Virtual Assistant spam from Google Gmail

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 23 Apr 2026 04:41:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1wFrUB-000000002XE-1Yxy

for dave@doctor.nl2k.ab.ca;

Thu, 23 Apr 2026 04:40:43 -0600

Resent-From: The Doctor

Resent-Date: Thu, 23 Apr 2026 04:40:43 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-vk1-f199.google.com ([209.85.221.199]:59498)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1wFrKO-00000000LkF-2gRs

for root@nk.ca;

Thu, 23 Apr 2026 04:30:47 -0600

Received: by mail-vk1-f199.google.com with SMTP id 71dfb90a1353d-56d402a0cabso5590907e0c.2

for ; Thu, 23 Apr 2026 03:29:49 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=gmail.com; s=20251104; t=1776940183; x=1777544983; darn=nk.ca;

h=to:from:subject:date:message-id:mime-version:from:to:cc:subject

:date:message-id:reply-to;

bh=P7l79znQ5HhL/TDOGLfAWH0WgOP8iubKiQQNeiPS3bY=;

b=o1u8z35NVHcgBhC0/75U08jCMbs/rrwxsjyYb3DrkY5I+LEPZeph1G9HfolNaXtQUy

40L7GTA0re4C5oEnehcIErk+I9ewkZ69/cjj/S9zR+2YsZwwNqHFHw20YJ+hwXVxrJLJ

dvFD/gBWVa4jU/LxUSpedVCoaK+QSmDQqrO8s48Sz/MEq8GHNM8TuCjkoe12wZ42oSqX

xMFp5/n9sGZYgkcQ8XK0xDxGK+r1ZEhSsoJ+BAp7UeRcp1X+2VwGJxdrAkU4I3aVVw2R

B+kiqGIrAWy+46/u7gGsXmjClfiUf1pgm8iTqwO9VjhKlkpb7nD6EHf0SMLbiFJDX802

r6cA==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20251104; t=1776940183; x=1777544983;

h=to:from:subject:date:message-id:mime-version:x-gm-message-state

:from:to:cc:subject:date:message-id:reply-to;

bh=P7l79znQ5HhL/TDOGLfAWH0WgOP8iubKiQQNeiPS3bY=;

b=B7iKIViTddN2Qakrs4VkSnBcDo/rmb5VTDHlGG95QqWEgizeOLHjPPzfPZOFVIxaO/

A0bWB/puRaK/NVLx0PkE5oMvDLMadTBVG8dagxFyJKjunt7+E+PkxzH+iTWlEdoYUvqw

eExvQ20qHa0kKB0Bzr6Ksmzb9u9vgTiRBhQJHRNz3XQuIjsF36/qxpB+tAClbHIFjvCW

lKUFc3o7FtnVZ/dmzCXpJtUZ50YqvW3Yrtl6nAHuLlHP+dEtVeFiuTPN8wJdtHkNoPxx

GzaFPl68cG+RP7FTxPxknbXWpmAnhT7ISqtxeVUG+jgJMB10SVwL3IBmN4wLOTVkLGmj

cK1w==

X-Gm-Message-State: AOJu0YxCY+dDJgp/yqRc1MG9y29S4Th9XfkdqKqlcH6sYLWoZmHBJGWl

i1i3bgQQuSZkdhe18uyKcY1LPj/ERS6POEsuS0RAgVmCwKUD6Jv7Uo2K1Ov33ood4fWId/F6tPR

B6xxCHg==

MIME-Version: 1.0

X-Received: by 2002:a05:6122:4d0f:b0:56f:6d11:b962 with SMTP id

71dfb90a1353d-56fa57fac70mr12472038e0c.2.1776940183346; Thu, 23 Apr 2026

03:29:43 -0700 (PDT)

Message-ID:

Date: Thu, 23 Apr 2026 10:29:43 +0000

Subject: Re: Remote VA Support Tailored to your Business ?? root@nk.ca

From: kundankumarpandey327@gmail.com

To: root@nk.ca

Content-Type: multipart/alternative; boundary="0000000000006a61b706501e20fd"



--0000000000006a61b706501e20fd

Content-Type: text/plain; charset="UTF-8"; format=flowed; delsp=yes

Content-Transfer-Encoding: base64



SGksDQoNCkkgd2FudGVkIHRvIGNoZWNrIGlmIHlvdSBoYWQgYSBjaGFuY2UgdG8gcmV2aWV3IG15

IGxhc3QgZW1haWwuDQoNCkxldCBtZSBrbm93IGlmIGEgYnJpZWYgY2FsbCB0aGlzIHdlZWsgd29y

a3MgZm9yIHlvdS4NCg0KVGhhbmsgeW91IQ0KS3VuZGFuDQpWQSBUZWFtIQ0KDQpPbiBGcmksIEFw

ciAxNywgMjAyNiBhdCA1OjEwIFBNIDw+IHdyb3RlOg0KDQpIaSwgcm9vdEBuay5jYQ0KDQpIb3Bl

IHlvdSBhcmUgZG9pbmcgd2VsbOKApg0KDQpQbGVhc2UsIGNvdWxkIHlvdSBsZXQgbWUga25vdyB3

aGV0aGVyIHlvdSBhcmUgaW50ZXJlc3RlZCBpbiBoaXJpbmcgYSByZW1vdGUgIA0KVmlydHVhbCBB

c3Npc3RhbnQgYXQgYSByZWFzb25hYmxlIGNvc3Q/DQoNCldoYXQgd2UgY2FuIGhhbmRsZSBmb3Ig

eW91Og0KDQpBZG1pbiAmIERhdGEgRW50cnkNCkVtYWlsICYgQ2FsZW5kYXIgTWFuYWdlbWVudA0K

Q29sZCBDYWxsaW5nICYgT3V0cmVhY2gNClNvY2lhbCBNZWRpYSAmIExlYWQgR2VuZXJhdGlvbg0K

Q3VzdG9tZXIgU3VwcG9ydA0KT25saW5lIFJlc2VhcmNoDQpDUk0gTWFuYWdlbWVudA0KQm9va2tl

ZXBpbmcgQXNzaXN0YW5jZQ0KQXBwb2ludG1lbnQgU2NoZWR1bGluZw0KRG9jdW1lbnQgUHJlcGFy

YXRpb24NClJlYWwgRXN0YXRlICYgRS1jb21tZXJjZSBTdXBwb3J0DQpTdHVkaW8tcXVhbGl0eSAz

RCBSZW5kZXJpbmcNClNFTyAmIERpZ2l0YWwgTWFya2V0aW5nDQpXZWJzaXRlIERldmVsb3BtZW50

DQpNb2JpbGUgQXBwIERldmVsb3BtZW50DQpSUE8g4oCTIFJlY3J1aXRtZW50IFByb2Nlc3MgT3V0

c291cmNpbmcNClZpZGVvIEVkaXRpbmcgU3VwcG9ydA0KDQpXZSBwcm92aWRlIHJlbGlhYmxlLCBh

ZmZvcmRhYmxlLCBhbmQgcmVzdWx0cy1kcml2ZW4gcmVtb3RlIHN1cHBvcnQgdGFpbG9yZWQgIA0K

dG8geW91ciBidXNpbmVzcyBuZWVkcy4NCg0KV291bGQgeW91IGJlIG9wZW4gdG8gYSBxdWljayBj

YWxsIHRoaXMgd2Vlaz8NCg0KQmVzdCBSZWdhcmRzLA0KS3VuZGFuDQpWQSBUZWFtDQo=

--0000000000006a61b706501e20fd

Content-Type: text/html; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable



Hi,

I wanted to check if you had a chance to review my last email.<=

br>
Let me know if a brief call this week works for you.

Thank yo=

u!
Kundan
VA Team!

On Fri, Apr 17, 2026 at 5:10=E2=80=AFPM <> =

wrote:

Hi, root@nk.ca

Hope you are doing well=E2=80=A6

>Please, could you let me know whether you are interested in hiring a remot=

e Virtual Assistant at a reasonable cost?

What we can handle for you=

:

Admin & Data Entry
Email & Calendar Management
Cold Calling =

& Outreach
Social Media & Lead Generation
Customer Support
Online =

Research
CRM Management
Bookkeeping Assistance
Appointment Schedul=

ing
Document Preparation
Real Estate & E-commerce Support
Studio-q=

uality 3D Rendering
SEO & Digital Marketing
Website Development
Mo=

bile App Development
RPO =E2=80=93 Recruitment Process Outsourcing
Vi=

deo Editing Support

We provide reliable, affordable, and results-dri=

ven remote support tailored to your business needs.

Would you be ope=

n to a quick call this week?

Best Regards,
Kundan
VA Team

--0000000000006a61b706501e20fd--

Web/SEO/App spam from Google Gmail Part 2

ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20240605;

h=to:subject:message-id:date:from:in-reply-to:references:mime-version

:dkim-signature;

bh=FJZ/faExcp9yYgDbj35T6btb5cFr12PFAQbjCRh2wCc=;

fh=SB8jXfqPGG2v91uLt22OjI1qM0ppcPSzzZYPt2TdtWg=;

b=db/t9SY8Jsz3vJh8GBkl2T2133PAyEzQcAQ6JjSXgriie9j20fP5CRT4CWT36kEXTI

usEwBd54x5Ad5GZB9XHXUlkzRAeOzb9zX9FDufIXRLSrLhqBrZ6iV6YQ2gUzQ6lppspb

Fu6tNss+E6j7seqOMaGWncQl6eeXbjw/JGS3js/xPS3eaHmjZ0L8SS6RiNRKbJ74Fh1N

07K4H15JtslLGgWi0SEFD0mCYT0ts79eUPELY/av6XS+wI5mOmY4ZfoFy2pbExhpQaBT

ppnOsJ1g+Pn3w9B+R/9i99w98tEtFOSauwQe3baH8wdzqFd3g9ojS929W6GeL2YnAkGb

Xsxg==;

darn=knitinfotech.co.in

ARC-Authentication-Results: i=1; mx.google.com; arc=none

X-Forwarded-Encrypted: i=1; AFNElJ+Yg+6/iwgRR1Ldrt/DubN2VDe2RjuUVZ6mMcu+HLFoKUDtED3FPerM3oqx2vWrDDZ0ptkaklRmLN3rJEWa@knitinfotech.co.in

X-Gm-Gg: AeBDiesfMRZKHbao1coJmfe8I9eYQmZL51E21czSvLmInoVnEWkFW1Jzr0IOe1UOagR

SgWJuRvl/o2uL86UB/0YQNTUxL7S7qo8Kd9tqNGAymHbXVoa+a3iVZIxlyaxdwFN+Yxu5ifAs8z

waadfy8N3x56CVWAu42eJZFRlWJm+PrEbeVv4VLWrQ87VTiHQGnSNgv59lzSVpQhU1xJ6jYk8Gi

GBXBRsCth+zFYqCDUs5bb0qOzeTsKXYfiE3RM2qAXa49gSmqcDc54hADEEevh6Wu0wTenPBDvyp

YXTVmh6RtC+27n76W550bgnskh64pZs33qTQPt2s2P1mSBb8alpO

X-Received: by 2002:a17:907:60d4:b0:ba3:eaf1:2743 with SMTP id

a640c23a62f3a-ba421debcc2mr1080717566b.19.1776928915279; Thu, 23 Apr 2026

00:21:55 -0700 (PDT)

MIME-Version: 1.0

References:

In-Reply-To:

From: Jasmine

Date: Thu, 23 Apr 2026 12:51:42 +0530

X-Gm-Features: AQROBzBC-6xCqEJboEZdaWw7W-brEWdTgNHz_m0tcxPrwPfl9B_OEGu0_p9gHKQ

Message-ID:

Subject: Re: $ Cleaning & Food Delivery Mobile Apps Development!!

To: undisclosed-recipients:;

Content-Type: multipart/alternative; boundary="000000000000c953b106501b80e6"

Bcc: jasminealex73@knitinfotech.co.in

X-Original-Sender: jasminealex372@gmail.com

X-Original-Authentication-Results: mx.google.com; dkim=pass

header.i=@gmail.com header.s=20251104 header.b=RYa95kFc; arc=pass

(i=1); spf=pass (google.com: domain of jasminealex372@gmail.com

designates 209.85.220.41 as permitted sender) smtp.mailfrom=jasminealex372@gmail.com;

dmarc=pass (p=NONE sp=QUARANTINE dis=NONE) header.from=gmail.com;

dara=neutral header.i=@knitinfotech.co.in

Precedence: list

Mailing-list: list jasminealex73@knitinfotech.co.in; contact jasminealex73+owners@knitinfotech.co.in

List-ID:

X-Spam-Checked-In-Group: jasminealex73@knitinfotech.co.in

X-Google-Group-Id: 1002268789410

List-Post: ,



List-Help: ,



List-Archive:

List-Subscribe: ,



List-Unsubscribe: ,





--000000000000c953b106501b80e6

Content-Type: text/plain; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable



Hiii,



I'm waiting for your response.!!



You might have missed my last mail due to your busy schedule.



If interested in iOS/Android app development, please let me know the app

details.



Many thanks!!

Jasmine

On Thu, Apr 9, 2026 at 9:07=E2=80=AFPM Jasmine w=

rote:



> Hello Sir/Ma=E2=80=99am,

>

> Good day!

>

> Are you interested in building a website, mobile app, or custom software

> solution?

>

>

> Apps included:

> 1.) Cleaning Apps

> 2.) Taxi/Cab Booking Apps

> 3.) Travel Apps

> 4.) Rental Apps

> 5.) Medical Apps

> 6.) GPS-based Apps

> 7.) Food Delivery Apps

> 8.) Restaurant/Hotels Apps

> 9.) Logistics Apps

> 10.) E-learning Apps

> 11.) Scheduling Apps

> 12.) Event management Apps

> 13.) Healthcare/Fitness Apps

> 14.) E-commerce Apps

> 15.) Real Estate Apps

> 16.) More Apps.

>

> Kindly let us know your mobile app idea and the exact features you need.

>

> Thank you!

> Jasmine

>



--000000000000c953b106501b80e6

Content-Type: text/html; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable



Hiii,

I=

9;m waiting for your response.!!

You might have missed my last mail =

due to your busy schedule.

If interested in iOS/Android app developm=

ent, please let me know the app details.

Many thanks!!
<=

font color=3D"#000000">Jasmi=

ne


ir=3D"ltr" class=3D"gmail_attr">On Thu, Apr 9, 2026=

at 9:07=E2=80=AFPM Jasmine <
>jasminealex372@gmail.com
> wrote:

=3D"gmail_quote" style=3D"margin:0px 0px 0px 0.8ex;border-left:1px solid rg=

b(204,204,204);padding-left:1ex">
H=

ello Sir/Ma=E2=80=99am,

Good day!

Are you interested in build=

ing a website, mobile app, or custom software solution?

Apps incl=

uded:

1.) =C2=A0Cleaning Apps
2.) =C2=A0Taxi/Cab Booking Apps=


3.) =C2=A0Travel Apps
4.) =C2=A0Rental Apps
5.) =C2=A0Medical App=

s
6.) =C2=A0GPS-based Apps
7.) =C2=A0Food Delivery Apps
8.) =C2=A0=

Restaurant/Hotels Apps
9.) =C2=A0Logistics Apps
10.) =C2=A0E-learning=

Apps
11.) =C2=A0Scheduling Apps
12.) =C2=A0Event management Apps
=

13.) =C2=A0Healthcare/Fitness Apps
14.) =C2=A0E-commerce Apps
15.) =

=C2=A0Real Estate Apps
16.) =C2=A0More Apps.

Kindly let us know y=

our mobile app idea and the exact features you need.

Thank you!
t>

r=3D"#000000">Jasmine






--000000000000c953b106501b80e6--

Web/SEO/App spam from Google Gmail Part 1

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 23 Apr 2026 04:40:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1wFrTP-0000000025P-3JxV

for dave@doctor.nl2k.ab.ca;

Thu, 23 Apr 2026 04:39:55 -0600

Resent-From: The Doctor

Resent-Date: Thu, 23 Apr 2026 04:39:55 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-ed1-f69.google.com ([209.85.208.69]:42149)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1wFoQR-00000000AS5-3ZWA

for root@nk.ca;

Thu, 23 Apr 2026 01:24:51 -0600

Received: by mail-ed1-f69.google.com with SMTP id 4fb4d7f45d1cf-6763c34cf60sf4780598a12.0

for ; Thu, 23 Apr 2026 00:23:52 -0700 (PDT)

ARC-Seal: i=3; a=rsa-sha256; t=1776929025; cv=pass;

d=google.com; s=arc-20240605;

b=ZuR7trWmn3WJ3tWxfqerNFh6FnRUXfAiK1TgyPGD8KO0SZpJxKHpMzeMwYkXiUDKA6

2IjZZd/40cdbrIoqpSTJmoPsbbkIF4HupLBpAUYwB7Y5cM1xs485tmAbG5gR3q32LhdU

Qj2+EXmga4iqqoKF0MSf5024CM85fpdgYcTG7LemfTDpvRtto3Vgk7gQCBWByE4f1h7t

UpY4nmWIpDg/YK0Cp5G29PR92x7EVZX6iulYF1Gp0nMZW1nWKYvVTGQoCQOgWJOFL8uY

D+bIpwLfArTzwoH76pML4GStLj7gP6bwZfh1RxsrRFB/k6agpkohhFmjXNrWD0K/vYIa

L6hw==

ARC-Message-Signature: i=3; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20240605;

h=list-unsubscribe:list-subscribe:list-archive:list-help:list-post

:list-id:mailing-list:precedence:to:subject:message-id:date:from

:in-reply-to:references:mime-version:dkim-signature;

bh=FJZ/faExcp9yYgDbj35T6btb5cFr12PFAQbjCRh2wCc=;

fh=zkPi75Mc9K0RWxmloXEiyV/IlQ14kcXEEFbw8TIu4aw=;

b=kN2y9gdxC3Uo3ZvQ4q7W806fhmrb8kzsyrt/1Tf6fZMTqEL5G0ntOmJ9k/bgeXsp5Y

WBXRz7u3+Bm/B1xGxHoGjhwmbofwHO2Y8nD4hyFd49I1PLKMqPpByGQa4A636bpDRQl8

yJCZp878BCOVtQ+vsXZks+bojf3eAmxiWCIbAMTYoiHr+0raznTU0Ioz0Icdox7Z/F4v

iZAGdxQ+RaTZxdeGRE6UBN63WGtXqbddOIxf/Y2YhqUPr0bGp2kOSfqkxtDChUi274GW

d0ROdXcNuhmS9IRxFMAbDpc1B62Myfycsz9KRCuiMV3NAu0VyUOH4KqR2DvRD4kSC6MS

cV0w==;

darn=nk.ca

ARC-Authentication-Results: i=3; mx.google.com;

dkim=pass header.i=@gmail.com header.s=20251104 header.b=RYa95kFc;

arc=pass (i=1);

spf=pass (google.com: domain of jasminealex372@gmail.com designates 209.85.220.41 as permitted sender) smtp.mailfrom=jasminealex372@gmail.com;

dmarc=pass (p=NONE sp=QUARANTINE dis=NONE) header.from=gmail.com;

dara=neutral header.i=@knitinfotech.co.in

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=knitinfotech-co-in.20251104.gappssmtp.com; s=20251104; t=1776929025; x=1777533825; darn=nk.ca;

h=list-unsubscribe:list-subscribe:list-archive:list-help:list-post

:list-id:mailing-list:precedence:x-original-authentication-results

:x-original-sender:to:subject:message-id:date:from:in-reply-to

:references:mime-version:from:to:cc:subject:date:message-id:reply-to;

bh=FJZ/faExcp9yYgDbj35T6btb5cFr12PFAQbjCRh2wCc=;

b=QHETIed+GDVEcNPqb44FzDHdZtQZfx34ZB09Rc6rFeE7Nmq50eIY/THc4XwLfQ6qoG

O8StCNxQxKPXAyTZMtg9U7Z+ydI5BvSEXxDYS8DFlJgyF8aicLBX5EeRVWZsnG07f5Q5

+lC1Gjq4I2y3BiaM3qufpS0CqIOE86IJcUzuuBqnY2MqVtV9ftSmXiUhFhW6f9lQtaZj

06PwfsKluqnfYcgnJXZfamyShYPhCJeYii9Oxb2j3txXGXo5/VTlxLmJDm4HqC/kicPZ

9fXxRmzoXKBZrrofZIhCim7K2Q8wMZ7kWBiA/fhb2vbZd+Lo0odlX51Bvrgkb6+DCyLo

If2w==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20251104; t=1776929025; x=1777533825;

h=list-unsubscribe:list-subscribe:list-archive:list-help:list-post

:x-spam-checked-in-group:list-id:mailing-list:precedence

:x-original-authentication-results:x-original-sender:to:subject

:message-id:date:from:in-reply-to:references:mime-version:x-gm-gg

:x-beenthere:x-gm-message-state:from:to:cc:subject:date:message-id

:reply-to;

bh=FJZ/faExcp9yYgDbj35T6btb5cFr12PFAQbjCRh2wCc=;

b=OjIUI+xfFyqUZBvqQGrfR/lW09Y/NZLAmm6rkZopWfzQCUCiXdMUuRC+rt4ar8shwX

1c7/fZbxzMsvT2DWvMtJ/AvjzkZae+3RW8PJ/tP+mcT/bKKLkktQ95uwDK+UIDy9yIOs

UM2wqlSEdQAqe5Ws0WjQV+OuqvET9ahWvu1ZLqFrmaA6qWkUM7kqkiNgaPQpsN2WjwUR

A33Vy7Ib5t9KfwtKdf4Jtk7x5fxCY0W4fEPNXkNZfvb+jlDsNsU3Ua44hJtrEBfoOSbG

hYnvmLk30z1NQ5iKUv/T3nmfrJKrAflXOe2oFkd13mjlQZHKqJweG8+WztzxIB6ak6mx

06ig==

X-Forwarded-Encrypted: i=3; AFNElJ8ezuZz2akh/OG5B33t6gMLp3xL791JmN36SsqQMF+8zhINguFEjaJGGb+hQVCA61NMS5mY@nk.ca

X-Gm-Message-State: AOJu0YxrrYQGTLvB6P2ZQQB5YGHfYPsoGJvnCP+QUAnylrZjZEbgm8EG

kizcFOoHrhnl2XD+KoKkxhFLZZhJOJZ+S58Jg/ELmRkxdJW027n9YQhYFK48NAX/KPM=

X-Received: by 2002:a05:6402:1d53:b0:671:a6e2:8f74 with SMTP id 4fb4d7f45d1cf-672c12b2fd1mr10214426a12.10.1776929025082;

Thu, 23 Apr 2026 00:23:45 -0700 (PDT)

X-BeenThere: jasminealex73@knitinfotech.co.in; h="AYAyTiK7jMzz2dBJFgn+ChgLgvEC8tPtzencwf29jLcPGll2gw=="

Received: by 2002:aa7:d154:0:b0:66e:8ce7:e2e7 with SMTP id 4fb4d7f45d1cf-672718365bdls673835a12.2.-pod-prod-00-eu;

Thu, 23 Apr 2026 00:22:03 -0700 (PDT)

X-Forwarded-Encrypted: i=3; AFNElJ+BcZiGdB6FKgDBC+KfkJLGYJ6B+sJO5wI+zzJgbHYcdLalaYmPchIDyVcgID5pT6vbgr3B7O75XweKB3Jk@knitinfotech.co.in

X-Received: by 2002:a17:907:60ca:b0:ba7:41d0:5efd with SMTP id a640c23a62f3a-ba741d06392mr821646066b.28.1776928916569;

Thu, 23 Apr 2026 00:21:56 -0700 (PDT)

ARC-Seal: i=2; a=rsa-sha256; t=1776928916; cv=pass;

d=google.com; s=arc-20240605;

b=ajjQOb7+IgbtPqV6ksNI2C98uq1LdCaQltA2YnXL4lglR1u8tnYtTuerd6x2FTP4Mu

8ca9Uae8SeTLtM3IBCfs5rAbB9bmYO0yMNzyRo0TQp/4Vmvi4fm3tJ/sXmMRx8LgEDxU

lN+5VQSHKQq9s3I1FYdZiC628IAkqwLXvbNVpoIy35+D/SkQOFL/Gmye2nmf8tMLdX8R

yvXk70X9VTU1tXTg6keBY6hCNJn2vO+uoq7JBQsvWHH7rsReO7BRp5YeK3UCchvdR/O+

fcfLYzi1xt5uHiQkIv3nPtlx4ndHWA+AZyZhA7mViWu8VnCVk+57LW/ppYz838bhr473

EXzg==

ARC-Message-Signature: i=2; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20240605;

h=to:subject:message-id:date:from:in-reply-to:references:mime-version

:dkim-signature;

bh=FJZ/faExcp9yYgDbj35T6btb5cFr12PFAQbjCRh2wCc=;

fh=SB8jXfqPGG2v91uLt22OjI1qM0ppcPSzzZYPt2TdtWg=;

b=kIr1j4ivvTH0cEFP4ZQtUZPbl48xFVxm3OHr/E7e8ff+Hfd13LE6L+YSrTi4xZFYTI

25zeAh+Nmuf07ZRXpyLnKs4yo8mqKdwCuUX36kqybDNSsX8VTLb+FagETfUOMJYhjrj8

lzej3j9wmBqRpe57fT6HqLpwKqTvFxtrr0ets3qvjAb4sOxVy4DULjKzw8I8tSKKreSw

bFW1mXw2jzhUed02BmaIhBj5mi9n2hXab8AlXa7vqZMRUkLyGbfDDD2RZE8DG3CgQee9

pGtmZZ2f9QgQzov9H1CKWS/NpaWSZHBvE0zZO9iXf9COtQCmui/Uax7eaW4dydnSFPxn

Vv5w==;

dara=google.com

ARC-Authentication-Results: i=2; mx.google.com;

dkim=pass header.i=@gmail.com header.s=20251104 header.b=RYa95kFc;

arc=pass (i=1);

spf=pass (google.com: domain of jasminealex372@gmail.com designates 209.85.220.41 as permitted sender) smtp.mailfrom=jasminealex372@gmail.com;

dmarc=pass (p=NONE sp=QUARANTINE dis=NONE) header.from=gmail.com;

dara=neutral header.i=@knitinfotech.co.in

Received: from mail-sor-f41.google.com (mail-sor-f41.google.com. [209.85.220.41])

by mx.google.com with SMTPS id a640c23a62f3a-ba4578b4eb2sor606054566b.5.2026.04.23.00.21.56

for

(Google Transport Security);

Thu, 23 Apr 2026 00:21:56 -0700 (PDT)

Received-SPF: pass (google.com: domain of jasminealex372@gmail.com designates 209.85.220.41 as permitted sender) client-ip=209.85.220.41;

ARC-Seal: i=1; a=rsa-sha256; t=1776928916; cv=none;

d=google.com; s=arc-20240605;

b=hKR1lPdLLegnCNvWk592AG6kk9k6d4hGITbCKuOMLiKHOwninP7da8+oV3TjTowxbo

OUWgCiYNTbCJxaVF6EM6kH8uoyNBxb1Tq4rqr3lQcw9O3ocLXNRKnUucivp3yJAjjD5s

sJviyAjXIrH1/JgzZ3U4diDRZeCQlNGC/irNn35cAJjNUrif4SpDnNgZ3AOsZO7nQBup

aY7m6pKz4EOOJVCdWgJf4O3KAWT9H6e89vu2Vp9fLPnHis98rrUvaL90g+oTBjarO/X7

rSfkLtIprjmOOrfm1nH0Ju+WxxiI4ctVgWc+GDdRY+a6s13avbaKDFLeCTFvRjVWT9Q1

43dQ==

Loan spam from Google gmail PArt 3





>> To stop receiving these emails, click

[here](https://app.close.com/go/unsubscribe/orga_WJQdcK5MUUa02rLIty6GVDnil9=

kHSKU8WElV6ueTPiF/sales%40nk.ca/GK6U1JDQJSfaf6

--tg9gajA9HdvShNSyH_DgbhmTyc8=3D/)

--===============0308454826350702456==

Content-Type: text/html; charset="utf-8"

MIME-Version: 1.0

Content-Transfer-Encoding: quoted-printable



Hi Gurkirat,

This is=

Stephanie Cabiao from Kesef Marketing.


=

Many businesses are currently reviewing their funding options to stay ahead=

.

If this is something you=E2=80=

=99re considering, you can check your options here:

https://form.jotform.com/260672364104452?lead_id=3Dlead_bqyNtSfmgPr9HEY1bFv=

oKaWRLZZxf887Qp2LC28qfuP&legalBusiness=3DN K MAINTENANCE&fullName[f=

irst]=3DGurkirat&fullName[last]=3DWirring" rel=3D"noopener noreferrer n=

ofollow">CLICK HERE TO START YOUR APPLICATION


<=

strong>If you have any questions or would prefer to speak directly, feel fr=

ee to call me at +1-866-216-5475 or 715-641-4654


iv>
Best regards,
Stephanie Cabiao <=

/strong>
Kesef Marketing

nerated=3D"unsubscribe-footer">


enerated=3D"quoted-text">

On Apr 19, 2026, at 10:32 PM, Stephanie Ke=

sef Marketing <stephanie@kesefmarketing.com> wrote:

pe=3D"cite">
Hi Gurkirat, 


iv>We noticed your Cash Advance application is still incomplete.
trong>

You=E2=80=99re just a few steps awa=

y from securing up to $800,000 in funding within 48 hours.

iv>
To move forward, please complete your application=

here:

104452?lead_id=3Dlead_bqyNtSfmgPr9HEY1bFvoKaWRLZZxf887Qp2LC28qfuP&legal=

Business=3DN K MAINTENANCE&fullName[first]=3DGurkirat&fullName[last=

]=3DWirring" rel=3D"noopener noreferrer nofollow">Click to Start yo=

ur Application here

and uploa=

d your last 3 months of bank statements. This will allow us to finalize you=

r review and match you with the best available funding options.

iv>

If you have any questions or would prefer to=

speak directly, feel free to call me at +1-866-216-5475 or 715-641-4654
trong>

Best regards,
Stephanie Cabiao
Kesef Mar=

keting

=



O=

n Apr 17, 2026, at 11:03 AM, Stephanie Kesef Marketing <stephanie@kesefm=

arketing.com> wrote:
Hi Gurkir=

at,

This is Stephanie Cabiao from=

Kesef Marketing.

Welcome,I wante=

d to personally reach out and thank you for your interest in business fundi=

ng. We work with lenders across Canada to provide reliable funding solution=

s that support growth, manage cash flow, and cover upcoming expenses=E2=80=

=94while helping you access competitive interest rates.
=



Onc=

e submitted, our team will review your information and present the best ava=

ilable funding options tailored to your needs.


>
If you have any questions or would prefer to speak directly, =

feel free to call me at +1-866-216-5475 or 715-641-4654
=


Looking forward to connecting.

r>
Best regards,
Stephanie Cabiao


>Kesef Marketing

ooter">


g src=3D"https://ml.closeml.com/t/oVk2mA9KNAVoTyNq5ZvE3Wb80u4vrphjX8yMb6LeR=

fh/YVFsbTnwSw.png" alt=3D"" width=3D"1" height=3D"1" />

--===============0308454826350702456==--



--===============3587633668073453775==--

Loan spam from Google gmail PArt 2

>

> To stop receiving these emails, click

> [here](https://app.close.com/go/unsubscribe/orga_WJQdcK5MUUa02rLIty6GVDni=

l9kHSKU8WElV6ueTPiF/sales%40nk.ca/GK6U1JDQJSfaf6

> --tg9gajA9HdvShNSyH_DgbhmTyc8=3D/)

>

> =20

> =20

> On Apr 17, 2026, at 11:03 AM, Stephanie Kesef Marketing

> wrote: =20

>

>



>> **Hi Gurkirat,**



>>



>> =20

>

>>



>> **This is Stephanie Cabiao from Kesef Marketing.**



>>



>> =20

>

>>



>> **Welcome,I wanted to personally reach out and thank you for your intere=

st

in business funding. We work with lenders across Canada to provide reliable

funding solutions that support growth, manage cash flow, and cover upcoming

expenses=E2=80=94while helping you access competitive interest rates.**



>>



>> =20

>

>>



>> **If you=E2=80=99re open to exploring your options, you can get started =

here: =20

> **[**Click here to start your

> application**](https://form.jotform.com/260672364104452?lead_id=3Dlead_bq=

yNtSfmgPr9HEY1bFvoKaWRLZZxf887Qp2LC28qfuP&legalBusiness=3DN

> K MAINTENANCE&fullName\[first\]=3DGurkirat&fullName\[last\]=3DWirring)

>>



>> =20

>

>>



>> **Once submitted, our team will review your information and present the

best available funding options tailored to your needs.**



>>



>> =20

>

>>



>> **If you have any questions or would prefer to speak directly, feel free=

to

call me at +1-866-216-5475 or 715-641-4654**



>>



>> =20

>

>>



>> **Looking forward to connecting.**



>>



>> =20

>

>>



>> **Best regards, =20

> Stephanie Cabiao ** =20

> **Kesef Marketing**

>>

Loan spam from Google Gmail Part 1

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Wed, 22 Apr 2026 16:42:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1wFgG5-00000000HjU-0B4v

for dave@doctor.nl2k.ab.ca;

Wed, 22 Apr 2026 16:41:25 -0600

Resent-From: The Doctor

Resent-Date: Wed, 22 Apr 2026 16:41:24 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-pj1-f46.google.com ([209.85.216.46]:44402)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1wFf5B-00000000E8s-1d44

for sales@nk.ca;

Wed, 22 Apr 2026 15:26:13 -0600

Received: by mail-pj1-f46.google.com with SMTP id 98e67ed59e1d1-3590042fa8eso4721906a91.1

for ; Wed, 22 Apr 2026 14:25:18 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=kesefmarketing.com; s=google; t=1776893112; x=1777497912; darn=nk.ca;

h=list-unsubscribe-post:list-unsubscribe:in-reply-to:references

:message-id:date:to:from:subject:mime-version:from:to:cc:subject

:date:message-id:reply-to;

bh=GeW0YKIWbORHPBIjAdPjVmC3ocGfWtFRuu/q8GPMWhI=;

b=ATDp94IxBo3YE2M1oKRaeCK3widOXO51ORrRpCu7Sy+l6wdjlsjt8r+Uo211ICTcs+

8VGVKpt3c8fnj9xev4z+urOXy0jYSWHruWXddTzzyuYgvPpTZB2bpypdy+HNTdV5Gh2u

kAdB07uDOa/76B9tLwTh7YezCoouZOgcks9kfLREOsFfnozs/aO8neVmtc14slXH8GVg

sIsT8uPF25Erxuw3lQYRjrzzM8kdn+qk4GsLiXh2jV8uG3s/88sAjCkqLS4+X7Vpifhs

A5JsFAUoIc0B3DQp7hJthmwuRoSvA2HMjVG1rF3ZqzQm1OiUGgBt6Fhgty7J/EQwZ7B8

S8hg==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20251104; t=1776893112; x=1777497912;

h=list-unsubscribe-post:list-unsubscribe:in-reply-to:references

:message-id:date:to:from:subject:mime-version:x-gm-gg

:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to;

bh=GeW0YKIWbORHPBIjAdPjVmC3ocGfWtFRuu/q8GPMWhI=;

b=RTspXKiTB9s1Wv7/o/MvxPUxMA+dJi52a2IhZ3chou+CDNpGcFJsVfzpN1jXCc4YXR

Qq5oo32N2K4EqNFkDfVarSogXVxLDPioRL/YHpWfmMT69rUucQ0WCTnT3oICx3d/XIgQ

rGtLOy/adC+8OtLoqDOAut8VJFpzuDg1OaGUGVvOtiiCFVcYr164XqNZ0UN5M8HQhEER

86P17Bl3J9UBPbvHaw29blVRzjnNHmFEaWaUiEizaPKdEv7311A8nXWmywNuTxq6f9X6

YGyDr0li2ZjmVqjlJ55pm6fbQ+LapP5qICldEeahs+YcS+OJUrd4SFkl0TxNigUgwUbe

uUZw==

X-Gm-Message-State: AOJu0YydvYbFVH/H5m7UST2vwXQco9X0KP9Y+YpAi5d2JrH2j3b4OV2D

e36SeOZp/V2U2RF3+A02WXQro8xg5qPfVIzEQh8mpOzB3o3ShDspEBRCIVy4AowyXdn5AXOYwxH

382Ml

X-Gm-Gg: AeBDieuzKZT18gPJNrqAXabgW9jirTphjwFQj8Jt5UKq+GiSENWY9RfTiCwseiuLqte

TyddM+IkDi5lx3/5oQX1GBdgD962/u7oCuOH9w4jYp+qmp+VBPtB+MhpBhZ3gw8z3dMMYqC9bwt

9FR1GlYnq4EHG9R140JpmjEd4kaS0rGpBspSbf5ZGqzWpS+1SHE4nXPkAAli4e646WS8ipIxcZm

m3kLM2gLHvVFwaG5xare/cW+19L7b9bVANrRDnvHCbLuBfX8Q3IPgV0+kdt/Rvs5nfEYwIQ8H7f

2f1uc8Cq3iDQ03skGHq8q5xDbvbDt47WKnUJ1fhmtcvjtrljJaOWr8VYwNpNiTl81458uVkvbRV

51EtT2MwvysRPls4zwvHA0YfiSeWobE4sXcgDces/cbhYmszeolO5fVNMyGggAw8dBY78ftSa6Z

4YS8mI7w7GjSNQkIwGN6FN+DZhzPG3HoMRz2zwXx6Zl5p034aEKDx51fQrsAXKumgWj+pA9jEZ8

hZIhg==

X-Received: by 2002:a17:90b:5106:b0:35a:189b:43db with SMTP id 98e67ed59e1d1-361403d5c41mr21873040a91.4.1776893111780;

Wed, 22 Apr 2026 14:25:11 -0700 (PDT)

Received: from smtpgw.close.com (am11-natgw-b0.close.com. [54.186.6.46])

by smtp.gmail.com with ESMTPSA id d9443c01a7336-2b5faa2f129sm161924145ad.29.2026.04.22.14.25.11

for

(version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256);

Wed, 22 Apr 2026 14:25:11 -0700 (PDT)

Content-Type: multipart/mixed; boundary="===============3587633668073453775=="

MIME-Version: 1.0

Subject: Re: Kesef Marketing | Smarter Access to Business Loans

From: =?utf-8?q?Stephanie_Kesef_Marketing?=

To: =?utf-8?q?Gurkirat_Wirring?=

Date: Wed, 22 Apr 2026 21:25:11 +0000

Message-ID: <177689311103.7.1517992003165419683@smtpgw.close.com>

X-CLOSEIO-EMAIL-ID: acti_oVk2mA9KNAVoTyNq5ZvE3Wb80u4vrphjX8yMb6LeRfh

References: <177644538269.7.3986001924003818893@smtpgw.close.com> <177644538269.7.7253266245741056513@smtpgw.close.com> <177665952029.7.16881262815357895943@smtpgw.close.com> <177665952029.7.4037035181715252544@smtpgw.close.com>

In-Reply-To: <177665952029.7.16881262815357895943@smtpgw.close.com>

List-Unsubscribe:

List-Unsubscribe-Post: List-Unsubscribe=One-Click



--===============3587633668073453775==

Content-Type: multipart/alternative; boundary="===============0308454826350702456=="

MIME-Version: 1.0



--===============0308454826350702456==

Content-Type: text/plain; charset="utf-8"

MIME-Version: 1.0

Content-Transfer-Encoding: quoted-printable



**Hi Gurkirat,**



=20



**This is Stephanie Cabiao from Kesef Marketing.** =20

=20



**Many businesses are currently reviewing their funding options to stay

ahead.**



=20



**If this is something you=E2=80=99re considering, you can check your optio=

ns here: =20

**[**CLICK HERE TO START YOUR

APPLICATION**](https://form.jotform.com/260672364104452?lead_id=3Dlead_bqyN=

tSfmgPr9HEY1bFvoKaWRLZZxf887Qp2LC28qfuP&legalBusiness=3DN

K MAINTENANCE&fullName\[first\]=3DGurkirat&fullName\[last\]=3DWirring) =20

=20

**If you have any questions or would prefer to speak directly, feel free to

call me at +1-866-216-5475 or 715-641-4654**



=20



**Best regards,**



**Stephanie Cabiao** =20

**Kesef Marketing =20

**



To stop receiving these emails, click

[here](https://app.close.com/go/unsubscribe/orga_WJQdcK5MUUa02rLIty6GVDnil9=

kHSKU8WElV6ueTPiF/sales%40nk.ca/GK6U1JDQJSfaf6

--tg9gajA9HdvShNSyH_DgbhmTyc8=3D/)



=20

=20

On Apr 19, 2026, at 10:32 PM, Stephanie Kesef Marketing

wrote: =20



> **Hi Gurkirat, **

>

> =20

>

>

> **We noticed your Cash Advance application is still incomplete.**

>

> =20

>

>

> **You=E2=80=99re just a few steps away from securing up to $800,000 in fu=

nding

> within 48 hours.**

>

> =20

>

>

> **To move forward, please complete your application here: =20

> **

>

> [**Click to Start your Application

> here**](https://form.jotform.com/260672364104452?lead_id=3Dlead_bqyNtSfmg=

Pr9HEY1bFvoKaWRLZZxf887Qp2LC28qfuP&legalBusiness=3DN

> K MAINTENANCE&fullName\[first\]=3DGurkirat&fullName\[last\]=3DWirring)

>

> =20

>

>

> **and upload your last 3 months of bank statements. This will allow us to

> finalize your review and match you with the best available funding

> options.**

>

> =20

>

>

> **If you have any questions or would prefer to speak directly, feel free =

to

> call me at +1-866-216-5475 or 715-641-4654**

>

> =20

> **Best regards, =20

> Stephanie Cabiao =20

> Kesef Marketing**

Invoice phish from Russia Part 2














erif; font-size: 16px;">Hi doctor,





erif; font-size: 16px;"> 





erif; font-size: 16px;">Attached is your invoice and payment receipt for yo=

ur records.





erif; font-size: 16px;"> 





erif; font-size: 16px;">Please review the attached document. Let us know if=

you have any questions.





erif; font-size: 16px;"> 





erif; font-size: 16px;">3D"d=<br
ocument icon" src=3D"https://gyazo.com/da09dca224cdd187568d5f5cb45895ed.png=

" width=3D"76" height=3D"104">






gomeryauc.vercel.app/?email=3Ddoctor@nk.ca">View_Invoice_Payment_Receipt.pd=

f





erif; font-size: 16px;"> 





erif; font-size: 16px;">Best Regards,





Mike O'Leary


Billing Department








Invoice phish from Russia Part 1

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Wed, 22 Apr 2026 11:40:02 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1wFbYE-00000000NjT-1Xly

for dave@doctor.nl2k.ab.ca;

Wed, 22 Apr 2026 11:39:50 -0600

Resent-From: The Doctor

Resent-Date: Wed, 22 Apr 2026 11:39:50 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from relay.meteogmp.ru ([95.163.222.104]:5460)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1wFaY6-00000000I1A-0djC

for doctor@nk.ca;

Wed, 22 Apr 2026 10:35:50 -0600

Received: from mail.meteogmp.ru (mail.meteogmp.ru [91.247.194.23])

by relay.meteogmp.ru (Postfix) with ESMTP id CB1A53EE88

for ; Wed, 22 Apr 2026 19:31:33 +0300 (MSK)

Received: from mail.meteogmp.ru (localhost [127.0.0.1])

by mail.meteogmp.ru (Postfix) with ESMTP id 4g14Wl3wDPz1M9nS

for ; Wed, 22 Apr 2026 19:32:35 +0300 (MSK)

X-Virus-Scanned: Debian amavis at localhost.localdomain

Received: from mail.meteogmp.ru ([127.0.0.1])

by mail.meteogmp.ru (mail.meteogmp.ru [127.0.0.1]) (amavis, port 10024)

with ESMTP id Q6epcr8UsiYl for ;

Wed, 22 Apr 2026 19:32:35 +0300 (MSK)

Received: from s1590535.smartape-vps.com (_gateway [10.10.0.1])

by mail.meteogmp.ru (Postfix) with ESMTPS id 4g14Wk6RNxz1M9mW

for ; Wed, 22 Apr 2026 19:32:34 +0300 (MSK)

From: Mike O'Leary

To: doctor@nk.ca

Subject: Invoice attached from Mike O'Leary - Wednesday, April 22, 2026 9:34 a.m.

Date: 22 Apr 2026 09:34:04 -0700

Message-ID: <20260422093404.3C1C6576E8611ADF@gmail.com>

MIME-Version: 1.0

Content-Type: text/html

Content-Transfer-Encoding: quoted-printable

X-Spam_score: 8.7

X-Spam_score_int: 87

X-Spam_bar: ++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Hi doctor, Attached is your invoice and payment receipt for

your records.



Content analysis details: (8.7 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[91.247.194.23 listed in dnsbl.ahbl.org]

[91.247.194.23 listed in dnsbl.ahbl.org]

[91.247.194.23 listed in dnsbl.ahbl.org]

[91.247.194.23 listed in dnsbl.ahbl.org]

[95.163.222.104 listed in dnsbl.ahbl.org]

[95.163.222.104 listed in dnsbl.ahbl.org]

[95.163.222.104 listed in dnsbl.ahbl.org]

[95.163.222.104 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[91.247.194.23 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[91.247.194.23 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[91.247.194.23 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[91.247.194.23 listed in dnsbl.ahbl.org]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[95.163.222.104 listed in bl.score.senderscore.com]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[91.247.194.23 listed in will-spam-for-food.eu.org]

[91.247.194.23 listed in will-spam-for-food.eu.org]

[91.247.194.23 listed in will-spam-for-food.eu.org]

[91.247.194.23 listed in will-spam-for-food.eu.org]

[91.247.194.23 listed in will-spam-for-food.eu.org]

[91.247.194.23 listed in will-spam-for-food.eu.org]

[91.247.194.23 listed in will-spam-for-food.eu.org]

[91.247.194.23 listed in will-spam-for-food.eu.org]

[95.163.222.104 listed in will-spam-for-food.eu.org]

[95.163.222.104 listed in will-spam-for-food.eu.org]

[95.163.222.104 listed in will-spam-for-food.eu.org]

[95.163.222.104 listed in will-spam-for-food.eu.org]

[95.163.222.104 listed in will-spam-for-food.eu.org]

[95.163.222.104 listed in will-spam-for-food.eu.org]

[95.163.222.104 listed in will-spam-for-food.eu.org]

[95.163.222.104 listed in will-spam-for-food.eu.org]

1.0 SPF_SOFTFAIL SPF: sender does not match SPF record (softfail)

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends in

digit

[andy55(at)gmail.com]

1.0 FORGED_GMAIL_RCVD 'From' gmail.com does not match 'Received' headers

0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider

[andy55(at)gmail.com]

1.5 MR_STRANGE_QUESTION URI: No description available.

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 HTML_MESSAGE BODY: HTML included in message

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 NO_RDNS2 Sending MTA has no reverse DNS

1.5 GB_CUSTOM_HTM_URI Custom html uri

0.7 SPOOFED_FREEMAIL No description available.

0.1 SPOOF_GMAIL_MID From Gmail but it doesn't seem to be...

Subject: {SPAM?} Invoice attached from Mike O'Leary - Wednesday, April 22, 2026 9:34 a.m.

Invoice phish from Russia Part 2














erif; font-size: 16px;">Hi doctor,





erif; font-size: 16px;"> 





erif; font-size: 16px;">Attached is your invoice and payment receipt for yo=

ur records.





erif; font-size: 16px;"> 





erif; font-size: 16px;">Please review the attached document. Let us know if=

you have any questions.





erif; font-size: 16px;"> 





erif; font-size: 16px;">3D"d=<br
ocument icon" src=3D"https://gyazo.com/da09dca224cdd187568d5f5cb45895ed.png=

" width=3D"76" height=3D"104">






gomeryauc.vercel.app/?email=3Ddoctor@doctor.nl2k.ab.ca">View_Invoice_Paymen=

t_Receipt.pdf





erif; font-size: 16px;"> 





erif; font-size: 16px;">Best Regards,





Mike O'Leary


Billing Department








Invoice phish from Russia Part 1

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Wed, 22 Apr 2026 11:40:01 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1wFbY9-00000000NjC-35Bh

for dave@doctor.nl2k.ab.ca;

Wed, 22 Apr 2026 11:39:45 -0600

Resent-From: The Doctor

Resent-Date: Wed, 22 Apr 2026 11:39:45 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from relay.meteogmp.ru ([95.163.222.104]:50515)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1wFaY5-00000000I13-3mwv

for doctor@doctor.nl2k.ab.ca;

Wed, 22 Apr 2026 10:35:45 -0600

Received: from mail.meteogmp.ru (mail.meteogmp.ru [91.247.194.23])

by relay.meteogmp.ru (Postfix) with ESMTP id C522B3EF92

for ; Wed, 22 Apr 2026 19:31:33 +0300 (MSK)

Received: from mail.meteogmp.ru (localhost [127.0.0.1])

by mail.meteogmp.ru (Postfix) with ESMTP id 4g14Wl3l4Dz1M9n6

for ; Wed, 22 Apr 2026 19:32:35 +0300 (MSK)

X-Virus-Scanned: Debian amavis at localhost.localdomain

Received: from mail.meteogmp.ru ([127.0.0.1])

by mail.meteogmp.ru (mail.meteogmp.ru [127.0.0.1]) (amavis, port 10024)

with ESMTP id 47rZVzVqlNEd for ;

Wed, 22 Apr 2026 19:32:35 +0300 (MSK)

Received: from s1590535.smartape-vps.com (_gateway [10.10.0.1])

by mail.meteogmp.ru (Postfix) with ESMTPS id 4g14Wk5Gcxz1M9q3

for ; Wed, 22 Apr 2026 19:32:34 +0300 (MSK)

From: Mike O'Leary

To: doctor@doctor.nl2k.ab.ca

Subject: Invoice attached from Mike O'Leary - Wednesday, April 22, 2026 9:34 a.m.

Date: 22 Apr 2026 09:34:04 -0700

Message-ID: <20260422093404.1A0A0D2F66C0CE4B@gmail.com>

MIME-Version: 1.0

Content-Type: text/html

Content-Transfer-Encoding: quoted-printable

X-Spam_score: 7.2

X-Spam_score_int: 72

X-Spam_bar: +++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Hi doctor, Attached is your invoice and payment receipt for

your records.



Content analysis details: (7.2 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[91.247.194.23 listed in dnsbl.ahbl.org]

[91.247.194.23 listed in dnsbl.ahbl.org]

[91.247.194.23 listed in dnsbl.ahbl.org]

[91.247.194.23 listed in dnsbl.ahbl.org]

[95.163.222.104 listed in dnsbl.ahbl.org]

[95.163.222.104 listed in dnsbl.ahbl.org]

[95.163.222.104 listed in dnsbl.ahbl.org]

[95.163.222.104 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[91.247.194.23 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[91.247.194.23 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[91.247.194.23 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[91.247.194.23 listed in dnsbl.ahbl.org]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[95.163.222.104 listed in bl.score.senderscore.com]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[91.247.194.23 listed in will-spam-for-food.eu.org]

[91.247.194.23 listed in will-spam-for-food.eu.org]

[91.247.194.23 listed in will-spam-for-food.eu.org]

[91.247.194.23 listed in will-spam-for-food.eu.org]

[91.247.194.23 listed in will-spam-for-food.eu.org]

[91.247.194.23 listed in will-spam-for-food.eu.org]

[91.247.194.23 listed in will-spam-for-food.eu.org]

[91.247.194.23 listed in will-spam-for-food.eu.org]

[95.163.222.104 listed in will-spam-for-food.eu.org]

[95.163.222.104 listed in will-spam-for-food.eu.org]

[95.163.222.104 listed in will-spam-for-food.eu.org]

[95.163.222.104 listed in will-spam-for-food.eu.org]

[95.163.222.104 listed in will-spam-for-food.eu.org]

[95.163.222.104 listed in will-spam-for-food.eu.org]

[95.163.222.104 listed in will-spam-for-food.eu.org]

[95.163.222.104 listed in will-spam-for-food.eu.org]

1.0 SPF_SOFTFAIL SPF: sender does not match SPF record (softfail)

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends in

digit

[andy55(at)gmail.com]

1.0 FORGED_GMAIL_RCVD 'From' gmail.com does not match 'Received' headers

0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider

[andy55(at)gmail.com]

1.5 MR_STRANGE_QUESTION URI: No description available.

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 HTML_MESSAGE BODY: HTML included in message

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 NO_RDNS2 Sending MTA has no reverse DNS

0.7 SPOOFED_FREEMAIL No description available.

0.1 SPOOF_GMAIL_MID From Gmail but it doesn't seem to be...

Subject: {SPAM?} Invoice attached from Mike O'Leary - Wednesday, April 22, 2026 9:34 a.m.

Russian INvoice SPam Part 1

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Wed, 22 Apr 2026 11:40:01 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1wFbY3-00000000NiP-13Zw

for dave@doctor.nl2k.ab.ca;

Wed, 22 Apr 2026 11:39:39 -0600

Resent-From: The Doctor

Resent-Date: Wed, 22 Apr 2026 11:39:39 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from relay.meteogmp.ru ([95.163.222.104]:19181)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1wFaY5-00000000I1B-3o66

for sales@nk.ca;

Wed, 22 Apr 2026 10:35:45 -0600

Received: from mail.meteogmp.ru (mail.meteogmp.ru [91.247.194.23])

by relay.meteogmp.ru (Postfix) with ESMTP id D74933EF95

for ; Wed, 22 Apr 2026 19:31:33 +0300 (MSK)

Received: from mail.meteogmp.ru (localhost [127.0.0.1])

by mail.meteogmp.ru (Postfix) with ESMTP id 4g14Wl4Fwvz1M9mZ

for ; Wed, 22 Apr 2026 19:32:35 +0300 (MSK)

X-Virus-Scanned: Debian amavis at localhost.localdomain

Received: from mail.meteogmp.ru ([127.0.0.1])

by mail.meteogmp.ru (mail.meteogmp.ru [127.0.0.1]) (amavis, port 10024)

with ESMTP id zGRDCVWqSJ0s for ;

Wed, 22 Apr 2026 19:32:35 +0300 (MSK)

Received: from s1590535.smartape-vps.com (_gateway [10.10.0.1])

by mail.meteogmp.ru (Postfix) with ESMTPS id 4g14Wl0RfBz1M9mj

for ; Wed, 22 Apr 2026 19:32:35 +0300 (MSK)

From: Mike O'Leary

To: sales@nk.ca

Subject: Invoice attached from Mike O'Leary - Wednesday, April 22, 2026 9:34 a.m.

Date: 22 Apr 2026 09:34:04 -0700

Message-ID: <20260422093404.E78456BF4B57ED08@gmail.com>

MIME-Version: 1.0

Content-Type: text/html

Content-Transfer-Encoding: quoted-printable

X-Spam_score: 7.2

X-Spam_score_int: 72

X-Spam_bar: +++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Hi sales, Attached is your invoice and payment receipt for

your records.



Content analysis details: (7.2 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[91.247.194.23 listed in dnsbl.ahbl.org]

[91.247.194.23 listed in dnsbl.ahbl.org]

[91.247.194.23 listed in dnsbl.ahbl.org]

[91.247.194.23 listed in dnsbl.ahbl.org]

[95.163.222.104 listed in dnsbl.ahbl.org]

[95.163.222.104 listed in dnsbl.ahbl.org]

[95.163.222.104 listed in dnsbl.ahbl.org]

[95.163.222.104 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[91.247.194.23 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[91.247.194.23 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[91.247.194.23 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[91.247.194.23 listed in dnsbl.ahbl.org]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[95.163.222.104 listed in bl.score.senderscore.com]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[91.247.194.23 listed in will-spam-for-food.eu.org]

[91.247.194.23 listed in will-spam-for-food.eu.org]

[91.247.194.23 listed in will-spam-for-food.eu.org]

[91.247.194.23 listed in will-spam-for-food.eu.org]

[91.247.194.23 listed in will-spam-for-food.eu.org]

[91.247.194.23 listed in will-spam-for-food.eu.org]

[91.247.194.23 listed in will-spam-for-food.eu.org]

[91.247.194.23 listed in will-spam-for-food.eu.org]

[95.163.222.104 listed in will-spam-for-food.eu.org]

[95.163.222.104 listed in will-spam-for-food.eu.org]

[95.163.222.104 listed in will-spam-for-food.eu.org]

[95.163.222.104 listed in will-spam-for-food.eu.org]

[95.163.222.104 listed in will-spam-for-food.eu.org]

[95.163.222.104 listed in will-spam-for-food.eu.org]

[95.163.222.104 listed in will-spam-for-food.eu.org]

[95.163.222.104 listed in will-spam-for-food.eu.org]

1.0 SPF_SOFTFAIL SPF: sender does not match SPF record (softfail)

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends in

digit

[andy55(at)gmail.com]

1.0 FORGED_GMAIL_RCVD 'From' gmail.com does not match 'Received' headers

0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider

[andy55(at)gmail.com]

1.5 MR_STRANGE_QUESTION URI: No description available.

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 HTML_MESSAGE BODY: HTML included in message

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 NO_RDNS2 Sending MTA has no reverse DNS

0.7 SPOOFED_FREEMAIL No description available.

0.1 SPOOF_GMAIL_MID From Gmail but it doesn't seem to be...

Subject: {SPAM?} Invoice attached from Mike O'Leary - Wednesday, April 22, 2026 9:34 a.m.

Russian INvoice SPam Part 2
















erif; font-size: 16px;">Hi sales,





erif; font-size: 16px;"> 





erif; font-size: 16px;">Attached is your invoice and payment receipt for yo=

ur records.





erif; font-size: 16px;"> 





erif; font-size: 16px;">Please review the attached document. Let us know if=

you have any questions.





erif; font-size: 16px;"> 





erif; font-size: 16px;">3D"d=<br
ocument icon" src=3D"https://gyazo.com/da09dca224cdd187568d5f5cb45895ed.png=

" width=3D"76" height=3D"104">






gomeryauc.vercel.app/?email=3Dsales@nk.ca">View_Invoice_Payment_Receipt.pdf=






erif; font-size: 16px;"> 





erif; font-size: 16px;">Best Regards,





Mike O'Leary


Billing Department








Invoice Phish from Russia Part 2














erif; font-size: 16px;">Hi root,





erif; font-size: 16px;"> 





erif; font-size: 16px;">Attached is your invoice and payment receipt for yo=

ur records.





erif; font-size: 16px;"> 





erif; font-size: 16px;">Please review the attached document. Let us know if=

you have any questions.





erif; font-size: 16px;"> 





erif; font-size: 16px;">3D"d=<br
ocument icon" src=3D"https://gyazo.com/da09dca224cdd187568d5f5cb45895ed.png=

" width=3D"76" height=3D"104">






gomeryauc.vercel.app/?email=3Droot@nk.ca">View_Invoice_Payment_Receipt.pdf<=

/a>





erif; font-size: 16px;"> 





erif; font-size: 16px;">Best Regards,





Mike O'Leary


Billing Department






Russian INvoice phish

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Wed, 22 Apr 2026 10:36:00 -0600

Received: from relay.meteogmp.ru ([95.163.222.104]:62960)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1wFaY5-00000000I17-3tv8

for dave@doctor.nl2k.ab.ca;

Wed, 22 Apr 2026 10:35:50 -0600

Received: from mail.meteogmp.ru (mail.meteogmp.ru [91.247.194.23])

by relay.meteogmp.ru (Postfix) with ESMTP id C14D13EDF5

for ; Wed, 22 Apr 2026 19:31:33 +0300 (MSK)

Received: from mail.meteogmp.ru (localhost [127.0.0.1])

by mail.meteogmp.ru (Postfix) with ESMTP id 4g14Wl3d5kz1M9n1

for ; Wed, 22 Apr 2026 19:32:35 +0300 (MSK)

X-Virus-Scanned: Debian amavis at localhost.localdomain

Received: from mail.meteogmp.ru ([127.0.0.1])

by mail.meteogmp.ru (mail.meteogmp.ru [127.0.0.1]) (amavis, port 10024)

with ESMTP id khhgqgvtowCO for ;

Wed, 22 Apr 2026 19:32:35 +0300 (MSK)

Received: from s1590535.smartape-vps.com (_gateway [10.10.0.1])

by mail.meteogmp.ru (Postfix) with ESMTPS id 4g14Wk5Cm8z1M9q1

for ; Wed, 22 Apr 2026 19:32:34 +0300 (MSK)

From: Mike O'Leary

To: dave@doctor.nl2k.ab.ca

Subject: Invoice attached from Mike O'Leary - Wednesday, April 22, 2026 9:34 a.m.

Date: 22 Apr 2026 09:34:04 -0700

Message-ID: <20260422093404.6A072C982CEAD731@gmail.com>

MIME-Version: 1.0

Content-Type: text/html

Content-Transfer-Encoding: quoted-printable

X-Spam_score: 7.2

X-Spam_score_int: 72

X-Spam_bar: +++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Hi dave, Attached is your invoice and payment receipt for

your records.



Content analysis details: (7.2 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[91.247.194.23 listed in dnsbl.ahbl.org]

[91.247.194.23 listed in dnsbl.ahbl.org]

[91.247.194.23 listed in dnsbl.ahbl.org]

[91.247.194.23 listed in dnsbl.ahbl.org]

[95.163.222.104 listed in dnsbl.ahbl.org]

[95.163.222.104 listed in dnsbl.ahbl.org]

[95.163.222.104 listed in dnsbl.ahbl.org]

[95.163.222.104 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[91.247.194.23 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[91.247.194.23 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[91.247.194.23 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[91.247.194.23 listed in dnsbl.ahbl.org]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[95.163.222.104 listed in bl.score.senderscore.com]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[91.247.194.23 listed in will-spam-for-food.eu.org]

[91.247.194.23 listed in will-spam-for-food.eu.org]

[91.247.194.23 listed in will-spam-for-food.eu.org]

[91.247.194.23 listed in will-spam-for-food.eu.org]

[91.247.194.23 listed in will-spam-for-food.eu.org]

[91.247.194.23 listed in will-spam-for-food.eu.org]

[91.247.194.23 listed in will-spam-for-food.eu.org]

[91.247.194.23 listed in will-spam-for-food.eu.org]

[95.163.222.104 listed in will-spam-for-food.eu.org]

[95.163.222.104 listed in will-spam-for-food.eu.org]

[95.163.222.104 listed in will-spam-for-food.eu.org]

[95.163.222.104 listed in will-spam-for-food.eu.org]

[95.163.222.104 listed in will-spam-for-food.eu.org]

[95.163.222.104 listed in will-spam-for-food.eu.org]

[95.163.222.104 listed in will-spam-for-food.eu.org]

[95.163.222.104 listed in will-spam-for-food.eu.org]

1.0 SPF_SOFTFAIL SPF: sender does not match SPF record (softfail)

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends in

digit

[andy55(at)gmail.com]

1.0 FORGED_GMAIL_RCVD 'From' gmail.com does not match 'Received' headers

0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider

[andy55(at)gmail.com]

1.5 MR_STRANGE_QUESTION URI: No description available.

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 HTML_MESSAGE BODY: HTML included in message

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 NO_RDNS2 Sending MTA has no reverse DNS

0.7 SPOOFED_FREEMAIL No description available.

0.1 SPOOF_GMAIL_MID From Gmail but it doesn't seem to be...

Subject: {SPAM?} Invoice attached from Mike O'Leary - Wednesday, April 22, 2026 9:34 a.m.
















erif; font-size: 16px;">Hi dave,





erif; font-size: 16px;"> 





erif; font-size: 16px;">Attached is your invoice and payment receipt for yo=

ur records.





erif; font-size: 16px;"> 





erif; font-size: 16px;">Please review the attached document. Let us know if=

you have any questions.





erif; font-size: 16px;"> 





erif; font-size: 16px;">3D"d=<br
ocument icon" src=3D"https://gyazo.com/da09dca224cdd187568d5f5cb45895ed.png=

" width=3D"76" height=3D"104">






gomeryauc.vercel.app/?email=3Ddave@doctor.nl2k.ab.ca">View_Invoice_Payment_=

Receipt.pdf





erif; font-size: 16px;"> 





erif; font-size: 16px;">Best Regards,





Mike O'Leary


Billing Department








Invoice phish from Russia Part 2














erif; font-size: 16px;">Hi www,





erif; font-size: 16px;"> 





erif; font-size: 16px;">Attached is your invoice and payment receipt for yo=

ur records.





erif; font-size: 16px;"> 





erif; font-size: 16px;">Please review the attached document. Let us know if=

you have any questions.





erif; font-size: 16px;"> 





erif; font-size: 16px;">3D"d=<br
ocument icon" src=3D"https://gyazo.com/da09dca224cdd187568d5f5cb45895ed.png=

" width=3D"76" height=3D"104">






gomeryauc.vercel.app/?email=3Dwww@doctor.nl2k.ab.ca">View_Invoice_Payment_R=

eceipt.pdf





erif; font-size: 16px;"> 





erif; font-size: 16px;">Best Regards,





Mike O'Leary


Billing Department