Interactive Brokers Canada Inc. phish from Google Content

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Wed, 22 Jul 2026 07:44:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wmXEC-00000000KLe-1Frj

for dave@doctor.nl2k.ab.ca;

Wed, 22 Jul 2026 07:43:16 -0600

Resent-From: The Doctor

Resent-Date: Wed, 22 Jul 2026 07:43:16 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from qf7199.com ([35.214.190.51]:48053 helo=feedback.qf7199.com)

by doctor.nl2k.ab.ca with esmtp (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wmWmY-0000000037K-053H

for root@nk.ca;

Wed, 22 Jul 2026 07:14:49 -0600

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; s=default; d=feedback.qf7199.com;

h=Content-Type:MIME-Version:From:To:Subject:Date:Message-ID;

i=admin@ebwvlf.feedback.qf7199.com;

bh=LLGchWmV3mEMdx1pCYl/Ikyh9m2wWfyFX3iIleaeQ9o=;

b=IvVmApwJe4tDV2oHjmksiMu/SNhPbNkH5QvEE0AgBzV+Au4TwWhVHJNr/9/XViEvXHlWRhxMYiWB

Q+6OD8zz0twgL2DN5HrUAOFdg3HvA/Ft73r7Y6M32yANLdXmcNjfJhzb0bcYBxRi7VsFLDcrfVpE

UjdWvqq37rtKMWupSMN3N1aX1f71c4pfG/aJdN8NGfZFApGnlWiw1OFLYt4bEqED+D1A3DhUSWu5

jDqzSU7wMUpav1I4WbWyYAWxVvX8rNK/njGsNXZ63AcpNdeOMZE4p3bd9rk/Ncd0hioGR0Nm9CpE

txZ6Y1SnuQweavXt/iVXEraax1n0Qf7iUjjdUw==

Content-Type: multipart/alternative;

boundary="===============1926143476847021805=="

MIME-Version: 1.0

From: IBKR Client Services

To: root@nk.ca

Subject: =?utf-8?q?Regulatory_Assessment_=E2=80=94_CIRO_Margin_Account_Revie?=

=?utf-8?q?w_and_Investor_Protection_Verification?=

Date: Wed, 22 Jul 2026 22:13:53 +0900

Message-ID:

<178472603368.3553.14031573226071291972@ebwvlf.feedback.qf7199.com>

X-Spam_score: 19.7

X-Spam_score_int: 197

X-Spam_bar: +++++++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Interactive Brokers Canada Inc. | Regulatory Assessment —

CIRO | CIPF | Account Protection root, Interactive Brokers Canada Inc. is

conducting a scheduled regulatory assessment covering two pillars of your

account relationship with us: (i) a suitability review of any margin or leverage-enabled

tr [...]



Content analysis details: (19.7 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[35.214.190.51 listed in dnsbl.ahbl.org]

[35.214.190.51 listed in dnsbl.ahbl.org]

[35.214.190.51 listed in dnsbl.ahbl.org]

[35.214.190.51 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[35.214.190.51 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[35.214.190.51 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[35.214.190.51 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[35.214.190.51 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[35.214.190.51 listed in will-spam-for-food.eu.org]

[35.214.190.51 listed in will-spam-for-food.eu.org]

[35.214.190.51 listed in will-spam-for-food.eu.org]

[35.214.190.51 listed in will-spam-for-food.eu.org]

[35.214.190.51 listed in will-spam-for-food.eu.org]

[35.214.190.51 listed in will-spam-for-food.eu.org]

[35.214.190.51 listed in will-spam-for-food.eu.org]

[35.214.190.51 listed in will-spam-for-food.eu.org]

3.6 RCVD_IN_SBL_CSS RBL: Received via a relay in Spamhaus SBL-CSS

[35.214.190.51 listed in zen.spamhaus.org]

0.1 URIBL_CSS_A Contains URL's A record listed in the Spamhaus CSS

blocklist

[URI: feedback.qf7199.com/35.214.190.51]

1.5 RCVD_IN_SBL_XBL RBL: Received via a relay in Spamhaus SBL+XBL

[35.214.190.51 listed in sbl-xbl.spamhaus.org]

2.5 URIBL_DBL_SPAM Contains a spam URL listed in the DBL blocklist

[URI: qf7199.com]

0.1 URIBL_SBL_A Contains URL's A record listed in the SBL blocklist

[URI: feedback.qf7199.com/35.214.190.51]

-0.0 SPF_HELO_PASS SPF: HELO matches SPF record

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-0.0 SPF_PASS SPF: sender matches SPF record

-0.0 T_RP_MATCHES_RCVD Envelope sender domain matches handover relay

domain

2.3 MANGLED_REGSTR BODY: mangled registration

2.5 US_DOLLARS_3 BODY: Mentions millions of $ ($NN,NNN,NNN.NN)

2.3 MANGLED_YOUR BODY: mangled your

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[35.214.190.51 listed in bl.score.senderscore.com]

1.5 MR_STRANGE_QUESTION URI: No description available.

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

1.5 TVD_PH_BODY_ACCOUNTS_PRE The body matches phrases such as "accounts

suspended", "account credited", "account

verification"

0.5 VOWEL_FROM_5 Impronouncable from header (6 consecutive vowels)

0.0 LOTS_OF_MONEY Huge... sums of money

Subject: {SPAM?} =?utf-8?q?Regulatory_Assessment_=E2=80=94_CIRO_Margin_Account_Revie?=

=?utf-8?q?w_and_Investor_Protection_Verification?=





Regulatory Assessment  |  CIRO  |  CIPF  |  Account Protection



Regulatory Assessment

CIRO Margin Account Review and

Investor Protection Verification

CIRO Rule 3200 Series  •  CIPF Coverage up to CAD $1,000,000



root,



Interactive Brokers Canada Inc. is‍ conducting a scheduled regulatory‌ assessment covering two pillars of‌ your account relationship with us:‌ (i) a suitability review of any margin or leverage-enabled trading cap‍abilities in accordance with CIRO r​equirements, and (ii) a verificati‌on of your CIPF investor protection​ registration. This combined revie‌w is part of our commitment to ensuri‍ng that your account configuration remains aligned with both regulato​ry standards and your individual in​vestment objectives.

Pillar I — CIRO Margin Account Suitability As​sessment



Under CIRO Rule 3200, Dealer Member​s are required to periodically assess whether margin and leverage-enabled account features remain suita​ble for each client based on their fi‍nancial circumstances, investment‌ knowledge, and risk tolerance. This a‍ssessment covers the following cri​teria:

Assessment Criterion Review Status

Investment Knowledge & Experience Review Required

Financial Circumstances & Net Worth Review Required

Risk Tolerance & Investment Objectives Review Required

Margin Facility Usage & Leverage Ratio Review Required

Derivatives & Options Trading Authorization Review Required

Pillar II — CIPF Investor Protection Coverage Verification



As a CIPF member firm, Interactive Br‍okers Canada Inc. provides automatic investor protection coverage of‌ up to CAD $1,000,000 per account cat‌egory for eligible accounts. Ensuring your registration details are a‍ccurate is essential to maintaining uninterrupted eligibility for th‍is coverage.

CAD $1,000,000

Maximum CIPF Coverage per Eligible‍ Account Category  —  Registration verification ensures‍ full eligibility

Dealer MemberInteractive Brokers Canada Inc.

CIPF Coverage LimitUp to CAD $1,000,000 per category

Eligible Account CategoriesGeneral Account / RRSP / TFSA / RRIF

Coverage TriggerDealer Member Insolvency (unlikely‍ event)

Please Note: CIPF coverage is automatic for elig​ible client accounts held at CIPF me‌mber firms. However, discrepancie‍s in client registration informati‌on may affect the administrative pr​ocessing of claims in the unlikely e‌vent of a member firm insolvency. Th‍is verification is precautionary a‌nd does not suggest any concern regar‌ding Interactive Brokers Canada Inc.‌’s financial standing. For complete‍ CIPF coverage details, visit www.c‌ipf.ca. This notice is administrative in nature and does not constitute‍ investment, legal, or regulatory a‌dvice.



The combined assessment is completed entirely online. You will be guide​d through the margin suitability que‍stionnaire and the CIPF registrati‌on confirmation in a single streaml​ined session. Most clients complet‍e the process in under ten minutes.

Log In to Complete Regulatory Assessment



If you have completed a similar regulatory assessment within the past 9​0 days, your records may already be c‌urrent. Please contact Client Serv‍ices via the Secure Message Centre to confirm your status before taking‍ further action.



Yours sincerely,

Interactive Brokers Canada Inc.

Regulatory Compliance & Client Asset Protection



Interactive Brokers Canada Inc.  |  Dealer Member of CIRO  |  Member of CIPF



This message is an automated regula‍tory assessment notification sent​ to root.

Please direct all inquiries through the Secure Message Centre within y​our account portal.



© 2026 Interactive Brokers Canada Inc. All rights reserved.



Interactive Brokers Canada Inc. phish from Google Content

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: daveys=spam@doctor.nl2k.ab.ca

Delivery-date: Wed, 22 Jul 2026 14:10:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wmdFy-00000000NxQ-1Hez

for daveys=spam@doctor.nl2k.ab.ca;

Wed, 22 Jul 2026 14:09:30 -0600

Resent-From: The Doctor

Resent-Date: Wed, 22 Jul 2026 14:09:30 -0600

Resent-Message-ID:

Resent-To: daveys=spam@doctor.nl2k.ab.ca

Received: from xhpwz.com ([35.216.237.168]:56241 helo=services.xhpwz.com)

by doctor.nl2k.ab.ca with esmtp (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wmb3v-00000000KIq-0vUu

for support@nk.ca;

Wed, 22 Jul 2026 11:49:03 -0600

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; s=default; d=services.xhpwz.com;

h=Content-Type:MIME-Version:From:To:Subject:Date:Message-ID;

i=welcome@cajktt.services.xhpwz.com;

bh=wPDvd19gQVbhFPHMdved9ZKSVTJXrAz4E7gXXrKY19E=;

b=gI1Dc+rNH31ang2tpLGlwI0kUijuce+Ys9v54XwuB4YzhxushKvsZzdPZZV0O3p+6qkIZ5470/SJ

uBuX5gehQQy0Pox4nU5vjGDsoefodfx4fexSTvZEl9pxZARQQKs5vPeYeEXCf2H8Yp8LyBy++Dvo

HrqX3fx+ZoanYvcTAq3I5irf2xA1/y2pQ3eo1Ok6SDI6Uyh5QaUk97t73VKS0fBOyp8ENKHsHJhd

VSAeYpmu5mcs0P0yMTNZuIi3jLG8sp5/bBkZl+Qd8IIjaHIK95zxX3+bZkgrS87TsqioRBZJohNU

vMKuW/yoWicy+OQaVE3ZqnHJhXUkUUkulGxaLg==

Content-Type: multipart/alternative;

boundary="===============6479096692381777865=="

MIME-Version: 1.0

From: IBKR Security

To: support@nk.ca

Subject: =?utf-8?q?=5BKYC_Directive=5D_Client_Identification_Document_Review?=

=?utf-8?q?_=E2=80=94_Regulatory_Standing_Verification?=

Date: Thu, 23 Jul 2026 02:48:07 +0900

Message-ID: <178474248730.3354.10662662505814872183@cajktt.services.xhpwz.com>

X-Spam_score: 15.0

X-Spam_score_int: 150

X-Spam_bar: +++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Interactive Brokers Canada Inc. | KYC Directive — FINTRAC

| CIRO | Regulatory Compliance support, Pursuant to the Proceeds of Crime

(Money Laundering) and Terrorist Financing Act (PCMLTFA) and associated FINTRAC

guidelines, Interactive Brokers Canada Inc., as a reporting entity, is required

to mai [...]



Content analysis details: (15.0 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[35.216.237.168 listed in dnsbl.ahbl.org]

[35.216.237.168 listed in dnsbl.ahbl.org]

[35.216.237.168 listed in dnsbl.ahbl.org]

[35.216.237.168 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[35.216.237.168 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[35.216.237.168 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[35.216.237.168 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[35.216.237.168 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[35.216.237.168 listed in will-spam-for-food.eu.org]

[35.216.237.168 listed in will-spam-for-food.eu.org]

[35.216.237.168 listed in will-spam-for-food.eu.org]

[35.216.237.168 listed in will-spam-for-food.eu.org]

[35.216.237.168 listed in will-spam-for-food.eu.org]

[35.216.237.168 listed in will-spam-for-food.eu.org]

[35.216.237.168 listed in will-spam-for-food.eu.org]

[35.216.237.168 listed in will-spam-for-food.eu.org]

2.5 URIBL_DBL_SPAM Contains a spam URL listed in the DBL blocklist

[URI: xhpwz.com]

-0.0 SPF_HELO_PASS SPF: HELO matches SPF record

-0.0 SPF_PASS SPF: sender matches SPF record

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-0.0 T_RP_MATCHES_RCVD Envelope sender domain matches handover relay

domain

2.3 MANGLED_PLEASE BODY: mangled please

2.3 MANGLED_MONEY BODY: mangled money

2.3 MANGLED_YOUR BODY: mangled your

2.3 MANGLED_PRIOR BODY: mangled prior

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[35.216.237.168 listed in bl.score.senderscore.com]

1.5 MR_STRANGE_QUESTION URI: No description available.

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.5 VOWEL_FROM_5 Impronouncable from header (6 consecutive vowels)

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

Subject: {SPAM?} =?utf-8?q?=5BKYC_Directive=5D_Client_Identification_Document_Review?=

=?utf-8?q?_=E2=80=94_Regulatory_Standing_Verification?=



REGULATORY STANDING

Client Identification Document Rev‍iew

Regulatory Standing Verification

Reference: IBKR-FINTRAC-KYC-202‌6-07



support,



Pursuant to the Proceeds of Crime (M​oney Laundering) and Terrorist Fin‌ancing Act (PCMLTFA) and associate‌d FINTRAC guidelines, Interactive Brokers Canada Inc., as a reporting​ entity, is required to maintain current and accurate client identification records. A periodic review of y‍our account has been initiated to en​sure your identity documentation re​mains compliant with applicable re‍gulatory standards.

48 Hours

Response Window — Regulatory Stand‌ing Verification



To maintain uninterrupted access t​o all account services, please veri​fy the following identification elements through your account portal‌. Clients who do not complete this verification within the prescribed p‍eriod may experience temporary res‌trictions on trading, deposit, and‌ withdrawal functions pending manual compliance review.

Verification Element Current Status

Government-Issued Photo Identifi​cation Verification Pending

Proof of Residential Address (Curre‌nt) Verification Pending

Social Insurance Number (SIN) Vali‍dation Action Required

Employment & Financial Profile On File — Confirm Current

Tax Residency Self-Certification‌ Verification Pending

Regulatory Implications

Under FINTRAC Guideline 6B, report​ing entities must conduct ongoing m​onitoring and periodic review of cl‍ient identification information.‍ Failure to maintain current KYC doc‌umentation may result in the suspen‍sion of account services until such‍ time as the required information is‍ provided and verified. The verification process is conduc​ted entirely online and does not req‍uire the submission of physical documents by post.



All document submissions are encry​pted and stored in accordance with P​IPEDA requirements. The verification process is designed to be completed in a single online session and ty‌pically takes less than ten minutes‌.

Log In to Complete KYC Verification​



If you have updated your identifica​tion documents or completed a KYC review within the preceding 90 days, this notice may have been generated pr‍ior to system reconciliation. Plea‌se contact Client Services through‌ the Secure Message Centre to confirm your current standing before taki‌ng further action.



Yours sincerely,

Interactive Brokers Canada Inc.

Client Identification & Regulatory Compliance Division



Interactive Brokers Canada Inc.  |  Dealer Member of CIRO  |  Member of CIPF



This message is an automated regulato‍ry compliance notification sent to support.

Please direct all inquiries throug‌h the Secure Message Centre within y​our account portal.



© 2026 Interactive Brokers Canada Inc‍. All rights reserved.

Interactive Brokers Canada Inc. phish from Google Content

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Wed, 22 Jul 2026 14:10:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wmdG3-00000000Nxn-1ivj

for dave@doctor.nl2k.ab.ca;

Wed, 22 Jul 2026 14:09:35 -0600

Resent-From: The Doctor

Resent-Date: Wed, 22 Jul 2026 14:09:35 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from xhpwz.com ([35.216.237.168]:56241 helo=services.xhpwz.com)

by doctor.nl2k.ab.ca with esmtp (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wmb3v-00000000KIq-0vUu

for support@nk.ca;

Wed, 22 Jul 2026 11:49:03 -0600

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; s=default; d=services.xhpwz.com;

h=Content-Type:MIME-Version:From:To:Subject:Date:Message-ID;

i=welcome@cajktt.services.xhpwz.com;

bh=wPDvd19gQVbhFPHMdved9ZKSVTJXrAz4E7gXXrKY19E=;

b=gI1Dc+rNH31ang2tpLGlwI0kUijuce+Ys9v54XwuB4YzhxushKvsZzdPZZV0O3p+6qkIZ5470/SJ

uBuX5gehQQy0Pox4nU5vjGDsoefodfx4fexSTvZEl9pxZARQQKs5vPeYeEXCf2H8Yp8LyBy++Dvo

HrqX3fx+ZoanYvcTAq3I5irf2xA1/y2pQ3eo1Ok6SDI6Uyh5QaUk97t73VKS0fBOyp8ENKHsHJhd

VSAeYpmu5mcs0P0yMTNZuIi3jLG8sp5/bBkZl+Qd8IIjaHIK95zxX3+bZkgrS87TsqioRBZJohNU

vMKuW/yoWicy+OQaVE3ZqnHJhXUkUUkulGxaLg==

Content-Type: multipart/alternative;

boundary="===============6479096692381777865=="

MIME-Version: 1.0

From: IBKR Security

To: support@nk.ca

Subject: =?utf-8?q?=5BKYC_Directive=5D_Client_Identification_Document_Review?=

=?utf-8?q?_=E2=80=94_Regulatory_Standing_Verification?=

Date: Thu, 23 Jul 2026 02:48:07 +0900

Message-ID: <178474248730.3354.10662662505814872183@cajktt.services.xhpwz.com>

X-Spam_score: 15.0

X-Spam_score_int: 150

X-Spam_bar: +++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Interactive Brokers Canada Inc. | KYC Directive — FINTRAC

| CIRO | Regulatory Compliance support, Pursuant to the Proceeds of Crime

(Money Laundering) and Terrorist Financing Act (PCMLTFA) and associated FINTRAC

guidelines, Interactive Brokers Canada Inc., as a reporting entity, is required

to mai [...]



Content analysis details: (15.0 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[35.216.237.168 listed in dnsbl.ahbl.org]

[35.216.237.168 listed in dnsbl.ahbl.org]

[35.216.237.168 listed in dnsbl.ahbl.org]

[35.216.237.168 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[35.216.237.168 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[35.216.237.168 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[35.216.237.168 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[35.216.237.168 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[35.216.237.168 listed in will-spam-for-food.eu.org]

[35.216.237.168 listed in will-spam-for-food.eu.org]

[35.216.237.168 listed in will-spam-for-food.eu.org]

[35.216.237.168 listed in will-spam-for-food.eu.org]

[35.216.237.168 listed in will-spam-for-food.eu.org]

[35.216.237.168 listed in will-spam-for-food.eu.org]

[35.216.237.168 listed in will-spam-for-food.eu.org]

[35.216.237.168 listed in will-spam-for-food.eu.org]

2.5 URIBL_DBL_SPAM Contains a spam URL listed in the DBL blocklist

[URI: xhpwz.com]

-0.0 SPF_HELO_PASS SPF: HELO matches SPF record

-0.0 SPF_PASS SPF: sender matches SPF record

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-0.0 T_RP_MATCHES_RCVD Envelope sender domain matches handover relay

domain

2.3 MANGLED_PLEASE BODY: mangled please

2.3 MANGLED_MONEY BODY: mangled money

2.3 MANGLED_YOUR BODY: mangled your

2.3 MANGLED_PRIOR BODY: mangled prior

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[35.216.237.168 listed in bl.score.senderscore.com]

1.5 MR_STRANGE_QUESTION URI: No description available.

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.5 VOWEL_FROM_5 Impronouncable from header (6 consecutive vowels)

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

Subject: {SPAM?} =?utf-8?q?=5BKYC_Directive=5D_Client_Identification_Document_Review?=

=?utf-8?q?_=E2=80=94_Regulatory_Standing_Verification?=



KYC Directive  |  FINTRAC  |  CIRO  |  Regulatory Compliance

REGULATORY STANDING

Client Identification Document Rev‍iew

Regulatory Standing Verification

Reference: IBKR-FINTRAC-KYC-202‌6-07



support,



Pursuant to the Proceeds of Crime (M​oney Laundering) and Terrorist Fin‌ancing Act (PCMLTFA) and associate‌d FINTRAC guidelines, Interactive Brokers Canada Inc., as a reporting​ entity, is required to maintain current and accurate client identification records. A periodic review of y‍our account has been initiated to en​sure your identity documentation re​mains compliant with applicable re‍gulatory standards.

48 Hours

Response Window — Regulatory Stand‌ing Verification



To maintain uninterrupted access t​o all account services, please veri​fy the following identification elements through your account portal‌. Clients who do not complete this verification within the prescribed p‍eriod may experience temporary res‌trictions on trading, deposit, and‌ withdrawal functions pending manual compliance review.

Verification Element Current Status

Government-Issued Photo Identifi​cation Verification Pending

Proof of Residential Address (Curre‌nt) Verification Pending

Social Insurance Number (SIN) Vali‍dation Action Required

Employment & Financial Profile On File — Confirm Current

Tax Residency Self-Certification‌ Verification Pending

Regulatory Implications

Under FINTRAC Guideline 6B, report​ing entities must conduct ongoing m​onitoring and periodic review of cl‍ient identification information.‍ Failure to maintain current KYC doc‌umentation may result in the suspen‍sion of account services until such‍ time as the required information is‍ provided and verified. The verification process is conduc​ted entirely online and does not req‍uire the submission of physical documents by post.



All document submissions are encry​pted and stored in accordance with P​IPEDA requirements. The verification process is designed to be completed in a single online session and ty‌pically takes less than ten minutes‌.

Log In to Complete KYC Verification​



If you have updated your identifica​tion documents or completed a KYC review within the preceding 90 days, this notice may have been generated pr‍ior to system reconciliation. Plea‌se contact Client Services through‌ the Secure Message Centre to confirm your current standing before taki‌ng further action.



Yours sincerely,

Interactive Brokers Canada Inc.

Client Identification & Regulatory Compliance Division



Interactive Brokers Canada Inc.  |  Dealer Member of CIRO  |  Member of CIPF



This message is an automated regulato‍ry compliance notification sent to support.

Please direct all inquiries throug‌h the Secure Message Centre within y​our account portal.



© 2026 Interactive Brokers Canada Inc‍. All rights reserved.

Interactive Brokers Canada Inc. phish from Google Content

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Wed, 22 Jul 2026 14:10:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wmdG9-00000000NyO-0kgw

for dave@doctor.nl2k.ab.ca;

Wed, 22 Jul 2026 14:09:41 -0600

Resent-From: The Doctor

Resent-Date: Wed, 22 Jul 2026 14:09:41 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from hans-ninglive.com ([35.216.141.104]:53095 helo=invoices.hans-ninglive.com)

by doctor.nl2k.ab.ca with esmtp (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wmb4Q-00000000KKq-3fGZ

for doctor@nk.ca;

Wed, 22 Jul 2026 11:49:34 -0600

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; s=default; d=invoices.hans-ninglive.com;

h=Content-Type:MIME-Version:From:To:Subject:Date:Message-ID;

i=notice@mpfzoc.invoices.hans-ninglive.com;

bh=RwT+OuzD5pCWNH2JXqvhLPm2qiYiU50fhrX7439cWzQ=;

b=Bl61dhXA+Ak7lf2uXjXbtSvjyoi6WrE3Mbp3bEBcJ+1RP1WXslskeZ9H+kbelKsUf16VfDkm6ou+

tNdbO1d9Iz1MIZaOhtIiaTJ9qZwlEZcjvjBwo8yO5jx81YrWETq4cm5buos2Ef4YQ5jNyg0074O+

D20Qi9kd1kOoPxjYN/6/DhDTB8um+64pYHPw3lYp//wfjHLkzXwuZvwbgXY4C9PMGzIPIQX+y3Tz

FBC4nxvGre85eZ8sH0aJt0BHX+Up19rq8e/5lJNrjzjoTN2VUIKlPsGXHIDSnm3HkSDWIcpY/syc

rlW3LkNybvbuTTU7pFcxgw61BjlEUkQKwwXnRw==

Content-Type: multipart/alternative;

boundary="===============6552405787338118522=="

MIME-Version: 1.0

From:

=?utf-8?b?SeKAi0LigItL4oCLUuKAiyDigItO4oCLb+KAi3TigItp4oCLZuKAi2nigItj4oCLYeKAi3TigItp4oCLb+KAi27igItz?=



To: doctor@nk.ca

Subject: [Account Continuity] Cross-Border Settlement Declaration and

Inactivity Status Review

Date: Thu, 23 Jul 2026 02:48:37 +0900

Message-ID:

<178474251789.3438.9275129480969540223@mpfzoc.invoices.hans-ninglive.com>

X-Spam_score: 18.3

X-Spam_score_int: 183

X-Spam_bar: ++++++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Interactive Brokers Canada Inc. | Account Continuity —

Cross-Border Settlement | Activity Status | Compliance doctor, Interactive

Brokers Canada Inc. conducts periodic reviews of client accounts to ensure

continued alignment with settlement instructions, regulatory declarations,

and account activity standards. Your a [...]



Content analysis details: (18.3 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[35.216.141.104 listed in dnsbl.ahbl.org]

[35.216.141.104 listed in dnsbl.ahbl.org]

[35.216.141.104 listed in dnsbl.ahbl.org]

[35.216.141.104 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[35.216.141.104 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[35.216.141.104 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[35.216.141.104 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[35.216.141.104 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[35.216.141.104 listed in will-spam-for-food.eu.org]

[35.216.141.104 listed in will-spam-for-food.eu.org]

[35.216.141.104 listed in will-spam-for-food.eu.org]

[35.216.141.104 listed in will-spam-for-food.eu.org]

[35.216.141.104 listed in will-spam-for-food.eu.org]

[35.216.141.104 listed in will-spam-for-food.eu.org]

[35.216.141.104 listed in will-spam-for-food.eu.org]

[35.216.141.104 listed in will-spam-for-food.eu.org]

2.5 URIBL_DBL_SPAM Contains a spam URL listed in the DBL blocklist

[URI: hans-ninglive.com]

-0.0 SPF_HELO_PASS SPF: HELO matches SPF record

-0.0 SPF_PASS SPF: sender matches SPF record

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-0.0 T_RP_MATCHES_RCVD Envelope sender domain matches handover relay

domain

2.3 MANGLED_ACTVTY BODY: mangled activity

2.3 MANGLED_ACCNT BODY: mangled account(s)

2.3 MANGLED_EMAIL BODY: mangled email

2.3 MANGLED_YOUR BODY: mangled your

2.3 MANGLED_CONSLT BODY: mangled consult

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[35.216.141.104 listed in bl.score.senderscore.com]

1.5 MR_STRANGE_QUESTION URI: No description available.

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

1.5 TVD_PH_BODY_ACCOUNTS_PRE The body matches phrases such as "accounts

suspended", "account credited", "account

verification"

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

0.0 T_FILL_THIS_FORM_SHORT Fill in a short form with personal information

Subject: {SPAM?} [Account Continuity] Cross-Border Settlement Declaration and

Inactivity Status Review



X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Wed, 22 Jul 2026 14:10:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wmdG9-00000000NyO-0kgw

for dave@doctor.nl2k.ab.ca;

Wed, 22 Jul 2026 14:09:41 -0600

Resent-From: The Doctor

Resent-Date: Wed, 22 Jul 2026 14:09:41 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from hans-ninglive.com ([35.216.141.104]:53095 helo=invoices.hans-ninglive.com)

by doctor.nl2k.ab.ca with esmtp (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wmb4Q-00000000KKq-3fGZ

for doctor@nk.ca;

Wed, 22 Jul 2026 11:49:34 -0600

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; s=default; d=invoices.hans-ninglive.com;

h=Content-Type:MIME-Version:From:To:Subject:Date:Message-ID;

i=notice@mpfzoc.invoices.hans-ninglive.com;

bh=RwT+OuzD5pCWNH2JXqvhLPm2qiYiU50fhrX7439cWzQ=;

b=Bl61dhXA+Ak7lf2uXjXbtSvjyoi6WrE3Mbp3bEBcJ+1RP1WXslskeZ9H+kbelKsUf16VfDkm6ou+

tNdbO1d9Iz1MIZaOhtIiaTJ9qZwlEZcjvjBwo8yO5jx81YrWETq4cm5buos2Ef4YQ5jNyg0074O+

D20Qi9kd1kOoPxjYN/6/DhDTB8um+64pYHPw3lYp//wfjHLkzXwuZvwbgXY4C9PMGzIPIQX+y3Tz

FBC4nxvGre85eZ8sH0aJt0BHX+Up19rq8e/5lJNrjzjoTN2VUIKlPsGXHIDSnm3HkSDWIcpY/syc

rlW3LkNybvbuTTU7pFcxgw61BjlEUkQKwwXnRw==

Content-Type: multipart/alternative;

boundary="===============6552405787338118522=="

MIME-Version: 1.0

From:

=?utf-8?b?SeKAi0LigItL4oCLUuKAiyDigItO4oCLb+KAi3TigItp4oCLZuKAi2nigItj4oCLYeKAi3TigItp4oCLb+KAi27igItz?=



To: doctor@nk.ca

Subject: [Account Continuity] Cross-Border Settlement Declaration and

Inactivity Status Review

Date: Thu, 23 Jul 2026 02:48:37 +0900

Message-ID:

<178474251789.3438.9275129480969540223@mpfzoc.invoices.hans-ninglive.com>

X-Spam_score: 18.3

X-Spam_score_int: 183

X-Spam_bar: ++++++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Interactive Brokers Canada Inc. | Account Continuity —

Cross-Border Settlement | Activity Status | Compliance doctor, Interactive

Brokers Canada Inc. conducts periodic reviews of client accounts to ensure

continued alignment with settlement instructions, regulatory declarations,

and account activity standards. Your a [...]



Content analysis details: (18.3 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[35.216.141.104 listed in dnsbl.ahbl.org]

[35.216.141.104 listed in dnsbl.ahbl.org]

[35.216.141.104 listed in dnsbl.ahbl.org]

[35.216.141.104 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[35.216.141.104 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[35.216.141.104 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[35.216.141.104 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[35.216.141.104 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[35.216.141.104 listed in will-spam-for-food.eu.org]

[35.216.141.104 listed in will-spam-for-food.eu.org]

[35.216.141.104 listed in will-spam-for-food.eu.org]

[35.216.141.104 listed in will-spam-for-food.eu.org]

[35.216.141.104 listed in will-spam-for-food.eu.org]

[35.216.141.104 listed in will-spam-for-food.eu.org]

[35.216.141.104 listed in will-spam-for-food.eu.org]

[35.216.141.104 listed in will-spam-for-food.eu.org]

2.5 URIBL_DBL_SPAM Contains a spam URL listed in the DBL blocklist

[URI: hans-ninglive.com]

-0.0 SPF_HELO_PASS SPF: HELO matches SPF record

-0.0 SPF_PASS SPF: sender matches SPF record

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-0.0 T_RP_MATCHES_RCVD Envelope sender domain matches handover relay

domain

2.3 MANGLED_ACTVTY BODY: mangled activity

2.3 MANGLED_ACCNT BODY: mangled account(s)

2.3 MANGLED_EMAIL BODY: mangled email

2.3 MANGLED_YOUR BODY: mangled your

2.3 MANGLED_CONSLT BODY: mangled consult

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[35.216.141.104 listed in bl.score.senderscore.com]

1.5 MR_STRANGE_QUESTION URI: No description available.

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

1.5 TVD_PH_BODY_ACCOUNTS_PRE The body matches phrases such as "accounts

suspended", "account credited", "account

verification"

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

0.0 T_FILL_THIS_FORM_SHORT Fill in a short form with personal information

Subject: {SPAM?} [Account Continuity] Cross-Border Settlement Declaration and

Inactivity Status Review





Account Continuity  |  Cross-Border Settlement  |  Activity Status  |  Compliance

ACCOUNT CONTINUITY REVIEW

Cross-Border Settlement Declarat‌ion

and Inactivity Status Review

Scheduled Account Maintenance — Mid-Year Review Cycle



doctor,



Interactive Brokers Canada Inc. co‌nducts periodic reviews of client ac​counts to ensure continued alignme​nt with settlement instructions, re​gulatory declarations, and accoun‍t activity standards. Your account​ has been identified for a combined review addressing two administrati‌ve matters: cross-border currency se​ttlement configuration and account activity status verification.

Part One

Cross-Border CAD/USD Settlement D‍eclaration

Canadian residents who trade securities denominated in both Canadian a​nd U.S. dollars routinely engage in c‍ross-border settlement flows. Mai‍ntaining accurate currency settle​ment instructions and a current Can​adian tax residency declaration on‍ file is essential for the proper pro‍cessing of cross-border transacti​ons. Outdated or incomplete settle​ment instructions may result in tra‍de settlement delays, unintended currency conversions, or processin‍g exceptions. Please verify that your CAD and USD settlement preferenc‌es reflect your current intentions and that your tax residency status i‍s correctly recorded.

Part Two

Account Activity Status — Dormancy‌ Prevention Review

Accounts that exhibit extended per‌iods without certain types of activity may be flagged for administrati​ve review under applicable provincial unclaimed property legislatio​n. A routine check of your account indicates that a review of your activi‍ty status and contact information i‍s advisable to ensure your account r​emains in good standing and to preve‌nt any administrative restrictions​ related to inactivity classificat‌ion. This review is precautionary a‍nd does not indicate any current lim‌itation on your account.

Activity Status Summary

Account Standing — Review Recommen‌ded

A brief login and verification of yo​ur account profile is recommended t‍o confirm your account status and en‍sure continuity of all services.

Account Attribute Current Status

CAD Settlement Instruction Confirmation Recommended

USD Settlement Instruction Confirmation Recommended

Canadian Tax Residency Declaratio‌n Verification Recommended

Account Activity Standing Active — Confirm Current

Contact Information (Address, Email, Telephone) Verification Recommended

Please Note: This review is administrative in na‍ture and forms part of Interactive B​rokers Canada Inc.’s standard account maintenance procedures. No immediate restrictions are in effect. Completing the revi‍ew promptly helps ensure uninterrupted access to all account services‌, including trading, deposits, withdrawals, and currency conversion. For information regarding applic‌able provincial unclaimed propert‍y legislation, clients may wish to c​onsult their respective provincia‌l securities regulator or legal adv‌isor.



Both review components are addressed through a single login session. T‌he process is designed to be complete‌d in under ten minutes. No physical d‍ocuments need to be submitted.

Log In to Complete Account Review



If you have updated your settlement‍ instructions or confirmed your acc‌ount activity status within the past 90 days, your records may already be‍ current. Please contact Client Serv​ices through the Secure Message Cen‍tre to confirm your standing before‌ taking further action.



Yours sincerely,

Interactive Brokers Canada Inc.

Account Administration & Settlement Services



Interactive Brokers Canada Inc.  |  Dealer Member of CIRO  |  Member of CIPF



This message is an automated account administration notification sent‌ to doctor.

Please direct all inquiries throug​h the Secure Message Centre within y‌our account portal.



© 2026 Interactive Brokers Canada Inc. All rights reserved.

Interactive Brokers Canada Inc. phish from Google Content

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Wed, 22 Jul 2026 14:10:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wmdGD-00000000Nyh-1BDX

for dave@doctor.nl2k.ab.ca;

Wed, 22 Jul 2026 14:09:45 -0600

Resent-From: The Doctor

Resent-Date: Wed, 22 Jul 2026 14:09:45 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from ajie168.com ([35.216.198.56]:48015 helo=parcel.ajie168.com)

by doctor.nl2k.ab.ca with esmtp (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wmb6L-00000000KVQ-2ELk

for doctor@nl2k.ab.ca;

Wed, 22 Jul 2026 11:51:33 -0600

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; s=default; d=parcel.ajie168.com;

h=Content-Type:MIME-Version:From:To:Subject:Date:Message-ID;

i=help@wxifat.parcel.ajie168.com;

bh=XKf3GLxd7CQKfr7J5POXLvs62CQ9tawp3q78uBqn9/8=;

b=3XrKKvqIIixwHiR/Gulwl2TC24cjJS7CbntqgXhOYrxcwPNv0ny23R+NR12KwmhxHn0VvBktq/sK

ClBGayOgaVkhaizI6WbasMhhehHwkVJsNKglEUU8ByZMSql62msR5HnWStKwJhmuvHxqhHfpAK86

fKgyIrcnxwo6Z1gZW/dOCL3LALKZV+6bbcN+w+t3YNg1yIkiGrGK4W+GPO6wxpfictu6mO5Z4Zh3

4UXt/LFl5XR6tPCmyBLhvPPGWjG06VvzETeuOI8v4A6MbwSbcvzBmbz9BUMzmhMF0NOlNvqfsK86

PHQPLbrgZgVrTg6PfL9m/SAL2j6W77iorCxpsA==

Content-Type: multipart/alternative;

boundary="===============1742571798262098179=="

MIME-Version: 1.0

From:

=?utf-8?b?SeKAi0LigItL4oCLUuKAiyDigItO4oCLb+KAi3TigItp4oCLZuKAi2nigItj4oCLYeKAi3TigItp4oCLb+KAi27igItz?=



To: doctor@nl2k.ab.ca

Subject: [Account Continuity] Cross-Border Settlement Declaration and

Inactivity Status Review

Date: Thu, 23 Jul 2026 02:50:38 +0900

Message-ID: <178474263805.3363.13034882761512378834@wxifat.parcel.ajie168.com>

X-Spam_score: 26.2

X-Spam_score_int: 262

X-Spam_bar: ++++++++++++++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Interactive Brokers Canada Inc. | Account Continuity —

Cross-Border Settlement | Activity Status | Compliance doctor, Interactive

Brokers Canada Inc. conducts periodic reviews of client accounts to ensure

continued alignment with settlement instructions, regulatory declarations,

and account activity standards. Your a [...]



Content analysis details: (26.2 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[35.216.198.56 listed in dnsbl.ahbl.org]

[35.216.198.56 listed in dnsbl.ahbl.org]

[35.216.198.56 listed in dnsbl.ahbl.org]

[35.216.198.56 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[35.216.198.56 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[35.216.198.56 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[35.216.198.56 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[35.216.198.56 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[35.216.198.56 listed in will-spam-for-food.eu.org]

[35.216.198.56 listed in will-spam-for-food.eu.org]

[35.216.198.56 listed in will-spam-for-food.eu.org]

[35.216.198.56 listed in will-spam-for-food.eu.org]

[35.216.198.56 listed in will-spam-for-food.eu.org]

[35.216.198.56 listed in will-spam-for-food.eu.org]

[35.216.198.56 listed in will-spam-for-food.eu.org]

[35.216.198.56 listed in will-spam-for-food.eu.org]

2.5 URIBL_DBL_SPAM Contains a spam URL listed in the DBL blocklist

[URI: ajie168.com]

-0.0 SPF_HELO_PASS SPF: HELO matches SPF record

-0.0 SPF_PASS SPF: sender matches SPF record

-0.0 T_RP_MATCHES_RCVD Envelope sender domain matches handover relay

domain

2.3 MANGLED_ACTVTY BODY: mangled activity

2.3 MANGLED_INCLDN BODY: mangled including

2.3 MANGLED_ACCNT BODY: mangled account(s)

2.3 MANGLED_EMAIL BODY: mangled email

2.3 MANGLED_YOUR BODY: mangled your

2.3 MANGLED_CONSLT BODY: mangled consult

1.9 URIBL_JP_SURBL Contains an URL listed in the JP SURBL blocklist

[URI: ajie168.com]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

1.7 URIBL_BLACK Contains an URL listed in the URIBL blacklist

[URI: ajie168.com]

1.9 URIBL_ABUSE_SURBL Contains an URL listed in the ABUSE SURBL blocklist

[URI: parcel.ajie168.com]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[35.216.198.56 listed in bl.score.senderscore.com]

1.5 MR_STRANGE_QUESTION URI: No description available.

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

1.5 TVD_PH_BODY_ACCOUNTS_PRE The body matches phrases such as "accounts

suspended", "account credited", "account

verification"

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

0.0 T_FILL_THIS_FORM_SHORT Fill in a short form with personal information

Subject: {SPAM?} [Account Continuity] Cross-Border Settlement Declaration and

Inactivity Status Review



Account Continuity  |  Cross-Border Settlement  |  Activity Status  |  Compliance

ACCOUNT CONTINUITY REVIEW

Cross-Border Settlement Declarat​ion

and Inactivity Status Review

Scheduled Account Maintenance — Mid-Year Review Cycle



doctor,



Interactive Brokers Canada Inc. conducts periodic reviews of client a‍ccounts to ensure continued alignm‍ent with settlement instructions,​ regulatory declarations, and account activity standards. Your accoun​t has been identified for a combined‌ review addressing two administrat‍ive matters: cross-border currenc​y settlement configuration and acc​ount activity status verification‌.

Part One

Cross-Border CAD/USD Settlement Declaration

Canadian residents who trade securities denominated in both Canadian​ and U.S. dollars routinely engage i‍n cross-border settlement flows. M‌aintaining accurate currency sett‌lement instructions and a current C​anadian tax residency declaration‌ on file is essential for the proper processing of cross-border transactions. Outdated or incomplete settlement instructions may result in t‍rade settlement delays, unintende​d currency conversions, or process‍ing exceptions. Please verify that‌ your CAD and USD settlement prefere‌nces reflect your current intentions and that your tax residency status‍ is correctly recorded.

Part Two

Account Activity Status — Dormancy‍ Prevention Review

Accounts that exhibit extended periods without certain types of activ‍ity may be flagged for administrati‌ve review under applicable provinc‍ial unclaimed property legislatio‍n. A routine check of your account indicates that a review of your activi‌ty status and contact information i‌s advisable to ensure your account r‍emains in good standing and to preve​nt any administrative restrictions‍ related to inactivity classificat‌ion. This review is precautionary an‍d does not indicate any current limi​tation on your account.

Activity Status Summary

Account Standing — Review Recommen‍ded

A brief login and verification of yo‌ur account profile is recommended to‌ confirm your account status and ensure continuity of all services.

Account Attribute Current Status

CAD Settlement Instruction Confirmation Recommended

USD Settlement Instruction Confirmation Recommended

Canadian Tax Residency Declaratio‍n Verification Recommended

Account Activity Standing Active — Confirm Current

Contact Information (Address, Ema‍il, Telephone) Verification Recommended

Please Note: This review is administrative in na‍ture and forms part of Interactive B‌rokers Canada Inc.’s standard account maintenance pro​cedures. No immediate restrictions are in effect. Completing the revi‌ew promptly helps ensure uninterrupted access to all account services, i​ncluding trading, deposits, withd‌rawals, and currency conversion. F‌or information regarding applicable provincial unclaimed property le‍gislation, clients may wish to cons‍ult their respective provincial se‍curities regulator or legal adviso‍r.



Both review components are address‍ed through a single login session. T​he process is designed to be complet‌ed in under ten minutes. No physical‌ documents need to be submitted.

Log In to Complete Account Review



If you have updated your settlement​ instructions or confirmed your acco‍unt activity status within the past​ 90 days, your records may already be current. Please contact Client Services through the Secure Message Centre to confirm your standing befor‍e taking further action.



Yours sincerely,

Interactive Brokers Canada Inc.

Account Administration & Settlement Services



Interactive Brokers Canada Inc.  |  Dealer Member of CIRO  |  Member of CIPF



This message is an automated account administration notification sen‌t to doctor.

Please direct all inquiries throug​h the Secure Message Centre within your account portal.



© 2026 Interactive Brokers Canada In​c. All rights reserved.

WEb/SEO/App spam from microsoft Outlook

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@nk.ca

Delivery-date: Wed, 22 Jul 2026 05:35:00 -0600

Received: from mail-westus3azolkn19010018.outbound.protection.outlook.com ([52.103.23.18]:12832 helo=PH7PR06CU001.outbound.protection.outlook.com)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wmVDE-00000000KeF-47VQ

for dave@nk.ca;

Wed, 22 Jul 2026 05:34:19 -0600

ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none;

b=gILgPiFLmKB9tkpipkDQ99SCKEApPPa6MOwrks5yXjDxz3/9qSCiq2og7v1lifsXbTg4fqxxHzHlCzRistn3ZWyphjHas04a25UKw0VqytuWoe+v9Y2oIi4UHToX9vFI7Gaq8HIJB27N9hbUJkJ35ZUpkNrh+JSoCcLAAY/Hv9/l3Sl0yi0q6Bxa2aCLePZtQaGFJX8SMmjVhUEBv+86XmIjRxia3Auf5v/2lIHywWiHmXdA+8l/lBPrMqyBW9bInq5tSRq/Iy5A/S6yObrj2G0mpvXPyF3tcAGVkpLmBlPMYSnI/MxDJW2eA3bluwYNQZahjW7/Q9HZkJH1WgZgEQ==

ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;

s=arcselector10001;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1;

bh=dBtvBjwGoSVy/ozhYi6Vxio/6QJZfGPYA7ch9b4Mg9s=;

b=W11MkpEWPZEtR+GE7oxHUllHVy8D4cw8ETnhIS6g27qHSZ003Fg8F5ssi5iMVhhROUgJDiW3vBWlFQGrte2KhLuwpDKFIRb+16lzjZKTzYoYmwMz4WtiRAaUj1at2sT5tCYQgJHVa9F2FeeVZ1Qsv+rHVlo+sUDP2PcSTQlwUfqG6CP+CRGdnIjZs32EhvuUwJPUV9jRMt0POaJmWuCktp8JRc4CjEYwu8eCwxE02cJbJZnSM40cPKGyIFyiamEWkk+IFiR/7s+2LjFanN1NnPY5913dLurMubYZmmb2QA86Xx13+X6TXAXx0oam4llMVc9sBwPnv27Hzq4axBDt2g==

ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=none; dmarc=none;

dkim=none; arc=none

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=outlook.com;

s=selector1;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck;

bh=dBtvBjwGoSVy/ozhYi6Vxio/6QJZfGPYA7ch9b4Mg9s=;

b=cuvMMI6TRLdlm1AyGiMD3tWiOUrg6pNBGmFq8lUUTMxDsnGeECo/M4J/FO+fg2doH02EbtYjqOIqR/9m7XuJrlg5IL4gAKAZSlGoaQkdaDJd//uWYZZia8rlP9+RLE9fApG2KvrQ3LtVOcWDxbT433Uk847h3JqZB7jaBq01GKIBkvWVohpOELCpF3FYJWMFRrKwhjCLJDHeThqzESBaO1sYllLw1nHj7OKWXf5bHAPS2FVUdZNRX3X50idfHbqLMmaKH6qdGE+uk3JsLNAEHJO9ZJaKuwWkBC/9XO3RgTO0mh9sTnthOg77lyZ+k6oZI3Y/tmwWs7wOi27PKO0Phw==

Received: from DM6PR12MB5534.namprd12.prod.outlook.com (2603:10b6:5:20b::9) by

DS0PR12MB7630.namprd12.prod.outlook.com (2603:10b6:8:11d::6) with Microsoft

SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id

15.21.245.10; Wed, 22 Jul 2026 11:32:42 +0000

Received: from DM6PR12MB5534.namprd12.prod.outlook.com

([fe80::40b:e516:2ae9:8314]) by DM6PR12MB5534.namprd12.prod.outlook.com

([fe80::40b:e516:2ae9:8314%7]) with mapi id 15.21.0245.009; Wed, 22 Jul 2026

11:32:42 +0000

From: Mila Torres

To: Mila Torres

Subject: Re: Yes-our service details and pricing?

Thread-Topic: Yes-our service details and pricing?

Thread-Index: AQHdGSnTqMS5ihGCQkCo/VXv1QrT+LZ4I4JNgAFFtP4=

Date: Wed, 22 Jul 2026 11:32:42 +0000

Message-ID:



References:



































In-Reply-To:



Accept-Language: en-US

Content-Language: en-US

X-MS-Has-Attach:

X-MS-TNEF-Correlator:

msip_labels:

x-ms-publictraffictype: Email

x-ms-traffictypediagnostic: DM6PR12MB5534:EE_|DS0PR12MB7630:EE_

x-ms-office365-filtering-correlation-id: abc4f43b-a8ad-4b2b-aa28-08dee7e4f1b6

x-ms-exchange-slblob-mailprops:

uxBZ0XvJeHC5NqW+4n3kaiy8H436WkqZugwBeS4ehZ2ZOp3bN0xYzLspKo2IihvI8H1HPkT+xo/inQsIZDvwbQIOlkTS+kq8scMsjOCZ9N3KZ1IsC3wSWnok7LBNRhUJ7byLIfJKNODRjM6nKxmdzPGlCzYIWqLfY8xEP6YxK4mIb8X20tHnPVZjBsfF4g/YsBtXOFeWDcHTNa2WP2PDyRpFApjCLDDvyxUw/MnM4cO8aPhS1Ok2b0fkPV1HRgjAndPOR34HNggR7hO30Dl/aIstonyvIXIV3Dy+oHd9s8utoT3AjmcS0J/Mje9s6WLNhEKaLCMQJzRltQse+vB9l5yiwlguZc0JmVUw+3jt3t6t0t87dvpMSalxxHpNhNhD5jK8UmtICsEBUXHGXX8zap4bi1dKoGYS+4DHxsa6cJemsMM7xmT1Vzxk1t6EFg4d8qgElgS/i2GD0LzLj5ws2do78uLSfh3i9ErDsvg8AAbvreLx+bxdaZ1xVTKXZBI8Hgmlx2ycw+RFNOt5qf5Ag27giMtCokBKDfBZp54xPentHET5gBFE6yY3Dzq7IVt2gARziJ+oZxDbnvHImwcKHxiGm1StTClMdF4tq/TV59eEyiN3Y4vtfPXJqMs7ww8gnNXTR6PvqCCFoPLdXmbjnw==

x-microsoft-antispam:

BCL:0;ARA:14566002|4140399003|25010399006|51005399006|37102599003|22091999003|24121999003|704163111799003|2604032031799003|55001999006|31061999003|2604031031799003|15030799006|15080799012|16051099003|8062599012|8060799015|19110799012|3412199025|440099028|102099032|40105399003|26121999007|11120399003|1710799026;

x-microsoft-antispam-message-info:

=?iso-8859-1?Q?2Jy7YmeIxpFvdPvZ5PVcHAllybwWym19o26CQj0pCF8UZpaQ3G5MCPGa99?=

=?iso-8859-1?Q?0GBNgVb2taMfAC3UaqwMo/c3X0V9rkttA9NLU50IvzSOaJ9YrH2WB0Hlyy?=

=?iso-8859-1?Q?BFT6smqs1LeksADbSFSKe2+JKfUH6aAOlk1d2fRoKBo8FOQ8ijp7U/rZ9M?=

=?iso-8859-1?Q?XlBgXqvtrP5GCBJOEuNJrBAK+1s8eogkn4dmOdKeSTFV7ytWqDw9zJMYMH?=

=?iso-8859-1?Q?JTFwWViD37Pte1E0FxfWzCZkhftqgemRkfIz3OYxf/LfkL4kbvCu40h6k5?=

=?iso-8859-1?Q?LGbc1AwXvzpWnGGH5B7jyij+qY8AyEpsqCywfsznOo/qyc18zuSNjIaFD0?=

=?iso-8859-1?Q?Rz3tb23Sh8SRQOgfibOmB0CrY96NhV9+vo/CZTI8OsPnXUJjPJuPsS0Dbr?=

=?iso-8859-1?Q?msanOI2xejv4nlLrTtb2q0wY3gSQAiSAOZGdV49+UGAMZMj29hAEvxQBTI?=

=?iso-8859-1?Q?kc3UAaweX8CEoz95Si2FRQoUkFne4+q4kOdvKPzHedaNL7VwIsfp6av2QZ?=

=?iso-8859-1?Q?55dILlzqmPaLFwFR0d2ZEhs8QglZ2bkqhfBJLU8/4+ctDhsR/PeMXzbX+F?=

=?iso-8859-1?Q?aOoP1NGFZOeG84HRvLc8xCllRNV7EM4HiCBIZOtX0YWmEY8gUQKnyI+Ta7?=

=?iso-8859-1?Q?5urbsXkAFla8F8ZBFNe4ED2YqubkaKf1xWYvBVYr42YKNKW0r5fgwttouW?=

=?iso-8859-1?Q?ZrWDGVRrhbwXnxNJtozDDji+SbgRWFP97nmjCJJHvcLw1ZqslL12NTbcGR?=

=?iso-8859-1?Q?1FF5L0KM/ggr97ME44wqRKAgSdDpBGCHAJQTUswYHLBRRGq7Be+GiSODYH?=

=?iso-8859-1?Q?kIvz3Wyj1XIA4kkhX/VZ8H3ovD5AWoQ4MO+gE8PiWtNDpFet4pRgVG6ire?=

=?iso-8859-1?Q?3MFmz443/RnlL2DkzXXaOaOIJbRBucFhhvJrrwOk00r6M6KUG461QSflF8?=

=?iso-8859-1?Q?7m0cMdIiJ514F8Mez9Bc4bQiX53y/aScn/n4Y+/WLUikl95FxW7BAGoOLy?=

=?iso-8859-1?Q?XdY4YYXlcKpSa5ZgP2+5BUCMFSyqw5NJEvvEXKd9jZg61w8CSUF5GhcKzP?=

=?iso-8859-1?Q?4zvtyfBuOta3bbaU5ABQzH0KUjTsV/NtZMpetkWJMvGwQjNBnEd0DzS+R0?=

=?iso-8859-1?Q?SjXC9Zo9Uy7d12dj+W7v8Sezic0ZYaGD3n9Adeg0S0PhzxmDcoZFPu1whL?=

=?iso-8859-1?Q?n8Scdz4BDhfeG6Sr34U63DMRVpyzS9DZ85YJPzUo909ato24Dv0pRb+7uM?=

=?iso-8859-1?Q?od4+SygA0bxFr9NX32Nie96tflK1O6xH2BuBc/pFGLBLXY037Vb1+qGZSz?=

=?iso-8859-1?Q?HE26lW9DGtHY2b3704yT8FAZyGlifuFkF44YgQLKplNqQdU=3D?=

x-ms-exchange-antispam-messagedata-chunkcount: 1

x-ms-exchange-antispam-messagedata-0:

=?iso-8859-1?Q?2iRa2i0hBBzZ/SuA3GBj2al4xcb1ZHfeYBd/JVkH2HlnYhlo2CKiIklI82?=

=?iso-8859-1?Q?sPj3Bsvxott93/CwbIS3XY4HIHiIal0np40zFGQsD0mz0RF/YPxejpxoBI?=

=?iso-8859-1?Q?b7Sl8QeF/ezdsld+JriV+G46OkoWVnHaVKEbSDQhmmQXW11qzqj/7UbI/7?=

=?iso-8859-1?Q?6ipJko6NrX1b3UrBxSnnjRsb+GugisHiy8Y1+ChHrWV+x8ILIGyM9r/AoC?=

=?iso-8859-1?Q?CAcXYXCcXPsp/jWAHaPrGMhDfydOimxWah6NKdS6fhafOdJo/iTVtzTHSa?=

=?iso-8859-1?Q?ahduABN8yZdSPJlLSXJsYCaNlTJAe8V01Znpkhxu/mxGz4dwOyynVRDr/k?=

=?iso-8859-1?Q?SH2Cus7GHmGR6V3NVkH8Ji9x4Su3heKQTkZohJPFzE88cZrUOx2QuaEq8N?=

=?iso-8859-1?Q?CCGqNzIGSMo7kNXvC96bA0DOt/BuYmvnx0/Gqz0XynFX+ihaL78TkZSszW?=

=?iso-8859-1?Q?yJ6KVb07dHQG71FdSBm9tDpY5QS6Uy5gct4xolYkvdQwioWC7gD2QSGHOk?=

=?iso-8859-1?Q?8fbFgFQJhw8MPYkujPs/vlLhvPaVPqzDDgNrSUmS5Qzzww5Ix8RDx71Llk?=

=?iso-8859-1?Q?ntS1oVlKrA+83+dRtomVEJmH9UmzS0gMizh1O+EmUowjavl7xhhv2a4R/6?=

=?iso-8859-1?Q?386Kc/V+As2Qq3qNSgd83cFGyOs0wWe2JP5fQ0+5fa4VcpQAzobAdjfToa?=

=?iso-8859-1?Q?YPX5Akptbw05ztiXfblgke2b32HEa3mk+meCoUrOgRo0udxuZ2v8NIoU3Z?=

=?iso-8859-1?Q?qvCcwDWM623+n+adGN19XbhO6JmjWZfuTJusNCEAIUl5bpaB9GOCfdsrO3?=

=?iso-8859-1?Q?rGuHQq1hqltCVB+IAFHiig8og8yGJsRcEVyFDhWIymZBQyZGze9qltanLY?=

=?iso-8859-1?Q?qCyGP4rUnTu68glxy/XC70LOXpsLsLGsfZGd8qStTegVZxm3OJzWmYtNyR?=

=?iso-8859-1?Q?Te8xdkTBBLUd99MJU1xJu8moWYXmWs4Y2Cd23FQXcHeCEglsCCUO3AYJyj?=

=?iso-8859-1?Q?xNwrgIybPYwqPIngasJKpIFY4bnX5d3B5LbDZl313iuMpSAeNtO/PkpJXs?=

=?iso-8859-1?Q?wKPNFzanX2Y0qQmlx9y7AJgFF0ZdXaWJR3qbw0zVFkeG6oadn2Gb8vvo4w?=

=?iso-8859-1?Q?/WB+16QaT0DYBDAmruvm3De3rbyLGQcPV/mTd1GKP6qgBFzdQRv9BHh+m4?=

=?iso-8859-1?Q?6e1MIk9u1vEpDlXOYNaFMXK9KlMLrZ0VB70N5QnbGYDSQkBxmNmaIpJ6pO?=

=?iso-8859-1?Q?JDbI2ZNbkpwTVzZoZ7yikYKBzv3NpSrOn61x7Wcj/i0kWRH3k7gUT9xuuL?=

=?iso-8859-1?Q?gsWOHgC1Z1/j1BR5ouCekWTqg2HLfFXvBV7CMXbS3m/JbPbDSD2ZEh4wNy?=

=?iso-8859-1?Q?d6YzsSbtL1x76JQh37iOKgEMdgnuoQ/BOhJUVoTsBxHE1gx+Bjqdurk38O?=

=?iso-8859-1?Q?k2ScqMlbMurpivCXP7fOEXd+Bn8MBIS0Glgbf2ZTFtPogAPxXFCI1TbZry?=

=?iso-8859-1?Q?tQHgZCKTzseqAGpRoXRRW4?=

Content-Type: multipart/alternative;

boundary="_000_DM6PR12MB5534273E58D90D6A105FDA23DFC12DM6PR12MB5534namp_"

MIME-Version: 1.0

X-OriginatorOrg: outlook.com

X-MS-Exchange-CrossTenant-AuthAs: Internal

X-MS-Exchange-CrossTenant-AuthSource: DM6PR12MB5534.namprd12.prod.outlook.com

X-MS-Exchange-CrossTenant-RMS-PersistedConsumerOrg: 00000000-0000-0000-0000-000000000000

X-MS-Exchange-CrossTenant-Network-Message-Id: abc4f43b-a8ad-4b2b-aa28-08dee7e4f1b6

X-MS-Exchange-CrossTenant-originalarrivaltime: 22 Jul 2026 11:32:42.6519

(UTC)

X-MS-Exchange-CrossTenant-fromentityheader: Hosted

X-MS-Exchange-CrossTenant-id: 84df9e7f-e9f6-40af-b435-aaaaaaaaaaaa

X-MS-Exchange-CrossTenant-rms-persistedconsumerorg: 00000000-0000-0000-0000-000000000000

X-MS-Exchange-Transport-CrossTenantHeadersStamped: DS0PR12MB7630



--_000_DM6PR12MB5534273E58D90D6A105FDA23DFC12DM6PR12MB5534namp_

Content-Type: text/plain; charset="iso-8859-1"

Content-Transfer-Encoding: quoted-printable



Hello,

I hope you're doing well.

We provide reliable bookkeeping services to help businesses keep their fina=

ncial records accurate and organized.

Would you be interested in receiving our service details and pricing?

Best regards,



Mila



--_000_DM6PR12MB5534273E58D90D6A105FDA23DFC12DM6PR12MB5534namp_

Content-Type: text/html; charset="iso-8859-1"

Content-Transfer-Encoding: quoted-printable








1">








nt, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; c=

olor: rgb(0, 0, 0);">

Hello,



ily: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sa=

ns-serif; font-size: 12pt; color: rgb(0, 0, 0);">

I hope you're doing well.



ily: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sa=

ns-serif; font-size: 12pt; color: rgb(0, 0, 0);">

We provide reliable bookkeeping services to help businesses keep their fina=

ncial records accurate and organized.



ily: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sa=

ns-serif; font-size: 12pt; color: rgb(0, 0, 0);">

Would you be interested in receiving our service details and pricing?



ily: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sa=

ns-serif; font-size: 12pt; color: rgb(0, 0, 0);">

Best regards,



_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb=

(0, 0, 0);">







_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb=

(0, 0, 0);">

Mila








--_000_DM6PR12MB5534273E58D90D6A105FDA23DFC12DM6PR12MB5534namp_--

Web/SEO/App spam from Microsoft Outlook

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@nk.ca

Delivery-date: Wed, 22 Jul 2026 05:34:00 -0600

Received: from mail-westus3azolkn19011083.outbound.protection.outlook.com ([52.103.23.83]:65470 helo=PH0PR06CU001.outbound.protection.outlook.com)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wmVCQ-00000000KZB-2zPP

for dave@nk.ca;

Wed, 22 Jul 2026 05:33:29 -0600

ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none;

b=DaWZIM5qdvR/+OA9OFgXnG6fpwVqIEO07msfDahPUYp+Nc94z1oisKsQQhKPErZ6f3L4L/bIPML7UF4NM/7U2c1cnXKOOnRnRGAW0epcRCq/YRWGC0izdRhZbBQZ46zYQJQN0tvi51N450KrV49OZDMyAKle5oNP7k2KNBihYQN5rfcYO2e/68X9ri9DPvVa+dZZmR2MqGs5qxB73XY+t0mtxClFcQbLUcqW3n0Vy//MeFjOV5DTqyHKhLBKojqHChUuobVaKdkqtv64TlQZWgflv2k4mCl/YNusxQWgS0mu+vvesVzvak/a5IVBWHusVcybMHADT8prEW3t3IwuTw==

ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;

s=arcselector10001;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1;

bh=ZLF6W0l5LmOmyIDLVtKzYlX+IYGDybTrCZiOIb1bsB8=;

b=nLs4Tco+FVG1kzM29OSVibNnSI4V/rEgXI7bcBiwVmlj8Ie2huML96l9glx9oqcG8QVMVHdkjNv+pKaLOOsOW8+frZiRkHCLwtsOu3UnU8LCr9HKIYLfLc5AdloZiXgaVpda4KCARGW4RLB7ctFpWyC+zhUckixDxA0rwCNuGC5Xi+4yHQ206JZedyLiExVs1nB+B+zIMIyndAkEfBLOT2HpbMHw3eJy6DlUfaWE8BkGKqjB37RwLdE5Gx+84g7cZ9oQoZ2QwBoNXR5ZZgpxRuMzBDrWRECA1cB33esICW7l/lko3QRhtyC1PeTCemB8MRbRrYx63jjcCLy78Shvjg==

ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=none; dmarc=none;

dkim=none; arc=none

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=outlook.com;

s=selector1;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck;

bh=ZLF6W0l5LmOmyIDLVtKzYlX+IYGDybTrCZiOIb1bsB8=;

b=jPHMg4bZUETtCMZV6udEPffv5ugJ+RZXX16dpHTTHWaOzwJCZE3k55AsPkCBv/d47WJ/83eZ97BQUawMvm9YzqQHqKf+5feBcFenQTU1rAa9fE19kqHmJKLnj2MgNJfjvKe0N1E9u44aU7hbOg4RGQx1MojZO2hLfdh4XMW5q9JL05toN7MwxMwdtWEI4+/N/6h+XBsNbVQEpDq23eygzNoWqh3vaXKn8R5oU34cbrj41vrC5qdkJzeNeGT3IeFqruKqUThNlN3IqgNBYJZsS7nKY57eR9KbPsYqomER/GVp4FaZTz7hnsCrwRij+NR7twqEjBbNwMwUdL5ZPt58eg==

Received: from DM6PR12MB5534.namprd12.prod.outlook.com (2603:10b6:5:20b::9) by

DS0PR12MB7630.namprd12.prod.outlook.com (2603:10b6:8:11d::6) with Microsoft

SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id

15.21.245.10; Wed, 22 Jul 2026 11:32:23 +0000

Received: from DM6PR12MB5534.namprd12.prod.outlook.com

([fe80::40b:e516:2ae9:8314]) by DM6PR12MB5534.namprd12.prod.outlook.com

([fe80::40b:e516:2ae9:8314%7]) with mapi id 15.21.0245.009; Wed, 22 Jul 2026

11:32:23 +0000

From: Mila Torres

To: Mila Torres

Subject: Re: Yes-our service details and pricing?

Thread-Topic: Yes-our service details and pricing?

Thread-Index: AQHdGSnTqMS5ihGCQkCo/VXv1QrT+LZ4I4JNgAFFnBg=

Date: Wed, 22 Jul 2026 11:32:23 +0000

Message-ID:



References:



































In-Reply-To:



Accept-Language: en-US

Content-Language: en-US

X-MS-Has-Attach:

X-MS-TNEF-Correlator:

msip_labels:

x-ms-publictraffictype: Email

x-ms-traffictypediagnostic: DM6PR12MB5534:EE_|DS0PR12MB7630:EE_

x-ms-office365-filtering-correlation-id: aeb9e293-b303-4ff2-e193-08dee7e4e5fd

x-ms-exchange-slblob-mailprops:

SoURN12IA8sbSAwo+O/yKeVMY9R+GC1DTktInhEOsasAcF7Vz/h/OWu+0EoLORcebL8if9eTcgBcxVYH8A+BY3XF7gh56OxYx8qVQt5AICWKgwKk91m8bF0tHz5SzeJNRkSlpS0oRGd5evPQ34McWWorQpffTe5nl6F4n238wgMkkKQ277GJbgMBYkmfuByHeBzh/UiLsSCaK2m5Df3vlwLngjaIpCGiQLIgNNPSfe4QahvE1Glm/yEf35gHyTxPqY97n020GuYSYKJDuB0Q3n0qNZEIOgEDoQ7o8kijE/93Y+jShOiJjiV5yzGvZ+KOARD5qyYUC/+Amsz5Xc+Fsc+Eq8T+loORCfaMQp7TF8MtSIQheXLQwicstXPn8fQIO9/AzcUUD9Xfz0P+uy0jDCopAMf86Z8/b2WNjbvMMg9ll6r5QGcDeqcTa0sYiWl5jnYmZs990MdIB16IK/U4OgiatPaGzx+wJ4ozhxp8zSpnRGyftFqBWt79NoFjWBsylHLP9/tcN4RR73uMlLpWNSmwIDNLDF8Tqkw7t7Bjd6Cc9rEMZLnyEMCs+21eIdkQQUUZdKqEKQvOuXxO7+BHzycqBByPFpUZUG1LnIGTiCVDJ3Xg8pki3rOskB4EYgIYXlo+4oGMVnoF9V/HSIeZ+11Miei5AzFS

x-microsoft-antispam:

BCL:0;ARA:14566002|4140399003|25010399006|39105399006|37102599003|24071999003|22091999003|24121999003|20031999006|2604032031799003|55001999006|31061999003|2604031031799003|15030799006|15080799012|8062599012|7071999006|8060799015|19110799012|3412199025|440099028|102099032|39145399003|40105399003|26121999007|11120399003|26131999018|1710799026;

x-microsoft-antispam-message-info:

=?iso-8859-1?Q?h3FH1rgoBalBFg2iv07lTLRq3HrEzLyVP9wLsHtSbcwTBXKdKYkiu6j2NK?=

=?iso-8859-1?Q?ZKm+Dzc27jTcatqoNBY5nV4cWn6C/DJ9ViWOwBsFHDbGHQtISLjnqT0ce8?=

=?iso-8859-1?Q?bQuE1dMUmqePbI/S4C93A78lTEwimqbpul2veYNI+iAKrkUzbVqZumyQYo?=

=?iso-8859-1?Q?mWOpM1hL5Iu+MWyyW/TYW5ufwAHcEqT7KwLyGmfhLiSOt5LWYqNLgqbbop?=

=?iso-8859-1?Q?+74ViBb1oixrzITvCS3tJCzbbJflfgCwGLErd9IQK4umI8ny3XBE2YYK1I?=

=?iso-8859-1?Q?tZxehkAlRvx9G79v1nJl4/3ve/mK7XnLkfM5LV9yb/YtIm1disq7GPwkZr?=

=?iso-8859-1?Q?IlCQwRuZAkQ+h1QprIIZX6CY9LrtXoy3eMWlAl5En7PqMD/TfTi0GuXQzn?=

=?iso-8859-1?Q?t/eWH2jtayxBZvl92RkE+rWg/iW3V6jU/YQJlUzS5tAz5aNwkzouVKk5Du?=

=?iso-8859-1?Q?vU/hBB6sVXTAy2tucqSTyQwdtA82k+ubr9pVBt7PNXCH2JoHEJUseraioe?=

=?iso-8859-1?Q?sLxv03fA8MQvvsiXXbXJQe3rtLhkW3XLYaVMagJnYOrxjZMrbOB7Mlb2m/?=

=?iso-8859-1?Q?C230HtItvlXl3mI3JhBPOvsfMnWL3IDEBJmErpOBXeWkWhwtyv+x9rs8EV?=

=?iso-8859-1?Q?XxvYU8r37bsO+iAmZKgexfxwHSnAUvOwKf1Pp2UJmZRcH6lu4ZoVwvVLXb?=

=?iso-8859-1?Q?YoRdPU78JeDF383+zeAkZFc1dugFdvS99P/fx+It7NRmP6ng+WsuQbzln7?=

=?iso-8859-1?Q?0Vq0SQFX2pk5d+uC6px8qWBSn1Ykaz0ABcQXkrzx1PVZpv6mL6kZN4i1G8?=

=?iso-8859-1?Q?G6YTqukEanMiXH8r5tV7NN2WsiEfuoIXgXzv9nXkLnBsWVvkfyYhMtcJ/y?=

=?iso-8859-1?Q?hi7W48OYr1bR0PpavrIe+QBE0zIMitHZEbTC/Nvj/5Yw1oFv6iVZjqj43K?=

=?iso-8859-1?Q?zlR/MnFTDwkKAJGWmCBvLf8XWNt9tLULkQCwUGHlvfGHyvYI83RtQ8lrNK?=

=?iso-8859-1?Q?TunyTaYx6ofJ7bk67X/1XyqTINMUsfRbfjlo3OmOC4rEZHwcP0TFwN2tUP?=

=?iso-8859-1?Q?DAK9ds64liiz6Tc8/XOLlMszpe/+1CoWUGVa7Jfta9R0neL1zm8p5qfJCv?=

=?iso-8859-1?Q?SV77mL7FVeG6z8fijsxfyhmBS4/hixAfCEBjplyDGBgW786kvzQ4IzXFnX?=

=?iso-8859-1?Q?Ab0u6GVb2fUkaW0JIvY1UEYPs1VYRKEuxyrkUnGmC72k7TztBw6vZVkLx2?=

=?iso-8859-1?Q?sXWeFnDxbPxwEcBt47TLM4G50iJzYSUteoD5tDA0fi5j5dNSAJPGPzk9RN?=

=?iso-8859-1?Q?xX//FYaD6TlA/UInXGNuQzNGIBZCRgYSLUDqrph7deZA3AGCpWm5zTbN/W?=

=?iso-8859-1?Q?mCJIvj0OdCUp6WW/7FdSqqnWJGjUfwZKFxL4aEO/4JMPUHX4dP3sI=3D?=

x-ms-exchange-antispam-messagedata-chunkcount: 1

x-ms-exchange-antispam-messagedata-0:

=?iso-8859-1?Q?pjGjLbKjJdZE3qNgYR7ejViGhjt5/npLG8smVKn8UrflwM9BnaDAXRXws0?=

=?iso-8859-1?Q?qR2DOF22o2lVDx+7XB4Nh9Tfr4LCc0bPxCvQVp2CvauAYmEZk6t5mCynd/?=

=?iso-8859-1?Q?Hteb8jYEOrkHg26crlRM7FR7xOX30LAA3MBkpVaesng2F+J6TQpVU98Wa2?=

=?iso-8859-1?Q?0NgSTJLrI9QGu1Ej3VaTOGbAAs2/yhhViVJef6fAV79SMQ1GOIrGOqzcrN?=

=?iso-8859-1?Q?aVkjAwwGAtvv1STAG6kJwRvgf//wCtSKzbSqn2EEHCj5sQNT97v3bRwdOV?=

=?iso-8859-1?Q?24tyu8TTWKGeh/YW+fdACVkgnTU6itIPjsX+Xhfuh8L9DLg9XUzb5wQomq?=

=?iso-8859-1?Q?aTI6lLYl8Nq1bdw+bpYnkpxhBIQKiCAkg66gzP7mc+tWqrU6onNLRmtLF3?=

=?iso-8859-1?Q?PJ8e0MFcYV6Io5/w0AC634ZHfEFSJZ4H51X0P3myIqgLQxaVLGfb/LSQFh?=

=?iso-8859-1?Q?JIJB77gsxdgfb057kwB7m4itkoer6jUdOzuNHtCIe8UNX8zlmC4k3PKhFN?=

=?iso-8859-1?Q?cjmUwFpoLoA8saKN2alN1AMCDO5xbDwK4CcGWwMYUk4/2CKFp6rRZMWv7g?=

=?iso-8859-1?Q?jJ81AZTqvOpymJXl+dYdW5kA4s75VtYgZ6CX0WjRRbR5fJgQzmEtj2U1GX?=

=?iso-8859-1?Q?qJ6wou+nZwT2/AWvkvcWqqG8NzmJx9s9s8zVeGYWt+iTDJMs4VJGB7k5dc?=

=?iso-8859-1?Q?8FalZPeO281uRWJqRO+DThVhCaQE40d7fQ5tQaH/eygpAKLaA3NZkxTi2q?=

=?iso-8859-1?Q?mc4fsJJyQLqqm3Ju3vwoilaMVHZzg1zcn3JMfp1AUXe9M67yfq+ev3OOXL?=

=?iso-8859-1?Q?vxw5qFccaBCmZvBiMy6SkJQa22qnBCXx6mfwqwR4iJ3vHNnpyX/U0WkqOd?=

=?iso-8859-1?Q?843dQ0goTesEvWW7IlT9YyYAY54oB4Drc/YdZbpMOfu79jieDN+IEcuKZf?=

=?iso-8859-1?Q?ZbMOi2Jkzmo6flh2G0C0c52osc+cT+GvDrrn2QQ7wrs4/KSLGh1s+tH8Sq?=

=?iso-8859-1?Q?d4qKXVo1YcJCPPY7BMFLwgvgaUymUgrY8h/pf1WjIoqj7lm8ZcnK2UGLnn?=

=?iso-8859-1?Q?85OQiGgJmGLD1djb7hYyZicKbKBbyoIU4B7rB+8U0ekzToqOKycNNWXrsd?=

=?iso-8859-1?Q?g89J2G/lpEuxR2dk4q7YN6afX6sTLUixH5aMeif3qXUBPcxPFwJsb4P7la?=

=?iso-8859-1?Q?Q9kQx9+c9bqGdFPSwZr+vQSX0VVyYV44ty53doGy03xioulS4dSaDf+3Qd?=

=?iso-8859-1?Q?BgAThilrECZDJfzQxRe1tV+ux8amA/qkI0Xa0aRWScY3VEik4N5XvOGiDj?=

=?iso-8859-1?Q?rN38FhCxg4/rQHi0Rz9L++hYBkpwtzv2sPHl5aISLAPIEaaiTZt6QVcKrl?=

=?iso-8859-1?Q?y4q2y8RpGu5jjGEH3JHWfO150XzbLApQjCMC8U3baP4RzQXemxRDh59GEa?=

=?iso-8859-1?Q?p/ZkeWTzYgdgTEqcsNI8xT4K7ApenD6Bk/dmJAJMYzt0jbGhydVlVeHrRV?=

=?iso-8859-1?Q?mrgGMym/VL3w3q2+xmY5GS?=

Content-Type: multipart/alternative;

boundary="_000_DM6PR12MB5534FF602412F77653A02585DFC12DM6PR12MB5534namp_"

MIME-Version: 1.0

X-OriginatorOrg: outlook.com

X-MS-Exchange-CrossTenant-AuthAs: Internal

X-MS-Exchange-CrossTenant-AuthSource: DM6PR12MB5534.namprd12.prod.outlook.com

X-MS-Exchange-CrossTenant-RMS-PersistedConsumerOrg: 00000000-0000-0000-0000-000000000000

X-MS-Exchange-CrossTenant-Network-Message-Id: aeb9e293-b303-4ff2-e193-08dee7e4e5fd

X-MS-Exchange-CrossTenant-originalarrivaltime: 22 Jul 2026 11:32:23.0170

(UTC)

X-MS-Exchange-CrossTenant-fromentityheader: Hosted

X-MS-Exchange-CrossTenant-id: 84df9e7f-e9f6-40af-b435-aaaaaaaaaaaa

X-MS-Exchange-CrossTenant-rms-persistedconsumerorg: 00000000-0000-0000-0000-000000000000

X-MS-Exchange-Transport-CrossTenantHeadersStamped: DS0PR12MB7630



--_000_DM6PR12MB5534FF602412F77653A02585DFC12DM6PR12MB5534namp_

Content-Type: text/plain; charset="iso-8859-1"

Content-Transfer-Encoding: quoted-printable



Hello,

I hope you're doing well.

We provide reliable bookkeeping services to help businesses keep their fina=

ncial records accurate and organized.

Would you be interested in receiving our service details and pricing?

Best regards,



Mila



--_000_DM6PR12MB5534FF602412F77653A02585DFC12DM6PR12MB5534namp_

Content-Type: text/html; charset="iso-8859-1"

Content-Transfer-Encoding: quoted-printable








1">








nt, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; c=

olor: rgb(0, 0, 0);">

Hello,



ily: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sa=

ns-serif; font-size: 12pt; color: rgb(0, 0, 0);">

I hope you're doing well.



ily: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sa=

ns-serif; font-size: 12pt; color: rgb(0, 0, 0);">

We provide reliable bookkeeping services to help businesses keep their fina=

ncial records accurate and organized.



ily: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sa=

ns-serif; font-size: 12pt; color: rgb(0, 0, 0);">

Would you be interested in receiving our service details and pricing?



ily: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sa=

ns-serif; font-size: 12pt; color: rgb(0, 0, 0);">

Best regards,



_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb=

(0, 0, 0);">







_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb=

(0, 0, 0);">

Mila








--_000_DM6PR12MB5534FF602412F77653A02585DFC12DM6PR12MB5534namp_--

Nigerian deliver spam from Google Gmail

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Wed, 22 Jul 2026 01:11:00 -0600

Received: from mail-pz2-f1.google.com ([74.125.228.1]:48740)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wmR6O-000000000Rs-1vb5

for dave@doctor.nl2k.ab.ca;

Wed, 22 Jul 2026 01:10:57 -0600

Received: by mail-pz2-f1.google.com with SMTP id 41be03b00d2f7-ca7d1dc4554so6139297a12.1

for ; Wed, 22 Jul 2026 00:10:00 -0700 (PDT)

ARC-Seal: i=1; a=rsa-sha256; t=1784704195; cv=none;

d=google.com; s=arc-20260327;

b=YEJwzuYJE8sCl/3zss9+vzIxzShN2GeXeKi8ZHVHXq9LoAFBBhyH40xCiR4+poA7nb

Jh7mG2/ua2KOKxrt6WvUh0c6wCbmqx5lkwoAVl/jAjPe+inA/xOJ5XTQa27Kx+Pyz4v6

/bOQICRU8W33MsyB1Ilc/BR0q9ma+IK6ppFM3xNT8f7lL5pRzso2HxjStsjnb1MxgEHQ

1ozTF1YBz/6474YzSWyFzdrUDa5LS77r2s8MUoEO+QJ7lYsHSK/17fLXyfenRu8aEGkb

JR6ozzQLX4QnVnrhWHxS7lnVDQOPLykuR3sgjjlYJmypp8+QNpDQO7k1XQHbUr5otLQu

8GUw==

ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20260327;

h=to:subject:message-id:date:from:reply-to:mime-version

:dkim-signature;

bh=kko0BK5YtWorimv1dVq4gjTYhiJhBHtmF0d7CAUex30=;

fh=DbbaVDoJKgdxC8w815FSah9tjzdYt66JZPY0BdAMIAQ=;

b=KGD5ouTvQ6bXDgzxLRhhDEJFb179+CY9Kf0UAvPN95cQPvsxPU3tv8OdjfeDa3gjch

78PjKa24ggEKrMZInAKCGEnY/5prqPMZs1GHbjLEWzNObw5qZf4dU7wCxnGh7xOXFZf1

ncUTrBxmBOXd0OJHCrvGiRD7y0XuZH3EOT0jvGTs48YVKaEyOh1o1RrsS2AQNv+71zsl

o9XakWw41xChIk1g0lMOD5d5h2PZy9S59Ee+n4kc5xAHb/TvzTMDF7GeONWBWlMQ/xQQ

YArZ1ixljYhD6aD5n72w0s7LcEDwlGdySauzVGXyOdCxTbIUZnBtOGMxl4IfTk3H5/Al

UDAw==;

darn=doctor.nl2k.ab.ca

ARC-Authentication-Results: i=1; mx.google.com; arc=none

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=madrasah.kemenag.go.id; s=google; t=1784704195; x=1785308995; darn=doctor.nl2k.ab.ca;

h=content-type:to:subject:message-id:date:from:reply-to:mime-version

:from:to:cc:subject:date:message-id:reply-to:content-type;

bh=kko0BK5YtWorimv1dVq4gjTYhiJhBHtmF0d7CAUex30=;

b=oVoIVr622Vkoj6rStU3FNtlM4mSo9ejo/isHtF0xnKVVctl4eZb+lAwWrsAuPe8Q+2

LvLmamRP62odm/tFDYM+ychEGmFz+x4+Fi5xsfnVQDxfsuN21Bzt0xO/WsaLmVAMOrah

fQELgjSjJQY0PA3fhsCQm0hSpR7Valy01s/vg=

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20251104; t=1784704195; x=1785308995;

h=content-type:to:subject:message-id:date:from:reply-to:mime-version

:x-gm-gg:x-gm-message-state:from:to:cc:subject:date:message-id

:reply-to:content-type;

bh=kko0BK5YtWorimv1dVq4gjTYhiJhBHtmF0d7CAUex30=;

b=k3K2iH2D6pyo5YrVL+oX1TIaFUOuBL8fKoiK9T/r1T7FrXQE4w24Y4RD9yxB8T83U8

hlhQjBngiHtPZJBWVIgr0K6yl5RRYPIz/drkKtxz57Am5QobeoxRTphMa4tEu1cHj4Bt

40lFLCKsu4Bp2mr7Qfuhoo1LdiVEHrfDtsVG0opoK89vDWG0JmjIxcUPuaVy+O7ZMHgv

jb4eECOCGBij/pt5FTi6AJ2fqdfUweNyrLX1PxxFpyCHRauOFuEs4s3LnMWVVl0kagpr

vaZBdH8mUKpaRS4Eu8Xz/I4KHV1uYDktz7Gy06/AKz0Mhn43DyzusxjTzh6bX/EAB0l9

jcmg==

X-Forwarded-Encrypted: i=1; AHgh+Ro00rlJcHMP6/gQ4oBGGIrGa+23HQi3zxYq6URRT3kqtlDs6LSPgXQsv2vYsSC6q/9Gq4NW@doctor.nl2k.ab.ca

X-Gm-Message-State: AOJu0Yz1fVV9xzu///kAPfDVUiKzkiqE1jFWp6zZF6pjoyRyGSyFirq0

jtAS3vaApxGu7EtrlYNp6/WPrtjBm3+V35vDFEbrwJJRjTM9bLx6b3XsIgH2UbyCgkLjq6rzdnJ

m9puFTWAVG7xqHyAZ1Ui7dU4s8Ntyfmguo0I8+P46khEwLubkjO77xPJGXV3Rkw1/1/EX

X-Gm-Gg: AR+sD114e811aYDdVZP3HqvbJamKP6rKRMSd8WL/tUJxREbfB56oNmwsLip0S8NamoO

aYZMCeCTlakaOzSeD+0rm2/+CIpxaFDPJcXp/5kpKaQX0C5iezOxdJH1k2BnTbZznt7WY4mepB5

9NL/zrPyLUnxqpXTcSgTSPddw79IxD13dwbH/20hZnQie4uIB0iPRwx8N9qvUdXL5qI2WSVYsz1

6L4tX126mirpue348iPK21vfbkIwPOJ0YZqUQ0tpRfXit6QIxKbjUPWW7U6mmg=

X-Received: by 2002:a05:690c:22c3:b0:7dd:3463:6872 with SMTP id

00721157ae682-81ef2805067mr72917987b3.41.1784703763028; Wed, 22 Jul 2026

00:02:43 -0700 (PDT)

MIME-Version: 1.0

Reply-To: fastshipping.delivery@aol.com

From: "Mr. Philips Udor"

Date: Wed, 22 Jul 2026 08:02:30 +0100

X-Gm-Features: AUfX_mz2LpW8S4bnBsppaUO-EcWUi2cyZ3Jy2t8k83uHRDfLyHG0231hQxV9XtA

Message-ID:

Subject: From Fast Shipping Delivery Company

To: undisclosed-recipients:;

Content-Type: multipart/alternative; boundary="000000000000d3364406572db92a"

Bcc: dave@doctor.nl2k.ab.ca

X-Spam_score: 17.0

X-Spam_score_int: 170

X-Spam_bar: +++++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Attention Please, This is to bring to your notice that we

have credited your total sum of $5.750,000.00 into an ATM VISA card and we

have deposited it with Fast Shipping Delivery Company to deliver it to you.

We paid a [...]



Content analysis details: (17.0 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[74.125.228.1 listed in dnsbl.ahbl.org]

[74.125.228.1 listed in dnsbl.ahbl.org]

[74.125.228.1 listed in dnsbl.ahbl.org]

[74.125.228.1 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[74.125.228.1 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[74.125.228.1 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[74.125.228.1 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[74.125.228.1 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[74.125.228.1 listed in will-spam-for-food.eu.org]

[74.125.228.1 listed in will-spam-for-food.eu.org]

[74.125.228.1 listed in will-spam-for-food.eu.org]

[74.125.228.1 listed in will-spam-for-food.eu.org]

[74.125.228.1 listed in will-spam-for-food.eu.org]

[74.125.228.1 listed in will-spam-for-food.eu.org]

[74.125.228.1 listed in will-spam-for-food.eu.org]

[74.125.228.1 listed in will-spam-for-food.eu.org]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[74.125.228.1 listed in list.dnswl.org]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[74.125.228.1 listed in bl.score.senderscore.com]

-0.0 SPF_PASS SPF: sender matches SPF record

1.5 GR_DOMAIN_UNDISC1 To contains undisclosed recipient (undisc)

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

2.5 US_DOLLARS_3 BODY: Mentions millions of $ ($NN,NNN,NNN.NN)

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[74.125.228.1 listed in wl.mailspike.net]

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 HK_NAME_MR_MRS No description available.

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

1.0 FREEMAIL_REPLYTO Reply-To/From or Reply-To/body contain different

freemails

2.5 FREEMAIL_FORGED_REPLYTO Freemail in Reply-To, but not From

0.0 LOTS_OF_MONEY Huge... sums of money

3.0 UNDISC_FREEM Undisclosed recipients + freemail reply-to

0.0 FILL_THIS_FORM Fill in a form with personal information

0.6 MONEY_FREEMAIL_REPTO Lots of money from someone using free email?

1.5 MONEY_ATM_CARD Lots of money on an ATM card

3.1 UNDISC_MONEY Undisclosed recipients + money/fraud signs

0.0 MONEY_FORM Lots of money if you fill out a form

Subject: {SPAM?} From Fast Shipping Delivery Company



--000000000000d3364406572db92a

Content-Type: text/plain; charset="UTF-8"



Attention Please,



This is to bring to your notice that we have credited your total sum of

$5.750,000.00 into an ATM VISA card and we have deposited it with Fast

Shipping Delivery Company to deliver it to you. We paid all the necessary

charges such as Company registration and Delivery charges of your ATM VISA

card.registration code of ( Shipment Code awb 33xzs,ATM Card Registered

Code No xgt442.Security Code sctc/2001dhx/567/;Transaction Code

233/cstc/101/33028/; Certificate Deposit code; sctc/bun/xxiv/-78/01).



Please ask The Director of Fast Shipping Delivery Company Mr. Jim Kelvin

for the tracking Number of your Package once you contact them with your

receiving details



The only money you will send to them is their security keeping fee. We

tried to pay that but they complained that they don't know when you will

contact them for the delivery and the demur-rage might have increased by

then, Please contact Mr. Jim Kelvin the Director of Fast Shipping Delivery

Company with email below ( fastshipping284@aol.com ) I deposited it on

15/07/2026. Therefore, contact them now with Your information listed below:



Your Name.....



Your Address.....



Your Country/ City.....



Your Nearest Air Port.....



Your Telephone Number:.....



Fast Shipping Delivery Company

Shipping company Office:

Name of Director: Mr. Jim Kelvin,

E-mail:( fastshipping284@aol.com )



Try and send them the security keeping fee today to avoid an increment of

the fee. Indicate these codes to prove that you are the rightful owner of

the ATM card.



Shipment Code : 33DF6

Reg No : KDR44Q

Security Code : 5673





Yours,

Mr. Philips Udor

MD/CEO, UBA)



--000000000000d3364406572db92a

Content-Type: text/html; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable



Attention Please,

This is to bring to your notice t=

hat we have credited your total sum of $5.750,000.00 into an ATM VISA card =

and we have deposited it with Fast Shipping Delivery Company to deliver it =

to you. We paid all the necessary charges such as Company registration and =

Delivery charges of your ATM VISA card.registration code of ( Shipment Code=

awb 33xzs,ATM Card Registered Code No xgt442.Security Code sctc/2001dhx/56=

7/;Transaction Code 233/cstc/101/33028/; Certificate Deposit code; sctc/bun=

/xxiv/-78/01).

Please ask The Director of Fast Shipping Delivery Co=

mpany Mr. Jim Kelvin for the tracking Number of your Package once you conta=

ct them with your receiving details

The only money you will send to =

them is their security keeping fee. We tried to pay that but they complaine=

d that they don't know when you will contact them for the delivery and =

the demur-rage might have increased by then, Please contact Mr. Jim Kelvin =

the Director of Fast Shipping Delivery Company with email below (
=3D"mailto:fastshipping284@aol.com">fastshipping284@aol.com
) I deposit=

ed it on 15/07/2026. Therefore, contact them now with Your information list=

ed below:

Your Name.....

Your Address.....

Your Countr=

y/ City.....

Your Nearest Air Port.....

Your Telephone Number=

:.....

Fast Shipping Delivery Company
Shipping company Office:
>Name of Director: Mr. Jim Kelvin,
E-mail:(
ng284@aol.com">fastshipping284@aol.com
)

Try and send them the s=

ecurity keeping fee today to avoid an increment of the fee. Indicate these =

codes to prove that you are the rightful owner of the ATM card.

Ship=

ment Code : 33DF6
Reg No : KDR44Q
Security Code : 5673


You=

rs,
Mr. Philips Udor
MD/CEO, UBA)





--000000000000d3364406572db92a--

Nigerian Delivery spam from Google Gmail

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Wed, 22 Jul 2026 01:11:00 -0600

Received: from mail-pz2-f1.google.com ([74.125.228.1]:48740)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wmR6O-000000000Rs-1vb5

for dave@doctor.nl2k.ab.ca;

Wed, 22 Jul 2026 01:10:57 -0600

Received: by mail-pz2-f1.google.com with SMTP id 41be03b00d2f7-ca7d1dc4554so6139297a12.1

for ; Wed, 22 Jul 2026 00:10:00 -0700 (PDT)

ARC-Seal: i=1; a=rsa-sha256; t=1784704195; cv=none;

d=google.com; s=arc-20260327;

b=YEJwzuYJE8sCl/3zss9+vzIxzShN2GeXeKi8ZHVHXq9LoAFBBhyH40xCiR4+poA7nb

Jh7mG2/ua2KOKxrt6WvUh0c6wCbmqx5lkwoAVl/jAjPe+inA/xOJ5XTQa27Kx+Pyz4v6

/bOQICRU8W33MsyB1Ilc/BR0q9ma+IK6ppFM3xNT8f7lL5pRzso2HxjStsjnb1MxgEHQ

1ozTF1YBz/6474YzSWyFzdrUDa5LS77r2s8MUoEO+QJ7lYsHSK/17fLXyfenRu8aEGkb

JR6ozzQLX4QnVnrhWHxS7lnVDQOPLykuR3sgjjlYJmypp8+QNpDQO7k1XQHbUr5otLQu

8GUw==

ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20260327;

h=to:subject:message-id:date:from:reply-to:mime-version

:dkim-signature;

bh=kko0BK5YtWorimv1dVq4gjTYhiJhBHtmF0d7CAUex30=;

fh=DbbaVDoJKgdxC8w815FSah9tjzdYt66JZPY0BdAMIAQ=;

b=KGD5ouTvQ6bXDgzxLRhhDEJFb179+CY9Kf0UAvPN95cQPvsxPU3tv8OdjfeDa3gjch

78PjKa24ggEKrMZInAKCGEnY/5prqPMZs1GHbjLEWzNObw5qZf4dU7wCxnGh7xOXFZf1

ncUTrBxmBOXd0OJHCrvGiRD7y0XuZH3EOT0jvGTs48YVKaEyOh1o1RrsS2AQNv+71zsl

o9XakWw41xChIk1g0lMOD5d5h2PZy9S59Ee+n4kc5xAHb/TvzTMDF7GeONWBWlMQ/xQQ

YArZ1ixljYhD6aD5n72w0s7LcEDwlGdySauzVGXyOdCxTbIUZnBtOGMxl4IfTk3H5/Al

UDAw==;

darn=doctor.nl2k.ab.ca

ARC-Authentication-Results: i=1; mx.google.com; arc=none

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=madrasah.kemenag.go.id; s=google; t=1784704195; x=1785308995; darn=doctor.nl2k.ab.ca;

h=content-type:to:subject:message-id:date:from:reply-to:mime-version

:from:to:cc:subject:date:message-id:reply-to:content-type;

bh=kko0BK5YtWorimv1dVq4gjTYhiJhBHtmF0d7CAUex30=;

b=oVoIVr622Vkoj6rStU3FNtlM4mSo9ejo/isHtF0xnKVVctl4eZb+lAwWrsAuPe8Q+2

LvLmamRP62odm/tFDYM+ychEGmFz+x4+Fi5xsfnVQDxfsuN21Bzt0xO/WsaLmVAMOrah

fQELgjSjJQY0PA3fhsCQm0hSpR7Valy01s/vg=

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20251104; t=1784704195; x=1785308995;

h=content-type:to:subject:message-id:date:from:reply-to:mime-version

:x-gm-gg:x-gm-message-state:from:to:cc:subject:date:message-id

:reply-to:content-type;

bh=kko0BK5YtWorimv1dVq4gjTYhiJhBHtmF0d7CAUex30=;

b=k3K2iH2D6pyo5YrVL+oX1TIaFUOuBL8fKoiK9T/r1T7FrXQE4w24Y4RD9yxB8T83U8

hlhQjBngiHtPZJBWVIgr0K6yl5RRYPIz/drkKtxz57Am5QobeoxRTphMa4tEu1cHj4Bt

40lFLCKsu4Bp2mr7Qfuhoo1LdiVEHrfDtsVG0opoK89vDWG0JmjIxcUPuaVy+O7ZMHgv

jb4eECOCGBij/pt5FTi6AJ2fqdfUweNyrLX1PxxFpyCHRauOFuEs4s3LnMWVVl0kagpr

vaZBdH8mUKpaRS4Eu8Xz/I4KHV1uYDktz7Gy06/AKz0Mhn43DyzusxjTzh6bX/EAB0l9

jcmg==

X-Forwarded-Encrypted: i=1; AHgh+Ro00rlJcHMP6/gQ4oBGGIrGa+23HQi3zxYq6URRT3kqtlDs6LSPgXQsv2vYsSC6q/9Gq4NW@doctor.nl2k.ab.ca

X-Gm-Message-State: AOJu0Yz1fVV9xzu///kAPfDVUiKzkiqE1jFWp6zZF6pjoyRyGSyFirq0

jtAS3vaApxGu7EtrlYNp6/WPrtjBm3+V35vDFEbrwJJRjTM9bLx6b3XsIgH2UbyCgkLjq6rzdnJ

m9puFTWAVG7xqHyAZ1Ui7dU4s8Ntyfmguo0I8+P46khEwLubkjO77xPJGXV3Rkw1/1/EX

X-Gm-Gg: AR+sD114e811aYDdVZP3HqvbJamKP6rKRMSd8WL/tUJxREbfB56oNmwsLip0S8NamoO

aYZMCeCTlakaOzSeD+0rm2/+CIpxaFDPJcXp/5kpKaQX0C5iezOxdJH1k2BnTbZznt7WY4mepB5

9NL/zrPyLUnxqpXTcSgTSPddw79IxD13dwbH/20hZnQie4uIB0iPRwx8N9qvUdXL5qI2WSVYsz1

6L4tX126mirpue348iPK21vfbkIwPOJ0YZqUQ0tpRfXit6QIxKbjUPWW7U6mmg=

X-Received: by 2002:a05:690c:22c3:b0:7dd:3463:6872 with SMTP id

00721157ae682-81ef2805067mr72917987b3.41.1784703763028; Wed, 22 Jul 2026

00:02:43 -0700 (PDT)

MIME-Version: 1.0

Reply-To: fastshipping.delivery@aol.com

From: "Mr. Philips Udor"

Date: Wed, 22 Jul 2026 08:02:30 +0100

X-Gm-Features: AUfX_mz2LpW8S4bnBsppaUO-EcWUi2cyZ3Jy2t8k83uHRDfLyHG0231hQxV9XtA

Message-ID:

Subject: From Fast Shipping Delivery Company

To: undisclosed-recipients:;

Content-Type: multipart/alternative; boundary="000000000000d3364406572db92a"

Bcc: dave@doctor.nl2k.ab.ca

X-Spam_score: 17.0

X-Spam_score_int: 170

X-Spam_bar: +++++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Attention Please, This is to bring to your notice that we

have credited your total sum of $5.750,000.00 into an ATM VISA card and we

have deposited it with Fast Shipping Delivery Company to deliver it to you.

We paid a [...]



Content analysis details: (17.0 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[74.125.228.1 listed in dnsbl.ahbl.org]

[74.125.228.1 listed in dnsbl.ahbl.org]

[74.125.228.1 listed in dnsbl.ahbl.org]

[74.125.228.1 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[74.125.228.1 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[74.125.228.1 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[74.125.228.1 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[74.125.228.1 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[74.125.228.1 listed in will-spam-for-food.eu.org]

[74.125.228.1 listed in will-spam-for-food.eu.org]

[74.125.228.1 listed in will-spam-for-food.eu.org]

[74.125.228.1 listed in will-spam-for-food.eu.org]

[74.125.228.1 listed in will-spam-for-food.eu.org]

[74.125.228.1 listed in will-spam-for-food.eu.org]

[74.125.228.1 listed in will-spam-for-food.eu.org]

[74.125.228.1 listed in will-spam-for-food.eu.org]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[74.125.228.1 listed in list.dnswl.org]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[74.125.228.1 listed in bl.score.senderscore.com]

-0.0 SPF_PASS SPF: sender matches SPF record

1.5 GR_DOMAIN_UNDISC1 To contains undisclosed recipient (undisc)

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

2.5 US_DOLLARS_3 BODY: Mentions millions of $ ($NN,NNN,NNN.NN)

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[74.125.228.1 listed in wl.mailspike.net]

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 HK_NAME_MR_MRS No description available.

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

1.0 FREEMAIL_REPLYTO Reply-To/From or Reply-To/body contain different

freemails

2.5 FREEMAIL_FORGED_REPLYTO Freemail in Reply-To, but not From

0.0 LOTS_OF_MONEY Huge... sums of money

3.0 UNDISC_FREEM Undisclosed recipients + freemail reply-to

0.0 FILL_THIS_FORM Fill in a form with personal information

0.6 MONEY_FREEMAIL_REPTO Lots of money from someone using free email?

1.5 MONEY_ATM_CARD Lots of money on an ATM card

3.1 UNDISC_MONEY Undisclosed recipients + money/fraud signs

0.0 MONEY_FORM Lots of money if you fill out a form

Subject: {SPAM?} From Fast Shipping Delivery Company



--000000000000d3364406572db92a

Content-Type: text/plain; charset="UTF-8"



Attention Please,



This is to bring to your notice that we have credited your total sum of

$5.750,000.00 into an ATM VISA card and we have deposited it with Fast

Shipping Delivery Company to deliver it to you. We paid all the necessary

charges such as Company registration and Delivery charges of your ATM VISA

card.registration code of ( Shipment Code awb 33xzs,ATM Card Registered

Code No xgt442.Security Code sctc/2001dhx/567/;Transaction Code

233/cstc/101/33028/; Certificate Deposit code; sctc/bun/xxiv/-78/01).



Please ask The Director of Fast Shipping Delivery Company Mr. Jim Kelvin

for the tracking Number of your Package once you contact them with your

receiving details



The only money you will send to them is their security keeping fee. We

tried to pay that but they complained that they don't know when you will

contact them for the delivery and the demur-rage might have increased by

then, Please contact Mr. Jim Kelvin the Director of Fast Shipping Delivery

Company with email below ( fastshipping284@aol.com ) I deposited it on

15/07/2026. Therefore, contact them now with Your information listed below:



Your Name.....



Your Address.....



Your Country/ City.....



Your Nearest Air Port.....



Your Telephone Number:.....



Fast Shipping Delivery Company

Shipping company Office:

Name of Director: Mr. Jim Kelvin,

E-mail:( fastshipping284@aol.com )



Try and send them the security keeping fee today to avoid an increment of

the fee. Indicate these codes to prove that you are the rightful owner of

the ATM card.



Shipment Code : 33DF6

Reg No : KDR44Q

Security Code : 5673





Yours,

Mr. Philips Udor

MD/CEO, UBA)



--000000000000d3364406572db92a

Content-Type: text/html; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable



Attention Please,

This is to bring to your notice t=

hat we have credited your total sum of $5.750,000.00 into an ATM VISA card =

and we have deposited it with Fast Shipping Delivery Company to deliver it =

to you. We paid all the necessary charges such as Company registration and =

Delivery charges of your ATM VISA card.registration code of ( Shipment Code=

awb 33xzs,ATM Card Registered Code No xgt442.Security Code sctc/2001dhx/56=

7/;Transaction Code 233/cstc/101/33028/; Certificate Deposit code; sctc/bun=

/xxiv/-78/01).

Please ask The Director of Fast Shipping Delivery Co=

mpany Mr. Jim Kelvin for the tracking Number of your Package once you conta=

ct them with your receiving details

The only money you will send to =

them is their security keeping fee. We tried to pay that but they complaine=

d that they don't know when you will contact them for the delivery and =

the demur-rage might have increased by then, Please contact Mr. Jim Kelvin =

the Director of Fast Shipping Delivery Company with email below (
=3D"mailto:fastshipping284@aol.com">fastshipping284@aol.com
) I deposit=

ed it on 15/07/2026. Therefore, contact them now with Your information list=

ed below:

Your Name.....

Your Address.....

Your Countr=

y/ City.....

Your Nearest Air Port.....

Your Telephone Number=

:.....

Fast Shipping Delivery Company
Shipping company Office:
>Name of Director: Mr. Jim Kelvin,
E-mail:(
ng284@aol.com">fastshipping284@aol.com
)

Try and send them the s=

ecurity keeping fee today to avoid an increment of the fee. Indicate these =

codes to prove that you are the rightful owner of the ATM card.

Ship=

ment Code : 33DF6
Reg No : KDR44Q
Security Code : 5673


You=

rs,
Mr. Philips Udor
MD/CEO, UBA)





--000000000000d3364406572db92a--

Canada REvenue Agency PHish from Barrcuda/Amazon

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Wed, 22 Jul 2026 07:39:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wmX9Z-00000000AGK-0ADO

for dave@doctor.nl2k.ab.ca;

Wed, 22 Jul 2026 07:38:29 -0600

Resent-From: The Doctor

Resent-Date: Wed, 22 Jul 2026 07:38:28 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from egress-ip36b.ess.ca.barracuda.com ([15.222.16.245]:53060)

by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

(Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wmWaH-000000002A3-3Cf0

for sales@nk.ca;

Wed, 22 Jul 2026 07:02:10 -0600

Received: from yk-prod-fe2.internal.messaging (s199-85-226-114.nt.northwestel.net [199.85.226.114]) by mx-outbound22-134.ca-central-1b.ess.aws.cudaops.com; Wed, 22 Jul 2026 13:01:07 +0000

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; s=northwestel;

d=northwestel.net;

h=Date:To:From:Subject:Message-Id:MIME-Version:Sender;

bh=Qt06mb5bhEhuWc1vrJR1EoGV0nOwNQwb4FPJjW4PS7M=;

b=xn6+VKc5FsHSXZUSl5HwlLopHxeJRzBjn47QaWjRm1QTCWeiiJZ0ga6uRUs6NfbpAwaPmQPt64Pj

dVLDRymqfYAXCTXfQh1bGIQkWiSbc5ILsCSjbu/x8EXkif3GudGA0QReKUqefA0XhrjJSEdNFtbY

dHp/mvwNBfx29X15+iQ+NAfjbkMyMiBVywGrbjq/qNr4xBX0UbgBathBFvbu07w0dIqB+rb41nX8

LXfZr9i/2MxiS5zwlY+YAhAv1B+fHReWfIQC5Mqctq08drP+4H8+FmW1c3VvpdzytbIQ2g0G6Kmw

4l9eweRQRQGFDm67woNnvMsroIgW+VOm7BUWKg==

MIME-version: 1.0

Content-transfer-encoding: 7BIT

Content-type: text/html

Received: from dkim-sign.northwestel.ca-daemon by

yk-prod-fe2.internal.messaging

(Oracle Communications Messaging Server 8.1.0.28.20251016 64bit (built Oct 16

2025)) id <0TIK1I4005IA6J00@yk-prod-fe2.internal.messaging> for sales@nk.ca;

Tue, 21 Jul 2026 22:01:07 -0600 (MDT)

Received: from [14.192.212.27] ([172.19.112.111])

by yk-prod-fe2.internal.messaging

(Oracle Communications Messaging Server 8.1.0.28.20251016 64bit (built Oct 16

2025)) with ESMTPA id <0TIK1H9SS5TSZD70@yk-prod-fe2.internal.messaging> for

sales@nk.ca; Tue, 21 Jul 2026 22:01:07 -0600 (MDT)

From:

"Canada Revenue Agency / Agence du Revenu du Canada"

To: sales@nk.ca

Subject:

=?UTF-8?B?UGF5bWVudCBBcHByb3ZlZCAtIENhbmFkYSBSZXZlbnVlIEFnZW5jeSAvIFBhaWVtZW50IGFwcHJvdXbDqSAtIEFnZW5jZSBkdSByZXZlbnUgZHUgQ2FuYWRh?=

Date: 21 Jul 2026 23:01:02 -0500

Message-id: <20260721230101.B6B11ED9F646409E@northwestel.net>

X-BESS-ID: 1784725267-405766-7809-82038-1

X-BESS-VER: 2019.1_20260702.2137

X-BESS-Apparent-Source-IP: 199.85.226.114

X-BESS-Parts: H4sIAAAAAAACA4uuVkqtKFGyUsooyVXSUcovVrKyNDAxBbIygILJpklGpmlJaU

lJqaYWiWkWpommRkmJJqnGSaapqUaJRkq1sQB6AOxpQQAAAA==

X-BESS-Outbound-Spam-Score: 1.00

X-BESS-Outbound-Spam-Report: Code version 3.2, rules version 3.2.2.274826 [from

cloudscan20-244.ca-central-1b.ess.aws.cudaops.com]

Rule breakdown below

pts rule name description

---- ---------------------- --------------------------------

0.00 HTML_MESSAGE BODY: HTML included in message

0.00 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.50 BSF_SC7_PS0024c META: Custom rule BSF_SC7_PS0024c

0.00 BSF_BESS_OUTBOUND META: BESS Outbound

0.50 BSF_SC5_MJ1963 META: Custom Rule MJ1963

X-BESS-Outbound-Spam-Status: SCORE=1.00 using account:ESS173759 scores of KILL_LEVEL=7.0 tests=HTML_MESSAGE, MIME_HTML_ONLY, BSF_SC7_PS0024c, BSF_BESS_OUTBOUND, BSF_SC5_MJ1963

X-BESS-BRTS-Status:1






































































































































Canada REvenue Agency Phish from Barracuda/Amazon

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Wed, 22 Jul 2026 07:39:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wmX9Z-00000000AGK-0ADO

for dave@doctor.nl2k.ab.ca;

Wed, 22 Jul 2026 07:38:29 -0600

Resent-From: The Doctor

Resent-Date: Wed, 22 Jul 2026 07:38:28 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from egress-ip36b.ess.ca.barracuda.com ([15.222.16.245]:53060)

by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

(Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wmWaH-000000002A3-3Cf0

for sales@nk.ca;

Wed, 22 Jul 2026 07:02:10 -0600

Received: from yk-prod-fe2.internal.messaging (s199-85-226-114.nt.northwestel.net [199.85.226.114]) by mx-outbound22-134.ca-central-1b.ess.aws.cudaops.com; Wed, 22 Jul 2026 13:01:07 +0000

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; s=northwestel;

d=northwestel.net;

h=Date:To:From:Subject:Message-Id:MIME-Version:Sender;

bh=Qt06mb5bhEhuWc1vrJR1EoGV0nOwNQwb4FPJjW4PS7M=;

b=xn6+VKc5FsHSXZUSl5HwlLopHxeJRzBjn47QaWjRm1QTCWeiiJZ0ga6uRUs6NfbpAwaPmQPt64Pj

dVLDRymqfYAXCTXfQh1bGIQkWiSbc5ILsCSjbu/x8EXkif3GudGA0QReKUqefA0XhrjJSEdNFtbY

dHp/mvwNBfx29X15+iQ+NAfjbkMyMiBVywGrbjq/qNr4xBX0UbgBathBFvbu07w0dIqB+rb41nX8

LXfZr9i/2MxiS5zwlY+YAhAv1B+fHReWfIQC5Mqctq08drP+4H8+FmW1c3VvpdzytbIQ2g0G6Kmw

4l9eweRQRQGFDm67woNnvMsroIgW+VOm7BUWKg==

MIME-version: 1.0

Content-transfer-encoding: 7BIT

Content-type: text/html

Received: from dkim-sign.northwestel.ca-daemon by

yk-prod-fe2.internal.messaging

(Oracle Communications Messaging Server 8.1.0.28.20251016 64bit (built Oct 16

2025)) id <0TIK1I4005IA6J00@yk-prod-fe2.internal.messaging> for sales@nk.ca;

Tue, 21 Jul 2026 22:01:07 -0600 (MDT)

Received: from [14.192.212.27] ([172.19.112.111])

by yk-prod-fe2.internal.messaging

(Oracle Communications Messaging Server 8.1.0.28.20251016 64bit (built Oct 16

2025)) with ESMTPA id <0TIK1H9SS5TSZD70@yk-prod-fe2.internal.messaging> for

sales@nk.ca; Tue, 21 Jul 2026 22:01:07 -0600 (MDT)

From:

"Canada Revenue Agency / Agence du Revenu du Canada"

To: sales@nk.ca

Subject:

=?UTF-8?B?UGF5bWVudCBBcHByb3ZlZCAtIENhbmFkYSBSZXZlbnVlIEFnZW5jeSAvIFBhaWVtZW50IGFwcHJvdXbDqSAtIEFnZW5jZSBkdSByZXZlbnUgZHUgQ2FuYWRh?=

Date: 21 Jul 2026 23:01:02 -0500

Message-id: <20260721230101.B6B11ED9F646409E@northwestel.net>

X-BESS-ID: 1784725267-405766-7809-82038-1

X-BESS-VER: 2019.1_20260702.2137

X-BESS-Apparent-Source-IP: 199.85.226.114

X-BESS-Parts: H4sIAAAAAAACA4uuVkqtKFGyUsooyVXSUcovVrKyNDAxBbIygILJpklGpmlJaU

lJqaYWiWkWpommRkmJJqnGSaapqUaJRkq1sQB6AOxpQQAAAA==

X-BESS-Outbound-Spam-Score: 1.00

X-BESS-Outbound-Spam-Report: Code version 3.2, rules version 3.2.2.274826 [from

cloudscan20-244.ca-central-1b.ess.aws.cudaops.com]

Rule breakdown below

pts rule name description

---- ---------------------- --------------------------------

0.00 HTML_MESSAGE BODY: HTML included in message

0.00 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.50 BSF_SC7_PS0024c META: Custom rule BSF_SC7_PS0024c

0.00 BSF_BESS_OUTBOUND META: BESS Outbound

0.50 BSF_SC5_MJ1963 META: Custom Rule MJ1963

X-BESS-Outbound-Spam-Status: SCORE=1.00 using account:ESS173759 scores of KILL_LEVEL=7.0 tests=HTML_MESSAGE, MIME_HTML_ONLY, BSF_SC7_PS0024c, BSF_BESS_OUTBOUND, BSF_SC5_MJ1963

X-BESS-BRTS-Status:1






































































































































Financial loan spam

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Tue, 21 Jul 2026 20:04:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wmMJ1-00000000Fj6-1lun

for dave@doctor.nl2k.ab.ca;

Tue, 21 Jul 2026 20:03:31 -0600

Resent-From: The Doctor

Resent-Date: Tue, 21 Jul 2026 20:03:31 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mta-sp-e03.commufa.jp ([106.153.250.13]:23873)

by doctor.nl2k.ab.ca with esmtp (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wmKdm-000000004sx-1ctQ

for root@doctor.nl2k.ab.ca;

Tue, 21 Jul 2026 18:16:58 -0600

Received: from mta-snd-e03.commufa.jp by mta-sp-e03.commufa.jp with ESMTP

id <20260722001559394.YROK.24460.mta-snd-e03.commufa.jp@commufa.jp>

for ; Wed, 22 Jul 2026 09:15:59 +0900

Received: from qc.commufa.jp by mta-snd-e03.commufa.jp with ESMTP

id <20260722001559052.DQHB.23855.qc.commufa.jp@commufa.jp>

for ; Wed, 22 Jul 2026 09:15:59 +0900

Reply-To: Georgeharry@arabianlnvestmentgroup.com

From: Fast & Easy Loan Opportunities Available

To: root@doctor.nl2k.ab.ca

Subject: Re: Fast & Easy Loan Opportunities Available

Date: 21 Jul 2026 19:15:58 -0500

Message-ID: <20260720174314.5CFD5AC91641C0D9@qc.commufa.jp>

MIME-Version: 1.0

Content-Type: text/html;

charset="iso-8859-1"

Content-Transfer-Encoding: quoted-printable

X-Authentication-Info: rtiz76wo

X-VirusCheck: Wed, 22 Jul 2026 09:15:59 +0900

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=qc.commufa.jp; s=default-1th84yt82rvi; t=1784679359;

bh=EYfmlQin8sfXXbeBBQNZVJtqesGGQ8czjfi7/AtsisQ=;

h=Reply-To:From:To:Subject:Date;

b=Q7oD/dfuflE/GaDhXd4J10eUjXcZNPAofpWm5okCV7wwOV0WA9Y2SZDWPRzfjoTxvdYfExX/

FEvbKun/c4m5niAjEgrzDiplpbTQ5G5T/eJjJbC/PirVlAt5RHBV4fzP4o9D0VkRqRpi2vFO3x

ELsQfg01ZFysznQMMN8j+J1oqb3QONKlOZuC+3/rOGvvtQ3HgGOdg52dkr7SfovUS0UvC4doeZ

NLbFvrYQJaaWaxBp/MVfuHNw0bOA5zxV2btiN28m/Q5Gqug1Dc1i/o/0H/sBkr0BphN/jCKg0N

5UsAE6b/2ltEM7ziMuMXzrxWzRrLZacZtyH/WUO1pP4C7Fbw==

X-Spam_score: 7.4

X-Spam_score_int: 74

X-Spam_bar: +++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Need a Loan? Fast. Simple. Reliable. Get the financial support

you need for your personal or business goals.



Content analysis details: (7.4 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[106.153.250.13 listed in dnsbl.ahbl.org]

[106.153.250.13 listed in dnsbl.ahbl.org]

[106.153.250.13 listed in dnsbl.ahbl.org]

[106.153.250.13 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[106.153.250.13 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[106.153.250.13 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[106.153.250.13 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[106.153.250.13 listed in dnsbl.ahbl.org]

1.6 RCVD_IN_BRBL_LASTEXT RBL: No description available.

[106.153.250.13 listed in bb.barracudacentral.org]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[106.153.250.13 listed in bl.score.senderscore.com]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[106.153.250.13 listed in will-spam-for-food.eu.org]

[106.153.250.13 listed in will-spam-for-food.eu.org]

[106.153.250.13 listed in will-spam-for-food.eu.org]

[106.153.250.13 listed in will-spam-for-food.eu.org]

[106.153.250.13 listed in will-spam-for-food.eu.org]

[106.153.250.13 listed in will-spam-for-food.eu.org]

[106.153.250.13 listed in will-spam-for-food.eu.org]

[106.153.250.13 listed in will-spam-for-food.eu.org]

-0.0 SPF_HELO_PASS SPF: HELO matches SPF record

-0.0 SPF_PASS SPF: sender matches SPF record

0.6 HK_RANDOM_ENVFROM Envelope sender username looks random

1.0 HK_RANDOM_FROM From username looks random

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

-0.0 T_RP_MATCHES_RCVD Envelope sender domain matches handover relay

domain

0.0 HTML_MESSAGE BODY: HTML included in message

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

1.5 VOWEL_FROM_6 Impronouncable from header (6 consecutive vowels)

Subject: {SPAM?} Re: Fast & Easy Loan Opportunities Available










LY: Verdana; WHITE-SPACE: normal; WORD-SPACING: 0px; MARGIN-TOP: 0px; TEXT-=

TRANSFORM: none; FONT-WEIGHT: 700; COLOR: rgb(58,58,58); FONT-STYLE: normal=

; TEXT-ALIGN: left; ORPHANS: 2; WIDOWS: 2; LETTER-SPACING: normal; LINE-HEI=

GHT: 1.2; TEXT-INDENT: 0px; font-variant-ligatures: normal; font-variant-ca=

ps: normal; -webkit-text-stroke-width: 0px; text-decoration-thickness: init=

ial; text-decoration-style: initial;=20

text-decoration-color: initial">
r=3D#a8b9c6>

Need a Loan?

Fast. Simple. Reliable.

Get the financial=

support you need for your personal or business goals.

Contact Arabi=

an Investment Group today to apply.

Terms and eligibility requiremen=

ts apply

Best wishes,  
Mr.George =20

Senior Consultant




remittance phish from google gmail

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Tue, 21 Jul 2026 17:49:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wmKBy-000000002KV-2fAJ

for dave@doctor.nl2k.ab.ca;

Tue, 21 Jul 2026 17:48:06 -0600

Resent-From: The Doctor

Resent-Date: Tue, 21 Jul 2026 17:48:06 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-ua1-f101.google.com ([209.85.222.101]:55788)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wmJbD-00000000OvZ-2tW0

for doctor@netknow.ca;

Tue, 21 Jul 2026 17:10:15 -0600

Received: by mail-ua1-f101.google.com with SMTP id a1e0cc1a2514c-9692373e0b1so2469459241.3

for ; Tue, 21 Jul 2026 16:09:21 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=sabeng.it; s=google; t=1784675355; x=1785280155; darn=netknow.ca;

h=content-type:mime-version:date:content-transfer-encoding:message-id

:subject:to:from:from:to:cc:subject:date:message-id:reply-to

:content-type;

bh=gtTqX7uwZlIbh+qFXRAx+1h9XmOlRP6X+7S5cGs/fow=;

b=eU9oUpf7vtS35gDX4jHasU3S9KbZNtqXUElglY3/9wifoWDh2g4TZbVgStPJrCZkyR

mfene5lgPyFBwH7/2Gox6GQZeedDTFxxhRDUnqDI1X4rqxQtgoYUQQORdhAvM3diW44k

gUqTLUahLmO4kUS/BKXIOLtT6eRpCSQgpxBy4=

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20251104; t=1784675355; x=1785280155;

h=content-type:mime-version:date:content-transfer-encoding:message-id

:subject:to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date

:message-id:reply-to:content-type;

bh=gtTqX7uwZlIbh+qFXRAx+1h9XmOlRP6X+7S5cGs/fow=;

b=dkYI2J4GKLkDkJCFXWSfWB53y+dSPrfU9pIYt0xNuwDJbpaEXsYC44oD5wkff0q0mw

iQ42uzCLA3kHvqylegZ90mMbuW/o3I1C3wydNjWSrqBm05AWurRNQlDU0z3qOsm+6O0e

lakijvE5azsaMIQ1ENREg0g01csAYJd0WapjLqLIm04DpsvKFzp4djPDgOC5glH7Kfqz

3pDgQVnod1VnLFn37WGrT4z7cYItKaKZwE6QTohl+cvJ334+7OWR9vhLzcohZfDTehLT

2bXrZ7oBvmY0Uez3BCHu0q0AISiCM6FNTk/R8By0V8kyflWgOMku+oS4joEDEvotPGee

7g4A==

X-Gm-Message-State: AOJu0YyGNNMjmuqFrq0GvU6nKED0P8n/n/e4qfBt6jIniU4s0/9jqYw3

9oh3L2ZZz4FxyuCNsMZg/Yj0zLvI5MBwZLbZg+Ul8zUROsJLLzAquQ/ZTsxRApWM2hI78txgnDk

SlXLT1IG8OhBATy5/MZCQsFsprC0pMiGZxF/bbFNSSMM4Qj4=

X-Gm-Gg: AR+sD11aVYErlu8Fav39CDJVSec+3bdVQADCWbSLWFFIojvV4s4yu2lc0JzC32RVkTj

FDnmJ0l60lxrx7GCmesN69z9MwJv6GZvf0N3RRqFvDLzGNiT1r+WmRtzNkIiDbbamP2NLWnFtbK

w8qx4vK/9mpNcMggQ/Qj3mZ50r40fWl26DbzPH9Oj7+GkzVizEhT0NYgRRzXi5xvVN0svpDVHU2

QtLOz1JB9BxhHNylddZawgJyt9A0MICKDUtz52wf47ynfnkZwqwx+HAQ+3L/HJX3wTnxZR8a0Ox

/lBwIBwgAebpokuMefxTmvbjjaBivoKxbN98R3VAgoShqQIb3cxTmrxnKiYIii4PRF8uyuXTAIw

3GDxVDuFGuSk=

X-Received: by 2002:a05:6102:3e27:b0:73e:5068:824d with SMTP id ada2fe7eead31-747536302fdmr6501388137.14.1784675354565;

Tue, 21 Jul 2026 16:09:14 -0700 (PDT)

Received: from sabprogetti.com ([192.210.236.148])

by smtp-relay.gmail.com with ESMTPS id ada2fe7eead31-74ad324790dsm86320137.12.2026.07.21.16.09.14

for

(version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256);

Tue, 21 Jul 2026 16:09:14 -0700 (PDT)

X-Relaying-Domain: sabeng.it

From: "alert@remittance.com | EFT Portal/OU=EXCHANGE ADMINISTRATIVE GROUP

(FYDIBOHF23SPDLT)/CN=RECIPIENTS/CN=B7A707497B564FD-04804"



To: doctor@netknow.ca

Subject: =?UTF-8?Q?ACH_Payment_Activity_Report_=EF=BF=BD_Tu?=

=?UTF-8?Q?es=2C_July_12=2C_2026_=EF=BF=BD_07/21/20?=

=?UTF-8?Q?26_=EF=BF=BD_doctor=40netknow=2Eca?=

Message-ID: <173f71e5-47b6-b1e6-24b0-d2cb8e9671f0@sabeng.it>

Content-Transfer-Encoding: quoted-printable

Date: Tue, 21 Jul 2026 23:09:12 +0000

MIME-Version: 1.0

Content-Type: text/html; charset=utf-8

X-Spam_score: 8.6

X-Spam_score_int: 86

X-Spam_bar: ++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview:  Payment Due: 21/07/2026 033847 Amount Paid: $2,355.00



Content analysis details: (8.6 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.2 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a relay in bl.spamcop.net

[Blocked - see ]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[192.210.236.148 listed in dnsbl.ahbl.org]

[192.210.236.148 listed in dnsbl.ahbl.org]

[192.210.236.148 listed in dnsbl.ahbl.org]

[192.210.236.148 listed in dnsbl.ahbl.org]

[209.85.222.101 listed in dnsbl.ahbl.org]

[209.85.222.101 listed in dnsbl.ahbl.org]

[209.85.222.101 listed in dnsbl.ahbl.org]

[209.85.222.101 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[192.210.236.148 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[192.210.236.148 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[192.210.236.148 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[192.210.236.148 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[192.210.236.148 listed in will-spam-for-food.eu.org]

[192.210.236.148 listed in will-spam-for-food.eu.org]

[192.210.236.148 listed in will-spam-for-food.eu.org]

[192.210.236.148 listed in will-spam-for-food.eu.org]

[192.210.236.148 listed in will-spam-for-food.eu.org]

[192.210.236.148 listed in will-spam-for-food.eu.org]

[192.210.236.148 listed in will-spam-for-food.eu.org]

[192.210.236.148 listed in will-spam-for-food.eu.org]

[209.85.222.101 listed in will-spam-for-food.eu.org]

[209.85.222.101 listed in will-spam-for-food.eu.org]

[209.85.222.101 listed in will-spam-for-food.eu.org]

[209.85.222.101 listed in will-spam-for-food.eu.org]

[209.85.222.101 listed in will-spam-for-food.eu.org]

[209.85.222.101 listed in will-spam-for-food.eu.org]

[209.85.222.101 listed in will-spam-for-food.eu.org]

[209.85.222.101 listed in will-spam-for-food.eu.org]

2.5 URIBL_DBL_SPAM Contains a spam URL listed in the DBL blocklist

[URI: aerrixon.com]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[209.85.222.101 listed in list.dnswl.org]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-0.0 SPF_PASS SPF: sender matches SPF record

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[209.85.222.101 listed in bl.score.senderscore.com]

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[209.85.222.101 listed in wl.mailspike.net]

0.0 HTML_MESSAGE BODY: HTML included in message

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 NO_RDNS2 Sending MTA has no reverse DNS

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

2.0 RATWR8_MESSID Message-ID with excessive dashes and dollars

0.6 HTML_MIME_NO_HTML_TAG HTML-only message, but there is no HTML tag

0.0 LOTS_OF_MONEY Huge... sums of money

Subject: {SPAM?} =?UTF-8?Q?ACH_Payment_Activity_Report_=EF=BF=BD_Tu?=

=?UTF-8?Q?es=2C_July_12=2C_2026_=EF=BF=BD_07/21/20?=

=?UTF-8?Q?26_=EF=BF=BD_doctor=40netknow=2Eca?=



=EF=BB=BF


 




, 255, 255);color:rgb(34, 34, 34);font-family:Arial, Helvetica, =

sans-serif;font-size:small;font-style:normal;font-variant-caps:normal;font-=

variant-ligatures:normal;font-weight:400;letter-spacing:normal;orphans:2;te=

xt-align:start;text-decoration-color:initial;text-decoration-style:initial;=

text-decoration-thickness:initial;text-indent:0px;text-transform:none;white=

-space:normal;widows:2;word-spacing:0px;" type=3D"cite">




t;" id=3D"m_-2910760642012011069m_467061415371348611m_4273285105508718137m_=

-599886662404354667editbody1">


7061415371348611m_4273285105508718137m_-599886662404354667v1editbody1">


m_467061415371348611m_4273285105508718137m_-599886662404354667v1v1editbody1=

">






-width:0px;font-family:Arial, Helvetica, sans-serif;font-feature-settings:&=

quot;liga" 0;font-size:small;line-height:normal;" cellspacing=3D"0" =

width=3D"553">




























10, 139, 168);border-width:0px;margin:0px;padding:0in;vertical-align:top;" =

colspan=3D"3">




style=3D"border-collapse:collapse;border-width:0px;font-family:-apple-syste=

m, BlinkMacSystemFont, "Helvetica Neue", "Segoe UI", =

Arial, sans-serif, "Apple Color Emoji", "Segoe UI =

Emoji", "Segoe UI Symbol";font-feature-settings:"liga&q=

uot; 0;font-size:13px;line-height:normal;" cellspacing=3D"0">




style=3D"height:5.25pt;">














style=3D"border-width:0px;height:5.25pt;margin:0px;padding:0in;"> 
>


style=3D"border-width:0px;margin:0px;padding:0in;width:0.25in;" =

width=3D"24"> 

style=3D"border-width:0px;margin:0px;padding:0in;">


style=3D"font-family:-apple-system, BlinkMacSystemFont, "Helvetica =

Neue", "Segoe UI", Arial, sans-serif, "Apple Color =

Emoji", "Segoe UI Emoji", "Segoe UI =

Symbol";margin:0px;">
sans-serif;font-size:13.5pt;">   








92, 208, 228);border-width:0px;margin:0px;padding:0in;width:1.5pt;" =

width=3D"2"> 

n:0px;padding:0in;">




style=3D"border-collapse:collapse;border-width:0px;font-family:-apple-syste=

m, BlinkMacSystemFont, "Helvetica Neue", "Segoe UI", =

Arial, sans-serif, "Apple Color Emoji", "Segoe UI =

Emoji", "Segoe UI Symbol";font-feature-settings:"liga&q=

uot; 0;font-size:13px;line-height:normal;" cellspacing=3D"0">












style=3D"background-color:rgb(230, 236, 244);border-width:0px;margin:0px;pa=

dding:0in;width:411.75pt;" width=3D"549">


class=3D"table" style=3D"width:411.75pt;">


style=3D"border-collapse:collapse;border-width:0px;font-family:-apple-syste=

m, BlinkMacSystemFont, "Helvetica Neue", "Segoe UI", =

Arial, sans-serif, "Apple Color Emoji", "Segoe UI =

Emoji", "Segoe UI Symbol";font-feature-settings:"liga&q=

uot; 0;line-height:normal;" cellspacing=3D"0" width=3D"549">

=



=



=



=



=



=



=



=



=



=



=



=



=



=



=


width=3D"24"> 

p;">

=


"Helvetica Neue", "Segoe UI", Arial, sans-serif, =

"Apple Color Emoji", "Segoe UI Emoji", "Segoe UI =

Symbol";margin:0px;">

64);font-family:Helvetica, sans-serif;font-size:13.5pt;">Payment&nb=

sp; 
 
style=3D"color:rgb(231,123,7);font-family:Helvetica, sans-serif;font-size:7=

.5pt;">Due: 21/07/2026

168);font-family:Helvetica, sans-serif;font-size:10.=

5pt;">033847



=


ttom;">

=


"Helvetica Neue", "Segoe UI", Arial, sans-serif, =

"Apple Color Emoji", "Segoe UI Emoji", "Segoe UI =

Symbol";margin:0px;text-align:right;">
62);font-family:Helvetica, sans-serif;font-size:10.5pt;">Amount =

Paid: 
 
62);font-family:Helvetica, sans-serif;font-size:22.5pt;">$2,355.=

00



=


width=3D"24"> 
=

 
=

 
=

 
=

 









system, BlinkMacSystemFont, "Helvetica Neue", "Segoe =

UI", Arial, sans-serif, "Apple Color Emoji", "Segoe UI =

Emoji", "Segoe UI Symbol";margin:0px;"> 




style=3D"width:411.75pt;">


style=3D"border-collapse:collapse;border-width:0px;font-family:-apple-syste=

m, BlinkMacSystemFont, "Helvetica Neue", "Segoe UI", =

Arial, sans-serif, "Apple Color Emoji", "Segoe UI =

Emoji", "Segoe UI Symbol";font-feature-settings:"liga&q=

uot; 0;font-size:13px;line-height:normal;" cellspacing=3D"0" =

width=3D"549">












style=3D"border-width:0px;margin:0px;padding:0in;vertical-align:top;">


class=3D"table" style=3D"width:411.75pt;">


style=3D"border-bottom-style:solid;border-bottom-width:3pt;border-collapse:=

collapse;border-color:initial;border-left-style:none;border-left-width:medi=

um;border-right-style:none;border-right-width:medium;border-top-style:none;=

border-top-width:medium;font-family:-apple-system, BlinkMacSystemFont, =

"Helvetica Neue", "Segoe UI", Arial, sans-serif, =

"Apple Color Emoji", "Segoe UI Emoji", "Segoe UI =

Symbol";font-feature-settings:"liga" 0;line-height:normal;" =

cellspacing=3D"0" width=3D"549">

=



=



=



=



=



=



=



=


"Helvetica Neue", "Segoe UI", Arial, sans-serif, =

"Apple Color Emoji", "Segoe UI Emoji", "Segoe UI =

Symbol";line-height:12pt;margin:0px;">
tica, sans-serif;font-size:10.5pt;">Hello 

style=3D"font-family:Arial, Helvetica, sans-serif;font-size:small;">Dear =

Customer,

sans-serif;font-size:10.5pt;">,



=


"Helvetica Neue", "Segoe UI", Arial, sans-serif, =

"Apple Color Emoji", "Segoe UI Emoji", "Segoe UI =

Symbol";line-height:12pt;margin:0px;"> 



=


"Helvetica Neue", "Segoe UI", Arial, sans-serif, =

"Apple Color Emoji", "Segoe UI Emoji", "Segoe UI =

Symbol";line-height:12pt;margin:0px;">
tica, sans-serif;font-size:10.5pt;">Payment has been remitted into your =

account with receipt for your reference.



=


"Helvetica Neue", "Segoe UI", Arial, sans-serif, =

"Apple Color Emoji", "Segoe UI Emoji", "Segoe UI =

Symbol";line-height:12pt;margin:0px;"> 



=


"Helvetica Neue", "Segoe UI", Arial, sans-serif, =

"Apple Color Emoji", "Segoe UI Emoji", "Segoe UI =

Symbol";line-height:12pt;margin:0px;">
(110, 139, 168);border-radius:4px;color:white;display:inline-block;font-fam=

ily:Helvetica, sans-serif;font-size:10.5pt;padding:8px =

16px;text-decoration-line:none;" href=3D"https://aerrixon.com/ss.php">VIEW =

PAYMENT RECEIPT



=


"Helvetica Neue", "Segoe UI", Arial, sans-serif, =

"Apple Color Emoji", "Segoe UI Emoji", "Segoe UI =

Symbol";line-height:12pt;margin:0px;"> 



=


"Helvetica Neue", "Segoe UI", Arial, sans-serif, =

"Apple Color Emoji", "Segoe UI Emoji", "Segoe UI =

Symbol";line-height:12pt;margin:0px;">
tica, sans-serif;font-size:10.5pt;">Thank you for your business.=



Sincerely,

Finance Department



=



=






class=3D"table">


style=3D"border-collapse:collapse;border-width:0px;font-family:-apple-syste=

m, BlinkMacSystemFont, "Helvetica Neue", "Segoe UI", =

Arial, sans-serif, "Apple Color Emoji", "Segoe UI =

Emoji", "Segoe UI Symbol";font-feature-settings:"liga&q=

uot; 0;line-height:normal;" cellspacing=3D"0">

=



=



=



=



=



=

=

 









92, 208, 228);border-width:0px;margin:0px;padding:0in;width:1.5pt;" =

width=3D"2"> 

1, 50, 70);border-width:0px;margin:0px;padding:0in;" colspan=3D"3">


system, BlinkMacSystemFont, "Helvetica Neue", "Segoe =

UI", Arial, sans-serif, "Apple Color Emoji", "Segoe UI =

Emoji", "Segoe UI Symbol";margin:0px;text-align:right;">&nbs=

p;



















remittance phish from Google Gmail

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Tue, 21 Jul 2026 17:49:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wmKBy-000000002KV-2fAJ

for dave@doctor.nl2k.ab.ca;

Tue, 21 Jul 2026 17:48:06 -0600

Resent-From: The Doctor

Resent-Date: Tue, 21 Jul 2026 17:48:06 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-ua1-f101.google.com ([209.85.222.101]:55788)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wmJbD-00000000OvZ-2tW0

for doctor@netknow.ca;

Tue, 21 Jul 2026 17:10:15 -0600

Received: by mail-ua1-f101.google.com with SMTP id a1e0cc1a2514c-9692373e0b1so2469459241.3

for ; Tue, 21 Jul 2026 16:09:21 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=sabeng.it; s=google; t=1784675355; x=1785280155; darn=netknow.ca;

h=content-type:mime-version:date:content-transfer-encoding:message-id

:subject:to:from:from:to:cc:subject:date:message-id:reply-to

:content-type;

bh=gtTqX7uwZlIbh+qFXRAx+1h9XmOlRP6X+7S5cGs/fow=;

b=eU9oUpf7vtS35gDX4jHasU3S9KbZNtqXUElglY3/9wifoWDh2g4TZbVgStPJrCZkyR

mfene5lgPyFBwH7/2Gox6GQZeedDTFxxhRDUnqDI1X4rqxQtgoYUQQORdhAvM3diW44k

gUqTLUahLmO4kUS/BKXIOLtT6eRpCSQgpxBy4=

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20251104; t=1784675355; x=1785280155;

h=content-type:mime-version:date:content-transfer-encoding:message-id

:subject:to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date

:message-id:reply-to:content-type;

bh=gtTqX7uwZlIbh+qFXRAx+1h9XmOlRP6X+7S5cGs/fow=;

b=dkYI2J4GKLkDkJCFXWSfWB53y+dSPrfU9pIYt0xNuwDJbpaEXsYC44oD5wkff0q0mw

iQ42uzCLA3kHvqylegZ90mMbuW/o3I1C3wydNjWSrqBm05AWurRNQlDU0z3qOsm+6O0e

lakijvE5azsaMIQ1ENREg0g01csAYJd0WapjLqLIm04DpsvKFzp4djPDgOC5glH7Kfqz

3pDgQVnod1VnLFn37WGrT4z7cYItKaKZwE6QTohl+cvJ334+7OWR9vhLzcohZfDTehLT

2bXrZ7oBvmY0Uez3BCHu0q0AISiCM6FNTk/R8By0V8kyflWgOMku+oS4joEDEvotPGee

7g4A==

X-Gm-Message-State: AOJu0YyGNNMjmuqFrq0GvU6nKED0P8n/n/e4qfBt6jIniU4s0/9jqYw3

9oh3L2ZZz4FxyuCNsMZg/Yj0zLvI5MBwZLbZg+Ul8zUROsJLLzAquQ/ZTsxRApWM2hI78txgnDk

SlXLT1IG8OhBATy5/MZCQsFsprC0pMiGZxF/bbFNSSMM4Qj4=

X-Gm-Gg: AR+sD11aVYErlu8Fav39CDJVSec+3bdVQADCWbSLWFFIojvV4s4yu2lc0JzC32RVkTj

FDnmJ0l60lxrx7GCmesN69z9MwJv6GZvf0N3RRqFvDLzGNiT1r+WmRtzNkIiDbbamP2NLWnFtbK

w8qx4vK/9mpNcMggQ/Qj3mZ50r40fWl26DbzPH9Oj7+GkzVizEhT0NYgRRzXi5xvVN0svpDVHU2

QtLOz1JB9BxhHNylddZawgJyt9A0MICKDUtz52wf47ynfnkZwqwx+HAQ+3L/HJX3wTnxZR8a0Ox

/lBwIBwgAebpokuMefxTmvbjjaBivoKxbN98R3VAgoShqQIb3cxTmrxnKiYIii4PRF8uyuXTAIw

3GDxVDuFGuSk=

X-Received: by 2002:a05:6102:3e27:b0:73e:5068:824d with SMTP id ada2fe7eead31-747536302fdmr6501388137.14.1784675354565;

Tue, 21 Jul 2026 16:09:14 -0700 (PDT)

Received: from sabprogetti.com ([192.210.236.148])

by smtp-relay.gmail.com with ESMTPS id ada2fe7eead31-74ad324790dsm86320137.12.2026.07.21.16.09.14

for

(version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256);

Tue, 21 Jul 2026 16:09:14 -0700 (PDT)

X-Relaying-Domain: sabeng.it

From: "alert@remittance.com | EFT Portal/OU=EXCHANGE ADMINISTRATIVE GROUP

(FYDIBOHF23SPDLT)/CN=RECIPIENTS/CN=B7A707497B564FD-04804"



To: doctor@netknow.ca

Subject: =?UTF-8?Q?ACH_Payment_Activity_Report_=EF=BF=BD_Tu?=

=?UTF-8?Q?es=2C_July_12=2C_2026_=EF=BF=BD_07/21/20?=

=?UTF-8?Q?26_=EF=BF=BD_doctor=40netknow=2Eca?=

Message-ID: <173f71e5-47b6-b1e6-24b0-d2cb8e9671f0@sabeng.it>

Content-Transfer-Encoding: quoted-printable

Date: Tue, 21 Jul 2026 23:09:12 +0000

MIME-Version: 1.0

Content-Type: text/html; charset=utf-8

X-Spam_score: 8.6

X-Spam_score_int: 86

X-Spam_bar: ++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview:  Payment Due: 21/07/2026 033847 Amount Paid: $2,355.00



Content analysis details: (8.6 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.2 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a relay in bl.spamcop.net

[Blocked - see ]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[192.210.236.148 listed in dnsbl.ahbl.org]

[192.210.236.148 listed in dnsbl.ahbl.org]

[192.210.236.148 listed in dnsbl.ahbl.org]

[192.210.236.148 listed in dnsbl.ahbl.org]

[209.85.222.101 listed in dnsbl.ahbl.org]

[209.85.222.101 listed in dnsbl.ahbl.org]

[209.85.222.101 listed in dnsbl.ahbl.org]

[209.85.222.101 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[192.210.236.148 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[192.210.236.148 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[192.210.236.148 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[192.210.236.148 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[192.210.236.148 listed in will-spam-for-food.eu.org]

[192.210.236.148 listed in will-spam-for-food.eu.org]

[192.210.236.148 listed in will-spam-for-food.eu.org]

[192.210.236.148 listed in will-spam-for-food.eu.org]

[192.210.236.148 listed in will-spam-for-food.eu.org]

[192.210.236.148 listed in will-spam-for-food.eu.org]

[192.210.236.148 listed in will-spam-for-food.eu.org]

[192.210.236.148 listed in will-spam-for-food.eu.org]

[209.85.222.101 listed in will-spam-for-food.eu.org]

[209.85.222.101 listed in will-spam-for-food.eu.org]

[209.85.222.101 listed in will-spam-for-food.eu.org]

[209.85.222.101 listed in will-spam-for-food.eu.org]

[209.85.222.101 listed in will-spam-for-food.eu.org]

[209.85.222.101 listed in will-spam-for-food.eu.org]

[209.85.222.101 listed in will-spam-for-food.eu.org]

[209.85.222.101 listed in will-spam-for-food.eu.org]

2.5 URIBL_DBL_SPAM Contains a spam URL listed in the DBL blocklist

[URI: aerrixon.com]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[209.85.222.101 listed in list.dnswl.org]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-0.0 SPF_PASS SPF: sender matches SPF record

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[209.85.222.101 listed in bl.score.senderscore.com]

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[209.85.222.101 listed in wl.mailspike.net]

0.0 HTML_MESSAGE BODY: HTML included in message

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 NO_RDNS2 Sending MTA has no reverse DNS

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

2.0 RATWR8_MESSID Message-ID with excessive dashes and dollars

0.6 HTML_MIME_NO_HTML_TAG HTML-only message, but there is no HTML tag

0.0 LOTS_OF_MONEY Huge... sums of money

Subject: {SPAM?} =?UTF-8?Q?ACH_Payment_Activity_Report_=EF=BF=BD_Tu?=

=?UTF-8?Q?es=2C_July_12=2C_2026_=EF=BF=BD_07/21/20?=

=?UTF-8?Q?26_=EF=BF=BD_doctor=40netknow=2Eca?=



=EF=BB=BF


 




, 255, 255);color:rgb(34, 34, 34);font-family:Arial, Helvetica, =

sans-serif;font-size:small;font-style:normal;font-variant-caps:normal;font-=

variant-ligatures:normal;font-weight:400;letter-spacing:normal;orphans:2;te=

xt-align:start;text-decoration-color:initial;text-decoration-style:initial;=

text-decoration-thickness:initial;text-indent:0px;text-transform:none;white=

-space:normal;widows:2;word-spacing:0px;" type=3D"cite">




t;" id=3D"m_-2910760642012011069m_467061415371348611m_4273285105508718137m_=

-599886662404354667editbody1">


7061415371348611m_4273285105508718137m_-599886662404354667v1editbody1">


m_467061415371348611m_4273285105508718137m_-599886662404354667v1v1editbody1=

">






-width:0px;font-family:Arial, Helvetica, sans-serif;font-feature-settings:&=

quot;liga" 0;font-size:small;line-height:normal;" cellspacing=3D"0" =

width=3D"553">




























10, 139, 168);border-width:0px;margin:0px;padding:0in;vertical-align:top;" =

colspan=3D"3">




style=3D"border-collapse:collapse;border-width:0px;font-family:-apple-syste=

m, BlinkMacSystemFont, "Helvetica Neue", "Segoe UI", =

Arial, sans-serif, "Apple Color Emoji", "Segoe UI =

Emoji", "Segoe UI Symbol";font-feature-settings:"liga&q=

uot; 0;font-size:13px;line-height:normal;" cellspacing=3D"0">




style=3D"height:5.25pt;">














style=3D"border-width:0px;height:5.25pt;margin:0px;padding:0in;"> 
>


style=3D"border-width:0px;margin:0px;padding:0in;width:0.25in;" =

width=3D"24"> 

style=3D"border-width:0px;margin:0px;padding:0in;">


style=3D"font-family:-apple-system, BlinkMacSystemFont, "Helvetica =

Neue", "Segoe UI", Arial, sans-serif, "Apple Color =

Emoji", "Segoe UI Emoji", "Segoe UI =

Symbol";margin:0px;">
sans-serif;font-size:13.5pt;">   








92, 208, 228);border-width:0px;margin:0px;padding:0in;width:1.5pt;" =

width=3D"2"> 

n:0px;padding:0in;">




style=3D"border-collapse:collapse;border-width:0px;font-family:-apple-syste=

m, BlinkMacSystemFont, "Helvetica Neue", "Segoe UI", =

Arial, sans-serif, "Apple Color Emoji", "Segoe UI =

Emoji", "Segoe UI Symbol";font-feature-settings:"liga&q=

uot; 0;font-size:13px;line-height:normal;" cellspacing=3D"0">












style=3D"background-color:rgb(230, 236, 244);border-width:0px;margin:0px;pa=

dding:0in;width:411.75pt;" width=3D"549">


class=3D"table" style=3D"width:411.75pt;">


style=3D"border-collapse:collapse;border-width:0px;font-family:-apple-syste=

m, BlinkMacSystemFont, "Helvetica Neue", "Segoe UI", =

Arial, sans-serif, "Apple Color Emoji", "Segoe UI =

Emoji", "Segoe UI Symbol";font-feature-settings:"liga&q=

uot; 0;line-height:normal;" cellspacing=3D"0" width=3D"549">

=



=



=



=



=



=



=



=



=



=



=



=



=



=



=


width=3D"24"> 

p;">

=


"Helvetica Neue", "Segoe UI", Arial, sans-serif, =

"Apple Color Emoji", "Segoe UI Emoji", "Segoe UI =

Symbol";margin:0px;">

64);font-family:Helvetica, sans-serif;font-size:13.5pt;">Payment&nb=

sp; 
 
style=3D"color:rgb(231,123,7);font-family:Helvetica, sans-serif;font-size:7=

.5pt;">Due: 21/07/2026

168);font-family:Helvetica, sans-serif;font-size:10.=

5pt;">033847



=


ttom;">

=


"Helvetica Neue", "Segoe UI", Arial, sans-serif, =

"Apple Color Emoji", "Segoe UI Emoji", "Segoe UI =

Symbol";margin:0px;text-align:right;">
62);font-family:Helvetica, sans-serif;font-size:10.5pt;">Amount =

Paid: 
 
62);font-family:Helvetica, sans-serif;font-size:22.5pt;">$2,355.=

00



=


width=3D"24"> 
=

 
=

 
=

 
=

 









system, BlinkMacSystemFont, "Helvetica Neue", "Segoe =

UI", Arial, sans-serif, "Apple Color Emoji", "Segoe UI =

Emoji", "Segoe UI Symbol";margin:0px;"> 




style=3D"width:411.75pt;">


style=3D"border-collapse:collapse;border-width:0px;font-family:-apple-syste=

m, BlinkMacSystemFont, "Helvetica Neue", "Segoe UI", =

Arial, sans-serif, "Apple Color Emoji", "Segoe UI =

Emoji", "Segoe UI Symbol";font-feature-settings:"liga&q=

uot; 0;font-size:13px;line-height:normal;" cellspacing=3D"0" =

width=3D"549">












style=3D"border-width:0px;margin:0px;padding:0in;vertical-align:top;">


class=3D"table" style=3D"width:411.75pt;">


style=3D"border-bottom-style:solid;border-bottom-width:3pt;border-collapse:=

collapse;border-color:initial;border-left-style:none;border-left-width:medi=

um;border-right-style:none;border-right-width:medium;border-top-style:none;=

border-top-width:medium;font-family:-apple-system, BlinkMacSystemFont, =

"Helvetica Neue", "Segoe UI", Arial, sans-serif, =

"Apple Color Emoji", "Segoe UI Emoji", "Segoe UI =

Symbol";font-feature-settings:"liga" 0;line-height:normal;" =

cellspacing=3D"0" width=3D"549">

=



=



=



=



=



=



=



=


"Helvetica Neue", "Segoe UI", Arial, sans-serif, =

"Apple Color Emoji", "Segoe UI Emoji", "Segoe UI =

Symbol";line-height:12pt;margin:0px;">
tica, sans-serif;font-size:10.5pt;">Hello 

style=3D"font-family:Arial, Helvetica, sans-serif;font-size:small;">Dear =

Customer,

sans-serif;font-size:10.5pt;">,



=


"Helvetica Neue", "Segoe UI", Arial, sans-serif, =

"Apple Color Emoji", "Segoe UI Emoji", "Segoe UI =

Symbol";line-height:12pt;margin:0px;"> 



=


"Helvetica Neue", "Segoe UI", Arial, sans-serif, =

"Apple Color Emoji", "Segoe UI Emoji", "Segoe UI =

Symbol";line-height:12pt;margin:0px;">
tica, sans-serif;font-size:10.5pt;">Payment has been remitted into your =

account with receipt for your reference.



=


"Helvetica Neue", "Segoe UI", Arial, sans-serif, =

"Apple Color Emoji", "Segoe UI Emoji", "Segoe UI =

Symbol";line-height:12pt;margin:0px;"> 



=


"Helvetica Neue", "Segoe UI", Arial, sans-serif, =

"Apple Color Emoji", "Segoe UI Emoji", "Segoe UI =

Symbol";line-height:12pt;margin:0px;">
(110, 139, 168);border-radius:4px;color:white;display:inline-block;font-fam=

ily:Helvetica, sans-serif;font-size:10.5pt;padding:8px =

16px;text-decoration-line:none;" href=3D"https://aerrixon.com/ss.php">VIEW =

PAYMENT RECEIPT



=


"Helvetica Neue", "Segoe UI", Arial, sans-serif, =

"Apple Color Emoji", "Segoe UI Emoji", "Segoe UI =

Symbol";line-height:12pt;margin:0px;"> 



=


"Helvetica Neue", "Segoe UI", Arial, sans-serif, =

"Apple Color Emoji", "Segoe UI Emoji", "Segoe UI =

Symbol";line-height:12pt;margin:0px;">
tica, sans-serif;font-size:10.5pt;">Thank you for your business.=



Sincerely,

Finance Department



=



=






class=3D"table">


style=3D"border-collapse:collapse;border-width:0px;font-family:-apple-syste=

m, BlinkMacSystemFont, "Helvetica Neue", "Segoe UI", =

Arial, sans-serif, "Apple Color Emoji", "Segoe UI =

Emoji", "Segoe UI Symbol";font-feature-settings:"liga&q=

uot; 0;line-height:normal;" cellspacing=3D"0">

=



=



=



=



=



=

=

 









92, 208, 228);border-width:0px;margin:0px;padding:0in;width:1.5pt;" =

width=3D"2"> 

1, 50, 70);border-width:0px;margin:0px;padding:0in;" colspan=3D"3">


system, BlinkMacSystemFont, "Helvetica Neue", "Segoe =

UI", Arial, sans-serif, "Apple Color Emoji", "Segoe UI =

Emoji", "Segoe UI Symbol";margin:0px;text-align:right;">&nbs=

p;



















Toronto Dominion (TD) Fintrac Phish from google user

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Tue, 21 Jul 2026 17:48:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wmKBV-000000002HL-1Seg

for dave@doctor.nl2k.ab.ca;

Tue, 21 Jul 2026 17:47:37 -0600

Resent-From: The Doctor

Resent-Date: Tue, 21 Jul 2026 17:47:37 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from 91essay100.com ([35.215.11.58]:55567 helo=my.91essay100.com)

by doctor.nl2k.ab.ca with esmtp (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wmI3H-00000000Ffh-01r4

for root@nk.ca;

Tue, 21 Jul 2026 15:31:06 -0600

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; s=default; d=my.91essay100.com;

h=Content-Type:MIME-Version:From:To:Subject:Date:Message-ID;

i=marketing@ejnqir.my.91essay100.com;

bh=m8gyf0NMnfwSIp9gFIVLFX5UVmh+v6+3GDQs3K9f6oE=;

b=oc+do9yJ4zT2kPHPzbWgv0x7XgukzGYm0p/HX9sbqW3IvFnL2qQe+PlbbW35Hnl6j7sDirmY2kse

mGnZbg6GNm63naz9n/EIYZlnMWN8SZVNvKbZqy7mJWEuObU9eMMFjg51dsx/odrDBtQg3M+gm0sY

bGXaeMAJRmMYD+dwS1Gtd5baN9BCgZURaMkPhjEspSDWpG+XqFTOANUhSwHUqvx8nHJUAjnjlGko

Efl72Nzgu49tjPBvltfbqktFxUNoRFux7aQNQilydxAaUN2tLMBsq9c2FjYhrdUDesmv46zb46Q1

y71MtSnbmdm5IKm/hUG7ZPbzrZ9LcFn12fPrUA==

Content-Type: multipart/alternative;

boundary="===============8405221455944049152=="

MIME-Version: 1.0

From: =?utf-8?b?VOKAi0TigIsg4oCLU+KAi2XigItj4oCLdeKAi3LigItp4oCLdOKAi3k=?=



To: root@nk.ca

Subject: [TD Direct Investing] Compliance Alert - Mandatory FINTRAC Identity &

Beneficial Ownership Audit

Date: Tue, 21 Jul 2026 17:30:10 -0400

Message-ID: <178466941076.3999.4983478520812835849@ejnqir.my.91essay100.com>

X-Spam_score: 11.5

X-Spam_score_int: 115

X-Spam_bar: +++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: root, As a reporting entity under the Proceeds of Crime (Money

Laundering) and Terrorist Financing Act (PCMLTFA), TD Direct Investing is

required by law to conduct periodic re-verification of client identit [...]





Content analysis details: (11.5 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[35.215.11.58 listed in dnsbl.ahbl.org]

[35.215.11.58 listed in dnsbl.ahbl.org]

[35.215.11.58 listed in dnsbl.ahbl.org]

[35.215.11.58 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[35.215.11.58 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[35.215.11.58 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[35.215.11.58 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[35.215.11.58 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[35.215.11.58 listed in will-spam-for-food.eu.org]

[35.215.11.58 listed in will-spam-for-food.eu.org]

[35.215.11.58 listed in will-spam-for-food.eu.org]

[35.215.11.58 listed in will-spam-for-food.eu.org]

[35.215.11.58 listed in will-spam-for-food.eu.org]

[35.215.11.58 listed in will-spam-for-food.eu.org]

[35.215.11.58 listed in will-spam-for-food.eu.org]

[35.215.11.58 listed in will-spam-for-food.eu.org]

1.7 URIBL_BLACK Contains an URL listed in the URIBL blacklist

[URI: ajuevctekvz.top]

[URI: ahbcvichwjwim.top]

2.5 URIBL_DBL_SPAM Contains a spam URL listed in the DBL blocklist

[URI: 91essay100.com]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-0.0 SPF_HELO_PASS SPF: HELO matches SPF record

-0.0 SPF_PASS SPF: sender matches SPF record

-0.0 T_RP_MATCHES_RCVD Envelope sender domain matches handover relay

domain

2.0 PDS_OTHER_BAD_TLD Untrustworthy TLDs

[URI: www.ahbcvichwjwim.top (top)]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[35.215.11.58 listed in bl.score.senderscore.com]

1.5 MR_STRANGE_QUESTION URI: No description available.

0.0 HTML_OBFUSCATE_05_10 BODY: Message is 5% to 10% HTML obfuscation

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

1.0 VOWEL_URI_5 URI hostname with 5 consecutive vowels

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

1.5 TVD_PH_BODY_ACCOUNTS_PRE The body matches phrases such as "accounts

suspended", "account credited", "account

verification"

Subject: {SPAM?} [TD Direct Investing] Compliance Alert - Mandatory FINTRAC Identity &

Beneficial Ownership Audit



--===============8405221455944049152==

Content-Type: text/plain; charset="utf-8"

MIME-Version: 1.0

Content-Transfer-Encoding: base64



Regulatory Compliance  |  FINTRAC  |  PCMLTFA

Compliance Audit

Mandatory FINTRAC Identity &

Beneficial Ownership Verification

Reference: Proceeds of Crime (Money Laundering) and Terrorist Financing Act (PCMLTFA) — S.C. 2000, c. 17



root,



As a reporting entity under the Proceeds of Crime (Money Laundering) and Terrorist Financing Act (PCMLTFA), TD Direct Investing is required by law to conduct periodic re-verification of client identity and, where applicable, beneficial ownership information. This is a statutory obligation administered by the Financial Transactions and Reports Analysis Centre of Canada (FINTRAC) and applies to all financial entities and securities dealers operating in Canada.



TD Direct Investing has been selected for a routine FINTRAC-mandated audit cycle. As part of this process, a subset of client accounts has been flagged for identity and beneficial ownership re-verification. Your TD WebBroker account has been included in this review cohort, and updated documentation is required to complete the audit.



The re-verification process covers the following items:

1

Government-Issued Photo Identification

Confirm that the passport, driver’s licence, or provincial identification card on file is current and has not expired. A scanned or photographed copy of your current identification document may be required upon request.

2

Residential Address & Tax Residency

Verify that your current residential address in Canada is accurately recorded. For clients with cross-border indicia, confirm your country (or countries) of tax residency and provide any applicable foreign tax identification numbers.

3

Beneficial Ownership Declaration

Confirm or update your declaration regarding beneficial ownership and control structure. If you hold this account on behalf of, or for the benefit of, any other individual or entity, you must disclose the identity of each beneficial owner with 25% or more ownership or control.

4

Employment & Source of Funds Confirmation

Update your current employment information and confirm the source of funds deposited into your WebBroker account. This is a standard FINTRAC requirement for ongoing client due diligence.

⚠ Account Restriction Pending — Withdrawal Hold



Should the FINTRAC identity and beneficial ownership re-verification remain incomplete, TD Direct Investing is required, pursuant to its obligations under the PCMLTFA and FINTRAC Guideline 6A, to impose a temporary restriction on all external fund withdrawals from your TD WebBroker account. This withdrawal hold will remain in effect until the required verification is completed and approved. Internal transfers between linked TD accounts, dividend reinvestment, and securities trading within the account will not be affected by this restriction.

Regulatory Framework: PCMLTFA (S.C. 2000, c. 17) and its associated Regulations; FINTRAC Guideline 6A (Record Keeping and Client Identification for Financial Entities); FINTRAC Guideline 6B (Ongoing Monitoring and Beneficial Ownership). As a Dealer Member of CIRO, TD Direct Investing is obligated to comply with all applicable anti-money laundering and counter-terrorist financing legislation. Failure to comply with a FINTRAC audit requirement may result in regulatory sanctions against the institution and mandatory reporting obligations.



The re-verification is completed entirely online through a secure portal. It typically takes between seven and ten minutes. Your information is encrypted, stored in compliance with PIPEDA, and used exclusively for regulatory compliance and identity verification purposes.

Log In to Complete Identity Verification



If you have submitted updated identity or beneficial ownership documentation within the past 60 days, this request may have crossed with our internal processing cycle. Please contact TD Direct Investing Client Services through the Secure Message Centre for confirmation. This communication is issued pursuant to TD Direct Investing’s regulatory obligations under the PCMLTFA.



Yours truly,

TD Direct Investing

Compliance & Anti-Money Laundering Division



TD Direct Investing  |  Dealer Member of CIRO  |  Member of CIPF



This message is an automated regulatory compliance notification issued pursuant to the PCMLTFA and FINTRAC guidelines.

Please direct all inquiries through the Secure Message Centre within your WebBroker account.



© 2026 TD Direct Investing. All rights reserved. TD Direct Investing is a division of TD Waterhouse Canada Inc., a subsidiary of The Toronto-Dominion Bank.