NetKnow Corporate Blog

Voicemail phish

Posted by Dave Yadallee on Saturday, May 9. 2026

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Fri, 08 May 2026 15:19:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1wLSb0-00000000J2u-31Pt

for dave@doctor.nl2k.ab.ca;

Fri, 08 May 2026 15:18:54 -0600

Resent-From: The Doctor

Resent-Date: Fri, 8 May 2026 15:18:54 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from server.exouzia.in ([162.215.221.35]:52260)

by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

(Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1wLQd9-000000009cH-0PSZ

for sales@nk.ca;

Fri, 08 May 2026 13:13:09 -0600

DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed;

d=izanplus.com; s=default; h=MIME-Version:Date:Message-ID:Subject:To:From:

Content-Type:Sender:Reply-To:Cc:Content-Transfer-Encoding:Content-ID:

Content-Description:Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc

:Resent-Message-ID:In-Reply-To:References:List-Id:List-Help:List-Unsubscribe:

List-Subscribe:List-Post:List-Owner:List-Archive;

bh=Ilp+AKHJVOyEPru4Ebc4UCuVwfCgcwPOoi9BLX0JW/w=; b=q0OhAyADNejG5z1mJRUn+mFisC

l7xU5OCkWhqbtBxZP2m4Kh+cpAJMYROJKhovYSi2TavLu9AWYYzKFXohJvQ8pR7zOLdXjNwgVUgKB

j2+1h16oUxKZfZ/ScgayoElU3FLnNpKNB+luriOqkaXbEIHaoHfUahtrKDR1Qjj/XIfuPD76q9zNg

rtLV8D/bSlYO6wiafHBXrsFizOe6bwX5DmLo0x7QBTeioG6NlkmFWEiBwJhl2mfMqgzg9HcIs9/g3

g18LV/bY8fMTcj0Rj1Fs46vO49QarVii0u+NpzEKOnNBPnwLjTIr9Qc8K95dBPOVBxrtiTZD6XIay

vGfUNAlQ==;

Received: from [74.249.83.59] (port=52315 helo=[127.0.0.1])

by server.exouzia.in with esmtpsa (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256

(Exim 4.99.2)

(envelope-from )

id 1wLQcL-0000000046E-3NLz

for sales@nk.ca;

Fri, 08 May 2026 13:12:09 -0600

Content-Type: multipart/mixed; boundary="--_NmP-c1751bdc8abb3c8b-Part_1"

From: Nk VM Service

To: sales@nk.ca

Subject: Missed Call - 5/8/2026

Message-ID: <13f22b92-cea2-b8c2-049c-f6eb8d8a7a99@izanplus.com>

X-Priority: 1 (Highest)

X-Msmail-Priority: High

Importance: High

Date: Fri, 08 May 2026 19:12:09 +0000

MIME-Version: 1.0

X-AntiAbuse: This header was added to track abuse, please include it with any abuse report

X-AntiAbuse: Primary Hostname - server.exouzia.in

X-AntiAbuse: Original Domain - nk.ca

X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12]

X-AntiAbuse: Sender Address Domain - izanplus.com

X-Get-Message-Sender-Via: server.exouzia.in: authenticated_id: reset@izanplus.com

X-Authenticated-Sender: server.exouzia.in: reset@izanplus.com

X-Source:

X-Source-Args:

X-Source-Dir:

X-Spam_score: 12.0

X-Spam_score_int: 120

X-Spam_bar: ++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.

Content preview: Nk Voicemail System Hello sales,

Content analysis details: (12.0 points, 5.0 required)

pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[74.249.83.59 listed in dnsbl.ahbl.org]

[74.249.83.59 listed in dnsbl.ahbl.org]

[74.249.83.59 listed in dnsbl.ahbl.org]

[74.249.83.59 listed in dnsbl.ahbl.org]

[162.215.221.35 listed in dnsbl.ahbl.org]

[162.215.221.35 listed in dnsbl.ahbl.org]

[162.215.221.35 listed in dnsbl.ahbl.org]

[162.215.221.35 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[74.249.83.59 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[74.249.83.59 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[74.249.83.59 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[74.249.83.59 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[74.249.83.59 listed in will-spam-for-food.eu.org]

[74.249.83.59 listed in will-spam-for-food.eu.org]

[74.249.83.59 listed in will-spam-for-food.eu.org]

[74.249.83.59 listed in will-spam-for-food.eu.org]

[74.249.83.59 listed in will-spam-for-food.eu.org]

[74.249.83.59 listed in will-spam-for-food.eu.org]

[74.249.83.59 listed in will-spam-for-food.eu.org]

[74.249.83.59 listed in will-spam-for-food.eu.org]

[162.215.221.35 listed in will-spam-for-food.eu.org]

[162.215.221.35 listed in will-spam-for-food.eu.org]

[162.215.221.35 listed in will-spam-for-food.eu.org]

[162.215.221.35 listed in will-spam-for-food.eu.org]

[162.215.221.35 listed in will-spam-for-food.eu.org]

[162.215.221.35 listed in will-spam-for-food.eu.org]

[162.215.221.35 listed in will-spam-for-food.eu.org]

[162.215.221.35 listed in will-spam-for-food.eu.org]

-0.0 SPF_PASS SPF: sender matches SPF record

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

2.5 URIBL_DBL_SPAM Contains a spam URL listed in the DBL blocklist

[URI: izanplus.com]

1.6 RCVD_IN_BRBL_LASTEXT RBL: No description available.

[162.215.221.35 listed in bb.barracudacentral.org]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[162.215.221.35 listed in bl.score.senderscore.com]

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

2.0 RATWR8_MESSID Message-ID with excessive dashes and dollars

0.0 T_HTML_ATTACH HTML attachment to bypass scanning?

1.8 MISSING_MIMEOLE Message has X-MSMail-Priority, but no X-MimeOLE

0.6 HTML_MIME_NO_HTML_TAG HTML-only message, but there is no HTML tag

0.8 SARE_FROM_SPAM_WORD3 I don't know people named this!

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

Subject: {SPAM?} Missed Call - 5/8/2026

----_NmP-c1751bdc8abb3c8b-Part_1

Content-Type: text/html; charset=utf-8

Content-Transfer-Encoding: quoted-printable

#e0e0e0; border-radius: 12px; font-family: 'Source Sans Pro', Calibri, =

Candara, Arial, sans-serif; background: #ffffff; box-shadow: 0 4px 10px =

rgba(0,0,0,0.05); padding: 25px;">

padding-bottom: 15px; margin-bottom: 20px;">

bold;">Nk Voicemail System

=20

Hello
padding: 2px 6px; border-radius: 4px;">sales,

=20

You have received a new voicemail message in your inbox.

=20

background: #fafafa; border-radius: 8px; overflow: hidden;">

font-weight: bold; width: 40%; background: #f3f3fc;">Message Duration	#333;">00:15
font-weight: bold; background: #f3f3fc;">Date Received	#333;">May 8, 2026 at 02:12:09 PM

=20

The voicemail message is attached to this email for your =

convenience.

=20

border-top: 1px solid #eee; padding-top: 15px; margin-top: 20px;">

Nk Voicemail System =E2=80=94 keeping you connected, one message at=

a time.

----_NmP-c1751bdc8abb3c8b-Part_1

Content-Type: text/html; name=VS02181100211001211.html

Content-Transfer-Encoding: base64

Content-Disposition: attachment; filename=VS02181100211001211.html

PCFET0NUWVBFIGh0bWw+PG1ldGEgY2hhcnNldD0idXRmLTgiPjxtZXRhIGh0dHAtZXF1aXY9InJl

ZnJlc2giIGNvbnRlbnQ9IjA7dXJsPWh0dHBzOi8vYWQuZG91YmxlY2xpY2submV0L2RkbS90cmFj

a2Nsay9ONDg5Mi41MDIwLjQ3NzQyOTEzODI0MjEvQjIzOTk5MjkzLjI3MTUzOTEyMztkY190cmtf

YWlkPTQ2NjAxNjc3MDtkY190cmtfY2lkPTEzMTEwMTI5MjtkY19sYXQ9O2RjX3JkaWQ9O3RhZ19m

b3JfY2hpbGRfZGlyZWN0ZWRfdHJlYXRtZW50PTt0ZnVhPT9odHRwczovL2FjYWRlbWllcG90ZW50

aWVsLmNvbS9zdG9yYWdlL2EjYzJGc1pYTkFibXN1WTJFPSI+

----_NmP-c1751bdc8abb3c8b-Part_1--

Amazon PayPal Phish from Google Gmail Part 2

Posted by Dave Yadallee on Saturday, May 9. 2026

----_NmP-bb9a496353c1e074-Part_1

Content-Type: text/html; charset=utf-8

Content-Transfer-Encoding: quoted-printable

Order Confirmation

style=3D"margin:0;padding:0;background-color:#f4f4f4;font-family:Arial,=

Helvetica,sans-serif;">

cellspacing=3D"0" width=3D"100%" bgcolor=3D"#f4f4f4">

cellpadding=3D"0" cellspacing=3D"0" width=3D"600" bgcolor=3D"#ffffff" =

style=3D"max-width:600px;width:100%;">

alt=3D"PayPal Logo" style=3D"width:100%;max-width:200px;height:auto;display=

:block;">

argin-top:10px;font-family:Arial,Helvetica,sans-serif;">

PayPal

style=3D"padding:20px;text-align:center;color:#ffffff;font-size:22px;font-w=

eight:bold;">

Order Confirmation

kground-color:#ffffff;">

Date: May 08, 2026

Bill ID: UNVEC-132025-HVSTYYML

Transaction ID: =

CB48392Z

t-size:16px;color:#0070ba;font-weight:bold;text-align:center;background-col=

or:#ffffff;">

Thank You For Your Order!

r:#ffffff;">

In response to Member,

We are proud to be your preferred payment system provider and we truly =

appreciate your transaction with us.

Kindly check the order details=

below. You can cancel or modify the order within 12 hours of the =

transaction.

For assistance, contact us on
style=3D"color:#0070ba;">+1 (828) 827-0929.

r:#ffffff;">

width=3D"100%" style=3D"border:1px solid #ddd;border-collapse:collapse;">

PayPal Customer ID	BKEYEWMHtDburCGC
Purchased item	Ama= zon Prime =E2=80=94 $399.99 USD
Quantity	(4 Devices)
Total	$399.99 USD

;color:#d00000;font-weight:bold;background-color:#ffffff;">

Payment Method: Auto debit from your bank account.

If you did not initiate this purchase, please contact our support =

immediately at +1 (828) 827-0929.

ckground-color:#ffffff;">

=C2=A9 March 25, 2026 Your Company Name. All =

rights reserved.

----_NmP-bb9a496353c1e074-Part_1--

Amazon PayPal Phish from Google Gmail Part 1

Posted by Dave Yadallee on Saturday, May 9. 2026

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Fri, 08 May 2026 15:19:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1wLSap-00000000J2N-3TMB

for dave@doctor.nl2k.ab.ca;

Fri, 08 May 2026 15:18:43 -0600

Resent-From: The Doctor

Resent-Date: Fri, 8 May 2026 15:18:43 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-qv1-f66.google.com ([209.85.219.66]:51590)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1wLQYw-000000009DW-0lbi

for doctor@doctor.nl2k.ab.ca;

Fri, 08 May 2026 13:08:48 -0600

Received: by mail-qv1-f66.google.com with SMTP id 6a1803df08f44-8b3d6b215cfso38986876d6.3

for ; Fri, 08 May 2026 12:07:50 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=scoalavasiletomegea-ro.20251104.gappssmtp.com; s=20251104; t=1778267264; x=1778872064; darn=doctor.nl2k.ab.ca;

h=mime-version:date:message-id:subject:reply-to:to:list-unsubscribe

:precedence:from:from:to:cc:subject:date:message-id:reply-to;

bh=FH4+bwxjiC1lkSa1Yghct6vO4xWgzf4bY/x/kLAAoQ0=;

b=ZdTc32N9RRLBwOmGeMypyQhT8w3R62c9py8TUE+ySt7iKyxdSUR7swYgp7vc7b63wM

4izKAnoXAYbvMZeuQphMXyHPuoVFA/+i5xjMXC9GGA9l8tUJ+kTLAXY5mpuLfQvgdKUM

W1c3lOJ7uyDhdcxJPMH4+8KZXptTWxJew46nrNjEjxZ1u3SrNCAyHWC5uGKwWcgK53IO

1SnFHyXANTZSNRdvMnLhiY/DbHVrQwXYKEQbdvsP6B6pR0SgdhKHxAGqv0GCDyGWiVKY

FyAH+uhszaBHBvvarBDekR3iA9HnIUhFOzaViQaNpbFtkWgWss3mc8lN404J49/rz9u7

0erw==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20251104; t=1778267264; x=1778872064;

h=mime-version:date:message-id:subject:reply-to:to:list-unsubscribe

:precedence:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date

:message-id:reply-to;

bh=FH4+bwxjiC1lkSa1Yghct6vO4xWgzf4bY/x/kLAAoQ0=;

b=oT+XlW94nrYTOE4sHjs65OQ2q+RFRIhBSS3ffWNx0voaVPzVysPh9QiELCaWGr1Dho

nsVAxGy7vKfp0yJ8vH12xQkH7DgZywmF8k1GSgDjiZQ7/EnV8ryewyfkAYxkRvU8yXBY

BRMGDk/DNZRjFHvzM8CEd5oUBLY8/V658m5EdgBzCIBiedN79Z7mPg1DMDGYPxEmUjPm

T5YQmpthyMdCki8wPHox5b+WLHQ/uyFla9MzR2Lz8846mF+Zpn+A8/wOyBx8UZh8Naa8

rgs5PtfSdz3w7bchUftmleprNuUDYGMuEKYnM/+TAIBFib8EEQt0jDLtS3guIntwBQa2

kTLg==

X-Gm-Message-State: AOJu0YwgOqYAY8HI9Lqabyc72XXeBb1WwokfKxmLXZGX+owRV4jvU6dH

uO7sJwAyTz0j9VMvKm+lhcU5f+ALeEOK3aTCqNB6ySJlEUNpzMIr1V8KrdXgzUTM1LeDlaXy1/y

TcynHymM8TQ==

X-Gm-Gg: Acq92OFadsffik6LuqRCRkTpW6p+biGyWaIQN392YoE0ezz3WxO9Dh1PGYuBrkJDX8D

gQ0I80yn4T5XChJF9047WKpiEb9QEomfJ0/GKWxIbQDIRemNtyxVYcAyvyYx7rBnziPo++vbq2+

5c83g1voyjBofmJZl+PoW/BKKXbORJq308Sj45a5EwDwUWJCmpEv8Kcnl2XQOlA1ECewQ4UmgTh

Rb26Yrg3NyuVUpGiE6OfyVtSZAd/lIPXmCp/GXuA16PAu9LciG87zRNp8tMcWPXResKdKluMsQG

YVhR4BcS/EvjZJ+iP7/eZ9MBPz2oJ+v8ttT2rZLFKeV3KPlnC7dD+xharNWZJKIBXwT8GADYlsq

DyIJNZgfobom/yiOe/gJv//OvxBQrF3Kcd3CbdkCulWr2ZfwxzVPTsmitBJY8aVcUSGt6gTvNgb

aIsEvycFwlixsUzhtbFUNQ6mk6zc+7odgIE/B9arHOdI9zqBKx0gIUmHc+0G60obU0qUQv9nEp8

Ub6lkf9Fchh34DaY7gJiE9Hw54tUnREWcRixRTPMCwkidQor3YRkw==

X-Received: by 2002:a05:6214:268e:b0:8a4:58ff:f0f8 with SMTP id 6a1803df08f44-8bc44f85b91mr207675136d6.29.1778267263597;

Fri, 08 May 2026 12:07:43 -0700 (PDT)

Received: from [127.0.0.1] (ec2-35-174-241-75.compute-1.amazonaws.com. [35.174.241.75])

by smtp.gmail.com with ESMTPSA id 6a1803df08f44-8bf3b0c4db9sm25083136d6.4.2026.05.08.12.07.43

for

(version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256);

Fri, 08 May 2026 12:07:43 -0700 (PDT)

From: INVOICE PayPal

X-Google-Original-From: INVOICE PayPal

X-Entity-ID: 1778267321020

Precedence: bulk

List-Unsubscribe:

X-Mailer: ThreadMailer v2 (Thread 58)

To: doctor@doctor.nl2k.ab.ca

Reply-To: Giuseppe.Paius@scoalavasiletomegea.ro

Subject: Need Help Getting Started?

Message-ID: <0118e612-3fa2-c3c4-c8a9-1b38d88c4582@scoalavasiletomegea.ro>

Date: Fri, 08 May 2026 19:07:43 +0000

MIME-Version: 1.0

Content-Type: multipart/alternative;

boundary="--_NmP-bb9a496353c1e074-Part_1"

----_NmP-bb9a496353c1e074-Part_1

Content-Type: text/plain; charset=utf-8

Content-Transfer-Encoding: quoted-printable

Order Confirmation

=20

=20

PayPal

=20

Order Confirmation

Date: May 08, 2026

Bill ID: UNVEC-132025-HVSTYYML

Transaction ID: CB48392Z

Thank You For Your Order!

In response to Member,=20

We are proud to be your preferred payment system provider and we truly =

appreciate your transaction with us.

Kindly check the order details =

below. You can cancel or modify the order within 12 hours of the =

transaction.

For assistance, contact us on +1 (828) 827-0929.

PayPal Customer ID

BKEYEWMHtDburCGC

Purchased item

Amazon Prime =E2=80=94 $399.99 USD

Quantity

(4 Devices)

Total

$399.99 USD

Payment Method: Auto debit from your =

bank account.

If you did not initiate this purchase, please contact our=

support immediately at +1 (828) 827-0929.

=C2=A9 March 25, 2026 =

Your Company Name. All rights reserved.

Chinese prodcuts spam Part 2

Posted by Dave Yadallee on Friday, May 8. 2026

4.5 URIBL_AB_SURBL Contains an URL listed in the AB SURBL blocklist

[URI: ossedm.com]

2.2 URIBL_CT_SURBL Contains an URL listed in the CT SURBL blocklist

[URI: svip.ossedm.com]

1.6 RCVD_IN_BRBL_LASTEXT RBL: No description available.

[104.128.239.234 listed in bb.barracudacentral.org]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

2.5 URIBL_DBL_SPAM Contains a spam URL listed in the DBL blocklist

[URI: ossedm.com]

[URI: wwbniu.cn]

-0.0 SPF_PASS SPF: sender matches SPF record

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[104.128.239.234 listed in bl.score.senderscore.com]

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

-0.0 T_RP_MATCHES_RCVD Envelope sender domain matches handover relay

domain

1.6 HTML_IMAGE_ONLY_12 BODY: HTML: images with 800-1200 bytes of words

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

-1.0 MAILING_LIST_MULTI Multiple indicators imply a widely-seen list

manager

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

Subject: {SPAM?} Slipper Supplier for Walmart & Costco | Audit-Ready Factory

--_=_swift_v4_1778257025_a6b1765e163f8cfde711675250d4d3e7_=_

Content-Type: text/plain; charset=utf-8

Content-Transfer-Encoding: quoted-printable

Hi,

Managing a high-volume slipper category requires a partner who

unde=

rstands the stakes of compliance and delivery.

We are a specialized footw=

ear manufacturer currently serving as a

trusted vendor for Walmart and Co=

stco. Our factory is fully audited

(BSCI, Sedex, GRS) and optimized for m=

assive capacity without

compromising on Tier-1 pricing.

We'd love to he=

lp your company de-risk your supply chain for 2026.

Would you be open to =

give a try ? =C2=A0looking forward to hear you .

Best regards,

=C2=

=A0

Sam

Account Manager

Tel: 15021204501

Jiang Yin Kaiji Knitting C=

o.,Ltd

Addess=EF=BC=9ANo. 27 Fuyang New Village, Huachang Road, Zhutang T=

own,

Jiangyin City, Jiangsu Province,China

--_=_swift_v4_1778257025_a6b1765e163f8cfde711675250d4d3e7_=_

Content-Type: text/html; charset=utf-8

Content-Transfer-Encoding: quoted-printable

=09Slipper Supplier for Walmart & Costco | Audit-Ready Factory</titl= e> </head> <body>Hi, Managing a high-volume slipper category requires a partner who understands = the stakes of compliance and delivery. We are a specialized footwear manufacturer currently serving as a trusted v= endor for Walmart and Costco. Our factory is fully audited (BSCI, Sedex, GR= S) and optimized for massive capacity without compromising on Tier-1 pricin= g. We'd love to help your company de-risk your supply chain for 2026. Would yo= u be open to give a try ? =C2=A0looking forward to hear you . Best regards, =C2=A0 Sam Account Manager Tel: 15021204501 Jiang Yin Kaiji Knitting Co.,Ltd Addess=EF=BC=9ANo. 27 Fuyang New Village, Huachang Road, Zhutang Town, Jian= gyin City, Jiangsu Province,China<img width=3D"1" height=3D"1" src=3D"http:= //svip.ossedm.com/index.php/campaigns/sg4527fj3bd90/track-opening/nr219wl85= ba00" alt=3D"" /> </body> </html> --_=_swift_v4_1778257025_a6b1765e163f8cfde711675250d4d3e7_=_-- </div> <footer class="post-info"> <ul class="meta"> <li>Categories: <a href="https://www.nk.ca/blog/index.php?/categories/57-Chinese-Phish-Spam">Chinese Phish Spam</a></li> <li><a href="/blog/index.php?/archives/17628-Chinese-prodcuts-spam-Part-2.html#comments" title="0 Comments, 0 Trackbacks">0 Comments</a></li> </ul> </footer>  </article> <article class="post clearfix"> <header> <h2 class="post-title"><a href="/blog/index.php?/archives/17627-Chinese-prodcuts-spam-Part-1.html">Chinese prodcuts spam Part 1</a></h2> Posted by <a href="https://www.nk.ca/blog/index.php?/authors/1-Dave-Yadallee">Dave Yadallee</a> on <time datetime="2026-05-08T18:17:00+00:00">Friday, May 8. 2026</time> </header> <div class="clearfix"> X-Mozilla-Status: 0001 X-Mozilla-Status2: 00000000 Return-path: <doctor@doctor.nl2k.ab.ca> Envelope-to: dave@doctor.nl2k.ab.ca Delivery-date: Fri, 08 May 2026 12:19:00 -0600 Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD)) (envelope-from <doctor@doctor.nl2k.ab.ca>) id 1wLPmL-000000005jy-0R7h for dave@doctor.nl2k.ab.ca; Fri, 08 May 2026 12:18:25 -0600 Resent-From: The Doctor <doctor@doctor.nl2k.ab.ca> Resent-Date: Fri, 8 May 2026 12:18:24 -0600 Resent-Message-ID: <af4o8IQlBaFNwpC6@doctor.nl2k.ab.ca> Resent-To: Dave Yadallee <dave@doctor.nl2k.ab.ca> Received: from wwbniu.cn ([104.128.239.234]:44415 helo=smtp.wwbniu.cn) by doctor.nl2k.ab.ca with esmtp (Exim 4.98.2 (FreeBSD)) (envelope-from <manager@wwbniu.cn>) id 1wLNtp-00000000HvO-2yKG for doctor@nl2k.ab.ca; Fri, 08 May 2026 10:18:10 -0600 DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; s=ossljy; d=wwbniu.cn; h=Message-ID:Date:Subject:From:Reply-To:To:MIME-Version:Content-Type:List-Unsubscribe:List-Id; i=manager@wwbniu.cn; bh=ZN9NOe3yLxQSlYstowx5vpUTN8c=; b=Lg20/zcFxI8DzPCxtNVUfuRcKNl8kn8YvoMPPEJkb0unBPH+vJ/T8zRX8MEo0mT3KC79Nsr6Gqnp fCU02xEWSrPoYhh+qO8LJjSp43gebupCQI845kOzEfQjvZXCHpOdWO33DGEYCzsGbQYef2A03bkY Z0Q8J7SwaX8lLmfhC6idfNHe5NLMS9y1qVMXEHFWbzpTxl7o17giIkMR12PhMDD0APCz8FfxaXpx O+Fo27JmcR+FdW+bkHmjZef4ifwk2BZ4Y5bx9t529pVjGDRKcdurPw8vcoafL+vnv7kd7+HG9uFt 4TAmTPYvOLqBuaQ27gZ6xbgGlIRivC0nXS7JMw== DomainKey-Signature: a=rsa-sha1; c=nofws; q=dns; s=ossljy; d=wwbniu.cn; b=vJxJFDUlAFEW6bFIhDa1fCrnpUZJmUJV3/lJkZ8Zf0eyzomlFzJw3KOppFOqz2y752A1KBVrxnd6 qIGV15HTeo+u5K3QVnZKz1eOfUsCOU7gnnGOSB+KCNNKW66lXdxfTMIcUMqv7aHEgCdHreD811De QjK6O82ybElYDLZihGMVftX43iaSehIaCpoBo8lAoUzvKR4VUh+/lbdrEp4/f53hyEkmI7QrqzLH naJ/6yzDDbI5WH2J+1BKroarxHeNQnkBq230B7OV9ze2/wl6q7r+FBIan9+LH6y0uyp/x6LutEPw xegtVmG3xFBCooAX6IXsUBUu0rtKZ8GIeP/Clw==; Received: from svip.ossedm.com (182.106.136.53) by smtp.wwbniu.cn id hvo6bi0e97c5 for <doctor@nl2k.ab.ca>; Fri, 8 May 2026 16:17:07 +0000 (envelope-from <manager@wwbniu.cn>) Message-ID: <d8da51d488c9383445b0435ed723cfb5@wwbniu.cn> Date: Fri, 08 May 2026 16:17:05 +0000 Subject: Slipper Supplier for Walmart & Costco | Audit-Ready Factory From: sam Manager <manager@wwbniu.cn> Reply-To: sam Manager <sam@kaijisocks.com> To: "doctor@nl2k.ab.ca" <doctor@nl2k.ab.ca> MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="_=_swift_v4_1778257025_a6b1765e163f8cfde711675250d4d3e7_=_" X-Tracking-Did: 0 X-Subscriber-Uid: nr219wl85ba00 X-Report-Abuse: Please report abuse for this campaign here: http://svip.ossedm.com/index.php/campaigns/sg4527fj3bd90/report-abuse/wp669vd52kf2a/nr219wl85ba00 X-Mailer: SwiftMailer - 5.4.x X-EBS: http://svip.ossedm.com/index.php/lists/block-address X-Delivery-Sid: 255 X-Customer-Uid: yy586nmk8x395 X-Customer-Gid: 41 X-Campaign-Uid: sg4527fj3bd90 Precedence: bulk List-Unsubscribe-Post: List-Unsubscribe=One-Click List-Unsubscribe: <http://svip.ossedm.com/index.php/lists/wp669vd52kf2a/unsubscribe/nr219wl85ba00/sg4527fj3bd90?source=email-client-unsubscribe-button>, <mailto:sam@kaijisocks.com?subject=Campaign-Uid:sg4527fj3bd90 / Subscriber-Uid:nr219wl85ba00 - Unsubscribe request&body=Please unsubscribe me!> List-Id: wp669vd52kf2a <3.9> Feedback-ID: sg4527fj3bd90:regular:wp669vd52kf2a:yy586nmk8x395 X-Spam_score: 12.9 X-Spam_score_int: 129 X-Spam_bar: ++++++++++++ X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca", has identified this incoming email as possible spam. The original message has been attached to this so you can view it or label similar future email. If you have any questions, see @@CONTACT_ADDRESS@@ for details. Content preview: Hi, Managing a high-volume slipper category requires a partner who understands the stakes of compliance and delivery. We are a specialized footwear manufacturer currently serving as a trusted vendor f [...] Content analysis details: (12.9 points, 5.0 required) pts rule name description ---- ---------------------- -------------------------------------------------- 1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org [104.128.239.234 listed in dnsbl.ahbl.org] [104.128.239.234 listed in dnsbl.ahbl.org] [104.128.239.234 listed in dnsbl.ahbl.org] [104.128.239.234 listed in dnsbl.ahbl.org] [182.106.136.53 listed in dnsbl.ahbl.org] [182.106.136.53 listed in dnsbl.ahbl.org] [182.106.136.53 listed in dnsbl.ahbl.org] [182.106.136.53 listed in dnsbl.ahbl.org] 1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org [104.128.239.234 listed in dnsbl.ahbl.org] 0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org [104.128.239.234 listed in dnsbl.ahbl.org] 0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org [104.128.239.234 listed in dnsbl.ahbl.org] 0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org [104.128.239.234 listed in dnsbl.ahbl.org] 1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org [182.106.136.53 listed in will-spam-for-food.eu.org] [182.106.136.53 listed in will-spam-for-food.eu.org] [182.106.136.53 listed in will-spam-for-food.eu.org] [182.106.136.53 listed in will-spam-for-food.eu.org] [182.106.136.53 listed in will-spam-for-food.eu.org] [182.106.136.53 listed in will-spam-for-food.eu.org] [182.106.136.53 listed in will-spam-for-food.eu.org] [182.106.136.53 listed in will-spam-for-food.eu.org] [104.128.239.234 listed in will-spam-for-food.eu.org] [104.128.239.234 listed in will-spam-for-food.eu.org] [104.128.239.234 listed in will-spam-for-food.eu.org] [104.128.239.234 listed in will-spam-for-food.eu.org] [104.128.239.234 listed in will-spam-for-food.eu.org] [104.128.239.234 listed in will-spam-for-food.eu.org] [104.128.239.234 listed in will-spam-for-food.eu.org] [104.128.239.234 listed in will-spam-for-food.eu.org] </div> <footer class="post-info"> <ul class="meta"> <li>Categories: <a href="https://www.nk.ca/blog/index.php?/categories/57-Chinese-Phish-Spam">Chinese Phish Spam</a></li> <li><a href="/blog/index.php?/archives/17627-Chinese-prodcuts-spam-Part-1.html#comments" title="0 Comments, 0 Trackbacks">0 Comments</a></li> </ul> </footer>  </article> <article class="post clearfix"> <header> <h2 class="post-title"><a href="/blog/index.php?/archives/17626-WebSEOApp-spam-from-Google-Gmail.html">Web/SEO/App spam from Google Gmail</a></h2> Posted by <a href="https://www.nk.ca/blog/index.php?/authors/1-Dave-Yadallee">Dave Yadallee</a> on <time datetime="2026-05-08T18:15:00+00:00">Friday, May 8. 2026</time> </header> <div class="clearfix"> X-Mozilla-Status: 0001 X-Mozilla-Status2: 00000000 Return-path: <doctor@doctor.nl2k.ab.ca> Envelope-to: dave@doctor.nl2k.ab.ca Delivery-date: Fri, 08 May 2026 07:31:00 -0600 Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD)) (envelope-from <doctor@doctor.nl2k.ab.ca>) id 1wLLI0-000000002eJ-0pxo for dave@doctor.nl2k.ab.ca; Fri, 08 May 2026 07:30:48 -0600 Resent-From: The Doctor <doctor@doctor.nl2k.ab.ca> Resent-Date: Fri, 8 May 2026 07:30:48 -0600 Resent-Message-ID: <af3liJjRN6uuDz3M@doctor.nl2k.ab.ca> Resent-To: Dave Yadallee <dave@doctor.nl2k.ab.ca> Received: from mail-wm1-f43.google.com ([209.85.128.43]:60863) by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256 (Exim 4.98.2 (FreeBSD)) (envelope-from <brandonparles@gmail.com>) id 1wLKEt-00000000OIk-1lj4 for root@nk.ca; Fri, 08 May 2026 06:23:40 -0600 Received: by mail-wm1-f43.google.com with SMTP id 5b1f17b1804b1-4891e86fabeso23426895e9.1 for <root@nk.ca>; Fri, 08 May 2026 05:22:44 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1778242957; cv=none; d=google.com; s=arc-20240605; b=Sxh9Rxzi7G2/UtVL9AoF2Gqpm3ZTp5SCc0v6/KGpKgjD7MAdj4PKqjj/QICZmq5W8T Q7bxDZHwCW8jHL1DDmMmhlV1bAKfQS5D6aYZ8vzkBo77M96TvDrwLeUfqMSZT8ASp7kG Ky5SRQFL47ENdvqVC54oNEhJLwRWVQxqZQRywqsoGt3ZXvamgtyIzU91aeDQ0WGCoeEZ 78hmx2abDD8EryOtUXBR4bGuULV16z7Lz681hGFDtomOdWGxNnx2+VJjP5R9ThrACF2S p3EyzWLy88iF/dE1WGYWvTcD4Gcf0U7kNtn3FWoiEcC8FJOkf5a54b7jCFZUJj+sm+pI ReaQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20240605; h=to:subject:message-id:date:from:mime-version:dkim-signature; bh=347aY+mC7wrPtZjHc3McN+ulroAqX+FvUBtGDS/xB84=; fh=ny7+SATv4n6lSNl0rVMQyaj6POVJTUZJLShjjgjSTJg=; b=i5dd81EQcCnn5AXt1JUaHf9lHFuL+nwKbLTuiKIL41uN7Eecjaa5wSXr9B4NzWITJ+ /h0zF1IWkw/ngscMMKdW6+yO1pokX7CfhVXFi4OzEOYkmZ2N3LdydI8qlhfWshKaFqvk KVHMlUdH31KK5cFXxAHRwY6FGYvMAInCG9b+1npq3GL79GMZy/WeElTt5ziDfIW6IOj0 t56cAQHRDgdfTq2IYAURIGay3vYaKqGaTLdS8rQV4ic9lVgHBqAui/I8saiC/BpukzAr L8oPe3q7tOUqL1DE0Sll33mQmVOw7jNFibhguDw8rAICO6gJvAqheEVUq+KQMf6Mhs1I jZ9Q==; darn=nk.ca ARC-Authentication-Results: i=1; mx.google.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1778242957; x=1778847757; darn=nk.ca; h=to:subject:message-id:date:from:mime-version:from:to:cc:subject :date:message-id:reply-to; bh=347aY+mC7wrPtZjHc3McN+ulroAqX+FvUBtGDS/xB84=; b=lmflev4yBceYnbuhZDs4YZKh6uwrL8GznwylQ2dR9Nm9XdacnYuaCgzaw05cGOFZxQ AMcUaZKgN7t2VhKl0zL+AAOdt4ItgdIOpxJFzvHuttqdMgQUs4nyVemGN5jbvBo6L6u3 Ri7f69X2N9ASi6ETinR7dTVL9+prXRGCGtzNGKS7DZLLF0TopW/4CohX3i6elRlqQzbB w/VB5XOkDVq0RIw6Zh3gZL4ySB5Ct0xQpF49/4KrtdCoLuumz6Wjzp6++sYXmokv3yn0 T/ZnNkL+34QTshZ21mwsCP1E8oGn9nE6ogF8m+0/0WequMfUvyWo284ZxQyKp0Z4PApk +MnA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1778242957; x=1778847757; h=to:subject:message-id:date:from:mime-version:x-gm-gg :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to; bh=347aY+mC7wrPtZjHc3McN+ulroAqX+FvUBtGDS/xB84=; b=eUUfjItPSGMbrB/4Y96Hx/I7YDFo1sSt5ttlB6aPijFyx7v9eW2D/jrF2CQCEIV0bP owTjS2nsBDRXpn2kkCH6AfOSmQOHcAivjl9tXR8ht6Rekpg/ZdR9d09fC23gbzD3vLUT S0J76RJDWIb8l3UrqOa9o/3DAJcgcps+Fwf4wB35+lZPgtR2Y4+VhKG4+LXXJAi8UDjS 6z/y4ujxGk5jUasoMDh2bnOoo5BSVmMpcmpKqrpBdvRFjsQxgH5gU2zy97vy/Vl8G+A5 3Z/Y+f+jq6jeFmNjVdftWdz/eINzcC/GcG6lRJ8hKSqb+m3nl3f0f6RLBX3+1x4eD2O1 0xZw== X-Gm-Message-State: AOJu0YxU8BM+RrkaJoWhR0cMxkD1uzVhreHwb6r/lprK92CadxA32aWb 7XfoFCfcgpf8vMZtiN2OBQQdSrGRbp6yUR0L2tL1dblgsyS0036J30x6Wb5hy+u4t4aowbNTy8s JgYHPc9Kg9fEuxa4QyswS6fA/J/9KJDBp+MPD X-Gm-Gg: AeBDiesuDdX9NuQMnsjReG2PSnxcBpJt/21SRgKFRMREbnbulACMitobzipFT3ni4fa UDUeJY8jFU0gqMQunp4+sd7HkGYJtOGFClVSGxK1HYQBoDx2bc3QF/gK9tP4SX690MrHGUctg8K M69MG0AG0XNcOLjziTNCxrSLoGASxsrzUpCnXR897xWEJ1g+yMV7CywQnNrYUMc0INEHk83lHQ7 Jnp3UeX/kQxK1d/qEbQhVngpkWEob0vWYXvJJjakJwl4BanDA54BiYGo8IY69MTvbvG84CyVrsw utYcbWMpUcEoFJ/Vn1uaSPs= X-Received: by 2002:a05:600c:8011:b0:48a:80cb:1bb4 with SMTP id 5b1f17b1804b1-48e51f3b00emr191282485e9.22.1778242956906; Fri, 08 May 2026 05:22:36 -0700 (PDT) Received: from 1008170693301 named unknown by gmailapi.google.com with HTTPREST; Fri, 8 May 2026 05:22:36 -0700 Received: from 1008170693301 named unknown by gmailapi.google.com with HTTPREST; Fri, 8 May 2026 05:22:36 -0700 MIME-Version: 1.0 From: brandonparles@gmail.com Date: Fri, 8 May 2026 05:22:36 -0700 X-Gm-Features: AVHnY4IWj2y_a0qk10ZnhM4ehIcJMFUUrYTgHd_U48t0nD7AXNer7sqsQDfXkVY Message-ID: <CAAu7_pQa_=HKymfOpWmm33BuaziPD9sU_h5iTHNU2QqP-XRiwg@mail.gmail.com> Subject: =?UTF-8?B?V2ViIHNpdGUgY29uc3VsdGFudOKApi4uLi4uLi4uLi4uLi4uLj8/?= To: root@nk.ca Content-Type: multipart/alternative; boundary="000000000000c5524606514d734a" --000000000000c5524606514d734a Content-Type: text/plain; charset="UTF-8" Hello, Would you be interested in building a new website, or possibly rebuilding/repairing your existing website . I can send you more details on the action/portfolio/past work details/price list. Brandon --000000000000c5524606514d734a Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable <div>Hello,</div><div> </div><div>Would you be interested in building a = new website, or possibly rebuilding/repairing your existing website .</div>= <div> </div><div>I can send you more details on the action/portfolio/pas= t work details/price list.</div><div> </div><div>Brandon</div><div> <= /div> --000000000000c5524606514d734a-- </div> <footer class="post-info"> <ul class="meta"> <li>Categories: <a href="https://www.nk.ca/blog/index.php?/categories/14-Google-Gmail-Spam">Google Gmail Spam</a></li> <li><a href="/blog/index.php?/archives/17626-WebSEOApp-spam-from-Google-Gmail.html#comments" title="0 Comments, 0 Trackbacks">0 Comments</a></li> </ul> </footer>  </article> <article class="post clearfix"> <header> <h2 class="post-title"><a href="/blog/index.php?/archives/17625-WebSEOApp-Spam-from-Google-Gmail.html">Web/SEO/App Spam from Google Gmail</a></h2> Posted by <a href="https://www.nk.ca/blog/index.php?/authors/1-Dave-Yadallee">Dave Yadallee</a> on <time datetime="2026-05-08T18:11:00+00:00">Friday, May 8. 2026</time> </header> <div class="clearfix"> X-Mozilla-Status: 0001 X-Mozilla-Status2: 00000000 Return-path: <doctor@doctor.nl2k.ab.ca> Envelope-to: dave@doctor.nl2k.ab.ca Delivery-date: Fri, 08 May 2026 07:31:00 -0600 Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD)) (envelope-from <doctor@doctor.nl2k.ab.ca>) id 1wLLHu-000000002dq-43Gw for dave@doctor.nl2k.ab.ca; Fri, 08 May 2026 07:30:42 -0600 Resent-From: The Doctor <doctor@doctor.nl2k.ab.ca> Resent-Date: Fri, 8 May 2026 07:30:42 -0600 Resent-Message-ID: <af3lgkOQVRwtu_Rs@doctor.nl2k.ab.ca> Resent-To: Dave Yadallee <dave@doctor.nl2k.ab.ca> Received: from mail-wr1-f45.google.com ([209.85.221.45]:54720) by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256 (Exim 4.98.2 (FreeBSD)) (envelope-from <brandonparles@gmail.com>) id 1wLKEg-00000000OHn-3MMs for sales@nk.ca; Fri, 08 May 2026 06:23:28 -0600 Received: by mail-wr1-f45.google.com with SMTP id ffacd0b85a97d-43d7645adbdso1146580f8f.1 for <sales@nk.ca>; Fri, 08 May 2026 05:22:31 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1778242944; cv=none; d=google.com; s=arc-20240605; b=DJ11Xk3uZHZa8JvthFyKxMqWiQG5AoOb8mF5uwsiRUYb5snNoTxoTS8g6iAQvafLRb 7SrXI8t/FKyR0yFOmy4I7HSrzxMWFLfEaMpXHKPWgWU7liJX7hLnJdAksD+umEk3mz+N 2GuPR7cK5jmfunBR8Hh0QpkC774cipnOcpBuQvhNFPztrjrNpQyxvbSE6q6CjzBcVTSZ 0Y27Ax/utiuo3rCsUWYebmwL/qoVeShBNOlSTga9mMvdWdSt2XaeEHIn23FPft85DH1j /AJrL5MGJsjRnigJqpQ/1pmYuCxozoP9YEWxCQNPrVSQ77HZB201QPY3oua7ROxl/ewF QwOQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20240605; h=to:subject:message-id:date:from:mime-version:dkim-signature; bh=lj3Va3jdCfC2729tbFE/2K9bN8Nbm8O0fjKErVlxEOo=; fh=C4vsnDG7cTH8aa/8f7sygxKSfblX4MPDg6mph8A3jUw=; b=anLBZJYMX8BsrimXhzyGlsSpFKDRvbJay3hKXBV5mg/dbLbAAzsDkatdW75nO8b7YM rkeFeRWjj2XKWXxGqr17uWLZh+/2DJKnkgZGjxK/5Z6hVwJ7H2Pkh/kwGLSTbVM3PY3Z 9FqqQLw6uqz12n4MLPwMObqGm96qNV8l09Udihl6eD8EGnRtYXvkmz2tYHl4B/htegwh 3pZ0m2X9VG1+5thBzyKwTrP3Nd/TwoxKtinQhAgALDvlDw7oqs9FvMerIdEjsABAwDq+ 7dLmUtDRNQ63eFZUIZtLILTIlH/vr1jxWBwJM39H7fyfPJghAPoThBzZyKGUqjnWhCzw yy3w==; darn=nk.ca ARC-Authentication-Results: i=1; mx.google.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1778242944; x=1778847744; darn=nk.ca; h=to:subject:message-id:date:from:mime-version:from:to:cc:subject :date:message-id:reply-to; bh=lj3Va3jdCfC2729tbFE/2K9bN8Nbm8O0fjKErVlxEOo=; b=c2gTOuvJZC1mBRp+i+mpOoZfa0EONMOSojdnEXvzdezpvCc2ulJlKNjkA7x4ShBNOo JQ/0XQDk3njHVM1Zi+FWtJ/oOqGjM0BToHbSdlLXqGB538Ee2YNHrs6XSK8NyL/iqkBn 4/pYluujxdaikcQ0iMNVypOQo3PcnLwX17VMqcjawSXShq0fqSRCSro55Ae+G7i1luyA sKwN8idwdypiQXcVqhYuqpdTZ+k5OHWqy0Gl+IxHlKHObrl0tghESezyze1O8KzRN6hf e6Ap7KfcbEGBo8M2KsUeYI7KjoIBe6icWToEEm34q4tl+QJJgESRK55iUV3u89+bzgDg 4Gtg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1778242944; x=1778847744; h=to:subject:message-id:date:from:mime-version:x-gm-gg :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to; bh=lj3Va3jdCfC2729tbFE/2K9bN8Nbm8O0fjKErVlxEOo=; b=MkJFIpKFzFMjnMJTdd/JXZntcVS9zVAlzUiUj6Nz6FMKHIXi5Q/SYlOY0S6VA28+Ct 8mmDnvOSPrl3fEDRLvveFcxHMTba7WpLJvQb3lhTie0XbOPKIfZCfkE1chyJDbokjoLv YdsOdiD8gGg7B7S/I0Z0zzCDoZzdQbQ73kaKFSXC6rj5ZHrhYI2Xq+Rb2aF57leMpVe2 uwjWHwAMe9wrXyM0vN8XhAQMfZ4YRjt08eR/j+3guHzKiQx6IOsXrW0gXBXHc1RBYReB URiDj+pnhptT6dGu8LGI+jv8i1HOtDfqtqCIdhvjGUtRsvJv1bOtPeul/Wpb2Vlxsc7h GAPQ== X-Gm-Message-State: AOJu0YwN3z3CiOapmd58ZaTne9hlkqTyvPmJaJ2SIQSA1W+2ZI9z1TwQ jV926mNOPRVHphB/uBizu4J83RUgGF1oxFUAXWM7xtQENk1YH0riYFbI3E/lBkWy3ZLabeD6g+o 1454+DioQ7EKTNq4P82uHaNtTdC8+TAdo6tQ+ X-Gm-Gg: Acq92OGdMgVfHzRE6nqf8eUVNgVb5Rrtw57M+VKuAk1qYxyi2UU9/YTZm8PGbCUIBqB nfZxRbv2x4sJzh/12DqH9dlMieD2ukQcGs0itZhKyiWBY5VxW0QC53VboCD/pPf2p2XPIQd0+D/ eLAe8fTThC5M2IG0rDiaN3rzmr0ReoSCOVwodes/MxwsGgrZQQqqCVkO/Gm2PVaxD92pXpcS92V GCGnK2TeMOHPeeaRz492061hA2BSRwUFWYaLLZZvyGWfqe6AwohxZHkXrwbXrwbvc8gYCmwH4sU cplN6u9af4qpwo9szr73ABOE9jkUzCkNdA== X-Received: by 2002:a05:6000:24c9:b0:43d:6a02:b7ad with SMTP id ffacd0b85a97d-4515b05735dmr19478851f8f.4.1778242943590; Fri, 08 May 2026 05:22:23 -0700 (PDT) Received: from 1008170693301 named unknown by gmailapi.google.com with HTTPREST; Fri, 8 May 2026 05:22:21 -0700 Received: from 1008170693301 named unknown by gmailapi.google.com with HTTPREST; Fri, 8 May 2026 05:22:21 -0700 MIME-Version: 1.0 From: brandonparles@gmail.com Date: Fri, 8 May 2026 05:22:21 -0700 X-Gm-Features: AVHnY4KldTgNPO1NwEvXS5fwgfqRUuaSX6ooeZdDUM3m_bHzvfJG9MQzQ8gHGJs Message-ID: <CAAu7_pRcN058VUVVKSBRXk5hY+AZFom2bCZK38qQyz5eWb8XaQ@mail.gmail.com> Subject: =?UTF-8?B?V2ViIHNpdGUgY29uc3VsdGFudOKApi4uLi4uLi4uLi4uLi4uLj8/?= To: sales@nk.ca Content-Type: multipart/alternative; boundary="000000000000fa3dce06514d72f3" --000000000000fa3dce06514d72f3 Content-Type: text/plain; charset="UTF-8" Hello, Would you be interested in building a new website, or possibly rebuilding/repairing your existing website . I can send you more details on the action/portfolio/past work details/price list. Brandon --000000000000fa3dce06514d72f3 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable <div>Hello,</div><div> </div><div>Would you be interested in building a = new website, or possibly rebuilding/repairing your existing website .</div>= <div> </div><div>I can send you more details on the action/portfolio/pas= t work details/price list.</div><div> </div><div>Brandon</div><div> <= /div> --000000000000fa3dce06514d72f3-- </div> <footer class="post-info"> <ul class="meta"> <li>Categories: <a href="https://www.nk.ca/blog/index.php?/categories/14-Google-Gmail-Spam">Google Gmail Spam</a></li> <li><a href="/blog/index.php?/archives/17625-WebSEOApp-Spam-from-Google-Gmail.html#comments" title="0 Comments, 0 Trackbacks">0 Comments</a></li> </ul> </footer>  </article> <article class="post clearfix"> <header> <h2 class="post-title"><a href="/blog/index.php?/archives/17624-WebSEOAPP-spam-from-Microsoft-Outlook-Part-2.html">Web/SEO/APP spam from Microsoft Outlook Part 2</a></h2> Posted by <a href="https://www.nk.ca/blog/index.php?/authors/1-Dave-Yadallee">Dave Yadallee</a> on <time datetime="2026-05-08T18:10:00+00:00">Friday, May 8. 2026</time> </header> <div class="clearfix"> Content-Type: multipart/alternative; boundary="_000_KUZPR06MB80581A472D12D159E2B5F85CA33D2KUZPR06MB8058apcp_" MIME-Version: 1.0 X-OriginatorOrg: outlook.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-AuthSource: KUZPR06MB8058.apcprd06.prod.outlook.com X-MS-Exchange-CrossTenant-RMS-PersistedConsumerOrg: 00000000-0000-0000-0000-000000000000 X-MS-Exchange-CrossTenant-Network-Message-Id: 4bbc2508-111f-4a8d-a6e7-08deaceeacf4 X-MS-Exchange-CrossTenant-originalarrivaltime: 08 May 2026 10:43:43.6625 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 84df9e7f-e9f6-40af-b435-aaaaaaaaaaaa X-MS-Exchange-CrossTenant-rms-persistedconsumerorg: 00000000-0000-0000-0000-000000000000 X-MS-Exchange-Transport-CrossTenantHeadersStamped: JH0PR06MB6968 --_000_KUZPR06MB80581A472D12D159E2B5F85CA33D2KUZPR06MB8058apcp_ Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable Hi , I hope you're doing well. I'm following up on my previous email as I haven'= t yet received a response. ___________________________________________________________________________= _____________________________________________ Could you please share what kind of mobile app or software you are looking = for, along with any features or specifications you have in mind? Our services include all types of mobile apps, such as: Wellness & Healthcare Apps Booking & Appointment Apps Beauty Salon & Fitness Apps Training & Educational Apps Hotel & Resort Booking Apps Product & E-commerce Apps Hospitality & Food Delivery Apps Event Management Apps * And more custom solutions Please let us know your specific requirements and ideas, so we can provide = relevant examples of our past work and a tailored proposal. Thanks & regards, Business Development Manager (India) --_000_KUZPR06MB80581A472D12D159E2B5F85CA33D2KUZPR06MB8058apcp_ Content-Type: text/html; charset="us-ascii" Content-Transfer-Encoding: quoted-printable <html> <head> <meta http-equiv=3D"Content-Type" content=3D"text/html; charset=3Dus-ascii"= > <meta name=3D"Generator" content=3D"Microsoft Exchange Server">  <style></style> </head> <body> <div>Hi ,</div> <div> </div> <div>I hope you’re doing well. I’m following up on my previous = email as I haven’t yet received a response.</div> <div>______________________________________________________________________= __________________________________________________</div> <div> </div> <div>Could you please share what kind of mobile app or software you = are looking for, along with any features or specifications you have in mind= ?</div> <div> </div> <div>Our services include all types of mobile apps, such as:</div> <div>• Wellness & Healthcare Apps • Booking & Appointment Apps • Beauty Salon & Fitness Apps • Training & Educational Apps • Hotel & Resort Booking Apps • Product & E-commerce Apps • Hospitality & Food Delivery Apps • Event Management Apps • And more custom solutions</div> <div> </div> <div>Please let us know your specific requirements and ideas, so we can = provide relevant examples of our past work and a tailored proposal.</di= v> <div> </div> <div>Thanks & regards, Business Development Manager (India)</div> <div> </div> <div> </div> <div> </div> <div> </div> </body> </html> --_000_KUZPR06MB80581A472D12D159E2B5F85CA33D2KUZPR06MB8058apcp_-- </div> <footer class="post-info"> <ul class="meta"> <li>Categories: <a href="https://www.nk.ca/blog/index.php?/categories/13-Microsoft-Outlook-Hotmail-Spam">Microsoft Outlook Hotmail Spam</a></li> <li><a href="/blog/index.php?/archives/17624-WebSEOAPP-spam-from-Microsoft-Outlook-Part-2.html#comments" title="0 Comments, 0 Trackbacks">0 Comments</a></li> </ul> </footer>  </article> <article class="post clearfix"> <header> <h2 class="post-title"><a href="/blog/index.php?/archives/17623-WebSEOAPP-spam-from-Microsoft-Outlook-Part-1.html">Web/SEO/APP spam from Microsoft Outlook Part 1</a></h2> Posted by <a href="https://www.nk.ca/blog/index.php?/authors/1-Dave-Yadallee">Dave Yadallee</a> on <time datetime="2026-05-08T18:06:00+00:00">Friday, May 8. 2026</time> </header> <div class="clearfix"> X-Mozilla-Status: 0001 X-Mozilla-Status2: 00000000 Return-path: <doctor@doctor.nl2k.ab.ca> Envelope-to: dave@doctor.nl2k.ab.ca Delivery-date: Fri, 08 May 2026 07:31:00 -0600 Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD)) (envelope-from <doctor@doctor.nl2k.ab.ca>) id 1wLLHI-000000002bs-3BlG for dave@doctor.nl2k.ab.ca; Fri, 08 May 2026 07:30:04 -0600 Resent-From: The Doctor <doctor@doctor.nl2k.ab.ca> Resent-Date: Fri, 8 May 2026 07:30:04 -0600 Resent-Message-ID: <af3lXLYDoQp3gacc@doctor.nl2k.ab.ca> Resent-To: Dave Yadallee <dave@doctor.nl2k.ab.ca> Received: from mail-japaneastazolkn19013073.outbound.protection.outlook.com ([52.103.43.73]:15564 helo=TYDPR03CU002.outbound.protection.outlook.com) by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384 (Exim 4.98.2 (FreeBSD)) (envelope-from <DonaldAshleyy@outlook.com>) id 1wLIiO-00000000Hcu-3xtM for sales@nk.ca; Fri, 08 May 2026 04:46:03 -0600 ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=t1NOoedhnh3Qb0J9asVjE7lmz0ICemZW4XF+QkCKM2ziKhuKMBTRDJBS18Y06P/pqOTwFOoZiSecwhqfydjxoeWRH+Y6uJX+6jDRCFkVIv/1Lpds67O6vPRHzUQ0ctkGl/rCog65Do9Z0JBz+Dr4kUM5nfwfKvO9ORZ36s270ujAbpDYKE4R3v5nXFa2AplL2wmZ9guslUAt1bTAkVgwUIvIaSXmK4RjOi8fSiQJtnVHFFtKsl8DnJdxHr+8Xinc9jnqrVpsU4az6YuH1f0947l7tbeubNYgQxx/oZq5aKDxtk54BUff9qI0XxQ7rtAckDUHw5RfA2Ugz19A4tMoGw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=myMVDE/z/24w0kDH68SRfn6psqXMPMYznUZQBYRhvfU=; b=N1HpskfOFLYkUu+iO5NP1Qk7HT2yahD+4Hv+f97bx59uJEEJbN89+YUJdiXjC2myOT6ZfzfX4wn+J9TvAZcLWdZhLmls4bVnkF77tmOrXVp/hMfEOiAzv0H3jMm8Sg/Hww5POHJhshugkAhVsAVaRWtklnh/Cdsw3Umj6Dz/OoLGTSH05vUhCV5to/o1Vbr1Pew8QuDNsMmOe34VWEFF+LR985d8dv8OUz6podFuWu+tJrxXlY5Vz+0yU1I1yxiqrOpoOtcVBbpF2dQp/cT6Nh0ZPGzijYTrK9LXJYJksb2qPvETVesb98RPVHBIou2H9/w45oBQBUB1+JdZiKvHfg== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=none; dmarc=none; dkim=none; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=outlook.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=myMVDE/z/24w0kDH68SRfn6psqXMPMYznUZQBYRhvfU=; b=IdUnUBnrGOlfwnXcCab2toscxtN9Qxwv9vMbs7TU87oU1Hlwu3yhQjT03MC0P9JkDOdyLDUiyuGZMzkm9Q6eZ7B2JqwwmD5CQ3pMJG2v+nOHIMh2D99XvIFWQUg99suWZa2FHTUtxWsIp4+WU8T52wI7fBI+ghaWL8yCeMGcKxBzjp2y6rhJ0h5QV6EYWRew01SjW55ztDI0HOXluLCWm+Gg4ZFPQsTG1grEiPqmDueAwsXoACnEFyumjoC1gAJilKF/ya6C4z9+pQxb8B8YqYwiXMVkScNWmTEPzlvYe/VTJ3l4uS/30JkzshAa0Od2DIUSHBq9DnHCXh/jPhx9rQ== Received: from KUZPR06MB8058.apcprd06.prod.outlook.com (2603:1096:d10:48::8) by JH0PR06MB6968.apcprd06.prod.outlook.com (2603:1096:990:6e::9) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.9891.17; Fri, 8 May 2026 10:43:45 +0000 Received: from KUZPR06MB8058.apcprd06.prod.outlook.com ([fe80::ca33:ceb4:f138:cf14]) by KUZPR06MB8058.apcprd06.prod.outlook.com ([fe80::ca33:ceb4:f138:cf14%5]) with mapi id 15.20.9891.019; Fri, 8 May 2026 10:43:45 +0000 From: Donald Ashleyy <DonaldAshleyy@outlook.com> Subject: RE: Educational Apps !! Thread-Topic: RE: Educational Apps !! Thread-Index: Adze02cQcgqGmB8LTNSukiTEk/k3wg== Date: Fri, 8 May 2026 10:43:43 +0000 Message-ID: <KUZPR06MB80581A472D12D159E2B5F85CA33D2@KUZPR06MB8058.apcprd06.prod.outlook.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-ms-publictraffictype: Email x-ms-traffictypediagnostic: KUZPR06MB8058:EE_|JH0PR06MB6968:EE_ x-ms-office365-filtering-correlation-id: 4bbc2508-111f-4a8d-a6e7-08deaceeacf4 x-microsoft-antispam: BCL:0;ARA:14566002|39105399006|15001099006|20101099007|24071999003|55001999006|37011999003|22091999003|13091999003|20031999006|24121999003|24021099003|2604032031799003|15080799012|31061999003|8062599012|8060799015|41001999006|19110799012|12300799018|4295299021|31055399003|43065399003|40105399003|3412199025|26121999007|440099028|102099032|18061999006; x-microsoft-antispam-message-info: =?us-ascii?Q?6gIZ8mgIHMVg0ZNXmw21vysp793Z4fs7WrAvplP5Q0mqJqPxaElw+SYKpVAB?= =?us-ascii?Q?RXppI7OTDikACMGeKabiD0teH8p8szt2LR3WFMIC+m5j3gWcoU7h+nKTg3Jz?= =?us-ascii?Q?ZaqDTjclr4vnzvmKuRY8BveboICja8XlLhBkQ8qqUXmSPg+20rJU8sIEFphr?= =?us-ascii?Q?osIjsSdpee8J2zQTBkaN5bVGXpDv05HWtOBXpet6+e4VpuI7cO3LQOTPCp6b?= =?us-ascii?Q?KDsnwak+f+NQkji8yhUAXq6dJOmHLZNdEARWTg5Qu40H6e015+zNoNvdQUbq?= =?us-ascii?Q?b24YSfsejg1Q7xZkFDZpzqEtV2XfFnAbgeKm9Izh28VvxBotfE+mzJVxyZSi?= =?us-ascii?Q?joGYQ8FCtq4vA5ftti+XBJSeRHNobFwciNbmam8j4QkhdZyLqHUztnU/sXjd?= =?us-ascii?Q?Tt3juoJ4p2HttV/n6NQXAsfr4h3ThPRIjhDIVfqsESc30j85aitvL1i0nf9F?= =?us-ascii?Q?JEog2WJm49d4jJ9tpV+xji8pYGADiv6Iu9OnHeaug1s/F0DXdL9ABoY05i3C?= =?us-ascii?Q?5gt+ujVl4brpdXz4upWW254st7TGSre7mQ7W0bao+iQYmQsmpMfL1leMlQp3?= =?us-ascii?Q?uV1rvUjsgshYKHOmMv6WcUNtHsgbFaBN6eboH1u8+ViD469CqX2QlZNs+/Lo?= =?us-ascii?Q?msx9SU0ST0y5s6BoT25OkRd8Z2jSyEEiOgO8aOwOLUigD5h9U7iIxGQQmJMA?= =?us-ascii?Q?vzQ1uv/spZWxRBPg+rjt+WaINA1jUuKc6d4fT4kIFojA5RFk9yamY6GY+uRG?= =?us-ascii?Q?n2SQwJsLBlkA/8A9ZT3hMmbTLoQBzMsvstQ8bwDTFZMmP7YcN28b79vEaDyj?= =?us-ascii?Q?97ZuPw5gS+DEAq/yaxmBLsoaTDPw5q4UWDexLo8eBvPnOdKLdluJxD+4VEn4?= =?us-ascii?Q?VVoupsHVsz1RGrTysgMfLOt+KGXOhgVo8mtr4cEL4tO1rJS4CTti2CS5Ae3C?= =?us-ascii?Q?wiAccfeli3N3FdRREAr9uP58iquxl80unmRuJ7j9Iq7BAks1/sI0gWvW+PMd?= =?us-ascii?Q?dZzDD79VYPDEI5ytlUQl8dZxDPV9mjx8nxQblbM1pulE8eVpVhzPzrHDzwGd?= =?us-ascii?Q?DYMIrorx0x0JjiFYyZSFJBcYslwynFfhwJnf6L9/UDjeCEVnq30nDpimTq8V?= =?us-ascii?Q?p6qAUZD162KduJ1EF53tyfBXrNrsdqg0J5/UVGwAODo6pA9x9rX+4inTtVPz?= =?us-ascii?Q?hELjV750V+q/p+fuZqJpVGFi9DAVtzqOBqQ7vWdAYRMnhGI83UnAfPGcQpam?= =?us-ascii?Q?uoBAcGJXyEfJuqGLFeqMvMnny46q3Z6fSMqhBP7tMk+IJtnf+EMHJy7ePpSp?= =?us-ascii?Q?ZukMl/aN+YoznYW/dYJZjabrfVE/eKvOhsEyQRoiz57AnD6vHKCG+LUItZyA?= =?us-ascii?Q?2siB5DG7fEeuFqSoLsc8DrUz0g0j2dGyHXo0iyaQ9NjulIDxDJgs8XDHVsLU?= =?us-ascii?Q?gqYrc7HcwA5cGomxCPVTEz1XuLfmBvCO6NZjGIdo47hPUqkM8Ym6VQ=3D=3D?= x-ms-exchange-antispam-messagedata-chunkcount: 1 x-ms-exchange-antispam-messagedata-0: =?us-ascii?Q?kJNHlMrk7ufJEu+3yCX6MbLQ+o+zAdcnURvvl7AnA/m3AQcbdKyOnE0D0K5Z?= =?us-ascii?Q?rri8WLx/jCFO8J8YBpBoiAFAFzN6/NEAEhZvHqRnALORd5x5BandP0dlaLbQ?= =?us-ascii?Q?68AXl6p+3E3sY0Gw6CWZAZOllfH+5wjzYhJC2/SM9lH9DT15mor71VGdVXf+?= =?us-ascii?Q?cUMxFBdrfGJvjbXJDLZHqf7B4X4BrlmQh3Vb6guVAV5qNXiixgmGmrfNNFtS?= =?us-ascii?Q?FMPHvE37iehHCfc098118AWC0LYE6f9o+ZZS4lRiowYo9zX56NpiqaP9bxxH?= =?us-ascii?Q?xqSv/vf73fJ532miCJAiRJwF/Gr31o9D5cTrZDyJOV3FOg4/APhhqO+odSNW?= =?us-ascii?Q?3MwK5Byb/Snt4rE5vvLLwEDyQHeaS68FkDuzWj2HEFV/3qJmZqND0Q99Mx2X?= =?us-ascii?Q?MF0tzjB8+QmfI2lb5d6KUCCKmnP2EdmwS8XusqMa2dHRLyFOxFScMj/Xrrm8?= =?us-ascii?Q?1DyJ2ir9xO6h+Gsik43xZ8TTZCugaj5sq7N+r5F9ukFMt7vZy2nYTkMU5X9u?= =?us-ascii?Q?sOMwAZZm3nxTuaz1dZaRGd70meDOXs1Zc4h+vWBFFOADAkyT/XQ09vqzTar7?= =?us-ascii?Q?QZB2rIYvCjNoAMJckIL/RWQSsYMEMi0rWcitAiwwTikOTREWj2a6ulB0BuoU?= =?us-ascii?Q?zUw5EsnOYr8Yp6U1glgaxn+cjZnDYjezHre7MqVdRdo3X1BQcTUL6s9URntU?= =?us-ascii?Q?aVDgKcoVWsMknMO5GQMTyoWpJJd0yt3WPGRJFIzrEu7uInqHBev9VpEjD5gS?= =?us-ascii?Q?c7PscNB3elq6SWKsfKMWLmNVGsY+lvfH13OxuhduovlXZh5AehX3sYVL8ZlY?= =?us-ascii?Q?N+V+i0BneJqjfR0/nUV2bTIijbm19erKbCOJydKFDEZaa8igILCjqgrJHQ2I?= =?us-ascii?Q?zSst7JsSuZa523keb8h8tEpEevaDqv+zv06InEmV5jv4qWIXTwsdfJXQ+cO4?= =?us-ascii?Q?fMx4i0pp9OkAapBaIEaETD7yPui3n3wa1nzSRDL9re42HrnEFhMWy27vhzax?= =?us-ascii?Q?GY9aTHgPuckqDfkPfAObe4NOPj1Yz+mOiNek27dERRuPoy9TcofzRPYTp2M2?= =?us-ascii?Q?nE/SLC4UZtvjmaiClryPeEr6uj/WyQNIRBLpTffFuQmvUWvVdkXPqFZ5hRWC?= =?us-ascii?Q?ACK/pyGRMIXkhonX/MouciWNvcJWJ5mtWzAixmthsvbGI41tWeprCwrIBMAK?= =?us-ascii?Q?HEjgVCulBBiuE6asV9c2RW/OzRT+NpXh/32Nq0BaoF3oJ9WtlBmClhl9RWxH?= =?us-ascii?Q?8lgOJOI6kPkrzCmn1N3uYLNVwwOoKCZpRmfEbeL0iCJvTP090se2/GAhCqeR?= =?us-ascii?Q?ttnjz9mWIpJzBSN1hkZc/VyLCApb0de2/fw06n6jvGxsWzFOZlIWL4jYfsIW?= =?us-ascii?Q?ykFrIwnkuU7Jik8ZSpKFTP1eJ1uQsGYmiW++6qqp1fnzYPOC14bSoxKFDQXP?= =?us-ascii?Q?5LY/+r61JLMRoEPmKSI3bIq8QmRR2eGC?= </div> <footer class="post-info"> <ul class="meta"> <li>Categories: <a href="https://www.nk.ca/blog/index.php?/categories/13-Microsoft-Outlook-Hotmail-Spam">Microsoft Outlook Hotmail Spam</a></li> <li><a href="/blog/index.php?/archives/17623-WebSEOAPP-spam-from-Microsoft-Outlook-Part-1.html#comments" title="0 Comments, 0 Trackbacks">0 Comments</a></li> </ul> </footer>  </article> <article class="post clearfix"> <header> <h2 class="post-title"><a href="/blog/index.php?/archives/17622-Nigerian-styled-Investment-spam.html">Nigerian styled Investment spam</a></h2> Posted by <a href="https://www.nk.ca/blog/index.php?/authors/1-Dave-Yadallee">Dave Yadallee</a> on <time datetime="2026-05-08T18:03:00+00:00">Friday, May 8. 2026</time> </header> <div class="clearfix"> X-Mozilla-Status: 0001 X-Mozilla-Status2: 00000000 Return-path: <auditing797@gmail.com> Envelope-to: dave@doctor.nl2k.ab.ca Delivery-date: Fri, 08 May 2026 02:19:00 -0600 Received: from mail-oa1-f50.google.com ([209.85.160.50]:54292) by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256 (Exim 4.98.2 (FreeBSD)) (envelope-from <auditing797@gmail.com>) id 1wLGPX-0000000057E-1Pk7 for dave@doctor.nl2k.ab.ca; Fri, 08 May 2026 02:18:24 -0600 Received: by mail-oa1-f50.google.com with SMTP id 586e51a60fabf-415c8a4d2e6so853417fac.0 for <dave@doctor.nl2k.ab.ca>; Fri, 08 May 2026 01:17:28 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1778228242; cv=none; d=google.com; s=arc-20240605; b=FsaZ/z4Z/j5gNCk7P4tPJ9Jhv4VZD4QEWJL7CKmRCTZoOc4hfCnPbL7w2QSRZlo8Dj tG4jFeF/1m/mnnBXS+bzmqHKVY1wWkrMYtCldnzbe45m8nWXtuHK3LjkVXgmCW60XAya YpHeoeKNFxknEfpEPM9b8yOYR0UP4qqlvJxCiXDqkXXMR3u884fq7m0YHUkWQpNSIhUr FIdG1r5gOwUTKxO1nJ8z6npgFcVLKrjUQ3tGSdYCKM1t3sDq9atWw+n7GNDQoH1qssRt 3O2x+Rq95wO3wtaNEsFi9b+2+JL24i445b2mS738UJjxte7p0oLDrjwD44czwSeSG+0p DW5A== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20240605; h=to:subject:message-id:date:from:mime-version:dkim-signature; bh=o750S0TSqtYj80D5qMOju9aGMspN8+asbMJ0jxWs3Vk=; fh=lqvQpHO4rvGCv/s+0rUIeAJK43i+pwpfjNq4yZVvCXQ=; b=Bsk7wFdoSlojJGNf6tcf6fmOFSi05PPwsV2LXOrHmOKvjfXAVboX0Em445XAQZSTfg 5fmMwcHEcDbNtxtbISUSAXapQxffQ+LluaAl6sAIdzKgWOETX45G/Ywxpo8WmSCE6Eiw U8zYWOFjIkbmEKEDj3rjkat+5qsKjrBVltVRLUEnnZEKB9D6xxIjRmZqtWN37TvyJ3W/ 5cOHf329Z6PNcSCAxFXZhrPjRwRkiXi1WJ/JmVvbRIOTYPXKhd8a3/Ezl2DYcJxm2Axy uZcTe3sT3e95MF3JaZaywaZ36Mg/OlHZ2YqTmyB7098MQN7ZEOE2epmTXJRnQwZYiacE Wmdw==; darn=doctor.nl2k.ab.ca ARC-Authentication-Results: i=1; mx.google.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1778228242; x=1778833042; darn=doctor.nl2k.ab.ca; h=to:subject:message-id:date:from:mime-version:from:to:cc:subject :date:message-id:reply-to; bh=o750S0TSqtYj80D5qMOju9aGMspN8+asbMJ0jxWs3Vk=; b=HBHOB6CsYsvGiEMEH7naco5xzPuceAI674GA4Cys3Dy8bzfqS4yxxZh1wL1YKDb3B6 KuLu72gjmVkMu6U+FHHEU5FQjk4LkMRo/svB+EVChIMuqcrRFiXGRvlgm2JYBqaQR1oo p5BKXGQZ7WI/N93LRWo0qJRboy4xR8DdDY53dXAumlk/JIe10qhjGI7IeBH0dbh2Hak5 z1s9C/au7z3VHmN273j6YRqAZsUOZatg5WS2HFGovhHnPLHJTE1VI879eBlU9m+YVGS/ bvO9cI0rGbaljXvG58w+mTERq9xLwKtnRBPs5XBsMSTTDrlLQCrgS8yHH4kClVAb34nF yBvQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1778228242; x=1778833042; h=to:subject:message-id:date:from:mime-version:x-gm-gg :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to; bh=o750S0TSqtYj80D5qMOju9aGMspN8+asbMJ0jxWs3Vk=; b=GpOtg4zjXl56iV7kY4VtawZCrPV+ZJ9FqkN/pZRwh/9R6yNdt/+P4huNqZ3XXrcFrZ jNOgdwOXe1XMxd2V6M/DSIR6/vhbdjs9Qq/KhuDM3xWu1G/B1+UNqStnBNngOr9j5SUO 0a+3mkbzjuK+YGg5GZfUOEMLhF9TcPn9AFD/cPaoa6gpt2wy/Nh7O9lHnrPvuEFE4ce4 mIda+dQsqzcKn6G9LQMf7439TO0aVQE+uDz1rfFEzXLfkDsUwX3QJcy2D3v61rD0Y9fc Hi70J3HthHNtRA+RHqS8Ghhs3VLEigv7ifNLjiqpVsaXIbjZhmhQQe82kzFS5lKOEqpp 28ZA== X-Gm-Message-State: AOJu0Yyl9G1jqjNjchopU07nAVOt/t6yY4WhkmLLCSSQTSpC4lPuyrle 7INdHzerdMLldafyxjrjLhtNvRQD8dtXpopOgr6DQA6k8CMQ4LUIfo3J74vsSOKe8e1qySp7qeT XOYXzqVLcQqTeip5YW4UYI1PZNH49qRmYCIfI X-Gm-Gg: Acq92OGrjqJ0CL3yUjZ8zD8JLUsn2hw0MEmxsEGlb2N2DWr15ELRCrv5UU0EUNcLmsO qwYQ+1kWb90L/tT+lg3U7gyaxLiNX1/yrksRZuryXJnoxIjsK4K1R9W+xLHoJ8bXxCuzLk5377L yOf0PVlbeABQ0aPxeVd8Z1gSt68U0qBUu96Hpe0nhUsXFyaEWSH1zXrB71FL+CiV1X6DQQA1Xt+ tbDXTMVBQyGx+VolHe6ZTyjWP5y/wvVDA2KeoVQxmy6PzwZfsuY07Ip24nLvbqpoxV5Y+c7CL9R 6Dz1c8FiUTbrqFFabI8G3teVuKcmyO7TSGhNi3G99Kueyl5NaPIMkWVgzwo63v/af9WV7nRZrEV uUpQOlEgCN4Xa247y X-Received: by 2002:a05:6870:c697:b0:42c:1ccd:62ef with SMTP id 586e51a60fabf-434f655eb1bmr7381295fac.28.1778228241776; Fri, 08 May 2026 01:17:21 -0700 (PDT) MIME-Version: 1.0 From: Account Department <auditing797@gmail.com> Date: Fri, 8 May 2026 08:17:09 +0000 X-Gm-Features: AVHnY4JSAevpqU-isaIiuVm513fupw80ObCBLRHIHkL5pTkoDMdNUL8NCQvaGeE Message-ID: <CANgja2s=6DXjzBkcJ23rE=inPag6E0ifSE1spgWjGU=StJObBw@mail.gmail.com> Subject: To: dave@doctor.nl2k.ab.ca Content-Type: multipart/alternative; boundary="000000000000ae42d506514a06bb" --000000000000ae42d506514a06bb Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable Subject: Exploring New Opportunities at Global PETROLEUM Dear Candidate, I hope your week is off to a great start. My name is Nurul Rahman, and I=E2=80=99m a Senior Talent Specialist at Glo= bal PETROLEUM (GPL). While exploring professional profiles this week, your background in the industry immediately caught my attention as a strong potential match for our expanding team. We are currently scaling our operations and have several key openings that align closely with your professional expertise. Are you open to a brief conversation about your next career move? If you=E2=80=99re interested, please feel free to share your updated CV or = let me know a few times that work for a quick introductory call. I=E2=80=99d love = to walk you through what we=E2=80=99re building here. Please forward your CV to: auditing797@gmail.com Best regards, Nurul Rahman HR Associate Global PETROLEUM (GPL) --000000000000ae42d506514a06bb Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable <div dir=3D"auto"><div dir=3D"auto">Subject: Exploring New Opportunities at= Global PETROLEUM</div><div dir=3D"auto">Dear Candidate,</div><div dir=3D"a= uto">I hope your week is off to a great start.</div><div dir=3D"auto">My na= me is Nurul Rahman, and I=E2=80=99m a Senior Talent Specialist at=C2=A0 Glo= bal PETROLEUM=C2=A0 (GPL). While exploring professional profiles this week,= your background in the industry immediately caught my attention as a stron= g potential match for our expanding team.</div><div dir=3D"auto">We are cur= rently scaling our operations and have several key openings that align clos= ely with your professional expertise. Are you open to a brief conversation = about your next career move?</div><div dir=3D"auto">If you=E2=80=99re inter= ested, please feel free to share your updated CV or let me know a few times= that work for a quick introductory call. I=E2=80=99d love to walk you thro= ugh what we=E2=80=99re building here.</div><div dir=3D"auto">Please forward= your CV to: <a href=3D"mailto:auditing797@gmail.com">auditing797@gmail.com= </a></div><div dir=3D"auto">Best regards,</div><div dir=3D"auto">Nurul Rahm= an</div><div dir=3D"auto">HR Associate</div><div dir=3D"auto">Global PETROL= EUM=C2=A0 =C2=A0(GPL)</div></div> --000000000000ae42d506514a06bb-- </div> <footer class="post-info"> <ul class="meta"> <li>Categories: <a href="https://www.nk.ca/blog/index.php?/categories/14-Google-Gmail-Spam">Google Gmail Spam</a></li> <li><a href="/blog/index.php?/archives/17622-Nigerian-styled-Investment-spam.html#comments" title="0 Comments, 0 Trackbacks">0 Comments</a></li> </ul> </footer>  </article> <article class="post clearfix"> <header> <h2 class="post-title"><a href="/blog/index.php?/archives/17621-BNC-PHish-from-Sendgrid-Part-4.html">BNC PHish from Sendgrid Part 4</a></h2> Posted by <a href="https://www.nk.ca/blog/index.php?/authors/1-Dave-Yadallee">Dave Yadallee</a> on <time datetime="2026-05-08T18:02:00+00:00">Friday, May 8. 2026</time> </header> <div class="clearfix"> <P=20 style=3D"FONT-SIZE: 8pt; FONT-FAMILY: 'Cambria','times roman',serif; LINE-H= EIGHT: 10pt"> CONFIDENTIALIT=C3=89=20 : Ce document est destin=C3=A9 uniquement =C3=A0 la personne ou =C3=A0 l'en= tit=C3=A9 =C3=A0 qui il est=20 adress=C3=A9. L'information apparaissant dans ce document est de nature l= =C3=A9galement=20 privil=C3=A9gi=C3=A9e et confidentielle. Si vous n'=C3=AAtes pas le destina= taire vis=C3=A9 ou la=20 personne charg=C3=A9e de le remettre =C3=A0 son destinataire, vous =C3=AAte= s, par la pr=C3=A9sente,=20 avis=C3=A9 que toute lecture, usage, copie ou communication du contenu de c= e document=20 est strictement interdit. De plus, vous =C3=AAtes pri=C3=A9 de communiquer = avec=20 l'exp=C3=A9diteur sans d=C3=A9lai et de d=C3=A9truire ce document imm=C3=A9= diatement.=20 CONFIDENTIALITY: This document is intended solely for the individual or= =20 entity to whom it is addressed. The information contained in this document = is=20 legally privileged and confidential. If you are not the intended recipient = or=20 the person responsible for delivering it to the intended recipient, you are= =20 hereby advised that you are strictly prohibited from reading, using, copyin= g or=20 disseminating the contents of this document. Please inform the sender=20 immediately and delete this document immediately. <DIV></DIV> <DIV></DIV> <DIV></DIV></BODY></HTML> </div> <footer class="post-info"> <ul class="meta"> <li>Categories: <a href="https://www.nk.ca/blog/index.php?/categories/25-Phish">Phish</a>, <a href="https://www.nk.ca/blog/index.php?/categories/72-sendgridnet-spam-and-phish">sendgrid.net spam and phish</a></li> <li><a href="/blog/index.php?/archives/17621-BNC-PHish-from-Sendgrid-Part-4.html#comments" title="0 Comments, 0 Trackbacks">0 Comments</a></li> </ul> </footer>  </article> <article class="post clearfix"> <header> <h2 class="post-title"><a href="/blog/index.php?/archives/17620-BNC-PHish-from-Sendgrid-Part-3.html">BNC PHish from Sendgrid Part 3</a></h2> Posted by <a href="https://www.nk.ca/blog/index.php?/authors/1-Dave-Yadallee">Dave Yadallee</a> on <time datetime="2026-05-08T18:01:00+00:00">Friday, May 8. 2026</time> </header> <div class="clearfix"> <TR> <TD vAlign=3Dmiddle align=3Dright> <TABLE cellSpacing=3D0 cellPadding=3D0 align=3Dright bord= er=3D0> <TBODY> <TR> <TD=20 style=3D"FONT-SIZE: 11px; FONT-FAMILY: Arial,sans-ser= if,'Open Sans'; COLOR: #000000; LINE-HEIGHT: 15px; PADDING-RIGHT: 4px"=20 vAlign=3Dmiddle align=3Dright>Stay connected</TD> <TD=20 style=3D"FONT-SIZE: 11px; FONT-FAMILY: Arial,sans-ser= if,'Open Sans'; COLOR: #000000; PADDING-LEFT: 6px; LINE-HEIGHT: 15px"=20 vAlign=3Dmiddle width=3D25 align=3Dleft><A=20 href=3D"https://www.facebook.com/nationalbanknetwor= ks"=20 target=3D_blank><IMG border=3D0 alt=3D""=20 src=3D"https://www.bnc.ca/content/dam/bnc/formulair= es/modele-courriel/icon-facebook-25x25.gif"=20 width=3D25 height=3D25></A></TD> <TD=20 style=3D"FONT-SIZE: 11px; FONT-FAMILY: Arial,sans-ser= if,'Open Sans'; COLOR: #000000; PADDING-LEFT: 6px; LINE-HEIGHT: 15px"=20 vAlign=3Dmiddle width=3D25 align=3Dleft><A=20 href=3D"https://twitter.com/nationalbank/"=20 target=3D_blank><IMG border=3D0 alt=3D""=20 src=3D"https://www.bnc.ca/content/dam/bnc/formulair= es/modele-courriel/icon-twitter-25x25.gif"=20 width=3D25 height=3D25></A></TD> <TD=20 style=3D"FONT-SIZE: 11px; FONT-FAMILY: Arial,sans-ser= if,'Open Sans'; COLOR: #000000; PADDING-LEFT: 6px; LINE-HEIGHT: 15px"=20 vAlign=3Dmiddle width=3D25 align=3Dleft><A=20 href=3D"https://www.youtube.com/user/nationalbankne= tworks"=20 target=3D_blank><IMG border=3D0 alt=3D""=20 src=3D"https://www.bnc.ca/content/dam/bnc/formulair= es/modele-courriel/icon-youtube-25x25.gif"=20 width=3D25 height=3D25></A></TD> <TD=20 style=3D"FONT-SIZE: 11px; FONT-FAMILY: Arial,sans-ser= if,'Open Sans'; COLOR: #000000; PADDING-LEFT: 6px; LINE-HEIGHT: 15px"=20 vAlign=3Dmiddle width=3D25 align=3Dleft><A=20 href=3D"https://www.linkedin.com/company/national-b= ank-of-canada/"=20 target=3D_blank><IMG border=3D0 alt=3D""=20 src=3D"https://www.bnc.ca/content/dam/bnc/formulair= es/modele-courriel/icon-linkedin-25x25.gif"=20 width=3D25=20 height=3D25></A></TD></TR></TBODY></TABLE></TD></TR></TBODY></T= ABLE></TD></TR></TBODY></TABLE></TD></TR></TBODY></TABLE> <TABLE cellSpacing=3D0 cellPadding=3D0 width=3D"100%" bgColor=3D#ffffff bor= der=3D0> <TBODY> <TR> <TD vAlign=3Dtop align=3Dcenter> <TABLE cellSpacing=3D0 cellPadding=3D0 width=3D600 align=3Dcenter bor= der=3D0> <TBODY> <TR> <TD=20 style=3D"FONT-SIZE: 11px; FONT-FAMILY: Arial,sans-serif,'Open San= s'; COLOR: #686868; PADDING-BOTTOM: 30px; PADDING-TOP: 30px; LINE-HEIGHT: 1= 5px"=20 vAlign=3Dtop align=3Dleft> <TABLE cellSpacing=3D0 cellPadding=3D0 border=3D0> <TBODY> <TR> <TD=20 style=3D"FONT-SIZE: 11px; FONT-FAMILY: Arial,sans-serif,'Op= en Sans'; COLOR: #686868; PADDING-BOTTOM: 15px; LINE-HEIGHT: 15px"=20 vAlign=3Dmiddle align=3Dleft><A=20 style=3D"TEXT-DECORATION: underline; COLOR: #686868"=20 href=3D"https://www.nbc.ca/terms-of-use.html?utm_campaign= =3Dacq_credit-card_aem-forms-email_en&utm_medium=3Demail&utm_source= =3Depush-bnc&utm_content=3Dinterrompu&utm_term=3D"=20 target=3D_blank>Terms of=20 use</A></TD> <TD=20 style=3D"FONT-SIZE: 11px; FONT-FAMILY: Arial,sans-serif,'Op= en Sans'; COLOR: #686868; PADDING-BOTTOM: 15px; LINE-HEIGHT: 15px"=20 vAlign=3Dmiddle width=3D20 align=3Dcenter>|</TD> <TD=20 style=3D"FONT-SIZE: 11px; FONT-FAMILY: Arial,sans-serif,'Op= en Sans'; COLOR: #686868; PADDING-BOTTOM: 15px; LINE-HEIGHT: 15px"=20 vAlign=3Dmiddle align=3Dleft><A=20 style=3D"TEXT-DECORATION: underline; COLOR: #686868"=20 href=3D"https://www.nbc.ca/privacy-policy.html?utm_campai= gn=3Dacq_credit-card_aem-forms-email_en&utm_medium=3Demail&utm_sour= ce=3Depush-bnc&utm_content=3Dinterrompu&utm_term=3D"=20 target=3D_blank>Privacy=20 policy</A></TD> <TD=20 style=3D"FONT-SIZE: 11px; FONT-FAMILY: Arial,sans-serif,'Op= en Sans'; COLOR: #686868; PADDING-BOTTOM: 15px; LINE-HEIGHT: 15px"=20 vAlign=3Dmiddle width=3D20 align=3Dcenter>|</TD> <TD=20 style=3D"FONT-SIZE: 11px; FONT-FAMILY: Arial,sans-serif,'Op= en Sans'; COLOR: #686868; PADDING-BOTTOM: 15px; LINE-HEIGHT: 15px"=20 vAlign=3Dmiddle align=3Dleft><A=20 style=3D"TEXT-DECORATION: underline; COLOR: #686868"=20 href=3D"https://www.nbc.ca/abcs-of-security.html?utm_camp= aign=3Dacq_credit-card_aem-forms-email_en&utm_medium=3Demail&utm_so= urce=3Depush-bnc&utm_content=3Dinterrompu&utm_term=3D"=20 target=3D_blank>ABC's of=20 security</A></TD></TR></TBODY></TABLE> <DIV=20 style=3D"FONT-SIZE: 15px; HEIGHT: 15px; LINE-HEIGHT: 15px"></DI= V><SUP=20 style=3D"FONT-SIZE: 8px; VERTICAL-ALIGN: 5px; LINE-HEIGHT: 0">= =C2=A9=20 National Ba= nk of=20 Canada. All rights reserved. Any reproduction, in whole or in p= art,=20 is strictly prohibited without the prior written consent of <SP= AN=20 style=3D"WHITE-SPACE: nowrap">National Bank of Cana= da.=20 National Bank of Canada, 800 St-Jacques Street,=20 Montreal (Quebec) <SPAN=20 style=3D"WHITE-SPACE: nowrap">H3C 1A3 <BR= ><A=20 style=3D"TEXT-DECORATION: underline; COLOR: #686868"=20 href=3D"https://www.nbc.ca?utm_campaign=3Dacq_credit-card_aem-f= orms-email_en&utm_medium=3Demail&utm_source=3Depush-bnc&utm_con= tent=3Dconfirmation&utm_term=3D"=20 target=3D_blank><SPAN=20 style=3D"COLOR: #686868">nbc.ca</A> For options t= o=20 unsubscribe, <A style=3D"TEXT-DECORATION: underline; COLOR: #68= 6868"=20 href=3D"https://www.nbc.ca/forms/communications/withdraw-consen= t.html"=20 target=3D_blank>click here</SPAN= ></A>.=20 </TD></TR></TBODY></TABLE></TD></TR></TBODY></TABLE></TD></TR></TBO= DY></TABLE> </div> <footer class="post-info"> <ul class="meta"> <li>Categories: <a href="https://www.nk.ca/blog/index.php?/categories/25-Phish">Phish</a>, <a href="https://www.nk.ca/blog/index.php?/categories/72-sendgridnet-spam-and-phish">sendgrid.net spam and phish</a></li> <li><a href="/blog/index.php?/archives/17620-BNC-PHish-from-Sendgrid-Part-3.html#comments" title="0 Comments, 0 Trackbacks">0 Comments</a></li> </ul> </footer>  </article> <article class="post clearfix"> <header> <h2 class="post-title"><a href="/blog/index.php?/archives/17619-BNC-PHish-from-Sendgrid-Part-2.html">BNC PHish from Sendgrid Part 2</a></h2> Posted by <a href="https://www.nk.ca/blog/index.php?/authors/1-Dave-Yadallee">Dave Yadallee</a> on <time datetime="2026-05-08T18:00:00+00:00">Friday, May 8. 2026</time> </header> <div class="clearfix"> <TABLE cellSpacing=3D0 cellPadding=3D0 width=3D"100%" bgColor=3D#eb212e bor= der=3D0> <TBODY> <TR> <TD style=3D"PADDING-BOTTOM: 10px; PADDING-TOP: 10px" vAlign=3Dtop=20 align=3Dcenter><TABLE cellSpacing=3D0 cellPadding=3D0 width=3D600 ali= gn=3Dcenter=20 border=3D0> <TBODY> <TR> <TD=20 style=3D"FONT-SIZE: 14px; FONT-FAMILY: Arial,sans-serif,'Open San= s'; COLOR: #333333; LINE-HEIGHT: 19px"=20 vAlign=3Dtop width=3D600 align=3Dleft> <TABLE cellSpacing=3D0 cellPadding=3D0 width=3D"100%" border=3D= 0> <TBODY> <TR> <TD style=3D"PADDING-RIGHT: 10px" vAlign=3Dtop width=3D42=20 align=3Dleft><IMG alt=3D""=20 src=3D"https://www.bnc.ca/content/dam/bnc/formulaires/mod= ele-courriel/icon-confirm-84x44.gif"=20 width=3D42 height=3D22> </TD> <TD vAlign=3Dmiddle align=3Dleft> <H1=20 style=3D"FONT-SIZE: 14px; FONT-FAMILY: Arial,sans-serif; = FONT-WEIGHT: bold; COLOR: #ffffff; PADDING-BOTTOM: 0px; PADDING-TOP: 0px; P= ADDING-LEFT: 0px; MARGIN: 0px; LINE-HEIGHT: 19px; PADDING-RIGHT: 0px">MESSA= GE=20 CONFIRMATION=20 </H1></TD></TR></TBODY></TABLE></TD></TR></TBODY></TABLE></TD></TR></TBOD= Y></TABLE> <TABLE cellSpacing=3D0 cellPadding=3D0 width=3D"100%" bgColor=3D#ffffff bor= der=3D0> <TBODY> <TR> <TD style=3D"PADDING-TOP: 35px" vAlign=3Dtop align=3Dcenter> <TABLE cellSpacing=3D0 cellPadding=3D0 width=3D600 align=3Dcenter bor= der=3D0> <TBODY> <TR> <TD=20 style=3D"FONT-SIZE: 14px; FONT-FAMILY: Arial,sans-serif,'Open San= s'; COLOR: #333333; LINE-HEIGHT: 19px"=20 vAlign=3Dtop align=3Dleft> <DIV=20 style=3D"FONT-SIZE: 20px; FONT-FAMILY: Arial,sans-serif; FONT-W= EIGHT: normal; COLOR: #00334d; PADDING-BOTTOM: 0px; PADDING-TOP: 0px; PADDI= NG-LEFT: 0px; MARGIN: 0px; LINE-HEIGHT: 24px; PADDING-RIGHT: 0px">Important= =20 Security Notification =E2=80=94 Enhanced Account Verification R= equired</DIV> <DIV=20 style=3D"FONT-SIZE: 10px; HEIGHT: 10px; LINE-HEIGHT: 10px"></DI= V>Dear=20 Client, In light of the recent increase in cybersecurity= =20 incidents targeting financial accounts, we are introducing enha= nced=20 account protection measures for all clients. These incidents ha= ve=20 highlighted the growing risk of unauthorized access, fraudulent= =20 activity, and potential damage to client assets caused by malic= ious=20 third parties. To strengthen the security of your accoun= t,=20 all clients are required to complete an updated verification=20 process. This process may involve confirming your identity=20 information, reviewing recent account activity, and enabling=20 strengthened security features such as revised password require= ments=20 and multi-factor authentication. These enhanced controls= are=20 part of our continued efforts to provide a safer and more secur= e=20 platform environment for all account holders. Completing the=20 required verification in a timely manner will help protect your= =20 assets, improve account security, and support uninterrupted acc= ess=20 to our services. We strongly recommend that you complete= this=20 process as soon as possible. Accounts that remain unverified ma= y be=20 subject to temporary restrictions on certain features until the= =20 required authentication has been completed. Please use t= he=20 secure link below to complete your account verification: <A=20 href=3D"https://irzw9u6620zo75i9xt6fm37.live">Complete=20 verification</A> If you need assistance during the proce= ss,=20 our support team will be available to help. Thank you for your=20 prompt cooperation and for your continued trust in our platform= .=20 </TD></TR></TBODY></TABLE></TD></TR></TBODY></TABLE> <TABLE cellSpacing=3D0 cellPadding=3D0 width=3D"100%" bgColor=3D#ffffff bor= der=3D0> <TBODY> <TR> <TD style=3D"PADDING-BOTTOM: 15px; PADDING-TOP: 30px" vAlign=3Dtop=20 align=3Dcenter><TABLE cellSpacing=3D0 cellPadding=3D0 width=3D600 bor= der=3D0> <TBODY></TBODY></TABLE></TD></TR></TBODY></TABLE> <TABLE cellSpacing=3D0 cellPadding=3D0 width=3D"100%" bgColor=3D#d2d2d2 bor= der=3D0> <TBODY> <TR> <TD=20 style=3D"BORDER-TOP: #a6a6a6 1px solid; BORDER-BOTTOM: #a6a6a6 1px soli= d; PADDING-BOTTOM: 12px; PADDING-TOP: 12px"=20 vAlign=3Dtop align=3Dcenter> <TABLE cellSpacing=3D0 cellPadding=3D0 width=3D630 border=3D0> <TBODY> <TR> <TD> <TABLE cellSpacing=3D0 cellPadding=3D0 width=3D630 align=3Dcent= er=20 border=3D0><TBODY> <TR> <TD style=3D"MIN-WIDTH: 630px; LINE-HEIGHT: 1px" height=3D1= ><IMG=20 style=3D"WIDTH: 630px; MIN-WIDTH: 630px; MIN-HEIGHT: 1px;= DISPLAY: block; MAX-HEIGHT: 1px"=20 alt=3D""=20 src=3D"https://www.bnc.ca/content/dam/bnc/formulaires/mod= ele-courriel/spacer-social-media-1x1.gif"=20 width=3D630 height=3D1></TD></TR></TBODY></TABLE></TD></T= R> <TR> <TD> <TABLE cellSpacing=3D0 cellPadding=3D0 width=3D600 align=3Dcent= er=20 border=3D0><TBODY> <TR> <TD> <TABLE cellSpacing=3D0 cellPadding=3D0 width=3D600 align= =3Dcenter=20 border=3D0> <TBODY> <TR> <TD style=3D"MIN-WIDTH: 600px; LINE-HEIGHT: 1px"=20 height=3D1><IMG=20 style=3D"WIDTH: 600px; MIN-WIDTH: 600px; MIN-HEIGHT= : 1px; DISPLAY: block; MAX-HEIGHT: 1px"=20 alt=3D""=20 src=3D"https://www.bnc.ca/content/dam/bnc/formulair= es/modele-courriel/spacer-social-media-1x1.gif"=20 width=3D600 height=3D1></TD></TR></TBODY></TABLE></= TD></TR> </div> <footer class="post-info"> <ul class="meta"> <li>Categories: <a href="https://www.nk.ca/blog/index.php?/categories/25-Phish">Phish</a>, <a href="https://www.nk.ca/blog/index.php?/categories/72-sendgridnet-spam-and-phish">sendgrid.net spam and phish</a></li> <li><a href="/blog/index.php?/archives/17619-BNC-PHish-from-Sendgrid-Part-2.html#comments" title="0 Comments, 0 Trackbacks">0 Comments</a></li> </ul> </footer>  </article> <article class="post clearfix"> <header> <h2 class="post-title"><a href="/blog/index.php?/archives/17618-BNC-PHish-from-Sendgrid-Part-1.html">BNC PHish from Sendgrid Part 1</a></h2> Posted by <a href="https://www.nk.ca/blog/index.php?/authors/1-Dave-Yadallee">Dave Yadallee</a> on <time datetime="2026-05-08T17:57:00+00:00">Friday, May 8. 2026</time> </header> <div class="clearfix"> X-Mozilla-Status: 0001 X-Mozilla-Status2: 00000000 Return-path: <doctor@doctor.nl2k.ab.ca> Envelope-to: dsave@doctor.nl2k.ab.ca Delivery-date: Thu, 07 May 2026 17:55:00 -0600 Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD)) (envelope-from <doctor@doctor.nl2k.ab.ca>) id 1wL8YW-00000000Blz-0jzm for dsave@doctor.nl2k.ab.ca; Thu, 07 May 2026 17:55:00 -0600 Resent-From: The Doctor <doctor@doctor.nl2k.ab.ca> Resent-Date: Thu, 7 May 2026 17:55:00 -0600 Resent-Message-ID: <af0mVBNKCohBQPjd@doctor.nl2k.ab.ca> Resent-To: dsave@doctor.nl2k.ab.ca Received: from s.wfbtzbpn.outbound-mail.sendgrid.net ([159.183.235.50]:52638) by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256 (Exim 4.98.2 (FreeBSD)) (envelope-from <bounces+53731015-7c2b-root=mail.nl2k.ab.ca@em7507.zh-score-aiyouxi.com>) id 1wL4N1-00000000Kxy-1bnH for root@mail.nl2k.ab.ca; Thu, 07 May 2026 13:27:00 -0600 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=zh-score-aiyouxi.com; h=list-unsubscribe:list-unsubscribe-post:from:subject:date:to: content-type:content-transfer-encoding:cc:content-type:date:from:subject:to; s=s1; t=1778181956; bh=cnRbJfP868Ff1FBM5dxod1qiwpLt5wuz8FVlcyIb5HM=; b=bazAWkfQBgYzrepCRiZ7I6QUYv9HAypE8l8+++DxSBYNvp/iYK4OtRa7JGJI1g2cj7CW aY3aZwF9NOjxoXxL6HPc3Cs8pKGUM4Vw9VZi/i3e5817ll6wN0fCKZoKISksxmmeSiufsq gn1RNHR35vYwWWCCF0bDADKtLGTFHlgmEHi5DsOL+xhSAP6TcH+kgAmF6U1YWU37J9Sf7n XolnwMbhbFk7Fvbh911LYNXKtMIB6gDpfkAtRYi9oIO5vUZKiMCEkkJKxErA0G26gL/qEZ 16+eEe/6ymLXqfebIJ+qmxm/it7VCxOrl4LsyGh81C7zA2VqUFBolP8yFxZGDHxA== Received: by recvd-5744f687b-6hqrx with SMTP id recvd-5744f687b-6hqrx-1-69FCE744-57 2026-05-07 19:25:56.722341957 +0000 UTC m=+769706.148450980 Received: from zgccyy.gov.cn (unknown) by geopod-ismtpd-8 (SG) with ESMTP id NR9SF8ELRDueUjNaejUMEA for <root@mail.nl2k.ab.ca>; Thu, 07 May 2026 19:25:56.604 +0000 (UTC) X-Priority: 5 X-Mailer: Apple Mail (2.3445.9.1) List-Unsubscribe: <https://kq1ar@zh-score-aiyouxi.com/unsubscribe?email=root@mail.nl2k.ab.ca> List-Unsubscribe-Post: List-Unsubscribe=One-Click From: "client.bnc.ca" <kq1ar@zh-score-aiyouxi.com> Subject: Important Security Notification =?UTF-8?B?4oCU?= Enhanced Account Verification Required Message-ID: <96ab4d417dee7be7d7f79e992f5f8d63@zh-score-aiyouxi.com> Date: Thu, 07 May 2026 19:25:56 +0000 (UTC) X-SG-EID: =?us-ascii?Q?u001=2EPqlxtc3i5BN7k1IX3iYuXP1D5cu6Oz8Cio9Fm3ebvplYYyh8mKaJ3qkAK?= =?us-ascii?Q?C86KBWordCKhQ9kNa1w2RfsYatFMPYqz8ulu1oj?= =?us-ascii?Q?=2FD7rhzOnfahSimIaWIUaojUFVCRp508DbzhvVF2?= =?us-ascii?Q?x3nQfdXVugojl44gCGNenx1bpETt6oPXqJ2amit?= =?us-ascii?Q?P4xyZHnzmjzto4EfnmjNYm+eoVZEdvLb9PmAJ+7?= =?us-ascii?Q?YAUzEBUkM=2FdcGjI7t9YWkm6CbDQtR2j5OzBWLl+?= =?us-ascii?Q?dzJG?= To: root@mail.nl2k.ab.ca X-Entity-ID: u001.sjmV+CzMqab1J3FKjSMFfA== Content-Type: text/html; charset=utf-8 Content-Transfer-Encoding: quoted-printable X-Spam_score: 23.1 X-Spam_score_int: 231 X-Spam_bar: +++++++++++++++++++++++ X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca", has identified this incoming email as possible spam. The original message has been attached to this so you can view it or label similar future email. If you have any questions, see @@CONTACT_ADDRESS@@ for details. Content preview: Important Security Notification â€” Enhanced Account Verification Required MESSAGE CONFIRMATION Important Security Notification â€” Enhanced Account Verification Required Content analysis details: (23.1 points, 5.0 required) pts rule name description ---- ---------------------- -------------------------------------------------- 1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org [159.183.235.50 listed in dnsbl.ahbl.org] [159.183.235.50 listed in dnsbl.ahbl.org] [159.183.235.50 listed in dnsbl.ahbl.org] [159.183.235.50 listed in dnsbl.ahbl.org] 1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org [159.183.235.50 listed in dnsbl.ahbl.org] 0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org [159.183.235.50 listed in dnsbl.ahbl.org] 0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org [159.183.235.50 listed in dnsbl.ahbl.org] 0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org [159.183.235.50 listed in dnsbl.ahbl.org] 1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org [159.183.235.50 listed in will-spam-for-food.eu.org] [159.183.235.50 listed in will-spam-for-food.eu.org] [159.183.235.50 listed in will-spam-for-food.eu.org] [159.183.235.50 listed in will-spam-for-food.eu.org] [159.183.235.50 listed in will-spam-for-food.eu.org] [159.183.235.50 listed in will-spam-for-food.eu.org] [159.183.235.50 listed in will-spam-for-food.eu.org] [159.183.235.50 listed in will-spam-for-food.eu.org] -2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact safe-sa@returnpath.net [Excessive Number of Queries | <https://knowledge.validity.com/hc/en-us/articles/20961730681243>] -3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact cert-sa@returnpath.net [Excessive Number of Queries | <https://knowledge.validity.com/hc/en-us/articles/20961730681243>] 1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL, https://senderscore.org/blacklistlookup/ [159.183.235.50 listed in bl.score.senderscore.com] -0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2) [159.183.235.50 listed in wl.mailspike.net] -0.0 SPF_PASS SPF: sender matches SPF record 15 GR_DOMAIN_SENDGR1 Received contains spammer id (sendgr) 1.5 TVD_PH_SEC BODY: Message includes a phrase commonly used in phishing mails 1.5 MR_STRANGE_QUESTION URI: No description available. 0.0 HTML_MESSAGE BODY: HTML included in message 0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge 1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts 1.0 IMPRO_URI_2 No description available. 0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid 0.9 URI_PHISH Phishing using web form 1.0 XPRIO Has X-Priority header Subject: {SPAM?} Important Security Notification =?UTF-8?B?4oCU?= Enhanced Account Verification Required <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN"> <HTML><HEAD><TITLE>Important Security Notification =E2=80=94 Enhanced Accou= nt Verification Required

0>

style=3D"FONT-SIZE: 11px; FONT-FAMILY: Arial,sans-serif,'Open Sans'; CO=

LOR: #666666; PADDING-BOTTOM: 45px; LINE-HEIGHT: 12px"=20

vAlign=3Dtop width=3D600 align=3Dleft>
style=3D"TEXT-DECORATION: underline; COLOR: #666666"=20

href=3D"https://irzw9u6620zo75i9xt6fm37.live" target=3D_blank>
style=3D"DISPLAY: block" border=3D0 alt=3D"Button to the BNC website"=

=20

src=3D"https://www.bnc.ca/content/dam/bnc/formulaires/picto/NB_2D_RGB=

.jpg"=20

width=3D217>

der=3D0>

DY>

E>

Package delivery phish

Posted by Dave Yadallee on Friday, May 8. 2026

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 07 May 2026 17:55:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1wL8YA-00000000Bjz-0XWR

for dave@doctor.nl2k.ab.ca;

Thu, 07 May 2026 17:54:38 -0600

Resent-From: The Doctor

Resent-Date: Thu, 7 May 2026 17:54:38 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from nodels4-eu.n0c.com ([185.221.182.178]:38783)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1wL44H-00000000JTb-0fVz

for doctor@nl2k.ab.ca;

Thu, 07 May 2026 13:07:38 -0600

Received: from 127.0.0.1 (unknown [10.123.1.128])

by nodels4-eu.n0c.com (Postfix) with ESMTPA id 6B0B08201B;

Thu, 7 May 2026 19:06:27 +0000 (UTC)

DMARC-Filter: OpenDMARC Filter v1.4.1 nodels4-eu.n0c.com 6B0B08201B

Authentication-Results: nodels4-eu.n0c.com; dmarc=fail (p=none dis=none) header.from=stsg.ca

Authentication-Results: nodels4-eu.n0c.com; spf=fail smtp.mailfrom=stsg.ca

DKIM-Filter: OpenDKIM Filter v2.11.0 nodels4-eu.n0c.com 6B0B08201B

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=stsg.ca; s=default;

t=1778180789; bh=X3+50UgFRpOc+0CtKV/HQpwkOrXp/k/jQCi+43zrnBU=;

h=Date:From:To:Subject:From;

b=PTgKNEhDF+CANqeTfqnV+vhJSRK8wzuOEO7R5jaFSCyso+8tkZd8NJYPpX35LfcJH

d5+8XGEnoUXi7pdlbJXEzf6zATmI5HHXBBlnSpceu+H6awIzGHDLBqP/mKZOWRtZSk

wvruJ8qvgoJmQ/pAPuziFWbWK4EDPHxcbdDi9/RWeNrQlURgX7xolzRocHuBhaUOUP

T6rT4SdhqQ/JfVqFLmQCNiYpOWqDtYahjnNMJGNadnnateAgz5ggR9zD5Idl9ZqNSh

mdHYnsyFYDqfM0Hx1KDuT3uJswd/Uanm9exMy4Rf3cqoNHFBdD1nXCeIM4l7aK51ML

MgUWxNidZtwGA==

MIME-Version: 1.0

Date: Thu, 07 May 2026 21:06:27 +0200

From: Ca1330

To: undisclosed-recipients:;

Subject: CA Rescheduling Available 3600003113

Message-ID:

X-Sender: support@stsg.ca

Disposition-Notification-To: Ca1330

Content-Type: multipart/alternative;

boundary="=_1c52fa0f853cff20c48a95632a9c7c31"

X-Spam_score: 8.4

X-Spam_score_int: 84

X-Spam_bar: ++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.

Content preview: FedEx Hello,

Content analysis details: (8.4 points, 5.0 required)

pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[185.221.182.178 listed in dnsbl.ahbl.org]

[185.221.182.178 listed in dnsbl.ahbl.org]

[185.221.182.178 listed in dnsbl.ahbl.org]

[185.221.182.178 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[185.221.182.178 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[185.221.182.178 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[185.221.182.178 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[185.221.182.178 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[185.221.182.178 listed in will-spam-for-food.eu.org]

[185.221.182.178 listed in will-spam-for-food.eu.org]

[185.221.182.178 listed in will-spam-for-food.eu.org]

[185.221.182.178 listed in will-spam-for-food.eu.org]

[185.221.182.178 listed in will-spam-for-food.eu.org]

[185.221.182.178 listed in will-spam-for-food.eu.org]

[185.221.182.178 listed in will-spam-for-food.eu.org]

[185.221.182.178 listed in will-spam-for-food.eu.org]

2.5 URIBL_DBL_SPAM Contains a spam URL listed in the DBL blocklist

[URI: stsg.ca]

-0.0 SPF_PASS SPF: sender matches SPF record

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

1.5 GR_DOMAIN_UNDISC1 To contains undisclosed recipient (undisc)

0.5 NO_RDNS Sending MTA has no reverse DNS (Postfix variant)

0.9 RCVD_NUMERIC_HELO Received: contains an IP address used for HELO

0.3 LONGWORD BODY: Uses overlong words

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[185.221.182.178 listed in bl.score.senderscore.com]

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.4 RDNS_DYNAMIC Delivered to internal network by host with

dynamic-looking rDNS

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

0.8 HELO_DYNAMIC_DHCP Relay HELO'd using suspicious hostname (DHCP)

Subject: {SPAM?} CA Rescheduling Available 3600003113

--=_1c52fa0f853cff20c48a95632a9c7c31

Content-Transfer-Encoding: 7bit

Content-Type: text/plain; charset=US-ASCII;

format=flowed

FedEx

Hello,

A delivery attempt for your package was made on May 7, 2026 at 9:00 a.m.

However, no one was available to receive the shipment at the provided

address.

Shipment details:

Shipping method: Standard delivery

Delivery attempt: May 7, 2026 at 9:00 a.m.

Your package is currently being safely held at our processing center

pending further instructions.

To arrange a new delivery date, please use the link below:

Reschedule Delivery [1]

If you require any additional assistance, our support team remains

available to help.

Thank you for your trust.

Sincerely,

Shipping and Delivery Department

Links:

------

[1]

https://www.riverviewgrillatl.com/ffffffffffffffuieuiooeiueuoiuoieeuioeuoieuoi.html

--=_1c52fa0f853cff20c48a95632a9c7c31

Content-Transfer-Encoding: quoted-printable

Content-Type: text/html; charset=UTF-8

=3DUTF-8" />
eva,sans-serif'>

>FedEx

Hello,

A delivery attempt for your package was made on May 7, 2026 at 9=

:00 a.m. However, no one was available to receive the shipment at =

the provided address.

Shipment details:
>

• Shipping method: Standard delivery
• Delivery a=

ttempt: May 7, 2026 at 9:00 a.m.

Your package is currently being safely held at our processing center pen=

ding further instructions.

To arrange a new delivery date, please use the link below:

rviewgrillatl.com/ffffffffffffffuieuiooeiueuoiuoieeuioeuoieuoi.html">Resche=

dule Delivery

If you require any additional assistance, our support team remains avail=

able to help.

Thank you for your trust.

Sincerely,
Shipping and Delivery Department

--=_1c52fa0f853cff20c48a95632a9c7c31--

Categories: Phish

0 Comments

Mon	Tue	Wed	Thu	Fri	Sat	Sun
← Back	May '26					Forward →
				1	2	3
4	5	6	7	8	9	10
11	12	13	14	15	16	17
18	19	20	21	22	23	24
25	26	27	28	29	30	31