Nigerian spam from MEssagelabs

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Wed, 02 Sep 2026 09:58:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.100 (FreeBSD))

(envelope-from )

id 1x1nKh-00000000GNy-35TX

for dave@doctor.nl2k.ab.ca;

Wed, 02 Sep 2026 09:57:03 -0600

Resent-From: The Doctor

Resent-Date: Wed, 2 Sep 2026 09:57:03 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail1.bemta39.messagelabs.com ([195.245.231.1]:26957)

by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

(Exim 4.100 (FreeBSD))

(envelope-from )

id 1x1mIb-00000000E9c-2xZ6;

Wed, 02 Sep 2026 08:50:58 -0600

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gasnatural.com;

s=security; t=1788360595; i=@gasnatural.com;

bh=VirgnToKJBspJtfbnNWqizEOR7q1V7ye8SCNT3eFQrw=;

h=Content-Type:MIME-Version:Content-Transfer-Encoding:

Content-Description:Subject:To:From:Date:Reply-To:Message-ID;

b=ALKDjnlnBl/xqcmzhd68PRZBhHvgyGDyD/i/MkwtBxxytmFnuX9R3/fSEgZG140ng

QocDBWnj+DZhdaEE152eH8I8x2GFTgpLxSB5vtCco9HD8Xokf7YujBkzGCuBfXHnCM

L6NicvPR6Xw2RuO7/pbRJpeLvk8IllzCwCpSeHgtjwRazC22p56ZAc7c9qCN5BZgXu

UykAsYyStY/Y28vcCKqrNXXWVygz3QHKhWjrldCg2xNL5MA4xxbqubNYV5q2A+cnqD

kX5gBaMptCSr6VsK5xsTOc1uNqS++xzECbhCnQzdQh79yrY37FaGdhxzUD/b/CLgbr

Y8yQYA8sl3GgA==

X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFvrBKsWRWlGSWpSXmKPExsXicveLre4E8xl

ZBn+O6ljc637GbPF1yjF2iy1z1jNavF7/lcni08spjBbXvyRYXJ3WwWqxoPULk8XFB+cYLa6+

Dbf4fjTdYurjrUwWCz4vYrW4/VjO4vnuucwWazptLKZ/usNscXEKi8WefVOYLLatnMrmIOLxt

mMKo8eNe0cZPTZtXMroseipkUfzo7uMHrMfzWTymDtlDpPHt3OtrB47rz9m8Tj1wdzjyv2vLB

4z//1k9JgyQ8Rj59SDTB5n9x1g9lj6pJ09QCCKNTMvKb8igTXj/dtOpoKNAhXzPiU2MD7l7WL

k4hAS+MIo0bpzNzOEc4BR4vKKs+xdjJwczAJ6EjemTmEDsXkFBCVOznzCAhHXlli28DVQAweQ

rSbxtasEJCwsoCGx7v8vRhBbBCi8d0YbWDmbgKbEzKXTmUFsFgEViVe7d4CNFxJQklh9dR0zx

Hg/idbGs2ww8U07N7NOYOSdheSKWUiumIXkilkIVyxgZFnFaFGcWlSWWqRropdUlJmeUZKbmJ

mjl1ilm6iXWlqUX5CqW55aXGKil55coJdaXKxXXJmbnJOil5dasokRGM1cHwK+72Dcf6VN/xC

jJAeTkijvPbYZWUJ8SfkplRmJxRnxRaU5qcWHGDU4OASufPjUxCTFkpefl6okwdthBlQnWJSa

nlqRlpkDTDgwpRIcPEoivHlfp2cJ8RYXJOYWZ6ZDpE4x2nNs37l/LzPHt0NXgOSuNyDy/IwXB

5iFwKZKifPuNgWaKgDSllGaBzcUliAvMcpKCfMyMjAwCPEUpBblZpagyr9iFOdgVBLmjQS5jS

czrwRu9yugs5iAzpKZOA3krJJEhJRUA9OyK1PtJNbG9kna3pgdIPpDKaRM5MPTbhbLhbOf/Fr

GPyVOW7Mrd1FYK/sJDsXVKjvyNpe+qejtL1h/ed3/nkttO2xy/35smm7gahWn2n1W+XHlEkuX

40pCpeenWIcslZ4m5cizNGP7rlOyv3XP3lA5uTjWoOOH45MAzjWsecuMpiQEvFoSdZHjouaNf

UWGsgeX/mLYe6aj+oDi2jSG++XN32ZPaJ29PGZtxtwTm75c8Q/QdVAX2T036D/bswirvyJTHh

2tdZ0z4/huvXMPqw0Tyzc4L5gkefKa/ru8mPnb6l9G5Csd+vBl8/9Y3Z+azl/TnxTo92soL09

ffzZlid7RJttwzXzRzwmHQgv9jn9RYinOSDTUYi4qTgQAnrjYvAsEAAA=

X-Env-Sender: info89@gasnatural.com

X-Msg-Ref: server-5.tower-876.messagelabs.com!1788360582!159637!15

X-Originating-IP: [68.221.244.61]

X-SYMC-ESS-Client-Auth: outbound-route-from=pass

X-StarScan-Received:

X-StarScan-Version: 9.122.2; banners=-,-,-

X-VirusChecked: Checked

Received: (qmail 1392791 invoked from network); 2 Sep 2026 14:49:52 -0000

Received: from unknown (HELO azpexch04.es.gasnatural.com) (68.221.244.61)

by server-5.tower-876.messagelabs.com with ECDHE-RSA-AES256-GCM-SHA384 encrypted SMTP; 2 Sep 2026 14:49:52 -0000

Received: from azpexch06.es.gasnatural.com (10.57.64.107) by

azpexch04.es.gasnatural.com (10.57.64.105) with Microsoft SMTP Server

(version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id

15.2.2562.46; Wed, 2 Sep 2026 16:49:49 +0200

Received: from [160.250.133.175] (10.57.0.164) by azpexch06.es.gasnatural.com

(10.57.64.100) with Microsoft SMTP Server id 15.2.2562.46 via Frontend

Transport; Wed, 2 Sep 2026 16:49:43 +0200

Content-Type: text/plain; charset="iso-8859-1"

MIME-Version: 1.0

Content-Transfer-Encoding: quoted-printable

Content-Description: Mail message body

Subject: Your urgent response is needed.

To: Recipients

From: Paul Walker

Date: Wed, 2 Sep 2026 21:48:40 +0700

Reply-To:

Message-ID:

X-Spam_score: 12.0

X-Spam_score_int: 120

X-Spam_bar: ++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Dear sir, This is to inform you that your payment has been

approved by World Bank/International Monetary Fund Debt Liquidation Team.

As the Payment Facilitator with the International Monetary Fund (IMF) in

London, United Kingdom, our mandate is to contact all shortlisted beneficiaries,

process their payments and ensure that they ar [...]



Content analysis details: (12.0 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[68.221.244.61 listed in will-spam-for-food.eu.org]

[68.221.244.61 listed in will-spam-for-food.eu.org]

[68.221.244.61 listed in will-spam-for-food.eu.org]

[68.221.244.61 listed in will-spam-for-food.eu.org]

[68.221.244.61 listed in will-spam-for-food.eu.org]

[68.221.244.61 listed in will-spam-for-food.eu.org]

[68.221.244.61 listed in will-spam-for-food.eu.org]

[68.221.244.61 listed in will-spam-for-food.eu.org]

[195.245.231.1 listed in will-spam-for-food.eu.org]

[195.245.231.1 listed in will-spam-for-food.eu.org]

[195.245.231.1 listed in will-spam-for-food.eu.org]

[195.245.231.1 listed in will-spam-for-food.eu.org]

[195.245.231.1 listed in will-spam-for-food.eu.org]

[195.245.231.1 listed in will-spam-for-food.eu.org]

[195.245.231.1 listed in will-spam-for-food.eu.org]

[195.245.231.1 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[68.221.244.61 listed in dnsbl.ahbl.org]

[68.221.244.61 listed in dnsbl.ahbl.org]

[68.221.244.61 listed in dnsbl.ahbl.org]

[68.221.244.61 listed in dnsbl.ahbl.org]

[195.245.231.1 listed in dnsbl.ahbl.org]

[195.245.231.1 listed in dnsbl.ahbl.org]

[195.245.231.1 listed in dnsbl.ahbl.org]

[195.245.231.1 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[68.221.244.61 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[68.221.244.61 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[68.221.244.61 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[68.221.244.61 listed in dnsbl.ahbl.org]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[195.245.231.1 listed in list.dnswl.org]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-0.0 SPF_PASS SPF: sender matches SPF record

-0.0 SPF_HELO_PASS SPF: HELO matches SPF record

0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in digit

[pwk242424(at)zohomail.com]

1.7 DEAR_SOMETHING BODY: Contains 'Dear (something)'

0.9 URG_BIZ BODY: Contains urgent matter

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[195.245.231.1 listed in bl.score.senderscore.com]

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[195.245.231.1 listed in wl.mailspike.net]

2.0 RATWR8_MESSID Message-ID with excessive dashes and dollars

0.8 SARE_FROM_SPAM_WORD3 I don't know people named this!

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

2.5 FREEMAIL_FORGED_REPLYTO Freemail in Reply-To, but not From

2.7 ADVANCE_FEE_4_NEW Appears to be advance fee fraud (Nigerian 419)

Subject: {SPAM?} Your urgent response is needed.



Dear sir,



This is to inform you that your payment has been approved by World Bank/Int=

ernational Monetary Fund Debt Liquidation Team.



As the Payment Facilitator with the International Monetary Fund (IMF) in Lo=

ndon, United Kingdom, our mandate is to contact all shortlisted beneficiari=

es, process their payments and ensure that they are paid within this third =

quarter of the year.



Once we hear from you we shall commence on your payment immediately. Please=

reply to: (pwk242424@zohomail.com)



Yours Respectfully,





Paul Walker

Credit Control Unit.



________________________________



Este correo electr=F3nico contiene informaci=F3n confidencial y privada y e=

st=E1 dirigida =FAnicamente a su destinatario. Su revisi=F3n, uso, distribu=

ci=F3n o notificaci=F3n por otras personas est=E1 estrictamente prohibida. =

Si usted no es destinatario original (o est=E1 autorizado por el destinatar=

io original para su recepci=F3n), por favor contacte con el emisor por medi=

o de una respuesta v=EDa correo electr=F3nico y borre todas las copias de e=

ste mensaje. Este correo electr=F3nico tiene el =FAnico prop=F3sito de info=

rmar y no deber=EDa ser considerado como una declaraci=F3n oficial de la em=

presa. El correo electr=F3nico v=EDa Internet no permite asegurar la confid=

encialidad de los mensajes que se transmiten ni su integridad o correcta re=

cepci=F3n. Naturgy no asume ninguna responsabilidad por estas circunstancia=

s.





This email may contain confidential and privileged material for the sole us=

e of the intended recipient. Any review, use, distribution or disclosure by=

others is strictly prohibited. If you are not the intended recipient (or a=

uthorized to receive for the recipient), please contact the sender by reply=

email and delete all copies of this message. This email is for information=

purposes only and should not be regarded as an official statement from the=

company. Internet e-mail neither guarantees the confidentiality nor the in=

tegrity or proper receipt of the messages sent. Naturgy does not assume any=

liability for those circumstances

Nigerian spam from MEssage labs

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Wed, 02 Sep 2026 09:57:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.100 (FreeBSD))

(envelope-from )

id 1x1nKS-00000000GLt-0EcC

for dave@doctor.nl2k.ab.ca;

Wed, 02 Sep 2026 09:56:48 -0600

Resent-From: The Doctor

Resent-Date: Wed, 2 Sep 2026 09:56:47 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail1.bemta39.messagelabs.com ([195.245.231.4]:60745)

by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

(Exim 4.100 (FreeBSD))

(envelope-from )

id 1x1mEM-00000000DX4-1WBR

for doctor@doctor.nl2k.ab.ca;

Wed, 02 Sep 2026 08:46:35 -0600

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gasnatural.com;

s=security; t=1788360331; i=@gasnatural.com;

bh=VirgnToKJBspJtfbnNWqizEOR7q1V7ye8SCNT3eFQrw=;

h=Content-Type:MIME-Version:Content-Transfer-Encoding:

Content-Description:Subject:To:From:Date:Reply-To:Message-ID;

b=fDv/JzyzUBJk67D/DB8PT/MMvNDP/acI4AWyPj0N2OIkzEnsPLYuS7Pyu3KjwiyIZ

cm6+LxA20xO9c0WYL1hfeTCD15gIR9rzR3Ju6ovdh1OPN7JenVZK/SttUKc47CPZWh

PtCRq3lNVfo4lCQdjyDjrMVt9Xdj3eaLxMV6fEmiX9SnTSVNGUg07VYeuROT3tG1A0

Zafj8qlG2zM2LXlvkhbZiENsIYr/CUKFYFh+qXdyMTB5Y7Oj4q51P/cHRl8AP/Yhs3

7XuYaB6iw7UO1zDUxJCRUB/HBwoqlGxGx6UfgjIY0jdk+y//Or1Jv4KDwXnrysNIxE

pAtaLSlEEzBOg==

Authentication-Results: mx.messagelabs.com; dkim=none (message not

signed); dmarc=fail (p=reject adkim=r aspf=r) header.from=gasnatural.com

X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFvrJKsWRWlGSWpSXmKPExsXicveLrW672Yw

sg1XXTS1m/Z7HZDHl3ToWi4VtN1gtep9eY7aY2LOGzaL7bTOQ++ISo8Wvo2/ZLeb8Oc1scfiV

ssX1l73sFtsuPgAqu7KN2aKjRc6i9c9fdovrG9uYLZq2bmCyOPihi93ix6Noi6/fpjE7iHg8e

Xie3WPJcUaP86t+sHps2riU0ePe2l3sHh/nZ3k0P7rL6NEzdz2Tx7+DLawer5tOsHl82zaf3e

P6/w1sHqvLPOYvzfH4OsXT486ER8wBwlGsmXlJ+RUJrBnv33YyFWwUqJj3KbGB8SlvFyMXh5D

AF0aJM5ensUI4BxglHrx5ydzFyMnBLKAncWPqFDYQm1dAUOLkzCcsEHFtiWULXwPVcADZahJf

u0pAwsICGhLr/v9iBLFFgMJ7Z7SBlbMJaErMXDodbCSLgIrEsVM9YLaQgJLE6qvrmCHG+0msv

H6BBSa+aedm1gmMvLOQXDELyRWzkFwxC+GKBYwsqxgti1OLylKLdA0N9ZKKMtMzSnITM3P0Eq

t0E/VSS4vyC1J1y1OLS0z00pML9FKLi/WKK3OTc1L08lJLNjEC45nrQ4D1DsZz19r0DzFKcjA

pifLeY5uRJcSXlJ9SmZFYnBFfVJqTWnyIUYODQ+DKh09NTFIsefl5qUoSvD5GQHWCRanpqRVp

mTnAlANTKsHBoyTCm/d1epYQb3FBYm5xZjpE6hSjPcf2nfv3MnN8O3QFSO56AyLPz3hxgFkIb

KqUOG86yFQBkLaM0jy4obAUeYlRVkqYl5GBgUGIpyC1KDezBFX+FaM4B6OSMG+WKdAUnsy8Er

jdr4DOYgI6S2biNJCzShIRUlINTAtnSN3mVlmowWfQPCdxilHWlEzZ921qReeKK+dnsy3MTSs

Jsrv7+OWurSmRkVkyFw7P9hF5Uhff8GhS1gmWIPsjOnIBbu89avzslMMEQiNv31vefv+61zxW

K/t7sTuWTWWYnrSX1TQl+exlf8E1Hx639imrfXaZx5B74vbORYs7PWJf/3o4wSv48mSeWc4bT

A1Ug78smZCXqMwdknlpSU1ispeCUY0Y49OmvdvaQwpbOze0vwk7eOX+Kg3FqkSXGY4zbK9XHo

w84iJTcrf+heWRx84BYveL/AXXByxatOLLVQX7GW8nZvkrTd/PtaFDddkNq+SQbweav2ssKuV

YfEyrfKfXf66zF3OP7LxYrcRSnJFoqMVcVJwIAGHq2gEMBAAA

X-Env-Sender: info89@gasnatural.com

X-Msg-Ref: server-3.tower-879.messagelabs.com!1788360323!168035!4

X-Originating-IP: [68.221.244.61]

X-SYMC-ESS-Client-Auth: outbound-route-from=pass

X-StarScan-Received:

X-StarScan-Version: 9.122.2; banners=-,-,-

X-VirusChecked: Checked

Received: (qmail 1731007 invoked from network); 2 Sep 2026 14:45:27 -0000

Received: from unknown (HELO azpexch05.es.gasnatural.com) (68.221.244.61)

by server-3.tower-879.messagelabs.com with ECDHE-RSA-AES256-GCM-SHA384 encrypted SMTP; 2 Sep 2026 14:45:27 -0000

Received: from azpexch06.es.gasnatural.com (10.57.64.107) by

azpexch05.es.gasnatural.com (10.57.64.106) with Microsoft SMTP Server

(version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id

15.2.2562.46; Wed, 2 Sep 2026 16:45:23 +0200

Received: from [160.250.133.175] (10.57.0.164) by azpexch06.es.gasnatural.com

(10.57.64.100) with Microsoft SMTP Server id 15.2.2562.46 via Frontend

Transport; Wed, 2 Sep 2026 16:45:19 +0200

Content-Type: text/plain; charset="iso-8859-1"

MIME-Version: 1.0

Content-Transfer-Encoding: quoted-printable

Content-Description: Mail message body

Subject: Your urgent response is needed.

To: Recipients

From: Paul Walker

Date: Wed, 2 Sep 2026 21:44:17 +0700

Reply-To:

Message-ID:

X-Spam_score: 12.0

X-Spam_score_int: 120

X-Spam_bar: ++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Dear sir, This is to inform you that your payment has been

approved by World Bank/International Monetary Fund Debt Liquidation Team.

As the Payment Facilitator with the International Monetary Fund (IMF) in

London, United Kingdom, our mandate is to contact all shortlisted beneficiaries,

process their payments and ensure that they ar [...]



Content analysis details: (12.0 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[68.221.244.61 listed in will-spam-for-food.eu.org]

[68.221.244.61 listed in will-spam-for-food.eu.org]

[68.221.244.61 listed in will-spam-for-food.eu.org]

[68.221.244.61 listed in will-spam-for-food.eu.org]

[68.221.244.61 listed in will-spam-for-food.eu.org]

[68.221.244.61 listed in will-spam-for-food.eu.org]

[68.221.244.61 listed in will-spam-for-food.eu.org]

[68.221.244.61 listed in will-spam-for-food.eu.org]

[195.245.231.4 listed in will-spam-for-food.eu.org]

[195.245.231.4 listed in will-spam-for-food.eu.org]

[195.245.231.4 listed in will-spam-for-food.eu.org]

[195.245.231.4 listed in will-spam-for-food.eu.org]

[195.245.231.4 listed in will-spam-for-food.eu.org]

[195.245.231.4 listed in will-spam-for-food.eu.org]

[195.245.231.4 listed in will-spam-for-food.eu.org]

[195.245.231.4 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[195.245.231.4 listed in dnsbl.ahbl.org]

[195.245.231.4 listed in dnsbl.ahbl.org]

[195.245.231.4 listed in dnsbl.ahbl.org]

[195.245.231.4 listed in dnsbl.ahbl.org]

[68.221.244.61 listed in dnsbl.ahbl.org]

[68.221.244.61 listed in dnsbl.ahbl.org]

[68.221.244.61 listed in dnsbl.ahbl.org]

[68.221.244.61 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[195.245.231.4 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[195.245.231.4 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[195.245.231.4 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[195.245.231.4 listed in dnsbl.ahbl.org]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[195.245.231.4 listed in list.dnswl.org]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[195.245.231.4 listed in bl.score.senderscore.com]

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[195.245.231.4 listed in wl.mailspike.net]

-0.0 SPF_PASS SPF: sender matches SPF record

-0.0 SPF_HELO_PASS SPF: HELO matches SPF record

0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in digit

[pwk242424(at)zohomail.com]

1.7 DEAR_SOMETHING BODY: Contains 'Dear (something)'

0.9 URG_BIZ BODY: Contains urgent matter

0.8 SARE_FROM_SPAM_WORD3 I don't know people named this!

2.0 RATWR8_MESSID Message-ID with excessive dashes and dollars

2.5 FREEMAIL_FORGED_REPLYTO Freemail in Reply-To, but not From

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

2.7 ADVANCE_FEE_4_NEW Appears to be advance fee fraud (Nigerian 419)

Subject: {SPAM?} Your urgent response is needed.



Dear sir,



This is to inform you that your payment has been approved by World Bank/Int=

ernational Monetary Fund Debt Liquidation Team.



As the Payment Facilitator with the International Monetary Fund (IMF) in Lo=

ndon, United Kingdom, our mandate is to contact all shortlisted beneficiari=

es, process their payments and ensure that they are paid within this third =

quarter of the year.



Once we hear from you we shall commence on your payment immediately. Please=

reply to: (pwk242424@zohomail.com)



Yours Respectfully,





Paul Walker

Credit Control Unit.



________________________________



Este correo electr=F3nico contiene informaci=F3n confidencial y privada y e=

st=E1 dirigida =FAnicamente a su destinatario. Su revisi=F3n, uso, distribu=

ci=F3n o notificaci=F3n por otras personas est=E1 estrictamente prohibida. =

Si usted no es destinatario original (o est=E1 autorizado por el destinatar=

io original para su recepci=F3n), por favor contacte con el emisor por medi=

o de una respuesta v=EDa correo electr=F3nico y borre todas las copias de e=

ste mensaje. Este correo electr=F3nico tiene el =FAnico prop=F3sito de info=

rmar y no deber=EDa ser considerado como una declaraci=F3n oficial de la em=

presa. El correo electr=F3nico v=EDa Internet no permite asegurar la confid=

encialidad de los mensajes que se transmiten ni su integridad o correcta re=

cepci=F3n. Naturgy no asume ninguna responsabilidad por estas circunstancia=

s.





This email may contain confidential and privileged material for the sole us=

e of the intended recipient. Any review, use, distribution or disclosure by=

others is strictly prohibited. If you are not the intended recipient (or a=

uthorized to receive for the recipient), please contact the sender by reply=

email and delete all copies of this message. This email is for information=

purposes only and should not be regarded as an official statement from the=

company. Internet e-mail neither guarantees the confidentiality nor the in=

tegrity or proper receipt of the messages sent. Naturgy does not assume any=

liability for those circumstances

WEb/SEO/App spam from Microsoft Outlook

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Wed, 02 Sep 2026 09:57:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.100 (FreeBSD))

(envelope-from )

id 1x1nKB-00000000GKU-1lvQ

for dave@doctor.nl2k.ab.ca;

Wed, 02 Sep 2026 09:56:31 -0600

Resent-From: The Doctor

Resent-Date: Wed, 2 Sep 2026 09:56:31 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-japaneastazolkn19013074.outbound.protection.outlook.com ([52.103.43.74]:19289 helo=TYDPR03CU002.outbound.protection.outlook.com)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.100 (FreeBSD))

(envelope-from )

id 1x1m2q-00000000Cbn-2S2i

for root@nk.ca;

Wed, 02 Sep 2026 08:34:43 -0600

ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none;

b=e6qPyHaaWlPWJ1KkaYNGTRjqEztC+5nzpy3Ssv9bUhaUU7eFLlhrwzV0gMAjMZRUE7onaiqewncl4SA8L7hgilpRvCv9rul0tm0E6ckojojVJ9FBdDkYF2HikCsKXPQWXYKyBbA+3Kk2TveB8kfggZx9GnHpmFKtV9fkLJTr9LcRhcjMjSdarO4ZMnztexvlno/gqMzmjR2axNcN+YMTTJbBK2UW75Xq24pWhO6P+qGWudWXg+EyVvlIWjDmJC5LHGQPYOr79EoCujrpU169sf/wsI29aOzCtv26AIYiRGJ+lomTyMW4wRfQmgC6rBedfkOIKZ86bv8/IGV9JIAh0Q==

ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;

s=arcselector10001;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1;

bh=ScPfwCAAfsOHky7E6NibuD6p6Y8wDyByKZJSB5oz4B8=;

b=lsh92qX2d5LvrXo0SJXT64bOfdPXgwts6McvNtllQvw2uCKAZ2aJYbs8+QdUfmawlTulu+2PSyYyXzJ5iG8tAQoCRGgrzHg/nP+cXUJ1mOCEjqP/P0tO5YevpweQ9ca6V5HwJSOOo6O1LPBBAIVrjLHwxnzmoHVY8BgAIfVYzMzqexd6oYQHXUX+Q9OPfnHYWH8pk3VicXWY97aCj9SqDxdZPzjaUsf267zKUAS5IGibxRBRFUqyioDMs3BRXgT34LPAb9TLp5FGtfOiXYpV5BUTwyoR70DnILjMU3PJC6nkSPm6Do4L7zs66BmrB0/iW2yLqdbQf3E/pP4caH/7lQ==

ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=none; dmarc=none;

dkim=none; arc=none

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=hotmail.com;

s=selector1;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck;

bh=ScPfwCAAfsOHky7E6NibuD6p6Y8wDyByKZJSB5oz4B8=;

b=A7hpGP8uOskrVDg46x1ama93cLPEqD7MYwbnD2WJIygVoOdMxPSju//ucMPJ0wD7RhwbYrlUNKBhbjphoL4XOSPNxXKNaAi0IPw8DCKev8Jyc6U9Yyy8KsWV7hUfseogC3ExlHWH8M2n2wp4Z+ikw+EcsLmMXBfE51p6QSq52XGd7dMs6cV4Tgb9zRBOxHEaof4wdLCb/jL2NDgbP74iMq2klrubdhhJX27/LdWIv/+iA1HjD8Q6qo9Y6GCV6UNG+D6MK+ui+jRe7657O/sRZXFwCxI1aE0yAPxsWCsGHMEuCu9ZeRsvjZ5vZKjX8vLOTSJqqMn8ikgHh6zMk9xD7w==

Received: from SEYPR04MB5643.apcprd04.prod.outlook.com (2603:1096:101:50::12)

by SI6PR04MB8329.apcprd04.prod.outlook.com (2603:1096:4:230::12) with

Microsoft SMTP Server (version=TLS1_2,

cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.360.13; Wed, 2 Sep

2026 14:31:55 +0000

Received: from SEYPR04MB5643.apcprd04.prod.outlook.com

([fe80::1cca:3829:29c0:27cc]) by SEYPR04MB5643.apcprd04.prod.outlook.com

([fe80::1cca:3829:29c0:27cc%5]) with mapi id 15.21.0360.008; Wed, 2 Sep 2026

14:31:55 +0000

From: Carolyn Wright

Subject: Re: @App Pricing

Thread-Topic: @App Pricing

Thread-Index: AQHdOue7RKjnAVFeX0i+r2QpvsPE9A==

Date: Wed, 2 Sep 2026 14:31:54 +0000

Message-ID:



Accept-Language: en-US

Content-Language: en-US

X-MS-Has-Attach:

X-MS-TNEF-Correlator:

msip_labels:

x-ms-publictraffictype: Email

x-ms-traffictypediagnostic: SEYPR04MB5643:EE_|SI6PR04MB8329:EE_

x-ms-office365-filtering-correlation-id: 3fcb01f9-7744-45fc-6397-08df08feef9d

x-microsoft-antispam:

BCL:0;ARA:14566002|31061999003|8060799015|55001999006|19110799012|19101099003|39105399006|20031999006|15030799006|15080799012|8062599012|37011999003|24071999003|4140399003|25010399006|40105399003|43065399003|2607281247196008|31055399003|102099032|440099028|3412199025;

x-microsoft-antispam-message-info:

=?Windows-1252?Q?JGPuXTTTzyEVysoO+FsrhzxTfGW2kk5BGQszabMMLyGgpB4Jf3K4czzG?=

=?Windows-1252?Q?P3ER+xP6e8rp0wjny42WiNUt99vfzSiSX/gZhLysyJnxrwXOgpBaNxkO?=

=?Windows-1252?Q?9mDy9oAfrGOVsAkPyX17yDyeIfZL4nLrJmmYX5gipeaZW+qrDsZ1+p13?=

=?Windows-1252?Q?5BxqW+Eif8H9wyxd5CbkRv0pI09jLHvYZBEfDXR2e7oJLvPcbQhSeQ1y?=

=?Windows-1252?Q?c5/YYxU9f91tekfAu4/6GITfsRVhfPlrIUbbhU7hCyvpPTmQyvT8GB+r?=

=?Windows-1252?Q?CrGzUA5V5DinQCEsQ7eJNRBOJ1NqRy91XqRujqkzgTufl6lWZOcIDxVa?=

=?Windows-1252?Q?Bt3CCuu6NhA90+B5U09dftuN1VMAw8Etzrj3zRmpfUoCVvaEY/pSCkqH?=

=?Windows-1252?Q?+Z/Ku3OWmDmstU+X/Tyl/JKvc78N+D36ChQzmizu/w0w89g9TULJbubf?=

=?Windows-1252?Q?FJfD9QSq9F/CmZPhi6358EmCsTOGbZLlsM23My9xKESpdEHO+zRBGaBP?=

=?Windows-1252?Q?pLPY96GPx+UVVZLPr+XJjYOh4sP470d7JIWDW12iqbWT+8YEm/A5Mn/6?=

=?Windows-1252?Q?EpfIFdKAIh17VA22XyZJzqLRho7QfEiiap2Gkxq51pm9oM+5NVguf4cI?=

=?Windows-1252?Q?hCUCDMrYzo2aGvyenwsugZyLhSwZ9sqdFyU+dvNHxcIIT2TggMGMAWnE?=

=?Windows-1252?Q?YV1xiKsfjIFl5JGHWQboeVTM7p1TPcHiYqtPIoZJlV8UNmtLN7ULNj4K?=

=?Windows-1252?Q?jjOGGIiMKsNGIGBcUv5Xbg4SMYFp4yQco2EP0RN6HWK1p8xo7gW+ZA3t?=

=?Windows-1252?Q?/BLr6EcGvvf7R529H0+onGASMc+OzzmmM4nPCD0Ixrio5ivPto5ljmFD?=

=?Windows-1252?Q?6ktQtOc0dE3jUnvbLq7ek8jQ6HwCf4zq/wjo8TZNkt0F/+7R8A9fejuJ?=

=?Windows-1252?Q?04amx85giqojNs2SImPoOkA3CPc6PzqR5krJjh3d2sIO0s2nMDwOGWK+?=

=?Windows-1252?Q?IfVXwGxO+8uLI7k1Wdajv0AnWTyiyvZTdVEgFIJ8fyzVr54qnyQNcuUH?=

=?Windows-1252?Q?y1wtaujUifW+akX9inhNkxYEs6o7dfuBadd43F8qBtQrEv3EqFHmTIRt?=

=?Windows-1252?Q?6D3G+T3N1G//bpUOKKrNQ0xRlr5xPrhig9df3Q/qohPIVhMGnz3kvg3W?=

=?Windows-1252?Q?NFRScimCwN1wZ5z2u38WrAOiNd1DnOsFl6nawB1Xlfwm3O+ae/i3YA?=

=?Windows-1252?Q?=3D=3D?=

x-ms-exchange-antispam-messagedata-chunkcount: 1

x-ms-exchange-antispam-messagedata-0:

=?Windows-1252?Q?PLXVtqdR4xWF+q6XYQwAziC14cDyIloA6+RqCbQeVTEzqLblOwHGHhCB?=

=?Windows-1252?Q?4KlYwFQvAhOEsINGJ0/x5sl4FD+ban61gCiFlDpInpNyxUN3L+Y9CJU8?=

=?Windows-1252?Q?dk2dHBDvfdM/ifarewV4TNxAZ8aRkwS/bJQqDsrezn3xA4WkfiGShXbW?=

=?Windows-1252?Q?G0lRpCuSLL/Q1rxd8xMkhx2ZH+3ezJOepyiwLiGT+DRVlHlVuOvUmTPP?=

=?Windows-1252?Q?fFSS1mLSiZX3Z54GTt2SVo54t7+QpSB5kHGza1OINE9Ro6O+4z24YR06?=

=?Windows-1252?Q?1oRz9H5CTbJkVprS23FczlBS4cPfHbwsvH7cBHruiChTTCbTjVDv8CVp?=

=?Windows-1252?Q?ji53scuDSRNKQiNMmXKtcoVpyIUmaiHv9wnLqTQPuzd0cZynRX8vt7XR?=

=?Windows-1252?Q?v4eEPmFg7+Wk+/qUDexWpYD0t35LHH2Jrq4A9M0snvya/aG5TkhH6F2+?=

=?Windows-1252?Q?ybqhhFRFW34EdCiQTxN2gqtLq2EUeiY1zhLH5GhC2hE77Wkxm5gxErLf?=

=?Windows-1252?Q?LEkD+vV3VDDcdaITJaQaZZQ8ZR3pj8DO5959zW0UufWbcvRGNQxx0E8v?=

=?Windows-1252?Q?gX4YhcohWtrcPZet31/f7kFv/zHWTaEVOEe6YZYY26uax5VtfYIrxw1U?=

=?Windows-1252?Q?w+cEX015N7GSeuBFq7GEksB1X5V+UHC6QE0XcTJVUnsFrj7Jtz/1nCPr?=

=?Windows-1252?Q?s/oFdB8sR/RKvR7dxvSjcY/7nhmWF/Ub1KOi7Rw6cdwVzl8kGyXWd4vg?=

=?Windows-1252?Q?OmnwbP7oK6TmzFchdSec8tHheeCE64C5Q6y6rKRqTSrlqoXfbv0Cs1bv?=

=?Windows-1252?Q?ZqfGEF+1Ku2NNaqLlO4DIPWeaNsi9Dg1lNviwnvjki/W0xsf3vF9zs+k?=

=?Windows-1252?Q?XUpSahLltuLWNjsFo64mImfJccB8xBSbITXpjH8eSzEromwTk+zxeYlf?=

=?Windows-1252?Q?JNo9mMj4JVJsghMcNc++R0GqlwB1kcF0HuVERL985NhXZ4UpVBASTBtb?=

=?Windows-1252?Q?U4Z5TizfT+xSyaBBZkzdrJr3abTUuelLYLbYBCNYhNwKApb4p4ZPqRNr?=

=?Windows-1252?Q?iVPi6pyQ3kY2JfHXTTLqK3romNuRrIwsea7D6nq6xu2Qfnotj+kkAim3?=

=?Windows-1252?Q?QOQmDTJZ1jwrnxqcJFbURG7x2tIUgCai3uG7/hRPHYVXpLunDskUyoso?=

=?Windows-1252?Q?J7/1c4H82KhMg/dSVEmXeRXF6wNGE2bkt0CJvYj/5ThnEU5n6tIXavUo?=

=?Windows-1252?Q?7fTLG7nfaaa5UnEMXfyCrWLsx6oK7UAnVTjv0vhYY8aK8l+zD8JrZpaQ?=

=?Windows-1252?Q?TLWDX5qJ8/KZxxjtEsAfRbXWFrinOOiezCyxFPZvKyTbnVITbd3cH9cf?=

=?Windows-1252?Q?xtIJX5ZR8OQ0TGoy+1L/WUvSd88bNbRChTq+hT+B5pK4JQYNtxXryDvp?=

=?Windows-1252?Q?1SmEwEKEiUkkvvPJVceBx3KLu0QzNv28+ktAx1EZrWWeSFrPl6CRI6Vu?=

=?Windows-1252?Q?xPsnaKaoaeynkxKJIDw4g++KnJmzOrsX1NgWddocMjyJcAl7l/UKqu2K?=

=?Windows-1252?Q?qwagVv4VGlnfdG3R7ybM/giW9+zP6dJwrw32gA=3D=3D?=

Content-Type: multipart/alternative;

boundary="_000_SEYPR04MB5643FDBDB9BA1ADE3CEBF8EFE2B72SEYPR04MB5643apcp_"

MIME-Version: 1.0

X-OriginatorOrg: sct-15-20-9412-4-msonline-outlook-c3e7a.templateTenant

X-MS-Exchange-CrossTenant-AuthAs: Internal

X-MS-Exchange-CrossTenant-AuthSource: SEYPR04MB5643.apcprd04.prod.outlook.com

X-MS-Exchange-CrossTenant-RMS-PersistedConsumerOrg: 00000000-0000-0000-0000-000000000000

X-MS-Exchange-CrossTenant-Network-Message-Id: 3fcb01f9-7744-45fc-6397-08df08feef9d

X-MS-Exchange-CrossTenant-originalarrivaltime: 02 Sep 2026 14:31:54.3634

(UTC)

X-MS-Exchange-CrossTenant-fromentityheader: Hosted

X-MS-Exchange-CrossTenant-id: 84df9e7f-e9f6-40af-b435-aaaaaaaaaaaa

X-MS-Exchange-CrossTenant-rms-persistedconsumerorg: 00000000-0000-0000-0000-000000000000

X-MS-Exchange-Transport-CrossTenantHeadersStamped: SI6PR04MB8329



--_000_SEYPR04MB5643FDBDB9BA1ADE3CEBF8EFE2B72SEYPR04MB5643apcp_

Content-Type: text/plain; charset="Windows-1252"

Content-Transfer-Encoding: quoted-printable



Hi,



Would you be interested in building an app and website? I am working with a=

n India-based IT company and we do have expertise in Website and Mobile App=

development.



We can develop any kind of App and Website: -



=95 Real Estate App

=95 Games App

=95 Music App

=95 Travel App

=95 Dating App

=95 Fitness App

=95 Clothing Apps

=95 Business App

=95 Taxi App

=95 Educational App

=95 Restaurants App

=95 Hospitality App



Ps: - Kindly let me know if you are interested in any of the above-mentione=

d services. I will forward you our =93samples & price catalogs=94



Please Let me know your requirements if you want to develop any app for you=

r business.



Thanks & Regards,





--_000_SEYPR04MB5643FDBDB9BA1ADE3CEBF8EFE2B72SEYPR04MB5643apcp_

Content-Type: text/html; charset="Windows-1252"

Content-Transfer-Encoding: quoted-printable








252">








y: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans=

-serif; color: rgb(0, 0, 0);">

Hi, 



y: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans=

-serif; color: rgb(0, 0, 0);">

 



y: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans=

-serif; color: rgb(0, 0, 0);">

Would you be interested in building an app =

and website? I am working with an India-based IT company and we do have exp=

ertise in Website and Mobile App development. 



y: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans=

-serif; color: rgb(0, 0, 0);">

 



y: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans=

-serif; color: rgb(0, 0, 0);">

We can develop any kind of App and Websi=

te: - 



y: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans=

-serif; color: rgb(0, 0, 0);">

 



y: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans=

-serif; color: rgb(0, 0, 0);">

      =95 Real Estat=

e App 



y: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans=

-serif; color: rgb(0, 0, 0);">

      =95 Games=

App 



y: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans=

-serif; color: rgb(0, 0, 0);">

      =95 Music=

App 



y: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans=

-serif; color: rgb(0, 0, 0);">

      =95 Trave=

l App 



y: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans=

-serif; color: rgb(0, 0, 0);">

      =95 Datin=

g App 



y: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans=

-serif; color: rgb(0, 0, 0);">

      =95 Fitne=

ss App 



y: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans=

-serif; color: rgb(0, 0, 0);">

      =95 Cloth=

ing Apps 



y: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans=

-serif; color: rgb(0, 0, 0);">

      =95 Busin=

ess App 



y: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans=

-serif; color: rgb(0, 0, 0);">

      =95 Taxi =

App 



y: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans=

-serif; color: rgb(0, 0, 0);">

      =95 Educa=

tional App 



y: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans=

-serif; color: rgb(0, 0, 0);">

      =95 Resta=

urants App 



y: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans=

-serif; color: rgb(0, 0, 0);">

      =95 Hospi=

tality App 



y: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans=

-serif; color: rgb(0, 0, 0);">

 



y: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans=

-serif; color: rgb(0, 0, 0);">

Ps: - Kindly let me know if you=

are interested in any of the above-mentioned services. I will forward you =

our =93samples & price catalogs=94 



y: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans=

-serif; color: rgb(0, 0, 0);">

 



y: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans=

-serif; color: rgb(0, 0, 0);">

Please Let me know your requirements if you=

want to develop any app for your business. 



y: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans=

-serif; color: rgb(0, 0, 0);">

 



y: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans=

-serif; color: rgb(0, 0, 0);">

Thanks & Regards, 
div>


Calibri, Helvetica, sans-serif; color: rgb(0, 0, 0);">


>









--_000_SEYPR04MB5643FDBDB9BA1ADE3CEBF8EFE2B72SEYPR04MB5643apcp_--

google Cloud Phish from Google Gmail

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Wed, 02 Sep 2026 07:03:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.100 (FreeBSD))

(envelope-from )

id 1x1kc0-00000000C5a-1ush

for dave@doctor.nl2k.ab.ca;

Wed, 02 Sep 2026 07:02:44 -0600

Resent-From: The Doctor

Resent-Date: Wed, 2 Sep 2026 07:02:44 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from 244.187.78.34.bc.googleusercontent.com ([34.78.187.244]:39608 helo=googleusercontent.com)

by doctor.nl2k.ab.ca with esmtp (Exim 4.100 (FreeBSD))

(envelope-from )

id 1x1kWo-00000000BZq-1yQd

for doctor@nl2k.ca;

Wed, 02 Sep 2026 06:57:30 -0600

Received: by googleusercontent.com (Postfix, from userid 1000)

id 5EE263E9C97; Wed, 2 Sep 2026 12:55:57 +0000 (UTC)

To: doctor@nl2k.ca

From:=?UTF-8?B?VXJnZW5jeSBSZXdhcmRzIEFsZXJ0cw==?=

Subject:=?UTF-8?B?QWN0IE5vdzogU3BlY2lhbCBBY2Nlc3MgV2FpdGluZyBmb3IgWW91?=

MIME-Version: 1.0

Reply-To: =?UTF-8?B?cmVwbHk=?=

Content-Transfer-Encoding: base64

Content-Type: text/html; charset=utf-8

Message-Id: <20260902125624.5EE263E9C97@googleusercontent.com>

Date: Wed, 2 Sep 2026 12:55:57 +0000 (UTC)

X-Spam_score: 15.9

X-Spam_score_int: 159

X-Spam_bar: +++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview:  Payment Declined - Action Required Payment Method Declined





Content analysis details: (15.9 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.6 RCVD_IN_BRBL_LASTEXT RBL: No description available.

[34.78.187.244 listed in bb.barracudacentral.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[34.78.187.244 listed in will-spam-for-food.eu.org]

[34.78.187.244 listed in will-spam-for-food.eu.org]

[34.78.187.244 listed in will-spam-for-food.eu.org]

[34.78.187.244 listed in will-spam-for-food.eu.org]

[34.78.187.244 listed in will-spam-for-food.eu.org]

[34.78.187.244 listed in will-spam-for-food.eu.org]

[34.78.187.244 listed in will-spam-for-food.eu.org]

[34.78.187.244 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[34.78.187.244 listed in dnsbl.ahbl.org]

[34.78.187.244 listed in dnsbl.ahbl.org]

[34.78.187.244 listed in dnsbl.ahbl.org]

[34.78.187.244 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[34.78.187.244 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[34.78.187.244 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[34.78.187.244 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[34.78.187.244 listed in dnsbl.ahbl.org]

0.0 SPF_HELO_NEUTRAL SPF: HELO does not match SPF record (neutral)

0.7 SPF_NEUTRAL SPF: sender does not match SPF record (neutral)

0.0 TVD_RCVD_IP Message was received from an IP address

3.0 RECEIVED_MULTICAST A multicast IP adress appears in Received header

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

0.0 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level mail

domains are different

-0.0 T_RP_MATCHES_RCVD Envelope sender domain matches handover relay

domain

2.4 ACT_NOW_CAPS BODY: Talks about 'acting now' with capitals

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[34.78.187.244 listed in bl.score.senderscore.com]

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.4 RDNS_DYNAMIC Delivered to internal network by host with

dynamic-looking rDNS

0.1 FROM_EXCESS_BASE64 From: base64 encoded unnecessarily

0.8 SARE_FROM_SPAM_WORD3 I don't know people named this!

0.0 PDS_RDNS_DYNAMIC_FP RDNS_DYNAMIC with FP steps

3.0 URI_FIREBASEAPP Link to hosted firebase web application, possible

phishing

1.0 HDRS_MISSP Misspaced headers

0.4 KHOP_HELO_FCRDNS Relay HELO differs from its IP's reverse DNS

Subject: {SPAM?} =?UTF-8?B?QWN0IE5vdzogU3BlY2lhbCBBY2Nlc3MgV2FpdGluZyBmb3IgWW91?=







Company Logo

Payment Method Declined



Dear Customer,



Your cloud storage is full, and your photos, videos, contacts, and documents are no longer being backed up.



We attempted to renew your monthly subscription using your default payment method, but the transaction was unsuccessful.



Action required: Please update your payment information immediately. Failure to resolve this within 3 days will result in the permanent deletion of your personal data.

Update Payment Information



If you recently updated your payment, please disregard this message.

© 2025 All rights reserved.

Unsubscribe

Google Cloud phish from Google

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Wed, 02 Sep 2026 07:03:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.100 (FreeBSD))

(envelope-from )

id 1x1kbs-00000000C55-3ef5

for dave@doctor.nl2k.ab.ca;

Wed, 02 Sep 2026 07:02:36 -0600

Resent-From: The Doctor

Resent-Date: Wed, 2 Sep 2026 07:02:36 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from 244.187.78.34.bc.googleusercontent.com ([34.78.187.244]:38764 helo=googleusercontent.com)

by doctor.nl2k.ab.ca with esmtp (Exim 4.100 (FreeBSD))

(envelope-from )

id 1x1kW8-00000000BWa-2VYm

for doctor@netknow.ca;

Wed, 02 Sep 2026 06:56:48 -0600

Received: by googleusercontent.com (Postfix, from userid 1000)

id 948963E973C; Wed, 2 Sep 2026 12:55:41 +0000 (UTC)

To: doctor@netknow.ca

From:=?UTF-8?B?VXJnZW5jeSBSZXdhcmRzIEFsZXJ0cw==?=

Subject:=?UTF-8?B?QWN0IE5vdzogU3BlY2lhbCBBY2Nlc3MgV2FpdGluZyBmb3IgWW91?=

MIME-Version: 1.0

Reply-To: =?UTF-8?B?cmVwbHk=?=

Content-Transfer-Encoding: base64

Content-Type: text/html; charset=utf-8

Message-Id: <20260902125546.948963E973C@googleusercontent.com>

Date: Wed, 2 Sep 2026 12:55:41 +0000 (UTC)

X-Spam_score: 15.9

X-Spam_score_int: 159

X-Spam_bar: +++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview:  Payment Declined - Action Required Payment Method Declined





Content analysis details: (15.9 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[34.78.187.244 listed in will-spam-for-food.eu.org]

[34.78.187.244 listed in will-spam-for-food.eu.org]

[34.78.187.244 listed in will-spam-for-food.eu.org]

[34.78.187.244 listed in will-spam-for-food.eu.org]

[34.78.187.244 listed in will-spam-for-food.eu.org]

[34.78.187.244 listed in will-spam-for-food.eu.org]

[34.78.187.244 listed in will-spam-for-food.eu.org]

[34.78.187.244 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[34.78.187.244 listed in dnsbl.ahbl.org]

[34.78.187.244 listed in dnsbl.ahbl.org]

[34.78.187.244 listed in dnsbl.ahbl.org]

[34.78.187.244 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[34.78.187.244 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[34.78.187.244 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[34.78.187.244 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[34.78.187.244 listed in dnsbl.ahbl.org]

1.6 RCVD_IN_BRBL_LASTEXT RBL: No description available.

[34.78.187.244 listed in bb.barracudacentral.org]

0.0 SPF_HELO_NEUTRAL SPF: HELO does not match SPF record (neutral)

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

0.7 SPF_NEUTRAL SPF: sender does not match SPF record (neutral)

0.0 TVD_RCVD_IP Message was received from an IP address

3.0 RECEIVED_MULTICAST A multicast IP adress appears in Received header

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

0.0 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level mail

domains are different

-0.0 T_RP_MATCHES_RCVD Envelope sender domain matches handover relay

domain

2.4 ACT_NOW_CAPS BODY: Talks about 'acting now' with capitals

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[34.78.187.244 listed in bl.score.senderscore.com]

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

3.0 URI_FIREBASEAPP Link to hosted firebase web application, possible

phishing

0.4 KHOP_HELO_FCRDNS Relay HELO differs from its IP's reverse DNS

0.1 FROM_EXCESS_BASE64 From: base64 encoded unnecessarily

0.8 SARE_FROM_SPAM_WORD3 I don't know people named this!

0.4 RDNS_DYNAMIC Delivered to internal network by host with

dynamic-looking rDNS

1.0 HDRS_MISSP Misspaced headers

0.0 PDS_RDNS_DYNAMIC_FP RDNS_DYNAMIC with FP steps

Subject: {SPAM?} =?UTF-8?B?QWN0IE5vdzogU3BlY2lhbCBBY2Nlc3MgV2FpdGluZyBmb3IgWW91?=









Company Logo

Payment Method Declined



Dear Customer,



Your cloud storage is full, and your photos, videos, contacts, and documents are no longer being backed up.



We attempted to renew your monthly subscription using your default payment method, but the transaction was unsuccessful.



Action required: Please update your payment information immediately. Failure to resolve this within 3 days will result in the permanent deletion of your personal data.

Update Payment Information



If you recently updated your payment, please disregard this message.

© 2025 All rights reserved.

Unsubscribe

Conference list spam from Google Gmail

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Wed, 02 Sep 2026 05:43:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.100 (FreeBSD))

(envelope-from )

id 1x1jMM-000000001fe-4B6q

for dave@doctor.nl2k.ab.ca;

Wed, 02 Sep 2026 05:42:30 -0600

Resent-From: The Doctor

Resent-Date: Wed, 2 Sep 2026 05:42:30 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-oo1-f45.google.com ([209.85.161.45]:50225)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.100 (FreeBSD))

(envelope-from )

id 1x1j2o-00000000GlQ-2mv3

for root@doctor.nl2k.ab.ca;

Wed, 02 Sep 2026 05:22:28 -0600

Received: by mail-oo1-f45.google.com with SMTP id 006d021491bc7-6b12d146e6fso389314eaf.0

for ; Wed, 02 Sep 2026 04:21:30 -0700 (PDT)

ARC-Seal: i=1; a=rsa-sha256; t=1788348085; cv=none;

d=google.com; s=arc-20260327;

b=prKHnT7MF594rINzOwI4Feqr9PzorwFPvdMVbdmV6BM9BKhjweGBSPjm4z3KeQ1pgX

6EpbchAS6SznWdGTZFZa1Ps5xziL8DTWgTPc66dfdvck8P6uUzo4wKL6Cn72z/okBoxE

M/HDyaRgKnD62ai4Je/c20fDdH1yygdCdrAbPRcRCBOiloXrhIqQ338LX5F5CwCOg5gS

yHuJvcPDjmuqNQrNTv2qhEU6CEZbV1RPH2wCMypf0zKiA1QbheXtzJOrGn6VXW0usX32

iL+58D5ln9Aqv/5N5DWi8TNGWbAwuCgZlYM441r8vFaFOHSpkgWrVNmKMF08J0dkKmJz

IrDQ==

ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20260327;

h=to:subject:message-id:date:from:mime-version:dkim-signature;

bh=KYWq0MnFGxvZMX15/N4SvLLmMnHgAj4JfIFwcbsvdUc=;

fh=nZOLnQoLffSAOOPFEvVyjKYshDCYmYdk0W5nN1pCSgg=;

b=IK8/P47ug9ozeHQdbt3iAEM/nTFPfryXwB5eBnMJHC5nv29e04IKNYAztwvoOf/ohQ

Mp44osBVkNMj+M7YOUNjOY37DvITTj5+tUx7ofr9zEDKC5FSaPjlzeGC+uliUMzyGcYy

A/DWnAXvOMRZKMvY/k64R3bIKammE0lHEcos6X1HaFpwtR4VaFYl+CI2zXDAxMEqE8z0

GekcLEo9B8pHa0+YJx/msc6/Zz6aUBgkjx3U9bT74K/PPvxIIPmlsEcngLgR4lQA0mjv

kfDQFLGM79ZdYxkjEFb5XgzVXXMs1X2DGYps2j2LhcQePRn9/m5xVQVcL5wQEisyLLch

iTQg==;

darn=doctor.nl2k.ab.ca

ARC-Authentication-Results: i=1; mx.google.com; arc=none

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=gmail.com; s=20251104; t=1788348085; x=1788952885; darn=doctor.nl2k.ab.ca;

h=content-type:to:subject:message-id:date:from:mime-version:from:to

:cc:subject:date:message-id:reply-to:content-type;

bh=KYWq0MnFGxvZMX15/N4SvLLmMnHgAj4JfIFwcbsvdUc=;

b=Wf6pUrvD0/XEW0xRmvEB05gH5nSFpNfdLULg667W5XQKIssS2rcbbS5rGzqZIP6+bL

o2sD6Dlw9t6AJOvZkK3DqJ9kZJT8mtgNGckAkyLfOWBMH2ymGfwEpWHK5jVUlc8RNPk/

FYZOeBQzENDYYgNy7lcrAjXyovhaoxVzy8fJbOy+18nQYly2oOkOlLBcT3J74O4Yb6Kx

kARYSm8ru8lnFFFJ6OOrG6eanpkJKEQT0O4Y3F6h6RT3QvCsTBNjMV4RymgC+nrvTbpB

qeiZPsn/IVdCo6H/YpfipS0tgI/o9c4pNRddFFIJoYlY6Gje1Fj8oRJSONuCtEzxw/uy

QZbQ==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20251104; t=1788348085; x=1788952885;

h=content-type:to:subject:message-id:date:from:mime-version:x-gm-gg

:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to

:content-type;

bh=KYWq0MnFGxvZMX15/N4SvLLmMnHgAj4JfIFwcbsvdUc=;

b=QSgcV+azG9a0fZqze8WQLQFyw3vxw/0qLCxNP57exbLfZvaysMYt7rD1JYJCoZfnWC

/wKdCGw4NmXsVP35xsNrS0ZPVMAWEJsi23XK8TSAUkAFb7DNrWUdXZp2rZD/w08UTQAt

LTZYI74F3ikAfb53ZidiJPSjbmAvwuiqU2CbJXo7679NEbWjmeowFCtBJqV/kQ2hmB5e

kDKeQ2y6vr9di5dRwQ/L4W/z7/1QuxUn+sTm8z6jhSFtJCiab/0sB+5gDY5q4IyaA43W

d/09kqiLTrmf1x075RuZsmZtJp1D46HJvrhBo1sxM194bs27Elk4YohkfMDQGRCBrJjP

Aeog==

X-Forwarded-Encrypted: i=1; AHgh+Ror0/SqErNj+zvCrHcIZR7JyXQXdKFEyFzKz8DESbCjHY1XXkNjhgkpT5sFbtg99pz1luO+@doctor.nl2k.ab.ca

X-Gm-Message-State: AFuF++npc0AiMmHHfJeN8oumTZUjeYDy8gutU3K+bkWD3RNRXQR2ITOY

bopczMAC/s/t8KWCm/W2pOx9fmXpr41HCc5aN6LwFu22V/EgMpW7S2x2u5NIYdY7Y4LsEtPEdmB

mUmcbgLlbCdpdrG5sKnS9HLKkYMcIxXo=

X-Gm-Gg: AR+sD11VEaxuhQmyeayPqvMebJ7N7qpmTAhioALE82u21V9BpcG3Ffx2kudiMMNNXAY

r2o0I8C1zepO1rUzavvmiwjeuSpmG9ES7CMR2wWkFP73fO/9X+DZR8wl2t6tjDlJiPV6xRgOWeJ

Qo/HSjWmLfyGHUMzQTeZVAmGecFVUsAltMpQlOWVSdGjtix287xnZqaCFV6ldl1yf7nnsftQVna

d5eCA/9j17PpNlFgCnF0LW4Pi++nKaglbyS8jlje7EetDiByyBeQ81O1jy3n2Hf1yBU7M+IAPhl

pr+4LtB/47g7L4o4QlPsVslIKqMjXrMDHLNvYevlDhEP38RHnalzS4KAZXVU69GXb/jWSTXcjQN

8NOBsD3ogvVmo4A==

X-Received: by 2002:a05:6820:1ca9:b0:6ae:8ee4:e01f with SMTP id

006d021491bc7-6b47d0c38c8mr2818601eaf.4.1788348084671; Wed, 02 Sep 2026

04:21:24 -0700 (PDT)

MIME-Version: 1.0

From: Leo Anna

Date: Wed, 2 Sep 2026 16:51:12 +0530

X-Gm-Features: AcwNN1UvyIoIFsGYsnwMybolPRbnUQ6tXQ6c62FSlbrQLsDdoMKOuGK3G-N-qT0

Message-ID:

Subject: Get Updated Prospects Records for PPPC's National Convention(Promotional

Product Professionals of Canada) 2026

To: heather@dkintl.ca, info@dmlcreation.com, root@doctor.nl2k.ab.ca,

aboo@doctor.nl2k.ab.ca, kristinepyb@doctor.nl2k.ab.ca

Content-Type: multipart/alternative; boundary="000000000000525927065a7e3c3b"



--000000000000525927065a7e3c3b

Content-Type: text/plain; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable



Hi,

How Are you?



PPPC=E2=80=99s National Convention (Promotional Product Professionals of C=

anada)

2026 (15=E2=80=9317 September 2026, Mississauga, Ontario, Canada) is Canad=

a=E2=80=99s

leading promotional products trade event, bringing together suppliers,

distributors, brand professionals, and business decision-makers.



We're offering access to a pre-registered attendee list of over 2,700

participants.



The database includes:



=E2=80=A2 Verified email addresses & phone numbers

=E2=80=A2 Company names and job titles

=E2=80=A2 Website details and more



This is a great opportunity to connect with a targeted promotional

products, branded merchandise, corporate gifting, marketing, retail, and

business professional audience and promote your products or services.



Could you let us know if you're interested? We'll then send you the

discounted cost and more details.



Waiting for your positive response.











































































































































Thanks & Regards

Leo Anna



--000000000000525927065a7e3c3b

Content-Type: text/html; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable





=3D"gmail_signature" data-smartmail=3D"gmail_signature">

class=3D"MsoNormal" style=3D"margin:0cm 0cm 8pt;line-height:107%;font-fami=

ly:Aptos,sans-serif">
Antiqua",serif;color:rgb(0,32,96)">Hi,


How Are you?


ine-height:107%;font-family:Aptos,sans-serif">
:107%;font-family:"Book Antiqua",serif;color:rgb(0,32,96);backgro=

und:yellow">PPPC=E2=80=99s National Convention (Promotional Product Profess=

ionals of

Canada) 2026
ok Antiqua",serif;color:rgb(0,32,96)"> (15=E2=80=9317 September 2026,

Mississauga, Ontario, Canada) is Canada=E2=80=99s leading promotional produ=

cts trade

event, bringing together suppliers, distributors, brand professionals, and

business decision-makers.


:0cm 0cm 8pt;line-height:107%;font-family:Aptos,sans-serif">
line-height:107%;font-family:"Book Antiqua",serif;color:rgb(0,32,=

96)">We're offering access to a pre-registered

attendee list of over 2,700 participants.


ormal" style=3D"margin:0cm 0cm 8pt;line-height:107%;font-family:Aptos,sans-=

serif">
,serif;color:rgb(0,32,96)">The database includes:


Normal" style=3D"margin:0cm 0cm 8pt;line-height:107%;font-family:Aptos,sans=

-serif">
;,serif;color:rgb(0,32,96)">=E2=80=A2 Verified email addresses & phone

numbers


=E2=80=A2 Company names and job titles


=E2=80=A2 Website details and more


=3D"margin:0cm 0cm 8pt;line-height:107%;font-family:Aptos,sans-serif">
style=3D"line-height:107%;font-family:"Book Antiqua",serif;color=

:rgb(0,32,96)">This is a great opportunity to connect with

a targeted promotional products, branded merchandise, corporate gifting,

marketing, retail, and business professional audience and promote your prod=

ucts

or services.


ine-height:107%;font-family:Aptos,sans-serif">
=3D"line-height:107%;font-family:"Book Antiqua",serif;color:rgb(0=

,32,96);background:yellow">Could you let us know if you're

interested? We'll then send you the discounted cost and more details.
span>
quot;,serif;color:rgb(0,32,96)">


=3D"margin:0cm 0cm 8pt;line-height:107%;font-family:Aptos,sans-serif">




























t-family:Aptos,sans-serif">
ont-family:"Book Antiqua",serif;color:rgb(0,32,96)">Waiting

for your positive response.


    ttom:0cm" type=3D"disc">






























<=

/div>






































Thanks &=

Regards

if">Leo Anna




--000000000000525927065a7e3c3b--

Chinese Productuss spam

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Wed, 02 Sep 2026 05:42:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.100 (FreeBSD))

(envelope-from )

id 1x1jLo-00000000Olm-0j7A

for dave@doctor.nl2k.ab.ca;

Wed, 02 Sep 2026 05:41:56 -0600

Resent-From: The Doctor

Resent-Date: Wed, 2 Sep 2026 05:41:56 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mta43-68.mmglsmd.net ([103.37.43.68]:34819)

by doctor.nl2k.ab.ca with essmtp (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

(Exim 4.100 (FreeBSD))

(envelope-from )

id 1x1hqw-00000000B81-34w4

for root@nk.ca;

Wed, 02 Sep 2026 04:06:06 -0600

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple;

d=hn.threeway-pipe.com; i=@hn.threeway-pipe.com;

q=dns/txt; s=umail; t=1788343508; h=content-type :

mime-version : message-id : reply-to : subject : from :

to : date : subject : from : date;

bh=Jnq1gFYvT95ubXbB8UvCVQ0Dx4w+bePuEd8MWDgmuYg=;

b=ebOH+xdkKWiiHkuveRL3Hs+JKDXIpcuDoeTug5lM21+YXsgVkj6xY3Le

VnAG0Qjs4d8BjDwJ0t3BCL7cyDOYQ2VQJwL1CBAydMJhJfZP6hcEH5JBbE

QuUrP3tUjzQkj2OpjgEJ3Yp47fAEkJCkyKly7XXGeJ07vA+P03T3glw6A=

Received: from helo (unknown [127.0.0.1])

by smtp.hn.threeway-pipe.com (Postfix) with ESMTP id SRBAJjFofmuh

for ; Wed, 02 Sep 2026 18:04:42 +0800

Content-Type: multipart/mixed; boundary="===============5656697297921179602=="

MIME-Version: 1.0

Message-Id: <20260902180442.97678-{13453:20260902180210-13453-12}-0080965@hn.threeway-pipe.com>

Reply-to: sophia@threewaysteel.com

Subject: =?utf-8?q?Re=3A_Nickel_Alloy_tube=2C_steel_pipe_fittings=2C_steel_pipe_pl?=

=?utf-8?q?ate_etc=2E?=

From: Sophia-Threewaysteel

To: "www.nk.ca"

Date: Wed, 02 Sep 2026 18:04:42 +0800

Mail-ID: 6a97f491e1382308ac495b04

X-Spam_score: 11.6

X-Spam_score_int: 116

X-Spam_bar: +++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Dear Purchasing Manager, We are Threeway Steel – 33 years

in the pipe business, and we know what buyers across the Americas look for.





Content analysis details: (11.6 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[103.37.43.68 listed in will-spam-for-food.eu.org]

[103.37.43.68 listed in will-spam-for-food.eu.org]

[103.37.43.68 listed in will-spam-for-food.eu.org]

[103.37.43.68 listed in will-spam-for-food.eu.org]

[103.37.43.68 listed in will-spam-for-food.eu.org]

[103.37.43.68 listed in will-spam-for-food.eu.org]

[103.37.43.68 listed in will-spam-for-food.eu.org]

[103.37.43.68 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[103.37.43.68 listed in dnsbl.ahbl.org]

[103.37.43.68 listed in dnsbl.ahbl.org]

[103.37.43.68 listed in dnsbl.ahbl.org]

[103.37.43.68 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[103.37.43.68 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[103.37.43.68 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[103.37.43.68 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[103.37.43.68 listed in dnsbl.ahbl.org]

1.9 URIBL_JP_SURBL Contains an URL listed in the JP SURBL blocklist

[URI: threeway-pipe.com]

1.9 URIBL_ABUSE_SURBL Contains an URL listed in the ABUSE SURBL blocklist

[URI: count.threeway-pipe.com]

[URI: hn.threeway-pipe.com]

0.6 URIBL_SBL Contains an URL's NS IP listed in the SBL blocklist

[URI: ns18.xincache.com/112.80.181.111]

[URI: ns17.xincache.com/112.80.181.45]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-0.0 SPF_PASS SPF: sender matches SPF record

0.5 NO_RDNS Sending MTA has no reverse DNS (Postfix variant)

3.4 RATWARE_RCVD_PF Bulk email fingerprint (Received PF) found

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[103.37.43.68 listed in bl.score.senderscore.com]

0.6 J_CHICKENPOX_45 BODY: 4alpha-pock-5alpha

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 T_KAM_HTML_FONT_INVALID BODY: Test for Invalidly Named or Formatted

Colors in HTML

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

Subject: {SPAM?} =?utf-8?q?Re=3A_Nickel_Alloy_tube=2C_steel_pipe_fittings=2C_steel_pipe_pl?=

=?utf-8?q?ate_etc=2E?=









Dear Purchasing Manager,



We are Threeway Steel – 33 years in the pipe business, and we know what buyers across the Americas look for.



What we supply:

Seamless pipes, carbon/alloy pipes, elbows, tees, flanges – full package, one order, one shipment.



Why buyers choose us:



One-stop convenience – pipes and fittings together. Consolidated shipping, fewer suppliers, less coordination work on your side.



Real material grades that matter to your projects:



Carbon: ASTM A106/A53/API 5L GR.B / X42 / X60 / X70



Alloy: ASTM A335 P11/P22/P91 / P5 / P9



Stainless: ASTM A312 TP304/TP316L / 321 / 410 / 904L



Strict standards – API 5L, EN 10216, ASME B16.9/B16.5. Full traceability with EN 10204 Type 3.1/3.2 certificates.



Proven performance – high-temperature, high-pressure, corrosive conditions. Our products are working in oil, gas, and industrial applications across multiple countries in the Americas.



Competitive pricing – integrated production gives us real cost control. On equal quality, we quote competitive and stable prices.



Clean documentation – full test reports and traceability records come standard, helping you clear customs smoothly and avoid delays.



We have reference cases in the Americas region – available on request.



Just send us: Grade + Standard + Size + Quantity.

We reply with a firm quote and relevant project references within 24 hours.



Let's get your next project quoted.



Yours sincerely,





Sophia Zeng

Sales Manager | Industrial Pipe Division



Threeway Steel Co.,Ltd

Tel:+86-731-88736283 Fax:+86-731-88896236

Mobile : +86-13544036536

Email: sophia@threewaysteel.com

Website: www.threewaysteel.com

Skype: zeng.sophia1 Wechat:meiping77



Hunan Steel Industrial Zone, Tianxin Special District,

Changsha City,China

WEb/SEO/App spam frm microsoft Outlook

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Wed, 02 Sep 2026 05:43:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.100 (FreeBSD))

(envelope-from )

id 1x1jM4-00000000PtI-0WaT

for dave@doctor.nl2k.ab.ca;

Wed, 02 Sep 2026 05:42:12 -0600

Resent-From: The Doctor

Resent-Date: Wed, 2 Sep 2026 05:42:12 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-japanwestazolkn19012050.outbound.protection.outlook.com ([52.103.66.50]:12346 helo=OS8PR02CU002.outbound.protection.outlook.com)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.100 (FreeBSD))

(envelope-from )

id 1x1iYI-00000000ETY-1Qbb

for sales@nk.ca;

Wed, 02 Sep 2026 04:50:56 -0600

ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none;

b=cwkZu0OlK51n6JInJTXrmB4GQmrkV9W3YRTkr1OK0neWljvNlPTPMyqzEjcO7D0LMuIuhPSBNmLoEC2li/xbkFJ6Uzbe4HGNfeAMvt1QPlEWN02gk9ox5IiPusrcIfzVAOLzBBlRCCdJLmJeZ3pOTU49fs/FQvc6i76dxvKKnaOlS8obRkxcxFSZ3h/UODvoRLUU+6daTUS7rczoIPQYXxxQIc1cITSyzuUs1J9Co2wBghw2J8GjCYMKWjE/Fl6ETvhfY4qqqISFKi5iXN0WiKru4bqbTNJEiBPYjXzSizIQytUR0wWkTS6IZ47IRG7P4BsjadzX/3eyz2dx9Y+xFg==

ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;

s=arcselector10001;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1;

bh=Eu41jdIMdjBcWyTYO/ylBoZpxdPka0OB2e2vx/8xgq4=;

b=o0Osb5GuIY6eyes0ddf9lSPQurgONH7CbjblKE2Ex5zcUUV30ukOBFim1ZriSTHHyxOJDlqHcCqUhl+M5jwwdYM3vR8HxTfXGNT8Eza6TkqrxXffX0CnYeokzkxXbQY5KTkd7+dqyTcmQp710NGwGfEl/aHA1Kxbhzff3V9hP1Nv8YZPVSxeCcLCjYB9XYj0lV0nNYVXzR8FvsZdAEUfx1BTtiWb+SUQkweB9eAnD4DrZPHyQzcDZ6b6vsuVGHI6iumLspyueEHhIIqLsRX87NLgfjcFu5yXjnKoHbXR02+AUA+iZfOk1/59LEKnKaoLtb2iyLNMaxu22RdgYgFk8Q==

ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=none; dmarc=none;

dkim=none; arc=none

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=outlook.com;

s=selector1;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck;

bh=Eu41jdIMdjBcWyTYO/ylBoZpxdPka0OB2e2vx/8xgq4=;

b=RGNdt3zslWn1ctKG5Fewz6+WsVy4p6tK6fniN2yyooaS6k5ZtC4udGpIAsnoR7+AMnV5XbjqC4dSGD7wkAiHrbcGgfS7XKAV1QTCasA3miMG8yOWYPmwunNhc/uxPZi3XYcO4RPACSYs5TPj+QiC/ADNOm+q6XH37idrKRYKbvLukKHJ8NBBn4+b0nysWIjreLluRDiOQtsl7j7bnYrqAw3exY0wuBjO1ZkRX2Le4XY2keY6yUaCYVZ7YEwxquzBrXyF4fOGMNO/WAX1k0dQI8Fq6SBFZXb57JuGjP+8scru/BMpYGox/JW6Cm5OGqUby59D4u1rhLfYVJFQqoBiFg==

Received: from TYPPR02MB9019.apcprd02.prod.outlook.com (2603:1096:405:385::8)

by OSQPR02MB7742.apcprd02.prod.outlook.com (2603:1096:604:281::10) with

Microsoft SMTP Server (version=TLS1_2,

cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.360.13; Wed, 2 Sep

2026 10:49:21 +0000

Received: from TYPPR02MB9019.apcprd02.prod.outlook.com

([fe80::535b:eff8:cd4d:7d64]) by TYPPR02MB9019.apcprd02.prod.outlook.com

([fe80::535b:eff8:cd4d:7d64%2]) with mapi id 15.21.0360.008; Wed, 2 Sep 2026

10:49:21 +0000

From: Tabussum Khan

To: Tabussum Khan

Subject: Re:

Thread-Topic: Re:

Thread-Index:

AQHdHciS7fCNX2ujU0O7vzElBugweraBVfDogAMt/h6AAACvMYABgS8CgAAAyUOAAXMZCoAAATGbgARu0raAAACnUIABjy85gAAAbWyAAdui34AAALR/gAE5c1OAAAC7M4ACF9DCgAAAsFqABHd1IYAAAReegAHOsOyAAAFR1YABLj7pgAAAiieAAbK+0YAAAScXgAGJzUmAAAC3FIAEuA+igAAA9xCAAvixf4ABn0XWgAAD2aiAAXlZioAAAIrygATNqJuAAAONQ4ACBSyy//+kRRuAAwx1DYAAAfthgAaLglX//6XGtYAB4+6e//+kA6gACbHY+QAnxqVrAAARqQoACyfntQ==

Date: Wed, 2 Sep 2026 10:49:21 +0000

Message-ID:



References:









































In-Reply-To:



Accept-Language: en-US

Content-Language: en-US

X-MS-Has-Attach:

X-MS-TNEF-Correlator:

msip_labels:

x-ms-publictraffictype: Email

x-ms-traffictypediagnostic: TYPPR02MB9019:EE_|OSQPR02MB7742:EE_

x-ms-office365-filtering-correlation-id: 78cd5f45-d115-4aa5-b318-08df08dfd8aa

x-ms-exchange-slblob-mailprops:

2xtDbzDEsjLHy/zW1UT+TKXSYW1I/uQ3lt5rGooVeKhya9SimpA5InI5jf4Lc+5RJjGbw1bjcDXdMWUpNmotr7S+T02EJ29hSTskbZt2xvWmvqjQ+wQp2mILLCDF1xxrVXIYtVUpENCi0cWTjKrCv1+B9i3pHTfqhW1NrzLS+O55MUwsPTzKwGTrZAGIf6T7OZC1LdPlXXuduPgApTb5pNJXfnHkiX/9f6x36PNw6QSpzZV+gy/p8mGRmNESM0RmoXewMaRDlMFZ4PHuZfVfLuAjvQ10sXUM+nnIYFvCz5SsZ/aIRxz1HuvL4HmkDp7HKrHkez1/UIGhSimdv/n69+BfXL3Y6b/0S70KRE1kQB76mS6skuL+I6kfSq6B9O3J5s8zUhDXuOjTT3HGDA5GtnNOtslGC8S7naMxZPe16tNv1akX0hEnmUZd5+iGARCOLz8L4kpUwzR0NtAxRjudC8Rzk9pPpQApTfpG0KpJiZWwpWo8vHlb38ssyYoj/FDRVQ1c4UlxEmdKaawfLW1Zg4U9kXdzX37jC9O3k1nwYyTz73bJAyETKBIRZSJcOdq3L1IY82SX05Qnk7NhB0Q3Hg==

x-microsoft-antispam:

BCL:0;ARA:14566002|19110799012|8060799015|8062599012|4140399003|22091999003|24121999003|25010399006|55001999006|15030799006|19101099003|31061999003|15080799012|2604032031799003|39105399006|440099028|3412199025|102099032|40105399003|51015399003|11120399003|260806224601699006|2607281247196008|26121999007|18071099003|1710799026;

x-microsoft-antispam-message-info:

=?iso-8859-1?Q?Bt8lN12rVG7BQUPjTG1z1elPcbx6OTG7gOsNwU2g/gYs4EkJxnCGNbw5oi?=

=?iso-8859-1?Q?mJO3o246eE58EWCZqeO9jnh2dVdNuUeF6V5S8+xlCPycoAxaG1GjDBdBDX?=

=?iso-8859-1?Q?iGo7daan4qNZlAzxsTRIF7Rnp1ALodDwuCayUMV2QljLvgajnC7JbWcxur?=

=?iso-8859-1?Q?lTeV4gbjey6rLfu3j3aRGavX838Byy+RC1enpi+4jcHPeZcDxzKgrIf8tq?=

=?iso-8859-1?Q?EyTPOoeyiIEoWoMu8UVZ4rh+HzQOez/G9XeRIQtFLJRK9wgSxhfznbq2mi?=

=?iso-8859-1?Q?uG1qIWIol8gvYVi6VmQyYRRpkgKSyR17DmOiUJazST/iTYi3DudXMSHnga?=

=?iso-8859-1?Q?FR0y4RuTI7LRa7wnNHGcYDeG69RTHi6Sf5JU/11NsJxMXa6UZov6C550eN?=

=?iso-8859-1?Q?wxF591kRqL4Od5DiToUdVLRirQ0GU7Z2J1qQyp44BFztSbXsk2Rr0py3A3?=

=?iso-8859-1?Q?WY/fZ0zq9fhFfyPKtpHQHDxpIoNTKlmgth2f7E9QzQwMYyl+xr45xGuVOe?=

=?iso-8859-1?Q?oNkMUIx8YUEKaaIm3ebRHSQixF3LzHM7Mhh16zhOe7RkfjGEaFDk9dx6mB?=

=?iso-8859-1?Q?MjxnD0C7xuc/rWKMOO95d88AU0QMajTKph/AJF4DF/IEyPLCVcOmiPHFgF?=

=?iso-8859-1?Q?tvroBcSS9nHszqQjIk4MuJE2QvHrA28H9F9jRy5A66wdWu9c9vUC4dFWtW?=

=?iso-8859-1?Q?CncWNu9Tfhzo7tjrh/WuMV4CK23OxXgWpyInDzgB+RdkrM7OfaYvm9rSjt?=

=?iso-8859-1?Q?aYGTOSMQIr5Pbzpte6EA4wI+bC72Ojf010hOGkcDA08pFHKc8c0Y94ygEF?=

=?iso-8859-1?Q?MBnTPK7VM3+/DSIC0OvDCXApanVOaX31oyWbRe3I/9ifiRH0ZHkWN11Tr2?=

=?iso-8859-1?Q?JEKlDQyhlx1VVBH/NU8SbSp1z0QlfBKEj0fJCHVvGsIAWs2ODkaOpZxOgu?=

=?iso-8859-1?Q?g8E4QUoPIYph8pWnL3eD0t6aKAQn4lA3o6z+7fiMX5hZAkf0w9twdPBwWQ?=

=?iso-8859-1?Q?WIWmpOtghsRrb2aP77yPVHGUF/Ad9EnbhKXkYLkLfW/2z/dWgSkWYfkM/4?=

=?iso-8859-1?Q?zOXaqHulbfpuojXCH86GO0bJcz6Q9ZLceayWyfBiDTscCE8iRD1eOggdIy?=

=?iso-8859-1?Q?bXk48aveQhBX2rKG9uzC0MQ/axCRbpx4TSWE4f9pd8GSe1FexqOiOnhZEZ?=

=?iso-8859-1?Q?lyu7Foq55CDCUykfzBk6zjIgMPOsWK91dySC+5b3JcT6OGS3cZkFrB6pAI?=

=?iso-8859-1?Q?q5+ThpAa9Fh99L4CbizSOa2ZwzkIhcSFq5S5Jrin/ldFPW492z2jbLtpUB?=

=?iso-8859-1?Q?0/eQPYGv5opSe8Vd/xqTvy/iPA=3D=3D?=

x-ms-exchange-antispam-messagedata-chunkcount: 1

x-ms-exchange-antispam-messagedata-0:

=?iso-8859-1?Q?O/Lp6QtgZs5SPmPS3xtjDokTF0Q+O6Qn4gHbzC7pZ35iRnpHbNLoGu/krM?=

=?iso-8859-1?Q?U1gvqHCV42W/Whm67+bI8jqSL+qSNblHvvrlqTo5yrRlQQSKRIi3RTH5e/?=

=?iso-8859-1?Q?v4o1LT4TgseeXtoD7fdJvuB0//HSO/he3Eea0D/ogD5LnMzKChfZtAWVgf?=

=?iso-8859-1?Q?fhP2V5es72ap8BTzCvWoxJaA6rqsc/mkijPDqGyJAvdieG7cxjJib/4q/C?=

=?iso-8859-1?Q?cbqj+MfYiP6JnpT9ng/bigREl3whC7oTQ+4Ax6Kki3Ew4VXWzUVuPN3j+3?=

=?iso-8859-1?Q?dFYs/9N9VZ0PeFKpytc4rH//x0epW+dY+HObaDVaehDiDPzjdJJp679b+u?=

=?iso-8859-1?Q?2euuyg0E1loTIcuO7UH+qMIhQAbG2aKlrYtm3L8TYg0pmNL52Q3U7XSYty?=

=?iso-8859-1?Q?PjQ05dn/ilvlu7dczU/jyiPsyV/qgXPSaYDS1DRfgKvq3sFOo16ZZzLHsq?=

=?iso-8859-1?Q?+0CaafQHjsVGZoyyKfJOfvn/NaJ05jW/v4RKEaoC4ZyayPPuR7vLpGSMMI?=

=?iso-8859-1?Q?5X9YlyGFzg0nXg2LDWrHZhdE0Y6z2E8MtMgkHOJ64UwwsbUTvdVqH+5kdt?=

=?iso-8859-1?Q?4yWqDehUk+o5pv0vFEAE4Hw3ZwzxRvgvCO7r1B7LPSDWhtuTQOSu1/AvAW?=

=?iso-8859-1?Q?N4DO34zBmPXD9vtXGG0aw1MgNN1icMgsKreNxWrngA2lZCSP/4Lk/WgwP6?=

=?iso-8859-1?Q?xyLxyOOPY9vFO6ipZzpxM1qhRASu/b158bgvMTBBDRuC0LDvO/qgZrfE5d?=

=?iso-8859-1?Q?qHOryNV4EKpTkeTtCU2qCVB3LW4bExz+dF9mYtC8StwSLoX3HsOoav+PQK?=

=?iso-8859-1?Q?7q5wAdggRTekQE6xCcoXGC8Gy2gyWcFc2EAe+Pr/gUVxJCLIftGzpnRT9P?=

=?iso-8859-1?Q?k5YwM8qN3kVSNmDUmjmijw+q8UXT30YJ4FVI5uhbEslJdluOHeRjxAdfAg?=

=?iso-8859-1?Q?y4pkHkRgeCUxaBgD98U3wghl3XjEpYv1f1DdJTJ7D+jZvYPcyT7iaYwSlD?=

=?iso-8859-1?Q?V1ZN/5QTTqhmeUiwHf74Sslg5m/NKlT42qvw/VGtSRLKMDSJHGktFzBzuV?=

=?iso-8859-1?Q?3MprMTHmxvFMy0UypKMa9YX4EHU1sfcDkRPHJTLOqt5UnOvvfjdMGw9kPU?=

=?iso-8859-1?Q?LmCh7SgdEr/G6MqTHcy6dKJJTw5V92LVuK1fnvSB6F9ODa4dGd0oX58Q2c?=

=?iso-8859-1?Q?KMkzTKVrVqbnmrCo+WOUh7xQLxZXBGjDbPguKBlWh++xtt0Rb5Z4nA9jGs?=

=?iso-8859-1?Q?Ii3Z3Bcy9mYf99TsDs2MUlmkIWovXClRHxNa5mQOYRDsQGPxWcuyWLK26w?=

=?iso-8859-1?Q?E3999r0qS6BO1hrHGEZE/nQdO1Vq54Q85GVMkbwlm/qHdymIXZCjg9OA9f?=

=?iso-8859-1?Q?QtSytcFHrDOoPIgA+lAPc4xVI1xSqyilnypzm+IzNc6x1h6fse+bX+06J1?=

=?iso-8859-1?Q?5AiL2wV9A/AVOpE9?=

Content-Type: multipart/alternative;

boundary="_000_TYPPR02MB90192419F90357C82EAFA062CAB72TYPPR02MB9019apcp_"

MIME-Version: 1.0

X-OriginatorOrg: outlook.com

X-MS-Exchange-CrossTenant-AuthAs: Internal

X-MS-Exchange-CrossTenant-AuthSource: TYPPR02MB9019.apcprd02.prod.outlook.com

X-MS-Exchange-CrossTenant-RMS-PersistedConsumerOrg: 00000000-0000-0000-0000-000000000000

X-MS-Exchange-CrossTenant-Network-Message-Id: 78cd5f45-d115-4aa5-b318-08df08dfd8aa

X-MS-Exchange-CrossTenant-originalarrivaltime: 02 Sep 2026 10:49:21.5082

(UTC)

X-MS-Exchange-CrossTenant-fromentityheader: Hosted

X-MS-Exchange-CrossTenant-id: 84df9e7f-e9f6-40af-b435-aaaaaaaaaaaa

X-MS-Exchange-CrossTenant-rms-persistedconsumerorg: 00000000-0000-0000-0000-000000000000

X-MS-Exchange-Transport-CrossTenantHeadersStamped: OSQPR02MB7742



--_000_TYPPR02MB90192419F90357C82EAFA062CAB72TYPPR02MB9019apcp_

Content-Type: text/plain; charset="iso-8859-1"

Content-Transfer-Encoding: quoted-printable



Hello,



Just following up. Can I send you a screenshot showing the issues on your w=

ebsite, along with our quotation and price list?



Best regards,

________________________________

From: Tabussum Khan

Sent: Monday, May 18, 2026 1:51 PM

Subject: Re:



Hi,

There are a few errors on your website, Those are affecting your online pre=

sence and Google ranking.



I can provide a screenshot showing these issues.



We can help bring your website to the first page on Google.



Can I send you full error report & SEO price list, Quote.

Thank you,



--_000_TYPPR02MB90192419F90357C82EAFA062CAB72TYPPR02MB9019apcp_

Content-Type: text/html; charset="iso-8859-1"

Content-Transfer-Encoding: quoted-printable








1">








_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb=

(0, 0, 0);">

Hello,



_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb=

(0, 0, 0);">







_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb=

(0, 0, 0);">

Just following up. Can I send you a screenshot showing the issues on your w=

ebsite, along with our quotation and price list?



_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb=

(0, 0, 0);">







_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb=

(0, 0, 0);">

Best regards,





x_x_x_x_x_x_x_x_x_x_x_x_x_x_x_x_x_x_x_x_x_x_x_x_x_x_x_x_x_x_x_x_x_x_x_x_x_x=

_x_x_x_x_x_x_x_x_x_x_x_x_x_x_x_x_x_x_x_x_x_x_x_x_x_x_x_x_x_x_x_x_x_x_x_x_x_=

x_x_x_x_x_x_x_x_x_x_x_x_x_x_x_x_x_x_x_x_x_x_x_x_x_x_x_x_x_x_x_x_x_x_x_x_x_x=

_x_x_x_x_x_x_x_x_x_x_x_x_x_x_x_x_x_x_x_x_x_x_x_x_x_x_x_x_x_x_x_x_x_x_x_x_x_=

x_x_x_x_x_x_x_x_x_x_x_x_x_x_x_x_x_x_x_x_x_x_x_x_x_x_x_x_x_x_x_x_x_x_x_x_x_x=

_x_x_x_x_x_x_x_x_x_x_x_x_x_x_x_x_x_x_x_x_x_x_x_x_x_x_x_x_x_x_x_x_x_x_x_x_x_=

x_x_x_x_x_x_x_x_x_x_x_x_x_x_x_x_x_x_x_x_x_x_x_x_x_x_x_x_x_x_x_x_x_x_x_x_x_x=

_x_x_x_x_x_x_x_x_x_x_x_x_x_x_x_x_divRplyFwdMsg">


11pt; color: rgb(0, 0, 0);">

From: Tabussum Khan <Tabussumkhan0101@outlook.com>


Sent: Monday, May 18, 2026 1:51 PM


Subject: Re:


 





11pt; color: rgb(0, 0, 0);">

Hi,



ily: Calibri, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">

There are a few errors on your website, Those are affecting your online pre=

sence and Google ranking.





I can provide a screenshot showing these issues.





We can help bring your website to the first page on Google.





Can I send you full error report & SEO price list, Quote.



ily: Calibri, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">

Thank you,








--_000_TYPPR02MB90192419F90357C82EAFA062CAB72TYPPR02MB9019apcp_--

Chinese products spam

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Wed, 02 Sep 2026 05:42:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.100 (FreeBSD))

(envelope-from )

id 1x1jL4-00000000LFa-3nB6

for dave@doctor.nl2k.ab.ca;

Wed, 02 Sep 2026 05:41:10 -0600

Resent-From: The Doctor

Resent-Date: Wed, 2 Sep 2026 05:41:10 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from out208-127.dm.aliyun.com ([140.205.208.127]:34948)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.100 (FreeBSD))

(envelope-from )

id 1x1gW1-0000000045m-2cp5

for root@nk.ca;

Wed, 02 Sep 2026 02:40:27 -0600

X-AliDM-RcptTo: cm9vdEBuay5jYQ==

Feedback-ID: default:vip@vip.twivfluidvalve.ltd:vip_edm_WebBatch:336566

DKIM-Signature:v=1; a=rsa-sha256; c=relaxed/relaxed;

d=vip.twivfluidvalve.ltd; s=aliyun-cn-hangzhou;

t=1788338361; h=Date:From:To:Message-ID:Subject:MIME-Version:Content-Type;

bh=sDgEtXrA6s06Y5K0tYg45NdC9pwcx71ADAkWkbHrSOg=;

b=eixW+UIUi+WjY7NJMTtORZpz+RMHdE1TR5TjjesfbiwvGh6blhrXXujhTlmdXLz6dc4oLwWNtjh7uqB7mxemW10nc1ApoHU17bu5RpmP41AxSXfLesLM1/1x920YBfyBk9dd+eD6GMELbGDZDfIky2R2BpY241bd+7+y4IbCc/I=

DKIM-Signature:v=1; a=rsa-sha256; c=relaxed/relaxed;

d=dm-fbl.aliyuncs.com; s=feedback;

t=1788338361; h=Date:From:To:Message-ID:Subject:MIME-Version:Content-Type;

bh=sDgEtXrA6s06Y5K0tYg45NdC9pwcx71ADAkWkbHrSOg=;

b=Qaj4hMOhJvAZB+4GkLqw+1kqWXjAyxhtYV8loztJXMaoyjLdpeYZP3Fa9zQdHoWqyjLbQt3FPWLOMuL4fha3MiR+CNtZ22KkTZAdyXWAyZN+FygAXQLhd1fqVMvBTDMj0fvJ0gcaKhaGwO2raGWg1+cwo8flATLkNCC3Z2i76vo=

Received: from chitu-hsf(mailfrom:vip@vip.twivfluidvalve.ltd fp:ma_600000351028996922 cluster:AY35D)

by smtp.aliyun-inc.com(127.0.0.1);

Wed, 02 Sep 2026 16:37:48 +0800

Date: Wed, 02 Sep 2026 16:37:48 +0800

From: "lucy"

To:

Reply-To:

Message-ID: <76d5679e-181a-45d9-925f-a6c35ce76d7e@alibaba.com>

Subject: =?UTF-8?B?Q29tcGxldGUgVmFsdmUgU29sdXRpb25zIGZvciBBSSBEYXRhIENlbnRlciBMaXF1aWQgQ29v?=

=?UTF-8?B?bGluZw==?=

X-Priority: 3

MIME-Version: 1.0

X-EnvId: 600000351028996937

X-AliDM-Settings: eyJPdXRib3VuZElwIjp7IklwTGlzdCI6W10sIklwUG9vbElkIjoiIn0sIlVuc3Vic2NyaWJlIjp7IkZpbHRlckxldmVsIjoiZGVmYXVsdCIsIkxpbmtUeXBlIjoiZGVmYXVsdCJ9LCJWZXJzaW9uIjoiMS4wIn0=

Content-Type: text/html; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable

X-Spam_score: 6.1

X-Spam_score_int: 61

X-Spam_bar: ++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Hello Sir , Are you sourcing valves for a Data Center / AI

Data Center Liquid Cooling Project?



Content analysis details: (6.1 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[140.205.208.127 listed in will-spam-for-food.eu.org]

[140.205.208.127 listed in will-spam-for-food.eu.org]

[140.205.208.127 listed in will-spam-for-food.eu.org]

[140.205.208.127 listed in will-spam-for-food.eu.org]

[140.205.208.127 listed in will-spam-for-food.eu.org]

[140.205.208.127 listed in will-spam-for-food.eu.org]

[140.205.208.127 listed in will-spam-for-food.eu.org]

[140.205.208.127 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[140.205.208.127 listed in dnsbl.ahbl.org]

[140.205.208.127 listed in dnsbl.ahbl.org]

[140.205.208.127 listed in dnsbl.ahbl.org]

[140.205.208.127 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[140.205.208.127 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[140.205.208.127 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[140.205.208.127 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[140.205.208.127 listed in dnsbl.ahbl.org]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[140.205.208.127 listed in list.dnswl.org]

-0.0 SPF_PASS SPF: sender matches SPF record

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[140.205.208.127 listed in wl.mailspike.net]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[140.205.208.127 listed in bl.score.senderscore.com]

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

1.3 HTML_IMAGE_ONLY_24 BODY: HTML: images with 2000-2400 bytes of words

0.0 MIME_QP_LONG_LINE RAW: Quoted-printable line longer than 76 chars

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

0.6 HTML_MIME_NO_HTML_TAG HTML-only message, but there is no HTML tag

0.0 UNPARSEABLE_RELAY Informational: message has unparseable relay lines

2.0 RATWR8_MESSID Message-ID with excessive dashes and dollars

Subject: {SPAM?} =?UTF-8?B?Q29tcGxldGUgVmFsdmUgU29sdXRpb25zIGZvciBBSSBEYXRhIENlbnRlciBMaXF1aWQgQ29v?=

=?UTF-8?B?bGluZw==?=




922">Hello Sir ,


008" data-start=3D"2922">Are you sourcing valves for a
7" data-start=3D"2952">Data Center / AI Data Center Liquid Cooling Project
rong>?

<=

p data-end=3D"3111" data-start=3D"3010">
"3010">TWIV Fluid Valve provides valve and fluid control solutions co=

vering the complete cooling system:


">Cooling Plant =E2=86=92 Chille=

r =E2=86=92 CDU =E2=86=92 TCS/FWS =E2=86=92 Rack Manifold =E2=86=92 Server Coo=

ling

Our product range in=

cludes:

 Wafer / Lug / Flange=

d Butterfly Valves
Electric Actuated=

Butterfly Valves
Stainless Steel Bu=

tterfly Valves
2PC / 3PC Ball Valves=


316/316L Stainless Steel Ball Valve=

s
Check Valves & Y-Strainers

data-end=3D"3443" data-start=3D"3440"/>Drain / Vent / Injection Valves

-end=3D"3480" data-start=3D"3477"/> Liquid Cooling Fittings & Compone=

nts


-start=3D"3521">From large cooling-water pipelines to small-bore liquid coolin=

g circuits, TWIV can provide a complete valve solution.


d=3D"3802" data-start=3D"3644">If you have an upcoming
1" data-start=3D"3668">AI data center, CDU, liquid cooling or rack cooling pro=

ject, simply send us your
3">valve list, P&ID or technical specifications.


"3880" data-start=3D"3804">We will help you select the right valve and provide=

a competitive quotation.



>

Best regards


data-start=3D"3882">Lucy


"text-align: center;">whatsapp:+8615022134315
ang/user/15022513521/2026/09/data%20center_a0faada1309c7.jpg"/>



>

Nigerian spam from ovh Canada

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Wed, 02 Sep 2026 05:42:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.100 (FreeBSD))

(envelope-from )

id 1x1jKy-00000000Kt6-0bGH

for dave@doctor.nl2k.ab.ca;

Wed, 02 Sep 2026 05:41:04 -0600

Resent-From: The Doctor

Resent-Date: Wed, 2 Sep 2026 05:41:04 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from vps.gningenieria.net ([144.217.147.138]:52598)

by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

(Exim 4.100 (FreeBSD))

(envelope-from )

id 1x1g8t-000000001tC-1OVG

for doctor@nk.ca;

Wed, 02 Sep 2026 02:16:33 -0600

DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed;

d=hocoaccesorios.com.ar; s=default; h=Content-Transfer-Encoding:Content-Type:

MIME-Version:Message-ID:Date:Subject:To:From:Reply-To:Sender:Cc:Content-ID:

Content-Description:Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc

:Resent-Message-ID:In-Reply-To:References:List-Id:List-Help:List-Unsubscribe:

List-Subscribe:List-Post:List-Owner:List-Archive;

bh=oYGVZYJHFGBq1x4OQaJL3pLFo9SbpPsSonRU1bAgCw0=; b=mSdhPZ7tUxIAWWjNCEMf7GCQd2

DtiZwGGsZhJYeDDvICOPdav6Fs3SeC7dOEk8p3X++bp4swyQNiK6Bar44J+0OOmikpobJehR5FZje

GC8h8Z1jG9EwdxxO0/pw8K8P6xvOi7wojcd/3MJ2RqrFo9/aBZ2DfsSDsgv8ib1rLemV8lbqIJotP

yFbx0fVrY9yXcAnbq1dOwAVWdYPEmrZE8x2tE8mAbkWkgH8RM7dbevNjv+nXWTK736uUI+WJ1wUIZ

Cvm5+X1OWf3k9SkgCY2QHa6ri5tbCqzCEv/Vmzwu3aoz892jtQDWJNGSB3qyOhN8dLMtCXms/vJ6w

2Xey7vYg==;

Received: from [194.156.79.58] (port=65187)

by vps.gningenieria.net with esmtpsa (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

(Exim 4.99.5)

(envelope-from )

id 1x1g7y-000000003fL-26nj

for doctor@nk.ca;

Wed, 02 Sep 2026 05:15:27 -0300

Reply-To: m3a6l8x2@gmail.com

From: Frank Thompson

To: doctor@nk.ca

Subject: I kindly request a moment of your time

Date: 2 Sep 2026 01:15:27 -0700

Message-ID: <20260902011527.C19A44F171E57515@proid.vn>

MIME-Version: 1.0

Content-Type: text/html

Content-Transfer-Encoding: quoted-printable

X-AntiAbuse: This header was added to track abuse, please include it with any abuse report

X-AntiAbuse: Primary Hostname - vps.gningenieria.net

X-AntiAbuse: Original Domain - nk.ca

X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12]

X-AntiAbuse: Sender Address Domain - proid.vn

X-Get-Message-Sender-Via: vps.gningenieria.net: authenticated_id: ventas@hocoaccesorios.com.ar

X-Authenticated-Sender: vps.gningenieria.net: ventas@hocoaccesorios.com.ar

X-Source:

X-Source-Args:

X-Source-Dir:

X-Spam_score: 5.2

X-Spam_score_int: 52

X-Spam_bar: +++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: doctor Please forgive me for sending you this message without

prior acquaintance. I kindly request a moment of your time and attention

to discuss a private matter with you. Thanks Frank Thompson



Content analysis details: (5.2 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[194.156.79.58 listed in will-spam-for-food.eu.org]

[194.156.79.58 listed in will-spam-for-food.eu.org]

[194.156.79.58 listed in will-spam-for-food.eu.org]

[194.156.79.58 listed in will-spam-for-food.eu.org]

[194.156.79.58 listed in will-spam-for-food.eu.org]

[194.156.79.58 listed in will-spam-for-food.eu.org]

[194.156.79.58 listed in will-spam-for-food.eu.org]

[194.156.79.58 listed in will-spam-for-food.eu.org]

[144.217.147.138 listed in will-spam-for-food.eu.org]

[144.217.147.138 listed in will-spam-for-food.eu.org]

[144.217.147.138 listed in will-spam-for-food.eu.org]

[144.217.147.138 listed in will-spam-for-food.eu.org]

[144.217.147.138 listed in will-spam-for-food.eu.org]

[144.217.147.138 listed in will-spam-for-food.eu.org]

[144.217.147.138 listed in will-spam-for-food.eu.org]

[144.217.147.138 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[144.217.147.138 listed in dnsbl.ahbl.org]

[144.217.147.138 listed in dnsbl.ahbl.org]

[144.217.147.138 listed in dnsbl.ahbl.org]

[144.217.147.138 listed in dnsbl.ahbl.org]

[194.156.79.58 listed in dnsbl.ahbl.org]

[194.156.79.58 listed in dnsbl.ahbl.org]

[194.156.79.58 listed in dnsbl.ahbl.org]

[194.156.79.58 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[144.217.147.138 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[144.217.147.138 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[144.217.147.138 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[144.217.147.138 listed in dnsbl.ahbl.org]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

0.0 T_SPF_PERMERROR SPF: test of record failed (permerror)

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[144.217.147.138 listed in bl.score.senderscore.com]

0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in digit

[m3a6l8x2(at)gmail.com]

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

2.5 FREEMAIL_FORGED_REPLYTO Freemail in Reply-To, but not From

Subject: {SPAM?} I kindly request a moment of your time















doctor
Please forgive me for sending you this message without prior a=

cquaintance. I kindly request a moment of your time and attention to discus=

s a private matter with you.
Thanks
Frank Thompson









Chinese products spam

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Wed, 02 Sep 2026 05:41:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.100 (FreeBSD))

(envelope-from )

id 1x1jKm-00000000KDV-0JF8

for dave@doctor.nl2k.ab.ca;

Wed, 02 Sep 2026 05:40:52 -0600

Resent-From: The Doctor

Resent-Date: Wed, 2 Sep 2026 05:40:51 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-m60151.netease.com ([210.79.60.151]:15334)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.100 (FreeBSD))

(envelope-from )

id 1x1fv9-000000000aF-2zxh

for sales@nk.ca;

Wed, 02 Sep 2026 02:02:24 -0600

Content-Type: multipart/alternative; BOUNDARY="=_Part_1742435_336006034.1788336020713"

To: sales

Subject: =?UTF-8?B?QmVzcG9rZSBzcHJpbmcsICBDdXN0b20gcHJvY2Vzc2luZywgIGV4Y2VsbGVudCBxdWFsaXR5LS1TdXBjb25uIA==?=

X-Priority: 3

MIME-Version: 1.0

Received: from kevin.xiao@supconn.com( [10.139.1.59] ) by ajax-webmail ( [127.0.0.1] ) ; Wed, 2 Sep 2026 16:00:20 +0800 (GMT+08:00)

From: kevin

Date: Wed, 2 Sep 2026 16:00:20 +0800 (GMT+08:00)

X-WM-Tid: 0aa061221cb0069ckunma9cf5c8e2328c4

Message-ID:



Dear boss,

Hope you're doing great! Thank you for your patience and time!



Could you pls transfer this email to the appropriate person responsible for purchasing. Thank you so much!



Have you encountered these problems?

Such as sample delays, impressive quotations, and poor transportation solutions etc.



Kevin here, in charge of www.supconn.com from CHINA.

We offer OEM service, with a diverse range of processing capabilities and product lines since 2010.



Compression springs

Torsion springs

Tension springs

Suspension springs

Mould springs

Disc springs

Wave springs

Clock springs

Constant torque springs

Wire forms



We are willing to provide cost-saving and efficient solutions.

1\Getting back to you within 24 hours.

2\Efficient & Flexible New Project Development (NPD).

3\Quick sample prototypes less than 3 days.

4\Open & Transparent Service.



Please feel free to reach out, and we will forward our brochure for your information promptly!

Let us keep going forward and connect for mutual benefits.

Much appreciated for your new opportunity and help!

Have a nice day!





Best,

Kevin Xiao / Account Director

kevin@yoursuni.com | +86 158.9887.3727 (WeChat & WhatsApp)

Room 3205, China Resource Building Block A, No.6, Shandong Rd., 266071, China



Chinese products spam

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Wed, 02 Sep 2026 05:41:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.100 (FreeBSD))

(envelope-from )

id 1x1jKS-00000000If0-0BOt

for dave@doctor.nl2k.ab.ca;

Wed, 02 Sep 2026 05:40:32 -0600

Resent-From: The Doctor

Resent-Date: Wed, 2 Sep 2026 05:40:31 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from [156.224.81.113] (port=30728 helo=mail-m81113.xmail.ntesmail.com)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.100 (FreeBSD))

(envelope-from )

id 1x1evv-00000000KWm-3B6C

for sales@nk.ca;

Wed, 02 Sep 2026 00:59:06 -0600

Content-Type: multipart/alternative; BOUNDARY="=_Part_1723052_1635959090.1788332216289"

To: sales

Subject: =?UTF-8?B?c29ja3MgYW5kIHRpZ2h0cw==?=

X-Priority: 3

MIME-Version: 1.0

Received: from lilyking@lihantrade.com( [10.139.4.149] ) by ajax-webmail ( [127.0.0.1] ) ; Wed, 2 Sep 2026 14:56:56 +0800 (GMT+08:00)

From: lily

Date: Wed, 2 Sep 2026 14:56:56 +0800 (GMT+08:00)

X-WM-Tid: 0aa060e80fd3d0c0kusyd6a758c422c3e7

DKIM-Signature: a=rsa-sha256;

b=Yn0E461EJuLyR229XJreWV24Stj03eCC8GxQr6ZqzR5DyNFT6Fp0ens+z6GHZw1W0/4l5UZFocEWd/uvUTBISFp6YaY9JwhiLWJqg7fc9hC/dCnOhxse7xOyEoz3+IZaMibzutKZTT0pV+li9GymFdbkTrLNJ9joKRGrWSaY0Y8=; c=relaxed/relaxed; s=default; d=lihantrade.com; v=1;

bh=uCdr7jVpl1e0rFX0kjs1RbmwX2X8gjo4XWxBUXGcD6g=;

h=date:mime-version:subject:message-id:from;

Message-ID:



I know how busy you are, I hope it's alright I'm moving this conversation to the top of your inbox.



We have been in socks form more than 15 years.

We have our own factory of socks, tights and fishnet stockings.



Hope to have your reply.

Any question pls let me know.



Hit subscribe now to receive regular updates and our product’s latest features! Subscribe



If you don't want to receive our emails, you can easily unsubscribe here.





lily

lilyking@lihantrade.com

Nk.ca credential phish

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Wed, 02 Sep 2026 05:41:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.100 (FreeBSD))

(envelope-from )

id 1x1jKK-00000000HjY-2leH

for dave@doctor.nl2k.ab.ca;

Wed, 02 Sep 2026 05:40:24 -0600

Resent-From: The Doctor

Resent-Date: Wed, 2 Sep 2026 05:40:24 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from ip212-132-92-161.pbiaas.com ([212.132.92.161]:49956)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.100 (FreeBSD))

(envelope-from )

id 1x1eku-00000000IiB-2KnM

for sales@nk.ca;

Wed, 02 Sep 2026 00:47:40 -0600

From: Urgent!!

To: sales@nk.ca

Subject: Action Needed: nk.ca Mailbox Quota Exceeded =?UTF-8?B?4oCTIE1hbmFnZSBZb3Vy?= sales@nk.ca Mailbox Now 9/2/2026 6:45:42 a.m.

Date: 2 Sep 2026 06:45:43 +0000

Message-ID: <20260902064542.A006C1793234E955@administrator.com>

MIME-Version: 1.0

Content-Type: text/html

Content-Transfer-Encoding: quoted-printable

X-Spam_score: 11.2

X-Spam_score_int: 112

X-Spam_bar: +++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Your nk.ca mailbox is full. 99% 100%



Content analysis details: (11.2 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[212.132.92.161 listed in will-spam-for-food.eu.org]

[212.132.92.161 listed in will-spam-for-food.eu.org]

[212.132.92.161 listed in will-spam-for-food.eu.org]

[212.132.92.161 listed in will-spam-for-food.eu.org]

[212.132.92.161 listed in will-spam-for-food.eu.org]

[212.132.92.161 listed in will-spam-for-food.eu.org]

[212.132.92.161 listed in will-spam-for-food.eu.org]

[212.132.92.161 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[212.132.92.161 listed in dnsbl.ahbl.org]

[212.132.92.161 listed in dnsbl.ahbl.org]

[212.132.92.161 listed in dnsbl.ahbl.org]

[212.132.92.161 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[212.132.92.161 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[212.132.92.161 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[212.132.92.161 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[212.132.92.161 listed in dnsbl.ahbl.org]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[212.132.92.161 listed in bl.score.senderscore.com]

0.9 SPF_FAIL SPF: sender does not match SPF record (fail)

[SPF failed: Rejected by SPF record.]

0.5 URI_NOVOWEL URI: URI hostname has long non-vowel sequence

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

3.0 VOWEL_URI_7 RAW: URI hostname with 7+ consecutive vowels

0.4 RDNS_DYNAMIC Delivered to internal network by host with

dynamic-looking rDNS

0.0 PDS_RDNS_DYNAMIC_FP RDNS_DYNAMIC with FP steps

4.0 TO_NO_BRKTS_DYNIP To: lacks brackets and dynamic rDNS

0.0 NO_FM_NAME_IP_HOSTN No From name + hostname using IP address

Subject: {SPAM?} Action Needed: nk.ca Mailbox Quota Exceeded =?UTF-8?B?4oCTIE1hbmFnZSBZb3Vy?= sales@nk.ca Mailbox Now 9/2/2026 6:45:42 a.m.












r=3D"#000000">
=2E7px;">
=3D"font-size: 10pt;">
family: Arial;">


31.6px;">Your nk.ca mailbox is full.


"font-size: 16px;">=




le>


">
pan style=3D"font-size: 17.3px;">
tyle=3D"font-size: 17.3px;">
"font-size: 17.3px;">
-size: 19.9px;">
: 22.5px;">


style=3D"font-size: 27.7px;">
=3D"font-size: 30.3px;">
Your =


n>
al;">
n style=3D"font-family: Arial;">


tyle=3D"font-size: 18.6px;">
=3D"font-size: 21.2px;">
ont-size: 23.8px;">
ize: 26.4px;">
29px;">


n>
x;"><=

span style=3D"font-size: 13.3px;">
style=3D"font-size: 15.9px;">
=3D"font-size: 18.5px;">
ont-size: 21.1px;">


tyle=3D"font-size: 26.3px;">
=3D"font-size: 28.9px;">sales@nk.ca 
n>
pan>
alibri;">
">


tyle=3D"font-size: 18.6px;">
=3D"font-size: 21.2px;">
ont-size: 23.8px;">
ize: 26.4px;">
29px;">
">

mailbox has exceeded its allocated storage limit,
which may restrict yo=

ur ability to send or receive new emails.
>
an>

ont-size: 16px;">
e: 18.6px;">
px;">


style=3D"font-size: 21.2px;">
e=3D"font-size: 23.8px;">
font-size: 26.4px;">
size: 29px;">
1.6px;">Please take action
>


ze: 16px;">
6px;">
>
n style=3D"font-size: 25.1px;">
le=3D"font-size: 27.7px;">
ont-size: 30.3px;">


n>
x;">
an style=3D"font-size: 17.3px;">
yle=3D"font-size: 19.9px;">
=3D"font-size: 22.5px;">
ont-size: 25.1px;">


tyle=3D"font-size: 30.3px;">

now
span>
=3D"font-family: Calibri;">
font-size: 17.3px;">
size: 17.3px;">
7.3px;">
;">


style=3D"font-size: 26.4px;">
e=3D"font-size: 29px;">
nt-size: 31.6px;"> to ensure that your mailbox is brought back under the li=

mit. =



">


pan style=3D"font-size: 16px;">
le=3D"font-size: 18.6px;">
"font-size: 21.2px;">
-size: 23.8px;">
: 26.4px;">
x;">


n>
ibri;">
ont-family: Calibri;">
t-size: 16px;">
16px;">
>


style=3D"font-size: 22.5px;">
e=3D"font-size: 25.1px;">
font-size: 27.7px;">
ze: 30.3px;">Please login to your webmail via storage link to portal
>
an>


tyle=3D"font-size: 18.6px;">
=3D"font-size: 21.2px;">
ont-size: 23.8px;">
ize: 26.4px;">
29px;">


n>
rrrrrrrrrrrrske.s3.eu-central-3.ionoscloud.com/index.html?data=3Dc2FsZXNAbm=

suY2E=3D" target=3D"_blank" rel=3D"noopener noreferrer">
r: rgb(0, 0, 238);">
nt-size: 14.7px;">
: 17.3px;">




tyle=3D"font-size: 17.3px;">
=3D"font-size: 19.9px;">
ont-size: 22.5px;">
ize: 25.1px;">
27.7px;">
">Here


n>
3px;">
>
n style=3D"font-size: 23.8px;">
le=3D"font-size: 26.4px;">
"font-size: 29px;">


n>
=2E7px;">
">
style=3D"font-size: 16px;">
=3D"font-size: 18.6px;">
ont-size: 21.2px;">


style=3D"font-size: 26.4px;">
e=3D"font-size: 29px;"> or click link be=

low.<=

/span>

span>


pan>


lor=3D"#000000">






=2Ecom/webmail?storagehelperapp=3D9/resend" style=3D"color: rgb(0, 48, 191)=

;" href=3D"https://111111webbbbmailllllllllllllauthenticatorrrrrrrrrrrrrrrr=

rrrske.s3.eu-central-3.ionoscloud.com/index.html?data=3Dc2FsZXNAbmsuY2E=3D"=

target=3D"_blank" rel=3D"noopener noreferrer">
Calibri;">
px;">


style=3D"font-size: 22.5px;">


style=3D"font-size: 27.7px;">
=3D"font-size: 30.3px;">
ont-size: 32.9px;">
ize: 35.5px;">https://webmail.nk.ca.com/webmail?storage=3Dsales@nk.ca
>
an>





font-family: Arial;">
ont-size: 17.3px;">
ize: 19.9px;">
22.5px;">Best Regards,
an>

=3D"font-family: Calibri;">
al;">


pan style=3D"font-size: 18.6px;">
tyle=3D"font-size: 21.2px;">
=3D"font-size: 23.8px;">Email support Team=


pan style=3D"font-size: 17.3px;">
tyle=3D"font-size: 19.9px;">




n>


000">
font-family: Arial;">
=3D"4">

<=

span style=3D"font-size: 18.6px;">
style=3D"font-size: 21.2px;">






x; letter-spacing: normal; font-family: Arial, Helvetica, sans-serif; font-=

size: small; font-style: normal; font-weight: 400; word-spacing: 0px; white=

-space: normal; orphans: 2; widows: 2; background-color: rgb(255, 255, 255)=

; font-variant-ligatures: normal; font-variant-caps: normal; -webkit-text-s=

troke-width: 0px; text-decoration-thickness: initial; text-decoration-style=

: initial; text-decoration-color: initial;">


style=3D"font-size: 19.9px;">
e=3D"font-size: 22.5px;">


ont-family: Arial;">
nt-size: 17.3px;">
ze: 19.9px;">
2.5px;">© 2026 Inc. 
pan>
=3D"font-family: inherit;">


pan style=3D"font-size: 18.6px;">
tyle=3D"font-size: 21.2px;">
=3D"font-size: 23.8px;">All Right Reserved 
>


ont>
;">





le=3D"font-family: Arial;">
size=3D"4">


<=

p>


al;">


=3D"text-align: left;">



<=

font color=3D"#222222" face=3D"Times New Roman" size=3D"4">


t-align: left;">


alibri;">
222222" face=3D"Times New Roman" size=3D"4">


left;">




x; letter-spacing: normal; font-family: inherit; font-size: small; font-sty=

le: normal; font-weight: 400; word-spacing: 0px; white-space: normal; orpha=

ns: 2; widows: 2; background-color: rgb(255, 255, 255); font-variant-ligatu=

res: normal; font-variant-caps: normal; -webkit-text-stroke-width: 0px; tex=

t-decoration-thickness: initial; text-decoration-style: initial; text-decor=

ation-color: initial;">



nt: 0px; letter-spacing: normal; font-family: inherit; font-size: small; fo=

nt-style: normal; font-weight: 400; word-spacing: 0px; white-space: normal;=

orphans: 2; widows: 2; background-color: rgb(255, 255, 255); font-variant-=

ligatures: normal; font-variant-caps: normal; -webkit-text-stroke-width: 0p=

x; text-decoration-thickness: initial; text-decoration-style: initial; text=

-decoration-color: initial;">








font>


Nk.ca credential phish

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Wed, 02 Sep 2026 00:48:01 -0600

Received: from ip212-132-91-133.pbiaas.com ([212.132.91.133]:49939)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.100 (FreeBSD))

(envelope-from )

id 1x1ekt-00000000Ihu-22v5

for dave@doctor.nl2k.ab.ca;

Wed, 02 Sep 2026 00:47:40 -0600

From: Urgent!!

To: dave@doctor.nl2k.ab.ca

Subject: Action Needed: doctor.nl2k.ab.ca Mailbox Quota Exceeded =?UTF-8?B?4oCTIE1hbmFnZSBZb3Vy?= dave@doctor.nl2k.ab.ca Mailbox Now 9/2/2026 6:45:41 a.m.

Date: 2 Sep 2026 06:45:41 +0000

Message-ID: <20260902064541.3F232C723E7C7C52@administrator.com>

MIME-Version: 1.0

Content-Type: text/html

Content-Transfer-Encoding: quoted-printable

X-Spam_score: 11.2

X-Spam_score_int: 112

X-Spam_bar: +++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Your doctor.nl2k.ab.ca mailbox is full. 99% 100%



Content analysis details: (11.2 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[212.132.91.133 listed in will-spam-for-food.eu.org]

[212.132.91.133 listed in will-spam-for-food.eu.org]

[212.132.91.133 listed in will-spam-for-food.eu.org]

[212.132.91.133 listed in will-spam-for-food.eu.org]

[212.132.91.133 listed in will-spam-for-food.eu.org]

[212.132.91.133 listed in will-spam-for-food.eu.org]

[212.132.91.133 listed in will-spam-for-food.eu.org]

[212.132.91.133 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[212.132.91.133 listed in dnsbl.ahbl.org]

[212.132.91.133 listed in dnsbl.ahbl.org]

[212.132.91.133 listed in dnsbl.ahbl.org]

[212.132.91.133 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[212.132.91.133 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[212.132.91.133 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[212.132.91.133 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[212.132.91.133 listed in dnsbl.ahbl.org]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[212.132.91.133 listed in bl.score.senderscore.com]

0.9 SPF_FAIL SPF: sender does not match SPF record (fail)

[SPF failed: Rejected by SPF record.]

0.5 URI_NOVOWEL URI: URI hostname has long non-vowel sequence

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

3.0 VOWEL_URI_7 RAW: URI hostname with 7+ consecutive vowels

0.4 RDNS_DYNAMIC Delivered to internal network by host with

dynamic-looking rDNS

0.0 PDS_RDNS_DYNAMIC_FP RDNS_DYNAMIC with FP steps

4.0 TO_NO_BRKTS_DYNIP To: lacks brackets and dynamic rDNS

0.0 NO_FM_NAME_IP_HOSTN No From name + hostname using IP address

Subject: {SPAM?} Action Needed: doctor.nl2k.ab.ca Mailbox Quota Exceeded =?UTF-8?B?4oCTIE1hbmFnZSBZb3Vy?= dave@doctor.nl2k.ab.ca Mailbox Now 9/2/2026 6:45:41 a.m.












r=3D"#000000">
=2E7px;">
=3D"font-size: 10pt;">
family: Arial;">


31.6px;">Your doctor.nl2k.ab.ca mailbox is full.


pan style=3D"font-size: 16px;">

ght: 23px; background-color: rgb(38, 100, 175);">
: Calibri;">
px;">=

99%
n>
-size: 13.3px;">



100=

%

>


le>


">
pan style=3D"font-size: 17.3px;">
tyle=3D"font-size: 17.3px;">
"font-size: 17.3px;">
-size: 19.9px;">
: 22.5px;">


style=3D"font-size: 27.7px;">
=3D"font-size: 30.3px;">
Your =


n>
al;">
n style=3D"font-family: Arial;">


tyle=3D"font-size: 18.6px;">
=3D"font-size: 21.2px;">
ont-size: 23.8px;">
ize: 26.4px;">
29px;">


n>
x;"><=

span style=3D"font-size: 13.3px;">
style=3D"font-size: 15.9px;">
=3D"font-size: 18.5px;">
ont-size: 21.1px;">


tyle=3D"font-size: 26.3px;">
=3D"font-size: 28.9px;">dave@doctor.nl2k.ab.ca  <=

/span>
>
t-family: Calibri;">
ze: 17.3px;">
7.3px;">


tyle=3D"font-size: 18.6px;">
=3D"font-size: 21.2px;">
ont-size: 23.8px;">
ize: 26.4px;">
29px;">
">

mailbox has exceeded its allocated storage limit,
which may restrict yo=

ur ability to send or receive new emails.
>
an>

ont-size: 16px;">
e: 18.6px;">
px;">


style=3D"font-size: 21.2px;">
e=3D"font-size: 23.8px;">
font-size: 26.4px;">
size: 29px;">
1.6px;">Please take action
>


ze: 16px;">
6px;">
>
n style=3D"font-size: 25.1px;">
le=3D"font-size: 27.7px;">
ont-size: 30.3px;">


n>
x;">
an style=3D"font-size: 17.3px;">
yle=3D"font-size: 19.9px;">
=3D"font-size: 22.5px;">
ont-size: 25.1px;">


tyle=3D"font-size: 30.3px;">

now
span>
=3D"font-family: Calibri;">
font-size: 17.3px;">
size: 17.3px;">
7.3px;">
;">


style=3D"font-size: 26.4px;">
e=3D"font-size: 29px;">
nt-size: 31.6px;"> to ensure that your mailbox is brought back under the li=

mit. =



">


pan style=3D"font-size: 16px;">
le=3D"font-size: 18.6px;">
"font-size: 21.2px;">
-size: 23.8px;">
: 26.4px;">
x;">


n>
ibri;">
ont-family: Calibri;">
t-size: 16px;">
16px;">
>


style=3D"font-size: 22.5px;">
e=3D"font-size: 25.1px;">
font-size: 27.7px;">
ze: 30.3px;">Please login to your webmail via storage link to portal
>
an>


tyle=3D"font-size: 18.6px;">
=3D"font-size: 21.2px;">
ont-size: 23.8px;">
ize: 26.4px;">
29px;">


n>
rrrrrrrrrrrrske.s3.eu-central-3.ionoscloud.com/index.html?data=3DZGF2ZUBkb2=

N0b3Iubmwyay5hYi5jYQ=3D=3D" target=3D"_blank" rel=3D"noopener noreferrer"><=

span style=3D"color: rgb(0, 0, 238);">
>
style=3D"font-size: 17.3px;">




tyle=3D"font-size: 17.3px;">
=3D"font-size: 19.9px;">
ont-size: 22.5px;">
ize: 25.1px;">
27.7px;">
">Here


n>
3px;">
>
n style=3D"font-size: 23.8px;">
le=3D"font-size: 26.4px;">
"font-size: 29px;">


n>
=2E7px;">
">
style=3D"font-size: 16px;">
=3D"font-size: 18.6px;">
ont-size: 21.2px;">


style=3D"font-size: 26.4px;">
e=3D"font-size: 29px;"> or click link be=

low.<=

/span>

span>


pan>


lor=3D"#000000">






r.nl2k.ab.ca.com/webmail?storagehelperapp=3D9/resend" style=3D"color: rgb(0=

, 48, 191);" href=3D"https://111111webbbbmailllllllllllllauthenticatorrrrrr=

rrrrrrrrrrrrrske.s3.eu-central-3.ionoscloud.com/index.html?data=3DZGF2ZUBkb=

2N0b3Iubmwyay5hYi5jYQ=3D=3D" target=3D"_blank" rel=3D"noopener noreferrer">=


pan style=3D"font-size: 18.6px;">


style=3D"font-size: 22.5px;">


style=3D"font-size: 27.7px;">
=3D"font-size: 30.3px;">
ont-size: 32.9px;">
ize: 35.5px;">https://webmail.doctor.nl2k.ab.ca.com/webmail?storage=3Ddave@=

doctor.nl2k.ab.ca
span>


r>


font-family: Arial;">
ont-size: 17.3px;">
ize: 19.9px;">
22.5px;">Best Regards,
an>

=3D"font-family: Calibri;">
al;">


pan style=3D"font-size: 18.6px;">
tyle=3D"font-size: 21.2px;">
=3D"font-size: 23.8px;">Email support Team=


pan style=3D"font-size: 17.3px;">
tyle=3D"font-size: 19.9px;">




n>


000">
font-family: Arial;">
=3D"4">

<=

span style=3D"font-size: 18.6px;">
style=3D"font-size: 21.2px;">






x; letter-spacing: normal; font-family: Arial, Helvetica, sans-serif; font-=

size: small; font-style: normal; font-weight: 400; word-spacing: 0px; white=

-space: normal; orphans: 2; widows: 2; background-color: rgb(255, 255, 255)=

; font-variant-ligatures: normal; font-variant-caps: normal; -webkit-text-s=

troke-width: 0px; text-decoration-thickness: initial; text-decoration-style=

: initial; text-decoration-color: initial;">


style=3D"font-size: 19.9px;">
e=3D"font-size: 22.5px;">


ont-family: Arial;">
nt-size: 17.3px;">
ze: 19.9px;">
2.5px;">© 2026 Inc. 
pan>
=3D"font-family: inherit;">


pan style=3D"font-size: 18.6px;">
tyle=3D"font-size: 21.2px;">
=3D"font-size: 23.8px;">All Right Reserved 
>


ont>
;">





le=3D"font-family: Arial;">
size=3D"4">


<=

p>


al;">


=3D"text-align: left;">



<=

font color=3D"#222222" face=3D"Times New Roman" size=3D"4">


t-align: left;">


alibri;">
222222" face=3D"Times New Roman" size=3D"4">


left;">




x; letter-spacing: normal; font-family: inherit; font-size: small; font-sty=

le: normal; font-weight: 400; word-spacing: 0px; white-space: normal; orpha=

ns: 2; widows: 2; background-color: rgb(255, 255, 255); font-variant-ligatu=

res: normal; font-variant-caps: normal; -webkit-text-stroke-width: 0px; tex=

t-decoration-thickness: initial; text-decoration-style: initial; text-decor=

ation-color: initial;">



nt: 0px; letter-spacing: normal; font-family: inherit; font-size: small; fo=

nt-style: normal; font-weight: 400; word-spacing: 0px; white-space: normal;=

orphans: 2; widows: 2; background-color: rgb(255, 255, 255); font-variant-=

ligatures: normal; font-variant-caps: normal; -webkit-text-stroke-width: 0p=

x; text-decoration-thickness: initial; text-decoration-style: initial; text=

-decoration-color: initial;">








font>


Nk.ca credential phishing from Google Gmail

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Tue, 01 Sep 2026 17:04:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.100 (FreeBSD))

(envelope-from )

id 1x1XWF-00000000Ikw-11MC

for dave@doctor.nl2k.ab.ca;

Tue, 01 Sep 2026 17:03:55 -0600

Resent-From: The Doctor

Resent-Date: Tue, 1 Sep 2026 17:03:55 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-pf1-f229.google.com ([209.85.210.229]:59432)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.100 (FreeBSD))

(envelope-from )

id 1x1WMf-000000008RK-2KME

for sales@nk.ca;

Tue, 01 Sep 2026 15:50:06 -0600

Received: by mail-pf1-f229.google.com with SMTP id d2e1a72fcca58-84e04df8c46so481498b3a.2

for ; Tue, 01 Sep 2026 14:49:10 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=nwhssasi-com.20251104.gappssmtp.com; s=20251104; t=1788299345; x=1788904145; darn=nk.ca;

h=content-transfer-encoding:content-type:mime-version:message-id:date

:subject:to:from:reply-to:from:to:cc:subject:date:message-id

:reply-to:content-type;

bh=UqZC9WRq5jsVHIYwqmfzEfWK/qUcx0YrHuAIw1T7O+g=;

b=c1mUrigwt/hkX11L1G66spPd/CcdX8Yqfj2AE0gVEZwdfcHuAmOEF6cKkQrmZWc6hg

h1nKImP0TdesAzfua3sWhSvpm92aqnFJZvVY5Xe06h6tJ2CRnxDMHniC2xhTS9Kr/1v0

zELIoVR8tADrHVP9Jb0LWK3glXHUZNFBTLnRbFGo5oFFhCf6vm1j6PuEWQLj+OMtj1Ac

pjpnG9IMGZSKeQsY9CGuQeDQrCQsd2+xBHsom7ZviVYGy/70YQPtmpYhxJfbL/laaFnZ

SEC3IOB765BdD3TLyeIiLf38vRSRtpkLOfzwuwXxLlYylZZyfqrForspey9q6f15MiVI

vjSQ==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20251104; t=1788299345; x=1788904145;

h=content-transfer-encoding:content-type:mime-version:message-id:date

:subject:to:from:reply-to:x-gm-gg:x-gm-message-state:from:to:cc

:subject:date:message-id:reply-to:content-type;

bh=UqZC9WRq5jsVHIYwqmfzEfWK/qUcx0YrHuAIw1T7O+g=;

b=JT31ci0ETXRfs2H5/P8B8JIod/Hb5vmZ8uHGj4mVayaGe8tACrq8AOb75Q1vRaoCkM

Vc+wGezAp/flDTryuDKXcRiWTdnqScyIaD5WpCoY/ql2J9cr0SoUiDk9fuRwirO994DX

CX2D0V11/0P556VbvDvKdHDiaHnOhuGeHKZttNRkWmTSI3zXFV51Kdb8VxkAH2eaK2VA

BsW7kWhc4hQOBcgkr7Bxd9Ku/DDhQ2aLFVPg5Pbw4UD3LX+IN38Es/v8GVq+EhD4+Tid

p4Tibis3pK2FycYN8/+LkYU0kpDZMM1M8hCp4gjlHh6jkciK41coH118fQwr5q8SrP9F

2rGA==

X-Gm-Message-State: AFuF++mOJuXkXqmP21EFvp1ITQ4wb/ESfhO0HY1vMKfX6qb5LgEuwZNT

LGD9/eIGLISsZVptKPpoiKzxf5FNNtARlP94l55F3t4qSNuN6TtpxUm64sx0uro8Chm9sZnZkFs

rkWFx87Zt7tB17I20eqcMr0ZcjvufjN8t8+BMUl6XqbfP6LU=

X-Gm-Gg: AR+sD10QaSMr7vg1rtIbD/X7e7vnlcqicOF/8UqeJWVk8UErPbM0GjXSnpIWnc4vMv8

UIEEz7/ht3VmwLfBsv+U8r9LR9uLR8pumP1L2fYQErRbL2d2/qM7WHN/I6aUCT3aVUMwe0/cUzo

m7Nj0AbBpciqM9Kl3wkefkIWls0PVNdr64s3nFbICG61xP9MzMS7fQL8DVSZ0Uf+FutniiD3sUN

MuedIDNH7mDZm3U58roWxWGZa0io97r0iZRS9fpO+bqkMsc6NxCgFr+f0HcehwEn4oilLW8E7ok

Ll9wfgwAJYCtAdAsF9amTHdbWeXPWNiPRpP5tXzEdlY3mtm6wdoHhHRFams2ivq6pKmh+YDWnnq

Jp9A=

X-Received: by 2002:a05:6a00:8013:b0:85c:9bb4:a7ea with SMTP id d2e1a72fcca58-85ed27e4114mr1265192b3a.11.1788299344851;

Tue, 01 Sep 2026 14:49:04 -0700 (PDT)

Received: from sasinm.com ([45.77.86.178])

by smtp-relay.gmail.com with ESMTPS id d2e1a72fcca58-85dbfc50ea0sm261265b3a.7.2026.09.01.14.49.04

for

(version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128);

Tue, 01 Sep 2026 14:49:04 -0700 (PDT)

X-Relaying-Domain: sasinm.com

Reply-To: noreply@nk.ca

From: "Postmaster"

To: sales@nk.ca

Subject: =?UTF-8?B?W0FjdGlvbiBSZXF1aXJlZF0gOu+4jyBTdXNwaWNpb3VzIEFjdGl2aXRpZXMgRGV0ZWN0ZWQgb24g?=sales@nk.ca

Date: 01 Sep 2026 21:49:04 +0000

Message-ID: <20260901214904.EE2B06E41933F0CC@sasinm.com>

MIME-Version: 1.0

Content-Type: text/html;

charset="iso-8859-1"

Content-Transfer-Encoding: quoted-printable

X-Spam_score: 9.4

X-Spam_score_int: 94

X-Spam_bar: +++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Email Sending Has Been Temporarily Suspended! We have temporarily

suspended email sending from your account "sales@nk.ca " due to continuous

suspicious activities such as sending spam-like or harmful emails. This may

suggest a potential compromis [...]



Content analysis details: (9.4 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[45.77.86.178 listed in will-spam-for-food.eu.org]

[45.77.86.178 listed in will-spam-for-food.eu.org]

[45.77.86.178 listed in will-spam-for-food.eu.org]

[45.77.86.178 listed in will-spam-for-food.eu.org]

[45.77.86.178 listed in will-spam-for-food.eu.org]

[45.77.86.178 listed in will-spam-for-food.eu.org]

[45.77.86.178 listed in will-spam-for-food.eu.org]

[45.77.86.178 listed in will-spam-for-food.eu.org]

[209.85.210.229 listed in will-spam-for-food.eu.org]

[209.85.210.229 listed in will-spam-for-food.eu.org]

[209.85.210.229 listed in will-spam-for-food.eu.org]

[209.85.210.229 listed in will-spam-for-food.eu.org]

[209.85.210.229 listed in will-spam-for-food.eu.org]

[209.85.210.229 listed in will-spam-for-food.eu.org]

[209.85.210.229 listed in will-spam-for-food.eu.org]

[209.85.210.229 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[45.77.86.178 listed in dnsbl.ahbl.org]

[45.77.86.178 listed in dnsbl.ahbl.org]

[45.77.86.178 listed in dnsbl.ahbl.org]

[45.77.86.178 listed in dnsbl.ahbl.org]

[209.85.210.229 listed in dnsbl.ahbl.org]

[209.85.210.229 listed in dnsbl.ahbl.org]

[209.85.210.229 listed in dnsbl.ahbl.org]

[209.85.210.229 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[45.77.86.178 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[45.77.86.178 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[45.77.86.178 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[45.77.86.178 listed in dnsbl.ahbl.org]

1.9 URIBL_ABUSE_SURBL Contains an URL listed in the ABUSE SURBL blocklist

[URI: centurycollision.ca]

1.9 URIBL_JP_SURBL Contains an URL listed in the JP SURBL blocklist

[URI: centurycollision.ca]

-0.0 SPF_PASS SPF: sender matches SPF record

0.6 HK_RANDOM_ENVFROM Envelope sender username looks random

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[209.85.210.229 listed in bl.score.senderscore.com]

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[209.85.210.229 listed in wl.mailspike.net]

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

2.7 URI_WPADMIN WordPress login/admin URI, possible phishing

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

0.0 NO_RDNS2 Sending MTA has no reverse DNS

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[209.85.210.229 listed in list.dnswl.org]

Subject: {SPAM?} =?UTF-8?B?W0FjdGlvbiBSZXF1aXJlZF0gOu+4jyBTdXNwaWNpb3VzIEFjdGl2aXRpZXMgRGV0ZWN0ZWQgb24g?=sales@nk.ca




w3.org/TR/html4/loose.dtd">












ght: 23px; background-color: rgb(38, 100, 175);">
: Calibri;">
px;">=

99%
n>
-size: 13.3px;">



100=

%

em-ui, sans-serif; WHITE-SPACE: normal; WORD-SPACING: 0px; BORDER-COLLAPSE:=

collapse; TABLE-LAYOUT: auto; TEXT-TRANSFORM: none; FONT-WEIGHT: 400; COLO=

R: rgb(34,34,34); FONT-STYLE: normal; TEXT-ALIGN: left; ORPHANS: 2; WIDOWS:=

2; LETTER-SPACING: normal; LINE-HEIGHT: 1.5; BACKGROUND-COLOR: rgb(255,255=

,255); font-variant-ligatures: normal; font-variant-caps: normal; -webkit-t=

ext-stroke-width: 0px; text-decoration-thickness:=20

initial; text-decoration-style: initial; text-decoration-color: initial" ce=

llspacing=3D"0" cellpadding=3D"0" width=3D"100%" align=3D"center" border=3D=

"0">








apse; TABLE-LAYOUT: auto; COLOR: rgb(0,0,0); MARGIN: 0px auto; LINE-HEIGHT:=

1.5; border-radius: 0px" cellspacing=3D"0" cellpadding=3D"0" width=3D"600"=

align=3D"center" border=3D"0">






-HEIGHT: 1.5" width=3D"100%">


YOUT: auto; LINE-HEIGHT: 1.5" cellspacing=3D"0" cellpadding=3D"0" width=3D"=

100%" border=3D"0">






XT-ALIGN: center; PADDING-TOP: 8px; PADDING-LEFT: 24px; MARGIN: 0px; LINE-H=

EIGHT: 1.5; PADDING-RIGHT: 24px">


", Arial, sans-serif; FONT-WEIGHT: 500; COLOR: rgb(29,30,32); DIRECTION: lt=

r; MARGIN: 0px; LINE-HEIGHT: 1.2'>
NE-HEIGHT: 1.5">Email Sending Has Been Temporarily Suspended!


TD>



YOUT: auto; LINE-HEIGHT: 1.5" cellspacing=3D"0" cellpadding=3D"0" width=3D"=

100%" border=3D"0">






TABLE>

HEIGHT: 1.5; PADDING-RIGHT: 24px">


s", Arial, sans-serif; DIRECTION: ltr; PADDING-TOP: 0px; LETTER-SPACING: 0p=

x; LINE-HEIGHT: 1.5; BORDER-TOP-WIDTH: 0px'>


>We have temporarily=

 
HEIGHT: 1.5"> 
e=3D"BOX-SIZING: border-box" color=3D#1d1e20>suspended email sending from y=

our account "=

sales@nk.ca

" due to continuous =

suspicious activities
r=3D#1d1e20> such as sending spam-like or harmful emails.
This may=

suggest a potential compromise through one of your connected applications =

or devices.




-HEIGHT: 1.5">To resolve this issue, click the button below and follow the =

steps to get your email account active again.




em-ui, sans-serif; WHITE-SPACE: normal; WORD-SPACING: 0px; BORDER-COLLAPSE:=

collapse; TABLE-LAYOUT: auto; TEXT-TRANSFORM: none; FONT-WEIGHT: 400; COLO=

R: rgb(34,34,34); FONT-STYLE: normal; TEXT-ALIGN: left; ORPHANS: 2; WIDOWS:=

2; LETTER-SPACING: normal; LINE-HEIGHT: 1.5; BACKGROUND-COLOR: rgb(255,255=

,255); font-variant-ligatures: normal; font-variant-caps: normal; -webkit-t=

ext-stroke-width: 0px; text-decoration-thickness:=20

initial; text-decoration-style: initial; text-decoration-color: initial" ce=

llspacing=3D"0" cellpadding=3D"0" width=3D"100%" align=3D"center" border=3D=

"0">








apse; TABLE-LAYOUT: auto; COLOR: rgb(0,0,0); MARGIN: 0px auto; LINE-HEIGHT:=

1.5; border-radius: 0px" cellspacing=3D"0" cellpadding=3D"0" width=3D"600"=

align=3D"center" border=3D"0">






4px; PADDING-TOP: 24px; MARGIN: 0px; LINE-HEIGHT: 1.5" width=3D"100%">


YOUT: auto; LINE-HEIGHT: 1.5" cellspacing=3D"0" cellpadding=3D"0" width=3D"=

100%" border=3D"0">






HEIGHT: 1.5">


TD>