NetKnow Corporate Blog

Apple watch paypal phish from Microsoft Outlook

Posted by Dave Yadallee on Thursday, July 30. 2026

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 30 Jul 2026 09:11:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.5 (FreeBSD))

(envelope-from )

id 1wpSPP-00000000720-0Acp

for dave@doctor.nl2k.ab.ca;

Thu, 30 Jul 2026 09:10:55 -0600

Resent-From: The Doctor

Resent-Date: Thu, 30 Jul 2026 09:10:54 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-southcentralusazlp17011026.outbound.protection.outlook.com ([40.93.14.26]:63763 helo=SN4PR0501CU005.outbound.protection.outlook.com)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.99.5 (FreeBSD))

(envelope-from )

id 1wpS4t-000000002Fz-0Q8j

for doctor@doctor.nl2k.ab.ca;

Thu, 30 Jul 2026 08:49:58 -0600

Received: from BY5PR03CA0003.namprd03.prod.outlook.com (2603:10b6:a03:1e0::13)

by CH0PR18MB4356.namprd18.prod.outlook.com (2603:10b6:610:d4::22) with

Microsoft SMTP Server (version=TLS1_2,

cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.270.12; Thu, 30 Jul

2026 14:48:42 +0000

Received: from SJ1PEPF00001CE1.namprd05.prod.outlook.com

(2603:10b6:a03:1e0:cafe::39) by BY5PR03CA0003.outlook.office365.com

(2603:10b6:a03:1e0::13) with Microsoft SMTP Server (version=TLS1_3,

cipher=TLS_AES_256_GCM_SHA384) id 15.21.270.12 via Frontend Transport; Thu,

30 Jul 2026 14:48:42 +0000

Authentication-Results: spf=pass (sender IP is 74.125.224.69)

smtp.mailfrom=gmail.com; dkim=pass (signature was verified)

header.d=google.com;dkim=pass (signature was verified)

header.d=gmail.com;dmarc=pass action=none header.from=gmail.com;compauth=pass

reason=100

Received-SPF: Pass (protection.outlook.com: domain of gmail.com designates

74.125.224.69 as permitted sender) receiver=protection.outlook.com;

client-ip=74.125.224.69; helo=mail-yx1-f69.google.com; pr=C

Received: from mail-yx1-f69.google.com (74.125.224.69) by

SJ1PEPF00001CE1.mail.protection.outlook.com (10.167.242.9) with Microsoft

SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.292.8

via Frontend Transport; Thu, 30 Jul 2026 14:48:42 +0000

X-IncomingTopHeaderMarker:

OriginalChecksum:B97BEA2483B572F4871975E87A0C1DAA81784E3537BACBFD3DCC8B2E006F2617;UpperCasedChecksum:6AA3FAD147D3EF2CA1C844820E2CE1F73612A9721EA4BC3EE191BDB93FBF32FC;SizeAsReceived:3549;Count:15

Received: by mail-yx1-f69.google.com with SMTP id 956f58d0204a3-66937c2e6d7so849921d50.0

for ; Thu, 30 Jul 2026 07:48:42 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=google.com; s=20251104; t=1785422921; x=1786027721; darn=groups.outlook.com;

h=content-type:to:from:subject:date:message-id:sender:reply-to

:mime-version:from:to:cc:subject:date:message-id:reply-to

:content-type;

bh=Lk32AcK2ToK/mn9qK0xTYMaRUNR8iCINgl5/emnvF2o=;

b=OX4Ol09P8q1tKxZF+O5u8/fUp7Fg5TjMmB7WeTcaCeakQ9+FJFa7iah4YFpwo/YL8p

++KZo8OybQawamaBFiWVWwRbOAEDdDB2gu9VO49dHW8IIYGolKgnQyx0UttlB7Ik9FZa

d8hcoK256mDUpKB72kxQrobnGKoiqqwccA4t7DGpj9BqH3DXZSbCGCzw4dHg0MpM+z53

JkuWyyZPVUSDCUgNGB6cN0SwYIuUJXk3DtfdzXLI/iF8OyT7PVm6erQmA8T1bp8Icllj

t7vNXXtElly4oKh5vriW1Wb+pOt/NpUm1OmOTsBKVGQQ3S69VWzg+Ov71uqWN4mS776Y

R/og==

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=gmail.com; s=20251104; t=1785422921; x=1786027721; darn=groups.outlook.com;

h=content-type:to:from:subject:date:message-id:sender:reply-to

:mime-version:from:to:cc:subject:date:message-id:reply-to

:content-type;

bh=Lk32AcK2ToK/mn9qK0xTYMaRUNR8iCINgl5/emnvF2o=;

b=E9pEH17xkZIOjhi7YLOBo/MsBAM0Q0blKPPYDvSKq4JZLh3cPTHsSrXWOiYyGUaXVB

4+rPDwRq76xpc1vIMpz6tjjbp920hSsDlJbf78S69oenlRhCF548jf9h0sFXrcaPJLlU

IBj5WfGGYtCUBNmdV0cw8FmEXGq/b67jNtJDvdtry3MY8uzF6m/FxM+xOIRnm7GyNDRV

d7fx+/DOr1VLcRo888A0eNwVEW0pUYyK+dW3CiAVqWeyC13gs7J/Y1vaOctMK4o67l1H

KX9dQ21W2sY0i1fTkQexZsKWnsw37xgtEx9Arw/ax7SUu6vk/9ahkt8crrcDO2rn1kj8

z9qw==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20251104; t=1785422921; x=1786027721;

h=content-type:to:from:subject:date:message-id:sender:reply-to

:mime-version:x-gm-message-state:from:to:cc:subject:date:message-id

:reply-to:content-type;

bh=Lk32AcK2ToK/mn9qK0xTYMaRUNR8iCINgl5/emnvF2o=;

b=N3PkZitGVy2tXP5ytbwELbw4ySMtfyQ+O5WZjRmD8S0ohZJn8cclgCefQA537Ttp1I

11ewCJDKd4ZYFL1eLmS+XuNPIXc0hDW7iNbowNMt3oLkc1F/KlTod92qNEKYcZNzm9PF

q6XStd5s6TwM4Mw2VtIEFvjwqEHlPRCyC9lEHMpWEchMkuBRxwt7efJai610NfluFczZ

soxXA+YPEaaGozva2t810inyGb4iuRgSNKGxGtgSj8mTZVWlMp/CoVZ6doKioctf7rY1

YdDUlBprF/qid7dWgDamQjKPZu98HTqO94tA46resy5slTog7TSYoIcbzNnBOB+XrEhM

7rng==

X-Gm-Message-State: AOJu0YxBrkDvERd2yH1Y/e2rTWGmQLTFn3VtwdP3aHWo98Sr+5SUXXc2

UPS1kowUf+HPqN7ykz19LrOvXrSrQGlx51HPhtw6xsF9pdU+x+GTG4OOkh4yQtU6rz1Iz5na7lf

XyT2e5JJtr0L1aPB4sSSoTVjjwoZ5o2sOez0=

MIME-Version: 1.0

X-Received: by 2002:a05:690e:4504:10b0:667:8b90:2e55 with SMTP id

956f58d0204a3-6692f7d7d11mr1447246d50.97.1785422921718; Thu, 30 Jul 2026

07:48:41 -0700 (PDT)

Reply-To: Haresasz Nxysarwsa

Sender: =?UTF-8?Q?Kalend=C3=A1r_Google?=

Message-ID:

Date: Thu, 30 Jul 2026 14:48:41 +0000

Subject: =?UTF-8?Q?Pozv=C3=A1nky=3A_Notification=3A_Your_auto=2Ddebit_payment_of_?=

=?UTF-8?Q?=24429=2E99_USD_is_s=2E=2E=2E_=40_=C5=A1t_30=2E_j=C3=BAl_2026_=28cynthiaperez389903=40?=

=?UTF-8?Q?groups=2Eoutlook=2Ecom=29?=

From: Haresasz Nxysarwsa

To: cynthiaperez389903@groups.outlook.com

Content-Type: multipart/mixed; boundary="00000000000005df870657d52b18"

X-IncomingHeaderCount: 15

X-EOPAttributedMessage: 0

X-EOPTenantAttributedMessage: 84df9e7f-e9f6-40af-b435-aaaaaaaaaaaa:0

X-MS-PublicTrafficType: Email

X-MS-TrafficTypeDiagnostic: SJ1PEPF00001CE1:EE_|CH0PR18MB4356:EE_

X-MS-Office365-Filtering-Correlation-Id: d9314ac5-1fc0-41f6-d3c2-08deee49a666

X-Sender-IP: 74.125.224.69

X-MS-Exchange-EOPDirect: true

X-SID-PRA: HARESSAZNZXRRSXAXZ321@GMAIL.COM

X-SID-Result: PASS

X-MS-Consumer-Group-Expansion-Loop: cynthiaperez389903@groups.outlook.com

X-MS-Exchange-Group-Expansion-Loop: cynthiaperez389903@groups.outlook.com

X-Microsoft-Antispam:

BCL:0;ARA:1444111002|34130799006|3069299007|32020799003|970799063|24102599021|6019299003|9000799056|1680799066|5139299004|26130799012|29080799009|4040799016|9020799019|6092099016|9400799043|3151999006|1041999012|1602099012|30041999003|22062799003|2607281247196005|2145499017|18021999003|1380799030|1360799030|1370799030|440099028|4302099013|3412199025|26104999009;

X-Microsoft-Antispam-Message-Info:

=?utf-8?B?blFGdW1xRUNtMnZ6TTNoajNxZncrSDdUeWp0bk4wOHdkWFBnOG5XV2tHSUti?=

=?utf-8?B?RnRQUlVnV2ZnN1h5NjNYWStsbjFuSklQeFJ0V2w2NEJCeFRFeGJaeExKdmcr?=

=?utf-8?B?Vk90MHlCYzFqYnN0c1BaNERkWC9wRXZJeFZDY0NFU2p1NTNIU0Y1YTZhWTYz?=

=?utf-8?B?L296NGsrWlZkci9ZK0N0Wm05UjBIbUpIQy9NbDl2dWFJU2M4VFZHejBaNjNr?=

=?utf-8?B?TzRmTEdEb2J0V2NwNmcrY3hEcG4zV2FVWXpWNmZ0ZHE2VWpSVFpxcVMxQytG?=

=?utf-8?B?c1NKM0FCcGhUZjRZUDdIK3ZXNHJVdmhIZEpwa1VUcUNLVjBJaE5zU1VlM1ow?=

=?utf-8?B?biswaytMWjlKY25HMitMWmpDNTZSSldqWXRic3NEeVR4TEdERnIzb3FQMzRq?=

=?utf-8?B?NGF3Z21kS25uSVFIWENDNTFNUkR4WEt4bEEyU1ZnTUx2NHo4VmpldGlRVjFi?=

=?utf-8?B?NWVENnMzaE1GUWNjdjh6dlZBMTRHc01BTDhqa3A0aFhGcFFvNWRSa0dnSlBi?=

=?utf-8?B?cTdZSFFBT2ZrcDFoYy9GbFNmQlJXS0NZNXVpdnQ5c0RnMy9GOEVwcEhyTm1Y?=

=?utf-8?B?WHdvSDl3Y1RLbnF2dUJYQXlyWVJJYWhQZWFiUktzalRNV3hLMFhoeDJEMUgx?=

=?utf-8?B?T0MycnBDRldUaUhoU1grTjNFK0VIK2RvcTk5TlJrcFRKR05YclJsTThVUmZ4?=

=?utf-8?B?SmNXM0RwL1Z3RXNGQTQ1c0dmN2praSt6N3FIdUNKdjNYN3c2TkxaYUJCTVAy?=

=?utf-8?B?RDFpWUNqTVV2N29NZmo3NFIxSzlVVWdBWU4rbjZBanVwQjFLdm9MU0xPMXFm?=

=?utf-8?B?ZVBXTGdwNXNkbC8zS3l2NHZlc2QyUWk5SDEwRThFeU5MM2xMcVdsTlU2elND?=

=?utf-8?B?QlBaZHdVQ1dOdnVORTVVZm1SMXNEVXJYTlk2VzB2S0d5dFBZZ3pMdGtOS3FP?=

=?utf-8?B?dld3RVoyaCtkbzdOcnFrL0xoRFZZdGFoUjB3ZXo3NWRSSWpCUEc3NGpWSkJi?=

=?utf-8?B?aHA1bjg5VjRoNGRTUGRhNW54L0Z2N05yRVVNUU5GNXZHOFlNWnBweUNhSStq?=

=?utf-8?B?dm9QTk1mMlZkc0pPMDVmT3piWjgyc3d6b1JDR2szelp5cmh3VWVLY1U3WHJQ?=

=?utf-8?B?MU9pWHFRTDlZcjdTdy9vc2lDd0tRdVZQZVRPWFFqTGVjbDk1elVtUGJVQjUy?=

=?utf-8?B?WTZXbStQam82SDJvMmxWTUorbkREMnZHSmFoQmRERTVubTBNRkNaVE5nLzNx?=

=?utf-8?B?UkJwSFVFNHFldVRPNmg2TmxoMUNXVEd5VWo0OGdkYnE2NG9GMVlnUTBJVFZw?=

=?utf-8?B?RjNrMTJJRVlRTTJiZ0JaemJoRHVRSXVGVVJ3d3VsQUJGeXczVktHUFhkQjBZ?=

=?utf-8?B?RStPOVNoNEJnNFZINGFvNi9abWp2Ky9GOVVUYWl5OUtkT3hTWnZuT2NEdyt5?=

=?utf-8?B?S0RqQlh2ZmM5M21rVWZUcnZueDlCR05SamIzVHdrdzZmdHdaclFRUXdaSVQw?=

=?utf-8?B?ajJTTDZLQ0tVM3IyY0xhOERZbkdsSUY0azcxKzBjdXhCQXJ3dXhiKzBKMHZq?=

=?utf-8?B?Vm5HRGZUOTZOZmorMy9YSWdVeStGaVNKQ3ZDMGkwY1NKMmd1SkorZlBaN2g2?=

=?utf-8?B?Z1JoRXJMU2E2VUlCRStvWm1nT2Q2YzVzR3FtY0FwV0ZWSHhiVGpKYWxwdHl3?=

=?utf-8?B?NU9qUDVWeU1paENSOThrY0NsUTk1WWN6OG5pbjVmQjM2TmltbGdjYkxPeklE?=

=?utf-8?B?V3pEdTc4Qll4S29XdWsrbElEQUtROEZjOWVqc0tRN3BPZzVucTQvYWZFVXFC?=

=?utf-8?B?THlJTTBUMGU3azVGNGI4dE84RUlza3B5RUNBc0cyRnNEclN3U3VvK1ZETm02?=

=?utf-8?B?K2NQYkkrRmdMQy9iQ0NTUkhYUlBSc05hR1hmaTZRb0JKd2lhVXJKZzJ3dGMr?=

=?utf-8?B?RXhyeHNkUW1qSEhKMVl0eGN5bHZmL2xGN1hjZXdaNlQ0YWJ6NmZ4M0kvSW9G?=

=?utf-8?B?OXNQTzQ0M2NSd1ZRZk9lOUZNWCtWT2NEZWN0b2NRSUNQU0QxYzZpdmFoV0tN?=

=?utf-8?B?L1h3dXNma3ZWdHJueDZudlhqWE51ZURRWFVHMTRIYlNEMVhWMVVENUtZKzcz?=

=?utf-8?B?eHVzWXRQSEFwVjEwMUdwWlZzOGttQzFGTlJjUGpOQ2U0cGQ5N1c5SnJkcDNi?=

=?utf-8?B?UE4wUExtYVNob2VnM0huYkY5djdlWGU1SDY5TmIwWVVMMjAzQzFWQnFEVDRR?=

=?utf-8?B?VzBHTjNFV0hYZEJrVkFGcVNGMy9YVGNYcjQ0cXVmWHNNWWJ4dzNtVkcxV2tE?=

=?utf-8?B?SWlwT3RWUDZmVm84K3E4N04rVlgrRnVnSkZNV280Y0hyM3ZHRnoxMmtCZllk?=

=?utf-8?B?SWtqQzY0NEdRMitMRWd6TjdzT3pYbVRIVmE3RHQ3TVhlTkxrTG9NRDJFbmZk?=

=?utf-8?B?Z1Mvem03dkMzSG11VFBZVXJac2JVSytxaHNFSnUrWVFTRXlDbmVYSVVnUnJS?=

=?utf-8?B?M09zV3JPM0JVbVJkRHhYTzZva1Z0ekh1QWF4R1ZPRDhZZUYzRzFXOUxKNzRV?=

=?utf-8?B?T3VYNWlaUk5TZFdLTHBJN1NpNmVUMnNJM3o4SUZnckZQOFhFU0VDWlgxM1c1?=

=?utf-8?B?WitCTnNHQ2VWeU9NNEdvdXdEL1ZrTUgyVlBVMk9WNjNXcmNoN0N3YzVRSzRu?=

=?utf-8?B?YzBWRTFtZU9qczV4N1pqN2dqbmdpdnlIVUZkZlVLc05xODFQRnhXYUxUcW9t?=

=?utf-8?B?UFlBeDJnTU5hUHh0TGIwUWRxTDQ2VGRSR1hmYjB5OHZ4bmtSaHNEZFlQS0J5?=

=?utf-8?B?Y011YkNYNVMzbThqbnEvRmZ2T1hDemJ6MERsYWZ0aEVBZ0o4U00rSHo2Y3RV?=

=?utf-8?B?VG5Pb0RXODlaVXVPZ2JmMDFnV1kreUY4eXhpdm9ST0QzU1UxKytLR2ExRElq?=

=?utf-8?B?a0xYSXdOL2hsTUdKUWVtWk8zYVBBZXN2NDNjVUJtMi92WS90Z3VoWDVNZ0Jr?=

=?utf-8?B?TDUxRTA5N1cwU0VPbkJCalpXa2pFRFp2ZjhWR2tTZkQ4blhMZTRleFIwTE1t?=

=?utf-8?B?a05rZ1JINXBVcStFeHByUFAvZjAwYmpGWnl3M0FlYTMwTU1TSkcrRCtYWkJL?=

=?utf-8?B?bkdUbUJWUlZ6ODc3djlSbUEvNWtGdWlBVTI1cmkwZz09?=

X-Auto-Response-Suppress: DR, OOF, AutoReply

X-OriginatorOrg: sct-15-20-9412-4-msonline-outlook-090a5.templateTenant

X-MS-Exchange-CrossTenant-OriginalArrivalTime: 30 Jul 2026 14:48:42.4572

(UTC)

X-MS-Exchange-CrossTenant-Network-Message-Id: d9314ac5-1fc0-41f6-d3c2-08deee49a666

X-MS-Exchange-CrossTenant-Id: 84df9e7f-e9f6-40af-b435-aaaaaaaaaaaa

X-MS-Exchange-CrossTenant-AuthSource: SJ1PEPF00001CE1.namprd05.prod.outlook.com

X-MS-Exchange-CrossTenant-AuthAs: Anonymous

X-MS-Exchange-CrossTenant-FromEntityHeader: Internet

X-MS-Exchange-Transport-CrossTenantHeadersStamped: CH0PR18MB4356

X-Spam_score: 15.1

X-Spam_score_int: 151

X-Spam_bar: +++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.

Content preview: Notification: Your auto-debit payment of $429.99 USD is scheduled

shortly [Invoice #INV-3381-APW] Å¡tvrtok 30. jÃºl 2026 Dear Valued Customer,

Thank you for your recent order with PayPal. We are pleased to confirm that

your order has been processed successfully and that your payment has been

authorized. We appreciate yo [...]

Content analysis details: (15.1 points, 5.0 required)

pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[74.125.224.69 listed in will-spam-for-food.eu.org]

[74.125.224.69 listed in will-spam-for-food.eu.org]

[74.125.224.69 listed in will-spam-for-food.eu.org]

[74.125.224.69 listed in will-spam-for-food.eu.org]

[74.125.224.69 listed in will-spam-for-food.eu.org]

[74.125.224.69 listed in will-spam-for-food.eu.org]

[74.125.224.69 listed in will-spam-for-food.eu.org]

[74.125.224.69 listed in will-spam-for-food.eu.org]

[2603:10b6:a03:1e0:cafe:0:0:39 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:a03:1e0:cafe:0:0:39 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:a03:1e0:cafe:0:0:39 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:a03:1e0:cafe:0:0:39 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:a03:1e0:cafe:0:0:39 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:a03:1e0:cafe:0:0:39 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:a03:1e0:cafe:0:0:39 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:a03:1e0:cafe:0:0:39 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:a03:1e0:0:0:0:13 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:a03:1e0:0:0:0:13 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:a03:1e0:0:0:0:13 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:a03:1e0:0:0:0:13 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:a03:1e0:0:0:0:13 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:a03:1e0:0:0:0:13 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:a03:1e0:0:0:0:13 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:a03:1e0:0:0:0:13 listed in]

[will-spam-for-food.eu.org]

[40.93.14.26 listed in will-spam-for-food.eu.org]

[40.93.14.26 listed in will-spam-for-food.eu.org]

[40.93.14.26 listed in will-spam-for-food.eu.org]

[40.93.14.26 listed in will-spam-for-food.eu.org]

[40.93.14.26 listed in will-spam-for-food.eu.org]

[40.93.14.26 listed in will-spam-for-food.eu.org]

[40.93.14.26 listed in will-spam-for-food.eu.org]

[40.93.14.26 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[40.93.14.26 listed in dnsbl.ahbl.org]

[40.93.14.26 listed in dnsbl.ahbl.org]

[40.93.14.26 listed in dnsbl.ahbl.org]

[40.93.14.26 listed in dnsbl.ahbl.org]

[74.125.224.69 listed in dnsbl.ahbl.org]

[74.125.224.69 listed in dnsbl.ahbl.org]

[74.125.224.69 listed in dnsbl.ahbl.org]

[74.125.224.69 listed in dnsbl.ahbl.org]

[2603:10b6:a03:1e0:cafe:0:0:39 listed in]

[dnsbl.ahbl.org]

[2603:10b6:a03:1e0:cafe:0:0:39 listed in]

[dnsbl.ahbl.org]

[2603:10b6:a03:1e0:cafe:0:0:39 listed in]

[dnsbl.ahbl.org]

[2603:10b6:a03:1e0:cafe:0:0:39 listed in]

[dnsbl.ahbl.org]

[2603:10b6:a03:1e0:0:0:0:13 listed in]

[dnsbl.ahbl.org]

[2603:10b6:a03:1e0:0:0:0:13 listed in]

[dnsbl.ahbl.org]

[2603:10b6:a03:1e0:0:0:0:13 listed in]

[dnsbl.ahbl.org]

[2603:10b6:a03:1e0:0:0:0:13 listed in]

[dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[40.93.14.26 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[40.93.14.26 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[40.93.14.26 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[40.93.14.26 listed in dnsbl.ahbl.org]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[40.93.14.26 listed in list.dnswl.org]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

1.2 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a relay in bl.spamcop.net

[Blocked - see ]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[40.93.14.26 listed in bl.score.senderscore.com]

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[40.93.14.26 listed in wl.mailspike.net]

-0.0 SPF_PASS SPF: sender matches SPF record

3.5 VOWEL_FROM_7 Impronouncable from header (7+ consecutive vowels)

0.5 FROM_LOCAL_NOVOWEL From: localpart has series of non-vowel letters

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

1.0 HK_RANDOM_FROM From username looks random

1.0 HK_RANDOM_REPLYTO Reply-To username looks random

0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider

[haressaznzxrrsxaxz321(at)gmail.com]

0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in digit

[haressaznzxrrsxaxz321(at)gmail.com]

-0.0 T_RP_MATCHES_RCVD Envelope sender domain matches handover relay

domain

0.0 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level mail

domains are different

0.3 LONGWORD BODY: Uses overlong words

0.1 TW_RW BODY: Odd Letter Triples with RW

0.6 MEGALONGWORD BODY: Uses really overlong words

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 HTML_MESSAGE BODY: HTML included in message

0.2 FREEMAIL_FORGED_FROMDOMAIN 2nd level domains in From and EnvelopeFrom

freemail headers are different

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

2.0 RATWR8_MESSID Message-ID with excessive dashes and dollars

0.1 TO_IN_SUBJ To address is in Subject

3.0 LONG_INVISIBLE_TEXT Long block of hidden text - bayes poison?

Subject: {SPAM?} =?UTF-8?Q?Pozv=C3=A1nky=3A_Notification=3A_Your_auto=2Ddebit_payment_of_?=

=?UTF-8?Q?=24429=2E99_USD_is_s=2E=2E=2E_=40_=C5=A1t_30=2E_j=C3=BAl_2026_=28cynthiaperez389903=40?=

=?UTF-8?Q?groups=2Eoutlook=2Ecom=29?=

--00000000000005df870657d52b18

Content-Type: multipart/alternative; boundary="00000000000005df860657d52b16"

--00000000000005df860657d52b16

Content-Type: text/plain; charset="UTF-8"; format=flowed; delsp=yes

Content-Transfer-Encoding: base64

Tm90aWZpY2F0aW9uOiBZb3VyIGF1dG8tZGViaXQgcGF5bWVudCBvZiAkNDI5Ljk5IFVTRCBpcyBz

Y2hlZHVsZWQgc2hvcnRseSAgDQpbSW52b2ljZSAjSU5WLTMzODEtQVBXXQ0KxaF0dnJ0b2sgMzAu

IGrDumwgMjAyNg0KDQoNCg0KRGVhciBWYWx1ZWQgQ3VzdG9tZXIsDQpUaGFuayB5b3UgZm9yIHlv

dXIgcmVjZW50IG9yZGVyIHdpdGggUGF5UGFsLiBXZSBhcmUgcGxlYXNlZCB0byBjb25maXJtIHRo

YXQgIA0KeW91ciBvcmRlciBoYXMgYmVlbiBwcm9jZXNzZWQgc3VjY2Vzc2Z1bGx5IGFuZCB0aGF0

IHlvdXIgcGF5bWVudCBoYXMgYmVlbiAgDQphdXRob3JpemVkLg0KV2UgYXBwcmVjaWF0ZSB5b3Vy

IGJ1c2luZXNzIGFuZCBsb29rIGZvcndhcmQgdG8gc2VydmluZyB5b3UuDQpUaGUgYXV0aG9yaXpl

ZCBwYXltZW50IHdpbGwgYmUgcmVmbGVjdGVkIGluIHlvdXIgYWNjb3VudCBhY3Rpdml0eSBzaG9y

dGx5Lg0KDQpGb3IgYW55IGlucXVpcmllcywgcGxlYXNlIGNvbnRhY3QgdXMgYXQgKzEgNjU2IDU1

NiAyMTUxLg0KDQpJbnZvaWNlIERldGFpbHM6DQoNCkludm9pY2UgSUQ6IElOVi0zMzgxLUFQVw0K

DQpQcm9kdWN0OiBBcHBsZSBXYXRjaCBVbHRyYSAyDQoNCk9yZGVyIERhdGU6IEp1bHkgMzAsIDIw

MjYNCg0KQW1vdW50IER1ZTogJDQyOS45OSBVU0QNCg0KUGF5bWVudCBNZXRob2Q6IEF1dGhvcml6

ZWQgUGF5UGFsIEF1dG8tRGViaXQNCg0KSWYgeW91IGRpZCBub3QgYXV0aG9yaXplIHRoaXMgY2hh

cmdlLCBwbGVhc2UgY29udGFjdCB1cyB3aXRoaW4gMTIgaG91cnMgdG8gIA0KcmV2aWV3IHRoZSB0

cmFuc2FjdGlvbiBhbmQgcmVxdWVzdCBhIHJlZnVuZC4NCg0KRm9yIGNhbmNlbGxhdGlvbnMgb3Ig

Y29uY2VybnMgcmVnYXJkaW5nIHVuYXV0aG9yaXplZCBjaGFyZ2VzLCBwbGVhc2UgIA0KY29udGFj

dCBvdXIgc3VwcG9ydCB0ZWFtIGF0ICsxIDY1NiA1NTYgMjE1MS4NCg0KVGhpcyBpcyBhbiBhdXRv

bWF0ZWQgbWVzc2FnZS4gRm9yIGZ1cnRoZXIgYXNzaXN0YW5jZSwgcGxlYXNlIGNvbnRhY3Qgb3Vy

ICANCnN1cHBvcnQgdGVhbS4NCg0KwqnvuI8gMTk5OeKAkzIwMjYgUGF5UGFsIEFsbCBSaWdodHMg

UmVzZXJ2ZWQuDQoNCk9yZ2FuaXrDoXRvcg0KSGFyZXNhc3ogTnh5c2Fyd3NhDQpoYXJlc3Nhem56

eHJyc3hheHozMjFAZ21haWwuY29tDQoNCk9kcG92ZWR6dGUgbmEgY3ludGhpYXBlcmV6Mzg5OTAz

QGdyb3Vwcy5vdXRsb29rLmNvbSBhwqBwb3pyaXRlIHNpIMSPYWzFoWllICANCnBvZHJvYm5vc3Rp

IG5hICANCmh0dHBzOi8vY2FsZW5kYXIuZ29vZ2xlLmNvbS9jYWxlbmRhci9ldmVudD9hY3Rpb249

VklFVyZlaWQ9TkdneVltb3dhREpqYzNWbGFtMDRZWEZxTlhGdGJXcHpkRGdnWTNsdWRHaHBZWEJs

Y21WNk16ZzVPVEF6UUdkeWIzVndjeTV2ZFhSc2IyOXJMbU52YlEmdG9rPU16RWphR0Z5WlhOellY

cHVlbmh5Y25ONFlYaDZNekl4UUdkdFlXbHNMbU52YlRnM05UZzJORGd4TkRjd056ZzNZbVE0T0RO

bFkyWTFNVEF3TXpGaVpXUTFOek15WWpGbFlUUSZjdHo9QXNpYSUyRkRoYWthJmhsPXNrJmVzPTAN

ClZhxaFhIMO6xI1hc8WlIGplIHZvbGl0ZcS+bsOhLg0KDQp+fi8vfn4NCk9kb3NsYW7DqSBLYWxl

bmTDoXJvbSBHb29nbGU6IGh0dHBzOi8vY2FsZW5kYXIuZ29vZ2xlLmNvbS9jYWxlbmRhci8NCg0K

VMO6dG8gc3Byw6F2dSBzdGUgZG9zdGFsaSwgcHJldG/FvmUgc3RlIMO6xI1hc3Ruw61rb20gZGFu

ZWogdWRhbG9zdGkuDQoNCkFrIHTDunRvIHBvenbDoW5rdSBwcmVwb8WhbGV0ZSwga3RvcsO9a2/E

vnZlayBqZWogcHLDrWplbWNhIGJ1ZGUgbcO0Y8WlIG9kb3NsYcWlICANCm9kcG92ZcSPIG9yZ2Fu

aXrDoXRvcm92aSwgYnnFpSBwcmlkYW7DvSBkbyB6b3puYW11IGhvc3TDrSwgcG96w712YcWlIGlu

w71jaCBiZXogIA0Kb2jEvmFkdSBuYSBpY2ggdmxhc3Ruw70gc3RhdiBwb3p2w6Fua3kgYWxlYm8g

bWVuacWlIHZhxaFlIHBvdHZyZGVuaWUgw7rEjWFzdGkuDQoNCsSOYWzFoWllIGluZm9ybcOhY2ll

ICANCmh0dHBzOi8vc3VwcG9ydC5nb29nbGUuY29tL2NhbGVuZGFyL2Fuc3dlci8zNzEzNSNmb3J3

YXJkaW5nDQo=

--00000000000005df860657d52b16

Content-Type: text/html; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable

schemas-microsoft-com:vml" xmlns:o=3D"urn:schemas-microsoft-com:office:offi=

ce">
t=3D"text/html; charset=3DUTF-8">
=3Ddevice-width,initial-scale=3D1">
ight dark">

=20

=20

=20

=20

/InformAction">
emtype=3D"http://schema.org/Person">
=3D"Pozv=C3=A1nka od pou=C5=BE=C3=ADvate=C4=BEa Haresasz Nxysarwsa"/>
><=

meta itemprop=3D"eventStatus" content=3D"http://schema.org/EventScheduled"/=

>
ization">
itemprop=3D"eventId/googleCalendar" content=3D"4h2bj0h2csuejm8aqj5qmmjst8"/=

>
x; height: 0; max-height: 0; width: 0; max-width: 0; opacity: 0; overflow: =

hidden;" itemprop=3D"name">Notification: Your auto-debit payment of $429.99=

USD is scheduled shortly [Invoice #INV-3381-APW]
rl" content=3D"https://calendar.google.com/calendar/event?action=3DVIEW&=

;eid=3DNGgyYmowaDJjc3Vlam04YXFqNXFtbWpzdDggY3ludGhpYXBlcmV6Mzg5OTAzQGdyb3Vw=

cy5vdXRsb29rLmNvbQ&tok=3DMzEjaGFyZXNzYXpuenhycnN4YXh6MzIxQGdtYWlsLmNvbT=

g3NTg2NDgxNDcwNzg3YmQ4ODNlY2Y1MTAwMzFiZWQ1NzMyYjFlYTQ&ctz=3DAsia%2FDhak=

a&hl=3Dsk&es=3D0"/>
rtDate" datetime=3D"20260730">
"20260731">

: #fff; line-height: 1px; height: 0; max-height: 0; width: 0; max-width: 0;=

opacity: 0; overflow: hidden;">Dear Valued Customer,

Thank you for your recent order with PayPal. We are pleased to confirm that=

your order has been processed successfully and that your payment has been =

authorized.

We appreciate yo

0" role=3D"presentation" align=3D"center" style=3D"width:100%;" class=3D"bo=

dy-container">

tyle=3D"height:16px;" aria-hidden=3D"true">

cing=3D"0" role=3D"presentation" align=3D"center" style=3D"width:100%;" cla=

ss=3D"">

px; direction: rtl; font-size: 0; padding: 24px 32px; text-align: left; ver=

tical-align: top;" class=3D"main-container-inner">

ection: ltr; display: inline-block; vertical-align: top; width: 100%;overfl=

ow: hidden; word-wrap: break-word;">
ellspacing=3D"0" role=3D"presentation" width=3D"100%" class=3D"main-column-=

table-ltr" style=3D"padding-right: 32px; padding-left: 0;;table-layout: fix=

ed;">

lign:top;">
presentation" width=3D"100%" style=3D"table-layout: fixed;">=

=3D"font-size: 0; padding: 0; text-align: left; word-break: break-word;;pad=

ding-bottom:24px;">

: normal; font-weight: 400; font-size: 14px; line-height: 20px; letter-spac=

ing: 0.2px;color: #3c4043; text-decoration: none;" class=3D"primary-text" r=

ole=3D"presentation">Dear Valued Customer,
Thank you for your rece=

nt order with PayPal. We are pleased to confirm that your order has been pr=

ocessed successfully and that your payment has been authorized.
We appre=

ciate your business and look forward to serving you.
The authorized paym=

ent will be reflected in your account activity shortly.

For any inquiries=

, please contact us at +1 656 556 2151.

Invoice Details:

Invoic=

e ID: INV-3381-APW

Product: Apple Watch Ultra 2

Order Date: Jul=

y 30, 2026

Amount Due: $429.99 USD

Payment Method: Authorized P=

ayPal Auto-Debit

If you did not authorize this charge, please contact=

us within 12 hours to review the transaction and request a refund.

F=

or cancellations or concerns regarding unauthorized charges, please contact=

our support team at +1 656 556 2151.

This is an automated message. F=

or further assistance, please contact our support team.

=C2=A9=EF=B8=

=8F 1999=E2=80=932026 PayPal All Rights Reserved.

=3D"description" content=3D"Dear Valued Customer,

Thank you for your recent order with PayPal. We are pleased to confirm that=

your order has been processed successfully and that your payment has been =

authorized.

We appreciate your business and look forward to serving you.

The authorized payment will be reflected in your account activity shortly.

For any inquiries, please contact us at +1 656 556 2151.

Invoice Details:

Invoice ID: INV-3381-APW

Product: Apple Watch Ultra 2

Order Date: July 30, 2026

Amount Due: $429.99 USD

Payment Method: Authorized PayPal Auto-Debit

If you did not authorize this charge, please contact us within 12 hours to =

review the transaction and request a refund.

For cancellations or concerns regarding unauthorized charges, please contac=

t our support team at +1 656 556 2151.

This is an automated message. For further assistance, please contact our su=

pport team.

=C2=A9=EF=B8=8F 1999=E2=80=932026 PayPal All Rights Reserved."/>

k: break-word;;padding-bottom:24px;">

s-serif;font-style: normal; font-weight: 400; font-size: 14px; line-height:=

20px; letter-spacing: 0.2px;color: #3c4043; text-decoration: none;" class=

=3D"primary-text" role=3D"presentation">
emprop=3D"startDate" datetime=3D"20260730">
" datetime=3D"20260731">
cellspacing=3D"0" role=3D"presentation" style=3D"padding-bottom: 4px;">
>

xt-decoration: none;font-weight: 700;-webkit-font-smoothing: antialiased;ma=

rgin: 0; padding: 0;">Kedy

=C5=A1tvrtok 30. j=

=C3=BAl 2026

0; text-align: left; word-break: break-word;;padding-bottom:24px;">

le=3D"font-family: Roboto, sans-serif;font-style: normal; font-weight: 400;=

font-size: 14px; line-height: 20px; letter-spacing: 0.2px;color: #3c4043; =

text-decoration: none;" class=3D"primary-text" role=3D"presentation">
border=3D"0" cellpadding=3D"0" cellspacing=3D"0" role=3D"presentation" sty=

le=3D"padding-bottom: 4px;">

t-size: 14px;color: #3c4043; text-decoration: none;font-weight: 700;-webkit=

-font-smoothing: antialiased;margin: 0; padding: 0;">Organiz=C3=A1tor

<=

/td>

>
k;;color: #3c4043; text-decoration: none;" href=3D"mailto:haressaznzxrrsxax=

z321@gmail.com">Haresasz Nxysarwsa
temscope itemtype=3D"http://schema.org/Person">
ent=3D"Haresasz Nxysarwsa"/>
rrsxaxz321@gmail.com"/>

=3D"secondary-text underline-on-hover" style=3D"display: inline-block;;colo=

r: #70757a; text-decoration: none;" href=3D"mailto:haressaznzxrrsxaxz321@gm=

ail.com">haressaznzxrrsxaxz321@gmail.com

tyle=3D"font-size: 0; padding: 0; text-align: left; word-break: break-word;=

;padding-bottom:24px;">

tyle: normal; font-weight: 400; font-size: 14px; line-height: 20px; letter-=

spacing: 0.2px;color: #3c4043; text-decoration: none;" class=3D"primary-tex=

t" role=3D"presentation">
=3D"0" role=3D"presentation" style=3D"padding-bottom: 4px;">

ss=3D"primary-text" style=3D"font-size: 14px;color: #3c4043; text-decoratio=

n: none;font-weight: 700;-webkit-font-smoothing: antialiased;margin: 0; pad=

ding: 0;">Hostia

(Zoznam host=C3=AD bol na =C5=BEiado=

s=C5=A5 organiz=C3=A1tora skryt=C3=BD)

-size: 0; padding: 0; text-align: left; word-break: break-word;;padding-bot=

tom:0px;">

Roboto, sans-serif;font-size: 14px; line-height: 20px; mso-line-height-rul=

e: exactly; text-align: left;" class=3D"primary-text">

ont-weight: 700;-webkit-font-smoothing: antialiased;">Odpove=C4=8F
pan class=3D"secondary-text" style=3D"color: #70757a; text-decoration: none=

;"> na
ine-block;;color: #70757a; text-decoration: none;" href=3D"mailto:cynthiape=

rez389903@groups.outlook.com">cynthiaperez389903@groups.outlook.com
an>

ign: left; word-break: break-word;;padding-bottom:16px;">

-family: Roboto, sans-serif;font-size: 14px; line-height: 20px; mso-line-he=

ight-rule: exactly; text-align: left;">
" cellspacing=3D"0" role=3D"presentation" style=3D"border-collapse: separat=

e;">

;">
=3D"0" role=3D"presentation" style=3D"border: solid 1px #dadce0; border-rad=

ius: 16px; border-collapse: separate;font-family: 'Google Sans', Ro=

boto, sans-serif;;display: inline-block;;margin-right: 12px; margin-left: 0=

;">
able>

--00000000000005df860657d52b16

Content-Type: text/calendar; charset="UTF-8"; method=REQUEST

Content-Transfer-Encoding: quoted-printable

BEGIN:VCALENDAR

PRODID:-//Google Inc//Google Calendar 70.9054//EN

VERSION:2.0

CALSCALE:GREGORIAN

METHOD:REQUEST

BEGIN:VEVENT

DTSTART;VALUE=3DDATE:20260730

DTEND;VALUE=3DDATE:20260731

DTSTAMP:20260730T144841Z

ORGANIZER;CN=3DHaresasz Nxysarwsa:mailto:haressaznzxrrsxaxz321@gmail.com

UID:4h2bj0h2csuejm8aqj5qmmjst8@google.com

ATTENDEE;CUTYPE=3DINDIVIDUAL;ROLE=3DREQ-PARTICIPANT;PARTSTAT=3DNEEDS-ACTION=

;RSVP=3D

TRUE;CN=3Dcynthiaperez389903@groups.outlook.com;X-NUM-GUESTS=3D0:mailto:cy=

nthia

perez389903@groups.outlook.com

X-MICROSOFT-CDO-OWNERAPPTID:739734032

CREATED:20260730T144833Z

DESCRIPTION:Dear Valued Customer\,\nThank you for your recent order with Pa

yPal. We are pleased to confirm that your order has been processed success=

f

ully and that your payment has been authorized.\nWe appreciate your busine=

s

s and look forward to serving you.\nThe authorized payment will be reflect=

e

d in your account activity shortly.\n\nFor any inquiries\, please contact =

u

s at +1 656 556 2151.\n\nInvoice Details:\n\nInvoice ID: INV-3381-APW\n\nP=

r

oduct: Apple Watch Ultra 2\n\nOrder Date: July 30\, 2026\n\nAmount Due: $4=

2

9.99 USD\n\nPayment Method: Authorized PayPal Auto-Debit\n\nIf you did not=

=20

authorize this charge\, please contact us within 12 hours to review the tr=

a

nsaction and request a refund.\n\nFor cancellations or concerns regarding =

u

nauthorized charges\, please contact our support team at +1 656 556 2151.\=

n

\nThis is an automated message. For further assistance\, please contact ou=

r

support team.\n\n=C2=A9=EF=B8=8F 1999=E2=80=932026 PayPal All Rights Rese=

rved.

LAST-MODIFIED:20260730T144834Z

LOCATION:

SEQUENCE:0

STATUS:CONFIRMED

SUMMARY:Notification: Your auto-debit payment of $429.99 USD is scheduled s

hortly [Invoice #INV-3381-APW]

TRANSP:TRANSPARENT

BEGIN:VALARM

ACTION:DISPLAY

DESCRIPTION:This is an event reminder

TRIGGER:-P0DT7H0M0S

END:VALARM

END:VEVENT

END:VCALENDAR

--00000000000005df860657d52b16--

--00000000000005df870657d52b18

Content-Type: application/ics; name="invite.ics"

Content-Disposition: attachment; filename="invite.ics"

Content-Transfer-Encoding: base64

QkVHSU46VkNBTEVOREFSDQpQUk9ESUQ6LS8vR29vZ2xlIEluYy8vR29vZ2xlIENhbGVuZGFyIDcw

LjkwNTQvL0VODQpWRVJTSU9OOjIuMA0KQ0FMU0NBTEU6R1JFR09SSUFODQpNRVRIT0Q6UkVRVUVT

VA0KQkVHSU46VkVWRU5UDQpEVFNUQVJUO1ZBTFVFPURBVEU6MjAyNjA3MzANCkRURU5EO1ZBTFVF

PURBVEU6MjAyNjA3MzENCkRUU1RBTVA6MjAyNjA3MzBUMTQ0ODQxWg0KT1JHQU5JWkVSO0NOPUhh

cmVzYXN6IE54eXNhcndzYTptYWlsdG86aGFyZXNzYXpuenhycnN4YXh6MzIxQGdtYWlsLmNvbQ0K

VUlEOjRoMmJqMGgyY3N1ZWptOGFxajVxbW1qc3Q4QGdvb2dsZS5jb20NCkFUVEVOREVFO0NVVFlQ

RT1JTkRJVklEVUFMO1JPTEU9UkVRLVBBUlRJQ0lQQU5UO1BBUlRTVEFUPU5FRURTLUFDVElPTjtS

U1ZQPQ0KIFRSVUU7Q049Y3ludGhpYXBlcmV6Mzg5OTAzQGdyb3Vwcy5vdXRsb29rLmNvbTtYLU5V

TS1HVUVTVFM9MDptYWlsdG86Y3ludGhpYQ0KIHBlcmV6Mzg5OTAzQGdyb3Vwcy5vdXRsb29rLmNv

bQ0KWC1NSUNST1NPRlQtQ0RPLU9XTkVSQVBQVElEOjczOTczNDAzMg0KQ1JFQVRFRDoyMDI2MDcz

MFQxNDQ4MzNaDQpERVNDUklQVElPTjpEZWFyIFZhbHVlZCBDdXN0b21lclwsXG5UaGFuayB5b3Ug

Zm9yIHlvdXIgcmVjZW50IG9yZGVyIHdpdGggUGENCiB5UGFsLiBXZSBhcmUgcGxlYXNlZCB0byBj

b25maXJtIHRoYXQgeW91ciBvcmRlciBoYXMgYmVlbiBwcm9jZXNzZWQgc3VjY2Vzc2YNCiB1bGx5

IGFuZCB0aGF0IHlvdXIgcGF5bWVudCBoYXMgYmVlbiBhdXRob3JpemVkLlxuV2UgYXBwcmVjaWF0

ZSB5b3VyIGJ1c2luZXMNCiBzIGFuZCBsb29rIGZvcndhcmQgdG8gc2VydmluZyB5b3UuXG5UaGUg

YXV0aG9yaXplZCBwYXltZW50IHdpbGwgYmUgcmVmbGVjdGUNCiBkIGluIHlvdXIgYWNjb3VudCBh

Y3Rpdml0eSBzaG9ydGx5LlxuXG5Gb3IgYW55IGlucXVpcmllc1wsIHBsZWFzZSBjb250YWN0IHUN

CiBzIGF0ICsxIDY1NiA1NTYgMjE1MS5cblxuSW52b2ljZSBEZXRhaWxzOlxuXG5JbnZvaWNlIElE

OiBJTlYtMzM4MS1BUFdcblxuUHINCiBvZHVjdDogQXBwbGUgV2F0Y2ggVWx0cmEgMlxuXG5PcmRl

ciBEYXRlOiBKdWx5IDMwXCwgMjAyNlxuXG5BbW91bnQgRHVlOiAkNDINCiA5Ljk5IFVTRFxuXG5Q

YXltZW50IE1ldGhvZDogQXV0aG9yaXplZCBQYXlQYWwgQXV0by1EZWJpdFxuXG5JZiB5b3UgZGlk

IG5vdCANCiBhdXRob3JpemUgdGhpcyBjaGFyZ2VcLCBwbGVhc2UgY29udGFjdCB1cyB3aXRoaW4g

MTIgaG91cnMgdG8gcmV2aWV3IHRoZSB0cmENCiBuc2FjdGlvbiBhbmQgcmVxdWVzdCBhIHJlZnVu

ZC5cblxuRm9yIGNhbmNlbGxhdGlvbnMgb3IgY29uY2VybnMgcmVnYXJkaW5nIHUNCiBuYXV0aG9y

aXplZCBjaGFyZ2VzXCwgcGxlYXNlIGNvbnRhY3Qgb3VyIHN1cHBvcnQgdGVhbSBhdCArMSA2NTYg

NTU2IDIxNTEuXG4NCiBcblRoaXMgaXMgYW4gYXV0b21hdGVkIG1lc3NhZ2UuIEZvciBmdXJ0aGVy

IGFzc2lzdGFuY2VcLCBwbGVhc2UgY29udGFjdCBvdXINCiAgc3VwcG9ydCB0ZWFtLlxuXG7Cqe+4

jyAxOTk54oCTMjAyNiBQYXlQYWwgQWxsIFJpZ2h0cyBSZXNlcnZlZC4NCkxBU1QtTU9ESUZJRUQ6

MjAyNjA3MzBUMTQ0ODM0Wg0KTE9DQVRJT046DQpTRVFVRU5DRTowDQpTVEFUVVM6Q09ORklSTUVE

DQpTVU1NQVJZOk5vdGlmaWNhdGlvbjogWW91ciBhdXRvLWRlYml0IHBheW1lbnQgb2YgJDQyOS45

OSBVU0QgaXMgc2NoZWR1bGVkIHMNCiBob3J0bHkgW0ludm9pY2UgI0lOVi0zMzgxLUFQV10NClRS

QU5TUDpUUkFOU1BBUkVOVA0KQkVHSU46VkFMQVJNDQpBQ1RJT046RElTUExBWQ0KREVTQ1JJUFRJ

T046VGhpcyBpcyBhbiBldmVudCByZW1pbmRlcg0KVFJJR0dFUjotUDBEVDdIME0wUw0KRU5EOlZB

TEFSTQ0KRU5EOlZFVkVOVA0KRU5EOlZDQUxFTkRBUg0K

--00000000000005df870657d52b18--

Interactive Brokers' phish from Google Users

Posted by Dave Yadallee on Thursday, July 30. 2026

Royal bank for Canada phish from google user

Posted by Dave Yadallee on Thursday, July 30. 2026

Interactive Brokers' trade phish from Google Cloud Compliance

Posted by Dave Yadallee on Thursday, July 30. 2026

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 30 Jul 2026 09:10:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.5 (FreeBSD))

(envelope-from )

id 1wpSOV-000000006pu-41Hb

for dave@doctor.nl2k.ab.ca;

Thu, 30 Jul 2026 09:09:59 -0600

Resent-From: The Doctor

Resent-Date: Thu, 30 Jul 2026 09:09:59 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from uzckeji.com ([35.215.116.200]:45649 helo=promos.uzckeji.com)

by doctor.nl2k.ab.ca with esmtp (Exim 4.99.5 (FreeBSD))

(envelope-from )

id 1wpR5V-00000000CmZ-2jVL

for sales@nk.ca;

Thu, 30 Jul 2026 07:46:26 -0600

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; s=default; d=promos.uzckeji.com;

h=Content-Type:MIME-Version:From:To:Subject:Date:Message-ID;

i=support@mjvdoz.promos.uzckeji.com;

bh=BR18sZWFkPUyL3Goxym359bO9bV4kmLCJpSHAyiyowU=;

b=AV0A34n9WrvH0F1XfJT1rZY2OZF+II1EkugbD0GIK7yMoZN6JhegyevuqW/V5A69YRC28SKF8cWj

4AolrdPAnMN4g7ApaKR7kVGUanSMF94nnYb+ji2vxXtBgnGknK+FRsXyYTO2nWfplYgPVEpcPVwT

5r5uqLX8sTKPQ3u0bkBb2xoPlDQmuOB94FjN+UdXUxNSy5+ljZxxxbL51Gikk7lvNAaHolGg7AKt

VM4h6j376mKLqmoKMupbAeDsGi630tBzpndEuJXcLA2SCNUI4F8Bv7My4McMZct8Mkzc/V9Ka36j

ZRG5dm6ihp00tjjrovRxDaVElUB/JG9ElpyHkA==

Content-Type: multipart/alternative;

boundary="===============8776155571676728755=="

MIME-Version: 1.0

From:

=?utf-8?b?SeKAi0LigItL4oCLUuKAiyDigItD4oCLbOKAi2nigItl4oCLbuKAi3TigIsg4oCLU+KAi2XigIty4oCLduKAi2nigItj4oCLZeKAi3M=?=

To: sales@nk.ca

Subject: =?utf-8?q?=5BIBKR_Canada=5D_Trade_Surveillance_Alert_=E2=80=94_Atyp?=

=?utf-8?q?ical_Account_Behaviour_Detected?=

Date: Thu, 30 Jul 2026 09:44:34 -0400

Message-ID: <178541907464.4639.269218818030736681@mjvdoz.promos.uzckeji.com>

X-Spam_score: 12.1

X-Spam_score_int: 121

X-Spam_bar: ++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.

Content preview: [IBKR Canada] Trade Surveillance Alert â€” Atypical Account

Activity Requires Review | Alerte de surveillance â€” Une activitÃ© atypique

du compte nÃ©cessite un examen sales, Interactive Brokers' trade surveillance

and market conduct monitoring systems â€” which operate continuously in compliance

with CIRO Dealer Member Rule 1300 series and Universal Market Integrity Rules

[...]

Content analysis details: (12.1 points, 5.0 required)

pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[35.215.116.200 listed in will-spam-for-food.eu.org]

[35.215.116.200 listed in will-spam-for-food.eu.org]

[35.215.116.200 listed in will-spam-for-food.eu.org]

[35.215.116.200 listed in will-spam-for-food.eu.org]

[35.215.116.200 listed in will-spam-for-food.eu.org]

[35.215.116.200 listed in will-spam-for-food.eu.org]

[35.215.116.200 listed in will-spam-for-food.eu.org]

[35.215.116.200 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[35.215.116.200 listed in dnsbl.ahbl.org]

[35.215.116.200 listed in dnsbl.ahbl.org]

[35.215.116.200 listed in dnsbl.ahbl.org]

[35.215.116.200 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[35.215.116.200 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[35.215.116.200 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[35.215.116.200 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[35.215.116.200 listed in dnsbl.ahbl.org]

-0.0 SPF_HELO_PASS SPF: HELO matches SPF record

-0.0 SPF_PASS SPF: sender matches SPF record

2.5 URIBL_DBL_SPAM Contains a spam URL listed in the DBL blocklist

[URI: uzckeji.com]

0.1 URIBL_SBL_A Contains URL's A record listed in the SBL blocklist

[URI: promos.uzckeji.com/35.215.116.200]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-0.0 T_RP_MATCHES_RCVD Envelope sender domain matches handover relay

domain

2.3 MANGLED_ACTVTY BODY: mangled activity

2.2 INVESTMENT_ADVICE BODY: Message mentions investment advice

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[35.215.116.200 listed in bl.score.senderscore.com]

1.5 MR_STRANGE_QUESTION URI: No description available.

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

0.8 SARE_FROM_SPAM_WORD3 I don't know people named this!

1.5 TVD_PH_BODY_ACCOUNTS_PRE The body matches phrases such as "accounts

suspended", "account credited", "account

verification"

Subject: {SPAM?} =?utf-8?q?=5BIBKR_Canada=5D_Trade_Surveillance_Alert_=E2=80=94_Atyp?=

=?utf-8?q?ical_Account_Behaviour_Detected?=

⚠

Interactive Brokers Canada Inc. — Trade Surveillance — Automated Detection

Atypical Account Behaviour Detect‌ed — Client Review Required

sales,

Interactive Brokers' trade survei‌llance and market conduct monitoring systems — which operate continuously in compliance with CIRO Dealer M‌ember Rule 1300 series and Universa‍l Market Integrity Rules (UMIR) — have identified trading patterns, login sequences‍, or account function usage that dev‍iate materially from the historical profile associated with your account.

This alert is a product of automated‌ surveillance. It is not a determina‍tion of misconduct. The patterns fl‌agged require your review to determine whether they represent authorized activity. Your timely review is a material factor.

Pattern Category Observation Severity

Login Behaviour Access timing, frequency, or geolocation inconsistent with historical norms Medium

Order Activity Trade size, security type, or execu‍tion pattern outside established p‌arameters High

Account Navigation Sequential function access pattern inconsistent with prior session history Medium

Client Obligation — Review and Confirm or Dispute

Under CIRO Dealer Member rules and I‌nteractive Brokers' Client Agreem‍ent, account holders are expected to review flagged activity and confi‍rm or dispute it upon notification.‌ Failure to review flagged activity within the prescribed period may ma‌terially affect your ability to seek protection or compensation for losses subsequently determined to be associated with the flagged act‌ivity. Your confirmation or disput‍e of each flagged pattern is a determinative factor in any claim assessment conducted by Interactive Broke‍rs' compliance or risk departments.

Log in to the Client Portal. The trad‍e surveillance review interface wi‍ll present each flagged pattern for‍ your confirmation or dispute. For each item, indicate whether the acti‍vity was authorized by you or whethe‌r it is unrecognized. If you dispute any item, our compliance and security teams will initiate a formal review. The process takes approximately five minutes. Your assets remain p‌rotected under CIPF.

Log In to Review Activity

Interactive Brokers Canada Inc. is an order-execution-only dealer an‍d does not provide investment advice‍. Member — CIRO and Member — CIPF. Reg‍istered office: 1800 McGill Colleg‌e Avenue, Suite 2106, Montreal, Quebec, H3A 3J6. This is an automated trade surveillance notification issued in compliance with regulatory obl‌igations. Do not reply to this email with account information.

Comportement atypique du compte détecté — Examen du client requis

sales,

Les systèmes de surveillance des transactions et de contrôle de la conduite sur les marchés d'Interactive Brokers — qui fonctionnent en conti‌nu conformément à la série 1300 des R‍ègles des courtiers membres de l'OC‌RI et aux Règles universelles d'int‌égrité du marché (RUIM) — ont détecté des schémas de trading, des séquences de connexion ou une utilisation des fonctions du compte qui s'écartent considérablement du profil histo‍rique associé à votre compte.

Cette alerte est le produit d'une surveillance automatisée. Il ne s'agit pas d'une détermination de mauvaise conduite. Les schémas signalés n‌écessitent votre examen pour déterminer s'ils représentent une activité autorisée. Votre examen en temps opportun est u‍n facteur déterminant.

Catégorie de schéma Observation Gravité

Comportement de connexion Moment, fréquence ou géolocalisation d'accès incompatibles avec les normes historiques Moyenne

Activité d'ordres Taille des transactions, type de titre ou schéma d'exécution hors des p‌aramètres établis Élevée

Navigation du compte Schéma d'accès aux fonctions séquentielles incompatible avec l'hist‍orique de session Moyenne

Obligation du client — Examiner et confirmer ou contester

En vertu des règles des courtiers membres de l'OCRI et de la Convention de client d'Interactive Brokers, les t‌itulaires de comptes sont tenus d'e‍xaminer l'activité signalée et de la confirmer ou de la contester dès réception de l'avis. Le défaut d'examiner l'activité si‌gnalée dans le délai prescrit peut compromettre considérablement vot‌re capacité à demander une protection ou une indemnisation pour les pertes ultérieurement attribuées à l'activité signalée. Vot‌re confirmation ou contestation de‍ chaque schéma signalé est un facteu‍r déterminant dans toute évaluation de réclamation menée par les service‍s de conformité ou de risque d'Interactive Brokers.

Connectez-vous au Portail Client. L'interface d'examen de surveillance des transactions présentera ch‌aque schéma signalé pour votre conf‍irmation ou contestation. Pour cha‌que élément, indiquez si l'activit‍é a été autorisée par vous ou si elle n'est pas reconnue. Si vous contestez un élément, nos équipes de conformité et de sécurité lanceront un examen formel. Le processus prend envir‍on cinq minutes. Vos actifs demeurent protégés par le FCPI.

Se connecter pour examiner l'activi‍té

Interactive Brokers Canada Inc. est un courtier exécutant des ordres s‌eulement et ne fournit pas de conseils en placement. Membre — OCRI et Mem‌bre — FCPI. Siège social : 1800, avenue McGill College, bureau 2106, Mon‌tréal (Québec) H3A 3J6. Ceci est une notification automatisée de surve‍illance des transactions émise conformément aux obligations réglementaires. Ne répondez pas à ce courri‍el en fournissant des renseignements sur votre compte.

Interactive Brokers Canada Inc. — Member — CIRO — Member — CIPF. Order-execution-only dealer. No investment advice.

Registered office: 1800 McGill Col‍lege Avenue, Suite 2106, Montreal,‌ Quebec, H3A 3J6.

The Interactive Brokers word and logo are trademarks of Interactive Brokers LLC.

© 2026 Interactive Brokers Canada Inc. All rights reserved.

Interactive Brokers Canada Inc. — Membre — OCRI — Membre — FCPI. Courtier exécutant des ordres seulement.‌ Aucun conseil en placement.

Siège social : 1800, avenue McGill College, bureau 2106, Montréal (Qué‍bec) H3A 3J6.

Le mot et le logo Interactive Brokers‍ sont des marques de commerce d'Inte‍ractive Brokers LLC.

© 2026 Interactive Brokers Canada Inc. Tous droits réservés.

Virtual assistant spam from Google Gmail

Posted by Dave Yadallee on Thursday, July 30. 2026

Hi Good Morning!
I sen=

t you an email on Friday but didn=E2=80=99t hear back.
Happy to sch=

edule a quick call. We offer Affordable Remote VA Support.
Thank yo=

u!
Justin,
VA Team!

On Apr 10, 2026, at 12:35=E2=80=AFPM,&=

nbsp; Justin <Juagmwaqfmwag@gmail.com> wrote:

Hi, root@nk.=

ca

Hope you are doing well=E2=80=A6

Please, could you let =

me know whether you are interested in hiring a remote Virtual Assistan=

t at a reasonable cost?

What we can handle for you:

=F0=9F=

=91=89 Admin & Data Entry

=F0=9F=91=89 Email & Calendar =

Management

=F0=9F=91=89 Cold Calling & Outreach

=F0=9F=

=91=89 social media & Lead Generation

=F0=9F=91=89 Customer =

Support

=F0=9F=91=89 Online Research

=F0=9F=91=89 CRM Mana=

gement

=F0=9F=91=89 Bookkeeping Assistance

=F0=9F=91=89 Ap=

pointment Scheduling

=F0=9F=91=89 Document Preparation

=F0=

=9F=91=89 Real Estate & E-commerce Support

=F0=9F=91=89 Stud=

io-quality 3D Rendering

=F0=9F=91=89 SEO & Digital Marketing=

=F0=9F=91=89 Website Development

=F0=9F=91=89 Mobile App =

Development

=F0=9F=91=89 LPO =E2=80=93 Legal Process Outsourcing=

=F0=9F=91=89 RPO =E2=80=93 Recruitment Process Outsourcing

<=

p>=F0=9F=91=89 Video Editing Support

We provide reliable, afford=

able, and results-driven remote support tailored to your business need=

s?

Would you be open to a quick call this week?

Best Regar=

ds,
Justin,
VA Team
Note: If this isn=E2=80=99t relevant, fee=

l free to reply =E2=80=9COpt-out=E2=80=9D

--ICN7dk9JZZbrWEHZBD=_rJS71uHkHvn0Wo--

Chinese language phish

Posted by Dave Yadallee on Thursday, July 30. 2026

virtual assistant spam from Google Gmail

Posted by Dave Yadallee on Thursday, July 30. 2026

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 30 Jul 2026 07:34:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.5 (FreeBSD))

(envelope-from )

id 1wpQtG-00000000Kfg-0qIA

for dave@doctor.nl2k.ab.ca;

Thu, 30 Jul 2026 07:33:38 -0600

Resent-From: The Doctor

Resent-Date: Thu, 30 Jul 2026 07:33:38 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-pl1-f175.google.com ([209.85.214.175]:44346)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.99.5 (FreeBSD))

(envelope-from )

id 1wpQXx-000000000zb-0ZKz

for sales@nk.ca;

Thu, 30 Jul 2026 07:11:47 -0600

Received: by mail-pl1-f175.google.com with SMTP id d9443c01a7336-2ce87c7e3bbso23741835ad.1

for ; Thu, 30 Jul 2026 06:10:49 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=gmail.com; s=20251104; t=1785417044; x=1786021844; darn=nk.ca;

h=content-language:thread-index:content-type:mime-version:message-id

:date:subject:to:from:from:to:cc:subject:date:message-id:reply-to

:content-type;

bh=G/Yv5PBwrW1blLYol2vaxh5AIXsDdQjSYnccLfXr/Xc=;

b=ZeXgb6T173ujNkbqtIKr50PP5UMFZ7r3jcuWnuhVxxM12jCKFHvSYr9RbWP8s7eLLf

YZcKtn/TTLjDm4H+d6I97uUTk+2X+5HOh6ZoBkkVMw3neCMg3vRYjXaYbUS6hKX7PG+e

TQrDT34503nYmlY49g4RR712Npnfl8EKqJzEif6/JfB0TQvXLDxu8QAgr8QS6u432Ck+

tc30PZgtxDY2SZpqdHf854aUF64VYVWD9CGqNf9QjDSu8HoMlE+IonISxNdpq2uv+8Mt

1KFzbzC2seRLuzsY5mI3jcnNb/ZLWOr0dIZR01qlTYZAcO9z6R5+PEjCJT9QVp9ZKyAa

1i5A==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20251104; t=1785417044; x=1786021844;

h=content-language:thread-index:content-type:mime-version:message-id

:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject

:date:message-id:reply-to:content-type;

bh=G/Yv5PBwrW1blLYol2vaxh5AIXsDdQjSYnccLfXr/Xc=;

b=S5Aq/AAewVfrNrIlhUiCJ653w9o68U4s64qK446pV1fq5Mw3G6KXrbkkZbWPez62jE

YIgc7ed7B63Hv+bah/5QOocldZn6AjxD5/JIdMWKEsn1n1p2w1G8nCsUg9CdOMRjDdgc

cqnLh4LxJbegtp7vzT44SUyuq+HmmPuawKYKssEcOZ+LwJ6/hI52KbKkHoG2+4p1AfxK

sGQP7oyQMeG+ZX3XNjhPsFXR3CW+6Usa+dIHvAk9YCHdQoldIQAHw0nrY5w2/HkS23Vw

ipoKN0ANiK/Ng0kuXrlptebPIzIFW4hYYVemH0GJKq8g7sGrGMC5FfMXzxDBl1ugDoeh

U7dw==

X-Gm-Message-State: AOJu0YyNkkEQc87uZLlII+JO6Qp0556L1WeAqqVBzO/LDJvaff2aknHs

LsNmMcyCG+8/ebIfUiSK6qco7qj7o+lw64xG7AI/uc/ClAFYnqDFIkUpmTZLxZEX

X-Gm-Gg: AR+sD11F3CsfZ6/uuzdiUBvcx8hKdLHcyXyBKgiIj5JugBvMLYfYKNul/4CD6H3zYEu

FDJoxyVF91v9oOY7QPDJ0LyrFjjfItoCWIsXSiGnBNsKrCPbqJ9knQqFMoL4nNVcjMSG4JCyLNL

38P3BszNMFYKmvlAFJRX1bbjhJ9FfzAMOMhj/zrUwv3YJF4INsITWQM9wwDroOChEruYHlL57EZ

QD9VtBijhlhGjVPubaP5491yC3gWIWRhAYdmAXGY5pMAiiF1dbt6KbJq2ENWig7/u7jnwN72Atz

IbFsjEqaBY7Dyr9keCuPb0vudbvy5/5n8eaoByLTN40WgR2FwBcZ0Hblvnno1lxops8ngJqfACk

/SVXa0/YgIDVTRdhvQeZr3XORoxRdABlHbF0y3qNYbendCXg10r1sNv0dhI8xHh4HE/QT+pbwYY

NHXY9QLjABVoIdmdONBQ7kgOTEqvt6TQSMSBkCYZKgpjIciqkUoqixvnO1Dq9ZHU6naR5Odx3Vm

hKCrQOaKtnz76CBUJE1MyF85bzCxkEINoblBQ69yVoxos6SqAvwr+iw

X-Received: by 2002:a17:902:e78b:b0:2ce:8e70:3210 with SMTP id d9443c01a7336-2d03dce519emr3994825ad.16.1785417043590;

Thu, 30 Jul 2026 06:10:43 -0700 (PDT)

Received: from LAPTOP7O4PJ7JN (38.31.68.103.broadband.rapidnet.in. [103.68.31.38])

by smtp.gmail.com with ESMTPSA id 5a478bee46e88-31504e1ff81sm22026441eec.31.2026.07.30.06.10.41

for

(version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128);

Thu, 30 Jul 2026 06:10:42 -0700 (PDT)

From: "Jawed"

To:

Subject: Call schedule | Virtual assistant ?

Date: Thu, 30 Jul 2026 18:40:18 +0530

Message-ID: <0fb101dd2024$d31eb760$795c2620$@gmail.com>

MIME-Version: 1.0

Content-Type: multipart/alternative;

boundary="----=_NextPart_000_0FB2_01DD2052.ECD6F360"

X-Mailer: Microsoft Outlook 16.0

Thread-Index: Ad0gI3qPd0h3MQahSZ2awIgER8Htwg==

Content-Language: en-in

This is a multipart message in MIME format.

------=_NextPart_000_0FB2_01DD2052.ECD6F360

Content-Type: text/plain;

charset="us-ascii"

Content-Transfer-Encoding: 7bit

sales@nk.ca

Hello,

Do you need help with my service?

. Cold Callers / Appointment setters

. Social media managers / digital marketing

. Research / Data Entry

. Accounting / Bookkeeping

. Marketing associates / lead generation

Can we schedule a quick 5-minute call?

Best wishes

Jawed

------=_NextPart_000_0FB2_01DD2052.ECD6F360

Content-Type: text/html;

charset="us-ascii"

Content-Transfer-Encoding: quoted-printable

xmlns:o=3D"urn:schemas-microsoft-com:office:office" =

xmlns:w=3D"urn:schemas-microsoft-com:office:word" =

xmlns:m=3D"http://schemas.microsoft.com/office/2004/12/omml" =

xmlns=3D"http://www.w3.org/TR/REC-html40">
HTTP-EQUIV=3D"Content-Type" CONTENT=3D"text/html; =

charset=3Dus-ascii">
(filtered medium)">
style=3D'word-wrap:break-word'>

class=3DMsoNoSpacing>sales@nk.ca

class=3DMsoNoSpacing>

class=3DMsoNoSpacing>Hello,

Do you need help with my =

service?

class=3DMsoNoSpacing>• Cold Callers / Appointment =

setters

• Social media managers =

/ digital marketing

• Research / =

Data Entry

• Accounting / =

Bookkeeping

• Marketing =

associates / lead generation

class=3DMsoNoSpacing>

Can we =

schedule a quick 5-minute call?

Best =

wishes
Jawed

------=_NextPart_000_0FB2_01DD2052.ECD6F360--

Chinese products spam

Posted by Dave Yadallee on Thursday, July 30. 2026

Web/SEo/App spam from Microsoft Outlook

Posted by Dave Yadallee on Thursday, July 30. 2026

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 30 Jul 2026 05:12:00 -0600

Received: from mail-francesouthazolkn19011027.outbound.protection.outlook.com ([52.103.39.27]:40760 helo=MRWPR03CU001.outbound.protection.outlook.com)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.99.5 (FreeBSD))

(envelope-from )

id 1wpOfd-0000000076Y-3Z07

for dave@doctor.nl2k.ab.ca;

Thu, 30 Jul 2026 05:11:37 -0600

ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none;

b=ffFgcM49R0dguVBiTnFk37RAu8RHVw9RycFvwkqV/gou/beW+GURJ8TCl98GmCF8/RwI2zwT7+6CwLBINVuPkL6oQ1QUk/LLhKn5QZHJMnZ3rGG8DKbBQqvWe2ZjRfxpKrBqtndV3WZfZFmDNMrVeRcx3j/8FYcyAjMODFQNumMXYVJLvuSOcqrqbSg3TtZkrBMywnjk1wtXqmy7W+VPCiQ2c2oyOh7cFD1wFPrtL21auUjGblGZwGeAmKMibja5PKr6ppGTaetP3cTu0Z8mF3Z2kuYx07S12CtmeXpj7G41MA3WvpEXwmtancxH1RqrB4r6UA7kTxestgz/6s0M8A==

ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;

s=arcselector10001;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1;

bh=izven13wli+UN6oMRhjQiYR14DxTHegRrwxchLls2mo=;

b=GRD7ZuAQMeQVHKJptWkqnK9i498HjqJ/0mPyu9WAFfDMinZwstQ8UJE0BKSXVaElKFowiZ57OVGGEKChXaSPRWqp9qm8OvDmj3o7ODlXbtQFusFcBvPVOtbUsRQTij/5nfa79hukPnlW7yCKwqpGfiuIPac8Qj7/XALL+5/RCZjBIGy2RoVX9OnKcvPYOPsKyKVqfwDeW9apSDMQxfTKz7sZNCTsFiMcENbTJL8WVG9U6Az+opfB0ziciYnNJjEEgfgUAv33b6FfXKhJSoYr6hssB1aQWVRUfVMUKNpMKgCDqc3IS1wUoT5TUog/7UYTmbqbq8QFwVXuAnf2W2U13g==

ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=none; dmarc=none;

dkim=none; arc=none

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=hotmail.com;

s=selector1;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck;

bh=izven13wli+UN6oMRhjQiYR14DxTHegRrwxchLls2mo=;

b=GeydLIhSob5XwZFioT82s/yLzS0rkyJ/l5YsMrtLYOUCAOMUg3FUe5KvzbrLeYAfRHCDAmBWNl1stm2t/NWq77Ba2YN2Z6MF20gn0nMUuZyryWcwIo4Pm02JMX5ljp+ZdM4idf02IRbwgXXS8NZGoypade1+N5B0M2Rnj48ZxB7fL8NAaGR3w+n7U4DiZA52kZQ66Nw7zclYy8F1F3oWULosdjJhGOSBwgruTLMg4bOHwHAwaglGITwOtIIukOubtcbaNwkm11yM7EvMS29bl/HRpNl/znE2wljAPbzP/QCG7o7TrExdkgQWaKmvgu3w8bxEPWiN36nCXBvAvV0yJQ==

Received: from PAWPR10MB7342.EURPRD10.PROD.OUTLOOK.COM (2603:10a6:102:2e2::11)

by GVXPR10MB8440.EURPRD10.PROD.OUTLOOK.COM (2603:10a6:150:1e0::21) with

Microsoft SMTP Server (version=TLS1_2,

cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.270.14; Thu, 30 Jul

2026 11:10:24 +0000

Received: from PAWPR10MB7342.EURPRD10.PROD.OUTLOOK.COM

([fe80::3518:29c1:f965:c578]) by PAWPR10MB7342.EURPRD10.PROD.OUTLOOK.COM

([fe80::3518:29c1:f965:c578%6]) with mapi id 15.21.0270.012; Thu, 30 Jul 2026

11:10:24 +0000

From: Robby Leeson

Subject: Good Morning

Thread-Topic: Good Morning

Thread-Index: AQHdIBOdH0LDf6/BskmHRxEpsl+4kg==

Date: Thu, 30 Jul 2026 11:10:24 +0000

Message-ID:

Accept-Language: fr-FR, en-US

Content-Language: fr-FR

X-MS-Has-Attach:

X-MS-TNEF-Correlator:

msip_labels:

x-ms-exchange-messagesentrepresentingtype: 1

x-ms-publictraffictype: Email

x-ms-traffictypediagnostic: PAWPR10MB7342:EE_|GVXPR10MB8440:EE_

x-ms-office365-filtering-correlation-id: 90039f66-ead3-45f8-2cf1-08deee2b2778

x-microsoft-antispam:

BCL:0;ARA:14566002|20031999006|39105399006|7071999006|31061999003|8062599012|8060799015|19110799012|22091999003|24121999003|25010399006|24071999003|4140399003|6040799012|16051099003|24021099003|15030799006|15080799012|39145399003|40105399003|26121999007|11120399003|102099032|3412199025|440099028;

x-microsoft-antispam-message-info:

=?iso-8859-1?Q?htmMFaEwC4/iOXiJmTaRFUxGQE91C2WlHPAcEY19eiMBbbBs2kyJWvy0uf?=

=?iso-8859-1?Q?JfjvA5OIGlQYMdXVTq2xlph5wwaYkGWxeQBH8vuoOCHnmB+5UFfHEkmSoy?=

=?iso-8859-1?Q?r+/8emzweFE+RqxOgmi9C9YFCx4zMUtjTyT1BFYyNKMKjSG6b0tpHqukS3?=

=?iso-8859-1?Q?DCMuj0NXSDXd3u8Na1CkL7GP4hxCj/7w7/ShnS/xxZxrTm2OeyxNqm+r5n?=

=?iso-8859-1?Q?o+p5CVtvOzgptty0nz2S1ytVfD4hbwVO5Ahrs9zjQOPB3+G+NAIjN6v6/1?=

=?iso-8859-1?Q?q76/K/6YpkLAer4e0z/5/itqImnUciL2fHuI6qhmN/pMlrrWtC8Nti6TH5?=

=?iso-8859-1?Q?JhX/MUrQEp2T9W7/4/pWRDxKOhDgwmT6dfxsgH5Hg+sjlHab6wSAWTdkB6?=

=?iso-8859-1?Q?hSSlien8HaOlDSTpuvLsxCKd+DYmdqkr8bARL5Zox86UdGiaHLV07YgE9S?=

=?iso-8859-1?Q?63Mv2HFFvxa4fFUOKL7Z6bjSJV0UKsxr063Gq8YYEOJW+S2Ncc1HbX88Fg?=

=?iso-8859-1?Q?c4lW6yN5Z+8+qmFwDtpJDwmZXO3XQTV7T/hOmoCN7EiNBeenv0okAHJ6pL?=

=?iso-8859-1?Q?vfgGzzlCbcBiYGLeXzWl8yvSh5/PfDp0+gq2uE0wbX/l+fBPENTLWtc2JU?=

=?iso-8859-1?Q?1DfZsE3QwvaBhQlEUsovronOcE3dF6Xsbl4jQtP/Spq0bLpIxzPCDn59x8?=

=?iso-8859-1?Q?NL7g2jLbFSVzzY70W5DgyI3bVDkQv4uQ4hGur2LGoJqD9Nv93kdxgYwHmX?=

=?iso-8859-1?Q?B+GFA1g7YCIqhNFg6kTwIfeNlCqUGfbS0dNEzBNpUphRKS3QrJfwGyP6jg?=

=?iso-8859-1?Q?0ySC1s7GDMlAM9ppfu3/zoE3J0ArnM0knE6qOca4FZC8htZBdqnSApTlm1?=

=?iso-8859-1?Q?zC9P1BuZN58L21+EcYmiMlG/h2SX7O8aTSmK1BGYp4MkpO3yqApcFB9QcT?=

=?iso-8859-1?Q?R4aNn+yL5tzy19V7DxVdnbND4fZaoTaPsJkpc8C3nmTG4hKed6IBxHLnv9?=

=?iso-8859-1?Q?fotyTF5h/g+2B9oSnRBfoMe7+3CiHUsYV4U5mUm3rIaQUNPwFVZYFSU2/I?=

=?iso-8859-1?Q?n4hC/LBsBk0Q9VeT81tACuCVEGPWBOPPI8dLCn7otJHq7r+QuaRGdeD4f9?=

=?iso-8859-1?Q?P/boE9LaZq/K9pB+o4E4qvqHd3kwIJ2bmCewf8YogqLXcsAks9jV63GAAm?=

=?iso-8859-1?Q?BdeEuqG/NwE8zFdOWZJuWZB/sKOOjBtaFcvxrvPOLz2S/GM2sFkupTCo3I?=

=?iso-8859-1?Q?xKbfoyCLlw4ZMJKJ404NIm9BPhdwqkAbSdWiKZ/lb2D9fQEhpu0dP7Q8LP?=

=?iso-8859-1?Q?NNaJ?=

x-ms-exchange-antispam-messagedata-chunkcount: 1

x-ms-exchange-antispam-messagedata-0:

=?iso-8859-1?Q?Wnhdjo/fDhyKsr3Satb5hj5CwPm/4L/H+VA2sjILgqOM5ezkwLpp6KcArZ?=

=?iso-8859-1?Q?tmaWEkaz2XKDtne9w+0eS8ffYihogdP6YYu+yfub12ETyEy6QXVketwZIf?=

=?iso-8859-1?Q?mq4a5L0ZlitftDNEm5zdLM+Ie3hGpLaSzAJW3HBjvVJv0xQL8+ekwGLK1y?=

=?iso-8859-1?Q?/O8Su6qnEuOYbFp+01mumx55acVTtpKpvVNCZvSEkqnO5RKMJfPeef+Jeb?=

=?iso-8859-1?Q?tyK0lCfD6lvN2tHbiUamPmnmyXWBJDEsrqah3UvXS4cWVIEzXIAbDs458k?=

=?iso-8859-1?Q?TMn9V4WrYm1HUl8RkrmHRVFTHAE1gfR/iTmHuDivj+Yj97uaP+H2AE20Mb?=

=?iso-8859-1?Q?EbnfnicNX8IVuZ52wpPhToWAa4DzPO3VHsBL41361LLrjytJPquZSCq8jj?=

=?iso-8859-1?Q?XjKVfzd4pt9/P5BNrOgl+YLuFQqpQe8Bimtpu4L12899SIeCH1SDuZ8M0R?=

=?iso-8859-1?Q?4mYxMmd6UGQFK+67Dv35OBvWeGRapHOLjcICx8CpVA3oQ/mWwQ8Cn8IaYD?=

=?iso-8859-1?Q?7NO2czra5L+cCYPv/NgZT4+K0jQ8QqEOOcL284kKeuOX0YqRbRZWhAH9dk?=

=?iso-8859-1?Q?xjwAffYzoGferg5vUn883T8oV2bEfCtU+gvyzVYqGRM7yNwkGtMGCdPbD1?=

=?iso-8859-1?Q?1ES7d6inEOzOr2zWkuwpPuoMnB4fO6Gb1Ar44P4gepBHGMnhtybsaNk9VM?=

=?iso-8859-1?Q?D+vBDZUX8/rEjVCa5O7I52NgaGtxvPZxIqAlZAan8tyfMH+nRSSLm77NDw?=

=?iso-8859-1?Q?TnupFnMK1YWdg4YOwfAjtXtIfuv0rznoJ9ggF6eFKwOZ9xEqlJui6Kel3h?=

=?iso-8859-1?Q?HBiMBJuwRNxSwu+0i7Ib7u8QYvC2mQeLtowmskhvGEHEEZrzSEwWiTaNDu?=

=?iso-8859-1?Q?YbwGx9sOS9gmtazNyINvD0ckIS5JLU3cM5wIGA+4+8P2ZkTj3/hkX3SXE2?=

=?iso-8859-1?Q?CsRC6bmdErV3ucX2c+sDrqZbwtyb/q+Pu/1FU1V1aEC4z7ZtkCHRkPgLOo?=

=?iso-8859-1?Q?+QBTEZGf5Z9Me5EcdMc8k0qbj94LNpUuUlGSylJVTKTMUwlkC9jRwDwqL2?=

=?iso-8859-1?Q?LtoN6wor/lI/6AwcIsk8FWafNw12syRJyMTOa0eZZjjZFtIqwFEk0l/dKe?=

=?iso-8859-1?Q?YqKbyXmF2nqsNHnyTfe0Bw9AshxjVHP6UqDqqzOFygJ00VLCgDC0DH+ZHP?=

=?iso-8859-1?Q?4eE561gCHa9Y2qj4rsrgXAiMGlBDxmRZayz+IzeJ3se2UkI/mRIYyARWul?=

=?iso-8859-1?Q?Q8a8Hu0xhkgFVqeycueAEdLjr1aQ7oHQ4fFAOHVqh2qb6wQ7A0kL7bJkMK?=

=?iso-8859-1?Q?ZGi0/pey820OXujHcVhe32z3XnDnCmPk1JW7zS2sLspi7WtWZi4MiC6Pio?=

=?iso-8859-1?Q?KSBCj0O5TG2rn4jlgeqexQH5tQCBOkKCz7bojd1frxMgXxBCBjZBMbxnh5?=

=?iso-8859-1?Q?s0rOLHYdGWpytIydKM+LFpt95oCYh3KJb8m4KA=3D=3D?=

Content-Type: multipart/alternative;

boundary="_000_PAWPR10MB7342876708353A3D75EC606EBBC92PAWPR10MB7342EURP_"

MIME-Version: 1.0

X-OriginatorOrg: sct-15-20-9412-4-msonline-outlook-d3deb.templateTenant

X-MS-Exchange-CrossTenant-AuthAs: Internal

X-MS-Exchange-CrossTenant-AuthSource: PAWPR10MB7342.EURPRD10.PROD.OUTLOOK.COM

X-MS-Exchange-CrossTenant-RMS-PersistedConsumerOrg: 00000000-0000-0000-0000-000000000000

X-MS-Exchange-CrossTenant-Network-Message-Id: 90039f66-ead3-45f8-2cf1-08deee2b2778

X-MS-Exchange-CrossTenant-originalarrivaltime: 30 Jul 2026 11:10:24.6353

(UTC)

X-MS-Exchange-CrossTenant-fromentityheader: Hosted

X-MS-Exchange-CrossTenant-id: 84df9e7f-e9f6-40af-b435-aaaaaaaaaaaa

X-MS-Exchange-CrossTenant-rms-persistedconsumerorg: 00000000-0000-0000-0000-000000000000

X-MS-Exchange-Transport-CrossTenantHeadersStamped: GVXPR10MB8440

--_000_PAWPR10MB7342876708353A3D75EC606EBBC92PAWPR10MB7342EURP_

Content-Type: text/plain; charset="iso-8859-1"

Content-Transfer-Encoding: quoted-printable

Hi,

How are you doing ? I'm still waiting for your response to my previous emai=

l. Waiting to hear from you as soon as possible.

Regards

Pedro

--_000_PAWPR10MB7342876708353A3D75EC606EBBC92PAWPR10MB7342EURP_

Content-Type: text/html; charset="iso-8859-1"

Content-Transfer-Encoding: quoted-printable

1">

background-color: rgb(255, 255, 255); margin: 0px; font-family: Calibri, He=

lvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">

255, 255);">Hi,

rgb(255, 255, 255); margin: 0px;">

background-color: rgb(255, 255, 255); margin: 0px; font-family: "Segoe=

UI", "Segoe UI Web (West European)", -apple-system, BlinkMa=

cSystemFont, Roboto, "Helvetica Neue", sans-serif; font-size: 12p=

t; color: rgb(36, 36, 36);">

How are you doing ? I'm still waiting for your response to my previous emai=

l. Waiting to hear from you as soon as possible.

margin: 0px; font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; =

color: rgb(0, 0, 0);">

255, 255);">Pedro

s-serif; font-size: 12pt; color: rgb(0, 0, 0);">

--_000_PAWPR10MB7342876708353A3D75EC606EBBC92PAWPR10MB7342EURP_--

Health calcium products spam from Microsoft Outlook

Posted by Dave Yadallee on Thursday, July 30. 2026

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 30 Jul 2026 04:29:00 -0600

Received: from out16-185.antispamcloud.com ([185.201.18.185]:40510)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.99.5 (FreeBSD))

(envelope-from )

id 1wpNzN-0000000018B-1oRB

for dave@doctor.nl2k.ab.ca;

Thu, 30 Jul 2026 04:28:01 -0600

Received: from s4712.syd1.stableserver.net ([198.38.93.21])

by mx325.antispamcloud.com with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.94.2)

(envelope-from )

id 1wpNyR-005ZJU-8x; Thu, 30 Jul 2026 12:26:49 +0200

DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed;

d=onlinehealth.co.za; s=default; h=MIME-Version:Content-Type:In-Reply-To:

References:Message-ID:Date:Subject:To:From:Sender:Reply-To:Cc:

Content-Transfer-Encoding:Content-ID:Content-Description:Resent-Date:

Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:List-Id:

List-Help:List-Unsubscribe:List-Subscribe:List-Post:List-Owner:List-Archive;

bh=oNBSEMCVN1Yy1Y4Z8A7OB2V0uBbsBZa2E4r252sj5c8=; b=LroWmxeSoFke5oEw8NYjIrXeiJ

XDQzXfiUkH0Z7jbjpy5aztjoj/IW6Iv90bzflBX7UYsKXSpptoTjFAA8T4WRChTY7B81CyO651B7Y

r3aQaIXxztOJN0LB6oPBcJ4pmc55TaMMPtfEpEN9Dsgmw5UAv0vBwgeSGV/cDKzcc8q6vYm15opHs

9I07G460baiUk0D+fS1m7MXfj4L975wOvPtuN68f8VlkqetvseMTNH8L+awEPDRBdUX2JNq8HAliW

PzInsrvlNy8RiHLeA5TVI2eyUfKgmO5D+i9q1600tM3l9jkerZC+WE2SPK5F5NNRSz21wHQMmgvBo

ivIMo5qw==;

Received: from [52.98.209.37] (port=53243 helo=GV1PR02MB8257.eurprd02.prod.outlook.com)

by s4712.syd1.stableserver.net with esmtpsa (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.99.5)

(envelope-from )

id 1wpNyK-0000000D3yt-2W5y;

Thu, 30 Jul 2026 10:26:40 +0000

From: "info@onlinehealth.co.za"

To: "dave@doctor.nl2k.ab.ca" , "doctor@nl2k.ab.ca"

Subject:

=?iso-2022-jp?B?Rnc6IENhbGNpdW0gUG93ZGVyGyRCISQbKEJOdXRyaXRpb25hbCBQcm9k?=

=?iso-2022-jp?B?dWN0cw==?=

Thread-Topic:

=?iso-2022-jp?B?Q2FsY2l1bSBQb3dkZXIbJEIhJBsoQk51dHJpdGlvbmFsIFByb2R1Y3Rz?=

Thread-Index: AWIuQzA4GmgSKb/ssATwPGcq1mZW8vXjlEh9

X-MS-Exchange-MessageSentRepresentingType: 1

Date: Thu, 30 Jul 2026 10:26:36 +0000

Message-ID:

References: <26c7f0.18e2.19fb0e4b319.Coremail.qianfanb@vip.163.com>

In-Reply-To: <26c7f0.18e2.19fb0e4b319.Coremail.qianfanb@vip.163.com>

Accept-Language: en-US

Content-Language: en-US

X-MS-Has-Attach:

X-MS-Exchange-Organization-SCL: -1

X-MS-TNEF-Correlator:

X-MS-Exchange-Organization-RecordReviewCfmType: 0

msip_labels:

Content-Type: multipart/alternative;

boundary="_000_GV1PR02MB825787EDF94B3DF630535328F0C92GV1PR02MB8257eurp_"

MIME-Version: 1.0

X-Get-Message-Sender-Via: s4712.syd1.stableserver.net: authenticated_id: info@onlinehealth.co.za

X-Authenticated-Sender: s4712.syd1.stableserver.net: info@onlinehealth.co.za

X-Originating-IP: 198.38.93.21

X-Spampanel-Domain: s4712.syd1.stableserver.net

X-Spampanel-Username: 198.38.93.21

Authentication-Results: antispamcloud.com; auth=pass smtp.auth=198.38.93.21@s4712.syd1.stableserver.net

X-Spampanel-Outgoing-Class: unsure

X-Spampanel-Outgoing-Evidence: Combined (0.60)

X-Recommended-Action: accept

X-Filter-ID: 9kzQTOBWQUFZTohSKvQbgI7ZDo5ubYELi59AwcWUnuXm6rNTtZt9akaM9CAP3495Vd/QTFaGzdwm

FV/OgAu0zCu2SmbhJN1U9FKs8X3+Nt2Y9HIs/iKwFaXzyKrPrEGa0UXBLeNbZhWtExN/i1eHKEYf

yTGsp+GZvJmiBugzeETMmwu+yu7O8TurymmD5vTQTyPIx4DZtCEn1ACC7fqX9CJwlNFET8uqlhb1

UKo++Jj+PawXz4OkaKWgAyyHasTlPqv2mp/J55B80pjNBGqcELm0v/tqjmRUis4ORFthDL931MEU

6JuuacWxepb8m9dBZK0EMmf3P50Ajf/tIX00FkTBuwLnUGQuNnoBQ/KeHosfzRslXI17GS1R1G9q

ZmhJJlVzfYeu2veejK2lOCRG58zgmlIwjjseIVAGwaWbkDKc0Cwh3QwFriop2/O74eHV21Fzkd5g

U5MycT0pdxJRiXq72wZVF8lCpyv9KjJ6pgjPnUyRBWYB1i/CifTwr9ZtLUJ7crhf6NWnPwGv7L2p

3D/BNM8813zogpOdGRAGcQuhFJ7oKehaoNVXSqhCqA/eYdbeax1V4ZsvmDQIa8yxaBkDJRaaICR2

rDamAVeZMV5qH68Tb5grCtCqtlDJnuAo9E4s9Gdne3MRDSTqmpH9260jiD6XqsJZtjQxlyCdseyn

JEFNnK1qPNWxPxft8F5DUBx4AUPwWPXKRBvljhpUNODBui4NbEho5tshba26WFfpkUZiG8IPY6w2

hvnJltBbZN93x25CTUX7JU63cGJVGk+LNw3faF63zVFfRzZ3fciqtihFO7o48dzV5UU5/0iHFCqT

hJGzQhLJ94s0JkFGJ7yMdUr45UVSHyCa1s1nvQ0PLjNfl89Rbl/KRMjyVlyGCF2UNqHvo3iI/j89

Ixoki1FfEoXm0/FPF8PR0w363lmvL0YsUDAr0HVfUEXNBMcsYnNGFdRN3CtPPBjSHkIxZc+HrWde

CNZcdxZXx1r/Wadi4ZRgfGRSidwrpGvyI+omXrwcAI2PCaiq+/a0w7hT9KdLqQwYcilbCplY0WAC

XveRVYKU9W9tbmVXJBqdHHDmfr8GmLdE9vCd+W2Z1iGwzrJJS1c8y9gQkftfW0mRErDyOI4gUk6a

WVeVfppVHxXAMS+4ayUpOtEhdxekWDmK9g==

X-Report-Abuse-To: spam@quarantine16.antispamcloud.com

X-Complaints-To: abuse@master.antispamcloud.com

--_000_GV1PR02MB825787EDF94B3DF630535328F0C92GV1PR02MB8257eurp_

Content-Type: text/plain; charset="iso-2022-jp"

Content-Transfer-Encoding: quoted-printable

Good day Dave,

I came across your details on the web whilst trying to establish and authen=

ticate the mail below. Would this be one of those scam rmails?

Regards,

________________________________

From: Qanfan

Sent: Thursday, July 30, 2026 4:40 AM

To: info@onlinehealth.co.za

Subject: Calcium Powder=1B$B!$=1B(BNutritional Products

Hi,

Good day.

We are an established importer and wholesale company based in China, with b=

usiness networks across Shenzhen, Guangzhou, Hong Kong and Singapore. Our s=

upply chain system is mature and well-developed.

Currently, we are actively sourcing high-quality health care products from =

reliable manufacturers and plan to introduce these products to the Chinese =

market.If you are interested in jointly exploring the Chinese market, pleas=

e don't hesitate to contact me.

I hope to have the opportunity for cooperation.Waiting for your early reply=

.

Best regards,

Qanfan Team

--_000_GV1PR02MB825787EDF94B3DF630535328F0C92GV1PR02MB8257eurp_

Content-Type: text/html; charset="iso-2022-jp"

Content-Transfer-Encoding: quoted-printable

jp">

nt, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; c=

olor: rgb(0, 0, 0);">

Good day Dave,

nt, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; c=

olor: rgb(0, 0, 0);">

nt, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; c=

olor: rgb(0, 0, 0);">

I came across your details on the web whilst trying to establish and authen=

ticate the mail below. Would this be one of those scam rmails?

nt, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; c=

olor: rgb(0, 0, 0);">

nt, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; c=

olor: rgb(0, 0, 0);">

Regards,

yle=3D"font-size:11pt" color=3D"#000000">From: Qanfan <qianfanb@v=

ip.163.com>

Sent: Thursday, July 30, 2026 4:40 AM

To: info@onlinehealth.co.za <info@onlinehealth.co.za>

Subject: Calcium Powder=1B$B!$=1B(BNutritional Products

000; font-size:14px; font-family:Arial">

rgin:0pt; text-indent:0pt; background-image:initial; background-position:in=

itial; background-size:initial; background-repeat:initial; background-attac=

hment:initial; background-origin:initial; background-clip:initial">

kground-image:initial; background-position:initial; background-size:initial=

; background-repeat:initial; background-attachment:initial; background-orig=

in:initial; background-clip:initial">Currently,

we are actively sourcing high-quality health
mily:=1B$BAWBN=1B(B; letter-spacing:0pt; font-size:10.5pt; background-image=

:initial; background-position:initial; background-size:initial; background-=

repeat:initial; background-attachment:initial; background-origin:initial; b=

ackground-clip:initial">care

products
; font-size:10.5pt; background-image:initial; background-position:initial; =

background-size:initial; background-repeat:initial; background-attachment:i=

nitial; background-origin:initial; background-clip:initial"> from

reliable manufacturers and plan to introduce these products to the Chinese=

size:10.5pt; background-image:initial; background-position:initial; backgro=

und-size:initial; background-repeat:initial; background-attachment:initial;=

background-origin:initial; background-clip:initial">
le=3D"font-family:Arial; letter-spacing:0pt; font-size:10.5pt; background-i=

mage:initial; background-position:initial; background-size:initial; backgro=

und-repeat:initial; background-attachment:initial; background-origin:initia=

l; background-clip:initial">market.If

you are interested in jointly exploring the Chinese market, please don't h=

esitate to contact me.
ng:0pt; font-size:10.5pt; background-image:initial; background-position:ini=

tial; background-size:initial; background-repeat:initial; background-attach=

ment:initial; background-origin:initial; background-clip:initial">
p>

--_000_GV1PR02MB825787EDF94B3DF630535328F0C92GV1PR02MB8257eurp_--

Health Calcium products spam

Posted by Dave Yadallee on Thursday, July 30. 2026

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 30 Jul 2026 07:33:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.5 (FreeBSD))

(envelope-from )

id 1wpQrz-00000000GB5-2ovD

for dave@doctor.nl2k.ab.ca;

Thu, 30 Jul 2026 07:32:19 -0600

Resent-From: The Doctor

Resent-Date: Thu, 30 Jul 2026 07:32:19 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from out13-75.antispamcloud.com ([185.201.17.75]:60414)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.99.5 (FreeBSD))

(envelope-from )

id 1wpNzN-0000000018E-1zOD

for doctor@nl2k.ab.ca;

Thu, 30 Jul 2026 04:28:01 -0600

Received: from s4712.syd1.stableserver.net ([198.38.93.21])

by mx325.antispamcloud.com with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.94.2)

(envelope-from )

id 1wpNyR-005ZJU-8x; Thu, 30 Jul 2026 12:26:49 +0200

DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed;

d=onlinehealth.co.za; s=default; h=MIME-Version:Content-Type:In-Reply-To:

References:Message-ID:Date:Subject:To:From:Sender:Reply-To:Cc:

Content-Transfer-Encoding:Content-ID:Content-Description:Resent-Date:

Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:List-Id:

List-Help:List-Unsubscribe:List-Subscribe:List-Post:List-Owner:List-Archive;

bh=oNBSEMCVN1Yy1Y4Z8A7OB2V0uBbsBZa2E4r252sj5c8=; b=LroWmxeSoFke5oEw8NYjIrXeiJ

XDQzXfiUkH0Z7jbjpy5aztjoj/IW6Iv90bzflBX7UYsKXSpptoTjFAA8T4WRChTY7B81CyO651B7Y

r3aQaIXxztOJN0LB6oPBcJ4pmc55TaMMPtfEpEN9Dsgmw5UAv0vBwgeSGV/cDKzcc8q6vYm15opHs

9I07G460baiUk0D+fS1m7MXfj4L975wOvPtuN68f8VlkqetvseMTNH8L+awEPDRBdUX2JNq8HAliW

PzInsrvlNy8RiHLeA5TVI2eyUfKgmO5D+i9q1600tM3l9jkerZC+WE2SPK5F5NNRSz21wHQMmgvBo

ivIMo5qw==;

Received: from [52.98.209.37] (port=53243 helo=GV1PR02MB8257.eurprd02.prod.outlook.com)

by s4712.syd1.stableserver.net with esmtpsa (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.99.5)

(envelope-from )

id 1wpNyK-0000000D3yt-2W5y;

Thu, 30 Jul 2026 10:26:40 +0000

From: "info@onlinehealth.co.za"

To: "dave@doctor.nl2k.ab.ca" , "doctor@nl2k.ab.ca"

Subject:

=?iso-2022-jp?B?Rnc6IENhbGNpdW0gUG93ZGVyGyRCISQbKEJOdXRyaXRpb25hbCBQcm9k?=

=?iso-2022-jp?B?dWN0cw==?=

Thread-Topic:

=?iso-2022-jp?B?Q2FsY2l1bSBQb3dkZXIbJEIhJBsoQk51dHJpdGlvbmFsIFByb2R1Y3Rz?=

Thread-Index: AWIuQzA4GmgSKb/ssATwPGcq1mZW8vXjlEh9

X-MS-Exchange-MessageSentRepresentingType: 1

Date: Thu, 30 Jul 2026 10:26:36 +0000

Message-ID:

References: <26c7f0.18e2.19fb0e4b319.Coremail.qianfanb@vip.163.com>

In-Reply-To: <26c7f0.18e2.19fb0e4b319.Coremail.qianfanb@vip.163.com>

Accept-Language: en-US

Content-Language: en-US

X-MS-Has-Attach:

X-MS-Exchange-Organization-SCL: -1

X-MS-TNEF-Correlator:

X-MS-Exchange-Organization-RecordReviewCfmType: 0

msip_labels:

Content-Type: multipart/alternative;

boundary="_000_GV1PR02MB825787EDF94B3DF630535328F0C92GV1PR02MB8257eurp_"

MIME-Version: 1.0

X-Get-Message-Sender-Via: s4712.syd1.stableserver.net: authenticated_id: info@onlinehealth.co.za

X-Authenticated-Sender: s4712.syd1.stableserver.net: info@onlinehealth.co.za

X-Originating-IP: 198.38.93.21

X-Spampanel-Domain: s4712.syd1.stableserver.net

X-Spampanel-Username: 198.38.93.21

Authentication-Results: antispamcloud.com; auth=pass smtp.auth=198.38.93.21@s4712.syd1.stableserver.net

X-Spampanel-Outgoing-Class: unsure

X-Spampanel-Outgoing-Evidence: Combined (0.60)

X-Recommended-Action: accept

X-Filter-ID: 9kzQTOBWQUFZTohSKvQbgI7ZDo5ubYELi59AwcWUnuXm6rNTtZt9akaM9CAP3495Vd/QTFaGzdwm

FV/OgAu0zCu2SmbhJN1U9FKs8X3+Nt2Y9HIs/iKwFaXzyKrPrEGa0UXBLeNbZhWtExN/i1eHKEYf

yTGsp+GZvJmiBugzeETMmwu+yu7O8TurymmD5vTQTyPIx4DZtCEn1ACC7fqX9CJwlNFET8uqlhb1

UKo++Jj+PawXz4OkaKWgAyyHasTlPqv2mp/J55B80pjNBGqcELm0v/tqjmRUis4ORFthDL931MEU

6JuuacWxepb8m9dBZK0EMmf3P50Ajf/tIX00FkTBuwLnUGQuNnoBQ/KeHosfzRslXI17GS1R1G9q

ZmhJJlVzfYeu2veejK2lOCRG58zgmlIwjjseIVAGwaWbkDKc0Cwh3QwFriop2/O74eHV21Fzkd5g

U5MycT0pdxJRiXq72wZVF8lCpyv9KjJ6pgjPnUyRBWYB1i/CifTwr9ZtLUJ7crhf6NWnPwGv7L2p

3D/BNM8813zogpOdGRAGcQuhFJ7oKehaoNVXSqhCqA/eYdbeax1V4ZsvmDQIa8yxaBkDJRaaICR2

rDamAVeZMV5qH68Tb5grCtCqtlDJnuAo9E4s9Gdne3MRDSTqmpH9260jiD6XqsJZtjQxlyCdseyn

JEFNnK1qPNWxPxft8F5DUBx4AUPwWPXKRBvljhpUNODBui4NbEho5tshba26WFfpkUZiG8IPY6w2

hvnJltBbZN93x25CTUX7JU63cGJVGk+LNw3faF63zVFfRzZ3fciqtihFO7o48dzV5UU5/0iHFCqT

hJGzQhLJ94s0JkFGJ7yMdUr45UVSHyCa1s1nvQ0PLjNfl89Rbl/KRMjyVlyGCF2UNqHvo3iI/j89

Ixoki1FfEoXm0/FPF8PR0w363lmvL0YsUDAr0HVfUEXNBMcsYnNGFdRN3CtPPBjSHkIxZc+HrWde

CNZcdxZXx1r/Wadi4ZRgfGRSidwrpGvyI+omXrwcAI2PCaiq+/a0w7hT9KdLqQwYcilbCplY0WAC

XveRVYKU9W9tbmVXJBqdHHDmfr8GmLdE9vCd+W2Z1iGwzrJJS1c8y9gQkftfW0mRErDyOI4gUk6a

WVeVfppVHxXAMS+4ayUpOtEhdxekWDmK9g==

X-Report-Abuse-To: spam@quarantine16.antispamcloud.com

X-Complaints-To: abuse@master.antispamcloud.com

--_000_GV1PR02MB825787EDF94B3DF630535328F0C92GV1PR02MB8257eurp_

Content-Type: text/plain; charset="iso-2022-jp"

Content-Transfer-Encoding: quoted-printable

Good day Dave,

I came across your details on the web whilst trying to establish and authen=

ticate the mail below. Would this be one of those scam rmails?

Regards,

________________________________

From: Qanfan

Sent: Thursday, July 30, 2026 4:40 AM

To: info@onlinehealth.co.za

Subject: Calcium Powder=1B$B!$=1B(BNutritional Products

Hi,

Good day.

We are an established importer and wholesale company based in China, with b=

usiness networks across Shenzhen, Guangzhou, Hong Kong and Singapore. Our s=

upply chain system is mature and well-developed.

Currently, we are actively sourcing high-quality health care products from =

reliable manufacturers and plan to introduce these products to the Chinese =

market.If you are interested in jointly exploring the Chinese market, pleas=

e don't hesitate to contact me.

I hope to have the opportunity for cooperation.Waiting for your early reply=

.

Best regards,

Qanfan Team

--_000_GV1PR02MB825787EDF94B3DF630535328F0C92GV1PR02MB8257eurp_

Content-Type: text/html; charset="iso-2022-jp"

Content-Transfer-Encoding: quoted-printable

jp">

nt, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; c=

olor: rgb(0, 0, 0);">

Good day Dave,

nt, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; c=

olor: rgb(0, 0, 0);">

nt, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; c=

olor: rgb(0, 0, 0);">

Regards,

000; font-size:14px; font-family:Arial">

--_000_GV1PR02MB825787EDF94B3DF630535328F0C92GV1PR02MB8257eurp_--

Web/SEO/App spam from Microsoft Outlook

Posted by Dave Yadallee on Thursday, July 30. 2026

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 30 Jul 2026 07:32:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.5 (FreeBSD))

(envelope-from )

id 1wpQrB-00000000Dml-2T1p

for dave@doctor.nl2k.ab.ca;

Thu, 30 Jul 2026 07:31:29 -0600

Resent-From: The Doctor

Resent-Date: Thu, 30 Jul 2026 07:31:29 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-koreacentralazolkn19011028.outbound.protection.outlook.com ([52.103.74.28]:41117 helo=SE2P216CU007.outbound.protection.outlook.com)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.99.5 (FreeBSD))

(envelope-from )

id 1wpLw1-000000007pn-0Vr4

for sales@nk.ca;

Thu, 30 Jul 2026 02:16:18 -0600

ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none;

b=LTrZZsmdvQ2LSc9hiUpWNJkln7p2qjbBP2Z0XFzhRwIQpd/irG1iCaL8KLvwOCSEjQIUn3OXY0pjpxEGEX+SZBZxKGU2U35yAperMI1Xn6udZgUDz1oBgSlAcFkQunob59uXmrBQViB5gLWDmCUR1QoUHpNsXBMpPhX9XeGNOlz1mMnezEEST14JmoNem4sMQBvJ6wi6VD6EzCsyUPpllApXoE6D62NLZtNgdIXbdg9hYAIceSDFhWWxySdaREDv7dXbPXPZGpVNlREdvW8jmWFLGlw3Egi94HVpEaWfeOTxRdA+TO5GG5VNXW9hVzOC6dea39rIthnydr+VD0FJkQ==

ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;

s=arcselector10001;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1;

bh=GpeDpi7K20K5RtmWtKJpmoxlbEjGT+XrBIhRaGv2QIM=;

b=oofDXZpzc8k8EBZUP5NR/K0PrZUGk+VKGIJ/dlCGx/RoCPGI93P13yktSNrCPhalUmUHDmmjYYyDrgu/tYmJOYnrAgnsaW+NVFTAxvsRBwHkC1gQoPyli4P8M5mkH8jAMVM476eYfv/p+RbnrK3XwRRzVGW51D+BbluvzQ7m7bW/zi15iemeP1VskhIwv5v9f25sfP0+JDELde/AQEGlEsxuzP1+Uuc14MRmVbNyIk8Pxs/mjNDdLdVzZX1PWAFv3cR4HNYL32Mfe8KNeos/G45k4RQFwPCS1nN1Ppt+choBX8niQB2i+Eu2cMNvGOIkuZrhISyL04rBAL/T4YP0lQ==

ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=none; dmarc=none;

dkim=none; arc=none

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=hotmail.com;

s=selector1;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck;

bh=GpeDpi7K20K5RtmWtKJpmoxlbEjGT+XrBIhRaGv2QIM=;

b=JBMFNKr/cfiJ9XCENN4SWhA6m/doxL6DZUV8IxI/6mFSGJwZsMVG2O5RELEORBXotupWjFmoewwYZjkrF2lqmI5lr1lc6fd0BIH5uqZfWs0HLlqZGCigi4co+bv9BKQg8IVQiqckRSgFsVfZ1U7ih7cvNnmtFzGHAaHwHn4kEZY4BPXzXxol++x83RWqLqL79yR86xb3NLW+VIwnFD8cz7igcMU6BrnhZ8k2tNa/Dw3vesF0FC5/NvXeJ8sqcmA2ORIylthoU2vrEYCz3CYMMkHmNU6Oo37cndIoe+vilEgenJz7YQDTf8h89QMsuwg2x0p09p31uO7aEnJfgC/B1Q==

Received: from SE1P216MB2113.KORP216.PROD.OUTLOOK.COM (2603:1096:101:159::13)

by PS2P216MB1281.KORP216.PROD.OUTLOOK.COM (2603:1096:301:99::9) with

Microsoft SMTP Server (version=TLS1_2,

cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.270.14; Thu, 30 Jul

2026 08:15:05 +0000

Received: from SE1P216MB2113.KORP216.PROD.OUTLOOK.COM

([fe80::312e:dcd8:af92:b3a5]) by SE1P216MB2113.KORP216.PROD.OUTLOOK.COM

([fe80::312e:dcd8:af92:b3a5%6]) with mapi id 15.21.0270.012; Thu, 30 Jul 2026

08:15:05 +0000

From: Belinda Miller

To: "sales@nk.ca"

Subject: www.nk.ca

Thread-Topic: www.nk.ca

Thread-Index: AQHdH/uHJbjMi77HHEekGEexzjFp2A==

Date: Thu, 30 Jul 2026 08:15:05 +0000

Message-ID:

Accept-Language: en-US

Content-Language: en-US

X-MS-Has-Attach:

X-MS-TNEF-Correlator:

x-ms-publictraffictype: Email

x-ms-traffictypediagnostic: SE1P216MB2113:EE_|PS2P216MB1281:EE_

x-ms-office365-filtering-correlation-id: 9b885cc0-18d6-49fe-c818-08deee12a984

x-microsoft-antispam:

BCL:0;ARA:14566002|2604032031799003|704163111799003|20031999006|39105399006|15001099006|8062599012|8060799015|19110799012|5062599005|31061999003|24071999003|4140399003|25010399006|37011999003|38102599003|15080799012|24021099003|16051099003|55001999006|10035399007|40105399003|1602099012|102099032|440099028|4302099013|3412199025;

x-microsoft-antispam-message-info:

=?us-ascii?Q?Z5XwVr8DXdg1BfLaGSZr22tPJuXQejzpOjW4x8/aosD00l8xgAmMpr9BAHCc?=

=?us-ascii?Q?N5CK4mWSIQj4xHKyHAXWlGu6Qe8UcBUbfaqAb4Qs8WjYcvSb2X5R1fuYDGfu?=

=?us-ascii?Q?9Z+WaNGkwpSl6DEe6bbhGZMHYnW34FPsgFSVNPVZAUgmPmBI2/wBrgjuhhpq?=

=?us-ascii?Q?CnZ4G8Ygq8uTBC3y+aV/RT0abM810JFHu7vMVz85mX8K1N8Ew30LapAeVisn?=

=?us-ascii?Q?t+8nsM0f3XCr2AsjAW+nNOhJr9sW7gCxfP/eWNxjIjM8QHA3s5f3isaV4p6f?=

=?us-ascii?Q?Db+IXfjgFxXBMsuo9zDSirfh2rPOz7CgkrGXVb2Nflis3mRMk6cqejXrMu+a?=

=?us-ascii?Q?6rEsaC50Z1VYkIfn22UNgOkaom8qQKsAUnPSyWBqDFonfP65wQmeQlQkTvo2?=

=?us-ascii?Q?oOCeWrTFGMbK3Ix6ZBU0ShBRo5FAvZaJM0tEkiXHmpXoutCIgQGZWp2W85t1?=

=?us-ascii?Q?uXqkPQY7kydLlH2oifiCGqRg8rgPNgFciBktU5rDK9GFEF6mHAfYpd3ydV6p?=

=?us-ascii?Q?62WH1xOhGxomS7WuL4/+hr9PhB5XDCqN1ApnkbwE2Xyppq8tp2jpRp7FrHP2?=

=?us-ascii?Q?JnpodZko5HFl4hiBbEE39ny1bpNzqHA/Fe/dfYhGvoudhK7NASWrIjW8CNiJ?=

=?us-ascii?Q?4PMZOFzXwpwuK26Z59HgWVR8VmMVIFO8IHo5yT0BdeZyO8P9z1vciy02nJpU?=

=?us-ascii?Q?OdwWK4IXefeL+cbWYHkXjOOTpIpboeDzE5h11K/+SLWTF5NSsArnoh+xNsHe?=

=?us-ascii?Q?ExIgdqpJ6oU3ZnsgWJzvvZRBJ1+lGDMb6jzyYABOnUzRQ+mDEOu7Yy+n0Vey?=

=?us-ascii?Q?iuF6vmXgzE7Y5nfaP7NSScXOb/wVzfySlpqxIAq7lsyZNDPMm6y6djA4LfiW?=

=?us-ascii?Q?K29wFFJ5FV8BFrHQZIze5EUV1HDRhM5y0OIbTd0KUKk7O7Yb2w2EPNvjGnch?=

=?us-ascii?Q?2Wb6DcPtGGlWXc5bdqGm1eCnUgtkin+S50VEZgtKeFszgqBhE6Ao1gKvErJu?=

=?us-ascii?Q?nHALXXeUpI/NwTSxXS2CYjGJPMTlc7aPf5Fim6DMbfOghb5IWaBxnm3q3DIv?=

=?us-ascii?Q?MDoatgeFXVHCOgj6ySEe/U3cS8VvJFaxZ0nwNGVPZReaVO1DxAayCNiTx623?=

=?us-ascii?Q?3GBpEExGTc0y3mhreGJjfAZEBPg0Rr40M0C5vRjS5Pyo2QZ0r6xmjbH7t/5X?=

=?us-ascii?Q?cXGOiHGXI/L+FCyOyM2WcPlYkKxEa6ssUtaJlTDFpoKFB2MZMiPz7V4eck7Z?=

=?us-ascii?Q?ZfEWAJ0C/TLExYiQTBfGY1pqYpu8GWlDRW2A6F7Yahi/F/Po9kfIjvwekpVt?=

=?us-ascii?Q?gKzUysqJygtPbEf8Zhs9SznW?=

x-ms-exchange-antispam-messagedata-chunkcount: 1

x-ms-exchange-antispam-messagedata-0:

=?us-ascii?Q?noR0HRHNck/GE/r3QH1ldsDMzAafI5oYeUMr8goa+wafvI85DLPUThaOa3Zn?=

=?us-ascii?Q?URK0HZ6Xq6x7oPAnIkgFvA+AhVmbUwA76zmD/5KOl1r1oHOlSdm/g2PUPmT+?=

=?us-ascii?Q?AJx5DHM+zoMsiOqKh1N5HKklU+yvwtRGEw79i5JjJjLrdWXZqB9jfIyBFLip?=

=?us-ascii?Q?uX+XaTVohEWrwZz8dQXBHMPN+31gjM7Y0kHWSEbi/CITA5Vd8gfocTUOIztK?=

=?us-ascii?Q?tNDt0kKLhmiGdaGnAPBMpZjspPvpq5g1UF94nWvOZgy5MgLBmytN+i4FLkra?=

=?us-ascii?Q?m9zqKC7eZEwOPRQR+korp/HHz2lrEUtFwCfhlLW9hsliig6YmFnyiDzuLL/S?=

=?us-ascii?Q?7+ryGwZ+tqJjGRHaIzQFlZbR4ZRQJh+G79qNcq5HdfrXOKbFGh/DXrZO5aRU?=

=?us-ascii?Q?NSHt6MbLEGeXmcvhH5iXVmzukkgSANdqyD4XhCsmienV6z5oOgP1xJNfjEqd?=

=?us-ascii?Q?Iuq9WLVLwHvQ/vSBBN8mOmfjzntqPElq8lVo1WNv0GfOG7tM/xrcAIqk8ooZ?=

=?us-ascii?Q?hD8XG1fS/0xaFY4kEZZSn63CGQn+sPl60vf0B+mtxwuV+C5MGLeGw2FNawUp?=

=?us-ascii?Q?fd6+sVEz+BHtI1HgDq/mIRVzbTemCnc4Cl4bNELB8JJgUZURT0UNzQLM4HU3?=

=?us-ascii?Q?iiMSObf4/mPvmY5k+ATGT5ktcPap7jVP2upzu1oYpyGXATt2Ftmjs1cm76fg?=

=?us-ascii?Q?HvdzvGe/4vZK9acDLLXmrpR9QdXm3L9aaNy/DnwPkS9O2/hXwgch5y/E9jRp?=

=?us-ascii?Q?EybMHHJDdSfs6B6a/xsDy3hhQXw5l/7c7ZVRO99GBsRCzNY30P/uJ6QpynyJ?=

=?us-ascii?Q?Z3ELeJ2TEXjXDtelKRcOrSwpZdf/I0FEiEhJpOPj66qxYGKOfIo23GmQQPMJ?=

=?us-ascii?Q?yGsyLCnJ1ZN9w+38dy/CWIjQfxlOC7j8ciCCVKIgpctxhBFOgqVxOuqEZ05B?=

=?us-ascii?Q?hg7Zp1H2P3mDceY2SQ4FhopURhL1I3Fe6EzKMEzzXGSVmRuBMYPZOSu+1zgI?=

=?us-ascii?Q?XtyOnZjiRUF+zQYeVC7xQhZ/d0ONuQZC1HtmcBgegagBRoS6islInd1Fe5bB?=

=?us-ascii?Q?ORsqGya2TdIjKVNODJUI5wNXkd7+encqF4fAIIoSXRpzPe+WF02ZIZRLA/4/?=

=?us-ascii?Q?XHTLcTjwU+SIGNZEZ07oqhIsilMlXXVtejwTm0m139iTtVZviibBody8E4pG?=

=?us-ascii?Q?wL8/bM/2rOA3Mz1r0ZDw6Y1Dy7sarDRiAHBAEiVdfFZEzyx5VxFfKzUQmZkO?=

=?us-ascii?Q?ENxhrKpdrKg5lP9slSzQ9/JYY/KGmyy5X7bArQmlKug+3rUy0128w1ZD1Vvl?=

=?us-ascii?Q?sMz4HjwE367VpJ+E9MMaFZlJ/ye5spCe3Gcjeyg4y8aoWrOUBFPNfaTbO23t?=

=?us-ascii?Q?v20bcBAwWzi124exXtr2RqUr+8bg?=

Content-Type: multipart/alternative;

boundary="_000_SE1P216MB211380B3520A5F93854F328E86C92SE1P216MB2113KORP_"

MIME-Version: 1.0

X-OriginatorOrg: sct-15-20-9412-4-msonline-outlook-94596.templateTenant

X-MS-Exchange-CrossTenant-AuthAs: Internal

X-MS-Exchange-CrossTenant-AuthSource: SE1P216MB2113.KORP216.PROD.OUTLOOK.COM

X-MS-Exchange-CrossTenant-RMS-PersistedConsumerOrg: 00000000-0000-0000-0000-000000000000

X-MS-Exchange-CrossTenant-Network-Message-Id: 9b885cc0-18d6-49fe-c818-08deee12a984

X-MS-Exchange-CrossTenant-originalarrivaltime: 30 Jul 2026 08:15:05.3482

(UTC)

X-MS-Exchange-CrossTenant-fromentityheader: Hosted

X-MS-Exchange-CrossTenant-id: 84df9e7f-e9f6-40af-b435-aaaaaaaaaaaa

X-MS-Exchange-CrossTenant-rms-persistedconsumerorg: 00000000-0000-0000-0000-000000000000

X-MS-Exchange-Transport-CrossTenantHeadersStamped: PS2P216MB1281

--_000_SE1P216MB211380B3520A5F93854F328E86C92SE1P216MB2113KORP_

Content-Type: text/plain; charset="us-ascii"

Content-Transfer-Encoding: quoted-printable

Hello,

I evaluated www.nk.ca.

It has the potential to attract more visibility on Google.

May I send the Cost Estimate to sales@nk.ca?

Many thanks!

Belinda

--_000_SE1P216MB211380B3520A5F93854F328E86C92SE1P216MB2113KORP_

Content-Type: text/html; charset="us-ascii"

Content-Transfer-Encoding: quoted-printable

>

Hello,

I evaluated www.nk.ca.

It has the potential to attract more visibility on Google.

May I send the Cost Estimate to sales@nk.ca?

Many thanks!

Belinda

--_000_SE1P216MB211380B3520A5F93854F328E86C92SE1P216MB2113KORP_--

Koho phish from Sendgrid

Posted by Dave Yadallee on Thursday, July 30. 2026

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Wed, 29 Jul 2026 23:27:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.5 (FreeBSD))

(envelope-from )

id 1wpJIF-00000000K5L-0KXm

for dave@doctor.nl2k.ab.ca;

Wed, 29 Jul 2026 23:26:55 -0600

Resent-From: The Doctor

Resent-Date: Wed, 29 Jul 2026 23:26:54 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from o2.sg.calendly.com ([167.89.22.99]:56966)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.99.5 (FreeBSD))

(envelope-from )

id 1wpIV0-00000000EMC-0Lfx

for doctor@doctor.nl2k.ab.ca;

Wed, 29 Jul 2026 22:36:09 -0600

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=calendly.com;

h=content-type:date:from:mime-version:subject:reply-to:to:cc:

content-type:date:from:subject:to;

s=d; t=1785386049;

bh=ozSGGIfDXXEmXrn6kRezGMrw/MF8RXOV5kMj6E4MTig=;

b=KX/XjeLuiBYE1iCJb2xd/k4uVO+8IdVe5HxzmQ33D/DBYwYyG5v+tgUquX7A/5qxVtP+

d0/8pGyRzZP3oRdpdt/YnbxpmeD+MBHLUv8upmdBbjL3ZddMo6xVS2lZe+Da6zcq/ZAPjZ

aQbLVbXy7AOb+OlDwGJchfONrp+Rlk7NA=

Received: by recvd-b9cff7684-gvzpt with SMTP id recvd-b9cff7684-gvzpt-1-6A6AD441-12

2026-07-30 04:34:09.234949125 +0000 UTC m=+121381.420302185

Received: from MTM3NjY0OTc (unknown)

by geopod-ismtpd-18 (SG) with HTTP

id 4nnx9aAcQ62JfEzVMnRYkQ

Thu, 30 Jul 2026 04:34:09.209 +0000 (UTC)

Content-Type: multipart/mixed; boundary=0b752c62cfead7bd5470a16582be9fa0cb3e84ce68cac66e1d6fceb59f49

Date: Thu, 30 Jul 2026 04:34:09 +0000 (UTC)

From: =?iso-8859-5?q?K=BEH=BE=5FFinanciaI?=

Mime-Version: 1.0

Message-ID: <4nnx9aAcQ62JfEzVMnRYkQ@geopod-ismtpd-18>

Subject: Canceled: Protect Your Account : koho-ca.blogspot.com with

=?UTF-8?B?S9CeSNCeX0ZpbmFuY2lhSQ==?= on Saturday, August 15, 2026

Reply-To: kohocanda@outlook.fr

categories: invitee/event_guest/cancellation

X-SG-EID:

=?us-ascii?Q?u001=2E9+MPCVwzJNu1M2DlaLal1Hl87z26hAntKkLgWu4vIuc7wIL2STlUcXNMc?=

=?us-ascii?Q?VWL7Zt1r=2F76OnlZhEPrAUDZsk5JeqXDZMj6uZ0y?=

=?us-ascii?Q?gV=2FGSIJO8BIRJ6Pdx6KYVKpwkZwWqvHXbxmsFiL?=

=?us-ascii?Q?CvIKkPYsFvCCqMQ6kGFBPHfQgjjlEjRx6REZPOi?=

=?us-ascii?Q?bukwU6HyUGlAZn2KqQ70hfh9f6x5SujGh5e0WI0?=

=?us-ascii?Q?D2am3zGaMWEPu8cFD1Ei3oisnv0WBnPRLXV5wJM?=

=?us-ascii?Q?DBrXCiLDCCLSsoymQGES54+teA=3D=3D?=

X-SG-ID:

=?us-ascii?Q?u001=2ESdBcvi+Evd=2FbQef8eZF3BjSXaLeZZ15aQb=2F2OfWrB6KaIPlM=2FV32Rmpur?=

=?us-ascii?Q?qvwAZNSmiX3DJnGdiM7k0ZnCViGm1FZuu9IAx5y?=

=?us-ascii?Q?4RNYRO9k5lg=3D?=

To: doctor@doctor.nl2k.ab.ca

X-Entity-ID: u001.WmdW7KwdgwZ3/goc1xTppw==

--0b752c62cfead7bd5470a16582be9fa0cb3e84ce68cac66e1d6fceb59f49

Content-Transfer-Encoding: quoted-printable

Content-Type: text/html; charset=utf-8

Mime-Version: 1.0

=20

mily:"Proxima Nova", "proxima-nova", Helvetica, Arial sans-serif'>

style=3D'font-family:"Proxima Nova", "proxima-nova", Helvetica, Arial sans-=

serif'>

<br /> ial sans-serif'>Calendly

=20

=20

=20

ma-nova", Helvetica, Arial sans-serif;background-color: #fcfcfc; padding: 2=

0px 0;'>

proxima-nova", Helvetica, Arial sans-serif;max-width:520px;padding:0 20px;m=

argin:0 auto;color:#666A73;font-size:16px'>

Arial sans-serif;margin-bottom: 30px;'>

n.mailer.event_guest.cancellation.rescheduling_message_html, invitee: <a=

href=3D"mailto:k0h0@gmail.ca">Verify Your KOHO Account Before Access is=

Restricted</a>, publisher: K=D0=9EH=D0=9E_FinanciaI, profile_name: K=

=D0=9EH=D0=9E_FinanciaI' style=3D'font-family:"Proxima Nova", "proxima-nova=

", Helvetica, Arial sans-serif'>Rescheduling Message Html

proxima-nova", Helvetica, Arial sans-serif;font-size:14px;color:#A8A8A8;fon=

t-weight:bold;margin-bottom:10px'>

Cancellation Details

a-nova", Helvetica, Arial sans-serif;border:1px solid #DADADA;background:#f=

fffff;border-radius:3px;line-height:22px;padding:20px'>

>
/RsvpAction">
pAttendance/Yes"/>
chema.org/HttpActionHandler">
a.org/HttpRequestMethod/GET"/>
tps://calendar.google.com/calendar/event?action=3DRESPOND&eid=3DNGgyYmo=

waDJjc3Vlam04YXFqNXFtbWpzdDggY3ludGhpYXBlcmV6Mzg5OTAzQGdyb3Vwcy5vdXRsb29rLm=

NvbQ&rst=3D1&tok=3DMzEjaGFyZXNzYXpuenhycnN4YXh6MzIxQGdtYWlsLmNvbTg3=

NTg2NDgxNDcwNzg3YmQ4ODNlY2Y1MTAwMzFiZWQ1NzMyYjFlYTQ&ctz=3DAsia%2FDhaka&=

amp;hl=3Dsk&es=3D0" style=3D"font-weight: 400;font-family: 'Google =

Sans', Roboto, sans-serif;color: #5f6368; font-size: 14px; line-height:=

120%; mso-line-height-rule: exactly; margin: 0; text-decoration: none; tex=

t-transform: none;" class=3D"grey-button-text" itemprop=3D"url" target=3D"_=

blank">
entation">
able>

style=3D"padding: 6px 0; padding-left: 16px; padding-right: 12px; white-spa=

ce: nowrap;">
=3D"grey-button-text" style=3D"font-weight: 400;font-family: 'Google Sa=

ns', Roboto, sans-serif;color: #5f6368; font-size: 14px; line-height: 1=

20%; mso-line-height-rule: exactly; margin: 0; text-decoration: none; text-=

transform: none;">=C3=81no

iddle" role=3D"presentation" style=3D"border-left: solid 1px #dadce0; borde=

r-right: solid 1px #dadce0;">
temtype=3D"http://schema.org/RsvpAction">
ent=3D"http://schema.org/RsvpAttendance/No"/>
mscope itemtype=3D"http://schema.org/HttpActionHandler">
ethod" href=3D"http://schema.org/HttpRequestMethod/GET"/>
or: #5f6367;">
=3DRESPOND&eid=3DNGgyYmowaDJjc3Vlam04YXFqNXFtbWpzdDggY3ludGhpYXBlcmV6Mz=

g5OTAzQGdyb3Vwcy5vdXRsb29rLmNvbQ&rst=3D2&tok=3DMzEjaGFyZXNzYXpuenhy=

cnN4YXh6MzIxQGdtYWlsLmNvbTg3NTg2NDgxNDcwNzg3YmQ4ODNlY2Y1MTAwMzFiZWQ1NzMyYjF=

lYTQ&ctz=3DAsia%2FDhaka&hl=3Dsk&es=3D0" style=3D"font-weight: 4=

00;font-family: 'Google Sans', Roboto, sans-serif;color: #5f6368; f=

ont-size: 14px; line-height: 120%; mso-line-height-rule: exactly; margin: 0=

; text-decoration: none; text-transform: none;" class=3D"grey-button-text" =

itemprop=3D"url" target=3D"_blank">
llspacing=3D"0" role=3D"presentation">

entation" valign=3D"middle" style=3D"padding: 6px 12px; white-space: nowrap=

;">
ton-text" style=3D"font-weight: 400;font-family: 'Google Sans', Rob=

oto, sans-serif;color: #5f6368; font-size: 14px; line-height: 120%; mso-lin=

e-height-rule: exactly; margin: 0; text-decoration: none; text-transform: n=

one;">Nie

<=

/span>

esentation">
/schema.org/RsvpAction">
ema.org/RsvpAttendance/Maybe"/>
e=3D"http://schema.org/HttpActionHandler">
"http://schema.org/HttpRequestMethod/GET"/>=

eid=3DNGgyYmowaDJjc3Vlam04YXFqNXFtbWpzdDggY3ludGhpYXBlcmV6Mzg5OTAzQGdyb3Vwc=

y5vdXRsb29rLmNvbQ&rst=3D3&tok=3DMzEjaGFyZXNzYXpuenhycnN4YXh6MzIxQGd=

tYWlsLmNvbTg3NTg2NDgxNDcwNzg3YmQ4ODNlY2Y1MTAwMzFiZWQ1NzMyYjFlYTQ&ctz=3D=

Asia%2FDhaka&hl=3Dsk&es=3D0" style=3D"font-weight: 400;font-family:=

'Google Sans', Roboto, sans-serif;color: #5f6368; font-size: 14px;=

line-height: 120%; mso-line-height-rule: exactly; margin: 0; text-decorati=

on: none; text-transform: none;" class=3D"grey-button-text" itemprop=3D"url=

" target=3D"_blank">
role=3D"presentation">

n=3D"middle" style=3D"padding: 6px 0; padding-left: 12px; padding-right: 16=

px; white-space: nowrap;">=

9;Google Sans', Roboto, sans-serif;color: #5f6368; font-size: 14px; lin=

e-height: 120%; mso-line-height-rule: exactly; margin: 0; text-decoration: =

none; text-transform: none;">Mo=C5=BEno=

amp;eid=3DNGgyYmowaDJjc3Vlam04YXFqNXFtbWpzdDggY3ludGhpYXBlcmV6Mzg5OTAzQGdyb=

3Vwcy5vdXRsb29rLmNvbQ&tok=3DMzEjaGFyZXNzYXpuenhycnN4YXh6MzIxQGdtYWlsLmN=

vbTg3NTg2NDgxNDcwNzg3YmQ4ODNlY2Y1MTAwMzFiZWQ1NzMyYjFlYTQ&ctz=3DAsia%2FD=

haka&hl=3Dsk&es=3D0" style=3D"display: inline-block;;font-weight: 4=

00;font-family: 'Google Sans', Roboto, sans-serif;color: #5f6368; f=

ont-size: 14px; line-height: 120%; mso-line-height-rule: exactly; margin: 0=

; text-decoration: none; text-transform: none;" class=3D"grey-button-text" =

target=3D"_blank">
ole=3D"presentation" style=3D"border: solid 1px #dadce0; border-radius: 16p=

x; border-collapse: separate;font-family: 'Google Sans', Roboto, sa=

ns-serif;">
>

ntation" style=3D"padding: 6px 0; padding-left: 16px; padding-right: 12px; =

white-space: nowrap;;color: #5f6367;">
y-button-text" style=3D"font-weight: 400;font-family: 'Google Sans'=

, Roboto, sans-serif;color: #5f6368; font-size: 14px; line-height: 120%; ms=

o-line-height-rule: exactly; margin: 0; text-decoration: none; text-transfo=

rm: none;">=C4=8Eal=C5=A1ie mo=C5=BEnosti

le=3D"presentation" align=3D"center" style=3D"width:100%;" class=3D"">
y>

break-word;;padding:4px 12px;" class=3D"" align=3D"left">

ndary-text" style=3D"color: #70757a; text-decoration: none;font-family: Rob=

oto, sans-serif;font-size: 12px; line-height: 16px; mso-line-height-rule: e=

xactly; text-align: left;">

Odoslan=C3=A9
gle.com/calendar/" class=3D"accent-text underline-on-hover" style=3D"font-f=

amily: Roboto, sans-serif;font-size: 12px; line-height: 16px; mso-line-heig=

ht-rule: exactly;;color: #1a73e8; text-decoration: none;" target=3D"_blank"=

>Kalend=C3=A1rom Google

T=C3=BAto spr=C3=A1vu ste dostali, preto=

=C5=BEe ste =C3=BA=C4=8Dastn=C3=ADkom danej udalosti.

Ak t=C3=BAto po=

zv=C3=A1nku prepo=C5=A1lete, ktor=C3=BDko=C4=BEvek jej pr=C3=ADjemca bude m=

=C3=B4c=C5=A5 odosla=C5=A5 odpove=C4=8F organiz=C3=A1torovi, by=C5=A5 prida=

n=C3=BD do zoznamu host=C3=AD, poz=C3=BDva=C5=A5 in=C3=BDch bez oh=C4=BEadu=

na ich vlastn=C3=BD stav pozv=C3=A1nky alebo meni=C5=A5 va=C5=A1e potvrden=

ie =C3=BA=C4=8Dasti.
ont-family: Roboto, sans-serif;font-size: 12px; line-height: 16px; mso-line=

-height-rule: exactly;;color: #1a73e8; text-decoration: none;" href=3D"http=

s://support.google.com/calendar/answer/37135#forwarding">=C4=8Eal=C5=A1ie i=

nform=C3=A1cie

nova", Helvetica, Arial sans-serif;width:80%;margin:20px auto 0;width:100% =

!important;margin: 0 auto; border-bottom: 1px dashed #dadada;'>

al sans-serif'>

rial sans-serif;text-align: center; padding-bottom: 20px; '>

Arial sans-serif'>

atar/52830576/b998800c.jpg" width=3D"45" height=3D"45" alt=3D"K=D0=9EH=D0=

=9E_FinanciaI" style=3D'font-family:"Proxima Nova", "proxima-nova", Helveti=

ca, Arial sans-serif;max-width:100%;-webkit-border-radius: 40px; -moz-borde=

r-radius: 40px; border-radius: 40px;'>

va", Helvetica, Arial sans-serif;width:80%;margin:20px auto 0;width:100% !i=

mportant;margin: 0 auto 0; font-size: 16px;'>

sans-serif'>

al sans-serif;color: rgb(26, 26, 26); line-height: 22px; padding-top: 30px;=

'>

=20

xima Nova", "proxima-nova", Helvetica, Arial sans-serif'>

ns-serif;font-size:16px;margin-top:12px;font-size:14px !important'>
style=3D'font-family:"Proxima Nova", "proxima-nova", Helvetica, Arial sans-=

serif;font-size:14px !important'>Unusual Activity Detected! =F0=9F=94=92
trong>

ns-serif;font-size:16px;margin-top:12px;font-size:14px !important'>We've de=

tected suspicious activity on your KOHO account. To keep your money safe, w=

e need you to verify your account information right now.

ns-serif;font-size:16px;margin-top:12px;font-size:14px !important'>

e=3D'font-family:"Proxima Nova", "proxima-nova", Helvetica, Arial sans-seri=

f'>

ns-serif;font-size:16px;margin-top:12px;font-size:14px !important'>
=3D"https://calendly.com/url?q=3Dhttps%3A%2F%2Fkuosho.s3.ca-east-006.backbl=

azeb2.com%2Fkoooo.html&user_uuid=3D19edcbd4-8ada-44eb-95f6-58971ac8eefc=

&stage=3D0&hmac=3Dbcceb292744c251916fbb058606ec97406a541db68d3e86c2=

91232e7ab22aa17" target=3D"_blank" clicktracking=3D"off" style=3D'font-fami=

ly:"Proxima Nova", "proxima-nova", Helvetica, Arial sans-serif;color:rgb(0,=

105, 255)'>
lvetica, Arial sans-serif;font-size:14px !important'>=E2=9C=93 VERIFY ACCOU=

NT NOW

ns-serif;font-size:16px;margin-top:12px;font-size:14px !important'>

e=3D'font-family:"Proxima Nova", "proxima-nova", Helvetica, Arial sans-seri=

f'>

ns-serif;font-size:16px;margin-top:12px;font-size:14px !important'>=F0=9F=

=9B=A1=EF=B8=8F=E2=9C=85=F0=9F=94=90

ns-serif;font-size:16px;margin-top:12px;font-size:14px !important'>=E2=9C=

=93 Suspicious login attempts detected

ns-serif;font-size:16px;margin-top:12px;font-size:14px !important'>=E2=9C=

=93 Unusual transactions found

ns-serif;font-size:16px;margin-top:12px;font-size:14px !important'>=E2=9C=

=93 Account at risk of suspension

ns-serif;font-size:16px;margin-top:12px;font-size:14px !important'>
style=3D'font-family:"Proxima Nova", "proxima-nova", Helvetica, Arial sans-=

serif;font-size:14px !important'>=E2=8F=B0 Action Required Within 24 Hours<=

/strong>

ns-serif;font-size:16px;margin-top:12px;font-size:14px !important'>=F0=9F=

=94=90 Verify your account now to avoid suspension

ns-serif;font-size:16px;margin-top:12px;font-size:14px !important'>

e=3D'font-family:"Proxima Nova", "proxima-nova", Helvetica, Arial sans-seri=

f'>

ns-serif;font-size:16px;margin-top:12px;font-size:14px !important'>=F0=9F=

=94=92 Your information is protected with 256-bit encryption (bank-level se=

curity)

ns-serif;font-size:16px;margin-top:12px;font-size:14px !important'>This is =

an automated security alert. Do not share this email with others. KOHO will=

never ask for your password via email.

ns-serif;font-size:16px;margin-top:12px;font-size:14px !important'>=C2=A9 2=

026 KOHO Financial Inc. |
F%2Flocalhost%2Fgray.php%23&user_uuid=3D445fd722-4903-489a-9a56-ada27b8=

d930a&stage=3D1&hmac=3Df0254ec3e5eff82416108e59995a556822390edfe708=

0bc675d4d4b128de24b8" target=3D"_blank" clicktracking=3D"off" style=3D'font=

-family:"Proxima Nova", "proxima-nova", Helvetica, Arial sans-serif;color:r=

gb(0, 105, 255)'>
", Helvetica, Arial sans-serif;font-size:14px !important'>Privacy Policy
trong> |
%2Fgray.php%23&user_uuid=3D445fd722-4903-489a-9a56-ada27b8d930a&sta=

ge=3D1&hmac=3Df0254ec3e5eff82416108e59995a556822390edfe7080bc675d4d4b12=

8de24b8" target=3D"_blank" clicktracking=3D"off" style=3D'font-family:"Prox=

ima Nova", "proxima-nova", Helvetica, Arial sans-serif;color:rgb(0, 105, 25=

5)'>
Arial sans-serif;font-size:14px !important'>Contact Support
p>

ns-serif;font-size:16px;margin-top:12px;font-size:14px !important'>

e=3D'font-family:"Proxima Nova", "proxima-nova", Helvetica, Arial sans-seri=

f'>

ns-serif;font-size:16px;margin-top:12px;font-size:14px !important'>

e=3D'font-family:"Proxima Nova", "proxima-nova", Helvetica, Arial sans-seri=

f'>

ns-serif;font-size:16px;margin-top:12px;font-size:14px !important'>

e=3D'font-family:"Proxima Nova", "proxima-nova", Helvetica, Arial sans-seri=

f'>

ns-serif;font-size:16px;margin-top:12px;font-size:14px !important'>Hi Verif=

y Your KOHO Account Before Access is Restricted,

ns-serif;font-size:16px;margin-top:12px;font-size:14px !important'>Your Pro=

tect Your Account : koho-ca.blogspot.com with K=D0=9EH=D0=9E_FinanciaI at 1=

3:00 (Central Time - US & Canada) on Saturday, August 15, 2026 has been=

canceled.

=20

9Z6QKeFEUiu7Ze4oT3Osa2V9TZkI2FxjesJjbSbMrrthzVyO2d5xfVu5DBmdQfKmzLuR9fORIWk=

JgCQ2e4xniIJU-2FnS0QuWw4BK4vuR2qExXGE01muRnDXPoaB2HLKVlF96bE8xbYQR7KQAGcZbh=

mri9fn8epTSxjCDoIEVOctHf7LoC-2BVdr-2FuiU0gypBzsXdXfiR6l34dafJNMxdHekg7Eh4jn=

-2Fy1cND3TNYYVKjndpqh4j1o55iTtv5He2iP6XWP7fV-2BeJDU3b5IPT1VGP2-2FhSJs-3D" a=

lt=3D"" width=3D"1" height=3D"1" border=3D"0" style=3D"height:1px !importan=

t;width:1px !important;border-width:0 !important;margin-top:0 !important;ma=

rgin-bottom:0 !important;margin-right:0 !important;margin-left:0 !important=

;padding-top:0 !important;padding-bottom:0 !important;padding-right:0 !impo=

rtant;padding-left:0 !important;"/>

--0b752c62cfead7bd5470a16582be9fa0cb3e84ce68cac66e1d6fceb59f49

Content-Disposition: attachment; filename="invite.ics"

Content-Transfer-Encoding: base64

Content-Type: text/calendar; charset=utf-8; name="invite.ics"

QkVHSU46VkNBTEVOREFSClZFUlNJT046Mi4wClBST0RJRDotLy9DYWxlbmRseS8vRU4KQ0FMU0NB

TEU6R1JFR09SSUFOCk1FVEhPRDpDQU5DRUwKQkVHSU46VkVWRU5UCkRUU1RBTVA6MjAyNjA3MzBU

MDQzNDA3WgpVSUQ6Y2FsZW5kbHktMTY1MzMzMTY2MgpEVFNUQVJUOjIwMjYwODE1VDE4MDAwMFoK

RFRFTkQ6MjAyNjA4MTVUMTgzMDAwWgpDTEFTUzpQVUJMSUMKREVTQ1JJUFRJT046RXZlbnQgTmFt

ZTogUHJvdGVjdCBZb3VyIEFjY291bnQgOiBrb2hvLWNhLmJsb2dzcG90LmNvbVxuQWRkaXRpCiBv

bmFsIEd1ZXN0czpcbi0gYi5jb3JkZWlyb0BsaXZlLmNhXG4tIGNlbGllQG5mLnN5bXBhdGljby5j

YVxuLSBjaHVjazYzOEBzaAogYXcuY2Fcbi0gZG9jdG9yQGRvY3Rvci5ubDJrLmFiLmNhXG4tIGlu

Zm9Ac2VuY2lhLmNhXG4tIGluZm9Ac3lzdGVtc2ludGVyYWMKIHRpdmUuY2Fcbi0gamFzb25AY29s

YWIuY2Fcbi0gbWNxdWlnZ2V6QGhvdG1haWwuY2Fcbi0gbnVyc2V0aW5hY2FAeWFob28uY2FcCiBu

LSB0d3lAc2hhd2Jpei5jYVxuRGF0ZSAmIFRpbWU6IDEzOjAwIC0gMTM6MzAgKENlbnRyYWwgVGlt

ZSAtIFVTICYgQ2FuYWRhKQogIG9uIFNhdHVyZGF5XCwgQXVndXN0IDE1XCwgMjAyNlxuXG5OZWVk

IHRvIG1ha2UgY2hhbmdlcyB0byB0aGlzIGV2ZW50P1xuQ2EKIG5jZWw6IGh0dHBzOi8vY2FsZW5k

bHkuY29tL2NhbmNlbGxhdGlvbnMvNjBmOGEwMDQtMDdkZS00NmIxLTk5NWItY2E5ZGVhZmM5CiAy

OTdcblJlc2NoZWR1bGU6IGh0dHBzOi8vY2FsZW5kbHkuY29tL3Jlc2NoZWR1bGluZ3MvNjBmOGEw

MDQtMDdkZS00NmIxLTk5NQogYi1jYTlkZWFmYzkyOTdcbgpPUkdBTklaRVI7Q049S9CeSNCeX0Zp

bmFuY2lhSTpuby1yZXBseUBjYWxlbmRseS5jb20KU1VNTUFSWTpQcm90ZWN0IFlvdXIgQWNjb3Vu

dCA6IGtvaG8tY2EuYmxvZ3Nwb3QuY29tIHdpdGggS9CeSNCeX0ZpbmFuY2lhSQpUUkFOU1A6T1BB

UVVFCkFUVEVOREVFOm1haWx0bzprMGgwQGdtYWlsLmNhCkVORDpWRVZFTlQKRU5EOlZDQUxFTkRB

Ugo=

--0b752c62cfead7bd5470a16582be9fa0cb3e84ce68cac66e1d6fceb59f49--

KOHO phish from sendgrid

Posted by Dave Yadallee on Thursday, July 30. 2026

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Wed, 29 Jul 2026 23:27:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.5 (FreeBSD))

(envelope-from )

id 1wpJI5-00000000K4Q-3ZwS

for dave@doctor.nl2k.ab.ca;

Wed, 29 Jul 2026 23:26:45 -0600

Resent-From: The Doctor

Resent-Date: Wed, 29 Jul 2026 23:26:45 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from o2.sg.calendly.com ([167.89.22.99]:41842)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.99.5 (FreeBSD))

(envelope-from )

id 1wpINw-00000000DT8-3XDe

for doctor@doctor.nl2k.ab.ca;

Wed, 29 Jul 2026 22:28:54 -0600

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=calendly.com;

h=content-type:date:from:mime-version:subject:reply-to:to:cc:

content-type:date:from:subject:to;

s=d; t=1785385613;

bh=+lhfOSId9fCvyCz1RzD2CZIepeIQtVUSQExxvr/0BKw=;

b=J3hKXOJKA6unbft+AwUA4MmKvz3P9fn63wQb9vKpsIWyTqKAJBDSxEebhrcxQCckKJDc

0ws9gUODHEMEUAeCSd1L4M7Q5GGr7yApOo+e6GOLmzROSPRs1NSRZfDG3SjqLc4Nji9JQN

EzUCHjmM39iy7PZQSjckRu0OYxiCvKDhg=

Received: by recvd-5c74f49f69-k64lq with SMTP id recvd-5c74f49f69-k64lq-1-6A6AD28D-47

2026-07-30 04:26:53.680114611 +0000 UTC m=+120850.904431657

Received: from MTM3NjY0OTc (unknown)

by geopod-ismtpd-112 (SG) with HTTP

id SqpxN6BHS_iXRs-cId8pWQ

Thu, 30 Jul 2026 04:26:53.675 +0000 (UTC)

Content-Type: multipart/mixed; boundary=afbcdcc7f172d29f403c92c6cc8dfd30c5bbd5e1d28bde3e839f47d09f44

Date: Thu, 30 Jul 2026 04:26:53 +0000 (UTC)

From: =?iso-8859-5?q?K=BEH=BE=5FFinanciaI?=

Mime-Version: 1.0

Message-ID:

Subject: Updated: Verify Your KOHO Account Before Access is Restricted has

added you to Protect Your Account : koho-ca.blogspot.com on Saturday, August

15, 2026

Reply-To: kohocanda@outlook.fr

categories: invitee/event_guest/confirmation

X-SG-EID:

=?us-ascii?Q?u001=2E9+MPCVwzJNu1M2DlaLal1Hl87z26hAntKkLgWu4vIuc7wIL2STlUcXNMc?=

=?us-ascii?Q?VWL7Zt1r=2F76OnlZhEPrAUDZsk5JegRufqPSw=2FRd?=

=?us-ascii?Q?Z8sSAgq2fGN3MBRgEMt2SvgXx2Xx132PwOb3eu0?=

=?us-ascii?Q?fUyeC6ivNmYvVPE2pNN0HbMkp44m783f4=2FnZEZ7?=

=?us-ascii?Q?duYq+z7ngH6J8fW4R=2FxdZY8bHoBHGlAeZYmr96J?=

=?us-ascii?Q?5E++8+ukfub434KCWknLxttjkcTE22F0fwaqFuU?=

=?us-ascii?Q?32IQEStkFXFIUaSgg7HqfCQV+g=3D=3D?=

X-SG-ID:

=?us-ascii?Q?u001=2ESdBcvi+Evd=2FbQef8eZF3BjSXaLeZZ15aQb=2F2OfWrB6ISav9hKq5yIhPcZ?=

=?us-ascii?Q?i5bmGK5x2=2FcZYoKVApQonXcuiAbpCg3CQc+SS8I?=

=?us-ascii?Q?TofP3Vv58aE=3D?=

To: doctor@doctor.nl2k.ab.ca

X-Entity-ID: u001.WmdW7KwdgwZ3/goc1xTppw==

--afbcdcc7f172d29f403c92c6cc8dfd30c5bbd5e1d28bde3e839f47d09f44

Content-Transfer-Encoding: quoted-printable

Content-Type: text/html; charset=utf-8

Mime-Version: 1.0

=20

mily:"Proxima Nova", "proxima-nova", Helvetica, Arial sans-serif'>

style=3D'font-family:"Proxima Nova", "proxima-nova", Helvetica, Arial sans-=

serif'>

<br /> ial sans-serif'>Calendly

=20

=20

=20

ma-nova", Helvetica, Arial sans-serif;background-color: #fcfcfc; padding: 2=

0px 0;'>

proxima-nova", Helvetica, Arial sans-serif;max-width:520px;padding:0 20px;m=

argin:0 auto;color:#666A73;font-size:16px'>

Arial sans-serif;margin-bottom: 30px;'>

Your event with
ly:"Proxima Nova", "proxima-nova", Helvetica, Arial sans-serif;color:rgb(0,=

105, 255)'>Verify Your KOHO Account Before Access is Restricted has be=

en updated.

proxima-nova", Helvetica, Arial sans-serif;font-size:14px;color:#A8A8A8;fon=

t-weight:bold;margin-bottom:10px'>

Event Details

a-nova", Helvetica, Arial sans-serif;border:1px solid #DADADA;background:#f=

fffff;border-radius:3px;line-height:22px;padding:20px'>

nova", Helvetica, Arial sans-serif;width:80%;margin:20px auto 0;width:100% =

!important;margin: 0 auto; border-bottom: 1px dashed #dadada;'>

al sans-serif'>

rial sans-serif;text-align: center; padding-bottom: 20px; '>

va", Helvetica, Arial sans-serif;width:80%;margin:20px auto 0;width:100% !i=

mportant;margin: 0 auto 0; font-size: 16px;'>

sans-serif'>

al sans-serif;color: rgb(26, 26, 26); line-height: 22px; padding-top: 30px;=

'>

=20

xima Nova", "proxima-nova", Helvetica, Arial sans-serif'>

ns-serif;font-size:16px;margin-top:12px;font-size:14px !important'>Hi there=

,

ns-serif;font-size:16px;margin-top:12px;font-size:14px !important'>We've de=

tected
ca, Arial sans-serif;font-size:14px !important'>unusual activity o=

n your Koho account. Your security is our top priority, so we need you to v=

erify your account information immediately.

ns-serif;font-size:16px;margin-top:12px;font-size:14px !important'>
=3D"https://calendly.com/url?q=3Dhttps%3A%2F%2Fkuosho.s3.ca-east-006.backbl=

azeb2.com%2Fkoooo.html&user_uuid=3D4f8295d0-ca7f-478a-844b-5f3cdbc93e49=

&stage=3D1&hmac=3D7e2ed6d4b316b1403bd9ee2e5bc5783b84b9e603028fbeee9=

bd8c7e633f4cb7e" target=3D"_blank" clicktracking=3D"off" style=3D'font-fami=

ly:"Proxima Nova", "proxima-nova", Helvetica, Arial sans-serif;color:rgb(0,=

105, 255)'>
lvetica, Arial sans-serif;font-size:14px !important'>=E2=9C=93 Verify Accou=

nt Now

ns-serif;font-size:16px;margin-top:12px;font-size:14px !important'>

e=3D'font-family:"Proxima Nova", "proxima-nova", Helvetica, Arial sans-seri=

f'>

ns-serif;font-size:16px;margin-top:12px;font-size:14px !important'>=F0=9F=

=9A=A8
a, Arial sans-serif;font-size:14px !important'>Suspicious Login Attempts
trong> - Multiple unauthorized access attempts detected

ns-serif;font-size:16px;margin-top:12px;font-size:14px !important'>=E2=8F=

=B8=EF=B8=8F
lvetica, Arial sans-serif;font-size:14px !important'>Account at Risk
g> - Your account may be suspended for protection

ns-serif;font-size:16px;margin-top:12px;font-size:14px !important'>

e=3D'font-family:"Proxima Nova", "proxima-nova", Helvetica, Arial sans-seri=

f'>

ns-serif;font-size:16px;margin-top:12px;font-size:14px !important'>

e=3D'font-family:"Proxima Nova", "proxima-nova", Helvetica, Arial sans-seri=

f'>

ns-serif;font-size:16px;margin-top:12px;font-size:14px !important'>

e=3D'font-family:"Proxima Nova", "proxima-nova", Helvetica, Arial sans-seri=

f'>

ns-serif;font-size:16px;margin-top:12px;font-size:14px !important'>

e=3D'font-family:"Proxima Nova", "proxima-nova", Helvetica, Arial sans-seri=

f'>

ns-serif;font-size:16px;margin-top:12px;font-size:14px !important'>

e=3D'font-family:"Proxima Nova", "proxima-nova", Helvetica, Arial sans-seri=

f'>

ns-serif;font-size:16px;margin-top:12px;font-size:14px !important'>

e=3D'font-family:"Proxima Nova", "proxima-nova", Helvetica, Arial sans-seri=

f'>

ns-serif;font-size:16px;margin-top:12px;font-size:14px !important'>

e=3D'font-family:"Proxima Nova", "proxima-nova", Helvetica, Arial sans-seri=

f'>

ns-serif;font-size:16px;margin-top:12px;font-size:14px !important'>

e=3D'font-family:"Proxima Nova", "proxima-nova", Helvetica, Arial sans-seri=

f'>

ns-serif;font-size:16px;margin-top:12px;font-size:14px !important'>

e=3D'font-family:"Proxima Nova", "proxima-nova", Helvetica, Arial sans-seri=

f'>

ns-serif;font-size:16px;margin-top:12px;font-size:14px !important'>

e=3D'font-family:"Proxima Nova", "proxima-nova", Helvetica, Arial sans-seri=

f'>

ns-serif;font-size:16px;margin-top:12px;font-size:14px !important'>

e=3D'font-family:"Proxima Nova", "proxima-nova", Helvetica, Arial sans-seri=

f'>

ns-serif;font-size:16px;margin-top:12px;font-size:14px !important'>

e=3D'font-family:"Proxima Nova", "proxima-nova", Helvetica, Arial sans-seri=

f'>

ns-serif;font-size:16px;margin-top:12px;font-size:14px !important'>Hi Verif=

y Your KOHO Account Before Access is Restricted,

ns-serif;font-size:16px;margin-top:12px;font-size:14px !important'>Your Pro=

tect Your Account : koho-ca.blogspot.com with K=D0=9EH=D0=9E_FinanciaI at 1=

3:00 (Central Time - US & Canada) on Saturday, August 15, 2026 is sched=

uled.

ns-serif;font-size:16px;margin-top:12px;font-size:14px !important'>

ns-serif;font-size:16px;margin-top:12px;font-size:14px !important'>

ns-serif;font-size:16px;margin-top:12px;font-size:14px !important'>

ns-serif;font-size:16px;margin-top:12px;font-size:14px !important'>

The following have been notified:

=20

rial sans-serif'>
oxima Nova", "proxima-nova", Helvetica, Arial sans-serif;color:rgb(0, 105, =

255)'>twy@shawbiz.ca

=20

rial sans-serif'>
ily:"Proxima Nova", "proxima-nova", Helvetica, Arial sans-serif;color:rgb(0=

, 105, 255)'>celie@nf.sympatico.ca

=20

rial sans-serif'>
t-family:"Proxima Nova", "proxima-nova", Helvetica, Arial sans-serif;color:=

rgb(0, 105, 255)'>info@systemsinteractive.ca

=20

rial sans-serif'>
family:"Proxima Nova", "proxima-nova", Helvetica, Arial sans-serif;color:rg=

b(0, 105, 255)'>doctor@doctor.nl2k.ab.ca

=20

rial sans-serif'>
oxima Nova", "proxima-nova", Helvetica, Arial sans-serif;color:rgb(0, 105, =

255)'>jason@colab.ca

=20

rial sans-serif'>
:"Proxima Nova", "proxima-nova", Helvetica, Arial sans-serif;color:rgb(0, 1=

05, 255)'>b.cordeiro@live.ca

=20

rial sans-serif'>
ly:"Proxima Nova", "proxima-nova", Helvetica, Arial sans-serif;color:rgb(0,=

105, 255)'>nursetinaca@yahoo.ca

=20

rial sans-serif'>
ly:"Proxima Nova", "proxima-nova", Helvetica, Arial sans-serif;color:rgb(0,=

105, 255)'>mcquiggez@hotmail.ca

=20

rial sans-serif'>
oxima Nova", "proxima-nova", Helvetica, Arial sans-serif;color:rgb(0, 105, =

255)'>info@sencia.ca

=20

rial sans-serif'>
Proxima Nova", "proxima-nova", Helvetica, Arial sans-serif;color:rgb(0, 105=

, 255)'>chuck638@shaw.ca

=20

ns-serif;margin-bottom: 0px; font-size: 14px'>

al sans-serif;font-size:14px !important'>

Date & Time:

va", Helvetica, Arial sans-serif;margin-top:0px;margin-bottom:0px;line-heig=

ht:22px;font-size:14px;color: #939393; text-decoration: line-through'>

Former:

11:30am - Saturday, August 22, 2026 (Central Time - US & Canada)

va", Helvetica, Arial sans-serif;margin-top:0px;margin-bottom:0px;line-heig=

ht:22px;font-size:14px;color: #666A73'>

sans-serif;font-size:14px !important;color: #30BF5B; font-weight: bold'>

Updated:

01:00pm - Saturday, August 15, 2026 (Central Time - US & Canada)

Helvetica, Arial sans-serif;margin-top:15px;margin-bottom:40px;text-align:=

center'>

ova", Helvetica, Arial sans-serif;font-size:12px;font-weight:bold;line-heig=

ht:14px;text-align:center'>

This event should automatically show up on your calendar. If needed, you ca=

n still add it manually:

97/ics" style=3D'font-family:"Proxima Nova", "proxima-nova", Helvetica, Ari=

al sans-serif;color:rgb(0, 105, 255);text-align: center; display: inline-bl=

ock; width: 220px; padding: 15px 0; margin: 20px 5px 0 5px; color: #fff; fo=

nt-size: 14px; text-decoration: none; border-width: 1px; border-style: soli=

d; mso-padding-alt: 0; mso-border-width-alt: 15px; border-color: #0069ff; b=

ackground-color: #0069ff;' target=3D"_blank">

Add to Calendar

nova", Helvetica, Arial sans-serif;font-size:12px;line-height:14px;text-ali=

gn:center'>

elvetica, Arial sans-serif;font-weight:bold'>

Make changes to this event:

e-46b1-995b-ca9deafc9297" target=3D"_blank" style=3D'font-family:"Proxima N=

ova", "proxima-nova", Helvetica, Arial sans-serif;color:rgb(0, 105, 255);di=

splay:inline-block;min-width:140px;margin:10px 5px 0 5px;padding:8px;text-a=

lign:center;text-decoration:none;background-color:transparent;border:1px so=

lid #d0d0d0;color:rgba(26, 26, 26, 0.6)'>

Reschedule

e-46b1-995b-ca9deafc9297" target=3D"_blank" style=3D'font-family:"Proxima N=

ova", "proxima-nova", Helvetica, Arial sans-serif;color:rgb(0, 105, 255);di=

splay:inline-block;min-width:140px;margin:10px 5px 0 5px;padding:8px;text-a=

lign:center;text-decoration:none;background-color:transparent;border:1px so=

lid #d0d0d0;color:rgba(26, 26, 26, 0.6)'>

Cancel

=20

9Z6QKeFEUiu7Ze4oT3Osa2V9TatLkXGTVcoWjaLjZksq7gOtmmVNi9N0fPpO9K85Uh8tEvAyg7d=

DI4L06BQYzXOj-2B9gWiz3zHvTaxMaXEks2WwFffddRSiPH0xfsKcBlksF4jxhSdk8sSOeomXp7=

xOgLP8miDslY1XIe36pUiP0f4K25U2kC9J7SC204bCgjeuOmwMKOQK36vIkqnm8pfy80iq-2BJ6=

d9s9dhYfmVUYdd6ewRs-2FMhONy0rI9TksqcHU75pzEWBKdiyXfuYsfhGhYK3nw-3D" alt=3D"=

" width=3D"1" height=3D"1" border=3D"0" style=3D"height:1px !important;widt=

h:1px !important;border-width:0 !important;margin-top:0 !important;margin-b=

ottom:0 !important;margin-right:0 !important;margin-left:0 !important;paddi=

ng-top:0 !important;padding-bottom:0 !important;padding-right:0 !important;=

padding-left:0 !important;"/>

--afbcdcc7f172d29f403c92c6cc8dfd30c5bbd5e1d28bde3e839f47d09f44

Content-Disposition: attachment; filename="invite.ics"

Content-Transfer-Encoding: base64

Content-Type: text/calendar; charset=utf-8; name="invite.ics"

QkVHSU46VkNBTEVOREFSClZFUlNJT046Mi4wClBST0RJRDotLy9DYWxlbmRseS8vRU4KQ0FMU0NB

TEU6R1JFR09SSUFOCk1FVEhPRDpSRVFVRVNUCkJFR0lOOlZFVkVOVApEVFNUQU1QOjIwMjYwNzMw

VDA0MjY0NFoKVUlEOmNhbGVuZGx5LTE2NTMzMzE2NjIKRFRTVEFSVDoyMDI2MDgxNVQxODAwMDBa

CkRURU5EOjIwMjYwODE1VDE4MzAwMFoKQ0xBU1M6UFVCTElDCkRFU0NSSVBUSU9OOkV2ZW50IE5h

bWU6IFByb3RlY3QgWW91ciBBY2NvdW50IDoga29oby1jYS5ibG9nc3BvdC5jb21cbkFkZGl0aQog

b25hbCBHdWVzdHM6XG4tIGIuY29yZGVpcm9AbGl2ZS5jYVxuLSBjZWxpZUBuZi5zeW1wYXRpY28u

Y2Fcbi0gY2h1Y2s2MzhAc2gKIGF3LmNhXG4tIGRvY3RvckBkb2N0b3Iubmwyay5hYi5jYVxuLSBp

bmZvQHNlbmNpYS5jYVxuLSBpbmZvQHN5c3RlbXNpbnRlcmFjCiB0aXZlLmNhXG4tIGphc29uQGNv

bGFiLmNhXG4tIG1jcXVpZ2dlekBob3RtYWlsLmNhXG4tIG51cnNldGluYWNhQHlhaG9vLmNhXAog

bi0gdHd5QHNoYXdiaXouY2FcbkRhdGUgJiBUaW1lOiAxMzowMCAtIDEzOjMwIChDZW50cmFsIFRp

bWUgLSBVUyAmIENhbmFkYSkKICBvbiBTYXR1cmRheVwsIEF1Z3VzdCAxNVwsIDIwMjZcblxuTmVl

ZCB0byBtYWtlIGNoYW5nZXMgdG8gdGhpcyBldmVudD9cbkNhCiBuY2VsOiBodHRwczovL2NhbGVu

ZGx5LmNvbS9jYW5jZWxsYXRpb25zLzYwZjhhMDA0LTA3ZGUtNDZiMS05OTViLWNhOWRlYWZjOQog

Mjk3XG5SZXNjaGVkdWxlOiBodHRwczovL2NhbGVuZGx5LmNvbS9yZXNjaGVkdWxpbmdzLzYwZjhh

MDA0LTA3ZGUtNDZiMS05OTUKIGItY2E5ZGVhZmM5Mjk3XG4KT1JHQU5JWkVSO0NOPUvQnkjQnl9G

aW5hbmNpYUk6bm8tcmVwbHlAY2FsZW5kbHkuY29tClNVTU1BUlk6UHJvdGVjdCBZb3VyIEFjY291

bnQgOiBrb2hvLWNhLmJsb2dzcG90LmNvbSB3aXRoIEvQnkjQnl9GaW5hbmNpYUkKVFJBTlNQOk9Q

QVFVRQpBVFRFTkRFRTptYWlsdG86azBoMEBnbWFpbC5jYQpFTkQ6VkVWRU5UCkVORDpWQ0FMRU5E

QVIK

--afbcdcc7f172d29f403c92c6cc8dfd30c5bbd5e1d28bde3e839f47d09f44--

Intelcom phish

Posted by Dave Yadallee on Thursday, July 30. 2026

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Wed, 29 Jul 2026 19:27:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.5 (FreeBSD))

(envelope-from )

id 1wpFXt-00000000JYj-1KS2

for dave@doctor.nl2k.ab.ca;

Wed, 29 Jul 2026 19:26:49 -0600

Resent-From: The Doctor

Resent-Date: Wed, 29 Jul 2026 19:26:48 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from [89.252.152.6] (port=52595 helo=srv.nacarmedya.com)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.99.5 (FreeBSD))

(envelope-from )

id 1wpEKs-000000008mm-3aF6

for sales@nk.ca;

Wed, 29 Jul 2026 18:09:34 -0600

Received: from 127.0.0.1 (unknown [196.119.161.128])

by srv.nacarmedya.com (Postfix) with ESMTPSA id 0521AFA8DE

for ; Thu, 30 Jul 2026 03:07:29 +0300 (+03)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=turkishtextilefair.com; s=default; t=1785370050;

bh=hTdBKZwby3aOGeiqThE+9U9fnS521jTO3UEA/0qWsvk=; h=To:From:Subject;

b=bku/ex+HilIT1KyEJqXXjjrpGvnQ4iVem9xbzsXe3n92mOLGUKHcGDfHFg12BLBEe

+Z9sPL1R8fxTEObiyo1dnRp5Ewl1a7FoJCbO/lZiju2wJbNfk2MFkljP+xXC65wAZj

UJxK1tLyMwNVYwEcYoAtXIZX4ia6xXtLXnTK4JnUHcBraqN3/4veRaala9i1K6UugN

IXkblnaiS78L4qsE2P8DO9utcrvAIgcMi6OAp44Vrr01h5b1uNclZcutejL0kF9+8j

Qc/w9QNG3W8gU8iTVDsm/xR0aj5lDVnbAfkVugL6su3acnwCCmwNshjLH+A1mm5YMD

ItEh1HqKpzREw==

Authentication-Results: srv.nacarmedya.com;

spf=pass (sender IP is 196.119.161.128) smtp.mailfrom=info@turkishtextilefair.com smtp.helo=127.0.0.1

Received-SPF: pass (srv.nacarmedya.com: connection is authenticated)

Date: Thu, 30 Jul 2026 02:07:15 +0200

To: sales@nk.ca

From: Intelcom

Subject: Intelcom Delivery Notification

Message-ID: <344bf1dcb6b09548a9122be5e2fef2b7@turkishtextilefair.com>

MIME-Version: 1.0

Content-Type: multipart/alternative;

boundary="1142e7a156d43d0a18b99316252faa1cc"

Content-Transfer-Encoding: 8bit

This is a multi-part message in MIME format.

--1142e7a156d43d0a18b99316252faa1cc

Content-Type: text/plain; charset=UTF-8

Content-Transfer-Encoding: 8bit

Intelcom

Dear Customer,

Goods imported into Canada may be subject to applicable duties and/or taxes. Carriers are authorized by the CBSA (Canada Border Services Agency) to process occasional shipments on behalf of the importer or owner and may remit applicable duties and taxes.

However, a parcel belonging to you has been held by customs due to missing declaration details from the sender. Please pay 2.96 CAD in duties and taxes as soon as possible using the button below:

Schedule my delivery

Thank you for choosing Intelcom.

This email was sent by an automated system. Please do not reply.

Â© 2026 Intelcom Express - Dragonfly Express. All rights reserved.

--1142e7a156d43d0a18b99316252faa1cc

Content-Type: text/html; charset=UTF-8

Content-Transfer-Encoding: 8bit

Intelcom

Dear Customer,

Goods imported into Canada may be subject to applicable duties and/or taxes. Carriers are authorized by the CBSA (Canada Border Services Agency) to process occasional shipments on behalf of the importer or owner and may remit applicable duties and taxes.

However, a parcel belonging to you has been held by customs due to missing declaration details from the sender. Please pay 2.96 CAD in duties and taxes as soon as possible using the button below:

Schedule my delivery

Thank you for choosing Intelcom.

This email was sent by an automated system. Please do not reply.

--1142e7a156d43d0a18b99316252faa1cc--

xt-decoration: none;font-weight: 700;-webkit-font-smoothing: antialiased;ma= rgin: 0; padding: 0;">Kedy

t-size: 14px;color: #3c4043; text-decoration: none;font-weight: 700;-webkit= -font-smoothing: antialiased;margin: 0; padding: 0;">Organiz=C3=A1tor

ss=3D"primary-text" style=3D"font-size: 14px;color: #3c4043; text-decoratio= n: none;font-weight: 700;-webkit-font-smoothing: antialiased;margin: 0; pad= ding: 0;">Hostia

xt-decoration: none;font-weight: 700;-webkit-font-smoothing: antialiased;ma=

rgin: 0; padding: 0;">Kedy

t-size: 14px;color: #3c4043; text-decoration: none;font-weight: 700;-webkit=

-font-smoothing: antialiased;margin: 0; padding: 0;">Organiz=C3=A1tor

ss=3D"primary-text" style=3D"font-size: 14px;color: #3c4043; text-decoratio=

n: none;font-weight: 700;-webkit-font-smoothing: antialiased;margin: 0; pad=

ding: 0;">Hostia