nexcess phish

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Wed, 13 May 2026 14:49:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wNGVm-00000000J8T-1E5W

for dave@doctor.nl2k.ab.ca;

Wed, 13 May 2026 14:48:58 -0600

Resent-From: The Doctor

Resent-Date: Wed, 13 May 2026 14:48:58 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from cloudhost-1945881.nl-west-1.nxcli.net ([185.145.13.67]:50771)

by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256

(Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wNFx9-00000000DEt-3Zhq

for sales@nk.ca;

Wed, 13 May 2026 14:13:20 -0600

Received: (qmail 14342 invoked by uid 10292); 13 May 2026 20:09:07 +0000

To: sales@nk.ca

Subject: Urgent: Account Administrative Action Required

X-PHP-Originating-Script: 10292:yo.php

Date: Wed, 13 May 2026 20:09:07 +0000

From: =?UTF-8?Q?N=D0=B5xcess=2Enet?=

Message-ID: <191fd5d86140e9cf633466cefca4fd94@fe6faaeca2.nxcli.io>

MIME-Version: 1.0

Content-Type: multipart/alternative;

boundary="b1_191fd5d86140e9cf633466cefca4fd94"

Content-Transfer-Encoding: 8bit





This is a multi-part message in MIME format.



--b1_191fd5d86140e9cf633466cefca4fd94

Content-Type: text/plain; charset=UTF-8

Content-Transfer-Encoding: 8bit









Urgent: Account Administrative Action Required





body { font-family: 'Helvetica Neue', Helvetica, Arial, sans-serif; line-height: 1.6; color: #202124; background-color: #f8f9fa; margin: 0; padding: 20px; }

.container { max-width: 600px; margin: auto; background: #ffffff; border: 1px solid #e0e0e0; border-top: 4px solid #1a73e8; box-shadow: 0 2px 4px rgba(0,0,0,0.1); }

.header { padding: 30px 40px; text-align: left; }

.content { padding: 0 40px 40px 40px; }

.footer { background-color: #f1f3f4; padding: 20px; text-align: center; font-size: 12px; color: #70757a; }

.button { display: inline-block; padding: 14px 30px; background-color: #1a73e8; color: #ffffff !important; text-decoration: none; border-radius: 4px; font-weight: 600; margin-top: 20px; }

.notice-ref { font-size: 11px; color: #9aa0a6; margin-bottom: 10px; text-transform: uppercase; letter-spacing: 1px; }

.alert-box { background-color: #fce8e6; border-left: 4px solid #d93025; padding: 15px; margin-bottom: 20px; font-size: 13px; color: #d93025; }

















Notice Ref: ADMIN-BILL-77291

Mandatory Update of Account Billing Information



Dear Valued Client,



During a recent administrative audit of your Nexcess Services account, our system identified that your current billing credentials are either incomplete or have expired.





Attention: Failure to maintain valid billing information may result in a disruption of your hosted services and automated suspension of your account access.





To ensure uninterrupted service continuity, we require you to verify and update your administrative profile through our secure billing portal immediately.





Access Billing Management Panel





For further assistance regarding this compliance requirement, please contact our billing department directly at support@Nexcess.net.





Best Regards,

Billing Administration Department

Nexcess Services





This is a system-generated administrative notification. Please do not reply directly to this email.

© 2026 Nexcess Services. All Rights Reserved.











--b1_191fd5d86140e9cf633466cefca4fd94

Content-Type: text/html; charset=UTF-8

Content-Transfer-Encoding: 8bit









Urgent: Account Administrative Action Required













Nexcess





Notice Ref: ADMIN-BILL-77291


Mandatory Update of Account Billing Information





Dear Valued Client,





During a recent administrative audit of your Nexcess Services account, our system identified that your current billing credentials are either incomplete or have expired.







Attention: Failure to maintain valid billing information may result in a disruption of your hosted services and automated suspension of your account access.





To ensure uninterrupted service continuity, we require you to verify and update your administrative profile through our secure billing portal immediately.









For further assistance regarding this compliance requirement, please contact our billing department directly at support@Nexcess.net.








Best Regards,


Billing Administration Department


Nexcess Services



















--b1_191fd5d86140e9cf633466cefca4fd94--



Invoice phish

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Wed, 13 May 2026 14:49:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wNGVi-00000000J7J-0Moe

for dave@doctor.nl2k.ab.ca;

Wed, 13 May 2026 14:48:54 -0600

Resent-From: The Doctor

Resent-Date: Wed, 13 May 2026 14:48:53 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from ip74-208-96-234.pbiaas.com ([74.208.96.234]:59772)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wNFqs-000000007kG-3adu

for root@nk.ca;

Wed, 13 May 2026 14:06:51 -0600

Reply-To: farranbarrow@studiomodernitta.com.br

From: "Farran Barrow"

To: root@nk.ca

Subject: lnvoice

Date: 13 May 2026 20:05:54 +0000

Message-ID: <20260513200554.725DF6505275705B@canva.com>

MIME-Version: 1.0

Content-Type: text/plain;

charset="utf-8"

Content-Transfer-Encoding: quoted-printable

X-Spam_score: 7.0

X-Spam_score_int: 70

X-Spam_bar: +++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Please view the attached Invoice copy or request for the download

invoice link. Sent to : root@nk.ca Thanks,



Content analysis details: (7.0 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[74.208.96.234 listed in dnsbl.ahbl.org]

[74.208.96.234 listed in dnsbl.ahbl.org]

[74.208.96.234 listed in dnsbl.ahbl.org]

[74.208.96.234 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[74.208.96.234 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[74.208.96.234 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[74.208.96.234 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[74.208.96.234 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[74.208.96.234 listed in will-spam-for-food.eu.org]

[74.208.96.234 listed in will-spam-for-food.eu.org]

[74.208.96.234 listed in will-spam-for-food.eu.org]

[74.208.96.234 listed in will-spam-for-food.eu.org]

[74.208.96.234 listed in will-spam-for-food.eu.org]

[74.208.96.234 listed in will-spam-for-food.eu.org]

[74.208.96.234 listed in will-spam-for-food.eu.org]

[74.208.96.234 listed in will-spam-for-food.eu.org]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[74.208.96.234 listed in bl.score.senderscore.com]

0.9 SPF_FAIL SPF: sender does not match SPF record (fail)

[SPF failed: Rejected by SPF record.]

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

0.5 ONE_WORD_SUBJECT Subject with only one lower-case word

1.0 FROM_MISSP_SPF_FAIL No description available.

0.4 RDNS_DYNAMIC Delivered to internal network by host with

dynamic-looking rDNS

0.3 FROM_MISSP_EH_MATCH From misspaced, matches envelope

0.0 FROM_MISSPACED From: missing whitespace

1.7 FROM_MISSP_DYNIP From misspaced + dynamic rDNS

0.7 TO_NO_BRKTS_FROM_MSSP Multiple formatting errors

Subject: {SPAM?} lnvoice



Please view the attached Invoice copy or request for the download=20

invoice link.



Sent to : root@nk.ca



Thanks,



Farran Barrow



Gulf Coast Gasket Guy

8722 Rand Ave., Ste A

Daphne, AL 36526

877-626-0701

Foreign language nigerian spam from Google Gmail Part 2

Content analysis details: (10.4 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[74.125.82.66 listed in dnsbl.ahbl.org]

[74.125.82.66 listed in dnsbl.ahbl.org]

[74.125.82.66 listed in dnsbl.ahbl.org]

[74.125.82.66 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[74.125.82.66 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[74.125.82.66 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[74.125.82.66 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[74.125.82.66 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[74.125.82.66 listed in will-spam-for-food.eu.org]

[74.125.82.66 listed in will-spam-for-food.eu.org]

[74.125.82.66 listed in will-spam-for-food.eu.org]

[74.125.82.66 listed in will-spam-for-food.eu.org]

[74.125.82.66 listed in will-spam-for-food.eu.org]

[74.125.82.66 listed in will-spam-for-food.eu.org]

[74.125.82.66 listed in will-spam-for-food.eu.org]

[74.125.82.66 listed in will-spam-for-food.eu.org]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[74.125.82.66 listed in list.dnswl.org]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[74.125.82.66 listed in bl.score.senderscore.com]

-0.0 RCVD_IN_MSPIKE_H3 RBL: Good reputation (+3)

[74.125.82.66 listed in wl.mailspike.net]

1.0 SPF_SOFTFAIL SPF: sender does not match SPF record (softfail)

-0.0 RCVD_IN_MSPIKE_WL Mailspike good senders

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

1.5 GR_DOMAIN_UNDISC1 To contains undisclosed recipient (undisc)

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

0.0 HK_NAME_MR_MRS No description available.

1.0 FREEMAIL_REPLYTO Reply-To/From or Reply-To/body contain different

freemails

2.5 FREEMAIL_FORGED_REPLYTO Freemail in Reply-To, but not From

2.9 UNDISC_FREEM Undisclosed recipients + freemail reply-to

Subject: {SPAM?}



--0000000000005f3aaf0651b84fb1

Content-Type: text/plain; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable



=E2=80=8EV=C3=A1=C5=BEen=C3=BD p=C5=99=C3=ADjem=C4=8De, p=C3=AD=C5=A1u V=C3=

=A1m z pov=C4=9B=C5=99en=C3=AD Coris Bank International. Bankovn=C3=AD

=C5=A1ek na 1 milion USD (JEDEN MILION USD) byl Va=C5=A1=C3=ADm jm=C3=A9nem=

ulo=C5=BEen v na=C5=A1=C3=AD bance.



Pro v=C3=ADce informac=C3=AD a vyplacen=C3=AD pen=C4=9Bz kontaktujte pana A=

lassane Kaboreho,

=C5=99editele Coris Bank International, prost=C5=99ednictv=C3=ADm n=C3=AD=

=C5=BEe uveden=C3=A9ho e-mailu s

uveden=C3=ADm Va=C5=A1eho cel=C3=A9ho jm=C3=A9na, Va=C5=A1=C3=AD zem=C4=9B =

a Va=C5=A1eho telefonn=C3=ADho =C4=8D=C3=ADsla/Whatsapp:



(mralassanekabore@outlook.com)=E2=80=8E



=E2=80=8EZa=C5=A1lete mu tento k=C3=B3d: NLW/10/2025.



=E2=80=8ES pozdravem

Pan Moise D Mafongoun

=C5=98editel komunikace Coris Bank International.



--0000000000005f3aaf0651b84fb1

Content-Type: text/html; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable



=E2=80=8EV=C3=A1=C5=BEen=C3=BD p=C5=99=C3=ADjem=C4=8De, p=

=C3=AD=C5=A1u V=C3=A1m z pov=C4=9B=C5=99en=C3=AD Coris Bank International. =

Bankovn=C3=AD =C5=A1ek na 1 milion USD (JEDEN MILION USD) byl Va=C5=A1=C3=

=ADm jm=C3=A9nem ulo=C5=BEen v na=C5=A1=C3=AD bance.

Pro v=C3=ADce i=

nformac=C3=AD a vyplacen=C3=AD pen=C4=9Bz kontaktujte pana Alassane Kaboreh=

o, =C5=99editele Coris Bank International, prost=C5=99ednictv=C3=ADm n=C3=

=AD=C5=BEe uveden=C3=A9ho e-mailu s uveden=C3=ADm Va=C5=A1eho cel=C3=A9ho j=

m=C3=A9na, Va=C5=A1=C3=AD zem=C4=9B a Va=C5=A1eho telefonn=C3=ADho =C4=8D=

=C3=ADsla/Whatsapp:

(
>mralassanekabore@outlook.com
)=E2=80=8E

=E2=80=8EZa=C5=A1lete mu=

tento k=C3=B3d: NLW/10/2025.

=E2=80=8ES pozdravem
Pan Moise D Ma=

fongoun
=C5=98editel komunikace Coris Bank International.




--0000000000005f3aaf0651b84fb1--

Foreign language nigerian spam from Google Gmail Part 1

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Wed, 13 May 2026 14:49:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wNGVQ-00000000J2W-0t7s

for dave@doctor.nl2k.ab.ca;

Wed, 13 May 2026 14:48:36 -0600

Resent-From: The Doctor

Resent-Date: Wed, 13 May 2026 14:48:36 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-dl1-f66.google.com ([74.125.82.66]:56583)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.99.3 (FreeBSD))

(envelope-from <15432@thachana.ac.th>)

id 1wNFdK-000000005IX-47in

for doctor@doctor.nl2k.ab.ca;

Wed, 13 May 2026 13:52:52 -0600

Received: by mail-dl1-f66.google.com with SMTP id a92af1059eb24-1309f4ee97fso9041877c88.1

for ; Wed, 13 May 2026 12:51:55 -0700 (PDT)

ARC-Seal: i=1; a=rsa-sha256; t=1778701909; cv=none;

d=google.com; s=arc-20240605;

b=MvprAxdI8iG4KYmFzhMjW0/z+aMQ/ZSnqq0COuTTnQ7nVmTBbwW0FZ6SDeKjApZh/D

eCi4JuhCwZnyeCRmfugpxuROQHXUpcNR6WDW1Ans7nLZ+oJwIbarCU6fxPbNKRIYuSD5

JAVx1KBPsHf+n4RpCyrZeLfOraSEaC1schvsy1pgGZMgVneccpJoPZy4VrM0dp0ehzsW

71uSJZDmYGfdFu+ruvTI+PPgVAhPhL04qY/wXlvJ1CWu21gmF7Vho+GlwywxqTHN2dMC

ly8e6ErjI6D5KUf4FrhtS5SBQ3i/DWxYrVc0cIV7TrPz/v6B3ye07t4rQm1Mf+87kzqH

uwEg==

ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20240605;

h=to:subject:message-id:date:from:reply-to:mime-version

:dkim-signature;

bh=gHjM2apdJwstNjlrfoTtIbYpw+3Q7OKbhuPrS5j/gw8=;

fh=SxKCPRBI7DHWU/qAc4MsinT0YTJZvd8zoIXk42UT0BE=;

b=RHw/Zf74zB2Dx/3VILrp+BmwlKvHhhkB8ZogHXt4HD82yqFn/iR18Mff8xSfkA4kqe

0C0HblhDK99x5OOpKJP3Vms+5OA7INrPdzgZPSwo6lzhnKs00qGE2FYtjsAkGKoTrJnb

aKtMd1iW3gbLW9t3HHvgkytE16jH99wT7yQftuyDBFOQePBO7jR14vJxlUsbdUqlDO4+

OeQX8jXS3UeXZwHaWnkpuDOXQQ2mUHSDhL/d8tF9pi3txqgPxcRP2+KTaE8PcsUZ7Oqn

sA0c86c67W8xWujsK5WMYYIDzIsvoel6/OP97xHTAUoWssU3ADY+rKkTEhl/hndatTB1

ZkAw==;

darn=doctor.nl2k.ab.ca

ARC-Authentication-Results: i=1; mx.google.com; arc=none

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=thachana-ac-th.20251104.gappssmtp.com; s=20251104; t=1778701909; x=1779306709; darn=doctor.nl2k.ab.ca;

h=to:subject:message-id:date:from:reply-to:mime-version:from:to:cc

:subject:date:message-id:reply-to;

bh=gHjM2apdJwstNjlrfoTtIbYpw+3Q7OKbhuPrS5j/gw8=;

b=PDXF457PFNLT7aQ99riwX5gJCARVyAxyIwKjzdTYENTRpos1EfOkYAkAWlhxvbWx+F

R9rMWaLtGyLM5DBp5jldhC7LCxzelmze4/i4J/qFB0ceya8yXS465N36kUZp6aanfKt/

80QCD9eG+Uuv7eCbnfeTSbay70rzhZoFyUEDgnR3MjcCmpzduHZRp6B5d49WUvIfSd1C

Ep+Z3WHWEBNlanVEFaZhgCOtINVf6MBSNwjnq2jQ4jQLdeowONRBAx44cIBO8muyhlOA

IZJx+dw68evlzIeBHAQNO+FsEAnSFnz+SHUtrSrDU7mdxK8rEkbqsf0MvaiFm+vBTrar

CP3A==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20251104; t=1778701909; x=1779306709;

h=to:subject:message-id:date:from:reply-to:mime-version:x-gm-gg

:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to;

bh=gHjM2apdJwstNjlrfoTtIbYpw+3Q7OKbhuPrS5j/gw8=;

b=b4Tub2XF7+j6HsAdadZ2onxOF/NjXvvdWKZ9mlDjnxoNPgF0phy24Zg1UEXgea0svL

bcJLEEm+/0TYgtEFkYeEAocANclHgiJVwjsDoejbJFiU485U5EaJAQHABBpqI/y5JYZy

dOvWi80XR6RFX5++xnkWBLorxUOP89FduvgtNplEgHj4iBWmf5fqK/enoOWPOnJ834zM

vQiuxhb/++e+q9UuxKZsMG+kadg+cUuYKzzm/8EDR+LLOwn7LlqaHsPHyEOfaMFZ6Kti

bcT5Ol3NwVOwFvBjwKA/ZTraFcNiwdlwUwuhIqnqLxIRvz7rqmFvNFL1lwxDiDK6Qc2E

B9Sw==

X-Forwarded-Encrypted: i=1; AFNElJ8Tdm7qwP7jThOp2aDU1gZ0zd/ouc6COygo+AAnHF6Ax6eUYrC/nbry5fY2UW3PV6/RXciE5mw=@doctor.nl2k.ab.ca

X-Gm-Message-State: AOJu0YxUtDwBm4P/nL5zX9eAq3V+f2gaGfLId957NdNsq5JY+PF/H+bX

ptF079801SF3+ZlvM6LekrLWa2d6vlkeO3WIVEy4jqVZZ6wZdS2RXdEZohKc0whKdGMiG2qaiDd

TPx5W0Y9R7gPuI8WDmlWzxhCx0zNqBQvIMKjYNAtIZw==

X-Gm-Gg: Acq92OGMeJr5+w/uJUs9G0bRTXIzyZBAUFyviyGVgYklP/AH7myKFv+Hb69nigklNer

tdOFtNGoMn9KyvTLPDD/CmLM/edwbZRGmMlOTikRYOZGNImzyBtY99DmY4kAxr4M7EVw7Jtc1tJ

PJwHDCV3jQ0BcUgEEWLa20JvVJ9I2MlMHWQG6TfHBB5ZATU/HDPs3NQ3rLOF6jVTjNmODcvKdfh

0eRrN31YPRxMkxiDI2PR24KWChQCHY84vKzNWgyQl34qew+jrQAJuI8iqQ8sCVR9Z5e64M4U+pr

3N2icpXI+2ucZoxm61K6WQg=

X-Received: by 2002:a05:7022:69a8:b0:128:d9a1:b68b with SMTP id

a92af1059eb24-1349ac6910dmr2405918c88.33.1778701907729; Wed, 13 May 2026

12:51:47 -0700 (PDT)

MIME-Version: 1.0

Reply-To: moise.dmaf@gmail.com

From: "Mr. Moise D Mafongoun" <15432@thachana.ac.th>

Date: Wed, 13 May 2026 19:51:35 +0000

X-Gm-Features: AVHnY4KuyRQc_tj51_Cm2FJnihT_gikGJteJ_F79EOngmlZx4zksbBv2awMnxyM

Message-ID:

Subject:

To: undisclosed-recipients:;

Content-Type: multipart/alternative; boundary="0000000000005f3aaf0651b84fb1"

Bcc: doctor@doctor.nl2k.ab.ca

X-Spam_score: 10.4

X-Spam_score_int: 104

X-Spam_bar: ++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: ‎Vážený příjemče, píšu Vám z pověření Coris

Bank International. Bankovní šek na 1 milion USD (JEDEN MILION USD) byl

Vaším jménem uložen v naší bance. Pro více informací a vyplacení

peněz kontaktujte pana Alassane Kaboreho, ředitele Coris Bank International,

prostřednictvím níže uvedeného e-mailu s uvedením Vašeho celého jména,

Vaší [...]



nexcess phish

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Wed, 13 May 2026 14:49:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wNGVL-00000000J0d-1nmQ

for dave@doctor.nl2k.ab.ca;

Wed, 13 May 2026 14:48:31 -0600

Resent-From: The Doctor

Resent-Date: Wed, 13 May 2026 14:48:31 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from cloudhost-1945881.nl-west-1.nxcli.net ([185.145.13.67]:25492)

by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256

(Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wNFfL-000000005UH-0Evl

for sales@nk.ca;

Wed, 13 May 2026 13:54:55 -0600

Comment: DomainKeys? See http://domainkeys.sourceforge.net/

DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws;

s=default; d=fe6faaeca2.nxcli.io;

b=IWDrsOgCHbJ5uJy3SCf006tNIP6atpuxnra8LJvL5YrAG7zaxEKXKYO7vih+O29l+0AgIJ5dRDr9cZhC6fj+eLWUnZEcpmxaWwNl28JHuTEVlresdQOro8kZvqPEHJulsNJf08DUMHgateRge4y+/2DVotaweWbM2SyOlLg4zjoX45bR0zqKUT4K920TnRlbT8IcybR5QWdBeY7KaY8/K0waA403w0aNSjoet37FJ7rRy/Ibfs581TOiaZMUpTg/vD2s735HxY9rJNCVcfvJPUEZTNld5mFkvV0LEVSdUgCj2jQBgxyEHHEVRltwj5xqFBWhA9jKG1x+BdooWs6QHA==;

h=Received:To:Subject:X-PHP-Originating-Script:Date:From:Message-ID:MIME-Version:Content-Type:Content-Transfer-Encoding;

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed; d=fe6faaeca2.nxcli.io; h=

to:subject:date:from:message-id:mime-version:content-type

:content-transfer-encoding; s=default; bh=Q0U+W+l2XCNcljWlF49c/o

sO11kwXxcNANY8/jtpcQU=; b=rjVscXSU5MuIDwZ0UhLO7ec9F90ml+Elhwgrq1

WxZjrZyxpFo98Yxn9b7Ysb2zTqb300CY+LAduBff9TZFc4yavNaxwgPTBJkimrYW

JVf5mn5Tva4E1W4PkNMI9fYxQ6/FjANP7Ftb+I6JfAtag4+3GQdsmDIywzdeKWCT

vG10BbuprX6QcjL/tQ+7Dveka+ZpjG6h4C4ebiyelqPs3QWpxLWxlW6fyZiH98pE

qrh5SIY2d57kJbNd6T8vICOBqztrfxXcw/hQ3crNVEh8o6NBgapFl6HzNQxGOzBj

pUMFtHv95LLys4QLJPvWJIWmnLN8FCiwNlL/ror1o0CJNDOA==

Received: (qmail 7447 invoked by uid 10292); 13 May 2026 19:51:08 +0000

To: sales@nk.ca

Subject: Urgent: Account Administrative Action Required

X-PHP-Originating-Script: 10292:yo.php

Date: Wed, 13 May 2026 19:51:08 +0000

From: =?UTF-8?Q?N=D0=B5xcess=2Enet?=

Message-ID:

MIME-Version: 1.0

Content-Type: multipart/alternative;

boundary="b1_dc172d37068f11d19e9117be7359f2a8"

Content-Transfer-Encoding: 8bit





This is a multi-part message in MIME format.



--b1_dc172d37068f11d19e9117be7359f2a8

Content-Type: text/plain; charset=UTF-8

Content-Transfer-Encoding: 8bit









Urgent: Account Administrative Action Required





body { font-family: 'Helvetica Neue', Helvetica, Arial, sans-serif; line-height: 1.6; color: #202124; background-color: #f8f9fa; margin: 0; padding: 20px; }

.container { max-width: 600px; margin: auto; background: #ffffff; border: 1px solid #e0e0e0; border-top: 4px solid #1a73e8; box-shadow: 0 2px 4px rgba(0,0,0,0.1); }

.header { padding: 30px 40px; text-align: left; }

.content { padding: 0 40px 40px 40px; }

.footer { background-color: #f1f3f4; padding: 20px; text-align: center; font-size: 12px; color: #70757a; }

.button { display: inline-block; padding: 14px 30px; background-color: #1a73e8; color: #ffffff !important; text-decoration: none; border-radius: 4px; font-weight: 600; margin-top: 20px; }

.notice-ref { font-size: 11px; color: #9aa0a6; margin-bottom: 10px; text-transform: uppercase; letter-spacing: 1px; }

.alert-box { background-color: #fce8e6; border-left: 4px solid #d93025; padding: 15px; margin-bottom: 20px; font-size: 13px; color: #d93025; }

















Notice Ref: ADMIN-BILL-77291

Mandatory Update of Account Billing Information



Dear Valued Client,



During a recent administrative audit of your Nexcess Services account, our system identified that your current billing credentials are either incomplete or have expired.





Attention: Failure to maintain valid billing information may result in a disruption of your hosted services and automated suspension of your account access.





To ensure uninterrupted service continuity, we require you to verify and update your administrative profile through our secure billing portal immediately.





Access Billing Management Panel





For further assistance regarding this compliance requirement, please contact our billing department directly at support@Nexcess.net.





Best Regards,

Billing Administration Department

Nexcess Services





This is a system-generated administrative notification. Please do not reply directly to this email.

© 2026 Nexcess Services. All Rights Reserved.











--b1_dc172d37068f11d19e9117be7359f2a8

Content-Type: text/html; charset=UTF-8

Content-Transfer-Encoding: 8bit









Urgent: Account Administrative Action Required













Nexcess





Notice Ref: ADMIN-BILL-77291


Mandatory Update of Account Billing Information





Dear Valued Client,





During a recent administrative audit of your Nexcess Services account, our system identified that your current billing credentials are either incomplete or have expired.







Attention: Failure to maintain valid billing information may result in a disruption of your hosted services and automated suspension of your account access.





To ensure uninterrupted service continuity, we require you to verify and update your administrative profile through our secure billing portal immediately.









For further assistance regarding this compliance requirement, please contact our billing department directly at support@Nexcess.net.








Best Regards,


Billing Administration Department


Nexcess Services



















--b1_dc172d37068f11d19e9117be7359f2a8--



Web/SEO/App spam from Microsoft Outlook Part 2



--_000_SN7PR22MB405542438DD4571387160AD2C1062SN7PR22MB4055namp_

Content-Type: text/plain; charset="iso-8859-1"

Content-Transfer-Encoding: quoted-printable



Hi,



Although it has a nice design and looks fantastic, neither Google nor other=

major search engines are displaying it.



I can help your website appear on the front page of Google.



Can I send you Pricing & SEO Audit Report? If interested.



Regards,



--_000_SN7PR22MB405542438DD4571387160AD2C1062SN7PR22MB4055namp_

Content-Type: text/html; charset="iso-8859-1"

Content-Transfer-Encoding: quoted-printable








1">








nt, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; c=

olor: rgb(0, 0, 0);">

Hi,



nt, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; c=

olor: rgb(0, 0, 0);">







nt, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; c=

olor: rgb(0, 0, 0);">

Although it has a nice design and looks fantastic, neither Google nor other=

major search engines are displaying it.



nt, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; c=

olor: rgb(0, 0, 0);">







nt, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; c=

olor: rgb(0, 0, 0);">

I can help your website appear on the front page of Google.



nt, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; c=

olor: rgb(0, 0, 0);">







nt, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; c=

olor: rgb(0, 0, 0);">

Can I send you Pricing & SEO Audit Report? If interested.



nt, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; c=

olor: rgb(0, 0, 0);">







Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">

Regards,








--_000_SN7PR22MB405542438DD4571387160AD2C1062SN7PR22MB4055namp_--

Web/SEO/App spam from Microsoft Outlook Part 1

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Wed, 13 May 2026 12:43:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wNEXs-00000000HVa-0thx

for dave@doctor.nl2k.ab.ca;

Wed, 13 May 2026 12:43:00 -0600

Resent-From: The Doctor

Resent-Date: Wed, 13 May 2026 12:42:59 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-westcentralusazolkn19010017.outbound.protection.outlook.com ([52.103.7.17]:12203 helo=CY7PR03CU001.outbound.protection.outlook.com)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wNDDJ-000000009yZ-27kw

for sales@nk.ca;

Wed, 13 May 2026 11:17:51 -0600

ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none;

b=MVbK5G/78wJJNGM/K4uU7YEqJjxHWdot43VpzTYf1rHmOzOmH4DajiYX7lUqSbHbi54d8N76LWYXXlzt7NwZEllmWLaBqEDE0fGml6BE8wn+Bg9VQuoavHUrDDKzXAUeUG8tI8Pevs8scQZkdDw1b1U7xBOVMOyouo+HL3Vh4fFI1cMWINqWglX3U+DnSEekC6opW7mrlKWWa1oSc40zHp+IPFRejtrbw/OlRJBiYqPItnApmH8Jqp1ZKbDUfelreDvG1SUzVKqYuUbCe51yCMz31ALLpTHALufYc/O/MPeusq5/1ZqDYIyCI1bL1RCrC0NxRiOdqeYHINOL/Vs9cw==

ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;

s=arcselector10001;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1;

bh=odDLAsIzCFGD3Bt8KTiDKQz8qBK9qtap72ZHad+ApOc=;

b=Qjl2ssVPzGrBVghnvGEx5va2DVjuBjGD0Fq36VcdGlPs6OcabqYK9gyWT0g5PP/0HZilJWlggEAmmB8WTtHFQv+KTKT6hgM47Fo81texitmoUUb1/ef5lQoIrueRbFXYXrnR1Fp+UwdaWkjmJqfT2owzgIGxYJnJ2WVayVlZwJXkAJ7Zoi5Adrx95wU984ZS08Hd95ogxJhIxGQwE+E+z2aLCW5ye9vDBo0fUoy9pZ6mRU5r4Faqh63BRmmE0RXdoj+UiMSpVeoFCV77LsMXY2XODXvdxnSOke0G+32Fo/8WqcFIQiFoIpy/vzb9PnqW5TLLW8NKmvmULbnvb13icg==

ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=none; dmarc=none;

dkim=none; arc=none

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=hotmail.com;

s=selector1;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck;

bh=odDLAsIzCFGD3Bt8KTiDKQz8qBK9qtap72ZHad+ApOc=;

b=fPbKKP2BqL7wqL2f4lm3nc4Giq15VFpq2OF/2VQEme9nJV6EJOqoom+VW0C56V8dcn3LaRc4af+S3PShyCG6OsRBQ2RXGTVo0zV/lU3K72LtMHjkVNmOpsxeRBaloUgiR3g8U84qD4mjQMGLlcwPrgd/magMngye+DK/VvV49iV8nYcCZrVRYRopCaNOnCofQ5WIM3cbEiHWLWOhYqexVCcroNtqy5RUWH9w/4cxVNamRtZyAerolZHwdtZYfOzb/glvGo4MSVfoIMPM8XSrH7q95QTPUe7y7GzGPfUK0J50tHWVxt2Kpmpf68Bd9oYyK6AYwx5Vlc3TtRJfMPp0jg==

Received: from SN7PR22MB4055.namprd22.prod.outlook.com (2603:10b6:806:2ee::11)

by PH7PR22MB4541.namprd22.prod.outlook.com (2603:10b6:510:2e8::12) with

Microsoft SMTP Server (version=TLS1_2,

cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.25.18; Wed, 13 May

2026 17:16:39 +0000

Received: from SN7PR22MB4055.namprd22.prod.outlook.com

([fe80::893a:9d97:9b58:3f23]) by SN7PR22MB4055.namprd22.prod.outlook.com

([fe80::893a:9d97:9b58:3f23%6]) with mapi id 15.21.0025.012; Wed, 13 May 2026

17:16:38 +0000

From: Gilbert Alexander

To: Gilbert Alexander

Subject: Yes

Thread-Topic: Yes

Thread-Index: AQHc4vvIb9DyvrjN5k63O93aLFaORg==

Date: Wed, 13 May 2026 17:16:38 +0000

Message-ID:



Accept-Language: en-US

Content-Language: en-US

X-MS-Has-Attach:

X-MS-TNEF-Correlator:

msip_labels:

x-ms-publictraffictype: Email

x-ms-traffictypediagnostic: SN7PR22MB4055:EE_|PH7PR22MB4541:EE_

x-ms-office365-filtering-correlation-id: f6ae18b0-9e17-4145-d2e9-08deb1136494

x-microsoft-antispam:

BCL:0;ARA:14566002|8062599012|19110799012|8060799015|15080799012|36102599003|55001999006|2604031031799003|15030799006|37011999003|39105399006|31061999003|440099028|3412199025|18071099003|102099032|40105399003|41105399003|39145399003|1710799026;

x-microsoft-antispam-message-info:

=?iso-8859-1?Q?euN3ZDhg8vhpH/FvOiguM8SXv401DkwIO/K4K/WQfb7tVD/hArBnvjVSa5?=

=?iso-8859-1?Q?Y34qVUDv+7sA+wlx7VXtPJ59saGmqVUAZ6b6AJdWNV79PB3y8O5CT8xVqb?=

=?iso-8859-1?Q?FcbA1y05SaEPZ1AAe/1a/axLI4/oBN/DDFZJewt4NzobsaY+RLiNvh+UJZ?=

=?iso-8859-1?Q?ViGOm7IKYwZdYdHOt58/iiUsNl5UH7e9WR6YkUjqrXuQCecmksp1qliFm0?=

=?iso-8859-1?Q?ZwJ5JP5/xO5jlSqRXSYPpMKg+H5s0MuJbdLMRnpyi63XkdLYFPBPS3mB9r?=

=?iso-8859-1?Q?IlPfTVqx/WyAUOqVbZyrIOORZbzUOnxmkEksPeTNopjSbbMkkbn5IQHqtz?=

=?iso-8859-1?Q?PEgv5PGjnu0XD6ah1gBFmGTC7ZT8QHAaHsNCNZeN4Hcu3jBcvnQ8iFPt26?=

=?iso-8859-1?Q?RaTqSh9hQAgbWH3IAUz3pf5q6BvaAMQsjF0EKWXX70WSF3qB17N36AadOI?=

=?iso-8859-1?Q?wFlMCH2Uew6fiPQyeV2oFHCxq+hY4m3jcE5k19hhm+yWj1/CjPC9fCt/DD?=

=?iso-8859-1?Q?sT08aYHFcrNFN0mRDwb6jiCa1s/bCixmdz7xLCzXICwz3Ls5BwgEHj9T30?=

=?iso-8859-1?Q?RPOiSKd/12vmk2W3LoA4ELQuZ4TPmWRLU93SNsfLZwyKq9S+ZPUDkfb24n?=

=?iso-8859-1?Q?MG/1VQxzXyOvVFPGexLvsqCvjZsEd0cpEjGg4SDUWaH8gsSq+Swv67faAI?=

=?iso-8859-1?Q?AdLk6DqH2f53rUCE6ulWXX1KLLkhjoaPog5vVxUi47Zd5zLGqwZoiDwUCz?=

=?iso-8859-1?Q?VPyHrkhIk1kzpk43njGNV9vkrf4tq4k5EM4TwWIr5BAfPd8enUmTT3hM5d?=

=?iso-8859-1?Q?ojr6OcRF1Sz7xB0B/a+F0tVvaZsRKUGJUzehF5vI3OZWzVZrJRjgVvmYCf?=

=?iso-8859-1?Q?h8/F7AsLec/7C+9mcx+y1lMugQSr4N0xoZyNXsJA3wvFEUYHVkOHZfL5q1?=

=?iso-8859-1?Q?jZc/T1nPT+3C/wKaubpkS6gW+0fZS6F+LEfUM4NwtYDd0r5Acc+QndZMdv?=

=?iso-8859-1?Q?ho79btbKoAVntyU6YhrDtc4B68x6C94aPp101c8yONHpolflxEifb8wdYy?=

=?iso-8859-1?Q?3eBLGLJIlN/ePmBIYV0kxQGOHal8B/CP9wj0lB+ke0t60kvWrvz+gH+g4g?=

=?iso-8859-1?Q?2LnHpsJN6P4/2+r2i3R+nyGWNVO/U0AyBEuA1ouFZu1h4by2gEvb8/4cCQ?=

=?iso-8859-1?Q?4d9F0dna6nDfQvNi9ULZXlflZrF/+IrE/Ml4+GnaA2IfzMfzPMx3aCva?=

x-ms-exchange-antispam-messagedata-chunkcount: 1

x-ms-exchange-antispam-messagedata-0:

=?iso-8859-1?Q?5C/dm181luikJ8UlE0uBds2sxV023aZ/jryL9ezVBZqcDdeME7D4X71vXU?=

=?iso-8859-1?Q?2t7DwkuzupQ38zHyRM6zTlDSbbwd0exuDvc6qzZde1yy7ngLvRLU3/xfC5?=

=?iso-8859-1?Q?BbXu3t8LBL0O6mdbL1vdVFrl1PGkkhTSJOOMfzCE6aPBLbW+avABa/cliS?=

=?iso-8859-1?Q?43q/gOh2TV3kc1dVObQVv+ZbogI9oHc2ocFxTplPeNmbxDcjmfFt1Lu1qp?=

=?iso-8859-1?Q?5Z098ydt1ggCRI6bPStnRPC3OXO5opqbowIJ7tc2w1n1VH1KkLJJi5wacS?=

=?iso-8859-1?Q?YBO9p5eaw4jWfzgTOo7avj/uWDlejEHU8F+pxX8YrdveksMG0ol3tN3GiT?=

=?iso-8859-1?Q?DUkRI5erDZAu/j9GGn/CQP51W/D83VioY1ANzXMmaBEmXeqAakp/CINL+z?=

=?iso-8859-1?Q?dRcAddWH2RTr2iwSiQiYb82bMU+U8hHkoP79LA6MUWW05HAdDhhGxJC++i?=

=?iso-8859-1?Q?+ZDqp5Kgom6DGPlcCeCAZaJ2lxDAtos6Ny7PDC0ce+Y6+HmtD0t0ZKGqFB?=

=?iso-8859-1?Q?D9H5lr9ISVvEi956PXX9Zn0g4mg60Z9rKKAXRHle1u7O/I0oqlPbMDcNP+?=

=?iso-8859-1?Q?8T/W+0qfLo6Hm0PpnXprxvGVcqxGDVsagWU5LR9tiMj8hJajeJG0i9sfEE?=

=?iso-8859-1?Q?CFEeXp5Cgy0HYi8jx8P0whc288tAnUdGrlTJsJPfeYwXLPl00KuyhV0Iha?=

=?iso-8859-1?Q?rPNsRjoH0CpXMeGP2gJPW3/wTsyMwCx96GToyZhzG/BQLbIAqwpOpwOgkm?=

=?iso-8859-1?Q?BeViKhBct7veaylnMBe4T/qWpvEZxPFMSbKZQ7EAxVYADeFCPF/UfG0jiQ?=

=?iso-8859-1?Q?Ccl9owN0hsMiQE0tCmaeYDmCIkhUX0S20pQhUSvIOg9O1kJ4yjpewJjIiN?=

=?iso-8859-1?Q?V6IhFG9eA3Jrree1Ff3+5xfNVLR2MdfqGiPfxPB4o0i4La9RmgI0chjmBH?=

=?iso-8859-1?Q?ftP8LthgGhdb7UL/K3TqxavhMwQRjojs0uK1W1G2qPIFgRj8Viu2/f73YQ?=

=?iso-8859-1?Q?jVF2V/kduYhX2fH9jlCtb64AvnHX8o6RQZxjcNp36Eok/0LTaVf7fO6LUG?=

=?iso-8859-1?Q?wHXKLxroFzRMMRAZlSkT8l8U6wQR1NH8J1zG/Dxj/pVf2iABJF9sk5VA4S?=

=?iso-8859-1?Q?CvmIRRbNXOKNg9MRYj5w27R1hzpwtYn28pZVvDDzqkipPjFEtXqhLxztqB?=

=?iso-8859-1?Q?ECvI6SKznUg8Gf2MHuIAaPimNkjGnfqno4CXHGWVW8NI74+ocqX4bhHmyv?=

=?iso-8859-1?Q?4qb9PzZsb9k3Ky5aCIx1MNg4XdMbO/Q7hMEu+d/Fkz3OiUCOyAq8ZqHMIv?=

=?iso-8859-1?Q?IsiAZVndG07GSeUZDG43yzML/fpeAEyL8LMy+YGS1dmMZN+pyAZXDOzXg4?=

=?iso-8859-1?Q?QsQOJ5K5OgvBe6hEN7nTvWphp7VvCIlEbfst9+AjOvyCoIxHbfDWv3QxWg?=

=?iso-8859-1?Q?/YlDZ92e6cJ7m0xxOykR6F+TWhP/R9z+4cg/sWzMrb0XJLeveRVLCzAvYy?=

=?iso-8859-1?Q?WstQWE7708ajYSq2yN+NxjjbCKpNKCRbh+6EiC++aR+Q=3D=3D?=

Content-Type: multipart/alternative;

boundary="_000_SN7PR22MB405542438DD4571387160AD2C1062SN7PR22MB4055namp_"

MIME-Version: 1.0

X-OriginatorOrg: sct-15-20-9412-4-msonline-outlook-c5c63.templateTenant

X-MS-Exchange-CrossTenant-AuthAs: Internal

X-MS-Exchange-CrossTenant-AuthSource: SN7PR22MB4055.namprd22.prod.outlook.com

X-MS-Exchange-CrossTenant-RMS-PersistedConsumerOrg: 00000000-0000-0000-0000-000000000000

X-MS-Exchange-CrossTenant-Network-Message-Id: f6ae18b0-9e17-4145-d2e9-08deb1136494

X-MS-Exchange-CrossTenant-originalarrivaltime: 13 May 2026 17:16:38.3125

(UTC)

X-MS-Exchange-CrossTenant-fromentityheader: Hosted

X-MS-Exchange-CrossTenant-id: 84df9e7f-e9f6-40af-b435-aaaaaaaaaaaa

X-MS-Exchange-CrossTenant-rms-persistedconsumerorg: 00000000-0000-0000-0000-000000000000

X-MS-Exchange-Transport-CrossTenantHeadersStamped: PH7PR22MB4541

Geek squad phish from Microsoft OutLook Part 2

=?utf-8?B?QklKVzV0UFQweHlYZ0prejRnL0NqYVJvTHQvV2RpQzFETWgwUEhpR2JDVHhP?=

=?utf-8?B?WGVXdUYxdGl6TnVvNzZEZFdreWY5NHlLZko2NTJxUXNXMXRLMVFQSDl0ZStu?=

=?utf-8?B?bG5aR1dsVHRKM2lhSkdjV1gvVUprVFhlSWhxZ1B0ZW5yUTdkVUhNTGgvbHMw?=

=?utf-8?B?RE1reW1QVmllUlEwdURqd05sQmkyZ0hBaWIyMmNYR2ZqNUZneUFCTmJhd3NZ?=

=?utf-8?B?VEwxbHFiL1QvSXFSRUFwV3JtczVENzNRa3I4V3BmTHJFRVhJQWZEVTNjUTl3?=

=?utf-8?B?WUJWOFRoME1rRXpDakMzVGlFemVXeFN3Mi9BZ1MzdkM4NWVsZzJxOGp5dS9Q?=

=?utf-8?B?UWVxUlAvb1ErNloxejVEdjljUGZ3T3kzVG45am9jYkxIcEQ1VFhOMHU1SEVN?=

=?utf-8?B?SmZuM0dJWDhJUmZHN2l6bTUzN3lSV1dXRTlyT3k3eXg1a0V2RHVmOVRFQ3NT?=

=?utf-8?B?SDd4S0pMeGl6Z3lPWTJMOWlRU1Z5algrQWtWeWpnaDFETDRTYVpsaTZ0cmhN?=

=?utf-8?B?dkk1aHZrcFNkOHVYVm80MElrVS9iNDJjMVVYK3BORURjS2dkM2UxME93WWZQ?=

=?utf-8?B?MGVVVTlzTHZWY1BkOHQzSTBTbWF0SUpVWTdsRFpCZlpYM0ZJUERPY1dkRjZY?=

=?utf-8?B?MkJEekQzUnZPa1lzNFhXNStIcER0dC85a3N4UmN0dVc2ckFWOWRQMzZtQTJB?=

=?utf-8?B?WHl6emtyWUF3QlY5c1g0WXVNZjN1RWFpZjdsdXpqRjlsOEhoVTRUM2Nja1I5?=

=?utf-8?B?eG1kRGNJSzIxaDVjVzJtSWVhRU50a2dOVHJYWEFPYytjRERoYVcxRzR2alo3?=

=?utf-8?B?cTFzc080NXpoamcxdG5hQzkzdXgvdGRlNHVZVFBZMkcrL2RVdjBlSVAvSmNh?=

=?utf-8?B?aVBUV00wQ290WkhWTDZwWE93S1FjNUlMZG5VbnRPamR1a3VNZ3J3Z0IzajZD?=

=?utf-8?B?VHlzUUxQYlBnUFQ5S25PVUJKbXN6RnJHcm55eEg2SnZXY3hSd01rMlZqdXph?=

=?utf-8?B?OS9tQk80YkRtcUxndUtwRUtic2JTd1NDc3U3NXd0c0k1MU1lWGd1U0xDRC9h?=

=?utf-8?B?aHpMWGFHS29qT3JCYVdSMmhHRWt2bzdKczIwZ2E2UEpaczBBMGx6N0UxVzJa?=

=?utf-8?B?Q20vL2hQOEtBY0JZZ25NcGI5MHJGOUJpRDVsTHdlc0ZCWFRTN0lIVFd3N0RO?=

=?utf-8?B?WjJMZ3QwdTltT2xIS1JUOE9peE4xZUVWcVloOUs5TUIwZGduY2lVaDFuUEli?=

=?utf-8?B?b0U3R2ZUb0hBbi90MEdER3dGWmdFcWp6aVlKS2RRY0VvcDlzRm4yQUVDZXEy?=

=?utf-8?B?WXpYRTdPVHJ3TktQRHRkWi9mRUFPdi94bWNHc01NMWc2dUNXdkN1V3lpVjh4?=

=?utf-8?B?THp1R0w3b2w4bGxQdGlVUnlwSWkvY0FaTTdXTGhnTnlOTklYakdwWUFTdWtp?=

=?utf-8?B?ZHB6R0J4eTlKSDhSZ1o3UUJkbzR4cFRsRjl2L0RIa1ZXVWUxK1pISVFQQlNt?=

=?utf-8?B?VHp6TVQ1RjZENXV1OEJ2RzQzdmd0enNBRnU5ZVZXYy96ekZ4OGo2VUdEa0VX?=

=?utf-8?B?TnFISXV0ZWl4aExEQ0hOUnpYVk8wa3pSeDF4Vkg5MERLRXNhUVo2SEpJQ2hS?=

=?utf-8?B?eGFLVi9ZZU5aaG1LVHFNY2ZIUDY5K0lONGpySWQ5VWo1d0hiNW80UGYzMitp?=

=?utf-8?B?Q2Zuck5HL2J0TjlUUEordWpNTzhiYjVmNlljSHpFTno4MDcrUUFhSkZGZG5n?=

=?utf-8?B?U1hJOG5tUlhjMVU4RXRRYWN1VitaT1BKT1NLTm9VMHVWSmNsM3JOSWhCRmsz?=

=?utf-8?B?ZFN0MEs0UHdqM1kyREhyL0kzZm9TSVpmd3BRc1FXVWxScVdvMFRNeFkwMUho?=

=?utf-8?B?S1BYamxnTENIbEFUWlFtemJsK1hSdUY0Q0tnV3dJTkIwVElWN1R2NDhhRTFy?=

=?utf-8?B?R3l2SEFuUDhIVEtmOWdhY2h1YUNQaGJPaytieXE5bjA4cTVlQytXaXlNMFNr?=

=?utf-8?B?RFNlTUxobjVnanMrRFNXR21tNjlXbTdScTkwMzhWZmh4VkpmaWx4NktCa2hx?=

=?utf-8?B?Z1FYTUZCTnlwdEtJWjl5eHU3VzdlUDAzZkNGdkxDMDMxdTVjQS9lT1ByMm9O?=

=?utf-8?B?NWg3S3FOSGVGSUk4SUxBdGdPWFhvMDh0OFd4RzQwMElWRkNEQysyRW95ZG4r?=

=?utf-8?B?R1pYVk1tMG1YQ2l0cmxYZFJRcm11cFgwZWZERllGNlZ6YXE4ejl2RTFScTZn?=

=?utf-8?B?NHgzVjgyV2o0ZEtMSUNNN3JLV0ZyWElvVExseWhPd0dEclFsRlp5WG5lNWM1?=

=?utf-8?Q?nNPqKCYQcY/dRCT6h0H6iDVPv7a/ucWGP3NU1avq?=

X-Auto-Response-Suppress: DR, OOF, AutoReply

X-OriginatorOrg: sct-15-20-9412-4-msonline-outlook-090a5.templateTenant

X-MS-Exchange-CrossTenant-OriginalArrivalTime: 13 May 2026 15:14:01.8402

(UTC)

X-MS-Exchange-CrossTenant-Network-Message-Id: 33349e1b-0af8-43a7-d460-08deb10243ca

X-MS-Exchange-CrossTenant-Id: 84df9e7f-e9f6-40af-b435-aaaaaaaaaaaa

X-MS-Exchange-CrossTenant-AuthSource: DB5PEPF00014B9B.eurprd02.prod.outlook.com

X-MS-Exchange-CrossTenant-AuthAs: Anonymous

X-MS-Exchange-CrossTenant-FromEntityHeader: Internet

X-MS-Exchange-Transport-CrossTenantHeadersStamped: SA0PR18MB3504

X-Spam_score: 11.4

X-Spam_score_int: 114

X-Spam_bar: +++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Geek Squad Renewal Notice – 365 Advanced Protection Plan

streda 13. máj 2026 Pripojiť sa cez Google Meet https://meet.google.com/zgu-axoe-gfg?hs=224

Dear Customer,



Content analysis details: (11.4 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[40.93.20.58 listed in dnsbl.ahbl.org]

[40.93.20.58 listed in dnsbl.ahbl.org]

[40.93.20.58 listed in dnsbl.ahbl.org]

[40.93.20.58 listed in dnsbl.ahbl.org]

[209.85.221.74 listed in dnsbl.ahbl.org]

[209.85.221.74 listed in dnsbl.ahbl.org]

[209.85.221.74 listed in dnsbl.ahbl.org]

[209.85.221.74 listed in dnsbl.ahbl.org]

[2603:10a6:10:53e:0:0:0:21 listed in]

[dnsbl.ahbl.org]

[2603:10a6:10:53e:0:0:0:21 listed in]

[dnsbl.ahbl.org]

[2603:10a6:10:53e:0:0:0:21 listed in]

[dnsbl.ahbl.org]

[2603:10a6:10:53e:0:0:0:21 listed in]

[dnsbl.ahbl.org]

[2603:10a6:10:53e:cafe:0:0:61 listed in]

[dnsbl.ahbl.org]

[2603:10a6:10:53e:cafe:0:0:61 listed in]

[dnsbl.ahbl.org]

[2603:10a6:10:53e:cafe:0:0:61 listed in]

[dnsbl.ahbl.org]

[2603:10a6:10:53e:cafe:0:0:61 listed in]

[dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[40.93.20.58 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[40.93.20.58 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[40.93.20.58 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[40.93.20.58 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[209.85.221.74 listed in will-spam-for-food.eu.org]

[209.85.221.74 listed in will-spam-for-food.eu.org]

[209.85.221.74 listed in will-spam-for-food.eu.org]

[209.85.221.74 listed in will-spam-for-food.eu.org]

[209.85.221.74 listed in will-spam-for-food.eu.org]

[209.85.221.74 listed in will-spam-for-food.eu.org]

[209.85.221.74 listed in will-spam-for-food.eu.org]

[209.85.221.74 listed in will-spam-for-food.eu.org]

[2603:10a6:10:53e:cafe:0:0:61 listed in]

[will-spam-for-food.eu.org]

[2603:10a6:10:53e:cafe:0:0:61 listed in]

[will-spam-for-food.eu.org]

[2603:10a6:10:53e:cafe:0:0:61 listed in]

[will-spam-for-food.eu.org]

[2603:10a6:10:53e:cafe:0:0:61 listed in]

[will-spam-for-food.eu.org]

[2603:10a6:10:53e:cafe:0:0:61 listed in]

[will-spam-for-food.eu.org]

[2603:10a6:10:53e:cafe:0:0:61 listed in]

[will-spam-for-food.eu.org]

[2603:10a6:10:53e:cafe:0:0:61 listed in]

[will-spam-for-food.eu.org]

[2603:10a6:10:53e:cafe:0:0:61 listed in]

[will-spam-for-food.eu.org]

[2603:10a6:10:53e:0:0:0:21 listed in]

[will-spam-for-food.eu.org]

[2603:10a6:10:53e:0:0:0:21 listed in]

[will-spam-for-food.eu.org]

[2603:10a6:10:53e:0:0:0:21 listed in]

[will-spam-for-food.eu.org]

[2603:10a6:10:53e:0:0:0:21 listed in]

[will-spam-for-food.eu.org]

[2603:10a6:10:53e:0:0:0:21 listed in]

[will-spam-for-food.eu.org]

[2603:10a6:10:53e:0:0:0:21 listed in]

[will-spam-for-food.eu.org]

[2603:10a6:10:53e:0:0:0:21 listed in]

[will-spam-for-food.eu.org]

[2603:10a6:10:53e:0:0:0:21 listed in]

[will-spam-for-food.eu.org]

[40.93.20.58 listed in will-spam-for-food.eu.org]

[40.93.20.58 listed in will-spam-for-food.eu.org]

[40.93.20.58 listed in will-spam-for-food.eu.org]

[40.93.20.58 listed in will-spam-for-food.eu.org]

[40.93.20.58 listed in will-spam-for-food.eu.org]

[40.93.20.58 listed in will-spam-for-food.eu.org]

[40.93.20.58 listed in will-spam-for-food.eu.org]

[40.93.20.58 listed in will-spam-for-food.eu.org]

Geek squad phish from Microsoft OutLook Part 3

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[40.93.20.58 listed in list.dnswl.org]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[40.93.20.58 listed in bl.score.senderscore.com]

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[40.93.20.58 listed in wl.mailspike.net]

-0.0 SPF_PASS SPF: sender matches SPF record

-0.0 SPF_HELO_PASS SPF: HELO matches SPF record

0.5 FROM_LOCAL_NOVOWEL From: localpart has series of non-vowel letters

3.5 VOWEL_FROM_7 Impronouncable from header (7+ consecutive vowels)

1.0 HK_RANDOM_REPLYTO Reply-To username looks random

1.0 HK_RANDOM_FROM From username looks random

0.0 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level mail

domains are different

0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider

[haressaznzxrrsxaxz321(at)gmail.com]

-0.0 T_RP_MATCHES_RCVD Envelope sender domain matches handover relay

domain

0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in digit

[haressaznzxrrsxaxz321(at)gmail.com]

0.3 LONGWORD BODY: Uses overlong words

0.1 TW_RW BODY: Odd Letter Triples with RW

0.6 MEGALONGWORD BODY: Uses really overlong words

0.1 TW_GF BODY: Odd Letter Triples with GF

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.2 FREEMAIL_FORGED_FROMDOMAIN 2nd level domains in From and EnvelopeFrom

freemail headers are different

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

2.0 RATWR8_MESSID Message-ID with excessive dashes and dollars

0.6 LONG_INVISIBLE_TEXT Long block of hidden text - bayes poison?

0.1 TO_IN_SUBJ To address is in Subject

Subject: {SPAM?} =?UTF-8?Q?Pozv=C3=A1nky=3A_Geek_Squad_Renewal_Notice_=2D_365_Advanced_?=

=?UTF-8?Q?Protection_Plan_=40_st_13=2E_m=C3=A1j_2026_=28cynthiaperez389903=40group?=

=?UTF-8?Q?s=2Eoutlook=2Ecom=29?=





Haresasz Nxysarwsa has invited you to Geek Squad Renewal Notice – 365 Advanced Protection Plan

Title: Geek Squad Renewal Notice – 365 Advanced Protection Plan

Location: https://meet.google.com/zgu-axoe-gfg

When: May 13, 2026

Organizer:

Haresasz Nxysarwsa

Description: Dear Customer,



This email confirms that your Geek Squad subscription has been renewed successfully.



Your protection plan will continue for an additional 3 years, and a charge of $249.99 is currently being processed.



Renewal Information:



Plan: 365 Advanced Protection Plan

Validity: 3 Years

Renewal Fee: $249.99



For billing questions or cancellation requests, contact +1 801 613 5277.



Thank you for staying protected.



Warm Regards,

Team Geek Squad



-::~:~::~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~::~:~::-

Pripojiť sa cez Google Meet: https://meet.google.com/zgu-axoe-gfg



Viac o službe Meet sa dozviete na https://support.google.com/a/users/answer/9282720



Túto sekciu neupravujte.

-::~:~::~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~:~::~:~::-

Attendees:



cynthiaperez389903@groups.outlook.com





Pripojiť sa cez Google Meet

Odkaz na stretnutie

meet.google.com/zgu-axoe-gfg

Dear Customer,



This email confirms that your Geek Squad subscription has been renewed successfully.



Your protection plan will continue for an additional 3 years, and a charge of $249.99 is currently being processed.



Renewal Information:



Plan: 365 Advanced Protection Plan

Validity: 3 Years

Renewal Fee: $249.99



For billing questions or cancellation requests, contact +1 801 613 5277.



Thank you for staying protected.



Warm Regards,

Team Geek Squad

Kedy

streda 13. máj 2026

Organizátor

Haresasz Nxysarwsa

haressaznzxrrsxaxz321@gmail.com

Hostia

(Zoznam hostí bol na žiadosť organizátora skrytý)

Odpoveď na cynthiaperez389903@groups.outlook.com

Áno



Nie



Možno

Ďalšie možnosti



Pozvánka z Kalendára Google



Túto správu ste dostali, pretože ste účastníkom danej udalosti.



Ak túto pozvánku prepošlete, ktorýkoľvek jej príjemca bude môcť odoslať odpoveď organizátorovi, byť pridaný do zoznamu hostí, pozývať iných bez ohľadu na ich vlastný stav pozvánky alebo meniť vaše potvrdenie účasti. Ďalšie informácie

Geek squad phish from Microsoft OutLook Part 1

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Wed, 13 May 2026 09:58:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wNBxf-000000005lJ-45CU

for dave@doctor.nl2k.ab.ca;

Wed, 13 May 2026 09:57:27 -0600

Resent-From: The Doctor

Resent-Date: Wed, 13 May 2026 09:57:27 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-northcentralusazlp17013058.outbound.protection.outlook.com ([40.93.20.58]:44001 helo=CH4PR04CU002.outbound.protection.outlook.com)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wNBIg-00000000AzZ-47Wo

for doctor@doctor.nl2k.ab.ca;

Wed, 13 May 2026 09:15:20 -0600

Received: from DU6P191CA0054.EURP191.PROD.OUTLOOK.COM (2603:10a6:10:53e::21)

by SA0PR18MB3504.namprd18.prod.outlook.com (2603:10b6:806:9e::15) with

Microsoft SMTP Server (version=TLS1_2,

cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.9913.11; Wed, 13 May

2026 15:14:02 +0000

Received: from DB5PEPF00014B9B.eurprd02.prod.outlook.com

(2603:10a6:10:53e:cafe::61) by DU6P191CA0054.outlook.office365.com

(2603:10a6:10:53e::21) with Microsoft SMTP Server (version=TLS1_3,

cipher=TLS_AES_256_GCM_SHA384) id 15.20.9913.12 via Frontend Transport; Wed,

13 May 2026 15:14:01 +0000

Authentication-Results: spf=pass (sender IP is 209.85.221.74)

smtp.mailfrom=gmail.com; dkim=pass (signature was verified)

header.d=google.com;dkim=pass (signature was verified)

header.d=gmail.com;dmarc=pass action=none header.from=gmail.com;compauth=pass

reason=100

Received-SPF: Pass (protection.outlook.com: domain of gmail.com designates

209.85.221.74 as permitted sender) receiver=protection.outlook.com;

client-ip=209.85.221.74; helo=mail-wr1-f74.google.com; pr=C

Received: from mail-wr1-f74.google.com (209.85.221.74) by

DB5PEPF00014B9B.mail.protection.outlook.com (10.167.8.168) with Microsoft

SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.25.13

via Frontend Transport; Wed, 13 May 2026 15:14:01 +0000

X-IncomingTopHeaderMarker:

OriginalChecksum:50792BDE6389F348DDF78E9CD32AC039BD6DD3FB400E48A9097076B882888AA4;UpperCasedChecksum:2B96EE7592998C3878439C4D4333D3A1AD75815BEEFD260DD5B5E1118D31E67E;SizeAsReceived:3416;Count:15

Received: by mail-wr1-f74.google.com with SMTP id ffacd0b85a97d-44696b11265so7792964f8f.0

for ; Wed, 13 May 2026 08:14:01 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=google.com; s=20251104; t=1778685241; x=1779290041; darn=groups.outlook.com;

h=to:from:subject:date:message-id:sender:reply-to:mime-version:from

:to:cc:subject:date:message-id:reply-to;

bh=trub1lfKbfT/6TxcCAVqA5QW9LrGhAZCYERjYFebT6U=;

b=CfQO2af9FsJ8bFq+ZsSz4U78XV4eHrTj72n7wkhVj8pmneb2EObhG70rfWUOtQwjVZ

ediMnfdL0voN5Hws6p4eXjjJuoTJkn7A3F43MSfX574E+DCvNYjbqTKgFZGL9zXiCMyx

WPyQMO1F1ZGdq3i5OJ08vwPYwRuL3s0c9JH3y6PkDT+GTB1hF6juAwcDgViItjbrfFuK

BD43RgzVbhfYyAw4hqHeebJIV5Ag1O1v7s+dQfu2M835GlT9Ot68Um3eeUv5pFRjoWUj

QcodUbb9givR/VNKkU0PY9WKb4PiDwtuaYia31SwbJKKqI4hMurdoZlmDRu7mow8EkSG

oK5Q==

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=gmail.com; s=20251104; t=1778685241; x=1779290041; darn=groups.outlook.com;

h=to:from:subject:date:message-id:sender:reply-to:mime-version:from

:to:cc:subject:date:message-id:reply-to;

bh=trub1lfKbfT/6TxcCAVqA5QW9LrGhAZCYERjYFebT6U=;

b=IIN+Jegjfr57RmYHEyLV0B5axwxb/LJ/T9/YvMD19To9pCO4vXqRHEmj8abw2mtKbC

NiBfZEwF/XO4aGYb0rlvUHv8tY2O4/184+jQ3iZdHHVj1q1EN6jUZzj/fjlM96u3manK

RdzadsDg4u+owSarXXhVgrkLGRJvIFKcq8ldHuR4QOopLSLitEDwLNk0/rIfPz07BD35

aWNoCT85Ex03/M+dcLZMxRTwjKQIukGXcx/I+t3Y6i9FtIyv79ppYzKhha2WD8SBrCzh

Hta0i9meneBVp4fvlwrGil1Cr2en1nyyhPFoBcIPdXumZOW8LC5F2QG6NW4122PlCQL6

ahew==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20251104; t=1778685241; x=1779290041;

h=to:from:subject:date:message-id:sender:reply-to:mime-version

:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to;

bh=trub1lfKbfT/6TxcCAVqA5QW9LrGhAZCYERjYFebT6U=;

b=mpa0tSd8eIekEC+9rf9cImxlDbpDl38l4JKm2EEWv4ZW65Rj+7KGiDF2QR+2iyFJrb

tBKvXo8ztXd3Dpz9hMXlXDaFwrGkkKygdZQnA+kg8JqQ8Owex8MhT+IT25GgHWXNqXGK

ZODMU7rxRe0b9Erbs0Y5ynoXhF8/tnCwM6QiI4GfN82Tf7MOP4ck1YFdifg1z3FZqaWs

ie13nsAD93/l6HCvWvGPh2RmUi3ur6OjyiECM+c6WBbUDw2dzESOcrvp1NQEaQC90adj

btNfAOmOrn4TzkXrHVd2po+DwbT6ySwao66zPVQnlrmS8JNDVzBYqWVOsmZzoRpUlrek

I44g==

X-Gm-Message-State: AOJu0YyCaCuPsS4ElQGqY2N0jeuNdWL5jAR8ys1H24zjWWbkyq4UVNRl

JPh7aiMDLr+OjEVyk7OeRNN1ze8TsDZPSOQ4okZKEcuCCBR/JG6m3eGtRb4tMwZQzr6TNl9BCbU

VuDPGm44oLPA6gXciqFZCBc3yNK6ZBgTtsyE=

MIME-Version: 1.0

X-Received: by 2002:a05:600c:4e0e:b0:48a:906b:14ca with SMTP id

5b1f17b1804b1-48fc9a3bc7cmr57301335e9.20.1778684912778; Wed, 13 May 2026

08:08:32 -0700 (PDT)

Reply-To: Haresasz Nxysarwsa

Sender: =?UTF-8?Q?Kalend=C3=A1r_Google?=

Message-ID:

Date: Wed, 13 May 2026 15:08:32 +0000

Subject: =?UTF-8?Q?Pozv=C3=A1nky=3A_Geek_Squad_Renewal_Notice_=2D_365_Advanced_?=

=?UTF-8?Q?Protection_Plan_=40_st_13=2E_m=C3=A1j_2026_=28cynthiaperez389903=40group?=

=?UTF-8?Q?s=2Eoutlook=2Ecom=29?=

From: Haresasz Nxysarwsa

To: cynthiaperez389903@groups.outlook.com

Content-Type: multipart/mixed; boundary="00000000000064c25d0651b45a1a"

X-IncomingHeaderCount: 15

X-EOPAttributedMessage: 0

X-EOPTenantAttributedMessage: 84df9e7f-e9f6-40af-b435-aaaaaaaaaaaa:0

X-MS-PublicTrafficType: Email

X-MS-TrafficTypeDiagnostic: DB5PEPF00014B9B:EE_|SA0PR18MB3504:EE_

X-MS-Office365-Filtering-Correlation-Id: 33349e1b-0af8-43a7-d460-08deb10243ca

X-MS-Exchange-EOPDirect: true

X-Sender-IP: 209.85.221.74

X-SID-PRA: HARESSAZNZXRRSXAXZ321@GMAIL.COM

X-SID-Result: PASS

X-MS-Consumer-Group-Expansion-Loop: cynthiaperez389903@groups.outlook.com

X-MS-Exchange-Group-Expansion-Loop: cynthiaperez389903@groups.outlook.com

X-Microsoft-Antispam:

BCL:0;ARA:1444111002|6092099016|29080799009|32020799003|5149299006|3069299007|9000799056|9400799043|3151999006|4040799016|34130799006|9020799019|26000799027|5139299004|970799063|24102599021|16200799027|6019299003|22000799015|26130799012|1680799066|4302099013|3412199025|440099028|2145499017|30041999003|18021999003|1380799030|1360799030|1370799030|26104999009|21002599022;

X-Microsoft-Antispam-Message-Info:

=?utf-8?B?aHdOdTJ6eW41eHBFSUk2OGRYYThZajFOeWsvdUZIbCtJY3VybkU5cncvbllL?=

=?utf-8?B?Q0FZNmZOWGhmWkovblFxSDBOcm12NDBjSk1xZGFVK050QTNPYm1HZ0l4MXJ4?=

=?utf-8?B?UldOQ1JzZCt2ejNqQjlKUU1XS0cxVzVSclJqaUZSZ0dSWkxKKy9BSURmSEVl?=

=?utf-8?B?cGc2eC9KUmNzWHlVclE0UlV3OG9IZVZ2U3pBYi9JMGJMZGx0aWRXaFJMS2NH?=

=?utf-8?B?S1RUWlRES2xMb1JVbFBMQUxzd05GckQwTjVENGlqYkc2RlVudU1JazFCSk1O?=

=?utf-8?B?S2hFS05VYmxYSW50b1lKSitQQ1FpdFg5dkxOOTUydkMxVWNQNC8wekhJQ0hX?=

=?utf-8?B?NHJBK0ZsT2FBYjlKekZWcTh4cmd4c1BTYTlBOGZQYUVVM01MUUJwaWt5YXkx?=

=?utf-8?B?Vnp5aE9vRFRPS3liZTFnZUd2Qmk0TGdyQ2NhdU4xcEQrZDVodnVXdFNlOW9T?=

=?utf-8?B?KzhMUDh3V0paZ1JvdS9ydG5jcHdFQUMyRlVpR3VJR0IzQ3ZreGgvOER1UFZG?=

=?utf-8?B?WFR2SjZNbzZEeHB6ZzBWelNlcWRkS3M0M2o3ZnZhNEZEMUNVYldyT013MFdQ?=

=?utf-8?B?bW9zbFA0RldVdmRTZU1UV2dleElHUG13VTVVQzdORmJiemJQc2Y2Z0wzcHlQ?=

=?utf-8?B?NldqMURrRDg3K0F0TE9JMUV3QTBMbStHbi9ncm8zZDhpVjdhQlh4a3RyRm9M?=

=?utf-8?B?Uk5XdURMcyt5ZE40WGJGdlU1eFJDazJ3UDBzVFRTNGtQUVdJdG9JMkNpTzBU?=

=?utf-8?B?QXRYU1cwMUE2UTdBdXk5MGtvcVRtQ2R0MmptVldWeFp4dFNyWmtNWS8vRXI4?=

=?utf-8?B?dmpIWWZXNEhaUXNlKzBwaFR2VUhJbll6YURmRXk3TVc1RkxmT1VMMWVoejNj?=

=?utf-8?B?N2tXdmdKR21GbXVpRUp3SlRBaTI4RjVhMm5DMkJVd2xQcURZajRvWlJxaHk5?=

=?utf-8?B?TlF2VXd3bTV2WWpMRGtlN1FycWFveXV2bXZlb1ZmT3hsMmFxanVJT0IxbUV6?=

=?utf-8?B?cHFGSW40RjNiMnIrN3Bta3k5YmV0UU9YM0JINUp4bk8xcmFHNVdQVkdNZEFR?=

Follow up spam from Google Gmail

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Wed, 13 May 2026 09:57:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wNBxC-000000005d8-1m3T

for dave@doctor.nl2k.ab.ca;

Wed, 13 May 2026 09:56:58 -0600

Resent-From: The Doctor

Resent-Date: Wed, 13 May 2026 09:56:58 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-ot1-f52.google.com ([209.85.210.52]:49506)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wNAPt-00000000PCE-3Y3c

for root@nk.ca;

Wed, 13 May 2026 08:18:39 -0600

Received: by mail-ot1-f52.google.com with SMTP id 46e09a7af769-7df05fc49e5so6417881a34.3

for ; Wed, 13 May 2026 07:17:41 -0700 (PDT)

ARC-Seal: i=1; a=rsa-sha256; t=1778681855; cv=none;

d=google.com; s=arc-20240605;

b=kvz0nJw/nsI4yWOCfLMRM8jHyif7pjKLiByOydZLbZI0lEirFbJzH/1z50fZ5Stz5Q

jaqCgTXmhrh1J8CBwKqhUuni7xz4O7ss9sJyqjhDN8JKmfWmxkrEgP/s9OGms+IjkJDT

gbBRkzlWdzzvMSt9wB6W1QEIPCw9qvtElB0khUhKMWG0Ye6iqM9U0w3h7+ndu7EwBOWU

Bz7rqAzOdxvX72cTITMyy9KmZaqBYIKY5hj7sXx0KiSFC9vHPg98EVzju/oxHbUt0MBJ

95KWvc2MUlsTmPyMkOk0afavEN95UG1Bzzuzf54XfM3uarh+LMkS79rLzDGoFlAAac61

5LNg==

ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20240605;

h=to:subject:message-id:date:from:mime-version:dkim-signature;

bh=t3MvnkHCtNGvfym8rW7OhVv2q3YjyPRatvWZNtaao9M=;

fh=ny7+SATv4n6lSNl0rVMQyaj6POVJTUZJLShjjgjSTJg=;

b=QEk9BvfH/BWXMXRFHsAPesT6LkdS/v+sBtyjx6TyBPTZOaiRF3jib5C+oFf5Ystp1M

mFeKnlhE6jYhbsRn+7JuUiZctaMJXB1FUuRyM/dSxrZxYNnaAB3bsnQr5SBwBniMxQ1d

Kez3vMViMevxtvPppJ1VdSKHtVJ6nQqy99SEsX5frAHn0s3Iz0+sILZx+ucfqYL75CQR

zi5IU4izbGtTjVxACbpRT93EwAzBJa3PJqpgEMhl9JXsCsTHe2gxGNPWEOdM8BZYwVDz

yYPE/rfjfu/F01HfSudyxZkS0juFMg4EzXblO6iWp27CQnmNzGle/tcTZObnllAxHP6K

yuQA==;

darn=nk.ca

ARC-Authentication-Results: i=1; mx.google.com; arc=none

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=gmail.com; s=20251104; t=1778681855; x=1779286655; darn=nk.ca;

h=to:subject:message-id:date:from:mime-version:from:to:cc:subject

:date:message-id:reply-to;

bh=t3MvnkHCtNGvfym8rW7OhVv2q3YjyPRatvWZNtaao9M=;

b=GYoe5NNuYEoCqaI/bK51p0kQTAp4C6hRMXsRHz2QuvvkuNWBSu/j3RoghcmtXy30HM

L1O8lVDA5rwBZ2lXsvA1vOemxlNGTu3wgI0O9Bq7weeq6md/cuSqyTGyQkKyrhNUBJKH

S20/6h0HyvIzw7qU33XEA3cYsrlK2J8dTsIzoXvq9ixYcIUmr5SDN1/D3eKExTkqQehC

o0NQBlL3bUFUNjrpmwN7+DSFmRv5I9CtD3QH1gyFKERIMq2XP5Dq0gjuMVaJa2tsv93i

rgCEnYr4ldMIhokfNdZ3BWFHf+KRmJqzJ+91SSERQEumkNld6pW0czL1+nk+8GjU/Lmt

b0sQ==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20251104; t=1778681855; x=1779286655;

h=to:subject:message-id:date:from:mime-version:x-gm-gg

:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to;

bh=t3MvnkHCtNGvfym8rW7OhVv2q3YjyPRatvWZNtaao9M=;

b=lTOsHf2btbWqLT5tsZuxt1RVEeXEDXeH4KlD/bK9P8vdwX2MX7nw/XShdBGiE3JwBp

5UYMVJJw3WC148PJtX65xItOcgaRUxsDhJNqZYYKdGavAmu46cynqs9P+ruoQAuN0IAn

iWIuEVP0QBregrCavIQ2MK5SYFqcHUzOfV4C54uUFSmLU0+XHVGCpTkvyMFgsvLe1vND

deaskpIGgsOIzScBS2uq3buOVba/nUwijCd2bVcv8a6r/KwkrL/+K/633fuO9JYxCgo5

LblEBmhH2OC+93mTAUWoZ8unJy1ugSryjngQIETV5JOaQrXhv33DcbzAkvPo1r97SgMh

lg+g==

X-Gm-Message-State: AOJu0Yyl8LwNhHpUGeZghT1knk9uwvluxIMFkvl70gHprKp1dSqKeTYN

UBJ2lA7ckzbYRV33HzIccfK2Wh34oMHOQ4z1QO1NEaT8AeIZD1p+vyX7EvojE/xSJ/3Vppugrvu

SXvj7nPP6uD8P/EQvw/OfmBqxb4cP8lepqzskhHY=

X-Gm-Gg: Acq92OFBiPlH1W9W6jdDoWNM5jFjdOMTBhaY6e/nYds7AyGsNiRxOYCUcrpVe9LVyCs

gl+LTnCIQmSGJpbU+s259ZHuByHkIKFzuTtATzBv8cAxvItp0SbGjti1mzw6bileQmbo9Uf+ztv

Hca5u/D3X2vP6IF/De/GjVsBULQ1Ns40yb/YF1FdhyF5EdaMyeb77D/rE2eggoMeiSnXdbness2

EsXiHeUvwTvPCFtmaGjOLbcJGRH0Z3q8j291C3kdNf5p6NoWogqhh50mp6dBGcLTx70shQo2QQ4

kY5raZp0L+RS

X-Received: by 2002:a05:6830:828f:b0:7d7:cb13:3fef with SMTP id

46e09a7af769-7e3da4bffdbmr2680557a34.20.1778681854648; Wed, 13 May 2026

07:17:34 -0700 (PDT)

MIME-Version: 1.0

From: Onur Genc

Date: Wed, 13 May 2026 15:16:51 +0100

X-Gm-Features: AVHnY4LgY-C-6hssAj0mQWnwarAYCjnUaYvxz4qL--NDjUSTQ3l9bAlezGKusVo

Message-ID:

Subject: Partnership Deal

To: root@nk.ca

Content-Type: multipart/alternative; boundary="0000000000001d63980651b3a472"



--0000000000001d63980651b3a472

Content-Type: text/plain; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable



I have tried to reach out to you in the past but you seems not active,

Let me know if it's okay for me to send specifics of a proposal to your

email address since I have it from LinkedIn.




Warm regards,

Onur Gen=C3=A7.

Chief Executive Officer.



--0000000000001d63980651b3a472

Content-Type: text/html; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable





=3D"gmail_signature" data-smartmail=3D"gmail_signature">

iv dir=3D"ltr">

e=3D"color:rgb(34,34,34)">I have tried =

to reach out to you =C2=A0in the past but you seems not active, Let me know=

if it's okay for me to send specifics of a proposal to your email addr=

ess since I have it from LinkedIn.

34,34,34)">

color=3D"#000000">Warm regards,
On=

ur Gen=C3=A7.
Chief Executive Officer.

iv>




--0000000000001d63980651b3a472--

Web/SEO/App spam from Google Gmail

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Wed, 13 May 2026 07:28:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wN9d1-00000000Pg5-1a4Y

for dave@doctor.nl2k.ab.ca;

Wed, 13 May 2026 07:27:59 -0600

Resent-From: The Doctor

Resent-Date: Wed, 13 May 2026 07:27:59 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-pl1-f200.google.com ([209.85.214.200]:43196)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1wN5Iv-00000000BAb-31HI

for root@nk.ca;

Wed, 13 May 2026 02:51:07 -0600

Received: by mail-pl1-f200.google.com with SMTP id d9443c01a7336-2ba054e0304so56380155ad.0

for ; Wed, 13 May 2026 01:50:09 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=websitedevelopercalifornia.com; s=google; t=1778662203; x=1779267003; darn=nk.ca;

h=to:from:subject:date:message-id:reply-to:mime-version:from:to:cc

:subject:date:message-id:reply-to;

bh=n8h+XozLB1R0XmU3VpXH9DETblpKqcv/RiOx9RTfPq0=;

b=N64SBaTceYLXeXKjpimcK9CeKBKTJrpkKs9IWw51Wt8q1jGOo9lQPaJzQIrm4y5nJT

NOU5ek5YG6RDyLuUtTmAnCn4ntjp3uQ3myIJAcnCtETRdbmijCnN4svBYp5FS/YkfdDE

/v4XNcDxtR9Gm64oy8poerUsv74n9iL2fONQA=

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20251104; t=1778662203; x=1779267003;

h=to:from:subject:date:message-id:reply-to:mime-version

:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to;

bh=n8h+XozLB1R0XmU3VpXH9DETblpKqcv/RiOx9RTfPq0=;

b=caN3Ck2IvebYdz8mdFEYicetm3f7SQ+ce/S/2IjkJn4m57FOAl8xsA2F/xEZZ93dEx

jgNUE8h2Uwr7Dp0ZPJb/k+FanQ5PMPzu1bb/8qOFlMZnv2dLxu/5OIZfjKidWp3mtoB/

wzjZjC85uSJxkX91l9ZPCgG62xR5WlTsB1Wv6tu2eRCqD2fesquvBoHjsqC6JzSw5es+

e/ix7zgnUFrDO2rIoOfosUrBidx2XZOppmgYLJLepZaspehasrSkfS0D5ZZzsTTm9Ybk

0b74fo2hJ4iTPJ9m+PD1IiDiYIIcX3dLd68wqaJuhZOv6ExcMECkWGTza1EW/uJNSIiU

9wig==

X-Gm-Message-State: AOJu0YwDomvTEeHYWufTgjFKiX1sy5Pw75vkGYqRw/M7Sh1ABfb4XIi7

VvXbXdvpKikXcDj0hbxIGoBAddXVr7GYwydHFB6Uv27JgF8NtH7xKor1GyqsJCDKOgQ1Sfn4oZN

+DFpUA9OShzytvyIkvLna5A==

MIME-Version: 1.0

X-Received: by 2002:a05:6300:210d:b0:3a2:c9a1:2c26 with SMTP id

adf61e73a8af0-3acd4209000mr7959505637.7.1778662203365; Wed, 13 May 2026

01:50:03 -0700 (PDT)

Reply-To: Info@websitedevelopercalifornia.com

Message-ID:

Date: Wed, 13 May 2026 08:50:03 +0000

Subject: Re: __Most Important www.nk.ca!!

From: alana@websitedevelopercalifornia.com

To: root@nk.ca

Content-Type: multipart/alternative; boundary="000000000000cea7a60651af106a"

X-Spam_score: 8.9

X-Spam_score_int: 89

X-Spam_bar: ++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Hi, I hope you're doing well. I reviewed your website www.nk.ca

and see strong potential to improve its design and overall user experience.

A modern, responsive, and professional website can help you attract more

visitors and incr [...]



Content analysis details: (8.9 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[209.85.214.200 listed in dnsbl.ahbl.org]

[209.85.214.200 listed in dnsbl.ahbl.org]

[209.85.214.200 listed in dnsbl.ahbl.org]

[209.85.214.200 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[209.85.214.200 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[209.85.214.200 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[209.85.214.200 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[209.85.214.200 listed in dnsbl.ahbl.org]

1.9 URIBL_JP_SURBL Contains an URL listed in the JP SURBL blocklist

[URI: websitedevelopercalifornia.com]

1.9 URIBL_ABUSE_SURBL Contains an URL listed in the ABUSE SURBL blocklist

[URI: websitedevelopercalifornia.com]

1.7 URIBL_BLACK Contains an URL listed in the URIBL blacklist

[URI: websitedevelopercalifornia.com]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[209.85.214.200 listed in list.dnswl.org]

-0.0 RCVD_IN_MSPIKE_H3 RBL: Good reputation (+3)

[209.85.214.200 listed in wl.mailspike.net]

-0.0 SPF_PASS SPF: sender matches SPF record

-0.0 RCVD_IN_MSPIKE_WL Mailspike good senders

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[209.85.214.200 listed in bl.score.senderscore.com]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[209.85.214.200 listed in will-spam-for-food.eu.org]

[209.85.214.200 listed in will-spam-for-food.eu.org]

[209.85.214.200 listed in will-spam-for-food.eu.org]

[209.85.214.200 listed in will-spam-for-food.eu.org]

[209.85.214.200 listed in will-spam-for-food.eu.org]

[209.85.214.200 listed in will-spam-for-food.eu.org]

[209.85.214.200 listed in will-spam-for-food.eu.org]

[209.85.214.200 listed in will-spam-for-food.eu.org]

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

2.0 RATWR8_MESSID Message-ID with excessive dashes and dollars

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

Subject: {SPAM?} Re: __Most Important www.nk.ca!!



--000000000000cea7a60651af106a

Content-Type: text/plain; charset="UTF-8"; format=flowed; delsp=yes



Hi,



I hope you're doing well.



I reviewed your website www.nk.ca and see strong potential to improve its

design and overall user experience. A modern, responsive, and professional

website can help you attract more visitors and increase conversions.



We provide complete website design services, including custom design,

mobile-friendly layouts, and optimized pages to support your business

growth.



Kindly share your requirements and contact details, and let me know a

convenient time for a quick meeting.



Thank you!!



--000000000000cea7a60651af106a

Content-Type: text/html; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable



Hi,

I hope you're doing well.

I reviewed your website www.nk.=

ca and see strong potential to improve its design and overall user experien=

ce. A modern, responsive, and professional website can help you attract mor=

e visitors and increase conversions.

We provide complete website des=

ign services, including custom design, mobile-friendly layouts, and optimiz=

ed pages to support your business growth.

Kindly share your requirem=

ents and contact details, and let me know a convenient time for a quick mee=

ting.

Thank you!!


--000000000000cea7a60651af106a--

Web/SEO/App spam from Google Gmail Part 2

PS- If you no longer wish to receive emails from us, kindly reply to this

email with the subject line "REMOVE" or "UNSUBSCRIBE," and we will promptly

remove your email address from our mailing list. Please allow up to 48 hours

for the changes to take effect.





------=_NextPart_000_25BBC_01DCE2DE.7725DF20

Content-Type: text/html;

charset="us-ascii"

Content-Transfer-Encoding: quoted-printable




xmlns:o=3D"urn:schemas-microsoft-com:office:office" =

xmlns:w=3D"urn:schemas-microsoft-com:office:word" =

xmlns:m=3D"http://schemas.microsoft.com/office/2004/12/omml" =

xmlns=3D"http://www.w3.org/TR/REC-html40">






charset=3Dus-ascii">




















style=3D'mso-margin-top-alt:0in;

margin-right:0in;margin-bottom:10.0pt;margin-left:0in;background:white'><=

span

style=3D'font-size:11.0pt;font-family:"Calibri","sans-serif";color:#24406=

1'>Hi,
style=3D'font-size:11.0pt;font-family:"Calibri","sans-serif";color:#22222=

2'>






style=3D'mso-margin-top-alt:0in;

margin-right:0in;margin-bottom:10.0pt;margin-left:0in;background:white'><=

span

style=3D'font-size:11.0pt;font-family:"Calibri","sans-serif";color:#24406=

1'>I was

checking your website 
style=3D'font-family:"Calibri","sans-serif";

color:#244061'>www.nk.ca

style=3D'font-size:11.0pt;font-family:

"Calibri","sans-serif";color:#244061'>'

style=3D'font-size:11.0pt;font-family:"Calibri","sans-serif";color:#24406=

1'> 

style=3D'font-size:11.0pt;font-family:"Calibri","sans-serif";color:#24406=

1'>and

see you have a good design, and it looks great, but it’s not =

ranking on

Google and other major search engines. Do you want more targeted =

visitors on

your website?
style=3D'font-size:11.0pt;font-family:"Calibri","sans-serif";

color:#222222'>






style=3D'mso-margin-top-alt:0in;

margin-right:0in;margin-bottom:10.0pt;margin-left:0in;background:white'><=

span

style=3D'font-size:11.0pt;font-family:"Calibri","sans-serif";color:#24406=

1'>We can

place your website on Google 1st page. Yahoo, Facebook, LinkedIn, =

YouTube,

Integral, Pinterest etc.).
style=3D'font-size:11.0pt;font-family:

"Calibri","sans-serif";color:#222222'>






style=3D'mso-margin-top-alt:0in;

margin-right:0in;margin-bottom:10.0pt;margin-left:0in;background:white'><=

span

style=3D'font-size:11.0pt;font-family:"Calibri","sans-serif";color:#24406=

1'>May I

send you a quote, Price SEO Packages? If interested.
style=3D'font-size:11.0pt;font-family:"Calibri","sans-serif";color:#22222=

2'>






style=3D'mso-margin-top-alt:0in;

margin-right:0in;margin-bottom:10.0pt;margin-left:0in;background:white'><=

span

style=3D'font-size:11.0pt;font-family:"Calibri","sans-serif";color:#24406=

1'>Thanks

& Regards



style=3D'font-family:"Calibri","sans-serif"'>Delilah
,
an>
style=3D'font-size:11.0pt;font-family:"Calibri","sans-serif";color:#22222=

2'>






style=3D'mso-margin-top-alt:0in;

margin-right:0in;margin-bottom:10.0pt;margin-left:0in;background:white'><=

span

style=3D'font-size:11.5pt;font-family:"Calibri","sans-serif";color:#22222=

2'> 
style=3D'font-size:11.0pt;font-family:"Calibri","sans-serif";color:#22222=

2'>






style=3D'mso-margin-top-alt:0in;

margin-right:0in;margin-bottom:10.0pt;margin-left:0in;background:white'><=

span

style=3D'font-size:11.5pt;font-family:"Calibri","sans-serif";color:#22222=

2'> 
style=3D'font-size:11.0pt;font-family:"Calibri","sans-serif";color:#22222=

2'>






style=3D'mso-margin-top-alt:0in;

margin-right:0in;margin-bottom:10.0pt;margin-left:0in;background:white'><=

span

style=3D'font-size:11.5pt;font-family:"Calibri","sans-serif";color:#22222=

2'> 
style=3D'font-size:11.0pt;font-family:"Calibri","sans-serif";color:#22222=

2'>






style=3D'mso-margin-top-alt:0in;

margin-right:0in;margin-bottom:12.0pt;margin-left:0in;background:white'><=

span

style=3D'font-size:11.5pt;font-family:"Calibri","sans-serif";color:#22222=

2'>















style=3D'font-size:11.0pt;font-family:"Calibri","sans-serif";

color:#222222'>






style=3D'mso-margin-top-alt:0in;

margin-right:0in;margin-bottom:10.0pt;margin-left:0in;background:white'><=

span

style=3D'font-size:11.5pt;font-family:"Calibri","sans-serif";color:#22222=

2'>













style=3D'mso-margin-top-alt:0in;

margin-right:0in;margin-bottom:10.0pt;margin-left:0in;background:white'><=

span

style=3D'font-size:11.5pt;font-family:"Calibri","sans-serif";color:#22222=

2'>











PS- If you no longer wish to receive emails from us, kindly reply to =

this email

with the subject line 
style=3D'font-size:11.5pt;font-family:

"Calibri","sans-serif";color:red'>"REMOVE" or

"UNSUBSCRIBE,"

style=3D'font-size:11.5pt;font-family:"Calibri","sans-serif";

color:#222222'> and we will promptly remove your email address from =

our

mailing list. Please allow up to 48 hours for the changes to take =

effect.

style=3D'font-size:11.0pt;font-family:"Calibri","sans-serif";color:#22222=

2'>





 





 

















------=_NextPart_000_25BBC_01DCE2DE.7725DF20--



Web/SEO/App spam from Google Gmail Part 1

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Wed, 13 May 2026 07:28:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wN9ch-00000000P26-01TQ

for dave@doctor.nl2k.ab.ca;

Wed, 13 May 2026 07:27:39 -0600

Resent-From: The Doctor

Resent-Date: Wed, 13 May 2026 07:27:38 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-pf1-f195.google.com ([209.85.210.195]:47363)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1wN4jY-000000008JP-1rA4

for sales@nk.ca;

Wed, 13 May 2026 02:14:35 -0600

Received: by mail-pf1-f195.google.com with SMTP id d2e1a72fcca58-8383fb7143aso3079091b3a.3

for ; Wed, 13 May 2026 01:13:34 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=oxygentech.in; s=google; t=1778660009; x=1779264809; darn=nk.ca;

h=content-language:thread-index:mime-version:message-id:date:subject

:to:from:from:to:cc:subject:date:message-id:reply-to;

bh=Ix9kWYLJFhr0XYO/HLj//nJp7kGHDc92mBOgHeM6P7o=;

b=hvxUMBjhN7ZiXHLhnEHPSN7posZRhWxeBOH5Rp20scKviirtAFL868iRpyzAXMDG1Q

NLPWTDSSCkDuQagDxumq0UgKj6sPOdRsu9/QBsMs5mkBZ7ai/NUYZRQILLi7Wp8rT9rl

r7VijPfZfu7BzwH82SWj+fJ32Q6Nr8sGDVamLlce8q4/RbSapp5PI9gUN5EteFCTcJPW

gYsaKdStnE8lJQxP9IirAIEMAITBCgMPbr4fK5sQYjbVbMjjdzuc9Di/gbhMdVQvfWYS

VvCBspn5Puq4DN2BcXdNFcJC9KmzK+vrV0apCATYkc3KAfwXRt0KMyaLO3VrSo669U3j

PYrA==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20251104; t=1778660009; x=1779264809;

h=content-language:thread-index:mime-version:message-id:date:subject

:to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date

:message-id:reply-to;

bh=Ix9kWYLJFhr0XYO/HLj//nJp7kGHDc92mBOgHeM6P7o=;

b=ELzz+rCrGXUP3T9pb8YA7u1NC96TZDPAHE9yXb1w8iBFdMjJnB/2rYZT/T99c/AOJ0

YQ/SWGSk4RyiROETEOohG7ImFYz7hRY+f8jknR0AdxYe37nvnMCJMir7AvZHNRMeq+MF

gDa/ZnbYgs5gpMjWo8qPUcgHG6hrzpdZvIvq4nHwk+Txt0j3N1Y/GBWLAmmVv5FDlX/l

+uE0aUuesUo+Y7ifrAi4ult18nwy05xXCnw4WoB0SlKpyo8MkjFWTJr5x5FIToc32UC0

wsVyr5z8rUo1ga+TVVzozmiFjtaSr4tyDe4OWSD/2oeSn5i4WWHYF4bDP2Opj/Fc4CF6

9CrA==

X-Gm-Message-State: AOJu0Yx6SHsk8xYj4D/AYimt5tp0cPLz/FpS6L+fEZDLLid14eytRnfH

ngf9rvPXYV11AEQ7yoAEnoEkdy1eMB9n56Lpbrvbak9L2f6627dA3FZJjo6iKyC2SL0q25kcWcH

SCh7ersI=

X-Gm-Gg: Acq92OEguLrgXc+UbVMKSdkWy+YocuhDjlhtdfeOI8IUor76GaDS7urSo7mAusi42xD

0TnsbdUtXM67sNPelB0/Dvn4tW7sYbYw+UuwYYqDN0tWjDxOH73s0qIkcA1P97XV4HMLSu6mRmi

8NI5hfXLKBYGIt+tttmI37f9Vev084ZXZwW+dlqTbTyZlkiBXqUo00rjDO5ViIToFe4yqVEzYLo

htzDrh1FPskbYTntwbXOJa3hk3+eDbjlvcr/uIfulk7kEF9b3z4Ys+K7rzBvpCxct6+Pu3uNsk8

rJgA1NRyAJMEKNINjOrePmTWGFnxNWFwK9shEyhw9NRuHllrTCmYumsyprvn42nEtgPCDOYJ52h

hZ6Rt67y9Cm5xqvb0dt1E+Q/2374z9lPHeuF4IMKhzxVQMiAFlDupAnHZNht2C4zjysmTEvVW7s

q08VG+i31tzXEgdFevrZHU7aNG/VNaaFr4/RquG6CUvUP4

X-Received: by 2002:a05:6a00:1c9c:b0:82c:d7c4:4c56 with SMTP id d2e1a72fcca58-83f03fcb1edmr2269187b3a.15.1778660008464;

Wed, 13 May 2026 01:13:28 -0700 (PDT)

Received: from vicPC ([2409:40d0:1346:deab:6d91:3835:a959:9bf1])

by smtp.gmail.com with ESMTPSA id d2e1a72fcca58-8396563f11csm32603612b3a.3.2026.05.13.01.13.26

for

(version=TLS1 cipher=ECDHE-ECDSA-AES128-SHA bits=128/128);

Wed, 13 May 2026 01:13:27 -0700 (PDT)

From: "Delilah"

To:

Subject: More Traffic for Your Website

Date: Wed, 13 May 2026 13:21:57 +0530

Message-ID: <25bbb01dce2b0$5d6da320$1848e960$@in>

MIME-Version: 1.0

Content-Type: multipart/alternative;

boundary="----=_NextPart_000_25BBC_01DCE2DE.7725DF20"

X-Mailer: Microsoft Office Outlook 12.0

Thread-Index: AdzhNXyUhlsJD1x9TtCjDiuCUwQ5EQ==

Content-Language: en-us

X-Spam_score: 9.4

X-Spam_score_int: 94

X-Spam_bar: +++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Hi, I was checking your website www.nk.ca' and see you have

a good design, and it looks great, but it's not ranking on Google and other

major search engines. Do you want more targeted visitors on your web [...]





Content analysis details: (9.4 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[209.85.210.195 listed in dnsbl.ahbl.org]

[209.85.210.195 listed in dnsbl.ahbl.org]

[209.85.210.195 listed in dnsbl.ahbl.org]

[209.85.210.195 listed in dnsbl.ahbl.org]

[2409:40d0:1346:deab:6d91:3835:a959:9bf1 listed]

[in dnsbl.ahbl.org]

[2409:40d0:1346:deab:6d91:3835:a959:9bf1 listed]

[in dnsbl.ahbl.org]

[2409:40d0:1346:deab:6d91:3835:a959:9bf1 listed]

[in dnsbl.ahbl.org]

[2409:40d0:1346:deab:6d91:3835:a959:9bf1 listed]

[in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[209.85.210.195 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[209.85.210.195 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[209.85.210.195 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[209.85.210.195 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[2409:40d0:1346:deab:6d91:3835:a959:9bf1 listed]

[in will-spam-for-food.eu.org]

[2409:40d0:1346:deab:6d91:3835:a959:9bf1 listed]

[in will-spam-for-food.eu.org]

[2409:40d0:1346:deab:6d91:3835:a959:9bf1 listed]

[in will-spam-for-food.eu.org]

[2409:40d0:1346:deab:6d91:3835:a959:9bf1 listed]

[in will-spam-for-food.eu.org]

[2409:40d0:1346:deab:6d91:3835:a959:9bf1 listed]

[in will-spam-for-food.eu.org]

[2409:40d0:1346:deab:6d91:3835:a959:9bf1 listed]

[in will-spam-for-food.eu.org]

[2409:40d0:1346:deab:6d91:3835:a959:9bf1 listed]

[in will-spam-for-food.eu.org]

[2409:40d0:1346:deab:6d91:3835:a959:9bf1 listed]

[in will-spam-for-food.eu.org]

[209.85.210.195 listed in will-spam-for-food.eu.org]

[209.85.210.195 listed in will-spam-for-food.eu.org]

[209.85.210.195 listed in will-spam-for-food.eu.org]

[209.85.210.195 listed in will-spam-for-food.eu.org]

[209.85.210.195 listed in will-spam-for-food.eu.org]

[209.85.210.195 listed in will-spam-for-food.eu.org]

[209.85.210.195 listed in will-spam-for-food.eu.org]

[209.85.210.195 listed in will-spam-for-food.eu.org]

1.9 URIBL_JP_SURBL Contains an URL listed in the JP SURBL blocklist

[URI: oxygentech.in]

1.9 URIBL_ABUSE_SURBL Contains an URL listed in the ABUSE SURBL blocklist

[URI: oxygentech.in]

2.5 URIBL_DBL_SPAM Contains a spam URL listed in the DBL blocklist

[URI: oxygentech.in]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

1.7 URIBL_BLACK Contains an URL listed in the URIBL blacklist

[URI: oxygentech.in]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[209.85.210.195 listed in list.dnswl.org]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[209.85.210.195 listed in bl.score.senderscore.com]

-0.0 RCVD_IN_MSPIKE_H3 RBL: Good reputation (+3)

[209.85.210.195 listed in wl.mailspike.net]

0.0 T_SPF_PERMERROR SPF: test of record failed (permerror)

-0.0 RCVD_IN_MSPIKE_WL Mailspike good senders

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

Subject: {SPAM?} More Traffic for Your Website



This is a multipart message in MIME format.



------=_NextPart_000_25BBC_01DCE2DE.7725DF20

Content-Type: text/plain;

charset="us-ascii"

Content-Transfer-Encoding: 7bit



Hi,



I was checking your website www.nk.ca' and see you have a good design, and

it looks great, but it's not ranking on Google and other major search

engines. Do you want more targeted visitors on your website?



We can place your website on Google 1st page. Yahoo, Facebook, LinkedIn,

YouTube, Integral, Pinterest etc.).



May I send you a quote, Price SEO Packages? If interested.



Thanks & Regards

Delilah,

We Transfer phish

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Wed, 13 May 2026 07:28:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wN9cQ-00000000Oe0-37oE

for dave@doctor.nl2k.ab.ca;

Wed, 13 May 2026 07:27:22 -0600

Resent-From: The Doctor

Resent-Date: Wed, 13 May 2026 07:27:22 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from [92.112.125.227] (port=54728 helo=mail.protector-tw.org)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1wN3Vw-000000001RN-2dMY

for support@nk.ca;

Wed, 13 May 2026 00:56:27 -0600

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=protector-tw.org;

s=202603; t=1778655321;

bh=Vu7lAp4z2K15fxov5qz8Ed8ZdbRd22wzs7MIDU5g0+U=;

h=From:To:Subject:Date:From;

b=tzalMaQ7fDWRA3BJbmecCxwSZoQ0Q/M1FXuHkNxUEPkHG4NVUWF6kyLqUw9xgy8J/

IFFZ5+VEUn1Dbd55pXeqV12GHn6uX3/yjJQEkAmZrYb0L6cXUNqRlN5Z2Kc1j7w16+

sOIsxx7XBjrx8zzf/z+T/sJn2MdM6YGKGLfVBECs=

Received: from protector-tw.org (unknown [148.135.207.6])

by mail.protector-tw.org (Postfix) with ESMTPSA id 37112CBA74

for ; Wed, 13 May 2026 12:55:21 +0600 (+06)

From: "WeTransfer"

To: support@nk.ca

Subject: support@nk.ca You have received some files.

Date: 13 May 2026 11:55:21 +0500

Message-ID: <20260513115520.2ADC6AFCE4D5D078@protector-tw.org>

MIME-Version: 1.0

Content-Type: multipart/related;

boundary="----=_NextPart_000_0012_8070634E.8A4ED8F6"

X-Spam_score: 6.5

X-Spam_score_int: 65

X-Spam_bar: ++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Goodday support@nk.ca, You have received some files



Content analysis details: (6.5 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[92.112.125.227 listed in dnsbl.ahbl.org]

[92.112.125.227 listed in dnsbl.ahbl.org]

[92.112.125.227 listed in dnsbl.ahbl.org]

[92.112.125.227 listed in dnsbl.ahbl.org]

[148.135.207.6 listed in dnsbl.ahbl.org]

[148.135.207.6 listed in dnsbl.ahbl.org]

[148.135.207.6 listed in dnsbl.ahbl.org]

[148.135.207.6 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[92.112.125.227 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[92.112.125.227 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[92.112.125.227 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[92.112.125.227 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[148.135.207.6 listed in will-spam-for-food.eu.org]

[148.135.207.6 listed in will-spam-for-food.eu.org]

[148.135.207.6 listed in will-spam-for-food.eu.org]

[148.135.207.6 listed in will-spam-for-food.eu.org]

[148.135.207.6 listed in will-spam-for-food.eu.org]

[148.135.207.6 listed in will-spam-for-food.eu.org]

[148.135.207.6 listed in will-spam-for-food.eu.org]

[148.135.207.6 listed in will-spam-for-food.eu.org]

[92.112.125.227 listed in will-spam-for-food.eu.org]

[92.112.125.227 listed in will-spam-for-food.eu.org]

[92.112.125.227 listed in will-spam-for-food.eu.org]

[92.112.125.227 listed in will-spam-for-food.eu.org]

[92.112.125.227 listed in will-spam-for-food.eu.org]

[92.112.125.227 listed in will-spam-for-food.eu.org]

[92.112.125.227 listed in will-spam-for-food.eu.org]

[92.112.125.227 listed in will-spam-for-food.eu.org]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-0.0 SPF_PASS SPF: sender matches SPF record

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

0.5 NO_RDNS Sending MTA has no reverse DNS (Postfix variant)

2.0 PDS_OTHER_BAD_TLD Untrustworthy TLDs

[URI: protector-tw.online (online)]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[92.112.125.227 listed in bl.score.senderscore.com]

0.0 HTML_MESSAGE BODY: HTML included in message

0.1 MXG_EMAIL_FRAG BODY: URI with email in fragment

0.0 HTML_IMAGE_RATIO_06 BODY: HTML has a low ratio of text to image area

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

1.3 RDNS_NONE Delivered to internal network by a host with no rDNS

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

Subject: {SPAM?} support@nk.ca You have received some files.



Subject:

support@nk.ca You have received some files.

From:

"WeTransfer"

Date:

5/13/26, 00:55

To:

support@nk.ca



WeTransfer Logo

Goodday support@nk.ca,



You have received some files



3 items, 33 MB in total

Heads up this file transfer will expire on 20/05/2026 when this happens, these files will be removed from our server

Get your files



Three attachment . Scanned successfully

Company Introduction.mp4 Company Profile & Catalogue.pdf RFQ.xls



The contents of this message, together with any attachments, are intended only for the use of the person(s) to which they are addressed and may contain confidential and/or privileged information. Further, any information herein is confidential and protected by law. It is unlawful for unauthorized persons to use, review, copy, disclose, or disseminate confidential information. If you are not the intended recipient, immediately advise the sender and delete this message and any attachments. Any distribution, or copying of this message, or any attachment, is prohibited.