Nigerian Spam from Google Gmail

Posted by Dave Yadallee on Thursday, August 13. 2026

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 13 Aug 2026 04:37:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.5 (FreeBSD))

(envelope-from )

id 1wuSnN-000000005GI-46cL

for dave@doctor.nl2k.ab.ca;

Thu, 13 Aug 2026 04:36:21 -0600

Resent-From: The Doctor

Resent-Date: Thu, 13 Aug 2026 04:36:21 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-pj2-f8.google.com ([74.125.227.136]:48753)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.99.5 (FreeBSD))

(envelope-from <09847@fangwit.ac.th>)

id 1wuM29-000000004DC-3ZKR

for doctor@mail.nl2k.ab.ca;

Wed, 12 Aug 2026 21:23:19 -0600

Received: by mail-pj2-f8.google.com with SMTP id d9443c01a7336-2d313798bf8so2106025ad.0

for ; Wed, 12 Aug 2026 20:22:23 -0700 (PDT)

ARC-Seal: i=1; a=rsa-sha256; t=1786591337; cv=none;

d=google.com; s=arc-20260327;

b=hA9+GHnnVfgS2MxtJraFObJyHlsYq3U2hMXaWe8mx4+EBRTyLV9ymeX4SpkFXbO0KE

WtU9ut4EFGLEHjIvuxA718EWXfyBmGM+4U7+WqZxuqdgCLxD97kuR5PTCNxmby+eQrXa

01vdj+mG44nJRpFM7l1CvrwMMXuH7OPSrMOkBesxqBdUdeTdbdxFfs4gkn4f9WPOB0ab

VsDXF7rK01ENNmFGT2Bbx8FECpb1voXiPwSZBHYxhvqRptGR7aAcHnWv5AbswU/lkU02

tk5Uy546k3UTgkr0q9DpQSusVE1Pjzre+VehuDJH/dkrDl5zlC8FyOhkNiKUEGNj5Wmr

35YQ==

ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20260327;

h=to:subject:message-id:date:from:reply-to:mime-version

:dkim-signature;

bh=4ydknHW2P8pjMeI4eFN3sPnhGEUQ1abgHhXUhIuZNGw=;

fh=HgIkBaNQuy42WG1XFGkOnz/8M6eWJrMMNbfDKG5Rnxs=;

b=ClH8CZuTCzXhbqXmyjhS2P86fiMHYrT1jsm/h0UslXaJyohYqFXj4TYuj+YVefCw/i

9B0fpoFNQFVXhMOAlPBXGw58ftM9A/uRResimHXeLCqcOfDUOzooDQvZWVb9DIAS7N8T

aTzLcfJZWqHXonAgQSxb/RxI5E6FpcC7kn4R5Fl+93eyyZXr3PdTn+ZZCCXhSO+1CqmE

kL8pV0VHDoOq41eNAi6uCGi2HVeCTXBOe1AJXlzR269PRoMMLUGISAbotpNFL9/VDBLH

CmUMSuE4LHHO9FULdJNa/5H58WvClM33uTenZKM4zwhvk4MsHWJOLpZQIaggiLMYX+hG

a74A==;

darn=mail.nl2k.ab.ca

ARC-Authentication-Results: i=1; mx.google.com; arc=none

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=fangwit.ac.th; s=google; t=1786591337; x=1787196137; darn=mail.nl2k.ab.ca;

h=content-type:to:subject:message-id:date:from:reply-to:mime-version

:from:to:cc:subject:date:message-id:reply-to:content-type;

bh=4ydknHW2P8pjMeI4eFN3sPnhGEUQ1abgHhXUhIuZNGw=;

b=iUaw3cylwS2fCtAJT4Hk15F83xLQV7lGVL1boZzNHYv+t8nl7gD3KciWB1vh5MyyU/

0Yg/7yLUSolEZ3oDKKKFWJ8ybjNkeZBOyG7FI/Uonyz1Xts4Hda9OEfGBM3NcAQMTV6X

ErHDba83kl4/TkeGn7eYciEH6vGhMeq/clZOa2TPt3nNE8fRwZLnIrEkxxPx3/3zVAnK

A25LGgP1WK2MQv+BqUzXylpGBDgJpqU2CSjVmFKg98bA5TbRN0/DvE1ushUNqhO8EF7M

K3j5iED02vTR9yx7xiSKO0K/ICbOq1WOtFF3HrrPiM9ZIBBjPMAs7r2rkeKGBfawuVZF

eIjw==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20251104; t=1786591337; x=1787196137;

h=content-type:to:subject:message-id:date:from:reply-to:mime-version

:x-gm-gg:x-gm-message-state:from:to:cc:subject:date:message-id

:reply-to:content-type;

bh=4ydknHW2P8pjMeI4eFN3sPnhGEUQ1abgHhXUhIuZNGw=;

b=o5XDH8ZAONsIukBTVfJ8fS9Tr0aSnggw/2/ZFXE3xnkdIZEoKG1iVT+8AIkVC8kw1z

CidaMsoXkezT5JQvSdpYsC1IPxNa2Eh932AURKptXOu4BA0IUSckXmOStlCCVbVR+8kw

54LoluofL5eQFIGRq90kTz5eEFE0W9WV/M6vzP0Z0IqGDDbIsVAOARfsAbM7q6kRulP8

NZfsJINBGwGNiAjTgnUBVGIPQdSv/J+bZK45vutH1NOaWl64/wH6b5sa1ok7KmXDf62h

neJXQ0lPvPTRitmAakuPd1ikgB2/Urht35lSBOd1mYw2ZMzTaSa9j/MetG9vwPYZjLtF

whzg==

X-Forwarded-Encrypted: i=1; AHgh+RoDzRUboHGPLitHB3VFvNMkqGwTUsCy/o3L3pBZrVcwNAPwoJDCX/tgyKivUh4/6lDGLtRcF5I=@mail.nl2k.ab.ca

X-Gm-Message-State: AOJu0YwF3Tt5/qC3wxH528pW9oN+AkYvWtt96q94BS3oMqmWdJUaAGzb

atrZGHbnWevGkmaYNswzBacK4Wy0jJAxYQpXX44KGD3YBtSUBy9hgDqD6plqtGFMVIRhNf9LN5R

/QgxYyHoBXiQkUImA9Lm9I6nf0YdTVK7FIOf/D6qKqg==

X-Gm-Gg: AR+sD112TuRefrX8ViPzz2GAXjcVpJzI7N3A9uGGTNR3fioE/eRhktZ6a2hbMCjYCQI

LtS2gLYWUrgWl+0raOR1qLKwvp4mfT3k3wIdQIJ3ZD6JvTqZqEUyo6wrJ7cJBteBEsGPRvMBXRb

2R9ZY+EM6RivXikWUR70ui/e6sTSO6KPHZyexXWRdjrfh29oC4huFffWRhKhhmz6I9l8+cRzSaU

6ev7PNSucf5sDqsr7U+tmspEsoJjtYDhDqZrnsIkYW/dhFH5u9aBDDEix0HRKiZSZfG58ENRblz

aRQJWLydBb+t+UVPxt5yvcBTixV0HJEvFzlhV0XK24tkLTrpb4+Oz95+tHp9a+9wqSunV5QoDui

qt/Ji7yyo8kbyBAtUQjTBYAX4/emNal+eK7xM4Yf7l2NP9xaC2XrUZTS5E2Q=

X-Received: by 2002:a05:6a21:6b02:b0:3ab:2fa:756c with SMTP id

adf61e73a8af0-3cc54f9616emr4198498637.1.1786591336774; Wed, 12 Aug 2026

20:22:16 -0700 (PDT)

MIME-Version: 1.0

Reply-To: norah111555@proton.me

From: =?UTF-8?B?4LiZ4Liy4Lii4LiX4Lix4Lio4LiZ4Lix4LiiIOC4leC4uOC4oeC5gOC4geC4qeC4l+C4tQ==?= <09847@fangwit.ac.th>

Date: Wed, 12 Aug 2026 20:22:04 -0700

X-Gm-Features: AUfX_mxxJp3ez1F1t3GUsOo2X2AV-RXO3mtIqkPuX05ji1Y8WweKWONbuCrG6Uc

Message-ID:

Subject: My Dear Partner ,

To: undisclosed-recipients:;

Content-Type: multipart/alternative; boundary="000000000000fcce740658e53526"

Bcc: doctor@mail.nl2k.ab.ca

X-Spam_score: 11.4

X-Spam_score_int: 114

X-Spam_bar: +++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.

Content preview: My Dear Partner , Due to my tight schedules I could not contact

you earlier. now.I'm happy to inform you about my success in getting those

funds transferred under the cooperation of a new partner. Now [...]

Content analysis details: (11.4 points, 5.0 required)

pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[74.125.227.136 listed in will-spam-for-food.eu.org]

[74.125.227.136 listed in will-spam-for-food.eu.org]

[74.125.227.136 listed in will-spam-for-food.eu.org]

[74.125.227.136 listed in will-spam-for-food.eu.org]

[74.125.227.136 listed in will-spam-for-food.eu.org]

[74.125.227.136 listed in will-spam-for-food.eu.org]

[74.125.227.136 listed in will-spam-for-food.eu.org]

[74.125.227.136 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[74.125.227.136 listed in dnsbl.ahbl.org]

[74.125.227.136 listed in dnsbl.ahbl.org]

[74.125.227.136 listed in dnsbl.ahbl.org]

[74.125.227.136 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[74.125.227.136 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[74.125.227.136 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[74.125.227.136 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[74.125.227.136 listed in dnsbl.ahbl.org]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[74.125.227.136 listed in list.dnswl.org]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[74.125.227.136 listed in wl.mailspike.net]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[74.125.227.136 listed in bl.score.senderscore.com]

-0.0 SPF_PASS SPF: sender matches SPF record

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

1.5 GR_DOMAIN_UNDISC1 To contains undisclosed recipient (undisc)

1.5 HK_SCAM_N8 BODY: No description available.

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

0.0 HK_SCAM No description available.

0.0 LOTS_OF_MONEY Huge... sums of money

0.0 T_FILL_THIS_FORM_SHORT Fill in a short form with personal information

1.5 MONEY_ATM_CARD Lots of money on an ATM card

1.3 MONEY_FORM_SHORT Lots of money if you fill out a short form

2.4 UNDISC_MONEY Undisclosed recipients + money/fraud signs

2.0 ADVANCE_FEE_2_NEW_MONEY Advance Fee fraud and lots of money

Subject: {SPAM?} My Dear Partner ,

--000000000000fcce740658e53526

Content-Type: text/plain; charset="UTF-8"

My Dear Partner ,

Due to my tight schedules I could not contact you earlier. now.I'm happy to

inform you about my success in getting those funds transferred under the

cooperation of a new partner.

Now contact my secretary Name is: Mr.Ben Mark Email address:(

janenorah64@gmail.com) Tell him to send you the ATM card, a total sum of US

US$10.5 million which I kept for your compensation for all your past

efforts and attempts to assist me in this transaction, which was applied in

your name. I appreciate your efforts at that time so much.

Best Regards

--000000000000fcce740658e53526

Content-Type: text/html; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable

My Dear Partner ,
Due to my tight schedules I could not=

contact you earlier. now.I'm happy to inform you about my success in g=

etting those funds transferred under the cooperation of a new partner.
N=

ow contact my secretary Name is: Mr.Ben Mark Email address:(
lto:janenorah64@gmail.com">janenorah64@gmail.com) Tell him to send you =

the ATM card, a total sum of US US$10.5 million which I kept for your compe=

nsation for all your past efforts and attempts to assist me in this transac=

tion, which was applied in your name. I appreciate your efforts at that tim=

e so much.
Best Regards

--000000000000fcce740658e53526--

Microsoft Temas phish

Posted by Dave Yadallee on Thursday, August 13. 2026

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 13 Aug 2026 07:11:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.5 (FreeBSD))

(envelope-from )

id 1wuVCU-00000000P9p-0qvR

for dave@doctor.nl2k.ab.ca;

Thu, 13 Aug 2026 07:10:26 -0600

Resent-From: The Doctor

Resent-Date: Thu, 13 Aug 2026 07:10:26 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from smtp.telepacific.net ([208.57.4.233]:39623)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.99.5 (FreeBSD))

(envelope-from )

id 1wuTlM-00000000FUL-21pG

for sales@nk.ca;

Thu, 13 Aug 2026 05:38:29 -0600

Received: from CNABAL-PC10.king.local (unknown [64.60.196.69])

by smtp.telepacific.net (Postfix) with ESMTP id 6167E12524D;

Wed, 12 Aug 2026 19:33:52 -0700 (PDT)

Content-Type: multipart/alternative; boundary="===============1462528628=="

MIME-Version: 1.0

Subject: New Message on Microsoft Teams Meeting

To: Recipients

From: "Microsoft Teams"

Date: Wed, 12 Aug 2026 19:32:52 -0700

X-Spam_score: 8.2

X-Spam_score_int: 82

X-Spam_bar: ++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.

Content preview: Microsoft Teams Secure collaboration Work chat Hi, 1 unread

mention Your teammates are trying to reach you in Microsoft Teams Someone

sent a message in a high-priority chat Reply, Go to conversation Microsoft

Teams

Content analysis details: (8.2 points, 5.0 required)

pts rule name description

---- ---------------------- --------------------------------------------------

0.1 MISSING_MID Missing Message-Id: header

-0.7 RCVD_IN_DNSWL_LOW RBL: Sender listed at http://www.dnswl.org/, low

trust

[208.57.4.233 listed in list.dnswl.org]

1.2 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a relay in bl.spamcop.net

[Blocked - see ]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[64.60.196.69 listed in will-spam-for-food.eu.org]

[64.60.196.69 listed in will-spam-for-food.eu.org]

[64.60.196.69 listed in will-spam-for-food.eu.org]

[64.60.196.69 listed in will-spam-for-food.eu.org]

[64.60.196.69 listed in will-spam-for-food.eu.org]

[64.60.196.69 listed in will-spam-for-food.eu.org]

[64.60.196.69 listed in will-spam-for-food.eu.org]

[64.60.196.69 listed in will-spam-for-food.eu.org]

[208.57.4.233 listed in will-spam-for-food.eu.org]

[208.57.4.233 listed in will-spam-for-food.eu.org]

[208.57.4.233 listed in will-spam-for-food.eu.org]

[208.57.4.233 listed in will-spam-for-food.eu.org]

[208.57.4.233 listed in will-spam-for-food.eu.org]

[208.57.4.233 listed in will-spam-for-food.eu.org]

[208.57.4.233 listed in will-spam-for-food.eu.org]

[208.57.4.233 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[64.60.196.69 listed in dnsbl.ahbl.org]

[64.60.196.69 listed in dnsbl.ahbl.org]

[64.60.196.69 listed in dnsbl.ahbl.org]

[64.60.196.69 listed in dnsbl.ahbl.org]

[208.57.4.233 listed in dnsbl.ahbl.org]

[208.57.4.233 listed in dnsbl.ahbl.org]

[208.57.4.233 listed in dnsbl.ahbl.org]

[208.57.4.233 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[64.60.196.69 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[64.60.196.69 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[64.60.196.69 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[64.60.196.69 listed in dnsbl.ahbl.org]

3.6 RCVD_IN_SBL_CSS RBL: Received via a relay in Spamhaus SBL-CSS

[64.60.196.69 listed in zen.spamhaus.org]

1.5 RCVD_IN_SBL_XBL RBL: Received via a relay in Spamhaus SBL+XBL

[64.60.196.69 listed in sbl-xbl.spamhaus.org]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

0.7 SPF_NEUTRAL SPF: sender does not match SPF record (neutral)

0.5 NO_RDNS Sending MTA has no reverse DNS (Postfix variant)

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 HTML_MESSAGE BODY: HTML included in message

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[208.57.4.233 listed in bl.score.senderscore.com]

Subject: {SPAM?} New Message on Microsoft Teams Meeting

You will not see this in a MIME-aware mail reader.

--===============1462528628==

Content-Type: text/plain; charset="iso-8859-1"

MIME-Version: 1.0

Content-Transfer-Encoding: quoted-printable

Content-Description: Mail message body

=

Microsoft Teams

Secure collaboration Work chat

=

Hi, =

1 unread mention

=

Your teammates are trying to reach you in Microsoft Teams

Someone sent a message in a high-priority chat

Reply, Go to conversation Microsoft Teams

=

Regards,

Microsoft Teams

Microsoft Teams 2026 Microsoft Corporation, One Microsoft Way, Redmond, W=

A 98052

You're receiving this because someone mentioned you in a chat on Microsoft=

Teams.

--===============1462528628==

Content-Type: text/html; charset="iso-8859-1"

MIME-Version: 1.0

Content-Transfer-Encoding: quoted-printable

Content-Description: Mail message body

Microsoft Teams

Microsoft Teams

Secure collaboration Work chat

Hi,

1 unread mention

Your teammates are trying to reach you in Microsoft Te=

ams

Someone sent a message in a high-priority chat

ss=3Dcta-button href=3D"https://t.co/SfwfxfBZXv">Reply, Go to conversation<=

/A> =

Microsoft Teams

AIN>

--===============1462528628==--

Microsoft Teams phish

Posted by Dave Yadallee on Thursday, August 13. 2026

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 13 Aug 2026 07:11:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.5 (FreeBSD))

(envelope-from )

id 1wuVCb-00000000PBN-1603

for dave@doctor.nl2k.ab.ca;

Thu, 13 Aug 2026 07:10:33 -0600

Resent-From: The Doctor

Resent-Date: Thu, 13 Aug 2026 07:10:33 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from smtpout.telepacific.net ([208.57.4.233]:36331 helo=smtp.telepacific.net)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.99.5 (FreeBSD))

(envelope-from )

id 1wuU5L-00000000KAh-2G9L

for doctor@nl2k.ab.ca;

Thu, 13 Aug 2026 05:59:09 -0600

Received: from CNABAL-PC10.king.local (unknown [64.60.196.69])

by smtp.telepacific.net (Postfix) with ESMTP id 69CD1125365;

Wed, 12 Aug 2026 19:34:01 -0700 (PDT)

Content-Type: multipart/alternative; boundary="===============1666873558=="

MIME-Version: 1.0

Subject: New Message on Microsoft Teams Meeting

To: Recipients

From: "Microsoft Teams"

Date: Wed, 12 Aug 2026 19:33:01 -0700

X-Spam_score: 8.2

X-Spam_score_int: 82

X-Spam_bar: ++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.

Content preview: Microsoft Teams Secure collaboration Work chat Hi, 1 unread

mention Your teammates are trying to reach you in Microsoft Teams Someone

sent a message in a high-priority chat Reply, Go to conversation Microsoft

Teams

Content analysis details: (8.2 points, 5.0 required)

pts rule name description

---- ---------------------- --------------------------------------------------

0.1 MISSING_MID Missing Message-Id: header

-0.7 RCVD_IN_DNSWL_LOW RBL: Sender listed at http://www.dnswl.org/, low

trust

[208.57.4.233 listed in list.dnswl.org]

1.2 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a relay in bl.spamcop.net

[Blocked - see ]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[64.60.196.69 listed in will-spam-for-food.eu.org]

[64.60.196.69 listed in will-spam-for-food.eu.org]

[64.60.196.69 listed in will-spam-for-food.eu.org]

[64.60.196.69 listed in will-spam-for-food.eu.org]

[64.60.196.69 listed in will-spam-for-food.eu.org]

[64.60.196.69 listed in will-spam-for-food.eu.org]

[64.60.196.69 listed in will-spam-for-food.eu.org]

[64.60.196.69 listed in will-spam-for-food.eu.org]

[208.57.4.233 listed in will-spam-for-food.eu.org]

[208.57.4.233 listed in will-spam-for-food.eu.org]

[208.57.4.233 listed in will-spam-for-food.eu.org]

[208.57.4.233 listed in will-spam-for-food.eu.org]

[208.57.4.233 listed in will-spam-for-food.eu.org]

[208.57.4.233 listed in will-spam-for-food.eu.org]

[208.57.4.233 listed in will-spam-for-food.eu.org]

[208.57.4.233 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[64.60.196.69 listed in dnsbl.ahbl.org]

[64.60.196.69 listed in dnsbl.ahbl.org]

[64.60.196.69 listed in dnsbl.ahbl.org]

[64.60.196.69 listed in dnsbl.ahbl.org]

[208.57.4.233 listed in dnsbl.ahbl.org]

[208.57.4.233 listed in dnsbl.ahbl.org]

[208.57.4.233 listed in dnsbl.ahbl.org]

[208.57.4.233 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[64.60.196.69 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[64.60.196.69 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[64.60.196.69 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[64.60.196.69 listed in dnsbl.ahbl.org]

3.6 RCVD_IN_SBL_CSS RBL: Received via a relay in Spamhaus SBL-CSS

[64.60.196.69 listed in zen.spamhaus.org]

1.5 RCVD_IN_SBL_XBL RBL: Received via a relay in Spamhaus SBL+XBL

[64.60.196.69 listed in sbl-xbl.spamhaus.org]

0.7 SPF_NEUTRAL SPF: sender does not match SPF record (neutral)

0.5 NO_RDNS Sending MTA has no reverse DNS (Postfix variant)

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[208.57.4.233 listed in bl.score.senderscore.com]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 HTML_MESSAGE BODY: HTML included in message

Subject: {SPAM?} New Message on Microsoft Teams Meeting

You will not see this in a MIME-aware mail reader.

--===============1666873558==

Content-Type: text/plain; charset="iso-8859-1"

MIME-Version: 1.0

Content-Transfer-Encoding: quoted-printable

Content-Description: Mail message body

=

Microsoft Teams

Secure collaboration Work chat

=

Hi, =

1 unread mention

=

Your teammates are trying to reach you in Microsoft Teams

Someone sent a message in a high-priority chat

Reply, Go to conversation Microsoft Teams

=

Regards,

Microsoft Teams

Microsoft Teams 2026 Microsoft Corporation, One Microsoft Way, Redmond, W=

A 98052

You're receiving this because someone mentioned you in a chat on Microsoft=

Teams.

--===============1666873558==

Content-Type: text/html; charset="iso-8859-1"

MIME-Version: 1.0

Content-Transfer-Encoding: quoted-printable

Content-Description: Mail message body

Microsoft Teams

Microsoft Teams

Secure collaboration Work chat

Hi,

1 unread mention

Your teammates are trying to reach you in Microsoft Te=

ams

Someone sent a message in a high-priority chat

ss=3Dcta-button href=3D"https://t.co/SfwfxfBZXv">Reply, Go to conversation<=

/A> =

Microsoft Teams

AIN>

--===============1666873558==--

Microsoft Teams phish

Posted by Dave Yadallee on Thursday, August 13. 2026

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 13 Aug 2026 07:11:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.5 (FreeBSD))

(envelope-from )

id 1wuVCQ-00000000P8b-0k9a

for dave@doctor.nl2k.ab.ca;

Thu, 13 Aug 2026 07:10:22 -0600

Resent-From: The Doctor

Resent-Date: Thu, 13 Aug 2026 07:10:22 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from smtpout.telepacific.net ([208.57.4.233]:33877 helo=smtp.telepacific.net)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.99.5 (FreeBSD))

(envelope-from )

id 1wuTKC-00000000AS9-2ggY

for doctor@netknow.ca;

Thu, 13 Aug 2026 05:10:26 -0600

Received: from CNABAL-PC10.king.local (unknown [64.60.196.69])

by smtp.telepacific.net (Postfix) with ESMTP id BA9801250CA;

Wed, 12 Aug 2026 19:33:39 -0700 (PDT)

Content-Type: multipart/alternative; boundary="===============0546516147=="

MIME-Version: 1.0

Subject: New Message on Microsoft Teams Meeting

To: Recipients

From: "Microsoft Teams"

Date: Wed, 12 Aug 2026 19:32:39 -0700

X-Spam_score: 8.2

X-Spam_score_int: 82

X-Spam_bar: ++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.

Content preview: Microsoft Teams Secure collaboration Work chat Hi, 1 unread

mention Your teammates are trying to reach you in Microsoft Teams Someone

sent a message in a high-priority chat Reply, Go to conversation Microsoft

Teams

Content analysis details: (8.2 points, 5.0 required)

pts rule name description

---- ---------------------- --------------------------------------------------

0.1 MISSING_MID Missing Message-Id: header

-0.7 RCVD_IN_DNSWL_LOW RBL: Sender listed at http://www.dnswl.org/, low

trust

[208.57.4.233 listed in list.dnswl.org]

1.2 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a relay in bl.spamcop.net

[Blocked - see ]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[64.60.196.69 listed in will-spam-for-food.eu.org]

[64.60.196.69 listed in will-spam-for-food.eu.org]

[64.60.196.69 listed in will-spam-for-food.eu.org]

[64.60.196.69 listed in will-spam-for-food.eu.org]

[64.60.196.69 listed in will-spam-for-food.eu.org]

[64.60.196.69 listed in will-spam-for-food.eu.org]

[64.60.196.69 listed in will-spam-for-food.eu.org]

[64.60.196.69 listed in will-spam-for-food.eu.org]

[208.57.4.233 listed in will-spam-for-food.eu.org]

[208.57.4.233 listed in will-spam-for-food.eu.org]

[208.57.4.233 listed in will-spam-for-food.eu.org]

[208.57.4.233 listed in will-spam-for-food.eu.org]

[208.57.4.233 listed in will-spam-for-food.eu.org]

[208.57.4.233 listed in will-spam-for-food.eu.org]

[208.57.4.233 listed in will-spam-for-food.eu.org]

[208.57.4.233 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[64.60.196.69 listed in dnsbl.ahbl.org]

[64.60.196.69 listed in dnsbl.ahbl.org]

[64.60.196.69 listed in dnsbl.ahbl.org]

[64.60.196.69 listed in dnsbl.ahbl.org]

[208.57.4.233 listed in dnsbl.ahbl.org]

[208.57.4.233 listed in dnsbl.ahbl.org]

[208.57.4.233 listed in dnsbl.ahbl.org]

[208.57.4.233 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[64.60.196.69 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[64.60.196.69 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[64.60.196.69 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[64.60.196.69 listed in dnsbl.ahbl.org]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

3.6 RCVD_IN_SBL_CSS RBL: Received via a relay in Spamhaus SBL-CSS

[64.60.196.69 listed in zen.spamhaus.org]

1.5 RCVD_IN_SBL_XBL RBL: Received via a relay in Spamhaus SBL+XBL

[64.60.196.69 listed in sbl-xbl.spamhaus.org]

0.7 SPF_NEUTRAL SPF: sender does not match SPF record (neutral)

0.5 NO_RDNS Sending MTA has no reverse DNS (Postfix variant)

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[208.57.4.233 listed in bl.score.senderscore.com]

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 HTML_MESSAGE BODY: HTML included in message

Subject: {SPAM?} New Message on Microsoft Teams Meeting

You will not see this in a MIME-aware mail reader.

--===============0546516147==

Content-Type: text/plain; charset="iso-8859-1"

MIME-Version: 1.0

Content-Transfer-Encoding: quoted-printable

Content-Description: Mail message body

=

Microsoft Teams

Secure collaboration Work chat

=

Hi, =

1 unread mention

=

Your teammates are trying to reach you in Microsoft Teams

Someone sent a message in a high-priority chat

Reply, Go to conversation Microsoft Teams

=

Regards,

Microsoft Teams

Microsoft Teams 2026 Microsoft Corporation, One Microsoft Way, Redmond, W=

A 98052

You're receiving this because someone mentioned you in a chat on Microsoft=

Teams.

--===============0546516147==

Content-Type: text/html; charset="iso-8859-1"

MIME-Version: 1.0

Content-Transfer-Encoding: quoted-printable

Content-Description: Mail message body

Microsoft Teams

Microsoft Teams

Secure collaboration Work chat

Hi,

1 unread mention

Your teammates are trying to reach you in Microsoft Te=

ams

Someone sent a message in a high-priority chat

ss=3Dcta-button href=3D"https://t.co/SfwfxfBZXv">Reply, Go to conversation<=

/A> =

Microsoft Teams

AIN>

--===============0546516147==--

Microsoft Teams phish

Posted by Dave Yadallee on Thursday, August 13. 2026

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 13 Aug 2026 04:36:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.5 (FreeBSD))

(envelope-from )

id 1wuSmz-0000000056o-21iW

for dave@doctor.nl2k.ab.ca;

Thu, 13 Aug 2026 04:35:57 -0600

Resent-From: The Doctor

Resent-Date: Thu, 13 Aug 2026 04:35:57 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from smtp.telepacific.net ([208.57.4.233]:45663)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.99.5 (FreeBSD))

(envelope-from )

id 1wuPqH-00000000Mdb-0tXw

for doctor@edmontonab.ca;

Thu, 13 Aug 2026 01:27:21 -0600

Received: from CNABAL-PC10.king.local (unknown [64.60.196.69])

by smtp.telepacific.net (Postfix) with ESMTP id 4BC1E124435;

Wed, 12 Aug 2026 19:31:43 -0700 (PDT)

Content-Type: multipart/alternative; boundary="===============1502743536=="

MIME-Version: 1.0

Subject: New Message on Microsoft Teams Meeting

To: Recipients

From: "Microsoft Teams"

Date: Wed, 12 Aug 2026 19:30:43 -0700

X-Spam_score: 8.2

X-Spam_score_int: 82

X-Spam_bar: ++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.

Content preview: Microsoft Teams Secure collaboration Work chat Hi, 1 unread

mention Your teammates are trying to reach you in Microsoft Teams Someone

sent a message in a high-priority chat Reply, Go to conversation Microsoft

Teams

Content analysis details: (8.2 points, 5.0 required)

pts rule name description

---- ---------------------- --------------------------------------------------

0.1 MISSING_MID Missing Message-Id: header

-0.7 RCVD_IN_DNSWL_LOW RBL: Sender listed at http://www.dnswl.org/, low

trust

[208.57.4.233 listed in list.dnswl.org]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

3.6 RCVD_IN_SBL_CSS RBL: Received via a relay in Spamhaus SBL-CSS

[64.60.196.69 listed in zen.spamhaus.org]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[208.57.4.233 listed in bl.score.senderscore.com]

1.5 RCVD_IN_SBL_XBL RBL: Received via a relay in Spamhaus SBL+XBL

[64.60.196.69 listed in sbl-xbl.spamhaus.org]

1.2 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a relay in bl.spamcop.net

[Blocked - see ]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[64.60.196.69 listed in will-spam-for-food.eu.org]

[64.60.196.69 listed in will-spam-for-food.eu.org]

[64.60.196.69 listed in will-spam-for-food.eu.org]

[64.60.196.69 listed in will-spam-for-food.eu.org]

[64.60.196.69 listed in will-spam-for-food.eu.org]

[64.60.196.69 listed in will-spam-for-food.eu.org]

[64.60.196.69 listed in will-spam-for-food.eu.org]

[64.60.196.69 listed in will-spam-for-food.eu.org]

[208.57.4.233 listed in will-spam-for-food.eu.org]

[208.57.4.233 listed in will-spam-for-food.eu.org]

[208.57.4.233 listed in will-spam-for-food.eu.org]

[208.57.4.233 listed in will-spam-for-food.eu.org]

[208.57.4.233 listed in will-spam-for-food.eu.org]

[208.57.4.233 listed in will-spam-for-food.eu.org]

[208.57.4.233 listed in will-spam-for-food.eu.org]

[208.57.4.233 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[64.60.196.69 listed in dnsbl.ahbl.org]

[64.60.196.69 listed in dnsbl.ahbl.org]

[64.60.196.69 listed in dnsbl.ahbl.org]

[64.60.196.69 listed in dnsbl.ahbl.org]

[208.57.4.233 listed in dnsbl.ahbl.org]

[208.57.4.233 listed in dnsbl.ahbl.org]

[208.57.4.233 listed in dnsbl.ahbl.org]

[208.57.4.233 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[64.60.196.69 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[64.60.196.69 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[64.60.196.69 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[64.60.196.69 listed in dnsbl.ahbl.org]

0.7 SPF_NEUTRAL SPF: sender does not match SPF record (neutral)

0.5 NO_RDNS Sending MTA has no reverse DNS (Postfix variant)

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 HTML_MESSAGE BODY: HTML included in message

Subject: {SPAM?} New Message on Microsoft Teams Meeting

You will not see this in a MIME-aware mail reader.

--===============1502743536==

Content-Type: text/plain; charset="iso-8859-1"

MIME-Version: 1.0

Content-Transfer-Encoding: quoted-printable

Content-Description: Mail message body

=

Microsoft Teams

Secure collaboration Work chat

=

Hi, =

1 unread mention

=

Your teammates are trying to reach you in Microsoft Teams

Someone sent a message in a high-priority chat

Reply, Go to conversation Microsoft Teams

=

Regards,

Microsoft Teams

Microsoft Teams 2026 Microsoft Corporation, One Microsoft Way, Redmond, W=

A 98052

You're receiving this because someone mentioned you in a chat on Microsoft=

Teams.

--===============1502743536==

Content-Type: text/html; charset="iso-8859-1"

MIME-Version: 1.0

Content-Transfer-Encoding: quoted-printable

Content-Description: Mail message body

Microsoft Teams

Microsoft Teams

Secure collaboration Work chat

Hi,

1 unread mention

Your teammates are trying to reach you in Microsoft Te=

ams

Someone sent a message in a high-priority chat

ss=3Dcta-button href=3D"https://t.co/SfwfxfBZXv">Reply, Go to conversation<=

/A> =

Microsoft Teams

AIN>

--===============1502743536==--

Microsoft Teams phish

Posted by Dave Yadallee on Thursday, August 13. 2026

Microsoft Teams

Secure collaboration Work chat

Hi,

1 unread mention

Your teammates are trying to reach you in Microsoft Te=

ams

Someone sent a message in a high-priority chat

ss=3Dcta-button href=3D"https://t.co/SfwfxfBZXv">Reply, Go to conversation<=

/A> =

Microsoft Teams

AIN>

--===============1502743536==--

Microsoft teams phish

Posted by Dave Yadallee on Thursday, August 13. 2026

Microsoft Teams

Secure collaboration Work chat

Hi,

1 unread mention

Your teammates are trying to reach you in Microsoft Te=

ams

Someone sent a message in a high-priority chat

ss=3Dcta-button href=3D"https://t.co/SfwfxfBZXv">Reply, Go to conversation<=

/A> =

Microsoft Teams

AIN>

--===============1502743536==--

Microsoft Teams phish

Posted by Dave Yadallee on Thursday, August 13. 2026

Microsoft Teams

Secure collaboration Work chat

Hi,

1 unread mention

Your teammates are trying to reach you in Microsoft Te=

ams

Someone sent a message in a high-priority chat

ss=3Dcta-button href=3D"https://t.co/SfwfxfBZXv">Reply, Go to conversation<=

/A> =

Microsoft Teams

AIN>

--===============1502743536==--

Microsoft Teams phish

Posted by Dave Yadallee on Thursday, August 13. 2026

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 13 Aug 2026 04:36:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.5 (FreeBSD))

(envelope-from )

id 1wuSms-0000000053M-0mx1

for dave@doctor.nl2k.ab.ca;

Thu, 13 Aug 2026 04:35:50 -0600

Resent-From: The Doctor

Resent-Date: Thu, 13 Aug 2026 04:35:50 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from smtp-out.telepacific.net ([208.57.4.233]:49911 helo=smtp.telepacific.net)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.99.5 (FreeBSD))

(envelope-from )

id 1wuMCt-000000006Am-0OkK

for doctor@edmontonab.ca;

Wed, 12 Aug 2026 21:34:24 -0600

Received: from CNABAL-PC10.king.local (unknown [64.60.196.69])

by smtp.telepacific.net (Postfix) with ESMTP id 1A242123296;

Wed, 12 Aug 2026 19:28:55 -0700 (PDT)

Content-Type: multipart/alternative; boundary="===============0532043777=="

MIME-Version: 1.0

Subject: New Message on Microsoft Teams Meeting

To: Recipients

From: "Microsoft Teams"

Date: Wed, 12 Aug 2026 19:27:55 -0700

X-Spam_score: 8.2

X-Spam_score_int: 82

X-Spam_bar: ++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.

Content preview: Microsoft Teams Secure collaboration Work chat Hi, 1 unread

mention Your teammates are trying to reach you in Microsoft Teams Someone

sent a message in a high-priority chat Reply, Go to conversation Microsoft

Teams

Content analysis details: (8.2 points, 5.0 required)

pts rule name description

---- ---------------------- --------------------------------------------------

0.1 MISSING_MID Missing Message-Id: header

-0.7 RCVD_IN_DNSWL_LOW RBL: Sender listed at http://www.dnswl.org/, low

trust

[208.57.4.233 listed in list.dnswl.org]

1.2 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a relay in bl.spamcop.net

[Blocked - see ]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[64.60.196.69 listed in dnsbl.ahbl.org]

[64.60.196.69 listed in dnsbl.ahbl.org]

[64.60.196.69 listed in dnsbl.ahbl.org]

[64.60.196.69 listed in dnsbl.ahbl.org]

[208.57.4.233 listed in dnsbl.ahbl.org]

[208.57.4.233 listed in dnsbl.ahbl.org]

[208.57.4.233 listed in dnsbl.ahbl.org]

[208.57.4.233 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[64.60.196.69 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[64.60.196.69 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[64.60.196.69 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[64.60.196.69 listed in dnsbl.ahbl.org]

3.6 RCVD_IN_SBL_CSS RBL: Received via a relay in Spamhaus SBL-CSS

[64.60.196.69 listed in zen.spamhaus.org]

1.5 RCVD_IN_SBL_XBL RBL: Received via a relay in Spamhaus SBL+XBL

[64.60.196.69 listed in sbl-xbl.spamhaus.org]

0.7 SPF_NEUTRAL SPF: sender does not match SPF record (neutral)

0.5 NO_RDNS Sending MTA has no reverse DNS (Postfix variant)

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 HTML_MESSAGE BODY: HTML included in message

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[208.57.4.233 listed in bl.score.senderscore.com]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[208.57.4.233 listed in will-spam-for-food.eu.org]

[208.57.4.233 listed in will-spam-for-food.eu.org]

[208.57.4.233 listed in will-spam-for-food.eu.org]

[208.57.4.233 listed in will-spam-for-food.eu.org]

[208.57.4.233 listed in will-spam-for-food.eu.org]

[208.57.4.233 listed in will-spam-for-food.eu.org]

[208.57.4.233 listed in will-spam-for-food.eu.org]

[208.57.4.233 listed in will-spam-for-food.eu.org]

[64.60.196.69 listed in will-spam-for-food.eu.org]

[64.60.196.69 listed in will-spam-for-food.eu.org]

[64.60.196.69 listed in will-spam-for-food.eu.org]

[64.60.196.69 listed in will-spam-for-food.eu.org]

[64.60.196.69 listed in will-spam-for-food.eu.org]

[64.60.196.69 listed in will-spam-for-food.eu.org]

[64.60.196.69 listed in will-spam-for-food.eu.org]

[64.60.196.69 listed in will-spam-for-food.eu.org]

Subject: {SPAM?} New Message on Microsoft Teams Meeting

You will not see this in a MIME-aware mail reader.

--===============0532043777==

Content-Type: text/plain; charset="iso-8859-1"

MIME-Version: 1.0

Content-Transfer-Encoding: quoted-printable

Content-Description: Mail message body

=

Microsoft Teams

Secure collaboration Work chat

=

Hi, =

1 unread mention

=

Your teammates are trying to reach you in Microsoft Teams

Someone sent a message in a high-priority chat

Reply, Go to conversation Microsoft Teams

=

Regards,

Microsoft Teams

Microsoft Teams 2026 Microsoft Corporation, One Microsoft Way, Redmond, W=

A 98052

You're receiving this because someone mentioned you in a chat on Microsoft=

Teams.

--===============0532043777==

Content-Type: text/html; charset="iso-8859-1"

MIME-Version: 1.0

Content-Transfer-Encoding: quoted-printable

Content-Description: Mail message body

Microsoft Teams

Microsoft Teams

Secure collaboration Work chat

Hi,

1 unread mention

Your teammates are trying to reach you in Microsoft Te=

ams

Someone sent a message in a high-priority chat

ss=3Dcta-button href=3D"https://t.co/SfwfxfBZXv">Reply, Go to conversation<=

/A> =

Microsoft Teams

AIN>

--===============0532043777==--

Loan phish from Google Gmail

Posted by Dave Yadallee on Wednesday, August 12. 2026

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Wed, 12 Aug 2026 14:58:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.5 (FreeBSD))

(envelope-from )

id 1wuG1H-000000006oP-28e8

for dave@doctor.nl2k.ab.ca;

Wed, 12 Aug 2026 14:57:51 -0600

Resent-From: The Doctor

Resent-Date: Wed, 12 Aug 2026 14:57:51 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-pf1-f181.google.com ([209.85.210.181]:42046)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.99.5 (FreeBSD))

(envelope-from )

id 1wuFkv-000000003HO-1Cjn

for sales@nk.ca;

Wed, 12 Aug 2026 14:41:05 -0600

Received: by mail-pf1-f181.google.com with SMTP id d2e1a72fcca58-84847482584so266266b3a.0

for ; Wed, 12 Aug 2026 13:40:09 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=kesefmarketing.com; s=google; t=1786567204; x=1787172004; darn=nk.ca;

h=list-unsubscribe-post:list-unsubscribe:in-reply-to:references

:message-id:date:to:from:subject:mime-version:content-type:from:to

:cc:subject:date:message-id:reply-to:content-type;

bh=tbZIXyF/GNVVf8IjUiKQ+oV/jqy4i5laBakVQZhtqkY=;

b=EYBGAeo33Zcg2OG0YC0bcK2kJBeffD0WtKoDiiHN4WUuehJ24U4VeiNlHX2v/AjK7b

NCrmIa+OFdE34Owonou3Ga51SnyJ7GW+uJDvKhE7ZPtbe6FZeAMNTcRqS+cdDZsoElnj

1kQ4TpSRbhMOZ3KQ52QaAY1szfqnHAHxnN5nOB6vCd5WBbZy+M/wL8fSQ1TKqyqQF6gD

0eesvF3tzU3Oi0D1ZwzCAnxLQt5ytGMTW7ojbwrtUn3IYCcSk6eHvaeBKpsf/fbAWwZP

uNlSj5xCYR0SuUSFFp0dU+barUCAQQhVxaBd8DCOZiIIwfOhMRTjeOA+fPqhvZgcnrV4

FJ/A==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20251104; t=1786567204; x=1787172004;

h=list-unsubscribe-post:list-unsubscribe:in-reply-to:references

:message-id:date:to:from:subject:mime-version:content-type:x-gm-gg

:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to

:content-type;

bh=tbZIXyF/GNVVf8IjUiKQ+oV/jqy4i5laBakVQZhtqkY=;

b=kvjrmShxRPm7Inmjf59poq+05M1BuSt5vuZP29mSns2/u05YNrQsVAqkJfiWxuzRH/

3MBmBDWqVm9R0W8IX1PjNmreE7xK4n2gx4HHE8OC8fAcSy2cV9A3duLQZXw6183iGlaY

DaCT3UCYznoPVBULureC7Z6JZGltL81/9NkfQ4i2LTdNGKuTGqHRui8UwvdSsRG11KWo

ECVHff/2gWiaoxkirYafg72xZUCFpaomZuZuluJuxEab6JCCUcb38ndewITEgAKaGkTk

BSry/7Ftjee1ma8ZeZYU20z4BMXDssDSzzf75UvxEjDRs6T1xB2fjkZJVWr3rMC12QS1

QGCQ==

X-Gm-Message-State: AOJu0Yw1AOcTHfbfQ/jJrMBQA1dQwMR3cpRKOyO3mIZaI8STo5kE4NZf

yf2wb3h6BDvpl36KwniUtjIkrwCS/h9XjRd6x4HF2ySu9l6pV9IzVdpf/kMC54biaFE3CB2Qmty

xR5Qx

X-Gm-Gg: AR+sD11t3seTxUqVbrNXpvLfZicFGyHG6GS5mYzW9qZrtNqO9k/dr2NAsJhSRYouF24

YW9GL8CdAfvYI10gVLyG+ocmEwWS7Vs6BoSn/YGMMNTcfCRIJYrgcrvTZlmtkQ2oYICNGkHA2Bg

zCVLn/OZ03KmScpyJWiafS7nLt+U+mhgjRwwcJehZiVey+oBlTcXeDesupLe+oJdyUCo92dbIlJ

V/bWQjrIs6B6LOxeYr3iuGVrwi62wA/nkHtG1IYYG+/H39VGnzKjNfq92uxw6gCKl97cmiMsK/R

DueJszsJyvNOYkzDrZcmdvo2clcDW+IProQ1gHiXFkVX8rHF6eIIodA8gkt0g3c2Tq2RfbjPTrt

oVca6U+le+hOb6kqHNlHnhS2nIqgjZtmLSbNJo6nfk+oCzDgQ3nelxzc0uyNZsGc1Q6bdllnqCT

Dy0s5BPfD+hjMhpAuFqeAJgOfdqzStv9XM0Ewg1TEpSmK9p8CXuD/uB7RkwXNGNE8QdA3goRok4

/YXulMX9c3Mb78D3xHhGEWfMimz8beqH4iCznTJmoM=

X-Received: by 2002:a05:6a00:14d5:b0:847:70f4:613f with SMTP id d2e1a72fcca58-84fc7c1ec38mr395443b3a.12.1786567203427;

Wed, 12 Aug 2026 13:40:03 -0700 (PDT)

Received: from smtpgw.close.com (am11-natgw-c0.close.com. [54.200.191.154])

by smtp.gmail.com with ESMTPSA id d2e1a72fcca58-84fc5a68c60sm114648b3a.48.2026.08.12.13.40.02

for

(version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256);

Wed, 12 Aug 2026 13:40:02 -0700 (PDT)

Content-Type: multipart/mixed; boundary="===============7946878310728263274=="

MIME-Version: 1.0

Subject: Re: Kesef Marketing | Smarter Access to Business Loans

From: =?utf-8?q?Lilian_Llanillo?=

To: =?utf-8?q?Gurkirat_Wirring?=

Date: Wed, 12 Aug 2026 20:40:02 +0000

Message-ID: <178656720216.7.1487486787664217380@smtpgw.close.com>

X-CLOSEIO-EMAIL-ID: acti_nk8LpFsOBhJSXuOowoxSS5NguctysG6eZdZgsfW6yYW

References: <178646337461.7.1240611996543057914@smtpgw.close.com> <178646337461.7.8575171778634196756@smtpgw.close.com>

In-Reply-To: <178646337461.7.1240611996543057914@smtpgw.close.com>

List-Unsubscribe:

List-Unsubscribe-Post: List-Unsubscribe=One-Click

--===============7946878310728263274==

Content-Type: multipart/alternative; boundary="===============6079678544044073755=="

MIME-Version: 1.0

--===============6079678544044073755==

Content-Type: text/plain; charset="utf-8"

MIME-Version: 1.0

Content-Transfer-Encoding: quoted-printable

**Hi Gurkirat, **

=20

**We noticed your Cash Advance application is still incomplete.**

=20

**You=E2=80=99re just a few steps away from securing up to $800,000 in fund=

ing within

48 hours.**

=20

**To move forward, please complete your application here: =20

**

[**Click to Start your Application

here**](https://form.jotform.com/260672364104452?lead_id=3Dlead_1MVGGnNXqVx=

8dbGrHgSfKaWzWuBT6yMLDjaGHIpxaD3&legalBusiness=3DN

K

MAINTENANCE&fullName\[first\]=3DGurkirat&fullName\[last\]=3DWirring&leadTyp=

e=3DAutomation)

=20

**and upload your last 3 months of bank statements. This will allow us to

finalize your review and match you with the best available funding options.=

**

=20

**If you have any questions or would prefer to speak directly, feel free to

call me at +1-866-216-5475 or 873-771-7630**

=20

**Best regards, =20

**

=20

**Lilian Llanillo**

**FUNDING ADVISOR**

=20

![email $16px$.png](https://closeio-

filepicker.s3.amazonaws.com/2026-05-14%2F1RDDVOgmo8WoImXFkS0Dtk%2F177877403=

9066-email+%2816px%29.png)****[**lilian@kesefmarketing.com**](https://lilia=

n@kesefmarketing.com)

![phone-call $16px$.png](https://closeio-

filepicker.s3.amazonaws.com/2026-05-14%2F1RDDVOgmo8WoImXFkS0Dtk%2F177877413=

7354-phone-

call+%2816px%29.png)**+1 (873) 771-7630**

**____________________________**

![IMG_5340.jpg](https://closeio-

filepicker.s3.amazonaws.com/2026-05-14%2F1RDDVOgmo8WoImXFkS0Dtk%2F177877416=

5068-IMG_5340.jpg)

=20

To stop receiving these emails, click

[here](https://app.close.com/go/unsubscribe/orga_WJQdcK5MUUa02rLIty6GVDnil9=

kHSKU8WElV6ueTPiF/sales%40nk.ca/GK6U1JDQJSfaf6

--tg9gajA9HdvShNSyH_DgbhmTyc8=3D/).

=20

=20

On Aug 11, 2026, at 09:49 AM, Lilian Llanillo

wrote: =20

> **Hi Gurkirat,**

>

> =20

>

>

> **This is Lilian Llanillo from Kesef Marketing.**

>

> =20

>

>

> **Welcome! I wanted to personally reach out and thank you for your intere=

st

> in business funding. We work with lenders across Canada to provide reliab=

le

> funding solutions that support growth, manage cash flow, and cover upcomi=

ng

> expenses=E2=80=94while helping you access competitive interest rates.**

>

> =20

>

>

> **If you=E2=80=99re open to exploring your options, you can get started h=

ere: =20

> **[**Click Here To Start Your

> Application**](https://form.jotform.com/260672364104452?lead_id=3Dlead_1M=

VGGnNXqVx8dbGrHgSfKaWzWuBT6yMLDjaGHIpxaD3&legalBusiness=3DN

> K

> MAINTENANCE&fullName\[first\]=3DGurkirat&fullName\[last\]=3DWirring&leadT=

ype=3DAutomation)

>

> **Once submitted, our team will review your information and present the b=

est

> available funding options tailored to your needs.**

>

> =20

>

>

> **If you have any questions or would prefer to speak directly, feel free =

to

> call me at +1-866-216-5475 or 873-771-7630**

>

> =20

>

>

> **Looking forward to connecting.**

>

> =20

>

>

> **Best regards, =20

> **

>

> =20

>

>

> **Lilian Llanillo**

>

> **FUNDING ADVISOR**

>

> =20

>

>

> ![email $16px$.png](https://closeio-

> filepicker.s3.amazonaws.com/2026-05-14%2F1RDDVOgmo8WoImXFkS0Dtk%2F1778774=

039066-email+%2816px%29.png)****[**lilian@kesefmarketing.com**](https://lil=

ian@kesefmarketing.com)

>

> ![phone-call $16px$.png](https://closeio-

> filepicker.s3.amazonaws.com/2026-05-14%2F1RDDVOgmo8WoImXFkS0Dtk%2F1778774=

137354-phone-

> call+%2816px%29.png)**+1 (873) 771-7630**

>

> **____________________________**

>

> ![IMG_5340.jpg](https://closeio-

> filepicker.s3.amazonaws.com/2026-05-14%2F1RDDVOgmo8WoImXFkS0Dtk%2F1778774=

165068-IMG_5340.jpg)

>

> =20

>

>

> To stop receiving these emails, click

> [here](https://app.close.com/go/unsubscribe/orga_WJQdcK5MUUa02rLIty6GVDni=

l9kHSKU8WElV6ueTPiF/sales%40nk.ca/GK6U1JDQJSfaf6

> --tg9gajA9HdvShNSyH_DgbhmTyc8=3D/).

--===============6079678544044073755==

Content-Type: text/html; charset="utf-8"

MIME-Version: 1.0

Content-Transfer-Encoding: quoted-printable

Hi Gurkirat,

W=

e noticed your Cash Advance application is still incomplete.

You=E2=80=99re just a few steps away from secur=

ing up to $800,000 in funding within 48 hours.

To move forward, please complete your application here:

strong>

id=3Dlead_1MVGGnNXqVx8dbGrHgSfKaWzWuBT6yMLDjaGHIpxaD3&legalBusiness=3DN=

K MAINTENANCE&fullName[first]=3DGurkirat&fullName[last]=3DWirring&=

amp;leadType=3DAutomation" rel=3D"noopener noreferrer nofollow">Cli=

ck to Start your Application here

rong>and upload your last 3 months of bank statements. This will allow us t=

o finalize your review and match you with the best available funding option=

s.

If you have any questions or w=

ould prefer to speak directly, feel free to call me at +1-866-216-5475 or 8=

73-771-7630

Best regards,

ont-weight: 700;">Lilian Llanillo

tyle=3D"font-weight: 700; color: rgb(57, 208, 150);">FUNDING ADVISOR=

3.amazonaws.com/2026-05-14%2F1RDDVOgmo8WoImXFkS0Dtk%2F1778774039066-email+%=

2816px%29.png" alt=3D"email (16px).png">
700;">
et=3D"_blank" rel=3D"noopener noreferrer nofollow">
ont-weight: 700;">lilian@kesefmarketing.com

<=

img src=3D"https://closeio-filepicker.s3.amazonaws.com/2026-05-14%2F1RDDVOg=

mo8WoImXFkS0Dtk%2F1778774137354-phone-call+%2816px%29.png" alt=3D"phone-cal=

l (16px).png"> +1 (873) 771-7630<=

/span>

_______=

_____________________

-filepicker.s3.amazonaws.com/2026-05-14%2F1RDDVOgmo8WoImXFkS0Dtk%2F17787741=

65068-IMG_5340.jpg" alt=3D"IMG_5340.jpg" style=3D"width: 159px; height: 64.=

1129px;">

ribe-footer">

To stop receiv=

ing these emails, click
a_WJQdcK5MUUa02rLIty6GVDnil9kHSKU8WElV6ueTPiF/sales%40nk.ca/GK6U1JDQJSfaf6-=

-tg9gajA9HdvShNSyH_DgbhmTyc8=3D/" target=3D"_blank" rel=3D"noopener norefer=

rer nofollow">here.

ed-text">

On Aug 11, 2026, at 09:49 AM, Lilian Llanillo <lilian@k=

esefmarketing.com> wrote:

Hi G=

urkirat,

This is Lilian Llanillo =

from Kesef Marketing.

Welcome! I =

wanted to personally reach out and thank you for your interest in business =

funding. We work with lenders across Canada to provide reliable funding sol=

utions that support growth, manage cash flow, and cover upcoming expenses=

=E2=80=94while helping you access competitive interest rates.
>

If you=E2=80=99re open to exploring your optio=

ns, you can get started here:

om/260672364104452?lead_id=3Dlead_1MVGGnNXqVx8dbGrHgSfKaWzWuBT6yMLDjaGHIpxa=

D3&legalBusiness=3DN K MAINTENANCE&fullName[first]=3DGurkirat&f=

ullName[last]=3DWirring&leadType=3DAutomation" rel=3D"noopener noreferr=

er nofollow">Click Here To Start Your Application
>
Once submitted, our team will review your information and pre=

sent the best available funding options tailored to your needs.
iv>

If you have any questions or would prefer to=

speak directly, feel free to call me at +1-866-216-5475 or 873-771-7630
trong>

Looking forward to connecting.
ong>

Best regards,

data-system-generated=3D"signature">

eight: 700;">Lilian Llanillo

=3D"font-weight: 700; color: rgb(57, 208, 150);">FUNDING ADVISOR
rong>

azonaws.com/2026-05-14%2F1RDDVOgmo8WoImXFkS0Dtk%2F1778774039066-email+%2816=

px%29.png" alt=3D"email (16px).png">
;">
=3D"_blank" rel=3D"noopener noreferrer nofollow">
t-weight: 700;">lilian@kesefmarketing.com

g src=3D"https://closeio-filepicker.s3.amazonaws.com/2026-05-14%2F1RDDVOgmo=

8WoImXFkS0Dtk%2F1778774137354-phone-call+%2816px%29.png" alt=3D"phone-call =

(16px).png"> +1 (873) 771-7630
pan>
_________=

___________________

ilepicker.s3.amazonaws.com/2026-05-14%2F1RDDVOgmo8WoImXFkS0Dtk%2F1778774165=

068-IMG_5340.jpg" alt=3D"IMG_5340.jpg" style=3D"width: 159px; height: 64.11=

29px;">

be-footer">
To stop receivin=

g these emails, click
WJQdcK5MUUa02rLIty6GVDnil9kHSKU8WElV6ueTPiF/sales%40nk.ca/GK6U1JDQJSfaf6--t=

g9gajA9HdvShNSyH_DgbhmTyc8=3D/" target=3D"_blank" rel=3D"noopener noreferre=

r nofollow">here.

://ml.closeml.com/t/nk8LpFsOBhJSXuOowoxSS5NguctysG6eZdZgsfW6yYW/YVFsbTnwSw.=

png" alt=3D"" width=3D"1" height=3D"1" />

--===============6079678544044073755==--

--===============7946878310728263274==--

Categories: Google Gmail Spam, Phish

0 Comments

Charity donation spam from Google Gmail
Posted by Dave Yadallee on Wednesday, August 12. 2026

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Wed, 12 Aug 2026 14:58:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.5 (FreeBSD))

(envelope-from )

id 1wuG0b-000000006hr-3kqP

for dave@doctor.nl2k.ab.ca;

Wed, 12 Aug 2026 14:57:09 -0600

Resent-From: The Doctor

Resent-Date: Wed, 12 Aug 2026 14:57:09 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-oo1-f43.google.com ([209.85.161.43]:44210)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.99.5 (FreeBSD))

(envelope-from )

id 1wuDtw-000000008wZ-3cYs

for bin@nl2k.ab.ca;

Wed, 12 Aug 2026 12:42:17 -0600

Received: by mail-oo1-f43.google.com with SMTP id 006d021491bc7-6a168dc590cso1061657eaf.0

for ; Wed, 12 Aug 2026 11:41:21 -0700 (PDT)

ARC-Seal: i=1; a=rsa-sha256; t=1786560075; cv=none;

d=google.com; s=arc-20260327;

b=ojh/dmeC/zE/1v2xPiZ910wq3lSSgwQaHOpvdEtUzfNo1DAKIIV7ksZqBjTmy3WDcs

NTZq4XZ86BMrbAZzeQdkvU9Sc9uVpo27q3N953eUSCrl480psPBd/8H2rEPxkwV4nazg

2KvbkeCK56DpqXJWTSc5S3UKVEQkqUCEs/GYTowh5nScCKoquq/paEt1EkjTu7snuF28

u8fmsmH4AoMsePED9Qp78T8zL/0RgnA4MqDBlIGGVsn6tIswPiuT1TQWYwZp9de99gv7

beZz6QO1yKVPQKnbQUH7E8Qsmd6jw2nykWgGa46Yg+h2Z7Vr+qbfLJNzpaxhJWu1cOQR

fIlg==

ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20260327;

h=to:subject:message-id:date:from:reply-to:mime-version

:dkim-signature;

bh=sCEQzu8upI9ZeYLWO1+SO/xtyTcIxNZesGTV7nuZiic=;

fh=Q/dGJ/Cv89OtrXCiLLKR7ggGXIAbJq64SMOAMdngurI=;

b=kyr6BhhjNF+qP3WR1cJz7+8M6c1e6rSYlXKE+36S3ZGc3Mnl523uLMm0Mtv4TnxA0R

8ukXwB9Hr2egUzLzwVHtzs1TN5PAw6E+xh+JOtn53xcaOFB8uivvjCMT6qfIXkgn7WgA

u65zTAXqNE6D0bF9F+XUGNch5892Fra5kEAXv7MV6u6VkIQEpskoQGxJb+lY9NpAb0wb

rvtgb8ohzv3JeH7pi8UYF/AYzaRyqa6UAeN31cIt4tqFu1TmcZ0HKPnZ3Qtg0iBmUzbb

yhR4tpweGVzfKw9V1Fq4MrQeV/kf22CSAXmHtcCCh7BqLI0rqAn0/gyFVQGjrPdYiF7v

eXFw==;

darn=nl2k.ab.ca

ARC-Authentication-Results: i=1; mx.google.com; arc=none

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=jisuniversity.ac.in; s=google; t=1786560075; x=1787164875; darn=nl2k.ab.ca;

h=content-type:to:subject:message-id:date:from:reply-to:mime-version

:from:to:cc:subject:date:message-id:reply-to:content-type;

bh=sCEQzu8upI9ZeYLWO1+SO/xtyTcIxNZesGTV7nuZiic=;

b=U3MeQaTAUTVs/zsdNrp8sDCiMkp7UaTOgmX2VJZeU4fhGWYKltbOkRvF8Z7quVQEI3

IRE/mCdGusx0X9c0B8U9kDH2TSq2uju3UNVOpXBFmAQEsOICTwYaGe1j9xL5H/CMvzF+

StSTCnnke6XFHzfvXpPZLuXWddeBcUo47V8nRdZZkCAQFB50R9Sv75obALlqdNLOi2r7

+6tk90ydvbtFPeXAAGpe0nlGwOTxw/hstC9Nh9zibZ7W1TMoBa58JqiVMWO7GE2MMh2T

+q8Ond5U8G+GqQAX9F+3gDT8eIiK6eZtRqDYQrCuOd+7ZPffqGChLxZY/rk/h39jnXMk

9tDA==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20251104; t=1786560075; x=1787164875;

h=content-type:to:subject:message-id:date:from:reply-to:mime-version

:x-gm-gg:x-gm-message-state:from:to:cc:subject:date:message-id

:reply-to:content-type;

bh=sCEQzu8upI9ZeYLWO1+SO/xtyTcIxNZesGTV7nuZiic=;

b=bs+nSTKPM7AWEYpymJjI1kNhihDKrGgHf9xMwasR7U5jzhx0ZSf5xFEZD/wwJbUtTx

fz7RrPZEmP7msfgUEJ3sWUHYLDXyij/JoLqyv9bTysY2VNJn3BMNb8oXDYVt7wM1V5AC

kPnP6Q+baHQ7vucqqylsrQF4jIVPhC0Y65nEnW8Y0hdDRhIjHM82IW6o6krFF2PeEGMn

lDRWb353Db+tvKPDiC1KnREJl0ErcdK7RzQVZZ2pokGZfjN9ADBM1C5L3ZcN8w3e5aWr

ENxA4D9AOSyq24RiWhNACd2Iy+Lq0Mt9qDbHy4AhChlMQTkzwLYO2bRLZyIhh/0xliIQ

w38w==

X-Forwarded-Encrypted: i=1; AHgh+RpfbEhYGtZauJlTjnR4sN1kyTeYxGA5ZnyZK0MYNeCV1RfAfsod5d05qnDqg88ualMN+xQ=@nl2k.ab.ca

X-Gm-Message-State: AOJu0Yx0JFr/4RtFSm4rxsVMnbs0q4ntc/fYvopI7VYhgB3ZbUg0T6Ij

vIpcLej6q/7MqOHBW4nfUKW6HRCUuIRkcJeLoOhidRAAIcHIF0H83fUtW/Oe6zdcqbcqqS7LaG9

yqLVzRswL4GSjez2Tt0BR5a8R3J4xi4yPbFebQs2Ueg==

X-Gm-Gg: AR+sD11/3pInu6WrEdjTNQJHfLLTSD35Mc/4aVp1sgfD5w5z5j1UuuzCwvnDfNux3Ks

x+TRNIUI4qe42yermMNCtdGaiRbaMfB9WeG9tmd81EQGvfOPnm7OPAG5nLzGiyPEfR1Hb9Mv9GQ

QX4ErxKEB+TFyHQq29knHCpce3Jm9Jdvl+jaTWSWH3njoCbfy6Og1nSjIbmvIQORYMnJd4M0JTv

zYjN86XvBCpdUYWFbXbXKK/WVL3t3pc4r81M3FZbdzSD1X/PmJzYcQ2omIhIG+iYLylsZuOstaO

twNWrN0kN5MK8UpWwWY4KR4/K8u1ka+uCyxRMBTr73c5L6TWRHCWSciaCVu8h+Pk6wy0+PDw9CF

bOA==

X-Received: by 2002:a05:6820:8c9:b0:6a1:44aa:86ce with SMTP id

006d021491bc7-6b0c435bc25mr501805eaf.22.1786560074541; Wed, 12 Aug 2026

11:41:14 -0700 (PDT)

MIME-Version: 1.0

Reply-To: santiagodiannahmeed@gmail.com

From: Diann Ahmed Santiago

Date: Wed, 12 Aug 2026 19:41:02 +0100

X-Gm-Features: AUfX_mwI6FZqwYJDSL5F64IXpeFztPNffmEl5X3tDqkYeAL4Slc2dFRjN1Xqii8

Message-ID:

Subject: CHARITY DONATION

To: undisclosed-recipients:;

Content-Type: multipart/alternative; boundary="0000000000009cfc0a0658ddee7c"

Bcc: bin@nl2k.ab.ca

X-Spam_score: 16.8

X-Spam_score_int: 168

X-Spam_bar: ++++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.

Content preview: -- Dear Beloved as a formal introduction I'm Diann Ahmed Santiago

an Indonesia citizens, I'm in the hospital undergoing serious treatment for

Esophageal cancer. I was recently transferred from the Jam [...]

Content analysis details: (16.8 points, 5.0 required)

pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[209.85.161.43 listed in will-spam-for-food.eu.org]

[209.85.161.43 listed in will-spam-for-food.eu.org]

[209.85.161.43 listed in will-spam-for-food.eu.org]

[209.85.161.43 listed in will-spam-for-food.eu.org]

[209.85.161.43 listed in will-spam-for-food.eu.org]

[209.85.161.43 listed in will-spam-for-food.eu.org]

[209.85.161.43 listed in will-spam-for-food.eu.org]

[209.85.161.43 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[209.85.161.43 listed in dnsbl.ahbl.org]

[209.85.161.43 listed in dnsbl.ahbl.org]

[209.85.161.43 listed in dnsbl.ahbl.org]

[209.85.161.43 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[209.85.161.43 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[209.85.161.43 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[209.85.161.43 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[209.85.161.43 listed in dnsbl.ahbl.org]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[209.85.161.43 listed in list.dnswl.org]

-0.0 SPF_PASS SPF: sender matches SPF record

1.5 GR_DOMAIN_UNDISC1 To contains undisclosed recipient (undisc)

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

1.6 SUBJ_ALL_CAPS Subject is all capitals

-0.0 RCVD_IN_MSPIKE_H3 RBL: Good reputation (+3)

[209.85.161.43 listed in wl.mailspike.net]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[209.85.161.43 listed in bl.score.senderscore.com]

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 HTML_MESSAGE BODY: HTML included in message

-0.0 RCVD_IN_MSPIKE_WL Mailspike good senders

1.0 FREEMAIL_REPLYTO Reply-To/From or Reply-To/body contain different

freemails

0.0 LOTS_OF_MONEY Huge... sums of money

2.5 FREEMAIL_FORGED_REPLYTO Freemail in Reply-To, but not From

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

0.0 MONEY_FREEMAIL_REPTO Lots of money from someone using free email?

2.9 UNDISC_FREEM Undisclosed recipients + freemail reply-to

2.4 UNDISC_MONEY Undisclosed recipients + money/fraud signs

0.0 MONEY_FRAUD_5 Lots of money and many fraud phrases

3.6 ADVANCE_FEE_3_NEW_MONEY Advance Fee fraud and lots of money

Subject: {SPAM?} CHARITY DONATION

--0000000000009cfc0a0658ddee7c

Content-Type: text/plain; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable

--=20

Dear Beloved as a formal introduction I'm Diann Ahmed Santiago an Indonesia

citizens, I'm in the hospital undergoing serious treatment for

Esophageal cancer. I was recently transferred from the James OSU Cancer

Centre

in Columbus Ohio United States of America to United Kingdom. I

have since lost my ability to talk and my Doctors have told me that I

have only a few months to live, due to my serious illness, I, therefore,

seize this opportunity to

notify you that I Diann Ahmed Santiago have decided to make you a

beneficiary to my ''WILL'' which based on my personal visit & search

in the export promotion council from the internet where your details

was well convinced to me of you been a reliable and trustworthy

fellow, I want you to assure me that you will not betray nor

disappoint my trust in you at the end of the transaction.

My Beloved, I and my late husband left the sum of Ten Million

Pounds (=C2=A310,000,000.00) in two trunks of metal boxes with

a security company as family valuables. I know this might sound

unbelievable to you, but I

tell you it's real and true.

I have decided to do this based on my short notice and limited time

state by my doctors, I decided in my mind that I should give this

resources to you, where I desire that you help take good care of

the needy ones in your country or around your region, such as

motherless baby's homes, widows, hurricane victims, and churches...Note

also, that before my illness. I have been carrying out the assignment

similar to this project just after the death of my husband.

As soon as I know your readiness to work and help me on this issue, I

shall provide the security company contact information for you to be sworn

into action.

You are humbly advised to contact me through my email

address as santiagodiannahmed@gmail.com

Remain Blessed,

Diann Ahmed Santiago

santiagodiannahmed@gmail.com

--0000000000009cfc0a0658ddee7c

Content-Type: text/html; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable

"gmail_signature_prefix">--

ature" data-smartmail=3D"gmail_signature">
Dear Beloved as =

a formal introduction I'm Diann Ahmed Santiago an Indonesia
citizens=

, I'm in the hospital undergoing serious treatment for
Esophageal ca=

ncer. I was recently transferred from the James OSU Cancer Centre
in Co=

lumbus Ohio United States of America to United Kingdom. I
have since los=

t my ability to talk and my Doctors have told me that I
have only a few =

months to live, due to my serious illness, I, therefore,
seize this opp=

ortunity to
notify you that I Diann Ahmed Santiago have decided to make =

you a
beneficiary to my ''WILL'' which based on my perso=

nal visit & search
in the export promotion council from the internet=

where your details
was well convinced to me of you been a reliable and =

trustworthy
fellow, I want you to assure me that you will not betray nor=

disappoint my trust in you at the end of the transaction.

My Bel=

oved, I and my late husband left the sum of Ten Million
Pounds (=C2=A310=

,000,000.00) in two trunks of metal boxes with
a security company as fam=

ily valuables. I know this might sound unbelievable to you, but I
tell y=

ou it's real and true.

I have decided to do this based on my sho=

rt notice and limited time
state by my doctors, I decided in my mind tha=

t I should give this
resources to you, where I desire that you help take=

good care of
the needy ones in your country or around your region, such=

as
motherless baby's homes, widows, hurricane victims, and churches=

...Note
also, that before my illness. I have been carrying out the assig=

nment
similar to this project just after the death of my husband.

>As soon as I know your readiness to work and help me on this issue, I
s=

hall provide the security company contact information for you to be sworn i=

nto action.
You are humbly advised to contact me through my email
add=

ress as s=

antiagodiannahmed@gmail.com

Remain Blessed,
Diann Ahmed Santi=

ago
sa=

ntiagodiannahmed@gmail.com

--0000000000009cfc0a0658ddee7c--

Categories: Google Gmail Spam

0 Comments

Intelcom Phish
Posted by Dave Yadallee on Wednesday, August 12. 2026

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Wed, 12 Aug 2026 14:57:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.5 (FreeBSD))

(envelope-from )

id 1wuG0Q-000000006fp-0KQJ

for dave@doctor.nl2k.ab.ca;

Wed, 12 Aug 2026 14:56:58 -0600

Resent-From: The Doctor

Resent-Date: Wed, 12 Aug 2026 14:56:57 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from vps.fslocal.com ([199.83.208.249]:46158)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.99.5 (FreeBSD))

(envelope-from )

id 1wuDSa-00000000LyF-32zb

for sales@nk.ca;

Wed, 12 Aug 2026 12:14:03 -0600

DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed;

d=laravel.perksona.com; s=default; h=MIME-Version:Date:

Content-Transfer-Encoding:Message-ID:Subject:To:From:Content-Type:Sender:

Reply-To:Cc:Content-ID:Content-Description:Resent-Date:Resent-From:

Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:In-Reply-To:References:

List-Id:List-Help:List-Unsubscribe:List-Subscribe:List-Post:List-Owner:

List-Archive; bh=/McdDXbMdaxgJ6ulkQo9xWuZbF1iRwDyuEIZ8YTRZOw=; b=c0AQULgFqBX3

E/f6D40isL5BFbq2sNZXCyf0RFBrJm1ah0zlCfAaKy3ADil+Q3diWsVbEeC/7Oadm9YRi9+fAjXBH

A2JaFl6Y9JNiYNM4S+8XZ6LGds+bG9AcTfOe7LHIfCxkF7krx7MVGQqYYjxYvqSu4VwCLgBQ6n1BK

q4XZh6vj/jfRU8BLiV17i0g2b8pMWHftBot+ye6tPIC2x1sobGVR9fZQnK28n7vmJxMhegQiM7Ald

g3hN9ibQ+Uk6eD6OOfL4kd2gZ1hPDVOrwTEmlfSBXvvqg4QuRpBesIZsTJI89smXQ4LJ5H9KAMIPO

mxibc/TvAwe2fDrT6rHGWg==;

Received: from [196.75.231.148] (port=62198 helo=[127.0.0.1])

by vps.fslocal.com with esmtpsa (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.99.5)

(envelope-from )

id 1wuDRO-00000001uhm-3xBU

for sales@nk.ca;

Wed, 12 Aug 2026 14:12:59 -0400

Content-Type: text/html

From: Intelcom

To: sales@nk.ca

Subject: Intelcom Delivery Notification

Message-ID: <1b29bfb9-63f1-28aa-b050-5822b1aaa86b@laravel.perksona.com>

Content-Transfer-Encoding: quoted-printable

Date: Wed, 12 Aug 2026 18:12:35 +0000

MIME-Version: 1.0

X-AntiAbuse: This header was added to track abuse, please include it with any abuse report

X-AntiAbuse: Primary Hostname - vps.fslocal.com

X-AntiAbuse: Original Domain - nk.ca

X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12]

X-AntiAbuse: Sender Address Domain - laravel.perksona.com

X-Get-Message-Sender-Via: vps.fslocal.com: authenticated_id: info-mjqu@laravel.perksona.com

X-Authenticated-Sender: vps.fslocal.com: info-mjqu@laravel.perksona.com

X-Source:

X-Source-Args:

X-Source-Dir:

X-Spam_score: 6.2

X-Spam_score_int: 62

X-Spam_bar: ++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.

Content preview: Intelcom Delivery Update

Content analysis details: (6.2 points, 5.0 required)

pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[196.75.231.148 listed in dnsbl.ahbl.org]

[196.75.231.148 listed in dnsbl.ahbl.org]

[196.75.231.148 listed in dnsbl.ahbl.org]

[196.75.231.148 listed in dnsbl.ahbl.org]

[199.83.208.249 listed in dnsbl.ahbl.org]

[199.83.208.249 listed in dnsbl.ahbl.org]

[199.83.208.249 listed in dnsbl.ahbl.org]

[199.83.208.249 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[196.75.231.148 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[196.75.231.148 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[196.75.231.148 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[196.75.231.148 listed in dnsbl.ahbl.org]

-0.0 SPF_PASS SPF: sender matches SPF record

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[199.83.208.249 listed in bl.score.senderscore.com]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[196.75.231.148 listed in will-spam-for-food.eu.org]

[196.75.231.148 listed in will-spam-for-food.eu.org]

[196.75.231.148 listed in will-spam-for-food.eu.org]

[196.75.231.148 listed in will-spam-for-food.eu.org]

[196.75.231.148 listed in will-spam-for-food.eu.org]

[196.75.231.148 listed in will-spam-for-food.eu.org]

[196.75.231.148 listed in will-spam-for-food.eu.org]

[196.75.231.148 listed in will-spam-for-food.eu.org]

[199.83.208.249 listed in will-spam-for-food.eu.org]

[199.83.208.249 listed in will-spam-for-food.eu.org]

[199.83.208.249 listed in will-spam-for-food.eu.org]

[199.83.208.249 listed in will-spam-for-food.eu.org]

[199.83.208.249 listed in will-spam-for-food.eu.org]

[199.83.208.249 listed in will-spam-for-food.eu.org]

[199.83.208.249 listed in will-spam-for-food.eu.org]

[199.83.208.249 listed in will-spam-for-food.eu.org]

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 HTML_MESSAGE BODY: HTML included in message

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

1.0 VOWEL_URI_5 URI hostname with 5 consecutive vowels

2.0 RATWR8_MESSID Message-ID with excessive dashes and dollars

0.8 SARE_FROM_SPAM_WORD3 I don't know people named this!

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

Subject: {SPAM?} Intelcom Delivery Notification

MARGIN: 30px auto; border-radius: 10px; box-shadow: 0 4px 10px rgba(0,0,0,0=

.08)">

center; PADDING-TOP: 20px; PADDING-LEFT: 20px; PADDING-RIGHT: 20px">

Intelcom

TEXT-ALIGN: center; PADDING-TOP: 30px; PADDING-LEFT: 30px; PADDING-RIGHT: =

30px">

Delivery Update

Your package is currently being processed and =

requires a small fee for customs handling.

18px; FONT-WEIGHT: bold; COLOR: #04ab94">Amount due: 2.96 CAD

Please confirm your delivery =

details to ensure a smooth delivery experience.

org/Intelcom/Contactez-support-Intelcom.ca/" style=3D"TEXT-DECORATION: =

none; BACKGROUND: #04ab94; MARGIN-TOP: 20px; FONT-WEIGHT: bold; COLOR: =

#ffffff; PADDING-BOTTOM: 12px; PADDING-TOP: 12px; PADDING-LEFT: 25px; =

DISPLAY: inline-block; PADDING-RIGHT: 25px; border-radius: 6px">Manage My =

Delivery

BACKGROUND: #f1f1f1; COLOR: #888; PADDING-BOTTOM: 20px; TEXT-ALIGN: center;=

PADDING-TOP: 20px; PADDING-LEFT: 20px; PADDING-RIGHT: 20px">

This is an automated message. Please do not reply.=

© 2026 Intelcom Express

Categories: Phish

0 Comments

Wealthsimple Phish from Google
Posted by Dave Yadallee on Wednesday, August 12. 2026

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Wed, 12 Aug 2026 14:57:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.5 (FreeBSD))

(envelope-from )

id 1wuG0J-000000006em-127C

for dave@doctor.nl2k.ab.ca;

Wed, 12 Aug 2026 14:56:51 -0600

Resent-From: The Doctor

Resent-Date: Wed, 12 Aug 2026 14:56:51 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from weall04.weiyuzhishiw.com ([35.217.83.89]:51393)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.99.5 (FreeBSD))

(envelope-from )

id 1wuD5v-000000009Kn-2wBf

for doctor@nk.ca;

Wed, 12 Aug 2026 11:50:35 -0600

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; s=default; d=weall04.weiyuzhishiw.com;

h=Content-Type:MIME-Version:From:To:Subject:Date:Message-ID;

i=UOVDZS@weall04.weiyuzhishiw.com;

bh=+uJBQiwcPS9ZW9Qp2u2m1mf4t9zqzQ9e3ZuBAlKBz6I=;

b=isUQmnm8uQz+fOPGBsjMnhcm9hAR0RhASwqSbZh8jU++z0z7Zl9IexGSSMbc6HC/lSCNHZNzQNSZ

Tobb8bL1NdWqcfr4aSYHdBqgzXHSwSK5fCBiEYBW1n//NijLJTgI/cb4kPF3izGHzxW0ukQn6H4w

61oQolEuOnLDQn0nuVtGJ9B4eATI81jlj5JpPPtzZnjM9hSQ2VAq23e7W1RH8KFbV4zOoDpltK/V

cy07Lj/pbWdoa4MRBLD26f9l5ZpwyM5Ogap8JhkaEcWalK6AW1RQ6c9BVNwnxjP1V/2h5PO+REsm

WIcbM3MU6hvybFSgkkoOIZy7a2tNG5gii2sm+w==

Content-Type: multipart/alternative;

boundary="===============8869485953320447085=="

MIME-Version: 1.0

From:

=?utf-8?b?V+KAi2XigIth4oCLbOKAi3TigIto4oCLc+KAi2nigItt4oCLcOKAi2zigItl4oCLIOKAi0PigIts4oCLaeKAi2XigItu4oCLdOKAiyDigItT4oCLdeKAi3DigItw4oCLb+KAi3LigIt0?=

To: doctor@nk.ca

Subject: =?utf-8?q?Transfer_Pause_in_Effect_=E2=80=94_Verify_Your_Identity_T?=

=?utf-8?q?oday_-_Suspension_de_transfert_en_vigueur_=E2=80=94_Verifiez_votr?=

=?utf-8?q?e_identite_aujourdhui?=

Date: Wed, 12 Aug 2026 13:49:39 -0400

Message-ID: <178655697959.3782.14659689807189522119@weall04.weiyuzhishiw.com>

X-Spam_score: 12.1

X-Spam_score_int: 121

X-Spam_bar: ++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.

Content preview: TRANSFERS CURRENTLY PAUSED â€” ACTION REQUIRED Transfer Pause

in Effect â€” Verify Your Identity Today ================================================================

Content analysis details: (12.1 points, 5.0 required)

pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[35.217.83.89 listed in will-spam-for-food.eu.org]

[35.217.83.89 listed in will-spam-for-food.eu.org]

[35.217.83.89 listed in will-spam-for-food.eu.org]

[35.217.83.89 listed in will-spam-for-food.eu.org]

[35.217.83.89 listed in will-spam-for-food.eu.org]

[35.217.83.89 listed in will-spam-for-food.eu.org]

[35.217.83.89 listed in will-spam-for-food.eu.org]

[35.217.83.89 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[35.217.83.89 listed in dnsbl.ahbl.org]

[35.217.83.89 listed in dnsbl.ahbl.org]

[35.217.83.89 listed in dnsbl.ahbl.org]

[35.217.83.89 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[35.217.83.89 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[35.217.83.89 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[35.217.83.89 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[35.217.83.89 listed in dnsbl.ahbl.org]

2.5 URIBL_DBL_SPAM Contains a spam URL listed in the DBL blocklist

[URI: npclw.com]

[URI: hqkjweb.com]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-0.0 SPF_HELO_PASS SPF: HELO matches SPF record

-0.0 SPF_PASS SPF: sender matches SPF record

-0.0 T_RP_MATCHES_RCVD Envelope sender domain matches handover relay

domain

1.9 URIBL_ABUSE_SURBL Contains an URL listed in the ABUSE SURBL blocklist

[URI: login.hqkjweb.com]

[URI: login.npclw.com]

1.9 URIBL_JP_SURBL Contains an URL listed in the JP SURBL blocklist

[URI: npclw.com]

[URI: hqkjweb.com]

0.0 URIBL_PH_SURBL Contains an URL listed in the PH SURBL blocklist

[URI: npclw.com]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[35.217.83.89 listed in bl.score.senderscore.com]

1.5 MR_STRANGE_QUESTION URI: No description available.

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

1.0 VOWEL_URI_5 URI hostname with 5 consecutive vowels

1.0 ACCT_PHISHING Possible phishing for account information

0.9 URI_PHISH Phishing using web form

Subject: {SPAM?} =?utf-8?q?Transfer_Pause_in_Effect_=E2=80=94_Verify_Your_Identity_T?=

=?utf-8?q?oday_-_Suspension_de_transfert_en_vigueur_=E2=80=94_Verifiez_votr?=

=?utf-8?q?e_identite_aujourdhui?=

Categories: Google Gmail Spam, Phish

0 Comments

chinese products spam
Posted by Dave Yadallee on Wednesday, August 12. 2026

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Wed, 12 Aug 2026 10:09:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.5 (FreeBSD))

(envelope-from )

id 1wuBUq-00000000NWp-164A

for dave@doctor.nl2k.ab.ca;

Wed, 12 Aug 2026 10:08:04 -0600

Resent-From: The Doctor

Resent-Date: Wed, 12 Aug 2026 10:08:04 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from static30-154.uszonea.dm.aliyun.com ([8.221.30.154]:28172)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.99.5 (FreeBSD))

(envelope-from )

id 1wuBPD-00000000MPw-1Nwr

for doctor@nl2k.ab.ca;

Wed, 12 Aug 2026 10:02:25 -0600

X-AliDM-RcptTo: ZG9jdG9yQG5sMmsuYWIuY2E=

Feedback-ID: default:trumsense-mirrorswitch@chinasmartsensor.cn:vip_dmx_DmxBatch:521943

DKIM-Signature:v=1; a=rsa-sha256; c=relaxed/relaxed;

d=chinasmartsensor.cn; s=mailbee-cn-1f0b3f2;

t=1786550477; h=List-Unsubscribe-Post:List-Unsubscribe:Date:From:To:Message-ID:Subject:MIME-Version:Content-Type;

bh=AyqVZ7Q3Cu/yzlcUrKPBvBGjAJ2z3QkLxu0gom4eRJQ=;

b=K2hE0ciZR0x4op7HACik1SjAttBdiPDFMlcwbjq8E7885S7HAIJ8xkUQAiD4nLV8HXYAUzmD6NGXVbwOOTriGriqlMiQ2UvN5UqNEK1gu4E/Z96JcZLsnsKU5eklbFGj9Yinhg+8nH59bVoRgdmynoiD3+r19OVgYEZvputZJPYUoKPr3jLbzUVANNgZWPbuf009YGlXLPzyF9JnX/rJzZCQHSXM2PIedTSYZC0tj8ia7heeF21VTOHdrn5NjkiSvd3jnyo4raR9TBmLA156jPZQdCGHxzvoD/6b7bjuXR86/phBb+O0woV04OX8Vd/ZrUclNJtrobzUrmIjj0P4wQ==

DKIM-Signature:v=1; a=rsa-sha256; c=relaxed/relaxed;

d=dm-fbl.aliyuncs.com; s=feedback;

t=1786550477; h=List-Unsubscribe-Post:List-Unsubscribe:Date:From:To:Message-ID:Subject:MIME-Version:Content-Type;

bh=AyqVZ7Q3Cu/yzlcUrKPBvBGjAJ2z3QkLxu0gom4eRJQ=;

b=NELkXzAv/aKUGkGeWxTShK+htTY7329Ymk07JYUvJbTvIZG1DfHPUJOT+I4N8Uv29F8X/1G6qg9UnmhI0xuE755cdsxLC6i0Q4d4NzuUqH5jg9PF0yVCFxuKwhaJfUbd8qVsziQ/0HMEh4+DYT3PQLo/OAos1rHnlCgpesbURK4=

List-Unsubscribe-Post: List-Unsubscribe=One-Click

List-Unsubscribe:

Received: from chitu-hsf(mailfrom:trumsense-mirrorswitch@chinasmartsensor.cn fp:metaq-uuid-f34310f9-132a-4f6a-b300-85a64c76b08c cluster:AY35D)

by smtp.aliyun-inc.com(127.0.0.1);

Thu, 13 Aug 2026 00:01:17 +0800

Date: Thu, 13 Aug 2026 00:01:17 +0800

From: "LED Mirror Touch Switch"

To:

Reply-To: "ledmirror-touchswitch@trumsense.com"

Message-ID: <624b5c9d-716e-4927-bbfd-d27e7ad3a956@alibaba.com>

Subject: =?UTF-8?B?UmU6IFImRCBzdXBwb3J0IGZvciB5b3VyIG5ldyBtaXJyb3Igc2VyaWVz?=

X-Priority: 3

MIME-Version: 1.0

X-EnvId: 600000347503892566

X-AliDM-Settings: eyJPdXRib3VuZElwIjp7IklwTGlzdCI6W10sIklwUG9vbElkIjoiNDBkODFhOGEtMDM2Mi00ZWMxLWIzMzQtNzQzZWZjZmJmNTU2In0sIlVuc3Vic2NyaWJlIjp7IkZpbHRlckxldmVsIjoiZGVmYXVsdCIsIkxpbmtUeXBlIjoiZGVmYXVsdCJ9LCJWZXJzaW9uIjoiMS4wIn0=

Content-Type: text/html; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable

X-Spam_score: 7.2

X-Spam_score_int: 72

X-Spam_bar: +++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.

Content preview: Hi, Working directly with our factory eliminates extra costs

and speeds up delivery.

Content analysis details: (7.2 points, 5.0 required)

pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[8.221.30.154 listed in will-spam-for-food.eu.org]

[8.221.30.154 listed in will-spam-for-food.eu.org]

[8.221.30.154 listed in will-spam-for-food.eu.org]

[8.221.30.154 listed in will-spam-for-food.eu.org]

[8.221.30.154 listed in will-spam-for-food.eu.org]

[8.221.30.154 listed in will-spam-for-food.eu.org]

[8.221.30.154 listed in will-spam-for-food.eu.org]

[8.221.30.154 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[8.221.30.154 listed in dnsbl.ahbl.org]

[8.221.30.154 listed in dnsbl.ahbl.org]

[8.221.30.154 listed in dnsbl.ahbl.org]

[8.221.30.154 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[8.221.30.154 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[8.221.30.154 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[8.221.30.154 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[8.221.30.154 listed in dnsbl.ahbl.org]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[8.221.30.154 listed in bl.score.senderscore.com]

-0.0 SPF_PASS SPF: sender matches SPF record

0.2 CK_HELO_GENERIC Relay used name indicative of a Dynamic Pool or

Generic rPTR

0.6 J_CHICKENPOX_45 BODY: 4alpha-pock-5alpha

0.6 J_CHICKENPOX_82 BODY: 8alpha-pock-2alpha

0.7 HTML_IMAGE_ONLY_28 BODY: HTML: images with 2400-2800 bytes of words

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 HTML_MESSAGE BODY: HTML included in message

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 MIME_QP_LONG_LINE RAW: Quoted-printable line longer than 76 chars

2.0 RATWR8_MESSID Message-ID with excessive dashes and dollars

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

0.0 UNPARSEABLE_RELAY Informational: message has unparseable relay lines

0.6 HTML_MIME_NO_HTML_TAG HTML-only message, but there is no HTML tag

Subject: {SPAM?} =?UTF-8?B?UmU6IFImRCBzdXBwb3J0IGZvciB5b3VyIG5ldyBtaXJyb3Igc2VyaWVz?=

ne; font-size:0px; line-height:0px; max-height:0px; max-width:0px; opacity:0; =

overflow:hidden; visibility:hidden; mso-hide:all;">=0A<=

div style=3D"clear: both;">
Hi,

=3D"MsoNormal">Working directly with our factory=0Aeliminates extra cost=

s and speeds up delivery.

r: rgb(255, 0, 0);">We produce LED mirror touch switches with=0Adimming, Bluet=

ooth, and anti-fog control.
With 17 yea=

rs of manufacturing experience=0Aand all key certifications, we make importing=

simple.
Would you like a quotation for=

your current=0Ademand?

p>

B=

est regards,
Cathy Wong

ass=3D"MsoNormal">Shenzhen Trumsense Technology Co.,Ltd.

ass=3D"MsoNormal">Address=EF=BC=9AA3102,Southern=0ALake, Ji=

ndi Community,Street3# Chunlin,Qujiang District,Xi'an City,Shaan Xi=0AProvince=

, China 710061
Tel: 008613891846516
an>
Email: ledmirror-touchswitch@trumsense.com=

=

"clear: both;">
If you don't want to receive our emails, you can=

7a1f3353364b12b65812452b4b4abd19&token=3DeyJjYW1wYWlnbl90aW1lIjoxNzg2NTUwNDc3L=

CJlZG1faWQiOjUyMTk0MywiZW52aWQiOiI2MDAwMDAzNDc1MDM4OTI1NjYiLCJtYWlsX2Zyb20iOiJ=

0cnVtc2Vuc2UtbWlycm9yc3dpdGNoQGNoaW5hc21hcnRzZW5zb3IuY24iLCJtYWlsX3RvIjoiZG9jd=

G9yQG5sMmsuYWIuY2EiLCJ0YXNraWQiOiJkNGQ5NTRkNi04ZGRkLTQxZDEtODM2Yi01ODBmNGZiOWU=

2NTgifQ%3D%3D&version=3D1.0" data-alidmx-urlmark=3D"f49293ac-8586-4b9d-8837-4e=

8a833fa16a">unsubscribe.

/v1/report?bid=3Dd4d954d6-8ddd-41d1-836b-580f4fb9e658&env=3D600000347503892566=

&mac=3D521943&mf=3Dtrumsense-mirrorswitch%40chinasmartsensor.cn&msgid=3D624b5c=

9d-716e-4927-bbfd-d27e7ad3a956%40alibaba.com&sac=3D0&tag=3DDMXTask&tid=3Dd4d95=

4d6-8ddd-41d1-836b-580f4fb9e658&to=3Ddoctor%40nl2k.ab.ca&tpl=3D&ts=3D178655047=

7&type=3D1&url=3D&v=3D1.0&sign=3Dcb528a618613da19244501f703ea697b&urlts=3D1786=

550477" alt=3D"" style=3D"display: none; width: 1px; height: 1px;" />

Categories: Chinese Phish Spam

0 Comments

WEb/SEO/App spam from Google Gmail
Posted by Dave Yadallee on Wednesday, August 12. 2026

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Wed, 12 Aug 2026 10:08:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.5 (FreeBSD))

(envelope-from )

id 1wuBUj-00000000NUb-468t

for dave@doctor.nl2k.ab.ca;

Wed, 12 Aug 2026 10:07:57 -0600

Resent-From: The Doctor

Resent-Date: Wed, 12 Aug 2026 10:07:57 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-pj1-f41.google.com ([209.85.216.41]:52231)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.99.5 (FreeBSD))

(envelope-from )

id 1wuBPD-00000000MQc-0F1t

for sales@nk.ca;

Wed, 12 Aug 2026 10:02:25 -0600

Received: by mail-pj1-f41.google.com with SMTP id 98e67ed59e1d1-3900e39d935so1481744a91.0

for ; Wed, 12 Aug 2026 09:01:27 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=gmail.com; s=20251104; t=1786550481; x=1787155281; darn=nk.ca;

h=disposition-notification-to:content-language:thread-index

:content-type:mime-version:message-id:date:subject:to:from:from:to

:cc:subject:date:message-id:reply-to:content-type;

bh=yklAkINHbzjZeNzhZD9lcNCaz278+gZgEk2532ihsq0=;

b=jPrsLye59nwBtPLHZYy565OTexo/LV0oq1byQ7ydX4+IrJUhQoOI1RPOjRli7cnivJ

RQVQC0kf+26GKyE/eeeKnzdC6sjlut5xbL1mQdIQYN/VaBVez6ZyUi4X3Rhg+qgRRscy

yHTZ/QVLA04JOpSZmi0Ynk+uS19UWZuc6RuzLGo2zz262MRWnJJMntHGkyoikMDMVR0G

qu1r+0DmvQYxKj1KJB0Z7kaW7zCYNVIqSTHdeXPQx5uCkQr0GIg0Ji32uo9mcsTpcpiq

OTcDOKWoV4sJaZubqwoVh/+gArOOqSqGrf79AxlSPsD/hYh0Y83iJ3Vznxx9/ew7cGXZ

DqoQ==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20251104; t=1786550481; x=1787155281;

h=disposition-notification-to:content-language:thread-index

:content-type:mime-version:message-id:date:subject:to:from:x-gm-gg

:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to

:content-type;

bh=yklAkINHbzjZeNzhZD9lcNCaz278+gZgEk2532ihsq0=;

b=BBDqDIMCOK8C3WqhPTFG/fzrLCPRfpXqEkXcwvNf62ahG0giZjBQOJG2zQS1bw9EfS

44X68AbDpRKJ4nGkrYn1Nr2EzD3oSuzrfMJFXT4cbIaJ86jeS2w6bozlsBQKKCC1ZbvD

2LTHr7k8+7q9Qome5pU6+ooPIOajgLCUjx1cL14bcKL2QJ9byY0ozMrm0gSPfmjf4FWm

luY6GU1an3thJjF2FLIlDk0DE05pFyyEA5IOx8KqIriRX1qwTieOgeuXDCBMFkrwdmdx

rAY/N4iaAUSO5WKh7qCdyq49Ba1azwoXsoXep3iPb14Yx+EqHnzjdAhnejDjTSAiGOgN

RwUw==

X-Gm-Message-State: AOJu0Ywoveuov2mxfhyb7l+pMHki7Yz4fa+QaWBLd9tYBHfiukluAJNK

aFCStOmXKl2M1oZ/klWg9JOq5jjxoht5G3Mrf5sLWyxOLU10KAhf2zFzE3I8P59/Qp8=

X-Gm-Gg: AR+sD12OkYBrnoHCCTYIbXwRGrM4nVFChWOyuLPaVZ0oG2Me7fr5qMbBuZsVGj3005e

qeSpHYOXIblmU6fmnxA3KTMpxtxLYd7hj15lZrk7NVZ2yvr2jIOGrOPou+TqCHBN18UMfWaIRqk

EaOWueY/NbFs8UWlBK/xxngpPgDLz5CCZ1ZVRlbmEDlAPw5bWdqaNjD9ujlpJOP8KLmgiz5nvUU

nalPp6BapSa/PtBbSTbOUndNZcJF60LYKl8qQWJNJE1/oAJcREKH7bVPwPQc+BVLWdU9jkObaQp

ZEJ/1l+kt/sDhTHAfcOhyeojW5o5rtlQ0ozZJ6RqLGxULLwYAJPfe/4FOsP8u1rczfOoq/N2jN1

7kPvJGRTYTwedvt3f29pCpLc054NDrPOthNLlCO667Ls2QwBsi8TB2VxdX5ekQPK57aufe6QyvH

HjE6pUCx06UpubmOwTtWNLvLgrqrcMmUPUo/9zII0pv6cwwXtwCPceHXqArLOV4w79Rb7oXUDCM

nX0TFVO7Q4QseYXokQE5ojG2mLQOe1k+m8VIagAZiTDY1x1Q9q8HFA=

X-Received: by 2002:a17:90b:2d87:b0:38e:67e1:15b with SMTP id 98e67ed59e1d1-3930129aa1dmr6958454a91.6.1786550480952;

Wed, 12 Aug 2026 09:01:20 -0700 (PDT)

Received: from DESKTOPH0SNGFD (204.124.163.103.broadband.rapidnet.in. [103.163.124.204])

by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-392f8cfdaccsm4024973a91.11.2026.08.12.09.01.19

for

(version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128);

Wed, 12 Aug 2026 09:01:20 -0700 (PDT)

From: "Moni Choudhry"

To:

Subject: Re: Looking a Website Designer or Developer..

Date: Wed, 12 Aug 2026 21:28:53 +0530

Message-ID: <05be01dd2a73$d0d33090$727991b0$@gmail.com>

MIME-Version: 1.0

Content-Type: multipart/alternative;

boundary="----=_NextPart_000_05BF_01DD2AA1.EA8C2FE0"

X-Mailer: Microsoft Outlook 16.0

Thread-Index: Ad0qXB5dMBKOw8e/RpK29Q+a8dX5aA==

Content-Language: en-us

Disposition-Notification-To: "Moni Choudhry"

X-Spam_score: 5.7

X-Spam_score_int: 57

X-Spam_bar: +++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.

Content preview: Hi sales@nk.ca, I hope you're doing well. I wanted to follow

up to see if you have had a chance to review my previous message. If you're

interested, It would be great if you share the details of your requirement

so that I can come up with my best solution accordingly & I can send you

more details on the packages/action/Portfo [...]

Content analysis details: (5.7 points, 5.0 required)

pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[103.163.124.204 listed in will-spam-for-food.eu.org]

[103.163.124.204 listed in will-spam-for-food.eu.org]

[103.163.124.204 listed in will-spam-for-food.eu.org]

[103.163.124.204 listed in will-spam-for-food.eu.org]

[103.163.124.204 listed in will-spam-for-food.eu.org]

[103.163.124.204 listed in will-spam-for-food.eu.org]

[103.163.124.204 listed in will-spam-for-food.eu.org]

[103.163.124.204 listed in will-spam-for-food.eu.org]

[209.85.216.41 listed in will-spam-for-food.eu.org]

[209.85.216.41 listed in will-spam-for-food.eu.org]

[209.85.216.41 listed in will-spam-for-food.eu.org]

[209.85.216.41 listed in will-spam-for-food.eu.org]

[209.85.216.41 listed in will-spam-for-food.eu.org]

[209.85.216.41 listed in will-spam-for-food.eu.org]

[209.85.216.41 listed in will-spam-for-food.eu.org]

[209.85.216.41 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[209.85.216.41 listed in dnsbl.ahbl.org]

[209.85.216.41 listed in dnsbl.ahbl.org]

[209.85.216.41 listed in dnsbl.ahbl.org]

[209.85.216.41 listed in dnsbl.ahbl.org]

[103.163.124.204 listed in dnsbl.ahbl.org]

[103.163.124.204 listed in dnsbl.ahbl.org]

[103.163.124.204 listed in dnsbl.ahbl.org]

[103.163.124.204 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[209.85.216.41 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[209.85.216.41 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[209.85.216.41 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[209.85.216.41 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_SBL_XBL RBL: Received via a relay in Spamhaus SBL+XBL

[103.163.124.204 listed in sbl-xbl.spamhaus.org]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[209.85.216.41 listed in list.dnswl.org]

1.5 RCVD_IN_CBL RBL: Received via a relay in cbl.abuseat.org

[Listed by XBL, see ]

-0.0 SPF_PASS SPF: sender matches SPF record

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider

[websiterevamp1(at)gmail.com]

0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends in

digit

[websiterevamp1(at)gmail.com]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

0.5 L_HELLO_ADDRESS BODY: Greets you by address, not by name

-0.0 RCVD_IN_MSPIKE_H3 RBL: Good reputation (+3)

[209.85.216.41 listed in wl.mailspike.net]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[209.85.216.41 listed in bl.score.senderscore.com]

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

-0.0 RCVD_IN_MSPIKE_WL Mailspike good senders

0.5 GB_FREEMAIL_DISPTO Disposition-Notification-To/From or

Disposition-Notification-To/body contain

different freemails

Subject: {SPAM?} Re: Looking a Website Designer or Developer..

This is a multipart message in MIME format.

------=_NextPart_000_05BF_01DD2AA1.EA8C2FE0

Content-Type: text/plain;

charset="us-ascii"

Content-Transfer-Encoding: 7bit

Hi sales@nk.ca,

I hope you're doing well. I wanted to follow up to see if you have had a

chance to review my previous message.

If you're interested, It would be great if you share the details of your

requirement so that I can come up with my best solution accordingly & I can

send you more details on the packages/action/Portfolio/past work details.

Best regards,

Moni.

From: Moni Choudhary

Sent: June 24, 2026 4:51 PM

To: sales@nk.ca

Subject: Looking a Website Designer or Developer.??

Hi sales@nk.ca,

I hope this email finds you well.

My name is Moni, and I am a highly skilled Full Stack Developer with

extensive experience in both front-end and back-end development. I am am

reaching to you in case you want to hire a perfect developer who can manage

your website, can make updates, enhance the visibility, develop advance

features in your website and provide you continue support on very reasonable

prices.

My Skills are:-

PHP (Laravel, CakePHP, Zend, Symphony, Yii), Node.js, Express.js, Magento,

WordPress, Shopify

HTML, CSS, JavaScript, Next.js, React.js, Angular, TypeScript, Vue.js.

I am happy offer a free 10- 15 hour trial to demonstrate my skills and I am

ready to work with you on monthly basis or as per your requirements. I can

mange the design and development both side.

If you are interested, then let me know your requirement, so I can assist

you with best solution.

Regards,

Moni.

------=_NextPart_000_05BF_01DD2AA1.EA8C2FE0

Content-Type: text/html;

charset="us-ascii"

Content-Transfer-Encoding: quoted-printable

xmlns:o=3D"urn:schemas-microsoft-com:office:office" =

xmlns:w=3D"urn:schemas-microsoft-com:office:word" =

xmlns:m=3D"http://schemas.microsoft.com/office/2004/12/omml" =

xmlns=3D"http://www.w3.org/TR/REC-html40">
HTTP-EQUIV=3D"Content-Type" CONTENT=3D"text/html; =

charset=3Dus-ascii">
(filtered medium)">
link=3D"#0563C1" vlink=3D"#954F72" style=3D'word-wrap:break-word'>

class=3DWordSection1>

style=3D'font-size:10.5pt;font-family:"Times New =

Roman",serif;color:#002060'>Hi =

sales@nk.ca,

style=3D'font-size:10.5pt;font-family:"Times New =

Roman",serif;color:#002060'>I hope you’re doing well. I wanted to =

follow up to see if you have had a chance to review my previous =

message.

style=3D'font-size:10.5pt;font-family:"Times New =

Roman",serif;color:#002060'>If you’re interested,
style=3D'background:yellow'>It would be great if you share the details =

of your requirement so that I can come up with my best solution =

accordingly & I can send you more details on the =

packages/action/Portfolio/past work =

details.

class=3DMsoNoSpacing>
New Roman",serif;color:#002060'>Best regards,

class=3DMsoNoSpacing>
New Roman",serif;color:#002060'>Moni.

class=3DMsoNoSpacing>
New Roman",serif;color:#002060'>

class=3DMsoNoSpacing>
style=3D'font-size:11.0pt;font-family:"Times New =

Roman",serif'>From:
style=3D'font-size:11.0pt;font-family:"Times New Roman",serif'> Moni =

Choudhary
Sent: June 24, 2026 4:51 =

PM
To: sales@nk.ca <sales@nk.ca>
Subject: =

Looking a Website Designer =

or Developer.??

class=3DMsoNoSpacing>
New Roman",serif;color:#002060'>

class=3DMsoNoSpacing>
New Roman",serif;color:#002060;background:#F8F8F8'>Hi =

sales@nk.ca,

style=3D'font-size:10.5pt;font-family:"Times New =

Roman",serif;color:#002060'>

class=3DMsoNoSpacing>
New Roman",serif;color:#002060;background:#F8F8F8'>I hope this email =

finds you well.

style=3D'font-size:10.5pt;font-family:"Times New =

Roman",serif;color:#002060'>

class=3DMsoNoSpacing>
New Roman",serif;color:#002060;background:#F8F8F8'>My name is =

Roman",serif;color:#002060'>Moni, and =

I am a highly skilled Full Stack Developer with extensive experience in =

both front-end and back-end development. I am am reaching to you in case =

you want to hire a perfect developer who can manage your website, can =

make updates, enhance the visibility, develop advance features in your =

website and provide you continue support on very reasonable =

prices.

class=3DMsoNoSpacing>
style=3D'font-size:10.5pt;font-family:"Times New =

Roman",serif;color:#002060;background:#F8F8F8'>My Skills =

are:-

New Roman",serif;color:#002060'>

style=3D'background:#F8F8F8'>PHP (Laravel, CakePHP, Zend, Symphony, =

Yii), Node.js, Express.js, Magento, WordPress, Shopify

style=3D'background:#F8F8F8'>HTML, CSS, JavaScript, Next.js, React.js, =

Angular, TypeScript, Vue.js.

class=3DMsoNoSpacing>
New Roman",serif;color:#002060;background:yellow'>I am happy offer a =

free 10- 15 hour trial to demonstrate my skills and I am ready to work =

with you on monthly basis or as per your requirements. I can mange the =

design and development both side.
style=3D'font-size:10.5pt;font-family:"Times New =

Roman",serif;color:#002060;background:#F8F8F8'>

style=3D'font-size:10.5pt;font-family:"Times New =

Roman",serif;color:#002060'>

class=3DMsoNoSpacing>
style=3D'font-size:10.5pt;font-family:"Times New =

Roman",serif;color:#002060'>If you are interested, then let me know your =

requirement, so I can assist you with best solution.

style=3D'font-size:10.5pt;font-family:"Times New =

Roman",serif;color:#002060'>
Regards,

class=3DMsoNoSpacing>
New Roman",serif;color:#002060'>Moni.

class=3DMsoNoSpacing>
New =

Roman",serif;color:#002060'>

ml>

------=_NextPart_000_05BF_01DD2AA1.EA8C2FE0--

Categories: Google Gmail Spam

0 Comments

Page 1289 of 1289, totaling 19335 entries

previous page

No entries to print

Mon	Tue	Wed	Thu	Fri	Sat	Sun
← Back	August '26					Forward →
					1	2
3	4	5	6	7	8	9
10	11	12	13	14	15	16
17	18	19	20	21	22	23
24	25	26	27	28	29	30
31

Your teammates are trying to reach you in Microsoft Te= ams

Your teammates are trying to reach you in Microsoft Te= ams

Your teammates are trying to reach you in Microsoft Te= ams

Your teammates are trying to reach you in Microsoft Te= ams

Your teammates are trying to reach you in Microsoft Te= ams

Your teammates are trying to reach you in Microsoft Te= ams

Your teammates are trying to reach you in Microsoft Te= ams

Your teammates are trying to reach you in Microsoft Te= ams

Intelcom

Delivery Update

Your teammates are trying to reach you in Microsoft Te=

ams

Your teammates are trying to reach you in Microsoft Te=

ams

Your teammates are trying to reach you in Microsoft Te=

ams

Your teammates are trying to reach you in Microsoft Te=

ams

Your teammates are trying to reach you in Microsoft Te=

ams

Your teammates are trying to reach you in Microsoft Te=

ams

Your teammates are trying to reach you in Microsoft Te=

ams

Your teammates are trying to reach you in Microsoft Te=

ams