x/twitter phishing from sendgrid

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 24 Sep 2026 14:32:31 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.100.1 (FreeBSD))

(envelope-from )

id 1x9q7H-000000006LS-1K8b

for dave@doctor.nl2k.ab.ca;

Thu, 24 Sep 2026 14:32:27 -0600

Resent-From: The Doctor

Resent-Date: Thu, 24 Sep 2026 14:32:27 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from o3.ptr4338.momos.com ([198.37.158.10]:51578)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.100.1 (FreeBSD))

(envelope-from )

id 1x9mw2-00000000Bpd-0pp6

for doctor@doctor.nl2k.ab.ca;

Thu, 24 Sep 2026 11:08:46 -0600

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=no-reply.momos.com;

h=content-transfer-encoding:content-type:date:from:mime-version:subject:

to:cc:content-type:date:from:subject:to;

s=s1; t=1790269613;

bh=3UErHwDxCwgI+CeTKgc4G/l0yr9YXZZf76TZzj8iu2g=;

b=MXcHUFyKaIKig5E1WDLwm3qxy9aXlFAniQj2mXEbiH3cx7cwGl7X8qzYitYjYK/e6cgO

8k+FU+ef/ArKpbnBvxI8GyetddWbwainIvJca+ijscRx4UAquD1CsOYXqdbR/ER62VLXAb

voluEuLwGpQa8+KUrLgdjB/gtEvVirNnmj4PcwG3suuUPdKtfvq/g9fpnNgXWYwTqRSkXH

gbVKM2a0y9xyIF1LFT3jb5X9NohIVTSSSXz1rc4R6WBl8A8xMNyb8MWvzksRjB0lKueC8h

WSLuUREDTAAY330UzQGfc/AF+q7EwnZmP0qKMMFmc+294IeV9ZRoqWmt/QVndk/w==

Received: by recvd-6fcf9bc75b-gdpw4 with SMTP id recvd-6fcf9bc75b-gdpw4-1-6AB558AD-184

2026-09-24 17:06:53.944029273 +0000 UTC m=+71448.978306460

Received: from MjM3NDY4NzI (unknown)

by geopod-ismtpd-18 (SG) with HTTP

id fSuqpmEoSwylk3N3QzCRfQ

Thu, 24 Sep 2026 17:06:53.933 +0000 (UTC)

Content-Transfer-Encoding: quoted-printable

Content-Type: text/html; charset=us-ascii

Date: Thu, 24 Sep 2026 17:06:53 +0000 (UTC)

From: "X.com"

Mime-Version: 1.0

Message-ID:

Subject: We noticed a login to your account from a new device

X-SG-EID:

=?us-ascii?Q?u001=2E+4hYyQ6YgDp8B9BSc=2FgOUKG3EF6jicrnS4CioOJdEW2ld9XLl10oQcaR4?=

=?us-ascii?Q?+Dm7mLT3LQRxfuU1=2FkeHwJRSxB3NnOiHKwb0fKr?=

=?us-ascii?Q?OkNkPtJ6iBFPgDcyB=2FfCJa1JnoAQiXTdcFMeUzF?=

=?us-ascii?Q?9ZStEqkGGtV0gTh2L0inXtyvHtbURpkvO4N2Ifa?=

=?us-ascii?Q?GZnYxySI0Nm51DJQmerxqiqcxvVNeAOdMBxooCl?=

=?us-ascii?Q?ovbgGGHtUmvyJ7jl33Is4N4Q5abMM0XGwi9zBLO?= =?us-ascii?Q?C686?=

X-SG-ID:

=?us-ascii?Q?u001=2ESdBcvi+Evd=2FbQef8eZF3BpTL9BgbK5wfSJMJGMsmprD1ZcmFObA4po1bG?=

=?us-ascii?Q?aUE6gycnk7QzJUxnbRBLsKFCDqic5Tzih=2Fk7Fru?=

=?us-ascii?Q?TL=2F+EaCr=2Fdg=3D?=

To: N/A

X-Entity-ID: u001.lT+99mXBFLSSHBhme7NCUg==

X-Spam_score: 18.5

X-Spam_score_int: 185

X-Spam_bar: ++++++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: New Login Notice - X We noticed a login to your account from

a new device. Was this you?



Content analysis details: (18.5 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[198.37.158.10 listed in will-spam-for-food.eu.org]

[198.37.158.10 listed in will-spam-for-food.eu.org]

[198.37.158.10 listed in will-spam-for-food.eu.org]

[198.37.158.10 listed in will-spam-for-food.eu.org]

[198.37.158.10 listed in will-spam-for-food.eu.org]

[198.37.158.10 listed in will-spam-for-food.eu.org]

[198.37.158.10 listed in will-spam-for-food.eu.org]

[198.37.158.10 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[198.37.158.10 listed in dnsbl.ahbl.org]

[198.37.158.10 listed in dnsbl.ahbl.org]

[198.37.158.10 listed in dnsbl.ahbl.org]

[198.37.158.10 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[198.37.158.10 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[198.37.158.10 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[198.37.158.10 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[198.37.158.10 listed in dnsbl.ahbl.org]

1.1 URIBL_GREY Contains an URL listed in the URIBL greylist

[URI: sendgrid.net]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[198.37.158.10 listed in wl.mailspike.net]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[198.37.158.10 listed in bl.score.senderscore.com]

-0.0 SPF_PASS SPF: sender matches SPF record

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

-0.0 T_RP_MATCHES_RCVD Envelope sender domain matches handover relay

domain

15 GR_DOMAIN_SENDGR6 URI: Body contains known spammer URI (sendgr)

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

0.0 SARE_FROM_SPAM_WORD4 From address suggests this may be spam

Subject: {SPAM?} We noticed a login to your account from a new device

X-Antivirus: AVG (VPS 260924-14, 9/24/2026), Inbound message

X-Antivirus-Status: Clean




schemas-microsoft-com:vml" xmlns:o=3D"urn:schemas-microsoft-com:office:offi=

ce">
ible" content=3D"IE=3Dedge">
e" content=3D"text/html; charset=3DUTF-8">
=3D"width=3Ddevice-width,initial-scale=3D1">
le type=3D"text/css">
style=3D"word-spacing:normal;background-color:#efeeea;">

round-color:#efeeea;">

uto;max-width:600px;">
" cellspacing=3D"0" role=3D"presentation" style=3D"width:100%;">=


0px;text-align:center;">

=3D"center" border=3D"0" cellpadding=3D"0" cellspacing=3D"0" role=3D"presen=

tation" style=3D"width:100%;">

ze:0px;padding:0px;text-align:left;">

olumn-per-100 mj-outlook-group-fix" style=3D"font-size:0px;text-align:left;=

direction:ltr;display:inline-block;vertical-align:top;width:100%;">
order=3D"0" cellpadding=3D"0" cellspacing=3D"0" role=3D"presentation" style=

=3D"vertical-align:top;" width=3D"100%">

=3D"font-size:0px;padding:10px 25px 10px 25px;word-break:break-word;">

style=3D"font-family:Arial, Helvetica, sans-serif;font-size:14px;font-weigh=

t:400;line-height:1.7;text-align:left;color:#000000;">
"-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd">=


vice-width,initial-scale=3D1">New Login Notice - X

email-container" role=3D"presentation" cellpadding=3D"0" cellspacing=3D"0" =

width=3D"100%">

3D""
eu/X.png">

We noticed a login to your account from a new device.=

Was this you?


tle">New login


padding=3D"0" cellspacing=3D"0">
Loca=

tion*		Spain, Madrid

ass=3D"details-label">Device		ChromeDesktop =

on Mac
Time
ls-value">September 23, 2026, 6:06 PM UTC


=3D"footnote">*Location is approximate based on the login's IP address=

.

If this was you=

You can ignore this message. There's no need to take any action=

.

If this was=

n't you

Complete these steps now to protect your account.

>


tainer">
sRmYjkXfgpLQK9RdAKUNghLZCgEcdRlTiXaxYOklWhKnDp3jn8QIBgwzV08cNgNhjY_GyWe1RRa=

az-2B-2B-2Bm2R4SiSUcHZOTY4dgdpSVRaTGu9ktME7HPVXhX3WDZiInv3-2F5UoHpxXyVn4ASQ=

uX4jCVoi69yEX4uDpHIGv8Pl-2FAms5OCklz-2BtzvnZai0tkO9sMriXJS2-2BduVKd4PYlmoir=

XruABLNHGfeqSLaN1yDlXRLKeIbEttURH-2FJAP00GQx2S1mDn2R7rE2hlgObzdAx3nbQyhdRZb=

7C8W3WytXEF7T0-2BB0tXYlBp7p46e-2Bdrq5WGz4ZRY7bH8pzC8UFKcGynH25JIgR0OUbR4wOR=

Z6sy2Ctlgh4-3D" target=3D"_blank" class=3D"btn">Secure your account
v>

ls/click?upn=3Du001.9YsRmYjkXfgpLQK9RdAKUNghLZCgEcdRlTiXaxYOklWhKnDp3jn8QIB=

gwzV08cNgL3l4_GyWe1RRaaz-2B-2B-2Bm2R4SiSUcHZOTY4dgdpSVRaTGu9ktME7HPVXhX3WDZ=

iInv3-2F5UoHpxXyVn4ASQuX4jCVoi69yEX4uDpHIGv8Pl-2FAms5OCklz-2BtzvnZai0tkO9sM=

riXJS2-2BduVKd4PYlmoirXruABE6S7Oo5KyA-2FdZ6Fr9zNOVEb3GUON3zbd56YSpL5x3C7N7M=

iXe6EMEV8GucHfNrgv7GSfTNozCiMJ30io0Z42zzCv4BDmPMNEjmwLPeKnmna7eKmpsICyP6qX0=

pCL7U1e3y5FcKOFQ-2B-2FxFJ9-2FaUPmpM-3D" target=3D"_blank">Help  |&=

nbsp;
mYjkXfgpLQK9RdAKUNghLZCgEcdRlTiXaxYOklWhKnDp3jn8QIBgwzV08cNgM4GL_GyWe1RRaaz=

-2B-2B-2Bm2R4SiSUcHZOTY4dgdpSVRaTGu9ktME7HPVXhX3WDZiInv3-2F5UoHpxXyVn4ASQuX=

4jCVoi69yEX4uDpHIGv8Pl-2FAms5OCklz-2BtzvnZai0tkO9sMriXJS2-2BduVKd4PYlmoirXr=

uABLoPNV3bmu2c7pvHOzLJdi5VTnIauGAzAb-2BbAtw-2BRlS-2FVCITI7QbOsthnWetnySckDr=

F24wt9xrI5-2BEmxL-2FtSRgA1oTXRS4Jan8i2TmayzXwdEv1i2X56BMQz-2BVjxcDhKsWhgyVg=

-2BpOnjGpHL4ck5hg-3D" target=3D"_blank">Email security tips


ss=3D"footer-text">We sent this email for verification
X Corp.
=3D"https://u23746872.ct.sendgrid.net/ls/click?upn=3Du001.9YsRmYjkXfgpLQK9R=

dAKUNghLZCgEcdRlTiXaxYOklWhKnDp3jn8QIBgwzV08cNgUYRM_GyWe1RRaaz-2B-2B-2Bm2R4=

SiSUcHZOTY4dgdpSVRaTGu9ktME7HPVXhX3WDZiInv3-2F5UoHpxXyVn4ASQuX4jCVoi69yEX4u=

DpHIGv8Pl-2FAms5OCklz-2BtzvnZai0tkO9sMriXJS2-2BduVKd4PYlmoirXruABOdSVf89vir=

7K60VEa5JDCfEe0FdnK9NKa8Enb3VRdwRwad2aXgS7Qh9o6yf2Sm4hxBJqaOPoQD0MRao82SRiJ=

oN6yTwINICMBnbWwziHaCGF45uZTRPxXSuWdF1wf6-2BRLnZi0ZUw2T-2FduYuGr5TUQE-3D" t=

arget=3D"_blank">1355 Market Street, Suite 900 San Francisco, CA 94103<=

/p>


=3D"0" cellspacing=3D"0" role=3D"presentation" width=3D"100%" style=3D"back=

ground-color: #ffffff;">












px;text-align:center;font-size: 10px;">x.com

x;text-align:center;font-size: 10px;">145 West 30th Street

x;text-align:center;font-size: 10px;">145

x;text-align:center;font-size: 10px;">New York, NY 10001

x;text-align:center;font-size: 10px;">United States

" cellpadding=3D"0" cellspacing=3D"0" role=3D"presentation" width=3D"100%">=




-align:center;font-size: 10px;">


ls/click?upn=3Du001.9YsRmYjkXfgpLQK9RdAKUODGy09pedZj70-2FWHbrRRIoZ8obOkbZZR=

vXqeZzMUFWft-2FduAgjRAoOG-2BlPrq5x5twwE4uXa-2FmNCO9R4Bb0mVnWX7WF8SrccsB0kHl=

WXOVsTsAL4bMqNu9BjUxNfig7XMnw9PvK-2B0lM-2Bsz7tY52K0v5lU-2FHN0-2Bv25p-2BIx-2=

Fi63KawGg17QHNZqa6tnJ-2Ff6sym76OsLoHRTkQM6NuKIhB0-2BmTxXyexhdetXOOq3-2F65DV=

DXZBUQ_GyWe1RRaaz-2B-2B-2Bm2R4SiSUcHZOTY4dgdpSVRaTGu9ktME7HPVXhX3WDZiInv3-2=

F5UoHpxXyVn4ASQuX4jCVoi69yEX4uDpHIGv8Pl-2FAms5OCklz-2BtzvnZai0tkO9sMriXJS2-=

2BduVKd4PYlmoirXruABI9jcV7Lsh4UZKWQ6tj0iHZXAcLWFu5jOuLyLBNg02dkdTaqiSbcIe51=

bccMoZWUS4EasrYUtvdY4cAscKrXADVPszOiEkO-2B-2F1r9hNA5yJA7eUR9Egs0Qp48fLmh6j5=

F2b2Qtd-2B-2B8M9PhFTTTQFsoug-3D'>Click here to unsubscribe from offers,=

surveys and other communications from Momos on behalf of X.com

=

<=

/div>
>

e-social_block" style=3D"margin:0px auto;max-width:600px;">
center" border=3D"0" cellpadding=3D"0" cellspacing=3D"0" role=3D"presentati=

on" style=3D"width:100%;">

px;padding:0;text-align:center;">

n-per-100 mj-outlook-group-fix" style=3D"font-size:0px;text-align:left;dire=

ction:ltr;display:inline-block;vertical-align:top;width:100%;">
r=3D"0" cellpadding=3D"0" cellspacing=3D"0" role=3D"presentation" style=3D"=

vertical-align:top;" width=3D"100%">

=3D"font-size:0px;padding:10px 25px 10px 25px;word-break:break-word;">
r" border=3D"0" cellpadding=3D"0" cellspacing=3D"0" role=3D"presentation" s=

tyle=3D"float:none;display:inline-table;">

px 4px 4px 4px;vertical-align:middle;">
" cellspacing=3D"0" role=3D"presentation" style=3D"border-radius:3px;width:=

20px;">

-align:middle;width:20px;">3D"default"
//stg-sg-notification-email-static-objects-bucket.s3.ap-southeast-1.amazona=

ws.com/social-icons/facebook_square.png" style=3D"border-radius:3px;display=

:block;" width=3D"20">

align:middle;padding:4px 4px 4px 0px;">
ze:13px;font-weight:normal;font-family:Arial, Helvetica, sans-serif;line-he=

ight:22px;text-decoration:none;">Facebook
<=

!--[if mso | IE]>
cellpadding=3D"0" cellspacing=3D"0" role=3D"presentation" style=3D"float:no=

ne;display:inline-table;">

ertical-align:middle;">
"0" role=3D"presentation" style=3D"border-radius:3px;width:20px;">
r>
tbody>

dth:20px;">
ic-objects-bucket.s3.ap-southeast-1.amazonaws.com/social-icons/tiktok_squar=

e.png" style=3D"border-radius:3px;display:block;" width=3D"20">

px;">
mily:Arial, Helvetica, sans-serif;line-height:22px;text-decoration:none;">T=

iktok

er=3D"0" cellpadding=3D"0" cellspacing=3D"0" role=3D"presentation" style=3D=

"float:none;display:inline-table;">

4px 4px;vertical-align:middle;">
pacing=3D"0" role=3D"presentation" style=3D"border-radius:3px;width:20px;">=


middle;width:20px;">
mail-static-objects-bucket.s3.ap-southeast-1.amazonaws.com/social-icons/you=

tube_square.png" style=3D"border-radius:3px;display:block;" width=3D"20">
td>

4px 4px 0px;">
al;font-family:Arial, Helvetica, sans-serif;line-height:22px;text-decoratio=

n:none;">Youtube

grid.net/wf/open?upn=3Du001.vAfwyCsv5SKe20dbI9Z6QKeFEUiu7Ze4oT3Osa2V9TYV4g-=

2B4edba6oZdWg5K5hEV6-2FQtKGRCxKSIGccFWJonuwn1xEOIpxPPjQ0ihQeyaMbqBpC59GuHgq=

Z-2Fe6RdVDmlke3kyPtp-2F8hJweDDMxSc7gVymMRCfNdSlANBZJLmmKAs8m-2B6jCLKFbmFSkA=

YKRpV-2BhhpR-2FnLTFsH7OlibMJibYGWtlDsdqKRtT3voxjdqvfJZNlwQcedvhlzuXq20VlUUq=

5V4Oygr9sUUzg1v1PID-2B4b-2BHU8MC0DMRMhPQNbzIE-3D" alt=3D"" width=3D"1" heig=

ht=3D"1" border=3D"0" style=3D"height:1px !important;width:1px !important;b=

order-width:0 !important;margin-top:0 !important;margin-bottom:0 !important=

;margin-right:0 !important;margin-left:0 !important;padding-top:0 !importan=

t;padding-bottom:0 !important;padding-right:0 !important;padding-left:0 !im=

portant;"/>

Wealthsimple phish from Microsoft Outlook

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 24 Sep 2026 14:32:31 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.100.1 (FreeBSD))

(envelope-from )

id 1x9q6z-000000006Jk-2NYi

for dave@doctor.nl2k.ab.ca;

Thu, 24 Sep 2026 14:32:09 -0600

Resent-From: The Doctor

Resent-Date: Thu, 24 Sep 2026 14:32:09 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from iwwl.jjzxbbs.com ([51.132.236.253]:45667)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.100.1 (FreeBSD))

(envelope-from )

id 1x9lYR-000000002Qw-4Bjs

for root@nk.ca;

Thu, 24 Sep 2026 09:40:19 -0600

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; s=default; d=iwwl.jjzxbbs.com;

h=Content-Type:MIME-Version:From:To:Subject:Date:Message-ID:Reply-To;

i=wduaqocwb@iwwl.jjzxbbs.com;

bh=3c8orCL1yeVjG27zCTKNgU26jRkniX2zzL1j2SDYj20=;

b=IV3NMTjXJooRc+aZwtMo29GL63ZERTwXZ6u9E+cIDuXE2YUf4v+XR8koJ2biT1lw/Vcc9BolaiCe

dff0I3crjyr1P0I2h0Jr2lXuUvFCQEJyrlSFPiZYsg9ttlMHlbhW2eop/7A9cT+Zy+rFeDZYNWKs

mm/JrWt9wTns1jeF2PuYmHgMLH4JvNP9ECWNc9oTTdZCsPL4bTNVJsmWsrU2lYsMLdExIaiLvwHA

1zqyjvr6TO4cd5I/qad6Qg5EelO7EmaNWtyejN9dfwBozFbOViUEUF7iML8JSyyAJjey9BDnHYw8

rjmNJf/Qg01+uC5/S0UNbLNbCAhYdqrXSSBxdQ==

Content-Type: multipart/alternative;

boundary="===============7124263676470425402=="

MIME-Version: 1.0

From: Wealthsimple investing

To: root@nk.ca

Subject: Update your tax details to avoid withholding tax

Date: Thu, 24 Sep 2026 08:38:29 -0700

Message-ID: <179026430941.5590.15794805014730822653@iwwl.jjzxbbs.com>

Reply-To: feedback@wealthsimple.com

Feedback-ID: campaign:wealthsimple.com:mailer

X-Spam_score: 42.4

X-Spam_score_int: 424

X-Spam_bar: ++++++++++++++++++++++++++++++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Hello root, We noticed that a few tax details on your account

have expired or are missing. If they are not updated, tax may be withheld

from your account at a higher rate. Account: root@nk.ca Reference: 12204385

Details to review: - Tax form (W-8BEN) - Tax residency information



Content analysis details: (42.4 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[51.132.236.253 listed in will-spam-for-food.eu.org]

[51.132.236.253 listed in will-spam-for-food.eu.org]

[51.132.236.253 listed in will-spam-for-food.eu.org]

[51.132.236.253 listed in will-spam-for-food.eu.org]

[51.132.236.253 listed in will-spam-for-food.eu.org]

[51.132.236.253 listed in will-spam-for-food.eu.org]

[51.132.236.253 listed in will-spam-for-food.eu.org]

[51.132.236.253 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[51.132.236.253 listed in dnsbl.ahbl.org]

[51.132.236.253 listed in dnsbl.ahbl.org]

[51.132.236.253 listed in dnsbl.ahbl.org]

[51.132.236.253 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[51.132.236.253 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[51.132.236.253 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[51.132.236.253 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[51.132.236.253 listed in dnsbl.ahbl.org]

1.7 URIBL_BLACK Contains an URL listed in the URIBL blacklist

[URI: shsrzts.com]

3.6 RCVD_IN_SBL_CSS RBL: Received via a relay in Spamhaus SBL-CSS

[51.132.236.253 listed in zen.spamhaus.org]

0.1 URIBL_CSS_A Contains URL's A record listed in the Spamhaus CSS

blocklist

[URI: iwwl.jjzxbbs.com/51.132.236.253]

1.5 RCVD_IN_SBL_XBL RBL: Received via a relay in Spamhaus SBL+XBL

[51.132.236.253 listed in sbl-xbl.spamhaus.org]

0.1 URIBL_SBL_A Contains URL's A record listed in the SBL blocklist

[URI: iwwl.jjzxbbs.com/51.132.236.253]

-0.0 SPF_PASS SPF: sender matches SPF record

-0.0 SPF_HELO_PASS SPF: HELO matches SPF record

3.5 VOWEL_FROM_7 Impronouncable from header (7+ consecutive vowels)

0.5 FROM_DOMAIN_NOVOWEL From: domain has series of non-vowel letters

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-0.0 T_RP_MATCHES_RCVD Envelope sender domain matches handover relay

domain

2.3 MANGLED_ACCNT BODY: mangled account(s)

2.3 MANGLED_RATES BODY: mangled rate(s)

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[51.132.236.253 listed in bl.score.senderscore.com]

1.5 MR_STRANGE_QUESTION URI: No description available.

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

3.0 VOWEL_URI_7 RAW: URI hostname with 7+ consecutive vowels

1.0 J_WEEDS_U FULL: Dec/Hex char Enc [Uu]

1.0 J_WEEDS_C FULL: Dec/Hex char Enc [Cc]

1.0 J_WEEDS_F FULL: Dec/Hex char Enc [Ff]

1.0 J_WEEDS_K FULL: Dec/Hex char Enc [Kk]

1.0 J_WEEDS_S FULL: Dec/Hex char Enc [Ss]

1.0 J_WEEDS_H FULL: Dec/Hex char Enc [Hh]

1.0 J_WEEDS_R FULL: Dec/Hex char Enc [Rr]

1.0 J_WEEDS_Y FULL: Dec/Hex char Enc [Yy]

1.0 J_WEEDS_T FULL: Dec/Hex char Enc [Tt]

1.0 J_WEEDS_I FULL: Dec/Hex char Enc [Ii]

1.0 J_WEEDS_L FULL: Dec/Hex char Enc [Ll]

1.0 J_WEEDS_A FULL: Dec/Hex char Enc [Aa]

1.0 J_WEEDS_G FULL: Dec/Hex char Enc [Gg]

1.0 J_WEEDS_E FULL: Dec/Hex char Enc [Ee]

1.0 J_WEEDS_M FULL: Dec/Hex char Enc [Mm]

1.0 J_WEEDS_O FULL: Dec/Hex char Enc [Oo]

1.0 J_WEEDS_D FULL: Dec/Hex char Enc [Dd]

1.0 J_WEEDS_N FULL: Dec/Hex char Enc [Nn]

1.0 J_WEEDS_P FULL: Dec/Hex char Enc [Pp]

2.0 WINDOWS_7BITS Windows charset announced as 7 bit

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

Subject: {SPAM?} Update your tax details to avoid withholding tax

X-Antivirus: AVG (VPS 260924-14, 9/24/2026), Inbound message

X-Antivirus-Status: Clean



--===============7124263676470425402==

Content-Type: text/plain; charset=windows-1252

MIME-Version: 1.0

Content-Transfer-Encoding: 7bit



Hello root,



We noticed that a few tax details on your account have expired or are

missing. If they are not updated, tax may be withheld from your

account at a higher rate.



Account: root@nk.ca

Reference: 12204385

Details to review:

- Tax form (W-8BEN)

- Tax residency information



Update your details:

https://www.shsrzts.com/?email=root@nk.ca&uid=BpIIJUlXzRb6C53gl76YCInr



It only takes a minute or two - and it helps us apply the correct tax

rate to your account.



Warm regards,

The Wealthsimple team



---

This email was sent automatically to root@nk.ca.

If this message was not meant for you, you can safely ignore it.



--===============7124263676470425402==

Content-Type: text/html; charset=utf-8

MIME-Version: 1.0

Content-Transfer-Encoding: 7bit















Update your tax details to avoid withholding tax































































































Wealthsimple


A note from Wealthsimp‍le


Some of your tax
details are expiring


Hello root,



We noticed that a few ta‍x details on your accoun‌t have expired or are missing. If they are no​t updated, tax may be wit‌hheld from your account a‍t a higher rate.












Update your details




It only takes a minute or two - and it helps us ap‌ply the correct tax rate to your account.
























Account


root@nk.ca


Reference


20153008


Details to review


Tax form (W-8BEN)
Tax residency informat‌ion




Warm regards,



The Wealthsimple team




This email was sent automatically to r‍oot@nk.ca.


If this message was not‌ meant for you, you can s‌afely ignore it.





Help

 · 

Privacy

 · 

Terms



Copyright Wealthsimp‍le Technologies Inc. Al‌l rights reserved.














--===============7124263676470425402==--

WealthSimple phish from Microsoft Outlook

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 24 Sep 2026 14:32:31 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.100.1 (FreeBSD))

(envelope-from )

id 1x9q6s-000000006J7-1sCZ

for dave@doctor.nl2k.ab.ca;

Thu, 24 Sep 2026 14:32:02 -0600

Resent-From: The Doctor

Resent-Date: Thu, 24 Sep 2026 14:32:02 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from jvvy.bdwxzzp.com ([68.221.186.151]:59437)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.100.1 (FreeBSD))

(envelope-from )

id 1x9lYK-000000002Qo-0NrC

for sales@nk.ca;

Thu, 24 Sep 2026 09:40:11 -0600

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; s=default; d=jvvy.bdwxzzp.com;

h=Content-Type:MIME-Version:From:To:Subject:Date:Message-ID:Reply-To;

i=mvoqdbmmp@jvvy.bdwxzzp.com;

bh=PTanEuWt7oORNSINOf7m/Xovnv3Q4AG290wlC9toNcA=;

b=0CZkfu08BImq7gm+EpiLiSMPfJ+Aqp+i7tWVLHw5sWooGADwrMK2vemg07/jC/465XCiKesofnvb

GWTVA9eG9xu28SLdSITzl6dyWEnLYo+p0wczrH7rq87S8x8m0M0yJZV2FxwJ4Yf99g8cJrBUkPdT

H4YFK9AKO9rn/lWHrGbVLcEAec04FKrn0z27s3rsbhUTDA6iCdxRfntqsSKkEQQtEVa/MUFjQm1p

ChZgjBh/1pP8adiEOrjLHeAVaYJ6PdjbwJsRe5WkR7KWujldFxQMVvUp8VccVrsKakCn5O2a71Kw

tKdes+rwFO9dWpq9rEXjccRP01gO3WgOEAeKpQ==

Content-Type: multipart/alternative;

boundary="===============4963110212110927708=="

MIME-Version: 1.0

From: Wealthsimple

To: sales@nk.ca

Subject: Update your tax details to avoid withholding tax

Date: Thu, 24 Sep 2026 08:38:28 -0700

Message-ID: <179026430811.4459.10529488636137459949@jvvy.bdwxzzp.com>

Reply-To: feedback@wealthsimple.com

Feedback-ID: campaign:wealthsimple.com:mailer

X-Spam_score: 36.0

X-Spam_score_int: 360

X-Spam_bar: ++++++++++++++++++++++++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Hello sales, We noticed that a few tax details on your account

have expired or are missing. If they are not updated, tax may be withheld

from your account at a higher rate. Account: sales@nk.ca Reference: 98255688

Details to review: - Tax form (W-8BEN) - Tax residency information



Content analysis details: (36.0 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[68.221.186.151 listed in will-spam-for-food.eu.org]

[68.221.186.151 listed in will-spam-for-food.eu.org]

[68.221.186.151 listed in will-spam-for-food.eu.org]

[68.221.186.151 listed in will-spam-for-food.eu.org]

[68.221.186.151 listed in will-spam-for-food.eu.org]

[68.221.186.151 listed in will-spam-for-food.eu.org]

[68.221.186.151 listed in will-spam-for-food.eu.org]

[68.221.186.151 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[68.221.186.151 listed in dnsbl.ahbl.org]

[68.221.186.151 listed in dnsbl.ahbl.org]

[68.221.186.151 listed in dnsbl.ahbl.org]

[68.221.186.151 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[68.221.186.151 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[68.221.186.151 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[68.221.186.151 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[68.221.186.151 listed in dnsbl.ahbl.org]

-0.0 SPF_PASS SPF: sender matches SPF record

-0.0 SPF_HELO_PASS SPF: HELO matches SPF record

1.0 HK_RANDOM_FROM From username looks random

3.5 VOWEL_FROM_7 Impronouncable from header (7+ consecutive vowels)

0.5 FROM_DOMAIN_NOVOWEL From: domain has series of non-vowel letters

0.6 HK_RANDOM_ENVFROM Envelope sender username looks random

-0.0 T_RP_MATCHES_RCVD Envelope sender domain matches handover relay

domain

3.6 RCVD_IN_SBL_CSS RBL: Received via a relay in Spamhaus SBL-CSS

[68.221.186.151 listed in zen.spamhaus.org]

0.1 URIBL_CSS_A Contains URL's A record listed in the Spamhaus CSS

blocklist

[URI: jvvy.bdwxzzp.com/68.221.186.151]

1.5 RCVD_IN_SBL_XBL RBL: Received via a relay in Spamhaus SBL+XBL

[68.221.186.151 listed in sbl-xbl.spamhaus.org]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

2.3 MANGLED_ACCNT BODY: mangled account(s)

0.1 URIBL_SBL_A Contains URL's A record listed in the SBL blocklist

[URI: jvvy.bdwxzzp.com/68.221.186.151]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[68.221.186.151 listed in bl.score.senderscore.com]

1.5 MR_STRANGE_QUESTION URI: No description available.

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

1.0 J_WEEDS_U FULL: Dec/Hex char Enc [Uu]

1.0 J_WEEDS_C FULL: Dec/Hex char Enc [Cc]

1.0 J_WEEDS_S FULL: Dec/Hex char Enc [Ss]

1.0 J_WEEDS_H FULL: Dec/Hex char Enc [Hh]

1.0 J_WEEDS_R FULL: Dec/Hex char Enc [Rr]

1.0 J_WEEDS_Y FULL: Dec/Hex char Enc [Yy]

1.0 J_WEEDS_W FULL: Dec/Hex char Enc [Ww]

1.0 J_WEEDS_T FULL: Dec/Hex char Enc [Tt]

1.0 J_WEEDS_I FULL: Dec/Hex char Enc [Ii]

1.0 J_WEEDS_L FULL: Dec/Hex char Enc [Ll]

1.0 J_WEEDS_A FULL: Dec/Hex char Enc [Aa]

1.0 J_WEEDS_E FULL: Dec/Hex char Enc [Ee]

1.0 J_WEEDS_X FULL: Dec/Hex char Enc [Xx]

1.0 J_WEEDS_M FULL: Dec/Hex char Enc [Mm]

1.0 J_WEEDS_O FULL: Dec/Hex char Enc [Oo]

1.0 J_WEEDS_D FULL: Dec/Hex char Enc [Dd]

1.0 J_WEEDS_N FULL: Dec/Hex char Enc [Nn]

1.0 J_WEEDS_P FULL: Dec/Hex char Enc [Pp]

2.0 WINDOWS_7BITS Windows charset announced as 7 bit

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

Subject: {SPAM?} Update your tax details to avoid withholding tax

X-Antivirus: AVG (VPS 260924-14, 9/24/2026), Inbound message

X-Antivirus-Status: Clean



--===============4963110212110927708==

Content-Type: text/plain; charset=windows-1252

MIME-Version: 1.0

Content-Transfer-Encoding: 7bit



Hello sales,



We noticed that a few tax details on your account have expired or are

missing. If they are not updated, tax may be withheld from your

account at a higher rate.



Account: sales@nk.ca

Reference: 98255688

Details to review:

- Tax form (W-8BEN)

- Tax residency information



Update your details:

https://www.hagonggc.com/?email=sales@nk.ca&uid=C9ZefEfiqFkqW4eUYjIYAeq8



It only takes a minute or two - and it helps us apply the correct tax

rate to your account.



Warm regards,

The Wealthsimple team



---

This email was sent automatically to sales@nk.ca.

If this message was not meant for you, you can safely ignore it.



--===============4963110212110927708==

Content-Type: text/html; charset=utf-8

MIME-Version: 1.0

Content-Transfer-Encoding: 7bit















Update your tax details to avoid withholding tax































































































Wealthsimple


A note from Wealthsimpl‌e


Some of your tax
details are expiring‌


Hello sales,



We noticed that a few ta​x details on your accoun‌t have expired or are missing. If they are not updated, tax may be wit​hheld from your accoun​t at a higher rate.












Update your details




It only takes a minute or‍ two - and it helps us ap‌ply the correct tax rate‍ to your account.
























Account


sales@nk.ca


Reference


56922960


Details to review


Tax form (W-8BEN)
Tax residency informat‍ion




Warm regards,



The Wealthsimple team




This email was sent automatically to sal​es@nk.ca.


If this message was not meant for you, you can s‍afely ignore it.





Help

 · 

Privacy

 · 

Terms



Copyright Wealthsimp‍le Technologies Inc. All‌ rights reserved.














--===============4963110212110927708==--

Chinese products spam

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 24 Sep 2026 14:31:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.100.1 (FreeBSD))

(envelope-from )

id 1x9q5Z-000000006Aq-1X4o

for dave@doctor.nl2k.ab.ca;

Thu, 24 Sep 2026 14:30:41 -0600

Resent-From: The Doctor

Resent-Date: Thu, 24 Sep 2026 14:30:41 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-m81138.netease.com ([47.88.81.138]:60468)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.100.1 (FreeBSD))

(envelope-from )

id 1x9kbI-00000000LuQ-0zui

for sales@nk.ca;

Thu, 24 Sep 2026 08:39:15 -0600

Content-Type: multipart/alternative; BOUNDARY="=_Part_815676_2041489364.1790260630306"

To: sales

Reply-To: longxiangleather@slphgloves.com

Subject: =?UTF-8?B?TGVhdGhlciAmIFJlY3ljbGVkIEZhYnJpYyBHbG92ZXMgZm9yIFlvdXIgQnJhbmQ=?=

X-Priority: 3

MIME-Version: 1.0

Received: from vivian@vexaimportspark.com( [10.139.1.59] ) by ajax-webmail ( [127.0.0.1] ) ; Thu, 24 Sep 2026 22:37:10 +0800 (GMT+08:00)

From: SLPH Gloves

Date: Thu, 24 Sep 2026 22:37:10 +0800 (GMT+08:00)

X-WM-Tid: 0aa0d3d95317068ckunm4db737e21056f0

DKIM-Signature: a=rsa-sha256;

b=X3NMLul0qORjbe6FgtJx19yihP3oCPPnvtpNRbxzwyfWJ81YrNVcXpsllQuutNQaNOA2Ub35OSK2uS0XD6Cxyaqa1tJHz8XPS0/oeVV7mnLUSG7y4Trf24VAnyI4rHBqxeN7Z2GR52hCNiurhHmu+vHnaERyaCbZGEmck9ElbJM=; s=default; c=relaxed/relaxed; d=vexaimportspark.com; v=1;

bh=s/nMJ63yWDj6UZ9dGZGbPXThwe7pQrXuUSuPSWXWlgY=;

h=date:mime-version:subject:message-id:from;

Message-ID:

X-Antivirus: AVG (VPS 260924-14, 9/24/2026), Inbound message

X-Antivirus-Status: Clean





Hi ,



Are you looking to add leather or recycled fabric gloves to your collection?



We manufacture fashion gloves and offer OEM production under your own brand.



We can develop samples based on your designs or reference photos, with material options to suit your requirements and budget.



Would you like us to send over our catalogue?









Serena.Geng

longxiangleather@slphgloves.com

bitcoin paypal phishing from Google Gmail

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 24 Sep 2026 14:30:30 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.100.1 (FreeBSD))

(envelope-from )

id 1x9q53-0000000067I-3Leb

for dave@doctor.nl2k.ab.ca;

Thu, 24 Sep 2026 14:30:09 -0600

Resent-From: The Doctor

Resent-Date: Thu, 24 Sep 2026 14:30:09 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-pj2-f13.google.com ([74.125.227.141]:62905)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.100.1 (FreeBSD))

(envelope-from )

id 1x9jcn-00000000Exy-23a6

for doctor@nl2k.ab.ca;

Thu, 24 Sep 2026 07:36:43 -0600

Received: by mail-pj2-f13.google.com with SMTP id 98e67ed59e1d1-39d654f02baso1061725a91.3

for ; Thu, 24 Sep 2026 06:35:46 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=gmail.com; s=20251104; t=1790256940; x=1790861740; darn=nl2k.ab.ca;

h=content-type:mime-version:subject:to:from:date:message-id:from:to

:cc:subject:date:message-id:reply-to:content-type;

bh=GpaaLBkJ9IunMG6ACHuyfPHVvLFKDfl0xI4lxBYibVU=;

b=BJS6jiSOn/899pUK9D4/TXP/mKnxgHTdbRpI9yKgTDRC76TAjI5rAejWrRDQN53RUu

CqiDF6yn+t0ohEFlZDl/iTsuhU8+O85WPQPxR0cpkkFIz2MNnlIaC8yhXt1Ee/EBEj24

Fe2BHs9GEoqbG4EwsacHOdV0pOO+VeVbhODqJoBWdBTbdokisqL8tICFmOAGTD3mAW4H

bOzgdA/os7x+jqs4uGfPlzabZQgluJCyDlDaAt+BNaid2c70ZIu/YoH7U2SPXDnd9sXg

kzUae/qXC1ZENzB588vdm2iDZ50b6HZnY1s66CbmxfVDuuKtnStqpKXy5DcVvfA+jXEF

/R0g==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20260707; t=1790256940; x=1790861740;

h=content-type:mime-version:subject:to:from:date:message-id:x-gm-gg

:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to

:content-type;

bh=GpaaLBkJ9IunMG6ACHuyfPHVvLFKDfl0xI4lxBYibVU=;

b=imVJhM/fphRgXz26ITxIBnp6y6qbn2xidVyg42Fek86sGCqAQvyoHhGJxvPj9O5bR9

YH/ZTOfcmSLegqw0MjD6tkVKC8XMf6vecy6orghuTqH6G/SPxQO/4LLl8vWbhOb/w/vn

4SiFmIBA0rZSUdZZ+IRVGnScreF/J+p3dNcnHQ17J6ZkNm1tklbSFzC8sQFy1uKsvqWw

lVfjAPzuyJ5WHITXpF3DUqUs7c82beB6GGNu+OmE+8Ydyi/bpxBzmIpIK9R9b6+imm1T

K3nYirbhADoIIRTfHtxa4CWQ68PV+bJBJmRA0OSjASiWRlakdgf/B/jmJE1EcRHgvz8H

YHFw==

X-Gm-Message-State: AFuF++kjJS1ABij1jC3GNKAe40x/geAGF4oP2Q1nFQxBoBzf6SOGUn/8

97h/L6qd7Uc4ljOFlu/2VI3ly/+IZ/T3Olr543CPzWxsC1ucqzV/YdcX18WUJ6GZ

X-Gm-Gg: AYBFou3t0P3G4BLXem+4caJEIxhUYoq42aannXynADv8kqfSGiQHgZB9Z6Rqd0iW2vd

GY7o8jAoFeVWpvu+sWu1jNPZCRyB6znwRJx5Sn0VznY6AYik4rWTa0RLvnL7vNeoj+9mXdDeUlB

E4caNpeR48y6p7mmzbgRaA9qGCS0vyvWHbnweEMyN4wil1/AdHSSEJ99eTOrT436B4dpRwstHvr

rYf65sdmGXTb7VzhW3TO5NazVFLRkg6KaXzaV8Uk+esiGSfU3qWfXYbptRBwdr/fYQpUZ+V+bXx

lxeyKk8Br14DkPfER+HqvFeUaOUJg6T05Eo2ysPwc3KjRjm+D/j7uEfz9CBltkQs19d+RdDFFUn

cHy6N8U++5XAcminxzw6iBoe7a04FWZymDLV/oEmeiDf4EGy/USD7r7Dy1KGXuRJd/eOcsyRLwH

gYXKBFgB4xQ4aX7hfrk7Nv8aXLLnXCWQtj5GhZEph85eyvHfgPE+iUdNTXegXye6r1MKwKF8XwO

moIG6puKBm+80KvSV76hrNMkQ==

X-Received: by 2002:a17:90b:4a89:b0:39e:6c69:34da with SMTP id 98e67ed59e1d1-3a098fc84eamr2143172a91.62.1790256939946;

Thu, 24 Sep 2026 06:35:39 -0700 (PDT)

Received: from localhost ([43.128.210.24])

by smtp.gmail.com with UTF8SMTPSA id 98e67ed59e1d1-3a0a8d290d0sm1447857a91.13.2026.09.24.06.35.38

for

(version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128);

Thu, 24 Sep 2026 06:35:39 -0700 (PDT)

Message-ID: <6ab5272b.c4bc8249.335141.7cad@mx.google.com>

Date: Thu, 24 Sep 2026 06:35:39 -0700 (PDT)

From: soniaijiogbe@gmail.com

X-Google-Original-From: PayPal

To: doctor@nl2k.ab.ca

Subject: Service Renewed | $434.32 | Ref: I-24P1JMXMPIT2SY

MIME-Version: 1.0

Content-Type: multipart/mixed; boundary=boundary123

X-Antivirus: AVG (VPS 260924-14, 9/24/2026), Inbound message

X-Antivirus-Status: Clean



--boundary123

Content-Type: text/html; charset="utf-8"













PayPal Automatic Payment















Dear Beloved Customer I-24P1JMXMPIT2SY







PayPal









You set up automatic payments to UID778411 BTC Trade Desk LLC









Issues with Transaction? To get in touch with us, +1-(828)-579-6836









Here's your Information















Next payment due:



Next week same day



Next payment amount:



$434.32 USD

















The automatic payment profile you set up







Profile ID


50C22671XW6786001V







Payments from


I-24P1JMXMPIT2SY


undefined







Payments to


UID778411 BTC Trade Desk LLC







Payments for


1 Week Dai...







Amount to be paid each time


$434.32 USD







Billing cycle


Weekly







Payments start


2026-09-24







Payments stop after cycle


Until cancellation







Payments will be made from


Bank Linked Card/PayPal















Use PayPal next time















Sign Up




It's the safer, easier way to pay.





Your personal and financial information is securely stored and never shared with merchants when you pay.















Want to make a change?





To change or cancel your automatic payment, contact at Call for Customer Service: +1-(828)-579-6836.



















PayPal











Help & Contact  |  

Security  |  

Apps









Twitter

Instagram

Facebook

LinkedIn





PayPal is committed to preventing fraudulent emails. Emails from PayPal will always contain your full name. Learn to identify phishing



Please don't reply to this email. To get in touch with us, +1 (805) 853-8011 Help & Contact.



PayPal, Inc. NMLS ID #: 910457



Not sure why you received this email? Learn more



Copyright © 1999-2026 PayPal, Inc. All rights reserved. PayPal is located at 1830 E 27Th St Jacksonville Fl 32206 United States.



PayPal RT001423:en_US(en-US):1.2.1:c9c0783293d3a















--boundary123

nk.ca credential phishing from Google Gmail

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 24 Sep 2026 14:30:30 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.100.1 (FreeBSD))

(envelope-from )

id 1x9q4u-0000000066h-2aPD

for dave@doctor.nl2k.ab.ca;

Thu, 24 Sep 2026 14:30:00 -0600

Resent-From: The Doctor

Resent-Date: Thu, 24 Sep 2026 14:30:00 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-pl1-f232.google.com ([209.85.214.232]:59668)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.100.1 (FreeBSD))

(envelope-from <13524957@intime.cz>)

id 1x9j20-00000000Bt9-467c

for games@nl2k.ab.ca;

Thu, 24 Sep 2026 06:58:41 -0600

Received: by mail-pl1-f232.google.com with SMTP id d9443c01a7336-2dd4b3c752fso8522105ad.3

for ; Thu, 24 Sep 2026 05:57:46 -0700 (PDT)

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20260707; t=1790254660; x=1790859460;

h=content-transfer-encoding:content-type:mime-version:message-id:date

:subject:to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date

:message-id:reply-to:content-type;

bh=4q1iODPfT6M76/wFxde+nv9WUKnxukbgzISiOtaUnXU=;

b=rtotBfiZOP5ahbbhjEzROkAMsc9N7gqk/ebFUXk+2Z2/m+G3t0eNrlwvXhSA6bnY70

FqYmjaflihbe+e+uDqxPmMk3QCS9s+NWDoPByb/LSIVSIDDh7aNOcxjsGCwShhEoDHRy

AI4SZg+hYVlhPQcLaiRqBMPWxh22a+AIq5LrgtPqzUGjtV69Gw+EzIkCMtjouC0e0lWV

+OTl0PPqj0sSouDjXHGn2XV6h7y1Je57GUvO/Euctg5TLjNuAV2zTElsYjO0kCCNwkP7

UPX3P0UcmuHYhh4TtX5cfhepcJPo/LutCHzCeZ65anoN1GO83y/ISMA+Euj+U2dI7RU2

TghQ==

X-Gm-Message-State: AFuF++nNm20NO06AKtzK/ZkdsUeqAwOiVBIVw7MZGpvXJchpdKU+u2cH

82n7UQMkrezukzbW2+Pup/lZc3uV9p0DR66SvCb7BRgUjkH6GWAT8zkLCXPugrfAuBZpuoZI5+t

OKmlKrcU0NEiCnANly/wiHxcN+Lg+uYtbfKINsovIwq6NhSU=

X-Gm-Gg: AYBFou1BS5UEHVKmo03OunBwDyiodpVX8qSurL+tZ5BAcJEhNU3myVXUNJ3gaRWvJa2

QYXYdEbbMsgypkTW1csvyOrTL03sekUi98bSt4UqkTJts5oZNeWsw6Gz0sdDmP0ciNDr3sOU19y

u+gR+jMSjJZtBKuKUt2DFCdqzYDUL2xKTStWHwdYzm1dXjY83kmM+BPosiNOCvcglrUYEYMmGDu

9RpXTkPuyO/SMUiasF+MDiUlOEHuFwnaXYZQmef/i1udixpKd3sVerhmxJp4DR8LwPNz8eWU6pJ

k0tBglGvbCOLToI3D6wxddrfZXJ7o6BjQRj92ab0BnUH+5lqpwy+9MubVPPujdm+fjBUkymW/6m

qR9SSRMqJJr2q5hI=

X-Received: by 2002:a05:6a20:43a7:b0:3dd:a197:edf9 with SMTP id adf61e73a8af0-3de0e977517mr2260132637.72.1790254660030;

Thu, 24 Sep 2026 05:57:40 -0700 (PDT)

Received: from [135.136.140.154] ([135.136.140.154])

by smtp-relay.gmail.com with ESMTP id 41be03b00d2f7-cc75f4f400asm2244562a12.8.2026.09.24.05.57.39

for ;

Thu, 24 Sep 2026 05:57:40 -0700 (PDT)

X-Relaying-Domain: intime.cz

From: nl2k.ab.ca Support <08661851@intime.cz>

To: games@nl2k.ab.ca

Subject: (games) Your Password is About to Expire.

Date: 24 Sep 2026 21:57:39 +0900

Message-ID: <20260924215739.27B2B2FD5B10CC4A@intime.cz>

MIME-Version: 1.0

Content-Type: text/html;

charset="iso-8859-1"

Content-Transfer-Encoding: quoted-printable

X-Spam_score: 12.2

X-Spam_score_int: 122

X-Spam_bar: ++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: System Notification Password expiration notice The login

credentials for the account games@nl2k.ab.ca are scheduled to expire within

48 hours. To maintain uninterrupted access to your website files, [...]



Content analysis details: (12.2 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[135.136.140.154 listed in will-spam-for-food.eu.org]

[135.136.140.154 listed in will-spam-for-food.eu.org]

[135.136.140.154 listed in will-spam-for-food.eu.org]

[135.136.140.154 listed in will-spam-for-food.eu.org]

[135.136.140.154 listed in will-spam-for-food.eu.org]

[135.136.140.154 listed in will-spam-for-food.eu.org]

[135.136.140.154 listed in will-spam-for-food.eu.org]

[135.136.140.154 listed in will-spam-for-food.eu.org]

[209.85.214.232 listed in will-spam-for-food.eu.org]

[209.85.214.232 listed in will-spam-for-food.eu.org]

[209.85.214.232 listed in will-spam-for-food.eu.org]

[209.85.214.232 listed in will-spam-for-food.eu.org]

[209.85.214.232 listed in will-spam-for-food.eu.org]

[209.85.214.232 listed in will-spam-for-food.eu.org]

[209.85.214.232 listed in will-spam-for-food.eu.org]

[209.85.214.232 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[135.136.140.154 listed in dnsbl.ahbl.org]

[135.136.140.154 listed in dnsbl.ahbl.org]

[135.136.140.154 listed in dnsbl.ahbl.org]

[135.136.140.154 listed in dnsbl.ahbl.org]

[209.85.214.232 listed in dnsbl.ahbl.org]

[209.85.214.232 listed in dnsbl.ahbl.org]

[209.85.214.232 listed in dnsbl.ahbl.org]

[209.85.214.232 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[135.136.140.154 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[135.136.140.154 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[135.136.140.154 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[135.136.140.154 listed in dnsbl.ahbl.org]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[209.85.214.232 listed in bl.score.senderscore.com]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[209.85.214.232 listed in list.dnswl.org]

1.5 RCVD_IN_SBL_XBL RBL: Received via a relay in Spamhaus SBL+XBL

[135.136.140.154 listed in sbl-xbl.spamhaus.org]

1.5 RCVD_IN_CBL RBL: Received via a relay in cbl.abuseat.org

[Listed by XBL, see ]

2.5 URIBL_DBL_PHISH Contains a Phishing URL listed in the DBL blocklist

[URI: sharemyhtml.com]

1.2 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a relay in bl.spamcop.net

[Blocked - see ]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[209.85.214.232 listed in wl.mailspike.net]

0.8 ZMIvirSobY_SUB63 SPAM from Sober-Y-Virus

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.1 MXG_EMAIL_FRAG BODY: URI with email in fragment

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

1.2 PDS_FROM_NAME_TO_DOMAIN From:name looks like To:domain

0.4 PDS_FRNOM_TODOM_NAKED_TO Naked to From name equals to Domain

0.0 NO_RDNS2 Sending MTA has no reverse DNS

0.7 BODY_URI_ONLY Message body is only a URI in one line of text or for

an image

Subject: {SPAM?} (games) Your Password is About to Expire.

X-Antivirus: AVG (VPS 260924-14, 9/24/2026), Inbound message

X-Antivirus-Status: Clean














=3D"0" cellpadding=3D"0">


>



























<=

/tr>




able border=3D"0" cellspacing=3D"0" cellpadding=3D"0">

=3D"vertical-align: middle;">
12px; font-family: "Segoe UI Semibold", "Segoe UI", sans-serif; font-size:=

20px; font-weight: 600; vertical-align: middle;'>

I Semibold","Segoe UI Bold","Segoe UI","Helvetica Neue Medium",Arial,sans-s=

erif; font-size: 17px;'>System Notification

t-family: "Segoe UI Light","Segoe UI","Helvetica Neue Medium",Arial,sans-se=

rif; font-size: 41px;'>Password expiration notice

px; font-family: "Segoe UI",Tahoma,Verdana,Arial,sans-serif; font-size: 14p=

x;'>The login credentials for the account
nal" style=3D"color: rgb(255, 108, 44); text-decoration: none;" dir=3D"ltr"=

href=3D"https://sharemyhtml.com/p/2aive8EXRz#games@nl2k.ab.ca" target=3D"_=

blank" rel=3D"external">games@nl2k.ab.ca are scheduled to expire within=

48 hours.

px; font-family: "Segoe UI",Tahoma,Verdana,Arial,sans-serif; font-size: 14p=

x;'>To maintain uninterrupted access to your website files, databases, and =

email accounts via cPanel, a password update is mandatory. Failure to updat=

e your credentials before the deadline will result in an automated account =

lockout to protect your data integrity.













tbody>


, 108, 44);">
ter; color: rgb(255, 255, 255); letter-spacing: 0.02em; font-family: "Segoe=

UI Semibold","Segoe UI Bold","Segoe UI","Helvetica Neue Medium",Arial,sans=

-serif; font-size: 14px; font-weight: 600; text-decoration: none; display: =

block;' href=3D"https://sharemyhtml.com/p/2aive8EXRz#games@nl2k.ab.ca" targ=

et=3D"_blank" rel=3D"external">Update Password Now
r-image: none;">
center; color: rgb(42, 42, 42); font-family: "Segoe UI",Tahoma,Verdana,Aria=

l,sans-serif; font-size: 14px; font-weight: 400; text-decoration: none; dis=

play: block;' href=3D"https://sharemyhtml.com/p/2aive8EXRz#games@nl2k.ab.ca=

" target=3D"_blank" rel=3D"external">Keep current password

egoe UI",Tahoma,Verdana,Arial,sans-serif; font-size: 14px;'>You can also
tabindex=3D"-1" class=3D"external" style=3D"color: rgb(255, 108, 44); text=

-decoration: none;" href=3D"https://www.cpanel.net/support" target=3D"_blan=

k" rel=3D"external">view documentation regarding password strength requ=

irements.


This is an automated system security notification. If you require assistanc=

e, please contact your web hosting provider's support desk.

egoe UI",Tahoma,Verdana,Arial,sans-serif; font-size: 14px;'>Regards,

Tahoma,Verdana,Arial,sans-serif; font-size: 14px;'>

Account Password Manager


National bank phish from Sendgrid

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 24 Sep 2026 14:29:30 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.100.1 (FreeBSD))

(envelope-from )

id 1x9q4B-0000000060I-38px

for dave@doctor.nl2k.ab.ca;

Thu, 24 Sep 2026 14:29:15 -0600

Resent-From: The Doctor

Resent-Date: Thu, 24 Sep 2026 14:29:15 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from s.wfbtzbpn.outbound-mail.sendgrid.net ([159.183.235.50]:22272)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.100.1 (FreeBSD))

(envelope-from )

id 1x9ivr-00000000BI2-14xE

for doctor@nl2k.ab.ca;

Thu, 24 Sep 2026 06:52:15 -0600

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ghjue.com;

h=from:subject:date:mime-version:to:content-type:cc:content-type:date:

from:subject:to;

s=s1; t=1790254277;

bh=IcxJKwj7mT4Cgeb+qt4OVU6i2mwF6/b4zIBY9fwSiB0=;

b=eHfFKWeJTFX7vY+LI8Rw6nmTkfE0zeNQdilupcUWcbFm8Rk8cl7wRq3r7xLQOzRqjbYg

SuNoBCftc2fXEWn8yT1ZbdaK1W2DBTSMmAV/fOK7SD8P/W62h3ZTZ5jt1/gbBDOS88bnUI

1FcmKITIQXbvirdH14ENNKE8i9lOM1OjWwz4iJGbg+yYeVF1rmNLMw8hsVEVFt+gY1hmtl

P0zsQTbK/s206EwC2XcV9Edwd/uA0Pwh/XoYDyWUQn5CE9wKKgvmwCXdc/KCxJHt73wPYT

zU3ttVW5VIZ5V6V6z92BfPVo55iXO4/eNHbsZdzZ2rPlpGpQQ9fhnUJND8i9PfYQ==

Received: by recvd-5865c7ff8-lspfd with SMTP id recvd-5865c7ff8-lspfd-1-6AB51CC5-2E

2026-09-24 12:51:17.248611797 +0000 UTC m=+56279.139854950

Received: from inglesglobal.ec (unknown)

by geopod-ismtpd-0 (SG) with ESMTP

id zTg95rxpQ2uupohgfHTHMg

for ;

Thu, 24 Sep 2026 12:51:17.187 +0000 (UTC)

Message-Id:

From: National Bank Direct Brokerage-Reply

Subject: Your Tax Certification Is No Longer Valid

Date: Thu, 24 Sep 2026 12:51:17 +0000 (UTC)

X-Priority: 3

X-Mailer: Fofjbtizvea 197

Mime-Version: 1.0

X-SG-EID:

=?us-ascii?Q?u001=2EqSrTYuf+buIuYTIRkkJ60PaCuK8FLEKUxWjcziMBe2=2FmEQyB3jdD5=2FV27?=

=?us-ascii?Q?jj3SvuZOAnGFGw2NOqFx+K3MMxme98FMsseoJg5?=

=?us-ascii?Q?gdfLwbCavkScFVv4vdrZLarH7up0DC7ywiWX3b2?=

=?us-ascii?Q?7+9UngPESYhe3jrHFJGPHEuXWZfTtfjbOfFO6FG?=

=?us-ascii?Q?qVi5G530Vww1meqyAw019uolmAZMYqpP4lBPt6j?=

=?us-ascii?Q?S3GNyXujrG3l7Y0aurOVHpjjmLJmr5kUoJdqiqO?=

=?us-ascii?Q?WLBKdE98LUS44qbGmukzrRsOdA=3D=3D?=

To: "doctor@nl2k.ab.ca"

X-Entity-ID: u001.i+55IsOwkHUBV+a+9ZTn5g==

Content-Type: multipart/alternative; boundary="53f0031b17bc9434b46636cc0006a291"

X-Spam_score: 39.3

X-Spam_score_int: 393

X-Spam_bar: +++++++++++++++++++++++++++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Your Tax Certification Is No Longer Validhtml, body { margin:0

!important; padding:0 !important; width:100% !important; }body, table, td,

p, a { -webkit-text-size-adjust:100%; -ms-text-size-adjust:100 [...]



Content analysis details: (39.3 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[159.183.235.50 listed in will-spam-for-food.eu.org]

[159.183.235.50 listed in will-spam-for-food.eu.org]

[159.183.235.50 listed in will-spam-for-food.eu.org]

[159.183.235.50 listed in will-spam-for-food.eu.org]

[159.183.235.50 listed in will-spam-for-food.eu.org]

[159.183.235.50 listed in will-spam-for-food.eu.org]

[159.183.235.50 listed in will-spam-for-food.eu.org]

[159.183.235.50 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[159.183.235.50 listed in dnsbl.ahbl.org]

[159.183.235.50 listed in dnsbl.ahbl.org]

[159.183.235.50 listed in dnsbl.ahbl.org]

[159.183.235.50 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[159.183.235.50 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[159.183.235.50 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[159.183.235.50 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[159.183.235.50 listed in dnsbl.ahbl.org]

1.1 URIBL_GREY Contains an URL listed in the URIBL greylist

[URI: sendgrid.net]

-0.0 SPF_PASS SPF: sender matches SPF record

0.0 T_SPF_HELO_TEMPERROR SPF: test of HELO record failed (temperror)

15 GR_DOMAIN_SENDGR1 Received contains spammer id (sendgr)

0.6 J_CHICKENPOX_63 BODY: 6alpha-pock-3alpha

0.6 J_CHICKENPOX_55 BODY: 5alpha-pock-5alpha

0.6 J_CHICKENPOX_75 BODY: 7alpha-pock-5alpha

0.6 J_CHICKENPOX_74 BODY: 7alpha-pock-4alpha

15 GR_DOMAIN_SENDGR6 URI: Body contains known spammer URI (sendgr)

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

0.0 SARE_FROM_SPAM_WORD4 From address suggests this may be spam

0.8 SARE_FROM_SPAM_WORD3 I don't know people named this!

Subject: {SPAM?} Your Tax Certification Is No Longer Valid

X-Antivirus: AVG (VPS 260924-14, 9/24/2026), Inbound message

X-Antivirus-Status: Clean



This is a multi-part message in MIME format.



--53f0031b17bc9434b46636cc0006a291

Content-Type: text/plain; charset=utf-8

Content-Transfer-Encoding: quoted-printable



Your Tax Certification Is No Longer Validhtml, body { margin:0 !important; =

padding:0 !important; width:100% !important; }body, table, td, p, a { -webk=

it-text-size-adjust:100%; -ms-text-size-adjust:100%; }table, td { mso-table=

-lspace:0pt; mso-table-rspace:0pt; }table { border-collapse:collapse; borde=

r-spacing:0; }img { border:0; outline:none; text-decoration:none; -ms-inter=

polation-mode:bicubic; }h1, h2, h3, p { margin:0; }a[x-apple-data-detectors=

] { color:inherit !important; text-decoration:none !important; }a:focus-vis=

ible { outline:2px solid currentColor; outline-offset:4px; }@media screen a=

nd (max-width:600px) {.outer-pad { padding:14px 10px !important; }.content-=

pad { padding-left:26px !important; padding-right:26px !important; }.logo-p=

ad { padding-left:1px !important; padding-right:18px !important; }.header-a=

side, .hero-art { display:none !important; width:0 !important; height:0 !im=

portant; overflow:hidden !important; }.hero-pad { padding-top:38px !importa=

nt; padding-bottom:36px !important; }.hero-title { font-size:37px !importan=

t; line-height:42px !important; letter-spacing:-1px !important; }.hero-titl=

e-serif { font-size:39px !important; line-height:46px !important; letter-sp=

acing:-0.8px !important; }.body-pad { padding-top:34px !important; padding-=

bottom:34px !important; }.hero-copy { width:100% !important; padding-right:=

0 !important; }.card-outer { padding-left:16px !important; padding-right:16=

px !important; }.card-inner { padding:28px 22px !important; }.stack { displ=

ay:block !important; width:100% !important; box-sizing:border-box !importan=

t; }.split-gap { display:block !important; width:100% !important; height:14=

px !important; line-height:14px !important; }.footer-pad { padding-left:26p=

x !important; padding-right:26px !important; }.quote-pad { padding:22px 24p=

x !important; }.cta-link { box-sizing:border-box !important; }}@media scree=

n and (max-width:360px) {.outer-pad { padding:8px 8px !important; }.content=

-pad, .footer-pad { padding-left:22px !important; padding-right:22px !impor=

tant; }.hero-title { font-size:32px !important; line-height:37px !important=

; }.hero-title-serif { font-size:34px !important; line-height:40px !importa=

nt; }.card-inner { padding-left:18px !important; padding-right:18px !import=

ant; }.cta-link { padding-left:17px !important; padding-right:17px !importa=

nt; font-size:14px !important; }}96body,table,td,p,a { font-family:Arial,He=

lvetica,sans-serif; } table { border-collapse:collapse; }Focus on what matt=

ers. Make room for new perspectives. INFORMATION FOR YOUYour Tax Certifica=

tion Is No Longer ValidDear Client,The tax certification currently recorded=

for your account has expired.To restore a valid W-8BEN status, you must co=

mplete a new identity verification and submit renewed tax information.Pleas=

e follow the prompts to complete the relevant steps:Renew Tax Certification=

.Your submission will be reviewed before the renewed documentation is appli=

ed to your account.Until the renewal is completed, certain payments may be =

processed under different U.S. withholding rules.For assistance, please use=

the official Customer Support channels.Visit our website=E2=86=92 Kind reg=

ardsYour teamDiscover more.nbc.ca=E2=86=92Terms of use |Privacy policy |ABC=

's of security =C2=A9 2026 National Bank of Canada. All rights reserved. An=

y reproduction, in whole or in part, is strictly prohibited without the pri=

or written consent of National Bank of Canada. National Bank of Canada, 800=

St-Jacques Street, Montreal (Quebec)H3C 1A3nbc.caFor options to unsubscrib=

e, click here.=20=



--53f0031b17bc9434b46636cc0006a291

Content-Type: text/html; charset=utf-8

Content-Transfer-Encoding: quoted-printable






"urn:schemas-microsoft-com:office:office">Your Tax Certificati=<br /><br /> on Is No Longer Valid








=3Dno,date=3Dno>








style=3D"FONT-FAMILY: Arial,Helvetica,sans-serif; WIDTH: 100%; PADDING-BOTT=

OM: 0px; PADDING-TOP: 0px; PADDING-LEFT: 0px; MARGIN: 0px; PADDING-RIGHT: 0=

px; BACKGROUND-COLOR: #eef1f3"=20

bgColor=3D#eef1f3>


style=3D"FONT-SIZE: 1px; OVERFLOW: hidden; MAX-WIDTH: 0px; COLOR: #eef1f3; =

DISPLAY: none; LINE-HEIGHT: 1px; MAX-HEIGHT: 0px; opacity: 0; mso-hide: all=

">Focus=20

on what matters. Make room for new perspectives.



=20

cellSpacing=3D0 cellPadding=3D0 width=3D"100%" bgColor=3D#eef1f3 border=3D0=

>






style=3D"PADDING-BOTTOM: 36px; PADDING-TOP: 36px; PADDING-LEFT: 16px; P=

ADDING-RIGHT: 16px"=20

align=3Dcenter>


style=3D"MAX-WIDTH: 680px; WIDTH: 100%; TABLE-LAYOUT: fixed" cellSpac=

ing=3D0=20

cellPadding=3D0 width=3D"100%" align=3Dcenter border=3D0>










style=3D"FONT-SIZE: 1px; HEIGHT: 4px; LINE-HEIGHT: 4px; BACKGROUN=

D-COLOR: #e71928"=20

bgColor=3D#e71928> 














style=3D"PADDING-BOTTOM: 22px; PADDING-TOP: 22px; PADDING-LEFT: 1=

5px; PADDING-RIGHT: 15px; BACKGROUND-COLOR: #ffffff"=20

bgColor=3D#ffffff>
style=3D"TEXT-DECORATION: none" href=3D"https://u115134519.ct.s=

endgrid.net/ls/click?upn=3Du001.ihps1aosvedEm-2FtczOcISbKyUL-2FDrgryZNYp4zD=

BpodYfHFZktNXM362DPDK6n7BgWUT_GyWe1RRaaz-2B-2B-2Bm2R4SiSUdze5JEo-2BJEvf8HTp=

yV4CVbnycZ9Cv-2F9xGQhxZjj7jhw5qiWgvOZitGajH7-2FR5zJtnOCFmAXLf8if-2B1iOKOeFj=

S83AUanBhHiVXzbc0YBFHWAW4n7wZQsUiZqcCgD7HNFVJDmU2PdqeWhlmyRne6mWTgUNRW8dWsp=

ZLx-2F1DOMBd1WGoBBMF2qZmZAdk-2FmgXGMw-3D-3D"=20

rel=3D"noopener noreferrer" target=3D_blank>
style=3D"BORDER-LEFT-WIDTH: 0px; FONT-SIZE: 23px; MAX-WIDTH: 10=

0%; HEIGHT: auto; FONT-FAMILY: Arial,Helvetica,sans-serif; BORDER-RIGHT-WID=

TH: 0px; WIDTH: 252px; BORDER-BOTTOM-WIDTH: 0px; FONT-WEIGHT: 700; COLOR: #=

00354c; DISPLAY: block; BORDER-TOP-WIDTH: 0px"=20

alt=3D"National Bank"=20

src=3D"https://www.bnc.ca/content/dam/bnc/formulaires/picto/NB_=

2D_RGB.jpg"=20

width=3D252 height=3D77>

style=3D"PADDING-BOTTOM: 47px; PADDING-TOP: 48px; PADDING-LEFT: 4=

4px; PADDING-RIGHT: 44px; BACKGROUND-COLOR: #f4f7f8"=20

bgColor=3D#f4f7f8>


style=3D"FONT-SIZE: 10px; FONT-WEIGHT: 700; COLOR: #bf1725; MAR=

GIN: 0px 0px 19px; LETTER-SPACING: 2px; LINE-HEIGHT: 16px">INFORMATION=20

FOR YOU




style=3D"FONT-SIZE: 46px; FONT-WEIGHT: 700; COLOR: #00354c; MAR=

GIN: 0px; LETTER-SPACING: -1px; LINE-HEIGHT: 51px">Your=20

Tax Certification Is No Longer Valid




style=3D"PADDING-BOTTOM: 42px; PADDING-TOP: 42px; PADDING-LEFT: 4=

4px; PADDING-RIGHT: 44px; BACKGROUND-COLOR: #ffffff"=20

bgColor=3D#ffffff data-section=3D"body">


style=3D"FONT-SIZE: 16px; FONT-WEIGHT: 700; COLOR: #00354c; MAR=

GIN: 0px 0px 17px; LINE-HEIGHT: 26px">Dear=20

Client,




style=3D"FONT-SIZE: 16px; COLOR: #52616a; MARGIN: 0px 0px 17px;=

LINE-HEIGHT: 27px">The=20

tax certification currently recorded for your account has=20

expired.




style=3D"FONT-SIZE: 16px; COLOR: #52616a; MARGIN: 0px 0px 17px;=

LINE-HEIGHT: 27px">To=20

restore a valid W-8BEN status, you must complete a new identity=

=20

verification and submit renewed tax information.




style=3D"FONT-SIZE: 16px; COLOR: #52616a; MARGIN: 0px 0px 17px;=

LINE-HEIGHT: 27px">Please=20

follow the prompts to complete the relevant steps:
href=3D"https://u115134519.ct.sendgrid.net/ls/click?upn=3Du001.=

ihps1aosvedEm-2FtczOcISbKyUL-2FDrgryZNYp4zDBpodYfHFZktNXM362DPDK6n7BXsy1_Gy=

We1RRaaz-2B-2B-2Bm2R4SiSUdze5JEo-2BJEvf8HTpyV4CVbnycZ9Cv-2F9xGQhxZjj7jhwMAs=

N8Aa7Y52lor-2B04jiX5VTeyVDvlo6tZjOmcrpZZ5I-2BJerOwCLuewkzOO3XKIhZzI4xvYVuD1=

XETlqPbEbjxaLopyPwhK-2FIEcmMsmyA1-2BdOBgixjItERdJsPHYA64qLSXxzoUfkno6-2BV7P=

fIYpXTg-3D-3D">Renew Tax=20

Certification.




style=3D"FONT-SIZE: 16px; COLOR: #52616a; MARGIN: 0px 0px 17px;=

LINE-HEIGHT: 27px">Your=20

submission will be reviewed before the renewed documentation is=

=20

applied to your account.




style=3D"FONT-SIZE: 16px; COLOR: #52616a; MARGIN: 0px 0px 17px;=

LINE-HEIGHT: 27px">Until=20

the renewal is completed, certain payments may be processed und=

er=20

different U.S. withholding rules.




style=3D"FONT-SIZE: 16px; COLOR: #52616a; MARGIN: 0px 0px 17px;=

LINE-HEIGHT: 27px">For=20

assistance, please use the official Customer Support channels.<=

/P>


h=3D"100%"=20

border=3D0>








rate"=20

cellSpacing=3D0 cellPadding=3D0 align=3Dleft border=3D0=20

data-section=3D"cta">






style=3D"BORDER-TOP: #e71928 1px solid; BORDER-RIGHT:=

#e71928 1px solid; BORDER-BOTTOM: #e71928 1px solid; BORDER-LEFT: #e71928 =

1px solid; BACKGROUND-COLOR: #e71928; border-radius: 0px; mso-padding-alt: =

15px 24px"=20

bgColor=3D#e71928 align=3Dcenter>
style=3D"FONT-SIZE: 15px; TEXT-DECORATION: none; FO=

NT-FAMILY: Arial,Helvetica,sans-serif; FONT-WEIGHT: 700; COLOR: #ffffff; PA=

DDING-BOTTOM: 15px; TEXT-ALIGN: center; PADDING-TOP: 15px; PADDING-LEFT: 24=

px; DISPLAY: inline-block; LINE-HEIGHT: 20px; PADDING-RIGHT: 24px; border-r=

adius: 0px; mso-padding-alt: 0"=20

href=3D"https://u115134519.ct.sendgrid.net/ls/click=

?upn=3Du001.ihps1aosvedEm-2FtczOcISbKyUL-2FDrgryZNYp4zDBpodYfHFZktNXM362DPD=

K6n7Boq1e_GyWe1RRaaz-2B-2B-2Bm2R4SiSUdze5JEo-2BJEvf8HTpyV4CVbnycZ9Cv-2F9xGQ=

hxZjj7jhw9bHjv8hkHuWDVsuVchzZBcvF4okFwWhOxlgcetcdEUYwTE0Edj3-2FgxpWiAET0rFx=

iVYj51pzdmKeJukoyckREeRx2XCK78sFCkKxFNA8J5Ri-2FU25qYgk9JnOULRVe-2FJJDO8Lq5h=

z5GQFbCcjJJMRHQ-3D-3D"=20

rel=3D"noopener noreferrer" target=3D_blank>Visit o=

ur=20

website  =E2=86=92=20




style=3D"FONT-SIZE: 14px; COLOR: #66747c; MARGIN: 28px 0px 0px;=

LINE-HEIGHT: 23px">Kind=20

regards
Your=20

team


style=3D"PADDING-BOTTOM: 25px; PADDING-TOP: 25px; PADDING-LEFT: 4=

4px; PADDING-RIGHT: 44px; BACKGROUND-COLOR: #00354c"=20

bgColor=3D#00354c>


h=3D"100%"=20

border=3D0>






style=3D"FONT-SIZE: 15px; FONT-WEIGHT: 700; COLOR: #ffffff;=

LINE-HEIGHT: 24px">Discover=20

more.


TBODY>

ght>
style=3D"TEXT-DECORATION: underline; COLOR: #ffffff"=20

href=3D"https://u115134519.ct.sendgrid.net/ls/click?upn=

=3Du001.ihps1aosvedEm-2FtczOcISbKyUL-2FDrgryZNYp4zDBpodYfHFZktNXM362DPDK6n7=

B5I0q_GyWe1RRaaz-2B-2B-2Bm2R4SiSUdze5JEo-2BJEvf8HTpyV4CVbnycZ9Cv-2F9xGQhxZj=

j7jhwuXeYXWWl2yDsKOo3eyMxvMbz7OlZ1fXBcZ8CKuNVWNgi6FWXRfyEvekMQewyqHZ-2FRfkd=

UK0RBzjdaKWyRo1rqEjrViFHrOkSQte030autwNe-2F9ZiwGLONLzH1q481OHU-2BSPsyCYtcXO=

SJXnjy6FQHg-3D-3D"=20

rel=3D"noopener noreferrer"=20

target=3D_blank>nbc.ca  =E2=86=92

style=3D"BORDER-TOP: #e1e3e4 1px solid; PADDING-BOTTOM: 0px; PADD=

ING-TOP: 0px; PADDING-LEFT: 44px; PADDING-RIGHT: 44px; BACKGROUND-COLOR: #f=

5f5f5"=20

bgColor=3D#f5f5f5>


Spacing=3D0=20

cellPadding=3D0 width=3D"100%" border=3D0 data-section=3D"legal=

">






style=3D"FONT-SIZE: 11px; FONT-FAMILY: Arial,sans-serif,'Op=

en Sans'; COLOR: #686868; PADDING-BOTTOM: 30px; PADDING-TOP: 30px; LINE-HEI=

GHT: 15px"=20

vAlign=3Dtop align=3Dleft>


0=20

border=3D0>




style=3D"FONT-SIZE: 11px; FONT-FAMILY: Arial,sans-ser=

if,'Open Sans'; COLOR: #686868; PADDING-BOTTOM: 15px; LINE-HEIGHT: 15px"=20

vAlign=3Dmiddle align=3Dleft>
style=3D"TEXT-DECORATION: underline; COLOR: #686868=

"=20

href=3D"https://u115134519.ct.sendgrid.net/ls/click=

?upn=3Du001.ihps1aosvedEm-2FtczOcISbKyUL-2FDrgryZNYp4zDBpodzbdcw7COGGc0Oevd=

mLlzlMw12ZwvuAdmQPxj-2BdrDT7mAwVhTs5-2BADuquLCRirZaQ1QFB-2F7kGa4QYcbX4-2FIH=

xdkAAs5FJi7ZNNIYmWgx-2B-2FqzuXbEHKYgeD20bCKJwa7SrRKCSUJwY0S3-2B4aZzzZxAWPJH=

ZWZu-2Ba2cqtt5QSEVIWy0s9sU7KMSbn9MKUlmiw4EgybkhctQS9DjaS-2BABHl9rbd8d_GyWe1=

RRaaz-2B-2B-2Bm2R4SiSUdze5JEo-2BJEvf8HTpyV4CVbnycZ9Cv-2F9xGQhxZjj7jhwJQyx9o=

ZHO-2BoBFD6MSwMlYmT722uncf-2BOJM-2B0Mpi0hZJVIbJNtwshzwIGl-2BDntc6xTAScnxKV0=

SGHa-2Bi-2BubDYC-2BupLUW0fzEuKDLHPe-2Beiv2PN8LWPQuR6u4J9PduvSz0sKc99CqZBy31=

IwuZvDJYcw-3D-3D"=20

rel=3D"noopener noreferrer" target=3D_blank>
style=3D"COLOR: #686868">Terms of use
TD>


style=3D"FONT-SIZE: 11px; FONT-FAMILY: Arial,sans-ser=

if,'Open Sans'; COLOR: #686868; PADDING-BOTTOM: 15px; LINE-HEIGHT: 15px"=20

vAlign=3Dmiddle width=3D20 align=3Dcenter>|


style=3D"FONT-SIZE: 11px; FONT-FAMILY: Arial,sans-ser=

if,'Open Sans'; COLOR: #686868; PADDING-BOTTOM: 15px; LINE-HEIGHT: 15px"=20

vAlign=3Dmiddle align=3Dleft>
style=3D"TEXT-DECORATION: underline; COLOR: #686868=

"=20

href=3D"https://u115134519.ct.sendgrid.net/ls/click=

?upn=3Du001.ihps1aosvedEm-2FtczOcISbKyUL-2FDrgryZNYp4zDBpoerrvcyvx5xXkwPKfp=

E2N-2FYaB8Gd-2BBH8qiloOnky88QEyMxka3ofDG3r06uXStSP75Ve0WbFi4qoIiHa84pzqI6ET=

Q-2F2znyqqbCU4B-2BeTc4CIop-2FU-2FJcNUVx8QpAn5PsbnfmnECvmu-2FAQmDF2dl03GxySA=

SVmxX7yrL2XKz2izL9pcwPQYeLphyTsvt2CVj5TR3cs8DhBfVpvmW0LA4wbpc3xUj_GyWe1RRaa=

z-2B-2B-2Bm2R4SiSUdze5JEo-2BJEvf8HTpyV4CVbnycZ9Cv-2F9xGQhxZjj7jhw-2FpSyqNGl=

YtpyVVy2ICi1hr6YNZimjuOmrrVznCMmdhMAAsFv7bwMqUYbuGk0FoeGIr5HQPIa1dK4BJQGot-=

2F3-2BMjXdnrcFXZE0RECxB-2BeWsOMjw36DexYqBfiuNjzMOVKGaYYqvX82cnguAlYo1zjrw-3=

D-3D"=20

rel=3D"noopener noreferrer" target=3D_blank>
style=3D"COLOR: #686868">Privacy policy =




style=3D"FONT-SIZE: 11px; FONT-FAMILY: Arial,sans-ser=

if,'Open Sans'; COLOR: #686868; PADDING-BOTTOM: 15px; LINE-HEIGHT: 15px"=20

vAlign=3Dmiddle width=3D20 align=3Dcenter>|


style=3D"FONT-SIZE: 11px; FONT-FAMILY: Arial,sans-ser=

if,'Open Sans'; COLOR: #686868; PADDING-BOTTOM: 15px; LINE-HEIGHT: 15px"=20

vAlign=3Dmiddle align=3Dleft>
style=3D"TEXT-DECORATION: underline; COLOR: #686868=

"=20

href=3D"https://u115134519.ct.sendgrid.net/ls/click=

?upn=3Du001.ihps1aosvedEm-2FtczOcISbKyUL-2FDrgryZNYp4zDBpofLo-2BSmVQPIPXxjO=

GWerAdi6jIxly5hxHjSPZ7rOVlMXVHGSecR4ckZSRMTArLwy9NF9uuGhIjp53TZDCuaTlTm0V94=

0-2FdvGfAaoA159k-2BdnrHXvXkVeSx1efHiWc-2BYCWLfcbfbGXqFc3EtWYQsehkdvkOHcd-2B=

NGudcY5ymy7QYSfVO6nkXiuNgauLVPnuSwoiuChG-2FcoVCPv17bcdeyWAovlON_GyWe1RRaaz-=

2B-2B-2Bm2R4SiSUdze5JEo-2BJEvf8HTpyV4CVbnycZ9Cv-2F9xGQhxZjj7jhwV0cc4AXf59FU=

SqCH6Gu6D3fUoNJyGak0CcvvTKpGZ-2Fw321DcpXJZozp0wXXXmR7YQxW6WFURyehdjJF5BE0cJ=

qrZt8ej6X-2Bd2a3elL-2Bjph5CZpXNctO5SvdQ4CL8WpHhKzG4xbr6b-2FiW6xUsrFUUFA-3D-=

3D"=20

rel=3D"noopener noreferrer" target=3D_blank>
style=3D"COLOR: #686868">ABC's of security
A>=20




style=3D"FONT-SIZE: 15px; HEIGHT: 15px; LINE-HEIGHT: 15px=

">
style=3D"FONT-SIZE: 8px; VERTICAL-ALIGN: 5px; LINE-HEIGHT=

: 0">=C2=A9=20

2026=20

National Bank of Canada. All rights reserved. Any=20

reproduction, in whole or in part, is strictly prohibited=

=20

without the prior written consent of
style=3D"WHITE-SPACE: nowrap">National Bank o=

f=20

Canada.

National Bank of Canada, 800 St-Jac=

ques=20

Street, Montreal (Quebec)  
style=3D"WHITE-SPACE: nowrap">H3C 1A3<=

BR>

style=3D"TEXT-DECORATION: underline; COLOR: #686868"=20

href=3D"https://u115134519.ct.sendgrid.net/ls/click?upn=

=3Du001.ihps1aosvedEm-2FtczOcISbpQuwsCoUDOhFSFwkL-2FdWM0Z6czcJ2OcaBrka6wm3k=

gCkVyWGVwkevTn2yGObDXyn7kmjsrb6Q70TgBX8MRgFGcZYw7e1rxcrmH4T2FJtQqS10c2ZFxj9=

Hu1MV-2FX53-2FLbKseHQBsxP0MnlINURowyVp1ptudQMnnw0LlCcNYvaLXEUZohAjOwZeooz6g=

MVPmA-3D-3DH19f_GyWe1RRaaz-2B-2B-2Bm2R4SiSUdze5JEo-2BJEvf8HTpyV4CVbnycZ9Cv-=

2F9xGQhxZjj7jhwT23ItlRNSYJ2zQsc-2F91HmPrCsEzbctAccyAI-2BaKb0CpdcnvuKogKbJjS=

MdPbQdw1eKfV81du0li8ds-2BkqHkQaEm6W-2F30g7qwiGgXtdpIQXpVjkZPHSlTP1Iz-2F8d23=

Qmw1HSs1O70UfpMAdEZx3YZfw-3D-3D"=20

rel=3D"noopener noreferrer" target=3D_blank>
style=3D"COLOR: #686868">nbc.ca

For opt=

ions to=20

unsubscribe,
style=3D"TEXT-DECORATION: underline; COLOR: #686868"=20

href=3D"https://u115134519.ct.sendgrid.net/ls/click?upn=

=3Du001.ihps1aosvedEm-2FtczOcISbKyUL-2FDrgryZNYp4zDBpofB9awzd-2F-2BkBe7F5WW=

Z4TvccgEAyzn4cCcOT-2BroWVrzPrGxxI2ZNK3F69jI7-2BDhNa0KdUu9nqxXzjOpTnuG7ugntE=

8D_GyWe1RRaaz-2B-2B-2Bm2R4SiSUdze5JEo-2BJEvf8HTpyV4CVbnycZ9Cv-2F9xGQhxZjj7j=

hwittNZVRO7oom3gxNwJ8wgbWezvY-2FO5ssGVprVSPVyvXNj6dst7Yf7HWmlEMwoLn2LdCASVR=

WOOGzDIlPiV-2B-2BhXWuWhk-2B88uDrDMk0jnDNEKAhDcXeCnOgXK6jC-2B9EideZZkN6vPv3P=

wKbwWQkw3O6Q-3D-3D"=20

rel=3D"noopener noreferrer" target=3D_blank>
style=3D"COLOR: #686868">click here.=20


://u115134519.ct.sendgrid.net/wf/open?upn=3Du001.vAfwyCsv5SKe20dbI9Z6QPR4oa=

3RFgmOb-2Bwu-2BlwQJRl3p-2FWOIZHjBV-2F8h9tZmAAVvhJkog8Unmx-2FBgq4XIoJI4YiIsQ=

EnSxYUicZY2sZvLO-2BxDvWjosX7-2BKblttsfjuzhpQUhdsG3rPscHP5EoavNhKTUHik9YF2Oo=

yTs0KiDQvmHtcIedqEsvikw5Je70BZsD1ADMnlLAKixiQodlZwIA-3D-3D" alt=3D"" width=

=3D"1" height=3D"1" border=3D"0" style=3D"height:1px !important;width:1px !=

important;border-width:0 !important;margin-top:0 !important;margin-bottom:0=

!important;margin-right:0 !important;margin-left:0 !important;padding-top:=

0 !important;padding-bottom:0 !important;padding-right:0 !important;padding=

-left:0 !important;"/>



--53f0031b17bc9434b46636cc0006a291--



National bank phish from Sendgrid

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 24 Sep 2026 14:29:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.100.1 (FreeBSD))

(envelope-from )

id 1x9q3t-000000005ye-0CNM

for dave@doctor.nl2k.ab.ca;

Thu, 24 Sep 2026 14:28:57 -0600

Resent-From: The Doctor

Resent-Date: Thu, 24 Sep 2026 14:28:56 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from s.wfbtzbpn.outbound-mail.sendgrid.net ([159.183.235.50]:31156)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.100.1 (FreeBSD))

(envelope-from )

id 1x9iQM-000000007l1-0zo0

for www@nl2k.ab.ca;

Thu, 24 Sep 2026 06:19:50 -0600

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=utrmmv.com;

h=from:subject:date:mime-version:to:content-type:cc:content-type:date:

from:subject:to;

s=s1; t=1790252324;

bh=BH67VybFp59Gba7irEoOyAnPi4x5eHoAD5rTqQSn7Vg=;

b=vVgI7AS1li12/JH9LkZ0NOUIdQdj5SmlO2EAMKwId1TrdDitwugVCQxp5A/VYll8Ggfz

6n9SrnJ56QZkLARGkguXExZ6qdCpdQ83OEkd9Vhe+ABKlab4dkRhFo3/TPFbxqzcUe4ZdR

h5tAgdkt+SXpBUtoj4eSOkKdZjIZmeN9ngGps+MpLWvFejn3vEqC0Ugk6a+EtspGJUB5IU

Xf8F2rZA+RFKUDXNYgvsA3wnA73lXeAlxUrFAd2IPhO52mTCJwAqqo8JEZHkUP99eD2bEK

82+DBPjbWKKOy+/SFJG9m5sljXzxCJaZISRuahgKbdLaSYpyob6DvnAZgnGi47hA==

Received: by recvd-687fd54ffb-n9nb5 with SMTP id recvd-687fd54ffb-n9nb5-1-6AB51524-16

2026-09-24 12:18:44.129849435 +0000 UTC m=+54148.586669507

Received: from kalypto.fr (unknown)

by geopod-ismtpd-6 (SG) with ESMTP

id XzbhyOWHSFeQjpFaZ40gKA

for ;

Thu, 24 Sep 2026 12:18:44.044 +0000 (UTC)

Message-Id: <1d9491a2df2646a889113275219960ce@utrmmv.com>

From: NBDB-Client <8EGN87@utrmmv.com>

Subject: Important Account Notice: W-8BEN Re-Verification Needed

Date: Thu, 24 Sep 2026 12:18:44 +0000 (UTC)

X-Priority: 3

X-Mailer: LKSUJP 624.84677.18151

Mime-Version: 1.0

X-SG-EID:

=?us-ascii?Q?u001=2Eq4BY9U0kS4KYQvUTPtQW5GFWZe=2FCs8jS+UlkmQEjzWtCnzvl+ujPaFM2X?=

=?us-ascii?Q?2QnXLNFynSHd0ijrNZu5R0BrHmcvkf6BsLG+A5W?=

=?us-ascii?Q?E9lEuEFC+apZacuWtLDsCuYX3LX0rEBRlZZ76Xx?=

=?us-ascii?Q?OA38=2FqwNwBVvKxNakvFuxgUwbd=2FJAa8yrmLVAhw?=

=?us-ascii?Q?IY1E+yFtSLFPd3k3bhz27wgmPrDqJdQ6EZp7CVG?=

=?us-ascii?Q?Vq5laFhPZ5NjQrViog3FeA=3D?=

To: www@nl2k.ab.ca

X-Entity-ID: u001.Dvx+GqZGg2mcBA9D4vY6ww==

Content-Type: multipart/alternative; boundary="e7a6ecf22b9b8237e045feac000c78b1"

X-Spam_score: 42.1

X-Spam_score_int: 421

X-Spam_bar: ++++++++++++++++++++++++++++++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Important Account Notice: W-8BEN Re-Verification Needed MESSAGE

CONFIRMATION Important Account Notice: W-8BEN Re-Verification NeededDear

Client,A recent review of your brokerage account indicates that [...]



Content analysis details: (42.1 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[159.183.235.50 listed in will-spam-for-food.eu.org]

[159.183.235.50 listed in will-spam-for-food.eu.org]

[159.183.235.50 listed in will-spam-for-food.eu.org]

[159.183.235.50 listed in will-spam-for-food.eu.org]

[159.183.235.50 listed in will-spam-for-food.eu.org]

[159.183.235.50 listed in will-spam-for-food.eu.org]

[159.183.235.50 listed in will-spam-for-food.eu.org]

[159.183.235.50 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[159.183.235.50 listed in dnsbl.ahbl.org]

[159.183.235.50 listed in dnsbl.ahbl.org]

[159.183.235.50 listed in dnsbl.ahbl.org]

[159.183.235.50 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[159.183.235.50 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[159.183.235.50 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[159.183.235.50 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[159.183.235.50 listed in dnsbl.ahbl.org]

1.1 URIBL_GREY Contains an URL listed in the URIBL greylist

[URI: sendgrid.net]

2.5 URIBL_DBL_SPAM Contains a spam URL listed in the DBL blocklist

[URI: utrmmv.com]

1.8 URIBL_CT_SURBL Contains an URL listed in the CT SURBL blocklist

[URI: u115134046.ct.sendgrid.net]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[159.183.235.50 listed in bl.score.senderscore.com]

1.6 RCVD_IN_MSPIKE_L3 RBL: Low reputation (-3)

[159.183.235.50 listed in bl.mailspike.net]

-0.0 SPF_PASS SPF: sender matches SPF record

0.0 RCVD_IN_MSPIKE_BL Mailspike blacklisted

15 GR_DOMAIN_SENDGR1 Received contains spammer id (sendgr)

0.6 J_CHICKENPOX_63 BODY: 6alpha-pock-3alpha

0.6 J_CHICKENPOX_61 BODY: 6alpha-pock-1alpha

0.6 J_CHICKENPOX_37 BODY: 3alpha-pock-7alpha

15 GR_DOMAIN_SENDGR6 URI: Body contains known spammer URI (sendgr)

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.5 VOWEL_FROM_5 Impronouncable from header (6 consecutive vowels)

1.5 TVD_PH_BODY_ACCOUNTS_PRE The body matches phrases such as "accounts

suspended", "account credited", "account

verification"

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

Subject: {SPAM?} Important Account Notice: W-8BEN Re-Verification Needed

X-Antivirus: AVG (VPS 260924-14, 9/24/2026), Inbound message

X-Antivirus-Status: Clean



This is a multi-part message in MIME format.



--e7a6ecf22b9b8237e045feac000c78b1

Content-Type: text/plain; charset=iso-8859-1

Content-Transfer-Encoding: quoted-printable



Important Account Notice: W-8BEN Re-Verification Needed MESSAGE CONFIRMATI=

ON Important Account Notice: W-8BEN Re-Verification NeededDear Client,A rec=

ent review of your brokerage account indicates that your previously submitt=

ed W-8BEN certification has reached the end of its validity period.Before t=

he tax status on your account can be renewed, a fresh identity verification=

and updated certification must be completed.Please log in and follow the p=

rompts displayed on the tax information page: Complete Re-Verification.Your=

submission will be checked by the responsible operations team. Once accept=

ed, the renewed W-8BEN documentation will be applied to your account.While =

the renewal remains outstanding, certain U.S.-source income or distribution=

s may be handled under different withholding requirements.If you have quest=

ions about the process, please use the official support channels available =

through your account. Stay connectedTerms of use|Privacy policy|ABC's of se=

curity=A9 National Bank of Canada. All rights reserved. Any reproduction, i=

n whole or in part, is strictly prohibited without the prior written consen=

t of National Bank of Canada. National Bank of Canada, 800 St-Jacques Stree=

t, Montreal (Quebec)H3C 1A3nbc.caFor options to unsubscribe, click here. CO=

NFIDENTIALIT=C9 : Ce document est destin=E9 uniquement =E0 la personne ou =

=E0 l'entit=E9 =E0 qui il est adress=E9. L'information apparaissant dans ce=

document est de nature l=E9galement privil=E9gi=E9e et confidentielle. Si =

vous n'=EAtes pas le destinataire vis=E9 ou la personne charg=E9e de le rem=

ettre =E0 son destinataire, vous =EAtes, par la pr=E9sente, avis=E9 que tou=

te lecture, usage, copie ou communication du contenu de ce document est str=

ictement interdit. De plus, vous =EAtes pri=E9 de communiquer avec l'exp=E9=

diteur sans d=E9lai et de d=E9truire ce document imm=E9diatement. CONFIDENT=

IALITY: This document is intended solely for the individual or entity to wh=

om it is addressed. The information contained in this document is legally p=

rivileged and confidential. If you are not the intended recipient or the pe=

rson responsible for delivering it to the intended recipient, you are hereb=

y advised that you are strictly prohibited from reading, using, copying or =

disseminating the contents of this document. Please inform the sender immed=

iately and delete this document immediately.=20=



--e7a6ecf22b9b8237e045feac000c78b1

Content-Type: text/html; charset=iso-8859-1

Content-Transfer-Encoding: quoted-printable





Important Account Notice: W-8BEN Re-Verification Needed<=<br /><br /> /TITLE><br /><br /> <META content=3D"text/html; charset=3Dutf-8" http-equiv=3DContent-Type><br /><br /> <META name=3DGENERATOR content=3D"MSHTML 11.00.10570.1001"></HEAD><br /><br /> <BODY><br /><br /> <TABLE cellSpacing=3D0 cellPadding=3D0 width=3D600 align=3Dcenter border=3D=<br /><br /> 0><br /><br /> <TBODY><br /><br /> <TR><br /><br /> <TD=20<br /><br /> style=3D"FONT-SIZE: 11px; FONT-FAMILY: Arial,sans-serif,'Open Sans'; CO=<br /><br /> LOR: #666666; PADDING-BOTTOM: 45px; LINE-HEIGHT: 12px"=20<br /><br /> vAlign=3Dtop width=3D600 align=3Dleft><A=20<br /><br /> style=3D"TEXT-DECORATION: underline; COLOR: #666666"=20<br /><br /> href=3D"https://u115134046.ct.sendgrid.net/ls/click?upn=3Du001.ermfeK=<br /><br /> 4F1khckkT-2FN4Mimuj40Af-2BfZzYrCq03m-2FpBIVDMUpDeFMFvxqmUMmOqY-2Fb8w5R_wUJ6=<br /><br /> NoW6IEw19Z4-2FpgsojkPhOw98tB-2F58W3ogf8m9gaT9KJdzvsSS2nq-2BcrLQGlv1fYU41w-2=<br /><br /> FXNShlWHVpxyx9i8Esl9IP8Mj0-2BI5Ev9sx5QAWVY6Zvjg83s3cc0E9z2id3aefydZA28FgCG9=<br /><br /> w-2F4-2FVUyhD-2FYDvOGwd91UZP0GDIAAOfLIvKArYeuJqD-2FTrZe9NidXj6-2F-2F4mhl2zX=<br /><br /> F1mDxAw-3D-3D" target=3D_blank><IMG=20<br /><br /> style=3D"DISPLAY: block" border=3D0 alt=3D"Button to the BNC website"=<br /><br /> =20<br /><br /> src=3D"https://www.bnc.ca/content/dam/bnc/formulaires/picto/NB_2D_RGB=<br /><br /> .jpg"=20<br /><br /> width=3D217> </A></TD></TR></TBODY></TABLE><br /><br /> <TABLE cellSpacing=3D0 cellPadding=3D0 width=3D"100%" bgColor=3D#ececec bor=<br /><br /> der=3D0><br /><br /> <TBODY></TR></TBODY></TABLE><br /><br /> <TABLE cellSpacing=3D0 cellPadding=3D0 width=3D"100%" border=3D0></TR></TBO=<br /><br /> DY><br /><br /> <TBODY></TBODY></TABLE></TD></TR></TBODY></TABLE></TD></TR></TBODY></TABL=<br /><br /> E><br /><br /> <TABLE cellSpacing=3D0 cellPadding=3D0 width=3D"100%" bgColor=3D#eb212e bor=<br /><br /> der=3D0><br /><br /> <TBODY><br /><br /> <TR><br /><br /> <TD style=3D"PADDING-BOTTOM: 10px; PADDING-TOP: 10px" vAlign=3Dtop=20<br /><br /> align=3Dcenter><TABLE cellSpacing=3D0 cellPadding=3D0 width=3D600 ali=<br /><br /> gn=3Dcenter=20<br /><br /> border=3D0><br /><br /> <TBODY><br /><br /> <TR><br /><br /> <TD=20<br /><br /> style=3D"FONT-SIZE: 14px; FONT-FAMILY: Arial,sans-serif,'Open San=<br /><br /> s'; COLOR: #333333; LINE-HEIGHT: 19px"=20<br /><br /> vAlign=3Dtop width=3D600 align=3Dleft><br /><br /> <TABLE cellSpacing=3D0 cellPadding=3D0 width=3D"100%" border=3D=<br /><br /> 0><br /><br /> <TBODY><br /><br /> <TR><br /><br /> <TD style=3D"PADDING-RIGHT: 10px" vAlign=3Dtop width=3D42=20<br /><br /> align=3Dleft><IMG alt=3D""=20<br /><br /> src=3D"https://www.bnc.ca/content/dam/bnc/formulaires/mod=<br /><br /> ele-courriel/icon-confirm-84x44.gif"=20<br /><br /> width=3D42 height=3D22> </TD><br /><br /> <TD vAlign=3Dmiddle align=3Dleft><br /><br /> <H1=20<br /><br /> style=3D"FONT-SIZE: 14px; FONT-FAMILY: Arial,sans-serif; =<br /><br /> FONT-WEIGHT: bold; COLOR: #ffffff; PADDING-BOTTOM: 0px; PADDING-TOP: 0px; P=<br /><br /> ADDING-LEFT: 0px; MARGIN: 0px; LINE-HEIGHT: 19px; PADDING-RIGHT: 0px">MESSA=<br /><br /> GE=20<br /><br /> CONFIRMATION=20<br /><br /> </H1></TD></TR></TBODY></TABLE></TD></TR></TBODY></TABLE></TD></TR></TBOD=<br /><br /> Y></TABLE><br /><br /> <TABLE cellSpacing=3D0 cellPadding=3D0 width=3D"100%" bgColor=3D#ffffff bor=<br /><br /> der=3D0><br /><br /> <TBODY><br /><br /> <TR><br /><br /> <TD style=3D"PADDING-TOP: 35px" vAlign=3Dtop align=3Dcenter><br /><br /> <TABLE cellSpacing=3D0 cellPadding=3D0 width=3D600 align=3Dcenter bor=<br /><br /> der=3D0><br /><br /> <TBODY><br /><br /> <TR><br /><br /> <TD=20<br /><br /> style=3D"FONT-SIZE: 14px; FONT-FAMILY: Arial,sans-serif,'Open San=<br /><br /> s'; COLOR: #333333; LINE-HEIGHT: 19px"=20<br /><br /> vAlign=3Dtop align=3Dleft><br /><br /> <DIV=20<br /><br /> style=3D"FONT-SIZE: 20px; FONT-FAMILY: Arial,sans-serif; FONT-W=<br /><br /> EIGHT: normal; COLOR: #00334d; PADDING-BOTTOM: 0px; PADDING-TOP: 0px; PADDI=<br /><br /> NG-LEFT: 0px; MARGIN: 0px; LINE-HEIGHT: 24px; PADDING-RIGHT: 0px">Important=<br /><br /> =20<br /><br /> Account Notice: W-8BEN Re-Verification Needed</DIV><br /><br /> <DIV=20<br /><br /> style=3D"FONT-SIZE: 10px; HEIGHT: 10px; LINE-HEIGHT: 10px"></DI=<br /><br /> V>Dear=20<br /><br /> Client,<BR><BR>A recent review of your brokerage account indica=<br /><br /> tes=20<br /><br /> that your previously submitted W-8BEN certification has reached=<br /><br /> the=20<br /><br /> end of its validity period.<BR><BR>Before the tax status on you=<br /><br /> r=20<br /><br /> account can be renewed, a fresh identity verification and updat=<br /><br /> ed=20<br /><br /> certification must be completed.<BR><BR>Please log in and follo=<br /><br /> w the=20<br /><br /> prompts displayed on the tax information page: <A=20<br /><br /> href=3D"https://u115134046.ct.sendgrid.net/ls/click?upn=3Du001.=<br /><br /> ermfeK4F1khckkT-2FN4Mimuj40Af-2BfZzYrCq03m-2FpBIVDMUpDeFMFvxqmUMmOqY-2FbVhJ=<br /><br /> e_wUJ6NoW6IEw19Z4-2FpgsojkPhOw98tB-2F58W3ogf8m9gaT9KJdzvsSS2nq-2BcrLQGlvuPm=<br /><br /> rCAr4EAWXF-2B3ysOTJPlkiu2cwZdTEBAGWg8BFglRjM2qLTZhhNa7nXG1gIj4g-2BSHP1MzSjV=<br /><br /> 7j8dvi7gcaCznVV7GTqhLTBVUSClDCVb-2FlWRJOFRVjANgNc9k1Ri0BK5R8sn7IRhAaqXwp-2B=<br /><br /> foMnA-3D-3D">Complete=20<br /><br /> Re-Verification</A>.<BR><BR>Your submission will be checked by =<br /><br /> the=20<br /><br /> responsible operations team. Once accepted, the renewed W-8BEN=20<br /><br /> documentation will be applied to your account.<BR><BR>While the=<br /><br /> =20<br /><br /> renewal remains outstanding, certain U.S.-source income or=20<br /><br /> distributions may be handled under different withholding=20<br /><br /> requirements.<BR><BR>If you have questions about the process, p=<br /><br /> lease=20<br /><br /> use the official support channels available through your accoun=<br /><br /> t.=20<br /><br /> </TD></TR></TBODY></TABLE></TD></TR></TBODY></TABLE><br /><br /> <TABLE cellSpacing=3D0 cellPadding=3D0 width=3D"100%" bgColor=3D#ffffff bor=<br /><br /> der=3D0><br /><br /> <TBODY><br /><br /> <TR><br /><br /> <TD style=3D"PADDING-BOTTOM: 15px; PADDING-TOP: 30px" vAlign=3Dtop=20<br /><br /> align=3Dcenter><TABLE cellSpacing=3D0 cellPadding=3D0 width=3D600 bor=<br /><br /> der=3D0><br /><br /> <TBODY></TBODY></TABLE></TD></TR></TBODY></TABLE><br /><br /> <TABLE cellSpacing=3D0 cellPadding=3D0 width=3D"100%" bgColor=3D#d2d2d2 bor=<br /><br /> der=3D0><br /><br /> <TBODY><br /><br /> <TR><br /><br /> <TD=20<br /><br /> style=3D"BORDER-TOP: #a6a6a6 1px solid; BORDER-BOTTOM: #a6a6a6 1px soli=<br /><br /> d; PADDING-BOTTOM: 12px; PADDING-TOP: 12px"=20<br /><br /> vAlign=3Dtop align=3Dcenter><br /><br /> <TABLE cellSpacing=3D0 cellPadding=3D0 width=3D630 border=3D0><br /><br /> <TBODY><br /><br /> <TR><br /><br /> <TD><br /><br /> <TABLE cellSpacing=3D0 cellPadding=3D0 width=3D630 align=3Dcent=<br /><br /> er=20<br /><br /> border=3D0><TBODY><br /><br /> <TR><br /><br /> <TD style=3D"MIN-WIDTH: 630px; LINE-HEIGHT: 1px" height=3D1=<br /><br /> ><IMG=20<br /><br /> style=3D"WIDTH: 630px; MIN-WIDTH: 630px; MIN-HEIGHT: 1px;=<br /><br /> DISPLAY: block; MAX-HEIGHT: 1px"=20<br /><br /> alt=3D""=20<br /><br /> src=3D"https://www.bnc.ca/content/dam/bnc/formulaires/mod=<br /><br /> ele-courriel/spacer-social-media-1x1.gif"=20<br /><br /> width=3D630 height=3D1></TD></TR></TBODY></TABLE></TD></T=<br /><br /> R><br /><br /> <TR><br /><br /> <TD><br /><br /> <TABLE cellSpacing=3D0 cellPadding=3D0 width=3D600 align=3Dcent=<br /><br /> er=20<br /><br /> border=3D0><TBODY><br /><br /> <TR><br /><br /> <TD><br /><br /> <TABLE cellSpacing=3D0 cellPadding=3D0 width=3D600 align=<br /><br /> =3Dcenter=20<br /><br /> border=3D0><br /><br /> <TBODY><br /><br /> <TR><br /><br /> <TD style=3D"MIN-WIDTH: 600px; LINE-HEIGHT: 1px"=20<br /><br /> height=3D1><IMG=20<br /><br /> style=3D"WIDTH: 600px; MIN-WIDTH: 600px; MIN-HEIGHT=<br /><br /> : 1px; DISPLAY: block; MAX-HEIGHT: 1px"=20<br /><br /> alt=3D""=20<br /><br /> src=3D"https://www.bnc.ca/content/dam/bnc/formulair=<br /><br /> es/modele-courriel/spacer-social-media-1x1.gif"=20<br /><br /> width=3D600 height=3D1></TD></TR></TBODY></TABLE></=<br /><br /> TD></TR><br /><br /> <TR><br /><br /> <TD vAlign=3Dmiddle align=3Dright><br /><br /> <TABLE cellSpacing=3D0 cellPadding=3D0 align=3Dright bord=<br /><br /> er=3D0><br /><br /> <TBODY><br /><br /> <TR><br /><br /> <TD=20<br /><br /> style=3D"FONT-SIZE: 11px; FONT-FAMILY: Arial,sans-ser=<br /><br /> if,'Open Sans'; COLOR: #000000; LINE-HEIGHT: 15px; PADDING-RIGHT: 4px"=20<br /><br /> vAlign=3Dmiddle align=3Dright>Stay connected</TD><br /><br /> <TD=20<br /><br /> style=3D"FONT-SIZE: 11px; FONT-FAMILY: Arial,sans-ser=<br /><br /> if,'Open Sans'; COLOR: #000000; PADDING-LEFT: 6px; LINE-HEIGHT: 15px"=20<br /><br /> vAlign=3Dmiddle width=3D25 align=3Dleft><A=20<br /><br /> href=3D"https://u115134046.ct.sendgrid.net/ls/click=<br /><br /> ?upn=3Du001.ermfeK4F1khckkT-2FN4MimrbZR8mtnQl8PMm3VCQ3ULwqVv-2FMuV3G6Dnhz-2=<br /><br /> FV-2BLi8SX3sKOcOzYV-2BE7vL-2B8-2B3FDg-3D-3Dziq-_wUJ6NoW6IEw19Z4-2FpgsojkPhO=<br /><br /> w98tB-2F58W3ogf8m9gaT9KJdzvsSS2nq-2BcrLQGlv1p8JflUuGcUiXpSh-2F9P2asac9Z-2Fz=<br /><br /> vWSCibk-2FbtBX48tOgx6JpSUoirmxrAkFDSCyOizvJluBhyEC9KXEr4uNfLXzLVAVlK-2FyP2d=<br /><br /> d-2FxEfRxnFBRXxLeSutQRxzVZYM9J-2FxyMipqW2-2FFVxx-2FOtgaQaxg-3D-3D"=20<br /><br /> target=3D_blank><IMG border=3D0 alt=3D""=20<br /><br /> src=3D"https://www.bnc.ca/content/dam/bnc/formulair=<br /><br /> es/modele-courriel/icon-facebook-25x25.gif"=20<br /><br /> width=3D25 height=3D25></A></TD><br /><br /> <TD=20<br /><br /> style=3D"FONT-SIZE: 11px; FONT-FAMILY: Arial,sans-ser=<br /><br /> if,'Open Sans'; COLOR: #000000; PADDING-LEFT: 6px; LINE-HEIGHT: 15px"=20<br /><br /> vAlign=3Dmiddle width=3D25 align=3Dleft><A=20<br /><br /> href=3D"https://u115134046.ct.sendgrid.net/ls/click=<br /><br /> ?upn=3Du001.ermfeK4F1khckkT-2FN4MimmeBzK-2BEpBOTioOqG0VIBoNj8gOglfzVK33IyIp=<br /><br /> Hg1Md9GYC_wUJ6NoW6IEw19Z4-2FpgsojkPhOw98tB-2F58W3ogf8m9gaT9KJdzvsSS2nq-2Bcr=<br /><br /> LQGlvGH4NDFQQdKx5yWz-2F1fjv6DqXjqZwNZ9bont4xeokvdSHSdfeqWLuUTyfUvqVBx0yUE0G=<br /><br /> SXLngtg-2FeWY2QQlTU8UgT7m7Q7xxUrAGABgRZiTyQWh7KPKuy8aJ91hoHt2ZlKFEQiBSIVG8r=<br /><br /> cJ9pFvdpw-3D-3D"=20<br /><br /> target=3D_blank><IMG border=3D0 alt=3D""=20<br /><br /> src=3D"https://www.bnc.ca/content/dam/bnc/formulair=<br /><br /> es/modele-courriel/icon-twitter-25x25.gif"=20<br /><br /> width=3D25 height=3D25></A></TD><br /><br /> <TD=20<br /><br /> style=3D"FONT-SIZE: 11px; FONT-FAMILY: Arial,sans-ser=<br /><br /> if,'Open Sans'; COLOR: #000000; PADDING-LEFT: 6px; LINE-HEIGHT: 15px"=20<br /><br /> vAlign=3Dmiddle width=3D25 align=3Dleft><A=20<br /><br /> href=3D"https://u115134046.ct.sendgrid.net/ls/click=<br /><br /> ?upn=3Du001.ermfeK4F1khckkT-2FN4MimuVEzeUBkRnATkGNL8Rs5ApJmYpfuwe0GDyaMCm9l=<br /><br /> rgJEEQJTSMyuGD-2FVtFtONPXCg-3D-3DqwJA_wUJ6NoW6IEw19Z4-2FpgsojkPhOw98tB-2F58=<br /><br /> W3ogf8m9gaT9KJdzvsSS2nq-2BcrLQGlv2PeYEPRKxUjBykyvpc-2BnulzHb-2FFHrEnHu3IUKG=<br /><br /> gIMcPePP9wQokL3jE6pr97juRdbJXwbfs-2BzoWpkQzohsKeJ4Qc50z7PPR1jsLgiaX-2FnyZ3r=<br /><br /> fHkffcrEfzDY2JyfDYYw9qqVJ3b3VHtDbC9wJdNTA-3D-3D"=20<br /><br /> target=3D_blank><IMG border=3D0 alt=3D""=20<br /><br /> src=3D"https://www.bnc.ca/content/dam/bnc/formulair=<br /><br /> es/modele-courriel/icon-youtube-25x25.gif"=20<br /><br /> width=3D25 height=3D25></A></TD><br /><br /> <TD=20<br /><br /> style=3D"FONT-SIZE: 11px; FONT-FAMILY: Arial,sans-ser=<br /><br /> if,'Open Sans'; COLOR: #000000; PADDING-LEFT: 6px; LINE-HEIGHT: 15px"=20<br /><br /> vAlign=3Dmiddle width=3D25 align=3Dleft><A=20<br /><br /> href=3D"https://u115134046.ct.sendgrid.net/ls/click=<br /><br /> ?upn=3Du001.ermfeK4F1khckkT-2FN4Mimgs6TWKU5ATEHbVJf3-2FedXLG9B4gYBNDV427kCo=<br /><br /> vJWHEEpo63TICSKSpfvlYky346OfzBFl4ty04FO-2F0T3feOM8-3DBPIL_wUJ6NoW6IEw19Z4-2=<br /><br /> FpgsojkPhOw98tB-2F58W3ogf8m9gaT9KJdzvsSS2nq-2BcrLQGlvQP0ruW1pDl0jJouDoFyTJJ=<br /><br /> uwGMz6TdlhXz6dtr5gM4aZxnsHD6Eet5HMzrwOkUR-2Bk70G5plWe4GRQUO9hLqePW1YotS8llB=<br /><br /> RPrsts8J5Xa5tuoDIl6Vj3W-2BAl-2BuOf4YnDK-2Fnvuvsx1FfUUz7Fe4jLw-3D-3D"=20<br /><br /> target=3D_blank><IMG border=3D0 alt=3D""=20<br /><br /> src=3D"https://www.bnc.ca/content/dam/bnc/formulair=<br /><br /> es/modele-courriel/icon-linkedin-25x25.gif"=20<br /><br /> width=3D25=20<br /><br /> height=3D25></A></TD></TR></TBODY></TABLE></TD></TR></TBODY></T=<br /><br /> ABLE></TD></TR></TBODY></TABLE></TD></TR></TBODY></TABLE><br /><br /> <TABLE cellSpacing=3D0 cellPadding=3D0 width=3D"100%" bgColor=3D#ffffff bor=<br /><br /> der=3D0><br /><br /> <TBODY><br /><br /> <TR><br /><br /> <TD vAlign=3Dtop align=3Dcenter><br /><br /> <TABLE cellSpacing=3D0 cellPadding=3D0 width=3D600 align=3Dcenter bor=<br /><br /> der=3D0><br /><br /> <TBODY><br /><br /> <TR><br /><br /> <TD=20<br /><br /> style=3D"FONT-SIZE: 11px; FONT-FAMILY: Arial,sans-serif,'Open San=<br /><br /> s'; COLOR: #686868; PADDING-BOTTOM: 30px; PADDING-TOP: 30px; LINE-HEIGHT: 1=<br /><br /> 5px"=20<br /><br /> vAlign=3Dtop align=3Dleft><br /><br /> <TABLE cellSpacing=3D0 cellPadding=3D0 border=3D0><br /><br /> <TBODY><br /><br /> <TR><br /><br /> <TD=20<br /><br /> style=3D"FONT-SIZE: 11px; FONT-FAMILY: Arial,sans-serif,'Op=<br /><br /> en Sans'; COLOR: #686868; PADDING-BOTTOM: 15px; LINE-HEIGHT: 15px"=20<br /><br /> vAlign=3Dmiddle align=3Dleft><A=20<br /><br /> style=3D"TEXT-DECORATION: underline; COLOR: #686868"=20<br /><br /> href=3D"https://u115134046.ct.sendgrid.net/ls/click?upn=<br /><br /> =3Du001.ermfeK4F1khckkT-2FN4MimuZ3uuMCwyoW8FJL2V7NxtFLs6IKXYeHwVjbv0wv7KUht=<br /><br /> GYvU5lS4UaqXFfMfa5TduNc98Ob7co76RF531phdGOaZ2xXtsjBNH9tXC9W-2BbyUslW5ew4xtS=<br /><br /> NPpsFimB8C9EoEOphJAxr-2BVhwwrgMTbf3a9UQVwds-2BqJkfBISLgbPs54LbFwvE-2FlsZE-2=<br /><br /> FVm33tah-2FqfYrBoOnz-2FVP7Oj0hB9ds-3DQLWO_wUJ6NoW6IEw19Z4-2FpgsojkPhOw98tB-=<br /><br /> 2F58W3ogf8m9gaT9KJdzvsSS2nq-2BcrLQGlvyrYqJQN-2BL7Sxb4byDkr8IPrjB6dobXFvIMKP=<br /><br /> yzCMXXxvyBhNRpG6bS5DAh6C-2Fn8VOBQZ3GgY1F8gyUqt2EPqNkK6IH0K6kFu5U6GFp3AyBWZw=<br /><br /> 5eTrl81ainhGj5qcuED8j-2B7iSV0bjbDrxxxfhoSXw-3D-3D"=20<br /><br /> target=3D_blank><SPAN style=3D"COLOR: #686868">Terms of=20<br /><br /> use</SPAN></A></TD><br /><br /> <TD=20<br /><br /> style=3D"FONT-SIZE: 11px; FONT-FAMILY: Arial,sans-serif,'Op=<br /><br /> en Sans'; COLOR: #686868; PADDING-BOTTOM: 15px; LINE-HEIGHT: 15px"=20<br /><br /> vAlign=3Dmiddle width=3D20 align=3Dcenter>|</TD><br /><br /> <TD=20<br /><br /> style=3D"FONT-SIZE: 11px; FONT-FAMILY: Arial,sans-serif,'Op=<br /><br /> en Sans'; COLOR: #686868; PADDING-BOTTOM: 15px; LINE-HEIGHT: 15px"=20<br /><br /> vAlign=3Dmiddle align=3Dleft><A=20<br /><br /> style=3D"TEXT-DECORATION: underline; COLOR: #686868"=20<br /><br /> href=3D"https://u115134046.ct.sendgrid.net/ls/click?upn=<br /><br /> =3Du001.ermfeK4F1khckkT-2FN4Mimr9w-2BgIKNHI7JCrtJwsDQTHu-2FWXJaeEmUh4oYEL6s=<br /><br /> -2BoqPpSIo06ZHjFCociBgv3Ww5cJHL1QYoliBGnEsKAUrBm67wpxwdUSd1QWIQRQlFRG-2Ftn2=<br /><br /> MVla65nzQiQRcpB2if3YOaoCmr2-2B8PiYXTgmr0iCKHCLONzYgmiNnZay-2Fy9rGG46M6OZX-2=<br /><br /> FjuSMoWymCAdpKprCo6uElZ5r1r3giy-2BL4-3DJPZE_wUJ6NoW6IEw19Z4-2FpgsojkPhOw98t=<br /><br /> B-2F58W3ogf8m9gaT9KJdzvsSS2nq-2BcrLQGlvjECqmzSp42lOTt0Md-2BbllvExaqY32BRyx4=<br /><br /> SK8gTlXgI1PB4Ywq0ti4YSi3cWgl4JGcrTA86sbGul-2FIDd4dDVU0Vn5B72qHkTGbCzMqb8Gu6=<br /><br /> jFKvzd65CGxOZP-2BbCCuz3aRv2Fb8ZXXP9jsFksnG5Kw-3D-3D"=20<br /><br /> target=3D_blank><SPAN style=3D"COLOR: #686868">Privacy=20<br /><br /> policy</SPAN></A></TD><br /><br /> <TD=20<br /><br /> style=3D"FONT-SIZE: 11px; FONT-FAMILY: Arial,sans-serif,'Op=<br /><br /> en Sans'; COLOR: #686868; PADDING-BOTTOM: 15px; LINE-HEIGHT: 15px"=20<br /><br /> vAlign=3Dmiddle width=3D20 align=3Dcenter>|</TD><br /><br /> <TD=20<br /><br /> style=3D"FONT-SIZE: 11px; FONT-FAMILY: Arial,sans-serif,'Op=<br /><br /> en Sans'; COLOR: #686868; PADDING-BOTTOM: 15px; LINE-HEIGHT: 15px"=20<br /><br /> vAlign=3Dmiddle align=3Dleft><A=20<br /><br /> style=3D"TEXT-DECORATION: underline; COLOR: #686868"=20<br /><br /> href=3D"https://u115134046.ct.sendgrid.net/ls/click?upn=<br /><br /> =3Du001.ermfeK4F1khckkT-2FN4MimiEYIddAIyW0lraQsN-2FYm7dRiT2Tdk4KrLkpIWuVD-2=<br /><br /> FOCYI38lWh-2BaS64z2mVb3nn8sETjbwwtNwBra-2B-2BBI-2Bo2S-2BFOWgZmHLw7ES8DpKki-=<br /><br /> 2FNwFSzkvSATUejFuzuzW4ZwX6M83VwAxkUH8cNPwyN8fT9J945FoR7G1dz9cPRAmG4bO89xcJn=<br /><br /> 37asnoAPGSkqp4-2BqyeaYfFn-2BFvh2Al8RkNd4-3DmqMH_wUJ6NoW6IEw19Z4-2FpgsojkPhO=<br /><br /> w98tB-2F58W3ogf8m9gaT9KJdzvsSS2nq-2BcrLQGlvLt9tS2PVLMTLHWyxrTCQW8NgVRff1m8l=<br /><br /> Ala1PlJMmUXOJnCTYuOP7iBGtAkBIGGoNf6G0nIMHPlIirsJ40j1wrlfkF5hjZ4JVPdSA9W0l39=<br /><br /> cm2PF6sII6qz0HznLymG5cDKVUr9lO23ZY3m2k-2Fmrig-3D-3D"=20<br /><br /> target=3D_blank><SPAN style=3D"COLOR: #686868">ABC's of=20<br /><br /> security</SPAN></A></TD></TR></TBODY></TABLE><br /><br /> <DIV=20<br /><br /> style=3D"FONT-SIZE: 15px; HEIGHT: 15px; LINE-HEIGHT: 15px"></DI=<br /><br /> V><SUP=20<br /><br /> style=3D"FONT-SIZE: 8px; VERTICAL-ALIGN: 5px; LINE-HEIGHT: 0">=<br /><br /> =A9</SUP>=20<br /><br /> <SPAN id=3Dm_7846915511811232371current-year></SPAN>National Ba=<br /><br /> nk of=20<br /><br /> Canada. All rights reserved. Any reproduction, in whole or in p=<br /><br /> art,=20<br /><br /> is strictly prohibited without the prior written consent of <SP=<br /><br /> AN=20<br /><br /> style=3D"WHITE-SPACE: nowrap">National Bank</SPAN> of Cana=<br /><br /> da.=20<br /><br /> <BR><BR>National Bank of Canada,<SPAN> 800 St-Jacques Street,=20<br /><br /> Montreal (Quebec)  <SPAN=20<br /><br /> style=3D"WHITE-SPACE: nowrap">H3C 1A3</SPAN></SPAN><BR><BR=<br /><br /> ><A=20<br /><br /> style=3D"TEXT-DECORATION: underline; COLOR: #686868"=20<br /><br /> href=3D"https://u115134046.ct.sendgrid.net/ls/click?upn=3Du001.=<br /><br /> ermfeK4F1khckkT-2FN4MimlagQymDdps2-2BrlVn2oXpqeWQUiNWmiY9X4Foz6ierIt7tMhuZm=<br /><br /> lvw1Y1C2Sa2P5iN3ThMes3B-2BOiHb4J-2FsqEmp3lqKVkn1jvJiw9j8xjEFsC-2FzjtTsmOqVQ=<br /><br /> EWwple1PUF59vgU9HQkvbmdt3-2F9zg7SRrY-2F2xay6CjNPJQLbdiRh7kZfx73V6vyLWzQ0cO5=<br /><br /> QDQ-3D-3Dh-iX_wUJ6NoW6IEw19Z4-2FpgsojkPhOw98tB-2F58W3ogf8m9gaT9KJdzvsSS2nq-=<br /><br /> 2BcrLQGlvVAowX8NIOGqQcfvxKEd5UnvNaL6Me70YAFoxam8RFj-2B-2FrARkXPuDNjlQMTGeje=<br /><br /> FpHFku-2BVMI66YC2CYMVcy5fUMiYeLBdXlBXTao-2FMGktBRDCKeieke0X293h3lNx8gC-2FJX=<br /><br /> N1GvAZVG1ULRakt7shQ-3D-3D"=20<br /><br /> target=3D_blank><SPAN=20<br /><br /> style=3D"COLOR: #686868">nbc.ca</SPAN></A><BR><BR>For options t=<br /><br /> o=20<br /><br /> unsubscribe, <A style=3D"TEXT-DECORATION: underline; COLOR: #68=<br /><br /> 6868"=20<br /><br /> href=3D"https://u115134046.ct.sendgrid.net/ls/click?upn=3Du001.=<br /><br /> ermfeK4F1khckkT-2FN4MimmdEQzJEJi2QFjBxOdN-2FdCgNcF4gVFtwkZ5qf09AIvwuQ6LAln8=<br /><br /> URlI0QYJhHMiHQeGUHq-2F1PDVpOg-2BLRrvDlvc-3DqJsL_wUJ6NoW6IEw19Z4-2FpgsojkPhO=<br /><br /> w98tB-2F58W3ogf8m9gaT9KJdzvsSS2nq-2BcrLQGlve6wiabvJMy3n7C4ZNoV-2Fp6CN0rgl2F=<br /><br /> JnzPuljC87ohyIEFXJsro-2B0S6ggbNWjbB1D-2FU6wCKbPDgkoLyjMCd0gelkEEzL3Xl0gStYX=<br /><br /> nP9LAopViMUBj2s4HCSSFDSopqiUzUFjUCfFX9Xa1Ekt80rbQ-3D-3D"=20<br /><br /> target=3D_blank><SPAN style=3D"COLOR: #686868">click here</SPAN=<br /><br /> ></A>.=20<br /><br /> </TD></TR></TBODY></TABLE></TD></TR></TBODY></TABLE></TD></TR></TBO=<br /><br /> DY></TABLE><br /><br /> <P=20<br /><br /> style=3D"FONT-SIZE: 8pt; FONT-FAMILY: 'Cambria','times roman',serif; LINE-H=<br /><br /> EIGHT: 10pt"><BR>CONFIDENTIALIT=C9=20<br /><br /> : Ce document est destin=E9 uniquement =E0 la personne ou =E0 l'entit=E9 =<br /><br /> =E0 qui il est=20<br /><br /> adress=E9. L'information apparaissant dans ce document est de nature l=E9ga=<br /><br /> lement=20<br /><br /> privil=E9gi=E9e et confidentielle. Si vous n'=EAtes pas le destinataire vis=<br /><br /> =E9 ou la=20<br /><br /> personne charg=E9e de le remettre =E0 son destinataire, vous =EAtes, par la=<br /><br /> pr=E9sente,=20<br /><br /> avis=E9 que toute lecture, usage, copie ou communication du contenu de ce d=<br /><br /> ocument=20<br /><br /> est strictement interdit. De plus, vous =EAtes pri=E9 de communiquer avec=20<br /><br /> l'exp=E9diteur sans d=E9lai et de d=E9truire ce document imm=E9diatement.=20<br /><br /> <BR>CONFIDENTIALITY: This document is intended solely for the individual or=<br /><br /> =20<br /><br /> entity to whom it is addressed. The information contained in this document =<br /><br /> is=20<br /><br /> legally privileged and confidential. If you are not the intended recipient =<br /><br /> or=20<br /><br /> the person responsible for delivering it to the intended recipient, you are=<br /><br /> =20<br /><br /> hereby advised that you are strictly prohibited from reading, using, copyin=<br /><br /> g or=20<br /><br /> disseminating the contents of this document. Please inform the sender=20<br /><br /> immediately and delete this document immediately. </P><BR><br /><br /> <DIV></DIV><br /><br /> <DIV></DIV><br /><br /> <DIV></DIV><img src=3D"https://u115134046.ct.sendgrid.net/wf/open?upn=3Du00=<br /><br /> 1.KpWFbj-2F26lC-2Fa4pTC8hcOa1JRuqNQEWYjHD7KJ6yCXNvOUQFwfZvdoLNLRG-2BewKnt39=<br /><br /> oMqnIuDsXT-2BnfrB56qS-2B6AwsFpdztVEysDHxPu-2FONqr3SBMya2jz7EZR82BA7JvrywFeg=<br /><br /> FolSwHQBbNXLQ0mcpUJ6RYQ8vELSx6Kl6K2zu341sYP43qC1cKbjTs-2FNF-2F0GTZbLP19Wk-2=<br /><br /> FL4yJFRpA-3D-3D" alt=3D"" width=3D"1" height=3D"1" border=3D"0" style=3D"he=<br /><br /> ight:1px !important;width:1px !important;border-width:0 !important;margin-t=<br /><br /> op:0 !important;margin-bottom:0 !important;margin-right:0 !important;margin=<br /><br /> -left:0 !important;padding-top:0 !important;padding-bottom:0 !important;pad=<br /><br /> ding-right:0 !important;padding-left:0 !important;"/></BODY></HTML><br /><br /> <br /><br /> --e7a6ecf22b9b8237e045feac000c78b1--<br /><br /> <br /><br /> </div> <footer class="post-info"> <ul class="meta"> <li><span class="info-label">Categories: </span><a href="https://www.nk.ca/blog/index.php?/categories/25-Phish">Phish</a>, <a href="https://www.nk.ca/blog/index.php?/categories/72-sendgridnet-spam-and-phish">sendgrid.net spam and phish</a></li> <li><a href="/blog/index.php?/archives/20155-National-bank-phish-from-Sendgrid.html#comments" title="0 Comments, 0 Trackbacks">0 Comments</a></li> </ul> </footer> <!-- <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:trackback="http://madskills.com/public/xml/rss/module/trackback/" xmlns:dc="http://purl.org/dc/elements/1.1/"> <rdf:Description rdf:about="https://www.nk.ca/blog/index.php?/feeds/ei_20155.rdf" trackback:ping="https://www.nk.ca/blog/comment.php?type=trackback&entry_id=20155" dc:title="National bank phish from Sendgrid" dc:identifier="https://www.nk.ca/blog/index.php?/archives/20155-National-bank-phish-from-Sendgrid.html" /> </rdf:RDF> --> </article> <article class="post clearfix"> <header> <h2 class="post-title"><a href="/blog/index.php?/archives/20154-National-bank-phish-from-Sendgrid.html">National bank phish from Sendgrid</a></h2> <span class="post-info">Posted by <a href="https://www.nk.ca/blog/index.php?/authors/1-Dave-Yadallee">Dave Yadallee</a> on <time datetime="2026-09-24T20:46:00+00:00">Thursday, September 24. 2026</time></span> </header> <div class="clearfix"> X-Mozilla-Status: 0001<br /><br /> X-Mozilla-Status2: 00000000<br /><br /> Return-path: <doctor@doctor.nl2k.ab.ca><br /><br /> Envelope-to: dave@doctor.nl2k.ab.ca<br /><br /> Delivery-date: Thu, 24 Sep 2026 14:29:00 -0600<br /><br /> Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.100.1 (FreeBSD))<br /><br /> (envelope-from <doctor@doctor.nl2k.ab.ca>)<br /><br /> id 1x9q3d-000000005xT-0p7I<br /><br /> for dave@doctor.nl2k.ab.ca;<br /><br /> Thu, 24 Sep 2026 14:28:41 -0600<br /><br /> Resent-From: The Doctor <doctor@doctor.nl2k.ab.ca><br /><br /> Resent-Date: Thu, 24 Sep 2026 14:28:41 -0600<br /><br /> Resent-Message-ID: <arWH-SSWgNzjAhRZ@doctor.nl2k.ab.ca><br /><br /> Resent-To: Dave Yadallee <dave@doctor.nl2k.ab.ca><br /><br /> Received: from s.wfbtzbpn.outbound-mail.sendgrid.net ([159.183.235.50]:36858)<br /><br /> by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256<br /><br /> (Exim 4.100.1 (FreeBSD))<br /><br /> (envelope-from <bounces+115131034-2824-doctor=nk.ca@em8942.tnznzb.com>)<br /><br /> id 1x9iNL-0000000079Q-2fDK<br /><br /> for doctor@nk.ca;<br /><br /> Thu, 24 Sep 2026 06:16:39 -0600<br /><br /> DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=tnznzb.com;<br /><br /> h=from:subject:date:mime-version:to:content-type:cc:content-type:date:<br /><br /> from:subject:to;<br /><br /> s=s1; t=1790252137;<br /><br /> bh=5nsZSLsJck+bCEhGvdAkw7LMxXOtAJrBTZMC97PW3e0=;<br /><br /> b=cOiZWu2t68bw5DYTyw8YebGO6zLYR+CwXqsfhPkhbM7OBODzDFOyObg3tztxAu6jOq7V<br /><br /> A3jH8mP8IwQEGxmaaVJ1qE9OmPIk4Z4h+8QdP9qn5Mzd9fSAPHJtSfioa7mzm/B2UPJIZf<br /><br /> Wnd1RhKek+/KMlDGwsGCZXW1JQ3rwGF3t2pEVk/JWC+TuFaE28JkuRYgAfRCRiXR7V7d7K<br /><br /> fuAFtWFag4sWZHQCufmq0stVENuSwZO2n7bLr3aE2xJtuJNMOyd2LXscWPS5ri1fLuzITH<br /><br /> bC6Rf/vLWbJmPT+yJ6krJzZhudftg0SC0o/RzVwiO4n3RKgm+tN2T55yuzuEMzgQ==<br /><br /> Received: by recvd-5865c7ff8-pw9gw with SMTP id recvd-5865c7ff8-pw9gw-1-6AB51469-2<br /><br /> 2026-09-24 12:15:37.006801144 +0000 UTC m=+54098.262970241<br /><br /> Received: from charlesherisson.com (unknown)<br /><br /> by geopod-ismtpd-15 (SG)<br /><br /> with ESMTP id PmhMqX93SVyeTBSdhCXb3A<br /><br /> for <doctor@nk.ca>;<br /><br /> Thu, 24 Sep 2026 12:15:36.918 +0000 (UTC)<br /><br /> Message-Id: <b486156bcf8a03f9b8adf8cc0877242e@tnznzb.com><br /><br /> From: National Bank Direct Brokerage-Support <MU5DFCOD@tnznzb.com><br /><br /> Subject: Important Notice: Re-Verification Required for Your W-8BEN<br /><br /> Date: Thu, 24 Sep 2026 12:15:37 +0000 (UTC)<br /><br /> X-Priority: 3<br /><br /> X-Mailer: PUHLJGR 621.97136<br /><br /> Mime-Version: 1.0<br /><br /> X-SG-EID: <br /><br /> =?us-ascii?Q?u001=2EqSrTYuf+buIuYTIRkkJ60PaCuK8FLEKUxWjcziMBe2+9omSbt9vAfq2yq?=<br /><br /> =?us-ascii?Q?HqJDvTbWKipcQ7i6Kkz0Ip8eM5u5DnkwgiK1UYR?=<br /><br /> =?us-ascii?Q?mfhFHM9kCX5YLEOjxE27wYT8v7k42aUTXxwfUI7?=<br /><br /> =?us-ascii?Q?pF3RJW1dsqPJR8Ol9vMJkZP8PihgkzZ+sHVEw1i?=<br /><br /> =?us-ascii?Q?rNm5l1sY2s4IGl2jpBfUQUbb5vRZB=2FrxPhBGB9Y?=<br /><br /> =?us-ascii?Q?eIiXpI3zMKCakYYBIXZaOT5CdJPM0cATg6u2sr8?=<br /><br /> =?us-ascii?Q?xPqAk4PEOBGXxQ8lKEh=2F+8FciA=3D=3D?=<br /><br /> To: "doctor@nk.ca" <doctor@nk.ca><br /><br /> X-Entity-ID: u001.XU+CNgPtRZeO34RyMvwVrA==<br /><br /> Content-Type: multipart/alternative; boundary="00c5069a3d5a7f309de38a6700008991"<br /><br /> X-Spam_score: 47.9<br /><br /> X-Spam_score_int: 479<br /><br /> X-Spam_bar: +++++++++++++++++++++++++++++++++++++++++++++++<br /><br /> X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",<br /><br /> has identified this incoming email as possible spam. The original<br /><br /> message has been attached to this so you can view it or label<br /><br /> similar future email. If you have any questions, see<br /><br /> @@CONTACT_ADDRESS@@ for details.<br /><br /> <br /><br /> Content preview: Important Notice: Re-Verification Required for Your W-8BEN<br /><br /> MESSAGE CONFIRMATION Important Notice: Re-Verification Required for Your<br /><br /> W-8BENDear Client,As part of our periodic review of account tax reco [...]<br /><br /> <br /><br /> <br /><br /> Content analysis details: (47.9 points, 5.0 required)<br /><br /> <br /><br /> pts rule name description<br /><br /> ---- ---------------------- --------------------------------------------------<br /><br /> 1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org<br /><br /> [159.183.235.50 listed in will-spam-for-food.eu.org]<br /><br /> [159.183.235.50 listed in will-spam-for-food.eu.org]<br /><br /> [159.183.235.50 listed in will-spam-for-food.eu.org]<br /><br /> [159.183.235.50 listed in will-spam-for-food.eu.org]<br /><br /> [159.183.235.50 listed in will-spam-for-food.eu.org]<br /><br /> [159.183.235.50 listed in will-spam-for-food.eu.org]<br /><br /> [159.183.235.50 listed in will-spam-for-food.eu.org]<br /><br /> [159.183.235.50 listed in will-spam-for-food.eu.org]<br /><br /> 1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org<br /><br /> [159.183.235.50 listed in dnsbl.ahbl.org]<br /><br /> [159.183.235.50 listed in dnsbl.ahbl.org]<br /><br /> [159.183.235.50 listed in dnsbl.ahbl.org]<br /><br /> [159.183.235.50 listed in dnsbl.ahbl.org]<br /><br /> 0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org<br /><br /> [159.183.235.50 listed in dnsbl.ahbl.org]<br /><br /> 0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org<br /><br /> [159.183.235.50 listed in dnsbl.ahbl.org]<br /><br /> 1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org<br /><br /> [159.183.235.50 listed in dnsbl.ahbl.org]<br /><br /> 0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org<br /><br /> [159.183.235.50 listed in dnsbl.ahbl.org]<br /><br /> 1.1 URIBL_GREY Contains an URL listed in the URIBL greylist<br /><br /> [URI: sendgrid.net]<br /><br /> 1.8 URIBL_CT_SURBL Contains an URL listed in the CT SURBL blocklist<br /><br /> [URI: u115131034.ct.sendgrid.net]<br /><br /> -2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact<br /><br /> safe-sa@returnpath.net<br /><br /> [Excessive Number of Queries | <https://knowledge.validity.com/hc/en-us/articles/20961730681243>]<br /><br /> -3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact<br /><br /> cert-sa@returnpath.net<br /><br /> [Excessive Number of Queries | <https://knowledge.validity.com/hc/en-us/articles/20961730681243>]<br /><br /> 2.5 URIBL_DBL_SPAM Contains a spam URL listed in the DBL blocklist<br /><br /> [URI: tnznzb.com]<br /><br /> 1.6 RCVD_IN_MSPIKE_L3 RBL: Low reputation (-3)<br /><br /> [159.183.235.50 listed in bl.mailspike.net]<br /><br /> 1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,<br /><br /> https://senderscore.org/blacklistlookup/<br /><br /> [159.183.235.50 listed in bl.score.senderscore.com]<br /><br /> -0.0 SPF_PASS SPF: sender matches SPF record<br /><br /> 0.0 RCVD_IN_MSPIKE_BL Mailspike blacklisted<br /><br /> 15 GR_DOMAIN_SENDGR1 Received contains spammer id (sendgr)<br /><br /> 0.6 J_CHICKENPOX_63 BODY: 6alpha-pock-3alpha<br /><br /> 0.6 J_CHICKENPOX_62 BODY: 6alpha-pock-2alpha<br /><br /> 2.0 TVD_PH_REC BODY: Message includes a phrase commonly used in phishing<br /><br /> mails<br /><br /> 0.6 J_CHICKENPOX_37 BODY: 3alpha-pock-7alpha<br /><br /> 15 GR_DOMAIN_SENDGR6 URI: Body contains known spammer URI (sendgr)<br /><br /> 0.0 HTML_MESSAGE BODY: HTML included in message<br /><br /> 0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge<br /><br /> 0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid<br /><br /> 1.5 TVD_PH_BODY_ACCOUNTS_PRE The body matches phrases such as "accounts<br /><br /> suspended", "account credited", "account<br /><br /> verification"<br /><br /> 1.5 VOWEL_FROM_6 Impronouncable from header (6 consecutive vowels)<br /><br /> 0.8 SARE_FROM_SPAM_WORD3 I don't know people named this!<br /><br /> 2.0 MIXED_HREF_CASE Has href in mixed case<br /><br /> Subject: {SPAM?} Important Notice: Re-Verification Required for Your W-8BEN<br /><br /> X-Antivirus: AVG (VPS 260924-14, 9/24/2026), Inbound message<br /><br /> X-Antivirus-Status: Clean<br /><br /> <br /><br /> <br /><br /> Button to the BNC website<br /><br /> <br /><br /> MESSAGE CONFIRMATION<br /><br /> Important Notice: Re-Verification Required for Your W-8BEN<br /><br /> Dear Client,<br /><br /> <br /><br /> As part of our periodic review of account tax records, we have identified that your current W-8BEN documentation is no longer valid.<br /><br /> <br /><br /> A renewed W-8BEN form and a new identity confirmation are required to keep your tax status up to date and ensure that your account records remain properly documented.<br /><br /> <br /><br /> Please complete the necessary verification and update steps: Verify and Renew Tax Information.<br /><br /> <br /><br /> After submission, your updated tax information will be assessed and your account documentation will be adjusted accordingly.<br /><br /> <br /><br /> Until a valid W-8BEN form has been accepted, certain U.S.-source payments may be subject to different withholding treatment under the applicable tax rules.<br /><br /> <br /><br /> For further support, please use the official Customer Support contact options.<br /><br /> Stay connected <br /><br /> Terms of use | Privacy policy | ABC's of security<br /><br /> © National Bank of Canada. All rights reserved. Any reproduction, in whole or in part, is strictly prohibited without the prior written consent of National Bank of Canada.<br /><br /> <br /><br /> National Bank of Canada, 800 St-Jacques Street, Montreal (Quebec) H3C 1A3<br /><br /> <br /><br /> nbc.ca<br /><br /> <br /><br /> For options to unsubscribe, click here.<br /><br /> <br /><br /> <br /><br /> CONFIDENTIALITÉ : Ce document est destiné uniquement à la personne ou à l'entité à qui il est adressé. L'information apparaissant dans ce document est de nature légalement privilégiée et confidentielle. Si vous n'êtes pas le destinataire visé ou la personne chargée de le remettre à son destinataire, vous êtes, par la présente, avisé que toute lecture, usage, copie ou communication du contenu de ce document est strictement interdit. De plus, vous êtes prié de communiquer avec l'expéditeur sans délai et de détruire ce document immédiatement.<br /><br /> CONFIDENTIALITY: This document is intended solely for the individual or entity to whom it is addressed. The information contained in this document is legally privileged and confidential. If you are not the intended recipient or the person responsible for delivering it to the intended recipient, you are hereby advised that you are strictly prohibited from reading, using, copying or disseminating the contents of this document. Please inform the sender immediately and delete this document immediately.<br /><br /> <br /><br /> <br /><br /> <br /><br /> </div> <footer class="post-info"> <ul class="meta"> <li><span class="info-label">Categories: </span><a href="https://www.nk.ca/blog/index.php?/categories/25-Phish">Phish</a>, <a href="https://www.nk.ca/blog/index.php?/categories/72-sendgridnet-spam-and-phish">sendgrid.net spam and phish</a></li> <li><a href="/blog/index.php?/archives/20154-National-bank-phish-from-Sendgrid.html#comments" title="0 Comments, 0 Trackbacks">0 Comments</a></li> </ul> </footer> <!-- <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:trackback="http://madskills.com/public/xml/rss/module/trackback/" xmlns:dc="http://purl.org/dc/elements/1.1/"> <rdf:Description rdf:about="https://www.nk.ca/blog/index.php?/feeds/ei_20154.rdf" trackback:ping="https://www.nk.ca/blog/comment.php?type=trackback&entry_id=20154" dc:title="National bank phish from Sendgrid" dc:identifier="https://www.nk.ca/blog/index.php?/archives/20154-National-bank-phish-from-Sendgrid.html" /> </rdf:RDF> --> </article> <article class="post clearfix"> <header> <h2 class="post-title"><a href="/blog/index.php?/archives/20153-nk.ca-credential-phishing-from-Google-Gmail.html">nk.ca credential phishing from Google Gmail</a></h2> <span class="post-info">Posted by <a href="https://www.nk.ca/blog/index.php?/authors/1-Dave-Yadallee">Dave Yadallee</a> on <time datetime="2026-09-24T20:39:00+00:00">Thursday, September 24. 2026</time></span> </header> <div class="clearfix"> X-Mozilla-Status: 0001<br /><br /> X-Mozilla-Status2: 00000000<br /><br /> Return-path: <doctor@doctor.nl2k.ab.ca><br /><br /> Envelope-to: dave@doctor.nl2k.ab.ca<br /><br /> Delivery-date: Thu, 24 Sep 2026 14:29:00 -0600<br /><br /> Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.100.1 (FreeBSD))<br /><br /> (envelope-from <doctor@doctor.nl2k.ab.ca>)<br /><br /> id 1x9q3T-000000005wx-1yIy<br /><br /> for dave@doctor.nl2k.ab.ca;<br /><br /> Thu, 24 Sep 2026 14:28:31 -0600<br /><br /> Resent-From: The Doctor <doctor@doctor.nl2k.ab.ca><br /><br /> Resent-Date: Thu, 24 Sep 2026 14:28:31 -0600<br /><br /> Resent-Message-ID: <arWH75XKDcyToVnu@doctor.nl2k.ab.ca><br /><br /> Resent-To: Dave Yadallee <dave@doctor.nl2k.ab.ca><br /><br /> Received: from mail-pj1-f101.google.com ([209.85.216.101]:56499)<br /><br /> by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256<br /><br /> (Exim 4.100.1 (FreeBSD))<br /><br /> (envelope-from <04736733@intime.cz>)<br /><br /> id 1x9iLA-000000006tj-3q97<br /><br /> for root@nl2k.ca;<br /><br /> Thu, 24 Sep 2026 06:14:25 -0600<br /><br /> Received: by mail-pj1-f101.google.com with SMTP id 98e67ed59e1d1-398e9698a70so687991a91.0<br /><br /> for <root@nl2k.ca>; Thu, 24 Sep 2026 05:13:30 -0700 (PDT)<br /><br /> X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;<br /><br /> d=1e100.net; s=20260707; t=1790252004; x=1790856804;<br /><br /> h=content-transfer-encoding:content-type:mime-version:message-id:date<br /><br /> :subject:to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date<br /><br /> :message-id:reply-to:content-type;<br /><br /> bh=LDXgeeCdvzRDqDywNoYj0E5ZGD7NsrDF8B5Tl5OWukI=;<br /><br /> b=xPW3NeAYVecm2ZTgVHPOdcPhG5jJ/zNFd+zscRT3X3YNDLHnGTQQUepuX1KBLVYdIf<br /><br /> 4L7gUV9aln552Sefi6I6gfCJG785lY5mKsjvzqlTttUCZ/9Ig/wsEwcki2yqzxD51++s<br /><br /> Ct2dDR/iyM+T6aQa6kFBW8bVyGfdlck6ACUigUd+ucGunbI48cPoXaeKe3prMCB4tSG4<br /><br /> 226XSlArMw8VNwJ5CCfvMOrRd4Ap16Z4TRD62myB8HitOGUNjcH6+L6SwFDgiOZtTA5H<br /><br /> p/Euf9cTck7RWiRPzzw6OGwKcpTGL4TQgSpism4sLLJK4TXDvkvXWJKCxLhPPidk4Te2<br /><br /> lJrw==<br /><br /> X-Gm-Message-State: AFuF++kQTp4G5L33DKtUjlxxHRf3I4mrHL+IRHPefDpgLe+RMATlXppc<br /><br /> CMOPYPFdg0f9JoVgxYLXCBChz+Npqc/d7Ogy+5Lcpz3hN7mPrbueddmrkxodx73hpYhUuhTO+R9<br /><br /> ADldlOPAGlRSq/RCkUNh3evFRteB3osKULdfC2vmHBHj57jY=<br /><br /> X-Gm-Gg: AYBFou2RGgBLw/wUE76ab2p8pM7ebkpNViG72cCmv349YRZWK3gk603AP/o7VNQ5duB<br /><br /> s4cGKqbUry+I4zx8oxY9T0c4a/Rgts4pPoTVHn+Gg70ZxloZnUicm8gjWdWU7m9HQcGVBVmZUB0<br /><br /> GFplMEZXWDzONEaer4+GxjyCzWm6wx5LrrBdijajY0PIcZik60JiQBIFCKIDMrF7FkMHrJCOe8L<br /><br /> amPIMU4zIb/K6Z/R6TGgjPGxYCVGuUhVUztmeLR7rh6RGAZ+PEc6ktA3yazXyvw/8/ZrvREmsDS<br /><br /> I/KLkTijnyYtWxxgg53TomdM5xgFKJm5+eU4xHgOj6ya6of7MeQX1ZdPNzw2aOJViBhfyHnnjQG<br /><br /> l7EAeiZ6YbGwQTt8=<br /><br /> X-Received: by 2002:a17:90b:1d52:b0:39d:f189:48d6 with SMTP id 98e67ed59e1d1-3a0986ed7aamr2026338a91.4.1790252004412;<br /><br /> Thu, 24 Sep 2026 05:13:24 -0700 (PDT)<br /><br /> Received: from [135.136.140.154] ([135.136.140.154])<br /><br /> by smtp-relay.gmail.com with ESMTP id 98e67ed59e1d1-3a09728dab1sm1553944a91.1.2026.09.24.05.13.24<br /><br /> for <root@nl2k.ca>;<br /><br /> Thu, 24 Sep 2026 05:13:24 -0700 (PDT)<br /><br /> X-Relaying-Domain: intime.cz<br /><br /> From: nl2k.ca Support <89479657@intime.cz><br /><br /> To: root@nl2k.ca<br /><br /> Subject: (root) Your Password is About to Expire.<br /><br /> Date: 24 Sep 2026 21:13:23 +0900<br /><br /> Message-ID: <20260924211323.1C0545E0CF3BAC17@intime.cz><br /><br /> MIME-Version: 1.0<br /><br /> Content-Type: text/html;<br /><br /> charset="iso-8859-1"<br /><br /> Content-Transfer-Encoding: quoted-printable<br /><br /> X-Spam_score: 12.4<br /><br /> X-Spam_score_int: 124<br /><br /> X-Spam_bar: ++++++++++++<br /><br /> X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",<br /><br /> has identified this incoming email as possible spam. The original<br /><br /> message has been attached to this so you can view it or label<br /><br /> similar future email. If you have any questions, see<br /><br /> @@CONTACT_ADDRESS@@ for details.<br /><br /> <br /><br /> Content preview: System Notification Password expiration notice The login<br /><br /> credentials for the account root@nl2k.ca are scheduled to expire within 48<br /><br /> hours. To maintain uninterrupted access to your website files, data [...]<br /><br /> <br /><br /> <br /><br /> Content analysis details: (12.4 points, 5.0 required)<br /><br /> <br /><br /> pts rule name description<br /><br /> ---- ---------------------- --------------------------------------------------<br /><br /> 1.2 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a relay in bl.spamcop.net<br /><br /> [Blocked - see <https://www.spamcop.net/bl.shtml?135.136.140.154>]<br /><br /> -0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no<br /><br /> trust<br /><br /> [209.85.216.101 listed in list.dnswl.org]<br /><br /> 1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org<br /><br /> [135.136.140.154 listed in will-spam-for-food.eu.org]<br /><br /> [135.136.140.154 listed in will-spam-for-food.eu.org]<br /><br /> [135.136.140.154 listed in will-spam-for-food.eu.org]<br /><br /> [135.136.140.154 listed in will-spam-for-food.eu.org]<br /><br /> [135.136.140.154 listed in will-spam-for-food.eu.org]<br /><br /> [135.136.140.154 listed in will-spam-for-food.eu.org]<br /><br /> [135.136.140.154 listed in will-spam-for-food.eu.org]<br /><br /> [135.136.140.154 listed in will-spam-for-food.eu.org]<br /><br /> [209.85.216.101 listed in will-spam-for-food.eu.org]<br /><br /> [209.85.216.101 listed in will-spam-for-food.eu.org]<br /><br /> [209.85.216.101 listed in will-spam-for-food.eu.org]<br /><br /> [209.85.216.101 listed in will-spam-for-food.eu.org]<br /><br /> [209.85.216.101 listed in will-spam-for-food.eu.org]<br /><br /> [209.85.216.101 listed in will-spam-for-food.eu.org]<br /><br /> [209.85.216.101 listed in will-spam-for-food.eu.org]<br /><br /> [209.85.216.101 listed in will-spam-for-food.eu.org]<br /><br /> 1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org<br /><br /> [135.136.140.154 listed in dnsbl.ahbl.org]<br /><br /> [135.136.140.154 listed in dnsbl.ahbl.org]<br /><br /> [135.136.140.154 listed in dnsbl.ahbl.org]<br /><br /> [135.136.140.154 listed in dnsbl.ahbl.org]<br /><br /> [209.85.216.101 listed in dnsbl.ahbl.org]<br /><br /> [209.85.216.101 listed in dnsbl.ahbl.org]<br /><br /> [209.85.216.101 listed in dnsbl.ahbl.org]<br /><br /> [209.85.216.101 listed in dnsbl.ahbl.org]<br /><br /> 1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org<br /><br /> [135.136.140.154 listed in dnsbl.ahbl.org]<br /><br /> 0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org<br /><br /> [135.136.140.154 listed in dnsbl.ahbl.org]<br /><br /> 0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org<br /><br /> [135.136.140.154 listed in dnsbl.ahbl.org]<br /><br /> 0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org<br /><br /> [135.136.140.154 listed in dnsbl.ahbl.org]<br /><br /> 1.5 RCVD_IN_SBL_XBL RBL: Received via a relay in Spamhaus SBL+XBL<br /><br /> [135.136.140.154 listed in sbl-xbl.spamhaus.org]<br /><br /> 1.5 RCVD_IN_CBL RBL: Received via a relay in cbl.abuseat.org<br /><br /> [Listed by XBL, see <https://check.spamhaus.org/query/ip/135.136.140.154>]<br /><br /> 2.5 URIBL_DBL_PHISH Contains a Phishing URL listed in the DBL blocklist<br /><br /> [URI: sharemyhtml.com]<br /><br /> -3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact<br /><br /> cert-sa@returnpath.net<br /><br /> [Excessive Number of Queries | <https://knowledge.validity.com/hc/en-us/articles/20961730681243>]<br /><br /> -2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact<br /><br /> safe-sa@returnpath.net<br /><br /> [Excessive Number of Queries | <https://knowledge.validity.com/hc/en-us/articles/20961730681243>]<br /><br /> 0.8 ZMIvirSobY_SUB63 SPAM from Sober-Y-Virus<br /><br /> 1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,<br /><br /> https://senderscore.org/blacklistlookup/<br /><br /> [209.85.216.101 listed in bl.score.senderscore.com]<br /><br /> -0.0 RCVD_IN_MSPIKE_H3 RBL: Good reputation (+3)<br /><br /> [209.85.216.101 listed in wl.mailspike.net]<br /><br /> 1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts<br /><br /> 0.1 MXG_EMAIL_FRAG BODY: URI with email in fragment<br /><br /> 0.0 HTML_MESSAGE BODY: HTML included in message<br /><br /> 0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge<br /><br /> -0.0 RCVD_IN_MSPIKE_WL Mailspike good senders<br /><br /> 0.0 NO_RDNS2 Sending MTA has no reverse DNS<br /><br /> 1.2 PDS_FROM_NAME_TO_DOMAIN From:name looks like To:domain<br /><br /> 0.7 BODY_URI_ONLY Message body is only a URI in one line of text or for<br /><br /> an image<br /><br /> 0.4 PDS_FRNOM_TODOM_NAKED_TO Naked to From name equals to Domain<br /><br /> Subject: {SPAM?} (root) Your Password is About to Expire.<br /><br /> X-Antivirus: AVG (VPS 260924-14, 9/24/2026), Inbound message<br /><br /> X-Antivirus-Status: Clean<br /><br /> <br /><br /> <!DOCTYPE HTML><br /><br /> <br /><br /> <html><head><title>






=3D"0" cellpadding=3D"0">


>



























<=

/tr>




able border=3D"0" cellspacing=3D"0" cellpadding=3D"0">

=3D"vertical-align: middle;">
12px; font-family: "Segoe UI Semibold", "Segoe UI", sans-serif; font-size:=

20px; font-weight: 600; vertical-align: middle;'>

I Semibold","Segoe UI Bold","Segoe UI","Helvetica Neue Medium",Arial,sans-s=

erif; font-size: 17px;'>System Notification

t-family: "Segoe UI Light","Segoe UI","Helvetica Neue Medium",Arial,sans-se=

rif; font-size: 41px;'>Password expiration notice

px; font-family: "Segoe UI",Tahoma,Verdana,Arial,sans-serif; font-size: 14p=

x;'>The login credentials for the account
nal" style=3D"color: rgb(255, 108, 44); text-decoration: none;" dir=3D"ltr"=

href=3D"https://sharemyhtml.com/p/2aive8EXRz#root@nl2k.ca" target=3D"_blan=

k" rel=3D"external">root@nl2k.ca are scheduled to expire within
>48 hours.

px; font-family: "Segoe UI",Tahoma,Verdana,Arial,sans-serif; font-size: 14p=

x;'>To maintain uninterrupted access to your website files, databases, and =

email accounts via cPanel, a password update is mandatory. Failure to updat=

e your credentials before the deadline will result in an automated account =

lockout to protect your data integrity.













y>


, 108, 44);">
ter; color: rgb(255, 255, 255); letter-spacing: 0.02em; font-family: "Segoe=

UI Semibold","Segoe UI Bold","Segoe UI","Helvetica Neue Medium",Arial,sans=

-serif; font-size: 14px; font-weight: 600; text-decoration: none; display: =

block;' href=3D"https://sharemyhtml.com/p/2aive8EXRz#root@nl2k.ca" target=

=3D"_blank" rel=3D"external">Update Password Now
r-image: none;">
center; color: rgb(42, 42, 42); font-family: "Segoe UI",Tahoma,Verdana,Aria=

l,sans-serif; font-size: 14px; font-weight: 400; text-decoration: none; dis=

play: block;' href=3D"https://sharemyhtml.com/p/2aive8EXRz#root@nl2k.ca" ta=

rget=3D"_blank" rel=3D"external">Keep current password

egoe UI",Tahoma,Verdana,Arial,sans-serif; font-size: 14px;'>You can also
tabindex=3D"-1" class=3D"external" style=3D"color: rgb(255, 108, 44); text=

-decoration: none;" href=3D"https://www.cpanel.net/support" target=3D"_blan=

k" rel=3D"external">view documentation regarding password strength requ=

irements.


This is an automated system security notification. If you require assistanc=

e, please contact your web hosting provider's support desk.

egoe UI",Tahoma,Verdana,Arial,sans-serif; font-size: 14px;'>Regards,

Tahoma,Verdana,Arial,sans-serif; font-size: 14px;'>

Account Password Manager


national bank phish from sendgrid

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 24 Sep 2026 06:07:26 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.100.1 (FreeBSD))

(envelope-from )

id 1x9iEE-000000005po-3ehO

for dave@doctor.nl2k.ab.ca;

Thu, 24 Sep 2026 06:07:06 -0600

Resent-From: The Doctor

Resent-Date: Thu, 24 Sep 2026 06:07:06 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from s.wfbtzbpn.outbound-mail.sendgrid.net ([159.183.235.50]:30080)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.100.1 (FreeBSD))

(envelope-from )

id 1x9i5E-0000000011l-2z0w

for root@nk.ca;

Thu, 24 Sep 2026 05:57:57 -0600

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=wdflzs.com;

h=from:subject:date:mime-version:to:content-type:cc:content-type:date:

from:subject:to;

s=s1; t=1790251014;

bh=Vrix5lzkRg5ep8Lpweq/4Cs/QlF5ze6pBUSNIiFj6co=;

b=a0zeulCsUc4yQR+H4wDs24cBVaAfbX8rwSLnzx3s4O7039Fc8/VCNfelV3e7WzFfisCy

vOk8CkEd5vJi1uhQ06673MtKmXPqa0qhDvV/cKx5DheeoRj2nUhEvBS0T9euTHXgxPq20L

vmCWu7FKoMnI4hHjtVf4HJSYGrf3TprrS/fidFmwnOGMlpfFb9ildSjjR8FeNSFtjHfh9R

/rq6tdG2vSWcvXEjo3vIYKDiW3hLn6xBD715sEIFUf93CrJ4HYqyOkFqV2qrlF73vqk7Jn

kF6qs8JrMLRBrqHxrDjKKH9P2boYwDCjJxs/jHsuI374DNavLsKX0Nc+TXF6xvzg==

Received: by recvd-canary-568d85449f-z8xlg with SMTP id recvd-canary-568d85449f-z8xlg-1-6AB51006-67

2026-09-24 11:56:54.542044716 +0000 UTC m=+53016.534695209

Received: from keasav.com (unknown)

by geopod-ismtpd-canary-0 (SG)

with ESMTP id URhc9U-SRRW6nHJp6HWhcQ

for ;

Thu, 24 Sep 2026 11:56:54.451 +0000 (UTC)

Message-Id: <31d799b87935df9269f77b0209011336@wdflzs.com>

From: National Bank Direct Brokerage-Support

Subject: Important Notice: Re-Verification Required for Your W-8BEN

Date: Thu, 24 Sep 2026 11:56:54 +0000 (UTC)

X-Priority: 3

X-Mailer: TKFMEMAHFR ZXZIC OKODSCUVZCLBLP 505.63443

Mime-Version: 1.0

X-SG-EID:

=?us-ascii?Q?u001=2EqSrTYuf+buIuYTIRkkJ60PaCuK8FLEKUxWjcziMBe2+9omSbt9vAfq2yq?=

=?us-ascii?Q?HqJDvTbpeckBitqMh=2FnqUgVEXi35xngIpZuzeSC?=

=?us-ascii?Q?2jvrhagx6JY+YgHsQl2daddo9vcN3fZQvPsMf9N?=

=?us-ascii?Q?2ZfN5d3A7YWEIRaW0rj1+0uLgtUGXPSiS7By3VY?=

=?us-ascii?Q?OQEji6F4HfACgmJydJJqj+vGlGBTQWlFK3kyWY2?=

=?us-ascii?Q?VNgJU9+exyAGE53aqlqqAVFdPRDkBhPh9Tr8DKP?=

=?us-ascii?Q?ilI62cesrnmrG1SjZHfCD69cEQ=3D=3D?=

To: root

X-Entity-ID: u001.XU+CNgPtRZeO34RyMvwVrA==

Content-Type: multipart/alternative; boundary="6012376cf50949639ffe31be000ab7b1"

X-Spam_score: 47.9

X-Spam_score_int: 479

X-Spam_bar: +++++++++++++++++++++++++++++++++++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Important Notice: Re-Verification Required for Your W-8BEN

MESSAGE CONFIRMATION Important Notice: Re-Verification Required for Your

W-8BENDear Client,As part of our periodic review of account tax reco [...]





Content analysis details: (47.9 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[159.183.235.50 listed in will-spam-for-food.eu.org]

[159.183.235.50 listed in will-spam-for-food.eu.org]

[159.183.235.50 listed in will-spam-for-food.eu.org]

[159.183.235.50 listed in will-spam-for-food.eu.org]

[159.183.235.50 listed in will-spam-for-food.eu.org]

[159.183.235.50 listed in will-spam-for-food.eu.org]

[159.183.235.50 listed in will-spam-for-food.eu.org]

[159.183.235.50 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[159.183.235.50 listed in dnsbl.ahbl.org]

[159.183.235.50 listed in dnsbl.ahbl.org]

[159.183.235.50 listed in dnsbl.ahbl.org]

[159.183.235.50 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[159.183.235.50 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[159.183.235.50 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[159.183.235.50 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[159.183.235.50 listed in dnsbl.ahbl.org]

2.5 URIBL_DBL_SPAM Contains a spam URL listed in the DBL blocklist

[URI: wdflzs.com]

1.1 URIBL_GREY Contains an URL listed in the URIBL greylist

[URI: sendgrid.net]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

1.8 URIBL_CT_SURBL Contains an URL listed in the CT SURBL blocklist

[URI: u115131034.ct.sendgrid.net]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[159.183.235.50 listed in bl.score.senderscore.com]

1.6 RCVD_IN_MSPIKE_L3 RBL: Low reputation (-3)

[159.183.235.50 listed in bl.mailspike.net]

-0.0 SPF_PASS SPF: sender matches SPF record

0.0 RCVD_IN_MSPIKE_BL Mailspike blacklisted

15 GR_DOMAIN_SENDGR1 Received contains spammer id (sendgr)

0.6 J_CHICKENPOX_63 BODY: 6alpha-pock-3alpha

0.6 J_CHICKENPOX_62 BODY: 6alpha-pock-2alpha

2.0 TVD_PH_REC BODY: Message includes a phrase commonly used in phishing

mails

0.6 J_CHICKENPOX_37 BODY: 3alpha-pock-7alpha

15 GR_DOMAIN_SENDGR6 URI: Body contains known spammer URI (sendgr)

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

1.5 VOWEL_FROM_6 Impronouncable from header (6 consecutive vowels)

0.8 SARE_FROM_SPAM_WORD3 I don't know people named this!

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

1.5 TVD_PH_BODY_ACCOUNTS_PRE The body matches phrases such as "accounts

suspended", "account credited", "account

verification"

2.0 MIXED_HREF_CASE Has href in mixed case

Subject: {SPAM?} Important Notice: Re-Verification Required for Your W-8BEN

X-Antivirus: AVG (VPS 260923-18, 9/23/2026), Inbound message

X-Antivirus-Status: Clean



This is a multi-part message in MIME format.



--6012376cf50949639ffe31be000ab7b1

Content-Type: text/plain; charset=iso-8859-1

Content-Transfer-Encoding: quoted-printable



Important Notice: Re-Verification Required for Your W-8BEN MESSAGE CONFIRM=

ATION Important Notice: Re-Verification Required for Your W-8BENDear Client=

,As part of our periodic review of account tax records, we have identified =

that your current W-8BEN documentation is no longer valid.A renewed W-8BEN =

form and a new identity confirmation are required to keep your tax status u=

p to date and ensure that your account records remain properly documented.P=

lease complete the necessary verification and update steps: Verify and Rene=

w Tax Information.After submission, your updated tax information will be as=

sessed and your account documentation will be adjusted accordingly.Until a =

valid W-8BEN form has been accepted, certain U.S.-source payments may be su=

bject to different withholding treatment under the applicable tax rules.For=

further support, please use the official Customer Support contact options.=

Stay connectedTerms of use|Privacy policy|ABC's of security=A9 National Ba=

nk of Canada. All rights reserved. Any reproduction, in whole or in part, i=

s strictly prohibited without the prior written consent of National Bank of=

Canada. National Bank of Canada, 800 St-Jacques Street, Montreal (Quebec)H=

3C 1A3nbc.caFor options to unsubscribe, click here. CONFIDENTIALIT=C9 : Ce =

document est destin=E9 uniquement =E0 la personne ou =E0 l'entit=E9 =E0 qui=

il est adress=E9. L'information apparaissant dans ce document est de natur=

e l=E9galement privil=E9gi=E9e et confidentielle. Si vous n'=EAtes pas le d=

estinataire vis=E9 ou la personne charg=E9e de le remettre =E0 son destinat=

aire, vous =EAtes, par la pr=E9sente, avis=E9 que toute lecture, usage, cop=

ie ou communication du contenu de ce document est strictement interdit. De =

plus, vous =EAtes pri=E9 de communiquer avec l'exp=E9diteur sans d=E9lai et=

de d=E9truire ce document imm=E9diatement. CONFIDENTIALITY: This document =

is intended solely for the individual or entity to whom it is addressed. Th=

e information contained in this document is legally privileged and confiden=

tial. If you are not the intended recipient or the person responsible for d=

elivering it to the intended recipient, you are hereby advised that you are=

strictly prohibited from reading, using, copying or disseminating the cont=

ents of this document. Please inform the sender immediately and delete this=

document immediately.=20=



--6012376cf50949639ffe31be000ab7b1

Content-Type: text/html; charset=iso-8859-1

Content-Transfer-Encoding: quoted-printable





Important Notice: Re-Verification Required for Your W-8B=<br /><br /> EN








0>






style=3D"FONT-SIZE: 11px; FONT-FAMILY: Arial,sans-serif,'Open Sans'; CO=

LOR: #666666; PADDING-BOTTOM: 45px; LINE-HEIGHT: 12px"=20

vAlign=3Dtop width=3D600 align=3Dleft>
style=3D"TEXT-DECORATION: underline; COLOR: #666666"=20

href=3D"https://u115131034.ct.sendgrid.net/ls/click?upn=3Du001.zhzWoG=

a88j4ocYXOiE8DhQk6uoMS5e-2F06CWy-2FIi1EqvYUFhWzQ4xEmshOWgXIaE1KRF7_YmNPztx4=

miJCrnDYqcF7ja4U1v4TCwhJ7TI1afjKJmPDzob3wFngBFOudMSnjYS-2B38eHKwaShOAWv0u3D=

T1vVieET6IqV3KUgQpHaP58YIs3Hn1HdFR-2FTY0-2FiUxlfXVTWwn9zuTPQ1IAls9zi64ls0Wj=

mQ2kBp7rSyUb9syfrs8xfnhafWQ5FjX2-2BB5I3fmuSn-2FpCeP9RhWPGNm5g3K7VQ-3D-3D" t=

arget=3D_blank>
style=3D"DISPLAY: block" border=3D0 alt=3D"Button to the BNC website"=

=20

src=3D"https://www.bnc.ca/content/dam/bnc/formulaires/picto/NB_2D_RGB=

.jpg"=20

width=3D217>



der=3D0>




DY>


E>


der=3D0>






align=3Dcenter>
gn=3Dcenter=20

border=3D0>






style=3D"FONT-SIZE: 14px; FONT-FAMILY: Arial,sans-serif,'Open San=

s'; COLOR: #333333; LINE-HEIGHT: 19px"=20

vAlign=3Dtop width=3D600 align=3Dleft>


0>








align=3Dleft>3D""=20<br
src=3D"https://www.bnc.ca/content/dam/bnc/formulaires/mod=

ele-courriel/icon-confirm-84x44.gif"=20

width=3D42 height=3D22>


style=3D"FONT-SIZE: 14px; FONT-FAMILY: Arial,sans-serif; =

FONT-WEIGHT: bold; COLOR: #ffffff; PADDING-BOTTOM: 0px; PADDING-TOP: 0px; P=

ADDING-LEFT: 0px; MARGIN: 0px; LINE-HEIGHT: 19px; PADDING-RIGHT: 0px">MESSA=

GE=20

CONFIRMATION=20


Y>


der=3D0>








der=3D0>






style=3D"FONT-SIZE: 14px; FONT-FAMILY: Arial,sans-serif,'Open San=

s'; COLOR: #333333; LINE-HEIGHT: 19px"=20

vAlign=3Dtop align=3Dleft>


style=3D"FONT-SIZE: 20px; FONT-FAMILY: Arial,sans-serif; FONT-W=

EIGHT: normal; COLOR: #00334d; PADDING-BOTTOM: 0px; PADDING-TOP: 0px; PADDI=

NG-LEFT: 0px; MARGIN: 0px; LINE-HEIGHT: 24px; PADDING-RIGHT: 0px">Important=

=20

Notice: Re-Verification Required for Your W-8BEN


style=3D"FONT-SIZE: 10px; HEIGHT: 10px; LINE-HEIGHT: 10px">
V>Dear=20

Client,

As part of our periodic review of account tax=20

records, we have identified that your current W-8BEN documentat=

ion=20

is no longer valid.

A renewed W-8BEN form and a new iden=

tity=20

confirmation are required to keep your tax status up to date an=

d=20

ensure that your account records remain properly=20

documented.

Please complete the necessary verification a=

nd=20

update steps:
click?upn=3Du001.zhzWoGa88j4ocYXOiE8DhQk6uoMS5e-2F06CWy-2FIi1EqvYUFhWzQ4xEm=

shOWgXIaE1bY_L_YmNPztx4miJCrnDYqcF7ja4U1v4TCwhJ7TI1afjKJmPDzob3wFngBFOudMSn=

jYS-2Ba8Ai1dD03GYCkZUHI6bajNqGrwkAAHqFZPjncz4aq5DzF1okgtYij9-2Fq8INyKp5bv8l=

wLatGUDZ3R-2Feg5LbzS43i2sWzm289y7Cjaak6aQ65Ng2PHA4Oh-2BucKYc-2BlqUPo3lLU5-2=

FX44SOFH5wtO6lGw-3D-3D">Verify and=20

Renew Tax Information.

After submission, your update=

d tax=20

information will be assessed and your account documentation wil=

l be=20

adjusted accordingly.

Until a valid W-8BEN form has been=

=20

accepted, certain U.S.-source payments may be subject to differ=

ent=20

withholding treatment under the applicable tax rules.

Fo=

r=20

further support, please use the official Customer Support conta=

ct=20

options.



der=3D0>






align=3Dcenter>
der=3D0>




der=3D0>






style=3D"BORDER-TOP: #a6a6a6 1px solid; BORDER-BOTTOM: #a6a6a6 1px soli=

d; PADDING-BOTTOM: 12px; PADDING-TOP: 12px"=20

vAlign=3Dtop align=3Dcenter>








R>






er=20

border=3D0>




>
style=3D"WIDTH: 630px; MIN-WIDTH: 630px; MIN-HEIGHT: 1px;=

DISPLAY: block; MAX-HEIGHT: 1px"=20

alt=3D""=20

src=3D"https://www.bnc.ca/content/dam/bnc/formulaires/mod=

ele-courriel/spacer-social-media-1x1.gif"=20

width=3D630 height=3D1>



er=20

border=3D0>








ABLE>



=3Dcenter=20

border=3D0>






height=3D1>
style=3D"WIDTH: 600px; MIN-WIDTH: 600px; MIN-HEIGHT=

: 1px; DISPLAY: block; MAX-HEIGHT: 1px"=20

alt=3D""=20

src=3D"https://www.bnc.ca/content/dam/bnc/formulair=

es/modele-courriel/spacer-social-media-1x1.gif"=20

width=3D600 height=3D1>

TD>



er=3D0>






style=3D"FONT-SIZE: 11px; FONT-FAMILY: Arial,sans-ser=

if,'Open Sans'; COLOR: #000000; LINE-HEIGHT: 15px; PADDING-RIGHT: 4px"=20

vAlign=3Dmiddle align=3Dright>Stay connected


style=3D"FONT-SIZE: 11px; FONT-FAMILY: Arial,sans-ser=

if,'Open Sans'; COLOR: #000000; PADDING-LEFT: 6px; LINE-HEIGHT: 15px"=20

vAlign=3Dmiddle width=3D25 align=3Dleft>
href=3D"https://u115131034.ct.sendgrid.net/ls/click=

?upn=3Du001.zhzWoGa88j4ocYXOiE8DhRfDuY9cmcwhsNL48XF2Hg3YSNhgyV9wxTFMQzfDPlb=

z2pBtdwz3xiEhBtePYguOag-3D-3DiCSu_YmNPztx4miJCrnDYqcF7ja4U1v4TCwhJ7TI1afjKJ=

mPDzob3wFngBFOudMSnjYS-2B533tKVoCX8dTN368tpkjt0THpVCLIN4HvlkmS2BZ6xleU8FyLX=

izkr4XsH0LOrukMmdbhtOvlNPvyHL1WfbdXVY3bY5j7oC2CsofTFhYxnS4Omqo9p2p7iywhtP03=

RRxHc0BMGEibpK5R7iqBf10EQ-3D-3D"=20

target=3D_blank>3D""=20<br
src=3D"https://www.bnc.ca/content/dam/bnc/formulair=

es/modele-courriel/icon-facebook-25x25.gif"=20

width=3D25 height=3D25>


style=3D"FONT-SIZE: 11px; FONT-FAMILY: Arial,sans-ser=

if,'Open Sans'; COLOR: #000000; PADDING-LEFT: 6px; LINE-HEIGHT: 15px"=20

vAlign=3Dmiddle width=3D25 align=3Dleft>
href=3D"https://u115131034.ct.sendgrid.net/ls/click=

?upn=3Du001.zhzWoGa88j4ocYXOiE8DhaVOZ6blLaaQDXHZgZhnUmUMRlZqFPvD3GEZ70mIwBx=

FsrOx_YmNPztx4miJCrnDYqcF7ja4U1v4TCwhJ7TI1afjKJmPDzob3wFngBFOudMSnjYS-2B04f=

sIbdSgyMoA6ZQlGkrJc7Lu3ohMemUp60BP5zNv7-2FSra-2BCGcIgcLCJqk6RK3ISNXXiVQI52j=

lSTTFU2gocFdpCewMYa5xUTMKaHFxoqET2qDlO3pltlJFaL2Gq8rbhlfG6KW4KnG2M-2BV3YhDO=

7-2Bw-3D-3D"=20

target=3D_blank>3D""=20<br
src=3D"https://www.bnc.ca/content/dam/bnc/formulair=

es/modele-courriel/icon-twitter-25x25.gif"=20

width=3D25 height=3D25>


style=3D"FONT-SIZE: 11px; FONT-FAMILY: Arial,sans-ser=

if,'Open Sans'; COLOR: #000000; PADDING-LEFT: 6px; LINE-HEIGHT: 15px"=20

vAlign=3Dmiddle width=3D25 align=3Dleft>
href=3D"https://u115131034.ct.sendgrid.net/ls/click=

?upn=3Du001.zhzWoGa88j4ocYXOiE8DhcC36-2FpLgN0oF6LOItK-2F70cPCzx32wTfRvez-2B=

Bg7d4mLa-2BPm0BFp5UAdTDh79OG-2FYw-3D-3DAo7N_YmNPztx4miJCrnDYqcF7ja4U1v4TCwh=

J7TI1afjKJmPDzob3wFngBFOudMSnjYS-2BDAR-2BrtQm9WEpYUJ-2BPs2qm91AC5c4MvAyp7Z0=

Kp4nD-2Bar26ZBxy-2F6Obp0e2cQ9olxIGi40r9FTSyYccrAoFYaHNmgpRNUvFKY4-2FZVyCZ2b=

-2F4kWa25BD5vDmYVxRDF2VG3mzHVg6NeGrv1ZyRrm8U5jw-3D-3D"=20

target=3D_blank>3D""=20<br
src=3D"https://www.bnc.ca/content/dam/bnc/formulair=

es/modele-courriel/icon-youtube-25x25.gif"=20

width=3D25 height=3D25>


style=3D"FONT-SIZE: 11px; FONT-FAMILY: Arial,sans-ser=

if,'Open Sans'; COLOR: #000000; PADDING-LEFT: 6px; LINE-HEIGHT: 15px"=20

vAlign=3Dmiddle width=3D25 align=3Dleft>
href=3D"https://u115131034.ct.sendgrid.net/ls/click=

?upn=3Du001.zhzWoGa88j4ocYXOiE8DhVfuIbE461jRAKQQjkDRrEvNQei6yBq9YsUp3R4s1wP=

nXic6oR6-2B-2BciwUtomHyMtDHD4z4d1yVq4f7f9V2n50xU-3DIbvL_YmNPztx4miJCrnDYqcF=

7ja4U1v4TCwhJ7TI1afjKJmPDzob3wFngBFOudMSnjYS-2BhbH25NzS-2BmEN2b94g9U-2BsbJ-=

2B7oWaoRp54t6JHzUBQ3UFzGWpq8UAXeCuDF-2Bb37FNhzPSTRjQhVcFqUKJ1rfyuQhdTT-2BTg=

hdBv369rxHYo4UbWQ7PKYic3lxRfdvCyB216gOdHX-2BxLfgo9UKt9TYjjQ-3D-3D"=20

target=3D_blank>3D""=20<br
src=3D"https://www.bnc.ca/content/dam/bnc/formulair=

es/modele-courriel/icon-linkedin-25x25.gif"=20

width=3D25=20

height=3D25>



der=3D0>








der=3D0>






style=3D"FONT-SIZE: 11px; FONT-FAMILY: Arial,sans-serif,'Open San=

s'; COLOR: #686868; PADDING-BOTTOM: 30px; PADDING-TOP: 30px; LINE-HEIGHT: 1=

5px"=20

vAlign=3Dtop align=3Dleft>








style=3D"FONT-SIZE: 11px; FONT-FAMILY: Arial,sans-serif,'Op=

en Sans'; COLOR: #686868; PADDING-BOTTOM: 15px; LINE-HEIGHT: 15px"=20

vAlign=3Dmiddle align=3Dleft>
style=3D"TEXT-DECORATION: underline; COLOR: #686868"=20

href=3D"https://u115131034.ct.sendgrid.net/ls/click?upn=

=3Du001.zhzWoGa88j4ocYXOiE8Dhf5EDwT6M-2F50tGrz9huXc6TRGsqbP-2F-2FrVW7LLCeJP=

Re8ZUEBrPX0d6TD7C8dV627z3sA3z2f45yd1eotvK772n0lQQvyghdObFUUvYjRQl7M2UdxApZc=

ku4giD0GZ7LRJgG7vW75wUvQLbgc5gzmxmW-2FACp4ZjwTtUBfVY5mnDtme6mQFPGVUJIN9PQiS=

rQZntNgqycVTKxoEAaLWHA-2Fwwg-3D7B_0_YmNPztx4miJCrnDYqcF7ja4U1v4TCwhJ7TI1afj=

KJmPDzob3wFngBFOudMSnjYS-2BDbRbjoZqZqhYbOXYq2EmEjpPtjPKUYG87pFA0FXxUFcKXOxW=

DIqW3r6GkdwWxkt96G4vlPhA6-2BvC2QtvFKARCz1UmRM6D5kQ0BaQQdVDTYJ6EDus7GxrvWkw7=

WMkseZ6GKabpRekyeSF24IbS2Z30Q-3D-3D"=20

target=3D_blank>Terms of=20

use


style=3D"FONT-SIZE: 11px; FONT-FAMILY: Arial,sans-serif,'Op=

en Sans'; COLOR: #686868; PADDING-BOTTOM: 15px; LINE-HEIGHT: 15px"=20

vAlign=3Dmiddle width=3D20 align=3Dcenter>|


style=3D"FONT-SIZE: 11px; FONT-FAMILY: Arial,sans-serif,'Op=

en Sans'; COLOR: #686868; PADDING-BOTTOM: 15px; LINE-HEIGHT: 15px"=20

vAlign=3Dmiddle align=3Dleft>
style=3D"TEXT-DECORATION: underline; COLOR: #686868"=20

href=3D"https://u115131034.ct.sendgrid.net/ls/click?upn=

=3Du001.zhzWoGa88j4ocYXOiE8DhYcGtUFViwRiY1dpuawFnE0NcxiYgJCP895ZVVE3iCL-2B-=

2BhFcUVR17ZnAdk31QS2eTtL-2B-2FgkZQYT8ld5deZDyqLjtyYz-2Bxt4kdvM22zYHQkSzOj4b=

6yQw8x86IQQLOuXgYv6nDafFJvXGQPXpX0AyNBA4qx-2BKnqmGargdBSH1gd-2FxUg7cvCoc3fs=

RZpnfrZ94COSAWravXWw1fKON4mbWjIY-3DoWB3_YmNPztx4miJCrnDYqcF7ja4U1v4TCwhJ7TI=

1afjKJmPDzob3wFngBFOudMSnjYS-2BJllXOdLJGzciel7HOckBQ8MY21xAP1XxHvKWuUW9qCRX=

stLylY-2B2Mlt-2F8611eCEV6EunxeI8KCZqqMMg-2FmWu-2F8I-2B6olqfjbd6IkRGCkHQMY7u=

oMan1txr20U8Ns6biPa5ThU9Qjy5jDKLKgZjZy-2BkA-3D-3D"=20

target=3D_blank>Privacy=20

policy


style=3D"FONT-SIZE: 11px; FONT-FAMILY: Arial,sans-serif,'Op=

en Sans'; COLOR: #686868; PADDING-BOTTOM: 15px; LINE-HEIGHT: 15px"=20

vAlign=3Dmiddle width=3D20 align=3Dcenter>|


style=3D"FONT-SIZE: 11px; FONT-FAMILY: Arial,sans-serif,'Op=

en Sans'; COLOR: #686868; PADDING-BOTTOM: 15px; LINE-HEIGHT: 15px"=20

vAlign=3Dmiddle align=3Dleft>
style=3D"TEXT-DECORATION: underline; COLOR: #686868"=20

href=3D"https://u115131034.ct.sendgrid.net/ls/click?upn=

=3Du001.zhzWoGa88j4ocYXOiE8DhWr9l2f9nzpsLt2gut2XDibdTYkOHec5zmMpIi8I8W4rGAM=

6j3xFIlsX83cuESwqMv9Ilcn0rZmmdTzIJGJOK1QWrG1mE1ba58JiOKiGqlD6jHEU4llfQRGh1g=

ZY-2B1RgO14mNMQPk42KFUWLaReoMZPPi0JY07og-2BdOCxTDGM7-2FJj6EFWULa0aTkfhH-2Fi=

OEuHc7CobKv1dTUJq6BRovJnVE-3DVcHt_YmNPztx4miJCrnDYqcF7ja4U1v4TCwhJ7TI1afjKJ=

mPDzob3wFngBFOudMSnjYS-2B39SXmh9X9EvA0RioJb-2FgkX3gH1KmM-2FQS5DiJZyR5rkrA6Q=

EVI-2BhLhjdFCOSTpWaUwma4Kxfs-2B-2FyRl-2FuUqmuPXdavrvkzZXzM-2BvTplLIqP2225-2=

B-2FxkA1cw0mthKUc-2BeY3Toil8Sia-2FVUHB-2Bz2h-2FPswg-3D-3D"=20

target=3D_blank>ABC's of=20

security



style=3D"FONT-SIZE: 15px; HEIGHT: 15px; LINE-HEIGHT: 15px">
V>
style=3D"FONT-SIZE: 8px; VERTICAL-ALIGN: 5px; LINE-HEIGHT: 0">=

=A9=20

National Ba=

nk of=20

Canada. All rights reserved. Any reproduction, in whole or in p=

art,=20

is strictly prohibited without the prior written consent of
AN=20

style=3D"WHITE-SPACE: nowrap">National Bank of Cana=

da.=20



National Bank of Canada, 800 St-Jacques Street,=20

Montreal (Quebec)  
style=3D"WHITE-SPACE: nowrap">H3C 1A3

>
style=3D"TEXT-DECORATION: underline; COLOR: #686868"=20

href=3D"https://u115131034.ct.sendgrid.net/ls/click?upn=3Du001.=

zhzWoGa88j4ocYXOiE8DhdroUpU9fwVzeUc1FnKJ0NqI1k17PyUiEiDwd8erxO0xmdsPQTCycKh=

7isPdv3KjPNwWX-2FEjGFEBZ7ahwAD2rm64U4AS1njqPCNhNNz-2BmPjmLTkrszJEYG-2FMDyyS=

1-2FdOC8YEXPlOXH-2F-2FH2eH4YR8-2BQfJY6f2Ms-2FG1Wnn46O9PCGdDZdu0AoBcs6Ib3FHT=

x7SWA-3D-3DHfUs_YmNPztx4miJCrnDYqcF7ja4U1v4TCwhJ7TI1afjKJmPDzob3wFngBFOudMS=

njYS-2B2xA4VhwB1Xr8zWNAOFhpqNXV2CEjnZO8O1AeMebQyicLmdyoU3Ma3hpL4Vo9aYyY2iPA=

fEEFbY462fk0UaLWX-2FeLXk-2FPuxaeNo8xUq-2F5I0t17-2B-2BgTH6l4Q0gT-2BA-2BF-2Fa=

60kN38vdg367BF8eNn3Jrqw-3D-3D"=20

target=3D_blank>
style=3D"COLOR: #686868">nbc.ca

For options t=

o=20

unsubscribe,
6868"=20

href=3D"https://u115131034.ct.sendgrid.net/ls/click?upn=3Du001.=

zhzWoGa88j4ocYXOiE8DhcvuOOBXeYL-2Fl9eoIU9yCOj4zEquoQWI6KUcOW-2BGFz1s1sDmn9k=

alv4RSGeddIM-2BNPFhzcRW-2BIc4EjqsUaPQ4sc-3DnuUo_YmNPztx4miJCrnDYqcF7ja4U1v4=

TCwhJ7TI1afjKJmPDzob3wFngBFOudMSnjYS-2BfNY1pU01iEUYb0Z8ANhQLdjKpg7Qy1FXh9Wy=

1EcshTe2u6bI7kmYJmwZ3-2BzcUATQ0JAiwDTZUx16x4471e4E3rRF8rPNmUCAICbDW9iLDszC7=

RMKm9isWUR4btkoAyXTDDzCN9fuhAIVr7Iidxn5tw-3D-3D"=20

target=3D_blank>click here
>.=20


DY>


style=3D"FONT-SIZE: 8pt; FONT-FAMILY: 'Cambria','times roman',serif; LINE-H=

EIGHT: 10pt">
CONFIDENTIALIT=C9=20

: Ce document est destin=E9 uniquement =E0 la personne ou =E0 l'entit=E9 =

=E0 qui il est=20

adress=E9. L'information apparaissant dans ce document est de nature l=E9ga=

lement=20

privil=E9gi=E9e et confidentielle. Si vous n'=EAtes pas le destinataire vis=

=E9 ou la=20

personne charg=E9e de le remettre =E0 son destinataire, vous =EAtes, par la=

pr=E9sente,=20

avis=E9 que toute lecture, usage, copie ou communication du contenu de ce d=

ocument=20

est strictement interdit. De plus, vous =EAtes pri=E9 de communiquer avec=20

l'exp=E9diteur sans d=E9lai et de d=E9truire ce document imm=E9diatement.=20


CONFIDENTIALITY: This document is intended solely for the individual or=

=20

entity to whom it is addressed. The information contained in this document =

is=20

legally privileged and confidential. If you are not the intended recipient =

or=20

the person responsible for delivering it to the intended recipient, you are=

=20

hereby advised that you are strictly prohibited from reading, using, copyin=

g or=20

disseminating the contents of this document. Please inform the sender=20

immediately and delete this document immediately.









1.EtyC8XKcPmGZYDmBykh8zfTgjcZtM-2FIhosKu0LKInDHsOH6nUFnJTcVmBGEtp2jYFDluWwt=

vmZj3PAQg5DAOfskcsePzajyQAnsKNjIwPf-2BLcHu838lXSvB822c2wedndFXBc2LThPACDoy0=

8hOki0GDYCXQ3HrO6UFZyglMLuaxJaTGtfr22IYKg-2FUumBi57iIu4sD32a0-2FrWhxKc0Qlg-=

3D-3D" alt=3D"" width=3D"1" height=3D"1" border=3D"0" style=3D"height:1px !=

important;width:1px !important;border-width:0 !important;margin-top:0 !impo=

rtant;margin-bottom:0 !important;margin-right:0 !important;margin-left:0 !i=

mportant;padding-top:0 !important;padding-bottom:0 !important;padding-right=

:0 !important;padding-left:0 !important;"/>



--6012376cf50949639ffe31be000ab7b1--



NAtional bank phish from sendgrid

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 24 Sep 2026 06:07:26 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.100.1 (FreeBSD))

(envelope-from )

id 1x9iEE-000000005po-3ehO

for dave@doctor.nl2k.ab.ca;

Thu, 24 Sep 2026 06:07:06 -0600

Resent-From: The Doctor

Resent-Date: Thu, 24 Sep 2026 06:07:06 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from s.wfbtzbpn.outbound-mail.sendgrid.net ([159.183.235.50]:30080)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.100.1 (FreeBSD))

(envelope-from )

id 1x9i5E-0000000011l-2z0w

for root@nk.ca;

Thu, 24 Sep 2026 05:57:57 -0600

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=wdflzs.com;

h=from:subject:date:mime-version:to:content-type:cc:content-type:date:

from:subject:to;

s=s1; t=1790251014;

bh=Vrix5lzkRg5ep8Lpweq/4Cs/QlF5ze6pBUSNIiFj6co=;

b=a0zeulCsUc4yQR+H4wDs24cBVaAfbX8rwSLnzx3s4O7039Fc8/VCNfelV3e7WzFfisCy

vOk8CkEd5vJi1uhQ06673MtKmXPqa0qhDvV/cKx5DheeoRj2nUhEvBS0T9euTHXgxPq20L

vmCWu7FKoMnI4hHjtVf4HJSYGrf3TprrS/fidFmwnOGMlpfFb9ildSjjR8FeNSFtjHfh9R

/rq6tdG2vSWcvXEjo3vIYKDiW3hLn6xBD715sEIFUf93CrJ4HYqyOkFqV2qrlF73vqk7Jn

kF6qs8JrMLRBrqHxrDjKKH9P2boYwDCjJxs/jHsuI374DNavLsKX0Nc+TXF6xvzg==

Received: by recvd-canary-568d85449f-z8xlg with SMTP id recvd-canary-568d85449f-z8xlg-1-6AB51006-67

2026-09-24 11:56:54.542044716 +0000 UTC m=+53016.534695209

Received: from keasav.com (unknown)

by geopod-ismtpd-canary-0 (SG)

with ESMTP id URhc9U-SRRW6nHJp6HWhcQ

for ;

Thu, 24 Sep 2026 11:56:54.451 +0000 (UTC)

Message-Id: <31d799b87935df9269f77b0209011336@wdflzs.com>

From: National Bank Direct Brokerage-Support

Subject: Important Notice: Re-Verification Required for Your W-8BEN

Date: Thu, 24 Sep 2026 11:56:54 +0000 (UTC)

X-Priority: 3

X-Mailer: TKFMEMAHFR ZXZIC OKODSCUVZCLBLP 505.63443

Mime-Version: 1.0

X-SG-EID:

=?us-ascii?Q?u001=2EqSrTYuf+buIuYTIRkkJ60PaCuK8FLEKUxWjcziMBe2+9omSbt9vAfq2yq?=

=?us-ascii?Q?HqJDvTbpeckBitqMh=2FnqUgVEXi35xngIpZuzeSC?=

=?us-ascii?Q?2jvrhagx6JY+YgHsQl2daddo9vcN3fZQvPsMf9N?=

=?us-ascii?Q?2ZfN5d3A7YWEIRaW0rj1+0uLgtUGXPSiS7By3VY?=

=?us-ascii?Q?OQEji6F4HfACgmJydJJqj+vGlGBTQWlFK3kyWY2?=

=?us-ascii?Q?VNgJU9+exyAGE53aqlqqAVFdPRDkBhPh9Tr8DKP?=

=?us-ascii?Q?ilI62cesrnmrG1SjZHfCD69cEQ=3D=3D?=

To: root

X-Entity-ID: u001.XU+CNgPtRZeO34RyMvwVrA==

Content-Type: multipart/alternative; boundary="6012376cf50949639ffe31be000ab7b1"

X-Spam_score: 47.9

X-Spam_score_int: 479

X-Spam_bar: +++++++++++++++++++++++++++++++++++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Important Notice: Re-Verification Required for Your W-8BEN

MESSAGE CONFIRMATION Important Notice: Re-Verification Required for Your

W-8BENDear Client,As part of our periodic review of account tax reco [...]





Content analysis details: (47.9 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[159.183.235.50 listed in will-spam-for-food.eu.org]

[159.183.235.50 listed in will-spam-for-food.eu.org]

[159.183.235.50 listed in will-spam-for-food.eu.org]

[159.183.235.50 listed in will-spam-for-food.eu.org]

[159.183.235.50 listed in will-spam-for-food.eu.org]

[159.183.235.50 listed in will-spam-for-food.eu.org]

[159.183.235.50 listed in will-spam-for-food.eu.org]

[159.183.235.50 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[159.183.235.50 listed in dnsbl.ahbl.org]

[159.183.235.50 listed in dnsbl.ahbl.org]

[159.183.235.50 listed in dnsbl.ahbl.org]

[159.183.235.50 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[159.183.235.50 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[159.183.235.50 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[159.183.235.50 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[159.183.235.50 listed in dnsbl.ahbl.org]

2.5 URIBL_DBL_SPAM Contains a spam URL listed in the DBL blocklist

[URI: wdflzs.com]

1.1 URIBL_GREY Contains an URL listed in the URIBL greylist

[URI: sendgrid.net]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

1.8 URIBL_CT_SURBL Contains an URL listed in the CT SURBL blocklist

[URI: u115131034.ct.sendgrid.net]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[159.183.235.50 listed in bl.score.senderscore.com]

1.6 RCVD_IN_MSPIKE_L3 RBL: Low reputation (-3)

[159.183.235.50 listed in bl.mailspike.net]

-0.0 SPF_PASS SPF: sender matches SPF record

0.0 RCVD_IN_MSPIKE_BL Mailspike blacklisted

15 GR_DOMAIN_SENDGR1 Received contains spammer id (sendgr)

0.6 J_CHICKENPOX_63 BODY: 6alpha-pock-3alpha

0.6 J_CHICKENPOX_62 BODY: 6alpha-pock-2alpha

2.0 TVD_PH_REC BODY: Message includes a phrase commonly used in phishing

mails

0.6 J_CHICKENPOX_37 BODY: 3alpha-pock-7alpha

15 GR_DOMAIN_SENDGR6 URI: Body contains known spammer URI (sendgr)

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

1.5 VOWEL_FROM_6 Impronouncable from header (6 consecutive vowels)

0.8 SARE_FROM_SPAM_WORD3 I don't know people named this!

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

1.5 TVD_PH_BODY_ACCOUNTS_PRE The body matches phrases such as "accounts

suspended", "account credited", "account

verification"

2.0 MIXED_HREF_CASE Has href in mixed case

Subject: {SPAM?} Important Notice: Re-Verification Required for Your W-8BEN

X-Antivirus: AVG (VPS 260923-18, 9/23/2026), Inbound message

X-Antivirus-Status: Clean



This is a multi-part message in MIME format.



--6012376cf50949639ffe31be000ab7b1

Content-Type: text/plain; charset=iso-8859-1

Content-Transfer-Encoding: quoted-printable



Important Notice: Re-Verification Required for Your W-8BEN MESSAGE CONFIRM=

ATION Important Notice: Re-Verification Required for Your W-8BENDear Client=

,As part of our periodic review of account tax records, we have identified =

that your current W-8BEN documentation is no longer valid.A renewed W-8BEN =

form and a new identity confirmation are required to keep your tax status u=

p to date and ensure that your account records remain properly documented.P=

lease complete the necessary verification and update steps: Verify and Rene=

w Tax Information.After submission, your updated tax information will be as=

sessed and your account documentation will be adjusted accordingly.Until a =

valid W-8BEN form has been accepted, certain U.S.-source payments may be su=

bject to different withholding treatment under the applicable tax rules.For=

further support, please use the official Customer Support contact options.=

Stay connectedTerms of use|Privacy policy|ABC's of security=A9 National Ba=

nk of Canada. All rights reserved. Any reproduction, in whole or in part, i=

s strictly prohibited without the prior written consent of National Bank of=

Canada. National Bank of Canada, 800 St-Jacques Street, Montreal (Quebec)H=

3C 1A3nbc.caFor options to unsubscribe, click here. CONFIDENTIALIT=C9 : Ce =

document est destin=E9 uniquement =E0 la personne ou =E0 l'entit=E9 =E0 qui=

il est adress=E9. L'information apparaissant dans ce document est de natur=

e l=E9galement privil=E9gi=E9e et confidentielle. Si vous n'=EAtes pas le d=

estinataire vis=E9 ou la personne charg=E9e de le remettre =E0 son destinat=

aire, vous =EAtes, par la pr=E9sente, avis=E9 que toute lecture, usage, cop=

ie ou communication du contenu de ce document est strictement interdit. De =

plus, vous =EAtes pri=E9 de communiquer avec l'exp=E9diteur sans d=E9lai et=

de d=E9truire ce document imm=E9diatement. CONFIDENTIALITY: This document =

is intended solely for the individual or entity to whom it is addressed. Th=

e information contained in this document is legally privileged and confiden=

tial. If you are not the intended recipient or the person responsible for d=

elivering it to the intended recipient, you are hereby advised that you are=

strictly prohibited from reading, using, copying or disseminating the cont=

ents of this document. Please inform the sender immediately and delete this=

document immediately.=20=



--6012376cf50949639ffe31be000ab7b1

Content-Type: text/html; charset=iso-8859-1

Content-Transfer-Encoding: quoted-printable





Important Notice: Re-Verification Required for Your W-8B=<br /><br /> EN








0>






style=3D"FONT-SIZE: 11px; FONT-FAMILY: Arial,sans-serif,'Open Sans'; CO=

LOR: #666666; PADDING-BOTTOM: 45px; LINE-HEIGHT: 12px"=20

vAlign=3Dtop width=3D600 align=3Dleft>
style=3D"TEXT-DECORATION: underline; COLOR: #666666"=20

href=3D"https://u115131034.ct.sendgrid.net/ls/click?upn=3Du001.zhzWoG=

a88j4ocYXOiE8DhQk6uoMS5e-2F06CWy-2FIi1EqvYUFhWzQ4xEmshOWgXIaE1KRF7_YmNPztx4=

miJCrnDYqcF7ja4U1v4TCwhJ7TI1afjKJmPDzob3wFngBFOudMSnjYS-2B38eHKwaShOAWv0u3D=

T1vVieET6IqV3KUgQpHaP58YIs3Hn1HdFR-2FTY0-2FiUxlfXVTWwn9zuTPQ1IAls9zi64ls0Wj=

mQ2kBp7rSyUb9syfrs8xfnhafWQ5FjX2-2BB5I3fmuSn-2FpCeP9RhWPGNm5g3K7VQ-3D-3D" t=

arget=3D_blank>
style=3D"DISPLAY: block" border=3D0 alt=3D"Button to the BNC website"=

=20

src=3D"https://www.bnc.ca/content/dam/bnc/formulaires/picto/NB_2D_RGB=

.jpg"=20

width=3D217>



der=3D0>




DY>


E>


der=3D0>






align=3Dcenter>
gn=3Dcenter=20

border=3D0>






style=3D"FONT-SIZE: 14px; FONT-FAMILY: Arial,sans-serif,'Open San=

s'; COLOR: #333333; LINE-HEIGHT: 19px"=20

vAlign=3Dtop width=3D600 align=3Dleft>


0>








align=3Dleft>3D""=20<br
src=3D"https://www.bnc.ca/content/dam/bnc/formulaires/mod=

ele-courriel/icon-confirm-84x44.gif"=20

width=3D42 height=3D22>


style=3D"FONT-SIZE: 14px; FONT-FAMILY: Arial,sans-serif; =

FONT-WEIGHT: bold; COLOR: #ffffff; PADDING-BOTTOM: 0px; PADDING-TOP: 0px; P=

ADDING-LEFT: 0px; MARGIN: 0px; LINE-HEIGHT: 19px; PADDING-RIGHT: 0px">MESSA=

GE=20

CONFIRMATION=20


Y>


der=3D0>








der=3D0>






style=3D"FONT-SIZE: 14px; FONT-FAMILY: Arial,sans-serif,'Open San=

s'; COLOR: #333333; LINE-HEIGHT: 19px"=20

vAlign=3Dtop align=3Dleft>


style=3D"FONT-SIZE: 20px; FONT-FAMILY: Arial,sans-serif; FONT-W=

EIGHT: normal; COLOR: #00334d; PADDING-BOTTOM: 0px; PADDING-TOP: 0px; PADDI=

NG-LEFT: 0px; MARGIN: 0px; LINE-HEIGHT: 24px; PADDING-RIGHT: 0px">Important=

=20

Notice: Re-Verification Required for Your W-8BEN


style=3D"FONT-SIZE: 10px; HEIGHT: 10px; LINE-HEIGHT: 10px">
V>Dear=20

Client,

As part of our periodic review of account tax=20

records, we have identified that your current W-8BEN documentat=

ion=20

is no longer valid.

A renewed W-8BEN form and a new iden=

tity=20

confirmation are required to keep your tax status up to date an=

d=20

ensure that your account records remain properly=20

documented.

Please complete the necessary verification a=

nd=20

update steps:
click?upn=3Du001.zhzWoGa88j4ocYXOiE8DhQk6uoMS5e-2F06CWy-2FIi1EqvYUFhWzQ4xEm=

shOWgXIaE1bY_L_YmNPztx4miJCrnDYqcF7ja4U1v4TCwhJ7TI1afjKJmPDzob3wFngBFOudMSn=

jYS-2Ba8Ai1dD03GYCkZUHI6bajNqGrwkAAHqFZPjncz4aq5DzF1okgtYij9-2Fq8INyKp5bv8l=

wLatGUDZ3R-2Feg5LbzS43i2sWzm289y7Cjaak6aQ65Ng2PHA4Oh-2BucKYc-2BlqUPo3lLU5-2=

FX44SOFH5wtO6lGw-3D-3D">Verify and=20

Renew Tax Information.

After submission, your update=

d tax=20

information will be assessed and your account documentation wil=

l be=20

adjusted accordingly.

Until a valid W-8BEN form has been=

=20

accepted, certain U.S.-source payments may be subject to differ=

ent=20

withholding treatment under the applicable tax rules.

Fo=

r=20

further support, please use the official Customer Support conta=

ct=20

options.



der=3D0>






align=3Dcenter>
der=3D0>




der=3D0>






style=3D"BORDER-TOP: #a6a6a6 1px solid; BORDER-BOTTOM: #a6a6a6 1px soli=

d; PADDING-BOTTOM: 12px; PADDING-TOP: 12px"=20

vAlign=3Dtop align=3Dcenter>








R>






er=20

border=3D0>




>
style=3D"WIDTH: 630px; MIN-WIDTH: 630px; MIN-HEIGHT: 1px;=

DISPLAY: block; MAX-HEIGHT: 1px"=20

alt=3D""=20

src=3D"https://www.bnc.ca/content/dam/bnc/formulaires/mod=

ele-courriel/spacer-social-media-1x1.gif"=20

width=3D630 height=3D1>



er=20

border=3D0>








ABLE>



=3Dcenter=20

border=3D0>






height=3D1>
style=3D"WIDTH: 600px; MIN-WIDTH: 600px; MIN-HEIGHT=

: 1px; DISPLAY: block; MAX-HEIGHT: 1px"=20

alt=3D""=20

src=3D"https://www.bnc.ca/content/dam/bnc/formulair=

es/modele-courriel/spacer-social-media-1x1.gif"=20

width=3D600 height=3D1>

TD>



er=3D0>






style=3D"FONT-SIZE: 11px; FONT-FAMILY: Arial,sans-ser=

if,'Open Sans'; COLOR: #000000; LINE-HEIGHT: 15px; PADDING-RIGHT: 4px"=20

vAlign=3Dmiddle align=3Dright>Stay connected


style=3D"FONT-SIZE: 11px; FONT-FAMILY: Arial,sans-ser=

if,'Open Sans'; COLOR: #000000; PADDING-LEFT: 6px; LINE-HEIGHT: 15px"=20

vAlign=3Dmiddle width=3D25 align=3Dleft>
href=3D"https://u115131034.ct.sendgrid.net/ls/click=

?upn=3Du001.zhzWoGa88j4ocYXOiE8DhRfDuY9cmcwhsNL48XF2Hg3YSNhgyV9wxTFMQzfDPlb=

z2pBtdwz3xiEhBtePYguOag-3D-3DiCSu_YmNPztx4miJCrnDYqcF7ja4U1v4TCwhJ7TI1afjKJ=

mPDzob3wFngBFOudMSnjYS-2B533tKVoCX8dTN368tpkjt0THpVCLIN4HvlkmS2BZ6xleU8FyLX=

izkr4XsH0LOrukMmdbhtOvlNPvyHL1WfbdXVY3bY5j7oC2CsofTFhYxnS4Omqo9p2p7iywhtP03=

RRxHc0BMGEibpK5R7iqBf10EQ-3D-3D"=20

target=3D_blank>3D""=20<br
src=3D"https://www.bnc.ca/content/dam/bnc/formulair=

es/modele-courriel/icon-facebook-25x25.gif"=20

width=3D25 height=3D25>


style=3D"FONT-SIZE: 11px; FONT-FAMILY: Arial,sans-ser=

if,'Open Sans'; COLOR: #000000; PADDING-LEFT: 6px; LINE-HEIGHT: 15px"=20

vAlign=3Dmiddle width=3D25 align=3Dleft>
href=3D"https://u115131034.ct.sendgrid.net/ls/click=

?upn=3Du001.zhzWoGa88j4ocYXOiE8DhaVOZ6blLaaQDXHZgZhnUmUMRlZqFPvD3GEZ70mIwBx=

FsrOx_YmNPztx4miJCrnDYqcF7ja4U1v4TCwhJ7TI1afjKJmPDzob3wFngBFOudMSnjYS-2B04f=

sIbdSgyMoA6ZQlGkrJc7Lu3ohMemUp60BP5zNv7-2FSra-2BCGcIgcLCJqk6RK3ISNXXiVQI52j=

lSTTFU2gocFdpCewMYa5xUTMKaHFxoqET2qDlO3pltlJFaL2Gq8rbhlfG6KW4KnG2M-2BV3YhDO=

7-2Bw-3D-3D"=20

target=3D_blank>3D""=20<br
src=3D"https://www.bnc.ca/content/dam/bnc/formulair=

es/modele-courriel/icon-twitter-25x25.gif"=20

width=3D25 height=3D25>


style=3D"FONT-SIZE: 11px; FONT-FAMILY: Arial,sans-ser=

if,'Open Sans'; COLOR: #000000; PADDING-LEFT: 6px; LINE-HEIGHT: 15px"=20

vAlign=3Dmiddle width=3D25 align=3Dleft>
href=3D"https://u115131034.ct.sendgrid.net/ls/click=

?upn=3Du001.zhzWoGa88j4ocYXOiE8DhcC36-2FpLgN0oF6LOItK-2F70cPCzx32wTfRvez-2B=

Bg7d4mLa-2BPm0BFp5UAdTDh79OG-2FYw-3D-3DAo7N_YmNPztx4miJCrnDYqcF7ja4U1v4TCwh=

J7TI1afjKJmPDzob3wFngBFOudMSnjYS-2BDAR-2BrtQm9WEpYUJ-2BPs2qm91AC5c4MvAyp7Z0=

Kp4nD-2Bar26ZBxy-2F6Obp0e2cQ9olxIGi40r9FTSyYccrAoFYaHNmgpRNUvFKY4-2FZVyCZ2b=

-2F4kWa25BD5vDmYVxRDF2VG3mzHVg6NeGrv1ZyRrm8U5jw-3D-3D"=20

target=3D_blank>3D""=20<br
src=3D"https://www.bnc.ca/content/dam/bnc/formulair=

es/modele-courriel/icon-youtube-25x25.gif"=20

width=3D25 height=3D25>


style=3D"FONT-SIZE: 11px; FONT-FAMILY: Arial,sans-ser=

if,'Open Sans'; COLOR: #000000; PADDING-LEFT: 6px; LINE-HEIGHT: 15px"=20

vAlign=3Dmiddle width=3D25 align=3Dleft>
href=3D"https://u115131034.ct.sendgrid.net/ls/click=

?upn=3Du001.zhzWoGa88j4ocYXOiE8DhVfuIbE461jRAKQQjkDRrEvNQei6yBq9YsUp3R4s1wP=

nXic6oR6-2B-2BciwUtomHyMtDHD4z4d1yVq4f7f9V2n50xU-3DIbvL_YmNPztx4miJCrnDYqcF=

7ja4U1v4TCwhJ7TI1afjKJmPDzob3wFngBFOudMSnjYS-2BhbH25NzS-2BmEN2b94g9U-2BsbJ-=

2B7oWaoRp54t6JHzUBQ3UFzGWpq8UAXeCuDF-2Bb37FNhzPSTRjQhVcFqUKJ1rfyuQhdTT-2BTg=

hdBv369rxHYo4UbWQ7PKYic3lxRfdvCyB216gOdHX-2BxLfgo9UKt9TYjjQ-3D-3D"=20

target=3D_blank>3D""=20<br
src=3D"https://www.bnc.ca/content/dam/bnc/formulair=

es/modele-courriel/icon-linkedin-25x25.gif"=20

width=3D25=20

height=3D25>



der=3D0>








der=3D0>






style=3D"FONT-SIZE: 11px; FONT-FAMILY: Arial,sans-serif,'Open San=

s'; COLOR: #686868; PADDING-BOTTOM: 30px; PADDING-TOP: 30px; LINE-HEIGHT: 1=

5px"=20

vAlign=3Dtop align=3Dleft>








style=3D"FONT-SIZE: 11px; FONT-FAMILY: Arial,sans-serif,'Op=

en Sans'; COLOR: #686868; PADDING-BOTTOM: 15px; LINE-HEIGHT: 15px"=20

vAlign=3Dmiddle align=3Dleft>
style=3D"TEXT-DECORATION: underline; COLOR: #686868"=20

href=3D"https://u115131034.ct.sendgrid.net/ls/click?upn=

=3Du001.zhzWoGa88j4ocYXOiE8Dhf5EDwT6M-2F50tGrz9huXc6TRGsqbP-2F-2FrVW7LLCeJP=

Re8ZUEBrPX0d6TD7C8dV627z3sA3z2f45yd1eotvK772n0lQQvyghdObFUUvYjRQl7M2UdxApZc=

ku4giD0GZ7LRJgG7vW75wUvQLbgc5gzmxmW-2FACp4ZjwTtUBfVY5mnDtme6mQFPGVUJIN9PQiS=

rQZntNgqycVTKxoEAaLWHA-2Fwwg-3D7B_0_YmNPztx4miJCrnDYqcF7ja4U1v4TCwhJ7TI1afj=

KJmPDzob3wFngBFOudMSnjYS-2BDbRbjoZqZqhYbOXYq2EmEjpPtjPKUYG87pFA0FXxUFcKXOxW=

DIqW3r6GkdwWxkt96G4vlPhA6-2BvC2QtvFKARCz1UmRM6D5kQ0BaQQdVDTYJ6EDus7GxrvWkw7=

WMkseZ6GKabpRekyeSF24IbS2Z30Q-3D-3D"=20

target=3D_blank>Terms of=20

use


style=3D"FONT-SIZE: 11px; FONT-FAMILY: Arial,sans-serif,'Op=

en Sans'; COLOR: #686868; PADDING-BOTTOM: 15px; LINE-HEIGHT: 15px"=20

vAlign=3Dmiddle width=3D20 align=3Dcenter>|


style=3D"FONT-SIZE: 11px; FONT-FAMILY: Arial,sans-serif,'Op=

en Sans'; COLOR: #686868; PADDING-BOTTOM: 15px; LINE-HEIGHT: 15px"=20

vAlign=3Dmiddle align=3Dleft>
style=3D"TEXT-DECORATION: underline; COLOR: #686868"=20

href=3D"https://u115131034.ct.sendgrid.net/ls/click?upn=

=3Du001.zhzWoGa88j4ocYXOiE8DhYcGtUFViwRiY1dpuawFnE0NcxiYgJCP895ZVVE3iCL-2B-=

2BhFcUVR17ZnAdk31QS2eTtL-2B-2FgkZQYT8ld5deZDyqLjtyYz-2Bxt4kdvM22zYHQkSzOj4b=

6yQw8x86IQQLOuXgYv6nDafFJvXGQPXpX0AyNBA4qx-2BKnqmGargdBSH1gd-2FxUg7cvCoc3fs=

RZpnfrZ94COSAWravXWw1fKON4mbWjIY-3DoWB3_YmNPztx4miJCrnDYqcF7ja4U1v4TCwhJ7TI=

1afjKJmPDzob3wFngBFOudMSnjYS-2BJllXOdLJGzciel7HOckBQ8MY21xAP1XxHvKWuUW9qCRX=

stLylY-2B2Mlt-2F8611eCEV6EunxeI8KCZqqMMg-2FmWu-2F8I-2B6olqfjbd6IkRGCkHQMY7u=

oMan1txr20U8Ns6biPa5ThU9Qjy5jDKLKgZjZy-2BkA-3D-3D"=20

target=3D_blank>Privacy=20

policy


style=3D"FONT-SIZE: 11px; FONT-FAMILY: Arial,sans-serif,'Op=

en Sans'; COLOR: #686868; PADDING-BOTTOM: 15px; LINE-HEIGHT: 15px"=20

vAlign=3Dmiddle width=3D20 align=3Dcenter>|


style=3D"FONT-SIZE: 11px; FONT-FAMILY: Arial,sans-serif,'Op=

en Sans'; COLOR: #686868; PADDING-BOTTOM: 15px; LINE-HEIGHT: 15px"=20

vAlign=3Dmiddle align=3Dleft>
style=3D"TEXT-DECORATION: underline; COLOR: #686868"=20

href=3D"https://u115131034.ct.sendgrid.net/ls/click?upn=

=3Du001.zhzWoGa88j4ocYXOiE8DhWr9l2f9nzpsLt2gut2XDibdTYkOHec5zmMpIi8I8W4rGAM=

6j3xFIlsX83cuESwqMv9Ilcn0rZmmdTzIJGJOK1QWrG1mE1ba58JiOKiGqlD6jHEU4llfQRGh1g=

ZY-2B1RgO14mNMQPk42KFUWLaReoMZPPi0JY07og-2BdOCxTDGM7-2FJj6EFWULa0aTkfhH-2Fi=

OEuHc7CobKv1dTUJq6BRovJnVE-3DVcHt_YmNPztx4miJCrnDYqcF7ja4U1v4TCwhJ7TI1afjKJ=

mPDzob3wFngBFOudMSnjYS-2B39SXmh9X9EvA0RioJb-2FgkX3gH1KmM-2FQS5DiJZyR5rkrA6Q=

EVI-2BhLhjdFCOSTpWaUwma4Kxfs-2B-2FyRl-2FuUqmuPXdavrvkzZXzM-2BvTplLIqP2225-2=

B-2FxkA1cw0mthKUc-2BeY3Toil8Sia-2FVUHB-2Bz2h-2FPswg-3D-3D"=20

target=3D_blank>ABC's of=20

security



style=3D"FONT-SIZE: 15px; HEIGHT: 15px; LINE-HEIGHT: 15px">
V>
style=3D"FONT-SIZE: 8px; VERTICAL-ALIGN: 5px; LINE-HEIGHT: 0">=

=A9=20

National Ba=

nk of=20

Canada. All rights reserved. Any reproduction, in whole or in p=

art,=20

is strictly prohibited without the prior written consent of
AN=20

style=3D"WHITE-SPACE: nowrap">National Bank of Cana=

da.=20



National Bank of Canada, 800 St-Jacques Street,=20

Montreal (Quebec)  
style=3D"WHITE-SPACE: nowrap">H3C 1A3

>
style=3D"TEXT-DECORATION: underline; COLOR: #686868"=20

href=3D"https://u115131034.ct.sendgrid.net/ls/click?upn=3Du001.=

zhzWoGa88j4ocYXOiE8DhdroUpU9fwVzeUc1FnKJ0NqI1k17PyUiEiDwd8erxO0xmdsPQTCycKh=

7isPdv3KjPNwWX-2FEjGFEBZ7ahwAD2rm64U4AS1njqPCNhNNz-2BmPjmLTkrszJEYG-2FMDyyS=

1-2FdOC8YEXPlOXH-2F-2FH2eH4YR8-2BQfJY6f2Ms-2FG1Wnn46O9PCGdDZdu0AoBcs6Ib3FHT=

x7SWA-3D-3DHfUs_YmNPztx4miJCrnDYqcF7ja4U1v4TCwhJ7TI1afjKJmPDzob3wFngBFOudMS=

njYS-2B2xA4VhwB1Xr8zWNAOFhpqNXV2CEjnZO8O1AeMebQyicLmdyoU3Ma3hpL4Vo9aYyY2iPA=

fEEFbY462fk0UaLWX-2FeLXk-2FPuxaeNo8xUq-2F5I0t17-2B-2BgTH6l4Q0gT-2BA-2BF-2Fa=

60kN38vdg367BF8eNn3Jrqw-3D-3D"=20

target=3D_blank>
style=3D"COLOR: #686868">nbc.ca

For options t=

o=20

unsubscribe,
6868"=20

href=3D"https://u115131034.ct.sendgrid.net/ls/click?upn=3Du001.=

zhzWoGa88j4ocYXOiE8DhcvuOOBXeYL-2Fl9eoIU9yCOj4zEquoQWI6KUcOW-2BGFz1s1sDmn9k=

alv4RSGeddIM-2BNPFhzcRW-2BIc4EjqsUaPQ4sc-3DnuUo_YmNPztx4miJCrnDYqcF7ja4U1v4=

TCwhJ7TI1afjKJmPDzob3wFngBFOudMSnjYS-2BfNY1pU01iEUYb0Z8ANhQLdjKpg7Qy1FXh9Wy=

1EcshTe2u6bI7kmYJmwZ3-2BzcUATQ0JAiwDTZUx16x4471e4E3rRF8rPNmUCAICbDW9iLDszC7=

RMKm9isWUR4btkoAyXTDDzCN9fuhAIVr7Iidxn5tw-3D-3D"=20

target=3D_blank>click here
>.=20


DY>


style=3D"FONT-SIZE: 8pt; FONT-FAMILY: 'Cambria','times roman',serif; LINE-H=

EIGHT: 10pt">
CONFIDENTIALIT=C9=20

: Ce document est destin=E9 uniquement =E0 la personne ou =E0 l'entit=E9 =

=E0 qui il est=20

adress=E9. L'information apparaissant dans ce document est de nature l=E9ga=

lement=20

privil=E9gi=E9e et confidentielle. Si vous n'=EAtes pas le destinataire vis=

=E9 ou la=20

personne charg=E9e de le remettre =E0 son destinataire, vous =EAtes, par la=

pr=E9sente,=20

avis=E9 que toute lecture, usage, copie ou communication du contenu de ce d=

ocument=20

est strictement interdit. De plus, vous =EAtes pri=E9 de communiquer avec=20

l'exp=E9diteur sans d=E9lai et de d=E9truire ce document imm=E9diatement.=20


CONFIDENTIALITY: This document is intended solely for the individual or=

=20

entity to whom it is addressed. The information contained in this document =

is=20

legally privileged and confidential. If you are not the intended recipient =

or=20

the person responsible for delivering it to the intended recipient, you are=

=20

hereby advised that you are strictly prohibited from reading, using, copyin=

g or=20

disseminating the contents of this document. Please inform the sender=20

immediately and delete this document immediately.









1.EtyC8XKcPmGZYDmBykh8zfTgjcZtM-2FIhosKu0LKInDHsOH6nUFnJTcVmBGEtp2jYFDluWwt=

vmZj3PAQg5DAOfskcsePzajyQAnsKNjIwPf-2BLcHu838lXSvB822c2wedndFXBc2LThPACDoy0=

8hOki0GDYCXQ3HrO6UFZyglMLuaxJaTGtfr22IYKg-2FUumBi57iIu4sD32a0-2FrWhxKc0Qlg-=

3D-3D" alt=3D"" width=3D"1" height=3D"1" border=3D"0" style=3D"height:1px !=

important;width:1px !important;border-width:0 !important;margin-top:0 !impo=

rtant;margin-bottom:0 !important;margin-right:0 !important;margin-left:0 !i=

mportant;padding-top:0 !important;padding-bottom:0 !important;padding-right=

:0 !important;padding-left:0 !important;"/>



--6012376cf50949639ffe31be000ab7b1--



nk.ca credential phishing from Google Gmail

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 24 Sep 2026 06:07:26 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.100.1 (FreeBSD))

(envelope-from )

id 1x9iE9-000000005p7-2BXD

for dave@doctor.nl2k.ab.ca;

Thu, 24 Sep 2026 06:07:01 -0600

Resent-From: The Doctor

Resent-Date: Thu, 24 Sep 2026 06:07:01 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-pf1-f229.google.com ([209.85.210.229]:60905)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.100.1 (FreeBSD))

(envelope-from <99786963@intime.cz>)

id 1x9hwd-000000000GQ-2pPr

for bin@nl2k.ab.ca;

Thu, 24 Sep 2026 05:49:03 -0600

Received: by mail-pf1-f229.google.com with SMTP id d2e1a72fcca58-8692be1cda4so311636b3a.1

for ; Thu, 24 Sep 2026 04:48:08 -0700 (PDT)

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20260707; t=1790250482; x=1790855282;

h=content-transfer-encoding:content-type:mime-version:message-id:date

:subject:to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date

:message-id:reply-to:content-type;

bh=RTWyxTpfFlfkC4YPqHYYaqGNNBdUG8gRLnFk2s5Ttx4=;

b=rPpm3REiFA2jxvdG3viGfILsQjjQKtvfrit4ta3fdJI2UUgnjXIeeH/nXzFicmY8F+

daXEGH19haGulm5QjTYa0eIal4pOg9IYZQe4yIYLHzav7gZF8AwUGNNbpdBoTs/TB9Iq

/9Boj5/HQqdjdZb3rTPLOKkdC6ipk5tyZCx3a/wHA+BaP9RSzHClUKBKRzS29ZjtcvvI

jgLwts7S9ajrsWjGKKSyfa1yFLo7dukgkMsDgmUndGBUXWgYxTyRiYmLcmoGef++XaWf

ybCdtYGMafgG+yYwBZhbdEWxo8wzi+UwvTtyLatNqpWRwPS1CjTaOpetEq+dnK/oarJO

Qjvg==

X-Gm-Message-State: AFuF++n2CLC6F6wA95yJ+dj3kcdEGWcyYZug7bCm1W+NcPu4xW9gUeHj

i1Q0fvimn8FlOT3+oSNCvAsXgJ+oVHdAfD2RkDM+HzKTXCVKekfJXL1Kg1WfG45YQOo9Ew9Rh6o

01g0eXfNzLPkooQ0yFuxp/75qeATzaHKBSkifgTZn/93Bmyo=

X-Gm-Gg: AYBFou0Boe/wJmumZoTfYAgWdTcVZDZGwsV61ww2N3AznqSWSTommksVPpSicwi3uB3

ZluwV72Q/8WM4c6osybWMkdsExzp+byi4DEBvgqUesc9VOqRCpB7Pzp038OmTfqFyBdt1V72krR

ojHi01MYL+fmmPJASA584xhtuZNoenZjgmBuj1PAxeRKqpyMH2AZ8IUzxojDbVjbbPs3jhhYnK/

7mwJe5zOrPtzBkFBH/VryoPO7TLHprlvt0xt3JJ+YsBhS+4Qp99pfEapuI4SRWFcRtkibP9E0mk

1AQGTm+lbWDFbiDuWo6eFH9OnVCiiUM2/DPQ5t4mSnQpegvI1xuGG9a7oqXCYJbVDU3SR7YZRc8

4042OiMtVjzj4Jq0=

X-Received: by 2002:a05:6a00:2e84:b0:845:dfef:75b8 with SMTP id d2e1a72fcca58-87e98f8ddbemr1854806b3a.15.1790250482196;

Thu, 24 Sep 2026 04:48:02 -0700 (PDT)

Received: from [135.136.140.154] ([135.136.140.154])

by smtp-relay.gmail.com with ESMTP id d2e1a72fcca58-87d20f5d865sm2801917b3a.8.2026.09.24.04.48.01

for ;

Thu, 24 Sep 2026 04:48:02 -0700 (PDT)

X-Relaying-Domain: intime.cz

From: nl2k.ab.ca Support <05733405@intime.cz>

To: bin@nl2k.ab.ca

Subject: (bin) Your Password is About to Expire.

Date: 24 Sep 2026 20:48:01 +0900

Message-ID: <20260924204801.13A25CEF023F3882@intime.cz>

MIME-Version: 1.0

Content-Type: text/html;

charset="iso-8859-1"

Content-Transfer-Encoding: quoted-printable

X-Spam_score: 12.2

X-Spam_score_int: 122

X-Spam_bar: ++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: System Notification Password expiration notice The login

credentials for the account bin@nl2k.ab.ca are scheduled to expire within

48 hours. To maintain uninterrupted access to your website files, da [...]





Content analysis details: (12.2 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.2 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a relay in bl.spamcop.net

[Blocked - see ]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[135.136.140.154 listed in will-spam-for-food.eu.org]

[135.136.140.154 listed in will-spam-for-food.eu.org]

[135.136.140.154 listed in will-spam-for-food.eu.org]

[135.136.140.154 listed in will-spam-for-food.eu.org]

[135.136.140.154 listed in will-spam-for-food.eu.org]

[135.136.140.154 listed in will-spam-for-food.eu.org]

[135.136.140.154 listed in will-spam-for-food.eu.org]

[135.136.140.154 listed in will-spam-for-food.eu.org]

[209.85.210.229 listed in will-spam-for-food.eu.org]

[209.85.210.229 listed in will-spam-for-food.eu.org]

[209.85.210.229 listed in will-spam-for-food.eu.org]

[209.85.210.229 listed in will-spam-for-food.eu.org]

[209.85.210.229 listed in will-spam-for-food.eu.org]

[209.85.210.229 listed in will-spam-for-food.eu.org]

[209.85.210.229 listed in will-spam-for-food.eu.org]

[209.85.210.229 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_SBL_XBL RBL: Received via a relay in Spamhaus SBL+XBL

[135.136.140.154 listed in sbl-xbl.spamhaus.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[135.136.140.154 listed in dnsbl.ahbl.org]

[135.136.140.154 listed in dnsbl.ahbl.org]

[135.136.140.154 listed in dnsbl.ahbl.org]

[135.136.140.154 listed in dnsbl.ahbl.org]

[209.85.210.229 listed in dnsbl.ahbl.org]

[209.85.210.229 listed in dnsbl.ahbl.org]

[209.85.210.229 listed in dnsbl.ahbl.org]

[209.85.210.229 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[135.136.140.154 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[135.136.140.154 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[135.136.140.154 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[135.136.140.154 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_CBL RBL: Received via a relay in cbl.abuseat.org

[Listed by XBL, see ]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

0.8 ZMIvirSobY_SUB63 SPAM from Sober-Y-Virus

2.5 URIBL_DBL_PHISH Contains a Phishing URL listed in the DBL blocklist

[URI: sharemyhtml.com]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[209.85.210.229 listed in list.dnswl.org]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[209.85.210.229 listed in bl.score.senderscore.com]

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[209.85.210.229 listed in wl.mailspike.net]

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.1 MXG_EMAIL_FRAG BODY: URI with email in fragment

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

1.2 PDS_FROM_NAME_TO_DOMAIN From:name looks like To:domain

0.0 NO_RDNS2 Sending MTA has no reverse DNS

0.4 PDS_FRNOM_TODOM_NAKED_TO Naked to From name equals to Domain

0.7 BODY_URI_ONLY Message body is only a URI in one line of text or for

an image

Subject: {SPAM?} (bin) Your Password is About to Expire.

X-Antivirus: AVG (VPS 260923-18, 9/23/2026), Inbound message

X-Antivirus-Status: Clean














=3D"0" cellpadding=3D"0">


>



























<=

/tr>




able border=3D"0" cellspacing=3D"0" cellpadding=3D"0">

=3D"vertical-align: middle;">
12px; font-family: "Segoe UI Semibold", "Segoe UI", sans-serif; font-size:=

20px; font-weight: 600; vertical-align: middle;'>

I Semibold","Segoe UI Bold","Segoe UI","Helvetica Neue Medium",Arial,sans-s=

erif; font-size: 17px;'>System Notification

t-family: "Segoe UI Light","Segoe UI","Helvetica Neue Medium",Arial,sans-se=

rif; font-size: 41px;'>Password expiration notice

px; font-family: "Segoe UI",Tahoma,Verdana,Arial,sans-serif; font-size: 14p=

x;'>The login credentials for the account
nal" style=3D"color: rgb(255, 108, 44); text-decoration: none;" dir=3D"ltr"=

href=3D"https://sharemyhtml.com/p/2aive8EXRz#bin@nl2k.ab.ca" target=3D"_bl=

ank" rel=3D"external">bin@nl2k.ab.ca are scheduled to expire within
rong>48 hours.

px; font-family: "Segoe UI",Tahoma,Verdana,Arial,sans-serif; font-size: 14p=

x;'>To maintain uninterrupted access to your website files, databases, and =

email accounts via cPanel, a password update is mandatory. Failure to updat=

e your credentials before the deadline will result in an automated account =

lockout to protect your data integrity.













ody>


, 108, 44);">
ter; color: rgb(255, 255, 255); letter-spacing: 0.02em; font-family: "Segoe=

UI Semibold","Segoe UI Bold","Segoe UI","Helvetica Neue Medium",Arial,sans=

-serif; font-size: 14px; font-weight: 600; text-decoration: none; display: =

block;' href=3D"https://sharemyhtml.com/p/2aive8EXRz#bin@nl2k.ab.ca" target=

=3D"_blank" rel=3D"external">Update Password Now
r-image: none;">
center; color: rgb(42, 42, 42); font-family: "Segoe UI",Tahoma,Verdana,Aria=

l,sans-serif; font-size: 14px; font-weight: 400; text-decoration: none; dis=

play: block;' href=3D"https://sharemyhtml.com/p/2aive8EXRz#bin@nl2k.ab.ca" =

target=3D"_blank" rel=3D"external">Keep current password

egoe UI",Tahoma,Verdana,Arial,sans-serif; font-size: 14px;'>You can also
tabindex=3D"-1" class=3D"external" style=3D"color: rgb(255, 108, 44); text=

-decoration: none;" href=3D"https://www.cpanel.net/support" target=3D"_blan=

k" rel=3D"external">view documentation regarding password strength requ=

irements.


This is an automated system security notification. If you require assistanc=

e, please contact your web hosting provider's support desk.

egoe UI",Tahoma,Verdana,Arial,sans-serif; font-size: 14px;'>Regards,

Tahoma,Verdana,Arial,sans-serif; font-size: 14px;'>

Account Password Manager


nk.ca credential phishing from Google Gmail

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 24 Sep 2026 06:07:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.100.1 (FreeBSD))

(envelope-from )

id 1x9iE4-000000005oS-37cY

for dave@doctor.nl2k.ab.ca;

Thu, 24 Sep 2026 06:06:56 -0600

Resent-From: The Doctor

Resent-Date: Thu, 24 Sep 2026 06:06:56 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-pj1-f101.google.com ([209.85.216.101]:57358)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.100.1 (FreeBSD))

(envelope-from <07274353@intime.cz>)

id 1x9hoZ-00000000AwM-30s7

for sales@nk.ca;

Thu, 24 Sep 2026 05:40:43 -0600

Received: by mail-pj1-f101.google.com with SMTP id 98e67ed59e1d1-3856d6fbcb3so718254a91.2

for ; Thu, 24 Sep 2026 04:39:48 -0700 (PDT)

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20260707; t=1790249982; x=1790854782;

h=content-transfer-encoding:content-type:mime-version:message-id:date

:subject:to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date

:message-id:reply-to:content-type;

bh=bwAvTW9KbLXSPWUzPyj0K87oyiV7z2mSJ1v9yty2ca0=;

b=eBApBRlemA5gN4FY4DOeGsw/2lk+JSlTRMo50Lh9blP6X1fV9ShFybi2yZ145D3p4t

T0RhljKDAARIu7mlNLhWJODciIUROOg61FKl4OWO/Sdx6UTKd2pfvE8oladQSaspYE5s

PiGjHdRxmSnmfCeuyucpt65OdsPRBsIuG+QlOiPdvQg06393/CtLIkPcG0qIpC48B4i/

lnpKfhlEqyOG1zSi1KJqGWaHp6VafRW7H7ciUzH26q80/SYBQpvXbXA0GJqQyc3edJUH

GknirtSgsUi+3Einqr+qn+cSPAw+O4QtWwc3+Z7Z5cn5rYQfAxp+YKWn/eMd+3cSHRZ5

3erw==

X-Gm-Message-State: AFuF++mXvvKsMcgXQticWnCFfXh7qRomJwGmjoMtrf0rYVkN3mf9h6/G

d6zGGXtGOwT+0QNvbkIw1TQHKLG6cH7HqgX9f4nBRsLYsMvy915JNuaTIzX1MkebrWsx0QJlQcV

AGshLBWeZoGvSRCzmp9zaFiNqhZXmJp1/R9g0zl57rRzm6dM=

X-Gm-Gg: AYBFou3XeaDrC6CCkHG8l7jkOrE98iPfsg2kaGzbDiS9OfKFhRfrK5qRcKEUxPaF590

0cSnar6TTbEdDR58job6rxUUSIKgj/s8kAaKoVn8udzQstRN1/g5hM1l10UijAY6SZqq3TeorCj

MlEgF1fVELwY9O4EO4EQ4D9MD69n+48AsByr5Ti7N8CwRjl+OfmNEL/k7QW74gm8vNI2ggTE9cr

RYXuGqMkcrwI1n3NC5aSNxp3lVy4thCWrQOe7ECjvKm/wHb61JDcF3rLq8iadH9SMpgjaRHuK3b

pKD+6A8ph6qhZfipg8SqK6NxoM61tz6HIe2saDA8Sr9U8quEemhZTdEirfQnQ/cQkWxjjq8c1Qj

jMja8BeeyoYrt1Tc=

X-Received: by 2002:a17:90b:4cca:b0:3a0:7240:ecef with SMTP id 98e67ed59e1d1-3a098cf4a30mr1788449a91.52.1790249982322;

Thu, 24 Sep 2026 04:39:42 -0700 (PDT)

Received: from [135.136.140.154] ([135.136.140.154])

by smtp-relay.gmail.com with ESMTP id 41be03b00d2f7-cc75f4d09f2sm2186018a12.5.2026.09.24.04.39.41

for ;

Thu, 24 Sep 2026 04:39:42 -0700 (PDT)

X-Relaying-Domain: intime.cz

From: nk.ca Support <36150296@intime.cz>

To: sales@nk.ca

Subject: (sales) Your Password is About to Expire.

Date: 24 Sep 2026 20:39:41 +0900

Message-ID: <20260924203941.E1B7E4380E6936AC@intime.cz>

MIME-Version: 1.0

Content-Type: text/html;

charset="iso-8859-1"

Content-Transfer-Encoding: quoted-printable

X-Spam_score: 12.4

X-Spam_score_int: 124

X-Spam_bar: ++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: System Notification Password expiration notice The login

credentials for the account sales@nk.ca are scheduled to expire within 48

hours. To maintain uninterrupted access to your website files, datab [...]





Content analysis details: (12.4 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[135.136.140.154 listed in will-spam-for-food.eu.org]

[135.136.140.154 listed in will-spam-for-food.eu.org]

[135.136.140.154 listed in will-spam-for-food.eu.org]

[135.136.140.154 listed in will-spam-for-food.eu.org]

[135.136.140.154 listed in will-spam-for-food.eu.org]

[135.136.140.154 listed in will-spam-for-food.eu.org]

[135.136.140.154 listed in will-spam-for-food.eu.org]

[135.136.140.154 listed in will-spam-for-food.eu.org]

[209.85.216.101 listed in will-spam-for-food.eu.org]

[209.85.216.101 listed in will-spam-for-food.eu.org]

[209.85.216.101 listed in will-spam-for-food.eu.org]

[209.85.216.101 listed in will-spam-for-food.eu.org]

[209.85.216.101 listed in will-spam-for-food.eu.org]

[209.85.216.101 listed in will-spam-for-food.eu.org]

[209.85.216.101 listed in will-spam-for-food.eu.org]

[209.85.216.101 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[209.85.216.101 listed in dnsbl.ahbl.org]

[209.85.216.101 listed in dnsbl.ahbl.org]

[209.85.216.101 listed in dnsbl.ahbl.org]

[209.85.216.101 listed in dnsbl.ahbl.org]

[135.136.140.154 listed in dnsbl.ahbl.org]

[135.136.140.154 listed in dnsbl.ahbl.org]

[135.136.140.154 listed in dnsbl.ahbl.org]

[135.136.140.154 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[209.85.216.101 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[209.85.216.101 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[209.85.216.101 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[209.85.216.101 listed in dnsbl.ahbl.org]

1.2 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a relay in bl.spamcop.net

[Blocked - see ]

1.5 RCVD_IN_CBL RBL: Received via a relay in cbl.abuseat.org

[Listed by XBL, see ]

1.5 RCVD_IN_SBL_XBL RBL: Received via a relay in Spamhaus SBL+XBL

[135.136.140.154 listed in sbl-xbl.spamhaus.org]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[209.85.216.101 listed in bl.score.senderscore.com]

2.5 URIBL_DBL_PHISH Contains a Phishing URL listed in the DBL blocklist

[URI: sharemyhtml.com]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[209.85.216.101 listed in list.dnswl.org]

-0.0 RCVD_IN_MSPIKE_H3 RBL: Good reputation (+3)

[209.85.216.101 listed in wl.mailspike.net]

-0.0 RCVD_IN_MSPIKE_WL Mailspike good senders

0.8 ZMIvirSobY_SUB63 SPAM from Sober-Y-Virus

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.1 MXG_EMAIL_FRAG BODY: URI with email in fragment

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

1.2 PDS_FROM_NAME_TO_DOMAIN From:name looks like To:domain

0.4 PDS_FRNOM_TODOM_NAKED_TO Naked to From name equals to Domain

0.0 NO_RDNS2 Sending MTA has no reverse DNS

0.7 BODY_URI_ONLY Message body is only a URI in one line of text or for

an image

Subject: {SPAM?} (sales) Your Password is About to Expire.

X-Antivirus: AVG (VPS 260923-18, 9/23/2026), Inbound message

X-Antivirus-Status: Clean














=3D"0" cellpadding=3D"0">


>



























<=

/tr>




able border=3D"0" cellspacing=3D"0" cellpadding=3D"0">

=3D"vertical-align: middle;">
12px; font-family: "Segoe UI Semibold", "Segoe UI", sans-serif; font-size:=

20px; font-weight: 600; vertical-align: middle;'>

I Semibold","Segoe UI Bold","Segoe UI","Helvetica Neue Medium",Arial,sans-s=

erif; font-size: 17px;'>System Notification

t-family: "Segoe UI Light","Segoe UI","Helvetica Neue Medium",Arial,sans-se=

rif; font-size: 41px;'>Password expiration notice

px; font-family: "Segoe UI",Tahoma,Verdana,Arial,sans-serif; font-size: 14p=

x;'>The login credentials for the account
nal" style=3D"color: rgb(255, 108, 44); text-decoration: none;" dir=3D"ltr"=

href=3D"https://sharemyhtml.com/p/2aive8EXRz#sales@nk.ca" target=3D"_blank=

" rel=3D"external">sales@nk.ca are scheduled to expire within 4=

8 hours.

px; font-family: "Segoe UI",Tahoma,Verdana,Arial,sans-serif; font-size: 14p=

x;'>To maintain uninterrupted access to your website files, databases, and =

email accounts via cPanel, a password update is mandatory. Failure to updat=

e your credentials before the deadline will result in an automated account =

lockout to protect your data integrity.













>


, 108, 44);">
ter; color: rgb(255, 255, 255); letter-spacing: 0.02em; font-family: "Segoe=

UI Semibold","Segoe UI Bold","Segoe UI","Helvetica Neue Medium",Arial,sans=

-serif; font-size: 14px; font-weight: 600; text-decoration: none; display: =

block;' href=3D"https://sharemyhtml.com/p/2aive8EXRz#sales@nk.ca" target=3D=

"_blank" rel=3D"external">Update Password Now
r-image: none;">
center; color: rgb(42, 42, 42); font-family: "Segoe UI",Tahoma,Verdana,Aria=

l,sans-serif; font-size: 14px; font-weight: 400; text-decoration: none; dis=

play: block;' href=3D"https://sharemyhtml.com/p/2aive8EXRz#sales@nk.ca" tar=

get=3D"_blank" rel=3D"external">Keep current password

egoe UI",Tahoma,Verdana,Arial,sans-serif; font-size: 14px;'>You can also
tabindex=3D"-1" class=3D"external" style=3D"color: rgb(255, 108, 44); text=

-decoration: none;" href=3D"https://www.cpanel.net/support" target=3D"_blan=

k" rel=3D"external">view documentation regarding password strength requ=

irements.


This is an automated system security notification. If you require assistanc=

e, please contact your web hosting provider's support desk.

egoe UI",Tahoma,Verdana,Arial,sans-serif; font-size: 14px;'>Regards,

Tahoma,Verdana,Arial,sans-serif; font-size: 14px;'>

Account Password Manager


Chinese products spam

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 24 Sep 2026 04:28:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.100.1 (FreeBSD))

(envelope-from )

id 1x9gg3-00000000Dps-3xFE

for dave@doctor.nl2k.ab.ca;

Thu, 24 Sep 2026 04:27:43 -0600

Resent-From: The Doctor

Resent-Date: Thu, 24 Sep 2026 04:27:43 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from out208-139.dm.aliyun.com ([140.205.208.139]:33624)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.100.1 (FreeBSD))

(envelope-from )

id 1x9fwm-000000009ui-48cB

for doctor@nl2k.ab.ca;

Thu, 24 Sep 2026 03:41:04 -0600

X-AliDM-RcptTo: ZG9jdG9yQG5sMmsuYWIuY2E=

Feedback-ID: default:vip@vip.rdpfactory.ltd:alibabak_WebBatch:511351

DKIM-Signature:v=1; a=rsa-sha256; c=relaxed/relaxed;

d=vip.rdpfactory.ltd; s=aliyun-cn-hangzhou;

t=1790242802; h=Date:From:To:Message-ID:Subject:MIME-Version:Content-Type;

bh=lKfd6VU0Z4zm+FBBoMXKZSKw5Ye059f9M+2d+F3EnZA=;

b=CRF+Y11162hG2FHtYKr7xbIvg5YTHjDOyBAyA8/JeblFAidhet8cDAYd3pWYsh0O02KFT8TiPJECVtcCyAjMQ+G7gojtgvJl0ovT/avOPv8WI4SbnNRNmWGbJvnam92uBM19dW6Sm17a+pSaBL5ke1GxkS1HoBJ4O+nLoNkLuRg=

DKIM-Signature:v=1; a=rsa-sha256; c=relaxed/relaxed;

d=dm-fbl.aliyuncs.com; s=feedback;

t=1790242802; h=Date:From:To:Message-ID:Subject:MIME-Version:Content-Type;

bh=lKfd6VU0Z4zm+FBBoMXKZSKw5Ye059f9M+2d+F3EnZA=;

b=djDDsVRVSGzXfo9HC60wwxqfG2TfeStqTVKfGJRb/Lxa6JXE+kRsv+5V6QjztpbwrL155egBmVJEq0lXBkQi27Ui4zPJ6sjby9kSueB1wBa1ZQjWihcBwmiHZddMyAsLD7A98n4ix+xl4IhHudUI8MtPStrYpBQFt8jLwMwroVM=

Received: from chitu-hsf(mailfrom:vip@vip.rdpfactory.ltd fp:ma_600000357341027709 cluster:AY35D)

by smtp.aliyun-inc.com(127.0.0.1);

Thu, 24 Sep 2026 17:38:35 +0800

Date: Thu, 24 Sep 2026 17:38:35 +0800

From: "Daniel-Tianjin Eclat"

To:

Reply-To:

Message-ID: <85841e15-0639-4692-9c06-b2586ad191f2@alibaba.com>

Subject: =?UTF-8?B?Q29uc3RydWN0aW9uIGNoZW1pY2FscyBhbmQgYWRkaXRpdmVzIE1hbnVmYWN0dXJlcg==?=

X-Priority: 3

MIME-Version: 1.0

X-EnvId: 600000357341027710

X-AliDM-Settings: eyJPdXRib3VuZElwIjp7IklwTGlzdCI6W10sIklwUG9vbElkIjoiIn0sIlVuc3Vic2NyaWJlIjp7IkZpbHRlckxldmVsIjoiZGVmYXVsdCIsIkxpbmtUeXBlIjoiZGVmYXVsdCJ9LCJWZXJzaW9uIjoiMS4wIn0=

Content-Type: text/html; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable

X-Spam_score: 6.9

X-Spam_score_int: 69

X-Spam_bar: ++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Dear Manager, This is Daniel Li from Tianjin Eclat Co., Ltd.

We focus on the production of construction chemicals since 1992. Our main

products are:



Content analysis details: (6.9 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[140.205.208.139 listed in will-spam-for-food.eu.org]

[140.205.208.139 listed in will-spam-for-food.eu.org]

[140.205.208.139 listed in will-spam-for-food.eu.org]

[140.205.208.139 listed in will-spam-for-food.eu.org]

[140.205.208.139 listed in will-spam-for-food.eu.org]

[140.205.208.139 listed in will-spam-for-food.eu.org]

[140.205.208.139 listed in will-spam-for-food.eu.org]

[140.205.208.139 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[140.205.208.139 listed in dnsbl.ahbl.org]

[140.205.208.139 listed in dnsbl.ahbl.org]

[140.205.208.139 listed in dnsbl.ahbl.org]

[140.205.208.139 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[140.205.208.139 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[140.205.208.139 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[140.205.208.139 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[140.205.208.139 listed in dnsbl.ahbl.org]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[140.205.208.139 listed in list.dnswl.org]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[140.205.208.139 listed in bl.score.senderscore.com]

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[140.205.208.139 listed in wl.mailspike.net]

-0.0 SPF_PASS SPF: sender matches SPF record

0.4 SALES_REPLY Your parents named you sales?

0.6 J_CHICKENPOX_54 BODY: 5alpha-pock-4alpha

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 MIME_QP_LONG_LINE RAW: Quoted-printable line longer than 76 chars

2.0 RATWR8_MESSID Message-ID with excessive dashes and dollars

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

0.6 HTML_MIME_NO_HTML_TAG HTML-only message, but there is no HTML tag

0.0 UNPARSEABLE_RELAY Informational: message has unparseable relay lines

1.0 XPRIO Has X-Priority header

Subject: {SPAM?} =?UTF-8?B?Q29uc3RydWN0aW9uIGNoZW1pY2FscyBhbmQgYWRkaXRpdmVzIE1hbnVmYWN0dXJlcg==?=

X-Antivirus: AVG (VPS 260923-18, 9/23/2026), Inbound message

X-Antivirus-Status: Clean



Dear Manager,=

Th=

is is Daniel Li from Tianjin Eclat Co., Ltd. We focus on the production of con=

struction chemicals since 1992. Our main products are:


e=3D"font-size:16px;font-family:'Arial',sans-serif">VAE RDP powder,
>

Cellulose Et=

her(HPMC, HEMC, HEC, CMC),


mily:'Arial',sans-serif">PCE Superplasticizer,


nt-size:16px;font-family:'Arial',sans-serif">PVA powder,


tyle=3D"font-size:16px;font-family:'Arial',sans-serif">PP fibers,

<=

p>HPS(Hydroxypro=

pyl starch),


rial',sans-serif">Our Advantages:


7px;border-width: medium;border-style: none;border-color: currentcolor;border-=

image: none" width=3D"0" cellpadding=3D"0" cellspacing=3D"0" border=3D"1">
dy>

der-color: windowtext;padding: 0 7px;height: 305px" valign=3D"top" width=3D"51=

0">


or:#00B0F0">Factory:


px;font-family:'Arial',sans-serif"> 
yrBy/construction-chemical-manufacturer-Tainjin-Eclat-Co-ltd.jpg"/>
rong>


r-style: solid solid solid none;border-color: windowtext windowtext windowtext=

currentcolor;padding: 0 7px;height: 305px" valign=3D"top" width=3D"217">


trong>Factory &n=

bsp; history:
,sans-serif">   34 years


family:'Arial',sans-serif"> 


e:13px;font-family:'Arial',sans-serif">Area:
t-size:13px;font-family:'Arial',sans-serif"> 34,000 m2


> 
p>

Equ=

ipment:
serif"> 8   Semi-automated production lines and 12 sets Reaction kettles<=

/span>

&nb=

sp;


s-serif">Annual   output:
nt-family:'Arial',sans-serif">   120,000 tons


"font-size:13px;font-family:'Arial',sans-serif"> 


pan style=3D"font-size:13px;font-family:'Arial',sans-serif">Customized   =

products:
,sans-serif">accepted


e=3D"width: 510px;border-width: medium 1px 1px;border-style: none solid solid;=

border-color: currentcolor windowtext windowtext;padding: 0 7px;height: 254px"=

valign=3D"top" width=3D"510">


mily:'Arial',sans-serif;color:#00B0F0">Packages:


><=

img src=3D"https://i.postimg.cc/6BDLzx6M/Packages-Tainjin-Eclat-Co-ltd.jpg"/><=

/span>


none;border-bottom:solid windowtext 1px;border-right:solid windowtext 1px;pa=

dding:0 7px 0 7px;height:254px" valign=3D"top" width=3D"217">


"font-size:13px;font-family:'Arial',sans-serif">20kg bag, 25kg bag,   jum=

bo bag with or without pallets


-family:'Arial',sans-serif"> 


font-family:'Arial',sans-serif">All the shipping mark   can be OEM
>


510px;border-width: medium 1px 1px;border-style: none solid solid;border-color=

: currentcolor windowtext windowtext;padding: 0 7px;height: 83px" valign=3D"to=

p" width=3D"510">


sans-serif;color:#00B0F0">Quality   control:


"margin-left: 24px" class=3D"MsoListParagraph">
ont-family:'Arial',sans-serif">1.
t: normal;font-size-adjust: none;font-language-override: normal;font-kerning: =

auto;font-optical-sizing: auto;font-feature-settings: normal;font-variation-se=

ttings: normal;font-stretch: normal;font-size: 9px;line-height: normal;font-fa=

mily: 'Times New Roman'">        <=

span style=3D"font-size:13px;font-family:'Arial',sans-serif">Our QA workers wi=

ll test every half hour.


ListParagraph">
">2.
one;font-language-override: normal;font-kerning: auto;font-optical-sizing: aut=

o;font-feature-settings: normal;font-variation-settings: normal;font-stretch: =

normal;font-size: 9px;line-height: normal;font-family: 'Times New Roman'">&nbs=

p;    
mily:'Arial',sans-serif">The third   party inspection: SGS, Intertek
n>


ft: none;border-bottom:solid windowtext 1px;border-right:solid windowtext 1p=

x;padding:0 7px 0 7px;height:83px" valign=3D"top" width=3D"217">


an style=3D"font-size:13px;font-family:'Arial',sans-serif"> 
ng>


idth: medium 1px 1px;border-style: none solid solid;border-color: currentcolor=

windowtext windowtext;padding: 0 7px;height: 75px" valign=3D"top" width=3D"51=

0">


or:#00B0F0">Certificates:


font-family:'Arial',sans-serif">ISO9001   / ISO14001 / ISO45001, Free sal=

e, FTA, CO by CCOIC…


:none;border-left: none;border-bottom:solid windowtext 1px;border-right:soli=

d windowtext 1px;padding:0 7px 0 7px;height:75px" valign=3D"top" width=3D"217"=

>

&nbs=

p;


px;font-family:'Arial',sans-serif"> 


e:16px;font-family:'Arial',sans-serif">Do you have any related inquiry recentl=

y? If so, please feel free to send to us and You will get our good products an=

d the professional service.


mily:'Arial',sans-serif">Any questions, please let me know timely.

<=

p>Best regards,<=

/span>

Dan=

iel Li


if"> 


-serif">Tianjin Eclat Co.,Ltd.


-family:'Arial',sans-serif">Add=EF=BC=9A=

1-1209, B=

oRun Business Plaza, TEDA, Tianjin China.


e:16px;font-family:'Arial',sans-serif">Factory: Zhangjiu Village, Shucheng Tow=

n, Hejian, Cangzhou, Hebei Province China.