German language cloud credential phish from Google Gmail Part 1

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 12 Mar 2026 15:37:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1w0ni2-00000000NMn-3CPZ

for dave@doctor.nl2k.ab.ca;

Thu, 12 Mar 2026 15:36:46 -0600

Resent-From: The Doctor

Resent-Date: Thu, 12 Mar 2026 15:36:46 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-oa1-f71.google.com ([209.85.160.71]:58373)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1w0ko4-000000004j8-3q5U

for doctor@nl2k.ca;

Thu, 12 Mar 2026 12:30:57 -0600

Received: by mail-oa1-f71.google.com with SMTP id 586e51a60fabf-417765eb13cso11231883fac.0

for ; Thu, 12 Mar 2026 11:30:02 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=cloudstorage11.jmpghana.com; s=firebase1; t=1773340195; x=1773944995; darn=nl2k.ca;

h=to:from:subject:date:message-id:mime-version:from:to:cc:subject

:date:message-id:reply-to;

bh=5Cbnb6KEfVHABR02leCZX9Vw/AAW9//eWEIncSBJPbw=;

b=l0Yz41KMMw+DbUhH8a9teFVjbPpWdo+BVw2oCiDThSAC4Tbv3TVxtZ/oEqe4iM3y6U

qkZ7wSTt1XC4+/2fG4HwNep7+FlKf8fN5ecSvzyer5pqxRQZ0KLJgmCTcn59501M+Be+

E5AlSJZ0VdimJUkPVO4Ve/xmYhM5E1A1tpmTlPyxIcTc6K8u+OG+hGkh5oE6sPsYYhUG

XaYpsSety7ViuJoqmEwS65BMNsWfj0lOr1NrDoV5NVJZcgWRGpuk4nxJw0qCWUFWE5gQ

iqZoJvzCwMBzBB6Ag6B4N//JUy0fHnaOnPUGnUHDCJqrmWp1mwQvMsmFO8OyR26xlDbS

3Pig==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20230601; t=1773340195; x=1773944995;

h=to:from:subject:date:message-id:mime-version:x-gm-message-state

:from:to:cc:subject:date:message-id:reply-to;

bh=5Cbnb6KEfVHABR02leCZX9Vw/AAW9//eWEIncSBJPbw=;

b=JduJybmYLjcYR7ixmWuFlJvTnasoZdESyvNu9I9ted2XTI/nrB17pIABrOmFq7gWKR

aA22TplD60p8qAdV6qUZFN/sJ8IEDnJHUPTsLk1r1WwnLm5Apykx10S1gqon1pNfOCGV

6lITwfCRAIgQj3j57sNd5eXuOT//b6/+wkgccG8HoqwxDDPN/ZL4gE8sAdiAIzcIu3js

6dzCKSNrCJvOZODVzXDNCLo4FFopyfOFV/0IOh5tDB5U513xO4BjhaI57V3PwY1i9mvG

8ESrfyN2dCukD/7PpVpSRojghWNLEPKi91oP4u5WHG7m+YJpb3nHtRKnbVy7+RokOcA7

NVqQ==

X-Gm-Message-State: AOJu0YyAK90aNSQnaBopS7MpX8GG0+HMjXwru60U3BF3lJR6ku1C5Wf7

pioTqv8STuWqh3pCvS2xXuwy17NJ0GFUbgE3LXAhNHVxqp91mMpd3RR9gNCr6p+24a2+r/3yA1t

nhh0LNguZ7PzUzA==

MIME-Version: 1.0

X-Received: by 2002:a05:6820:169e:b0:67b:baca:a49b with SMTP id

006d021491bc7-67bdaa9000bmr261050eaf.67.1773340195580; Thu, 12 Mar 2026

11:29:55 -0700 (PDT)

Message-ID: <0000000000006c6e72064cd7f037@google.com>

Date: Thu, 12 Mar 2026 18:29:55 +0000

Subject: =?UTF-8?Q?=F0=9F=9A=AB_Ihr_Konto_wird_am_13=2E_M=C3=A4rz_2026_deaktiviert_?=

=?UTF-8?Q?=E2=80=93_Fotos_=26_Videos?=

From: =?UTF-8?Q?iCIoud=2DSupport=C2=AE?=

To: doctor@nl2k.ca

Content-Type: multipart/alternative; boundary="0000000000006c6e64064cd7f034"



--0000000000006c6e64064cd7f034

Content-Type: text/plain; charset="UTF-8"; format=flowed; delsp=yes

Content-Transfer-Encoding: base64



WW91ciBhY2NvdW50IGhhcyBiZWVuIGRlYWN0aXZhdGVkIOKAkyB2ZXJpZmljYXRpb24gcmVxdWly

ZWQuDQoNCg0KDQoNCmlDSW91ZA0KDQoNCg0KUGF5bWVudCBmYWlsZWQg4oCTIFBsZWFzZSB1cGRh

dGUgeW91ciBwYXltZW50IG1ldGhvZC4NCg0KDQoNCmlDSW91ZCBTdG9yYWdlDQoNCllvdXIgYWNj

b3VudCBoYXMgYmVlbiBkZWFjdGl2YXRlZA0KDQpQYXltZW50IG1ldGhvZCB1cGRhdGUgcmVxdWly

ZWQg4pqg77iPIFlvdXIgcGhvdG9zIGFuZCB2aWRlb3Mgd2lsbCBiZSBkZWxldGVkLg0KDQoNCg0K

U3Vic2NyaXB0aW9uIGRldGFpbHMNCg0KDQoNClRhcmlmIFN0b3JhZ2UNCg0KRW1haWwgYWRkcmVz

cyBkb2N0b3JAbmwyay5jYQ0KDQpQcm9kdWN0IGlDbG91ZCBTdG9yYWdlDQoNClJlbmV3YWwgZGF0

ZSAxMy4wMy4yMDI2DQoNCg0KDQoNCg0KQWN0aW9uIHJlcXVpcmVkDQoNClZlcmlmaWNhdGlvbiBy

ZXF1aXJlZCBQbGVhc2UgdXBkYXRlIHlvdXIgcGF5bWVudCBtZXRob2QNCg0KDQoNClVwZGF0ZSBw

YXltZW50IG1ldGhvZA0KDQoNCg0KDQpUaGlzIG5vdGlmaWNhdGlvbiB3YXMgZ2VuZXJhdGVkIGF1

dG9tYXRpY2FsbHkgYW5kIGNvbmNlcm5zIHlvdXIgaUNsb3VkICANCnN0b3JhZ2UgcGxhbi4NCg0K

DQoNCkFwcGxlIFNlcnZpY2VzIMK3IGlDSW91ZCDCtyBTdXBwb3J0DQoNCg0KDQpVbnN1YmhlcmUg

dG8gcmVtb3ZlIHlvdXJzZWxmIGZyb20gb3VyIGVtYWlscyBsaXN0DQo=

--0000000000006c6e64064cd7f034

Content-Type: text/html; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable












">



Kontomitteilung




J&e=3Ddoctor@nl2k.ca" style=3D"text-decoration:none; color:black;">



=20




ransparent;">

Your account has been deactivated =E2=80=93 verification required.





=3D"0" border=3D"0" style=3D"width:100%;background-color:#f5f5f7;">














pacing=3D"0" border=3D"0" style=3D"max-width:680px;">
































pple-system,BlinkMacSystemFont,'SF Pro Display','Segoe UI',Arial,sans-serif=

;font-size:28px;line-height:32px;font-weight:600;color:#1d1d1f;letter-spaci=

ng:-0.3px;">

iCIoud


border-radius:22px;overflow:hidden;box-shadow:0 4px 14px rgba(0,0,0,0.04);"=

>






cellspacing=3D"0" border=3D"0">








olid #f1d1d1;padding:14px 24px;text-align:center;font-family:-apple-system,=

BlinkMacSystemFont,'SF Pro Text','Segoe UI',Arial,sans-serif;font-size:14px=

;line-height:20px;font-weight:600;color:#c9342f;">

Payment failed =E2=80=93 Please update your payment method. =








cellspacing=3D"0" border=3D"0">


















































































e-system,BlinkMacSystemFont,'SF Pro Text','Segoe UI',Arial,sans-serif;font-=

size:13px;line-height:18px;color:#6e6e73;font-weight:600;">

iCIoud Storage


system,BlinkMacSystemFont,'SF Pro Display','Segoe UI',Arial,sans-serif;font=

-size:32px;line-height:38px;font-weight:600;color:#1d1d1f;letter-spacing:-0=

.5px;">

Your account has been deactivated

system,BlinkMacSystemFont,'SF Pro Text','Segoe UI',Arial,sans-serif;font-si=

ze:16px;line-height:26px;color:#424245;">

Payment method update required =E2=9A=A0=EF=B8=8F Your photos and videos wi=

ll be deleted.




=3D"0" cellspacing=3D"0" border=3D"0" style=3D"background-color:#f5f5f7;bor=

der:1px solid #ebebed;border-radius:16px;">














y:-apple-system,BlinkMacSystemFont,'SF Pro Display','Segoe UI',Arial,sans-s=

erif;font-size:18px;line-height:24px;font-weight:600;color:#1d1d1f;">

Subscription details



adding=3D"0" cellspacing=3D"0" border=3D"0" style=3D"font-family:-apple-sys=

tem,BlinkMacSystemFont,'SF Pro Text','Segoe UI',Arial,sans-serif;font-size:=

15px;color:#1d1d1f;">


































solid #e5e5e7;color:#6e6e73;width:42%;">Tarif

solid #e5e5e7;font-weight:500;">Storage

solid #e5e5e7;color:#6e6e73;">Email address

solid #e5e5e7;font-weight:500;">doctor@nl2k.ca

solid #e5e5e7;color:#6e6e73;">Product

;">iCloud Storage
R=

enewal date

>13.03.2026





system,BlinkMacSystemFont,'SF Pro Display','Segoe UI',Arial,sans-serif;font=

-size:21px;line-height:28px;font-weight:600;color:#1d1d1f;">

Action required

system,BlinkMacSystemFont,'SF Pro Text','Segoe UI',Arial,sans-serif;font-si=

ze:15px;line-height:25px;color:#424245;">

Verification required

Please update your payment method




ing=3D"0" border=3D"0">








:980px;">


HHjEb8FnWE9d9Asehh8yaMgb6CJ&e=3Ddoctor@nl2k.ca"

style=3D"display:inline-block;padding:14px 30p=

x;font-family:-apple-system,BlinkMacSystemFont,'SF Pro Text','Segoe UI',Ari=

al,sans-serif;font-size:15px;line-height:20px;font-weight:600;color:#ffffff=

;text-decoration:none;border-radius:980px;">

Update payment method







background-color:#ececee;"> 



r;font-family:-apple-system,BlinkMacSystemFont,'SF Pro Text','Segoe UI',Ari=

al,sans-serif;font-size:13px;line-height:21px;color:#6e6e73;">

This notification was generated automatically and concerns your iCloud stor=

age plan.



ily:-apple-system,BlinkMacSystemFont,'SF Pro Text','Segoe UI',Arial,sans-se=

rif;font-size:12px;line-height:18px;color:#8e8e93;">

Apple Services =C2=B7 iCIoud =C2=B7 Support










text-align:center;margin-top:10px">Unsub

=3D8HFMMWySSP29QHHjEb8FnWE9d9Asehh8yaMgb6CJ&e=3Ddoctor@nl2k.ca">here
to=

remove yourself from our emails list

--0000000000006c6e64064cd7f034--

German language cloud credential phish from Google Gmail Part 2




system,BlinkMacSystemFont,'SF Pro Display','Segoe UI',Arial,sans-serif;font=

-size:32px;line-height:38px;font-weight:600;color:#1d1d1f;letter-spacing:-0=

.5px;">

Your account has been deactivated








system,BlinkMacSystemFont,'SF Pro Text','Segoe UI',Arial,sans-serif;font-si=

ze:16px;line-height:26px;color:#424245;">

Payment method update required =E2=9A=A0=EF=B8=8F Your photos and videos wi=

ll be deleted.














=3D"0" cellspacing=3D"0" border=3D"0" style=3D"background-color:#f5f5f7;bor=

der:1px solid #ebebed;border-radius:16px;">














y:-apple-system,BlinkMacSystemFont,'SF Pro Display','Segoe UI',Arial,sans-s=

erif;font-size:18px;line-height:24px;font-weight:600;color:#1d1d1f;">

Subscription details



adding=3D"0" cellspacing=3D"0" border=3D"0" style=3D"font-family:-apple-sys=

tem,BlinkMacSystemFont,'SF Pro Text','Segoe UI',Arial,sans-serif;font-size:=

15px;color:#1d1d1f;">


































solid #e5e5e7;color:#6e6e73;width:42%;">Tarif

solid #e5e5e7;font-weight:500;">Storage

solid #e5e5e7;color:#6e6e73;">Email address

solid #e5e5e7;font-weight:500;">www@nl2k.ab.ca

solid #e5e5e7;color:#6e6e73;">Product

;">iCloud Storage
R=

enewal date

>13.03.2026















system,BlinkMacSystemFont,'SF Pro Display','Segoe UI',Arial,sans-serif;font=

-size:21px;line-height:28px;font-weight:600;color:#1d1d1f;">

Action required










system,BlinkMacSystemFont,'SF Pro Text','Segoe UI',Arial,sans-serif;font-si=

ze:15px;line-height:25px;color:#424245;">

Verification required

Please update your payment method














ing=3D"0" border=3D"0">








:980px;">


8YBk3fd21TcChGpTjexQ9vsHkqL&e=3Dwww@nl2k.ab.ca"

style=3D"display:inline-block;padding:14px 30p=

x;font-family:-apple-system,BlinkMacSystemFont,'SF Pro Text','Segoe UI',Ari=

al,sans-serif;font-size:15px;line-height:20px;font-weight:600;color:#ffffff=

;text-decoration:none;border-radius:980px;">

Update payment method

















background-color:#ececee;"> 













r;font-family:-apple-system,BlinkMacSystemFont,'SF Pro Text','Segoe UI',Ari=

al,sans-serif;font-size:13px;line-height:21px;color:#6e6e73;">

This notification was generated automatically and concerns your iCloud stor=

age plan.


















ily:-apple-system,BlinkMacSystemFont,'SF Pro Text','Segoe UI',Arial,sans-se=

rif;font-size:12px;line-height:18px;color:#8e8e93;">

Apple Services =C2=B7 iCIoud =C2=B7 Support


















text-align:center;margin-top:10px">Unsub
=3D9Xn4aiFCsmqaF8YBk3fd21TcChGpTjexQ9vsHkqL&e=3Dwww@nl2k.ab.ca">here
to=

remove yourself from our emails list


--000000000000e65729064cd7bdae--

German language cloud credential phish from Google Gmail Part 2




system,BlinkMacSystemFont,'SF Pro Display','Segoe UI',Arial,sans-serif;font=

-size:32px;line-height:38px;font-weight:600;color:#1d1d1f;letter-spacing:-0=

.5px;">

Your account has been deactivated








system,BlinkMacSystemFont,'SF Pro Text','Segoe UI',Arial,sans-serif;font-si=

ze:16px;line-height:26px;color:#424245;">

Payment method update required =E2=9A=A0=EF=B8=8F Your photos and videos wi=

ll be deleted.














=3D"0" cellspacing=3D"0" border=3D"0" style=3D"background-color:#f5f5f7;bor=

der:1px solid #ebebed;border-radius:16px;">














y:-apple-system,BlinkMacSystemFont,'SF Pro Display','Segoe UI',Arial,sans-s=

erif;font-size:18px;line-height:24px;font-weight:600;color:#1d1d1f;">

Subscription details



adding=3D"0" cellspacing=3D"0" border=3D"0" style=3D"font-family:-apple-sys=

tem,BlinkMacSystemFont,'SF Pro Text','Segoe UI',Arial,sans-serif;font-size:=

15px;color:#1d1d1f;">


































solid #e5e5e7;color:#6e6e73;width:42%;">Tarif

solid #e5e5e7;font-weight:500;">Storage

solid #e5e5e7;color:#6e6e73;">Email address

solid #e5e5e7;font-weight:500;">www@nl2k.ab.ca

solid #e5e5e7;color:#6e6e73;">Product

;">iCloud Storage
R=

enewal date

>13.03.2026















system,BlinkMacSystemFont,'SF Pro Display','Segoe UI',Arial,sans-serif;font=

-size:21px;line-height:28px;font-weight:600;color:#1d1d1f;">

Action required










system,BlinkMacSystemFont,'SF Pro Text','Segoe UI',Arial,sans-serif;font-si=

ze:15px;line-height:25px;color:#424245;">

Verification required

Please update your payment method














ing=3D"0" border=3D"0">








:980px;">


8YBk3fd21TcChGpTjexQ9vsHkqL&e=3Dwww@nl2k.ab.ca"

style=3D"display:inline-block;padding:14px 30p=

x;font-family:-apple-system,BlinkMacSystemFont,'SF Pro Text','Segoe UI',Ari=

al,sans-serif;font-size:15px;line-height:20px;font-weight:600;color:#ffffff=

;text-decoration:none;border-radius:980px;">

Update payment method

















background-color:#ececee;"> 













r;font-family:-apple-system,BlinkMacSystemFont,'SF Pro Text','Segoe UI',Ari=

al,sans-serif;font-size:13px;line-height:21px;color:#6e6e73;">

This notification was generated automatically and concerns your iCloud stor=

age plan.


















ily:-apple-system,BlinkMacSystemFont,'SF Pro Text','Segoe UI',Arial,sans-se=

rif;font-size:12px;line-height:18px;color:#8e8e93;">

Apple Services =C2=B7 iCIoud =C2=B7 Support


















text-align:center;margin-top:10px">Unsub
=3D9Xn4aiFCsmqaF8YBk3fd21TcChGpTjexQ9vsHkqL&e=3Dwww@nl2k.ab.ca">here
to=

remove yourself from our emails list


--000000000000e65729064cd7bdae--

German language cloud credential phish from Google Gmail Part 1

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 12 Mar 2026 15:37:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1w0nhs-00000000NJA-1mf9

for dave@doctor.nl2k.ab.ca;

Thu, 12 Mar 2026 15:36:36 -0600

Resent-From: The Doctor

Resent-Date: Thu, 12 Mar 2026 15:36:36 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-oi1-f198.google.com ([209.85.167.198]:46441)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1w0kaQ-0000000046c-2zbw

for www@nl2k.ab.ca;

Thu, 12 Mar 2026 12:16:51 -0600

Received: by mail-oi1-f198.google.com with SMTP id 5614622812f47-466fb87b5c6so206556b6e.1

for ; Thu, 12 Mar 2026 11:15:54 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=cloudstorage10.jmpghana.com; s=firebase1; t=1773339348; x=1773944148; darn=nl2k.ab.ca;

h=to:from:subject:date:message-id:mime-version:from:to:cc:subject

:date:message-id:reply-to;

bh=lIM3eBzfC8bvzYMAm6gUNcBX3NlTZo1Ai+enwnyfr/M=;

b=Kcgo9fKP+c0D+yWnsxOSexGlKWsxx6ruuEkt/36hMGRKa7b4/P9VLjx88YElMY+WoE

5+epCCuo0VKNvRqw7gQCbihEM04J7fMd9yh2MvBo6YhRjTVDnbBZXWqOxdpPU/Sd/ekE

Fs2u2sCRK4Fp/cWcFmjDv8Fh3gk+KeIvILL2axsXNgRVAH8789ZNaXiYOyt7JLba7bRX

U/H8Z1kRG7+NzK9PqP9AlEfFTX6y6rPiD/XEwfZACckTz8buKQAFnESfw1389RoRmuUo

OVvbXgR9qKb+k82vZpzSLXLRoJ4oKDWgJ8IL4rtx4/wuFdFikaAI3RoagH4wMxbGJ18d

igVg==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20230601; t=1773339348; x=1773944148;

h=to:from:subject:date:message-id:mime-version:x-gm-message-state

:from:to:cc:subject:date:message-id:reply-to;

bh=lIM3eBzfC8bvzYMAm6gUNcBX3NlTZo1Ai+enwnyfr/M=;

b=uCO0gRRZx07uUsE+Zt9l1boVEjJCTzmc+zTFzGqi1vQcHuzPrivIrzralfl7FO4Mbz

tOmCnTFcE1I2WoqkeO4M64KvRi4BYoemnADjDAEIwGwjakEGjsz2J/RT+PX/1+2GAHub

zzg3pMwwN/zs+xPrsMchKxTOMihIdrSBFmXIp4hQzA1dq7oMah/HkToYaib7x/fOadB/

xRAXXg/WmHrci6/GRdffk4ARUrH8S69fXiCFuuV285nSaGwitzl+8iJ1pSkrKr5AtzyF

ALj41n9U73xB9IymjPXPUUX6xiLAVTaUQIWj70qTLx91Li5qmrjtxnAEsv4cI5lMAoeh

vR/Q==

X-Gm-Message-State: AOJu0YxkymmHTmP6dmkTsA9RNBcABkCjGHgDiCxPYVOywbd/84awBGgd

NOV5SbJqoBna3Wj/NU/eBGvdPE+u7v3lJ8jo/RoLHxCdIOhWEKK5pbhMpIENBspG+JEJJlmlSUP

PAZqYFLD71HmgHw==

MIME-Version: 1.0

X-Received: by 2002:a05:6808:1409:b0:467:ee:7a2f with SMTP id

5614622812f47-46757186adbmr193305b6e.28.1773339347932; Thu, 12 Mar 2026

11:15:47 -0700 (PDT)

Message-ID: <000000000000e65738064cd7bdb1@google.com>

Date: Thu, 12 Mar 2026 18:15:47 +0000

Subject: =?UTF-8?Q?=F0=9F=9A=AB_Ihr_Konto_wird_am_13=2E_M=C3=A4rz_2026_deaktiviert_?=

=?UTF-8?Q?=E2=80=93_Fotos_=26_Videos?=

From: =?UTF-8?Q?iCIoud=2DSupport=C2=AE?=

To: www@nl2k.ab.ca

Content-Type: multipart/alternative; boundary="000000000000e65729064cd7bdae"



--000000000000e65729064cd7bdae

Content-Type: text/plain; charset="UTF-8"; format=flowed; delsp=yes

Content-Transfer-Encoding: base64



WW91ciBhY2NvdW50IGhhcyBiZWVuIGRlYWN0aXZhdGVkIOKAkyB2ZXJpZmljYXRpb24gcmVxdWly

ZWQuDQoNCg0KDQoNCmlDSW91ZA0KDQoNCg0KUGF5bWVudCBmYWlsZWQg4oCTIFBsZWFzZSB1cGRh

dGUgeW91ciBwYXltZW50IG1ldGhvZC4NCg0KDQoNCmlDSW91ZCBTdG9yYWdlDQoNCllvdXIgYWNj

b3VudCBoYXMgYmVlbiBkZWFjdGl2YXRlZA0KDQpQYXltZW50IG1ldGhvZCB1cGRhdGUgcmVxdWly

ZWQg4pqg77iPIFlvdXIgcGhvdG9zIGFuZCB2aWRlb3Mgd2lsbCBiZSBkZWxldGVkLg0KDQoNCg0K

U3Vic2NyaXB0aW9uIGRldGFpbHMNCg0KDQoNClRhcmlmIFN0b3JhZ2UNCg0KRW1haWwgYWRkcmVz

cyB3d3dAbmwyay5hYi5jYQ0KDQpQcm9kdWN0IGlDbG91ZCBTdG9yYWdlDQoNClJlbmV3YWwgZGF0

ZSAxMy4wMy4yMDI2DQoNCg0KDQoNCg0KQWN0aW9uIHJlcXVpcmVkDQoNClZlcmlmaWNhdGlvbiBy

ZXF1aXJlZCBQbGVhc2UgdXBkYXRlIHlvdXIgcGF5bWVudCBtZXRob2QNCg0KDQoNClVwZGF0ZSBw

YXltZW50IG1ldGhvZA0KDQoNCg0KDQpUaGlzIG5vdGlmaWNhdGlvbiB3YXMgZ2VuZXJhdGVkIGF1

dG9tYXRpY2FsbHkgYW5kIGNvbmNlcm5zIHlvdXIgaUNsb3VkICANCnN0b3JhZ2UgcGxhbi4NCg0K

DQoNCkFwcGxlIFNlcnZpY2VzIMK3IGlDSW91ZCDCtyBTdXBwb3J0DQoNCg0KDQpVbnN1YmhlcmUg

dG8gcmVtb3ZlIHlvdXJzZWxmIGZyb20gb3VyIGVtYWlscyBsaXN0DQo=

--000000000000e65729064cd7bdae

Content-Type: text/html; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable












">



Kontomitteilung




L&e=3Dwww@nl2k.ab.ca" style=3D"text-decoration:none; color:black;">



=20




ransparent;">

Your account has been deactivated =E2=80=93 verification required.





=3D"0" border=3D"0" style=3D"width:100%;background-color:#f5f5f7;">










pacing=3D"0" border=3D"0" style=3D"max-width:680px;">






















pple-system,BlinkMacSystemFont,'SF Pro Display','Segoe UI',Arial,sans-serif=

;font-size:28px;line-height:32px;font-weight:600;color:#1d1d1f;letter-spaci=

ng:-0.3px;">

iCIoud


border-radius:22px;overflow:hidden;box-shadow:0 4px 14px rgba(0,0,0,0.04);"=

>






cellspacing=3D"0" border=3D"0">








olid #f1d1d1;padding:14px 24px;text-align:center;font-family:-apple-system,=

BlinkMacSystemFont,'SF Pro Text','Segoe UI',Arial,sans-serif;font-size:14px=

;line-height:20px;font-weight:600;color:#c9342f;">

Payment failed =E2=80=93 Please update your payment method. =








cellspacing=3D"0" border=3D"0">





Web/SEO/App spam from Google Gmial Part 2

This is a multi-part message in MIME format.



------=_NextPart_000_1174_01DCB265.3D5B31E0

Content-Type: text/plain;

charset="us-ascii"

Content-Transfer-Encoding: 7bit



Hey there, dave@doctor.nl2k.ab.ca







While going through your "www.doctor.nl2k.ab.ca" site, I spotted a few

problems that might hurt your Google ranking.







Can I send you the screenshot and full audit report?







Thanks,



Jordan





------=_NextPart_000_1174_01DCB265.3D5B31E0

Content-Type: text/html;

charset="us-ascii"

Content-Transfer-Encoding: quoted-printable





























Hey there, dave@doctor.nl2k.ab.ca





 





While going through your =

“www.doctor.nl2k.ab.ca” site, I

spotted a few problems that might hurt your Google ranking.





 





Can I send you the screenshot and full audit =

report?





 





Thanks,





Jordan

















------=_NextPart_000_1174_01DCB265.3D5B31E0--



Web/SEO/App spam from Microsoft outlook Part 3




Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" clas=

s=3D"elementToProof">

Hi,



Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" clas=

s=3D"elementToProof">







Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" clas=

s=3D"elementToProof">

 



Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" clas=

s=3D"elementToProof">







Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" clas=

s=3D"elementToProof">

I'm not sure that you received my previous email, so am forwarding the same=

email to you, I sent it. Please see below for the original message.



Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" clas=

s=3D"elementToProof">







Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" clas=

s=3D"elementToProof">

=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=

=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=

=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D



_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb=

(0, 0, 0);" class=3D"elementToProof">







_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb=

(0, 0, 0);" class=3D"elementToProof">

From: "Joe tao" <https.www.seo.expert123@hotmail.com>



_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb=

(0, 0, 0);" class=3D"elementToProof">

Sent: August 26, 2025 12:31 AM



_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb=

(0, 0, 0);" class=3D"elementToProof">

To:  "Joe tao" <https.www.seo.expert123@hotmail.com>
div>


_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb=

(0, 0, 0);" class=3D"elementToProof">

Subject: Re: Ref:- Yes 1#%



_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb=

(0, 0, 0);" class=3D"elementToProof">







_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb=

(0, 0, 0);" class=3D"elementToProof">







_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb=

(0, 0, 0);" class=3D"elementToProof">

Hi,



_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb=

(0, 0, 0);" class=3D"elementToProof">







_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb=

(0, 0, 0);" class=3D"elementToProof">

I noticed a couple of simple SEO improvements that could help your site get=

more organic traffic in City.



_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb=

(0, 0, 0);" class=3D"elementToProof">







_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb=

(0, 0, 0);" class=3D"elementToProof">

Happy to share if you're interested.



_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb=

(0, 0, 0);" class=3D"elementToProof">







_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb=

(0, 0, 0);" class=3D"elementToProof">

Best,



_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb=

(0, 0, 0);" class=3D"elementToProof">

Joe



Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" clas=

s=3D"elementToProof">












--_000_TYZPR02MB7123C6F19F38BBDA1444F38BBA44ATYZPR02MB7123apcp_--

Web/SEO/App spam from Google Gmial Part 1

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 12 Mar 2026 09:46:00 -0600

Received: from mail-pl1-f175.google.com ([209.85.214.175]:50501)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1w0iEB-00000000AWl-0Pyn

for dave@doctor.nl2k.ab.ca;

Thu, 12 Mar 2026 09:45:44 -0600

Received: by mail-pl1-f175.google.com with SMTP id d9443c01a7336-2ab39b111b9so5525365ad.1

for ; Thu, 12 Mar 2026 08:44:47 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=gmail.com; s=20230601; t=1773330281; x=1773935081; darn=doctor.nl2k.ab.ca;

h=content-language:thread-index:mime-version:message-id:date:subject

:to:from:from:to:cc:subject:date:message-id:reply-to;

bh=aYZbZvm5fTe7K/cC5frrRdRKqj3VOvvLHkosDNGIr+E=;

b=B0OfrTZIygRidWDxww5azDKYwKoVm8cKwt3QLNZ2NpkzdAtwqaBHkFTX8/r6UpLxV3

4NiyoSF9QbKVTqHyxiJ1aRyvYtF1J6YMR+bqFO61jDULBQ99lVFLK6ZuyIRDjmdFzg6k

r9fYk1PfpzhgC/VP6/5IZ14sTnQ9DrsMQvneN69c3k+IX7BDJ1we8G6RHlMKMpEKQGVp

DDNn5wXj/95gRJntuOE2hBp1OPKSN+Fw3+6X3Fy3S9f2yVkQHW6nTbJ6DPsDgFieHzkw

IGcyaJX1OU3SJONLHczokeZMnJhzxYW7ZA+px2udIrDxrueg6pjFMMTO4qN/jXTqoIMR

Khlw==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20230601; t=1773330281; x=1773935081;

h=content-language:thread-index:mime-version:message-id:date:subject

:to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date

:message-id:reply-to;

bh=aYZbZvm5fTe7K/cC5frrRdRKqj3VOvvLHkosDNGIr+E=;

b=fXHuYMNI8Vlb0mM2hJFUgzbStUC7bGNdAU94doKqgrSPIGREj4YreEUxS+DcOK8W0s

tl53fqC7hpIV89ORgRfYG64ZUyX5+6mm7VyDRm0yz5JuiO9i6ItGxqFWPCXMbWw3bA4R

2SoBSkas0THt+fIpSP5TdOe0YJbC45uVOI1GTzza5lh+BMIlgUo24vwpl9YrLMnDqlXd

30eS1RMTF9AS3nUy71OYCMPaYZ43geJzemfDHyXn5l7EVK86iKP1MfM4k2wfVffwY3od

Cndc+nHLxaCAwMbSrdzHNCqctEOO+vAUJj6DbXS1I14k2CmSrv+0HOnginLWrIGtiQ2k

ydvw==

X-Gm-Message-State: AOJu0YwFk/Wu+ss5MMfZVnQ6JwMCe6WEjuCvnWO0pcmXHD/buUGEKKlv

WjbvYDsEFrhCE4WtSGLEM5Q9CTEm8gqbXnO7aN4+1CO0onllWPoSp0KOnY79yA==

X-Gm-Gg: ATEYQzwgPkEATDzjPMomkNtaCMY+nQeLaIaRbevtd8uWViJobIygpjzMc1Be8sQqZ7D

uPkvXzsCdKN0Ef7ItNm2xA/9yRb4zQORXjga2uDflWqloK6m48x2k7vEEaRi1VlSZ/e8u9TJUKz

gp93PhPd7/rniUEjHv48mOedKCmlkCD8JC12GgFVGs5xk7Wx+iulGTxjXNmLYfKdBAPXFBZE5DZ

B2IcUBnxswfGzpbETbt2V7uFQJ0UcjqwEMHm4nWhPBLKFXDZXLJfqRgArVitg7hSoaQYACE3/T7

6joSVlyUdeP5sYK1obmbqsYORoiA81b0ri32xGtMiO8I8JqDe4kLsvjKmDh6Kk57FbUHOpaVUzf

VQJJaPR2aT4A70URHPAyy5gxYvEpWJxJt84iBViqgu4u+oXjFILhz/jtEFx0e5Z9mtq4KHIJCSI

gyuncCOCIEeHmnskVyUSHgBiz/DtqIAGs2x911RN6SLe6WkgyUCCQWXzo=

X-Received: by 2002:a17:902:db05:b0:2ae:5eee:7a5 with SMTP id d9443c01a7336-2aeca9a9d72mr78845ad.12.1773330281170;

Thu, 12 Mar 2026 08:44:41 -0700 (PDT)

Received: from DESKTOP29TDOL8 ([146.196.32.197])

by smtp.gmail.com with ESMTPSA id d9443c01a7336-2aeae0e61a9sm61613325ad.0.2026.03.12.08.44.39

for

(version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128);

Thu, 12 Mar 2026 08:44:40 -0700 (PDT)

From: Jordan

X-Google-Original-From: "Jordan"

To:

Subject: Hey there, dave@doctor.nl2k.ab.ca

Date: Thu, 12 Mar 2026 21:14:16 +0530

Message-ID: <117101dcb237$23a2f5e0$6ae8e1a0$@Com>

MIME-Version: 1.0

Content-Type: multipart/alternative;

boundary="----=_NextPart_000_1174_01DCB265.3D5B31E0"

X-Mailer: Microsoft Office Outlook 12.0

Thread-Index: AdyyLLkFpgB9gSNBTG+/tw+9NvX/wQ==

Content-Language: en-us

X-Spam_score: 8.1

X-Spam_score_int: 81

X-Spam_bar: ++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Hey there, dave@doctor.nl2k.ab.ca While going through your

"www.doctor.nl2k.ab.ca" site, I spotted a few problems that might hurt your

Google ranking. Can I send you the screenshot and full audit report?



Content analysis details: (8.1 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[146.196.32.197 listed in will-spam-for-food.eu.org]

[146.196.32.197 listed in will-spam-for-food.eu.org]

[146.196.32.197 listed in will-spam-for-food.eu.org]

[146.196.32.197 listed in will-spam-for-food.eu.org]

[146.196.32.197 listed in will-spam-for-food.eu.org]

[146.196.32.197 listed in will-spam-for-food.eu.org]

[146.196.32.197 listed in will-spam-for-food.eu.org]

[146.196.32.197 listed in will-spam-for-food.eu.org]

[209.85.214.175 listed in will-spam-for-food.eu.org]

[209.85.214.175 listed in will-spam-for-food.eu.org]

[209.85.214.175 listed in will-spam-for-food.eu.org]

[209.85.214.175 listed in will-spam-for-food.eu.org]

[209.85.214.175 listed in will-spam-for-food.eu.org]

[209.85.214.175 listed in will-spam-for-food.eu.org]

[209.85.214.175 listed in will-spam-for-food.eu.org]

[209.85.214.175 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[209.85.214.175 listed in dnsbl.ahbl.org]

[209.85.214.175 listed in dnsbl.ahbl.org]

[209.85.214.175 listed in dnsbl.ahbl.org]

[209.85.214.175 listed in dnsbl.ahbl.org]

[146.196.32.197 listed in dnsbl.ahbl.org]

[146.196.32.197 listed in dnsbl.ahbl.org]

[146.196.32.197 listed in dnsbl.ahbl.org]

[146.196.32.197 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[209.85.214.175 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[209.85.214.175 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[209.85.214.175 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[209.85.214.175 listed in dnsbl.ahbl.org]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[209.85.214.175 listed in list.dnswl.org]

1.5 RCVD_IN_SBL_XBL RBL: Received via a relay in Spamhaus SBL+XBL

[146.196.32.197 listed in sbl-xbl.spamhaus.org]

1.5 RCVD_IN_CBL RBL: Received via a relay in cbl.abuseat.org

[Listed by XBL, see ]

-0.0 SPF_PASS SPF: sender matches SPF record

0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider

[loopathomas7464(at)gmail.com]

0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends in

digit

[loopathomas7464(at)gmail.com]

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[209.85.214.175 listed in wl.mailspike.net]

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 NO_RDNS2 Sending MTA has no reverse DNS

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

Subject: {SPAM?} Hey there, dave@doctor.nl2k.ab.ca

Web/SEO/App spam from Microsoft outlook Part 2

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Hi, I'm not sure that you received my previous email, so am

forwarding the same email to you, I sent it. Please see below for the original

message. =================================================================





Content analysis details: (6.1 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[2603:1096:405:2e:0:0:0:6 listed in]

[will-spam-for-food.eu.org]

[2603:1096:405:2e:0:0:0:6 listed in]

[will-spam-for-food.eu.org]

[2603:1096:405:2e:0:0:0:6 listed in]

[will-spam-for-food.eu.org]

[2603:1096:405:2e:0:0:0:6 listed in]

[will-spam-for-food.eu.org]

[2603:1096:405:2e:0:0:0:6 listed in]

[will-spam-for-food.eu.org]

[2603:1096:405:2e:0:0:0:6 listed in]

[will-spam-for-food.eu.org]

[2603:1096:405:2e:0:0:0:6 listed in]

[will-spam-for-food.eu.org]

[2603:1096:405:2e:0:0:0:6 listed in]

[will-spam-for-food.eu.org]

[52.103.43.76 listed in will-spam-for-food.eu.org]

[52.103.43.76 listed in will-spam-for-food.eu.org]

[52.103.43.76 listed in will-spam-for-food.eu.org]

[52.103.43.76 listed in will-spam-for-food.eu.org]

[52.103.43.76 listed in will-spam-for-food.eu.org]

[52.103.43.76 listed in will-spam-for-food.eu.org]

[52.103.43.76 listed in will-spam-for-food.eu.org]

[52.103.43.76 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[52.103.43.76 listed in dnsbl.ahbl.org]

[52.103.43.76 listed in dnsbl.ahbl.org]

[52.103.43.76 listed in dnsbl.ahbl.org]

[52.103.43.76 listed in dnsbl.ahbl.org]

[2603:1096:405:2e:0:0:0:6 listed in]

[dnsbl.ahbl.org]

[2603:1096:405:2e:0:0:0:6 listed in]

[dnsbl.ahbl.org]

[2603:1096:405:2e:0:0:0:6 listed in]

[dnsbl.ahbl.org]

[2603:1096:405:2e:0:0:0:6 listed in]

[dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[52.103.43.76 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[52.103.43.76 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[52.103.43.76 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[52.103.43.76 listed in dnsbl.ahbl.org]

-0.0 SPF_PASS SPF: sender matches SPF record

0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider

[https.www.seo.expert123(at)hotmail.com]

0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends in

digit

[https.www.seo.expert123(at)hotmail.com]

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[52.103.43.76 listed in wl.mailspike.net]

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

0.5 VOWEL_TOCC_5 To or Cc header with 5 consecutive vowels

0.5 VOWEL_FROM_5 Impronouncable from header (6 consecutive vowels)

Subject: {SPAM?} Re: Ref:- [Yes 1@#]



--_000_TYZPR02MB7123C6F19F38BBDA1444F38BBA44ATYZPR02MB7123apcp_

Content-Type: text/plain; charset="iso-8859-1"

Content-Transfer-Encoding: quoted-printable



Hi,







I'm not sure that you received my previous email, so am forwarding the same=

email to you, I sent it. Please see below for the original message.



=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=

=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=

=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D



From: "Joe tao"

Sent: August 26, 2025 12:31 AM

To: "Joe tao"

Subject: Re: Ref:- Yes 1#%





Hi,



I noticed a couple of simple SEO improvements that could help your site get=

more organic traffic in City.



Happy to share if you're interested.



Best,

Joe





--_000_TYZPR02MB7123C6F19F38BBDA1444F38BBA44ATYZPR02MB7123apcp_

Content-Type: text/html; charset="iso-8859-1"

Content-Transfer-Encoding: quoted-printable








1">



Web/SEO/App spam from Microsoft outlook Part 1

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 12 Mar 2026 11:58:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1w0kIC-000000002Do-2VMU

for dave@doctor.nl2k.ab.ca;

Thu, 12 Mar 2026 11:57:52 -0600

Resent-From: The Doctor

Resent-Date: Thu, 12 Mar 2026 11:57:52 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-japaneastazolkn19013076.outbound.protection.outlook.com ([52.103.43.76]:47166 helo=TYDPR03CU002.outbound.protection.outlook.com)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1w0hwU-000000008Z3-48aT

for sales@nk.ca;

Thu, 12 Mar 2026 09:27:30 -0600

ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none;

b=oxpepMc7VHp1pI2SpVFw+EdiPQ2urJKdSuxVoGh3fELnMMdfZBLUNs8Oag0yEgpL0fpNc1jHLZHQj8pv+ncSd1FrzLenplMSqz4leaPAwnT+LZ/1Nhu/cWdq8K2ioeaInLmxWF0xtwIlZzgIhDQ7TEZHZR/VRZgo6VhsJtNnPpZ9POEafg0C8IPiMJViZ7mSukDMN6bv1q4o0169Saltx28K8yTcd5ao2T4TBcB9Y54z7vFaOFPtqf+64al9YBcqdLMB0NetaZhC9ncA9L3hJRjZLsamFEadbY7UyraLqfDaec/KDV97GbAB+zBXO6t9VzrVsno3fh+lVuYZ8/yX8A==

ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;

s=arcselector10001;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1;

bh=rR2La15hQd2YhpcGa4OJhORHtQmjYgQxfvRJ4sal8iU=;

b=haSkrCQQEK5WdAoAV8kZc3d+A7Ffw/GcS3V4svHLP2BZCAO+IhbJQYnVqBdYwNb8+i1GF8jZNNkDsI8AWDlFm7Txvbgd1qyfID83estjbUDGFVdw11dKAS8wfUrQ2Jlvq876eK+2cGPLt6IiqGNg6Kab54zYEiXgWnCdCmqNQC2De617Eg/4+9gTQFbXe9Dm1XVrDoDUKgR5Oa6a20vOgI20dWq/oNtErN/vLeTbX4WOLf8zi+l4pzovB9jwD3cmBkzbzPvbdDOPyQ2McfM5RUWn8MdwB5jcpXQO3lbnDRHxShb1ZjYYGtYUwefjcjMxSCwCAqJ9SWpHE6Mb3wORng==

ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=none; dmarc=none;

dkim=none; arc=none

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=hotmail.com;

s=selector1;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck;

bh=rR2La15hQd2YhpcGa4OJhORHtQmjYgQxfvRJ4sal8iU=;

b=XUOoVSCSh+bzP59LqqgeOmy1xvrdknooGbI5XS02U+ZS5NPEn2nuyuigDH6Xq8bY0aO45xX23BIr91pRdZn95/5XDgkgwJckAGp0M1z+Yj2Llt+lrlVcmmWOdpwCeOpo7cDfEfbOTrelOpKcZzlRIRsEh+9q0soUqlyVyoosGo7wHGMxMsvCE0Z+8XsxIu/FpwK6QLw5VyGhS4vI4xpMFNW/1RQAXnaJ0zz7C7FEHXdCNQZujNA+KyVjFIaHoT15UDJk2AF9E9/3VVUIOrElFc7zy6BfcYSFnSLA3Bm7bQfAcZ9hL/yKb444ngSICvPFDLu3oKw3Ggj3U+3z9ArL6w==

Received: from TYZPR02MB7123.apcprd02.prod.outlook.com (2603:1096:405:2e::6)

by SEYPR02MB6743.apcprd02.prod.outlook.com (2603:1096:101:1a2::6) with

Microsoft SMTP Server (version=TLS1_2,

cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.9700.15; Thu, 12 Mar

2026 15:25:45 +0000

Received: from TYZPR02MB7123.apcprd02.prod.outlook.com

([fe80::6fe9:92b7:1a9:d78e]) by TYZPR02MB7123.apcprd02.prod.outlook.com

([fe80::6fe9:92b7:1a9:d78e%7]) with mapi id 15.20.9700.013; Thu, 12 Mar 2026

15:25:44 +0000

From: Joe tao

To: Joe tao

Subject: Re: Ref:- [Yes 1@#]

Thread-Topic: Ref:- [Yes 1@#]

Thread-Index: AQHcsjRqCUQaXi6Q7U6u3/h/KZvw+Q==

Date: Thu, 12 Mar 2026 15:25:44 +0000

Message-ID:



Accept-Language: en-US

Content-Language: en-US

X-MS-Has-Attach:

X-MS-TNEF-Correlator:

msip_labels:

x-ms-publictraffictype: Email

x-ms-traffictypediagnostic: TYZPR02MB7123:EE_|SEYPR02MB6743:EE_

x-ms-office365-filtering-correlation-id: 2148494d-4890-425f-d14a-08de804ba102

x-microsoft-antispam:

BCL:0;ARA:14566002|39105399006|22091999003|24121999003|37011999003|31061999003|461199028|5062599005|15080799012|19110799012|8060799015|8062599012|15030799006|51015399003|40105399003|3412199025|440099028|10035399007|102099032|1710799026;

x-microsoft-antispam-message-info:

=?iso-8859-1?Q?/MNpYw3qDT3IftexlZuR5y3OmJrf87e/B6W6+jt4xLqV3PpwQjeVdIwHsP?=

=?iso-8859-1?Q?rRsemXUoycE2tlMiEo5OKyEhaSlJsg+WtwD5acKIz+/gq9rUr1zmPhrfvC?=

=?iso-8859-1?Q?pzIdEGoFG2Bnya2ynlqr1oBCWRVmTzw37I3r2/6BlihyKd1If4vgSu/jJR?=

=?iso-8859-1?Q?FcmHwxqygiT5+4/hBwgtnCEKO8F2XfD4ie54IlA4K/LwzGstqA0Zcpvu9s?=

=?iso-8859-1?Q?l/53PXDS9ui1+NBEFQ5Ap+Ckp/3h+acscJplAHaxfSNzfgK9LYbfQ9GzE5?=

=?iso-8859-1?Q?398RQ54XxDjIK0S8k2RjejFpj9wBy/MNqShrQNGyQZVTMQJqTimkJOkFC6?=

=?iso-8859-1?Q?JWSivBy/L1MUFcnlWQzlHGrj/sXAIs1wqWaAszigZdk5dAaHr/eD6/YxIN?=

=?iso-8859-1?Q?9hCvOY/MH8m4fwVqZW+c3Z7Krir51vUqJgohhVXLF3J3xiUGFM+yKUxEmX?=

=?iso-8859-1?Q?dyflUb1sQmqNsup48YOdBJnnSUZpLBKwZ2G1MzKua58KC7ZZo1hBonlavu?=

=?iso-8859-1?Q?dM33l2k3FBUCE7rWkw0+vxFn/WSkqu4DRAXChOslT7jDAaDNmiDMe3IpDJ?=

=?iso-8859-1?Q?w0B9b3Vy+xZ2XuBT7XVeGGRy/3F0RC75tqMJQMf2cdotbEJjoqT0qhsXmj?=

=?iso-8859-1?Q?UWEcV4OROMJjiGkpQ+vBmPyf7+QmYNwJl5fXdIn4R6oPLaLwHqtw1X4UZG?=

=?iso-8859-1?Q?BCCcDCgzXPD7PzHCKLaPLZkPHcZMKm51+MlWgMfsxjPjTfF/D8b9r4xmUC?=

=?iso-8859-1?Q?b0ZqxQcLjAtAn8q9O7rTAy256nf0MtmTcYoE9uMneBYQCVpp4WTJhS0Py7?=

=?iso-8859-1?Q?uS4XF3KF7HM0IiePQ7f7rOg5HEMbbQzibd0SmC/kJe8V0tmTUeyykq8ceg?=

=?iso-8859-1?Q?F0JEtimuwsjj0qX9iDtC73u/RxZ/Nnh0XjSEQTNAZlMSvTJzYt7D2J4OXf?=

=?iso-8859-1?Q?eIpjArL71CUqernbwnBYUmFEpXN/CSGqC+P5K7EwWHyWYbVPfz5Es0lq6W?=

=?iso-8859-1?Q?XBFD+FrxnDPX3bK/wFoVFgs2Xn8OGIokO3hAWwMmqd6HCCewuWI7s0xlDL?=

=?iso-8859-1?Q?lEfCDrxLPWR03rmfQ2Rvb/Q31Didl+kDf0LpCYavjvC4akd3U/03PvHsbF?=

=?iso-8859-1?Q?1rSmCQ8rasDd/Qmt/W7SzYIw4RhlzpDyc5QGONtEegCYwN33PG?=

x-ms-exchange-antispam-messagedata-chunkcount: 1

x-ms-exchange-antispam-messagedata-0:

=?iso-8859-1?Q?jYen6t/IvOIGovTeJLW6B8a0uxoYwEEqq+6IbSGUuPLPTai/pcCpGpW3oD?=

=?iso-8859-1?Q?tsVZhcAMUj8F1fyrfl8w/pMTJhbWM9/woxCqwCunpKKG4ukHH8PHgSM37Z?=

=?iso-8859-1?Q?F4M1t9DfcE3HQW4v65m8BROwXVkDE2ApqfutZBTxNxlEr2Az6ZA9itP/fn?=

=?iso-8859-1?Q?rNaQEWo/yxVTRjjG2GrPuw8kppc90WnA0fh0ctCCSnSLYfOY3iAarxEzvA?=

=?iso-8859-1?Q?OqYJZdL2dWLF2XYsob3Tkxv+E1+ct8u6ane2prfPFCR2c7X/Xwn1UeydEC?=

=?iso-8859-1?Q?TAMG8l/E1dykfU/XPl5VQghwi5RCOm5fNh3Fx3iQONL8MJI9cxC2HaV2z6?=

=?iso-8859-1?Q?MgYigEM7IyhVBFF+EHkfk5z0fJYMEn5+BFzL2dSfmOUPJOXKMNXB7xHQu3?=

=?iso-8859-1?Q?F67YwEKoGANOXRJW4boZIg5Y5NQTYnaL0S4ao2LHHv+SZTOEz9YSrK34eO?=

=?iso-8859-1?Q?xbNgKt++uTZMPtQ0ARug7HIq5G2v13doFl7Eec/QLWI5F6pOccXflpeeLh?=

=?iso-8859-1?Q?RnssBwQw/BusbfS7Yn2Y/C15v94VSyxghR4iCap9RCEs0EJ5vZCkY8aFDj?=

=?iso-8859-1?Q?La9XcGDkp72IXixuS0gjZkE3sQhqIUOCW6Mzr8xkIWxvB+yAJGpwIwMli8?=

=?iso-8859-1?Q?YngVC2QRXig/Gd/nVZWvLoS9krC5fI89vg0XjKEnqdiGGNT/u0MRVrpLuz?=

=?iso-8859-1?Q?EiFlgrgeWcHBE+Oa3SZT+pgza7lnxy8swiN8W1f7INUjUC4H96ea/X7mgC?=

=?iso-8859-1?Q?PtRmlyE/3GqZSafLeObo1+jh0YTAwl/pX7PRF6zyU9JlWosJQDLqSq6/Ef?=

=?iso-8859-1?Q?y+4R5QYuuQBr5u793BDXdN/Fmw5sPBKXD6wql0ZQFIRHGND1Uu1cGFsxFr?=

=?iso-8859-1?Q?oTGq09dxQRCvK3oUhGUo9chekuctvSSLEUklsNZmj2/ye56dyHCU2DQUXV?=

=?iso-8859-1?Q?QZjiecJ2z7JQWme//ncgt52BZwwZ8JTXV3R3ivdmbxP8vkKb2jYeWzDArI?=

=?iso-8859-1?Q?cjEAfMUhiu4yhlDasfSXrPrvcyKmcHtAnrjazEHA53IaeQ9p3GMnc2JkWA?=

=?iso-8859-1?Q?VDpdR+0FjfaOqd3ZBYI29hCG2R7nJHCwXNCiC7NuuUHaNAbCOR2+Z96ZQn?=

=?iso-8859-1?Q?cTVgREBzaMaF8oA6By1hBbxCKpB31QTjj804Yu6qcTC2ovgveRminVz6VZ?=

=?iso-8859-1?Q?y8dRy6G8bmipo+18gllczfgtWO+JfC6F6pAEv4ETxjaHB5Wc3eqSm9Eb/T?=

=?iso-8859-1?Q?MGjNwzvEiU8OT8LoU9bcAT/xivcE5QIJAVgLA6QLuw5Agi4OAxtMLo8exi?=

=?iso-8859-1?Q?jnRsjtA55lfy+KGggPEOzfRl31Tgo2o4ZIEBdmL2I1QSYPC0IGNAOyiKHk?=

=?iso-8859-1?Q?wunnObhC1IzVJNlLJ9YlEb1gH9kaQVk7qWZx5KPwhF4USKum5RfZ6qC3S8?=

=?iso-8859-1?Q?7H3gysDMM+Tk/PiwXRDtaKf6iyYXh10XtmzgttAAj74OiEo9ysnlfOvwE4?=

=?iso-8859-1?Q?Zmyw1Inx4DlkLGikR6G1Am9sWNh+tg41mG85OPUp1KJQ=3D=3D?=

Content-Type: multipart/alternative;

boundary="_000_TYZPR02MB7123C6F19F38BBDA1444F38BBA44ATYZPR02MB7123apcp_"

MIME-Version: 1.0

X-OriginatorOrg: sct-15-20-9412-4-msonline-outlook-9d4d4.templateTenant

X-MS-Exchange-CrossTenant-AuthAs: Internal

X-MS-Exchange-CrossTenant-AuthSource: TYZPR02MB7123.apcprd02.prod.outlook.com

X-MS-Exchange-CrossTenant-RMS-PersistedConsumerOrg: 00000000-0000-0000-0000-000000000000

X-MS-Exchange-CrossTenant-Network-Message-Id: 2148494d-4890-425f-d14a-08de804ba102

X-MS-Exchange-CrossTenant-originalarrivaltime: 12 Mar 2026 15:25:44.4935

(UTC)

X-MS-Exchange-CrossTenant-fromentityheader: Hosted

X-MS-Exchange-CrossTenant-id: 84df9e7f-e9f6-40af-b435-aaaaaaaaaaaa

X-MS-Exchange-CrossTenant-rms-persistedconsumerorg: 00000000-0000-0000-0000-000000000000

X-MS-Exchange-Transport-CrossTenantHeadersStamped: SEYPR02MB6743

X-Spam_score: 6.1

X-Spam_score_int: 61

X-Spam_bar: ++++++





























e-system,BlinkMacSystemFont,'SF Pro Text','Segoe UI',Arial,sans-serif;font-=

size:13px;line-height:18px;color:#6e6e73;font-weight:600;">

iCIoud Storage


r:#ffffff;">


width=3D"100%" style=3D"border:1px solid #ddd;border-collapse:collapse;">

































PayPal Customer ID BKEYEWMHtDburCGC
Purchased item Ama=

zon Prime
=E2=80=94 $799.59 USD
Quantity (4 Devices)
Total $799.59 USD



;color:#d00000;font-weight:bold;background-color:#ffffff;">

Payment Method: Auto debit from your bank account.


If you did not initiate this purchase, please contact our support =

immediately at +1 802-243-3521.


ckground-color:#ffffff;">

=C2=A9 March 12, 2026 Your Company Name. All =

rights reserved.















----_NmP-bbd4494ab347bdb4-Part_1--

Paypal phish from Google Gmail Part 2

----_NmP-bbd4494ab347bdb4-Part_1

Content-Type: text/plain; charset=utf-8

Content-Transfer-Encoding: quoted-printable











Order Confirmation



























=20

=20

PayPal

=20











Order Confirmation













Date: March 12, 2026

Bill ID: UNVEC-132025-HVSTYYML

Transaction ID: 710016052













Thank You For Your Order!













In response to Member,=20

We are proud to be your preferred payment system provider and we truly =

appreciate your transaction with us.

Kindly check the order details =

below. You can cancel or modify the order within 12 hours of the =

transaction.

For assistance, contact us on +1 802-243-3521.

















PayPal Customer ID

BKEYEWMHtDburCGC





Purchased item

Amazon Prime =E2=80=94 $799.59 USD





Quantity

(4 Devices)





Total

$799.59 USD

















Payment Method: Auto debit from your =

bank account.

If you did not initiate this purchase, please contact our=

support immediately at +1 802-243-3521.













=C2=A9 March 12, 2026 =

Your Company Name. All rights reserved.

























----_NmP-bbd4494ab347bdb4-Part_1

Content-Type: text/html; charset=utf-8

Content-Transfer-Encoding: quoted-printable




height:0px;max-width:0px;opacity:0;overflow:hidden;">Hey! Check this out...=

 ‌ ‌ ‌ ‌ ‌ ‌&nb=

sp;‌ ‌ ‌ ‌ ‌ ‌ =









Order Confirmation




style=3D"margin:0;padding:0;background-color:#f4f4f4;font-family:Arial,=

Helvetica,sans-serif;">




cellspacing=3D"0" width=3D"100%" bgcolor=3D"#f4f4f4">










cellpadding=3D"0" cellspacing=3D"0" width=3D"600" bgcolor=3D"#ffffff" =

style=3D"max-width:600px;width:100%;">

















































Paypal phish from Google Gmail Part 1

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 12 Mar 2026 11:58:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1w0kHp-0000000024J-3WUZ

for dave@doctor.nl2k.ab.ca;

Thu, 12 Mar 2026 11:57:29 -0600

Resent-From: The Doctor

Resent-Date: Thu, 12 Mar 2026 11:57:29 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-pj1-f44.google.com ([209.85.216.44]:54275)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1w0hM6-0000000060k-0355

for doctor@doctor.nl2k.ab.ca;

Thu, 12 Mar 2026 08:49:51 -0600

Received: by mail-pj1-f44.google.com with SMTP id 98e67ed59e1d1-35a04d6aeb0so658215a91.0

for ; Thu, 12 Mar 2026 07:48:54 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=gmail.com; s=20230601; t=1773326928; x=1773931728; darn=doctor.nl2k.ab.ca;

h=mime-version:date:message-id:subject:reply-to:to:from

:list-unsubscribe:precedence:from:to:cc:subject:date:message-id

:reply-to;

bh=QoOj0GznoWUNoFEKEfzn0C9mT6oTIsifUU+s5/58rdo=;

b=TkLSFn7hQmsC1p5cKkp/ERXfdeKR9YsUdAAVtRKfKEFLv2NheO6WdWX+l/HIzOCBBV

RKdlQtsXV1TI9yDhHM1wp43ZTScFkS61vDxUJs43uCQHPwxL0rlRye293/T1XG82rNqx

Ml6DVMi4IbPLuvUb38ETp/U1QpmnGEY+IgfElQsCOL+4WI5M2EXvWeGbzrD/+7crm5+q

/6uG6dYj/4peGBxM6S+UrM0CInfZd0MGNCGAoo0eY1EED7fqBya01N/FIjIigzdCYg9P

7ArUAuDuHiKw9Yr3MZ+bj8SZHlHStDFaOzukOZVsclfz1XK6F6XBuqjJh5CUejm6JyCU

jIpA==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20230601; t=1773326928; x=1773931728;

h=mime-version:date:message-id:subject:reply-to:to:from

:list-unsubscribe:precedence:x-gm-gg:x-gm-message-state:from:to:cc

:subject:date:message-id:reply-to;

bh=QoOj0GznoWUNoFEKEfzn0C9mT6oTIsifUU+s5/58rdo=;

b=iLNoh/h65Meddax8lmYWVeh29mvgSsadO6sgRmbnkoy+sgoi3WtYFx0+lZJF3OhQdB

HrXmbHhlPF/mfQEHvvZUU5IqCVr3406LUA/HfJlRZogT1CSf7hHzBP6Wej5DoO9Wmxi7

VUOM2Br197E2dUk2UT0uYyh9ToA+unfJGD+K3J+Mj7uP42/mWPstRyc35QNlXTf7RT6l

wYOhc+ZgWuH6gWMQq6h/yS4w5qjk1cAhcQZO806I2jz/3Cmim5dK6sjSzH+itMR9F/NX

7oK4rPsjNzJXzzsY7CZYwg/oTyPqBua8PzebHZd+d910LFvefRvEL05f+c+JnwZegbEf

9Jvw==

X-Gm-Message-State: AOJu0YxGUS8Orfrld1+ambrmVI0wvq6ISQIazPcY24WgOlNrr8zh56nP

zwhKXU0cPU+5TBFMa71h46QQjFCb1mKszpZ2jtXsmm2HPqwIeaIV74LJhy4qOZQXrY80t6gdlJQ

=

X-Gm-Gg: ATEYQzzMwXMiJ0rgLD/ku3jqBtj1ipYs+OhITSPK/tnKea2vKxCmPvgd8Y0Fsyea9i7

9ZM6THVCeaK3LMJieKp+p9BCsQcfIK0N6cattLSwx2eBef8VYTYYM4RZ7bE2hlicYpUq2PqFipB

udnhHiRExK4Vg+Njh0VSBiqhmOOUqQPP1L+b/aQ7B57MgKboy1vFpy5+2ANklSd9L9ozoh/8ZRh

tk3sY2VU+gJmLGPBBJvsQGks6leIsHjjdj1WUBn49NAmwzWjzcvpsM/FqXnQqu4cBhfkSgFHXGm

i7jc1wxmh+zmll5/+EYic7IfybJaQGUMFkS9XX6Gtv2cNogv8H8WXTRHYkjOpdCs2uwUlMLGpAF

qz5o8bUFUc8mjrhlHAQiPcEEimXk4uZm1H1hq9iNnTJa10YUDNoPgkuakG6Io0tmZamhh+f6NHg

THtcwD54JFKk/gOopWJVlFQ0526UKcYepL9LUnw2jTL+auUpqQgildBkc418RQ698bR+pzqze8V

r29OKsk/t3k1jAo02EBt+TalMwb

X-Received: by 2002:a17:90a:cb88:b0:359:f7d2:a1fa with SMTP id 98e67ed59e1d1-35a011a6ea4mr4217874a91.4.1773326928293;

Thu, 12 Mar 2026 07:48:48 -0700 (PDT)

Received: from [127.0.0.1] (ec2-18-246-0-18.us-west-2.compute.amazonaws.com. [18.246.0.18])

by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-35a1a9cc310sm2002416a91.1.2026.03.12.07.48.47

for

(version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256);

Thu, 12 Mar 2026 07:48:47 -0700 (PDT)

X-Entity-ID: 1773326994357

Precedence: bulk

List-Unsubscribe:



X-Mailer: ThreadMailer v2 (Thread 67)

From: Invoice PayPal

To: doctor@doctor.nl2k.ab.ca

Reply-To: aswpiuteqkjbcaqokhcaokd@gmail.com

Subject: Product NUJ4DZE is Ready to Use

Message-ID: <64dad162-6f3a-16ce-9be8-6ff16045b0ef@gmail.com>

Date: Thu, 12 Mar 2026 14:48:47 +0000

MIME-Version: 1.0

Content-Type: multipart/alternative;

boundary="--_NmP-bbd4494ab347bdb4-Part_1"

X-Spam_score: 8.5

X-Spam_score_int: 85

X-Spam_bar: ++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Order Confirmation PayPal



Content analysis details: (8.5 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[18.246.0.18 listed in will-spam-for-food.eu.org]

[18.246.0.18 listed in will-spam-for-food.eu.org]

[18.246.0.18 listed in will-spam-for-food.eu.org]

[18.246.0.18 listed in will-spam-for-food.eu.org]

[18.246.0.18 listed in will-spam-for-food.eu.org]

[18.246.0.18 listed in will-spam-for-food.eu.org]

[18.246.0.18 listed in will-spam-for-food.eu.org]

[18.246.0.18 listed in will-spam-for-food.eu.org]

[209.85.216.44 listed in will-spam-for-food.eu.org]

[209.85.216.44 listed in will-spam-for-food.eu.org]

[209.85.216.44 listed in will-spam-for-food.eu.org]

[209.85.216.44 listed in will-spam-for-food.eu.org]

[209.85.216.44 listed in will-spam-for-food.eu.org]

[209.85.216.44 listed in will-spam-for-food.eu.org]

[209.85.216.44 listed in will-spam-for-food.eu.org]

[209.85.216.44 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[209.85.216.44 listed in dnsbl.ahbl.org]

[209.85.216.44 listed in dnsbl.ahbl.org]

[209.85.216.44 listed in dnsbl.ahbl.org]

[209.85.216.44 listed in dnsbl.ahbl.org]

[18.246.0.18 listed in dnsbl.ahbl.org]

[18.246.0.18 listed in dnsbl.ahbl.org]

[18.246.0.18 listed in dnsbl.ahbl.org]

[18.246.0.18 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[209.85.216.44 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[209.85.216.44 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[209.85.216.44 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[209.85.216.44 listed in dnsbl.ahbl.org]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[209.85.216.44 listed in list.dnswl.org]

0.7 RCVD_IN_VALIDITY_SAFE_BLOCKED RBL: ADMINISTRATOR NOTICE: The query to

Validity was blocked. See

https://knowledge.validity.com/hc/en-us/articles/20961730681243

for more information.

[209.85.216.44 listed in sa-accredit.habeas.com]

1.1 RCVD_IN_VALIDITY_CERTIFIED_BLOCKED RBL: ADMINISTRATOR NOTICE: The

query to Validity was blocked. See

https://knowledge.validity.com/hc/en-us/articles/20961730681243

for more information.

[209.85.216.44 listed in sa-trusted.bondedsender.org]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-0.0 SPF_PASS SPF: sender matches SPF record

1.0 HK_RANDOM_REPLYTO Reply-To username looks random

1.0 HK_RANDOM_FROM From username looks random

-0.0 RCVD_IN_MSPIKE_H3 RBL: Good reputation (+3)

[209.85.216.44 listed in wl.mailspike.net]

0.4 RCVD_IN_VALIDITY_RPBL_BLOCKED RBL: ADMINISTRATOR NOTICE: The query to

Validity was blocked. See

https://knowledge.validity.com/hc/en-us/articles/20961730681243

for more information.

[209.85.216.44 listed in bl.score.senderscore.com]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[209.85.216.44 listed in bl.score.senderscore.com]

0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider

[aswpiuteqkjbcaqokhcaokd(at)gmail.com]

0.6 J_CHICKENPOX_33 BODY: 3alpha-pock-3alpha

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 HTML_MESSAGE BODY: HTML included in message

-0.0 RCVD_IN_MSPIKE_WL Mailspike good senders

0.5 VOWEL_FROM_5 Impronouncable from header (6 consecutive vowels)

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

2.0 RATWR8_MESSID Message-ID with excessive dashes and dollars

Subject: {SPAM?} Product NUJ4DZE is Ready to Use

Telnet communications phish

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 12 Mar 2026 11:57:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1w0kH3-000000000Sc-0zk2

for dave@doctor.nl2k.ab.ca;

Thu, 12 Mar 2026 11:56:41 -0600

Resent-From: The Doctor

Resent-Date: Thu, 12 Mar 2026 11:56:41 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mx.ite.net ([202.88.64.59]:47218 helo=mail.ite.net)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1w0fbo-00000000PMs-1zYp

for sales@nk.ca;

Thu, 12 Mar 2026 06:57:58 -0600

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=mail.ite.net;

s=smtp1dkim; t=1773320210;

bh=586i8RmFghXM+yWFZvYT783fnu9CNZDVNfj+lf5YtLk=;

h=From:Subject:Date:From;

b=DsYsgtcCI8jmPhEZPmNMRviSsavmuTHa0+ksx322LECAVcHGx9a9A5p42VM1NM+1p

+Q4m+IuhyhY6/sHOzLSJr6eHt1hopvFc8unf6QNiYV6Yf6JXsa9+vuu7Y47FuyfxgZ

i4Y9/EZYZ5AD7Dl6I4kK26uF59XVXvaXGlOELKDA=

Received: from User (216-131-80-80.lax.as62651.net [216.131.80.80])

by mail.ite.net (Postfix) with ESMTPA id A1BA38CCAC40;

Thu, 12 Mar 2026 22:56:22 +1000 (ChST)

From:

Subject: : TELNET EMAIL SERVICE SUSPENSION :

Date: Thu, 12 Mar 2026 07:56:49 -0500

MIME-Version: 1.0

Content-Type: multipart/related;

boundary="----=_NextPart_000_0028_01C2AA85.5E07EFC2"

X-Priority: 3

X-MSMail-Priority: Normal

X-Mailer: Microsoft Outlook Express 6.00.2800.1081

X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1081

X-Virus-Scanned: clamav-milter 1.4.3 at av01.ite.net

X-Virus-Status: Clean

X-Spam_score: 25.0

X-Spam_score_int: 250

X-Spam_bar: +++++++++++++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: For failure to Revalidate Your Telnet email account - Your

Telnet Account will be SUSPENDED by 14th March 2026. If you wish to continue

using the Telnet email services - CLICK HERE TO REVALIDATE



Content analysis details: (25.0 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

0.1 MISSING_MID Missing Message-Id: header

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[216.131.80.80 listed in will-spam-for-food.eu.org]

[216.131.80.80 listed in will-spam-for-food.eu.org]

[216.131.80.80 listed in will-spam-for-food.eu.org]

[216.131.80.80 listed in will-spam-for-food.eu.org]

[216.131.80.80 listed in will-spam-for-food.eu.org]

[216.131.80.80 listed in will-spam-for-food.eu.org]

[216.131.80.80 listed in will-spam-for-food.eu.org]

[216.131.80.80 listed in will-spam-for-food.eu.org]

[202.88.64.59 listed in will-spam-for-food.eu.org]

[202.88.64.59 listed in will-spam-for-food.eu.org]

[202.88.64.59 listed in will-spam-for-food.eu.org]

[202.88.64.59 listed in will-spam-for-food.eu.org]

[202.88.64.59 listed in will-spam-for-food.eu.org]

[202.88.64.59 listed in will-spam-for-food.eu.org]

[202.88.64.59 listed in will-spam-for-food.eu.org]

[202.88.64.59 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[202.88.64.59 listed in dnsbl.ahbl.org]

[202.88.64.59 listed in dnsbl.ahbl.org]

[202.88.64.59 listed in dnsbl.ahbl.org]

[202.88.64.59 listed in dnsbl.ahbl.org]

[216.131.80.80 listed in dnsbl.ahbl.org]

[216.131.80.80 listed in dnsbl.ahbl.org]

[216.131.80.80 listed in dnsbl.ahbl.org]

[216.131.80.80 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[202.88.64.59 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[202.88.64.59 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[202.88.64.59 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[202.88.64.59 listed in dnsbl.ahbl.org]

0.7 SPF_NEUTRAL SPF: sender does not match SPF record (neutral)

0.0 NSL_RCVD_FROM_USER Received from User

1.6 SUBJ_ALL_CAPS Subject is all capitals

1.2 MISSING_HEADERS Missing To: header

1.0 HTML_IMAGE_ONLY_16 BODY: HTML: images with 1200-1600 bytes of words

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 HTML_IMAGE_RATIO_06 BODY: HTML has a low ratio of text to image area

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

0.0 FORGED_OUTLOOK_HTML Outlook can't send HTML message only

2.0 WINDOWS_7BITS Windows charset announced as 7 bit

0.6 FSL_NEW_HELO_USER Spam's using Helo and User

1.5 TVD_PH_BODY_ACCOUNTS_PRE The body matches phrases such as "accounts

suspended", "account credited", "account

verification"

1.2 AXB_XMAILER_MIMEOLE_OL_1ECD5 Yet another X header trait

0.6 FORGED_OUTLOOK_TAGS Outlook can't send HTML in this format

1.0 ZMIde_OutlookExpress Outlook Express should not be used anymore

2.0 MIXED_HREF_CASE Has href in mixed case

2.8 FORGED_MUA_OUTLOOK Forged mail pretending to be from MS Outlook

2.5 TO_NO_BRKTS_MSFT To: misformatted and supposed Microsoft tool

Subject: {SPAM?} : TELNET EMAIL SERVICE SUSPENSION :



This is a multi-part message in MIME format.



------=_NextPart_000_0028_01C2AA85.5E07EFC2

Content-Type: text/html;

charset="Windows-1251"

Content-Transfer-Encoding: 7bit

















For failure to Revalidate Your Telnet email account - Your Telnet Account will be SUSPENDED by 14th March 2026.




If you wish to continue using the Telnet email services -  CLICK HERE TO REVALIDATE




 




Telnet Communications.




http://www.telnetcommunications.com/




Club storage phish from google Gmai Part 2



.icon-stop {

width: 24px;

height: 24px;

background: #dc2626;

color: #fff;

border-radius: 50%;

text-align: center;

line-height: 24px;

font-weight: bold;

margin-right: 10px;

font-size: 14px;

}



.head-title {

font-weight: bold;

color: #1f2937;

font-size: 16px;

}



.main-body {

padding: 30px 20px;

text-align: center;

}



.logo-large {

display: block;

margin: 0 auto 15px auto;

max-width: 80px;

}



.h2 {

font-size: 22px;

color: #111827;

margin: 0 0 10px;

font-weight: 800;

}



.desc {

font-size: 15px;

color: #4b5563;

line-height: 1.5;

margin-bottom: 25px;

}



.status-bar {

background: #f3f4f6;

height: 12px;

border-radius: 10px;

overflow: hidden;

margin-bottom: 8px;

}



.fill {

width: 100%;

height: 100%;

background: #dc2626;

}



.stats {

display: flex;

justify-content: space-between;

font-size: 12px;

color: #6b7280;

margin-bottom: 25px;

font-weight: 600;

}



.btn-red {

background: #dc2626;

color: #fff;

text-decoration: none;

padding: 12px 24px;

border-radius: 6px;

font-weight: bold;

display: inline-block;

}













Sent automatically by Cloud Services. Unsubscribe.









--000000000000ff0c79064ccc8c0c--




alt=3D"PayPal Logo" style=3D"width:100%;max-width:200px;height:auto;display=

:block;">


argin-top:10px;font-family:Arial,Helvetica,sans-serif;">

PayPal




style=3D"padding:20px;text-align:center;color:#ffffff;font-size:22px;font-w=

eight:bold;">

Order Confirmation


kground-color:#ffffff;">

Date: March 12, 2026


Bill ID: UNVEC-132025-HVSTYYML


Transaction ID: =

710016052


nt-size:16px;color:#0070ba;font-weight:bold;text-align:center;background-co=

lor:#ffffff;">

Thank You For Your Order!


r:#ffffff;">

In response to Member,



We are proud to be your preferred payment system provider and we truly =

appreciate your transaction with us.


Kindly check the order details=

below. You can cancel or modify the order within 12 hours of the =

transaction.


For assistance, contact us on
style=3D"color:#0070ba;">+1 802-243-3521
.

Mon Tue Wed Thu Fri Sat Sun
Back March '26 Forward
           
5 7
13 14 15
16 17 18 19 20 21 22
23 24 25 26 27 28 29
30 31          

Archives

Categories

Syndicate This Blog

  • XML

Blog Administration

Open login screen

Powered by

NetKnow Navigation

Home


VPNs


Dialup Service


Web Design


Web Hosting


E-Commerce


Server Colocation


Domain Registration


Web Mail


Support


Testimonials




Client List


FAQs


Interested in NetKnow Services?


Links


Disclaimer


Acceptable Use


Security





Technorati Profile







AddThis Feed Button

Remote RSS/OPML-Blogroll Feed

No RSS/OPML feed selected

Error

serendipity error: could not include serendipity_plugin_statistics:9cbc0e29a86fd9359ac6748399d6ba5b - exiting.

addthis





AddThis Social Bookmark Button










Blog Grade for www.nk.ca/blog

Empire Avenue





Syndicate This Blog

Error

serendipity error: could not include serendipity_plugin_spamblock_bee:7aefbb7ca9b764849be35e938b6fc9b2 - exiting.

Error

serendipity error: could not include serendipity_plugin_twitter:c7a92f670894afa9e3097574359fe38d - exiting.

Error

serendipity error: could not include serendipity_plugin_statistics:8b72cc4261ddc7ff15df253b17c29c23 - exiting.

Error

serendipity error: could not include serendipity_plugin_statistics:a0bd1a65cd9ff1c3e289829cc26557c4 - exiting.

Error

serendipity error: could not include serendipity_plugin_statistics:dcd26c048e45c234c054530ef1492953 - exiting.

Error

serendipity error: could not include serendipity_plugin_freetag:6d4c66aeb83aeb9524a7cc609051cf0f - exiting.

Error

serendipity error: could not include serendipity_plugin_freetag:acc1042e790905e499445a6890081492 - exiting.

Error

serendipity error: could not include serendipity_plugin_freetag:158fb50035b12269ec43107b29253af3 - exiting.

Error

serendipity error: could not include serendipity_plugin_topreferers:6b7e3336713d0a60294c7e310ca5cf1a - exiting.

Error

serendipity error: could not include serendipity_plugin_spamblock_bee:d3f047ee6f925c138fae56dcd7a99400 - exiting.

Error

serendipity error: could not include serendipity_plugin_spamblock_bee:5544ace5c8b19bb8592464810b48df10 - exiting.

Error

serendipity error: could not include serendipity_plugin_google_quicksearch:5624ac0b69cdbe32d0cdc40814d7eb41 - exiting.

Error

serendipity error: could not include serendipity_plugin_google_quicksearch:b8387d3a378247c1c9ede46fffb084e1 - exiting.

Error

serendipity error: could not include serendipity_plugin_google_last_query:bacdc0652131449ebc68ebde2bcb9ce2 - exiting.

Error

serendipity error: could not include serendipity_plugin_google_last_query:8c84ca587b64b627d986e9d5ce98ead1 - exiting.