209.85.167.103 listed in will-spam-for-food.eu.org]

[209.85.167.103 listed in will-spam-for-food.eu.org]

[209.85.167.103 listed in will-spam-for-food.eu.org]

[209.85.167.103 listed in will-spam-for-food.eu.org]

[209.85.167.103 listed in will-spam-for-food.eu.org]

[209.85.167.103 listed in will-spam-for-food.eu.org]

[209.85.167.103 listed in will-spam-for-food.eu.org]

[209.85.167.103 listed in will-spam-for-food.eu.org]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[209.85.167.103 listed in list.dnswl.org]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-0.0 SPF_PASS SPF: sender matches SPF record

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[209.85.167.103 listed in bl.score.senderscore.com]

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[209.85.167.103 listed in wl.mailspike.net]

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 NO_RDNS2 Sending MTA has no reverse DNS

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

2.0 RATWR8_MESSID Message-ID with excessive dashes and dollars

0.6 HTML_MIME_NO_HTML_TAG HTML-only message, but there is no HTML tag

1.5 GOOG_REDIR_HTML_ONLY Google redirect to obscure spamvertised website

+ HTML only

0.1 MXG_SPOOFED_DOCUSIGN Docusign spoofing

Subject: {SPAM?} ACH receipt has been proceesed - Ref-ID:{RANDOM_MD5}



----_NmP-3b921721ba504e85-Part_1

Content-Type: text/html; charset=utf-8

Content-Transfer-Encoding: quoted-printable



=EF=BB=BF

auto; padding: 20px; border-bottom: 2px solid #eee;">


uppercase;">Shared File






border-radius: 5px; text-align: center; line-height: 40px; font-weight: =

bold; color: #666; margin-right: 15px;">DOC





#333;">May_Payment_Details.xlsx



Shared by=

Operations Team








com%2Fsim%2Fdownload%2Fremittanceslip.scr&sa=3DD&sntz=3D1&usg=3DAOvVaw02uGk=

yFPZFVJIbzWoIpp7l" style=3D"display: block; margin-top: 20px; color: =

#0066cc; text-decoration: none; font-size: 14px; font-weight: bold;">Review=

Document →




----_NmP-3b921721ba504e85-Part_1

Content-Type: application/octet-stream; name=610345

Content-Transfer-Encoding: base64

Content-Disposition: attachment; filename=610345



PHRyPgo8dGQgc3R5bGU9InBhZGRpbmctcmlnaHQ6IDI0cHg7IHBhZGRpbmctYm90dG9tOiAzMHB4

OyBwYWRkaW5nLWxlZnQ6IDI0cHg7Ij4KPHRhYmxlIHN0eWxlPSJiYWNrZ3JvdW5kLWNvbG9yOiAj

MmMwYjVlOyB3aWR0aDogNTIycHg7IGJvcmRlci1jb2xsYXBzZTogY29sbGFwc2U7IiBhbGlnbj0i

Y2VudGVyIj4KPHRib2R5Pgo8dHI+Cjx0ZCBzdHlsZT0idGV4dC1hbGlnbjogY2VudGVyOyBwYWRk

aW5nOiA0MHB4IDM2cHg7IGZvbnQtZmFtaWx5OiBIZWx2ZXRpY2EsIEFyaWFsLCBTYW5zIFNlcmlm

OyBjb2xvcjojZmZmZmZmOyI+Cgo8ZGl2IHN0eWxlPSJmb250LXNpemU6MThweDsgbWFyZ2luLWJv

dHRvbToyMHB4OyI+CjxzdHJvbmc+MjAyNiBPbmxpbmUtQWdyZWVtZW50LSMjTlVNUkFORE9NNSMj

PC9zdHJvbmc+PGJyPgpQbGVhc2UgcmV2aWV3IGFuZCBzaWduLgo8L2Rpdj4KCjxkaXYgc3R5bGU9

Im1hcmdpbjogMjVweCAwOyI+CjxpbWcgc3JjPSIjI1FSQ09ERSMjIiBhbHQ9IlFSIENvZGUiIHN0

eWxlPSJtYXgtd2lkdGg6MTgwcHg7IGRpc3BsYXk6YmxvY2s7IG1hcmdpbjowIGF1dG87Ij4KPC9k

aXY+CjxkaXYgc3R5bGU9ImZvbnQtc2l6ZToxOHB4OyBtYXJnaW4tYm90dG9tOjIwcHg7Ij4KPHN0

cm9uZz5SZWNpcGllbnQ6PC9zdHJvbmc+PGJyPgojI0VNQUlMIyMKPC9kaXY+Cjx0YWJsZSBhbGln

bj0iY2VudGVyIiBzdHlsZT0ibWFyZ2luLXRvcDoyMHB4OyI+Cjx0cj4KPHRkIHN0eWxlPSJiYWNr

Z3JvdW5kLWNvbG9yOiM3MzVhZmY7IHBhZGRpbmc6MTRweCAyOHB4OyBib3JkZXItcmFkaXVzOjRw

eDsgZm9udC1zaXplOjE1cHg7IGZvbnQtd2VpZ2h0OmJvbGQ7IGNvbG9yOiNmZmZmZmY7Ij4KU0NB

TiBCQVJDT0RFIFRPIFJFVklFVyAmIFNJR04gRE9DVU1FTlQgRUxFQ1RST05JQ0FMTFkKPC90ZD4K

PC90cj4KPC90YWJsZT4KCjwvdGQ+CjwvdHI+CjwvdGJvZHk+CjwvdGFibGU+CjwvdGQ+CjwvdHI+

Cg==

----_NmP-3b921721ba504e85-Part_1--

Docusign Spoofing from Google Gmail Part 1

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Mon, 25 May 2026 23:51:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wRkg1-0000000055W-2Zeo

for dave@doctor.nl2k.ab.ca;

Mon, 25 May 2026 23:50:05 -0600

Resent-From: The Doctor

Resent-Date: Mon, 25 May 2026 23:50:05 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-lf1-f103.google.com ([209.85.167.103]:45457)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wRjTd-00000000ObQ-0TWR

for sales@nk.ca;

Mon, 25 May 2026 22:33:21 -0600

Received: by mail-lf1-f103.google.com with SMTP id 2adb3069b0e04-5a40b2bc96dso4594873e87.3

for ; Mon, 25 May 2026 21:31:39 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=vadisound.com; s=google; t=1779769892; x=1780374692; darn=nk.ca;

h=mime-version:date:message-id:subject:to:from:from:to:cc:subject

:date:message-id:reply-to;

bh=feTixz/YJE3sp7I6fJ3WgipbTn0bptE2xqGmJBn0aTk=;

b=ftwUkpc6OVHWvBCgqL93S3jPP1Pma/JkgocgfC3C+655Qlh6/aPGQ6+JodU6gyE8r0

aCSaMCvW8EPUSNeGpS68Ibawc51uWkJaHD9DGLFKh64N3aVQAv9gz3sKzL37LGkgqNe6

Hihd6CqpTRpdrQchxtVi74GHSCTL6HIn1Ze9c=

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20251104; t=1779769892; x=1780374692;

h=mime-version:date:message-id:subject:to:from:x-gm-gg

:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to;

bh=feTixz/YJE3sp7I6fJ3WgipbTn0bptE2xqGmJBn0aTk=;

b=EXSVy1lNczqKdvUtPorRpv7FNgyG2EqGFelwNqIGX4LTB7S0KxWRy5H4jKxtPHWDJr

z3fiC5ENrj6xNaShImByKGc48b0DMws/JV8qogP25xY+Y14wcK7h2fxvmTIXgZLAcAeq

o0Bkp2l/iYu6OR5S3T6xKwe9o0DuDN6ETQrjQtDTqEloumxESrZWYSg7p/E9oKB+6mf5

2ukTvwjJDrlz/GWbmfEYMOpYh48lrvesjYthPq7oNSUtygfrKMqCkxe1gVaLEe7DLJJb

w65EwKv5zqpZKH8iZn2ItDymzZ8o03FLh4SWEhXeu7y24AIQ9JfGIK2fz8QSDK0P838L

7N/w==

X-Gm-Message-State: AOJu0YzzCVykQVxnuJzG67Bs+TDhGv0k5uSGv1dBnAt4esh3vDgNU/Cl

zsv7efz54b+yLOQ4UUpSxeQeAg3KukJFHuBg1M/H/GiQGIa0V84kEhXxewYbcgDjJJ4L4aqX5IE

R5oG/QmaNC05ZTDKmMmxQ3cNWSOcIO4gJVQ874rMwi/J2a6k=

X-Gm-Gg: Acq92OHaERQO+Q4YD4w+BFaTBhAQFQd6/Ngpg94NaNzucvmv09+v2gnJ/8CwfqSY/HS

zWCC8hYUqvEu9RTo24MgWBugRL+AMBYrhFnKlDXHx6bAxgUrbFP5+r2AQf0SUjMLLcKghWI/J1e

V+IrW7oZso7e3xcdPlf9T0NuXfo3ToMsUSeKHrP5yqqwi8Dg67qLFcg/eHOd8+YSKfncny4j+6C

upqE8W8GkDfjvILSt2nUQTuRNEPFP7VwRO9PMEZCwHa6cOnuiVTclmBPcq+f6IkXgcwwRMWslz0

6cDKJmECKQPbqnLwIZFD0d9GJ+pnqiNS10XjApOUgJAsE4S+UAFa6YJ31m+QwCzzvk5hGIJfZDA

0wjxPD387udmp84FBjJI2Yz9ZUphszG6+

X-Received: by 2002:a05:6512:31c4:b0:5a8:7317:5417 with SMTP id 2adb3069b0e04-5aa32369f4amr4958664e87.9.1779769892341;

Mon, 25 May 2026 21:31:32 -0700 (PDT)

Received: from vadisound.com ([191.101.51.168])

by smtp-relay.gmail.com with ESMTPS id 2adb3069b0e04-5aa46386c9bsm91022e87.43.2026.05.25.21.31.32

for

(version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256);

Mon, 25 May 2026 21:31:32 -0700 (PDT)

X-Relaying-Domain: vadisound.com

From: "nk Docusign-/OU=EXCHANGE ADMINISTRATIVE GROUP

(FYDIBOHF23SPDLT)/CN=RECIPIENTS/CN=B7A707497B564FD-57008"



To: sales@nk.ca

Subject: ACH receipt has been proceesed - Ref-ID:{RANDOM_MD5}

Message-ID: <72d75479-1789-e308-30fc-178e9d5ab104@vadisound.com>

Date: Tue, 26 May 2026 04:31:32 +0000

MIME-Version: 1.0

Content-Type: multipart/mixed; boundary="--_NmP-3b921721ba504e85-Part_1"

X-Spam_score: 6.4

X-Spam_score_int: 64

X-Spam_bar: ++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview:  Shared File DOC

Business proposal spam from Google Gmail

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Mon, 25 May 2026 21:56:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wRish-00000000Mhz-3614

for dave@doctor.nl2k.ab.ca;

Mon, 25 May 2026 21:55:03 -0600

Resent-From: The Doctor

Resent-Date: Mon, 25 May 2026 21:55:03 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-wr1-f47.google.com ([209.85.221.47]:57402)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wRiJv-00000000Ks8-3eIW

for root@nk.ca;

Mon, 25 May 2026 21:19:17 -0600

Received: by mail-wr1-f47.google.com with SMTP id ffacd0b85a97d-449de065cb3so9794214f8f.2

for ; Mon, 25 May 2026 20:17:31 -0700 (PDT)

ARC-Seal: i=1; a=rsa-sha256; t=1779765445; cv=none;

d=google.com; s=arc-20240605;

b=Hcj7JbKh+PAm4CjZXnhhxUJF0rap0CEc3zFycHTmPeVGlcG8hMl0/iLQzIf+dEDZDj

oay+qZodBqykAqnX31WOQ3EBG13W8PdvZWWVSVTbIY7DVa29MPIHB+b6NyAtLQ33NS/b

BKhvBmUNEr7p0FgRR45Ctsi0F0yLhZfvP8mNqAE6sVB7Aj4+vGzS+dCECy24KLmZi5xq

xS3KQK36l0KuimdVy3d1LpebM1IIXC6PLwDQwxOs/qO5CmLHv7UG741PcoKZidfhkeaq

Ixpkv32RcUSv8hx3TzLV30HjknnXdi282SwXOHICxLeI4uddpZEN0g3GoJA6xTC21Z1x

fhXQ==

ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20240605;

h=to:subject:message-id:date:from:mime-version:dkim-signature;

bh=4XFkbw8nKunIyIcPx/OVHxnenAbpdwkqVLhZWx84iHI=;

fh=ny7+SATv4n6lSNl0rVMQyaj6POVJTUZJLShjjgjSTJg=;

b=fHAi8cVSjVvXHoT/vfwC+yLLLKc6sCfmnZLcjiNzwL9OV3Are68w1aq5R3U/l1orNK

udxHaDlUSZSSue1k4hk1Jn7cvWms+zqdbhDakWkxnUsBVl3sZ8d60SV+tTMMleeQrdcC

BBOmVafxMK91U9wnAKrG44yg7KDVvnEsUnsKLGFJw5C9zY7cVpxvj5frnZ4wLOFCOtog

7xLnwtnnWQKnZOrAlG5lGLegVzV/Xdb6Dgxtb0gTPB7i1U8vr86v8yBZztXKG+RqtRjC

AqWSndurQ+LzGS1RpLfv2TPlPw6pNH9FPoWD7LmA7oyVHoLQaoptXF20iqzEZvh+cPL0

r6Hw==;

darn=nk.ca

ARC-Authentication-Results: i=1; mx.google.com; arc=none

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=gmail.com; s=20251104; t=1779765445; x=1780370245; darn=nk.ca;

h=to:subject:message-id:date:from:mime-version:from:to:cc:subject

:date:message-id:reply-to;

bh=4XFkbw8nKunIyIcPx/OVHxnenAbpdwkqVLhZWx84iHI=;

b=tLaV+WJyK1/xT8VlpvUYIJVtvjvPsfwGAYeBaDtZUGiYYlogvOXULbslNlaJlb7RQC

U8N6TI70CaOm+Yvk4QugYOQ8Y63B/IrzVnJfTyv7gKvTJ0DnPgFhxxcArx1YcqZVvdlc

734QSbt5hyGUXm/vgg2eNp16PXPI715Dh5uiseOktWnHGjaFYDnz4Sz5CFFWJVnFwMxN

hJegnXOUUsxiS92PiNR3LlbqoLN8d33Uij2QWJhET6Bx0pJZ/aFlIEBDvldYTeb7A1eh

S3ecjXe7UeQqkJ1U7ojQXr54KpQsT6UjU8fexUIslrP7yn7wfor7KCuY4jabJRg0InaA

ETZg==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20251104; t=1779765445; x=1780370245;

h=to:subject:message-id:date:from:mime-version:x-gm-gg

:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to;

bh=4XFkbw8nKunIyIcPx/OVHxnenAbpdwkqVLhZWx84iHI=;

b=pvzvqu76FJliSwmdloquEsxdfeoDu5aymBwKvpzUAkT46deJmZnBb1iNFFSQ8/7ibC

2lXQ2Zuk4BCsoisDu2MNI1pNe7Q9Nz4IaEZuLdhSGrx+oZx/5WizH9HmNrbQ9WQblb00

j+zIgCxDZOdqznEW5AX6gPC5QyCR1DivTxLhbghbQDB0T5TpbykY9DqwzwBWK/A08USY

N5mqSgpgKDcPo/2kJsKaPXgJBUfKL+3x2mlxwY8ceU9UH7UdiWWRAdRJjDPPWxKWrNnA

kCHvzlft4JA0y96SPcQqPosL/MIP/XeJ+SvbQ1UakDH3fL1912Nc9jW0Cl2Oqv1dNp2A

CBZw==

X-Gm-Message-State: AOJu0YwdvAj2VPnEEWRU9rte6bbNaMqQevl3+FkInMCvJ13g9FH8MUlA

9Kq+KPMD+Vd1jM6NF6XNOv8qxWc+u0mV15G3jH9MN6frCXQP3aej7T1I3oqkBQ2ndhymhnjolwJ

yHuwFwYcI9QpysEyq2qddFP8W5EP6Bi18jsQjoM4=

X-Gm-Gg: Acq92OFUE6Cef0epHeGChronF91FPe9MVu/Wzolo69edQZ0ZzUMSELOTLbhYDePrFPG

BlhgLxVwfVwGnxIhYQBRO7SjSDZzoVdzPBA4ZidBqoMB6R3Lz55IN2pJ1mlU1KPW0m08Tzg5fCy

B1dSWHGQhIxa4uz5owiBjhYRp3bEgrDkQZEWwL3XhHe0AzMD7sDtDXEZq6mjEIhB7jE4bVdwSn4

9OxYuP0AMli+o/IDhS2Rc4YU7YLmWjvMeuF/FAKyUgDbduNcKukxutCWTOu79Z6hCsievgpLjKR

1ptb+WI0NV6ngxutOZpnXV3zcfVj3lVgQA==

X-Received: by 2002:a05:6000:470b:b0:452:d03a:7aad with SMTP id

ffacd0b85a97d-45eb38a6d8cmr27717921f8f.36.1779765444503; Mon, 25 May 2026

20:17:24 -0700 (PDT)

MIME-Version: 1.0

From: Onur Genc

Date: Tue, 26 May 2026 04:17:11 +0100

X-Gm-Features: AVHnY4IWItGDH8Fbf_Pdcf6dcG1LoiLw0dz_rIp7c16XTmQpaqKtYWtwBj6Mw-Y

Message-ID:

Subject: Deal update

To: root@nk.ca

Content-Type: multipart/alternative; boundary="0000000000001a6d400652afeff6"



--0000000000001a6d400652afeff6

Content-Type: text/plain; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable



Hello,



I came across your LinkedIn profile, Could you please let me know if

sending a proposal's information to the above address is okay.




Warm regards,

Mr. Onur Gen=C3=A7..



Caution: This email has been scanned for viruses and malware, and may have

been automatically archived by Mimecast, a leader in email security and

cyber resilience. Mimecast integrates email defenses with brand protection,

security awareness training, web security, compliance and other essential

capabilities. Mimecast helps protect large and small organizations from

malicious activity, human error and technology failure; and to lead the

movement toward building a more resilient world. To find out more, visit

our website..



--0000000000001a6d400652afeff6

Content-Type: text/html; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable





=3D"gmail_signature" data-smartmail=3D"gmail_signature">

iv style=3D"color:rgb(34,34,34)">

Neue",Helvetica,Arial,sans-serif">
obotoDraft, Helvetica, Arial, sans-serif" color=3D"#000000">Hello,
>

etica,Arial,sans-serif">
vetica, Arial, sans-serif" color=3D"#000000">

>

serif">
otoDraft, Helvetica, Arial, sans-serif">I came across your LinkedIn profile=

,=C2=A0

,sans-serif">Could you please let me know if sending a proposal's infor=

mation to the above address is okay.=C2=A0

>

<=

/b>

>Warm regards,
Mr. Onur Gen=

=C3=A7..


an style=3D"font-size:x-small;font-family:georgia,serif">
0000">Caution

02,102);font-family:georgia,serif">: This email has been scanned for viruse=

s and malware, and may have been automatically archived by Mimecast, a lead=

er in email security and cyber resilience. Mimecast integrates email defens=

es with brand protection, security awareness training, web security, compli=

ance and other essential capabilities. Mimecast helps protect large and sma=

ll organizations from malicious activity, human error and technology failur=

e; and to lead the movement toward building a more resilient world. To find=

out more,=C2=A0

02);font-family:georgia,serif">visit our website..
=





--0000000000001a6d400652afeff6--

Business partnership spam

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Mon, 25 May 2026 21:54:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wRirc-00000000MeT-3gaR

for dave@doctor.nl2k.ab.ca;

Mon, 25 May 2026 21:53:56 -0600

Resent-From: The Doctor

Resent-Date: Mon, 25 May 2026 21:53:56 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from [37.228.64.18] (port=50868 helo=mail2.adaoil.kz)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wRd48-000000003bu-0k0M

for root@nk.ca;

Mon, 25 May 2026 15:42:38 -0600

Received: from localhost (localhost [127.0.0.1])

by mail2.adaoil.kz (Postfix) with ESMTP id 188B12ADD73E

for ; Tue, 26 May 2026 02:41:03 +0500 (+05)

Received: from mail2.adaoil.kz ([127.0.0.1])

by localhost (mail2.adaoil.kz [127.0.0.1]) (amavisd-new, port 10032)

with ESMTP id 7OZbv3YsHkmB for ;

Tue, 26 May 2026 02:41:02 +0500 (+05)

Received: from localhost (localhost [127.0.0.1])

by mail2.adaoil.kz (Postfix) with ESMTP id A60EB279C780

for ; Tue, 26 May 2026 02:34:37 +0500 (+05)

X-Virus-Scanned: amavisd-new at mail2.adaoil.kz

Received: from mail2.adaoil.kz ([127.0.0.1])

by localhost (mail2.adaoil.kz [127.0.0.1]) (amavisd-new, port 10026)

with ESMTP id F8TqvZKvjkZu for ;

Tue, 26 May 2026 02:34:37 +0500 (+05)

Received: from [130.94.59.229] (unknown [130.94.59.229])

by mail2.adaoil.kz (Postfix) with ESMTPSA id 047902830CF6

for ; Tue, 26 May 2026 02:22:24 +0500 (+05)

Reply-To: mrsreamnassersaudi@gmail.com

From: "Mrs. Reem Nasser"

To: root@nk.ca

Subject: RE: Business Proposal / Saudi Aramco Group

Date: 26 May 2026 05:22:07 +0800

Message-ID: <20260526052207.99AE64A4DDE60D5C@adaoil.kz>

MIME-Version: 1.0

Content-Type: text/html

Content-Transfer-Encoding: quoted-printable

X-Spam_score: 7.7

X-Spam_score_int: 77

X-Spam_bar: +++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Greetings root@nk.ca, I have a genuine and promising business

proposal that I believe could be mutually beneficial, and I would very much

like the opportunity to discuss it with you. Would you be open to exploring

this opportunity as a trustworthy partner? Please let me know if you are

interested, and I would be happy to provide more details at your convenience.





Content analysis details: (7.7 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[37.228.64.18 listed in dnsbl.ahbl.org]

[37.228.64.18 listed in dnsbl.ahbl.org]

[37.228.64.18 listed in dnsbl.ahbl.org]

[37.228.64.18 listed in dnsbl.ahbl.org]

[130.94.59.229 listed in dnsbl.ahbl.org]

[130.94.59.229 listed in dnsbl.ahbl.org]

[130.94.59.229 listed in dnsbl.ahbl.org]

[130.94.59.229 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[37.228.64.18 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[37.228.64.18 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[37.228.64.18 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[37.228.64.18 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[130.94.59.229 listed in will-spam-for-food.eu.org]

[130.94.59.229 listed in will-spam-for-food.eu.org]

[130.94.59.229 listed in will-spam-for-food.eu.org]

[130.94.59.229 listed in will-spam-for-food.eu.org]

[130.94.59.229 listed in will-spam-for-food.eu.org]

[130.94.59.229 listed in will-spam-for-food.eu.org]

[130.94.59.229 listed in will-spam-for-food.eu.org]

[130.94.59.229 listed in will-spam-for-food.eu.org]

[37.228.64.18 listed in will-spam-for-food.eu.org]

[37.228.64.18 listed in will-spam-for-food.eu.org]

[37.228.64.18 listed in will-spam-for-food.eu.org]

[37.228.64.18 listed in will-spam-for-food.eu.org]

[37.228.64.18 listed in will-spam-for-food.eu.org]

[37.228.64.18 listed in will-spam-for-food.eu.org]

[37.228.64.18 listed in will-spam-for-food.eu.org]

[37.228.64.18 listed in will-spam-for-food.eu.org]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[37.228.64.18 listed in wl.mailspike.net]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[37.228.64.18 listed in bl.score.senderscore.com]

-0.0 SPF_PASS SPF: sender matches SPF record

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

0.5 NO_RDNS Sending MTA has no reverse DNS (Postfix variant)

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HK_NAME_MR_MRS No description available.

1.3 RDNS_NONE Delivered to internal network by a host with no rDNS

0.7 TO_NO_BRKTS_FROM_MSSP Multiple formatting errors

0.0 NO_RDNS2 Sending MTA has no reverse DNS

2.5 FREEMAIL_FORGED_REPLYTO Freemail in Reply-To, but not From

0.0 FROM_MISSPACED From: missing whitespace

0.0 TO_NO_BRKTS_NORDNS_HTML To: misformatted and no rDNS and HTML only

0.3 FROM_MISSP_EH_MATCH From misspaced, matches envelope

Subject: {SPAM?} RE: Business Proposal / Saudi Aramco Group














right: 0.5em; padding-bottom: 0.5em; padding-left: 0.5em;"> Greetings root@=

nk.ca,







I have a genuine and promising business proposal that I believe could be mu=

tually beneficial, and I would very much like the opportunity to discuss it=

with you.





Would you be open to exploring this opportunity as a trustworthy partner? P=

lease let me know if you are interested, and I would be happy to provide mo=

re details at your convenience.





Thank you for your time and consideration.





Best regards,


Mrs. Reem Nasser,
Business Development Manager,
Saudi Aramco Grou=

p Oil Company.


NetKnow Now in Netcraft's Top 15350 Part 2



Platinum Communications





Platinum Communications Corp.

bought out by Xplornet .



Wild Rose Internet





Wild Rose Internet

ranks >2000000 from >2000000 and I wonder if this is another wireless branch of Tera-Byte and bought out by Xplornet





TIC Internet





TIC Internet

ranks >2000000 from >2000000 ( I do remember you).



Nisa Custom Internet Solutions





Nisa Custom Internet Solutions

ranks >2000000 from >2000000 by Netcraft



MediaShaker





Media Shakers of Edmonton

ranks >2000000 from >2000000





Koi Media





Koi Media

rank >2000000 from >2000000



WebFire





Webfire.ca

ranks >2000000 from >2000000 and seems to be connected with Shaw.



Core Network Solutions Inc.





Core Network Solutions Inc.

ranks at >2000000 from >2000000 .



The Network Centre





The Network Centre

ranks >2000000 from >2000000 and are linked with Telus high Speed.





Open Concept Internet, Inc.





Open Concept Internet, Inc.

rank > 2000000 from > 2000000





Techalta





Interspots of Edmonton

acquired by Techalta ;



Yegtel





Yegtel rank > 2000000 .



Internet Crossroads





Internet Crossroads Ltd of North Edmonton

rank nothing from nothing by Netcraft and seems to merged with Tera-Byte/ecn.ab.ca .



If I remember anymore, I will add to this entry, before Netcraft changes our ranking. Please watch this space and please feel free to peruse

our services.

NetKnow Now in Netcraft's Top 15350 Part 1

All data is from Netcraft Toolbar .

Looks as if there are major changes to the Netcraft algorithm after some years! Why did Avast clasify the extension as URL:Phishing?

This is not the Alexa Tool Bar!



NetKnow







Netknow now at 15345 from 14636 at Netcraft
and pfs compliant



A significant decrease! We must do
  1. security audits regularly
  2. check on illegitimate traffic hitting the web server


  3. and
  4. keep design current!




How do we compare with other providers in

Edmonton
, Alberta, Canada?



Telus and reviews



Next we have Telus.com

ranked by Netcraft at 3287 from 3312 .

Sometimes their Web Hosting is done by
title="Internet Names for Business">Internet Names for Business


is ranked by Netcraft at >2000000 from >2000000 .



Is Telus's ADSL network susceptible to Code Red Attacks and Attackers?

Reviews of Telus are available :





Rogers





Rogers Business Solutions

which rank 5430 from 5344 and are hosted in Europe.



Government of Alberta



The Government of Alberta Website

ranks 14657 from 14793 by Netcraft and seems to hosted on Cloudfare.



Netknow again





We at Netknow are at 15345 from 18857 since the start of 2026.



City of Edmonton







The City of Edmonton
ranks 36235 from 35449 by Netcraft and hosted by Google.



University of Alberta







The University of Alberta
ranks 47175 from 47360 hosted by Amazon Techonologies.



Juno and NetZero





We have Juno Internet ranked on top

at 306335 from 336161 who are the owners of

US Based Netzero
at Netcraft Rank 82292 from 83219 .





NAIT / Northern Alberta Institute of Technology





NAIT ranks 124673 from 123989 hosted by Microsoft .





Grant MacEwen University





MacEwan ranks 129235 from 126399 .



TekSavvy



TekSavvy ranks 219230 from 228379 and are hosted by Microsoft



Shaw Cable





Next,

members.shaw.ca

ranks >2000000 from >2000000 and retired and

Shaw Cable

is next at Netcraft rank >20000000 from >20000000 . Hosted now by Akamei .

Their Network Hosting Arm,

Big Pipe is at

Netcraft rank 345961 from 349214 and hosted by Akamai in Europe .



Reviews of Shaw are available :





Internet Centre / CCINet



Internet Centre

rank 352698 from 380368 . Their partner Rack Nine ranks > 2000000.



Xplornet



xplornet

ranks >2000000 from >2000000 and are listed with

Cirrus9 and are joining up with Shaw.

Their new domain xplore.ca ranks 444878 from 451922 .

According to an article in the Sherwood Park Independent, they are also getting an Alberta Government subsidy.



Distributel / 3Web / CIA



Cybersurf

is ranked 971531 from 873158 and seems to be hosted in USA by DigitalOcean.



Primus



Primus

ranks >2000000 from >2000000 and now points to BLACKIRON_DataCentres ranked >2000000 from >2000000.



Northern lights Fiber







Northern lights Fiber
are ranked by Netcraft >2000000 and uses AWS.



OkayVPN





OkayVPN

are ranked by Netcraft >2000000 and uses Cloudfare.



Radiant Communications / goco.ca





Radiant Communications

are ranked by Netcraft >2000000 and part of goco.ca

which ranks >2000000 .



Tera Byte Edmonton and reviews





Next is Tera-Byte

at Netcraft Rank >2000000 with

Tera-Byte.ca

ranking >2000000 from >2000000 and their wireless arm Tera-Byte Wireless

sold to Xplornet.

One of Tera-Byte's acquisitions

Edmonton Community Networks

ranks at >2000000 from >2000000 and

Go Edmonton ranks >2000000 from >2000000.

Alberta political blogger Daveberta ranks >2000000 from >2000000; interesting!!!

Reviews of Tera-byte is available at

here

and another here

and check Google for more reviews; just search tera byte.



MCSnet





MCSNET ranks >2000000 from >2000000 and are hosted by Microsoft .



Nucleus Internet Services





After that we have

Nucleus Information Services
which can be found at Netcraft Rank >2000000 from >2000000 .





4Web





4web ranks >2000000 from >2000000 .



Alentus / Wolfpaw





Alentus

rank by Netcraft >2000000 from >2000000 and I note they are hosted in the USA .

wolfpaw.net

which ranks at >2000000 from >2000000



Yellowpencil





Yellowpencil Ranks >2000000 from >2000000



WSI Corporation





Next is WSI - We Simply The Internet of Toronto

at Netcraft Position >2000000 from >2000000 and are being hosted on Amazon.



Uniserve / Interbaun





Next, Uniserve

ranks on Netcraft >2000000 from >2000000

One of their acquisitions

interbaun

ranks with Netcraft ?????? from ?????? due to merging of sites.

One customer just came over from this organization in Nov 2006.



Clearwave Broadband





Clearwave Broadband ranks

at >2000000 from >2000000

Centex Phish

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Mon, 25 May 2026 13:58:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wRbQt-00000000IHz-244r

for dave@doctor.nl2k.ab.ca;

Mon, 25 May 2026 13:57:51 -0600

Resent-From: The Doctor

Resent-Date: Mon, 25 May 2026 13:57:51 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from ns1.robo.co.jp ([219.166.6.18]:57744 helo=mail.robo.co.jp)

by doctor.nl2k.ab.ca with esmtp (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wRaaz-000000005TP-2wJb

for sales@nk.ca;

Mon, 25 May 2026 13:04:25 -0600

Received: from synergyhub.com.my (unknown [104.223.84.134])

by mail.robo.co.jp (Postfix) with ESMTPA id 84AF162116

for ; Tue, 26 May 2026 04:00:22 +0900 (JST)

From: "Accounts Payable - (Stephanie Delanoy)"

To: sales@nk.ca

Subject: ref : EFT Payment Notification for Inv#76620

Date: 25 May 2026 12:03:22 -0700

Message-ID: <20260525120321.F9AE528F389EF2C0@synergyhub.com.my>

MIME-Version: 1.0

Content-Type: multipart/mixed;

boundary="----=_NextPart_000_0012_E0246A6A.51D43055"



This is a multi-part message in MIME format.



------=_NextPart_000_0012_E0246A6A.51D43055

Content-Type: multipart/related;

boundary="----=_NextPart_001_0013_E0246A6A.51D43055"



Dear sales,



Please find below your electronic remittance advice for Inv#16147



Payments will be post to your account within 1-5 business days of the attached remittance advise document.



Payment Secure Document for:sales@nk.ca

Scanned by: nk.ca Trusted AI Scanner Detector.

Attachment type: PDF

Date:5/25/2026 12:03:21 p.m.



If you do not receive this payment or have questions please do not hesitate to contact and reach out to us.







Thanks



Credit Team







CONFIDENTIALITY NOTE: This message is intended only for the use of the individual or entity to which it is addressed and may contain information that is privileged, confidential and exempt from disclosure under applicable law. If the reader of the message is not the intended recipient, you are hereby notified that any dissemination, distribution or copying of this communication is strictly prohibited. If you have received this communication in error, please notify us immediately and delete this message permanently from your files