Geek Squad phish from Microsoft Outlook Part 4

Haresasz Nxysarwsa has invited you to Geek Squad Renewal Transaction Record

Title: Geek Squad Renewal Transaction Record

Location: https://meet.google.com/ujq-qkkn-tpn

When: May 22, 2026

Organizer:

Haresasz Nxysarwsa

Description: Dear Client,



We are pleased to notify you that the Geek Squad 365 Advanced Protection Plan has undergone a successful renewal for another three-year term.



The required amount of $214.99 was charged against your saved payment option. Please wait up to twenty-four hours for this activity to reflect on your personal bank account statements.



Transaction Overview:

Item: 365 Advanced Protection Plan

Span: 3 Years

Charged: $214.99



If this charge is unfamiliar or unauthorized by you, dial our Billing Specialists right now at +1 805 747 1260 to request instant and complete cancellation help.



Thank you for continuing to prefer Geek Squad for safety.



Respectfully,

Geek Squad Billing Team



-::~:~::~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~::~:~::-

Pripojiť sa cez Google Meet: https://meet.google.com/ujq-qkkn-tpn



Viac o službe Meet sa dozviete na https://support.google.com/a/users/answer/9282720



Túto sekciu neupravujte.

-::~:~::~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~::~:~::-

Attendees:



cynthiaperez389903@groups.outlook.com



Geek Squad Renewal Transaction Record

Pripojiť sa cez Google Meet – Dear Client, We are pleased to notify you that the Geek Squad 365 Advanced Protection Plan has undergone a successful renewal for another three-year term. The required amount of $214.99 was charged



Pripojiť sa cez Google Meet

Odkaz na stretnutie

meet.google.com/ujq-qkkn-tpn

Dear Client,



We are pleased to notify you that the Geek Squad 365 Advanced Protection Plan has undergone a successful renewal for another three-year term.



The required amount of $214.99 was charged against your saved payment option. Please wait up to twenty-four hours for this activity to reflect on your personal bank account statements.



Transaction Overview:

Item: 365 Advanced Protection Plan

Span: 3 Years

Charged: $214.99



If this charge is unfamiliar or unauthorized by you, dial our Billing Specialists right now at +1 805 747 1260 to request instant and complete cancellation help.



Thank you for continuing to prefer Geek Squad for safety.



Respectfully,

Geek Squad Billing Team

Kedy

piatok 22. máj 2026

Organizátor

Haresasz Nxysarwsa

haressaznzxrrsxaxz321@gmail.com

Hostia

(Zoznam hostí bol na žiadosť organizátora skrytý)

Odpoveď na cynthiaperez389903@groups.outlook.com

Áno



Nie



Možno

Ďalšie možnosti



Pozvánka z Kalendára Google



Túto správu ste dostali, pretože ste účastníkom danej udalosti.



Ak túto pozvánku prepošlete, ktorýkoľvek jej príjemca bude môcť odoslať odpoveď organizátorovi, byť pridaný do zoznamu hostí, pozývať iných bez ohľadu na ich vlastný stav pozvánky alebo meniť vaše potvrdenie účasti. Ďalšie informácie

Geek Squad phish from Microsoft Outlook Part 3

Content analysis details: (13.7 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[40.93.23.97 listed in dnsbl.ahbl.org]

[40.93.23.97 listed in dnsbl.ahbl.org]

[40.93.23.97 listed in dnsbl.ahbl.org]

[40.93.23.97 listed in dnsbl.ahbl.org]

[209.85.128.70 listed in dnsbl.ahbl.org]

[209.85.128.70 listed in dnsbl.ahbl.org]

[209.85.128.70 listed in dnsbl.ahbl.org]

[209.85.128.70 listed in dnsbl.ahbl.org]

[2603:10a6:10:4bc:0:0:0:18 listed in]

[dnsbl.ahbl.org]

[2603:10a6:10:4bc:0:0:0:18 listed in]

[dnsbl.ahbl.org]

[2603:10a6:10:4bc:0:0:0:18 listed in]

[dnsbl.ahbl.org]

[2603:10a6:10:4bc:0:0:0:18 listed in]

[dnsbl.ahbl.org]

[2603:10a6:10:4bc:cafe:0:0:bc listed in]

[dnsbl.ahbl.org]

[2603:10a6:10:4bc:cafe:0:0:bc listed in]

[dnsbl.ahbl.org]

[2603:10a6:10:4bc:cafe:0:0:bc listed in]

[dnsbl.ahbl.org]

[2603:10a6:10:4bc:cafe:0:0:bc listed in]

[dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[40.93.23.97 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[40.93.23.97 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[40.93.23.97 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[40.93.23.97 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[209.85.128.70 listed in will-spam-for-food.eu.org]

[209.85.128.70 listed in will-spam-for-food.eu.org]

[209.85.128.70 listed in will-spam-for-food.eu.org]

[209.85.128.70 listed in will-spam-for-food.eu.org]

[209.85.128.70 listed in will-spam-for-food.eu.org]

[209.85.128.70 listed in will-spam-for-food.eu.org]

[209.85.128.70 listed in will-spam-for-food.eu.org]

[209.85.128.70 listed in will-spam-for-food.eu.org]

[2603:10a6:10:4bc:cafe:0:0:bc listed in]

[will-spam-for-food.eu.org]

[2603:10a6:10:4bc:cafe:0:0:bc listed in]

[will-spam-for-food.eu.org]

[2603:10a6:10:4bc:cafe:0:0:bc listed in]

[will-spam-for-food.eu.org]

[2603:10a6:10:4bc:cafe:0:0:bc listed in]

[will-spam-for-food.eu.org]

[2603:10a6:10:4bc:cafe:0:0:bc listed in]

[will-spam-for-food.eu.org]

[2603:10a6:10:4bc:cafe:0:0:bc listed in]

[will-spam-for-food.eu.org]

[2603:10a6:10:4bc:cafe:0:0:bc listed in]

[will-spam-for-food.eu.org]

[2603:10a6:10:4bc:cafe:0:0:bc listed in]

[will-spam-for-food.eu.org]

[2603:10a6:10:4bc:0:0:0:18 listed in]

[will-spam-for-food.eu.org]

[2603:10a6:10:4bc:0:0:0:18 listed in]

[will-spam-for-food.eu.org]

[2603:10a6:10:4bc:0:0:0:18 listed in]

[will-spam-for-food.eu.org]

[2603:10a6:10:4bc:0:0:0:18 listed in]

[will-spam-for-food.eu.org]

[2603:10a6:10:4bc:0:0:0:18 listed in]

[will-spam-for-food.eu.org]

[2603:10a6:10:4bc:0:0:0:18 listed in]

[will-spam-for-food.eu.org]

[2603:10a6:10:4bc:0:0:0:18 listed in]

[will-spam-for-food.eu.org]

[2603:10a6:10:4bc:0:0:0:18 listed in]

[will-spam-for-food.eu.org]

[40.93.23.97 listed in will-spam-for-food.eu.org]

[40.93.23.97 listed in will-spam-for-food.eu.org]

[40.93.23.97 listed in will-spam-for-food.eu.org]

[40.93.23.97 listed in will-spam-for-food.eu.org]

[40.93.23.97 listed in will-spam-for-food.eu.org]

[40.93.23.97 listed in will-spam-for-food.eu.org]

[40.93.23.97 listed in will-spam-for-food.eu.org]

[40.93.23.97 listed in will-spam-for-food.eu.org]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[40.93.23.97 listed in list.dnswl.org]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-0.0 SPF_PASS SPF: sender matches SPF record

1.0 HK_RANDOM_REPLYTO Reply-To username looks random

1.0 HK_RANDOM_FROM From username looks random

0.5 FROM_LOCAL_NOVOWEL From: localpart has series of non-vowel letters

3.5 VOWEL_FROM_7 Impronouncable from header (7+ consecutive vowels)

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[40.93.23.97 listed in wl.mailspike.net]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[40.93.23.97 listed in bl.score.senderscore.com]

0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in digit

[haressaznzxrrsxaxz321(at)gmail.com]

0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider

[haressaznzxrrsxaxz321(at)gmail.com]

-0.0 T_RP_MATCHES_RCVD Envelope sender domain matches handover relay

domain

0.0 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level mail

domains are different

0.1 TW_RW BODY: Odd Letter Triples with RW

0.6 MEGALONGWORD BODY: Uses really overlong words

0.1 TW_QK BODY: Odd Letter Triples with QK

0.3 LONGWORD BODY: Uses overlong words

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

0.2 FREEMAIL_FORGED_FROMDOMAIN 2nd level domains in From and EnvelopeFrom

freemail headers are different

2.0 RATWR8_MESSID Message-ID with excessive dashes and dollars

0.1 TO_IN_SUBJ To address is in Subject

3.0 LONG_INVISIBLE_TEXT Long block of hidden text - bayes poison?

Subject: {SPAM?} =?UTF-8?Q?Pozv=C3=A1nky=3A_Geek_Squad_Renewal_Transaction_Record_=40_p?=

=?UTF-8?Q?i_22=2E_m=C3=A1j_2026_=28cynthiaperez389903=40groups=2Eoutlook=2Ecom=29?=

Geek Squad phish from Microsoft Outlook Part 2

X-Microsoft-Antispam-Message-Info:

=?utf-8?B?VTRDd09MYlJuVEVrY0lXdXVjVHJHMTcrRzJqaldnZ0FHTW9kTlNyWFZ5WjVH?=

=?utf-8?B?WFRiUVhnZURTOWk2NGVUNmIvb1pLektBbEorQUcyU2x5bFBUTlk1SHJrdVlt?=

=?utf-8?B?YWhoYjBYZmRaS1NuekZyQk1YOGR1Lzk3aXc0bWpqa1ptQUlsd0VQTTJDU21z?=

=?utf-8?B?OXdsYi9CMy95OEZGSWZ2Ny9TY1BFa2ZDY1VqM2t1N3R3eEVxeWw0bkg4UkI3?=

=?utf-8?B?dHUxbENWd0ovMVhPdEhXVDRpeFF0bHhSWW92N0FSZnRQQ2cvT2NsWEV0WlVU?=

=?utf-8?B?cUc1bk1IdVdPRU5ySnJBYUp0MCtKbFkrVTZ0WHhyK252MVEyL3AyU2ljZkpt?=

=?utf-8?B?RStWMnoraW4zTVpJZE9nRFd0RERSclNid0FJSE5ydjBUQldCaVVwY3M2WDhw?=

=?utf-8?B?MEV6aGMycHNTOUJIaWRjdy9tY0htMmJvTVlVMmtidnhQM3hYTkNjRzVWUlAw?=

=?utf-8?B?YVNBZEZ6SUVZUFFDQWg5NjE2MTFOSGMwR1FpRDliVjY4Z1FOTk43cHkyY0cy?=

=?utf-8?B?M24zam5Kd2JKM3JJYkl4Z2tIZVBRK1JoMURRQ3loWFA4dTRmbmRBNzZVSmhC?=

=?utf-8?B?SDNDL3RxYnlGYzdvKzFRcnpuVnRuaG1IRnhuais0Q2xSQVA2SnRxdFc2dDJD?=

=?utf-8?B?TmUxTFlYL05nbExybVhSVDIwdTBUZnMvMzRTTm1LK0lxbGowSlRQYXhCSFZo?=

=?utf-8?B?VGNCZUp1VjlpMzAzQnFEN2ROTk55aDN2djBjMURZTzZ3UCtVMml5aExUMGds?=

=?utf-8?B?MnlQZWlCbG8xbTlmYUFkQ0hRUUhBRWRPOFFvSm5uVVUwK2I0d09GQWR0dkJM?=

=?utf-8?B?NWVlVEtxN1V3U2g5VjBKRFhBRFMrVWNoTlBJYlEyWVF0WEJxQXgxTDNXd0Mz?=

=?utf-8?B?UFZFdjBHS2hyM2t0S2NHZHM5dWgzWXRHdWxTYkY3OVhqcWpQeWRJbDRST3lE?=

=?utf-8?B?WmFERzY5WnFPaGx1bFNpQVJOWUZVT1lRcXBQZWF5QjBLY0V3ZmFOY1FtcEMz?=

=?utf-8?B?SWtmZ0ZOZHYyUm5ubDNPcDZ2ZjVLaUs1dDNQbUE1dS84SEVSSjFQNGN5V1Y4?=

=?utf-8?B?YVh2NVg3UkNZaEZMMHlPclRMOXA1MzdocVloeUFRcWJTSmNPbHcrOFBFOG1R?=

=?utf-8?B?Tkk1bUticHArNHhjQ29tWFVNa0dxcEIvaGlkQVNURjErbit0M1k4cUNLcGdC?=

=?utf-8?B?NytTK0JGNzJUckpDYjMrR2lhaW9mVHhrZ3hacVNBM0JDWk80b0tLMjhndFRu?=

=?utf-8?B?cURuRzVhaDBmQnFTOGUrd1ZUWXlFTTdyRmFzNE1XR1psd0FGT0hOTktiMVVy?=

=?utf-8?B?Q1RBY1p1QitnOC9sVEl1MmpZeE4zcEVJWVJzdW1qRGlPay9sWUY2ZytkMTAy?=

=?utf-8?B?T1AzQUJRZmd1ZHErRkJ0Slg3TlZ0QVlKZ3hPYmlCZ1RnYkZFT2ErUlZlYktt?=

=?utf-8?B?bWs0bGUzbEpYNEJZam5WMzAvSXBncDdrL2x5WGdpOTd3bFpWcndWeXpyWDFx?=

=?utf-8?B?L1czSHZzN3hNMlY5QkI5eUlwY05YZFFxNjlBM09nYWlYdjBUNkpMZjJyWmxV?=

=?utf-8?B?N0hxakJDTDlZZENPZ1VHZTQ5by9lNnlzNWZ2NFJ2YW5jV0EzaUtIMHZ3NWEr?=

=?utf-8?B?VEg1OElVTThXaTVUQ3FXZFdmYU54UnZkRTJNU3dLalVDc2NHUU9WYUNiTjRU?=

=?utf-8?B?ZDlMTDMzT2RXRzJUaVZVVUErQlJlSjQzbnBvV3c5WjIyVmNiY2ZLUkc2Smd3?=

=?utf-8?B?THpvcGp1Z1B6RUNWd1pUczducUpRc3Fra1RJL1dHSzJEWGJUSDBDS1FkazFx?=

=?utf-8?B?cWdva1pYNFRUYldGT29OUVBvUy9DZ25aQ2hpY05zT3kxTHJJUW9Pc3E5OFpN?=

=?utf-8?B?ZGdGYXZsTnp1NG9JcWpmM1RUR21EQ3hXRGkxL3lPbkhvbXZteDhINzJCc1Qw?=

=?utf-8?B?bys3aS9HNWhBemNnNW9rMDlNaDR3dGhmRHN1MVh5cGVVUS9MT1A2V01lNTdu?=

=?utf-8?B?RXJEbFVwdVdSa1dkV0pZdDVGV2o2MkNwdkpHVHdzbGZpOTZQY0ZCVFEwZDM5?=

=?utf-8?B?dTVvbGlUVW42UDFYT3FMaWM1VHhrQVlYZENkcVRKZ3ZldzhMdXZHcW94eVp3?=

=?utf-8?B?OE9xSDZ5cDNyQkR1TmQ5WUFoRGNsSHY3dXpYV0JjcFlLeW1ZRGx4UzFXZ0dS?=

=?utf-8?B?blBxUWNoVjQxS2toUjhZSE94Tm9NNzJ6WDgxMnRrM2NMYjVZMXpmYTRhWlda?=

=?utf-8?B?ajRjalRJUEVWMUxLRUtHKzhNZW9xY2o2RjZleGlkNHpoNjRXSXhTTUdkVVBp?=

=?utf-8?B?MXovVnZlTHVxY0xXbUpsaTd5akYrK0ZxbmFIS3FxcDBCSmNaaWV3dFk2OHdN?=

=?utf-8?B?ekdHenkzWFhoVy9IOVp5dHh0MHFTd2RUYUJKd3k5MWhBc0s4cDlZVkNFMm0x?=

=?utf-8?B?eXl1S1UyUlF5eWxIZW45dDNWV0VMUWhjRXBXY0cvWldGOWZES3dEckd3bzA3?=

=?utf-8?B?YjRqZVBTS0F5ZVBpQTdZTTlmZG94OWVyTWk4VDVFUm5hNE5HckV2ZEFjbm1k?=

=?utf-8?B?MUtsem5NaFFMYk1pTlk1czNxSU52TFpyVFJXa3AvNkdBZEdGcGoyV1BveUI5?=

=?utf-8?B?UldTakdMdnc3d2QzWFNUektVaGp3QXJYQ3o2OTAvbXNGbW1JNFJNSDBmTllQ?=

=?utf-8?B?NCtBNC9GMXc0cTZ3TkRMUHdNYS9mSEhreFBtSS9ITEM0b1JOalQwcVhoNlN0?=

=?utf-8?B?SG1mcHNEZHB5ekVtVkR5SldpOHZNeFJocHFrMC9wNldTMnJXM3VMdzd4cExJ?=

=?utf-8?B?U3Fub1FLSW5HRS9YeEpJZGVhR1g4YTFRODg4bXZTenJsL3lNKzBrNU0veElT?=

=?utf-8?B?U1NXaVNTVndDWEovQVVMTjF2Y3BMUkJZemUyNjdPR1VSUU1iUFRCekZoc2Qv?=

=?utf-8?B?eEhaQkJoejVuTFhqRFZFODhpSTVFcTZmVHl6VXRidFVLdmtVTGwvTzJzdThj?=

=?utf-8?B?L1FoamhIOG1EZXZiRkNla3lyeXVJdGhlWUYvZWcyR1AvNjhCK1F4Qm1PMDVi?=

=?utf-8?B?QkE1QnNmNHRRRGZobVZCM3VKQ2xzdFhPVUQ5WkVCUGM2TGk0anZKQjNjMzJZ?=

=?utf-8?B?RzZZbmtJUTA2d2VIZEM2cnNXdXZZQzFiaVQrL3Z0SHBubzhZTUNPdGdlTFpw?=

=?utf-8?B?UDVyZktuQjdlQjg0UEw3V25SaTdhUDJUditmUWpYdUwzdFpYcmMyZ2toQi9V?=

=?utf-8?B?RVN1Z0swNWlINW90VFh3c3p2NHpzVjhDV1V0NDdFSHV2Ukc4cTNTakQ1enJV?=

=?utf-8?B?ckVZUmRiU01QRG92ekxwTGhuV21OcnNlYmpuSU5oQ0RQdktPaFJOVys5a0xv?=

=?utf-8?B?STdqRHVKWXl4MWFjR201K1dwZ1Ntc1NZSWdLWVZuakNIb3lMKzVOdkR2d3Q1?=

=?utf-8?B?TVkwZXh4bXg2ajVhbk90MEZkSVNkVEZXVGcvNm9CcXRhY3FzclJPbWVPeGN2?=

=?utf-8?B?K1BBZzhhdG1BL1I2MFlJSmhnRkRqbTZqM2pEQTZvS2NrRnl2a1llQ2dDY1BZ?=

=?utf-8?B?MFZRSkY5Nmh3VkdxS1hsa3lVaWhkRmt5Y01LQkt4d2N3ckFDc0tGS29DTTVS?=

=?utf-8?B?M1orOGR0V2s4MXVOQ1M5NXByak9XMlVHRmFjQXZQcjNsRE1uUndyS1dPWUli?=

=?utf-8?B?YThOWW41cm9ZQzlGN3B2eEs5QXNNblY5YkJzVm8rOU9IY0k1OHRhNDhwcVVq?=

=?utf-8?B?NHYrMXF2YTZMVmNVRDNJdmltVlJNNTFpd0lha3AwNUhHd0ROVytqeWV4TlVG?=

=?utf-8?B?b3JrTmxaWHV6eG1XanhKMk1lWUQwR0NPU0pJMVNrZ2hwMkJRRWRWdWZRRDND?=

=?utf-8?Q?fng7UaIKHDp9pY371/F8WLuKqW+7rgBVdW7KqZVEd5nIb?=

X-Auto-Response-Suppress: DR, OOF, AutoReply

X-OriginatorOrg: sct-15-20-9412-4-msonline-outlook-090a5.templateTenant

X-MS-Exchange-CrossTenant-OriginalArrivalTime: 22 May 2026 15:19:11.4545

(UTC)

X-MS-Exchange-CrossTenant-Network-Message-Id: 42a9d0cd-3f17-4fcb-a07e-08deb8157a0d

X-MS-Exchange-CrossTenant-Id: 84df9e7f-e9f6-40af-b435-aaaaaaaaaaaa

X-MS-Exchange-CrossTenant-AuthSource: DB3PEPF00008860.eurprd02.prod.outlook.com

X-MS-Exchange-CrossTenant-AuthAs: Anonymous

X-MS-Exchange-CrossTenant-FromEntityHeader: Internet

X-MS-Exchange-Transport-CrossTenantHeadersStamped: BY1PR18MB5399

X-Spam_score: 13.7

X-Spam_score_int: 137

X-Spam_bar: +++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Geek Squad Renewal Transaction Record piatok 22. máj 2026

Pripojiť sa cez Google Meet https://meet.google.com/ujq-qkkn-tpn?hs=224

Dear Client,

Geek Squad phish from Microsoft Outlook Part 1

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Fri, 22 May 2026 11:51:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wQU0p-000000001z8-3vLo

for dave@doctor.nl2k.ab.ca;

Fri, 22 May 2026 11:50:19 -0600

Resent-From: The Doctor

Resent-Date: Fri, 22 May 2026 11:50:19 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-westus3azlp17010097.outbound.protection.outlook.com ([40.93.23.97]:52616 helo=PH7PR06CU001.outbound.protection.outlook.com)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wQRfe-00000000BDa-3Z2p

for doctor@doctor.nl2k.ab.ca;

Fri, 22 May 2026 09:20:31 -0600

Received: from DUZPR01CA0120.eurprd01.prod.exchangelabs.com

(2603:10a6:10:4bc::18) by BY1PR18MB5399.namprd18.prod.outlook.com

(2603:10b6:a03:531::6) with Microsoft SMTP Server (version=TLS1_2,

cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.48.17; Fri, 22 May

2026 15:19:12 +0000

Received: from DB3PEPF00008860.eurprd02.prod.outlook.com

(2603:10a6:10:4bc:cafe::bc) by DUZPR01CA0120.outlook.office365.com

(2603:10a6:10:4bc::18) with Microsoft SMTP Server (version=TLS1_3,

cipher=TLS_AES_256_GCM_SHA384) id 15.21.48.17 via Frontend Transport; Fri, 22

May 2026 15:19:11 +0000

Authentication-Results: spf=pass (sender IP is 209.85.128.70)

smtp.mailfrom=gmail.com; dkim=pass (signature was verified)

header.d=google.com;dkim=pass (signature was verified)

header.d=gmail.com;dmarc=pass action=none header.from=gmail.com;compauth=pass

reason=100

Received-SPF: Pass (protection.outlook.com: domain of gmail.com designates

209.85.128.70 as permitted sender) receiver=protection.outlook.com;

client-ip=209.85.128.70; helo=mail-wm1-f70.google.com; pr=C

Received: from mail-wm1-f70.google.com (209.85.128.70) by

DB3PEPF00008860.mail.protection.outlook.com (10.167.242.11) with Microsoft

SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.71.7 via

Frontend Transport; Fri, 22 May 2026 15:19:11 +0000

X-IncomingTopHeaderMarker:

OriginalChecksum:0F179618E27EEED1FB4BEB8B99148AD2102E123F29068982E4485764FE389789;UpperCasedChecksum:6173AB4FA4EFBB8E7B490DB64F84162BDF3B7539759D3F4BB916C5E56824F964;SizeAsReceived:3377;Count:15

Received: by mail-wm1-f70.google.com with SMTP id 5b1f17b1804b1-49047e9ca88so4434065e9.3

for ; Fri, 22 May 2026 08:19:11 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=google.com; s=20251104; t=1779463151; x=1780067951; darn=groups.outlook.com;

h=to:from:subject:date:message-id:sender:reply-to:mime-version:from

:to:cc:subject:date:message-id:reply-to;

bh=XnRkUBUfTrWQF7w2MVX4sXJh0lpDabTRDoEKm+fTczo=;

b=G1mpIX7UEJe0dL44rCXTnP+1Vgu8gcD/ByzjgDS4e1oTFuV7Udk+9K3WIEwTvzKPY1

G0QkW64oIxxUrXPSN56ioP+/RCdgrsea4KraBNjknx4KrG43i5/zLM+UphAQA9hMe6r9

PjXsESYGFFX3TUeUn5dvTny2Ridb8krgcIp3kGY/VVTIeiLXTCuNB4MhCVkWaQTSU8er

lC3Z8K2zKssam/K+wm+T1uenzjHQjEIitYUKwsaSai1259BKYML425fvMf0KXuvNXzkg

2oviLionwbKz5RZR4LA0BNgH57kbTfppLITFYyOY6Yy1cati2veUn+o1qEN9fGcVaxX8

TQmA==

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=gmail.com; s=20251104; t=1779463151; x=1780067951; darn=groups.outlook.com;

h=to:from:subject:date:message-id:sender:reply-to:mime-version:from

:to:cc:subject:date:message-id:reply-to;

bh=XnRkUBUfTrWQF7w2MVX4sXJh0lpDabTRDoEKm+fTczo=;

b=qNcHgFOP5Uqhc9EuTidGc+BxacWvSqe9f8lFGlXSR0rbLGwmZG/0TYtxxt/UewEJdE

tjaZl9tahtoP9DY/BfpGyUVYGDi6w/1dx27wvhO+BNli2yvNFKWXzDczcqFR3IJxrfok

+JP/PjNhR4c5Sk71NrjLWhOseOw18BnLm/CSfk0sIBLoAnz4cQ0+aKdjGu0CrFg02fEU

2DJnMgS7IR62srLThskHZELmb86hAlr3txXGLUyZZk6WCFLxEGINZKykgoDEcgORrwf3

Yebur1xYICt9HsVsMTXCvo3mWjrMIO0BLK9xwNTW40uAdtu1BA+ohBmLoaBqKIxIKv0a

sFWQ==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20251104; t=1779463151; x=1780067951;

h=to:from:subject:date:message-id:sender:reply-to:mime-version

:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to;

bh=XnRkUBUfTrWQF7w2MVX4sXJh0lpDabTRDoEKm+fTczo=;

b=mcEOG6bhdXj612U9OJ9w9NGYAUYRhBIQdE/54/Dzt52BKsVEun89ztoj2At8kd2DVM

UAvIXX7FNALcv2hQwvl8+qsovL4TQbr91OaksFmLEiVFNNUznnEMkXI/0kJbgPym8VxK

BgfbF4nYM5Of3Ag5AvviiYfseTWSDopG27VMEhTKawsYxY1AxTrOUVayTz4ZRwtBcFMZ

IHIa1wcpzB4OO5C7ao1qiXuyFoXEUzUi2/5stwp8xrLmVZC4xSFy0QhFO41idPEaz7Wm

tcymqkfWUHI1h9nEzTK4mFKcoxAX9qD2LK670qY7N6WngbZ2J5Nqt+cRlFSObupO9MRR

bkbQ==

X-Gm-Message-State: AOJu0YzSx1IcjTZmtczD6TkegiF+7zvpgL4LCYbs/H7Abn4QD/AXmGKN

a7rb4QqBjPBgSrPPaehZ1e8Y5U6sx1nTDkYwKfU7uzmz0WvzFNd4QbJZQSzcR+kjcMnKg4ulp/d

ayHTkr/h4IFblA/6tg9qyThpweawfSshNvbc=

MIME-Version: 1.0

X-Received: by 2002:a05:600c:4e13:b0:490:4e0f:64d8 with SMTP id

5b1f17b1804b1-4904e0f6815mr3663765e9.0.1779463150713; Fri, 22 May 2026

08:19:10 -0700 (PDT)

Reply-To: Haresasz Nxysarwsa

Sender: =?UTF-8?Q?Kalend=C3=A1r_Google?=

Message-ID:

Date: Fri, 22 May 2026 15:19:10 +0000

Subject: =?UTF-8?Q?Pozv=C3=A1nky=3A_Geek_Squad_Renewal_Transaction_Record_=40_p?=

=?UTF-8?Q?i_22=2E_m=C3=A1j_2026_=28cynthiaperez389903=40groups=2Eoutlook=2Ecom=29?=

From: Haresasz Nxysarwsa

To: cynthiaperez389903@groups.outlook.com

Content-Type: multipart/mixed; boundary="000000000000fd44e00652698c3c"

X-IncomingHeaderCount: 15

X-EOPAttributedMessage: 0

X-EOPTenantAttributedMessage: 84df9e7f-e9f6-40af-b435-aaaaaaaaaaaa:0

X-MS-PublicTrafficType: Email

X-MS-TrafficTypeDiagnostic: DB3PEPF00008860:EE_|BY1PR18MB5399:EE_

X-MS-Office365-Filtering-Correlation-Id: 42a9d0cd-3f17-4fcb-a07e-08deb8157a0d

X-MS-Exchange-EOPDirect: true

X-Sender-IP: 209.85.128.70

X-SID-PRA: HARESSAZNZXRRSXAXZ321@GMAIL.COM

X-SID-Result: PASS

X-MS-Consumer-Group-Expansion-Loop: cynthiaperez389903@groups.outlook.com

X-MS-Exchange-Group-Expansion-Loop: cynthiaperez389903@groups.outlook.com

X-Microsoft-Antispam:

BCL:0;ARA:1444111002|970799063|5139299004|4040799016|34130799006|9400799043|24102599021|9020799019|32020799003|16200799027|22000799015|1680799066|26130799012|9000799056|3151999006|6092099016|3069299007|6019299003|26000799027|29080799009|5149299006|21002599022;

List spam from Google User

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Fri, 22 May 2026 11:49:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wQTz1-000000001NC-2hD4

for dave@doctor.nl2k.ab.ca;

Fri, 22 May 2026 11:48:27 -0600

Resent-From: The Doctor

Resent-Date: Fri, 22 May 2026 11:48:27 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from 138.191.192.35.bc.googleusercontent.com ([35.192.191.138]:59290 helo=[10.88.0.4])

by doctor.nl2k.ab.ca with esmtp (Exim 4.99.3 (FreeBSD))

id 1wQPQi-00000000P02-3vZE

for root@nk.ca;

Fri, 22 May 2026 06:56:52 -0600

Content-Type: multipart/related; boundary="===============1254440665516529268=="

MIME-Version: 1.0

From: "Nagindas Khandwala College ."

To: root@nk.ca

Subject: =?utf-8?q?Completed=3A_Shared_via_ShareFile_=E2=80=93_Nagindas_Khandwala_College_shared_a_summary-Bonus=5FStatement=5F2026=2Epdf__Contact=2E?=

X-Priority: 2

X-Spam_score: 6.8

X-Spam_score_int: 68

X-Spam_bar: ++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Reimbursement Summary Nagindas Khandwala College shared a

summary Shared from Nagindas Khandwala College Finance • 23 May, 2026



Content analysis details: (6.8 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.4 MISSING_DATE Missing Date: header

0.1 MISSING_MID Missing Message-Id: header

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[35.192.191.138 listed in dnsbl.ahbl.org]

[35.192.191.138 listed in dnsbl.ahbl.org]

[35.192.191.138 listed in dnsbl.ahbl.org]

[35.192.191.138 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[35.192.191.138 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[35.192.191.138 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[35.192.191.138 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[35.192.191.138 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[35.192.191.138 listed in will-spam-for-food.eu.org]

[35.192.191.138 listed in will-spam-for-food.eu.org]

[35.192.191.138 listed in will-spam-for-food.eu.org]

[35.192.191.138 listed in will-spam-for-food.eu.org]

[35.192.191.138 listed in will-spam-for-food.eu.org]

[35.192.191.138 listed in will-spam-for-food.eu.org]

[35.192.191.138 listed in will-spam-for-food.eu.org]

[35.192.191.138 listed in will-spam-for-food.eu.org]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

0.0 TVD_RCVD_IP Message was received from an IP address

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[35.192.191.138 listed in bl.score.senderscore.com]

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 HTML_MESSAGE BODY: HTML included in message

0.4 RDNS_DYNAMIC Delivered to internal network by host with

dynamic-looking rDNS

0.0 SARE_FROM_SPAM_WORD4 From address suggests this may be spam

0.4 KHOP_HELO_FCRDNS Relay HELO differs from its IP's reverse DNS

0.8 TO_EQ_FM_DOM_HTML_ONLY To domain == From domain and HTML only

1.0 XPRIO Has X-Priority header

0.2 HELO_MISC_IP Looking for more Dynamic IP Relays

Subject: {SPAM?} =?utf-8?q?Completed=3A_Shared_via_ShareFile_=E2=80=93_Nagindas_Khandwala_College_shared_a_summary-Bonus=5FStatement=5F2026=2Epdf__Contact=2E?=



Hi,



Would you be interested in reaching school districts and universities with verified data?



Covers Principals, Admissions Directors, Deans, Superintendents, and Program Directors.



Contacts come with a 97% deliverability guarantee — all verified.



Every record provides email, phone number, and full institution information.



May I send a quick sample and pricing?



Best regards

Cleo Manning



To remove from this mailing, reply with the subject line "LEAVE US"

Web/SEO/App Spam from Microsoft Outlook Part 2

--_000_TY0PR0101MB419018F13FACB72756A752CECD0F2TY0PR0101MB4190_

Content-Type: text/plain; charset="Windows-1252"

Content-Transfer-Encoding: quoted-printable



Hi,



If your business is growing fast but managing the workload feels chaotic =

=97 we can help.



Our team supports you remotely with:



=95 Admin assistance & calendar management

=95 Calling & appointment setting

=95 Customer & client support

=95 Marketing, design & social media

=95 Bookkeeping & back-office coordination

=95 Web & app support



We work as an extension of your in-house staff, keeping things organized an=

d running smoothly.



Would you like to see how this model could improve your team=92s efficiency=

?



Thanks,

Ravika Sharma



--_000_TY0PR0101MB419018F13FACB72756A752CECD0F2TY0PR0101MB4190_

Content-Type: text/html; charset="Windows-1252"

Content-Transfer-Encoding: quoted-printable




osoft-com:office:office" xmlns:w=3D"urn:schemas-microsoft-com:office:word" =

xmlns:m=3D"http://schemas.microsoft.com/office/2004/12/omml" xmlns=3D"http:=

//www.w3.org/TR/REC-html40">




252">








break-word">



Hi,




t;,serif"> 



If your business is growing fast but managing the wo=

rkload feels chaotic =97 we can help.




t;,serif"> 



Our team supports you remotely with:






=95 Admin assistance & calendar management


=95 Calling & appointment setting


=95 Customer & client support


=95 Marketing, design & social media


=95 Bookkeeping & back-office coordination


=95 Web & app support




t;,serif"> 



We work as an extension of your in-house staff, keep=

ing things organized and running smoothly.






Would you like to see how this model could improve your team=92s efficiency=

?




t;,serif"> 



Thanks,


Ravika Sharma











--_000_TY0PR0101MB419018F13FACB72756A752CECD0F2TY0PR0101MB4190_--

Web/SEO/App Spam from Microsoft Outlook Part 1

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Fri, 22 May 2026 06:32:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wQP20-00000000Mvp-141y

for dave@doctor.nl2k.ab.ca;

Fri, 22 May 2026 06:31:12 -0600

Resent-From: The Doctor

Resent-Date: Fri, 22 May 2026 06:31:12 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-japaneastazolkn19013076.outbound.protection.outlook.com ([52.103.43.76]:42604 helo=TYDPR03CU002.outbound.protection.outlook.com)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wQOrB-00000000Lv3-3j3b

for root@nk.ca;

Fri, 22 May 2026 06:20:12 -0600

ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none;

b=dQP7zoINyVVN7lWeLs7Ex5BOqtCHv2jiLsw2l8g6oIfySHNrl5rVw2GX9P/gMMLrSEydH6zhwCH5loVUkaIC34XeXZ6N0+J19n6vxugn0k4XUtr8mQ8ystGezkc6AEa0QeNciUfdyHByCN8AK6cqmJECik8s+rF4JRtXtx99wnmSisDiCdCNRlo/yb/zXIjc7hSC0Lh9ug8EFa06Gpk6+Ap8qC9BBNVGKpn1qnqV4CcXrsAIumvuv+GTkqv3DpPiBxs1aYFeGegNDBdF3docrHbMuxCmDKm71sV0pHb2oWzloFHsgVD8dc8Ij9/1KovkCSyVomyqv0PLq+uC3igEew==

ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;

s=arcselector10001;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1;

bh=xRK1TiWgi8ghT8cKaa3jp4NWpH2n4EdoOtcEEwbG1c8=;

b=Lp2lD0vRILPlS1C/2VizcTPFC1TRWmwd8VcAsBxgpHgmXi+zR1O0MsoS0cHcyPjOQmv4bGcKtWWCQbyunzoJh7M3LJv9Zae5+gqQK37Ufx1o0RrUNiThGB5TeyiX5tjWRHu1UfVMnyb9oUzLkhI9T8UIojALEZeiPsNqZV2LJM6Rh2fnOwLOYQ0LhGkouzoGEQDmfvj/vnbqYFdTY2XyQcvtq8n0l4Qk57PMfoztnrN64ymT1JINDDVuzsp4UvD/IHmJsJkQWS/JK04xv/Cl8RXyjiSfnLTTxb8MnoXwyjrXOyki85yz8F1bUsOk+GlwulS4iNtcAooGhgjyLWr3xg==

ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=none; dmarc=none;

dkim=none; arc=none

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=hotmail.com;

s=selector1;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck;

bh=xRK1TiWgi8ghT8cKaa3jp4NWpH2n4EdoOtcEEwbG1c8=;

b=C0FBU4EQ0NE9PLbFe67Uhu0V9994BlC8pgvZ1q8Xmx4WWKeKu3fGcY0csuovmgaJC2/Aj393hJr33n6dPbx22rz88ngZ4GrQT5bdfjDZ+Dd7e7jqTHfxK/9ZGwnwLkJpb8fqJCQ0jwF9Q3AWoaOvUqvXbkhfwMVfWOvn3jRgicnZu9Jq+4m1y6xB4PnU0ssBcRZBAPK9egpF1n1YDHQ80p8b7tzOgXZUhMn5l93q+jSXlBesxAbx+C2XjW+pII8Qg/JKMCFQ2qahayDzhFY2OhAKjD2UIEmgaK8nFgIPcN0Di4D9Y/pLNQjw544BLLLXh1drk4KFIO2De9IcBMFjXA==

Received: from TY0PR0101MB4190.apcprd01.prod.exchangelabs.com

(2603:1096:400:1ba::7) by KUZPR01MB7946.apcprd01.prod.exchangelabs.com

(2603:1096:d10:64::21) with Microsoft SMTP Server (version=TLS1_2,

cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.48.17; Fri, 22 May

2026 12:18:15 +0000

Received: from TY0PR0101MB4190.apcprd01.prod.exchangelabs.com

([fe80::84f6:d86:b78d:fd11]) by

TY0PR0101MB4190.apcprd01.prod.exchangelabs.com ([fe80::84f6:d86:b78d:fd11%6])

with mapi id 15.21.0048.016; Fri, 22 May 2026 12:18:14 +0000

From: Ravika Sharma

To: Ravika Sharma

Subject:

=?Windows-1252?Q?Complete_remote_business_support_=97_from_calls_to_campa?=

=?Windows-1252?Q?igns?=

Thread-Topic:

=?Windows-1252?Q?Complete_remote_business_support_=97_from_calls_to_campa?=

=?Windows-1252?Q?igns?=

Thread-Index: AQHc6eUFNl3AM9HdZ0SicJPjJ2p1Pw==

Disposition-Notification-To: Ravika Sharma

Date: Fri, 22 May 2026 12:17:56 +0000

Message-ID:



References:















In-Reply-To:



Accept-Language: en-US

Content-Language: en-US

X-MS-Has-Attach:

X-MS-TNEF-Correlator:

x-ms-publictraffictype: Email

x-ms-traffictypediagnostic: TY0PR0101MB4190:EE_|KUZPR01MB7946:EE_

x-ms-office365-filtering-correlation-id: 6acd39b1-90d1-4ef9-2359-08deb7fc325c

x-ms-exchange-slblob-mailprops:

Z4JiEoKTUklVvMCeVd/FJBKLkgroD6Zz9wpgvpa4aKEHoqU588wjTiiWray6YLMzqb7nSSGk0ABe5KEbmYiUEfDLx1AyqVJyeWQi21QdDQw75vxUlwGJuRndj6bfJHeoakhpduKNkC7n/vLdSYIsNYkc62X6hJ0xynYHMnxBS7nODW1thPOYhC/jhhU9JO7AuiMz8DyMO2XPsCEREXI+jovudHJ41GMXAoRKOelZY1TR+L7ePgFUwLSNLYED75j7IuR00kRp8SVbKlpwygvQGE6328G0iKh2ydLvYwHTD5IJOQyGRkQpGXPco+zc/1NhqLCQMYAIInOSM5DhtJGMlkJ1yC3puRoVKZiSpQJW/kReSFPC3OOCHLJfGDhQ9hB/EUFfyPyETZzLFXg5G9tDUzDvHpZyffgjSIAJ82+lwksZabBY378NMAoy8v0ReXq8hUmls+ECA7KE2jfLvTxpzy0u80K6ZIGJ2VX04sVaVOIm4sReHrhcxOXmvb7QuxvMt/EHc2D5lAv0+Woq3GzQMoAXJ+gWv0aYvS0AlccLEi50pT1ioJOMT94jUDvUSy0WfzOA7/h6eQXqEJTXR7T0lNJDd+pexDmB41YCZ6w3Ex+ejaI9wjvsKhIeBBuf8Fge

x-microsoft-antispam:

BCL:0;ARA:14566002|8062599012|8060799015|19110799012|15080799012|13091999003|31061999003|24121999003|22091999003|55001999006|39105399006|24021099003|704163111799003|2604032081799003|2604032031799003|16051099003|37011999003|3412199025|18071099003|440099028|102099032|39145399003|41105399003|40105399003|1710799026;

x-microsoft-antispam-message-info:

=?Windows-1252?Q?0bfr2/kD4fDQoVFAMX02dxuEVgjxloAjgLgSeokLIP6y0ZB9N/96Ef4r?=

=?Windows-1252?Q?3Y3FgTnaLLuNxZEgO0qXAnj2EZpp7HThqEodrKoZc/jU03hYmLPOj8eL?=

=?Windows-1252?Q?Cqbn2y5I771Mu+IuWH1urEBQOZeWdcTaxWzqsZfPDvm3e08pu4d2KxLi?=

=?Windows-1252?Q?BNwKU8xTcsR0okUWISDN4YwnYjxdeBMsamDBBb0/uEfzcsbpfzq2VEIs?=

=?Windows-1252?Q?tFzZy7QNXmETt0+8UEiiJEB9p4Wo8cYVdQnadH8Qf2UNmnpysiNNPYiX?=

=?Windows-1252?Q?uOMzhlS8tvy0AkgTfrbJ4vtP6+lxpgGLBDeBOWBiCqQdsFt28PMEChgO?=

=?Windows-1252?Q?nVtHX9OmnxyGRkClI6IbdKn+BmRJ5Nu2cZiYZSWo3KOgSufOlDa0u4pI?=

=?Windows-1252?Q?CJoae0zLQwwaHurwzGCiKT/vQQN7HHyJyOzQa7cKJy/YjT+klop1AZSR?=

=?Windows-1252?Q?xxwxZvHcq432UG1BKmiri6+To42sS9wfjEssS0Y815NHakhsxpQUXinE?=

=?Windows-1252?Q?QimVxFocSECzX0w3MVS/AJ5sp/o8Yyum9N1b0AQR8IQhUfMik1sj3WzN?=

=?Windows-1252?Q?Zp/fIj3Kyiae/h/b9HcZx5Ho3BJEwmCToB69ZqdoxIMUtdT/+XEhVn5x?=

=?Windows-1252?Q?9XuGJ72VfWtwc87nqT8df3hjihqCW/ZA/cPBn6L6WMISIuFLAcV4W7kQ?=

=?Windows-1252?Q?Id9BmXJ6+tmTt3Z+XDKLrZo8QfsP9aBTgYZ0BtckLGKMGMDtFcciW4sy?=

=?Windows-1252?Q?AwsnWlwHYGkUWybv/pwpPxkOsXkzEoYDPLkmRnJIAWXb96NHH5acz7kH?=

=?Windows-1252?Q?iRBMMJ93uP7n3YhTh1wqWqTu7cYP3q3/9waWiL9zQvIqkdx/1a4Vpn8z?=

=?Windows-1252?Q?7mw7tteV2LoYLewVvO+auLCe6JhRSAZnsFPG+jUd91KAeiDifJSx4WKd?=

=?Windows-1252?Q?dK2kZKaOYCEhfKvvUhXwQzaaUlJumkOg3pNlUYKIPA8U15MuIsbfoni4?=

=?Windows-1252?Q?xnfYTTVT+/6ux1uoHHgRYbOAu9eYsBMJHIXtW2d/V90jOEqjUbCAZ0TM?=

=?Windows-1252?Q?F7oluCqnJ6Mr4amiRu95h0EDmnPzNnRZybzBJhEqBwrQtfQtI8b/Iuk7?=

=?Windows-1252?Q?MVS750PD6nNai2mI7ZDRyCcUVgfGEh+DH9UFH+0huLp9ex1+pFUDPjgd?=

=?Windows-1252?Q?z/WOgr3hQT2KJ+2ZkIJ5I55Rzxv9y47SQQo+jFRI+h1yBtXJro/mJDkG?=

=?Windows-1252?Q?BWl3ehwJipJJH4e8M62MVlCR3V6/3ujFC2H7LY+l+6z41rluktOm2EPd?=

=?Windows-1252?Q?fGcuJI/cAhyijt1fpOqpn9pCw7a4pT+7JJaAOVOvxZVcXVVCLpmcTRrc?=

=?Windows-1252?Q?mNplxCDf2zMF+iwWRT7o7OrwCkTfyXIoED4EqXOY0RUKSJX8nYKOFQJt?=

=?Windows-1252?Q?hDo6Z7dxMeN2fvmhNNlwZcH7DUMI1vMueSuySQBUeLqObgWHWOrQ9Kpe?=

=?Windows-1252?Q?30R/d9z9?=

x-ms-exchange-antispam-messagedata-chunkcount: 1

x-ms-exchange-antispam-messagedata-0:

=?Windows-1252?Q?RVjOg/50tkzf2KDzEo4aNR0sw/8tstZXp+rdINDc6CpkBZ85ejIqYF/o?=

=?Windows-1252?Q?jvyY+iK51NbZ5IJnV+upSePWG5HgN4dzCw4TGJYw2o/XWD/UHNFrh3Pw?=

=?Windows-1252?Q?wWoH+3DwcNVxGN0YDkhznyrk4H21NWR0lu30uL5JVfiHYqgISwYMhdq9?=

=?Windows-1252?Q?bdOWVUofftkr2FUTtlt0xdC66dDFPyz+U+R6hdjhCFcUtH5Cyy5yTho0?=

=?Windows-1252?Q?/0YpFvZd58dTeyfoGA80o4F1kByuYroeDjrP5gQUHw1oY/s7bwA9+/s+?=

=?Windows-1252?Q?EC52fEtGTRWPhSdkYAPn4+mcG3YVcwcs98jsfXstiTAHyYRCoGUb9MhW?=

=?Windows-1252?Q?DgwWoTBp5BNXZ65GJYezM1ibsa855SBuZ+biMVcvsHZKB9hOUQfbVbDP?=

=?Windows-1252?Q?jviqKiQgDGIghuacNzHlOz8IBOhc/dZBUghG5hMjxCkb1wHFiqlg7fYI?=

=?Windows-1252?Q?rPpBIdJ8jIQ+DcjgQQMQmOneiskQ7sNIw9yGjtVKBiEGA5Ik7EB8H3kV?=

=?Windows-1252?Q?DkdARincQcZ/Rx86XJ8+hIT+Yb8kqaXgOK3ZO5XLoE0z9xECxTYWaEmQ?=

=?Windows-1252?Q?Uf6lyQNmLK3NwUsoFeXTadH2izhJuaA5CW8jWcXIUw8mhi2GQYENw9Op?=

=?Windows-1252?Q?usZecjOptw0/u4sg+ttxMt9jRCuJON8HraXkNpr7Txe1AkfZJYZ4tH9o?=

=?Windows-1252?Q?F7/FpC1y4HtezIu/VaIA/O1Xz6MWypHipfG+PXj7K4Vk3jbKBDYMhc/t?=

=?Windows-1252?Q?OnW6FxCiEEV32DEL7VAHH2AShbS4U57citrctvC5M74TcvHXCKvVlj8y?=

=?Windows-1252?Q?I5KDRbWkhNhfakSSACw3wf6xBTfm2YAs9GtglrFHoIknLCWuD0wwd+pV?=

=?Windows-1252?Q?ToUQYxtkBgHKMR3Ful3ukLaIWSz8gT+eSGTnkRKdh+t3Auy2jfhUC4lZ?=

=?Windows-1252?Q?Ll/Cd3vtmpJVEPN8eGmOumxupdotHm4ymRaOO4aJYmEjTAaih4Hu5Qs3?=

=?Windows-1252?Q?BojxX3WN5UNGavOWjvECuxp69JNADlSDXueSDUzV6z/3q6gw2rdhltDy?=

=?Windows-1252?Q?sgvtDjNtTNUsnf+j24/muRShgDhkyVav8VKzeP2SRZjSqx4YkvVniMHd?=

=?Windows-1252?Q?dO5gYuHwAdQJtiPCcxi2lMs4gFb+cmOgVHlzHQldjN6as+3IL2pOuHOR?=

=?Windows-1252?Q?fzmdx2wm7lda8A5KEaKkvW7ApOMYPzqmpWYVRaf90FcC5L9Rh3Gn/l43?=

=?Windows-1252?Q?KKShZtyy+KhM2Eic8PmvgUpKXd6UHdB+MAzyojE2f6oL+caDLHg++zfS?=

=?Windows-1252?Q?oETDYSERjg/tKsdQ628DjPuV6GvV6Zh7w6VKlee/fsXWSKaBqt3NCCrN?=

=?Windows-1252?Q?RY4+kb5AayXRf9pGcEKcjW7gjGNeMJdrNBitGHQTJhq98cZ8PgvLAFAc?=

=?Windows-1252?Q?HWb1np1MWa8KshYFWMcwBpCreSb8zIljQXwYPe76HPXxIBR7yy9Angxv?=

=?Windows-1252?Q?NXF7TaZs?=

Content-Type: multipart/alternative;

boundary="_000_TY0PR0101MB419018F13FACB72756A752CECD0F2TY0PR0101MB4190_"

MIME-Version: 1.0

X-OriginatorOrg: sct-15-20-9412-4-msonline-outlook-3e488.templateTenant

X-MS-Exchange-CrossTenant-AuthAs: Internal

X-MS-Exchange-CrossTenant-AuthSource: TY0PR0101MB4190.apcprd01.prod.exchangelabs.com

X-MS-Exchange-CrossTenant-RMS-PersistedConsumerOrg: 00000000-0000-0000-0000-000000000000

X-MS-Exchange-CrossTenant-Network-Message-Id: 6acd39b1-90d1-4ef9-2359-08deb7fc325c

X-MS-Exchange-CrossTenant-originalarrivaltime: 22 May 2026 12:17:56.5366

(UTC)

X-MS-Exchange-CrossTenant-fromentityheader: Hosted

X-MS-Exchange-CrossTenant-id: 84df9e7f-e9f6-40af-b435-aaaaaaaaaaaa

X-MS-Exchange-CrossTenant-rms-persistedconsumerorg: 00000000-0000-0000-0000-000000000000

X-MS-Exchange-Transport-CrossTenantHeadersStamped: KUZPR01MB7946

Web/SEO/App spam from Microsoft Outlook Part 3




ontService,Calibri,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">

Thank you!



ontService,Calibri,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">







ontService,Calibri,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">












; color:rgb(0,0,0)">

From: kapial kumar <kapialkumsr.web@outlook.com>


Sent: Thursday, February 19, 2026 11:53 PM


Subject: Marketing Proposal and Pricing Details


 





ontService,Calibri,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">

Hi,



ontService,Calibri,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">







ontService,Calibri,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">

Do you want more leads and online visibility?



ontService,Calibri,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">







ontService,Calibri,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">

We=92re specialists in SEO, PPC, Content Marketing, and Social Media cam=

paigns.



ontService,Calibri,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">







ontService,Calibri,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">

If interested, I can share a proposal with pricing.



ontService,Calibri,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">







ontService,Calibri,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">

Best,



ontService,Calibri,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">

Kapial



ontService,Calibri,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">














--_000_SEZPR01MB7557DD9462EB9DFBF297F916EE0F2SEZPR01MB7557apcp_--

Web/SEO/App spam from Microsoft Outlook Part 1

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Fri, 22 May 2026 04:47:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wQNOJ-00000000C9n-3OUj

for dave@doctor.nl2k.ab.ca;

Fri, 22 May 2026 04:46:07 -0600

Resent-From: The Doctor

Resent-Date: Fri, 22 May 2026 04:46:07 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-japanwestazolkn19012056.outbound.protection.outlook.com ([52.103.66.56]:15962 helo=OS8PR02CU002.outbound.protection.outlook.com)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wQIZh-00000000Bd8-2ZpH

for root@nk.ca;

Thu, 21 May 2026 23:37:44 -0600

ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none;

b=Fq71Oz1MzpmWp/+UnKG6Nq++/qLlVp+B1fCpTyg4FzS1KkeK2Aim1QbUMJcLiDlwZc3dz/X1YeVref8rbNxxfWF4jx3sbtwz8kQ1lxqtwd5C8VUP03i9sjLxARre0hDRgzkB5QuDWQeXuiWiR9A5myYN3kk/HsdREWKcbMXNDeGVwcAsJq7EEZ4pRhdcjTIHZG/6neBElYGiUK4WNEo3QiPhDO20d6wv3wJAxlluaPzfyUoW2rqjndrMc1NQeXKtkBtYL+1GxrGs+zHvrQDmkYnHSPNkgZrXAmEwtfvKBBzCPRXDfleH0CjXmnVmBCnzemv89vEbACursDDVWz4g0g==

ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;

s=arcselector10001;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1;

bh=t0GcX6fUORxEAksv/r1T6T5jYVvy7QSAGc24gQr1V1Q=;

b=Va0mMz/PggoOoMaLADj4im9kaT2/bvBXWwwvOyrQMbpP0+NPoSFWrUSPcuQiW6buJOao3rR71ZxIhesxPbVzvs6X3A+1T52Xcj8bAQkxvaFVIk8Nc4NqZskerebfvCiojSOpnUclqqMlZ6CgxD0kd/zs8BviXy3UF+5B9dgjgE3Bbq/YlbI3cUyhdOrUiH/Jbt7+gNq0AHigXBJiBCFN1Hv1s8ibyKKFbX5x6vSywsJif0Bo992oHhrjufF20Y0F5AksB9UTtf6oCD2hCsgnd35r5qF+HCi8wiU9YANYnFtXLjQt73Rn8qeqImJB7XclljQS3DhTUBD0odYpYaKktQ==

ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=none; dmarc=none;

dkim=none; arc=none

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=outlook.com;

s=selector1;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck;

bh=t0GcX6fUORxEAksv/r1T6T5jYVvy7QSAGc24gQr1V1Q=;

b=qOMwsJT5ifdnT/1vWIu+ifH8guyofyuANHcFP+pbBSW9W/ZsFSgQV5vD8SqqzG8JCWbPAU6I5iFkqf7XUtKXWJrSPA/UDILOUOU8HtbccUCrYD68ZZ7Gi22nEK2DwHqGzKAQTcpbyvxr2e9AmZ2U7IPeB+yktqLQGUQhU2mI9JCHuqQ3m0HfwS9gdykkeoH2AGC+LSLqqvs/uNh0M4ivwniW3lm8TTmNYqlvVc7xmHsYVfqKFB+53G7D/QfB3iBxJwTSHbq5AuIM8IkhMwmoaGLpCEELP3mqLUf75rLqGAD5qHwRGySkh7GAp6u41C02frXeVNDYwXONgpSQeuFRdQ==

Received: from SEZPR01MB7557.apcprd01.prod.exchangelabs.com

(2603:1096:101:29f::11) by KUZPR01MB7945.apcprd01.prod.exchangelabs.com

(2603:1096:d10:61::22) with Microsoft SMTP Server (version=TLS1_2,

cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.48.17; Fri, 22 May

2026 05:34:45 +0000

Received: from SEZPR01MB7557.apcprd01.prod.exchangelabs.com

([fe80::5b1b:767e:d52e:a80b]) by SEZPR01MB7557.apcprd01.prod.exchangelabs.com

([fe80::5b1b:767e:d52e:a80b%3]) with mapi id 15.21.0025.012; Fri, 22 May 2026

05:34:45 +0000

From: kapial kumar

Subject: Re: Marketing Proposal and Pricing Details

Thread-Topic: Marketing Proposal and Pricing Details

Thread-Index:

AQHcwQ2rNGXAdIXlFEqaPjZDVwTb/7XImiROgAeY6E6AAAHJhIADWSKQgAACfh+ARkNPcA==

Date: Fri, 22 May 2026 05:34:22 +0000

Message-ID:



References:





























In-Reply-To:



Accept-Language: en-US

Content-Language: en-US

X-MS-Has-Attach:

X-MS-TNEF-Correlator:

msip_labels:

x-ms-publictraffictype: Email

x-ms-traffictypediagnostic: SEZPR01MB7557:EE_|KUZPR01MB7945:EE_

x-ms-office365-filtering-correlation-id: 1211e765-6151-4689-8abe-08deb7c3d434

x-microsoft-antispam:

BCL:0;ARA:14566002|16051099003|55001999006|24021099003|8062599012|2604032031799003|19110799012|704163111799003|20031999006|8060799015|31061999003|24121999003|39105399006|37011999003|22091999003|7071999006|24071999003|15030799006|15080799012|31055399003|40105399003|43065399003|440099028|3412199025|102099032;

x-microsoft-antispam-message-info:

=?Windows-1252?Q?0pQnrO7GKQnueuCqtYcHB2wFjIHTkDuyrg6rDT6DCCp/SHGK8XZoNwvb?=

=?Windows-1252?Q?ongYLZX3lre0rCca/H283Y6j1L5c+w9C47hHoU+LwU8VQSfTYR0c1B+B?=

=?Windows-1252?Q?CGilw0i8lCBQjW61gVD1QLGnnJPZNVz1mxUmIdhjTEgd3eriJ/NXX/4y?=

=?Windows-1252?Q?2ERfy1JveTNsFzUvtvVUY51fsiKscouNwVHKByt6Uf4MiGaFmMDNd53s?=

=?Windows-1252?Q?VSxPZMHYGdhXaklBOrn3QdPDSBtZI4JWd9umYi+EeVzrlQEbAqK/QtH1?=

=?Windows-1252?Q?8GOFE/6yYZ7yqsEeWXBNHCZYON5i03Ye9gPTgWcsKLHbgCkpOiv1zjAk?=

=?Windows-1252?Q?wmMrvADMppbEWyGAJgEiDM+dx/IgJ4Kny57MuWWGkUl76FLJQ3MRlbxB?=

=?Windows-1252?Q?Mo8/tH8jjTZllZP0MBWD4cmt4LS3nWTM4DAtFyYdue7d5zRKMKHiqrNS?=

=?Windows-1252?Q?/RQ/R6sYTMwm/0fPr0sO/i0ViuRWhmTUeaAuaY756Ufk2AxwRtSfTJeb?=

=?Windows-1252?Q?Hi3MkcpmDoTNmtQipaPqYrlieYSDxXw229oFXB2ypzOUhZ2ison5h1Hx?=

=?Windows-1252?Q?0fyKUb7OlAWqgx/85q7sDV1EbPu2ohT8uevnOXLjZkKvWuyAJkxWMogM?=

=?Windows-1252?Q?0RN7XUEwRW/AbYM2RTGiHjkQES6tJXWTj03ya+1jqJxGi/0eztrF2/hz?=

=?Windows-1252?Q?zoeUbsI+SNBU4HxxUblIJndkkPKuWvwHXGgxjm8uhYqela/WC+GDx0oD?=

=?Windows-1252?Q?ob19TKMMpShhjjSAVa/4vNO6JNM3jRpjTDeRLk1j6J9tfNZSZXqSDFne?=

=?Windows-1252?Q?vccccEFzRM6mlLdFQnHR/+Omp166/rowgDDsiKK96yDzjhrcc8snkuWo?=

=?Windows-1252?Q?oPcvCh5rTgWljeavUi9W3kySQ2Qfdh9Ilublh1FQSBbMGx6Q8ITC96cD?=

=?Windows-1252?Q?mEnGAB6KPiqIJ80LboyrzJJN1h+rMFfbBkbU+dGkJGro/TGrEO3YPFrp?=

=?Windows-1252?Q?SCGvjvzP0TWPR4EPDkIrxL4Z7h4RjTT/RIT5cIALzaWJiUyRLfZgS0CS?=

=?Windows-1252?Q?2Cy7Qd8TDTBS9rmtqOIG9DbXB2iXm2pbMnpGdJ0ex5NqxUqMK5oUyve1?=

=?Windows-1252?Q?GgI1AJERUgsghPlsdbPFDOU0r4F1sfF2QAI5t6uQA67ohJxXPrqWQ1M9?=

=?Windows-1252?Q?Wt9JqcnbAFIGtM7Aka5ULfPqeOKjTQEYOSpEHy/1BUGaESgwIXrdlK6Q?=

=?Windows-1252?Q?gJPHtotFn5nZd80xSSRRgsyMR68GKUttdmDeoy2EL0l57Elm2W3mLmPS?=

=?Windows-1252?Q?MgP4jIDJ7y5CD2uCwTr/H/Jsbgf2Z0rfACyn+4oKzTrL4meGVqPuzfzQ?=

=?Windows-1252?Q?Y+7LCu1mktvKDeM0UysTaBNiQRqzCDb09vzoWxhXHUpF1vbLZyTMsH0v?=

=?Windows-1252?Q?0jsa6Y7N+vE0zggsw/QXQuoZHysE99LqBz9hrbUM+2A=3D?=

x-ms-exchange-antispam-messagedata-chunkcount: 1

x-ms-exchange-antispam-messagedata-0:

=?Windows-1252?Q?uTKRL6XZCz1MrsZdYRJjstF/d2lyb1SqWRT7iz0OsA8P1ehfstwTXacu?=

=?Windows-1252?Q?gonZ/24OMXcyafU+YFjBsd+eS9F++kicbad9R94x+tmTgLHmCMYETdr8?=

=?Windows-1252?Q?JdWKkxMlbeR3WjgJAC9Buj+nzQdAWGtShSW61VinSl5ZV5Vsut/beG25?=

=?Windows-1252?Q?z3EOLO9E+W/eyItF49IbKIN9EQdWOYSJRL5owrhdu6qG08LsRuADj7Bj?=

=?Windows-1252?Q?VdcBSXvHlEq5xtpTgmqSrfhIPI93P60S9gjZbXlz3JnXjqM3tMkRmCbV?=

=?Windows-1252?Q?IA2mQ59COkpfNh2LBTdCf2Ys0gMtSnh/SJ35CsX1lCDpz2WJvYpKY+2T?=

=?Windows-1252?Q?3vOcBCbGgNO6v5EPRHxKj18VIeiFzQrig6q1OXnKSSdc9I3q4QVGfysB?=

=?Windows-1252?Q?ezcOOmh+q+M0RewyuTXiS4hkOKShEwIhg06pQknVHF5G80WZpdx84GYx?=

=?Windows-1252?Q?UUEDkGloPxgBEMOUd390GRkxXM4S3onJhaTyvk+lgnMztGDIzj7rQdpF?=

=?Windows-1252?Q?fgiPIy5gDoqmZNaV1ShYqvMvYsKgypurQb+a9RaEOv10z5IkdoZnKnvX?=

=?Windows-1252?Q?fInwaPLfz1Wp4ag3PY9E+rbiVqsdUGu8RaJ4mTsZ9l8bMHfI37PIPU4t?=

=?Windows-1252?Q?5VQjb+Z7mjXRxUyDDwgt4jtPxti6GhiiEpwY04qIPLRDmYe6HIBBlweG?=

=?Windows-1252?Q?c9h8D2EFtFNEGb3hqkX/71hjThKQRL4jiq+u1eXUFI9oVxtRn0RREv9w?=

=?Windows-1252?Q?Qfx1bvX1CCZqNfcuhrFsd5awZma51tM5PNbWSVgAhqgOunXeaENeAr8Z?=

=?Windows-1252?Q?ADIEdm70jAERScBrZr5kRE63qEdr1xxQYCJfE0cLdwgmGAfK4Cspn49d?=

=?Windows-1252?Q?oH8oALjiuHdgyyya7L+Vhc1LaByzrIQzQMfwmElxBqn3FvlA5TW3pubB?=

=?Windows-1252?Q?EKfIaFiwX5hRygV6c8sP0jfYVl2Kg21yDOc5ISYJg463gTz0J+FHWmQ4?=

=?Windows-1252?Q?ARnOHR3LWtD9HJ8VFswSCBALjsVQYumVZt4Pdnin6N95PJ3haRMS458d?=

=?Windows-1252?Q?rq16HPbGOMxagTJKoU8uf+m8q/oWzqRtXfzJEARqPak02BNOJxa8+TiK?=

=?Windows-1252?Q?KfHjZddbZb+8+6tq09s/ApFmnhij4Ca41YvZkEBJqB50SxKGlbtPRRVh?=

=?Windows-1252?Q?4oYbV/epSBcPCSv3QDhloAOjElwIK36S8qFi0w+VEQNXt4pZ/w03/4Vw?=

=?Windows-1252?Q?av3CA5f+8pJB+UCY3DR9GRGfkBp8H3SGzPyST0UG4Qc+qVc0vv0KONTS?=

=?Windows-1252?Q?paOqy0IC7UXt16g9T6CEd9UWtqLE3DrrM4MESpLjBUSZKkq52VLY/exb?=

=?Windows-1252?Q?nbB5O2LH2CaMVrwDusmCu/XSD2oFiSw5peaG0Qz1mAZVPR7XEt2cI7to?=

=?Windows-1252?Q?rU52GptEie8A0/AaKYjcLBmAVuwwXe6Jw/YvBsF9aXszCh4aUWZ0AwZt?=

=?Windows-1252?Q?kz4ATunuOZOOTij8jWZJlUHkfU5eN3M34ZW3XvyGq3BEjrqERY2JxdUq?=

=?Windows-1252?Q?xI5yEq/5xsyis0wr?=

Web/SEO/App spam from Microsoft Outlook Part 2

Content-Type: multipart/alternative;

boundary="_000_SEZPR01MB7557DD9462EB9DFBF297F916EE0F2SEZPR01MB7557apcp_"

MIME-Version: 1.0

X-OriginatorOrg: outlook.com

X-MS-Exchange-CrossTenant-AuthAs: Internal

X-MS-Exchange-CrossTenant-AuthSource: SEZPR01MB7557.apcprd01.prod.exchangelabs.com

X-MS-Exchange-CrossTenant-RMS-PersistedConsumerOrg: 00000000-0000-0000-0000-000000000000

X-MS-Exchange-CrossTenant-Network-Message-Id: 1211e765-6151-4689-8abe-08deb7c3d434

X-MS-Exchange-CrossTenant-originalarrivaltime: 22 May 2026 05:34:22.3831

(UTC)

X-MS-Exchange-CrossTenant-fromentityheader: Hosted

X-MS-Exchange-CrossTenant-id: 84df9e7f-e9f6-40af-b435-aaaaaaaaaaaa

X-MS-Exchange-CrossTenant-rms-persistedconsumerorg: 00000000-0000-0000-0000-000000000000

X-MS-Exchange-Transport-CrossTenantHeadersStamped: KUZPR01MB7945



--_000_SEZPR01MB7557DD9462EB9DFBF297F916EE0F2SEZPR01MB7557apcp_

Content-Type: text/plain; charset="Windows-1252"

Content-Transfer-Encoding: quoted-printable



Hi,



Following up on my previous email. Let me know if you'd like more details o=

n our SEO, PPC, and social media services.



Thanks!



________________________________

From: kapial kumar

Sent: Tuesday, April 7, 2026 5:53 PM

Subject: Re: Marketing Proposal and Pricing Details



Hi,



May I share our pricing, company details, and a few case studies for your r=

eference?



Please let me know.



Thank you!





________________________________

From: kapial kumar

Sent: Thursday, February 19, 2026 11:53 PM

Subject: Marketing Proposal and Pricing Details



Hi,



Do you want more leads and online visibility?



We=92re specialists in SEO, PPC, Content Marketing, and Social Media campai=

gns.



If interested, I can share a proposal with pricing.



Best,

Kapial





--_000_SEZPR01MB7557DD9462EB9DFBF297F916EE0F2SEZPR01MB7557apcp_

Content-Type: text/html; charset="Windows-1252"

Content-Transfer-Encoding: quoted-printable








252">








nt, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; c=

olor: rgb(0, 0, 0);">

Hi,



nt, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; c=

olor: rgb(0, 0, 0);">







nt, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; c=

olor: rgb(0, 0, 0);">

Following up on my previous email. Let me know if you'd like more details o=

n our

SEO, PPC, and social media services.



nt, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; c=

olor: rgb(0, 0, 0);">







nt, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; c=

olor: rgb(0, 0, 0);">

Thanks!



nt, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; c=

olor: rgb(0, 0, 0);">












yle=3D"font-size:11pt" color=3D"#000000">From: kapial kumar <kapi=

alkumsr.web@outlook.com>


Sent: Tuesday, April 7, 2026 5:53 PM


Subject: Re: Marketing Proposal and Pricing Details


 









nt,Aptos_MSFontService,Calibri,Helvetica,sans-serif; font-size:12pt; color:=

rgb(0,0,0)">

Hi,



ontService,Calibri,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">







ontService,Calibri,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">

May I share our pricing, company details, and a few case studie=

s for your reference?



ontService,Calibri,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">







ontService,Calibri,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">

Please let me know.



ontService,Calibri,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">




Document phish from Sendgrid

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 21 May 2026 21:33:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wQGce-000000002X0-2SNA

for dave@doctor.nl2k.ab.ca;

Thu, 21 May 2026 21:32:28 -0600

Resent-From: The Doctor

Resent-Date: Thu, 21 May 2026 21:32:28 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from s.wrqvtnrb.outbound-mail.sendgrid.net ([149.72.114.91]:60388)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wQEYn-00000000PLr-1sS6

for doctor@nl2k.ab.ca;

Thu, 21 May 2026 19:20:29 -0600

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=empverify.com;

h=subject:from:mime-version:content-type:date:to:cc:content-type:date:

from:subject:to;

s=s1; t=1779412720;

bh=iv4LvqVjGodypmUgYOths5WMgxCKkkmBTxarGGtbEiQ=;

b=kAvLQkWTpftw5lq8YAwtsQxUpEErxSNJmqkL83NC59AObFJz2qOYdSvTVbPxg1mFbA1j

K7u/AHMgJUMx3raJZyZa5hs1s+g4G7Mp7pCxM9QcvBaxUOXytJyhNl2YVhBvUIW2nQSgQo

z4PW3W4TzXfcprErBCJ26BZ/5MdJnbjBKfD+LHSUxjZ5yWeJ6qpg8dxzyNzacsgMp/bXmm

kQ9OB8nFRQqp8OlTrWS2daEMT/b78Ldn00D+J7AT1J4WfFfFoLnU9VKto8ZzKs7SifFctk

wMMQGL2GmJuJ8blvekZAavgVaaIo7DvCZW8vw9LDi5/Jsqy2+fGw4wq4VO7Nigrw==

Received: by recvd-6dc99dfcc-kmflc with SMTP id recvd-6dc99dfcc-kmflc-1-6A0FAEF0-57

2026-05-22 01:18:40.636401412 +0000 UTC m=+2000838.168727825

Received: from [185.161.208.213] (unknown)

by geopod-ismtpd-0 (SG)

with ESMTP id G0l_Rt7MQq-ti815lW-3Qg

for ;

Fri, 22 May 2026 01:18:40.563 +0000 (UTC)

Subject:

From: Doctor

MIME-Version: 1.0

Content-Type: multipart/related; boundary="===============67409873226141853702=="

Message-ID:

Date: Fri, 22 May 2026 01:18:40 +0000 (UTC)

X-SG-EID:

=?us-ascii?Q?u001=2EtEEv7EM7uSpW62rZ7UH0GP=2FJ=2Fh9mnSsjb2wcFT=2FPQAMNaIViiXhxGwGmf?=

=?us-ascii?Q?DvfEPFIf4gjizz20yJIibEdrhPm2A0mESfdi=2FO2?=

=?us-ascii?Q?JrVFX1PYn8hPIi9MH9IdN=2FoMz+5AGJIUsAlwZC2?=

=?us-ascii?Q?ot5jMTgHoPkTIT19kgsuKQZBJ69pj+62qok3qhP?=

=?us-ascii?Q?Rc3VMxXJ=2F50JjN6HHmCHiavml2WmcMKfPuDm+ZP?=

=?us-ascii?Q?8AHxQuKffnN4yb75keKkAQ=3D?=

To: doctor@nl2k.ab.ca

X-Entity-ID: u001.aET258zFD/ldDHwUwbLSRw==

X-Spam_score: 33.3

X-Spam_score_int: 333

X-Spam_bar: +++++++++++++++++++++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Doctor Internal Update



Content analysis details: (33.3 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[185.161.208.213 listed in dnsbl.ahbl.org]

[185.161.208.213 listed in dnsbl.ahbl.org]

[185.161.208.213 listed in dnsbl.ahbl.org]

[185.161.208.213 listed in dnsbl.ahbl.org]

[149.72.114.91 listed in dnsbl.ahbl.org]

[149.72.114.91 listed in dnsbl.ahbl.org]

[149.72.114.91 listed in dnsbl.ahbl.org]

[149.72.114.91 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[185.161.208.213 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[185.161.208.213 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[185.161.208.213 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[185.161.208.213 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[185.161.208.213 listed in will-spam-for-food.eu.org]

[185.161.208.213 listed in will-spam-for-food.eu.org]

[185.161.208.213 listed in will-spam-for-food.eu.org]

[185.161.208.213 listed in will-spam-for-food.eu.org]

[185.161.208.213 listed in will-spam-for-food.eu.org]

[185.161.208.213 listed in will-spam-for-food.eu.org]

[185.161.208.213 listed in will-spam-for-food.eu.org]

[185.161.208.213 listed in will-spam-for-food.eu.org]

[149.72.114.91 listed in will-spam-for-food.eu.org]

[149.72.114.91 listed in will-spam-for-food.eu.org]

[149.72.114.91 listed in will-spam-for-food.eu.org]

[149.72.114.91 listed in will-spam-for-food.eu.org]

[149.72.114.91 listed in will-spam-for-food.eu.org]

[149.72.114.91 listed in will-spam-for-food.eu.org]

[149.72.114.91 listed in will-spam-for-food.eu.org]

[149.72.114.91 listed in will-spam-for-food.eu.org]

1.1 URIBL_GREY Contains an URL listed in the URIBL greylist

[URI: sendgrid.net]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-0.0 SPF_PASS SPF: sender matches SPF record

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

15 GR_DOMAIN_SENDGR1 Received contains spammer id (sendgr)

-0.0 RCVD_IN_MSPIKE_H3 RBL: Good reputation (+3)

[149.72.114.91 listed in wl.mailspike.net]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[149.72.114.91 listed in bl.score.senderscore.com]

15 GR_DOMAIN_SENDGR6 URI: Body contains known spammer URI (sendgr)

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_IMAGE_ONLY_32 BODY: HTML: images with 2800-3200 bytes of words

0.8 SARE_FROM_SPAM_WORD3 I don't know people named this!

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

-0.0 RCVD_IN_MSPIKE_WL Mailspike good senders

Subject: {SPAM?}



Doctor Logo

Doctor

Internal Update

Document Ready for Review



Hi Doctor,



A new file has been added to your Doctor workspace and is now ready for review.



Please review the document before it expires on May 21, 2026.

Review Document →

Doctor

Automated Notice



Document phish from Sendgrid

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 21 May 2026 21:33:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wQGca-000000002Wl-1pve

for dave@doctor.nl2k.ab.ca;

Thu, 21 May 2026 21:32:24 -0600

Resent-From: The Doctor

Resent-Date: Thu, 21 May 2026 21:32:24 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from s.wfbtzhsq.outbound-mail.sendgrid.net ([159.183.224.100]:38836)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wQEYs-00000000PLq-2qQz

for doctor@doctor.nl2k.ab.ca;

Thu, 21 May 2026 19:20:34 -0600

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=empverify.com;

h=from:subject:mime-version:content-type:date:to:cc:content-type:date:

from:subject:to;

s=s1; t=1779412720;

bh=TDTNaJqSUnr4JCy7vVZdJIgZ25XLTNRsQmbVV5vO+JE=;

b=U2quqwC8rXYyP8tZ64/KuVWKxsusMP7wyi9a6cWI0CFO0QYYMTaBPKPP6F7xp8G5FWlQ

U7nzDd2k72H7sTdOrI/CCZmAHNqDolmXdiVUIHiKG/3J29VItFlJ9o0j/GPIBXS1QeRHJK

8oGM3u/8vMEKfogVS4D1Uaw+9i8NTjzzQYIZ0JSLwybUNumCDGpLpcX6vEiTWZrrOqrnsK

+f4u9THpJPiqSkKdDX1Je3i7aLWQZuHin+32bChYwXrLWp9r3wXryknvUPgMdLZFN0fQUy

CJU8GNIVKctaeYSkX1fpd3cy95lvkSSePanLamWbLAg6pderit1a6EmPqrVxUpCg==

Received: by recvd-5744f687b-9rlmj with SMTP id recvd-5744f687b-9rlmj-1-6A0FAEF0-44

2026-05-22 01:18:40.505790118 +0000 UTC m=+2000490.984851486

Received: from [185.161.208.213] (unknown)

by geopod-ismtpd-16 (SG)

with ESMTP id bxIIZDTASSywXUxHuMxk9w

for ;

Fri, 22 May 2026 01:18:40.391 +0000 (UTC)

From: Doctor

Subject:

MIME-Version: 1.0

Content-Type: multipart/related; boundary="===============45158735235125019587=="

Message-ID:

Date: Fri, 22 May 2026 01:18:40 +0000 (UTC)

X-SG-EID:

=?us-ascii?Q?u001=2EtEEv7EM7uSpW62rZ7UH0GP=2FJ=2Fh9mnSsjb2wcFT=2FPQAMNaIViiXhxGwGmf?=

=?us-ascii?Q?DvfEPFIHXHL5TkWSp+tS0enx7ezPjl5otVfQE9P?=

=?us-ascii?Q?+hOPHzWPwgzJWGB7a1x3DtbQ2J+8CQ1OhbJPWtn?=

=?us-ascii?Q?oncSnQwm3zCdItD0Yy1BM1y=2FvaE+Gib3MPcvmFX?=

=?us-ascii?Q?VuKE4UkzmCm2U1lnrKesY8aEkQLVhfa2xyc6b3P?=

=?us-ascii?Q?3IspgR+hZut1qs5AryQHh4=3D?=

To: doctor@doctor.nl2k.ab.ca

X-Entity-ID: u001.aET258zFD/ldDHwUwbLSRw==

X-Spam_score: 33.1

X-Spam_score_int: 331

X-Spam_bar: +++++++++++++++++++++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Doctor Internal Update



Content analysis details: (33.1 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[185.161.208.213 listed in dnsbl.ahbl.org]

[185.161.208.213 listed in dnsbl.ahbl.org]

[185.161.208.213 listed in dnsbl.ahbl.org]

[185.161.208.213 listed in dnsbl.ahbl.org]

[159.183.224.100 listed in dnsbl.ahbl.org]

[159.183.224.100 listed in dnsbl.ahbl.org]

[159.183.224.100 listed in dnsbl.ahbl.org]

[159.183.224.100 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[185.161.208.213 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[185.161.208.213 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[185.161.208.213 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[185.161.208.213 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[185.161.208.213 listed in will-spam-for-food.eu.org]

[185.161.208.213 listed in will-spam-for-food.eu.org]

[185.161.208.213 listed in will-spam-for-food.eu.org]

[185.161.208.213 listed in will-spam-for-food.eu.org]

[185.161.208.213 listed in will-spam-for-food.eu.org]

[185.161.208.213 listed in will-spam-for-food.eu.org]

[185.161.208.213 listed in will-spam-for-food.eu.org]

[185.161.208.213 listed in will-spam-for-food.eu.org]

[159.183.224.100 listed in will-spam-for-food.eu.org]

[159.183.224.100 listed in will-spam-for-food.eu.org]

[159.183.224.100 listed in will-spam-for-food.eu.org]

[159.183.224.100 listed in will-spam-for-food.eu.org]

[159.183.224.100 listed in will-spam-for-food.eu.org]

[159.183.224.100 listed in will-spam-for-food.eu.org]

[159.183.224.100 listed in will-spam-for-food.eu.org]

[159.183.224.100 listed in will-spam-for-food.eu.org]

1.1 URIBL_GREY Contains an URL listed in the URIBL greylist

[URI: sendgrid.net]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-0.0 SPF_PASS SPF: sender matches SPF record

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

15 GR_DOMAIN_SENDGR1 Received contains spammer id (sendgr)

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[159.183.224.100 listed in bl.score.senderscore.com]

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[159.183.224.100 listed in wl.mailspike.net]

15 GR_DOMAIN_SENDGR6 URI: Body contains known spammer URI (sendgr)

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_IMAGE_ONLY_32 BODY: HTML: images with 2800-3200 bytes of words

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

0.8 SARE_FROM_SPAM_WORD3 I don't know people named this!

Subject: {SPAM?}



From:

Doctor

Date:

5/21/26, 19:18

To:

doctor@doctor.nl2k.ab.ca



Doctor Logo

Doctor

Internal Update

Document Ready for Review



Hi Doctor,



A new file has been added to your Doctor workspace and is now ready for review.



Please review the document before it expires on May 21, 2026.

Review Document →

Doctor

Automated Notice

Nagindas Khandwala College phish From Google User

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Fri, 22 May 2026 11:49:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wQTz1-000000001NC-2hD4

for dave@doctor.nl2k.ab.ca;

Fri, 22 May 2026 11:48:27 -0600

Resent-From: The Doctor

Resent-Date: Fri, 22 May 2026 11:48:27 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from 138.191.192.35.bc.googleusercontent.com ([35.192.191.138]:59290 helo=[10.88.0.4])

by doctor.nl2k.ab.ca with esmtp (Exim 4.99.3 (FreeBSD))

id 1wQPQi-00000000P02-3vZE

for root@nk.ca;

Fri, 22 May 2026 06:56:52 -0600

Content-Type: multipart/related; boundary="===============1254440665516529268=="

MIME-Version: 1.0

From: "Nagindas Khandwala College ."

To: root@nk.ca

Subject: =?utf-8?q?Completed=3A_Shared_via_ShareFile_=E2=80=93_Nagindas_Khandwala_College_shared_a_summary-Bonus=5FStatement=5F2026=2Epdf__Contact=2E?=

X-Priority: 2

X-Spam_score: 6.8

X-Spam_score_int: 68

X-Spam_bar: ++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Reimbursement Summary Nagindas Khandwala College shared a

summary Shared from Nagindas Khandwala College Finance • 23 May, 2026



Content analysis details: (6.8 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.4 MISSING_DATE Missing Date: header

0.1 MISSING_MID Missing Message-Id: header

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[35.192.191.138 listed in dnsbl.ahbl.org]

[35.192.191.138 listed in dnsbl.ahbl.org]

[35.192.191.138 listed in dnsbl.ahbl.org]

[35.192.191.138 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[35.192.191.138 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[35.192.191.138 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[35.192.191.138 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[35.192.191.138 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[35.192.191.138 listed in will-spam-for-food.eu.org]

[35.192.191.138 listed in will-spam-for-food.eu.org]

[35.192.191.138 listed in will-spam-for-food.eu.org]

[35.192.191.138 listed in will-spam-for-food.eu.org]

[35.192.191.138 listed in will-spam-for-food.eu.org]

[35.192.191.138 listed in will-spam-for-food.eu.org]

[35.192.191.138 listed in will-spam-for-food.eu.org]

[35.192.191.138 listed in will-spam-for-food.eu.org]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

0.0 TVD_RCVD_IP Message was received from an IP address

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[35.192.191.138 listed in bl.score.senderscore.com]

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 HTML_MESSAGE BODY: HTML included in message

0.4 RDNS_DYNAMIC Delivered to internal network by host with

dynamic-looking rDNS

0.0 SARE_FROM_SPAM_WORD4 From address suggests this may be spam

0.4 KHOP_HELO_FCRDNS Relay HELO differs from its IP's reverse DNS

0.8 TO_EQ_FM_DOM_HTML_ONLY To domain == From domain and HTML only

1.0 XPRIO Has X-Priority header

0.2 HELO_MISC_IP Looking for more Dynamic IP Relays

Subject: {SPAM?} =?utf-8?q?Completed=3A_Shared_via_ShareFile_=E2=80=93_Nagindas_Khandwala_College_shared_a_summary-Bonus=5FStatement=5F2026=2Epdf__Contact=2E?=



--===============1254440665516529268==

Content-Type: text/html; charset="utf-8"

MIME-Version: 1.0

Content-Transfer-Encoding: base64



Nagindas Khandwala College shared a summary

Shared from Nagindas Khandwala College Finance • 23 May, 2026

Hi Root, your reimbursement summary for the current period is available.



Two items need additional documentation before processing.

XLSX

Reimbursement_Summary_Root_2026.xlsx

310 KB • Spreadsheet

2 sheets • Updated today

Open in Excel

Shared from Nagindas Khandwala College. If you were not expecting this email, you can safely ignore it.

Canada Revenue Agency Phish from Japan

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 21 May 2026 16:31:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wQBuJ-000000003YA-3Fh4

for dave@doctor.nl2k.ab.ca;

Thu, 21 May 2026 16:30:23 -0600

Resent-From: The Doctor

Resent-Date: Thu, 21 May 2026 16:30:23 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from smtp1.kagoya.net ([153.127.234.3]:43938)

by doctor.nl2k.ab.ca with esmtp (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wQA4G-00000000JeR-4A1h

for www@nl2k.ab.ca;

Thu, 21 May 2026 14:32:42 -0600

Received: from kagoya.net (act03.kagoya.net [133.18.75.69])

by smtp1.kagoya.net (Postfix) with ESMTPA id 56490608AB5D1;

Fri, 22 May 2026 05:26:55 +0900 (JST)

MIME-Version: 1.0

Message-ID: <20260521202655.0002E129.0152@kagoya.net>

Date: Fri, 22 May 2026 05:26:55 +0900

From: "Canada Revenue Agency (CRA)"

To:

Subject: Important Document

Content-Type: multipart/alternative;

boundary="-----ELU8WU74L82UYT.RFTZEWYE25FQ28T0_0_0002E129"

X-Priority: 3

X-MAILER: Active! mail



This is a multi-part message in MIME format.



-------ELU8WU74L82UYT.RFTZEWYE25FQ28T0_0_0002E129

Content-Type: text/plain; charset=US-ASCII

Content-Transfer-Encoding: 7bit





Changes On Your Canada Revenue Agency (CRA)

Canada Revenue Agency (CRA) sent you an important document to review and sign.

Review Document

If you have any questions or need assistance, feel free to contact us.

CRA

Canada Revenue Agency



Please do not reply to this email, as it is for notification purposes only.

This is an automated notification. Please do not reply to this message directly.



-------ELU8WU74L82UYT.RFTZEWYE25FQ28T0_0_0002E129

Content-Type: text/html; charset=US-ASCII

Content-Transfer-Encoding: 7bit









Changes On Your Canada Revenue Agency (CRA) 




Canada Revenue Agency (CRA) sent you an important document to review and sign.



If you have any questions or need assistance, feel free to contact us.

CRA
Canada Revenue Agency






 



Please do not reply to this email, as it is for notification purposes only.


This is an automated notification. Please do not reply to this message directly.















-------ELU8WU74L82UYT.RFTZEWYE25FQ28T0_0_0002E129--



Canada revenue phish from Japan

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 21 May 2026 16:31:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wQBuD-000000003XX-18PZ

for dave@doctor.nl2k.ab.ca;

Thu, 21 May 2026 16:30:17 -0600

Resent-From: The Doctor

Resent-Date: Thu, 21 May 2026 16:30:17 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from smtp3.kagoya.net ([]:44344)

by doctor.nl2k.ab.ca with esmtp (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wQA8E-00000000K2y-1nGQ

for doctor@nl2k.ca;

Thu, 21 May 2026 14:36:46 -0600

Received: from kagoya.net (act02.kagoya.net [133.18.75.68])

by smtp3.kagoya.net (Postfix) with ESMTPA id 03C69663319B7;

Fri, 22 May 2026 05:26:24 +0900 (JST)

MIME-Version: 1.0

Message-ID: <20260521202623.0000F8AB.0116@kagoya.net>

Date: Fri, 22 May 2026 05:26:23 +0900

From: "Canada Revenue Agency (CRA)"

To:

Subject: Important Document

Content-Type: multipart/alternative;

boundary="-----FVNGIR5OT.RN46RKMCSQKPF7A3.09SJ_0_0000F8AB"

X-Priority: 3

X-MAILER: Active! mail



This is a multi-part message in MIME format.



-------FVNGIR5OT.RN46RKMCSQKPF7A3.09SJ_0_0000F8AB

Content-Type: text/plain; charset=US-ASCII

Content-Transfer-Encoding: 7bit





Changes On Your Canada Revenue Agency (CRA)

Canada Revenue Agency (CRA) sent you an important document to review and sign.

Review Document

If you have any questions or need assistance, feel free to contact us.

CRA

Canada Revenue Agency



Please do not reply to this email, as it is for notification purposes only.

This is an automated notification. Please do not reply to this message directly.



-------FVNGIR5OT.RN46RKMCSQKPF7A3.09SJ_0_0000F8AB

Content-Type: text/html; charset=US-ASCII

Content-Transfer-Encoding: 7bit









Changes On Your Canada Revenue Agency (CRA) 




Canada Revenue Agency (CRA) sent you an important document to review and sign.



If you have any questions or need assistance, feel free to contact us.

CRA
Canada Revenue Agency






 



Please do not reply to this email, as it is for notification purposes only.


This is an automated notification. Please do not reply to this message directly.















-------FVNGIR5OT.RN46RKMCSQKPF7A3.09SJ_0_0000F8AB--