collaberation spam from Google Gmail

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Mon, 27 Jul 2026 07:38:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.5 (FreeBSD))

(envelope-from )

id 1woLWd-00000000CZP-2V1K

for dave@doctor.nl2k.ab.ca;

Mon, 27 Jul 2026 07:37:47 -0600

Resent-From: The Doctor

Resent-Date: Mon, 27 Jul 2026 07:37:47 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-yw1-f169.google.com ([209.85.128.169]:59646)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.99.5 (FreeBSD))

(envelope-from )

id 1woG2D-00000000L4s-3EiZ

for root@nk.ca;

Mon, 27 Jul 2026 01:46:11 -0600

Received: by mail-yw1-f169.google.com with SMTP id 00721157ae682-81eef95653fso17270867b3.2

for ; Mon, 27 Jul 2026 00:45:14 -0700 (PDT)

ARC-Seal: i=1; a=rsa-sha256; t=1785138308; cv=none;

d=google.com; s=arc-20260327;

b=OQjFeYprwhjSI8/kTh9OI964bjSJyFhKsI6fIO+gRqTmquU2WrkjB6KQLI4wwhNGzK

gMagVUWPx1YRGCooxUI+8CRAM3Ruk5Jq0spjnDcQ5V18COhW5K4HCxLSofT7XpawFZNy

N2qqgYVBOk06P2/MC3rbYy0lKqX50erby1j8/BGxnoP+gwYtL0CP+DSJpVn64BWqP6Ep

ZZhYRH+wz+j8a4LNmM/rFYTusA82nuXAS6n/De/YMqmNIbzJKteB3y4/QpPAQZy4Lodi

DW51xUNrbrOTN5aCxfJd5ULKfI4xBwgzziw+c4hbK2nkkqfWfW5JDGFhRLCM3goJGwCo

Ijeg==

ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20260327;

h=to:subject:message-id:date:from:mime-version:dkim-signature;

bh=AthGtbu1EgN9gMx+Qc5FoGfhfB+kHJWkhQNVgweMbUg=;

fh=ny7+SATv4n6lSNl0rVMQyaj6POVJTUZJLShjjgjSTJg=;

b=GGeipFz35pTdYyzRABVBBkDGFFqtMc6vJtzFkXaPjGu4Iijhk2afSI7P7kS3o4sBi/

PLtmCY+N1dzcp4HDMN7sABs17DUcKmBtBnDGBDW8lTin8RMQZJ6JjR0JbUmifpJs2KkQ

Rc1OV02GyD7My1wxzi9OXphgbghTpByoKIvmIiMVZEMmuA4qRAt88VWnKmrERyL+h63V

CV9gluftjjvJXjxc05J6YZ3HtiV74zetOT3CQKAQKyMFc1vKYsApmuI61w5yItjTTY3n

O3pll6GpkiZoxXyO5EzK2SX0qPsYgPbkIzAc08rjNPKlftEpSfRzdkGRFhazzFVQ8uEz

N5LA==;

darn=nk.ca

ARC-Authentication-Results: i=1; mx.google.com; arc=none

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=gmail.com; s=20251104; t=1785138308; x=1785743108; darn=nk.ca;

h=content-type:to:subject:message-id:date:from:mime-version:from:to

:cc:subject:date:message-id:reply-to:content-type;

bh=AthGtbu1EgN9gMx+Qc5FoGfhfB+kHJWkhQNVgweMbUg=;

b=c2c+WOQw2oYg74qSfPV76TuYg/2QH4TfDYh+j5u8cwGlb2RYVXljZlbXDENP7injGK

2prLRpsGTF2XidZ3c2fZTzrQhB9DvzjvH6TNqWChjq25qJVoOxfTyvFGei1ZhFQmNBiR

DuHJRUarO3TkejPYJYUA2ZIQlz5OzfUsdl+HAliNqe7Rqz1FxAz9+oHB6TAyzzIUGJRa

w9g2qEtPJQ5pvfkY5SeXFv4/zLihOdKkJvLm9Coh5WUj0nKEJcu247P4MFLOivm01WlI

GT0ZwETPUeNHBCkGA3UPHnBu9d6wtdsX7pCSoG886KD4XhuPXF2K4Ds4mFIgL411bxK4

pRhQ==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20251104; t=1785138308; x=1785743108;

h=content-type:to:subject:message-id:date:from:mime-version:x-gm-gg

:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to

:content-type;

bh=AthGtbu1EgN9gMx+Qc5FoGfhfB+kHJWkhQNVgweMbUg=;

b=MaPbsSi4DzrwIQrv4RAnft8p9EmE5Zyny0bRw/P9KUK16DmOwoqL8zzU0iInPVSJjL

OkB3kDokI+L56Y272fDxOjaE4SbtuDFTxazDH9zGKVe5atdSuDtd64QmkS/auhl46+RS

HF9fPuewQVWe00A36b0rPLZM3v7byKeG1O8ikosIVqrgfbuhIqiHuHkPRYUK1QfqYNp6

GHQMhWcqsDgS9pysnol5/AENnDI2tQ69B3otMoRxLLvvYRkqIjR/MizvS3CqaVpC13nf

xc5j+fMaT77BAVgfxkQ2nH9P/3sNBfd2qfKix4h8V/8g4tkiMJkmMzsGdDuhuBKBhpxy

jFGA==

X-Gm-Message-State: AOJu0YyItMuyRFcmCEX7RoUcK2gFZpV8J9JYROeLWRe1pzz9LAxoTOmy

GkgjsWMqpLugdVGEB7rNeSUrN9H4ZMAMnCj6B95sIqQEMqmVjhy0yhoNUPvmOZ5ydMqfox2P1n+

mnxhJixcqWgmEM0mwJ55VxFBPZPuemgpLdmjRtkQ=

X-Gm-Gg: AR+sD12YD6DpOn207wHVu0tRSgOWeHMbGAnj1gQ11Wi2Y1DHXs84vYlA79TrwHhf2Mf

miqa5/PGRT4QHuC30quk8uEZ90t58xeR7yo5AXVEOjuac4ULypCVKazsgtKHv2N2vIu3/kfcQGH

/+6iS6WmANS7+SPjsky9HxRn3DLtsO27Gj52uhSy5MkKB5AtUSTPm8b5eoJDCek+SaxeHD2XMgh

8JJwpKFlzVNbowXvLJQUQhUK738zCyqnYmtePIzFS9DdHKuCV/3Jn4U7+sJrA==

X-Received: by 2002:a05:690c:b03:b0:81e:c436:c530 with SMTP id

00721157ae682-81f69ce00d2mr26443517b3.14.1785138307994; Mon, 27 Jul 2026

00:45:07 -0700 (PDT)

MIME-Version: 1.0

From: Onur Genc

Date: Mon, 27 Jul 2026 08:44:38 +0100

X-Gm-Features: AUfX_myurJtdvF6jGIGz0z5fS2D_HrtKPv9fL1L8rgz1T814S-rHu7TZc0SCCRI

Message-ID:

Subject: Collaboration Insight

To: root@nk.ca

Content-Type: multipart/alternative; boundary="000000000000b9184b065792e61c"



--000000000000b9184b065792e61c

Content-Type: text/plain; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable



Could you please let me know if sending a proposal's information to the

above address is okay. On LinkedIn, I was able to locate your email

address..



Warms Regards,

Mr Onur Gen=C3=A7.

[image: Your profile picture]



--000000000000b9184b065792e61c

Content-Type: text/html; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable





=3D"gmail_signature" data-smartmail=3D"gmail_signature">

iv style=3D"color:rgb(34,34,34)">

0,0);font-family:"Google Sans",Roboto,RobotoDraft,Helvetica,Arial=

,sans-serif">Could you please let me know if sending a proposal's=

information to the above address is okay. On=C2=A0LinkedIn, I was able to =

locate your email address..

ium">
Helvetica,Arial,sans-serif">

n>
Warms Regards=

,
Mr Onur =

Gen=C3=A7.
<=

font color=3D"#ff0000">3D"Your
t=3D"96" style=3D"border-width:medium;border-style:none;border-color:curren=

tcolor;border-radius:50%;max-width:288px;font-family:"Google Sans Flex=

","Google Sans Text","Google Sans",Roboto,Arial,sa=

ns-serif;font-size:14px;background-color:rgb(248,250,253)">
>




--000000000000b9184b065792e61c--

x/Twitter 2FA Phish

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Sun, 26 Jul 2026 19:28:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.5 (FreeBSD))

(envelope-from )

id 1woA8F-00000000OYE-0lYv

for dave@doctor.nl2k.ab.ca;

Sun, 26 Jul 2026 19:27:51 -0600

Resent-From: The Doctor

Resent-Date: Sun, 26 Jul 2026 19:27:50 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from outgoing21.flk.host-h.net ([197.242.87.55]:38597)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.99.5 (FreeBSD))

(envelope-from )

id 1wo6Fx-000000003wY-36Zk

for doctor@doctor.nl2k.ab.ca;

Sun, 26 Jul 2026 15:19:43 -0600

DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed;

d=thinkubate.co; s=xneelo; h=Date:Content-Type:MIME-Version:Message-ID:

Reply-To:From:Subject:To:sender:cc:bcc:in-reply-to:references:

content-transfer-encoding; bh=LGQHXlD8SpeMgoVQ4+BkfqaPSKdelkkBFeSA1/fPNUs=;

b=ocpWszEHccsUV5CnWjO6x6cJzXc9g1TwHejSDbmrKy+YXTmPS6AmzroT7gRiinoqLaiSFmaGZoc

erq5/ik5BL9xbJGigyLpp3li0N84EENz1VkeAJoKc/3gqAd+yMwONv4JzG0cJa7ZVxodtVX40Hewg

3eDLcunWA2OPLeXZ1NgzX4xHVQwgIhZvTABPjBnNowsvUE+QhsTLAl+W0ZcA8FPOnyKGO+sJV232p

xKsisXNH8tXWIJKWIsEAPvsCYiM0x73WEmniAUvBNyKtsuVr3k4wpAcgK8ySgzBk+U6esb9FqHvNZ

Y+BmD/bI7MG9VJt2wewliX5nHQ1knIidWMCA==;

Received: from www34.flk1.host-h.net ([78.47.0.91])

by antispam5-flk1.host-h.net with esmtpsa (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.94.2)

(envelope-from )

id 1wo68N-000OVR-CP

for doctor@doctor.nl2k.ab.ca; Sun, 26 Jul 2026 23:18:38 +0200

Received: from thinkjmwfn by www34.flk1.host-h.net with local (Exim 4.98.2)

(envelope-from )

id 1wo6F3-0000000BiXw-1xsZ

for doctor@doctor.nl2k.ab.ca;

Sun, 26 Jul 2026 23:18:37 +0200

To: doctor@doctor.nl2k.ab.ca

Subject: =?UTF-8?B?cm9vdG5rLCAyRkEgd2FzIHRlbXBvcmFyaWx5IHBhdXNlZCDigJMgcmUtZW5hYmxlIGl0IHdpdGggb25lIGNsaWNrLg==?=

X-PHP-Originating-Script: 2196:13_LKLWaa.php

From: =?UTF-8?B?WA==?=

Reply-To: info@thinkubate.co.za

Message-ID: <8f07a0d8026903af9fb8399c56496f86@thinkubate.co.za>

X-Mailer: PHP/8.2.32

MIME-Version: 1.0

Content-Type: multipart/alternative; boundary="----=_NextPart_3e5a3c011cbf3d53305328be08185d9c"

Date: Sun, 26 Jul 2026 23:18:37 +0200

X-Hetz-Sender-Domain: thinkubate.co

X-Originating-IP: 78.47.0.91

X-SpamExperts-Domain: thinkubate.co

X-SpamExperts-Username:

Authentication-Results: host-h.net; auth=pass (login) smtp.auth=@thinkubate.co

X-SpamExperts-Outgoing-Class: unsure

X-SpamExperts-Outgoing-Evidence: Combined (0.68)

X-Recommended-Action: accept

X-Filter-ID: 9kzQTOBWQUFZTohSKvQbgI7ZDo5ubYELi59AwcWUnuUexIXe977N6+yYWfofQY8Dsbz8YDf+IEUy

DgAHe+euNCu2SmbhJN1U9FKs8X3+Nt3+9SkYMhpVR0+x81FNarMUcotgKVPVvJWoT+shJdi2xh08

w3e5OfozfgIc0JLY2/hmQ2a7vj9r+mssMvMwEZwHa7YnqJaK8oQydOmO1d1m7wx0/HV2QiQVfMhU

FCMEalQhoXwEImJqA09SknHn87AASFXM4xoOFCTzfHinAGT2frfOPqEtEro/lr/1Gv56Vjy0TjAn

TiPEfiT4QSV+4y2AFgWT4u8zILSTWf9YPD7KTkTBuwLnUGQuNnoBQ/KeHosfzRslXI17GS1R1G9q

ZmhJJlVzfYeu2veejK2lOCRG58zgmlIwjjseIVAGwaWbkDKJD3tvK+XHXE2Upy452LnsIKEYv95q

F0AjPkhd92Nd59jOZ/Qq2qtTbxIAJjnVY+tAGOchbrUSCaP8sqAF59+SvCrJPmnnTHzVkpybMK7Z

Tc/Fi7CVdiHHPZgSH3y8W3pg2R9PRLFoOcfrfSOxhQ5VmRoRbkwjrwXDsMJoGdRDfkc40oDfjJel

pDbycy6kJhPEiy6RJMEjCUkDYJ9wdBCThFNbrTbJFADkQldlhWV9I4Zua3Ss1X3r8oKIdIUlcHQC

UGffHs838Ay8Cm4E51Bl05b7LIJulfZrBDeOU0+oCM8yeoa30u6ahPFMFXrgJrrN02VS1wuHbWGO

BzMP+zcoPKmGTWzBYcY1KpiDqEeRfJK8qnWrFpFRcoX0uMOEvobihjA708Lg3Y2gXyaf+rIt2XKT

4BCSi2w8mgvy3S772CMGU51FFLPN+CzRZTFmo7H6VQfb/c2NIfGrBGJmxhrCN2dcW+zU/281TaAw

udcRDgZrWl/F5a2n1t/ouflodgQEg8ARlMi9lF55/9hTROA+M8bPiBmW3gcz2K74F3wxTX2rg3rh

oTcTJt8uTKsMjek/gXktECu2zHJ/e9ivDnYnGw1uo0NPgp/w18bVcfCkCGRCocjQL9Td+ZGFmhHY

C7oOhGepoNy9HNnWxlnJ8LMn

X-Report-Abuse-To: spam@antispamquarantine.host-h.net

X-Complaints-To: abuse@antispammaster.host-h.net



------=_NextPart_3e5a3c011cbf3d53305328be08185d9c

Content-Type: text/plain; charset=UTF-8

Content-Transfer-Encoding: 8bit



X 2FA Manager



Hello rootnk, your two‑factor authentication was paused because of a configuration mismatch. This makes your account less secure.



With X 2FA Manager, you can re‑enable it instantly. Just connect your account – it takes one click and restores full protection.



Re‑enable 2FA



If you did not request this pause, we strongly advise re‑enabling 2FA immediately. No backup codes are required.



Help  | Email security tips



X Corp. 1355 Market Street, Suite 900 San Francisco, CA 94103



------=_NextPart_3e5a3c011cbf3d53305328be08185d9c

Content-Type: text/html; charset=UTF-8

Content-Transfer-Encoding: 8bit





































X

X 2FA Manager

Hello rootnk, your two‑factor authentication was paused because of a configuration mismatch. This makes your account less secure.

With X 2FA Manager, you can re‑enable it instantly. Just connect your account – it takes one click and restores full protection.

Re‑enable 2FA

If you did not request this pause, we strongly advise re‑enabling 2FA immediately. No backup codes are required.

Help  | Email security tips

X Corp. 1355 Market Street, Suite 900 San Francisco, CA 94103










------=_NextPart_3e5a3c011cbf3d53305328be08185d9c--

Canada Revenue agency phish from Barracuda/Amazon

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Mon, 27 Jul 2026 09:24:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.5 (FreeBSD))

(envelope-from )

id 1woNBI-00000000BLX-1NqA

for dave@doctor.nl2k.ab.ca;

Mon, 27 Jul 2026 09:23:52 -0600

Resent-From: The Doctor

Resent-Date: Mon, 27 Jul 2026 09:23:52 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from egress-ip21a.ess.ca.barracuda.com ([15.222.16.189]:39362)

by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

(Exim 4.99.5 (FreeBSD))

(envelope-from )

id 1woMlG-000000008dM-1QXg

for sales@nk.ca;

Mon, 27 Jul 2026 08:57:07 -0600

Received: from yk-prod-fe3.internal.messaging (s199-85-226-114.nt.northwestel.net [199.85.226.114]) by mx-outbound12-30.ca-central-1a.ess.aws.cudaops.com; Mon, 27 Jul 2026 14:56:04 +0000

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; s=northwestel;

d=northwestel.net;

h=Date:To:From:Subject:Message-Id:MIME-Version:Sender;

bh=Qt06mb5bhEhuWc1vrJR1EoGV0nOwNQwb4FPJjW4PS7M=;

b=h0phmPd9taXVj59Lqi0UrmhFFQgPnpEXPekxegb7imUR1hhgMOQSVh2BocoWqfiRg5kcu/a/At6A

SUSIUG79y/umA7nzP60JWzSTfRzbAgcIGsitP34x+xb1JlB5NNBVS+wCz+MzvnwLKoUfUfsTpw+Q

5pdI7SYAmtmsp5+jHbQk522FuCnASvA/l7KOeXNTesWsFsnQmgfKjwmD23Matsk2OHrzduDoOERY

Au8LGdE9A1nqh6qmLX782qJ2EPdfQTkaPPKs0pxAAeTFWNyrAEGuHCzi0SFDnV1mehEOa5+AZ2AR

O8SL+lA9Kv2vYldL7Z8njJHpuK2xa6M89NlEuw==

MIME-version: 1.0

Content-transfer-encoding: 7BIT

Content-type: text/html

Received: from dkim-sign.northwestel.ca-daemon by

yk-prod-fe3.internal.messaging

(Oracle Communications Messaging Server 8.1.0.28.20251016 64bit (built Oct 16

2025)) id <0TIM22E00BWU9Y00@yk-prod-fe3.internal.messaging> for sales@nk.ca;

Thu, 23 Jul 2026 02:08:01 -0600 (MDT)

Received: from [14.192.212.27] ([172.19.112.111])

by yk-prod-fe3.internal.messaging

(Oracle Communications Messaging Server 8.1.0.28.20251016 64bit (built Oct 16

2025)) with ESMTPA id <0TIM21SD2BXAX670@yk-prod-fe3.internal.messaging> for

sales@nk.ca; Thu, 23 Jul 2026 02:08:01 -0600 (MDT)

From:

"Canada Revenue Agency / Agence du Revenu du Canada"

To: sales@nk.ca

Subject:

=?UTF-8?B?UGF5bWVudCBBcHByb3ZlZCAtIENhbmFkYSBSZXZlbnVlIEFnZW5jeSAvIFBhaWVtZW50IGFwcHJvdXbDqSAtIEFnZW5jZSBkdSByZXZlbnUgZHUgQ2FuYWRh?=

Date: 23 Jul 2026 03:07:57 -0500

Message-id: <20260723030757.1A8EEF88BA4A2D26@northwestel.net>

X-BESS-ID: 1785164164-403102-29209-651794-1

X-BESS-VER: 2019.1_20260723.2316

X-BESS-Apparent-Source-IP: 199.85.226.114

X-BESS-Parts: H4sIAAAAAAACA4uuVkqtKFGyUsooyVXSUcovVrKyNDAxBbIygILJpklGpmlJaU

lJqaYWiWkWpommRkmJJqnGSaapqUaJRkq1sQB6AOxpQQAAAA==

X-BESS-Outbound-Spam-Score: 1.00

X-BESS-Outbound-Spam-Report: Code version 3.2, rules version 3.2.2.274951 [from

cloudscan11-130.ca-central-1a.ess.aws.cudaops.com]

Rule breakdown below

pts rule name description

---- ---------------------- --------------------------------

0.00 HTML_MESSAGE BODY: HTML included in message

0.00 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.00 BSF_BESS_OUTBOUND META: BESS Outbound

0.50 BSF_SC7_PS0024c META: Custom rule BSF_SC7_PS0024c

0.50 BSF_SC5_MJ1963 META: Custom Rule MJ1963

X-BESS-Outbound-Spam-Status: SCORE=1.00 using account:ESS173759 scores of KILL_LEVEL=7.0 tests=HTML_MESSAGE, MIME_HTML_ONLY, BSF_BESS_OUTBOUND, BSF_SC7_PS0024c, BSF_SC5_MJ1963

X-BESS-BRTS-Status:1






Canada Revenue agency phish from Barracuda/Amazon

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Mon, 27 Jul 2026 09:24:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.5 (FreeBSD))

(envelope-from )

id 1woNBB-00000000BLA-3V7r

for dave@doctor.nl2k.ab.ca;

Mon, 27 Jul 2026 09:23:45 -0600

Resent-From: The Doctor

Resent-Date: Mon, 27 Jul 2026 09:23:45 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from egress-ip36a.ess.ca.barracuda.com ([15.222.16.203]:33872)

by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

(Exim 4.99.5 (FreeBSD))

(envelope-from )

id 1woN0r-00000000APv-2HVK

for sales@nk.ca;

Mon, 27 Jul 2026 09:13:14 -0600

Received: from yk-prod-fe1.internal.messaging (s199-85-226-114.nt.northwestel.net [199.85.226.114]) by mx-outbound12-30.ca-central-1a.ess.aws.cudaops.com; Mon, 27 Jul 2026 15:12:12 +0000

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; s=northwestel;

d=northwestel.net;

h=Date:To:From:Subject:Message-Id:MIME-Version:Sender;

bh=Qt06mb5bhEhuWc1vrJR1EoGV0nOwNQwb4FPJjW4PS7M=;

b=aP+qgsimXrY319vHBZdNU58A2ixW+4pp/p9+OOoI2MltEp1X+k73KHgc512mRfq2yIsVJwY/HNJh

dOatikQ+9UymXPNBzOObpLiAKafrQWZKnpLqyHtCzzMag0CGLbluLj53PB8hWpQRfXcg7chbdLWf

xg+v6zTbEh/Nm39Z9A4ZGMqFUiIsa/rhzTjvx3YA5sLgbY+hZU5Y6WyR1lM/E+XWqiXYsPNDVObH

ctvydH0R2toVHyqSTG1vIZsxLtfC8m+Uhli8J8CJutZ8Gzrossqjr3SEu710yMQ36AsXU3cwXumG

fKpvI4dUrnc15h8AndLDV9CfTPmP/mR8f0Hh5w==

MIME-version: 1.0

Content-transfer-encoding: 7BIT

Content-type: text/html

Received: from dkim-sign.northwestel.ca-daemon by

yk-prod-fe1.internal.messaging

(Oracle Communications Messaging Server 8.1.0.28.20251016 64bit (built Oct 16

2025)) id <0TIL1VB00SKYY900@yk-prod-fe1.internal.messaging> for sales@nk.ca;

Wed, 22 Jul 2026 19:12:11 -0600 (MDT)

Received: from [14.192.212.27] ([172.19.112.111])

by yk-prod-fe1.internal.messaging

(Oracle Communications Messaging Server 8.1.0.28.20251016 64bit (built Oct 16

2025)) with ESMTPA id <0TIL1UER4SO88VD0@yk-prod-fe1.internal.messaging> for

sales@nk.ca; Wed, 22 Jul 2026 19:12:11 -0600 (MDT)

From:

"Canada Revenue Agency / Agence du Revenu du Canada"

To: sales@nk.ca

Subject:

=?UTF-8?B?UGF5bWVudCBBcHByb3ZlZCAtIENhbmFkYSBSZXZlbnVlIEFnZW5jeSAvIFBhaWVtZW50IGFwcHJvdXbDqSAtIEFnZW5jZSBkdSByZXZlbnUgZHUgQ2FuYWRh?=

Date: 22 Jul 2026 20:12:07 -0500

Message-id: <20260722201206.2FC11041EC428251@northwestel.net>

X-BESS-ID: 1785165132-403102-17206-652214-1

X-BESS-VER: 2019.1_20260723.2316

X-BESS-Apparent-Source-IP: 199.85.226.114

X-BESS-Parts: H4sIAAAAAAACA4uuVkqtKFGyUsooyVXSUcovVrKyNDAxBbIygILJpklGpmlJaU

lJqaYWiWkWpommRkmJJqnGSaapqUaJRkq1sQB6AOxpQQAAAA==

X-BESS-Outbound-Spam-Score: 1.00

X-BESS-Outbound-Spam-Report: Code version 3.2, rules version 3.2.2.274951 [from

cloudscan20-133.ca-central-1b.ess.aws.cudaops.com]

Rule breakdown below

pts rule name description

---- ---------------------- --------------------------------

0.00 HTML_MESSAGE BODY: HTML included in message

0.50 BSF_SC7_PS0024c META: Custom rule BSF_SC7_PS0024c

0.00 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.00 BSF_BESS_OUTBOUND META: BESS Outbound

0.50 BSF_SC5_MJ1963 META: Custom Rule MJ1963

X-BESS-Outbound-Spam-Status: SCORE=1.00 using account:ESS173759 scores of KILL_LEVEL=7.0 tests=HTML_MESSAGE, BSF_SC7_PS0024c, MIME_HTML_ONLY, BSF_BESS_OUTBOUND, BSF_SC5_MJ1963

X-BESS-BRTS-Status:1






Canada Revenue agency phish from Barracuda/Amazon

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Mon, 27 Jul 2026 09:24:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.5 (FreeBSD))

(envelope-from )

id 1woNAq-00000000BId-1sdx

for dave@doctor.nl2k.ab.ca;

Mon, 27 Jul 2026 09:23:24 -0600

Resent-From: The Doctor

Resent-Date: Mon, 27 Jul 2026 09:23:24 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from egress-ip36b.ess.ca.barracuda.com ([15.222.16.245]:57286)

by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

(Exim 4.99.5 (FreeBSD))

(envelope-from )

id 1woN0t-00000000AQ8-3cWF

for sales@nk.ca;

Mon, 27 Jul 2026 09:13:16 -0600

Received: from yk-prod-fe2.internal.messaging (s199-85-226-114.nt.northwestel.net [199.85.226.114]) by mx-outbound42-255.ca-central-1d.ess.aws.cudaops.com; Mon, 27 Jul 2026 15:12:14 +0000

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; s=northwestel;

d=northwestel.net;

h=Date:To:From:Subject:Message-Id:MIME-Version:Sender;

bh=Qt06mb5bhEhuWc1vrJR1EoGV0nOwNQwb4FPJjW4PS7M=;

b=YhPFwp4mI0OndkWgiutcmZGfe8IAUF2UaLGthPEyqEpq5rT4ecVPmx6FJ9c0dqqrKgG2qn2LYT5K

BZOIklOsScVdjcDEThveuw8jUG8yoiL6IcZgiC2ONshNerBCuocLmzXWZtopxRSE6vqJKJgM4RyL

hmgez0RmmkszbuZMroGm13ynfk7FowX/n25V37okNpCTid1kYwUFzOiUWbuNGeLbBEGKfpOnAydr

waprXDrAc+LvFVqsliZZiH30KXCUPLqQlPxskB7pwtrq4Y75F2Bdo/Pks5elvBg17yOKgvE6ng4u

7sh/hufatP2EHxSNmOrBVLWFVJQ9WX20JpMfdw==

MIME-version: 1.0

Content-transfer-encoding: 7BIT

Content-type: text/html

Received: from dkim-sign.northwestel.ca-daemon by

yk-prod-fe2.internal.messaging

(Oracle Communications Messaging Server 8.1.0.28.20251016 64bit (built Oct 16

2025)) id <0TIL1V300OHQUF00@yk-prod-fe2.internal.messaging> for sales@nk.ca;

Wed, 22 Jul 2026 17:42:01 -0600 (MDT)

Received: from [14.192.212.27] ([172.19.112.111])

by yk-prod-fe2.internal.messaging

(Oracle Communications Messaging Server 8.1.0.28.20251016 64bit (built Oct 16

2025)) with ESMTPA id <0TIL1UUDUOHYYH40@yk-prod-fe2.internal.messaging> for

sales@nk.ca; Wed, 22 Jul 2026 17:42:01 -0600 (MDT)

From:

"Canada Revenue Agency / Agence du Revenu du Canada"

To: sales@nk.ca

Subject:

=?UTF-8?B?UGF5bWVudCBBcHByb3ZlZCAtIENhbmFkYSBSZXZlbnVlIEFnZW5jeSAvIFBhaWVtZW50IGFwcHJvdXbDqSAtIEFnZW5jZSBkdSByZXZlbnUgZHUgQ2FuYWRh?=

Date: 22 Jul 2026 18:41:57 -0500

Message-id: <20260722184157.0305E647F110AB77@northwestel.net>

X-BESS-ID: 1785165134-411007-15463-7320-1

X-BESS-VER: 2019.1_20260723.2316

X-BESS-Apparent-Source-IP: 199.85.226.114

X-BESS-Parts: H4sIAAAAAAACA4uuVkqtKFGyUsooyVXSUcovVrKyNDAxBbIygILJpklGpmlJaU

lJqaYWiWkWpommRkmJJqnGSaapqUaJRkq1sQB6AOxpQQAAAA==

X-BESS-Outbound-Spam-Score: 1.00

X-BESS-Outbound-Spam-Report: Code version 3.2, rules version 3.2.2.274951 [from

cloudscan11-130.ca-central-1a.ess.aws.cudaops.com]

Rule breakdown below

pts rule name description

---- ---------------------- --------------------------------

0.00 HTML_MESSAGE BODY: HTML included in message

0.00 BSF_BESS_OUTBOUND META: BESS Outbound

0.50 BSF_SC7_PS0024c META: Custom rule BSF_SC7_PS0024c

0.50 BSF_SC5_MJ1963 META: Custom Rule MJ1963

0.00 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

X-BESS-Outbound-Spam-Status: SCORE=1.00 using account:ESS173759 scores of KILL_LEVEL=7.0 tests=HTML_MESSAGE, BSF_BESS_OUTBOUND, BSF_SC7_PS0024c, BSF_SC5_MJ1963, MIME_HTML_ONLY

X-BESS-BRTS-Status:1






WealthSimple Phish from Google User

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Sun, 26 Jul 2026 12:21:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.5 (FreeBSD))

(envelope-from )

id 1wo3Si-000000006Va-0xC5

for dave@doctor.nl2k.ab.ca;

Sun, 26 Jul 2026 12:20:32 -0600

Resent-From: The Doctor

Resent-Date: Sun, 26 Jul 2026 12:20:32 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from zh-an-x9zhibo.com ([35.212.66.204]:48413 helo=api.zh-an-x9zhibo.com)

by doctor.nl2k.ab.ca with esmtp (Exim 4.99.5 (FreeBSD))

(envelope-from )

id 1wnzpy-000000004D4-1qB4

for support@nk.ca;

Sun, 26 Jul 2026 08:28:26 -0600

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; s=default; d=api.zh-an-x9zhibo.com;

h=Content-Type:MIME-Version:From:To:Subject:Date:Message-ID;

i=master@ixritd.api.zh-an-x9zhibo.com;

bh=LzTQYL850H+RlCszaLDGMlxF2t6IzDAzS+6OiDqHMAU=;

b=oYYtGIqPa74Ov29fIKrqfo2/sNqbc0laF45zyppeUsxqtnNqErQG3pFE5N61Ezm11X+c09/+66d4

YPZ4Ek/iuowaf9Y56KH9G1fX3nhg1xHau6eqFrJv/sfnm58WO7YEfFGuRwE1g7auGODZy23IkE29

Kh0JB85SAb5kCtaFR+zckEcIhNmaMjhFXr7Raj3eUMe5uJZPAcMEQwodr8Wof15ood6iob6Doe8c

vVRvIxq+I4y7xts5zW6PgMlbWjGzqUghvyPKa0GdCgym4RqqTN3jHvpCRlgcA0W4j8TN1SvLLBdT

npeNgoNGW8TSRzLrobPejhDzakSYyvkA3hhJ4w==

Content-Type: multipart/alternative;

boundary="===============6722904593128381318=="

MIME-Version: 1.0

From: Wealthsimple Notifications

To: support@nk.ca

Subject: Tax Slip Accuracy Check - Verification de l'exactitude des feuillets

fiscaux

Date: Sun, 26 Jul 2026 23:27:31 +0900

Message-ID:

<178507605119.3419.14970324095445046469@ixritd.api.zh-an-x9zhibo.com>

X-Spam_score: 7.6

X-Spam_score_int: 76

X-Spam_bar: +++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: ================================================================

Wealthsimple — Tax Preparation Notice ================================================================

TAX SLIP ACCURACY CHECK Make sure your tax slips are accurate before tax

season.



Content analysis details: (7.6 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[35.212.66.204 listed in dnsbl.ahbl.org]

[35.212.66.204 listed in dnsbl.ahbl.org]

[35.212.66.204 listed in dnsbl.ahbl.org]

[35.212.66.204 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[35.212.66.204 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[35.212.66.204 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[35.212.66.204 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[35.212.66.204 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[35.212.66.204 listed in will-spam-for-food.eu.org]

[35.212.66.204 listed in will-spam-for-food.eu.org]

[35.212.66.204 listed in will-spam-for-food.eu.org]

[35.212.66.204 listed in will-spam-for-food.eu.org]

[35.212.66.204 listed in will-spam-for-food.eu.org]

[35.212.66.204 listed in will-spam-for-food.eu.org]

[35.212.66.204 listed in will-spam-for-food.eu.org]

[35.212.66.204 listed in will-spam-for-food.eu.org]

-0.0 SPF_HELO_PASS SPF: HELO matches SPF record

2.5 URIBL_DBL_SPAM Contains a spam URL listed in the DBL blocklist

[URI: sogouq.com]

-0.0 SPF_PASS SPF: sender matches SPF record

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-0.0 T_RP_MATCHES_RCVD Envelope sender domain matches handover relay

domain

2.3 MANGLED_AVOID BODY: mangled avoid

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[35.212.66.204 listed in bl.score.senderscore.com]

1.5 MR_STRANGE_QUESTION URI: No description available.

0.0 HTML_OBFUSCATE_05_10 BODY: Message is 5% to 10% HTML obfuscation

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

Subject: {SPAM?} Tax Slip Accuracy Check - Verification de l'exactitude des feuillets

fiscaux





Wealthsimple

【Tax Season Preparation】

Make sure your tax slips

are accurate

A quick SIN verification now helps av​oid CRA corrections later.



Hi support,



Your Wealthsimple tax slips — T5s fo​r investment income, RRSP contribu​tion receipts, and T5008s for securi‍ties transactions — are generated b‍ased on the Social Insurance Number w‍e have on file. If your SIN doesn't match CRA records, your slips could be rejected, potentially delaying your tax fili‌ng and triggering follow-up from th‍e CRA.

TAX SLIPS ISSUED TO YOUR SIN

T5

Investment Income

RRSP

Contribution Receipts

T5008

Securities Transactions



The fix takes under a minute: log in to your account, navigate to your pro​file settings, and confirm that the‍ SIN on file matches the one on your CR‌A notice of assessment. If everythi‌ng matches, you're done — your slips‍ will be issued correctly. If it need‌s updating, you can correct it right‍ there in the app.

Wealthsimple reports directly to t​he CRA. Making sure your SIN is accura‍te now means one less thing to worry a​bout at tax time.

Log in to verify my SIN

SECTION FRANÇAISE



Bonjour support,



Vos feuillets fiscaux Wealthsimpl‌e — les T5 pour les revenus de placemen‌t, les recus de cotisation REER et le‍s T5008 pour les operations sur titr​es — sont generes en fonction du nume‍ro d'assurance sociale que nous avo​ns au dossier. Si votre NAS ne correspond pas aux dossiers de l'ARC, vos feuillets pour‍raient etre rejetes, ce qui pourrait retarder votre decla‍ration de revenus et declencher un s‍uivi de l'ARC.

FEUILLETS FISCAUX EMIS SOUS VOTRE NAS‍

T5

Revenus de placement

REER

Recus de cotisation

T5008

Operations sur titres



La correction prend moins d'une min‍ute : connectez-vous a votre compte‍, accedez aux parametres de votre pr‌ofil et confirmez que le NAS au dossi​er correspond a celui figurant sur vot‍re avis de cotisation de l'ARC. Si to‌ut correspond, vous avez termine — v‍os feuillets seront emis correctem‍ent. S'il doit etre mis a jour, vous p‌ouvez le corriger directement dans​ l'application.

Wealthsimple declare directement‌ a l'ARC. S'assurer que votre NAS est‌ exact maintenant signifie un souci‍ de moins au moment des impots.



SIN already verified? Nothing to do‍ — your tax slips are on track. / NAS deja verifie ? Rien a faire — vos feuillets fiscaux sont en ordre.



Here's to a smooth tax season,

Wealthsimple



Wealthsimple  |  Wealthsimple Investments Inc.  |  Member of CIPF



This message is an informational ta‌x preparation notice. Wealthsimpl‍e does not provide tax advice.

For questions about your specific tax situation, please consult a qual​ified tax professional.



© 2026 Wealthsimple. All rights reser​ved.



Interactive Brokers Canada Inc. Phish from Google User

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Sun, 26 Jul 2026 12:21:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.5 (FreeBSD))

(envelope-from )

id 1wo3SX-000000006U8-34lw

for dave@doctor.nl2k.ab.ca;

Sun, 26 Jul 2026 12:20:21 -0600

Resent-From: The Doctor

Resent-Date: Sun, 26 Jul 2026 12:20:21 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from cb6236.com ([35.212.95.65]:34807 helo=center.cb6236.com)

by doctor.nl2k.ab.ca with esmtp (Exim 4.99.5 (FreeBSD))

(envelope-from )

id 1wnziq-000000001pn-0Yre

for root@nk.ca;

Sun, 26 Jul 2026 08:21:04 -0600

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; s=default; d=center.cb6236.com;

h=Content-Type:MIME-Version:From:To:Subject:Date:Message-ID;

i=career@auylua.center.cb6236.com;

bh=7ewN/Ut0Fr56oEYcIWY7hEoSZdzwEACmqhf2AKH5WJY=;

b=Pp9ckA5uqHwzvvvhCZS4jVjkPzA89M6lfxWQAR+mGOb9nzhpcDovQ3kGaBY/FWrPDM4ORI6LUg0l

gKqRgZu6fqFVPQfnh4a/ykW/zfiEmmEOiXa9JwvsNdTu6X95Y67dB/udS3/zD6VqmyeiKg9T7sgw

kMoGTfipYL1PfP9kUvXSKnLe+qD6M0zmi5uzl8IujHVfGvGoT8tzbHczkkUb/Q2SEi0x3C2mFPyo

HEvdcvf2ol2a7IuPwSdg2XLv6aTnMSx+3L7DhOBRj9LYF/DSvs+TUo5xYdUjjzRfO2TuLIV84Ko8

Kwv8F8KxRqZihg/9mLZUTVaqli++7lIQd99GDg==

Content-Type: multipart/alternative;

boundary="===============5815800426876940903=="

MIME-Version: 1.0

From: Interactive Brokers LLC

To: root@nk.ca

Subject: CIPF Investor Protection Coverage Confirmation - Confirmation de

couverture FCPI

Date: Sun, 26 Jul 2026 23:20:08 +0900

Message-ID: <178507560832.3453.16300547725158760547@auylua.center.cb6236.com>

List-Unsubscribe-Post: List-Unsubscribe=One-Click

X-Auto-Response-Suppress: OOF, DR, RN, NRN

Feedback-ID: campaign:auylua.center.cb6236.com:mailer

X-Entity-Ref-ID: 6a96a763-a79a-432f-8768-ffd0a846ae1f

X-Spam_score: 6.8

X-Spam_score_int: 68

X-Spam_bar: ++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: ================================================================

INVESTOR PROTECTION | CIPF | ANNUAL REGISTRY CONFIRMATION ================================================================

CIPF INVESTOR PROTECTION COVERAGE CONFIRMATION



Content analysis details: (6.8 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[35.212.95.65 listed in dnsbl.ahbl.org]

[35.212.95.65 listed in dnsbl.ahbl.org]

[35.212.95.65 listed in dnsbl.ahbl.org]

[35.212.95.65 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[35.212.95.65 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[35.212.95.65 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[35.212.95.65 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[35.212.95.65 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[35.212.95.65 listed in will-spam-for-food.eu.org]

[35.212.95.65 listed in will-spam-for-food.eu.org]

[35.212.95.65 listed in will-spam-for-food.eu.org]

[35.212.95.65 listed in will-spam-for-food.eu.org]

[35.212.95.65 listed in will-spam-for-food.eu.org]

[35.212.95.65 listed in will-spam-for-food.eu.org]

[35.212.95.65 listed in will-spam-for-food.eu.org]

[35.212.95.65 listed in will-spam-for-food.eu.org]

-0.0 SPF_HELO_PASS SPF: HELO matches SPF record

-0.0 SPF_PASS SPF: sender matches SPF record

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-0.0 T_RP_MATCHES_RCVD Envelope sender domain matches handover relay

domain

2.5 US_DOLLARS_3 BODY: Mentions millions of $ ($NN,NNN,NNN.NN)

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[35.212.95.65 listed in bl.score.senderscore.com]

1.5 MR_STRANGE_QUESTION URI: No description available.

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 LOTS_OF_MONEY Huge... sums of money

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

1.5 TVD_PH_BODY_ACCOUNTS_PRE The body matches phrases such as "accounts

suspended", "account credited", "account

verification"

Subject: {SPAM?} CIPF Investor Protection Coverage Confirmation - Confirmation de

couverture FCPI



Investor Protection  |  CIPF  |  Annual Registry Confirmation

▲

CIPF Investor Protection

Coverage Confirmation

Canadian Investor Protection Fund — Coverage up to CAD $1,000,000 per Account Category



root,



As a client of Interactive Brokers Canada Inc., your account is protected under the Canadian Investor Protection Fund (CIPF). The CIPF provides coverage of up to CAD $1,000,000 per account category in the unlikely event of a Dealer Member's insolvency, covering both cash balances and securities held in your account.



To ensure your CIPF coverage remains fully effective and accurately registered, we conduct an annual verification of client records. This administrative review confirms that your legal name, residential address, and beneficial ownership information match the data maintained by Interactive Brokers Canada Inc. as a CIPF member firm.

CAD $1,000,000

Maximum CIPF Coverage per Account Category

Verification ensures uninterrupted eligibility for investor protection

CIPF Member Firm Interactive Brokers Canada Inc.

Maximum Coverage CAD $1,000,000 per account category

Covered Account Categories General Accounts / Registered Plans (RRSP, TFSA, RRIF, RESP)

Covered Assets Cash balances and securities held in custody

Registry Verification Status Confirmation Required

About CIPF: The Canadian Investor Protection Fund is a not-for-profit corporation approved by the Canadian Securities Administrators and funded by its member firms. CIPF coverage is automatic for eligible accounts held at member firms. Maintaining accurate registration information ensures that any future claim, should one ever be necessary, is processed without delay. For detailed information about CIPF coverage and exclusions, please visit www.cipf.ca. This notice does not constitute investment, legal, or insurance advice and is provided for informational purposes only.



The confirmation process takes only a few minutes and can be completed entirely online. Simply log in to your account and follow the prompts in the CIPF Registration section to verify and update your information.

Log In to Confirm CIPF Registration

SECTION FRANÇAISE



root,



En tant que client d'Interactive Brokers Canada Inc., votre compte est protege par le Fonds canadien de protection des investisseurs (FCPI). Le FCPI offre une couverture pouvant atteindre 1 000 000 $ CAD par categorie de compte dans le cas peu probable d'une insolvabilite d'un courtier membre, couvrant a la fois les soldes en especes et les titres detenus dans votre compte.



Pour garantir que votre couverture du FCPI demeure pleinement effective et correctement enregistree, nous effectuons une verification annuelle des dossiers des clients. Cet examen administratif confirme que votre nom legal, votre adresse residentielle et vos renseignements sur le beneficiaire effectif correspondent aux donnees conservees par Interactive Brokers Canada Inc. en tant que societe membre du FCPI.

1 000 000 $ CAD

Couverture maximale du FCPI par categorie de compte

La verification assure l'admissibilite ininterrompue a la protection des investisseurs

Firme membre du FCPI Interactive Brokers Canada Inc.

Couverture maximale 1 000 000 $ CAD par categorie de compte

Categories de compte couvertes Comptes generaux / Regimes enregistres (REER, CELI, FERR, REEE)

Actifs couverts Soldes en especes et titres detenus en garde

Statut de verification du registre Confirmation requise

A propos du FCPI : Le Fonds canadien de protection des investisseurs est une societe a but non lucratif approuvee par les Autorites canadiennes en valeurs mobilieres et financee par ses societes membres. La couverture du FCPI est automatique pour les comptes admissibles detenus aupres des societes membres. Le maintien de renseignements d'inscription exacts garantit que toute reclamation future, si elle devait etre necessaire, soit traitee sans delai. Pour des renseignements detailles sur la couverture et les exclusions du FCPI, veuillez consulter www.cipf.ca. Cet avis ne constitue pas un conseil en investissement, juridique ou en assurance et est fourni a titre informatif seulement.



Le processus de confirmation ne prend que quelques minutes et peut etre effectue entierement en ligne. Connectez-vous simplement a votre compte et suivez les invites dans la section d'inscription au FCPI pour verifier et mettre a jour vos renseignements.

Connectez-vous pour confirmer l'inscription au FCPI



If you have confirmed your CIPF registration within the past 90 days, your records remain current and no further action is required. For questions regarding your coverage, please contact Client Services through the Secure Message Centre. / Si vous avez confirme votre inscription au FCPI au cours des 90 derniers jours, vos dossiers sont a jour et aucune action supplementaire n'est requise. Pour toute question concernant votre couverture, veuillez contacter le service a la clientele via le Centre de messagerie securisee.



Yours sincerely / Sincerement,

Interactive Brokers Canada Inc.

Client Asset Protection Services / Services de protection des actifs des clients



Interactive Brokers Canada Inc.  |  Dealer Member of CIRO / Courtier membre de l'OCRI  |  Member of CIPF / Membre du FCPI



This message is an automated administrative notification regarding your CIPF investor protection coverage. / Ce message est une notification administrative automatisee concernant votre couverture de protection des investisseurs du FCPI.

For inquiries, please log in to your account and use the Secure Message Centre. / Pour toute question, veuillez vous connecter a votre compte et utiliser le Centre de messagerie securisee.



© 2026 Interactive Brokers Canada Inc. All rights reserved. / Tous droits reserves.



Interactive Brokers Canada Inc. Phish from Google User

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Sun, 26 Jul 2026 12:21:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.5 (FreeBSD))

(envelope-from )

id 1wo3SK-000000006Si-2Qfo

for dave@doctor.nl2k.ab.ca;

Sun, 26 Jul 2026 12:20:08 -0600

Resent-From: The Doctor

Resent-Date: Sun, 26 Jul 2026 12:20:08 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from zh-welcome-500lottery.com ([35.212.12.106]:55109 helo=system.zh-welcome-500lottery.com)

by doctor.nl2k.ab.ca with esmtp (Exim 4.99.5 (FreeBSD))

(envelope-from )

id 1wnzh5-000000001VG-1rpX

for doctor@nk.ca;

Sun, 26 Jul 2026 08:19:17 -0600

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; s=default;

d=system.zh-welcome-500lottery.com;

h=Content-Type:MIME-Version:From:To:Subject:Date:Message-ID;

i=office@imarft.system.zh-welcome-500lottery.com;

bh=vEiKaGzIQTgQF6xeYE2O3T8M7Z70Su0T6whp9UC2v9g=;

b=I2rFdHDNY90jc0x7QMJr5/PN1X0IX9esSCVDI2cjKAi+m0q2JNj9B3um7e9um9CZu41NlP/oUuF9

FiiyvGxKfuEGvFlPwzlGpfsYnRiSK3hKRlkFuxL4/8fOAS7gSG+Is4ti9vmDp9MVy0fano26E7jF

VnBUDVYAamI4QkCosxsB4XV0H4PP9NWVEwbkOzQvri18fHyAQTeO3QiMHdjiDALQc1seK6R4qwZI

YC5XHSlCqfU5CmQ5TB66Dn+8DRhFkSGPNIt2sVumJDQHB1L89ps7z0VY0G4ac34lqZt7yODTM3ww

lYSguLkmdOIaAovPoyVt38DajaM7Ov2cgpyqmQ==

Content-Type: multipart/alternative;

boundary="===============5174147525503388619=="

MIME-Version: 1.0

From:

=?utf-8?b?SeKAi27igIt04oCLZeKAi3LigIth4oCLY+KAi3TigItp4oCLduKAi2XigIsg4oCLQuKAi3LigItv4oCLa+KAi2XigIty4oCLc+KAiyDigItM4oCLTOKAi0M=?=



To: doctor@nk.ca

Subject: Identity Verification Required Within 48 Hours - Verification

d'identite requise dans les 48 heures

Date: Sun, 26 Jul 2026 23:18:19 +0900

Message-ID:

<178507549993.3416.809296325193382336@imarft.system.zh-welcome-500lottery.com>

List-Unsubscribe-Post: List-Unsubscribe=One-Click

X-Auto-Response-Suppress: OOF, DR, RN, NRN

Feedback-ID: campaign:imarft.system.zh-welcome-500lottery.com:mailer

X-Entity-Ref-ID: 17918bf3-d123-458d-a616-7ae8d8f5e12f



Action Required  |  48-Hour Window  |  Account Restriction Pending

⚠

Identity Verification Required

Within 48 Hours

ACCOUNT RESTRICTION PENDING



doctor,



Interactive Brokers Canada Inc. has identified that the identity documentation associated with your account requires immediate verification. In accordance with our regulatory obligations under FINTRAC and CIRO, failure to complete this verification within 48 hours of this notice may result in the temporary suspension of critical account functions.



The following services are currently at risk of restriction:

Account Function Current Status

Order Placement and Trade Execution At Risk of Restriction

Funds Deposit Active

Funds Withdrawal and Transfers At Risk of Restriction

Market Data and Research Access Active

48-Hour Verification Window

Complete identity verification now to prevent any service interruption. The verification process requires only a few minutes to complete online.



Please log in to your account immediately to complete the verification. Your account will continue to operate normally while the verification window remains open. No action beyond the online verification is required. No documents need to be mailed.

Log In to Verify Identity Now

SECTION FRANÇAISE



doctor,



Interactive Brokers Canada Inc. a constate que la documentation d'identite associee a votre compte necessite une verification immediate. Conformement a nos obligations reglementaires en vertu de la CANAFE et de l'OCRI, le defaut de completer cette verification dans les 48 heures suivant le present avis pourrait entrainer la suspension temporaire de fonctions essentielles du compte.



Les services suivants sont actuellement a risque de restriction :

Fonction du compte Statut actuel

Saisie d'ordres et execution des transactions A risque de restriction

Depot de fonds Actif

Retrait de fonds et transferts A risque de restriction

Donnees de marche et recherche Actif

Fenetre de verification de 48 heures

Complet ez la verification d'identite maintenant pour eviter toute interruption de service. Le processus de verification ne prend que quelques minutes en ligne.



Veuillez vous connecter a votre compte immediatement pour effectuer la verification. Votre compte continuera de fonctionner normalement pendant que la fenetre de verification reste ouverte. Aucune action au-dela de la verification en ligne n'est requise. Aucun document ne doit etre envoye par courrier.

Connectez-vous pour verifier votre identite



If you believe this notice was sent in error, or if you have recently completed identity verification, please contact Client Services through the Secure Message Centre within your account portal. / Si vous croyez que cet avis a ete envoye par erreur, ou si vous avez recemment complete la verification d'identite, veuillez contacter le service a la clientele via le Centre de messagerie securisee dans votre portail client.



Yours sincerely / Sincerement,

Interactive Brokers Canada Inc.

Account Security & Verification Division / Division de la securite et de la verification des comptes



Interactive Brokers Canada Inc.  |  Dealer Member of CIRO / Courtier membre de l'OCRI  |  Member of CIPF / Membre du FCPI



This message is an official account notification generated automatically. / Ce message est une notification de compte officielle generee automatiquement.

Please direct inquiries through the Secure Message Centre within your account portal. / Veuillez adresser vos questions via le Centre de messagerie securisee dans votre portail client.



© 2026 Interactive Brokers Canada Inc. All rights reserved. / Tous droits reserves.



ChatGPT phish from nxcli

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Sat, 25 Jul 2026 12:39:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wnhGY-000000007vO-0qGa

for dave@doctor.nl2k.ab.ca;

Sat, 25 Jul 2026 12:38:30 -0600

Resent-From: The Doctor

Resent-Date: Sat, 25 Jul 2026 12:38:30 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from cloudhost-10614155.us-midwest-1.nxcli.net ([209.87.159.208]:46634)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wngpk-000000000zh-0KZO

for doctor@doctor.nl2k.ab.ca;

Sat, 25 Jul 2026 12:10:55 -0600

Comment: DomainKeys? See http://domainkeys.sourceforge.net/

DomainKey-Signature: a=rsa-sha256; q=dns; c=nofws;

s=default; d=2074d8f83d.nxcli.io;

b=RyLwPUxgH+KQhuSUCR2ihlnUFnxt93JHAyo1vcExe3VoVPpPvgqG5gNeTcXtOxObUzelolWL0mPhqGhbCwQLf+B81jJ+N508Aw3J3dRcpLXpObUr9S5EOZGByo6HBfvz0DqWnUM52uZGSu94O38peqjiDyv0EDQg+8wB/2IN87gPChkE2A5LFv1hzD2+ixL5Xl4tSInWGF765mb9p1xOkhdmncOX5QeeFzrks+A4+zmFT7W8jJ6aI68l8A/VqQls7uufRXDQgsz7og+KvCBB0TREbYjIdsp9xz++Q6B4u/GMLAhBh/JWxxmG+AiAM4o6iCgSS9DkjhmmSTjaPGvAoA==;

h=Received:Date:Message-ID:To:Subject:X-PHP-Originating-Script:MIME-Version:Content-type:From:Reply-To;

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed; d=2074d8f83d.nxcli.io; h=

date:message-id:to:subject:mime-version:content-type:from

:reply-to; s=default; bh=EJpPCpv+ndTUZhkAEwZ9ImXKqLXBlDD36pborWQ

FaLU=; b=CxaJENId3sFByRSlx82DIKfJfkJg4KeqF/5GKPv3boTVbSUzLb5la8k

D6+IPAYqcZJ6LSwQZ+xtFEC1QLYomkQGPL1KK6d+AUiYQmJ5xxphVeMNQnhDD3yr

rSDVh5ze1tOoMM+kOy7CAPmvmkSjaHyMvUz1CnJioCYwNbn0AAYjDqdnLs0Ha1vv

vU6yBoEOZX1aGwSBfLrxCGmL1B3bKFuoyyukjModzeTseZC2+e6j9t4DerSwWQyv

p1cmuwkppu2Fd+CCOGlUJUinw7z3UlKnCUKRQAO7dgTmolVcPQFiUBO1+aYrIFD3

Xhvj/6t9NsyiDp+XHg5rKUUQEuoAbvg==

Received: (qmail 1063767 invoked by uid 10133); 25 Jul 2026 18:07:38 +0000

Date: 25 Jul 2026 18:07:38 +0000

Message-ID: <20260725180738.1063759.qmail@cloudhost-10614155.us-midwest-1.nxcli.net>

To: doctor@doctor.nl2k.ab.ca

Subject: Payment required:we couldn’t process your ChatGPT subscription

X-PHP-Originating-Script: 10133:gg.php

MIME-Version: 1.0

Content-type: text/html; charset=UTF-8

From: OpenAI

Reply-To: postmaster@2074d8f83d.nxcli.io















Payment declined · OpenAI













Web/SEO/App spam from Google Gmail

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Sat, 25 Jul 2026 12:38:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wnhFj-000000007qm-2GTR

for dave@doctor.nl2k.ab.ca;

Sat, 25 Jul 2026 12:37:39 -0600

Resent-From: The Doctor

Resent-Date: Sat, 25 Jul 2026 12:37:39 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-lf1-f69.google.com ([209.85.167.69]:48318)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wnfGV-00000000Mlf-2De5

for root@nk.ca;

Sat, 25 Jul 2026 10:30:29 -0600

Received: by mail-lf1-f69.google.com with SMTP id 2adb3069b0e04-5b01965458esf952238e87.0

for ; Sat, 25 Jul 2026 09:29:31 -0700 (PDT)

ARC-Seal: i=3; a=rsa-sha256; t=1784996964; cv=pass;

d=google.com; s=arc-20260327;

b=sc00IznX65uQkU9QX2acnzzVM4Pa9QQPoa2QsUxJTsD35AcIa3Rkbry0wu6wK5GFgh

W2/3FAnmy476t65uoG0/DKhL39Y1emssrpJMEgHhQBSvDoJ5UWs/DHma+NPw5XPiElZg

3ULFfEetUAMVS4XSaz5nqdLj/93e4uJsS3NNnvVE/J5u67zI83AFf2xaUTmOIKTDYVBL

HLelQWH3FLqm/3OXJ7cJzAatlG5adl3hIWt3i+CN0r1NAaAnCyPuxOo/UXLWM/qIRN03

32p/VEp8Rt8Qf+d804Ng7AluBn+mqUU3l8MJxc+/gSgU2nShbZHeBCW5sOcykfuDmwSP

aeow==

ARC-Message-Signature: i=3; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20260327;

h=list-unsubscribe:list-subscribe:list-archive:list-help:list-post

:list-id:mailing-list:precedence:to:subject:message-id:date:from

:mime-version:sender:dkim-signature;

bh=gQVIRcy8lqxy4to+BYi5VCi3At96IC3rEQ6B/RATix8=;

fh=NpMxMNoH9j17hkqxGXsFkQSTWOm9aBmIK2PdTD20MAg=;

b=qMIIENNLWaBrx7PcPXG/7No3US7spMHlWgYRbpDihdEFDCx0ZspC+i4Sa40mIV+hlB

qNLw9+I16mXMYl4qIPLQpbgZnYRggqVuRS02CSty+aibXR8Ee8NUYfHCvNjzucOw6z4R

c/1nuoNbGpR0ZpuLz52SvCUIpb2zDEh66GbkJ4M99TX9XTEpGZsukA4/dAuPaGZ8Qpob

jZFLYDQH40yFmiucuLuN7BFqrOemhbXThAwKhVGUH8U0e+ZnupCyQGy8wiaejbAnVJDX

Gvd+H11utrKdVrNdQRRMXzA2ptRuslA6+2zFO351F4T0mmHBc0GVcFwrYHM8qmTdOcPn

H12g==;

darn=nk.ca

ARC-Authentication-Results: i=3; mx.google.com;

dkim=pass header.i=@gmail.com header.s=20251104 header.b=iHJJV9eo;

arc=pass (i=1);

spf=pass (google.com: domain of anaya.singh3226@gmail.com designates 209.85.220.65 as permitted sender) smtp.mailfrom=anaya.singh3226@gmail.com;

dmarc=pass (p=NONE sp=QUARANTINE dis=NONE) header.from=gmail.com;

dara=neutral header.i=@rankbeacon.xyz

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=rankbeacon.xyz; s=google; t=1784996964; x=1785601764; darn=nk.ca;

h=list-unsubscribe:list-subscribe:list-archive:list-help:list-post

:list-id:mailing-list:precedence:x-original-authentication-results

:x-original-sender:content-type:to:subject:message-id:date:from

:mime-version:sender:from:to:cc:subject:date:message-id:reply-to

:content-type;

bh=gQVIRcy8lqxy4to+BYi5VCi3At96IC3rEQ6B/RATix8=;

b=ZhMhr7w/WduM7sRSlCl8K601l46CCWtBLZJpH0D4nvg1QiQ6vGSM+BkSvKKfR2Aj0q

lrG7MZKje0QX9isb5EtjpK8m4mn6VbooeagD0lxw9WbO9rL+oRXRr5JcDFA+lbOFKk8c

UINauCd2CkpOnCwC4/yvzoIZDA24OnzcLjqCtfxruDnPTCc17NGn9glVUy15SEVKVc1m

wAHKJdu+gGTQid3g2bPM8erjeB56mY4E2V0sVzn53usimVUxqPsQrNXO7SFsyp0Chf/S

EVBqbN0IiUgUJ70DkkwAlKbNNPm1sHxd/CfHCN6o69h4P/7aRN3KLN+m3WMrD/BqL3ay

FxjA==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20251104; t=1784996964; x=1785601764;

h=list-unsubscribe:list-subscribe:list-archive:list-help:list-post

:x-spam-checked-in-group:list-id:mailing-list:precedence

:x-original-authentication-results:x-original-sender:content-type:to

:subject:message-id:date:from:mime-version:x-gm-gg:x-beenthere

:x-gm-message-state:sender:from:to:cc:subject:date:message-id

:reply-to:content-type;

bh=gQVIRcy8lqxy4to+BYi5VCi3At96IC3rEQ6B/RATix8=;

b=jBgLoTv1shPiGJARfKBEG6gShbrlue2biyHD6bmXVCeOYZGyN5LI/YdwU5kCqWJo0X

I7+QeAOEZQ7WTXfHxtptCUuI7d1XCzXw4VQsrQjnnFiAKb68MHdu+wd1sGQvA4yatJmf

mj/6iRgJpzXF5PDNZjMIEEf2YcvdQ+r2mvAwUQ9piDWX4qOFGYMH6SCUFwkxsueWgmbY

6EoD90/EYQABO81kAkeJrVmZh+5I9bxKhooAeAfz9XREvY/FORV/BO/bk/7SN+6pZU0g

NoFAKIwBt3hc9xLJHPUL+KHF/QkPkfAdVvWDfGYzyGvNa172RC3m4Fhm1/qE/Ju60FO0

Cxfw==

Sender: google_seo@rankbeacon.xyz

X-Forwarded-Encrypted: i=3; AHgh+RoXBql3r6mGyRyPFeJodimy6clahwyJ3LGBW4NmuBEH7XC2AVbkfVG5yxNPrqp1D0hNWI8Q@nk.ca

X-Gm-Message-State: AOJu0YwQRF4B/ypeo7nwyqto3ddC/JjlH1q+jkx0n1LNTMa9TSOe5eij

iU0TATwmMM0cJ8nG7Oajw2D8irf7WT/fvQyCJ4+O8U6SWwQBS4WtoWWpo1lYKj+BYSw=

X-Received: by 2002:a2e:b8d2:0:b0:39c:7200:b9b9 with SMTP id 38308e7fff4ca-39f2880973cmr4706691fa.13.1784996964450;

Sat, 25 Jul 2026 09:29:24 -0700 (PDT)

X-BeenThere: google_seo@rankbeacon.xyz; h="Aa7YSPRSG7kGVJx1K1RzpMkOfROOJIOdziaC/PzTUsfimnqHyg=="

Received: by 2002:a05:651c:3146:b0:39c:63ce:34ac with SMTP id

38308e7fff4ca-39f064a1f12ls10243831fa.1.-pod-prod-03-eu; Sat, 25 Jul 2026

09:27:16 -0700 (PDT)

X-Received: by 2002:a05:6512:31cf:b0:5ae:b7d4:7ddb with SMTP id 2adb3069b0e04-5b2c1b13969mr491563e87.26.1784996835642;

Sat, 25 Jul 2026 09:27:15 -0700 (PDT)

ARC-Seal: i=2; a=rsa-sha256; t=1784996835; cv=pass;

d=google.com; s=arc-20260327;

b=EE2fQR7KOkhSqEOHXSJNAkoViis0B6t64lGQW9OcXE/FPiFHGbbuBFVotMuSj42F2c

A+fuRs1QoEeS3HGoNJijAsy5vuf/IiTGdOhfIKOG1F1G8ir5sMQJ7eTkFAXPPApZ/16W

SRl8ySq6aCSlsdaxTwDZ96BIGgkYT0haPAf2wpFSNxW2Ldw98oPc6Vx4/29eFLYfUaDy

NFxd9pNWMvWZ7O4oPLk5jmLAatdbFJP//Py5ncEeYMw8RGa0PVZbr+hK31Mh+ndVBjZH

MV6hmeRk91bEf6Jm6TKD+OAWmoNV2i+pLMLWvBpwmrOoH2BePM0LZtBy8x7ao0hHkqPV

+xvQ==

ARC-Message-Signature: i=2; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20260327;

h=to:subject:message-id:date:from:mime-version:dkim-signature;

bh=g8eXVDs7lSOLFQ7ZfT588MqrehbWhf6HkiuaB0l6euk=;

fh=PWSUFaEq1CkbsfShP2jell5RPg3MDtCYx7KzhsUuaJc=;

b=hury3/Uj92h7wGtXF7X5iWLoqzOnSaJq9D2zplD2B3GNfNG9hwCxrbfPZjfQrxQGze

TrmOnvtaVBA2mlseFlKAK932ycqBJCANljVQPVrXUgDMfPMSS8tssjvFgR5CbqtztoaB

+vYoJa0E8ZiCUW3nbKgS4ZM+5BKWCXAItNM/sr7JytFR015UxcZqVjf1Txjym4YBDJ8k

wYdm+b7onpgAGgnS0VbWhYeXk+y2xwvfsGEJPbs2PHXGOdhpg+RcSQiAVR9Is/PoGJH/

9IE2KMHK5J10MxLDRcjweEuY/DJzYPZHELEyh0Fo2o0hT7BCnmaolvJULneTJAdgsMpf

jXMg==;

dara=google.com

ARC-Authentication-Results: i=2; mx.google.com;

dkim=pass header.i=@gmail.com header.s=20251104 header.b=iHJJV9eo;

arc=pass (i=1);

spf=pass (google.com: domain of anaya.singh3226@gmail.com designates 209.85.220.65 as permitted sender) smtp.mailfrom=anaya.singh3226@gmail.com;

dmarc=pass (p=NONE sp=QUARANTINE dis=NONE) header.from=gmail.com;

dara=neutral header.i=@rankbeacon.xyz

Received: from mail-sor-f65.google.com (mail-sor-f65.google.com. [209.85.220.65])

by mx.google.com with SMTPS id 2adb3069b0e04-5b2be078844sor364516e87.4.2026.07.25.09.27.15

for

(Google Transport Security);

Sat, 25 Jul 2026 09:27:15 -0700 (PDT)

Received-SPF: pass (google.com: domain of anaya.singh3226@gmail.com designates 209.85.220.65 as permitted sender) client-ip=209.85.220.65;

ARC-Seal: i=1; a=rsa-sha256; t=1784996835; cv=none;

d=google.com; s=arc-20260327;

b=oSnncrwxSXNLhsl5skgD8+IRq0BGfwdPdHTRxWLKUBfSQz17ZBUnBg+tB5DX9NdUtO

GWXWzXL8SxS08oPlbhJzouiUo/uVXxr6x1cAZzvrXd0U23eeoIbzNhmeIUAD7dVWv4HZ

sCJ4amlP/b8aj0x9NJN1R0iYszaWLSzEFJd/DyEoS39/nRVk1tR3BJOke1YnG9MHGgbR

gQS6XKrO1jjKheUTkL0aTKCoDN942Sk4Z2cZC9HMSCdGCrEF9O3T1LtARhHE652uikyL

Uyalr+5M6VCMMgC6Ch/8pDahol2nBy1j+YvyapSJAVTWppIy2swJ5f5/9ayioDdyZTa9

TLag==

ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20260327;

h=to:subject:message-id:date:from:mime-version:dkim-signature;

bh=g8eXVDs7lSOLFQ7ZfT588MqrehbWhf6HkiuaB0l6euk=;

fh=PWSUFaEq1CkbsfShP2jell5RPg3MDtCYx7KzhsUuaJc=;

b=NFJPPmyVh5FaoY7NDfThybIOn0G+uutbfh2b5c+hRYGKTpkU+8tDczXyHrz6ks78Xk

3FQkfiaFaECwZ3F9aNwlDH7IZL+PcaMZa7SS3wE+w6OYOS3WexaLjY2mwCdIyoAyvFO8

bMtyh0wDL0QRgVwGnBOtDhDZok6Z5nMSSWwuXQ0Pqp+TY+eQuTt01PYBV96TINpXKiIv

LF1Oeg/MjlWkmkfaf/vy7ndTxz8WuPyjWjU7BrwHeYC2F+KKszApD7N+6msHsG2OXNJ3

DWnjAgveUJU93reJ55Mewi35WCBhORNUS0GBex08VHRFLXzk13ek0femNJF5hjEMoTmF

bIrQ==;

darn=rankbeacon.xyz

ARC-Authentication-Results: i=1; mx.google.com; arc=none

X-Gm-Gg: AR+sD12Myt3X5EU+ujsnvhNUG/YIlYfq/Bo1yeX1GHLzmWPGatEf0RIYZK60k8X/14l

61ycFi7SOCEHl4sDE6lSZFXNx10zQdisN1rMUIYn4csx8cAKJhJsbj+LHxuY5Utz4jtWgpBFkWL

nvWR5St0sdYNelUg26T+AJWPnoeRi1Yr5wgNVlCQD1nIqWYsSe4Y2phR9nDazm7gzqq1gtdz3ug

5bZpzT30v/yEEocmLkN5N2mrO6Q+s7oyY4fxI0NyEJ+9pN3WotZa35AxA6SMBjOipx4afxRDbcB

sI2zdK3RKAa6v1MxXeI=

X-Received: by 2002:a05:6512:318c:b0:5b0:141d:ec5a with SMTP id

2adb3069b0e04-5b2c1afb57amr507480e87.13.1784996835033; Sat, 25 Jul 2026

09:27:15 -0700 (PDT)

MIME-Version: 1.0

From: Anaya Singh

Date: Sat, 25 Jul 2026 21:59:07 +0530

X-Gm-Features: AUfX_mwJiw5ICiewWCE2vVdJJ92q258JpppwV4ZfFyXcPlXRB72sI0edyldyq6U

Message-ID:

Subject: Few improvements for your website !!!

To: google_seo@rankbeacon.xyz

Content-Type: multipart/alternative; boundary="000000000000470473065771f6a4"

X-Original-Sender: anaya.singh3226@gmail.com

X-Original-Authentication-Results: mx.google.com; dkim=pass

header.i=@gmail.com header.s=20251104 header.b=iHJJV9eo; arc=pass

(i=1); spf=pass (google.com: domain of anaya.singh3226@gmail.com

designates 209.85.220.65 as permitted sender) smtp.mailfrom=anaya.singh3226@gmail.com;

dmarc=pass (p=NONE sp=QUARANTINE dis=NONE) header.from=gmail.com;

dara=neutral header.i=@rankbeacon.xyz

Precedence: list

Mailing-list: list google_seo@rankbeacon.xyz; contact google_seo+owners@rankbeacon.xyz

List-ID:

X-Spam-Checked-In-Group: google_seo@rankbeacon.xyz

X-Google-Group-Id: 1054195051699

List-Post: ,

List-Help: ,



List-Archive:

List-Subscribe: ,



List-Unsubscribe: ,





--000000000000470473065771f6a4

Content-Type: text/plain; charset="UTF-8"



Hi,



Many local businesses are missing opportunities because they're not visible

enough online.



We help businesses generate more calls, inquiries, and customers through

Google.



Reply "Sure" and let's connect.



Thanks,



To unsubscribe from this group and stop receiving emails from it, send an email to google_seo+unsubscribe@rankbeacon.xyz.



--000000000000470473065771f6a4

Content-Type: text/html; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable



Hi,

Many local businesses are missing opportunities=

because they're not visible enough online.

We help businesses g=

enerate more calls, inquiries, and customers through Google.

Reply &=

quot;Sure" and let's connect.

Thanks,








To unsubscribe from this group and stop receiving emails from it, send an e=

mail to google_seo=

+unsubscribe@rankbeacon.xyz.




--000000000000470473065771f6a4--

Dragonfly/ Intelcom phish

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Sat, 25 Jul 2026 12:38:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wnhFW-000000007pw-3pxl

for dave@doctor.nl2k.ab.ca;

Sat, 25 Jul 2026 12:37:26 -0600

Resent-From: The Doctor

Resent-Date: Sat, 25 Jul 2026 12:37:26 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from vps.fslocal.com ([199.83.208.249]:38494)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wnefj-000000000aT-3MOe

for sales@nk.ca;

Sat, 25 Jul 2026 09:52:32 -0600

DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed;

d=laravel.perksona.com; s=default; h=MIME-Version:Date:

Content-Transfer-Encoding:Message-ID:Subject:To:From:Content-Type:Sender:

Reply-To:Cc:Content-ID:Content-Description:Resent-Date:Resent-From:

Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:In-Reply-To:References:

List-Id:List-Help:List-Unsubscribe:List-Subscribe:List-Post:List-Owner:

List-Archive; bh=sDNfpZErZvXaokLFnuFHft4Svn7KnO6x598cSskuhiQ=; b=WOb8573tcfXy

yfFBeRyehPOmjhj7pHHMRpYv4ZovwIMT1eMmJYj30fFhSDuJ5efF0VnoLJcXONv0vac8CEDzXyqCm

mLe2KAXht7/+6H7XB4sSoXN5BLGV0Xqec0wjzPjAleIi8owx2f0xW6THfd4d7rj0axNvPL1x4QzV9

JSS7kGoa2BCF8nUeGk0mrn7F4K0lKpPo2tiMNVhbcF+GGJj32Odo1mdyvbwj2Wbidbfo1ushmpdU1

nlHNklYnDmhpTXPTNhOhOaKsNsnSPkqjVAIwuFFvSZDEO2vJVSswlwx5Iza8wypQHk5Ca/IoYh95n

4dcB/PwoUHur7AUUFAfy9A==;

Received: from [196.75.60.176] (port=58404 helo=[127.0.0.1])

by vps.fslocal.com with esmtpsa (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.99.4)

(envelope-from )

id 1wnees-0000000CRul-28gD

for sales@nk.ca;

Sat, 25 Jul 2026 11:51:26 -0400

Content-Type: text/html

From: Intelcom

To: sales@nk.ca

Subject: Intelcom Delivery Notification

Message-ID: <02d5530f-76eb-e8f7-1afb-7f71cfe8e477@laravel.perksona.com>

Content-Transfer-Encoding: quoted-printable

Date: Sat, 25 Jul 2026 15:51:24 +0000

MIME-Version: 1.0

X-AntiAbuse: This header was added to track abuse, please include it with any abuse report

X-AntiAbuse: Primary Hostname - vps.fslocal.com

X-AntiAbuse: Original Domain - nk.ca

X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12]

X-AntiAbuse: Sender Address Domain - laravel.perksona.com

X-Get-Message-Sender-Via: vps.fslocal.com: authenticated_id: info-mjqu@laravel.perksona.com

X-Authenticated-Sender: vps.fslocal.com: info-mjqu@laravel.perksona.com

X-Source:

X-Source-Args:

X-Source-Dir:

X-Spam_score: 8.2

X-Spam_score_int: 82

X-Spam_bar: ++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Intelcom Delivery Update



Content analysis details: (8.2 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_SBL_XBL RBL: Received via a relay in Spamhaus SBL+XBL

[196.75.60.176 listed in sbl-xbl.spamhaus.org]

1.5 RCVD_IN_CBL RBL: Received via a relay in cbl.abuseat.org

[Listed by XBL, see ]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[196.75.60.176 listed in dnsbl.ahbl.org]

[196.75.60.176 listed in dnsbl.ahbl.org]

[196.75.60.176 listed in dnsbl.ahbl.org]

[196.75.60.176 listed in dnsbl.ahbl.org]

[199.83.208.249 listed in dnsbl.ahbl.org]

[199.83.208.249 listed in dnsbl.ahbl.org]

[199.83.208.249 listed in dnsbl.ahbl.org]

[199.83.208.249 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[196.75.60.176 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[196.75.60.176 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[196.75.60.176 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[196.75.60.176 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[196.75.60.176 listed in will-spam-for-food.eu.org]

[196.75.60.176 listed in will-spam-for-food.eu.org]

[196.75.60.176 listed in will-spam-for-food.eu.org]

[196.75.60.176 listed in will-spam-for-food.eu.org]

[196.75.60.176 listed in will-spam-for-food.eu.org]

[196.75.60.176 listed in will-spam-for-food.eu.org]

[196.75.60.176 listed in will-spam-for-food.eu.org]

[196.75.60.176 listed in will-spam-for-food.eu.org]

[199.83.208.249 listed in will-spam-for-food.eu.org]

[199.83.208.249 listed in will-spam-for-food.eu.org]

[199.83.208.249 listed in will-spam-for-food.eu.org]

[199.83.208.249 listed in will-spam-for-food.eu.org]

[199.83.208.249 listed in will-spam-for-food.eu.org]

[199.83.208.249 listed in will-spam-for-food.eu.org]

[199.83.208.249 listed in will-spam-for-food.eu.org]

[199.83.208.249 listed in will-spam-for-food.eu.org]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[199.83.208.249 listed in bl.score.senderscore.com]

-0.0 SPF_PASS SPF: sender matches SPF record

0.0 HTML_MESSAGE BODY: HTML included in message

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

2.0 RATWR8_MESSID Message-ID with excessive dashes and dollars

0.8 SARE_FROM_SPAM_WORD3 I don't know people named this!

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

Subject: {SPAM?} Intelcom Delivery Notification
















MARGIN: 30px auto; border-radius: 10px; box-shadow: 0 4px 10px rgba(0,0,0,0=

.08)">


center; PADDING-TOP: 20px; PADDING-LEFT: 20px; PADDING-RIGHT: 20px">

Intelcom










TEXT-ALIGN: center; PADDING-TOP: 30px; PADDING-LEFT: 30px; PADDING-RIGHT: =

30px">

Delivery Update





Your package is currently being processed and =

requires a small fee for customs handling.






18px; FONT-WEIGHT: bold; COLOR: #04ab94">Amount due: 2.96 CAD





Please confirm your delivery =

details to ensure a smooth delivery experience.




BACKGROUND: #04ab94; MARGIN-TOP: 20px; FONT-WEIGHT: bold; COLOR: #ffffff; =

PADDING-BOTTOM: 12px; PADDING-TOP: 12px; PADDING-LEFT: 25px; DISPLAY: =

inline-block; PADDING-RIGHT: 25px; border-radius: 6px">Manage My Delivery =








#f1f1f1; COLOR: #888; PADDING-BOTTOM: 20px; TEXT-ALIGN: center; =

PADDING-TOP: 20px; PADDING-LEFT: 20px; PADDING-RIGHT: 20px">

This is an automated message. Please do not reply.=





© 2026 Intelcom Express











Web/SEO/App spam from Google Gmail

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Sat, 25 Jul 2026 09:44:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wneXY-00000000B4p-0l0u

for dave@doctor.nl2k.ab.ca;

Sat, 25 Jul 2026 09:43:52 -0600

Resent-From: The Doctor

Resent-Date: Sat, 25 Jul 2026 09:43:51 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-pj1-f69.google.com ([209.85.216.69]:52582)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wne2D-000000001hI-2Jgl

for root@nk.ca;

Sat, 25 Jul 2026 09:11:39 -0600

Received: by mail-pj1-f69.google.com with SMTP id 98e67ed59e1d1-38ea32e57e2sf2675951a91.1

for ; Sat, 25 Jul 2026 08:10:42 -0700 (PDT)

ARC-Seal: i=3; a=rsa-sha256; t=1784992236; cv=pass;

d=google.com; s=arc-20260327;

b=aW/4e9TYzg4gObpeY/RR+efTQgcGkNWlRJtNiC2Lqwrt6K/WerDAhcr+mrvZ85t86h

pLGnTf9ZBmDW2CYTP+an0gojCMU0PJ6aPXNAIxR+H73ZPcnjWFXLUW+ODPh2eew0l4WL

GywdkswkKBsAGqTRIc3nFHNlr/2jeGIrlUP5Mj035ip+QZcY38eaDqc9WGVPjg/5jeOi

7pmWDXyS75XktU0dO5mhUV7VprCJJ0W5jrD56H8Eij1qJzaqsqRSCLQL0FTJQfUixTUm

pQqRtIFyXapRNzver+GtRAF+H3NSA+6zrAFLHhiTw9ZxXsml9lW/42fdl9Iq57Qp1X31

NnqA==

ARC-Message-Signature: i=3; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20260327;

h=list-unsubscribe:list-subscribe:list-archive:list-help:list-post

:list-id:mailing-list:precedence:to:subject:message-id:date:from

:mime-version:sender:dkim-signature;

bh=7+Tf5i57NiUOeuQ2JVL47eK4odYUOp+NpDW4vYpAuuI=;

fh=GSTS1F8Fs2MHWutf7v3ey04JwL5MZunFLi5/yLoq8LA=;

b=rDwTmarPmL5Z6YZnkz4FI0wo+cDWxBqznZjTiJZAcNAXbc1bYgBpcj93rF8Wt7yolp

lFyIOfTMy6U9Iqs2OfMCKN6KCmXWZ72iITsa2OG72CF7yRA3/6+toNLP/+TvoawH/1Y8

w3h64iqkS2o3e3edsLMDDWJUMjOSeXq4nbwpCuAotp/dM7GCaADDKgPG+k/8dxmT4WPp

MkgPM4Yigs8T/zEEBVCCjug0rLwGtuD+VdzCA91WjaYWjrtHI0haclR28BvzAY7RFk9Q

+f05vun6IKwp2YY9RzQCno/FTxUXNQ2363aLch1NG1Yt6+6UIHdfvJm6h1SO1F3Poj5B

1urQ==;

darn=nk.ca

ARC-Authentication-Results: i=3; mx.google.com;

dkim=pass header.i=@gmail.com header.s=20251104 header.b=XLkoDbx7;

arc=pass (i=1);

spf=pass (google.com: domain of ella.white3180@gmail.com designates 209.85.220.65 as permitted sender) smtp.mailfrom=ella.white3180@gmail.com;

dmarc=pass (p=NONE sp=QUARANTINE dis=NONE) header.from=gmail.com;

dara=neutral header.i=@rankbeacon.xyz

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=rankbeacon.xyz; s=google; t=1784992236; x=1785597036; darn=nk.ca;

h=list-unsubscribe:list-subscribe:list-archive:list-help:list-post

:list-id:mailing-list:precedence:x-original-authentication-results

:x-original-sender:content-type:to:subject:message-id:date:from

:mime-version:sender:from:to:cc:subject:date:message-id:reply-to

:content-type;

bh=7+Tf5i57NiUOeuQ2JVL47eK4odYUOp+NpDW4vYpAuuI=;

b=JHKHSG9oEpH8VIvwtdmNz5RRMBD5nFEs9cAgiqbZHnKMt//OSoNRt6YH8hyJMrjJk+

So+e1cx+kGGQWaym1U8Qa1v3d01S2/ghGubdYpkiFv5/SqTSmvOK3PDlbOMY1pd9bnIW

6fLFQPATWJTCzFlCvUL7+3FOck4hBQQLAZFogaXLwQHm+9tzFNQZHkxg2Nw0MS9uARyj

COjZaJxlncNG34pqaeYlsG8Nowh98IwOoVTtEQSNVViERx9ZDQ3q22/VWITldMITcm8M

xivR0ce6FVUYE3urwvA+8bLMRRaCDXIGSVIF/WL2QfoK00uyi6F0p+9mVLYT9rkWxHG/

3mmQ==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20251104; t=1784992236; x=1785597036;

h=list-unsubscribe:list-subscribe:list-archive:list-help:list-post

:x-spam-checked-in-group:list-id:mailing-list:precedence

:x-original-authentication-results:x-original-sender:content-type:to

:subject:message-id:date:from:mime-version:x-gm-gg:x-beenthere

:x-gm-message-state:sender:from:to:cc:subject:date:message-id

:reply-to:content-type;

bh=7+Tf5i57NiUOeuQ2JVL47eK4odYUOp+NpDW4vYpAuuI=;

b=Ce23sCayQtqsVFSMUcAzjv/laKS6nKjDFM7duQthPOAx64dwuUlFVe/jzMQdZt5cFt

D09SK+IOmHIckq1FCck3A/hPA2f8IQeXb9tiI5/y2udQ3XgY1fhRMwrj2y2bhGhY1CNO

6km+72Us/G4G97e/rdJwXBrmAgSGkTjeJ92YSPS+yqP7KF37yBudec46EwyHuWM9bKrz

YVA/zc1bU10dzbtOmosx4vjL1hexhJj3Sdoz34MrUmPFMKqEYij1jjBmSQzWb7fF8Vtm

WA08SYQAGj+aPuqsFzOlRCUtECk0JZR1HhKYL2pq/99Z7sol9ONIUSaKiFCj4G4NH10U

SXhg==

Sender: google_seo@rankbeacon.xyz

X-Forwarded-Encrypted: i=3; AHgh+Rpm2MxIGY4hoKfLf2JFcEx/P5fSZSeCf16f//T59PKtzcLjTyJ/Hv0A15IhJqBev7zCwI5s@nk.ca

X-Gm-Message-State: AOJu0YwAdtJVMACGwXniw/GPzD+6HjZziQwE5yOaiCY89Y2Oo3iNvDrG

D7yPG2rRLarCViT41RUa+vo0o7YYreGchdNs3mFuRsAL7Rv0kRDxuBhF811az2icyv8=

X-Received: by 2002:a05:690e:e81:b0:666:3936:98fa with SMTP id 956f58d0204a3-668c7a37615mr625053d50.4.1784991853093;

Sat, 25 Jul 2026 08:04:13 -0700 (PDT)

X-BeenThere: google_seo@rankbeacon.xyz; h="Aa7YSPQO0PozLsMCmhkdLWjDSIpn/H5s0YjmsGY+M6bjZG4xPQ=="

Received: by 2002:a05:690e:1286:b0:668:85e9:dcf0 with SMTP id

956f58d0204a3-668a1631950ls1870702d50.0.-pod-prod-05-us; Sat, 25 Jul 2026

08:03:12 -0700 (PDT)

X-Received: by 2002:a05:690e:1543:20b0:667:bd13:2f63 with SMTP id 956f58d0204a3-668c7bb98dbmr487896d50.59.1784991792212;

Sat, 25 Jul 2026 08:03:12 -0700 (PDT)

ARC-Seal: i=2; a=rsa-sha256; t=1784991792; cv=pass;

d=google.com; s=arc-20260327;

b=dwHX1cDsKnVSDL7lPt3XqV644FmPxVaC3OGuWsAQl3ShFjVXJO5eCyIagAKAj4ESsA

YXiQbNec8qu7VFlsWCR0JQF7JJUeZc82XXmc1fZ0C9VDdyyPqNr1uu030lGpsmZe09hH

DYHG+6nWcOT3WuEpuRXZji0vioSMsEyh6XEA3p4Q5RvhwqJE0Ee75ZRFjUYC97ZCpqq2

JMXVILG2b8n0Plv59AtcyWJg/NAsy7KCjFTCdruPTGf7q8ODTPS2vTD+tRqAWdojuG8N

tArWc0Jm6iSMS+/J1MO/OSPt/tvTAPkP/3q/G2Ym6lDMn31O+uHNwXcR1kRQi8oZ46P6

1+sw==

ARC-Message-Signature: i=2; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20260327;

h=to:subject:message-id:date:from:mime-version:dkim-signature;

bh=s4V2XHaG9aRw7mWETWp4rc5Clk2cejwUFX4Kt2V3XFg=;

fh=PWSUFaEq1CkbsfShP2jell5RPg3MDtCYx7KzhsUuaJc=;

b=bLxbG/LuZkqeMlzMc4K8bkJG///xa38FFuXsxR5Ji7cD31yaqKB76XcrfsY/ehiFnd

X0eWAGlwi/RQnjSn3u7zXVOiVpJ4G6guDD2Ri2Cwju/1vA8obWKmx9REN2VHDfIUhp57

pFyBMlaZZZkxrSICwrUANzbM5RzzlS2xO0I6dUyIcQs9gTjf9+iK/icQ7djxpcYgb9pJ

S6c9irUUoTdqZVKw8KJvKnx91gQsXtKZoVXMPI4Uifbkp+HVraolu20Uj175j9xmSMYT

1W4uMl0OIxFDOcagpnft4TFSUYPyL2QpMJ+f1WQVC7Yacik36Ndne0i8nwc4pIyYAMKs

ZIOg==;

dara=google.com

ARC-Authentication-Results: i=2; mx.google.com;

dkim=pass header.i=@gmail.com header.s=20251104 header.b=XLkoDbx7;

arc=pass (i=1);

spf=pass (google.com: domain of ella.white3180@gmail.com designates 209.85.220.65 as permitted sender) smtp.mailfrom=ella.white3180@gmail.com;

dmarc=pass (p=NONE sp=QUARANTINE dis=NONE) header.from=gmail.com;

dara=neutral header.i=@rankbeacon.xyz

Received: from mail-sor-f65.google.com (mail-sor-f65.google.com. [209.85.220.65])

by mx.google.com with SMTPS id 956f58d0204a3-668c70054c0sor1475273d50.10.2026.07.25.08.03.12

for

(Google Transport Security);

Sat, 25 Jul 2026 08:03:12 -0700 (PDT)

Received-SPF: pass (google.com: domain of ella.white3180@gmail.com designates 209.85.220.65 as permitted sender) client-ip=209.85.220.65;

ARC-Seal: i=1; a=rsa-sha256; t=1784991792; cv=none;

d=google.com; s=arc-20260327;

b=DxCpifMeMes9iRMf7jeW+a50x5kCzJKojGcmOFmHV73d921Q5rRIMqdbmzaXinFPA9

1zTavF7UpXN/6/H4GYoyQO6Qtj5dgiZ7E4VFlbHVY6NuV4fzRXGLnxuwst54PBckG/Q0

HNt4q+cKiNIvNG/VRia7XedtRJ7mlM3OHyTDmkC+21HweTqCxBqd9Kp+mmy52EoIcW7b

4bM3s1iGykyTp+ipi3hKsQF8RsJXWlxfc0CkBVsE3x0gvjmPC6zGTOyTpVWuLChWp8vU

DxGRrYngMm6wy1lpYh1LbiVaHhP9to4lf91eiNLkzthVIkmYBv4gHXE9FlOyEwsXVU07

vCww==

ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20260327;

h=to:subject:message-id:date:from:mime-version:dkim-signature;

bh=s4V2XHaG9aRw7mWETWp4rc5Clk2cejwUFX4Kt2V3XFg=;

fh=PWSUFaEq1CkbsfShP2jell5RPg3MDtCYx7KzhsUuaJc=;

b=UyL/FDieunP9c9u+zzfOB2H2cEw+D4Ed7TPZLVMmtzHZM+rJB8gpTGIUse6rM5gKf6

EzEoVQmJstlncieLdMZO3HAFPZQmvd/5T/RvepTi98e+tiWAHdRuQegTkrxbIl6I/D0z

YyF/Dw06fOZyFKYs+Kq5ER2cDfB+tAMpftffb1Jz4swQW0E9KFM9zfi0t5zwhpEdDu34

8U5OPkFW4EEOAk6+rbCnetpBRSOpFf9YKQ7/C+HHlxtB//YICsSin8xpaa5wKKzFYS4l

HcJmHFbtiX59hNgqgdZRSTcOVggTcSwAKrPddYt1I9u6+hiAVr8+BlN+ikGBhuCLE/eo

4FWA==;

darn=rankbeacon.xyz

ARC-Authentication-Results: i=1; mx.google.com; arc=none

X-Gm-Gg: AR+sD13d0z4kEP2HXSbGo0pydEKUqHIw/TpMzXTEbqmcDZFKa2+B307ruOdCj3UIE3N

/0JixMEL7cu/gW2o4V41YDJzM0wH0m3e3LCXTAVO2LskqkWwGMIOuHz4vU85if8/godLL9Qgs9+

OuWdl62BwVvfd6BLCNiu+WVr5sg5GLxPZ4jLiCBiooeE0baUzuMRwQGHiqLLJX4ISGj7R4c0iUj

0r7HSQQLroByqmA3xypuO1M2iOe8+CqHC8bRvo0QX+/HWRTq0ijRqsL9U2KSI+7+/tLvqdqYhF8

z+B2Z2MyXRkNPtuJrz0=

X-Received: by 2002:a05:690e:bcb:b0:668:9148:17ef with SMTP id

956f58d0204a3-668c7a72322mr594870d50.24.1784991791727; Sat, 25 Jul 2026

08:03:11 -0700 (PDT)

MIME-Version: 1.0

From: Ella White

Date: Sat, 25 Jul 2026 20:35:05 +0530

X-Gm-Features: AUfX_mwsnMH0st646LdFKrtAY1jGZZmfbVPRIQ_NCaFouNqDL1Oupcv29gHPPho

Message-ID:

Subject: I Found a few opportunities on your website

To: google_seo@rankbeacon.xyz

Content-Type: multipart/alternative; boundary="000000000000ac46ce065770c9d7"

X-Original-Sender: ella.white3180@gmail.com

X-Original-Authentication-Results: mx.google.com; dkim=pass

header.i=@gmail.com header.s=20251104 header.b=XLkoDbx7; arc=pass

(i=1); spf=pass (google.com: domain of ella.white3180@gmail.com

designates 209.85.220.65 as permitted sender) smtp.mailfrom=ella.white3180@gmail.com;

dmarc=pass (p=NONE sp=QUARANTINE dis=NONE) header.from=gmail.com;

dara=neutral header.i=@rankbeacon.xyz

Precedence: list

Mailing-list: list google_seo@rankbeacon.xyz; contact google_seo+owners@rankbeacon.xyz

List-ID:

X-Spam-Checked-In-Group: google_seo@rankbeacon.xyz

X-Google-Group-Id: 1054195051699

List-Post: ,

List-Help: ,



List-Archive:

List-Subscribe: ,



List-Unsubscribe: ,





--000000000000ac46ce065770c9d7

Content-Type: text/plain; charset="UTF-8"



Hi there,



I noticed a few things on your website that may be affecting how

visitors engage with it.



I documented a* few recommendations* that could help improve results.



Should I* send them over?*



Thanks,



To unsubscribe from this group and stop receiving emails from it, send an email to google_seo+unsubscribe@rankbeacon.xyz.



--000000000000ac46ce065770c9d7

Content-Type: text/html; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable



Hi there,

I noticed a few things on your =

website that may be affecting how visitors engage with it.

r>I documented a few recommendations that could help improve resu=

lts.

Should I send them over?

Thanks,








To unsubscribe from this group and stop receiving emails from it, send an e=

mail to google_seo=

+unsubscribe@rankbeacon.xyz.




--000000000000ac46ce065770c9d7--

Web/SEO/App spam from OVH.net

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Sat, 25 Jul 2026 08:34:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wndRv-00000000O4L-2xkm

for dave@doctor.nl2k.ab.ca;

Sat, 25 Jul 2026 08:33:59 -0600

Resent-From: The Doctor

Resent-Date: Sat, 25 Jul 2026 08:33:59 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from seoserviceweb.com ([79.137.75.80]:47769)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wnc1B-00000000FyK-1vZg

for sales@nk.ca;

Sat, 25 Jul 2026 07:02:25 -0600

DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed;

d=seoserviceweb.com; s=mail; h=List-Id:List-Unsubscribe:Content-Type:

MIME-Version:To:Reply-To:From:Subject:Date:Message-ID:Sender:Cc:

Content-Transfer-Encoding:Content-ID:Content-Description:Resent-Date:

Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:In-Reply-To:

References:List-Help:List-Subscribe:List-Post:List-Owner:List-Archive;

bh=26z/8rOgd0FGwyhO964lIkzjeepz01Q6pLEPef/EflE=; b=bgkPn+sd9amH2M7hYmS5zpaZWv

mvzWk5sR0gbtiC+2F01eL8ocDXE7H3QJVagUxdKXGhv00Fx1jK4Y96nUDcoz5n9oDeOiGhNY7Ncbj

vcQTbZwoyHjX3eiVI1vsDBOVQiphxjkTlc7ycl0RpR8yhkbTZLO45fPkAEMQg+fNmROQ3xf34Q8K3

7Eg8crKZsvB33jys9GRM9NZK/UUYVi/fDHqO00QncEVCUZFGFCoXo/Sxr3R2+wXWkjDmW2P/5FkrR

NjC3rcy95V8yxh1dq9KSFirDvNX71Wqb8kR44kKEdmPLy5VVfv5RJm53QvL34eDIaIKyYa0hA/giP

xaX5zkMw==;

Received: from localhost ([127.0.0.1] helo=seoserviceweb.com)

by mail.seoserviceweb.com with esmtpa (Exim 4.95)

(envelope-from )

id 1wnc0I-00B7x2-VI

for sales@nk.ca;

Sat, 25 Jul 2026 13:01:23 +0000

Message-ID:

Date: Sat, 25 Jul 2026 13:01:22 +0000

Subject: Why your competitor is out ranking you

From: Asish Sahoo

Reply-To: Asish Sahoo

To: "sales@nk.ca"

MIME-Version: 1.0

Content-Type: multipart/alternative;

boundary="_=_swift_1784984482_65fd3fa59f59002bf4c077c726dde855_=_"

X-Tracking-Did: 0

X-Subscriber-Uid: gt864eomgv6dd

X-Report-Abuse: Please report abuse for this campaign here:

http://seoserviceweb.com/index.php/campaigns/cl020d5tw43a2/report-abuse/mz228jhl635d4/gt864eomgv6dd

X-Mailer: SwiftMailer - 5.4.x

X-EBS: http://seoserviceweb.com/index.php/lists/block-address

X-Delivery-Sid: 1

X-Customer-Uid: bd766a7grddaa

X-Customer-Gid: 0

X-Campaign-Uid: cl020d5tw43a2

Precedence: bulk

List-Unsubscribe-Post: List-Unsubscribe=One-Click

List-Unsubscribe: ,


Subscriber-Uid:gt864eomgv6dd - Unsubscribe request&body=Please unsubscribe

me!>

List-Id: mz228jhl635d4

Feedback-ID: cl020d5tw43a2:gt864eomgv6dd:mz228jhl635d4:bd766a7grddaa

X-Spam_score: 8.6

X-Spam_score_int: 86

X-Spam_bar: ++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Hello Team, I am Asish, a Search Engine Optimization (SEO)

expert. I searched keywords for your website nk.ca on Google and noticed

that you aren’t on the first page. Your website looks pretty good, [...]





Content analysis details: (8.6 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[79.137.75.80 listed in dnsbl.ahbl.org]

[79.137.75.80 listed in dnsbl.ahbl.org]

[79.137.75.80 listed in dnsbl.ahbl.org]

[79.137.75.80 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[79.137.75.80 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[79.137.75.80 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[79.137.75.80 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[79.137.75.80 listed in dnsbl.ahbl.org]

-0.0 SPF_HELO_PASS SPF: HELO matches SPF record

1.9 URIBL_ABUSE_SURBL Contains an URL listed in the ABUSE SURBL blocklist

[URI: seoserviceweb.com]

1.9 URIBL_JP_SURBL Contains an URL listed in the JP SURBL blocklist

[URI: seoserviceweb.com]

1.7 URIBL_BLACK Contains an URL listed in the URIBL blacklist

[URI: seoserviceweb.com]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-0.0 SPF_PASS SPF: sender matches SPF record

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

-0.0 T_RP_MATCHES_RCVD Envelope sender domain matches handover relay

domain

0.3 LONGWORD BODY: Uses overlong words

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[79.137.75.80 listed in bl.score.senderscore.com]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[79.137.75.80 listed in will-spam-for-food.eu.org]

[79.137.75.80 listed in will-spam-for-food.eu.org]

[79.137.75.80 listed in will-spam-for-food.eu.org]

[79.137.75.80 listed in will-spam-for-food.eu.org]

[79.137.75.80 listed in will-spam-for-food.eu.org]

[79.137.75.80 listed in will-spam-for-food.eu.org]

[79.137.75.80 listed in will-spam-for-food.eu.org]

[79.137.75.80 listed in will-spam-for-food.eu.org]

0.0 HTML_MESSAGE BODY: HTML included in message

0.7 HTML_IMAGE_ONLY_20 BODY: HTML: images with 1600-2000 bytes of words

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

-1.0 MAILING_LIST_MULTI Multiple indicators imply a widely-seen list

manager

1.5 IMPRONONCABLE_2 Too much mixed numbers and lower-case letters

Subject: {SPAM?} Why your competitor is out ranking you





--_=_swift_1784984482_65fd3fa59f59002bf4c077c726dde855_=_

Content-Type: text/plain; charset=utf-8

Content-Transfer-Encoding: quoted-printable



Hello Team,

I am Asish, a Search Engine Optimization (SEO) expert. I sear=

ched

keywords for your website=C2=A0nk.ca=C2=A0on Google and noticed that=

you

aren=E2=80=99t on the first page. Your website looks pretty good, bu=

t you

are missing out on many calls and business by being back on a good=



Page Rank. I=E2=80=99ve had lots of good rankings and generated addition=

al

leads for others worldwide.

Because as per your website keywords and=

design, you are a prime

candidate to outrank your competitors, and I=

=E2=80=99ve made a plan for how

you can do that.

If you=E2=80=99re the =

right person to send this plan to, and you would like

to speak, just resp=

ond to this email that you=E2=80=99re interested and

I=E2=80=99ll send it=

over to you right away.

If I need to be talking to someone else, let me =

know!

Asish Sahoo | SEO Expert

Building No - 430

Bhubaneswar 751006=



India

https://linktr.ee/asish.sahoo,

=C2=A0

Unsubscribe=C2=A0[http=

://seoserviceweb.com/index.php/campaigns/cl020d5tw43a2/track-url/gt864eomgv=

6dd/ef51c402c9233f468e4875c1ffaef7534e5a9bfe]



--_=_swift_1784984482_65fd3fa59f59002bf4c077c726dde855_=_

Content-Type: text/html; charset=utf-8

Content-Transfer-Encoding: quoted-printable









=09Why your competitor is out ranking you



Hello Team,





I am Asish, a Search Engine Optimization (SEO) expert. I searched keywords =

for your website=C2=A0nk.ca=C2=A0on Google and noticed that you aren=

=E2=80=99t on the first page. Your website looks pretty good, but you are m=

issing out on many calls and business by being back on a good Page Rank. I=

=E2=80=99ve had lots of good rankings and generated additional leads for ot=

hers worldwide.





Because as per your website keywords and design, you are a prime candidate =

to outrank your competitors, and I=E2=80=99ve made a plan for how you can d=

o that.





If you=E2=80=99re the right person to send this plan to, and you would like=

to speak, just respond to this email that you=E2=80=99re interested and I=

=E2=80=99ll send it over to you right away.





If I need to be talking to someone else, let me know!











Asish Sahoo | SEO Expert


Building No - 430


Bhubaneswar 75=

1006


India


https://linktr.ee/asish.sahoo,























=C2=A0






om/index.php/campaigns/cl020d5tw43a2/track-url/gt864eomgv6dd/ef51c402c9233f=


468e4875c1ffaef7534e5a9bfe">Unsubscribe



paigns/cl020d5tw43a2/track-opening/gt864eomgv6dd" alt=3D"" />







--_=_swift_1784984482_65fd3fa59f59002bf4c077c726dde855_=_--



Web/SEO/App spam from Google Gmail

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Fri, 24 Jul 2026 12:59:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wnL6U-000000003sQ-2FIn

for dave@doctor.nl2k.ab.ca;

Fri, 24 Jul 2026 12:58:38 -0600

Resent-From: The Doctor

Resent-Date: Fri, 24 Jul 2026 12:58:38 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-oa1-f69.google.com ([209.85.160.69]:58402)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wnKzp-000000003DV-3FKJ

for root@nk.ca;

Fri, 24 Jul 2026 12:51:55 -0600

Received: by mail-oa1-f69.google.com with SMTP id 586e51a60fabf-451d8064053sf651170fac.0

for ; Fri, 24 Jul 2026 11:50:58 -0700 (PDT)

ARC-Seal: i=3; a=rsa-sha256; t=1784919053; cv=pass;

d=google.com; s=arc-20260327;

b=bzIHrIPe1Hbz0gScHBHr3Ls/DsCBMaVuh9UjWDCq1SHaEhYDET0LC+8OWCXgUoubcF

+1dtIR0QDUeWNkCnjHuZoWloGwh2DrdlOY0rxRVll/7g7WwPTSitrmh5oNt5acn879WP

Scut8ML2u6G4E/UZxA8eOLVu48maqwftjeo6pPyD50X6i0OIzblKMmDXyn1YTYfPddbs

VKTOj0N/eN9xgmgminC1JgrXFBMUrZfn87+Q4tlqnSw0ep3EwTIxg01b6srjrNW1iNll

tXHWTCKM8/HyPj2Ir9ThPqgn8RX/Tclqt6hmaIkqfc9eeqyJDwX8o9UAt5mNp36NvDvk

Cdhw==

ARC-Message-Signature: i=3; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20260327;

h=list-unsubscribe:list-archive:list-help:list-post:list-id

:mailing-list:precedence:reply-to:to:subject:message-id:date:from

:mime-version:dkim-signature;

bh=81jkBpgv82WTYqnAHYmT+l3Wbg9XYZJtcd8wKXpcej4=;

fh=xIk91nWcC6ruj3RG/sokbHPOfeuTrFrjQ1A2XxuXacA=;

b=jWntdb0U0fz01KePvUhh6DoPq0tGH6F0CHaQRgFUdigVfxZ/GOPP5E66oOVpj5atAv

OpzoSAisYTFQfa5d3aKc8dUn6hhLp1Hicof5Va5SSQcpU2kT/eBaBrLqiliuQpJujHNO

2o8hfdU4NQYfjlT0tTlC9pJ1uTxdkiv3iKcOJeQczB8dXWKp1xF1wWhMuSMWLvevBXUh

YBTahRKgHbL2jl5kmq6qJG9Nd0UborsPika812PYukvR7lq7+gBu+1wsJBuE77eerLHE

ZhbauXPJoZW2gThlrwJxGkEKvnqci68CX1Q9r8GHkh+0ATJPw9bO1cMFYO4xE7sJLxa3

w3oA==;

darn=nk.ca

ARC-Authentication-Results: i=3; mx.google.com;

dkim=pass header.i=@seorino.com header.s=google header.b="K6X/EuvP";

arc=pass (i=1);

spf=pass (google.com: domain of manish@seorino.com designates 209.85.220.41 as permitted sender) smtp.mailfrom=manish@seorino.com;

dmarc=pass (p=QUARANTINE sp=QUARANTINE dis=NONE) header.from=seorino.com;

dara=neutral header.i=@seoservicesindia.co.in

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=seoservicesindia.co.in; s=google; t=1784919053; x=1785523853; darn=nk.ca;

h=list-unsubscribe:list-archive:list-help:list-post:list-id

:mailing-list:precedence:reply-to:x-original-authentication-results

:x-original-sender:content-type:to:subject:message-id:date:from

:mime-version:from:to:cc:subject:date:message-id:reply-to

:content-type;

bh=81jkBpgv82WTYqnAHYmT+l3Wbg9XYZJtcd8wKXpcej4=;

b=RZhsaYjsac5wjWh39FAdKBcAAO1GdwdyED+w7dmYSYlVjwFCVienIawfJR0uuxkg97

5+q+4yMKuoApW8y5NeJiAPsbh+EW0YwoPkk4VXb+FVk/RJ6flo165oy98xNkTXMMhnqv

A9vzdYGd0ufcrs36ywnmAK5uxwcicUDEvnAUcDGs1tHEXJWf/OjoWTQHir/wKzqCpzdA

wULpz1syjVSmGCJCpQ5rjWHrFPHiaqwsHVq6NeNo0M/LWU5NWH2GpUEol9NRuKCU2SMk

OBwAaTn9r3O8NJw4HVxMibdWUKREfjru0bk6rEvz/J/OI9TXBRHVputilvG37ptUJ4cY

r2HA==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20251104; t=1784919053; x=1785523853;

h=list-unsubscribe:list-archive:list-help:list-post

:x-spam-checked-in-group:list-id:mailing-list:precedence:reply-to

:x-original-authentication-results:x-original-sender:content-type:to

:subject:message-id:date:from:mime-version:x-gm-gg:x-beenthere

:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to

:content-type;

bh=81jkBpgv82WTYqnAHYmT+l3Wbg9XYZJtcd8wKXpcej4=;

b=sKVrXL7bJ7058EfqNqE/ScPQbcuMv0KidETkU5gyyjWogexg1PIKzYehu4hsfUhQvJ

kW2YqL3kgNTP+7YPTpFnZW2p5xKZfDy+QwPVNwVcbxFJ4L8+IQ6KgSblA9ip5SGOxitL

1fv0PDDBBJYXhmWdQVWx6xGbFytyRh/wbZs5VHoVQffnFFf1UCypBKvi8m1MyS05RXgd

BQsNOcZ2aB2W9aPL7jRI730fw+VT/JIfb9EpG4inAgKJoOM/yu8/F7LGvBd5KOVgsf+S

LJcoBYFKM1WdVmQmrRVAF4Klbwwv5vlOL8jCkDqDjAn0mRTFxV9+6QTW9srehyui2cKv

9S1A==

X-Forwarded-Encrypted: i=3; AHgh+RoNZHyLjYTwUwYmow4Rq+RjycQQLlf1aP/D/HWm0H9L08RG11P6a1SxrcHKFRs7/8e9H0RC@nk.ca

X-Gm-Message-State: AOJu0Yxt5o23Wxh2z/966pHs/9+4kJ6NzcCvUHmEhxKWeRRaKGLmpM8l

vUTv6zZgIb/xOqFLmHZGPHYd8aTP1v/WvwRTCzi1yAiQb4kbJOg9f0epXsSf1uLJ330=

X-Received: by 2002:a53:b193:0:b0:668:8eda:3dc3 with SMTP id 956f58d0204a3-668a4bc45camr1617732d50.21.1784918577657;

Fri, 24 Jul 2026 11:42:57 -0700 (PDT)

X-BeenThere: rankjet@seoservicesindia.co.in; h="Aa7YSPSIicrjLwcC0oaeVH0ciVt+qp1obpfndQysHc/EvVB/Ig=="

Received: by 2002:a05:690e:144b:b0:664:fbe3:c5e with SMTP id

956f58d0204a3-668a1986437ls697367d50.2.-pod-prod-08-us; Fri, 24 Jul 2026

11:41:24 -0700 (PDT)

X-Received: by 2002:a05:690c:4803:b0:81d:7a2:f044 with SMTP id 00721157ae682-81f4c1b9df2mr28665997b3.28.1784918484668;

Fri, 24 Jul 2026 11:41:24 -0700 (PDT)

ARC-Seal: i=2; a=rsa-sha256; t=1784918484; cv=pass;

d=google.com; s=arc-20260327;

b=U5BBVbd4WlNrZA1ZWWDjht0g+II5gnckRp21ByCdCWgdaOo8Ef3dbmZUTCXYV1jBb8

b5j0wEz1RcKxf72L375sU30a0WabKXRoQ0rTQ3xzqXe5m56oIWQWTpjhsyx2/AZlas5S

YYFjj6oRs5CbfAI7EjDcRNwCVVESGuQmm6mrKSCCKuUysAN/Rloju8eHXGcLlSTMJ5DY

/ipi4o2M2b5bofOC72N2Tps99yOcdDLn60eZFxhJYITfdf3rnpYnpdAIE5HmTOEqo1z5

fkR0877UcgfqbDSITwqpilXPnCi7u2gsU+ybl9uskZ9YnTH4K8YuRR0btaBzMsQPGVJF

pLAw==

ARC-Message-Signature: i=2; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20260327;

h=to:subject:message-id:date:from:mime-version:dkim-signature;

bh=A/hPVIQ+woPxssgH5ilvlZZLzFeUx0qx7QWCU4ZtlmY=;

fh=y/t/hCheY/mF9iT6OQ30VYnXUQqDJy7gojMWmOuDDhU=;

b=n0tmDE/6wji2ydmCmj8HfrDlXjgSCW3b+poZNyf6PnSO1L8V9iAxgT8GkR0vimZGov

dJept+ENOAyxAN/GRf0gBjLCEcejrTGgYqf0X0L8JHM5hMfX9bN+f35uat6KOlLZ4S1S

T2ZUmlDEAq0f0BaEgSsWCNMIzqGIj7o8UkOrEexFFR7ATRbDbUmF8zas6xu1kh2iJGeR

wIIIdd3f9/Q3wT3/+GvYUc2yLo3Z8hsj2CvwVmRhOIETFGyhVacI/jKo6Z3ZL2Yzzyzv

kuPt1OyLxb+Dx+yuAUHVaF98Z0eU7nJs/kd7raSGBjcj4vvpNSscv+vQ104BUPxNcvYH

3ozg==;

dara=google.com

ARC-Authentication-Results: i=2; mx.google.com;

dkim=pass header.i=@seorino.com header.s=google header.b="K6X/EuvP";

arc=pass (i=1);

spf=pass (google.com: domain of manish@seorino.com designates 209.85.220.41 as permitted sender) smtp.mailfrom=manish@seorino.com;

dmarc=pass (p=QUARANTINE sp=QUARANTINE dis=NONE) header.from=seorino.com;

dara=neutral header.i=@seoservicesindia.co.in

Received: from mail-sor-f41.google.com (mail-sor-f41.google.com. [209.85.220.41])

by mx.google.com with SMTPS id 00721157ae682-81f65750ea4sor4932487b3.2.2026.07.24.11.41.24

for

(Google Transport Security);

Fri, 24 Jul 2026 11:41:24 -0700 (PDT)

Received-SPF: pass (google.com: domain of manish@seorino.com designates 209.85.220.41 as permitted sender) client-ip=209.85.220.41;

ARC-Seal: i=1; a=rsa-sha256; t=1784918484; cv=none;

d=google.com; s=arc-20260327;

b=gaMNMnATf64bQmLv2Sw8Jvb+jYslDUYNLbCydLJH1x2OBvgEnFsmj/ji4Sh5qh1Xv5

a4egxXQ895nGHPpj3QS3TZiUgU+7fhehnFvZpv+X/scZnEW+EWK7TSGbQVq4qjwHBeEn

by4nl7U1ZIR4ckkpvKHL6ytgzZAxZy9ja9YPvx7wpSmrt+jZtfCL0G27uemEPmjiC5Ae

kGxjWvvlo9XkXSOIxAYaWFpVwVYlvdofA0LbZL2yFYvbx4tVBo52PdlW5bvxDklhiEdE

Ttc8ASUQ2c6sSn/SM663I1t380wOa5iIzawe149LXKqc1jgOgdIZj0HMuKMMZT+sGzDu

htjg==

ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20260327;

h=to:subject:message-id:date:from:mime-version:dkim-signature;

bh=A/hPVIQ+woPxssgH5ilvlZZLzFeUx0qx7QWCU4ZtlmY=;

fh=y/t/hCheY/mF9iT6OQ30VYnXUQqDJy7gojMWmOuDDhU=;

b=qfhe7QGsjK0uxq+JCEhBglSXHhELUOr/0+Box7JfhBseVIoM19UkUNd2TF7RiRCY7H

NnsW6h4jmm3eDJyaPg/U260R8eBdVeeGSP4sCFkUTjA609PGGad/cdyUGZETzw+tuTXt

L1noNbd7QFEWl3chQyuVkFwgGNoAyAQJyKNYLBljBnnqnrnjN0J3UYy+Q3hHPOa3avcF

b7/aYYq3DtnN7G7+W7gWaZ1/H3SqB0UtiziB/Ap2g7vJtWEXKSj79fwUnjnt++OS3Bu6

NFIx9xAW4Tn8mCmey3G22H3pBRwbBWJQJapOzCnRQyNECBwMGR/Kl1RCNhjgp4AJI5ir

8qEw==;

darn=seoservicesindia.co.in

ARC-Authentication-Results: i=1; mx.google.com; arc=none

X-Gm-Gg: AR+sD123kyfnoJ9uGhl4/LraRYkCUA4U1drwFxr9jm9ajRumeCo0vLIYHixE4jQgqdG

h1jlGSCLZv2OKl5s9Z9CZqNK6vuqWZ6WkLxe81ZoTSlIC6EDuBiwiIWaQYqP1xdLKJBoLUbNaQp

xY8qEScai6a5esUqbzwMHCxVe95TFRexWjIY+312zAooTIstGKac5m/vk+ZifaQdoIZOOJGBPhn

LiTW+YsQgzi8srr8efKg/2Bgak6cBM5kYlwLSCUoRvPDjBP/+sX01W/yCKNYIdaiAE9/xBEtt7i

WPQODbYdwNPb0zlZ1ad9iaSOPLroJdL5pG43zSwpl/FleojZEXiKgpCmwEahzEvVfaJK8gXpny2

ABA==

X-Received: by 2002:a05:690c:6308:b0:81e:d081:d73 with SMTP id

00721157ae682-81f4c349272mr29815967b3.65.1784918484159; Fri, 24 Jul 2026

11:41:24 -0700 (PDT)

MIME-Version: 1.0

From: "'Manish Kumar' via rankjet"

Date: Sat, 25 Jul 2026 00:11:12 +0530

X-Gm-Features: AUfX_mzB5UkVOPCSsZOV2Z2xyD35nDs7zHZ0sNt0PecT7bDf_8ZL-CEZ3oYPL4A

Message-ID:

Subject: Visitors but fewer inquiries?

To: rankjet@seoservicesindia.co.in

Content-Type: multipart/alternative; boundary="00000000000033a00306575fb870"

X-Original-Sender: manish@seorino.com

X-Original-Authentication-Results: mx.google.com; dkim=pass

header.i=@seorino.com header.s=google header.b="K6X/EuvP"; arc=pass

(i=1); spf=pass (google.com: domain of manish@seorino.com designates

209.85.220.41 as permitted sender) smtp.mailfrom=manish@seorino.com;

dmarc=pass (p=QUARANTINE sp=QUARANTINE dis=NONE) header.from=seorino.com;

dara=neutral header.i=@seoservicesindia.co.in

X-Original-From: Manish Kumar

Reply-To: Manish Kumar

Precedence: list

Mailing-list: list rankjet@seoservicesindia.co.in; contact rankjet+owners@seoservicesindia.co.in

List-ID:

X-Spam-Checked-In-Group: rankjet@seoservicesindia.co.in

X-Google-Group-Id: 1019656154660

List-Post: ,



List-Help: ,



List-Archive:

List-Unsubscribe: ,



X-Spam_score: 5.9

X-Spam_score_int: 59

X-Spam_bar: +++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Hi There, Getting website visitors is good, but if they

aren’t turning into inquiries, opportunities may be missed. We help improve

traffic quality and conversions to generate more leads and sales.



Content analysis details: (5.9 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[209.85.160.69 listed in dnsbl.ahbl.org]

[209.85.160.69 listed in dnsbl.ahbl.org]

[209.85.160.69 listed in dnsbl.ahbl.org]

[209.85.160.69 listed in dnsbl.ahbl.org]

[209.85.220.41 listed in dnsbl.ahbl.org]

[209.85.220.41 listed in dnsbl.ahbl.org]

[209.85.220.41 listed in dnsbl.ahbl.org]

[209.85.220.41 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[209.85.160.69 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[209.85.160.69 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[209.85.160.69 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[209.85.160.69 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[209.85.220.41 listed in will-spam-for-food.eu.org]

[209.85.220.41 listed in will-spam-for-food.eu.org]

[209.85.220.41 listed in will-spam-for-food.eu.org]

[209.85.220.41 listed in will-spam-for-food.eu.org]

[209.85.220.41 listed in will-spam-for-food.eu.org]

[209.85.220.41 listed in will-spam-for-food.eu.org]

[209.85.220.41 listed in will-spam-for-food.eu.org]

[209.85.220.41 listed in will-spam-for-food.eu.org]

[209.85.160.69 listed in will-spam-for-food.eu.org]

[209.85.160.69 listed in will-spam-for-food.eu.org]

[209.85.160.69 listed in will-spam-for-food.eu.org]

[209.85.160.69 listed in will-spam-for-food.eu.org]

[209.85.160.69 listed in will-spam-for-food.eu.org]

[209.85.160.69 listed in will-spam-for-food.eu.org]

[209.85.160.69 listed in will-spam-for-food.eu.org]

[209.85.160.69 listed in will-spam-for-food.eu.org]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[209.85.160.69 listed in list.dnswl.org]

1.7 URIBL_BLACK Contains an URL listed in the URIBL blacklist

[URI: seoservicesindia.co.in]

1.9 URIBL_JP_SURBL Contains an URL listed in the JP SURBL blocklist

[URI: seoservicesindia.co.in]

1.9 URIBL_ABUSE_SURBL Contains an URL listed in the ABUSE SURBL blocklist

[URI: seoservicesindia.co.in]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

0.0 T_SPF_PERMERROR SPF: test of record failed (permerror)

-0.0 RCVD_IN_MSPIKE_H3 RBL: Good reputation (+3)

[209.85.160.69 listed in wl.mailspike.net]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[209.85.160.69 listed in bl.score.senderscore.com]

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

-1.0 MAILING_LIST_MULTI Multiple indicators imply a widely-seen list

manager

-0.0 RCVD_IN_MSPIKE_WL Mailspike good senders

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

Subject: {SPAM?} Visitors but fewer inquiries?



--00000000000033a00306575fb870

Content-Type: text/plain; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable



Hi There,



Getting website visitors is good, but if they aren=E2=80=99t turning into=

inquiries,

opportunities may be missed.



We help improve traffic quality and conversions to generate more leads and

sales.



I=E2=80=99ve prepared a quick snapshot with a few ideas.



Reply =E2=80=9COK =E2=80=93 SEND=E2=80=9D and I=E2=80=99ll share it.





Thanks,Manish



To unsubscribe from this group and stop receiving emails from it, send an e=

mail to rankjet+unsubscribe@seoservicesindia.co.in.



--00000000000033a00306575fb870

Content-Type: text/html; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable



Hi There,

Getting website visitors is good,
>=C2=A0but if they aren=E2=80=99t turning into=C2=A0inquiries, opportuni=

ties may be missed.

We help improve=C2=A0traffic quality and c=

onversions to generate more leads and sales.

I=E2=80=99ve prepare=

d a quick snapshot with a few ideas.

Reply =E2=80=9COK =E2=80=

=93 SEND=E2=80=9D=C2=A0and I=E2=80=99ll share it.

Thanks,=


Manish









To unsubscribe from this group and stop receiving emails from it, send an e=

mail to rankj=

et+unsubscribe@seoservicesindia.co.in.




--00000000000033a00306575fb870--

Nigerian spam from Google Gmail

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Fri, 24 Jul 2026 05:21:00 -0600

Received: from mail-lj1-f181.google.com ([209.85.208.181]:44513)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wnDx2-00000000FSt-1TfJ

for dave@doctor.nl2k.ab.ca;

Fri, 24 Jul 2026 05:20:33 -0600

Received: by mail-lj1-f181.google.com with SMTP id 38308e7fff4ca-39c953950dfso2856891fa.1

for ; Fri, 24 Jul 2026 04:19:37 -0700 (PDT)

ARC-Seal: i=1; a=rsa-sha256; t=1784891970; cv=none;

d=google.com; s=arc-20260327;

b=igjAJlP0MJj81lZBL/W6Km0+hECmwOt2hZ7JJXbljP4vHlb+P+oAoYLpaUC+9OBotk

Ei34z8VF/9EUvqZMq6wEMyM7VkZtJpFQujNYUn4SNdEAU4Mmb8WpfHzZTPz0OER0Ysev

gzDPFsgKGhGTLivDubMiDZkFo7n111Dwdc+N/tZb5JpKFhzrbmn2bCvlyzxXrk/fOAUD

bjwlWEI+LTppuYklxbSajQjfNYwOAag/eS0rPv7dSZYR7Ak6pCUQh2s3ijqe8rRipIM1

Gjl753uqKhvaYTLRRM5YElxn/LPy6Dst59xVDzKM4YCoow1ZwEXz9QttuL1h4WaSPGua

0koQ==

ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20260327;

h=to:subject:message-id:date:from:mime-version:dkim-signature;

bh=vxCHp2bJ5bHXwZy2rexyasAyTW+9TMOrONNLiOUVnkE=;

fh=Ss1bU5JLZrA5FbRsbE2+yH0Ca2gym0COUPyLOr+TioY=;

b=VZPk2m2sUuUbk/ZJWggKu1ROBPPiLJtxdRTXNJb4WsXW0Y6tX8i/y/LKkUMZwloWYt

IeRvbwd3A92AnXite/uPlnB4EAedCZSZEO3s2pAMZR5k/p/9oAzbDWmBJbZEW5gtKmvc

4t6SKx3Bcs1MIBE32gi1JI1sN3cB4iO4h6ELO8QCv+2WaJC6Qb747t5BUJSrdG3U7nbA

V2tqz8c8QYVA3RvAlQ6SokbnY5cVP1WNibfzLf0pHD5UsIZ7kqt09A0rS4ndXKeRfvuJ

5giE5aHYd5PZNmlcU49kyCxP/QjOkNpadbBRrNYR42AJVhT9viASkCgiAt04TgYn/RAF

si/Q==;

darn=doctor.nl2k.ab.ca

ARC-Authentication-Results: i=1; mx.google.com; arc=none

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=gmail.com; s=20251104; t=1784891970; x=1785496770; darn=doctor.nl2k.ab.ca;

h=content-type:to:subject:message-id:date:from:mime-version:from:to

:cc:subject:date:message-id:reply-to:content-type;

bh=vxCHp2bJ5bHXwZy2rexyasAyTW+9TMOrONNLiOUVnkE=;

b=pw0CvcyjagwCLbagVlXPJrliQPT9ToL3gZNNDlsf54RDG0T16CSAK4hRXtYn/VLgb8

vNWZwrNHSos+fx39j4tLDQQikLvh9/Mxxu5uT9Qk2qi9cn8nq5/zCQYUOfabIGsM4Kke

2Mw1fHiFP17gstrnYa9KkuplFhOk/ABmD+lTvG8kY/sQMgbGfoQ9RC3qm5ePtUSFGCOJ

t84ZkcoWLz2sE7Pszx0iZVaGPfg/LclS9I436URuuUEye+5C7Q62gH0x66ySi8GiiSNO

gs6USabtr7awgCSIG965evifJtBGb+z7cEaAWFpR8jtPKHCmYhPV2iDSrSIvfopKutRS

EU8g==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20251104; t=1784891970; x=1785496770;

h=content-type:to:subject:message-id:date:from:mime-version:x-gm-gg

:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to

:content-type;

bh=vxCHp2bJ5bHXwZy2rexyasAyTW+9TMOrONNLiOUVnkE=;

b=pELvBWNlS0Nqs8Xpp8etxqekIdj0v1oRgly7zZkwrljfIXp4+LiPVM7vaxeyUiSbuI

XP6qIKiEhP7xmzn17q89jyPWCuCLMQKVC/LR4M9i65Vn/GumiiBN4IfWL3j8KUNQGXms

jAwKCIOOyrilRrO4RqYsjpBKB5EDv4I87t0jElqqvJb0g1xOlBNEmKf4WJE/x83j7qM9

Z1sFMhz2BSeCEtEDUhLqsvjJJ9M0pK/QojOeubdGATNqivpRmRyzJhnH6GlF59gXwZEY

naMbA60eCmvthzpf5BaizbmhcOxfjEI1doPF0fyCfR4k0p6axJdvWYNW1XNvPrutg6Lv

SDCQ==

X-Forwarded-Encrypted: i=1; AHgh+Rp834zEh/RKTeHYt8vLV9iYRH1ywW0yGREn98rEtP0PI2AVBJTfQtQqGjWhQ28oLx25/r4I@doctor.nl2k.ab.ca

X-Gm-Message-State: AOJu0Ywhtpwv0I1UovfftZ0t9bFxFEagT9F6vCDFFpfE5FCXOtMaosXl

JovfvDL8PvnPhK/Gs/EG0wm7GGZzaSaY33u+5QK/+r0fRl1MJ2I0KnHI4o5NuqT2GozzveeVC08

TYhRahN5RyeqYPqR/TlFMnLgPDSPIQKQ=

X-Gm-Gg: AR+sD121hEXqd5EP0IW8Jkm12lG7DEPkjXSXKT7ib7v78Y0cyrFH+hRoOGoIo37WBAa

VZt8iy2XeYm+yCC+7dBgrgr0uV3NpYW/1heEarvAQJMlNhzF30BeCNnC2OH2Lw2zA56n6FED81i

hbQnHZaqR24lOtkujEvqWbq6OdXgASuDOmV8pPtoqi8A9wNAZbWgTbmcbBmq1SvL/RIF7so/eL0

Vnq51ch7+G/71J71vQLdYkTH5h2EicvUF7xNgBhBXcxynpHfmuJOLKofUwWog==

X-Received: by 2002:a05:651c:981:b0:39c:6d3a:2dd9 with SMTP id

38308e7fff4ca-39f07c474b8mr14189351fa.12.1784891969540; Fri, 24 Jul 2026

04:19:29 -0700 (PDT)

MIME-Version: 1.0

From: Dd Yyy

Date: Fri, 24 Jul 2026 11:19:45 -0700

X-Gm-Features: AUfX_mxVBiwSZ1Rb1m9vWmSZDbXHYp6uPQio-zGe9_YNio8HkKBXF8l__vU1CoA

Message-ID:

Subject: Hellow Costomer.Urgent Needed..

To: undisclosed-recipients:;

Content-Type: multipart/alternative; boundary="000000000000ce973b0657598b3c"

Bcc: dave@doctor.nl2k.ab.ca

X-Spam_score: 10.5

X-Spam_score_int: 105

X-Spam_bar: ++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Hellow Costomer. Payment order from citibank, they bank have

sign the payment by our office unit of transfer today in your name as next

of kin, from the Citibank of America, we need your full details of transfer

and a [...]



Content analysis details: (10.5 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[209.85.208.181 listed in dnsbl.ahbl.org]

[209.85.208.181 listed in dnsbl.ahbl.org]

[209.85.208.181 listed in dnsbl.ahbl.org]

[209.85.208.181 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[209.85.208.181 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[209.85.208.181 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[209.85.208.181 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[209.85.208.181 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[209.85.208.181 listed in will-spam-for-food.eu.org]

[209.85.208.181 listed in will-spam-for-food.eu.org]

[209.85.208.181 listed in will-spam-for-food.eu.org]

[209.85.208.181 listed in will-spam-for-food.eu.org]

[209.85.208.181 listed in will-spam-for-food.eu.org]

[209.85.208.181 listed in will-spam-for-food.eu.org]

[209.85.208.181 listed in will-spam-for-food.eu.org]

[209.85.208.181 listed in will-spam-for-food.eu.org]

-0.0 SPF_PASS SPF: sender matches SPF record

1.5 GR_DOMAIN_UNDISC1 To contains undisclosed recipient (undisc)

0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider

[dyyy45428(at)gmail.com]

0.0 DATE_IN_FUTURE_06_12 Date: is 6 to 12 hours after Received: date

0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends in

digit

[dyyy45428(at)gmail.com]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

2.5 HK_SCAM_N2 BODY: No description available.

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[209.85.208.181 listed in wl.mailspike.net]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[209.85.208.181 listed in bl.score.senderscore.com]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[209.85.208.181 listed in list.dnswl.org]

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

0.0 HK_SCAM No description available.

0.0 LOTS_OF_MONEY Huge... sums of money

2.0 ADVANCE_FEE_2_NEW_MONEY Advance Fee fraud and lots of money

3.1 UNDISC_MONEY Undisclosed recipients + money/fraud signs

Subject: {SPAM?} Hellow Costomer.Urgent Needed..



--000000000000ce973b0657598b3c

Content-Type: text/plain; charset="UTF-8"



Hellow Costomer.







Payment order from citibank, they bank have sign the payment by our office

unit of transfer today in your name as next of kin, from the Citibank of

America, we need your full details of transfer and a copy of any identity

as urgent immediately, thanks, at your services, for transfer of the sum of

$7.2 million Dollars, to your given account as scam vitin.











III Director Office of Public Affair







Mr. Sabo .H.Rabo.



--000000000000ce973b0657598b3c

Content-Type: text/html; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable










































ize:11pt;font-family:"Calibri","sans-serif"">
e=3D"font-size:26pt;line-height:115%" lang=3D"EN">Hellow Costomer.
pan>






ize:11pt;font-family:"Calibri","sans-serif"">
e=3D"font-size:26pt;line-height:115%" lang=3D"EN">=C2=A0=






ize:11pt;font-family:"Calibri","sans-serif"">
e=3D"font-size:26pt;line-height:115%" lang=3D"EN">Payment order from citiba=

nk, they bank have sign the payment by our office

unit of transfer today in your name as next of kin, from the Citibank of

America, we need your full details of transfer and a copy of any identity a=

s

urgent immediately, thanks, at your services, for transfer of the sum of $7=

.2

million Dollars, to your given account as scam vitin.
pan>






ize:11pt;font-family:"Calibri","sans-serif"">
e=3D"font-size:26pt;line-height:115%" lang=3D"EN">=C2=A0=






ize:11pt;font-family:"Calibri","sans-serif"">
e=3D"font-size:26pt;line-height:115%" lang=3D"EN">=C2=A0=






ize:11pt;font-family:"Calibri","sans-serif"">
e=3D"font-size:26pt;line-height:115%" lang=3D"EN">=C2=A0III Director Office=

of Public Affair






ize:11pt;font-family:"Calibri","sans-serif"">
e=3D"font-size:26pt;line-height:115%" lang=3D"EN">=C2=A0=






ize:11pt;font-family:"Calibri","sans-serif"">
e=3D"font-size:26pt;line-height:115%" lang=3D"EN">=C2=A0Mr. Sabo .H.Rabo.
span>






ize:11pt;font-family:"Calibri","sans-serif"">=C2=

=A0

















--000000000000ce973b0657598b3c--