Chinese products spam

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Sun, 10 May 2026 19:23:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1wMFLZ-00000000Fs5-129e

for dave@doctor.nl2k.ab.ca;

Sun, 10 May 2026 19:22:13 -0600

Resent-From: The Doctor

Resent-Date: Sun, 10 May 2026 19:22:13 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-m82120.xmail.ntesmail.com ([156.224.82.120]:33194)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1wMExS-00000000E3K-2Oa1

for sales@nk.ca;

Sun, 10 May 2026 18:57:28 -0600

Content-Type: multipart/alternative; BOUNDARY="=_Part_2065009_1892086343.1778460980326"

To: sales

Subject: =?UTF-8?B?UmU6IFN1YmplY3Q6IEVsZXZhdGUgWW91ciBUZXh0aWxlIEZpbmlzaGluZyB3aXRoIE91ciBTaWxpY29uZSBPaWwgU29sdXRpb25z?=

X-Priority: 3

MIME-Version: 1.0

Received: from eddy@zjdschem.com( [10.139.0.42] ) by ajax-webmail ( [127.0.0.1] ) ; Mon, 11 May 2026 08:56:20 +0800 (GMT+08:00)

From: Eddy Zhang

Date: Mon, 11 May 2026 08:56:20 +0800 (GMT+08:00)

X-WM-Tid: 0a9e1488f454d0c1kusy4abcc25829a175

DKIM-Signature: a=rsa-sha256;

b=dL877Jpl6iswKAYDsGuhxuC3QkpD7IdMgFrk6c5dqYLviQAYwgSphjpxBgQA9AgVE2UHK3pMIvuf9SQFQ29VFUgnbF02VzIpt8hL7YPoFaLe4yPdDYp9Nt0uDEKVgQtkEv2AZTjT1dP8Ma3cE4PPfZnkg22v17+B/pd3gfY2EvE=; s=default; c=relaxed/relaxed; d=zjdschem.com; v=1;

bh=icMEiOdKn7zsJXjHKEtF0ZxqqjsienEGf3QTb0rHULY=;

h=date:mime-version:subject:message-id:from;

Message-ID:







Dear sales,











I hope this email finds you well. My name is Eddy Zhang, Foreign Trade Sales at Dongyang Desheng Dyeing Textile Auxiliary Co., Ltd. Established in 2010, we have over a decade of experience in producing innovative textile auxiliaries. Our manufacturing base in Jiangbei Industrial Zone, Zhejiang Province, supports a modern production, sales, and after-sales service chain.







We specialize in high-quality silicone oil and levelling agents, designed to enhance the resilience, softness, and smoothness of various fabrics. Our products offer excellent stability, non-stick properties, and are APEO-free, ensuring compliance with environmental safety regulations. We proudly serve clients in Pakistan, Bangladesh, Vietnam, Malaysia, and beyond.







I would love to discuss how our customized solutions can benefit your textile finishing processes. Looking forward to future cooperation.











Best regards,









DONGYANG DESHENG

DYEING AUXILIARIES CO., LTD

Eddy Zhang

Foreign Trade Department

TEL: 86 152 6862 5008 (Whatsapp/Wechat/Facebook )

MAIL: eddy@zjdschem.com



If you don't want to receive our emails, you can easily unsubscribe here.

nigerian spam

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Sun, 10 May 2026 19:34:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1wMFWg-00000000Gkq-19rA

for dave@doctor.nl2k.ab.ca;

Sun, 10 May 2026 19:33:42 -0600

Resent-From: The Doctor

Resent-Date: Sun, 10 May 2026 19:33:42 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail.sf.kg ([212.112.102.195]:60628)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.98.2 (FreeBSD))

(envelope-from <402.a.mergenbaev@sf.kg>)

id 1wMFTr-00000000GUE-3M5y

for root@doctor.nl2k.ab.ca;

Sun, 10 May 2026 19:30:58 -0600

Received: from localhost (localhost [127.0.0.1])

by mail.sf.kg (Postfix) with ESMTP id 558184E52F5DD;

Thu, 7 May 2026 03:10:42 +0600 (+06)

Received: from mail.sf.kg ([127.0.0.1])

by localhost (mail.sf.kg [127.0.0.1]) (amavisd-new, port 10032)

with ESMTP id t_5EV46rP4Td; Thu, 7 May 2026 03:10:42 +0600 (+06)

Received: from localhost (localhost [127.0.0.1])

by mail.sf.kg (Postfix) with ESMTP id A55DA4B8415EA;

Tue, 5 May 2026 15:43:40 +0600 (+06)

DKIM-Filter: OpenDKIM Filter v2.10.3 mail.sf.kg A55DA4B8415EA

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=sf.kg;

s=763E2812-1931-11ED-B42E-810EFC213C9A; t=1777974221;

bh=Q7u3W1l6fOkhqUwZfSiyOSpUzD78w1fMysfzAzQvXBc=;

h=MIME-Version:To:From:Date:Message-Id;

b=hu9G/syPsmsmBAD0qKXag0TcMZxj6l021NeYAi7DjXy99IbTMe0+OH+NffIurYxjG

BbZMjAelxCus+aYVf7RVY/oijhpqAdZ0DTpkz44aJEPY3ENo2X5aeoUqCNnEsl6sj8

MuBBZCNrOebH464QlO0eCygv8a5SAju+4Kmf0MVEBmjoyzvOdd2LuOB5VajFwPiZrS

W2jAaEyUPNB2BwMpYYMB9Ae/wBRC2nRHtE8biA7XZ/frifrSClRU5rdTuyI2w3IRDy

VOb0qQyvYrUwX7dYJYpfN4HchKffhA3Ji1pp7D9UFyC5dkV2OJUVWAV5+jJmDLwzGE

3hlaOlGsKvRHQ==

X-Virus-Scanned: amavisd-new at sf.kg

Received: from mail.sf.kg ([127.0.0.1])

by localhost (mail.sf.kg [127.0.0.1]) (amavisd-new, port 10026)

with ESMTP id BtmJrpxaXr35; Tue, 5 May 2026 15:43:40 +0600 (+06)

Received: from [194.59.31.250] (unknown [194.59.31.250])

by mail.sf.kg (Postfix) with ESMTPSA id EE0494AD49CF0;

Tue, 5 May 2026 11:01:44 +0600 (+06)

Content-Type: multipart/alternative; boundary="===============2146471402=="

MIME-Version: 1.0

Subject: Re: I need your help now

To: Recipients <402.a.mergenbaev@sf.kg>

From: " Olena Shevchenko" <402.a.mergenbaev@sf.kg>

Date: Tue, 05 May 2026 06:38:49 -0700

Reply-To: olenashev1@amail.az

Message-Id: <20260505050145.EE0494AD49CF0@mail.sf.kg>

X-Spam_score: 8.4

X-Spam_score_int: 84

X-Spam_bar: ++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Hi, I am a Ukrainian, I have funds for investment, can i trust

you to guide me invest in your country? Please help me. Ole.



Content analysis details: (8.4 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[194.59.31.250 listed in dnsbl.ahbl.org]

[194.59.31.250 listed in dnsbl.ahbl.org]

[194.59.31.250 listed in dnsbl.ahbl.org]

[194.59.31.250 listed in dnsbl.ahbl.org]

[212.112.102.195 listed in dnsbl.ahbl.org]

[212.112.102.195 listed in dnsbl.ahbl.org]

[212.112.102.195 listed in dnsbl.ahbl.org]

[212.112.102.195 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[194.59.31.250 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[194.59.31.250 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[194.59.31.250 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[194.59.31.250 listed in dnsbl.ahbl.org]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-0.0 SPF_PASS SPF: sender matches SPF record

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[212.112.102.195 listed in bl.score.senderscore.com]

2.6 RCVD_IN_MSPIKE_L5 RBL: Very bad reputation (-5)

[212.112.102.195 listed in bl.mailspike.net]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[212.112.102.195 listed in will-spam-for-food.eu.org]

[212.112.102.195 listed in will-spam-for-food.eu.org]

[212.112.102.195 listed in will-spam-for-food.eu.org]

[212.112.102.195 listed in will-spam-for-food.eu.org]

[212.112.102.195 listed in will-spam-for-food.eu.org]

[212.112.102.195 listed in will-spam-for-food.eu.org]

[212.112.102.195 listed in will-spam-for-food.eu.org]

[212.112.102.195 listed in will-spam-for-food.eu.org]

[194.59.31.250 listed in will-spam-for-food.eu.org]

[194.59.31.250 listed in will-spam-for-food.eu.org]

[194.59.31.250 listed in will-spam-for-food.eu.org]

[194.59.31.250 listed in will-spam-for-food.eu.org]

[194.59.31.250 listed in will-spam-for-food.eu.org]

[194.59.31.250 listed in will-spam-for-food.eu.org]

[194.59.31.250 listed in will-spam-for-food.eu.org]

[194.59.31.250 listed in will-spam-for-food.eu.org]

-0.0 SPF_HELO_PASS SPF: HELO matches SPF record

0.0 RCVD_IN_MSPIKE_BL Mailspike blacklisted

0.5 NO_RDNS Sending MTA has no reverse DNS (Postfix variant)

1.0 FROMSPACE Idiosyncratic "From" header format

0.6 FROM_STARTS_WITH_NUMS From: starts with several numbers

2.4 DATE_IN_FUTURE_03_06 Date: is 3 to 6 hours after Received: date

-0.0 T_RP_MATCHES_RCVD Envelope sender domain matches handover relay

domain

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

0.0 NO_RDNS2 Sending MTA has no reverse DNS

Subject: {SPAM?} Re: I need your help now



You will not see this in a MIME-aware mail reader.

--===============2146471402==

Content-Type: text/plain; charset="iso-8859-1"

MIME-Version: 1.0

Content-Transfer-Encoding: quoted-printable

Content-Description: Mail message body



Hi, I am a Ukrainian, I have funds for investment, can i trust you to guide=

me invest in your country? =





Please help me.



Ole.



--===============2146471402==

Content-Type: text/html; charset="iso-8859-1"

MIME-Version: 1.0

Content-Transfer-Encoding: quoted-printable

Content-Description: Mail message body




=3Diso-8859-1"/>


serif; COLOR: black">Hi, I am a Ukrainian, I have funds for investment, can=

i trust you to guide me invest in your country?

Please help me.
>
Ole.



--===============2146471402==--

Nigerian spam

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Sun, 10 May 2026 19:34:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1wMFWY-00000000GkG-1Q6y

for dave@doctor.nl2k.ab.ca;

Sun, 10 May 2026 19:33:34 -0600

Resent-From: The Doctor

Resent-Date: Sun, 10 May 2026 19:33:34 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail.sf.kg ([212.112.102.195]:60554)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.98.2 (FreeBSD))

(envelope-from <402.a.mergenbaev@sf.kg>)

id 1wMFTr-00000000GSx-3M3Z

for root@mail.nl2k.ab.ca;

Sun, 10 May 2026 19:30:58 -0600

Received: from localhost (localhost [127.0.0.1])

by mail.sf.kg (Postfix) with ESMTP id AA24A4E55D0C4;

Thu, 7 May 2026 03:10:42 +0600 (+06)

Received: from mail.sf.kg ([127.0.0.1])

by localhost (mail.sf.kg [127.0.0.1]) (amavisd-new, port 10032)

with ESMTP id Wp0ZCr-VwuCW; Thu, 7 May 2026 03:10:42 +0600 (+06)

Received: from localhost (localhost [127.0.0.1])

by mail.sf.kg (Postfix) with ESMTP id 76A644454E2F8;

Tue, 5 May 2026 15:43:41 +0600 (+06)

DKIM-Filter: OpenDKIM Filter v2.10.3 mail.sf.kg 76A644454E2F8

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=sf.kg;

s=763E2812-1931-11ED-B42E-810EFC213C9A; t=1777974222;

bh=Q7u3W1l6fOkhqUwZfSiyOSpUzD78w1fMysfzAzQvXBc=;

h=MIME-Version:To:From:Date:Message-Id;

b=ElOKzD5Dx/8PYo/I5nufVL0isO3wILs89xfgPEXl0i0b5ViFeKAsuX7QrPnQFIVD8

qkoolFaWmxGalW+rffhkxAbPwehd7z6fAgmgMyD3LnZbsiIyqW6ymoxNWl7r/LGlyZ

MOF20cIlpXKGX7D+Fh0EsKJhDxokhm7b7CJW2+kC68Z9eghvTwO3m7xKNjZwaX+1LE

0/jQt9aCEaJEtYJkqPpP4AYuT0WopvV903gIN4PvbdCslUv4D1cx5Q0lUFWJDWVqhx

ydhYZSxBgyvSTYi5PLbvU4dHodBxMDASYcnOtnWHbWxAIGnUKJybnHCvMRt+6azSv6

3U/uPVjmyHMJg==

X-Virus-Scanned: amavisd-new at sf.kg

Received: from mail.sf.kg ([127.0.0.1])

by localhost (mail.sf.kg [127.0.0.1]) (amavisd-new, port 10026)

with ESMTP id 1EihvBmZZyjM; Tue, 5 May 2026 15:43:41 +0600 (+06)

Received: from [194.59.31.250] (unknown [194.59.31.250])

by mail.sf.kg (Postfix) with ESMTPSA id EE0494AD49CF0;

Tue, 5 May 2026 11:01:44 +0600 (+06)

Content-Type: multipart/alternative; boundary="===============2146471402=="

MIME-Version: 1.0

Subject: Re: I need your help now

To: Recipients <402.a.mergenbaev@sf.kg>

From: " Olena Shevchenko" <402.a.mergenbaev@sf.kg>

Date: Tue, 05 May 2026 06:38:49 -0700

Reply-To: olenashev1@amail.az

Message-Id: <20260505050145.EE0494AD49CF0@mail.sf.kg>

X-Spam_score: 8.4

X-Spam_score_int: 84

X-Spam_bar: ++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Hi, I am a Ukrainian, I have funds for investment, can i trust

you to guide me invest in your country? Please help me. Ole.



Content analysis details: (8.4 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[194.59.31.250 listed in dnsbl.ahbl.org]

[194.59.31.250 listed in dnsbl.ahbl.org]

[194.59.31.250 listed in dnsbl.ahbl.org]

[194.59.31.250 listed in dnsbl.ahbl.org]

[212.112.102.195 listed in dnsbl.ahbl.org]

[212.112.102.195 listed in dnsbl.ahbl.org]

[212.112.102.195 listed in dnsbl.ahbl.org]

[212.112.102.195 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[194.59.31.250 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[194.59.31.250 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[194.59.31.250 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[194.59.31.250 listed in dnsbl.ahbl.org]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-0.0 SPF_PASS SPF: sender matches SPF record

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[212.112.102.195 listed in bl.score.senderscore.com]

2.6 RCVD_IN_MSPIKE_L5 RBL: Very bad reputation (-5)

[212.112.102.195 listed in bl.mailspike.net]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[212.112.102.195 listed in will-spam-for-food.eu.org]

[212.112.102.195 listed in will-spam-for-food.eu.org]

[212.112.102.195 listed in will-spam-for-food.eu.org]

[212.112.102.195 listed in will-spam-for-food.eu.org]

[212.112.102.195 listed in will-spam-for-food.eu.org]

[212.112.102.195 listed in will-spam-for-food.eu.org]

[212.112.102.195 listed in will-spam-for-food.eu.org]

[212.112.102.195 listed in will-spam-for-food.eu.org]

[194.59.31.250 listed in will-spam-for-food.eu.org]

[194.59.31.250 listed in will-spam-for-food.eu.org]

[194.59.31.250 listed in will-spam-for-food.eu.org]

[194.59.31.250 listed in will-spam-for-food.eu.org]

[194.59.31.250 listed in will-spam-for-food.eu.org]

[194.59.31.250 listed in will-spam-for-food.eu.org]

[194.59.31.250 listed in will-spam-for-food.eu.org]

[194.59.31.250 listed in will-spam-for-food.eu.org]

-0.0 SPF_HELO_PASS SPF: HELO matches SPF record

0.0 RCVD_IN_MSPIKE_BL Mailspike blacklisted

0.5 NO_RDNS Sending MTA has no reverse DNS (Postfix variant)

1.0 FROMSPACE Idiosyncratic "From" header format

0.6 FROM_STARTS_WITH_NUMS From: starts with several numbers

2.4 DATE_IN_FUTURE_03_06 Date: is 3 to 6 hours after Received: date

-0.0 T_RP_MATCHES_RCVD Envelope sender domain matches handover relay

domain

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

0.0 NO_RDNS2 Sending MTA has no reverse DNS

Subject: {SPAM?} Re: I need your help now



You will not see this in a MIME-aware mail reader.

--===============2146471402==

Content-Type: text/plain; charset="iso-8859-1"

MIME-Version: 1.0

Content-Transfer-Encoding: quoted-printable

Content-Description: Mail message body



Hi, I am a Ukrainian, I have funds for investment, can i trust you to guide=

me invest in your country? =





Please help me.



Ole.



--===============2146471402==

Content-Type: text/html; charset="iso-8859-1"

MIME-Version: 1.0

Content-Transfer-Encoding: quoted-printable

Content-Description: Mail message body




=3Diso-8859-1"/>


serif; COLOR: black">Hi, I am a Ukrainian, I have funds for investment, can=

i trust you to guide me invest in your country?

Please help me.
>
Ole.



--===============2146471402==--

nigerian spam

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Sun, 10 May 2026 19:21:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1wMFJa-00000000FjZ-15wU

for dave@doctor.nl2k.ab.ca;

Sun, 10 May 2026 19:20:10 -0600

Resent-From: The Doctor

Resent-Date: Sun, 10 May 2026 19:20:10 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail.sf.kg ([212.112.102.195]:54172)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.98.2 (FreeBSD))

(envelope-from <402.a.mergenbaev@sf.kg>)

id 1wMEXd-00000000Bou-33Gz

for doctor@nl2k.ab.ca;

Sun, 10 May 2026 18:30:46 -0600

Received: from localhost (localhost [127.0.0.1])

by mail.sf.kg (Postfix) with ESMTP id 9FB934DFC9678;

Thu, 7 May 2026 03:05:56 +0600 (+06)

Received: from mail.sf.kg ([127.0.0.1])

by localhost (mail.sf.kg [127.0.0.1]) (amavisd-new, port 10032)

with ESMTP id oFVoHeePLYS0; Thu, 7 May 2026 03:05:56 +0600 (+06)

Received: from localhost (localhost [127.0.0.1])

by mail.sf.kg (Postfix) with ESMTP id B28AC4DFCB343;

Tue, 5 May 2026 15:37:06 +0600 (+06)

DKIM-Filter: OpenDKIM Filter v2.10.3 mail.sf.kg B28AC4DFCB343

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=sf.kg;

s=763E2812-1931-11ED-B42E-810EFC213C9A; t=1777973826;

bh=fLNdftdjLm1MsjlRy1DC+KXKVrjTxvegmgYVAX9fUz0=;

h=MIME-Version:To:From:Date:Message-Id;

b=NoLH668S26aBwNZhkvzLsIn2EA2o89y29VVRiwB2jqjEJAoA6k/pDacLL2rdDYSL0

HuvuJsVpRZgyBjCD1xsOr4/WZJ6pRfxOmUTxJZaj11gzU8TlNVQfEhncW6IzDSAyZ7

HXqWyIb9Pg9YYNDt1TafHHWzegq2HY5MhKT/9OPwK//znx3sHzJuw4H4OtwnjKUGxC

Kr6+5hj+n4jqP91KhYAJX3q9l9Y38SfEYm6ckxNvjrY38GmSM8kr5fRC/wAfExjxhG

S/36hksBae+LXi7VYIJvBemwfh0RdlAj/vuWYI7Mg2l0WjUrTfczf/UN+R/QAmc++o

d/tulEfPI0bow==

X-Virus-Scanned: amavisd-new at sf.kg

Received: from mail.sf.kg ([127.0.0.1])

by localhost (mail.sf.kg [127.0.0.1]) (amavisd-new, port 10026)

with ESMTP id dko7-22nybf2; Tue, 5 May 2026 15:37:06 +0600 (+06)

Received: from [194.59.31.250] (unknown [194.59.31.250])

by mail.sf.kg (Postfix) with ESMTPSA id A35044AEBD284;

Tue, 5 May 2026 10:29:17 +0600 (+06)

Content-Type: multipart/alternative; boundary="===============1021953823=="

MIME-Version: 1.0

Subject: Re: I need your help now

To: Recipients <402.a.mergenbaev@sf.kg>

From: " Olena Shevchenko" <402.a.mergenbaev@sf.kg>

Date: Tue, 05 May 2026 06:06:22 -0700

Reply-To: olenashev1@amail.az

Message-Id: <20260505042918.A35044AEBD284@mail.sf.kg>

X-Spam_score: 8.4

X-Spam_score_int: 84

X-Spam_bar: ++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Hi, I am a Ukrainian, I have funds for investment, can i trust

you to guide me invest in your country? Please help me. Ole.



Content analysis details: (8.4 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[194.59.31.250 listed in dnsbl.ahbl.org]

[194.59.31.250 listed in dnsbl.ahbl.org]

[194.59.31.250 listed in dnsbl.ahbl.org]

[194.59.31.250 listed in dnsbl.ahbl.org]

[212.112.102.195 listed in dnsbl.ahbl.org]

[212.112.102.195 listed in dnsbl.ahbl.org]

[212.112.102.195 listed in dnsbl.ahbl.org]

[212.112.102.195 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[194.59.31.250 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[194.59.31.250 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[194.59.31.250 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[194.59.31.250 listed in dnsbl.ahbl.org]

-0.0 SPF_PASS SPF: sender matches SPF record

-0.0 SPF_HELO_PASS SPF: HELO matches SPF record

0.5 NO_RDNS Sending MTA has no reverse DNS (Postfix variant)

1.0 FROMSPACE Idiosyncratic "From" header format

0.6 FROM_STARTS_WITH_NUMS From: starts with several numbers

2.4 DATE_IN_FUTURE_03_06 Date: is 3 to 6 hours after Received: date

-0.0 T_RP_MATCHES_RCVD Envelope sender domain matches handover relay

domain

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

0.0 NO_RDNS2 Sending MTA has no reverse DNS

2.6 RCVD_IN_MSPIKE_L5 RBL: Very bad reputation (-5)

[212.112.102.195 listed in bl.mailspike.net]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[212.112.102.195 listed in bl.score.senderscore.com]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[212.112.102.195 listed in will-spam-for-food.eu.org]

[212.112.102.195 listed in will-spam-for-food.eu.org]

[212.112.102.195 listed in will-spam-for-food.eu.org]

[212.112.102.195 listed in will-spam-for-food.eu.org]

[212.112.102.195 listed in will-spam-for-food.eu.org]

[212.112.102.195 listed in will-spam-for-food.eu.org]

[212.112.102.195 listed in will-spam-for-food.eu.org]

[212.112.102.195 listed in will-spam-for-food.eu.org]

[194.59.31.250 listed in will-spam-for-food.eu.org]

[194.59.31.250 listed in will-spam-for-food.eu.org]

[194.59.31.250 listed in will-spam-for-food.eu.org]

[194.59.31.250 listed in will-spam-for-food.eu.org]

[194.59.31.250 listed in will-spam-for-food.eu.org]

[194.59.31.250 listed in will-spam-for-food.eu.org]

[194.59.31.250 listed in will-spam-for-food.eu.org]

[194.59.31.250 listed in will-spam-for-food.eu.org]

0.0 RCVD_IN_MSPIKE_BL Mailspike blacklisted

Subject: {SPAM?} Re: I need your help now



You will not see this in a MIME-aware mail reader.

--===============1021953823==

Content-Type: text/plain; charset="iso-8859-1"

MIME-Version: 1.0

Content-Transfer-Encoding: quoted-printable

Content-Description: Mail message body



Hi, I am a Ukrainian, I have funds for investment, can i trust you to guide=

me invest in your country? =





Please help me.



Ole.



--===============1021953823==

Content-Type: text/html; charset="iso-8859-1"

MIME-Version: 1.0

Content-Transfer-Encoding: quoted-printable

Content-Description: Mail message body




=3Diso-8859-1"/>


serif; COLOR: black">Hi, I am a Ukrainian, I have funds for investment, can=

i trust you to guide me invest in your country?

Please help me.
>
Ole.



--===============1021953823==--

Nigerian spam

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path: <402.a.mergenbaev@sf.kg>

Envelope-to: dave@nk.ca

Delivery-date: Sun, 10 May 2026 18:22:00 -0600

Received: from mail.sf.kg ([212.112.102.195]:35924)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.98.2 (FreeBSD))

(envelope-from <402.a.mergenbaev@sf.kg>)

id 1wMEP4-00000000BCs-1ajB

for dave@nk.ca;

Sun, 10 May 2026 18:21:58 -0600

Received: from localhost (localhost [127.0.0.1])

by mail.sf.kg (Postfix) with ESMTP id 708CE413BB3D5;

Thu, 7 May 2026 03:05:24 +0600 (+06)

Received: from mail.sf.kg ([127.0.0.1])

by localhost (mail.sf.kg [127.0.0.1]) (amavisd-new, port 10032)

with ESMTP id iEz5G3O0jZ0D; Thu, 7 May 2026 03:05:24 +0600 (+06)

Received: from localhost (localhost [127.0.0.1])

by mail.sf.kg (Postfix) with ESMTP id E39AF4D531B05;

Tue, 5 May 2026 15:36:37 +0600 (+06)

DKIM-Filter: OpenDKIM Filter v2.10.3 mail.sf.kg E39AF4D531B05

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=sf.kg;

s=763E2812-1931-11ED-B42E-810EFC213C9A; t=1777973798;

bh=TPjsm4BC0A+iAOHk2yxQgR8wwUc4bf7cnDOHuXiluKs=;

h=MIME-Version:To:From:Date:Message-Id;

b=JeYkrL7M4rdCw10+j95UaILWNGrrtDNJDPBitzobLPPfnHilHGSnSaUtnwG4z0DWI

OCSAOCULUVv5EuQrv/e+hFXF4rN0gMMG/0+Pqd5nCa0oZW4OkwzqPOimR5k/N14b/5

bXJ91Pj/lLpg1SFaI7UJyCKgZ2iF6VBEd0kBI1tLKQZJuaEtF/7juJHZx5PNXe0raT

rDTNgrUOdh0mP9o7c8tnOZmin7gc4KNNxKFEvcjwhM5cY6kPzUhAai0I6NOTrVRZQ9

pMvY+Nbc6327QKOglLKZM/fTk2L7w3B4MrM1sFjHapjOon/wpGe+DxqQ+/tSVjdZhz

8qWo/b/B9J/Ow==

X-Virus-Scanned: amavisd-new at sf.kg

Received: from mail.sf.kg ([127.0.0.1])

by localhost (mail.sf.kg [127.0.0.1]) (amavisd-new, port 10026)

with ESMTP id LpkTUJFU-xQW; Tue, 5 May 2026 15:36:37 +0600 (+06)

Received: from [194.59.31.250] (unknown [194.59.31.250])

by mail.sf.kg (Postfix) with ESMTPSA id 2EDC14AE267B4;

Tue, 5 May 2026 10:27:48 +0600 (+06)

Content-Type: multipart/alternative; boundary="===============2129957922=="

MIME-Version: 1.0

Subject: Re: I need your help now

To: Recipients <402.a.mergenbaev@sf.kg>

From: " Olena Shevchenko" <402.a.mergenbaev@sf.kg>

Date: Tue, 05 May 2026 06:04:54 -0700

Reply-To: olenashev1@amail.az

Message-Id: <20260505042749.2EDC14AE267B4@mail.sf.kg>

X-Spam_score: 8.4

X-Spam_score_int: 84

X-Spam_bar: ++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Hi, I am a Ukrainian, I have funds for investment, can i trust

you to guide me invest in your country? Please help me. Ole.



Content analysis details: (8.4 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[212.112.102.195 listed in dnsbl.ahbl.org]

[212.112.102.195 listed in dnsbl.ahbl.org]

[212.112.102.195 listed in dnsbl.ahbl.org]

[212.112.102.195 listed in dnsbl.ahbl.org]

[194.59.31.250 listed in dnsbl.ahbl.org]

[194.59.31.250 listed in dnsbl.ahbl.org]

[194.59.31.250 listed in dnsbl.ahbl.org]

[194.59.31.250 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[212.112.102.195 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[212.112.102.195 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[212.112.102.195 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[212.112.102.195 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[194.59.31.250 listed in will-spam-for-food.eu.org]

[194.59.31.250 listed in will-spam-for-food.eu.org]

[194.59.31.250 listed in will-spam-for-food.eu.org]

[194.59.31.250 listed in will-spam-for-food.eu.org]

[194.59.31.250 listed in will-spam-for-food.eu.org]

[194.59.31.250 listed in will-spam-for-food.eu.org]

[194.59.31.250 listed in will-spam-for-food.eu.org]

[194.59.31.250 listed in will-spam-for-food.eu.org]

[212.112.102.195 listed in will-spam-for-food.eu.org]

[212.112.102.195 listed in will-spam-for-food.eu.org]

[212.112.102.195 listed in will-spam-for-food.eu.org]

[212.112.102.195 listed in will-spam-for-food.eu.org]

[212.112.102.195 listed in will-spam-for-food.eu.org]

[212.112.102.195 listed in will-spam-for-food.eu.org]

[212.112.102.195 listed in will-spam-for-food.eu.org]

[212.112.102.195 listed in will-spam-for-food.eu.org]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[212.112.102.195 listed in bl.score.senderscore.com]

2.6 RCVD_IN_MSPIKE_L5 RBL: Very bad reputation (-5)

[212.112.102.195 listed in bl.mailspike.net]

-0.0 SPF_PASS SPF: sender matches SPF record

-0.0 SPF_HELO_PASS SPF: HELO matches SPF record

0.0 RCVD_IN_MSPIKE_BL Mailspike blacklisted

0.5 NO_RDNS Sending MTA has no reverse DNS (Postfix variant)

1.0 FROMSPACE Idiosyncratic "From" header format

0.6 FROM_STARTS_WITH_NUMS From: starts with several numbers

2.4 DATE_IN_FUTURE_03_06 Date: is 3 to 6 hours after Received: date

-0.0 T_RP_MATCHES_RCVD Envelope sender domain matches handover relay

domain

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

0.0 NO_RDNS2 Sending MTA has no reverse DNS

Subject: {SPAM?} Re: I need your help now



You will not see this in a MIME-aware mail reader.

--===============2129957922==

Content-Type: text/plain; charset="iso-8859-1"

MIME-Version: 1.0

Content-Transfer-Encoding: quoted-printable

Content-Description: Mail message body



Hi, I am a Ukrainian, I have funds for investment, can i trust you to guide=

me invest in your country? =





Please help me.



Ole.



--===============2129957922==

Content-Type: text/html; charset="iso-8859-1"

MIME-Version: 1.0

Content-Transfer-Encoding: quoted-printable

Content-Description: Mail message body




=3Diso-8859-1"/>


serif; COLOR: black">Hi, I am a Ukrainian, I have funds for investment, can=

i trust you to guide me invest in your country?

Please help me.
>
Ole.



--===============2129957922==--



Costco Survey phish from Microsoft Outlook Part 3































































































COSTCO MEMBER REWARDS




Limited-time exclusive opportunity









EXCLUSIVE GIVEAWAY







Win a YETI Beach Lounge Wagon







As a valued Costco member, you’ve been selected for a chance to receive a brand-new

YETI Beach Lounge Wagon.

Answer a quick question to confirm your entry and claim your reward.































Premium Quality


Durable and built for outdoor comfort



Easy Participation


Takes less than a minute



Exclusive Access


Limited to selected Costco members



No Purchase Needed


Completely free to enter










style="background:#E53935;color:#ffffff;padding:14px 40px;text-decoration:none;font-weight:bold;border-radius:6px;display:inline-block;">

GET IT NOW






Limited availability. One entry per household.







You are receiving this email as part of a promotional rewards program.



Unsubscribe





















--_4b7bda0d-a248-47d2-9e97-189b99cd3395_--

Costco Survey phish from Microsoft Outlook Part 2



Content analysis details: (18.1 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[40.107.208.129 listed in dnsbl.ahbl.org]

[40.107.208.129 listed in dnsbl.ahbl.org]

[40.107.208.129 listed in dnsbl.ahbl.org]

[40.107.208.129 listed in dnsbl.ahbl.org]

[2603:10b6:610:1f0:0:0:0:13 listed in]

[dnsbl.ahbl.org]

[2603:10b6:610:1f0:0:0:0:13 listed in]

[dnsbl.ahbl.org]

[2603:10b6:610:1f0:0:0:0:13 listed in]

[dnsbl.ahbl.org]

[2603:10b6:610:1f0:0:0:0:13 listed in]

[dnsbl.ahbl.org]

[2603:10b6:610:1f0:cafe:0:0:c3 listed in]

[dnsbl.ahbl.org]

[2603:10b6:610:1f0:cafe:0:0:c3 listed in]

[dnsbl.ahbl.org]

[2603:10b6:610:1f0:cafe:0:0:c3 listed in]

[dnsbl.ahbl.org]

[2603:10b6:610:1f0:cafe:0:0:c3 listed in]

[dnsbl.ahbl.org]

[104.238.213.166 listed in dnsbl.ahbl.org]

[104.238.213.166 listed in dnsbl.ahbl.org]

[104.238.213.166 listed in dnsbl.ahbl.org]

[104.238.213.166 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[40.107.208.129 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[40.107.208.129 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[40.107.208.129 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[40.107.208.129 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[104.238.213.166 listed in will-spam-for-food.eu.org]

[104.238.213.166 listed in will-spam-for-food.eu.org]

[104.238.213.166 listed in will-spam-for-food.eu.org]

[104.238.213.166 listed in will-spam-for-food.eu.org]

[104.238.213.166 listed in will-spam-for-food.eu.org]

[104.238.213.166 listed in will-spam-for-food.eu.org]

[104.238.213.166 listed in will-spam-for-food.eu.org]

[104.238.213.166 listed in will-spam-for-food.eu.org]

[2603:10b6:610:1f0:cafe:0:0:c3 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:610:1f0:cafe:0:0:c3 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:610:1f0:cafe:0:0:c3 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:610:1f0:cafe:0:0:c3 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:610:1f0:cafe:0:0:c3 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:610:1f0:cafe:0:0:c3 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:610:1f0:cafe:0:0:c3 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:610:1f0:cafe:0:0:c3 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:610:1f0:0:0:0:13 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:610:1f0:0:0:0:13 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:610:1f0:0:0:0:13 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:610:1f0:0:0:0:13 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:610:1f0:0:0:0:13 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:610:1f0:0:0:0:13 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:610:1f0:0:0:0:13 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:610:1f0:0:0:0:13 listed in]

[will-spam-for-food.eu.org]

[40.107.208.129 listed in will-spam-for-food.eu.org]

[40.107.208.129 listed in will-spam-for-food.eu.org]

[40.107.208.129 listed in will-spam-for-food.eu.org]

[40.107.208.129 listed in will-spam-for-food.eu.org]

[40.107.208.129 listed in will-spam-for-food.eu.org]

[40.107.208.129 listed in will-spam-for-food.eu.org]

[40.107.208.129 listed in will-spam-for-food.eu.org]

[40.107.208.129 listed in will-spam-for-food.eu.org]

2.5 URIBL_DBL_SPAM Contains a spam URL listed in the DBL blocklist

[URI: hermizo.digital]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

4.5 URIBL_AB_SURBL Contains an URL listed in the AB SURBL blocklist

[URI: hermizo.digital]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

2.2 URIBL_CT_SURBL Contains an URL listed in the CT SURBL blocklist

[URI: www.hermizo.digital]

-0.0 SPF_PASS SPF: sender matches SPF record

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider

[buvedpcqydkxqgqmgresf(at)councilonagingof65285.onmicrosoft.com]

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[40.107.208.129 listed in wl.mailspike.net]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[40.107.208.129 listed in bl.score.senderscore.com]

0.3 OFFER BODY: Offers you Something

0.7 MPART_ALT_DIFF BODY: HTML and text parts are different

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

0.0 MIME_HTML_ONLY_MULTI Multipart message only has text/html MIME parts

2.0 RATWR8_MESSID Message-ID with excessive dashes and dollars

1.7 URIBL_BLACK Contains an URL listed in the URIBL blacklist

[URI: hermizo.digital]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[40.107.208.129 listed in list.dnswl.org]

1.8 COMBO_IMAGEONLY1 Appears to be an image only message

Subject: {SPAM?} Your Costco Survey Reward Is Ready



--_4b7bda0d-a248-47d2-9e97-189b99cd3395_

Content-Type: text/html; charset=UTF-8

Content-Transfer-Encoding: 7bit





















Costco Exclusive Offer

Costco Survey phish from Microsoft Outlook Part 1

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Sun, 10 May 2026 15:12:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1wMBR1-00000000NNO-2GLe

for dave@doctor.nl2k.ab.ca;

Sun, 10 May 2026 15:11:35 -0600

Resent-From: The Doctor

Resent-Date: Sun, 10 May 2026 15:11:35 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-westus3azon11021129.outbound.protection.outlook.com ([40.107.208.129]:49140 helo=PH0PR06CU001.outbound.protection.outlook.com)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1wM9yc-00000000Gcd-0cyr

for doctor@doctor.nl2k.ab.ca;

Sun, 10 May 2026 13:38:20 -0600

ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none;

b=Tv+sumIPDwYo1MHA58TVVf4Jz3zcVkdOIqVh1Xnr7+5B+oJH3gukndIQRQuIDlxQ4qYIJZfBspSjSXgsUfScnCnSk/+aU2T/ggnWdjG4Jlt0uHVMAVm2YNCWIluqojCvl/QLyZv80DWDcDyIsELqVAG0EGbVABtyTPgY8WVF6ZXY23ENbk/SKm8EGUn70OwG3yP50MRnBf7VVhtn4u2ZEfD6p+6oO+7dEoHD453SdHbjW5EdCZoylygMZr0fT9wRAN8ZFiI4kf2x+FzL8hgkLBMHBO8xVTsrlm1o7FdITV+0g+ysQAxeXcCdFUiHfhGk0oJBL50A4eE5jgY7CpAGWw==

ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;

s=arcselector10001;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1;

bh=mevWowwRL6fwxW19Brwcpbav0TIvRIPdSLuT09D8mcM=;

b=MC6CBvgaWlmNtYusuEQ2YK6k5g5n+am8Zy1afCxW8BGrtBFoIR7AT8OUkuGPYcr/8Wje+CVK5LpyYXP1jnxquyK5C1bH/OuKOuZQ73J4bn4XtQOANnbay27BySKqXphG7A7zlvbY+YUTViHZPHlR0kjWAozShsPfFQ3NFi27hx40+kLLQdidd5C7iag0w805ycEQW5A+IdgWd3ALWgCuuxpiy11yt0TCVUJmqlfo4Rny5oumsn+1rik5NYY67MtOMF+3xKd84vdIt2SmFViSLJTOrHPxeKRUvw9HqeA77yB2QcO+0p9NGkvr7ymz1LKFNUdQQD+7DrESW/swyklqrA==

ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=fail (sender ip is

104.238.213.166) smtp.rcpttodomain=doctor.nl2k.ab.ca

smtp.mailfrom=councilonagingof65285.onmicrosoft.com; dmarc=none action=none

header.from=councilonagingof65285.onmicrosoft.com; dkim=none (message not

signed); arc=none (0)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=councilonagingof65285.onmicrosoft.com;

s=selector1-councilonagingof65285-onmicrosoft-com;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck;

bh=mevWowwRL6fwxW19Brwcpbav0TIvRIPdSLuT09D8mcM=;

b=ByvyVkMOY5ydqRfNfQVt+ngpxJnavqILNjKPzOCgoxkiMFIcSuAP8jM2YJ8pXN/oXU45NpJHMu2Mc2dVzVltEu85c3OmK11LroYHGG7KCk8RWeeSaLlxs20gMqYMA2OcNINXC3swqEwD+VorUKTU1pjpTmoFfaEhhhtd0237jjhHaeLeing8QdJFb8NniVc8Z4/FaHm92ZPIMO7n4aGtT81v31M6d/C18UU7lVtwmoZy4o+mCuxc4HMnxQx/CRp8p98fME4iRyFlxma4DPsWQsuugvl7kL5LJkj+rDiFF82xpXg+b0d6hT3/ERbO/cGwie1VU9fwKmvZsE/4BxdPBw==

Received: from CH5PR05CA0020.namprd05.prod.outlook.com (2603:10b6:610:1f0::13)

by CH0PR15MB6236.namprd15.prod.outlook.com (2603:10b6:610:192::16) with

Microsoft SMTP Server (version=TLS1_2,

cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.9891.15; Sun, 10 May

2026 19:37:15 +0000

Received: from CH1PEPF0000AD7E.namprd04.prod.outlook.com

(2603:10b6:610:1f0:cafe::c3) by CH5PR05CA0020.outlook.office365.com

(2603:10b6:610:1f0::13) with Microsoft SMTP Server (version=TLS1_3,

cipher=TLS_AES_256_GCM_SHA384) id 15.21.25.14 via Frontend Transport; Sun, 10

May 2026 19:37:15 +0000

X-MS-Exchange-Authentication-Results: spf=fail (sender IP is 104.238.213.166)

smtp.mailfrom=councilonagingof65285.onmicrosoft.com; dkim=none (message not

signed) header.d=none;dmarc=none action=none

header.from=councilonagingof65285.onmicrosoft.com;

Received-SPF: Fail (protection.outlook.com: domain of

councilonagingof65285.onmicrosoft.com does not designate 104.238.213.166 as

permitted sender) receiver=protection.outlook.com; client-ip=104.238.213.166;

helo=councilonagingof65285.onmicrosoft.com;

Received: from councilonagingof65285.onmicrosoft.com (104.238.213.166) by

CH1PEPF0000AD7E.mail.protection.outlook.com (10.167.244.87) with Microsoft

SMTP Server id 15.21.25.13 via Frontend Transport; Sun, 10 May 2026 19:37:14

+0000

MIME-Version: 1.0

From: Costco Surveys

Subject: Your Costco Survey Reward Is Ready

Date: Sun, 10 May 2026 20:34:57 +0100

To: doctor@doctor.nl2k.ab.ca

Content-Type: multipart/alternative;

boundary="_4b7bda0d-a248-47d2-9e97-189b99cd3395_"

Message-ID:

<67b34c14-72a2-41a9-8e77-52176ab7f485@CH1PEPF0000AD7E.namprd04.prod.outlook.com>

X-EOPAttributedMessage: 0

X-MS-PublicTrafficType: Email

X-MS-TrafficTypeDiagnostic: CH1PEPF0000AD7E:EE_|CH0PR15MB6236:EE_

X-MS-Office365-Filtering-Correlation-Id: ca2b3d76-1ee4-495c-4b0a-08deaecb89e3

X-MS-Exchange-SenderADCheck: 1

X-MS-Exchange-AntiSpam-Relay: 0

X-Microsoft-Antispam:

BCL:0;ARA:13230040|376014|34020700016|82310400026|36860700016|61400799027|4022899009|8096899003|18002099003|16102099003|85622059|56012099003;

X-Microsoft-Antispam-Message-Info:

ADHtc36lTtkl4qZSfIb/SZkstUnfsBL8gJrSmjS2lVifeHLo0lWEofhOpe3lUHHsgfH2zrfZXKnJcnah+8U3tjKcceoca0zprNWo2+EJvAjjsV6WiUykVMA4/MJN6vNGgJ9q07iySOx+2ycjB/KCrBaqCUFHE/XrC432yN6YlbnWrUMRaC9N7t0WkrxjvqK+CLqiL218uphmnjO8+DhIq8c0RD/0EWmn6K+XfMdueYzSdCkbUOZ4RmtKkmyNNJefBcGse2+CQDky3aS/vrd/zf6Rs2gl691d1wUSd8OjJl2O4LIzX4csjvYFE0XacvIR8UuXXG9G3Lzcq4cTS6AQLsAZL7uDcs70MWNSPJ8kZRr1rw9SkJzGXg7+qFgFk2iYm4uaTj9AHYpY+U5ZdVyYWY6acuUYOrKO7K1tZWXlt2q1EZNyQbUrlTjYrVf4P6lNLSYKeTfOgPYvrY/j/kJ83Zsb0BJKcba7D6xNmuUhuj6RmgxHq18Ql8QVnY4S8DPKYbDiGu7FSICGPIB2/NSW2ai5RWQ5nqNtbK5X+pGWpinDuU25cNpjJGOlT//e01D+nKz4AVHjWpEiaxnA09LkcFGKHKvnlCDoEXkqD9TYP3uLQrFhl6jEc4qDDTb4jky1BaXTl0eneRsbTb7ZpwFRd2DCGg6g10UookqFJY4mDuJNzStLnJt6nMteNfBkiXpLPumc7ZgA9YRpowPpB9ePChLC7pgX3DzItj+42Ar1buI=

X-Forefront-Antispam-Report:

CIP:104.238.213.166;CTRY:US;LANG:en;SCL:1;SRV:;IPV:CAL;SFV:NSPM;H:councilonagingof65285.onmicrosoft.com;PTR:InfoDomainNonexistent;CAT:NONE;SFS:(13230040)(376014)(34020700016)(82310400026)(36860700016)(61400799027)(4022899009)(8096899003)(18002099003)(16102099003)(85622059)(56012099003);DIR:OUT;SFP:1102;

X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1

X-MS-Exchange-AntiSpam-MessageData-0:

UWhUFt/b1A1KeUHYi4SWwDE+16oKMztiIksUanII+XEJ7fwHXNM2oxtls8JYJOl6IEBUDvF8zSx0yZ0wGjZlYvL436WYfhpgPHllAI0jALnDvoTWS6Kbs4kAbiwh3UZ2LK/k3RvwwnSu9GpyvT6IGIwBSplTY2fGZSsOtph0MDhzUbE+SMhWGi/3x0LO5qs68jU/DkzF6yYVO94wRXySpWPRwQXA8BSMbmdjmgI9S7hWmcOHMy4GLnuNoGEFDigjba2zZzJse1q+5yJWt/s0gAwnpquhC7AzP8Q5FQGOCO06wmZsvhuC032ILtXL1/qp8zhhT5mT8sBRpoPuEleBBcljJ8GEC/h7y4iZ8PUdLC/Z4ARgpbuhmtnZrq3WwU+tNdE6YB/cOwnFLia+zQSQG+20py/5d/SDgTzn4AqMCxqAhsLXNHdXE9jPrEXnypbV

X-OriginatorOrg: councilonagingof65285.onmicrosoft.com

X-MS-Exchange-CrossTenant-OriginalArrivalTime: 10 May 2026 19:37:14.6759

(UTC)

X-MS-Exchange-CrossTenant-Network-Message-Id: ca2b3d76-1ee4-495c-4b0a-08deaecb89e3

X-MS-Exchange-CrossTenant-Id: c06ed4ac-ac23-4161-a733-d5ba6c748b9c

X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=c06ed4ac-ac23-4161-a733-d5ba6c748b9c;Ip=[104.238.213.166];Helo=[councilonagingof65285.onmicrosoft.com]

X-MS-Exchange-CrossTenant-AuthSource:

CH1PEPF0000AD7E.namprd04.prod.outlook.com

X-MS-Exchange-CrossTenant-AuthAs: Anonymous

X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem

X-MS-Exchange-Transport-CrossTenantHeadersStamped: CH0PR15MB6236

X-Spam_score: 18.1

X-Spam_score_int: 181

X-Spam_bar: ++++++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Costco Exclusive Offer COSTCO MEMBER REWARDS

Web/SEo/App spam from Google Gmail

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Sun, 10 May 2026 08:48:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1wM5R8-000000000ZV-31Ju

for dave@doctor.nl2k.ab.ca;

Sun, 10 May 2026 08:47:18 -0600

Resent-From: The Doctor

Resent-Date: Sun, 10 May 2026 08:47:18 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-vs1-f72.google.com ([209.85.217.72]:56545)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1wM55l-00000000Lf2-0f0d

for sales@nk.ca;

Sun, 10 May 2026 08:25:22 -0600

Received: by mail-vs1-f72.google.com with SMTP id ada2fe7eead31-6332db4182dso424148137.0

for ; Sun, 10 May 2026 07:24:25 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=gmail.com; s=20251104; t=1778423059; x=1779027859; darn=nk.ca;

h=to:from:subject:date:message-id:mime-version:from:to:cc:subject

:date:message-id:reply-to;

bh=KM9Mk8P3Q4d7oOJbpCOskUdbUgp0M7b3siAd7eOaS9M=;

b=N/ONfbJFZO/22mf2qxjQhAY4iruoQQ0XVrZ01os3I/8kbo2+zz273+Oj35AdRoAobW

7QDdqnoEhAFIuSBjL8P9wDFBcOh25JlBi/DmHh7XugT5mYRFWhG0R/1/xjf5hXhf48KY

7LWXCW8tQDVSpt3PbMPR83bsGt8qx7RKa39vEv8PP/dWo4TlT5b/62RGDMhoeY/FW/Qm

e3Y9mDHtZwjJ7OnhuF+kLURzNwc0U1vdXVcXeq/mpJLuxe0+pLdGRxzjWyfbjfq3jaSr

Y9hQfw4Hvu9sTk2lCZDS/ty5lpChALzmC5RY+IuJzl0KabDM/L5c2qf8m41tKyRuuyV4

/bKQ==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20251104; t=1778423059; x=1779027859;

h=to:from:subject:date:message-id:mime-version:x-gm-message-state

:from:to:cc:subject:date:message-id:reply-to;

bh=KM9Mk8P3Q4d7oOJbpCOskUdbUgp0M7b3siAd7eOaS9M=;

b=ZladjN+Rc4/oEyuDvv5ssgpr0GvwFs7ts5ZpfTWvNA3oFh1t6Kv3uQ6fuS3L/0556W

dRrQbb27nAG7aNFqgnCEAEyw7njPrsT2BnUimZ1VJzmH20szQvOiIqHxyYTRu/jrkrAK

mCFom/mjPMGbvcnHINJYTVqWrnLFkiO9E54tIiqdephDK3kCigduZ+5KrYWrySXNtRfq

pGwL2Vsot5LVE5T1nXpKtgJMVJ7HNCCRzpEm+LSOwn8rWbQwi/nRuRBFVoGcW+f3kQPi

YzXIRQZKmHUZc/yLHJOnNYY+JbFhLAocczgFGlNISy/0AoI30Za0+kLANPiFqzm6Zsj3

lGAw==

X-Gm-Message-State: AOJu0YxWeFNd0ebBL8LPsg31vAQJqhvNr4OkOmSupKgiMwKvcIKzwtMO

4JqVotDXdaM4broGhnkGqo0pML1AK5hYhhB5Nl9aFTQqAeNb3k80AZ6M2m113+kJDiHhAhrU6hA

HS/c=

MIME-Version: 1.0

X-Received: by 2002:a05:6102:2ac7:b0:633:c6c4:b32c with SMTP id

ada2fe7eead31-633c6c4b990mr516594137.15.1778423059142; Sun, 10 May 2026

07:24:19 -0700 (PDT)

Message-ID:

Date: Sun, 10 May 2026 14:24:19 +0000

Subject: Pricing 5/10/2026

From: jamesmateo385@gmail.com

To: sales@nk.ca

Content-Type: multipart/alternative; boundary="000000000000b35b46065177628b"



--000000000000b35b46065177628b

Content-Type: text/plain; charset="UTF-8"; format=flowed; delsp=yes



Hello sir/mam

Have a good day,



I looked over your website and believe that both it and your company have a

lot of potential.



I would like to send you a Proposal of your business website!



You can get your website on the 1st page of GOOGLE.



Can I send a You Quotation and Price?



Thank you!

Mateo



--000000000000b35b46065177628b

Content-Type: text/html; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable



Hello sir/mam
Have a good day,

I looked over your website and bel=

ieve that both it and your company have a lot of potential.

I would =

like to send you a Proposal of your business website!

You can get yo=

ur website on the 1st page of GOOGLE.

Can I send a You Quotation an=

d Price?

Thank you!
Mateo

--000000000000b35b46065177628b--

Fedex phish from Sendgrid Part 2




r=3D"0" style=3D"background:#ffffff; border-top:1px solid #e3e3e3;">










=3D"0" border=3D"0" style=3D"max-width:500px;">








0px;">


=3D"display:inline-block; background:#ffffff; border:2px solid #007ab7; col=

or:#007ab7; font-family:'FedEx Sans', Roboto, Arial, sans-serif; font-size:=

16px; font-weight:700; text-decoration:none; padding:12px 28px; border-radi=

us:40px; letter-spacing:0.5px;">Confirm and Resolve Charges











r=3D"0" style=3D"background:#ffffff; border-top:1px solid #e3e3e3;">








px;">


=3D"0" border=3D"0" style=3D"max-width:500px;">







=20









=20









=20



=20

=20









=20









=20










dEx Sans', Roboto, Arial, sans-serif; font-size:24px; font-weight:300; colo=

r:#333; padding-bottom:30px;">

Tracking details


3; padding:14px 0;">


cellspacing=3D"0" border=3D"0">










-family:'FedEx Sans', Roboto, Arial, sans-serif; font-size:16px; font-weigh=

t:600; color:#333; vertical-align:top;">

Tracking ID


-family:'FedEx Sans', Roboto, Arial, sans-serif; font-size:16px; font-weigh=

t:600; color:#007ab7; vertical-align:top;">


45b4" style=3D"color:#007ab7; text-decoration:none; font-weight:600;"> 5514=

58785652125





3; padding:14px 0;">


cellspacing=3D"0" border=3D"0">










-family:'FedEx Sans', Roboto, Arial, sans-serif; font-size:16px; font-weigh=

t:600; color:#333; vertical-align:top;">

Canada


-family:'FedEx Sans', Roboto, Arial, sans-serif; font-size:16px; font-weigh=

t:300; color:#333; vertical-align:top;">

{{DATE}} {{TIME}}




3; padding:14px 0;">


cellspacing=3D"0" border=3D"0">










-family:'FedEx Sans', Roboto, Arial, sans-serif; font-size:16px; font-weigh=

t:600; color:#333; vertical-align:top;">

Number of pieces


-family:'FedEx Sans', Roboto, Arial, sans-serif; font-size:16px; font-weigh=

t:300; color:#333; vertical-align:top;">

1




3; padding:14px 0;">


cellspacing=3D"0" border=3D"0">










-family:'FedEx Sans', Roboto, Arial, sans-serif; font-size:16px; font-weigh=

t:600; color:#333; vertical-align:top;">

Total shipment weight


-family:'FedEx Sans', Roboto, Arial, sans-serif; font-size:16px; font-weigh=

t:300; color:#333; vertical-align:top;">

2.40 LB




3; padding:14px 0;">


cellspacing=3D"0" border=3D"0">










-family:'FedEx Sans', Roboto, Arial, sans-serif; font-size:16px; font-weigh=

t:600; color:#333; vertical-align:top;">

Service


-family:'FedEx Sans', Roboto, Arial, sans-serif; font-size:16px; font-weigh=

t:300; color:#333; vertical-align:top;">

FedEx International Connect=

Plus





Fedex phish from Sendgrid Part 3












r=3D"0" style=3D"background:#ffffff;">








px;">


nline-block; background:#ffffff; border:2px solid #007ab7; color:#007ab7; f=

ont-family:'FedEx Sans', Roboto, Arial, sans-serif; font-size:15px; font-we=

ight:700; text-decoration:none; padding:14px 32px; border-radius:40px; lett=

er-spacing:1px;">TRACK SHIPMENT









r=3D"0" style=3D"background:#ffffff; border-top:1px solid #e3e3e3;">








px;">


=3D"0" border=3D"0" style=3D"max-width:500px;">








to, Arial, sans-serif; font-size:14px; line-height:1.5; color:#555; text-al=

ign:left;">




t.com/mail?url=3Dhttps%3A%2F%2Fwww.fedex.com%2Fcontent%2Fdam%2Ffedex-com%2F=

ens%2Fenvelope_icon.jpg&t=3D1774298302&ymreqid=3Df0dd530e-86fe-79af-1c5e-d7=

0005018c00&sig=3DCbh.F0qv4V4ixe9MoM5ASA--~D" width=3D"15" height=3D"9" styl=

e=3D"display:inline-block; margin-right:6px;" alt=3D"icon">=20

Please do not respond to th=

is message.
This email was sent from an unattended mailbox. This r=

eport was generated at approximately Canada=20



All wei=

ghts are estimated.



To trac=

k the latest status of your shipment, click on the tracking number above.
p>

Standar=

d transit is the date and time the package is scheduled to be delivered by,=

based on the selected service, destination and ship date. Limitations and =

exceptions may apply. Please see the FedEx Service Guide for terms and cond=

itions of service, including the FedEx Money-Back Guarantee, or contact you=

r FedEx Customer Support representative.



=C2=A9 2=

026 Federal Express Corporation. The content of this message is protected b=

y copyright and trademark laws under U.S. and international law. Review our=


"color:#007ab7; text-decoration:underline;">Privacy Notice
. All rights =

reserved.



Thank y=

ou for your business.




e:12px; color:#888;">ID: 1026















Fedex phish from Sendgrid Part 1

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Sun, 10 May 2026 08:20:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1wM50H-00000000DoS-3ATz

for dave@doctor.nl2k.ab.ca;

Sun, 10 May 2026 08:19:33 -0600

Resent-From: The Doctor

Resent-Date: Sun, 10 May 2026 08:19:33 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from a108.a57a0aae.use4.send.mailgun.net ([198.244.51.108]:41538)

by doctor.nl2k.ab.ca with utf8esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256

(Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1wM3kx-00000000OK5-1B9b

for sales@nk.ca;

Sun, 10 May 2026 06:59:46 -0600

DKIM-Signature: a=rsa-sha256; v=1; c=relaxed/relaxed; d=digitaldistributiongroup.com; q=dns/txt; s=mailo; t=1778417920; x=1778425120;

h=Content-Type: Content-Transfer-Encoding: Message-Id: List-Unsubscribe: Reply-To: To: To: From: From: Subject: Subject: Mime-Version: Date: Sender: Sender;

bh=Qb7ZwVcX9h8UXh71BQ2bafHpfeSeuJxC4hZfLbg6+lY=;

b=YDMbxtRs9LemJMKecmBX6eQ0d5N0LbTa3hTcmuhHF92HEALIJ1dO+OrOvrcYT9sGE7hETc9B+sxAsZinuVrb9z3Gqofk+84OjeSA5M2IChhq+pwfLdqBY1i5xYXspbLVMpLFqNIscYn1duAejmkdUckb0QhjlvhF1W1ffQ/Y4ZI=

X-Mailgun-Sid: WyIzMjAxMiIsInNhbGVzQG5rLmNhIiwiMTI2NTJmIl0=

Received: by 28a3df20a495a09ae53c3f149858759d23f8c80ca9950622431215e3ed6e199e with HTTP

id 6a008100b7a3917ac535fecc; Sun, 10 May 2026 12:58:40 GMT

X-Mailgun-Sending-Ip: 198.244.51.108

Sender: info@digitaldistributiongroup.com

Date: Sun, 10 May 2026 12:58:40 +0000

Mime-Version: 1.0

Subject: we've updated the estimated delivery date of your shipment

From: FedEx Tracking

To: sales@nk.ca

Reply-To: support@digitaldistributiongroup.com

List-Unsubscribe:

Precedence: bulk

Message-Id: <20260510125840.26d96e8e636c90b9@digitaldistributiongroup.com>

Content-Transfer-Encoding: quoted-printable

Content-Type: text/html; charset="utf-8"












=3D1.0">

FedEx Delivery Notification






elvetica Neue', Helvetica, Arial, sans-serif;">




order-radius:8px; overflow:hidden; box-shadow:0 1px 4px rgba(0,0,0,0.05);">






r=3D"0" style=3D"background:#4d148c; width:100%;">










ds/images/fedex-express-logo-9186.png" alt=3D"FedEx" width=3D"140" style=3D=

"display:block; width:140px; height:auto; border:0;" border=3D"0">








r=3D"0" style=3D"background:#fafafa; width:100%;">








px;">


=3D"0" border=3D"0" style=3D"max-width:500px; width:100%;">














FedEx Sans', Roboto, Arial, sans-serif; font-size:32px; font-weight:300; co=

lor:#333; line-height:1.2; padding-bottom:16px;">

We=E2=80=99ve updated the estimated del=

ivery of your shipment. =20


0px;">


cellspacing=3D"0" border=3D"0">














ont-family:'FedEx Sans', Roboto, Arial, sans-serif; font-size:16px; font-we=

ight:600; color:#333; letter-spacing:0; padding-bottom:6px;">

Delivery Date


ont-family:'FedEx Sans', Roboto, Arial, sans-serif; font-size:26px; font-we=

ight:300; color:#333; line-height:1.3;">

{{DATE}}=20





Fedex phish from Sendgrid Part 3








3; padding:14px 0;">


cellspacing=3D"0" border=3D"0">










-family:'FedEx Sans', Roboto, Arial, sans-serif; font-size:16px; font-weigh=

t:600; color:#333; vertical-align:top;">

Total shipment weight


-family:'FedEx Sans', Roboto, Arial, sans-serif; font-size:16px; font-weigh=

t:300; color:#333; vertical-align:top;">

2.40 LB







=20






3; padding:14px 0;">


cellspacing=3D"0" border=3D"0">










-family:'FedEx Sans', Roboto, Arial, sans-serif; font-size:16px; font-weigh=

t:600; color:#333; vertical-align:top;">

Service


-family:'FedEx Sans', Roboto, Arial, sans-serif; font-size:16px; font-weigh=

t:300; color:#333; vertical-align:top;">

FedEx International Connect=

Plus




















r=3D"0" style=3D"background:#ffffff;">








px;">


isplay:inline-block; background:#ffffff; border:2px solid #007ab7; color:#0=

07ab7; font-family:'FedEx Sans', Roboto, Arial, sans-serif; font-size:15px;=

font-weight:700; text-decoration:none; padding:14px 32px; border-radius:40=

px; letter-spacing:1px;">TRACK SHIPMENT









r=3D"0" style=3D"background:#ffffff; border-top:1px solid #e3e3e3;">








px;">


=3D"0" border=3D"0" style=3D"max-width:500px;">








to, Arial, sans-serif; font-size:14px; line-height:1.5; color:#555; text-al=

ign:left;">




t.com/mail?url=3Dhttps%3A%2F%2Fwww.fedex.com%2Fcontent%2Fdam%2Ffedex-com%2F=

ens%2Fenvelope_icon.jpg&t=3D1774298302&ymreqid=3Df0dd530e-86fe-79af-1c5e-d7=

0005018c00&sig=3DCbh.F0qv4V4ixe9MoM5ASA--~D" width=3D"15" height=3D"9" styl=

e=3D"display:inline-block; margin-right:6px;" alt=3D"icon">=20

Please do not respond to th=

is message.
This email was sent from an unattended mailbox. This r=

eport was generated at approximately Canada=20



All wei=

ghts are estimated.



To trac=

k the latest status of your shipment, click on the tracking number above.
p>

Standar=

d transit is the date and time the package is scheduled to be delivered by,=

based on the selected service, destination and ship date. Limitations and =

exceptions may apply. Please see the FedEx Service Guide for terms and cond=

itions of service, including the FedEx Money-Back Guarantee, or contact you=

r FedEx Customer Support representative.



=C2=A9 2=

026 Federal Express Corporation. The content of this message is protected b=

y copyright and trademark laws under U.S. and international law. Review our=


"color:#007ab7; text-decoration:underline;">Privacy Notice
. All rights =

reserved.



Thank y=

ou for your business.




e:12px; color:#888;">ID: 1026















Fedex phish from Sendgrid Part 2








r=3D"0" style=3D"background:#fafafa; width:100%;">








px;">


=3D"0" border=3D"0" style=3D"max-width:500px; width:100%;">














FedEx Sans', Roboto, Arial, sans-serif; font-size:32px; font-weight:300; co=

lor:#333; line-height:1.2; padding-bottom:16px;">

We=E2=80=99ve updated the estimated del=

ivery of your shipment. =20


0px;">


cellspacing=3D"0" border=3D"0">














ont-family:'FedEx Sans', Roboto, Arial, sans-serif; font-size:16px; font-we=

ight:600; color:#333; letter-spacing:0; padding-bottom:6px;">

Delivery Date


ont-family:'FedEx Sans', Roboto, Arial, sans-serif; font-size:26px; font-we=

ight:300; color:#333; line-height:1.3;">

{{DATE}}=20












r=3D"0" style=3D"background:#ffffff; border-top:1px solid #e3e3e3;">










=3D"0" border=3D"0" style=3D"max-width:500px;">








0px;">


" style=3D"display:inline-block; background:#ffffff; border:2px solid #007a=

b7; color:#007ab7; font-family:'FedEx Sans', Roboto, Arial, sans-serif; fon=

t-size:16px; font-weight:700; text-decoration:none; padding:12px 28px; bord=

er-radius:40px; letter-spacing:0.5px;">Confirm and Resolve Charges











r=3D"0" style=3D"background:#ffffff; border-top:1px solid #e3e3e3;">




px;">


=3D"0" border=3D"0" style=3D"max-width:500px;">







=20









=20









=20



=20

=20









=20

Fedex phish from Sendrig Part 1

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Sun, 10 May 2026 08:20:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1wM50A-00000000DBZ-0tQE

for dave@doctor.nl2k.ab.ca;

Sun, 10 May 2026 08:19:26 -0600

Resent-From: The Doctor

Resent-Date: Sun, 10 May 2026 08:19:26 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from a108.a57a0aae.use4.send.mailgun.net ([198.244.51.108]:43878)

by doctor.nl2k.ab.ca with utf8esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256

(Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1wM3e1-00000000NYA-2S8f

for doctor@doctor.nl2k.ab.ca;

Sun, 10 May 2026 06:52:36 -0600

DKIM-Signature: a=rsa-sha256; v=1; c=relaxed/relaxed; d=digitaldistributiongroup.com; q=dns/txt; s=mailo; t=1778417490; x=1778424690;

h=Content-Type: Content-Transfer-Encoding: Message-Id: List-Unsubscribe: Reply-To: To: To: From: From: Subject: Subject: Mime-Version: Date: Sender: Sender;

bh=owJCeFTZRyo+4naimVBRUS33gYnwbWu1tWOgTU0Txnw=;

b=WRPdQDeqbGlw+tvcyFO15I8QYalo+yROpv46zquab8IqE64Hv5WN0SWK+6NH1jScdE+0H+kLOeMPYo62u72dg80sNfsywcaCCvI40gKjEpCWVTPRNlJNQvMA8R09bU4Os67lgeNV97LraNSQEc/CJF9dcsybyEt0mzBK7qJPWec=

X-Mailgun-Sid: WyIyNmIxOCIsImRvY3RvckBkb2N0b3Iubmwyay5hYi5jYSIsIjEyNjUyZiJd

Received: by 75182698c3b7be753b4ed9991578a6717724111b3e9012b76a67ce89fd7f5760 with HTTP

id 6a007f52248a36f3e64e94b5; Sun, 10 May 2026 12:51:30 GMT

X-Mailgun-Sending-Ip: 198.244.51.108

Sender: info@digitaldistributiongroup.com

Date: Sun, 10 May 2026 12:51:30 +0000

Mime-Version: 1.0

Subject: we've updated the estimated delivery date of your shipment

From: FedEx Tracking

To: doctor@doctor.nl2k.ab.ca

Reply-To: support@digitaldistributiongroup.com

List-Unsubscribe:

Precedence: bulk

Message-Id: <20260510125130.8a6b80349bce190f@digitaldistributiongroup.com>

Content-Transfer-Encoding: quoted-printable

Content-Type: text/html; charset="utf-8"

X-Spam_score: 7.1

X-Spam_score_int: 71

X-Spam_bar: +++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: FedEx Delivery Notification We’ve updated the estimated

delivery of your shipment. Delivery Date {{DATE}} Confirm and Resolve Charges

Tracking details Tracking ID 551458785652125 Canada {{DATE}} {{TIME}} Number

of pieces 1 To [...]



Content analysis details: (7.1 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[198.244.51.108 listed in dnsbl.ahbl.org]

[198.244.51.108 listed in dnsbl.ahbl.org]

[198.244.51.108 listed in dnsbl.ahbl.org]

[198.244.51.108 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[198.244.51.108 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[198.244.51.108 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[198.244.51.108 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[198.244.51.108 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[198.244.51.108 listed in will-spam-for-food.eu.org]

[198.244.51.108 listed in will-spam-for-food.eu.org]

[198.244.51.108 listed in will-spam-for-food.eu.org]

[198.244.51.108 listed in will-spam-for-food.eu.org]

[198.244.51.108 listed in will-spam-for-food.eu.org]

[198.244.51.108 listed in will-spam-for-food.eu.org]

[198.244.51.108 listed in will-spam-for-food.eu.org]

[198.244.51.108 listed in will-spam-for-food.eu.org]

-0.0 SPF_PASS SPF: sender matches SPF record

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

0.8 SARE_FROM_SPAM_WORD3 I don't know people named this!

Subject: {SPAM?} we've updated the estimated delivery date of your shipment












=3D1.0">

FedEx Delivery Notification






elvetica Neue', Helvetica, Arial, sans-serif;">




order-radius:8px; overflow:hidden; box-shadow:0 1px 4px rgba(0,0,0,0.05);">






dEx Sans', Roboto, Arial, sans-serif; font-size:24px; font-weight:300; colo=

r:#333; padding-bottom:30px;">

Tracking details


3; padding:14px 0;">


cellspacing=3D"0" border=3D"0">










-family:'FedEx Sans', Roboto, Arial, sans-serif; font-size:16px; font-weigh=

t:600; color:#333; vertical-align:top;">

Tracking ID


-family:'FedEx Sans', Roboto, Arial, sans-serif; font-size:16px; font-weigh=

t:600; color:#007ab7; vertical-align:top;">


com/868h5xve" style=3D"color:#007ab7; text-decoration:none; font-weight:600=

;"> 551458785652125





3; padding:14px 0;">


cellspacing=3D"0" border=3D"0">










-family:'FedEx Sans', Roboto, Arial, sans-serif; font-size:16px; font-weigh=

t:600; color:#333; vertical-align:top;">

Canada


-family:'FedEx Sans', Roboto, Arial, sans-serif; font-size:16px; font-weigh=

t:300; color:#333; vertical-align:top;">

{{DATE}} {{TIME}}




3; padding:14px 0;">


cellspacing=3D"0" border=3D"0">










-family:'FedEx Sans', Roboto, Arial, sans-serif; font-size:16px; font-weigh=

t:600; color:#333; vertical-align:top;">

Number of pieces


-family:'FedEx Sans', Roboto, Arial, sans-serif; font-size:16px; font-weigh=

t:300; color:#333; vertical-align:top;">

1




r=3D"0" style=3D"background:#4d148c; width:100%;">










ds/images/fedex-express-logo-9186.png" alt=3D"FedEx" width=3D"140" style=3D=

"display:block; width:140px; height:auto; border:0;" border=3D"0">