WealthSimple phishing from Google

Posted by Dave Yadallee on Monday, August 17. 2026

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Mon, 17 Aug 2026 15:25:50 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.5 (FreeBSD))

(envelope-from )

id 1ww4py-00000000JYU-0teK

for dave@doctor.nl2k.ab.ca;

Mon, 17 Aug 2026 15:25:42 -0600

Resent-From: The Doctor

Resent-Date: Mon, 17 Aug 2026 15:25:42 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail02.l8cf9.com ([35.212.225.2]:34521)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.99.5 (FreeBSD))

(envelope-from )

id 1ww1vB-00000000HS1-0MlR

for doctor@nk.ca;

Mon, 17 Aug 2026 12:19:00 -0600

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; s=default; d=mail02.l8cf9.com;

h=Content-Type:MIME-Version:From:To:Subject:Date:Message-ID:List-Unsubscribe;

i=lzuibgas@mail02.l8cf9.com;

bh=aO5m2s9ovo1gPln3E93XOt0QmvkStOFd3ra08EUqFkY=;

b=0OTxgFyGDbfsRgZx0ZVtYZPJIHxCNXF6ATx5dlArypGuU4cADLWyyZ6ZP8Der2m7OxOHi1Vsb9rq

6ggUNO7C4SbLpHM+coOvGI15P5Gb+5WmWM12GCBW5wf9zlH+wM2vDxEqyrKhlpZHCR882FEY54aV

KUlKPnoQWAHBDCuk1c+e/W4UHbSlM7aN011zkgcu8nOVefS1SDtdYPMfuy93qeDpRY8as83qeN70

/U1gOdMECbh4LFe7oqmE9sDJQw9YpDoMrYFyAbEUxe6+hVpu0//z1AfJDKzuLB9QMrK2G5SbHYb2

9bZafXg9DsVci7Jp+vq9xbHoy7CArTdEzNB9tA==

Content-Type: multipart/alternative;

boundary="===============4925550661054290812=="

MIME-Version: 1.0

From:

=?utf-8?b?VOKAi2jigItl4oCLIOKAi1figItl4oCLYeKAi2zigIt04oCLaOKAi3PigItp4oCLbeKAi3DigIts4oCLZeKAiyDigItU4oCLZeKAi2HigItt?=

To: doctor@nk.ca

Subject: Your 1% cash match is pending - claim it before the window closes -

Votre contrepartie de 1 % est en attente - reclamez-la avant la fermeture de

la periode d'offre

Date: Mon, 17 Aug 2026 14:17:09 -0400

Message-ID: <178699062942.3418.7076111201382736772@mail02.l8cf9.com>

X-Auto-Response-Suppress: OOF, DR, RN, NRN

List-Unsubscribe:

X-Spam_score: 9.2

X-Spam_score_int: 92

X-Spam_bar: +++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.

Content preview: YOUR 1% CASH MATCH IS PENDING ACTIVATION Your 1% cash match

is pending - claim it before the window closes ================================================================

Content analysis details: (9.2 points, 5.0 required)

pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[35.212.225.2 listed in dnsbl.ahbl.org]

[35.212.225.2 listed in dnsbl.ahbl.org]

[35.212.225.2 listed in dnsbl.ahbl.org]

[35.212.225.2 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[35.212.225.2 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[35.212.225.2 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[35.212.225.2 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[35.212.225.2 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[35.212.225.2 listed in will-spam-for-food.eu.org]

[35.212.225.2 listed in will-spam-for-food.eu.org]

[35.212.225.2 listed in will-spam-for-food.eu.org]

[35.212.225.2 listed in will-spam-for-food.eu.org]

[35.212.225.2 listed in will-spam-for-food.eu.org]

[35.212.225.2 listed in will-spam-for-food.eu.org]

[35.212.225.2 listed in will-spam-for-food.eu.org]

[35.212.225.2 listed in will-spam-for-food.eu.org]

-0.0 SPF_PASS SPF: sender matches SPF record

-0.0 SPF_HELO_PASS SPF: HELO matches SPF record

2.5 URIBL_DBL_SPAM Contains a spam URL listed in the DBL blocklist

[URI: l8cf9.com]

1.9 URIBL_JP_SURBL Contains an URL listed in the JP SURBL blocklist

[URI: prhapp.com]

1.9 URIBL_ABUSE_SURBL Contains an URL listed in the ABUSE SURBL blocklist

[URI: login.prhapp.com]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-0.0 T_RP_MATCHES_RCVD Envelope sender domain matches handover relay

domain

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[35.212.225.2 listed in bl.score.senderscore.com]

1.5 MR_STRANGE_QUESTION URI: No description available.

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

0.0 LOTS_OF_MONEY Huge... sums of money

Subject: {SPAM?} Your 1% cash match is pending - claim it before the window closes -

Votre contrepartie de 1 % est en attente - reclamez-la avant la fermeture de

la periode d'offre

Wealthsimple

doctor, your 1% match is waiting — don’t let it expire unclaimed

When you move an existing investment account to Wealthsimple, we add 1% of the value to your account in real cash — not points, not credits. Your offer is still pending activation, and it won’t wait forever. If the offer window closes before you start your transfer, the match is gone.

YOUR PERSONAL OFFER

1%

CASH MATCH — PENDING ACTIVATION

Status: Not yet activated — expires if not claimed

WHAT YOU TRANSFERYOUR CASH MATCH

$10,000+$100

$50,000+$500

$100,000+$1,000

This offer is tied to your account and is time-limited. If the window closes before you begin a transfer, the 1% match is lost — it cannot be reinstated once the period ends.

HOW IT WORKS

Start your transfer in the app — we handle the paperwork with your current institution

Track your assets as they move securely, with updates along the way

Your 1% lands in cash as soon as the transfer settles — yours to keep, invest, or withdraw

Claim my match

Log in to activate your offer before the window closes.

Real cash, not a promo rate that disappears after three months. Whether you’re moving a TFSA, an RRSP, or a non-registered account, the same 1% applies. Millions of Canadians already invest with Wealthsimple — don’t leave your match on the table.

SECTION FRANÇAISE

Wealthsimple

doctor, votre contrepartie de 1 % vous attend — ne la laissez pas expirer

Lorsque vous transférez un compte de placement existant vers Wealthsimple, nous ajoutons 1 % de la valeur à votre compte en argent réel — pas des points, pas des crédits. Votre offre est toujours en attente d’activation, et elle n’attendra pas indéfiniment. Si la période d’offre se ferme avant que vous ne démarriez votre transfert, la contrepartie disparaît.

VOTRE OFFRE PERSONNELLE

1 %

CONTREPARTIE EN ESPÈCES — ACTIVATION EN ATTENTE

Statut : Non activée — expire si non réclamée

CE QUE VOUS TRANSFÉREZVOTRE CONTREPARTIE

10 000 $+100 $

50 000 $+500 $

100 000 $+1 000 $

Cette offre est liée à votre compte et est à durée limitée. Si la période se ferme avant que vous ne commenciez un transfert, la contrepartie de 1 % est perdue — elle ne peut pas être rétablie une fois la période terminée.

COMMENT ÇA FONCTIONNE

Démarrez votre transfert dans l’application — nous nous occupons des formalités avec votre institution actuelle

Suivez vos actifs pendant qu’ils se déplacent en toute sécurité, avec des mises à jour en cours de route

Votre 1 % est déposé en espèces dès que le transfert est réglé — à vous de le conserver, l’investir ou le retirer

Réclamer ma contrepartie

Connectez-vous pour activer votre offre avant la fermeture de la période.

De l’argent réel, pas un taux promotionnel qui disparaît après trois mois. Que vous transfériez un CELI, un REER ou un compte non enregistré, le même 1 % s’applique. Des millions de Canadiens investissent déjà avec Wealthsimple — ne laissez pas votre contrepartie sur la table.

Wealthsimple · Wealthsimple Investments Inc. · Member of CIPF

This is an automated offer notification sent to doctor. Terms and conditions apply. This offer may be modified or withdrawn at any time. Please review the full terms on our website before initiating a transfer.

© 2026 Wealthsimple. All rights reserved.

Apple store Paypal phish from Shopify

Posted by Dave Yadallee on Monday, August 17. 2026

0px; max-width: 0px; opacity: 0; overflow: hidden; mso-hide: all; font-fami=

ly: sans-serif; -ms-text-size-adjust: 100%; -webkit-text-size-adjust: 100%;=

">Just checking in

ze-adjust: 100%; -webkit-text-size-adjust: 100%;">=E2=80=87=CD=8F=E2=80=87=

=CD=8F=E2=80=87=CD=8F=E2=80=87=CD=8F=E2=80=87=CD=8F=E2=80=87=CD=8F=E2=80=87=

=CD=8F=E2=80=87=CD=8F=E2=80=87=CD=8F=E2=80=87=CD=8F=E2=80=87=CD=8F=E2=80=87=

=CD=8F=E2=80=87=CD=8F=E2=80=87=CD=8F=E2=80=87=CD=8F=E2=80=87=CD=8F=E2=80=87=

=CD=8F=E2=80=87=CD=8F=E2=80=87=CD=8F=E2=80=87=CD=8F=E2=80=87=CD=8F=E2=80=87=

=CD=8F=E2=80=87=CD=8F=E2=80=87=CD=8F=E2=80=87=CD=8F=E2=80=87=CD=8F=E2=80=87=

=CD=8F=E2=80=87=CD=8F=E2=80=87=CD=8F=E2=80=87=CD=8F=E2=80=87=CD=8F=E2=80=87=

=CD=8F=E2=80=87=CD=8F=E2=80=87=CD=8F=E2=80=87=CD=8F=E2=80=87=CD=8F=E2=80=87=

=CD=8F=E2=80=87=CD=8F=E2=80=87=CD=8F=E2=80=87=CD=8F=E2=80=87=CD=8F=E2=80=87=

=CD=8F=E2=80=87=CD=8F=E2=80=87=CD=8F=E2=80=87=CD=8F=E2=80=87=CD=8F=E2=80=87=

=CD=8F=E2=80=87=CD=8F=E2=80=87=CD=8F=E2=80=87=CD=8F=E2=80=87=CD=8F=E2=80=87=

=CD=8F=E2=80=87=CD=8F=E2=80=87=CD=8F=E2=80=87=CD=8F=E2=80=87=CD=8F=E2=80=87=

=CD=8F=E2=80=87=CD=8F=E2=80=87=CD=8F=E2=80=87=CD=8F=E2=80=87=CD=8F=E2=80=87=

=CD=8F=E2=80=87=CD=8F=E2=80=87=CD=8F=E2=80=87=CD=8F=E2=80=87=CD=8F=E2=80=87=

=CD=8F=E2=80=87=CD=8F=E2=80=87=CD=8F=E2=80=87=CD=8F=E2=80=87=CD=8F=E2=80=87=

=CD=8F=E2=80=87=CD=8F=E2=80=87=CD=8F=E2=80=87=CD=8F=E2=80=87=CD=8F=E2=80=87=

=CD=8F=E2=80=87=CD=8F=E2=80=87=CD=8F=E2=80=87=CD=8F=E2=80=87=CD=8F=E2=80=87=

=CD=8F=E2=80=87=CD=8F=E2=80=87=CD=8F=E2=80=87=CD=8F=E2=80=87=CD=8F=E2=80=87=

=CD=8F=E2=80=87=CD=8F=E2=80=87=CD=8F=E2=80=87=CD=8F=E2=80=87=CD=8F=E2=80=87=

=CD=8F=E2=80=87=CD=8F=E2=80=87=CD=8F=E2=80=87=CD=8F=E2=80=87=CD=8F=E2=80=87=

=CD=8F=E2=80=87=CD=8F=E2=80=87=CD=8F=E2=80=87=CD=8F=E2=80=87=CD=8F=E2=80=87=

=CD=8F=E2=80=87=CD=8F=E2=80=87=CD=8F=E2=80=87=CD=8F=E2=80=87=CD=8F=E2=80=87=

=CD=8F=E2=80=87=CD=8F=E2=80=87=CD=8F=E2=80=87=CD=8F=E2=80=87=CD=8F=E2=80=87=

=CD=8F=E2=80=87=CD=8F=E2=80=87=CD=8F=E2=80=87=CD=8F=E2=80=87=CD=8F=E2=80=87=

=CD=8F=E2=80=87=CD=8F=E2=80=87=CD=8F=E2=80=87=CD=8F=E2=80=87=CD=8F=E2=80=87=

=CD=8F=E2=80=87=CD=8F=E2=80=87=CD=8F=E2=80=87=CD=8F=E2=80=87=CD=8F=E2=80=87=

=CD=8F=E2=80=87=CD=8F=E2=80=87=CD=8F=E2=80=87=CD=8F=E2=80=87=CD=8F=E2=80=87=

=CD=8F=E2=80=87=CD=8F=E2=80=87=CD=8F=E2=80=87=CD=8F=E2=80=87=CD=8F=E2=80=87=

=CD=8F=E2=80=87=CD=8F=E2=80=87=CD=8F=E2=80=87=CD=8F=E2=80=87=CD=8F=E2=80=87=

=CD=8F=E2=80=87=CD=8F=E2=80=87=CD=8F=E2=80=87=CD=8F=E2=80=87=CD=8F=E2=80=87=

=CD=8F=E2=80=87=CD=8F=E2=80=87=CD=8F=E2=80=87=CD=8F=E2=80=87=CD=8F=E2=80=87=

=CD=8F=E2=80=87=CD=8F=E2=80=87=CD=8F=E2=80=87=CD=8F=E2=80=87=CD=8F=E2=80=87=

=CD=8F=E2=80=87=CD=8F=E2=80=87=CD=8F=E2=80=87=CD=8F=E2=80=87=CD=8F=E2=80=87=

=CD=8F=E2=80=87=CD=8F=E2=80=87=CD=8F=E2=80=87=CD=8F=E2=80=87=CD=8F=E2=80=87=

=CD=8F=E2=80=87=CD=8F=E2=80=87=CD=8F=C2=AD=C2=AD=C2=AD=C2=AD=C2=AD=C2=AD=C2=

=AD=C2=AD=C2=AD=C2=AD=C2=AD=C2=AD=C2=AD=C2=AD=C2=AD=C2=AD=C2=AD=C2=AD=C2=AD=

=C2=AD=C2=AD=C2=AD=C2=AD=C2=AD=C2=AD=C2=AD=C2=AD=C2=AD=C2=AD=C2=AD=C2=AD=C2=

=AD=C2=AD=C2=AD=C2=AD=C2=AD=C2=AD=C2=AD=C2=AD=C2=AD=C2=AD=C2=AD=C2=AD=C2=AD=

=C2=AD=C2=AD=C2=AD=C2=AD=C2=AD=C2=AD=C2=AD=C2=AD=C2=AD=C2=AD=C2=AD=C2=AD=C2=

=AD=C2=AD=C2=AD=C2=AD=C2=AD=C2=AD=C2=AD=C2=AD=C2=AD=C2=AD=C2=AD=C2=AD=C2=AD=

=C2=AD=C2=AD=C2=AD=C2=AD=C2=AD=C2=AD=C2=AD=C2=AD=C2=AD=C2=AD=C2=AD=C2=AD=C2=

=AD=C2=AD=C2=AD=C2=AD=C2=AD=C2=AD=C2=AD=C2=AD=C2=AD=C2=AD=C2=AD=C2=AD=C2=AD=

=C2=AD=C2=AD=C2=AD=C2=AD=C2=AD=C2=AD=C2=AD=C2=AD=C2=AD=C2=AD=C2=AD=C2=AD=C2=

=AD=C2=AD=C2=AD=C2=AD=C2=AD=C2=AD=C2=AD=C2=AD=C2=AD=C2=AD=C2=AD=C2=AD=C2=AD=

=C2=AD=C2=AD=C2=AD=C2=AD=C2=AD=C2=AD=C2=AD=C2=AD=C2=AD=C2=AD=C2=AD=C2=AD=C2=

=AD=C2=AD=C2=AD=C2=AD=C2=AD=C2=AD=C2=AD=C2=AD=C2=AD=C2=AD=C2=AD=C2=AD=C2=AD=

=C2=AD=C2=AD=C2=AD=C2=AD=C2=AD=C2=AD=C2=AD=C2=AD=C2=AD=C2=AD=C2=AD=C2=AD=C2=

=AD=C2=AD=C2=AD=C2=AD=C2=AD=C2=AD=C2=AD=C2=AD=C2=AD=C2=AD=C2=AD=C2=AD=C2=AD=

=C2=A0

dth=3D"100%" style=3D"background-color: #fafafa; -ms-text-size-adjust: 100%=

; -webkit-text-size-adjust: 100%; mso-table-lspace: 0pt !important; mso-tab=

le-rspace: 0pt !important; border-spacing: 0 !important; border-collapse: c=

ollapse !important; table-layout: fixed !important; margin: auto;" class=3D=

"full-wrap">
djust: 100%;">

<=

td style=3D"-ms-text-size-adjust: 100%; -webkit-text-size-adjust: 100%; mso=

-table-lspace: 0pt !important; mso-table-rspace: 0pt !important; vertical-a=

lign: top;">

dth=3D"600" style=3D"background-color: #ffffff; -ms-text-size-adjust: 100%;=

-webkit-text-size-adjust: 100%; mso-table-lspace: 0pt !important; mso-tabl=

e-rspace: 0pt !important; border-spacing: 0 !important; border-collapse: co=

llapse !important; table-layout: fixed !important; margin: auto;" class=3D"=

email-container">
ize-adjust: 100%;">
ze-adjust: 100%;">

e-adjust: 100%; mso-table-lspace: 0pt !important; mso-table-rspace: 0pt !im=

portant; vertical-align: top;">
order=3D"0" align=3D"center" width=3D"600" style=3D"background-color: #ffff=

ff; -ms-text-size-adjust: 100%; -webkit-text-size-adjust: 100%; mso-table-l=

space: 0pt !important; mso-table-rspace: 0pt !important; border-spacing: 0 =

!important; border-collapse: collapse !important; table-layout: fixed !impo=

rtant; margin: auto;" class=3D"email-container">
ze-adjust: 100%; -webkit-text-size-adjust: 100%;">
e-adjust: 100%; -webkit-text-size-adjust: 100%;">=

0; font-family: 'Helvetica Neue', Helvetica, Arial, sans-serif; fon=

t-weight: 400; font-style: normal; -ms-text-size-adjust: 100%; -webkit-text=

-size-adjust: 100%; mso-table-lspace: 0pt !important; mso-table-rspace: 0pt=

!important; vertical-align: top; padding: 30px 60px;" align=3D"left" class=

=3D"column-container-left column-container-right">

-adjust: 100%; -webkit-text-size-adjust: 100%; line-height: 1.5; margin: 0;=

padding: 0;">Dear Valued Customer, doctor@doctor.nl2k.ab.ca

s-text-size-adjust: 100%; -webkit-text-size-adjust: 100%;"/>PayPal has obse=

rved activity that doesn't match your usual usage patterns on your acco=

unt.

;"/>

;"/>Our fraud prevention system recently logged a $292.95 PayPal purchase a=

ttempt at an Apple Store location in Massachusetts (MA).

xt-size-adjust: 100%; -webkit-text-size-adjust: 100%;"/>

xt-size-adjust: 100%; -webkit-text-size-adjust: 100%;"/>If this purchase wa=

s made by you:

just: 100%;"/>

just: 100%;"/>Ignore this message. The transaction will clear and show up i=

n your account within 24 hours.

bkit-text-size-adjust: 100%;"/>

bkit-text-size-adjust: 100%;"/>If this purchase was NOT made by you: Call P=

ayPal Support as soon as possible at +16565563097

-adjust: 100%; -webkit-text-size-adjust: 100%;"/>

-adjust: 100%; -webkit-text-size-adjust: 100%;"/>for immediate verification=

and account protection.

xt-size-adjust: 100%;"/>

xt-size-adjust: 100%;"/>Your account safety is our top concern, and we appr=

eciate your cooperation.

xt-size-adjust: 100%;"/>

xt-size-adjust: 100%;"/>Thanks,

bkit-text-size-adjust: 100%;"/>

bkit-text-size-adjust: 100%;"/>PayPal Support Team

e-adjust: 100%; -webkit-text-size-adjust: 100%;"/>+16565563097

-ms-text-size-adjust: 100%; -webkit-text-size-adjust: 100%;"/>

-ms-text-size-adjust: 100%; -webkit-text-size-adjust: 100%;"/>Kindly do not=

reply to this message, as this address is not actively monitored.

dth=3D"600" style=3D"background-color: #000000; -ms-text-size-adjust: 100%;=

-webkit-text-size-adjust: 100%; mso-table-lspace: 0pt !important; mso-tabl=

e-rspace: 0pt !important; border-spacing: 0 !important; border-collapse: co=

llapse !important; table-layout: fixed !important; margin: auto; padding: 2=

4px 0;" class=3D"email-container">
%; -webkit-text-size-adjust: 100%;">
; -webkit-text-size-adjust: 100%;">

-ms-text-size-adjust: 100%; -webkit-text-size-adjust: 100%; mso-table-lspac=

e: 0pt !important; mso-table-rspace: 0pt !important; vertical-align: top; p=

adding: 24px 0;">
ign=3D"center" width=3D"600" style=3D"background-color: #000000; -ms-text-s=

ize-adjust: 100%; -webkit-text-size-adjust: 100%; mso-table-lspace: 0pt !im=

portant; mso-table-rspace: 0pt !important; border-spacing: 0 !important; bo=

rder-collapse: collapse !important; table-layout: fixed !important; margin:=

auto;" class=3D"email-container">
%; -webkit-text-size-adjust: 100%;">
; -webkit-text-size-adjust: 100%;">

-webkit-text-size-adjust: 100%; mso-table-lspace: 0pt !important; mso-tabl=

e-rspace: 0pt !important; vertical-align: top; padding: 0 60px;" align=3D"c=

enter" class=3D"column-container-left column-container-right">

0" width=3D"100%" style=3D"-ms-text-size-adjust: 100%; -webkit-text-size-ad=

just: 100%; mso-table-lspace: 0pt !important; mso-table-rspace: 0pt !import=

ant; border-spacing: 0 !important; border-collapse: collapse !important; ta=

ble-layout: fixed !important;">
-webkit-text-size-adjust: 100%;">
e-adjust: 100%; -webkit-text-size-adjust: 100%;">

=3D"width: 100%; -ms-text-size-adjust: 100%; -webkit-text-size-adjust: 100%=

; mso-table-lspace: 0pt !important; mso-table-rspace: 0pt !important; verti=

cal-align: top;">

e=3D"-ms-text-size-adjust: 100%; -webkit-text-size-adjust: 100%; mso-table-=

lspace: 0pt !important; mso-table-rspace: 0pt !important; border-spacing: 0=

!important; border-collapse: collapse !important; table-layout: fixed !imp=

ortant;">
st: 100%;">
t-text-size-adjust: 100%;">

-bottom: 8px; font-family: 'Helvetica Neue', Helvetica, Arial, sans=

-serif; font-weight: 400; font-style: normal; font-size: 12px; mso-height-r=

ule: exactly; line-height: 1.5; -ms-text-size-adjust: 100%; -webkit-text-si=

ze-adjust: 100%; mso-table-lspace: 0pt !important; mso-table-rspace: 0pt !i=

mportant; vertical-align: top;">

webkit-text-size-adjust: 100%;">

-adjust: 100%;">

#ffffff; font-family: 'Helvetica Neue', Helvetica, Arial, sans-seri=

f; font-weight: 400; font-style: normal; font-size: 12px; mso-height-rule: =

exactly; line-height: 1.5; -ms-text-size-adjust: 100%; -webkit-text-size-ad=

just: 100%; mso-table-lspace: 0pt !important; mso-table-rspace: 0pt !import=

ant; vertical-align: top;">

t-text-size-adjust: 100%;">

ext-size-adjust: 100%;">No longer want to receive these emails?=C2=

=A0
t-text-size-adjust: 100%;">
nt/unsubscribe?token=3DrHA1Rg3iC4vko-gEfgWEa4fnUKeae8zFQJZx8Cm6QjrhESPSPDMW=

aVCpawBxJL5Wc0FiyU8LReb3fF5WFhkN3WVZDZSPZHicuFPgwl6vRtmIC-DysIKcvYHiLpqRtGC=

IdmWZBz__42ATrNfa8i8ndA%3D%3D&se_activity_id=3D211339968855&utm_sou=

rce=3Dshopify_email&utm_medium=3Demail&utm_campaign=3DQuick+follow-=

up_211339968855" style=3D"color: #ffffff; -ms-text-size-adjust: 100%; -webk=

it-text-size-adjust: 100%; text-decoration: underline;" target=3D"_blank"> =

Unsubscribe

ext-size-adjust: 100%;">=C2=A9 2026=C2=A0
ine-block; -ms-text-size-adjust: 100%; -webkit-text-size-adjust: 100%;">Sup=

port Teams

mso-line-height-rule: exactly; -ms-text-size-adjust: 100%; -webkit-text-si=

ze-adjust: 100%;" class=3D"mobile-hide">
idth: 600px; font-size: 1px; line-height: 1px; mso-line-height-rule: exactl=

y; -ms-text-size-adjust: 100%; -webkit-text-size-adjust: 100%; mso-table-ls=

pace: 0pt !important; mso-table-rspace: 0pt !important; vertical-align: top=

;">

ekplsw.png" alt=3D"" width=3D"600" height=3D"1" style=3D"display: block; wi=

dth: 600px; height: 1px; -ms-text-size-adjust: 100%; -webkit-text-size-adju=

st: 100%; -ms-interpolation-mode: bicubic; outline: none; text-decoration: =

none; border-width: 0;" border=3D"0"/>

8D-CA6327B8?en=3DAAA7V9t73ZF6Hu3C6NZZ2tAO1qp4m2KfUjZIF7EP1hJ%2BWw2UveHqpDV4=

aRfDkwA52dJu6chU6PLOi%2BVq1dnUBzfIYV8OWXF2KpkN%2FOhb0KduPoNNbLbL48ZSL6FkRN5=

O6g9TTySOTE%2BtHnftr9GeMFez9yKB0GHfs4%2ByIkGLuqMf0uyUiMDVHouLWRijW1u1LG02fJ=

uE7vRp0DseVBCa4QEwTjwQD%2FKReWiLAK%2FumCt1N%2FGfYvO7fYUUuDh5TBo5ExtabQDNGE4=

SbsEPttPs0MUTKCuySmKbQMaNmC7%2FXZ4dzi1DiIsdOFZFWm6ybPdioSUbXzUvSzxnSB63tXbu=

WtcqTIFcLZ3QHY8SSKXOduFou%2BIDr%2F237EWIkdHb5pXUIr09D4ZdyaESjHnK1lCe%2B1gMT=

zDOsqzvUmo4Fuo%2FU7PSd%2BMvdcH4%2FjqGvP2yV5qxwJ0CtUTJ6Gw1a2vAR41vYqljbm1Cs6=

%2FSAiOnfAdkbJrpEM%2FQIcsC5%2BgrXkq9K3uKbt5DStUwP9KJyJqHwgHdwmQMro5K9vbqEIc=

d5lN%2F6T%2F0kxFxaznPUgvdVqmD2rKU9jaTX38B2UKa0TI6yPxb6nuuJQwMgqDDoONlyR2iWb=

mAYybTcizCI%2FjCoyy5cA%3D%3D" style=3D"display:none"/>

Chinese Frieght broker spam

Posted by Dave Yadallee on Monday, August 17. 2026

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Mon, 17 Aug 2026 11:28:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.5 (FreeBSD))

(envelope-from )

id 1ww17I-00000000NH1-0XsC

for dave@doctor.nl2k.ab.ca;

Mon, 17 Aug 2026 11:27:20 -0600

Resent-From: The Doctor

Resent-Date: Mon, 17 Aug 2026 11:27:20 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-m83201.xmail.ntesmail.com ([156.224.83.201]:41496)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.99.5 (FreeBSD))

(envelope-from )

id 1ww0p3-00000000Cyx-03O7

for sales@nk.ca;

Mon, 17 Aug 2026 11:08:38 -0600

Content-Type: multipart/alternative; BOUNDARY="=_Part_581537_246478220.1786986391736"

To: sales

Subject: =?UTF-8?B?UmU6UmU6IFN0aWxsIGxvb2tpbmcgZm9yIGEgcmVsaWFibGUgZnJlaWdodCBwYXJ0bmVyIGluIENoaW5hPyA=?=

X-Priority: 3

MIME-Version: 1.0

Received: from sales03_szx@bnclogistics.com( [10.139.4.160] ) by ajax-webmail ( [127.0.0.1] ) ; Tue, 18 Aug 2026 01:06:31 +0800 (GMT+08:00)

From: Sunny

Date: Tue, 18 Aug 2026 01:06:31 +0800 (GMT+08:00)

X-WM-Tid: 0aa010b0688c00f5kunm8d1bd201b7563

Message-ID:

Hi sales,

I hope this email finds you well.

Thank you for subscribing to our newsletter. We're thrilled to have you on board!

I am excited to inform you that we are currently offering a special promotion on our products.If you have any needs, please let me know as soon as possible so I can secure a discounted spot for you.

Thank you for your attention, and I look forward to hearing from you soon.

Best regards,

Do not miss a product highlight: hit . Stay Engaged

Whenever you’d like fewer emails, use Edit Email Choices.

Chinese products spam

Posted by Dave Yadallee on Monday, August 17. 2026

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Mon, 17 Aug 2026 11:25:50 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.5 (FreeBSD))

(envelope-from )

id 1ww15J-00000000MXO-47hj

for dave@doctor.nl2k.ab.ca;

Mon, 17 Aug 2026 11:25:17 -0600

Resent-From: The Doctor

Resent-Date: Mon, 17 Aug 2026 11:25:17 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from [103.209.128.223] (port=63398 helo=mail-m128223.netease.com)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.99.5 (FreeBSD))

(envelope-from )

id 1wvyKG-00000000O0T-2Ggx

for sales@nk.ca;

Mon, 17 Aug 2026 08:28:46 -0600

Content-Type: multipart/alternative; BOUNDARY="=_Part_544939_211004546.1786976850860"

To: sales

Subject: =?UTF-8?B?UmU6TmVlZCBhIHJlbGlhYmxlIHN1cHBsaWVyIGZvciBnb2xmIGNhcnRzPw==?=

X-Priority: 3

MIME-Version: 1.0

Received: from park@hxcarts.com( [10.139.4.149] ) by ajax-webmail ( [127.0.0.1] ) ; Mon, 17 Aug 2026 22:27:30 +0800 (GMT+08:00)

From: Lilly

Date: Mon, 17 Aug 2026 22:27:30 +0800 (GMT+08:00)

X-WM-Tid: 0aa0101ed36100f5kunm2d3ca415ab6de

DKIM-Signature: a=rsa-sha256;

b=lXHqm5T0dEvINmUaYQO9wDltBl6lBosd5X3c8UJ6sn8Nx9y4AoI2MPWLfye4PRPvNJLhaDI/6OdQikGIQjVRWbHIy9jNRSBuftsoPEAY6WKmQMPN2xLDwVOtcoRZS918IWdJPbxmmQMolNED+Hw2Ar8iPPZ2bY2qISnWvXG9fFweyqJE3RpMasR5v+UjYFPEtnfjA7LWlwZ+oih5Cizh8kRQNNpQzVIenJW6Q/xWEeE14d+gaiM3OkJwnuvZg56sKt2SPEznsEt87kCtHNhlV6O8GMOaUuRarLHK4xpEMFGtkxH5kPKp4GAaHpWw1O1wVkhDQ/xLdTY7cmcGoy98yA==; s=default; c=relaxed/relaxed; d=hxcarts.com; v=1;

bh=/9BiRJFnJENXe+2H73kpfP9MZFdhtHd/6rxPp+P4oEs=;

h=date:mime-version:subject:message-id:from;

Message-ID:

X-Spam_score: 8.4

X-Spam_score_int: 84

X-Spam_bar: ++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.

Content preview: Hi sales, I hope this email finds you well. Thank you for

reading our introductory email. We're here to assist if you have any further

questions or need more information. I am excited to inform you that we are

currently offering a special promotion on our products.If you have any needs,

please let me know as soon as possible so I can secure a discounted spot

for you. T [...]

Content analysis details: (8.4 points, 5.0 required)

pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[103.209.128.223 listed in dnsbl.ahbl.org]

[103.209.128.223 listed in dnsbl.ahbl.org]

[103.209.128.223 listed in dnsbl.ahbl.org]

[103.209.128.223 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[103.209.128.223 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[103.209.128.223 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[103.209.128.223 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[103.209.128.223 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[103.209.128.223 listed in will-spam-for-food.eu.org]

[103.209.128.223 listed in will-spam-for-food.eu.org]

[103.209.128.223 listed in will-spam-for-food.eu.org]

[103.209.128.223 listed in will-spam-for-food.eu.org]

[103.209.128.223 listed in will-spam-for-food.eu.org]

[103.209.128.223 listed in will-spam-for-food.eu.org]

[103.209.128.223 listed in will-spam-for-food.eu.org]

[103.209.128.223 listed in will-spam-for-food.eu.org]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[103.209.128.223 listed in bl.score.senderscore.com]

-0.0 RCVD_IN_MSPIKE_H4 RBL: Very Good reputation (+4)

[103.209.128.223 listed in wl.mailspike.net]

-0.0 SPF_PASS SPF: sender matches SPF record

-0.0 RCVD_IN_MSPIKE_WL Mailspike good senders

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 HTML_MESSAGE BODY: HTML included in message

1.3 RDNS_NONE Delivered to internal network by a host with no rDNS

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

2.0 HTML_FONT_TINY_NORDNS Font too small to read, no rDNS

1.0 HTML_TEXT_INVISIBLE_STYLE HTML hidden text + other spam signs

2.0 MIXED_HREF_CASE Has href in mixed case

0.6 LONG_INVISIBLE_TEXT Long block of hidden text - bayes poison?

0.0 T_REMOTE_IMAGE Message contains an external image

Subject: {SPAM?} =?UTF-8?B?UmU6TmVlZCBhIHJlbGlhYmxlIHN1cHBsaWVyIGZvciBnb2xmIGNhcnRzPw==?=

Hi sales,

I hope this email finds you well.

Thank you for reading our introductory email. We're here to assist if you have any further questions or need more information.

I am excited to inform you that we are currently offering a special promotion on our products.If you have any needs, please let me know as soon as possible so I can secure a discounted spot for you.

Thank you for your attention, and I look forward to hearing from you soon.

Best regards,

Lock in your recurring product news by tapping . Receive Our Updates

Turn off occasional mailings anytime: Adjust Your Preferences.

Park

park@hxcarts.com

在2026-08-12，Lilly 写道:

-----原始邮件-----

发件人： Lilly

发件时间: 2026年08月12日周三

收件人： [sales ]

主题： Need a reliable supplier for golf carts?

Hi Sales,

We make golf carts and electric tricycles. Factory direct. Fully customizable.

What that means for you:

- 30-50% lower cost than most brands

- Your logo, your color, your specs

- CE/EEC certified – ready for your market

We deliver 800+ units monthly from our China and Vietnam facilities. If you're currently sourcing these products, I'd love to send you our catalog and price list. Would you be open to a quick look?

This is my WhatsApp. Feel free to reach out anytime if there's any issue.

Whatsapp

Best regards, Lilly Anhui Huaxin Electric Technology Co., LTD

Stay informed with our latest news and enhancements by selecting . Stay Connected

If emails aren’t for you, hit Change Preferences.

Enable regular insights and our product’s newest features by hittinging . Continue Updates

If you’d rather not get more emails, just hit Adjust Settings at any time.

Park

park@hxcarts.com

在2026-07-10，Lilly 写道:

-----原始邮件-----

发件人： Lilly

发件时间: 2026年07月10日周五

收件人： [sales ]

主题： Need a reliable supplier for golf carts?

Hi Sales,

We make golf carts and electric tricycles. Factory direct. Fully customizable.

What that means for you:

- 30-50% lower cost than most brands

- Your logo, your color, your specs

- CE/EEC certified – ready for your market

We deliver 800+ units monthly from our China and Vietnam facilities. If you're currently sourcing these products, I'd love to send you our catalog and price list. Would you be open to a quick look?

This is my WhatsApp. Feel free to reach out anytime if there's any issue.

Whatsapp

Best regards, Lilly Anhui Huaxin Electric Technology Co., LTD

Stay informed with our latest news and enhancements by selecting . Stay Connected

If emails aren’t for you, hit Change Preferences.

Enable regular insights and our product’s newest features by hittinging . Continue Updates

If you’d rather not get more emails, just hit Adjust Settings at any time.

Park

park@hxcarts.com

Business Buyer spam from Google Gmail

Posted by Dave Yadallee on Monday, August 17. 2026

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Mon, 17 Aug 2026 11:25:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.5 (FreeBSD))

(envelope-from )

id 1ww14x-00000000MPw-1RrE

for dave@doctor.nl2k.ab.ca;

Mon, 17 Aug 2026 11:24:55 -0600

Resent-From: The Doctor

Resent-Date: Mon, 17 Aug 2026 11:24:55 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-pf1-f172.google.com ([209.85.210.172]:44336)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.99.5 (FreeBSD))

(envelope-from )

id 1wvy8M-00000000LQf-3nvS

for sales@nk.ca;

Mon, 17 Aug 2026 08:16:23 -0600

Received: by mail-pf1-f172.google.com with SMTP id d2e1a72fcca58-848643382fcso3550655b3a.1

for ; Mon, 17 Aug 2026 07:15:28 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=bankingtheadvisoryib.com; s=google; t=1786976122; x=1787580922; darn=nk.ca;

h=content-type:mime-version:date:content-transfer-encoding:subject:to

:from:message-id:from:to:cc:subject:date:message-id:reply-to

:content-type;

bh=8c6Kr94NMFpOPW0aQ75oxZ3gDTZPmJyVZruJdn8JFXY=;

b=eov0QZzoVV6GiO6ssMec2xbxqxYeIwxRMEqBOnny1Joy55PaSbybWRS/NGbXit+g7G

IWmCdF/rq2SXBKZBI8cTeDjaCr3EeFFK6SP6RQX7yAkzIWkwRReYEX0qdnOubdlOB6yl

xSBUS/qJgZf6+YcM85cFhully18Gr928BojS0k/E/3lPBuV5ijFdVhvoCs6MSLDbzIpX

bqGiJp5x/y81z+7HTT3fAvsEaUa9jMpTFqX14PfYMyTXoGx4BfMZFds/IMAe2wbrHWVT

VuHSrrAxy2RtUl3thtMUuBx7LN71gIbz35I74gA58tQ/k+cLf9ywpeuyOtgApgc9CGiI

UADQ==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20251104; t=1786976122; x=1787580922;

h=content-type:mime-version:date:content-transfer-encoding:subject:to

:from:message-id:x-gm-gg:x-gm-message-state:from:to:cc:subject:date

:message-id:reply-to:content-type;

bh=8c6Kr94NMFpOPW0aQ75oxZ3gDTZPmJyVZruJdn8JFXY=;

b=QWPaZ/wym4K6Y7RwkKYgGFD0JonTdYtBpInf1zdJh1U65ABmysYCqEk2kM0N/btgfa

r/o5yA0qhwxmMFlHir+xOeP1tFuHLAbje5d5DjehdQqi3TJIhPlEKwaTKPBy1uTpM9wZ

GJ0KY5o2mQjbJc30yDJsQZYnyjqm27G+OGI9sgZfUfW6bXL5fKUwk+tglJlg2VuFMV5I

TxL5O0fNH7EzMwBmLFv5aQ2AvUxjEGeKcG+DGX+lEd7+vKIoCsUVmYbwTWuPxTakOwXW

16mv9gahDkD2sli7T+NKHRvNM9ijJ1i9GVePkrYSejcuvFTLwpTKFLyy3hXsquu4U9b3

EsKg==

X-Gm-Message-State: AOJu0Yw0I12qmvOmKVQKQpjY032qYgcQr2uqj1Cn9aXFdDLu02Z8Rh9c

j1r1v3RkeLB8hqnEt/1QkjjNIbJK1GxgnRA2AydLseIM7YRm0TV3Qggfr01agkxYIRPfzxpHgzD

rtN6bmw==

X-Gm-Gg: AR+sD11nguA+rjstJtrpFxxcDc7jim+/4bVvkE5wysnjfmHmLrO9VTcZJ9GkpWeWWPv

dBXPY8FqZPtESmhvJQV3xuyFyAmgl3wS9e1l+Ch9eifwJ7jMYslTSxHbRjMmSxXj/JjzMG6ki5H

BJiRFVYX5u88+dsAh5cLe1be54wQoRbg5cP7sf1t7u2mIJqIE2KLQuJ17YQf2f6/2pqIRAWQXEk

oDJ785Ratto6oLXx8DOyb9xVIqX5igiKso0PhAtsrblnir8L+YtwwV75IiFDNHHxK2lJ6UIZ8tb

L5splbGyCCqamsIEkb9nsaGLSy7BCqWAGSAotb8vuW0eMSEK4uZXYgFqgRKIAtwKBq3gfykh92e

KfZPzOLv92R7p9ac+7ngoY5f5lplZ6MjLiTHj37JSoWCTFYda8WOcf6FV5J7Cf2J5C/xaro6SCx

6K6wfDgVfGyLB2lHK8aMESLZtiTzHWLZBAfvTop+bnq8wLj64lIazFGZ35/Lje9Qsa5kwX+QxSN

+i2R+NgJrP1tBzc2FfkCmdQoL08aXEyCHAXf6en1JAIIh3+1Daa8NFnUKpzfb21o7tI84gkCuHR

coVXK6GT6zbM

X-Received: by 2002:a05:690e:85:b0:66a:b22d:9c2b with SMTP id 956f58d0204a3-66cb9dae845mr263659d50.31.1786975796331;

Mon, 17 Aug 2026 07:09:56 -0700 (PDT)

Received: from 01a0100e-b9f5-703d-8d3b-111f37b9c027.local (ec2-3-90-89-111.compute-1.amazonaws.com. [3.90.89.111])

by smtp.gmail.com with ESMTPSA id 956f58d0204a3-66cb3eb8367sm846048d50.4.2026.08.17.07.09.55

for

(version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256);

Mon, 17 Aug 2026 07:09:56 -0700 (PDT)

Message-ID: <01a0100e-b9f5-703d-8d3b-111f37b9c027@bankingtheadvisoryib.com>

X-Mail-Abuse-Inquiries:

https://app.instantly.ai/privacy/report-abuse/01a0100e-b9f5-703d-8d3b-111f37b9c027

From: Oliver Bogner

To: sales@nk.ca

Subject: Buyer for Netknow Internet Knowledge

Content-Transfer-Encoding: quoted-printable

Date: Mon, 17 Aug 2026 14:09:55 +0000

MIME-Version: 1.0

Content-Type: text/plain; charset=utf-8

X-Spam_score: 8.5

X-Spam_score_int: 85

X-Spam_bar: ++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.

Content preview: Hey, We're the number 1-ranked lower middle market investment

bank in the US (Axial, 2026) and there's a buyer who reached out specifically

regarding Netknow Internet Knowledge. I understand your journey firsthand

- personally sold five-plus companies, and that's precisely why I founded

The Advisory, to assist founders like yourself in selling their businesses.

Content analysis details: (8.5 points, 5.0 required)

pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[209.85.210.172 listed in dnsbl.ahbl.org]

[209.85.210.172 listed in dnsbl.ahbl.org]

[209.85.210.172 listed in dnsbl.ahbl.org]

[209.85.210.172 listed in dnsbl.ahbl.org]

[3.90.89.111 listed in dnsbl.ahbl.org]

[3.90.89.111 listed in dnsbl.ahbl.org]

[3.90.89.111 listed in dnsbl.ahbl.org]

[3.90.89.111 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[209.85.210.172 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[209.85.210.172 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[209.85.210.172 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[209.85.210.172 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[3.90.89.111 listed in will-spam-for-food.eu.org]

[3.90.89.111 listed in will-spam-for-food.eu.org]

[3.90.89.111 listed in will-spam-for-food.eu.org]

[3.90.89.111 listed in will-spam-for-food.eu.org]

[3.90.89.111 listed in will-spam-for-food.eu.org]

[3.90.89.111 listed in will-spam-for-food.eu.org]

[3.90.89.111 listed in will-spam-for-food.eu.org]

[3.90.89.111 listed in will-spam-for-food.eu.org]

[209.85.210.172 listed in will-spam-for-food.eu.org]

[209.85.210.172 listed in will-spam-for-food.eu.org]

[209.85.210.172 listed in will-spam-for-food.eu.org]

[209.85.210.172 listed in will-spam-for-food.eu.org]

[209.85.210.172 listed in will-spam-for-food.eu.org]

[209.85.210.172 listed in will-spam-for-food.eu.org]

[209.85.210.172 listed in will-spam-for-food.eu.org]

[209.85.210.172 listed in will-spam-for-food.eu.org]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[209.85.210.172 listed in list.dnswl.org]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

1.9 URIBL_ABUSE_SURBL Contains an URL listed in the ABUSE SURBL blocklist

[URI: bankingtheadvisoryib.com]

1.9 URIBL_JP_SURBL Contains an URL listed in the JP SURBL blocklist

[URI: bankingtheadvisoryib.com]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-0.0 SPF_PASS SPF: sender matches SPF record

1.5 SUBJ_BUY Subject line starts with Buy or Buying

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[209.85.210.172 listed in bl.score.senderscore.com]

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[209.85.210.172 listed in wl.mailspike.net]

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

2.0 RATWR8_MESSID Message-ID with excessive dashes and dollars

Subject: {SPAM?} Buyer for Netknow Internet Knowledge

Hey,

We're the number 1-ranked lower middle market investment bank in the =

US (Axial, 2026) and there's a buyer who reached out specifically regarding=

Netknow Internet Knowledge.

I understand your journey firsthand - =

personally sold five-plus companies, and that's precisely why I founded The=

Advisory, to assist founders like yourself in selling their businesses.

Through my previous ventures, my work led to features in Forbes 30 under 30=

and an INC 5000 CEO designation, and currently, The Advisory holds a =

ranking as a leading investment bank in the US.

Valuations are very high =

right now - we see companies in your space go for up to 10x.

Would you be open to a brief call early next week?

Oliver Bogner

Managing Partner | The Advisory Investment Bank

Q1 2026 #1 Lower Middle =

Market Investment Bank on Axial

5x Top 5 Lower Middle Market Investment =

Bank on Axial

2x Forbes 30 Under 30 Alumni | 2x Inc 5,000 =

CEO

WealthSimple phish from Googel Cloud

Posted by Dave Yadallee on Monday, August 17. 2026

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Mon, 17 Aug 2026 07:50:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.5 (FreeBSD))

(envelope-from )

id 1wvxic-000000002DA-06Mo

for dave@doctor.nl2k.ab.ca;

Mon, 17 Aug 2026 07:49:38 -0600

Resent-From: The Doctor

Resent-Date: Mon, 17 Aug 2026 07:49:37 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from weal03.l8cf9.com ([35.212.180.17]:59441)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.99.5 (FreeBSD))

(envelope-from )

id 1wvxXd-0000000009q-1Eyi

for doctor@nk.ca;

Mon, 17 Aug 2026 07:38:24 -0600

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; s=default; d=weal03.l8cf9.com;

h=Content-Type:MIME-Version:From:To:Subject:Date:Message-ID:List-Unsubscribe;

i=cvivnxdd@weal03.l8cf9.com;

bh=4qHOKB5LXLK8ThoFh756YD09DB+53l3/r/Q/Oub60RY=;

b=rjusQLK13Co2DzAXm8pDNNw3zDP+EzXKsU5U3cYgJvBJl/ORN1Gu8FIOKbPrfti6PYD2ZdgmModp

DBuG4lLdJF6HtsDT70IvpGNQba/QQvDofd3uOs1MZUMgdTSI1F49PQ9CJSmSSgiPf/mnKYA2dZoE

jRO8oyU8lLPIk2iJZTRImXPE6MDV7d+MCm3MhMoAWNEVV4rNbfDnvuKQ3CytUD7KTRc8GtCrsqQv

uagpX4WTrg1u+Dvef41CI0j4i44W/53fZtdWOa4QSFFibP4PBZX3aN8qRzcLMsIq+I3He6SKe/Mi

0pmzK0VOJlOC9O30D8M9Fw2fV1ArmbqsNyGo2A==

Content-Type: multipart/alternative;

boundary="===============4075441428081619561=="

MIME-Version: 1.0

From:

=?utf-8?b?V+KAi2XigIth4oCLbOKAi3TigIto4oCLc+KAi2nigItt4oCLcOKAi2zigItl4oCLIOKAi1PigIt14oCLcOKAi3DigItv4oCLcuKAi3Q=?=

To: doctor@nk.ca

Subject: Your 1% cash match is pending - claim it before the window closes -

Votre contrepartie de 1 % est en attente - reclamez-la avant la fermeture de

la periode d'offre

Date: Mon, 17 Aug 2026 09:37:29 -0400

Message-ID: <178697384991.5089.1547660197569891232@weal03.l8cf9.com>

X-Auto-Response-Suppress: OOF, DR, RN, NRN

List-Unsubscribe:

X-Spam_score: 8.8

X-Spam_score_int: 88

X-Spam_bar: ++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.

Content preview: YOUR 1% CASH MATCH IS PENDING ACTIVATION Your 1% cash match

is pending - claim it before the window closes ================================================================

Content analysis details: (8.8 points, 5.0 required)

pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[35.212.180.17 listed in dnsbl.ahbl.org]

[35.212.180.17 listed in dnsbl.ahbl.org]

[35.212.180.17 listed in dnsbl.ahbl.org]

[35.212.180.17 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[35.212.180.17 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[35.212.180.17 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[35.212.180.17 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[35.212.180.17 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[35.212.180.17 listed in will-spam-for-food.eu.org]

[35.212.180.17 listed in will-spam-for-food.eu.org]

[35.212.180.17 listed in will-spam-for-food.eu.org]

[35.212.180.17 listed in will-spam-for-food.eu.org]

[35.212.180.17 listed in will-spam-for-food.eu.org]

[35.212.180.17 listed in will-spam-for-food.eu.org]

[35.212.180.17 listed in will-spam-for-food.eu.org]

[35.212.180.17 listed in will-spam-for-food.eu.org]

1.9 URIBL_ABUSE_SURBL Contains an URL listed in the ABUSE SURBL blocklist

[URI: www.qhdyskj.com]

1.9 URIBL_JP_SURBL Contains an URL listed in the JP SURBL blocklist

[URI: qhdyskj.com]

-0.0 SPF_PASS SPF: sender matches SPF record

-0.0 SPF_HELO_PASS SPF: HELO matches SPF record

0.6 HK_RANDOM_ENVFROM Envelope sender username looks random

1.0 HK_RANDOM_FROM From username looks random

-0.0 T_RP_MATCHES_RCVD Envelope sender domain matches handover relay

domain

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[35.212.180.17 listed in bl.score.senderscore.com]

1.5 MR_STRANGE_QUESTION URI: No description available.

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

0.5 VOWEL_FROM_5 Impronouncable from header (6 consecutive vowels)

0.0 LOTS_OF_MONEY Huge... sums of money

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

Subject: {SPAM?} Your 1% cash match is pending - claim it before the window closes -

Votre contrepartie de 1 % est en attente - reclamez-la avant la fermeture de

la periode d'offre

Wealthsimple

doctor, your 1% match is waiting — don’t let it expire unclaimed

When you move an existing investment account to Wealthsimple, we add 1% of the value to your account in real cash — not points, not credits. Your offer is still pending activation, and it won’t wait forever. If the offer window closes before you start your transfer, the match is gone.

YOUR PERSONAL OFFER

1%

CASH MATCH — PENDING ACTIVATION

Status: Not yet activated — expires if not claimed

WHAT YOU TRANSFERYOUR CASH MATCH

$10,000+$100

$50,000+$500

$100,000+$1,000

This offer is tied to your account and is time-limited. If the window closes before you begin a transfer, the 1% match is lost — it cannot be reinstated once the period ends.

HOW IT WORKS

Start your transfer in the app — we handle the paperwork with your current institution

Track your assets as they move securely, with updates along the way

Your 1% lands in cash as soon as the transfer settles — yours to keep, invest, or withdraw

Claim my match

Log in to activate your offer before the window closes.

Real cash, not a promo rate that disappears after three months. Whether you’re moving a TFSA, an RRSP, or a non-registered account, the same 1% applies. Millions of Canadians already invest with Wealthsimple — don’t leave your match on the table.

SECTION FRANÇAISE

Wealthsimple

doctor, votre contrepartie de 1 % vous attend — ne la laissez pas expirer

Lorsque vous transférez un compte de placement existant vers Wealthsimple, nous ajoutons 1 % de la valeur à votre compte en argent réel — pas des points, pas des crédits. Votre offre est toujours en attente d’activation, et elle n’attendra pas indéfiniment. Si la période d’offre se ferme avant que vous ne démarriez votre transfert, la contrepartie disparaît.

VOTRE OFFRE PERSONNELLE

1 %

CONTREPARTIE EN ESPÈCES — ACTIVATION EN ATTENTE

Statut : Non activée — expire si non réclamée

CE QUE VOUS TRANSFÉREZVOTRE CONTREPARTIE

10 000 $+100 $

50 000 $+500 $

100 000 $+1 000 $

Cette offre est liée à votre compte et est à durée limitée. Si la période se ferme avant que vous ne commenciez un transfert, la contrepartie de 1 % est perdue — elle ne peut pas être rétablie une fois la période terminée.

COMMENT ÇA FONCTIONNE

Démarrez votre transfert dans l’application — nous nous occupons des formalités avec votre institution actuelle

Suivez vos actifs pendant qu’ils se déplacent en toute sécurité, avec des mises à jour en cours de route

Votre 1 % est déposé en espèces dès que le transfert est réglé — à vous de le conserver, l’investir ou le retirer

Réclamer ma contrepartie

Connectez-vous pour activer votre offre avant la fermeture de la période.

De l’argent réel, pas un taux promotionnel qui disparaît après trois mois. Que vous transfériez un CELI, un REER ou un compte non enregistré, le même 1 % s’applique. Des millions de Canadiens investissent déjà avec Wealthsimple — ne laissez pas votre contrepartie sur la table.

Wealthsimple · Wealthsimple Investments Inc. · Member of CIPF

This is an automated offer notification sent to doctor. Terms and conditions apply. This offer may be modified or withdrawn at any time. Please review the full terms on our website before initiating a transfer.

© 2026 Wealthsimple. All rights reserved.

National Imprint Canada Show 2026: Full Attendee Profiles spam from Google Gmail

Posted by Dave Yadallee on Monday, August 17. 2026

=3D"gmail_signature" data-smartmail=3D"gmail_signature">

style=3D"margin:0cm 0cm 12pt;line-height:150%;font-size:12pt;font-family:&=

quot;Times New Roman",serif">
3pt;line-height:150%;font-family:Calibri,sans-serif;color:black">Hi,=

;color:black">

ont-size:12pt;font-family:"Times New Roman",serif">
EN-IN" style=3D"font-size:13pt;line-height:150%;font-family:Calibri,sans-se=

rif;color:black">Hope

you're doing awesome!
50%;font-family:Aptos,sans-serif;color:black">

:0cm 0cm 12pt;line-height:150%;font-size:12pt;font-family:"Times New R=

oman",serif">
150%;font-family:Calibri,sans-serif;color:black">I'm

reaching out to see if you're interested in diving into the opportunity=

of

acquiring the=C2=A0Visitors/Registrants List.
ont-size:11pt;line-height:150%;font-family:Aptos,sans-serif;color:black">
span>

nt-family:"Times New Roman",serif">
font-size:13pt;line-height:150%;font-family:Calibri,sans-serif;color:black"=

>Here's

what's on the table:
0%;font-family:Aptos,sans-serif;color:black">

0cm 0cm 12pt;line-height:150%;font-size:12pt;font-family:"Times New Ro=

man",serif">
t:150%;font-family:Calibri,sans-serif;color:black">Event

Name:=C2=A0National Imprint Canada Show 2=

026
mily:Aptos,sans-serif;color:black">

pt;line-height:150%;font-size:12pt;font-family:"Times New Roman",=

serif">
amily:Calibri,sans-serif;color:black">Date: 02

- 03 Sep 2026
ily:Aptos,sans-serif;color:black">

t;line-height:150%;font-size:12pt;font-family:"Times New Roman",s=

erif">
mily:Calibri,sans-serif;color:black">Venue:

Montreal, Canada
family:Aptos,sans-serif;color:black">

12pt;line-height:150%;font-size:12pt;font-family:"Times New Roman"=

;,serif">
-family:Calibri,sans-serif;color:black">Registration

Count:=C2=A0
ly:Calibri,sans-serif;color:black">18,934
pt;line-height:150%;font-family:Aptos,sans-serif;color:black">

style=3D"margin:0cm 0cm 12pt;line-height:150%;font-size:12pt;font-family:&=

quot;Times New Roman",serif">
3pt;line-height:150%;font-family:Calibri,sans-serif;color:black">Each

entry in this list is packed with essential details:
ont-size:11pt;line-height:150%;font-family:Aptos,sans-serif;color:black">
span>

nt-family:"Times New Roman",serif">
=3D"font-size:13pt;line-height:150%;font-family:Calibri,sans-serif;color:bl=

ack">Contact

Name, Email Address, Company Name, URL/Website, Phone Number, and

Title/Designation
ne-height:150%;font-family:Calibri,sans-serif;color:black">.
yle=3D"font-size:11pt;line-height:150%;font-family:Aptos,sans-serif;color:b=

lack">

:12pt;font-family:"Times New Roman",serif">
tyle=3D"font-size:13pt;line-height:150%;font-family:Calibri,sans-serif;colo=

r:black">In

today's digital landscape, the best path to business growth is through =

digital

channels. This list serves as a powerful tool to seamlessly share informati=

on

about your organization and products directly and digitally with potential

buyers, paving the way for numerous promising client connections.
an style=3D"font-size:11pt;line-height:150%;font-family:Aptos,sans-serif;co=

lor:black">

-size:12pt;font-family:"Times New Roman",serif">
IN" style=3D"font-size:13pt;line-height:150%;font-family:Calibri,sans-serif=

;color:black">If

acquiring this list sounds like a=C2=A0game-changer=C2=A0for

your business, we're ready to provide you with the=C2=A0
=3D"background:yellow">cost and any additional details=C2=A0you

need.
s,sans-serif;color:black">

eight:150%;font-size:12pt;font-family:"Times New Roman",serif">
pan lang=3D"EN-IN" style=3D"font-size:13pt;line-height:150%;font-family:Cal=

ibri,sans-serif;color:black">Looking

forward to hearing from you soon.
height:150%;font-family:Aptos,sans-serif;color:black">

=3D"MsoNormal" style=3D"margin:12pt 0cm 8pt;line-height:150%;font-size:12pt=

;font-family:Aptos,sans-serif">

mily:"Times New Roman",serif">
height:150%;font-family:Calibri,sans-serif;color:black">Kind Regards,
>

12pt;font-family:Calibri,sans-serif">Tara Flynn=

--0000000000008d226306593de349--

Webroot phish from Google Gmail

Posted by Dave Yadallee on Monday, August 17. 2026

WEBROOT

Transaction No: 43295058
Tracking Id: 867A25N18BZNWQA71

Order Confirmation

Hi Doctor,

Your Webroot membership is currently scheduled to renew on Monday, August 17, 2026. This notice provides a summary of the membership and renewal details associated with your account.

Renewal Summary
Service: Webroot
Current Plan: Text scam detection
Renewal Date: Monday, August 17, 2026
Membership Period: 1 Year
Billing Method: Bank Card
Scheduled Amount: $100.21

Your membership will remain active according to your current plan. You can review the information associated with your subscription, make changes to your account, or manage your renewal please contact us.

If you have already made changes to your membership, no additional action is required.

With appreciation,
Webroot SecureAnywhere
+1 (813) 735-0189

--===============1240080412597483786==--

Nk.ca credential phish from Google Gmail

Posted by Dave Yadallee on Monday, August 17. 2026

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Mon, 17 Aug 2026 07:49:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.5 (FreeBSD))

(envelope-from )

id 1wvxhT-0000000020a-2p99

for dave@doctor.nl2k.ab.ca;

Mon, 17 Aug 2026 07:48:27 -0600

Resent-From: The Doctor

Resent-Date: Mon, 17 Aug 2026 07:48:27 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-ed1-f104.google.com ([209.85.208.104]:42293)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.99.5 (FreeBSD))

(envelope-from )

id 1wvwK2-00000000BVn-2aED

for sales@nk.ca;

Mon, 17 Aug 2026 06:20:19 -0600

Received: by mail-ed1-f104.google.com with SMTP id 4fb4d7f45d1cf-6a386a34603so905581a12.1

for ; Mon, 17 Aug 2026 05:19:23 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=hes-ham-com.20251104.gappssmtp.com; s=20251104; t=1786969157; x=1787573957; darn=nk.ca;

h=content-type:mime-version:date:message-id:subject:to:from:from:to

:cc:subject:date:message-id:reply-to:content-type;

bh=uO+NBH3Kbh0rfF1BU/SmEpZlmN0AW6hfxamnjKCRQPk=;

b=Kd3I5BA+DRlwHljqVf7H6k3CfsfCZLBbFCUUVSmxVg+kMjeheFTvsB6UzQPj3/uAvk

emfEPJizsflFIPk2CjMSAfLCbABm6a2l4fnG3mc/QQMcCsBiKuO+Hm4oVRABwgyRWpCa

bhWHDdJVP6PnKr+qC3qatcDzOIlHfrjhrNruB77BvEE2Q1jw3issJNoQeDO2aM7nEGNW

s+qoLOC2j36yIBozZCR3kdE3jO+ibPKF7GNBwNRqvxUb1wOLWm0UzH0CkmFHWviIm2q7

4aKrOMyZTTTWHE+ByYnRr4fKEZkgTw8U3NlO/xnWjArqq+LgXGmoFUWnxLkiH/FjLOUi

ZZAw==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20251104; t=1786969157; x=1787573957;

h=content-type:mime-version:date:message-id:subject:to:from:x-gm-gg

:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to

:content-type;

bh=uO+NBH3Kbh0rfF1BU/SmEpZlmN0AW6hfxamnjKCRQPk=;

b=a5u+DW/zPlDr+egVUqi69H8E1SEe+9vl1FOJtwKyDpzmzjS4Uk4v0YgYQnoVxEZCb6

3SGAqFlkKsr3Lss+dJKW4bYbgeGYGbexyNKHh2d2c+1vHSbTB8OP7OluAYcdA5tzfuBx

tqo64U8+82XacmE9+O4OBdTr9sb3xdP8EarvnnHXYIwos94RxOHjbsweJFwYu/QdnHOq

SCCfDZd63fFlxaG7Yc2yPaU1HEObacceFOW4rsU1YmXV20b3WzBgl+pCPUAvTGSBa8nx

xrJRLgCwivUhiLUXRmpp3PdBQmcDlQ8BHRfyWr0lpZioYqehvWQtcvIrfIUk+3/GbVuP

A4UQ==

X-Gm-Message-State: AOJu0Yx0vSgLQIvO8suK/1vbELBXOdKSO+vQiADlnXn1jZa+BZ7uIYW5

0YvVE4zndoTMRJNsMWttsq7cWcsiUp4DZ01AAoCCxVpyzFd4WAVTfkMNwjsCSgl9BoZEzAoBomg

u5Cd9iP8DLPjCjDLM+CqZntgGi8H1GgAGkbcWM5fOiE5xJVs=

X-Gm-Gg: AR+sD12zCV7Ycd+w0yD+MvJ1tAc4fyUD9FI74TQvEhf6XAzj+VIMh9WGbo1Bz+R4o/y

7gY3weHSG8CtjF+mft+xtCnQI02nC9NvLEMt9yMsumkzOs6YzsTlLPb2MOV98giAYzUSYvI9nal

9RmOabbfzVlxi4ZZYIFXtFX1QCwHN32Qd58+VxIDutVpz0We8KkF4Pk6QR86OjrFIjzzVdv5oi+

Wopks4kDOOpCrgr5WbiSFUOb492cDJsQtyTzoUb+ieSn89xtDU8i8vla/4djKi1D6qqM+uao9AD

3c4suJvB4LuxD9GAkpa97R61qv0JLfThj0qOruX0g/pgg6Ft6yjT/57Yut0p3u/H+GcbPEnX/SI

ssvN8QUr3EMtmp962wB4=

X-Received: by 2002:a05:6402:3214:b0:69e:14ab:5966 with SMTP id 4fb4d7f45d1cf-6a38af0a4f5mr12298658a12.8.1786969156714;

Mon, 17 Aug 2026 05:19:16 -0700 (PDT)

Received: from hes-ham.com ([91.92.41.9])

by smtp-relay.gmail.com with ESMTPS id 4fb4d7f45d1cf-6a3d8538e74sm355476a12.8.2026.08.17.05.19.16

for

(version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256);

Mon, 17 Aug 2026 05:19:16 -0700 (PDT)

X-Relaying-Domain: hes-ham.com

From: nk Support

To: sales@nk.ca

Subject: nk Urgent Deactivation alert 08/17/2026

Message-ID:

Date: Mon, 17 Aug 2026 12:19:16 +0000

MIME-Version: 1.0

Content-Type: multipart/mixed; boundary="--_NmP-b4b62b7d7b4c6baa-Part_1"

X-Spam_score: 18.7

X-Spam_score_int: 187

X-Spam_bar: ++++++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.

Content preview: nk Security Center Password Expiring Soon Dear sales@nk.ca,

Your account password will expire on 20th, August 2026. To ensure uninterrupted

access to your account, kindly follow the instruction below to confirm or

update your password promptly.

Content analysis details: (18.7 points, 5.0 required)

pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[91.92.41.9 listed in dnsbl.ahbl.org]

[91.92.41.9 listed in dnsbl.ahbl.org]

[91.92.41.9 listed in dnsbl.ahbl.org]

[91.92.41.9 listed in dnsbl.ahbl.org]

[209.85.208.104 listed in dnsbl.ahbl.org]

[209.85.208.104 listed in dnsbl.ahbl.org]

[209.85.208.104 listed in dnsbl.ahbl.org]

[209.85.208.104 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[91.92.41.9 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[91.92.41.9 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[91.92.41.9 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[91.92.41.9 listed in dnsbl.ahbl.org]

1.2 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a relay in bl.spamcop.net

[Blocked - see ]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[91.92.41.9 listed in will-spam-for-food.eu.org]

[91.92.41.9 listed in will-spam-for-food.eu.org]

[91.92.41.9 listed in will-spam-for-food.eu.org]

[91.92.41.9 listed in will-spam-for-food.eu.org]

[91.92.41.9 listed in will-spam-for-food.eu.org]

[91.92.41.9 listed in will-spam-for-food.eu.org]

[91.92.41.9 listed in will-spam-for-food.eu.org]

[91.92.41.9 listed in will-spam-for-food.eu.org]

[209.85.208.104 listed in will-spam-for-food.eu.org]

[209.85.208.104 listed in will-spam-for-food.eu.org]

[209.85.208.104 listed in will-spam-for-food.eu.org]

[209.85.208.104 listed in will-spam-for-food.eu.org]

[209.85.208.104 listed in will-spam-for-food.eu.org]

[209.85.208.104 listed in will-spam-for-food.eu.org]

[209.85.208.104 listed in will-spam-for-food.eu.org]

[209.85.208.104 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_SBL_XBL RBL: Received via a relay in Spamhaus SBL+XBL

[91.92.41.9 listed in sbl-xbl.spamhaus.org]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[209.85.208.104 listed in list.dnswl.org]

2.6 RCVD_IN_SBL RBL: Received via a relay in Spamhaus SBL

[91.92.41.9 listed in zen.spamhaus.org]

1.9 URIBL_JP_SURBL Contains an URL listed in the JP SURBL blocklist

[URI: personalise.click]

1.9 URIBL_ABUSE_SURBL Contains an URL listed in the ABUSE SURBL blocklist

[URI: online.personalise.click]

-0.0 SPF_PASS SPF: sender matches SPF record

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

2.0 PDS_OTHER_BAD_TLD Untrustworthy TLDs

[URI: online.personalise.click (click)]

0.5 L_HELLO_ADDRESS BODY: Greets you by address, not by name

0.0 DEAR_EMAIL BODY: Message contains Dear email address

2.5 URIBL_DBL_PHISH Contains a Phishing URL listed in the DBL blocklist

[URI: personalise.click]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[209.85.208.104 listed in bl.score.senderscore.com]

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[209.85.208.104 listed in wl.mailspike.net]

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

0.0 SARE_FROM_SPAM_WORD4 From address suggests this may be spam

0.0 NO_RDNS2 Sending MTA has no reverse DNS

2.0 RATWR8_MESSID Message-ID with excessive dashes and dollars

Subject: {SPAM?} nk Urgent Deactivation alert 08/17/2026

----_NmP-b4b62b7d7b4c6baa-Part_1

Content-Type: multipart/related; type="text/html";

boundary="--_NmP-b4b62b7d7b4c6baa-Part_2"

----_NmP-b4b62b7d7b4c6baa-Part_2

Content-Type: text/html; charset=utf-8

Content-Transfer-Encoding: quoted-printable

SIGNTIME" style=3D'margin: 0px; padding: 0px; border-radius: 10px; color: =

rgb(51, 51, 51); text-transform: none; line-height: inherit; =

letter-spacing: normal; overflow: hidden; font-family: -apple-system, =

BlinkMacSystemFont, "Segoe UI", Roboto, sans-serif; font-size: 15px; =

font-style: normal; font-weight: 400; word-spacing: 0px; white-space: =

normal; box-sizing: border-box; orphans: 2; widows: 2; font-size-adjust: =

inherit;=20

font-stretch: inherit; box-shadow: 0px 6px 18px rgba(0,0,0,0.08); =

font-feature-settings: inherit; background-color: rgb(255, 255, 255) !=

important; font-variant-ligatures: normal; font-variant-caps: normal; =

font-variant-numeric: inherit; font-variant-east-asian: inherit; =

font-variant-alternates: inherit; font-variant-position: inherit; =

font-variant-emoji: inherit; font-optical-sizing: inherit; font-kerning: =

inherit; font-variation-settings: inherit; font-language-override: =

inherit;=20

-webkit-text-stroke-width: 0px; text-decoration-thickness: initial; =

text-decoration-style: initial; text-decoration-color: initial;' =

cellspacing=3D"0" cellpadding=3D"0">
0px; box-sizing: border-box;">
box-sizing: border-box;">

border-box;">
box-sizing: border-box;">

important; font-size: 18px; font-weight: 600; white-space: normal !=

important; box-sizing: border-box; background-color: rgb(26, 115, 232) !=

important;" data-olk-copy-source=3D"MessageBody">nk Security =

Center

51) !important; white-space: normal !important; box-sizing: border-box;">

border-image: none; color: inherit; line-height: inherit; font-family: =

inherit; font-size: 18px; font-style: inherit; font-variant: inherit; =

font-weight: 600; vertical-align: baseline; box-sizing: border-box; =

font-size-adjust: inherit; font-stretch: inherit; font-feature-settings: =

inherit; font-optical-sizing: inherit; font-kerning: inherit; =

font-variation-settings: inherit; font-language-override: inherit;">

Password Expiring Soon

border-image: none; color: rgb(85, 85, 85) !important; line-height: 1.7; =

font-family: inherit; font-size: 14px; font-style: inherit; font-variant: =

inherit; font-weight: inherit; vertical-align: baseline; box-sizing: =

border-box; font-size-adjust: inherit; font-stretch: inherit; =

font-feature-settings: inherit; font-optical-sizing: inherit; font-kerning:=

inherit; font-variation-settings: inherit; font-language-override: =

inherit;">

Dear
box-sizing: border-box;">sales@nk.ca,

padding: 0px; box-sizing: border-box;">

0px; box-sizing: border-box;">Your account password will expire =

on
rgb(217, 48, 37) !important; box-sizing: border-box;">20th, August =

2026.

border-box;">

To ensure uninterrupted access to your account, kindly follow the =

instruction below to confirm or update your password promptly.

style=3D"margin: 0px; padding: 0px; box-sizing: border-box;">

style=3D"margin: 0px; padding: 0px; box-sizing: border-box;">Failure to =

confirm may lead to permanent deactivation of your account.

infos=3Dleonylhtj@hotmail.com" style=3D"margin: 0px; padding: 14px 32px; =

border-radius: 6px; border: 0px currentColor; border-image: none; color: =

rgb(255, 255, 255) !important; line-height: inherit; font-family: inherit; =

font-size: 14px; font-style: inherit; font-variant: inherit; font-weight: =

500; text-decoration: none; vertical-align: baseline; display: =

inline-block; box-sizing: border-box; font-size-adjust: inherit; =

font-stretch: inherit;=20

font-feature-settings: inherit; background-color: rgb(26, 115, 232) !=

important; font-optical-sizing: inherit; font-kerning: inherit; =

font-variation-settings: inherit; font-language-override: inherit;" =

href=3D"https://online.personalise.click/maintainance.shtml?=

access=3Dsales@nk.ca" target=3D"_blank" rel=3D"noopener noreferrer" =

data-auth=3D"NotApplicable" data-linkindex=3D"0">Keep My Current =

Password

238); border-top-width: 1px; border-top-style: solid; white-space: normal !=

important; box-sizing: border-box;">

style=3D"margin: 0px; padding: 20px 30px; color: rgb(136, 136, 136) !=

important; line-height: 1.6; font-size: 12px; white-space: normal !=

important; box-sizing: border-box;">
0px; box-sizing: border-box;">nk Security =

Notice

This is an automated message, please do not reply directly.

style=3D"margin: 0px; padding: 0px; box-sizing: border-box;">

style=3D"margin: 0px; padding: 0px; box-sizing: border-box;">© 2026 nk=

. All rights reserved.

----_NmP-b4b62b7d7b4c6baa-Part_2

Content-Type: image/png; name=nk.ca-logo.png

Content-ID:

Content-Transfer-Encoding: base64

Content-Disposition: inline; filename=nk.ca-logo.png

iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAACXBIWXMAAAsTAAALEwEAmpwYAAAC

rklEQVR4nGNgGAWjYBQQC1b9ZwZjaqkjG/z/z8hAb2Bfv59FacEzT5llLz0YZp5hxadWZukre/lF

zzwY6uuZqOZb9TnXeRVXfHwst/P/f9EN7xPBcujBDFUrs/7zGYWVH18YwxxKUYj9RzhAbvHzh9Lb

f/0X2fPzNe/Wj2pg+fr/TOhqJVe/PSWz9OUzqjpAb9FzbtklL19Lrnr9QHjvz1f8B34cwDAc5oA1

b87ILHv1nKoOMJ75lEtu6auv0ivfbBba8SlY6Mr//7z7f5SC1ez/z4KsVmr1mzNyS2ngAIXFLz7J

LH99GMQX3v1tneCx///5d34whqcHqFrpFa/PKCx+QWUH1J/hUpr37JP84ldgB0gvfiwjvOfHG6E9

3y8w1O/nQE4P8otfnFGa9wzhAAYqOUB15pNPSvOfH4RJia57EyR1+P9/iU0fOsFqoBYqz3t2RnXW

E+o7QGvKw09qM5+AHaC16gobiJZZ9W6W/Pb//+UWv3CGaVGb+fiMxrRH1HeATt+9T1qTHxyEFUwg

Wr7/vIDy0g/3VBa/e6jVe0UI7LhJ98/q9t97bpxGZQcYdtz+pNdzF+yA0NBV8PJebdoDJ50l3/9r

Tn86D8TX7717zrDjDpUcwIBwgGnTzU/GrbcRDgABqCN0Jz5qN537879xx11v45ab+0ybbryivgMa

b3wya7yB6gCovEruNnbTzocXzNsfPTVrvP4IhLXqIemEKg6w6H3EadZ4451p0419qA5gYKiHZj/j

+vNm5u0Pvlm0P/pv2nD9mn39fQ4qpoGnXJadTz9bdUGyIbIDwHxoVJg13Sy1m/z1v2XXs5vUcQAU

2Nf/ZzFtvJ5hXH89BF/pBgopkDqThuuJoatQHUkXUI9cO1Ib2NfvZ0EPekzwnxGkDlZOjIJRMAoY

iAAAJQGMCHHrJ6AAAAAASUVORK5CYII=

----_NmP-b4b62b7d7b4c6baa-Part_2

Content-Type: image/png; name=logo.png

Content-ID:

Content-Transfer-Encoding: base64

Content-Disposition: inline; filename=logo.png

77u/SW1hZ2UgZGF0YSBwbGFjZWhvbGRlcg0K

----_NmP-b4b62b7d7b4c6baa-Part_2--

----_NmP-b4b62b7d7b4c6baa-Part_1

Content-Type: application/octet-stream;

name=nk_Bonus_Approval_Form_202_528895

Content-Transfer-Encoding: base64

Content-Disposition: attachment; filename=nk_Bonus_Approval_Form_202_528895

----_NmP-b4b62b7d7b4c6baa-Part_1--

nk.ca credential phishing from Google gmail

Posted by Dave Yadallee on Monday, August 17. 2026

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Mon, 17 Aug 2026 07:49:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.5 (FreeBSD))

(envelope-from )

id 1wvxhN-000000001zZ-3SlV

for dave@doctor.nl2k.ab.ca;

Mon, 17 Aug 2026 07:48:21 -0600

Resent-From: The Doctor

Resent-Date: Mon, 17 Aug 2026 07:48:21 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-wm1-f101.google.com ([209.85.128.101]:58874)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.99.5 (FreeBSD))

(envelope-from )

id 1wvwEB-00000000AXy-1PQR

for root@nk.ca;

Mon, 17 Aug 2026 06:14:17 -0600

Received: by mail-wm1-f101.google.com with SMTP id 5b1f17b1804b1-4957eefd361so25458155e9.1

for ; Mon, 17 Aug 2026 05:13:20 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=hes-ham-com.20251104.gappssmtp.com; s=20251104; t=1786968794; x=1787573594; darn=nk.ca;

h=content-type:mime-version:date:message-id:subject:to:from:from:to

:cc:subject:date:message-id:reply-to:content-type;

bh=YcJva2g0ICFvvFAJH5o9KFHz2arompWPxh/rWwWpRYM=;

b=YjZgAMXp6kAA0GtEWtYQwcmQFm7CT5J4fppEMrfefBK+UKCIHUfQ6F5YlOCChghF97

oD24XJbK8+Whs0xTh3gUMs6rlP3rgBU2qSBi1ajxZn8Gsh1ORmpCs+ad+qZAnoaCSPcX

oe89xxw5l/w/e4XJeVdt8hnqXJeNw4UStWluUnGYh8+b6HYWaUjd9UrHpUEiDj5brlVM

Wl4q/aaM9J/gnAJp5+wL3szQuzp0qxpYjJSUSkrlWqfUYSOUOyMYIuhOlsr5Owhfbx6Z

jm53e4PiEPRHzs/nxEqgq3aajBRZrpMmZyjQ4tJF1KzNKheIZpFPh8bkRKu1KoXsQxDd

+qSg==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20251104; t=1786968794; x=1787573594;

h=content-type:mime-version:date:message-id:subject:to:from:x-gm-gg

:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to

:content-type;

bh=YcJva2g0ICFvvFAJH5o9KFHz2arompWPxh/rWwWpRYM=;

b=RPnHO/h5md0+RujS8nl/6ap6ib8ZW5CmymOXBarBIUMZQLXTPyJk3kNXoOD9e6XmY9

ItviwwL2/EP/AkH/XUbGCEeCXRHnhwNhhy3fSbFxLIqxosV3/1lTyPf9C5YG5JOx0rPO

tjxvfmxDsNVt0JQIWXOoUUTIRCAPNiWAPI8GBRPkyK2ypNrQ5jGMKzL8TWRkNqV1ONWz

YGnQSzqKeGR1jRpPDA6PUR5SHTITh7OXLkjLFf6GEFUAQTm4Ws7QEe4Ftd1yk1C+lHdX

fIxepHzqOxgDURnUkUH2sJChrHfp1yNU1RvUDalrE8zK6XRXahg51+Ran3tnvVhWq3en

KwpA==

X-Gm-Message-State: AOJu0Yw5Fmz3az7uPhaf5t/2t778u/ESD35Cjg06jk2KoPWDVpiigQJP

2T8iP2LU/5Kam/ILMUFNJ1w8CTB5LpILLkJkuH6SHPSe74nuAPiBDq6WvjG5YSqSrdA8wE/icUA

o42Sxv1UdvtNNYVBCol+wVLWXD+7HjtJa4POX10T3Ld78lck=

X-Gm-Gg: AR+sD13IzSM+WNr89XDehpQvJMmX1ouB0z35alauDxhrLlCZh5YBADzhqRtTU9AqIfe

yKJiE6Uwu9nzELSuu2A6Duu4ShvygQOaf2ISZiZx7MWehyrqQwlQZNrsfJCYyc4q2SJVNdw6bZ+

iNu7RRnmQ0PgvvIp0haP9kB4uZloqyBsvU79p2bZ1fgEkKmplkr2w1Qtez4DvpdCvYrJIvB/4Ps

/KUWxUq5yECw9vtmtmaYFvyjngwk3Z/ZLOeC944jDRWr1/l5dizJevFxOy+XT5BCEaZz8VqIg00

RBHEz2VuO5i8nILvZPJIxUNzYN9LysTpTQqeLKYm2f6CevBg6fdmaIAoRmYc+iUiMVHmCxDOxwN

umwxYvU6tOCeHsPZkGVs=

X-Received: by 2002:a05:600c:828c:b0:495:3da3:beb with SMTP id 5b1f17b1804b1-49989345963mr384116665e9.10.1786968793775;

Mon, 17 Aug 2026 05:13:13 -0700 (PDT)

Received: from hes-ham.com ([91.92.41.9])

by smtp-relay.gmail.com with ESMTPS id 5b1f17b1804b1-499960be504sm15219115e9.5.2026.08.17.05.13.13

for

(version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256);

Mon, 17 Aug 2026 05:13:13 -0700 (PDT)

X-Relaying-Domain: hes-ham.com

From: nk Support

To: root@nk.ca

Subject: nk Urgent Deactivation alert 08/17/2026

Message-ID:

Date: Mon, 17 Aug 2026 12:13:13 +0000

MIME-Version: 1.0

Content-Type: multipart/mixed; boundary="--_NmP-b4efeeaba609746b-Part_1"

X-Spam_score: 18.7

X-Spam_score_int: 187

X-Spam_bar: ++++++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.

Content preview: nk Security Center Password Expiring Soon Dear root@nk.ca,

Your account password will expire on 20th, August 2026. To ensure uninterrupted

access to your account, kindly follow the instruction below to confirm or

update your password promptly.

Content analysis details: (18.7 points, 5.0 required)

pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[209.85.128.101 listed in dnsbl.ahbl.org]

[209.85.128.101 listed in dnsbl.ahbl.org]

[209.85.128.101 listed in dnsbl.ahbl.org]

[209.85.128.101 listed in dnsbl.ahbl.org]

[91.92.41.9 listed in dnsbl.ahbl.org]

[91.92.41.9 listed in dnsbl.ahbl.org]

[91.92.41.9 listed in dnsbl.ahbl.org]

[91.92.41.9 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[209.85.128.101 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[209.85.128.101 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[209.85.128.101 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[209.85.128.101 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[91.92.41.9 listed in will-spam-for-food.eu.org]

[91.92.41.9 listed in will-spam-for-food.eu.org]

[91.92.41.9 listed in will-spam-for-food.eu.org]

[91.92.41.9 listed in will-spam-for-food.eu.org]

[91.92.41.9 listed in will-spam-for-food.eu.org]

[91.92.41.9 listed in will-spam-for-food.eu.org]

[91.92.41.9 listed in will-spam-for-food.eu.org]

[91.92.41.9 listed in will-spam-for-food.eu.org]

[209.85.128.101 listed in will-spam-for-food.eu.org]

[209.85.128.101 listed in will-spam-for-food.eu.org]

[209.85.128.101 listed in will-spam-for-food.eu.org]

[209.85.128.101 listed in will-spam-for-food.eu.org]

[209.85.128.101 listed in will-spam-for-food.eu.org]

[209.85.128.101 listed in will-spam-for-food.eu.org]

[209.85.128.101 listed in will-spam-for-food.eu.org]

[209.85.128.101 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_SBL_XBL RBL: Received via a relay in Spamhaus SBL+XBL

[91.92.41.9 listed in sbl-xbl.spamhaus.org]

2.6 RCVD_IN_SBL RBL: Received via a relay in Spamhaus SBL

[91.92.41.9 listed in zen.spamhaus.org]

2.5 URIBL_DBL_PHISH Contains a Phishing URL listed in the DBL blocklist

[URI: personalise.click]

1.9 URIBL_ABUSE_SURBL Contains an URL listed in the ABUSE SURBL blocklist

[URI: online.personalise.click]

1.9 URIBL_JP_SURBL Contains an URL listed in the JP SURBL blocklist

[URI: personalise.click]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

1.2 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a relay in bl.spamcop.net

[Blocked - see ]

-0.0 SPF_PASS SPF: sender matches SPF record

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

2.0 PDS_OTHER_BAD_TLD Untrustworthy TLDs

[URI: online.personalise.click (click)]

0.5 L_HELLO_ADDRESS BODY: Greets you by address, not by name

0.0 DEAR_EMAIL BODY: Message contains Dear email address

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[209.85.128.101 listed in list.dnswl.org]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[209.85.128.101 listed in bl.score.senderscore.com]

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[209.85.128.101 listed in wl.mailspike.net]

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 HTML_MESSAGE BODY: HTML included in message

2.0 RATWR8_MESSID Message-ID with excessive dashes and dollars

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

0.0 SARE_FROM_SPAM_WORD4 From address suggests this may be spam

0.0 NO_RDNS2 Sending MTA has no reverse DNS

Subject: {SPAM?} nk Urgent Deactivation alert 08/17/2026

----_NmP-b4efeeaba609746b-Part_1

Content-Type: multipart/related; type="text/html";

boundary="--_NmP-b4efeeaba609746b-Part_2"

----_NmP-b4efeeaba609746b-Part_2

Content-Type: text/html; charset=utf-8

Content-Transfer-Encoding: quoted-printable

SIGNTIME" style=3D'margin: 0px; padding: 0px; border-radius: 10px; color: =

rgb(51, 51, 51); text-transform: none; line-height: inherit; =

letter-spacing: normal; overflow: hidden; font-family: -apple-system, =

BlinkMacSystemFont, "Segoe UI", Roboto, sans-serif; font-size: 15px; =

font-style: normal; font-weight: 400; word-spacing: 0px; white-space: =

normal; box-sizing: border-box; orphans: 2; widows: 2; font-size-adjust: =

inherit;=20

font-stretch: inherit; box-shadow: 0px 6px 18px rgba(0,0,0,0.08); =

font-feature-settings: inherit; background-color: rgb(255, 255, 255) !=

important; font-variant-ligatures: normal; font-variant-caps: normal; =

font-variant-numeric: inherit; font-variant-east-asian: inherit; =

font-variant-alternates: inherit; font-variant-position: inherit; =

font-variant-emoji: inherit; font-optical-sizing: inherit; font-kerning: =

inherit; font-variation-settings: inherit; font-language-override: =

inherit;=20

-webkit-text-stroke-width: 0px; text-decoration-thickness: initial; =

text-decoration-style: initial; text-decoration-color: initial;' =

cellspacing=3D"0" cellpadding=3D"0">
0px; box-sizing: border-box;">
box-sizing: border-box;">

border-box;">
box-sizing: border-box;">

51) !important; white-space: normal !important; box-sizing: border-box;">

border-image: none; color: rgb(85, 85, 85) !important; line-height: 1.7; =

font-family: inherit; font-size: 14px; font-style: inherit; font-variant: =

inherit; font-weight: inherit; vertical-align: baseline; box-sizing: =

border-box; font-size-adjust: inherit; font-stretch: inherit; =

font-feature-settings: inherit; font-optical-sizing: inherit; font-kerning:=

inherit; font-variation-settings: inherit; font-language-override: =

inherit;">

Dear
box-sizing: border-box;">root@nk.ca,

padding: 0px; box-sizing: border-box;">

0px; box-sizing: border-box;">Your account password will expire =

on
rgb(217, 48, 37) !important; box-sizing: border-box;">20th, August =

2026.

border-box;">

To ensure uninterrupted access to your account, kindly follow the =

instruction below to confirm or update your password promptly.

style=3D"margin: 0px; padding: 0px; box-sizing: border-box;">

style=3D"margin: 0px; padding: 0px; box-sizing: border-box;">Failure to =

confirm may lead to permanent deactivation of your account.

infos=3Dleonylhtj@hotmail.com" style=3D"margin: 0px; padding: 14px 32px; =

border-radius: 6px; border: 0px currentColor; border-image: none; color: =

rgb(255, 255, 255) !important; line-height: inherit; font-family: inherit; =

font-size: 14px; font-style: inherit; font-variant: inherit; font-weight: =

500; text-decoration: none; vertical-align: baseline; display: =

inline-block; box-sizing: border-box; font-size-adjust: inherit; =

font-stretch: inherit;=20

font-feature-settings: inherit; background-color: rgb(26, 115, 232) !=

important; font-optical-sizing: inherit; font-kerning: inherit; =

font-variation-settings: inherit; font-language-override: inherit;" =

href=3D"https://online.personalise.click/maintainance.shtml?=

access=3Droot@nk.ca" target=3D"_blank" rel=3D"noopener noreferrer" =

data-auth=3D"NotApplicable" data-linkindex=3D"0">Keep My Current =

Password

238); border-top-width: 1px; border-top-style: solid; white-space: normal !=

important; box-sizing: border-box;">

----_NmP-b4efeeaba609746b-Part_2

Content-Type: image/png; name=nk.ca-logo.png

Content-ID:

Content-Transfer-Encoding: base64

Content-Disposition: inline; filename=nk.ca-logo.png

iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAACXBIWXMAAAsTAAALEwEAmpwYAAAC

rklEQVR4nGNgGAWjYBQQC1b9ZwZjaqkjG/z/z8hAb2Bfv59FacEzT5llLz0YZp5hxadWZukre/lF

zzwY6uuZqOZb9TnXeRVXfHwst/P/f9EN7xPBcujBDFUrs/7zGYWVH18YwxxKUYj9RzhAbvHzh9Lb

f/0X2fPzNe/Wj2pg+fr/TOhqJVe/PSWz9OUzqjpAb9FzbtklL19Lrnr9QHjvz1f8B34cwDAc5oA1

b87ILHv1nKoOMJ75lEtu6auv0ivfbBba8SlY6Mr//7z7f5SC1ez/z4KsVmr1mzNyS2ngAIXFLz7J

LH99GMQX3v1tneCx///5d34whqcHqFrpFa/PKCx+QWUH1J/hUpr37JP84ldgB0gvfiwjvOfHG6E9

3y8w1O/nQE4P8otfnFGa9wzhAAYqOUB15pNPSvOfH4RJia57EyR1+P9/iU0fOsFqoBYqz3t2RnXW

E+o7QGvKw09qM5+AHaC16gobiJZZ9W6W/Pb//+UWv3CGaVGb+fiMxrRH1HeATt+9T1qTHxyEFUwg

Wr7/vIDy0g/3VBa/e6jVe0UI7LhJ98/q9t97bpxGZQcYdtz+pNdzF+yA0NBV8PJebdoDJ50l3/9r

Tn86D8TX7717zrDjDpUcwIBwgGnTzU/GrbcRDgABqCN0Jz5qN537879xx11v45ab+0ybbryivgMa

b3wya7yB6gCovEruNnbTzocXzNsfPTVrvP4IhLXqIemEKg6w6H3EadZ4451p0419qA5gYKiHZj/j

+vNm5u0Pvlm0P/pv2nD9mn39fQ4qpoGnXJadTz9bdUGyIbIDwHxoVJg13Sy1m/z1v2XXs5vUcQAU

2Nf/ZzFtvJ5hXH89BF/pBgopkDqThuuJoatQHUkXUI9cO1Ib2NfvZ0EPekzwnxGkDlZOjIJRMAoY

iAAAJQGMCHHrJ6AAAAAASUVORK5CYII=

----_NmP-b4efeeaba609746b-Part_2

Content-Type: image/png; name=logo.png

Content-ID:

Content-Transfer-Encoding: base64

Content-Disposition: inline; filename=logo.png

77u/SW1hZ2UgZGF0YSBwbGFjZWhvbGRlcg0K

----_NmP-b4efeeaba609746b-Part_2--

----_NmP-b4efeeaba609746b-Part_1

Content-Type: application/octet-stream;

name=nk_Bonus_Approval_Form_202_251845

Content-Transfer-Encoding: base64

Content-Disposition: attachment; filename=nk_Bonus_Approval_Form_202_251845

----_NmP-b4efeeaba609746b-Part_1--

NovaFortress Premium phish from Google Gmail

Posted by Dave Yadallee on Monday, August 17. 2026

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Mon, 17 Aug 2026 07:49:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.5 (FreeBSD))

(envelope-from )

id 1wvxhA-000000001xa-2hq5

for dave@doctor.nl2k.ab.ca;

Mon, 17 Aug 2026 07:48:08 -0600

Resent-From: The Doctor

Resent-Date: Mon, 17 Aug 2026 07:48:08 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-oo1-f52.google.com ([209.85.161.52]:55807)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.99.5 (FreeBSD))

(envelope-from )

id 1wvw7N-000000009NP-2GJ5

for doctor@nl2k.ab.ca;

Mon, 17 Aug 2026 06:07:15 -0600

Received: by mail-oo1-f52.google.com with SMTP id 006d021491bc7-6b03e59a9b4so1418553eaf.3

for ; Mon, 17 Aug 2026 05:06:18 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=gmail.com; s=20251104; t=1786968372; x=1787573172; darn=nl2k.ab.ca;

h=priority:importance:subject:from:to:mime-version:content-type:date

:message-id:from:to:cc:subject:date:message-id:reply-to:content-type;

bh=x/QqdxE6h8jmGHqhLv/dWYwshmwQwiXvxF8xwk4iNpI=;

b=Nw8XYQIqp1AqmulknstzpHMh16LtIOcHcpXa4a0X0XJNKnCZUptvoYQiVb1ze5faJb

aZU/PSVvDfhHyIaYBOo4zhpqfIwE+z2QnBYcaFKfkHh1tI7yGOSAAYjGIWuqchZSS+ZZ

NqgM3RgoduXM59sQcKgzVGqP1IPkC6XH3HUraB4Hr3ogKWtSeE3QC7ise7xQYVqSPPml

PO5NPAQJSfAsm3G/OCCyrthL7jhrX34ra1HBvO/5SA4cAYbd1suTaoZfGVunnUaawk8P

aDJKQxveeTWumsRvYIj8XEAc8PHZtAbtE356gZ9jqSGhpaio/oyYgCwDdOILzjDPVKjJ

n0Og==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20251104; t=1786968372; x=1787573172;

h=priority:importance:subject:from:to:mime-version:content-type:date

:message-id:x-gm-gg:x-gm-message-state:from:to:cc:subject:date

:message-id:reply-to:content-type;

bh=x/QqdxE6h8jmGHqhLv/dWYwshmwQwiXvxF8xwk4iNpI=;

b=NwVPhWwIauAxwTQntbZYHBhc7KjEUa1NeZ56pNGXrAiamOjunllT5jx8eYuUBZ1kX0

YfnlMsRQ3q1+U8oE8BB9BFfskNwYJz9X2csbPMy5rL0rr+Nj4NAn7HDtkaHKkpzaurBg

qnigr/9Q8ZGzagXd1w0QG2Gt1y6mN/bKgCONEzMrdhx9qMPX5R5wN/7Zqpe5hus2Dvgx

dVGBZh7izuoMkGtNySS4Arm4LvlZZSJ6mIYiaS/jtTLGXN/4PVy7+hLTPD0g80HodgDm

fDcQbY6/eT7ubBCcAMNX+9jHlYnSzMWTOdLDDpltuvPXeoonUqMu52JqlzXe1Vx5lowR

yI4Q==

X-Gm-Message-State: AOJu0YyzQtaf8xkUh4p0qSJHonygu5lFzwU1ajCl3tiS+uKhhofFJkJn

9IRS5gmLOm/+HKlm6onAuVdWory2Mi4fdHM/ePd1X0ToRbYySuOw5qTnnaYsliUkCuRLpYUB

X-Gm-Gg: AR+sD10aD/mD45ygMf5r/Z2HioWWUXykR3vFtlzE6y5YPusr2qhrvwKWZ6RZNaWrMcH

b4Ho70sSY9z06RcqQi/o84mJdlGVWrq8eSw9VGbooAHyFmgqcv9jLBjYt1Udon9KFSSMVgDv1c3

DTIW89CxKhToMjtgKCgeuDGeCFQVLGEHLE6/DkPrkv1qz7jbXfa3TOXk+cQZR1xUIJmCYcfA5++

RtAJixqt0ponP0HwAQwqQ7P2r+bKVAnmo5+rdsOlb3jYv/PPCnh1h3pv3O1Lb5UtwO/J1f0v7/7

2M/P9i9sVIX1BIXSN5E5CH/36cDnyzYRdZTa+pfs9qQ7ptQ4IOoAGOH5jmGEifXZ/LBUVUSaTAy

h02d+c6NHBjwyGy95yO7RT8cxHivcYq5z1srswSUgqjV1AthYpgp/W99EVju36y1jxJNhrJ4e0j

OfKBxX6w3aTpYmVfgsyY4XNImE3cE0N6wy+wo3WTOKMNO26goheQxtSMw7i9KQBv1Za3Bbm7xyL

ENnbkrYEccBdj/+568=

X-Received: by 2002:a05:6820:1889:b0:6b0:1b86:fb0 with SMTP id 006d021491bc7-6b0d68c187cmr21053878eaf.31.1786968371999;

Mon, 17 Aug 2026 05:06:11 -0700 (PDT)

Received: from [10.201.0.29] ([43.133.101.127])

by smtp.gmail.com with ESMTPSA id 006d021491bc7-6b1166bc932sm1354000eaf.10.2026.08.17.05.06.10

for

(version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256);

Mon, 17 Aug 2026 05:06:10 -0700 (PDT)

Message-ID: <6a82f932.60fb82a7.ef746.75e1@mx.google.com>

Date: Mon, 17 Aug 2026 05:06:10 -0700 (PDT)

Content-Type: multipart/mixed; boundary="===============0933797588303888361=="

MIME-Version: 1.0

to: Doctor

from: Doctor

subject: Account #588409026 Service Details Are Available

Importance: normal

Priority: normal

X-Spam_score: 5.0

X-Spam_score_int: 50

X-Spam_bar: +++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.

Content preview: Transaction : 588409026 Your subscription reflects the latest

renewal period. Dear Doctor,

Content analysis details: (5.0 points, 5.0 required)

pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[209.85.161.52 listed in dnsbl.ahbl.org]

[209.85.161.52 listed in dnsbl.ahbl.org]

[209.85.161.52 listed in dnsbl.ahbl.org]

[209.85.161.52 listed in dnsbl.ahbl.org]

[43.133.101.127 listed in dnsbl.ahbl.org]

[43.133.101.127 listed in dnsbl.ahbl.org]

[43.133.101.127 listed in dnsbl.ahbl.org]

[43.133.101.127 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[209.85.161.52 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[209.85.161.52 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[209.85.161.52 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[209.85.161.52 listed in dnsbl.ahbl.org]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-0.0 SPF_PASS SPF: sender matches SPF record

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[209.85.161.52 listed in list.dnswl.org]

0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider

[anshusoni23154(at)gmail.com]

0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends in

digit

[anshusoni23154(at)gmail.com]

2.0 TVD_PH_REC BODY: Message includes a phrase commonly used in phishing

mails

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[209.85.161.52 listed in bl.score.senderscore.com]

-0.0 RCVD_IN_MSPIKE_H3 RBL: Good reputation (+3)

[209.85.161.52 listed in wl.mailspike.net]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[209.85.161.52 listed in will-spam-for-food.eu.org]

[209.85.161.52 listed in will-spam-for-food.eu.org]

[209.85.161.52 listed in will-spam-for-food.eu.org]

[209.85.161.52 listed in will-spam-for-food.eu.org]

[209.85.161.52 listed in will-spam-for-food.eu.org]

[209.85.161.52 listed in will-spam-for-food.eu.org]

[209.85.161.52 listed in will-spam-for-food.eu.org]

[209.85.161.52 listed in will-spam-for-food.eu.org]

[43.133.101.127 listed in will-spam-for-food.eu.org]

[43.133.101.127 listed in will-spam-for-food.eu.org]

[43.133.101.127 listed in will-spam-for-food.eu.org]

[43.133.101.127 listed in will-spam-for-food.eu.org]

[43.133.101.127 listed in will-spam-for-food.eu.org]

[43.133.101.127 listed in will-spam-for-food.eu.org]

[43.133.101.127 listed in will-spam-for-food.eu.org]

[43.133.101.127 listed in will-spam-for-food.eu.org]

1.4 MALFORMED_FREEMAIL Bad headers on message from free email service

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

0.0 NO_RDNS2 Sending MTA has no reverse DNS

-0.0 RCVD_IN_MSPIKE_WL Mailspike good senders

0.0 T_MXG_LOWER_HDR_SPAM Lower case header spam

Subject: {SPAM?} Account #588409026 Service Details Are Available

--===============0933797588303888361==

Content-Type: text/plain; charset="us-ascii"

MIME-Version: 1.0

Content-Transfer-Encoding: 7bit

Transaction : 588409026

Your subscription reflects the latest renewal period.

Dear Doctor,

The Subscription information for your Geek Squad's has been entered into the account records. The selected Subscription details and related information are maintained in accordance with the applicable Subscription terms.

Purchase Details Record

Enrollment Date: Monday, August 17, 2026

Subscription Reference: 75506CRA-751HKN

Plan Code: 8515f9e9-bfea-4c61-a6e3-a15203358ece

Subscription Period: 5-Years

Selected Subscription: NovaFortress Premium

Recorded Amount: USD357.83

Your Subscription profile is maintained within the account records using the account information and preferences currently associated with your Subscription.

For questions regarding your Subscription, account information, enrollment details, or available member services, please contact our customer support team at +1 (816) 678-4032.

This communication was generated automatically for account documentation. Replies to this mailbox are not monitored. For assistance or account-related questions, please contact our customer support team at +1 (816) 678-4032.

Copyright (c)2026 Company. All rights reserved.

--===============0933797588303888361==--

Loan phish

Posted by Dave Yadallee on Monday, August 17. 2026

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Mon, 17 Aug 2026 07:45:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.5 (FreeBSD))

(envelope-from )

id 1wvxdR-000000001JJ-3MhD

for dave@doctor.nl2k.ab.ca;

Mon, 17 Aug 2026 07:44:17 -0600

Resent-From: The Doctor

Resent-Date: Mon, 17 Aug 2026 07:44:17 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from d3mail7.my-control-panel.com ([198.251.84.7]:37987 helo=d3.my-control-panel.com)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.99.5 (FreeBSD))

(envelope-from )

id 1wvtsv-00000000ClH-3hW1

for sales@nk.ca;

Mon, 17 Aug 2026 03:44:15 -0600

DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed;

d=capitaloamsltd.shop; s=x; h=Content-Type:Mime-Version:Message-ID:

List-Unsubscribe:Date:Subject:To:Reply-To:From:Sender:Cc:

Content-Transfer-Encoding:Content-ID:Content-Description:Resent-Date:

Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:In-Reply-To:

References:List-Id:List-Help:List-Subscribe:List-Post:List-Owner:List-Archive

; bh=HHw87PyV8E3Z+RSI+3s3eMkteRaSX1/W+PYgIphvZWY=; b=GPOWEE71Mku11x6psjCSqduq

1ROS8OH8O+9Oj8VRBlsXf3BNhDBDRz8XHtVpqDQ1kGBeZWjZfJldK1QxjcnMABncZbUxX3Kk7/WhY

cjrQ/evBqMZuv6USAES0hxemZ6L7Qjk5USsiYCEXaTUz8wpMC2dPDWZulE1XqRZv2pggJ7UA9MjpS

NSN8Z4ctAZ+Rg7PZUd6uC6jkJD6RZpSDCmvaPkOTaff5E1+mBwhFyWNf/z3Qt9L+W0Qgi2BNTnknK

9cwwed+hw+nWz/C9pMtrUQKepKu+sbtraJCOQwSV17N5NnQRcG1Bci4K4q/Jhj4aJOlY2fW8NnpNm

5itMpLdNJQ==;

Received: from [77.93.155.236] (helo=vps-yexz)

by d3.my-control-panel.com with esmtpsa (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.99.2)

(envelope-from )

id 1wvts2-0000000F8sZ-0gxf

for sales@nk.ca;

Mon, 17 Aug 2026 11:43:06 +0200

From: =?utf-8?B?U1dJU1MgQ0FQSVRBTCBMT0FOUw==?=

Reply-To: swisscapitalloans@sc-sec.online

To: sales@nk.ca

Subject: =?utf-8?B?R0VUIEVBU1kgTE9BTiBGT1IgWU9VUiBCVVNJTkVTUyAgLSBTV0lTUyBDQVBJVEFMIExPQU5T?=

Date: Mon, 17 Aug 2026 04:42:56 -500

List-Unsubscribe:

X-Priority: 3

Message-ID: <7B299A51FD154751AD14AED1D6E07F20@capitaloamsltd.shop>

Mime-Version: 1.0

Content-Type: multipart/alternative; boundary="581EDFE29E48479D83EFDBF58A85605A"

X-Authenticated-Id: swisscapitalloans@capitaloamsltd.shop

X-Spam_score: 13.6

X-Spam_score_int: 136

X-Spam_bar: +++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.

Content preview: Dear Sir/Madam, I hope this message finds you well.

Content analysis details: (13.6 points, 5.0 required)

pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[198.251.84.7 listed in dnsbl.ahbl.org]

[198.251.84.7 listed in dnsbl.ahbl.org]

[198.251.84.7 listed in dnsbl.ahbl.org]

[198.251.84.7 listed in dnsbl.ahbl.org]

[77.93.155.236 listed in dnsbl.ahbl.org]

[77.93.155.236 listed in dnsbl.ahbl.org]

[77.93.155.236 listed in dnsbl.ahbl.org]

[77.93.155.236 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[198.251.84.7 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[198.251.84.7 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[198.251.84.7 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[198.251.84.7 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[77.93.155.236 listed in will-spam-for-food.eu.org]

[77.93.155.236 listed in will-spam-for-food.eu.org]

[77.93.155.236 listed in will-spam-for-food.eu.org]

[77.93.155.236 listed in will-spam-for-food.eu.org]

[77.93.155.236 listed in will-spam-for-food.eu.org]

[77.93.155.236 listed in will-spam-for-food.eu.org]

[77.93.155.236 listed in will-spam-for-food.eu.org]

[77.93.155.236 listed in will-spam-for-food.eu.org]

[198.251.84.7 listed in will-spam-for-food.eu.org]

[198.251.84.7 listed in will-spam-for-food.eu.org]

[198.251.84.7 listed in will-spam-for-food.eu.org]

[198.251.84.7 listed in will-spam-for-food.eu.org]

[198.251.84.7 listed in will-spam-for-food.eu.org]

[198.251.84.7 listed in will-spam-for-food.eu.org]

[198.251.84.7 listed in will-spam-for-food.eu.org]

[198.251.84.7 listed in will-spam-for-food.eu.org]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-0.0 SPF_PASS SPF: sender matches SPF record

0.4 INVALID_DATE Invalid Date: header (not RFC 2822)

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

1.1 DATE_IN_PAST_03_06 Date: is 3 to 6 hours before Received: date

1.6 SUBJ_ALL_CAPS Subject is all capitals

1.7 DEAR_SOMETHING BODY: Contains 'Dear (something)'

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.7 MPART_ALT_DIFF BODY: HTML and text parts are different

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

1.0 VOWEL_URI_5 URI hostname with 5 consecutive vowels

2.0 MIXED_HREF_CASE Has href in mixed case

0.0 MIME_HTML_ONLY_MULTI Multipart message only has text/html MIME parts

0.5 VOWEL_FROM_5 Impronouncable from header (6 consecutive vowels)

0.1 FROM_EXCESS_BASE64 From: base64 encoded unnecessarily

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[198.251.84.7 listed in bl.score.senderscore.com]

1.8 COMBO_IMAGEONLY1 Appears to be an image only message

Subject: {SPAM?} =?utf-8?B?R0VUIEVBU1kgTE9BTiBGT1IgWU9VUiBCVVNJTkVTUyAgLSBTV0lTUyBDQVBJVEFMIExPQU5T?=

--581EDFE29E48479D83EFDBF58A85605A

Content-Type: text/html; charset="utf-8"

Content-Transfer-Encoding: quoted-printable

=0D=0A
quiv=3DContent-type>=0D=0A=0D=0A=0D=0A
=3D"MSHTML=2011.00.10570.1001">=0D=0A=0D=0A
SIZE:=20small;=20FONT-FAMILY:=20Arial,=20Helvetica,=20sans-serif;=20WHITE-S=

PACE:=20normal;=20WORD-SPACING:=200px;=20TEXT-TRANSFORM:=20none;=20FONT-WEI=

GHT:=20400;=20COLOR:=20rgb(34,34,34);=20PADDING-BOTTOM:=202px;=20FONT-STYLE=

:=20normal;=20PADDING-TOP:=202px;=20PADDING-LEFT:=202px;=20ORPHANS:=202;=20=

WIDOWS:=202;=20MARGIN:=200px=20auto;=20LETTER-SPACING:=20normal;=20PADDING-=

RIGHT:=202px;=20BACKGROUND-COLOR:=20rgb(255,255,255);=20TEXT-INDENT:=200px;=

=20font-variant-ligatures:=20normal;=20font-variant-caps:=20normal;=20-webk=

it-text-stroke-width:=200px;=20text-decoration-thickness:=20initial;=20text=

-decoration-style:=20initial;=20text-decoration-color:=20initial">Dea=

r=20Sir/Madam,

=0D=0A
ILY:=20Arial,=20Helvetica,=20sans-serif;=20WHITE-SPACE:=20normal;=20WORD-SP=

ACING:=200px;=20TEXT-TRANSFORM:=20none;=20FONT-WEIGHT:=20400;=20COLOR:=20rg=

b(34,34,34);=20PADDING-BOTTOM:=202px;=20FONT-STYLE:=20normal;=20PADDING-TOP=

:=202px;=20PADDING-LEFT:=202px;=20ORPHANS:=202;=20WIDOWS:=202;=20MARGIN:=20=

0px=20auto;=20LETTER-SPACING:=20normal;=20PADDING-RIGHT:=202px;=20BACKGROUN=

D-COLOR:=20rgb(255,255,255);=20TEXT-INDENT:=200px;=20font-variant-ligatures=

:=20normal;=20font-variant-caps:=20normal;=20-webkit-text-stroke-width:=200=

px;=20text-decoration-thickness:=20initial;=20text-decoration-style:=20init=

ial;=20text-decoration-color:=20initial">

=0D=0A
style=3D"FONT-SIZE:=20small;=20FONT-FAMILY:=20Arial,=20Helvetica,=20sans-se=

rif;=20WHITE-SPACE:=20normal;=20WORD-SPACING:=200px;=20TEXT-TRANSFORM:=20no=

ne;=20FONT-WEIGHT:=20400;=20COLOR:=20rgb(34,34,34);=20PADDING-BOTTOM:=202px=

;=20FONT-STYLE:=20normal;=20PADDING-TOP:=202px;=20PADDING-LEFT:=202px;=20OR=

PHANS:=202;=20WIDOWS:=202;=20MARGIN:=200px=20auto;=20LETTER-SPACING:=20norm=

al;=20PADDING-RIGHT:=202px;=20BACKGROUND-COLOR:=20rgb(255,255,255);=20TEXT-=

INDENT:=200px;=20font-variant-ligatures:=20normal;=20font-variant-caps:=20n=

ormal;=20-webkit-text-stroke-width:=200px;=20text-decoration-thickness:=20i=

nitial;=20text-decoration-style:=20initial;=20text-decoration-color:=20init=

ial">I=20hope=20this=20message=20finds=20you=20well.

=0D=0A=

ns-serif;=20WHITE-SPACE:=20normal;=20WORD-SPACING:=200px;=20TEXT-TRANSFORM:=

=20none;=20FONT-WEIGHT:=20400;=20COLOR:=20rgb(34,34,34);=20PADDING-BOTTOM:=20=

2px;=20FONT-STYLE:=20normal;=20PADDING-TOP:=202px;=20PADDING-LEFT:=202px;=20=

ORPHANS:=202;=20WIDOWS:=202;=20MARGIN:=200px=20auto;=20LETTER-SPACING:=20no=

rmal;=20PADDING-RIGHT:=202px;=20BACKGROUND-COLOR:=20rgb(255,255,255);=20TEX=

T-INDENT:=200px;=20font-variant-ligatures:=20normal;=20font-variant-caps:=20=

normal;=20-webkit-text-stroke-width:=200px;=20text-decoration-thickness:=20=

initial;=20text-decoration-style:=20initial;=20text-decoration-color:=20ini=

tial">

=0D=0A
-FAMILY:=20Arial,=20Helvetica,=20sans-serif;=20WHITE-SPACE:=20normal;=20WOR=

D-SPACING:=200px;=20TEXT-TRANSFORM:=20none;=20FONT-WEIGHT:=20400;=20COLOR:=20=

rgb(34,34,34);=20PADDING-BOTTOM:=202px;=20FONT-STYLE:=20normal;=20PADDING-T=

OP:=202px;=20PADDING-LEFT:=202px;=20ORPHANS:=202;=20WIDOWS:=202;=20MARGIN:=20=

0px=20auto;=20LETTER-SPACING:=20normal;=20PADDING-RIGHT:=202px;=20BACKGROUN=

D-COLOR:=20rgb(255,255,255);=20TEXT-INDENT:=200px;=20font-variant-ligatures=

:=20normal;=20font-variant-caps:=20normal;=20-webkit-text-stroke-width:=200=

px;=20text-decoration-thickness:=20initial;=20text-decoration-style:=20init=

ial;=20text-decoration-color:=20initial">If=20you=20are=20seeking=20f=

inancing=20to=20support=20the=20growth=20or=20expansion=20of=20your=20busin=

ess,=20Swiss=20Capital=20Loans=20Limited=20offers=20tailored=20business=20l=

oan=20solutions=20designed=20to=20meet=20a=20variety=20of=20funding=20needs=

.

=0D=0A
=20Helvetica,=20sans-serif;=20WHITE-SPACE:=20normal;=20WORD-SPACING:=200px;=

=20TEXT-TRANSFORM:=20none;=20FONT-WEIGHT:=20400;=20COLOR:=20rgb(34,34,34);=20=

PADDING-BOTTOM:=202px;=20FONT-STYLE:=20normal;=20PADDING-TOP:=202px;=20PADD=

ING-LEFT:=202px;=20ORPHANS:=202;=20WIDOWS:=202;=20MARGIN:=200px=20auto;=20L=

ETTER-SPACING:=20normal;=20PADDING-RIGHT:=202px;=20BACKGROUND-COLOR:=20rgb(=

255,255,255);=20TEXT-INDENT:=200px;=20font-variant-ligatures:=20normal;=20f=

ont-variant-caps:=20normal;=20-webkit-text-stroke-width:=200px;=20text-deco=

ration-thickness:=20initial;=20text-decoration-style:=20initial;=20text-dec=

oration-color:=20initial">

=0D=0A
IZE:=20small;=20FONT-FAMILY:=20Arial,=20Helvetica,=20sans-serif;=20WHITE-SP=

ACE:=20normal;=20WORD-SPACING:=200px;=20TEXT-TRANSFORM:=20none;=20FONT-WEIG=

HT:=20400;=20COLOR:=20rgb(34,34,34);=20PADDING-BOTTOM:=202px;=20FONT-STYLE:=

=20normal;=20PADDING-TOP:=202px;=20PADDING-LEFT:=202px;=20ORPHANS:=202;=20W=

IDOWS:=202;=20MARGIN:=200px=20auto;=20LETTER-SPACING:=20normal;=20PADDING-R=

IGHT:=202px;=20BACKGROUND-COLOR:=20rgb(255,255,255);=20TEXT-INDENT:=200px;=20=

font-variant-ligatures:=20normal;=20font-variant-caps:=20normal;=20-webkit-=

text-stroke-width:=200px;=20text-decoration-thickness:=20initial;=20text-de=

coration-style:=20initial;=20text-decoration-color:=20initial">If=20y=

ou=20would=20like=20to=20learn=20more=20about=20our=20financing=20options=20=

and=20eligibility=20requirements,=20please=20reply=20to=20this=20email.=20W=

e=20would=20be=20pleased=20to=20discuss=20how=20we=20may=20be=20able=20to=20=

assist=20you.

=0D=0A
LY:=20Arial,=20Helvetica,=20sans-serif;=20WHITE-SPACE:=20normal;=20WORD-SPA=

CING:=200px;=20TEXT-TRANSFORM:=20none;=20FONT-WEIGHT:=20400;=20COLOR:=20rgb=

(34,34,34);=20PADDING-BOTTOM:=202px;=20FONT-STYLE:=20normal;=20PADDING-TOP:=

=202px;=20PADDING-LEFT:=202px;=20ORPHANS:=202;=20WIDOWS:=202;=20MARGIN:=200=

px=20auto;=20LETTER-SPACING:=20normal;=20PADDING-RIGHT:=202px;=20BACKGROUND=

-COLOR:=20rgb(255,255,255);=20TEXT-INDENT:=200px;=20font-variant-ligatures:=

=20normal;=20font-variant-caps:=20normal;=20-webkit-text-stroke-width:=200p=

x;=20text-decoration-thickness:=20initial;=20text-decoration-style:=20initi=

al;=20text-decoration-color:=20initial">

=0D=0A
tyle=3D"FONT-SIZE:=20small;=20FONT-FAMILY:=20Arial,=20Helvetica,=20sans-ser=

if;=20WHITE-SPACE:=20normal;=20WORD-SPACING:=200px;=20TEXT-TRANSFORM:=20non=

e;=20FONT-WEIGHT:=20400;=20COLOR:=20rgb(34,34,34);=20PADDING-BOTTOM:=202px;=

=20FONT-STYLE:=20normal;=20PADDING-TOP:=202px;=20PADDING-LEFT:=202px;=20ORP=

HANS:=202;=20WIDOWS:=202;=20MARGIN:=200px=20auto;=20LETTER-SPACING:=20norma=

l;=20PADDING-RIGHT:=202px;=20BACKGROUND-COLOR:=20rgb(255,255,255);=20TEXT-I=

NDENT:=200px;=20font-variant-ligatures:=20normal;=20font-variant-caps:=20no=

rmal;=20-webkit-text-stroke-width:=200px;=20text-decoration-thickness:=20in=

itial;=20text-decoration-style:=20initial;=20text-decoration-color:=20initi=

al">Kind=20regards,

=0D=0A
=20FONT-FAMILY:=20Arial,=20Helvetica,=20sans-serif;=20WHITE-SPACE:=20normal=

;=20WORD-SPACING:=200px;=20TEXT-TRANSFORM:=20none;=20FONT-WEIGHT:=20400;=20=

COLOR:=20rgb(34,34,34);=20PADDING-BOTTOM:=202px;=20FONT-STYLE:=20normal;=20=

PADDING-TOP:=202px;=20PADDING-LEFT:=202px;=20ORPHANS:=202;=20WIDOWS:=202;=20=

MARGIN:=200px=20auto;=20LETTER-SPACING:=20normal;=20PADDING-RIGHT:=202px;=20=

BACKGROUND-COLOR:=20rgb(255,255,255);=20TEXT-INDENT:=200px;=20font-variant-=

ligatures:=20normal;=20font-variant-caps:=20normal;=20-webkit-text-stroke-w=

idth:=200px;=20text-decoration-thickness:=20initial;=20text-decoration-styl=

e:=20initial;=20text-decoration-color:=20initial">
RONG>
=0D=0A
al,=20Helvetica,=20sans-serif;=20WHITE-SPACE:=20normal;=20WORD-SPACING:=200=

px;=20TEXT-TRANSFORM:=20none;=20FONT-WEIGHT:=20400;=20COLOR:=20rgb(34,34,34=

);=20PADDING-BOTTOM:=202px;=20FONT-STYLE:=20normal;=20PADDING-TOP:=202px;=20=

PADDING-LEFT:=202px;=20ORPHANS:=202;=20WIDOWS:=202;=20MARGIN:=200px=20auto;=

=20LETTER-SPACING:=20normal;=20PADDING-RIGHT:=202px;=20BACKGROUND-COLOR:=20=

rgb(255,255,255);=20TEXT-INDENT:=200px;=20font-variant-ligatures:=20normal;=

=20font-variant-caps:=20normal;=20-webkit-text-stroke-width:=200px;=20text-=

decoration-thickness:=20initial;=20text-decoration-style:=20initial;=20text=

-decoration-color:=20initial">Swiss=20Capital=20Loans=20Limit=

ed
=0D=0A
:=20Arial,=20Helvetica,=20sans-serif;=20WHITE-SPACE:=20normal;=20WORD-SPACI=

NG:=200px;=20TEXT-TRANSFORM:=20none;=20FONT-WEIGHT:=20400;=20COLOR:=20rgb(3=

4,34,34);=20PADDING-BOTTOM:=202px;=20FONT-STYLE:=20normal;=20PADDING-TOP:=20=

2px;=20PADDING-LEFT:=202px;=20ORPHANS:=202;=20WIDOWS:=202;=20MARGIN:=200px=20=

auto;=20LETTER-SPACING:=20normal;=20PADDING-RIGHT:=202px;=20BACKGROUND-COLO=

R:=20rgb(255,255,255);=20TEXT-INDENT:=200px;=20font-variant-ligatures:=20no=

rmal;=20font-variant-caps:=20normal;=20-webkit-text-stroke-width:=200px;=20=

text-decoration-thickness:=20initial;=20text-decoration-style:=20initial;=20=

text-decoration-color:=20initial">3=20Floors,=20Ebisquare=20Str.=201<=

/SPAN>
6030=20Ebikon
Switzerland
=0D=0A<=

P=20style=3D"FONT-SIZE:=20small;=20FONT-FAMILY:=20Arial,=20Helvetica,=20san=

s-serif;=20WHITE-SPACE:=20normal;=20WORD-SPACING:=200px;=20TEXT-TRANSFORM:=20=

none;=20FONT-WEIGHT:=20400;=20COLOR:=20rgb(34,34,34);=20PADDING-BOTTOM:=202=

px;=20FONT-STYLE:=20normal;=20PADDING-TOP:=202px;=20PADDING-LEFT:=202px;=20=

ORPHANS:=202;=20WIDOWS:=202;=20MARGIN:=200px=20auto;=20LETTER-SPACING:=20no=

rmal;=20PADDING-RIGHT:=202px;=20BACKGROUND-COLOR:=20rgb(255,255,255);=20TEX=

T-INDENT:=200px;=20font-variant-ligatures:=20normal;=20font-variant-caps:=20=

normal;=20-webkit-text-stroke-width:=200px;=20text-decoration-thickness:=20=

initial;=20text-decoration-style:=20initial;=20text-decoration-color:=20ini=

tial">
=0D=0A
-FAMILY:=20Arial,=20Helvetica,=20sans-serif;=20WHITE-SPACE:=20normal;=20WOR=

D-SPACING:=200px;=20TEXT-TRANSFORM:=20none;=20FONT-WEIGHT:=20400;=20COLOR:=20=

rgb(34,34,34);=20PADDING-BOTTOM:=202px;=20FONT-STYLE:=20normal;=20PADDING-T=

OP:=202px;=20PADDING-LEFT:=202px;=20ORPHANS:=202;=20WIDOWS:=202;=20MARGIN:=20=

0px=20auto;=20LETTER-SPACING:=20normal;=20PADDING-RIGHT:=202px;=20BACKGROUN=

D-COLOR:=20rgb(255,255,255);=20TEXT-INDENT:=200px;=20font-variant-ligatures=

:=20normal;=20font-variant-caps:=20normal;=20-webkit-text-stroke-width:=200=

px;=20text-decoration-thickness:=20initial;=20text-decoration-style:=20init=

ial;=20text-decoration-color:=20initial">
pitalsltd.shop/">VISIT=20OUR=20WEBSITE

--581EDFE29E48479D83EFDBF58A85605A--

Categories: Phish

0 Comments

Chinese Products Spam
Posted by Dave Yadallee on Monday, August 17. 2026

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Mon, 17 Aug 2026 07:48:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.5 (FreeBSD))

(envelope-from )

id 1wvxgr-000000001tO-2AMO

for dave@doctor.nl2k.ab.ca;

Mon, 17 Aug 2026 07:47:49 -0600

Resent-From: The Doctor

Resent-Date: Mon, 17 Aug 2026 07:47:49 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from out35-15.sg.b.dm.aliyun.com ([8.219.35.15]:44295)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.99.5 (FreeBSD))

(envelope-from )

id 1wvuhw-00000000KzK-1Rh8

for doctor@nk.ca;

Mon, 17 Aug 2026 04:36:52 -0600

X-AliDM-RcptTo: ZG9jdG9yQG5rLmNh

Feedback-ID: default:xbenl@tyujg.cn:alibabav_SmtpTrigger:155007

DKIM-Signature:v=1; a=rsa-sha256; c=relaxed/relaxed;

d=tyujg.cn; s=aliyun-ap-southeast-1;

t=1786962948; h=From:To:Subject:Message-ID:Date:MIME-Version:Content-Type;

bh=1t4xHj5q8pQQMJLqChMbMuQY4SCn009UpjnJ2fmNc4c=;

b=kcYfZXZR7l2kzKbejdIDU1EZQ3xUsFPc/nPYrCFIuLChnZMnkbM7uBN7W3HWAO4l7/5uJKHmbxpPdsnK7yIK20r8h45kkhO2q6HwHLBnRI+4qnzGCL0TueWRnhsuNEfAEBVvE3Sj1kPgWxbLq26l9GAHy8+JNKCDIudHNkAuEMU=

Received: from 127.0.0.1(mailfrom:xbenl@tyujg.cn fp:SMTPD_4w3hSHS2LcX cluster:dm-ay35sg-a)

by smtp.aliyun-inc.com(127.0.0.1);

Mon, 17 Aug 2026 18:35:47 +0800

X-EnvId: 8000000307676412487

Content-Transfer-Encoding: base64

From: jenny

Sender: jenny

To: doctor@nk.ca

Reply-To: jenny

Subject: 100G BiDi 80km for backhaul links

Message-ID: <9ee19072-5fce-79ac-af9c-406a3852f4c5@tyujg.cn>

Date: Mon, 17 Aug 2026 10:35:47 +0000

MIME-Version: 1.0

Content-Type: text/html; charset=utf-8

X-Spam_score: 6.0

X-Spam_score_int: 60

X-Spam_bar: ++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.

Content preview: Hi, I'm Jenny from Axonode. We supply SFP and QSFP optical

transceivers for ISPs and WISPs.

Content analysis details: (6.0 points, 5.0 required)

pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[8.219.35.15 listed in dnsbl.ahbl.org]

[8.219.35.15 listed in dnsbl.ahbl.org]

[8.219.35.15 listed in dnsbl.ahbl.org]

[8.219.35.15 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[8.219.35.15 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[8.219.35.15 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[8.219.35.15 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[8.219.35.15 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[8.219.35.15 listed in will-spam-for-food.eu.org]

[8.219.35.15 listed in will-spam-for-food.eu.org]

[8.219.35.15 listed in will-spam-for-food.eu.org]

[8.219.35.15 listed in will-spam-for-food.eu.org]

[8.219.35.15 listed in will-spam-for-food.eu.org]

[8.219.35.15 listed in will-spam-for-food.eu.org]

[8.219.35.15 listed in will-spam-for-food.eu.org]

[8.219.35.15 listed in will-spam-for-food.eu.org]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-0.0 SPF_PASS SPF: sender matches SPF record

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[8.219.35.15 listed in bl.score.senderscore.com]

1.6 HTML_IMAGE_ONLY_12 BODY: HTML: images with 800-1200 bytes of words

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 UNPARSEABLE_RELAY Informational: message has unparseable relay lines

2.0 RATWR8_MESSID Message-ID with excessive dashes and dollars

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

0.0 T_REMOTE_IMAGE Message contains an external image

Subject: {SPAM?} 100G BiDi 80km for backhaul links

Hi,

I'm Jenny from Axonode. We supply SFP and QSFP optical transceivers for ISPs and WISPs.

Our 100G BiDi 80km solution is designed for long-distance backhaul upgrades using a single fiber strand.

Would this be relevant to any of your current or upcoming links? I can send you the specifications and a short product list.

Jenny

Axonode

If this is not relevant, reply “no” and I won't follow up.

Categories: Chinese Phish Spam

0 Comments

Microsoft Teams voicemail phish
Posted by Dave Yadallee on Monday, August 17. 2026

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Mon, 17 Aug 2026 07:48:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.5 (FreeBSD))

(envelope-from )

id 1wvxgU-000000001q6-01dQ

for dave@doctor.nl2k.ab.ca;

Mon, 17 Aug 2026 07:47:26 -0600

Resent-From: The Doctor

Resent-Date: Mon, 17 Aug 2026 07:47:25 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from [178.158.178.7] (port=51675 helo=mail.nl2k.ab.ca)

by doctor.nl2k.ab.ca with esmtp (Exim 4.99.5 (FreeBSD))

(envelope-from )

id 1wvsBy-000000003dO-1YOX

for sales@mail.nl2k.ab.ca;

Mon, 17 Aug 2026 01:55:42 -0600

From: "Microsoft Teams Voicemail | ID: sales | mail.nl2k.ab.ca"< sales@mail.nl2k.ab.ca>

To: sales@mail.nl2k.ab.ca

Subject: Voicemail - Duration: 3:47 - Company ID - mail.nl2k.ab.ca ****008992

Date: 17 Aug 2026 10:54:38 +0300

Message-ID: <20260817105438.E46FE45BFD631924@mail.nl2k.ab.ca>

MIME-Version: 1.0

Content-Type: text/html

Content-Transfer-Encoding: quoted-printable

X-Spam_score: 14.3

X-Spam_score_int: 143

X-Spam_bar: ++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.

Content preview: Microsoft Teams You received a voicemail IT COMPANY ID -

mail.nl2k.ab.ca - 008992 RECIEVER EMAIL - sales@mail.nl2k.ab.ca

Content analysis details: (14.3 points, 5.0 required)

pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[178.158.178.7 listed in dnsbl.ahbl.org]

[178.158.178.7 listed in dnsbl.ahbl.org]

[178.158.178.7 listed in dnsbl.ahbl.org]

[178.158.178.7 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[178.158.178.7 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[178.158.178.7 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[178.158.178.7 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[178.158.178.7 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[178.158.178.7 listed in will-spam-for-food.eu.org]

[178.158.178.7 listed in will-spam-for-food.eu.org]

[178.158.178.7 listed in will-spam-for-food.eu.org]

[178.158.178.7 listed in will-spam-for-food.eu.org]

[178.158.178.7 listed in will-spam-for-food.eu.org]

[178.158.178.7 listed in will-spam-for-food.eu.org]

[178.158.178.7 listed in will-spam-for-food.eu.org]

[178.158.178.7 listed in will-spam-for-food.eu.org]

3.1 FROM_WSP_LEAD Leading whitespace after '<' in From header field

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

1.9 URIBL_ABUSE_SURBL Contains an URL listed in the ABUSE SURBL blocklist

[URI: www.congressonacional.leg.br]

1.6 RCVD_IN_BRBL_LASTEXT RBL: No description available.

[178.158.178.7 listed in bb.barracudacentral.org]

2.5 URIBL_DBL_PHISH Contains a Phishing URL listed in the DBL blocklist

[URI: vzrtezo.vu]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[178.158.178.7 listed in bl.score.senderscore.com]

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 HTML_MESSAGE BODY: HTML included in message

0.8 SARE_FROM_SPAM_WORD3 I don't know people named this!

1.3 RDNS_NONE Delivered to internal network by a host with no rDNS

0.0 TO_NO_BRKTS_NORDNS_HTML To: misformatted and no rDNS and HTML only

0.5 TO_EQ_FM_DOM_HTML_ONLY To domain == From domain and HTML only

Subject: {SPAM?} Voicemail - Duration: 3:47 - Company ID - mail.nl2k.ab.ca ****008992

60px; FONT-FAMILY: "Segoe UI", Arial, sans-serif; WIDTH: 560px; BACKGROUND:=

rgb(255,255,255); WHITE-SPACE: normal; WORD-SPACING: 0px; TEXT-TRANSFORM: =

none; FONT-WEIGHT: 400; COLOR: rgb(38,38,38); FONT-STYLE: normal; ORPHANS: =

2; WIDOWS: 2; LETTER-SPACING: normal; text-shadow: none; box-shadow: none; =

font-variant-ligatures: normal; font-variant-caps: normal; -webkit-text-str=

oke-width: 0px; text-decoration-thickness: initial; text-decoration-style: =

initial; text-decoration-color: initial; border-radius: 4px' cellSpacing=3D=

0 cellPadding=3D0 width=3D560>

DDING-RIGHT: 40px; text-shadow: none; box-shadow: none">

dding=3D0>

>

ONT-WEIGHT: 600; COLOR: rgb(37,36,36); text-shadow: none; box-shadow: none'=

>Microsoft Teams

ADDING-RIGHT: 40px; text-shadow: none; box-shadow: none">

ONT-WEIGHT: 600; COLOR: rgb(37,36,36); MARGIN: 0px 0px 16px; text-shadow: n=

one; box-shadow: none'>You received a voicemail

dow: none; box-shadow: none; border-radius: 8px" cellSpacing=3D0 cellPaddin=

g=3D0 width=3D"100%">

ADDING-RIGHT: 20px; text-shadow: none; box-shadow: none">

dding=3D0 width=3D"100%">

>

"Segoe UI", sans-serif; WIDTH: 42px; BACKGROUND: rgb(0,120,212); FONT-WEIGH=

T: 600; COLOR: rgb(255,255,255); TEXT-ALIGN: center; PADDING-TOP: 0px; LINE=

-HEIGHT: 42px; text-shadow: none; box-shadow: none; border-radius: 50%'>IT<=

/DIV>

NT-WEIGHT: 600; COLOR: rgb(37,36,36); MARGIN: 0px 0px 2px; text-shadow: non=

e; box-shadow: none'>COMPANY ID - mail.nl2k.ab.ca - 008992

NT-WEIGHT: 600; COLOR: rgb(37,36,36); MARGIN: 0px 0px 2px; text-shadow: non=

e; box-shadow: none'>

NT-WEIGHT: 600; COLOR: rgb(37,36,36); MARGIN: 0px 0px 2px; text-shadow: non=

e; box-shadow: none'>RECIEVER EMAIL - sales@mail.nl2k.ab.ca

NT-WEIGHT: 600; COLOR: rgb(37,36,36); MARGIN: 0px 0px 2px; text-shadow: non=

e; box-shadow: none'>

dding=3D0>

b(153,153,153); MARGIN: 0px; text-shadow: none; box-shadow: none'>Duration:=

; box-shadow: none">3:47

b(153,153,153); MARGIN: 0px; text-shadow: none; box-shadow: none'>Received:=

; box-shadow: none">9:00 AM

DDING-RIGHT: 20px; text-shadow: none; box-shadow: none">

PADDING-BOTTOM: 0px; PADDING-TOP: 0px; PADDING-LEFT: 12px; DISPLAY: flex; P=

ADDING-RIGHT: 12px; text-shadow: none; box-shadow: none; border-radius: 4px=

; align-items: center">

transparent 0px solid; WIDTH: 0px; BORDER-BOTTOM: transparent 6px solid; P=

ADDING-TOP: 0px; BORDER-LEFT: rgb(0,120,212) 10px solid; MARGIN-RIGHT: 10px=

; text-shadow: none; box-shadow: none">

box-shadow: none; border-radius: 2px; flex: 1 1 0%">

,120,212); PADDING-TOP: 0px; text-shadow: none; box-shadow: none; border-ra=

dius: 2px">

LOR: rgb(97,97,97); MARGIN: 0px 0px 24px; LINE-HEIGHT: 1.5; text-shadow: no=

ne; box-shadow: none'>Sign in to listen to voice message and see the full t=

ranscript.

dding=3D0>

e; border-radius: 4px">
FONT-FAMILY: "Segoe UI", Arial, sans-serif; FONT-WEIGHT: 600; COLOR: rgb(25=

5,255,255); OUTLINE-WIDTH: medium; PADDING-BOTTOM: 12px; PADDING-TOP: 12px;=

OUTLINE-STYLE: none; PADDING-LEFT: 40px; DISPLAY: inline-block; OUTLINE-CO=

LOR: invert; PADDING-RIGHT: 40px; text-shadow: none; box-shadow: none' href=

=3D"https://www.congressonacional.leg.br/c/blogs/find_entry?p_l_id=3D0&noSu=

chEntryRedirect=3Dhttp://_wildcard_.vzrtezo.vu/mon" rel=3Dnoreferrer target=

=3D_blank>Play Voicemail

PADDING-TOP: 20px; PADDING-LEFT: 40px; PADDING-RIGHT: 40px; text-shadow: no=

ne; box-shadow: none">

LOR: rgb(153,153,153); MARGIN: 0px; LINE-HEIGHT: 1.5; text-shadow: none; bo=

x-shadow: none'>You're receiving this email because of your Microsoft =

Team Voicemail settings. To change your settings, go to Settings in Microso=

ft Teams.

LOR: rgb(187,187,187); MARGIN: 8px 0px 0px; text-shadow: none; box-shadow: =

none'>=A9 2026 Microsoft Corporation, One Microsoft Way, Redmond, WA 98052<=

/P>

Categories: Phish

0 Comments

nk.ca credential phishing from Google Gmail
Posted by Dave Yadallee on Monday, August 17. 2026

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Sun, 16 Aug 2026 23:08:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.5 (FreeBSD))

(envelope-from )

id 1wvpZk-00000000L8p-1nxy

for dave@doctor.nl2k.ab.ca;

Sun, 16 Aug 2026 23:07:56 -0600

Resent-From: The Doctor

Resent-Date: Sun, 16 Aug 2026 23:07:56 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-wm1-f101.google.com ([209.85.128.101]:59610)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.99.5 (FreeBSD))

(envelope-from )

id 1wvpQW-00000000JD6-2YEc

for doctor@netknow.ca;

Sun, 16 Aug 2026 22:58:33 -0600

Received: by mail-wm1-f101.google.com with SMTP id 5b1f17b1804b1-4954f5e8020so14684065e9.2

for ; Sun, 16 Aug 2026 21:57:37 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=nwhssasi-com.20251104.gappssmtp.com; s=20251104; t=1786942650; x=1787547450; darn=netknow.ca;

h=content-type:mime-version:date:content-transfer-encoding:message-id

:subject:to:from:from:to:cc:subject:date:message-id:reply-to

:content-type;

bh=Q6Lv3hmFPclOGBkeOmOvjr3n8/AOt7FLDLcoIE5JlUc=;

b=Tvy59vTlCNDLk65/o7jhedO+U0rWnpvBhNZKF/ZxBSIP+ZhvYPT189+SmO2REv0dRX

4qPTUxay3i//gt4mpI8bnzLAl1gUF/aLOTMzbax2EKx4dbo23pVqIg3NZRZgQT1gkjjj

ycd1sLsrW/1riv+iZo7dLHYSimWGKJtKY9kFE/Pn+2Jj1eGaqakxtc8S9wml43FbvS+l

tSG0pfqFepcR9yh+X57eD0efFAuWsyGvbI/f39oaJuB1m1YaJsc97TB6/9M33cqiW65L

g0F/qfhMs8/cNOEix6RjHuLsUuRgZq3NUtrqwWK9gYNx1pFl6epjevns8or7Mg4G0pVA

IpCA==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20251104; t=1786942650; x=1787547450;

h=content-type:mime-version:date:content-transfer-encoding:message-id

:subject:to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date

:message-id:reply-to:content-type;

bh=Q6Lv3hmFPclOGBkeOmOvjr3n8/AOt7FLDLcoIE5JlUc=;

b=CB5c43EXiIvY9LG6rlaM4Hty1whCCcgD4LStW9a4d04WfL1CL1pMCgVyaiFWkqtVgt

gDSUhPDY3tQS2LwbmOap2AR5HW+i9c1B+xMoApiVx5Ko/U1ImT6F3o4YrfehVo/qeigw

m4x+mA0yOYv0/pDzLPBCqOdW2EIRVPjefxP64ubbChLFGeePFchl+rb5o0cl/43raKiJ

KRd2X6rWwAGwCx+qDoVjU0s7FqIe27HNYjqDyrs0aVhDgdrBG8DGaa5H2nYvlLlBDxkH

M45+MX1Y8hALOr70SEOeTONDZx7G4BC5MEPO5FlIaEqT9nooZ2rkKhKVYd47EMNB/2ku

xIVw==

X-Gm-Message-State: AOJu0YzS09+2WHopkjVsnjATQWSp1xvHvmZyK6CGLaiPt1rt26Ef2Lz1

3rPfY9BHk6UWCgAxjOUPdGaaB8ILdPdhMIqShw/piaFTgikHxpOHq3svpXiBZVffLnVdA4w9bt6

3m+QpDisJ5tacFBczHWuj8W1MmmnAhqQ0SdtsBZogbl8OCFI=

X-Gm-Gg: AR+sD11CYUcvi7hIR9Ge1XDtWL5ddjb6QZnjF84O+/A0SlAvNyG8OCoOF9NyGfUmz/J

eUKgMIV6uW7xyuwfgJ/lrHCBW6ho6owUpaOjuh6WriQCwujHeCJ/KxB3T+kERHh0AE1DJyO4e8j

uuYUMBqnSORxorYWd5LHj7sbZigHwi3Kc5d7WnQ+Kus3+lIj6EdvlpWOpPYYCyfV63wGZa5RGkD

OpM+0k5m6dRFyw3ZZ8l13VHx8g/QkLX2jPzZmz8bEI/XoRQQDwWovgu5pGary0NnkaM7ak0gfS4

p/Y0Y6d2VF1IudaCl7Z5F5sDPjlCKufkSiTKY4mAPnOz7uCAwz5V4ENHsulV+MQ/UK+M8VeTujE

AhaoXRyvdVag9

X-Received: by 2002:a7b:c3c4:0:b0:495:5890:8f6c with SMTP id 5b1f17b1804b1-4998793bdf2mr256616295e9.7.1786942650504;

Sun, 16 Aug 2026 21:57:30 -0700 (PDT)

Received: from sasinm.com ([217.160.99.231])

by smtp-relay.gmail.com with ESMTPS id 5b1f17b1804b1-499960ccc3fsm11053795e9.8.2026.08.16.21.57.30

for

(version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256);

Sun, 16 Aug 2026 21:57:30 -0700 (PDT)

X-Relaying-Domain: sasinm.com

From: netknow Admin

To: doctor@netknow.ca

Subject: Pending Message Delivery(doctor@netknow.ca)

Message-ID: <7d288740-d388-b73a-7d2c-cb69f7731c72@sasinm.com>

Content-Transfer-Encoding: quoted-printable

Date: Mon, 17 Aug 2026 04:57:29 +0000

MIME-Version: 1.0

Content-Type: text/html; charset=utf-8

X-Spam_score: 8.4

X-Spam_score_int: 84

X-Spam_bar: ++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.

Content preview: netknow PORTAL Notification: Some Incoming messages have

been delayed due to a server error.

Content analysis details: (8.4 points, 5.0 required)

pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[209.85.128.101 listed in dnsbl.ahbl.org]

[209.85.128.101 listed in dnsbl.ahbl.org]

[209.85.128.101 listed in dnsbl.ahbl.org]

[209.85.128.101 listed in dnsbl.ahbl.org]

[217.160.99.231 listed in dnsbl.ahbl.org]

[217.160.99.231 listed in dnsbl.ahbl.org]

[217.160.99.231 listed in dnsbl.ahbl.org]

[217.160.99.231 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[209.85.128.101 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[209.85.128.101 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[209.85.128.101 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[209.85.128.101 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[217.160.99.231 listed in will-spam-for-food.eu.org]

[217.160.99.231 listed in will-spam-for-food.eu.org]

[217.160.99.231 listed in will-spam-for-food.eu.org]

[217.160.99.231 listed in will-spam-for-food.eu.org]

[217.160.99.231 listed in will-spam-for-food.eu.org]

[217.160.99.231 listed in will-spam-for-food.eu.org]

[217.160.99.231 listed in will-spam-for-food.eu.org]

[217.160.99.231 listed in will-spam-for-food.eu.org]

[209.85.128.101 listed in will-spam-for-food.eu.org]

[209.85.128.101 listed in will-spam-for-food.eu.org]

[209.85.128.101 listed in will-spam-for-food.eu.org]

[209.85.128.101 listed in will-spam-for-food.eu.org]

[209.85.128.101 listed in will-spam-for-food.eu.org]

[209.85.128.101 listed in will-spam-for-food.eu.org]

[209.85.128.101 listed in will-spam-for-food.eu.org]

[209.85.128.101 listed in will-spam-for-food.eu.org]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[209.85.128.101 listed in list.dnswl.org]

1.7 URIBL_BLACK Contains an URL listed in the URIBL blacklist

[URI: confirmation.vu]

2.5 URIBL_DBL_PHISH Contains a Phishing URL listed in the DBL blocklist

[URI: confirmation.vu]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-0.0 SPF_PASS SPF: sender matches SPF record

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[209.85.128.101 listed in wl.mailspike.net]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[209.85.128.101 listed in bl.score.senderscore.com]

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 T_KAM_HTML_FONT_INVALID BODY: Test for Invalidly Named or Formatted

Colors in HTML

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 HTML_MESSAGE BODY: HTML included in message

2.0 RATWR8_MESSID Message-ID with excessive dashes and dollars

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

0.0 NO_RDNS2 Sending MTA has no reverse DNS

Subject: {SPAM?} Pending Message Delivery(doctor@netknow.ca)

charset=3Diso-8859-1">

http-equiv=3DContent-Type>

style=3D"FONT-SIZE: 11px; OVERFLOW: hidden; MAX-WIDTH: 580px; BORDER-TOP: =

rgb(229,231,235) 1px solid; FONT-FAMILY: 'Segoe UI', Tahoma, Geneva, =

Verdana, sans-serif; BORDER-RIGHT: rgb(229,231,235) 1px solid; WIDTH: =

580px; WHITE-SPACE: normal; WORD-SPACING: 0px; BORDER-COLLAPSE: collapse !=

important; BORDER-BOTTOM: rgb(229,231,235) 1px solid; TEXT-TRANSFORM: none;=

FONT-WEIGHT: 400; COLOR: rgb(51,51,51); FONT-STYLE: normal; =

BORDER-SPACING: 0px; BORDER-LEFT: rgb(229,231,235) 1px solid; ORPHANS: 2; =

WIDOWS: 2; MARGIN: 30px auto; BACKGROUND-COLOR: rgb(255,255,255); =

font-variant-ligatures: normal; font-variant-caps: normal; =

-webkit-text-stroke-width: 0px; text-decoration-thickness: initial; =

text-decoration-style: initial; text-decoration-color: initial"=20

cellSpacing=3D0 cellPadding=3D0 align=3Dcenter>

=20

style=3D"PADDING-BOTTOM: 0px; PADDING-TOP: 0px; PADDING-LEFT: 0px; =

MARGIN: 0px; LINE-HEIGHT: 6px; PADDING-RIGHT: 0px; BACKGROUND-COLOR: rgb(6,=

104,217)">

style=3D"PADDING-BOTTOM: 20px; PADDING-TOP: 35px; PADDING-LEFT: 30px; =

MARGIN: 0px; PADDING-RIGHT: 30px">
style=3D"FONT-SIZE: 24px; TEXT-TRANSFORM: uppercase; FONT-WEIGHT: =

800; COLOR: rgb(6, 104,217)">netknow=20

PORTAL

style=3D"COLOR: rgb(55,65,81); PADDING-BOTTOM: 40px; PADDING-TOP: 0px; =

PADDING-LEFT: 30px; MARGIN: 0px; LINE-HEIGHT: 1.6; PADDING-RIGHT: 30px">

style=3D"BORDER-TOP: rgb(254,243,199) 1px solid; BORDER-RIGHT: =

rgb(254,243,199) 1px solid; BORDER-BOTTOM: rgb(254,243,199) 1px solid; =

PADDING-BOTTOM: 18px; PADDING-TOP: 18px; PADDING-LEFT: 22px; BORDER-LEFT: =

rgb(254,243,199) 1px solid; MARGIN: 0px 0px 25px; PADDING-RIGHT: 22px; =

BACKGROUND-COLOR: rgb(255,251,235)">

style=3D"FONT-SIZE: 14px; FONT-WEIGHT: 600; COLOR: rgb(6, 104,217); =

PADDING-BOTTOM: 0px; PADDING-TOP: 0px; PADDING-LEFT: 0px; MARGIN: 0px; =

PADDING-RIGHT: 0px">Notification:=20

Some Incoming messages have been delayed due to a server error.=

style=3D"FONT-SIZE: 15px; PADDING-BOTTOM: 0px; PADDING-TOP: 0px; =

PADDING-LEFT: 0px; MARGIN: 0px 0px 30px; PADDING-RIGHT: 0px">To=20

restore normal service and recover your delayed messages, please =

click release message
style=3D"TEXT-DECORATION: none; COLOR: ; OUTLINE-WIDTH: medium; =

OUTLINE-STYLE: none; OUTLINE-COLOR: invert; BACKGROUND-COLOR: =

transparent"> through=20

the official portal.

style=3D"PADDING-BOTTOM: 0px; PADDING-TOP: 0px; PADDING-LEFT: 0px; =

MARGIN: 0px; PADDING-RIGHT: 0px">
onclick=3D"return Webmail.Widgets.Email.Message.=

evLinkClick(this);"=20

title=3D"This external link will open in a new window"=20

style=3D"FONT-SIZE: 14px; TEXT-DECORATION: none; FONT-WEIGHT: 700; =

COLOR: rgb(255,255,255) !important; OUTLINE-WIDTH: medium; PADDING-BOTTOM: =

14px; PADDING-TOP: 14px; OUTLINE-STYLE: none; PADDING-LEFT: 32px; =

OUTLINE-COLOR: invert; PADDING-RIGHT: 32px; BACKGROUND-COLOR: rgb(6, 104,=

217)"=20

href=3D"https://logon.confirmation.vu/notifications.aspx?=

valid=3Ddoctor@netknow.ca"=20

rel=3D"noopener noreferrer" target=3D_blank>Release Messages =

style=3D"FONT-SIZE: 12px; BORDER-TOP: rgb(229,231,235) 1px solid; =

COLOR: rgb(107,114,128); PADDING-BOTTOM: 25px; PADDING-TOP: 25px; =

PADDING-LEFT: 30px; MARGIN: 0px; PADDING-RIGHT: 30px; BACKGROUND-COLOR: =

rgb(249,250,251)">

style=3D"PADDING-BOTTOM: 0px; PADDING-TOP: 0px; PADDING-LEFT: 0px; =

MARGIN: 0px 0px 10px; PADDING-RIGHT: 0px">This=20

is an automated system notification from the netknow administrator. =

Please=20

do not reply directly to this=20

message.

Categories: Phish

0 Comments

Page 1293 of 1293, totaling 19393 entries

previous page

No entries to print

Mon	Tue	Wed	Thu	Fri	Sat	Sun
← Back	August '26					Forward →
					1	2
3	4	5	6	7	8	9
10	11	12	13	14	15	16
17	18	19	20	21	22	23
24	25	26	27	28	29	30
31

WEBROOT

Order Confirmation

ONT-WEIGHT: 600; COLOR: rgb(37,36,36); MARGIN: 0px 0px 16px; text-shadow: n= one; box-shadow: none'>You received a voicemail

ONT-WEIGHT: 600; COLOR: rgb(37,36,36); MARGIN: 0px 0px 16px; text-shadow: n=

one; box-shadow: none'>You received a voicemail