Dutch language phidh from Google GMail

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Tue, 06 Oct 2026 08:05:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.100.1 (FreeBSD))

(envelope-from )

id 1xE5mm-00000000M3Z-3b3b

for dave@doctor.nl2k.ab.ca;

Tue, 06 Oct 2026 08:04:52 -0600

Resent-From: The Doctor

Resent-Date: Tue, 6 Oct 2026 08:04:52 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-qk1-f199.google.com ([209.85.222.199]:47292)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.100.1 (FreeBSD))

(envelope-from )

id 1xDzlA-000000000Cj-0MJd

for doctor@nk.ca;

Tue, 06 Oct 2026 01:38:23 -0600

Received: by mail-qk1-f199.google.com with SMTP id af79cd13be357-93cbacbb996so412900185a.2

for ; Tue, 06 Oct 2026 00:36:29 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=afu-edu-np.20251104.gappssmtp.com; s=20251104; t=1791272183; x=1791876983; darn=nk.ca;

h=content-type:to:from:subject:date:message-id:mime-version:from:to

:cc:subject:date:message-id:reply-to:content-type;

bh=HlhxDfAyud7oQ6hAtax4HiK9q2o/CcWJtfFNq3hBMGw=;

b=aq//AXA2SZ21XoTFIwAzHJURMQcAHr6bMN2qsGd202ZJi2eHN1kI4STeUg4h0Yry0C

Mik50shsWQgiNrSXfzcU2Z/L0vtoC6Yr+Z9HEhTtxp2QEPyGuZ1+vZjw3GE7Zfw+kxeg

UiaN7JbJ+HP5/0Sz6HoqszdBHukhUkkQZ/fiBwbpkJz9eqsvkaJIUfmyfLUlt9zjHJ6G

0RVwqbqVXukgjV5qEFvlEspxPnzuRrtkXjQD5DKDPO9j2BlovNMYByXbmejeyeZ0cxc3

x25N5u7qpVM413LAE32lu7Qrtofx2ttY9ZLjYKkOj9nBHha3lFB5Gt6KK72Q02fHkHSq

0h2A==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20260707; t=1791272183; x=1791876983;

h=content-type:to:from:subject:date:message-id:mime-version

:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to

:content-type;

bh=HlhxDfAyud7oQ6hAtax4HiK9q2o/CcWJtfFNq3hBMGw=;

b=loKHIMMsbhksyYGOmAfFXqPQRWyoGB4QW7UwRgbnEzdZ6AdOP0uhm5vP8sif7+M+Ba

ApN12OnwIGv2EBglOYGPAMW/tPAQe3pbtOZ6fg3YElOYiHGAhZof32PaiBmBMix1CyC9

BaaPxzhzSq+GWd5/it4gak8E24NND3lDm1Rn9Fh/iBEotffTxw9ncIn3zSbcSREgDLE5

3lBoynk3CKy/nts/z0PKzMohlZgieeoGDdelXOZryLHCY8GwoQUCW5TVuHKfEr4mtA++

Rl4B9RYSLFrP21boD5btQTGH5XeMJXWA9Vr+/HyBNjbZghEXKEUauUEQ+KLLe9HYr/eP

8hjQ==

X-Gm-Message-State: AFuF++neUiitVbVQNh6gYIhgj+RPKyTPD9KY4FbiQTUe4bZbnLVVKOBd

0GT8Ng1kUwPfVqQgtMFDEvOqI/l42E/baeyfwsO+g9mOBwbcjvh0IH+2OK7Wt0PTboQvU42+RFh

cSF0OJOtkTB1deFJYrmRawqZJ

MIME-Version: 1.0

X-Received: by 2002:a05:620a:6cc7:b0:93e:7939:acd0 with SMTP id

af79cd13be357-93e8f4a60b4mr98586685a.37.1791272182941; Tue, 06 Oct 2026

00:36:22 -0700 (PDT)

Message-ID:

Date: Tue, 06 Oct 2026 07:36:22 +0000

Subject: =?UTF-8?Q?Beveiligingswaarschuwing_=E2=80=93_uw_wifi=2Dnetwerk?=

From: Digitale Veiligheidsdienst

To: doctor@nk.ca

Content-Type: multipart/alternative; boundary="000000000000291e62065d270ef8"

X-Spam_score: 7.4

X-Spam_score_int: 74

X-Spam_bar: +++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: 🔒 Digitale Veiligheidsdienst ⚠KWETSBAARHEID GEDETECTEERD

IN UW NETWERK Uit recente scans blijkt dat miljoenen Nederlandse thuisnetwerken

kwetsbaar zijn voor ongeautoriseerde toegang. De oorzaak: verouderde router-firmware

en standaard wachtwoorden die nooit zijn gewijzig [...]



Content analysis details: (7.4 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[209.85.222.199 listed in will-spam-for-food.eu.org]

[209.85.222.199 listed in will-spam-for-food.eu.org]

[209.85.222.199 listed in will-spam-for-food.eu.org]

[209.85.222.199 listed in will-spam-for-food.eu.org]

[209.85.222.199 listed in will-spam-for-food.eu.org]

[209.85.222.199 listed in will-spam-for-food.eu.org]

[209.85.222.199 listed in will-spam-for-food.eu.org]

[209.85.222.199 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[209.85.222.199 listed in dnsbl.ahbl.org]

[209.85.222.199 listed in dnsbl.ahbl.org]

[209.85.222.199 listed in dnsbl.ahbl.org]

[209.85.222.199 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[209.85.222.199 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[209.85.222.199 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[209.85.222.199 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[209.85.222.199 listed in dnsbl.ahbl.org]

1.1 URIBL_GREY Contains an URL listed in the URIBL greylist

[URI: klclick.com]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[209.85.222.199 listed in wl.mailspike.net]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[209.85.222.199 listed in bl.score.senderscore.com]

1.0 SPF_SOFTFAIL SPF: sender does not match SPF record (softfail)

0.1 TW_IJ BODY: Odd Letter Triples with IJ

0.1 TW_JG BODY: Odd Letter Triples with JG

0.1 TW_JK BODY: Odd Letter Triples with JK

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[209.85.222.199 listed in list.dnswl.org]

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 HTML_MESSAGE BODY: HTML included in message

1.0 VOWEL_URI_5 URI hostname with 5 consecutive vowels

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

2.0 RATWR8_MESSID Message-ID with excessive dashes and dollars

1.0 IMPRO_URI_2 No description available.

Subject: {SPAM?} =?UTF-8?Q?Beveiligingswaarschuwing_=E2=80=93_uw_wifi=2Dnetwerk?=



--000000000000291e62065d270ef8

Content-Type: text/plain; charset="UTF-8"; format=flowed; delsp=yes

Content-Transfer-Encoding: base64



8J+UkiBEaWdpdGFsZSBWZWlsaWdoZWlkc2RpZW5zdA0KDQoNCg0K4pqgIEtXRVRTQkFBUkhFSUQg

R0VERVRFQ1RFRVJEIElOIFVXIE5FVFdFUksNCg0KDQoNCg0KVWl0IHJlY2VudGUgc2NhbnMgYmxp

amt0IGRhdCBtaWxqb2VuZW4gTmVkZXJsYW5kc2UgdGh1aXNuZXR3ZXJrZW4ga3dldHNiYWFyICAN

Cnppam4gdm9vciBvbmdlYXV0b3Jpc2VlcmRlIHRvZWdhbmcuIERlIG9vcnphYWs6IHZlcm91ZGVy

ZGUgcm91dGVyLWZpcm13YXJlICANCmVuIHN0YW5kYWFyZCB3YWNodHdvb3JkZW4gZGllIG5vb2l0

IHppam4gZ2V3aWp6aWdkLg0KDQpNZXQgZWVuIGdyYXRpcyBuZXR3ZXJrc2NhbiBrdW50IHUgaW4g

MzAgc2Vjb25kZW4gemllbiBvZiB1dyB3aWZpLW5ldHdlcmsgIA0KdmVpbGlnIGlzLiBVIGtyaWpn

dCBkaXJlY3QgZWVuIHJhcHBvcnQgbWV0IGV2ZW50dWVsZSByaXNpY28ncyBlbiBhZHZpZXMuDQoN

Cg0KDQpWZWVsdm9vcmtvbWVuZGUgcmlzaWNvJ3M6DQrigKIgT25iZXZlaWxpZ2RlIElvVC1hcHBh

cmF0ZW4gKGNhbWVyYSwgZGV1cmJlbCkNCuKAoiBWZXJvdWRlcmRlIFdQQTItZW5jcnlwdGllDQri

gKIgU3RhbmRhYXJkIHJvdXRlcndhY2h0d29vcmQgYWN0aWVmDQoNCg0KDQoNClN0YXJ0IGdyYXRp

cyBuZXR3ZXJrc2Nhbg0KDQoNCg0KQWZtZWxkZW4gfCBOaWV0IG1lZXIgb250dmFuZ2VuDQoNCg==

--000000000000291e62065d270ef8

Content-Type: text/html; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable




h:600px;margin:0 auto;font-family:Arial,Helvetica,sans-serif;background:#ff=

ffff;">











🔒 Di=

gitale Veiligheidsdienst




nd:#c62828;border-radius:0 0 8px 8px;">





⚠ KWET=

SBAARHEID GEDETECTEERD IN UW NETWERK





Uit=

recente scans blijkt dat miljoenen Nederlandse thuisnetwerken kwetsbaar zi=

jn voor ongeautoriseerde toegang. De oorzaak: verouderde router-firmware en=

standaard wachtwoorden die nooit zijn gewijzigd.



Met=

een gratis netwerkscan kunt u in 30 seconden zien of uw wifi-netwerk veili=

g is. U krijgt direct een rapport met eventuele risico's en advies.




nd:#f5f5f5;border-radius:6px;border-left:4px solid #c62828;">





Ve=

elvoorkomende risico's:
• Onbeveiligde IoT-apparaten (came=

ra, deurbel)
• Verouderde WPA2-encryptie
• Standaard router=

wachtwoord actief












1#t/c/3dd0f4d5688292d705f1" style=3D"display:inline-block;padding:14px 36px=

;color:#ffffff;font-size:15px;font-weight:bold;text-decoration:none;">Start=

gratis netwerkscan




1px;color:#999;text-align:center;">


1#t/u/3dd0f4d5688292d705f1" style=3D"color:#999;text-decoration:underline;"=

>Afmelden  | 
01KCGS3SY4J36RX5JNAPV4X2XB_11#t/p/3dd0f4d5688292d705f1" style=3D"color:#999=

;text-decoration:underline;">Niet meer ontvangen



--000000000000291e62065d270ef8--

Dutch language phish from Google Gmail

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Tue, 06 Oct 2026 08:05:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.100.1 (FreeBSD))

(envelope-from )

id 1xE5me-00000000M2z-0I42

for dave@doctor.nl2k.ab.ca;

Tue, 06 Oct 2026 08:04:44 -0600

Resent-From: The Doctor

Resent-Date: Tue, 6 Oct 2026 08:04:43 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-pf1-f200.google.com ([209.85.210.200]:42432)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.100.1 (FreeBSD))

(envelope-from )

id 1xDzOR-00000000O6a-3OBS

for doctor@nk.ca;

Tue, 06 Oct 2026 01:14:55 -0600

Received: by mail-pf1-f200.google.com with SMTP id d2e1a72fcca58-88b9d8c9e55so586730b3a.1

for ; Tue, 06 Oct 2026 00:13:04 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=afu-edu-np.20251104.gappssmtp.com; s=20251104; t=1791270778; x=1791875578; darn=nk.ca;

h=content-type:to:from:subject:date:message-id:mime-version:from:to

:cc:subject:date:message-id:reply-to:content-type;

bh=+RDjNda7qEDg1oRh2ccR+hTKDmvxGSxyccjcKmvQ45Q=;

b=R6DqOWA73Oj2UvNtr3e6WepeU4sbbATLdWweX3XAMhFMfKycpG4FgGfirR9ONeyMY4

ll0MHkBh6DmtKhg/EOYUA/xrlEVlSszvgptlx/NwiZEyK2hOmJtFhvHWhg2nUXdnTxD5

elMIv6PC6e7rL1ZsHp2pc1nsfdRoygUwn7xXy51Jnj1qd+K3mMycmwLbM2pOn1JAfK3I

tRfh7mSBgBmamxK9t/KUafjD6mrsIWG0jC/ML61tRkdDkrHW6qKdvtj7i2IXMgR79ZfW

BVqX0fwluSucfWdfT3MEVFjCxb2l8PTwtjWGrFEHSE43ZQf5sE1+A/l/mieGd/2JtPfx

mrCg==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20260707; t=1791270778; x=1791875578;

h=content-type:to:from:subject:date:message-id:mime-version

:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to

:content-type;

bh=+RDjNda7qEDg1oRh2ccR+hTKDmvxGSxyccjcKmvQ45Q=;

b=zooVJcqLl8R6WC391mMMtD7KGM+3ErCXk7s7kwBetcw4RS+73mflKfHf5p581fVj7A

rbaKcoBU+hD+jZnd3q6tx3Kf8A8g5SIKqnPVflYJYmkT810uknMuHq9IKzn4+ddNXEDX

jEa2mx3Lfq+5rqUmT57ggzwAKXptVRKJxIhA2vwIlHUGYbVeIot5aOA5hkvyBwjXG8T5

23gc8JURxqZHvrXuDfyHgo5gDdL47blNCxPmHI2aoLXpl1H9I3c7R/Sl1uWoIa7wHCBY

X6zZGZY0Oc+pnUdVay1ad3Sw+yNmtNPlBvyxQ2ukAtFWAjp0qgGyF+Dpb97xCdpmNMrM

VZ4A==

X-Gm-Message-State: AFuF++lZdj5XzEiBXPN01E6mwl6YXrRs5Zwz3JiLQn6fEGOoXiqq7u8l

T3EN5gj62ryGArweOYFm2ETkGNVudnoZiji08Z0b1Ve9LyfFkUDrW4WaoXg61axQOCKVEqSYtST

QCPtfJg82I+KMBSGWnoOYWiNa

MIME-Version: 1.0

X-Received: by 2002:a05:6a00:4610:b0:88d:a4c:3a5e with SMTP id

d2e1a72fcca58-8904926965cmr1374422b3a.49.1791270778599; Tue, 06 Oct 2026

00:12:58 -0700 (PDT)

Message-ID:

Date: Tue, 06 Oct 2026 07:12:58 +0000

Subject: Wat betalen anderen voor hun abonnement?

From: Nationaal Telecom Onderzoek

To: doctor@nk.ca

Content-Type: multipart/alternative; boundary="000000000000748dff065d26ba24"

X-Spam_score: 6.4

X-Spam_score_int: 64

X-Spam_bar: ++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Nationaal Telecom Onderzoek Editie oktober 2026 Betaalt u

te veel voor uw telefoonabonnement?



Content analysis details: (6.4 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[209.85.210.200 listed in will-spam-for-food.eu.org]

[209.85.210.200 listed in will-spam-for-food.eu.org]

[209.85.210.200 listed in will-spam-for-food.eu.org]

[209.85.210.200 listed in will-spam-for-food.eu.org]

[209.85.210.200 listed in will-spam-for-food.eu.org]

[209.85.210.200 listed in will-spam-for-food.eu.org]

[209.85.210.200 listed in will-spam-for-food.eu.org]

[209.85.210.200 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[209.85.210.200 listed in dnsbl.ahbl.org]

[209.85.210.200 listed in dnsbl.ahbl.org]

[209.85.210.200 listed in dnsbl.ahbl.org]

[209.85.210.200 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[209.85.210.200 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[209.85.210.200 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[209.85.210.200 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[209.85.210.200 listed in dnsbl.ahbl.org]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[209.85.210.200 listed in list.dnswl.org]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

1.1 URIBL_GREY Contains an URL listed in the URIBL greylist

[URI: klclick.com]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[209.85.210.200 listed in bl.score.senderscore.com]

-0.0 RCVD_IN_MSPIKE_H3 RBL: Good reputation (+3)

[209.85.210.200 listed in wl.mailspike.net]

1.0 SPF_SOFTFAIL SPF: sender does not match SPF record (softfail)

-0.0 RCVD_IN_MSPIKE_WL Mailspike good senders

0.1 TW_JK BODY: Odd Letter Triples with JK

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 HTML_MESSAGE BODY: HTML included in message

2.0 RATWR8_MESSID Message-ID with excessive dashes and dollars

1.0 IMPRO_URI_2 No description available.

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

Subject: {SPAM?} Wat betalen anderen voor hun abonnement?



--000000000000748dff065d26ba24

Content-Type: text/plain; charset="UTF-8"; format=flowed; delsp=yes

Content-Transfer-Encoding: base64



TmF0aW9uYWFsIFRlbGVjb20gT25kZXJ6b2VrDQoNCkVkaXRpZSBva3RvYmVyIDIwMjYNCg0KDQoN

CkJldGFhbHQgdSB0ZSB2ZWVsIHZvb3IgdXcgdGVsZWZvb25hYm9ubmVtZW50Pw0KDQpVaXQgb25z

IGxhYXRzdGUgb25kZXJ6b2VrIG9uZGVyIDE0LjAwMCBOZWRlcmxhbmRzZSBodWlzaG91ZGVucyBi

bGlqa3QgZGF0ICANCjYyJSBtZWVyIGJldGFhbHQgZGFuIG5vZGlnLiBHZW1pZGRlbGQgZ2FhdCBo

ZXQgb20g4oKsOCw0MCBwZXIgbWFhbmQg4oCUIGRhdCBpcyAgDQpydWltIOKCrDEwMCBwZXIgamFh

ci4NCg0KDQoNCuKCrDI0DQoNCmdlbWlkZGVsZCBiZXRhYWxkDQoNCuKCrDE1LDYwDQoNCmxhYWdz

dGUgdGFyaWVmKg0KDQoNCg0KVmVyZ2VsaWprIHV3IGFib25uZW1lbnQgbWV0IGR1aXplbmRlbiBh

bmRlcmUgTmVkZXJsYW5kZXJzIGVuIG9udGRlayBvZiB1ICANCmt1bnQgYmVzcGFyZW4uDQoNCg0K

VmVyZ2VsaWprIHV3IGFib25uZW1lbnQNCg0KDQoqQnJvbjogTlRPIG9rdG9iZXIgMjAyNiwgc2lt

LW9ubHkgMTBHQisNCg0KDQpBZm1lbGRlbiB8IE5pZXQgbWVlciBvbnR2YW5nZW4NCg0K

--000000000000748dff065d26ba24

Content-Type: text/html; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable




h:600px;margin:0 auto;font-family:Arial,Helvetica,sans-serif;background:#ff=

ffff;">









Nation=

aal Telecom Onderzoek



Editie oktober 20=

26






argin:0 0 15px;">Betaalt u te veel voor uw telefoonabonnement?



Uit=

ons laatste onderzoek onder 14.000 Nederlandse huishoudens blijkt dat 62% =

meer betaalt dan nodig. Gemiddeld gaat het om €8,40 per maand — =

dat is ruim €100 per jaar.




px solid #e3f2fd;border-radius:8px;">










solid #e3f2fd;">

€=

24



gemiddeld betaald
>

€=

15,60



laagste tarief*


Verge=

lijk uw abonnement met duizenden andere Nederlanders en ontdek of u kunt be=

sparen.










1#t/c/ce4bffee27c7ec4e8bd3" style=3D"display:inline-block;padding:14px 36px=

;color:#ffffff;font-size:15px;font-weight:bold;text-decoration:none;">Verge=

lijk uw abonnement



*Bron: NTO oktober =

2026, sim-only 10GB+




1px;color:#999;text-align:center;">


1#t/u/ce4bffee27c7ec4e8bd3" style=3D"color:#999;text-decoration:underline;"=

>Afmelden  | 
01KCGS3SY4J36RX5JNAPV4X2XB_11#t/p/ce4bffee27c7ec4e8bd3" style=3D"color:#999=

;text-decoration:underline;">Niet meer ontvangen



--000000000000748dff065d26ba24--

Dutch language phishing from Google Gmail

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Tue, 06 Oct 2026 08:05:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.100.1 (FreeBSD))

(envelope-from )

id 1xE5mS-00000000M24-24Eh

for dave@doctor.nl2k.ab.ca;

Tue, 06 Oct 2026 08:04:32 -0600

Resent-From: The Doctor

Resent-Date: Tue, 6 Oct 2026 08:04:32 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-oo1-f72.google.com ([209.85.161.72]:45442)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.100.1 (FreeBSD))

(envelope-from )

id 1xDzIt-00000000Nal-1Sri

for doctor@nk.ca;

Tue, 06 Oct 2026 01:09:14 -0600

Received: by mail-oo1-f72.google.com with SMTP id 006d021491bc7-6df538053fcso3952150eaf.3

for ; Tue, 06 Oct 2026 00:07:18 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=pacioli.net; s=google; t=1791270432; x=1791875232; darn=nk.ca;

h=content-type:to:from:subject:date:message-id:mime-version:from:to

:cc:subject:date:message-id:reply-to:content-type;

bh=nyETHLua6RKonvYOpIkeDJiEBPXRnJ10oEwYBQb+6i0=;

b=ixH8xYieaNdmuatMQcc8yFVyFHz505yg5WiJ3vDaLwKZUCA4wKAHahcSks644uSCpU

UYD3nCUg1/Kxv2gJ0y/0TJzMiXWNtJ+Y2rGalFLCpXRVC6dFj33/6YsH6VO0xVBTzbd5

O6ZSb5PhNdmc9o/FkXofGA5P8/sopUoOEILhw=

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20260707; t=1791270432; x=1791875232;

h=content-type:to:from:subject:date:message-id:mime-version

:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to

:content-type;

bh=nyETHLua6RKonvYOpIkeDJiEBPXRnJ10oEwYBQb+6i0=;

b=w8coBlFYgwjfTiQ9ZSTQ+caKYGBkERTMiC+rMz/Hi9FBGDDOm3W1V7czNxNOC7NPV7

zS4cGnFE0GTSuCGgNpOxdkaQVxK7Z0B7YLI5RQlBuZmnJTxPqcQfdR3a2oy6dzNdSi6I

uAx5uHrbbRqAaLy4dNPfzjtve6Qe+P+Zy4ekGjyOV0kh1fypqKPVbY171txuFjx1xIix

TQbsNhQIP1KqYAq+9Bp36WYrkciCJYnv1CaPaE7rdMDBDDw+IKfvinAJAKtj/+4PYME3

wpK9mLX9uN4OhH9Nus2ubIn3dvX6KM4dzJkHKu6XPPdLsitxykS0Fi0+KmgoTdqrogax

1wKQ==

X-Gm-Message-State: AFuF++nhwX461gbEKH3wRjxt7KZKdKpXHPiBqTEI7do4hcOZ4McSO34e

sR+27VDd3d/qeoz1XOUzslSNWTj9Rpk0ijxKsx4D1kiU8cFmSDs9EmOJv8GYqNH2LBREPLpDfrc

noO1Faqb8wu1k0vpJ93dKQKut

MIME-Version: 1.0

X-Received: by 2002:a05:690e:440b:b0:677:b9d8:a472 with SMTP id

956f58d0204a3-678fcf062e7mr118931d50.79.1791269979821; Mon, 05 Oct 2026

23:59:39 -0700 (PDT)

Message-ID:

Date: Tue, 06 Oct 2026 06:59:39 +0000

Subject: Gratis EHBO-gids voor uw gezin

From: Zilveren Kruis Preventie

To: doctor@nk.ca

Content-Type: multipart/alternative; boundary="000000000000d82782065d268aaa"

X-Spam_score: 5.4

X-Spam_score_int: 54

X-Spam_bar: +++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Zilveren Kruis · Preventie Beste lezer, Wist u dat 80% van

de Nederlanders niet weet hoe te handelen bij een hartstilstand? Of dat kinderen

onder de 5 het hoogste risico lopen op verstikking in huis?



Content analysis details: (5.4 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[209.85.161.72 listed in will-spam-for-food.eu.org]

[209.85.161.72 listed in will-spam-for-food.eu.org]

[209.85.161.72 listed in will-spam-for-food.eu.org]

[209.85.161.72 listed in will-spam-for-food.eu.org]

[209.85.161.72 listed in will-spam-for-food.eu.org]

[209.85.161.72 listed in will-spam-for-food.eu.org]

[209.85.161.72 listed in will-spam-for-food.eu.org]

[209.85.161.72 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[209.85.161.72 listed in dnsbl.ahbl.org]

[209.85.161.72 listed in dnsbl.ahbl.org]

[209.85.161.72 listed in dnsbl.ahbl.org]

[209.85.161.72 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[209.85.161.72 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[209.85.161.72 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[209.85.161.72 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[209.85.161.72 listed in dnsbl.ahbl.org]

1.1 URIBL_GREY Contains an URL listed in the URIBL greylist

[URI: klclick.com]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-0.0 RCVD_IN_MSPIKE_H3 RBL: Good reputation (+3)

[209.85.161.72 listed in wl.mailspike.net]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[209.85.161.72 listed in bl.score.senderscore.com]

-0.0 SPF_PASS SPF: sender matches SPF record

-0.0 RCVD_IN_MSPIKE_WL Mailspike good senders

0.1 TW_IK BODY: Odd Letter Triples with IK

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 HTML_MESSAGE BODY: HTML included in message

1.0 IMPRO_URI_2 No description available.

2.0 RATWR8_MESSID Message-ID with excessive dashes and dollars

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

Subject: {SPAM?} Gratis EHBO-gids voor uw gezin



--000000000000d82782065d268aaa

Content-Type: text/plain; charset="UTF-8"; format=flowed; delsp=yes

Content-Transfer-Encoding: base64



WmlsdmVyZW4gS3J1aXMgwrcgUHJldmVudGllDQoNCg0KDQpCZXN0ZSBsZXplciwNCg0KV2lzdCB1

IGRhdCA4MCUgdmFuIGRlIE5lZGVybGFuZGVycyBuaWV0IHdlZXQgaG9lIHRlIGhhbmRlbGVuIGJp

aiBlZW4gIA0KaGFydHN0aWxzdGFuZD8gT2YgZGF0IGtpbmRlcmVuIG9uZGVyIGRlIDUgaGV0IGhv

b2dzdGUgcmlzaWNvIGxvcGVuIG9wICANCnZlcnN0aWtraW5nIGluIGh1aXM/DQoNCldpaiBoZWJi

ZW4gZWVuIGJla25vcHRlIEVIQk8tZ2lkcyBzYW1lbmdlc3RlbGQgbWV0IGRlIGJlbGFuZ3Jpamtz

dGUgIA0KbGV2ZW5zcmVkZGVuZGUgaGFuZGVsaW5nZW4uIFZhbiByZWFuaW1hdGllIHRvdCBicmFu

ZHdvbmRlbiwgdmFuIGFsbGVyZ2lzY2hlICANCnJlYWN0aWVzIHRvdCB2YWwtb25nZWx1a2tlbi4N

Cg0KRGUgZ2lkcyBpcyBncmF0aXMgYmVzY2hpa2JhYXIgdm9vciBpZWRlcmVlbiBkaWUgZGUgZ2V6

b25kaGVpZCB2YW4gemlqbiAgDQpnZXppbiBzZXJpZXVzIG5lZW10Lg0KRG93bmxvYWQgZGUgZ3Jh

dGlzIEVIQk8tZ2lkcyDihpINCk1ldCB2cmllbmRlbGlqa2UgZ3JvZXQsDQpUZWFtIFByZXZlbnRp

ZQ0KWmlsdmVyZW4gS3J1aXMNCg0KDQpBZm1lbGRlbiB8IE5pZXQgbWVlciBvbnR2YW5nZW4NCg0K

--000000000000d82782065d268aaa

Content-Type: text/html; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable




h:600px;margin:0 auto;font-family:Georgia,'Times New Roman',serif;backgroun=

d:#ffffff;">










uppercase;margin:0 0 20px;font-family:Arial,sans-serif;">Zilveren Kruis &mi=

ddot; Preventie





Bes=

te lezer,



Wis=

t u dat 80% van de Nederlanders niet weet hoe te handelen bij een hartstils=

tand? Of dat kinderen onder de 5 het hoogste risico lopen op verstikking in=

huis?



Wij=

hebben een beknopte EHBO-gids samengesteld met de belangrijkste levensredd=

ende handelingen. Van reanimatie tot brandwonden, van allergische reacties =

tot val-ongelukken.



De =

gids is gratis beschikbaar voor iedereen die de gezondheid van zijn gezin s=

erieus neemt.




1#t/c/cec6f5c8b4b17c4d1807" style=3D"color:#00857c;font-size:15px;font-weig=

ht:bold;text-decoration:underline;">Download de gratis EHBO-gids →

Met=

vriendelijke groet,
Team Preventie

ont-size:13px;color:#888;">Zilveren Kruis




1px;color:#999;text-align:center;font-family:Arial,sans-serif;">


1#t/u/cec6f5c8b4b17c4d1807" style=3D"color:#999;text-decoration:underline;"=

>Afmelden  | 
01KCGS3SY4J36RX5JNAPV4X2XB_11#t/p/cec6f5c8b4b17c4d1807" style=3D"color:#999=

;text-decoration:underline;">Niet meer ontvangen



--000000000000d82782065d268aaa--

Dutch language phish from Google Gmail

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Tue, 06 Oct 2026 00:48:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.100.1 (FreeBSD))

(envelope-from )

id 1xDyxb-00000000LBP-1BZ9

for dave@doctor.nl2k.ab.ca;

Tue, 06 Oct 2026 00:47:35 -0600

Resent-From: The Doctor

Resent-Date: Tue, 6 Oct 2026 00:47:35 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-ua1-f70.google.com ([209.85.222.70]:50649)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.100.1 (FreeBSD))

(envelope-from )

id 1xDyvJ-00000000Khm-03DT

for doctor@nk.ca;

Tue, 06 Oct 2026 00:44:48 -0600

Received: by mail-ua1-f70.google.com with SMTP id a1e0cc1a2514c-98331b577e4so1806606241.1

for ; Mon, 05 Oct 2026 23:42:57 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=aluno-mg-gov-br.20251104.gappssmtp.com; s=20251104; t=1791268971; x=1791873771; darn=nk.ca;

h=content-type:to:from:subject:date:message-id:mime-version:from:to

:cc:subject:date:message-id:reply-to:content-type;

bh=jg4qvfhAncNapEsp15VDs6ALrxTkMu1qArgnRbXxYME=;

b=yx6/hTJKbA59zr3iPMO/+dVJtYIQisi/6ig8/s+Gfg2PDu7WpSJ+khXFfYM+vPYASk

IgSo3G2YIby5WQ5SuALpUeZB7IGLguUGvS0TTute0xdOdDCtEOXXQAUg4ERrStpLc5Rg

64Z8Pxo7jpbApgxhu21hpYScfGiBslkPOkbzRvvhGJhAK7PZEDRAgYoLDuAWjABfM3KX

ajamQJ1xfA9fNhv+dwD4opfyIU4BlWyJiFg/I9kXDaflqtkVaVuq1L7fJMRMTflis51P

JLeAUIuUuRhcVz8ridK1vu/vKyh5DF0TSMFdHVpA1iLiUnQru8JeSIaxc92UsTDVDHwV

eSSQ==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20260707; t=1791268971; x=1791873771;

h=content-type:to:from:subject:date:message-id:mime-version

:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to

:content-type;

bh=jg4qvfhAncNapEsp15VDs6ALrxTkMu1qArgnRbXxYME=;

b=vO8Jp50B4eSyL7fFs7ieC07qxYX89yeKTOqgKd5JnnCATgRxEKLgMywAmlypmNHJ6h

v53ubNXQz90uP3FL2A/UHm50Hk3e767qptS0iCDE3hDxJyIjiMTItP3mpETPWjhHNMYw

93HYcTc4FGwngq1X2L17XgthppPqi5kH/TPo4sndA9TITGSLv8KgmonCpN75xcIIUM2r

n+k+N1dRBbvOzfofoC5TT5AwWXi51JbWuMeoFPhosMpH8+L7PoWw6n6dKi35jwZf0INF

ES7stfhP1dAxI8vJqs0DAB3yUmngfG0oti1gUEpIcOVDFhqtgEAmdF7VS/EqQCXYFmT6

BvSg==

X-Gm-Message-State: AFq9FYLOOpYFWX2IEbLzzroB1xag9MhY9X9oHoQd2UONtaqzWeYqrYrn

LyGWAD/Ip9KSxS6i4KS/BNnHJB/slx+RG0xw4PqS56MZxuly5GS7Ejshs9A8HoWBzFPcwxiytfx

B2bni2yNAIxxCVkN+3cdSJagg+zGXs06HQN1UAmG50G2GkQIfvxu+Y/bmLYP4qmt7MkJy9w==

MIME-Version: 1.0

X-Received: by 2002:a05:6102:f9f:b0:79f:3bbd:aa3f with SMTP id

ada2fe7eead31-7c8799fa46dmr90294137.6.1791268971118; Mon, 05 Oct 2026

23:42:51 -0700 (PDT)

Message-ID:

Date: Tue, 06 Oct 2026 06:42:51 +0000

Subject: =?UTF-8?Q?Tariefwijziging_per_1_november_=E2=80=93_check_uw_besparin?=

=?UTF-8?Q?g?=

From: Sanne van Energiecheck

To: doctor@nk.ca

Content-Type: multipart/alternative; boundary="000000000000b89501065d264e1f"

X-Spam_score: 8.9

X-Spam_score_int: 89

X-Spam_bar: ++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Energietarieven wijzigen per 1 november Controleer of u nog

wel het voordeligste tarief heeft Hallo,



Content analysis details: (8.9 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[209.85.222.70 listed in will-spam-for-food.eu.org]

[209.85.222.70 listed in will-spam-for-food.eu.org]

[209.85.222.70 listed in will-spam-for-food.eu.org]

[209.85.222.70 listed in will-spam-for-food.eu.org]

[209.85.222.70 listed in will-spam-for-food.eu.org]

[209.85.222.70 listed in will-spam-for-food.eu.org]

[209.85.222.70 listed in will-spam-for-food.eu.org]

[209.85.222.70 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[209.85.222.70 listed in dnsbl.ahbl.org]

[209.85.222.70 listed in dnsbl.ahbl.org]

[209.85.222.70 listed in dnsbl.ahbl.org]

[209.85.222.70 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[209.85.222.70 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[209.85.222.70 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[209.85.222.70 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[209.85.222.70 listed in dnsbl.ahbl.org]

1.1 URIBL_GREY Contains an URL listed in the URIBL greylist

[URI: klclick.com]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[209.85.222.70 listed in list.dnswl.org]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[209.85.222.70 listed in bl.score.senderscore.com]

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[209.85.222.70 listed in wl.mailspike.net]

0.1 TW_IJ BODY: Odd Letter Triples with IJ

0.1 TW_JG BODY: Odd Letter Triples with JG

0.1 TW_JZ BODY: Odd Letter Triples with JZ

0.5 URI_NOVOWEL URI: URI hostname has long non-vowel sequence

0.0 HTML_FONT_LOW_CONTRAST BODY: HTML font color similar or identical to

background

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 HTML_MESSAGE BODY: HTML included in message

3.0 VOWEL_URI_7 RAW: URI hostname with 7+ consecutive vowels

2.0 RATWR8_MESSID Message-ID with excessive dashes and dollars

1.0 IMPRO_URI_2 No description available.

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

Subject: {SPAM?} =?UTF-8?Q?Tariefwijziging_per_1_november_=E2=80=93_check_uw_besparin?=

=?UTF-8?Q?g?=



--000000000000b89501065d264e1f

Content-Type: text/plain; charset="UTF-8"; format=flowed; delsp=yes

Content-Transfer-Encoding: quoted-printable



Energietarieven wijzigen per 1 november



Controleer of u nog wel het voordeligste tarief heeft







Hallo,



Per 1 november wijzigen veel energieleveranciers hun tarieven. Gemiddeld =

=20

stijgt de energierekening met =E2=82=AC12 per maand. Maar dat hoeft niet vo=

or u te =20

gelden =E2=80=94 mits u tijdig vergelijkt.







=E2=82=AC463



gemiddelde jaarlijkse besparing bij overstappen*









Bereken uw besparing





*Bron: ACM Energiemonitor Q3 2026





Sanne =E2=80=93 Energiecheck

Afmelden | Niet meer ontvangen





--=20





PRESERVE A NATUREZA, EVITE O DESPERD=C3=8DCIO DE PAPEL E PENSE ANTES DE=20

IMPRIMIR.



"Responsabilidade com o MEIO AMBIENTE"



Esta mensagem e=20

quaisquer arquivos em anexo podem conter informa=C3=A7=C3=B5es confidenciai=

s e/ou=20

privilegiadas. Se voc=C3=AA n=C3=A3o for o destinat=C3=A1rio ou a pessoa au=

torizada a=20

receber esta mensagem, por favor n=C3=A3o leia, copie, repasse, imprima, gu=

arde,=20

nem tome qualquer a=C3=A7=C3=A3o baseada nestas informa=C3=A7=C3=B5es. Por =

favor notifique o=20

remetente imediatamente por e-mail e apague a mensagem permanentemente.=20

Este ambiente est=C3=A1 sendo monitorado para evitar o uso indevido de noss=

os=20

sistemas.



--000000000000b89501065d264e1f

Content-Type: text/html; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable




h:600px;margin:0 auto;font-family:Arial,Helvetica,sans-serif;background:#ff=

ffff;">








:30px;text-align:center;">

=

Energietarieven wijzigen per 1 november



Controleer of u nog wel=

het voordeligste tarief heeft





Hal=

lo,



Per=

1 november wijzigen veel energieleveranciers hun tarieven. Gemiddeld stijg=

t de energierekening met €12 per maand. Maar dat hoeft niet voor u te =

gelden =E2=80=94 mits u tijdig vergelijkt.




nd:#e8f5e9;border-radius:8px;">





=

€463



gemiddelde jaarlijkse besp=

aring bij overstappen*












1#t/c/e4325b3094b65ea1e1bd" style=3D"display:inline-block;padding:14px 36px=

;color:#ffffff;font-size:15px;font-weight:bold;text-decoration:none;">Berek=

en uw besparing



*=

Bron: ACM Energiemonitor Q3 2026




1px;color:#999;text-align:center;">

Sanne =E2=80=93 Energiecheck



1#t/u/e4325b3094b65ea1e1bd" style=3D"color:#999;text-decoration:underline;"=

>Afmelden  | 
01KCGS3SY4J36RX5JNAPV4X2XB_11#t/p/e4325b3094b65ea1e1bd" style=3D"color:#999=

;text-decoration:underline;">Niet meer ontvangen







le=3D"font-size:11px">PRESERVE A NATUREZA, EVITE O DES=

PERD=C3=8DCIO DE PAPEL E PENSE ANTES DE IMPRIMIR.


=3D"font-family:Arial">"Responsabilidade com o MEIO AMBIENTE"
an>


255)">Esta mensagem e q=

uaisquer arquivos em anexo podem conter informa=C3=A7=C3=B5es confidenciais=

e/ou privilegiadas. Se voc=C3=AA n=C3=A3o for o destinat=C3=A1rio ou a pes=

soa autorizada a receber esta mensagem, por favor n=C3=A3o leia, copie, rep=

asse, imprima, guarde, nem tome qualquer a=C3=A7=C3=A3o baseada nestas info=

rma=C3=A7=C3=B5es. Por favor notifique o remetente imediatamente por e-mail=

e apague a mensagem permanentemente. Este ambiente est=C3=A1 sendo monitor=

ado para evitar o uso indevido de nossos sistemas.



--000000000000b89501065d264e1f--

Dutch language phish from Google Gmail

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Tue, 06 Oct 2026 00:48:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.100.1 (FreeBSD))

(envelope-from )

id 1xDyxR-00000000LAV-25Gs

for dave@doctor.nl2k.ab.ca;

Tue, 06 Oct 2026 00:47:25 -0600

Resent-From: The Doctor

Resent-Date: Tue, 6 Oct 2026 00:47:25 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-yw1-f200.google.com ([209.85.128.200]:52234)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.100.1 (FreeBSD))

(envelope-from )

id 1xDyiq-00000000JZm-3Co9

for doctor@nk.ca;

Tue, 06 Oct 2026 00:32:01 -0600

Received: by mail-yw1-f200.google.com with SMTP id 00721157ae682-8afde3fe132so7551557b3.0

for ; Mon, 05 Oct 2026 23:30:06 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=usmba.ac.ma; s=google; t=1791268200; x=1791873000; darn=nk.ca;

h=content-type:to:from:subject:date:message-id:mime-version:from:to

:cc:subject:date:message-id:reply-to:content-type;

bh=Mc43BANQZ86xEXyiXR8XzZoFaJrcucgKsMPhSBvR+O0=;

b=N4j6eV4E7eYc5hQMXV9oPnO9wuUIXwSqo22GSBPVvuhN0ppgTKEs5bp3Gn4NL3Gin/

QFOZegOfK8o5c+Ds8FFL/h0PoSWeM8v5wKyiarQLflOHbbxlqoM9fFBsamJtRhxIICMS

Bp61COONR4YVNS0rAgjmT4CxSeub0eYYcg2hs=

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20260707; t=1791268200; x=1791873000;

h=content-type:to:from:subject:date:message-id:mime-version

:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to

:content-type;

bh=Mc43BANQZ86xEXyiXR8XzZoFaJrcucgKsMPhSBvR+O0=;

b=DyWqdw6C8LwBBLCBOPTVpjRfoFFRY/YC0hzvgV+vs0CPOpDRgX5SniAS318AME75Y+

UFhc4glw4EnKWk1n99gsqjr83vuPSKTGWCLJzD+Y6RhC2BKiYuCA2tw8ti+AnaSMKldg

JLTJ2/6woZePXfBe3NYd/gsVTCRdszhMnSdE4J7aTtg9eAKVkLtvb08ie3rdpPkiVEgZ

Q0TAd2KtjNZI+N+de8uKr5SZZiKn8Z7Om4oZj/jaBapCosDmT1+wmKCoO46Wp2jKXaYA

GES3C1sNX7h3np5XrxkOSJPaITIiAEc5VwoTN5mYQ6QW+kErh5yZU+nT/76mzpa+quad

Bt4Q==

X-Gm-Message-State: AFq9FYJn7ic1uodXB3vm9kTI5GeDB58rkCAji+mc9YSHQ9vEFoMYV01/

mDszrrjDF7AbQgWg9JjMebOrlhLIh/NAl5DKRe8/EQtA3HG9qWStxUkeF7Ge01QeBdgZbKQ/vWB

LE2bg40Cf9tM6RZWmvThCv7QF

MIME-Version: 1.0

X-Received: by 2002:a05:690c:9988:b0:887:f4fc:ee35 with SMTP id

00721157ae682-8b04f39cb91mr1707387b3.19.1791268200111; Mon, 05 Oct 2026

23:30:00 -0700 (PDT)

Message-ID:

Date: Tue, 06 Oct 2026 06:30:00 +0000

Subject: Actie vereist voor uw levering

From: DHL Bezorgservice

To: doctor@nk.ca

Content-Type: multipart/alternative; boundary="000000000000c3ef81065d26207e"



--000000000000c3ef81065d26207e

Content-Type: text/plain; charset="UTF-8"; format=flowed; delsp=yes

Content-Transfer-Encoding: base64



REhMIEJlem9yZ3NlcnZpY2UNCg0KDQpFciBpcyBlZW4gYWN0aWUgbm9kaWcgb20gdXcgcGFra2V0

IHRlIGt1bm5lbiBiZXpvcmdlbi4gQ29udHJvbGVlciBoaWVyb25kZXIgIA0KZGUgYmV6b3Jnb3B0

aWVzIGVuIGtpZXMgdXcgdm9vcmtldXIuDQoNCg0KU3RhdHVzDQpXYWNodCBvcCB1dyBrZXV6ZQ0K

DQpWZXJ3YWNodGUgbGV2ZXJpbmcNCk1hYW5kYWcgNyBva3Qg4oCTIERpbnNkYWcgOCBva3QNCg0K

QmV6b3Jnb3B0aWVzDQpUaHVpc2Jlem9yZ2VuIOKAoiBESEwgUHVudCDigKIgQnVyZW4NCg0KDQoN

CktpZXMgdXcgYmV6b3Jnb3B0aWUNCg0KDQoNCkFmbWVsZGVuIHwgTmlldCBtZWVyIG9udHZhbmdl

bg0KDQo=

--000000000000c3ef81065d26207e

Content-Type: text/html; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable




h:600px;margin:0 auto;font-family:Arial,Helvetica,sans-serif;background:#ff=

ffff;">









DHL

Bezor=

gservice



Er =

is een actie nodig om uw pakket te kunnen bezorgen. Controleer hieronder de=

bezorgopties en kies uw voorkeur.




px solid #e8e8e8;border-radius:6px;">








id #e8e8e8;">

Status


Wacht op uw =

keuze



Verwachte levering


Maandag 7 okt =E2=80=93 Dinsdag =

8 okt



Bezorgopties


Thuisbezorgen • DHL Punt &b=

ull; Buren










1#t/c/17d547cea71ccf7cf222" style=3D"display:inline-block;padding:14px 36px=

;color:#ffffff;font-size:15px;font-weight:bold;text-decoration:none;">Kies =

uw bezorgoptie




1px;color:#999;text-align:center;">


1#t/u/17d547cea71ccf7cf222" style=3D"color:#999;text-decoration:underline;"=

>Afmelden  | 
01KCGS3SY4J36RX5JNAPV4X2XB_11#t/p/17d547cea71ccf7cf222" style=3D"color:#999=

;text-decoration:underline;">Niet meer ontvangen



--000000000000c3ef81065d26207e--

Web/SEo/App sapm from Google Gmail

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Mon, 05 Oct 2026 23:34:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.100.1 (FreeBSD))

(envelope-from )

id 1xDxnl-00000000Dar-0yhq

for dave@doctor.nl2k.ab.ca;

Mon, 05 Oct 2026 23:33:21 -0600

Resent-From: The Doctor

Resent-Date: Mon, 5 Oct 2026 23:33:21 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-dy1-f173.google.com ([74.125.82.173]:46378)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.100.1 (FreeBSD))

(envelope-from )

id 1xDxS3-00000000AjB-1vEJ

for sales@nk.ca;

Mon, 05 Oct 2026 23:10:32 -0600

Received: by mail-dy1-f173.google.com with SMTP id 5a478bee46e88-34ef8f66a6bso191386eec.1

for ; Mon, 05 Oct 2026 22:08:36 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=appatozsolutions-com.20251104.gappssmtp.com; s=20251104; t=1791263310; x=1791868110; darn=nk.ca;

h=content-type:mime-version:date:content-transfer-encoding:message-id

:subject:to:from:from:to:cc:subject:date:message-id:reply-to

:content-type;

bh=LuRxWn5L8YS8du9xI7m+o6mTsO5dn/u/2ftmII1OqzA=;

b=gKfm8KXrS3QJ2+1W83kinhjsU1RPIVpzuycO4ltySR4W3DNY/PiZ8GKNbVWK61ZPR8

ff/5hynNVAljj4/o1MuOCS1a5maD+FwCM69gwQF0V+32hgJO7tJVHGZJPiFULieM5h9I

+pRfymdf+LlTPjDrLTD+mDM3Sl6XXBgLHPy9BZcwMZ9ddtwHaVWYRwNZesc2cPryObsZ

iLFBYC3URT20SE9LsG5FDBj6oYvQFB31PVK6QT0ooN7BJJNvoeh0a+4bwzrP/kWoDIVt

vae1+9tu5JYRccoFIW4ydvWWiF5fgFuVn9AUMwt+9u5Ke9rbfx1v4GIL57fzdQ/RvuPn

HQog==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20260707; t=1791263310; x=1791868110;

h=content-type:mime-version:date:content-transfer-encoding:message-id

:subject:to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date

:message-id:reply-to:content-type;

bh=LuRxWn5L8YS8du9xI7m+o6mTsO5dn/u/2ftmII1OqzA=;

b=wNZTn2TloDVoERdwbE6+7IjKpAOskB/1PgZi5GqFjCrhUzu2D08t1Rx6Y0W7bkqVSG

jOQIuG5TWcsW4fm5luxazbnCY+luevm54Dghq7hWBnArJbS11FoMeF4GuISiJXtDzFdr

ZojDIcEKSfIvR1ppKs6g5eUBIRafq5ZIyIggmdSUey0sywwjIEt2Zrcgw/KhxF1u72G8

045AR214MjyKPG84IJBU/7nRplMQYfYFNZNLBkD7oRe4iF+U4RxQ7BWZzDPEvJGBdM2K

9Z1q6uqyiNMkbg/37T8p12eW2c7vqcrZ4sWnMJWro8h5rm0nPd5NR+tdbnv5G3yqthhn

L9UQ==

X-Gm-Message-State: AFuF++m1eGNHDwgFRw2bcAnBTpQhawix9fbU3imNLMTjTFcwTJVBq3kB

vQb5YnS4KJHKNvR+1TqkLFBvMu8m/i1UiUxUJa0fVvX1kd+whwkBVtpowadqBilDPCau2sFM8eM

K3pFa

X-Gm-Gg: AYBFou09O8+ZTTwyWcXSe4GfPUkUFQqgJ2Q4sCyUANpIqVbfvwgR4vhS37CUPWxkZxh

zi6FIfoyyxlI7ldCOSHlo3Nf0z6ulahZKLJEO+b/t4TzibhG318Kl66bxzKLXmCah0KkfroFTBi

U2+GqPk+OixC3Lmjg4s9xDI+2iReLAnFMNlCRl9m0DGwZO5D9/Y95SkUKRFfLQbcg690o8tBUWh

zc9djqjXj1jcIdOHwdzqtX7/50mxHmpY9lFCL/lH78wQnIo/3jXlVM/l0mTZOCMFWJfAOuJTLQ8

LQ1dFdyFLzGf/Tq1RahmFAm1H+x8YX1oy0uIpIzy5laGb9fRhsb6angR5CF0ZD/JxK8vYr0jQ8R

TSVfO6eygLxh1W0Lm8NsBBm6l7u9UbVdEOKjuOJdWUGh4EE+6ornR5xqaV9iVGWYOG98YX+sO84

NtTfJTqrc3dBfZ5GVf5dZlT0umMP+XuiCmF7bH+EpZTQXYMUUmD2xo6IbPn9n1pzpzLEYalWKyk

yTwkYUhve/7Ydonix01/4BA+N2Syw==

X-Received: by 2002:a05:7301:618a:b0:348:201a:6c8b with SMTP id 5a478bee46e88-3514e383e91mr157826eec.38.1791263310021;

Mon, 05 Oct 2026 22:08:30 -0700 (PDT)

Received: from [127.0.0.1] ([122.161.50.206])

by smtp.gmail.com with ESMTPSA id 5a478bee46e88-35146b5ee6bsm5356793eec.30.2026.10.05.22.08.28

for

(version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128);

Mon, 05 Oct 2026 22:08:29 -0700 (PDT)

From: Edith

To: sales@nk.ca

Subject: Hi - www.nk.ca ?

Message-ID: <0b85616c-cb95-ec91-e67e-71aa115efbaf@appatozsolutions.com>

Content-Transfer-Encoding: quoted-printable

Date: Tue, 06 Oct 2026 05:08:27 +0000

MIME-Version: 1.0

Content-Type: text/html; charset=utf-8

X-Spam_score: 14.0

X-Spam_score_int: 140

X-Spam_bar: ++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Hi, Want to grow your business with a custom mobile app?



Content analysis details: (14.0 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[122.161.50.206 listed in will-spam-for-food.eu.org]

[122.161.50.206 listed in will-spam-for-food.eu.org]

[122.161.50.206 listed in will-spam-for-food.eu.org]

[122.161.50.206 listed in will-spam-for-food.eu.org]

[122.161.50.206 listed in will-spam-for-food.eu.org]

[122.161.50.206 listed in will-spam-for-food.eu.org]

[122.161.50.206 listed in will-spam-for-food.eu.org]

[122.161.50.206 listed in will-spam-for-food.eu.org]

[74.125.82.173 listed in will-spam-for-food.eu.org]

[74.125.82.173 listed in will-spam-for-food.eu.org]

[74.125.82.173 listed in will-spam-for-food.eu.org]

[74.125.82.173 listed in will-spam-for-food.eu.org]

[74.125.82.173 listed in will-spam-for-food.eu.org]

[74.125.82.173 listed in will-spam-for-food.eu.org]

[74.125.82.173 listed in will-spam-for-food.eu.org]

[74.125.82.173 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[122.161.50.206 listed in dnsbl.ahbl.org]

[122.161.50.206 listed in dnsbl.ahbl.org]

[122.161.50.206 listed in dnsbl.ahbl.org]

[122.161.50.206 listed in dnsbl.ahbl.org]

[74.125.82.173 listed in dnsbl.ahbl.org]

[74.125.82.173 listed in dnsbl.ahbl.org]

[74.125.82.173 listed in dnsbl.ahbl.org]

[74.125.82.173 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[122.161.50.206 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[122.161.50.206 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[122.161.50.206 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[122.161.50.206 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_CBL RBL: Received via a relay in cbl.abuseat.org

[Listed by XBL, see ]

1.5 RCVD_IN_SBL_XBL RBL: Received via a relay in Spamhaus SBL+XBL

[122.161.50.206 listed in sbl-xbl.spamhaus.org]

[122.161.50.206 listed in sbl-xbl.spamhaus.org]

3.6 RCVD_IN_SBL_CSS RBL: Received via a relay in Spamhaus SBL-CSS

[122.161.50.206 listed in zen.spamhaus.org]

1.2 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a relay in bl.spamcop.net

[Blocked - see ]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[74.125.82.173 listed in list.dnswl.org]

-0.0 RCVD_IN_MSPIKE_H3 RBL: Good reputation (+3)

[74.125.82.173 listed in wl.mailspike.net]

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 NO_RDNS2 Sending MTA has no reverse DNS

2.0 RATWR8_MESSID Message-ID with excessive dashes and dollars

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

0.6 HTML_MIME_NO_HTML_TAG HTML-only message, but there is no HTML tag

-0.0 RCVD_IN_MSPIKE_WL Mailspike good senders

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[74.125.82.173 listed in bl.score.senderscore.com]

1.0 FROM_FMBLA_NEWDOM14 From domain was registered in last 7-14 days

Subject: {SPAM?} Hi - www.nk.ca ?



Hi,

Want to grow your business with a custom mobile app?

/>
I'd be happy to share our previous work and development packages.=



Thanks,

Edith



Nigerian spam

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Mon, 05 Oct 2026 23:05:13 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.100.1 (FreeBSD))

(envelope-from )

id 1xDxMO-00000000ALy-0XLk

for dave@doctor.nl2k.ab.ca;

Mon, 05 Oct 2026 23:05:04 -0600

Resent-From: The Doctor

Resent-Date: Mon, 5 Oct 2026 23:05:04 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail.plesio.bg ([91.196.126.13]:43020)

by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

(Exim 4.100.1 (FreeBSD))

(envelope-from )

id 1xDrog-00000000PVe-0D6R

for doctor@doctor.nl2k.ab.ca;

Mon, 05 Oct 2026 17:09:31 -0600

Received: (qmail 21705 invoked by uid 1010); 5 Oct 2026 22:28:18 -0000

X-Qmail-Scanner-Diagnostics: from 154.118.73.164 (hostedben@plesio.bg@154.118.73.164) by dsrv103-plesio-db (envelope-from , uid 1007) with qmail-scanner-2.11st

(spamassassin: 3.4.0. perlscan: 2.11st.

Clear:RC:1(154.118.73.164):SA:0(2.6/5.0):.

Processed in 1.165895 secs); 05 Oct 2026 22:28:18 -0000

X-Spam-Status: No, hits=2.6 required=5.0

X-Spam-Level: ++

X-Spam-Report: SA TESTS

0.0 URIBL_BLOCKED ADMINISTRATOR NOTICE: The query to URIBL was blocked.

See

http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block

for more information.

[URIs: skyibfcu.com]

-1.0 ALL_TRUSTED Passed through trusted hosts only via SMTP

-1.9 BAYES_00 BODY: Bayes spam probability is 0 to 1%

[score: 0.0000]

1.0 FROMSPACE Idiosyncratic "From" header format

0.0 MILLION_HUNDRED BODY: Million "One to Nine" Hundred

0.5 MISSING_MID Missing Message-Id: header

0.0 LOTS_OF_MONEY Huge... sums of money

1.1 MONEY_NOHTML Lots of money in plain text

2.9 ADVANCE_FEE_4_NEW_MONEY Advance Fee fraud and lots of money

Received: from unknown (HELO ?192.168.1.4?) (hostedben@plesio.bg@154.118.73.164)

by mail.plesio.bg with ESMTPA; 5 Oct 2026 22:28:16 -0000

Content-Type: text/plain; charset="iso-8859-1"

MIME-Version: 1.0

Content-Transfer-Encoding: quoted-printable

Content-Description: Mail message body

Subject: my subject

To: Recipients

From: " SKY FEDERAL CREDIT UNION BANK"

Date: Mon, 05 Oct 2026 15:28:07 -0700

Reply-To: admin@skyibfcu.com

Message-ID: <1791239296104121591@dsrv103-plesio-db>

X-Spam_score: 6.8

X-Spam_score_int: 68

X-Spam_bar: ++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: CONTACT US HERE: admin@skyibfcu.com We received your file

to release your payment of twenty three million three hundred thousand dollars

to you, so you are to inform us on how you want to receive your payment,

because we are paying in f [...]



Content analysis details: (6.8 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[154.118.73.164 listed in will-spam-for-food.eu.org]

[154.118.73.164 listed in will-spam-for-food.eu.org]

[154.118.73.164 listed in will-spam-for-food.eu.org]

[154.118.73.164 listed in will-spam-for-food.eu.org]

[154.118.73.164 listed in will-spam-for-food.eu.org]

[154.118.73.164 listed in will-spam-for-food.eu.org]

[154.118.73.164 listed in will-spam-for-food.eu.org]

[154.118.73.164 listed in will-spam-for-food.eu.org]

[91.196.126.13 listed in will-spam-for-food.eu.org]

[91.196.126.13 listed in will-spam-for-food.eu.org]

[91.196.126.13 listed in will-spam-for-food.eu.org]

[91.196.126.13 listed in will-spam-for-food.eu.org]

[91.196.126.13 listed in will-spam-for-food.eu.org]

[91.196.126.13 listed in will-spam-for-food.eu.org]

[91.196.126.13 listed in will-spam-for-food.eu.org]

[91.196.126.13 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[154.118.73.164 listed in dnsbl.ahbl.org]

[154.118.73.164 listed in dnsbl.ahbl.org]

[154.118.73.164 listed in dnsbl.ahbl.org]

[154.118.73.164 listed in dnsbl.ahbl.org]

[91.196.126.13 listed in dnsbl.ahbl.org]

[91.196.126.13 listed in dnsbl.ahbl.org]

[91.196.126.13 listed in dnsbl.ahbl.org]

[91.196.126.13 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[154.118.73.164 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[154.118.73.164 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[154.118.73.164 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[154.118.73.164 listed in dnsbl.ahbl.org]

-0.0 SPF_PASS SPF: sender matches SPF record

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

1.0 FROMSPACE Idiosyncratic "From" header format

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-0.0 T_RP_MATCHES_RCVD Envelope sender domain matches handover relay

domain

2.5 MILLION_HUNDRED BODY: Million "One to Nine" Hundred

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

0.0 LOTS_OF_MONEY Huge... sums of money

1.8 ADVANCE_FEE_4_NEW_MONEY Advance Fee fraud and lots of money

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[91.196.126.13 listed in bl.score.senderscore.com]

Subject: {SPAM?} my subject



CONTACT US HERE: admin@skyibfcu.com



We received your file to release your payment of twenty three million three=

hundred thousand dollars to you, so you are to inform us on how you want t=

o receive your payment, because we are paying in four ways: 1, wire transfe=

r bank to bank, 2, certified international ATM MASTERCARD,

3, we can open online account for you and credit your full payment and dire=

ct you on how you can transfer to your local account, 4, we can deliver you=

r payment through diplomatic, to your door step in your country.



This is the picture of your payment in dollars, so you should try get back =

to us immediately, you can call us through whatsapp on +19342013826



We are here to serve you better



Regards

Dr. Daisy Romo

Nigerian spam

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Mon, 05 Oct 2026 23:05:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.100.1 (FreeBSD))

(envelope-from )

id 1xDxLq-00000000AGn-0yEx

for dave@doctor.nl2k.ab.ca;

Mon, 05 Oct 2026 23:04:30 -0600

Resent-From: The Doctor

Resent-Date: Mon, 5 Oct 2026 23:04:30 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail.plesio.bg ([91.196.126.13]:57300)

by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

(Exim 4.100.1 (FreeBSD))

(envelope-from )

id 1xDqLQ-000000008fN-2Bg0

for doctor@doctor.nl2k.ab.ca;

Mon, 05 Oct 2026 15:35:17 -0600

Received: (qmail 12985 invoked by uid 1010); 5 Oct 2026 21:29:13 -0000

X-Qmail-Scanner-Diagnostics: from 154.118.73.164 (hostedben@plesio.bg@154.118.73.164) by dsrv103-plesio-db (envelope-from , uid 1007) with qmail-scanner-2.11st

(spamassassin: 3.4.0. perlscan: 2.11st.

Clear:RC:1(154.118.73.164):SA:0(2.6/5.0):.

Processed in 1.173683 secs); 05 Oct 2026 21:29:13 -0000

X-Spam-Status: No, hits=2.6 required=5.0

X-Spam-Level: ++

X-Spam-Report: SA TESTS

0.0 URIBL_BLOCKED ADMINISTRATOR NOTICE: The query to URIBL was blocked.

See

http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block

for more information.

[URIs: skyibfcu.com]

-1.0 ALL_TRUSTED Passed through trusted hosts only via SMTP

-1.9 BAYES_00 BODY: Bayes spam probability is 0 to 1%

[score: 0.0000]

1.0 FROMSPACE Idiosyncratic "From" header format

0.0 MILLION_HUNDRED BODY: Million "One to Nine" Hundred

0.5 MISSING_MID Missing Message-Id: header

0.0 LOTS_OF_MONEY Huge... sums of money

1.1 MONEY_NOHTML Lots of money in plain text

2.9 ADVANCE_FEE_4_NEW_MONEY Advance Fee fraud and lots of money

Received: from unknown (HELO ?192.168.1.4?) (hostedben@plesio.bg@154.118.73.164)

by mail.plesio.bg with ESMTPA; 5 Oct 2026 21:29:11 -0000

Content-Type: text/plain; charset="iso-8859-1"

MIME-Version: 1.0

Content-Transfer-Encoding: quoted-printable

Content-Description: Mail message body

Subject: my subject

To: Recipients

From: " SKY FEDERAL CREDIT UNION BANK"

Date: Mon, 05 Oct 2026 14:28:59 -0700

Reply-To: admin@skyibfcu.com

Message-ID: <1791235751104112917@dsrv103-plesio-db>

X-Spam_score: 6.8

X-Spam_score_int: 68

X-Spam_bar: ++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: CONTACT US HERE: admin@skyibfcu.com We received your file

to release your payment of twenty three million three hundred thousand dollars

to you, so you are to inform us on how you want to receive your payment,

because we are paying in f [...]



Content analysis details: (6.8 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[154.118.73.164 listed in will-spam-for-food.eu.org]

[154.118.73.164 listed in will-spam-for-food.eu.org]

[154.118.73.164 listed in will-spam-for-food.eu.org]

[154.118.73.164 listed in will-spam-for-food.eu.org]

[154.118.73.164 listed in will-spam-for-food.eu.org]

[154.118.73.164 listed in will-spam-for-food.eu.org]

[154.118.73.164 listed in will-spam-for-food.eu.org]

[154.118.73.164 listed in will-spam-for-food.eu.org]

[91.196.126.13 listed in will-spam-for-food.eu.org]

[91.196.126.13 listed in will-spam-for-food.eu.org]

[91.196.126.13 listed in will-spam-for-food.eu.org]

[91.196.126.13 listed in will-spam-for-food.eu.org]

[91.196.126.13 listed in will-spam-for-food.eu.org]

[91.196.126.13 listed in will-spam-for-food.eu.org]

[91.196.126.13 listed in will-spam-for-food.eu.org]

[91.196.126.13 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[91.196.126.13 listed in dnsbl.ahbl.org]

[91.196.126.13 listed in dnsbl.ahbl.org]

[91.196.126.13 listed in dnsbl.ahbl.org]

[91.196.126.13 listed in dnsbl.ahbl.org]

[154.118.73.164 listed in dnsbl.ahbl.org]

[154.118.73.164 listed in dnsbl.ahbl.org]

[154.118.73.164 listed in dnsbl.ahbl.org]

[154.118.73.164 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[91.196.126.13 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[91.196.126.13 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[91.196.126.13 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[91.196.126.13 listed in dnsbl.ahbl.org]

-0.0 SPF_PASS SPF: sender matches SPF record

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

1.0 FROMSPACE Idiosyncratic "From" header format

-0.0 T_RP_MATCHES_RCVD Envelope sender domain matches handover relay

domain

2.5 MILLION_HUNDRED BODY: Million "One to Nine" Hundred

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[91.196.126.13 listed in bl.score.senderscore.com]

0.0 LOTS_OF_MONEY Huge... sums of money

1.8 ADVANCE_FEE_4_NEW_MONEY Advance Fee fraud and lots of money

Subject: {SPAM?} my subject



CONTACT US HERE: admin@skyibfcu.com



We received your file to release your payment of twenty three million three=

hundred thousand dollars to you, so you are to inform us on how you want t=

o receive your payment, because we are paying in four ways: 1, wire transfe=

r bank to bank, 2, certified international ATM MASTERCARD,

3, we can open online account for you and credit your full payment and dire=

ct you on how you can transfer to your local account, 4, we can deliver you=

r payment through diplomatic, to your door step in your country.



This is the picture of your payment in dollars, so you should try get back =

to us immediately, you can call us through whatsapp on +19342013826



We are here to serve you better



Regards

Dr. Daisy Romo

loan phish from Google Gmail

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Mon, 05 Oct 2026 23:05:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.100.1 (FreeBSD))

(envelope-from )

id 1xDxLi-00000000AFw-1PB0

for dave@doctor.nl2k.ab.ca;

Mon, 05 Oct 2026 23:04:22 -0600

Resent-From: The Doctor

Resent-Date: Mon, 5 Oct 2026 23:04:22 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-pj2-f13.google.com ([74.125.227.141]:59904)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.100.1 (FreeBSD))

(envelope-from )

id 1xDqEf-0000000084L-1jSj

for sales@nk.ca;

Mon, 05 Oct 2026 15:28:13 -0600

Received: by mail-pj2-f13.google.com with SMTP id 98e67ed59e1d1-396ccb65437so1198284a91.3

for ; Mon, 05 Oct 2026 14:27:16 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=swiftbridge.ca; s=google; t=1791235630; x=1791840430; darn=nk.ca;

h=references:list-unsubscribe-post:list-unsubscribe:message-id:date

:to:from:subject:mime-version:content-type:from:to:cc:subject:date

:message-id:reply-to:content-type;

bh=w0r3ORismzaKwM/bAPslp8pz+uHecXsAmQ2l7253ln4=;

b=iR6a4RoyfjauAXWQQPEM5nsmNB+hIN1/zL7p4NY6hzBl4fbIDyo5XYinMS3POqHGBl

+goqSmtwjqpJWOqTa97R4l3dif5R+OeYtDLhQHbeL+pLZRQZp4WSqu8hGXX4KXk/abGN

UxNH3j24Fxm2zIpjBjVQ055To6Eyn4igvabbwtp+UApbCijQil4TRcdNQyZTjD3C4ocO

CImMCp1T2QVtipOPCBGcnJU+ghdXRa/sOFSR6zY5KHtNV0BjdtSvDE9KRY6iUkfO2NnD

28SWruYTbVuEgD/YO+tryFDXl1Tf0RJ0EEVZkGKDEUnu57KMxp3AH5TwIcE9eUd9HCLd

pI8w==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20260707; t=1791235630; x=1791840430;

h=references:list-unsubscribe-post:list-unsubscribe:message-id:date

:to:from:subject:mime-version:content-type:x-gm-gg

:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to

:content-type;

bh=w0r3ORismzaKwM/bAPslp8pz+uHecXsAmQ2l7253ln4=;

b=z0RmyUf2v52HjWGzpOGl53ygBMSfTXmPmszC45LycnkkOCjs9gDxw2qtZGLiLx06j7

Ie4JzrTRuwYUu6R3JQVJ/E0/gaATl+7/HJ1HtkIrcajxopRuAFWjAdOGBpalibTeGA3e

kMLd6jC5KMMBduhkrEkRNC9peQyJ9EXLkNzA8jEdHuT7E+xpf32EvFnNAtXgeABCAzlB

bCiVQEqKpBt23QuMVpK2/TZhEA/xziBEM8nyzI98T0tRxM9AM9/NynLib31S8qoQx0+W

LEvbzez33JrehLQcLzdYrlDYFDHVhWR4j7Oax0bkVpWytGtSaOCjYUwWRPpdt87rmTvR

fkJA==

X-Gm-Message-State: AFq9FYKhrNFKZru25N1lSDXxtf7sgYVIR4o6oS1u5M8p00lXR5JPxoTY

6Xmb1QQ5873/IzHS5zcvgucqjfjuwWZnY17gpoalmsxrOTPxVXFf4SJd5eGv0yaRgO/KfR0WpCv

0YcUILA==

X-Gm-Gg: AYBFou1atL2vpd0y/khHbmVimbwE+wz23tcKw0Yr/qVCQ6UqqBtywPyD5lX0EqGxxIE

Ll5DFq4hLzRhEU1rtlRSIEScqAFjxpg+DrFGdhlVyb+uEYrT9VhwIumRDUcP/UKPQkaK4fmUvtw

LFZ+zfobnnjdwlVg/ZlzDUZN1RsC1F8jhXtfp4Be4vJGh4+5mtiTBJA/MSrkMFZLv58/YfCMuxu

GQ4LEu5brgm87SvcHdFAbfC3TXr9Ucz0wAtUJf255pwOROetU+iv2P6NxwkkX22wBUfEzveDZYi

OuLoxw7htjHiNEgqk2XnztSNA/9oqGqLKvIAVwlqfwDlIjs2WM3/siZc3qeNd0sccElOalWOb1r

aretKyccN+9GYkVqDfD8Ys7lBPwG70esClv2QuxjZalz1p/grhrDivj0E1+wfrmH2QWL2muiKln

4vViSvY5I7CY42q9HMAFgqiI/b/q1RKNmKaP2qBskhOrhO+bmabbTWst/RQtvvOfqHzpSEQTjHp

k3lVsKhTZiv+4G4yuvLRUGzH20mlZxLAvTSXDn1wkyCO7gWJrZ8tqx3HdAxJcw=

X-Received: by 2002:a17:90b:4c52:b0:3a0:c0f0:9a97 with SMTP id 98e67ed59e1d1-3a6ce3b93e4mr9060780a91.9.1791235630294;

Mon, 05 Oct 2026 14:27:10 -0700 (PDT)

Received: from smtpgw.close.com (am11-natgw-a0.close.com. [52.11.177.187])

by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-3a8533abe0asm1339773a91.1.2026.10.05.14.27.08

for

(version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256);

Mon, 05 Oct 2026 14:27:09 -0700 (PDT)

Content-Type: multipart/mixed; boundary="===============8580698333051343651=="

MIME-Version: 1.0

Subject: What could you qualify for?

From: =?utf-8?q?Operations_Department?=

To: sales@nk.ca

Date: Mon, 05 Oct 2026 21:27:08 +0000

Message-ID: <179123562890.7.7731234447453487135@smtpgw.close.com>

X-CLOSEIO-EMAIL-ID: acti_II4vUOJP4aUq3xM4SgyHJSsBVEfrSgBXXdmYMG1HKNL

List-Unsubscribe:

List-Unsubscribe-Post: List-Unsubscribe=One-Click

References: <179123562890.7.17695418849350973772@smtpgw.close.com>



--===============8580698333051343651==

Content-Type: multipart/alternative; boundary="===============8141066556783723586=="

MIME-Version: 1.0



--===============8141066556783723586==

Content-Type: text/plain; charset="utf-8"

MIME-Version: 1.0

Content-Transfer-Encoding: quoted-printable



Hey Gurkirat,



=20



I=E2=80=99m reaching out because we help businesses access working capital =

without the

long process you may be used to.



=20



If you=E2=80=99re curious what could qualify for, send over your applicatio=

n and we

can take a look.



=20



[See what you qualify for](https://form.jotform.com/242605781483259)



=20



No obligation =E2=80=94 just want to see what we can find.



=20



\-- =20

=20

=20

=20

--- =20

| | ![photo](https://ci3.googleusercontent.com/meips/ADKq_NZcwYaCAZ90rjgA_b=

jLpd4UBFKqUrHszw5qpzRZhK0SNMTtvlfq5zGViREQoOUAdVJMjeicSY8kTxvpVSSXmTyQwrq5M=

5IB26TVMQhTMEd-HXVMeR6WJ2TFGheuvLHxDzKlmbEZCoK7opGGGjR_q5TiTVefUnoNDMPitlcf=

bg=3Ds0-d-e1-ft#https://d36urhup7zbd7q.cloudfront.net/u/O6rlxveRayv/28587ed=

2-7c1a-49f7-92d8-ab9cbb1a3725__400x400__.jpeg)| **Noah Blake** =20

=20

| **Operations & Customer Support - **[**Apply

Here!**](https://form.jotform.com/261906027631252) =20

**Swiftbridge Funding** =20

--- =20

| [ +1 236-506-](tel:+1236-702-1731)7475 | [swiftbridge.ca](https://swift=

bridge.ca/) =20

--- =20

|

[![instagram](https://ci3.googleusercontent.com/meips/ADKq_NandMz9xr29JOnOo=

0ZGdt9IUU2uHaL1R39vaFC2NqcN17ttmyRblzHiisIgSKi6PYdfEsJSsbtXM30S6OiMDtOlnHuj=

8c9qwveZHk9y4bM-

WnzUlNF7=3Ds0-d-e1-ft#https://gifo.srv.wisestamp.com/s/inst/E4405F/48/0/bac=

kground.png)](https://instagram.com/swiftbridgefunding)|

[![linkedin](https://ci3.googleusercontent.com/meips/ADKq_NYWx_R1C52H8WTUFY=

iJQy38-AlU07dlE8P81d508aEMaVFWlSBbw-

iTGs8QQjhOzTvhy0I8TsN1QrcyihwN0sH39dCjRCrlp_Yv5H1m45hADcbKig=3Ds0-d-e1-ft#h=

ttps://gifo.srv.wisestamp.com/s/ld/0077b5/48/0/background.png)](https://www=

.linkedin.com/company/swift-

bridge-funding/) =20

---|--- =20

=20

To stop receiving these emails, click

[Unsubscribe](https://app.close.com/go/unsubscribe/orga_rkJepeCLpETmCWxJkfO=

SoXmVctXd0sGdXUBNuPxrS8x/sales%40nk.ca/VXBlw6Fuqe1NXDIkBcNws9nXSz1DrVPka6K2=

SzHPIME=3D/)

--===============8141066556783723586==

Content-Type: text/html; charset="utf-8"

MIME-Version: 1.0

Content-Transfer-Encoding: quoted-printable



Hey Gurkirat,

I=E2=80=99m reaching out becaus=

e we help businesses access working capital without the long process you ma=

y be used to.

If you=E2=80=99re curious what coul=

d qualify for, send over your application and we can take a look.

>

"noopener noreferrer nofollow">See what you qualify for

<=

/div>
No obligation =E2=80=94 just want to see what we can find.
<=

span data-system-generated=3D"signature">

yle=3D"color: rgb(34, 34, 34);">--


le=3D"color: rgb(34, 34, 34);">

25, 28, 43); font-family: Mulish, sans-serif; font-size: 16px; direction: l=

tr; border-collapse: collapse;"><=

/colgroup>

x; height: 12px; line-height: 0px;">

=3D"1">
%" style=3D"width: 485px;">
roup>

llspacing=3D"0" style=3D"border-collapse: collapse; line-height: 1.15;">
lgroup>
lgroup>
>

top; padding: 0.01px 14px 0.01px 1px; width: 65px; text-align: center;">


style=3D"margin: 1px;">
ADKq_NZcwYaCAZ90rjgA_bjLpd4UBFKqUrHszw5qpzRZhK0SNMTtvlfq5zGViREQoOUAdVJMjei=

cSY8kTxvpVSSXmTyQwrq5M5IB26TVMQhTMEd-HXVMeR6WJ2TFGheuvLHxDzKlmbEZCoK7opGGGj=

R_q5TiTVefUnoNDMPitlcfbg=3Ds0-d-e1-ft#https://d36urhup7zbd7q.cloudfront.net=

/u/O6rlxveRayv/28587ed2-7c1a-49f7-92d8-ab9cbb1a3725__400x400__.jpeg" alt=3D=

"photo" style=3D"width: 65px; height: 65px; vertical-align: middle; border-=

radius: 0px; border: 0px; display: block;">


an=3D"1" valign=3D"top" style=3D"padding: 0.01px 0.01px 0.01px 14px; vertic=

al-align: top; border-left: 1px solid rgb(189, 189, 189);">
Noa=

h Blake


yle=3D"border-collapse: collapse;">
">

.01px;">

Operations=

& Customer Support -
06027631252" target=3D"_blank" rel=3D"noopener noreferrer nofollow">
>Apply Here!

t-size: 13px; font-weight: bold; color: rgb(100, 100, 100);">Swiftbridge Fu=

nding


ht=3D"0" style=3D"height: 0px;">
style=3D"border-collapse: collapse;">
x;">
e>

ght=3D"0" style=3D"height: 0px; padding-top: 14px; width: 388px; font-famil=

y: Arial;">


>
r nofollow" style=3D"color: rgb(30, 144, 250); text-decoration: unset;">
an style=3D"line-height: 13.2px; color: rgb(33, 33, 33);">+1 236-506-
>7475  |  
_blank" rel=3D"noopener noreferrer nofollow" style=3D"color: rgb(30, 144, 2=

50); text-decoration: unset;">
b(33, 33, 33);">swiftbridge.ca 


t: 0px; padding: 14px 0.01px 0.01px;">
=3D"0" border=3D"0" style=3D"min-width: 50px;">
width: 25px;">
tbody>

span=3D"1" rowspan=3D"1" align=3D"left" style=3D"padding-right: 6px; text-a=

lign: center; padding-top: 0px;">


://instagram.com/swiftbridgefunding" target=3D"_blank" rel=3D"noopener nore=

ferrer nofollow" style=3D"color: rgb(30, 144, 250);">
3.googleusercontent.com/meips/ADKq_NandMz9xr29JOnOo0ZGdt9IUU2uHaL1R39vaFC2N=

qcN17ttmyRblzHiisIgSKi6PYdfEsJSsbtXM30S6OiMDtOlnHuj8c9qwveZHk9y4bM-WnzUlNF7=

=3Ds0-d-e1-ft#https://gifo.srv.wisestamp.com/s/inst/E4405F/48/0/background.=

png" alt=3D"instagram" style=3D"width: 24px; height: 24px; float: left; bor=

der: none;">


le=3D"padding-right: 6px; text-align: center; padding-top: 0px;">


=3D"margin: 1px;">
funding/" target=3D"_blank" rel=3D"noopener noreferrer nofollow" style=3D"c=

olor: rgb(30, 144, 250);">
ps/ADKq_NYWx_R1C52H8WTUFYiJQy38-AlU07dlE8P81d508aEMaVFWlSBbw-iTGs8QQjhOzTvh=

y0I8TsN1QrcyihwN0sH39dCjRCrlp_Yv5H1m45hADcbKig=3Ds0-d-e1-ft#https://gifo.sr=

v.wisestamp.com/s/ld/0077b5/48/0/background.png" alt=3D"linkedin" style=3D"=

width: 24px; height: 24px; float: left; border: none;">


ata-system-generated=3D"unsubscribe-footer">


>
G1HKNL/1TRpq4kUQd.png" alt=3D"" width=3D"1" height=3D"1" />

--===============8141066556783723586==--



--===============8580698333051343651==--

Chinese products spam

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Mon, 05 Oct 2026 23:04:13 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.100.1 (FreeBSD))

(envelope-from )

id 1xDxLQ-00000000AE3-3OEp

for dave@doctor.nl2k.ab.ca;

Mon, 05 Oct 2026 23:04:04 -0600

Resent-From: The Doctor

Resent-Date: Mon, 5 Oct 2026 23:04:04 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-m81128.netease.com ([47.88.81.128]:50088)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.100.1 (FreeBSD))

(envelope-from )

id 1xDpTf-00000000OrT-1IkY

for sales@nk.ca;

Mon, 05 Oct 2026 14:39:41 -0600

Content-Type: multipart/alternative; BOUNDARY="=_Part_1009979_292327557.1791232708251"

To: sales

Reply-To: longxiangleather@slphgloves.com

Subject: =?UTF-8?B?UmU6IExlYXRoZXIgJiBSZWN5Y2xlZCBGYWJyaWMgR2xvdmVzIGZvciBZb3VyIEJyYW5k?=

X-Priority: 3

MIME-Version: 1.0

Received: from vivian@vexaimportspark.com( [10.139.5.212] ) by ajax-webmail ( [127.0.0.1] ) ; Tue, 6 Oct 2026 04:38:28 +0800 (GMT+08:00)

From: SLPH Gloves

Date: Tue, 6 Oct 2026 04:38:28 +0800 (GMT+08:00)

X-WM-Tid: 0aa10dca0e6e00f8kunm2056b8b7150c49

DKIM-Signature: a=rsa-sha256;

b=EpLOczxflDEgkQAYeNMBH/YjJO+5sJRKhprqnMJhajQkNSwjCR1RooIOEcJmSI4K0yXAON084huHdzQUUDXiQNRN0MKOhFCg7mLg8Wbkj6Ba8dIircGq4bFnkDexBAxI60Pm4h/tKrqYNKlZakSppg7hEgJ9HjscWtrSnO09fBY=; c=relaxed/relaxed; s=default; d=vexaimportspark.com; v=1;

bh=NrwYiMW8E9HhWiKf2SpZMD3QMIjMs09tKaL9hwKDnZM=;

h=date:mime-version:subject:message-id:from;

Message-ID:







Hi ,



Just following up on my previous email to see if you're planning any new glove styles for your collection.



We'd be happy to suggest suitable styles and materials based on your target price range, or develop samples from your designs.



Would you like me to send you a few styles to review?

















Serena.G

longxiangleather@slphgloves.com





On Thu, Sep 24, 2026, SLPH Gloves wrote:



-----Original Message-----

From: SLPH Gloves

Sent Time: Thu, Sep 24, 2026

To: [sales ]

Subject: Leather & Recycled Fabric Gloves for Your Brand





Hi ,



Are you looking to add leather or recycled fabric gloves to your collection?



We manufacture fashion gloves and offer OEM production under your own brand.



We can develop samples based on your designs or reference photos, with material options to suit your requirements and budget.



Would you like us to send over our catalogue?









Serena.Geng

longxiangleather@slphgloves.com







NetKnow now in Netcraft's top 380700

Posted by Dave Yadallee on
All data is from Netcraft Toolbar .

Looks as if there are major changes to the Netcraft algorithm after some years! Why did Avast clasify the extension as URL:Phishing?

This is not the Alexa Tool Bar!



NetKnow







Netknow now at 380699 from 411534 at Netcraft and pfs compliant



A significant increase! We must do
  1. security audits regularly
  2. check on illegitimate traffic hitting the web server


  3. Effiency of server
    4. and
  4. keep design current!




How do we compare with other providers in

Edmonton, Alberta, Canada?



Rogers





Rogers Business Solutions

which rank 7894 from 7915 and are hosted in Europe.

Telus and reviews





Next we have Telus.com

ranked by Netcraft at 7931 from 7319 .

Sometimes their Web Hosting is done by
title="Internet Names for Business">Internet Names for Business

is ranked by Netcraft at >2000000 from >2000000 .



Is Telus's ADSL network susceptible to Code Red Attacks and Attackers?

Reviews of Telus are available :





Government of Alberta



The Government of Alberta Website

ranks 13236 from 13162 by Netcraft and seems to hosted on Cloudfare.



City of Edmonton







The City of Edmonton ranks 37646 from 37543 by Netcraft and hosted by Google.



University of Alberta







The University of Alberta ranks 48720 from 49638 hosted by Amazon Techonologies.



Juno and NetZero





We have Juno Internet ranked on top

at 342987 from 354161 who are the owners of

US Based Netzero at Netcraft Rank 140715 from 130093 .





TekSavvy



TekSavvy ranks 167201 from 161297 and are hosted by Microsoft



NAIT / Northern Alberta Institute of Technology





NAIT ranks 245495 from 250522 hosted by Microsoft .



Grant MacEwen University





MacEwan ranks 343065 from 304843 .



Internet Centre / CCINet



Internet Centre

rank 312425 from 321307. Their partner Rack Nine ranks > 2000000.



Netknow again





We at Netknow are at 380699 from 18857 since the start of 2026.



Shaw Cable





Next,

members.shaw.ca

ranks >2000000 from >2000000 and retired and

Shaw Cable

is next at Netcraft rank >20000000 from >20000000 . Hosted now by Akamei .

Their Network Hosting Arm,

Big Pipe is at

Netcraft rank 383800 from 383980 and hosted by Akamai in Europe .



Reviews of Shaw are available :





Xplornet



xplornet

ranks >2000000 from >2000000 and are listed with

Cirrus9 and are joining up with Shaw.

Their new domain xplore.ca ranks 639103 from 639405 .

According to an article in the Sherwood Park Independent, they are also getting an Alberta Government subsidy.



Distributel / 3Web / CIA



Cybersurf

is ranked 934723 from 832576 and seems to be hosted in USA by DigitalOcean.



Primus



Primus

ranks >2000000 from >2000000 and now points to BLACKIRON_DataCentres ranked >2000000 from >2000000.



Northern lights Fiber







Northern lights Fiber are ranked by Netcraft >2000000 and uses AWS.



OkayVPN





OkayVPN

are ranked by Netcraft >2000000 and uses Cloudfare.



Radiant Communications / goco.ca





Radiant Communications

are ranked by Netcraft >2000000 and part of goco.ca

which ranks >2000000 .



Tera Byte Edmonton and reviews





Next is Tera-Byte

at Netcraft Rank >2000000 with

Tera-Byte.ca

ranking >2000000 from >2000000 and their wireless arm Tera-Byte Wireless

sold to Xplornet.

One of Tera-Byte's acquisitions

Edmonton Community Networks

ranks at >2000000 from >2000000 and

Go Edmonton ranks >2000000 from >2000000.

Alberta political blogger Daveberta ranks >2000000 from >2000000; interesting!!!

Reviews of Tera-byte is available at

here

and another here

and check Google for more reviews; just search tera byte.



MCSnet





MCSNET ranks >2000000 from >2000000 and are hosted by Microsoft .



Nucleus Internet Services





After that we have

Nucleus Information Services which can be found at Netcraft Rank >2000000 from >2000000 .





4Web





4web ranks >2000000 from >2000000 .



Alentus / Wolfpaw





Alentus

rank by Netcraft >2000000 from >2000000 and I note they are hosted in the USA .

wolfpaw.net

which ranks at >2000000 from >2000000



Yellowpencil





Yellowpencil Ranks >2000000 from >2000000



WSI Corporation





Next is WSI - We Simply The Internet of Toronto

at Netcraft Position >2000000 from >2000000 and are being hosted on Amazon.



Uniserve / Interbaun





Next, Uniserve

ranks on Netcraft >2000000 from >2000000

One of their acquisitions

interbaun

ranks with Netcraft ?????? from ?????? due to merging of sites.

One customer just came over from this organization in Nov 2006.



Clearwave Broadband





Clearwave Broadband ranks

at >2000000 from >2000000



Platinum Communications





Platinum Communications Corp.

bought out by Xplornet .



Wild Rose Internet





Wild Rose Internet

ranks >2000000 from >2000000 and I wonder if this is another wireless branch of Tera-Byte and bought out by Xplornet





TIC Internet





TIC Internet

ranks >2000000 from >2000000 ( I do remember you).



Nisa Custom Internet Solutions





Nisa Custom Internet Solutions

ranks >2000000 from >2000000 by Netcraft



MediaShaker





Media Shakers of Edmonton

ranks >2000000 from >2000000





Koi Media





Koi Media

rank >2000000 from >2000000



WebFire





Webfire.ca

ranks >2000000 from >2000000 and seems to be connected with Shaw.



Core Network Solutions Inc.





Core Network Solutions Inc.

ranks at >2000000 from >2000000 .



The Network Centre





The Network Centre

ranks >2000000 from >2000000 and are linked with Telus high Speed.





Open Concept Internet, Inc.





Open Concept Internet, Inc.

rank > 2000000 from > 2000000





Techalta





Interspots of Edmonton

acquired by Techalta ;



Yegtel





Yegtel rank > 2000000 .



Internet Crossroads





Internet Crossroads Ltd of North Edmonton

rank nothing from nothing by Netcraft and seems to merged with Tera-Byte/ecn.ab.ca .



If I remember anymore, I will add to this entry, before Netcraft changes our ranking. Please watch this space and please feel free to peruse

our services.

WEb/SEO/App spam from Google Gmail

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Mon, 05 Oct 2026 13:20:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.100.1 (FreeBSD))

(envelope-from )

id 1xDoDX-000000008Bw-11H5

for dave@doctor.nl2k.ab.ca;

Mon, 05 Oct 2026 13:19:19 -0600

Resent-From: The Doctor

Resent-Date: Mon, 5 Oct 2026 13:19:19 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-pz2-f36.google.com ([74.125.228.36]:37371)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.100.1 (FreeBSD))

(envelope-from )

id 1xDmKj-00000000JM5-0xxq

for sales@nk.ca;

Mon, 05 Oct 2026 11:18:13 -0600

Received: by mail-pz2-f36.google.com with SMTP id d2e1a72fcca58-88a0f29ce98so1001320b3a.3

for ; Mon, 05 Oct 2026 10:17:16 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=webappsconsultants.com; s=google; t=1791220631; x=1791825431; darn=nk.ca;

h=content-type:mime-version:date:content-transfer-encoding:message-id

:subject:to:from:from:to:cc:subject:date:message-id:reply-to

:content-type;

bh=aLYse9AgT8RYZ+SXVteVsLuhHZodrG98PiRvEqXJjDo=;

b=GInSRXAvblV5EWDTUhpLDVkd1qg5hoX4waHxKqqYiic32CuMhldsLKjaTxTcuFYt7v

AxXqgI9TkUK6/gc9L73aCKiS5kluVUi3pvO525Ft/x6jK34gakUA8kSus183sQTV1Bac

QJWPTGFdU+CheMou9JMD8dXKnJplWMtxGfD2ASTFYVy6A+LvPDPOFIDGKdmk+lZucLUt

bv1PWBCcglPMoEWZNlk+WWVtviRbUmJEyS9WEayKKqqqJwVpJetCNtYTARpUzVJMoOD8

N/zlH7FAvCz0034+J/y8/UTwXWOmEgwTnfN06vhUOhcP1ay1GnQv67l+iRH0tt3n2wvQ

zi7Q==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20260707; t=1791220631; x=1791825431;

h=content-type:mime-version:date:content-transfer-encoding:message-id

:subject:to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date

:message-id:reply-to:content-type;

bh=aLYse9AgT8RYZ+SXVteVsLuhHZodrG98PiRvEqXJjDo=;

b=zjWNfwGysB84L2Qfkg4hqnBY7a/aE7CimKA60SBgHE1PjekdcWiUTQAJ5uDCg9bTCt

OyLpLejzfO8mIhtjp0oMyiNKt5yuJaUBs5HkqEcQvXm5WzGwyVeYxuRIQPK0TGufLmNC

y/v3CXAzm5lo9Eo28AEfRJeI4C6tyOUucaIo+elH5i4aSzQgdQ5sapG2hYblngTnXTqv

NsncI6g+/vTIv8ET2poVIIbX87uF3CqBUxCmqT0/kfuLSrG6lkQJoFiWpMWyWHRaB20t

SodDVNc9qQeHuZnIs94WcnZA4JifltIKQ44O26/KaMXHZytQf3ZRe19Z1fF7e3eCbdK3

ow5g==

X-Gm-Message-State: AFuF++nxuNM1GTkTkzscp5x4THJTw0fTfy8gpSArFGFpOi58VYStpTkB

xxgsQz7xxy1BefoOllkqVqNmf1+GjKaoyxAU5HATLPj7t/BKAWiso00fRFhfwTcI4qoQQ1hMmuj

Sfvp926U=

X-Gm-Gg: AYBFou1jWtxd+Lj4ru9BI75h8JRG4efNuGSyvTz1rhpgwN+cojDaX/nQA2mydVGslBM

qj6Ia07gZCIDQecn9X5soN8aEBTqJw6znu5JOrH3dEC4VQf3LSW8tmbRU78D6H9Hd7XrFpVnjxC

6iP4/TVhZS3Y9pdVzWZw92dhpjUHrx7cwvUnLjAmg5sGAoL+Lvvj3512pA3NrlHBSHqJcNsZTZX

hgYShmzKNLW8jOemB3z8E9n03fBTqVJJ0iDCnQfHSHvChn0WeYB8B1QWKXILr/rXhXTJm/DAfxt

ImxWfTU3HQC0OQcCGyDjyvm04IwL2FC6Nax83QmLQL1Jw1UScQsTXLIrzCb2s/QT8zwmU/018LY

aC6E7QMyn+GfI89S9AYGPcbR+5LwddbGJdPcoIQK05CWY2j3edDDrOdpFLRiia3jBh9VkhBpb22

I7lCQUGlHPVBW6QpSVFTzVKwP3wE5pUWncXjDB4lUGXutA6m9C1DEf10XFDs1Zpip07gUQa5UMD

zP/hVdn1w02FUThmkBt

X-Received: by 2002:a05:6a20:3d10:b0:3dd:a196:30a4 with SMTP id adf61e73a8af0-3e0bd4bbb09mr11707756637.84.1791220630708;

Mon, 05 Oct 2026 10:17:10 -0700 (PDT)

Received: from [127.0.0.1] ([103.106.232.102])

by smtp.gmail.com with ESMTPSA id d2e1a72fcca58-88b0d344d96sm3813308b3a.59.2026.10.05.10.17.09

for

(version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128);

Mon, 05 Oct 2026 10:17:09 -0700 (PDT)

From: Paul

To: sales@nk.ca

Subject: Get Better SEO Results www.nk.ca ?

Message-ID: <9e2bbd4a-819d-8e41-6da4-168d783fb034@webappsconsultants.com>

Content-Transfer-Encoding: quoted-printable

Date: Mon, 05 Oct 2026 17:17:08 +0000

MIME-Version: 1.0

Content-Type: text/html; charset=utf-8

X-Spam_score: 16.1

X-Spam_score_int: 161

X-Spam_bar: ++++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Hi, Would you like to see an SEO report for www.nk.ca? It

will show specific improvements that can help increase your search rankings.





Content analysis details: (16.1 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[103.106.232.102 listed in will-spam-for-food.eu.org]

[103.106.232.102 listed in will-spam-for-food.eu.org]

[103.106.232.102 listed in will-spam-for-food.eu.org]

[103.106.232.102 listed in will-spam-for-food.eu.org]

[103.106.232.102 listed in will-spam-for-food.eu.org]

[103.106.232.102 listed in will-spam-for-food.eu.org]

[103.106.232.102 listed in will-spam-for-food.eu.org]

[103.106.232.102 listed in will-spam-for-food.eu.org]

[74.125.228.36 listed in will-spam-for-food.eu.org]

[74.125.228.36 listed in will-spam-for-food.eu.org]

[74.125.228.36 listed in will-spam-for-food.eu.org]

[74.125.228.36 listed in will-spam-for-food.eu.org]

[74.125.228.36 listed in will-spam-for-food.eu.org]

[74.125.228.36 listed in will-spam-for-food.eu.org]

[74.125.228.36 listed in will-spam-for-food.eu.org]

[74.125.228.36 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[103.106.232.102 listed in dnsbl.ahbl.org]

[103.106.232.102 listed in dnsbl.ahbl.org]

[103.106.232.102 listed in dnsbl.ahbl.org]

[103.106.232.102 listed in dnsbl.ahbl.org]

[74.125.228.36 listed in dnsbl.ahbl.org]

[74.125.228.36 listed in dnsbl.ahbl.org]

[74.125.228.36 listed in dnsbl.ahbl.org]

[74.125.228.36 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[103.106.232.102 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[103.106.232.102 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[103.106.232.102 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[103.106.232.102 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_CBL RBL: Received via a relay in cbl.abuseat.org

[Listed by XBL, see ]

1.5 RCVD_IN_SBL_XBL RBL: Received via a relay in Spamhaus SBL+XBL

[103.106.232.102 listed in sbl-xbl.spamhaus.org]

1.7 URIBL_BLACK Contains an URL listed in the URIBL blacklist

[URI: webappsconsultants.com]

2.5 URIBL_DBL_SPAM Contains a spam URL listed in the DBL blocklist

[URI: webappsconsultants.com]

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

1.9 URIBL_ABUSE_SURBL Contains an URL listed in the ABUSE SURBL blocklist

[URI: webappsconsultants.com]

1.9 URIBL_JP_SURBL Contains an URL listed in the JP SURBL blocklist

[URI: webappsconsultants.com]

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

0.6 HTML_MIME_NO_HTML_TAG HTML-only message, but there is no HTML tag

2.0 RATWR8_MESSID Message-ID with excessive dashes and dollars

0.0 NO_RDNS2 Sending MTA has no reverse DNS

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[74.125.228.36 listed in bl.score.senderscore.com]

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[74.125.228.36 listed in wl.mailspike.net]

Subject: {SPAM?} Get Better SEO Results www.nk.ca ?



Hi,

Would you like to see an SEO report for www.nk.ca? It will =

show specific improvements that can help increase your search rankings.=

May I send you our quote and previous SEO work?

Kind Regards,=

Paul



Evri phish from Japan

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Mon, 05 Oct 2026 10:18:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.100.1 (FreeBSD))

(envelope-from )

id 1xDlNp-00000000AlB-2XpC

for dave@doctor.nl2k.ab.ca;

Mon, 05 Oct 2026 10:17:45 -0600

Resent-From: The Doctor

Resent-Date: Mon, 5 Oct 2026 10:17:45 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from [158.199.129.240] (port=19174 helo=m113.secure.ne.jp)

by doctor.nl2k.ab.ca with smtp (Exim 4.100.1 (FreeBSD))

(envelope-from )

id 1xDioD-000000004o7-37BP

for DOCTOR@NL2K.AB.CA;

Mon, 05 Oct 2026 07:32:26 -0600

Received: (qmail 73466 invoked from network); 5 Oct 2026 22:31:22 +0900

Received: from unknown (HELO ?195.210.113.33?) (h?upbaker@soullogis.co.jp@195.210.113.6)

by 0 with SMTP; 5 Oct 2026 22:31:22 +0900

From: "EVRl"

To: DOCTOR@NL2K.AB.CA

Subject: Important update regarding your parcel delivery H09Z878R1995

Date: 5 Oct 2026 14:31:21 +0100

MIME-Version: 1.0

Message-ID: <20261219222158.16@soullogis.co.jp>

User-Agent: Roundcube Webmail/1.4.12

X-Sender: "EVRI"

X-Originating-IP: 69.227.47.25

X-Priority: 3 (Normal)

X-Mailer: Roundcube Webmail/1.6.0

List-Unsubscribe:

Content-Type: text/html;

charset="utf-8"

Content-Transfer-Encoding: quoted-printable

X-Spam_score: 5.7

X-Spam_score_int: 57

X-Spam_bar: +++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Evri Update Maintenance and Reliability Update. This message

confirms that parcel staging has completed the required administrative checkpoint.

No manual intervention is needed for domestic routing. Tracking Ref [...]





Content analysis details: (5.7 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[69.227.47.25 listed in will-spam-for-food.eu.org]

[69.227.47.25 listed in will-spam-for-food.eu.org]

[69.227.47.25 listed in will-spam-for-food.eu.org]

[69.227.47.25 listed in will-spam-for-food.eu.org]

[69.227.47.25 listed in will-spam-for-food.eu.org]

[69.227.47.25 listed in will-spam-for-food.eu.org]

[69.227.47.25 listed in will-spam-for-food.eu.org]

[69.227.47.25 listed in will-spam-for-food.eu.org]

[195.210.113.6 listed in will-spam-for-food.eu.org]

[195.210.113.6 listed in will-spam-for-food.eu.org]

[195.210.113.6 listed in will-spam-for-food.eu.org]

[195.210.113.6 listed in will-spam-for-food.eu.org]

[195.210.113.6 listed in will-spam-for-food.eu.org]

[195.210.113.6 listed in will-spam-for-food.eu.org]

[195.210.113.6 listed in will-spam-for-food.eu.org]

[195.210.113.6 listed in will-spam-for-food.eu.org]

[158.199.129.240 listed in will-spam-for-food.eu.org]

[158.199.129.240 listed in will-spam-for-food.eu.org]

[158.199.129.240 listed in will-spam-for-food.eu.org]

[158.199.129.240 listed in will-spam-for-food.eu.org]

[158.199.129.240 listed in will-spam-for-food.eu.org]

[158.199.129.240 listed in will-spam-for-food.eu.org]

[158.199.129.240 listed in will-spam-for-food.eu.org]

[158.199.129.240 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[158.199.129.240 listed in dnsbl.ahbl.org]

[158.199.129.240 listed in dnsbl.ahbl.org]

[158.199.129.240 listed in dnsbl.ahbl.org]

[158.199.129.240 listed in dnsbl.ahbl.org]

[69.227.47.25 listed in dnsbl.ahbl.org]

[69.227.47.25 listed in dnsbl.ahbl.org]

[69.227.47.25 listed in dnsbl.ahbl.org]

[69.227.47.25 listed in dnsbl.ahbl.org]

[195.210.113.6 listed in dnsbl.ahbl.org]

[195.210.113.6 listed in dnsbl.ahbl.org]

[195.210.113.6 listed in dnsbl.ahbl.org]

[195.210.113.6 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[158.199.129.240 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[158.199.129.240 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[158.199.129.240 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[158.199.129.240 listed in dnsbl.ahbl.org]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[158.199.129.240 listed in list.dnswl.org]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[158.199.129.240 listed in bl.score.senderscore.com]

-0.0 SPF_PASS SPF: sender matches SPF record

-0.0 SPF_HELO_PASS SPF: HELO matches SPF record

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 HTML_MESSAGE BODY: HTML included in message

1.3 RDNS_NONE Delivered to internal network by a host with no rDNS

2.0 HTML_FONT_TINY_NORDNS Font too small to read, no rDNS

Subject: {SPAM?} Important update regarding your parcel delivery H09Z878R1995






emas-microsoft-com:vml" xmlns:o=3D"urn:schemas-microsoft-com:office:office"=

>




">


=3D1">



Evri Update










margin: 0; padding: 0; background-color: #F4F6F8; font-family: Arial, sans-=

serif;">=20






max-height:0px;max-width:0px;opacity:0;overflow:hidden;mso-hide:all;">

Maintenance and Reliability Update. This message confirms that parc=

el staging has completed the required administrative checkpoint. No manual =

intervention is needed for domestic routing. Tracking Reference: rm4731. St=

atus: Staged.








t: 100%; mso-table-lspace: 0pt; mso-table-rspace: 0pt; margin: 0 auto; max-=

width: 600px; background-color: #ffffff; border-radius: 8px; box-shadow: 0 =

4px 15px rgba(0,0,0,0.05); overflow: hidden;" align=3D"center" width=3D"100=

%" max-width=3D"600" border=3D"0" cellpadding=3D"0" cellspacing=3D"0">

=20=20=20=20=20=20=20=20=20=20=20=20






























adjust: 100%; mso-table-lspace: 0pt; mso-table-rspace: 0pt; padding: 30px 2=

0px;" align=3D"center" bgcolor=3D"#007BC4">


t-size-adjust: 100%; mso-table-lspace: 0pt; mso-table-rspace: 0pt" width=3D=

"100%" border=3D"0" cellpadding=3D"0" cellspacing=3D"0">
















s-text-size-adjust: 100%; mso-table-lspace: 0pt; mso-table-rspace: 0pt" ali=

gn=3D"left" width=3D"50%">


ic; border: 0; outline: none; text-decoration: none; display: block;" src=

=3D"https://www.evri.com/_assets/images/evri/emails/5e0bc296-95db-4b54-9952=

-2c1cb73f4966_Evri%2Blogo.png" alt=3D"Evri" width=3D"85" height=3D"25">
s-text-size-adjust: 100%; mso-table-lspace: 0pt; mso-table-rspace: 0pt" ali=

gn=3D"right" width=3D"50%">


ic; border: 0; outline: none; text-decoration: none; display: block; border=

-radius: 50%; border: 2px solid #fff;" src=3D"https://www.evri.com/_assets/=

images/emails/avatars.png" alt=3D"Avatar" width=3D"60" height=3D"60">

s-text-size-adjust: 100%; mso-table-lspace: 0pt; mso-table-rspace: 0pt; pad=

ding-top: 25px;" colspan=3D"2" align=3D"left">


x; font-weight: bold; margin: 0; line-height: 1.3;">

Urgent: Re-delivery Needed



adjust: 100%; mso-table-lspace: 0pt; mso-table-rspace: 0pt; padding: 40px 3=

0px;" align=3D"center">


t: 1.6; margin: 0 0 20px 0; text-align: left;">

Hello there User,




t: 1.6; margin: 0 0 25px 0; text-align: left;">

Your delivery could not be completed today as there=

was no safe place to leave the item.



=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20




t-size-adjust: 100%; mso-table-lspace: 0pt; mso-table-rspace: 0pt; backgrou=

nd-color: #F8F9FA; border: 1px solid #DFE1E6; border-radius: 6px; margin-bo=

ttom: 30px;" width=3D"100%" border=3D"0" cellpadding=3D"0" cellspacing=3D"0=

">














s-text-size-adjust: 100%; mso-table-lspace: 0pt; mso-table-rspace: 0pt; pad=

ding: 15px 20px; border-bottom: 1px solid #DFE1E6;" align=3D"left">


14px;">Tracking Number:



5px; font-weight: bold;">



H09Z66R8227h

s-text-size-adjust: 100%; mso-table-lspace: 0pt; mso-table-rspace: 0pt; pad=

ding: 15px 20px;" align=3D"left">


14px;">Redelivery Fee:



6px; font-weight: bold;">



£ 2.25





t: 1.6; margin: 0 0 30px 0; text-align: center;">

Please secure the redelivery fee to ensure your pac=

kage is not shipped back to the origin.














t: 1.5; margin: 0; text-align: center;">

Note: Yo=

ur parcel will be held at our local depot for 24 to 48 hours
g> before being automatically returned to the sender.

adjust: 100%; mso-table-lspace: 0pt; mso-table-rspace: 0pt; padding: 25px 3=

0px;" align=3D"center" bgcolor=3D"#007BC4">


t: 1.6; margin: 0; text-align: center; opacity: 0.9;">

Evri is a trading name of Hermes Parcelnet Limited.=




Registered in England and Wales No. 03900782


Registered office: Capitol House, 1 Capitol Close, =

Morley, Leeds, LS27 0WH










Saxo bank phish from Microsoft

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Mon, 05 Oct 2026 10:18:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.100.1 (FreeBSD))

(envelope-from )

id 1xDlNj-00000000Aka-01l7

for dave@doctor.nl2k.ab.ca;

Mon, 05 Oct 2026 10:17:39 -0600

Resent-From: The Doctor

Resent-Date: Mon, 5 Oct 2026 10:17:38 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from luvz.gxxbsi.com ([4.225.222.13]:50323)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.100.1 (FreeBSD))

(envelope-from )

id 1xDiml-000000004ei-0BzF

for root@nk.ca;

Mon, 05 Oct 2026 07:30:54 -0600

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; s=default; d=luvz.gxxbsi.com;

h=Content-Type:MIME-Version:From:To:Subject:Date:Message-ID:Reply-To;

i=tbgfdtcx@luvz.gxxbsi.com;

bh=O3a7NiQDsV6ViZbarKaoMdrluysEHlp3L3BFA8ijyXE=;

b=WyjhBwTgocoTSka4OIodRXPf+8ASdkIdi6IL834NznAJMPHIUS1CX/oiRxfyUBI5xaKwfc6oNAyh

I51v+lcQGX0lTOTLA5G6G2ccRhfLIaou0XYDLnYgJ/K5NjgmGZPEfOH/6/B1CBRFHO4FHFIEx1PZ

ynxMdF11BTvQwQTAkjveCq1LO7b+5VD0ymDpXnoWlSoir5u/sNosXzTwZWTItUuZ3NFBFh4GSjwb

zZfTVmj/MnpzEgh3kt2bhSEq2me8axEvC714T2fXBejnFLa9gt+4lBY+NF7k4NBxzEnlm3M8zHai

gFdouTaP0o1gHfolAziqcLyQvlNhxj5SWKOwpw==

Content-Type: multipart/alternative;

boundary="===============8255052029500806211=="

MIME-Version: 1.0

From: Saxo

To: root@nk.ca

Subject: Account Protection Review - Please Confirm Your Saxo Security Details

Date: Mon, 05 Oct 2026 09:29:57 -0400

Message-ID: <179120699733.4223.10335405951413035074@luvz.gxxbsi.com>

Reply-To: clientservices@saxobank.com

Feedback-ID: campaign:clientservices@saxobank.com:mailer

X-Auto-Response-Suppress: OOF, DR, RN, NRN

X-Spam_score: 39.5

X-Spam_score_int: 395

X-Spam_bar: +++++++++++++++++++++++++++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: SAXO - ACCOUNT PROTECTION REVIEW ================================

One item needs your confirmation. Dear root,



Content analysis details: (39.5 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[4.225.222.13 listed in will-spam-for-food.eu.org]

[4.225.222.13 listed in will-spam-for-food.eu.org]

[4.225.222.13 listed in will-spam-for-food.eu.org]

[4.225.222.13 listed in will-spam-for-food.eu.org]

[4.225.222.13 listed in will-spam-for-food.eu.org]

[4.225.222.13 listed in will-spam-for-food.eu.org]

[4.225.222.13 listed in will-spam-for-food.eu.org]

[4.225.222.13 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[4.225.222.13 listed in dnsbl.ahbl.org]

[4.225.222.13 listed in dnsbl.ahbl.org]

[4.225.222.13 listed in dnsbl.ahbl.org]

[4.225.222.13 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[4.225.222.13 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[4.225.222.13 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[4.225.222.13 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[4.225.222.13 listed in dnsbl.ahbl.org]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-0.0 SPF_PASS SPF: sender matches SPF record

-0.0 SPF_HELO_PASS SPF: HELO matches SPF record

1.0 HK_RANDOM_FROM From username looks random

3.5 VOWEL_FROM_7 Impronouncable from header (7+ consecutive vowels)

0.5 FROM_LOCAL_NOVOWEL From: localpart has series of non-vowel letters

0.6 HK_RANDOM_ENVFROM Envelope sender username looks random

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-0.0 T_RP_MATCHES_RCVD Envelope sender domain matches handover relay

domain

2.3 MANGLED_YOUR BODY: mangled your

2.3 MANGLED_BELOW BODY: mangled below

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[4.225.222.13 listed in bl.score.senderscore.com]

1.5 MR_STRANGE_QUESTION URI: No description available.

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 HTML_MESSAGE BODY: HTML included in message

1.0 J_WEEDS_G FULL: Dec/Hex char Enc [Gg]

1.0 J_WEEDS_O FULL: Dec/Hex char Enc [Oo]

1.0 J_WEEDS_P FULL: Dec/Hex char Enc [Pp]

1.0 J_WEEDS_E FULL: Dec/Hex char Enc [Ee]

1.0 J_WEEDS_D FULL: Dec/Hex char Enc [Dd]

1.0 J_WEEDS_M FULL: Dec/Hex char Enc [Mm]

1.0 J_WEEDS_Q FULL: Dec/Hex char Enc [Qq]

1.0 J_WEEDS_I FULL: Dec/Hex char Enc [Ii]

1.0 J_WEEDS_X FULL: Dec/Hex char Enc [Xx]

1.0 J_WEEDS_U FULL: Dec/Hex char Enc [Uu]

1.0 J_WEEDS_H FULL: Dec/Hex char Enc [Hh]

1.0 J_WEEDS_C FULL: Dec/Hex char Enc [Cc]

1.0 J_WEEDS_W FULL: Dec/Hex char Enc [Ww]

1.0 J_WEEDS_V FULL: Dec/Hex char Enc [Vv]

1.0 J_WEEDS_N FULL: Dec/Hex char Enc [Nn]

1.0 J_WEEDS_Y FULL: Dec/Hex char Enc [Yy]

1.0 J_WEEDS_T FULL: Dec/Hex char Enc [Tt]

1.0 J_WEEDS_R FULL: Dec/Hex char Enc [Rr]

1.0 J_WEEDS_L FULL: Dec/Hex char Enc [Ll]

1.0 J_WEEDS_J FULL: Dec/Hex char Enc [Jj]

1.0 J_WEEDS_F FULL: Dec/Hex char Enc [Ff]

1.0 J_WEEDS_A FULL: Dec/Hex char Enc [Aa]

1.0 J_WEEDS_S FULL: Dec/Hex char Enc [Ss]

1.0 J_WEEDS_B FULL: Dec/Hex char Enc [Bb]

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

0.5 ISO_7BITS ISO charset announced as 7 bit (or bad rule ?)

2.0 VOWEL_URI_6 URI hostname with 6 consecutive vowels

Subject: {SPAM?} Account Protection Review - Please Confirm Your Saxo Security Details



--===============8255052029500806211==

Content-Type: text/plain; charset=iso-8859-1

MIME-Version: 1.0

Content-Transfer-Encoding: quoted-printable



SAXO - ACCOUNT PROTECTION REVIEW

=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=

=3D=3D=3D=3D=3D=3D=3D



One item needs your confirmation.



Dear root,



As part of the account protection review we are carrying out for clients in

Canada, we compared the security settings registered on your profile with t=

he

requirements now in force. The result is summarised below.



SECURITY ITEM STATUS

------------------------------------------------------------------

Two-step sign-in verification Action required

Contact details on file Up to date

Platform access settings Confirmation pending

Account standing Active

------------------------------------------------------------------



To close the review, sign in and confirm the pending item. Your access stays

as it is while the item is open, but we ask you to complete it today.



Review and confirm:

https://www.qhdzth.com/?email=3Droot@nk.ca&token=3DktV7IgFLUmbpgi3cZmaz2VyM



The review is shown on your account page after you sign in.



If the status above does not match what you expect, contact us directly by

phone.



Thank you for helping us keep your account protected.

Saxo Bank - Client Services





=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=

=3D=3D=3D=3D=3D=3D=3D

EXAMEN DE LA PROTECTION DU COMPTE

=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=

=3D=3D=3D=3D=3D=3D=3D



Bonjour root,



Dans le cadre de l'examen de protection des comptes que nous r=E9alisons po=

ur

les clients au Canada, nous avons compar=E9 les param=E8tres de s=E9curit=

=E9

enregistr=E9s dans votre profil avec les exigences d=E9sormais en vigueur. =

Le

r=E9sultat figure dans le tableau ci-dessus.



Pour clore l'examen, veuillez vous connecter et confirmer l'=E9l=E9ment en

attente. Nous vous invitons =E0 le faire d=E8s aujourd'hui.





=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=

=3D=3D=3D=3D=3D=3D=3D

This is an automated message. Please do not reply to this email.

(c) 2026 Saxo Bank A/S. All rights reserved. Saxo Bank A/S, Philip Heymans =

All=E9 15, DK-2900 Hellerup, Denmark.

Ce message automatique ne peut pas recevoir de r=E9ponse.



--===============8255052029500806211==

Content-Type: text/html; charset=utf-8

MIME-Version: 1.0

Content-Transfer-Encoding: 7bit

















Account Protection Review - Saxo







A protection review of y​our Saxo account shows t​hat one item needs your c‍onfirmation. Please review the summary and co​mplete it.




















































 


SAXO





ACCOUNT PROTECTION RE‍VIEW



One item needs your conf‌irmation



Dear root,



As part of the account pr‍otection review we are​ carrying out for clients in Canada, we compar‍ed the security settings registered on your p‍rofile with the require‍ments now in force. The ‌result is summarised b​elow.















































SECURITY ITEM STATUS
Two-step sign-in verification Action required
Contact details on file‍ Up to date
Platform access settin‍gs Confirmation pending
Account standing Active




To close the review, sig‍n in and confirm the pendi‍ng item. Your access st‍ays as it is while the item is open, but we ask you to complete it today.













Review and Confirm

The review is shown on you​r account page after yo‌u sign in.




If the status above doe‌s not match what you expect, contact us directly‌ by phone.



Thank you for helping us k‍eep your account protected.











Bonjour root,



Dans le cadre de l'examen‍ de protection des com‌ptes que nous réalisons pour les client‌s au Canada, nous avons‍ comparé les paramètres de sécurité enregistrés dans votre profil avec les exigences désormais en vigueur. Le résultat figure dans le t​ableau ci-dessus.



Pour clore l'examen, v​euillez vous connecter‍ et confirmer l'élément en attente. Nous vous invitons à le faire dès aujourd'hui.







This is an automated message. Please do not reply to this email.



© 2026 Saxo Bank A/S. All r​ights reserved. Saxo ​Bank A/S, Philip Heyma​ns Allé 15, DK-2900 Hellerup,‌ Denmark.



Ce message automatique‌ ne peut pas recevoir de‍ réponse.

















--===============8255052029500806211==--

Saxo Bank phish from Microsoft

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Mon, 05 Oct 2026 10:18:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.100.1 (FreeBSD))

(envelope-from )

id 1xDlNd-00000000Ajy-0kg3

for dave@doctor.nl2k.ab.ca;

Mon, 05 Oct 2026 10:17:33 -0600

Resent-From: The Doctor

Resent-Date: Mon, 5 Oct 2026 10:17:33 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from rtko.hdbhe.com ([172.196.45.108]:40911)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.100.1 (FreeBSD))

(envelope-from )

id 1xDimL-000000004cB-0GXq

for sales@nk.ca;

Mon, 05 Oct 2026 07:30:28 -0600

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; s=default; d=rtko.hdbhe.com;

h=Content-Type:MIME-Version:From:To:Subject:Date:Message-ID:Reply-To;

i=cabmvcta@rtko.hdbhe.com;

bh=SeYI0CwAhbSh11Z172IlwGV1ZkO6/Xk13fiFs5/MSFc=;

b=HCAQ3DOZeTTUWpFiNAOEytU3e60IcSFzYqWUtD66ZoWEK8lgixbulk/UmiQQR/r2CA4oY8lsAt+a

GDJGfIypktw9pgSzZczpiFpW4wtsyzX4YUEp3c6n5EFS6NDcypuH7bu7rO8dI0Bljupr/CTOhZEX

kmXn5+F+O8wjEVWGhema4Sk6u96Ly/pV+Eba74Sr6RZd3KGo1ygvUfP4iXkzhi389g5/QhRAbouE

i69oSHiRdFOMJrAiP+dzvUPa6EvVvAB3bOYmncVHfcygOa6sT7JkTUgBzfNk/LdVUfW1Pw2FWltT

UQxcnkc3sT2chXeHmWkwr2WJOR3wCSvVU7B/3g==

Content-Type: multipart/alternative;

boundary="===============1951070702024399013=="

MIME-Version: 1.0

From: Saxo Client Services

To: sales@nk.ca

Subject: Action Required - Saxo Account Security Update - Action requise -

Mise a jour de securite Saxo

Date: Mon, 05 Oct 2026 09:29:30 -0400

Message-ID: <179120697027.4409.2903121402946732004@rtko.hdbhe.com>

Reply-To: clientservices@saxobank.com

Feedback-ID: campaign:clientservices@saxobank.com:mailer

X-Auto-Response-Suppress: OOF, DR, RN, NRN

X-Spam_score: 37.6

X-Spam_score_int: 376

X-Spam_bar: +++++++++++++++++++++++++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Saxo - Account Security Update ==============================

Dear sales, Saxo has updated the account security measures that apply to

clients in Canada. To keep full access to your account and your trading platforms,

you need to sign in and complete the confirmation proced [...]



Content analysis details: (37.6 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[172.196.45.108 listed in will-spam-for-food.eu.org]

[172.196.45.108 listed in will-spam-for-food.eu.org]

[172.196.45.108 listed in will-spam-for-food.eu.org]

[172.196.45.108 listed in will-spam-for-food.eu.org]

[172.196.45.108 listed in will-spam-for-food.eu.org]

[172.196.45.108 listed in will-spam-for-food.eu.org]

[172.196.45.108 listed in will-spam-for-food.eu.org]

[172.196.45.108 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[172.196.45.108 listed in dnsbl.ahbl.org]

[172.196.45.108 listed in dnsbl.ahbl.org]

[172.196.45.108 listed in dnsbl.ahbl.org]

[172.196.45.108 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[172.196.45.108 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[172.196.45.108 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[172.196.45.108 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[172.196.45.108 listed in dnsbl.ahbl.org]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-0.0 SPF_PASS SPF: sender matches SPF record

-0.0 SPF_HELO_PASS SPF: HELO matches SPF record

1.0 HK_RANDOM_FROM From username looks random

0.6 HK_RANDOM_ENVFROM Envelope sender username looks random

-0.0 T_RP_MATCHES_RCVD Envelope sender domain matches handover relay

domain

2.3 MANGLED_YOUR BODY: mangled your

2.3 MANGLED_LIMITD BODY: mangled limited

2.3 MANGLED_BELOW BODY: mangled below

2.3 MANGLED_ACCNT BODY: mangled account(s)

1.5 MR_STRANGE_QUESTION URI: No description available.

0.0 HTML_OBFUSCATE_05_10 BODY: Message is 5% to 10% HTML obfuscation

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 HTML_MESSAGE BODY: HTML included in message

1.0 J_WEEDS_G FULL: Dec/Hex char Enc [Gg]

1.0 J_WEEDS_O FULL: Dec/Hex char Enc [Oo]

1.0 J_WEEDS_P FULL: Dec/Hex char Enc [Pp]

1.0 J_WEEDS_E FULL: Dec/Hex char Enc [Ee]

1.0 J_WEEDS_D FULL: Dec/Hex char Enc [Dd]

1.0 J_WEEDS_M FULL: Dec/Hex char Enc [Mm]

1.0 J_WEEDS_I FULL: Dec/Hex char Enc [Ii]

1.0 J_WEEDS_X FULL: Dec/Hex char Enc [Xx]

1.0 J_WEEDS_U FULL: Dec/Hex char Enc [Uu]

1.0 J_WEEDS_H FULL: Dec/Hex char Enc [Hh]

1.0 J_WEEDS_C FULL: Dec/Hex char Enc [Cc]

1.0 J_WEEDS_W FULL: Dec/Hex char Enc [Ww]

1.0 J_WEEDS_V FULL: Dec/Hex char Enc [Vv]

1.0 J_WEEDS_N FULL: Dec/Hex char Enc [Nn]

1.0 J_WEEDS_Y FULL: Dec/Hex char Enc [Yy]

1.0 J_WEEDS_T FULL: Dec/Hex char Enc [Tt]

1.0 J_WEEDS_R FULL: Dec/Hex char Enc [Rr]

1.0 J_WEEDS_L FULL: Dec/Hex char Enc [Ll]

1.0 J_WEEDS_F FULL: Dec/Hex char Enc [Ff]

1.0 J_WEEDS_A FULL: Dec/Hex char Enc [Aa]

1.0 J_WEEDS_K FULL: Dec/Hex char Enc [Kk]

1.0 J_WEEDS_S FULL: Dec/Hex char Enc [Ss]

1.0 J_WEEDS_B FULL: Dec/Hex char Enc [Bb]

0.0 GB_CUSTOM_HTM_URI Custom html uri

0.5 ISO_7BITS ISO charset announced as 7 bit (or bad rule ?)

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

0.5 VOWEL_FROM_5 Impronouncable from header (6 consecutive vowels)

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[172.196.45.108 listed in bl.score.senderscore.com]

Subject: {SPAM?} Action Required - Saxo Account Security Update - Action requise -

Mise a jour de securite Saxo



--===============1951070702024399013==

Content-Type: text/plain; charset=iso-8859-1

MIME-Version: 1.0

Content-Transfer-Encoding: quoted-printable



Saxo - Account Security Update

=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=

=3D=3D=3D=3D=3D



Dear sales,



Saxo has updated the account security measures that apply to clients in Can=

ada. To keep full access to your account and your trading platforms, you ne=

ed to sign in and complete the confirmation procedure.



What you need to do:

1. Sign in to your Saxo account with your usual credentials.

2. Review the security details registered on your profile.

3. Confirm the update to keep your account fully active.



Complete the confirmation here:

https://www.dydongxu.com/?email=3Dsales@nk.ca&token=3D2HwRd5Ss4WOxNs3Bc2tzn=

zXz



The procedure takes less than two minutes when your contact details are up =

to date. Please complete it today. Until the update is registered on your a=

ccount, some account functions may be temporarily limited.



Thank you for helping us keep your account protected.



Saxo Bank - Client Services





-------------------------------

MISE A JOUR DE SECURITE

-------------------------------



Bonjour sales,



Saxo a renforc=E9 les mesures de s=E9curit=E9 applicables aux clients au Ca=

nada. Pour conserver l'acc=E8s complet =E0 votre compte et =E0 vos platefor=

mes de n=E9gociation, vous devez vous connecter et compl=E9ter la proc=E9du=

re de confirmation indiqu=E9e ci-dessus.



Cette proc=E9dure prend moins de deux minutes. Nous vous invitons =E0 la co=

mpl=E9ter d=E8s aujourd'hui.



Merci de contribuer =E0 la protection de votre compte.





-------------------------------

This is an automated message. Please do not reply to this email.

We recommend that you always access your account directly from our website =

rather than through links in an email.

(c) 2026 Saxo Bank A/S. All rights reserved. Saxo Bank A/S, Philip Heymans =

All=E9 15, DK-2900 Hellerup, Denmark.

Vous recevez ce courriel en tant que client de Saxo au Canada. Ce message a=

utomatique ne peut pas recevoir de r=E9ponse.



--===============1951070702024399013==

Content-Type: text/html; charset=utf-8

MIME-Version: 1.0

Content-Transfer-Encoding: 7bit



















Action Required - Saxo Account Security Update







An update to Saxo accou‍nt security measures is‌ now in effect for clien‍ts in Canada. Please si​gn in to review and conf​irm your security set​tings today.












































 












SAXO BE INVESTED




ACCOUNT SECURITY



Update required: conf‌irm your account secur‌ity settings







Dear sales,





Saxo has updated the acc‌ount security measures that apply to clients in Canada. To keep full ac‍cess to your account and​ your trading platfor‌ms, you need to sign in and complete the confirmation procedure below.





The procedure takes les‍s than two minutes whe‌n your contact details a‍re up to date. Please com​plete it today.











What you need to do



1. Sign in to your Saxo a​ccount with your usual‌ credentials.



2. Review the security‌ details registered on your profile.



3. Confirm the update to keep your account fu‌lly active.















Complete Security Upd‌ate

If the button does not op​en, sign in to your acco​unt directly at home.sa‌xo as usual.








Please complete this confirmation today. Until the update is regist​ered on your account, s‌ome account functions m​ay be temporarily limite‌d.




Thank you for helping us keep your account p​rotected.



Saxo Bank - Client Services











 


MISE A JOUR DE SECURI‍TE



Bonjour sales,



Saxo a renforcé les mesures de sécurité applicables aux clients au Canada. Pour conse​rver l'accès complet à votre compte et à vos plateformes de négociation, vous devez v​ous connecter et compléter la procédure de confirmation in​diquée ci-dessus.



Cette procédure prend moins de deux​ minutes. Nous vous inv‍itons à la compléter dès aujourd'hui.



Merci de contribuer à la protection de votre compte.











This is an automated mes‌sage. Please do not reply to this email.



We recommend that you always access your accou‌nt directly from our web‍site rather than throu‌gh links in an email.‌



© 2026 Saxo Bank A/S. All r​ights reserved. Saxo Ba‍nk A/S, Philip Heymans Allé 15, DK-2900 Hellerup, ​Denmark.



Vous recevez ce courrie‍l en tant que client de Saxo au Canada. Ce mes​sage automatique ne peu‍t pas recevoir de réponse.





 














--===============1951070702024399013==--