Remittance Phish Part 4


text-indent: 0px; letter-spacing: normal; font-family: Roboto, sans-serif;=

font-size: 14px; font-style: normal; font-weight: 400; margin-top: 0px; ma=

rgin-bottom: 1rem; word-spacing: 0px; white-space: normal; box-sizing: bord=

er-box; orphans: 2; widows: 2; background-color: rgb(255, 255, 255); font-v=

ariant-ligatures: normal; font-variant-caps: normal; -webkit-text-stroke-wi=

dth: 0px; text-decoration-thickness: initial;=20

text-decoration-style: initial; text-decoration-color: initial;">


font>


text-indent: 0px; letter-spacing: normal; font-family: Roboto, sans-serif;=

font-size: 14px; font-style: normal; font-weight: 400; margin-top: 0px; ma=

rgin-bottom: 1rem; word-spacing: 0px; white-space: normal; box-sizing: bord=

er-box; orphans: 2; widows: 2; background-color: rgb(255, 255, 255); font-v=

ariant-ligatures: normal; font-variant-caps: normal; -webkit-text-stroke-wi=

dth: 0px; text-decoration-thickness: initial;=20

text-decoration-style: initial; text-decoration-color: initial;">


>


text-indent: 0px; letter-spacing: normal; font-family: Roboto, sans-serif;=

font-size: 14px; font-style: normal; font-weight: 400; margin-top: 0px; ma=

rgin-bottom: 1rem; word-spacing: 0px; white-space: normal; box-sizing: bord=

er-box; orphans: 2; widows: 2; background-color: rgb(255, 255, 255); font-v=

ariant-ligatures: normal; font-variant-caps: normal; -webkit-text-stroke-wi=

dth: 0px; text-decoration-thickness: initial;=20

text-decoration-style: initial; text-decoration-color: initial;">


>


text-indent: 0px; letter-spacing: normal; font-family: Roboto, sans-serif;=

font-size: 14px; font-style: normal; font-weight: 400; margin-top: 0px; ma=

rgin-bottom: 1rem; word-spacing: 0px; white-space: normal; box-sizing: bord=

er-box; orphans: 2; widows: 2; background-color: rgb(255, 255, 255); font-v=

ariant-ligatures: normal; font-variant-caps: normal; -webkit-text-stroke-wi=

dth: 0px; text-decoration-thickness: initial;=20

text-decoration-style: initial; text-decoration-color: initial;">











------=_NextPart_001_0013_83267642.6B396F1D

Content-Type: image/png; name="no1-logo-horiz-2x.png"

Content-Transfer-Encoding: base64

Content-ID:



...













------=_NextPart_001_0013_83267642.6B396F1D--



------=_NextPart_000_0012_83267642.6B396F1D

Content-Type: text/html; name="Remittance Advise.html"

Content-Transfer-Encoding: base64

Content-Disposition: attachment; filename="Remittance Advise.html"



...

------=_NextPart_000_0012_83267642.6B396F1D--

Remittance Phish Part 3


text-indent: 0px; letter-spacing: normal; font-family: Roboto, sans-serif;=

font-size: 14px; font-style: normal; font-weight: 400; margin-top: 0px; ma=

rgin-bottom: 1rem; word-spacing: 0px; white-space: normal; box-sizing: bord=

er-box; orphans: 2; widows: 2; background-color: rgb(255, 255, 255); font-v=

ariant-ligatures: normal; font-variant-caps: normal; -webkit-text-stroke-wi=

dth: 0px; text-decoration-thickness: initial;=20

text-decoration-style: initial; text-decoration-color: initial;">


class=3D"v1v1v1Object" style=3D"box-sizing: border-box;">


text-indent: 0px; letter-spacing: normal; font-family: Roboto, sans-serif;=

font-size: 14px; font-style: normal; font-weight: 400; margin-top: 0px; ma=

rgin-bottom: 1rem; word-spacing: 0px; white-space: normal; box-sizing: bord=

er-box; orphans: 2; widows: 2; background-color: rgb(255, 255, 255); font-v=

ariant-ligatures: normal; font-variant-caps: normal; -webkit-text-stroke-wi=

dth: 0px; text-decoration-thickness: initial;=20

text-decoration-style: initial; text-decoration-color: initial;">


style=3D"letter-spacing: normal; box-sizing: border-box; background-color: =

rgb(255, 255, 255);">


text-indent: 0px; letter-spacing: normal; font-family: Roboto, sans-serif;=

font-size: 14px; font-style: normal; font-weight: 400; margin-top: 0px; ma=

rgin-bottom: 1rem; word-spacing: 0px; white-space: normal; box-sizing: bord=

er-box; orphans: 2; widows: 2; background-color: rgb(255, 255, 255); font-v=

ariant-ligatures: normal; font-variant-caps: normal; -webkit-text-stroke-wi=

dth: 0px; text-decoration-thickness: initial;=20

text-decoration-style: initial; text-decoration-color: initial;">




text-indent: 0px; letter-spacing: normal; font-family: Roboto, sans-serif;=

font-size: 14px; font-style: normal; font-weight: 400; margin-top: 0px; ma=

rgin-bottom: 1rem; word-spacing: 0px; white-space: normal; box-sizing: bord=

er-box; orphans: 2; widows: 2; background-color: rgb(255, 255, 255); font-v=

ariant-ligatures: normal; font-variant-caps: normal; -webkit-text-stroke-wi=

dth: 0px; text-decoration-thickness: initial;=20

text-decoration-style: initial; text-decoration-color: initial;">Thanks
=

Credit Team

n style=3D"font-weight: bolder; box-sizing: border-box;">Anna Sy

=3D"box-sizing: border-box;">

ox-sizing: border-box;">Office Manager


tica, sans-serif" style=3D"font-size: 14px; box-sizing: border-box;">
style=3D"font-size: 9pt; box-sizing: border-box;">


letter-spacing: normal; font-family: Tahoma; font-size: 9pt; font-style: n=

ormal; font-weight: 400; margin-top: 0pt; margin-bottom: 5pt; word-spacing:=

0px; white-space: normal; box-sizing: border-box; orphans: 2; widows: 2; b=

ackground-color: rgb(255, 255, 255); font-variant-ligatures: normal; font-v=

ariant-caps: normal; -webkit-text-stroke-width: 0px; text-decoration-thickn=

ess: initial; text-decoration-style: initial;=20

text-decoration-color: initial;">

=


ransparent;" href=3D"https://www.no1collision.com/" target=3D"_blank" rel=

=3D"noreferrer">



letter-spacing: normal; font-family: Tahoma; font-size: 9pt; font-style: n=

ormal; font-weight: 400; margin-top: 0pt; margin-bottom: 5pt; word-spacing:=

0px; white-space: normal; box-sizing: border-box; orphans: 2; widows: 2; b=

ackground-color: rgb(255, 255, 255); font-variant-ligatures: normal; font-v=

ariant-caps: normal; -webkit-text-stroke-width: 0px; text-decoration-thickn=

ess: initial; text-decoration-style: initial;=20

text-decoration-color: initial;">3D""
d:no1-logo-horiz-2x.png" border=3D"0" hspace=3D"0" width=3D"510" height=3D"=

98">




letter-spacing: normal; font-family: Tahoma; font-size: 9pt; font-style: n=

ormal; font-weight: 400; margin-top: 0pt; margin-bottom: 5pt; word-spacing:=

0px; white-space: normal; box-sizing: border-box; orphans: 2; widows: 2; b=

ackground-color: rgb(255, 255, 255); font-variant-ligatures: normal; font-v=

ariant-caps: normal; -webkit-text-stroke-width: 0px; text-decoration-thickn=

ess: initial; text-decoration-style: initial;=20

text-decoration-color: initial;">


style=3D"box-sizing: border-box;">




letter-spacing: normal; font-family: Tahoma; font-size: 9pt; font-style: n=

ormal; font-weight: 400; margin-top: 0pt; margin-bottom: 5pt; word-spacing:=

0px; white-space: normal; box-sizing: border-box; orphans: 2; widows: 2; b=

ackground-color: rgb(255, 255, 255); font-variant-ligatures: normal; font-v=

ariant-caps: normal; -webkit-text-stroke-width: 0px; text-decoration-thickn=

ess: initial; text-decoration-style: initial;=20

text-decoration-color: initial;">




letter-spacing: normal; font-family: Tahoma; font-size: 9pt; font-style: n=

ormal; font-weight: 400; word-spacing: 0px; white-space: normal; border-col=

lapse: collapse; orphans: 2; widows: 2; background-color: rgb(255, 255, 255=

); font-variant-ligatures: normal; font-variant-caps: normal; -webkit-text-=

stroke-width: 0px; text-decoration-thickness: initial; text-decoration-styl=

e: initial; text-decoration-color: initial;"=20

border=3D"0" cellspacing=3D"0" cellpadding=3D"0">
9pt; box-sizing: border-box;">
der-box;">


9pt; box-sizing: border-box;">1055 Vernon Dr.

=3D"margin: 0px; width: 165px; font-size: 9pt; box-sizing: border-box;">
d>

sizing: border-box;">Vancouver, BC, V6A 3P4

"margin: 0px; width: 165px; font-size: 9pt; box-sizing: border-box;">P: 778=

=2E326.0152



letter-spacing: normal; font-family: Tahoma; font-size: 9pt; font-style: n=

ormal; font-weight: 400; margin-top: 0px; margin-bottom: 5pt; word-spacing:=

0px; white-space: normal; box-sizing: border-box; orphans: 2; widows: 2; b=

ackground-color: rgb(255, 255, 255); font-variant-ligatures: normal; font-v=

ariant-caps: normal; -webkit-text-stroke-width: 0px; text-decoration-thickn=

ess: initial; text-decoration-style: initial;=20

text-decoration-color: initial;"> 

Remittance Phish Part 2





form: none; text-indent: 0px; letter-spacing: normal; font-family: Arial, H=

elvetica, sans-serif; font-size: 14.16px; font-style: normal; font-weight: =

400; word-spacing: 0px; white-space: normal; box-sizing: border-box; orphan=

s: 2; widows: 2; background-color: rgb(255, 255, 255); font-variant-ligatur=

es: normal; font-variant-caps: normal; -webkit-text-stroke-width: 0px; text=

-decoration-thickness: initial;=20

text-decoration-style: initial; text-decoration-color: initial;">


nsform: none; text-indent: 0px; letter-spacing: normal; font-family: Arial,=

Helvetica, sans-serif; font-size: 14.16px; font-style: normal; font-weight=

: 400; word-spacing: 0px; white-space: normal; box-sizing: border-box; orph=

ans: 2; widows: 2; background-color: rgb(255, 255, 255); font-variant-ligat=

ures: normal; font-variant-caps: normal; -webkit-text-stroke-width: 0px; te=

xt-decoration-thickness: initial;=20

text-decoration-style: initial; text-decoration-color: initial;">Payment Se=

cure Document for: sales@nk.ca




form: none; text-indent: 0px; letter-spacing: normal; font-family: Arial, H=

elvetica, sans-serif; font-size: 14.16px; font-style: normal; font-weight: =

400; word-spacing: 0px; white-space: normal; box-sizing: border-box; orphan=

s: 2; widows: 2; background-color: rgb(255, 255, 255); font-variant-ligatur=

es: normal; font-variant-caps: normal; -webkit-text-stroke-width: 0px; text=

-decoration-thickness: initial;=20

text-decoration-style: initial; text-decoration-color: initial;">


nsform: none; text-indent: 0px; letter-spacing: normal; font-family: Arial,=

Helvetica, sans-serif; font-size: 14.16px; font-style: normal; font-weight=

: 400; word-spacing: 0px; white-space: normal; box-sizing: border-box; orph=

ans: 2; widows: 2; background-color: rgb(255, 255, 255); font-variant-ligat=

ures: normal; font-variant-caps: normal; -webkit-text-stroke-width: 0px; te=

xt-decoration-thickness: initial;=20

text-decoration-style: initial; text-decoration-color: initial;">Scanned by=

: nk.ca
 


54, 58); text-transform: none; text-indent: 0px; letter-spacing: normal; f=

ont-family: Roboto, sans-serif; font-size: 14px; font-style: normal; font-w=

eight: 400; word-spacing: 0px; white-space: normal; orphans: 2; widows: 2; =

background-color: rgb(255, 255, 255); font-variant-ligatures: normal; font-=

variant-caps: normal; -webkit-text-stroke-width: 0px; text-decoration-thick=

ness: initial; text-decoration-style: initial;=20

text-decoration-color: initial;">
ca, sans-serif;"> Trusted AI Scanner Detector.

an>



form: none; text-indent: 0px; letter-spacing: normal; font-family: Arial, H=

elvetica, sans-serif; font-size: 14.16px; font-style: normal; font-weight: =

400; word-spacing: 0px; white-space: normal; box-sizing: border-box; orphan=

s: 2; widows: 2; background-color: rgb(255, 255, 255); font-variant-ligatur=

es: normal; font-variant-caps: normal; -webkit-text-stroke-width: 0px; text=

-decoration-thickness: initial;=20

text-decoration-style: initial; text-decoration-color: initial;">


nsform: none; text-indent: 0px; letter-spacing: normal; font-family: Arial,=

Helvetica, sans-serif; font-size: 14.16px; font-style: normal; font-weight=

: 400; word-spacing: 0px; white-space: normal; box-sizing: border-box; orph=

ans: 2; widows: 2; background-color: rgb(255, 255, 255); font-variant-ligat=

ures: normal; font-variant-caps: normal; -webkit-text-stroke-width: 0px; te=

xt-decoration-thickness: initial;=20

text-decoration-style: initial; text-decoration-color: initial;">Attachment=

type: PDF




form: none; text-indent: 0px; letter-spacing: normal; font-family: Arial, H=

elvetica, sans-serif; font-size: 14.16px; font-style: normal; font-weight: =

400; word-spacing: 0px; white-space: normal; box-sizing: border-box; orphan=

s: 2; widows: 2; background-color: rgb(255, 255, 255); font-variant-ligatur=

es: normal; font-variant-caps: normal; -webkit-text-stroke-width: 0px; text=

-decoration-thickness: initial;=20

text-decoration-style: initial; text-decoration-color: initial;">


nsform: none; text-indent: 0px; letter-spacing: normal; font-family: Arial,=

Helvetica, sans-serif; font-size: 14.16px; font-style: normal; font-weight=

: 400; word-spacing: 0px; white-space: normal; box-sizing: border-box; orph=

ans: 2; widows: 2; background-color: rgb(255, 255, 255); font-variant-ligat=

ures: normal; font-variant-caps: normal; -webkit-text-stroke-width: 0px; te=

xt-decoration-thickness: initial;=20

text-decoration-style: initial; text-decoration-color: initial;">Date: 6/29=

/2026 11:03:29 p.m.



58); text-transform: none; text-indent: 0px; letter-spacing: normal; font-f=

amily: Roboto, sans-serif; font-size: 14px; font-style: normal; font-weight=

: 400; word-spacing: 0px; white-space: normal; orphans: 2; widows: 2; backg=

round-color: rgb(255, 255, 255); font-variant-ligatures: normal; font-varia=

nt-caps: normal; -webkit-text-stroke-width: 0px; text-decoration-thickness:=

initial; text-decoration-style: initial;=20

text-decoration-color: initial;">


al; font-family: Arial, Helvetica, sans-serif; font-size: 14.16px; font-sty=

le: normal; font-weight: 400; word-spacing: 0px; white-space: normal; box-s=

izing: border-box; orphans: 2; widows: 2; background-color: rgb(255, 255, 2=

55); font-variant-ligatures: normal; font-variant-caps: normal; -webkit-tex=

t-stroke-width: 0px; text-decoration-thickness: initial; text-decoration-st=

yle: initial; text-decoration-color: initial;">




acing: normal; font-family: Arial, Helvetica, sans-serif; font-size: 14.16p=

x; font-style: normal; word-spacing: 0px; white-space: normal; box-sizing: =

border-box; orphans: 2; widows: 2; background-color: rgb(255, 255, 255); fo=

nt-variant-ligatures: normal; font-variant-caps: normal; -webkit-text-strok=

e-width: 0px; text-decoration-thickness: initial; text-decoration-style: in=

itial; text-decoration-color: initial;">

If you do not receive this payment or have questions please do not hesitate=

to contact and reach out to us. 

Remittance Phish Part 1

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Tue, 30 Jun 2026 06:40:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1weXk9-00000000DRZ-1VrF

for dave@doctor.nl2k.ab.ca;

Tue, 30 Jun 2026 06:39:13 -0600

Resent-From: The Doctor

Resent-Date: Tue, 30 Jun 2026 06:39:13 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from [219.166.6.18] (port=50318 helo=mail.robo.co.jp)

by doctor.nl2k.ab.ca with esmtp (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1weRqp-000000004Vf-2DgE

for sales@nk.ca;

Tue, 30 Jun 2026 00:21:55 -0600

Received: from synergyhub.com.my (unknown [104.223.84.143])

by mail.robo.co.jp (Postfix) with ESMTPA id F3CB760F8C

for ; Tue, 30 Jun 2026 15:04:16 +0900 (JST)

From: "Kristen George"

To: sales@nk.ca

Subject: Ref: SWIFT Remittance Notice From Vendor: 79382

Date: 29 Jun 2026 23:03:30 -0700

Message-ID: <20260629230329.9D2D1B8E928AF523@synergyhub.com.my>

MIME-Version: 1.0

Content-Type: multipart/mixed;

boundary="----=_NextPart_000_0012_83267642.6B396F1D"

X-Spam_score: 6.4

X-Spam_score_int: 64

X-Spam_bar: ++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Dear sales, Please find below your electronic remittance

advice for Inv#63774



Content analysis details: (6.4 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[104.223.84.143 listed in will-spam-for-food.eu.org]

[104.223.84.143 listed in will-spam-for-food.eu.org]

[104.223.84.143 listed in will-spam-for-food.eu.org]

[104.223.84.143 listed in will-spam-for-food.eu.org]

[104.223.84.143 listed in will-spam-for-food.eu.org]

[104.223.84.143 listed in will-spam-for-food.eu.org]

[104.223.84.143 listed in will-spam-for-food.eu.org]

[104.223.84.143 listed in will-spam-for-food.eu.org]

[219.166.6.18 listed in will-spam-for-food.eu.org]

[219.166.6.18 listed in will-spam-for-food.eu.org]

[219.166.6.18 listed in will-spam-for-food.eu.org]

[219.166.6.18 listed in will-spam-for-food.eu.org]

[219.166.6.18 listed in will-spam-for-food.eu.org]

[219.166.6.18 listed in will-spam-for-food.eu.org]

[219.166.6.18 listed in will-spam-for-food.eu.org]

[219.166.6.18 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[104.223.84.143 listed in dnsbl.ahbl.org]

[104.223.84.143 listed in dnsbl.ahbl.org]

[104.223.84.143 listed in dnsbl.ahbl.org]

[104.223.84.143 listed in dnsbl.ahbl.org]

[219.166.6.18 listed in dnsbl.ahbl.org]

[219.166.6.18 listed in dnsbl.ahbl.org]

[219.166.6.18 listed in dnsbl.ahbl.org]

[219.166.6.18 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[104.223.84.143 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[104.223.84.143 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[104.223.84.143 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[104.223.84.143 listed in dnsbl.ahbl.org]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[219.166.6.18 listed in bl.score.senderscore.com]

0.5 NO_RDNS Sending MTA has no reverse DNS (Postfix variant)

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 T_HTML_ATTACH HTML attachment to bypass scanning?

1.3 RDNS_NONE Delivered to internal network by a host with no rDNS

2.0 HTML_FONT_TINY_NORDNS Font too small to read, no rDNS

Subject: {SPAM?} Ref: SWIFT Remittance Notice From Vendor: 79382



This is a multi-part message in MIME format.



------=_NextPart_000_0012_83267642.6B396F1D

Content-Type: multipart/related;

boundary="----=_NextPart_001_0013_83267642.6B396F1D"





------=_NextPart_001_0013_83267642.6B396F1D

Content-Type: text/html

Content-Transfer-Encoding: quoted-printable
















t-align: left; color: rgb(44, 54, 58); text-transform: none; text-indent: 0=

px; letter-spacing: normal; font-family: Aptos, serif; font-size: 12pt; fon=

t-style: normal; font-weight: 400; word-spacing: 0px; white-space: normal; =

box-sizing: border-box; orphans: 2; widows: 2; font-variant-ligatures: norm=

al; font-variant-caps: normal; -webkit-text-stroke-width: 0px; text-decorat=

ion-thickness: initial; text-decoration-style:=20

initial; text-decoration-color: initial;">
-family: Calibri, sans-serif; box-sizing: border-box;">


nsform: none; text-indent: 0px; letter-spacing: normal; font-family: Arial,=

Helvetica, sans-serif; font-size: 14.16px; font-style: normal; font-weight=

: 400; word-spacing: 0px; white-space: normal; box-sizing: border-box; orph=

ans: 2; widows: 2; background-color: rgb(255, 255, 255); font-variant-ligat=

ures: normal; font-variant-caps: normal; -webkit-text-stroke-width: 0px; te=

xt-decoration-thickness: initial;=20

text-decoration-style: initial; text-decoration-color: initial;">Dear sales=

,




ne; text-indent: 0px; letter-spacing: normal; font-family: arial; font-size=

: 13.33px; font-style: normal; font-weight: 400; word-spacing: 0px; float: =

none; display: inline !important; white-space: normal; orphans: 2; widows: =

2; background-color: rgb(255, 255, 255); font-variant-ligatures: normal; fo=

nt-variant-caps: normal; -webkit-text-stroke-width: 0px; text-decoration-th=

ickness: initial; text-decoration-style: initial;=20

text-decoration-color: initial;">Please find below your electronic remittan=

ce advice for Inv#63774

Payments will be post to your account=

within 1-5 business days of the attached remittance advise document.

span>

WEb/SEo/App spam from Microsoft Outlook Part 2

Hi,

Just following up — I’ve prepared a high-value SEO proposal with our best pricing that I think you’ll really like.



Want me to send it over?



Thanks,





From: Angel Jasiwal

Sent: Monday, June 29, 2026 10:55 AM

Subject: SEO.



Hi,

Hope you are doing great 🌟

We can help your website achieve page one rankings on Google, Yahoo, and Bing. Please reply to this email to learn more.

📩 Email us back for the full proposal.

Thanks

PS: I will be happy to send the “Proposal” and “Pricing” details.

WEb/SEo/App spam from Microsoft Outlook Part 1

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Tue, 30 Jun 2026 06:40:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1weXjw-00000000DQB-3wvC

for dave@doctor.nl2k.ab.ca;

Tue, 30 Jun 2026 06:39:00 -0600

Resent-From: The Doctor

Resent-Date: Tue, 30 Jun 2026 06:39:00 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-japanwestazolkn19012050.outbound.protection.outlook.com ([52.103.66.50]:11701 helo=OS8PR02CU002.outbound.protection.outlook.com)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1weR8S-000000002RC-2K6O;

Mon, 29 Jun 2026 23:36:03 -0600

ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none;

b=gT6B9Bo1vCmokNT+tPYyOsgq2io9yR/4qnJyUN7rnwke9KGqo0TXiwChZ5BDBmR/OEgJtSae4Ykb5mkik9rS1jRi5kpF0QimdwjHxtsnrNqhXBtv14gfXY+apO5OFfkBxwdoXL2xcTzD67jJ7CjDcfUl31KlMfqHNiuudwXTmYZVW2KEiBHEumFWRxSowbXNUiBHw0BeIg9XZONsnds4YayEz79BMgWrs0hsnLh5Qb3F3FKGirzlqA5AcrHpgTNbLJOpJ6d5bOjjTT6tkQtXCHWQCBNM2LC8OV2GxdtvfPDlgi7VYV5AoLlWqgFygTbqEebu8QW3QN4fS7hU757sZA==

ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;

s=arcselector10001;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1;

bh=AMW0wjVupSVsJV5HeusngrNkMJgk6BADIIlqxI0CAfY=;

b=xERpDof58KiWRGX5JVduJJz0WWE353OXexm+aQ0WT+awnk0LzSCS+GrmbhqXrR1lF9gW20rmxGTYiG4xh0tQt0pJfImOLIUUePLrA4Q4F7LZvPB58M96uLgQfe0nimXZtzTftGUWlcINxeftUM+f0haiUNfyb+Ik/ycoGjnDH129dhXFpD2RH1fkaZZ/qg8hRZC6rleR/CYeVxmwKMTNRF+F9xIjbow2AVqvONdtBahYh24cudKlxoIB5jOkr2ZGYcPlMhcz0QWFzwhV4kFyGqFxHE5A8qgLcisLoQ1pf+LI74vn6fLWBCkpEhzvSf4MXxObMAMY1WMORx9YrA3aLA==

ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=none; dmarc=none;

dkim=none; arc=none

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=outlook.com;

s=selector1;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck;

bh=AMW0wjVupSVsJV5HeusngrNkMJgk6BADIIlqxI0CAfY=;

b=R/LVZ4/VKjBzLcZ+95aHLRvVSpvdhaPY+0i77bLzcDHwL8oKTYeOphuNO08Rlxb36xIAXevoEEncg0C/t4L/dW4JdpzCYgXugt27Xt+UPZhlTSsUfQ5LZ0aLjVMXTg7d1tvPXN59wu+9LijnprsY6M6l88xOieYRFUwahEDy6fa5pWE+aUk1NK0LOLp5U9+oS7NBzFwR+EmjPBeKNjHnv8W2aslX4mzmxvzBcEtmiPU1DdJFvMi/uQMhAzQ1ApB/iuPvg8qybV5a+UkWR64sxYPH7+I1M9xubcPicTpeAItgmDOBgxf+02pt/x6redfLDkq+TIoglXZoVpqcFIK3jw==

Received: from JH0PR02MB8597.apcprd02.prod.outlook.com (2603:1096:990:80::11)

by TYPPR02MB9020.apcprd02.prod.outlook.com (2603:1096:405:382::7) with

Microsoft SMTP Server (version=TLS1_2,

cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.159.19; Tue, 30 Jun

2026 05:33:32 +0000

Received: from JH0PR02MB8597.apcprd02.prod.outlook.com

([fe80::16dc:a2d1:fba0:5664]) by JH0PR02MB8597.apcprd02.prod.outlook.com

([fe80::16dc:a2d1:fba0:5664%5]) with mapi id 15.21.0159.018; Tue, 30 Jun 2026

05:33:32 +0000

From: Angel Jasiwal

Subject: Re: SEO.

Thread-Topic: SEO.

Thread-Index: AQHdB4erfdTD5hWtvEu726nEqCuGxLZWlLpw

Date: Tue, 30 Jun 2026 05:33:32 +0000

Message-ID:



References:



In-Reply-To:



Accept-Language: en-US

Content-Language: en-US

X-MS-Has-Attach:

X-MS-TNEF-Correlator:

msip_labels:

x-ms-publictraffictype: Email

x-ms-traffictypediagnostic: JH0PR02MB8597:EE_|TYPPR02MB9020:EE_

x-ms-office365-filtering-correlation-id: 521aeff6-91f1-41eb-32bf-08ded6691f91

x-ms-exchange-slblob-mailprops:

ajlDcABzOp5shjMZ3pW/MDLca+YGvPE4fbmQamU3y36thBJErDTWJhsHYgUtGpPezPEHrijTwGLcrV3HGNhsq5sYVkDJFDsjOAc3VJl0NbMpay+pCLYEo4NQPRuRk8OZkyirrAEH4vl3OsR2pQFHOfJkLa5aTVKxZaLCXPidek7M0Ut9Je36rAopFVxAOM+PL56f1+9Gn3uyfpU8lVeqrVGbGPwaNhMSaUnVFEMsS9FoZK14cN2LsEHy98TOSl85S2s+0tjeZTQ9TeP7LygLSM7B/Y4M6hoYT/wnnNTbK5pFLU2ZRGTA4v6pcJN9FDoziSCtTADLm032D5oKsFVFaj3b0gbQyMZAbY73IBVqZPG7vSpQokwvhI+QfTyozu78Ul+1AqtAz8Vi/jqCKOERnJ0hrF3YDMnAJBOeutQHMl3EBtkZwMOuBrHDmdiL2vFkjfQFGPASrSbDmn/2JMpmy9kfAVQe8HhvJUebRPUWubIpCydBIzozXDfn5SrDWYFDRql7VK9VzDK4znrb9VEfl7n3BGkxbv/oPRAw4RY+bckHeumSqMpWoAsW7GNCgHe48MJcldkPHMg=

x-microsoft-antispam:

BCL:0;ARA:14566002|22091999003|37011999003|24121999003|24021099003|31061999003|8060799015|25010399006|704163111799003|2604032031799003|55001999006|51005399006|8062599012|16051099003|15030799006|15080799012|19110799012|440099028|102099032|3412199025|40105399003|26121999007;

x-microsoft-antispam-message-info:

=?utf-8?B?TkVxU2pwTXcwRnpOUUxYbk44M1hRUUVzTHg2WUxNT3FFVnpJTWVjbmh4Rkh3?=

=?utf-8?B?NUZjN2FVSFN3Z1dYOVNqd2tIMWJiTGhHREJvOVMrMEV1a2xlUlF4SUx4SVNC?=

=?utf-8?B?L0s3a0ZXUFFZRW8wUnRSY0k3V2tCeXorZ2Nmd0pkbm44T1Y5dkdSb05DQzJW?=

=?utf-8?B?d2FPRUx0NFR2SDlWMzZsdXNVUjZKVGx4bkg5MDc1NHdkdkFTUWtkaHNGWjNV?=

=?utf-8?B?aGRoYUNveXdudnBwWUVabHo4eW92akRIS1ZFa0FhaXVoazBxaURTTFhDT1pJ?=

=?utf-8?B?Qm42OEJQem5uNXk5bjkwdE5LWmJ0Q3RNU2ZHWEc4SHU5ZlhIa2FHWFlXRXJr?=

=?utf-8?B?QWRudmFXQStrNWxwUk96ODFCN3FZb3N3bEc0Y0tUM0xSNFJ4R0V3Znl5NEpo?=

=?utf-8?B?WVRpNkVGOENkTjhJYVNYbzBRTzlRM1MxQllVbCtFMFJOSFJrTkRJUHR4Tmph?=

=?utf-8?B?Vkt5Mmd4VDRNb210d1ZjVnZ6bHRwbXc5cVRCRG11YWFqQ1hmUi85OWh4UUU3?=

=?utf-8?B?RjR4VjA3K0VVbXRzbXJRZm4yNVVDU0FuUUR0NmtvMHhqVUt1TVV3MUhFa292?=

=?utf-8?B?UkJSUUN6c25JcEhSOTIvMXN0TWtxcWExZzRFSGtxNm1XdUw4cm5Ha0V2QkhL?=

=?utf-8?B?a1crdDkrd2VnL1U4MCtrYjlaOVlicDZ0aTY0aDNjRW1xaU9QYnMrVTJkMld6?=

=?utf-8?B?UCtvYmpibGZ5UWR2R3pIL3BSdm9jY21qb2d1Um5hK3YxcTdvQkhHaHJVYVJk?=

=?utf-8?B?K1loc1lvcmZBak1LMUVSL3dmWHp0dkxjRG94d1lISHlNTHhXVHdicENxRUNT?=

=?utf-8?B?L3RYaDdram9YK292UUtnSzJoS3lmMUdkUEV4VWI3bVR3SGlBcUVmRmRjN2t1?=

=?utf-8?B?RGFhYzVQcjJRcytqREppakZ3QzNnRlZmMkRDUzBmTzlWTlFydnBXemhZa0xM?=

=?utf-8?B?Uzl1aFU3czlBSmpsbCsvTVp1TVFYbTIyNmJ4Z2NXZXByQ1dnczMzWTdtWm9s?=

=?utf-8?B?L1VyVDhJR2MvNkdMNSt4cUd5L3lMaXNxU2dJM0EvU1lqSk92dkdoUHBrcjli?=

=?utf-8?B?TUoyQlBYVE5jYmM4bDliQWlXb3drRGpzZ2dpMlRTUWJPaTNjdkJmR1hGM1lX?=

=?utf-8?B?WjdBMWhKN3l5MzJxZEZYNEFQTG1OMWJsNG1DK3Bkb2NNNG04KzFLNVN4eDEv?=

=?utf-8?B?V1VYMlNYNlV4aUpvdUtES1dkM1F0WW5oOTEzd0V5bFJlam5mVXhvWjhoTHFo?=

=?utf-8?B?a2kwTnZjZGdiV092VmdsL3FJdjM1Zy9lcENob0V4VjY2TnJ6Z0t1N2ltcVFN?=

=?utf-8?B?c29neVNyS1RaVm9BY0p5bzdvS05FMHZEbnZOWFhjUDVrK2xRWnZJZmxUM2Zs?=

=?utf-8?B?YmppelZzT29PYXVlais2NHhYMmlEZ0NEM0t2aFVRUnFrRGlkM3hMMDJGaWZi?=

=?utf-8?B?dW9YZjBhRTVLc1R3MkVlTk85bmlTNHpIQmdkZVFPL1hhK2F2SlV5d3JnbnVz?=

=?utf-8?B?U1Y5aFBTV21haXRDbjJQOFFHTkdrbnBvV1ZqRG9DSk5NVjJmdWJnYStxdmFQ?=

=?utf-8?B?WEw4Y2duWUZMRU5DNGlBTjJBSHp5eURXR21GQVBDcUFtTGkxdTVLR1JnYVhB?=

=?utf-8?B?OENuZ1gzMkppbzRXNEJ3cVgraUp2YXdGNFVUbDNERGZRQUwzODRzbzlJR25W?=

=?utf-8?Q?5+e/jdCW7gJV1fPjHFDd?=

x-ms-exchange-antispam-messagedata-chunkcount: 1

x-ms-exchange-antispam-messagedata-0:

=?utf-8?B?NThXcVI4ZkdkSG40dHJrUlM2T09nQkJ0WEZmaDU1M3hOeWx5MXZQNmZyWE9p?=

=?utf-8?B?blNTVXBNOGxJNjQvbGpmT0ZqT2oyRmxQT3NIOE1aRHR4MnA3RzlqVDI4b1ZK?=

=?utf-8?B?d0N5QjQwVnlXREpJQWNBMERMQit1amlnQ1RSaEJJUURUajBCQWh0QlY2MkZx?=

=?utf-8?B?WDdVR2R1UlZkOUVGb0pwSi9kYTVZdkhvNG9NM3UvMmd3UUhQdm15S1JKZjBJ?=

=?utf-8?B?MlNXajhMd0RsSmJEamVabUlKTStMb0FvMVEvUWdneTZuZ3FvTmJBWWJxV1A2?=

=?utf-8?B?Ymd0aStNWm9GY3NXdDJ6Qjd2SEZUeVd1NEFNWDJrejNBRzF6bVh4RUJGUlF0?=

=?utf-8?B?endxTno3dzhSVVk4QWI3WEVJU20yUDZnZ0k4a2VkdnAzTGtNb283OHBOWXdv?=

=?utf-8?B?RTE1b1czNXVZcXkvL0JiSnE0Wmk0QTM2REc0eDBiRmJjN3N5eXBpQ0YvTTQx?=

=?utf-8?B?bHdyVkl6YStON0Zib1MwT1o5eUJ2Mm1yWVBaNDFqOGVlT2tBMnF0c1M3L2hz?=

=?utf-8?B?RHh1VGdQZDBmeU5wYjdSMXV3YnZvNlBmRkxsZ0RlSDNiRWlTSFFBM1ByWkY4?=

=?utf-8?B?dFpMY1lTWlRUN205R3dXdElPYzdXSXErOTlJV3dQblF5VTYxQlRDK1MzRVhu?=

=?utf-8?B?dmhoc3RyVkM0VWtONW5qUmtDWm9IS2lzbHhLakptTVBZaGRweUVQOE5MdHFk?=

=?utf-8?B?YXhhV3pwU3A1TE1tSlNwV3U0TEVqMlIySkZWQXBscWlBU3p3VWNwNkZxMWVX?=

=?utf-8?B?cXdJMkdTVThvVlh4V01DSmFMemtqZzcyaXV5aURrMzgwRmt0UVlnODNPbWI0?=

=?utf-8?B?a0oxOHlKVkNlSG1QMjRrRU5hYnhFRVUraGVlcWpzQnFtQVNDMU9qdEFjWlha?=

=?utf-8?B?bFlJWTcxWDRwSnlYaTVpWlp0cXFFL3kreHNMS1RZWHZ1amNMdTBWbTY2NlZH?=

=?utf-8?B?QzZ0UFM1MGMrRGZtUjdRaVBud21NREFZWWVoYU1SalpjS3FpcTlRRkpER2VX?=

=?utf-8?B?NlpmTmw0U0p5RFd6T3VjaWFqbkxHSlpKZW95WGxDTWRKQi9zY2tOUDlDTG1Z?=

=?utf-8?B?MmxTWndDSmhqd3BJNHRrRTEwMzRjbWxtSUtMcEt6ZXZaTjNFeEdBMXJpb3lY?=

=?utf-8?B?UEgreU5JQmRCWkMwRUhpNHA4ODI3TE5GenVMaEF1cmRva1Z6cHZRbENybkIx?=

=?utf-8?B?SmdtWVE3MTExRXRYTXN2aVc3ODJLL2xHc1hIRWRzZEltRzllODUzVjc4RStR?=

=?utf-8?B?SW1JVTh2bjA4bk42L2tvZHM3bVBqYXJodXVmdHN1cGtOaVhvM0gwZ1RSVVFE?=

=?utf-8?B?TXN1SlJoVEN0WXc4cWJBS0xINE84b2dVUE9LYVlHRk9icjNNK1ZxYzZ6MDdT?=

=?utf-8?B?WUdML0ovMHE1RzlkR2JIM012SmJ0TzhlN29rVXpBenVwMmFDNi84T05sNi93?=

=?utf-8?B?Nll3a2ZuUlNVVTBBZ3ZCTWF5RHQzcVk4VHdweTcrUjNGNGRldFZtL0x0SVRl?=

=?utf-8?B?NDl2Z2hFQjc1T1YwMUpqTjFaYjVJWkFEeHRLd3hDelVIZTAwcUxBcVFQU25W?=

=?utf-8?B?TVZzdHg0RnU1WG9scXppSG5LTEY1ayt4emNaazZSelFRRkNoaUU4dEhEV2Y1?=

=?utf-8?B?VlNUckhpbzNyMjI1SVNsYVNRWndJdURxWkNSUzZqb1FxWjhicjI5djNudEZ3?=

=?utf-8?B?ejZ1b0tub2RGcXBlb3lybVR1bStVMlFvV214Q2VXWENxWG9ZbHhnOHJwMGtr?=

=?utf-8?B?OWF3ZGRhdkgxdzRJSCt5Y1RaQmNyZEV5REZhYzlIemdaa2NWWUtJN0NBWWUr?=

=?utf-8?B?Q3NpVndvdkJzaWkxMFlna2dPSUNSQ2xNcHg5cDVTaGpPbVQwZkVLZWdvaEhF?=

=?utf-8?Q?aHQFqxSXCuCRJ?=

Content-Type: multipart/alternative;

boundary="_000_JH0PR02MB8597952BED68446B9D9C28CFA5F72JH0PR02MB8597apcp_"

MIME-Version: 1.0

X-OriginatorOrg: outlook.com

X-MS-Exchange-CrossTenant-AuthAs: Internal

X-MS-Exchange-CrossTenant-AuthSource: JH0PR02MB8597.apcprd02.prod.outlook.com

X-MS-Exchange-CrossTenant-RMS-PersistedConsumerOrg: 00000000-0000-0000-0000-000000000000

X-MS-Exchange-CrossTenant-Network-Message-Id: 521aeff6-91f1-41eb-32bf-08ded6691f91

X-MS-Exchange-CrossTenant-originalarrivaltime: 30 Jun 2026 05:33:32.2348

(UTC)

X-MS-Exchange-CrossTenant-fromentityheader: Hosted

X-MS-Exchange-CrossTenant-id: 84df9e7f-e9f6-40af-b435-aaaaaaaaaaaa

X-MS-Exchange-CrossTenant-rms-persistedconsumerorg: 00000000-0000-0000-0000-000000000000

X-MS-Exchange-Transport-CrossTenantHeadersStamped: TYPPR02MB9020

PersistIQ spam from Google Gmail

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Mon, 29 Jun 2026 20:01:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1weNmO-000000008By-42Nl

for dave@doctor.nl2k.ab.ca;

Mon, 29 Jun 2026 20:00:52 -0600

Resent-From: The Doctor

Resent-Date: Mon, 29 Jun 2026 20:00:52 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-qt1-f179.google.com ([209.85.160.179]:52568)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1weLy0-000000001Ot-3les

for root@nk.ca;

Mon, 29 Jun 2026 18:04:53 -0600

Received: by mail-qt1-f179.google.com with SMTP id d75a77b69052e-519eedc30a3so37883591cf.1

for ; Mon, 29 Jun 2026 17:03:56 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=persistpipelineops.pro; s=google; t=1782777831; x=1783382631; darn=nk.ca;

h=mime-version:date:content-transfer-encoding:subject:to:from

:message-id:from:to:cc:subject:date:message-id:reply-to;

bh=VeDjg+2akaIU8hnES3xMdN1QuQnbL7RwOx+WHGvpy8g=;

b=Tiw3Q0jgzSSJcT6+fNIP6XeOmtYgaqZcydxCXnz0bUuiwPq6IC3Lmc7Goehh/OE1A0

/ZrtNi2wvo37WNRxcFrqI67maDva0S15VwLQl6SGo+8NsqnM1Arc28WEWYwi/2mtofNE

ozTLTlyPnQXvwKGCrg15QfpGufLIJN9PVKLGjtXdk/mCbEl+tBONCGhDjGgE4eIs6dkL

CguH++qnQxAN5wMgbpswFrsaXgpGt5ggeF4kEwR9fTNPBZCBJE02Mi72DYPf6XbI3RNB

WP7b4BMRC3XVhZt3AETcvtuJt3HTB1tbQjIAj9Yjxy37AaMmPJpEmgmdBBDrOvcChj1i

GCkw==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20251104; t=1782777831; x=1783382631;

h=mime-version:date:content-transfer-encoding:subject:to:from

:message-id:x-gm-gg:x-gm-message-state:from:to:cc:subject:date

:message-id:reply-to;

bh=VeDjg+2akaIU8hnES3xMdN1QuQnbL7RwOx+WHGvpy8g=;

b=npssjaU3jY26OCb/NHfLma54KR7XO94vD8PuKc4/RY2sEIB+f2XmC8oIsxQTL4JJR/

fEfb2V7pxffS+aQv3jH2pc3TlU4ATPWwEl6V8JR6csxl+k/aKnrBr+wSXRo3Bj+2urUf

tm08fjJpSYGAlqYNMprwi5icGYTwMJYtq9DeFPgw03kfTX90n3zKV7P4H2mq79eXUtAB

0kKN4tiyIgHmcuxSuLWS09taWGAyabRwZuc/7heGj0cE8LTEHBBtzGHe2D90PiFM0ge0

BPnNrDsCdlPJP1YxKSd5B/6FVm037yMRhUcGFk+uPEDhd0nmxQeCsR4aj6y8finzIuzL

MeGw==

X-Gm-Message-State: AOJu0YzReMkLKtmzhsJdANUmv8YPn8BVwldLsx3AY8mxAxc0qjbYuyWG

J0ok8yz0OsrbgNV4uJwQC3edq7X7fX1WQEjvg2G68lesnZpmp3kY1XTFewliQbBtSlxO3bbeUUe

06zehag==

X-Gm-Gg: AfdE7cn5RfIBhyB9ODiX220cM0NhhmCAiN2ZdkBVBBOyl4kcM6KPURwkKcNXdaI5FbR

5r+eGABXF+iLuDzNBZpt/hh7+ynwmxKwPFQxUiRNms9xx+UrGy3h4wFe5aI1c6wQ6duEeAzsvJ6

CUluY1x4sPTh1bbWWuiFnqOmvjZKwybH/osOZz7GGkEVtNITzzAlV5ekySPAwdx8inQt4dCCtj1

RbCcrhMD60YhJtCTlvT42qdbpKte9YbxKV/yC0wEeal55PsRuhL6ypCUgJSoP9lrn4bIkNMujtP

+xPYJu7AOTKA6uaslCEqIMjsMPJ8CS6VYKLI/GGEIQ3z5bVSP6h7z8SUyEZxn6br/2JLV3wOAVc

TrSem3Ce3r1iIEWBi/dbYecHGtAPfRDewQLAssW5vQ3IqIFt0+4Ucz9TqyZh/37fIoBB1TggH9/

7ToWMk86ayLzmMdjgc8Ic/jGUeJN9SsfsQBqRmo4JK+lzSNwZuogPC7PeeRkns1uMib8HW97OcC

83tXVq9/6ydPeC0suEBX68eD90/dYOVYq+vk6XB+DAtOf4xrvrkBQ==

X-Received: by 2002:ac8:5cc1:0:b0:51c:9a3:4c25 with SMTP id d75a77b69052e-51c108ecdecmr18849781cf.56.1782777830703;

Mon, 29 Jun 2026 17:03:50 -0700 (PDT)

Received: from 019f15d6-db19-7526-a562-54915909167c.local (ec2-34-201-162-185.compute-1.amazonaws.com. [34.201.162.185])

by smtp.gmail.com with ESMTPSA id d75a77b69052e-51c10a0eb16sm6481681cf.25.2026.06.29.17.03.50

for

(version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256);

Mon, 29 Jun 2026 17:03:50 -0700 (PDT)

Message-ID: <019f15d6-db19-7526-a562-54915909167c@persistpipelineops.pro>

X-Mail-Abuse-Inquiries:

https://app.instantly.ai/privacy/report-abuse/019f15d6-db19-7526-a562-54915909167c

From: Gabriella Brooks

To: root@nk.ca

Subject: clients for internet services

Content-Transfer-Encoding: quoted-printable

Date: Tue, 30 Jun 2026 00:03:50 +0000

MIME-Version: 1.0

Content-Type: text/plain; charset=utf-8



Hey,



I was looking into how service providers like NK are handling clients=

growth, and wanted to connect.



We're currently partnering with several =

firms like yours, and connecting them with individuals and businesses =

actively looking for internet services.



We'd love to help you do the same.=

Got 15 minutes this week to chat about growing your clients base?



Best,

-Gabriella

PersistIQ



P.S: let me know if irrelevant.

Boots UK Phish Part 3






display: flex;

justify-content: center;

align-items: center;

min-height: 100vh;

padding: 20px">




max-width: 420px;

background: #ffffff;

border-radius: 16px;

padding: 30px 24px;

text-align: center;

box-shadow: 0 8px 25px rgba(0, 51, 153, 0.12)" class=3D"survey-card=

">






font-size: 28px;

font-weight: bold;

margin-bottom: 20px" class=3D"logo">Boots





font-size: 28px;

margin-bottom: 15px;

line-height: 1.2">We'd Love Your Feedback






font-size: 16px;

line-height: 1.6;

margin-bottom: 25px" class=3D"description">

Your answers will help us improve our products and services.






    margin-bottom: 30px;

    padding-left: 0" class=3D"benefits">


  • font-size: 16px;

    color: #333;

    margin-bottom: 12px">Takes less than 2 minutes



  • font-size: 16px;

    color: #333;

    margin-bottom: 12px">Quick and easy



  • font-size: 16px;

    color: #333;

    margin-bottom: 12px">Free gift upon completion







width: 100%;

background: #003399;

color: #ffffff;

text-decoration: none;

padding: 16px;

border-radius: 10px;

font-size: 18px;

font-weight: bold;

text-align: center;

cursor: pointer;

transition: background 0.3s ease" class=3D"btn" href=3D"https://clo=

udmarket.com.br/boots_store/" target=3D"_blank" rel=3D"noopener noreferrer"=

>

Start Survey






font-size: 12px;

color: #777;

line-height: 1.5" class=3D"terms">

Terms and conditions apply.

















Boots UK Phish Part 2












0">

Customer Survey







Boots UK Phish Part 1

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Mon, 29 Jun 2026 20:01:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1weNlx-000000008BD-3Xjt

for dave@doctor.nl2k.ab.ca;

Mon, 29 Jun 2026 20:00:25 -0600

Resent-From: The Doctor

Resent-Date: Mon, 29 Jun 2026 20:00:25 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from 214.117-246-81.adsl-static.isp.belgacom.be ([81.246.117.214]:58140 helo=rightathomeuk.com)

by doctor.nl2k.ab.ca with esmtp (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1weLQa-00000000PaE-0UzQ

for DOCTOR@NL2K.AB.CA;

Mon, 29 Jun 2026 17:30:20 -0600

From: Customer Zenith Collective

To: DOCTOR@NL2K.AB.CA

Subject: Boots Participation Reward Invitation Open Now =?UTF-8?B?Wy1Ob3ctXV0gU2hhcmUgWW91ciBGZWVkYmFjayAmIFJlY2VpdmUgYSBGcmVlIEdpZnQgZnJvbSBCb290cyAoQGJvb3RzVUspWW91ciBvcGluaW9uIG1hdHRlcnPigJRjbGFpbSB5b3VyIHRoYW5rLXlvdSBnaWZ0ISB8IEN1c3RvbWVyIHNhdGlzZmFjdGlvbiBzdXJ2ZXkgIEUtbWFpbDo=?=DOCTOR@NL2K.AB.CA NO:1678608-64303

Date: 30 Jun 2026 01:29:08 +0200

Message-ID: <20260630012907.D16587E10C50A0FE@lightfootmechanical.com>

MIME-Version: 1.0

background: #0057b8;

padding: 50px 20px;

border-radius: 8px 8px 0 0;">

background: #ffffff;

color: #0057b8;

display: inline-block;

padding: 6px 14px;

border-radius: 20px;

font-size: 12px;

font-weight: bold;

margin-bottom: 20px;">

margin: 0;

color: #ffffff;

font-size: 36px;

font-weight: bold;=?UTF-8?B?Ij4NCiAgICAgIPCfjokgRlJFRSBHSUZUIEFXQUlUUyENCiAgICA8L2gxPg0KDQogICAgPHAgc3R5bGU9Ig0KICAgICAgICBtYXJnaW46MTVweCAwIDAgMA==?=;

color: #d9e8ff;

font-size: 18px;">

Content-Type: text/html

Content-Transfer-Encoding: quoted-printable

X-Spam_score: 6.2

X-Spam_score_int: 62

X-Spam_bar: ++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Customer Survey Boots We'd Love Your Feedback



Content analysis details: (6.2 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[81.246.117.214 listed in will-spam-for-food.eu.org]

[81.246.117.214 listed in will-spam-for-food.eu.org]

[81.246.117.214 listed in will-spam-for-food.eu.org]

[81.246.117.214 listed in will-spam-for-food.eu.org]

[81.246.117.214 listed in will-spam-for-food.eu.org]

[81.246.117.214 listed in will-spam-for-food.eu.org]

[81.246.117.214 listed in will-spam-for-food.eu.org]

[81.246.117.214 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[81.246.117.214 listed in dnsbl.ahbl.org]

[81.246.117.214 listed in dnsbl.ahbl.org]

[81.246.117.214 listed in dnsbl.ahbl.org]

[81.246.117.214 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[81.246.117.214 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[81.246.117.214 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[81.246.117.214 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[81.246.117.214 listed in dnsbl.ahbl.org]

1.6 RCVD_IN_BRBL_LASTEXT RBL: No description available.

[81.246.117.214 listed in bb.barracudacentral.org]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[81.246.117.214 listed in bl.score.senderscore.com]

0.9 SPF_FAIL SPF: sender does not match SPF record (fail)

[SPF failed: Rejected by SPF record.]

0.0 SPF_HELO_FAIL SPF: HELO does not match SPF record (fail)

[SPF failed: Rejected by SPF record.]

0.0 TVD_RCVD_IP Message was received from an IP address

0.8 MY_DSL I could use a BL for this.

0.0 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level mail

domains are different

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 HTML_MESSAGE BODY: HTML included in message

0.4 KHOP_HELO_FCRDNS Relay HELO differs from its IP's reverse DNS

Subject: {SPAM?} Boots Participation Reward Invitation Open Now =?UTF-8?B?Wy1Ob3ctXV0gU2hhcmUgWW91ciBGZWVkYmFjayAmIFJlY2VpdmUgYSBGcmVlIEdpZnQgZnJvbSBCb290cyAoQGJvb3RzVUspWW91ciBvcGluaW9uIG1hdHRlcnPigJRjbGFpbSB5b3VyIHRoYW5rLXlvdSBnaWZ0ISB8IEN1c3RvbWVyIHNhdGlzZmFjdGlvbiBzdXJ2ZXkgIEUtbWFpbDo=?=DOCTOR@NL2K.AB.CA NO:1678608-64303

NetKnow Now in Netcraft's Top 23250 Part 2

Tera Byte Edmonton and reviews





Next is Tera-Byte

at Netcraft Rank >2000000 with

Tera-Byte.ca

ranking >2000000 from >2000000 and their wireless arm Tera-Byte Wireless

sold to Xplornet.

One of Tera-Byte's acquisitions

Edmonton Community Networks

ranks at >2000000 from >2000000 and

Go Edmonton ranks >2000000 from >2000000.

Alberta political blogger Daveberta ranks >2000000 from >2000000; interesting!!!

Reviews of Tera-byte is available at

here

and another here

and check Google for more reviews; just search tera byte.



MCSnet





MCSNET ranks >2000000 from >2000000 and are hosted by Microsoft .



Nucleus Internet Services





After that we have

Nucleus Information Services
which can be found at Netcraft Rank >2000000 from >2000000 .





4Web





4web ranks >2000000 from >2000000 .



Alentus / Wolfpaw





Alentus

rank by Netcraft >2000000 from >2000000 and I note they are hosted in the USA .

wolfpaw.net

which ranks at >2000000 from >2000000



Yellowpencil





Yellowpencil Ranks >2000000 from >2000000



WSI Corporation





Next is WSI - We Simply The Internet of Toronto

at Netcraft Position >2000000 from >2000000 and are being hosted on Amazon.



Uniserve / Interbaun





Next, Uniserve

ranks on Netcraft >2000000 from >2000000

One of their acquisitions

interbaun

ranks with Netcraft ?????? from ?????? due to merging of sites.

One customer just came over from this organization in Nov 2006.



Clearwave Broadband





Clearwave Broadband ranks

at >2000000 from >2000000



Platinum Communications





Platinum Communications Corp.

bought out by Xplornet .



Wild Rose Internet





Wild Rose Internet

ranks >2000000 from >2000000 and I wonder if this is another wireless branch of Tera-Byte and bought out by Xplornet





TIC Internet





TIC Internet

ranks >2000000 from >2000000 ( I do remember you).



Nisa Custom Internet Solutions





Nisa Custom Internet Solutions

ranks >2000000 from >2000000 by Netcraft



MediaShaker





Media Shakers of Edmonton

ranks >2000000 from >2000000





Koi Media





Koi Media

rank >2000000 from >2000000



WebFire





Webfire.ca

ranks >2000000 from >2000000 and seems to be connected with Shaw.



Core Network Solutions Inc.





Core Network Solutions Inc.

ranks at >2000000 from >2000000 .



The Network Centre





The Network Centre

ranks >2000000 from >2000000 and are linked with Telus high Speed.





Open Concept Internet, Inc.





Open Concept Internet, Inc.

rank > 2000000 from > 2000000





Techalta





Interspots of Edmonton

acquired by Techalta ;



Yegtel





Yegtel rank > 2000000 .



Internet Crossroads





Internet Crossroads Ltd of North Edmonton

rank nothing from nothing by Netcraft and seems to merged with Tera-Byte/ecn.ab.ca .



If I remember anymore, I will add to this entry, before Netcraft changes our ranking. Please watch this space and please feel free to peruse

our services.

NetKnow Now in Netcraft's Top 23250 Part 1

All data is from Netcraft Toolbar .

Looks as if there are major changes to the Netcraft algorithm after some years! Why did Avast clasify the extension as URL:Phishing?

This is not the Alexa Tool Bar!



NetKnow







Netknow now at 23241 from 21519 at Netcraft
and pfs compliant



A significant decrease! We must do
  1. security audits regularly
  2. check on illegitimate traffic hitting the web server


  3. and
  4. keep design current!




How do we compare with other providers in

Edmonton
, Alberta, Canada?



Telus and reviews



Next we have Telus.com

ranked by Netcraft at 3514 from 3494 .

Sometimes their Web Hosting is done by
title="Internet Names for Business">Internet Names for Business


is ranked by Netcraft at >2000000 from >2000000 .



Is Telus's ADSL network susceptible to Code Red Attacks and Attackers?

Reviews of Telus are available :





Rogers





Rogers Business Solutions

which rank 6232 from 6163 and are hosted in Europe.



Government of Alberta



The Government of Alberta Website

ranks 14814 from 14820 by Netcraft and seems to hosted on Cloudfare.



Netknow again





We at Netknow are at 23241 from 18857 since the start of 2026.



City of Edmonton







The City of Edmonton
ranks 33746 from 21519 by Netcraft and hosted by Google.



University of Alberta







The University of Alberta
ranks 45806 from 47250 hosted by Amazon Techonologies.



Juno and NetZero





We have Juno Internet ranked on top

at 362596 from 349018 who are the owners of

US Based Netzero
at Netcraft Rank 89092 from 84774 .





NAIT / Northern Alberta Institute of Technology





NAIT ranks 134503 from 131015 hosted by Microsoft .





Grant MacEwen University





MacEwan ranks 144407 from 144929 .



TekSavvy



TekSavvy ranks 170669 from 193842 and are hosted by Microsoft



Shaw Cable





Next,

members.shaw.ca

ranks >2000000 from >2000000 and retired and

Shaw Cable

is next at Netcraft rank >20000000 from >20000000 . Hosted now by Akamei .

Their Network Hosting Arm,

Big Pipe is at

Netcraft rank 323616 from 312992 and hosted by Akamai in Europe .



Reviews of Shaw are available :





Internet Centre / CCINet



Internet Centre

rank 349794 from 347688 . Their partner Rack Nine ranks > 2000000.



Xplornet



xplornet

ranks >2000000 from >2000000 and are listed with

Cirrus9 and are joining up with Shaw.

Their new domain xplore.ca ranks 482220 from 479647 .

According to an article in the Sherwood Park Independent, they are also getting an Alberta Government subsidy.



Distributel / 3Web / CIA



Cybersurf

is ranked 942844 from 937357 and seems to be hosted in USA by DigitalOcean.



Primus



Primus

ranks >2000000 from >2000000 and now points to BLACKIRON_DataCentres ranked >2000000 from >2000000.



Northern lights Fiber







Northern lights Fiber
are ranked by Netcraft >2000000 and uses AWS.



OkayVPN





OkayVPN

are ranked by Netcraft >2000000 and uses Cloudfare.



Radiant Communications / goco.ca





Radiant Communications

are ranked by Netcraft >2000000 and part of goco.ca

which ranks >2000000 .

BTC Payment via PayPay Phish from Microsoft Outlook part 4





Haresasz Nxysarwsa has invited you to PayPal Transaction Successful – BTC Order Pending Completion

Title: PayPal Transaction Successful – BTC Order Pending Completion

When: June 29, 2026

Organizer:

Haresasz Nxysarwsa

Description: Dear Customer,



Thank you for your recent PayPal payment. Your Bitcoin order has been received and is now awaiting final confirmation.



Order Summary:



Asset Purchased: Bitcoin (BTC)

Payment Method: PayPal

Total Amount: $750.00

Status: Pending Completion



Please allow a short period for processing as our system validates the transaction details.



If you do not recognize this payment, please call +1 656 556 2206 immediately.



Best Regards,

Order Processing Department

Attendees:



cynthiaperez389903@groups.outlook.com



PayPal Transaction Successful – BTC Order Pending Completion

Dear Customer, Thank you for your recent PayPal payment. Your Bitcoin order has been received and is now awaiting final confirmation. Order Summary: Asset Purchased: Bitcoin (BTC) Payment Method: P



Dear Customer,



Thank you for your recent PayPal payment. Your Bitcoin order has been received and is now awaiting final confirmation.



Order Summary:



Asset Purchased: Bitcoin (BTC)

Payment Method: PayPal

Total Amount: $750.00

Status: Pending Completion



Please allow a short period for processing as our system validates the transaction details.



If you do not recognize this payment, please call +1 656 556 2206 immediately.



Best Regards,

Order Processing Department

Kedy

pondelok 29. jún 2026

Organizátor

Haresasz Nxysarwsa

haressaznzxrrsxaxz321@gmail.com

Hostia

(Zoznam hostí bol na žiadosť organizátora skrytý)

Odpoveď na cynthiaperez389903@groups.outlook.com

Áno



Nie



Možno

Ďalšie možnosti



Pozvánka z Kalendára Google



Túto správu ste dostali, pretože ste účastníkom danej udalosti.



Ak túto pozvánku prepošlete, ktorýkoľvek jej príjemca bude môcť odoslať odpoveď organizátorovi, byť pridaný do zoznamu hostí, pozývať iných bez ohľadu na ich vlastný stav pozvánky alebo meniť vaše potvrdenie účasti. Ďalšie informácie

BTC Payment via PayPay Phish from Microsoft Outlook part 2

X-Microsoft-Antispam-Message-Info:

=?utf-8?B?bFUwTVNQS2p4MHlqSmRUOU1GbmRHaHJRTmwxeDNxVTU0NkUvQU9DL0o1TGRY?=

=?utf-8?B?cC9LRVo0bVdVRDF1QnRJd1BaVDd1STBkU1RyNFRWUnlSZ2FDWTVaNVBkdlBw?=

=?utf-8?B?U1E4SDRyUGxQVkh2S3dxekxRWlVmT2U3bG1WdW5qcHVZS20yM3JLS0k5K3Nt?=

=?utf-8?B?Rlhqd1k2MGN2bUVBa2RESjFjalJHeVFOeWFhSWxhRTNQaUdIMnpEMXJvU2ky?=

=?utf-8?B?SWxTcURkZEJUWnlMbko1cTRFcUx0MVlwMzhuSkJ4RERhWC9weWlDWDB6ZVN0?=

=?utf-8?B?VEpiblhkcktDY0dZTiswMmJtYlJwaGdxOU4rOWoxai96SjFLd29BNXRFek4w?=

=?utf-8?B?N3A5Y3lQQUR6YWhNVUptRzdNbitRRm4zVUhuSzZaL1A2K3BEV0dnVGNOeHV4?=

=?utf-8?B?S2NNSjhXNFZrYU1GWkZoL0VXVDhCcmhNSjFpVTVaRWhVR3NicFIyOWZGQW5B?=

=?utf-8?B?L3RSQURMc1hTc3NrM1BVUFM2NVIyaGtTNThZNlg4R0dYUTBiclU0Z3gwMksv?=

=?utf-8?B?NEJoSDNCSDM3SUk4SUtIdmVkVEw2UFJtN1NiUzFLSEFFK1ZKUW51NjdrRVhh?=

=?utf-8?B?TWpDRGZncjRGN2NzaFZkbUxlOFloMXpqWGlJZk5xak56d3BBbDlrVys0YXFv?=

=?utf-8?B?dUp1WW93ZGpDUXhuYlQ3UkpjTEsvUmVKKzQwKzRvMGlEQjVtYzBTTUREWUNn?=

=?utf-8?B?b2c2N2l3ZkF2NjNOQXVURXNVZWgxWGdZeFJNZmtKbEk0QXBZMjVZSHRhSWN6?=

=?utf-8?B?MVVsaG9icHhyNE83MEdKT3poKzVTMUFjV3lPcTJQSGdxT1VnU2tpSEZ1TkM1?=

=?utf-8?B?dXV5RXc0SFg2Tkk0WjdOUWRLN3JlVnVnbyswNUtBRzAwV1haaW1sU0N2UTJ0?=

=?utf-8?B?MzBPU1BQTmxrd1BvRUhoL0crNTIxNnpKSlNwcVdLMzRlS2s3Z2VSM05uUC96?=

=?utf-8?B?ZXZxUUh0NkMyWlh5ZlpwNExtZXZuOW8yYUI2TTVIenhtSGpvR3lnQUY2aTRB?=

=?utf-8?B?Z3lKVjdIQ2ZnaU9MdDRPWEl5Z0pFS1QvMEp4UjN0VUJuK1lXbDZHTWRSQ1lC?=

=?utf-8?B?NUFjSXpjakY3NEpXNjVwZkxGcC9mSHlUcVpKblFVRStmMHFBNW5aLzFvNThr?=

=?utf-8?B?YVliUitjdHVTM2pMRXhWMk02R09LNldvNkl6TnVLeElEbUpvYnBPd3pISHpj?=

=?utf-8?B?QkpwRHRDZUg4aDlBRHlOcGJVNWc3ZEdlcmZ4OVVVU2JNYlNrL2xiclRXcm9R?=

=?utf-8?B?ZnAveFZmMTNyQmc0Qk1QWkF2OFN3QjhXeXowZ1c2ZWFYUWJKRi9BeE5STE5M?=

=?utf-8?B?TW1SZnhUT0RPRGw4OTdTL2M4TVhuSVBkbEptNUFEUldHOTdxVVg3NjlTWmNP?=

=?utf-8?B?eVB1QXJWUlJLb0pRZVJ3YTN4YUE3b0xBcWRYbFdiV2VJTDcwa2lSOGxXcGlW?=

=?utf-8?B?UmxtampOSDVRMzYwWjI1by8zUFZXem5ieXFHWmRHK2FjQ0xOWDlIRzJKUENa?=

=?utf-8?B?Q1h0R0FQTnJWTlZPYVNzVDEwUVdCUlNsWVZadkFsUGViU3dwQ1czbittemNq?=

=?utf-8?B?a25WazVKTkkrdnRQc04xcnpTRERpWTFwcUpxckE2QmM2WW9WMVQ0YlVJVWoy?=

=?utf-8?B?ZkptMVdzMENjeXZLWlI0WGlQK3BzZnZhRUhoMW9vQ3dvTHJ4MTJlVDdjeS9T?=

=?utf-8?B?amtWT2RyVmdKdGQyTjE0Njk2b3NvWkFxNzl1NWxNbDAxNW01TEJLK1ZYMXdp?=

=?utf-8?B?dXI3TjI0MWN5YzdNMitWWmxPZUdVUXFIaEFRWWJHeERRejhiMi9PMlBtYjJ5?=

=?utf-8?B?VlNOMWVyTFpzV1czVGQwVEFZN3N4STlzZEhPM2hPd0hiQTVKZ3l3QWdVNHlX?=

=?utf-8?B?c0JvQSswZ3JqaCtuYzlJMWZobGNlRGxQOHNaRDBzYUQyK3dzemxWUWpLM2lj?=

=?utf-8?B?dm9JTGxrWFZENEZOWktYbEdnTkFaTTR2ZzBYSVlOOGdNbHJzSERGVVJ4Z01x?=

=?utf-8?B?am9iMjczRjdGSFcyRmtjWWZ1VWQxcFkvNm5uclp4Y1BnZTl5RitwZ2Z3UHVs?=

=?utf-8?B?UHhmcGl2RDN4dUw0OC9pRmpwR3ZYRFBacFR6WW1zZnNxWDVDb1RJWm9uSEFs?=

=?utf-8?B?OFJJY0lvMUp2cTVtZGl2czcvL0piSjBsTzdiQXVPa2hlei93SEZrcnE2TnV6?=

=?utf-8?B?c3VsbUk5bUhPVDFQN2gwL0d1Y3VBOUNVZDl6RkUvTE9ESGg0blpEUWJ6UzRu?=

=?utf-8?B?MXBXN0xGc2FaME9HUFl3RUxFV0xHbSthcGovZERKdXB4Z1NRaENpSEViZjM4?=

=?utf-8?B?dGtYV2JNR0NoWDhkZVhOdGE4K2N4RXJjTURNSVJGS0RrVURWUTVzLy9aSWNz?=

=?utf-8?B?OTdDQVVLNTRuOGd1ZzBvYzVnd1JQNUxyS29TUCswM2hTRTlRemp0TWFjdUpG?=

=?utf-8?B?c0d4dUUwc1lhbFhaWXdBYnN0ZVN1WTZXUEI3KzJmTzFXczdObzlVLzB1bUFv?=

=?utf-8?B?YlowNmtVa2VHUGd4ai9pQjRIMGczNHFiRlQvaHpraHY2SnJkbVl1cy9ydlFz?=

=?utf-8?B?TDBUdVZlOXlhdFgrZ1Fpc01udzBxc2RscGcyYUlvRlkySmU5RURuNGpCNy9l?=

=?utf-8?B?eTNYZStLcW5GNWZpc2gyRGRhT3NoamRGMFQ0MUZBaTRuZ2dLVEZVV3pYNGc5?=

=?utf-8?B?MktDUi9nWjBVYU5OQWNXbUxwbFhoRGJ5OEt5K1FHMmRWTjVhVVA4SUFrV1ll?=

=?utf-8?B?U0ljZDdIMXQ3dGpjV05tdUx6U2s5MGQ0bUczeU5tKzIvbmpBNUZFcWNxT1dN?=

=?utf-8?B?cTlhaEE5ZVBvQjY0UmdkRjZmREpoVEk3YTUwSEhWTFZxQ044SG1EK2ZMVm0r?=

=?utf-8?B?akJSZWxwK2IwMWlzOEI2VUpDVVdXNndUMlJJbW1EQ0JoTlVPaTRJTDE0WFJs?=

=?utf-8?B?NVd2ZHd1RHdyY2pERUlpU0o2Z2FqdERDQjVVYUJsZklyMEVJdFBEbVpwaW5U?=

=?utf-8?B?UkNFemtrMU1ud2FBa1pxMzlnNjNEY1dBQWMwdFJ4OG50OHV1a0RKV0NRU1VC?=

=?utf-8?B?S2hTQVhkSnJ6VGtzNGI3TVZHcDBiYU9pTzZwOEZvTmdRRkJvN2ZlMDZYZjlZ?=

=?utf-8?B?TW5zUEUxT096dUNsZ0ZnekllZkZnZTFpalZHWVlWTFVtTm5YR3JtaHN3dW5O?=

=?utf-8?B?R2dHS0JkUHRaSFpMOE0vS0QvS0EwSW01cmJWa3hBV0RIaVUwaThvL3ZIbys4?=

=?utf-8?B?a2EzdXZYTVl4QjUzQ25iN0syd1RWUEFhQ0JBZEx5cUFJZWdLRWtWTkYwODlU?=

=?utf-8?B?L2IxaXJOcG1FdlNlSkFiVmxhcWpRWjlIZStCMmhxTXg4NmJ5QzZvR1M4SW4x?=

=?utf-8?B?VzJ3R1pVeXNOOS93UWFNWUpIdjg4S00vbi9pc1M2aWNwNkxhRzE3Rmd3OExR?=

=?utf-8?B?SkZRNDJIWFNwcjAzbUUzNlZ2a2xJcWRJSTZma28xbDcxQ3B4Y0N0cXFEZmRU?=

=?utf-8?B?QXc5UFlzSDlZak9qZE5sWVV3RjJVamZOWUVNcTRlTHJMQ0RoUG5ZVURSUHV5?=

=?utf-8?B?Z3JocmcvQUhuUEFNVCsvZUtZMkhlY2hOM1lYNjlYZ3M2NUVaQnpWU0t5Qllq?=

=?utf-8?B?NytjMno4eEtueXd4YlV5NklaWnhhVThGNUYySW5nQTZvWG81Z3hPTDRWU1dw?=

=?utf-8?B?TEMvQy9wUUJ2V044VW4xS0FVUFFYYlVYZTBaaDlvRzkvZFNVQnFYM0VaY3FK?=

=?utf-8?B?U3hKZGVncTJBakgza0V3dUtzQzVUQmhFRE1oK3Q4Tk13WnJiZkMwa2UxM2VC?=

=?utf-8?B?Nloxd2FkMm85SzhtWStpUUVJMUNpY3JFTWtMUkw4OHNnRUFlTFFUcnB1ZVdZ?=

=?utf-8?B?eWtRTFJzcFRjdENwYkNZa1h3UVlVQVQvbjY2NUtzY3RlTENseHNKLzlZdlgv?=

=?utf-8?B?THkyS1l1Mk9CbTlsZHBndnBZdWJQRGNRenUxaDlJQ085elA5ZXNvSjNQSDlR?=

=?utf-8?Q?TZD8H0v4d6Ws2ikXH62?=

X-Auto-Response-Suppress: DR, OOF, AutoReply

X-OriginatorOrg: sct-15-20-9412-4-msonline-outlook-090a5.templateTenant

X-MS-Exchange-CrossTenant-OriginalArrivalTime: 29 Jun 2026 16:48:10.7533

(UTC)

X-MS-Exchange-CrossTenant-Network-Message-Id: 8c9cf958-2740-4f9a-892e-08ded5fe3439

X-MS-Exchange-CrossTenant-Id: 84df9e7f-e9f6-40af-b435-aaaaaaaaaaaa

X-MS-Exchange-CrossTenant-AuthSource: SN1PEPF00036F3C.namprd05.prod.outlook.com

X-MS-Exchange-CrossTenant-AuthAs: Anonymous

X-MS-Exchange-CrossTenant-FromEntityHeader: Internet

X-MS-Exchange-Transport-CrossTenantHeadersStamped: SJ4PPF5DF2E3EFE

X-Spam_score: 13.7

X-Spam_score_int: 137

X-Spam_bar: +++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: PayPal Transaction Successful – BTC Order Pending Completion

pondelok 29. jún 2026 Dear Customer, Thank you for your recent PayPal payment.

Your Bitcoin order has been received and is now awaiting final confirmation.



BTC Payment via PayPay Phish from Microsoft Outlook part 3



Content analysis details: (13.7 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[209.85.128.71 listed in will-spam-for-food.eu.org]

[209.85.128.71 listed in will-spam-for-food.eu.org]

[209.85.128.71 listed in will-spam-for-food.eu.org]

[209.85.128.71 listed in will-spam-for-food.eu.org]

[209.85.128.71 listed in will-spam-for-food.eu.org]

[209.85.128.71 listed in will-spam-for-food.eu.org]

[209.85.128.71 listed in will-spam-for-food.eu.org]

[209.85.128.71 listed in will-spam-for-food.eu.org]

[2603:10b6:806:d0:cafe:0:0:a4 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:806:d0:cafe:0:0:a4 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:806:d0:cafe:0:0:a4 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:806:d0:cafe:0:0:a4 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:806:d0:cafe:0:0:a4 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:806:d0:cafe:0:0:a4 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:806:d0:cafe:0:0:a4 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:806:d0:cafe:0:0:a4 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:806:d0:0:0:0:7 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:806:d0:0:0:0:7 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:806:d0:0:0:0:7 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:806:d0:0:0:0:7 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:806:d0:0:0:0:7 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:806:d0:0:0:0:7 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:806:d0:0:0:0:7 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:806:d0:0:0:0:7 listed in]

[will-spam-for-food.eu.org]

[40.93.2.68 listed in will-spam-for-food.eu.org]

[40.93.2.68 listed in will-spam-for-food.eu.org]

[40.93.2.68 listed in will-spam-for-food.eu.org]

[40.93.2.68 listed in will-spam-for-food.eu.org]

[40.93.2.68 listed in will-spam-for-food.eu.org]

[40.93.2.68 listed in will-spam-for-food.eu.org]

[40.93.2.68 listed in will-spam-for-food.eu.org]

[40.93.2.68 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[40.93.2.68 listed in dnsbl.ahbl.org]

[40.93.2.68 listed in dnsbl.ahbl.org]

[40.93.2.68 listed in dnsbl.ahbl.org]

[40.93.2.68 listed in dnsbl.ahbl.org]

[209.85.128.71 listed in dnsbl.ahbl.org]

[209.85.128.71 listed in dnsbl.ahbl.org]

[209.85.128.71 listed in dnsbl.ahbl.org]

[209.85.128.71 listed in dnsbl.ahbl.org]

[2603:10b6:806:d0:cafe:0:0:a4 listed in]

[dnsbl.ahbl.org]

[2603:10b6:806:d0:cafe:0:0:a4 listed in]

[dnsbl.ahbl.org]

[2603:10b6:806:d0:cafe:0:0:a4 listed in]

[dnsbl.ahbl.org]

[2603:10b6:806:d0:cafe:0:0:a4 listed in]

[dnsbl.ahbl.org]

[2603:10b6:806:d0:0:0:0:7 listed in]

[dnsbl.ahbl.org]

[2603:10b6:806:d0:0:0:0:7 listed in]

[dnsbl.ahbl.org]

[2603:10b6:806:d0:0:0:0:7 listed in]

[dnsbl.ahbl.org]

[2603:10b6:806:d0:0:0:0:7 listed in]

[dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[40.93.2.68 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[40.93.2.68 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[40.93.2.68 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[40.93.2.68 listed in dnsbl.ahbl.org]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[40.93.2.68 listed in bl.score.senderscore.com]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[40.93.2.68 listed in list.dnswl.org]

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[40.93.2.68 listed in wl.mailspike.net]

-0.0 SPF_PASS SPF: sender matches SPF record

1.0 HK_RANDOM_FROM From username looks random

3.5 VOWEL_FROM_7 Impronouncable from header (7+ consecutive vowels)

0.5 FROM_LOCAL_NOVOWEL From: localpart has series of non-vowel letters

1.0 HK_RANDOM_REPLYTO Reply-To username looks random

-0.0 T_RP_MATCHES_RCVD Envelope sender domain matches handover relay

domain

0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider

[haressaznzxrrsxaxz321(at)gmail.com]

0.0 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level mail

domains are different

0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in digit

[haressaznzxrrsxaxz321(at)gmail.com]

0.1 TW_RW BODY: Odd Letter Triples with RW

0.3 LONGWORD BODY: Uses overlong words

0.6 MEGALONGWORD BODY: Uses really overlong words

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 HTML_MESSAGE BODY: HTML included in message

2.0 RATWR8_MESSID Message-ID with excessive dashes and dollars

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

0.2 FREEMAIL_FORGED_FROMDOMAIN 2nd level domains in From and EnvelopeFrom

freemail headers are different

0.1 TO_IN_SUBJ To address is in Subject

3.0 LONG_INVISIBLE_TEXT Long block of hidden text - bayes poison?

Subject: {SPAM?} =?UTF-8?Q?Pozv=C3=A1nky=3A_PayPal_Transaction_Successful_=2D_BTC_Order?=

=?UTF-8?Q?_Pending_Completion_=40_po_29=2E_j=C3=BAn_2026_=28cynthiaperez389903=40g?=

=?UTF-8?Q?roups=2Eoutlook=2Ecom=29?=