NetKnow Corporate Blog

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Tue, 14 Jul 2026 06:59:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wjcim-00000000AB0-2QGd

for dave@doctor.nl2k.ab.ca;

Tue, 14 Jul 2026 06:58:48 -0600

Resent-From: The Doctor

Resent-Date: Tue, 14 Jul 2026 06:58:48 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from [82.26.157.18] (port=47350 helo=mail.sylvalia.com)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wjYMv-000000007Zj-3Xel

for bin@nl2k.ab.ca;

Tue, 14 Jul 2026 02:20:06 -0600

From: Mr Owusu Kwesi

Date: Mon, 13 Jul 2026 17:34:24 -0700

Subject: Re Offer of Gold Bars for Sale

X-MS-Reactions: disallow

Message-Id:

To: bin@nl2k.ab.ca

Sender: Mr Owusu Kwesi

Reply-To: Mr Owusu Kwesi

MIME-Version: 1.0

Content-Type: text/plain; charset=utf-8

X-Spam_score: 9.2

X-Spam_score_int: 92

X-Spam_bar: +++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Dear Sir/Madam, We are pleased to offer for sale high-quality

gold bars mined directly from our concessions. The details of our product

are as follows: Commodity: Gold Form: Alluvial Bar Purity: 22+ Carat (94%)

Quantity Available: 4,000 kilograms Price: USD 95,000 per kilogram Origin:

Ghana Deleterious Elements: 0% Cyanide



Content analysis details: (9.2 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[82.26.157.18 listed in dnsbl.ahbl.org]

[82.26.157.18 listed in dnsbl.ahbl.org]

[82.26.157.18 listed in dnsbl.ahbl.org]

[82.26.157.18 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[82.26.157.18 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[82.26.157.18 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[82.26.157.18 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[82.26.157.18 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[82.26.157.18 listed in will-spam-for-food.eu.org]

[82.26.157.18 listed in will-spam-for-food.eu.org]

[82.26.157.18 listed in will-spam-for-food.eu.org]

[82.26.157.18 listed in will-spam-for-food.eu.org]

[82.26.157.18 listed in will-spam-for-food.eu.org]

[82.26.157.18 listed in will-spam-for-food.eu.org]

[82.26.157.18 listed in will-spam-for-food.eu.org]

[82.26.157.18 listed in will-spam-for-food.eu.org]

-0.0 SPF_PASS SPF: sender matches SPF record

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[82.26.157.18 listed in bl.score.senderscore.com]

0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in digit

[owusukwe65(at)gmail.com]

1.1 DATE_IN_PAST_06_12 Date: is 6 to 12 hours before Received: date

1.7 DEAR_SOMETHING BODY: Contains 'Dear (something)'

0.0 HK_NAME_MR_MRS No description available.

2.5 FREEMAIL_FORGED_REPLYTO Freemail in Reply-To, but not From

1.3 RDNS_NONE Delivered to internal network by a host with no rDNS

0.0 LOTS_OF_MONEY Huge... sums of money

0.0 MONEY_NOHTML Lots of money in plain text

1.0 FREEMAIL_REPLYTO Reply-To/From or Reply-To/body contain different

freemails

0.0 MONEY_FREEMAIL_REPTO Lots of money from someone using free email?

Subject: {SPAM?} Re Offer of Gold Bars for Sale



Dear Sir/Madam,



We are pleased to offer for sale high-quality gold bars mined directly from our concessions. The details of our product are as follows:



Commodity: Gold

Form: Alluvial Bar

Purity: 22+ Carat (94%)

Quantity Available: 4,000 kilograms

Price: USD 95,000 per kilogram

Origin: Ghana

Deleterious Elements: 0% Cyanide



A full corporate offer and detailed documentation can be provided upon request. We are committed to professional, secure, and transparent business transactions and would be glad to discuss further steps to facilitate this opportunity.



Please feel free to contact me via email at (kweo296@gmail.com)

or WhatsApp at (+233532452351) for additional information or to request our corporate offer.



Thank you for your time and consideration. We look forward to the possibility of working together.



Yours faithfully,



Owusu Kwesi

[Position, manager]

Tarkwa, Western Region, Ghana

Nisa Custom Internet Solutions

Nisa Custom Internet Solutions

ranks >2000000 from >2000000 by Netcraft

MediaShaker

Media Shakers of Edmonton

ranks >2000000 from >2000000

Koi Media

Koi Media

rank >2000000 from >2000000

WebFire

Webfire.ca

ranks >2000000 from >2000000 and seems to be connected with Shaw.

Core Network Solutions Inc.

Core Network Solutions Inc.

ranks at >2000000 from >2000000 .

The Network Centre

The Network Centre

ranks >2000000 from >2000000 and are linked with Telus high Speed.

Open Concept Internet, Inc.

Open Concept Internet, Inc.

rank > 2000000 from > 2000000

Techalta

Interspots of Edmonton

acquired by Techalta ;

Yegtel

Yegtel rank > 2000000 .

Internet Crossroads

Internet Crossroads Ltd of North Edmonton

rank nothing from nothing by Netcraft and seems to merged with Tera-Byte/ecn.ab.ca .



If I remember anymore, I will add to this entry, before Netcraft changes our ranking. Please watch this space and please feel free to peruse

our services.

All data is from Netcraft Toolbar .

Looks as if there are major changes to the Netcraft algorithm after some years! Why did Avast clasify the extension as URL:Phishing?

This is not the Alexa Tool Bar!

NetKnow

Netknow now at 28879 from 25755 at Netcraft and pfs compliant



A significant decrease! We must do

1. security audits regularly
2. check on illegitimate traffic hitting the web server


and
3. keep design current!

How do we compare with other providers in

Edmonton, Alberta, Canada?

Telus and reviews

Next we have Telus.com

ranked by Netcraft at 3547 from 3558 .

Sometimes their Web Hosting is done by
title="Internet Names for Business">Internet Names for Business

is ranked by Netcraft at >2000000 from >2000000 .



Is Telus's ADSL network susceptible to Code Red Attacks and Attackers?

Reviews of Telus are available :

• NCIX FORUMS



• DSL Reports

Rogers

Rogers Business Solutions

which rank 6411 from 6417 and are hosted in Europe.

Government of Alberta

The Government of Alberta Website

ranks 14167 from 14429 by Netcraft and seems to hosted on Cloudfare.

Netknow again

We at Netknow are at 28879 from 18857 since the start of 2026.

City of Edmonton

The City of Edmonton ranks 33553 from 32969 by Netcraft and hosted by Google.

University of Alberta

The University of Alberta ranks 45546 from 44917 hosted by Amazon Techonologies.

Juno and NetZero

We have Juno Internet ranked on top

at 439123 from 421100 who are the owners of

US Based Netzero at Netcraft Rank 95943 from 93111 .

NAIT / Northern Alberta Institute of Technology

NAIT ranks 146004 from 141954 hosted by Microsoft .

Grant MacEwen University

MacEwan ranks 171094 from 148120 .

TekSavvy

TekSavvy ranks 175559 from 177997 and are hosted by Microsoft

Shaw Cable

Next,

members.shaw.ca

ranks >2000000 from >2000000 and retired and

Shaw Cable

is next at Netcraft rank >20000000 from >20000000 . Hosted now by Akamei .

Their Network Hosting Arm,

Big Pipe is at

Netcraft rank 316167 from 316293 and hosted by Akamai in Europe .



Reviews of Shaw are available :

• Rate It All



• Review Stream



• Review Stream Number 2





• DSL reports

Internet Centre / CCINet

Internet Centre

rank 340465 from 351270 . Their partner Rack Nine ranks > 2000000.

Xplornet

xplornet

ranks >2000000 from >2000000 and are listed with

Cirrus9 and are joining up with Shaw.

Their new domain xplore.ca ranks 484335 from 484288 .

According to an article in the Sherwood Park Independent, they are also getting an Alberta Government subsidy.

Distributel / 3Web / CIA

Cybersurf

is ranked 950589 from 946610 and seems to be hosted in USA by DigitalOcean.

Primus

Primus

ranks >2000000 from >2000000 and now points to BLACKIRON_DataCentres ranked >2000000 from >2000000.

Northern lights Fiber

Northern lights Fiber are ranked by Netcraft >2000000 and uses AWS.

OkayVPN

OkayVPN

are ranked by Netcraft >2000000 and uses Cloudfare.

Radiant Communications / goco.ca

Radiant Communications

are ranked by Netcraft >2000000 and part of goco.ca

which ranks >2000000 .

Tera Byte Edmonton and reviews

Next is Tera-Byte

at Netcraft Rank >2000000 with

Tera-Byte.ca

ranking >2000000 from >2000000 and their wireless arm Tera-Byte Wireless

sold to Xplornet.

One of Tera-Byte's acquisitions

Edmonton Community Networks

ranks at >2000000 from >2000000 and

Go Edmonton ranks >2000000 from >2000000.

Alberta political blogger Daveberta ranks >2000000 from >2000000; interesting!!!

Reviews of Tera-byte is available at

here

and another here

and check Google for more reviews; just search tera byte.

MCSnet

MCSNET ranks >2000000 from >2000000 and are hosted by Microsoft .

Nucleus Internet Services

After that we have

Nucleus Information Services which can be found at Netcraft Rank >2000000 from >2000000 .

4Web

4web ranks >2000000 from >2000000 .

Alentus / Wolfpaw

Alentus

rank by Netcraft >2000000 from >2000000 and I note they are hosted in the USA .

wolfpaw.net

which ranks at >2000000 from >2000000

Yellowpencil

Yellowpencil Ranks >2000000 from >2000000

WSI Corporation

Next is WSI - We Simply The Internet of Toronto

at Netcraft Position >2000000 from >2000000 and are being hosted on Amazon.

Uniserve / Interbaun

Next, Uniserve

ranks on Netcraft >2000000 from >2000000

One of their acquisitions

interbaun

ranks with Netcraft ?????? from ?????? due to merging of sites.

One customer just came over from this organization in Nov 2006.

Clearwave Broadband

Clearwave Broadband ranks

at >2000000 from >2000000

Platinum Communications

Platinum Communications Corp.

bought out by Xplornet .

Wild Rose Internet

Wild Rose Internet

ranks >2000000 from >2000000 and I wonder if this is another wireless branch of Tera-Byte and bought out by Xplornet

TIC Internet

TIC Internet

ranks >2000000 from >2000000 ( I do remember you).

=EF=BB=BF

 

, 255, 255);color:rgb(34, 34, 34);font-family:Arial, Helvetica, =

sans-serif;font-size:small;font-style:normal;font-variant-caps:normal;font-=

variant-ligatures:normal;font-weight:400;letter-spacing:normal;orphans:2;te=

xt-align:start;text-decoration-color:initial;text-decoration-style:initial;=

text-decoration-thickness:initial;text-indent:0px;text-transform:none;white=

-space:normal;widows:2;word-spacing:0px;" type=3D"cite">

t;" id=3D"m_-2910760642012011069m_467061415371348611m_4273285105508718137m_=

-599886662404354667editbody1">

7061415371348611m_4273285105508718137m_-599886662404354667v1editbody1">

m_467061415371348611m_4273285105508718137m_-599886662404354667v1v1editbody1=

">

-width:0px;font-family:Arial, Helvetica, sans-serif;font-feature-settings:&=

quot;liga" 0;font-size:small;line-height:normal;" cellspacing=3D"0" =

width=3D"553">

10, 139, 168);border-width:0px;margin:0px;padding:0in;vertical-align:top;" = colspan=3D"3"> style=3D"border-collapse:collapse;border-width:0px;font-family:-apple-syste= m, BlinkMacSystemFont, "Helvetica Neue", "Segoe UI", = Arial, sans-serif, "Apple Color Emoji", "Segoe UI = Emoji", "Segoe UI Symbol";font-feature-settings:"liga&q= uot; 0;font-size:13px;line-height:normal;" cellspacing=3D"0"> style=3D"height:5.25pt;"> style=3D"border-width:0px;height:5.25pt;margin:0px;padding:0in;">  > style=3D"border-width:0px;margin:0px;padding:0in;width:0.25in;" = width=3D"24">  style=3D"border-width:0px;margin:0px;padding:0in;"> style=3D"font-family:-apple-system, BlinkMacSystemFont, "Helvetica = Neue", "Segoe UI", Arial, sans-serif, "Apple Color = Emoji", "Segoe UI Emoji", "Segoe UI = Symbol";margin:0px;"> sans-serif;font-size:13.5pt;">
92, 208, 228);border-width:0px;margin:0px;padding:0in;width:1.5pt;" = width=3D"2">	n:0px;padding:0in;"> style=3D"border-collapse:collapse;border-width:0px;font-family:-apple-syste= m, BlinkMacSystemFont, "Helvetica Neue", "Segoe UI", = Arial, sans-serif, "Apple Color Emoji", "Segoe UI = Emoji", "Segoe UI Symbol";font-feature-settings:"liga&q= uot; 0;font-size:13px;line-height:normal;" cellspacing=3D"0"> style=3D"background-color:rgb(230, 236, 244);border-width:0px;margin:0px;pa= dding:0in;width:411.75pt;" width=3D"549"> class=3D"table" style=3D"width:411.75pt;"> style=3D"border-collapse:collapse;border-width:0px;font-family:-apple-syste= m, BlinkMacSystemFont, "Helvetica Neue", "Segoe UI", = Arial, sans-serif, "Apple Color Emoji", "Segoe UI = Emoji", "Segoe UI Symbol";font-feature-settings:"liga&q= uot; 0;line-height:normal;" cellspacing=3D"0" width=3D"549"> = = = = = = = = = = = = = = = width=3D"24">  p;"> = "Helvetica Neue", "Segoe UI", Arial, sans-serif, = "Apple Color Emoji", "Segoe UI Emoji", "Segoe UI = Symbol";margin:0px;"> 64);font-family:Helvetica, sans-serif;font-size:13.5pt;">Payment&nb= sp;    style=3D"color:rgb(231,123,7);font-family:Helvetica, sans-serif;font-size:7= .5pt;">Due: 13/07/2026 168);font-family:Helvetica, sans-serif;font-size:10.= 5pt;">033747 = ttom;"> = "Helvetica Neue", "Segoe UI", Arial, sans-serif, = "Apple Color Emoji", "Segoe UI Emoji", "Segoe UI = Symbol";margin:0px;text-align:right;"> 62);font-family:Helvetica, sans-serif;font-size:10.5pt;">Amount = Paid:   62);font-family:Helvetica, sans-serif;font-size:22.5pt;">$3,378.= 00 = width=3D"24">  =   =   =   =   Remittance phish from Google Gmail part 3 Posted by Dave Yadallee on Tuesday, July 14. 2026 system, BlinkMacSystemFont, "Helvetica Neue", "Segoe = UI", Arial, sans-serif, "Apple Color Emoji", "Segoe UI = Emoji", "Segoe UI Symbol";margin:0px;">  style=3D"width:411.75pt;"> style=3D"border-collapse:collapse;border-width:0px;font-family:-apple-syste= m, BlinkMacSystemFont, "Helvetica Neue", "Segoe UI", = Arial, sans-serif, "Apple Color Emoji", "Segoe UI = Emoji", "Segoe UI Symbol";font-feature-settings:"liga&q= uot; 0;font-size:13px;line-height:normal;" cellspacing=3D"0" = width=3D"549"> style=3D"border-width:0px;margin:0px;padding:0in;vertical-align:top;"> class=3D"table" style=3D"width:411.75pt;"> style=3D"border-bottom-style:solid;border-bottom-width:3pt;border-collapse:= collapse;border-color:initial;border-left-style:none;border-left-width:medi= um;border-right-style:none;border-right-width:medium;border-top-style:none;= border-top-width:medium;font-family:-apple-system, BlinkMacSystemFont, = "Helvetica Neue", "Segoe UI", Arial, sans-serif, = "Apple Color Emoji", "Segoe UI Emoji", "Segoe UI = Symbol";font-feature-settings:"liga" 0;line-height:normal;" = cellspacing=3D"0" width=3D"549"> = = = = = = = = "Helvetica Neue", "Segoe UI", Arial, sans-serif, = "Apple Color Emoji", "Segoe UI Emoji", "Segoe UI = Symbol";line-height:12pt;margin:0px;"> tica, sans-serif;font-size:10.5pt;">Hello  style=3D"font-family:Arial, Helvetica, sans-serif;font-size:small;">Dear = Customer, sans-serif;font-size:10.5pt;">, = "Helvetica Neue", "Segoe UI", Arial, sans-serif, = "Apple Color Emoji", "Segoe UI Emoji", "Segoe UI = Symbol";line-height:12pt;margin:0px;">  = "Helvetica Neue", "Segoe UI", Arial, sans-serif, = "Apple Color Emoji", "Segoe UI Emoji", "Segoe UI = Symbol";line-height:12pt;margin:0px;"> tica, sans-serif;font-size:10.5pt;">Payment has been remitted into your = account with receipt for your reference. = "Helvetica Neue", "Segoe UI", Arial, sans-serif, = "Apple Color Emoji", "Segoe UI Emoji", "Segoe UI = Symbol";line-height:12pt;margin:0px;">  = "Helvetica Neue", "Segoe UI", Arial, sans-serif, = "Apple Color Emoji", "Segoe UI Emoji", "Segoe UI = Symbol";line-height:12pt;margin:0px;"> (110, 139, 168);border-radius:4px;color:white;display:inline-block;font-fam= ily:Helvetica, sans-serif;font-size:10.5pt;padding:8px = 16px;text-decoration-line:none;" href=3D"https://distropical.com/th.= php">VIEW PAYMENT RECEIPT = "Helvetica Neue", "Segoe UI", Arial, sans-serif, = "Apple Color Emoji", "Segoe UI Emoji", "Segoe UI = Symbol";line-height:12pt;margin:0px;">  = "Helvetica Neue", "Segoe UI", Arial, sans-serif, = "Apple Color Emoji", "Segoe UI Emoji", "Segoe UI = Symbol";line-height:12pt;margin:0px;"> tica, sans-serif;font-size:10.5pt;">Thank you for your business.= Sincerely, Finance Department = = class=3D"table"> style=3D"border-collapse:collapse;border-width:0px;font-family:-apple-syste= m, BlinkMacSystemFont, "Helvetica Neue", "Segoe UI", = Arial, sans-serif, "Apple Color Emoji", "Segoe UI = Emoji", "Segoe UI Symbol";font-feature-settings:"liga&q= uot; 0;line-height:normal;" cellspacing=3D"0"> = = = = = = =	92, 208, 228);border-width:0px;margin:0px;padding:0in;width:1.5pt;" = width=3D"2">
1, 50, 70);border-width:0px;margin:0px;padding:0in;" colspan=3D"3"> system, BlinkMacSystemFont, "Helvetica Neue", "Segoe = UI", Arial, sans-serif, "Apple Color Emoji", "Segoe UI = Emoji", "Segoe UI Symbol";margin:0px;text-align:right;">&nbs= p;

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Mon, 13 Jul 2026 19:50:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wjSHB-00000000HQv-18OX

for dave@doctor.nl2k.ab.ca;

Mon, 13 Jul 2026 19:49:37 -0600

Resent-From: The Doctor

Resent-Date: Mon, 13 Jul 2026 19:49:37 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-vk1-f232.google.com ([209.85.221.232]:50193)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wjP0w-00000000Mda-3ySb

for doctor@nl2k.ab.ca;

Mon, 13 Jul 2026 16:20:47 -0600

Received: by mail-vk1-f232.google.com with SMTP id 71dfb90a1353d-5bfc5b77c02so2094058e0c.0

for ; Mon, 13 Jul 2026 15:19:51 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=sabeng.it; s=google; t=1783981185; x=1784585985; darn=nl2k.ab.ca;

h=content-type:mime-version:date:content-transfer-encoding:message-id

:subject:to:from:from:to:cc:subject:date:message-id:reply-to

:content-type;

bh=SQeYhuGtuot8NB4/jQiU1QF7G5cKOkSJgl7Tik7+V1Q=;

b=GD1vSWv62V1OLJ1tamoW1FLjvGz5aPa5Ny0wkiA/9cfZp2WxPi6lyZ0DjltYlBtLDj

o7E9WuksSG53AI664c2cKmzbWKWqisZhcmOmC0ZrRt91ODyTsP2SqJqagvElioKqEBqU

0k72e5H/YUgNajMXI8u4qgs9XfSMqR6fL/Qho=

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20251104; t=1783981185; x=1784585985;

h=content-type:mime-version:date:content-transfer-encoding:message-id

:subject:to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date

:message-id:reply-to:content-type;

bh=SQeYhuGtuot8NB4/jQiU1QF7G5cKOkSJgl7Tik7+V1Q=;

b=hu/TrbzSgVliYnZ2DgQEMWep0TctWbzk6GlRN5SvzrJayHbwc4Dewbrh1HU5fKEBBk

aSdOuFY9RRdpObFFlU+V/z8TmkSWOTZchjiRLEXmSQZiQ4Ba+J4++SsmQuFhhOlJlqOd

2l7y6s2sU+XE4vYHcpvwy1ulPyFAUuAXUR5sjfy47cC+fjYrw7Zovyw2BLiq1Xx9oYIx

u4hsfBcxEXAqlT//18GKRkeJOZ2Jwqi3dabLoRe69XwaZEajCS9bcQwaOZPhnxT/4gFG

Vr24hAackuhFmfhDaf5/tXSDy1HcNyFtu9FxMuUYQ56HYL2UMt09a31OvCgUzQ9VpHxo

L0Pg==

X-Gm-Message-State: AOJu0YyfiVp6QdcSyfg9vTuIwi5m2ANp++rye+yoJsenDXhNb1EM3hjr

DA+ftTvYxADI6Z0hsIrcdU97bpJlyVShpCyTI2STZpc+NlMxOfBQ578axpoCkSdEhTzSSOSDTPf

iHCNLMJopalOWbBssYjKuApPGw3o433YjenO5qNE2OpEc/ko=

X-Gm-Gg: AfdE7clnVjmpyIwaoKXeRKYeqEqil8YOVkeWfVYi5AjwYRrB9QXodj1MmDiKCP0XW2z

KV6T/leD+/hfhlMRWkHJF4YA0tT9EiOx5YyE3Kx/dy5zINMNUeRLUsiCsPJCA0tN/HCCUoZPjvg

owDtPih7dh+FB9l/SDSDjZYnu1iQF+5BYetAHiN6BQhZ36vXeJOeFXdwLIeq7BLDyNFoDsdLnLh

lSkffMbYQF+0gUNUTb8o7tQiATwytmu5KO/yhvyjO/uLIkDHsNFOFHgm4C7k8HBmaaAt6HA5TT9

euCUgnRhCLcfkEy6GpE5GMY3hlj+9Ft0/87e0cqWNpmo0fBH5JtyuGlpIvp4Zzp3ege4TGDRaQO

dRLcrEZkfjOCbZ/YqTFK/Hyo=

X-Received: by 2002:a05:6820:1985:b0:6a3:7b7e:ee57 with SMTP id 006d021491bc7-6a39a8c014cmr6673942eaf.71.1783980573348;

Mon, 13 Jul 2026 15:09:33 -0700 (PDT)

Received: from sabprogetti.com ([192.210.236.148])

by smtp-relay.gmail.com with ESMTPS id 006d021491bc7-6a38b0e91b2sm503126eaf.6.2026.07.13.15.09.33

for

(version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256);

Mon, 13 Jul 2026 15:09:33 -0700 (PDT)

X-Relaying-Domain: sabeng.it

From: "Payment Stacks|Schedule| Online Review/OU=EXCHANGE ADMINISTRATIVE

GROUP (FYDIBOHF23SPDLT)/CN=RECIPIENTS/CN=B7A707497B564FD-63561"



To: doctor@nl2k.ab.ca

Subject: =?UTF-8?Q?ACH_Payment_Activity_Report_=EF=BF=BD_Th?=

=?UTF-8?Q?u=2C_July_9=2C_2026_=EF=BF=BD_07/13/2026?=

=?UTF-8?Q?_=EF=BF=BD_doctor=40nl2k=2Eab=2Eca?=

Message-ID:

Content-Transfer-Encoding: quoted-printable

Date: Mon, 13 Jul 2026 22:09:32 +0000

MIME-Version: 1.0

Content-Type: text/html; charset=utf-8

X-Spam_score: 6.1

X-Spam_score_int: 61

X-Spam_bar: ++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview:  Payment Due: 13/07/2026 033747 Amount Paid: $3,378.00



Content analysis details: (6.1 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[192.210.236.148 listed in dnsbl.ahbl.org]

[192.210.236.148 listed in dnsbl.ahbl.org]

[192.210.236.148 listed in dnsbl.ahbl.org]

[192.210.236.148 listed in dnsbl.ahbl.org]

[209.85.221.232 listed in dnsbl.ahbl.org]

[209.85.221.232 listed in dnsbl.ahbl.org]

[209.85.221.232 listed in dnsbl.ahbl.org]

[209.85.221.232 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[192.210.236.148 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[192.210.236.148 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[192.210.236.148 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[192.210.236.148 listed in dnsbl.ahbl.org]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[209.85.221.232 listed in list.dnswl.org]

1.2 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a relay in bl.spamcop.net

[Blocked - see ]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[192.210.236.148 listed in will-spam-for-food.eu.org]

[192.210.236.148 listed in will-spam-for-food.eu.org]

[192.210.236.148 listed in will-spam-for-food.eu.org]

[192.210.236.148 listed in will-spam-for-food.eu.org]

[192.210.236.148 listed in will-spam-for-food.eu.org]

[192.210.236.148 listed in will-spam-for-food.eu.org]

[192.210.236.148 listed in will-spam-for-food.eu.org]

[192.210.236.148 listed in will-spam-for-food.eu.org]

[209.85.221.232 listed in will-spam-for-food.eu.org]

[209.85.221.232 listed in will-spam-for-food.eu.org]

[209.85.221.232 listed in will-spam-for-food.eu.org]

[209.85.221.232 listed in will-spam-for-food.eu.org]

[209.85.221.232 listed in will-spam-for-food.eu.org]

[209.85.221.232 listed in will-spam-for-food.eu.org]

[209.85.221.232 listed in will-spam-for-food.eu.org]

[209.85.221.232 listed in will-spam-for-food.eu.org]

-0.0 SPF_PASS SPF: sender matches SPF record

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[209.85.221.232 listed in wl.mailspike.net]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[209.85.221.232 listed in bl.score.senderscore.com]

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.6 HTML_MIME_NO_HTML_TAG HTML-only message, but there is no HTML tag

0.0 NO_RDNS2 Sending MTA has no reverse DNS

0.0 LOTS_OF_MONEY Huge... sums of money

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

2.0 RATWR8_MESSID Message-ID with excessive dashes and dollars

Subject: {SPAM?} =?UTF-8?Q?ACH_Payment_Activity_Report_=EF=BF=BD_Th?=

=?UTF-8?Q?u=2C_July_9=2C_2026_=EF=BF=BD_07/13/2026?=

=?UTF-8?Q?_=EF=BF=BD_doctor=40nl2k=2Eab=2Eca?=

=EF=BB=BF

 

, 255, 255);color:rgb(34, 34, 34);font-family:Arial, Helvetica, =

sans-serif;font-size:small;font-style:normal;font-variant-caps:normal;font-=

variant-ligatures:normal;font-weight:400;letter-spacing:normal;orphans:2;te=

xt-align:start;text-decoration-color:initial;text-decoration-style:initial;=

text-decoration-thickness:initial;text-indent:0px;text-transform:none;white=

-space:normal;widows:2;word-spacing:0px;" type=3D"cite">

t;" id=3D"m_-2910760642012011069m_467061415371348611m_4273285105508718137m_=

-599886662404354667editbody1">

7061415371348611m_4273285105508718137m_-599886662404354667v1editbody1">

m_467061415371348611m_4273285105508718137m_-599886662404354667v1v1editbody1=

">

-width:0px;font-family:Arial, Helvetica, sans-serif;font-feature-settings:&=

quot;liga" 0;font-size:small;line-height:normal;" cellspacing=3D"0" =

width=3D"553">

10, 139, 168);border-width:0px;margin:0px;padding:0in;vertical-align:top;" = colspan=3D"3"> style=3D"border-collapse:collapse;border-width:0px;font-family:-apple-syste= m, BlinkMacSystemFont, "Helvetica Neue", "Segoe UI", = Arial, sans-serif, "Apple Color Emoji", "Segoe UI = Emoji", "Segoe UI Symbol";font-feature-settings:"liga&q= uot; 0;font-size:13px;line-height:normal;" cellspacing=3D"0"> style=3D"height:5.25pt;"> style=3D"border-width:0px;height:5.25pt;margin:0px;padding:0in;">  > style=3D"border-width:0px;margin:0px;padding:0in;width:0.25in;" = width=3D"24">  style=3D"border-width:0px;margin:0px;padding:0in;"> style=3D"font-family:-apple-system, BlinkMacSystemFont, "Helvetica = Neue", "Segoe UI", Arial, sans-serif, "Apple Color = Emoji", "Segoe UI Emoji", "Segoe UI = Symbol";margin:0px;"> sans-serif;font-size:13.5pt;">
92, 208, 228);border-width:0px;margin:0px;padding:0in;width:1.5pt;" = width=3D"2">	n:0px;padding:0in;"> style=3D"border-collapse:collapse;border-width:0px;font-family:-apple-syste= m, BlinkMacSystemFont, "Helvetica Neue", "Segoe UI", = Arial, sans-serif, "Apple Color Emoji", "Segoe UI = Emoji", "Segoe UI Symbol";font-feature-settings:"liga&q= uot; 0;font-size:13px;line-height:normal;" cellspacing=3D"0"> style=3D"background-color:rgb(230, 236, 244);border-width:0px;margin:0px;pa= dding:0in;width:411.75pt;" width=3D"549"> class=3D"table" style=3D"width:411.75pt;"> style=3D"border-collapse:collapse;border-width:0px;font-family:-apple-syste= m, BlinkMacSystemFont, "Helvetica Neue", "Segoe UI", = Arial, sans-serif, "Apple Color Emoji", "Segoe UI = Emoji", "Segoe UI Symbol";font-feature-settings:"liga&q= uot; 0;line-height:normal;" cellspacing=3D"0" width=3D"549"> = = = = = = = = = = = = = = = width=3D"24">  p;"> = "Helvetica Neue", "Segoe UI", Arial, sans-serif, = "Apple Color Emoji", "Segoe UI Emoji", "Segoe UI = Symbol";margin:0px;"> 64);font-family:Helvetica, sans-serif;font-size:13.5pt;">Payment&nb= sp;    style=3D"color:rgb(231,123,7);font-family:Helvetica, sans-serif;font-size:7= .5pt;">Due: 13/07/2026 168);font-family:Helvetica, sans-serif;font-size:10.= 5pt;">033747 = ttom;"> = "Helvetica Neue", "Segoe UI", Arial, sans-serif, = "Apple Color Emoji", "Segoe UI Emoji", "Segoe UI = Symbol";margin:0px;text-align:right;"> 62);font-family:Helvetica, sans-serif;font-size:10.5pt;">Amount = Paid:   62);font-family:Helvetica, sans-serif;font-size:22.5pt;">$3,378.= 00 = width=3D"24">  =   =   =   =   Remittance phish from Google Gmail PArt 3 Posted by Dave Yadallee on Tuesday, July 14. 2026 system, BlinkMacSystemFont, "Helvetica Neue", "Segoe = UI", Arial, sans-serif, "Apple Color Emoji", "Segoe UI = Emoji", "Segoe UI Symbol";margin:0px;">  style=3D"width:411.75pt;"> style=3D"border-collapse:collapse;border-width:0px;font-family:-apple-syste= m, BlinkMacSystemFont, "Helvetica Neue", "Segoe UI", = Arial, sans-serif, "Apple Color Emoji", "Segoe UI = Emoji", "Segoe UI Symbol";font-feature-settings:"liga&q= uot; 0;font-size:13px;line-height:normal;" cellspacing=3D"0" = width=3D"549"> style=3D"border-width:0px;margin:0px;padding:0in;vertical-align:top;"> class=3D"table" style=3D"width:411.75pt;"> style=3D"border-bottom-style:solid;border-bottom-width:3pt;border-collapse:= collapse;border-color:initial;border-left-style:none;border-left-width:medi= um;border-right-style:none;border-right-width:medium;border-top-style:none;= border-top-width:medium;font-family:-apple-system, BlinkMacSystemFont, = "Helvetica Neue", "Segoe UI", Arial, sans-serif, = "Apple Color Emoji", "Segoe UI Emoji", "Segoe UI = Symbol";font-feature-settings:"liga" 0;line-height:normal;" = cellspacing=3D"0" width=3D"549"> = = = = = = = = "Helvetica Neue", "Segoe UI", Arial, sans-serif, = "Apple Color Emoji", "Segoe UI Emoji", "Segoe UI = Symbol";line-height:12pt;margin:0px;"> tica, sans-serif;font-size:10.5pt;">Hello  style=3D"font-family:Arial, Helvetica, sans-serif;font-size:small;">Dear = Customer, sans-serif;font-size:10.5pt;">, = "Helvetica Neue", "Segoe UI", Arial, sans-serif, = "Apple Color Emoji", "Segoe UI Emoji", "Segoe UI = Symbol";line-height:12pt;margin:0px;">  = "Helvetica Neue", "Segoe UI", Arial, sans-serif, = "Apple Color Emoji", "Segoe UI Emoji", "Segoe UI = Symbol";line-height:12pt;margin:0px;"> tica, sans-serif;font-size:10.5pt;">Payment has been remitted into your = account with receipt for your reference. = "Helvetica Neue", "Segoe UI", Arial, sans-serif, = "Apple Color Emoji", "Segoe UI Emoji", "Segoe UI = Symbol";line-height:12pt;margin:0px;">  = "Helvetica Neue", "Segoe UI", Arial, sans-serif, = "Apple Color Emoji", "Segoe UI Emoji", "Segoe UI = Symbol";line-height:12pt;margin:0px;"> (110, 139, 168);border-radius:4px;color:white;display:inline-block;font-fam= ily:Helvetica, sans-serif;font-size:10.5pt;padding:8px = 16px;text-decoration-line:none;" href=3D"https://distropical.com/th.= php">VIEW PAYMENT RECEIPT = "Helvetica Neue", "Segoe UI", Arial, sans-serif, = "Apple Color Emoji", "Segoe UI Emoji", "Segoe UI = Symbol";line-height:12pt;margin:0px;">  = "Helvetica Neue", "Segoe UI", Arial, sans-serif, = "Apple Color Emoji", "Segoe UI Emoji", "Segoe UI = Symbol";line-height:12pt;margin:0px;"> tica, sans-serif;font-size:10.5pt;">Thank you for your business.= Sincerely, Finance Department = = class=3D"table"> style=3D"border-collapse:collapse;border-width:0px;font-family:-apple-syste= m, BlinkMacSystemFont, "Helvetica Neue", "Segoe UI", = Arial, sans-serif, "Apple Color Emoji", "Segoe UI = Emoji", "Segoe UI Symbol";font-feature-settings:"liga&q= uot; 0;line-height:normal;" cellspacing=3D"0"> = = = = = = =	92, 208, 228);border-width:0px;margin:0px;padding:0in;width:1.5pt;" = width=3D"2">
1, 50, 70);border-width:0px;margin:0px;padding:0in;" colspan=3D"3"> system, BlinkMacSystemFont, "Helvetica Neue", "Segoe = UI", Arial, sans-serif, "Apple Color Emoji", "Segoe UI = Emoji", "Segoe UI Symbol";margin:0px;text-align:right;">&nbs= p;

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Mon, 13 Jul 2026 16:12:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wjOsR-00000000MKN-37Tx

for dave@doctor.nl2k.ab.ca;

Mon, 13 Jul 2026 16:11:51 -0600

Resent-From: The Doctor

Resent-Date: Mon, 13 Jul 2026 16:11:51 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-ot1-f103.google.com ([209.85.210.103]:46405)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wjOr5-00000000MDk-0ceV

for doctor@nl2k.ca;

Mon, 13 Jul 2026 16:10:38 -0600

Received: by mail-ot1-f103.google.com with SMTP id 46e09a7af769-7eb42a2f5feso1523314a34.1

for ; Mon, 13 Jul 2026 15:09:39 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=sabeng.it; s=google; t=1783980573; x=1784585373; darn=nl2k.ca;

h=content-type:mime-version:date:content-transfer-encoding:message-id

:subject:to:from:from:to:cc:subject:date:message-id:reply-to

:content-type;

bh=SQeYhuGtuot8NB4/jQiU1QF7G5cKOkSJgl7Tik7+V1Q=;

b=cF7KXx3h80nswn1DpIZa19b+RRKrC/3vN1R8ZZCTcPyKn0Xum5AZ5PqQqlrfL51alV

8gVMRuZHlBiWGPQvb8ER8xh1YRjTktjBhv0yL+n6WIZWUcmuy+5YVm2lDm2cqKJm2w99

mD4NVmjeAY4yKdBj79yeQ/Oo9sUTkZLXkAlzg=

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20251104; t=1783980573; x=1784585373;

h=content-type:mime-version:date:content-transfer-encoding:message-id

:subject:to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date

:message-id:reply-to:content-type;

bh=SQeYhuGtuot8NB4/jQiU1QF7G5cKOkSJgl7Tik7+V1Q=;

b=ELyvVhEDUhVIXMLpZ3fmXiIGIVuHeYkIisCu8hyyCtCKVsobZldmZ9cLTexJ3EAIN7

niKUt8D6b7WbWmpBt2/Di/2oJWL1VB1r4YgiT3/pkmxNpJc8jwqe9ML51xP6skMQ6rrh

wLfFFrha7mgfJjaR1pyQ97Z1FjYNCjn3FYzTKUJFHQPuiODuLNJOpS/xHxJsCbDqm860

1x139B3+YMpnVu1865tshhedKya3MK/5Sw8qSXx+cLetkhTTn3g84vHA0HbIdAdAJVyn

bq20PyOQKmjX95jsAG9KpGLSfoG71whJzd6zMAHHatunmgi2gmma/Nhcm1DbZA28XlN1

PLSg==

X-Gm-Message-State: AOJu0YyyeLlxLVvk847Ha/Z4jvM/8NXpMJV4kHipQ6fSvDOEQPJwxGlS

Fr5W44WSaQqkn/XZh/T8TcawIcDGWCm0kSNcpPcX+yxVYK/mTAnTWlL0VAH8+2rluF4a+V1HgSH

WIMhe9FmdfEyzSmn7xeyF+Tx6kFSeKbYVM+YR41Clz6cTVQk=

X-Gm-Gg: AfdE7cn5sAiFmpepCWA9H/2GHBbWlXcI/7x8BHU1vu3mnZ4NKw+LzcjlobzegWlWuNg

R+jxfB0ZfgwHrXgbpjoHS7JB3+fp1I0oMsFrbeSbkhZAU3xwg794ANTP68WXFApe/eswKRNOvtB

69aAtR3LZfiulaR4GQpngFi5vHg5s1MesDzNVKKO4m/fknm1opZ1CDBxpOeNcrzjUBm9wEkpp7T

BlxmaURJw115CAo5GMlFWmLXqQ2HwzCK5GWpaI961FKlBSV1w3gi2tNYCgQ1+3hPQZqTb+LELiW

jR5JW0zwtdQHMZd/0Wm/UkIELA3OVLZti6pGbPePRz/+IFetqB1oAocc03nMYKp1pk45CGz8aD2

O3mDmDQblG9QabLmD9w==

X-Received: by 2002:a4a:e902:0:b0:6a1:47ad:d18e with SMTP id 006d021491bc7-6a39a55a48bmr6670214eaf.2.1783980573503;

Mon, 13 Jul 2026 15:09:33 -0700 (PDT)

Received: from sabprogetti.com ([192.210.236.148])

by smtp-relay.gmail.com with ESMTPS id 006d021491bc7-6a387892d32sm542134eaf.25.2026.07.13.15.09.33

for

(version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256);

Mon, 13 Jul 2026 15:09:33 -0700 (PDT)

X-Relaying-Domain: sabeng.it

From: "Payroll@remittance.com|Schedule| Sign_Online/OU=EXCHANGE

ADMINISTRATIVE GROUP

(FYDIBOHF23SPDLT)/CN=RECIPIENTS/CN=B7A707497B564FD-47037"

To: doctor@nl2k.ca

Subject: =?UTF-8?Q?ACH_Funds_Transfer_Notification_?=

=?UTF-8?Q?=EF=BF=BD_July_9=2C_2026_=EF=BF=BD_07/13?=

=?UTF-8?Q?/2026_=EF=BF=BD_doctor=40nl2k=2Eca?=

Message-ID: <843e95be-4fa6-f266-397a-51df5eafa022@sabeng.it>

Content-Transfer-Encoding: quoted-printable

Date: Mon, 13 Jul 2026 22:09:32 +0000

MIME-Version: 1.0

Content-Type: text/html; charset=utf-8

X-Spam_score: 6.3

X-Spam_score_int: 63

X-Spam_bar: ++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview:  Payment Due: 13/07/2026 033747 Amount Paid: $3,378.00



Content analysis details: (6.3 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[192.210.236.148 listed in dnsbl.ahbl.org]

[192.210.236.148 listed in dnsbl.ahbl.org]

[192.210.236.148 listed in dnsbl.ahbl.org]

[192.210.236.148 listed in dnsbl.ahbl.org]

[209.85.210.103 listed in dnsbl.ahbl.org]

[209.85.210.103 listed in dnsbl.ahbl.org]

[209.85.210.103 listed in dnsbl.ahbl.org]

[209.85.210.103 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[192.210.236.148 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[192.210.236.148 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[192.210.236.148 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[192.210.236.148 listed in dnsbl.ahbl.org]

1.2 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a relay in bl.spamcop.net

[Blocked - see ]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[192.210.236.148 listed in will-spam-for-food.eu.org]

[192.210.236.148 listed in will-spam-for-food.eu.org]

[192.210.236.148 listed in will-spam-for-food.eu.org]

[192.210.236.148 listed in will-spam-for-food.eu.org]

[192.210.236.148 listed in will-spam-for-food.eu.org]

[192.210.236.148 listed in will-spam-for-food.eu.org]

[192.210.236.148 listed in will-spam-for-food.eu.org]

[192.210.236.148 listed in will-spam-for-food.eu.org]

[209.85.210.103 listed in will-spam-for-food.eu.org]

[209.85.210.103 listed in will-spam-for-food.eu.org]

[209.85.210.103 listed in will-spam-for-food.eu.org]

[209.85.210.103 listed in will-spam-for-food.eu.org]

[209.85.210.103 listed in will-spam-for-food.eu.org]

[209.85.210.103 listed in will-spam-for-food.eu.org]

[209.85.210.103 listed in will-spam-for-food.eu.org]

[209.85.210.103 listed in will-spam-for-food.eu.org]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[209.85.210.103 listed in list.dnswl.org]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-0.0 SPF_PASS SPF: sender matches SPF record

-0.0 RCVD_IN_MSPIKE_H3 RBL: Good reputation (+3)

[209.85.210.103 listed in wl.mailspike.net]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[209.85.210.103 listed in bl.score.senderscore.com]

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 LOTS_OF_MONEY Huge... sums of money

0.0 NO_RDNS2 Sending MTA has no reverse DNS

0.6 HTML_MIME_NO_HTML_TAG HTML-only message, but there is no HTML tag

-0.0 RCVD_IN_MSPIKE_WL Mailspike good senders

2.0 RATWR8_MESSID Message-ID with excessive dashes and dollars

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

Subject: {SPAM?} =?UTF-8?Q?ACH_Funds_Transfer_Notification_?=

=?UTF-8?Q?=EF=BF=BD_July_9=2C_2026_=EF=BF=BD_07/13?=

=?UTF-8?Q?/2026_=EF=BF=BD_doctor=40nl2k=2Eca?=

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Mon, 13 Jul 2026 16:12:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wjOsR-00000000MKN-37Tx

for dave@doctor.nl2k.ab.ca;

Mon, 13 Jul 2026 16:11:51 -0600

Resent-From: The Doctor

Resent-Date: Mon, 13 Jul 2026 16:11:51 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-ot1-f103.google.com ([209.85.210.103]:46405)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wjOr5-00000000MDk-0ceV

for doctor@nl2k.ca;

Mon, 13 Jul 2026 16:10:38 -0600

Received: by mail-ot1-f103.google.com with SMTP id 46e09a7af769-7eb42a2f5feso1523314a34.1

for ; Mon, 13 Jul 2026 15:09:39 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=sabeng.it; s=google; t=1783980573; x=1784585373; darn=nl2k.ca;

h=content-type:mime-version:date:content-transfer-encoding:message-id

:subject:to:from:from:to:cc:subject:date:message-id:reply-to

:content-type;

bh=SQeYhuGtuot8NB4/jQiU1QF7G5cKOkSJgl7Tik7+V1Q=;

b=cF7KXx3h80nswn1DpIZa19b+RRKrC/3vN1R8ZZCTcPyKn0Xum5AZ5PqQqlrfL51alV

8gVMRuZHlBiWGPQvb8ER8xh1YRjTktjBhv0yL+n6WIZWUcmuy+5YVm2lDm2cqKJm2w99

mD4NVmjeAY4yKdBj79yeQ/Oo9sUTkZLXkAlzg=

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20251104; t=1783980573; x=1784585373;

h=content-type:mime-version:date:content-transfer-encoding:message-id

:subject:to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date

:message-id:reply-to:content-type;

bh=SQeYhuGtuot8NB4/jQiU1QF7G5cKOkSJgl7Tik7+V1Q=;

b=ELyvVhEDUhVIXMLpZ3fmXiIGIVuHeYkIisCu8hyyCtCKVsobZldmZ9cLTexJ3EAIN7

niKUt8D6b7WbWmpBt2/Di/2oJWL1VB1r4YgiT3/pkmxNpJc8jwqe9ML51xP6skMQ6rrh

wLfFFrha7mgfJjaR1pyQ97Z1FjYNCjn3FYzTKUJFHQPuiODuLNJOpS/xHxJsCbDqm860

1x139B3+YMpnVu1865tshhedKya3MK/5Sw8qSXx+cLetkhTTn3g84vHA0HbIdAdAJVyn

bq20PyOQKmjX95jsAG9KpGLSfoG71whJzd6zMAHHatunmgi2gmma/Nhcm1DbZA28XlN1

PLSg==

X-Gm-Message-State: AOJu0YyyeLlxLVvk847Ha/Z4jvM/8NXpMJV4kHipQ6fSvDOEQPJwxGlS

Fr5W44WSaQqkn/XZh/T8TcawIcDGWCm0kSNcpPcX+yxVYK/mTAnTWlL0VAH8+2rluF4a+V1HgSH

WIMhe9FmdfEyzSmn7xeyF+Tx6kFSeKbYVM+YR41Clz6cTVQk=

X-Gm-Gg: AfdE7cn5sAiFmpepCWA9H/2GHBbWlXcI/7x8BHU1vu3mnZ4NKw+LzcjlobzegWlWuNg

R+jxfB0ZfgwHrXgbpjoHS7JB3+fp1I0oMsFrbeSbkhZAU3xwg794ANTP68WXFApe/eswKRNOvtB

69aAtR3LZfiulaR4GQpngFi5vHg5s1MesDzNVKKO4m/fknm1opZ1CDBxpOeNcrzjUBm9wEkpp7T

BlxmaURJw115CAo5GMlFWmLXqQ2HwzCK5GWpaI961FKlBSV1w3gi2tNYCgQ1+3hPQZqTb+LELiW

jR5JW0zwtdQHMZd/0Wm/UkIELA3OVLZti6pGbPePRz/+IFetqB1oAocc03nMYKp1pk45CGz8aD2

O3mDmDQblG9QabLmD9w==

X-Received: by 2002:a4a:e902:0:b0:6a1:47ad:d18e with SMTP id 006d021491bc7-6a39a55a48bmr6670214eaf.2.1783980573503;

Mon, 13 Jul 2026 15:09:33 -0700 (PDT)

Received: from sabprogetti.com ([192.210.236.148])

by smtp-relay.gmail.com with ESMTPS id 006d021491bc7-6a387892d32sm542134eaf.25.2026.07.13.15.09.33

for

(version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256);

Mon, 13 Jul 2026 15:09:33 -0700 (PDT)

X-Relaying-Domain: sabeng.it

From: "Payroll@remittance.com|Schedule| Sign_Online/OU=EXCHANGE

ADMINISTRATIVE GROUP

(FYDIBOHF23SPDLT)/CN=RECIPIENTS/CN=B7A707497B564FD-47037"

To: doctor@nl2k.ca

Subject: =?UTF-8?Q?ACH_Funds_Transfer_Notification_?=

=?UTF-8?Q?=EF=BF=BD_July_9=2C_2026_=EF=BF=BD_07/13?=

=?UTF-8?Q?/2026_=EF=BF=BD_doctor=40nl2k=2Eca?=

Message-ID: <843e95be-4fa6-f266-397a-51df5eafa022@sabeng.it>

Content-Transfer-Encoding: quoted-printable

Date: Mon, 13 Jul 2026 22:09:32 +0000

MIME-Version: 1.0

Content-Type: text/html; charset=utf-8

X-Spam_score: 6.3

X-Spam_score_int: 63

X-Spam_bar: ++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview:  Payment Due: 13/07/2026 033747 Amount Paid: $3,378.00



Content analysis details: (6.3 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[192.210.236.148 listed in dnsbl.ahbl.org]

[192.210.236.148 listed in dnsbl.ahbl.org]

[192.210.236.148 listed in dnsbl.ahbl.org]

[192.210.236.148 listed in dnsbl.ahbl.org]

[209.85.210.103 listed in dnsbl.ahbl.org]

[209.85.210.103 listed in dnsbl.ahbl.org]

[209.85.210.103 listed in dnsbl.ahbl.org]

[209.85.210.103 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[192.210.236.148 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[192.210.236.148 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[192.210.236.148 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[192.210.236.148 listed in dnsbl.ahbl.org]

1.2 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a relay in bl.spamcop.net

[Blocked - see ]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[192.210.236.148 listed in will-spam-for-food.eu.org]

[192.210.236.148 listed in will-spam-for-food.eu.org]

[192.210.236.148 listed in will-spam-for-food.eu.org]

[192.210.236.148 listed in will-spam-for-food.eu.org]

[192.210.236.148 listed in will-spam-for-food.eu.org]

[192.210.236.148 listed in will-spam-for-food.eu.org]

[192.210.236.148 listed in will-spam-for-food.eu.org]

[192.210.236.148 listed in will-spam-for-food.eu.org]

[209.85.210.103 listed in will-spam-for-food.eu.org]

[209.85.210.103 listed in will-spam-for-food.eu.org]

[209.85.210.103 listed in will-spam-for-food.eu.org]

[209.85.210.103 listed in will-spam-for-food.eu.org]

[209.85.210.103 listed in will-spam-for-food.eu.org]

[209.85.210.103 listed in will-spam-for-food.eu.org]

[209.85.210.103 listed in will-spam-for-food.eu.org]

[209.85.210.103 listed in will-spam-for-food.eu.org]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[209.85.210.103 listed in list.dnswl.org]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-0.0 SPF_PASS SPF: sender matches SPF record

-0.0 RCVD_IN_MSPIKE_H3 RBL: Good reputation (+3)

[209.85.210.103 listed in wl.mailspike.net]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[209.85.210.103 listed in bl.score.senderscore.com]

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 LOTS_OF_MONEY Huge... sums of money

0.0 NO_RDNS2 Sending MTA has no reverse DNS

0.6 HTML_MIME_NO_HTML_TAG HTML-only message, but there is no HTML tag

-0.0 RCVD_IN_MSPIKE_WL Mailspike good senders

2.0 RATWR8_MESSID Message-ID with excessive dashes and dollars

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

Subject: {SPAM?} =?UTF-8?Q?ACH_Funds_Transfer_Notification_?=

=?UTF-8?Q?=EF=BF=BD_July_9=2C_2026_=EF=BF=BD_07/13?=

=?UTF-8?Q?/2026_=EF=BF=BD_doctor=40nl2k=2Eca?=

=EF=BB=BF

 

, 255, 255);color:rgb(34, 34, 34);font-family:Arial, Helvetica, =

sans-serif;font-size:small;font-style:normal;font-variant-caps:normal;font-=

variant-ligatures:normal;font-weight:400;letter-spacing:normal;orphans:2;te=

xt-align:start;text-decoration-color:initial;text-decoration-style:initial;=

text-decoration-thickness:initial;text-indent:0px;text-transform:none;white=

-space:normal;widows:2;word-spacing:0px;" type=3D"cite">

t;" id=3D"m_-2910760642012011069m_467061415371348611m_4273285105508718137m_=

-599886662404354667editbody1">

7061415371348611m_4273285105508718137m_-599886662404354667v1editbody1">

m_467061415371348611m_4273285105508718137m_-599886662404354667v1v1editbody1=

">

-width:0px;font-family:Arial, Helvetica, sans-serif;font-feature-settings:&=

quot;liga" 0;font-size:small;line-height:normal;" cellspacing=3D"0" =

width=3D"553">

10, 139, 168);border-width:0px;margin:0px;padding:0in;vertical-align:top;" = colspan=3D"3"> style=3D"border-collapse:collapse;border-width:0px;font-family:-apple-syste= m, BlinkMacSystemFont, "Helvetica Neue", "Segoe UI", = Arial, sans-serif, "Apple Color Emoji", "Segoe UI = Emoji", "Segoe UI Symbol";font-feature-settings:"liga&q= uot; 0;font-size:13px;line-height:normal;" cellspacing=3D"0"> style=3D"height:5.25pt;"> style=3D"border-width:0px;height:5.25pt;margin:0px;padding:0in;">  > style=3D"border-width:0px;margin:0px;padding:0in;width:0.25in;" = width=3D"24">  style=3D"border-width:0px;margin:0px;padding:0in;"> style=3D"font-family:-apple-system, BlinkMacSystemFont, "Helvetica = Neue", "Segoe UI", Arial, sans-serif, "Apple Color = Emoji", "Segoe UI Emoji", "Segoe UI = Symbol";margin:0px;"> sans-serif;font-size:13.5pt;">
92, 208, 228);border-width:0px;margin:0px;padding:0in;width:1.5pt;" = width=3D"2">	n:0px;padding:0in;"> style=3D"border-collapse:collapse;border-width:0px;font-family:-apple-syste= m, BlinkMacSystemFont, "Helvetica Neue", "Segoe UI", = Arial, sans-serif, "Apple Color Emoji", "Segoe UI = Emoji", "Segoe UI Symbol";font-feature-settings:"liga&q= uot; 0;font-size:13px;line-height:normal;" cellspacing=3D"0"> style=3D"background-color:rgb(230, 236, 244);border-width:0px;margin:0px;pa= dding:0in;width:411.75pt;" width=3D"549"> class=3D"table" style=3D"width:411.75pt;"> style=3D"border-collapse:collapse;border-width:0px;font-family:-apple-syste= m, BlinkMacSystemFont, "Helvetica Neue", "Segoe UI", = Arial, sans-serif, "Apple Color Emoji", "Segoe UI = Emoji", "Segoe UI Symbol";font-feature-settings:"liga&q= uot; 0;line-height:normal;" cellspacing=3D"0" width=3D"549"> = = = = = = = = = = = = = = = width=3D"24">  p;"> = "Helvetica Neue", "Segoe UI", Arial, sans-serif, = "Apple Color Emoji", "Segoe UI Emoji", "Segoe UI = Symbol";margin:0px;"> 64);font-family:Helvetica, sans-serif;font-size:13.5pt;">Payment&nb= sp;    style=3D"color:rgb(231,123,7);font-family:Helvetica, sans-serif;font-size:7= .5pt;">Due: 13/07/2026 168);font-family:Helvetica, sans-serif;font-size:10.= 5pt;">033747 = ttom;"> = "Helvetica Neue", "Segoe UI", Arial, sans-serif, = "Apple Color Emoji", "Segoe UI Emoji", "Segoe UI = Symbol";margin:0px;text-align:right;"> 62);font-family:Helvetica, sans-serif;font-size:10.5pt;">Amount = Paid:   62);font-family:Helvetica, sans-serif;font-size:22.5pt;">$3,378.= 00 = width=3D"24">  =   =   =   =   Remittance phish from Google Gmail Part 3 Posted by Dave Yadallee on Tuesday, July 14. 2026 system, BlinkMacSystemFont, "Helvetica Neue", "Segoe = UI", Arial, sans-serif, "Apple Color Emoji", "Segoe UI = Emoji", "Segoe UI Symbol";margin:0px;">  style=3D"width:411.75pt;"> style=3D"border-collapse:collapse;border-width:0px;font-family:-apple-syste= m, BlinkMacSystemFont, "Helvetica Neue", "Segoe UI", = Arial, sans-serif, "Apple Color Emoji", "Segoe UI = Emoji", "Segoe UI Symbol";font-feature-settings:"liga&q= uot; 0;font-size:13px;line-height:normal;" cellspacing=3D"0" = width=3D"549"> style=3D"border-width:0px;margin:0px;padding:0in;vertical-align:top;"> class=3D"table" style=3D"width:411.75pt;"> style=3D"border-bottom-style:solid;border-bottom-width:3pt;border-collapse:= collapse;border-color:initial;border-left-style:none;border-left-width:medi= um;border-right-style:none;border-right-width:medium;border-top-style:none;= border-top-width:medium;font-family:-apple-system, BlinkMacSystemFont, = "Helvetica Neue", "Segoe UI", Arial, sans-serif, = "Apple Color Emoji", "Segoe UI Emoji", "Segoe UI = Symbol";font-feature-settings:"liga" 0;line-height:normal;" = cellspacing=3D"0" width=3D"549"> = = = = = = = = "Helvetica Neue", "Segoe UI", Arial, sans-serif, = "Apple Color Emoji", "Segoe UI Emoji", "Segoe UI = Symbol";line-height:12pt;margin:0px;"> tica, sans-serif;font-size:10.5pt;">Hello  style=3D"font-family:Arial, Helvetica, sans-serif;font-size:small;">Dear = Customer, sans-serif;font-size:10.5pt;">, = "Helvetica Neue", "Segoe UI", Arial, sans-serif, = "Apple Color Emoji", "Segoe UI Emoji", "Segoe UI = Symbol";line-height:12pt;margin:0px;">  = "Helvetica Neue", "Segoe UI", Arial, sans-serif, = "Apple Color Emoji", "Segoe UI Emoji", "Segoe UI = Symbol";line-height:12pt;margin:0px;"> tica, sans-serif;font-size:10.5pt;">Payment has been remitted into your = account with receipt for your reference. = "Helvetica Neue", "Segoe UI", Arial, sans-serif, = "Apple Color Emoji", "Segoe UI Emoji", "Segoe UI = Symbol";line-height:12pt;margin:0px;">  = "Helvetica Neue", "Segoe UI", Arial, sans-serif, = "Apple Color Emoji", "Segoe UI Emoji", "Segoe UI = Symbol";line-height:12pt;margin:0px;"> (110, 139, 168);border-radius:4px;color:white;display:inline-block;font-fam= ily:Helvetica, sans-serif;font-size:10.5pt;padding:8px = 16px;text-decoration-line:none;" href=3D"https://distropical.com/th.= php">VIEW PAYMENT RECEIPT = "Helvetica Neue", "Segoe UI", Arial, sans-serif, = "Apple Color Emoji", "Segoe UI Emoji", "Segoe UI = Symbol";line-height:12pt;margin:0px;">  = "Helvetica Neue", "Segoe UI", Arial, sans-serif, = "Apple Color Emoji", "Segoe UI Emoji", "Segoe UI = Symbol";line-height:12pt;margin:0px;"> tica, sans-serif;font-size:10.5pt;">Thank you for your business.= Sincerely, Finance Department = = class=3D"table"> style=3D"border-collapse:collapse;border-width:0px;font-family:-apple-syste= m, BlinkMacSystemFont, "Helvetica Neue", "Segoe UI", = Arial, sans-serif, "Apple Color Emoji", "Segoe UI = Emoji", "Segoe UI Symbol";font-feature-settings:"liga&q= uot; 0;line-height:normal;" cellspacing=3D"0"> = = = = = = =	92, 208, 228);border-width:0px;margin:0px;padding:0in;width:1.5pt;" = width=3D"2">
1, 50, 70);border-width:0px;margin:0px;padding:0in;" colspan=3D"3"> system, BlinkMacSystemFont, "Helvetica Neue", "Segoe = UI", Arial, sans-serif, "Apple Color Emoji", "Segoe UI = Emoji", "Segoe UI Symbol";margin:0px;text-align:right;">&nbs= p;

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Mon, 13 Jul 2026 16:12:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wjOsC-00000000MJW-1DSa

for dave@doctor.nl2k.ab.ca;

Mon, 13 Jul 2026 16:11:36 -0600

Resent-From: The Doctor

Resent-Date: Mon, 13 Jul 2026 16:11:36 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-oo1-f104.google.com ([209.85.161.104]:61490)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wjOr3-00000000MDe-3acn

for doctor@doctor.nl2k.ab.ca;

Mon, 13 Jul 2026 16:10:38 -0600

Received: by mail-oo1-f104.google.com with SMTP id 006d021491bc7-6a3776acb16so260886eaf.2

for ; Mon, 13 Jul 2026 15:09:39 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=sabeng.it; s=google; t=1783980573; x=1784585373; darn=doctor.nl2k.ab.ca;

h=content-type:mime-version:date:content-transfer-encoding:message-id

:subject:to:from:from:to:cc:subject:date:message-id:reply-to

:content-type;

bh=SQeYhuGtuot8NB4/jQiU1QF7G5cKOkSJgl7Tik7+V1Q=;

b=iQSJAU4FSEAPmfzsMfKanmkqLUk/nqUzL2w/oBJQ71qynPwglYoUCKyG26NAOg5ki1

BY5WbaWWlczsI57CmuW+CNgKOcho6cwxxrtGuoyIIyPg0y8cvzNpNlfIGUzPSbQwDypg

MK6xboL1RrilQVO7SCMZ2+GlQr4nHznwnhrak=

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20251104; t=1783980573; x=1784585373;

h=content-type:mime-version:date:content-transfer-encoding:message-id

:subject:to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date

:message-id:reply-to:content-type;

bh=SQeYhuGtuot8NB4/jQiU1QF7G5cKOkSJgl7Tik7+V1Q=;

b=rUdFU8Da1eblkmkno997+mKSREriJXL+I0lG45GkN0m0XAHrYktWjGQCgrFsI8KLJu

nFpb2VlrtGx1EVTrvI0j0Ejv6dVuYaPdZV52vI5FKCPndslihjm4C1j99Wy2sl6RW/7c

T22Hu6yvNZ7uG70DSbdcNjg/H7MgNXiLMEt0BGOIQT52ZNZm6wRbunHoOzeMn/biJ3se

JheYnUO4szJiRAv+mGt+QmQcQEi1/1hxN3B9yHr3t1/lCdl2k9ddxBUlGkooZkXsH2Y9

B/sTqhWsOTklgEAI4VGFrW0kuBw55VmIzog4rTw5Ulh+J1LL9aVdJvrRnAtVUIT1OhAX

+rHA==

X-Gm-Message-State: AOJu0Yy1wTv4Az5t1GMCMfxvyq4RaEmFIH746/Utk2xOoUeqNEdzhVe5

HWnNZDpS011EtNjDpTiUWzxQ787tnxxlPleCchBsIcTl2geyWhcPg1uvzMGJ+UaYhvElYhnEdsm

QxZ3SwBBkCy7c9HvDi3Ezke/ZpJ/hVCSC3ux6nPB0QZPZHQY=

X-Gm-Gg: AfdE7cn4cg+4A/2yNqoVdWRP9dzjvsx2KPr8rg+tLr8JTjlYUwb7JwSSf0AokSHdMXH

dK6VNf1AcwFG5+ZNghwL/a7QW3fQ4YKioDsVD8HYhIaCQ67eecSvRj1E8G1+Oq+uPrJbpLUHoY7

0gkBIhVMjpBz0KRTJ5eP1MBQWgB0039tT2h8rGoBxfLh1cI6Ljp6BaiP2RittdKX4ag33lrz+pD

PiR1jZHoqgD3Y8UaMVFW1ASRaiMSo1Qh8OQKDNKleGx6OPf2j3D3vfbl1XRfhNuxP3Vj6n+3HWh

1r9mYQ/L2FTAQSgsXAhUFlwT5Zq2t0KDSXk/5cZPLT8CxpJ2s/CKevdoDBQw3rbZ+NqDSAU78q5

0xTz9vFaObvvmfBYzif0rdXU=

X-Received: by 2002:a05:6820:1b05:b0:6a1:60cd:9854 with SMTP id 006d021491bc7-6a39a7222d1mr6460046eaf.53.1783980572857;

Mon, 13 Jul 2026 15:09:32 -0700 (PDT)

Received: from sabprogetti.com ([192.210.236.148])

by smtp-relay.gmail.com with ESMTPS id 006d021491bc7-6a387892d32sm542134eaf.25.2026.07.13.15.09.32

for

(version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256);

Mon, 13 Jul 2026 15:09:32 -0700 (PDT)

X-Relaying-Domain: sabeng.it

From: "alert@remittance.com | EFT Portal/OU=EXCHANGE ADMINISTRATIVE GROUP

(FYDIBOHF23SPDLT)/CN=RECIPIENTS/CN=B7A707497B564FD-10700"



To: doctor@doctor.nl2k.ab.ca

Subject: =?UTF-8?Q?ACH_Payment_Processed_=EF=BF=BD_Thu=2C_J?=

=?UTF-8?Q?uly_9=2C_2026_=EF=BF=BD_07/13/2026_?=

=?UTF-8?Q?=EF=BF=BD_doctor=40doctor=2Enl2k=2Eab=2E?= =?UTF-8?Q?ca?=

Message-ID: <97c00ed5-e038-3336-0a79-8bd3fbb0edc8@sabeng.it>

Content-Transfer-Encoding: quoted-printable

Date: Mon, 13 Jul 2026 22:09:31 +0000

MIME-Version: 1.0

Content-Type: text/html; charset=utf-8

X-Spam_score: 6.3

X-Spam_score_int: 63

X-Spam_bar: ++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview:  Payment Due: 13/07/2026 033747 Amount Paid: $3,378.00



Content analysis details: (6.3 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[192.210.236.148 listed in dnsbl.ahbl.org]

[192.210.236.148 listed in dnsbl.ahbl.org]

[192.210.236.148 listed in dnsbl.ahbl.org]

[192.210.236.148 listed in dnsbl.ahbl.org]

[209.85.161.104 listed in dnsbl.ahbl.org]

[209.85.161.104 listed in dnsbl.ahbl.org]

[209.85.161.104 listed in dnsbl.ahbl.org]

[209.85.161.104 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[192.210.236.148 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[192.210.236.148 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[192.210.236.148 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[192.210.236.148 listed in dnsbl.ahbl.org]

1.2 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a relay in bl.spamcop.net

[Blocked - see ]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[192.210.236.148 listed in will-spam-for-food.eu.org]

[192.210.236.148 listed in will-spam-for-food.eu.org]

[192.210.236.148 listed in will-spam-for-food.eu.org]

[192.210.236.148 listed in will-spam-for-food.eu.org]

[192.210.236.148 listed in will-spam-for-food.eu.org]

[192.210.236.148 listed in will-spam-for-food.eu.org]

[192.210.236.148 listed in will-spam-for-food.eu.org]

[192.210.236.148 listed in will-spam-for-food.eu.org]

[209.85.161.104 listed in will-spam-for-food.eu.org]

[209.85.161.104 listed in will-spam-for-food.eu.org]

[209.85.161.104 listed in will-spam-for-food.eu.org]

[209.85.161.104 listed in will-spam-for-food.eu.org]

[209.85.161.104 listed in will-spam-for-food.eu.org]

[209.85.161.104 listed in will-spam-for-food.eu.org]

[209.85.161.104 listed in will-spam-for-food.eu.org]

[209.85.161.104 listed in will-spam-for-food.eu.org]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[209.85.161.104 listed in list.dnswl.org]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-0.0 SPF_PASS SPF: sender matches SPF record

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[209.85.161.104 listed in bl.score.senderscore.com]

-0.0 RCVD_IN_MSPIKE_H3 RBL: Good reputation (+3)

[209.85.161.104 listed in wl.mailspike.net]

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

2.0 RATWR8_MESSID Message-ID with excessive dashes and dollars

-0.0 RCVD_IN_MSPIKE_WL Mailspike good senders

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

0.0 LOTS_OF_MONEY Huge... sums of money

0.0 NO_RDNS2 Sending MTA has no reverse DNS

0.6 HTML_MIME_NO_HTML_TAG HTML-only message, but there is no HTML tag

Subject: {SPAM?} =?UTF-8?Q?ACH_Payment_Processed_=EF=BF=BD_Thu=2C_J?=

=?UTF-8?Q?uly_9=2C_2026_=EF=BF=BD_07/13/2026_?=

=?UTF-8?Q?=EF=BF=BD_doctor=40doctor=2Enl2k=2Eab=2E?= =?UTF-8?Q?ca?=

system, BlinkMacSystemFont, "Helvetica Neue", "Segoe =

UI", Arial, sans-serif, "Apple Color Emoji", "Segoe UI =

Emoji", "Segoe UI Symbol";margin:0px;"> 

style=3D"width:411.75pt;">


style=3D"border-collapse:collapse;border-width:0px;font-family:-apple-syste=

m, BlinkMacSystemFont, "Helvetica Neue", "Segoe UI", =

Arial, sans-serif, "Apple Color Emoji", "Segoe UI =

Emoji", "Segoe UI Symbol";font-feature-settings:"liga&q=

uot; 0;font-size:13px;line-height:normal;" cellspacing=3D"0" =

width=3D"549">

style=3D"border-width:0px;margin:0px;padding:0in;vertical-align:top;"> class=3D"table" style=3D"width:411.75pt;"> style=3D"border-bottom-style:solid;border-bottom-width:3pt;border-collapse:= collapse;border-color:initial;border-left-style:none;border-left-width:medi= um;border-right-style:none;border-right-width:medium;border-top-style:none;= border-top-width:medium;font-family:-apple-system, BlinkMacSystemFont, = "Helvetica Neue", "Segoe UI", Arial, sans-serif, = "Apple Color Emoji", "Segoe UI Emoji", "Segoe UI = Symbol";font-feature-settings:"liga" 0;line-height:normal;" = cellspacing=3D"0" width=3D"549"> = = = = = = = = "Helvetica Neue", "Segoe UI", Arial, sans-serif, = "Apple Color Emoji", "Segoe UI Emoji", "Segoe UI = Symbol";line-height:12pt;margin:0px;"> tica, sans-serif;font-size:10.5pt;">Hello  style=3D"font-family:Arial, Helvetica, sans-serif;font-size:small;">Dear = Customer, sans-serif;font-size:10.5pt;">, = "Helvetica Neue", "Segoe UI", Arial, sans-serif, = "Apple Color Emoji", "Segoe UI Emoji", "Segoe UI = Symbol";line-height:12pt;margin:0px;">  = "Helvetica Neue", "Segoe UI", Arial, sans-serif, = "Apple Color Emoji", "Segoe UI Emoji", "Segoe UI = Symbol";line-height:12pt;margin:0px;"> tica, sans-serif;font-size:10.5pt;">Payment has been remitted into your = account with receipt for your reference. = "Helvetica Neue", "Segoe UI", Arial, sans-serif, = "Apple Color Emoji", "Segoe UI Emoji", "Segoe UI = Symbol";line-height:12pt;margin:0px;">  = "Helvetica Neue", "Segoe UI", Arial, sans-serif, = "Apple Color Emoji", "Segoe UI Emoji", "Segoe UI = Symbol";line-height:12pt;margin:0px;"> (110, 139, 168);border-radius:4px;color:white;display:inline-block;font-fam= ily:Helvetica, sans-serif;font-size:10.5pt;padding:8px = 16px;text-decoration-line:none;" href=3D"https://distropical.com/th.= php">VIEW PAYMENT RECEIPT = "Helvetica Neue", "Segoe UI", Arial, sans-serif, = "Apple Color Emoji", "Segoe UI Emoji", "Segoe UI = Symbol";line-height:12pt;margin:0px;">  = "Helvetica Neue", "Segoe UI", Arial, sans-serif, = "Apple Color Emoji", "Segoe UI Emoji", "Segoe UI = Symbol";line-height:12pt;margin:0px;"> tica, sans-serif;font-size:10.5pt;">Thank you for your business.= Sincerely, Finance Department = = class=3D"table"> style=3D"border-collapse:collapse;border-width:0px;font-family:-apple-syste= m, BlinkMacSystemFont, "Helvetica Neue", "Segoe UI", = Arial, sans-serif, "Apple Color Emoji", "Segoe UI = Emoji", "Segoe UI Symbol";font-feature-settings:"liga&q= uot; 0;line-height:normal;" cellspacing=3D"0"> = = = = = = =

92, 208, 228);border-width:0px;margin:0px;padding:0in;width:1.5pt;" =

width=3D"2"> 






1, 50, 70);border-width:0px;margin:0px;padding:0in;" colspan=3D"3">

system, BlinkMacSystemFont, "Helvetica Neue", "Segoe =

UI", Arial, sans-serif, "Apple Color Emoji", "Segoe UI =

Emoji", "Segoe UI Symbol";margin:0px;text-align:right;">&nbs=

p;

=EF=BB=BF

 

, 255, 255);color:rgb(34, 34, 34);font-family:Arial, Helvetica, =

sans-serif;font-size:small;font-style:normal;font-variant-caps:normal;font-=

variant-ligatures:normal;font-weight:400;letter-spacing:normal;orphans:2;te=

xt-align:start;text-decoration-color:initial;text-decoration-style:initial;=

text-decoration-thickness:initial;text-indent:0px;text-transform:none;white=

-space:normal;widows:2;word-spacing:0px;" type=3D"cite">

t;" id=3D"m_-2910760642012011069m_467061415371348611m_4273285105508718137m_=

-599886662404354667editbody1">

7061415371348611m_4273285105508718137m_-599886662404354667v1editbody1">

m_467061415371348611m_4273285105508718137m_-599886662404354667v1v1editbody1=

">

-width:0px;font-family:Arial, Helvetica, sans-serif;font-feature-settings:&=

quot;liga" 0;font-size:small;line-height:normal;" cellspacing=3D"0" =

width=3D"553">

10, 139, 168);border-width:0px;margin:0px;padding:0in;vertical-align:top;" = colspan=3D"3"> style=3D"border-collapse:collapse;border-width:0px;font-family:-apple-syste= m, BlinkMacSystemFont, "Helvetica Neue", "Segoe UI", = Arial, sans-serif, "Apple Color Emoji", "Segoe UI = Emoji", "Segoe UI Symbol";font-feature-settings:"liga&q= uot; 0;font-size:13px;line-height:normal;" cellspacing=3D"0"> style=3D"height:5.25pt;"> style=3D"border-width:0px;height:5.25pt;margin:0px;padding:0in;">  > style=3D"border-width:0px;margin:0px;padding:0in;width:0.25in;" = width=3D"24">  style=3D"border-width:0px;margin:0px;padding:0in;"> style=3D"font-family:-apple-system, BlinkMacSystemFont, "Helvetica = Neue", "Segoe UI", Arial, sans-serif, "Apple Color = Emoji", "Segoe UI Emoji", "Segoe UI = Symbol";margin:0px;"> sans-serif;font-size:13.5pt;">

92, 208, 228);border-width:0px;margin:0px;padding:0in;width:1.5pt;" = width=3D"2">

n:0px;padding:0in;"> style=3D"border-collapse:collapse;border-width:0px;font-family:-apple-syste= m, BlinkMacSystemFont, "Helvetica Neue", "Segoe UI", = Arial, sans-serif, "Apple Color Emoji", "Segoe UI = Emoji", "Segoe UI Symbol";font-feature-settings:"liga&q= uot; 0;font-size:13px;line-height:normal;" cellspacing=3D"0"> style=3D"background-color:rgb(230, 236, 244);border-width:0px;margin:0px;pa= dding:0in;width:411.75pt;" width=3D"549"> class=3D"table" style=3D"width:411.75pt;"> style=3D"border-collapse:collapse;border-width:0px;font-family:-apple-syste= m, BlinkMacSystemFont, "Helvetica Neue", "Segoe UI", = Arial, sans-serif, "Apple Color Emoji", "Segoe UI = Emoji", "Segoe UI Symbol";font-feature-settings:"liga&q= uot; 0;line-height:normal;" cellspacing=3D"0" width=3D"549"> = = = = = = = = = = = = = = = width=3D"24">  p;"> = "Helvetica Neue", "Segoe UI", Arial, sans-serif, = "Apple Color Emoji", "Segoe UI Emoji", "Segoe UI = Symbol";margin:0px;"> 64);font-family:Helvetica, sans-serif;font-size:13.5pt;">Payment&nb= sp;    style=3D"color:rgb(231,123,7);font-family:Helvetica, sans-serif;font-size:7= .5pt;">Due: 13/07/2026 168);font-family:Helvetica, sans-serif;font-size:10.= 5pt;">033747 = ttom;"> = "Helvetica Neue", "Segoe UI", Arial, sans-serif, = "Apple Color Emoji", "Segoe UI Emoji", "Segoe UI = Symbol";margin:0px;text-align:right;"> 62);font-family:Helvetica, sans-serif;font-size:10.5pt;">Amount = Paid:   62);font-family:Helvetica, sans-serif;font-size:22.5pt;">$3,378.= 00 = width=3D"24">  =   =   =   =