Docusign phish from Google Gmail Part 3











3D"Logo"
src=3D"https://docucdn-a.akamaihd.net/olive/images/2.62.=

0/global-assets/email-templates/email-logo.png" width=3D"116" />






3D""
src=3D"https://docucdn-a.akamaihd.net/olive/images/2.76.=

0/email/iconFileWithCheckWhite.png" width=3D"75" />

A document has been sent for your review



target=3D"_blank">View Document








Please review the attached document at your convenience. Contact the =

sender if you have questions.





This invitation is intended only for the recipient and contains secure =

access information.











Confidential: Do not share this email or link with =

others.









About Docusign: Sign securely and legally in minutes, =

from anywhere.





Need help? Contact the sender or visit our support page=

.









Download the app:
.com/features-and-benefits/mobile" target=3D"_blank"> 3D""
height=3D"18" src=3D"https://docucdn-a.akamaihd.net/olive/images/2.62.=

0/global-assets/email-templates/icon-download-app.png" width=3D"18" />Get =

Docusign





Sent by Ashley Allen via Docusign. To unsubscribe, =

contact the sender.





This message contains =

confidential information. If you are not the intended recipient, please =

delete immediately.











Docusign phish from Google Gmail Part 2



=EF=BB=BF


name=3D"viewport" />

Docusign phish from Google Gmail Part 1

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Tue, 07 Jul 2026 17:44:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1whFRT-00000000EGW-0C5P

for dave@doctor.nl2k.ab.ca;

Tue, 07 Jul 2026 17:43:07 -0600

Resent-From: The Doctor

Resent-Date: Tue, 7 Jul 2026 17:43:06 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-oa1-f103.google.com ([209.85.160.103]:44088)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1whEfM-00000000I5n-1eMI

for doctor@netknow.ca;

Tue, 07 Jul 2026 16:53:36 -0600

Received: by mail-oa1-f103.google.com with SMTP id 586e51a60fabf-44cb057311bso47222fac.0

for ; Tue, 07 Jul 2026 15:52:36 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=sabeng.it; s=google; t=1783464750; x=1784069550; darn=netknow.ca;

h=mime-version:date:content-transfer-encoding:message-id:subject:to

:from:from:to:cc:subject:date:message-id:reply-to;

bh=EWV8XmCUvffytCAcw2TyXcQCDCinzlDmbMB2SDY4DX4=;

b=TxUiOsRG5ygsTTp2Rem1eBNX6+1Xz5n4OuY64F5df7ztgP2AaIlbN9KXJVt58Y5dOI

c3C/JGRTuM32pBOtHhFA7htCRgPLJQZnnDucgcKQPzMdIDdL3IwdRJljHUhyN6bz90yL

rER8P6jzMoGcqcrCjpKJ5WlYn48cF5JaU8pAM=

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20251104; t=1783464750; x=1784069550;

h=mime-version:date:content-transfer-encoding:message-id:subject:to

:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date:message-id

:reply-to;

bh=EWV8XmCUvffytCAcw2TyXcQCDCinzlDmbMB2SDY4DX4=;

b=sBppQyZ4EiAXEX11IYOudUKF6qztdUVnoCLv+yqBCL5tWiVh+eh23mKcATD4aTA8wB

wxN5kVfGfxburGz5z4FRlyLxCyv0sTKI1TA+PXNP4tJIAW5MgWRS8hAhZx7wH6l06yvI

1yTsgX6BHVE0XK391T8hCkdU5k03E10E1APd6P8M+Su5FQRbKyuZoAHY1USfwBmGRc1U

GDcK9UNIpp/w3bu/S9I9uKn1YpwxiAkUHHNp4692Iw9mb4LR767ibfWMFliCZJkyWBxF

YsoBcMmSFVFB8T0NQqFLbJ6KXM657nvPN+2vKoiuKG1mhzT1hxnHne0y9l8aDvnRUVjE

ZB0w==

X-Gm-Message-State: AOJu0Yw6UrylTifmhetURbAosa7pD+huhNKEgZiHmLsZRakV+dfkpgxW

OPKtmugX7RW7qwjoiRhcp8YCZxNyVLQpPPs8D/GXS0ErtzyJfTJrvYmQ5D1XNprcgGpKTilmf3H

LlyyClRC7TtOrcvAxxJZHBAvrlSTbauRiCiIEtDWFXlotQ58=

X-Gm-Gg: AfdE7ckzm0bLM6hoAEFvGDPZvwYTjR3dOd9TDZDWV+GUDOjPS6K3/Sjm4RVimbVXwZa

Hkz7fUiYJvKgzTtW27+HWBT/Zib4RE682ldor2Qj6T0nkLp2sMiU1XFKaXFIMmb9o7GGPMmRY4/

a9wasBM+nG8Jxae4mXQm4cMgC6X4GLQdBJS58N9/Fg8F3h745APHzAYRWBgdCOcc1AOPwrUZx6s

455dg2F8HOtk9dmlA8Eg2yWgsUG2SjRKV8vpKoFtzC5meXoEmLj/O0MxS4dJpvdhdu4vllFoO+V

nYG3WrMN+0Crs2CdAKMgolqatZP9yl5Av/wGQcblQivfP9uZ3mQUWumJacV3EFFQFulOwa+Muo1

LIz90rhNxVkUGKmvEabjmwNk=

X-Received: by 2002:a05:6871:2e94:b0:448:558c:d850 with SMTP id 586e51a60fabf-4510637007fmr4485748fac.43.1783464750358;

Tue, 07 Jul 2026 15:52:30 -0700 (PDT)

Received: from sabprogetti.com ([192.210.236.148])

by smtp-relay.gmail.com with ESMTPS id 586e51a60fabf-44cfb5ab52asm1591009fac.3.2026.07.07.15.52.30

for

(version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256);

Tue, 07 Jul 2026 15:52:30 -0700 (PDT)

X-Relaying-Domain: sabeng.it

From: "Incoming_Payment|Schedule| Online Review/OU=EXCHANGE ADMINISTRATIVE

GROUP (FYDIBOHF23SPDLT)/CN=RECIPIENTS/CN=B7A707497B564FD-55757"



To: doctor@netknow.ca

Subject: =?UTF-8?Q?Invoice_and_Payment_Documentation_Enclos?=

=?UTF-8?Q?ed_for_Review_=EF=BF=BD_07/07/2026_?=

=?UTF-8?Q?=EF=BF=BD_doctor=40netknow=2Eca?=

Message-ID: <8d32afef-ddf7-68df-e16d-9a0dadf3d89b@sabeng.it>

Content-Transfer-Encoding: quoted-printable

Date: Tue, 07 Jul 2026 22:52:28 +0000

MIME-Version: 1.0

Content-Type: text/html; charset=utf-8

X-Spam_score: 6.1

X-Spam_score_int: 61

X-Spam_bar: ++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview:  A document has been sent for your review View Document

Please review the attached document at your convenience. Contact the sender

if you have questions.



Content analysis details: (6.1 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[192.210.236.148 listed in dnsbl.ahbl.org]

[192.210.236.148 listed in dnsbl.ahbl.org]

[192.210.236.148 listed in dnsbl.ahbl.org]

[192.210.236.148 listed in dnsbl.ahbl.org]

[209.85.160.103 listed in dnsbl.ahbl.org]

[209.85.160.103 listed in dnsbl.ahbl.org]

[209.85.160.103 listed in dnsbl.ahbl.org]

[209.85.160.103 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[192.210.236.148 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[192.210.236.148 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[192.210.236.148 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[192.210.236.148 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[192.210.236.148 listed in will-spam-for-food.eu.org]

[192.210.236.148 listed in will-spam-for-food.eu.org]

[192.210.236.148 listed in will-spam-for-food.eu.org]

[192.210.236.148 listed in will-spam-for-food.eu.org]

[192.210.236.148 listed in will-spam-for-food.eu.org]

[192.210.236.148 listed in will-spam-for-food.eu.org]

[192.210.236.148 listed in will-spam-for-food.eu.org]

[192.210.236.148 listed in will-spam-for-food.eu.org]

[209.85.160.103 listed in will-spam-for-food.eu.org]

[209.85.160.103 listed in will-spam-for-food.eu.org]

[209.85.160.103 listed in will-spam-for-food.eu.org]

[209.85.160.103 listed in will-spam-for-food.eu.org]

[209.85.160.103 listed in will-spam-for-food.eu.org]

[209.85.160.103 listed in will-spam-for-food.eu.org]

[209.85.160.103 listed in will-spam-for-food.eu.org]

[209.85.160.103 listed in will-spam-for-food.eu.org]

1.2 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a relay in bl.spamcop.net

[Blocked - see ]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[209.85.160.103 listed in list.dnswl.org]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[209.85.160.103 listed in bl.score.senderscore.com]

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[209.85.160.103 listed in wl.mailspike.net]

-0.0 SPF_PASS SPF: sender matches SPF record

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

2.0 RATWR8_MESSID Message-ID with excessive dashes and dollars

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

0.0 NO_RDNS2 Sending MTA has no reverse DNS

0.6 HTML_MIME_NO_HTML_TAG HTML-only message, but there is no HTML tag

Subject: {SPAM?} =?UTF-8?Q?Invoice_and_Payment_Documentation_Enclos?=

=?UTF-8?Q?ed_for_Review_=EF=BF=BD_07/07/2026_?=

=?UTF-8?Q?=EF=BF=BD_doctor=40netknow=2Eca?=

Docusign phish from Google Gmail Part 3









3D"Logo"
src=3D"https://docucdn-a.akamaihd.net/olive/images/2.62.=

0/global-assets/email-templates/email-logo.png" width=3D"116" />






3D""
src=3D"https://docucdn-a.akamaihd.net/olive/images/2.76.=

0/email/iconFileWithCheckWhite.png" width=3D"75" />

A document has been sent for your review



target=3D"_blank">View Document








Please review the attached document at your convenience. Contact the =

sender if you have questions.





This invitation is intended only for the recipient and contains secure =

access information.











Confidential: Do not share this email or link with =

others.









About Docusign: Sign securely and legally in minutes, =

from anywhere.





Need help? Contact the sender or visit our support page=

.









Download the app:
.com/features-and-benefits/mobile" target=3D"_blank"> 3D""
height=3D"18" src=3D"https://docucdn-a.akamaihd.net/olive/images/2.62.=

0/global-assets/email-templates/icon-download-app.png" width=3D"18" />Get =

Docusign





Sent by Ashley Allen via Docusign. To unsubscribe, =

contact the sender.





This message contains =

confidential information. If you are not the intended recipient, please =

delete immediately.











Docusign phish from Google Gmail Part 2





=EF=BB=BF


name=3D"viewport" />

Docusign phish from Google Gmail Part 1

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@nl2k.ab.ca

Delivery-date: Tue, 07 Jul 2026 16:17:00 -0600

Received: from mail-qt1-f230.google.com ([209.85.160.230]:59466)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1whE5u-00000000BbR-1Qui

for dave@nl2k.ab.ca;

Tue, 07 Jul 2026 16:16:54 -0600

Received: by mail-qt1-f230.google.com with SMTP id d75a77b69052e-51c01089e8aso37212361cf.2

for ; Tue, 07 Jul 2026 15:15:59 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=sabeng.it; s=google; t=1783462553; x=1784067353; darn=nl2k.ab.ca;

h=content-type:mime-version:date:content-transfer-encoding:message-id

:subject:to:from:from:to:cc:subject:date:message-id:reply-to

:content-type;

bh=EWV8XmCUvffytCAcw2TyXcQCDCinzlDmbMB2SDY4DX4=;

b=GENNvtqnoWR9+jgmfuYywMh3O5DZiOXQ8zmqxWxL8snCQoLXwiMFQGKyYhIUrALYiV

pXPlQekIT81nYfTa6rG0KgMEp40zq7FQ9rPJY2YPuKbA+unBooMTI85bEWFNq71Cpy5O

1veJ5IB8cXXhTKbsaZt1pncUFToATjmSs+M3A=

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20251104; t=1783462553; x=1784067353;

h=content-type:mime-version:date:content-transfer-encoding:message-id

:subject:to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date

:message-id:reply-to:content-type;

bh=EWV8XmCUvffytCAcw2TyXcQCDCinzlDmbMB2SDY4DX4=;

b=SUAZx86PttUbJcLKM78Ov2WDY0EXdxXECUFRVnZU6DH4A3NvBzo78kELuldgI7Ppsl

eRTAw9OwLF2tK1wZKYj9Na6f1Bp192dfwO1/wdB63tMXOWzTeuth/bUisPz6wuWAFF1/

8Selx0nQCkfkd2fUQn7A7pVhqRotHx+x1Ki6ctbmtWLeH8EV8GafdodCQkAsztStGV2A

i2Hgfb8uwJtW4XfaUWYzhjnM4ZdboWd6huHOYA6ITIb5xJe0uqcva3iHkk1BxfjqQN6J

sUyQddzg6PfWZGdFpqjs0YZYOGHBB47/XiviRMFDLkesmdaCkE2cJ0s32aURxpurTXb2

NMCg==

X-Gm-Message-State: AOJu0YzrAhewClnI2S8p5LACnkBzlJoVm80cgULu2d8Te5i21A8sMGGf

yGrY2YlL1QmFGjb3kilhFvYHw72YpaAUXtNCCRSvW1JjcPb655ydrQje8q8pq4GQWYNS5g9aM45

CteAK2mCb2gzpMbelsZRCnk/Wcba+ycqp6XCS/I0ej9On2bc=

X-Gm-Gg: AfdE7cnu/ApLB5Pc2cETU014pwxfOP+Nufp89hshtVWJOPsnqHldWVTCkLbsDAm+GFm

nrSffKjYn91rri5yeUfuK+W9ul73sAP6bU8QwFrgp+DPCm0vfI5akwwxa45KoV6zQPesl2lQ80A

rVJ6Jw8+K22/9lhe1wlEGk1gIoTSRl47fRQYBNhQh2C7SBPmcnhBhti2vHX1G/JXSco/1SYLZ6a

ja7MdQ386adAC7WUCUQ8oEbtMibIHj2dkHZDcO3G59yxwpjDo/hD9lOihiSlN08xd8F32SPmh3j

jEulkMcfgBGF17VVeD3F+/e9xWSO7JFY0fVyGm4XuAbIGHsCeHOKcfKw2h+lzveJr0DnZaTu+tT

eId1RHTbvjB2AkrhtTvucVg==

X-Received: by 2002:a05:622a:1f88:b0:51c:1c00:e46 with SMTP id d75a77b69052e-51c8b303215mr979411cf.25.1783462552995;

Tue, 07 Jul 2026 15:15:52 -0700 (PDT)

Received: from sabprogetti.com ([192.210.236.148])

by smtp-relay.gmail.com with ESMTPS id d75a77b69052e-51c41931526sm7041581cf.0.2026.07.07.15.15.52

for

(version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256);

Tue, 07 Jul 2026 15:15:52 -0700 (PDT)

X-Relaying-Domain: sabeng.it

From: "Incoming_Payment|Schedule| Online Review/OU=EXCHANGE ADMINISTRATIVE

GROUP (FYDIBOHF23SPDLT)/CN=RECIPIENTS/CN=B7A707497B564FD-70349"



To: dave@nl2k.ab.ca

Subject: =?UTF-8?Q?Please_Review_the_Attached_Slip=2C_Invoi?=

=?UTF-8?Q?ce_=26_Payment_Report_=EF=BF=BD_07/07/20?=

=?UTF-8?Q?26_=EF=BF=BD_dave=40nl2k=2Eab=2Eca?=

Message-ID: <3ee50806-7430-30e4-4715-269876d8abf8@sabeng.it>

Content-Transfer-Encoding: quoted-printable

Date: Tue, 07 Jul 2026 22:15:51 +0000

MIME-Version: 1.0

Content-Type: text/html; charset=utf-8

X-Spam_score: 6.1

X-Spam_score_int: 61

X-Spam_bar: ++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview:  A document has been sent for your review View Document

Please review the attached document at your convenience. Contact the sender

if you have questions.



Content analysis details: (6.1 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[192.210.236.148 listed in dnsbl.ahbl.org]

[192.210.236.148 listed in dnsbl.ahbl.org]

[192.210.236.148 listed in dnsbl.ahbl.org]

[192.210.236.148 listed in dnsbl.ahbl.org]

[209.85.160.230 listed in dnsbl.ahbl.org]

[209.85.160.230 listed in dnsbl.ahbl.org]

[209.85.160.230 listed in dnsbl.ahbl.org]

[209.85.160.230 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[192.210.236.148 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[192.210.236.148 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[192.210.236.148 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[192.210.236.148 listed in dnsbl.ahbl.org]

1.2 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a relay in bl.spamcop.net

[Blocked - see ]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[192.210.236.148 listed in will-spam-for-food.eu.org]

[192.210.236.148 listed in will-spam-for-food.eu.org]

[192.210.236.148 listed in will-spam-for-food.eu.org]

[192.210.236.148 listed in will-spam-for-food.eu.org]

[192.210.236.148 listed in will-spam-for-food.eu.org]

[192.210.236.148 listed in will-spam-for-food.eu.org]

[192.210.236.148 listed in will-spam-for-food.eu.org]

[192.210.236.148 listed in will-spam-for-food.eu.org]

[209.85.160.230 listed in will-spam-for-food.eu.org]

[209.85.160.230 listed in will-spam-for-food.eu.org]

[209.85.160.230 listed in will-spam-for-food.eu.org]

[209.85.160.230 listed in will-spam-for-food.eu.org]

[209.85.160.230 listed in will-spam-for-food.eu.org]

[209.85.160.230 listed in will-spam-for-food.eu.org]

[209.85.160.230 listed in will-spam-for-food.eu.org]

[209.85.160.230 listed in will-spam-for-food.eu.org]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[209.85.160.230 listed in list.dnswl.org]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[209.85.160.230 listed in bl.score.senderscore.com]

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[209.85.160.230 listed in wl.mailspike.net]

-0.0 SPF_PASS SPF: sender matches SPF record

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

2.0 RATWR8_MESSID Message-ID with excessive dashes and dollars

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

0.0 NO_RDNS2 Sending MTA has no reverse DNS

0.6 HTML_MIME_NO_HTML_TAG HTML-only message, but there is no HTML tag

Subject: {SPAM?} =?UTF-8?Q?Please_Review_the_Attached_Slip=2C_Invoi?=

=?UTF-8?Q?ce_=26_Payment_Report_=EF=BF=BD_07/07/20?=

=?UTF-8?Q?26_=EF=BF=BD_dave=40nl2k=2Eab=2Eca?=

Docusign phish from Google Gmail Part 2





=EF=BB=BF


name=3D"viewport" />

Docusign phish from Google Gmail Part 3









3D"Logo"
src=3D"https://docucdn-a.akamaihd.net/olive/images/2.62.=

0/global-assets/email-templates/email-logo.png" width=3D"116" />






3D""
src=3D"https://docucdn-a.akamaihd.net/olive/images/2.76.=

0/email/iconFileWithCheckWhite.png" width=3D"75" />

A document has been sent for your review



target=3D"_blank">View Document








Please review the attached document at your convenience. Contact the =

sender if you have questions.





This invitation is intended only for the recipient and contains secure =

access information.











Confidential: Do not share this email or link with =

others.









About Docusign: Sign securely and legally in minutes, =

from anywhere.





Need help? Contact the sender or visit our support page=

.









Download the app:
.com/features-and-benefits/mobile" target=3D"_blank"> 3D""
height=3D"18" src=3D"https://docucdn-a.akamaihd.net/olive/images/2.62.=

0/global-assets/email-templates/icon-download-app.png" width=3D"18" />Get =

Docusign





Sent by Ashley Allen via Docusign. To unsubscribe, =

contact the sender.





This message contains =

confidential information. If you are not the intended recipient, please =

delete immediately.











Docusign phish from Google Gmail Part 1

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Tue, 07 Jul 2026 17:44:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1whFRa-00000000EGz-1SII

for dave@doctor.nl2k.ab.ca;

Tue, 07 Jul 2026 17:43:14 -0600

Resent-From: The Doctor

Resent-Date: Tue, 7 Jul 2026 17:43:14 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-pl1-f229.google.com ([209.85.214.229]:56404)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1whEfM-00000000I6M-1hvA

for doctor@nk.ca;

Tue, 07 Jul 2026 16:53:36 -0600

Received: by mail-pl1-f229.google.com with SMTP id d9443c01a7336-2cca0c5799eso747575ad.0

for ; Tue, 07 Jul 2026 15:52:36 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=sabeng.it; s=google; t=1783464750; x=1784069550; darn=nk.ca;

h=content-type:mime-version:date:content-transfer-encoding:message-id

:subject:to:from:from:to:cc:subject:date:message-id:reply-to

:content-type;

bh=EWV8XmCUvffytCAcw2TyXcQCDCinzlDmbMB2SDY4DX4=;

b=e90ZA+Gol0yXRXQCRjT+RRivkK6H7zgqbGa20p41vBjRC6eKLzvnlOG6kXO9PtDHJ9

pWxiCXrB3TSXkHA29l35b2XN4sGmR/SID4nBhWaBoF47qfsvD59nIUqryitR5tL6Dho9

uaURnz7rKnNe8UXfhb70l1ck/1s/pshiIt5wc=

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20251104; t=1783464750; x=1784069550;

h=content-type:mime-version:date:content-transfer-encoding:message-id

:subject:to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date

:message-id:reply-to:content-type;

bh=EWV8XmCUvffytCAcw2TyXcQCDCinzlDmbMB2SDY4DX4=;

b=tBP39U9kuba+lya+6grO9u2/76PUlYu1l3cGFQTvUacIv5Y/We82xtolkSXF9Ri/8V

HOs+K0CEyp7XZ6N91NhbQ8RGGW+nlVrvFMKse/XhNTAWoOBg3VeEcPKQyWAxCerQ/oem

h8YaEI2f6T4i9XgQLP73i25SsLqVLO3DLM8Av4ePc6dBmOIXBF2DFVV4yr3wzp+LMMbP

6SsYyjGE+7XYK4ANx87pvY+gijTwTdBJDYVQib6loFhLW/sG+xkGIgxDyJbBVZ8fNG+z

l4hBVI9t8/YP5q1fYzY18liRgGS83BcqXXrwVqe01Khq44BFL6z5VPttBUvvsh+m+5Qa

YRgw==

X-Gm-Message-State: AOJu0YxULub1rLrejIy4sJdMc9TRGvlJ0sbRNgL/hn0cK8LjxWu0wcLR

AsfNIMAGcD46AIpPsoJB3RcLSU5vuaT4sz0FRKUMEiAywI0NKcnXa8ViBdunvKatzTYWI1ix0FD

pDv4l5Fl5CpemhZH/lvoJ+t6fTYuRAzHQVkNe73yKyi8Vn8Q=

X-Gm-Gg: AfdE7ckgEKENE6zSoMkgdNudRIeuj62P5YBcRtHJk9o9+QueKd3wpOfdew0fmFhZ4iw

nVplVhod8nWQrqhYr1bwJXoFuyMQZ2nPdogbWbfrufC4R6t2MERU/6biaq4l1JCMKygvLE63X8V

m6m1x26H/ZHJBeYjuvtm5fmSHhEGEFuRhxTJJTrfI7Bvblx3f8kNgZqME5VM/6WSu6Pn5iYyt2c

bi+ta7+b8ZYYh5KKG7QxXxKR3soskmulEhUaEwjEeSZ0mkcPW35Bgjny9hgOhWzfKXv9EGgrTVo

c1lFJT//fRJxtjbOyM2jdBjQ1fBq/nSdZ4r5N8DhFrqVh9UzS92cg3LxELuG9+mlHrZOeAyohsq

9gHkXqQJwu17xhRpgpg==

X-Received: by 2002:a17:902:ebd1:b0:2c9:ed16:8d8d with SMTP id d9443c01a7336-2ccbf1890d3mr68975175ad.38.1783464750587;

Tue, 07 Jul 2026 15:52:30 -0700 (PDT)

Received: from sabprogetti.com ([192.210.236.148])

by smtp-relay.gmail.com with ESMTPS id d9443c01a7336-2ccc9bdd019sm3313665ad.13.2026.07.07.15.52.30

for

(version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256);

Tue, 07 Jul 2026 15:52:30 -0700 (PDT)

X-Relaying-Domain: sabeng.it

From: "Incoming_Payment | EFT Portal/OU=EXCHANGE ADMINISTRATIVE GROUP

(FYDIBOHF23SPDLT)/CN=RECIPIENTS/CN=B7A707497B564FD-27559"

To: doctor@nk.ca

Subject: =?UTF-8?Q?Attached_Payment_Report_for_Your_Review_?=

=?UTF-8?Q?=EF=BF=BD_07/07/2026_=EF=BF=BD_doctor=40?= =?UTF-8?Q?nk=2Eca?=

Message-ID: <31213b49-f665-fd68-977f-edfe928d705a@sabeng.it>

Content-Transfer-Encoding: quoted-printable

Date: Tue, 07 Jul 2026 22:52:29 +0000

MIME-Version: 1.0

Content-Type: text/html; charset=utf-8

X-Spam_score: 6.3

X-Spam_score_int: 63

X-Spam_bar: ++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview:  A document has been sent for your review View Document

Please review the attached document at your convenience. Contact the sender

if you have questions.



Content analysis details: (6.3 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[192.210.236.148 listed in dnsbl.ahbl.org]

[192.210.236.148 listed in dnsbl.ahbl.org]

[192.210.236.148 listed in dnsbl.ahbl.org]

[192.210.236.148 listed in dnsbl.ahbl.org]

[209.85.214.229 listed in dnsbl.ahbl.org]

[209.85.214.229 listed in dnsbl.ahbl.org]

[209.85.214.229 listed in dnsbl.ahbl.org]

[209.85.214.229 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[192.210.236.148 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[192.210.236.148 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[192.210.236.148 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[192.210.236.148 listed in dnsbl.ahbl.org]

1.2 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a relay in bl.spamcop.net

[Blocked - see ]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[192.210.236.148 listed in will-spam-for-food.eu.org]

[192.210.236.148 listed in will-spam-for-food.eu.org]

[192.210.236.148 listed in will-spam-for-food.eu.org]

[192.210.236.148 listed in will-spam-for-food.eu.org]

[192.210.236.148 listed in will-spam-for-food.eu.org]

[192.210.236.148 listed in will-spam-for-food.eu.org]

[192.210.236.148 listed in will-spam-for-food.eu.org]

[192.210.236.148 listed in will-spam-for-food.eu.org]

[209.85.214.229 listed in will-spam-for-food.eu.org]

[209.85.214.229 listed in will-spam-for-food.eu.org]

[209.85.214.229 listed in will-spam-for-food.eu.org]

[209.85.214.229 listed in will-spam-for-food.eu.org]

[209.85.214.229 listed in will-spam-for-food.eu.org]

[209.85.214.229 listed in will-spam-for-food.eu.org]

[209.85.214.229 listed in will-spam-for-food.eu.org]

[209.85.214.229 listed in will-spam-for-food.eu.org]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[209.85.214.229 listed in list.dnswl.org]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[209.85.214.229 listed in bl.score.senderscore.com]

-0.0 RCVD_IN_MSPIKE_H3 RBL: Good reputation (+3)

[209.85.214.229 listed in wl.mailspike.net]

-0.0 SPF_PASS SPF: sender matches SPF record

-0.0 RCVD_IN_MSPIKE_WL Mailspike good senders

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 NO_RDNS2 Sending MTA has no reverse DNS

0.6 HTML_MIME_NO_HTML_TAG HTML-only message, but there is no HTML tag

2.0 RATWR8_MESSID Message-ID with excessive dashes and dollars

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

Subject: {SPAM?} =?UTF-8?Q?Attached_Payment_Report_for_Your_Review_?=

=?UTF-8?Q?=EF=BF=BD_07/07/2026_=EF=BF=BD_doctor=40?= =?UTF-8?Q?nk=2Eca?=

Desperate to coomunicate spam

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Tue, 07 Jul 2026 17:44:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1whFRt-00000000EHo-3KBd

for dave@doctor.nl2k.ab.ca;

Tue, 07 Jul 2026 17:43:33 -0600

Resent-From: The Doctor

Resent-Date: Tue, 7 Jul 2026 17:43:33 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-ej1-f41.google.com ([209.85.218.41]:50301)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1whFM3-00000000DjC-2iHB

for doctor@nk.ca;

Tue, 07 Jul 2026 17:37:33 -0600

Received: by mail-ej1-f41.google.com with SMTP id a640c23a62f3a-c1276f8414bso5984666b.0

for ; Tue, 07 Jul 2026 16:36:27 -0700 (PDT)

ARC-Seal: i=1; a=rsa-sha256; t=1783467380; cv=none;

d=google.com; s=arc-20260327;

b=m4bZIshYL/Y9g+F9T+Sy//YyGo9TWaxHUBMbIAFGPmG09JBjWYJQcaOGoHR2R8C/US

UnZJ/n9hpg/qQ/godCaPGHmT1nnOK6tftQtXLB26bjoGewo0gGr5mxHuariiRSgkBwNx

u57QYMFyg7LxQiNLdOQ475PbK/sOhIKPP4w5e02VDtm0N26zirApWVBFf22QvDD43fFF

XImamdkdwHqMFeezDc4LLYf3MdT3qXvLIPr/H7+EbLqNho5XyqonbYmf97+DJDdk7nXO

nEn9LP7osJJ8k3aLTR8R1eM+hXlXiZmrtmQHTykCm4H4TnMTkxqvusS4G3o2kIgvyGK+

TS2g==

ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20260327;

h=to:subject:message-id:date:from:mime-version:dkim-signature;

bh=9izsVGAPMplK+brqLDlGV4XPoiyvmCwVCug6OlgvbxQ=;

fh=OQ46c1PzsJkng+bk9UdWxmIgl/cFRynZeJQlAMibJO4=;

b=MskBl7iMKRp7iw9pA0A5c/M7Fk+hTezjfrAeUVuM4O3HW7LFi7KtVgxKTuI0pACKoL

/dm6gDrRDxNqT3CvUoK57PkgmZ/Oqjw/tfXvgcCI+YG+udRV/cFXzRqFVLn3yMWcNS3G

VzWO7RI26u8PrA5SerxNoVo1nHodFF29UiVxvY6ss7Q0IBqrLOSGdp0KMwJCNmJoQom5

9btnChuM7yB7FtnOa/yN4PyBgdgHz77UOhPAxQsxDUvC2+t6/h2Nn7O9PluE+p+lZti2

yBxWayNVBPLp5iIREY0SiDiCqkERgnT3eOQ0DL2V/6KeO/EzaybUvYLEROsnmd3t0gSA

becg==;

darn=nk.ca

ARC-Authentication-Results: i=1; mx.google.com; arc=none

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=gmail.com; s=20251104; t=1783467380; x=1784072180; darn=nk.ca;

h=content-type:to:subject:message-id:date:from:mime-version:from:to

:cc:subject:date:message-id:reply-to:content-type;

bh=9izsVGAPMplK+brqLDlGV4XPoiyvmCwVCug6OlgvbxQ=;

b=RVEsGKYC+5x3LF2spOmNPwq6AK0HfsEmxsTUWkF9kdYy1WMx29sbEkdvhJA/g8jeYz

57Y4DnbyvzUSkNVSHJ9jTKX3ndQvf1/+cTaA7JaHv59ym+gc7NZ6FY1t8IRReLt044n0

XNbhKOIRI93R6+Mzt+ETQLpda/uKo16+mUfIYFW1/S/fsujdcPTsC6ICy9KYbNS0m9Fo

CPHX7O9BhXAdq6O+fUz7R7vjBzpSB/YTCGexjwpZJNM0/JMHq/vPTmy2QzbOD8UffW7X

Oz0qLE42D2ARgYG6wAmbu0ps1I0MvmcX2+5SYN4uRJUHPpwG52SV+J/fwxrDgEHfm2nw

dw4w==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20251104; t=1783467380; x=1784072180;

h=content-type:to:subject:message-id:date:from:mime-version:x-gm-gg

:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to

:content-type;

bh=9izsVGAPMplK+brqLDlGV4XPoiyvmCwVCug6OlgvbxQ=;

b=VXqoER291MRUTth9uiWxLA8pLpxmuLxUoVTAcwuWcNIlfQ/ZWtopcLiQH0ZrYuqsTn

qY/yWalQEfJbS9lF61EOHMozGVYSG5kZK1L81KC4jXTvx74cbNfZW9q++USAaZy9OPd8

WVoj+yjLxRMaLO0W2AEAaitGL3Y+Orf8HL+xWG2RdnVVVZzeA4z+JYvaskZ6nKM1U7EP

PNLLugzJvPf082QxrDnfYHF2LKU4tqJZjMNNov3A5hBVPbhB8/2ikTqKuiVZ88uZOmlD

vz1lyY+aVVT52mZQi3FQnQtgk0CMUbqxMtS131RQhpP6bZ9RnhjRi1dFs/NO2fD9Kxou

rTxg==

X-Forwarded-Encrypted: i=1; AHgh+RqQzD2bMpP8mSt1ppL5zuJXMCYn6b5Xjz8tPfEFmBwIuVDYs/6o2s+uio4Drj+nT6EQYnW+Gbw=@nk.ca

X-Gm-Message-State: AOJu0YxN46zVPQ3WbWy6G2Nq06ZZGwtKvx9TfGOvqj6yV1qglMywmCJG

qcsclmLUUnBvQWayoHAqRkbCxD+nYcZVgdpq0I/7aClovjo9EF+kIBVi1tejLjmu5PJ7tSK1F6l

Wz8xzvZRuD2nQAhw33SWHwjuENTvPVHc=

X-Gm-Gg: AfdE7cmWZzktscs2njOkO5ALBW/cwxjSY7WMrNcaRuj2gRnxpHzlatOKWe+ELRzO06l

LvnsmY7bW8GYdByO1fzxvaWpTQjXIMuoI/YHL9xnCgeqdXuVZJpkpIjNAD2v653p8Q5GVS8F+Eo

LKXTBbPwr9yV11EWEGlOcQb+wnJD3g757DXMRN0Z4kyn9DXryk3Ke+NvtmSxiKjyUaP8881JjIr

gSMBsUMnMwUfzH47vbMTIYoJBc5yUiRMRNlHJQX5uuSxMWCaL9W5dh0uRsuoZ9bgn6xSm0=

X-Received: by 2002:a17:907:6e8e:b0:c12:7d53:cc88 with SMTP id

a640c23a62f3a-c15ce22a26dmr7815866b.58.1783467380137; Tue, 07 Jul 2026

16:36:20 -0700 (PDT)

MIME-Version: 1.0

From: Patrick Eagles

Date: Tue, 7 Jul 2026 20:36:08 -0300

X-Gm-Features: AVVi8CcCnIW_I5SsAwifTpVhUZkGJ19J_k0iTYl9B6lDXmn8O143ZhaY_H-mUD0

Message-ID:

Subject: Good Day

To: undisclosed-recipients:;

Content-Type: multipart/alternative; boundary="000000000000a961d806560ddbe4"

Bcc: doctor@nk.ca

X-Spam_score: 5.8

X-Spam_score_int: 58

X-Spam_bar: +++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Good morning, I hope you received my previous message to you

? Pls reply . Good morning, I hope you received my previous message to you

? Pls reply .



Content analysis details: (5.8 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[209.85.218.41 listed in dnsbl.ahbl.org]

[209.85.218.41 listed in dnsbl.ahbl.org]

[209.85.218.41 listed in dnsbl.ahbl.org]

[209.85.218.41 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[209.85.218.41 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[209.85.218.41 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[209.85.218.41 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[209.85.218.41 listed in dnsbl.ahbl.org]

-0.0 SPF_PASS SPF: sender matches SPF record

1.5 GR_DOMAIN_UNDISC1 To contains undisclosed recipient (undisc)

0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends in

digit

[whoreliefund2022(at)gmail.com]

0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider

[eaglespatrick5(at)gmail.com]

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

-0.0 RCVD_IN_MSPIKE_H3 RBL: Good reputation (+3)

[209.85.218.41 listed in wl.mailspike.net]

-0.0 RCVD_IN_MSPIKE_WL Mailspike good senders

Subject: {SPAM?} Good Day



--000000000000a961d806560ddbe4

Content-Type: text/plain; charset="UTF-8"



Good morning, I hope you received my previous message to you ? Pls reply .



--000000000000a961d806560ddbe4

Content-Type: text/html; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable




=3D"font-family:"Google Sans",Roboto,RobotoDraft,Helvetica,Arial,=

sans-serif;direction:ltr;margin:8px 0px 0px;padding:0px;font-size:0.875rem;=

overflow-x:hidden">

le=3D"direction:ltr;font-variant:normal;font-size-adjust:none;font-kerning:=

auto;font-feature-settings:normal;font-stretch:normal;font-size:small;line-=

height:1.5;font-family:Arial,Helvetica,sans-serif;overflow:auto hidden">
v id=3D"gmail-avWBGd-18">
Good morning, I hope you received=

my previous message to you ? Pls reply .
<=

/div>


ple-interchange-newline">




--000000000000a961d806560ddbe4--

Desperation for communication spam from Google Gmail

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Tue, 07 Jul 2026 17:44:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1whFRt-00000000EHo-3KBd

for dave@doctor.nl2k.ab.ca;

Tue, 07 Jul 2026 17:43:33 -0600

Resent-From: The Doctor

Resent-Date: Tue, 7 Jul 2026 17:43:33 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-ej1-f41.google.com ([209.85.218.41]:50301)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1whFM3-00000000DjC-2iHB

for doctor@nk.ca;

Tue, 07 Jul 2026 17:37:33 -0600

Received: by mail-ej1-f41.google.com with SMTP id a640c23a62f3a-c1276f8414bso5984666b.0

for ; Tue, 07 Jul 2026 16:36:27 -0700 (PDT)

ARC-Seal: i=1; a=rsa-sha256; t=1783467380; cv=none;

d=google.com; s=arc-20260327;

b=m4bZIshYL/Y9g+F9T+Sy//YyGo9TWaxHUBMbIAFGPmG09JBjWYJQcaOGoHR2R8C/US

UnZJ/n9hpg/qQ/godCaPGHmT1nnOK6tftQtXLB26bjoGewo0gGr5mxHuariiRSgkBwNx

u57QYMFyg7LxQiNLdOQ475PbK/sOhIKPP4w5e02VDtm0N26zirApWVBFf22QvDD43fFF

XImamdkdwHqMFeezDc4LLYf3MdT3qXvLIPr/H7+EbLqNho5XyqonbYmf97+DJDdk7nXO

nEn9LP7osJJ8k3aLTR8R1eM+hXlXiZmrtmQHTykCm4H4TnMTkxqvusS4G3o2kIgvyGK+

TS2g==

ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20260327;

h=to:subject:message-id:date:from:mime-version:dkim-signature;

bh=9izsVGAPMplK+brqLDlGV4XPoiyvmCwVCug6OlgvbxQ=;

fh=OQ46c1PzsJkng+bk9UdWxmIgl/cFRynZeJQlAMibJO4=;

b=MskBl7iMKRp7iw9pA0A5c/M7Fk+hTezjfrAeUVuM4O3HW7LFi7KtVgxKTuI0pACKoL

/dm6gDrRDxNqT3CvUoK57PkgmZ/Oqjw/tfXvgcCI+YG+udRV/cFXzRqFVLn3yMWcNS3G

VzWO7RI26u8PrA5SerxNoVo1nHodFF29UiVxvY6ss7Q0IBqrLOSGdp0KMwJCNmJoQom5

9btnChuM7yB7FtnOa/yN4PyBgdgHz77UOhPAxQsxDUvC2+t6/h2Nn7O9PluE+p+lZti2

yBxWayNVBPLp5iIREY0SiDiCqkERgnT3eOQ0DL2V/6KeO/EzaybUvYLEROsnmd3t0gSA

becg==;

darn=nk.ca

ARC-Authentication-Results: i=1; mx.google.com; arc=none

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=gmail.com; s=20251104; t=1783467380; x=1784072180; darn=nk.ca;

h=content-type:to:subject:message-id:date:from:mime-version:from:to

:cc:subject:date:message-id:reply-to:content-type;

bh=9izsVGAPMplK+brqLDlGV4XPoiyvmCwVCug6OlgvbxQ=;

b=RVEsGKYC+5x3LF2spOmNPwq6AK0HfsEmxsTUWkF9kdYy1WMx29sbEkdvhJA/g8jeYz

57Y4DnbyvzUSkNVSHJ9jTKX3ndQvf1/+cTaA7JaHv59ym+gc7NZ6FY1t8IRReLt044n0

XNbhKOIRI93R6+Mzt+ETQLpda/uKo16+mUfIYFW1/S/fsujdcPTsC6ICy9KYbNS0m9Fo

CPHX7O9BhXAdq6O+fUz7R7vjBzpSB/YTCGexjwpZJNM0/JMHq/vPTmy2QzbOD8UffW7X

Oz0qLE42D2ARgYG6wAmbu0ps1I0MvmcX2+5SYN4uRJUHPpwG52SV+J/fwxrDgEHfm2nw

dw4w==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20251104; t=1783467380; x=1784072180;

h=content-type:to:subject:message-id:date:from:mime-version:x-gm-gg

:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to

:content-type;

bh=9izsVGAPMplK+brqLDlGV4XPoiyvmCwVCug6OlgvbxQ=;

b=VXqoER291MRUTth9uiWxLA8pLpxmuLxUoVTAcwuWcNIlfQ/ZWtopcLiQH0ZrYuqsTn

qY/yWalQEfJbS9lF61EOHMozGVYSG5kZK1L81KC4jXTvx74cbNfZW9q++USAaZy9OPd8

WVoj+yjLxRMaLO0W2AEAaitGL3Y+Orf8HL+xWG2RdnVVVZzeA4z+JYvaskZ6nKM1U7EP

PNLLugzJvPf082QxrDnfYHF2LKU4tqJZjMNNov3A5hBVPbhB8/2ikTqKuiVZ88uZOmlD

vz1lyY+aVVT52mZQi3FQnQtgk0CMUbqxMtS131RQhpP6bZ9RnhjRi1dFs/NO2fD9Kxou

rTxg==

X-Forwarded-Encrypted: i=1; AHgh+RqQzD2bMpP8mSt1ppL5zuJXMCYn6b5Xjz8tPfEFmBwIuVDYs/6o2s+uio4Drj+nT6EQYnW+Gbw=@nk.ca

X-Gm-Message-State: AOJu0YxN46zVPQ3WbWy6G2Nq06ZZGwtKvx9TfGOvqj6yV1qglMywmCJG

qcsclmLUUnBvQWayoHAqRkbCxD+nYcZVgdpq0I/7aClovjo9EF+kIBVi1tejLjmu5PJ7tSK1F6l

Wz8xzvZRuD2nQAhw33SWHwjuENTvPVHc=

X-Gm-Gg: AfdE7cmWZzktscs2njOkO5ALBW/cwxjSY7WMrNcaRuj2gRnxpHzlatOKWe+ELRzO06l

LvnsmY7bW8GYdByO1fzxvaWpTQjXIMuoI/YHL9xnCgeqdXuVZJpkpIjNAD2v653p8Q5GVS8F+Eo

LKXTBbPwr9yV11EWEGlOcQb+wnJD3g757DXMRN0Z4kyn9DXryk3Ke+NvtmSxiKjyUaP8881JjIr

gSMBsUMnMwUfzH47vbMTIYoJBc5yUiRMRNlHJQX5uuSxMWCaL9W5dh0uRsuoZ9bgn6xSm0=

X-Received: by 2002:a17:907:6e8e:b0:c12:7d53:cc88 with SMTP id

a640c23a62f3a-c15ce22a26dmr7815866b.58.1783467380137; Tue, 07 Jul 2026

16:36:20 -0700 (PDT)

MIME-Version: 1.0

From: Patrick Eagles

Date: Tue, 7 Jul 2026 20:36:08 -0300

X-Gm-Features: AVVi8CcCnIW_I5SsAwifTpVhUZkGJ19J_k0iTYl9B6lDXmn8O143ZhaY_H-mUD0

Message-ID:

Subject: Good Day

To: undisclosed-recipients:;

Content-Type: multipart/alternative; boundary="000000000000a961d806560ddbe4"

Bcc: doctor@nk.ca

X-Spam_score: 5.8

X-Spam_score_int: 58

X-Spam_bar: +++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Good morning, I hope you received my previous message to you

? Pls reply . Good morning, I hope you received my previous message to you

? Pls reply .



Content analysis details: (5.8 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[209.85.218.41 listed in dnsbl.ahbl.org]

[209.85.218.41 listed in dnsbl.ahbl.org]

[209.85.218.41 listed in dnsbl.ahbl.org]

[209.85.218.41 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[209.85.218.41 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[209.85.218.41 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[209.85.218.41 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[209.85.218.41 listed in dnsbl.ahbl.org]

-0.0 SPF_PASS SPF: sender matches SPF record

1.5 GR_DOMAIN_UNDISC1 To contains undisclosed recipient (undisc)

0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends in

digit

[whoreliefund2022(at)gmail.com]

0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider

[eaglespatrick5(at)gmail.com]

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

-0.0 RCVD_IN_MSPIKE_H3 RBL: Good reputation (+3)

[209.85.218.41 listed in wl.mailspike.net]

-0.0 RCVD_IN_MSPIKE_WL Mailspike good senders

Subject: {SPAM?} Good Day



--000000000000a961d806560ddbe4

Content-Type: text/plain; charset="UTF-8"



Good morning, I hope you received my previous message to you ? Pls reply .



--000000000000a961d806560ddbe4

Content-Type: text/html; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable




=3D"font-family:"Google Sans",Roboto,RobotoDraft,Helvetica,Arial,=

sans-serif;direction:ltr;margin:8px 0px 0px;padding:0px;font-size:0.875rem;=

overflow-x:hidden">

le=3D"direction:ltr;font-variant:normal;font-size-adjust:none;font-kerning:=

auto;font-feature-settings:normal;font-stretch:normal;font-size:small;line-=

height:1.5;font-family:Arial,Helvetica,sans-serif;overflow:auto hidden">
v id=3D"gmail-avWBGd-18">
Good morning, I hope you received=

my previous message to you ? Pls reply .
<=

/div>


ple-interchange-newline">




--000000000000a961d806560ddbe4--

Transfer.it phish Part 3






0" cellspacing=3D"0">








=3D"padding-top: 48px;">


cellspacing=3D"0">










center" style=3D"padding: 0 4px;">


target=3D"_blank" style=3D"color: #080A0D; font-size: 16px; line-height: =

24px; font-family: sans-serif, Helvetica, Arial; text-align:center; text-de=

coration: none; display: inline-block; font-weight: bold; vertical-align: m=

iddle;">Powered by



center" style=3D"padding: 0 4px;">


target=3D"_blank" style=3D"text-decoration: none; display: inline-block; v=

ertical-align: middle; font-size: 0;">3D"MEGA
=3D"cid:mega_logo.png-z38e84aad3dce2005" style=3D"width: 24px; height: 24px=

;" />









; color: #595C61; font-size: 14px; line-height: 24px; font-family: sans-ser=

if, Helvetica, Arial; text-align: center;">
" target=3D"_blank" style=3D"color: #595C61; font-size: 14px; line-height:=

24px; font-family: sans-serif, Helvetica, Arial; text-align:center; text-d=

ecoration: underline; display: inline-block;">About

-space: nowrap;">    •    
an>
95C61; font-size: 14px; line-height: 24px; font-family: sans-serif, Helvet=

ica, Arial; text-align:center; text-decoration: underline; display: inline-=

block;">Privacy
   &=

nbsp;•    

target=3D"_blank" style=3D"color: #595C61; font-size: 14px; line-height: =

24px; font-family: sans-serif, Helvetica, Arial; text-align:center; text-de=

coration: underline; display: inline-block;">Terms

space: nowrap;">    •    
n>
1; font-size: 14px; line-height: 24px; font-family: sans-serif, Helvetica,=

Arial; text-align:center; text-decoration: underline; display: inline-bloc=

k;">Report this transfer



































--b2_1vAnPWGg84QRZFdtHMMCqtsHOmwVOIh99U7XfBR3Uo

Content-Type: image/png

Content-Transfer-Encoding: base64

Content-ID:

Content-Disposition: inline



...





--b2_1vAnPWGg84QRZFdtHMMCqtsHOmwVOIh99U7XfBR3Uo

Content-Type: image/png

Content-Transfer-Encoding: base64

Content-ID:

Content-Disposition: inline





Transfer.it phish Part 2










8px 0;" class=3D"main">


ng=3D"0">
















8px; border-radius: 24px; background-color: #FFF;" class=3D"box">




al;font-size:24px;line-height:32px;font-weight:700;color:#333333;">

Heads-up =E2=80=93 your transfer=E2=80=99s expi=

ring soon








t;">


k" aria-label=3D"Transfer it">3D"Transfer
sferit_logo.png-z38e84aad3dce2005" style=3D"width: 48px; height: 48px;" /><=

/a>








al; font-size: 18px; line-height: 24px; color: #080A0D; padding: 0; margin:=

0; margin-top: 36px; font-weight: 400; text-align: left;">

Hi there,






al; font-size: 18px; line-height: 24px; color: #080A0D; padding: 0; margin:=

0; margin-top: 36px; font-weight: 400; text-align: left;">

Just a quick reminder: your transfer, =E2=80=

=9CWCC443-I HAVE SOMETHING IMPORTANT AND INTERESTING TO TELL YOU ABOUT YOUR=

LIFE. PLEASE REPLY TO ME IMMEDIATELY AT MY EMAIL ADDRESS donaldaalan@outlo=

ok.com BY CLICKING ON IT TO REPLY TO ME DIRECTLY.-ANE858=E2=80=9D, will exp=

ire in 3 days =E2=80=93 on 2026-07-10.






al; font-size: 18px; line-height: 24px; color: #080A0D; padding: 0; margin:=

0; margin-top: 36px; font-weight: 400; text-align: left;">

If your recipient hasn=E2=80=99t accessed it ye=

t, now=E2=80=99s a good time to nudge them. Once it expires, the files will=

no longer be available.








=3D"0" width=3D"100%">








lvetica, sans-serif; font-size: 16px; vertical-align: top; padding-top: 36p=

x;" valign=3D"top">


ellspacing=3D"0" width=3D"100%">








serif, Helvetica, Arial; font-size: 16px; vertical-align: top; border-radiu=

s: 8px; text-align: center; background-color: #1875FF" valign=3D"top" align=

=3D"center" bgcolor=3D"#1875FF">
ST" target=3D"_blank" style=3D"border: solid 2px #1875FF; border-radius: 8p=

x; box-sizing: border-box; cursor: pointer; display: inline-block; font-siz=

e: 16px; line-height: 24px; font-weight: 400; margin: 0; padding: 14px 14px=

; text-decoration: none; background-color: #1875FF; color: #fff; width: 100=

%;">View your transfer









al; font-size: 16px; line-height: 24px; color: #595C61; padding: 0; margin:=

0; margin-top: 12px; font-weight: 400; text-align: center;">

1 item

 &nbs=

p;  •    
183 B in total
an>

 &nbs=

p;  •    
Expires on 2026-07=

-10


=20






al; font-size: 18px; line-height: 24px; color: #080A0D; padding: 0; margin:=

0; margin-top: 36px; font-weight: 400; text-align: left;">

If the button doesn=E2=80=99t work, you can cop=

y and paste this link into your browser:

t/upQhKWwH1DST">https://transfer.it/t/upQhKWwH1DST







al; font-size: 18px; line-height: 24px; color: #080A0D; padding: 0; margin:=

0; margin-top: 36px; font-weight: 400; text-align: left;">

Need more time? You can always re-upload after =

it expires, or upgrade to=

Pro
for flexible expiry options.






al; font-size: 18px; line-height: 24px; color: #080A0D; padding: 0; margin:=

0; margin-top: 36px; font-weight: 400; text-align: left;">

Enjoy the rest of your day!








al; font-size: 18px; line-height: 24px; color: #080A0D; padding: 0; margin:=

0; margin-top: 36px; font-weight: 400; text-align: left;">

Cheers,
The Transfer.it team






; background-color: #f0f0f0; height: 1px; font-size: 0;">




yle=3D"padding: 0 24px;">



Transfer.it phish Part 1

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Tue, 07 Jul 2026 16:29:33 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1whEHy-00000000CQ4-2uif

for dave@doctor.nl2k.ab.ca;

Tue, 07 Jul 2026 16:29:14 -0600

Resent-From: The Doctor

Resent-Date: Tue, 7 Jul 2026 16:29:14 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from relay6.api.mega.co.nz ([66.203.124.6]:57939)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1whE4W-00000000BYT-159U

for root@nk.ca;

Tue, 07 Jul 2026 16:15:29 -0600

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=transfer.it;

s=transferit-api; t=1783462468;

bh=c4IV4EAuyyWzjqWscferD+GalHrYlHf9QaliLW0gumo=;

h=Date:To:From:Subject:From;

b=pYpNIZJewblRB/fOvARJ2HPslVYM5Y8WLeAQofHOrA0dtTOV7nFLtrA5S3mYR/FwW

yBmSFwMKpLJXcR658prUHHzapmMnr7S+jXldRd3UipJp4AdEUXjPddBTnwZeyddstb

OCL9TRohix/+IHZ/tEs3nJY8MfMyYDzj6cBQeGiVD2GN0hXcdG6sPVI+QibqNQdegT

7fmtg02CKNgXsLLNeCb3XN/+xJFINWCY1qbfzzXBzBfAZAvFCahnMom7IMWZb7sNba

AJ2k61VgoOdUO+r4taQAEP7JcgIboGShmlWoRHamVXUQAuLikaMB80CuaKi90l+Ucz

8kJUpyBgBAW3A==

Received: from mega475 (bt7.api.mega.co.nz [66.203.125.17])

by relay6.api.mega.co.nz (Postfix) with ESMTP id B39D2382127

for ; Wed, 8 Jul 2026 00:14:28 +0200 (CEST)

Date: Tue, 7 Jul 2026 22:14:28 +0000

To: root@nk.ca

From: "Transfer.it"

Subject: Transfer.it reminder: Your transfer will expire soon!

Message-ID: <1vAnPWGg84QRZFdtHMMCqtsHOmwVOIh99U7XfBR3Uo@mega475>

Feedback-ID: 125:io:megamailer

MIME-Version: 1.0

Content-Type: multipart/alternative;

boundary="b1_1vAnPWGg84QRZFdtHMMCqtsHOmwVOIh99U7XfBR3Uo"

Content-Transfer-Encoding: 8bit



This is a multi-part message in MIME format.



--b1_1vAnPWGg84QRZFdtHMMCqtsHOmwVOIh99U7XfBR3Uo

Content-Type: text/plain; charset=UTF-8

Content-Transfer-Encoding: 8bit



Heads-up – your transfer’s expiring soon



Hi there,



Just a quick reminder: your transfer, “WCC443-I HAVE SOMETHING IMPORTANT AND INTERESTING TO TELL YOU ABOUT YOUR LIFE. PLEASE REPLY TO ME IMMEDIATELY AT MY EMAIL ADDRESS donaldaalan@outlook.com BY CLICKING ON IT TO REPLY TO ME DIRECTLY.-ANE858”, will expire in 3 days – on 2026-07-10.



If your recipient hasn’t accessed it yet, now’s a good time to nudge them. Once it expires, the files will no longer be available.



View your transfer



1 item 183 B in total Expires on 2026-07-10



If the button doesn’t work, you can copy and paste this link into your browser:

https://transfer.it/t/upQhKWwH1DST



Need more time? You can always re-upload after it expires, or upgrade to Pro for flexible expiry options.



Enjoy the rest of your day!



Cheers,

The Transfer.it team





--b1_1vAnPWGg84QRZFdtHMMCqtsHOmwVOIh99U7XfBR3Uo

Content-Type: multipart/related;

boundary="b2_1vAnPWGg84QRZFdtHMMCqtsHOmwVOIh99U7XfBR3Uo";

type="text/html"



--b2_1vAnPWGg84QRZFdtHMMCqtsHOmwVOIh99U7XfBR3Uo

Content-Type: text/html; charset=UTF-8

Content-Transfer-Encoding: quoted-printable










=3D1.0">


">

Transfer.it reminder: Your transfer will expire soon!

Gold for sale Nigerian spam

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Tue, 07 Jul 2026 20:15:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1whHoM-00000000Lzm-3ENv

for dave@doctor.nl2k.ab.ca;

Tue, 07 Jul 2026 20:14:54 -0600

Resent-From: The Doctor

Resent-Date: Tue, 7 Jul 2026 20:14:54 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from [195.64.137.83] (port=48304 helo=inpn.org.ua)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1whGW9-00000000HnT-2l6r

for bin@nl2k.ab.ca;

Tue, 07 Jul 2026 18:52:10 -0600

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=inpn.org.ua; s=mail;

t=1783470627; bh=/eOgGrTddnGaD9Q32v24MrfNLIfYCPvlSJOds9OPe5g=;

h=From:Subject:To:Reply-To;

b=ekoO0REufuFuTNcvqTweUZacnUqG3WW7R2HSMyZjmfo5EBkKY4VRESpeasAj02byw

6C9TPLqlXIfdPfrAM8j9Q4tOAP6TPksrqWUWJVNbJCRUvp9yk7REMuGkt+OZAUDXHX

qExAC4w5WknXtYXJUzyY25oyc4PT5OzksCxyQXVwFO/gcpG6Su0vGq9Oi4u1AM4T41

CFqMwndFh7SWA0lcDQ1HaXblH4be/SRYKHGOZo6C7cG0fgRxkEj2TjFGOngNJ5rove

rzussSy8M+OqumPKu74E013oownH+BSyH0vbTYvz5HnuUV4RXelPhRGzxI0VsCQNvy

Vc5e7aFiyDohA==

From: Mr Owusu Kwesi

Date: Tue, 07 Jul 2026 13:01:04 -0700

Subject: Re Offer of Gold Bars for Sale

Message-Id:

To: bin@nl2k.ab.ca

Sender: Mr Owusu Kwesi

Reply-To: Mr Owusu Kwesi

MIME-Version: 1.0

Content-Type: text/plain; charset=utf-8

X-Spam_score: 9.8

X-Spam_score_int: 98

X-Spam_bar: +++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Dear Sir/Madam, We are pleased to offer for sale high-quality

gold bars mined directly from our concessions. The details of our product

are as follows: Commodity: Gold Form: Alluvial Bar Purity: 22+ Carat (94%)

Quantity Available: 4,000 kilograms Price: USD 95,000 per kilogram Origin:

Ghana Deleterious Elements: 0% Cyanide



Content analysis details: (9.8 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[195.64.137.83 listed in dnsbl.ahbl.org]

[195.64.137.83 listed in dnsbl.ahbl.org]

[195.64.137.83 listed in dnsbl.ahbl.org]

[195.64.137.83 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[195.64.137.83 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[195.64.137.83 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[195.64.137.83 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[195.64.137.83 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[195.64.137.83 listed in will-spam-for-food.eu.org]

[195.64.137.83 listed in will-spam-for-food.eu.org]

[195.64.137.83 listed in will-spam-for-food.eu.org]

[195.64.137.83 listed in will-spam-for-food.eu.org]

[195.64.137.83 listed in will-spam-for-food.eu.org]

[195.64.137.83 listed in will-spam-for-food.eu.org]

[195.64.137.83 listed in will-spam-for-food.eu.org]

[195.64.137.83 listed in will-spam-for-food.eu.org]

1.6 RCVD_IN_BRBL_LASTEXT RBL: No description available.

[195.64.137.83 listed in bb.barracudacentral.org]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-0.0 SPF_HELO_PASS SPF: HELO matches SPF record

-0.0 SPF_PASS SPF: sender matches SPF record

0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in digit

[owusukwe65(at)gmail.com]

1.1 DATE_IN_PAST_03_06 Date: is 3 to 6 hours before Received: date

1.7 DEAR_SOMETHING BODY: Contains 'Dear (something)'

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[195.64.137.83 listed in bl.score.senderscore.com]

0.0 LOTS_OF_MONEY Huge... sums of money

1.3 RDNS_NONE Delivered to internal network by a host with no rDNS

0.0 MONEY_NOHTML Lots of money in plain text

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

0.0 HK_NAME_MR_MRS No description available.

2.5 FREEMAIL_FORGED_REPLYTO Freemail in Reply-To, but not From

0.0 MONEY_FREEMAIL_REPTO Lots of money from someone using free email?

Subject: {SPAM?} Re Offer of Gold Bars for Sale



Dear Sir/Madam,



We are pleased to offer for sale high-quality gold bars mined directly from our concessions. The details of our product are as follows:



Commodity: Gold

Form: Alluvial Bar

Purity: 22+ Carat (94%)

Quantity Available: 4,000 kilograms

Price: USD 95,000 per kilogram

Origin: Ghana

Deleterious Elements: 0% Cyanide



A full corporate offer and detailed documentation can be provided upon request. We are committed to professional, secure, and transparent business transactions and would be glad to discuss further steps to facilitate this opportunity.



Please feel free to contact me via email at (kweo296@gmail.com)

or WhatsApp at (+233532452351) for additional information or to request our corporate offer.



Thank you for your time and consideration. We look forward to the possibility of working together.



Yours faithfully,



Owusu Kwesi

[Position, manager]

Tarkwa, Western Region, Ghana