French language rental demand phish from Google Gmail

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path: <32744@ppk.ac.th>

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Fri, 24 Jul 2026 08:25:00 -0600

Received: from mail-ed2-f10.google.com ([74.125.228.74]:35592)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.99.3 (FreeBSD))

(envelope-from <32744@ppk.ac.th>)

id 1wnGpT-00000000Dzx-1ftg

for dave@doctor.nl2k.ab.ca;

Fri, 24 Jul 2026 08:24:57 -0600

Received: by mail-ed2-f10.google.com with SMTP id 4fb4d7f45d1cf-69f81c7774bso308437a12.1

for ; Fri, 24 Jul 2026 07:23:59 -0700 (PDT)

ARC-Seal: i=1; a=rsa-sha256; t=1784903032; cv=none;

d=google.com; s=arc-20260327;

b=GyyWDP4qtNkMv9b1ZnPwD5f+AVTHoszL+a1HGpLD2A5UhatgTyE6XVIITxHOMfM/zr

6Gi0scSrZPmNpOJKeJKrMMgi/BtL2NkVMWP2lJyneC4f25kGXlFnaV8ntrhX4M8Xu/NZ

ncIF5f7dYnbwN2vrO/JKGEQRhyCfKJ0S3QGMzEBZQ8Zhfw0FSPumwVZKxlSvrnCm5aXA

2tkLBnZT/lEEvNat3btW1TA+d/r8g+ayivQc04s2//qJaaZ/G1J6s4YGw+4KLX5syhbw

1OP4IA3icYM6tTU/hqjIHweCtQSAHRB3aA8DliQpQbm8jWnQItJtSsTCaVzfWpFt96r+

eQ/A==

ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20260327;

h=to:subject:message-id:date:from:reply-to:mime-version

:dkim-signature;

bh=IMA5Sw8qIrcHV4qGqe22xd6am7rg+aYSZ4DpW/tGOUk=;

fh=iJxnW4txVHu36bxW6bVHuHW9xfC3HwpWkzGZSogv29I=;

b=bnqaenTY+zpFntyzGfLE6k7oRISknC6aLONC6RmUuZqV6WOIASlWFvM2onGT7bk+7z

paF1O2Odq4274WJoQnGS4/FAA2M9aMEKBuo/LzD367ZCOAmeMM0LNpNFXrHHwBTcihsk

unucHYQoBOv2TG8I3A50h8CM6PWt91kmpNljyKWpIGx0FD9FfcsDwtlQLjY6wsdrIvLI

zjT97ind2ZnzG4nf6KUhv/oou42rTSLNECjli2oREsw0z5i6JNuuWD3205zf8fQMMwAI

JBztKsaNGxKOt9T4M3oMdblsPfuT+Q2d/U1TpiHEO/HBJgW7NGltBC7F8bl/Mg8N3mUC

1Ecg==;

darn=doctor.nl2k.ab.ca

ARC-Authentication-Results: i=1; mx.google.com; arc=none

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=ppk-ac-th.20251104.gappssmtp.com; s=20251104; t=1784903032; x=1785507832; darn=doctor.nl2k.ab.ca;

h=content-type:to:subject:message-id:date:from:reply-to:mime-version

:from:to:cc:subject:date:message-id:reply-to:content-type;

bh=IMA5Sw8qIrcHV4qGqe22xd6am7rg+aYSZ4DpW/tGOUk=;

b=WmjEJm0r9uxDWKLP1guLLu715ANoz12YfGLWaEacmspe2T9QdNKC11pzhPcPIUX6Mk

L6JS/ZK05af1fh73JHhMRH3URL8Lu8TeEoGjlYR0QysuBPUfYFvh/Wv+zU+vFALoJ+3H

2eqyKWJATY5rPv1pFbfDxkNDrInor6M3dYQ3DI9mA68oa6zmNXwYJnyI91HB7nCeoWkY

u60rGyUxAEvBwgMsDNML9t7cY066G0ZeyBEtBhnqtN10DJjnM4OReFRv9Rn9A+pWaiQk

Pw3fRGuhF93wBtrlRP9O85E+y2XfRfVzD08Md7pvSjnVPMntO3gyCjI6mn+iLj0grBUG

YHBw==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20251104; t=1784903032; x=1785507832;

h=content-type:to:subject:message-id:date:from:reply-to:mime-version

:x-gm-gg:x-gm-message-state:from:to:cc:subject:date:message-id

:reply-to:content-type;

bh=IMA5Sw8qIrcHV4qGqe22xd6am7rg+aYSZ4DpW/tGOUk=;

b=A3xjpEJTaJ6O08uoUY1DcnmpUcJRIlCj4qPf/A121FVqVQ5YCcqkeBNWj1e9Eg23Cq

QgXATG0ZZbvFY7KzAQUIcoFZfENZcXWW4/dFhatj04nsQSE4n2ygDF+yhNsd8b1BwSaX

tz6uPvH0ECnt8uLOdnDKKOLGKAH81XsgAfVSngrCUYCNERg0SH6gisqKpKr7Ih774EiY

sR24WpodjyFb5yAGHmhlstVDVSEX6hmWOVBktFTerqS5c4DbAZwkP/3i+SlRLvl+R7Jw

Pb6wnXrMsa/i57RDnap9D4Ba3FZUKa/xH61zicdF86DSxfobFRivuuqvgDdeoMiUYbJF

ieNA==

X-Forwarded-Encrypted: i=1; AHgh+RqeoOws3ywpwnnILwtHPZmJK7DRzymZlNgdNy52t4jpE2DiDXwcEu+Q8mZ9PZNe8v48Y+OP@doctor.nl2k.ab.ca

X-Gm-Message-State: AOJu0Yzxikqr7mGQVEC3YZTP9afj3JXSKPSjA4l/Myyn9iVfhCFIsMnq

eBbBOtvYx6l1iF1tMRLmUbkA43QeEGQbRoZFZ4KUz3VeOiQwo66cFfVkWVFqWe0ev8Jhi5aF+kl

IikcV6i7bRLmqlNM+qgJZnlWkkzdHH5M+GUVZON2Kcw==

X-Gm-Gg: AR+sD10geENy+GCIuHy4GJEjmLnc8prlr/Ptw35Vsvt0/hjx9gNKFtengYARJRWQ6MC

J4xVC9ErL2G2qLuqjlmG8j6IYFi3PXOBrwBpZxF8Ccvn9ZwUTx5pjXAOZ8ZLEXX8w5uMneUE8Ex

ncI3Kcyp18X6AKtzSHPWkTF/Cbt2rgU1Z5Z1vclQ5rB+SfNQjnPtgrpmdogoOSk67309pku+TJ9

/zMaholQosphsMigBiOLdoPKCLH2So5QunMxQB2uhN8w3TBR5jQDEwT9Z8XGzY/HdY6uAXmgO2D

A48isXw79FgAQvO6VHneHKpQaCGGjuOPBw==

X-Received: by 2002:a05:6402:52cc:b0:698:4405:4feb with SMTP id

4fb4d7f45d1cf-69f6b138549mr2863956a12.3.1784903032279; Fri, 24 Jul 2026

07:23:52 -0700 (PDT)

MIME-Version: 1.0

Reply-To: servicegestionlocative020103@outlook.com

From: GESTION LOCATIVE <32744@ppk.ac.th>

Date: Fri, 24 Jul 2026 16:23:41 +0200

X-Gm-Features: AUfX_mxvFV-3_VygFkak9EgO9_7g46BXXiV5iftyEZxoTRBr5nBMhXIQRbHqB4M

Message-ID:

Subject: =?UTF-8?Q?Avis_important_=E2=80=93_Mise_=C3=A0_jour_de_nos_modalit=C3=A9s_de?=

=?UTF-8?Q?_paiement_du_loyer=F0=9F=8F=A0?=

To: undisclosed-recipients:;

Content-Type: multipart/alternative; boundary="00000000000032b04506575c1f1e"

Bcc: dave@doctor.nl2k.ab.ca

X-Spam_score: 9.5

X-Spam_score_int: 95

X-Spam_bar: +++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Madame, Monsieur, Nous vous rappelons que le loyer du mois

d’août est maintenant exigible. Afin de faciliter le traitement et l’encaissement

des paiements, nous vous informons que *le virement Interac est désormais

notre mode de paiement privilégié*. Cette procédure est en vigueur Ã

[...]



Content analysis details: (9.5 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[74.125.228.74 listed in dnsbl.ahbl.org]

[74.125.228.74 listed in dnsbl.ahbl.org]

[74.125.228.74 listed in dnsbl.ahbl.org]

[74.125.228.74 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[74.125.228.74 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[74.125.228.74 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[74.125.228.74 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[74.125.228.74 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[74.125.228.74 listed in will-spam-for-food.eu.org]

[74.125.228.74 listed in will-spam-for-food.eu.org]

[74.125.228.74 listed in will-spam-for-food.eu.org]

[74.125.228.74 listed in will-spam-for-food.eu.org]

[74.125.228.74 listed in will-spam-for-food.eu.org]

[74.125.228.74 listed in will-spam-for-food.eu.org]

[74.125.228.74 listed in will-spam-for-food.eu.org]

[74.125.228.74 listed in will-spam-for-food.eu.org]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[74.125.228.74 listed in list.dnswl.org]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-0.0 SPF_PASS SPF: sender matches SPF record

1.5 GR_DOMAIN_UNDISC1 To contains undisclosed recipient (undisc)

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in digit

[servicegestionlocative020103(at)outlook.com]

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[74.125.228.74 listed in wl.mailspike.net]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[74.125.228.74 listed in bl.score.senderscore.com]

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

1.0 FREEMAIL_REPLYTO Reply-To/From or Reply-To/body contain different

freemails

2.5 FREEMAIL_FORGED_REPLYTO Freemail in Reply-To, but not From

3.0 UNDISC_FREEM Undisclosed recipients + freemail reply-to

Subject: {SPAM?} =?UTF-8?Q?Avis_important_=E2=80=93_Mise_=C3=A0_jour_de_nos_modalit=C3=A9s_de?=

=?UTF-8?Q?_paiement_du_loyer=F0=9F=8F=A0?=



--00000000000032b04506575c1f1e

Content-Type: text/plain; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable



Madame, Monsieur,



Nous vous rappelons que le loyer du mois d=E2=80=99ao=C3=BBt est maintena=

nt exigible.



Afin de faciliter le traitement et l=E2=80=99encaissement des paiements, no=

us vous

informons que *le virement Interac est d=C3=A9sormais notre mode de paiemen=

t

privil=C3=A9gi=C3=A9*. Cette proc=C3=A9dure est en vigueur =C3=A0 compter d=

e ce mois et

permettra un traitement plus rapide et plus s=C3=A9curitaire de votre paiem=

ent.



Nous vous invitons =C3=A0 effectuer votre r=C3=A8glement en utilisant les c=

oordonn=C3=A9es

suivantes :



Adresse Interac :

servicegestionlocative020103@outlook.com





Question de s=C3=A9curit=C3=A9 : Paiement

R=C3=A9ponse : Loyer



Nous vous serions reconnaissants d=E2=80=99effectuer votre paiement dans le=

s d=C3=A9lais

pr=C3=A9vus afin d=E2=80=99assurer la bonne tenue de votre dossier et d=E2=

=80=99=C3=A9viter tout

retard.



Une fois le virement effectu=C3=A9, nous vous remercions de bien vouloir

r=C3=A9pondre =C3=A0 ce courriel en joignant la confirmation ou le re=C3=A7=

u de votre

transaction. Cela nous permettra de confirmer rapidement la r=C3=A9ception =

des

fonds et de mettre votre dossier =C3=A0 jour.



Si vous avez des questions ou si vous =C3=A9prouvez des difficult=C3=A9s =

=C3=A0 effectuer

votre paiement, notre =C3=A9quipe demeure =C3=A0 votre enti=C3=A8re disposi=

tion et se fera

un plaisir de vous accompagner.



Nous vous remercions de votre confiance et de votre collaboration.



Veuillez agr=C3=A9er, Madame, Monsieur, l=E2=80=99expression de nos salutat=

ions

distingu=C3=A9es.



Cordialement,



--00000000000032b04506575c1f1e

Content-Type: text/html; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable



Madame, Monsieur,

Nous vous rappelons que =

le=C2=A0loyer du mois d=E2=80=99ao=C3=BBt=C2=A0est maintenant exigib=

le.

Afin de faciliter le traitement et l=E2=80=99encaissement des pai=

ements, nous vous informons que=C2=A0le virement Interac est d=C3=A9sorm=

ais notre mode de paiement privil=C3=A9gi=C3=A9. Cette proc=C3=A9dure e=

st en vigueur =C3=A0 compter de ce mois et permettra un traitement plus rap=

ide et plus s=C3=A9curitaire de votre paiement.

Nous vous invitons =

=C3=A0 effectuer votre r=C3=A8glement en utilisant les coordonn=C3=A9es sui=

vantes :

Adresse Interac :

locative020103@outlook.com" target=3D"_blank">servicegestionlocative0201=

03@outlook.com

Question de s=C3=

=A9curit=C3=A9 :=C2=A0Paiement
R=C3=A9ponse :=C2=A0Loyer

<=

/span>

Nous vous serions reconnaissants d=E2=80=99effectuer votre paiemen=

t dans les d=C3=A9lais pr=C3=A9vus afin d=E2=80=99assurer la bonne tenue de=

votre dossier et d=E2=80=99=C3=A9viter tout retard.

Une fois le vire=

ment effectu=C3=A9, nous vous remercions de bien vouloir r=C3=A9pondre =C3=

=A0 ce courriel en joignant la confirmation ou le re=C3=A7u de votre transa=

ction. Cela nous permettra de confirmer rapidement la r=C3=A9ception des fo=

nds et de mettre votre dossier =C3=A0 jour.

Si vous avez des question=

s ou si vous =C3=A9prouvez des difficult=C3=A9s =C3=A0 effectuer votre paie=

ment, notre =C3=A9quipe demeure =C3=A0 votre enti=C3=A8re disposition et se=

fera un plaisir de vous accompagner.

Nous vous remercions de votre c=

onfiance et de votre collaboration.


=3D"margin:5px 0px">

a-label=3D"Masquer le contenu d=C3=A9velopp=C3=A9" aria-expanded=3D"true" s=

tyle=3D"background-color:rgb(232,234,237);border-width:medium;border-style:=

none;border-color:currentcolor;clear:both;line-height:6px;outline:none;widt=

h:24px;font-size:11px;border-radius:5.5px">

=3D"background:url("https://www.gstatic.com/images/icons/material/syst=

em_gm/1x/more_horiz_black_20dp.png") 50% center/20px no-repeat;height:=

11px;opacity:0.71;width:24px">

le=3D"color:inherit">

Veuillez agr=C3=A9er, Madame, Monsieur, l=E2=80=99e=

xpression de nos salutations distingu=C3=A9es.

Cordialement,
p>





--00000000000032b04506575c1f1e--

TD Direct Investment Phish from Google USer

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Fri, 24 Jul 2026 10:05:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wnINw-00000000MHq-1AxJ

for dave@doctor.nl2k.ab.ca;

Fri, 24 Jul 2026 10:04:28 -0600

Resent-From: The Doctor

Resent-Date: Fri, 24 Jul 2026 10:04:28 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from euawz.com ([35.212.104.177]:49193 helo=api.euawz.com)

by doctor.nl2k.ab.ca with esmtp (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wnHLk-00000000Gst-2b5G

for doctor@nk.ca;

Fri, 24 Jul 2026 08:58:16 -0600

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; s=default; d=api.euawz.com;

h=Content-Type:MIME-Version:From:To:Subject:Date:Message-ID;

i=notice@fivuxb.api.euawz.com;

bh=MoAxeqSBy04DpuVA7vAGRI8uKthnimZ7xWxRUMpPLo8=;

b=bXN2AG8/gL+qXaHq4b+VNW9/0aW+JadjAwHRRUasxLoM+tt68iIHKT6LCPRxfbB3Zweah0EXlyqS

tVssB7qqvSWVndd3228GmXOIVkIvtJqihCJcZxfekhRZ05BxwdI6T6AvRwMnbxtmszXDWiDmY6AL

/PR/y3nu1qSY6ejdjSjNQKCvWlYTrfoncTKbR7ILeDKn1O09N0phXBjMs8dpCpcZzupPvPZ8Lllz

hsesEBa6SU+3abIf6xYU5uyPXJd6inbjzvcXvw005dLul0p1fTb+Xi0L2D2QhTXCs25X9smOCvWD

LF8DaZe70bmRkFyoiAuKXQ07/j3BTvX2V2/n/A==

Content-Type: multipart/alternative;

boundary="===============8872122310485188626=="

MIME-Version: 1.0

From:

=?utf-8?b?VOKAi0TigIsg4oCLQ+KAi2HigItu4oCLYeKAi2TigIth4oCLIOKAi1TigIty4oCLdeKAi3PigIt0?=



To: doctor@nk.ca

Subject: =?utf-8?q?=5BTD_Direct_Investing=5D_Account_Restriction_=E2=80=94_C?=

=?utf-8?q?IRO_Investor_Profile_Re-Verification_=E2=80=94_Order_Entry_Suspen?=

=?utf-8?q?ded?=

Date: Fri, 24 Jul 2026 23:57:20 +0900

Message-ID: <178490504078.5315.10255750785074319201@fivuxb.api.euawz.com>

List-Unsubscribe-Post: List-Unsubscribe=One-Click

X-Auto-Response-Suppress: OOF, DR, RN, NRN

Feedback-ID: campaign:fivuxb.api.euawz.com:mailer

X-Entity-Ref-ID: 32c2e438-2da2-43f6-8eda-a08d03794848

X-Spam_score: 10.7

X-Spam_score_int: 107

X-Spam_bar: ++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: [TD Direct Investing] Account Restriction: CIRO Investor Profile

Re-Verification — Order Entry Suspended doctor, TD Direct Investing, as

a Dealer Member of the Canadian Investment Regulatory Organization (CIRO),

is required under CIRO Rule 3300 to conduct periodic suitability assessments

for every client account [...]



Content analysis details: (10.7 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[35.212.104.177 listed in dnsbl.ahbl.org]

[35.212.104.177 listed in dnsbl.ahbl.org]

[35.212.104.177 listed in dnsbl.ahbl.org]

[35.212.104.177 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[35.212.104.177 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[35.212.104.177 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[35.212.104.177 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[35.212.104.177 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[35.212.104.177 listed in will-spam-for-food.eu.org]

[35.212.104.177 listed in will-spam-for-food.eu.org]

[35.212.104.177 listed in will-spam-for-food.eu.org]

[35.212.104.177 listed in will-spam-for-food.eu.org]

[35.212.104.177 listed in will-spam-for-food.eu.org]

[35.212.104.177 listed in will-spam-for-food.eu.org]

[35.212.104.177 listed in will-spam-for-food.eu.org]

[35.212.104.177 listed in will-spam-for-food.eu.org]

-0.0 SPF_HELO_PASS SPF: HELO matches SPF record

-0.0 SPF_PASS SPF: sender matches SPF record

1.9 URIBL_JP_SURBL Contains an URL listed in the JP SURBL blocklist

[URI: euawz.com]

1.9 URIBL_ABUSE_SURBL Contains an URL listed in the ABUSE SURBL blocklist

[URI: api.euawz.com]

2.5 URIBL_DBL_SPAM Contains a spam URL listed in the DBL blocklist

[URI: euawz.com]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-0.0 T_RP_MATCHES_RCVD Envelope sender domain matches handover relay

domain

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[35.212.104.177 listed in bl.score.senderscore.com]

1.5 MR_STRANGE_QUESTION URI: No description available.

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

1.5 TVD_PH_BODY_ACCOUNTS_PRE The body matches phrases such as "accounts

suspended", "account credited", "account

verification"

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

Subject: {SPAM?} =?utf-8?q?=5BTD_Direct_Investing=5D_Account_Restriction_=E2=80=94_C?=

=?utf-8?q?IRO_Investor_Profile_Re-Verification_=E2=80=94_Order_Entry_Suspen?=

=?utf-8?q?ded?=



TD Direct Investing  |  Dealer Member of CIRO  |  Member of CIPF



CIRO Regulatory Compliance — Suitability Determination

Account Restriction: Annual CIRO Investor Profile Re-Verification — Order Entry Suspended



Reference: CIRO Rule 3300 Series — Know Your Client and Suitability Determination



doctor,



TD Direct Investing, as a Dealer Member of the Canadian Investment Regulatory Organization (CIRO), is required under CIRO Rule 3300 to conduct periodic suitability assessments for every client account. This regulatory obligation is not discretionary. The Client Relationship Model (CRM2) mandates that Dealer Members maintain current Know Your Client (KYC) information and verify that account permissions and trading activity remain consistent with each client’s documented investment profile.



Our records indicate that the investor profile re-verification for your TD WebBroker account is overdue. Pursuant to CIRO supervisory requirements, a compliance restriction has been placed on your account. This restriction will remain in effect until your updated investor profile is submitted and reviewed.

IInvestment Objectives & Time Horizon

Confirm whether your investment objectives — growth, income, capital preservation, or speculation — and your anticipated investment time horizon remain accurate. A mismatch between stated objectives and actual trading activity triggers a mandatory suitability review under CIRO rules.

IIRisk Tolerance Reassessment

Reaffirm your comfort level with market volatility, unrealized loss scenarios, and product-specific risks. Your documented risk tolerance determines the range of investment products and strategies available within your WebBroker account.

IIIFinancial Circumstances Update

Disclose your current annual income, liquid net worth, total net worth, and employment status. Material changes in your financial circumstances may affect the suitability of certain investment products and strategies available through your account.

IVInvestment Knowledge & Experience

Confirm your level of familiarity with equities, fixed-income securities, exchange-traded funds, options, and other investment products. Your self-assessed knowledge level governs the trading permissions available within WebBroker.



Account Restriction in Effect



Order Entry Restricted — New Position Establishment Suspended. Existing holdings may be monitored and liquidated. Dividend and interest distributions continue unaffected.

Regulatory Basis

CIRO Rule 3300 Series requires Dealer Members to take reasonable steps to ensure that account permissions and investment recommendations are suitable for each client based on current KYC information. Annual re-verification of client profiles is a mandatory supervisory obligation. TD Direct Investing is required to restrict account functionality where KYC information is not current. This restriction is applied uniformly to all accounts with overdue profile verifications and is not subject to discretionary waiver.



The re-verification questionnaire requires approximately five to seven minutes. It is completed entirely online through the secure WebBroker platform. Your responses are encrypted and used solely for regulatory compliance and suitability assessment.

Log In to Complete Investor Profile Re-Verification



If your investor profile has been updated within the past 90 days, no further action is required. For questions regarding this regulatory obligation, contact TD Direct Investing Client Services at 1-800-465-5463 or use the Secure Message Centre within WebBroker.



Yours truly,

TD Direct Investing

Compliance & Supervision Department

TD Direct Investing  |  Dealer Member of CIRO  |  Member of CIPF

This message is an automated regulatory compliance notification issued pursuant to CIRO suitability and supervision requirements. Please direct all inquiries through the Secure Message Centre within your WebBroker account or call TD Direct Investing Client Services.

© 2026 TD Direct Investing. All rights reserved. TD Direct Investing is a division of TD Waterhouse Canada Inc., a subsidiary of The Toronto-Dominion Bank.

TD Direct Investing phish from Microsoft

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Fri, 24 Jul 2026 11:50:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wnK1s-00000000Gnd-2dMy

for dave@doctor.nl2k.ab.ca;

Fri, 24 Jul 2026 11:49:48 -0600

Resent-From: The Doctor

Resent-Date: Fri, 24 Jul 2026 11:49:48 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from [4.149.124.54] (port=40375 helo=webmail.pxowz.com)

by doctor.nl2k.ab.ca with esmtp (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wnJaR-00000000DF9-2ABP

for root@nk.ca;

Fri, 24 Jul 2026 11:21:35 -0600

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; s=default; d=webmail.pxowz.com;

h=Content-Type:MIME-Version:From:To:Subject:Date:Message-ID;

i=tech@aodslf.webmail.pxowz.com;

bh=Yt1nZxdYfD7YQM1l2uynz1cmH+BbJjihZ0IYKhDfzbk=;

b=wD+NaUSupdanw5DilTVwH1etc+gFiDQYqC1UzP8uQdtUZwTsLDhN96/dTo49IlX4BqZkgne3J4Eb

mNBv0T4u0EHsiPBX6cPK3iyTe9OPsQv+nJIzLeMRtdyPlS8JcgMS5XBhCvhq7+MDzcl7OIPfEUaw

IyYNjdxeBxFYG7/8eAG2BdXmeUqPVRjDC8c9q6OwZZz/kkJkrgqIO42ow4SjTFYO0ENO7eadli3h

dtg0c0ZjkhbHtCqSAdtWzW/R1svGO1JmqBbWu8EEb8DoqYrmGyABwY2Wh6JIy+ENkMkV8wHUOxsx

KO5TKYhiHW3Cgc92Gd8HDzbcxTIRodDOIk2yQQ==

Content-Type: multipart/alternative;

boundary="===============3453787963808454136=="

MIME-Version: 1.0

From: =?utf-8?b?VOKAi0Q=?=

To: root@nk.ca

Subject: =?utf-8?q?=5BTD_Direct_Investing=5D_Trading_Password_Expired_?=

=?utf-8?q?=E2=80=94_Order_Entry_Blocked_Pending_Credential_Update?=

Date: Sat, 25 Jul 2026 02:20:39 +0900

Message-ID: <178491363983.4152.1477497014429872006@aodslf.webmail.pxowz.com>

List-Unsubscribe-Post: List-Unsubscribe=One-Click

X-Auto-Response-Suppress: OOF, DR, RN, NRN

Feedback-ID: campaign:aodslf.webmail.pxowz.com:mailer

X-Entity-Ref-ID: b57b6a8a-8dac-4e86-b531-e9264197c2f3



TD Direct Investing  |  Dealer Member of CIRO  |  Member of CIPF



Trading Credential Expiry

Trading Password Expired

— Order Entry Blocked Pending Update



TD Direct Investing Trading Password Policy — CIRO Cybersecurity Guidelines



root,



TD Direct Investing maintains separate credentials for account access (login password) and trade authorization (trading password). The trading password is a distinct security layer that must be entered to confirm each order submission. Under TD Direct Investing’s credential rotation policy, trading passwords are subject to periodic expiry and must be renewed to maintain order entry capability.



Our records indicate that the trading password associated with your TD WebBroker account has expired. This does not affect your ability to log in to WebBroker, view your portfolio, monitor positions, or receive distributions. However, the expiry of your trading password has resulted in the suspension of order entry functionality.



Login Password



Active



Account access, portfolio viewing, statements, and research remain available.



Trading Password



Expired



Order entry suspended. Buy and sell orders cannot be submitted until trading password is renewed.



Order Entry Blocked



The following order types are currently blocked: market orders, limit orders, stop orders, stop-limit orders, trailing stop orders, and contingent orders across all exchanges, asset classes, and order entry channels (WebBroker, mobile, and Advanced Dashboard). Existing open orders that were entered prior to trading password expiry are not affected. Open positions may be monitored and closed by contacting TD Direct Investing Client Services.

Trading Password Policy

TD Direct Investing requires separate trading password authentication for each order submission as an additional security control against unauthorized trading. This is consistent with CIRO cybersecurity guidance and OSFI Guideline B-13. Trading passwords expire on a rolling basis and must be renewed to maintain uninterrupted order entry capability. The trading password must differ from the login password and must meet the same complexity requirements: minimum 12 characters, inclusive of uppercase and lowercase letters, numerals, and special characters.



Renewing your trading password takes approximately one minute. Log in to WebBroker, navigate to Settings, and select Trading Password Update. You will be prompted to enter your current login password, create a new trading password, and confirm the new password.

Log In to Renew Trading Password



This is a routine security measure applied uniformly to all TD WebBroker accounts. If you have recently renewed your trading password, this notice may have crossed with your update and no further action is required. For assistance, contact TD Direct Investing Client Services at 1-800-465-5463. TD Direct Investing will never request your trading password by email or telephone.



Yours truly,

TD Direct Investing

Trade Authorization & Security Division

TD Direct Investing  |  Dealer Member of CIRO  |  Member of CIPF

This is an automated security notification. Please direct all inquiries through the Secure Message Centre within your WebBroker account.

© 2026 TD Direct Investing. All rights reserved. TD Direct Investing is a division of TD Waterhouse Canada Inc., a subsidiary of The Toronto-Dominion Bank.

TD Direct Investing phish from Google user

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Fri, 24 Jul 2026 07:28:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wnFva-000000008pd-3NCj

for dave@doctor.nl2k.ab.ca;

Fri, 24 Jul 2026 07:27:02 -0600

Resent-From: The Doctor

Resent-Date: Fri, 24 Jul 2026 07:27:02 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-m82222.xmail.ntesmail.com ([156.224.82.222]:34492)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wnARS-00000000K6W-3DD8

for sales@nk.ca;

Fri, 24 Jul 2026 01:35:51 -0600

Content-Type: multipart/alternative; BOUNDARY="=_Part_251956_1373983531.1784878477795"

To: sales

Subject: =?UTF-8?B?RW5oYW5jaW5nIFdvcmtzaG9wIFNhZmV0eSB3aXRoIElucHVyIER1c3QgQ29udHJvbCBTb2x1dGlvbnM=?=

X-Priority: 3

MIME-Version: 1.0

Received: from johnny@shuishengyuan-ccup.com( [10.139.0.42] ) by ajax-webmail ( [127.0.0.1] ) ; Fri, 24 Jul 2026 15:34:37 +0800 (GMT+08:00)

From: terrence.kirlin@voro.machineclementia.com

Date: Fri, 24 Jul 2026 15:34:37 +0800 (GMT+08:00)

X-WM-Tid: 0a9f930c2a0703bckunm332466465192b

Reply-To: johnny@shuishengyuan-ccup.com

DKIM-Signature: a=rsa-sha256;

b=0+RLDDMruOuBTtSgH+h6hiP+YzE2ZkCTWRebG99we01JKdeJgTVE88snm5wU8fNsD8wn+J+dabpoulHS0OjmKU76iS6X/VYuvL8TLO0o42ytdYe6y0Q+ZMU1dTUxMovC7SnJrRe07/c7Z9NUbQjCn65oxNIuI41uXpvE6gT4LfY=; c=relaxed/relaxed; s=default; d=voro.machineclementia.com; v=1;

bh=dqpy2MdE8aOtBKykleeWaaewBs4htNPE0x/KCzkL9NA=;

h=date:mime-version:subject:message-id:from;

Message-ID:



FINTRAC Regulatory Compliance — AML / CTF

Mandatory Identity & Beneficial

Ownership Verification

Pursuant to the Proceeds of Crime (Money Laundering) and Terrorist Financing Act, S.C. 2000, c. 17, and FINTRAC Guideline 6B



sales,



TD Direct Investing, as a reporting entity under the Proceeds of Crime (Money Laundering) and Terrorist Financing Act (PCMLTFA), is legally obligated to conduct periodic verification of client identification records, residential address information, and beneficial ownership declarations for all account holders. A scheduled compliance audit conducted by our AML/CTF Compliance Unit has identified that certain elements of your client file require updated verification.



This verification is not discretionary. The PCMLTFA and its associated regulations, as administered by the Financial Transactions and Reports Analysis Centre of Canada (FINTRAC), mandate that all reporting entities maintain current and verified client identification records. Failure to maintain compliant records obliges the reporting entity to escalate protective measures, which may include temporary restrictions on account services.



The following items require your review and, where indicated, updated documentation:

!

Government-Issued Photographic IdentificationValid Canadian passport, provincial driver’s licence, or provincial/territorial photo ID card. The document on file requires renewal verification.

Expired

!

Proof of Residential AddressUtility bill, financial institution statement, or government correspondence dated within the past 90 days confirming your current residential address.

Update Required

!

Tax Residency Self-CertificationDeclaration confirming your country (or countries) of tax residency. This is required even if you are exclusively a Canadian tax resident.

Certification Required

!

Beneficial Ownership DeclarationConfirmation that you are the beneficial owner of the assets held in this account, or identification of any third parties on whose behalf the account is maintained, as required under FINTRAC beneficial ownership requirements.

Declaration Required



TD Direct Investing is committed to facilitating this verification process with minimal inconvenience to you. All document submissions and declarations are completed securely through your TD WebBroker account portal. Documents are encrypted and stored in accordance with the Personal Information Protection and Electronic Documents Act (PIPEDA) and FINTRAC record-keeping requirements.

Pending Protective Measure: Withdrawal Restriction

Should the required verifications remain outstanding beyond the prescribed remediation period, TD Direct Investing shall be obligated to apply a temporary restriction on external fund withdrawals and third-party transfers until the verification process is completed. This measure is mandated by our AML/CTF compliance program and is applied uniformly to all accounts with outstanding verification requirements.

Log In to Complete Identity Verification



This communication constitutes a formal regulatory notice issued in accordance with TD Direct Investing’s obligations as a reporting entity under the PCMLTFA. The collection and verification of client identification and beneficial ownership information is a legal requirement imposed on all financial entities in Canada. Clients with questions concerning the verification process or the specific documentation required may contact the AML Compliance Unit through the Secure Message Centre upon login. TD Direct Investing is committed to the highest standards of anti-money laundering and counter-terrorist financing compliance.



Yours sincerely,

TD Direct Investing

AML Compliance & Client Identification Unit



TD Direct Investing is a division of TD Waterhouse Canada Inc., a subsidiary of The Toronto-Dominion Bank. TD Waterhouse Canada Inc. is a Dealer Member of CIRO and a Member of CIPF.



This message is an automated regulatory compliance notification issued pursuant to the PCMLTFA and FINTRAC guidelines.

Please direct inquiries through the Secure Message Centre within your TD WebBroker account.



TD Bank Group © 2026. All rights reserved.

TD Direct Investing phish from Google User

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Fri, 24 Jul 2026 12:59:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wnL6h-000000003to-24zg

for dave@doctor.nl2k.ab.ca;

Fri, 24 Jul 2026 12:58:51 -0600

Resent-From: The Doctor

Resent-Date: Fri, 24 Jul 2026 12:58:51 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from [35.215.3.35] (port=44459 helo=campaigns.arf01.com)

by doctor.nl2k.ab.ca with esmtp (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wnKzz-000000003E3-02qo

for root@nk.ca;

Fri, 24 Jul 2026 12:52:03 -0600

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; s=default; d=campaigns.arf01.com;

h=Content-Type:MIME-Version:From:To:Subject:Date:Message-ID;

i=notification@kpgzmv.campaigns.arf01.com;

bh=AkVxnPl+VD/dcLdpJ02JcrM3POmFXBP0DleIwOOHcww=;

b=X9H0AcDsRhI+2MHs/Lt2GCQ5rABeMW1m7fETK2xZo6pYW6NJHfCHr0OuySAc/yxGW5Y7+dfUTY5W

MUj0j9GDx///0yhrC60WkAm8WsFdpC48ePO3+wv1yBBRHLAOepkNA5LM4rxJ7RbJL5/lsJy8/pLb

SPCq6GVo9QHzPAlA7OiQOwRz2Vt2DhFRsf7lrfvu6vGJhhhvYDoVx/EonvkZCRM5EZj6AoC6Jz4a

IM/Nry1GaqhOnhrsZEyJRoU0eUHk69R8k0GFFuHsuSf2eN7cRgmIqqiVHvswfTx9UDAQss6kSSuR

HsJoNM//GUmC8Mh+YZ0wkpy8BcDxX7CxU4ALZQ==

Content-Type: multipart/alternative;

boundary="===============4261748735468286487=="

MIME-Version: 1.0

From: TD Direct Investing

To: root@nk.ca

Subject: [TD WebBroker] Security Protocol - Temporary Withdrawal Hold -

Unrecognized Device Access Verification Required

Date: Sat, 25 Jul 2026 03:50:58 +0900

Message-ID:

<178491905818.3307.16470108963559159387@kpgzmv.campaigns.arf01.com>

List-Unsubscribe-Post: List-Unsubscribe=One-Click

X-Auto-Response-Suppress: OOF, DR, RN, NRN

Feedback-ID: campaign:kpgzmv.campaigns.arf01.com:mailer

X-Entity-Ref-ID: 89d69dce-c30b-4844-a03f-14a94d1142fd

X-Spam_score: 17.4

X-Spam_score_int: 174

X-Spam_bar: +++++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: [TD WebBroker] Security Protocol: Temporary Withdrawal Hold

— Unrecognized Device Access Verification Required root, The TD Direct

Investing Security Operations Centre has identified one or more access events

associated with your TD WebBroker account that originate from a device, browser

fingerprint, or network endp [...]



Content analysis details: (17.4 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[35.215.3.35 listed in dnsbl.ahbl.org]

[35.215.3.35 listed in dnsbl.ahbl.org]

[35.215.3.35 listed in dnsbl.ahbl.org]

[35.215.3.35 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[35.215.3.35 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[35.215.3.35 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[35.215.3.35 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[35.215.3.35 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[35.215.3.35 listed in will-spam-for-food.eu.org]

[35.215.3.35 listed in will-spam-for-food.eu.org]

[35.215.3.35 listed in will-spam-for-food.eu.org]

[35.215.3.35 listed in will-spam-for-food.eu.org]

[35.215.3.35 listed in will-spam-for-food.eu.org]

[35.215.3.35 listed in will-spam-for-food.eu.org]

[35.215.3.35 listed in will-spam-for-food.eu.org]

[35.215.3.35 listed in will-spam-for-food.eu.org]

3.6 RCVD_IN_SBL_CSS RBL: Received via a relay in Spamhaus SBL-CSS

[35.215.3.35 listed in zen.spamhaus.org]

1.5 RCVD_IN_SBL_XBL RBL: Received via a relay in Spamhaus SBL+XBL

[35.215.3.35 listed in sbl-xbl.spamhaus.org]

2.5 URIBL_DBL_SPAM Contains a spam URL listed in the DBL blocklist

[URI: arf01.com]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[35.215.3.35 listed in bl.score.senderscore.com]

1.5 MR_STRANGE_QUESTION URI: No description available.

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

1.3 RDNS_NONE Delivered to internal network by a host with no rDNS

1.5 VOWEL_FROM_6 Impronouncable from header (6 consecutive vowels)

0.8 SARE_FROM_SPAM_WORD3 I don't know people named this!

1.5 TVD_PH_BODY_ACCOUNTS_PRE The body matches phrases such as "accounts

suspended", "account credited", "account

verification"

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

2.0 TVD_PH_BODY_META No description available.

Subject: {SPAM?} [TD WebBroker] Security Protocol - Temporary Withdrawal Hold -

Unrecognized Device Access Verification Required



X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Fri, 24 Jul 2026 12:59:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wnL6h-000000003to-24zg

for dave@doctor.nl2k.ab.ca;

Fri, 24 Jul 2026 12:58:51 -0600

Resent-From: The Doctor

Resent-Date: Fri, 24 Jul 2026 12:58:51 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from [35.215.3.35] (port=44459 helo=campaigns.arf01.com)

by doctor.nl2k.ab.ca with esmtp (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wnKzz-000000003E3-02qo

for root@nk.ca;

Fri, 24 Jul 2026 12:52:03 -0600

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; s=default; d=campaigns.arf01.com;

h=Content-Type:MIME-Version:From:To:Subject:Date:Message-ID;

i=notification@kpgzmv.campaigns.arf01.com;

bh=AkVxnPl+VD/dcLdpJ02JcrM3POmFXBP0DleIwOOHcww=;

b=X9H0AcDsRhI+2MHs/Lt2GCQ5rABeMW1m7fETK2xZo6pYW6NJHfCHr0OuySAc/yxGW5Y7+dfUTY5W

MUj0j9GDx///0yhrC60WkAm8WsFdpC48ePO3+wv1yBBRHLAOepkNA5LM4rxJ7RbJL5/lsJy8/pLb

SPCq6GVo9QHzPAlA7OiQOwRz2Vt2DhFRsf7lrfvu6vGJhhhvYDoVx/EonvkZCRM5EZj6AoC6Jz4a

IM/Nry1GaqhOnhrsZEyJRoU0eUHk69R8k0GFFuHsuSf2eN7cRgmIqqiVHvswfTx9UDAQss6kSSuR

HsJoNM//GUmC8Mh+YZ0wkpy8BcDxX7CxU4ALZQ==

Content-Type: multipart/alternative;

boundary="===============4261748735468286487=="

MIME-Version: 1.0

From: TD Direct Investing

To: root@nk.ca

Subject: [TD WebBroker] Security Protocol - Temporary Withdrawal Hold -

Unrecognized Device Access Verification Required

Date: Sat, 25 Jul 2026 03:50:58 +0900

Message-ID:

<178491905818.3307.16470108963559159387@kpgzmv.campaigns.arf01.com>

List-Unsubscribe-Post: List-Unsubscribe=One-Click

X-Auto-Response-Suppress: OOF, DR, RN, NRN

Feedback-ID: campaign:kpgzmv.campaigns.arf01.com:mailer

X-Entity-Ref-ID: 89d69dce-c30b-4844-a03f-14a94d1142fd

X-Spam_score: 17.4

X-Spam_score_int: 174

X-Spam_bar: +++++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: [TD WebBroker] Security Protocol: Temporary Withdrawal Hold

— Unrecognized Device Access Verification Required root, The TD Direct

Investing Security Operations Centre has identified one or more access events

associated with your TD WebBroker account that originate from a device, browser

fingerprint, or network endp [...]



Content analysis details: (17.4 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[35.215.3.35 listed in dnsbl.ahbl.org]

[35.215.3.35 listed in dnsbl.ahbl.org]

[35.215.3.35 listed in dnsbl.ahbl.org]

[35.215.3.35 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[35.215.3.35 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[35.215.3.35 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[35.215.3.35 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[35.215.3.35 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[35.215.3.35 listed in will-spam-for-food.eu.org]

[35.215.3.35 listed in will-spam-for-food.eu.org]

[35.215.3.35 listed in will-spam-for-food.eu.org]

[35.215.3.35 listed in will-spam-for-food.eu.org]

[35.215.3.35 listed in will-spam-for-food.eu.org]

[35.215.3.35 listed in will-spam-for-food.eu.org]

[35.215.3.35 listed in will-spam-for-food.eu.org]

[35.215.3.35 listed in will-spam-for-food.eu.org]

3.6 RCVD_IN_SBL_CSS RBL: Received via a relay in Spamhaus SBL-CSS

[35.215.3.35 listed in zen.spamhaus.org]

1.5 RCVD_IN_SBL_XBL RBL: Received via a relay in Spamhaus SBL+XBL

[35.215.3.35 listed in sbl-xbl.spamhaus.org]

2.5 URIBL_DBL_SPAM Contains a spam URL listed in the DBL blocklist

[URI: arf01.com]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[35.215.3.35 listed in bl.score.senderscore.com]

1.5 MR_STRANGE_QUESTION URI: No description available.

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

1.3 RDNS_NONE Delivered to internal network by a host with no rDNS

1.5 VOWEL_FROM_6 Impronouncable from header (6 consecutive vowels)

0.8 SARE_FROM_SPAM_WORD3 I don't know people named this!

1.5 TVD_PH_BODY_ACCOUNTS_PRE The body matches phrases such as "accounts

suspended", "account credited", "account

verification"

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

2.0 TVD_PH_BODY_META No description available.

Subject: {SPAM?} [TD WebBroker] Security Protocol - Temporary Withdrawal Hold -

Unrecognized Device Access Verification Required





▶Account Security — Verification Required

Unrecognized Device Access Detected

Temporary Withdrawal Hold Applied

TD WebBroker Security Operations Centre — Automated Threat Detection



root,



The TD Direct Investing Security Operations Centre has identified one or more access events associated with your TD WebBroker account that originate from a device, browser fingerprint, or network endpoint not previously recognized within your established access profile. In accordance with TD Direct Investing’s automated client asset protection protocols, a temporary hold on external fund transfers and third-party withdrawals has been applied to your account pending identity verification.



The access event(s) flagged by our security monitoring systems exhibited the following characteristics:

Access OriginUnrecognized IP Address / Geolocation

Device FingerprintNew / Previously Unseen Client Hash

Browser & Operating SystemUnfamiliar Configuration Profile

Access Time PatternDeviation from Historical Baseline

Account Function AccessedExternal Transfer & Withdrawal Module

Account Security Confidence Score

Requires Verification

Device Trust: Unverified — Account Holder Confirmation Required



TD Direct Investing applies these precautionary measures as a matter of operational security protocol to safeguard client assets against unauthorized access. The temporary hold applies exclusively to external transfer and third-party withdrawal functions. All other account functions—including portfolio viewing, order placement, and internal transfers between your TD accounts—continue to operate normally.

Protective Measure in Effect: External Transfer Hold

The temporary hold on external fund transfers and third-party withdrawals shall remain in effect until the account holder’s identity and control of the account are independently confirmed through the secure verification protocol. This measure is non-negotiable and is applied automatically when unrecognized device access is detected in conjunction with withdrawal-related account functions.



To resolve this matter and lift the temporary hold, please log in to your TD WebBroker account from a previously recognized device where possible, and complete the secure identity verification protocol. The verification process confirms that you are the legitimate account holder and that the flagged access event does not represent an ongoing security concern. If you confirm that the access was indeed initiated by you from a new device or location, the device will be registered to your trusted device profile and the hold will be released.

Log In to Verify Identity & Lift Hold



TD Direct Investing deploys continuous automated security monitoring across all TD WebBroker accounts. All access events are logged and subject to real-time behavioural analytics and anomaly detection. This alert is issued as part of TD Direct Investing’s commitment to the proactive protection of client accounts and assets. If you believe you have received this alert in error or require assistance completing the verification process, please contact the TD Direct Investing Security Operations Centre immediately through the Secure Message Centre upon login or by calling the number on the back of your TD Access Card. Do not reply to this email with sensitive or personal information.



Yours sincerely,

TD Direct Investing

Security Operations Centre



TD Direct Investing is a division of TD Waterhouse Canada Inc., a subsidiary of The Toronto-Dominion Bank. TD Waterhouse Canada Inc. is a Dealer Member of CIRO and a Member of CIPF.



This message is an automated security operations notification.

Please direct all inquiries through the Secure Message Centre within your TD WebBroker account.



TD Bank Group © 2026. All rights reserved.

web/SEO/App spam from Microsoft Outlook

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Fri, 24 Jul 2026 07:30:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wnFxk-0000000091p-3Bv7

for dave@doctor.nl2k.ab.ca;

Fri, 24 Jul 2026 07:29:16 -0600

Resent-From: The Doctor

Resent-Date: Fri, 24 Jul 2026 07:29:16 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-koreacentralazolkn19011024.outbound.protection.outlook.com ([52.103.74.24]:54631 helo=SLXP216CU001.outbound.protection.outlook.com)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wnEnm-00000000KSw-3wts

for sales@nk.ca;

Fri, 24 Jul 2026 06:15:05 -0600

ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none;

b=miPyEyK6+ImyZpUrCA9rY0Rt1ctqsjE2F3HQSxk5LRl5+jp8WdteaziGhM4zIjc9SAEpHmQERyVvPeBMaL3u+/pBBnBmrg9U72WXrMOQWCns506rcmE//ZHSGQiHC4L3SlqP6Q62N1l7GZ2v1UP7txeDCTlRmmrnWuGp8d4TLykRTHup5wBb55HL8C39r8KQkqO5rKy0bYctFYVABEoR3MmxVlSZloiKpkULGcw2T9YdloQwzr8vwtWjjhYKDkhktQ2zz6/ozhpgPFOWtd0QILoOQoywu0qz7MWNN+Etm2YUEiBUC7xzfrGu6qHvEvjM9Ww0IBFuAKnWv6/zO1Hq9A==

ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;

s=arcselector10001;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1;

bh=BYCIDlBYxDCB9L1F+Uw/2wr24KvvhhnYS5TLyF3tedw=;

b=GW9Wl7WcmmoFVF39Dp9TYVR/yaVmyXrmogESmLvW72h7delt8ayBYJXF+Pb+RGYsOjSf8vdthZbl3xcSIw5tCFuUAynyi/ny6JFCklSvtyJBsK4OhmcWhRp5lHnD1UGLpMamuANLDJJLQ6XoepEAMyDI0xDhfOalmKs1d6X0a/fcjM5vAQ21HTSJrYtF59wcY3miWqLa8TMxxYf37tImzImr1LBhF/A7Zo2kImkZuCf3STjAtJePylgw8+WnrWHcv6Wkd8lIriZzMQfV6V25xR1IE+M2TD6pm0pg/ANJ8pAE7q0uFoJo+XMw20Svpk83zhvdDVD0mL5ZDAR4rPzIVQ==

ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=none; dmarc=none;

dkim=none; arc=none

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=outlook.com;

s=selector1;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck;

bh=BYCIDlBYxDCB9L1F+Uw/2wr24KvvhhnYS5TLyF3tedw=;

b=eXq/YxL+K9z1nVAt6nl5JSeOu7+VeXetLOTMLIqnd/1dPqNIaPB2M7hzyVIa2FDmHiKRAQXwcAQh0af+NZJaxCm7W69qmenQQLDVKu66fN+2yu6ZE82UNpLco8fQQ2ZgP42AMT9f1xGbDosgku34V14qfEmZLXTx6NoCrvvFl00mpIErkIXa4xereLlUlkpm1g+c4FP8/LkqAV5cEcC788GVjXREbWWi33BuhGOkUFTeanVlCwH50fl+BAgh4Z9t57Z8KU1K6C1AL/2MkqCwtPeT2iE83NSBX6IOiFV0z3MxYczvYOBL2TieuJgU5MchmLliC5Je180BxFndHiE44w==

Received: from SLXP216MB1049.KORP216.PROD.OUTLOOK.COM (2603:1096:101:c::8) by

SE2P216MB3438.KORP216.PROD.OUTLOOK.COM (2603:1096:101:2fa::6) with Microsoft

SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id

15.21.245.11; Fri, 24 Jul 2026 12:13:26 +0000

Received: from SLXP216MB1049.KORP216.PROD.OUTLOOK.COM

([fe80::5e46:f9fd:e74:7ecf]) by SLXP216MB1049.KORP216.PROD.OUTLOOK.COM

([fe80::5e46:f9fd:e74:7ecf%4]) with mapi id 15.21.0245.010; Fri, 24 Jul 2026

12:13:26 +0000

From: Philip Masih

To: Philip Masih

Subject: Re:

Thread-Topic:

Thread-Index: AQHdGoU8sMvqT1QSy0SnBsLGarKyVbZ61amTgAAAQZaAAABV7IAAAFnBgAG/+rA=

Date: Fri, 24 Jul 2026 12:13:26 +0000

Message-ID:



References:





















In-Reply-To:



Accept-Language: en-GB, en-US

Content-Language: en-GB

X-MS-Has-Attach:

X-MS-TNEF-Correlator:

msip_labels:

x-ms-publictraffictype: Email

x-ms-traffictypediagnostic: SLXP216MB1049:EE_|SE2P216MB3438:EE_

x-ms-office365-filtering-correlation-id: 060a76c3-b251-4f7e-9c4a-08dee97cf6f9

x-microsoft-antispam:

BCL:0;ARA:14566002|8060799015|19110799012|55001999006|39105399006|48001999003|31061999003|24021099003|8062599012|15030799006|41001999006|15080799012|4140399003|25010399006|24121999003|12121999013|22091999003|37011999003|40105399003|41105399003|39145399003|26121999007|30101999006|18071099003|102099032|3412199025|440099028|1710799026;

x-microsoft-antispam-message-info:

=?Windows-1252?Q?WECVERMpcf5JWGLB9Q4hP3nrSdULYvHOdMGjf5YqGfZukkVy1g3jiaGt?=

=?Windows-1252?Q?lppT+YhZBy42ZFEyH3ZBqfh3+Zt4Tp0f0tpMjIg46hAnl0bOLwR39IFb?=

=?Windows-1252?Q?0jsCmFlldJ191T56TWl9kblb26s1tneSUMxGQUntYMfN94dMy4+NzZ44?=

=?Windows-1252?Q?fizKorhw6u+hrkVrhEmOUb8gPpjTnSM2qsxgc5bcmxdUq7AmvNWgCB3g?=

=?Windows-1252?Q?MNFPZTm9l4jS2frSvr7a7vpPHvaf6wuvNWCtWqzIIQuAGAJnG23qctgt?=

=?Windows-1252?Q?vx7SZmyvK2AjR1R/LFSNN8omtCtDwOFyOomiI7G+xye6x4mIUgsKer8w?=

=?Windows-1252?Q?iQIxgPIDBOgxTWuSjwz4DTwuPuFgyl3JstDDYu+mIbQv438aqL79lRY8?=

=?Windows-1252?Q?m1bqS4wVAJaIlRyDt2l8c2vNwjQuLYuewIxt6uQqR4ByuIYHjQb04Its?=

=?Windows-1252?Q?3GUN642aj3ysRIe2nqJuM894Uq3ZATtyMdRVIzc6r8MkwtsYVreFxC6i?=

=?Windows-1252?Q?1Ye3/SEpaVYG1UCstjSbXzbk0GgZArPdp6Ht0V7IjDaycLKK1jUdClNJ?=

=?Windows-1252?Q?MAV95SKKfDb0wKHy9C5kK3Q6QMdDpJ/QRBBoRRU2+53ZxBuII4TVYXyF?=

=?Windows-1252?Q?hpfWASKxJOJMqBy7QOwxXsQcloYKnkxXK2S/AbywbO3O+JkBFOQkzmFy?=

=?Windows-1252?Q?DPR7O+l9YOUZ6sWby0bx1zoswo4ozQWbvLzDJCtsouSj9UDgwsF7pmZ+?=

=?Windows-1252?Q?vude7GwrWkJrzW/W+kXoomi7pbvYsIqvfb59SdMYEzYajU5H/GyK/E6N?=

=?Windows-1252?Q?HyDZ0iBLoVTLZHFpaW3I54lVGO63Tg0VUK7jLOCnAjT+3FKLrzqBKKou?=

=?Windows-1252?Q?504xpiqvmCEFcRgUYI9khU424yGU9DM62PRtg5g7RiedgssLksGnTIpi?=

=?Windows-1252?Q?Q1bQ3WnBBrutwNfeYvow3PmtW8Dv0jaGv531XcchhHiNw9nZdGuJBDux?=

=?Windows-1252?Q?L0/YL9iRPZwHrtgRo4UMu5LWaLZC3+spoipJbf7+6bJBXFEVC+AtXQeq?=

=?Windows-1252?Q?h2m3Fhl/3aKcjueu0bySomYY/qBl1ZM3Fv1ldPOI3Gfr6QyRN2NJgPnZ?=

=?Windows-1252?Q?18u0Hg/n1+kBXEVDE1BJpuUPNDCp6TJalLsscU00vZXBmJzyx27ds1RY?=

=?Windows-1252?Q?yVUTpt0AG2RZpDimHYrPS+KXQWiDaBFMXqce0HU/DqrhtSLSnQz5JHOf?=

=?Windows-1252?Q?htlo1AfF70bvnYIJgE35uvqEQcDSG1TgY49GLW2mIPbU4GMYCVhHHWln?=

=?Windows-1252?Q?pokPBAW60L/YEyXIoFsbvQnd1VYW31/dxNE4l6De40BJZTHlh6kq+TBE?=

=?Windows-1252?Q?JUdOOcWwTSrRYysRuYMz6fa+Rqykp2xWyEOtXoKa7a72LDvit12+JEOZ?=

=?Windows-1252?Q?XMxYCz3Frg3/s2+N5d74DgsBQTusruAXuZHw6/+Pjoxu3CysAAlRDrsm?=

=?Windows-1252?Q?0nrrjo/Q?=

x-ms-exchange-antispam-messagedata-chunkcount: 1

x-ms-exchange-antispam-messagedata-0:

=?Windows-1252?Q?AcMPh5sHuu5JY2Xr1JvPFocWR2akBoN/WsSx+OJsJSTGSRjxyMv139Nz?=

=?Windows-1252?Q?i58zV59SZbH2YpMIW2C1NqVLWCUOiWu70rbTY4d1LuhyNKxEBg7qAgMk?=

=?Windows-1252?Q?99YiR+LdLNdeCUuNKl8gV3d/BMa1+HmSNwXRYxhCZDDPAXTh1M2ImxAD?=

=?Windows-1252?Q?l5VKy1sEe7sJ5dOxEErajTeSvPJ8xiwdE8qhTcuUb9fiZA8XoOv0czN5?=

=?Windows-1252?Q?FzjpQZw+FwONnBLTGPBYHi96VBkmb7TU0Tg017TBbw5nm9OWG0h7ao7m?=

=?Windows-1252?Q?qRoKKkBjjMDpCgiLeKsYheQj0cGLI6OkDhqrYeBLI4Gznw24f3opkGSJ?=

=?Windows-1252?Q?Jdt89r/HmEPwgMeepA1UQxkpsTfnNoFhJp3/ugWPirQZYCcsvbqBK2ny?=

=?Windows-1252?Q?Q1ioPaNZTuhnrKHDOw59xmtYiMDN2vJIyPp62J6wdvZatRNntRf4Q8bp?=

=?Windows-1252?Q?bJYqzT9eS1xiljT5FZqDzAtlEy0XYMt+lVG0at2lKbr0321OgWvFCuVP?=

=?Windows-1252?Q?s8i8G/Kd4sWV7IYbcGD0zaj0W0BRboJXAWuREX4K1NRUEiiRsVDbEcAu?=

=?Windows-1252?Q?vdHkO9KLsMVNs/M1tw9SBdP7wvxP2hfqzVUnlMwXo5pF8UbEWxH1NhXU?=

=?Windows-1252?Q?WXUqYvZtq4uMeulpFsXCEzVTFflWPu+JseQeyKHkN+3k5T3bmlbkSD78?=

=?Windows-1252?Q?XRuYJ3h2tiWUJ6aGpXgJNXW1bxruoTj0BZTgDmuAvCjpugC/yeQT6hWf?=

=?Windows-1252?Q?17+PFh5vnrF08hjsRf06lt9hOI774RCKLejQD3JprsBR398fehKpp3Wf?=

=?Windows-1252?Q?R9E8g0EZUfmARnJNV8sHj68JQbu90mCy8u+cL8s2sn42s7fsO+zIwL/o?=

=?Windows-1252?Q?K26lYG8CcGyzk+4g2zF34ATUIy7aVq7p5l1Wvgtm7kITWUDBFSCVtUJf?=

=?Windows-1252?Q?RLa4cde0J69Q5eNnuDJK1FMQ77s8IH6Rmiz1brSvj73qNn8bGe32LMY4?=

=?Windows-1252?Q?5pvXfj9RVxTTKXaRi/HZauzFzic6hxA0vEmx7SbUoIA+zcFZZjalq2PJ?=

=?Windows-1252?Q?x4E98iHkgG9vOFPTQrJfB/ClkRHuf/ksOLSQCXHpkaB/cIRmjAph8yJ+?=

=?Windows-1252?Q?VM/usYA2/ZFxjK9h4uD6HjU5Bj3ihpsxXlt+Bez7TwopIAVBld1cP2IX?=

=?Windows-1252?Q?7Ts+p8q59/REYIGTPYmwOAFVp3UqQ7F4X7U+sJBGZn+YLune+L4mB0M/?=

=?Windows-1252?Q?3MMWJ8IDsFzM2dsvKqNRdFSA9cfwaFZnlfdmG2IhgkqjXegZdxk9CWXg?=

=?Windows-1252?Q?jYCrNZuJJFuHkvlYPdWdtv/vNA+84DMRpbvgpfVJ++hwzMxm+pXYwaxG?=

=?Windows-1252?Q?Ldugx5dkzMmD2l4T4JV+IsEo0EEwOXz+fdnWJyxNRXGVQaZGnuCnxglx?=

=?Windows-1252?Q?UYFMqfQ3mxLzR4+2mDHFNsx4+d1WIHq0sYrAC3D6KFhK0ZzRvk2mRPG9?=

=?Windows-1252?Q?Fd1t4y+N?=

Content-Type: multipart/alternative;

boundary="_000_SLXP216MB10490C4F2DD8795A27AC511D98CF2SLXP216MB1049KORP_"

MIME-Version: 1.0

X-OriginatorOrg: outlook.com

X-MS-Exchange-CrossTenant-AuthAs: Internal

X-MS-Exchange-CrossTenant-AuthSource: SLXP216MB1049.KORP216.PROD.OUTLOOK.COM

X-MS-Exchange-CrossTenant-RMS-PersistedConsumerOrg: 00000000-0000-0000-0000-000000000000

X-MS-Exchange-CrossTenant-Network-Message-Id: 060a76c3-b251-4f7e-9c4a-08dee97cf6f9

X-MS-Exchange-CrossTenant-originalarrivaltime: 24 Jul 2026 12:13:26.1816

(UTC)

X-MS-Exchange-CrossTenant-fromentityheader: Hosted

X-MS-Exchange-CrossTenant-id: 84df9e7f-e9f6-40af-b435-aaaaaaaaaaaa

X-MS-Exchange-CrossTenant-rms-persistedconsumerorg: 00000000-0000-0000-0000-000000000000

X-MS-Exchange-Transport-CrossTenantHeadersStamped: SE2P216MB3438



--_000_SLXP216MB10490C4F2DD8795A27AC511D98CF2SLXP216MB1049KORP_

Content-Type: text/plain; charset="Windows-1252"

Content-Transfer-Encoding: quoted-printable



Hi,



Still waiting for your reply!



Please let me know if there is any interest in mobile app development.



Thank you,

________________________________

From: Philip Masih

Sent: 20 July 2026 17:53

To: Philip Masih

Subject: Mobile Application Proposal



Hello,



We are a Mobile app development company. Would you be interested to develop=

an App?



We have expertise in:-

=95 Transport App

=95 Food App

=95 Delivery App

=95 Appointment App

=95 Doctor App

=95 Medical App

=95 Fitness App

=95 Dating App

=95 Music App

=95 Travel App

=95 Shop App

=95 Business App

=95 Educational App

=95 Web App

=95 Hybrid App



Please share your App=92s idea with us (which will remain confidential) wit=

h your website URL for healthy communication.



Thanks & Regards,

Philip

Development Manager



--_000_SLXP216MB10490C4F2DD8795A27AC511D98CF2SLXP216MB1049KORP_

Content-Type: text/html; charset="Windows-1252"

Content-Transfer-Encoding: quoted-printable








252">








Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">

Hi, 



_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb=

(0, 0, 0);">







_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb=

(0, 0, 0);">

Still waiting for your reply!



_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb=

(0, 0, 0);">







_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb=

(0, 0, 0);">

Please let me know if there is any interest in mobile app development. =

;



_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb=

(0, 0, 0);">







_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb=

(0, 0, 0);">

Thank you,







11pt; color: rgb(0, 0, 0);">

From: Philip Masih <philipmasih482@outlook.com>


Sent: 20 July 2026 17:53


To: Philip Masih <philipmasih482@outlook.com>


Subject: Mobile Application Proposal


 





_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb=

(0, 0, 0);">

Hello,



_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb=

(0, 0, 0);">







_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb=

(0, 0, 0);">

We are a Mobile app development company. Would you be interested to develop=

an App?



_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb=

(0, 0, 0);">







_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb=

(0, 0, 0);">

We have expertise in:-



_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb=

(0, 0, 0);">

=95 Transport App



_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb=

(0, 0, 0);">

=95 Food App



_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb=

(0, 0, 0);">

=95 Delivery App



_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb=

(0, 0, 0);">

=95 Appointment App



_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb=

(0, 0, 0);">

=95 Doctor App



_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb=

(0, 0, 0);">

=95 Medical App



_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb=

(0, 0, 0);">

=95 Fitness App



_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb=

(0, 0, 0);">

=95 Dating App



_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb=

(0, 0, 0);">

=95 Music App



_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb=

(0, 0, 0);">

=95 Travel App



_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb=

(0, 0, 0);">

=95 Shop App



_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb=

(0, 0, 0);">

=95 Business App



_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb=

(0, 0, 0);">

=95 Educational App



_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb=

(0, 0, 0);">

=95 Web App



_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb=

(0, 0, 0);">

=95 Hybrid App



_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb=

(0, 0, 0);">

 



_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb=

(0, 0, 0);">

Please share your App=92s idea with us (which will remain confidential) wit=

h your website URL for healthy communication.  



_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb=

(0, 0, 0);">







_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb=

(0, 0, 0);">

Thanks & Regards,



_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb=

(0, 0, 0);">

Philip



_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb=

(0, 0, 0);">

Development Manager








--_000_SLXP216MB10490C4F2DD8795A27AC511D98CF2SLXP216MB1049KORP_--

ChatGPT phish from serviceshelps.com

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Fri, 24 Jul 2026 07:29:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wnFwy-000000008xe-42ku

for dave@doctor.nl2k.ab.ca;

Fri, 24 Jul 2026 07:28:28 -0600

Resent-From: The Doctor

Resent-Date: Fri, 24 Jul 2026 07:28:28 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mta.serviceshelps.com ([87.99.132.75]:34951)

by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

(Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wnCyx-00000000AGJ-23o7

for sales@nk.ca;

Fri, 24 Jul 2026 04:18:28 -0600

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; s=1784883504.serviceshelps;

d=serviceshelps.com;

h=Content-Type:MIME-Version:From:To:Subject:Date:Message-ID:List-Unsubscribe;

i=support@serviceshelps.com;

bh=wVpt49JWqY37C/3Zs/AgtnRqTwwhCnyhDyko6sXYgRg=;

b=FwCuLopg6VONm4IuZTvSQbiZKR6yRfuzF2Y/bK37tEnUISvTfgF14jWY0VNrb7C06c2ayetnZP0L

usHf+wv83UjdHBE0g12d7geAWM819CZWMbWH4q2hc1FEB3grpv5dtQLcmneQAIvWa87hpHqS9pnk

bSX76rp/8whCiFaTAXEDQ2h4FOV0VdzYscqjzT69Lo2ySDAmpckyQU5BFRigggfF4jc0nYH9wYr4

LjVcUG7vzumCkAPIhppZiIEa8gYEm0DG1lEGLlFoKo01ujAteB6B0qpQADqnB6UfWniPq1b2leWw

Y1XF/h7nrT1vNjlnI3BX9lsZcilvEZy06kGntg==

Content-Type: multipart/mixed; boundary="===============4557206524044104869=="

MIME-Version: 1.0

From: ChatGPT

To: sales@nk.ca

Subject: =?utf-8?q?Payment_Failed_=E2=80=94_ChatGPT_Subscription_Suspended?=

Date: Fri, 24 Jul 2026 03:17:30 -0700

Message-ID: <178488825008.11672.17320155450568200932@WIN-EP3PH7304AD>

X-Priority: 3

X-MSMail-Priority: Normal

Importance: Normal

X-Mailer: Mozilla Thunderbird

X-Auto-Response-Suppress: All

Precedence: bulk

List-Unsubscribe:

X-Spam-Status: No, score=0.0 required=5.0

X-Spam-Level:

X-Spam-Checker-Version: SpamAssassin (version 3.4.0)

X-Spam-Report: This message is not spam.

X-Spam_score: 5.8

X-Spam_score_int: 58

X-Spam_bar: +++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Your ChatGPT Subscription Has Been Paused Your Subscription

Has Been Paused



Content analysis details: (5.8 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[87.99.132.75 listed in dnsbl.ahbl.org]

[87.99.132.75 listed in dnsbl.ahbl.org]

[87.99.132.75 listed in dnsbl.ahbl.org]

[87.99.132.75 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[87.99.132.75 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[87.99.132.75 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[87.99.132.75 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[87.99.132.75 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[87.99.132.75 listed in will-spam-for-food.eu.org]

[87.99.132.75 listed in will-spam-for-food.eu.org]

[87.99.132.75 listed in will-spam-for-food.eu.org]

[87.99.132.75 listed in will-spam-for-food.eu.org]

[87.99.132.75 listed in will-spam-for-food.eu.org]

[87.99.132.75 listed in will-spam-for-food.eu.org]

[87.99.132.75 listed in will-spam-for-food.eu.org]

[87.99.132.75 listed in will-spam-for-food.eu.org]

-0.0 SPF_PASS SPF: sender matches SPF record

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-0.0 T_RP_MATCHES_RCVD Envelope sender domain matches handover relay

domain

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[87.99.132.75 listed in bl.score.senderscore.com]

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 URI_TRUNCATED BODY: Message contained a URI which was truncated

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

1.6 FORGED_MUA_MOZILLA Forged mail pretending to be from Mozilla

1.8 MISSING_MIMEOLE Message has X-MSMail-Priority, but no X-MimeOLE

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

Subject: {SPAM?} =?utf-8?q?Payment_Failed_=E2=80=94_ChatGPT_Subscription_Suspended?=



--===============4557206524044104869==

Content-Type: text/html; charset="us-ascii"

MIME-Version: 1.0

Content-Transfer-Encoding: 7bit













Your ChatGPT Subscription Has Been Paused




























































alt="ChatGPT"

width="160"

style="display:block;border:0;height:auto;max-width:160px;" />








Your Subscription Has Been Paused









Dear Customer,









We were unable to process the most recent payment for your ChatGPT subscription. The charge was declined due to insufficient funds or a declined payment method on file.







As a result, your subscription has been temporarily paused and you'll lose access to premium features including GPT-5, advanced data analysis, and more.







To regain full access, please update your payment method below. Your subscription will be reactivated immediately once the update is complete.


















target="_blank"

style="display:inline-block;background-color:#10a37f;color:#ffffff;text-decoration:none;padding:14px 36px;border-radius:8px;font-size:15px;font-weight:600;letter-spacing:0.2px;text-align:center;white-space:nowrap;">

Update Payment Method












You received this email because you have a ChatGPT account.


If you did not create this account, please disregard this message.





© 2026 OpenAI. All rights reserved.












--===============4557206524044104869==--

Aeroplan points phish from Sendgrid

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Fri, 24 Jul 2026 07:29:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wnFws-000000008xB-1SqH

for dave@doctor.nl2k.ab.ca;

Fri, 24 Jul 2026 07:28:22 -0600

Resent-From: The Doctor

Resent-Date: Fri, 24 Jul 2026 07:28:22 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from vsvhscxc.outbound-mail.sendgrid.net ([134.128.108.172]:36258)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wnCxu-00000000ABJ-410w

for root@nk.ca;

Fri, 24 Jul 2026 04:17:18 -0600

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=sendgrid.net;

h=content-type:date:from:mime-version:subject:reply-to:list-unsubscribe:

list-unsubscribe-post:to:cc:content-type:date:from:subject:to;

s=smtpapi; t=1784888182;

bh=ORbY7kzCUKxNYs6FcrI8VjduKe4PHld/pU2V09z3ahE=;

b=FW3YjW1q354Zk84+FWD04FZYuE/OYK2M8afCF8Dvst8aw4RpToI1JeyNuC5L02XAuApx

XBAUwB1oCFFl93vPg4m8dv88XQmg46ZTKowIcxZnT9c73p4CJ8kmdVSVYSZa9+Z9pcjYV4

gJhbzdG9YY/ZCOJQvIJ+YT0k7RXNOAALw=

Received: by recvd-f66db6c76-nr4b7 with SMTP id recvd-f66db6c76-nr4b7-1-6A633B76-3

2026-07-24 10:16:21.99697942 +0000 UTC m=+138325.487921945

Received: from NTM0ODA1Njc (unknown)

by geopod-ismtpd-94 (SG) with HTTP

id 2Hbi_45tTBmYNvWqjW80nQ

Fri, 24 Jul 2026 10:16:21.963 +0000 (UTC)

Content-Type: multipart/alternative; boundary=320e69bdc408514e005a25ee978f0a29c8d61f89b0995434b99f24c440af

Date: Fri, 24 Jul 2026 10:16:22 +0000 (UTC)

From: Aeroplan Points

Mime-Version: 1.0

Message-ID: <2Hbi_45tTBmYNvWqjW80nQ@geopod-ismtpd-94>

Subject: =?UTF-8?B?4pqg77iP?= Final Notice: Your Aeroplan Points Expire

November 30

Reply-To: du.tcharonson620@googlemail.com

List-Unsubscribe:

=?us-ascii?Q?=3Chttps=3A=2F=2Fu53480567=2Ect=2Esendgrid=2Enet=2Flu=2Funsubscribe=3Foc=3Du001=2ESdR=5F?=

=?us-ascii?Q?=5FsCN=5F7rZz8-Rbz2kDHv6XjDsTgUwD7BOqwV3PPS?=

=?us-ascii?Q?biAyR4beYCB5L-Fi83tNDwdpI2ceLLvKwk5N8g4?=

=?us-ascii?Q?eKjmbE0B9lOaw=5F7-IvdclzO68ZlNf-Anq4rRkLd?=

=?us-ascii?Q?ALK8MDAMTAkO3gJqX1v=5F4i4rzYFhhOD5q9C06Nf?=

=?us-ascii?Q?FkK2-wayO4-JsGE5GfVK-si=5FzOF6zb3DuT2kU3q?=

=?us-ascii?Q?p6vIb6hNNs7s=5FR2yK4GdI7e4AcPQEOxo=5Fnu99u5?=

=?us-ascii?Q?7K-KExhlmxDnqu56EY-eUpIcA4QZ5v4dqZldgs6?=

=?us-ascii?Q?7f2iJtz4CoDadG=5FXTFwLTzY8e1uddcRkWEcjSMX?=

=?us-ascii?Q?MXlnRMjXShFo-9vshatz2nxmHymVxrsK8KUK-Xy?=

=?us-ascii?Q?1WGahcJUQa75mhZKnxCfWmXsQeN=5FCzaM7cD5X1r?=

=?us-ascii?Q?87IRGzW1HAbvkud10ylWaIj0Lvo3xoyp-z8PKdP?=

=?us-ascii?Q?g8PxrpcnB=5FuJ7tZD507tODxZL3pAv10Cco=5FICXj?=

=?us-ascii?Q?6a3-dKaMSm0giCxr=5FNQoe=5FA=5FpI6jfZtvXS1rUFu?=

=?us-ascii?Q?mjAkdykSe=5FuiGYmWPIN8Bxo7DnHGyc-1fSIstgD?=

=?us-ascii?Q?pq-VWU-3M8cR0ubGvAbLrRY40EJ09xo=5Ftpp=5Ftdd?=

=?us-ascii?Q?=5FrtI6iwSbN-CVfL3zq0jS7w=5FVgSlol=5Fl-jRYBGf?=

=?us-ascii?Q?z4bxFqpioJ=5F7Mmd5ZrcL-gDxmHNqdUIKzOnd0Vk?=

=?us-ascii?Q?NE4hvvyDWVZQi5nrY6XAFvxZwB3xKZUPK9GnLgv?=

=?us-ascii?Q?077PK6vhUNcrqBgVm=5FE0f3w8O6f1p1gQmZ128yk?=

=?us-ascii?Q?3mqYVKBSMWUWCeIpnVb1XOoNCVLlsosHia2eSMj?=

=?us-ascii?Q?Ch9BhmFRaoJC30rC7rz5rGrquEia6evgnUMgtWi?=

=?us-ascii?Q?ojc4mHQPxoLoEcEWxuQLDybtoiGWO0PWNIJCj02?=

=?us-ascii?Q?BhlVKHC9XaNcMf-0PGYXfpDNUHq4KQZr47fyUSC?=

=?us-ascii?Q?MjboB9KQflvKJ4dqpf-qYc5FXphVgoYknwVewUd?=

=?us-ascii?Q?VKjzDh1EsrOxMRbIjsuGdDuDGOrk-j466Spr7tX?=

=?us-ascii?Q?Hvy9vwI7rMkhLlYfBUOaJMJGKDfg1En--UcKiTO?=

=?us-ascii?Q?3anMztcS5BAkD2cML7kc0vEjeVux7P9v=5Fiy-zOx?=

=?us-ascii?Q?uLfN11aRe9WsjsHiGUqGSa3=5FbwIrD969xrrOeU6?=

=?us-ascii?Q?yVEQBVUJsng6HsSGrcphJZ9zcrKnWz38lY08-HC?=

=?us-ascii?Q?5SFiJ0zx3T5kW2ZAORTnWmUFc7=5Fnqnv6msld8kH?=

=?us-ascii?Q?Ms1Tvfx19uiTm14P8po299JdP-cEFcTTSbN1K=5FY?=

=?us-ascii?Q?Pf69GpTowHMi5K6CUNx6lDf8N9TExoJJCYekdNC?=

=?us-ascii?Q?veuBsiZzbwpg0wcTca001qpeLnqqCNFEdQCXn6J?=

=?us-ascii?Q?KCyW6X6p4G41bh3f-1A-lbWEQ1jnVyUKW5e6-0e?=

=?us-ascii?Q?nj9HygfRB1lxeX=5F--tdUx268ldyZgE-1KXJA=3E=2C=3C?=

=?us-ascii?Q?mailto=3Aunsubscribe=40sendgrid=2Enet=3Fsubject?=

=?us-ascii?Q?=3Dhttps=3A=2F=2Fu53480567=2Ect=2Esendgrid=2Enet=2Fmt=2Fu?=

=?us-ascii?Q?=2Fu001=2E9QLdQEyMyPNLvIS5NnhdxG6qQLOP1xA5E?=

=?us-ascii?Q?fZdJMLDJF4=2F4sl=2Fu001=2EM=5Fki9d06=2Fu001=2Ep7ggp?=

=?us-ascii?Q?GYbNHJ4vKUM-2FW9CPnBeZzyxd2AM24oVDqSCQy?=

=?us-ascii?Q?Q7okK2WzCPTSFNqQsNV-2Bhnyn6RBim2FZZumww?=

=?us-ascii?Q?XnXhGRPZiy4ZxRJBNggaUHCprb5gjLScH6svxP0?=

=?us-ascii?Q?KcOqZmfx501AyXk4Bl7xXxNz4OA-2FQoKQyNk5V?=

=?us-ascii?Q?CloOL0mOrVsp-2Bgy9gx88QXCvr4Y7-2BHg-2Bo?=

=?us-ascii?Q?5TtE9jT-2BFuVfHx0rljHexYAoaUCNIiAYrajM5?=

=?us-ascii?Q?Z-2FuTTtV5-2ByiXQbxxyixjm47OC3g7wwFWi7L?=

=?us-ascii?Q?4OFFDwh-2FdUS0W-2BcNmWaqR2eDV15NxRLFvze?=

=?us-ascii?Q?r9edOzRDCha9McNlV483EWnETL6j-2FIU2JMWVV?=

=?us-ascii?Q?8vQt1hNjiN9pWVqkNJLppp-2B5WfG6O-2FcxbNg?=

=?us-ascii?Q?ya7wMVccOXSnqDXVVR38pHpWUbKDa56nLMTvo9l?=

=?us-ascii?Q?JcQd39MMsHTIKtK8j5xuk-2BTnubiQMo9Qrh4lh?=

=?us-ascii?Q?rTeRmYGb8Xl86s3e8K-2F-2BRfNDpmZMmGyJYNZ?=

=?us-ascii?Q?s2vobPpqYCaVLqjjAZRUY7CHW-2FLFzpqQjkTGy?=

=?us-ascii?Q?5jLrGYSDHw69jZbZg2gwXq9IPDOMxJDTxRH4hwF?=

=?us-ascii?Q?QzeM3Yo0J8DaY0of3mdCSuLDVTlSsZmP0AA8xQd?=

=?us-ascii?Q?bl7T23yf9iL4-2B9x0LYG-2BFIOjzXWm0OCrenZ?=

=?us-ascii?Q?9a3eiedCNpOu8CgqKCdD-2BO4iCTICzXMVWptKd?=

=?us-ascii?Q?paPI3o5UAL9jItm0ph33FpmliwjCNH00Atz-2By?=

=?us-ascii?Q?SojsfLofqHgXNXlRuczAtiGaP4YuQPugHKXUzaf?=

=?us-ascii?Q?AqKryvQpxguO6CmicD4z1S-2F8vMwl0lAE53-2B?=

=?us-ascii?Q?029mly-2FzaDFvHTNEKmOc1wDppy1nqKxmdOW-2?=

=?us-ascii?Q?Bi0SeqGhVbT53B6qShZDAG-2BqW3ft7i5D7JD5R?=

=?us-ascii?Q?SULPUKw6FZEo4vaASU-2BILe2x3CBq7OHNZswW4?=

=?us-ascii?Q?14DzfJXus-2Fp=2Fu001=2E8nk6MTNq=3E?=

List-Unsubscribe-Post: List-Unsubscribe=One-Click

X-SG-EID:

=?us-ascii?Q?u001=2EkPCokVTLpzOQN11CnW+qjss2owXwiFks=2FTgz9R=2FU4jfPl0ZXtdQBHmYH3?=

=?us-ascii?Q?d5qkGPfZG2KBfmsCEqFjKNhBRGbPKYMBB7XBlxq?=

=?us-ascii?Q?krc6TgGTf5gvKY0MIKmm5Z7J2I4gXd=2FmYBA5nl7?=

=?us-ascii?Q?plFxbHBc=2FqVphxYFqW6lV15ee=2Fs4C71cVPhHxEu?=

=?us-ascii?Q?MOnvv9gu8SGmwHEJE+fVNDxWj2jnjxyBrPxvIzn?=

=?us-ascii?Q?OI5Swg2MuhCD3hrQFoVg=2FePxaOXi1aX8+zcx62W?= =?us-ascii?Q?qd5R?=

X-SG-ID:

=?us-ascii?Q?u001=2EXwhBPNhCejkv4+fVosb2QVfR16Qxp9CrA7PjDe5zzeI=2F0IZCBsPXtgHbA?=

=?us-ascii?Q?oGIj+RskLxA4N2rJjSWrHfgX07tLOm0v5BUQcd6?=

=?us-ascii?Q?w3knjorGi7Hwu0WCOA5AFSvy0=2FwlG32=2FNAZeXoL?=

=?us-ascii?Q?EM+T8zDzl8AajadOUVFLcAti=2F60xz6KkEAPPwKv?=

=?us-ascii?Q?4Ant4inEbYmKEgStj7SRAgoD=2FhsvVpculaXgOBl?=

=?us-ascii?Q?TI7AuvGSTzU0wYWrOcFvA8a8x00b3jiK=2FnsTxC2?=

=?us-ascii?Q?snKxFDb=2FCtrVk=2FLxShFSrP3MF2Q6Bfa7H7crQo8?=

=?us-ascii?Q?pbcLon=2FSlzrgMnMgsq5+efOeVwmJCdp7zTbjbmE?=

=?us-ascii?Q?OvdQHfdivCspOlaMqfR0i2ZAzU+WVLVFSPf+TOP?=

=?us-ascii?Q?ccDLYIlsObC9aJsmWL55+7sLkuVyVFWR9IlYeTR?=

=?us-ascii?Q?ZPzzP=2F4Ay=2F72D48ieXOw4QJI2jOMhxTlvTnGHbo?=

=?us-ascii?Q?lG5Ax0ENINadVKhNSlYDQ5SjuDwP46f=2FTt0+fKO?=

=?us-ascii?Q?sHlvctpKAkuy08ouzv7VqO7uzJUMYtBlPPFQcmo?=

=?us-ascii?Q?vZXEblHoVkl26SQjxjAkDNx31AZPAcmKhNImII5?=

=?us-ascii?Q?iyXKJgo1MaytRzEBMAr55frIryrGCBypVvjpgxb?=

=?us-ascii?Q?tvRN2rEm8xxved6TQILAGO4KvqFIPRjk8+XSegz?=

=?us-ascii?Q?cTC507LCEXkOE4QP0AZ6MMuk+5HbySRMUnljt0u?=

=?us-ascii?Q?Dprj5yOO=2F4YPyhmP0c0Gqwl?=

To: root@nk.ca

X-Entity-ID: u001.ySM5x/GwaHPYGIUJEBBikQ==

X-Spam_score: 37.5

X-Spam_score_int: 375

X-Spam_bar: +++++++++++++++++++++++++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: AEROPLAN Your Points Are at Risk ⚠️ Action Required by

July 25, 2026



Content analysis details: (37.5 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[134.128.108.172 listed in dnsbl.ahbl.org]

[134.128.108.172 listed in dnsbl.ahbl.org]

[134.128.108.172 listed in dnsbl.ahbl.org]

[134.128.108.172 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[134.128.108.172 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[134.128.108.172 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[134.128.108.172 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[134.128.108.172 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[134.128.108.172 listed in will-spam-for-food.eu.org]

[134.128.108.172 listed in will-spam-for-food.eu.org]

[134.128.108.172 listed in will-spam-for-food.eu.org]

[134.128.108.172 listed in will-spam-for-food.eu.org]

[134.128.108.172 listed in will-spam-for-food.eu.org]

[134.128.108.172 listed in will-spam-for-food.eu.org]

[134.128.108.172 listed in will-spam-for-food.eu.org]

[134.128.108.172 listed in will-spam-for-food.eu.org]

-0.0 SPF_PASS SPF: sender matches SPF record

15 GR_DOMAIN_SENDGR1 Received contains spammer id (sendgr)

0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in digit

[du.tcharonson620(at)googlemail.com]

0.0 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level mail

domains are different

-0.0 T_RP_MATCHES_RCVD Envelope sender domain matches handover relay

domain

0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider

[du.tcharonson620(at)googlemail.com]

15 GR_DOMAIN_SENDGR6 URI: Body contains known spammer URI (sendgr)

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

2.0 VOWEL_URI_6 URI hostname with 6 consecutive vowels

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

0.2 FREEMAIL_FORGED_FROMDOMAIN 2nd level domains in From and EnvelopeFrom

freemail headers are different

Subject: {SPAM?} =?UTF-8?B?4pqg77iP?= Final Notice: Your Aeroplan Points Expire

November 30



--320e69bdc408514e005a25ee978f0a29c8d61f89b0995434b99f24c440af

Content-Transfer-Encoding: quoted-printable

Content-Type: text/plain; charset=utf-8

Mime-Version: 1.0



AEROPLAN



**********************

Your Points Are at Risk

**********************



=E2=9A=A0=EF=B8=8F Action Required by July 25, 2026



Dear {Member Name},



We noticed that your Aeroplan account has been inactive for *18 months*. Ac=

cording to our program terms, points may expire if no qualifying activity i=

s recorded within that period.



Your hard-earned points are worth real travel value =E2=80=94 *don't let th=

em go to waste*. Redeem them for flights, seat upgrades, hotel stays, car r=

entals, and more.



3,247

Aeroplan Points Available

=E2=8F=B3 Expires: July 25, 2026



=E2=9A=A0=EF=B8=8F Limited time remaining =E2=80=94 take action before th=

e deadline



=F0=9F=92=A1 Quick Tip: Making any eligible purchase with your Aeroplan c=

redit card will automatically extend your points for another 18 months.



Qualifying activities include:



=E2=9C=93 Redeem points for flights or upgrades =E2=9C=93 Book hotels or re=

ntal cars via Aeroplan partners =E2=9C=93 Earn points from retail, dining, =

or travel partners =E2=9C=93 Make purchases using your Aeroplan credit card



=F0=9F=94=92 Keep My Points Active ( https://www.mppvjh.com )



=F0=9F=94=90 Secure connection =E2=80=A2 No payment required =E2=80=A2 Inst=

ant activation



Act now =E2=80=94 once your points expire, they cannot be reinstated.



We appreciate your loyalty and hope you continue to enjoy the benefits of b=

eing an Aeroplan member.



Sincerely,

Aeroplan Member Services



Member #: {Member Number}



=F0=9F=9B=A1=EF=B8=8F Security Reminder: Aeroplan will never ask for yo=

ur password, PIN, or credit card details via email. Always verify you are o=

n the official Aeroplan website before entering any information.



This is an automated service message regarding your Aeroplan account. Pleas=

e do not reply to this email.



=C2=A9 2026 Aeroplan Loyalty Program. All rights reserved.

--320e69bdc408514e005a25ee978f0a29c8d61f89b0995434b99f24c440af

Content-Transfer-Encoding: quoted-printable

Content-Type: text/html; charset=utf-8

Mime-Version: 1.0












0">

Your Aeroplan Points Are About to Expire






l,Helvetica,sans-serif;">




nd-color:#f4f6f9;padding:30px 0;">












d:#ffffff;border-radius:8px;overflow:hidden;box-shadow:0 4px 20px rgba(0,0,=

0,0.08);">






































255,255,0.7);letter-spacing:3px;">

AEROPLAN




ight:1.3;">

Your Points Are at Risk





=E2=9A=A0=EF=B8=8F Action Required by July 25, 2026





weight:600;">

Dear {Member Name},







We noticed that your Aeroplan account has been inactive for 18 mont=

hs.=20

According to our program terms, points may expire if no qualifying activity=

is recorded within that period.







Your hard-earned points are worth real travel value =E2=80=94 don't=

let them go to waste.=20

Redeem them for flights, seat upgrades, hotel stays, car rentals, and more.








x;padding:28px 25px;margin:30px 0;text-align:center;">




>

3,247







Aeroplan Points Available






;background:#fff0f0;display:inline-block;padding:4px 16px;border-radius:20p=

x;">

=E2=8F=B3 Expires: July 25, 2026





















=E2=9A=A0=EF=B8=8F Limited time remaining<=

/strong> =E2=80=94 take action before the deadline











20px;margin:0 0 25px;border-radius:4px;">



=F0=9F=92=A1 Quick Tip: Making any eligible purchase with =

your Aeroplan credit card will automatically extend your points for another=

18 months.









Qualifying activities include:






0 25px;">


























t:1.8;border-bottom:1px solid #f0f0f0;">

=E2=9C=93 Redeem points for flights or upgrades

t:1.8;border-bottom:1px solid #f0f0f0;">

=E2=9C=93 Book hotels or rental cars via Aeroplan partners

t:1.8;border-bottom:1px solid #f0f0f0;">

=E2=9C=93 Earn points from retail, dining, or travel partners

t:1.8;">

=E2=9C=93 Make purchases using your Aeroplan credit card









VbxEAMpHdbYYnBk2C24jThtmu1utwCTY8-3DpzCa_YmNPztx4miJCrnDYqcF7jfR8yISc1B2YMc=

URCB95RzH7v-2FAlqusd9Q2l6rZumiG-2BKDbmL6ETKFvupUGdMmnHpZ8xnfswBgDv56ULRc6Ej=

7kJm-2BGqZQL6DqzqUNPNV7238ktb63re1Vuvzgscbmjh6KWccBT8mTGz6HmkDR2KHhp0Wzoz01=

vYeOYJISGX7KmJqop22-2Bd7e4ZW6pN0YXeM1271PiWnBKKrGkjwdex8LIrj6oQX5GPo6962hA4=

oeVxyWQpwGCYKGXvQ54LQ4sQI08bD4PSZqy95W5IAZhL-2BSKm6SPpfBxFvpv7ryGqaU2z-2FtW=

JYddMbsHVVE6SRc2CNund2Bv7j7TOTtFbck3dQj6cpsnQc-2FtAY05BmAc2lLXl3EXLVricPkDn=

CvFhFLGwCoHr-2BExo1CKpIOYZ0Kh2wZyvmoG96Ej9ZRt-2B7qa7CNuedLOaeVEnb1-2Br7Z3tI=

0bIhBRYHcbK8TRJ7uOmyk5iD-2F99-2FiFXPMx37IPufNTseSb6tN4viAY4t1N0mjn0ga7MrVi4=

qhWh7W8CRd2DqUdKBqOcBNRLrPjSikBbF7Oak8Xg2VllOAueLllLC7SEzXNcPKtf-2B1HDQ37iJ=

KaU2Z7LPUBRwJMc8eYy7HuAzw-2BddH6BGZ00Wc-2Bm5Kq6Xo4JUtLvXqQhKX2DD51PunWUsUHt=

Bc2ssIOxyqrgkgrpg8bRKuBt02-2BWXA7wiUYirp0AjY-2Bj2aTnH121pYy2jXk9hZylW57dKzP=

Zwe-2FTM2DXUF7M1MiJNVRsqhHcM-2Bzmi-2BAhxEuWJZiKgN83Pej9-2BaRi0en2k4QNvIe73k=

l6nghz2o-2B3To4DVBK-2BLArgSbyiKCGtkQNDvPCKIJcP90wXYtNiBASqG2cg-3D" style=3D=

"

background:#d71920;

color:#ffffff;

text-decoration:none;

padding:15px 44px;

border-radius:6px;

font-size:16px;

font-weight:bold;

display:inline-block;

box-shadow:0 4px 12px rgba(215,25,32,0.3);

">

=F0=9F=94=92 Keep My Points Active










line-height:1.6;">

=F0=9F=94=90 Secure connection =E2=80=A2 No payment required =E2=80=A2 Inst=

ant activation






">

Act now =E2=80=94 once your points expire, they cannot be reinstated.







We appreciate your loyalty and hope you continue to enjoy the benefits of b=

eing an Aeroplan member.







Sincerely,


Aeroplan Member Services






xt-align:center;border-top:1px solid #eee;padding-top:18px;">

Member #: {Member Number}

top:1px solid #e8e8e8;">





=F0=9F=9B=A1=EF=B8=8F Security Reminder:
strong>=20

Aeroplan will never ask for your password, PIN, or credit =

card details via email.=20

Always verify you are on the official Aeroplan website before entering any =

information.







This is an automated service message regarding your Aeroplan account.=20

Please do not reply to this email.







=C2=A9 2026 Aeroplan Loyalty Program. All rights reserved.









GZYDmBykh8zSgppscrG1a9-2FbnUZspF0av6mdLTg7APu65Yl-2FlT7gYWIWvlofAwKkY-2F2pt=

fbkc7w8h-2FPFa6xEfU55tVw9pxqAkjKcoCM5xYrUadMDhNOM92fWIv17g9YhozDkR7CnSOMHWp=

Kp-2FOCL5FPngHGR5vJixDSB2pKjOBbSSeBrl2C4HDeklkzb-2Fzbw4w1ozpYGHSYwVJPMr3g-2=

BQXxypOGqfR75fWSHgy3PX1YZ3XPQ7ht6-2F80BXspIM4bFdbHzcaB-2BPfMdaDjzCL4UvK4iZ3=

khVyTPaVQ0W1aIIZ7-2FTwpfPfW2-2BbGnIq1fz6UQN5Ynet6A9yEn3SYVLlSusvLcZ9DQcBpdH=

7nM-2B7ttKQhgRpxzhs9SSHe93QAA3W0QPwEIa2eoVJ64id-2BMD4F1A8JBSPsUo4KBqhjucstg=

uv4wg7kHkKJHxiTzWAsk-2BokKYMGuG2H7V2JOtzJ0eX5yhU7D5-2Fl5FHTmukUTMP4O7bcn4IX=

kLfvtioo7TVzstzMfPTWsW2-2Bp7f7Vbnrh3ZRvdi3LRwgN74dgw7OK5jUhr1A4OblzhotPTxRg=

8L6A4L46AEjjAJGmcE7-2B7dAfHAFLjN-2BGidKxCX3zAI13wkNB2z4XduBv-2BjHtws8TB3uuA=

TXNiEii1MmCqPWwpspl0dKZkFiPTcUAtz3lA3Gtza2yCly-2FLYW-2FFC4qVXSfl-2FZ1HK1MoW=

I-2FzrRgkO6VcpmhLbrYxnLH-2BpZrM2wIjF1cG6KVylb-2BRleqbwKqDJToAKp95R9d5Jy8vva=

AmAC-2Bl-2FYRCHIu4DZ84v3wSKTxk05EDzu46zJoW6Id2BNYC6VdSPS-2BouXqM9pUzOdgLb9a=

gdq7m-2Fsc8LDzkzBZahNKA-3D" alt=3D"" width=3D"1" height=3D"1" border=3D"0" =

style=3D"height:1px !important;width:1px !important;border-width:0 !importa=

nt;margin-top:0 !important;margin-bottom:0 !important;margin-right:0 !impor=

tant;margin-left:0 !important;padding-top:0 !important;padding-bottom:0 !im=

portant;padding-right:0 !important;padding-left:0 !important;"/>



--320e69bdc408514e005a25ee978f0a29c8d61f89b0995434b99f24c440af--

Chinese products spam

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Fri, 24 Jul 2026 07:28:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wnFva-000000008pd-3NCj

for dave@doctor.nl2k.ab.ca;

Fri, 24 Jul 2026 07:27:02 -0600

Resent-From: The Doctor

Resent-Date: Fri, 24 Jul 2026 07:27:02 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-m82222.xmail.ntesmail.com ([156.224.82.222]:34492)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wnARS-00000000K6W-3DD8

for sales@nk.ca;

Fri, 24 Jul 2026 01:35:51 -0600

Content-Type: multipart/alternative; BOUNDARY="=_Part_251956_1373983531.1784878477795"

To: sales

Subject: =?UTF-8?B?RW5oYW5jaW5nIFdvcmtzaG9wIFNhZmV0eSB3aXRoIElucHVyIER1c3QgQ29udHJvbCBTb2x1dGlvbnM=?=

X-Priority: 3

MIME-Version: 1.0

Received: from johnny@shuishengyuan-ccup.com( [10.139.0.42] ) by ajax-webmail ( [127.0.0.1] ) ; Fri, 24 Jul 2026 15:34:37 +0800 (GMT+08:00)

From: terrence.kirlin@voro.machineclementia.com

Date: Fri, 24 Jul 2026 15:34:37 +0800 (GMT+08:00)

X-WM-Tid: 0a9f930c2a0703bckunm332466465192b

Reply-To: johnny@shuishengyuan-ccup.com

DKIM-Signature: a=rsa-sha256;

b=0+RLDDMruOuBTtSgH+h6hiP+YzE2ZkCTWRebG99we01JKdeJgTVE88snm5wU8fNsD8wn+J+dabpoulHS0OjmKU76iS6X/VYuvL8TLO0o42ytdYe6y0Q+ZMU1dTUxMovC7SnJrRe07/c7Z9NUbQjCn65oxNIuI41uXpvE6gT4LfY=; c=relaxed/relaxed; s=default; d=voro.machineclementia.com; v=1;

bh=dqpy2MdE8aOtBKykleeWaaewBs4htNPE0x/KCzkL9NA=;

h=date:mime-version:subject:message-id:from;

Message-ID:



X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Fri, 24 Jul 2026 07:28:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wnFva-000000008pd-3NCj

for dave@doctor.nl2k.ab.ca;

Fri, 24 Jul 2026 07:27:02 -0600

Resent-From: The Doctor

Resent-Date: Fri, 24 Jul 2026 07:27:02 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-m82222.xmail.ntesmail.com ([156.224.82.222]:34492)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wnARS-00000000K6W-3DD8

for sales@nk.ca;

Fri, 24 Jul 2026 01:35:51 -0600

Content-Type: multipart/alternative; BOUNDARY="=_Part_251956_1373983531.1784878477795"

To: sales

Subject: =?UTF-8?B?RW5oYW5jaW5nIFdvcmtzaG9wIFNhZmV0eSB3aXRoIElucHVyIER1c3QgQ29udHJvbCBTb2x1dGlvbnM=?=

X-Priority: 3

MIME-Version: 1.0

Received: from johnny@shuishengyuan-ccup.com( [10.139.0.42] ) by ajax-webmail ( [127.0.0.1] ) ; Fri, 24 Jul 2026 15:34:37 +0800 (GMT+08:00)

From: terrence.kirlin@voro.machineclementia.com

Date: Fri, 24 Jul 2026 15:34:37 +0800 (GMT+08:00)

X-WM-Tid: 0a9f930c2a0703bckunm332466465192b

Reply-To: johnny@shuishengyuan-ccup.com

DKIM-Signature: a=rsa-sha256;

b=0+RLDDMruOuBTtSgH+h6hiP+YzE2ZkCTWRebG99we01JKdeJgTVE88snm5wU8fNsD8wn+J+dabpoulHS0OjmKU76iS6X/VYuvL8TLO0o42ytdYe6y0Q+ZMU1dTUxMovC7SnJrRe07/c7Z9NUbQjCn65oxNIuI41uXpvE6gT4LfY=; c=relaxed/relaxed; s=default; d=voro.machineclementia.com; v=1;

bh=dqpy2MdE8aOtBKykleeWaaewBs4htNPE0x/KCzkL9NA=;

h=date:mime-version:subject:message-id:from;

Message-ID:

WEb/SEO/App spam from Microsoft Outlook

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Fri, 24 Jul 2026 07:25:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wnFsn-000000008F6-3JpV

for dave@doctor.nl2k.ab.ca;

Fri, 24 Jul 2026 07:24:09 -0600

Resent-From: The Doctor

Resent-Date: Fri, 24 Jul 2026 07:24:09 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-eastusazolkn19012073.outbound.protection.outlook.com ([52.103.11.73]:14734 helo=BL0PR03CU003.outbound.protection.outlook.com)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wn9uW-00000000GXq-4C8b

for doctor@netknow.ca;

Fri, 24 Jul 2026 01:01:43 -0600

ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none;

b=HDJU99OEFZvaDTQuJJMmOQmPWkAingEk5nC+mpt4J4n5JH7z4LyAl+pPPVitzZSz/xaPIXERegoBVYOHQErn5zb4m1zrihEnOWmxq1IVQ8/gcQaeMzRWe5v3qIXVHPLkKGCMwismAa1X6ZpUc7+WGh6ciCkdyHFMHnKGGkZs4zn6FS4hsOSDgv5Qtr3kpanayBUOK0iRf/tXhYFMKsy5qn/LN7fQLgOfax5plYYUSLGr4Tav+o0czG+ZWPPBbHIgY417EOu4Peygf6e2fs/TAL70zotwzWlwb8Gc3E9j++vqKvy5OgLsFfrGj/Lz6ikxBWhKnd4cv/+BX5O/w9569Q==

ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;

s=arcselector10001;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1;

bh=6qJrx67bdWbRNl8z3Stftgvz9ifqHNbDMNVxq++d99w=;

b=NupcZDKSnuFA1lSdIrZaXBx1hlONn6gRAWPr/zxdaCIufG5NCuW8gd4IMs/64PPP4VkDD9OCpaxKZ5wLsxwd4kClmG8GDztBBiSiDLOF7I+8Q15oh6C9Lo/ngb2G1RhnTR//AeIjykb+u5cJMCwl1bltj6Bn6sjjFDHWUQq2lduvTVbqhcL0LThnbinQekUTqI03XqASlUDhBBBR6nPzubpwRNj4gxE8iS+ZytNK10IIwtyfKPAo1PdDFHfq8lEjrAeLVdFMjPCWLkk2LPbbuNIHQKgooBSxKiKtS5FRoUAbyeCP9T6rvzA/5hii/2PxDLoibRA6Z7mBWksOlm3qjQ==

ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=none; dmarc=none;

dkim=none; arc=none

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=hotmail.com;

s=selector1;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck;

bh=6qJrx67bdWbRNl8z3Stftgvz9ifqHNbDMNVxq++d99w=;

b=bWH87M6nzpSPxnP/aURwapn0FVHGpmFBCXN6iJw/hOknGAsg4yzl7/EYQ2uxLC/3mws6JXv9eKVuS8wbTdKDZb88YZq2/aZ0Jd1jp+gpYDk3cV4NWj3Kcw0tQQiYwMifLzcuuY6Y/dDs2NoYoTPsnPPm8d1jG2nAtM9wPbEILU+ZYaAZ9MQOCVNE1We/0OaGqY13Jxrkiv6LwFheSeBwRmaNBsMCvuCg3yaufaf6JlncJclIZNqvmkq87WWhkr/aNcALbLI3aWkFEl2iOD95CxSlMGOvTMJw06NAqq7UvqKoq4vnMIitJxNVWPgpsQDbMPIYqsTJkqfUVNDJrhWbFg==

Received: from SN7PR19MB6733.namprd19.prod.outlook.com (2603:10b6:806:266::19)

by DM6PR19MB4245.namprd19.prod.outlook.com (2603:10b6:5:2b1::13) with

Microsoft SMTP Server (version=TLS1_2,

cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.223.18; Fri, 24 Jul

2026 07:00:36 +0000

Received: from SN7PR19MB6733.namprd19.prod.outlook.com

([fe80::cd7e:d06b:2293:c7d]) by SN7PR19MB6733.namprd19.prod.outlook.com

([fe80::cd7e:d06b:2293:c7d%7]) with mapi id 15.21.0245.010; Fri, 24 Jul 2026

07:00:36 +0000

From: Siddharth Jaiswal

To: Siddharth Jaiswal

Subject: Re: Affordable Web Design !

Thread-Topic: Affordable Web Design !

Thread-Index: AQHdGeq6oPn0UDtRo0yhLqD6IiHf7LZ5obMQgAL65n0=

Date: Fri, 24 Jul 2026 07:00:33 +0000

Message-ID:



References:





In-Reply-To:



Accept-Language: en-US

Content-Language: en-US

X-MS-Has-Attach:

X-MS-TNEF-Correlator:

msip_labels:

x-ms-publictraffictype: Email

x-ms-traffictypediagnostic: SN7PR19MB6733:EE_|DM6PR19MB4245:EE_

x-ms-office365-filtering-correlation-id: 1bc51ce0-01ab-4bd9-2f98-08dee95142cc

x-ms-exchange-slblob-mailprops:

hnD4Fgoc1bPokEwHA1l2GYyEHUkO2myI9KMMD+X+ohEhYjxrQLj6D0fiujSFCsw5ZUEOPVd4m2aJ1O23eYxjDrmLASisQoCwKf77vpHQ+wGtgYuLt4dORe6UZUJtZgW1oP6dw2VpsFTsJWZTA0263Ar9pwrdqVU08zSte/5Xm+ZuXvgfE3pn7Fl3BIfJMvoK/hof1rDlmto6UY2n3eTaeUkSQR7wUiKcftHJ+wai1soo5QArIwwNJruwbPEXRpllmqz0fA0NPLQfY+qXMslp+W2q2uemh5Hh3EIHJaXgUsLEVPqElqG9UXkh2hvMbFSMajUhORXi7EqBnQo9hmxozgKAiEOOtfUeRpwPBVEk+Tjxv2zeWFUG6FUd8smgkQJN/3pqfxpQtyg+T+0LEsA5D4rKH+uZO2iZd3k3Wwo/95NA1DRM6QzsnnhBX5v4BvBK1nkrKNF6/1V8ZYll7+QbfPH3m2OQPY8BLh5oFoEk2H/B0C8WfJV56vPK+eHdmtrPZYFTpb2YdYCr7/dPtFrmJMPG2zuH4WH+h/LmsRb1Fv5mmpgwLOndu9b79mYAgJrizovFP5f4kNVgG987O7Xt4kBSVcaq+WNhjlNwO+TMXxxdrZ1mPDL/jYtnuabQuwG/

x-microsoft-antispam:

BCL:0;ARA:14566002|4140399003|15080799012|15030799006|25010399006|16051099003|55001999006|24021099003|2604032081799003|39105399006|22091999003|37011999003|24121999003|704163111799003|15001099006|8062599012|2604032031799003|8060799015|48001999003|19110799012|31061999003|12091999003|56899033|3412199025|440099028|102099032|40105399003|41105399003|39145399003|18071099003|1710799026;

x-microsoft-antispam-message-info:

=?us-ascii?Q?Vkn+MumCa6m9wFtXY40hfXe6TmO8YxRR1eS0m39baq6Ar3C0Taxysj8iiSMm?=

=?us-ascii?Q?tq7LYVBX18vK8e8liv+5RcoiLSmG1xKNpWnsqKZRIRvJCexAxIIFEcIZbP9Z?=

=?us-ascii?Q?pyZjCbV+Oc4+c6yHI1vKQmrtrgB5n130mXfOsUqW/0+NK9qMq2qcvtO5nHPj?=

=?us-ascii?Q?e2ffpd+qhwKCXYQ6/tSSiSZ6Ts6dG8M7/pjaO7yEeJ4yODiWZlLF5Adg4QEo?=

=?us-ascii?Q?8rn0kLFWTxsHwPguQeuKane5z1AuElTGzdZm1pqte30LDavC1qBrI8Dqb8s/?=

=?us-ascii?Q?jPcVOzZbK3x74Hmpy2Fbbr0icwP+0RotRUreFacXcFjH9AGwGUFJ7Wy4iMQ3?=

=?us-ascii?Q?IifWt8Cpei234zEkiyeXDLk51B3EgfB7wJkLRXoh5EURRtCrDDM0ZYCr5+ij?=

=?us-ascii?Q?MY8qlzzutzAmzJLDd0qm1t5HMqVjy7gT3FGL0h3GxRdKm38hlAYI/8sPn4oI?=

=?us-ascii?Q?0NMrYxjgbZ+GOyJG29eFNPDr+a8umhpWLTxZmTyUmONmvSg+Dm/Stul5xxR0?=

=?us-ascii?Q?GHILRLhLPIFIFA4YKBx4aCNofy51tC6jjW7aBk9cQHUwfgzh2OBV7GvaVutB?=

=?us-ascii?Q?9scJINmKF7Fx0Wk2/Cq86PYn/tMMEe1Xbl07LVhAefWlXYht/kG77gm5DvSy?=

=?us-ascii?Q?ZFiZ5tVH96xSHJ982OLy1SaCsLbKAUygHCx0yVu71+JgYdzy8kmcDDG28EAA?=

=?us-ascii?Q?s3ytZhTZtHcuGNUraqduPICRUFDt/WZk7gTX4luhhMftQRNQzCAqlCN6hI+v?=

=?us-ascii?Q?i+On79SK2XXs1tetW9hpylx5oyxoT0Ju7WlOYfbnX6Ho4GMeejDrLucHOgw+?=

=?us-ascii?Q?nJuo4T7L0zpT2yFM3PIiBfaogWfiU5EZGleqN9ijeWFy3LHE5y9AAEA3eo3n?=

=?us-ascii?Q?lEdbX8Uz4aHHK9nVL5Oo74VnWNY6oxqC4h/xFNa9wmhAUa5W6Heruub3/Sys?=

=?us-ascii?Q?uGiloUBHyjU3U68nbFBlEtlrjo7992iijGvxoSk2oNB2OzjzVljT/viBGXgT?=

=?us-ascii?Q?CerSDvMyf0B3Zsnh3MpD4YQtRHPUWHIFx8M9/VTJc0/KZCJWWpTVzzttcOC8?=

=?us-ascii?Q?DASOInoncLeizgKwfBJFRbaCfPdVjrKTXicKtrJoQ+N0Rq/78o7ZCwb+wzyF?=

=?us-ascii?Q?tTysCjrFbUIpxtWFKVkUfgsJfwmGa0dbKw4tiXK5WCTG8XN1NQ4o9sruCs7a?=

=?us-ascii?Q?iawJyQosrXp9ynnP9DyELvgmok8p73GU+wDbLBMIQvCAwuEHwAHUG0cTHqVz?=

=?us-ascii?Q?Y6FbEmAXW0fgt+/mTrih3KeKIytHK85MeQEPJWDu+U5EmlQTScFXWCx2qgSQ?=

=?us-ascii?Q?97uog5CHLYIUDeKdlqxlD/3uredU0fcwx72bvbDIHoUjjPKtJ3iH4zMZabQc?=

=?us-ascii?Q?KOgIAqR7Iod+o2dr2+8l1z+gNBmLzqSR0sBcC9mTAHxt/V3xrEmnFkZA5B01?=

=?us-ascii?Q?FapLqARWtWQkXU5Ctg1/RiswmlVV88nYr76jS6iRXS2egAKmqh39OoGKtPSa?=

=?us-ascii?Q?5BOG9x5dkOGY0tA=3D?=

x-ms-exchange-antispam-messagedata-chunkcount: 1

x-ms-exchange-antispam-messagedata-0:

=?us-ascii?Q?KQd0eISVMwYqJ/mW/W4u+WaMAYEEuIqyZrK7hMGTZCYIxtTHjX8QP1Q7Uu5K?=

=?us-ascii?Q?POoXds3DMdLvGy3tXCxHf+f1N6DIjlSLcdWzxkXReVqfO/oVkzNBm1gZ3Os1?=

=?us-ascii?Q?mz4Y1tl2otnITdbb7Tg4Hh7wGknYizHV9Hwj7SwvkUS3xUSixPGSB6WfJ49y?=

=?us-ascii?Q?LAAVchBYYt8B/8YUxh5aJN07EBauEMi2XqwFoAwjs3cUR08PC/58pDjCz5cM?=

=?us-ascii?Q?blg6U3+08JD3ZiBnZ4ukbGgA3mfDODs37nhpIlb61BkYjDKILqKJMPpYdu2d?=

=?us-ascii?Q?4Ccc+yDTrTWm02Oyn8K/eaFkxep0PYDaq/vaMQPCyUqufSVDfOOjT3H7Gc9+?=

=?us-ascii?Q?XFgIjPNCEUITfDYOd/PABptvv0sQgauy/ZreA7HD9asjpuB2zp5j+Ue3zo/p?=

=?us-ascii?Q?y3imtGKPV05AH4SD+WIxPvJDURZdk/FLf7AU7WKPk7tuE2pJYkW3LxdfaGwI?=

=?us-ascii?Q?QzTEWGFOxgzUBFhZCu5owIx9F7zGF1wrhcizhIeOuYO/NPZ/Io9zlmxKrJMJ?=

=?us-ascii?Q?wdaLGdhwUvZ4EBgBTkutpdPksCeorXgJcm+TYMoKhaeXXn9xt9aYa+bcYjHc?=

=?us-ascii?Q?4MXSBDyt3sVWNGWxFCswyj26nJAFSLbQyT9YPT/cw42QtPeUDz1jAnRVWPxe?=

=?us-ascii?Q?oUvj1CCjYRFP3rcEYZn0u6xRcswoZ1SFmU0g2VS3luo4RDFwSO36ItXHG3Uq?=

=?us-ascii?Q?j1xpMmAqxDPg0W45Qghp8vhBlixigbSvqppukEkVJ1bJwV7NHHCcBbYXDZsr?=

=?us-ascii?Q?GmemHfXjrfuIF/Tie2KsIojA6L45W7Qc3yeR5O08eB6LIVek6wB0UXo2I1/L?=

=?us-ascii?Q?3zqSnRO4DN5IlMUib6PJF2Fulu2Q3aB1MpA59l4ob2Zjvd41ItqiJh3QolPi?=

=?us-ascii?Q?LkPxxuu37k7QDyM5NcBb9ddGfCt2SUKZ0LhW+SvzOvd4XJQwIUl/tCF00a3o?=

=?us-ascii?Q?VogQzCCvhPViczfoBU8mHQL4gFir0dsdrHyWyJSIa7LhiXG+OiKUKe0kqJBa?=

=?us-ascii?Q?l81UmqwXXF8aSJPA0bNwUpmxPnWACf4b2ysAUPHL/VIS51LjWsWMKBV2py5u?=

=?us-ascii?Q?uTiWxYyGZStsZTG2AqssSjUI3x03GHR8Xfjf+OIVKGsxUPj3anT9JzyhW5nC?=

=?us-ascii?Q?AbqGhdNzfy9Pk5DFbsEvczWE3ELGm3DI3SPNZJVyrbY/+KH6vdOCIdNJk9cD?=

=?us-ascii?Q?FBt0JYBn0OHupMtuOjC/AwC7/Kfotf8P34y2562c8xJ67/czjOlzFf1F1qjS?=

=?us-ascii?Q?7Io0gA0eakub9IcEj0FbD86l5/emiEo+S5OyvfZItEZPOjQVvJxsGxU4C7d8?=

=?us-ascii?Q?AUxRMT+EJa4ozA/8RENXWFlwU0DHIOGXNF83cIh+9fgwsaqBJiyERH7UOY+L?=

=?us-ascii?Q?zCneWkIyRoHGVTjztLyBsH8qwYLnBRGLasCQarlF0+SwoYJeaW7tvbHH724v?=

=?us-ascii?Q?rVsF2FIiRLgdKWw3hpNXC8MkU/HeQeXA?=

Content-Type: multipart/alternative;

boundary="_000_SN7PR19MB673332258CBED8FFA3F6E237AACF2SN7PR19MB6733namp_"

MIME-Version: 1.0

X-OriginatorOrg: sct-15-20-9412-4-msonline-outlook-990eb.templateTenant

X-MS-Exchange-CrossTenant-AuthAs: Internal

X-MS-Exchange-CrossTenant-AuthSource: SN7PR19MB6733.namprd19.prod.outlook.com

X-MS-Exchange-CrossTenant-RMS-PersistedConsumerOrg: 00000000-0000-0000-0000-000000000000

X-MS-Exchange-CrossTenant-Network-Message-Id: 1bc51ce0-01ab-4bd9-2f98-08dee95142cc

X-MS-Exchange-CrossTenant-originalarrivaltime: 24 Jul 2026 07:00:33.0611

(UTC)

X-MS-Exchange-CrossTenant-fromentityheader: Hosted

X-MS-Exchange-CrossTenant-id: 84df9e7f-e9f6-40af-b435-aaaaaaaaaaaa

X-MS-Exchange-CrossTenant-rms-persistedconsumerorg: 00000000-0000-0000-0000-000000000000

X-MS-Exchange-Transport-CrossTenantHeadersStamped: DM6PR19MB4245



--_000_SN7PR19MB673332258CBED8FFA3F6E237AACF2SN7PR19MB6733namp_

Content-Type: text/plain; charset="us-ascii"

Content-Transfer-Encoding: quoted-printable



Dear Sir/Madam,

Just reaching out to see if you need any website design, redesign, or devel=

opment services. We'd be happy to discuss how we can support your business.



________________________________

From: Siddharth Jaiswal

Sent: Wednesday, July 22, 2026 8:30 PM

To: Siddharth Jaiswal

Subject: Re: Affordable Web Design !



Hi,



I am a professional website design with over 8 years of graphic design and =

web experience. I make clean, creative designs done on time for a reasonabl=

e price.



I design new websites, UX-UI web design and development, graphic design, e-=

commerce platforms, other promotional related work.



If you are interested, then I can send you our Price list, company informat=

ion and an affordable quotation with the best offer.



Regards,

Siddharth Jaiswal





--_000_SN7PR19MB673332258CBED8FFA3F6E237AACF2SN7PR19MB6733namp_

Content-Type: text/html; charset="us-ascii"

Content-Transfer-Encoding: quoted-printable








>








y: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans=

-serif; font-size: 12pt; color: rgb(0, 0, 0);">

Dear Sir/Madam,



y: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans=

-serif; font-size: 12pt; color: rgb(0, 0, 0);">

Just reaching out to see if you need any website design, redesign, or devel=

opment services. We'd be happy to discuss how we can support your business.=




nt, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; c=

olor: rgb(0, 0, 0);">











yle=3D"font-size:11pt" color=3D"#000000">From: Siddharth Jaiswal <=

;siddharthjaiswals@hotmail.com>


Sent: Wednesday, July 22, 2026 8:30 PM


To: Siddharth Jaiswal <siddharthjaiswals@hotmail.com>


Subject: Re: Affordable Web Design !

 









nt,Aptos_MSFontService,Calibri,Helvetica,sans-serif; font-size:12pt; color:=

rgb(0,0,0)">

Hi,  



os_EmbeddedFont,Aptos_MSFontService,Calibri,Helvetica,sans-serif; font-size=

:12pt; color:rgb(0,0,0)">

 



os_EmbeddedFont,Aptos_MSFontService,Calibri,Helvetica,sans-serif; font-size=

:12pt; color:rgb(0,0,0)">

I am a professional website design with over 8 years of graphic design and =

web experience. I make clean, creative designs done on time for a reasonabl=

e price.  



os_EmbeddedFont,Aptos_MSFontService,Calibri,Helvetica,sans-serif; font-size=

:12pt; color:rgb(0,0,0)">

 



os_EmbeddedFont,Aptos_MSFontService,Calibri,Helvetica,sans-serif; font-size=

:12pt; color:rgb(0,0,0)">

I design new websites, UX-UI web design and development, graphic design, e-=

commerce platforms, other promotional related work.



os_EmbeddedFont,Aptos_MSFontService,Calibri,Helvetica,sans-serif; font-size=

:12pt; color:rgb(0,0,0)">

 



os_EmbeddedFont,Aptos_MSFontService,Calibri,Helvetica,sans-serif; font-size=

:12pt; color:rgb(0,0,0)">

If you are interested, then I can send you our Price list, company informat=

ion and an affordable quotation with the best offer.



os_EmbeddedFont,Aptos_MSFontService,Calibri,Helvetica,sans-serif; font-size=

:12pt; color:rgb(0,0,0)">

 



os_EmbeddedFont,Aptos_MSFontService,Calibri,Helvetica,sans-serif; font-size=

:12pt; color:rgb(0,0,0)">

Regards,



os_EmbeddedFont,Aptos_MSFontService,Calibri,Helvetica,sans-serif; font-size=

:12pt; color:rgb(0,0,0)">

Siddharth Jaiswal



ontService,Calibri,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">














--_000_SN7PR19MB673332258CBED8FFA3F6E237AACF2SN7PR19MB6733namp_--

OpenAI Phish from nxcli

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Fri, 24 Jul 2026 00:11:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wn96q-00000000BDR-2NJl

for dave@doctor.nl2k.ab.ca;

Fri, 24 Jul 2026 00:10:12 -0600

Resent-From: The Doctor

Resent-Date: Fri, 24 Jul 2026 00:10:12 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from cloudhost-1920808.us-midwest-1.nxcli.net ([8.29.155.178]:30920)

by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256

(Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wn7Ku-00000000PBo-2019

for doctor@doctor.nl2k.ab.ca;

Thu, 23 Jul 2026 22:16:43 -0600

Comment: DomainKeys? See http://domainkeys.sourceforge.net/

DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws;

s=default; d=8f7ff93830.nxcli.io;

b=lKlcWlNs5VFohHX3bvcVBGA1tlA5wStxa/oeSD/Vc1MjNrdoMbRG9l1a2aHAecBJywW6xZYcjAniIHv42q9voxGeIESUUgyrlG8QytQRfY5IT0Pkl+0kGgxxdjPlq2dKYm+GiIXoIcfWFMyuKnGvrDGqjZ/SSPjYK+T1hc2HPKBdxrSSdnoXzswhfam8vPLb+RhxDtcFReQZSyHgdIdx4HX+i9pacPSWkZEX4fF05Kgz3fLmgnNvxOuXh1cfLfsPHuTRpE2tBKju4q+4fb4KSfL/uR6ZSQ2v72rau+K5lr45uTHPV7KgFaKGQYnL5ZBP+U6A8oEC1ZfaajB0WcMm9A==;

h=Received:Date:Message-ID:To:Subject:X-PHP-Originating-Script:MIME-Version:Content-type:From:Reply-To;

DKIM-Signature: v=1; a=rsa-sha1; c=relaxed; d=8f7ff93830.nxcli.io; h=

date:message-id:to:subject:mime-version:content-type:from

:reply-to; s=default; bh=T5p1jW4K2aRE7vn0V5xSzH34Wc8=; b=BTpap+H

dZmXNCuvGBnrQGuBD0Q5TDPYEpIHO0qevhJ9tIlo8UVpcQ80Ejx/VFa9VYlwrFmY

JTR9yVn0ydwdDv2t64eo6P11f32NHTZVxSen9gYumFHFqM8tuS3rF0FEpWmPg34d

pzgow5+UL+4Ffwr8nFbk2E1MXPWFbDyfBICVBL+WDmvabDMVaZhBms5Ks9d2TWpF

ipWI/BtOi/fngbcVe09fecul5ZQWCJT3NEAm21biP7TBGnffm1ZdBb7AW9VIOoTD

jh/GjglAVhQm3qqfp9UkHAgclo7VA0nzppM+yCWAF3yApYL9ugDmP5GbbMpOWgwb

p40/tFBdKhLUsoA==

Received: (qmail 24092 invoked by uid 10252); 24 Jul 2026 04:14:01 +0000

Date: 24 Jul 2026 04:14:01 +0000

Message-ID: <20260724041401.24084.qmail@cloudhost-1920808.us-midwest-1.nxcli.net>

To: doctor@doctor.nl2k.ab.ca

Subject: Action Required: Please update your payment details

X-PHP-Originating-Script: 10252:info.php

MIME-Version: 1.0

Content-type: text/html; charset=UTF-8

From: ChatGPT

Reply-To: support@8f7ff93830.nxcli.io















ChatGPT Subscription Update









































OpenAI
Subscription Payment Declined


Hello,





We attempted to process your subscription payment for ChatGPT, but unfortunately, the payment was declined.





This may be due to an issue with your payment method. To continue enjoying uninterrupted access to ChatGPT Plus, please update your payment information.



































ChatGPT Plus Subscription $20.00
VAT (19%) $3.80
Total Due Today $23.80




*By subscribing, you agree to OpenAI's Terms of Use. You will be charged $23.80 monthly until you cancel.














Update Payment Details




If you have any questions or need help, feel free to contact our support team.


OpenAI Support





You received this because you requested a subscription update.





Help Center | Privacy Policy






OpenAI Phish from nxcli

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Fri, 24 Jul 2026 00:10:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wn96b-00000000B8O-1S3P

for dave@doctor.nl2k.ab.ca;

Fri, 24 Jul 2026 00:09:57 -0600

Resent-From: The Doctor

Resent-Date: Fri, 24 Jul 2026 00:09:57 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from [8.29.155.178] (port=35124 helo=cloudhost-1920808.us-midwest-1.nxcli.net)

by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256

(Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wn73I-00000000NSn-1ai7

for doctor@nl2k.ab.ca;

Thu, 23 Jul 2026 21:58:31 -0600

Comment: DomainKeys? See http://domainkeys.sourceforge.net/

DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws;

s=default; d=8f7ff93830.nxcli.io;

b=ioCJrSN9argsryvmq3FHeZsTdsNF8E5e9r0bajoBbDLP0rFJ7X10e7lABEN2y47qgPxZicBOc+9fzauzIlfPGmyRtx2KvdK4Z7LwxAE6wpD4Up2924n5LTduKyDs0Bm3MIQbtWcSSoA4s1i0dDlngi8O0VTJJf925GzVdd5Jj/kmzAtAjuXsdilraQIZL3213wYdvFEWPNQyLmGUNm2PMwUA0KEWagC/qsKAUtuSGqOYfW8SWpviU6BqLqZV1u+ynZEQL8vMhopv6wPPJzbzTA69Ovhueh+3yDv+cNeuZXhzxztIg3U7RwfTgEJYWzaedq5icemKuR4mqH3lv8USdw==;

h=Received:Date:Message-ID:To:Subject:X-PHP-Originating-Script:MIME-Version:Content-type:From:Reply-To;

DKIM-Signature: v=1; a=rsa-sha1; c=relaxed; d=8f7ff93830.nxcli.io; h=

date:message-id:to:subject:mime-version:content-type:from

:reply-to; s=default; bh=T5p1jW4K2aRE7vn0V5xSzH34Wc8=; b=hj3NWJ3

iOCVblcadZtGIT0Udh3iO5ZXO1GbfJVWRBaeayaVwJylscmzzIfDzpEQMbdUav/n

yBOlwNepR4Y+Z2rlGMuCzpZB1SWVbx9LOXqJ7y8tnDBgCsRYwIaXknwkGJ+OO82h

ot0xFT0IVAnto9zZsoAYPRjmINVMIBwmu25bfCheZ481oSKYBorvvEloFgV5N+fy

FhL+EsouaJvaNS/9LaM4eiar8RoccGSKnppiq0Ao56SPPg+2xfUsd53leeYGTsYf

NEI29SWhUG9NobUl3APt/ipJzDpQToiPSQWtvrFrAFkD7sAsinY+7PqIT3eciN4x

CHsC0lQY/Az3WNA==

Received: (qmail 7217 invoked by uid 10252); 24 Jul 2026 03:55:26 +0000

Date: 24 Jul 2026 03:55:26 +0000

Message-ID: <20260724035526.7209.qmail@cloudhost-1920808.us-midwest-1.nxcli.net>

To: doctor@nl2k.ab.ca

Subject: Action Required: Please update your payment details

X-PHP-Originating-Script: 10252:info.php

MIME-Version: 1.0

Content-type: text/html; charset=UTF-8

From: ChatGPT

Reply-To: support@8f7ff93830.nxcli.io















ChatGPT Subscription Update









































OpenAI
Subscription Payment Declined


Hello,





We attempted to process your subscription payment for ChatGPT, but unfortunately, the payment was declined.





This may be due to an issue with your payment method. To continue enjoying uninterrupted access to ChatGPT Plus, please update your payment information.



































ChatGPT Plus Subscription $20.00
VAT (19%) $3.80
Total Due Today $23.80




*By subscribing, you agree to OpenAI's Terms of Use. You will be charged $23.80 monthly until you cancel.














Update Payment Details




If you have any questions or need help, feel free to contact our support team.


OpenAI Support





You received this because you requested a subscription update.





Help Center | Privacy Policy






Intelcom Phish

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Fri, 24 Jul 2026 00:09:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wn95g-00000000B2g-3bjF

for dave@doctor.nl2k.ab.ca;

Fri, 24 Jul 2026 00:09:00 -0600

Resent-From: The Doctor

Resent-Date: Fri, 24 Jul 2026 00:09:00 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from [89.252.152.6] (port=51351 helo=srv.nacarmedya.com)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wn54Q-00000000BJ1-0pui

for sales@nk.ca;

Thu, 23 Jul 2026 19:51:39 -0600

Received: from 127.0.0.1 (unknown [196.119.23.177])

by srv.nacarmedya.com (Postfix) with ESMTPSA id 4A265FCC69

for ; Fri, 24 Jul 2026 04:50:32 +0300 (+03)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=turkishtextilefair.com; s=default; t=1784857833;

bh=Qha4otnuk8+m1R+ii7jQpfGe+Vru4MB9i07aE7ZXnUk=; h=To:From:Subject;

b=LEeAnsinnQK9KEViwOJKfqJfnZbPMDfbYveCukBmZDvxs7zKBNEyNKCLyU9S3J2lN

4pjFolIRlMDh1U6PqrlAGYdJGGRf1b3CabrNWxK4NDwCHF3/5u0BN5EUrehSuzjf+r

SmmD3MEj2UnWAVhCre4YO6iiYri3PRuVOAZRFXS0Kj0p6vW2UI/FpFmAzwfDyQUXZz

2YodjlmrfNEzXKyjPvl0P+RKtW5N4AcG53JVLIb1sYNZo5AWh90EN+ZEIxzqGcI/0V

tcmjERBfzqEkEWW7PhLJ7APfFznEYwWBfnN8A4Ue0glnsvlIfHLuSV6knxwmXn/sJm

DAPNy/19a69bQ==

Authentication-Results: srv.nacarmedya.com;

spf=pass (sender IP is 196.119.23.177) smtp.mailfrom=info@turkishtextilefair.com smtp.helo=127.0.0.1

Received-SPF: pass (srv.nacarmedya.com: connection is authenticated)

Date: Fri, 24 Jul 2026 03:47:55 +0200

To: sales@nk.ca

From: Intelcom

Subject: Intelcom Delivery Notification

Message-ID: <0535efe555f8aa3097b3437cbefbb1c6@turkishtextilefair.com>

MIME-Version: 1.0

Content-Type: multipart/alternative;

boundary="17c1fd1e81497652a6b439b10c6a23df8"

Content-Transfer-Encoding: 8bit



This is a multi-part message in MIME format.



--17c1fd1e81497652a6b439b10c6a23df8

Content-Type: text/plain; charset=UTF-8

Content-Transfer-Encoding: 8bit

















Intelcom



Dear Customer,





Goods imported into Canada may be subject to applicable duties and/or taxes. Carriers are authorized by the CBSA (Canada Border Services Agency) to process occasional shipments on behalf of the importer or owner and may remit applicable duties and taxes.

However, a parcel belonging to you has been held by customs due to missing declaration details from the sender. Please pay 2.96 CAD in duties and taxes as soon as possible using the button below:



Schedule my delivery



Thank you for choosing Intelcom.









This email was sent by an automated system. Please do not reply.

© 2026 Intelcom Express - Dragonfly Express. All rights reserved.





--17c1fd1e81497652a6b439b10c6a23df8

Content-Type: text/html; charset=UTF-8

Content-Transfer-Encoding: 8bit

































Intelcom
Dear Customer,


Goods imported into Canada may be subject to applicable duties and/or taxes. Carriers are authorized by the CBSA (Canada Border Services Agency) to process occasional shipments on behalf of the importer or owner and may remit applicable duties and taxes.



However, a parcel belonging to you has been held by customs due to missing declaration details from the sender. Please pay 2.96 CAD in duties and taxes as soon as possible using the button below:

Schedule my delivery
Thank you for choosing Intelcom.










This email was sent by an automated system. Please do not reply.



© 2026 Intelcom Express - Dragonfly Express. All rights reserved.









--17c1fd1e81497652a6b439b10c6a23df8--



Chinese products spam

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 23 Jul 2026 17:00:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wn2O1-00000000H4a-1pxf

for dave@doctor.nl2k.ab.ca;

Thu, 23 Jul 2026 16:59:29 -0600

Resent-From: The Doctor

Resent-Date: Thu, 23 Jul 2026 16:59:29 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from [210.79.60.70] (port=51618 helo=mail-m6070.netease.com)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wn2FK-00000000FXl-3g6q

for sales@nk.ca;

Thu, 23 Jul 2026 16:50:45 -0600

Content-Type: multipart/alternative; BOUNDARY="=_Part_146544_1970923275.1784846970996"

To: sales

Reply-To: sales23@abiscircuits.com

Subject: =?UTF-8?B?LlJlbGlhYmxlIFBDQkEgZm9yICB5b3VyIHByb2R1Y3QgUENCQSBTYWxlcw==?=

X-Priority: 3

MIME-Version: 1.0

Received: from diana@abiscircuits.cn( [10.139.4.160] ) by ajax-webmail ( [127.0.0.1] ) ; Fri, 24 Jul 2026 06:49:30 +0800 (GMT+08:00)

From: Diana

Date: Fri, 24 Jul 2026 06:49:30 +0800 (GMT+08:00)

X-WM-Tid: 0a9f912b70660696kunmbcdc05dd2f7fe

DKIM-Signature: a=rsa-sha256;

b=Ixr+2wRW+mjCLDmvQjnD+akK/bX1jxqF8Wbw1uqIXEQp2c0kjbR1qxqoJUy2/aD2BzlmfWW+cNvoNu4UFuAa14HLFDp63xhX5vGqFy7s5bgeuXajYu1JyaS3/Gt9y5pK+A23tol+xFe8+n78xr0h3TRJiXY6kNMNBptq4WtfHIg=; c=relaxed/relaxed; s=default; d=abisassembly.net; v=1;

bh=Z40VWDhn3V0cgQ5v/tXgZpi0mG98wd1LdsZHDJ4t8GA=;

h=date:mime-version:subject:message-id:from;

Message-ID:

X-Spam_score: 7.7

X-Spam_score_int: 77

X-Spam_bar: +++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Hi , Hoping you're doing well .This Diana from Abis circuits

the professional PCBA OEM . What this means for you is simply one more qualified

choice when you source PCBAs. A few facts about Abis that may help you decide

when the next RFQ lands:



Content analysis details: (7.7 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[210.79.60.70 listed in dnsbl.ahbl.org]

[210.79.60.70 listed in dnsbl.ahbl.org]

[210.79.60.70 listed in dnsbl.ahbl.org]

[210.79.60.70 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[210.79.60.70 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[210.79.60.70 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[210.79.60.70 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[210.79.60.70 listed in dnsbl.ahbl.org]

0.6 URIBL_SBL Contains an URL's NS IP listed in the SBL blocklist

[URI: ns14.xincache.com/112.80.181.111]

[URI: ns13.xincache.com/112.80.181.45]

-0.0 SPF_PASS SPF: sender matches SPF record

0.4 SALES_REPLY Your parents named you sales?

1.3 URI_HEX URI: URI hostname has long hexadecimal sequence

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_IMAGE_RATIO_06 BODY: HTML has a low ratio of text to image area

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

1.3 RDNS_NONE Delivered to internal network by a host with no rDNS

0.0 T_REMOTE_IMAGE Message contains an external image

Subject: {SPAM?} =?UTF-8?B?LlJlbGlhYmxlIFBDQkEgZm9yICB5b3VyIHByb2R1Y3QgUENCQSBTYWxlcw==?=



--=_Part_146544_1970923275.1784846970996

Content-Type: text/plain; charset="UTF-8"

Content-Transfer-Encoding: base64



SGkgLAogCkhvcGluZyB5b3UncmUgZG9pbmcgd2VsbCAuVGhpcyBEaWFuYSBmcm9tIEFiaXMgY2ly

Y3VpdHMgdGhlIHByb2Zlc3Npb25hbCBQQ0JBIE9FTSAuCiAKV2hhdCB0aGlzIG1lYW5zIGZvciB5

b3UgaXMgc2ltcGx5IG9uZSBtb3JlIHF1YWxpZmllZCBjaG9pY2Ugd2hlbiB5b3Ugc291cmNlIFBD

QkFzLiBBIGZldyBmYWN0cyBhYm91dCBBYmlzIHRoYXQgbWF5IGhlbHAgeW91IGRlY2lkZSB3aGVu

IHRoZSBuZXh0IFJGUSBsYW5kczoKIAotIDE0IFNNVCBsaW5lIHRvIG1lZXQgdGhlIGxlYWQgdGlt

ZSByZXF1aXJtZW50IG9mIG91ciBjdXN0b21lciAuCi0gUHJvZmVzc2lvbmFsIGVuZ2luZWVyIGFu

ZCBwdXJjaGFzaW5nIHRlYW0gY2FuIHJlcGxhY2UgdGhlIGNvbXBvZW5lbnQgd2l0aCAxMDAlIGFs

dGVybmF0aXZlIGFuZCBzYXZlIHRoZSBjb3N0IGZvciB5b3UgLgotIEluLWhvdXNlIGNvbmZvcm1h

bCBjb2F0aW5nLCBmdW5jdGlvbmFsIHRlc3QsIGFuZCBib3gtYnVpbGQKLSBEaXJlY3QgZnJhbmNo

aXNlZCBjaGFubmVscyBmb3IgVEksIEFESSwgTXVyYXRhLCBhbmQgb3RoZXJzCiAKSGVyZSBpcyB0

aGUgQWJpcyBjb21wYW55IHByZXNlbnRhdGlvbiBmb3IgeW91ciByZWZlcmVuY2UgLgogClRoYW5r

IHlvdSBmb3IgdGhlIHRydXN0IHlvdeKAmXZlIHBsYWNlZCBpbiBtZSBvdmVyIHRoZSB5ZWFyc+KA

lEnigJltIGVhZ2VyIHRvIGtlZXAgZWFybmluZyBpdC4KIAogCiAKCgoKRGlhbmEgRGFpClByb2pl

Y3QgUmVwcmVzZW50YXRpdmUgfCBBQklTIENpcmN1aXRzIENvLiwgTHRkCiAKUmlnaWQgUENCLCBG

bGV4IFBDQiwgUmlnaWQtRmxleCAxfjMyIExheWVyIFBDQiwgTWV0YWwgUENCLCBIREkgUENCLCBQ

Q0JBCk1vYmlsZSAvIFdoYXRzYXBwIC8gV2VjaGF0OiArODYgMTM1MTA3NTQ3NTMKRW1haWw6IHNh

bGVzMjNAYWJpc2NpcmN1aXRzLmNvbSAvIGRpYW5hQGFiaXNjaXJjdWl0cy5jbgpXZWJzaXRlOiBh

YmlzY2lyY3VpdHMuY29tCgogICAgCgoK

--=_Part_146544_1970923275.1784846970996

Content-Type: text/html; charset="UTF-8"

Content-Transfer-Encoding: base64



Hi ,







Hoping you're doing well .This Diana from Abis circuits the professional PCBA OEM .







What this means for you is simply one more qualified choice when you source PCBAs. A few facts about Abis that may help you decide when the next RFQ lands:







- 14 SMT line to meet the lead time requirment of our customer .



- Professional engineer and purchasing team can replace the compoenent with 100% alternative and save the cost for you .



- In-house conformal coating, functional test, and box-build



- Direct franchised channels for TI, ADI, Murata, and others







Here is the Abis company presentation for your reference .







Thank you for the trust you’ve placed in me over the years—I’m eager to keep earning it.









Diana Dai

Project Representative | ABIS Circuits Co., Ltd



Rigid PCB, Flex PCB, Rigid-Flex 1~32 Layer PCB, Metal PCB, HDI PCB, PCBA

Mobile / Whatsapp / Wechat: +86 13510754753

Email: sales23@abiscircuits.com / diana@abiscircuits.cn

Website: abiscircuits.com







Remittance phish from Google Gmail

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 23 Jul 2026 16:34:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wn1ya-000000002E0-1cXm

for dave@doctor.nl2k.ab.ca;

Thu, 23 Jul 2026 16:33:12 -0600

Resent-From: The Doctor

Resent-Date: Thu, 23 Jul 2026 16:33:12 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-oa1-f101.google.com ([209.85.160.101]:44102)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wn1gy-00000000BHt-2iDD

for doctor@mail.nl2k.ab.ca;

Thu, 23 Jul 2026 16:15:08 -0600

Received: by mail-oa1-f101.google.com with SMTP id 586e51a60fabf-44cb057311bso405782fac.0

for ; Thu, 23 Jul 2026 15:14:13 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=sabeng.it; s=google; t=1784844847; x=1785449647; darn=mail.nl2k.ab.ca;

h=content-type:mime-version:date:content-transfer-encoding:message-id

:subject:to:from:from:to:cc:subject:date:message-id:reply-to

:content-type;

bh=2Qd++MhFVn/+JzWjUONsUGSuFncRBpZ1V7WcMOzblGY=;

b=ODdc/RMoHdFInbVC7Mi3Q6apajWjPx/gJQbcmd960yKolcTiitx8jjnue6STzIQigS

hSwTYFsk8bhPNX+iJ1IAc6dwKSO9OLAVjTCF37130yXsryi5zr3TNFNJHtwMVSXhADnP

6Tb7nEj6F53FhbrjEFFSmRXJj06V2fF0YLL4E=

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20251104; t=1784844847; x=1785449647;

h=content-type:mime-version:date:content-transfer-encoding:message-id

:subject:to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date

:message-id:reply-to:content-type;

bh=2Qd++MhFVn/+JzWjUONsUGSuFncRBpZ1V7WcMOzblGY=;

b=XvjnEE250Fd8QuuH++5qXnAuC7CMDmi45HDbhNy/YxKbuFirPbTcfFat4H6h14b/VQ

2hX8qkKH4rvzKLaltX0Xcp2gJISFE1jI+snHzrlbRCgGJhglG+C0C4576mHx28MtVeLE

6Elp1Nw8Hgidw4Hd/ixAJA7xBpmZbtS8PTg4iglgYHQ+5VeDf4lt9oad0RHspVQoomYR

UMBaL4TsNSrm3DQ1DL4+eqJJynQIZKCNJm1oK5L9OvgE7pqVGdcMXHhFbYNmYhRP3kMM

p8P27bhLGksCNCzfLN3xljP6tKYCa3YBzi3E9Eszfhx9R91nYeAAglb+bYR6SBBVk7Xq

Kifw==

X-Gm-Message-State: AOJu0YzVZK5Z+D9oCQMvx26gdS8vGgTh6e/9lOM6uJQEi4DbzpEnrIuD

om5iFk6VsRc+LAilM4MP0PwMD2gpFFyLqM0HKsKOWbkoQnTMRpsQU2zt01Hg6QrsIszYKve1Qqw

VPI1w1tyu3XNKuRpGyZOL8tHNvNfCyJi1xivWkWiMTVc+geU=

X-Gm-Gg: AR+sD12OqfLOr93p8lOq7OLA5Q1ljX2I4Mi50i6AyFBp0q2hxXTJ8B+PRBZPYsf69Uh

fT0RS9y10raKMK+1V3yoW15Doo8pQ6Gl66weQZCI1cLzVZ1UhDBgUfXRX4zf2PKGDRLAXGds+I6

WhGT47ztMNN+CucgrBvuvEYVa1SvsiUXzn4lT5Ti+8+ZDlJNKxGhiY80hyQ4K5y4fyUU/QFtZeo

A/d7vKDITcYweiUHIIhmPx9F5/pkVachjl/vsJSzHXI20jmFNU0g9P4YNfcZIYro514HvuAHWLx

BmMvfpOLR43NnL9gFeyscP5D1U4yXTT5nXzvwBlHPzJt4A7EIOEbDm2eWo0eiLm5ENE7Grejrzz

Q4iVRy/TxqmM=

X-Received: by 2002:a05:6870:3196:b0:457:8533:a16f with SMTP id 586e51a60fabf-457a10a7e5dmr2681197fac.32.1784844847392;

Thu, 23 Jul 2026 15:14:07 -0700 (PDT)

Received: from sabprogetti.com ([192.210.236.148])

by smtp-relay.gmail.com with ESMTPS id 586e51a60fabf-45766e2846dsm361125fac.2.2026.07.23.15.14.07

for

(version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256);

Thu, 23 Jul 2026 15:14:07 -0700 (PDT)

X-Relaying-Domain: sabeng.it

From: "Payroll@remittance.com|Schedule| Sign_Online/OU=EXCHANGE

ADMINISTRATIVE GROUP

(FYDIBOHF23SPDLT)/CN=RECIPIENTS/CN=B7A707497B564FD-07320"



To: doctor@mail.nl2k.ab.ca

Subject: =?UTF-8?Q?ACH_Funds_Transfer_Notification_?=

=?UTF-8?Q?=EF=BF=BD_July_12=2C_2026_=EF=BF=BD_07/2?=

=?UTF-8?Q?3/2026_=EF=BF=BD_doctor=40mail=2Enl2k=2E?= =?UTF-8?Q?ab=2Eca?=

Message-ID: <3c5c7e77-d3ad-c6cf-320c-426d764b1b77@sabeng.it>

Content-Transfer-Encoding: quoted-printable

Date: Thu, 23 Jul 2026 22:14:05 +0000

MIME-Version: 1.0

Content-Type: text/html; charset=utf-8

X-Spam_score: 6.5

X-Spam_score_int: 65

X-Spam_bar: ++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview:  Payment Due: 23/07/2026 033847 Amount Paid: $2,355.00



Content analysis details: (6.5 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[192.210.236.148 listed in dnsbl.ahbl.org]

[192.210.236.148 listed in dnsbl.ahbl.org]

[192.210.236.148 listed in dnsbl.ahbl.org]

[192.210.236.148 listed in dnsbl.ahbl.org]

[209.85.160.101 listed in dnsbl.ahbl.org]

[209.85.160.101 listed in dnsbl.ahbl.org]

[209.85.160.101 listed in dnsbl.ahbl.org]

[209.85.160.101 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[192.210.236.148 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[192.210.236.148 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[192.210.236.148 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[192.210.236.148 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[192.210.236.148 listed in will-spam-for-food.eu.org]

[192.210.236.148 listed in will-spam-for-food.eu.org]

[192.210.236.148 listed in will-spam-for-food.eu.org]

[192.210.236.148 listed in will-spam-for-food.eu.org]

[192.210.236.148 listed in will-spam-for-food.eu.org]

[192.210.236.148 listed in will-spam-for-food.eu.org]

[192.210.236.148 listed in will-spam-for-food.eu.org]

[192.210.236.148 listed in will-spam-for-food.eu.org]

[209.85.160.101 listed in will-spam-for-food.eu.org]

[209.85.160.101 listed in will-spam-for-food.eu.org]

[209.85.160.101 listed in will-spam-for-food.eu.org]

[209.85.160.101 listed in will-spam-for-food.eu.org]

[209.85.160.101 listed in will-spam-for-food.eu.org]

[209.85.160.101 listed in will-spam-for-food.eu.org]

[209.85.160.101 listed in will-spam-for-food.eu.org]

[209.85.160.101 listed in will-spam-for-food.eu.org]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

1.2 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a relay in bl.spamcop.net

[Blocked - see ]

-0.0 SPF_PASS SPF: sender matches SPF record

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[209.85.160.101 listed in list.dnswl.org]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[209.85.160.101 listed in bl.score.senderscore.com]

-0.0 RCVD_IN_MSPIKE_H3 RBL: Good reputation (+3)

[209.85.160.101 listed in wl.mailspike.net]

0.0 HTML_MESSAGE BODY: HTML included in message

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

-0.0 RCVD_IN_MSPIKE_WL Mailspike good senders

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

0.0 NO_RDNS2 Sending MTA has no reverse DNS

0.6 HTML_MIME_NO_HTML_TAG HTML-only message, but there is no HTML tag

2.0 RATWR8_MESSID Message-ID with excessive dashes and dollars

0.0 LOTS_OF_MONEY Huge... sums of money

Subject: {SPAM?} =?UTF-8?Q?ACH_Funds_Transfer_Notification_?=

=?UTF-8?Q?=EF=BF=BD_July_12=2C_2026_=EF=BF=BD_07/2?=

=?UTF-8?Q?3/2026_=EF=BF=BD_doctor=40mail=2Enl2k=2E?= =?UTF-8?Q?ab=2Eca?=



=EF=BB=BF


 




, 255, 255);color:rgb(34, 34, 34);font-family:Arial, Helvetica, =

sans-serif;font-size:small;font-style:normal;font-variant-caps:normal;font-=

variant-ligatures:normal;font-weight:400;letter-spacing:normal;orphans:2;te=

xt-align:start;text-decoration-color:initial;text-decoration-style:initial;=

text-decoration-thickness:initial;text-indent:0px;text-transform:none;white=

-space:normal;widows:2;word-spacing:0px;" type=3D"cite">




t;" id=3D"m_-2910760642012011069m_467061415371348611m_4273285105508718137m_=

-599886662404354667editbody1">


7061415371348611m_4273285105508718137m_-599886662404354667v1editbody1">


m_467061415371348611m_4273285105508718137m_-599886662404354667v1v1editbody1=

">






-width:0px;font-family:Arial, Helvetica, sans-serif;font-feature-settings:&=

quot;liga" 0;font-size:small;line-height:normal;" cellspacing=3D"0" =

width=3D"553">




























10, 139, 168);border-width:0px;margin:0px;padding:0in;vertical-align:top;" =

colspan=3D"3">




style=3D"border-collapse:collapse;border-width:0px;font-family:-apple-syste=

m, BlinkMacSystemFont, "Helvetica Neue", "Segoe UI", =

Arial, sans-serif, "Apple Color Emoji", "Segoe UI =

Emoji", "Segoe UI Symbol";font-feature-settings:"liga&q=

uot; 0;font-size:13px;line-height:normal;" cellspacing=3D"0">




style=3D"height:5.25pt;">














style=3D"border-width:0px;height:5.25pt;margin:0px;padding:0in;"> 
>


style=3D"border-width:0px;margin:0px;padding:0in;width:0.25in;" =

width=3D"24"> 
style=3D"border-width:0px;margin:0px;padding:0in;">


style=3D"font-family:-apple-system, BlinkMacSystemFont, "Helvetica =

Neue", "Segoe UI", Arial, sans-serif, "Apple Color =

Emoji", "Segoe UI Emoji", "Segoe UI =

Symbol";margin:0px;">
sans-serif;font-size:13.5pt;">   





92, 208, 228);border-width:0px;margin:0px;padding:0in;width:1.5pt;" =

width=3D"2"> 
n:0px;padding:0in;">




style=3D"border-collapse:collapse;border-width:0px;font-family:-apple-syste=

m, BlinkMacSystemFont, "Helvetica Neue", "Segoe UI", =

Arial, sans-serif, "Apple Color Emoji", "Segoe UI =

Emoji", "Segoe UI Symbol";font-feature-settings:"liga&q=

uot; 0;font-size:13px;line-height:normal;" cellspacing=3D"0">












style=3D"background-color:rgb(230, 236, 244);border-width:0px;margin:0px;pa=

dding:0in;width:411.75pt;" width=3D"549">


class=3D"table" style=3D"width:411.75pt;">


style=3D"border-collapse:collapse;border-width:0px;font-family:-apple-syste=

m, BlinkMacSystemFont, "Helvetica Neue", "Segoe UI", =

Arial, sans-serif, "Apple Color Emoji", "Segoe UI =

Emoji", "Segoe UI Symbol";font-feature-settings:"liga&q=

uot; 0;line-height:normal;" cellspacing=3D"0" width=3D"549">

=



=



=



=



=



=



=



=



=



=



=



=



=



=



=


width=3D"24"> 
p;">

=


"Helvetica Neue", "Segoe UI", Arial, sans-serif, =

"Apple Color Emoji", "Segoe UI Emoji", "Segoe UI =

Symbol";margin:0px;">

64);font-family:Helvetica, sans-serif;font-size:13.5pt;">Payment&nb=

sp;   
style=3D"color:rgb(231,123,7);font-family:Helvetica, sans-serif;font-size:7=

.5pt;">Due: 23/07/2026

168);font-family:Helvetica, sans-serif;font-size:10.=

5pt;">033847



=
ttom;">

=


"Helvetica Neue", "Segoe UI", Arial, sans-serif, =

"Apple Color Emoji", "Segoe UI Emoji", "Segoe UI =

Symbol";margin:0px;text-align:right;">
62);font-family:Helvetica, sans-serif;font-size:10.5pt;">Amount =

Paid:  
62);font-family:Helvetica, sans-serif;font-size:22.5pt;">$2,355.=

00



=
width=3D"24"> 
=

 		 =

 		 =

 		 =

 









system, BlinkMacSystemFont, "Helvetica Neue", "Segoe =

UI", Arial, sans-serif, "Apple Color Emoji", "Segoe UI =

Emoji", "Segoe UI Symbol";margin:0px;"> 




style=3D"width:411.75pt;">


style=3D"border-collapse:collapse;border-width:0px;font-family:-apple-syste=

m, BlinkMacSystemFont, "Helvetica Neue", "Segoe UI", =

Arial, sans-serif, "Apple Color Emoji", "Segoe UI =

Emoji", "Segoe UI Symbol";font-feature-settings:"liga&q=

uot; 0;font-size:13px;line-height:normal;" cellspacing=3D"0" =

width=3D"549">












style=3D"border-width:0px;margin:0px;padding:0in;vertical-align:top;">


class=3D"table" style=3D"width:411.75pt;">


style=3D"border-bottom-style:solid;border-bottom-width:3pt;border-collapse:=

collapse;border-color:initial;border-left-style:none;border-left-width:medi=

um;border-right-style:none;border-right-width:medium;border-top-style:none;=

border-top-width:medium;font-family:-apple-system, BlinkMacSystemFont, =

"Helvetica Neue", "Segoe UI", Arial, sans-serif, =

"Apple Color Emoji", "Segoe UI Emoji", "Segoe UI =

Symbol";font-feature-settings:"liga" 0;line-height:normal;" =

cellspacing=3D"0" width=3D"549">

=



=



=



=



=



=



=



=


"Helvetica Neue", "Segoe UI", Arial, sans-serif, =

"Apple Color Emoji", "Segoe UI Emoji", "Segoe UI =

Symbol";line-height:12pt;margin:0px;">
tica, sans-serif;font-size:10.5pt;">Hello 
style=3D"font-family:Arial, Helvetica, sans-serif;font-size:small;">Dear =

Customer,
sans-serif;font-size:10.5pt;">,



=


"Helvetica Neue", "Segoe UI", Arial, sans-serif, =

"Apple Color Emoji", "Segoe UI Emoji", "Segoe UI =

Symbol";line-height:12pt;margin:0px;"> 



=


"Helvetica Neue", "Segoe UI", Arial, sans-serif, =

"Apple Color Emoji", "Segoe UI Emoji", "Segoe UI =

Symbol";line-height:12pt;margin:0px;">
tica, sans-serif;font-size:10.5pt;">Payment has been remitted into your =

account with receipt for your reference.



=


"Helvetica Neue", "Segoe UI", Arial, sans-serif, =

"Apple Color Emoji", "Segoe UI Emoji", "Segoe UI =

Symbol";line-height:12pt;margin:0px;"> 



=


"Helvetica Neue", "Segoe UI", Arial, sans-serif, =

"Apple Color Emoji", "Segoe UI Emoji", "Segoe UI =

Symbol";line-height:12pt;margin:0px;">
(110, 139, 168);border-radius:4px;color:white;display:inline-block;font-fam=

ily:Helvetica, sans-serif;font-size:10.5pt;padding:8px =

16px;text-decoration-line:none;" href=3D"https://laviestudio.com.br/r.=

php">VIEW PAYMENT RECEIPT



=


"Helvetica Neue", "Segoe UI", Arial, sans-serif, =

"Apple Color Emoji", "Segoe UI Emoji", "Segoe UI =

Symbol";line-height:12pt;margin:0px;"> 



=


"Helvetica Neue", "Segoe UI", Arial, sans-serif, =

"Apple Color Emoji", "Segoe UI Emoji", "Segoe UI =

Symbol";line-height:12pt;margin:0px;">
tica, sans-serif;font-size:10.5pt;">Thank you for your business.=



Sincerely,

Finance Department



=



=





class=3D"table">


style=3D"border-collapse:collapse;border-width:0px;font-family:-apple-syste=

m, BlinkMacSystemFont, "Helvetica Neue", "Segoe UI", =

Arial, sans-serif, "Apple Color Emoji", "Segoe UI =

Emoji", "Segoe UI Symbol";font-feature-settings:"liga&q=

uot; 0;line-height:normal;" cellspacing=3D"0">

=



=



=



=



=



=

=

 









92, 208, 228);border-width:0px;margin:0px;padding:0in;width:1.5pt;" =

width=3D"2"> 

1, 50, 70);border-width:0px;margin:0px;padding:0in;" colspan=3D"3">


system, BlinkMacSystemFont, "Helvetica Neue", "Segoe =

UI", Arial, sans-serif, "Apple Color Emoji", "Segoe UI =

Emoji", "Segoe UI Symbol";margin:0px;text-align:right;">&nbs=

p;