NetKnow Corporate Blog

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Sat, 20 Jun 2026 14:07:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wb1xi-00000000OK8-0GSa

for dave@doctor.nl2k.ab.ca;

Sat, 20 Jun 2026 14:06:42 -0600

Resent-From: The Doctor

Resent-Date: Sat, 20 Jun 2026 14:06:41 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-lf1-f65.google.com ([209.85.167.65]:47506)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wb1ir-00000000MaZ-3oHl

for doctor@netknow.ca;

Sat, 20 Jun 2026 13:51:31 -0600

Received: by mail-lf1-f65.google.com with SMTP id 2adb3069b0e04-5aa5edf347eso2202149e87.3

for ; Sat, 20 Jun 2026 12:50:31 -0700 (PDT)

ARC-Seal: i=1; a=rsa-sha256; t=1781985024; cv=none;

d=google.com; s=arc-20240605;

b=CgHgOdMkIAfWGrKET1xguDXzjLcRuiZeFjmntm9GdFnSf7gAdKjj+rO2wqSjy4JfLM

8fMJdv24ijIVlVVbpDVw5hFA9+d+60MqBr4OW+R21dOH21HHRvf6nvJHdhp/wHks8+Vo

JwvPFP3jVn0wjgUrxlq4gRQuKo/4ajTZrJTfH18d0U8Zf4j8VtTvtGyKW9aFTROQyYC1

ST+KZTYHDBHyghSdw3YstNR8lGbd3Cjs2vZEM/VyurkJ5NesRH/VE5xVPjafpU8g+IsE

vUsbsgyl7e79zNxFHI8bZmTO/naA6lvbZ+J9hvf75vMxfYI+CaERGh4QyctjzlXZxy1M

g1zQ==

ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20240605;

h=to:subject:message-id:date:from:reply-to:mime-version

:dkim-signature;

bh=em15lI1mKGVSJdQKVfxc2yi8Xza15rcXvqiJNGJzY8s=;

fh=eLgWUN41aUnp69WnMTguA4LkmrRBey2PdCsLZfURz9w=;

b=MztDUIYPZ7CbkrIBMm20edXWfrirv+ikoaH5FyNaDjGBrCzsH3m+LByapt0P0zVpOx

RVRDKWv/Nk1J67BlEEKEyBWPv10dY/NPVjAbHpaAbNHeIw7ZhGX6Fdmc7LphZFMW3bQg

ickHFNYUkBn3KktfS8R6H5CtLnRb4Tn1bF+hdhK4Me30Bwa7oaNyAeRYXvDIIRnmqKWJ

v1aKOyBZxfWe7kqucjR4yfGXC+EFYd6Q0/fNMCO8UFXcL4388BNdhBTYOpbqvSXlx+Ab

zF+LhZuzhDm4upnDYRKkSl1NqR6noVs3WubZeTW+FPUYWelrO9JldWqXykBfnX2sNqGn

G6uA==;

darn=netknow.ca

ARC-Authentication-Results: i=1; mx.google.com; arc=none

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=gmail.com; s=20251104; t=1781985024; x=1782589824; darn=netknow.ca;

h=to:subject:message-id:date:from:reply-to:mime-version:from:to:cc

:subject:date:message-id:reply-to;

bh=em15lI1mKGVSJdQKVfxc2yi8Xza15rcXvqiJNGJzY8s=;

b=O9FcDF/fGN3YJm1tj4wKgLsQE7ixrduU9lCWYOTX6dwhvYZUOu0ITGpAy6SZNS3Syy

GqbU7y+OOu6+3P1zSlIdvo2muObs75pH2TydS0C64nDxC0N+E7qa0IbzoeaajxOWm1Rr

1bljKii4z+YHPIGV/8wULSpIR0/NI68+LhCxg+HOuK+MtCbYtffTYkqaviLESxQevfUg

N0APOL6YOG/pScBlLfXYrE+8LHpRUfFol3JDDrMM2WqbAKIpYZAo7NC2Ep/C8cfdtINx

9m671so4dxKbBwm6s86/uScprxKk6dDKyQn5lU8IssrwIsU2rGoJa99/XW8Plg6Q3YUs

1N2Q==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20251104; t=1781985024; x=1782589824;

h=to:subject:message-id:date:from:reply-to:mime-version:x-gm-gg

:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to;

bh=em15lI1mKGVSJdQKVfxc2yi8Xza15rcXvqiJNGJzY8s=;

b=fJ4yIfO0JNN5lIiflUr71uq58SU5CTNVWM+EDo9Tv1ViueRIVI9L3K/n2hijy0xUWh

XxXEV0Byk8gVSHKmKMbW+qe2ftl4BIoJsqGC1Icm4p2N7+sw4NA7QYYVKUvETSDH8d5D

/UNv5iPfzcV0gzfZfoKP744G0QFCvidMmNC3AF/ctVzPFtg0poUKJ8uGvtXJjMOIE5/L

nUkKppylCDl5l8b2LMIpshf1OBMSSfE20CjK4hP8avt8OptX3r1U9nunBty6zofJG6tg

+gNm2LkLSH4s69RQSmIh0IFMdR44CYOQm2SBWhJfoB9YmsVHQdPwzqQfk89O/pckWOqg

6XqQ==

X-Forwarded-Encrypted: i=1; AFNElJ9fMhwbuiUHBcl7JMpZ6RKKF2eccoQLGRdITecPp/qTJK99pcrLXcUTF1vrtGV9YcWrqjVi0SU=@netknow.ca

X-Gm-Message-State: AOJu0YxP5W145a3lO30vLW7PNMpjIjhxX6CE8OHl8UFE15yOZr48O2Kb

neNBNLy2n8x0k+Y1YXX2vIP9qKPufLr8HVSvhKFsjDRXcoxIqg6RQUqqxaceaJzhV0qyk8sIENq

XVuCPD+hDj1x1xMCEYMXD4utg/YbJz3X6uLI5Pxv5ag==

X-Gm-Gg: AfdE7cl0lRwjoiRYHf6igIocFieHyMl9MmIT9Mcmv/HblQMVQsEmvbsIBVIqGBUhY9f

5vPQDelT5EAXH8HBqXol7d9bvpiN6amfDTr6rtxx6Iic/jCgrKL2FXmK0sYhM5bi5YIhjltn+t/

XipsPIqTcQ+ASsmXk8/Pfpsrv5RPnsfmap7V6IxGzWAUR3TqgWhV3zCuOKnMFM2vEqcrA/6aPJ+

D52/DqFNXNbMoKDUnV+aM8ESq5w6TFRjc08kSTJDdiSc71kB/8qXb3CQETQfVqAKvXGyP8Stg==

X-Received: by 2002:a2e:a9a5:0:b0:396:9966:50cf with SMTP id

38308e7fff4ca-3998e4092d7mr16710201fa.9.1781984716204; Sat, 20 Jun 2026

12:45:16 -0700 (PDT)

MIME-Version: 1.0

Reply-To: citibank.co.usa@gmail.com

From: Michael Corbat

Date: Sat, 20 Jun 2026 12:44:41 -0700

X-Gm-Features: AVVi8Cee6rCzcsUfU88IFtFAIMaK7YU6-UAmDxNctI4bo92nl-eibb70H8m3-qc

Message-ID:

Subject: Compensation Award

To: undisclosed-recipients:;

Content-Type: multipart/alternative; boundary="000000000000012f4e0654b4a67c"

Bcc: doctor@netknow.ca

X-Spam_score: 16.4

X-Spam_score_int: 164

X-Spam_bar: ++++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Subject: Midland Financial Recovery Bureau – Victim Compensation

Program Compensation Award: USD $1,500,000.00 Reference ID: MF1122-CRX00491

Address: 8600 Westfield Avenue, Suite 210, Houston, TX 77 [...]



Content analysis details: (16.4 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[209.85.167.65 listed in will-spam-for-food.eu.org]

[209.85.167.65 listed in will-spam-for-food.eu.org]

[209.85.167.65 listed in will-spam-for-food.eu.org]

[209.85.167.65 listed in will-spam-for-food.eu.org]

[209.85.167.65 listed in will-spam-for-food.eu.org]

[209.85.167.65 listed in will-spam-for-food.eu.org]

[209.85.167.65 listed in will-spam-for-food.eu.org]

[209.85.167.65 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[209.85.167.65 listed in dnsbl.ahbl.org]

[209.85.167.65 listed in dnsbl.ahbl.org]

[209.85.167.65 listed in dnsbl.ahbl.org]

[209.85.167.65 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[209.85.167.65 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[209.85.167.65 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[209.85.167.65 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[209.85.167.65 listed in dnsbl.ahbl.org]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[209.85.167.65 listed in list.dnswl.org]

-0.0 SPF_PASS SPF: sender matches SPF record

1.5 GR_DOMAIN_UNDISC1 To contains undisclosed recipient (undisc)

0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider

[jeegael37(at)gmail.com]

1.0 FORGED_GMAIL_RCVD 'From' gmail.com does not match 'Received' headers

0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends in

digit

[jeegael37(at)gmail.com]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

2.5 US_DOLLARS_3 BODY: Mentions millions of $ ($NN,NNN,NNN.NN)

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[209.85.167.65 listed in wl.mailspike.net]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[209.85.167.65 listed in bl.score.senderscore.com]

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 LOTS_OF_MONEY Huge... sums of money

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

1.0 FREEMAIL_REPLYTO Reply-To/From or Reply-To/body contain different

freemails

2.8 UNDISC_FREEM Undisclosed recipients + freemail reply-to

0.0 MONEY_FREEMAIL_REPTO Lots of money from someone using free email?

0.0 T_FILL_THIS_FORM_SHORT Fill in a short form with personal information

0.4 FILL_THIS_FORM_FRAUD_PHISH Answer suspicious question(s)

0.0 T_FILL_THIS_FORM_FRAUD_PHISH Answer suspicious question(s)

1.3 MONEY_FORM_SHORT Lots of money if you fill out a short form

2.6 UNDISC_MONEY Undisclosed recipients + money/fraud signs

2.0 ADVANCE_FEE_2_NEW_MONEY Advance Fee fraud and lots of money

0.0 MONEY_FRAUD_5 Lots of money and many fraud phrases

0.0 FORM_FRAUD_5 Fill a form and many fraud phrases

Subject: {SPAM?} Compensation Award



--000000000000012f4e0654b4a67c

Content-Type: text/plain; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable



Subject: Midland Financial Recovery Bureau =E2=80=93 Victim Compensation Pr=

ogram

Compensation Award: USD $1,500,000.00

Reference ID: MF1122-CRX00491

Address: 8600 Westfield Avenue, Suite 210, Houston, TX 77040, USA



Dear Recipient,



We are contacting you as a listed beneficiary in a federally supported

restitution initiative established to compensate victims of financial

fraud. This action follows the prosecution and sentencing of

individuals=E2=80=94namely Andrew Collins, Eric Mateo, and Linda Frost=E2=

=80=94who were

recently convicted of operating fraudulent schemes while posing as

representatives of financial and government institutions.



As part of the outcome, the Midland Financial Recovery Bureau, in

collaboration with U.S. regulatory authorities, has approved a compensation

payment of USD $1,500,000.00 to be issued in your name. Disbursement will

be made through a secure ATM-enabled payment card, and all standard

transaction and delivery costs will be covered by the issuing entity.



To confirm your eligibility and initiate the processing of your payment,

please provide the following information for verification and compliance

review:



Full Legal Name



Residential Mailing Address



Current Occupation



Active Contact Number



Government-Issued Photo Identification (valid)



Please be advised that a nominal Processing and Verification Fee will be

required to complete the official endorsement and release of funds. There

will be no additional fees once this has been fulfilled.



This compensation program is part of a broader effort to assist fraud

victims and reinforce public confidence in financial institutions.



Sincerely,

Mr. Thomas E. Ralston

Director, Compensation Oversight Division

Midland Financial Recovery Bureau



--000000000000012f4e0654b4a67c

Content-Type: text/html; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

0.0 LOTS_OF_MONEY Huge... sums of money

0.0 T_FILL_THIS_FORM_SHORT Fill in a short form with personal information

1.0 FREEMAIL_REPLYTO Reply-To/From or Reply-To/body contain different

freemails

0.0 T_FILL_THIS_FORM_FRAUD_PHISH Answer suspicious question(s)

1.3 MONEY_FORM_SHORT Lots of money if you fill out a short form

2.8 UNDISC_FREEM Undisclosed recipients + freemail reply-to

0.4 FILL_THIS_FORM_FRAUD_PHISH Answer suspicious question(s)

0.0 MONEY_FREEMAIL_REPTO Lots of money from someone using free email?

0.0 MONEY_FRAUD_5 Lots of money and many fraud phrases

2.6 UNDISC_MONEY Undisclosed recipients + money/fraud signs

2.0 ADVANCE_FEE_2_NEW_MONEY Advance Fee fraud and lots of money

0.0 FORM_FRAUD_5 Fill a form and many fraud phrases

Subject: {SPAM?} Compensation Award



--000000000000012f4e0654b4a67c

Content-Type: text/plain; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable



Subject: Midland Financial Recovery Bureau =E2=80=93 Victim Compensation Pr=

ogram

Compensation Award: USD $1,500,000.00

Reference ID: MF1122-CRX00491

Address: 8600 Westfield Avenue, Suite 210, Houston, TX 77040, USA



Dear Recipient,



We are contacting you as a listed beneficiary in a federally supported

restitution initiative established to compensate victims of financial

fraud. This action follows the prosecution and sentencing of

individuals=E2=80=94namely Andrew Collins, Eric Mateo, and Linda Frost=E2=

=80=94who were

recently convicted of operating fraudulent schemes while posing as

representatives of financial and government institutions.



As part of the outcome, the Midland Financial Recovery Bureau, in

collaboration with U.S. regulatory authorities, has approved a compensation

payment of USD $1,500,000.00 to be issued in your name. Disbursement will

be made through a secure ATM-enabled payment card, and all standard

transaction and delivery costs will be covered by the issuing entity.



To confirm your eligibility and initiate the processing of your payment,

please provide the following information for verification and compliance

review:



Full Legal Name



Residential Mailing Address



Current Occupation



Active Contact Number



Government-Issued Photo Identification (valid)



Please be advised that a nominal Processing and Verification Fee will be

required to complete the official endorsement and release of funds. There

will be no additional fees once this has been fulfilled.



This compensation program is part of a broader effort to assist fraud

victims and reinforce public confidence in financial institutions.



Sincerely,

Mr. Thomas E. Ralston

Director, Compensation Oversight Division

Midland Financial Recovery Bureau



--000000000000012f4e0654b4a67c

Content-Type: text/html; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Sat, 20 Jun 2026 14:07:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wb1xr-00000000OLU-325D

for dave@doctor.nl2k.ab.ca;

Sat, 20 Jun 2026 14:06:51 -0600

Resent-From: The Doctor

Resent-Date: Sat, 20 Jun 2026 14:06:51 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-lj1-f193.google.com ([209.85.208.193]:47268)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wb1jr-00000000Mfk-3ZSU

for doctor@nk.ca;

Sat, 20 Jun 2026 13:52:33 -0600

Received: by mail-lj1-f193.google.com with SMTP id 38308e7fff4ca-39677aed4d3so26710671fa.2

for ; Sat, 20 Jun 2026 12:51:37 -0700 (PDT)

ARC-Seal: i=1; a=rsa-sha256; t=1781985090; cv=none;

d=google.com; s=arc-20240605;

b=MLDZl2NPuQnb3G9u4TG9WsQDvzeh8EmnxT2dX3mNHVK6QB8BJ/ItvVG96x2DbgEdAX

MrbugZM7tJ9kaouzlMlv8C+GPOzFXcuPmfxCJeuJEeuOCheD5I+BwDH18JaWKdunb0bf

Dwrivb3/0C2QLsU90MKqNYMZsTuykmP3dvafr+/rPcbfqB1XmpgS/8PBPWltaDWJouV+

JIuot9uQMDamLjgsz5P30W7uAOWJVY8ZZ5ovS9xOrB4QweAlv60trcyNObMBH3UrrKK+

bZc9PPN7G44BNRDPDl8MGfh/X/U64KslmjweBfVVMnBhfdcQK7aUVbbsGGi3v+xn4ZAz

EYAw==

ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20240605;

h=to:subject:message-id:date:from:reply-to:mime-version

:dkim-signature;

bh=em15lI1mKGVSJdQKVfxc2yi8Xza15rcXvqiJNGJzY8s=;

fh=2/qc8Opyk4bxvL+K8xyZSX9PXUMx/90mitUCvHIx4UI=;

b=YJPDp+M8LmCDddsbiz3ebGAYVoU/pm/FMnKQ3sxt5l9mZMYwW9hIoQ/ygye4H6Fl7W

wfTBrX0NXgGEL5986NEYavaGJYXa2CJVa72B3d30LyJKxhYnbmJkB/eNV0XLPf2m6NsG

+QsRxquvg/PCa4q0YM/mSuhJxriehTZjXVboEZ9qjU/D3NEicR0hxxOXLWJSRJw57+6f

VuzLaacKH9f2cfKu96fZHrfEFcf7Q7UTbItCrKisR2Jf/+X3rTUaqxZq6lLKT9WNTpRs

s6nv+30OFKbY2Am8F49N8M+eelfoHPMOtKMeZ18Q8f88Spr4xDX4X+uKSmd/XuG8gLdo

/xhw==;

darn=nk.ca

ARC-Authentication-Results: i=1; mx.google.com; arc=none

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=gmail.com; s=20251104; t=1781985090; x=1782589890; darn=nk.ca;

h=to:subject:message-id:date:from:reply-to:mime-version:from:to:cc

:subject:date:message-id:reply-to;

bh=em15lI1mKGVSJdQKVfxc2yi8Xza15rcXvqiJNGJzY8s=;

b=mrdNhgmFgDJ6Rz3NrVGJBzeSB1WKgSIrtciQQbH+SjLSkubTWx3a9laTQYwghA/+jG

DteRuHLH5WvCb3VArAwEdh16V9kiY7db3junZMCCbLGqvCryqEuksPP8XdOMD9X3VsKh

TfZ9cYCN6ZDC7FqhsmB8HS8CwpyNObHz+X+D38m4p59BOPbFxaS8erWEfY2jKV1FQULp

r8OW2jz6p+MCZ4Iff+tK2n6GVU2Ist6spj5n4CHthyav+WT5eM4JOFFdCfx8DrfIcHTq

5d8MhhOra48Clb12TIPFTofbARQjoxDLQbzrXl5VlqFsFxJCq/qZSiTf+fCVs3gbI2n/

n6lg==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20251104; t=1781985090; x=1782589890;

h=to:subject:message-id:date:from:reply-to:mime-version:x-gm-gg

:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to;

bh=em15lI1mKGVSJdQKVfxc2yi8Xza15rcXvqiJNGJzY8s=;

b=bzmjaV8C8CIfmVMu8v3Wngkv+kA2gWc1THBkyiibux5BD/JKilpb0LwYD3YM9HdxL+

5GeUJM/6AztW05P5gBo9/eL4ZXA+z9PGhw/ZqIWDl4G5M4uHTgt9xXrXB+i5nCc+HQlZ

9+XoGsA43K+CQ5iFO4cAw8F8fsCiP2+eczJOeCYbrRDJ5V0PAKyw2oUATYZm4ksfHMr5

cxFVd1Vc06Ht7alON5tKV4blyGhq5aBhzrNBvGrUXM0jbnc2OgfDPxVHG5lVYu/dv5hQ

akUb0Ll/ZEHrwGSfPcdLIqagXdAbqOh0tfkmmZg6zV/h1ekxMfy2JPusKG+d4Sib3SWt

5foA==

X-Forwarded-Encrypted: i=1; AFNElJ/WfCd3aPEmfvzkskvVsthnNEiRZ6Z0GFvQASC8Oza0pAIFvg8t2qQb96tq186cuZ4hd8lLILA=@nk.ca

X-Gm-Message-State: AOJu0Yy9uYiBNHwdzKUNXgkcN7s1rxODaU9iaKPVwj1cOubfap3F2yPC

4LyBTqLPfRsXt8C2LShHY19jnoyjdDYTzxpPWMCShGKcCGChIEMFuakRYVtVFrE1oapFXdzLJ2L

6KfClzwgyNQEQDlVXfMeSrHSlw35ChoM=

X-Gm-Gg: AfdE7ckmayn7qAqPE8xAE1qHwP4zQagUQQ3oUKQNcs1LNZ8jWbWw3PFDk6JNZYYy6Kj

Mf44Ern/sdtdl+2rgLOSaEL3JDhIkV+e2fjBkf3AZtK6NI1lCzNDaMEwqGn+ViVhn09K3F63djx

gaU/VTl5t484juqSfSjd+km8Q+MBTG+0FMJ+PUbJCulnkPtmGfdFIX6YeWHmvMybOjSQZ6Eq/iQ

a5CmQy14y5Is0EootPq6mW/Eadxvg7pJeV9rFCyUrFXrOs/h8dVWMdfuVEZTrb8kF6Wowd/TEhW

y26u2xwM

X-Received: by 2002:a2e:a9a5:0:b0:396:9966:50cf with SMTP id

38308e7fff4ca-3998e4092d7mr16710201fa.9.1781984716204; Sat, 20 Jun 2026

12:45:16 -0700 (PDT)

MIME-Version: 1.0

Reply-To: citibank.co.usa@gmail.com

From: Michael Corbat

Date: Sat, 20 Jun 2026 12:44:41 -0700

X-Gm-Features: AVVi8Cee6rCzcsUfU88IFtFAIMaK7YU6-UAmDxNctI4bo92nl-eibb70H8m3-qc

Message-ID:

Subject: Compensation Award

To: undisclosed-recipients:;

Content-Type: multipart/alternative; boundary="000000000000012f4e0654b4a67c"

Bcc: doctor@nk.ca

X-Spam_score: 16.4

X-Spam_score_int: 164

X-Spam_bar: ++++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Subject: Midland Financial Recovery Bureau – Victim Compensation

Program Compensation Award: USD $1,500,000.00 Reference ID: MF1122-CRX00491

Address: 8600 Westfield Avenue, Suite 210, Houston, TX 77 [...]



Content analysis details: (16.4 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[209.85.208.193 listed in will-spam-for-food.eu.org]

[209.85.208.193 listed in will-spam-for-food.eu.org]

[209.85.208.193 listed in will-spam-for-food.eu.org]

[209.85.208.193 listed in will-spam-for-food.eu.org]

[209.85.208.193 listed in will-spam-for-food.eu.org]

[209.85.208.193 listed in will-spam-for-food.eu.org]

[209.85.208.193 listed in will-spam-for-food.eu.org]

[209.85.208.193 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[209.85.208.193 listed in dnsbl.ahbl.org]

[209.85.208.193 listed in dnsbl.ahbl.org]

[209.85.208.193 listed in dnsbl.ahbl.org]

[209.85.208.193 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[209.85.208.193 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[209.85.208.193 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[209.85.208.193 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[209.85.208.193 listed in dnsbl.ahbl.org]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[209.85.208.193 listed in list.dnswl.org]

-0.0 SPF_PASS SPF: sender matches SPF record

1.5 GR_DOMAIN_UNDISC1 To contains undisclosed recipient (undisc)

0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider

[jeegael37(at)gmail.com]

1.0 FORGED_GMAIL_RCVD 'From' gmail.com does not match 'Received' headers

0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends in

digit

[jeegael37(at)gmail.com]

2.5 US_DOLLARS_3 BODY: Mentions millions of $ ($NN,NNN,NNN.NN)

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[209.85.208.193 listed in wl.mailspike.net]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[209.85.208.193 listed in bl.score.senderscore.com]

--000000000000f3d2300654b0a963

Content-Type: text/plain; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable



International Economic Stabilization Bureau (IESB)

Office of Global Restitution & Development

450 Constitution Avenue NW

Washington, D.C. 20530

United States



Grant Approval Notification



Global Recovery & Assistance Program

(Ref: IESB-447521-GRAP)



Dear Beneficiary,



The International Economic Stabilization Bureau (IESB) is pleased to notify

you of your approval for a Global Recovery Grant. This program was

established in partnership with the World Development Cooperative and the

Universal Economic Relief Fund to provide direct financial assistance to

individuals and communities adversely affected by global economic

disruptions and financial misconduct.



Program Background

Following comprehensive investigations conducted by international

regulators, significant assets were seized from dismantled fraudulent

operations across multiple continents. These funds have been allocated to

the Global Recovery & Assistance Program. After an independent audit and

eligibility review, your profile has been approved to receive a restitution

grant of US $1,500,000 (One Million, Five Hundred Thousand United States

Dollars).



Disbursement Method

Funds will be distributed via a secure Digital Payment Certificate linked

to the International Settlement Network, ensuring accessibility and secure

transfer in more than 120 countries.



Verification Process =E2=80=94 Required Action

To complete your registration and initiate the release of your grant,

kindly provide the following details:



Full Name (as listed on official records)



Residential Address & Country of Residence



Occupation/Field of Work



Direct Contact Number



A copy of any valid Government-issued Identification Document



Program Oversight & Certification

This notification is issued under the supervision of:



Dr. Maria Ellington =E2=80=93 Director, International Economic Stabilizatio=

n Bureau



Mr. Daniel Kovacs =E2=80=93 Chief Administrator, World Development Cooperat=

ive



Ms. Sophia Grant =E2=80=93 Global Treasurer, Universal Economic Relief Fund



Please respond promptly with the requested information to secure your grant

disbursement.



Sincerely,

Dr. Maria Ellington

Director, International Economic Stabilization Bureau (IESB)



--000000000000f3d2300654b0a963

Content-Type: text/html; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Sat, 20 Jun 2026 09:07:00 -0600

Received: from mail-ot1-f66.google.com ([209.85.210.66]:43210)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1waxGi-00000000IdY-3vqA

for dave@doctor.nl2k.ab.ca;

Sat, 20 Jun 2026 09:06:10 -0600

Received: by mail-ot1-f66.google.com with SMTP id 46e09a7af769-7e6deacafa8so2168172a34.0

for ; Sat, 20 Jun 2026 08:05:13 -0700 (PDT)

ARC-Seal: i=1; a=rsa-sha256; t=1781967907; cv=none;

d=google.com; s=arc-20240605;

b=NDEvGn6qUfKh88S8K/v+d19ovnl8FyNuFZKuEw9LCKL3k+Y2zTDb9gWNSjHVxG2JMV

7UW4PwdmQtTSNO2JcvaD/9BXAt4laWmJ4F6+Z1QzOXC/iRKomczikp8gp/ZVzcSJZYJC

kWrWUCLe6+tOqyr1e/lYeampNqPJ4u3Hp+4t8u8JJN6GlFaXCAjwKS5XSewaSJ12NEDi

EplGW/QydCRdxH5JyKeYTuXeda7AnROWhrNiMap9O8MVyeCltdC8TNjs9wobESPbpYfc

XW6B8uIPQuVJqMjXudwN0TeNDX/7IS0kg7aL6cqoAfGLX75QVdOyXjYtnAEuGNX53QyY

0ing==

ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20240605;

h=to:subject:message-id:date:from:reply-to:mime-version

:dkim-signature;

bh=NRa1yV8ekP8Z9Ym8P8T/6j9ZFPN0sqmrapO9e9e2gIo=;

fh=xSOtv5ID8ogNOZSFpG+Q1yeX32V/4/vtEuW7J0Qqrdo=;

b=FvCf2HVu+4CtygWZCYnWAVPaN5j++oukt0as8oaOnmHooFKzTaHkNHk2DPziHU6SQZ

JjjABR93yZmEgJHWJ/mb1qzEYuRN37ZC36pPq5XvYLdtxDctWzPCdUeRrz0ZjCVqwHS3

/dasKQuS4qHfVotvOHiG1S7nqZ4ThzMG820KScfHxvq/bi/tj1y0AVHXA/oN1CIdSLqv

WRYAfxs1UOxjrTiSJo+UikFitSK5NFJSN6ANFq36AkncTKgog2lv7wnSO/arBemzz8N4

uep030wjMXCWc6EeVCwjyZKpEyNGTw1YQXlSvupHa7E6atzObQMkmxySeE1at3RqDdsw

THGA==;

darn=doctor.nl2k.ab.ca

ARC-Authentication-Results: i=1; mx.google.com; arc=none

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=gmail.com; s=20251104; t=1781967907; x=1782572707; darn=doctor.nl2k.ab.ca;

h=to:subject:message-id:date:from:reply-to:mime-version:from:to:cc

:subject:date:message-id:reply-to;

bh=NRa1yV8ekP8Z9Ym8P8T/6j9ZFPN0sqmrapO9e9e2gIo=;

b=O7CgvYJKNr23cjxCDwTZDpAp5dUisf4E7yI3BC8ree8qSMQwyv2Tns4fmAmmOUup4P

dW7D6hnphr/ooCnqQvmd3uFVeOCC4++TzwnkjWi/8PZXxbws6rjuFFkr+BxHvjhFVQwW

QS0r3V/YzhO4qN9S/m9vRG5l2iaDSZ8zjjrl1p+1rFL92YnnnqcKeZIryQx6km426oS2

0gzNdSy94gS4dC2HXKeWq9QGmYAfJDXhUvYNUU62OgodjsXs76pYAo5Rhqs0/9fV6YcO

cAA73m8Vj5Nqog4ffuY/qqxPPdN7t6pAfrI+PLIQTZEsKHE2x0cQ5C/lCKCS3wrmkHqk

eS8w==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20251104; t=1781967907; x=1782572707;

h=to:subject:message-id:date:from:reply-to:mime-version:x-gm-gg

:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to;

bh=NRa1yV8ekP8Z9Ym8P8T/6j9ZFPN0sqmrapO9e9e2gIo=;

b=dUG5O1WsSGcq+EmeAX8qIlY4A9fuOmGTn1mWIOGfQ2rTWzTHzk7ZtA7FKsb9JiqZIO

T5CDeStQwsKcdUOf/NDzKaYz95IaapM+uhQ2QBoACZ9vzeuHiVYpBsl7KLDGAm7V8uBu

IpzUwewN0OyUlmqTNOaNtjhf6Fv/U6ylUtB2URYvMLQGqow5K4c9Gf5EJaaG0Xo2Xg1s

UIcTU+Iiy9LyBjWPZ9LR0CkIxgTVAo/855gq5ZElR6M/cEHsXvrYMj5T8P1Ri3TXS47r

cl86ayyyS++J/E+2FGgOa4zBNg5ULdiwMH5NlaBWXSRcjsD9JK+GS8Lk/Vipo3+CPyiB

J/Yw==

X-Forwarded-Encrypted: i=1; AFNElJ8QAO+zEhVX6UVLa2fEG26UoC2vL2Br38Jhdk/uAp626srGv+d/Kg32CTdBMQWb1YDtPlgl@doctor.nl2k.ab.ca

X-Gm-Message-State: AOJu0YwSrkkIk6J8CPdTAOtzjymXprPr/WCbgwRzLhdQtnOaSOBRvjk5

/rcis/qsFMCQIZcpreUQf0it3wIMHT3TlBI1A7evKX3W4Id6MrsL/NFKsJtaNiMRbTS6twWcqVl

kT2U6azfWBwnyEk3IgXCaJ26uM6p7PUpqh5NzB2JG/A==

X-Gm-Gg: AfdE7clsxYdZ4Y9Ggp/u4EYavjwKSoGnh9CbmrZ5o0PehOzKvm7FHwgTvoj2WBRXklI

EQDWxvPh4/KgkW2uXaGL+8BY7JT82taTo3ZbZsMNeiHlXJbZaoBKJv8hI/g6oc5dg7NORzXowX7

Voa7Iuo2W0WQE46q9BYxGLJmQspA7NA493ChuD1EvR5KRwYR0waqLX1OwiX9B3CyT/PBXzQuKiS

mFEAqs0qm9WKZdGqopPISIF7tClUye435VnInjcnu27TWqA08rirsmj7kELc6R/lsGasEBhsw==

X-Received: by 2002:a05:6820:220f:b0:696:72e9:f92e with SMTP id

006d021491bc7-6a0da01ce54mr4937306eaf.10.1781967602568; Sat, 20 Jun 2026

08:00:02 -0700 (PDT)

MIME-Version: 1.0

Reply-To: citibank.co.usa@gmail.com

From: "Dr. Michael Faulkender"

Date: Sat, 20 Jun 2026 07:59:28 -0700

X-Gm-Features: AVVi8CdZUg8ePfOUFljzVOOHVqdCSAwhbCy4T3INsbk0jtcUWkJBKRfdiEPE5bw

Message-ID:

Subject: Global Recovery & Assistance Program

To: undisclosed-recipients:;

Content-Type: multipart/alternative; boundary="000000000000f3d2300654b0a963"

Bcc: dave@doctor.nl2k.ab.ca

X-Spam_score: 21.5

X-Spam_score_int: 215

X-Spam_bar: +++++++++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: International Economic Stabilization Bureau (IESB) Office

of Global Restitution & Development 450 Constitution Avenue NW Washington,

D.C. 20530 United States Grant Approval Notification Global Recovery & Assistance

Program (Ref: IESB-447521-GRAP)



Content analysis details: (21.5 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[209.85.210.66 listed in will-spam-for-food.eu.org]

[209.85.210.66 listed in will-spam-for-food.eu.org]

[209.85.210.66 listed in will-spam-for-food.eu.org]

[209.85.210.66 listed in will-spam-for-food.eu.org]

[209.85.210.66 listed in will-spam-for-food.eu.org]

[209.85.210.66 listed in will-spam-for-food.eu.org]

[209.85.210.66 listed in will-spam-for-food.eu.org]

[209.85.210.66 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[209.85.210.66 listed in dnsbl.ahbl.org]

[209.85.210.66 listed in dnsbl.ahbl.org]

[209.85.210.66 listed in dnsbl.ahbl.org]

[209.85.210.66 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[209.85.210.66 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[209.85.210.66 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[209.85.210.66 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[209.85.210.66 listed in dnsbl.ahbl.org]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[209.85.210.66 listed in list.dnswl.org]

-0.0 SPF_PASS SPF: sender matches SPF record

1.5 GR_DOMAIN_UNDISC1 To contains undisclosed recipient (undisc)

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-0.0 RCVD_IN_MSPIKE_H3 RBL: Good reputation (+3)

[209.85.210.66 listed in wl.mailspike.net]

0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider

[samuelbenjamin.ou(at)gmail.com]

2.5 MILLION_USD BODY: Talks about millions of dollars

3.5 DEAR_BENEFICIARY BODY: Dear Beneficiary:

2.5 US_DOLLARS_3 BODY: Mentions millions of $ ($NN,NNN,NNN.NN)

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[209.85.210.66 listed in bl.score.senderscore.com]

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

0.8 SARE_FROM_SPAM_WORD3 I don't know people named this!

0.0 T_HK_NAME_FM_DR No description available.

0.0 LOTS_OF_MONEY Huge... sums of money

-0.0 RCVD_IN_MSPIKE_WL Mailspike good senders

1.0 FREEMAIL_REPLYTO Reply-To/From or Reply-To/body contain different

freemails

0.0 FILL_THIS_FORM Fill in a form with personal information

2.8 UNDISC_FREEM Undisclosed recipients + freemail reply-to

0.0 MONEY_FORM Lots of money if you fill out a form

0.0 MONEY_FREEMAIL_REPTO Lots of money from someone using free email?

2.6 UNDISC_MONEY Undisclosed recipients + money/fraud signs

3.1 MONEY_FRAUD_3 Lots of money and several fraud phrases

Subject: {SPAM?} Global Recovery & Assistance Program

--000000000000f3d2300654b0a963

Content-Type: text/plain; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable



International Economic Stabilization Bureau (IESB)

Office of Global Restitution & Development

450 Constitution Avenue NW

Washington, D.C. 20530

United States



Grant Approval Notification



Global Recovery & Assistance Program

(Ref: IESB-447521-GRAP)



Dear Beneficiary,



The International Economic Stabilization Bureau (IESB) is pleased to notify

you of your approval for a Global Recovery Grant. This program was

established in partnership with the World Development Cooperative and the

Universal Economic Relief Fund to provide direct financial assistance to

individuals and communities adversely affected by global economic

disruptions and financial misconduct.



Program Background

Following comprehensive investigations conducted by international

regulators, significant assets were seized from dismantled fraudulent

operations across multiple continents. These funds have been allocated to

the Global Recovery & Assistance Program. After an independent audit and

eligibility review, your profile has been approved to receive a restitution

grant of US $1,500,000 (One Million, Five Hundred Thousand United States

Dollars).



Disbursement Method

Funds will be distributed via a secure Digital Payment Certificate linked

to the International Settlement Network, ensuring accessibility and secure

transfer in more than 120 countries.



Verification Process =E2=80=94 Required Action

To complete your registration and initiate the release of your grant,

kindly provide the following details:



Full Name (as listed on official records)



Residential Address & Country of Residence



Occupation/Field of Work



Direct Contact Number



A copy of any valid Government-issued Identification Document



Program Oversight & Certification

This notification is issued under the supervision of:



Dr. Maria Ellington =E2=80=93 Director, International Economic Stabilizatio=

n Bureau



Mr. Daniel Kovacs =E2=80=93 Chief Administrator, World Development Cooperat=

ive



Ms. Sophia Grant =E2=80=93 Global Treasurer, Universal Economic Relief Fund



Please respond promptly with the requested information to secure your grant

disbursement.



Sincerely,

Dr. Maria Ellington

Director, International Economic Stabilization Bureau (IESB)



--000000000000f3d2300654b0a963

Content-Type: text/html; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@nl2k.ab.ca

Delivery-date: Sat, 20 Jun 2026 09:08:00 -0600

Received: from mail-oi1-f195.google.com ([209.85.167.195]:43506)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1waxHj-00000000Ihs-13KW

for dave@nl2k.ab.ca;

Sat, 20 Jun 2026 09:07:12 -0600

Received: by mail-oi1-f195.google.com with SMTP id 5614622812f47-48670d35a87so2367654b6e.1

for ; Sat, 20 Jun 2026 08:06:16 -0700 (PDT)

ARC-Seal: i=1; a=rsa-sha256; t=1781967970; cv=none;

d=google.com; s=arc-20240605;

b=OGlom3+dDw9cLfBKuoQq/WESuZLwhPT7smN2UUeACAEkkAIkgoS65AXqpnbs1bxPjK

KK0rJsKHBjK/nzYUn15EB/06gGYNOmnKFVilJM4WX4rxW5snPcfr91SeKVi+sNh5TXZ3

5XfgXDPIWneQZpG8NLbQnidZJSqEhCD7hX3VIKRBsReC2Kz/Ll6qv2VRYeurV9KoUStE

RxdwW+Bn86BQgi9lgB07ul9PwsgrtggykuMK5o377VRAw8DSRAOkB0c5T/ctfGspwaT/

ykVcMLsAbwgkdFrNGlMltI8Ab/L6QWNsyf6Dox3qwoz3p0Sh42+gjn7mIfOAw2BzzrOv

ABZw==

ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20240605;

h=to:subject:message-id:date:from:reply-to:mime-version

:dkim-signature;

bh=NRa1yV8ekP8Z9Ym8P8T/6j9ZFPN0sqmrapO9e9e2gIo=;

fh=NfR8xDJjuLU8nXmj/yixzqcI+zCHIC1i/sDdVRnLoXs=;

b=lXdz3r7VtFCgYScFadzRDJ+g8UVkYLP7iX6MG0ox+sXSJn9VJlRlHp8sJ/6bvx51b2

ZJ643mp1Y19JE1KxDKJJ5qNPiDNHjVgVyfC0PWVryPi2ar8/99nknHjsJpecjpZ8Jk84

HKf0WA4NSuMehzJDKsPJEVcjJAyOxTNE4FNmBco2NY8gxOMwM2kDFLeld2kk/5ztf668

pLbpbqYPagVzMBax8gEXfj39Uk2vhmM40qNS7x/NyJvxaC5SQrhyq59XoB9oULWAc6yS

Hnpqgtkb3F/Qp8zi51x0Qxw8L6P3VJAFMCmIgQRwQyzN5FjlwFRfhg87mh5c6St/wVQ+

E4cg==;

darn=nl2k.ab.ca

ARC-Authentication-Results: i=1; mx.google.com; arc=none

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=gmail.com; s=20251104; t=1781967970; x=1782572770; darn=nl2k.ab.ca;

h=to:subject:message-id:date:from:reply-to:mime-version:from:to:cc

:subject:date:message-id:reply-to;

bh=NRa1yV8ekP8Z9Ym8P8T/6j9ZFPN0sqmrapO9e9e2gIo=;

b=XYBbAK2GUM4evCTKFzdquDdgTDV+CHW4SG54X/CUPVC7yeC1hpERVR1hILimCoU0jz

s0yNkxCCXc+JEhpgE1KnDBSjWnzgLewR4Ce1Dekjy3I/ESo6333zrmVzouEqdUYx4gOP

mJ8Wcp/9ZlLrZuJ7cIbwDPYZ8d/qZLaNM6SWmwh/CBWB60nLtxB/EAtZ1My14Xxah7Xk

VibxDXpObpcD2LnLOzfDgKSgV5Kqrk88MPRAH3YhVx5ycq4drqONd64CRLhhcdaNmAtb

XFWqTHsrZGSROYXk9tIt90BHYZcd3wno+5bucEgbbZf9wTK5nJZ0MVdzrJHYs+t7teAX

7XOQ==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20251104; t=1781967970; x=1782572770;

h=to:subject:message-id:date:from:reply-to:mime-version:x-gm-gg

:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to;

bh=NRa1yV8ekP8Z9Ym8P8T/6j9ZFPN0sqmrapO9e9e2gIo=;

b=Bwj/k8eBXDAf5LFjY+9I/Bv1zF4R7+7wCxnHzG4z0DvzPtT8trF9SBkuxiwL1OfcIe

rX15ODQQLkE5z/UyV4MkxVSQSzlU9XbjjV2tptl4ArvKkzfDsmu2SAdRCM50+k/ipD/G

dsqvCbcqFsSjG1cMOWAElJjDS/lpyamMzSFyDyxEiL88fk0B9u1g6MmpGpm7LngOnLrA

+IEef35Nw2pg9KG8LsW+uPK4zuvJZZKUm3oG5t09wQMUWoMx4AGhx3r9LzSfv11CP/43

0EMsppA+eCrvkkIAoKqq4NkBB7OnmsGc0kloX5md8srQ3by6+cjG1Queb3+TviHGeY3o

Ok5A==

X-Forwarded-Encrypted: i=1; AFNElJ/4O7FsaiKdd/DINNk1nF+sqdDZwJiPBnOc9sJ25kCjKGSybVprfF0bJRIgKC874qzHGdiH@nl2k.ab.ca

X-Gm-Message-State: AOJu0YwzfBop3LLZUafQ5RnI0SyqO+KVSzwHDJ8n+9ycGJLXgrQAf6D/

5TrhBMyq+nvA8+50qrVGGjz+fo5sLD7C+vahddELmug5AZeEZZeFt5fMlROM0eKJSkjMCrZLmxu

oxJNRYYvzBFMuDbBgeFdk6AH0oVEzU1g=

X-Gm-Gg: AfdE7ckwl/i1qduuO8C2XNgIyLWbfRKkt7+xtXvG+vqY/FfCpRYOvweEELvRefVMyzx

0c21u0b9qh7UAYxTf5BBGPnjVQwa40xd+HisG3JxN9T4UWsvwP3JBtpywe88nOeJHt7+PPqxnBV

QQ1xkXz9rMX882Z7dWmIui6JXPtqwClxUznrI+oE4wbCoCAUOCGs4WrhG6NfdigjiH85v9tM5CQ

oARqcg8NCXqObfu952royqcBSHD/KFHhLWCL3n0DN5zyljCAIz6jE6P8LZi7B/4f3ZlibHfsg==

X-Received: by 2002:a05:6820:220f:b0:696:72e9:f92e with SMTP id

006d021491bc7-6a0da01ce54mr4937306eaf.10.1781967602568; Sat, 20 Jun 2026

08:00:02 -0700 (PDT)

MIME-Version: 1.0

Reply-To: citibank.co.usa@gmail.com

From: "Dr. Michael Faulkender"

Date: Sat, 20 Jun 2026 07:59:28 -0700

X-Gm-Features: AVVi8CdZUg8ePfOUFljzVOOHVqdCSAwhbCy4T3INsbk0jtcUWkJBKRfdiEPE5bw

Message-ID:

Subject: Global Recovery & Assistance Program

To: undisclosed-recipients:;

Content-Type: multipart/alternative; boundary="000000000000f3d2300654b0a963"

Bcc: dave@nl2k.ab.ca

X-Spam_score: 21.4

X-Spam_score_int: 214

X-Spam_bar: +++++++++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: International Economic Stabilization Bureau (IESB) Office

of Global Restitution & Development 450 Constitution Avenue NW Washington,

D.C. 20530 United States Grant Approval Notification Global Recovery & Assistance

Program (Ref: IESB-447521-GRAP)



Content analysis details: (21.4 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[209.85.167.195 listed in will-spam-for-food.eu.org]

[209.85.167.195 listed in will-spam-for-food.eu.org]

[209.85.167.195 listed in will-spam-for-food.eu.org]

[209.85.167.195 listed in will-spam-for-food.eu.org]

[209.85.167.195 listed in will-spam-for-food.eu.org]

[209.85.167.195 listed in will-spam-for-food.eu.org]

[209.85.167.195 listed in will-spam-for-food.eu.org]

[209.85.167.195 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[209.85.167.195 listed in dnsbl.ahbl.org]

[209.85.167.195 listed in dnsbl.ahbl.org]

[209.85.167.195 listed in dnsbl.ahbl.org]

[209.85.167.195 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[209.85.167.195 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[209.85.167.195 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[209.85.167.195 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[209.85.167.195 listed in dnsbl.ahbl.org]

-0.0 SPF_PASS SPF: sender matches SPF record

1.5 GR_DOMAIN_UNDISC1 To contains undisclosed recipient (undisc)

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[209.85.167.195 listed in list.dnswl.org]

0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider

[samuelbenjamin.ou(at)gmail.com]

2.5 MILLION_USD BODY: Talks about millions of dollars

3.5 DEAR_BENEFICIARY BODY: Dear Beneficiary:

2.5 US_DOLLARS_3 BODY: Mentions millions of $ ($NN,NNN,NNN.NN)

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[209.85.167.195 listed in bl.score.senderscore.com]

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[209.85.167.195 listed in wl.mailspike.net]

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 LOTS_OF_MONEY Huge... sums of money

0.0 T_HK_NAME_FM_DR No description available.

0.8 SARE_FROM_SPAM_WORD3 I don't know people named this!

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

1.0 FREEMAIL_REPLYTO Reply-To/From or Reply-To/body contain different

freemails

0.0 MONEY_FREEMAIL_REPTO Lots of money from someone using free email?

2.8 UNDISC_FREEM Undisclosed recipients + freemail reply-to

0.0 FILL_THIS_FORM Fill in a form with personal information

0.0 MONEY_FORM Lots of money if you fill out a form

3.1 MONEY_FRAUD_3 Lots of money and several fraud phrases

2.6 UNDISC_MONEY Undisclosed recipients + money/fraud signs

Subject: {SPAM?} Global Recovery & Assistance Program

Content-Type: multipart/alternative;

boundary="_000_TYSPR01MB635814C750405026C09127B6D3E12TYSPR01MB6358apcp_"

MIME-Version: 1.0

X-OriginatorOrg: outlook.com

X-MS-Exchange-CrossTenant-AuthAs: Internal

X-MS-Exchange-CrossTenant-AuthSource: TYSPR01MB6358.apcprd01.prod.exchangelabs.com

X-MS-Exchange-CrossTenant-RMS-PersistedConsumerOrg: 00000000-0000-0000-0000-000000000000

X-MS-Exchange-CrossTenant-Network-Message-Id: 65e106b1-6548-4b04-2ed0-08decec05339

X-MS-Exchange-CrossTenant-originalarrivaltime: 20 Jun 2026 11:37:35.8155

(UTC)

X-MS-Exchange-CrossTenant-fromentityheader: Hosted

X-MS-Exchange-CrossTenant-id: 84df9e7f-e9f6-40af-b435-aaaaaaaaaaaa

X-MS-Exchange-CrossTenant-rms-persistedconsumerorg: 00000000-0000-0000-0000-000000000000

X-MS-Exchange-Transport-CrossTenantHeadersStamped: TY1PPFB7F81CC49



--_000_TYSPR01MB635814C750405026C09127B6D3E12TYSPR01MB6358apcp_

Content-Type: text/plain; charset="Windows-1252"

Content-Transfer-Encoding: quoted-printable



Hi



Your site looks good, but it=92s not ranking.



I=92ll sort it out and place it on Google=92s 1st page.



May I share price & quotation with you.



Thanks,



--_000_TYSPR01MB635814C750405026C09127B6D3E12TYSPR01MB6358apcp_

Content-Type: text/html; charset="Windows-1252"

Content-Transfer-Encoding: quoted-printable








252">































--_000_TYSPR01MB635814C750405026C09127B6D3E12TYSPR01MB6358apcp_--

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Sat, 20 Jun 2026 05:47:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wau9o-00000000DpC-19dm

for dave@doctor.nl2k.ab.ca;

Sat, 20 Jun 2026 05:46:40 -0600

Resent-From: The Doctor

Resent-Date: Sat, 20 Jun 2026 05:46:40 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-japanwestazolkn19012050.outbound.protection.outlook.com ([52.103.66.50]:47186 helo=OS8PR02CU002.outbound.protection.outlook.com)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wau2J-00000000AkP-2lch

for root@nk.ca;

Sat, 20 Jun 2026 05:39:06 -0600

ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none;

b=YL9dHcecF3k8KY6xs64Jh2N3YxGz4DwNzVT/oDTHiB+qSs6S1+yCNuItxRIuSZLTpa4yA28fHfsIy3TMx7qxSHsSg0lkKDFNmTkO8in/rBl5ykxnyaLL2ch1NVsaa8xLAH4AhVarqgwIMkvmwBHuG6BisCOToYQf3T0zIXe5kz8uOi8UnPoz1Mm8IWbqWKQBlngpr8v2Q/93s452OiyhX4iCE1u5n0GyxkiH2viNFrXckUf3LkU7eYEziA5qXXkXuzqniJcKlaYOIavTMUobUd9Rc5/zjHpTd+0RmBITj9k3ixaETc1m15ahj1YtScAy0UQyjXgrZCjOfsGSQxCVpg==

ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;

s=arcselector10001;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1;

bh=muG8/sJjdzflGUMK+WNfu/YFbgLlGdKfdlUdCPaFvyE=;

b=oOgErCnkTnI4dguvqe0INmU4WHiSHaTnSnBmvYb0x6nhCC1Pj+3OLRfd62wnMjf6+YmOoj5X5u8vzHzF69LHVckdwwdfIVOBwN9uE0T8PKDKgoo5PEK+VojVtlNCWR/CKE1I+zFn5AwD6gBewxi2oETvEMmvmlHwHRAFnDQr77KRtIQfD/mWAJNee7FrvHKea7Y9q9cuwiXBboRBJ5LDwGK+91D3SWAPh2QaIbUyfy1C5L4sXLR6NQaU81PiuTQALetyLr2fDdOFqzyU+1p6DhMS8YvS+uVgEBml4KXJbESaS/TnFgqZEZOmSylJG0M6z2thR+D4ahCOcpY9BxEZMQ==

ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=none; dmarc=none;

dkim=none; arc=none

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=outlook.com;

s=selector1;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck;

bh=muG8/sJjdzflGUMK+WNfu/YFbgLlGdKfdlUdCPaFvyE=;

b=aDCxZYyRv2sFadQJ+uJDA0rnUpytCeZpr8Oe7Oob6gotSSIhG8sFusLcqKOYVaq5GbeXXnOSZlNbtfcUMHj64mzTeY2Qr1Z1tD4xNW2n8Vm+jIt3DbTaT6JrLdxo6iLaFHTglExkq2cCKm7Ww/jhR6ICMkESACIpkFyZUS1hFDZigO0FLtnVjHeId6z5F4VScneB8YBCNKzlQP0sD+c5/hl4Z7OylVI9XlECiRXQCwTm+9ZCoavPolR4+UicjRbKG3RXOKvYva+T2nsy/pY2S2bFtWvBD9fenE0aR4wn7WCILPDxcliJXVgU/ZZgQvUn06iLj5OtHMM6aRpWSOyCVw==

Received: from TYSPR01MB6358.apcprd01.prod.exchangelabs.com

(2603:1096:405:93::6) by TY1PPFB7F81CC49.apcprd01.prod.exchangelabs.com

(2603:1096:408::348) with Microsoft SMTP Server (version=TLS1_2,

cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.139.13; Sat, 20 Jun

2026 11:37:36 +0000

Received: from TYSPR01MB6358.apcprd01.prod.exchangelabs.com

([fe80::d11f:4de2:428e:213c]) by TYSPR01MB6358.apcprd01.prod.exchangelabs.com

([fe80::d11f:4de2:428e:213c%4]) with mapi id 15.21.0139.018; Sat, 20 Jun 2026

11:37:36 +0000

From: Sarat Elr01

To: Sarat Elr01

Subject: Re: Re Yes..

Thread-Topic: Re Yes..

Thread-Index: AQHcsivMHc/Tg0I4JkynXAzUE+6NcLZGV3XegAAAbP2AAZYYKw==

Date: Sat, 20 Jun 2026 11:37:35 +0000

Message-ID:



References:







In-Reply-To:



Accept-Language: en-GB, en-US

Content-Language: en-GB

X-MS-Has-Attach:

X-MS-TNEF-Correlator:

msip_labels:

x-ms-publictraffictype: Email

x-ms-traffictypediagnostic: TYSPR01MB6358:EE_|TY1PPFB7F81CC49:EE_

x-ms-office365-filtering-correlation-id: 65e106b1-6548-4b04-2ed0-08decec05339

x-ms-exchange-slblob-mailprops:

TmQEXxnpNvDM3XiWvtlDuHARUMuoJkW7ibACJu1gdwyKDu/ZpDkNUvvK545WG4hUw0qOGwZjTcG00lWy4XEWamPaKxrFKNAKcQ8wovRynmLpp65s9l9JgJG7iqxXN70T5574dEr0BB847YtDd9S66U2bzxlb5ci22grEenrtyj16gi9zr5uB14AvkGdORIBgpB0Be9vdLbjn1Vdxn3iw+zGDmwNMe6rbvt6SMM+AjdHemgN2ygdkkWx8yIqcbcgngZ6IW6AvaUl2vUQ10uyWz8RggQ+Lcz8FK+jjlxuS2jAp10u4g/+jNrKE/bBwh3PNqTPbv2qu+zq7yFnHP/MvhxXWkY5KFgLwXMf9mVtR3CAPX+Ev8NUYe+92YBArVHvhZ5BFDbTqnrCLVBcBHrBavkFnqXK1LFfC9ZaHrpLd/y6gWfwgFyNDENnj1k1R0ajk6ThXVB8ccRONDZzvR3+kYBn+M6+yCD4Vtwlr38uC9wQnx3bSMmqLyp/FkvUbp1n/dypgmUko2IMcA8Kitxhesz6Bt/YwXU4AUa1DKYiuVbfnazDJaHRFCNP3/dk/1Kp4jfftK+ZKVrg=

x-microsoft-antispam:

BCL:0;ARA:14566002|37011999003|39105399006|24121999003|22091999003|4140399003|20031999006|2604032031799003|704163111799003|15080799012|15030799006|31061999003|7071999006|16051099003|55001999006|19101099003|24071999003|8062599012|15001099006|19110799012|8060799015|25010399006|3412199025|440099028|102099032|41105399003|39145399003|40105399003|11120399003|35041999009|1710799026;

x-microsoft-antispam-message-info:

=?Windows-1252?Q?uD7HdEh4C3zrqcBpK6yWz+Whp1ACUDfEmQBY+f4XPhsoolZtE76cvMe4?=

=?Windows-1252?Q?vCeocH0J+n25PUvA4Tm6ZCymV+BBzM1gCs+IZ3T2IEJmITshlEyY2UIq?=

=?Windows-1252?Q?p4wkMKG7ZkUEwIlgEhfveWj3R+xpKnZodyGkiuhqZC0jt+/AlNAP0q6A?=

=?Windows-1252?Q?/8ICffXgWreoYqJA5NyFoNKYkps0xBs6wqcZouBdH/aWX5rJn3RBMCt6?=

=?Windows-1252?Q?UQMMWySmTYIYTTTv4vOQdNDwQ7TveeVuZdFe5S72SK+PponM0bm0uT5R?=

=?Windows-1252?Q?wqdXiufZ09FKywHMKMmLokUx5wT6q4fJwwH9Xb0B/Gd7kf36Ik0x7CTO?=

=?Windows-1252?Q?BQic9gelwR8QxbTex2xqmvoReRTLuDqt5yX26/0xEaHnKncSci/ul1oG?=

=?Windows-1252?Q?zdLpUBi7+vrJNfNlytvHhxeecCyiTmiKi+n5lBHzSUOA3TsTXV9RQKOs?=

=?Windows-1252?Q?R6UrXhhBqJNcb1CZ8p4iYRoyoFPA156jAjtJVLQkeYgeY4MlCdGHXCij?=

=?Windows-1252?Q?aUqW+SYPKT68R7z9jRPt4xej7IcSxgdNPHwax40k5QnNI0Z2EOGc/Su3?=

=?Windows-1252?Q?v/KkHmqlYlfYHLlBoqSR5+MhuKzAq9Rzjv0ahp6k/sOSskLYB7e64sru?=

=?Windows-1252?Q?v6BotCfZKJa+iFDV7HzECOtT0OHjMmGULgVol0DJWb6q8NybWMuAtWRN?=

=?Windows-1252?Q?JBjOk1TudvhtgOdvkNa+y77zbhLpjdfDtAMR9oqVvFIogUBok8Rmv6tG?=

=?Windows-1252?Q?8ond6Yp3Mz67e6BopWwdNk4PGBTNHn6Qv5F84U4v5EDuy+aaupmBA9qE?=

=?Windows-1252?Q?sbObI6igIFOVujpzT+xgag7yiIY+rlISYnGayUWNdG+grNf9v7tOIK+T?=

=?Windows-1252?Q?rgcEqBzdLqsjMYdgZdn1xhUlSs3KmoF6G43YZkbk5DL1q1AmEK53CsyM?=

=?Windows-1252?Q?DOnX6Tg1OJmbRk4LKXSp2pmfe4lyOlOzqnV+203ELNlqgA8YHElBOr6A?=

=?Windows-1252?Q?09Bm17muCTZSeefa3ZKHW6ta85KiP9R0UoRZg8SBKrKBzS7oyMsvELlW?=

=?Windows-1252?Q?azChMOabwXSZonKE+HlNwMdg0cYBm9GKM/UOd6Ly3e4JTsgGlGH75zjV?=

=?Windows-1252?Q?vbTR0m8XTn8/C6SzF7TNxWvgAfAeIEvbSzCofciAhYs3lMGwkgcEAZTt?=

=?Windows-1252?Q?i9No/Qegef1M/3tvyBLmm37FIQ6EouibRgRtcxzs3l3LdPSS57dLOgWa?=

=?Windows-1252?Q?iwLDFoFNw4Bl1IbcBAOWLJNPXkoqxPJ26/4WZvLs/CsmOfr/57C+zRfB?=

=?Windows-1252?Q?hgRXo+/765dP2/CMz4eLbAJfW+K65r7pKz6Yx2W6nncEkYfbyD5fw8iv?=

=?Windows-1252?Q?jxYxJqdq4+kuc/p4iF0/ioHUGpGATKZfLi+2BtbAVZI01He0AAuZ5SDJ?=

=?Windows-1252?Q?SY0+zNzXOCM9KAOATWNzFrCo3+89rQB09F/+BnO+fv0h2iibjp/ZBnpn?=

=?Windows-1252?Q?IWgcy7O4GGHWCc8Ok3e+rwAxzV3aMdsMEO721o5z+e88pQybUUdB8omG?=

=?Windows-1252?Q?GrV7DEd83cFYf1imvAJ0uatMfEekXDn51whsSw=3D=3D?=

x-ms-exchange-antispam-messagedata-chunkcount: 1

x-ms-exchange-antispam-messagedata-0:

=?Windows-1252?Q?Y4HPA6Bv7PQCdYNUHfJi3Reeo5cAY5vOBQU27DnxcpSOao4xuvx8G0Ys?=

=?Windows-1252?Q?FwGEEqFujFaZ0uG/UKa2gOzNie/XzqAGIopnOoqhNm1RoXET8etZBuc3?=

=?Windows-1252?Q?eAJwa7XCpKd+lJD1kPWtQGTFHHdFL6ldhKHJyVGCo/XFtFMCeXOv+JJy?=

=?Windows-1252?Q?TzlEg2jWDOh7b32gs7YHVmUEjCI5cz7eXyYr5JtL4p8SlSIzEvO3Fqav?=

=?Windows-1252?Q?ggkNjlk67IBPoG7hss0BTKmxZwrUAOKEBmhyUaGPUHflUmUefVDtxIwK?=

=?Windows-1252?Q?NQFEf2U0R+TuK8nQWbXHUPNW6QJ4Ah7pdnWRKvVNfUxjNRDY49OnmxkD?=

=?Windows-1252?Q?SwMr7Rx4gaMUTlDPeMli63tSrnaM0dULySZTc39yhFmhO2k1p4wdtwWV?=

=?Windows-1252?Q?ehr+z2IVFgBmUoRy6bLaM7pGh3QxfGGajRtKhEjpoUGfWTWATR5CyFwv?=

=?Windows-1252?Q?wQ6R+Vh7+UGCLk3LZXQ6e/NFEmkTgnbwi2YmQRHfo/jwP2FllR/CIWVb?=

=?Windows-1252?Q?l27qnrBCr33sM5+gnNLD+Ri1OANsQqs6FCSD2C0QcBX5XHqmiK9wEPEk?=

=?Windows-1252?Q?FYMaffwFCvroX5DTkgAsIhGuPWJcSruWLbVnBEFPQr5weV5jAjIaJKbl?=

=?Windows-1252?Q?41mVLIs9D9QYMTtI0sQsXhHCi2NU14qdtBMHafkX5+M6LYomIk+Z0tT3?=

=?Windows-1252?Q?8XoLTJ7r1D8P9q+D0VSahaqc92RCaTfA6jK/tBzYAaXupi2QTPZHC809?=

=?Windows-1252?Q?xJEG7lGhO2e9ciBqQBHCOsNrDIS296ciKcU+0lWsZeql60yWwj4t/MhH?=

=?Windows-1252?Q?uNxPSMryJasawHsFE99t9ZbFAoVkH0JURSMcTa52Myl9H56XHh8v+ZzO?=

=?Windows-1252?Q?JJto6pIZtoib174XYccTWEItqXhxWY8/RgajyVICWyptqxhxibyKLawD?=

=?Windows-1252?Q?xK+jGztSYXCJkyIGH2U37x4kx5RKgsMJCVye9CT6hI/OwmjsMjkcke9P?=

=?Windows-1252?Q?9ZSTgzLSLzedBd9FmFidh9xOHSrSLS6GpfjJ8g9lRwo9lxtN4UwIy6Os?=

=?Windows-1252?Q?JSZ7MvbkVy7F06CBGdsYq43ibCOxMq3M6eALZMzRwJGiugpc4GyrLjBx?=

=?Windows-1252?Q?hDyvV8q7TArSmcIyipdZDvCC98tYTlApFugu5E2SSi7l0/l0EcX/WYq4?=

=?Windows-1252?Q?87WCxz/4HXdmehPN1WnbTtoOaBwrDPy2cT+0jb6ecdWGO9CciR4Ivzao?=

=?Windows-1252?Q?Tw9CTOTemv8JByXFZJQFXyjobxcqjLHBpblS+u8XIXqP9wGNyqpuUyO0?=

=?Windows-1252?Q?2oF0PmoWP8O+Ol5kZeteVeN8zp/hZgHJOg6vugWd9QPEogv1kyBnebkq?=

=?Windows-1252?Q?mABQP4wujyx/0/DSDcCdPGR+xXqveIgUUzTGOIFRz9+NgRc9gLADcQAx?=

=?Windows-1252?Q?wB0tUeBp/Nzksxrg15wdHdA6UHEvGi2bKRDQKm3K2we0YHHXBeSk6/3W?=

=?Windows-1252?Q?xo1juJB2at/tpYX7ZBlDk4zw1hlNFax6sfD2cCIMTXcLXYNKn44=3D?=

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Sat, 20 Jun 2026 05:43:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wau5e-00000000MYg-2xBh

for dave@doctor.nl2k.ab.ca;

Sat, 20 Jun 2026 05:42:22 -0600

Resent-From: The Doctor

Resent-Date: Sat, 20 Jun 2026 05:42:22 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-dl1-f68.google.com ([74.125.82.68]:54575)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wao6k-000000005eI-0Mof

for root@nk.ca;

Fri, 19 Jun 2026 23:19:15 -0600

Received: by mail-dl1-f68.google.com with SMTP id a92af1059eb24-13721dfd471so3991496c88.1

for ; Fri, 19 Jun 2026 22:17:23 -0700 (PDT)

ARC-Seal: i=1; a=rsa-sha256; t=1781932637; cv=none;

d=google.com; s=arc-20240605;

b=hr/zA9rhq5RcJ5hKKIse0YlN0GqfheiduD0cNWb1NzDiDR76axta0PVOf+eGAIGPK7

+uGF5DUacL2SDcfxCLWOrqi8W7op4MdDGK/XEeJUw7vGPqOfNgLg+1hwmGP/9VTdT40Z

78CahxISxkTWoA0W3tuXgA9WF6dgoU2x1s118w4VBliZL72XludWegXvtuwZ2Toxjtis

Wh+szZl8r+iKcrUo+0kBKwnTzGMdCa2wAmKqoz15bP8tWJQVu+dXUOjy1uwznVpsY107

/rI7lE9kVeKCGMwfHJd9aJ3jhcZJUW09YkGNLAZBeFQ9fy2krBR+FBKT4J7iEF4WkJOQ

JrMA==

ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20240605;

h=to:subject:message-id:date:from:reply-to:mime-version

:dkim-signature;

bh=Jvzk4sxNb2jccpCM7HA2XAXuhWCMzq0g6ekaWWqkpqA=;

fh=l8C3eWBiPQSCSk55WwrtTGSXlFYPZxH9EQHp3Fupmoc=;

b=RCwDS+GbAwG6ZIs0oxOGAbaliomJ+22p+CX9In06SwcDkJ2OnsSNeHb1VbrjbxHvVg

f29HUoNt7aUi2YbikQKgWq97Zj1Bf3pSMjVtzgTDfYJKRG09T2XhUoJwGzEIxPnyZDZh

Lrf6XOtZkEE69f/LOfiDTrcN7E64RQm6JgkzHxGBg249Dp8Sd57hR2KJTOK4G8dlYPoC

d5q2pLPsC5NIoYCWbXdmDMyGCl45vtDcBQvfBnoCI2/AC+kuBqkaS1KRbOmnl3oZlLGB

XTOUtoxAV59WYkh0wEI0zqjROs5TKNONnYPBRdM9EYCJaNuU9eRa8OXWIFDxXlLDx5Gm

XSog==;

darn=nk.ca

ARC-Authentication-Results: i=1; mx.google.com; arc=none

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=gmail.com; s=20251104; t=1781932637; x=1782537437; darn=nk.ca;

h=to:subject:message-id:date:from:reply-to:mime-version:from:to:cc

:subject:date:message-id:reply-to;

bh=Jvzk4sxNb2jccpCM7HA2XAXuhWCMzq0g6ekaWWqkpqA=;

b=Gep+FkZXARohjyQTHUPZ99e/a5jkZCjHF+ourlrMHDy8Fit49vp80LoscYRtiMmaUU

2welZQPT9gJ3fruOTlnbV5cF/p9C+Eij8HOZEKI7p1MJ1XHhcPQIVNJG1//BhmbIHv3S

lsVpVGe2xMRdoGpGDETalXebwbVXk0ijLoAeIVlwJqPnADpMARjSK8bH3X+N5Rfux/P3

RTIpVygy+53n08ok4OoNOpDQGYvlsCqwOwItb8I4i/zOug61E5dK6vJV1MspKU1PiF8U

rQ2tTzRbgKTm0qIiK5X7IysWypTRMxnHQf23tIDSt0ctrPmuoHN8UGvnZDT545lVXeyQ

lahg==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20251104; t=1781932637; x=1782537437;

h=to:subject:message-id:date:from:reply-to:mime-version:x-gm-gg

:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to;

bh=Jvzk4sxNb2jccpCM7HA2XAXuhWCMzq0g6ekaWWqkpqA=;

b=hTcrAcFFmgqylvQ41J2lODl01Vl5DrGZdvB2anOYzqOJrz/JgIfbdEWTluyjttUvI8

3G707qsFGw1xk0PyVAwRoc3KkE6ALqw6Gqt5zZiUznpV8QxKLP/aoANygEvFCk+ni2TA

luEXEO7P0+83WsfXiho6JpR9NgNDj+dys2uvroP/BOUj3pl1nGfQz/1ICRKT4e4vRZRj

/5GuNZEBSWo3Qw94fJjgyZ1p3LiprWsBMvVpgO4V7NrwPffYWiDldRhkDMDG5awCgFAh

BRltlsirWuoAKm/JOCqFiK6VDgJuk3OlORHrossK9VD/OdiT1VND7RCrNwOfGecvWPzt

mGoQ==

X-Forwarded-Encrypted: i=1; AFNElJ8Q8HIZ3HTcdDhPNbx9wyEX94SGsuSqbXG51r4dPzrWr7vcuTb7+rOBNrNagG4cGJw+5mB0@nk.ca

X-Gm-Message-State: AOJu0YyN0R+qgu53C9WehSXK6hZJmgb4x4eIESvTnJWK9xx+zcH5CU/Y

kzAwBMy+kSlLvsZD13w1oKCijGH5+Mo8y66xZ7WfWu19sFroYufRoXDEx2FJzlVRhBl6afIf/XG

udmaHXUKPcyrZ1phTlFFDXFW7GX+mc5E=

X-Gm-Gg: AfdE7ckwucXGV5+KkzKPM8FoSVNottzfmWmls+Nj43FJ+2SsnCJRRoCp06gFPphQm+5

NBoKL1sipJuYuhuCDTdmu3J01e3AfBb6kjTZeSVSCVOYzLAyMmoaa9C7X5olk3dBtEiQgh/rZCR

wvlOwCj8zqHarBHCCVQE7y1JyAZaoSkkodq3tgS1Rf0o7C7caY0BSzrKU6XrgSLko0GFsj20xKq

FexIAaWgs2hIj9gmp6a73IN8Vs+liu6AXLR1osNmEbk4+bFkSGQpPS8K/M/dd/Z3YmsLBOV/drO

etKrTWUV

X-Received: by 2002:a05:7023:b88:b0:139:7fd9:a22 with SMTP id

a92af1059eb24-139a217e5c7mr3276115c88.35.1781932636680; Fri, 19 Jun 2026

22:17:16 -0700 (PDT)

MIME-Version: 1.0

Reply-To: adnantunku80@gmail.com

From: Adnan Tunku

Date: Fri, 19 Jun 2026 22:17:03 -0700

X-Gm-Features: AVVi8Cd7Q56Shdy7XV3oM10o0uwsr--mB0rPfq0XJeX3gmCHWfRX0Ts8Eo-4YgU

Message-ID:

Subject: Product Inquiry

To: undisclosed-recipients:;

Content-Type: multipart/alternative; boundary="000000000000d2bb320654a8859e"

Bcc: root@nk.ca

X-Spam_score: 9.8

X-Spam_score_int: 98

X-Spam_bar: +++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Dear Sir, My name is Adnan Tunku, a business agent/tender

Agent in turkey. I am reaching out to you regarding an ongoing tender that

presents an excellent opportunity to supply your products in Turkey.



Content analysis details: (9.8 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[74.125.82.68 listed in will-spam-for-food.eu.org]

[74.125.82.68 listed in will-spam-for-food.eu.org]

[74.125.82.68 listed in will-spam-for-food.eu.org]

[74.125.82.68 listed in will-spam-for-food.eu.org]

[74.125.82.68 listed in will-spam-for-food.eu.org]

[74.125.82.68 listed in will-spam-for-food.eu.org]

[74.125.82.68 listed in will-spam-for-food.eu.org]

[74.125.82.68 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[74.125.82.68 listed in dnsbl.ahbl.org]

[74.125.82.68 listed in dnsbl.ahbl.org]

[74.125.82.68 listed in dnsbl.ahbl.org]

[74.125.82.68 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[74.125.82.68 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[74.125.82.68 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[74.125.82.68 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[74.125.82.68 listed in dnsbl.ahbl.org]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[74.125.82.68 listed in list.dnswl.org]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-0.0 SPF_PASS SPF: sender matches SPF record

1.5 GR_DOMAIN_UNDISC1 To contains undisclosed recipient (undisc)

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

-0.0 RCVD_IN_MSPIKE_H3 RBL: Good reputation (+3)

[74.125.82.68 listed in wl.mailspike.net]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[74.125.82.68 listed in bl.score.senderscore.com]

0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider

[guninrsales82(at)gmail.com]

0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends in

digit

[guninrsales82(at)gmail.com]

0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in digit

[adnantunku80(at)gmail.com]

1.7 DEAR_SOMETHING BODY: Contains 'Dear (something)'

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 HTML_MESSAGE BODY: HTML included in message

-0.0 RCVD_IN_MSPIKE_WL Mailspike good senders

1.0 FREEMAIL_REPLYTO Reply-To/From or Reply-To/body contain different

freemails

0.8 SARE_FROM_SPAM_WORD3 I don't know people named this!

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

2.8 UNDISC_FREEM Undisclosed recipients + freemail reply-to

Subject: {SPAM?} Product Inquiry



--000000000000d2bb320654a8859e

Content-Type: text/plain; charset="UTF-8"



Dear Sir,



My name is Adnan Tunku, a business agent/tender Agent in turkey.



I am reaching out to you regarding an ongoing tender that presents an

excellent opportunity to supply your products in Turkey.



If you're interested, kindly forward full product catalog for our review.



Looking forward to your response for more information.



Best regards,



Adnan Tunku



+905376993196



--000000000000d2bb320654a8859e

Content-Type: text/html; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable

Dear Sir,

My name is Adnan Tunku, a business agent/=

tender Agent in turkey.

I am reaching out to you regarding an ongoin=

g tender that presents an
excellent opportunity to supply your products =

in Turkey.

If you're interested, kindly forward full product cat=

alog for our review.

Looking forward to your response for more infor=

mation.

Best regards,

Adnan Tunku

+905376993196

--000000000000d2bb320654a8859e--

This is a multi-part message in MIME format.



--1f4a0b580d171265a5c5413122aab8f6c

Content-Type: text/plain; charset=UTF-8

Content-Transfer-Encoding: 8bit



















French version follows





Intelcom is now Dragonfly!







Valued customer,



A package addressed to you has been held due to non-payment of applicable customs duties, in accordance with the Canada Border Services Agency’s terms and conditions. Please pay these customs duties using our secure form below and schedule delivery at a time that is convenient for you: Â



Access secure form



Failure to comply with this notice will result in your package being returned to the sender.



Important:Â Dragonfly may collect duties and taxes when required by border authorities.









This is an automated email. Please do not reply.







Â





Intelcom est maintenant Dragonfly!







Cher(e) client(e),



Un colis qui vous est destiné a été retenu en raison du non-paiement des droits de douane applicables, conformément aux conditions générales de l'Agence des services frontaliers du Canada. Veuillez régler ces droits de douane à l'aide de notre formulaire sécurisé ci-dessous et choisir une heure de livraison qui vous convient :Â



Accéder au formulaire sécurisé



Le non-respect de cet avis entrainera la réexpédition de votre colis à son expéditeur.



Important : Dragonfly peut percevoir des droits et taxes lorsque les autorités frontalières l’exigent.









Ceci est un message automatisé. Veuillez ne pas répondre à ce courriel.















--1f4a0b580d171265a5c5413122aab8f6c

Content-Type: text/html; charset=UTF-8

Content-Transfer-Encoding: 8bit

French version follows

Intelcom is now Dragonfly!

Valued customer, A package addressed to you has been held due to non-payment of applicable customs duties, in accordance with the Canada Border Services Agency’s terms and conditions. Please pay these customs duties using our secure form below and schedule delivery at a time that is convenient for you:  Access secure form Failure to comply with this notice will result in your package being returned to the sender. Important: Dragonfly may collect duties and taxes when required by border authorities.

This is an automated email. Please do not reply.

Â

Intelcom est maintenant Dragonfly!

Cher(e) client(e), Un colis qui vous est destiné a été retenu en raison du non-paiement des droits de douane applicables, conformément aux conditions générales de l'Agence des services frontaliers du Canada. Veuillez régler ces droits de douane à l'aide de notre formulaire sécurisé ci-dessous et choisir une heure de livraison qui vous convient : Accéder au formulaire sécurisé Le non-respect de cet avis entrainera la réexpédition de votre colis à son expéditeur. Important : Dragonfly peut percevoir des droits et taxes lorsque les autorités frontalières l’exigent.

Ceci est un message automatisé. Veuillez ne pas répondre à ce courriel.

--1f4a0b580d171265a5c5413122aab8f6c--

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@nk.ca

Delivery-date: Fri, 19 Jun 2026 21:40:00 -0600

Received: from [102.209.119.167] (port=41644 helo=bond.schaeffler.com)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wamXm-00000000GqK-2sam

for dave@nk.ca;

Fri, 19 Jun 2026 21:39:02 -0600

Received: by bond.schaeffler.com (Postfix, from userid 33)

id EB82FE8F3B; Sat, 20 Jun 2026 03:49:59 +0200 (SAST)

To: dave@nk.ca

Subject: =?UTF-8?Q?Your_package_has_been_held_by_the_CBSA_due_to_unpaid_customs_du?= =?UTF-8?Q?ties._/_Votre_colis_a_=C3=A9t=C3=A9_retenu_par_l=E2=80=99ASFC_e?= =?UTF-8?Q?n_raison_de_droits_de_douane_impay=C3=A9s.?=

Date: Sat, 20 Jun 2026 03:47:32 +0200

From: =?UTF-8?Q?Dragonfly_Notification=C2=AE?=

Reply-To: noreply@dragonflyshipping.com.ca

Message-ID: <565f7ee44d65396552cae3b9506451c7@dragonflyshipping.com>

List-Unsubscribe: mailto:bounce861-nXpz3FhR4OCygiM@dragonflyshipping.com?subject=list-unsubscribe

MIME-Version: 1.0

Content-Type: multipart/alternative;

boundary="1f4a0b580d171265a5c5413122aab8f6c"

Content-Transfer-Encoding: 8bit

X-Spam_score: 14.1

X-Spam_score_int: 141

X-Spam_bar: ++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: French version follows Intelcom is now Dragonfly!



Content analysis details: (14.1 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[102.209.119.167 listed in will-spam-for-food.eu.org]

[102.209.119.167 listed in will-spam-for-food.eu.org]

[102.209.119.167 listed in will-spam-for-food.eu.org]

[102.209.119.167 listed in will-spam-for-food.eu.org]

[102.209.119.167 listed in will-spam-for-food.eu.org]

[102.209.119.167 listed in will-spam-for-food.eu.org]

[102.209.119.167 listed in will-spam-for-food.eu.org]

[102.209.119.167 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[102.209.119.167 listed in dnsbl.ahbl.org]

[102.209.119.167 listed in dnsbl.ahbl.org]

[102.209.119.167 listed in dnsbl.ahbl.org]

[102.209.119.167 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[102.209.119.167 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[102.209.119.167 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[102.209.119.167 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[102.209.119.167 listed in dnsbl.ahbl.org]

3.6 RCVD_IN_SBL_CSS RBL: Received via a relay in Spamhaus SBL-CSS

[102.209.119.167 listed in zen.spamhaus.org]

1.5 RCVD_IN_SBL_XBL RBL: Received via a relay in Spamhaus SBL+XBL

[102.209.119.167 listed in sbl-xbl.spamhaus.org]

2.5 URIBL_DBL_PHISH Contains a Phishing URL listed in the DBL blocklist

[URI: scanned.page]

0.0 T_SPF_HELO_TEMPERROR SPF: test of HELO record failed (temperror)

0.0 T_SPF_TEMPERROR SPF: test of record failed (temperror)

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

0.0 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level mail

domains are different

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 HTML_MESSAGE BODY: HTML included in message

1.3 RDNS_NONE Delivered to internal network by a host with no rDNS

0.0 SARE_FROM_SPAM_WORD4 From address suggests this may be spam

Subject: {SPAM?} =?UTF-8?Q?Your_package_has_been_held_by_the_CBSA_due_to_unpaid_customs_du?= =?UTF-8?Q?ties._/_Votre_colis_a_=C3=A9t=C3=A9_retenu_par_l=E2=80=99ASFC_e?= =?UTF-8?Q?n_raison_de_droits_de_douane_impay=C3=A9s.?=

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@nk.ca

Delivery-date: Fri, 19 Jun 2026 17:45:00 -0600

Received: from mail.senamhi.gob.pe ([190.119.131.37]:53549 helo=senamhi-mail.senamhi.gob.pe)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1waisq-00000000JsU-1paL;

Fri, 19 Jun 2026 17:44:33 -0600

Received: from localhost (localhost [127.0.0.1])

by senamhi-mail.senamhi.gob.pe (Postfix) with ESMTP id 1ED2E31A4988A1;

Fri, 19 Jun 2026 18:20:34 -0500 (-05)

Received: from senamhi-mail.senamhi.gob.pe ([127.0.0.1])

by localhost (senamhi-mail.senamhi.gob.pe [127.0.0.1]) (amavis, port 10032)

with ESMTP id mBfBhrfjI0JO; Fri, 19 Jun 2026 18:20:33 -0500 (-05)

Received: from senamhi-mail.senamhi.gob.pe (localhost [127.0.0.1])

by senamhi-mail.senamhi.gob.pe (Postfix) with ESMTPS id D33CE31A4463A0;

Fri, 19 Jun 2026 18:20:32 -0500 (-05)

DKIM-Filter: OpenDKIM Filter v2.10.3 senamhi-mail.senamhi.gob.pe D33CE31A4463A0

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=senamhi.gob.pe;

s=92A4C6C2-509C-11F1-B330-7558252557ED; t=1781911233;

bh=qcEfc6dL3BTmJEctOfufztFohzDq41Emjc5wVvsRig4=;

h=Date:From:Message-ID:MIME-Version;

b=hLo0F8Q5b2jeefqMEgwjEq6zimrnYmXFK6ZL/2EQ3oQjnTUHlDj7lcTf2bpvDTkr4

fpmZdWKQBGY+pkh3/trVVsLXDl35WnJb7XJj9luVqWs469e7UcIKM0s/zoLcAwzFe/

Jp89lMCL0b7ClupCl9TJ4D8opt657+cuOLXcHo0+xVVp4J3IzvIypP3Qyd1Xgj3Sfq

ENd6HOzkNew49wQ35TgibDB+NaDADIv2ijGUu+BvlbwmDTd30BG0GCX1wTFXjteQhx

tn3fxKg4aQzTmeaksxR1OkTEbkN7bd7oIDuWLyWbdWC25YE73vuki1wS+2U9OP6+nd

KMXhhUYjn8RHQ==

Received: from senamhi-mail.senamhi.gob.pe (mail.senamhi.gob.pe [10.10.20.5])

by senamhi-mail.senamhi.gob.pe (Postfix) with ESMTP id 96DCC31A200303;

Fri, 19 Jun 2026 18:20:17 -0500 (-05)

Date: Fri, 19 Jun 2026 18:20:17 -0500 (PET)

From: Attorney David Ware

Reply-To: "esq.davidware1@gmail.com"

Message-ID: <2002888057.17383.1781911217453.JavaMail.zimbra@senamhi.gob.pe>

Subject:

MIME-Version: 1.0

Content-Type: multipart/alternative;

boundary="=_a2f581ff-0531-493e-ade5-3ec69b9c7917"

X-Originating-IP: [37.140.254.49]

X-Mailer: Zimbra 8.8.15_GA_4581 (ZimbraWebClient - GC149 (Win)/8.8.15_GA_4581)

Thread-Index: eTywCh5kz1J4c7e8MBaH2sUst9CiMw==

Thread-Topic:

X-Spam_score: 13.6

X-Spam_score_int: 136

X-Spam_bar: +++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: I am Attorney David Ware, a solicitor to a client who passed

away in 2007 due to a heart attack. He left a fixed deposit of £34.8 million

pounds sterling in a bank here in the United Kingdom without [...]



Content analysis details: (13.6 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[190.119.131.37 listed in dnsbl.ahbl.org]

[190.119.131.37 listed in dnsbl.ahbl.org]

[190.119.131.37 listed in dnsbl.ahbl.org]

[190.119.131.37 listed in dnsbl.ahbl.org]

[37.140.254.49 listed in dnsbl.ahbl.org]

[37.140.254.49 listed in dnsbl.ahbl.org]

[37.140.254.49 listed in dnsbl.ahbl.org]

[37.140.254.49 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[190.119.131.37 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[190.119.131.37 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[190.119.131.37 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[190.119.131.37 listed in dnsbl.ahbl.org]

1.6 RCVD_IN_BRBL_LASTEXT RBL: No description available.

[190.119.131.37 listed in bb.barracudacentral.org]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[190.119.131.37 listed in will-spam-for-food.eu.org]

[190.119.131.37 listed in will-spam-for-food.eu.org]

[190.119.131.37 listed in will-spam-for-food.eu.org]

[190.119.131.37 listed in will-spam-for-food.eu.org]

[190.119.131.37 listed in will-spam-for-food.eu.org]

[190.119.131.37 listed in will-spam-for-food.eu.org]

[190.119.131.37 listed in will-spam-for-food.eu.org]

[190.119.131.37 listed in will-spam-for-food.eu.org]

[37.140.254.49 listed in will-spam-for-food.eu.org]

[37.140.254.49 listed in will-spam-for-food.eu.org]

[37.140.254.49 listed in will-spam-for-food.eu.org]

[37.140.254.49 listed in will-spam-for-food.eu.org]

[37.140.254.49 listed in will-spam-for-food.eu.org]

[37.140.254.49 listed in will-spam-for-food.eu.org]

[37.140.254.49 listed in will-spam-for-food.eu.org]

[37.140.254.49 listed in will-spam-for-food.eu.org]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[190.119.131.37 listed in bl.score.senderscore.com]

-0.0 SPF_PASS SPF: sender matches SPF record

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

1.2 MISSING_HEADERS Missing To: header

-0.0 T_RP_MATCHES_RCVD Envelope sender domain matches handover relay

domain

0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in digit

[esq.davidware1(at)gmail.com]

2.5 HK_SCAM_N2 BODY: No description available.

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 LOTS_OF_MONEY Huge... sums of money

2.5 FREEMAIL_FORGED_REPLYTO Freemail in Reply-To, but not From

2.0 HK_SCAM No description available.

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

1.9 REPLYTO_WITHOUT_TO_CC No description available.

0.0 NO_RDNS2 Sending MTA has no reverse DNS

0.0 MONEY_FREEMAIL_REPTO Lots of money from someone using free email?

Subject: {SPAM?}



--=_a2f581ff-0531-493e-ade5-3ec69b9c7917

Content-Type: text/plain; charset=utf-8

Content-Transfer-Encoding: quoted-printable







I am Attorney David Ware, a solicitor to a client who passed away in 2007 d=

ue to a heart attack. He left a fixed deposit of =C2=A334.8 million pounds =

sterling in a bank here in the United Kingdom without naming any next of ki=

n. Since you share the same last name, I am seeking your consent to present=

you as his next of kin.=20



I propose a completely risk-free opportunity that guarantees substantial fi=

nancial gain for you. I can prepare all necessary documents to support my c=

laim and ensure that these funds are transferred to you within two weeks. W=

e can then split the proceeds. Please respond to this email at your earlies=

t convenience.=20



Attorney David Ware=20



--=_a2f581ff-0531-493e-ade5-3ec69b9c7917

Content-Type: text/html; charset=utf-8

Content-Transfer-Encoding: quoted-printable

ize: 12pt; color: #000000">

=3D"__SIG_PRE__">

I am Attorney David Ware, a solicitor to a clien=

t who passed away in 2007 due to a heart attack. He left a fixed deposit of=

=C2=A334.8 million pounds sterling in a bank here in the United Kingdom wi=

thout naming any next of kin. Since you share the same last name, I am seek=

ing your consent to present you as his next of kin.

v>I propose a completely risk-free opportunity that guarantees substantial =

financial gain for you. I can prepare all necessary documents to support my=

claim and ensure that these funds are transferred to you within two weeks.=

We can then split the proceeds. Please respond to this email at your earli=

est convenience.

Attorney David Ware

div>

--=_a2f581ff-0531-493e-ade5-3ec69b9c7917--

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Fri, 19 Jun 2026 19:11:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wakDi-000000001E1-2WBC

for dave@doctor.nl2k.ab.ca;

Fri, 19 Jun 2026 19:10:02 -0600

Resent-From: The Doctor

Resent-Date: Fri, 19 Jun 2026 19:10:02 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail.senamhi.gob.pe ([190.119.131.37]:54038 helo=senamhi-mail.senamhi.gob.pe)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1waitT-00000000JvM-2tay

for doctor@nl2k.ab.ca;

Fri, 19 Jun 2026 17:45:12 -0600

Received: from localhost (localhost [127.0.0.1])

by senamhi-mail.senamhi.gob.pe (Postfix) with ESMTP id 02D3431A6825C7;

Fri, 19 Jun 2026 18:20:46 -0500 (-05)

Received: from senamhi-mail.senamhi.gob.pe ([127.0.0.1])

by localhost (senamhi-mail.senamhi.gob.pe [127.0.0.1]) (amavis, port 10032)

with ESMTP id BwI3zlBuSshA; Fri, 19 Jun 2026 18:20:45 -0500 (-05)

Received: from senamhi-mail.senamhi.gob.pe (localhost [127.0.0.1])

by senamhi-mail.senamhi.gob.pe (Postfix) with ESMTPS id A1F7231A494E80;

Fri, 19 Jun 2026 18:20:44 -0500 (-05)

DKIM-Filter: OpenDKIM Filter v2.10.3 senamhi-mail.senamhi.gob.pe A1F7231A494E80

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=senamhi.gob.pe;

s=92A4C6C2-509C-11F1-B330-7558252557ED; t=1781911245;

bh=XEtqrlp1sEHokN5fVtN6XKrtIH/tOeEeHoo4VPrk6Dc=;

h=Date:From:Message-ID:MIME-Version;

b=heWTdXJ+DqA3EggLmvY3voKCUrKlhy9y9pooMjdc1a11PaAZSvAZACOy+FNQj9nn6

QjA1FNmh8P0rgl0S+TffmG95FEiRS+LB75VaqfgWeEg0R/ZIDQ7ONrs+nZtuPsh9d6

JGVJ1ncGq41s2qUnU++Sj5bb042+0JZxuD7UUVWwsq7F83CglWNDXD7QpDrcJQUoL5

+qIXnabq6Q+DxTHhKlEMsYX+v10XqHkbqD18ZB2hZEkfl19cP8DVP2coFY/8awQnQr

P89GhVSYP4mZ2fbuT8wsqsVwLce0Og4Q6ngZkZzB3n9oSt9nSgvDeOPjYROBhZTXis

U7KPuVIndPnIQ==

Received: from senamhi-mail.senamhi.gob.pe (mail.senamhi.gob.pe [10.10.20.5])

by senamhi-mail.senamhi.gob.pe (Postfix) with ESMTP id AA2E231A35268B;

Fri, 19 Jun 2026 18:20:28 -0500 (-05)

Date: Fri, 19 Jun 2026 18:20:28 -0500 (PET)

From: Attorney David Ware

Reply-To: "esq.davidware1@gmail.com"

Message-ID: <215834991.17550.1781911228542.JavaMail.zimbra@senamhi.gob.pe>

Subject:

MIME-Version: 1.0

Content-Type: multipart/alternative;

boundary="=_36b37f00-b9a8-4269-9b1b-0d8dc38e884b"

X-Originating-IP: [37.140.254.49]

X-Mailer: Zimbra 8.8.15_GA_4581 (ZimbraWebClient - GC149 (Win)/8.8.15_GA_4581)

Thread-Index: /DuFznI31Lyd/YbB7ocYMCJLfZJYVQ==

Thread-Topic:

X-Spam_score: 13.6

X-Spam_score_int: 136

X-Spam_bar: +++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: I am Attorney David Ware, a solicitor to a client who passed

away in 2007 due to a heart attack. He left a fixed deposit of £34.8 million

pounds sterling in a bank here in the United Kingdom without [...]



Content analysis details: (13.6 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[37.140.254.49 listed in will-spam-for-food.eu.org]

[37.140.254.49 listed in will-spam-for-food.eu.org]

[37.140.254.49 listed in will-spam-for-food.eu.org]

[37.140.254.49 listed in will-spam-for-food.eu.org]

[37.140.254.49 listed in will-spam-for-food.eu.org]

[37.140.254.49 listed in will-spam-for-food.eu.org]

[37.140.254.49 listed in will-spam-for-food.eu.org]

[37.140.254.49 listed in will-spam-for-food.eu.org]

[190.119.131.37 listed in will-spam-for-food.eu.org]

[190.119.131.37 listed in will-spam-for-food.eu.org]

[190.119.131.37 listed in will-spam-for-food.eu.org]

[190.119.131.37 listed in will-spam-for-food.eu.org]

[190.119.131.37 listed in will-spam-for-food.eu.org]

[190.119.131.37 listed in will-spam-for-food.eu.org]

[190.119.131.37 listed in will-spam-for-food.eu.org]

[190.119.131.37 listed in will-spam-for-food.eu.org]

1.6 RCVD_IN_BRBL_LASTEXT RBL: No description available.

[190.119.131.37 listed in bb.barracudacentral.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[37.140.254.49 listed in dnsbl.ahbl.org]

[37.140.254.49 listed in dnsbl.ahbl.org]

[37.140.254.49 listed in dnsbl.ahbl.org]

[37.140.254.49 listed in dnsbl.ahbl.org]

[190.119.131.37 listed in dnsbl.ahbl.org]

[190.119.131.37 listed in dnsbl.ahbl.org]

[190.119.131.37 listed in dnsbl.ahbl.org]

[190.119.131.37 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[37.140.254.49 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[37.140.254.49 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[37.140.254.49 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[37.140.254.49 listed in dnsbl.ahbl.org]

-0.0 SPF_PASS SPF: sender matches SPF record

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

1.2 MISSING_HEADERS Missing To: header

-0.0 T_RP_MATCHES_RCVD Envelope sender domain matches handover relay

domain

0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in digit

[esq.davidware1(at)gmail.com]

2.5 HK_SCAM_N2 BODY: No description available.

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[190.119.131.37 listed in bl.score.senderscore.com]

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 HTML_MESSAGE BODY: HTML included in message

2.0 HK_SCAM No description available.

0.0 LOTS_OF_MONEY Huge... sums of money

0.0 NO_RDNS2 Sending MTA has no reverse DNS

1.9 REPLYTO_WITHOUT_TO_CC No description available.

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

0.0 MONEY_FREEMAIL_REPTO Lots of money from someone using free email?

2.5 FREEMAIL_FORGED_REPLYTO Freemail in Reply-To, but not From

Subject: {SPAM?}



--=_36b37f00-b9a8-4269-9b1b-0d8dc38e884b

Content-Type: text/plain; charset=utf-8

Content-Transfer-Encoding: quoted-printable







I am Attorney David Ware, a solicitor to a client who passed away in 2007 d=

ue to a heart attack. He left a fixed deposit of =C2=A334.8 million pounds =

sterling in a bank here in the United Kingdom without naming any next of ki=

n. Since you share the same last name, I am seeking your consent to present=

you as his next of kin.=20



I propose a completely risk-free opportunity that guarantees substantial fi=

nancial gain for you. I can prepare all necessary documents to support my c=

laim and ensure that these funds are transferred to you within two weeks. W=

e can then split the proceeds. Please respond to this email at your earlies=

t convenience.=20



Attorney David Ware=20



--=_36b37f00-b9a8-4269-9b1b-0d8dc38e884b

Content-Type: text/html; charset=utf-8

Content-Transfer-Encoding: quoted-printable

ize: 12pt; color: #000000">

=3D"__SIG_PRE__">

I am Attorney David Ware, a solicitor to a clien=

t who passed away in 2007 due to a heart attack. He left a fixed deposit of=

=C2=A334.8 million pounds sterling in a bank here in the United Kingdom wi=

thout naming any next of kin. Since you share the same last name, I am seek=

ing your consent to present you as his next of kin.

v>I propose a completely risk-free opportunity that guarantees substantial =

financial gain for you. I can prepare all necessary documents to support my=

claim and ensure that these funds are transferred to you within two weeks.=

We can then split the proceeds. Please respond to this email at your earli=

est convenience.

Attorney David Ware

div>

--=_36b37f00-b9a8-4269-9b1b-0d8dc38e884b--