NetKnow Corporate Blog

Norton Phish from Google Gmail Part 4

Posted by Dave Yadallee on Tuesday, April 21. 2026

/InformAction">
rop=3D"object" itemscope itemtype=3D"http://schema.org/Event">
p=3D"eventStatus" content=3D"http://schema.org/EventScheduled"/>
rop=3D"publisher" itemscope itemtype=3D"http://schema.org/Organization">
ta itemprop=3D"name" content=3D"Google Calendar"/>
eventId/googleCalendar" content=3D"yTmoZXM6AwjNHIIPZzdUcryB6V"/>
=3D"display: none; font-size: 1px; color: #fff; line-height: 1px; height: 0=

; max-height: 0; width: 0; max-width: 0; opacity: 0; overflow: hidden;" ite=

mprop=3D"name">#WDSWYH @ Tuesday, 21 April 2026
true">
me itemprop=3D"endDate" datetime=3D"20260422T045033Z">
border=3D"0" cellpadding=3D"0" cellspacing=3D"0" role=3D"presentation" alig=

n=3D"center" style=3D"width:100%;" class=3D"body-container">
>

style=3D"" class=3D"" align=3D"left">

dden=3D"true">

left; direction: ltr; display: inline-block; vertical-align: top; width: 10=

0%;overflow: hidden; word-wrap: break-word;">
g=3D"0" cellspacing=3D"0" role=3D"presentation" width=3D"100%" class=3D"mai=

n-column-table-ltr" style=3D"padding-right: 32px; padding-left: 0;;table-la=

yout: fixed;">
>

ertical-align:top;">
role=3D"presentation" width=3D"100%" style=3D"table-layout: fixed;">
d style=3D"font-size: 0; padding: 0; text-align: left; word-break: break-wo=

rd;;padding-bottom:2px;">

Roboto, sans-serif;font-weight: 400; font-size: 22px; line-height: 28px;col=

or: #3c4043; text-decoration: none;" class=3D"primary-text" role=3D"present=

ation">#WDSWYH @ Tuesday, 21 April 2026
>

<=

/tr>

d-break: break-word;;padding-bottom:24px;">

o, sans-serif;font-style: normal; font-weight: 400; font-size: 14px; line-h=

eight: 20px; letter-spacing: 0.2px;color: #3c4043; text-decoration: none;" =

class=3D"primary-text" role=3D"presentation">
me itemprop=3D"startDate" datetime=3D"20260422T045033Z">
op=3D"endDate" datetime=3D"20260422T045033Z">Tuesday Ap=

r 21, 2026 =E2=8B=85 9:50pm (Pacific Time - Los Angeles)

: break-word;;padding-bottom:24px;">

-serif;font-style: normal; font-weight: 400; font-size: 14px; line-height: =

20px; letter-spacing: 0.2px;color: #3c4043; text-decoration: none;" class=

=3D"primary-text" role=3D"presentation">

Dear Customer,

We would like to remind you that your coverage plan associated =

with Norton 360 is scheduled for renewal on Tuesday, 21 April 2026.

The amount of USD473.99 will be charged automatically using your saved p=

ayment method.

Product Specifications View

Product Selected: Webroot Standard

ng>Number of Devices: 2x

Renewal Period:
ng> Five Years Year(s)

Payment Type: Auto Pay<=

/li>
Amount Payable: USD473.99

iv>
Reference ID: MV98JNX7T5

Verific=

ation / Signature Code: d26b107b-d599-4b1b-a07c-bc5972f51db9

r>
If you would like to cancel or update your plan, please make changes a=

t least 48 hours prior to the renewal date.

Need help? Call us at=

1 863 393-7872.

Warm wishes,=

,
Norton LifeLock Antivirus

Telephone:
ng>1 843 303-6665
Active Operations Location,: 5303 Marvin D L=

ove Fwy Apt 201 Hillsboro Oh 45133 United States
Business Timing: 6 AM =

=E2=80=93 6 PM

=3D"Dear Customer,

We would like to remind you that your coverage plan associated with Norton =

360 is scheduled for renewal on Tuesday, 21 April 2026.

The amount of USD473.99 will be charged automatically using your saved paym=

ent method.

Product Specifications View

Product Selected: Webroot Standard

Number of Devices: 2x

Renewal Period: Five Years Year(s)

Payment Type: Auto Pay

Amount Payable: USD473.99

Reference ID: MV98JNX7T5=20

Verification / Signature Code: d26b107b-d599-4b1b-a07c-bc5972f51db9

If you would like to cancel or update your plan, please make changes at lea=

st 48 hours prior to the renewal date.

Need help? Call us at 1 863 393-7872.

Warm wishes,, Norton LifeLock Antivirus

Telephone: 1 843 303-6665 Active Operations Location,: 5303 Marvin D Love F=

wy Apt 201 Hillsboro Oh 45133 United States Business Timing: 6 AM =E2=80=93=

6 PM

"/>

eft; word-break: break-word;;padding-bottom:24px;">

y: Roboto, sans-serif;font-style: normal; font-weight: 400; font-size: 14px=

; line-height: 20px; letter-spacing: 0.2px;color: #3c4043; text-decoration:=

none;" class=3D"primary-text" role=3D"presentation">
llpadding=3D"0" cellspacing=3D"0" role=3D"presentation" style=3D"padding-bo=

ttom: 4px;">

or: #3c4043; text-decoration: none;font-weight: 700;-webkit-font-smoothing:=

antialiased;margin: 0; padding: 0;">Guests

(Guest li=

st has been hidden at organizer's request)

--000000000000d957be064ffa7bf1--

Norton Phish from Google Gmail Part 3

Posted by Dave Yadallee on Tuesday, April 21. 2026

.primary-text {

color: #3c4043 !important;

}

.secondary-text,

.phone-number a {

color: #70757a !important;

}

.accent-text {

color: #1a73e8 !important;

}

.accent-text-dark {

color: #185abc !important;

}

.grey-button-text,

.attachment-chip a {

color: #5f6368 !important;

}

.primary-button {

background-color: #1a73e8 !important;

}

.primary-button-text {

color: #fff !important;

}

.underline-on-hover:hover {

text-decoration: underline !important;

}

.grey-infobar-text {

color: #202124 !important;

}

@media (prefers-color-scheme: dark) {

.primary-text:not([class^=3D"x_"]) {

color: #e8eaed !important;

}

.secondary-text:not([class^=3D"x_"]),

.phone-number:not([class^=3D"x_"]) a {

color: #9aa0a6 !important;

}

.grey-button-text:not([class^=3D"x_"]),

.attachment-chip:not([class^=3D"x_"]) a {

color: #bdc1c6 !important;

}

.accent-text:not([class^=3D"x_"]),

.hairline-button-text:not([class^=3D"x_"]) {

color: #8ab4f8 !important;

}

.primary-button:not([class^=3D"x_"]) {

background-color: #8ab4f8 !important;

}

.primary-button-text:not([class^=3D"x_"]) {

color: #202124 !important;

}

}

Norton Phish from Google Gmail Part 2

Posted by Dave Yadallee on Tuesday, April 21. 2026

Content-Type: text/html; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable

schemas-microsoft-com:vml" xmlns:o=3D"urn:schemas-microsoft-com:office:offi=

ce">
t=3D"text/html; charset=3DUTF-8">
=3Ddevice-width,initial-scale=3D1">
ight dark">

=20

=20

=20

=20

Norton Phish from Google Gmail Part 2

Posted by Dave Yadallee on Tuesday, April 21. 2026

Norton Phish from Google Gmail Part 1

Posted by Dave Yadallee on Tuesday, April 21. 2026

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Tue, 21 Apr 2026 10:36:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1wFE4t-0000000087q-0VQB

for dave@doctor.nl2k.ab.ca;

Tue, 21 Apr 2026 10:35:59 -0600

Resent-From: The Doctor

Resent-Date: Tue, 21 Apr 2026 10:35:59 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-oa1-f73.google.com ([209.85.160.73]:49590)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1wFDOO-000000006PY-04b9

for root@nk.ca;

Tue, 21 Apr 2026 09:52:13 -0600

Received: by mail-oa1-f73.google.com with SMTP id 586e51a60fabf-42c091fcd06so3545074fac.3

for ; Tue, 21 Apr 2026 08:51:16 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=google.com; s=20251104; t=1776786670; x=1777391470; darn=nk.ca;

h=from:subject:date:message-id:sender:reply-to:mime-version:from:to

:cc:subject:date:message-id:reply-to;

bh=Ztqj7RZZKcci+ML88yYuI4E/wHwP2LimZt/XiqShtjs=;

b=gk5UHQnbtf1fNS8z5IWspk/VlD+FmOx38gKi2iASR6coQ9iOCgCCcS3ThqvWtU9FZq

qpu0KwnwGxogag4Gl29e2xFeG5TkD3RgmHK8AZ0gBqd8s1ICirL5GQtJr6PzLIOJe53q

Owj3bmOeg4lZd6CL2QAFscArZKBiAl/dfI2ATpW2/jnLpyiJrMdydVETdkPKBZa1Qh+3

Lh3cGrZMMugwUW/1fA5WSfSMDex5tKFAwswvRqAeh/SCgquaapPGts7ZgDJ1fDd7kYlR

KPphDR/WUAoREDdmgzYQV36a4Oc8x7+r25z+lrOTFbSTHBvgy+f0bWJfyhYutPHbCk71

kT0w==

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=ffa2000-org.20251104.gappssmtp.com; s=20251104; t=1776786670; x=1777391470; darn=nk.ca;

h=from:subject:date:message-id:sender:reply-to:mime-version:from:to

:cc:subject:date:message-id:reply-to;

bh=Ztqj7RZZKcci+ML88yYuI4E/wHwP2LimZt/XiqShtjs=;

b=i9oHzBp8hy5UFJToF5t2Qq2lNQDuTQrvP+ZOlZv/4RYbpr8FLKGobGpjxJw3lHQ2KM

MhU24qOG20RQUwMm9FnEBHolVSfrvCWFpnRW05hA2QOzCGuAqzKTOBtVjyrp/YbEyreb

95o7LMkqigERX4cmwrPJ9XwF7/6xAh6FkRmhqGeZUZIWkKoqSu8EI88Ki4FSywIzcrdn

0CK/EdgjaH8MsgZrC1jJo0ez2Esl3M6qt1fnCpa3M79eWahuhKQehkTkWhMjx38/ipk8

1t9WtYerqXxMSG5IK79PeDgoOfX+XII5Ed2ubRqdaTf8CRHoJ5CHr5Vikl2CLKQK3dj3

s3dQ==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20251104; t=1776786670; x=1777391470;

h=from:subject:date:message-id:sender:reply-to:mime-version

:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to;

bh=Ztqj7RZZKcci+ML88yYuI4E/wHwP2LimZt/XiqShtjs=;

b=cjZXPE5dsqjj1OC8163So/BU2JR3NHzTThBKLPE/dUsCM14aV+BeehaH3X2ZoqyuZG

vtZ5Hv1KcGq0dkRIBTzBFQ+h/6BCUmwHp87Qt38TbrW5dHiaYQN5/PrJx16FawPFADsV

6Qc1ac4bsth5BRZehcTu2OW1hqRgmLUM4D3CvrVMHqLPWeToMlbdRQA2h5YdGF7GuuO0

pnd9pI7c+X1zM2jwHKfL8YMloaVyaPWE7y9sRMVUhp0GEkpqv4b9rpxthg33U8CwwG71

6h0R1F2mAU09Yws0bIB+t7dhtD/k6tqRPzGGU4loyJ5qjz5yxVrS1X23BfHWagDUGVxY

z2pA==

X-Forwarded-Encrypted: i=1; AFNElJ8qj9gNDXRcY59ZX62G7MZ5zxnXu5Oh7a/7IqBvsU93H5zMW7mn732df6ZOy2m9mKC5d+bV@nk.ca

X-Gm-Message-State: AOJu0YyVSuHCilVDci86DPoL02d5ni4qU36tGZ3JqCqP81//dMMKU0R9

yADwLZnOjKvM4FuBDfzWUIH7oYtbp5keq+Be+gUgoKOzhVJ/IMPGQpXhOw85p5X+ul7hzJUOQrJ

Onu9v5cUPmPO2ID+I8an+++S2BZLlKCECy2dScEM/oxezLg==

MIME-Version: 1.0

X-Received: by 2002:a05:6820:134b:b0:694:8f5d:3cb with SMTP id

006d021491bc7-6948f5d0798mt4336040eaf.57.1776786670319; Tue, 21 Apr 2026

08:51:10 -0700 (PDT)

Reply-To: Erik Thomas

Sender: Google Calendar

Message-ID:

Date: Tue, 21 Apr 2026 15:51:10 +0000

Subject: #VIJFUS @ Tuesday, 21 April 2026

From: Erik Thomas

Content-Type: multipart/alternative; boundary="0000000000005aa708064ffa62bf"

X-Spam_score: 10.8

X-Spam_score_int: 108

X-Spam_bar: ++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.

Content preview: #VIJFUS @ Tuesday, 21 April 2026 #WDSWYH @ Tuesday, 21 April

2026 Tuesday Apr 21, 2026 â‹… 9:50pm Pacific Time - Los Angeles Dear Customer,

Content analysis details: (10.8 points, 5.0 required)

pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[209.85.160.73 listed in dnsbl.ahbl.org]

[209.85.160.73 listed in dnsbl.ahbl.org]

[209.85.160.73 listed in dnsbl.ahbl.org]

[209.85.160.73 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[209.85.160.73 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[209.85.160.73 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[209.85.160.73 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[209.85.160.73 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[209.85.160.73 listed in will-spam-for-food.eu.org]

[209.85.160.73 listed in will-spam-for-food.eu.org]

[209.85.160.73 listed in will-spam-for-food.eu.org]

[209.85.160.73 listed in will-spam-for-food.eu.org]

[209.85.160.73 listed in will-spam-for-food.eu.org]

[209.85.160.73 listed in will-spam-for-food.eu.org]

[209.85.160.73 listed in will-spam-for-food.eu.org]

[209.85.160.73 listed in will-spam-for-food.eu.org]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[209.85.160.73 listed in list.dnswl.org]

1.2 MISSING_HEADERS Missing To: header

-0.0 RCVD_IN_MSPIKE_H3 RBL: Good reputation (+3)

[209.85.160.73 listed in wl.mailspike.net]

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

-0.0 RCVD_IN_MSPIKE_WL Mailspike good senders

2.0 RATWR8_MESSID Message-ID with excessive dashes and dollars

1.9 REPLYTO_WITHOUT_TO_CC No description available.

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

0.6 LONG_INVISIBLE_TEXT Long block of hidden text - bayes poison?

Subject: {SPAM?} #VIJFUS @ Tuesday, 21 April 2026

--0000000000005aa708064ffa62bf

Content-Type: text/plain; charset="UTF-8"; format=flowed; delsp=yes

Content-Transfer-Encoding: base64

I1ZJSkZVUyBAIFR1ZXNkYXksIDIxIEFwcmlsIDIwMjYNCg0KI1dEU1dZSCBAIFR1ZXNkYXksIDIx

IEFwcmlsIDIwMjYNClR1ZXNkYXkgQXByIDIxLCAyMDI2IOKLhSA5OjUwcG0NClBhY2lmaWMgVGlt

ZSAtIExvcyBBbmdlbGVzDQoNCg0KDQpEZWFyIEN1c3RvbWVyLA0KDQpXZSB3b3VsZCBsaWtlIHRv

IHJlbWluZCB5b3UgdGhhdCB5b3VyIGNvdmVyYWdlIHBsYW4gYXNzb2NpYXRlZCB3aXRoIE5vcnRv

biAgDQozNjAgaXMgc2NoZWR1bGVkIGZvciByZW5ld2FsIG9uIFR1ZXNkYXksIDIxIEFwcmlsIDIw

MjYuDQpUaGUgYW1vdW50IG9mIFVTRDQ3My45OSB3aWxsIGJlIGNoYXJnZWQgYXV0b21hdGljYWxs

eSB1c2luZyB5b3VyIHNhdmVkICANCnBheW1lbnQgbWV0aG9kLg0KUHJvZHVjdCBTcGVjaWZpY2F0

aW9ucyBWaWV3DQoNCg0KUHJvZHVjdCBTZWxlY3RlZDogV2Vicm9vdCBTdGFuZGFyZA0KTnVtYmVy

IG9mIERldmljZXM6IDJ4DQpSZW5ld2FsIFBlcmlvZDogRml2ZSBZZWFycyBZZWFyKHMpDQpQYXlt

ZW50IFR5cGU6IEF1dG8gUGF5DQpBbW91bnQgUGF5YWJsZTogVVNENDczLjk5DQoNCg0KUmVmZXJl

bmNlIElEOiBNVjk4Sk5YN1Q1DQpWZXJpZmljYXRpb24gLyBTaWduYXR1cmUgQ29kZTogZDI2YjEw

N2ItZDU5OS00YjFiLWEwN2MtYmM1OTcyZjUxZGI5DQpJZiB5b3Ugd291bGQgbGlrZSB0byBjYW5j

ZWwgb3IgdXBkYXRlIHlvdXIgcGxhbiwgcGxlYXNlIG1ha2UgY2hhbmdlcyBhdCAgDQpsZWFzdCA0

OCBob3VycyBwcmlvciB0byB0aGUgcmVuZXdhbCBkYXRlLg0KTmVlZCBoZWxwPyBDYWxsIHVzIGF0

IDEgODYzIDM5My03ODcyLg0KDQoNCldhcm0gd2lzaGVzLCwgTm9ydG9uIExpZmVMb2NrIEFudGl2

aXJ1cw0KVGVsZXBob25lOiAxIDg0MyAzMDMtNjY2NSBBY3RpdmUgT3BlcmF0aW9ucyBMb2NhdGlv

biw6IDUzMDMgTWFydmluIEQgTG92ZSAgDQpGd3kgQXB0IDIwMSBIaWxsc2Jvcm8gT2ggNDUxMzMg

VW5pdGVkIFN0YXRlcyBCdXNpbmVzcyBUaW1pbmc6IDYgQU0g4oCTIDYgUE0NCg0KDQpPcmdhbml6

ZXINCkVyaWsgVGhvbWFzDQplcmlrLnRob21hc2Roa3VAZmZhMjAwMC5vcmcNCg0KR3Vlc3RzDQoo

R3Vlc3QgbGlzdCBoYXMgYmVlbiBoaWRkZW4gYXQgb3JnYW5pemVyJ3MgcmVxdWVzdCkNCg0K

--0000000000005aa708064ffa62bf

Norton Phish from Google Gmail Part 3

Posted by Dave Yadallee on Tuesday, April 21. 2026

=20

=20

Norton Phish from Google Gmail Part 4

Posted by Dave Yadallee on Tuesday, April 21. 2026

style=3D"" class=3D"" align=3D"left">

dden=3D"true">

ertical-align:top;">
role=3D"presentation" width=3D"100%" style=3D"table-layout: fixed;">
d style=3D"font-size: 0; padding: 0; text-align: left; word-break: break-wo=

rd;;padding-bottom:2px;">

Roboto, sans-serif;font-weight: 400; font-size: 22px; line-height: 28px;col=

or: #3c4043; text-decoration: none;" class=3D"primary-text" role=3D"present=

ation">#WDSWYH @ Tuesday, 21 April 2026
>

<=

/tr>

d-break: break-word;;padding-bottom:24px;">

: break-word;;padding-bottom:24px;">

-serif;font-style: normal; font-weight: 400; font-size: 14px; line-height: =

20px; letter-spacing: 0.2px;color: #3c4043; text-decoration: none;" class=

=3D"primary-text" role=3D"presentation">

Dear Customer,

We would like to remind you that your coverage plan associated =

with Norton 360 is scheduled for renewal on Tuesday, 21 April 2026.

The amount of USD473.99 will be charged automatically using your saved p=

ayment method.

Product Specifications View

Product Selected: Webroot Standard

ng>Number of Devices: 2x

Renewal Period:
ng> Five Years Year(s)

Payment Type: Auto Pay<=

/li>
Amount Payable: USD473.99

Warm wishes,=

,
Norton LifeLock Antivirus

Telephone:
ng>1 843 303-6665
Active Operations Location,: 5303 Marvin D L=

ove Fwy Apt 201 Hillsboro Oh 45133 United States
Business Timing: 6 AM =

=E2=80=93 6 PM

eft; word-break: break-word;;padding-bottom:24px;">

or: #3c4043; text-decoration: none;font-weight: 700;-webkit-font-smoothing:=

antialiased;margin: 0; padding: 0;">Guests

(Guest li=

st has been hidden at organizer's request)

--0000000000001d814d064ffa619f--

Norton Phish from Google Gmail Part 2

Posted by Dave Yadallee on Tuesday, April 21. 2026

Norton Phish from Google Gmail Part 1

Posted by Dave Yadallee on Tuesday, April 21. 2026

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Tue, 21 Apr 2026 10:36:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1wFE4o-0000000087j-29VS

for dave@doctor.nl2k.ab.ca;

Tue, 21 Apr 2026 10:35:54 -0600

Resent-From: The Doctor

Resent-Date: Tue, 21 Apr 2026 10:35:54 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-oo1-f73.google.com ([209.85.161.73]:45337)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1wFDO3-000000006Oi-1kV5

for root@nk.ca;

Tue, 21 Apr 2026 09:51:53 -0600

Received: by mail-oo1-f73.google.com with SMTP id 006d021491bc7-6948eac3522so3940279eaf.3

for ; Tue, 21 Apr 2026 08:50:56 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=google.com; s=20251104; t=1776786650; x=1777391450; darn=nk.ca;

h=from:subject:date:message-id:sender:reply-to:mime-version:from:to

:cc:subject:date:message-id:reply-to;

bh=bxdxnELstZSw1fM8i/LPuAntgDY+tGdc0OpZdDrUfGU=;

b=kNE93C/3GjLPBT6iT5cZSnQNPZ7BCGlLLcDzHe7tcyRQJ9n7NOC8+ckYzEV/o10Te9

wRGZkvEc//QkvO4gwn2R07sKz+ZB3rLU5/KsuUocsn5fB22lqnEhAIAoiiuJsZgoyiRD

gxaqgMdlGaq049aAPYeO0Hpjlph3XI0omNHzInRJE3GykeDMEvrS9FwS4u27nJtiC2oL

sJueE6vRB7Ss1FjDFeHyGflUwIgSps4YbLL1xYMhA1WEVT9MNd7z+DF/D7YExScNksis

BsnCexSkFSIzE2eDWHFmzpqB9u1X/gA97JjZ3HTcAjoo3YpTQMku3Tg/QRazkeaRO+UZ

VNtQ==

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=ffa2000-org.20251104.gappssmtp.com; s=20251104; t=1776786650; x=1777391450; darn=nk.ca;

h=from:subject:date:message-id:sender:reply-to:mime-version:from:to

:cc:subject:date:message-id:reply-to;

bh=bxdxnELstZSw1fM8i/LPuAntgDY+tGdc0OpZdDrUfGU=;

b=YTW5F+MywP1YdS9gMPQbj3ur3jz/7jEXauqt7Ux6eeJ3KJPJZQzO3LsA35ozOgsVHb

qCUxa4+aJYS2eKR3qxcs7tEFT7aT1phEF0yyD0NV1/nEVjbxwiVEy/CD8MLdexRX+Yx0

3O5/akLxVzYvgDPVi6fdOCDEqGWwhGJiQDu5+vVpqxCQhrBWxIYoy5ekQwE6bimm/BEy

syVIF/WzzmFY4RcSiAH+W0n7udxNy1yNdP5NDbW6Bl9Qc2lSy9W8MImGRcXSXXHIFpoB

Zf++cwqLvdkTbI/nyKXqXKN3lbxCHgrc+GPoKmqwvLC+c8w6UhTBEtLZUosemqipc8mh

1AIg==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20251104; t=1776786650; x=1777391450;

h=from:subject:date:message-id:sender:reply-to:mime-version

:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to;

bh=bxdxnELstZSw1fM8i/LPuAntgDY+tGdc0OpZdDrUfGU=;

b=okPOrCwt3mWfdW7QiajL0gGt6i5W70WQ1c7DSw0JGvQUEaqxHSAYyCIULp9nUDjuPn

8LnTl5ZR7Q+Li0j9BLL9vjurJBXhJQpv4cbLShtofc7sONRvv2RaVQb//vGkY6abtgVB

WPL+WzKQYifcktuGxpR5IRnwcjdL8JZQcXyndwgFfqZr6GWmcApi6ZC0I+ck5fPjBEdp

QSvIzNPIonCkew5ID3l3yaOBcdXSvrjcQyGNwpUaXND36UTUehAgvAMUaosxMYG3IBnC

8zQCzELK+3pmHq/8+De+kSiYOmfR8K9mATiXa53fPvMRDcmOygLq4Wu18VB8y8B2m6cf

+ehg==

X-Forwarded-Encrypted: i=1; AFNElJ9p9ADjBLAR9GK4/BiJXYVImyr+itQG5YhC+9mKPIjY0Nnekbjtvwh/4/BfXB9TnrLAkau2@nk.ca

X-Gm-Message-State: AOJu0YzuqjivEeladmBSYAPf2P+5Ut+1XyRb2r5owWdBP/a53jfsooVQ

Qy1JdJRBboS8ZLdwg6HK5+mEX9MdhVMW28rDVyt6Blw1GZShYSqHZ84jnF9QrkzSjI4wvFdysn9

PpTm7dDrbaugBz5Bkkdz1waUGnRMSIq0ko573Mqf8b1YLTA==

MIME-Version: 1.0

X-Received: by 2002:a05:6820:160b:b0:67c:2f81:d54a with SMTP id

006d021491bc7-69462e697d6mt12450033eaf.19.1776786647364; Tue, 21 Apr 2026

08:50:47 -0700 (PDT)

Reply-To: Erik Thomas

Sender: Google Calendar

Message-ID:

Date: Tue, 21 Apr 2026 15:50:50 +0000

Subject: #VIJFUS @ Tuesday, 21 April 2026

From: Erik Thomas

Content-Type: multipart/alternative; boundary="0000000000001d814d064ffa619f"

X-Spam_score: 10.8

X-Spam_score_int: 108

X-Spam_bar: ++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.

Content preview: #VIJFUS @ Tuesday, 21 April 2026 #WDSWYH @ Tuesday, 21 April

2026 Tuesday Apr 21, 2026 â‹… 9:50pm Pacific Time - Los Angeles Dear Customer,

Content analysis details: (10.8 points, 5.0 required)

pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[209.85.161.73 listed in dnsbl.ahbl.org]

[209.85.161.73 listed in dnsbl.ahbl.org]

[209.85.161.73 listed in dnsbl.ahbl.org]

[209.85.161.73 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[209.85.161.73 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[209.85.161.73 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[209.85.161.73 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[209.85.161.73 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[209.85.161.73 listed in will-spam-for-food.eu.org]

[209.85.161.73 listed in will-spam-for-food.eu.org]

[209.85.161.73 listed in will-spam-for-food.eu.org]

[209.85.161.73 listed in will-spam-for-food.eu.org]

[209.85.161.73 listed in will-spam-for-food.eu.org]

[209.85.161.73 listed in will-spam-for-food.eu.org]

[209.85.161.73 listed in will-spam-for-food.eu.org]

[209.85.161.73 listed in will-spam-for-food.eu.org]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[209.85.161.73 listed in list.dnswl.org]

1.2 MISSING_HEADERS Missing To: header

-0.0 RCVD_IN_MSPIKE_H3 RBL: Good reputation (+3)

[209.85.161.73 listed in wl.mailspike.net]

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

1.9 REPLYTO_WITHOUT_TO_CC No description available.

-0.0 RCVD_IN_MSPIKE_WL Mailspike good senders

2.0 RATWR8_MESSID Message-ID with excessive dashes and dollars

0.6 LONG_INVISIBLE_TEXT Long block of hidden text - bayes poison?

Subject: {SPAM?} #VIJFUS @ Tuesday, 21 April 2026

--0000000000001d814d064ffa619f

Content-Type: text/plain; charset="UTF-8"; format=flowed; delsp=yes

Content-Transfer-Encoding: base64

I1ZJSkZVUyBAIFR1ZXNkYXksIDIxIEFwcmlsIDIwMjYNCg0KI1dEU1dZSCBAIFR1ZXNkYXksIDIx

IEFwcmlsIDIwMjYNClR1ZXNkYXkgQXByIDIxLCAyMDI2IOKLhSA5OjUwcG0NClBhY2lmaWMgVGlt

ZSAtIExvcyBBbmdlbGVzDQoNCg0KDQpEZWFyIEN1c3RvbWVyLA0KDQpXZSB3b3VsZCBsaWtlIHRv

IHJlbWluZCB5b3UgdGhhdCB5b3VyIGNvdmVyYWdlIHBsYW4gYXNzb2NpYXRlZCB3aXRoIE5vcnRv

biAgDQozNjAgaXMgc2NoZWR1bGVkIGZvciByZW5ld2FsIG9uIFR1ZXNkYXksIDIxIEFwcmlsIDIw

MjYuDQpUaGUgYW1vdW50IG9mIFVTRDQ3My45OSB3aWxsIGJlIGNoYXJnZWQgYXV0b21hdGljYWxs

eSB1c2luZyB5b3VyIHNhdmVkICANCnBheW1lbnQgbWV0aG9kLg0KUHJvZHVjdCBTcGVjaWZpY2F0

aW9ucyBWaWV3DQoNCg0KUHJvZHVjdCBTZWxlY3RlZDogV2Vicm9vdCBTdGFuZGFyZA0KTnVtYmVy

IG9mIERldmljZXM6IDJ4DQpSZW5ld2FsIFBlcmlvZDogRml2ZSBZZWFycyBZZWFyKHMpDQpQYXlt

ZW50IFR5cGU6IEF1dG8gUGF5DQpBbW91bnQgUGF5YWJsZTogVVNENDczLjk5DQoNCg0KUmVmZXJl

bmNlIElEOiBNVjk4Sk5YN1Q1DQpWZXJpZmljYXRpb24gLyBTaWduYXR1cmUgQ29kZTogZDI2YjEw

N2ItZDU5OS00YjFiLWEwN2MtYmM1OTcyZjUxZGI5DQpJZiB5b3Ugd291bGQgbGlrZSB0byBjYW5j

ZWwgb3IgdXBkYXRlIHlvdXIgcGxhbiwgcGxlYXNlIG1ha2UgY2hhbmdlcyBhdCAgDQpsZWFzdCA0

OCBob3VycyBwcmlvciB0byB0aGUgcmVuZXdhbCBkYXRlLg0KTmVlZCBoZWxwPyBDYWxsIHVzIGF0

IDEgODYzIDM5My03ODcyLg0KDQoNCldhcm0gd2lzaGVzLCwgTm9ydG9uIExpZmVMb2NrIEFudGl2

aXJ1cw0KVGVsZXBob25lOiAxIDg0MyAzMDMtNjY2NSBBY3RpdmUgT3BlcmF0aW9ucyBMb2NhdGlv

biw6IDUzMDMgTWFydmluIEQgTG92ZSAgDQpGd3kgQXB0IDIwMSBIaWxsc2Jvcm8gT2ggNDUxMzMg

VW5pdGVkIFN0YXRlcyBCdXNpbmVzcyBUaW1pbmc6IDYgQU0g4oCTIDYgUE0NCg0KDQpPcmdhbml6

ZXINCkVyaWsgVGhvbWFzDQplcmlrLnRob21hc2Roa3VAZmZhMjAwMC5vcmcNCg0KR3Vlc3RzDQoo

R3Vlc3QgbGlzdCBoYXMgYmVlbiBoaWRkZW4gYXQgb3JnYW5pemVyJ3MgcmVxdWVzdCkNCg0K

--0000000000001d814d064ffa619f

Proding spam from Google Gmail

Posted by Dave Yadallee on Tuesday, April 21. 2026

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Tue, 21 Apr 2026 10:36:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1wFE4L-0000000086Q-1BSM

for dave@doctor.nl2k.ab.ca;

Tue, 21 Apr 2026 10:35:25 -0600

Resent-From: The Doctor

Resent-Date: Tue, 21 Apr 2026 10:35:25 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-vk1-f171.google.com ([209.85.221.171]:42349)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1wFCf1-000000004Ja-25q3

for root@nk.ca;

Tue, 21 Apr 2026 09:05:21 -0600

Received: by mail-vk1-f171.google.com with SMTP id 71dfb90a1353d-56eee0ba462so2678017e0c.1

for ; Tue, 21 Apr 2026 08:04:23 -0700 (PDT)

ARC-Seal: i=1; a=rsa-sha256; t=1776783857; cv=none;

d=google.com; s=arc-20240605;

b=ShbOk4SgLpBL/03OfqFu1oeNA9irui4TEPysC9FNDbW0bne+8tqxOSKzaOSjF8+lOu

ROVqeQQaGpy/jjaBJUyWoiITjpVbOEINY0by1BOa5DaFfaQNH1agoRqrItHdwsKEGvpn

mBQfOw8NIeZNg+yMaQAR83bLKAJjIMnzU1/a/cQppXvxwPVByG+Zb0KtanhsGHfGQ0UY

lyp2Qd2tiBa1vCJBNAuDfZVweXZf6mUuWN7SVxnM/mmod+yg8fqjKw7dinwBTJNM8MiH

iXW8QUuxbDBA9cQXKrmEYmNXl2BTk9jzpFGFEo5iHfL8C/qR+3nnQmqUQLhI/m02EeOj

SpGg==

ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20240605;

h=to:subject:message-id:date:from:mime-version:dkim-signature;

bh=NDXJrPggB3Nie86hYvP4r3+3O8PiTDf4sE+e1yuJSWM=;

fh=ny7+SATv4n6lSNl0rVMQyaj6POVJTUZJLShjjgjSTJg=;

b=TtYzb1xpByidXqul5kOMJ3XwJwr1AaqU8AnmMkF/yrFOUmaJm9A05o3VDMwfIYdO1b

ik2OmujhlZf7pcLbeXeqC/r1aMs/tFGGtW/B3lXjzeXWeERJKXkAX2JCIliubIvfFQEK

a080yOlJblkDkXt7thRc2imSOEgNPFwHUO5580n38mn9qyI8lKmtZmxVzRg3GSfBHwsW

HsiQ+H3ndcp2oxH3UsZJ2LZKTw0kvRRgZeXVFDJ9GUEbW3qOs5kMLCi3t25VGOZUE03d

ABhRaStyo8BCHnPXrLzmjCV4DGAlzbvJICOGTTC43Ul5K4+6TwSIu13YS9XxtzeqI1so

paHg==;

darn=nk.ca

ARC-Authentication-Results: i=1; mx.google.com; arc=none

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=gmail.com; s=20251104; t=1776783857; x=1777388657; darn=nk.ca;

h=to:subject:message-id:date:from:mime-version:from:to:cc:subject

:date:message-id:reply-to;

bh=NDXJrPggB3Nie86hYvP4r3+3O8PiTDf4sE+e1yuJSWM=;

b=qwWE5sDt+V1sNPDz1xoHB9hWMR7NyPXodlyQOrtP1d5mo9R4GOyXg4a0mPYOY/To3W

pp8h7g/4n19nirQZM9uJzxo0R8YCRZn0v8ZLv26ICK4w5licHFDtOG2Ij7NaFVuPUf7a

CU0fhiBeQa/uQ9gFrik6nIHtb9HlVUkYOUPTp8uNG4AOJL6qNISuH3PkJnaIeXxHlHuZ

mNe28QGB5o/VDAqKRMgNu2SFqpwQxNs9IGEvSu8kE2+eRp6fZ8Te4C9Ie/p6k9ExBQl7

6gt/Qdt73TM+s7u5oWQ4vhUweiM5O09tgB4pCgznKTjlW6bHi7+6vLZcSTrAiTbXFNUM

taGA==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20251104; t=1776783857; x=1777388657;

h=to:subject:message-id:date:from:mime-version:x-gm-gg

:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to;

bh=NDXJrPggB3Nie86hYvP4r3+3O8PiTDf4sE+e1yuJSWM=;

b=R3a7k8NICY1/49t4REUbi1dHyc65wePG4SpYwlMbx4vHOCU46/EgcBcvoHyIqjQjuZ

oVo72f7UxFMXOrdH55Wcd6mDSD5wt81ByB+S4XxflzJN30BNHNsZnP7H73cFhDcMMlbP

6jiI1C69sBPbNi4VO4YkjlhU9k08FaOJoFqM63Y0W/CAu7QN8IEsEIVweoE+FjHIdXAZ

JtnYkihkWgDpT9mwXs4itYU1a7sPRoaFDVWOz8NysOt7+E5DGA9tzwwHSFGY/cusQnc8

CPa3KiLaf/byCi9r5DN9DvYxy84K6V6rUbMHKMTDMB4RhmEmqHpStzqcN77oCcIrh5ch

TYcQ==

X-Gm-Message-State: AOJu0YzjF4DDfHkFy95H6oGn0ToSb7JZl1ZqfOwBJn99N9HH3KyXWAtE

GMpFZ+rsNyHlb+8dwWB+zEL/lWU7KU6Az0ZIHSkkqgdadlAkWyk82vkUoB/Dqgb1jmw6HCre+27

vuQiiY+idoTjnDzWVtnMV3x4HP0SLHsE+tmjleF8=

X-Gm-Gg: AeBDiesMypDBvt+wAmEOwNPfcUr865hcNsfYhV02lRv2oRYsMoDZ4PuCmIU1Nmug2Gk

vhR+Xxfj13EeV8IcQ/v/9wVRO9kPqJJ0zktR3xDMxTVccmKswof92elFfd65HBrvLhwoMClp9+/

uYX21fSXdrAjNWRaX523FiAN4leLwPw3eCxE2d2GnYGeINLU6mbFw40UiR0qIesbg4l1PSsvbvD

PTFy01Vul16Xh0QH4XknYOApuM4FoVvfnvWFvYp3c5WUo2emJ1uYXfCNfxH6Z6uiI4LLHX3JMQ1

MsRDVbdauAadllvX8369h0chK7+fe3mG8/qA9gGGXeEnf0dlZsBgjTLn

X-Received: by 2002:a05:6123:102:b0:56d:3451:4cc0 with SMTP id

71dfb90a1353d-56fa66fd956mr6015635e0c.7.1776783857016; Tue, 21 Apr 2026

08:04:17 -0700 (PDT)

MIME-Version: 1.0

From: Farhan Faruqui

Date: Tue, 21 Apr 2026 17:04:05 +0200

X-Gm-Features: AQROBzBgvlgJXYzFQ1InTzVV8pY3Z1cWGk2tX5EafN3PwVxoDIPgysfhF1VqELM

Message-ID:

Subject:

To: root@nk.ca

Content-Type: multipart/alternative; boundary="000000000000a3e467064ff9baba"

X-Spam_score: 5.1

X-Spam_score_int: 51

X-Spam_bar: +++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.

Content preview: Can I continue to email you at this address? Can I continue

to email you at this address?

Content analysis details: (5.1 points, 5.0 required)

pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[209.85.221.171 listed in dnsbl.ahbl.org]

[209.85.221.171 listed in dnsbl.ahbl.org]

[209.85.221.171 listed in dnsbl.ahbl.org]

[209.85.221.171 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[209.85.221.171 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[209.85.221.171 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[209.85.221.171 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[209.85.221.171 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[209.85.221.171 listed in will-spam-for-food.eu.org]

[209.85.221.171 listed in will-spam-for-food.eu.org]

[209.85.221.171 listed in will-spam-for-food.eu.org]

[209.85.221.171 listed in will-spam-for-food.eu.org]

[209.85.221.171 listed in will-spam-for-food.eu.org]

[209.85.221.171 listed in will-spam-for-food.eu.org]

[209.85.221.171 listed in will-spam-for-food.eu.org]

[209.85.221.171 listed in will-spam-for-food.eu.org]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[209.85.221.171 listed in list.dnswl.org]

-0.0 SPF_PASS SPF: sender matches SPF record

0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider

[faruquifarhan746(at)gmail.com]

0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends in

digit

[kristinelandmark002(at)gmail.com]

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[209.85.221.171 listed in wl.mailspike.net]

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

Subject: {SPAM?}

--000000000000a3e467064ff9baba

Content-Type: text/plain; charset="UTF-8"

Can I continue to email you at this address?

--000000000000a3e467064ff9baba

Content-Type: text/html; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable

=3D"gmail_signature" data-smartmail=3D"gmail_signature">

iv dir=3D"ltr">

=3D"ltr">

dir=3D"ltr">

ltr">

iv dir=3D"ltr">

=3D"ltr">

dir=3D"ltr">

ltr">

iv dir=3D"ltr">

=3D"ltr">

dir=3D"ltr">

ltr">Can I continue to email you at this address?

<=

/div>

--000000000000a3e467064ff9baba--

Nigerian phish

Posted by Dave Yadallee on Tuesday, April 21. 2026

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Tue, 21 Apr 2026 06:31:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1wFAFj-000000006QZ-26bd

for dave@doctor.nl2k.ab.ca;

Tue, 21 Apr 2026 06:30:55 -0600

Resent-From: The Doctor

Resent-Date: Tue, 21 Apr 2026 06:30:55 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from dedi-13340348.frinense.com.br ([162.214.100.13]:58542)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1wF7kD-00000000DFP-3Hn8

for root@nk.ca;

Tue, 21 Apr 2026 03:50:23 -0600

DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed;

d=frinense.com; s=default; h=Message-Id:Date:Reply-To:MIME-Version:

Content-Type:To:Subject:From:Sender:Cc:Content-Transfer-Encoding:Content-ID:

Content-Description:Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc

:Resent-Message-ID:In-Reply-To:References:List-Id:List-Help:List-Unsubscribe:

List-Subscribe:List-Post:List-Owner:List-Archive;

bh=A1+yhM42cfpvhlegOqojfa4bHCuxN3Gh3f+4LkVqgGs=; b=uWq+B5jmEy3uG/Bf94QP0eaDRo

X0ct00JAVFq6GkDTn9G8IN8d95XQCgMbZygwbhsSoIEF2Mh7HFADdKlIJmqMyDh4Fy9JaEJLHjl4c

nQdV0xLdTFCtXNNel83XDEYa/MWSWDLnjVN+xQr2hQ82yUDfJEfLYsMOGLV0bBaUVZuUgs0olX0HV

Rh+ZR7b+gXfm/Lw9P0sah5+VepLSugtRo02RQXnHo5ujHUwyqrH0hSSecPIHPb72OhBppGT2JKBJz

1yPcQfUeMiYn5GBiA1n1X/e3ORlM4I6Ti3yWRdUOY/5x9aQSybIxMiwIkP6QihtZZi2UNU2jM1q5F

7ORTA9MQ==;

Received: from ec2-54-198-108-54.compute-1.amazonaws.com ([54.198.108.54]:63076 helo=EC2AMAZ-896QSEP)

by dedi-13340348.frinense.com.br with esmtpsa (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

(Exim 4.99.1)

(envelope-from )

id 1w8kmm-0000000BFaR-2aNU

for root@nk.ca;

Fri, 03 Apr 2026 17:06:32 -0300

From: "Viktor Jhangiani"

Subject: Important

To:

Content-Type: multipart/alternative; boundary="uRov4=_8spDurlEP3XpqHbrZxn4jTQOtPu"

MIME-Version: 1.0

Reply-To:

Date: Fri, 3 Apr 2026 20:06:32 +0000

Message-Id: <03322026040620B57B14FBC5-91775C7098@frinense.com>

X-AntiAbuse: This header was added to track abuse, please include it with any abuse report

X-AntiAbuse: Primary Hostname - dedi-13340348.frinense.com.br

X-AntiAbuse: Original Domain - nk.ca

X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12]

X-AntiAbuse: Sender Address Domain - frinense.com

X-Get-Message-Sender-Via: dedi-13340348.frinense.com.br: authenticated_id: junior.ti@frinense.com

X-Authenticated-Sender: dedi-13340348.frinense.com.br: junior.ti@frinense.com

X-Source:

X-Source-Args:

X-Source-Dir:

X-Spam_score: 7.1

X-Spam_score_int: 71

X-Spam_bar: +++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.

Content preview: In my earlier years, I pursued a career as an engineer and

gold merchant in Odessa, Ukraine. Now retired and writing to you from my

hospital bed after being diagnosed with esophageal cancer-with only [...]

Content analysis details: (7.1 points, 5.0 required)

pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[162.214.100.13 listed in dnsbl.ahbl.org]

[162.214.100.13 listed in dnsbl.ahbl.org]

[162.214.100.13 listed in dnsbl.ahbl.org]

[162.214.100.13 listed in dnsbl.ahbl.org]

[54.198.108.54 listed in dnsbl.ahbl.org]

[54.198.108.54 listed in dnsbl.ahbl.org]

[54.198.108.54 listed in dnsbl.ahbl.org]

[54.198.108.54 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[162.214.100.13 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[162.214.100.13 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[162.214.100.13 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[162.214.100.13 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[54.198.108.54 listed in will-spam-for-food.eu.org]

[54.198.108.54 listed in will-spam-for-food.eu.org]

[54.198.108.54 listed in will-spam-for-food.eu.org]

[54.198.108.54 listed in will-spam-for-food.eu.org]

[54.198.108.54 listed in will-spam-for-food.eu.org]

[54.198.108.54 listed in will-spam-for-food.eu.org]

[54.198.108.54 listed in will-spam-for-food.eu.org]

[54.198.108.54 listed in will-spam-for-food.eu.org]

[162.214.100.13 listed in will-spam-for-food.eu.org]

[162.214.100.13 listed in will-spam-for-food.eu.org]

[162.214.100.13 listed in will-spam-for-food.eu.org]

[162.214.100.13 listed in will-spam-for-food.eu.org]

[162.214.100.13 listed in will-spam-for-food.eu.org]

[162.214.100.13 listed in will-spam-for-food.eu.org]

[162.214.100.13 listed in will-spam-for-food.eu.org]

[162.214.100.13 listed in will-spam-for-food.eu.org]

-0.0 SPF_PASS SPF: sender matches SPF record

-0.0 SPF_HELO_PASS SPF: HELO matches SPF record

2.1 DATE_IN_PAST_96_XX Date: is 96 hours or more before Received: date

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

Subject: {SPAM?} Important

This is a multi-part message in MIME format

--uRov4=_8spDurlEP3XpqHbrZxn4jTQOtPu

Content-Type: text/plain; charset="iso-8859-1"

Content-Transfer-Encoding: quoted-printable

In my earlier years, I pursued a career as an engineer and gold mercha=

nt in Odessa, Ukraine. Now retired and writing to you from my hospital=

bed after being diagnosed with esophageal cancer-with only months lef=

t-I find it challenging to hold onto hope or muster the energy for cha=

ritable activities that have always been central to me. It would truly=

mean a lot if we could discuss this further since helping others has =

consistently brought immense fulfillment and joy into my life.

Kindly inform me once you receive this message, and I'll share all the=

necessary details.

I genuinely appreciate it.

--uRov4=_8spDurlEP3XpqHbrZxn4jTQOtPu

Content-Type: text/html; charset="iso-8859-1"

Content-Transfer-Encoding: quoted-printable

8859-1">

me=3D"viewport" content=3D"width=3Ddevice-width, initial-scale=3D1"> <=

META name=3D"format-detection" content=3D"telephone=3Dno"> Impo=<br /><br /> rtant

e=3D"3">In my ea=

rlier years, I pursued a career as an engineer and gold merchant in Od=

essa, Ukraine. Now retired and writing to you from my hospital bed aft=

er being diagnosed with esophageal cancer-with only months left-I find=

it challenging to hold onto hope or muster the energy for charitable =

activities that have always been central to me. It would truly mean a =

lot if we could discuss this further since helping others has consiste=

ntly brought immense fulfillment and joy into my life.

Kindly i=

nform me once you receive this message, and I'll share all the necessa=

ry details.

I genuinely appreciate it.
>

--uRov4=_8spDurlEP3XpqHbrZxn4jTQOtPu--

TD Phish from Sendgrid Part 2

Posted by Dave Yadallee on Tuesday, April 21. 2026

class=3D"ntes_editor_table ntes_editor_ext_table "=20

style=3D"MAX-WIDTH: 600px; WIDTH: 100%; MARGIN-LEFT: auto !important;=

MARGIN-RIGHT: auto !important"=20

cellSpacing=3D0 cellPadding=3D0 width=3D600 bgColor=3D#ffffff border=

=3D0>

class=3D"ntes_editor_table ntes_editor_ext_table " cellSpacing=

=3D0=20

cellPadding=3D0 width=3D"100%">

style=3D"FONT-SIZE: 16px; FONT-FAMILY: Arial, Verdana, sans=

-serif; COLOR: #1c1c1c; PADDING-BOTTOM: 40px; PADDING-TOP: 30px; PADDING-LE=

FT: 30px; MARGIN: auto; LINE-HEIGHT: 24px; PADDING-RIGHT: 30px">

style=3D"FONT-SIZE: 26px; FONT-FAMILY: 'Arial', Helvetica=

, sans-serif !important; FONT-WEIGHT: normal; COLOR: #1c1c1c; PADDING-BOTTO=

M: 0px; TEXT-ALIGN: center !important; PADDING-TOP: 0px; PADDING-LEFT: 0px;=

MARGIN: 0px 0px 20px; LINE-HEIGHT: 36px; PADDING-RIGHT: 0px">Mandatory=20

Security Upgrade Notice =E2=80=94 Client Account Verifica=

tion=20

Required

Dear Client,

In response to the recent rise in cybersecurity incide=

nts=20

affecting financial accounts, we are implementing a manda=

tory=20

security upgrade for all client accounts. Recent cases ha=

ve=20

shown that malicious actors are increasingly targeting=20

investors through unauthorized access attempts, account=20

misuse, and other harmful activities that may place clien=

t=20

assets at risk.

To strengthen account protection, every client is requ=

ired=20

to complete an updated verification process. This securit=

y=20

procedure may include confirming identity details, review=

ing=20

recent account activity, and enabling enhanced protection=

=20

features such as stronger password requirements and=20

multi-factor authentication.

These measures are being introduced as part of our=20

continued commitment to safeguarding client assets and=20

maintaining the integrity of our platform. Completing the=

=20

required authentication will help reduce security risks a=

nd=20

support uninterrupted access to your account services.
>

We strongly recommend that you complete this process a=

s=20

soon as possible. Accounts that remain pending verificati=

on=20

may be subject to temporary limitations until the securit=

y=20

upgrade has been completed.

Please use the secure link below to complete your acco=

unt=20

security verification:

style=3D"COLOR: #282828; PADDING-BOTTOM: 20px; TEXT-ALIGN=

: center; PADDING-TOP: 20px; MARGIN: auto"=20

colspan=3D"2">
style=3D"FONT-SIZE: 15px; TEXT-DECORATION: none; MAX-WIDT=

H: 200px; FONT-FAMILY: sans-serif; WIDTH: 100%; FONT-WEIGHT: 400; COLOR: #c=

fbd91; PADDING-BOTTOM: 10px; TEXT-ALIGN: center; PADDING-TOP: 10px; PADDING=

-LEFT: 16px; DISPLAY: inline-block; LINE-HEIGHT: 20px; PADDING-RIGHT: 16px;=

BACKGROUND-COLOR: #282828"=20

href=3D"https://tjrum3e1ceg2gxygsf8o13tt.live" target=3D_=

blank=20

align-item=3D"center">Complete Update

Login with the email address you used to register to=20

complete your application today, or access your applicati=

on=20

using your WebBroker Username/Connect ID and password, or=

your=20

EasyWeb Username/Access Card and password.

style=3D"FONT-SIZE: 18px; FONT-FAMILY: Arial, Verdana, sa=

ns-serif; COLOR: #1c1c1c; TEXT-ALIGN: center; LINE-HEIGHT: 28px">Questions?=

=20

We're Ready to Help!

Call
style=3D"TEXT-DECORATION: underline; COLOR: #038203"=20

href=3D"tel:18004655463">1=E2=80=91800=E2=80=91465=E2=80=

=915463 to speak to a=20

licensed Investment Representative from Monday to Friday,=

7:00=20

a.m. to 10:00 p.m. EST (one-hour extension).

Thank you,

TD Direct Investing=20

- FOOTER START -->

class=3D"ntes_editor_table ntes_editor_ext_table " style=3D"MARGIN: a=

uto"=20

cellSpacing=3D0 cellPadding=3D0 width=3D"100%" bgColor=3D#282828 bord=

er=3D0>

style=3D"FONT-SIZE: 15px; FONT-FAMILY: 'Arial', Helvetica, sans-s=

erif; BORDER-COLLAPSE: collapse; FONT-WEIGHT: 400; COLOR: #ffffff; TEXT-ALI=

GN: left; LINE-HEIGHT: 24px; PADDING-RIGHT: 55px; BACKGROUND-COLOR: #282828=

"=20

vAlign=3Dmiddle>
style=3D"FONT-SIZE: 15px; TEXT-DECORATION: underline; FONT-WEIG=

HT: 400; COLOR: #cfbd91; LINE-HEIGHT: 24px; BACKGROUND-COLOR: #282828"=20

href=3D"https://tjrum3e1ceg2gxygsf8o13tt.live" target=3D_blank>=

Contact=20

Us |
>
style=3D"FONT-SIZE: 15px; TEXT-DECORATION: underline; FONT-WEIG=

HT: 400; COLOR: #cfbd91; LINE-HEIGHT: 24px; BACKGROUND-COLOR: #282828"=20

href=3D"https://tjrum3e1ceg2gxygsf8o13tt.live" target=3D_blank>=

Privacy=20

& Security |
style=3D"FONT-SIZE: 15px; TEXT-DECORATION: underline; FONT-WEIG=

HT: 400; COLOR: #cfbd91; LINE-HEIGHT: 24px; BACKGROUND-COLOR: #282828"=20

href=3D"https://tjrum3e1ceg2gxygsf8o13tt.live" target=3D_blank>=

Legal=20

=3Dmiddle=20

align=3Dleft>
style=3D"PADDING-LEFT: 4px; MARGIN-LEFT: auto !important; DISPL=

AY: block; MARGIN-RIGHT: auto !important"=20

border=3D0 alt=3D""=20

src=3D"https://www.feeds.td.com/ew//images/omni/tdi/assets/td-c=

hair-st-v1.png"=20

width=3D124>

style=3D"FONT-SIZE: 13px; FONT-FAMILY: 'Arial', Helvetica, sans-serif; =

COLOR: #555555; PADDING-BOTTOM: 30px; PADDING-TOP: 20px; PADDING-LEFT: 1px;=

LINE-HEIGHT: 20px; PADDING-RIGHT: 1px"=20

vAlign=3Dtop align=3Dleft>

TD Direct Investing is a division of TD Waterhouse Canada Inc., a=20

subsidiary of The Toronto=E2=80=91Dominion Bank.

^=C2=AE The TD logo and other TD trademarks are the prop=

erty of=20

The Toronto=E2=80=91Dominion Bank or its subsidiaries.

If you wish to unsubscribe from receiving commercial electronic=20

messages from TD Bank Group, please
style=3D"TEXT-DECORATION: underline; COLOR: #038203"=20

href=3D"https://tjrum3e1ceg2gxygsf8o13tt.live" target=3D_blank>click=20

here

Mon	Tue	Wed	Thu	Fri	Sat	Sun
← Back	April '26					Forward →
		1	2	3	4	5
6	7	8	9	10	11	12
13	14	15	16	17	18	19
20	21	22	23	24	25	26
27	28	29	30

or: #3c4043; text-decoration: none;font-weight: 700;-webkit-font-smoothing:= antialiased;margin: 0; padding: 0;">Guests

or: #3c4043; text-decoration: none;font-weight: 700;-webkit-font-smoothing:= antialiased;margin: 0; padding: 0;">Guests

or: #3c4043; text-decoration: none;font-weight: 700;-webkit-font-smoothing:=

antialiased;margin: 0; padding: 0;">Guests

or: #3c4043; text-decoration: none;font-weight: 700;-webkit-font-smoothing:=

antialiased;margin: 0; padding: 0;">Guests