Domain Name Spam from Google Mail Part 1

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Wed, 22 Apr 2026 09:50:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1wFZpZ-00000000EAg-3bUz

for dave@doctor.nl2k.ab.ca;

Wed, 22 Apr 2026 09:49:37 -0600

Resent-From: The Doctor

Resent-Date: Wed, 22 Apr 2026 09:49:37 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-yw1-f169.google.com ([209.85.128.169]:43462)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1wFYue-000000008ej-0rVe

for sales@nk.ca;

Wed, 22 Apr 2026 08:50:57 -0600

Received: by mail-yw1-f169.google.com with SMTP id 00721157ae682-79db5e18ac6so67625497b3.1

for ; Wed, 22 Apr 2026 07:50:00 -0700 (PDT)

ARC-Seal: i=1; a=rsa-sha256; t=1776869393; cv=none;

d=google.com; s=arc-20240605;

b=YoUdU330u8w1BuyfJqYVdoEM1ZgPGk5EJhZoLy1y4NJstcC9vQzXKEn7FCq5YnmiSX

lSTwXmYaAEs2FhyxnKAGedmkUaTS44pTSMWhGy7U/zt7X7UiUAUgmsxt5rE4TkhU22B8

Aaz7U5P2f83hsaYFOl9e7+VI0S6Dkw5/Js/y4y1FXMaEqQLgk5AJAUIQwv/GMiNM/CZW

vqBL7PVfZkTDbiOGa4nAW46iLwsEACu5GUSOOPk1uamxfyQ5GPOiHu0owqG7+IGaKk1p

MuF8kOh/YedtDXeezZ71UjjAjNOu7n2yf+a2fzX94jBCyuI0p9SFHhae3xC4yNzw19FJ

3oKg==

ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20240605;

h=to:subject:message-id:date:from:in-reply-to:references:mime-version

:dkim-signature;

bh=bPAaLiYbvRpEVGFCu/wTZlqwSC7G4/OUkGOJOCQxhLg=;

fh=C4vsnDG7cTH8aa/8f7sygxKSfblX4MPDg6mph8A3jUw=;

b=DRY8+akh52Ngatee0ErPrTs9oKrjMeL50n6PqcIJJpXEfaJIzj7HFd6TXX+vmgmO92

+hmDFoRu04RT64tsCdI7g38IGHb74JspR3h1eDFJE38CLnxnOiYU/tbUDSFvl2I9kJsH

UbByl6Z0V4UlVhwCPWO+0ypRPg5GJYJcPt1A9wg77DDKmcnEwd/jYNS8HYi7e+9cYkor

6KNJG9zeyXRsOZ/FNO7+0UDcCbnw2h1dHKJ9SHgAxWaSh+K4pQ+yeyh5qKY6dNyEP/VD

iB7sxy11YMvTxad5+IxMCvdAJTY4fyIYdRElnU4R+9E8iuVm+flsb3TgqJdxaFVGq6sd

a/UQ==;

darn=nk.ca

ARC-Authentication-Results: i=1; mx.google.com; arc=none

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=gmail.com; s=20251104; t=1776869393; x=1777474193; darn=nk.ca;

h=to:subject:message-id:date:from:in-reply-to:references:mime-version

:from:to:cc:subject:date:message-id:reply-to;

bh=bPAaLiYbvRpEVGFCu/wTZlqwSC7G4/OUkGOJOCQxhLg=;

b=FEkDHZD5dn7cI8Lx42iJ+VDc6nNRAA/RK+Bqu1uiBd+l9YDjvcUoHxE2yQgTodcjrV

b6Tz1sDhGczQ+m177aPX7kH9a05egNi5Xjy6ToOJiD5cOdr6bx1+odJpuqil2wwSMgMn

KbomxgXvfC25FFGGNfuWe2mxnabaWdsVGeDx7rPc/UQ3UgC5VmAgK8h14gdkr+g1hATu

/MVj+nXKyohxve5vqSFcdIEE1Ded06F9bT9FDDsM8lXfn9SfMpBUnD6pPqwgdvieNSig

G1KxUA56ztW5eJ3g4ffXhHtyq/Y0Ixed6Gb+XYLX2jWTSSXItTzJS3oeV8nruQhyfOPc

KFuA==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20251104; t=1776869393; x=1777474193;

h=to:subject:message-id:date:from:in-reply-to:references:mime-version

:x-gm-gg:x-gm-message-state:from:to:cc:subject:date:message-id

:reply-to;

bh=bPAaLiYbvRpEVGFCu/wTZlqwSC7G4/OUkGOJOCQxhLg=;

b=a9xiEzw8jw9mSwssIsSQqy/oK/5ncdq3trHEdYX+Jz1pshj0V+Zaaarg6tmq2BugHg

idmIWRvLd40EOBDoG9jUa8KfS4GXqnJTVa6t5WMazs2ead90JBGn9+XZ0rjNA6wNFV8P

ekszzYCNnrjHBMSCDXxgmiEvYh13cNbns1Wv/SlzhTkNszMTV+aref5/Zk3WKqh4XA0L

xQ97h+Pnm5wUAZU980OV9tf2XropLTs/8e7eupcv/b1kK2Oc5liJVvKsRBhcIeN7BEST

rwMraQ3/W61AC8aduPKu1b/tkn7yyYq3RG212pRrGl6XBwtilaQEuM1AoVuPC9zzp0fq

lQgQ==

X-Gm-Message-State: AOJu0YxerZ+FuvUlAJhFvVk0PPMW8DMdGC2zsbgYN1Qx3CcJEgGypH5p

MCtDkta2Ca/su9i8cV0s7sm8lt181tbTkm0wC76Qv+DzD7+uui9GVZWx+wIGQ4LL5/uEWnUMyl0

bZdheG3CL9B4yuNxceyrXGqnIx4XpO3LnqOCi

X-Gm-Gg: AeBDiet+8isO5L3tKuAUfPtpokQszp8OMMzMeVuGiwScx+EcCuv6zvRMUbaXIoOXstu

xbA0ck8ntwjxLVcuEYhN+9iUJNKFI1h/g51bVBqb/Y0jUftvGB03GW8Vv24p97GYKFiwGF8+lW2

8DUAe2bg1Txt5fY+WzvIpQg0gJJXVHl/sfhVTks4HmrTgifMeRM420UYtIUXhWAUPNHX6K7CE4B

+Bh8R0AfTuAX3UIIlBKKKWzOINtFOsPFStc5zpnqz7dpBcGrOhOcG+0FalrEkvKdU2FxWgiBYhP

IIyo4t052hM7Ut0gjXzDPFk=

X-Received: by 2002:a05:690c:c50e:b0:7b4:1394:4104 with SMTP id

00721157ae682-7b9ed2c71f9mr175103547b3.9.1776869393302; Wed, 22 Apr 2026

07:49:53 -0700 (PDT)

MIME-Version: 1.0

References:



In-Reply-To:

From: Nichoas Louis

Date: Wed, 22 Apr 2026 15:49:40 +0100

X-Gm-Features: AQROBzA0369IotKTAfcM8MsrZDY2P66gNYQhP9ypChbSxAJgOXMugzZ8st1jvts

Message-ID:

Subject: Re: VOIP IN EDMONTON

To: sales@nk.ca

Content-Type: multipart/alternative; boundary="0000000000000008b406500da51c"



--0000000000000008b406500da51c

Content-Type: text/plain; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable



Hello,





We sent you an email recently and never heard back. We=E2=80=99ve scheduled=

a

24-hour discount for the domain name, and we would like to know if there is

any interest here.





The domain can be developed or redirected to your current website to

increase visibility with its keywords in EDMONTON and its environs.





We have also reduced the price of the domain to $550 only.





To get it now, go to

www.VoipEdmonton.com

Do let me know if you have any questions!





We await your response.





Stay Safe.



On Tue, 14 Apr 2026, 5:18=E2=80=AFpm Nichoas Louis,
.com>

wrote:



> Good morning,

>

>

> What do you think about the website domaihn name

> www.VoipEdmonton.com?

>

>

> Do you have any interest?

>

>

> Will you be considering this offer?

>

>

> You can also let me know your best offer, and we=E2=80=99ll work together=

to find

> a mutually agreeable price. If no interest please let me know so I don=E2=

=80=99t

> follow up further.

>

>

> We sincerely appreciate your response.

>

>

> With best wishes,

Paypal Cryptocurrency phishing from Microsoft Outlook Part 3

Posted by Dave Yadallee on
0.0 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level mail

domains are different

-0.0 T_RP_MATCHES_RCVD Envelope sender domain matches handover relay

domain

0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider

[haressaznzxrrsxaxz321(at)gmail.com]

0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in digit

[haressaznzxrrsxaxz321(at)gmail.com]

0.3 LONGWORD BODY: Uses overlong words

0.6 MEGALONGWORD BODY: Uses really overlong words

0.1 TW_RW BODY: Odd Letter Triples with RW

0.1 TW_VJ BODY: Odd Letter Triples with VJ

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 HTML_MESSAGE BODY: HTML included in message

2.0 RATWR8_MESSID Message-ID with excessive dashes and dollars

0.2 FREEMAIL_FORGED_FROMDOMAIN 2nd level domains in From and EnvelopeFrom

freemail headers are different

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

0.6 LONG_INVISIBLE_TEXT Long block of hidden text - bayes poison?

0.1 TO_IN_SUBJ To address is in Subject

Subject: {SPAM?} =?UTF-8?Q?Pozv=C3=A1nky=3A_Order_Processing_Notice_=2D_Payment_Confirm?=

=?UTF-8?Q?ed_=40_st_22=2E_apr_2026_=28cynthiaperez389903=40groups=2Eoutlook=2Ecom=29?=





Haresasz Nxysarwsa has invited you to Order Processing Notice – Payment Confirmed

Title: Order Processing Notice – Payment Confirmed

Location: https://meet.google.com/yqr-oyab-vjx

When: April 22, 2026

Organizer:

Haresasz Nxysarwsa

Description: Dear Customer,



Thank you for your payment. We confirm that your PayPal transaction has been successfully verified and your Bitcoin (BTC) order is now in the confirmation stage.



Transaction ID: X4N8Q2J7T5

Date: April 22, 2026

Amount: $410.00

Payment Method: PayPal

Order Status: Pending Verification



Blockchain confirmation times may vary depending on overall network demand. You will be notified once your order has been finalized.



If you have any questions, please contact our support department.



Customer Support: +1(843) 367-5992



Thank you for your continued support.



Best Regards,

Billing Department



-::~:~::~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~::~:~::-

Pripojiť sa cez Google Meet: https://meet.google.com/yqr-oyab-vjx



Viac o službe Meet sa dozviete na https://support.google.com/a/users/answer/9282720



Túto sekciu neupravujte.

-::~:~::~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~::~:~::-

Attendees:



cynthiaperez389903@groups.outlook.com





Pripojiť sa cez Google Meet

Odkaz na stretnutie

meet.google.com/yqr-oyab-vjx

Dear Customer,



Thank you for your payment. We confirm that your PayPal transaction has been successfully verified and your Bitcoin (BTC) order is now in the confirmation stage.



Transaction ID: X4N8Q2J7T5

Date: April 22, 2026

Amount: $410.00

Payment Method: PayPal

Order Status: Pending Verification



Blockchain confirmation times may vary depending on overall network demand. You will be notified once your order has been finalized.



If you have any questions, please contact our support department.



Customer Support: +1(843) 367-5992



Thank you for your continued support.



Best Regards,

Billing Department

Kedy

streda 22. apr 2026

Organizátor

Haresasz Nxysarwsa

haressaznzxrrsxaxz321@gmail.com

Hostia

(Zoznam hostí bol na žiadosť organizátora skrytý)

Odpoveď na cynthiaperez389903@groups.outlook.com

Áno



Nie



Možno

Ďalšie možnosti



Pozvánka z Kalendára Google



Túto správu ste dostali, pretože ste účastníkom danej udalosti.



Ak túto pozvánku prepošlete, ktorýkoľvek jej príjemca bude môcť odoslať odpoveď organizátorovi, byť pridaný do zoznamu hostí, pozývať iných bez ohľadu na ich vlastný stav pozvánky alebo meniť vaše potvrdenie účasti. Ďalšie informácie

Paypal Cryptocurrency phishing from Microsoft Outlook Part 2

Posted by Dave Yadallee on
=?utf-8?B?OXBleHZkNGorK3VQc1ZEbkZXVUZqV0VTdlZiWHFPWktqZGE0c29ac0Z3d3Y4?=

=?utf-8?B?bDBrMHMvMXh0WXBoajVvQ20wZEVwQ1dqSFJLb3N6aTJSOWNqYXdRRDdVVnBt?=

=?utf-8?B?Rkh3V2FJNkZxMTdETlpvUGpTUDRaWUtTc3VJc0dWbU5nR01uMWhLWldVbU1N?=

=?utf-8?B?ZDhacWJZVHBEczk4WkRmaWMwMHFFZWkzam9HY2xCMFlTSURYWjkyUm83dnQ3?=

=?utf-8?B?RDcrN09RemQvVW1qMVhLU0x5N3pNTHBTNzVPcmVEc0pOMTBJLzQxOEpyYURZ?=

=?utf-8?B?VGRoSGdldHB1ckRmZGZSNWhoZkpXdnEyMlVYbjNuVUxKaE1Ic2JtRjRFOFRj?=

=?utf-8?B?V1VKTFljMkl6U1orTkVpTmdrckhQSW5XNTJ5UXh2OEI5UXFBZUVwc0duVGlr?=

=?utf-8?B?dnJBdHkxejMyNkU3Ynorakg2YVlwMUNTRW81MUdPc1RLZnNsME11Y2ROM1My?=

=?utf-8?B?Y3ZzT3NHUWFyUDlibGdFRW9iSy96SVozc3hKNEpJdVdCa2pZZXVkNE1iK3Rw?=

=?utf-8?B?QU1GaEkwRnF2cndhT0Fzd0luWml3eDBUWDBLNGZzUG8xN1d2OWlXMVAzVWVZ?=

=?utf-8?B?WGsrNndFVmI5ZGN4cm5OaE1TRWpZRFdGRkJrbTBEeGgyaXhhdWYxUC9ZUTBF?=

=?utf-8?B?R2l2QmJ0Q052VFdqUmhEZUdYNzNISzBIY0d3c000cnpTOUExOWtmUGZWWnBp?=

=?utf-8?B?cDhNOEhWZFhtK1ZZZWFkM2JNQ0g1R0FWQklrdUdZU2xjeFZJZ3craUp6djU1?=

=?utf-8?B?VUlhSGp4UEZkYTdIeVNualkvaWdNbGpycEswWFIrMFE5eXR6QVdwOGluRmMr?=

=?utf-8?B?bGhIUUxtMXMvNjQwQzlOSjAvc1Q4K0U1cVRhMC96dDlJVTdNaEVLY1RIRVVt?=

=?utf-8?B?ODg4WXhiWDhVeHRQOFZhTmF3RTdrQlNsT21jU0RDb3dNdlY2RnFqYm9MZWpx?=

=?utf-8?B?N2JKZjB6c0FiZnRTc3I1QXpjUE44QVlld09mdDcyZGpTTTEwM1VPYXZSNEky?=

=?utf-8?B?V3VIWUJpQUFOVkd3OVNIRWNqS0FyRStxeXJ6VGVVSHc0V1RoZzJSVmRmUGtN?=

=?utf-8?B?SXlGWkhkUTRoNUh6dG92NVVrOHBzVEI1ZERIcGd1Q0lJN1JsZlBxcmY5MzNY?=

=?utf-8?B?WUppWnBGOE5QUkM5SXZBRGJ3WVhlNlZKaGp0R2Z1NzR3L0pCektXVWYwb091?=

=?utf-8?Q?p0QJ4MclJnyQpFlnodoMpI4MBl6VC5aUt?=

X-Auto-Response-Suppress: DR, OOF, AutoReply

X-OriginatorOrg: sct-15-20-9412-4-msonline-outlook-090a5.templateTenant

X-MS-Exchange-CrossTenant-OriginalArrivalTime: 22 Apr 2026 14:45:21.3282

(UTC)

X-MS-Exchange-CrossTenant-Network-Message-Id: bf3d12cb-f271-4597-be26-08dea07dc79c

X-MS-Exchange-CrossTenant-Id: 84df9e7f-e9f6-40af-b435-aaaaaaaaaaaa

X-MS-Exchange-CrossTenant-AuthSource: DM2PEPF00003FC2.namprd04.prod.outlook.com

X-MS-Exchange-CrossTenant-AuthAs: Anonymous

X-MS-Exchange-CrossTenant-FromEntityHeader: Internet

X-MS-Exchange-Transport-CrossTenantHeadersStamped: PH0PR18MB3848

X-Spam_score: 11.4

X-Spam_score_int: 114

X-Spam_bar: +++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Order Processing Notice – Payment Confirmed streda 22. apr

2026 Pripojiť sa cez Google Meet https://meet.google.com/yqr-oyab-vjx?hs=224

Dear Customer,



Content analysis details: (11.4 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[40.93.1.2 listed in dnsbl.ahbl.org]

[40.93.1.2 listed in dnsbl.ahbl.org]

[40.93.1.2 listed in dnsbl.ahbl.org]

[40.93.1.2 listed in dnsbl.ahbl.org]

[209.85.161.74 listed in dnsbl.ahbl.org]

[209.85.161.74 listed in dnsbl.ahbl.org]

[209.85.161.74 listed in dnsbl.ahbl.org]

[209.85.161.74 listed in dnsbl.ahbl.org]

[2603:10b6:610:e7:0:0:0:35 listed in]

[dnsbl.ahbl.org]

[2603:10b6:610:e7:0:0:0:35 listed in]

[dnsbl.ahbl.org]

[2603:10b6:610:e7:0:0:0:35 listed in]

[dnsbl.ahbl.org]

[2603:10b6:610:e7:0:0:0:35 listed in]

[dnsbl.ahbl.org]

[2603:10b6:610:e7:cafe:0:0:50 listed in]

[dnsbl.ahbl.org]

[2603:10b6:610:e7:cafe:0:0:50 listed in]

[dnsbl.ahbl.org]

[2603:10b6:610:e7:cafe:0:0:50 listed in]

[dnsbl.ahbl.org]

[2603:10b6:610:e7:cafe:0:0:50 listed in]

[dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[40.93.1.2 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[40.93.1.2 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[40.93.1.2 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[40.93.1.2 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[209.85.161.74 listed in will-spam-for-food.eu.org]

[209.85.161.74 listed in will-spam-for-food.eu.org]

[209.85.161.74 listed in will-spam-for-food.eu.org]

[209.85.161.74 listed in will-spam-for-food.eu.org]

[209.85.161.74 listed in will-spam-for-food.eu.org]

[209.85.161.74 listed in will-spam-for-food.eu.org]

[209.85.161.74 listed in will-spam-for-food.eu.org]

[209.85.161.74 listed in will-spam-for-food.eu.org]

[2603:10b6:610:e7:cafe:0:0:50 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:610:e7:cafe:0:0:50 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:610:e7:cafe:0:0:50 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:610:e7:cafe:0:0:50 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:610:e7:cafe:0:0:50 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:610:e7:cafe:0:0:50 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:610:e7:cafe:0:0:50 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:610:e7:cafe:0:0:50 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:610:e7:0:0:0:35 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:610:e7:0:0:0:35 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:610:e7:0:0:0:35 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:610:e7:0:0:0:35 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:610:e7:0:0:0:35 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:610:e7:0:0:0:35 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:610:e7:0:0:0:35 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:610:e7:0:0:0:35 listed in]

[will-spam-for-food.eu.org]

[40.93.1.2 listed in will-spam-for-food.eu.org]

[40.93.1.2 listed in will-spam-for-food.eu.org]

[40.93.1.2 listed in will-spam-for-food.eu.org]

[40.93.1.2 listed in will-spam-for-food.eu.org]

[40.93.1.2 listed in will-spam-for-food.eu.org]

[40.93.1.2 listed in will-spam-for-food.eu.org]

[40.93.1.2 listed in will-spam-for-food.eu.org]

[40.93.1.2 listed in will-spam-for-food.eu.org]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[40.93.1.2 listed in list.dnswl.org]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-0.0 SPF_PASS SPF: sender matches SPF record

-0.0 SPF_HELO_PASS SPF: HELO matches SPF record

0.5 FROM_LOCAL_NOVOWEL From: localpart has series of non-vowel letters

3.5 VOWEL_FROM_7 Impronouncable from header (7+ consecutive vowels)

1.0 HK_RANDOM_REPLYTO Reply-To username looks random

1.0 HK_RANDOM_FROM From username looks random

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[40.93.1.2 listed in wl.mailspike.net]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[40.93.1.2 listed in bl.score.senderscore.com]

Paypal Cryptocurrency phishing from Microsoft Outlook Part 1

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Wed, 22 Apr 2026 09:50:03 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1wFZpN-00000000E9O-41gn

for dave@doctor.nl2k.ab.ca;

Wed, 22 Apr 2026 09:49:25 -0600

Resent-From: The Doctor

Resent-Date: Wed, 22 Apr 2026 09:49:25 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-westusazlp17010002.outbound.protection.outlook.com ([40.93.1.2]:43322 helo=BYAPR05CU005.outbound.protection.outlook.com)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1wFYqS-000000008K6-0e9f

for doctor@doctor.nl2k.ab.ca;

Wed, 22 Apr 2026 08:46:40 -0600

Received: from CH0PR03CA0240.namprd03.prod.outlook.com (2603:10b6:610:e7::35)

by PH0PR18MB3848.namprd18.prod.outlook.com (2603:10b6:510:2b::24) with

Microsoft SMTP Server (version=TLS1_2,

cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.9846.20; Wed, 22 Apr

2026 14:45:22 +0000

Received: from DM2PEPF00003FC2.namprd04.prod.outlook.com

(2603:10b6:610:e7:cafe::50) by CH0PR03CA0240.outlook.office365.com

(2603:10b6:610:e7::35) with Microsoft SMTP Server (version=TLS1_3,

cipher=TLS_AES_256_GCM_SHA384) id 15.20.9791.48 via Frontend Transport; Wed,

22 Apr 2026 14:45:21 +0000

Authentication-Results: spf=pass (sender IP is 209.85.161.74)

smtp.mailfrom=gmail.com; dkim=pass (signature was verified)

header.d=google.com;dkim=pass (signature was verified)

header.d=gmail.com;dmarc=pass action=none header.from=gmail.com;compauth=pass

reason=100

Received-SPF: Pass (protection.outlook.com: domain of gmail.com designates

209.85.161.74 as permitted sender) receiver=protection.outlook.com;

client-ip=209.85.161.74; helo=mail-oo1-f74.google.com; pr=C

Received: from mail-oo1-f74.google.com (209.85.161.74) by

DM2PEPF00003FC2.mail.protection.outlook.com (10.167.23.20) with Microsoft

SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.20.9846.18

via Frontend Transport; Wed, 22 Apr 2026 14:45:21 +0000

X-IncomingTopHeaderMarker:

OriginalChecksum:0A597A57D272C789A52AE46B09C8BBA62646102A41C8E30A2EB1E83E6A05F3AA;UpperCasedChecksum:0331458022BE88BC4608EB18A567A9D5BB9B0C77D54299CCD77FDD2EB8D0B567;SizeAsReceived:3383;Count:15

Received: by mail-oo1-f74.google.com with SMTP id 006d021491bc7-6946dfca922so4677615eaf.1

for ; Wed, 22 Apr 2026 07:45:21 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=google.com; s=20251104; t=1776869121; x=1777473921; darn=groups.outlook.com;

h=to:from:subject:date:message-id:sender:reply-to:mime-version:from

:to:cc:subject:date:message-id:reply-to;

bh=Qcznrz6dMXfhK6mVdeLuj7BHSjZW9UCiByt6meB7GPA=;

b=TWfE+xcEeLX8aGJK7wxuGkHga1C4qefZp7TalhfS+YUMcgafZuWFqy+6ntMZOQGrZO

A/+gPX8HeDyVzobvlIfVs/rwQXtv0EdQbEr1fEHbSHQtw2VoKa/pl7IwcmX3vGcxnXu/

vXkFXBeLneKtBPatO/nmvHey6BUyg04gZ58f+ecAYqUjSAfwGKK5dpCRHKViFqXMleIK

YHfVMJWFHy+iH9gVJTYyw6Ln0XDjOUTuUu15/UyDc6btSkFRWBhjt7V55Pk62+Dd21ao

O4jysIMbSJG11pMh3xDa/m1EOd65ovtigcdLy1uH3chY+Ks1lX4p89EkcNFkkCfgNr2l

srUw==

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=gmail.com; s=20251104; t=1776869121; x=1777473921; darn=groups.outlook.com;

h=to:from:subject:date:message-id:sender:reply-to:mime-version:from

:to:cc:subject:date:message-id:reply-to;

bh=Qcznrz6dMXfhK6mVdeLuj7BHSjZW9UCiByt6meB7GPA=;

b=Cg2v9o5jDXNgKAPf/ZsUD4qeyXSoFGf9Fz8eerHYu59BKbEUIUJNW3afJqofkdwkL1

Pq0sH6Gw6/GtACdVfu7CRSa5d3TwqOTUt/TZlhH0fdPu2aO7A+FzBnvSTtU84Fc7QmN0

I4/tOFIKAsV2uBmSewtKUtDMziCiwpa6fHmL18BgB5pNniBC4KEqkKiWv6vKfJUTZ6fv

BVeowY40Fo6wuCo/GNGIJ5dvKmNFI4XaPaBrxkwmm0FtEADF8r4Z3YlKs4C0jpPFhb9X

rb5vL15x+EcihpeMbAbHIawQph/2WXF61bITMhG6r5SmYdLm8PlfDtT7SfB/Z8MJdjkZ

uS6g==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20251104; t=1776869121; x=1777473921;

h=to:from:subject:date:message-id:sender:reply-to:mime-version

:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to;

bh=Qcznrz6dMXfhK6mVdeLuj7BHSjZW9UCiByt6meB7GPA=;

b=a8qZ8wQ0Uj+zyIpTC5IaohI9yRKuj4/FhQpjgzorwOLu/aLJj71aCDHPUbPXaiw+zr

nwmjkfPekz+eoblBzO4j09paA2z/FM3+0fiElFZs/9jTqkmHOyV0wTloFabqZmJmE6Hx

RziBLgrAkLleF41p+HVpOJgryczbF68I2NT67HGQI2J026BNyNoebbva/7ltB4L90nnl

G/yKw1UIc5Jnh+R/11hqaZXWsK+rgwg1oXGwzUU0gygiLfZyDAREhB73IXV3Lp8Da06S

I4YLCVKsvLM9ZJdRecCHVtIyFVA99HMLAm9kMXR/WgnT+g/a1QvKp9yw/WKaLviGQ4LD

HEng==

X-Gm-Message-State: AOJu0YxEtN6M80n+S7JKi9wzxzGHepOJ7wkAdBaO5ukdkdBHScLPic9+

k2gzLbly3kP1+njgqOzXd+//n/4RJrVH5jflcZYvgcM+uTmqDslnrmYK7f3qi2q7chDKMl4q25A

4qrD2zgcaoDbGq9VH20+21aHIZfx+RV9C+QA=

MIME-Version: 1.0

X-Received: by 2002:a05:6820:4c06:b0:694:8f3a:3f41 with SMTP id

006d021491bc7-6948f3a4683mr5431110eaf.41.1776869120784; Wed, 22 Apr 2026

07:45:20 -0700 (PDT)

Reply-To: Haresasz Nxysarwsa

Sender: =?UTF-8?Q?Kalend=C3=A1r_Google?=

Message-ID:

Date: Wed, 22 Apr 2026 14:45:20 +0000

Subject: =?UTF-8?Q?Pozv=C3=A1nky=3A_Order_Processing_Notice_=2D_Payment_Confirm?=

=?UTF-8?Q?ed_=40_st_22=2E_apr_2026_=28cynthiaperez389903=40groups=2Eoutlook=2Ecom=29?=

From: Haresasz Nxysarwsa

To: cynthiaperez389903@groups.outlook.com

Content-Type: multipart/mixed; boundary="000000000000c1c0f406500d94f8"

X-IncomingHeaderCount: 15

X-EOPAttributedMessage: 0

X-EOPTenantAttributedMessage: 84df9e7f-e9f6-40af-b435-aaaaaaaaaaaa:0

X-MS-PublicTrafficType: Email

X-MS-TrafficTypeDiagnostic: DM2PEPF00003FC2:EE_|PH0PR18MB3848:EE_

X-MS-Office365-Filtering-Correlation-Id: bf3d12cb-f271-4597-be26-08dea07dc79c

X-MS-Exchange-EOPDirect: true

X-Sender-IP: 209.85.161.74

X-SID-PRA: HARESSAZNZXRRSXAXZ321@GMAIL.COM

X-SID-Result: PASS

X-MS-Consumer-Group-Expansion-Loop: cynthiaperez389903@groups.outlook.com

X-MS-Exchange-Group-Expansion-Loop: cynthiaperez389903@groups.outlook.com

X-Microsoft-Antispam:

BCL:0;ARA:1444111002|16200799027|9020799019|24102599021|6092099016|461199028|9000799056|26130799006|3151999006|9400799043|29080799006|6019299003|6149299003|1680799066|26000799027|5139299004|4040799016|4302099013|3412199025|440099028|2145499017|30041999003|26104999006|22062799003|18021999003|1380799030|1360799030|1370799030|21002599022;

X-Microsoft-Antispam-Message-Info:

=?utf-8?B?V2dJM0NtdC9Odk9XazJzWGwzaE03V2lwY1E4NG9rdEo1cGZhMVlCTDdYcHhu?=

=?utf-8?B?U1RqWFkxaWN2NWhjQ2NKSHlVajNGZmNXbWdtRlR0ZXV5SENsL2dxZGgwZEMz?=

=?utf-8?B?ZUdQc3dhOHgzSTgxMWtFSUhBOFZhdVN0RHY2YS9kN0h4OTZlcjJ0ellZQVlo?=

=?utf-8?B?OFhNT0d2eTlHOEhqYXRzL1Q4T3hWcy90Z2R1N0UwanFrWHR2YkxUSFZNdU9j?=

=?utf-8?B?ZW5FMWlaMWJRbi83UU1GeHpzVFNWcVV2K1c3WE0ya3dNQkFrSGF2SC9hK0ZI?=

=?utf-8?B?OWd4aEJKQ0M2dmdWWVAwVTFzbmRDNzZqalhYTTB1NVZpQTZuSHVZM1luc2pp?=

=?utf-8?B?cGIwNkhubk1aVisxRjh1VmgzYUFsdDNoMmpyYXJ4S1l5NFZFNDVsWTVmRnRL?=

=?utf-8?B?NG5uWHMwazFBR052dVY0alBTL2Iyak5zRjJsQUQxYWllUThVWlgxTmdpODFr?=

=?utf-8?B?QjgvdEI1dHA1blBwdElzcFVhb0c1NU1sYlN5dzB1bWZvQkRYM0RESTE2aWs5?=

=?utf-8?B?N1p0allPb1owem5BL0w1VGN3ay9ZOEJTN2d2VXplOEMzU0d4ZDNnTWV5OFBx?=

=?utf-8?B?NHlYK2tuS1dOT0hvQzhqQ2hIdXhIQ2hsMldIUyt4KytKQzNyTmRTcU1PQnk3?=

=?utf-8?B?dUY3STVVeXVtYXlsVUwrZ0xwUkxEWUxUMnJ0enExOC9FbGxuakcxN1Y5QnAw?=

=?utf-8?B?T0F6VkhoSklQNmZCNkpNUkRwOWNjY2dEVWlFR0o5TVNmVlJENUFmcjhpK1Z6?=

=?utf-8?B?SkI4NCtrak91QlNsSFZTUE5BTzhzSHRzd2JYYUVVcDV4R244YnpraGVSYjdi?=

=?utf-8?B?aDBVejRrcHdWSnU0WTJJbDAxdXNjcVhCb3ZsZmo0dDlTclhCTXVySmUwYXBC?=

=?utf-8?B?Umw1T21LY3dudmFULzRJQ29RYjRCZWdkemQrTUgxZlhPTTRqR2hHbTBTUEI4?=

=?utf-8?B?eVpWZmoxdFVmdDZRdFBhSHVWSlZFWlZRa3pxV0c3ZVlNSktuU1ZaUzBQeC93?=

=?utf-8?B?NHVsY3RzM3pJVW9DandVKzB1N3V1ODhQaWRjc0dyRUI3RVJKcnM2VDRiWXFI?=

=?utf-8?B?ZStHbzVzUVEwZGRDNmJDb3BXNkNwTHlYcHpTZlNDeXFOczZKSUkzbWxsNU5D?=

=?utf-8?B?OS9xdGwxNFJVdTUxbWhraXJVOVErbURFK3JVRHdIYWJzTzU5cUJ6dGlYd1B6?=

=?utf-8?B?eDVxdHRlcldyV3FKakU5K25tMUI4NjRUU0dzMXVCV3pSeU4vWURhWlJuVHhs?=

=?utf-8?B?ZEtTQ0hrNmpQZzQ1R3JPM0JSbTFJVzJ5b2hWLzI3NFliVHA5NFZvVXdEaVlr?=

=?utf-8?B?R2RkUUtyZ3B0eDZtY1Fnd29QbEpMUlM2V1NER0Fnampua0NRZUZxb3F5Z0Zj?=

=?utf-8?B?Z2JGZEhRYitWUjl1bktFMGdQRjVYcVRlNGE1ZURjTXRSRXQ4emREWk1lb1FJ?=

=?utf-8?B?V01ZT3pTTGw0aDUyaEZKL2RyVHNtTG40UkhKeGhqQ3ljaGxtQXF6R2ZZWE1W?=

=?utf-8?B?QnNDRE9ETEh4QU1xQWN0TTlNdGlGMVBZZm1vS3J6TkorUEhDTFpJbTl5MVdy?=

=?utf-8?B?SVNGMDIrT3RjSUNEQnp1TXhpTFRQVUplOUpGcjNxVVh0cW5qNjE4a284K1A4?=

=?utf-8?B?Qzl2WnU2NkRWaWZ1bW4xT2hycmw4bU5LYk1uUEh4U28wc25qdGIwNnQ1bmIv?=

=?utf-8?B?d2JJdndZK3I4b2pZaElzdVp1SFZWNmJiQm9sQk1FdVNRTXdsM3AvWWlidnN0?=

=?utf-8?B?d3pIUTVRc2x2cFZ0Z3hwdm1TZktkTmo0QjlJVjQ3WTFCOVBDa2lXOWNqdUcw?=

=?utf-8?B?ZG1mWFBJMHlaK1djYVhSaGkwcDB0V3A0Skh4dTJIVitNUlNtcEc2VWlEVDBn?=

=?utf-8?B?N1AzU0Izc2d0Qzh2cTVKTlAxWkR3MXVybnRyUUpjYmo5L0xnbldwcy9tS09S?=

=?utf-8?B?cG5rRHFLVkJVYVBnd3BBRGNFTVQvbnBNc3lUSE9rUHAvNDFwWElWNTZxQ2Ji?=

=?utf-8?B?eEIyNDJCMHJLRG5HMGFidGZYN3lUQW5MSjhHbGpoZDRQdWJKR2pOcy9lcVJk?=

=?utf-8?B?U0VQN3FINWxKTCtoWmhnbkhhbUlzZmRWYkdnNm41elBJbzRvYmhXbkx2NU55?=

=?utf-8?B?enowZXJwS29KRzg0Wmtpb09DU1NJZW1KZE90OThnVWNBTnB6Q3VzanVzQUtL?=

=?utf-8?B?b1VuTTNReUZVNHNXMWxtR2ZJSmNGcEQ5UU05c0UyWUpoRWdXZkJxRWdsRnAz?=

=?utf-8?B?UURNcVA5dUxsUFM1VCtqeWhIemdVNTk1WkxUTU9CcnVqMzk4ellrOUt2TTgw?=

=?utf-8?B?SWVkVDlTazJTd2NNRkYzTTFzQXJINDRlS3NISmZwQVByS1FHOFl0OENHVG5y?=

Norton Phish from Google Gmail Part 3

Posted by Dave Yadallee on
























































































--===============1534604035356672217==--

Norton Phish from Google Gmail Part 2

Posted by Dave Yadallee on









778a4d3c8a66954f0e23f1f694ea285081' height=3D'1' width=3D'1' align=3D'ri=

ght' />

------d6b546ff4550a245ba8d898f567ce67c--



Account phish posing as BC Cannabis Alliance Part 2

Posted by Dave Yadallee on

td>
%" border=3D"0" cellpadding=3D"0" cellspacing=3D"0" role=3D"presentation=

" style=3D"mso-table-lspace:0;mso-table-rspace:0;word-break:break-word">=


"font-family:Arial,sans-serif">

ont-family:Arial,'Helvetica Neue',Helvetica,sans-serif;mso-line-height-a=

lt:18px;color:#4a4a4a;line-height:1.5">


px;mso-line-height-alt:21px">
-size: 14px;">If you have already completed this update, you can safely =

ignore this message. Thanks for helping keep your account secure. <=

/span>


e>
width=3D"100%" border=3D"0" cellpadding=3D"0" cellspacing=3D"0" role=3D"=

presentation" style=3D"mso-table-lspace:0;mso-table-rspace:0">
>

llpadding=3D"0" cellspacing=3D"0" role=3D"presentation" style=3D"mso-tab=

le-lspace:0;mso-table-rspace:0;color:#000;width:600px;margin:0 auto" wid=

th=3D"600">

=3D"mso-table-lspace:0;mso-table-rspace:0;font-weight:400;text-align:lef=

t;padding-bottom:5px;padding-top:5px;vertical-align:top">
"social_block block-1" width=3D"100%" border=3D"0" cellpadding=3D"0" cel=

lspacing=3D"0" role=3D"presentation" style=3D"mso-table-lspace:0;mso-tab=

le-rspace:0">
y>

ding-right:0;padding-left:0">
<=

table class=3D"social-table" width=3D"188px" border=3D"0" cellpadding=3D=

"0" cellspacing=3D"0" role=3D"presentation" style=3D"mso-table-lspace:0;=

mso-table-rspace:0;display:inline-block">

:0">
a4d3c8a66954f0eb113e3625d92fc4c70a9d66ea88257f9" target=3D"_blank">
src=3D"https://app-rsrc.getbee.io/public/resources/social-networks-icon-=

sets/t-outline-circle-default-gray/facebook@2x.png" width=3D"32" height=3D=

"auto" alt=3D"Facebook" title=3D"Facebook" style=3D"display:block;height=

:auto;border:0">


c8a66954f0eb113e3625d92fc4c9ebe182642bbb156" target=3D"_blank">
"https://app-rsrc.getbee.io/public/resources/social-networks-icon-sets/t=

-outline-circle-default-gray/twitter@2x.png" width=3D"32" height=3D"auto=

" alt=3D"Twitter" title=3D"Twitter" style=3D"display:block;height:auto;b=

order:0">
td1.com/c/443/cb6bfcb666a7e30d5da5b5749e4dc7778a4d3c8a66954f0eb113e3625d=

92fc4c24d7ad0dc9cab4bb" target=3D"_blank">
etbee.io/public/resources/social-networks-icon-sets/t-outline-circle-def=

ault-gray/instagram@2x.png" width=3D"32" height=3D"auto" alt=3D"Instagra=

m" title=3D"Instagram" style=3D"display:block;height:auto;border:0">=


/cb6bfcb666a7e30d5da5b5749e4dc7778a4d3c8a66954f0eb113e3625d92fc4cb62c327=

84419519d" target=3D"_blank">
ic/resources/social-networks-icon-sets/t-outline-circle-default-gray/lin=

kedin@2x.png" width=3D"32" height=3D"auto" alt=3D"LinkedIn" title=3D"Lin=

kedIn" style=3D"display:block;height:auto;border:0">

block-2" width=3D"100%" border=3D"0" cellpadding=3D"0" cellspacing=3D"0"=

role=3D"presentation" style=3D"mso-table-lspace:0;mso-table-rspace:0"><=

tbody>
y>

px;padding-right:30px;padding-top:60px">

"center">
"presentation" width=3D"100%" style=3D"mso-table-lspace:0;mso-table-rspa=

ce:0">

-height:1px;border-top:1px solid #e2e2e2">
ak-word;"> 

ss=3D"row row-3" align=3D"center" width=3D"100%" border=3D"0" cellpaddin=

g=3D"0" cellspacing=3D"0" role=3D"presentation" style=3D"mso-table-lspac=

e:0;mso-table-rspace:0;background-color:#fff">


lpadding=3D"0" cellspacing=3D"0" role=3D"presentation" style=3D"mso-tabl=

e-lspace:0;mso-table-rspace:0;color:#333;width:600px;margin:0 auto" widt=

h=3D"600">

"mso-table-lspace:0;mso-table-rspace:0;font-weight:400;text-align:left;p=

adding-bottom:60px;padding-left:30px;padding-right:30px;padding-top:60px=

;vertical-align:top">
border=3D"0" cellpadding=3D"0" cellspacing=3D"0" role=3D"presentation" =

style=3D"mso-table-lspace:0;mso-table-rspace:0">

pad" style=3D"padding-bottom:32px;width:100%;padding-right:0;padding-lef=

t:0">

08px">
grxx.png" style=3D"display:block;height:auto;border:0;width:100%" width=3D=

"108" alt=3D"Alternate text" title=3D"Alternate text" height=3D"auto">
div>

width=3D"100%" border=3D"0" cellpadding=3D"10" cellspacing=3D"0" role=3D=

"presentation" style=3D"mso-table-lspace:0;mso-table-rspace:0;word-break=

:break-word">

l,sans-serif">

',Helvetica,sans-serif;font-size:12px;mso-line-height-alt:18px;color:#9b=

9b9b;line-height:1.5">


er;mso-line-height-alt:12px">

Account phish posing as BC Cannabis Alliance Part 1

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Wed, 22 Apr 2026 07:31:02 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1wFXfQ-00000000Jyc-49Tt

for dave@doctor.nl2k.ab.ca;

Wed, 22 Apr 2026 07:31:00 -0600

Resent-From: The Doctor

Resent-Date: Wed, 22 Apr 2026 07:31:00 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from smtp-newslist-210.md02.com ([209.172.40.210]:64221)

by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

(Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1wFR9w-000000007qE-0rRI

for doctor@nk.ca;

Wed, 22 Apr 2026 00:34:16 -0600

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; s=c133315; d=cmtd1.com;

h=Subject:From:To:Reply-To:List-Unsubscribe:List-Unsubscribe-Post:List-id:

MIME-Version:Date:Content-Type:Message-Id:From:To:Subject:Date;

i=info+bccannabisalliance.com@cmtd1.com;

bh=sXmVKhLm62pi9KckLa+48HZ8TDKbdz9jY8UR9CaEEPQ=;

b=q4IRgyc95aYOZnTF22OewMHflOLlJxrbwmCdRhEcYC5YGhaQioTkdFanhnDY6u6138SeiATTNFPy

Y5+F6LUSqKL4yJ2TksIGwTXcCiWiaMH614+vgr/7YdoSNP4Zx6H3+tCFD/OMQH4Z+GjgPh0LVxy+

lEZPaB0VAYannaP+tcg=

Received: by smtp-newslist-210.md02.com id ht1lto3cld82 for ; Wed, 22 Apr 2026 06:33:09 +0000 (envelope-from )

Subject: Keep your account features up to date

From: "Ledger =?UTF-8?Q?=F0=9F=94=90?="

To: doctor@nk.ca

Reply-To: info@bccannabisalliance.com

Tag-id: 1724342.15265028.9406955.743775.m.300a09a4

List-Unsubscribe: ,

List-Unsubscribe-Post: List-Unsubscribe=One-Click

Interface-id: 443

Parent-id: 133315

Client-id: 1724342

List-id: 9406955

Feedback-ID: 1724342:news:2:cmd02

MIME-Version: 1.0

Date: Wed, 22 Apr 2026 02:33:09 -0400 (EDT)

Content-Type: multipart/alternative; boundary="----d6b546ff4550a245ba8d898f567ce67c"

Message-Id: <20260422063309.A70BF40005@mta-mailings-postfix.postfix-production.cluster.local>



------d6b546ff4550a245ba8d898f567ce67c

Content-Type: text/plain; charset="utf-8"

Content-Transfer-Encoding: quoted-printable



In order to see your message, click on the following link: https://cmtd1=

.com/v/443/cb6bfcb666a7e30d5da5b5749e4dc7778a4d3c8a66954f0e23f1f694ea285=

081

------d6b546ff4550a245ba8d898f567ce67c

Content-Type: text/html; charset="utf-8"

Content-Transfer-Encoding: quoted-printable






content=3D"text/html; charset=3Dutf-8">
"width=3Ddevice-width,initial-scale=3D1">


transparent; border-bottom: 0px solid transparent; border-left: 0px soli=

d transparent; border-radius: 4px; border-right: 0px solid transparent; =

border-top: 0px solid transparent; color: #ffffff; display: inline-block=

; font-family: Arial, Helvetica Neue, Helvetica, sans-serif; font-size: =

14px; font-weight: 400; mso-border-alt: none; padding-bottom: 5px; paddi=

ng-top: 5px; padding-left: 20px; padding-right: 20px; text-align: center=

; width: auto; word-break: keep-all; letter-spacing: normal;">
e=3D"word-break: break-word; line-height: 28px;">Update Now
>