WEb/SEo/App spam from Google Gmail

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Sun, 30 Aug 2026 09:20:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.100 (FreeBSD))

(envelope-from )

id 1x0hJx-00000000OPS-2TL0

for dave@doctor.nl2k.ab.ca;

Sun, 30 Aug 2026 09:19:45 -0600

Resent-From: The Doctor

Resent-Date: Sun, 30 Aug 2026 09:19:45 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-pj2-f7.google.com ([74.125.227.135]:47753)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.100 (FreeBSD))

(envelope-from )

id 1x0h8y-00000000Mce-2F4Y

for sales@nk.ca;

Sun, 30 Aug 2026 09:08:33 -0600

Received: by mail-pj2-f7.google.com with SMTP id d9443c01a7336-2d903e972efso2947485ad.0

for ; Sun, 30 Aug 2026 08:07:37 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=theithubstudios.com; s=google; t=1788102452; x=1788707252; darn=nk.ca;

h=content-language:thread-index:content-type:mime-version:message-id

:date:subject:to:from:from:to:cc:subject:date:message-id:reply-to

:content-type;

bh=mZsiA/4dSoqNBl4zyl/i7I4EQHa35pZpE9u7l/0uATA=;

b=f3m9yGzi94QFRyHpNkC4BUQfO3x5Gkj/I0+UP03WchykYo93VIakvpZBxbR1llk7o3

A9cOt9wbHTlF56GZ8a0iwnilVBYo0thC3x7hcjwOhrvq5lyziqsP1fdQDnDpI+10mdEr

sjMUQZ7wtz9S0MzP5dqLcTRdWNXewb/aQUfoIZmNENDuEumLOPXk+ks2Hx7vCbvbgjOT

L6RpZ5WpnSEizPCdlsWN31ZN7hpcwZcW7vB/jNVdsLEbD+ZNcgvGLTvkm7FDd34UYi4O

LP0EGJwCFVEn5Fr9TCbHR+6fUYDkZmlL1bZU2Zxt6d1gJf/MmfUCL0EcibwB2J2snORP

TssQ==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20251104; t=1788102452; x=1788707252;

h=content-language:thread-index:content-type:mime-version:message-id

:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject

:date:message-id:reply-to:content-type;

bh=mZsiA/4dSoqNBl4zyl/i7I4EQHa35pZpE9u7l/0uATA=;

b=LykZeBLQZBwJjtkefQIOLZWVXO+I6T0Ho91SaTIc80yC/36jAmod0ep/yAhLgQRdPA

oMb8cpvE07dEiLFvAVzkahr982t9XtuHB4rawG1P+hEWgvPYXPM55RionIhvmII+PM4C

VbZfa+jiA1nH/2gx6Rdb6RSgcLyqvZgWf80nvuXZNnGfBD3ujCodLLQLbJzl4E+6oy28

sdaVTQlbiiQ9GcZbGnBW4xScYY75ANCoYEomMO4kO+VPkpKF52quuTcbUTRs0QydoxWP

j+9+KL+TxyeZg50YafGNzW3whR6BdXoQCYrjXfSpFT3tQDQe8q3+mYeyinZ8QVICk62k

+qag==

X-Gm-Message-State: AFuF++ktPs2qmyR1MSDzgA+OSwXDKIuPsv4pkxRVrUjXdNxdcQh9ueM7

D4s01eF2lSCziTibSuordrWhKLWPrCEwO6IJQaO9WLJNsgsgUmEbhe+W0pCLfQFwgiFfNAblojh

KInFnp7kiFQ==

X-Gm-Gg: AR+sD13D1m+S7L0CYscr7aeg+FsQKNn8uiWudFLvWBw96ybqWOV8XNBVF6jUpwvyJ0g

LAgzv8B1A1FWKilEMuge5fY7iBDW3aXiIEp3vWA/8Le5fylC/KzmTGRd9j2smKDZeIm0t2b43Wu

k4jNLxkmgLZYNsBT9FaMbN+t3/Tr4MYVctRrREDnCP02v39n5bkZcfmBCphPckEBCDkP5tQ+kJ3

sabyLFMzqDGDJk+ZAx2IPOISScpYyXkQGx2JCWlsG79W+N6c7DrbRL6LcPQGyeMarRuT0jyYVzP

tu3++Dw4J9Zvk0nqLURY1TX/uevkNVyPBNBm6NowFxftRDCdCQ0JTp3R2aX1gBQ7BqeQEtQoNqD

o13nrOXEFRW99R/Wxx1cQigtjymRAmEi9VjaDy5qRnaJDpkFfK2/NF0N88UbzYWOlad6DmiXcIi

9JN4UUTNib/qNKD8GfCGAy8Sz++zgL2khlV3RjeHr5LckRltq9sOTGqpJHjpkthhQ+ho/h1R8gd

XInw5eV

X-Received: by 2002:a05:6a21:700d:b0:3d3:b00a:7082 with SMTP id adf61e73a8af0-3d3b00a77a9mr21417928637.28.1788102451648;

Sun, 30 Aug 2026 08:07:31 -0700 (PDT)

Received: from DESKTOPL5RN3M6 ([2401:4900:8845:5a12:7cbf:50f4:82f5:6322])

by smtp.gmail.com with ESMTPSA id 41be03b00d2f7-cc1f3312676sm2778648a12.12.2026.08.30.08.07.30

for

(version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128);

Sun, 30 Aug 2026 08:07:31 -0700 (PDT)

From: "Suhas Dyani"

To:

Subject: #Reminder Email

Date: Sun, 30 Aug 2026 20:29:45 +0530

Message-ID: <1b41801dd3891$474dfe50$d5e9faf0$@theithubstudios.com>

MIME-Version: 1.0

Content-Type: multipart/alternative;

boundary="----=_NextPart_000_1B419_01DD38BF.61063A50"

X-Mailer: Microsoft Outlook 14.0

Thread-Index: Ad04ihwQ2ZcRNQ3MTpKcNG8LddTY7w==

Content-Language: en-us

X-Spam_score: 5.2

X-Spam_score_int: 52

X-Spam_bar: +++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Hi, May I send you a web portfolio and prices? Please let

me know. Thank you,



Content analysis details: (5.2 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[2401:4900:8845:5a12:7cbf:50f4:82f5:6322 listed]

[in will-spam-for-food.eu.org]

[2401:4900:8845:5a12:7cbf:50f4:82f5:6322 listed]

[in will-spam-for-food.eu.org]

[2401:4900:8845:5a12:7cbf:50f4:82f5:6322 listed]

[in will-spam-for-food.eu.org]

[2401:4900:8845:5a12:7cbf:50f4:82f5:6322 listed]

[in will-spam-for-food.eu.org]

[2401:4900:8845:5a12:7cbf:50f4:82f5:6322 listed]

[in will-spam-for-food.eu.org]

[2401:4900:8845:5a12:7cbf:50f4:82f5:6322 listed]

[in will-spam-for-food.eu.org]

[2401:4900:8845:5a12:7cbf:50f4:82f5:6322 listed]

[in will-spam-for-food.eu.org]

[2401:4900:8845:5a12:7cbf:50f4:82f5:6322 listed]

[in will-spam-for-food.eu.org]

[74.125.227.135 listed in will-spam-for-food.eu.org]

[74.125.227.135 listed in will-spam-for-food.eu.org]

[74.125.227.135 listed in will-spam-for-food.eu.org]

[74.125.227.135 listed in will-spam-for-food.eu.org]

[74.125.227.135 listed in will-spam-for-food.eu.org]

[74.125.227.135 listed in will-spam-for-food.eu.org]

[74.125.227.135 listed in will-spam-for-food.eu.org]

[74.125.227.135 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[74.125.227.135 listed in dnsbl.ahbl.org]

[74.125.227.135 listed in dnsbl.ahbl.org]

[74.125.227.135 listed in dnsbl.ahbl.org]

[74.125.227.135 listed in dnsbl.ahbl.org]

[2401:4900:8845:5a12:7cbf:50f4:82f5:6322 listed]

[in dnsbl.ahbl.org]

[2401:4900:8845:5a12:7cbf:50f4:82f5:6322 listed]

[in dnsbl.ahbl.org]

[2401:4900:8845:5a12:7cbf:50f4:82f5:6322 listed]

[in dnsbl.ahbl.org]

[2401:4900:8845:5a12:7cbf:50f4:82f5:6322 listed]

[in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[74.125.227.135 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[74.125.227.135 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[74.125.227.135 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[74.125.227.135 listed in dnsbl.ahbl.org]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

1.9 URIBL_ABUSE_SURBL Contains an URL listed in the ABUSE SURBL blocklist

[URI: theithubstudios.com]

1.9 URIBL_JP_SURBL Contains an URL listed in the JP SURBL blocklist

[URI: theithubstudios.com]

-0.0 SPF_PASS SPF: sender matches SPF record

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[74.125.227.135 listed in bl.score.senderscore.com]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[74.125.227.135 listed in list.dnswl.org]

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[74.125.227.135 listed in wl.mailspike.net]

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

Subject: {SPAM?} #Reminder Email



This is a multipart message in MIME format.



------=_NextPart_000_1B419_01DD38BF.61063A50

Content-Type: text/plain;

charset="us-ascii"

Content-Transfer-Encoding: 7bit



Hi,



May I send you a web portfolio and prices? Please let me know.



Thank you,







_____



From: Suhas Dyani

Sent: 18 August 2026 04:58 PM

To: sales@nk.ca

Subject: Ranking 1st Page



Hello,



I was checking your website ''www.nk.ca" and see you have a good design and

it looks great, but it's not ranking on Google and other major search

engine.



I'm a SEO Expert and I helped over 2500 businesses rank on the (1st Page on

Google). My rates are very affordable.



Can I send you a price list?



Thanks

Suhas Dyani





------=_NextPart_000_1B419_01DD38BF.61063A50

Content-Type: text/html;

charset="us-ascii"

Content-Transfer-Encoding: quoted-printable




xmlns:o=3D"urn:schemas-microsoft-com:office:office" =

xmlns:w=3D"urn:schemas-microsoft-com:office:word" =

xmlns:m=3D"http://schemas.microsoft.com/office/2004/12/omml" =

xmlns=3D"http://www.w3.org/TR/REC-html40">
HTTP-EQUIV=3D"Content-Type" CONTENT=3D"text/html; =

charset=3Dus-ascii">
(filtered medium)">
link=3D"#0563C1" vlink=3D"#954F72">


class=3DMsoNormal =

style=3D'margin-bottom:12.0pt;line-height:normal'>
style=3D'color:black;background:white'>Hi,
lang=3DEN-US>

May I =

send you a web portfolio and prices? Please let me =

know.

Thank you,


lang=3DEN-US>


style=3D'margin-bottom:12.0pt;text-align:center;line-height:normal'>
lang=3DEN-US>


class=3DMsoNormal =

style=3D'margin-bottom:12.0pt;line-height:normal'>
style=3D'color:black;background:white'>From:
lang=3DEN-US style=3D'color:black;background:white'> Suhas =

Dyani

style=3D'color:black;background:white'>Sent:
style=3D'color:black;background:white'> 18 August 2026 04:58 =

PM

style=3D'color:black;background:white'>To:
style=3D'color:black;background:white'> sales@nk.ca

an style=3D'color:black;background:white'>Subject:
style=3D'color:black;background:white'> Ranking 1st =

Page


style=3D'color:black;background:white'>Hello,


style=3D'color:black;background:white'>I was checking your website =

‘‘www.nk.ca
style=3D'color:black;background:white'>” and see you have a good =

design and it looks great, but it’s not ranking on Google and =

other major search engine.


style=3D'color:black;background:white'>I’m a SEO Expert and I =

helped over 2500 businesses rank on the (1st Page on Google). My =

rates are very affordable.


style=3D'color:black;background:white'>Can I send you a price =

list?


style=3D'color:black;background:white'>Thanks

style=3D'color:black;background:white'>Suhas =

Dyani



------=_NextPart_000_1B419_01DD38BF.61063A50--



Loan phish from Google Gmail

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Sat, 29 Aug 2026 20:31:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.100 (FreeBSD))

(envelope-from )

id 1x0VJ7-00000000Ltv-0mPb

for dave@doctor.nl2k.ab.ca;

Sat, 29 Aug 2026 20:30:05 -0600

Resent-From: The Doctor

Resent-Date: Sat, 29 Aug 2026 20:30:05 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-yw1-f181.google.com ([209.85.128.181]:61747)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.100 (FreeBSD))

(envelope-from )

id 1x0VF6-00000000L8x-1efi

for doctor@doctor.nl2k.ab.ca;

Sat, 29 Aug 2026 20:26:05 -0600

Received: by mail-yw1-f181.google.com with SMTP id 00721157ae682-81ed2a06b9eso16950677b3.3

for ; Sat, 29 Aug 2026 19:25:08 -0700 (PDT)

ARC-Seal: i=1; a=rsa-sha256; t=1788056702; cv=none;

d=google.com; s=arc-20260327;

b=YztaMKYlYjDt4dXKjiO1LpSN8tc2EcLq8cIQqUA63ndBeQRIRboeiULrQsgFs0qKok

obqGVBShdUq8OHkoD77IL/3uBuIxGNcKTRvZEnxFcBmhBAVwjudcr/3epETCtFXaRUQw

5Y7JNUH1/IDNkioO3ospt3jt/swn1EATKmwdDL6Nl9rXAF+jFzShx4fJdHEu4PkolErW

1m2RgufS9/NYdIN/CDa8PWdE5vEd8qsD2HxlPPoe7wNybkvkPTIef2d+BQOSopRv6C1l

pzkTUBy9cgAUZQwmhWNx87dJPjCfLki0dlzIckE1g5o8YvnAtc8Ydgx9Vvbk5MJKwU7G

2zyA==

ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20260327;

h=to:subject:message-id:date:from:reply-to:mime-version

:dkim-signature;

bh=997sFx9mnnvdp2ph94YQOhXJTK9VtVntmmphxIyEFOs=;

fh=N7PBsHtgfA/gvmXGo1kUF9onXcis58rdtYLvHUCjy0o=;

b=iTYRgzlpp4FN2lqzGLEry0gAifh/VBWwrB8oY1npL26kl/KDrT2pFHEz+o5eYx2Tq/

kDFyGgTs2xHbrc/bOUyss4s3MHJzvqQDcp7hSwI8uJ0rYeMoFMzwI83wJvIQQmie4b8X

j8w9p/cZzMYX6lSQauU1Ep/gAqyuvfocuuuN332JIXDDCgA+4D2BaEru+VIAp4lZ9NEL

Vy6vt72ANwJG0oanSR2zFbE4nXYNU8+dGBgR/hpcJ69eJUZRvkRCzWnXqhqWASj3qS/F

KYriSseziu0D80Iq+t9NAJhbwrwJdUdM1hq8/NTx9kG5az5TI+sKYrkFHEOHFsIYsufu

Cspw==;

darn=doctor.nl2k.ab.ca

ARC-Authentication-Results: i=1; mx.google.com; arc=none

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=gmail.com; s=20251104; t=1788056702; x=1788661502; darn=doctor.nl2k.ab.ca;

h=content-type:to:subject:message-id:date:from:reply-to:mime-version

:from:to:cc:subject:date:message-id:reply-to:content-type;

bh=997sFx9mnnvdp2ph94YQOhXJTK9VtVntmmphxIyEFOs=;

b=Mkpap333VuZHGwcnxuTUEAMpSsQf5wKUaKbO2rIi/4Fyk8qJ2oBnQnkRQoA1V/A+Gk

7nlFtfYglr5NXYJ0zVJL8FRb/JoKYv+qMsdKwmQgbr1mT4oSzml9Ew+iyqk5xE2rUnfn

DDtwgmXNpYoQt3JVBxnhw+RpTjmglITuJwkG2shk4cD3JrMwmkhWPReVEISJHotq8XK4

0A+ERsb3fU6w8FEWPEAwr2CIxB/r3SmWTMJRSn8WNzZI0EXx+yg3HcTC8od/OLd1eWRv

1a+L4tl6Xk51Hf46UyAlDYZhWF39UwmDDF0eD3UL2lkf4ZW97lfXXpznZKfqLbauDcS0

svww==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20251104; t=1788056702; x=1788661502;

h=content-type:to:subject:message-id:date:from:reply-to:mime-version

:x-gm-gg:x-gm-message-state:from:to:cc:subject:date:message-id

:reply-to:content-type;

bh=997sFx9mnnvdp2ph94YQOhXJTK9VtVntmmphxIyEFOs=;

b=ceYR/Estx9dzPLpvt4FgMvYV1X4pmC3lnMUjG8cS/hfBB6LnwO1O8J6CvoT7SUBCqN

uvPZW0xgX0JwLYOux1IEWt9Hcx2C8w4TreO9RV6lzpx0T0IY7PL9SnSS/b73aa5xJ777

6gnytfpnuDz9dz5Kzp4v7kJGMvPzEHy0JRlQEEdpJDBWBmcpIFttBdic1QOuI6J4fqH0

dgUHMmRACQQRAskNzWfRGvmTZPsXIwk0D5GiZWW7YfWL2KyR6OtXnD8beAhxVQybQx7P

7xMQsh3k4KYNO9dvINOMtZ5F7zavzGQtRZGQii8e6ly0Jgn7eeYMmaHN89Ue/crNoqJN

VQpg==

X-Forwarded-Encrypted: i=1; AKwUvBzSEisewBOEDddPyLt3ZeuKBIeysUbXLBNjPNCWJHTR2u4bz8BGo/DSJQVa2hosTEb34BE5Xws=@doctor.nl2k.ab.ca

X-Gm-Message-State: AFuF++kIwha8KKd4jsq4Xnj9bBh/hstdq/O9M/CpyKpxMPT9NwdW5M3G

W+lECUe719bnH2ouGFJjtH8AxXU++6VvNj1eON7Lld5FsZCZ/MyyDRRcHGpLZeCoW9ABjqbybrD

59KEE/Uw9yRmyy43WZDnNDqc9sobgWbM=

X-Gm-Gg: AYBFou0jZJz3qK4mjp6/ZZJLB4KVmo2zrWkiS0MEKh9b9cfDcGVrtkY1jiar8rIflPk

I0RRAjbn2QKoM6X9nFfMtPJ1oY1GbStRDqmciQHWIIP+3uBDNyxsyinUj4maB3opAxhs/Tw+W1o

mqAwjPN2QxPsJ4mzOzqT2Fh1rs4yu5mHQv6bdbS3ywds35YpXKrFqinJGntTM90NgxDHjOHixN4

EXp4VQrDabru0cq96P2xQM+KABeYJfxB9WpWaP3GCDYbXB2Jr3dc1UcDhnAmEcCktpC6HM2lohU

0mgE4PYXldHO/QDw+724B0ff2KNPZL80fbPoLH+VuvUVifmJhN7hodyaZnDwpKoqyLAw991kQAh

nHKoXHIje

X-Received: by 2002:a05:690c:a4c5:b0:834:fadf:6085 with SMTP id

00721157ae682-85d65ee8822mr52645367b3.4.1788056702119; Sat, 29 Aug 2026

19:25:02 -0700 (PDT)

MIME-Version: 1.0

Reply-To: rh2832846@gmail.com

From: Rashid Mohammad Hassan

Date: Sat, 29 Aug 2026 19:24:30 -0700

X-Gm-Features: AcwNN1XnXro_FvpsLjGxIZH475zk5QMcGBpVvjY1UtwyPcOrF6gEOe40KRyWBaM

Message-ID:

Subject: We Provide Loan For Project..

To: undisclosed-recipients:;

Content-Type: text/plain; charset="UTF-8"

Bcc: doctor@doctor.nl2k.ab.ca

X-Spam_score: 11.5

X-Spam_score_int: 115

X-Spam_bar: +++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Dear Sir, My name is Mr.Rashid Hassan, the finance officer,

Sheikh Tamim Bin Hamad Finance House; we are independent financial advisors

offering high quality and independent financial services for gulf region

r [...]



Content analysis details: (11.5 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[209.85.128.181 listed in will-spam-for-food.eu.org]

[209.85.128.181 listed in will-spam-for-food.eu.org]

[209.85.128.181 listed in will-spam-for-food.eu.org]

[209.85.128.181 listed in will-spam-for-food.eu.org]

[209.85.128.181 listed in will-spam-for-food.eu.org]

[209.85.128.181 listed in will-spam-for-food.eu.org]

[209.85.128.181 listed in will-spam-for-food.eu.org]

[209.85.128.181 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[209.85.128.181 listed in dnsbl.ahbl.org]

[209.85.128.181 listed in dnsbl.ahbl.org]

[209.85.128.181 listed in dnsbl.ahbl.org]

[209.85.128.181 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[209.85.128.181 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[209.85.128.181 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[209.85.128.181 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[209.85.128.181 listed in dnsbl.ahbl.org]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[209.85.128.181 listed in list.dnswl.org]

-0.0 SPF_PASS SPF: sender matches SPF record

1.5 GR_DOMAIN_UNDISC1 To contains undisclosed recipient (undisc)

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends in

digit

[syedmohammadahmed79(at)gmail.com]

0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider

[syedmohammadahmed79(at)gmail.com]

0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in digit

[rh2832846(at)gmail.com]

0.6 J_CHICKENPOX_54 BODY: 5alpha-pock-4alpha

1.7 DEAR_SOMETHING BODY: Contains 'Dear (something)'

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[209.85.128.181 listed in bl.score.senderscore.com]

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[209.85.128.181 listed in wl.mailspike.net]

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

2.9 UNDISC_FREEM Undisclosed recipients + freemail reply-to

1.0 FREEMAIL_REPLYTO Reply-To/From or Reply-To/body contain different

freemails

2.1 UNDISC_MONEY Undisclosed recipients + money/fraud signs

Subject: {SPAM?} We Provide Loan For Project..



Dear Sir,



My name is Mr.Rashid Hassan, the finance officer, Sheikh Tamim Bin

Hamad Finance House; we are independent financial advisors offering

high quality and independent financial services for gulf region

residents and expatriates living abroad.



We offer corporate and personal loans at 3% interest rate for the

duration of (fifteen 15 years) available for both gulf residents and

expatriates or business owners worldwide.



We also have 1% commission for all our brokers worldwide who introduce

business and project owners for finance or other opportunities.



Kindly keep me posted if you are interested in more details.



Regards,



Mr. Rashid Hassan

Finance Officer.

Sheikh Tamim Bin Hamad Finance House,

Al Maha Building, 29, Al Rida Street,

Fereej Bin Omran,Doha, Qatar

Settlement Notice Canada phish

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Sat, 29 Aug 2026 07:27:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.100 (FreeBSD))

(envelope-from )

id 1x0J4W-00000000Om1-1ldQ

for dave@doctor.nl2k.ab.ca;

Sat, 29 Aug 2026 07:26:12 -0600

Resent-From: The Doctor

Resent-Date: Sat, 29 Aug 2026 07:26:12 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from sumaura.ed.jp ([122.28.44.173]:51990)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.100 (FreeBSD))

(envelope-from )

id 1x0EDr-000000001ft-2iKN

for root@doctor.nl2k.ab.ca;

Sat, 29 Aug 2026 02:15:40 -0600

Received: from EC2AMAZ-GIQJMCG (ec2-15-152-154-241.ap-northeast-3.compute.amazonaws.com [15.152.154.241])

by sumaura.ed.jp (Postfix) with ESMTPA id AA57322107530

for ; Sat, 29 Aug 2026 17:14:40 +0900 (JST)

Authentication-Results: sumaura.ed.jp; arc=none smtp.remote-ip=15.152.154.241

ARC-Seal: i=1; a=rsa-sha256; d=bizmw.com; s=default; t=1787991280; cv=none;

b=uU2eecAquoEnCES4cTzZkAEv8gKrwm7vhUKS5X9mDotOIUTJCNdJXw4Q3APRSIvws6vQ7O9f/NgY5uptu/B0IprJ9PWw7RiUNXkRhgj9MMmQF+eiJCEetqREy5mReYtOxv2EP+fSgmgCt06Ezu32AP7OyPHl6XE43e7LzTZyD9M=

ARC-Message-Signature: i=1; a=rsa-sha256; d=bizmw.com; s=default;

t=1787991280; c=relaxed/relaxed;

bh=t/YBSsf97TWqp+wKtGfBPJCPupV1yDBiIGi+KI1dmIY=;

h=DKIM-Signature:MIME-Version:From:To:Date:Subject; b=w4Ge4MFwwzpvYf2EF2feTafUqZ42Y8asBKkaC+h2yslmCPN7tb8z0CJkthkBPBw1m73xcwO7dAPX0uUw9PLbHgNFRUO5lD6630bmnL32VMGD1HUF4E7vKlJT6AU4uHJnTNk9/8FMUJxTIphv19Cbh9bhqXUD48yve4aE6efo58Y=

ARC-Authentication-Results: i=1; sumaura.ed.jp

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=sumaura.ed.jp;

s=bizmw; t=1787991280;

bh=t/YBSsf97TWqp+wKtGfBPJCPupV1yDBiIGi+KI1dmIY=;

h=From:To:Date:Subject:From;

b=c3RSI88igwWjRKGb3/iaVPEGddGjizy691hiFNruQOo6eKrt9dh+r+sCKmkDsKsTS

sBUCelLlILnBWW1fc9u+cK0azCpJ8mc9suHXNUGXneWLc0vjGmhypJ5eX9sojwr+j5

ZLSd4oeRSVxXCjnTgfOBBFqT5zKpEu31nB8iQDLs=

MIME-Version: 1.0

From: "Settlement Notice Canada"



To: root@doctor.nl2k.ab.ca

Date: 29 Aug 2026 08:14:41 +0000

Subject: =?utf-8?B?Q2FuYWRpYW4gQ2xhc3MgQWN0aW9uIFNldHRsZW1lbnQgTm90?=

=?utf-8?B?aWNlIOKAlCBSZWYgTm/CuiA1MTM2NTUyNTQ3MSA4LzI5LzIwMjYgODox?=

=?utf-8?B?NDo0MSBBTQ==?=

Content-Type: multipart/alternative;

boundary=--boundary_78_3f0ee6f2-953d-43c1-a484-468e0c5c661c



LEGAL INFORMATION

SETTLEMENT NOTICE



PACKAGED BREAD

2026

Settlement Information

Loblaw / Weston

Packaged Bread

Class Actions

Important information concerning the proposed national settlement and potential Settlement Class Members.



Why you are receiving this

You are receiving this email because you were identified as having claimed a $100 to $200 Loblaw Card from the Packaged Bread Loblaw Card Program and/or as having registered with the lawyers handling this class action.

01 — Legal Notice

Authorized by the Superior Court of Justice for Ontario



About the settlement

Class actions have been certified/authorized by the Ontario Superior Court of Justice and the Superior Court of Quebec on behalf of individuals and businesses resident in Canada who purchased Packaged Bread alleging certain manufacturers and retailers engaged in anticompetitive conduct resulting in overcharges for Packaged Bread sold in Canada.

The Courts have not yet made any decision on the merits of the claims or the defences in either of the actions.

National Settlement

$500 Million

$96 million already paid

02 — Settlement Details

The Plaintiffs in the actions have entered into a national settlement with Loblaw/Weston for $500 million and their cooperation in pursuing claims against non-settling defendants in the continuing actions.

If the settlement is approved by the Courts in both actions, the net settlement funds, after approved fees and expenses, will be distributed to and for the benefit of Settlement Class Members in accordance with the applicable distribution protocol.

03 — Eligibility

Canadian Settlement Class Members

If you are resident anywhere in Canada except Quebec and purchased Packaged Bread between January 1, 2008 and December 31, 2025, inclusive, and wish to participate in the Loblaw/Weston Settlement, please review the official settlement information and eligibility requirements.

Review the settlement information

Review the applicable eligibility requirements and deadlines.

Apply Now



Appliquez

Before submitting any information

Verify the settlement administrator, court notice, claim deadline and official website before providing personal or financial information.

This communication contains settlement information. Please consult the official settlement materials for the authoritative terms, eligibility requirements and deadlines.



https://www.canadianbreadsettlement.ca/ | Unsubscribe

```

NRA Financial Serivces phish

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Sat, 29 Aug 2026 07:26:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.100 (FreeBSD))

(envelope-from )

id 1x0J47-00000000NFu-3mEk

for dave@doctor.nl2k.ab.ca;

Sat, 29 Aug 2026 07:25:47 -0600

Resent-From: The Doctor

Resent-Date: Sat, 29 Aug 2026 07:25:47 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail.ch-cotefleurie.fr ([85.69.129.56]:34398)

by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

(Exim 4.100 (FreeBSD))

(envelope-from )

id 1x0EAg-000000001D2-3n7x

for sales@nk.ca;

Sat, 29 Aug 2026 02:12:25 -0600

Received: from mail.ch-cotefleurie.fr (unknown [127.0.0.1])

by IMSVA (Postfix) with ESMTP id 2DCB21C2B7;

Sat, 29 Aug 2026 09:41:39 +0200 (CEST)

Received: from mail.ch-cotefleurie.fr (unknown [127.0.0.1])

by IMSVA (Postfix) with ESMTP id EAB4A1C2B2;

Sat, 29 Aug 2026 09:41:38 +0200 (CEST)

Received: from cpsureproxy.ch-cotefleurie.fr (unknown [10.100.0.126])

by mail.ch-cotefleurie.fr (Postfix) with ESMTPS;

Sat, 29 Aug 2026 09:41:38 +0200 (CEST)

Received: from SRVCPSPROXY (localhost [127.0.0.1])

by cpsureproxy.ch-cotefleurie.fr (CPSureProxy) with ESMTP id 9ADEA40CD1F8;

Sat, 29 Aug 2026 09:42:44 +0200 (CEST)

Received: from localhost ([127.0.0.1])

by cpsure-proxycpsureproxy.ch-cotefleurie.fr (CpsureProxy SMTP Server ) with SMTP ID 661;

Sat, 29 Aug 2026 09:42:44 +0200 (CEST)

Subject: RE: 3% Loan Offer

Received: from VMMAIL.ch-cotefleurie.lan (vmmail.ch-cotefleurie.lan [10.100.0.121])

by cpsureproxy.ch-cotefleurie.fr (CPSureProxy) with ESMTPS id F3934408B92C;

Sat, 29 Aug 2026 09:42:43 +0200 (CEST)

Received: from VMMAIL.ch-cotefleurie.lan (10.100.0.121) by

VMMAIL.ch-cotefleurie.lan (10.100.0.121) with Microsoft SMTP Server (TLS) id

15.0.1497.48; Sat, 29 Aug 2026 09:41:37 +0200

Received: from VMMAIL.ch-cotefleurie.lan ([::1]) by VMMAIL.ch-cotefleurie.lan

([::1]) with mapi id 15.00.1497.048; Sat, 29 Aug 2026 09:41:37 +0200

From: Lacroix Barbery Isabelle

Thread-Topic: 3% Loan Offer

Thread-Index: Ad03ic5hIhdb4/gfT56cHTPb7MGyeQ==

Date: Sat, 29 Aug 2026 07:41:36 +0000

Message-ID:

References:

In-Reply-To:

Reply-To: "nrafinancialservices@gmail.com"

Accept-Language: fr-FR, en-US

Content-Language: en-US

X-MS-Has-Attach: yes

X-MS-TNEF-Correlator:

x-ms-exchange-transport-fromentityheader: Hosted

x-originating-ip: [10.100.0.182]

X-TM-AS-Product-Ver: IMSVA-9.1.0.2090-9.0.0.1006-29414.003

X-TM-AS-Result: No--22.114-5.0-31-10

X-TMASE-MatchedRID: MEQKCd2trAoSNshT2Pmtjk6cPAGJW4fBBAvKzU5bamyuts+PvHaQBZ/v

Lk4ECKhoNtrqBJtuOX6I40w6RysGJoc7+Qb8+03pG66tuBin4dAIKj6WwO7KdVYiM8eC1pUc90i

bxL4bz6Auy+d2rXUBkptVVeKU/pCr8IMW9dkWZjJh5IuIaxTO+VTizEWrqKARdigxMAcafVqFAf

5iylR8WhiZsVhauLEn2QQJvp4Wi4Bq9oJbnOqI2ovptQwz5tsimzsJ8CsZYU4452hx28rHFd4/Y

ESqlSEjaxRbNXCVDGpv3aldo2nDN6NfMEt6ct/sdAU6ju3vtggVa1aLx/BuKYs8pmiDRrsD1QHs

EgWqqGqt1kt6UTrAW077e4Y1xq/3xiknb2OPrsiQcHYOUcn/nt8dWDYdvqmpDUELQvnUqRe18B4

/wJrJhq9qwExAVIsfkz95T9f7my5Ws+NJhfhHRFWdnB1JA5xrdnYdrEck9S5JfaMWBkhEfZqzs/

+5MP0Yq7md2MBDN9qTjfdmiwjcEZRMZUCEHkRt

X-TM-AS-User-Approved-Sender: Yes

x-tm-as-user-blocked-sender: No

X-TMASE-Result: 10--22.114400-10.000000

X-TMASE-Version: IMSVA-9.1.0.2090-9.0.1006-29414.003

x-tm-snts-smtp: 91EC04EC399893F12A16A7B7C3AB917E51F2073ED340D13E3E72782762B0DDB82000:9

Content-Type: multipart/mixed;

boundary="_004_dc47ab0fdf3c434a9d71d2fe5f4b5ddeVMMAILchcotefleurielan_"

MIME-Version: 1.0

To: undisclosed-recipients:;

X-TM-AS-GCONF: 11111111

X-TM-AS-SMTP: 1.0 Y3BzdXJlcHJveHkuY2gtY290ZWZsZXVyaWUuZnI=

SWxhY3JvaXhiYXJiZXJ5QGNoLWNvdGVmbGV1cmllLmZy

X-TM-AS-ERS: 0.0.0.0-0.0.0.0

X-imss-scan-details: No--22.114-5.0-31-10

X-IMSS-DKIM-White-List: No;No

X-TMASE-SNAP-Result: 1.821001.0001-0-1-22:0,33:0,34:0-0

X-Spam_score: 5.8

X-Spam_score_int: 58

X-Spam_bar: +++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: kindly Find attached for more information kindly Find attached

for more information



Content analysis details: (5.8 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[85.69.129.56 listed in will-spam-for-food.eu.org]

[85.69.129.56 listed in will-spam-for-food.eu.org]

[85.69.129.56 listed in will-spam-for-food.eu.org]

[85.69.129.56 listed in will-spam-for-food.eu.org]

[85.69.129.56 listed in will-spam-for-food.eu.org]

[85.69.129.56 listed in will-spam-for-food.eu.org]

[85.69.129.56 listed in will-spam-for-food.eu.org]

[85.69.129.56 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[85.69.129.56 listed in dnsbl.ahbl.org]

[85.69.129.56 listed in dnsbl.ahbl.org]

[85.69.129.56 listed in dnsbl.ahbl.org]

[85.69.129.56 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[85.69.129.56 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[85.69.129.56 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[85.69.129.56 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[85.69.129.56 listed in dnsbl.ahbl.org]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-0.0 SPF_PASS SPF: sender matches SPF record

0.5 NO_RDNS Sending MTA has no reverse DNS (Postfix variant)

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

1.5 GR_DOMAIN_UNDISC1 To contains undisclosed recipient (undisc)

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[85.69.129.56 listed in bl.score.senderscore.com]

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[85.69.129.56 listed in wl.mailspike.net]

-0.0 T_RP_MATCHES_RCVD Envelope sender domain matches handover relay

domain

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 NO_RDNS2 Sending MTA has no reverse DNS

2.5 FREEMAIL_FORGED_REPLYTO Freemail in Reply-To, but not From

Subject: {SPAM?} RE: 3% Loan Offer







--_004_dc47ab0fdf3c434a9d71d2fe5f4b5ddeVMMAILchcotefleurielan_

Content-Type: multipart/alternative;

boundary="_000_dc47ab0fdf3c434a9d71d2fe5f4b5ddeVMMAILchcotefleurielan_"



--_000_dc47ab0fdf3c434a9d71d2fe5f4b5ddeVMMAILchcotefleurielan_

Content-Type: text/plain; charset="us-ascii"

Content-Transfer-Encoding: quoted-printable





kindly Find attached for more information



--_000_dc47ab0fdf3c434a9d71d2fe5f4b5ddeVMMAILchcotefleurielan_

Content-Type: text/html; charset="us-ascii"

Content-Transfer-Encoding: quoted-printable




osoft-com:office:office" xmlns:w=3D"urn:schemas-microsoft-com:office:word" =

xmlns:m=3D"http://schemas.microsoft.com/office/2004/12/omml" xmlns=3D"http:=

//www.w3.org/TR/REC-html40">




>








break-word">



 



kindly Find attached for more information=











--_000_dc47ab0fdf3c434a9d71d2fe5f4b5ddeVMMAILchcotefleurielan_--



--_004_dc47ab0fdf3c434a9d71d2fe5f4b5ddeVMMAILchcotefleurielan_

Content-Type: image/jpeg; name="3%_Special_Loan.jpg"

Content-Description: 3%_Special_Loan.jpg

Content-Disposition: attachment; filename="3%_Special_Loan.jpg"; size=180287;

creation-date="Sun, 09 Aug 2026 10:07:46 GMT";

modification-date="Sun, 09 Aug 2026 10:08:24 GMT"

Content-Transfer-Encoding: base64



...





--_004_dc47ab0fdf3c434a9d71d2fe5f4b5ddeVMMAILchcotefleurielan_--

Docusign phish from google Gmail

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Fri, 28 Aug 2026 20:48:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.100 (FreeBSD))

(envelope-from )

id 1x096J-000000005kJ-1m4v

for dave@doctor.nl2k.ab.ca;

Fri, 28 Aug 2026 20:47:23 -0600

Resent-From: The Doctor

Resent-Date: Fri, 28 Aug 2026 20:47:23 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-wm1-f102.google.com ([209.85.128.102]:42370)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.100 (FreeBSD))

(envelope-from )

id 1x08yh-000000004T4-0EMq

for doctor@netknow.ca;

Fri, 28 Aug 2026 20:39:40 -0600

Received: by mail-wm1-f102.google.com with SMTP id 5b1f17b1804b1-495437bb891so10819905e9.1

for ; Fri, 28 Aug 2026 19:38:43 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=brushme-com-ua.20251104.gappssmtp.com; s=20251104; t=1787971117; x=1788575917; darn=netknow.ca;

h=content-type:mime-version:date:message-id:subject:to:from:from:to

:cc:subject:date:message-id:reply-to:content-type;

bh=ecFgV2Mg7lNOcdQYVoSakzRe7/55dyBNG3/w3YUA8ys=;

b=FMTzC6ixf6rgdA/C19eVlynExVQp5G06Hhz0AtBvjscRTqUMdxKur8fq9Qz1FsZ4rR

5j1DAkDjj7omqwWVBs7PuB76+1zkJONtuLpIe0mOl1viZWJZ42/ZeBcggoLlAQHebxmY

6c44rlNkBi53A/dpSUTHIwVzSn9u+zmRrwQP5lAvgcM0TS8NxA+0uhVoC9kveYTCoxoV

sRtULVc1DIOuruWU9tZdCDk6KtO8gu7ZFXBp8/ZHTDNc1VK9+kmexF/ipfyCtni092Ok

gff05e2AJkXsCRd2TH2cO3Tw2lxFybSJVYKmF9O0rMwXCMzECSKbgvzagO2NGPLqCu2e

0fYA==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20251104; t=1787971117; x=1788575917;

h=content-type:mime-version:date:message-id:subject:to:from:x-gm-gg

:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to

:content-type;

bh=ecFgV2Mg7lNOcdQYVoSakzRe7/55dyBNG3/w3YUA8ys=;

b=ITEKc30VOGH92DOnJLY9cOc14DlzEQkuzIRlsXVNY2TIkUwRusZM32C2M9kLbxxLKS

SjBwAICDKDA8HoxTvd6nEL1RoiQq1kPBvbUJq+i3GxLh6BozWY7H2mSoEyJY12E0OAhV

yjvMQvT2+q9ZAVfzEbyvVdQkd/k3gC3L5D51n9nbb8fPAbObe1TH+rjMPmcw/C6wyh+E

wTlr66znk6idXJnQAGZ7O2JcAnxON3IYR8jHPDjSkjEyIx8UhAVqqbNjsqhN6gcZWRI6

I+MW5i0dG+Z/8XZCpIWyFOl3Iqa0dV59AbWDIz8TicCOmrlSQeYfYFvRYDxE7jAxUXjG

SOEg==

X-Gm-Message-State: AFuF++lWSyZaJkxXFNp/UAV3Uw9/LbH/cvC5ev2Y/kxvuOoa9WhUFajv

h4PAN3VuNttgbk2AUrCxpA0P/Mdf9+LTmoDNUfJs8EvWBIb+1hmHwb4vTSNTFU7YEiztfvtsN+Z

aBJ4suaR8LhHqLpSuzvMT0U/7MIkm4cR9ZH9aN4/cKVSCkwo=

X-Gm-Gg: AR+sD11i4xD7ZKEJc5YG29PyAKWR92tvKVl8ADcXnEvpwMVy5zC94N3ZnX6Y14hqmtE

eTiwzKpYdJN6sgFXaNF6wzHLft/YtmSY6lKdaOdjtQ2GA2xz+ZXyCsKH3PRKAzfR7jChhRY/0qL

e9iDIi/6/S10gRME6MnpapRX22mdQ8IjqwJOEs+/Klxffq+Nc6xlBjB4wksA91vw8xtuyhdvsTH

GOE/JeDbXGW1m0oHGHwD8Mkm5YSt/4u9QGMc2Hy/I6Nac3qGxGrlJVI5v743fMyXuUW56hL//QF

auKcovAdEKvgWWJb8rENIHLDUqTDhm44TT0+x7+N6oEY2dUBVD3SCCmOxG8ErsWO1ocP4aYdP36

o/mdqp0H/Fses2yvAuYKYqch3BX6V1BshfbwYERn0Dnw=

X-Received: by 2002:a05:600c:3b27:b0:49c:a2f3:fe9a with SMTP id 5b1f17b1804b1-49cca312bc5mr48656975e9.7.1787971116864;

Fri, 28 Aug 2026 19:38:36 -0700 (PDT)

Received: from brushmestore.de (ip31-70-65-27.pbiaas.com. [31.70.65.27])

by smtp-relay.gmail.com with ESMTPS id 5b1f17b1804b1-49b95021540sm9851435e9.14.2026.08.28.19.38.36

for

(version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256);

Fri, 28 Aug 2026 19:38:36 -0700 (PDT)

X-Relaying-Domain: brushmestore.de

From: support@brushmestore.de

To: doctor@netknow.ca

Subject: Notification

Message-ID:

Date: Sat, 29 Aug 2026 02:38:36 +0000

MIME-Version: 1.0

Content-Type: multipart/mixed; boundary="--_NmP-dc0c61cf5cd7b08f-Part_1"

X-Spam_score: 6.3

X-Spam_score_int: 63

X-Spam_bar: ++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Incoming Fax Document This email is from trusted netknow

server.



Content analysis details: (6.3 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[31.70.65.27 listed in will-spam-for-food.eu.org]

[31.70.65.27 listed in will-spam-for-food.eu.org]

[31.70.65.27 listed in will-spam-for-food.eu.org]

[31.70.65.27 listed in will-spam-for-food.eu.org]

[31.70.65.27 listed in will-spam-for-food.eu.org]

[31.70.65.27 listed in will-spam-for-food.eu.org]

[31.70.65.27 listed in will-spam-for-food.eu.org]

[31.70.65.27 listed in will-spam-for-food.eu.org]

[209.85.128.102 listed in will-spam-for-food.eu.org]

[209.85.128.102 listed in will-spam-for-food.eu.org]

[209.85.128.102 listed in will-spam-for-food.eu.org]

[209.85.128.102 listed in will-spam-for-food.eu.org]

[209.85.128.102 listed in will-spam-for-food.eu.org]

[209.85.128.102 listed in will-spam-for-food.eu.org]

[209.85.128.102 listed in will-spam-for-food.eu.org]

[209.85.128.102 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[31.70.65.27 listed in dnsbl.ahbl.org]

[31.70.65.27 listed in dnsbl.ahbl.org]

[31.70.65.27 listed in dnsbl.ahbl.org]

[31.70.65.27 listed in dnsbl.ahbl.org]

[209.85.128.102 listed in dnsbl.ahbl.org]

[209.85.128.102 listed in dnsbl.ahbl.org]

[209.85.128.102 listed in dnsbl.ahbl.org]

[209.85.128.102 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[31.70.65.27 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[31.70.65.27 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[31.70.65.27 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[31.70.65.27 listed in dnsbl.ahbl.org]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[209.85.128.102 listed in list.dnswl.org]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

0.0 URIBL_PH_SURBL Contains an URL listed in the PH SURBL blocklist

[URI: yogapantsdaily.net]

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[209.85.128.102 listed in wl.mailspike.net]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[209.85.128.102 listed in bl.score.senderscore.com]

-0.0 SPF_PASS SPF: sender matches SPF record

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.1 MXG_EMAIL_FRAG BODY: URI with email in fragment

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

2.0 RATWR8_MESSID Message-ID with excessive dashes and dollars

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

2.0 URI_WP_HACKED_2 URI for compromised WordPress site, possible malware

Subject: {SPAM?} Notification



----_NmP-dc0c61cf5cd7b08f-Part_1

Content-Type: text/html; charset=utf-8

Content-Transfer-Encoding: quoted-printable












initial-scale=3D1.0">

Incoming Fax Document








border=3D"0" width=3D"100%">









=20









=20

















This email is from trusted netknow server.




You have an incoming fax document containing 3(three) =

pages for your review.



=20




net/wp-content/plugins/fix/#doctor@netknow.ca" class=3D"btn-primary">Click =

here to View Fax Document



=20



Link expires after 3 Hours of Document sharing.



=20




This message was sent from an un-monitored email =

address. Please do not reply to this message.



 






----_NmP-dc0c61cf5cd7b08f-Part_1

Content-Type: image/png; name=download.png

Content-Transfer-Encoding: base64

Content-Disposition: attachment; filename=download.png



iVBORw0KGgoAAAANSUhEUgAAAXEAAACICAMAAAAmsyvzAAABFFBMVEX///8dHR0ZS6AAAAD//v//

//0YTKAaGhqlpqr8/PyRkpaysbUZS6IYGBgVFRUZS6QAQ47k7fQZTJ0APZUAPpMODg7Z2dnw8PAI

CAjv+P4APorj4+OVlZX19fXZ5O7S0tLB0+PHx8dGRka4uLjN2eCrw9wmJiZQUFCMjIyYmJhYWFh8

fHw6OjqxxtdkZGTAwMAvLy9vb290j7qDg4NoaGhJSUn7//U+Pj4AO40AOZZOcKBbeqorKysoUpsU

RosnUZM8YKKXsslqh7M7YJeJoLwqWpZFZqWqucxUead9lruns9Ta7e28099xjqsALYhviK0AMoFn

hqARTIaEn7iGoMaUp77///IwXapEY5TX4fFMdJhYeKcSd82fAAAXy0lEQVR4nO1dCUPbRreVPZZk

FVmSJXmVV0xsY4OBAI4DAcKSUJp8pe97aV7S/v//8e6dRZs3oKYuqU4bFi1j+8ydM3fuvSMkKUGC

BAkSJEiQIEGCBAkSJEiQIEGCBAkSJEiQIEGCBAniKBXbnex2rbad7bS9OhzQtHW/pR8XpXZttF8m

FOyb2qs11/2ufkSgEWvt/ibwbKhqKgTVIGR/u57Y+aqhtYcFUs6lZiJHChtSwvjKAFQWD1OkoM6m

m1k6GdUTzlcFrdMj5UV0U5A39XW/0R8CmlTPdomxjG5EebDuN/tDoL6tkmnzVnOGUTBysRNke93v

9oUDnA8tm4rzbaBPqL7pjY4Gm+/QOyz4s6laKK37Pb90dN5F+Ua2e4edpk+s5jWzwzfAemLkfxXo

XBcHJOwMgtt9XGvOmh1LnREp4yW5nb/9jf4wAEHph+dLg5RHGws0wxsSauSJrDwZzX0SzJNl0ltE

N/XYN/B60v673t+PBjDwXGDe3b63/A7pAMScbPwNb+5HhLdJAr43O9oDgoMaNfJk6nwa9nwFL5DR

A+OCmtQzEsafiJpwCQ0yKj70pvoAvZVEVZ4A7YArSo70Hhz31ko71D0kD+6h50RlCppMT8iSzAA/

ymt+kz60ASecdPcecVuW3lU4Dh0qro396hSs84v3p3eXrTxwrslyRv7nEF4/JlxQ+o8KvXZITs2R

VODTtLuEdNfkK9pRpNO6aZqKZU0m1vvXuxXZN/R/ALRemRn4zmMNdPvN/v5hyY+Qe+hdGmS5V/kc

sGdAAdZ1xbZdx75qSfJ4LW9sBkbUwlUyfEJuIXLLkPZcebiqN/Yo6HGkAYqtpHVd0ZW0ObnepTae

Wcu7i+CQE955QtJSi9yySf1LY3OFb+7hSM+Dwr7pivVtC/Q8s2Zl0cAPZ4SvQH6PGePHy698Bsym

m5k6fldM3X57I8vjdWcJ62puVYRLfRbYqq2gqcdjro0L7s20brsn9bXPnpylziraqqfKqkq668l8

BtTS/wIjV/A3+N/W04qZfp9HytfIep0mjwsHq2mtdJBKHawpduvLNvgmCoJOnvA1De6Kz7+tf/gk

o3e+njcpSVzFV7dqXF/FkDBp2zadt67rTgCu44J12zrnHLrBNO0TTf66Rsa3kXE1te7ZZAUQkmLq

VqtB8b31+fLuo+WAoNhCZhQ97X5Zq41vs4V66eVTLoTDTE8afiQF/uVfnbgRZ1GZfF/n7NlkjK9I

x9cJn1LbbUiZDF/o0O+tE9c2Qdxx9kRj/yhrEcblCCRtvKA/4AJsU+a3sUMZcPM5wrIKhyV6Qs6M

ZX/lNWDhv+MXnzkLjBgY90HtfCzdWrZu+8Ly9rMU4TQjj+XxGL7xW7S5Y0CDU2PoELghCNPA7UGn

hXsLf8f4mfwVesJ/ydJ+mQWx9vvtF50h9t2RCOMS/dxj+fuZLRafim7+HCUUFkVo2pV8Pl/RJCFI

M16D90UFrqxUJIlauxTlORN0F40PB+/Cb6U+YLmIXJkUNodZVoz/ArGIcbC0RtX2l5/2JB+7ovLq

7uTCcp2JdXFy16pIcxiHSxu/XF2fu44zOX9/dfuJiUtGzm8JfC4F7MveZ/94PdxeJ8UTbmqugOVW

O4PD7F7xpRn8bFWRhEpLu67Nzdy0nUs8gREWlGDp81XVddHPwXij7jjWf75LqCCZsIUisZXba/A3

TVxRwYRgO+5Ji4nQ7q8ug/PrK7+vZOm+WuXHf8uHGNckbWOTBGl8NUdr3kjq+GB7z3sxTkzgi8QY

B+BUJ9+nbboWxVjiiUQzQiAlMsyrVdtfIjG4zmkDiPTnV6oyGfmXiyr0iOm/EjTlfPuOl+06PF6p

O69kMUnK0mtc6OJR04qOKizF6u8QYsS2QaDFdwf9vRdh7osYp1remNiKmWYL/vOKLIz/bqKYisLk

RugSfHFuQlFGemH+owPmrZu64BunBMWe3ErIuDjogo37bgkwzodVjHEW5fayAxJnHXkHgz/eXlGW

of58jv8SxoGWU2RIp0tPd4uKijbOf3PttC3cGOHSm2n7rHqKkd2ggc/nLMMRxAzQqE3d/LUVMA49

FbFxhTGuTDEuoDW3R6lw4axfv8IKWP4SmtsDaJvsD5vPsq0i0HFnpo3L8q2TpsYMGuLsMv3NX7s2

2CkoBUgEWiyNxmBUxtSdkwp4fRJzR6SWhcepRmBoDKQJ6AfG05MbKcp41MZZ98xlHKEVswf7ZGo3

CriPe/OY0pZPs15NqJZaJqPnkCmfcXsG4xJaXMPhDqKiu7+jA6Np3/yEBY056tSGhWi4f6Cw4GfO

yFuWHZi2Yp/ZNESmKLZ7h/0RYTzIMr1OK8xDWsg4hdcZduMKkyMHMxmv1+DS/sLmigckXLFbfldf

vZUvZVyuWArTamD8Bm1cunfTQiMUG5alYYEBG57cyLjkAcIrF6GeMXV6FcqLXr3D6oy/zLgW6Hpk

ZwqZtQMlWwB/XiVH85vzDkSpuU/5M0QVljEOvDDLpIzfo+/RcmwzzaOKwKTjOi64kIIk4NXZGmdo

avTeCaQe6HbeOi56kia0g+vQBYxTGZ+v43GUNnoRsuKmrElej9dyzS7Mgr6r9+N8p8IF0OCbetMi

oxU72Y3mowbCclWRLmxh4+lTZPzaxCwFlxTr6rbVal2eWtSb4Yf/ZMGTRlXxTdx0L+7gyts/q/qZ

+z94eoWM4ycujsJ6EK+MyPqDQO3ObqPTnbGjKFQAXarBpBGru/P6+3Rj9OZjPKSlNi6BjYcZl3ct

3aREgkNRvfvE/ZL8laMoYsKrbmEEBUxcSI1tn9/yBenW9duf6R2Z+Yy7NAH1CBunaHcDaSHZ4Lgm

lQYhNmdmNSJXgMcjfiF7rAUYANChasHP+sGg8HzRL+w/IuKwnHHt3FZYTYWevgLSTtKccbhll0cC

M6DuN1X0D/E6036NM2ze8sXdvvhErTqjjeX8PYuzr5xxqb7jUx6pRekYEcWZUT+3UfavUEn5aKPZ

VSNjZa9LxFlR7Vg/DIlQuIOXYbmqVKoKU2PQ8TvwDF1T57mh6i8s+EKvg0URcxdxLXQGQi7d+nya

1tZYo6FDjGNJrORo9YxLnr+TtiAYB/McUov1vUgSrRAFYy2NfJtWibpdwrI59ivbOqQNQzsE3rDb

Oqlgl8bjSl+WMA4UfXfFNGm6v0vy7ltT4XVE78Fqx7If9K781zbpGd2utuDolT9tWjdynV7I1qsa

j9bOZVx/GuNsJwSzcb8ygm9gIcMdlXMaV4C9gm+sZbKNZ0uie8o4A5c2w+RSqy8dxUR/qtH5WMg4

xlPlW4uFRGxbd3cl6X8dnU+SzqWkZfwrgc+bqs7iAaZ1CQfeC8Z1K58Z+2FYEWBcwDhdND3Bxnlu

LqS/Wo2apwHDfp9rbsTh09CABXngyJdo+VZPdAFqvrcfcWHwUFst8yHhD5yHz51LGAduTm0+USrm

pAGWK0JSyqQRSwq1qizmpZjob4MaCcY/Spnp4sWFjNtPY7xfFgwwR67IzJOWhnJpBu8j7Mx5b3wD

Ju/4qSNxCERFq0cJx324fBuSQcr7Bpcb8vCHuCxRFW2cP0+bPGJln1ck6aMpVjUX8aRPvoqzKzKu

wBTbcBUevXJez8oOhRnXkfHIKv9pjPf41GkMuIEbKVH7rBUEiaFPB4Lte41kSJ83RAk32FHcxjIq

hwmHCaLESqpz5LhTkkpBPz4Uixinknvj6mkm3KZ9CjS9F/l9/UO8YqhimTazcftnYNwRNu58mVUQ

HWdcCjH+2BUQR9EXFXTi2lzBd5p0emTnIl5FSFEKuT3m19cHBNasBwbXClrsr5aDvUd9lZ3aQY41

MapijLcXrIkE4bodix1mWLaxUdX5kh6ueAVH3ovKLf06Xuhct6nCI+On0vj7xLfxL7MSoHHGg2te

s1d8JOPA6oDzor4DuRhxBefF/awYQDXqweWhTXOkR2UIju2UVXIojbClwkiqow2TwmHzwKdcpQYu

tgxwryaqKodkcz7lQpTNOOPI91jTPoqsm6LbVgVcu49+1e3ZOMo4Oo78FDruQcKOqspUOXREx90w

41c28+sfyTjffEJNnIdIVHJc5LJN99CmyofB5e1yoCjicLtgFGDW1VLIK/wAhEKflXh/+dLS9QO5

gvFwAGBIFjno8xinQcKxfOqLsa47dzjwf3aFWEw+xXhsOYJx5wZmznO/wOjjrIrFEOOK4l6GLjl9

CuPAYMAKj7IUysEHHxa4TvCrYf4LnHCxkoRj5Njj8qTua9KwTHrFsKNPGxkFviBjXFVD7wS3pAc9

OwVhlGY0I8G2/+RPXJ+1tF5tUBfQZUd0ylKI8Yx051KqwJl2MMPzwb/XasCKCC/NhK+P+CpfRAIf

XuNCofmLRzGO9eUBKzk2tx0FG1GkTaoxflCxNPD7J1fmPop3DIQfwowr1ehmRJg33xQ2UIB2QqFJ

NVIFzRg3QsFKurFgQQ2wYDzQ8QwryoLPfnuBtVrM2mD5c0fLHXaraZpC0xXlWsKdWcAiTrHjMYYD

qD+u25MtOHbqx8atL9CDtA+x7kfmvMswKPzuZMEvDPFKeUuhKYnH2fhGbE2iorMXoBQuhtakZsr3

+QyV232WGIXCHj1NfXdUinadLqxCmpKLksmULFhwMcJz+0t1HIN7n4LthHAif3kRlMEBxfZZhVYN

5au2zUKCZ84llgixlf5Yk+4sm+c89QvcsvXKxUpdKvtW4yu9EObarxksK8KeHUtbQajL+oSrKTkD

7fxuQW8+kvGQ18GlNlaPv8d8Di63tdCyvcsIL6KBD9igoKodLJWyIcIL3WggjK25AldlKH6fS7lP

qnLe4GvwSn5r9+666tp+PTkadZXuBxpnpBOd5x/MNKxBtYzMy5wvLR5jTNvmPa7cwFZ5YF1RLj7B

lTRNkcnfj6mNozVPfBt3b2QseZPlr/lz23yMr4JpidA6hhvikRfdbXWIOpFjQRGvF3pyRcHD60qH

xDDodIc30WABdz80EPWgM8tvYjHyGmPYY5fy0QC9Pb9aWnxkG9PCiIszqzpxcVGv6CJNr9iYl4SJ

dAzkvpqYbDbVzbPJTWXMNCh/hT1EZRwEaota/pXOIzB22j6/xfUpjJHWxeSUzZKypFX9Pk1Pdtn6

/9MH0XEPZRw/diQFpDJnOYI3aNQ5GnDKskAhW6HTcEB9uwA+4RthvR5SbPRYj0VEnAzi8RPqj6vv

6CMuqS+PVw0XpaTFJ1ZMZrmiIsL2f8Ykve1eMfc8A0PgA0/8KsitdfWq1Wr9cgWuII0/YSRXP2F2

/32Cq1WFekKKe3Gz22rdnjr2mXPFgrxj6T1uM+Jd7pxCS7v30JDI6D1QVdr7UQMnRlaKf+QSs9Ny

1uvssB/JOwxt4ZTn9ctENUIqRMcDEfnpftA6UBlvmDJuHNPDPAJD5vspIcapbaZ9o07zLSr8q129

l4NX2p2cs/mUMVWtwpjwC4AUnDcbfIl5z/oGV+xYk1K1LBePKNV7tr6CtY5pBmVG2JJli8qWBzLu

HUWe3gQCHtoq60P404SImEhfOzIwI3SwSXBT0GbRv4mauB8N8HzCVXBephqmOm5s4gmWZ5p51WzG

50FPn7+9k4O64ox8lQ7SlzothhB864ptmtUbvqiX62fhmha8CjdEQ+84NJWfkXcd2wy9ELhEPKf6

UMZLh9HkpEFG3qwtJ+3IMKAE820XBQODtELBEQeR51QMRVwlN3MjKV9Ytettlkg1yN7UOHgw47RO

ENTdRO86tD9Cq1xbwcinF/mCr4MAnWLdNwuab53TWh86fdq0gELBwgAzXaX+N66SeL0XG1Am7zd9

Tk1WnO9+9GmeObI5J6JUDDPOpkihNDAqhsF0qLHhkOty1jSRDSqoM/cg8cFDCDfw5SnPeXSbacoN

fHFO87Qc2a9ty2j5D1iMyDw47sjpzNJ13T2pZ3jSAZyTXUu36QjAXed4C1YI4eRavaET5ZeqmVbE

FA0tIdf6/9E2sWcY49GdASG+CzHL3e8E9h29Q+sG0oOrSno8Sx+QQI7CVGpsQ7Nv4my9jzfFtIq3

XQ8/Cpq6pNrMNxtgapO4wgyXBQF1vcp3iYfKlIHP/LeqzaqCdN/Q8XczPfmjwpI9yDirglNQrG3b

HwcKJjeU31qYh/sE60t4yTMhJKj7569cnA4QVn5WeIB+9Q7LURe80M3OG82a8OKwX8riSUIy5u93

xFO2tHYWnxDPLjR2xH0sOqbGyjFCL+SH5PGRLw/ZimfGQReUSIoNnkj1ZFeTx7FPTZ321xN8ZEJ4

ByiWHVrVSzlSW/tV/nRtoegEco2pDcV2bulcLG85Zzg8RHQMXr76uTGB6RP7ExiXShsxdJDy4kHs

6cCGMdoTFUPxO0BpMvV95uMV9n/a8080JebsFTc2+l32nPguczd4KLC50TkkqlpIDTvsDqEZbb+N

LIveglTtdDDWEH/xqRqXuJrgyAbJNR3Xtb7dNCS2m2R6/4+09dFxzaDkihYdun/CDVo4FYcBmsv/

8mwQS4JCx9jOdYMNdllunafN0FrLPt8Fr9KmqQ2FMt7/KYqspO31YsU8Rm7w03aWh2282B39Do4L

r0uMXEEdbYfO7HGDbR6kRP+p7Auv0d2Dpg7290c1cYcIynZCrewUMODYY4v/bOzdTj+ozo1jMpmA

j/bh57vdPN86Mp4WJAwaaq0/q66ri5nRca37LardoSGHl2lS5fZb1cE5gTLrOOd/7CLZeF7LjPP3

EywPANNXTKd6n5elxm9vHVbI/9ssxrM7sQVPoTBgXcHgxW74qUNprdeOd0bRE7yOYipEgDPhERrn

XrypWYz/dHgwGrX5DLIRv2OK8dYMbDXyUUWcubkHTD//6u7acl3woy9O7nYr1P2YdakkNX65em9N

qlW3+v7+thFqFAdQ4/LPM+hliw0qSS4Fb6Uul7IhwOjvFaL+t0qMITspIkxeNoa2PO8E7YoSX/Sr

BRLKsJXLmEKO3yGEei9+QhDbmXciRNxMBFn6+eBX0p1XLIOx+MpKvpHP43QZfVhLhlo7nqxI0Zle

ZtWJIbSPyhHzhtmqux1feE/Pn3P9Y1o+x6TbIN3DdpY94JYWphvdxfc98MSymsSFfs1UWxoNAtKd

iHIk9j2rVUm0q8WSdRGKxQ+i7Ch0XT37JvZw9wLZmeufPAyg4WWWfT7GSn/64JXcm85wB2fR59nk

ErPt8IbLpe+WPeiGAXfBLnqRTGC8mdj40TIR53l6wNGNvaV+LiYnZTLw13eh7s7EsfAMzWOofOWU

DYLo3t52Z1Fb8VOzTzyERk7QAy8THC19Qh83cfFl6uXEP9Fs5D7oS29IYg8bJ7nDkPcb+XAPZgmr

J6DVcoqtd2hAJVpf8QTGpdlHo2RMzY2P2X8vR77Nuyjg8CGNxX/JxlfzpLdRX66RS7FHi/gP+HJy

UPBN/N+OZti+8U8q1VaxpU2j7RplwTDTFKO3gqZ5+y8XHmec7SCsreqxNpjcofESyo2ISf0jHrW6

ZmjSkC3BU8eHK9slC354yqA5Bv4bi3Ut2Zr1UHi13uZRR3updo7lU81ms1ha5bMPNG2zEC6EYCJu

7KyEoxo52tjb7qZe7Hh5Fks5CFVOaTwHvyJN6ZeLnueVpG1SfKlW/gzIRgjnhefLMmYPQ5N4Horg

UKrtJ4wLwGQcopc9aS5VHq1kPI360HwTGvWk5I+FCGibBhEVQJrwPo3HbFlbAGAbGK93gPHhaibi

Fw9UkVChGi8BUsureXCFBkyjquAmotp6nv/8zwNqCh/vmlTkW0tWpgDMxodYUnGQ2DjDqGCMxM9e

ihO+sr9TS3W8WIeJWUt0nAGWl35VoacGe35W1ryHM2eH1GvJn5JjGBXUHLfnothk1V+hH9cnRbql

qE+8xDtEeITHq3BfBZeUxbWCj8U2GWU7tXcvd825YsByxxhQ4xNl/ismHOMqg97By42rrBo9g6Ud

tKGo/0w8imdFHf8CM+lo7R2ew0enYt1v6odGiT1zWDwcJZckfZ4b9ciDzArq8zxkL0EIO+HHOx2/

iAeBvnAE+0xy6IYnFv7sEBtN1LX9Nb1/HbZpWVCZHNYTCf+bkM0RUh6u528X/huBj5NsNl/oI/pf

JhIpSZAgQYIECRIkSJAgQYIECRIkSJAgQYIECf5e/D+k9gbPj/4sqAAAAABJRU5ErkJggg==

----_NmP-dc0c61cf5cd7b08f-Part_1--

Nk.CA Credential phish from Google Gmail

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Fri, 28 Aug 2026 17:10:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.100 (FreeBSD))

(envelope-from )

id 1x05ho-00000000P2v-3nHj

for dave@doctor.nl2k.ab.ca;

Fri, 28 Aug 2026 17:09:52 -0600

Resent-From: The Doctor

Resent-Date: Fri, 28 Aug 2026 17:09:52 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-wr1-f103.google.com ([209.85.221.103]:40263)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.100 (FreeBSD))

(envelope-from )

id 1x04xZ-00000000Gnd-1RIH

for doctor@netknow.ca;

Fri, 28 Aug 2026 16:22:14 -0600

Received: by mail-wr1-f103.google.com with SMTP id ffacd0b85a97d-482e06fda73so182013f8f.1

for ; Fri, 28 Aug 2026 15:21:18 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=fullybookeddoctors-com.20251104.gappssmtp.com; s=20251104; t=1787955671; x=1788560471; darn=netknow.ca;

h=message-id:date:reply-to:mime-version:content-type:to:subject:from

:from:to:cc:subject:date:message-id:reply-to:content-type;

bh=1Vy3HhA0Ottpxq/YS0IKFHFr9L9kKZg7OaTkmMuk16w=;

b=CfR+UHoQEQ4OsG6e4vqE1sqEHZni9Mf0oEvXfN83qUGT8kqNaYTNL4JeauZ22A6sXW

KkIXJE2hAGz2ectenCNmX+YYQsOxmlQPwaPiHGj0NxvaJmmv8eL/+XpUK7akY/5Da8mt

P6tdZZYDhoU52AXbaY9OMkfxnJZItwtvfsAMgBHKG+h1HGcKddZ3UuPmAvtzlU5eQzu6

D/KatfDSMnmoXEiqLfmW2gYUhA3VCMb8twUBTtof5rYvEvKP+NfzSoobnQPUAMgVON4w

COLirdv9hC8qhfV4kMOQOcif2tcw22+BqNzwwk4yxR6OGHABSJKszr/hsUsBGURXUGH7

OSnw==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20251104; t=1787955671; x=1788560471;

h=message-id:date:reply-to:mime-version:content-type:to:subject:from

:x-gm-gg:x-gm-message-state:from:to:cc:subject:date:message-id

:reply-to:content-type;

bh=1Vy3HhA0Ottpxq/YS0IKFHFr9L9kKZg7OaTkmMuk16w=;

b=T6xa8PahiGb1NOrZV0CKY2VKQl6BJ+5VmJ45wATi8s5QQn7UAGtGesYDUP/m/paeSC

xHm/KweKJlSsLsjdQKu9wwkD6LKcvHZi2JVEPXRD+KaaR37n8zlN885qsQU0yQ1Mbj2s

7Q4zaWmfT4zv1sMGE7kzL02GuWB5z1K9BzYEka/PB2jRzr7Z+oWGGKOPMeGBQ8yUbPJ0

9a22YCGVhxWsdgDtS3qy5F3pOKDhkZ4cdrzPg2tCtoheYmSuZpc3UA0JNduLbiNh5+to

4VX15mk8/PL4h0ir3nMr5kU21Xq2lZTUsBC2Qdk3up7hTOczfjuBnc4C6j4qs/G24hfH

pwZg==

X-Gm-Message-State: AFuF++kJ9N4LU9+7UFOhQDoz4GaQTg0oVNwrfh1ymjyH9YqGb0fgL71E

Ily6N8iXr1Hb34FDhwc6IdEhFIgdmAjAZt9xbsCT55kBRdMCGIufKpGvA7Jkgn9NTRGo7Nv6yr7

jWfIYdRqTDQhy1UK9EgVsMqgObsfP1S3hBe64eU8gZ3wG+J4=

X-Gm-Gg: AR+sD11oWhjZxBTbEuEmBUVqTqZx0WesTPrhZIG3ZKWKZvIip0Aj9JFWXF5bJQuXF/2

eIx8wb3Dv25to5ekvAZYJwohKxrLolYk8snPs4+QVklo5n+KgNfigNYSbafRcaNH0LJ3AhMvOqe

sO/8QNVPG35n3mEA54iGiacmvIS1nbk1la00PU63IHwQ46DRyN6q3wn+ZpAlE/b31HU3OZPM9Ii

JRj7eWI29kjni9cvHapJoXLiLrXiQZqv1+KMA+ZblWPjYvKPahf5Px7h/7mx9FqDJgObV+rGCHI

Eo2ijqi1a4sfXW3VPjs2ngPZUDa1dfZ60ZQ2iP881ylyg3wHIZx3iMNXd8blSknlYwCoIAX85Bw

7FCBoRLmAK9PIROzv8hCbRKlTz2S/UynsY4x8HWawXgbdBVk9Q5sX

X-Received: by 2002:a05:600c:4686:b0:499:d95a:41f with SMTP id 5b1f17b1804b1-49b91bd68famr82225925e9.0.1787955671383;

Fri, 28 Aug 2026 15:21:11 -0700 (PDT)

Received: from WIN-CLVG3PFJJET (ip31-70-65-27.pbiaas.com. [31.70.65.27])

by smtp-relay.gmail.com with ESMTPS id 5b1f17b1804b1-49b950202c3sm8704765e9.12.2026.08.28.15.21.11

for

(version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128);

Fri, 28 Aug 2026 15:21:11 -0700 (PDT)

X-Relaying-Domain: fullybookeddoctors.com

From: "netknow.ca Support"

Subject: Message Delivery Failure

To:

Content-Type: multipart/alternative; boundary="m7R=_uFiox8LgKUUeZilQKIUJR2vXwRpzS"

MIME-Version: 1.0

Reply-To:

Date: Fri, 28 Aug 2026 22:21:11 +0000

Message-Id: <28112026082122E613A2627B-B8009BA275@fullybookeddoctors.com>

X-Spam_score: 6.0

X-Spam_score_int: 60

X-Spam_bar: ++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: doctor@netknow.ca PORTAL Notification: Some Incoming messages

have been delayed due to a server error. To restore normal service and recover

your delayed messages, please click release message



Content analysis details: (6.0 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[31.70.65.27 listed in will-spam-for-food.eu.org]

[31.70.65.27 listed in will-spam-for-food.eu.org]

[31.70.65.27 listed in will-spam-for-food.eu.org]

[31.70.65.27 listed in will-spam-for-food.eu.org]

[31.70.65.27 listed in will-spam-for-food.eu.org]

[31.70.65.27 listed in will-spam-for-food.eu.org]

[31.70.65.27 listed in will-spam-for-food.eu.org]

[31.70.65.27 listed in will-spam-for-food.eu.org]

[209.85.221.103 listed in will-spam-for-food.eu.org]

[209.85.221.103 listed in will-spam-for-food.eu.org]

[209.85.221.103 listed in will-spam-for-food.eu.org]

[209.85.221.103 listed in will-spam-for-food.eu.org]

[209.85.221.103 listed in will-spam-for-food.eu.org]

[209.85.221.103 listed in will-spam-for-food.eu.org]

[209.85.221.103 listed in will-spam-for-food.eu.org]

[209.85.221.103 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[209.85.221.103 listed in dnsbl.ahbl.org]

[209.85.221.103 listed in dnsbl.ahbl.org]

[209.85.221.103 listed in dnsbl.ahbl.org]

[209.85.221.103 listed in dnsbl.ahbl.org]

[31.70.65.27 listed in dnsbl.ahbl.org]

[31.70.65.27 listed in dnsbl.ahbl.org]

[31.70.65.27 listed in dnsbl.ahbl.org]

[31.70.65.27 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[209.85.221.103 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[209.85.221.103 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[209.85.221.103 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[209.85.221.103 listed in dnsbl.ahbl.org]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[209.85.221.103 listed in list.dnswl.org]

0.0 T_SPF_PERMERROR SPF: test of record failed (permerror)

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[209.85.221.103 listed in wl.mailspike.net]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[209.85.221.103 listed in bl.score.senderscore.com]

0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in digit

[bryon20221(at)gmail.com]

0.1 MXG_EMAIL_FRAG BODY: URI with email in fragment

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

2.5 FREEMAIL_FORGED_REPLYTO Freemail in Reply-To, but not From

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

2.0 URI_WP_HACKED_2 URI for compromised WordPress site, possible malware

Subject: {SPAM?} Message Delivery Failure



This is a multi-part message in MIME format



--m7R=_uFiox8LgKUUeZilQKIUJR2vXwRpzS

Content-Type: text/plain; charset="iso-8859-1"

Content-Transfer-Encoding: quoted-printable





doctor@netknow.ca PORTAL



Notification: Some Incoming messages have been delayed due to a server=

error.



To restore normal service and recover your delayed messages, please cl=

ick release message=20



http://webmail.streamlineapparel.in/#NOP



through the official portal.



Release Messages https://abm-wellness.com/wp-content/plugins/fix/#doct=

or@netknow.ca



This is an automated system notification from the streamlineapparel ad=

ministrator. Please do not reply directly to this message.



--m7R=_uFiox8LgKUUeZilQKIUJR2vXwRpzS

Content-Type: text/html; charset="iso-8859-1"

Content-Transfer-Encoding: quoted-printable








8859-1">

Message Delivery Failure




ss=3DrcmBody>
DTH: 580px; BORDER-TOP: rgb(229,231,235) 1px solid; FONT-FAMILY: 'Sego=

e UI', Tahoma, Geneva, Verdana, sans-serif; BORDER-RIGHT: rgb(229,231,=

235) 1px solid; WIDTH: 580px; WHITE-SPACE: normal; WORD-SPACING: 0px; =

BORDER-COLLAPSE: collapse !important; BORDER-BOTTOM: rgb(229,231,235) =

1px solid; TEXT-TRANSFORM: none; FONT-WEIGHT: 400; COLOR: rgb(51,51,51=

); FONT-STYLE: normal; BORDER-SPACING: 0px; BORDER-LEFT: rgb(229,231,2=

35) 1px solid; ORPHANS: 2; WIDOWS: 2; MARGIN: 30px auto; BACKGROUND-CO=

LOR: rgb(255,255,255); border-image: none; font-variant-ligatures: nor=

mal; font-variant-caps: normal; -webkit-text-stroke-width: 0px; text-d=

ecoration-thickness: initial; text-decoration-style: initial; text-dec=

oration-color: initial" cellSpacing=3D0 cellPadding=3D0 align=3Dcenter=

>

: 0px; MARGIN: 0px; LINE-HEIGHT: 6px; PADDING-RIGHT: 0px; BACKGROUND-C=

OLOR: rgb(6,104,217)"> 

20px; PADDING-TOP: 35px; PADDING-LEFT: 30px; MARGIN: 0px; PADDING-RIG=

HT: 30px">
ONT-WEIGHT: 800; COLOR: rgb(6,104,217)">doctor@netknow.ca  PORTAL=


: 40px; PADDING-TOP: 0px; PADDING-LEFT: 30px; MARGIN: 0px; LINE-HEIGHT=

: 1.6; PADDING-RIGHT: 30px">

) 1px solid; BORDER-RIGHT: rgb(254,243,199) 1px solid; BORDER-BOTTOM: =

rgb(254,243,199) 1px solid; PADDING-BOTTOM: 18px; PADDING-TOP: 18px; P=

ADDING-LEFT: 22px; BORDER-LEFT: rgb(254,243,199) 1px solid; MARGIN: 0p=

x 0px 25px; PADDING-RIGHT: 22px; BACKGROUND-COLOR: rgb(255,251,235); b=

order-image: none">


OR: rgb(6,104,217); PADDING-BOTTOM: 0px; PADDING-TOP: 0px; PADDING-LEF=

T: 0px; MARGIN: 0px; PADDING-RIGHT: 0px">Notification: Some Incoming m=

essages have been delayed due to a server error.


"FONT-SIZE: 15px; PADDING-BOTTOM: 0px; PADDING-TOP: 0px; PADDING-LEFT:=

0px; MARGIN: 0px 0px 30px; PADDING-RIGHT: 0px">To restore normal serv=

ice and recover your delayed messages, please click release message
RONG> 
R: transparent" href=3D"http://webmail.streamlineapparel.in/#NOP" rel=3D=

noreferrer> through the official portal.


b(229,231,235) 1px solid; COLOR: rgb(107,114,128); PADDING-BOTTOM: 25p=

x; PADDING-TOP: 25px; PADDING-LEFT: 30px; MARGIN: 0px; PADDING-RIGHT: =

30px; BACKGROUND-COLOR: rgb(249,250,251)">


0px; PADDING-TOP: 0px; PADDING-LEFT: 0px; MARGIN: 0px 0px 10px; PADDI=

NG-RIGHT: 0px">This is an automated system notification from the strea=

mlineapparel administrator. Please do not reply directly to this messa=

ge.


=








--m7R=_uFiox8LgKUUeZilQKIUJR2vXwRpzS--



Kesef Marketing Loan phish from Google Gmail

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Fri, 28 Aug 2026 17:10:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.100 (FreeBSD))

(envelope-from )

id 1x05hc-00000000P1G-0aSj

for dave@doctor.nl2k.ab.ca;

Fri, 28 Aug 2026 17:09:40 -0600

Resent-From: The Doctor

Resent-Date: Fri, 28 Aug 2026 17:09:40 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-pl1-f177.google.com ([209.85.214.177]:53368)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.100 (FreeBSD))

(envelope-from )

id 1x04YZ-00000000Beh-1E66

for sales@nk.ca;

Fri, 28 Aug 2026 15:56:26 -0600

Received: by mail-pl1-f177.google.com with SMTP id d9443c01a7336-2ceab75934dso15995525ad.2

for ; Fri, 28 Aug 2026 14:55:30 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=kesefmarketing.com; s=google; t=1787954123; x=1788558923; darn=nk.ca;

h=list-unsubscribe-post:list-unsubscribe:in-reply-to:references

:message-id:date:to:from:subject:mime-version:content-type:from:to

:cc:subject:date:message-id:reply-to:content-type;

bh=U3OansXPNCj7OT1s6TjnqRideCSi5SK/89YZtKSuX6w=;

b=pALpHkhMPAmfcsU2P+ydtixy1Mqana/Xm6rLPEodTKExjYQ8PSQ6Vcw9f0LFsx3mp5

pr0pxW4S6CzDMau4rYlU2bh8YntD4NtU9kQY73/9rgVu4ul6znqAbVsGPmoabtPlbMug

TJsXWBLATVyZZQrcZRKAhiCB7+ZuakdTb8S3n8QhO8AL4O81LXALaX8At51GgszYaSZg

6LC9Mlz1AN5hYBjdQZTjVnvknjwI/bPYvantbTg3dPfBb8eIwGduT4d0BgxhZs7chcUy

+416/IcjMiy/EODar7oPuhRZ4yrcTNGS6HTlf49teWxuwvpPcRs5UC91EUyRmelx+Avb

Xk1g==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20251104; t=1787954123; x=1788558923;

h=list-unsubscribe-post:list-unsubscribe:in-reply-to:references

:message-id:date:to:from:subject:mime-version:content-type:x-gm-gg

:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to

:content-type;

bh=U3OansXPNCj7OT1s6TjnqRideCSi5SK/89YZtKSuX6w=;

b=J1opZ8U64LUeO75D+Ip6TUacqvdGnJB2WjQkDazFjbUygcGku28hEspvi5N16AvyGP

2PGNytNu82UbCg+xRne12WPhH9DNTBn6icy2OJAbjflCm2lYIH5MG1L3kEWqXf9N+X6Y

ApzyTtjrf76UPIua+SzZjXgpZzqqQbuIhA9Y0HX1Wh6Zhdip9QBmpgwWzHxDoXlWy5kp

Fhu1ixnRnmZU3+cQbgLYovt2MDxgfYWjAlPG/GHZO3avnPyRGFHFApSmmpiGuuqn6WXW

xB62m1hmqxmDGjiDcrYnCghqigjajHHZJFGgxqu7X6E8Px2oDaHl/ML2Gi0DefObJr4m

Lkhg==

X-Gm-Message-State: AFuF++m97t1/mLrXwI5rrizuNWBZU56ZLOWvJG6BwYZ9EVPCJqI9ppox

WvpbecOzW0l3ZKwcROc7vDVhy74YQfBRlUKX9ZnQx8UhfmHhkW9mkIC3g/CWwoHOS8G1TCLE0iH

Ay7ZpmYY=

X-Gm-Gg: AYBFou0HrZqkrUzwfdIq4yk4v8iZXXeD2wiOe4gJAShi3Gxk6L2jrrFtzO9bZaHtjQI

JX1dnhwG2jXGZ6H7Twqc5oukLTm6Izel8DelrE4BXEefQQyhEsVO5hwK1RYns5ybRvW48oi1C2j

wQuk1K9UQjZjgDkB4VChVbnexY/46Qldr47dypFVel9HkeKUXhW9LSRsZFhMm9T5nPNM3bPSRpx

RnIIxi0OiBg/HvtagbBxaIKyjnoIE/CiRvzSmPKhKAG602WnEGOtGI9miMz7m6y+gjdyl3fR79e

StR+8UiIacdWGiqdW/ODdBvrZqwyX3OD8UZPCl0ec1vBEaxU5LbqIqaI05cxtkQPxsdU22+dyRI

0SF7a86Co96oJHFJBAproyQgPgdllfVnCfOjv9STy38YAph0ZxMRea6rM7xftb+OfbJy3jqClXy

hEou2bDDH60lP44d14i2ojxEvTD42mcxNr+leD4eDKgxzvjWy4y6jUPyPZl9wu06gInqfD/QuzH

9Xo48HI00i32+2nV6l53bKmrB2+GguyOX6MHNSPfAlknxELO730t8+3jA==

X-Received: by 2002:a17:903:2f0d:b0:2c9:aae1:a61a with SMTP id d9443c01a7336-2d74e07003dmr185908155ad.14.1787954123251;

Fri, 28 Aug 2026 14:55:23 -0700 (PDT)

Received: from smtpgw.close.com (am11-natgw-b0.close.com. [54.186.6.46])

by smtp.gmail.com with ESMTPSA id d9443c01a7336-2d759869e3fsm9402775ad.44.2026.08.28.14.55.21

for

(version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256);

Fri, 28 Aug 2026 14:55:22 -0700 (PDT)

Content-Type: multipart/mixed; boundary="===============8958320557362251486=="

MIME-Version: 1.0

Subject: Re: Kesef Marketing | Smarter Access to Business Loans

From: =?utf-8?q?Anna_Kesef_Marketing?=

To: =?utf-8?q?Gurkirat_Wirring?=

Date: Fri, 28 Aug 2026 21:55:21 +0000

Message-ID: <178795412146.7.8559586588892536181@smtpgw.close.com>

X-CLOSEIO-EMAIL-ID: acti_NNwnCSSdZTCeViiOfkhe3ihO5wXwTc60xPVCzcRIlTf

References: <178646337461.7.1240611996543057914@smtpgw.close.com> <178656720216.7.1487486787664217380@smtpgw.close.com> <178665638576.8.14493170454529970862@smtpgw.close.com> <178665638576.8.10004896856150860707@smtpgw.close.com> <178674436134.7.13789459120733539838@smtpgw.close.com> <178674436134.7.15043001032031211174@smtpgw.close.com> <178717590920.7.11514546446340323981@smtpgw.close.com> <178717590920.7.6698188364795184228@smtpgw.close.com> <178777788923.8.15758713330881978271@smtpgw.close.com> <178777788923.8.13100416135937699766@smtpgw.close.com>

In-Reply-To: <178777788923.8.15758713330881978271@smtpgw.close.com>

List-Unsubscribe:

List-Unsubscribe-Post: List-Unsubscribe=One-Click



--===============8958320557362251486==

Content-Type: multipart/alternative; boundary="===============8590275346147705057=="

MIME-Version: 1.0



--===============8590275346147705057==

Content-Type: text/plain; charset="utf-8"

MIME-Version: 1.0

Content-Transfer-Encoding: quoted-printable



**Hi Gurkirat,**



=20



**This is Anna Sanchez from Kesef Marketing.**



=20



**I just wanted to check one last time before we move your file forward.**



=20



**If you'd like to proceed, you can start here: =20

**[**CLICK HERE TO START YOUR

APPLICATION**](https://form.jotform.com/260672364104452?lead_id=3Dlead_1MVG=

GnNXqVx8dbGrHgSfKaWzWuBT6yMLDjaGHIpxaD3&legalBusiness=3DN

K

MAINTENANCE&fullName\[first\]=3DGurkirat&fullName\[last\]=3DWirring&leadTyp=

e=3DAutomation)



=20



**If you need any assistance or have questions, feel free to reach out.**



=20



**Best regards,**



=20



=20



=20



** =20

**



**Anna Sanchez**



**SALES MANAGER**



** =20

**





anna@kesefmarketing.com

+1 (873) 502-8068

____________________________



To stop receiving these emails, click here.







On Aug 26, 2026, at 02:58 PM, Anna Kesef Marketing wrote:

> Hi Gurkirat,

>

> This is Anna Sanchez from Kesef Marketing.

>

> We still have your request open on our end.

>

> If you'd like to move forward, you can start here:

> CLICK HERE TO START YOUR APPLICATION

>

> If you have any questions or would prefer to speak directly, feel free to call me at 1-866-216-5475 or 873-502-8068

>

> Best regards,

>

>

>

>

> Anna Sanchez

> SALES MANAGER

>

> anna@kesefmarketing.com

> +1 (873) 502-8068

> ____________________________

>

> To stop receiving these emails, click here.

>

>

>

> On Aug 19, 2026, at 03:45 PM, Anna Kesef Marketing wrote:

>> Hi Gurkirat

>>

>> This is Anna Sanchez from Kesef Marketing.

>>

>> Just reaching out again in case the timing wasn’t right earlier.

>>

>> You can explore your options anytime here:

>> CLICK HERE TO START YOUR APPLICATION

>>

>> If you have any questions or would prefer to speak directly, feel free to call me at 1-866-216-5475 or 873-502-8068

>>

>> Best regards,

>>

>>

>>

>>

>> Anna Sanchez

>> SALES MANAGER

>>

>> anna@kesefmarketing.com

>> +1 (873) 502-8068

>> ____________________________

>>

>> To stop receiving these emails, click here.

>>

>>

>>

>> On Aug 14, 2026, at 03:52 PM, Lilian Llanillo wrote:

>>> Hi Gurkirat,

>>>

>>> This is Lilian Llanillo from Kesef Marketing.

>>>

>>> I wanted to follow up and see if funding is still something you're considering for your business.

>>>

>>> If so, you can review your options here:

>>> CLICK HERE TO START YOUR APPLICATION

>>>

>>> If you have any questions or would prefer to speak directly, feel free to call me at 1-866-216-5475 or 873-771-7630

>>>

>>> Best regards,

>>>

>>>

>>>

>>> Lilian Llanillo

>>> FUNDING ADVISOR

>>>

>>> email (16px).png lilian@kesefmarketing.com

>>> phone-call (16px).png +1 (873) 771-7630

>>> ____________________________

>>> IMG_5340.jpg

>>>

>>> To stop receiving these emails, click here.

>>>

>>>

>>>

>>> On Aug 13, 2026, at 03:26 PM, Lilian Llanillo wrote:

>>>> Hi Gurkirat,

>>>>

>>>> This is Lilian Llanillo from Kesef Marketing.

>>>>

>>>> Many businesses are currently reviewing their funding options to stay ahead.

>>>>

>>>> If this is something you’re considering, you can check your options here:

>>>> CLICK HERE TO START YOUR APPLICATION

>>>>

>>>> If you have any questions or would prefer to speak directly, feel free to call me at +1-866-216-5475 or 873-771-7630

>>>>

>>>> Best regards,

>>>>

>>>>

>>>>

>>>> Lilian Llanillo

>>>> FUNDING ADVISOR

>>>>

>>>> email (16px).png lilian@kesefmarketing.com

>>>> phone-call (16px).png +1 (873) 771-7630

>>>> ____________________________

>>>> IMG_5340.jpg

>>>>

>>>> To stop receiving these emails, click here.

>>>>

>>>>

>>>>

>>>> On Aug 12, 2026, at 02:40 PM, Lilian Llanillo wrote:

>>>>> Hi Gurkirat,

>>>>>

>>>>> We noticed your Cash Advance application is still incomplete.

>>>>>

>>>>> You’re just a few steps away from securing up to $800,000 in funding within 48 hours.

>>>>>

>>>>> To move forward, please complete your application here:

>>>>> Click to Start your Application here

>>>>>

>>>>> and upload your last 3 months of bank statements. This will allow us to finalize your review and match you with the best available funding options.

>>>>>

>>>>> If you have any questions or would prefer to speak directly, feel free to call me at +1-866-216-5475 or 873-771-7630

>>>>>

>>>>> Best regards,

>>>>>

>>>>> Lilian Llanillo

>>>>> FUNDING ADVISOR

>>>>>

>>>>> email (16px).png lilian@kesefmarketing.com

>>>>> phone-call (16px).png +1 (873) 771-7630

>>>>> ____________________________

>>>>> IMG_5340.jpg

>>>>>

>>>>> To stop receiving these emails, click here.

>>>>>

>>>>>

>>>>>

>>>>> On Aug 11, 2026, at 09:49 AM, Lilian Llanillo wrote:

>>>>>> Hi Gurkirat,

>>>>>>

>>>>>> This is Lilian Llanillo from Kesef Marketing.

>>>>>>

>>>>>> Welcome! I wanted to personally reach out and thank you for your interest in business funding. We work with lenders across Canada to provide reliable funding solutions that support growth, manage cash flow, and cover upcoming expenses—while helping you access competitive interest rates.

>>>>>>

>>>>>> If you’re open to exploring your options, you can get started here:

>>>>>> Click Here To Start Your Application

>>>>>> Once submitted, our team will review your information and present the best available funding options tailored to your needs.

>>>>>>

>>>>>> If you have any questions or would prefer to speak directly, feel free to call me at +1-866-216-5475 or 873-771-7630

>>>>>>

>>>>>> Looking forward to connecting.

>>>>>>

>>>>>> Best regards,

>>>>>>

>>>>>> Lilian Llanillo

>>>>>> FUNDING ADVISOR

>>>>>>

>>>>>> email (16px).png lilian@kesefmarketing.com

>>>>>> phone-call (16px).png +1 (873) 771-7630

>>>>>> ____________________________

>>>>>> IMG_5340.jpg

>>>>>>

>>>>>> To stop receiving these emails, click here.

>>>>>>

Donation spam

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Fri, 28 Aug 2026 12:59:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.100 (FreeBSD))

(envelope-from )

id 1x01mF-000000002ph-3zEL

for dave@doctor.nl2k.ab.ca;

Fri, 28 Aug 2026 12:58:11 -0600

Resent-From: The Doctor

Resent-Date: Fri, 28 Aug 2026 12:58:11 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from cronus.internetguys.ca ([65.110.12.179]:33389)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.100 (FreeBSD))

(envelope-from )

id 1wzyj5-00000000JDR-29Rm

for www@nl2k.ab.ca;

Fri, 28 Aug 2026 09:42:52 -0600

DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=fsjmail.ca;

s=default; h=Content-Transfer-Encoding:Content-Type:MIME-Version:Message-ID:

Date:Subject:To:From:Reply-To:Sender:Cc:Content-ID:Content-Description:

Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:

In-Reply-To:References:List-Id:List-Help:List-Unsubscribe:List-Subscribe:

List-Post:List-Owner:List-Archive;

bh=dxAlClQ8y5Q6tq7CIaVd2aUcXb8te/l6Zzv1EN5B+eE=; b=Ohn0uJ2Iiqb8Be7OAMLXX0RB/9

GJ+OsLR5HwekV+u9hUJELhr0J3WIzVXmOxR8UG1DCT8nlO31q3LU4WhE0j6dJHE0T0NuljshyxhRH

R7m0p2RXqtuYO6jysNuBpP+NmctJbnSPaxqtnScbW5enuuySAOB0tkTsIXk4WRP4FJCg=;

Received: from kd027084177035.ppp-bb.dion.ne.jp ([27.84.177.35]:5435)

by cronus.internetguys.ca with esmtpsa (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

(Exim 4.99.5)

(envelope-from )

id 1wzyhP-0000000AVfp-05lf

for www@nl2k.ab.ca;

Fri, 28 Aug 2026 08:40:57 -0700

Reply-To: williamben5790@gmail.com

From: Mr. Cheng Saephan

To: www@nl2k.ab.ca

Subject: DONATION FUNDS !!!

Date: 28 Aug 2026 08:40:54 -0700

Message-ID: <20260828084052.D3526A4F16769890@fsjmail.ca>

MIME-Version: 1.0

Content-Type: text/plain;

charset="utf-8"

Content-Transfer-Encoding: quoted-printable

X-internetguys-MailScanner-Information: Please contact the ISP for more information

X-internetguys-MailScanner-ID: 1wzyhP-0000000AVfp-05lf

X-internetguys-MailScanner: Not scanned: please contact your Internet E-Mail Service Provider for details

X-internetguys-MailScanner-SpamCheck:

X-internetguys-MailScanner-From: wward2@fsjmail.ca

X-Spam-Status: No

X-AntiAbuse: This header was added to track abuse, please include it with any abuse report

X-AntiAbuse: Primary Hostname - cronus.internetguys.ca

X-AntiAbuse: Original Domain - nl2k.ab.ca

X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12]

X-AntiAbuse: Sender Address Domain - fsjmail.ca

X-Get-Message-Sender-Via: cronus.internetguys.ca: authenticated_id: wward2@fsjmail.ca

X-Authenticated-Sender: cronus.internetguys.ca: wward2@fsjmail.ca

X-Source:

X-Source-Args:

X-Source-Dir:

X-Spam_score: 18.1

X-Spam_score_int: 181

X-Spam_bar: ++++++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Dear Winner My name is Mr. Cheng Saephan, the fortunate winner

of a $1.3 billion powerball jackpot in 2024. I am giving away funds to five

randomly selected individuals. If you have received this email, it means

[...]



Content analysis details: (18.1 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[27.84.177.35 listed in will-spam-for-food.eu.org]

[27.84.177.35 listed in will-spam-for-food.eu.org]

[27.84.177.35 listed in will-spam-for-food.eu.org]

[27.84.177.35 listed in will-spam-for-food.eu.org]

[27.84.177.35 listed in will-spam-for-food.eu.org]

[27.84.177.35 listed in will-spam-for-food.eu.org]

[27.84.177.35 listed in will-spam-for-food.eu.org]

[27.84.177.35 listed in will-spam-for-food.eu.org]

[65.110.12.179 listed in will-spam-for-food.eu.org]

[65.110.12.179 listed in will-spam-for-food.eu.org]

[65.110.12.179 listed in will-spam-for-food.eu.org]

[65.110.12.179 listed in will-spam-for-food.eu.org]

[65.110.12.179 listed in will-spam-for-food.eu.org]

[65.110.12.179 listed in will-spam-for-food.eu.org]

[65.110.12.179 listed in will-spam-for-food.eu.org]

[65.110.12.179 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[27.84.177.35 listed in dnsbl.ahbl.org]

[27.84.177.35 listed in dnsbl.ahbl.org]

[27.84.177.35 listed in dnsbl.ahbl.org]

[27.84.177.35 listed in dnsbl.ahbl.org]

[65.110.12.179 listed in dnsbl.ahbl.org]

[65.110.12.179 listed in dnsbl.ahbl.org]

[65.110.12.179 listed in dnsbl.ahbl.org]

[65.110.12.179 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[27.84.177.35 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[27.84.177.35 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[27.84.177.35 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[27.84.177.35 listed in dnsbl.ahbl.org]

-0.0 SPF_PASS SPF: sender matches SPF record

-0.0 SPF_HELO_PASS SPF: HELO matches SPF record

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

1.5 RCVD_IN_CBL RBL: Received via a relay in cbl.abuseat.org

[Listed by XBL, see ]

1.5 RCVD_IN_SBL_XBL RBL: Received via a relay in Spamhaus SBL+XBL

[27.84.177.35 listed in sbl-xbl.spamhaus.org]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

1.6 SUBJ_ALL_CAPS Subject is all capitals

0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in digit

[williamben5790(at)gmail.com]

3.1 DEAR_WINNER BODY: Spam with generic salutation of "dear winner"

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[65.110.12.179 listed in bl.score.senderscore.com]

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

0.7 TO_NO_BRKTS_FROM_MSSP Multiple formatting errors

0.0 LOTS_OF_MONEY Huge... sums of money

1.4 MONEY_NOHTML Lots of money in plain text

0.0 HK_NAME_MR_MRS No description available.

2.5 FREEMAIL_FORGED_REPLYTO Freemail in Reply-To, but not From

0.4 MONEY_FREEMAIL_REPTO Lots of money from someone using free email?

1.3 MONEY_FORM_SHORT Lots of money if you fill out a short form

0.0 T_FILL_THIS_FORM_SHORT Fill in a short form with personal information

0.4 FILL_THIS_FORM_FRAUD_PHISH Answer suspicious question(s)

0.0 T_FILL_THIS_FORM_FRAUD_PHISH Answer suspicious question(s)

2.0 ADVANCE_FEE_2_NEW_MONEY Advance Fee fraud and lots of money

Subject: {SPAM?} DONATION FUNDS !!!



Dear Winner



My name is Mr. Cheng Saephan, the fortunate winner of a $1.3=20

billion powerball jackpot in 2024. I am giving away funds to five=20

randomly selected individuals. If you have received this email,=20

it means you were chosen in the selection process. I have donated=20

a significant portion of my wealth to various charities, but due=20

to my deteriorating health and limited time, I have decided to=20

contribute $10 million to you as one of the chosen five. You can=20

verify my winnings by watching the video linked below.



Click here to watch:

https://youtu.be/YH0ZPmf9VEE?si=3DEeAtBhFkLwde1c-d



YOUR CODE IS: [0043035]



Please respond to this email with the code [0043035] at=20

williamben5790@gmail.com and provide your details below, and he=20

will assist you with the next steps for receiving your donation.



You are advised to send your details as stated below.

your Full name,

your Home address

your WhatsApp number

your Occupation

your ID Card



Contact My Personal Manager

Name: Mr. William Ben

WhatsApp Only :+1(754)207-5509

Email: williamben5790@gmail.com



I hope this brings joy to you and your family.



Best regards,

Mr. Cheng Saephan

Donation spam

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Fri, 28 Aug 2026 12:59:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.100 (FreeBSD))

(envelope-from )

id 1x01m5-000000002oB-3sRP

for dave@doctor.nl2k.ab.ca;

Fri, 28 Aug 2026 12:58:01 -0600

Resent-From: The Doctor

Resent-Date: Fri, 28 Aug 2026 12:58:01 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from cronus.internetguys.ca ([65.110.12.179]:32987)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.100 (FreeBSD))

(envelope-from )

id 1wzyEu-00000000DiU-2v3Y

for support@nk.ca;

Fri, 28 Aug 2026 09:11:41 -0600

DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=fsjmail.ca;

s=default; h=Content-Transfer-Encoding:Content-Type:MIME-Version:Message-ID:

Date:Subject:To:From:Reply-To:Sender:Cc:Content-ID:Content-Description:

Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:

In-Reply-To:References:List-Id:List-Help:List-Unsubscribe:List-Subscribe:

List-Post:List-Owner:List-Archive;

bh=dxAlClQ8y5Q6tq7CIaVd2aUcXb8te/l6Zzv1EN5B+eE=; b=0a+S//bVHO8Qw7Hteoo3KUVzpv

TMCoerH2eAelcnHTSSGuJVcNgaH5iE4tmm8fsKJ9+WvQgoQsEgg0TjyFM/EulTfQM/N5aoHeyKmkw

+gQi44rv8CEQmv6Iz5obDr+U+FM6aDMTrigXwuzFIq2Xl1diTbFHogfPNn2X8jGosrFw=;

Received: from kd027084177035.ppp-bb.dion.ne.jp ([27.84.177.35]:6238)

by cronus.internetguys.ca with esmtpsa (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

(Exim 4.99.5)

(envelope-from )

id 1wzyCJ-0000000ACU9-3BgO

for support@nk.ca;

Fri, 28 Aug 2026 08:08:50 -0700

Reply-To: williamben5790@gmail.com

From: Mr. Cheng Saephan

To: support@nk.ca

Subject: DONATION FUNDS !!!

Date: 28 Aug 2026 08:08:46 -0700

Message-ID: <20260828080846.8615553299CE8E07@fsjmail.ca>

MIME-Version: 1.0

Content-Type: text/plain;

charset="utf-8"

Content-Transfer-Encoding: quoted-printable

X-internetguys-MailScanner-Information: Please contact the ISP for more information

X-internetguys-MailScanner-ID: 1wzyCJ-0000000ACU9-3BgO

X-internetguys-MailScanner: Not scanned: please contact your Internet E-Mail Service Provider for details

X-internetguys-MailScanner-SpamCheck:

X-internetguys-MailScanner-From: wward2@fsjmail.ca

X-Spam-Status: No

X-AntiAbuse: This header was added to track abuse, please include it with any abuse report

X-AntiAbuse: Primary Hostname - cronus.internetguys.ca

X-AntiAbuse: Original Domain - nk.ca

X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12]

X-AntiAbuse: Sender Address Domain - fsjmail.ca

X-Get-Message-Sender-Via: cronus.internetguys.ca: authenticated_id: wward2@fsjmail.ca

X-Authenticated-Sender: cronus.internetguys.ca: wward2@fsjmail.ca

X-Source:

X-Source-Args:

X-Source-Dir:

X-Spam_score: 18.1

X-Spam_score_int: 181

X-Spam_bar: ++++++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Dear Winner My name is Mr. Cheng Saephan, the fortunate winner

of a $1.3 billion powerball jackpot in 2024. I am giving away funds to five

randomly selected individuals. If you have received this email, it means

[...]



Content analysis details: (18.1 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[27.84.177.35 listed in will-spam-for-food.eu.org]

[27.84.177.35 listed in will-spam-for-food.eu.org]

[27.84.177.35 listed in will-spam-for-food.eu.org]

[27.84.177.35 listed in will-spam-for-food.eu.org]

[27.84.177.35 listed in will-spam-for-food.eu.org]

[27.84.177.35 listed in will-spam-for-food.eu.org]

[27.84.177.35 listed in will-spam-for-food.eu.org]

[27.84.177.35 listed in will-spam-for-food.eu.org]

[65.110.12.179 listed in will-spam-for-food.eu.org]

[65.110.12.179 listed in will-spam-for-food.eu.org]

[65.110.12.179 listed in will-spam-for-food.eu.org]

[65.110.12.179 listed in will-spam-for-food.eu.org]

[65.110.12.179 listed in will-spam-for-food.eu.org]

[65.110.12.179 listed in will-spam-for-food.eu.org]

[65.110.12.179 listed in will-spam-for-food.eu.org]

[65.110.12.179 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[27.84.177.35 listed in dnsbl.ahbl.org]

[27.84.177.35 listed in dnsbl.ahbl.org]

[27.84.177.35 listed in dnsbl.ahbl.org]

[27.84.177.35 listed in dnsbl.ahbl.org]

[65.110.12.179 listed in dnsbl.ahbl.org]

[65.110.12.179 listed in dnsbl.ahbl.org]

[65.110.12.179 listed in dnsbl.ahbl.org]

[65.110.12.179 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[27.84.177.35 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[27.84.177.35 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[27.84.177.35 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[27.84.177.35 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_SBL_XBL RBL: Received via a relay in Spamhaus SBL+XBL

[27.84.177.35 listed in sbl-xbl.spamhaus.org]

1.5 RCVD_IN_CBL RBL: Received via a relay in cbl.abuseat.org

[Listed by XBL, see ]

-0.0 SPF_PASS SPF: sender matches SPF record

-0.0 SPF_HELO_PASS SPF: HELO matches SPF record

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

1.6 SUBJ_ALL_CAPS Subject is all capitals

0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in digit

[williamben5790(at)gmail.com]

3.1 DEAR_WINNER BODY: Spam with generic salutation of "dear winner"

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[65.110.12.179 listed in bl.score.senderscore.com]

0.0 HK_NAME_MR_MRS No description available.

0.0 LOTS_OF_MONEY Huge... sums of money

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

2.5 FREEMAIL_FORGED_REPLYTO Freemail in Reply-To, but not From

0.7 TO_NO_BRKTS_FROM_MSSP Multiple formatting errors

1.4 MONEY_NOHTML Lots of money in plain text

0.0 T_FILL_THIS_FORM_SHORT Fill in a short form with personal information

0.0 T_FILL_THIS_FORM_FRAUD_PHISH Answer suspicious question(s)

0.4 MONEY_FREEMAIL_REPTO Lots of money from someone using free email?

0.4 FILL_THIS_FORM_FRAUD_PHISH Answer suspicious question(s)

1.3 MONEY_FORM_SHORT Lots of money if you fill out a short form

2.0 ADVANCE_FEE_2_NEW_MONEY Advance Fee fraud and lots of money

Subject: {SPAM?} DONATION FUNDS !!!



Dear Winner



My name is Mr. Cheng Saephan, the fortunate winner of a $1.3=20

billion powerball jackpot in 2024. I am giving away funds to five=20

randomly selected individuals. If you have received this email,=20

it means you were chosen in the selection process. I have donated=20

a significant portion of my wealth to various charities, but due=20

to my deteriorating health and limited time, I have decided to=20

contribute $10 million to you as one of the chosen five. You can=20

verify my winnings by watching the video linked below.



Click here to watch:

https://youtu.be/YH0ZPmf9VEE?si=3DEeAtBhFkLwde1c-d



YOUR CODE IS: [0043035]



Please respond to this email with the code [0043035] at=20

williamben5790@gmail.com and provide your details below, and he=20

will assist you with the next steps for receiving your donation.



You are advised to send your details as stated below.

your Full name,

your Home address

your WhatsApp number

your Occupation

your ID Card



Contact My Personal Manager

Name: Mr. William Ben

WhatsApp Only :+1(754)207-5509

Email: williamben5790@gmail.com



I hope this brings joy to you and your family.



Best regards,

Mr. Cheng Saephan

Donation spam

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Fri, 28 Aug 2026 12:58:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.100 (FreeBSD))

(envelope-from )

id 1x01lv-000000002lc-3zLm

for dave@doctor.nl2k.ab.ca;

Fri, 28 Aug 2026 12:57:51 -0600

Resent-From: The Doctor

Resent-Date: Fri, 28 Aug 2026 12:57:51 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from cronus.internetguys.ca ([65.110.12.179]:60101)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.100 (FreeBSD))

(envelope-from )

id 1wzxnP-000000008UR-1R8u

for sales@nk.ca;

Fri, 28 Aug 2026 08:43:16 -0600

DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=fsjmail.ca;

s=default; h=Content-Transfer-Encoding:Content-Type:MIME-Version:Message-ID:

Date:Subject:To:From:Reply-To:Sender:Cc:Content-ID:Content-Description:

Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:

In-Reply-To:References:List-Id:List-Help:List-Unsubscribe:List-Subscribe:

List-Post:List-Owner:List-Archive;

bh=dxAlClQ8y5Q6tq7CIaVd2aUcXb8te/l6Zzv1EN5B+eE=; b=xZ5JNfS4oud9tEmkVfkQJyLhrF

8AUP96PGceczXgLLUQrnwLGpTPrXYJ7Pk7udOfAo+aZIVFr9kBe0tuHs6/a2rOKqPORUDNJxnAwc3

hPQFR2j1ja+av61ZwKygAIzC9ZPK2Pspt71d6vX4yKXnL3VNeEWzGCt/H+SkD8BTbRKw=;

Received: from kd027084177035.ppp-bb.dion.ne.jp ([27.84.177.35]:14612)

by cronus.internetguys.ca with esmtpsa (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

(Exim 4.99.5)

(envelope-from )

id 1wzxjx-00000009un6-2mIw

for sales@nk.ca;

Fri, 28 Aug 2026 07:39:32 -0700

Reply-To: williamben5790@gmail.com

From: Mr. Cheng Saephan

To: sales@nk.ca

Subject: DONATION FUNDS !!!

Date: 28 Aug 2026 07:39:25 -0700

Message-ID: <20260828073925.4C5886E3C98B40A0@fsjmail.ca>

MIME-Version: 1.0

Content-Type: text/plain;

charset="utf-8"

Content-Transfer-Encoding: quoted-printable

X-internetguys-MailScanner-Information: Please contact the ISP for more information

X-internetguys-MailScanner-ID: 1wzxjx-00000009un6-2mIw

X-internetguys-MailScanner: Not scanned: please contact your Internet E-Mail Service Provider for details

X-internetguys-MailScanner-SpamCheck:

X-internetguys-MailScanner-From: wward2@fsjmail.ca

X-Spam-Status: No

X-AntiAbuse: This header was added to track abuse, please include it with any abuse report

X-AntiAbuse: Primary Hostname - cronus.internetguys.ca

X-AntiAbuse: Original Domain - nk.ca

X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12]

X-AntiAbuse: Sender Address Domain - fsjmail.ca

X-Get-Message-Sender-Via: cronus.internetguys.ca: authenticated_id: wward2@fsjmail.ca

X-Authenticated-Sender: cronus.internetguys.ca: wward2@fsjmail.ca

X-Source:

X-Source-Args:

X-Source-Dir:

X-Spam_score: 18.1

X-Spam_score_int: 181

X-Spam_bar: ++++++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Dear Winner My name is Mr. Cheng Saephan, the fortunate winner

of a $1.3 billion powerball jackpot in 2024. I am giving away funds to five

randomly selected individuals. If you have received this email, it means

[...]



Content analysis details: (18.1 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[27.84.177.35 listed in will-spam-for-food.eu.org]

[27.84.177.35 listed in will-spam-for-food.eu.org]

[27.84.177.35 listed in will-spam-for-food.eu.org]

[27.84.177.35 listed in will-spam-for-food.eu.org]

[27.84.177.35 listed in will-spam-for-food.eu.org]

[27.84.177.35 listed in will-spam-for-food.eu.org]

[27.84.177.35 listed in will-spam-for-food.eu.org]

[27.84.177.35 listed in will-spam-for-food.eu.org]

[65.110.12.179 listed in will-spam-for-food.eu.org]

[65.110.12.179 listed in will-spam-for-food.eu.org]

[65.110.12.179 listed in will-spam-for-food.eu.org]

[65.110.12.179 listed in will-spam-for-food.eu.org]

[65.110.12.179 listed in will-spam-for-food.eu.org]

[65.110.12.179 listed in will-spam-for-food.eu.org]

[65.110.12.179 listed in will-spam-for-food.eu.org]

[65.110.12.179 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_SBL_XBL RBL: Received via a relay in Spamhaus SBL+XBL

[27.84.177.35 listed in sbl-xbl.spamhaus.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[27.84.177.35 listed in dnsbl.ahbl.org]

[27.84.177.35 listed in dnsbl.ahbl.org]

[27.84.177.35 listed in dnsbl.ahbl.org]

[27.84.177.35 listed in dnsbl.ahbl.org]

[65.110.12.179 listed in dnsbl.ahbl.org]

[65.110.12.179 listed in dnsbl.ahbl.org]

[65.110.12.179 listed in dnsbl.ahbl.org]

[65.110.12.179 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[27.84.177.35 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[27.84.177.35 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[27.84.177.35 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[27.84.177.35 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_CBL RBL: Received via a relay in cbl.abuseat.org

[Listed by XBL, see ]

-0.0 SPF_PASS SPF: sender matches SPF record

-0.0 SPF_HELO_PASS SPF: HELO matches SPF record

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

1.6 SUBJ_ALL_CAPS Subject is all capitals

0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in digit

[williamben5790(at)gmail.com]

3.1 DEAR_WINNER BODY: Spam with generic salutation of "dear winner"

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[65.110.12.179 listed in bl.score.senderscore.com]

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

0.0 HK_NAME_MR_MRS No description available.

0.0 LOTS_OF_MONEY Huge... sums of money

0.4 MONEY_FREEMAIL_REPTO Lots of money from someone using free email?

1.4 MONEY_NOHTML Lots of money in plain text

0.7 TO_NO_BRKTS_FROM_MSSP Multiple formatting errors

2.5 FREEMAIL_FORGED_REPLYTO Freemail in Reply-To, but not From

0.0 T_FILL_THIS_FORM_SHORT Fill in a short form with personal information

0.4 FILL_THIS_FORM_FRAUD_PHISH Answer suspicious question(s)

2.0 ADVANCE_FEE_2_NEW_MONEY Advance Fee fraud and lots of money

0.0 T_FILL_THIS_FORM_FRAUD_PHISH Answer suspicious question(s)

1.3 MONEY_FORM_SHORT Lots of money if you fill out a short form

Subject: {SPAM?} DONATION FUNDS !!!



Dear Winner



My name is Mr. Cheng Saephan, the fortunate winner of a $1.3=20

billion powerball jackpot in 2024. I am giving away funds to five=20

randomly selected individuals. If you have received this email,=20

it means you were chosen in the selection process. I have donated=20

a significant portion of my wealth to various charities, but due=20

to my deteriorating health and limited time, I have decided to=20

contribute $10 million to you as one of the chosen five. You can=20

verify my winnings by watching the video linked below.



Click here to watch:

https://youtu.be/YH0ZPmf9VEE?si=3DEeAtBhFkLwde1c-d



YOUR CODE IS: [0043035]



Please respond to this email with the code [0043035] at=20

williamben5790@gmail.com and provide your details below, and he=20

will assist you with the next steps for receiving your donation.



You are advised to send your details as stated below.

your Full name,

your Home address

your WhatsApp number

your Occupation

your ID Card



Contact My Personal Manager

Name: Mr. William Ben

WhatsApp Only :+1(754)207-5509

Email: williamben5790@gmail.com



I hope this brings joy to you and your family.



Best regards,

Mr. Cheng Saephan

Donation spam

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Fri, 28 Aug 2026 12:58:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.100 (FreeBSD))

(envelope-from )

id 1x01lq-000000002ko-41CQ

for dave@doctor.nl2k.ab.ca;

Fri, 28 Aug 2026 12:57:46 -0600

Resent-From: The Doctor

Resent-Date: Fri, 28 Aug 2026 12:57:46 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from cronus.internetguys.ca ([65.110.12.179]:41691)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.100 (FreeBSD))

(envelope-from )

id 1wzxdC-000000006ZD-0Akt

for root@nl2k.ca;

Fri, 28 Aug 2026 08:32:43 -0600

DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=fsjmail.ca;

s=default; h=Content-Transfer-Encoding:Content-Type:MIME-Version:Message-ID:

Date:Subject:To:From:Reply-To:Sender:Cc:Content-ID:Content-Description:

Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:

In-Reply-To:References:List-Id:List-Help:List-Unsubscribe:List-Subscribe:

List-Post:List-Owner:List-Archive;

bh=dxAlClQ8y5Q6tq7CIaVd2aUcXb8te/l6Zzv1EN5B+eE=; b=RnAovrBlY3ZOoQAzfPPS5lDAZD

ZopaUldtzc3NP4fPCuJFJoJnAWAX2l94LPkQZSflpvC2gkXlJ0t8P9Z1J2jyy4REwMoQFSERpvLq/

vcjGMrDxNezCbGu6+MSaRxXmcZ+02ofdL7L01WU2Lxes/r1wNKglns5nK7J0iKY6x6bs=;

Received: from kd027084177035.ppp-bb.dion.ne.jp ([27.84.177.35]:24080)

by cronus.internetguys.ca with esmtpsa (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

(Exim 4.99.5)

(envelope-from )

id 1wzxcI-00000009ps0-3I6t

for root@nl2k.ca;

Fri, 28 Aug 2026 07:31:37 -0700

Reply-To: williamben5790@gmail.com

From: Mr. Cheng Saephan

To: root@nl2k.ca

Subject: DONATION FUNDS !!!

Date: 28 Aug 2026 07:31:34 -0700

Message-ID: <20260828073133.B2C2D17EE283C608@fsjmail.ca>

MIME-Version: 1.0

Content-Type: text/plain;

charset="utf-8"

Content-Transfer-Encoding: quoted-printable

X-internetguys-MailScanner-Information: Please contact the ISP for more information

X-internetguys-MailScanner-ID: 1wzxcI-00000009ps0-3I6t

X-internetguys-MailScanner: Not scanned: please contact your Internet E-Mail Service Provider for details

X-internetguys-MailScanner-SpamCheck:

X-internetguys-MailScanner-From: wward2@fsjmail.ca

X-Spam-Status: No

X-AntiAbuse: This header was added to track abuse, please include it with any abuse report

X-AntiAbuse: Primary Hostname - cronus.internetguys.ca

X-AntiAbuse: Original Domain - nl2k.ca

X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12]

X-AntiAbuse: Sender Address Domain - fsjmail.ca

X-Get-Message-Sender-Via: cronus.internetguys.ca: authenticated_id: wward2@fsjmail.ca

X-Authenticated-Sender: cronus.internetguys.ca: wward2@fsjmail.ca

X-Source:

X-Source-Args:

X-Source-Dir:

X-Spam_score: 18.1

X-Spam_score_int: 181

X-Spam_bar: ++++++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Dear Winner My name is Mr. Cheng Saephan, the fortunate winner

of a $1.3 billion powerball jackpot in 2024. I am giving away funds to five

randomly selected individuals. If you have received this email, it means

[...]



Content analysis details: (18.1 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[27.84.177.35 listed in will-spam-for-food.eu.org]

[27.84.177.35 listed in will-spam-for-food.eu.org]

[27.84.177.35 listed in will-spam-for-food.eu.org]

[27.84.177.35 listed in will-spam-for-food.eu.org]

[27.84.177.35 listed in will-spam-for-food.eu.org]

[27.84.177.35 listed in will-spam-for-food.eu.org]

[27.84.177.35 listed in will-spam-for-food.eu.org]

[27.84.177.35 listed in will-spam-for-food.eu.org]

[65.110.12.179 listed in will-spam-for-food.eu.org]

[65.110.12.179 listed in will-spam-for-food.eu.org]

[65.110.12.179 listed in will-spam-for-food.eu.org]

[65.110.12.179 listed in will-spam-for-food.eu.org]

[65.110.12.179 listed in will-spam-for-food.eu.org]

[65.110.12.179 listed in will-spam-for-food.eu.org]

[65.110.12.179 listed in will-spam-for-food.eu.org]

[65.110.12.179 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[27.84.177.35 listed in dnsbl.ahbl.org]

[27.84.177.35 listed in dnsbl.ahbl.org]

[27.84.177.35 listed in dnsbl.ahbl.org]

[27.84.177.35 listed in dnsbl.ahbl.org]

[65.110.12.179 listed in dnsbl.ahbl.org]

[65.110.12.179 listed in dnsbl.ahbl.org]

[65.110.12.179 listed in dnsbl.ahbl.org]

[65.110.12.179 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[27.84.177.35 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[27.84.177.35 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[27.84.177.35 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[27.84.177.35 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_SBL_XBL RBL: Received via a relay in Spamhaus SBL+XBL

[27.84.177.35 listed in sbl-xbl.spamhaus.org]

1.5 RCVD_IN_CBL RBL: Received via a relay in cbl.abuseat.org

[Listed by XBL, see ]

-0.0 SPF_PASS SPF: sender matches SPF record

-0.0 SPF_HELO_PASS SPF: HELO matches SPF record

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

1.6 SUBJ_ALL_CAPS Subject is all capitals

0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in digit

[williamben5790(at)gmail.com]

3.1 DEAR_WINNER BODY: Spam with generic salutation of "dear winner"

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[65.110.12.179 listed in bl.score.senderscore.com]

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

0.0 HK_NAME_MR_MRS No description available.

0.0 LOTS_OF_MONEY Huge... sums of money

0.7 TO_NO_BRKTS_FROM_MSSP Multiple formatting errors

1.4 MONEY_NOHTML Lots of money in plain text

2.5 FREEMAIL_FORGED_REPLYTO Freemail in Reply-To, but not From

0.4 MONEY_FREEMAIL_REPTO Lots of money from someone using free email?

0.0 T_FILL_THIS_FORM_SHORT Fill in a short form with personal information

1.3 MONEY_FORM_SHORT Lots of money if you fill out a short form

0.0 T_FILL_THIS_FORM_FRAUD_PHISH Answer suspicious question(s)

0.4 FILL_THIS_FORM_FRAUD_PHISH Answer suspicious question(s)

2.0 ADVANCE_FEE_2_NEW_MONEY Advance Fee fraud and lots of money

Subject: {SPAM?} DONATION FUNDS !!!



Dear Winner



My name is Mr. Cheng Saephan, the fortunate winner of a $1.3=20

billion powerball jackpot in 2024. I am giving away funds to five=20

randomly selected individuals. If you have received this email,=20

it means you were chosen in the selection process. I have donated=20

a significant portion of my wealth to various charities, but due=20

to my deteriorating health and limited time, I have decided to=20

contribute $10 million to you as one of the chosen five. You can=20

verify my winnings by watching the video linked below.



Click here to watch:

https://youtu.be/YH0ZPmf9VEE?si=3DEeAtBhFkLwde1c-d



YOUR CODE IS: [0043035]



Please respond to this email with the code [0043035] at=20

williamben5790@gmail.com and provide your details below, and he=20

will assist you with the next steps for receiving your donation.



You are advised to send your details as stated below.

your Full name,

your Home address

your WhatsApp number

your Occupation

your ID Card



Contact My Personal Manager

Name: Mr. William Ben

WhatsApp Only :+1(754)207-5509

Email: williamben5790@gmail.com



I hope this brings joy to you and your family.



Best regards,

Mr. Cheng Saephan

Donation spam

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Fri, 28 Aug 2026 12:58:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.100 (FreeBSD))

(envelope-from )

id 1x01ln-000000002kH-113i

for dave@doctor.nl2k.ab.ca;

Fri, 28 Aug 2026 12:57:43 -0600

Resent-From: The Doctor

Resent-Date: Fri, 28 Aug 2026 12:57:43 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from cronus.internetguys.ca ([65.110.12.179]:48343)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.100 (FreeBSD))

(envelope-from )

id 1wzxeC-000000006jl-38y5

for root@doctor.nl2k.ab.ca;

Fri, 28 Aug 2026 08:33:45 -0600

DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=fsjmail.ca;

s=default; h=Content-Transfer-Encoding:Content-Type:MIME-Version:Message-ID:

Date:Subject:To:From:Reply-To:Sender:Cc:Content-ID:Content-Description:

Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:

In-Reply-To:References:List-Id:List-Help:List-Unsubscribe:List-Subscribe:

List-Post:List-Owner:List-Archive;

bh=dxAlClQ8y5Q6tq7CIaVd2aUcXb8te/l6Zzv1EN5B+eE=; b=SsG5ceQyKNKwmOPUo2m2ukAYJB

aS4tfSpsKWjtWh8E60f5AC/H2BCSyqFUW0XAXP7jVLMgpMpd0yCge+vQ31Ppml9ymYxvG5mGFjZFn

902KHg7z9MLr3UDlgNXyyKlY/a1iuiRJD1XLTH8UrJZhJ2BGqVCKGHdIP6fG2HdGjLSo=;

Received: from kd027084177035.ppp-bb.dion.ne.jp ([27.84.177.35]:52481)

by cronus.internetguys.ca with esmtpsa (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

(Exim 4.99.5)

(envelope-from )

id 1wzxcH-00000009paE-3Ktm

for root@doctor.nl2k.ab.ca;

Fri, 28 Aug 2026 07:31:36 -0700

Reply-To: williamben5790@gmail.com

From: Mr. Cheng Saephan

To: root@doctor.nl2k.ab.ca

Subject: DONATION FUNDS !!!

Date: 28 Aug 2026 07:31:33 -0700

Message-ID: <20260828073133.995F182139FF7C66@fsjmail.ca>

MIME-Version: 1.0

Content-Type: text/plain;

charset="utf-8"

Content-Transfer-Encoding: quoted-printable

X-internetguys-MailScanner-Information: Please contact the ISP for more information

X-internetguys-MailScanner-ID: 1wzxcH-00000009paE-3Ktm

X-internetguys-MailScanner: Not scanned: please contact your Internet E-Mail Service Provider for details

X-internetguys-MailScanner-SpamCheck:

X-internetguys-MailScanner-From: wward2@fsjmail.ca

X-Spam-Status: No

X-AntiAbuse: This header was added to track abuse, please include it with any abuse report

X-AntiAbuse: Primary Hostname - cronus.internetguys.ca

X-AntiAbuse: Original Domain - doctor.nl2k.ab.ca

X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12]

X-AntiAbuse: Sender Address Domain - fsjmail.ca

X-Get-Message-Sender-Via: cronus.internetguys.ca: authenticated_id: wward2@fsjmail.ca

X-Authenticated-Sender: cronus.internetguys.ca: wward2@fsjmail.ca

X-Source:

X-Source-Args:

X-Source-Dir:

X-Spam_score: 18.1

X-Spam_score_int: 181

X-Spam_bar: ++++++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Dear Winner My name is Mr. Cheng Saephan, the fortunate winner

of a $1.3 billion powerball jackpot in 2024. I am giving away funds to five

randomly selected individuals. If you have received this email, it means

[...]



Content analysis details: (18.1 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[27.84.177.35 listed in will-spam-for-food.eu.org]

[27.84.177.35 listed in will-spam-for-food.eu.org]

[27.84.177.35 listed in will-spam-for-food.eu.org]

[27.84.177.35 listed in will-spam-for-food.eu.org]

[27.84.177.35 listed in will-spam-for-food.eu.org]

[27.84.177.35 listed in will-spam-for-food.eu.org]

[27.84.177.35 listed in will-spam-for-food.eu.org]

[27.84.177.35 listed in will-spam-for-food.eu.org]

[65.110.12.179 listed in will-spam-for-food.eu.org]

[65.110.12.179 listed in will-spam-for-food.eu.org]

[65.110.12.179 listed in will-spam-for-food.eu.org]

[65.110.12.179 listed in will-spam-for-food.eu.org]

[65.110.12.179 listed in will-spam-for-food.eu.org]

[65.110.12.179 listed in will-spam-for-food.eu.org]

[65.110.12.179 listed in will-spam-for-food.eu.org]

[65.110.12.179 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_SBL_XBL RBL: Received via a relay in Spamhaus SBL+XBL

[27.84.177.35 listed in sbl-xbl.spamhaus.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[27.84.177.35 listed in dnsbl.ahbl.org]

[27.84.177.35 listed in dnsbl.ahbl.org]

[27.84.177.35 listed in dnsbl.ahbl.org]

[27.84.177.35 listed in dnsbl.ahbl.org]

[65.110.12.179 listed in dnsbl.ahbl.org]

[65.110.12.179 listed in dnsbl.ahbl.org]

[65.110.12.179 listed in dnsbl.ahbl.org]

[65.110.12.179 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[27.84.177.35 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[27.84.177.35 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[27.84.177.35 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[27.84.177.35 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_CBL RBL: Received via a relay in cbl.abuseat.org

[Listed by XBL, see ]

-0.0 SPF_PASS SPF: sender matches SPF record

-0.0 SPF_HELO_PASS SPF: HELO matches SPF record

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

1.6 SUBJ_ALL_CAPS Subject is all capitals

0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in digit

[williamben5790(at)gmail.com]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

3.1 DEAR_WINNER BODY: Spam with generic salutation of "dear winner"

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[65.110.12.179 listed in bl.score.senderscore.com]

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

0.0 LOTS_OF_MONEY Huge... sums of money

0.0 HK_NAME_MR_MRS No description available.

0.7 TO_NO_BRKTS_FROM_MSSP Multiple formatting errors

0.4 MONEY_FREEMAIL_REPTO Lots of money from someone using free email?

1.4 MONEY_NOHTML Lots of money in plain text

2.5 FREEMAIL_FORGED_REPLYTO Freemail in Reply-To, but not From

0.0 T_FILL_THIS_FORM_SHORT Fill in a short form with personal information

0.0 T_FILL_THIS_FORM_FRAUD_PHISH Answer suspicious question(s)

0.4 FILL_THIS_FORM_FRAUD_PHISH Answer suspicious question(s)

1.3 MONEY_FORM_SHORT Lots of money if you fill out a short form

2.0 ADVANCE_FEE_2_NEW_MONEY Advance Fee fraud and lots of money

Subject: {SPAM?} DONATION FUNDS !!!



Dear Winner



My name is Mr. Cheng Saephan, the fortunate winner of a $1.3=20

billion powerball jackpot in 2024. I am giving away funds to five=20

randomly selected individuals. If you have received this email,=20

it means you were chosen in the selection process. I have donated=20

a significant portion of my wealth to various charities, but due=20

to my deteriorating health and limited time, I have decided to=20

contribute $10 million to you as one of the chosen five. You can=20

verify my winnings by watching the video linked below.



Click here to watch:

https://youtu.be/YH0ZPmf9VEE?si=3DEeAtBhFkLwde1c-d



YOUR CODE IS: [0043035]



Please respond to this email with the code [0043035] at=20

williamben5790@gmail.com and provide your details below, and he=20

will assist you with the next steps for receiving your donation.



You are advised to send your details as stated below.

your Full name,

your Home address

your WhatsApp number

your Occupation

your ID Card



Contact My Personal Manager

Name: Mr. William Ben

WhatsApp Only :+1(754)207-5509

Email: williamben5790@gmail.com



I hope this brings joy to you and your family.



Best regards,

Mr. Cheng Saephan

Donation spam

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Fri, 28 Aug 2026 12:58:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.100 (FreeBSD))

(envelope-from )

id 1x01ln-000000002kH-113i

for dave@doctor.nl2k.ab.ca;

Fri, 28 Aug 2026 12:57:43 -0600

Resent-From: The Doctor

Resent-Date: Fri, 28 Aug 2026 12:57:43 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from cronus.internetguys.ca ([65.110.12.179]:48343)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.100 (FreeBSD))

(envelope-from )

id 1wzxeC-000000006jl-38y5

for root@doctor.nl2k.ab.ca;

Fri, 28 Aug 2026 08:33:45 -0600

DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=fsjmail.ca;

s=default; h=Content-Transfer-Encoding:Content-Type:MIME-Version:Message-ID:

Date:Subject:To:From:Reply-To:Sender:Cc:Content-ID:Content-Description:

Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:

In-Reply-To:References:List-Id:List-Help:List-Unsubscribe:List-Subscribe:

List-Post:List-Owner:List-Archive;

bh=dxAlClQ8y5Q6tq7CIaVd2aUcXb8te/l6Zzv1EN5B+eE=; b=SsG5ceQyKNKwmOPUo2m2ukAYJB

aS4tfSpsKWjtWh8E60f5AC/H2BCSyqFUW0XAXP7jVLMgpMpd0yCge+vQ31Ppml9ymYxvG5mGFjZFn

902KHg7z9MLr3UDlgNXyyKlY/a1iuiRJD1XLTH8UrJZhJ2BGqVCKGHdIP6fG2HdGjLSo=;

Received: from kd027084177035.ppp-bb.dion.ne.jp ([27.84.177.35]:52481)

by cronus.internetguys.ca with esmtpsa (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

(Exim 4.99.5)

(envelope-from )

id 1wzxcH-00000009paE-3Ktm

for root@doctor.nl2k.ab.ca;

Fri, 28 Aug 2026 07:31:36 -0700

Reply-To: williamben5790@gmail.com

From: Mr. Cheng Saephan

To: root@doctor.nl2k.ab.ca

Subject: DONATION FUNDS !!!

Date: 28 Aug 2026 07:31:33 -0700

Message-ID: <20260828073133.995F182139FF7C66@fsjmail.ca>

MIME-Version: 1.0

Content-Type: text/plain;

charset="utf-8"

Content-Transfer-Encoding: quoted-printable

X-internetguys-MailScanner-Information: Please contact the ISP for more information

X-internetguys-MailScanner-ID: 1wzxcH-00000009paE-3Ktm

X-internetguys-MailScanner: Not scanned: please contact your Internet E-Mail Service Provider for details

X-internetguys-MailScanner-SpamCheck:

X-internetguys-MailScanner-From: wward2@fsjmail.ca

X-Spam-Status: No

X-AntiAbuse: This header was added to track abuse, please include it with any abuse report

X-AntiAbuse: Primary Hostname - cronus.internetguys.ca

X-AntiAbuse: Original Domain - doctor.nl2k.ab.ca

X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12]

X-AntiAbuse: Sender Address Domain - fsjmail.ca

X-Get-Message-Sender-Via: cronus.internetguys.ca: authenticated_id: wward2@fsjmail.ca

X-Authenticated-Sender: cronus.internetguys.ca: wward2@fsjmail.ca

X-Source:

X-Source-Args:

X-Source-Dir:

X-Spam_score: 18.1

X-Spam_score_int: 181

X-Spam_bar: ++++++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Dear Winner My name is Mr. Cheng Saephan, the fortunate winner

of a $1.3 billion powerball jackpot in 2024. I am giving away funds to five

randomly selected individuals. If you have received this email, it means

[...]



Content analysis details: (18.1 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[27.84.177.35 listed in will-spam-for-food.eu.org]

[27.84.177.35 listed in will-spam-for-food.eu.org]

[27.84.177.35 listed in will-spam-for-food.eu.org]

[27.84.177.35 listed in will-spam-for-food.eu.org]

[27.84.177.35 listed in will-spam-for-food.eu.org]

[27.84.177.35 listed in will-spam-for-food.eu.org]

[27.84.177.35 listed in will-spam-for-food.eu.org]

[27.84.177.35 listed in will-spam-for-food.eu.org]

[65.110.12.179 listed in will-spam-for-food.eu.org]

[65.110.12.179 listed in will-spam-for-food.eu.org]

[65.110.12.179 listed in will-spam-for-food.eu.org]

[65.110.12.179 listed in will-spam-for-food.eu.org]

[65.110.12.179 listed in will-spam-for-food.eu.org]

[65.110.12.179 listed in will-spam-for-food.eu.org]

[65.110.12.179 listed in will-spam-for-food.eu.org]

[65.110.12.179 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_SBL_XBL RBL: Received via a relay in Spamhaus SBL+XBL

[27.84.177.35 listed in sbl-xbl.spamhaus.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[27.84.177.35 listed in dnsbl.ahbl.org]

[27.84.177.35 listed in dnsbl.ahbl.org]

[27.84.177.35 listed in dnsbl.ahbl.org]

[27.84.177.35 listed in dnsbl.ahbl.org]

[65.110.12.179 listed in dnsbl.ahbl.org]

[65.110.12.179 listed in dnsbl.ahbl.org]

[65.110.12.179 listed in dnsbl.ahbl.org]

[65.110.12.179 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[27.84.177.35 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[27.84.177.35 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[27.84.177.35 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[27.84.177.35 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_CBL RBL: Received via a relay in cbl.abuseat.org

[Listed by XBL, see ]

-0.0 SPF_PASS SPF: sender matches SPF record

-0.0 SPF_HELO_PASS SPF: HELO matches SPF record

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

1.6 SUBJ_ALL_CAPS Subject is all capitals

0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in digit

[williamben5790(at)gmail.com]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

3.1 DEAR_WINNER BODY: Spam with generic salutation of "dear winner"

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[65.110.12.179 listed in bl.score.senderscore.com]

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

0.0 LOTS_OF_MONEY Huge... sums of money

0.0 HK_NAME_MR_MRS No description available.

0.7 TO_NO_BRKTS_FROM_MSSP Multiple formatting errors

0.4 MONEY_FREEMAIL_REPTO Lots of money from someone using free email?

1.4 MONEY_NOHTML Lots of money in plain text

2.5 FREEMAIL_FORGED_REPLYTO Freemail in Reply-To, but not From

0.0 T_FILL_THIS_FORM_SHORT Fill in a short form with personal information

0.0 T_FILL_THIS_FORM_FRAUD_PHISH Answer suspicious question(s)

0.4 FILL_THIS_FORM_FRAUD_PHISH Answer suspicious question(s)

1.3 MONEY_FORM_SHORT Lots of money if you fill out a short form

2.0 ADVANCE_FEE_2_NEW_MONEY Advance Fee fraud and lots of money

Subject: {SPAM?} DONATION FUNDS !!!



Dear Winner



My name is Mr. Cheng Saephan, the fortunate winner of a $1.3=20

billion powerball jackpot in 2024. I am giving away funds to five=20

randomly selected individuals. If you have received this email,=20

it means you were chosen in the selection process. I have donated=20

a significant portion of my wealth to various charities, but due=20

to my deteriorating health and limited time, I have decided to=20

contribute $10 million to you as one of the chosen five. You can=20

verify my winnings by watching the video linked below.



Click here to watch:

https://youtu.be/YH0ZPmf9VEE?si=3DEeAtBhFkLwde1c-d



YOUR CODE IS: [0043035]



Please respond to this email with the code [0043035] at=20

williamben5790@gmail.com and provide your details below, and he=20

will assist you with the next steps for receiving your donation.



You are advised to send your details as stated below.

your Full name,

your Home address

your WhatsApp number

your Occupation

your ID Card



Contact My Personal Manager

Name: Mr. William Ben

WhatsApp Only :+1(754)207-5509

Email: williamben5790@gmail.com



I hope this brings joy to you and your family.



Best regards,

Mr. Cheng Saephan

Donation spam

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Fri, 28 Aug 2026 12:58:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.100 (FreeBSD))

(envelope-from )

id 1x01lj-000000002js-179h

for dave@doctor.nl2k.ab.ca;

Fri, 28 Aug 2026 12:57:39 -0600

Resent-From: The Doctor

Resent-Date: Fri, 28 Aug 2026 12:57:39 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from cronus.internetguys.ca ([65.110.12.179]:48827)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.100 (FreeBSD))

(envelope-from )

id 1wzxdC-000000006ZE-0AiT

for root@mail.nl2k.ab.ca;

Fri, 28 Aug 2026 08:32:43 -0600

DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=fsjmail.ca;

s=default; h=Content-Transfer-Encoding:Content-Type:MIME-Version:Message-ID:

Date:Subject:To:From:Reply-To:Sender:Cc:Content-ID:Content-Description:

Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:

In-Reply-To:References:List-Id:List-Help:List-Unsubscribe:List-Subscribe:

List-Post:List-Owner:List-Archive;

bh=dxAlClQ8y5Q6tq7CIaVd2aUcXb8te/l6Zzv1EN5B+eE=; b=tjBbYYaHyfpqFMJS1jvzWlP+3w

BoP0OgJRok5QhZzAXs/IG2Gne6XvLs/3s8VmN4m3To9hjs4p32TwiW2rk5YZGgZ6AA8FZ4c4uppBQ

8kZPfs/Z9uKSptIU/xiPQPa6tkLe9zWVeQIw/wM//nCrbg5UClM8i6j1fSfDRnEUUXAI=;

Received: from kd027084177035.ppp-bb.dion.ne.jp ([27.84.177.35]:11363)

by cronus.internetguys.ca with esmtpsa (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

(Exim 4.99.5)

(envelope-from )

id 1wzxcI-00000009pV9-21te

for root@mail.nl2k.ab.ca;

Fri, 28 Aug 2026 07:31:37 -0700

Reply-To: williamben5790@gmail.com

From: Mr. Cheng Saephan

To: root@mail.nl2k.ab.ca

Subject: DONATION FUNDS !!!

Date: 28 Aug 2026 07:31:33 -0700

Message-ID: <20260828073133.B65FCF7C23E304F4@fsjmail.ca>

MIME-Version: 1.0

Content-Type: text/plain;

charset="utf-8"

Content-Transfer-Encoding: quoted-printable

X-internetguys-MailScanner-Information: Please contact the ISP for more information

X-internetguys-MailScanner-ID: 1wzxcI-00000009pV9-21te

X-internetguys-MailScanner: Not scanned: please contact your Internet E-Mail Service Provider for details

X-internetguys-MailScanner-SpamCheck:

X-internetguys-MailScanner-From: wward2@fsjmail.ca

X-Spam-Status: No

X-AntiAbuse: This header was added to track abuse, please include it with any abuse report

X-AntiAbuse: Primary Hostname - cronus.internetguys.ca

X-AntiAbuse: Original Domain - mail.nl2k.ab.ca

X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12]

X-AntiAbuse: Sender Address Domain - fsjmail.ca

X-Get-Message-Sender-Via: cronus.internetguys.ca: authenticated_id: wward2@fsjmail.ca

X-Authenticated-Sender: cronus.internetguys.ca: wward2@fsjmail.ca

X-Source:

X-Source-Args:

X-Source-Dir:

X-Spam_score: 18.1

X-Spam_score_int: 181

X-Spam_bar: ++++++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Dear Winner My name is Mr. Cheng Saephan, the fortunate winner

of a $1.3 billion powerball jackpot in 2024. I am giving away funds to five

randomly selected individuals. If you have received this email, it means

[...]



Content analysis details: (18.1 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[27.84.177.35 listed in will-spam-for-food.eu.org]

[27.84.177.35 listed in will-spam-for-food.eu.org]

[27.84.177.35 listed in will-spam-for-food.eu.org]

[27.84.177.35 listed in will-spam-for-food.eu.org]

[27.84.177.35 listed in will-spam-for-food.eu.org]

[27.84.177.35 listed in will-spam-for-food.eu.org]

[27.84.177.35 listed in will-spam-for-food.eu.org]

[27.84.177.35 listed in will-spam-for-food.eu.org]

[65.110.12.179 listed in will-spam-for-food.eu.org]

[65.110.12.179 listed in will-spam-for-food.eu.org]

[65.110.12.179 listed in will-spam-for-food.eu.org]

[65.110.12.179 listed in will-spam-for-food.eu.org]

[65.110.12.179 listed in will-spam-for-food.eu.org]

[65.110.12.179 listed in will-spam-for-food.eu.org]

[65.110.12.179 listed in will-spam-for-food.eu.org]

[65.110.12.179 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[27.84.177.35 listed in dnsbl.ahbl.org]

[27.84.177.35 listed in dnsbl.ahbl.org]

[27.84.177.35 listed in dnsbl.ahbl.org]

[27.84.177.35 listed in dnsbl.ahbl.org]

[65.110.12.179 listed in dnsbl.ahbl.org]

[65.110.12.179 listed in dnsbl.ahbl.org]

[65.110.12.179 listed in dnsbl.ahbl.org]

[65.110.12.179 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[27.84.177.35 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[27.84.177.35 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[27.84.177.35 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[27.84.177.35 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_SBL_XBL RBL: Received via a relay in Spamhaus SBL+XBL

[27.84.177.35 listed in sbl-xbl.spamhaus.org]

1.5 RCVD_IN_CBL RBL: Received via a relay in cbl.abuseat.org

[Listed by XBL, see ]

-0.0 SPF_PASS SPF: sender matches SPF record

-0.0 SPF_HELO_PASS SPF: HELO matches SPF record

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

1.6 SUBJ_ALL_CAPS Subject is all capitals

0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in digit

[williamben5790(at)gmail.com]

3.1 DEAR_WINNER BODY: Spam with generic salutation of "dear winner"

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[65.110.12.179 listed in bl.score.senderscore.com]

0.7 TO_NO_BRKTS_FROM_MSSP Multiple formatting errors

0.0 LOTS_OF_MONEY Huge... sums of money

0.0 HK_NAME_MR_MRS No description available.

2.5 FREEMAIL_FORGED_REPLYTO Freemail in Reply-To, but not From

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

1.4 MONEY_NOHTML Lots of money in plain text

0.4 MONEY_FREEMAIL_REPTO Lots of money from someone using free email?

1.3 MONEY_FORM_SHORT Lots of money if you fill out a short form

0.0 T_FILL_THIS_FORM_SHORT Fill in a short form with personal information

0.4 FILL_THIS_FORM_FRAUD_PHISH Answer suspicious question(s)

0.0 T_FILL_THIS_FORM_FRAUD_PHISH Answer suspicious question(s)

2.0 ADVANCE_FEE_2_NEW_MONEY Advance Fee fraud and lots of money

Subject: {SPAM?} DONATION FUNDS !!!



Dear Winner



My name is Mr. Cheng Saephan, the fortunate winner of a $1.3=20

billion powerball jackpot in 2024. I am giving away funds to five=20

randomly selected individuals. If you have received this email,=20

it means you were chosen in the selection process. I have donated=20

a significant portion of my wealth to various charities, but due=20

to my deteriorating health and limited time, I have decided to=20

contribute $10 million to you as one of the chosen five. You can=20

verify my winnings by watching the video linked below.



Click here to watch:

https://youtu.be/YH0ZPmf9VEE?si=3DEeAtBhFkLwde1c-d



YOUR CODE IS: [0043035]



Please respond to this email with the code [0043035] at=20

williamben5790@gmail.com and provide your details below, and he=20

will assist you with the next steps for receiving your donation.



You are advised to send your details as stated below.

your Full name,

your Home address

your WhatsApp number

your Occupation

your ID Card



Contact My Personal Manager

Name: Mr. William Ben

WhatsApp Only :+1(754)207-5509

Email: williamben5790@gmail.com



I hope this brings joy to you and your family.



Best regards,

Mr. Cheng Saephan

Donation spam

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Fri, 28 Aug 2026 12:58:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.100 (FreeBSD))

(envelope-from )

id 1x01lc-000000002ih-3deA

for dave@doctor.nl2k.ab.ca;

Fri, 28 Aug 2026 12:57:32 -0600

Resent-From: The Doctor

Resent-Date: Fri, 28 Aug 2026 12:57:32 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from cronus.internetguys.ca ([65.110.12.179]:47107)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.100 (FreeBSD))

(envelope-from )

id 1wzxIV-000000002xD-41T3

for postmaster@nl2k.ab.ca;

Fri, 28 Aug 2026 08:11:21 -0600

DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=fsjmail.ca;

s=default; h=Content-Transfer-Encoding:Content-Type:MIME-Version:Message-ID:

Date:Subject:To:From:Reply-To:Sender:Cc:Content-ID:Content-Description:

Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:

In-Reply-To:References:List-Id:List-Help:List-Unsubscribe:List-Subscribe:

List-Post:List-Owner:List-Archive;

bh=dxAlClQ8y5Q6tq7CIaVd2aUcXb8te/l6Zzv1EN5B+eE=; b=hNOGHtaOogNzsWWQcBjY7QVPSw

CIet9zZCgraPDXG9J8tQL2KXGyCG+O+Y+jxiCS7GZctsn9/tkK2epUPo9tmXHv6ropBtxXaVF1rrd

y8Z3HmbmneG0XhR34IKCa6U8ShdWN23N1ISlx1IwmNTFBWCiMdAptx1EvaCnxHs/MVNA=;

Received: from kd027084177035.ppp-bb.dion.ne.jp ([27.84.177.35]:64025)

by cronus.internetguys.ca with esmtpsa (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

(Exim 4.99.5)

(envelope-from )

id 1wzxGu-00000009d1i-14PK

for postmaster@nl2k.ab.ca;

Fri, 28 Aug 2026 07:09:30 -0700

Reply-To: williamben5790@gmail.com

From: Mr. Cheng Saephan

To: postmaster@nl2k.ab.ca

Subject: DONATION FUNDS !!!

Date: 28 Aug 2026 07:09:23 -0700

Message-ID: <20260828070922.B8E4649384AA39E5@fsjmail.ca>

MIME-Version: 1.0

Content-Type: text/plain;

charset="utf-8"

Content-Transfer-Encoding: quoted-printable

X-internetguys-MailScanner-Information: Please contact the ISP for more information

X-internetguys-MailScanner-ID: 1wzxGu-00000009d1i-14PK

X-internetguys-MailScanner: Not scanned: please contact your Internet E-Mail Service Provider for details

X-internetguys-MailScanner-SpamCheck:

X-internetguys-MailScanner-From: wward2@fsjmail.ca

X-Spam-Status: No

X-AntiAbuse: This header was added to track abuse, please include it with any abuse report

X-AntiAbuse: Primary Hostname - cronus.internetguys.ca

X-AntiAbuse: Original Domain - nl2k.ab.ca

X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12]

X-AntiAbuse: Sender Address Domain - fsjmail.ca

X-Get-Message-Sender-Via: cronus.internetguys.ca: authenticated_id: wward2@fsjmail.ca

X-Authenticated-Sender: cronus.internetguys.ca: wward2@fsjmail.ca

X-Source:

X-Source-Args:

X-Source-Dir:

X-Spam_score: 18.1

X-Spam_score_int: 181

X-Spam_bar: ++++++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Dear Winner My name is Mr. Cheng Saephan, the fortunate winner

of a $1.3 billion powerball jackpot in 2024. I am giving away funds to five

randomly selected individuals. If you have received this email, it means

[...]



Content analysis details: (18.1 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[27.84.177.35 listed in will-spam-for-food.eu.org]

[27.84.177.35 listed in will-spam-for-food.eu.org]

[27.84.177.35 listed in will-spam-for-food.eu.org]

[27.84.177.35 listed in will-spam-for-food.eu.org]

[27.84.177.35 listed in will-spam-for-food.eu.org]

[27.84.177.35 listed in will-spam-for-food.eu.org]

[27.84.177.35 listed in will-spam-for-food.eu.org]

[27.84.177.35 listed in will-spam-for-food.eu.org]

[65.110.12.179 listed in will-spam-for-food.eu.org]

[65.110.12.179 listed in will-spam-for-food.eu.org]

[65.110.12.179 listed in will-spam-for-food.eu.org]

[65.110.12.179 listed in will-spam-for-food.eu.org]

[65.110.12.179 listed in will-spam-for-food.eu.org]

[65.110.12.179 listed in will-spam-for-food.eu.org]

[65.110.12.179 listed in will-spam-for-food.eu.org]

[65.110.12.179 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[27.84.177.35 listed in dnsbl.ahbl.org]

[27.84.177.35 listed in dnsbl.ahbl.org]

[27.84.177.35 listed in dnsbl.ahbl.org]

[27.84.177.35 listed in dnsbl.ahbl.org]

[65.110.12.179 listed in dnsbl.ahbl.org]

[65.110.12.179 listed in dnsbl.ahbl.org]

[65.110.12.179 listed in dnsbl.ahbl.org]

[65.110.12.179 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[27.84.177.35 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[27.84.177.35 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[27.84.177.35 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[27.84.177.35 listed in dnsbl.ahbl.org]

-0.0 SPF_PASS SPF: sender matches SPF record

-0.0 SPF_HELO_PASS SPF: HELO matches SPF record

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

1.5 RCVD_IN_SBL_XBL RBL: Received via a relay in Spamhaus SBL+XBL

[27.84.177.35 listed in sbl-xbl.spamhaus.org]

1.5 RCVD_IN_CBL RBL: Received via a relay in cbl.abuseat.org

[Listed by XBL, see ]

1.6 SUBJ_ALL_CAPS Subject is all capitals

0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in digit

[williamben5790(at)gmail.com]

3.1 DEAR_WINNER BODY: Spam with generic salutation of "dear winner"

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[65.110.12.179 listed in bl.score.senderscore.com]

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

0.7 TO_NO_BRKTS_FROM_MSSP Multiple formatting errors

0.0 LOTS_OF_MONEY Huge... sums of money

0.0 HK_NAME_MR_MRS No description available.

1.4 MONEY_NOHTML Lots of money in plain text

2.5 FREEMAIL_FORGED_REPLYTO Freemail in Reply-To, but not From

0.0 T_FILL_THIS_FORM_SHORT Fill in a short form with personal information

0.0 T_FILL_THIS_FORM_FRAUD_PHISH Answer suspicious question(s)

0.4 FILL_THIS_FORM_FRAUD_PHISH Answer suspicious question(s)

0.4 MONEY_FREEMAIL_REPTO Lots of money from someone using free email?

1.3 MONEY_FORM_SHORT Lots of money if you fill out a short form

2.0 ADVANCE_FEE_2_NEW_MONEY Advance Fee fraud and lots of money

Subject: {SPAM?} DONATION FUNDS !!!



Dear Winner



My name is Mr. Cheng Saephan, the fortunate winner of a $1.3=20

billion powerball jackpot in 2024. I am giving away funds to five=20

randomly selected individuals. If you have received this email,=20

it means you were chosen in the selection process. I have donated=20

a significant portion of my wealth to various charities, but due=20

to my deteriorating health and limited time, I have decided to=20

contribute $10 million to you as one of the chosen five. You can=20

verify my winnings by watching the video linked below.



Click here to watch:

https://youtu.be/YH0ZPmf9VEE?si=3DEeAtBhFkLwde1c-d



YOUR CODE IS: [0043035]



Please respond to this email with the code [0043035] at=20

williamben5790@gmail.com and provide your details below, and he=20

will assist you with the next steps for receiving your donation.



You are advised to send your details as stated below.

your Full name,

your Home address

your WhatsApp number

your Occupation

your ID Card



Contact My Personal Manager

Name: Mr. William Ben

WhatsApp Only :+1(754)207-5509

Email: williamben5790@gmail.com



I hope this brings joy to you and your family.



Best regards,

Mr. Cheng Saephan