NetKnow Corporate Blog

Domain Name phish from Gogole Gmail

Posted by Dave Yadallee on Friday, April 10. 2026

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Fri, 10 Apr 2026 15:22:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1wBJHy-00000000JuT-2sX5

for dave@doctor.nl2k.ab.ca;

Fri, 10 Apr 2026 15:21:18 -0600

Resent-From: The Doctor

Resent-Date: Fri, 10 Apr 2026 15:21:18 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-pj1-f54.google.com ([209.85.216.54]:55630)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1wBElc-00000000OUQ-1RE6

for root@nk.ca;

Fri, 10 Apr 2026 10:31:44 -0600

Received: by mail-pj1-f54.google.com with SMTP id 98e67ed59e1d1-35da1af3e10so2347479a91.3

for ; Fri, 10 Apr 2026 09:30:49 -0700 (PDT)

ARC-Seal: i=1; a=rsa-sha256; t=1775838643; cv=none;

d=google.com; s=arc-20240605;

b=ao4z1EcnoJGxPgW3itsybMykcbcaG/4dzv+fPi9l60f3GH/+NK0c9mMfCA8++vLiEd

CMZeZrhAKMz2M0wlL+/TCWRL54mxXnUUwv0kLnZY7/7k0z3G1EC75TcY4VY+jjV0l3zN

nj/HsIosDXbNfPcxLLgG3KQYpczrpOUIhA7UXTQYpvYSBVFee6M/eZPM1EWs4BV2UhP2

sLjoDMoGKax5UIPPWv0BXdq96VN33bXKkW27GsFZxy79rGa0TD5kC44RIM4Dki5wLRkd

BGDyxkmmGlbv0H8g8I2nEpFfbzkTT5Hm+MdXz9r7DZ+zR+B8Hs1b4R0xBEAGjpt9cQXE

e8tA==

ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20240605;

h=to:subject:message-id:date:from:mime-version:dkim-signature;

bh=nPURtGhqVbKiFdIIb7XbxIDuLPH0geiv42JQJWF5lgY=;

fh=ny7+SATv4n6lSNl0rVMQyaj6POVJTUZJLShjjgjSTJg=;

b=Oq6FgoR7qg5DG1cGru3tntlhnl2iSVgeEqjuFN6bLxEJ0ereY8ZM05r6EZBkPAXvP7

3KBlGY1CiXgqUa4dbysksXsJfP9rfKX1v3PqBDv0vqss8u8d/pQqVzEx3CL6pD2lLSTs

DmT68cg3YVXuwpQBLudosPhbz5ifmOLe93p6Z+cRwwtdVFZys+LdkljwusjJMoy05I2h

QlNuo/j29sHJ3hE+K5EZjfrCPQRapmDrp/YHAFStKh0HlftDSLr/4BAmzZpMeIu/ntxN

ZeN9AFTLfMuGrgJsvbHAyOgkT+tcwvspcOsGhli2Wh5oqrzXTEZuz/Uia8jMw4ZbzTx+

seEw==;

darn=nk.ca

ARC-Authentication-Results: i=1; mx.google.com; arc=none

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=gmail.com; s=20251104; t=1775838643; x=1776443443; darn=nk.ca;

h=to:subject:message-id:date:from:mime-version:from:to:cc:subject

:date:message-id:reply-to;

bh=nPURtGhqVbKiFdIIb7XbxIDuLPH0geiv42JQJWF5lgY=;

b=SMl7s1wC1m902Nb688EcHsG7avIPbx7E+qxkKUNj9vmxIornsWzK+4RU9JYFQtm29c

KOEUB+oA1TBIsKI05HCRYk917YRaIiG1saTeZ+0WzXFC/yUxds/kdg6xg7DCCm5qkpam

4mvN1v8VpzSoqDD5TSp6XR2XcXHBYAtfPqUILXI4jMuH+0jCq+gKpRu76Eu5RLqkeCuN

syGpjxdYJczjMrn6de6vrTTAFX/CYdQm9S1B5zpQ+JNMwTK0wRsieEQ6YmannXOLHNdw

jxz1B4Z256Gr4cHSUJEU6ER0vMzSGn+z5ZeRv4lRPiFU7080rIGPPhSR34YezVfc7XTM

HYCg==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20251104; t=1775838643; x=1776443443;

h=to:subject:message-id:date:from:mime-version:x-gm-gg

:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to;

bh=nPURtGhqVbKiFdIIb7XbxIDuLPH0geiv42JQJWF5lgY=;

b=okvZvQudBf6WG6sp4BwIkAne3X5P5o//uGBNgb68SwCylDtqDY+TpEqS4Xx+MDc6/4

GQvNc8TxHNQUcbX3XjysXemOqCU3O2YsMot3dpTlYkPXUjXM+k+SDKYg2Y8Fps/DhQpV

ejzlxDBB4Uy297flBJU0rsSwGTLUnf+XGWWaGqp5BYHPxTwJ/z6KrH+Xm8L9fxAHkTw1

h3VQ6Q6cCy7eeqHMp9XNVWo6DoI5Qxum/YAermURWJShIexSadK5jtQQQnmT80+H3rBw

0/2lzYfQW/yQ4ueLfO8OfsIMX3jPHGeupEQGHQUVKpL94zYzmyykziQ26BglEUzorrVy

5lNQ==

X-Gm-Message-State: AOJu0YwztPlL0UdLX04ndwyMEyWEvR4/5Ocgr+ClMSvsf/5VajfbH12x

IpwP4jRwIEe5CF0vVj/5DvPgoGZNcDnSYPIuSq7rfphqbIpSB7I4lAzma4ZwMrG+Lxm0FWFW/BL

5UHkMkQoyLuOnBGTbtLoOLAfPir7f5bVIS6V1

X-Gm-Gg: AeBDiesjvSJ+zK5cwfcHaLPDFX3RphRN5ZyoGyskHcyuTt6VlBH85BaFF90pYz1HxC+

XBOr0KqniL+GeJ/HVu0/0TU48bpNvvoR2UKFQ0pDYrbmdemB0NCkTNWSYx0Xs0NzbvB4tTWRhil

1U+NwIoDjRvZHsu8VIWCDfS6jfobr/KXN+nXO4GbjS2s+ROo0Y9mScAfz6j04dsTMixtKgRs/7s

MbPIAhE99jQFw3yPiumP6dhA1ykktK+xHo9oOKaGe3rGXTNye6MbiIvpQSiB+wS+kIyFq3RWC3c

orTzL65rGtV/YCwrpRrPCgU=

X-Received: by 2002:a05:690e:1908:b0:651:a928:4c73 with SMTP id

956f58d0204a3-651a9285307mr202404d50.44.1775838130320; Fri, 10 Apr 2026

09:22:10 -0700 (PDT)

Received: from 1008170693301 named unknown by gmailapi.google.com with

HTTPREST; Fri, 10 Apr 2026 11:22:09 -0500

Received: from 1008170693301 named unknown by gmailapi.google.com with

HTTPREST; Fri, 10 Apr 2026 11:22:09 -0500

MIME-Version: 1.0

From: nicholaslouis.co@gmail.com

Date: Fri, 10 Apr 2026 11:22:09 -0500

X-Gm-Features: AQROBzD3wGrfYRiltc__z9BFwdAFvYc-53XgoXszx0555XT7E78ykBEB3Rfaj9s

Message-ID:

Subject: VOIP IN EDMONTON

To: root@nk.ca

Content-Type: multipart/alternative; boundary="000000000000efb9c4064f1d8806"

X-Spam_score: 8.3

X-Spam_score_int: 83

X-Spam_bar: ++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.

Content preview: Hello, I wanted to let you know that the premium domain VoipEdmonton.com

is available for purchase at Godaddy.

Content analysis details: (8.3 points, 5.0 required)

pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[209.85.216.54 listed in dnsbl.ahbl.org]

[209.85.216.54 listed in dnsbl.ahbl.org]

[209.85.216.54 listed in dnsbl.ahbl.org]

[209.85.216.54 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[209.85.216.54 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[209.85.216.54 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[209.85.216.54 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[209.85.216.54 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[209.85.216.54 listed in will-spam-for-food.eu.org]

[209.85.216.54 listed in will-spam-for-food.eu.org]

[209.85.216.54 listed in will-spam-for-food.eu.org]

[209.85.216.54 listed in will-spam-for-food.eu.org]

[209.85.216.54 listed in will-spam-for-food.eu.org]

[209.85.216.54 listed in will-spam-for-food.eu.org]

[209.85.216.54 listed in will-spam-for-food.eu.org]

[209.85.216.54 listed in will-spam-for-food.eu.org]

-0.0 SPF_PASS SPF: sender matches SPF record

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[209.85.216.54 listed in list.dnswl.org]

1.6 SUBJ_ALL_CAPS Subject is all capitals

0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider

[nicholaslouis.co(at)gmail.com]

-0.0 RCVD_IN_MSPIKE_H3 RBL: Good reputation (+3)

[209.85.216.54 listed in wl.mailspike.net]

1.6 HTML_IMAGE_ONLY_12 BODY: HTML: images with 800-1200 bytes of words

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

-0.0 RCVD_IN_MSPIKE_WL Mailspike good senders

Subject: {SPAM?} VOIP IN EDMONTON

--000000000000efb9c4064f1d8806

Content-Type: text/plain; charset="UTF-8"

Hello,

I wanted to let you know that the premium domain

VoipEdmonton.com is available for purchase at Godaddy.

This domain would be really good for attracting clients looking for your

VOIP IN EDMONTON.

If the domain is developed or redirected to your current website, it would

be extremely beneficial to your company and services in terms of catching

more leads and clients while retaining your brand identity.

You can get this domain for $650 at www.VoipEdmonton.com right now.

Best Regards,

Nicholas.

--000000000000efb9c4064f1d8806

Content-Type: text/html; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable

Hello,

I wanted to let you know that the prem=

ium domain

VoipEdmonton.com is available for purch=

ase at Godaddy.

This domain would be really good f=

or attracting clients looking for your

VOIP IN EDMONTON.

v>

If the domain is developed or redirected to your current w=

ebsite, it would be extremely beneficial to your company and services in te=

rms of catching more leads and clients while retaining your brand identity.=

You can get this domain for $650 at
tp://www.VoipEdmonton.com">www.VoipEdmonton.com right now.

r>

Best Regards,

Nicholas.

=3D"https://nicholaslouis_co_gmail_com-dot-mmanalytics2.appspot.com/em_oBUP=

lK7Pew7e5btd2Kul/comet.gif" style=3D"display:none !important;">

--000000000000efb9c4064f1d8806--

Domain name phish from Google Gmail

Posted by Dave Yadallee on Friday, April 10. 2026

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 09 Apr 2026 22:15:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1wB3GP-00000000Cud-3dVR

for dave@doctor.nl2k.ab.ca;

Thu, 09 Apr 2026 22:14:37 -0600

Resent-From: The Doctor

Resent-Date: Thu, 9 Apr 2026 22:14:37 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-ua1-f42.google.com ([209.85.222.42]:48169)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1wAy6D-000000000Qz-0Usz

for sales@nk.ca;

Thu, 09 Apr 2026 16:43:53 -0600

Received: by mail-ua1-f42.google.com with SMTP id a1e0cc1a2514c-951c5ac6253so455000241.0

for ; Thu, 09 Apr 2026 15:42:57 -0700 (PDT)

ARC-Seal: i=1; a=rsa-sha256; t=1775774570; cv=none;

d=google.com; s=arc-20240605;

b=GPiwB/VBrEEVfywxoFn4+TrUKMQPiA5sWhDf5EL3O+zwiwcICzuG20dH3hHHncAa50

6fZk0TRGmLebLx7xATs82Y3CIky58/hMct9d5YgFm3ZocAiBOplXSOEOt4/tOHvEGJNU

a2iLhfAyrEm+cpmsNN9zTxVIeXfVODRQphOPCmmoPD+o0li9Jr2zyRS1XDAwwNqeLpU4

QxBlfTkUarppLMnYoOFKzj7KEYQ7VhwdIg3vCPaz3R7lpl7k/0Lft1fK1RlEx+iDnm8a

4ToAHRDQvgMkI1EizFAzfTSpJKKvhXoTfp3n1LIY5YzXF4jJqW23nJ32Sr4rCP9Q+xV0

vchA==

ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20240605;

h=to:subject:message-id:date:from:mime-version:dkim-signature;

bh=doKeFjGpUS1MMkq9fVuSWY9+2OFO3+OWG8xkr33xJj8=;

fh=C4vsnDG7cTH8aa/8f7sygxKSfblX4MPDg6mph8A3jUw=;

b=D1Kv2QeqA7ejhxHermhQCnxcMbQQCb+9PgUv3QM02mHUMbts5tbwVBI6rpRlX8XKl+

UDaGIcy6z8hwlyhAMEhEbGA4AxxdTR2mV9GaBn6zbyj86bDsImiQCjIGrMutxQL9qWpR

9Wq66rP9UhsV9J4/6Yahek+GxbkZB0azu2LPD8cDeP/rcA9VbyxD5rlEHw2QYooDk3f1

qNqYFxOz7Ya8VXSOwZEWe1ekM9UPGttUhUlzUMeOEldcYH2FbSqdrx1FUP+YuPEzOAl1

kXJISodRBqFQyYJeOQ6xcWN6GvAtHwqymrgs9YNWKrCva/Ay2V3CilLKyTzys/vFuejq

6hUQ==;

darn=nk.ca

ARC-Authentication-Results: i=1; mx.google.com; arc=none

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=gmail.com; s=20251104; t=1775774570; x=1776379370; darn=nk.ca;

h=to:subject:message-id:date:from:mime-version:from:to:cc:subject

:date:message-id:reply-to;

bh=doKeFjGpUS1MMkq9fVuSWY9+2OFO3+OWG8xkr33xJj8=;

b=Xpf8h0uKgnwyAKbOpFTokmVkO7np5AT977PCsvRprOZ2zpYVRuafTbLMfhUmuwcvMv

qPQi6Uv6b0+A6Zet4FOHt4XOLWFhMecNz/qAmz5ljYAWYshyfeiafvr+8Ig+Zxgx8dfo

KM7RcZ0CbGQv3+pcIxyJAenGHGd1/GJEZdT1X8cuJLnjvGuymzLhmTUG2B9ESlHbvy0A

IyOZR486ugMyNR0mHbe4UsjsmFU7axEnJwc5fcuPXdXCewLlaa/Hk0SS1mcWtiqcLWT2

dG8BbhtDKg8TrdG7iHdklOqfb0XNbx42/k1kUK2lubVsMoC4sA8cypsJFLcq0D924pRR

lSCQ==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20251104; t=1775774570; x=1776379370;

h=to:subject:message-id:date:from:mime-version:x-gm-gg

:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to;

bh=doKeFjGpUS1MMkq9fVuSWY9+2OFO3+OWG8xkr33xJj8=;

b=RnXuLs2uCAYd4aC1GryfN9/9Nvcrg400EclxKsez/bvdUmWtUzNP2EgiuclVNn0vFT

UDKFZHNsAz9qTO7IhR9725ynIeBh3Fxn1xACMlzUoTqgAtOgj+rj7L0ECN0ThLb+KQjv

mBR1VOEtH2blDKQ0uQnZGS3dFP4SFMie+Nl9VL326Fnk7acoVGYApLE3r9JWX4D/+CZe

Dy/j6jIVS70ZOp/P4s6bzVVsFNgDGF3QjJJwa5aYuveAqDsEV23EiCnG56NPdorP6+0J

pE3WMVfTV18qH/6sJB3/0L2MsoPKQKuA4/2Z/pK8vB5ofS/XCojD2ulahbHljSzt8wjD

W07Q==

X-Gm-Message-State: AOJu0YwhCSbp1NVuHPmix9VKaTLC37M9aGiNdXGXsLWX4i7Qql6eDwxU

AnEu4bTPxFMV3ghYdLQ2ZJubnt+3y3BbIJCMyjRJTudkUEfH54t6cPC+026nQPBFs+bTCfX+UEt

HwlmE7sgJEut5XH/19r8kXcMT/yFcaE5LINgc

X-Gm-Gg: AeBDietZwZ6iLD+mdx3izymOgaSTIT9pQ5qfEDbKFE6jP2/K8QyCXJAfKZLo1t+3RD0

HKhBIXlNm4WzmN0S4V2XnZEMmLaZd5tgqO2IMSrrT8JUK4fQJj9g6qOc+VpW/uNMMUCu7UnvPa7

u2SlcK50vhz7L9uX4kkKt75YbXNMnWtyHWBMgA4MyaQRceB5nGEwxcvPwLLwUpGmlwJdtEPp2eL

TMQrdGUqkl/umkfzejE6Yf/UULIwV98mm++nOplxE0ycU46Ehv3YvE7CDhMuUZWMuftxEd+/Q+/

MHuMzzKQZvaDxRuK+58V1hWAqIXSMRPAjbmHN11JFk8=

X-Received: by 2002:a05:6102:26c9:b0:5f1:72a7:f879 with SMTP id

ada2fe7eead31-60a01366052mr324852137.28.1775774570281; Thu, 09 Apr 2026

15:42:50 -0700 (PDT)

MIME-Version: 1.0

From: Bob Jones

Date: Fri, 10 Apr 2026 03:42:37 +0500

X-Gm-Features: AQROBzCQ9ustgHKOXnHifeu5Y3bQwFSpPRKfXAE_u6XOTuUJfrx7TWqzCW37py0

Message-ID:

Subject: Msp in Edmonton

To: sales@nk.ca

Content-Type: multipart/alternative; boundary="000000000000767fd4064f0ebc52"

X-Spam_score: 5.1

X-Spam_score_int: 51

X-Spam_bar: +++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.

Content preview: Hello EdmontonMsp.com is available for $950. Would you be

interested in this acquisition?

Content analysis details: (5.1 points, 5.0 required)

pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[209.85.222.42 listed in dnsbl.ahbl.org]

[209.85.222.42 listed in dnsbl.ahbl.org]

[209.85.222.42 listed in dnsbl.ahbl.org]

[209.85.222.42 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[209.85.222.42 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[209.85.222.42 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[209.85.222.42 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[209.85.222.42 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[209.85.222.42 listed in will-spam-for-food.eu.org]

[209.85.222.42 listed in will-spam-for-food.eu.org]

[209.85.222.42 listed in will-spam-for-food.eu.org]

[209.85.222.42 listed in will-spam-for-food.eu.org]

[209.85.222.42 listed in will-spam-for-food.eu.org]

[209.85.222.42 listed in will-spam-for-food.eu.org]

[209.85.222.42 listed in will-spam-for-food.eu.org]

[209.85.222.42 listed in will-spam-for-food.eu.org]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[209.85.222.42 listed in list.dnswl.org]

-0.0 SPF_PASS SPF: sender matches SPF record

0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider

[miamimaidservice92(at)gmail.com]

0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends in

digit

[miamimaidservice92(at)gmail.com]

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[209.85.222.42 listed in wl.mailspike.net]

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

Subject: {SPAM?} Msp in Edmonton

--000000000000767fd4064f0ebc52

Content-Type: text/plain; charset="UTF-8"

Hello

EdmontonMsp.com is available for $950.

Would you be interested in this acquisition?

Warm Regards

Bob Jones

--000000000000767fd4064f0ebc52

Content-Type: text/html; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable

Hello

Edmont=

onMsp.com is available for $950.

=3D"auto">Would you be interested in this acquisition?

o">

Warm Regards

Bob Jone=

s=C2=A0

--000000000000767fd4064f0ebc52--

Domain purchase phish from Google Gmail

Posted by Dave Yadallee on Friday, April 10. 2026

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Fri, 10 Apr 2026 15:22:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1wBJHu-00000000JuK-1E2z

for dave@doctor.nl2k.ab.ca;

Fri, 10 Apr 2026 15:21:14 -0600

Resent-From: The Doctor

Resent-Date: Fri, 10 Apr 2026 15:21:14 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-oo1-f50.google.com ([209.85.161.50]:43376)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1wBEiE-00000000OGg-1s46

for sales@nk.ca;

Fri, 10 Apr 2026 10:28:14 -0600

Received: by mail-oo1-f50.google.com with SMTP id 006d021491bc7-662f30d3f1fso1282831eaf.1

for ; Fri, 10 Apr 2026 09:27:19 -0700 (PDT)

ARC-Seal: i=1; a=rsa-sha256; t=1775838433; cv=none;

d=google.com; s=arc-20240605;

b=GAMZFcx5z5ob1JPpyTqu/soJi52s5KGbliDXuAJeh7r3z37EghWJIHXRL4ATYdJDZ3

u7pihBb3qsD3ALz7lrl/fDYkoHO9uA9dVsEUky/M/a27xUA0kWJAFMfA+vyMhkpNVoGV

1nmIt/Ne16zoNa7oTh3w6z4eI3SrUWhqcKoijcJJSYou2Reo8/DhWd44WLlDxqOs4hDG

pNZe4/wZtoe7F2qQFFnnVkihj53EN9YGJc9GeX10x2SnkRKUwGoaDZ73P6qi+BVGns0r

kkRZIo5hFZo7l6Zh26D7253pz2+Z70GA7GgZkSt8fwAKCtToR6vq1qFbju0rGQK45Qpz

9yzg==

ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20240605;

h=to:subject:message-id:date:from:mime-version:dkim-signature;

bh=84X5Tf0YRcGeCCp60oPsR8jn7szCpBnsTumiuhe0PXk=;

fh=C4vsnDG7cTH8aa/8f7sygxKSfblX4MPDg6mph8A3jUw=;

b=UEaGFGiGkIaOSe57i6GKRmDRRD2sWsOeGIRywslIv5djsYnBRB21s0AgD+GjQMTKHR

wivfOa44tUkU6rRCHKw9hh1JVABagF+lPBM+GFQ8yBZuTAWJxXaWQ2RCJg/FnQwokzDm

hSAhPnDThiuJ95qRDF8d7QpdAyewh5lg3Fm0MmHzhiJCR4ReQEKx+bWVyH0HfKMbGcLP

xrh+PTJfmAh0E5PbQOJZ/illiSIyhnjBDOpDWoRgSg03s/Zdgun85vG+7+9EFGQWQ/jx

8YvkJhTVyDptgjsDJVJMxJObPasYaBXymvDa3f4FnhaZ/bNl8y8Ov9s2JdLMxB5FXts0

KflA==;

darn=nk.ca

ARC-Authentication-Results: i=1; mx.google.com; arc=none

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=gmail.com; s=20251104; t=1775838433; x=1776443233; darn=nk.ca;

h=to:subject:message-id:date:from:mime-version:from:to:cc:subject

:date:message-id:reply-to;

bh=84X5Tf0YRcGeCCp60oPsR8jn7szCpBnsTumiuhe0PXk=;

b=e2Veu5rD74NCpI20H3wSdHKQM6oEGdP2Itfr7wAqEyGsOFnP7UxJ91ScFV0Dm4JMDq

/4XJMCC+JcUP7ZN9rHqnGtrbnzWUd8wy5KVgL6vVcQFkB4YjE19eF1cM2HYPQNUq/71o

BFZ4qEHXYJp7wlVDG0d8Tl7jukcN4Fs26JwSg5IPkv3mHvFMb0XnAE1CoAqpSuFsg+ud

qBOtzYnjqIfte+rZekGU/TvuFDzZpq3Vt47dpq3LNLAROJVtPfws4hxFk3teCuzooGs2

IZ4X0efw/ifTnkZAd9kwAAR1DV+nS0ZPhvFgRn+Z22yBwKCn2Ncf811XDAtw6PvPtfrD

rGkA==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20251104; t=1775838433; x=1776443233;

h=to:subject:message-id:date:from:mime-version:x-gm-gg

:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to;

bh=84X5Tf0YRcGeCCp60oPsR8jn7szCpBnsTumiuhe0PXk=;

b=GSzkoXVy3MqwGntxWKyykS36cvhGq72BGXEnr/C1JdGjbhkeUdKk/7bVecX6qjmejN

JmdUH2XzcgReMj8xpVvaLRf3oFuhSbU/F+5Lvyiuvq7dq/HbbxNMIAAS3imp9soJa2aG

hLqT0g31qXWbKWKBdekY7/nIIo6AZ1CUueyZIL+EkekpYE1ggEigvFWmQns2d1709kUV

oOPZv+SrVEb3AfMNiAmg5mDOmFgMqncdFVDfyUFtM/hPBd9y1HZ/dVVW7NvVfI09OccH

FUyiW1Tv+0cQnX0MjKAcSn3kOLE72O/qFiyuB/ACL1+aCWBH6F+AhfR7m2SL6Q1PR9yi

3gzg==

X-Gm-Message-State: AOJu0YySeVqcTti5FZaa2ZgH0QeLF/6o3DZTTcrccVH0RdzEPDjALsQz

b+8fPxsjxijBhiomzOm2BdLxoZn0J2x/dtl8M8e13kyaSsro1Q/1GSed01ub77ruoNVkEe13bwB

VfUchg2CfhAlfTSyjgUsFVaNF3ITY+VqwBM7R

X-Gm-Gg: AeBDietCJ6sykmjQd2h6ZMJaOpKBFd25s7uwgpqhfeVao86BhpGmkhUMIcmXu20nWWI

4R0p6UTK4RHmdOvEwgvxkdUYZ18oCOny9y88RF65I7LbSpNBAqhLutPN/lQxKlCMNY0MZnp+nfN

vriRDa4bvgxvDdquPdmnE0nCZDP8Rwo/30G51ggNKTRy+XK8Pl12igqODp0DWdHFSTSCYk9nsVQ

3urvr75zDM7IstQ4fFuok7bqmcZe7rWyNI0mvW8vFOdgkKlmtKaf+Ha6QhEgrb0vIyjcbZJNeYO

cTWwvQ2+0b9gRBPD636gEdc=

X-Received: by 2002:a05:690e:b41:b0:650:178e:253 with SMTP id

956f58d0204a3-65186f2f0c2mr6752887d50.0.1775838084155; Fri, 10 Apr 2026

09:21:24 -0700 (PDT)

Received: from 1008170693301 named unknown by gmailapi.google.com with

HTTPREST; Fri, 10 Apr 2026 11:21:23 -0500

Received: from 1008170693301 named unknown by gmailapi.google.com with

HTTPREST; Fri, 10 Apr 2026 11:21:23 -0500

MIME-Version: 1.0

From: nicholaslouis.co@gmail.com

Date: Fri, 10 Apr 2026 11:21:23 -0500

X-Gm-Features: AQROBzC_z8zl2znhhHBczuNlVvrgl-95zGGIYtPAxoMnWCI3MBUCmxt1ZOiegE0

Message-ID:

Subject: VOIP IN EDMONTON

To: sales@nk.ca

Content-Type: multipart/alternative; boundary="0000000000002f4b29064f1d861e"

X-Spam_score: 8.3

X-Spam_score_int: 83

X-Spam_bar: ++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.

Content preview: Hello, I wanted to let you know that the premium domain VoipEdmonton.com

is available for purchase at Godaddy.

Content analysis details: (8.3 points, 5.0 required)

pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[209.85.161.50 listed in dnsbl.ahbl.org]

[209.85.161.50 listed in dnsbl.ahbl.org]

[209.85.161.50 listed in dnsbl.ahbl.org]

[209.85.161.50 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[209.85.161.50 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[209.85.161.50 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[209.85.161.50 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[209.85.161.50 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[209.85.161.50 listed in will-spam-for-food.eu.org]

[209.85.161.50 listed in will-spam-for-food.eu.org]

[209.85.161.50 listed in will-spam-for-food.eu.org]

[209.85.161.50 listed in will-spam-for-food.eu.org]

[209.85.161.50 listed in will-spam-for-food.eu.org]

[209.85.161.50 listed in will-spam-for-food.eu.org]

[209.85.161.50 listed in will-spam-for-food.eu.org]

[209.85.161.50 listed in will-spam-for-food.eu.org]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[209.85.161.50 listed in list.dnswl.org]

-0.0 SPF_PASS SPF: sender matches SPF record

1.6 SUBJ_ALL_CAPS Subject is all capitals

0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider

[nicholaslouis.co(at)gmail.com]

-0.0 RCVD_IN_MSPIKE_H3 RBL: Good reputation (+3)

[209.85.161.50 listed in wl.mailspike.net]

1.6 HTML_IMAGE_ONLY_12 BODY: HTML: images with 800-1200 bytes of words

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

-0.0 RCVD_IN_MSPIKE_WL Mailspike good senders

0.0 T_REMOTE_IMAGE Message contains an external image

Subject: {SPAM?} VOIP IN EDMONTON

--0000000000002f4b29064f1d861e

Content-Type: text/plain; charset="UTF-8"

Hello,

I wanted to let you know that the premium domain

VoipEdmonton.com is available for purchase at Godaddy.

This domain would be really good for attracting clients looking for your

VOIP IN EDMONTON.

If the domain is developed or redirected to your current website, it would

be extremely beneficial to your company and services in terms of catching

more leads and clients while retaining your brand identity.

You can get this domain for $650 at www.VoipEdmonton.com right now.

Best Regards,

Nicholas.

--0000000000002f4b29064f1d861e

Content-Type: text/html; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable

Hello,

I wanted to let you know that the prem=

ium domain

VoipEdmonton.com is available for purch=

ase at Godaddy.

This domain would be really good f=

or attracting clients looking for your

VOIP IN EDMONTON.

v>

If the domain is developed or redirected to your current w=

ebsite, it would be extremely beneficial to your company and services in te=

rms of catching more leads and clients while retaining your brand identity.=

You can get this domain for $650 at
tp://www.VoipEdmonton.com">www.VoipEdmonton.com right now.

r>

Best Regards,

Nicholas.

=3D"https://nicholaslouis_co_gmail_com-dot-mmanalytics.appspot.com/em_GrGDV=

VfCnSWAX8pOmpL6/asteroid.gif" style=3D"display:none !important;">

--0000000000002f4b29064f1d861e--

Package phish from Sendgrid

Posted by Dave Yadallee on Friday, April 10. 2026

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Fri, 10 Apr 2026 10:19:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1wBEZ4-00000000NbG-0Sqe

for dave@doctor.nl2k.ab.ca;

Fri, 10 Apr 2026 10:18:38 -0600

Resent-From: The Doctor

Resent-Date: Fri, 10 Apr 2026 10:18:38 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from s.wfbtzhsv.outbound-mail.sendgrid.net ([159.183.224.104]:32048)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1wBDH9-00000000Lr3-2yYQ

for root@nk.ca;

Fri, 10 Apr 2026 08:56:12 -0600

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kbsxfa.com;

h=from:subject:date:mime-version:to:content-type:

content-transfer-encoding:cc:content-type:date:from:subject:to;

s=s1; t=1775832909; bh=sgmqfxVTn5tNusgxdcpPp+bpUdFmqXEdz+qDeA54eWI=;

b=x2bkUphuwncopMkSzXt+aYkXPIu7t8EGgTham61yLkfp3wzewfuosLrg3RCCf0raDuWq

Z6W64rfafYdI/pDJ4OmN9rvXmPNkU+8Tv3iQHqc55CsrSCSjHXktc1VC2RAJ11fC4yYTR1

wYB2MkcBn6BjkHAEzBAE8eU0GoVP5k3iLBYRXXfpuLDExvQruLmzMNLkIQg7SbYiJ3aY0M

2mwcczCQznEwNiqZlQ62omNhBei14jimnFOIxMIeSuGJsKQ8Q+DS+rGl62bSE8nKpFhoEl

8CUEd7wGDO9A9tDlWF0QpzCks4wzgIBFwJkhwrxWA9LXX1JUi0naWGzeo1O4kzQg==

Received: by recvd-585cb44ccd-dljnx with SMTP id recvd-585cb44ccd-dljnx-1-69D90F4D-E

2026-04-10 14:55:09.064709211 +0000 UTC m=+928694.265763231

Received: from franchimon-icm.com (unknown)

by geopod-ismtpd-canary-0 (SG)

with ESMTP id zocxVFIJRnyF_oH_6VAI6g

for ;

Fri, 10 Apr 2026 14:55:09.004 +0000 (UTC)

Message-Id:

From: Logistics Team

Subject: Important: Confirm Your Shipping Information to Prevent Return of

Your Package

Date: Fri, 10 Apr 2026 14:55:09 +0000 (UTC)

X-Priority: 5

X-Mailer: GipLbbceRAfxU NCYIBswiQSvBuDl IDcusAxuV 286.86158

Mime-Version: 1.0

X-SG-EID:

=?us-ascii?Q?u001=2Eol3cEI4W5DOn5lRhLQ=2Fe7c6hfFNQrSnzZPz=2F=2FA8LA9cYm8u8U=2FaARP4KH?=

=?us-ascii?Q?kLRG=2FMPOlFVAhg0WxPjfLoqaPciLexthaxcfIU5?=

=?us-ascii?Q?QVwZj=2FRSTEoRk=2FVA24+Pv53gaECzH9yXcAz3f=2Fo?=

=?us-ascii?Q?Txgh7NBHLKaE90VjzQhS1VFnwIXg4EZJYerwzn6?=

=?us-ascii?Q?1Rf1QzqRXzC72x6pgUPRfQG7d8VGO41IvYZynPj?=

=?us-ascii?Q?4qRO6N3=2FFug=2FHfwYCYou5k=3D?=

To: "root@nk.ca"

X-Entity-ID: u001.4YvAU33fPP5NJy37RisiGA==

Content-Type: text/html; charset=us-ascii

Content-Transfer-Encoding: base64

X-Spam_score: 29.3

X-Spam_score_int: 293

X-Spam_bar: +++++++++++++++++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.

Content preview: Dear root@nk.ca, We are writing to inform you that we encountered

an issue with verifying the delivery address for your recent order. As a

result, we were unable to complete the delivery of your package.

Content analysis details: (29.3 points, 5.0 required)

pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[159.183.224.104 listed in dnsbl.ahbl.org]

[159.183.224.104 listed in dnsbl.ahbl.org]

[159.183.224.104 listed in dnsbl.ahbl.org]

[159.183.224.104 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[159.183.224.104 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[159.183.224.104 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[159.183.224.104 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[159.183.224.104 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[159.183.224.104 listed in will-spam-for-food.eu.org]

[159.183.224.104 listed in will-spam-for-food.eu.org]

[159.183.224.104 listed in will-spam-for-food.eu.org]

[159.183.224.104 listed in will-spam-for-food.eu.org]

[159.183.224.104 listed in will-spam-for-food.eu.org]

[159.183.224.104 listed in will-spam-for-food.eu.org]

[159.183.224.104 listed in will-spam-for-food.eu.org]

[159.183.224.104 listed in will-spam-for-food.eu.org]

1.9 URIBL_JP_SURBL Contains an URL listed in the JP SURBL blocklist

[URI: xfonyfg.com]

1.9 URIBL_ABUSE_SURBL Contains an URL listed in the ABUSE SURBL blocklist

[URI: intelcom.ca.xfonyfg.com]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

0.0 RCVD_IN_VALIDITY_CERTIFIED_BLOCKED RBL: ADMINISTRATOR NOTICE: The

query to Validity was blocked. See

https://knowledge.validity.com/hc/en-us/articles/20961730681243

for more information.

[159.183.224.104 listed in sa-trusted.bondedsender.org]

0.0 RCVD_IN_VALIDITY_RPBL_BLOCKED RBL: ADMINISTRATOR NOTICE: The query to

Validity was blocked. See

https://knowledge.validity.com/hc/en-us/articles/20961730681243

for more information.

[159.183.224.104 listed in bl.score.senderscore.com]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[159.183.224.104 listed in bl.score.senderscore.com]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

0.0 RCVD_IN_VALIDITY_SAFE_BLOCKED RBL: ADMINISTRATOR NOTICE: The query to

Validity was blocked. See

https://knowledge.validity.com/hc/en-us/articles/20961730681243

for more information.

[159.183.224.104 listed in sa-accredit.habeas.com]

-0.0 SPF_PASS SPF: sender matches SPF record

15 GR_DOMAIN_SENDGR1 Received contains spammer id (sendgr)

1.5 DEAR_EMAIL BODY: Message contains Dear email address

0.5 L_HELLO_ADDRESS BODY: Greets you by address, not by name

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 MIME_BASE64_TEXT RAW: Message text disguised using base64 encoding

0.5 VOWEL_FROM_5 Impronouncable from header (6 consecutive vowels)

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

2.5 XM_RANDOM X-Mailer apparently random

2.0 FILL_THIS_FORM_LONG Fill in a form with personal information

1.0 XPRIO Has X-Priority header

0.0 FILL_THIS_FORM Fill in a form with personal information

Subject: {SPAM?} Important: Confirm Your Shipping Information to Prevent Return of

Your Package

Dear root@nk.ca,

We are writing to inform you that we encountered an issue with verifying the delivery address for your recent order. As a result, we were unable to complete the delivery of your package.

Current Status:

The address details provided appear to be incomplete or unclear. In order to avoid delays or the return of your shipment, we kindly ask that you review and update your shipping information as soon as possible.

Required Action:

Please ensure that the following details are correct:

Full street address

Unit or apartment number (if applicable)

City, postal code, and country

Contact phone number

Deadline for Update:

To prevent further delay or potential return of your package, we kindly ask that you submit the updated information within the next 48 hours.

Important Reminder:

For security purposes, please update your details only through the official delivery portal linked to your account. If we do not receive updated information within the hold window, we may be required to delay or return your shipment as per our carrier's policies.

Review Delivery Details: https://intelcom.ca.xfonyfg.com/lMrgLhGebN

This is an automated notification from 's delivery system. Please refrain from replying to this email.

Thank you for your prompt attention to this matter.

Geek Squad Phish from Google Gmail

Posted by Dave Yadallee on Friday, April 10. 2026

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Fri, 10 Apr 2026 10:19:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1wBEZ0-00000000Nb4-02KK

for dave@doctor.nl2k.ab.ca;

Fri, 10 Apr 2026 10:18:34 -0600

Resent-From: The Doctor

Resent-Date: Fri, 10 Apr 2026 10:18:33 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-oo1-f73.google.com ([209.85.161.73]:58599)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1wBDCL-00000000LQF-3KSt

for doctor@nl2k.ab.ca;

Fri, 10 Apr 2026 08:51:16 -0600

Received: by mail-oo1-f73.google.com with SMTP id 006d021491bc7-683b5d81209so4299006eaf.0

for ; Fri, 10 Apr 2026 07:50:19 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=google.com; s=20251104; t=1775832613; x=1776437413; darn=nl2k.ab.ca;

h=to:from:subject:date:message-id:sender:reply-to:mime-version:from

:to:cc:subject:date:message-id:reply-to;

bh=yAPvojQl0yHYUaU74SjQTMZXw2kgF33YDgSLq348pM8=;

b=dZE2YfddUxlZjtiAv98WSGiTGynSAeDv8E8aPEV8h7xyDIHkMZwLUgS46GJZu1/xMk

qTOQ8ejwVZNxNGBmU8y5pddHvkdFsKaVM4Wb0zOebMhwYFm+G7ask7NJkqwnRsnF3xS4

jolxM0xlCo46eTImoj3xDmga1cMAPFjDXugjtIQ+uruXv1JyG4S8a6qozwG+vpwY2YSJ

VT2zjQ44OEp+wnkg2F7lrtMArKCV9pEviODajMjJKYGhVKpRmeQNGRVGN3OPpweX/5WH

y5lBhMGnW5swmjySY/IVhAxyfIyr4GiDcC7KgibvaVh8cJ9+oDnY3oRHgCXeUcNz6r2S

i8HQ==

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=zzygjt-com.20251104.gappssmtp.com; s=20251104; t=1775832613; x=1776437413; darn=nl2k.ab.ca;

h=to:from:subject:date:message-id:sender:reply-to:mime-version:from

:to:cc:subject:date:message-id:reply-to;

bh=yAPvojQl0yHYUaU74SjQTMZXw2kgF33YDgSLq348pM8=;

b=kKEBK5s8AX1YUerqd3dWmQs1sjY+TdVaSCkxF2lEREo0SBWdP8IN7foP8JIngbJSp6

FlR1PQHyRzIGTdcHH+aCcHYTMVfm+nnEoOD4RIPtiN06sxGD/7CymVwXtmVMBY9v4bXU

oIp3MDzFCe56eW6EDfy88SMrMvxZXEe4kbbLwMNfxcrpN9mNnrQ8WS1iXXIVB/fuCjiQ

D7S7Rmurcb0RRd0JG0EkxYviFVF0HFLtmtQMPXTHbMXrI/dkuJd1olrk3I4zlGjhtQH1

UEpUReSENtkgart5Zd8p5WEn4WMLvaeVY5BvYx0fxtCJdDnNC4JFa/y1e7MYLwqSyTNB

f0uA==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20251104; t=1775832613; x=1776437413;

h=to:from:subject:date:message-id:sender:reply-to:mime-version

:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to;

bh=yAPvojQl0yHYUaU74SjQTMZXw2kgF33YDgSLq348pM8=;

b=JFe2eQDQ2hxWSuU3gdnmkmA18GM0hyoMoayHRt3c30MGkaybkFfMjvKigFgG6FulDo

W6stAnPBsKLeW1UPADtsLIUZBAn/uRbVMDnys+eMyGgkwe+cN75LSwgngvYGrOEPZk2/

7/X5jONdhf115Pm5329dVQXfb5S/62RZO30bxuCL7kFeuuWcPLUSe9Hl+Uxq2n13am4u

TVyHMjJ9oQdQQQA3yiyDFoR4ybJWAuWe63SFYuAj/Y6AESKTNDLlAtyNU8LJFqGE2gfI

659xZTqy5wqsBQrdgS/Q0uLIEMGBRhxVFyUVjvX4Zi3V/xrLEcj9/oMopJVJv+AZXa/0

wP8Q==

X-Gm-Message-State: AOJu0YyY6Kug8qzcf93j6k4kiKN5VyApMutwuSZRpU5aga82020314lL

OzELWcIBZ9YsOCZ8QlB07wv6nK9tRAr89EpiSqhkNx1dqVy8oUtl90XA54ko4I2AgYptCnwCZWw

m1iG05/oXL2KRxno1fTL/6lCTJwqPhWEIq2oQDRLBM5xvEBhYGtJDu1J1

MIME-Version: 1.0

X-Received: by 2002:a05:6820:780f:b0:688:6d55:17b with SMTP id

006d021491bc7-68be89e55bemr1079822eaf.51.1775832612892; Fri, 10 Apr 2026

07:50:12 -0700 (PDT)

Reply-To: Aireosha zarrow

Sender: Google Calendar

Message-ID:

Date: Fri, 10 Apr 2026 14:50:12 +0000

Subject: Invitation: Notice: Your Service Plan Will Renew Soon @ Fri Apr 10,

2026 8:49pm (GMT-7) (doctor@nl2k.ab.ca)

From: Aireosha zarrow

To: doctor@nl2k.ab.ca

Content-Type: multipart/mixed; boundary="0000000000001281f5064f1c40b4"

X-Spam_score: 9.1

X-Spam_score_int: 91

X-Spam_bar: +++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.

Content preview: Notice: Your Service Plan Will Renew Soon Friday Apr 10, 2026

â‹… 8:49pm Pacific Time - Los Angeles Invoice Date: Friday, 10 April 2026

Invoice id: 6782-727-4376 Geek Squad

Content analysis details: (9.1 points, 5.0 required)

pts rule name description

---- ---------------------- --------------------------------------------------

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[209.85.161.73 listed in list.dnswl.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[209.85.161.73 listed in dnsbl.ahbl.org]

[209.85.161.73 listed in dnsbl.ahbl.org]

[209.85.161.73 listed in dnsbl.ahbl.org]

[209.85.161.73 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[209.85.161.73 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[209.85.161.73 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[209.85.161.73 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[209.85.161.73 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[209.85.161.73 listed in will-spam-for-food.eu.org]

[209.85.161.73 listed in will-spam-for-food.eu.org]

[209.85.161.73 listed in will-spam-for-food.eu.org]

[209.85.161.73 listed in will-spam-for-food.eu.org]

[209.85.161.73 listed in will-spam-for-food.eu.org]

[209.85.161.73 listed in will-spam-for-food.eu.org]

[209.85.161.73 listed in will-spam-for-food.eu.org]

[209.85.161.73 listed in will-spam-for-food.eu.org]

0.3 LONGWORD BODY: Uses overlong words

0.6 MEGALONGWORD BODY: Uses really overlong words

0.6 J_CHICKENPOX_53 BODY: 5alpha-pock-3alpha

-0.0 RCVD_IN_MSPIKE_H3 RBL: Good reputation (+3)

[209.85.161.73 listed in wl.mailspike.net]

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

-0.0 RCVD_IN_MSPIKE_WL Mailspike good senders

2.0 RATWR8_MESSID Message-ID with excessive dashes and dollars

0.6 LONG_INVISIBLE_TEXT Long block of hidden text - bayes poison?

Subject: {SPAM?} Invitation: Notice: Your Service Plan Will Renew Soon @ Fri Apr 10,

2026 8:49pm (GMT-7) (doctor@nl2k.ab.ca)

Aireosha zarrow has invited you to Notice: Your Service Plan Will Renew Soon

Title: Notice: Your Service Plan Will Renew Soon

When: Friday, April 10, 2026 at 21:49

Organizer:

Aireosha zarrow

Description: Invoice Date: Friday, 10 April 2026

Invoice id: 6782-727-4376

Geek Squad

Esteemed Customer,

This notice is to confirm the successful renewal of your Geek Squad subscription. A total of USD355.39 has been charged for the selected 24 Months duration.

Inventory Tracking Hub

• Plan: SafeLayer Core

• Reference ID: MBVXD7YZZ

• Term Duration: 24 Months

• Quantity: x3

• Amount Paid: USD355.39

If you need any assistance, please contact (+1 808) 388-7319.

Gladly sent,,

GEEKSQUAD

Accounts head: Daniel Hovermale

Support Hotline Number: (+1 808) 388-7319

Team Management: 3300 Irvine Ave # 225 Norwalk Ca 90650-4336 Usa

Support Availability: 6 AM – 6 PM

This message was generated automatically.

Attendees:

doctor@nl2k.ab.ca

Invoice Date: Friday, 10 April 2026

Invoice id: 6782-727-4376

Geek Squad

Esteemed Customer,

This notice is to confirm the successful renewal of your Geek Squad subscription. A total of USD355.39 has been charged for the selected 24 Months duration.

Inventory Tracking Hub

• Plan: SafeLayer Core

• Reference ID: MBVXD7YZZ

• Term Duration: 24 Months

• Quantity: x3

• Amount Paid: USD355.39

If you need any assistance, please contact (+1 808) 388-7319.

Gladly sent,,

GEEKSQUAD

Accounts head: Daniel Hovermale

Support Hotline Number: (+1 808) 388-7319

Team Management: 3300 Irvine Ave # 225 Norwalk Ca 90650-4336 Usa

Support Availability: 6 AM – 6 PM

This message was generated automatically.

When

Friday Apr 10, 2026 ⋅ 8:49pm (Pacific Time - Los Angeles)

Organizer

Aireosha zarrow

aireoshazarrow@zzygjt.com

Guests

(Guest list has been hidden at organizer's request)

Reply for doctor@nl2k.ab.ca

Yes

No

Maybe

More options

Invitation from Google Calendar

You are receiving this email because you are an attendee on the event.

Forwarding this invitation could allow any recipient to send a response to the organizer, be added to the guest list, invite others regardless of their own invitation status, or modify your RSVP. Learn more

Geek squad Phish from Google Gmail

Posted by Dave Yadallee on Friday, April 10. 2026

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Fri, 10 Apr 2026 10:19:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1wBEYX-00000000NZ1-2nJa

for dave@doctor.nl2k.ab.ca;

Fri, 10 Apr 2026 10:18:05 -0600

Resent-From: The Doctor

Resent-Date: Fri, 10 Apr 2026 10:18:05 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-oo1-f73.google.com ([209.85.161.73]:45183)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1wBC55-00000000I1v-2EHS

for doctor@nl2k.ab.ca;

Fri, 10 Apr 2026 07:39:41 -0600

Received: by mail-oo1-f73.google.com with SMTP id 006d021491bc7-679c51b2d6cso3115143eaf.2

for ; Fri, 10 Apr 2026 06:38:43 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=google.com; s=20251104; t=1775828317; x=1776433117; darn=nl2k.ab.ca;

h=to:from:subject:date:message-id:sender:reply-to:mime-version:from

:to:cc:subject:date:message-id:reply-to;

bh=uhXuVIFrqxVwRacsomq3nFt22jWt7wmibzMv4dXAd0g=;

b=DDGuC7lBQx8js8pkZHCGB1C+lZgxoS7Xe0DI2+qaoxBtoYx9w15q1fZYXVQ0nmc2gA

PjSXKUUkyvfmBap6t6/9XCoF7XacZu2iRLy0WBMA5ojKRpGx8m6ui2e0hYt0Iszf3BuN

EMrIJWzuXNyeDS7qhDQ6BIHZqcd1OOfCpzLQ19dp3huIlXC+FqCiBhozKgeuaU+132Sp

uXxszUwOL9jUHyYkP2xqTz4VS3Hw2k8YULa1P984F6O9MhD81FMcSo2VYNeMpZmOGS5b

tAFgS4M37zillDxKghnF8XfeBWctDvYgUh3eqcwlAfDcuixZzyysqqeG0W7FqdchxQ8H

hqxw==

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=pvvmail-com.20251104.gappssmtp.com; s=20251104; t=1775828317; x=1776433117; darn=nl2k.ab.ca;

h=to:from:subject:date:message-id:sender:reply-to:mime-version:from

:to:cc:subject:date:message-id:reply-to;

bh=uhXuVIFrqxVwRacsomq3nFt22jWt7wmibzMv4dXAd0g=;

b=sUmFt0hh0Rs7dtrc4SZM9afl6pmKM4ugBCmgx5ObGq8GmX/NgyfN5euvKk+jZfA6nt

Njw0c59w8AeSTA18HJ7ddKcClcY5ZkYoiUeLNUh+FCKMp25PXEV49bPieSHgMBbf0Zhs

uofjRtE/eeauSHAtEntsL2EFGT58rRDNLZD7c6LUPuhUXyjCcpMghio6pyLfvorWBhlo

5khcD63WaxTvNnTN0YrLklNVkN7qoviNW10NYasy/5IuixIkkqpQn/BEWQGS6X0SLC31

hzNEF5eX2n2XdRqb3vddDowWcBf9qlos40apdflSOk+C787HWsRkWjnoA3MEDrn9vYtx

+6qQ==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20251104; t=1775828317; x=1776433117;

h=to:from:subject:date:message-id:sender:reply-to:mime-version

:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to;

bh=uhXuVIFrqxVwRacsomq3nFt22jWt7wmibzMv4dXAd0g=;

b=bFCweweaLcj+LqxmswOMXWGi7cctNE2d6576oXAajKfCuBuaCkFQ2Um/S9FyoTemZ1

7DY2gjHA3Jo9nBMG3s+QyBdgrk2S85JWagwpNtplCbH+MnXatEhACizC7Sj4XjaKmwvJ

In9hxtSXyF6NUbCuk0kQFEKV/cCloCbqH85gnZUp1889nAUI3TVxdj1S83BjycGJL8Up

/A3yHR7MVErFwk5GefWmmf3z9IUJDj8NwBVj3XVYmmXhOetct9T8uWpKFXHSJ9/MntDE

cQKF0cXOESB26Vrwwrun8KIH1n0vXrGI0jH0auKgrGcAoTmeHXZKpeB5lZBF9eH+29qZ

ug9Q==

X-Gm-Message-State: AOJu0Yz5JKidJPrr/qUfS5npFBSsTmVPww6LnVQ1roQLNw+R27qDA0qZ

Ybk1d4FZNtNw1fsSQ/CQokdON7dWD6Tz1NCDB9O1Scl2BMt/LVFF3mRcvvNKpEJxWkJ5fTAjyxW

5Y8FkZT2i139i5DW/tNkzMxPpjqo5IPG2UObSVkwURFhRscZl3jDVEJej

MIME-Version: 1.0

X-Received: by 2002:a05:6820:6684:b0:685:5300:f1ca with SMTP id

006d021491bc7-68be94cd315mr1178761eaf.64.1775828317426; Fri, 10 Apr 2026

06:38:37 -0700 (PDT)

Reply-To: Anousak wilmouth

Sender: Google Calendar

Message-ID:

Date: Fri, 10 Apr 2026 13:38:37 +0000

Subject: Invitation: Notice: Your Plan Renewal is Approaching @ Fri Apr 10,

2026 10:38pm (EDT) (doctor@nl2k.ab.ca)

From: Anousak wilmouth

To: doctor@nl2k.ab.ca

Content-Type: multipart/mixed; boundary="0000000000000ad895064f1b4063"

X-Spam_score: 8.5

X-Spam_score_int: 85

X-Spam_bar: ++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.

Content preview: Notice: Your Plan Renewal is Approaching Friday Apr 10, 2026

â‹… 10:38pm Eastern Time - New York Transaction Date: Friday, 10 April 2026

Transaction Receipt: 34-1033-8696 GeekSquad's

Content analysis details: (8.5 points, 5.0 required)

pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[209.85.161.73 listed in dnsbl.ahbl.org]

[209.85.161.73 listed in dnsbl.ahbl.org]

[209.85.161.73 listed in dnsbl.ahbl.org]

[209.85.161.73 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[209.85.161.73 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[209.85.161.73 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[209.85.161.73 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[209.85.161.73 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[209.85.161.73 listed in will-spam-for-food.eu.org]

[209.85.161.73 listed in will-spam-for-food.eu.org]

[209.85.161.73 listed in will-spam-for-food.eu.org]

[209.85.161.73 listed in will-spam-for-food.eu.org]

[209.85.161.73 listed in will-spam-for-food.eu.org]

[209.85.161.73 listed in will-spam-for-food.eu.org]

[209.85.161.73 listed in will-spam-for-food.eu.org]

[209.85.161.73 listed in will-spam-for-food.eu.org]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[209.85.161.73 listed in list.dnswl.org]

0.3 LONGWORD BODY: Uses overlong words

0.6 MEGALONGWORD BODY: Uses really overlong words

-0.0 RCVD_IN_MSPIKE_H3 RBL: Good reputation (+3)

[209.85.161.73 listed in wl.mailspike.net]

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

2.0 RATWR8_MESSID Message-ID with excessive dashes and dollars

-0.0 RCVD_IN_MSPIKE_WL Mailspike good senders

0.6 LONG_INVISIBLE_TEXT Long block of hidden text - bayes poison?

Subject: {SPAM?} Invitation: Notice: Your Plan Renewal is Approaching @ Fri Apr 10,

2026 10:38pm (EDT) (doctor@nl2k.ab.ca)

Anousak wilmouth has invited you to Notice: Your Plan Renewal is Approaching

Title: Notice: Your Plan Renewal is Approaching

When: Friday, April 10, 2026 at 20:38

Organizer:

Anousak wilmouth

Description: Transaction Date: Friday, 10 April 2026

Transaction Receipt: 34-1033-8696

GeekSquad's

Dear Account Holder,

Kindly note that your GeekSquad's subscription has been renewed. The total charge of USD376.31 has been successfully processed for your 2 Years plan.

Product Activity Dashboard

• Plan: DigitalSecure Suite

• Reference ID: SADYEZDTS

• Term Duration: 2 Years

• Quantity: x3

• Amount Paid: USD376.31

For support or queries, please contact 1 810 219-4169.

Warm regards,,

GEEKSQUAD

Accounts team: Sundrilla Kanak

Technical Support Helpdesk: 1 810 219-4169

Control Team: 4539 Occidental Rd Longview Tx 75615 US

Operating Schedule: 6 AM – 6 PM

This notification was generated automatically.

Attendees:

doctor@nl2k.ab.ca

Notice: Your Plan Renewal is Approaching

Transaction Date: Friday, 10 April 2026 Transaction Receipt: 34-1033-8696 GeekSquad's Dear Account Holder, Kindly note that your GeekSquad's subscription has been renewed. The total charge of USD37

Transaction Date: Friday, 10 April 2026

Transaction Receipt: 34-1033-8696

GeekSquad's

Dear Account Holder,

Kindly note that your GeekSquad's subscription has been renewed. The total charge of USD376.31 has been successfully processed for your 2 Years plan.

Product Activity Dashboard

• Plan: DigitalSecure Suite

• Reference ID: SADYEZDTS

• Term Duration: 2 Years

• Quantity: x3

• Amount Paid: USD376.31

For support or queries, please contact 1 810 219-4169.

Warm regards,,

GEEKSQUAD

Accounts team: Sundrilla Kanak

Technical Support Helpdesk: 1 810 219-4169

Control Team: 4539 Occidental Rd Longview Tx 75615 US

Operating Schedule: 6 AM – 6 PM

This notification was generated automatically.

When

Friday Apr 10, 2026 ⋅ 10:38pm (Eastern Time - New York)

Organizer

Anousak wilmouth

anousakwilmouth@pvvmail.com

Guests

(Guest list has been hidden at organizer's request)

Reply for doctor@nl2k.ab.ca

Yes

No

Maybe

More options

Invitation from Google Calendar

You are receiving this email because you are an attendee on the event.

Forwarding this invitation could allow any recipient to send a response to the organizer, be added to the guest list, invite others regardless of their own invitation status, or modify your RSVP. Learn more

Web/SEO/App spam from Google Gmail

Posted by Dave Yadallee on Friday, April 10. 2026

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Fri, 10 Apr 2026 07:31:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1wBBwd-00000000JoE-3hHo

for dave@doctor.nl2k.ab.ca;

Fri, 10 Apr 2026 07:30:47 -0600

Resent-From: The Doctor

Resent-Date: Fri, 10 Apr 2026 07:30:47 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-yw1-f207.google.com ([209.85.128.207]:61480)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1wBBBb-00000000530-0PD4

for sales@nk.ca;

Fri, 10 Apr 2026 06:42:19 -0600

Received: by mail-yw1-f207.google.com with SMTP id 00721157ae682-7949310b90cso37167987b3.2

for ; Fri, 10 Apr 2026 05:41:22 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=globallogicinfotech.com; s=google; t=1775824876; x=1776429676; darn=nk.ca;

h=to:from:subject:date:message-id:reply-to:mime-version:from:to:cc

:subject:date:message-id:reply-to;

bh=lFnztb8L/7DVLzX+LDv05tVafh3+mdy3mRAXd2dw1OU=;

b=acpF7JCkYOcN2Oji9wjP2DnIgT1blsCBonYodiVcMis1UWlHr99O6HQUkllPh2Lvjz

DNK1nlS/qNMp8RbHbzMwn87KSLYmot5IophIdPCmz+s3bv73B6IIKNRbyaT2GFmvbfsg

YsYI5bZVhaop18RTbWi5EP4BfI67blEyQc8cOycSQnoac3viWaYbHjoTv7sFZaLpekqk

huOyUImlE40Boq04OZ9gw/LZWkAzUdTLv0amQl8J/Ak5h+ddC8r1h7WZsFeYv//4JKHH

5ws3ksAP+zDEeHMmgrHwNM4aSWfZtgqKvXfS+6RveHC3XBtugmOqABcz/s8rMdhFTnuU

XXSg==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20251104; t=1775824876; x=1776429676;

h=to:from:subject:date:message-id:reply-to:mime-version

:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to;

bh=lFnztb8L/7DVLzX+LDv05tVafh3+mdy3mRAXd2dw1OU=;

b=B/wFFwR1kcmdasKswj6GCIF2JK67cXbJnH+bRvBLyY+AzkkoGkdGvzRUWBd6lHGoJE

nWF/FyjjcXkBhbPUQxSr84+I9UF5fQiSUmzolYkFObWI0tLNwL2WGmvH+H9uZD/k120p

p3+QUBbVfIjwz59ga7vAkusbsHp/EyCBe2wglqGdqxe0V8fUX/EVETZXm4Ej8rDYuigl

ARQtAod04CdXTXgkQDPs903lkkypxZT0luB4mOgLMpmiU5mZHr8ZZwtB+9xTrZM0gUHd

ugtq3bxS1nL0PM/NbysBBaspLHYeNDVgc9CGH0i4ZUNOcqkVpniD92z2Z1xJPVqS4OT5

FQSg==

X-Gm-Message-State: AOJu0YyOrdYHHoEcE6ZtNHLBmqeuBDR/pLBQNn91rDfpqM+/QCbqHB+6

QmgKknr+L3HzoiC04Pxemvw15ZydckFhNdT0FCCouEdBaXSZoz3yzO82rtH4av2SEEoMMdXAFII

pfLZoXGwuM72HqtZCaNtT38fc

MIME-Version: 1.0

X-Received: by 2002:a05:690c:698a:b0:79a:b75e:1509 with SMTP id

00721157ae682-7af71e47916mr29058017b3.43.1775824876205; Fri, 10 Apr 2026

05:41:16 -0700 (PDT)

Reply-To: info@globallogicinfotech.com

Message-ID:

Date: Fri, 10 Apr 2026 12:41:16 +0000

Subject: Re: Website Redesign but Worried about the Costs?

From: sheila@globallogicinfotech.com

To: sales@nk.ca

Content-Type: multipart/alternative; boundary="000000000000ee08ba064f1a7289"

--000000000000ee08ba064f1a7289

Content-Type: text/plain; charset="UTF-8"; format=flowed; delsp=yes

Hi,

Are you considering a website redesign but worried about the costs? We have

a solution for you!

I am searching online and found your email sales@nk.ca and saw you have a

website but your website could use a boost to improve how it looks visually

in order to make it look like the more up-to-date and modern sites.

We can help you if you'd like to add graphics, logos, calls to action,

additional buttons, etc. at a very low cost. Those features really help to

sell.

If you're interested, I can also provide information on our website

promotion packages and explain how they can benefit your business. Or Could

we set up a meeting? How about tomorrow at 10 to 12 AM?

May I send you a Website Sample & Prices ?

Thanks & Regards,

Sheila McVitty

FOR UNSUBSCRIBE OUR MAILING LIST PLEASE SIMPLY REPLY "NO". We will never

contact you again.

--000000000000ee08ba064f1a7289

Content-Type: text/html; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable

Hi,

Are you considering a website redesign but worried about the cos=

ts? We have a solution for you!

I am searching online and found your=

email sales@nk.ca and saw you have a website but your website could use a =

boost to improve how it looks visually in order to make it look like the mo=

re up-to-date and modern sites.

We can help you if you=E2=80=99d lik=

e to add graphics, logos, calls to action, additional buttons, etc. at a ve=

ry low cost. Those features really help to sell.

If you're intereste=

d, I can also provide information on our website promotion packages and exp=

lain how they can benefit your business. Or Could we set up a meeting? How =

about tomorrow at 10 to 12 AM?

May I send you a Website Sample & Pri=

ces ?

Thanks & Regards,
Sheila McVitty

FOR UNSUBSCRIBE OUR=

MAILING LIST PLEASE SIMPLY REPLY "NO". We will never contact you again.

--000000000000ee08ba064f1a7289--

WEb/SEO/App Spam from Google Gmail

Posted by Dave Yadallee on Friday, April 10. 2026

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Fri, 10 Apr 2026 07:31:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1wBBwY-00000000Jao-2ccm

for dave@doctor.nl2k.ab.ca;

Fri, 10 Apr 2026 07:30:42 -0600

Resent-From: The Doctor

Resent-Date: Fri, 10 Apr 2026 07:30:42 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-yw1-f205.google.com ([209.85.128.205]:48454)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1wBBBb-00000000531-0QBZ

for root@nk.ca;

Fri, 10 Apr 2026 06:42:19 -0600

Received: by mail-yw1-f205.google.com with SMTP id 00721157ae682-794d80fea59so35752847b3.1

for ; Fri, 10 Apr 2026 05:41:22 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=globallogicinfotech.com; s=google; t=1775824877; x=1776429677; darn=nk.ca;

h=to:from:subject:date:message-id:reply-to:mime-version:from:to:cc

:subject:date:message-id:reply-to;

bh=7/0aQOvkzeG1412m1MY8caZHly6Nd0gxEK15nMsW1QM=;

b=emvBi01lttYvUlJnU52RaUD0COns4W4ojYfCRtpwI2vkVFZaUY73CZNGYmtZLSgIU7

c0+QjrJ+qxRFj2ACUkKVzu3YPnaNMPONxAgHyCFU1aFyUJXpMJqcbb9NnLuQz8KOTNha

nLSh9LGn1/3+WEuE7RAg/euC/oTbXAvkXHwfuhWi6hgkS5ctTUbVLhQbprqB3chWdCJ7

h3HCKd8lZRKRopMzLWTUXWzIELhobJW0jxEqg+BP820pdhjbxDqoK1HnIZ5bYrce7msp

mNZ94JtAWyi1wNxHrapqAPWnWpQO4lYSt/Q+UcYVkVGdjtJTkup+3T8NXXPGH7MS3S/N

P1Uw==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20251104; t=1775824877; x=1776429677;

h=to:from:subject:date:message-id:reply-to:mime-version

:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to;

bh=7/0aQOvkzeG1412m1MY8caZHly6Nd0gxEK15nMsW1QM=;

b=TeJPLx7xbQctV/NULK9uzJswbwshepEOTwPKG74curgz5vF6EBHerXNRzfQo3agvkw

uk96qX8vjJ1MN8abZEtzTQPvKvMUFLEG9ZqJJDoW9NsABoq972BlyAntmuugz7/90Tl5

B0QuUsLLHOH+TdtvT1evyj+NLvo5oFQefSxEdO0dQyqehkAWOt3ZvpRyuebjD8cQ/jwO

mTHGqSQt06KNeW28ddQ2+Vj9ETwQDTntWTilqg7BuaySdYmKq9g5AAl3PI1jCYHrClIQ

Q8wVQiEQ3Q5Bx8GwyOTnSHy45tKJLqzUr8I16UzZEQBXOFhadOypSIqAV4yobz7J3n/u

pG0A==

X-Gm-Message-State: AOJu0YyDVRTK5KykI0hFcyBT0RL3jaYeAehX1fsVunrYs2Nxsa1GD+wO

RRYR+q1E/jGaJBBt9W+5acSEmNHn70r2C05g9qFmqCgIUqkugMp+Ye5+CtfDVyNRA/AnR0nY1E8

QpP4lta7Q/Nam6//EmMPlIZ2i

MIME-Version: 1.0

X-Received: by 2002:a05:690c:e04e:b0:798:980f:6706 with SMTP id

00721157ae682-7af6fa01f0emr24994867b3.22.1775824876762; Fri, 10 Apr 2026

05:41:16 -0700 (PDT)

Reply-To: info@globallogicinfotech.com

Message-ID:

Date: Fri, 10 Apr 2026 12:41:16 +0000

Subject: Re: Website Redesign but Worried about the Costs?

From: sheila@globallogicinfotech.com

To: root@nk.ca

Content-Type: multipart/alternative; boundary="000000000000f67e43064f1a7239"

--000000000000f67e43064f1a7239

Content-Type: text/plain; charset="UTF-8"; format=flowed; delsp=yes

Hi,

Are you considering a website redesign but worried about the costs? We have

a solution for you!

I am searching online and found your email root@nk.ca and saw you have a

website but your website could use a boost to improve how it looks visually

in order to make it look like the more up-to-date and modern sites.

We can help you if you'd like to add graphics, logos, calls to action,

additional buttons, etc. at a very low cost. Those features really help to

sell.

If you're interested, I can also provide information on our website

promotion packages and explain how they can benefit your business. Or Could

we set up a meeting? How about tomorrow at 10 to 12 AM?

May I send you a Website Sample & Prices ?

Thanks & Regards,

Sheila McVitty

FOR UNSUBSCRIBE OUR MAILING LIST PLEASE SIMPLY REPLY "NO". We will never

contact you again.

--000000000000f67e43064f1a7239

Content-Type: text/html; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable

Hi,

Are you considering a website redesign but worried about the cos=

ts? We have a solution for you!

I am searching online and found your=

email root@nk.ca and saw you have a website but your website could use a b=

oost to improve how it looks visually in order to make it look like the mor=

e up-to-date and modern sites.

We can help you if you=E2=80=99d like=

to add graphics, logos, calls to action, additional buttons, etc. at a ver=

y low cost. Those features really help to sell.

If you're interested=

, I can also provide information on our website promotion packages and expl=

ain how they can benefit your business. Or Could we set up a meeting? How a=

bout tomorrow at 10 to 12 AM?

May I send you a Website Sample & Pric=

es ?

Thanks & Regards,
Sheila McVitty

FOR UNSUBSCRIBE OUR =

MAILING LIST PLEASE SIMPLY REPLY "NO". We will never contact you again.

--000000000000f67e43064f1a7239--

Oriental Langauge phishing

Posted by Dave Yadallee on Friday, April 10. 2026

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 09 Apr 2026 23:40:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1wB4af-00000000NBH-31uC

for dave@doctor.nl2k.ab.ca;

Thu, 09 Apr 2026 23:39:37 -0600

Resent-From: The Doctor

Resent-Date: Thu, 9 Apr 2026 23:39:37 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail.dealisjennifer.online ([194.163.136.205]:51990)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1wB3iM-00000000IY4-2U7F

for sales@nk.ca;

Thu, 09 Apr 2026 22:43:38 -0600

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple;

d=jenniferoffice.online; s=default; t=1775796103;

bh=LgtKDxA24hCwxTdcz+yCIfzcVhPlXJ1OyFFx7gQGC60=;

h=To:Subject:Date:From:Reply-To:List-Unsubscribe:From;

b=L0jQC1tZyd/wnitVJTBem1FJbQP8rhbbRVf6R2u348QtP40HTXtfCUjFnO31HVYm7

AkEEW8mjhAmIt1UT2LkWuuzyCh8M1w49OmR1gi71CkNqzUhNrYPXv5XcWWMFqqIYOS

ZLBStB24Q14XoTfjs+xLHHHOb8PvXkMi0wTMZy/l/l5lpkqycXL6+WDHw9gQX5lV9c

CE4RzGDNJXZxC5Pu5xaT2a8rArevsnmhiwSJMkblpnNxJefEFN3OsAtFLP86HEu9Q1

UQ0LgY+OAP8HAktFG/G8FZVmVUEZ117Sdaoz7U3vVyXpQdwpZzhkJp/LRRA0ta3Epw

YD5pTd3rIvtmA==

Received: by mail.dealisjennifer.online (Postfix, from userid 33)

id 93CF720343; Fri, 10 Apr 2026 06:41:43 +0200 (CEST)

To: sales@nk.ca

Subject: =?UTF-8?B?6rOE7JW9IOusuOyEnCDtmZXsnbgg67aA7YOB65Oc66a964uI64uk?=

Date: Fri, 10 Apr 2026 13:41:43 +0900

From: Client services

Reply-To: Client services

Message-ID:

X-Mailer: Sendy (https://sendy.co)

List-Unsubscribe-Post: List-Unsubscribe=One-Click

List-Unsubscribe:

MIME-Version: 1.0

Content-Type: text/html; charset=UTF-8

Content-Transfer-Encoding: 8bit

X-Spam_score: 10.7

X-Spam_score_int: 107

X-Spam_bar: ++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.

Content preview: ì•ˆë…•í•˜ì„¸ìš” sales@nk.ca, í™•ì¸ì´ í•„ìš”í•œ ê³„ì•½ ë¬¸ì„œê°€

ë°°ì •ë˜ì—ˆìŠµë‹ˆë‹¤.

Content analysis details: (10.7 points, 5.0 required)

pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[194.163.136.205 listed in dnsbl.ahbl.org]

[194.163.136.205 listed in dnsbl.ahbl.org]

[194.163.136.205 listed in dnsbl.ahbl.org]

[194.163.136.205 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[194.163.136.205 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[194.163.136.205 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[194.163.136.205 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[194.163.136.205 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[194.163.136.205 listed in will-spam-for-food.eu.org]

[194.163.136.205 listed in will-spam-for-food.eu.org]

[194.163.136.205 listed in will-spam-for-food.eu.org]

[194.163.136.205 listed in will-spam-for-food.eu.org]

[194.163.136.205 listed in will-spam-for-food.eu.org]

[194.163.136.205 listed in will-spam-for-food.eu.org]

[194.163.136.205 listed in will-spam-for-food.eu.org]

[194.163.136.205 listed in will-spam-for-food.eu.org]

-0.0 SPF_PASS SPF: sender matches SPF record

-0.0 SPF_HELO_PASS SPF: HELO matches SPF record

2.0 PDS_OTHER_BAD_TLD Untrustworthy TLDs

[URI: jenniferoffice.online (online)]

0.0 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level mail

domains are different

-0.0 T_RP_MATCHES_RCVD Envelope sender domain matches handover relay

domain

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 HTML_MESSAGE BODY: HTML included in message

0.1 MXG_EMAIL_FRAG BODY: URI with email in fragment

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.5 FROM_SUSPICIOUS_NTLD From abused NTLD

2.0 FROM_SUSPICIOUS_NTLD_FP From abused NTLD

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

Subject: {SPAM?} =?UTF-8?B?6rOE7JW9IOusuOyEnCDtmZXsnbgg67aA7YOB65Oc66a964uI64uk?=

ì•ˆë…•í•˜ì„¸ìš” sales@nk.ca,

í™•ì¸ì´ í•„ìš”í•œ ê³„ì•½ ë¬¸ì„œê°€ ë°°ì •ë˜ì—ˆìŠµë‹ˆë‹¤.

ë¬¸ì„œ í™•ì¸

ê°ì‚¬í•©ë‹ˆë‹¤.

Client Services

costco Phish

Posted by Dave Yadallee on Thursday, April 9. 2026

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 09 Apr 2026 12:38:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1wAuFr-000000008h8-2eUY

for dave@doctor.nl2k.ab.ca;

Thu, 09 Apr 2026 12:37:27 -0600

Resent-From: The Doctor

Resent-Date: Thu, 9 Apr 2026 12:37:27 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from [213.176.16.238] (port=52191 helo=weslandbol.nl)

by doctor.nl2k.ab.ca with esmtp (Exim 4.98.2 (FreeBSD))

id 1wAtIO-000000004dJ-3mmC

for doctor@nl2k.ab.ca;

Thu, 09 Apr 2026 11:36:09 -0600

DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; s=smtp; d=nl2k.ab.ca;

h=Date:To:From:Subject:Content-Type:Mime-Version:Content-Transfer-Encoding; i=doctor@nl2k.ab.ca;

bh=O0bpsvYCJ5/7vzcUr3jc9dZYEXk=;

b=J5Igyo8iErRnjxwRzFS0yXwLTSfCiIm4gTO5teGX7vtZYKkztFdUtL1Tn8K89KqB6D5o9oG5/972

1IOoTyNn5DN8opFVqqwcyoqorzqUR4GVnLwqyqqA6mVUSTdD88NuG4N/0Rq2e6M8RNZMUJoAwLVU

i674KU6c7/81IVSfaP2rd3JcqdRioNmcCFt2jWcWhinJaVyTPdEORsCTglExH/jDfFcR7LNJJKoG

89pYWfEqGSv/nbZC0H++CFW99E7AqEqw9lIkhQOT+NsexQ6LoXxgyUESx6f7CwiMB+/RWOoMFy9p

SxDt9G8BlPiuohHtKSYil8X/LTKTAuq7feRjOA==

DomainKey-Signature: a=rsa-sha1; c=nofws; q=dns; s=smtp; d=nl2k.ab.ca;

b=Zs23ahDnjqr+W17paNw6OREs+5XXuLOuwthJcuyL9IqCqNQEu9Qq77XQa9viOAoY/TJVAoR948lN

9ZetVIY7hkaDtbyLmmLhrmZSszz5Kh2oVkADmJ05/oY+iDr0bQtmtDDoRV8ndvGwCCYfYjEOraup

BapdU3KBioremzKB/FrV6+d1yUYD1wBv8ZWJXbVOayzfKKwoowIEmzg16/Sua/NduIbPZFxnJ9U/

bfdN1J+agRBGT2Y3pdBXpkQvzQPmrkO84cLGre25GyZ32eupx0meLjxp7Az8Np9/VqTQtmayroXO

G5bb+9uzCrpEEuQItcR4n1+I9Y7xGq1dfIZ8Zg==;

Date: Thu, 09 Apr 2026 17:35:02 +0000

To: doctor@nl2k.ab.ca

From: FinalNotice

Subject: Confirmation Needed

Content-Type: text/html; charset="UTF-8"

Mime-Version: 1.0

Content-Transfer-Encoding: 8bit

X-Spam_score: 10.7

X-Spam_score_int: 107

X-Spam_bar: ++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.

Content preview: CLICK HERE Unsubscribe 115 E 23rd St New York, NY, US 10010

Content analysis details: (10.7 points, 5.0 required)

pts rule name description

---- ---------------------- --------------------------------------------------

0.1 MISSING_MID Missing Message-Id: header

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[213.176.16.238 listed in dnsbl.ahbl.org]

[213.176.16.238 listed in dnsbl.ahbl.org]

[213.176.16.238 listed in dnsbl.ahbl.org]

[213.176.16.238 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[213.176.16.238 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[213.176.16.238 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[213.176.16.238 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[213.176.16.238 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[213.176.16.238 listed in will-spam-for-food.eu.org]

[213.176.16.238 listed in will-spam-for-food.eu.org]

[213.176.16.238 listed in will-spam-for-food.eu.org]

[213.176.16.238 listed in will-spam-for-food.eu.org]

[213.176.16.238 listed in will-spam-for-food.eu.org]

[213.176.16.238 listed in will-spam-for-food.eu.org]

[213.176.16.238 listed in will-spam-for-food.eu.org]

[213.176.16.238 listed in will-spam-for-food.eu.org]

-0.0 SPF_HELO_PASS SPF: HELO matches SPF record

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.3 HTML_IMAGE_ONLY_04 BODY: HTML: images with 0-400 bytes of words

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.1 HTML_SHORT_LINK_IMG_1 HTML is very short with a linked image

1.3 RDNS_NONE Delivered to internal network by a host with no rDNS

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

0.4 TO_EQ_FM_DIRECT_MX To == From and direct-to-MX

0.0 TO_EQ_FM_HTML_DIRECT To == From and HTML only, direct-to-MX

2.2 TO_EQ_FM_DOM_HTML_ONLY To domain == From domain and HTML only

Subject: {SPAM?} Confirmation Needed

CLICK HERE

Unsubscribe
115 E 23rd St New York, NY, US 10010

costco phish

Posted by Dave Yadallee on Thursday, April 9. 2026

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 09 Apr 2026 12:38:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1wAuFo-000000008gv-0Um6

for dave@doctor.nl2k.ab.ca;

Thu, 09 Apr 2026 12:37:24 -0600

Resent-From: The Doctor

Resent-Date: Thu, 9 Apr 2026 12:37:24 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from [213.176.16.238] (port=52191 helo=weslandbol.nl)

by doctor.nl2k.ab.ca with esmtp (Exim 4.98.2 (FreeBSD))

id 1wAtIK-000000004dJ-0msX

for games@nl2k.ab.ca;

Thu, 09 Apr 2026 11:36:00 -0600

DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; s=smtp; d=nl2k.ab.ca;

h=Date:To:From:Subject:Content-Type:Mime-Version:Content-Transfer-Encoding; i=games@nl2k.ab.ca;

bh=rfR57kAMZb2RIy0iE3BOyHJHMLI=;

b=Gn6LMBwBxxTvY4s7bqTshVBsgJqy7rNQkDFziNbXjanajT/Xz+M0Lg7vGdTcqodHvw5/hroLJ36c

G6J6HfQtkwSX937k6RkQv2ndWpPGqMf3HT1MpdHPUnFIaRRvunQP0m3Zk8Ck92t5h12dLJY0Kcfj

EkctAE7wr6DJIb1yWxelsFpxaDXL4TRdv6Ow5AlYWst3UIdJU4Pv6Z5W57pU9RCAv97rOrx3UvJZ

EvzIrAB7EUWEi8TwyxEF4ep1M+7GbL4l5iSTeP/H/Lj787bD0Wq6GN+iXH7cBYFC9DWevl9AZTu9

pgLctQoYHhATleHgLwYGyz0iBXzwwUtUWE+zdQ==

DomainKey-Signature: a=rsa-sha1; c=nofws; q=dns; s=smtp; d=nl2k.ab.ca;

b=nSaD9sDg/F+I5ZSIQ27JZg+MaU2tBKwpxx7p54vsIyeUAquwNnYnX31ycGMEA5o3x45RzSSUXxau

G1ySGJ9ZZKs9L20leFoSoFT7YzIOedal7BwqDIGJjSyM32BFVX0M1HjQGAD2YpIbWBp34aMl5TfB

SRe77eDObcBS5ClIe5lagTAKiuH49qL3byDH+TFO3Egb/hTd98z5NZyowxBSoXhBTJtnuwLgBdyh

0KWdVMU8KzPAdBLj0vqDMRTENl3at4j7vvwW06AJAI/FnN89jyzzRmVJmo/Gzx7PEXUGdw/9q2sG

stDW7qseVjhzVYqYy0UrQ81kb3jSdiwZwO0LCg==;

Date: Thu, 09 Apr 2026 17:34:54 +0000

To: games@nl2k.ab.ca

From: FinalNotice

Subject: Confirmation Needed

Content-Type: text/html; charset="UTF-8"

Mime-Version: 1.0

Content-Transfer-Encoding: 8bit

X-Spam_score: 10.7

X-Spam_score_int: 107

X-Spam_bar: ++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.

Content preview: CLICK HERE Unsubscribe 115 E 23rd St New York, NY, US 10010

Content analysis details: (10.7 points, 5.0 required)

pts rule name description

---- ---------------------- --------------------------------------------------

0.1 MISSING_MID Missing Message-Id: header

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[213.176.16.238 listed in dnsbl.ahbl.org]

[213.176.16.238 listed in dnsbl.ahbl.org]

[213.176.16.238 listed in dnsbl.ahbl.org]

[213.176.16.238 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[213.176.16.238 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[213.176.16.238 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[213.176.16.238 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[213.176.16.238 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[213.176.16.238 listed in will-spam-for-food.eu.org]

[213.176.16.238 listed in will-spam-for-food.eu.org]

[213.176.16.238 listed in will-spam-for-food.eu.org]

[213.176.16.238 listed in will-spam-for-food.eu.org]

[213.176.16.238 listed in will-spam-for-food.eu.org]

[213.176.16.238 listed in will-spam-for-food.eu.org]

[213.176.16.238 listed in will-spam-for-food.eu.org]

[213.176.16.238 listed in will-spam-for-food.eu.org]

-0.0 SPF_HELO_PASS SPF: HELO matches SPF record

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.3 HTML_IMAGE_ONLY_04 BODY: HTML: images with 0-400 bytes of words

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.1 HTML_SHORT_LINK_IMG_1 HTML is very short with a linked image

1.3 RDNS_NONE Delivered to internal network by a host with no rDNS

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

0.0 TO_EQ_FM_HTML_DIRECT To == From and HTML only, direct-to-MX

2.2 TO_EQ_FM_DOM_HTML_ONLY To domain == From domain and HTML only

0.4 TO_EQ_FM_DIRECT_MX To == From and direct-to-MX

Subject: {SPAM?} Confirmation Needed

CLICK HERE

Unsubscribe
115 E 23rd St New York, NY, US 10010

Costco phish

Posted by Dave Yadallee on Thursday, April 9. 2026

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 09 Apr 2026 12:38:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1wAuFh-000000008gc-0vDs

for dave@doctor.nl2k.ab.ca;

Thu, 09 Apr 2026 12:37:17 -0600

Resent-From: The Doctor

Resent-Date: Thu, 9 Apr 2026 12:37:17 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from [213.176.16.238] (port=52191 helo=weslandbol.nl)

by doctor.nl2k.ab.ca with esmtp (Exim 4.98.2 (FreeBSD))

id 1wAtIF-000000004dJ-0DXp

for root@nl2k.ab.ca;

Thu, 09 Apr 2026 11:35:55 -0600

DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; s=smtp; d=nl2k.ab.ca;

h=Date:To:From:Subject:Content-Type:Mime-Version:Content-Transfer-Encoding; i=root@nl2k.ab.ca;

bh=7B9TmL6pM+GKinS3Kd21v89Blcg=;

b=cvdR/Z6r3zoh7ejhvyGcqK9OSZzLB2Sex5oh0XVJ0geVl/YahBpHIxdzh6PZXfqSBQbRl3IVGZwo

utIz3fn+/sU5aI9lnF5/WoIqGq/O4MEAun97AMzI3FMVQNZiAuY+2ygDtMVglghCXeREb4NOin6W

nyyQuuFqd6Vx1lBClsTZgDBiANRd0BQa4+x+/4lgXDjePtOx9YEhWrl3lF3cKn9lxeVEHox3EvKd

BGT1tuGN6f+XXY1Jjl7PQyzJKwZIy5mIdx8wSxLYpzSOmvSMOmni1WUXC+qdDBRIQpA13XFsXmWO

Up9dckp/1bPJoYxVzW+ldC1div6zZ3ONKBJ8Ew==

DomainKey-Signature: a=rsa-sha1; c=nofws; q=dns; s=smtp; d=nl2k.ab.ca;

b=kn3V1/ctoSeAwQ7ycBSMqaKh3mVR278ZgTrne3vZY1SPYOuzHVkTI/ONeRUwyiwaOS5MJLyLCojX

PRVgqR1NeVCtEHzw+2gCtTkWWGs5vRYhYc85G4EZeux7/+A3Hut4V90jPIccUWhyCawIXToc2yHw

Br8pw1Xa5g1s03q8HNUIHf2H+aKhMEETjMVwrzZGZeVlwh2P3xZI4w+qoyvNqHx1JI5BssZYcDaC

W/iYh4ExHWOZr9CSzhFXrC/KNmc+RQdnwASIL/zzgCoYBAc7THUH/IY509xfn1TLvGBkc6N2pP2w

D53YElw16Cv9yrK2Ph0W0XlC7KJ8VQ3Zw/nSEA==;

Date: Thu, 09 Apr 2026 17:34:54 +0000

To: root@nl2k.ab.ca

From: FinalNotice

Subject: Confirmation Needed

Content-Type: text/html; charset="UTF-8"

Mime-Version: 1.0

Content-Transfer-Encoding: 8bit

X-Spam_score: 10.7

X-Spam_score_int: 107

X-Spam_bar: ++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.

Content preview: CLICK HERE Unsubscribe 115 E 23rd St New York, NY, US 10010

Content analysis details: (10.7 points, 5.0 required)

pts rule name description

---- ---------------------- --------------------------------------------------

0.1 MISSING_MID Missing Message-Id: header

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[213.176.16.238 listed in dnsbl.ahbl.org]

[213.176.16.238 listed in dnsbl.ahbl.org]

[213.176.16.238 listed in dnsbl.ahbl.org]

[213.176.16.238 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[213.176.16.238 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[213.176.16.238 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[213.176.16.238 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[213.176.16.238 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[213.176.16.238 listed in will-spam-for-food.eu.org]

[213.176.16.238 listed in will-spam-for-food.eu.org]

[213.176.16.238 listed in will-spam-for-food.eu.org]

[213.176.16.238 listed in will-spam-for-food.eu.org]

[213.176.16.238 listed in will-spam-for-food.eu.org]

[213.176.16.238 listed in will-spam-for-food.eu.org]

[213.176.16.238 listed in will-spam-for-food.eu.org]

[213.176.16.238 listed in will-spam-for-food.eu.org]

-0.0 SPF_HELO_PASS SPF: HELO matches SPF record

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.3 HTML_IMAGE_ONLY_04 BODY: HTML: images with 0-400 bytes of words

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

1.3 RDNS_NONE Delivered to internal network by a host with no rDNS

0.1 HTML_SHORT_LINK_IMG_1 HTML is very short with a linked image

0.4 TO_EQ_FM_DIRECT_MX To == From and direct-to-MX

2.2 TO_EQ_FM_DOM_HTML_ONLY To domain == From domain and HTML only

0.0 TO_EQ_FM_HTML_DIRECT To == From and HTML only, direct-to-MX

Subject: {SPAM?} Confirmation Needed

CLICK HERE

Unsubscribe
115 E 23rd St New York, NY, US 10010

Costco phish

Posted by Dave Yadallee on Thursday, April 9. 2026

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 09 Apr 2026 12:38:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1wAuFk-000000008gk-2pCN

for dave@doctor.nl2k.ab.ca;

Thu, 09 Apr 2026 12:37:20 -0600

Resent-From: The Doctor

Resent-Date: Thu, 9 Apr 2026 12:37:20 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from [213.176.16.238] (port=47089 helo=weslandbol.nl)

by doctor.nl2k.ab.ca with esmtp (Exim 4.98.2 (FreeBSD))

id 1wAtI6-000000004dK-3PzD

for root@mail.nl2k.ab.ca;

Thu, 09 Apr 2026 11:35:50 -0600

DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; s=smtp; d=mail.nl2k.ab.ca;

h=Date:To:From:Subject:Content-Type:Mime-Version:Content-Transfer-Encoding; i=root@mail.nl2k.ab.ca;

bh=a3UI2tba0Fwwlm3IKgJTNzZE3A4=;

b=k+UxPvMjrT7aIZfBEtg7cHt/oA7QbLKRTMy1U3YzBhUPyCNdxal77QzYjc3mYThgurWHh6XQUBJW

CU3pzVRzJgAZiwFFYm9h66XTOVpb9Vm7Jx4YRU+zjTSn+y1DKButtlqhK4L58hT3xFJf2Df7jR+4

m+dFutMBzaYAyxIGZZ7p2Iixf5VxbzLaObu+N3Rz4qh0MUsWThJ/aNpH/8ljVDCH14lZTQSTXoAw

m/otxi+VCwwsrv8JICUIV/ne1gBIURq23f/12FXhD/nK+OdAo39menYzAKMDGdpjDZsuW8LkGaJD

4glYtfFrl2uehLf9AdppmRBNS/nLTaMdwjcPyQ==

DomainKey-Signature: a=rsa-sha1; c=nofws; q=dns; s=smtp; d=mail.nl2k.ab.ca;

b=EnTTFROeQvaKsJyvAofBsIqS02oRr/BsPefVSTxoHDf5HH46qlPdzooEsvYi8Kwr9fU3NouOow2m

GLn9ztMX7jAEEYsX4tYWE/DmTSKeRSbcnGSDIIAzk+j6lRUB07Ow7UjPWFRXiK+mgWXQFTlRRge4

5LMLhavdp1edp0VmM1qIIe1lX5fxSioIdmcQhGylr2teqEAWHV/fc89ST4p1+iEXjV5Kmu1UBXTB

3uk8GU7FLBzeLg3WNAiX0oX7b66lFeNvbeurcY7P2fT9WULAXSKCnkzKa44ijRYy8H6Fp8u/P2BI

clbBXpZjxg2RzlmRx4C81eTLQzZqxMZI0NOA5g==;

Date: Thu, 09 Apr 2026 17:34:54 +0000

To: root@mail.nl2k.ab.ca

From: FinalNotice

Subject: Confirmation Needed

Content-Type: text/html; charset="UTF-8"

Mime-Version: 1.0

Content-Transfer-Encoding: 8bit

X-Spam_score: 10.7

X-Spam_score_int: 107

X-Spam_bar: ++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.

Content preview: CLICK HERE Unsubscribe 115 E 23rd St New York, NY, US 10010

Content analysis details: (10.7 points, 5.0 required)

pts rule name description

---- ---------------------- --------------------------------------------------

0.1 MISSING_MID Missing Message-Id: header

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[213.176.16.238 listed in dnsbl.ahbl.org]

[213.176.16.238 listed in dnsbl.ahbl.org]

[213.176.16.238 listed in dnsbl.ahbl.org]

[213.176.16.238 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[213.176.16.238 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[213.176.16.238 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[213.176.16.238 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[213.176.16.238 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[213.176.16.238 listed in will-spam-for-food.eu.org]

[213.176.16.238 listed in will-spam-for-food.eu.org]

[213.176.16.238 listed in will-spam-for-food.eu.org]

[213.176.16.238 listed in will-spam-for-food.eu.org]

[213.176.16.238 listed in will-spam-for-food.eu.org]

[213.176.16.238 listed in will-spam-for-food.eu.org]

[213.176.16.238 listed in will-spam-for-food.eu.org]

[213.176.16.238 listed in will-spam-for-food.eu.org]

-0.0 SPF_HELO_PASS SPF: HELO matches SPF record

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.3 HTML_IMAGE_ONLY_04 BODY: HTML: images with 0-400 bytes of words

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

0.1 HTML_SHORT_LINK_IMG_1 HTML is very short with a linked image

1.3 RDNS_NONE Delivered to internal network by a host with no rDNS

0.4 TO_EQ_FM_DIRECT_MX To == From and direct-to-MX

0.0 TO_EQ_FM_HTML_DIRECT To == From and HTML only, direct-to-MX

2.2 TO_EQ_FM_DOM_HTML_ONLY To domain == From domain and HTML only

Subject: {SPAM?} Confirmation Needed

CLICK HERE

Unsubscribe
115 E 23rd St New York, NY, US 10010

Costco phish

Posted by Dave Yadallee on Thursday, April 9. 2026

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path: <>

Envelope-to: dave@nl2k.ab.ca

Delivery-date: Thu, 09 Apr 2026 11:36:00 -0600

Received: from [213.176.16.238] (port=52191 helo=weslandbol.nl)

by doctor.nl2k.ab.ca with esmtp (Exim 4.98.2 (FreeBSD))

id 1wAtI6-000000004dJ-3Q1z

for dave@nl2k.ab.ca;

Thu, 09 Apr 2026 11:35:50 -0600

DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; s=smtp; d=nl2k.ab.ca;

h=Date:To:From:Subject:Content-Type:Mime-Version:Content-Transfer-Encoding; i=dave@nl2k.ab.ca;

bh=3oKyTa9EQmW6Cko2pZ3Scv6dj+U=;

b=C5P1VOJmklJO9ZCsXtsVFFMEYvpu5ujionVh3vXqRXM9cQX3AEP8bVaD9qSK627h3+tIoayTBZRx

JGnFED5HGXGtb3aQJI/LRPcSKhHBPOsfoepxlp92XuR/wZJYll8aYSrA1tXAcXUUqgBkiwjh6wSL

OddsdXjFh0zij6S7ghp3GXuVjx77ZaTn15qIMvTQ2fmkjCkT1Ey2H42IsxSMeBIMQcaB4rxFgsUf

MJCVKfCeoiSaMafu7JHdS64VP5cGlhcwwjn7uLyjCuxH/lUfIngTdE4G2CVjFn5Z9AyxPonX86t5

kk8/N+nBI8mrk5mWkojgh00xyvwZtlppJOmBZg==

DomainKey-Signature: a=rsa-sha1; c=nofws; q=dns; s=smtp; d=nl2k.ab.ca;

b=IUPSpumMrG0lNGHE560Gl0Dg5szb0vHr36772E8WdmX541LQTxV27xyrDq7L63wB427aJbFb1K38

U6DI3VoFFtfy8RgLzSH3USq6ShVd5DVV8QtNFlIkkWB0AYkCAkJmAb7rmc4UfSSZvB1BQlKU7i3Y

OT59tHZWKT+pbGNr7lbVlOI4z21uaZxtCZlgcbtPF9/4NxheFQ9Z8oc0UkDIvTDhiwBVjbeJ4LQY

Gezn+4+E4SMaN8puVGjLWKJUtI/rW/hZHDPjivhIE07Km/roEWuCOU3u1oyPHxWbhU3DYziaWsqx

PN4ST6cz7oLoEWe+oE84bzbwzbCZfgmzFca9zA==;

Date: Thu, 09 Apr 2026 17:34:53 +0000

To: dave@nl2k.ab.ca

From: FinalNotice

Subject: Confirmation Needed

Content-Type: text/html; charset="UTF-8"

Mime-Version: 1.0

Content-Transfer-Encoding: 8bit

X-Spam_score: 10.7

X-Spam_score_int: 107

X-Spam_bar: ++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.

Content preview: CLICK HERE Unsubscribe 115 E 23rd St New York, NY, US 10010

Content analysis details: (10.7 points, 5.0 required)

pts rule name description

---- ---------------------- --------------------------------------------------

0.1 MISSING_MID Missing Message-Id: header

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[213.176.16.238 listed in dnsbl.ahbl.org]

[213.176.16.238 listed in dnsbl.ahbl.org]

[213.176.16.238 listed in dnsbl.ahbl.org]

[213.176.16.238 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[213.176.16.238 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[213.176.16.238 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[213.176.16.238 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[213.176.16.238 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[213.176.16.238 listed in will-spam-for-food.eu.org]

[213.176.16.238 listed in will-spam-for-food.eu.org]

[213.176.16.238 listed in will-spam-for-food.eu.org]

[213.176.16.238 listed in will-spam-for-food.eu.org]

[213.176.16.238 listed in will-spam-for-food.eu.org]

[213.176.16.238 listed in will-spam-for-food.eu.org]

[213.176.16.238 listed in will-spam-for-food.eu.org]

[213.176.16.238 listed in will-spam-for-food.eu.org]

-0.0 SPF_HELO_PASS SPF: HELO matches SPF record

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.3 HTML_IMAGE_ONLY_04 BODY: HTML: images with 0-400 bytes of words

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.1 HTML_SHORT_LINK_IMG_1 HTML is very short with a linked image

1.3 RDNS_NONE Delivered to internal network by a host with no rDNS

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

2.2 TO_EQ_FM_DOM_HTML_ONLY To domain == From domain and HTML only

0.4 TO_EQ_FM_DIRECT_MX To == From and direct-to-MX

0.0 TO_EQ_FM_HTML_DIRECT To == From and HTML only, direct-to-MX

Subject: {SPAM?} Confirmation Needed

CLICK HERE

Unsubscribe
115 E 23rd St New York, NY, US 10010

Costco Phish

Posted by Dave Yadallee on Thursday, April 9. 2026

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 09 Apr 2026 12:38:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1wAuFd-000000008gP-3ao4

for dave@doctor.nl2k.ab.ca;

Thu, 09 Apr 2026 12:37:13 -0600

Resent-From: The Doctor

Resent-Date: Thu, 9 Apr 2026 12:37:13 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from [213.176.16.238] (port=36229 helo=weslandbol.nl)

by doctor.nl2k.ab.ca with esmtp (Exim 4.98.2 (FreeBSD))

id 1wAtI6-000000004dI-3Pw6

for support@nk.ca;

Thu, 09 Apr 2026 11:35:54 -0600

DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; s=smtp; d=nk.ca;

h=Date:To:From:Subject:Content-Type:Mime-Version:Content-Transfer-Encoding; i=support@nk.ca;

bh=Gl5rLbXNOU+8SHeMiiedGyNwAoA=;

b=VoC8TmSLTJaWmNolVmYeEh/VpcyiCGyftJcpFVAoelG0y15zYmTVGVMogaHLy4Atv4+JnwuEn96r

NblFeTRmiIJfeJ5fDHqWjJZKJNi2eFwsOsdaSIZoTXzZPzrhss0kAvrP1N9b7w5GKSsAVoz9PYhJ

Z6mz08OrG3scZ3gGXAU1VoyOKpaWSK6JGdZo0IXNn2Qv7rneDYEoTeUeRe0GdX6JCEm+8tKWqEwZ

w5xNhEzsSy4gLY6tFNuUHaC4K/rxdI42pu76HRedl9yT+3x9hfP4bOQn1cZ8FKQKLgQQYPWq4m+D

F2IjIMQfFtUqVmKlGdrEjQYXpyqbLFF+f5dXSA==

DomainKey-Signature: a=rsa-sha1; c=nofws; q=dns; s=smtp; d=nk.ca;

b=rIC8Gy6gT8Xp/Pxc5hKut/jXyz1Wf3yKgqfyAPd8QPQQP98MZg0oKhnWFawrYI2v1izlHore5H42

nbin67OVXEwepd5eTm+lrf1BsDRTEIe/2avh+Wqnes2+XScUs0SIvF2Do0d2gdlLlUE2/GeiV6c0

0pRh2W3m+KEVUANXZdaZg6mcx+BVPZi//mont7ApwPDrMCUecnY+9NjdAMqj+eIZTB/kKNR32WnH

RfzWum0y5nT3s0w/UV4pKHuOtLIT2PEeH2GD+S0bGb4VokIa8cgZYIijEZcMpdHzg4YnBs6eiItU

KjI0HDsAWY3FvZdLj1gKuN0i8TjoHbxUrqwddQ==;

Date: Thu, 09 Apr 2026 17:34:53 +0000

To: support@nk.ca

From: FinalNotice

Subject: Confirmation Needed

Content-Type: text/html; charset="UTF-8"

Mime-Version: 1.0

Content-Transfer-Encoding: 8bit

X-Spam_score: 10.7

X-Spam_score_int: 107

X-Spam_bar: ++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.

Content preview: CLICK HERE Unsubscribe 115 E 23rd St New York, NY, US 10010

Content analysis details: (10.7 points, 5.0 required)

pts rule name description

---- ---------------------- --------------------------------------------------

0.1 MISSING_MID Missing Message-Id: header

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[213.176.16.238 listed in dnsbl.ahbl.org]

[213.176.16.238 listed in dnsbl.ahbl.org]

[213.176.16.238 listed in dnsbl.ahbl.org]

[213.176.16.238 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[213.176.16.238 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[213.176.16.238 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[213.176.16.238 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[213.176.16.238 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[213.176.16.238 listed in will-spam-for-food.eu.org]

[213.176.16.238 listed in will-spam-for-food.eu.org]

[213.176.16.238 listed in will-spam-for-food.eu.org]

[213.176.16.238 listed in will-spam-for-food.eu.org]

[213.176.16.238 listed in will-spam-for-food.eu.org]

[213.176.16.238 listed in will-spam-for-food.eu.org]

[213.176.16.238 listed in will-spam-for-food.eu.org]

[213.176.16.238 listed in will-spam-for-food.eu.org]

-0.0 SPF_HELO_PASS SPF: HELO matches SPF record

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.3 HTML_IMAGE_ONLY_04 BODY: HTML: images with 0-400 bytes of words

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

1.3 RDNS_NONE Delivered to internal network by a host with no rDNS

0.1 HTML_SHORT_LINK_IMG_1 HTML is very short with a linked image

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

2.2 TO_EQ_FM_DOM_HTML_ONLY To domain == From domain and HTML only

0.4 TO_EQ_FM_DIRECT_MX To == From and direct-to-MX

0.0 TO_EQ_FM_HTML_DIRECT To == From and HTML only, direct-to-MX

Subject: {SPAM?} Confirmation Needed

CLICK HERE

Unsubscribe
115 E 23rd St New York, NY, US 10010

Mon	Tue	Wed	Thu	Fri	Sat	Sun
← Back	April '26					Forward →
		1	2	3	4	5
6	7	8	9	10	11	12
13	14	15	16	17	18	19
20	21	22	23	24	25	26
27	28	29	30