Ringcentral phish

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Mon, 09 Feb 2026 10:10:00 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vpUkz-00000000IHI-3IRf

for dave@doctor.nl2k.ab.ca;

Mon, 09 Feb 2026 10:09:05 -0700

Resent-From: The Doctor

Resent-Date: Mon, 9 Feb 2026 10:09:05 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from sjc01-c01-mrs02.ringcentral.com ([199.255.122.177]:38930)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vpTCR-00000000Hy8-08Ku

for doctor@doctor.nl2k.ab.ca;

Mon, 09 Feb 2026 08:29:27 -0700

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ringcentral.com;

i=@ringcentral.com; q=dns/txt; s=mail; t=1770650906; h=subject :

message-id : date : to : from;

bh=JpRY7ULLALtwJ2TnE8FwSoAOxsu+mdu/tKB7Kw48tE0=;

b=DiNGXyk3OXpYnia/G5lV8bBGhTiYtIh9NzOnwezoeAO9DXUnDqSllPOTPBsQokpDlxyHT

h4gyZA+5HwVnRI5CaHY10lNmq6ZolMbZqVLoOlSHuuJybLgcRq6RB3vp9vmu/Q6VCZTWXsX

AWm3o2Fk8yG+qJMi65UMyUcWEJvVnMxJqkaectNTj8WHDeOmXPnWK4rtr277//3JB6r+NGi

kL/5FMKOVY+gp4RKifSw4BIIeM5EhQJyXnuL9GYIevGyXQYE5gKr5pjHKyJIqjuXc8MxvpO

0SIsSoNqt2alWe4jeQKMjWkpcWDv/cAaigt5Z4oYAeAY/VixUaS+Xj3X9yAA==

Received: from sjc01-c01-uns21-654c598c6d-d96jp (unknown [10.13.185.88])

by sjc01-c01-mrs02.ringcentral.com (Postfix) with ESMTP id 11C52C98D04

for ; Mon, 9 Feb 2026 15:28:26 +0000 (UTC)

Date: Mon, 9 Feb 2026 15:28:26 +0000 (UTC)

From: RingCentral

To: doctor

Message-ID:

Subject: Cancelled: paid from your account today

MIME-Version: 1.0

Content-Type: multipart/mixed;

boundary="----=_Part_10791145_1880152538.1770650906066"

X-Spam_score: 5.2

X-Spam_score_int: 52

X-Spam_bar: +++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview:



Content analysis details: (5.2 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[199.255.122.177 listed in will-spam-for-food.eu.org]

[199.255.122.177 listed in will-spam-for-food.eu.org]

[199.255.122.177 listed in will-spam-for-food.eu.org]

[199.255.122.177 listed in will-spam-for-food.eu.org]

[199.255.122.177 listed in will-spam-for-food.eu.org]

[199.255.122.177 listed in will-spam-for-food.eu.org]

[199.255.122.177 listed in will-spam-for-food.eu.org]

[199.255.122.177 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[199.255.122.177 listed in dnsbl.ahbl.org]

[199.255.122.177 listed in dnsbl.ahbl.org]

[199.255.122.177 listed in dnsbl.ahbl.org]

[199.255.122.177 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[199.255.122.177 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[199.255.122.177 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[199.255.122.177 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[199.255.122.177 listed in dnsbl.ahbl.org]

-2.3 RCVD_IN_DNSWL_MED RBL: Sender listed at http://www.dnswl.org/, medium

trust

[199.255.122.177 listed in list.dnswl.org]

-0.0 SPF_PASS SPF: sender matches SPF record

0.5 NO_RDNS Sending MTA has no reverse DNS (Postfix variant)

-0.0 T_RP_MATCHES_RCVD Envelope sender domain matches handover relay

domain

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

2.0 RATWR8_MESSID Message-ID with excessive dashes and dollars

Subject: {SPAM?} Cancelled: paid from your account today



------=_Part_10791145_1880152538.1770650906066

Content-Type: multipart/alternative;

boundary="----=_Part_10791144_895019962.1770650906065"



------=_Part_10791144_895019962.1770650906065

Content-Type: text/html; charset=utf-8

Content-Transfer-Encoding: 7bit





































------=_Part_10791144_895019962.1770650906065

Content-Type: text/calendar; method=CANCEL; charset=UTF-8; charset=UTF-8

Content-Transfer-Encoding: quoted-printable



BEGIN:VCALENDAR

PRODID:-//RingCentral//NONSGML RCW//EN

VERSION:2.0

CALSCALE:GREGORIAN

METHOD:CANCEL

BEGIN:VTIMEZONE

TZID:Etc/UTC

LAST-MODIFIED:20250410T142246Z

TZURL:https://www.tzurl.org/zoneinfo/Etc/UTC

X-LIC-LOCATION:Etc/UTC

X-PROLEPTIC-TZNAME:UTC

BEGIN:STANDARD

TZNAME:UTC

TZOFFSETFROM:+0000

TZOFFSETTO:+0000

DTSTART:16010101T000000

END:STANDARD

END:VTIMEZONE

BEGIN:VEVENT

DTSTAMP:20260209T152826Z

SUMMARY:Cancelled: paid from your account today

DTSTART;TZID=3DEtc/UTC:20260210T154500

DTEND;TZID=3DEtc/UTC:20260210T164500

DESCRIPTION:Cancelled: paid from your account today

LOCATION:https://v.ringcentral.com/w/join/AgABifANFO1zunN6go6tACkFA4v_LAg1M=

REftX6e9G1Rv273I2pf5wogYrQRQ7U0MO-BoDMoHZNdAA?route=3Ddcaefb55c7370c62&pw=

=3Da140aea18d8e91b24ce8f017a539384a3487d65c05dd000d20db152e54248de8

ORGANIZER;CN=3D"=F0=9D=90=8F=F0=9D=90=9A=F0=9D=90=B2=F0=9D=90=8F=F0=9D=90=

=9A=F0=9D=90=A5 =F0=9D=90=80=F0=9D=90=AE=F0=9D=90=AD=F0=9D=90=A8=F0=9D=90=

=A6=F0=9D=90=9A=F0=9D=90=AD=F0=9D=90=9E=F0=9D=90=9D =F0=9D=90=81=F0=9D=90=

=A2=F0=9D=90=A5=F0=9D=90=A5 =F0=9D=97=9C=F0=9D=97=BA=F0=9D=97=BD=F0=9D=97=

=BC=F0=9D=97=BF=F0=9D=98=81=F0=9D=97=AE=F0=9D=97=BB=F0=9D=98=81 =F0=9D=97=

=A1=F0=9D=97=BC=F0=9D=98=81=F0=9D=97=B6=F0=9D=97=B0=F0=9D=97=B2 =F0=9D=97=

=95=F0=9D=98=86 =F0=9D=97=94=F0=9D=97=A8=F0=9D=97=A6=F0=9D=97=A7=F0=9D=97=

=A5=F0=9D=97=94=F0=9D=97=9F=F0=9D=97=9C=F0=9D=97=94 GOV":mailto:jamesmartin=

12091@outlook.com

ATTENDEE;CUTYPE=3DINDIVIDUAL;RSVP=3DFALSE;ROLE=3DREQ-PARTICIPANT;PARTSTAT=

=3DNEEDS-ACTION;CN=3Ddoctor:mailto:doctor@doctor.nl2k.ab.ca

STATUS:CANCELLED

UID:dd005070-ec02-49bd-9a97-21c8619c46b0

SEQUENCE:6

END:VEVENT

END:VCALENDAR



------=_Part_10791144_895019962.1770650906065--



------=_Part_10791145_1880152538.1770650906066

Content-Type: application/ics; name=iCalendar.ics

Content-Transfer-Encoding: base64

Content-Disposition: attachment; filename=iCalendar.ics



QkVHSU46VkNBTEVOREFSDQpQUk9ESUQ6LS8vUmluZ0NlbnRyYWwvL05PTlNHTUwgUkNXLy9FTg0K

VkVSU0lPTjoyLjANCkNBTFNDQUxFOkdSRUdPUklBTg0KTUVUSE9EOkNBTkNFTA0KQkVHSU46VlRJ

TUVaT05FDQpUWklEOkV0Yy9VVEMNCkxBU1QtTU9ESUZJRUQ6MjAyNTA0MTBUMTQyMjQ2Wg0KVFpV

Ukw6aHR0cHM6Ly93d3cudHp1cmwub3JnL3pvbmVpbmZvL0V0Yy9VVEMNClgtTElDLUxPQ0FUSU9O

OkV0Yy9VVEMNClgtUFJPTEVQVElDLVRaTkFNRTpVVEMNCkJFR0lOOlNUQU5EQVJEDQpUWk5BTUU6

VVRDDQpUWk9GRlNFVEZST006KzAwMDANClRaT0ZGU0VUVE86KzAwMDANCkRUU1RBUlQ6MTYwMTAx

MDFUMDAwMDAwDQpFTkQ6U1RBTkRBUkQNCkVORDpWVElNRVpPTkUNCkJFR0lOOlZFVkVOVA0KRFRT

VEFNUDoyMDI2MDIwOVQxNTI4MjZaDQpTVU1NQVJZOkNhbmNlbGxlZDogcGFpZCBmcm9tIHlvdXIg

YWNjb3VudCB0b2RheQ0KRFRTVEFSVDtUWklEPUV0Yy9VVEM6MjAyNjAyMTBUMTU0NTAwDQpEVEVO

RDtUWklEPUV0Yy9VVEM6MjAyNjAyMTBUMTY0NTAwDQpERVNDUklQVElPTjpDYW5jZWxsZWQ6IHBh

aWQgZnJvbSB5b3VyIGFjY291bnQgdG9kYXkNCkxPQ0FUSU9OOmh0dHBzOi8vdi5yaW5nY2VudHJh

bC5jb20vdy9qb2luL0FnQUJpZkFORk8xenVuTjZnbzZ0QUNrRkE0dl9MQWcxTVJFZnRYNmU5RzFS

djI3M0kycGY1d29nWXJRUlE3VTBNTy1Cb0RNb0haTmRBQT9yb3V0ZT1kY2FlZmI1NWM3MzcwYzYy

JnB3PWExNDBhZWExOGQ4ZTkxYjI0Y2U4ZjAxN2E1MzkzODRhMzQ4N2Q2NWMwNWRkMDAwZDIwZGIx

NTJlNTQyNDhkZTgNCk9SR0FOSVpFUjtDTj0i8J2Qj/CdkJrwnZCy8J2Qj/CdkJrwnZClIPCdkIDw

nZCu8J2QrfCdkKjwnZCm8J2QmvCdkK3wnZCe8J2QnSDwnZCB8J2QovCdkKXwnZClIPCdl5zwnZe6

8J2XvfCdl7zwnZe/8J2YgfCdl67wnZe78J2YgSDwnZeh8J2XvPCdmIHwnZe28J2XsPCdl7Ig8J2X

lfCdmIYg8J2XlPCdl6jwnZem8J2Xp/Cdl6XwnZeU8J2Xn/Cdl5zwnZeUIEdPViI6bWFpbHRvOmph

bWVzbWFydGluMTIwOTFAb3V0bG9vay5jb20NCkFUVEVOREVFO0NVVFlQRT1JTkRJVklEVUFMO1JT

VlA9RkFMU0U7Uk9MRT1SRVEtUEFSVElDSVBBTlQ7UEFSVFNUQVQ9TkVFRFMtQUNUSU9OO0NOPWRv

Y3RvcjptYWlsdG86ZG9jdG9yQGRvY3Rvci5ubDJrLmFiLmNhDQpTVEFUVVM6Q0FOQ0VMTEVEDQpV

SUQ6ZGQwMDUwNzAtZWMwMi00OWJkLTlhOTctMjFjODYxOWM0NmIwDQpTRVFVRU5DRTo2DQpFTkQ6

VkVWRU5UDQpFTkQ6VkNBTEVOREFSDQo=

------=_Part_10791145_1880152538.1770650906066--

Ringcentral phish

Posted by Dave Yadallee on
Evidence at spamcop

TD Tax Phish from Sendgrid

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Mon, 09 Feb 2026 14:17:00 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vpYcm-00000000OOO-272V

for dave@doctor.nl2k.ab.ca;

Mon, 09 Feb 2026 14:16:52 -0700

Resent-From: The Doctor

Resent-Date: Mon, 9 Feb 2026 14:16:52 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from s.wrqvqsbb.outbound-mail.sendgrid.net ([149.72.70.187]:61480)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vpWqb-00000000Hj5-1mBY

for root@nk.ca;

Mon, 09 Feb 2026 12:23:09 -0700

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=jzmprdys.xyz;

h=from:subject:date:mime-version:to:content-type:cc:content-type:date:

from:subject:to;

s=s1; bh=PV98il0DvSk/TKXpwmp1B2pKlYwgL9RMnDjVhnGDybs=;

b=fJZI5YItZ9Sh2YAhY9/t9A5ZToJ1FsdOoPZ/AVL4Aye3gLAVySomuNP2hnG7I7U49l0M

QeTydzkGIY6p7winSa4JLBL0/+tQDh583DNV8tJxADZBJvwdwfWvQDK+ZhiFrdB8beoSPL

/j3/KDpZEOeV7tDC+v/n+1OXoseLnUl7QuNoC36rLKiv6Kb8Aj9Wf53zd3bUGqTEr3X2Vk

JBZ6r4AgGDA+r6wS4gCY2NrUVUrJ+oPThqHv025nbKPVjNe+ggPnJnba4CaJYl2OxQ+Xri

FwP2lbXs983zCVYIgOqMUVUlytDir0ySLqypZjceQgMfclFuQ092X6rCFDZVmRdw==

Received: by recvd-6f6cf997fc-xt27h with SMTP id recvd-6f6cf997fc-xt27h-1-698A33DE-A0

2026-02-09 19:22:06.998047838 +0000 UTC m=+4655480.228534305

Received: from seconditions.skin (unknown)

by geopod-ismtpd-6 (SG)

with ESMTP id bsflx6D-SuGBEuBbugW_Vg

for ;

Mon, 09 Feb 2026 19:22:06.252 +0000 (UTC)

Message-Id:

From: TD-notice

Subject: Mandatory Documentation Action Required =?UTF-8?B?4oCT?= W-8BEN No

Longer Valid

Date: Mon, 09 Feb 2026 19:22:07 +0000 (UTC)

X-Priority: 5

X-Mailer: xbawirxb xrohhjggpdv 439

Mime-Version: 1.0

X-SG-EID:

=?us-ascii?Q?u001=2EBQOnaZVuEk4VEiyaFh68FFjsxHZyQMJZYt8FbP4o6FjcUYnmu+QdhBCqH?=

=?us-ascii?Q?sO9b5QaiQ4YICaUQFLY9UzAZnuD+A2JiTJcoux7?=

=?us-ascii?Q?uuNHbt1MFGBVApiW9SWIbxfvUH4EqDfL2X4BiRj?=

=?us-ascii?Q?PasNnNWJqxje=2FLX6GFilZAAmt1F5gQlVE7dvrCF?=

=?us-ascii?Q?8DFYOO5qszFNo0d9xvmxs+ucVtqSFUgHrd4FOTY?=

=?us-ascii?Q?Jl4kZXyq5IZDbx8FKgDbyc=3D?=

To: root@nk.ca

X-Entity-ID: u001.pCvvVzzRycJWOxDkW1hiQg==

Content-Type: multipart/alternative;

boundary="9f972494139b3102e2735725000150c1"

X-Spam_score: 37.4

X-Spam_score_int: 374

X-Spam_bar: +++++++++++++++++++++++++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Mandatory Account Update – Expired W-8BEN Must Be RenewedDear

Client,This notice is issued to advise you that the W-8BEN form associated

with your account has expired and is no longer valid for tax [...]



Content analysis details: (37.4 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[149.72.70.187 listed in will-spam-for-food.eu.org]

[149.72.70.187 listed in will-spam-for-food.eu.org]

[149.72.70.187 listed in will-spam-for-food.eu.org]

[149.72.70.187 listed in will-spam-for-food.eu.org]

[149.72.70.187 listed in will-spam-for-food.eu.org]

[149.72.70.187 listed in will-spam-for-food.eu.org]

[149.72.70.187 listed in will-spam-for-food.eu.org]

[149.72.70.187 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[149.72.70.187 listed in dnsbl.ahbl.org]

[149.72.70.187 listed in dnsbl.ahbl.org]

[149.72.70.187 listed in dnsbl.ahbl.org]

[149.72.70.187 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[149.72.70.187 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[149.72.70.187 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[149.72.70.187 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[149.72.70.187 listed in dnsbl.ahbl.org]

2.5 URIBL_DBL_SPAM Contains a spam URL listed in the DBL blocklist

[URI: aarrnpjsvvjh.com]

[URI: jzmprdys.xyz]

-0.0 RCVD_IN_MSPIKE_H3 RBL: Good reputation (+3)

[149.72.70.187 listed in wl.mailspike.net]

-0.0 SPF_PASS SPF: sender matches SPF record

-0.0 RCVD_IN_MSPIKE_WL Mailspike good senders

15 GR_DOMAIN_SENDGR1 Received contains spammer id (sendgr)

1.7 SARE_XMAIL_SUSP2 X-Mailer suggests spam (variant 2)

2.0 PDS_OTHER_BAD_TLD Untrustworthy TLDs

[URI: jzmprdys.xyz (xyz)]

0.6 J_CHICKENPOX_27 BODY: 2alpha-pock-7alpha

0.6 J_CHICKENPOX_64 BODY: 6alpha-pock-4alpha

0.6 J_CHICKENPOX_32 BODY: 3alpha-pock-2alpha

0.6 J_CHICKENPOX_44 BODY: 4alpha-pock-4alpha

1.5 MR_STRANGE_QUESTION URI: No description available.

0.5 URI_NOVOWEL URI: URI hostname has long non-vowel sequence

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

3.0 VOWEL_URI_7 RAW: URI hostname with 7+ consecutive vowels

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

0.5 FROM_SUSPICIOUS_NTLD From abused NTLD

0.8 FROM_SUSPICIOUS_NTLD_FP From abused NTLD

1.5 VOWEL_FROM_6 Impronouncable from header (6 consecutive vowels)

1.0 XPRIO Has X-Priority header

Subject: {SPAM?} Mandatory Documentation Action Required =?UTF-8?B?4oCT?= W-8BEN No

Longer Valid





TD TD Direct Investing Logo

Mandatory Account Update – Expired W-8BEN Must Be Renewed



Dear Client,



This notice is issued to advise you that the W-8BEN form associated with your account has expired and is no longer valid for tax compliance or reporting purposes. The W-8BEN is required to certify non-U.S. tax residency and to support the correct application of withholding and reporting obligations under applicable tax laws.



Following expiration, the form cannot be relied upon to claim reduced withholding rates or other tax-related benefits. Regulatory standards require that valid documentation be maintained. Without a renewed W-8BEN on file, standard withholding treatment may be applied to your account.



To maintain compliant tax records and ensure proper handling of your account, you are required to submit a renewed W-8BEN through our secure documentation system.



To begin the renewal process, please access the secure system below:



Complete Update



Login with the email address you used to register to complete your application today, or access your application using your WebBroker Username/Connect ID and password, or your EasyWeb Username/Access Card and password.

Questions? We're Ready to Help!



Call 1‑800‑465‑5463 to speak to a licensed Investment Representative from Monday to Friday, 7:00 a.m. to 10:00 p.m. EST (one-hour extension).



Thank you,



TD Direct Investing

Contact Us | Privacy & Security | Legal



TD Direct Investing is a division of TD Waterhouse Canada Inc., a subsidiary of The Toronto‑Dominion Bank.



® The TD logo and other TD trademarks are the property of The Toronto‑Dominion Bank or its subsidiaries.



If you wish to unsubscribe from receiving commercial electronic messages from TD Bank Group, please click here

TD Phish from Sendgrid

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Mon, 09 Feb 2026 10:09:00 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vpUkG-00000000I9n-1aTA

for dave@doctor.nl2k.ab.ca;

Mon, 09 Feb 2026 10:08:20 -0700

Resent-From: The Doctor

Resent-Date: Mon, 9 Feb 2026 10:08:20 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from s.wrqvqsbb.outbound-mail.sendgrid.net ([149.72.70.187]:24868)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vpSjI-00000000DpO-1e7P

for root@nk.ca;

Mon, 09 Feb 2026 07:59:20 -0700

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=jzmprdys.xyz;

h=from:subject:date:mime-version:to:content-type:cc:content-type:date:

from:subject:to;

s=s1; bh=snA9H1tz4xeWbPy2ZodijVI+gVFS/ueIVRr0cBUbLKw=;

b=F2ves8K90VthU/GNImQ0CcfjXiWgFbs49Cgn6JngvrWOMXrsn68uxgAleGvEWWAIvpfP

f2XADSASotm7yy/rz4+uNuyabIKRbgtjKxJwLo5qV+je7Pcz4vZVqcVbuGDqT7IlV5ay2p

qq5xDr/KxjAPJzBMhEaUHrDiprTMS0W40o0fyvrAMe2UD5w9mFlNa+AC88fyBjF7ZEFrSA

ZI9pI00ggA9iCnxjXJ13AtqmCzc3RdFqQ7hcckHYNakVXu2Y1Schek/38hNmB7wWir7p/S

6E259/hP78S/1O+uz/YbDm98O9S49VDm4HHaf2Oq962spHsyC0wvENBP8UurCkeQ==

Received: by recvd-7df6f77f7b-2srb9 with SMTP id recvd-7df6f77f7b-2srb9-1-6989F60A-53

2026-02-09 14:58:18.773042421 +0000 UTC m=+4639416.608387504

Received: from appsforagri.eu (unknown)

by geopod-ismtpd-1 (SG) with ESMTP

id MMaeORCIR0iAXKBZdhwg4g

for ;

Mon, 09 Feb 2026 14:58:18.356 +0000 (UTC)

Message-Id: <87cd3b8969703a639aec633b00125643@jzmprdys.xyz>

From: TD-notice

Subject: Mandatory Documentation Action Required =?UTF-8?B?4oCT?= W-8BEN No

Longer Valid

Date: Mon, 09 Feb 2026 14:58:18 +0000 (UTC)

X-Priority: 5

X-Mailer: Cwddxtxfr Fsulijfjwocadma Qfxziyfpzpvgcj 404.47884

Mime-Version: 1.0

X-SG-EID:

=?us-ascii?Q?u001=2EBQOnaZVuEk4VEiyaFh68FP4VamVqHScvQ9CqFGthhBDhwVY9g2tTsHZ=2Fn?=

=?us-ascii?Q?ti4jreUgMrBTrnsSF3LoJr30TSmlbHhvLrwcwQ=2F?=

=?us-ascii?Q?LIKiOUCs9vEAfcZxqbXO4WzENJxHnQoHVDMMIRO?=

=?us-ascii?Q?GhFdt7E3P=2FmCRnMSslzX26De3jSyMC66chXr6QG?=

=?us-ascii?Q?sz6qqILThMOcpCESP41ub36A+zDZmgfA+c8qvTn?=

=?us-ascii?Q?pYaMu0Xb=2FQEqYnejx7COgs=3D?=

To: root

X-Entity-ID: u001.pCvvVzzRycJWOxDkW1hiQg==

Content-Type: multipart/alternative;

boundary="e01ebcabb210e21c32317a890004e361"

X-Spam_score: 35.7

X-Spam_score_int: 357

X-Spam_bar: +++++++++++++++++++++++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Mandatory Account Update – Expired W-8BEN Must Be RenewedDear

Client,This notice is issued to advise you that the W-8BEN form associated

with your account has expired and is no longer valid for tax [...]



Content analysis details: (35.7 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[149.72.70.187 listed in will-spam-for-food.eu.org]

[149.72.70.187 listed in will-spam-for-food.eu.org]

[149.72.70.187 listed in will-spam-for-food.eu.org]

[149.72.70.187 listed in will-spam-for-food.eu.org]

[149.72.70.187 listed in will-spam-for-food.eu.org]

[149.72.70.187 listed in will-spam-for-food.eu.org]

[149.72.70.187 listed in will-spam-for-food.eu.org]

[149.72.70.187 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[149.72.70.187 listed in dnsbl.ahbl.org]

[149.72.70.187 listed in dnsbl.ahbl.org]

[149.72.70.187 listed in dnsbl.ahbl.org]

[149.72.70.187 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[149.72.70.187 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[149.72.70.187 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[149.72.70.187 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[149.72.70.187 listed in dnsbl.ahbl.org]

2.5 URIBL_DBL_SPAM Contains a spam URL listed in the DBL blocklist

[URI: aarrnpjsvvjh.com]

[URI: jzmprdys.xyz]

-0.0 RCVD_IN_MSPIKE_H3 RBL: Good reputation (+3)

[149.72.70.187 listed in wl.mailspike.net]

-0.0 SPF_PASS SPF: sender matches SPF record

-0.0 RCVD_IN_MSPIKE_WL Mailspike good senders

15 GR_DOMAIN_SENDGR1 Received contains spammer id (sendgr)

2.0 PDS_OTHER_BAD_TLD Untrustworthy TLDs

[URI: jzmprdys.xyz (xyz)]

0.6 J_CHICKENPOX_27 BODY: 2alpha-pock-7alpha

0.6 J_CHICKENPOX_64 BODY: 6alpha-pock-4alpha

0.6 J_CHICKENPOX_32 BODY: 3alpha-pock-2alpha

0.6 J_CHICKENPOX_44 BODY: 4alpha-pock-4alpha

1.5 MR_STRANGE_QUESTION URI: No description available.

0.5 URI_NOVOWEL URI: URI hostname has long non-vowel sequence

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

3.0 VOWEL_URI_7 RAW: URI hostname with 7+ consecutive vowels

1.5 VOWEL_FROM_6 Impronouncable from header (6 consecutive vowels)

0.8 FROM_SUSPICIOUS_NTLD_FP From abused NTLD

0.5 FROM_SUSPICIOUS_NTLD From abused NTLD

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

1.0 XPRIO Has X-Priority header

Subject: {SPAM?} Mandatory Documentation Action Required =?UTF-8?B?4oCT?= W-8BEN No

Longer Valid



TD TD Direct Investing Logo

Mandatory Account Update – Expired W-8BEN Must Be Renewed



Dear Client,



This notice is issued to advise you that the W-8BEN form associated with your account has expired and is no longer valid for tax compliance or reporting purposes. The W-8BEN is required to certify non-U.S. tax residency and to support the correct application of withholding and reporting obligations under applicable tax laws.



Following expiration, the form cannot be relied upon to claim reduced withholding rates or other tax-related benefits. Regulatory standards require that valid documentation be maintained. Without a renewed W-8BEN on file, standard withholding treatment may be applied to your account.



To maintain compliant tax records and ensure proper handling of your account, you are required to submit a renewed W-8BEN through our secure documentation system.



To begin the renewal process, please access the secure system below:



Complete Update



Login with the email address you used to register to complete your application today, or access your application using your WebBroker Username/Connect ID and password, or your EasyWeb Username/Access Card and password.

Questions? We're Ready to Help!



Call 1‑800‑465‑5463 to speak to a licensed Investment Representative from Monday to Friday, 7:00 a.m. to 10:00 p.m. EST (one-hour extension).



Thank you,



TD Direct Investing

Contact Us | Privacy & Security | Legal



TD Direct Investing is a division of TD Waterhouse Canada Inc., a subsidiary of The Toronto‑Dominion Bank.



® The TD logo and other TD trademarks are the property of The Toronto‑Dominion Bank or its subsidiaries.



If you wish to unsubscribe from receiving commercial electronic messages from TD Bank Group, please click here



Geek squad phish from Google Gmail Part 3

Posted by Dave Yadallee on
@font-face {

font-family: 'Google Sans';

font-style: normal;

font-weight: 500;

src: url(//fonts.gstatic.com/s/googlesans/v14/4UabrENHsxJlGDuGo1OIlLU94Yt=

zCwM.ttf) format('truetype');

}

@font-face {

font-family: 'Google Sans';

font-style: normal;

font-weight: 700;

src: url(//fonts.gstatic.com/s/googlesans/v14/4UabrENHsxJlGDuGo1OIlLV154t=

zCwM.ttf) format('truetype');

}





=20



=20



=20



=20



Geek squad phish from Google Gmail Part 4

Posted by Dave Yadallee on













/InformAction">
emtype=3D"http://schema.org/EmailMessage">
ntent=3D"Clint Batterberry: Esteemed Customer, dispatch finalized for Trans=

action"/>
ma.org/Event">
ventScheduled"/>
chema.org/Organization">
/>
7aJreYj8yQppK"/>
line-height: 1px; height: 0; max-height: 0; width: 0; max-width: 0; opacity=

: 0; overflow: hidden;" itemprop=3D"name">Esteemed Customer, dispatch final=

ized for Transaction
"0" cellspacing=3D"0" role=3D"presentation" align=3D"center" style=3D"width=

:100%;" class=3D"body-container">

=3D"left">
 
>
dding=3D"0" cellspacing=3D"0" role=3D"presentation" align=3D"center" style=

=3D"width:100%;" class=3D"">

eft">


p=3D"description">Esteemed Customer, dispatch finalized for Transaction

=


spacing=3D"0" role=3D"presentation" align=3D"center" style=3D"width:100%;" =

class=3D"">

: 8px; direction: rtl; font-size: 0; padding: 24px 32px; text-align: left; =

vertical-align: top;" class=3D"main-container-inner">

direction: ltr; display: inline-block; vertical-align: top; width: 100%;ove=

rflow: hidden; word-wrap: break-word;">
" cellspacing=3D"0" role=3D"presentation" width=3D"100%" class=3D"main-colu=

mn-table-ltr" style=3D"padding-right: 32px; padding-left: 0;;table-layout: =

fixed;">

l-align:top;">
=3D"presentation" width=3D"100%" style=3D"table-layout: fixed;">
style=3D"font-size: 0; padding: 0; text-align: left; word-break: break-wor=

d;;padding-bottom:24px;">

-style: normal; font-weight: 400; font-size: 14px; line-height: 20px; lette=

r-spacing: 0.2px;color: #3c4043; text-decoration: none;" class=3D"primary-t=

ext" role=3D"presentation">

le=3D"font-size: 0; padding: 0; text-align: left; word-break: break-word;;p=

adding-bottom:2px;">

o, sans-serif;font-weight: 400; font-size: 22px; line-height: 28px;color: #=

3c4043; text-decoration: none;" class=3D"primary-text" role=3D"presentation=

">Esteemed Customer, dispatch finalized for Transac=

tion

align: left; word-break: break-word;;padding-bottom:24px;">

nt-family: Roboto, sans-serif;font-style: normal; font-weight: 400; font-si=

ze: 14px; line-height: 20px; letter-spacing: 0.2px;color: #3c4043; text-dec=

oration: none;" class=3D"primary-text" role=3D"presentation">
den=3D"true">=

Tuesday Feb 10, 2026 =E2=8B=85 4:25am (Eastern Time - New York)
>

t; word-break: break-word;;padding-bottom:24px;">

Roboto, sans-serif;font-style: normal; font-weight: 400; font-size: 14px; =

line-height: 20px; letter-spacing: 0.2px;color: #3c4043; text-decoration: n=

one;" class=3D"primary-text" role=3D"presentation">

GeekSqua=

d Transaction Date: Tuesday, 10 February 2026
Transaction No: NO56931XFH=

6976
{ph}: (859)-312 3507

Membership stays enabled

Esteemed =

Customer,

We are confirming your upcoming automatic renewal with Geek=

Squad. A payment of USD551.77 will be processed today, Tuesday, 10 February=

2026, for your membership renewal.

Purchase Record Archive
strong>
- Quantity: x3 Device
- Product: Complete Access Coverage
=

- Current Plan: 5 Years Warranty
- Payment Method: Auto Debit
- Total=

Paid: USD551.77
- Client ID: MQVYIPUZN4
- Activation Key: 05b590f6-0=

f61-499b-b4da-3af3c9c7902e

This membership will renew automatically e=

ach year unless canceled 48 hours before the renewal date.

Should you=

need to make any changes, please contact our Support Team at (859)-312 350=

7.

Yours kindly,,
Geek Squad By Best Buy
Manage by: Associated =

Teicher
Support Number: 1-(865) 209-0967
{address3}: 4758 N Federal =

Hwy Jacksonville Fl 32235-1506 United States
{hours}


mprop=3D"description" content=3D"GeekSquad Transaction Date: Tuesday, 10 Fe=

bruary 2026Transaction No: NO56931XFH6976{ph}: (859)-312 3507Membership sta=

ys enabledEsteemed Customer,We are confirming your upcoming automatic renew=

al with GeekSquad. A payment of USD551.77 will be processed today, Tuesday,=

10 February 2026, for your membership renewal.Purchase Record Archive- Qua=

ntity: x3 Device- Product: Complete Access Coverage- Current Plan: 5 Years =

Warranty- Payment Method: Auto Debit- Total Paid: USD551.77- Client ID: MQV=

YIPUZN4- Activation Key: 05b590f6-0f61-499b-b4da-3af3c9c7902eThis membershi=

p will renew automatically each year unless canceled 48 hours before the re=

newal date.Should you need to make any changes, please contact our Support =

Team at (859)-312 3507.Yours kindly,,Geek Squad By Best BuyManage by: Assoc=

iated TeicherSupport Number: 1-(865) 209-0967{address3}: 4758 N Federal Hw=

y Jacksonville Fl 32235-1506 United States{hours}"/>

g=3D"0" role=3D"presentation" style=3D"padding-bottom: 4px;">


ass=3D"primary-text" style=3D"font-size: 14px;color: #3c4043; text-decorati=

on: none;font-weight: 700;-webkit-font-smoothing: antialiased;margin: 0; pa=

dding: 0;">Guests

(Guest list has been hidden at orga=

nizer's request)

-[if mso | IE]>

>

--000000000000d3d09d064a69ef18--

Geek squad phish from Google Gmail Part 2

Posted by Dave Yadallee on
--000000000000d3d09d064a69ef18

Content-Type: text/html; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable




schemas-microsoft-com:vml" xmlns:o=3D"urn:schemas-microsoft-com:office:offi=

ce">
t=3D"text/html; charset=3DUTF-8">
=3Ddevice-width,initial-scale=3D1">
ight dark">