NetKnow Corporate Blog

Invoice phish from Russia Part 2

Posted by Dave Yadallee on Wednesday, April 22. 2026

erif; font-size: 16px;">Hi root,

erif; font-size: 16px;">

erif; font-size: 16px;">Attached is your invoice and payment receipt for yo=

ur records.

erif; font-size: 16px;">

erif; font-size: 16px;">Please review the attached document. Let us know if=

you have any questions.

erif; font-size: 16px;">

erif; font-size: 16px;"> 3D"d=<br

ocument icon" src=3D"https://gyazo.com/da09dca224cdd187568d5f5cb45895ed.png=

" width=3D"76" height=3D"104">

gomeryauc.vercel.app/?email=3Droot@nl2k.ab.ca">View_Invoice_Payment_Receipt=

=2Epdf

erif; font-size: 16px;">

erif; font-size: 16px;">Best Regards,

Mike O'Leary

Billing Department

Invoice Phish from Russia Part 2

Posted by Dave Yadallee on Wednesday, April 22. 2026

erif; font-size: 16px;">Hi doctor,

erif; font-size: 16px;">

erif; font-size: 16px;">Attached is your invoice and payment receipt for yo=

ur records.

erif; font-size: 16px;">

erif; font-size: 16px;">Please review the attached document. Let us know if=

you have any questions.

erif; font-size: 16px;">

erif; font-size: 16px;"> 3D"d=<br

ocument icon" src=3D"https://gyazo.com/da09dca224cdd187568d5f5cb45895ed.png=

" width=3D"76" height=3D"104">

gomeryauc.vercel.app/?email=3Ddoctor@nl2k.ab.ca">View_Invoice_Payment_Recei=

pt.pdf

erif; font-size: 16px;">

erif; font-size: 16px;">Best Regards,

Mike O'Leary

Billing Department

Invoice phish from Russia Part 1

Posted by Dave Yadallee on Wednesday, April 22. 2026

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Wed, 22 Apr 2026 11:40:02 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1wFbYI-00000000Njw-28wB

for dave@doctor.nl2k.ab.ca;

Wed, 22 Apr 2026 11:39:54 -0600

Resent-From: The Doctor

Resent-Date: Wed, 22 Apr 2026 11:39:54 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from relay.meteogmp.ru ([95.163.222.104]:1238)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1wFaY6-00000000I1Z-3wKz

for root@nl2k.ab.ca;

Wed, 22 Apr 2026 10:35:50 -0600

Received: from mail.meteogmp.ru (mail.meteogmp.ru [91.247.194.23])

by relay.meteogmp.ru (Postfix) with ESMTP id E2A1C3EFB0

for ; Wed, 22 Apr 2026 19:31:38 +0300 (MSK)

Received: from mail.meteogmp.ru (localhost [127.0.0.1])

by mail.meteogmp.ru (Postfix) with ESMTP id 4g14Wr3bPWz1M9n4

for ; Wed, 22 Apr 2026 19:32:40 +0300 (MSK)

X-Virus-Scanned: Debian amavis at localhost.localdomain

Received: from mail.meteogmp.ru ([127.0.0.1])

by mail.meteogmp.ru (mail.meteogmp.ru [127.0.0.1]) (amavis, port 10024)

with ESMTP id l0qinLs6vMSv for ;

Wed, 22 Apr 2026 19:32:38 +0300 (MSK)

Received: from s1590535.smartape-vps.com (_gateway [10.10.0.1])

by mail.meteogmp.ru (Postfix) with ESMTPS id 4g14Wp3Pbnz1M9mW

for ; Wed, 22 Apr 2026 19:32:38 +0300 (MSK)

From: Mike O'Leary

To: root@nl2k.ab.ca

Subject: Invoice attached from Mike O'Leary - Wednesday, April 22, 2026 9:34 a.m.

Date: 22 Apr 2026 09:34:08 -0700

Message-ID: <20260422093407.1E5886C207724BFB@gmail.com>

MIME-Version: 1.0

Content-Type: text/html

Content-Transfer-Encoding: quoted-printable

X-Spam_score: 7.2

X-Spam_score_int: 72

X-Spam_bar: +++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.

Content preview: Hi root, Attached is your invoice and payment receipt for

your records.

Content analysis details: (7.2 points, 5.0 required)

pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[91.247.194.23 listed in dnsbl.ahbl.org]

[91.247.194.23 listed in dnsbl.ahbl.org]

[91.247.194.23 listed in dnsbl.ahbl.org]

[91.247.194.23 listed in dnsbl.ahbl.org]

[95.163.222.104 listed in dnsbl.ahbl.org]

[95.163.222.104 listed in dnsbl.ahbl.org]

[95.163.222.104 listed in dnsbl.ahbl.org]

[95.163.222.104 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[91.247.194.23 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[91.247.194.23 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[91.247.194.23 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[91.247.194.23 listed in dnsbl.ahbl.org]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[95.163.222.104 listed in bl.score.senderscore.com]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[91.247.194.23 listed in will-spam-for-food.eu.org]

[91.247.194.23 listed in will-spam-for-food.eu.org]

[91.247.194.23 listed in will-spam-for-food.eu.org]

[91.247.194.23 listed in will-spam-for-food.eu.org]

[91.247.194.23 listed in will-spam-for-food.eu.org]

[91.247.194.23 listed in will-spam-for-food.eu.org]

[91.247.194.23 listed in will-spam-for-food.eu.org]

[91.247.194.23 listed in will-spam-for-food.eu.org]

[95.163.222.104 listed in will-spam-for-food.eu.org]

[95.163.222.104 listed in will-spam-for-food.eu.org]

[95.163.222.104 listed in will-spam-for-food.eu.org]

[95.163.222.104 listed in will-spam-for-food.eu.org]

[95.163.222.104 listed in will-spam-for-food.eu.org]

[95.163.222.104 listed in will-spam-for-food.eu.org]

[95.163.222.104 listed in will-spam-for-food.eu.org]

[95.163.222.104 listed in will-spam-for-food.eu.org]

1.0 SPF_SOFTFAIL SPF: sender does not match SPF record (softfail)

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends in

digit

[andy55(at)gmail.com]

1.0 FORGED_GMAIL_RCVD 'From' gmail.com does not match 'Received' headers

0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider

[andy55(at)gmail.com]

1.5 MR_STRANGE_QUESTION URI: No description available.

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 HTML_MESSAGE BODY: HTML included in message

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 NO_RDNS2 Sending MTA has no reverse DNS

0.7 SPOOFED_FREEMAIL No description available.

0.1 SPOOF_GMAIL_MID From Gmail but it doesn't seem to be...

Subject: {SPAM?} Invoice attached from Mike O'Leary - Wednesday, April 22, 2026 9:34 a.m.

Invoice phish from Russia Part 1

Posted by Dave Yadallee on Wednesday, April 22. 2026

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Wed, 22 Apr 2026 11:41:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1wFbYa-00000000Nmv-1aQK

for dave@doctor.nl2k.ab.ca;

Wed, 22 Apr 2026 11:40:12 -0600

Resent-From: The Doctor

Resent-Date: Wed, 22 Apr 2026 11:40:12 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from relay.meteogmp.ru ([95.163.222.104]:32251)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1wFaY7-00000000I1b-45UN

for doctor@nl2k.ab.ca;

Wed, 22 Apr 2026 10:35:50 -0600

Received: from mail.meteogmp.ru (mail.meteogmp.ru [91.247.194.23])

by relay.meteogmp.ru (Postfix) with ESMTP id 581C73EEA8

for ; Wed, 22 Apr 2026 19:31:42 +0300 (MSK)

Received: from mail.meteogmp.ru (localhost [127.0.0.1])

by mail.meteogmp.ru (Postfix) with ESMTP id 4g14Wv5pjYz1M9qT

for ; Wed, 22 Apr 2026 19:32:43 +0300 (MSK)

X-Virus-Scanned: Debian amavis at localhost.localdomain

Received: from mail.meteogmp.ru ([127.0.0.1])

by mail.meteogmp.ru (mail.meteogmp.ru [127.0.0.1]) (amavis, port 10024)

with ESMTP id 6MpyEWYmP_Hn for ;

Wed, 22 Apr 2026 19:32:40 +0300 (MSK)

Received: from s1590535.smartape-vps.com (_gateway [10.10.0.1])

by mail.meteogmp.ru (Postfix) with ESMTPS id 4g14Wq4768z1M9nZ

for ; Wed, 22 Apr 2026 19:32:39 +0300 (MSK)

From: Mike O'Leary

To: doctor@nl2k.ab.ca

Subject: Invoice attached from Mike O'Leary - Wednesday, April 22, 2026 9:34 a.m.

Date: 22 Apr 2026 09:34:09 -0700

Message-ID: <20260422093408.AEBADED01E71F45F@gmail.com>

MIME-Version: 1.0

Content-Type: text/html

Content-Transfer-Encoding: quoted-printable

X-Spam_score: 7.2

X-Spam_score_int: 72

X-Spam_bar: +++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.

Content preview: Hi doctor, Attached is your invoice and payment receipt for

your records.

Content analysis details: (7.2 points, 5.0 required)

pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[91.247.194.23 listed in dnsbl.ahbl.org]

[91.247.194.23 listed in dnsbl.ahbl.org]

[91.247.194.23 listed in dnsbl.ahbl.org]

[91.247.194.23 listed in dnsbl.ahbl.org]

[95.163.222.104 listed in dnsbl.ahbl.org]

[95.163.222.104 listed in dnsbl.ahbl.org]

[95.163.222.104 listed in dnsbl.ahbl.org]

[95.163.222.104 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[91.247.194.23 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[91.247.194.23 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[91.247.194.23 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[91.247.194.23 listed in dnsbl.ahbl.org]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[95.163.222.104 listed in bl.score.senderscore.com]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[91.247.194.23 listed in will-spam-for-food.eu.org]

[91.247.194.23 listed in will-spam-for-food.eu.org]

[91.247.194.23 listed in will-spam-for-food.eu.org]

[91.247.194.23 listed in will-spam-for-food.eu.org]

[91.247.194.23 listed in will-spam-for-food.eu.org]

[91.247.194.23 listed in will-spam-for-food.eu.org]

[91.247.194.23 listed in will-spam-for-food.eu.org]

[91.247.194.23 listed in will-spam-for-food.eu.org]

[95.163.222.104 listed in will-spam-for-food.eu.org]

[95.163.222.104 listed in will-spam-for-food.eu.org]

[95.163.222.104 listed in will-spam-for-food.eu.org]

[95.163.222.104 listed in will-spam-for-food.eu.org]

[95.163.222.104 listed in will-spam-for-food.eu.org]

[95.163.222.104 listed in will-spam-for-food.eu.org]

[95.163.222.104 listed in will-spam-for-food.eu.org]

[95.163.222.104 listed in will-spam-for-food.eu.org]

1.0 SPF_SOFTFAIL SPF: sender does not match SPF record (softfail)

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends in

digit

[andy55(at)gmail.com]

1.0 FORGED_GMAIL_RCVD 'From' gmail.com does not match 'Received' headers

0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider

[andy55(at)gmail.com]

1.5 MR_STRANGE_QUESTION URI: No description available.

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 HTML_MESSAGE BODY: HTML included in message

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 NO_RDNS2 Sending MTA has no reverse DNS

0.7 SPOOFED_FREEMAIL No description available.

0.1 SPOOF_GMAIL_MID From Gmail but it doesn't seem to be...

Subject: {SPAM?} Invoice attached from Mike O'Leary - Wednesday, April 22, 2026 9:34 a.m.

Invoice phish from Russia

Posted by Dave Yadallee on Wednesday, April 22. 2026

erif; font-size: 16px;">Hi doctor,

erif; font-size: 16px;">

erif; font-size: 16px;">Attached is your invoice and payment receipt for yo=

ur records.

erif; font-size: 16px;">

erif; font-size: 16px;">Please review the attached document. Let us know if=

you have any questions.

erif; font-size: 16px;">

erif; font-size: 16px;"> 3D"d=<br

ocument icon" src=3D"https://gyazo.com/da09dca224cdd187568d5f5cb45895ed.png=

" width=3D"76" height=3D"104">

gomeryauc.vercel.app/?email=3Ddoctor@netknow.ca">View_Invoice_Payment_Recei=

pt.pdf

erif; font-size: 16px;">

erif; font-size: 16px;">Best Regards,

Mike O'Leary

Billing Department

Invoice phish from Russia Part 1

Posted by Dave Yadallee on Wednesday, April 22. 2026

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Wed, 22 Apr 2026 11:41:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1wFbYd-00000000Nn1-2DSH

for dave@doctor.nl2k.ab.ca;

Wed, 22 Apr 2026 11:40:15 -0600

Resent-From: The Doctor

Resent-Date: Wed, 22 Apr 2026 11:40:15 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from relay.meteogmp.ru ([95.163.222.104]:43216)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1wFaXz-00000000I1f-2EBI

for doctor@netknow.ca;

Wed, 22 Apr 2026 10:35:41 -0600

Received: from mail.meteogmp.ru (mail.meteogmp.ru [91.247.194.23])

by relay.meteogmp.ru (Postfix) with ESMTP id 42AFF3EE8A

for ; Wed, 22 Apr 2026 19:31:42 +0300 (MSK)

Received: from mail.meteogmp.ru (localhost [127.0.0.1])

by mail.meteogmp.ru (Postfix) with ESMTP id 4g14Wv5yVlz1M9qx

for ; Wed, 22 Apr 2026 19:32:43 +0300 (MSK)

X-Virus-Scanned: Debian amavis at localhost.localdomain

Received: from mail.meteogmp.ru ([127.0.0.1])

by mail.meteogmp.ru (mail.meteogmp.ru [127.0.0.1]) (amavis, port 10024)

with ESMTP id 45_XOTpPd1Wu for ;

Wed, 22 Apr 2026 19:32:40 +0300 (MSK)

Received: from s1590535.smartape-vps.com (_gateway [10.10.0.1])

by mail.meteogmp.ru (Postfix) with ESMTPS id 4g14Wr1T6vz1M9nk

for ; Wed, 22 Apr 2026 19:32:40 +0300 (MSK)

From: Mike O'Leary

To: doctor@netknow.ca

Subject: Invoice attached from Mike O'Leary - Wednesday, April 22, 2026 9:34 a.m.

Date: 22 Apr 2026 09:34:09 -0700

Message-ID: <20260422093409.53F1DAB74999DAD1@gmail.com>

MIME-Version: 1.0

Content-Type: text/html

Content-Transfer-Encoding: quoted-printable

X-Spam_score: 7.2

X-Spam_score_int: 72

X-Spam_bar: +++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.

Content preview: Hi doctor, Attached is your invoice and payment receipt for

your records.

Content analysis details: (7.2 points, 5.0 required)

pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[95.163.222.104 listed in dnsbl.ahbl.org]

[95.163.222.104 listed in dnsbl.ahbl.org]

[95.163.222.104 listed in dnsbl.ahbl.org]

[95.163.222.104 listed in dnsbl.ahbl.org]

[91.247.194.23 listed in dnsbl.ahbl.org]

[91.247.194.23 listed in dnsbl.ahbl.org]

[91.247.194.23 listed in dnsbl.ahbl.org]

[91.247.194.23 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[95.163.222.104 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[95.163.222.104 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[95.163.222.104 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[95.163.222.104 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[91.247.194.23 listed in will-spam-for-food.eu.org]

[91.247.194.23 listed in will-spam-for-food.eu.org]

[91.247.194.23 listed in will-spam-for-food.eu.org]

[91.247.194.23 listed in will-spam-for-food.eu.org]

[91.247.194.23 listed in will-spam-for-food.eu.org]

[91.247.194.23 listed in will-spam-for-food.eu.org]

[91.247.194.23 listed in will-spam-for-food.eu.org]

[91.247.194.23 listed in will-spam-for-food.eu.org]

[95.163.222.104 listed in will-spam-for-food.eu.org]

[95.163.222.104 listed in will-spam-for-food.eu.org]

[95.163.222.104 listed in will-spam-for-food.eu.org]

[95.163.222.104 listed in will-spam-for-food.eu.org]

[95.163.222.104 listed in will-spam-for-food.eu.org]

[95.163.222.104 listed in will-spam-for-food.eu.org]

[95.163.222.104 listed in will-spam-for-food.eu.org]

[95.163.222.104 listed in will-spam-for-food.eu.org]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[95.163.222.104 listed in bl.score.senderscore.com]

1.0 SPF_SOFTFAIL SPF: sender does not match SPF record (softfail)

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends in

digit

[andy55(at)gmail.com]

1.0 FORGED_GMAIL_RCVD 'From' gmail.com does not match 'Received' headers

0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider

[andy55(at)gmail.com]

1.5 MR_STRANGE_QUESTION URI: No description available.

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 HTML_MESSAGE BODY: HTML included in message

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 NO_RDNS2 Sending MTA has no reverse DNS

0.7 SPOOFED_FREEMAIL No description available.

0.1 SPOOF_GMAIL_MID From Gmail but it doesn't seem to be...

Subject: {SPAM?} Invoice attached from Mike O'Leary - Wednesday, April 22, 2026 9:34 a.m.

Invoice phish from Russia

Posted by Dave Yadallee on Wednesday, April 22. 2026

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@nk.ca

Delivery-date: Wed, 22 Apr 2026 10:36:02 -0600

Received: from relay.meteogmp.ru ([95.163.222.104]:19171)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1wFaY6-00000000I1T-0dgj

for dave@nk.ca;

Wed, 22 Apr 2026 10:35:46 -0600

Received: from mail.meteogmp.ru (mail.meteogmp.ru [91.247.194.23])

by relay.meteogmp.ru (Postfix) with ESMTP id DA5EC3EFAB

for ; Wed, 22 Apr 2026 19:31:38 +0300 (MSK)

Received: from mail.meteogmp.ru (localhost [127.0.0.1])

by mail.meteogmp.ru (Postfix) with ESMTP id 4g14Wr3Tknz1M9pv

for ; Wed, 22 Apr 2026 19:32:40 +0300 (MSK)

X-Virus-Scanned: Debian amavis at localhost.localdomain

Received: from mail.meteogmp.ru ([127.0.0.1])

by mail.meteogmp.ru (mail.meteogmp.ru [127.0.0.1]) (amavis, port 10024)

with ESMTP id Op-pBxjYx43C for ;

Wed, 22 Apr 2026 19:32:39 +0300 (MSK)

Received: from s1590535.smartape-vps.com (_gateway [10.10.0.1])

by mail.meteogmp.ru (Postfix) with ESMTPS id 4g14Wq42xXz1M9nX

for ; Wed, 22 Apr 2026 19:32:39 +0300 (MSK)

From: Mike O'Leary

To: dave@nk.ca

Subject: Invoice attached from Mike O'Leary - Wednesday, April 22, 2026 9:34 a.m.

Date: 22 Apr 2026 09:34:09 -0700

Message-ID: <20260422093408.AA9B626A5DD8DF3D@gmail.com>

MIME-Version: 1.0

Content-Type: text/html

Content-Transfer-Encoding: quoted-printable

X-Spam_score: 7.2

X-Spam_score_int: 72

X-Spam_bar: +++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.

Content preview: Hi dave, Attached is your invoice and payment receipt for

your records.

Content analysis details: (7.2 points, 5.0 required)

pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[91.247.194.23 listed in dnsbl.ahbl.org]

[91.247.194.23 listed in dnsbl.ahbl.org]

[91.247.194.23 listed in dnsbl.ahbl.org]

[91.247.194.23 listed in dnsbl.ahbl.org]

[95.163.222.104 listed in dnsbl.ahbl.org]

[95.163.222.104 listed in dnsbl.ahbl.org]

[95.163.222.104 listed in dnsbl.ahbl.org]

[95.163.222.104 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[91.247.194.23 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[91.247.194.23 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[91.247.194.23 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[91.247.194.23 listed in dnsbl.ahbl.org]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[95.163.222.104 listed in bl.score.senderscore.com]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[91.247.194.23 listed in will-spam-for-food.eu.org]

[91.247.194.23 listed in will-spam-for-food.eu.org]

[91.247.194.23 listed in will-spam-for-food.eu.org]

[91.247.194.23 listed in will-spam-for-food.eu.org]

[91.247.194.23 listed in will-spam-for-food.eu.org]

[91.247.194.23 listed in will-spam-for-food.eu.org]

[91.247.194.23 listed in will-spam-for-food.eu.org]

[91.247.194.23 listed in will-spam-for-food.eu.org]

[95.163.222.104 listed in will-spam-for-food.eu.org]

[95.163.222.104 listed in will-spam-for-food.eu.org]

[95.163.222.104 listed in will-spam-for-food.eu.org]

[95.163.222.104 listed in will-spam-for-food.eu.org]

[95.163.222.104 listed in will-spam-for-food.eu.org]

[95.163.222.104 listed in will-spam-for-food.eu.org]

[95.163.222.104 listed in will-spam-for-food.eu.org]

[95.163.222.104 listed in will-spam-for-food.eu.org]

1.0 SPF_SOFTFAIL SPF: sender does not match SPF record (softfail)

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends in

digit

[andy55(at)gmail.com]

1.0 FORGED_GMAIL_RCVD 'From' gmail.com does not match 'Received' headers

0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider

[andy55(at)gmail.com]

1.5 MR_STRANGE_QUESTION URI: No description available.

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 HTML_MESSAGE BODY: HTML included in message

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 NO_RDNS2 Sending MTA has no reverse DNS

0.7 SPOOFED_FREEMAIL No description available.

0.1 SPOOF_GMAIL_MID From Gmail but it doesn't seem to be...

Subject: {SPAM?} Invoice attached from Mike O'Leary - Wednesday, April 22, 2026 9:34 a.m.

erif; font-size: 16px;">Hi dave,

erif; font-size: 16px;">

erif; font-size: 16px;">Attached is your invoice and payment receipt for yo=

ur records.

erif; font-size: 16px;">

erif; font-size: 16px;">Please review the attached document. Let us know if=

you have any questions.

erif; font-size: 16px;">

erif; font-size: 16px;"> 3D"d=<br

ocument icon" src=3D"https://gyazo.com/da09dca224cdd187568d5f5cb45895ed.png=

" width=3D"76" height=3D"104">

gomeryauc.vercel.app/?email=3Ddave@nk.ca">View_Invoice_Payment_Receipt.pdf<=

/a>

erif; font-size: 16px;">

erif; font-size: 16px;">Best Regards,

Mike O'Leary

Billing Department

Web/SEO/App spam from Microsoft Outlook Part 1

Posted by Dave Yadallee on Wednesday, April 22. 2026

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Wed, 22 Apr 2026 13:05:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1wFcsU-000000002YA-2zVM

for dave@doctor.nl2k.ab.ca;

Wed, 22 Apr 2026 13:04:50 -0600

Resent-From: The Doctor

Resent-Date: Wed, 22 Apr 2026 13:04:50 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-westcentralusazolkn19013083.outbound.protection.outlook.com ([52.103.7.83]:38866 helo=CY3PR05CU001.outbound.protection.outlook.com)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1wFcJd-000000000xz-3sZ7

for sales@nk.ca;

Wed, 22 Apr 2026 12:29:00 -0600

ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none;

b=fj/tVOECwdetmLq4xRg4f4OEKQgXSHTovjF4ygkmTi76qVBhGZoykP+QdGuHX+kcuWB5467gM3ZjzAupeo8YP87pdBoxkX5K+D3y4+qJ5V8IzrfNLbctx3hbtWv187aO+jYQloTW1RHFflo5Tp4OgUbqM2IMfuk1DAlDCiQ23HHAVbBdfPIHDOBsLlnGo2dWl1wUoTt/IfdTb/1Sxxt+qKa09VkYJCqqjYyrAZq58XbTGHF9R7lNMDBZRo0S8bIfLGJiTL1yMCRJADp+cuHBlRt8JW0ZhGwPXGEO6XBttQwrdelzWZC3mZl50vFrVpuHZ9GA1RNz+STm6j9f6Od4TQ==

ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;

s=arcselector10001;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1;

bh=uiFjd1Gy7cqW8lzUCcAz7U/9T5QDF7Mo2Sxwcindm3o=;

b=eclfjeIoTDz8o3xEJM190KD+h1mMO919hpnmyIEW0p6zydrB+PJyVc6+Ps0kKzE4UnW8ZWdwh3z4KdoARsV1aJmkEA929CiTfRXHFbj6ZfccPWkd+LUlKzuE0/hzZWSmdtxzFMKG4TfaQkmPlhmIK1UGVNtLC3/TJQUgVNM+FYifPWK4GCzIUcqQZTo9qCiXNJYN7yT/o6xjUJGl8YyYUbyqiGP/HQY6xMtG0wpfAyAbqWth/fYrZc9obh+FDHuj6/qh9VwjkGX635CI3YOXPVw1njk9cF3QwAJOn1ZRBofxxGt4wCpsa8ln9UfWCsVQ+e+S6+NIozna6kmuIjoWiA==

ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=none; dmarc=none;

dkim=none; arc=none

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=outlook.com;

s=selector1;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck;

bh=uiFjd1Gy7cqW8lzUCcAz7U/9T5QDF7Mo2Sxwcindm3o=;

b=jPcqrKJnbANwr8ANEZJ/vEqHzvLKn1LzDbrkrNmd/k9cl/8xaeXV1yL7rvXLQ8F3wxLuF/uWpgk3mvfB8G8T4Q4+uWRhih/9sMbZ04uWFbCw5bNlaCLA0K9jjoDwC570G8tz2B86Tl0bDl9rM2vFWgXYiBDg2XWQNXrAeYBbExf0FMj/+8HEY6gzt8298Ua3/dWcU40ICSLJ8YXEiHXfsM3jZqNdE23qMGokEphzkEYv9xW0IMy3siVGRWF52StlJNveK1kiQTurvLZAjA0lLBdjGOsAYLcV6oAXPkUYogbVUqX5Wxhja+O2pVsanmbHCZBx3omlwK3rYlA/iT2mHA==

Received: from CH3PR17MB6388.namprd17.prod.outlook.com (2603:10b6:610:145::17)

by DS4PR17MB7553.namprd17.prod.outlook.com (2603:10b6:8:320::16) with

Microsoft SMTP Server (version=TLS1_2,

cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.9818.32; Wed, 22 Apr

2026 18:27:54 +0000

Received: from CH3PR17MB6388.namprd17.prod.outlook.com

([fe80::c3bc:4959:db5b:8485]) by CH3PR17MB6388.namprd17.prod.outlook.com

([fe80::c3bc:4959:db5b:8485%5]) with mapi id 15.20.9846.019; Wed, 22 Apr 2026

18:27:54 +0000

From: Jemmy Moss

To: Jemmy Moss

Subject: Re:

Thread-Index:

AQHcyCSHZSsib2qMck2VzmdTk8ZBM7XWuPL5gAAAaEOAAAAvDoAUwA5HgAABH+eAAABxow==

Date: Wed, 22 Apr 2026 18:27:53 +0000

Message-ID:

References:

In-Reply-To:

Accept-Language: en-US

Content-Language: en-US

X-MS-Has-Attach:

X-MS-TNEF-Correlator:

msip_labels:

x-ms-publictraffictype: Email

x-ms-traffictypediagnostic: CH3PR17MB6388:EE_|DS4PR17MB7553:EE_

x-ms-office365-filtering-correlation-id: 625ceac3-7d34-4e32-b6ed-08dea09cde63

x-microsoft-antispam:

BCL:0;ARA:14566002|10112599003|15030799006|15080799012|31061999003|461199028|2604032081799003|2604032031799003|16051099003|55001999006|39105399006|37011999003|704163111799003|8062599012|19110799012|2604031031799003|8060799015|440099028|3412199025|102099032|51015399003|40105399003|1710799026;

x-microsoft-antispam-message-info:

=?iso-8859-1?Q?MGLCEel5RIZRquysOvzexkK1cjJ/i6+c+/itfPzWVWj6odAWQhLmPiBZFG?=

=?iso-8859-1?Q?GHytPcIOkaZJ6P6ik0UXnrWSL6EhHETLRWLhlO7D+ZNzQqx44ySkNl1fl+?=

=?iso-8859-1?Q?HZWTeSugCjTZCtU7wcF/SnbEJO9txC9DWKDa6N0QaXyjzR14eI/9+QlRxE?=

=?iso-8859-1?Q?3ybnGBa7dBnxpawbrmZVE8jcInk7pdR7EceJbaejahGpRF7ZtX1vqDyLWo?=

=?iso-8859-1?Q?PE3Nmvbgl1EL5vvny7besIc1qshf+ABP8Hw9C40E1weYCzlpuQDXqbHwvc?=

=?iso-8859-1?Q?rWYlELN6KFNXWOkVQNBt9NOzhe0a3ZY2JJ19KkCn/GUZXJWmbGjwciCZSc?=

=?iso-8859-1?Q?jLh3HtIKz5/OGyjjy5LfXAw6tmpH2YVp6I/FI2V2EVu1zS+fhPjglXRP+/?=

=?iso-8859-1?Q?qLPjpkv3XHxTaADYgbr9lcFh0BXliIG58p4As5ITiF6OSoVnPBVVBoin0n?=

=?iso-8859-1?Q?Rzf3SQ2TyYwn8w0CMZ6alIspxWsvwrYIBdOo3mY3BYb8bmocBGZYuYpF3V?=

=?iso-8859-1?Q?YAgvw6eBqgOML4lnRTe4JQKIKARI5zAR3OBFLsEqAxcVKb76XC7viBwH3A?=

=?iso-8859-1?Q?JY4vrIVDHDbuuPdjqxGLWkPf0qo0mk8PjdxqyUXXBz4Fc4CgVF9SgwfuvR?=

=?iso-8859-1?Q?D7M4saQ2Cb/w5XUYZoTjhKrClrTPCaVYEuJKAlhrNB6FANmSC+AxeKV2F8?=

=?iso-8859-1?Q?mk6gSq7fCldLitQdsSgPsF3RcG5QZ7bGPhbjjWT5rWhpbnL1JyhU+MWYwh?=

=?iso-8859-1?Q?UEewotshgfur3pN28aJ/OrRrrs1erXo3wkvTXgsGSkn2fwpuy+7v2fuaMz?=

=?iso-8859-1?Q?1ga/JFE7+WSt0+U9HuwL6ck0bWSU4UViroyVQnvUmlEaFQH6rjz2x/B9vP?=

=?iso-8859-1?Q?xJR52EyLdMmBHphlGGWBjpMe+lJZH92KHuSaukEkJ6lAKNTDLqnYMh9S0t?=

=?iso-8859-1?Q?hRLn3JrSXx7NtLL1fEb6s+IXfiJPBSeR+aJgDF1BCK6ab3gMFf1CwGiTuS?=

=?iso-8859-1?Q?Lh4g9b979aKb20KONr8cHttZNVkOhXF1hId9xQBeuUXuMbZtXXZqp6RH4N?=

=?iso-8859-1?Q?h/4VkPzFmuZgpIylrizNTiKnDCGmftfHbKCIIpCEPsb6lcDUrB8xEEa92L?=

=?iso-8859-1?Q?9ibZoCo8OJ962B9CoQ3uhuU2aY7y0QsEup3M0inxjzGRmy0TARpuuD9XWh?=

=?iso-8859-1?Q?AKA+XThW2LEiuWYJGV4N9SQ1+JrQ0wTCgJy5CW5EdVbqdBDrfABj9osWc+?=

=?iso-8859-1?Q?A0sXiy4tv9lnHsBGGBGNLKQ4879bmsk0w6aYm3U4qG5cL6NKVtyXo7bZ8p?=

=?iso-8859-1?Q?QXgOtfbNKHfxpKY1AXvOP1I+9sVUhMoGEg/2Ik6qeWIQOy8=3D?=

x-ms-exchange-antispam-messagedata-chunkcount: 1

x-ms-exchange-antispam-messagedata-0:

=?iso-8859-1?Q?Br9Tap21d1KUIlIN7rKQ6Rl2ogU4bMPIbhB7K7vNzqHHuWxYfvFibZkP4I?=

=?iso-8859-1?Q?Pu9fQAYCIGC409veVTbtjtp64HzbGCoAwWAwJZrWWay28LVHejeQ4WNc2l?=

=?iso-8859-1?Q?P5axCiQmX+K8tj2gp1I9q0zmuid/qAYgvPn2t3DH/jfiO00VHAiZdkyU01?=

=?iso-8859-1?Q?qth/l3AzfAOZqjxvL4oehSMWj7Q16dSHGmS8s9zhvg8a76IOeFFU8H4UvG?=

=?iso-8859-1?Q?+RGHxk1h+/D51+W19Xw7aVjEq9v2jcCHN5UYMOR4MPyYDHAKpRGOu2ebrY?=

=?iso-8859-1?Q?YtJQny2twF8S4j7TFKAwUl96BqrQ3FR5/4B86QXaC7n9JWsFmbNa9N4mef?=

=?iso-8859-1?Q?Wldnl3aJscIWcrz/nSBVUgsoL+dtDWeu/qIqOf3lukovWu4wxjseZV8Kzc?=

=?iso-8859-1?Q?4bNITE4vlSFPx234ASMThCLHCjk/TXexuhLnHcCRBSN4hJdIL+9xEMbqN5?=

=?iso-8859-1?Q?W4Npz0nuoiJh/1Z34VAFVlzZY7SAUbrF7VTkC9ZOwte6JC+/Eq2rs+TmLZ?=

=?iso-8859-1?Q?xtN5yL5TjJv5pL3x92W9F5mPHYRq7zi80X04js4BTxU0dG3ANSO0LajE2Y?=

=?iso-8859-1?Q?3BFcDcPep3QkVlRb6sEWczwxkDUWe18336GjMt7kxpIadhAtkPnXasYydz?=

=?iso-8859-1?Q?lVSmRY8Zu1AQeHr58VkTmlzheQTBXseUvfvI5KfoTsVIGAWDokAZkaUZ/f?=

=?iso-8859-1?Q?jELdMh6pu3b/t9PqNs755svhR05JH/mbFgnnGZVZZuS+1rc3nWM5M4FjCZ?=

=?iso-8859-1?Q?dTh+yf+ekJoXL987q3jEkBXJib4dJAfn/dBcUDyChh3qd/sko5133vGwl7?=

=?iso-8859-1?Q?MBLouJYlELcgot/DtkghesnoJeD+nn38g2jsjOTG6bcdes75i3UqxEwJ4g?=

=?iso-8859-1?Q?EVZrX1jIpY3YMJLdiOEJ2yUbddHgONam7tk+3jlQyfZl+mmcVAJ426CuMv?=

=?iso-8859-1?Q?WDXkgkB35zM5c6c77Fkhe95f9WVzCrqwCseGPwrEYkqJK4nNfAlHt1PD3a?=

=?iso-8859-1?Q?4Yot2SCk2aGO2zOLgWIC6YqRqC43qH7z1WnJKbnKHyiEqCYGrFRFloH80m?=

=?iso-8859-1?Q?gxABS4VowUzGsdCpNxb+u6CYsFWpgRyNyproZoeI/4DXbf9N13Nqo1CmCu?=

=?iso-8859-1?Q?buO9RBpzQxu6HzYr++4om9teE0wvGMBqsxdDGzEHqBwob6c22cW6/SDOhF?=

=?iso-8859-1?Q?tR1kzAaKoym0OFQKTD4Ax7kOHkSi4leoqO4YMIYySK8fSW5P24PgVfejYg?=

=?iso-8859-1?Q?ZPoV24uj7GoXFWjvJ/0gO3ewCa+0xliad/p9Cept9yntyhvgNXgawAvGa0?=

=?iso-8859-1?Q?FOJoil1R5ASlZ+Jh50tnSdVAeFTXFYGUZi5NFYJy73l/4k0n8o0NkilyQE?=

=?iso-8859-1?Q?AXsefbDkS6/8YA7K7XNHmXDOvgyLQSprSbrtYHnyq79vNuFR9O71N978AB?=

=?iso-8859-1?Q?ELERLtNS1Q0P7bUO+gF0QjdiIHwBoRjTRtB4AzezsCYXF5b8A5rJiyOhf6?=

=?iso-8859-1?Q?3yznGc683dOHoqVyTtkSY8?=

Content-Type: multipart/alternative;

boundary="_000_CH3PR17MB638806E08B4296FEB9A43284FD2D2CH3PR17MB6388namp_"

MIME-Version: 1.0

X-OriginatorOrg: outlook.com

X-MS-Exchange-CrossTenant-AuthAs: Internal

X-MS-Exchange-CrossTenant-AuthSource: CH3PR17MB6388.namprd17.prod.outlook.com

X-MS-Exchange-CrossTenant-RMS-PersistedConsumerOrg: 00000000-0000-0000-0000-000000000000

X-MS-Exchange-CrossTenant-Network-Message-Id: 625ceac3-7d34-4e32-b6ed-08dea09cde63

X-MS-Exchange-CrossTenant-originalarrivaltime: 22 Apr 2026 18:27:53.9005

(UTC)

X-MS-Exchange-CrossTenant-fromentityheader: Hosted

X-MS-Exchange-CrossTenant-id: 84df9e7f-e9f6-40af-b435-aaaaaaaaaaaa

X-MS-Exchange-CrossTenant-rms-persistedconsumerorg: 00000000-0000-0000-0000-000000000000

X-MS-Exchange-Transport-CrossTenantHeadersStamped: DS4PR17MB7553

--_000_CH3PR17MB638806E08B4296FEB9A43284FD2D2CH3PR17MB6388namp_

Content-Type: text/plain; charset="iso-8859-1"

Content-Transfer-Encoding: quoted-printable

Hello,

I found your website on Google and can help improve its ranking to page one=

, bringing you more customers.

Can I share a quick SEO Proposal and Pricing?

Thanks,

Web/SEO/App spam from Microsoft Outlook Part 2

Posted by Dave Yadallee on Wednesday, April 22. 2026

--_000_CH3PR17MB638806E08B4296FEB9A43284FD2D2CH3PR17MB6388namp_

Content-Type: text/html; charset="iso-8859-1"

Content-Transfer-Encoding: quoted-printable

1">

nt, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; c=

olor: rgb(0, 0, 0);">

Hello,

_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb=

(0, 0, 0);">

_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb=

(0, 0, 0);">

I found your website on Google and can help improve its ranking to page one=

, bringing you more customers.

_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb=

(0, 0, 0);">

_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb=

(0, 0, 0);">

Can I share a quick SEO Proposal and Pricing?

_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb=

(0, 0, 0);">

_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb=

(0, 0, 0);">

Thanks,

--_000_CH3PR17MB638806E08B4296FEB9A43284FD2D2CH3PR17MB6388namp_--

Chinese Products spam Part 2

Posted by Dave Yadallee on Wednesday, April 22. 2026

color: windowtext">

16px">Manufacturing Mode

: 1px;border-width: 1px;border-color: windowtext">

y:=E5=AE=8B=E4=BD=93;font-size:16px">Fully in-house design, machining, welding=

, assembly, and testing

"padding: 1px;border-width: 1px;border-color: windowtext">

nt-family:=E5=AE=8B=E4=BD=93;font-size:16px">Core Engineering Team

<=

/td>
: windowtext">

>Senior engineer leading development projects since 2007

<=

tr>
windowtext">

=

Export Markets

er-width: 1px;border-color: windowtext">

=E4=BD=93;font-size:16px">Middle East, Europe, Asia, South America, Africa
an>

1px;border-color: windowtext">

;font-size:16px">Main Machine Categories

style=3D"padding: 1px;border-width: 1px;border-color: windowtext">

le=3D"font-family:=E5=AE=8B=E4=BD=93;font-size:16px">Roof & wall sheet rol=

l forming machines (IBR, trapezoidal, corrugated, tile)

r>
windowtext">

S=

tructural Machines

border-width: 1px;border-color: windowtext">

=8B=E4=BD=93;font-size:16px">C & Z purlin roll forming machines (adjustabl=

e & fixed size)

ding: 1px;border-width: 1px;border-color: windowtext">

amily:=E5=AE=8B=E4=BD=93;font-size:16px">Sandwich Panel Production Lines
>

-color: windowtext">

:16px">Rock wool, glass wool, EPS and PU sandwich panel lines

<=

/tr>
olor: windowtext">

6px">Auxiliary Equipment

: 1px;border-width: 1px;border-color: windowtext">

y:=E5=AE=8B=E4=BD=93;font-size:16px">Decoilers, hydraulic punching systems, fl=

ying cutters, automatic stackers

style=3D"padding: 1px;border-width: 1px;border-color: windowtext">

yle=3D"font-family:=E5=AE=8B=E4=BD=93;font-size:16px">Structural Processing
pan>

der-color: windowtext">

ize:16px">13m gantry milling machine ensuring frame precision =E2=89=A4 0.05 m=

m

idth: 1px;border-color: windowtext">

=BD=93;font-size:16px">Machine Frame

e=3D"padding: 1px;border-width: 1px;border-color: windowtext">

"font-family:=E5=AE=8B=E4=BD=93;font-size:16px">Heavy-duty frame using 200=C3=97=

100 mm square tubes with CO=E2=82=82 shielded welding

=

ndowtext">

Sur=

face Treatment

er-width: 1px;border-color: windowtext">

=E4=BD=93;font-size:16px">Shot blasting and electrostatic powder coating for d=

urability

border-width: 1px;border-color: windowtext">

=8B=E4=BD=93;font-size:16px">Electrical Control

enter" style=3D"padding: 1px;border-width: 1px;border-color: windowtext">

pan style=3D"font-family:=E5=AE=8B=E4=BD=93;font-size:16px">PLC system design =

and programming completed in-house

r" style=3D"padding: 1px;border-width: 1px;border-color: windowtext">

style=3D"font-family:=E5=AE=8B=E4=BD=93;font-size:16px">Assembly Process
>

-color: windowtext">

:16px">Complete machine alignment and full testing before shipment

<=

/td>
der-color: windowtext">

ize:16px">Production Integration

"padding: 1px;border-width: 1px;border-color: windowtext">

nt-family:=E5=AE=8B=E4=BD=93;font-size:16px">Ability to design and supply comp=

lete roll forming production lines

n style=3D";font-family:Calibri;font-size:16px">Rather than supplying individu=

al machines only, we focus on providing stable and integrated roll forming sol=

utions that support long-term production requirements.

e=3D";font-family:Calibri;font-size:16px">If you are planning to expand your p=

roduct range or introduce new roll forming equipment, we would be glad to lear=

n more about your production needs and explore how our manufacturing capabilit=

y could support your projects.

i;font-size:16px">Best regards,

ri;font-size:16px">Jarvis
16px">
Xinnuo M=

achinery

What=

sApp: +86 188 3070 9860

Chinese Products spam Part 1

Posted by Dave Yadallee on Wednesday, April 22. 2026

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Wed, 22 Apr 2026 09:50:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1wFZpk-00000000EBJ-0mZL

for dave@doctor.nl2k.ab.ca;

Wed, 22 Apr 2026 09:49:48 -0600

Resent-From: The Doctor

Resent-Date: Wed, 22 Apr 2026 09:49:48 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from out197-85.us.a.dm.aliyun.com ([47.90.197.85]:24135)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1wFZGe-00000000AUE-44PF

for root@nk.ca;

Wed, 22 Apr 2026 09:13:42 -0600

X-AliDM-RcptTo: cm9vdEBuay5jYQ==

Feedback-ID: default:vip@vip.rollermachinery.ltd:vip_edm_WebBatch:454356

DKIM-Signature:v=1; a=rsa-sha256; c=relaxed/relaxed;

d=vip.rollermachinery.ltd; s=aliyun-cn-hangzhou;

t=1776870701; h=Date:From:To:Message-ID:Subject:MIME-Version:Content-Type;

bh=ItIwiRGMNQlsdNgtAIkDNb8M+m0R9kvChuR0LK8DgFA=;

b=bJOl787asjKOp6knX2FhUs8/8eWUDbGhujXqyeOWrpDgm+OwsL1SmoVdZbbmoDHYlwKPapBelsNmlx5f/Zd9leI1T/PTEyU1yRkRp0KdE8wiaLBmrcqvQb9WNwJN4ZCWaJWu7ycgWSiUsu6nHRNx6vRn6DJ7fGukhg9onbWcja8=

DKIM-Signature:v=1; a=rsa-sha256; c=relaxed/relaxed;

d=dm-fbl.aliyuncs.com; s=feedback;

t=1776870701; h=Date:From:To:Message-ID:Subject:MIME-Version:Content-Type;

bh=ItIwiRGMNQlsdNgtAIkDNb8M+m0R9kvChuR0LK8DgFA=;

b=pPYbp1vfpha7txHlgORg+lZuZjlQ5dovB6oPX+9A5u6fnrNrcWVG7x3WeTVi+7kmItUSsFKbw6QknBerNIrID0DbFLbOoUxS0ggSRGoM+HdACVI0PTnRzevNaGYc2Z6vyT6LcCz0PB4fg2ouyCgKtNHJVT5nBgkFWuU2lShNaQ0=

Received: from chitu-hsf(mailfrom:vip@vip.rollermachinery.ltd fp:ma_600000297384119787 cluster:AY35D)

by smtp.aliyun-inc.com(127.0.0.1);

Wed, 22 Apr 2026 23:10:31 +0800

Date: Wed, 22 Apr 2026 23:10:31 +0800

From: "JARVIS"

To:

Reply-To:

Message-ID:

Subject: =?UTF-8?B?Um9sbCBGb3JtaW5nIE1hY2hpbmVyeQ==?=

X-Priority: 3

MIME-Version: 1.0

X-EnvId: 600000297384119792

X-AliDM-Settings: eyJPdXRib3VuZElwIjp7IklwTGlzdCI6W10sIklwUG9vbElkIjoiIn0sIlVuc3Vic2NyaWJlIjp7IkZpbHRlckxldmVsIjoiZGVmYXVsdCIsIkxpbmtUeXBlIjoiZGVmYXVsdCJ9LCJWZXJzaW9uIjoiMS4wIn0=

Content-Type: text/html; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable

X-Spam_score: 9.1

X-Spam_score_int: 91

X-Spam_bar: +++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.

Content preview: Dear Sir / Madam, I hope you are doing well.

Content analysis details: (9.1 points, 5.0 required)

pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[47.90.197.85 listed in dnsbl.ahbl.org]

[47.90.197.85 listed in dnsbl.ahbl.org]

[47.90.197.85 listed in dnsbl.ahbl.org]

[47.90.197.85 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[47.90.197.85 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[47.90.197.85 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[47.90.197.85 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[47.90.197.85 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[47.90.197.85 listed in will-spam-for-food.eu.org]

[47.90.197.85 listed in will-spam-for-food.eu.org]

[47.90.197.85 listed in will-spam-for-food.eu.org]

[47.90.197.85 listed in will-spam-for-food.eu.org]

[47.90.197.85 listed in will-spam-for-food.eu.org]

[47.90.197.85 listed in will-spam-for-food.eu.org]

[47.90.197.85 listed in will-spam-for-food.eu.org]

[47.90.197.85 listed in will-spam-for-food.eu.org]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[47.90.197.85 listed in list.dnswl.org]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

0.9 SPF_FAIL SPF: sender does not match SPF record (fail)

[SPF failed: Rejected by SPF record.]

0.4 SALES_REPLY Your parents named you sales?

1.7 DEAR_SOMETHING BODY: Contains 'Dear (something)'

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[47.90.197.85 listed in bl.score.senderscore.com]

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 HTML_MESSAGE BODY: HTML included in message

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 MIME_QP_LONG_LINE RAW: Quoted-printable line longer than 76 chars

2.0 RATWR8_MESSID Message-ID with excessive dashes and dollars

0.0 UNPARSEABLE_RELAY Informational: message has unparseable relay lines

0.6 HTML_MIME_NO_HTML_TAG HTML-only message, but there is no HTML tag

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

1.0 XPRIO Has X-Priority header

Subject: {SPAM?} =?UTF-8?B?Um9sbCBGb3JtaW5nIE1hY2hpbmVyeQ==?=

Dear Sir / Madam,
>

I hope you are doi=

ng well.

In t=

he roll forming machinery industry, the long-term performance of equipment dep=

ends not only on the machine itself, but also on the manufacturing capability =

behind it =E2=80=94 including engineering design, machining precision, structu=

ral stability, and production integration.

amily:Calibri;font-size:16px">Allow me to briefly introduce our factory and ou=

r manufacturing capabilities.

style=3D";margin-left:3px;margin-left:9px;margin-right:9px;border-left:1px sol=

id windowtext;border-top:1px solid windowtext;border-right:1px solid windowtex=

t;border-bottom:1px solid windowtext">=

Domain for Sale Spam from Google Gmail Part 2

Posted by Dave Yadallee on Wednesday, April 22. 2026

> On Fri, 10 Apr 2026, 5:22=E2=80=AFpm , wrote=

:

>

>> Hello,

>>

>> I wanted to let you know that the premium domain

>>

>> VoipEdmonton.com is available for purchase at Godaddy.

>>

>> This domain would be really good for attracting clients looking for your

>> VOIP IN EDMONTON.

>>

>> If the domain is developed or redirected to your current website, it

>> would be extremely beneficial to your company and services in terms of

>> catching more leads and clients while retaining your brand identity.

>>

>> You can get this domain for $650 at www.VoipEdmonton.com right now.

>>

>> Best Regards,

>>

>> Nicholas.

>>

>

--00000000000048bd0c06500da616

Content-Type: text/html; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable

Hello,

>

We sent you an email recentl=

y and never heard back. We=E2=80=99ve scheduled a 24-hour discount for the =

domain name, and we would like to know if there is any interest here.

=

T=

he domain can be developed or redirected to your current website to increas=

e visibility with its keywords in EDMONTON and its environs.

=3D"auto">

We have a=

lso reduced the price of the domain to $550 only.

r>

To get it now, go to=

=C2=A0

www.V=

oipEdmonton.com

Do let me know if you have any q=

uestions!

dir=3D"auto">We await your response.

dir=3D"auto">

Stay Safe.

ass=3D"gmail_quote gmail_quote_container">

ttr">On Tue, 14 Apr 2026, 5:18=E2=80=AFpm Nichoas Louis, <
lto:nicholaslouis.co@gmail.com">nicholaslouis.co@gmail.com> wrote:
r>

-left:1px #ccc solid;padding-left:1ex">
=

Good morning,

=

What do you think about the website domaihn name=C2=A0
iv>

nk" rel=3D"noreferrer">www.VoipEdmonton.com?

>

Do you have any intere=

st?

=3D"auto">Will you be considering this offer?

div>

You can also let me know =

your best offer, and we=E2=80=99ll work together to find a mutually agreeab=

le price. If no interest please let me know so I don=E2=80=99t follow up fu=

rther.

r=3D"auto">We sincerely appreciate your response.

r>

With best wishes,
v>

">On Fri, 10 Apr 2026, 5:22=E2=80=AFpm , <
s.co@gmail.com" target=3D"_blank" rel=3D"noreferrer">nicholaslouis.co@gmail=

.com> wrote:

gin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">

Hello,

I wanted to let you know that the prem=

ium domain

VoipEdmonton.com is available for purch=

ase at Godaddy.

This domain would be really good f=

or attracting clients looking for your
VOIP IN EDMONTON.

v>
If the domain is developed or redirected to your current w=

ebsite, it would be extremely beneficial to your company and services in te=

rms of catching more leads and clients while retaining your brand identity.=

You can get this domain for $650 at
tp://www.VoipEdmonton.com" rel=3D"noreferrer noreferrer" target=3D"_blank">=

www.VoipEdmonton.com right now.

Best Regards,<=

/div>

Nicholas.

o_gmail_com-dot-mmanalytics2.appspot.com/em_oBUPlK7Pew7e5btd2Kul/comet.gif"=

style=3D"display:none!important">

--00000000000048bd0c06500da616--

Domain for Sale Spam from Google Gmail Part 1

Posted by Dave Yadallee on Wednesday, April 22. 2026

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Wed, 22 Apr 2026 09:50:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1wFZpe-00000000EB1-0RaM

for dave@doctor.nl2k.ab.ca;

Wed, 22 Apr 2026 09:49:42 -0600

Resent-From: The Doctor

Resent-Date: Wed, 22 Apr 2026 09:49:41 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-yw1-f170.google.com ([209.85.128.170]:53369)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1wFYuy-000000008hN-2ksE

for root@nk.ca;

Wed, 22 Apr 2026 08:51:16 -0600

Received: by mail-yw1-f170.google.com with SMTP id 00721157ae682-79a2ee65171so73455507b3.2

for ; Wed, 22 Apr 2026 07:50:21 -0700 (PDT)

ARC-Seal: i=1; a=rsa-sha256; t=1776869415; cv=none;

d=google.com; s=arc-20240605;

b=CMNsUprueFZJa3Q6/HENCxDIvzkLxB5U9F3lXjqLniPMgfI8eTPaqkpRVBPsV7Yqwk

jznywDNN9cO8Bzk+/jdoEX61ot5rKsc0FzLrhfPmao0TrrrVncTADs1c4/KowzsQvtaB

DiUYzwa3vzek7NqcMwilh9pY80co9KW7Gsb3P+0zxJkAGTyVlA8Rj6LJEq97SgC9+nUq

svo28xJNoG7bV+Woma1c91yBwdASbTwojsMjLjrXpS8zkdCUFE61x4QK9TA0JAja5RTY

8MARSswabrrmUvmIhdxEMqlZ/fZPlidVALYuALsEKxK7aMpOGEhhcN5wIlJUOUPNwaLZ

9yOg==

ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20240605;

h=to:subject:message-id:date:from:in-reply-to:references:mime-version

:dkim-signature;

bh=EEcmsmi5Ig/CZHwr430b+LKypvX6Q/EdKQVRx6fdtkk=;

fh=ny7+SATv4n6lSNl0rVMQyaj6POVJTUZJLShjjgjSTJg=;

b=WAnRH363NO6YCpDDDIseIC80xdwFwEWDCUwVif32jeYmDRpCk6XAy71KyW/C6QZq9v

Hf2qNCm4XjAp67cqWbXaYgOTNYCM4Sozin24/8Mhza4JPg/B1heC3cuzuomSjm/xZSyR

JpSovapnGFK4hQQvTzZv6lliSJrpRpYqHq3P0WTgDCjbEiwyEYp4hm9eop8OlLZ1djX7

FS/JvB5iUaiYyt2gMvXsBrKibMckTjdJ5Iw65pgRTeA8kueyMBE40GJ9QBSjcgKXT5In

ilHQCUP1s523s5c6VLPFSvyyrD6yozUBehF8gMWz3D4K0UGdu+n/dLiinX2uqQaKdnAl

jWPA==;

darn=nk.ca

ARC-Authentication-Results: i=1; mx.google.com; arc=none

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=gmail.com; s=20251104; t=1776869415; x=1777474215; darn=nk.ca;

h=to:subject:message-id:date:from:in-reply-to:references:mime-version

:from:to:cc:subject:date:message-id:reply-to;

bh=EEcmsmi5Ig/CZHwr430b+LKypvX6Q/EdKQVRx6fdtkk=;

b=Tln7agSWRUBBAb6f8CVsAF8okNtKDETdxTDSMezKwv7W3E2TEzrKfy1n6hqtjUvQ5H

0m/2kxkAQxsQaTom9QJ1jQckiN9bL0e3fYgB+MxwByK0OimwpmCWU7dY7J2owcK+qLDE

ap+7EqywB5RKLdejaX9TU8QwX18KNMfNZ7vVcrzk4N1U2+Fdmg4urbd1a6STr4adRz2f

SQzN8kTjyy/X6prfAQ1hM9b8KY5DL13WTm41QnzJ2DVzkmHqyYBi2jSUJPoissMfz27h

SAsytSpJjsqBK57+zzfC4+1CyW1ajvYkeJRHEaaBuH//0AT5hl9/RUA304YbXywyOOgD

i3cg==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20251104; t=1776869415; x=1777474215;

h=to:subject:message-id:date:from:in-reply-to:references:mime-version

:x-gm-gg:x-gm-message-state:from:to:cc:subject:date:message-id

:reply-to;

bh=EEcmsmi5Ig/CZHwr430b+LKypvX6Q/EdKQVRx6fdtkk=;

b=p/hiYwXQd2WlbF7S7VjZ716bADsuWWT7Ll0MNL55sAW2dvnMC/FL8tyD3D7UekUMNy

z2KhdS96KEe8DxVhK87BwOcbscPadrN6cRuI5GGvizWhevL19jFKmbUeSRJILfQIsn4k

hKVDZlQDccqmUfuLaePGB5k+0Xm+On+9mzzOftpl+gJfjmYtKRymBMVbXqEWOMcmoei9

8eqMw2vtPOkQT/cGkD51Go0iDRlTY4KO6c5ZvBTxg6d7luwNC6Q1FMiL4A2ako09LJf4

q9LWuS6NtnXWQsBQSbaqLubqkDNqyNvRs56znMVA3EwNlh8LIp7sgZJ/+c4pDbivRvSR

TOoQ==

X-Gm-Message-State: AOJu0YyrGcK/37QMNh+djK4Fbjdx1kR1L+/xZdQxCrHOvqHaypUZeMds

r/cJPUXR13yBcfYC4Sai5tTIuzyaOePoJNeOb1Nui26AKveSBbPb+kqRnSFLSwIOCxWY8hqT90S

87qa3SJ5quw57v0IUb0ZkYKgjtoWieASpUTSo

X-Gm-Gg: AeBDieuroyOcWliHgjb8+pJs7dl8DOZa0EZ6Ybphz2S4LczIvZ+j/AfJpsrzkx/mule

FTGHN+qG4aIU4fjPJoSzS96BCa/CYCUv5nCnbDUV2UudXg/gOTx1Kx6qn1fZto7dAhzyyzD4vom

/M78BNjwVwCwLJ13KMNiR4iSyStB4oXSLhxKQaFZyz7AOE7aZzMCICCeaxnYXv0fVhDrFEEEdNS

zOhjPg5kKkHTng+AcQ83pBBHm/P5iHPhw+tao/fMDQG5a25ILJs9hCYCPatxDBPPRWmuGrTaOJn

KxXDuws2NGjFQKkGA03Gb5U=

X-Received: by 2002:a05:690c:112:b0:7a2:ce0e:865c with SMTP id

00721157ae682-7b9ecfdb8efmr229845777b3.37.1776869414844; Wed, 22 Apr 2026

07:50:14 -0700 (PDT)

MIME-Version: 1.0

References:

In-Reply-To:

From: Nichoas Louis

Date: Wed, 22 Apr 2026 15:50:01 +0100

X-Gm-Features: AQROBzBpr3USaUYZ3jnsjfrLIJ38YgjvPZtvqXmQj6-IQjh37VXJB-FLSDSONrk

Message-ID:

Subject: Re: VOIP IN EDMONTON

To: root@nk.ca

Content-Type: multipart/alternative; boundary="00000000000048bd0c06500da616"

--00000000000048bd0c06500da616

Content-Type: text/plain; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable

Hello,

We sent you an email recently and never heard back. We=E2=80=99ve scheduled=

a

24-hour discount for the domain name, and we would like to know if there is

any interest here.

The domain can be developed or redirected to your current website to

increase visibility with its keywords in EDMONTON and its environs.

We have also reduced the price of the domain to $550 only.

To get it now, go to

www.VoipEdmonton.com

Do let me know if you have any questions!

We await your response.

Stay Safe.

On Tue, 14 Apr 2026, 5:18=E2=80=AFpm Nichoas Louis,
.com>

wrote:

> Good morning,

>

>

> What do you think about the website domaihn name

> www.VoipEdmonton.com?

>

>

> Do you have any interest?

>

>

> Will you be considering this offer?

>

>

> You can also let me know your best offer, and we=E2=80=99ll work together=

to find

> a mutually agreeable price. If no interest please let me know so I don=E2=

=80=99t

> follow up further.

>

>

> We sincerely appreciate your response.

>

>

> With best wishes,

>

Domain Name Spam from Google Mail Part 2

Posted by Dave Yadallee on Wednesday, April 22. 2026

>

> On Fri, 10 Apr 2026, 5:21=E2=80=AFpm , wrote=

:

>

>> Hello,

>>

>> I wanted to let you know that the premium domain

>>

>> VoipEdmonton.com is available for purchase at Godaddy.

>>

>> This domain would be really good for attracting clients looking for your

>> VOIP IN EDMONTON.

>>

>> If the domain is developed or redirected to your current website, it

>> would be extremely beneficial to your company and services in terms of

>> catching more leads and clients while retaining your brand identity.

>>

>> You can get this domain for $650 at www.VoipEdmonton.com right now.

>>

>> Best Regards,

>>

>> Nicholas.

>>

>

--0000000000000008b406500da51c

Content-Type: text/html; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable

Hello,

>

We sent you an email recentl=

y and never heard back. We=E2=80=99ve scheduled a 24-hour discount for the =

domain name, and we would like to know if there is any interest here.

=

T=

he domain can be developed or redirected to your current website to increas=

e visibility with its keywords in EDMONTON and its environs.

=3D"auto">

We have a=

lso reduced the price of the domain to $550 only.

r>

To get it now, go to=

=C2=A0

www.V=

oipEdmonton.com

Do let me know if you have any q=

uestions!

dir=3D"auto">We await your response.

dir=3D"auto">

Stay Safe.

ass=3D"gmail_quote gmail_quote_container">

ttr">On Tue, 14 Apr 2026, 5:18=E2=80=AFpm Nichoas Louis, <
lto:nicholaslouis.co@gmail.com">nicholaslouis.co@gmail.com> wrote:
r>

-left:1px #ccc solid;padding-left:1ex">
=

Good morning,

=

What do you think about the website domaihn name=C2=A0
iv>

nk" rel=3D"noreferrer">www.VoipEdmonton.com?

>

Do you have any intere=

st?

=3D"auto">Will you be considering this offer?

div>

You can also let me know =

your best offer, and we=E2=80=99ll work together to find a mutually agreeab=

le price. If no interest please let me know so I don=E2=80=99t follow up fu=

rther.

r=3D"auto">We sincerely appreciate your response.

r>

With best wishes,
v>

">On Fri, 10 Apr 2026, 5:21=E2=80=AFpm , <
s.co@gmail.com" target=3D"_blank" rel=3D"noreferrer">nicholaslouis.co@gmail=

.com> wrote:

gin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">

Hello,

I wanted to let you know that the prem=

ium domain

VoipEdmonton.com is available for purch=

ase at Godaddy.

This domain would be really good f=

or attracting clients looking for your
VOIP IN EDMONTON.

v>
If the domain is developed or redirected to your current w=

ebsite, it would be extremely beneficial to your company and services in te=

rms of catching more leads and clients while retaining your brand identity.=

You can get this domain for $650 at
tp://www.VoipEdmonton.com" rel=3D"noreferrer noreferrer" target=3D"_blank">=

www.VoipEdmonton.com right now.

Best Regards,<=

/div>

Nicholas.

o_gmail_com-dot-mmanalytics.appspot.com/em_GrGDVVfCnSWAX8pOmpL6/asteroid.gi=

f" style=3D"display:none!important">

--0000000000000008b406500da51c--

Domain Name Spam from Google Mail Part 1

Posted by Dave Yadallee on Wednesday, April 22. 2026

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Wed, 22 Apr 2026 09:50:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1wFZpZ-00000000EAg-3bUz

for dave@doctor.nl2k.ab.ca;

Wed, 22 Apr 2026 09:49:37 -0600

Resent-From: The Doctor

Resent-Date: Wed, 22 Apr 2026 09:49:37 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-yw1-f169.google.com ([209.85.128.169]:43462)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1wFYue-000000008ej-0rVe

for sales@nk.ca;

Wed, 22 Apr 2026 08:50:57 -0600

Received: by mail-yw1-f169.google.com with SMTP id 00721157ae682-79db5e18ac6so67625497b3.1

for ; Wed, 22 Apr 2026 07:50:00 -0700 (PDT)

ARC-Seal: i=1; a=rsa-sha256; t=1776869393; cv=none;

d=google.com; s=arc-20240605;

b=YoUdU330u8w1BuyfJqYVdoEM1ZgPGk5EJhZoLy1y4NJstcC9vQzXKEn7FCq5YnmiSX

lSTwXmYaAEs2FhyxnKAGedmkUaTS44pTSMWhGy7U/zt7X7UiUAUgmsxt5rE4TkhU22B8

Aaz7U5P2f83hsaYFOl9e7+VI0S6Dkw5/Js/y4y1FXMaEqQLgk5AJAUIQwv/GMiNM/CZW

vqBL7PVfZkTDbiOGa4nAW46iLwsEACu5GUSOOPk1uamxfyQ5GPOiHu0owqG7+IGaKk1p

MuF8kOh/YedtDXeezZ71UjjAjNOu7n2yf+a2fzX94jBCyuI0p9SFHhae3xC4yNzw19FJ

3oKg==

ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20240605;

h=to:subject:message-id:date:from:in-reply-to:references:mime-version

:dkim-signature;

bh=bPAaLiYbvRpEVGFCu/wTZlqwSC7G4/OUkGOJOCQxhLg=;

fh=C4vsnDG7cTH8aa/8f7sygxKSfblX4MPDg6mph8A3jUw=;

b=DRY8+akh52Ngatee0ErPrTs9oKrjMeL50n6PqcIJJpXEfaJIzj7HFd6TXX+vmgmO92

+hmDFoRu04RT64tsCdI7g38IGHb74JspR3h1eDFJE38CLnxnOiYU/tbUDSFvl2I9kJsH

UbByl6Z0V4UlVhwCPWO+0ypRPg5GJYJcPt1A9wg77DDKmcnEwd/jYNS8HYi7e+9cYkor

6KNJG9zeyXRsOZ/FNO7+0UDcCbnw2h1dHKJ9SHgAxWaSh+K4pQ+yeyh5qKY6dNyEP/VD

iB7sxy11YMvTxad5+IxMCvdAJTY4fyIYdRElnU4R+9E8iuVm+flsb3TgqJdxaFVGq6sd

a/UQ==;

darn=nk.ca

ARC-Authentication-Results: i=1; mx.google.com; arc=none

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=gmail.com; s=20251104; t=1776869393; x=1777474193; darn=nk.ca;

h=to:subject:message-id:date:from:in-reply-to:references:mime-version

:from:to:cc:subject:date:message-id:reply-to;

bh=bPAaLiYbvRpEVGFCu/wTZlqwSC7G4/OUkGOJOCQxhLg=;

b=FEkDHZD5dn7cI8Lx42iJ+VDc6nNRAA/RK+Bqu1uiBd+l9YDjvcUoHxE2yQgTodcjrV

b6Tz1sDhGczQ+m177aPX7kH9a05egNi5Xjy6ToOJiD5cOdr6bx1+odJpuqil2wwSMgMn

KbomxgXvfC25FFGGNfuWe2mxnabaWdsVGeDx7rPc/UQ3UgC5VmAgK8h14gdkr+g1hATu

/MVj+nXKyohxve5vqSFcdIEE1Ded06F9bT9FDDsM8lXfn9SfMpBUnD6pPqwgdvieNSig

G1KxUA56ztW5eJ3g4ffXhHtyq/Y0Ixed6Gb+XYLX2jWTSSXItTzJS3oeV8nruQhyfOPc

KFuA==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20251104; t=1776869393; x=1777474193;

h=to:subject:message-id:date:from:in-reply-to:references:mime-version

:x-gm-gg:x-gm-message-state:from:to:cc:subject:date:message-id

:reply-to;

bh=bPAaLiYbvRpEVGFCu/wTZlqwSC7G4/OUkGOJOCQxhLg=;

b=a9xiEzw8jw9mSwssIsSQqy/oK/5ncdq3trHEdYX+Jz1pshj0V+Zaaarg6tmq2BugHg

idmIWRvLd40EOBDoG9jUa8KfS4GXqnJTVa6t5WMazs2ead90JBGn9+XZ0rjNA6wNFV8P

ekszzYCNnrjHBMSCDXxgmiEvYh13cNbns1Wv/SlzhTkNszMTV+aref5/Zk3WKqh4XA0L

xQ97h+Pnm5wUAZU980OV9tf2XropLTs/8e7eupcv/b1kK2Oc5liJVvKsRBhcIeN7BEST

rwMraQ3/W61AC8aduPKu1b/tkn7yyYq3RG212pRrGl6XBwtilaQEuM1AoVuPC9zzp0fq

lQgQ==

X-Gm-Message-State: AOJu0YxerZ+FuvUlAJhFvVk0PPMW8DMdGC2zsbgYN1Qx3CcJEgGypH5p

MCtDkta2Ca/su9i8cV0s7sm8lt181tbTkm0wC76Qv+DzD7+uui9GVZWx+wIGQ4LL5/uEWnUMyl0

bZdheG3CL9B4yuNxceyrXGqnIx4XpO3LnqOCi

X-Gm-Gg: AeBDiet+8isO5L3tKuAUfPtpokQszp8OMMzMeVuGiwScx+EcCuv6zvRMUbaXIoOXstu

xbA0ck8ntwjxLVcuEYhN+9iUJNKFI1h/g51bVBqb/Y0jUftvGB03GW8Vv24p97GYKFiwGF8+lW2

8DUAe2bg1Txt5fY+WzvIpQg0gJJXVHl/sfhVTks4HmrTgifMeRM420UYtIUXhWAUPNHX6K7CE4B

+Bh8R0AfTuAX3UIIlBKKKWzOINtFOsPFStc5zpnqz7dpBcGrOhOcG+0FalrEkvKdU2FxWgiBYhP

IIyo4t052hM7Ut0gjXzDPFk=

X-Received: by 2002:a05:690c:c50e:b0:7b4:1394:4104 with SMTP id

00721157ae682-7b9ed2c71f9mr175103547b3.9.1776869393302; Wed, 22 Apr 2026

07:49:53 -0700 (PDT)

MIME-Version: 1.0

References:

In-Reply-To:

From: Nichoas Louis

Date: Wed, 22 Apr 2026 15:49:40 +0100

X-Gm-Features: AQROBzA0369IotKTAfcM8MsrZDY2P66gNYQhP9ypChbSxAJgOXMugzZ8st1jvts

Message-ID:

Subject: Re: VOIP IN EDMONTON

To: sales@nk.ca

Content-Type: multipart/alternative; boundary="0000000000000008b406500da51c"

--0000000000000008b406500da51c

Content-Type: text/plain; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable

Hello,

We sent you an email recently and never heard back. We=E2=80=99ve scheduled=

a

24-hour discount for the domain name, and we would like to know if there is

any interest here.

The domain can be developed or redirected to your current website to

increase visibility with its keywords in EDMONTON and its environs.

We have also reduced the price of the domain to $550 only.

To get it now, go to

www.VoipEdmonton.com

Do let me know if you have any questions!

We await your response.

Stay Safe.

On Tue, 14 Apr 2026, 5:18=E2=80=AFpm Nichoas Louis,
.com>

wrote:

> Good morning,

>

>

> What do you think about the website domaihn name

> www.VoipEdmonton.com?

>

>

> Do you have any interest?

>

>

> Will you be considering this offer?

>

>

> You can also let me know your best offer, and we=E2=80=99ll work together=

to find

> a mutually agreeable price. If no interest please let me know so I don=E2=

=80=99t

> follow up further.

>

>

> We sincerely appreciate your response.

>

>

> With best wishes,

"padding: 1px;border-width: 1px;border-color: windowtext"> ign:center"> 16px">Category	style=3D"padding: 1px;border-width: 1px;border-color: windowtext"> ;text-align:center"> t-size: 16px">Details
lign=3D"center" style=3D"padding: 1px;border-width: 1px;border-color: windowte= xt"> Company N= ame	px;border-color: windowtext"> font-size:16px">Xinnuo Machinery
style=3D"padding: 1px;border-width: 1px;border-color: windowtext"> yle=3D"font-family:=E5=AE=8B=E4=BD=93;font-size:16px">Factory Established n>	r-color: windowtext"> e:16px">1995
px;border-width: 1px;border-color: windowtext"> =AE=8B=E4=BD=93;font-size:16px">Manufacturing Experience	lign=3D"center" style=3D"padding: 1px;border-width: 1px;border-color: windowte= xt"> 30+ years= specializing in cold roll forming machinery
n=3D"center" style=3D"padding: 1px;border-width: 1px;border-color: windowtext"= > Annual Produ= ction Capacity	er-width: 1px;border-color: windowtext"> =E4=BD=93;font-size:16px">Approximately 1500 machines per year

Mon	Tue	Wed	Thu	Fri	Sat	Sun
← Back	April '26					Forward →
		1	2	3	4	5
6	7	8	9	10	11	12
13	14	15	16	17	18	19
20	21	22	23	24	25	26
27	28	29	30

Archives

Categories

Syndicate This Blog

Blog Administration

Powered by

NetKnow Navigation

Remote RSS/OPML-Blogroll Feed

Error

addthis

Empire Avenue

Error

Error

Error

Syndicate This Blog

Error

Error

Error

Error

Error

Error

Error

Error

Error

Error

Error

Error

Error

Error

Error