NetKnow now in NetCraft's Top 11400 part 2

Posted by Dave Yadallee on


MCSnet





MCSNET ranks >2000000 from >2000000 and are hosted by Microsoft .



Nucleus Internet Services





After that we have

Nucleus Information Services which can be found at Netcraft Rank >2000000 from >2000000 .





4Web





4web ranks >2000000 from >2000000 .



Alentus / Wolfpaw





Alentus

rank by Netcraft >2000000 from >2000000 and I note they are hosted in the USA .

wolfpaw.net

which ranks at >2000000 from >2000000



Yellowpencil





Yellowpencil Ranks >2000000 from >2000000



WSI Corporation





Next is WSI - We Simply The Internet of Toronto

at Netcraft Position >2000000 from >2000000 and are being hosted on Amazon.



Uniserve / Interbaun





Next, Uniserve

ranks on Netcraft >2000000 from >2000000

One of their acquisitions

interbaun

ranks with Netcraft ?????? from ?????? due to merging of sites.

One customer just came over from this organization in Nov 2006.



Clearwave Broadband





Clearwave Broadband ranks

at >2000000 from >2000000



Platinum Communications





Platinum Communications Corp.

bought out by Xplornet .



Wild Rose Internet





Wild Rose Internet

ranks >2000000 from >2000000 and I wonder if this is another wireless branch of Tera-Byte and bought out by Xplornet





TIC Internet





TIC Internet

ranks >2000000 from >2000000 ( I do remember you).



Nisa Custom Internet Solutions





Nisa Custom Internet Solutions

ranks >2000000 from >2000000 by Netcraft



MediaShaker





Media Shakers of Edmonton

ranks >2000000 from >2000000





Koi Media





Koi Media

rank >2000000 from >2000000



WebFire





Webfire.ca

ranks >2000000 from >2000000 and seems to be connected with Shaw.



Core Network Solutions Inc.





Core Network Solutions Inc.

ranks at >2000000 from >2000000 .



The Network Centre





The Network Centre

ranks >2000000 from >2000000 and are linked with Telus high Speed.





Open Concept Internet, Inc.





Open Concept Internet, Inc.

rank > 2000000 from > 2000000





Techalta





Interspots of Edmonton

acquired by Techalta ;



Yegtel





Yegtel rank > 2000000 .



Internet Crossroads





Internet Crossroads Ltd of North Edmonton

rank nothing from nothing by Netcraft and seems to merged with Tera-Byte/ecn.ab.ca .



If I remember anymore, I will add to this entry, before Netcraft changes our ranking. Please watch this space and please feel free to peruse

our services.

NetKnow now in NetCraft's Top 11400 part 1

Posted by Dave Yadallee on
All data is from Netcraft Toolbar .

Looks as if there are major changes to the Netcraft algorithm after some years! Why did Avast clasify the extension as URL:Phishing?

This is not the Alexa Tool Bar!



NetKnow







Netknow now at 11388 from 11738 at Netcraft and pfs compliant



A slight increase! We must do
  1. security audits regularly
  2. check on illegitimate traffic hitting the web server


    3. and
  3. keep design current!




How do we compare with other providers in

Edmonton, Alberta, Canada?



Rogers





Rogers Business Solutions

which rank 4268 from 4137 and are hosted in Europe.



Telus and reviews



Next we have Telus.com

ranked by Netcraft at 6285 from 6245 .

Sometimes their Web Hosting is done by
title="Internet Names for Business">Internet Names for Business

is ranked by Netcraft at >2000000 from >2000000 .



Is Telus's ADSL network susceptible to Code Red Attacks and Attackers?

Reviews of Telus are available :





Netknow again





We at Netknow are at 11388 from 18857 since the start of 2026.



Government of Alberta



The Government of Alberta Website

ranks 14751 from 14788 by Netcraft and seems to hosted on Cloudfare.



City of Edmonton







The City of Edmonton ranks 30321 from 29654 by Netcraft and hosted by Google.



University of Alberta







The University of Alberta ranks 52672 from 52622 hosted by Amazon Techonologies.



Juno and NetZero





We have Juno Internet ranked on top

at 294205 from 293334 who are the owners of

US Based Netzero at Netcraft Rank 74900 from 72855 .



Grant MacEwen University





MacEwan ranks 109656 from 113457 .



NAIT / Northern Alberta Institute of Technology





NAIT ranks 110255 from 120680 hosted by Microsoft .



TekSavvy



TekSavvy ranks 239733 from 215114 and are hosted by Microsoft



Shaw Cable





Next,

members.shaw.ca

ranks >2000000 from >2000000 and retired and

Shaw Cable

is next at Netcraft rank 1181181 from 1196278 . Hosted now by Akamei .

Their Network Hosting Arm,

Big Pipe is at

Netcraft rank 289186 from 310103 and hosted by Akamai in Europe .



Reviews of Shaw are available :





Xplornet



xplornet

ranks >2000000 from >2000000 and are listed with

Cirrus9 and are joining up with Shaw.

Their new domain xplore.ca ranks 353903 from 352757 .

According to an article in the Sherwood Park Independent, they are also getting an Alberta Government subsidy.



Internet Centre / CCINet



Internet Centre

rank 440510 from 497223 . Their partner Rack Nine ranks > 2000000.



Distributel / 3Web / CIA



Cybersurf

is ranked 915909 from 920644 and seems to be hosted in USA by DigitalOcean.



Primus



Primus

ranks >2000000 from >2000000 and now points to BLACKIRON_DataCentres ranked >2000000 from >2000000.



Northern lights Fiber







Northern lights Fiber are ranked by Netcraft >2000000 and uses AWS.



OkayVPN





OkayVPN

are ranked by Netcraft >2000000 and uses Cloudfare.



Radiant Communications / goco.ca





Radiant Communications

are ranked by Netcraft >2000000 and part of goco.ca

which ranks >2000000 .



Tera Byte Edmonton and reviews





Next is Tera-Byte

at Netcraft Rank >2000000 with

Tera-Byte.ca

ranking >2000000 from >2000000 and their wireless arm Tera-Byte Wireless

sold to Xplornet.

One of Tera-Byte's acquisitions

Edmonton Community Networks

ranks at >2000000 from >2000000 and

Go Edmonton ranks >2000000 from >2000000.

Alberta political blogger Daveberta ranks >2000000 from >2000000; interesting!!!

Reviews of Tera-byte is available at

here

and another here

and check Google for more reviews; just search tera byte.

ScotiaBank Phish Part 2

Posted by Dave Yadallee on
B+BxtDuhBIfiV/RNH7188AFZ73l8YykCBDFx3hUeI+KUrysVsAHZyK789Yt/YakpqQSvyKAS/FA=

ftq+Ir6RiybwaUKNSPEMxN9dWdG5Z05nll9qw3V0LjKKs/wSBy4e/t1IU+07ZCk/82APqqsuw2o=

9AUojGRVu65CfYpUzTp0RHGTi11fuFnuJSlHh13LX6eCSibw/YPX4+Ob4FUoixYbv0OA1+9tPm5=

NPDw14S/P2lSSJIhSQ5RfCnNwf7Pr7R1SL5bZDsptSytiPgdlp913Y9dCNLZyUqRqkKLv/vOSjN=

kkGSYnf2TiVhHzOy4CLdo5fdMqUFe6Q3Wct5+pEO8gKzmodUSm/E2m1G/IFooJfkt/VyOGJ/d+j=

jR7Of5yByASJjr3wWW8ExT/xSvltp/qeakmDlPTzasT5zZ2S+RYHtHL8Zg8Pi/UhTtcXy8UoO/+=

nv8kvVUu0OKqcTIFIx7drmOMHMxItyUeMpjnnVzI0AFJ+tRy/Kz72tAa/1ozza3rZhw0q+P2WO2=

3pa8EvW29vaU9I7rzW7lfl1xyrHGNu/9S7Rza1L1g46fFc0Q4ItEb88hXHLDnkdE7XX+OU4X/BF=

zynzvorNtfz+vlUrp9x9kWpK67n4/WX86s5WQ/j+zf4BWH5dfUgxwjqhSjT/MkpjnbtVAU4U64D=

gs0H5kVcRdeLV5W+zcUiM21PqbCRdMFT4rcnLHJNJsISodC8/Zxu6XBM06lKcRTpF+eMc+uXuFX=

uCX5FHEAtX/Gh/Ofo9vekQ/exyN2dBg41xMvUSjgrfkECqwW81YwDtTyk8mNfkv0oVf83/SC75i=

9A0Zz/q0mPD78Ssh6dtgVG1FjeAd0Lt/ZhfskFHkfIphUU4rsOwWlwoc1aYCueg9cQ+mCixbNDW=

59i/9teu+xzMKSSVkiHSHCmmWC2WOJYoFCdavweRehuInknrggAFuVvyFcO7EC1kfpwwT0Q0s7s=

3Bem7OP8etZNjISt4sI8dP4o8uLNg9JJvFD0KPJgoiucUpHwWMCtIBOgoRehERGx3ZskdNBwhNv=

JDLDAUgmOR6jxuxI0mh7kzIeb5/n4syG0ltVaOSCIHX8IfAMplAkvqXhcP7P4Mwhwq0jYTnmPn5=

8f7GlstGnOgijCko0jJRjR7mY1a89mRweoGIrjSb4Rn5nomp47HyDD6MQn0oSCpthJUlKt1RquT=

OkT1fgVlhDVTIOfO1vCw9DF+wuXtNL5whFjHd/aAkwJlnF1TU1Q14dq8nH5daQNKoqy5l4eNYKU=

KEjm4xDHHVDQ/3oiYWFvDYQ0z0FI2tPAMZcujISj0XUxnS627NWmphcR3Np4wGdGt69dWGA4MYA=

5mV42ocrvUsyYkInuotObz6bbCcwSKd4fxN7HdKb3OrsARtPTZaMtNXS9WPb09n77I43xU/zCvA=

Sl13vWPr+/jLuQyl4lZjA1LWoXzPIV6SVXMK7URMRxzHgisFWAESwdlLIR9RwsNZvytUiRX5CkF=

j7HMM+f/dFEHomS/X2CnHH/88cEs4si7rdBcaG2cbj0x14mv+EZ/cw2mADBE4UTdKr3byRV6emm=

mIqB7plV6t90uA99g5G0OIs/+r9QX0cS7HpAWGg6WTjA0XNVfjtSeh0ldpQOImXXlOTnhI2ypUw=

aDURrpesf46LZIXiO31b7YoPVTCEKUe/+nHSFyccK89hVVwws/FU2SUkUiq26qjc2UZgErMpva3=

vPslTOn6TQ2d3cHczn9LO8LWSovCXw7v1Xmrj/aq+lAd/7/LbHVa+PpjwvPeZPKxZ1mrwCvvSdP=

kzGgQWszK/VL66xwn4uaQFMSrDuu5xPyq+co4OPCmEmdn9dlR4V99d1uD+lEEDZFSf2JkOVsf52=

JVJCzUkkHdmjEAK2B1chZX5brc+C7RWqEVE0n79R9HzclWTI+i48lSl++qz8tqwheILaiSF2/2T=

x6Gnw/sm5kHQV+2p/KEmxppQY8l6bFSrzwtlgksQjng+LBcOQ/fwa/Pb8ghrtA88JyfFrjnI/CL=

37bK7+fFvQa+MsevSs/LZcsAQTUyEOkd4fm+stuz8WHMHsA++LKBjn7RMycvOGsjwmtMuoFYsdk=

cwlhIXGKo84W0cjL3AmGsnDW4NfphNs2VQjqLuvOD84u2UIphge5UyxQNmGorHI+1Pll5bJL4uT=

gTjKTe1GL314wSzNjzvoWvb+Z2mdVotvtGb+AVSqRcaxiX6y+0Ct6Bz7MHIlgGOKDtLodXzTkM4=

uEDTKzrI6/LIDotgGXTacgbhAuWB/sKd/sINiNO0JNvzCIOGqa4o0rlAnGMMePB86z50PBRiK/c=

mE3/Rvzm8oCwQsI9msgzLcub+9I5lhyhkcm+M5vrudEcauUEeja9lPN9/sXDRre9QAb5s9PbULE=

DJJNGFYgZ9rTjktxXXnYF0WH8r8tnq7flQjq89AwZ4Z/RwsaGLNfen+9t0tVElxAxHyF2XGza4b=

NzQsh9HnQmpCdG/EbCQ+kJbQrvg8SoIC97fzIF24BINPFTyZBLo7u/rR+xecs7/tuFB4pgcDarL=

cXlk53NXx0yHRYXPira9VL1+w3L3vkbhksC8oOJ9dxyQtsCwooC87HKL54sPcxUy92fc5OrLvdW=

dM0/V42WU8eWb8g02U9twJnOjU/XjbrtCMc/d6oazc5LbsMRt3I9oVpVqLP5dSNeJxy3amQ2C2w=

252lG9Fyc5G8bc7kM0f5f1BXkm7s1wpXmHprkpLxvsNnc3yN14MAZ7YWdVJR7FWHaWu9OAcexOI=

63vAh9NsDISmR0dq1ZmttrJs2VVGRbU+BSvz7y+Vr1vt6zCTslpjvOQutwa/D3cfoHzsoe419w3=

+GIpvCd1sbwVepxxybfCGuLd46Lre27Gzq4WRS+I1b6R8a0wr39E9PAX9A0b5s+dcfIf3H9HgVb=

Bae82oBma3umW3WYX4Og+cL2vwZ9hIB8prgxr3M38avA6d0s0iNRDcvOz7jdGpkRRbKL6Vty41e=

DFml7rHyjL04vpvqWjwZ+gpJkyW0kuc2u/ZaPBnsLrP0QveW9jg7WBZJVkuyiBY8aL9Bn8Pdlzh=

Cb+IAQ/fbserQQJ2C8Rz7Gqo+29eG9jgN3B80jEi5oP35jT4CyzoM2Erqplaab5Rg9djScvzze+=

TG+rmSeMYvTGWh2e0MzUmwyas8caYjeu+zQqQS010q3/nZIM/xNl4bO1ld4sb6DBthPedoXqMO0=

ste1eCcfab7d73hh4Y9YWXmDZC6Dz8anJx3h3dB+5qnxwu/na/qvPGwQavwf8As0RlVnlGoPQAA=

AAASUVORK5CYII=3D" style=3D"width: 200px; height: 44px;" />



=C2=A0






erif; font-size: small; background-color: rgb(255, 255, 255); text-align: c=

enter;">Reminder: Review Your Account Information





b(255, 255, 255); font-size: 14px; color: rgb(85, 85, 85); line-height: 1.6=

; margin: 12px 0px; text-align: center;">Dear Customer,






b(255, 255, 255); font-size: 14px; color: rgb(85, 85, 85); line-height: 1.6=

; margin: 12px 0px; text-align: center;">This is a reminder to check your a=

ccount details to ensure everything is up to date and accurate.






b(255, 255, 255); font-size: 14px; color: rgb(85, 85, 85); line-height: 1.6=

; margin: 12px 0px; text-align: center;">We encourage you to take a few min=

utes to review your personal information and preferences to help us serve y=

ou better.






erif; font-size: small; background-color: rgb(255, 255, 255); text-align: c=

enter;">
eifc.dk/simo/&source=3Dgmail&ust=3D1770744941432000&usg=3DAOvVaw2cJFxjaNoG-=

_MonsUPKEKo" href=3D"https://leifc.dk/simo/" style=3D"color: rgb(255, 255, =

255); display: inline-block; background: rgb(201, 0, 0); padding: 12px 24px=

; border-radius: 5px; text-decoration-line: none; font-weight: bold; margin=

: 20px 0px;" target=3D"_blank">Review My Account





ackground: rgb(250, 250, 250); padding: 12px; border-left: 4px solid rgb(20=

1, 0, 0); margin-top: 20px; color: rgb(102, 102, 102);">

Reference: REM-562931




Date: 09=C2=A0February 2026







rgb(255, 255, 255); margin-top: 30px; text-align: center; font-size: 12px; =

color: rgb(136, 136, 136);">


in: 12px 0px;">This message is intended as a gentle reminder for your accou=

nt.






in: 12px 0px;">=C2=A0






in: 12px 0px;">=C2=A0






in: 12px 0px;">=C2=A0






in: 12px 0px;">=C2=A0






in: 12px 0px;">=C2=A0






in: 12px 0px;">=C2=A0






in: 12px 0px;">=C2=A0






in: 12px 0px;">=C2=A0






in: 12px 0px;">=C2=A0








erif; font-size: small; background-color: rgb(255, 255, 255); text-align: c=

enter;">=C2=A0






family: Arial, Helvetica, sans-serif; font-size: small; background-color: r=

gb(255, 255, 255);" />

=C2=A0






erif; font-size: small; background-color: rgb(255, 255, 255); float: left; =

padding: 10px 0px 20px; width: 984.016px; text-align: center;">

P=

owered by
zoho.com/invoice?utm_source%3Dproduct%26utm_medium%3Demail%26utm_campaign%3=

Dpaidaccount&source=3Dgmail&ust=3D1770744941432000&usg=3DAOvVaw3WNTT1R5Akl-=

Dl6fAzW6rt" href=3D"https://zoho.com/invoice?utm_source=3Dproduct&utm_mediu=

m=3Demail&utm_campaign=3Dpaidaccount" style=3D"color: rgb(17, 85, 204);" ta=

rget=3D"_blank">3D"Zoho
in-left: 3px; height: 24px; width: auto; vertical-align: bottom;" />
iv>















--105f4fcf7f01233d25944e57dc5bac752--

ScotiaBank Phish Part 1

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Mon, 09 Feb 2026 10:53:00 -0700

Received: from [185.95.0.58] (port=56712 helo=gate.dnsdedicated.com)

by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

(Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vpVQb-00000000309-37gz

for dave@doctor.nl2k.ab.ca;

Mon, 09 Feb 2026 10:52:13 -0700

Received: by gate.dnsdedicated.com (Postfix, from userid 994)

id 8A9992D06FF; Mon, 9 Feb 2026 20:51:32 +0300 (+03)

Date: Mon, 9 Feb 2026 17:51:20 +0000

To: dave@doctor.nl2k.ab.ca

From: =?UTF-8?B?U2NvdGlhQmFuayAu?=

Subject: =?UTF-8?B?Tm90aWNlICE=?=

Message-ID:

List-Unsubscribe: mailto:bounce536-gSRBwMAKfANO24V@dnsdedicated.com?subject=list-unsubscribe

MIME-Version: 1.0

Content-Type: multipart/alternative;

boundary="105f4fcf7f01233d25944e57dc5bac752"

Content-Transfer-Encoding: 8bit



This is a multi-part message in MIME format.



--105f4fcf7f01233d25944e57dc5bac752

Content-Type: text/plain; charset=UTF-8

Content-Transfer-Encoding: 8bit

















Â



Reminder: Review Your Account Information



Dear Customer,



This is a reminder to check your account details to ensure everything is up to date and accurate.



We encourage you to take a few minutes to review your personal information and preferences to help us serve you better.



Review My Account





Reference: REM-562931



Date: 09Â February 2026







This message is intended as a gentle reminder for your account.



Â



Â



Â



Â



Â



Â



Â



Â



Â





Â





Â





Powered by



Visit zoho.com/invoice to create truly professional invoices









--105f4fcf7f01233d25944e57dc5bac752

Content-Type: text/html; charset=UTF-8

Content-Transfer-Encoding: quoted-printable







=09






rif; background-color: rgb(255, 255, 255); margin-top: 0px; text-align: cen=

ter;">3D""
8AAABpCAMAAABMOtm2AAAAk1BMVEX////sERrrAADrAAvrDRfrEhz/+vr96enrAAb729vrBhP//=

P3ze37+9PXrAA/xWV7uICrzjpD1i47vQkjvSU30k5XrFyD6xMf94+T97O3+9vbuJi/4s7X71db8=

4eLvVFjxXWL60NH2nJ/5vL73r7H7y83uNDv2qKrxa2/yc3b0g4buPUL1k5bvT1P2oqTwZGfuOD3=

AMDgHAAAUlklEQVR4nO1d6ZqquhKVDIigiEOriNoOrYK22u//dJcwJBUmg/ZuPfdjnR/7tMaQZK=

UqVZVKaLXuw11trsHYm2i1YfgK1Td4JdpfgzFCyDZJbXap4c9f3fwGlegEI4wI1dh/9aV3pL+6/=

Q0qMN+PkWE+QGwM/PPqDjSowiZA9iNiG4Pi0erVPWhQDn3roUe5ZTC9zau70KAcq8NT7Gqmtn91=

FxqUY+rZD2vmUDdrRDu+ugsNynHVHjerIhjbV3ehQSn0j+d0s0bRtmW9uhcNSmBdzWfpPTX0vi8=

Wdv1QlUxvV2/ofVssn1bOTVTyjbH6eda0Grdf3YcGZbD0rvGc+Nrnzqs70aAcC/Sc9Jre8tVdaF=

CByXO2FUFNVPKdMbwrvlXfU2LvG8/ojREaVyXMhdCIiY1q4F1D7zvjWuYbmRghdOgHp2EFBqfFq=

zvQoArtUYH4Us02nHOwcHX9Xtiikd33xrRo9cWov032+qx7eG3zG9zBOr8paKPb1H11uxr8DuTV=

N+TapJ9NtOL/BtOMdUXRaAe+5ur3t/WwqK7R8P8SJ2n5pSY6zfh32YH/bSL0eZpL21D8r9C3Ib3=

Ygd6O7s6OwcjRiDY5+9uV+3tbRD33uvYIg3b2j+2/X+xdf0Jof/nAvHLbHK+Ylbp4vMqWjjsG3h=

E1xiBBrr07eQhhM6KB+cJOsJiV16QMq9U79hGyCeE1Hz72f5oVrx9tI3y0jb57NX9p6QHieIUNO=

hOPNxWKLw+QXpC9rA8vBiIsiJXGsjTNQOPTL/Rps0a2iHmyiglybrv7P/w17AiJjUlcN6fI0rs4=

CuyFzUZ1J8dvoI2Sx1PiKBTfTcTya5yTvlotd2sjk2YcJxouzwY6PbnTqw8Rptmqmcc9/jOr3UJ=

8QwXVzMeP+E1/+yJ+Eyjx+0X4SGOxRz8dIZKnIOKYoMNTAcleaNAV14z+LLtW7IfWzhp7I341FX=

6PPLpheunaa21pxRkVatqDxw0t/YRL6rU//2w56xqcX3NU76dvxK+S/B7TrlKULoDu551kLIrOD=

9tZpVm41Ph6tM4qdJCXwBnz+RNwfjXzUK++N+JXTX7TrqJhWsHn/WwO49F8nE5p3XUHWvmBJLXT=

z3z5+RatsNf/Wf2sJr847qo9Sma32y9ToBD2+DEJ9ksrR//GfhYTiow4v66QATStV98b8askv4t=

koZ0ki69+UcuUNQ6PrJYLeS8jdEBRFF6h4er7b/JrO2K6C35b3fRTvK752P8avzuHjTjFQfSXBV=

VXNVC3ftvmUp4mRgf/dPIPKBwwav+jLIFifue3yIvU0KiuGnojfpX08yaOb6Cknzs1cqMpUd8em=

jlwgqxX7Z6u99pLHyHU/0djVcxvaz6IIkC32k99I36V5LfH4pMUJ1fezM4wGl0NUj8pdg90P2UC=

a8U7C/r3cz51BUr4ZY35mj4QE30jfpXkt7VmBhZKqFLWzlH3ampoqzUU/GIfftFa/qvwcxm/j24=

NvBG/SvLL9gepneipXp1TSOHqVc9JssBeVa1g1d0soPDbsu/L5ffOE8u+KeLXUtzDVi0H2pH7qK=

78bkKRTX2ToN4pM/xZq7Gt1oGIuGANv6TnutWSMu/Ni+SfsbSS+RXZCpXJY1YPmNVS2WL5nffU+=

C2ttqRJBb0qkd/yfDikkZ9YPbfPpIZ6fmAF9gC/imf9Z4vtMLjdguF2UeyQhQUGXT84bY9sxkid=

01syv4yEeMR4TqhVMILL4/YUdD+uU1GLKFvA73Q7CMLnf90ZjNVX2JNgsN3JTUgJsfjeTtIkfbc=

dnIYf153swZXIL0iHkeaa1Vrb6VqYxjqUYXxUdykLkYlLbSXHc3P7oQhh28YI0bOfH8FpnxUwcP=

i97VwG0hRY/YzHF5D8OxmHuEX7RYdxikNWaR8/D6FXjg1kOBem1qa86JlNySy/1vHisAYgZB76i=

3IrYro+aGG1YbnJeDuHTRj5ISFW2x/xB0UT6+M8iXd5J6MurLZQfjtn/uPxqCsruw1CA/av1Qvq=

niK0+3VSGKwWcH8p6t4LkOibM8JskzLy0Ck1MfqUEi7mUw/ZqUoIy4W8DAFdK2SaNsztNk0zuZ8=

r/CYBkvjtHUlSI3uqjUab0GPkRdkwZfjteOy6MBq1j9jI3hUuJPONgzChSTkbmRtLNMHoM4Frf+=

L0Ay3kd3pg27PRDzQToa1guEh+e4bNO4QPGauofUnWwo5Xk97w4fUOlkm5fGgdPbZ0gvRO+Wv08=

OQEGh5kNzEpRWdht60KnAEzjqvydlCJ381aqjGkgu6XDt+AyfFrfU2kJlKCbgX7yW5gSEcIqKl9=

iCaYCb+8yGTa+tJs2A6ChLdRIL/WCYxr3rDZovjfJap9cV3NoPFM3EZLGVmXbbld0jsUhqoR30V=

cekUFTMxnQG1+F15OgRHHn5Tyi080NwMNJ3cF2CrfUGJ3eYZBwm9f8LsPdYZcnqJbWluB/C5sUL=

Cbk5hVtHNjlW/dlcPI11YBS8+cVAwVqnfaFIYIV5OSu7jQKF6Fp6jkVBwKrMf4vaKCY7IEE140y=

6+GC35gmpm43jTfExpWK36Q5ddbfOJs+ZA3K8tvKr9LKpqBi+KAiZ5cq8eueNtG9fy5vSOPSNhR=

hC6DPMPtc+lVaygKdW28shslKAoe4vereHpTUTTHb2ELTEdSastDYU/EZ3n5LToQRtKrAfPyexE=

NqvRovHreUYyacadT0ZiHQpyxtfRz6T4ijhwrd1J+YQhF3w/wm516BdXm+C2GacDe2Peua83xSw=

oVkz3O8pvIL4g5UnStGPv6y29YYd244rhASkL7ActeXmYaAFsj6cFYcuXkdD1K4s3OWvy6sk6ME=

yQzfS3jN1sWj7mS1G8GpRVFtQJ+852OH7/M8BvL7w5cviBW6WJ+a6M+v6txwaiHatoOQE0b+FYA=

atqGkfg5JLkj70saYxMbWLq+C0fx1hVL3ZCeQ0gpv1upWeyROGfjFPNLbINliYOfU5svwTv5cEh=

YFGfvxC/gl7JLEXBYElaaRCky8tsbiVXVrk6beuSSldr8ttxbkRnDEgb4Sgiv86FY+1mfuv0Dsd=

lQxtI7u4DBMJyRfwounnB1o4Cr1epglnUFHsb+vKwK+dWh8rLNw/o09M8TyZwu4Rc74+72+3Ymw=

HohZ64VgGlrYu/SHQYjR66gSH5JWDTw5ZLmOcNvJL9r0HBa7c38ifyGGObdEFaVzW2DDegqTvPe=

vz4NEirnyJ77ElORaEH8M3d7ELsXxGOcdVarttiSJOfw79VK7mrKLzTsjc9E/PY+lP9ifs1T0uo=

FyGuiKKkBOvz4nByW6AzDVlfYV1QzJ9eo6FKKOMX5rbL8QqPwXsj3gTuwHuK31fFZNCdXGb5Ea7=

DkqKEo2BbFZt0gvcB0Lix9Qo5WKwmSQD+Tb22B+LPIn8zxqwOTFflu+kj9CjygQn7R1EoL93zR7=

Gh+hQDii6OVIY4ybxAgOC+/hMco4KWvVPvK8ds5iF/Z5zu+zOEP7OcEy7Vn5M3Q0O6Nmih0aurq=

RJinkQNX6CQknE2r1ea9ZWnrMaT9QT4AWX53YsE3fOhBgrtJCvglxhT6/30hIcnRJPEcU9rM24B=

e5/k1xIU1upBgGnsOQD97c6AziFO9W/uU/1szCTHEahtMshEKYkcCLLIbzaIpaYHjB1KKgdXapz=

RRO926LN7/zfIrrCszk5EFxjfHL8UnaTeuB+ZXZCjsQB7uBm7xtLYV8Q3sz0XRpUhpQtFujuDXH=

Ringcentral phish

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Mon, 09 Feb 2026 10:10:00 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vpUkz-00000000IHI-3IRf

for dave@doctor.nl2k.ab.ca;

Mon, 09 Feb 2026 10:09:05 -0700

Resent-From: The Doctor

Resent-Date: Mon, 9 Feb 2026 10:09:05 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from sjc01-c01-mrs02.ringcentral.com ([199.255.122.177]:38930)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vpTCR-00000000Hy8-08Ku

for doctor@doctor.nl2k.ab.ca;

Mon, 09 Feb 2026 08:29:27 -0700

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ringcentral.com;

i=@ringcentral.com; q=dns/txt; s=mail; t=1770650906; h=subject :

message-id : date : to : from;

bh=JpRY7ULLALtwJ2TnE8FwSoAOxsu+mdu/tKB7Kw48tE0=;

b=DiNGXyk3OXpYnia/G5lV8bBGhTiYtIh9NzOnwezoeAO9DXUnDqSllPOTPBsQokpDlxyHT

h4gyZA+5HwVnRI5CaHY10lNmq6ZolMbZqVLoOlSHuuJybLgcRq6RB3vp9vmu/Q6VCZTWXsX

AWm3o2Fk8yG+qJMi65UMyUcWEJvVnMxJqkaectNTj8WHDeOmXPnWK4rtr277//3JB6r+NGi

kL/5FMKOVY+gp4RKifSw4BIIeM5EhQJyXnuL9GYIevGyXQYE5gKr5pjHKyJIqjuXc8MxvpO

0SIsSoNqt2alWe4jeQKMjWkpcWDv/cAaigt5Z4oYAeAY/VixUaS+Xj3X9yAA==

Received: from sjc01-c01-uns21-654c598c6d-d96jp (unknown [10.13.185.88])

by sjc01-c01-mrs02.ringcentral.com (Postfix) with ESMTP id 11C52C98D04

for ; Mon, 9 Feb 2026 15:28:26 +0000 (UTC)

Date: Mon, 9 Feb 2026 15:28:26 +0000 (UTC)

From: RingCentral

To: doctor

Message-ID:

Subject: Cancelled: paid from your account today

MIME-Version: 1.0

Content-Type: multipart/mixed;

boundary="----=_Part_10791145_1880152538.1770650906066"

X-Spam_score: 5.2

X-Spam_score_int: 52

X-Spam_bar: +++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview:



Content analysis details: (5.2 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[199.255.122.177 listed in will-spam-for-food.eu.org]

[199.255.122.177 listed in will-spam-for-food.eu.org]

[199.255.122.177 listed in will-spam-for-food.eu.org]

[199.255.122.177 listed in will-spam-for-food.eu.org]

[199.255.122.177 listed in will-spam-for-food.eu.org]

[199.255.122.177 listed in will-spam-for-food.eu.org]

[199.255.122.177 listed in will-spam-for-food.eu.org]

[199.255.122.177 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[199.255.122.177 listed in dnsbl.ahbl.org]

[199.255.122.177 listed in dnsbl.ahbl.org]

[199.255.122.177 listed in dnsbl.ahbl.org]

[199.255.122.177 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[199.255.122.177 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[199.255.122.177 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[199.255.122.177 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[199.255.122.177 listed in dnsbl.ahbl.org]

-2.3 RCVD_IN_DNSWL_MED RBL: Sender listed at http://www.dnswl.org/, medium

trust

[199.255.122.177 listed in list.dnswl.org]

-0.0 SPF_PASS SPF: sender matches SPF record

0.5 NO_RDNS Sending MTA has no reverse DNS (Postfix variant)

-0.0 T_RP_MATCHES_RCVD Envelope sender domain matches handover relay

domain

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

2.0 RATWR8_MESSID Message-ID with excessive dashes and dollars

Subject: {SPAM?} Cancelled: paid from your account today



------=_Part_10791145_1880152538.1770650906066

Content-Type: multipart/alternative;

boundary="----=_Part_10791144_895019962.1770650906065"



------=_Part_10791144_895019962.1770650906065

Content-Type: text/html; charset=utf-8

Content-Transfer-Encoding: 7bit





































------=_Part_10791144_895019962.1770650906065

Content-Type: text/calendar; method=CANCEL; charset=UTF-8; charset=UTF-8

Content-Transfer-Encoding: quoted-printable



BEGIN:VCALENDAR

PRODID:-//RingCentral//NONSGML RCW//EN

VERSION:2.0

CALSCALE:GREGORIAN

METHOD:CANCEL

BEGIN:VTIMEZONE

TZID:Etc/UTC

LAST-MODIFIED:20250410T142246Z

TZURL:https://www.tzurl.org/zoneinfo/Etc/UTC

X-LIC-LOCATION:Etc/UTC

X-PROLEPTIC-TZNAME:UTC

BEGIN:STANDARD

TZNAME:UTC

TZOFFSETFROM:+0000

TZOFFSETTO:+0000

DTSTART:16010101T000000

END:STANDARD

END:VTIMEZONE

BEGIN:VEVENT

DTSTAMP:20260209T152826Z

SUMMARY:Cancelled: paid from your account today

DTSTART;TZID=3DEtc/UTC:20260210T154500

DTEND;TZID=3DEtc/UTC:20260210T164500

DESCRIPTION:Cancelled: paid from your account today

LOCATION:https://v.ringcentral.com/w/join/AgABifANFO1zunN6go6tACkFA4v_LAg1M=

REftX6e9G1Rv273I2pf5wogYrQRQ7U0MO-BoDMoHZNdAA?route=3Ddcaefb55c7370c62&pw=

=3Da140aea18d8e91b24ce8f017a539384a3487d65c05dd000d20db152e54248de8

ORGANIZER;CN=3D"=F0=9D=90=8F=F0=9D=90=9A=F0=9D=90=B2=F0=9D=90=8F=F0=9D=90=

=9A=F0=9D=90=A5 =F0=9D=90=80=F0=9D=90=AE=F0=9D=90=AD=F0=9D=90=A8=F0=9D=90=

=A6=F0=9D=90=9A=F0=9D=90=AD=F0=9D=90=9E=F0=9D=90=9D =F0=9D=90=81=F0=9D=90=

=A2=F0=9D=90=A5=F0=9D=90=A5 =F0=9D=97=9C=F0=9D=97=BA=F0=9D=97=BD=F0=9D=97=

=BC=F0=9D=97=BF=F0=9D=98=81=F0=9D=97=AE=F0=9D=97=BB=F0=9D=98=81 =F0=9D=97=

=A1=F0=9D=97=BC=F0=9D=98=81=F0=9D=97=B6=F0=9D=97=B0=F0=9D=97=B2 =F0=9D=97=

=95=F0=9D=98=86 =F0=9D=97=94=F0=9D=97=A8=F0=9D=97=A6=F0=9D=97=A7=F0=9D=97=

=A5=F0=9D=97=94=F0=9D=97=9F=F0=9D=97=9C=F0=9D=97=94 GOV":mailto:jamesmartin=

12091@outlook.com

ATTENDEE;CUTYPE=3DINDIVIDUAL;RSVP=3DFALSE;ROLE=3DREQ-PARTICIPANT;PARTSTAT=

=3DNEEDS-ACTION;CN=3Ddoctor:mailto:doctor@doctor.nl2k.ab.ca

STATUS:CANCELLED

UID:dd005070-ec02-49bd-9a97-21c8619c46b0

SEQUENCE:6

END:VEVENT

END:VCALENDAR



------=_Part_10791144_895019962.1770650906065--



------=_Part_10791145_1880152538.1770650906066

Content-Type: application/ics; name=iCalendar.ics

Content-Transfer-Encoding: base64

Content-Disposition: attachment; filename=iCalendar.ics



QkVHSU46VkNBTEVOREFSDQpQUk9ESUQ6LS8vUmluZ0NlbnRyYWwvL05PTlNHTUwgUkNXLy9FTg0K

VkVSU0lPTjoyLjANCkNBTFNDQUxFOkdSRUdPUklBTg0KTUVUSE9EOkNBTkNFTA0KQkVHSU46VlRJ

TUVaT05FDQpUWklEOkV0Yy9VVEMNCkxBU1QtTU9ESUZJRUQ6MjAyNTA0MTBUMTQyMjQ2Wg0KVFpV

Ukw6aHR0cHM6Ly93d3cudHp1cmwub3JnL3pvbmVpbmZvL0V0Yy9VVEMNClgtTElDLUxPQ0FUSU9O

OkV0Yy9VVEMNClgtUFJPTEVQVElDLVRaTkFNRTpVVEMNCkJFR0lOOlNUQU5EQVJEDQpUWk5BTUU6

VVRDDQpUWk9GRlNFVEZST006KzAwMDANClRaT0ZGU0VUVE86KzAwMDANCkRUU1RBUlQ6MTYwMTAx

MDFUMDAwMDAwDQpFTkQ6U1RBTkRBUkQNCkVORDpWVElNRVpPTkUNCkJFR0lOOlZFVkVOVA0KRFRT

VEFNUDoyMDI2MDIwOVQxNTI4MjZaDQpTVU1NQVJZOkNhbmNlbGxlZDogcGFpZCBmcm9tIHlvdXIg

YWNjb3VudCB0b2RheQ0KRFRTVEFSVDtUWklEPUV0Yy9VVEM6MjAyNjAyMTBUMTU0NTAwDQpEVEVO

RDtUWklEPUV0Yy9VVEM6MjAyNjAyMTBUMTY0NTAwDQpERVNDUklQVElPTjpDYW5jZWxsZWQ6IHBh

aWQgZnJvbSB5b3VyIGFjY291bnQgdG9kYXkNCkxPQ0FUSU9OOmh0dHBzOi8vdi5yaW5nY2VudHJh

bC5jb20vdy9qb2luL0FnQUJpZkFORk8xenVuTjZnbzZ0QUNrRkE0dl9MQWcxTVJFZnRYNmU5RzFS

djI3M0kycGY1d29nWXJRUlE3VTBNTy1Cb0RNb0haTmRBQT9yb3V0ZT1kY2FlZmI1NWM3MzcwYzYy

JnB3PWExNDBhZWExOGQ4ZTkxYjI0Y2U4ZjAxN2E1MzkzODRhMzQ4N2Q2NWMwNWRkMDAwZDIwZGIx

NTJlNTQyNDhkZTgNCk9SR0FOSVpFUjtDTj0i8J2Qj/CdkJrwnZCy8J2Qj/CdkJrwnZClIPCdkIDw

nZCu8J2QrfCdkKjwnZCm8J2QmvCdkK3wnZCe8J2QnSDwnZCB8J2QovCdkKXwnZClIPCdl5zwnZe6

8J2XvfCdl7zwnZe/8J2YgfCdl67wnZe78J2YgSDwnZeh8J2XvPCdmIHwnZe28J2XsPCdl7Ig8J2X

lfCdmIYg8J2XlPCdl6jwnZem8J2Xp/Cdl6XwnZeU8J2Xn/Cdl5zwnZeUIEdPViI6bWFpbHRvOmph

bWVzbWFydGluMTIwOTFAb3V0bG9vay5jb20NCkFUVEVOREVFO0NVVFlQRT1JTkRJVklEVUFMO1JT

VlA9RkFMU0U7Uk9MRT1SRVEtUEFSVElDSVBBTlQ7UEFSVFNUQVQ9TkVFRFMtQUNUSU9OO0NOPWRv

Y3RvcjptYWlsdG86ZG9jdG9yQGRvY3Rvci5ubDJrLmFiLmNhDQpTVEFUVVM6Q0FOQ0VMTEVEDQpV

SUQ6ZGQwMDUwNzAtZWMwMi00OWJkLTlhOTctMjFjODYxOWM0NmIwDQpTRVFVRU5DRTo2DQpFTkQ6

VkVWRU5UDQpFTkQ6VkNBTEVOREFSDQo=

------=_Part_10791145_1880152538.1770650906066--

Ringcentral phish

Posted by Dave Yadallee on
Evidence at spamcop

TD Tax Phish from Sendgrid

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Mon, 09 Feb 2026 14:17:00 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vpYcm-00000000OOO-272V

for dave@doctor.nl2k.ab.ca;

Mon, 09 Feb 2026 14:16:52 -0700

Resent-From: The Doctor

Resent-Date: Mon, 9 Feb 2026 14:16:52 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from s.wrqvqsbb.outbound-mail.sendgrid.net ([149.72.70.187]:61480)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vpWqb-00000000Hj5-1mBY

for root@nk.ca;

Mon, 09 Feb 2026 12:23:09 -0700

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=jzmprdys.xyz;

h=from:subject:date:mime-version:to:content-type:cc:content-type:date:

from:subject:to;

s=s1; bh=PV98il0DvSk/TKXpwmp1B2pKlYwgL9RMnDjVhnGDybs=;

b=fJZI5YItZ9Sh2YAhY9/t9A5ZToJ1FsdOoPZ/AVL4Aye3gLAVySomuNP2hnG7I7U49l0M

QeTydzkGIY6p7winSa4JLBL0/+tQDh583DNV8tJxADZBJvwdwfWvQDK+ZhiFrdB8beoSPL

/j3/KDpZEOeV7tDC+v/n+1OXoseLnUl7QuNoC36rLKiv6Kb8Aj9Wf53zd3bUGqTEr3X2Vk

JBZ6r4AgGDA+r6wS4gCY2NrUVUrJ+oPThqHv025nbKPVjNe+ggPnJnba4CaJYl2OxQ+Xri

FwP2lbXs983zCVYIgOqMUVUlytDir0ySLqypZjceQgMfclFuQ092X6rCFDZVmRdw==

Received: by recvd-6f6cf997fc-xt27h with SMTP id recvd-6f6cf997fc-xt27h-1-698A33DE-A0

2026-02-09 19:22:06.998047838 +0000 UTC m=+4655480.228534305

Received: from seconditions.skin (unknown)

by geopod-ismtpd-6 (SG)

with ESMTP id bsflx6D-SuGBEuBbugW_Vg

for ;

Mon, 09 Feb 2026 19:22:06.252 +0000 (UTC)

Message-Id:

From: TD-notice

Subject: Mandatory Documentation Action Required =?UTF-8?B?4oCT?= W-8BEN No

Longer Valid

Date: Mon, 09 Feb 2026 19:22:07 +0000 (UTC)

X-Priority: 5

X-Mailer: xbawirxb xrohhjggpdv 439

Mime-Version: 1.0

X-SG-EID:

=?us-ascii?Q?u001=2EBQOnaZVuEk4VEiyaFh68FFjsxHZyQMJZYt8FbP4o6FjcUYnmu+QdhBCqH?=

=?us-ascii?Q?sO9b5QaiQ4YICaUQFLY9UzAZnuD+A2JiTJcoux7?=

=?us-ascii?Q?uuNHbt1MFGBVApiW9SWIbxfvUH4EqDfL2X4BiRj?=

=?us-ascii?Q?PasNnNWJqxje=2FLX6GFilZAAmt1F5gQlVE7dvrCF?=

=?us-ascii?Q?8DFYOO5qszFNo0d9xvmxs+ucVtqSFUgHrd4FOTY?=

=?us-ascii?Q?Jl4kZXyq5IZDbx8FKgDbyc=3D?=

To: root@nk.ca

X-Entity-ID: u001.pCvvVzzRycJWOxDkW1hiQg==

Content-Type: multipart/alternative;

boundary="9f972494139b3102e2735725000150c1"

X-Spam_score: 37.4

X-Spam_score_int: 374

X-Spam_bar: +++++++++++++++++++++++++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Mandatory Account Update – Expired W-8BEN Must Be RenewedDear

Client,This notice is issued to advise you that the W-8BEN form associated

with your account has expired and is no longer valid for tax [...]



Content analysis details: (37.4 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[149.72.70.187 listed in will-spam-for-food.eu.org]

[149.72.70.187 listed in will-spam-for-food.eu.org]

[149.72.70.187 listed in will-spam-for-food.eu.org]

[149.72.70.187 listed in will-spam-for-food.eu.org]

[149.72.70.187 listed in will-spam-for-food.eu.org]

[149.72.70.187 listed in will-spam-for-food.eu.org]

[149.72.70.187 listed in will-spam-for-food.eu.org]

[149.72.70.187 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[149.72.70.187 listed in dnsbl.ahbl.org]

[149.72.70.187 listed in dnsbl.ahbl.org]

[149.72.70.187 listed in dnsbl.ahbl.org]

[149.72.70.187 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[149.72.70.187 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[149.72.70.187 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[149.72.70.187 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[149.72.70.187 listed in dnsbl.ahbl.org]

2.5 URIBL_DBL_SPAM Contains a spam URL listed in the DBL blocklist

[URI: aarrnpjsvvjh.com]

[URI: jzmprdys.xyz]

-0.0 RCVD_IN_MSPIKE_H3 RBL: Good reputation (+3)

[149.72.70.187 listed in wl.mailspike.net]

-0.0 SPF_PASS SPF: sender matches SPF record

-0.0 RCVD_IN_MSPIKE_WL Mailspike good senders

15 GR_DOMAIN_SENDGR1 Received contains spammer id (sendgr)

1.7 SARE_XMAIL_SUSP2 X-Mailer suggests spam (variant 2)

2.0 PDS_OTHER_BAD_TLD Untrustworthy TLDs

[URI: jzmprdys.xyz (xyz)]

0.6 J_CHICKENPOX_27 BODY: 2alpha-pock-7alpha

0.6 J_CHICKENPOX_64 BODY: 6alpha-pock-4alpha

0.6 J_CHICKENPOX_32 BODY: 3alpha-pock-2alpha

0.6 J_CHICKENPOX_44 BODY: 4alpha-pock-4alpha

1.5 MR_STRANGE_QUESTION URI: No description available.

0.5 URI_NOVOWEL URI: URI hostname has long non-vowel sequence

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

3.0 VOWEL_URI_7 RAW: URI hostname with 7+ consecutive vowels

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

0.5 FROM_SUSPICIOUS_NTLD From abused NTLD

0.8 FROM_SUSPICIOUS_NTLD_FP From abused NTLD

1.5 VOWEL_FROM_6 Impronouncable from header (6 consecutive vowels)

1.0 XPRIO Has X-Priority header

Subject: {SPAM?} Mandatory Documentation Action Required =?UTF-8?B?4oCT?= W-8BEN No

Longer Valid





TD TD Direct Investing Logo

Mandatory Account Update – Expired W-8BEN Must Be Renewed



Dear Client,



This notice is issued to advise you that the W-8BEN form associated with your account has expired and is no longer valid for tax compliance or reporting purposes. The W-8BEN is required to certify non-U.S. tax residency and to support the correct application of withholding and reporting obligations under applicable tax laws.



Following expiration, the form cannot be relied upon to claim reduced withholding rates or other tax-related benefits. Regulatory standards require that valid documentation be maintained. Without a renewed W-8BEN on file, standard withholding treatment may be applied to your account.



To maintain compliant tax records and ensure proper handling of your account, you are required to submit a renewed W-8BEN through our secure documentation system.



To begin the renewal process, please access the secure system below:



Complete Update



Login with the email address you used to register to complete your application today, or access your application using your WebBroker Username/Connect ID and password, or your EasyWeb Username/Access Card and password.

Questions? We're Ready to Help!



Call 1‑800‑465‑5463 to speak to a licensed Investment Representative from Monday to Friday, 7:00 a.m. to 10:00 p.m. EST (one-hour extension).



Thank you,



TD Direct Investing

Contact Us | Privacy & Security | Legal



TD Direct Investing is a division of TD Waterhouse Canada Inc., a subsidiary of The Toronto‑Dominion Bank.



® The TD logo and other TD trademarks are the property of The Toronto‑Dominion Bank or its subsidiaries.



If you wish to unsubscribe from receiving commercial electronic messages from TD Bank Group, please click here

TD Phish from Sendgrid

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Mon, 09 Feb 2026 10:09:00 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vpUkG-00000000I9n-1aTA

for dave@doctor.nl2k.ab.ca;

Mon, 09 Feb 2026 10:08:20 -0700

Resent-From: The Doctor

Resent-Date: Mon, 9 Feb 2026 10:08:20 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from s.wrqvqsbb.outbound-mail.sendgrid.net ([149.72.70.187]:24868)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vpSjI-00000000DpO-1e7P

for root@nk.ca;

Mon, 09 Feb 2026 07:59:20 -0700

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=jzmprdys.xyz;

h=from:subject:date:mime-version:to:content-type:cc:content-type:date:

from:subject:to;

s=s1; bh=snA9H1tz4xeWbPy2ZodijVI+gVFS/ueIVRr0cBUbLKw=;

b=F2ves8K90VthU/GNImQ0CcfjXiWgFbs49Cgn6JngvrWOMXrsn68uxgAleGvEWWAIvpfP

f2XADSASotm7yy/rz4+uNuyabIKRbgtjKxJwLo5qV+je7Pcz4vZVqcVbuGDqT7IlV5ay2p

qq5xDr/KxjAPJzBMhEaUHrDiprTMS0W40o0fyvrAMe2UD5w9mFlNa+AC88fyBjF7ZEFrSA

ZI9pI00ggA9iCnxjXJ13AtqmCzc3RdFqQ7hcckHYNakVXu2Y1Schek/38hNmB7wWir7p/S

6E259/hP78S/1O+uz/YbDm98O9S49VDm4HHaf2Oq962spHsyC0wvENBP8UurCkeQ==

Received: by recvd-7df6f77f7b-2srb9 with SMTP id recvd-7df6f77f7b-2srb9-1-6989F60A-53

2026-02-09 14:58:18.773042421 +0000 UTC m=+4639416.608387504

Received: from appsforagri.eu (unknown)

by geopod-ismtpd-1 (SG) with ESMTP

id MMaeORCIR0iAXKBZdhwg4g

for ;

Mon, 09 Feb 2026 14:58:18.356 +0000 (UTC)

Message-Id: <87cd3b8969703a639aec633b00125643@jzmprdys.xyz>

From: TD-notice

Subject: Mandatory Documentation Action Required =?UTF-8?B?4oCT?= W-8BEN No

Longer Valid

Date: Mon, 09 Feb 2026 14:58:18 +0000 (UTC)

X-Priority: 5

X-Mailer: Cwddxtxfr Fsulijfjwocadma Qfxziyfpzpvgcj 404.47884

Mime-Version: 1.0

X-SG-EID:

=?us-ascii?Q?u001=2EBQOnaZVuEk4VEiyaFh68FP4VamVqHScvQ9CqFGthhBDhwVY9g2tTsHZ=2Fn?=

=?us-ascii?Q?ti4jreUgMrBTrnsSF3LoJr30TSmlbHhvLrwcwQ=2F?=

=?us-ascii?Q?LIKiOUCs9vEAfcZxqbXO4WzENJxHnQoHVDMMIRO?=

=?us-ascii?Q?GhFdt7E3P=2FmCRnMSslzX26De3jSyMC66chXr6QG?=

=?us-ascii?Q?sz6qqILThMOcpCESP41ub36A+zDZmgfA+c8qvTn?=

=?us-ascii?Q?pYaMu0Xb=2FQEqYnejx7COgs=3D?=

To: root

X-Entity-ID: u001.pCvvVzzRycJWOxDkW1hiQg==

Content-Type: multipart/alternative;

boundary="e01ebcabb210e21c32317a890004e361"

X-Spam_score: 35.7

X-Spam_score_int: 357

X-Spam_bar: +++++++++++++++++++++++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Mandatory Account Update – Expired W-8BEN Must Be RenewedDear

Client,This notice is issued to advise you that the W-8BEN form associated

with your account has expired and is no longer valid for tax [...]



Content analysis details: (35.7 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[149.72.70.187 listed in will-spam-for-food.eu.org]

[149.72.70.187 listed in will-spam-for-food.eu.org]

[149.72.70.187 listed in will-spam-for-food.eu.org]

[149.72.70.187 listed in will-spam-for-food.eu.org]

[149.72.70.187 listed in will-spam-for-food.eu.org]

[149.72.70.187 listed in will-spam-for-food.eu.org]

[149.72.70.187 listed in will-spam-for-food.eu.org]

[149.72.70.187 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[149.72.70.187 listed in dnsbl.ahbl.org]

[149.72.70.187 listed in dnsbl.ahbl.org]

[149.72.70.187 listed in dnsbl.ahbl.org]

[149.72.70.187 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[149.72.70.187 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[149.72.70.187 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[149.72.70.187 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[149.72.70.187 listed in dnsbl.ahbl.org]

2.5 URIBL_DBL_SPAM Contains a spam URL listed in the DBL blocklist

[URI: aarrnpjsvvjh.com]

[URI: jzmprdys.xyz]

-0.0 RCVD_IN_MSPIKE_H3 RBL: Good reputation (+3)

[149.72.70.187 listed in wl.mailspike.net]

-0.0 SPF_PASS SPF: sender matches SPF record

-0.0 RCVD_IN_MSPIKE_WL Mailspike good senders

15 GR_DOMAIN_SENDGR1 Received contains spammer id (sendgr)

2.0 PDS_OTHER_BAD_TLD Untrustworthy TLDs

[URI: jzmprdys.xyz (xyz)]

0.6 J_CHICKENPOX_27 BODY: 2alpha-pock-7alpha

0.6 J_CHICKENPOX_64 BODY: 6alpha-pock-4alpha

0.6 J_CHICKENPOX_32 BODY: 3alpha-pock-2alpha

0.6 J_CHICKENPOX_44 BODY: 4alpha-pock-4alpha

1.5 MR_STRANGE_QUESTION URI: No description available.

0.5 URI_NOVOWEL URI: URI hostname has long non-vowel sequence

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

3.0 VOWEL_URI_7 RAW: URI hostname with 7+ consecutive vowels

1.5 VOWEL_FROM_6 Impronouncable from header (6 consecutive vowels)

0.8 FROM_SUSPICIOUS_NTLD_FP From abused NTLD

0.5 FROM_SUSPICIOUS_NTLD From abused NTLD

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

1.0 XPRIO Has X-Priority header

Subject: {SPAM?} Mandatory Documentation Action Required =?UTF-8?B?4oCT?= W-8BEN No

Longer Valid



TD TD Direct Investing Logo

Mandatory Account Update – Expired W-8BEN Must Be Renewed



Dear Client,



This notice is issued to advise you that the W-8BEN form associated with your account has expired and is no longer valid for tax compliance or reporting purposes. The W-8BEN is required to certify non-U.S. tax residency and to support the correct application of withholding and reporting obligations under applicable tax laws.



Following expiration, the form cannot be relied upon to claim reduced withholding rates or other tax-related benefits. Regulatory standards require that valid documentation be maintained. Without a renewed W-8BEN on file, standard withholding treatment may be applied to your account.



To maintain compliant tax records and ensure proper handling of your account, you are required to submit a renewed W-8BEN through our secure documentation system.



To begin the renewal process, please access the secure system below:



Complete Update



Login with the email address you used to register to complete your application today, or access your application using your WebBroker Username/Connect ID and password, or your EasyWeb Username/Access Card and password.

Questions? We're Ready to Help!



Call 1‑800‑465‑5463 to speak to a licensed Investment Representative from Monday to Friday, 7:00 a.m. to 10:00 p.m. EST (one-hour extension).



Thank you,



TD Direct Investing

Contact Us | Privacy & Security | Legal



TD Direct Investing is a division of TD Waterhouse Canada Inc., a subsidiary of The Toronto‑Dominion Bank.



® The TD logo and other TD trademarks are the property of The Toronto‑Dominion Bank or its subsidiaries.



If you wish to unsubscribe from receiving commercial electronic messages from TD Bank Group, please click here



Geek squad phish from Google Gmail Part 3

Posted by Dave Yadallee on
@font-face {

font-family: 'Google Sans';

font-style: normal;

font-weight: 500;

src: url(//fonts.gstatic.com/s/googlesans/v14/4UabrENHsxJlGDuGo1OIlLU94Yt=

zCwM.ttf) format('truetype');

}

@font-face {

font-family: 'Google Sans';

font-style: normal;

font-weight: 700;

src: url(//fonts.gstatic.com/s/googlesans/v14/4UabrENHsxJlGDuGo1OIlLV154t=

zCwM.ttf) format('truetype');

}





=20



=20



=20



=20



Geek squad phish from Google Gmail Part 4

Posted by Dave Yadallee on













/InformAction">
emtype=3D"http://schema.org/EmailMessage">
ntent=3D"Clint Batterberry: Esteemed Customer, dispatch finalized for Trans=

action"/>
ma.org/Event">
ventScheduled"/>
chema.org/Organization">
/>
7aJreYj8yQppK"/>
line-height: 1px; height: 0; max-height: 0; width: 0; max-width: 0; opacity=

: 0; overflow: hidden;" itemprop=3D"name">Esteemed Customer, dispatch final=

ized for Transaction
"0" cellspacing=3D"0" role=3D"presentation" align=3D"center" style=3D"width=

:100%;" class=3D"body-container">

=3D"left">
 
>
dding=3D"0" cellspacing=3D"0" role=3D"presentation" align=3D"center" style=

=3D"width:100%;" class=3D"">

eft">


p=3D"description">Esteemed Customer, dispatch finalized for Transaction

=


spacing=3D"0" role=3D"presentation" align=3D"center" style=3D"width:100%;" =

class=3D"">

: 8px; direction: rtl; font-size: 0; padding: 24px 32px; text-align: left; =

vertical-align: top;" class=3D"main-container-inner">

direction: ltr; display: inline-block; vertical-align: top; width: 100%;ove=

rflow: hidden; word-wrap: break-word;">
" cellspacing=3D"0" role=3D"presentation" width=3D"100%" class=3D"main-colu=

mn-table-ltr" style=3D"padding-right: 32px; padding-left: 0;;table-layout: =

fixed;">

l-align:top;">
=3D"presentation" width=3D"100%" style=3D"table-layout: fixed;">
style=3D"font-size: 0; padding: 0; text-align: left; word-break: break-wor=

d;;padding-bottom:24px;">

-style: normal; font-weight: 400; font-size: 14px; line-height: 20px; lette=

r-spacing: 0.2px;color: #3c4043; text-decoration: none;" class=3D"primary-t=

ext" role=3D"presentation">

le=3D"font-size: 0; padding: 0; text-align: left; word-break: break-word;;p=

adding-bottom:2px;">

o, sans-serif;font-weight: 400; font-size: 22px; line-height: 28px;color: #=

3c4043; text-decoration: none;" class=3D"primary-text" role=3D"presentation=

">Esteemed Customer, dispatch finalized for Transac=

tion

align: left; word-break: break-word;;padding-bottom:24px;">

nt-family: Roboto, sans-serif;font-style: normal; font-weight: 400; font-si=

ze: 14px; line-height: 20px; letter-spacing: 0.2px;color: #3c4043; text-dec=

oration: none;" class=3D"primary-text" role=3D"presentation">
den=3D"true">=

Tuesday Feb 10, 2026 =E2=8B=85 4:25am (Eastern Time - New York)
>

t; word-break: break-word;;padding-bottom:24px;">

Roboto, sans-serif;font-style: normal; font-weight: 400; font-size: 14px; =

line-height: 20px; letter-spacing: 0.2px;color: #3c4043; text-decoration: n=

one;" class=3D"primary-text" role=3D"presentation">

GeekSqua=

d Transaction Date: Tuesday, 10 February 2026
Transaction No: NO56931XFH=

6976
{ph}: (859)-312 3507

Membership stays enabled

Esteemed =

Customer,

We are confirming your upcoming automatic renewal with Geek=

Squad. A payment of USD551.77 will be processed today, Tuesday, 10 February=

2026, for your membership renewal.

Purchase Record Archive
strong>
- Quantity: x3 Device
- Product: Complete Access Coverage
=

- Current Plan: 5 Years Warranty
- Payment Method: Auto Debit
- Total=

Paid: USD551.77
- Client ID: MQVYIPUZN4
- Activation Key: 05b590f6-0=

f61-499b-b4da-3af3c9c7902e

This membership will renew automatically e=

ach year unless canceled 48 hours before the renewal date.

Should you=

need to make any changes, please contact our Support Team at (859)-312 350=

7.

Yours kindly,,
Geek Squad By Best Buy
Manage by: Associated =

Teicher
Support Number: 1-(865) 209-0967
{address3}: 4758 N Federal =

Hwy Jacksonville Fl 32235-1506 United States
{hours}


mprop=3D"description" content=3D"GeekSquad Transaction Date: Tuesday, 10 Fe=

bruary 2026Transaction No: NO56931XFH6976{ph}: (859)-312 3507Membership sta=

ys enabledEsteemed Customer,We are confirming your upcoming automatic renew=

al with GeekSquad. A payment of USD551.77 will be processed today, Tuesday,=

10 February 2026, for your membership renewal.Purchase Record Archive- Qua=

ntity: x3 Device- Product: Complete Access Coverage- Current Plan: 5 Years =

Warranty- Payment Method: Auto Debit- Total Paid: USD551.77- Client ID: MQV=

YIPUZN4- Activation Key: 05b590f6-0f61-499b-b4da-3af3c9c7902eThis membershi=

p will renew automatically each year unless canceled 48 hours before the re=

newal date.Should you need to make any changes, please contact our Support =

Team at (859)-312 3507.Yours kindly,,Geek Squad By Best BuyManage by: Assoc=

iated TeicherSupport Number: 1-(865) 209-0967{address3}: 4758 N Federal Hw=

y Jacksonville Fl 32235-1506 United States{hours}"/>

g=3D"0" role=3D"presentation" style=3D"padding-bottom: 4px;">


ass=3D"primary-text" style=3D"font-size: 14px;color: #3c4043; text-decorati=

on: none;font-weight: 700;-webkit-font-smoothing: antialiased;margin: 0; pa=

dding: 0;">Guests

(Guest list has been hidden at orga=

nizer's request)

-[if mso | IE]>

>

--000000000000d3d09d064a69ef18--

Geek squad phish from Google Gmail Part 2

Posted by Dave Yadallee on
--000000000000d3d09d064a69ef18

Content-Type: text/html; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable




schemas-microsoft-com:vml" xmlns:o=3D"urn:schemas-microsoft-com:office:offi=

ce">
t=3D"text/html; charset=3DUTF-8">
=3Ddevice-width,initial-scale=3D1">
ight dark">