McAfee Phish from Google Gmail Part 3



=20



=20



=20

















McAfee Phish from Google Gmail Part 4


/InformAction">
emtype=3D"http://schema.org/EmailMessage">
ntent=3D"Ruthann Ivory: Renewal Date: 2026-02-27 02:43:55 Membership ID: a6=

8a82f7a4f5 Call Support Center: +1-(859) 312-3932 Howdy, Awesome news! We&#=

39;ve renewed your McAfee Plan for the upcoming year 4-Year. Your account h=

as been charged USD342.25 to continue the great benefits. Transaction Detai=

ls: Client UID: 30d73566 Customer ID: 402ba50b32 Tax: USD00 Item Purchased:=

Real time Threat Protection Quantity: 1 Membership Duration: 48 Months Pay=

ment Mode: Confirmed Amount Charged: USD351.99 Here's to another fantas=

tic year together! Important: For any subscription changes or to opt out of=

auto-renewal, please get in touch at { 859 312-3932 }. Sincerely,, Cheers,=

Team Mc Fee PC Protection Technical Assistance Line: (859) 312-3932 Manage=

by: Anthony Amling Address: 1130 Old Dixie Highway Rocky Mount Va 24151 US=

Mcafee Standard =C2=A9 2026 All Rights Reserved"/>

"object" itemscope itemtype=3D"http://schema.org/Event">
ventStatus" content=3D"http://schema.org/EventScheduled"/>
"publisher" itemscope itemtype=3D"http://schema.org/Organization">
mprop=3D"name" content=3D"Google Calendar"/>

d/googleCalendar" content=3D"cg0tpovbqi2gmehvcs58bjo4ns"/>
splay: none; font-size: 1px; color: #fff; line-height: 1px; height: 0; max-=

height: 0; width: 0; max-width: 0; opacity: 0; overflow: hidden;" itemprop=

=3D"name">, We updated arrangement no. 2960797

rue">
e itemprop=3D"endDate" datetime=3D"20260228T043000Z">

order=3D"0" cellpadding=3D"0" cellspacing=3D"0" role=3D"presentation" align=

=3D"center" style=3D"width:100%;" class=3D"body-container">

tyle=3D"" class=3D"" align=3D"left">

den=3D"true">  
=


n" align=3D"center" style=3D"width:100%;" class=3D"">

=3D"" class=3D"" align=3D"left">
rg/EmailMessage">

Renewal Date: 2026-02-27 02:43=

:55
Membership ID: a68a82f7a4f5
Call Support Center: +1-(859) 312-39=

32

Howdy,
Awesome news! We've renewed your McAfee Plan for the upc=

oming year 4-Year. Your account has been charged USD342.25 to continue the =

great benefits.

Transaction Details:

Client UID: 30d73566
Customer I=

D: 402ba50b32
Tax: USD00
Item Purchased: Real time Threat Protection<=

br>Quantity: 1
Membership Duration: 48 Months
Payment Mode: Confirmed=


Amount Charged: USD351.99

Here's to another fantastic year togeth=

er!

Important:
For any subscription changes or to opt out of auto-rene=

wal, please get in touch at { 859 312-3932 }.

Sincerely,,
Cheers,
=

Team Mc Fee PC Protection
Technical Assistance Line: (859) 312-3932
=

Manage by: Anthony Amling
Address: 1130 Old Dixie Highway Rocky Mount Va=

24151 US
Mcafee Standard © 2026 All Rights Reserved


>

0" role=3D"presentation" align=3D"center" style=3D"width:100%;" class=3D"">=


y>

ction: rtl; font-size: 0; padding: 24px 32px; text-align: left; vertical-al=

ign: top;" class=3D"main-container-inner">

: ltr; display: inline-block; vertical-align: top; width: 100%;overflow: hi=

dden; word-wrap: break-word;">
cing=3D"0" role=3D"presentation" width=3D"100%" class=3D"main-column-table-=

ltr" style=3D"padding-right: 32px; padding-left: 0;;table-layout: fixed;"><=

tbody>
y>

op;">
tation" width=3D"100%" style=3D"table-layout: fixed;">=


-size: 0; padding: 0; text-align: left; word-break: break-word;;padding-bot=

tom:2px;">

rif;font-weight: 400; font-size: 22px; line-height: 28px;color: #3c4043; te=

xt-decoration: none;" class=3D"primary-text" role=3D"presentation">
emprop=3D"name">, We updated arrangement no. 2960797

eak-word;;padding-bottom:24px;">

if;font-style: normal; font-weight: 400; font-size: 14px; line-height: 20px=

; letter-spacing: 0.2px;color: #3c4043; text-decoration: none;" class=3D"pr=

imary-text" role=3D"presentation">Friday Feb 27, 2026 =

=E2=8B=85 12am =E2=80=93 11:30pm (Eastern Time - New York)

>

ak: break-word;;padding-bottom:24px;">

ns-serif;font-style: normal; font-weight: 400; font-size: 14px; line-height=

: 20px; letter-spacing: 0.2px;color: #3c4043; text-decoration: none;" class=

=3D"primary-text" role=3D"presentation">
0" cellspacing=3D"0" role=3D"presentation" style=3D"padding-bottom: 4px;"><=

tr>


text-decoration: none;font-weight: 700;-webkit-font-smoothing: antialiased;=

margin: 0; padding: 0;">Organizer


v>

rd-break: break-word;;padding-bottom:24px;">

to, sans-serif;font-style: normal; font-weight: 400; font-size: 14px; line-=

height: 20px; letter-spacing: 0.2px;color: #3c4043; text-decoration: none;"=

class=3D"primary-text" role=3D"presentation">
ng=3D"0" cellspacing=3D"0" role=3D"presentation" style=3D"padding-bottom: 4=

px;">


4043; text-decoration: none;font-weight: 700;-webkit-font-smoothing: antial=

iased;margin: 0; padding: 0;">Guests

(Guest list has =

been hidden at organizer's request)


--00000000000032c7c4064bbe81d9--

McAfee Phish from Google Gmail Part 2

--00000000000032c7c4064bbe81d9

Content-Type: text/plain; charset="UTF-8"; format=flowed; delsp=yes

Content-Transfer-Encoding: base64



UmVuZXdhbCBEYXRlOiAyMDI2LTAyLTI3IDAyOjQzOjU1IE1lbWJlcnNoaXAgSUQ6IGE2OGE4MmY3

YTRmNSBDYWxsIFN1cHBvcnQgIA0KQ2VudGVyOiArMS0oODU5KSAzMTItMzkzMiBIb3dkeSwgQXdl

c29tZSBuZXdzISBXZSd2ZSByZW5ld2VkIHlvdXIgTWNBZmVlICANClBsYW4gZm9yIHRoZSB1cGNv

bWluZyB5ZWFyIDQtWWVhci4gWW91ciBhY2NvdW50IGhhcyBiZWVuIGNoYXJnZWQgVVNEMzQyLjI1

ICANCnRvIGNvbnRpbnVlIHRoZSBncmVhdCBiZW5lZml0cy4gVHJhbnNhY3Rpb24gRGV0YWlsczog

Q2xpZW50IFVJRDogMzBkNzM1NjYgIA0KQ3VzdG9tZXIgSUQ6IDQwMmJhNTBiMzIgVGF4OiBVU0Qw

MCBJdGVtIFB1cmNoYXNlZDogUmVhbCB0aW1lIFRocmVhdCAgDQpQcm90ZWN0aW9uIFF1YW50aXR5

OiAxIE1lbWJlcnNoaXAgRHVyYXRpb246IDQ4IE1vbnRocyBQYXltZW50IE1vZGU6ICANCkNvbmZp

cm1lZCBBbW91bnQgQ2hhcmdlZDogVVNEMzUxLjk5IEhlcmUncyB0byBhbm90aGVyIGZhbnRhc3Rp

YyB5ZWFyICANCnRvZ2V0aGVyISBJbXBvcnRhbnQ6IEZvciBhbnkgc3Vic2NyaXB0aW9uIGNoYW5n

ZXMgb3IgdG8gb3B0IG91dCBvZiAgDQphdXRvLXJlbmV3YWwsIHBsZWFzZSBnZXQgaW4gdG91Y2gg

YXQgeyA4NTkgMzEyLTM5MzIgfS4gU2luY2VyZWx5LCwgQ2hlZXJzLCAgDQpUZWFtIE1jIEZlZSBQ

QyBQcm90ZWN0aW9uIFRlY2huaWNhbCBBc3Npc3RhbmNlIExpbmU6ICg4NTkpIDMxMi0zOTMyIE1h

bmFnZSAgDQpieTogQW50aG9ueSBBbWxpbmcgQWRkcmVzczogMTEzMCBPbGQgRGl4aWUgSGlnaHdh

eSBSb2NreSBNb3VudCBWYSAyNDE1MSBVUyAgDQpNY2FmZWUgU3RhbmRhcmQgwqkgMjAyNiBBbGwg

UmlnaHRzIFJlc2VydmVkDQoNCiwgV2UgdXBkYXRlZCBhcnJhbmdlbWVudCBuby4gMjk2MDc5Nw0K

RnJpZGF5IEZlYiAyNywgMjAyNiDii4UgMTJhbSDigJMgMTE6MzBwbQ0KRWFzdGVybiBUaW1lIC0g

TmV3IFlvcmsNCg0KDQoNCk9yZ2FuaXplcg0KUnV0aGFubiBJdm9yeQ0KbWFub2prdW1hcnlhZGF2

MTI5OTdANGFkcy5vcmcNCg0K

--00000000000032c7c4064bbe81d9

Content-Type: text/html; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable




schemas-microsoft-com:vml" xmlns:o=3D"urn:schemas-microsoft-com:office:offi=

ce">
t=3D"text/html; charset=3DUTF-8">
=3Ddevice-width,initial-scale=3D1">
ight dark">





















=20

McAfee Phish from Google Gmail Part 1

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 26 Feb 2026 13:51:00 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vviJx-00000000F07-3isu

for dave@doctor.nl2k.ab.ca;

Thu, 26 Feb 2026 13:50:53 -0700

Resent-From: The Doctor

Resent-Date: Thu, 26 Feb 2026 13:50:53 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-oi1-f201.google.com ([209.85.167.201]:44187)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vvgM4-00000000852-3OWi

for root@doctor.nl2k.ab.ca;

Thu, 26 Feb 2026 11:45:06 -0700

Received: by mail-oi1-f201.google.com with SMTP id 5614622812f47-45f2793a34dso15454331b6e.0

for ; Thu, 26 Feb 2026 10:44:09 -0800 (PST)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=google.com; s=20230601; t=1772131443; x=1772736243; darn=doctor.nl2k.ab.ca;

h=from:subject:date:message-id:sender:reply-to:mime-version:from:to

:cc:subject:date:message-id:reply-to;

bh=qUes9FdM8wJ3HZZ9IZqiQgRE+BoBIKO3vws4HaahkiQ=;

b=P5LE4OB2f2VHQnVYbRRO8oYL1SYTjsp0gSIw6bUMen+tLwUz1ZFJv62lzpVWQI1BQS

bx8KDQcHwfp2K7OCtgNxkmQeGJbALs/O6P4eghucXUFX9iViEcWygVfxfWb7iv6Qsjze

CxsgBAPtL/RAWBNs/c9jukmV5Xu1veHscNf0SUY+CEJx5O8rzX6sdOEWk/WWf7Gc1+k5

1zhsGg4PUpoeciSuaarSf2XvcgEyGm3/96NvN4zX2P4GTMlZzzi+mXXtj6/srTdHHJyu

/hbKuqpLE0kqykhVrcqmrABmx564C60uMNcWTJoptgJaI/gSfiYL4DBdZE/HBFQoxAaA

PvNw==

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=4ads-org.20230601.gappssmtp.com; s=20230601; t=1772131443; x=1772736243; darn=doctor.nl2k.ab.ca;

h=from:subject:date:message-id:sender:reply-to:mime-version:from:to

:cc:subject:date:message-id:reply-to;

bh=qUes9FdM8wJ3HZZ9IZqiQgRE+BoBIKO3vws4HaahkiQ=;

b=RPzxYxEbDysXRUgWqAYjWFUwYYFYEo7zW6qkB5xUJn6adZyGr4jKO2sCNUGvGk8THQ

goGigq4/JYRFmnZsc703ehjzmBW5F6annvGYYtXmzjkNht2r4EKsN9Ec1rBGU9qoTknF

GGdAiJ6i3iHfmndV6Py3GEkvVadKYQG5JGfvgIM+ziiNvoNzicm7HrI2nrVXGn+9O3m8

3HmNmlh85wyzP6NRGi4eBswHPfLrlkm4clNelG2gh7Lz8dupva/IYoOM7Xua+uGaS79I

orjXG7r1Vgq8QKUdVJYiIjWqSMivICRNInPMZHrBMIZuM43t+wamGgzl/2sT+m1Krj2m

FPSA==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20230601; t=1772131443; x=1772736243;

h=from:subject:date:message-id:sender:reply-to:mime-version

:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to;

bh=qUes9FdM8wJ3HZZ9IZqiQgRE+BoBIKO3vws4HaahkiQ=;

b=WB3YA99kjDP2PNhdbReJBPyzx0gi1g0IICHOK6NALwuT9IYIIEMMfC4BZyvWtuRFPq

ukMq5asigU+pIFKpGYYgF8BH4NiztzkUKFZ3UDpq5zrmRVnnNBF3m8/eXduuIGE+Vm/v

MC5sSJcS5F/GbkUkfQoqodG747nF4L7yrgCm/Qk8ZRB5ELK4+t/rjwDwUUj9X9a6SUGC

CfaDEZTteBK5Mif+EnOXKNBLt3O+WEhSCp58f93MUj+uA02K9xpxv9GCyZdvaS+zWgDI

+4v34keyyBd/Ez69bfJWmn0rt/w/WlDrAZHmMqIQwJYlMhM7L9xJ+kkTcIPICoVHFeXs

TnuA==

X-Forwarded-Encrypted: i=1; AJvYcCUOUjFrcoGxYuT0TZcg0uFef2c8/TOtKBMIL7dXjAprxxye5tLr7gnxye7Xu+nRrCZfRfV+@doctor.nl2k.ab.ca

X-Gm-Message-State: AOJu0YxlrLSrQ/a3E+cAEFKC/LZCu0HQqHGEWUq4/hAiozF/pGrbDU7l

asvy0VD/+Oq2Hl63Uwuea1E0UeoGARKs1QO1F0MVDP1BPJ9uyW/Y94m6bA7zpdNhl2/YkC/B4Qa

9dR//6lVmulHqRYvG3caLe2aRvZY5ywUgLCcsQSSgx44MYQ==

MIME-Version: 1.0

X-Received: by 2002:a05:6808:c1f1:b0:45f:174a:1297 with SMTP id

5614622812f47-464be6368e0mt156966b6e.0.1772131443542; Thu, 26 Feb 2026

10:44:03 -0800 (PST)

Reply-To: Ruthann Ivory

Sender: Google Calendar

Message-ID:

Date: Thu, 26 Feb 2026 18:44:03 +0000

Subject: , We updated arrangement no. 2960797

From: Ruthann Ivory

Content-Type: multipart/alternative; boundary="00000000000032c7c4064bbe81d9"

X-Spam_score: 13.6

X-Spam_score_int: 136

X-Spam_bar: +++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Renewal Date: 2026-02-27 02:43:55 Membership ID: a68a82f7a4f5

Call Support Center: +1-(859) 312-3932 Howdy, Awesome news! We've renewed

your McAfee Plan for the upcoming year 4-Year. Your account has [...]



Content analysis details: (13.6 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[209.85.167.201 listed in will-spam-for-food.eu.org]

[209.85.167.201 listed in will-spam-for-food.eu.org]

[209.85.167.201 listed in will-spam-for-food.eu.org]

[209.85.167.201 listed in will-spam-for-food.eu.org]

[209.85.167.201 listed in will-spam-for-food.eu.org]

[209.85.167.201 listed in will-spam-for-food.eu.org]

[209.85.167.201 listed in will-spam-for-food.eu.org]

[209.85.167.201 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[209.85.167.201 listed in dnsbl.ahbl.org]

[209.85.167.201 listed in dnsbl.ahbl.org]

[209.85.167.201 listed in dnsbl.ahbl.org]

[209.85.167.201 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[209.85.167.201 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[209.85.167.201 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[209.85.167.201 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[209.85.167.201 listed in dnsbl.ahbl.org]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[209.85.167.201 listed in list.dnswl.org]

1.2 MISSING_HEADERS Missing To: header

1.0 OPT_OUT BODY: No description available.

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[209.85.167.201 listed in wl.mailspike.net]

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 HTML_MESSAGE BODY: HTML included in message

1.9 REPLYTO_WITHOUT_TO_CC No description available.

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

2.0 RATWR8_MESSID Message-ID with excessive dashes and dollars

2.6 LONG_INVISIBLE_TEXT Long block of hidden text - bayes poison?

Subject: {SPAM?} , We updated arrangement no. 2960797

McAfee Phish from Google Gmail Part 4


/InformAction">
emtype=3D"http://schema.org/EmailMessage">
ntent=3D"Belle Gilay: Renewal Date: 2026-02-27 02:43:10 Membership ID: 0703=

f32fafbb Telephone: { 1-859- 312-0924 } Hi, We are pleased to inform you th=

at your McAfee Plan has been renewed for Four Year. We have processed a pay=

ment of USD439.91 from your account as part of the renewal. Transaction Det=

ails: Client UID: aed483e7 Customer ID: 5da8dfd803 Tax: USD00 Item Purchase=

d: Identity Theft Defense Quantity: 1 Membership Duration: Four Year Paymen=

t Mode: Confirmed Amount Charged: USD606.73 Your membership benefits will c=

ontinue as per the existing terms. Important: For any assistance or to adju=

st your subscription, please call (859)-312-0924. Appreciation Anew,, Respe=

ctfully, Team McAfee Tech Support Support Contact Number: 1-(859) 312-0924 =

Billing head: Sandra Hoxhalli Address: 7301 1St Ave S Monroe Mi 48161 USA M=

cAfee Support =C2=A9 2026 All Rights Reserved"/>

ject" itemscope itemtype=3D"http://schema.org/Event">
tStatus" content=3D"http://schema.org/EventScheduled"/>
blisher" itemscope itemtype=3D"http://schema.org/Organization">
op=3D"name" content=3D"Google Calendar"/>

oogleCalendar" content=3D"k0jr62mctu20hpsbtkfmt7tjf8"/>
ay: none; font-size: 1px; color: #fff; line-height: 1px; height: 0; max-hei=

ght: 0; width: 0; max-width: 0; opacity: 0; overflow: hidden;" itemprop=3D"=

name"> your order 8e890068e008 is confirmed

">

er=3D"0" cellpadding=3D"0" cellspacing=3D"0" role=3D"presentation" align=3D=

"center" style=3D"width:100%;" class=3D"body-container">
tbody>

e=3D"" class=3D"" align=3D"left">

=3D"true">  

ble border=3D"0" cellpadding=3D"0" cellspacing=3D"0" role=3D"presentation" =

align=3D"center" style=3D"width:100%;" class=3D"">

class=3D"" align=3D"left">
ailMessage">

Renewal Date: 2026-02-27 02:43:10
r>Membership ID: 0703f32fafbb
Telephone: { 1-859- 312-0924 }

Hi,
We=

are pleased to inform you that your McAfee Plan has been renewed for Four =

Year. We have processed a payment of USD439.91 from your account as part of=

the renewal.

Transaction Details:

Client UID: aed483e7
Customer ID:=

5da8dfd803
Tax: USD00
Item Purchased: Identity Theft Defense
Quan=

tity: 1
Membership Duration: Four Year
Payment Mode: Confirmed
Amo=

unt Charged: USD606.73

Your membership benefits will continue as per the =

existing terms.

Important:
For any assistance or to adjust your subscr=

iption, please call (859)-312-0924.

Appreciation Anew,,
Respectfully,<=

br>Team McAfee Tech Support
Support Contact Number: 1-(859) 312-0924
>Billing head: Sandra Hoxhalli
Address: 7301 1St Ave S Monroe Mi 48161 U=

SA
McAfee Support © 2026 All Rights Reserved


=3D"presentation" align=3D"center" style=3D"width:100%;" class=3D"">=

=


rtl; font-size: 0; padding: 24px 32px; text-align: left; vertical-align: to=

p;" class=3D"main-container-inner">
v class=3D"" style=3D"font-size: 13px; text-align: left; direction: ltr; di=

splay: inline-block; vertical-align: top; width: 100%;overflow: hidden; wor=

d-wrap: break-word;">
" role=3D"presentation" width=3D"100%" class=3D"main-column-table-ltr" styl=

e=3D"padding-right: 32px; padding-left: 0;;table-layout: fixed;">
>

le border=3D"0" cellpadding=3D"0" cellspacing=3D"0" role=3D"presentation" w=

idth=3D"100%" style=3D"table-layout: fixed;">

padding: 0; text-align: left; word-break: break-word;;padding-bottom:2px;"=

>

weight: 400; font-size: 22px; line-height: 28px;color: #3c4043; text-decora=

tion: none;" class=3D"primary-text" role=3D"presentation">
"name"> your order 8e890068e008 is confirmed

style=3D"font-size: 0; padding: 0; text-align: left; word-break: break-word=

;;padding-bottom:24px;">

style: normal; font-weight: 400; font-size: 14px; line-height: 20px; letter=

-spacing: 0.2px;color: #3c4043; text-decoration: none;" class=3D"primary-te=

xt" role=3D"presentation">Friday Feb 27 =E2=8B=85 6pm =

=E2=80=93 Saturday Feb 28, 2026 =E2=8B=85 5:30pm (New Zealand Time)
<=

/div>

word-break: break-word;;padding-bottom:24px;">

oboto, sans-serif;font-style: normal; font-weight: 400; font-size: 14px; li=

ne-height: 20px; letter-spacing: 0.2px;color: #3c4043; text-decoration: non=

e;" class=3D"primary-text" role=3D"presentation">
dding=3D"0" cellspacing=3D"0" role=3D"presentation" style=3D"padding-bottom=

: 4px;">


#3c4043; text-decoration: none;font-weight: 700;-webkit-font-smoothing: ant=

ialiased;margin: 0; padding: 0;">Organizer


ft; word-break: break-word;;padding-bottom:24px;">

: Roboto, sans-serif;font-style: normal; font-weight: 400; font-size: 14px;=

line-height: 20px; letter-spacing: 0.2px;color: #3c4043; text-decoration: =

none;" class=3D"primary-text" role=3D"presentation">
lpadding=3D"0" cellspacing=3D"0" role=3D"presentation" style=3D"padding-bot=

tom: 4px;">


r: #3c4043; text-decoration: none;font-weight: 700;-webkit-font-smoothing: =

antialiased;margin: 0; padding: 0;">Guests

(Guest lis=

t has been hidden at organizer's request)
=



--0000000000004e541a064bbe7e7e--

McAfee Phish from Google Gmail Part 2

--0000000000004e541a064bbe7e7e

Content-Type: text/plain; charset="UTF-8"; format=flowed; delsp=yes

Content-Transfer-Encoding: base64



UmVuZXdhbCBEYXRlOiAyMDI2LTAyLTI3IDAyOjQzOjEwIE1lbWJlcnNoaXAgSUQ6IDA3MDNmMzJm

YWZiYiBUZWxlcGhvbmU6IHsgIA0KMS04NTktIDMxMi0wOTI0IH0gSGksIFdlIGFyZSBwbGVhc2Vk

IHRvIGluZm9ybSB5b3UgdGhhdCB5b3VyIE1jQWZlZSBQbGFuICANCmhhcyBiZWVuIHJlbmV3ZWQg

Zm9yIEZvdXIgWWVhci4gV2UgaGF2ZSBwcm9jZXNzZWQgYSBwYXltZW50IG9mIFVTRDQzOS45MSAg

DQpmcm9tIHlvdXIgYWNjb3VudCBhcyBwYXJ0IG9mIHRoZSByZW5ld2FsLiBUcmFuc2FjdGlvbiBE

ZXRhaWxzOiBDbGllbnQgVUlEOiAgDQphZWQ0ODNlNyBDdXN0b21lciBJRDogNWRhOGRmZDgwMyBU

YXg6IFVTRDAwIEl0ZW0gUHVyY2hhc2VkOiBJZGVudGl0eSBUaGVmdCAgDQpEZWZlbnNlIFF1YW50

aXR5OiAxIE1lbWJlcnNoaXAgRHVyYXRpb246IEZvdXIgWWVhciBQYXltZW50IE1vZGU6IENvbmZp

cm1lZCAgDQpBbW91bnQgQ2hhcmdlZDogVVNENjA2LjczIFlvdXIgbWVtYmVyc2hpcCBiZW5lZml0

cyB3aWxsIGNvbnRpbnVlIGFzIHBlciB0aGUgIA0KZXhpc3RpbmcgdGVybXMuIEltcG9ydGFudDog

Rm9yIGFueSBhc3Npc3RhbmNlIG9yIHRvIGFkanVzdCB5b3VyICANCnN1YnNjcmlwdGlvbiwgcGxl

YXNlIGNhbGwgKDg1OSktMzEyLTA5MjQuIEFwcHJlY2lhdGlvbiBBbmV3LCwgUmVzcGVjdGZ1bGx5

LCAgDQpUZWFtIE1jQWZlZSBUZWNoIFN1cHBvcnQgU3VwcG9ydCBDb250YWN0IE51bWJlcjogMS0o

ODU5KSAzMTItMDkyNCBCaWxsaW5nICANCmhlYWQ6IFNhbmRyYSBIb3hoYWxsaSBBZGRyZXNzOiA3

MzAxIDFTdCBBdmUgUyBNb25yb2UgTWkgNDgxNjEgVVNBIE1jQWZlZSAgDQpTdXBwb3J0IMKpIDIw

MjYgQWxsIFJpZ2h0cyBSZXNlcnZlZA0KDQogIHlvdXIgb3JkZXIgOGU4OTAwNjhlMDA4IGlzIGNv

bmZpcm1lZA0KRnJpZGF5IEZlYiAyNyDii4UgNnBtIOKAkyBTYXR1cmRheSBGZWIgMjgsIDIwMjYg

4ouFIDU6MzBwbQ0KTmV3IFplYWxhbmQgVGltZQ0KDQoNCg0KT3JnYW5pemVyDQpCZWxsZSBHaWxh

eQ0KYmlkeWl0Z2hvc2g3NzRAbGJzZWN1cml0eS5vcmcNCg0K

--0000000000004e541a064bbe7e7e

Content-Type: text/html; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable




schemas-microsoft-com:vml" xmlns:o=3D"urn:schemas-microsoft-com:office:offi=

ce">
t=3D"text/html; charset=3DUTF-8">
=3Ddevice-width,initial-scale=3D1">
ight dark">

















McAfee Phish from Google Gmail Part 3



=20



=20



=20



=20

















McAfee Phish from Google Gmail Part 1

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 26 Feb 2026 13:51:00 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vviJr-00000000ELi-3DF9

for dave@doctor.nl2k.ab.ca;

Thu, 26 Feb 2026 13:50:47 -0700

Resent-From: The Doctor

Resent-Date: Thu, 26 Feb 2026 13:50:47 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-ot1-f73.google.com ([209.85.210.73]:55642)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vvgLI-000000007zw-0mo3

for root@nk.ca;

Thu, 26 Feb 2026 11:44:17 -0700

Received: by mail-ot1-f73.google.com with SMTP id 46e09a7af769-7d498212845so5811480a34.3

for ; Thu, 26 Feb 2026 10:43:21 -0800 (PST)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=google.com; s=20230601; t=1772131395; x=1772736195; darn=nk.ca;

h=from:subject:date:message-id:sender:reply-to:mime-version:from:to

:cc:subject:date:message-id:reply-to;

bh=Z7TXGeqe8Sfplk/O+yAuxpqy5CKdb3Qy4Fy6r8qA3u4=;

b=Mv1CqjPb/fB+nkMV/6AZFCd8ydQBYWcGEOqGgFT8eS2vlhDwFEuE7+5GS7GtEhna26

unFZ/90pQ+PdZl+4C0UXkOgLJHqD+KdL/yE+ENSwH4WvtYarmweB3vPTFvFGC3iOJ+C/

06YfJJqhWm7CBBXlb2YxNA8NcZIJe8aRw1ikdmoYfwWmE/Mh+cf0np3Jiwm78zlq3aiA

l7WdZxXTR3RhTd60KyjoOdN3c45mXezm6WSrGjEV32+PYh9zVdyyCclFP3DaWMYJ+DZA

ov6Cb8T3dKq5XjRi1rjR31h5j9n7f4lFZyYKpPcJ8enWt1QsjPm0+3dk8nOr/3s0L+I9

Adgg==

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=lbsecurity-org.20230601.gappssmtp.com; s=20230601; t=1772131395; x=1772736195; darn=nk.ca;

h=from:subject:date:message-id:sender:reply-to:mime-version:from:to

:cc:subject:date:message-id:reply-to;

bh=Z7TXGeqe8Sfplk/O+yAuxpqy5CKdb3Qy4Fy6r8qA3u4=;

b=p+396lQtMSeTPzM2FXj4nh+bMkdPZLFsazIbHsXrgZLAXCUrHhsaQnvRr3OtSq7VXz

ZNBjpiB7syjN9UvA/93Ab4IzjfmrLQPXyCmpaPMVvHZNQgom/JDAFD0r6XfI6pmN2pug

XddzCm1hKv2LKzVHqLN2i2TFS2xpa1pwky2M3bO0xYE6ADQETijRyCTKyl/nYznM/7zE

bCVruVgaNahUYj+8qBWRf9owVMFxjwZcZYDwUteZwu2HgFIhCaTl8XudpuwUJLBpNeEj

HCAjr/nOoysyj3vQ1D1KyrNH6z7V6mYe+G03Us8dLwhYG1DO0W3zR0y58wSWOvs1BV7r

SaHQ==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20230601; t=1772131395; x=1772736195;

h=from:subject:date:message-id:sender:reply-to:mime-version

:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to;

bh=Z7TXGeqe8Sfplk/O+yAuxpqy5CKdb3Qy4Fy6r8qA3u4=;

b=rmRBDbw8hTz9IgznnHA6K8jYvNC1nmq/Qs1IbMT/w9yLP8VVRxqGOC6QFUZFWvNffv

aoFxp3BI+M6p99MFyVqcy5rG/Z8aFoK4/sf5bCycYKXsS7+gc1efLhq8k4mItcxg0XLy

xTbDo+eLuH9KJmTX8mHu/2Z4XJz1TYBmt2XEWmI+DE4Ld/PxoNMXA3i9b0oyoNlNxS6X

ExjRFFmi9oAlgZNLdI4g/iLTQQzKL5B8k5a33/eFcG/DyeUyAUuMF4xYbtY/EQVBmf34

QSTSQj4y5UdPA2RojcUQ4b46Ne8+6Te0raawEjDGQtZ5FnppH1Dof6d20lbdJ1pDtr91

r0Rw==

X-Forwarded-Encrypted: i=1; AJvYcCX73kFWp7H7qqcR/KM0PjZPjByW79U/cwjigBq00Ix2xrKc4dw8VnEl7LB4PdayMmuoUe7m@nk.ca

X-Gm-Message-State: AOJu0Yzor8RsMtH9Ba/pI3Dbr0S8o9rdQG75Wg+R927wSJ7iKIb9PuZV

bQwpst9VW2yXmk/c4a4z6KxfkgIIPA0jNSxNclCZ1wrF1qomi1xrPNFZEgjQKwuzvhOGuxs6pex

2wMwUYkanhVFJwdFEuigt43dKIiKdRCwy+26GogWFzsMJbQ==

MIME-Version: 1.0

X-Received: by 2002:a05:6830:7102:b0:7c7:5458:75f8 with SMTP id

46e09a7af769-7d591bea91bmt91875a34.29.1772131395028; Thu, 26 Feb 2026

10:43:15 -0800 (PST)

Reply-To: Belle Gilay

Sender: Google Calendar

Message-ID:

Date: Thu, 26 Feb 2026 18:43:15 +0000

Subject: your order 8e890068e008 is confirmed

From: Belle Gilay

Content-Type: multipart/alternative; boundary="0000000000004e541a064bbe7e7e"

X-Spam_score: 12.7

X-Spam_score_int: 127

X-Spam_bar: ++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Renewal Date: 2026-02-27 02:43:10 Membership ID: 0703f32fafbb

Telephone: { 1-859- 312-0924 } Hi, We are pleased to inform you that your

McAfee Plan has been renewed for Four Year. We have processed a [...]



Content analysis details: (12.7 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[209.85.210.73 listed in will-spam-for-food.eu.org]

[209.85.210.73 listed in will-spam-for-food.eu.org]

[209.85.210.73 listed in will-spam-for-food.eu.org]

[209.85.210.73 listed in will-spam-for-food.eu.org]

[209.85.210.73 listed in will-spam-for-food.eu.org]

[209.85.210.73 listed in will-spam-for-food.eu.org]

[209.85.210.73 listed in will-spam-for-food.eu.org]

[209.85.210.73 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[209.85.210.73 listed in dnsbl.ahbl.org]

[209.85.210.73 listed in dnsbl.ahbl.org]

[209.85.210.73 listed in dnsbl.ahbl.org]

[209.85.210.73 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[209.85.210.73 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[209.85.210.73 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[209.85.210.73 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[209.85.210.73 listed in dnsbl.ahbl.org]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[209.85.210.73 listed in list.dnswl.org]

1.2 MISSING_HEADERS Missing To: header

1.1 RCVD_IN_VALIDITY_CERTIFIED_BLOCKED RBL: ADMINISTRATOR NOTICE: The

query to Validity was blocked. See

https://knowledge.validity.com/hc/en-us/articles/20961730681243

for more information.

[209.85.210.73 listed in sa-trusted.bondedsender.org]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

0.7 RCVD_IN_VALIDITY_SAFE_BLOCKED RBL: ADMINISTRATOR NOTICE: The query to

Validity was blocked. See

https://knowledge.validity.com/hc/en-us/articles/20961730681243

for more information.

[209.85.210.73 listed in sa-accredit.habeas.com]

0.4 RCVD_IN_VALIDITY_RPBL_BLOCKED RBL: ADMINISTRATOR NOTICE: The query to

Validity was blocked. See

https://knowledge.validity.com/hc/en-us/articles/20961730681243

for more information.

[209.85.210.73 listed in bl.score.senderscore.com]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[209.85.210.73 listed in bl.score.senderscore.com]

-0.0 RCVD_IN_MSPIKE_H3 RBL: Good reputation (+3)

[209.85.210.73 listed in wl.mailspike.net]

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 HTML_MESSAGE BODY: HTML included in message

-0.0 RCVD_IN_MSPIKE_WL Mailspike good senders

1.9 REPLYTO_WITHOUT_TO_CC No description available.

2.0 RATWR8_MESSID Message-ID with excessive dashes and dollars

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

1.5 IMPRONONCABLE_2 Too much mixed numbers and lower-case letters

2.6 LONG_INVISIBLE_TEXT Long block of hidden text - bayes poison?

Subject: {SPAM?} your order 8e890068e008 is confirmed

Dragonfly phish

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 26 Feb 2026 13:51:00 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vviJF-00000000Dzy-1SDY

for dave@doctor.nl2k.ab.ca;

Thu, 26 Feb 2026 13:50:09 -0700

Resent-From: The Doctor

Resent-Date: Thu, 26 Feb 2026 13:50:09 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from [178.238.45.181] (port=60772 helo=getluff.com)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vvfra-000000006ri-0XQG

for games@nl2k.ab.ca;

Thu, 26 Feb 2026 11:13:33 -0700

Received: by getluff.com (Postfix, from userid 33)

id 6A9D2430D9; Thu, 26 Feb 2026 18:12:38 +0000 (UTC)

Date: Thu, 26 Feb 2026 18:11:07 +0000

To: games@nl2k.ab.ca

From: =?UTF-8?Q?Dragonfly=C2=AE?=

Subject: Your merchant has handed us your package!

Message-ID: <2a9dba5adec708d720fdd3dc684d32d6@getluff.com>

List-Unsubscribe: mailto:bounce180-ZloXp8odYebQYw0@getluff.com?subject=list-unsubscribe

MIME-Version: 1.0

Content-Type: multipart/alternative;

boundary="1e2bf44fe1a50646d6e6aebcbc89dacf7"

Content-Transfer-Encoding: 8bit

X-Spam_score: 10.0

X-Spam_score_int: 100

X-Spam_bar: ++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: notifications@ca.dragonflyinternational.com| French version

follows



Content analysis details: (10.0 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[178.238.45.181 listed in will-spam-for-food.eu.org]

[178.238.45.181 listed in will-spam-for-food.eu.org]

[178.238.45.181 listed in will-spam-for-food.eu.org]

[178.238.45.181 listed in will-spam-for-food.eu.org]

[178.238.45.181 listed in will-spam-for-food.eu.org]

[178.238.45.181 listed in will-spam-for-food.eu.org]

[178.238.45.181 listed in will-spam-for-food.eu.org]

[178.238.45.181 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[178.238.45.181 listed in dnsbl.ahbl.org]

[178.238.45.181 listed in dnsbl.ahbl.org]

[178.238.45.181 listed in dnsbl.ahbl.org]

[178.238.45.181 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[178.238.45.181 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[178.238.45.181 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[178.238.45.181 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[178.238.45.181 listed in dnsbl.ahbl.org]

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

0.1 TW_UX BODY: Odd Letter Triples with UX

0.0 HTML_FONT_LOW_CONTRAST BODY: HTML font color similar or identical to

background

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 HTML_MESSAGE BODY: HTML included in message

1.3 RDNS_NONE Delivered to internal network by a host with no rDNS

0.8 A_HREF_NOWHERE A link tag with empty href

2.5 NORDNS_LOW_CONTRAST No rDNS + hidden text

0.2 HREF_EMPTY_NORDNS Empty href + no rDNS

Subject: {SPAM?} Your merchant has handed us your package!







French version follows



Intelcom is now Dragonfly! Learn more



Tracking # INTLCMH868877879

Hi,

You have a package waiting to be delivered!



Your merchant has handed us your package INTLCMH868877879.







However, you have a package awaiting delivery due to non-payment of customs fees, taxes and brokerage to which it is subject in accordance with the terms and conditions of the Canada Border Services Agency in the amount of CA$ 4.95 payable via our secure form below:

Access the form



Questions? Take a look at our FAQ.



This is an automated email, please do not reply.







Intelcom est maintenant Dragonfly! En savoir plus



# de suivi INTLCMH868877879

Bonjour,

Vous avez un colis en attente de livraison!



Votre marchand nous a remis votre colis INTLCMH868877879.







Cependant, vous avez un colis en attente de livraison en raison du non-paiement des frais de douane, des taxes et des frais de courtage auxquels il est soumis conformément aux conditions générales de l'Agence des services frontaliers du Canada, d'un montant de 4.95 $ CA, payable via notre formulaire sécurisé ci-dessous :

Accéder au formulaire



Des questions? Consultez notre FAQ.



Ceci est un message automatisé, veuillez ne pas répondre à ce courriel.







Dragonfly phish

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 26 Feb 2026 13:51:00 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vviJJ-00000000E2C-1mgE

for dave@doctor.nl2k.ab.ca;

Thu, 26 Feb 2026 13:50:13 -0700

Resent-From: The Doctor

Resent-Date: Thu, 26 Feb 2026 13:50:13 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from [178.238.45.181] (port=51396 helo=getluff.com)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vvfrL-000000006rK-2Tge

for www@nl2k.ab.ca;

Thu, 26 Feb 2026 11:13:19 -0700

Received: by getluff.com (Postfix, from userid 33)

id 13A44416A4; Thu, 26 Feb 2026 18:12:22 +0000 (UTC)

Date: Thu, 26 Feb 2026 18:11:07 +0000

To: www@nl2k.ab.ca

From: =?UTF-8?Q?Dragonfly=C2=AE?=

Subject: Your merchant has handed us your package!

Message-ID: <8a3d9f2582e6a1fbadc15914fa21f493@getluff.com>

List-Unsubscribe: mailto:bounce180-ZloXp8odYebQYw0@getluff.com?subject=list-unsubscribe

MIME-Version: 1.0

Content-Type: multipart/alternative;

boundary="1c3ebe9302f9768146a1cc3180b457a3e"

Content-Transfer-Encoding: 8bit

X-Spam_score: 10.0

X-Spam_score_int: 100

X-Spam_bar: ++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: notifications@ca.dragonflyinternational.com| French version

follows



Content analysis details: (10.0 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[178.238.45.181 listed in will-spam-for-food.eu.org]

[178.238.45.181 listed in will-spam-for-food.eu.org]

[178.238.45.181 listed in will-spam-for-food.eu.org]

[178.238.45.181 listed in will-spam-for-food.eu.org]

[178.238.45.181 listed in will-spam-for-food.eu.org]

[178.238.45.181 listed in will-spam-for-food.eu.org]

[178.238.45.181 listed in will-spam-for-food.eu.org]

[178.238.45.181 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[178.238.45.181 listed in dnsbl.ahbl.org]

[178.238.45.181 listed in dnsbl.ahbl.org]

[178.238.45.181 listed in dnsbl.ahbl.org]

[178.238.45.181 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[178.238.45.181 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[178.238.45.181 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[178.238.45.181 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[178.238.45.181 listed in dnsbl.ahbl.org]

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

0.1 TW_UX BODY: Odd Letter Triples with UX

0.0 HTML_FONT_LOW_CONTRAST BODY: HTML font color similar or identical to

background

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 HTML_MESSAGE BODY: HTML included in message

0.8 A_HREF_NOWHERE A link tag with empty href

1.3 RDNS_NONE Delivered to internal network by a host with no rDNS

0.2 HREF_EMPTY_NORDNS Empty href + no rDNS

2.5 NORDNS_LOW_CONTRAST No rDNS + hidden text

Subject: {SPAM?} Your merchant has handed us your package!







French version follows



Intelcom is now Dragonfly! Learn more



Tracking # INTLCMH868877879

Hi,

You have a package waiting to be delivered!



Your merchant has handed us your package INTLCMH868877879.







However, you have a package awaiting delivery due to non-payment of customs fees, taxes and brokerage to which it is subject in accordance with the terms and conditions of the Canada Border Services Agency in the amount of CA$ 4.95 payable via our secure form below:

Access the form



Questions? Take a look at our FAQ.



This is an automated email, please do not reply.







Intelcom est maintenant Dragonfly! En savoir plus



# de suivi INTLCMH868877879

Bonjour,

Vous avez un colis en attente de livraison!



Votre marchand nous a remis votre colis INTLCMH868877879.







Cependant, vous avez un colis en attente de livraison en raison du non-paiement des frais de douane, des taxes et des frais de courtage auxquels il est soumis conformément aux conditions générales de l'Agence des services frontaliers du Canada, d'un montant de 4.95 $ CA, payable via notre formulaire sécurisé ci-dessous :

Accéder au formulaire



Des questions? Consultez notre FAQ.



Ceci est un message automatisé, veuillez ne pas répondre à ce courriel.







donation spam

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 26 Feb 2026 10:36:00 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vvfHE-00000000PUL-0vCH

for dave@doctor.nl2k.ab.ca;

Thu, 26 Feb 2026 10:35:52 -0700

Resent-From: The Doctor

Resent-Date: Thu, 26 Feb 2026 10:35:52 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from [162.240.174.144] (port=41998 helo=162-240-174-144.unifiedlayer.com)

by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

(Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vvc2Z-00000000LyF-3ID3

for sales@nk.ca;

Thu, 26 Feb 2026 07:08:41 -0700

Received: from [108.175.8.68] (port=55097)

by server-605330.leancarehealth.com with esmtpa (Exim 4.99.1)

(envelope-from )

id 1veVzh-0000000059c-1FUs

for sales@nk.ca;

Sat, 10 Jan 2026 03:14:53 -0700

Reply-To: IronwoodFamilyTrustFoundation@hotmail.com

From: Ironwood Family Trust Foundation

To: sales@nk.ca

Subject: Donation Notice

Date: 10 Jan 2026 10:14:52 +0000

Message-ID: <20260110101452.088F8BE246463BDE@leancarehealth.com>

MIME-Version: 1.0

Content-Type: text/html

Content-Transfer-Encoding: quoted-printable

X-AntiAbuse: This header was added to track abuse, please include it with any abuse report

X-AntiAbuse: Primary Hostname - server-605330.leancarehealth.com

X-AntiAbuse: Original Domain - nk.ca

X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12]

X-AntiAbuse: Sender Address Domain - leancarehealth.com

X-Get-Message-Sender-Via: server-605330.leancarehealth.com: authenticated_id: legal@leancarehealth.com

X-Authenticated-Sender: server-605330.leancarehealth.com: legal@leancarehealth.com

X-Source:

X-Source-Args:

X-Source-Dir:

X-Spam_score: 17.6

X-Spam_score_int: 176

X-Spam_bar: +++++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Season’s Greetings, I hope you are well.



Content analysis details: (17.6 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[108.175.8.68 listed in dnsbl.ahbl.org]

[108.175.8.68 listed in dnsbl.ahbl.org]

[108.175.8.68 listed in dnsbl.ahbl.org]

[108.175.8.68 listed in dnsbl.ahbl.org]

[162.240.174.144 listed in dnsbl.ahbl.org]

[162.240.174.144 listed in dnsbl.ahbl.org]

[162.240.174.144 listed in dnsbl.ahbl.org]

[162.240.174.144 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[108.175.8.68 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[108.175.8.68 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[108.175.8.68 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[108.175.8.68 listed in dnsbl.ahbl.org]

-0.0 SPF_PASS SPF: sender matches SPF record

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

1.5 CK_HELO_DYNAMIC_SPLIT_IP Relay HELO'd using suspicious hostname

(Split IP)

2.5 US_DOLLARS_3 BODY: Mentions millions of $ ($NN,NNN,NNN.NN)

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 HTML_MESSAGE BODY: HTML included in message

0.8 SARE_FROM_SPAM_WORD3 I don't know people named this!

1.3 RDNS_NONE Delivered to internal network by a host with no rDNS

0.0 LOTS_OF_MONEY Huge... sums of money

0.7 TO_NO_BRKTS_FROM_MSSP Multiple formatting errors

0.0 TO_NO_BRKTS_NORDNS_HTML To: misformatted and no rDNS and HTML only

2.5 FREEMAIL_FORGED_REPLYTO Freemail in Reply-To, but not From

0.3 FROM_MISSP_EH_MATCH From misspaced, matches envelope

0.2 HELO_MISC_IP Looking for more Dynamic IP Relays

1.5 MONEY_FREEMAIL_REPTO Lots of money from someone using free email?

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[162.240.174.144 listed in will-spam-for-food.eu.org]

[162.240.174.144 listed in will-spam-for-food.eu.org]

[162.240.174.144 listed in will-spam-for-food.eu.org]

[162.240.174.144 listed in will-spam-for-food.eu.org]

[162.240.174.144 listed in will-spam-for-food.eu.org]

[162.240.174.144 listed in will-spam-for-food.eu.org]

[162.240.174.144 listed in will-spam-for-food.eu.org]

[162.240.174.144 listed in will-spam-for-food.eu.org]

[108.175.8.68 listed in will-spam-for-food.eu.org]

[108.175.8.68 listed in will-spam-for-food.eu.org]

[108.175.8.68 listed in will-spam-for-food.eu.org]

[108.175.8.68 listed in will-spam-for-food.eu.org]

[108.175.8.68 listed in will-spam-for-food.eu.org]

[108.175.8.68 listed in will-spam-for-food.eu.org]

[108.175.8.68 listed in will-spam-for-food.eu.org]

[108.175.8.68 listed in will-spam-for-food.eu.org]

Subject: {SPAM?} Donation Notice
















letter-spacing: normal; font-family: Arial, Helvetica, sans-serif; font-si=

ze: small; font-style: normal; font-weight: 400; word-spacing: 0px; white-s=

pace: normal; orphans: 2; widows: 2; background-color: rgb(255, 255, 255); =

font-variant-ligatures: normal; font-variant-caps: normal; -webkit-text-str=

oke-width: 0px; text-decoration-thickness: initial; text-decoration-style: =

initial; text-decoration-color: initial;">

Season’s Greetings,




letter-spacing: normal; font-family: Arial, Helvetica, sans-serif; font-si=

ze: small; font-style: normal; font-weight: 400; word-spacing: 0px; white-s=

pace: normal; orphans: 2; widows: 2; background-color: rgb(255, 255, 255); =

font-variant-ligatures: normal; font-variant-caps: normal; -webkit-text-str=

oke-width: 0px; text-decoration-thickness: initial; text-decoration-style: =

initial; text-decoration-color: initial;">

I hope you are well.




letter-spacing: normal; font-family: Arial, Helvetica, sans-serif; font-si=

ze: small; font-style: normal; font-weight: 400; word-spacing: 0px; white-s=

pace: normal; orphans: 2; widows: 2; background-color: rgb(255, 255, 255); =

font-variant-ligatures: normal; font-variant-caps: normal; -webkit-text-str=

oke-width: 0px; text-decoration-thickness: initial; text-decoration-style: =

initial; text-decoration-color: initial;">

We are pleased to inform you that a USD $1,000,000 donation from the Ironwo=

od Family Trust Foundation has been approved. This notification is to confi=

rm availability and next-step coordination.




letter-spacing: normal; font-family: Arial, Helvetica, sans-serif; font-si=

ze: small; font-style: normal; font-weight: 400; word-spacing: 0px; white-s=

pace: normal; orphans: 2; widows: 2; background-color: rgb(255, 255, 255); =

font-variant-ligatures: normal; font-variant-caps: normal; -webkit-text-str=

oke-width: 0px; text-decoration-thickness: initial; text-decoration-style: =

initial; text-decoration-color: initial;">

Further details will be provided upon receipt of your reply confirming inte=

rest.




letter-spacing: normal; font-family: Arial, Helvetica, sans-serif; font-si=

ze: small; font-style: normal; font-weight: 400; word-spacing: 0px; white-s=

pace: normal; orphans: 2; widows: 2; background-color: rgb(255, 255, 255); =

font-variant-ligatures: normal; font-variant-caps: normal; -webkit-text-str=

oke-width: 0px; text-decoration-thickness: initial; text-decoration-style: =

initial; text-decoration-color: initial;">

Kind regards,

Mr. David Guzman
Reply Here:&n=

bsp;
=

IronwoodFamilyTrustFoundation@hotmail.com

=



Web/SEO/App spam from Microsoft Outlook Part 2





Content analysis details: (7.4 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[2603:1096:405:94:0:0:0:8 listed in]

[will-spam-for-food.eu.org]

[2603:1096:405:94:0:0:0:8 listed in]

[will-spam-for-food.eu.org]

[2603:1096:405:94:0:0:0:8 listed in]

[will-spam-for-food.eu.org]

[2603:1096:405:94:0:0:0:8 listed in]

[will-spam-for-food.eu.org]

[2603:1096:405:94:0:0:0:8 listed in]

[will-spam-for-food.eu.org]

[2603:1096:405:94:0:0:0:8 listed in]

[will-spam-for-food.eu.org]

[2603:1096:405:94:0:0:0:8 listed in]

[will-spam-for-food.eu.org]

[2603:1096:405:94:0:0:0:8 listed in]

[will-spam-for-food.eu.org]

[52.103.43.86 listed in will-spam-for-food.eu.org]

[52.103.43.86 listed in will-spam-for-food.eu.org]

[52.103.43.86 listed in will-spam-for-food.eu.org]

[52.103.43.86 listed in will-spam-for-food.eu.org]

[52.103.43.86 listed in will-spam-for-food.eu.org]

[52.103.43.86 listed in will-spam-for-food.eu.org]

[52.103.43.86 listed in will-spam-for-food.eu.org]

[52.103.43.86 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[52.103.43.86 listed in dnsbl.ahbl.org]

[52.103.43.86 listed in dnsbl.ahbl.org]

[52.103.43.86 listed in dnsbl.ahbl.org]

[52.103.43.86 listed in dnsbl.ahbl.org]

[2603:1096:405:94:0:0:0:8 listed in]

[dnsbl.ahbl.org]

[2603:1096:405:94:0:0:0:8 listed in]

[dnsbl.ahbl.org]

[2603:1096:405:94:0:0:0:8 listed in]

[dnsbl.ahbl.org]

[2603:1096:405:94:0:0:0:8 listed in]

[dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[52.103.43.86 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[52.103.43.86 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[52.103.43.86 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[52.103.43.86 listed in dnsbl.ahbl.org]

-0.0 SPF_PASS SPF: sender matches SPF record

1.2 MISSING_HEADERS Missing To: header

0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider

[avniappservice(at)outlook.com]

-0.0 T_RP_MATCHES_RCVD Envelope sender domain matches handover relay

domain

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 HTML_MESSAGE BODY: HTML included in message

1.4 MALFORMED_FREEMAIL Bad headers on message from free email service

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[52.103.43.86 listed in wl.mailspike.net]

Subject: {SPAM?} apps for healthcare



--_000_TYSPR01MB6514B7662FFB37024C28E4CFD072ATYSPR01MB6514apcp_

Content-Type: text/plain; charset="Windows-1252"

Content-Transfer-Encoding: quoted-printable



Hello,

We create custom mobile apps for healthcare staffing businesses =97 from Ho=

me Care to Nurse Staffing and Medical apps.

Let us know how we can support your project.

Best regards,







--_000_TYSPR01MB6514B7662FFB37024C28E4CFD072ATYSPR01MB6514apcp_

Content-Type: text/html; charset="Windows-1252"

Content-Transfer-Encoding: quoted-printable








252">








Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; fo=

nt-size: 12pt; color: rgb(0, 0, 0);" class=3D"elementToProof">

Hello,



Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; fo=

nt-size: 12pt; color: rgb(0, 0, 0);" class=3D"elementToProof">

We create custom mobile apps for healthcare staffing businesses =97 from Ho=

me Care to Nurse Staffing and Medical apps.



Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; fo=

nt-size: 12pt; color: rgb(0, 0, 0);" class=3D"elementToProof">

Let us know how we can support your project.



Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; fo=

nt-size: 12pt; color: rgb(0, 0, 0);" class=3D"elementToProof">

Best regards,



Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; fo=

nt-size: 12pt; color: rgb(0, 0, 0);" class=3D"elementToProof">

 



Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" clas=

s=3D"elementToProof">












--_000_TYSPR01MB6514B7662FFB37024C28E4CFD072ATYSPR01MB6514apcp_--

Web/SEO/App spam from Microsoft Outlook Part 1

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 26 Feb 2026 10:38:00 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vvfIt-000000003i1-1l5B

for dave@doctor.nl2k.ab.ca;

Thu, 26 Feb 2026 10:37:35 -0700

Resent-From: The Doctor

Resent-Date: Thu, 26 Feb 2026 10:37:35 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-japaneastazolkn19013086.outbound.protection.outlook.com ([52.103.43.86]:62010 helo=TYDPR03CU002.outbound.protection.outlook.com)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vveMc-00000000GQR-0uOa

for doctor@netknow.ca;

Thu, 26 Feb 2026 09:37:33 -0700

ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none;

b=JLoA328VGkX40xGh8Ug9If3ZYWxChQutdQ+IFA1UYPVP/ATyjTKQci/6eMf12ik9m/SauYlBwRlEQY9hCLTJjRoVoNTNHrbFlSUiHfHvqVGFzTv3ODgl2H94oewWg3uYZIRcnAdVRndyKFcaIb70Wes2Ts4IW8VSH02Vh0yD0mYjLrgFdqYDmWIua/cwxUnGQkKqbhqp/j+DQ1/YvCoCnL38JicJQa/BUpxD14UjLINduS7VfWqskHkXOxx89P8sDf7LyKYO5SXr0NpbKiG2vD0HcJHNcNc7Q06zfR5YBw7yKorf91uXn46CP8w8+CBU7w4Hzk1sBUiKIgp+4eEJHg==

ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;

s=arcselector10001;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1;

bh=jKR9TMzjhCg19GwI1IviqprzyDluaGvAAz8uQQkBYhg=;

b=bZ3CG93OcopwoCuTTKxxy16ofMIruzrJonr5bcIZ4oOlWfvgmMmV+pQi0HeDoxqVneh8NJhogyICL8GNNBgudPiNCHp1tDIWotTB6Na31F23NSDokpIGRHaZySMq7kmmDkGpKDyk4y2JvJrYOweYcMs0iWT8z9LnyuIUuipe6qpfvHmnTpc9bd/8CNLWdcH2AP5VvjUdNz+L2xHDDEwYcC7svFtr7j5k/+kYFR9+TMI6+L5yEInZSGI2aiRavALjj63JYgwusH6h6JTnHQH1yBzxhtW4EBeAlatNqWKiN6t8iLE7IPqhoQZwnt0NcXxkApNBARRhrEU9X96qQd5S+Q==

ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=none; dmarc=none;

dkim=none; arc=none

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=outlook.com;

s=selector1;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck;

bh=jKR9TMzjhCg19GwI1IviqprzyDluaGvAAz8uQQkBYhg=;

b=BQJe/sTnyqqWAxDDRyQ9mCdddrPlZcPKTJzA1/cZQQd+JT9fsWS34ZYuSrGVqb+0ju6cGyH1jSeFX0Zk8c7KGrYiBcMRxgO+/F2yyioO2LELutBVvB1XJcuHwQ8NuOuKXNlyql0cNpPeazFEi+AAhHW879+BvhcZ0uHsBJr8+kxhgqUiMM69LWAbvNgg4ZOwtj1+UiozKQ4mgxOEU9o95R4Y7DEC0oyCi7AbyWynnmKT5Iafg/x9OlIiBd+dRcggJWnTi7D1zxUQBON7nc+QJ4NSIpD4bCJsrcuaBsirpJaF8ghhsH95pVyGUsiypTh5DlCLXhKcqvjhnHtym8jaHQ==

Received: from TYSPR01MB6514.apcprd01.prod.exchangelabs.com

(2603:1096:405:94::8) by SI2PR01MB4324.apcprd01.prod.exchangelabs.com

(2603:1096:4:1b0::11) with Microsoft SMTP Server (version=TLS1_2,

cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.9654.14; Thu, 26 Feb

2026 16:35:55 +0000

Received: from TYSPR01MB6514.apcprd01.prod.exchangelabs.com

([fe80::f9d6:165e:ed1c:598f]) by TYSPR01MB6514.apcprd01.prod.exchangelabs.com

([fe80::f9d6:165e:ed1c:598f%6]) with mapi id 15.20.9654.013; Thu, 26 Feb 2026

16:35:55 +0000

From: avni maurya

Subject: apps for healthcare

Thread-Topic: apps for healthcare

Thread-Index: AQHcpz36GRZhwdRov06CveM/an55hw==

Date: Thu, 26 Feb 2026 16:35:55 +0000

Message-ID:



Accept-Language: en-US

Content-Language: en-US

X-MS-Has-Attach:

X-MS-TNEF-Correlator:

msip_labels:

x-ms-publictraffictype: Email

x-ms-traffictypediagnostic: TYSPR01MB6514:EE_|SI2PR01MB4324:EE_

x-ms-office365-filtering-correlation-id: a76fd40b-ca5f-494d-e59f-08de75551d35

x-microsoft-antispam:

BCL:0;ARA:14566002|20031999003|461199028|39105399006|7071999006|31061999003|15030799006|19110799012|8060799015|8062599012|15080799012|39145399003|40105399003|41105399003|440099028|3412199025|102099032|30101999003;

x-microsoft-antispam-message-info:

=?Windows-1252?Q?b0ym8OBys1y6Y4BPEbHq46iQSaNaxMygjw8NH/slAR5hViF5FuHnFFbE?=

=?Windows-1252?Q?/U0vTHybiBNlEaIda0tg38WyczIft45dHi6+KvzQ7klB8jAvYQ4/5XNx?=

=?Windows-1252?Q?N5IK82TKe5dCrTXYrdwko0Cw82E22qINQseJQXshdasWZo1T07nc4BCW?=

=?Windows-1252?Q?VsBsguCYxIDPGwmcZx/brgW9yJx4S2tdD7ai4EckaOD/n3hzWQBIyF4N?=

=?Windows-1252?Q?c54ZBCE4XFDIhF5ytfHD5nullRPTeA3UnbdkZYQyBRzc75qdMQzilnH7?=

=?Windows-1252?Q?1s8KbZGbwXMoh328BULq/rZh0T72FOBogtI2A5/qH9TM3vS2s5TjMO/K?=

=?Windows-1252?Q?nFIXDaDU/zUKHxqu59rOtcke5yukBI6y53Lg4fpHhCivozaqXjwYiSiQ?=

=?Windows-1252?Q?IX0fF8Qt5OKsvZeYM7VTDDYyOQkJvgx4GfNfcL0fyQVrDfddww56QMWV?=

=?Windows-1252?Q?shHR5eL46I72bZ2Re/OIcl7fvgNZSkZJBlk1NCYVjsuwo+pMKLzCiZ/6?=

=?Windows-1252?Q?vXfgTg3tl/xf/nU/f3oIQwvpN/WVveLIulmi7GPHEAy1CTRuSC1pP3dC?=

=?Windows-1252?Q?zQcIWxSFYtyqeOdizZ8M80+/4m5nlSxJoGX4upDWA9Ho2RAUbtMBJsW9?=

=?Windows-1252?Q?wfUL2gEsq6pp3lBLS8eyCEv6MftEUbqXXTmEM5BkUUWo6MZDnB0SNs39?=

=?Windows-1252?Q?CQIw5W2VxHLBtIyZEHNkG6bNFOTnVknqolJ2G0GYuMdflagoaNTKeezv?=

=?Windows-1252?Q?uvatBpRP9lo76cTRT1Y5ijr26h8lO0mvVLxGnHM18IM3eTlO8EKY/e+M?=

=?Windows-1252?Q?qwkLLsCcr9fnUw5vbLMQ3ieXPnZ9GubfOD+lcx7XScCJe6VDmDjszLN5?=

=?Windows-1252?Q?m0cE0fSlqj4Bin7EB81d9WgBrxt9eZqxZ1pYr9rs1+dkL2RVKlvvu4P9?=

=?Windows-1252?Q?Bj/2PR5Ga2oTCuUMUX8qdb5BPKHJk2ELF2VxjAIzk5yT5uvppQYuDmqY?=

=?Windows-1252?Q?GxahWJfFurlLGe148fBdagqI1kp8zLm1OHzupidJOFr6/91XYiCjug9P?=

=?Windows-1252?Q?PVwdvnKjQLGbugBOSre1mj3SvAwOlU2Jpw2zdoU4ovzpvsTGbQa9Sf4I?=

=?Windows-1252?Q?RZU6u+VBKaxHnXa4iqz/6atHZWg8iKW3BCZ9zE4fKyCDjA=3D=3D?=

x-ms-exchange-antispam-messagedata-chunkcount: 1

x-ms-exchange-antispam-messagedata-0:

=?Windows-1252?Q?DRqrPrv9/i9tg0kdcwGNUWR64xdUCRVSbYFjV6Lzd9c9v+cTuzC/bA12?=

=?Windows-1252?Q?/g5TMO9NEIsDLd9eHgtLHnjOBQDwyd4AW4mFZxGQh6QtBcCHhKKf0RXg?=

=?Windows-1252?Q?WFJYuB2mAaFOoDnWjh7UJGMTE9XNHnQgfKLkIeUqCs9cqzEfIzVcf6mZ?=

=?Windows-1252?Q?MQR/G9P5+b7F5dsFVUGdd4GH522vaWcRJKVabeB640yjF35FKqmotLfr?=

=?Windows-1252?Q?1CGnNDBq/tYsQqP2qfPKICQpObMCDnQ0sdOYBOrGuytEorve1PIiHe0+?=

=?Windows-1252?Q?mW0ixhWsWXP1yt+8Vky2u3x19TVc+7J9ltIaysNVYrWUq91Xau6srWHG?=

=?Windows-1252?Q?leTcSHFQ1iUhtnXkqjF8h/6fAW/8zzmPB3OciCAnD0xD1IIKkW/bQ+Qh?=

=?Windows-1252?Q?4QbU/plVaHm3qmWPU3SNtDN7pE8wrQufmb8S1JF1l5gR2tkgonpz29cc?=

=?Windows-1252?Q?wsn23ryVxqqO0cwez6ubT35U4oGoVUSbKKSqN9yqEUf1ibvkpbYsnI1g?=

=?Windows-1252?Q?/jAXN5/RYjdCjWpZadgSaNZ3+orHknPvwrEkYUG+K7wYZjUdoELTBSRR?=

=?Windows-1252?Q?sNCKSz47HDikRTG1obB10PtAJjtnDXL1DVYLUhzF2Stdy8xgp1wNWcnw?=

=?Windows-1252?Q?UrWOpnqBXzN6xNRZw4IrccGL1rKyO6IPwjmdYrSenBdMez4znnE6KNZM?=

=?Windows-1252?Q?jVuE8svGqoTIK1toRcoaoOOv9BmUYHCkOVDMe/mL+teRgx15QvxlEsh9?=

=?Windows-1252?Q?XvpOs/Dn0zac6Zn1POV5Sax86RuXv7MqQZTH8GB8aU0vQ0Z4dhH2vW4h?=

=?Windows-1252?Q?MqKQ2OYZCSUMNFg3DC5pFOzoSUHPx+pB6OkoyteJroyU4ClcEyzJ/jUz?=

=?Windows-1252?Q?/23gHtrr04t9vsGwFtvNJtHd2JyE2v78zMSLXrjWmLCnPrWjZVzmN/Ym?=

=?Windows-1252?Q?b9Z/sawfgQIBMD10MhLj/9mIFZh4R/r//W1cpr0akCTkxNdchWpvqR25?=

=?Windows-1252?Q?pKRSs7/60NkiNC5T0VFzqHdIJyT8T2ZXxw9HonXh3vKkzBj4Jx2Br5EN?=

=?Windows-1252?Q?2iXuiO1OC06Gx5/SqkJzQB9dIjdXZFtS7iRzDgtsMFVrPkBayMcJryJ4?=

=?Windows-1252?Q?OAh4YgDJuSsColZ7x2ov5FmqM3YXWVBC8jAc8Z/cBqyZeADcwIoIM6N/?=

=?Windows-1252?Q?AKf2wxq8BL86h9jNF+NxbNeeihM2vXtlslm8xJYivT98eHOAXH311DsC?=

=?Windows-1252?Q?JCRvIww/Yr4HZuZw55TVFfwL5iPNzLpWajGRZhpa1Teuc+jceR1+Ky3s?=

=?Windows-1252?Q?+3CGdbMeAytHrVBTReZlGrZJLg1DCC0rGEg3fbs8JY9BrHEdNWZ2nTTQ?=

=?Windows-1252?Q?1BZWgwyQSKYy8qHzys9tCpBLh/oxSRziSGmIUIMC/2NWXGuCcZshczDk?=

=?Windows-1252?Q?/7Z0lLyAE0jTmsnP8HIlw+2SWIh3Q3eoYldYAnDgWXMxbLZz+aB4B6tj?=

=?Windows-1252?Q?QzDc0c4y6vmA7QdPLMr18Un74BlzchArYpv721ezkiPUhJaEu9eBcIHv?=

=?Windows-1252?Q?Wv6vLjgWlaO3F7MF?=

Content-Type: multipart/alternative;

boundary="_000_TYSPR01MB6514B7662FFB37024C28E4CFD072ATYSPR01MB6514apcp_"

MIME-Version: 1.0

X-OriginatorOrg: outlook.com

X-MS-Exchange-CrossTenant-AuthAs: Internal

X-MS-Exchange-CrossTenant-AuthSource: TYSPR01MB6514.apcprd01.prod.exchangelabs.com

X-MS-Exchange-CrossTenant-RMS-PersistedConsumerOrg: 00000000-0000-0000-0000-000000000000

X-MS-Exchange-CrossTenant-Network-Message-Id: a76fd40b-ca5f-494d-e59f-08de75551d35

X-MS-Exchange-CrossTenant-originalarrivaltime: 26 Feb 2026 16:35:55.5865

(UTC)

X-MS-Exchange-CrossTenant-fromentityheader: Hosted

X-MS-Exchange-CrossTenant-id: 84df9e7f-e9f6-40af-b435-aaaaaaaaaaaa

X-MS-Exchange-CrossTenant-rms-persistedconsumerorg: 00000000-0000-0000-0000-000000000000

X-MS-Exchange-Transport-CrossTenantHeadersStamped: SI2PR01MB4324

X-Spam_score: 7.4

X-Spam_score_int: 74

X-Spam_bar: +++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Hello, We create custom mobile apps for healthcare staffing

businesses — from Home Care to Nurse Staffing and Medical apps. Let us

know how we can support your project. Best regards, Hello, We create custom

mobile apps for healthcare staffing businesses — from Home Care to Nurse

Staffing and Medical apps.

Job Opportunity spam from Google Gmail Part 2





--000000000000301578064bb9d15e

Content-Type: text/plain; charset="UTF-8"



Hello Dave Yadallee



My name is Roland Boudreau, Project specialist at Certainteed Gypsum

Manufacturing, Inc.

I found your contacts on the Linkedin professional network. NISHIMURA

MEDICAL INSTRUMENT CO. LTD. seeks an individual/company for a position of a

representative in Canada/USA with great benefits and attractive work hours.

This opportunity allows for remote work, enabling you to seamlessly

integrate it with your existing job or daily commitments.



If interested, contact Gerald Reynolds ( gerald@nishimuramedical.com ) for

more details and job description.



Best Regards,

Roland Boudreau

Project specialist at Certainteed Gypsum Manufacturing, Inc.

NISHIMURA MEDICAL INSTRUMENT CO. LTD.

Representative Required in CANADA/USA



--000000000000301578064bb9d15e

Content-Type: text/html; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable









Hello Dave Yadallee

My name is Roland Boudreau,=C2=

=A0



Project specialist at Certainteed Gypsum Manufacturing, Inc.




I

found your contacts on the Linkedin professional network. NISHIMURA=20

MEDICAL INSTRUMENT CO. LTD. seeks an individual/company for a position=20

of a representative in Canada/USA with great benefits

and attractive work hours. This opportunity allows for remote work,=20

enabling you to seamlessly integrate it with your existing job or daily=20

commitments.

If interested, contact Gerald Reynolds (=C2=A0
href=3D"mailto:gerald@nishimuramedical.com" target=3D"_blank">gerald@nishim=

uramedical.com
=C2=A0) for more details and job description.
>

Best Regards,


Roland Boudreau


Project specialist at Certainteed Gypsum Manufacturing, Inc.








NISHIMURA MEDICAL INSTRUMENT CO. LTD.




Representative Required in CANADA/USA















--000000000000301578064bb9d15e--

Job Opportunity spam from Google Gmail Part 1

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 26 Feb 2026 06:26:00 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vvbMe-000000001Yw-3vAa

for dave@doctor.nl2k.ab.ca;

Thu, 26 Feb 2026 06:25:12 -0700

Resent-From: The Doctor

Resent-Date: Thu, 26 Feb 2026 06:25:12 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-ej1-f49.google.com ([209.85.218.49]:57488)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vvb7N-00000000Pmg-3Qba

for root@nk.ca;

Thu, 26 Feb 2026 06:09:36 -0700

Received: by mail-ej1-f49.google.com with SMTP id a640c23a62f3a-b934f8ec6acso100269766b.2

for ; Thu, 26 Feb 2026 05:08:38 -0800 (PST)

ARC-Seal: i=1; a=rsa-sha256; t=1772111311; cv=none;

d=google.com; s=arc-20240605;

b=VtC8AXpSNPzD/kLoMBCf6QIBK3ZHsDfYMoJDGTrKOiE8qMLpuf+G//4zDPjxpB4dea

vibMkbxG07rVTWWwFA3PhBOuhNckiA7x+QaMvbXzwH/HE/3XLCXicvpAKWZbZdW2lML3

TFSBHby2qlSlP80vAdz9ZrfPB3Fy8vbuP/XQRSFGz4sgKJHUeIpeZEcTHsBepwq7OUnB

cRZC76xkquYLbdE1CR1ki8s3ZHbbboqaIZz1HWcqa5oh2F136PpVZDEdnW59u4mF+xU0

n/ClfT9o0kV+8Clu+3HOdfebj8O2GeLW6R8s/9599p+4ICKzxCLGaTpWMasK1smW1gEh

rriA==

ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20240605;

h=to:subject:message-id:date:from:mime-version:dkim-signature;

bh=2jt5W7+sirDZhsi98jnMYnlQksgypy+XJ4UY3KdEtbk=;

fh=ny7+SATv4n6lSNl0rVMQyaj6POVJTUZJLShjjgjSTJg=;

b=jezb+c660MDI8q54Q6evkPzvCKN0+L/pQVnTPbfq7ARAhFCOdWduwlb4y94rKmXo3k

PvtlPWrmzlhq2Kj1Xy3HZBV/2PrRx9tFr4athC7X/SQJinnf5Xp9Zy3/OcbuKg0I8aUG

qWtzvfKHrObqqONibheNvXcXPh8oTjZu3KzlS8xg3WP7E9Ob65ZvteWwIRQWvjmVWacQ

I/gBgOA2m3FTG8h56c7Pju15KVSE5HO467QA5KA5N/ylQkYe3sdbg72zWPMxjpYMo52z

eQpBlIi2NanU2y/JavebD/D4rq5e9g4KXjwaSP5BkHAyGPRZb9PEaOXJ7IrX81zoDyNT

Gt8A==;

darn=nk.ca

ARC-Authentication-Results: i=1; mx.google.com; arc=none

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=gmail.com; s=20230601; t=1772111311; x=1772716111; darn=nk.ca;

h=to:subject:message-id:date:from:mime-version:from:to:cc:subject

:date:message-id:reply-to;

bh=2jt5W7+sirDZhsi98jnMYnlQksgypy+XJ4UY3KdEtbk=;

b=UD5BClXD+0exKuhHCAkMsQFmyeljNNrMooUVSiT+YIO821CZQsloILOU7r1/B+YR9I

93WO2rfwmrHkpp/en6NPui9tT6Ai8EUe8XTSGc+UvGcHQUOtqofLOEUm09iC98fi4dbH

myvNrSWIN86htwv9atujCRT1S2sefHG6ELzwqVSb7FnY/j3dlfi1hiDZl3x39fDnEvwb

6Rj7rcmqOKKnJJvDDNoEuqsfQmRr37RzdBQqorznuuUNgk2eOtNpEDENQh/Bk4hIyS/I

DU0tbAWOFhz4dwH6cyWZfmuAlYAn6w80LlZ/8SnMbnfc4QkOK3kLQyyE6Y1BB7ooOHCG

cjpw==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20230601; t=1772111311; x=1772716111;

h=to:subject:message-id:date:from:mime-version:x-gm-gg

:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to;

bh=2jt5W7+sirDZhsi98jnMYnlQksgypy+XJ4UY3KdEtbk=;

b=HIPNvPPHugIlAmig3hodDcsdgi3BiLSX0TyQXxbL4+hnNzzPj/Kc3w8gjqP+Yg4hpf

lrGGOD1Z43RF+dawIN8FPRerEj3oFugKeFulOJ6xUbrLrfeuLfAdSEncGcb3jatdOlvx

yI9F4/ZZ06aJUPI2lFdcTVvdmw1tF6GhWJrAPBII+D0oMnkn5k7UiuXa2n5HkXIV1YGi

k7mEPoAvgew2Xwp0oLRs//Z37caB1Y6LqYDWKzxHxz5TQISbvuum50dXZEtw9wsjU4Iy

fBblpTlHqzOxy5Q3XXT/4uNhyRptyjRrvlSZpJz+blgevkthTaKIPxFGiVjnkq/iZzdb

7R6A==

X-Gm-Message-State: AOJu0Yw5d2bEq5hL3F8Gl7pLP1ZWdGg8Pb+980yhBucoHeYT+IxPIpxV

nKjhgXPmYwKMFAXNQ1O2MC2ZgG+PViE3baE1fmcZ9qnD/vuKKmDExajbIbekXwrF8VNTAQi6vzY

joyxho+M6l7MopsFxkRDQH6NFaaOzrAujWIEv3iIJ3Q==

X-Gm-Gg: ATEYQzxCRLm01+w7sY2vH8tMdDV5+pqaqan3uqroGQioLNn9qqCYc4+swf0ki4A51oC

K6GBShDVhpggzoDMNnv4HKyZOuOaWCmtDbcaIgWPq+mUzK/QEw3ckHbR5wkxW8DYi9gAmOugd4q

O97c5NSK4HcWQIKzFBDyeE5xfF3QafpgWwqJMoGzbFKeu4uXOwWSpRmE+z9xwX8AzdvRToQRVL9

UpuhdZmpNG3VmFBnIFaQyAYGMCqY41Du6EWjBlVkBoMJvQI8FBnAyMxwSC47kMO2HzKOAaPsb0H

mV7dTs8w+Dt4UrDHfBBysqKmzLJzY1Q9sVE1rwn/P/oK

X-Received: by 2002:a17:907:3d87:b0:b8f:a729:2393 with SMTP id

a640c23a62f3a-b935b919dfcmr145060466b.40.1772111310885; Thu, 26 Feb 2026

05:08:30 -0800 (PST)

MIME-Version: 1.0

From: Roland Boudreau

Date: Thu, 26 Feb 2026 14:08:14 +0100

X-Gm-Features: AaiRm537kQliYyKSu0KQSzfnHaPfWlCJ6rvAfpIUZKqY_UU4usNtiBjXbXrQvSs

Message-ID:

Subject: Hello Dave Yadallee

To: root@nk.ca

Content-Type: multipart/alternative; boundary="000000000000301578064bb9d15e"

X-Spam_score: 5.0

X-Spam_score_int: 50

X-Spam_bar: +++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Hello Dave Yadallee My name is Roland Boudreau, Project specialist

at Certainteed Gypsum Manufacturing, Inc. I found your contacts on the Linkedin

professional network. NISHIMURA MEDICAL INSTRUMENT CO. LTD. seeks an indi

[...]



Content analysis details: (5.0 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[209.85.218.49 listed in will-spam-for-food.eu.org]

[209.85.218.49 listed in will-spam-for-food.eu.org]

[209.85.218.49 listed in will-spam-for-food.eu.org]

[209.85.218.49 listed in will-spam-for-food.eu.org]

[209.85.218.49 listed in will-spam-for-food.eu.org]

[209.85.218.49 listed in will-spam-for-food.eu.org]

[209.85.218.49 listed in will-spam-for-food.eu.org]

[209.85.218.49 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[209.85.218.49 listed in dnsbl.ahbl.org]

[209.85.218.49 listed in dnsbl.ahbl.org]

[209.85.218.49 listed in dnsbl.ahbl.org]

[209.85.218.49 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[209.85.218.49 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[209.85.218.49 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[209.85.218.49 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[209.85.218.49 listed in dnsbl.ahbl.org]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[209.85.218.49 listed in list.dnswl.org]

-0.0 SPF_PASS SPF: sender matches SPF record

0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider

[roland.boudreaugenki(at)gmail.com]

-0.0 RCVD_IN_MSPIKE_H3 RBL: Good reputation (+3)

[209.85.218.49 listed in wl.mailspike.net]

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

-0.0 RCVD_IN_MSPIKE_WL Mailspike good senders

Subject: {SPAM?} Hello Dave Yadallee