WEb/SEo/App Spam from Google Gmail

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 14 May 2026 04:47:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wNTaZ-00000000MvL-2Hjc

for dave@doctor.nl2k.ab.ca;

Thu, 14 May 2026 04:46:47 -0600

Resent-From: The Doctor

Resent-Date: Thu, 14 May 2026 04:46:47 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-dl1-f70.google.com ([74.125.82.70]:44404)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wNRte-000000008km-3bYV

for sales@nk.ca;

Thu, 14 May 2026 02:58:31 -0600

Received: by mail-dl1-f70.google.com with SMTP id a92af1059eb24-13312be8a31so4409292c88.1

for ; Thu, 14 May 2026 01:57:35 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=websitedevelopercalifornia.com; s=google; t=1778749049; x=1779353849; darn=nk.ca;

h=to:from:subject:date:message-id:reply-to:mime-version:from:to:cc

:subject:date:message-id:reply-to;

bh=GFW8FyAlZspjQ8CjjgGEaVUxDaDh500kkQyan8VMbNc=;

b=koUhv5Ljg2Qhsk0PCpWXBTEuNzpbLd2OfxT7R9wDiCJxSB72U3h3eX66ai3QpASApv

TwfWh/YQasMVGsdGrChcmh1hmBlWRXpDhb5DudNbIBx1dCEMw331bDSTZxU9+XpHFExf

zNs0gNWH6UY/t9WJm0Kfc6h3kOONlzm8g+r8U=

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20251104; t=1778749049; x=1779353849;

h=to:from:subject:date:message-id:reply-to:mime-version

:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to;

bh=GFW8FyAlZspjQ8CjjgGEaVUxDaDh500kkQyan8VMbNc=;

b=mrIlgA9bsmkXDnR4RttSPAK9PHP+Se4aMAGGaGR1rpktCN9OAx0BMG1p8ZIvhGediw

5eXjSfG2D9JRJ4YHwIEjxYXNBxtqVEgBJidku2axko+y486ZBBRzwtbFyKd3N/4PBFyQ

KF7mc9Qw3giLRbhkA7nqTGtM+/UPhASXgsu2kPQbvm0PznyoBzZjk0Cr6ZowDMLxlyED

uPKYlPxYuDBIIzExoZ8Q5ewLySmf5znL+PqIwwyLG/9D9AULOVvEC0Y95hAkK+5w9CW1

3xSZjvjZkjky5MHi/ShdPDie2CaPPgO63fr5JOtb93r8/s+ghYHgnqRbYwhdd27L2Fn7

Y2KA==

X-Gm-Message-State: AOJu0YwHGF2OPlEckd//XkQ0Sy6ml5dAqIYcI3WF5/Y8lAVGjmDAVNwu

9iqmxROTBGvhID7AVYt62WxBLBjfLvob1cOHELtxwbbrL35HH1IZDL/AJ2zHS/WY8TwAQX+s5HV

MzLaODKHd1D9mjpvuP5bfPA==

MIME-Version: 1.0

X-Received: by 2002:a05:690c:6e83:b0:7bd:6a98:58db with SMTP id

00721157ae682-7c6aa413740mr71877597b3.22.1778748593613; Thu, 14 May 2026

01:49:53 -0700 (PDT)

Reply-To: Info@websitedevelopercalifornia.com

Message-ID:

Date: Thu, 14 May 2026 08:49:53 +0000

Subject: Re: Could we set up a meeting?

From: june@websitedevelopercalifornia.com

To: sales@nk.ca

Content-Type: multipart/alternative; boundary="000000000000113bf80651c32e7f"

X-Spam_score: 9.1

X-Spam_score_int: 91

X-Spam_bar: +++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Hi, I came across your website www.nk.ca and noticed it has

strong potential. With SEO, your business can gain more visibility, attract

targeted customers, and achieve steady growth compared to ads. Without SEO,

however, competitors may capture your audience, your online presence may

stay restricted, and valuable opportunities can be missed.



Content analysis details: (9.1 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[74.125.82.70 listed in dnsbl.ahbl.org]

[74.125.82.70 listed in dnsbl.ahbl.org]

[74.125.82.70 listed in dnsbl.ahbl.org]

[74.125.82.70 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[74.125.82.70 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[74.125.82.70 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[74.125.82.70 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[74.125.82.70 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[74.125.82.70 listed in will-spam-for-food.eu.org]

[74.125.82.70 listed in will-spam-for-food.eu.org]

[74.125.82.70 listed in will-spam-for-food.eu.org]

[74.125.82.70 listed in will-spam-for-food.eu.org]

[74.125.82.70 listed in will-spam-for-food.eu.org]

[74.125.82.70 listed in will-spam-for-food.eu.org]

[74.125.82.70 listed in will-spam-for-food.eu.org]

[74.125.82.70 listed in will-spam-for-food.eu.org]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-0.0 SPF_PASS SPF: sender matches SPF record

1.7 URIBL_BLACK Contains an URL listed in the URIBL blacklist

[URI: websitedevelopercalifornia.com]

1.9 URIBL_JP_SURBL Contains an URL listed in the JP SURBL blocklist

[URI: websitedevelopercalifornia.com]

1.9 URIBL_ABUSE_SURBL Contains an URL listed in the ABUSE SURBL blocklist

[URI: websitedevelopercalifornia.com]

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[74.125.82.70 listed in list.dnswl.org]

-0.0 RCVD_IN_MSPIKE_H3 RBL: Good reputation (+3)

[74.125.82.70 listed in wl.mailspike.net]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[74.125.82.70 listed in bl.score.senderscore.com]

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

2.0 RATWR8_MESSID Message-ID with excessive dashes and dollars

-0.0 RCVD_IN_MSPIKE_WL Mailspike good senders

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

Subject: {SPAM?} Re: Could we set up a meeting?



--000000000000113bf80651c32e7f

Content-Type: text/plain; charset="UTF-8"; format=flowed; delsp=yes



Hi,



I came across your website www.nk.ca and noticed it has strong potential.

With SEO, your business can gain more visibility, attract targeted

customers, and achieve steady growth compared to ads.



Without SEO, however, competitors may capture your audience, your online

presence may stay restricted, and valuable opportunities can be missed.



Would you like me to share a tailored SEO plan with details?



Thank You!!



--000000000000113bf80651c32e7f

Content-Type: text/html; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable



Hi,

I came across your website www.nk.ca and noticed it has strong p=

otential. With SEO, your business can gain more visibility, attract targete=

d customers, and achieve steady growth compared to ads.

Without SEO,=

however, competitors may capture your audience, your online presence may s=

tay restricted, and valuable opportunities can be missed.

Would you =

like me to share a tailored SEO plan with details?

Thank You!!


--000000000000113bf80651c32e7f--

Chinese spam

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@nk.ca

Delivery-date: Thu, 14 May 2026 00:45:00 -0600

Received: from out0-7.static.mail.aliyun.com ([59.82.0.7]:35038)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wNPnu-00000000M8i-3TXY

for dave@nk.ca;

Thu, 14 May 2026 00:44:28 -0600

X-Alimail-AntiSpam:AC=CONTINUE;BC=0.8502186|0.7928596;BR=01201311R841S95rulernew999_84748_200303;CH=yellow;DM=|SPAM|false|;DS=CONTINUE|ham_alarm|0.107512-0.0794212-0.813067;FP=2274828657281376505|0|0|0|0|-1|-1|-1;HT=maildocker-contentspam033045213054;MF=jojo.x@win-globaldata.com;NM=1;PH=DS;RN=58;RT=0;SR=0;TI=SMTPD_---.hWpp.oN_1778741000;

Received: from OS-20250105HJWK(mailfrom:jojo.x@win-globaldata.com fp:SMTPD_---.hWpp.oN_1778741000 cluster:ay29)

by smtp.aliyun-inc.com;

Thu, 14 May 2026 14:43:23 +0800

Date: Thu, 14 May 2026 14:43:20 +0800

From: jojo.x

Message-ID:

Subject: =?utf-8?B?6auY6YCa6IOA5pe25Luj77yMMjAyNuW5tOiuoeeul+WFieWIuw==?=

=?utf-8?B?6L2v5Lu26KGM5Lia5biC5Zy66LCD5p+l5pWw5o2u5oql5ZGK?=

X-Mailer: MailMasterPC/4.19.4.1001 (Win10 22H2)

X-MailMaster-ShowOneRcpt: 1

X-CUSTOM-MAIL-MASTER-SENT-ID: A03FDEE3-6D0D-491A-9E92-0FA1F79526FB

MIME-Version: 1.0

Content-Type: text/html; charset="utf-8"

Content-Transfer-Encoding: base64





您好,近期我司出版一份付费市场调查报告—《2026年全球与中国计算光刻软件市场现状及未来发展趋势》。

报告着重研究计算光刻软件行业竞争格局,重点分析全球主要厂商产能、销量、收入、产品价格和市场份额,全球产地、销地分布情况等。

此外针对计算光刻软件行业产品分类、应用、产业链、生产模式、销售模式、行业政策、行业发展有利因素、不利因素和进入壁垒也做了详细分析。

如果您有兴趣了解更多内容,可以为您提供一份样品(可选中、英文),以供参考。

全球及国内主要厂商包括:

ASML, KLA, Siemens, Synopsys, Cadence, Dongfang Jingyuan Electron Co., Ltd., Yuwei Optics

......

如果此份报告不适合您,请帮忙转发给贵司的市场部或管理层,感谢您的协助。此外,我司还出版其他产品的调查分析,如有需要,烦请告知。

谢谢您的阅读,顺祝商祺!





------------------

Best Regards

Jojo Yang | Global Sales Manager

E-mail: jojo@winmarketresearch.com

Phone/WeChat/WhatsApp: +86-18026352358 (7*24)

TEL: US: +1-888-365-4458(US) +1-202-499-1434(Int'L)

USA Office: 17890 Castleton Street Suite 369 City of Industry CA 91748 United States

China Office: VILI International Building No.167 Tianhe District Guangzhou City China

Nexcess Phish Part 2



------=_NextPart_000_7695_5E87E50C.E1ECABF9

Content-Type: text/plain;

charset="utf-8"

Content-Transfer-Encoding: quoted-printable







Notice Ref: ADMIN-BILL-77291

Mandatory Update of Account Billing Information

Dear sales@nk.ca,

During a recent administrative audit of your Nexcess Services account, our =

system identified that your current billing credentials are either incomple=

te or have expired.

Attention: Failure to maintain valid billing information may result in a di=

sruption of your hosted services and automated suspension of your account a=

ccess.

To ensure uninterrupted service continuity, we require you to verify and up=

date your administrative profile through our secure billing portal immediat=

ely.

Access Billing Management Panel

For further assistance regarding this compliance requirement, please contac=

t our billing department directly at support@Nexcess.net.







Best Regards,

Billing Administration Department

Nexcess Services

This is a system-generated administrative notification. Please do not reply=

directly to this email.

=C2=A9 2026 Nexcess Services. All Rights Reserved.=20=



------=_NextPart_000_7695_5E87E50C.E1ECABF9

Content-Type: text/html;

charset="utf-8"

Content-Transfer-Encoding: quoted-printable







Urgent: Account Administrative Action Requir=<br /><br /> ed










acing=3D0 cols=3D1 cellPadding=3D0 width=3D"100%" align=3Dleft border=3D0><=

tbody>




lPadding=3D0 width=3D"100%" align=3Dleft border=3D0>







3D"Nexce=<br
ss" src=3D"https://sm.pcmag.com/pcmag_me/review/n/nexcess-we/nexcess-web-ho=

sting_x5sc.jpg">=20





Notice Ref: ADMIN-BILL-77291


Mandatory Up=

date of=20

Account Billing Information



Dear sales@nk.ca,



During a recent administrative audit of your Nexcess=20

Services
account, our system identified that your current billing=

=20

credentials are either incomplete or have expired.



Attention: Failure to maintain va=

lid=20

billing information may result in a disruption of your hosted services and=

=20

automated suspension of your account access.


To ensure uninterrupted service continuity, we require =

you=20

to verify and update your administrative profile through our secure billing=

=20

portal immediately.





For further assistance regar=

ding=20

this compliance requirement, please contact our billing department directly=

at=20

support@Nexcess.net.





0px; BORDER-LEFT: 0px; MARGIN: 25px 0px">



Best Regards,
Billing=20

Administration Department
Nexcess Services



This is a system-generated administrative notificatio=

n. Please=20

do not reply directly to this email.
=C2=A9 2026 Nexcess Services. All R=

ights=20

Reserved.




------=_NextPart_000_7695_5E87E50C.E1ECABF9--

Follow up spam from Google Gmail

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 14 May 2026 04:47:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wNTZv-00000000MfK-1HoY

for dave@doctor.nl2k.ab.ca;

Thu, 14 May 2026 04:46:07 -0600

Resent-From: The Doctor

Resent-Date: Thu, 14 May 2026 04:46:07 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-qk1-f196.google.com ([209.85.222.196]:61834)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wNPNb-00000000K68-2WD4

for root@nk.ca;

Thu, 14 May 2026 00:17:17 -0600

Received: by mail-qk1-f196.google.com with SMTP id af79cd13be357-90f850473f9so204738485a.3

for ; Wed, 13 May 2026 23:16:20 -0700 (PDT)

ARC-Seal: i=1; a=rsa-sha256; t=1778739374; cv=none;

d=google.com; s=arc-20240605;

b=AIYS9l4qmeyuoe7lYRi+2ShgNEdmKRSaqRR405SFLKq3CJ+5Q3dQTg4CYB2GweSDsO

DK62omFJ8ZkbB1ltndXMkV67lANvdEozFCaL504G6hk/C2Zv2hhAlsEJndVbgwxwqOUu

QhxAoXKIBEkKuceOX9SdUq43HgN4HfYmp6OgjJ6nTKj3DwTYuzFntXtIBps8LNBUwmon

X/JqBj3kd/IItcNMUNm6EqGzrwas2OIS09PyUgV/75noKMCVdANzMhPkoaVh3bWdLPfo

+dA83yjusUOXwtDaBfWQb23A75yFG5N0I0fi3ZweRL/CPxUksaX5qtez1b64J/8+ByTU

OFog==

ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20240605;

h=to:subject:message-id:date:from:mime-version:dkim-signature;

bh=jAhtNbVkyUYVopTduQYINAuDwGdf5tSkX5IbrBSumbE=;

fh=ny7+SATv4n6lSNl0rVMQyaj6POVJTUZJLShjjgjSTJg=;

b=ThVB6k1/T2v16u42eGCakbXuKAt4kjFLNau65S2W1c83/eGeQftQKGsk130kLEDmk+

ZnppLhgo+24saviLGt0JAvSLFHbv+pMaiw11U8X3laMr8xdbfBXT4eKuLmTIJ48uBSNz

fmzCVsnS8SNeBLCMuAcA3rhCGHQwjVxqYG+IUkgtDQGIQbOto0pZptxUn5JP31+xD9bY

evfB9xCuUe6c7zQAF795sL15oDRGjy//s3Sjo9gkam/ch5Oq5D7cneIzK3VF+hTnQaPQ

txNt4lJUM9vl8Xo1jhUvGCFsglaiILB5nHX8Hr3b2utixV4tD6mFwsKg3ezpsSpfn2Il

CmhQ==;

darn=nk.ca

ARC-Authentication-Results: i=1; mx.google.com; arc=none

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=gmail.com; s=20251104; t=1778739374; x=1779344174; darn=nk.ca;

h=to:subject:message-id:date:from:mime-version:from:to:cc:subject

:date:message-id:reply-to;

bh=jAhtNbVkyUYVopTduQYINAuDwGdf5tSkX5IbrBSumbE=;

b=pHOVymijtOl77TLwRUlHBKq1Z+ms0H7/t5kqQDfS715yt7jc3uVpJxB17Q8uCFIK3e

jqOwfhcgOkmJaQHLwcNPBpQCz4FMaIcvjorDR2QHbYFQnOo6kPqH120wbABlDSpMOMHW

So97dCLb7hQWV/BszfoR4/gY7wyjPMuetyliCL29/iuLYuliU4PBmLjW23WVvHfQb2TP

Jg4nIQetYgms6mkBuYA4uJc58ufStFcRFNR0SU4m+wePEkJ5c5h4J7yTVAXcYo8dPrJM

0rtfONB2m6bMtDTStKfLIf5FjL/Riuv78jYJB9jTqfRCF3MCYuWwnDiiipcZZR75H5fF

BCRQ==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20251104; t=1778739374; x=1779344174;

h=to:subject:message-id:date:from:mime-version:x-gm-gg

:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to;

bh=jAhtNbVkyUYVopTduQYINAuDwGdf5tSkX5IbrBSumbE=;

b=jjqgbr8c2Dyft9l7Ued3wDcXfwGFVv9l3hles7wlY+Jq7Sjk2t2las92Q4EfQ3CFcT

cjARUPxHg3PAFG2KPR6Abb/hoUgKqma9OTa38q3u0C1XdDowXik/iJ3B7d771uOuDt2Z

avzFAar65gp6+hJgfGTz0zvZN6VgQKB0kR/B0vZ/CvMWUSZMbAi+jgcZHHEsB6+bw7b/

T4c0BE7Zgsznw/xwtEK+vDggXnwP+L4O+eV0GcbVJ5dOwGdM62pmkWLNPbsnZ0gS73de

Vsoe7LnrtGP/zdEympF0xg3QO/rh96x4AipVtGIbr3VNHx+RdEckPlZ+bn3y4xHJqwjP

//bw==

X-Gm-Message-State: AOJu0YyOyr4DDj7+SB5lUSP2tX2VV3ibBEXPaVw51swVMk9CDzgjS+Ik

TH77tmFFkOhIOyDKw5lsHEvkaEGcmMAi2WeaN15AxrAYATFixx1JZ2ECLjH5uPwtt/6Md3iYTOk

TuM0N86ElkfnsJb+n+plUEMBh4yi54c9q2SatWPLglh//

X-Gm-Gg: Acq92OHGBy01D95od3+rHF+BwSSm0BRuzTPLlXneesZcJSRSehqfPf/Su13FZx8E19w

AFnqHMk0g5PbA0/6XxLSPT35ZpUY6JLIeutY2O0GY4vK4yvAaYw4QGm9+Lo/TRGl54OMKH8r1dX

g5lcY67VArroBGCPaDIQm6r/VC2SZwrw9Ss1kdDn6n6vq1pzpYBrTVFf7XQc7wny8uggCWA7N5L

H1eI+A6pZ7gdsnSzs+WD4M3OIeVh0pV1+rt0uWrojBc4kSAhH/sZ0TRPYda7WQaQWaPyKxk8yBc

LiAwpN+ZgI4Am2S3qfURM+Q=

X-Received: by 2002:a05:620a:7107:b0:90f:786c:8961 with SMTP id

af79cd13be357-90facf9e2cfmr937189385a.39.1778739373361; Wed, 13 May 2026

23:16:13 -0700 (PDT)

MIME-Version: 1.0

From: Onur Genc

Date: Thu, 14 May 2026 07:15:50 +0100

X-Gm-Features: AVHnY4IYDxhUXdQlZEACQ8gHHyzahuNliApfmKWM53P_bfzYX1GghqFxTpfobiI

Message-ID:

Subject: Service request

To: root@nk.ca

Content-Type: multipart/alternative; boundary="0000000000007f4ef30651c108b5"



--0000000000007f4ef30651c108b5

Content-Type: text/plain; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable



Greetings,



I have tried to reach out to you in the past but you seems not active,

Let me know if it's okay for me to send specifics of a proposal to your

email address since I have it from LinkedIn.




Warm regards,

Onur Gen=C3=A7..

Chief Executive Officer.



[image: Your profile picture]



--0000000000007f4ef30651c108b5

Content-Type: text/html; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable





=3D"gmail_signature" data-smartmail=3D"gmail_signature">

iv style=3D"color:rgb(34,34,34);font-family:"Helvetica Neue",Helv=

etica,Arial,sans-serif">

f">Greetings,

nt-family:Arial,Helvetica,sans-serif"><=

br>
<=

span style=3D"color:rgb(0,0,0)">I have tried to reach out to you =C2=A0i=

n the past but you seems not active, Let me know if it's okay for me to=

send specifics of a proposal to your email address since I have it from Li=

nkedIn.

f">

y:Arial,Helvetica,sans-serif">
Warm =

regards,
Onur Gen=C3=A7=

..
Chief Executive Officer.

>

t=3D"Your profile picture" width=3D"96" height=3D"96" style=3D"border-width=

:medium;border-style:none;border-color:currentcolor;border-radius:50%;max-w=

idth:288px;font-family:"Google Sans Flex","Google Sans Text&=

quot;,"Google Sans",Roboto,Arial,sans-serif;background-color:rgb(=

248,250,253)">
<=

/div>




--0000000000007f4ef30651c108b5--

Nexcess Phish Part 1

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Wed, 13 May 2026 19:56:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wNLIQ-000000004Kv-2bDR

for dave@doctor.nl2k.ab.ca;

Wed, 13 May 2026 19:55:30 -0600

Resent-From: The Doctor

Resent-Date: Wed, 13 May 2026 19:55:30 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from smtp2-2213.emaillabs.net.pl ([185.243.31.188]:35606)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wNKWp-00000000GXJ-2klb

for sales@nk.ca;

Wed, 13 May 2026 19:06:29 -0600

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=newsletter.noreplaysender.xyz; s=default; t=1778720725;

bh=bGrCBiVjpnHKJpJVEFwX4SxWgtJJnNKYtvvqxxghY14=;

h=From:To:Subject:Date:Feedback-ID;

b=KVmLepF7ODFOQOUkSLQXzz13vKY88twYfbsJZ6KKbt4BEeUrcSgpOY/lyc6rx/9Ur

BqrBAVWAZWdtC82r7FUo4/Mf4t7GrOeaPs2rnOtfjxe6tFth5HHEBIHsMu2Jv8r1kE

0BHdVxoH857NH9iACb2zmYTHEzBMDorfD3y8Hi8Jcn0a00JX43xVnIypQTijp3v6PC

a9n6FST1fGMfcEQLcod26z0GLb3K70G5DxvQZos41FLOL1UcmEgoYCCcmg5/rHeZlJ

fJYYy2j+zD1X8AIGlV28ZtLgRkhQaPY5PeusNpwvU9krFtWshT1kNJnydT4Nfu7Hyu

WF5BkW4qblcLw==

MIME-Version: 1.0

X-Mailer: Microsoft Outlook 14.0

Reply-To: "Nexcess"

Message-ID:

X-Priority: 1 (Highest)

From: "Nexcess"

To: sales@nk.ca

Subject: Urgent: Account Administrative Action Required

Date: Wed, 13 May 2026 21:05:00 -0400

Content-Type: multipart/alternative;

boundary="----=_NextPart_000_7695_5E87E50C.E1ECABF9"

Feedback-ID: :click.newsletter.noreplaysender.xyz:1.nexuscrafttrading.smtp:default

X-Sid: info@newsletter.noreplaysender.xyz

X-Return-Path:

X-Spam_score: 11.9

X-Spam_score_int: 119

X-Spam_bar: +++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Notice Ref: ADMIN-BILL-77291 Mandatory Update of Account

Billing Information Dear sales@nk.ca, During a recent administrative audit

of your Nexcess Services account, our system identified that your cu [...]





Content analysis details: (11.9 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[185.243.31.188 listed in dnsbl.ahbl.org]

[185.243.31.188 listed in dnsbl.ahbl.org]

[185.243.31.188 listed in dnsbl.ahbl.org]

[185.243.31.188 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[185.243.31.188 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[185.243.31.188 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[185.243.31.188 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[185.243.31.188 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[185.243.31.188 listed in will-spam-for-food.eu.org]

[185.243.31.188 listed in will-spam-for-food.eu.org]

[185.243.31.188 listed in will-spam-for-food.eu.org]

[185.243.31.188 listed in will-spam-for-food.eu.org]

[185.243.31.188 listed in will-spam-for-food.eu.org]

[185.243.31.188 listed in will-spam-for-food.eu.org]

[185.243.31.188 listed in will-spam-for-food.eu.org]

[185.243.31.188 listed in will-spam-for-food.eu.org]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-0.0 SPF_PASS SPF: sender matches SPF record

0.7 FROM_FMBLA_NEWDOM From domain was registered in last 7 days

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[185.243.31.188 listed in bl.score.senderscore.com]

2.0 PDS_OTHER_BAD_TLD Untrustworthy TLDs

[URI: newsletter.noreplaysender.xyz]

[(xyz)]

1.5 DEAR_EMAIL BODY: Message contains Dear email address

0.5 L_HELLO_ADDRESS BODY: Greets you by address, not by name

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.5 FROM_SUSPICIOUS_NTLD From abused NTLD

2.0 FROM_SUSPICIOUS_NTLD_FP From abused NTLD

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

0.8 SARE_FROM_SPAM_WORD3 I don't know people named this!

1.0 XPRIO Has X-Priority header

1.4 DOS_OUTLOOK_TO_MX Delivered direct to MX with Outlook headers

Subject: {SPAM?} Urgent: Account Administrative Action Required

Follow up spam from Google Gmail

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Wed, 13 May 2026 19:56:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wNLI2-000000003no-3wz0

for dave@doctor.nl2k.ab.ca;

Wed, 13 May 2026 19:55:06 -0600

Resent-From: The Doctor

Resent-Date: Wed, 13 May 2026 19:55:06 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-ej1-f65.google.com ([209.85.218.65]:50660)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wNIZ0-000000007Ct-1fdc

for root@nk.ca;

Wed, 13 May 2026 17:00:35 -0600

Received: by mail-ej1-f65.google.com with SMTP id a640c23a62f3a-bcb5370bb0dso1076404966b.1

for ; Wed, 13 May 2026 15:59:38 -0700 (PDT)

ARC-Seal: i=1; a=rsa-sha256; t=1778713171; cv=none;

d=google.com; s=arc-20240605;

b=b82SU/UmttVfeG9wkLxFVb5rn348LU6KvlcKNpt1negB5Kv0lPM8/iapmfoZY2ckvj

/4GX0g7KZZeYpRNsTn1c2gVBhpxhESU5UX2f1QvqQcj1Wg9snBhfBep7EniDEpDPDwLO

vbw0AKwD0iyS4HZ5civSGwaKwAQrpMaLHdFCeBPmnuMXT1hZ4XFgBYiHckLBP/aPiMov

goJfTFK+URCzRs+1irNV4V0RbRqZdMBBM5xsLi9kvcmt/JmVwM5AesM8PCM/Xm+3vNYv

jGRCjB8HoWVksgP+M3hQCX780a8jMMb28QJEUhpFV9r8qMu8heHOKjRKMQdZQ8kStrr1

Ajlg==

ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20240605;

h=to:subject:message-id:date:from:mime-version:dkim-signature;

bh=IeyKm+J5Zin1MRG7E74zjOvTTyuq+EJ0fBPrB7qPr5g=;

fh=okLrRxdcQ5S5mQ3G3iQaC7KbaU25FN62J8W+dLvpK/A=;

b=RIkg3OEYAT6SLpLq8nNlT4fnxeoFF5uClrVVohPRYMUyhAGCZ2uesm1ayV5Mh/xT7X

74JLGUeBOp8eZrxcr1GORnnFV36/UOarayH4FW06vT99Luo+EuSa6qpCD5wMbtjFzwDb

FC3o3EgOGVkfAP+vyQSkgrdxP2Dxtt64ehyUHNyuj/f6BdFRH+jHmgJ1rmvyyQlF5Sxp

aDqBbh6U9fAZQazvqAUKULRE8KI/+Jc4BzysyP6W96cldiyxltmcbgn93zem+JJrycJ4

OSmcRA/dtmUNpmOGJq9syaEGW/KCsBcYbvkTRE8MPz7FS/P0QpJdmMQlJkpMMh54GQrO

9B6g==;

darn=nk.ca

ARC-Authentication-Results: i=1; mx.google.com; arc=none

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=gmail.com; s=20251104; t=1778713171; x=1779317971; darn=nk.ca;

h=to:subject:message-id:date:from:mime-version:from:to:cc:subject

:date:message-id:reply-to;

bh=IeyKm+J5Zin1MRG7E74zjOvTTyuq+EJ0fBPrB7qPr5g=;

b=qzt06iPq4ODeBl9dJk3+YVhlEVxPxTEulXnZykbrWPtjoLZ2HfaLfVxHAPVj+13v7B

uabh4U0GrEhYsj7hYKJhrjpGUqkKocTphf0+6Wy+5zbCp5Kj7hic5vLgc9gJSpYaaL83

2QTs4ocqcU1d5jaxaHvFOLgZTkAHHwlpCZk5pMYMzVeCYWoqQArttTNr/uvRob9aZRzS

8CwEB2hgIqM4Mh4KqCVnfWus/MXkATdTlixB2iXMf03Xn7f4FHJzZJWkODNUlFMaoPtk

jLIdmvzTnShvH/qNdtnpBm1yCiolp7FUgNhId8fzfGoRoSqYrw950BOzikWN7X0Xf6KA

Y+UA==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20251104; t=1778713171; x=1779317971;

h=to:subject:message-id:date:from:mime-version:x-gm-gg

:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to;

bh=IeyKm+J5Zin1MRG7E74zjOvTTyuq+EJ0fBPrB7qPr5g=;

b=gq8GXbmdmW0OvHsasJ33NpX5fT7KJ+nHV7ML28nR5+Sf3WoCD8pDV7dMsGv89NUNc+

aLL54AAbCySeEG3aOJYaIWlvTPybSrkMdf5EWmSKu7cwAA3jRPX05Q5KoEdke3ay9XwG

zYyJ8n/pgAIkC5aqIgykowBAGbZMxncmfga01aSy8XRw2jRZ7FyyU8aGB0S1PfsXRDrE

if5HZWzbAPkS+DSeVL4QTuEZCBgIpsHcK5S5EQQTTK1EfXgYzOvlKLdWoBZHP/qkhP44

P2QczK6/LDfQyn+y1BIiQbGf+dMvG7Z5sLEl2/cfQPEqJH6YFEK3AV7BpFUi8QCYWmFk

rR2g==

X-Forwarded-Encrypted: i=1; AFNElJ9wqneOd3s/edYgJ6Ebn8WsRk3/vllJBCr0x/skKf08Ed3mNdA9df5Q40/1dO8gitJ3daAD@nk.ca

X-Gm-Message-State: AOJu0YzupOlQBCCAvdA4FhyG0za8Y+8QMbnnJ1F/88F57xgj79VZHKAX

J9fptdGzLoVm91G+2E85yBAV00EsZce4scWtDK1+SSwp8xFSO8QadVQkvqDQhP84d2+F4JFNTvj

WjprVIbzXBPqDPbK3z/mC2BvFjKUDDYY=

X-Gm-Gg: Acq92OHA5cuauQmyGL+YYIMD7VRzfNWCn4y1GTLhXifHuNL4Ks2Ow96UqLriU6BY31U

1anmMfH674wgFOZ3DEz/JoibCP+L6mQk23mxfvPOGCmMeHVjyouS7NBT3+RC1yybi/FLro0/ejK

e78yA8WgLFmqaEHj1HIVKvFgbunNX5rCKvePCoO1gRChYoW0pVHQe1lCcEPYCuxCtkCvw4h4QJR

nRL4MB6FUTeMeEnkzdfjaXCnFug/YsO2KFuDaMsgq2oah8wuXjZxCiPAvSv2UF1RdNp9dbr7lHT

yCRPf8b+ZOyCIJPNKwpNeMM2

X-Received: by 2002:a17:907:7f8b:b0:bc4:c901:20fc with SMTP id

a640c23a62f3a-bd3c1400c9emr357009566b.30.1778713171556; Wed, 13 May 2026

15:59:31 -0700 (PDT)

MIME-Version: 1.0

Received: by 2002:a17:906:af48:b0:bc2:a455:439 with HTTP; Wed, 13 May 2026

15:59:30 -0700 (PDT)

From: Jessica Jessica

Date: Wed, 13 May 2026 15:59:30 -0700

X-Gm-Features: AVHnY4K70BRIU3AhRrUjnO5dqHkKmVJDAMu82rLsFOh6ZEPHFk2m6kEo7l6sG4Y

Message-ID:

Subject: hello

To: undisclosed-recipients:;

Content-Type: multipart/alternative; boundary="000000000000bf7f030651baeea4"

Bcc: root@nk.ca



--000000000000bf7f030651baeea4

Content-Type: text/plain; charset="UTF-8"



Good day,

I didn't get your response from my previous

email. Kindly get back to me as soon as

possible.



Thank you.

jessica



--000000000000bf7f030651baeea4

Content-Type: text/html; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable



Good day,
I didn't get your response from my previous
email. Kind=

ly get back to me as soon as
possible.

Thank you.=C2=A0
>
jessica=C2=A0




--000000000000bf7f030651baeea4--

Invoice Phish

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Wed, 13 May 2026 19:55:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wNLH6-000000002hU-0cph

for dave@doctor.nl2k.ab.ca;

Wed, 13 May 2026 19:54:08 -0600

Resent-From: The Doctor

Resent-Date: Wed, 13 May 2026 19:54:08 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from ip74-208-96-234.pbiaas.com ([]:64912)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wNHfK-000000002Py-0Mk1

for games@nl2k.ab.ca;

Wed, 13 May 2026 16:03:02 -0600

Reply-To: farranbarrow@studiomodernitta.com.br

From: "Farran Barrow"

To: games@nl2k.ab.ca

Subject: lnvoice

Date: 13 May 2026 22:02:05 +0000

Message-ID: <20260513220205.1258A40049E294EA@canva.com>

MIME-Version: 1.0

Content-Type: text/plain;

charset="utf-8"

Content-Transfer-Encoding: quoted-printable

X-Spam_score: 7.0

X-Spam_score_int: 70

X-Spam_bar: +++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.

74.208.96.234

Content preview: Please view the attached Invoice copy or request for the download

invoice link. Sent to : games@nl2k.ab.ca Thanks,



Content analysis details: (7.0 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[74.208.96.234 listed in dnsbl.ahbl.org]

[74.208.96.234 listed in dnsbl.ahbl.org]

[74.208.96.234 listed in dnsbl.ahbl.org]

[74.208.96.234 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[74.208.96.234 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[74.208.96.234 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[74.208.96.234 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[74.208.96.234 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[74.208.96.234 listed in will-spam-for-food.eu.org]

[74.208.96.234 listed in will-spam-for-food.eu.org]

[74.208.96.234 listed in will-spam-for-food.eu.org]

[74.208.96.234 listed in will-spam-for-food.eu.org]

[74.208.96.234 listed in will-spam-for-food.eu.org]

[74.208.96.234 listed in will-spam-for-food.eu.org]

[74.208.96.234 listed in will-spam-for-food.eu.org]

[74.208.96.234 listed in will-spam-for-food.eu.org]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[74.208.96.234 listed in bl.score.senderscore.com]

0.9 SPF_FAIL SPF: sender does not match SPF record (fail)

[SPF failed: Rejected by SPF record.]

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

0.5 ONE_WORD_SUBJECT Subject with only one lower-case word

1.0 FROM_MISSP_SPF_FAIL No description available.

0.4 RDNS_DYNAMIC Delivered to internal network by host with

dynamic-looking rDNS

0.7 TO_NO_BRKTS_FROM_MSSP Multiple formatting errors

1.7 FROM_MISSP_DYNIP From misspaced + dynamic rDNS

0.0 FROM_MISSPACED From: missing whitespace

0.3 FROM_MISSP_EH_MATCH From misspaced, matches envelope

Subject: {SPAM?} lnvoice



Please view the attached Invoice copy or request for the download=20

invoice link.



Sent to : games@nl2k.ab.ca



Thanks,



Farran Barrow



Gulf Coast Gasket Guy

8722 Rand Ave., Ste A

Daphne, AL 36526

877-626-0701

Invoice phish

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Wed, 13 May 2026 19:55:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wNLHC-000000002jp-3zEl

for dave@doctor.nl2k.ab.ca;

Wed, 13 May 2026 19:54:14 -0600

Resent-From: The Doctor

Resent-Date: Wed, 13 May 2026 19:54:14 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from ip74-208-96-234.pbiaas.com ([74.208.96.234]:60480)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wNI3q-000000004D6-3F7s

for doctor@mail.nl2k.ab.ca;

Wed, 13 May 2026 16:28:23 -0600

Reply-To: farranbarrow@studiomodernitta.com.br

From: "Farran Barrow"

To: doctor@mail.nl2k.ab.ca

Subject: Re: lnvoice

Date: 13 May 2026 22:27:26 +0000

Message-ID: <20260513222726.0F42FDC0E24CFBDA@canva.com>

MIME-Version: 1.0

Content-Type: text/plain;

charset="utf-8"

Content-Transfer-Encoding: quoted-printable

X-Spam_score: 7.1

X-Spam_score_int: 71

X-Spam_bar: +++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Please view the attached Invoice copy or request for the download

invoice link. Sent to : doctor@mail.nl2k.ab.ca Thanks,



Content analysis details: (7.1 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.6 RCVD_IN_BRBL_LASTEXT RBL: No description available.

[74.208.96.234 listed in bb.barracudacentral.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[74.208.96.234 listed in dnsbl.ahbl.org]

[74.208.96.234 listed in dnsbl.ahbl.org]

[74.208.96.234 listed in dnsbl.ahbl.org]

[74.208.96.234 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[74.208.96.234 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[74.208.96.234 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[74.208.96.234 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[74.208.96.234 listed in dnsbl.ahbl.org]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[74.208.96.234 listed in bl.score.senderscore.com]

0.9 SPF_FAIL SPF: sender does not match SPF record (fail)

[SPF failed: Rejected by SPF record.]

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

1.0 FROM_MISSP_SPF_FAIL No description available.

0.4 RDNS_DYNAMIC Delivered to internal network by host with

dynamic-looking rDNS

1.7 FROM_MISSP_DYNIP From misspaced + dynamic rDNS

0.0 FROM_MISSPACED From: missing whitespace

0.3 FROM_MISSP_EH_MATCH From misspaced, matches envelope

0.7 TO_NO_BRKTS_FROM_MSSP Multiple formatting errors

Subject: {SPAM?} Re: lnvoice



Please view the attached Invoice copy or request for the download=20

invoice link.



Sent to : doctor@mail.nl2k.ab.ca



Thanks,



Farran Barrow



Gulf Coast Gasket Guy

8722 Rand Ave., Ste A

Daphne, AL 36526

877-626-0701

Invoice phish

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Wed, 13 May 2026 19:55:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wNLH6-000000002hU-0cph

for dave@doctor.nl2k.ab.ca;

Wed, 13 May 2026 19:54:08 -0600

Resent-From: The Doctor

Resent-Date: Wed, 13 May 2026 19:54:08 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from ip74-208-96-234.pbiaas.com ([74.208.96.234]:64912)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wNHfK-000000002Py-0Mk1

for games@nl2k.ab.ca;

Wed, 13 May 2026 16:03:02 -0600

Reply-To: farranbarrow@studiomodernitta.com.br

From: "Farran Barrow"

To: games@nl2k.ab.ca

Subject: lnvoice

Date: 13 May 2026 22:02:05 +0000

Message-ID: <20260513220205.1258A40049E294EA@canva.com>

MIME-Version: 1.0

Content-Type: text/plain;

charset="utf-8"

Content-Transfer-Encoding: quoted-printable

X-Spam_score: 7.0

X-Spam_score_int: 70

X-Spam_bar: +++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Please view the attached Invoice copy or request for the download

invoice link. Sent to : games@nl2k.ab.ca Thanks,



Content analysis details: (7.0 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[74.208.96.234 listed in dnsbl.ahbl.org]

[74.208.96.234 listed in dnsbl.ahbl.org]

[74.208.96.234 listed in dnsbl.ahbl.org]

[74.208.96.234 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[74.208.96.234 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[74.208.96.234 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[74.208.96.234 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[74.208.96.234 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[74.208.96.234 listed in will-spam-for-food.eu.org]

[74.208.96.234 listed in will-spam-for-food.eu.org]

[74.208.96.234 listed in will-spam-for-food.eu.org]

[74.208.96.234 listed in will-spam-for-food.eu.org]

[74.208.96.234 listed in will-spam-for-food.eu.org]

[74.208.96.234 listed in will-spam-for-food.eu.org]

[74.208.96.234 listed in will-spam-for-food.eu.org]

[74.208.96.234 listed in will-spam-for-food.eu.org]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[74.208.96.234 listed in bl.score.senderscore.com]

0.9 SPF_FAIL SPF: sender does not match SPF record (fail)

[SPF failed: Rejected by SPF record.]

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

0.5 ONE_WORD_SUBJECT Subject with only one lower-case word

1.0 FROM_MISSP_SPF_FAIL No description available.

0.4 RDNS_DYNAMIC Delivered to internal network by host with

dynamic-looking rDNS

0.7 TO_NO_BRKTS_FROM_MSSP Multiple formatting errors

1.7 FROM_MISSP_DYNIP From misspaced + dynamic rDNS

0.0 FROM_MISSPACED From: missing whitespace

0.3 FROM_MISSP_EH_MATCH From misspaced, matches envelope

Subject: {SPAM?} lnvoice



Please view the attached Invoice copy or request for the download=20

invoice link.



Sent to : games@nl2k.ab.ca



Thanks,



Farran Barrow



Gulf Coast Gasket Guy

8722 Rand Ave., Ste A

Daphne, AL 36526

877-626-0701

invoice phish

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Wed, 13 May 2026 19:54:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wNLGw-000000002dd-3OFb

for dave@doctor.nl2k.ab.ca;

Wed, 13 May 2026 19:53:58 -0600

Resent-From: The Doctor

Resent-Date: Wed, 13 May 2026 19:53:58 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from ip74-208-96-234.pbiaas.com ([74.208.96.234]:64405)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wNHSY-000000001Sd-0Sii

for doctor@nl2k.ab.ca;

Wed, 13 May 2026 15:49:50 -0600

Reply-To: farranbarrow@studiomodernitta.com.br

From: "Farran Barrow"

To: doctor@nl2k.ab.ca

Subject: Invoice copy

Date: 13 May 2026 21:48:53 +0000

Message-ID: <20260513214852.F4AEA2EEC0C4E34E@canva.com>

MIME-Version: 1.0

Content-Type: text/plain;

charset="utf-8"

Content-Transfer-Encoding: quoted-printable

X-Spam_score: 6.5

X-Spam_score_int: 65

X-Spam_bar: ++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Please view the attached Invoice copy or request for the download

invoice link. Sent to : doctor@nl2k.ab.ca Thanks,



Content analysis details: (6.5 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[74.208.96.234 listed in dnsbl.ahbl.org]

[74.208.96.234 listed in dnsbl.ahbl.org]

[74.208.96.234 listed in dnsbl.ahbl.org]

[74.208.96.234 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[74.208.96.234 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[74.208.96.234 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[74.208.96.234 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[74.208.96.234 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[74.208.96.234 listed in will-spam-for-food.eu.org]

[74.208.96.234 listed in will-spam-for-food.eu.org]

[74.208.96.234 listed in will-spam-for-food.eu.org]

[74.208.96.234 listed in will-spam-for-food.eu.org]

[74.208.96.234 listed in will-spam-for-food.eu.org]

[74.208.96.234 listed in will-spam-for-food.eu.org]

[74.208.96.234 listed in will-spam-for-food.eu.org]

[74.208.96.234 listed in will-spam-for-food.eu.org]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[74.208.96.234 listed in bl.score.senderscore.com]

0.9 SPF_FAIL SPF: sender does not match SPF record (fail)

[SPF failed: Rejected by SPF record.]

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

0.4 RDNS_DYNAMIC Delivered to internal network by host with

dynamic-looking rDNS

1.0 FROM_MISSP_SPF_FAIL No description available.

1.7 FROM_MISSP_DYNIP From misspaced + dynamic rDNS

0.7 TO_NO_BRKTS_FROM_MSSP Multiple formatting errors

0.0 FROM_MISSPACED From: missing whitespace

0.3 FROM_MISSP_EH_MATCH From misspaced, matches envelope

Subject: {SPAM?} Invoice copy



Please view the attached Invoice copy or request for the download=20

invoice link.



Sent to : doctor@nl2k.ab.ca



Thanks,



Farran Barrow



Gulf Coast Gasket Guy

8722 Rand Ave., Ste A

Daphne, AL 36526

877-626-0701

Invoice phish

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Wed, 13 May 2026 19:54:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wNLGq-000000002bT-1PSN

for dave@doctor.nl2k.ab.ca;

Wed, 13 May 2026 19:53:52 -0600

Resent-From: The Doctor

Resent-Date: Wed, 13 May 2026 19:53:52 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from ip74-208-96-234.pbiaas.com ([74.208.96.234]:53233)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wNHCu-000000000Qb-0pxs

for support@nk.ca;

Wed, 13 May 2026 15:33:40 -0600

Reply-To: farranbarrow@studiomodernitta.com.br

From: "Farran Barrow"

To: support@nk.ca

Subject: Re: lnvoice

Date: 13 May 2026 21:32:43 +0000

Message-ID: <20260513213243.848BD44D1B30DF1D@canva.com>

MIME-Version: 1.0

Content-Type: text/plain;

charset="utf-8"

Content-Transfer-Encoding: quoted-printable

X-Spam_score: 6.5

X-Spam_score_int: 65

X-Spam_bar: ++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Please view the attached Invoice copy or request for the download

invoice link. Sent to : support@nk.ca Thanks,



Content analysis details: (6.5 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[74.208.96.234 listed in dnsbl.ahbl.org]

[74.208.96.234 listed in dnsbl.ahbl.org]

[74.208.96.234 listed in dnsbl.ahbl.org]

[74.208.96.234 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[74.208.96.234 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[74.208.96.234 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[74.208.96.234 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[74.208.96.234 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[74.208.96.234 listed in will-spam-for-food.eu.org]

[74.208.96.234 listed in will-spam-for-food.eu.org]

[74.208.96.234 listed in will-spam-for-food.eu.org]

[74.208.96.234 listed in will-spam-for-food.eu.org]

[74.208.96.234 listed in will-spam-for-food.eu.org]

[74.208.96.234 listed in will-spam-for-food.eu.org]

[74.208.96.234 listed in will-spam-for-food.eu.org]

[74.208.96.234 listed in will-spam-for-food.eu.org]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[74.208.96.234 listed in bl.score.senderscore.com]

0.9 SPF_FAIL SPF: sender does not match SPF record (fail)

[SPF failed: Rejected by SPF record.]

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

0.4 RDNS_DYNAMIC Delivered to internal network by host with

dynamic-looking rDNS

1.0 FROM_MISSP_SPF_FAIL No description available.

1.7 FROM_MISSP_DYNIP From misspaced + dynamic rDNS

0.7 TO_NO_BRKTS_FROM_MSSP Multiple formatting errors

0.0 FROM_MISSPACED From: missing whitespace

0.3 FROM_MISSP_EH_MATCH From misspaced, matches envelope

Subject: {SPAM?} Re: lnvoice



Please view the attached Invoice copy or request for the download=20

invoice link.



Sent to : support@nk.ca



Thanks,



Farran Barrow



Gulf Coast Gasket Guy

8722 Rand Ave., Ste A

Daphne, AL 36526

877-626-0701

Invoice phish

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Wed, 13 May 2026 19:54:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wNLGZ-000000001c5-49Zf

for dave@doctor.nl2k.ab.ca;

Wed, 13 May 2026 19:53:35 -0600

Resent-From: The Doctor

Resent-Date: Wed, 13 May 2026 19:53:35 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from ip74-208-96-234.pbiaas.com ([74.208.96.234]:62843)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wNGlx-000000002vW-0I1K

for doctor@netknow.ca;

Wed, 13 May 2026 15:05:49 -0600

Reply-To: farranbarrow@studiomodernitta.com.br

From: "Farran Barrow"

To: doctor@netknow.ca

Subject: lnvoice

Date: 13 May 2026 21:04:52 +0000

Message-ID: <20260513210452.5D7D170B63BE0754@canva.com>

MIME-Version: 1.0

Content-Type: text/plain;

charset="utf-8"

Content-Transfer-Encoding: quoted-printable

X-Spam_score: 7.0

X-Spam_score_int: 70

X-Spam_bar: +++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Please view the attached Invoice copy or request for the download

invoice link. Sent to : doctor@netknow.ca Thanks,



Content analysis details: (7.0 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[74.208.96.234 listed in dnsbl.ahbl.org]

[74.208.96.234 listed in dnsbl.ahbl.org]

[74.208.96.234 listed in dnsbl.ahbl.org]

[74.208.96.234 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[74.208.96.234 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[74.208.96.234 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[74.208.96.234 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[74.208.96.234 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[74.208.96.234 listed in will-spam-for-food.eu.org]

[74.208.96.234 listed in will-spam-for-food.eu.org]

[74.208.96.234 listed in will-spam-for-food.eu.org]

[74.208.96.234 listed in will-spam-for-food.eu.org]

[74.208.96.234 listed in will-spam-for-food.eu.org]

[74.208.96.234 listed in will-spam-for-food.eu.org]

[74.208.96.234 listed in will-spam-for-food.eu.org]

[74.208.96.234 listed in will-spam-for-food.eu.org]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

0.9 SPF_FAIL SPF: sender does not match SPF record (fail)

[SPF failed: Rejected by SPF record.]

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

0.5 ONE_WORD_SUBJECT Subject with only one lower-case word

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[74.208.96.234 listed in bl.score.senderscore.com]

1.0 FROM_MISSP_SPF_FAIL No description available.

0.4 RDNS_DYNAMIC Delivered to internal network by host with

dynamic-looking rDNS

0.7 TO_NO_BRKTS_FROM_MSSP Multiple formatting errors

1.7 FROM_MISSP_DYNIP From misspaced + dynamic rDNS

0.0 FROM_MISSPACED From: missing whitespace

0.3 FROM_MISSP_EH_MATCH From misspaced, matches envelope

Subject: {SPAM?} lnvoice



Please view the attached Invoice copy or request for the download=20

invoice link.



Sent to : doctor@netknow.ca



Thanks,



Farran Barrow



Gulf Coast Gasket Guy

8722 Rand Ave., Ste A

Daphne, AL 36526

877-626-0701

Invoice phish

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Wed, 13 May 2026 19:54:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wNLGN-000000000sN-2v6g

for dave@doctor.nl2k.ab.ca;

Wed, 13 May 2026 19:53:23 -0600

Resent-From: The Doctor

Resent-Date: Wed, 13 May 2026 19:53:23 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from ip74-208-96-234.pbiaas.com ([74.208.96.234]:55440)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wNGjm-0000000022q-03oG

for root@nl2k.ab.ca;

Wed, 13 May 2026 15:03:34 -0600

Reply-To: farranbarrow@studiomodernitta.com.br

From: "Farran Barrow"

To: root@nl2k.ab.ca

Subject: Re: lnvoice

Date: 13 May 2026 21:02:47 +0000

Message-ID: <20260513210247.C37CD2B45B171F52@canva.com>

MIME-Version: 1.0

Content-Type: text/plain;

charset="utf-8"

Content-Transfer-Encoding: quoted-printable

X-Spam_score: 6.5

X-Spam_score_int: 65

X-Spam_bar: ++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Please view the attached Invoice copy or request for the download

invoice link. Sent to : root@nl2k.ab.ca Thanks,



Content analysis details: (6.5 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[74.208.96.234 listed in dnsbl.ahbl.org]

[74.208.96.234 listed in dnsbl.ahbl.org]

[74.208.96.234 listed in dnsbl.ahbl.org]

[74.208.96.234 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[74.208.96.234 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[74.208.96.234 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[74.208.96.234 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[74.208.96.234 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[74.208.96.234 listed in will-spam-for-food.eu.org]

[74.208.96.234 listed in will-spam-for-food.eu.org]

[74.208.96.234 listed in will-spam-for-food.eu.org]

[74.208.96.234 listed in will-spam-for-food.eu.org]

[74.208.96.234 listed in will-spam-for-food.eu.org]

[74.208.96.234 listed in will-spam-for-food.eu.org]

[74.208.96.234 listed in will-spam-for-food.eu.org]

[74.208.96.234 listed in will-spam-for-food.eu.org]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[74.208.96.234 listed in bl.score.senderscore.com]

0.9 SPF_FAIL SPF: sender does not match SPF record (fail)

[SPF failed: Rejected by SPF record.]

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

1.0 FROM_MISSP_SPF_FAIL No description available.

0.4 RDNS_DYNAMIC Delivered to internal network by host with

dynamic-looking rDNS

0.3 FROM_MISSP_EH_MATCH From misspaced, matches envelope

0.0 FROM_MISSPACED From: missing whitespace

0.7 TO_NO_BRKTS_FROM_MSSP Multiple formatting errors

1.7 FROM_MISSP_DYNIP From misspaced + dynamic rDNS

Subject: {SPAM?} Re: lnvoice



Please view the attached Invoice copy or request for the download=20

invoice link.



Sent to : root@nl2k.ab.ca



Thanks,



Farran Barrow



Gulf Coast Gasket Guy

8722 Rand Ave., Ste A

Daphne, AL 36526

877-626-0701

Invoice phish

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Wed, 13 May 2026 19:54:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wNLGj-000000002GB-0Z7C

for dave@doctor.nl2k.ab.ca;

Wed, 13 May 2026 19:53:45 -0600

Resent-From: The Doctor

Resent-Date: Wed, 13 May 2026 19:53:44 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from ip74-208-96-234.pbiaas.com ([74.208.96.234]:62843)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wNGlx-000000002vW-0I1K

for doctor@netknow.ca;

Wed, 13 May 2026 15:05:49 -0600

Reply-To: farranbarrow@studiomodernitta.com.br

From: "Farran Barrow"

To: doctor@netknow.ca

Subject: lnvoice

Date: 13 May 2026 21:04:52 +0000

Message-ID: <20260513210452.5D7D170B63BE0754@canva.com>

MIME-Version: 1.0

Content-Type: text/plain;

charset="utf-8"

Content-Transfer-Encoding: quoted-printable

X-Spam_score: 7.0

X-Spam_score_int: 70

X-Spam_bar: +++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Please view the attached Invoice copy or request for the download

invoice link. Sent to : doctor@netknow.ca Thanks,



Content analysis details: (7.0 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[74.208.96.234 listed in dnsbl.ahbl.org]

[74.208.96.234 listed in dnsbl.ahbl.org]

[74.208.96.234 listed in dnsbl.ahbl.org]

[74.208.96.234 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[74.208.96.234 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[74.208.96.234 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[74.208.96.234 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[74.208.96.234 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[74.208.96.234 listed in will-spam-for-food.eu.org]

[74.208.96.234 listed in will-spam-for-food.eu.org]

[74.208.96.234 listed in will-spam-for-food.eu.org]

[74.208.96.234 listed in will-spam-for-food.eu.org]

[74.208.96.234 listed in will-spam-for-food.eu.org]

[74.208.96.234 listed in will-spam-for-food.eu.org]

[74.208.96.234 listed in will-spam-for-food.eu.org]

[74.208.96.234 listed in will-spam-for-food.eu.org]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

0.9 SPF_FAIL SPF: sender does not match SPF record (fail)

[SPF failed: Rejected by SPF record.]

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

0.5 ONE_WORD_SUBJECT Subject with only one lower-case word

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[74.208.96.234 listed in bl.score.senderscore.com]

1.0 FROM_MISSP_SPF_FAIL No description available.

0.4 RDNS_DYNAMIC Delivered to internal network by host with

dynamic-looking rDNS

0.7 TO_NO_BRKTS_FROM_MSSP Multiple formatting errors

1.7 FROM_MISSP_DYNIP From misspaced + dynamic rDNS

0.0 FROM_MISSPACED From: missing whitespace

0.3 FROM_MISSP_EH_MATCH From misspaced, matches envelope

Subject: {SPAM?} lnvoice



Please view the attached Invoice copy or request for the download=20

invoice link.



Sent to : doctor@netknow.ca



Thanks,



Farran Barrow



Gulf Coast Gasket Guy

8722 Rand Ave., Ste A

Daphne, AL 36526

877-626-0701

Invoice phish

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Wed, 13 May 2026 14:50:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wNGW1-00000000JDh-1VXd

for dave@doctor.nl2k.ab.ca;

Wed, 13 May 2026 14:49:13 -0600

Resent-From: The Doctor

Resent-Date: Wed, 13 May 2026 14:49:13 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from ip74-208-96-234.pbiaas.com ([74.208.96.234]:59370)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wNGLJ-00000000Eyt-2tJf

for www@doctor.nl2k.ab.ca;

Wed, 13 May 2026 14:38:18 -0600

Reply-To: farranbarrow@studiomodernitta.com.br

From: "Farran Barrow"

To: www@doctor.nl2k.ab.ca

Subject: Re: lnvoice

Date: 13 May 2026 20:37:22 +0000

Message-ID: <20260513203722.A58C92D06C7C8FC1@canva.com>

MIME-Version: 1.0

Content-Type: text/plain;

charset="utf-8"

Content-Transfer-Encoding: quoted-printable

X-Spam_score: 6.5

X-Spam_score_int: 65

X-Spam_bar: ++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Please view the attached Invoice copy or request for the download

invoice link. Sent to : www@doctor.nl2k.ab.ca Thanks,



Content analysis details: (6.5 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[74.208.96.234 listed in dnsbl.ahbl.org]

[74.208.96.234 listed in dnsbl.ahbl.org]

[74.208.96.234 listed in dnsbl.ahbl.org]

[74.208.96.234 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[74.208.96.234 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[74.208.96.234 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[74.208.96.234 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[74.208.96.234 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[74.208.96.234 listed in will-spam-for-food.eu.org]

[74.208.96.234 listed in will-spam-for-food.eu.org]

[74.208.96.234 listed in will-spam-for-food.eu.org]

[74.208.96.234 listed in will-spam-for-food.eu.org]

[74.208.96.234 listed in will-spam-for-food.eu.org]

[74.208.96.234 listed in will-spam-for-food.eu.org]

[74.208.96.234 listed in will-spam-for-food.eu.org]

[74.208.96.234 listed in will-spam-for-food.eu.org]

0.9 SPF_FAIL SPF: sender does not match SPF record (fail)

[SPF failed: Rejected by SPF record.]

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

1.0 FROM_MISSP_SPF_FAIL No description available.

0.4 RDNS_DYNAMIC Delivered to internal network by host with

dynamic-looking rDNS

0.3 FROM_MISSP_EH_MATCH From misspaced, matches envelope

0.0 FROM_MISSPACED From: missing whitespace

0.7 TO_NO_BRKTS_FROM_MSSP Multiple formatting errors

1.7 FROM_MISSP_DYNIP From misspaced + dynamic rDNS

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[74.208.96.234 listed in bl.score.senderscore.com]

Subject: {SPAM?} Re: lnvoice



Please view the attached Invoice copy or request for the download=20

invoice link.



Sent to : www@doctor.nl2k.ab.ca



Thanks,



Farran Barrow



Gulf Coast Gasket Guy

8722 Rand Ave., Ste A

Daphne, AL 36526

877-626-0701