NetKnow Corporate Blog

Nisa Custom Internet Solutions

Nisa Custom Internet Solutions

ranks >2000000 from >2000000 by Netcraft

MediaShaker

Media Shakers of Edmonton

ranks >2000000 from >2000000

Koi Media

Koi Media

rank >2000000 from >2000000

WebFire

Webfire.ca

ranks >2000000 from >2000000 and seems to be connected with Shaw.

Core Network Solutions Inc.

Core Network Solutions Inc.

ranks at >2000000 from >2000000 .

The Network Centre

The Network Centre

ranks >2000000 from >2000000 and are linked with Telus high Speed.

Open Concept Internet, Inc.

Open Concept Internet, Inc.

rank > 2000000 from > 2000000

Techalta

Interspots of Edmonton

acquired by Techalta ;

Yegtel

Yegtel rank > 2000000 .

Internet Crossroads

Internet Crossroads Ltd of North Edmonton

rank nothing from nothing by Netcraft and seems to merged with Tera-Byte/ecn.ab.ca .



If I remember anymore, I will add to this entry, before Netcraft changes our ranking. Please watch this space and please feel free to peruse

our services.

All data is from Netcraft Toolbar .

Looks as if there are major changes to the Netcraft algorithm after some years! Why did Avast clasify the extension as URL:Phishing?

This is not the Alexa Tool Bar!

NetKnow

Netknow now at 28879 from 25755 at Netcraft and pfs compliant



A significant decrease! We must do

1. security audits regularly
2. check on illegitimate traffic hitting the web server


and
3. keep design current!

How do we compare with other providers in

Edmonton, Alberta, Canada?

Telus and reviews

Next we have Telus.com

ranked by Netcraft at 3547 from 3558 .

Sometimes their Web Hosting is done by
title="Internet Names for Business">Internet Names for Business

is ranked by Netcraft at >2000000 from >2000000 .



Is Telus's ADSL network susceptible to Code Red Attacks and Attackers?

Reviews of Telus are available :

• NCIX FORUMS



• DSL Reports

Rogers

Rogers Business Solutions

which rank 6411 from 6417 and are hosted in Europe.

Government of Alberta

The Government of Alberta Website

ranks 14167 from 14429 by Netcraft and seems to hosted on Cloudfare.

Netknow again

We at Netknow are at 28879 from 18857 since the start of 2026.

City of Edmonton

The City of Edmonton ranks 33553 from 32969 by Netcraft and hosted by Google.

University of Alberta

The University of Alberta ranks 45546 from 44917 hosted by Amazon Techonologies.

Juno and NetZero

We have Juno Internet ranked on top

at 439123 from 421100 who are the owners of

US Based Netzero at Netcraft Rank 95943 from 93111 .

NAIT / Northern Alberta Institute of Technology

NAIT ranks 146004 from 141954 hosted by Microsoft .

Grant MacEwen University

MacEwan ranks 171094 from 148120 .

TekSavvy

TekSavvy ranks 175559 from 177997 and are hosted by Microsoft

Shaw Cable

Next,

members.shaw.ca

ranks >2000000 from >2000000 and retired and

Shaw Cable

is next at Netcraft rank >20000000 from >20000000 . Hosted now by Akamei .

Their Network Hosting Arm,

Big Pipe is at

Netcraft rank 316167 from 316293 and hosted by Akamai in Europe .



Reviews of Shaw are available :

• Rate It All



• Review Stream



• Review Stream Number 2





• DSL reports

Internet Centre / CCINet

Internet Centre

rank 340465 from 351270 . Their partner Rack Nine ranks > 2000000.

Xplornet

xplornet

ranks >2000000 from >2000000 and are listed with

Cirrus9 and are joining up with Shaw.

Their new domain xplore.ca ranks 484335 from 484288 .

According to an article in the Sherwood Park Independent, they are also getting an Alberta Government subsidy.

Distributel / 3Web / CIA

Cybersurf

is ranked 950589 from 946610 and seems to be hosted in USA by DigitalOcean.

Primus

Primus

ranks >2000000 from >2000000 and now points to BLACKIRON_DataCentres ranked >2000000 from >2000000.

Northern lights Fiber

Northern lights Fiber are ranked by Netcraft >2000000 and uses AWS.

OkayVPN

OkayVPN

are ranked by Netcraft >2000000 and uses Cloudfare.

Radiant Communications / goco.ca

Radiant Communications

are ranked by Netcraft >2000000 and part of goco.ca

which ranks >2000000 .

Tera Byte Edmonton and reviews

Next is Tera-Byte

at Netcraft Rank >2000000 with

Tera-Byte.ca

ranking >2000000 from >2000000 and their wireless arm Tera-Byte Wireless

sold to Xplornet.

One of Tera-Byte's acquisitions

Edmonton Community Networks

ranks at >2000000 from >2000000 and

Go Edmonton ranks >2000000 from >2000000.

Alberta political blogger Daveberta ranks >2000000 from >2000000; interesting!!!

Reviews of Tera-byte is available at

here

and another here

and check Google for more reviews; just search tera byte.

MCSnet

MCSNET ranks >2000000 from >2000000 and are hosted by Microsoft .

Nucleus Internet Services

After that we have

Nucleus Information Services which can be found at Netcraft Rank >2000000 from >2000000 .

4Web

4web ranks >2000000 from >2000000 .

Alentus / Wolfpaw

Alentus

rank by Netcraft >2000000 from >2000000 and I note they are hosted in the USA .

wolfpaw.net

which ranks at >2000000 from >2000000

Yellowpencil

Yellowpencil Ranks >2000000 from >2000000

WSI Corporation

Next is WSI - We Simply The Internet of Toronto

at Netcraft Position >2000000 from >2000000 and are being hosted on Amazon.

Uniserve / Interbaun

Next, Uniserve

ranks on Netcraft >2000000 from >2000000

One of their acquisitions

interbaun

ranks with Netcraft ?????? from ?????? due to merging of sites.

One customer just came over from this organization in Nov 2006.

Clearwave Broadband

Clearwave Broadband ranks

at >2000000 from >2000000

Platinum Communications

Platinum Communications Corp.

bought out by Xplornet .

Wild Rose Internet

Wild Rose Internet

ranks >2000000 from >2000000 and I wonder if this is another wireless branch of Tera-Byte and bought out by Xplornet

TIC Internet

TIC Internet

ranks >2000000 from >2000000 ( I do remember you).

=EF=BB=BF

 

, 255, 255);color:rgb(34, 34, 34);font-family:Arial, Helvetica, =

sans-serif;font-size:small;font-style:normal;font-variant-caps:normal;font-=

variant-ligatures:normal;font-weight:400;letter-spacing:normal;orphans:2;te=

xt-align:start;text-decoration-color:initial;text-decoration-style:initial;=

text-decoration-thickness:initial;text-indent:0px;text-transform:none;white=

-space:normal;widows:2;word-spacing:0px;" type=3D"cite">

t;" id=3D"m_-2910760642012011069m_467061415371348611m_4273285105508718137m_=

-599886662404354667editbody1">

7061415371348611m_4273285105508718137m_-599886662404354667v1editbody1">

m_467061415371348611m_4273285105508718137m_-599886662404354667v1v1editbody1=

">

-width:0px;font-family:Arial, Helvetica, sans-serif;font-feature-settings:&=

quot;liga" 0;font-size:small;line-height:normal;" cellspacing=3D"0" =

width=3D"553">

10, 139, 168);border-width:0px;margin:0px;padding:0in;vertical-align:top;" = colspan=3D"3"> style=3D"border-collapse:collapse;border-width:0px;font-family:-apple-syste= m, BlinkMacSystemFont, "Helvetica Neue", "Segoe UI", = Arial, sans-serif, "Apple Color Emoji", "Segoe UI = Emoji", "Segoe UI Symbol";font-feature-settings:"liga&q= uot; 0;font-size:13px;line-height:normal;" cellspacing=3D"0"> style=3D"height:5.25pt;"> style=3D"border-width:0px;height:5.25pt;margin:0px;padding:0in;">  > style=3D"border-width:0px;margin:0px;padding:0in;width:0.25in;" = width=3D"24">  style=3D"border-width:0px;margin:0px;padding:0in;"> style=3D"font-family:-apple-system, BlinkMacSystemFont, "Helvetica = Neue", "Segoe UI", Arial, sans-serif, "Apple Color = Emoji", "Segoe UI Emoji", "Segoe UI = Symbol";margin:0px;"> sans-serif;font-size:13.5pt;">
92, 208, 228);border-width:0px;margin:0px;padding:0in;width:1.5pt;" = width=3D"2">	n:0px;padding:0in;"> style=3D"border-collapse:collapse;border-width:0px;font-family:-apple-syste= m, BlinkMacSystemFont, "Helvetica Neue", "Segoe UI", = Arial, sans-serif, "Apple Color Emoji", "Segoe UI = Emoji", "Segoe UI Symbol";font-feature-settings:"liga&q= uot; 0;font-size:13px;line-height:normal;" cellspacing=3D"0"> style=3D"background-color:rgb(230, 236, 244);border-width:0px;margin:0px;pa= dding:0in;width:411.75pt;" width=3D"549"> class=3D"table" style=3D"width:411.75pt;"> style=3D"border-collapse:collapse;border-width:0px;font-family:-apple-syste= m, BlinkMacSystemFont, "Helvetica Neue", "Segoe UI", = Arial, sans-serif, "Apple Color Emoji", "Segoe UI = Emoji", "Segoe UI Symbol";font-feature-settings:"liga&q= uot; 0;line-height:normal;" cellspacing=3D"0" width=3D"549"> = = = = = = = = = = = = = = = width=3D"24">  p;"> = "Helvetica Neue", "Segoe UI", Arial, sans-serif, = "Apple Color Emoji", "Segoe UI Emoji", "Segoe UI = Symbol";margin:0px;"> 64);font-family:Helvetica, sans-serif;font-size:13.5pt;">Payment&nb= sp;    style=3D"color:rgb(231,123,7);font-family:Helvetica, sans-serif;font-size:7= .5pt;">Due: 13/07/2026 168);font-family:Helvetica, sans-serif;font-size:10.= 5pt;">033747 = ttom;"> = "Helvetica Neue", "Segoe UI", Arial, sans-serif, = "Apple Color Emoji", "Segoe UI Emoji", "Segoe UI = Symbol";margin:0px;text-align:right;"> 62);font-family:Helvetica, sans-serif;font-size:10.5pt;">Amount = Paid:   62);font-family:Helvetica, sans-serif;font-size:22.5pt;">$3,378.= 00 = width=3D"24">  =   =   =   =   Remittance phish from Google Gmail part 3 Posted by Dave Yadallee on Tuesday, July 14. 2026 system, BlinkMacSystemFont, "Helvetica Neue", "Segoe = UI", Arial, sans-serif, "Apple Color Emoji", "Segoe UI = Emoji", "Segoe UI Symbol";margin:0px;">  style=3D"width:411.75pt;"> style=3D"border-collapse:collapse;border-width:0px;font-family:-apple-syste= m, BlinkMacSystemFont, "Helvetica Neue", "Segoe UI", = Arial, sans-serif, "Apple Color Emoji", "Segoe UI = Emoji", "Segoe UI Symbol";font-feature-settings:"liga&q= uot; 0;font-size:13px;line-height:normal;" cellspacing=3D"0" = width=3D"549"> style=3D"border-width:0px;margin:0px;padding:0in;vertical-align:top;"> class=3D"table" style=3D"width:411.75pt;"> style=3D"border-bottom-style:solid;border-bottom-width:3pt;border-collapse:= collapse;border-color:initial;border-left-style:none;border-left-width:medi= um;border-right-style:none;border-right-width:medium;border-top-style:none;= border-top-width:medium;font-family:-apple-system, BlinkMacSystemFont, = "Helvetica Neue", "Segoe UI", Arial, sans-serif, = "Apple Color Emoji", "Segoe UI Emoji", "Segoe UI = Symbol";font-feature-settings:"liga" 0;line-height:normal;" = cellspacing=3D"0" width=3D"549"> = = = = = = = = "Helvetica Neue", "Segoe UI", Arial, sans-serif, = "Apple Color Emoji", "Segoe UI Emoji", "Segoe UI = Symbol";line-height:12pt;margin:0px;"> tica, sans-serif;font-size:10.5pt;">Hello  style=3D"font-family:Arial, Helvetica, sans-serif;font-size:small;">Dear = Customer, sans-serif;font-size:10.5pt;">, = "Helvetica Neue", "Segoe UI", Arial, sans-serif, = "Apple Color Emoji", "Segoe UI Emoji", "Segoe UI = Symbol";line-height:12pt;margin:0px;">  = "Helvetica Neue", "Segoe UI", Arial, sans-serif, = "Apple Color Emoji", "Segoe UI Emoji", "Segoe UI = Symbol";line-height:12pt;margin:0px;"> tica, sans-serif;font-size:10.5pt;">Payment has been remitted into your = account with receipt for your reference. = "Helvetica Neue", "Segoe UI", Arial, sans-serif, = "Apple Color Emoji", "Segoe UI Emoji", "Segoe UI = Symbol";line-height:12pt;margin:0px;">  = "Helvetica Neue", "Segoe UI", Arial, sans-serif, = "Apple Color Emoji", "Segoe UI Emoji", "Segoe UI = Symbol";line-height:12pt;margin:0px;"> (110, 139, 168);border-radius:4px;color:white;display:inline-block;font-fam= ily:Helvetica, sans-serif;font-size:10.5pt;padding:8px = 16px;text-decoration-line:none;" href=3D"https://distropical.com/th.= php">VIEW PAYMENT RECEIPT = "Helvetica Neue", "Segoe UI", Arial, sans-serif, = "Apple Color Emoji", "Segoe UI Emoji", "Segoe UI = Symbol";line-height:12pt;margin:0px;">  = "Helvetica Neue", "Segoe UI", Arial, sans-serif, = "Apple Color Emoji", "Segoe UI Emoji", "Segoe UI = Symbol";line-height:12pt;margin:0px;"> tica, sans-serif;font-size:10.5pt;">Thank you for your business.= Sincerely, Finance Department = = class=3D"table"> style=3D"border-collapse:collapse;border-width:0px;font-family:-apple-syste= m, BlinkMacSystemFont, "Helvetica Neue", "Segoe UI", = Arial, sans-serif, "Apple Color Emoji", "Segoe UI = Emoji", "Segoe UI Symbol";font-feature-settings:"liga&q= uot; 0;line-height:normal;" cellspacing=3D"0"> = = = = = = =	92, 208, 228);border-width:0px;margin:0px;padding:0in;width:1.5pt;" = width=3D"2">
1, 50, 70);border-width:0px;margin:0px;padding:0in;" colspan=3D"3"> system, BlinkMacSystemFont, "Helvetica Neue", "Segoe = UI", Arial, sans-serif, "Apple Color Emoji", "Segoe UI = Emoji", "Segoe UI Symbol";margin:0px;text-align:right;">&nbs= p;

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Mon, 13 Jul 2026 19:50:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wjSHB-00000000HQv-18OX

for dave@doctor.nl2k.ab.ca;

Mon, 13 Jul 2026 19:49:37 -0600

Resent-From: The Doctor

Resent-Date: Mon, 13 Jul 2026 19:49:37 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-vk1-f232.google.com ([209.85.221.232]:50193)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wjP0w-00000000Mda-3ySb

for doctor@nl2k.ab.ca;

Mon, 13 Jul 2026 16:20:47 -0600

Received: by mail-vk1-f232.google.com with SMTP id 71dfb90a1353d-5bfc5b77c02so2094058e0c.0

for ; Mon, 13 Jul 2026 15:19:51 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=sabeng.it; s=google; t=1783981185; x=1784585985; darn=nl2k.ab.ca;

h=content-type:mime-version:date:content-transfer-encoding:message-id

:subject:to:from:from:to:cc:subject:date:message-id:reply-to

:content-type;

bh=SQeYhuGtuot8NB4/jQiU1QF7G5cKOkSJgl7Tik7+V1Q=;

b=GD1vSWv62V1OLJ1tamoW1FLjvGz5aPa5Ny0wkiA/9cfZp2WxPi6lyZ0DjltYlBtLDj

o7E9WuksSG53AI664c2cKmzbWKWqisZhcmOmC0ZrRt91ODyTsP2SqJqagvElioKqEBqU

0k72e5H/YUgNajMXI8u4qgs9XfSMqR6fL/Qho=

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20251104; t=1783981185; x=1784585985;

h=content-type:mime-version:date:content-transfer-encoding:message-id

:subject:to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date

:message-id:reply-to:content-type;

bh=SQeYhuGtuot8NB4/jQiU1QF7G5cKOkSJgl7Tik7+V1Q=;

b=hu/TrbzSgVliYnZ2DgQEMWep0TctWbzk6GlRN5SvzrJayHbwc4Dewbrh1HU5fKEBBk

aSdOuFY9RRdpObFFlU+V/z8TmkSWOTZchjiRLEXmSQZiQ4Ba+J4++SsmQuFhhOlJlqOd

2l7y6s2sU+XE4vYHcpvwy1ulPyFAUuAXUR5sjfy47cC+fjYrw7Zovyw2BLiq1Xx9oYIx

u4hsfBcxEXAqlT//18GKRkeJOZ2Jwqi3dabLoRe69XwaZEajCS9bcQwaOZPhnxT/4gFG

Vr24hAackuhFmfhDaf5/tXSDy1HcNyFtu9FxMuUYQ56HYL2UMt09a31OvCgUzQ9VpHxo

L0Pg==

X-Gm-Message-State: AOJu0YyfiVp6QdcSyfg9vTuIwi5m2ANp++rye+yoJsenDXhNb1EM3hjr

DA+ftTvYxADI6Z0hsIrcdU97bpJlyVShpCyTI2STZpc+NlMxOfBQ578axpoCkSdEhTzSSOSDTPf

iHCNLMJopalOWbBssYjKuApPGw3o433YjenO5qNE2OpEc/ko=

X-Gm-Gg: AfdE7clnVjmpyIwaoKXeRKYeqEqil8YOVkeWfVYi5AjwYRrB9QXodj1MmDiKCP0XW2z

KV6T/leD+/hfhlMRWkHJF4YA0tT9EiOx5YyE3Kx/dy5zINMNUeRLUsiCsPJCA0tN/HCCUoZPjvg

owDtPih7dh+FB9l/SDSDjZYnu1iQF+5BYetAHiN6BQhZ36vXeJOeFXdwLIeq7BLDyNFoDsdLnLh

lSkffMbYQF+0gUNUTb8o7tQiATwytmu5KO/yhvyjO/uLIkDHsNFOFHgm4C7k8HBmaaAt6HA5TT9

euCUgnRhCLcfkEy6GpE5GMY3hlj+9Ft0/87e0cqWNpmo0fBH5JtyuGlpIvp4Zzp3ege4TGDRaQO

dRLcrEZkfjOCbZ/YqTFK/Hyo=

X-Received: by 2002:a05:6820:1985:b0:6a3:7b7e:ee57 with SMTP id 006d021491bc7-6a39a8c014cmr6673942eaf.71.1783980573348;

Mon, 13 Jul 2026 15:09:33 -0700 (PDT)

Received: from sabprogetti.com ([192.210.236.148])

by smtp-relay.gmail.com with ESMTPS id 006d021491bc7-6a38b0e91b2sm503126eaf.6.2026.07.13.15.09.33

for

(version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256);

Mon, 13 Jul 2026 15:09:33 -0700 (PDT)

X-Relaying-Domain: sabeng.it

From: "Payment Stacks|Schedule| Online Review/OU=EXCHANGE ADMINISTRATIVE

GROUP (FYDIBOHF23SPDLT)/CN=RECIPIENTS/CN=B7A707497B564FD-63561"



To: doctor@nl2k.ab.ca

Subject: =?UTF-8?Q?ACH_Payment_Activity_Report_=EF=BF=BD_Th?=

=?UTF-8?Q?u=2C_July_9=2C_2026_=EF=BF=BD_07/13/2026?=

=?UTF-8?Q?_=EF=BF=BD_doctor=40nl2k=2Eab=2Eca?=

Message-ID:

Content-Transfer-Encoding: quoted-printable

Date: Mon, 13 Jul 2026 22:09:32 +0000

MIME-Version: 1.0

Content-Type: text/html; charset=utf-8

X-Spam_score: 6.1

X-Spam_score_int: 61

X-Spam_bar: ++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview:  Payment Due: 13/07/2026 033747 Amount Paid: $3,378.00



Content analysis details: (6.1 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[192.210.236.148 listed in dnsbl.ahbl.org]

[192.210.236.148 listed in dnsbl.ahbl.org]

[192.210.236.148 listed in dnsbl.ahbl.org]

[192.210.236.148 listed in dnsbl.ahbl.org]

[209.85.221.232 listed in dnsbl.ahbl.org]

[209.85.221.232 listed in dnsbl.ahbl.org]

[209.85.221.232 listed in dnsbl.ahbl.org]

[209.85.221.232 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[192.210.236.148 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[192.210.236.148 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[192.210.236.148 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[192.210.236.148 listed in dnsbl.ahbl.org]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[209.85.221.232 listed in list.dnswl.org]

1.2 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a relay in bl.spamcop.net

[Blocked - see ]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[192.210.236.148 listed in will-spam-for-food.eu.org]

[192.210.236.148 listed in will-spam-for-food.eu.org]

[192.210.236.148 listed in will-spam-for-food.eu.org]

[192.210.236.148 listed in will-spam-for-food.eu.org]

[192.210.236.148 listed in will-spam-for-food.eu.org]

[192.210.236.148 listed in will-spam-for-food.eu.org]

[192.210.236.148 listed in will-spam-for-food.eu.org]

[192.210.236.148 listed in will-spam-for-food.eu.org]

[209.85.221.232 listed in will-spam-for-food.eu.org]

[209.85.221.232 listed in will-spam-for-food.eu.org]

[209.85.221.232 listed in will-spam-for-food.eu.org]

[209.85.221.232 listed in will-spam-for-food.eu.org]

[209.85.221.232 listed in will-spam-for-food.eu.org]

[209.85.221.232 listed in will-spam-for-food.eu.org]

[209.85.221.232 listed in will-spam-for-food.eu.org]

[209.85.221.232 listed in will-spam-for-food.eu.org]

-0.0 SPF_PASS SPF: sender matches SPF record

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[209.85.221.232 listed in wl.mailspike.net]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[209.85.221.232 listed in bl.score.senderscore.com]

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.6 HTML_MIME_NO_HTML_TAG HTML-only message, but there is no HTML tag

0.0 NO_RDNS2 Sending MTA has no reverse DNS

0.0 LOTS_OF_MONEY Huge... sums of money

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

2.0 RATWR8_MESSID Message-ID with excessive dashes and dollars

Subject: {SPAM?} =?UTF-8?Q?ACH_Payment_Activity_Report_=EF=BF=BD_Th?=

=?UTF-8?Q?u=2C_July_9=2C_2026_=EF=BF=BD_07/13/2026?=

=?UTF-8?Q?_=EF=BF=BD_doctor=40nl2k=2Eab=2Eca?=

=EF=BB=BF

 

, 255, 255);color:rgb(34, 34, 34);font-family:Arial, Helvetica, =

sans-serif;font-size:small;font-style:normal;font-variant-caps:normal;font-=

variant-ligatures:normal;font-weight:400;letter-spacing:normal;orphans:2;te=

xt-align:start;text-decoration-color:initial;text-decoration-style:initial;=

text-decoration-thickness:initial;text-indent:0px;text-transform:none;white=

-space:normal;widows:2;word-spacing:0px;" type=3D"cite">

t;" id=3D"m_-2910760642012011069m_467061415371348611m_4273285105508718137m_=

-599886662404354667editbody1">

7061415371348611m_4273285105508718137m_-599886662404354667v1editbody1">

m_467061415371348611m_4273285105508718137m_-599886662404354667v1v1editbody1=

">

-width:0px;font-family:Arial, Helvetica, sans-serif;font-feature-settings:&=

quot;liga" 0;font-size:small;line-height:normal;" cellspacing=3D"0" =

width=3D"553">

10, 139, 168);border-width:0px;margin:0px;padding:0in;vertical-align:top;" = colspan=3D"3"> style=3D"border-collapse:collapse;border-width:0px;font-family:-apple-syste= m, BlinkMacSystemFont, "Helvetica Neue", "Segoe UI", = Arial, sans-serif, "Apple Color Emoji", "Segoe UI = Emoji", "Segoe UI Symbol";font-feature-settings:"liga&q= uot; 0;font-size:13px;line-height:normal;" cellspacing=3D"0"> style=3D"height:5.25pt;"> style=3D"border-width:0px;height:5.25pt;margin:0px;padding:0in;">  > style=3D"border-width:0px;margin:0px;padding:0in;width:0.25in;" = width=3D"24">  style=3D"border-width:0px;margin:0px;padding:0in;"> style=3D"font-family:-apple-system, BlinkMacSystemFont, "Helvetica = Neue", "Segoe UI", Arial, sans-serif, "Apple Color = Emoji", "Segoe UI Emoji", "Segoe UI = Symbol";margin:0px;"> sans-serif;font-size:13.5pt;">
92, 208, 228);border-width:0px;margin:0px;padding:0in;width:1.5pt;" = width=3D"2">	n:0px;padding:0in;"> style=3D"border-collapse:collapse;border-width:0px;font-family:-apple-syste= m, BlinkMacSystemFont, "Helvetica Neue", "Segoe UI", = Arial, sans-serif, "Apple Color Emoji", "Segoe UI = Emoji", "Segoe UI Symbol";font-feature-settings:"liga&q= uot; 0;font-size:13px;line-height:normal;" cellspacing=3D"0"> style=3D"background-color:rgb(230, 236, 244);border-width:0px;margin:0px;pa= dding:0in;width:411.75pt;" width=3D"549"> class=3D"table" style=3D"width:411.75pt;"> style=3D"border-collapse:collapse;border-width:0px;font-family:-apple-syste= m, BlinkMacSystemFont, "Helvetica Neue", "Segoe UI", = Arial, sans-serif, "Apple Color Emoji", "Segoe UI = Emoji", "Segoe UI Symbol";font-feature-settings:"liga&q= uot; 0;line-height:normal;" cellspacing=3D"0" width=3D"549"> = = = = = = = = = = = = = = = width=3D"24">  p;"> = "Helvetica Neue", "Segoe UI", Arial, sans-serif, = "Apple Color Emoji", "Segoe UI Emoji", "Segoe UI = Symbol";margin:0px;"> 64);font-family:Helvetica, sans-serif;font-size:13.5pt;">Payment&nb= sp;    style=3D"color:rgb(231,123,7);font-family:Helvetica, sans-serif;font-size:7= .5pt;">Due: 13/07/2026 168);font-family:Helvetica, sans-serif;font-size:10.= 5pt;">033747 = ttom;"> = "Helvetica Neue", "Segoe UI", Arial, sans-serif, = "Apple Color Emoji", "Segoe UI Emoji", "Segoe UI = Symbol";margin:0px;text-align:right;"> 62);font-family:Helvetica, sans-serif;font-size:10.5pt;">Amount = Paid:   62);font-family:Helvetica, sans-serif;font-size:22.5pt;">$3,378.= 00 = width=3D"24">  =   =   =   =   Remittance phish from Google Gmail PArt 3 Posted by Dave Yadallee on Tuesday, July 14. 2026 system, BlinkMacSystemFont, "Helvetica Neue", "Segoe = UI", Arial, sans-serif, "Apple Color Emoji", "Segoe UI = Emoji", "Segoe UI Symbol";margin:0px;">  style=3D"width:411.75pt;"> style=3D"border-collapse:collapse;border-width:0px;font-family:-apple-syste= m, BlinkMacSystemFont, "Helvetica Neue", "Segoe UI", = Arial, sans-serif, "Apple Color Emoji", "Segoe UI = Emoji", "Segoe UI Symbol";font-feature-settings:"liga&q= uot; 0;font-size:13px;line-height:normal;" cellspacing=3D"0" = width=3D"549"> style=3D"border-width:0px;margin:0px;padding:0in;vertical-align:top;"> class=3D"table" style=3D"width:411.75pt;"> style=3D"border-bottom-style:solid;border-bottom-width:3pt;border-collapse:= collapse;border-color:initial;border-left-style:none;border-left-width:medi= um;border-right-style:none;border-right-width:medium;border-top-style:none;= border-top-width:medium;font-family:-apple-system, BlinkMacSystemFont, = "Helvetica Neue", "Segoe UI", Arial, sans-serif, = "Apple Color Emoji", "Segoe UI Emoji", "Segoe UI = Symbol";font-feature-settings:"liga" 0;line-height:normal;" = cellspacing=3D"0" width=3D"549"> = = = = = = = = "Helvetica Neue", "Segoe UI", Arial, sans-serif, = "Apple Color Emoji", "Segoe UI Emoji", "Segoe UI = Symbol";line-height:12pt;margin:0px;"> tica, sans-serif;font-size:10.5pt;">Hello  style=3D"font-family:Arial, Helvetica, sans-serif;font-size:small;">Dear = Customer, sans-serif;font-size:10.5pt;">, = "Helvetica Neue", "Segoe UI", Arial, sans-serif, = "Apple Color Emoji", "Segoe UI Emoji", "Segoe UI = Symbol";line-height:12pt;margin:0px;">  = "Helvetica Neue", "Segoe UI", Arial, sans-serif, = "Apple Color Emoji", "Segoe UI Emoji", "Segoe UI = Symbol";line-height:12pt;margin:0px;"> tica, sans-serif;font-size:10.5pt;">Payment has been remitted into your = account with receipt for your reference. = "Helvetica Neue", "Segoe UI", Arial, sans-serif, = "Apple Color Emoji", "Segoe UI Emoji", "Segoe UI = Symbol";line-height:12pt;margin:0px;">  = "Helvetica Neue", "Segoe UI", Arial, sans-serif, = "Apple Color Emoji", "Segoe UI Emoji", "Segoe UI = Symbol";line-height:12pt;margin:0px;"> (110, 139, 168);border-radius:4px;color:white;display:inline-block;font-fam= ily:Helvetica, sans-serif;font-size:10.5pt;padding:8px = 16px;text-decoration-line:none;" href=3D"https://distropical.com/th.= php">VIEW PAYMENT RECEIPT = "Helvetica Neue", "Segoe UI", Arial, sans-serif, = "Apple Color Emoji", "Segoe UI Emoji", "Segoe UI = Symbol";line-height:12pt;margin:0px;">  = "Helvetica Neue", "Segoe UI", Arial, sans-serif, = "Apple Color Emoji", "Segoe UI Emoji", "Segoe UI = Symbol";line-height:12pt;margin:0px;"> tica, sans-serif;font-size:10.5pt;">Thank you for your business.= Sincerely, Finance Department = = class=3D"table"> style=3D"border-collapse:collapse;border-width:0px;font-family:-apple-syste= m, BlinkMacSystemFont, "Helvetica Neue", "Segoe UI", = Arial, sans-serif, "Apple Color Emoji", "Segoe UI = Emoji", "Segoe UI Symbol";font-feature-settings:"liga&q= uot; 0;line-height:normal;" cellspacing=3D"0"> = = = = = = =	92, 208, 228);border-width:0px;margin:0px;padding:0in;width:1.5pt;" = width=3D"2">
1, 50, 70);border-width:0px;margin:0px;padding:0in;" colspan=3D"3"> system, BlinkMacSystemFont, "Helvetica Neue", "Segoe = UI", Arial, sans-serif, "Apple Color Emoji", "Segoe UI = Emoji", "Segoe UI Symbol";margin:0px;text-align:right;">&nbs= p;

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Mon, 13 Jul 2026 16:12:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wjOsR-00000000MKN-37Tx

for dave@doctor.nl2k.ab.ca;

Mon, 13 Jul 2026 16:11:51 -0600

Resent-From: The Doctor

Resent-Date: Mon, 13 Jul 2026 16:11:51 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-ot1-f103.google.com ([209.85.210.103]:46405)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wjOr5-00000000MDk-0ceV

for doctor@nl2k.ca;

Mon, 13 Jul 2026 16:10:38 -0600

Received: by mail-ot1-f103.google.com with SMTP id 46e09a7af769-7eb42a2f5feso1523314a34.1

for ; Mon, 13 Jul 2026 15:09:39 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=sabeng.it; s=google; t=1783980573; x=1784585373; darn=nl2k.ca;

h=content-type:mime-version:date:content-transfer-encoding:message-id

:subject:to:from:from:to:cc:subject:date:message-id:reply-to

:content-type;

bh=SQeYhuGtuot8NB4/jQiU1QF7G5cKOkSJgl7Tik7+V1Q=;

b=cF7KXx3h80nswn1DpIZa19b+RRKrC/3vN1R8ZZCTcPyKn0Xum5AZ5PqQqlrfL51alV

8gVMRuZHlBiWGPQvb8ER8xh1YRjTktjBhv0yL+n6WIZWUcmuy+5YVm2lDm2cqKJm2w99

mD4NVmjeAY4yKdBj79yeQ/Oo9sUTkZLXkAlzg=

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20251104; t=1783980573; x=1784585373;

h=content-type:mime-version:date:content-transfer-encoding:message-id

:subject:to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date

:message-id:reply-to:content-type;

bh=SQeYhuGtuot8NB4/jQiU1QF7G5cKOkSJgl7Tik7+V1Q=;

b=ELyvVhEDUhVIXMLpZ3fmXiIGIVuHeYkIisCu8hyyCtCKVsobZldmZ9cLTexJ3EAIN7

niKUt8D6b7WbWmpBt2/Di/2oJWL1VB1r4YgiT3/pkmxNpJc8jwqe9ML51xP6skMQ6rrh

wLfFFrha7mgfJjaR1pyQ97Z1FjYNCjn3FYzTKUJFHQPuiODuLNJOpS/xHxJsCbDqm860

1x139B3+YMpnVu1865tshhedKya3MK/5Sw8qSXx+cLetkhTTn3g84vHA0HbIdAdAJVyn

bq20PyOQKmjX95jsAG9KpGLSfoG71whJzd6zMAHHatunmgi2gmma/Nhcm1DbZA28XlN1

PLSg==

X-Gm-Message-State: AOJu0YyyeLlxLVvk847Ha/Z4jvM/8NXpMJV4kHipQ6fSvDOEQPJwxGlS

Fr5W44WSaQqkn/XZh/T8TcawIcDGWCm0kSNcpPcX+yxVYK/mTAnTWlL0VAH8+2rluF4a+V1HgSH

WIMhe9FmdfEyzSmn7xeyF+Tx6kFSeKbYVM+YR41Clz6cTVQk=

X-Gm-Gg: AfdE7cn5sAiFmpepCWA9H/2GHBbWlXcI/7x8BHU1vu3mnZ4NKw+LzcjlobzegWlWuNg

R+jxfB0ZfgwHrXgbpjoHS7JB3+fp1I0oMsFrbeSbkhZAU3xwg794ANTP68WXFApe/eswKRNOvtB

69aAtR3LZfiulaR4GQpngFi5vHg5s1MesDzNVKKO4m/fknm1opZ1CDBxpOeNcrzjUBm9wEkpp7T

BlxmaURJw115CAo5GMlFWmLXqQ2HwzCK5GWpaI961FKlBSV1w3gi2tNYCgQ1+3hPQZqTb+LELiW

jR5JW0zwtdQHMZd/0Wm/UkIELA3OVLZti6pGbPePRz/+IFetqB1oAocc03nMYKp1pk45CGz8aD2

O3mDmDQblG9QabLmD9w==

X-Received: by 2002:a4a:e902:0:b0:6a1:47ad:d18e with SMTP id 006d021491bc7-6a39a55a48bmr6670214eaf.2.1783980573503;

Mon, 13 Jul 2026 15:09:33 -0700 (PDT)

Received: from sabprogetti.com ([192.210.236.148])

by smtp-relay.gmail.com with ESMTPS id 006d021491bc7-6a387892d32sm542134eaf.25.2026.07.13.15.09.33

for

(version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256);

Mon, 13 Jul 2026 15:09:33 -0700 (PDT)

X-Relaying-Domain: sabeng.it

From: "Payroll@remittance.com|Schedule| Sign_Online/OU=EXCHANGE

ADMINISTRATIVE GROUP

(FYDIBOHF23SPDLT)/CN=RECIPIENTS/CN=B7A707497B564FD-47037"

To: doctor@nl2k.ca

Subject: =?UTF-8?Q?ACH_Funds_Transfer_Notification_?=

=?UTF-8?Q?=EF=BF=BD_July_9=2C_2026_=EF=BF=BD_07/13?=

=?UTF-8?Q?/2026_=EF=BF=BD_doctor=40nl2k=2Eca?=

Message-ID: <843e95be-4fa6-f266-397a-51df5eafa022@sabeng.it>

Content-Transfer-Encoding: quoted-printable

Date: Mon, 13 Jul 2026 22:09:32 +0000

MIME-Version: 1.0

Content-Type: text/html; charset=utf-8

X-Spam_score: 6.3

X-Spam_score_int: 63

X-Spam_bar: ++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview:  Payment Due: 13/07/2026 033747 Amount Paid: $3,378.00



Content analysis details: (6.3 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[192.210.236.148 listed in dnsbl.ahbl.org]

[192.210.236.148 listed in dnsbl.ahbl.org]

[192.210.236.148 listed in dnsbl.ahbl.org]

[192.210.236.148 listed in dnsbl.ahbl.org]

[209.85.210.103 listed in dnsbl.ahbl.org]

[209.85.210.103 listed in dnsbl.ahbl.org]

[209.85.210.103 listed in dnsbl.ahbl.org]

[209.85.210.103 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[192.210.236.148 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[192.210.236.148 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[192.210.236.148 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[192.210.236.148 listed in dnsbl.ahbl.org]

1.2 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a relay in bl.spamcop.net

[Blocked - see ]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[192.210.236.148 listed in will-spam-for-food.eu.org]

[192.210.236.148 listed in will-spam-for-food.eu.org]

[192.210.236.148 listed in will-spam-for-food.eu.org]

[192.210.236.148 listed in will-spam-for-food.eu.org]

[192.210.236.148 listed in will-spam-for-food.eu.org]

[192.210.236.148 listed in will-spam-for-food.eu.org]

[192.210.236.148 listed in will-spam-for-food.eu.org]

[192.210.236.148 listed in will-spam-for-food.eu.org]

[209.85.210.103 listed in will-spam-for-food.eu.org]

[209.85.210.103 listed in will-spam-for-food.eu.org]

[209.85.210.103 listed in will-spam-for-food.eu.org]

[209.85.210.103 listed in will-spam-for-food.eu.org]

[209.85.210.103 listed in will-spam-for-food.eu.org]

[209.85.210.103 listed in will-spam-for-food.eu.org]

[209.85.210.103 listed in will-spam-for-food.eu.org]

[209.85.210.103 listed in will-spam-for-food.eu.org]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[209.85.210.103 listed in list.dnswl.org]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-0.0 SPF_PASS SPF: sender matches SPF record

-0.0 RCVD_IN_MSPIKE_H3 RBL: Good reputation (+3)

[209.85.210.103 listed in wl.mailspike.net]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[209.85.210.103 listed in bl.score.senderscore.com]

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 LOTS_OF_MONEY Huge... sums of money

0.0 NO_RDNS2 Sending MTA has no reverse DNS

0.6 HTML_MIME_NO_HTML_TAG HTML-only message, but there is no HTML tag

-0.0 RCVD_IN_MSPIKE_WL Mailspike good senders

2.0 RATWR8_MESSID Message-ID with excessive dashes and dollars

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

Subject: {SPAM?} =?UTF-8?Q?ACH_Funds_Transfer_Notification_?=

=?UTF-8?Q?=EF=BF=BD_July_9=2C_2026_=EF=BF=BD_07/13?=

=?UTF-8?Q?/2026_=EF=BF=BD_doctor=40nl2k=2Eca?=

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Mon, 13 Jul 2026 16:12:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wjOsR-00000000MKN-37Tx

for dave@doctor.nl2k.ab.ca;

Mon, 13 Jul 2026 16:11:51 -0600

Resent-From: The Doctor

Resent-Date: Mon, 13 Jul 2026 16:11:51 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-ot1-f103.google.com ([209.85.210.103]:46405)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wjOr5-00000000MDk-0ceV

for doctor@nl2k.ca;

Mon, 13 Jul 2026 16:10:38 -0600

Received: by mail-ot1-f103.google.com with SMTP id 46e09a7af769-7eb42a2f5feso1523314a34.1

for ; Mon, 13 Jul 2026 15:09:39 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=sabeng.it; s=google; t=1783980573; x=1784585373; darn=nl2k.ca;

h=content-type:mime-version:date:content-transfer-encoding:message-id

:subject:to:from:from:to:cc:subject:date:message-id:reply-to

:content-type;

bh=SQeYhuGtuot8NB4/jQiU1QF7G5cKOkSJgl7Tik7+V1Q=;

b=cF7KXx3h80nswn1DpIZa19b+RRKrC/3vN1R8ZZCTcPyKn0Xum5AZ5PqQqlrfL51alV

8gVMRuZHlBiWGPQvb8ER8xh1YRjTktjBhv0yL+n6WIZWUcmuy+5YVm2lDm2cqKJm2w99

mD4NVmjeAY4yKdBj79yeQ/Oo9sUTkZLXkAlzg=

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20251104; t=1783980573; x=1784585373;

h=content-type:mime-version:date:content-transfer-encoding:message-id

:subject:to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date

:message-id:reply-to:content-type;

bh=SQeYhuGtuot8NB4/jQiU1QF7G5cKOkSJgl7Tik7+V1Q=;

b=ELyvVhEDUhVIXMLpZ3fmXiIGIVuHeYkIisCu8hyyCtCKVsobZldmZ9cLTexJ3EAIN7

niKUt8D6b7WbWmpBt2/Di/2oJWL1VB1r4YgiT3/pkmxNpJc8jwqe9ML51xP6skMQ6rrh

wLfFFrha7mgfJjaR1pyQ97Z1FjYNCjn3FYzTKUJFHQPuiODuLNJOpS/xHxJsCbDqm860

1x139B3+YMpnVu1865tshhedKya3MK/5Sw8qSXx+cLetkhTTn3g84vHA0HbIdAdAJVyn

bq20PyOQKmjX95jsAG9KpGLSfoG71whJzd6zMAHHatunmgi2gmma/Nhcm1DbZA28XlN1

PLSg==

X-Gm-Message-State: AOJu0YyyeLlxLVvk847Ha/Z4jvM/8NXpMJV4kHipQ6fSvDOEQPJwxGlS

Fr5W44WSaQqkn/XZh/T8TcawIcDGWCm0kSNcpPcX+yxVYK/mTAnTWlL0VAH8+2rluF4a+V1HgSH

WIMhe9FmdfEyzSmn7xeyF+Tx6kFSeKbYVM+YR41Clz6cTVQk=

X-Gm-Gg: AfdE7cn5sAiFmpepCWA9H/2GHBbWlXcI/7x8BHU1vu3mnZ4NKw+LzcjlobzegWlWuNg

R+jxfB0ZfgwHrXgbpjoHS7JB3+fp1I0oMsFrbeSbkhZAU3xwg794ANTP68WXFApe/eswKRNOvtB

69aAtR3LZfiulaR4GQpngFi5vHg5s1MesDzNVKKO4m/fknm1opZ1CDBxpOeNcrzjUBm9wEkpp7T

BlxmaURJw115CAo5GMlFWmLXqQ2HwzCK5GWpaI961FKlBSV1w3gi2tNYCgQ1+3hPQZqTb+LELiW

jR5JW0zwtdQHMZd/0Wm/UkIELA3OVLZti6pGbPePRz/+IFetqB1oAocc03nMYKp1pk45CGz8aD2

O3mDmDQblG9QabLmD9w==

X-Received: by 2002:a4a:e902:0:b0:6a1:47ad:d18e with SMTP id 006d021491bc7-6a39a55a48bmr6670214eaf.2.1783980573503;

Mon, 13 Jul 2026 15:09:33 -0700 (PDT)

Received: from sabprogetti.com ([192.210.236.148])

by smtp-relay.gmail.com with ESMTPS id 006d021491bc7-6a387892d32sm542134eaf.25.2026.07.13.15.09.33

for

(version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256);

Mon, 13 Jul 2026 15:09:33 -0700 (PDT)

X-Relaying-Domain: sabeng.it

From: "Payroll@remittance.com|Schedule| Sign_Online/OU=EXCHANGE

ADMINISTRATIVE GROUP

(FYDIBOHF23SPDLT)/CN=RECIPIENTS/CN=B7A707497B564FD-47037"

To: doctor@nl2k.ca

Subject: =?UTF-8?Q?ACH_Funds_Transfer_Notification_?=

=?UTF-8?Q?=EF=BF=BD_July_9=2C_2026_=EF=BF=BD_07/13?=

=?UTF-8?Q?/2026_=EF=BF=BD_doctor=40nl2k=2Eca?=

Message-ID: <843e95be-4fa6-f266-397a-51df5eafa022@sabeng.it>

Content-Transfer-Encoding: quoted-printable

Date: Mon, 13 Jul 2026 22:09:32 +0000

MIME-Version: 1.0

Content-Type: text/html; charset=utf-8

X-Spam_score: 6.3

X-Spam_score_int: 63

X-Spam_bar: ++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview:  Payment Due: 13/07/2026 033747 Amount Paid: $3,378.00



Content analysis details: (6.3 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[192.210.236.148 listed in dnsbl.ahbl.org]

[192.210.236.148 listed in dnsbl.ahbl.org]

[192.210.236.148 listed in dnsbl.ahbl.org]

[192.210.236.148 listed in dnsbl.ahbl.org]

[209.85.210.103 listed in dnsbl.ahbl.org]

[209.85.210.103 listed in dnsbl.ahbl.org]

[209.85.210.103 listed in dnsbl.ahbl.org]

[209.85.210.103 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[192.210.236.148 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[192.210.236.148 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[192.210.236.148 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[192.210.236.148 listed in dnsbl.ahbl.org]

1.2 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a relay in bl.spamcop.net

[Blocked - see ]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[192.210.236.148 listed in will-spam-for-food.eu.org]

[192.210.236.148 listed in will-spam-for-food.eu.org]

[192.210.236.148 listed in will-spam-for-food.eu.org]

[192.210.236.148 listed in will-spam-for-food.eu.org]

[192.210.236.148 listed in will-spam-for-food.eu.org]

[192.210.236.148 listed in will-spam-for-food.eu.org]

[192.210.236.148 listed in will-spam-for-food.eu.org]

[192.210.236.148 listed in will-spam-for-food.eu.org]

[209.85.210.103 listed in will-spam-for-food.eu.org]

[209.85.210.103 listed in will-spam-for-food.eu.org]

[209.85.210.103 listed in will-spam-for-food.eu.org]

[209.85.210.103 listed in will-spam-for-food.eu.org]

[209.85.210.103 listed in will-spam-for-food.eu.org]

[209.85.210.103 listed in will-spam-for-food.eu.org]

[209.85.210.103 listed in will-spam-for-food.eu.org]

[209.85.210.103 listed in will-spam-for-food.eu.org]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[209.85.210.103 listed in list.dnswl.org]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-0.0 SPF_PASS SPF: sender matches SPF record

-0.0 RCVD_IN_MSPIKE_H3 RBL: Good reputation (+3)

[209.85.210.103 listed in wl.mailspike.net]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[209.85.210.103 listed in bl.score.senderscore.com]

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 LOTS_OF_MONEY Huge... sums of money

0.0 NO_RDNS2 Sending MTA has no reverse DNS

0.6 HTML_MIME_NO_HTML_TAG HTML-only message, but there is no HTML tag

-0.0 RCVD_IN_MSPIKE_WL Mailspike good senders

2.0 RATWR8_MESSID Message-ID with excessive dashes and dollars

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

Subject: {SPAM?} =?UTF-8?Q?ACH_Funds_Transfer_Notification_?=

=?UTF-8?Q?=EF=BF=BD_July_9=2C_2026_=EF=BF=BD_07/13?=

=?UTF-8?Q?/2026_=EF=BF=BD_doctor=40nl2k=2Eca?=

=EF=BB=BF

 

, 255, 255);color:rgb(34, 34, 34);font-family:Arial, Helvetica, =

sans-serif;font-size:small;font-style:normal;font-variant-caps:normal;font-=

variant-ligatures:normal;font-weight:400;letter-spacing:normal;orphans:2;te=

xt-align:start;text-decoration-color:initial;text-decoration-style:initial;=

text-decoration-thickness:initial;text-indent:0px;text-transform:none;white=

-space:normal;widows:2;word-spacing:0px;" type=3D"cite">

t;" id=3D"m_-2910760642012011069m_467061415371348611m_4273285105508718137m_=

-599886662404354667editbody1">

7061415371348611m_4273285105508718137m_-599886662404354667v1editbody1">

m_467061415371348611m_4273285105508718137m_-599886662404354667v1v1editbody1=

">

-width:0px;font-family:Arial, Helvetica, sans-serif;font-feature-settings:&=

quot;liga" 0;font-size:small;line-height:normal;" cellspacing=3D"0" =

width=3D"553">

10, 139, 168);border-width:0px;margin:0px;padding:0in;vertical-align:top;" = colspan=3D"3"> style=3D"border-collapse:collapse;border-width:0px;font-family:-apple-syste= m, BlinkMacSystemFont, "Helvetica Neue", "Segoe UI", = Arial, sans-serif, "Apple Color Emoji", "Segoe UI = Emoji", "Segoe UI Symbol";font-feature-settings:"liga&q= uot; 0;font-size:13px;line-height:normal;" cellspacing=3D"0"> style=3D"height:5.25pt;"> style=3D"border-width:0px;height:5.25pt;margin:0px;padding:0in;">  > style=3D"border-width:0px;margin:0px;padding:0in;width:0.25in;" = width=3D"24">  style=3D"border-width:0px;margin:0px;padding:0in;"> style=3D"font-family:-apple-system, BlinkMacSystemFont, "Helvetica = Neue", "Segoe UI", Arial, sans-serif, "Apple Color = Emoji", "Segoe UI Emoji", "Segoe UI = Symbol";margin:0px;"> sans-serif;font-size:13.5pt;">
92, 208, 228);border-width:0px;margin:0px;padding:0in;width:1.5pt;" = width=3D"2">	n:0px;padding:0in;"> style=3D"border-collapse:collapse;border-width:0px;font-family:-apple-syste= m, BlinkMacSystemFont, "Helvetica Neue", "Segoe UI", = Arial, sans-serif, "Apple Color Emoji", "Segoe UI = Emoji", "Segoe UI Symbol";font-feature-settings:"liga&q= uot; 0;font-size:13px;line-height:normal;" cellspacing=3D"0"> style=3D"background-color:rgb(230, 236, 244);border-width:0px;margin:0px;pa= dding:0in;width:411.75pt;" width=3D"549"> class=3D"table" style=3D"width:411.75pt;"> style=3D"border-collapse:collapse;border-width:0px;font-family:-apple-syste= m, BlinkMacSystemFont, "Helvetica Neue", "Segoe UI", = Arial, sans-serif, "Apple Color Emoji", "Segoe UI = Emoji", "Segoe UI Symbol";font-feature-settings:"liga&q= uot; 0;line-height:normal;" cellspacing=3D"0" width=3D"549"> = = = = = = = = = = = = = = = width=3D"24">  p;"> = "Helvetica Neue", "Segoe UI", Arial, sans-serif, = "Apple Color Emoji", "Segoe UI Emoji", "Segoe UI = Symbol";margin:0px;"> 64);font-family:Helvetica, sans-serif;font-size:13.5pt;">Payment&nb= sp;    style=3D"color:rgb(231,123,7);font-family:Helvetica, sans-serif;font-size:7= .5pt;">Due: 13/07/2026 168);font-family:Helvetica, sans-serif;font-size:10.= 5pt;">033747 = ttom;"> = "Helvetica Neue", "Segoe UI", Arial, sans-serif, = "Apple Color Emoji", "Segoe UI Emoji", "Segoe UI = Symbol";margin:0px;text-align:right;"> 62);font-family:Helvetica, sans-serif;font-size:10.5pt;">Amount = Paid:   62);font-family:Helvetica, sans-serif;font-size:22.5pt;">$3,378.= 00 = width=3D"24">  =   =   =   =   Remittance phish from Google Gmail Part 3 Posted by Dave Yadallee on Tuesday, July 14. 2026 system, BlinkMacSystemFont, "Helvetica Neue", "Segoe = UI", Arial, sans-serif, "Apple Color Emoji", "Segoe UI = Emoji", "Segoe UI Symbol";margin:0px;">  style=3D"width:411.75pt;"> style=3D"border-collapse:collapse;border-width:0px;font-family:-apple-syste= m, BlinkMacSystemFont, "Helvetica Neue", "Segoe UI", = Arial, sans-serif, "Apple Color Emoji", "Segoe UI = Emoji", "Segoe UI Symbol";font-feature-settings:"liga&q= uot; 0;font-size:13px;line-height:normal;" cellspacing=3D"0" = width=3D"549"> style=3D"border-width:0px;margin:0px;padding:0in;vertical-align:top;"> class=3D"table" style=3D"width:411.75pt;"> style=3D"border-bottom-style:solid;border-bottom-width:3pt;border-collapse:= collapse;border-color:initial;border-left-style:none;border-left-width:medi= um;border-right-style:none;border-right-width:medium;border-top-style:none;= border-top-width:medium;font-family:-apple-system, BlinkMacSystemFont, = "Helvetica Neue", "Segoe UI", Arial, sans-serif, = "Apple Color Emoji", "Segoe UI Emoji", "Segoe UI = Symbol";font-feature-settings:"liga" 0;line-height:normal;" = cellspacing=3D"0" width=3D"549"> = = = = = = = = "Helvetica Neue", "Segoe UI", Arial, sans-serif, = "Apple Color Emoji", "Segoe UI Emoji", "Segoe UI = Symbol";line-height:12pt;margin:0px;"> tica, sans-serif;font-size:10.5pt;">Hello  style=3D"font-family:Arial, Helvetica, sans-serif;font-size:small;">Dear = Customer, sans-serif;font-size:10.5pt;">, = "Helvetica Neue", "Segoe UI", Arial, sans-serif, = "Apple Color Emoji", "Segoe UI Emoji", "Segoe UI = Symbol";line-height:12pt;margin:0px;">  = "Helvetica Neue", "Segoe UI", Arial, sans-serif, = "Apple Color Emoji", "Segoe UI Emoji", "Segoe UI = Symbol";line-height:12pt;margin:0px;"> tica, sans-serif;font-size:10.5pt;">Payment has been remitted into your = account with receipt for your reference. = "Helvetica Neue", "Segoe UI", Arial, sans-serif, = "Apple Color Emoji", "Segoe UI Emoji", "Segoe UI = Symbol";line-height:12pt;margin:0px;">  = "Helvetica Neue", "Segoe UI", Arial, sans-serif, = "Apple Color Emoji", "Segoe UI Emoji", "Segoe UI = Symbol";line-height:12pt;margin:0px;"> (110, 139, 168);border-radius:4px;color:white;display:inline-block;font-fam= ily:Helvetica, sans-serif;font-size:10.5pt;padding:8px = 16px;text-decoration-line:none;" href=3D"https://distropical.com/th.= php">VIEW PAYMENT RECEIPT = "Helvetica Neue", "Segoe UI", Arial, sans-serif, = "Apple Color Emoji", "Segoe UI Emoji", "Segoe UI = Symbol";line-height:12pt;margin:0px;">  = "Helvetica Neue", "Segoe UI", Arial, sans-serif, = "Apple Color Emoji", "Segoe UI Emoji", "Segoe UI = Symbol";line-height:12pt;margin:0px;"> tica, sans-serif;font-size:10.5pt;">Thank you for your business.= Sincerely, Finance Department = = class=3D"table"> style=3D"border-collapse:collapse;border-width:0px;font-family:-apple-syste= m, BlinkMacSystemFont, "Helvetica Neue", "Segoe UI", = Arial, sans-serif, "Apple Color Emoji", "Segoe UI = Emoji", "Segoe UI Symbol";font-feature-settings:"liga&q= uot; 0;line-height:normal;" cellspacing=3D"0"> = = = = = = =	92, 208, 228);border-width:0px;margin:0px;padding:0in;width:1.5pt;" = width=3D"2">
1, 50, 70);border-width:0px;margin:0px;padding:0in;" colspan=3D"3"> system, BlinkMacSystemFont, "Helvetica Neue", "Segoe = UI", Arial, sans-serif, "Apple Color Emoji", "Segoe UI = Emoji", "Segoe UI Symbol";margin:0px;text-align:right;">&nbs= p;

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Mon, 13 Jul 2026 16:12:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wjOsC-00000000MJW-1DSa

for dave@doctor.nl2k.ab.ca;

Mon, 13 Jul 2026 16:11:36 -0600

Resent-From: The Doctor

Resent-Date: Mon, 13 Jul 2026 16:11:36 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-oo1-f104.google.com ([209.85.161.104]:61490)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wjOr3-00000000MDe-3acn

for doctor@doctor.nl2k.ab.ca;

Mon, 13 Jul 2026 16:10:38 -0600

Received: by mail-oo1-f104.google.com with SMTP id 006d021491bc7-6a3776acb16so260886eaf.2

for ; Mon, 13 Jul 2026 15:09:39 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=sabeng.it; s=google; t=1783980573; x=1784585373; darn=doctor.nl2k.ab.ca;

h=content-type:mime-version:date:content-transfer-encoding:message-id

:subject:to:from:from:to:cc:subject:date:message-id:reply-to

:content-type;

bh=SQeYhuGtuot8NB4/jQiU1QF7G5cKOkSJgl7Tik7+V1Q=;

b=iQSJAU4FSEAPmfzsMfKanmkqLUk/nqUzL2w/oBJQ71qynPwglYoUCKyG26NAOg5ki1

BY5WbaWWlczsI57CmuW+CNgKOcho6cwxxrtGuoyIIyPg0y8cvzNpNlfIGUzPSbQwDypg

MK6xboL1RrilQVO7SCMZ2+GlQr4nHznwnhrak=

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20251104; t=1783980573; x=1784585373;

h=content-type:mime-version:date:content-transfer-encoding:message-id

:subject:to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date

:message-id:reply-to:content-type;

bh=SQeYhuGtuot8NB4/jQiU1QF7G5cKOkSJgl7Tik7+V1Q=;

b=rUdFU8Da1eblkmkno997+mKSREriJXL+I0lG45GkN0m0XAHrYktWjGQCgrFsI8KLJu

nFpb2VlrtGx1EVTrvI0j0Ejv6dVuYaPdZV52vI5FKCPndslihjm4C1j99Wy2sl6RW/7c

T22Hu6yvNZ7uG70DSbdcNjg/H7MgNXiLMEt0BGOIQT52ZNZm6wRbunHoOzeMn/biJ3se

JheYnUO4szJiRAv+mGt+QmQcQEi1/1hxN3B9yHr3t1/lCdl2k9ddxBUlGkooZkXsH2Y9

B/sTqhWsOTklgEAI4VGFrW0kuBw55VmIzog4rTw5Ulh+J1LL9aVdJvrRnAtVUIT1OhAX

+rHA==

X-Gm-Message-State: AOJu0Yy1wTv4Az5t1GMCMfxvyq4RaEmFIH746/Utk2xOoUeqNEdzhVe5

HWnNZDpS011EtNjDpTiUWzxQ787tnxxlPleCchBsIcTl2geyWhcPg1uvzMGJ+UaYhvElYhnEdsm

QxZ3SwBBkCy7c9HvDi3Ezke/ZpJ/hVCSC3ux6nPB0QZPZHQY=

X-Gm-Gg: AfdE7cn4cg+4A/2yNqoVdWRP9dzjvsx2KPr8rg+tLr8JTjlYUwb7JwSSf0AokSHdMXH

dK6VNf1AcwFG5+ZNghwL/a7QW3fQ4YKioDsVD8HYhIaCQ67eecSvRj1E8G1+Oq+uPrJbpLUHoY7

0gkBIhVMjpBz0KRTJ5eP1MBQWgB0039tT2h8rGoBxfLh1cI6Ljp6BaiP2RittdKX4ag33lrz+pD

PiR1jZHoqgD3Y8UaMVFW1ASRaiMSo1Qh8OQKDNKleGx6OPf2j3D3vfbl1XRfhNuxP3Vj6n+3HWh

1r9mYQ/L2FTAQSgsXAhUFlwT5Zq2t0KDSXk/5cZPLT8CxpJ2s/CKevdoDBQw3rbZ+NqDSAU78q5

0xTz9vFaObvvmfBYzif0rdXU=

X-Received: by 2002:a05:6820:1b05:b0:6a1:60cd:9854 with SMTP id 006d021491bc7-6a39a7222d1mr6460046eaf.53.1783980572857;

Mon, 13 Jul 2026 15:09:32 -0700 (PDT)

Received: from sabprogetti.com ([192.210.236.148])

by smtp-relay.gmail.com with ESMTPS id 006d021491bc7-6a387892d32sm542134eaf.25.2026.07.13.15.09.32

for

(version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256);

Mon, 13 Jul 2026 15:09:32 -0700 (PDT)

X-Relaying-Domain: sabeng.it

From: "alert@remittance.com | EFT Portal/OU=EXCHANGE ADMINISTRATIVE GROUP

(FYDIBOHF23SPDLT)/CN=RECIPIENTS/CN=B7A707497B564FD-10700"



To: doctor@doctor.nl2k.ab.ca

Subject: =?UTF-8?Q?ACH_Payment_Processed_=EF=BF=BD_Thu=2C_J?=

=?UTF-8?Q?uly_9=2C_2026_=EF=BF=BD_07/13/2026_?=

=?UTF-8?Q?=EF=BF=BD_doctor=40doctor=2Enl2k=2Eab=2E?= =?UTF-8?Q?ca?=

Message-ID: <97c00ed5-e038-3336-0a79-8bd3fbb0edc8@sabeng.it>

Content-Transfer-Encoding: quoted-printable

Date: Mon, 13 Jul 2026 22:09:31 +0000

MIME-Version: 1.0

Content-Type: text/html; charset=utf-8

X-Spam_score: 6.3

X-Spam_score_int: 63

X-Spam_bar: ++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview:  Payment Due: 13/07/2026 033747 Amount Paid: $3,378.00



Content analysis details: (6.3 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[192.210.236.148 listed in dnsbl.ahbl.org]

[192.210.236.148 listed in dnsbl.ahbl.org]

[192.210.236.148 listed in dnsbl.ahbl.org]

[192.210.236.148 listed in dnsbl.ahbl.org]

[209.85.161.104 listed in dnsbl.ahbl.org]

[209.85.161.104 listed in dnsbl.ahbl.org]

[209.85.161.104 listed in dnsbl.ahbl.org]

[209.85.161.104 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[192.210.236.148 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[192.210.236.148 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[192.210.236.148 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[192.210.236.148 listed in dnsbl.ahbl.org]

1.2 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a relay in bl.spamcop.net

[Blocked - see ]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[192.210.236.148 listed in will-spam-for-food.eu.org]

[192.210.236.148 listed in will-spam-for-food.eu.org]

[192.210.236.148 listed in will-spam-for-food.eu.org]

[192.210.236.148 listed in will-spam-for-food.eu.org]

[192.210.236.148 listed in will-spam-for-food.eu.org]

[192.210.236.148 listed in will-spam-for-food.eu.org]

[192.210.236.148 listed in will-spam-for-food.eu.org]

[192.210.236.148 listed in will-spam-for-food.eu.org]

[209.85.161.104 listed in will-spam-for-food.eu.org]

[209.85.161.104 listed in will-spam-for-food.eu.org]

[209.85.161.104 listed in will-spam-for-food.eu.org]

[209.85.161.104 listed in will-spam-for-food.eu.org]

[209.85.161.104 listed in will-spam-for-food.eu.org]

[209.85.161.104 listed in will-spam-for-food.eu.org]

[209.85.161.104 listed in will-spam-for-food.eu.org]

[209.85.161.104 listed in will-spam-for-food.eu.org]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[209.85.161.104 listed in list.dnswl.org]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-0.0 SPF_PASS SPF: sender matches SPF record

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[209.85.161.104 listed in bl.score.senderscore.com]

-0.0 RCVD_IN_MSPIKE_H3 RBL: Good reputation (+3)

[209.85.161.104 listed in wl.mailspike.net]

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

2.0 RATWR8_MESSID Message-ID with excessive dashes and dollars

-0.0 RCVD_IN_MSPIKE_WL Mailspike good senders

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

0.0 LOTS_OF_MONEY Huge... sums of money

0.0 NO_RDNS2 Sending MTA has no reverse DNS

0.6 HTML_MIME_NO_HTML_TAG HTML-only message, but there is no HTML tag

Subject: {SPAM?} =?UTF-8?Q?ACH_Payment_Processed_=EF=BF=BD_Thu=2C_J?=

=?UTF-8?Q?uly_9=2C_2026_=EF=BF=BD_07/13/2026_?=

=?UTF-8?Q?=EF=BF=BD_doctor=40doctor=2Enl2k=2Eab=2E?= =?UTF-8?Q?ca?=

system, BlinkMacSystemFont, "Helvetica Neue", "Segoe =

UI", Arial, sans-serif, "Apple Color Emoji", "Segoe UI =

Emoji", "Segoe UI Symbol";margin:0px;"> 

style=3D"width:411.75pt;">


style=3D"border-collapse:collapse;border-width:0px;font-family:-apple-syste=

m, BlinkMacSystemFont, "Helvetica Neue", "Segoe UI", =

Arial, sans-serif, "Apple Color Emoji", "Segoe UI =

Emoji", "Segoe UI Symbol";font-feature-settings:"liga&q=

uot; 0;font-size:13px;line-height:normal;" cellspacing=3D"0" =

width=3D"549">

style=3D"border-width:0px;margin:0px;padding:0in;vertical-align:top;"> class=3D"table" style=3D"width:411.75pt;"> style=3D"border-bottom-style:solid;border-bottom-width:3pt;border-collapse:= collapse;border-color:initial;border-left-style:none;border-left-width:medi= um;border-right-style:none;border-right-width:medium;border-top-style:none;= border-top-width:medium;font-family:-apple-system, BlinkMacSystemFont, = "Helvetica Neue", "Segoe UI", Arial, sans-serif, = "Apple Color Emoji", "Segoe UI Emoji", "Segoe UI = Symbol";font-feature-settings:"liga" 0;line-height:normal;" = cellspacing=3D"0" width=3D"549"> = = = = = = = = "Helvetica Neue", "Segoe UI", Arial, sans-serif, = "Apple Color Emoji", "Segoe UI Emoji", "Segoe UI = Symbol";line-height:12pt;margin:0px;"> tica, sans-serif;font-size:10.5pt;">Hello  style=3D"font-family:Arial, Helvetica, sans-serif;font-size:small;">Dear = Customer, sans-serif;font-size:10.5pt;">, = "Helvetica Neue", "Segoe UI", Arial, sans-serif, = "Apple Color Emoji", "Segoe UI Emoji", "Segoe UI = Symbol";line-height:12pt;margin:0px;">  = "Helvetica Neue", "Segoe UI", Arial, sans-serif, = "Apple Color Emoji", "Segoe UI Emoji", "Segoe UI = Symbol";line-height:12pt;margin:0px;"> tica, sans-serif;font-size:10.5pt;">Payment has been remitted into your = account with receipt for your reference. = "Helvetica Neue", "Segoe UI", Arial, sans-serif, = "Apple Color Emoji", "Segoe UI Emoji", "Segoe UI = Symbol";line-height:12pt;margin:0px;">  = "Helvetica Neue", "Segoe UI", Arial, sans-serif, = "Apple Color Emoji", "Segoe UI Emoji", "Segoe UI = Symbol";line-height:12pt;margin:0px;"> (110, 139, 168);border-radius:4px;color:white;display:inline-block;font-fam= ily:Helvetica, sans-serif;font-size:10.5pt;padding:8px = 16px;text-decoration-line:none;" href=3D"https://distropical.com/th.= php">VIEW PAYMENT RECEIPT = "Helvetica Neue", "Segoe UI", Arial, sans-serif, = "Apple Color Emoji", "Segoe UI Emoji", "Segoe UI = Symbol";line-height:12pt;margin:0px;">  = "Helvetica Neue", "Segoe UI", Arial, sans-serif, = "Apple Color Emoji", "Segoe UI Emoji", "Segoe UI = Symbol";line-height:12pt;margin:0px;"> tica, sans-serif;font-size:10.5pt;">Thank you for your business.= Sincerely, Finance Department = = class=3D"table"> style=3D"border-collapse:collapse;border-width:0px;font-family:-apple-syste= m, BlinkMacSystemFont, "Helvetica Neue", "Segoe UI", = Arial, sans-serif, "Apple Color Emoji", "Segoe UI = Emoji", "Segoe UI Symbol";font-feature-settings:"liga&q= uot; 0;line-height:normal;" cellspacing=3D"0"> = = = = = = =

92, 208, 228);border-width:0px;margin:0px;padding:0in;width:1.5pt;" =

width=3D"2"> 






1, 50, 70);border-width:0px;margin:0px;padding:0in;" colspan=3D"3">

system, BlinkMacSystemFont, "Helvetica Neue", "Segoe =

UI", Arial, sans-serif, "Apple Color Emoji", "Segoe UI =

Emoji", "Segoe UI Symbol";margin:0px;text-align:right;">&nbs=

p;

=EF=BB=BF

 

, 255, 255);color:rgb(34, 34, 34);font-family:Arial, Helvetica, =

sans-serif;font-size:small;font-style:normal;font-variant-caps:normal;font-=

variant-ligatures:normal;font-weight:400;letter-spacing:normal;orphans:2;te=

xt-align:start;text-decoration-color:initial;text-decoration-style:initial;=

text-decoration-thickness:initial;text-indent:0px;text-transform:none;white=

-space:normal;widows:2;word-spacing:0px;" type=3D"cite">

t;" id=3D"m_-2910760642012011069m_467061415371348611m_4273285105508718137m_=

-599886662404354667editbody1">

7061415371348611m_4273285105508718137m_-599886662404354667v1editbody1">

m_467061415371348611m_4273285105508718137m_-599886662404354667v1v1editbody1=

">

-width:0px;font-family:Arial, Helvetica, sans-serif;font-feature-settings:&=

quot;liga" 0;font-size:small;line-height:normal;" cellspacing=3D"0" =

width=3D"553">

10, 139, 168);border-width:0px;margin:0px;padding:0in;vertical-align:top;" = colspan=3D"3"> style=3D"border-collapse:collapse;border-width:0px;font-family:-apple-syste= m, BlinkMacSystemFont, "Helvetica Neue", "Segoe UI", = Arial, sans-serif, "Apple Color Emoji", "Segoe UI = Emoji", "Segoe UI Symbol";font-feature-settings:"liga&q= uot; 0;font-size:13px;line-height:normal;" cellspacing=3D"0"> style=3D"height:5.25pt;"> style=3D"border-width:0px;height:5.25pt;margin:0px;padding:0in;">  > style=3D"border-width:0px;margin:0px;padding:0in;width:0.25in;" = width=3D"24">  style=3D"border-width:0px;margin:0px;padding:0in;"> style=3D"font-family:-apple-system, BlinkMacSystemFont, "Helvetica = Neue", "Segoe UI", Arial, sans-serif, "Apple Color = Emoji", "Segoe UI Emoji", "Segoe UI = Symbol";margin:0px;"> sans-serif;font-size:13.5pt;">

92, 208, 228);border-width:0px;margin:0px;padding:0in;width:1.5pt;" = width=3D"2">

n:0px;padding:0in;"> style=3D"border-collapse:collapse;border-width:0px;font-family:-apple-syste= m, BlinkMacSystemFont, "Helvetica Neue", "Segoe UI", = Arial, sans-serif, "Apple Color Emoji", "Segoe UI = Emoji", "Segoe UI Symbol";font-feature-settings:"liga&q= uot; 0;font-size:13px;line-height:normal;" cellspacing=3D"0"> style=3D"background-color:rgb(230, 236, 244);border-width:0px;margin:0px;pa= dding:0in;width:411.75pt;" width=3D"549"> class=3D"table" style=3D"width:411.75pt;"> style=3D"border-collapse:collapse;border-width:0px;font-family:-apple-syste= m, BlinkMacSystemFont, "Helvetica Neue", "Segoe UI", = Arial, sans-serif, "Apple Color Emoji", "Segoe UI = Emoji", "Segoe UI Symbol";font-feature-settings:"liga&q= uot; 0;line-height:normal;" cellspacing=3D"0" width=3D"549"> = = = = = = = = = = = = = = = width=3D"24">  p;"> = "Helvetica Neue", "Segoe UI", Arial, sans-serif, = "Apple Color Emoji", "Segoe UI Emoji", "Segoe UI = Symbol";margin:0px;"> 64);font-family:Helvetica, sans-serif;font-size:13.5pt;">Payment&nb= sp;    style=3D"color:rgb(231,123,7);font-family:Helvetica, sans-serif;font-size:7= .5pt;">Due: 13/07/2026 168);font-family:Helvetica, sans-serif;font-size:10.= 5pt;">033747 = ttom;"> = "Helvetica Neue", "Segoe UI", Arial, sans-serif, = "Apple Color Emoji", "Segoe UI Emoji", "Segoe UI = Symbol";margin:0px;text-align:right;"> 62);font-family:Helvetica, sans-serif;font-size:10.5pt;">Amount = Paid:   62);font-family:Helvetica, sans-serif;font-size:22.5pt;">$3,378.= 00 = width=3D"24">  =   =   =   =   Remittance phish from Google Gmail Part 1 Posted by Dave Yadallee on Tuesday, July 14. 2026 X-Mozilla-Status: 0001 X-Mozilla-Status2: 00000000 Return-path: Envelope-to: dave@doctor.nl2k.ab.ca Delivery-date: Mon, 13 Jul 2026 16:12:00 -0600 Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD)) (envelope-from ) id 1wjOsF-00000000MJm-2ANX for dave@doctor.nl2k.ab.ca; Mon, 13 Jul 2026 16:11:39 -0600 Resent-From: The Doctor Resent-Date: Mon, 13 Jul 2026 16:11:39 -0600 Resent-Message-ID: Resent-To: Dave Yadallee Received: from mail-pl1-f229.google.com ([209.85.214.229]:48445) by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256 (Exim 4.99.3 (FreeBSD)) (envelope-from ) id 1wjOr3-00000000MDi-3cXD for doctor@mail.nl2k.ab.ca; Mon, 13 Jul 2026 16:10:38 -0600 Received: by mail-pl1-f229.google.com with SMTP id d9443c01a7336-2cce6a0c9c3so32621705ad.1 for ; Mon, 13 Jul 2026 15:09:39 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=sabeng.it; s=google; t=1783980573; x=1784585373; darn=mail.nl2k.ab.ca; h=content-type:mime-version:date:content-transfer-encoding:message-id :subject:to:from:from:to:cc:subject:date:message-id:reply-to :content-type; bh=SQeYhuGtuot8NB4/jQiU1QF7G5cKOkSJgl7Tik7+V1Q=; b=OL8gavcHjVsRN7kI1lyeorh5HuPES7VWkVvSgXww7PggHEdhDLj5sXmvlteGu/Q/Ou 1Qf4RdaoLYfUdcU6aipmTiGotGUn2uYvxONtTAQeDRXycRXjUh8lID1Fpnwpc2l3g6Ec qMDXSCfTtUiLFyQahlADjuvs5WSU170OQ6IuA= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1783980573; x=1784585373; h=content-type:mime-version:date:content-transfer-encoding:message-id :subject:to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=SQeYhuGtuot8NB4/jQiU1QF7G5cKOkSJgl7Tik7+V1Q=; b=mkP9ada4GhnRNu8xsakmZOTcRG8CQfZz6Vs90gwh/CUOhfRJwqX7Mj5lpi1XqvLf4i GWjUGEWDVs3CNvqn7A6CHklX40BI+Ib4UNGu/u9eglfmYenWunHTc3f1bIBRuluIyECd QYCPFxddldjKBQ7ejusdlreUiN2lcJwQSLhIBDU+VrQpgOf+zKaMyJdMEz/CqzFmTSsA zHpuVHq0rsb+RAz/Jb3yzmZC1Z9Rs8xnDMaGyk/q5QzNNmK/DMoPRs4krtIEcO73cQQ4 g9TQCIMGc/Xz6DwgvDzicMjv7FfJaiskp3SF71P78iX4VbvAR6St41Lgm+WPSM7s/lmd pIQQ== X-Gm-Message-State: AOJu0Ywep0EoNluz2JUq/E5Xhg42K53WP1vlh/gSQpoBPuAgChVd4Fqe VbXUDp+Ohef0/iOz5/C8UsBOQ9ETgKAoqe+HbHwbBidm29dJUmgVyunUTKUAVMoHFZ9jYZt98TK 7R4POG84zFhwEn82MrLZHhmJsZOpU1YjO0lBVvlWCdcswtxw= X-Gm-Gg: AfdE7cmGq9YX6jhOe93ZDoceGI50QkQhE7R3wk2vuKV7rLKOKDXvorVTDV3nfHm7AGE hUbVHsP2byYL+y9nCkYMDSBXwwB9yAr+o+sSy/JCSenFpGPfFiFXp0OXaCxo/Hpqu/uQ6MvRc7I Fd75nMdO60ja/Mt5131YFaIhZDbl4+1BImoMcHZHwBOkZzdT8MtSsolp2nqE5QsigTuFUst8yqb s5sa4u4Pk3vEVHnCfqFwsvR0Mw62PcrBeL3oMSMGSI7p5g2xVNuQ8UmprLPFuTg6W4wDtsyjS8j 3nABpn1z+03Ao67u8NMc10PfOyGvd0t+YuAlmujtmjzRlWXRXvii0AEr1EtShJkExeZiB5ugAP8 l7NBASR6gkHzO2LMVGCCeKA== X-Received: by 2002:a17:902:d2ca:b0:2c9:97a8:8c1b with SMTP id d9443c01a7336-2ce9f2948camr100384155ad.46.1783980573226; Mon, 13 Jul 2026 15:09:33 -0700 (PDT) Received: from sabprogetti.com ([192.210.236.148]) by smtp-relay.gmail.com with ESMTPS id d9443c01a7336-2ccc9ccd086sm21273355ad.35.2026.07.13.15.09.32 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 13 Jul 2026 15:09:33 -0700 (PDT) X-Relaying-Domain: sabeng.it From: "alert@remittance.com | EFT Portal/OU=EXCHANGE ADMINISTRATIVE GROUP (FYDIBOHF23SPDLT)/CN=RECIPIENTS/CN=B7A707497B564FD-78448" To: doctor@mail.nl2k.ab.ca Subject: =?UTF-8?Q?ACH_Payment_Status_Update_=EF=BF=BD_July?= =?UTF-8?Q?_9=2C_2026_=EF=BF=BD_07/13/2026_?= =?UTF-8?Q?=EF=BF=BD_doctor=40mail=2Enl2k=2Eab=2Eca?= Message-ID: <7a9d77a6-dcc5-5e6b-29c9-a3104bfc1d24@sabeng.it> Content-Transfer-Encoding: quoted-printable Date: Mon, 13 Jul 2026 22:09:31 +0000 MIME-Version: 1.0 Content-Type: text/html; charset=utf-8 X-Spam_score: 6.3 X-Spam_score_int: 63 X-Spam_bar: ++++++ X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca", has identified this incoming email as possible spam. The original message has been attached to this so you can view it or label similar future email. If you have any questions, see @@CONTACT_ADDRESS@@ for details. Content preview:  Payment Due: 13/07/2026 033747 Amount Paid: $3,378.00 Content analysis details: (6.3 points, 5.0 required) pts rule name description ---- ---------------------- -------------------------------------------------- 1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org [192.210.236.148 listed in dnsbl.ahbl.org] [192.210.236.148 listed in dnsbl.ahbl.org] [192.210.236.148 listed in dnsbl.ahbl.org] [192.210.236.148 listed in dnsbl.ahbl.org] [209.85.214.229 listed in dnsbl.ahbl.org] [209.85.214.229 listed in dnsbl.ahbl.org] [209.85.214.229 listed in dnsbl.ahbl.org] [209.85.214.229 listed in dnsbl.ahbl.org] 1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org [192.210.236.148 listed in dnsbl.ahbl.org] 0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org [192.210.236.148 listed in dnsbl.ahbl.org] 0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org [192.210.236.148 listed in dnsbl.ahbl.org] 0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org [192.210.236.148 listed in dnsbl.ahbl.org] 1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org [192.210.236.148 listed in will-spam-for-food.eu.org] [192.210.236.148 listed in will-spam-for-food.eu.org] [192.210.236.148 listed in will-spam-for-food.eu.org] [192.210.236.148 listed in will-spam-for-food.eu.org] [192.210.236.148 listed in will-spam-for-food.eu.org] [192.210.236.148 listed in will-spam-for-food.eu.org] [192.210.236.148 listed in will-spam-for-food.eu.org] [192.210.236.148 listed in will-spam-for-food.eu.org] [209.85.214.229 listed in will-spam-for-food.eu.org] [209.85.214.229 listed in will-spam-for-food.eu.org] [209.85.214.229 listed in will-spam-for-food.eu.org] [209.85.214.229 listed in will-spam-for-food.eu.org] [209.85.214.229 listed in will-spam-for-food.eu.org] [209.85.214.229 listed in will-spam-for-food.eu.org] [209.85.214.229 listed in will-spam-for-food.eu.org] [209.85.214.229 listed in will-spam-for-food.eu.org] -0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no trust [209.85.214.229 listed in list.dnswl.org] 1.2 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a relay in bl.spamcop.net [Blocked - see ] -2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact safe-sa@returnpath.net [Excessive Number of Queries | ] -3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact cert-sa@returnpath.net [Excessive Number of Queries | ] -0.0 SPF_PASS SPF: sender matches SPF record 1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL, https://senderscore.org/blacklistlookup/ [209.85.214.229 listed in bl.score.senderscore.com] 1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts 0.0 HTML_MESSAGE BODY: HTML included in message 0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge 2.0 RATWR8_MESSID Message-ID with excessive dashes and dollars 0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid 0.0 LOTS_OF_MONEY Huge... sums of money 0.0 NO_RDNS2 Sending MTA has no reverse DNS 0.6 HTML_MIME_NO_HTML_TAG HTML-only message, but there is no HTML tag -0.0 RCVD_IN_MSPIKE_H3 RBL: Good reputation (+3) [209.85.214.229 listed in wl.mailspike.net] -0.0 RCVD_IN_MSPIKE_WL Mailspike good senders Subject: {SPAM?} =?UTF-8?Q?ACH_Payment_Status_Update_=EF=BF=BD_July?= =?UTF-8?Q?_9=2C_2026_=EF=BF=BD_07/13/2026_?= =?UTF-8?Q?=EF=BF=BD_doctor=40mail=2Enl2k=2Eab=2Eca?=