Instagram social media spam from Microsoft Outlook Part 2

Posted by Dave Yadallee on




--__=_Part_Boundary_007_025954.007816

Content-Type: text/html; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable



















PowerYourSocial



=0D=0A=0D=0A
=3D"MSHTML=2011.00.10570.1001">=0D=0A=0D=0A
Dear=20sales@n=

k.ca,
=0D=0A
 
=0D=0A
Jo=

in=20an=20Elite=20Circle=20of=20influential=20leaders.<=

/DIV>=0D=0A
 
=0D=0A
OPENING=20=E2=9C=A8
Illuminati=20=

is=20an=20elite=20organization=20of=20world=20leaders,=20business=20authori=

ties,=20innovators,=20artists,=20and=20other=20influential=20members=20of=20=

this=20planet.=20Our=20coalition=20unites=20influencers=20of=20all=20politi=

cal,=20religious,=20and=20geographical=20backgrounds=20to=20further=20the=20=

prosperity=20of=20the=20human=20species=20as=20a=20whole.
=0D=0A
<=

BR>Interested=20in=20learning=20more=20about=20joining=20the=20Illuminati=20=

Brotherhood?=20For=20inquiries,=20eligibility=20information,=20and=20regist=

ration=20details,=20kindly=20send=20a=20direct=20message=20on=20our=20whats=

app=20line=20by=20clicking=20our=20whatsapp=20link.
=0D=0A
 <=

/DIV>=0D=0A

2942">CHAT=20US=20ON=20WHATSAPP
=0D=0A
 
=0D=0A
=0D=

=0A=0D=0A

=0D=0A

Dr.=20Medi

=0D=0A

Illuminati=20Italy=20Agent=20=

-=20+39=20351=20070=202942

=0D=0A
t24cr=20xexx8yu=20xyri2b=20x18d9i69=20x1c1uobl=20xyqm7xq=20x1ys307a"=20styl=

e=3D'FONT-SIZE:=2012px;=20MARGIN-BOTTOM:=200px;=20FONT-FAMILY:=20"Segoe=20U=

I=20Historic",=20"Segoe=20UI",=20Helvetica,=20Arial,=20sans-serif;=20WHITE-=

SPACE:=20normal;=20WORD-SPACING:=200px;=20MARGIN-TOP:=200px;=20TEXT-TRANSFO=

RM:=20none;=20FONT-WEIGHT:=20400;=20COLOR:=20rgb(28,30,33);=20PADDING-BOTTO=

M:=200px;=20FONT-STYLE:=20normal;=20PADDING-TOP:=200px;=20ORPHANS:=202;=20W=

IDOWS:=202;=20LETTER-SPACING:=20normal;=20BACKGROUND-COLOR:=20rgb(255,255,2=

55);=20TEXT-INDENT:=200px;=20padding-inline:=200px;=20margin-inline:=2016px=

;=20font-variant-ligatures:=20normal;=20font-variant-caps:=20normal;=20-web=

kit-text-stroke-width:=200px;=20text-decoration-thickness:=20initial;=20tex=

t-decoration-style:=20initial;=20text-decoration-color:=20initial'>

R=20class=3DApple-interchange-newline>=0D=0A
2z=20x78zum5=20x2lah0s=20x1n2onr6=20x1nhvcw1=20x1qjc9v5=20xozqiw3=20x1q0g3n=

p=20xyri2b=20x1c1uobl=20xwib8y2=20xexx8yu=20x1ws5yxj=20xw01apr=20x4cne27=20=

xifccgj"=20style=3D'BOX-SIZING:=20border-box;=20FONT-SIZE:=2012px;=20MARGIN=

-BOTTOM:=20-6px;=20FONT-FAMILY:=20"Segoe=20UI=20Historic",=20"Segoe=20UI",=20=

Helvetica,=20Arial,=20sans-serif;=20WHITE-SPACE:=20normal;=20WORD-SPACING:=20=

0px;=20MARGIN-TOP:=20-6px;=20POSITION:=20relative;=20TEXT-TRANSFORM:=20none=

;=20FONT-WEIGHT:=20400;=20COLOR:=20rgb(28,30,33);=20PADDING-BOTTOM:=208px;=20=

FONT-STYLE:=20normal;=20PADDING-TOP:=200px;=20ORPHANS:=202;=20WIDOWS:=202;=20=

Z-INDEX:=200;=20DISPLAY:=20flex;=20LETTER-SPACING:=20normal;=20BACKGROUND-C=

OLOR:=20rgb(255,255,255);=20TEXT-INDENT:=200px;=20padding-inline:=200px;=20=

margin-inline:=20-6px;=20font-variant-ligatures:=20normal;=20font-variant-c=

aps:=20normal;=20-webkit-text-stroke-width:=200px;=20text-decoration-thickn=

ess:=20initial;=20text-decoration-style:=20initial;=20text-decoration-color=

:=20initial;=20justify-content:=20flex-start;=20flex-flow:=20row;=20align-i=

tems:=20stretch;=20flex-shrink:=200'>07/18/2026
=0D=0A

 

=0D=

=0A



--8CE0F6CB9C46418D8111A446698EC469--

Illuminati Spam Part 1

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Sat, 18 Jul 2026 09:11:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wl6gW-00000000MFm-2rAJ

for dave@doctor.nl2k.ab.ca;

Sat, 18 Jul 2026 09:10:36 -0600

Resent-From: The Doctor

Resent-Date: Sat, 18 Jul 2026 09:10:36 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from d6-229.my-control-panel.com ([198.251.89.229]:55101 helo=d6.my-control-panel.com)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wl5KS-00000000Byz-22Sa

for sales@nk.ca;

Sat, 18 Jul 2026 07:43:54 -0600

DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed;

d=senzxc44.shop; s=x; h=Content-Type:Mime-Version:Message-ID:List-Unsubscribe

:Date:Subject:To:Reply-To:From:Sender:Cc:Content-Transfer-Encoding:Content-ID

:Content-Description:Resent-Date:Resent-From:Resent-Sender:Resent-To:

Resent-Cc:Resent-Message-ID:In-Reply-To:References:List-Id:List-Help:

List-Subscribe:List-Post:List-Owner:List-Archive;

bh=bR8F7GEb3TB4ldmgmIZRGLQGhsl/HKPGvG6bm3vBZ2Q=; b=ugeZWixeSE4tz0YSoyv5Otybvv

15B6DyG3+iqrw83EIdtSDWD5p72+QoLV8dv1eBrdzGJaYO+223E+qbUwHT92h2k02oDnwO+0oNkfQ

H+msbjRKUARSsrkQi9ZVSUWHGIVzd7Asawbj7TlGplxvC8mdUA9V3QCnSuzybh5aM13U62bJNg3iM

G2v/zsm2qZTmoXzbtxNSCxk949tsfi4bJdUuwB6tWfgMewLFjTNdCoN0nAq4jvB+7V22MEc2Kwu1G

+txaWCvWLL9Ic6goLCpowYoemwi0/YRMjdD6aXKrFMkngBvAlF9/hp0VVBPDLqv0EQaXORJLuQWM6

khdZPDVw==;

Received: from [155.117.44.22] (helo=vps-ngfh)

by d6.my-control-panel.com with esmtpsa (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.99.2)

(envelope-from )

id 1wl5JY-00000007LPQ-1qN7

for sales@nk.ca;

Sat, 18 Jul 2026 15:42:48 +0200

From: =?utf-8?B?SWxsdW1pbmF0aSBJdGFseSBBZ2VudCAtICszOSAzNTEgMDcwIDI5NDI=?=

Reply-To: contact@illuminatisecretsociety.cc

To: sales@nk.ca

Subject: =?utf-8?B?Sm9pbiB0aGUgRWxpdGUgQ2lyY2xlIChJTExVTUlOQVRJKSAtIElsbHVtaW5hdGkgSXRhbHkgQWdlbnQgLSArMzkgMzUxIDA3MCAyOTQy?=

Date: Sat, 18 Jul 2026 08:42:46 -500

List-Unsubscribe:

X-Priority: 3

Message-ID: <2D10A2E526894A19B365346774D71A08@senzxc44.shop>

Mime-Version: 1.0

Content-Type: multipart/alternative; boundary="8CE0F6CB9C46418D8111A446698EC469"

X-Authenticated-Id: contact@senzxc44.shop

X-Spam_score: 10.7

X-Spam_score_int: 107

X-Spam_bar: ++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Dear sales@nk.ca, Join an Elite Circle of influential leaders.

OPENING ✨ Illuminati is an elite organization of world leaders, business

authorities, innovators, artists, and other influential members of this planet.

Our coalition unites influencers of all polit [...]



Content analysis details: (10.7 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[198.251.89.229 listed in dnsbl.ahbl.org]

[198.251.89.229 listed in dnsbl.ahbl.org]

[198.251.89.229 listed in dnsbl.ahbl.org]

[198.251.89.229 listed in dnsbl.ahbl.org]

[155.117.44.22 listed in dnsbl.ahbl.org]

[155.117.44.22 listed in dnsbl.ahbl.org]

[155.117.44.22 listed in dnsbl.ahbl.org]

[155.117.44.22 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[198.251.89.229 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[198.251.89.229 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[198.251.89.229 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[198.251.89.229 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[155.117.44.22 listed in will-spam-for-food.eu.org]

[155.117.44.22 listed in will-spam-for-food.eu.org]

[155.117.44.22 listed in will-spam-for-food.eu.org]

[155.117.44.22 listed in will-spam-for-food.eu.org]

[155.117.44.22 listed in will-spam-for-food.eu.org]

[155.117.44.22 listed in will-spam-for-food.eu.org]

[155.117.44.22 listed in will-spam-for-food.eu.org]

[155.117.44.22 listed in will-spam-for-food.eu.org]

[198.251.89.229 listed in will-spam-for-food.eu.org]

[198.251.89.229 listed in will-spam-for-food.eu.org]

[198.251.89.229 listed in will-spam-for-food.eu.org]

[198.251.89.229 listed in will-spam-for-food.eu.org]

[198.251.89.229 listed in will-spam-for-food.eu.org]

[198.251.89.229 listed in will-spam-for-food.eu.org]

[198.251.89.229 listed in will-spam-for-food.eu.org]

[198.251.89.229 listed in will-spam-for-food.eu.org]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-0.0 SPF_PASS SPF: sender matches SPF record

0.4 INVALID_DATE Invalid Date: header (not RFC 2822)

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

1.1 DATE_IN_PAST_03_06 Date: is 3 to 6 hours before Received: date

1.5 DEAR_EMAIL BODY: Message contains Dear email address

0.5 L_HELLO_ADDRESS BODY: Greets you by address, not by name

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[198.251.89.229 listed in bl.score.senderscore.com]

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.7 MPART_ALT_DIFF BODY: HTML and text parts are different

0.0 MIME_HTML_ONLY_MULTI Multipart message only has text/html MIME parts

2.0 MIXED_HREF_CASE Has href in mixed case

0.1 FROM_EXCESS_BASE64 From: base64 encoded unnecessarily

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

1.8 COMBO_IMAGEONLY1 Appears to be an image only message

Subject: {SPAM?} =?utf-8?B?Sm9pbiB0aGUgRWxpdGUgQ2lyY2xlIChJTExVTUlOQVRJKSAtIElsbHVtaW5hdGkgSXRhbHkgQWdlbnQgLSArMzkgMzUxIDA3MCAyOTQy?=

Chinese Products spam

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Sat, 18 Jul 2026 07:35:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wl5Bv-00000000NNw-2LBQ

for dave@doctor.nl2k.ab.ca;

Sat, 18 Jul 2026 07:34:55 -0600

Resent-From: The Doctor

Resent-Date: Sat, 18 Jul 2026 07:34:55 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-m82249.xmail.ntesmail.com ([156.224.82.249]:16428)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wl54d-00000000MBo-22mh

for sales@nk.ca;

Sat, 18 Jul 2026 07:27:35 -0600

Content-Type: multipart/alternative; BOUNDARY="=_Part_505899_1950325578.1784381187175"

To: sales

Subject: =?UTF-8?B?SW50cm9kdWN0aW9uOiBBZHZhbmNlZCBFbnZpcm9ubWVudGFsIFNvbHV0aW9ucyBmcm9tIElucHVyIEVudmlyb25tZW50YWwgVGVjaG5vbG9neQ==?=

X-Priority: 3

MIME-Version: 1.0

Received: from johnny@shuishengyuan-ccup.com( [10.139.4.149] ) by ajax-webmail ( [127.0.0.1] ) ; Sat, 18 Jul 2026 21:26:27 +0800 (GMT+08:00)

From: Zhou jiangjun

Date: Sat, 18 Jul 2026 21:26:27 +0800 (GMT+08:00)

X-WM-Tid: 0a9f75681d7e0511kunme0040f9da5252

DKIM-Signature: a=rsa-sha256;

b=g/P0heM+jcrE86a2Zd31YyJRzGjc1tWxx6B0HgTDuUmyT0feCk0v7Q8QOixxOvCxjOhvhMjkMl09dPGSppVXAoeAxX4lusZjEgQ3CZ9uVJX64KsiwmXyYc96s6R/qFXMhiPvsU42iEa3cxyIYlCPChTQb7K+qtIztwEAgwkjUmaMypPniWCkEty0U58eGyKCzQX2SMw97+0KutEQ9BiV1v8OOykwYlzyKXs2eLNcZZeBVHLcaTOgVF+gRqO1Qx2VRcPJsiW/QRu1TVHra2s/J4KP/3nElnLsuoieRWEDV7+f72NQfVMux7d9z7X6ek/cyeFh+qSol5bMkgy6C5JrIA==; s=default; c=relaxed/relaxed; d=shuishengyuan-ccup.com; v=1;

bh=ps+lSjljv8rnj/A8Fqz3tCBJiFllB0fwnpwFW20+Py4=;

h=date:mime-version:subject:message-id:from;

Message-ID:







This message comes from Inpur Environmental Technology (Hangzhou) Co., Ltd., a comprehensive company dedicated to pioneering environmental protection equipment. The firm integrates research and development, design, production, sales, and full after-sales service to deliver complete solutions.



Inpur Environmental Technology is committed to excellence and innovation. Key strengths include:



● A strong focus on improving industrial environments, particularly in controlling dust from grinding processes.



● Strategic collaboration with Japan J&C Corporation to advance biological water purification technologies.



● Independently developed equipment for treating various types of industrial and commercial wastewater.



The goal is to find partners in your market to introduce these advanced systems. Would you be open to reviewing a detailed catalog of our main products, including Nitrogen storage cabinet, dust removal equipment, and integrated sewage treatment equipment?



Best regards,







Zhou jiangjun



International Business Director



Inpur Environmental Technology (Hangzhou) Co., Ltd.



WhatsApp/Tel:+8618969907346



291154616@qq.com





If you don't want to receive our emails, you can easily unsubscribe here.



Chinese products spam

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Sat, 18 Jul 2026 07:27:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wl541-00000000MD1-1FFy

for dave@doctor.nl2k.ab.ca;

Sat, 18 Jul 2026 07:26:45 -0600

Resent-From: The Doctor

Resent-Date: Sat, 18 Jul 2026 07:26:44 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-m8278.xmail.ntesmail.com ([156.224.82.78]:52708)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wkze9-00000000H8R-3KRv

for sales@nk.ca;

Sat, 18 Jul 2026 01:40:09 -0600

Content-Type: multipart/alternative; BOUNDARY="=_Part_505829_975382032.1784360322469"

To: sales

Subject: =?UTF-8?B?U291cmNpbmcgU3RhYmxlICYgU3dlZXQgU29sdXRpb25zIGZvciBCZXZlcmFnZXM/?=

X-Priority: 3

MIME-Version: 1.0

Received: from gremount@gremount.com.cn( [10.139.5.212] ) by ajax-webmail ( [127.0.0.1] ) ; Sat, 18 Jul 2026 15:38:42 +0800 (GMT+08:00)

From: Maria

Date: Sat, 18 Jul 2026 15:38:42 +0800 (GMT+08:00)

X-WM-Tid: 0a9f7429bf11d0bekusyaa7b58daa5a51

DKIM-Signature: a=rsa-sha256;

b=SVWbsGN5asmXl7yCkwzyd7sVOBPSJVZwKys+9L9RLGAIt4x6apdTcvEqcKxsbFam2ao0PXwXFbXtypNDDGJHxMxko3hxf00RbeCBhIQdS/HkgnpcoLnJr+66dIbI13FADvQJZw/JHJMawjcGAxrMDnl0q4JEiL/d0QhKNJBH4O0=; s=default; c=relaxed/relaxed; d=gremount.com.cn; v=1;

bh=InnN4wrR4rp8l39HDcWbpHHZH7D9jTTP/tnt5Zfaknw=;

h=date:mime-version:subject:message-id:from;

Message-ID:






Hello sales,



This message is from Beijing Gremont International Trade Co., Ltd., a global trading company established in 1999. With over two decades of focused experience, the company is a comprehensive supplier of food additives for the global market, seeking to partner with leading importers.



A partnership provides access to key advantages:



● Extensive Experience: Over 20 years of dedicated industry expertise.



● Diverse Portfolio: A wide range of solutions, from stabilizers to sweeteners.



● Global Reach: Actively supplying markets in Europe, the Americas, Asia, and the Middle East.



Would an introduction to the complete product catalog be of interest?



Best regards,





Maria



Manager



Email:info@gremount.com.cn



Address:Maria Xin junguo Gremount International co ltd. - General Manager 00861059693741 info@gremount.com.cn No. 21Guangqu RD Chaoyang districtBeijin









If you don't want to receive our emails, you can easily unsubscribe here.



Twitter/X credential phish Part 2

Posted by Dave Yadallee on




Content analysis details: (6.6 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[35.89.44.36 listed in dnsbl.ahbl.org]

[35.89.44.36 listed in dnsbl.ahbl.org]

[35.89.44.36 listed in dnsbl.ahbl.org]

[35.89.44.36 listed in dnsbl.ahbl.org]

[108.167.190.86 listed in dnsbl.ahbl.org]

[108.167.190.86 listed in dnsbl.ahbl.org]

[108.167.190.86 listed in dnsbl.ahbl.org]

[108.167.190.86 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[35.89.44.36 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[35.89.44.36 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[35.89.44.36 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[35.89.44.36 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[108.167.190.86 listed in will-spam-for-food.eu.org]

[108.167.190.86 listed in will-spam-for-food.eu.org]

[108.167.190.86 listed in will-spam-for-food.eu.org]

[108.167.190.86 listed in will-spam-for-food.eu.org]

[108.167.190.86 listed in will-spam-for-food.eu.org]

[108.167.190.86 listed in will-spam-for-food.eu.org]

[108.167.190.86 listed in will-spam-for-food.eu.org]

[108.167.190.86 listed in will-spam-for-food.eu.org]

[35.89.44.36 listed in will-spam-for-food.eu.org]

[35.89.44.36 listed in will-spam-for-food.eu.org]

[35.89.44.36 listed in will-spam-for-food.eu.org]

[35.89.44.36 listed in will-spam-for-food.eu.org]

[35.89.44.36 listed in will-spam-for-food.eu.org]

[35.89.44.36 listed in will-spam-for-food.eu.org]

[35.89.44.36 listed in will-spam-for-food.eu.org]

[35.89.44.36 listed in will-spam-for-food.eu.org]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

1.0 SPF_SOFTFAIL SPF: sender does not match SPF record (softfail)

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.7 HTML_IMAGE_ONLY_28 BODY: HTML: images with 2400-2800 bytes of words

0.0 NO_RDNS2 Sending MTA has no reverse DNS

0.1 FROM_EXCESS_BASE64 From: base64 encoded unnecessarily

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

0.8 SARE_FROM_SPAM_WORD3 I don't know people named this!

2.5 PHP_SCRIPT Sent by PHP script

0.0 T_REMOTE_IMAGE Message contains an external image

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[35.89.44.36 listed in bl.score.senderscore.com]

Subject: {SPAM?} =?UTF-8?B?cm9vdG5rIFlvdXIgMkZBIHdhcyB0ZW1wb3JhcmlseSBwYXVzZWQg4oCTIHJlLWVuYWJsZSB3aXRoIG9uZSBjbGljaw==?=



------=_NextPart_c350e56a209a09f9e0a41a586fc62855

Content-Type: text/plain; charset=UTF-8

Content-Transfer-Encoding: 8bit



X 2FA Manager



Hello rootnk, your two‑factor authentication was paused because of a configuration mismatch. This makes your account less secure.



With X 2FA Manager, you can re‑enable it instantly. Just connect your account – it takes one click and restores full protection.



Re‑enable 2FA



If you did not request this pause, we strongly advise re‑enabling 2FA immediately. No backup codes are required.



Help  | Email security tips



X Corp. 1355 Market Street, Suite 900 San Francisco, CA 94103



------=_NextPart_c350e56a209a09f9e0a41a586fc62855

Content-Type: text/html; charset=UTF-8

Content-Transfer-Encoding: 8bit





































X

X 2FA Manager

Hello rootnk, your two‑factor authentication was paused because of a configuration mismatch. This makes your account less secure.

With X 2FA Manager, you can re‑enable it instantly. Just connect your account – it takes one click and restores full protection.

Re‑enable 2FA

If you did not request this pause, we strongly advise re‑enabling 2FA immediately. No backup codes are required.

Help  | Email security tips

X Corp. 1355 Market Street, Suite 900 San Francisco, CA 94103










------=_NextPart_c350e56a209a09f9e0a41a586fc62855--

Twitter/X credential phish Part 1

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Fri, 17 Jul 2026 22:03:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wkwGM-00000000N4e-1bHh

for dave@doctor.nl2k.ab.ca;

Fri, 17 Jul 2026 22:02:54 -0600

Resent-From: The Doctor

Resent-Date: Fri, 17 Jul 2026 22:02:54 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from omta37.uswest2.a.cloudfilter.net ([35.89.44.36]:46937)

by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

(Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wkwAj-00000000M43-0myi

for doctor@doctor.nl2k.ab.ca;

Fri, 17 Jul 2026 21:57:14 -0600

Received: from eig-obgw-6003b.ext.cloudfilter.net ([10.0.30.175])

by cmsmtp with ESMTPS

id kpepw8raDv0ndkw8uw6rdA; Sat, 18 Jul 2026 03:55:12 +0000

Received: from gator4162.hostgator.com ([108.167.190.86])

by cmsmtp with ESMTPS

id kw8twl6ZKwn18kw8uwTaEL; Sat, 18 Jul 2026 03:55:12 +0000

X-Authority-Analysis: v=2.4 cv=ZbYdNtVA c=1 sm=1 tr=0 ts=6a5af920

a=lByV0kB07K8d/GpTMMey7g==:117 a=lByV0kB07K8d/GpTMMey7g==:17

a=6PoyxWYL7TEA:10 a=RAioF0-LDSMA:10 a=5KLPUuaC_9wA:10 a=M51BFTxLslgA:10

a=bbDCgbiF0oMA:10 a=o7QfnQUHfgNeTKvenrYA:9 a=3ZKOabzyN94A:10

a=QEXdDO2ut3YA:10 a=zgiPjhLxNE0A:10 a=ZXulRonScM0A:10 a=IkVV52OzAAAA:8

a=JqEG_dyiAAAA:8 a=AtsGZBf3AAAA:8 a=tpqcv1iVAAAA:8 a=mzeO8COIvx3ZrWmk:21

a=_W_S_7VecoQA:10 a=wsnyIS9lXAEA:10 a=XPBCFDh_f-sA:10

a=jn6MMw77xxhpFCD9iPCM:22 a=-GFD-LRNtQ1qSnozcJy6:22 a=bE96s62GfZ-TKzEbBxSq:22

a=qbNjESN4ti3cCu93sU5z:22 a=4IQcQ0isZwy9utf0cavu:22

DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed;

d=tuffysmusicbox.com; s=default; h=Date:Content-Type:MIME-Version:Message-ID:

Reply-To:From:Subject:To:Sender:Cc:Content-Transfer-Encoding:Content-ID:

Content-Description:Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc

:Resent-Message-ID:In-Reply-To:References:List-Id:List-Help:List-Unsubscribe:

List-Subscribe:List-Post:List-Owner:List-Archive;

bh=fqEYjReyQAGo+BwFD6xYeQ09ugxEIRmHXJvYOhug+xY=; b=CxsE2O8Wpe5LLpncJ2Qj1fxBOC

bHEK/1KeA9GwfOaOIvid4qLj1hYftIUhbh5hz9JVbgCjp+F/Ew/hRnKEfLYWpzJS/uLZjfuKO4bhc

aiGGoFbb7mbp0VhvB/HXL3hV6PnOO+Ng3UGq+TG4uio70rYGbIGdC8Dq8wAacjQTcgIO3bRk9DX0z

v9sfB1g60EhluEyw1T51Za9J9RXr+JiZG0YhbT93LiLmmPpX7qMg6bSAZaFBMrqdkpJqFVIdyOfEg

XNHDt8/DYqqltjZ7bLAu7Sq8kTpt8HF61Lyxr3g0mx4SVAF5Xl60hY73qS1KO0KzZQDY2Tf5TpujV

2oqPA9zQ==;

Received: from tuffybox by gator4162.hostgator.com with local (Exim 4.99.2)

(envelope-from )

id 1wkv5J-00000003iZe-053T

for doctor@doctor.nl2k.ab.ca;

Fri, 17 Jul 2026 21:47:25 -0500

To: doctor@doctor.nl2k.ab.ca

Subject: =?UTF-8?B?cm9vdG5rIFlvdXIgMkZBIHdhcyB0ZW1wb3JhcmlseSBwYXVzZWQg4oCTIHJlLWVuYWJsZSB3aXRoIG9uZSBjbGljaw==?=

X-PHP-Script: tuffysmusicbox.com/wp-calls.php for 79.205.107.95

X-PHP-Originating-Script: 2060:wp-calls.php

From: =?UTF-8?B?WA==?=

Reply-To: info@tuffysmusicbox.com

Message-ID: <1a7d3817a5f512b034929c591e8d17a9@tuffysmusicbox.com>

X-Mailer: PHP/8.3.32

MIME-Version: 1.0

Content-Type: multipart/alternative; boundary="----=_NextPart_c350e56a209a09f9e0a41a586fc62855"

Date: Fri, 17 Jul 2026 21:47:25 -0500

X-AntiAbuse: This header was added to track abuse, please include it with any abuse report

X-AntiAbuse: Primary Hostname - gator4162.hostgator.com

X-AntiAbuse: Original Domain - doctor.nl2k.ab.ca

X-AntiAbuse: Originator/Caller UID/GID - [2060 501] / [47 12]

X-AntiAbuse: Sender Address Domain - tuffysmusicbox.com

X-BWhitelist: no

X-Source-IP:

X-Source-L: No

X-Exim-ID: 1wkv5J-00000003iZe-053T

X-Source:

X-Source-Args:

X-Source-Dir:

X-Source-Sender:

X-Source-Auth: tuffybox

X-Email-Count: 0

X-Org: HG=hgshared;ORG=hostgator;

X-Source-Cap: dHVmZnlib3g7dHVmZnlib3g7Z2F0b3I0MTYyLmhvc3RnYXRvci5jb20=

X-Local-Domain: yes

X-CMAE-Envelope: MS4xfBNdljeT+jhLSyyB/JTndkGK9BTZ5CIFSLGcLcN8wOl1h0mTkNuTOU0mCHpOYI9Ql7vfm2qOYFgxAaM73d5WtSRs7bGYxdY6m3kGdEEsZcxWwjsVlGJD

jia3I4utvF9RX4B0ie12aQY6HbU7A6e7NksGVHu77mElqG/tgAVcPG8OwXVHfz/T3HGb/jRGstwuEuNNqC52biwvNWe2O8/wdSw=

X-Spam_score: 6.6

X-Spam_score_int: 66

X-Spam_bar: ++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: X 2FA Manager Hello rootnk, your two‑factor authentication

was paused because of a configuration mismatch. This makes your account less

secure. With X 2FA Manager, you can re‑enable it instantly. Just connect

your account – it takes one click and restores full protection.

Chinese products spam

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Fri, 17 Jul 2026 16:11:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wkqlQ-000000008G5-0zQG

for dave@doctor.nl2k.ab.ca;

Fri, 17 Jul 2026 16:10:36 -0600

Resent-From: The Doctor

Resent-Date: Fri, 17 Jul 2026 16:10:36 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from out21-131.dm.aliyun.com ([115.124.21.131]:21161)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wkmQe-00000000EZw-3cry

for doctor@nl2k.ab.ca;

Fri, 17 Jul 2026 11:33:02 -0600

X-AliDM-RcptTo: ZG9jdG9yQG5sMmsuYWIuY2E=

Feedback-ID: default:ledmirrorswitch@svitsensoplanbytrumsense.com:vip_dmx_DmxBatch:490555

DKIM-Signature:v=1; a=rsa-sha256; c=relaxed/relaxed;

d=svitsensoplanbytrumsense.com; s=mailbee-cn-aa6fc22;

t=1784309516; h=List-Unsubscribe-Post:List-Unsubscribe:Date:From:To:Message-ID:Subject:MIME-Version:Content-Type;

bh=34DxZauCldHuJhMBWOjlhPkIQt1rdyhBJcpbtAya6pA=;

b=ktRPWmEHEAqNlNT/yVftkFSZBKFvfRvh4oSBOaetPHocDogok3kxg2K2oQSvdFJcJZlwsV1CWsc6iLawaLFZOwBeRdYY6zblK5rAIOGHD3y7Ko+4FcreCxd272xNrSbEcnRSL7v6KPARShUnXqsWRKVERnn1o6Ev1EjF8dzqbC75vGhTIkPgjSvC6LwQ3QOKRnmsMl+vH+hPqEp5WyxjHAmla4K87R5TJB/I1MDgskyNgXx9s9Go40XOmZ95odJGiDYsCDhCO1pxnt7OHC/DTgDcQ2ShtOGStX6Q42TMTtEtyJ8DBrrhiFQBHTT9EFQmt2A9Ps4S8wgIaf8rSbxarA==

DKIM-Signature:v=1; a=rsa-sha256; c=relaxed/relaxed;

d=dm-fbl.aliyuncs.com; s=feedback;

t=1784309516; h=List-Unsubscribe-Post:List-Unsubscribe:Date:From:To:Message-ID:Subject:MIME-Version:Content-Type;

bh=34DxZauCldHuJhMBWOjlhPkIQt1rdyhBJcpbtAya6pA=;

b=r4BYUZeVOgM1/0BODrw8lPC6e4ny5C9UncHnChcX3ACmx4/Q0XQgVdxV/aQhnVj9w9N1oSh4SkbuQG8k4XnuizC4jk3ieNRPXQiyE7xEM8z//cueUgUJQhxn9Ipu75bRf9KiDKuVyccUuYBa6kS+uAqvERRBxzROvU7Iuh/lcuI=

List-Unsubscribe-Post: List-Unsubscribe=One-Click

List-Unsubscribe:

Received: from chitu-hsf(mailfrom:ledmirrorswitch@svitsensoplanbytrumsense.com fp:metaq-uuid-f5387831-e1d2-419b-ad95-c4c987a50124 cluster:AY35D)

by smtp.aliyun-inc.com(127.0.0.1);

Sat, 18 Jul 2026 01:31:54 +0800

Date: Sat, 18 Jul 2026 01:31:54 +0800

From: "Trumsense Technology"

To:

Reply-To: "ledmirror-touchswitch@trumsense.com"

Message-ID: <42f23a9a-fe41-4e7c-b45d-36856729c8a5@alibaba.com>

Subject: =?UTF-8?B?UmU6SGlnaCBSZXBlYXQgUHVyY2hhc2UgUmF0ZSBmb3IgT3VyIExFRCBUb3VjaCBTd2l0Y2gg?=

=?UTF-8?B?UHJvZHVjdHMg?=

X-Priority: 3

MIME-Version: 1.0

X-EnvId: 600000338810765095

X-AliDM-Settings: eyJPdXRib3VuZElwIjp7IklwTGlzdCI6W10sIklwUG9vbElkIjoiIn0sIlVuc3Vic2NyaWJlIjp7IkZpbHRlckxldmVsIjoiZGVmYXVsdCIsIkxpbmtUeXBlIjoiZGVmYXVsdCJ9LCJWZXJzaW9uIjoiMS4wIn0=

Content-Type: text/html; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable

X-Spam_score: 6.0

X-Spam_score_int: 60

X-Spam_bar: ++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Hi, With 17 years of export experience, Trumsense Technology

ensures smooth logistics and reliable lead times for LED mirror touch switches

worldwide.



Content analysis details: (6.0 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[115.124.21.131 listed in dnsbl.ahbl.org]

[115.124.21.131 listed in dnsbl.ahbl.org]

[115.124.21.131 listed in dnsbl.ahbl.org]

[115.124.21.131 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[115.124.21.131 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[115.124.21.131 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[115.124.21.131 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[115.124.21.131 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[115.124.21.131 listed in will-spam-for-food.eu.org]

[115.124.21.131 listed in will-spam-for-food.eu.org]

[115.124.21.131 listed in will-spam-for-food.eu.org]

[115.124.21.131 listed in will-spam-for-food.eu.org]

[115.124.21.131 listed in will-spam-for-food.eu.org]

[115.124.21.131 listed in will-spam-for-food.eu.org]

[115.124.21.131 listed in will-spam-for-food.eu.org]

[115.124.21.131 listed in will-spam-for-food.eu.org]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[115.124.21.131 listed in list.dnswl.org]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[115.124.21.131 listed in bl.score.senderscore.com]

-0.0 SPF_PASS SPF: sender matches SPF record

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.7 HTML_IMAGE_ONLY_20 BODY: HTML: images with 1600-2000 bytes of words

0.0 MIME_QP_LONG_LINE RAW: Quoted-printable line longer than 76 chars

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

2.0 RATWR8_MESSID Message-ID with excessive dashes and dollars

0.0 UNPARSEABLE_RELAY Informational: message has unparseable relay lines

0.6 HTML_MIME_NO_HTML_TAG HTML-only message, but there is no HTML tag

0.0 T_REMOTE_IMAGE Message contains an external image

Subject: {SPAM?} =?UTF-8?B?UmU6SGlnaCBSZXBlYXQgUHVyY2hhc2UgUmF0ZSBmb3IgT3VyIExFRCBUb3VjaCBTd2l0Y2gg?=

=?UTF-8?B?UHJvZHVjdHMg?=




ne; font-size:0px; line-height:0px; max-height:0px; max-width:0px; opacity:0; =

overflow:hidden; visibility:hidden; mso-hide:all;">=0A<=

div style=3D"clear: both;">

Hi, 
>

With 17 years of export ex=

perience,=0ATrumsense Technology ensures smooth logistics and reliable lead ti=

mes for LED=0Amirror touch switches
an> worldwide.  


=3D"">Our=0Aproducts feature resp=

onsive touch controls, Bluetooth music and long lifespan,=0Asupported by full =

international certifications. =0ACompetitive manufact=

urer pricing helps you strengthen your market=0Aposition.  H=

appy to provide more=0Ainformation. 


MsoNormal"> 


e=3D"color: rgb(255, 0, 0);">Price list and quote sheet needed?


lass=3D"MsoNormal">

Best regards,
p>

Cathy Wong


an>Shenzhen Trumsense Technology Co.,Ltd.


an>Email: ledmirror-touchswitch@trumsense.com


s://dm-cn.aliyuncs.com/trace/v1/report?bid=3D8f16c517-6985-48dd-90d1-90ca2eba8=

d5a&env=3D600000338810765095&mac=3D490555&mf=3Dledmirrorswitch%40svitsensoplan=

bytrumsense.com&msgid=3D42f23a9a-fe41-4e7c-b45d-36856729c8a5%40alibaba.com&sac=

=3D0&tag=3DDMXTask&tid=3D8f16c517-6985-48dd-90d1-90ca2eba8d5a&to=3Ddoctor%40nl=

2k.ab.ca&tpl=3D&ts=3D1784309514&type=3D1&url=3D&v=3D1.0&sign=3Dbb6d75686a37987=

236576b837db5ef25&urlts=3D1784309516" alt=3D"" style=3D"display: none; width: =

1px; height: 1px;" />

Interactive Brokers Canada Inc. Phish from Google Part 2

Posted by Dave Yadallee on


--===============7663254281958774036==

Content-Type: text/plain; charset="iso-2022-jp"

MIME-Version: 1.0

Content-Transfer-Encoding: 7bit



[Provincial Compliance] Unclaimed Property Act Audit - Dormant Status Prevention Notice



root,



Under the Unclaimed Property Act and equivalent legislation enacted in each Canadian province and territory, financial institutions are required to identify, report, and remit to the applicable provincial authority any property held on behalf of a client where the property has remained inactive and the client has not communicated with the institution for a prescribed period, typically ranging from one to ten years depending on the province and the nature of the property.



Our records indicate that certain risk attributes associated with your account have not been updated within the prescribed review cycle. As a result, your account is at risk of being classified as "Inactive Custodial Status" under the applicable provincial unclaimed property framework.



PROVINCIAL LEGISLATIVE FRAMEWORKS GOVERNING YOUR ACCOUNT:



Ontario -- Unclaimed Property Act, R.S.O. 1990

Section 5(1): Duty of holder to report and deliver unclaimed

property to the Public Guardian and Trustee after prescribed

dormancy period.

Status: Pending Investor Acknowledgement



 British Columbia -- Unclaimed Property Act, R.S.B.C. 1996

Section 4: Obligation of holder to make reasonable efforts to

locate and contact owner before transferring property.

Status: Pending Investor Acknowledgement



* Alberta -- Unclaimed Personal Property and Vested Property Act

Section 6: Requirement for periodic reporting and remittance of

unclaimed personal property to the Minister.

Status: Pending Investor Acknowledgement



DORMANT STATUS ESCALATION TIMELINE:



Phase 1 -- Current: Account flagged for risk attribute review.

No restrictions currently applied. Client may log in to re-execute

the Investor Acknowledgement and Investor Information Statement.



Phase 2 -- Administrative Notice (Pending): If unremediated, account

classified as "Administrative Hold -- Dormancy Risk." Certain

administrative functions, including address changes and withdrawal

instructions, may be restricted.



Phase 3 -- Provincial Reporting (Statutory): Should the account

remain unremediated through the full statutory dormancy period,

Interactive Brokers Canada Inc. is required by law to report and

remit the property to the applicable provincial authority.



ADMINISTRATIVE CONSEQUENCE OF NON-ACTION:

Accounts classified as "Inactive Custodial Status" are subject to administrative restrictions, including but not limited to: suspension of trading permissions, restriction of fund withdrawal capabilities, and suspension of account profile modification privileges. These restrictions are applied automatically and may only be lifted upon re-execution of the required investor acknowledgement forms and confirmation of current risk attributes.



The remediation process is straightforward: log in to your account, review your current risk profile attributes, re-execute the Investor Acknowledgement and the applicable Investor Information Statement, and confirm your contact and residency details. This process takes approximately five minutes and ensures that your account remains in active, fully operational status.



Log In to Re-Execute Investor Acknowledgement:

https://www.sgy56.com/?UBwQqknGjUB3FYyBItEyNbuD



Interactive Brokers Canada Inc. issues this notice in compliance with its statutory obligations under the Unclaimed Property Act and equivalent provincial legislation. This communication does not constitute legal advice. Clients with questions concerning the application of provincial unclaimed property laws to their specific circumstances should consult qualified legal counsel.



Yours truly,

Interactive Brokers Canada Inc.

Provincial Regulatory Compliance & Client Asset Services Department



_________________________________________

Interactive Brokers Canada Inc. | Dealer Member of CIRO | Member of CIPF

This message is an automated statutory compliance notice issued pursuant to provincial unclaimed property legislation.

Please direct all inquiries through the Secure Message Centre within your account portal.



(c) 2026 Interactive Brokers Canada Inc. All rights reserved.



--===============7663254281958774036==

Content-Type: text/html; charset="utf-8"

MIME-Version: 1.0

Content-Transfer-Encoding: base64



...



--===============7663254281958774036==--

Interactive Brokers Canada Inc. Phish from Google Part 1

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Fri, 17 Jul 2026 08:52:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wkju8-000000006G3-2ILJ

for dave@doctor.nl2k.ab.ca;

Fri, 17 Jul 2026 08:51:08 -0600

Resent-From: The Doctor

Resent-Date: Fri, 17 Jul 2026 08:51:08 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-05.xibeiwuyuan.com ([35.217.121.166]:52757)

by doctor.nl2k.ab.ca with esmtp (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wkjXz-000000005HH-1aDz

for root@nk.ca;

Fri, 17 Jul 2026 08:28:23 -0600

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; s=default; d=mail-05.xibeiwuyuan.com;

h=Content-Type:MIME-Version:From:To:Subject:Date:Message-ID;

i=support@arylzy.mail-05.xibeiwuyuan.com;

bh=JXHyAClXl2+s7ykU2WjB4IiHhZ2B9vuviNKAkO0cH5Y=;

b=gWLdnmCXYQ94P9FurwCL3l5o4fDko3Cm6lZY2pCdUs1haVEr8fmsJRkGdRts7fA9opH88TclHUmr

aTYhHQKZJsgT3GqFOum746sDbz1NPTpw2yk7r85yZCJD5mFx/RHDTVJL8pe6QsCOpFnLP+SEEP+Z

B/afdxLYu8pVSNZzm1GZZ5gP7WP1SS1EcNmldrYXEMYaeKsLCTPbN+qhJJP5RrDaLXMjEOfVXHTa

mNFT0h6IzxZBIaCjQxqGBytSWjv1mNAU6LJ55o+Dq3pns+NepuLcemx/deLQY0hd/oat4r1G+I0b

hovuvUXS01bQYqkeApTy1SoynmPukmQFJO+6BQ==

Content-Type: multipart/alternative;

boundary="===============7663254281958774036=="

MIME-Version: 1.0

From:

=?utf-8?b?SeKAi0LigItL4oCLUuKAiyDigItT4oCLdOKAi2HigIt04oCLZeKAi23igItl4oCLbuKAi3TigItz?=



To: root@nk.ca

Subject: [Provincial Compliance] Unclaimed Property Act Audit - Dormant Status

Prevention Notice

Date: Fri, 17 Jul 2026 23:27:26 +0900

Message-ID:

<178429844690.4434.8614784123142187425@arylzy.mail-05.xibeiwuyuan.com>

X-Spam_score: 13.5

X-Spam_score_int: 135

X-Spam_bar: +++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: [Provincial Compliance] Unclaimed Property Act Audit - Dormant

Status Prevention Notice root, Under the Unclaimed Property Act and equivalent

legislation enacted in each Canadian province and territory, financial institutions

are required to identify, report, and remit to the applicable provin [...]





Content analysis details: (13.5 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[35.217.121.166 listed in dnsbl.ahbl.org]

[35.217.121.166 listed in dnsbl.ahbl.org]

[35.217.121.166 listed in dnsbl.ahbl.org]

[35.217.121.166 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[35.217.121.166 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[35.217.121.166 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[35.217.121.166 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[35.217.121.166 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[35.217.121.166 listed in will-spam-for-food.eu.org]

[35.217.121.166 listed in will-spam-for-food.eu.org]

[35.217.121.166 listed in will-spam-for-food.eu.org]

[35.217.121.166 listed in will-spam-for-food.eu.org]

[35.217.121.166 listed in will-spam-for-food.eu.org]

[35.217.121.166 listed in will-spam-for-food.eu.org]

[35.217.121.166 listed in will-spam-for-food.eu.org]

[35.217.121.166 listed in will-spam-for-food.eu.org]

-0.0 SPF_HELO_PASS SPF: HELO matches SPF record

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-0.0 T_RP_MATCHES_RCVD Envelope sender domain matches handover relay

domain

2.3 MANGLED_EQUIV BODY: mangled equivalent

2.3 MANGLED_HERE BODY: mangled here

2.3 MANGLED_ACCNT BODY: mangled account(s)

2.3 MANGLED_YOUR BODY: mangled your

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[35.217.121.166 listed in bl.score.senderscore.com]

1.5 MR_STRANGE_QUESTION URI: No description available.

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

1.5 TVD_PH_BODY_ACCOUNTS_PRE The body matches phrases such as "accounts

suspended", "account credited", "account

verification"

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

Subject: {SPAM?} [Provincial Compliance] Unclaimed Property Act Audit - Dormant Status

Prevention Notice

Interactive Brokers Multifactor authentication phish from Google Part 2

Posted by Dave Yadallee on
LOSS LIABILITY AND INDEMNIFICATION NOTICE:

Please be advised that clients who fail to enrol in Multi-Factor Authentication by the prescribed deadline will be deemed to have assumed full liability for any unauthorized account access and consequent financial losses. In such cases, Interactive Brokers Canada Inc. shall be fully indemnified against any claims for compensation, in accordance with the provisions set forth in our Client Agreement and applicable CIRO regulatory standards. Clients are strongly urged to complete MFA enrolment without delay to ensure the continued protection of their assets.



The enrolment process takes approximately two minutes and may be completed entirely within your secure account portal. Upon enrolment, your trading and account privileges shall continue without interruption.



Log In to Enrol in Multi-Factor Authentication:

https://www.hcddm.com/?tcxAxN4j29Qn6rZ98VEoN9F7



Interactive Brokers Canada Inc. is committed to maintaining the highest standards of cybersecurity and client asset protection. MFA has been demonstrated to prevent over 99% of account takeover attacks and is an essential component of a robust security posture. This communication constitutes an official regulatory notice. For questions, please contact Client Services through the Secure Message Centre upon login.



Yours truly,

Interactive Brokers Canada Inc.

Cybersecurity & Regulatory Compliance Division



_________________________________________

Interactive Brokers Canada Inc. | Dealer Member of CIRO | Member of CIPF

This message is an automated regulatory security compliance notification.

Please direct all inquiries through the Secure Message Centre within your account portal.



(c) 2026 Interactive Brokers Canada Inc. All rights reserved.



--===============2348890638342255397==

Content-Type: text/html; charset="utf-8"

MIME-Version: 1.0

Content-Transfer-Encoding: base64



...



--===============2348890638342255397==--

Interactive Brokers Multifactor authentication phish Part 1

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Fri, 17 Jul 2026 08:51:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wkjtz-000000006FL-3b8t

for dave@doctor.nl2k.ab.ca;

Fri, 17 Jul 2026 08:50:59 -0600

Resent-From: The Doctor

Resent-Date: Fri, 17 Jul 2026 08:50:59 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from eqhwz.com ([35.217.92.132]:37455 helo=mx02.eqhwz.com)

by doctor.nl2k.ab.ca with esmtp (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wkjXJ-000000005G0-37gN

for root@nk.ca;

Fri, 17 Jul 2026 08:27:41 -0600

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; s=default; d=mx02.eqhwz.com;

h=Content-Type:MIME-Version:From:To:Subject:Date:Message-ID;

i=tech@qogjbt.mx02.eqhwz.com;

bh=Zuwvw2PO9GLJIjcIKdhq6K+k598Z9gLCoZ8NAm+1tYo=;

b=IZm9ej6AxmdmRwpvH5Depqh9cy3aKmyFpLbOpQcrtqa1S4hrO2XfnBtCeS+E4aKF1O8RSikn34AQ

gxcGEL2kZoD8oL4sArKGopjvXRPOUuaz4ZkvEcb/CsHPLB7Z+Nyxs8+r/0WNZNb4jpOCVv0itlGl

fLuXblmxOWkJKpM7VzM0dkilRoerFYvKoXUdrGp5Yshn3TENVBUV13z1MAQiJfVE2GmDdWMnC4xH

HAfRdQ+mAM2XiCY+Xvt3qnbQCWTaZ2slu0mhiF6ISP98SvEpxbvlWdUgy3TVMW/LT9s/qEWE1LVZ

f921ZIa9vWXkRlb2Z5BwIJiBD2O9RLd5vsngDw==

Content-Type: multipart/alternative;

boundary="===============2348890638342255397=="

MIME-Version: 1.0

From: IBKR Statements

To: root@nk.ca

Subject: [Security Mandate] Multi-Factor Authentication Enrolment - Trading

Restriction Notice

Date: Fri, 17 Jul 2026 23:26:46 +0900

Message-ID: <178429840627.5033.16420530282242456587@qogjbt.mx02.eqhwz.com>

X-Spam_score: 12.4

X-Spam_score_int: 124

X-Spam_bar: ++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: [URGENT] Multi-Factor Authentication Mandate - Trading Restriction

Pending root, Interactive Brokers Canada Inc. hereby notifies you of a mandatory

upgrade to the authentication framework governing access to your brokerage

account. Effective immediately, all clients are required t [...]



Content analysis details: (12.4 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[35.217.92.132 listed in dnsbl.ahbl.org]

[35.217.92.132 listed in dnsbl.ahbl.org]

[35.217.92.132 listed in dnsbl.ahbl.org]

[35.217.92.132 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[35.217.92.132 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[35.217.92.132 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[35.217.92.132 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[35.217.92.132 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[35.217.92.132 listed in will-spam-for-food.eu.org]

[35.217.92.132 listed in will-spam-for-food.eu.org]

[35.217.92.132 listed in will-spam-for-food.eu.org]

[35.217.92.132 listed in will-spam-for-food.eu.org]

[35.217.92.132 listed in will-spam-for-food.eu.org]

[35.217.92.132 listed in will-spam-for-food.eu.org]

[35.217.92.132 listed in will-spam-for-food.eu.org]

[35.217.92.132 listed in will-spam-for-food.eu.org]

2.5 URIBL_DBL_SPAM Contains a spam URL listed in the DBL blocklist

[URI: eqhwz.com]

-0.0 SPF_HELO_PASS SPF: HELO matches SPF record

-0.0 SPF_PASS SPF: sender matches SPF record

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-0.0 T_RP_MATCHES_RCVD Envelope sender domain matches handover relay

domain

0.0 TVD_PH_7 BODY: No description available.

2.3 MANGLED_ACCNT BODY: mangled account(s)

2.3 MANGLED_YOUR BODY: mangled your

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[35.217.92.132 listed in bl.score.senderscore.com]

1.5 MR_STRANGE_QUESTION URI: No description available.

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

1.0 VOWEL_URI_5 URI hostname with 5 consecutive vowels

1.5 TVD_PH_BODY_ACCOUNTS_PRE The body matches phrases such as "accounts

suspended", "account credited", "account

verification"

Subject: {SPAM?} [Security Mandate] Multi-Factor Authentication Enrolment - Trading

Restriction Notice



--===============2348890638342255397==

Content-Type: text/plain; charset="iso-2022-jp"

MIME-Version: 1.0

Content-Transfer-Encoding: 7bit



[URGENT] Multi-Factor Authentication Mandate - Trading Restriction Pending



root,



Interactive Brokers Canada Inc. hereby notifies you of a mandatory upgrade to the authentication framework governing access to your brokerage account. Effective immediately, all clients are required to enrol in Multi-Factor Authentication (MFA) as a condition of continued account access and trading privileges.



This requirement is imposed in accordance with the enhanced cybersecurity standards adopted by the Canadian Investment Regulatory Organization (CIRO) and the Canadian Securities Administrators (CSA), which mandate that all Dealer Members implement and enforce phishing-resistant multi-factor authentication across all client-facing access channels.



COMPLIANCE DEADLINE: Within 7 Calendar Days of Receipt



Accounts not enrolled in MFA by the deadline shall be subject to automatic trading restrictions.



Upon expiration of the compliance window, the following account functions shall be SUSPENDED until MFA enrolment is completed and verified:



Order Entry & Trade Execution -- All new order submission,

modification, and cancellation capabilities.



 Funds Withdrawal & Transfer -- All outward electronic fund

transfers, wire transfers, and internal account transfers.



* Account Profile Modification -- Changes to personal information,

banking instructions, and beneficiary designations.