◆ kanex-ai
Loading…
Inbox Urgent Legal Staff Family Sent Attachments Sydnee.ai Spaces Unsure Later Trash
Benjamin & Williams Aug 16 5:02 AM
Commercial Claim Discovery Documents Our file:D-8222 Debtor: VICTORIA ROPA ELEGANTE
Fake debt collector demand with 24h payment threat; sender domain suspicious.
phishing urgent
Sydnee Agent (AI) Aug 16 4:10 AM
Sydnee nightly — config_drift audit 2026-08-16 — 0P0 12P1 4R
Sydnee Agent (AI): Sydnee nightly — config_drift audit 2026-08-16 — 0P0 12P1 4R
employee high
Sydnee Agent (AI) Aug 16 3:15 AM
Sydnee WEEKLY (cross-cutting) audit 2026-08-16 — 0P0 0P1 0R
Sydnee Agent (AI): Sydnee WEEKLY (cross-cutting) audit 2026-08-16 — 0P0 0P1 0R
employee high
Kelvin Yan Aug 16 1:16 AM
RE: Cash-out refinance inquiry — confirmed HOA figure, plus a second Veer question
⚠ PHISHING: employee impersonation: display name matches 'kelvin yan' but sender is email.sydneeinc.com
phishing urgent
Kelvin Yan Aug 16 1:13 AM
Re: Furnished 1BR at Veer Towers / CityCenter — owner inquiry, immediate move-in
⚠ PHISHING: employee impersonation: display name matches 'kelvin yan' but sender is email.sydneeinc.com
phishing urgent
Sydnee Inc Legal Aug 15 7:55 PM
TEST — Veer 304E, how the Izeal reply will look
⚠ PHISHING: domain impersonation: display name contains 'sydnee' but sender is email.sydneeinc.com
phishing urgent
Sydnee Inc Legal Aug 15 7:46 PM
Veer Towers 304E - furnished 1BR, corporate housing
⚠ PHISHING: domain impersonation: display name contains 'sydnee' but sender is email.sydneeinc.com
phishing urgent
Kelvin Yan Aug 15 7:34 PM
Veer 304E — three drafts for review before sending
⚠ PHISHING: employee impersonation: display name matches 'kelvin yan' but sender is email.sydneeinc.com
phishing urgent
Bank of America Aug 15 5:44 PM
Your statement is available
Bank of America: Your statement is available
financial
Bank of America Aug 15 5:43 PM
Your statement is available
Bank of America: Your statement is available
financial
Sydnee Agent (AI) Aug 15 5:39 PM
[Calibration Daily] 2026-08-16
Sydnee Agent (AI): [Calibration Daily] 2026-08-16
employee high
Sydnee Inc Legal Aug 15 5:34 PM
Access test 1 of 3 - link
⚠ PHISHING: domain impersonation: display name contains 'sydnee' but sender is email.sydneeinc.com
phishing urgent
Sydnee Inc Legal Aug 15 5:33 PM
Access test 3 of 3 - verified
⚠ PHISHING: domain impersonation: display name contains 'sydnee' but sender is email.sydneeinc.com
phishing urgent
Sydnee Inc Legal Aug 15 5:09 PM
Access test 3 of 3 - verified
⚠ PHISHING: domain impersonation: display name contains 'sydnee' but sender is email.sydneeinc.com
phishing urgent
Sydnee Inc Legal Aug 15 5:09 PM
Access test 1 of 3 - link
⚠ PHISHING: domain impersonation: display name contains 'sydnee' but sender is email.sydneeinc.com
phishing urgent
Sydnee Inc Legal Aug 15 4:48 PM
Access test 1 of 3 - link (opens straight away, no code)
⚠ PHISHING: domain impersonation: display name contains 'sydnee' but sender is email.sydneeinc.com
phishing urgent
Microsoft Outlook Aug 15 4:47 PM
Undeliverable: FW: Dr Cat's Video Insights on $NOW and $TEAM-Video 2 of 12 (August 16, 2026)
Microsoft Outlook: Undeliverable: FW: Dr Cat's Video Insights on $NOW and $TEAM
employee high
Microsoft Outlook Aug 15 4:46 PM
Undeliverable: FW: Dr Cat's Video Insights on $ABCL-Video 3 of 12 (August 16, 2026)
Microsoft Outlook: Undeliverable: FW: Dr Cat's Video Insights on $ABCL-Video 3
employee high
Sydnee Inc Legal Aug 15 4:26 PM
Veer 304E - all three access levels
⚠ PHISHING: domain impersonation: display name contains 'sydnee' but sender is email.sydneeinc.com
phishing urgent
Sydnee Inc Legal Aug 15 4:16 PM
Veer 304E - replacement links
⚠ PHISHING: domain impersonation: display name contains 'sydnee' but sender is email.sydneeinc.com
phishing urgent
Sydnee Inc Legal Aug 15 4:10 PM
Veer 304E - short links, one with a code
⚠ PHISHING: domain impersonation: display name contains 'sydnee' but sender is email.sydneeinc.com
phishing urgent
Sydnee Inc Legal Aug 15 4:04 PM
Your access code
⚠ PHISHING: domain impersonation: display name contains 'sydnee' but sender is email.sydneeinc.com
phishing urgent
Sydnee Inc Legal Aug 15 4:04 PM
Your access code
⚠ PHISHING: domain impersonation: display name contains 'sydnee' but sender is email.sydneeinc.com
phishing urgent
Sydnee Inc Legal Aug 15 4:00 PM
Veer 304E - test of the secure file links
⚠ PHISHING: domain impersonation: display name contains 'sydnee' but sender is email.sydneeinc.com
phishing urgent
Sydnee Inc Legal Aug 15 4:00 PM
Your access code
⚠ PHISHING: domain impersonation: display name contains 'sydnee' but sender is email.sydneeinc.com
phishing urgent
Amazon Payments Aug 15 12:52 PM
Action requise sur le compte Amazon Payments
Fake Amazon Payments suspension threat; credential harvesting attempt.
phishing urgent
Guest Relations at The Ritz-Carlton, Laguna Niguel Aug 15 10:49 AM
Kelvin, please complete the travel request form to customize your stay at The Ritz-Carlton, Laguna Niguel
Suspicious Ritz-Carlton email with obfuscation; potential credential theft attempt.
phishing urgent
Manus Team Aug 15 7:33 AM
ACTION REQUIRED: 7 days left to back up Kelvin Yan for future restoration
⚠ PHISHING: phishing subject pattern: 'ACTION REQUIRED' from external sender privaterelay.appleid.com
phishing urgent
Benjamin & Williams Aug 15 5:02 AM
Commercial Claim Discovery Documents Our file:D-8222 Debtor: VICTORIA ROPA ELEGANTE
Fake debt collection demand with 24h payment pressure; spoofed domain.
phishing urgent
Sydnee Agent (AI) Aug 15 4:15 AM
Sydnee nightly — PERFORMANCE audit 2026-08-15 — 0P0 2P1 13R
Sydnee Agent (AI): Sydnee nightly — PERFORMANCE audit 2026-08-15 — 0P0 2P1 13R
employee high
The Ritz-Carlton Reservations Aug 15 4:12 AM
Plan for your upcoming stay at The Ritz-Carlton, Laguna Niguel on Monday, August 17, 2026
Ritz-Carlton reservation confirmation for August 17 stay at Laguna Niguel.
personal
Tesla Aug 15 12:55 AM
Full Self-Driving (Supervised) Subscription Renewed
Tesla FSD subscription auto-renewed for Model Y, $107.29/month.
financial low
Sydnee.ai Legal Aug 14 9:22 PM
Jiao 移民案件最新进展说明（好消息，请放心）
⚠ PHISHING: domain impersonation: display name contains 'sydnee' but sender is email.sydnee.ai
phishing urgent
KuCoin Aug 14 6:38 PM
Dormancy Fee Deduction Notice
KuCoin dormancy fee deducted from account this month.
financial
Tommy Wang (Wang IP Law) Aug 14 6:30 PM
Re: I-485 Application (IOE0934359789 and IOE0934359788)
Tommy Wang (Wang IP Law): Re: I-485 Application (IOE0934359789 and IOE0934359788)
legal-ip high
Bank of America Aug 14 6:16 PM
We've sent your payment to SOUTHERN CALIFORNIA EDISON SCE as requested
Bank of America: We've sent your payment to SOUTHERN CALIFORNIA EDISON SCE as
financial high
Sydnee Agent (AI) Aug 14 5:42 PM
[Calibration Daily] 2026-08-15
Sydnee Agent (AI): [Calibration Daily] 2026-08-15
employee high
Sydnee Agent (AI) Aug 14 5:30 PM
Sydnee algo daily — dev $-2,239 · prod $+0 · 6d window
Sydnee Agent (AI): Sydnee algo daily — dev $-2,239 · prod $+0 · 6d window
employee high
Laguna Road Area Community Message Aug 14 2:39 PM
1 New School Flyer for Your Child
School flyer: Congressional App Challenge signup opportunity.
family
Anthony Patino in Teams Aug 14 2:34 PM
Anthony Patino sent a message
⚠ PHISHING: employee impersonation: display name matches 'anthony' but sender is teams.mail.microsoft
phishing urgent
TAnthony Patino Aug 14 1:34 PM
[Teams oneOnOne] (Teams DM)
Anthony Patino flagging ~$20k air shipment payment for approval.
employee
Amy Burghardt Aug 14 1:19 PM
RE: Meeting
Amy Burghardt: RE: Meeting
personal high
Mary Chmelka Aug 14 1:07 PM
Survey invite to Ameritas California Language Assistance Program Survey
Ameritas requesting language preference survey for insurance benefits.
vendor low
TAnthony Patino Aug 14 12:47 PM
[Teams oneOnOne] (Teams DM)
Anthony Patino requesting updated HDCVT statement.
employee
TAnthony Patino Aug 14 12:45 PM
[Teams oneOnOne] (Teams DM)
Teams DM acknowledgment from Anthony Patino.
employee
TAnthony Patino Aug 14 12:45 PM
[Teams oneOnOne] (Teams DM)
Anthony Patino confirms E-like assessment via Teams DM.
employee low
TAnthony Patino Aug 14 12:08 PM
[Teams oneOnOne] (Teams DM)
Anthony found something; not due for ~30 days.
employee
TAnthony Patino Aug 14 12:05 PM
[Teams oneOnOne] (Teams DM)
SAVLink payment $15,915 awaiting approval
financial high
TAnthony Patino Aug 14 11:59 AM
[Teams oneOnOne] (Teams DM)
Anthony Patino internal Teams message about communications or notes.
employee
TAnthony Patino Aug 14 11:56 AM
[Teams oneOnOne] (Teams DM)
Anthony Patino confirming he will set something up now.
employee
⚠ PHISHING / FRAUD SUSPECTED
This message may be impersonating a known contact or company. Do NOT click any links or open attachments.
Detection: Email displays as from Victoria Yeung at Klasse Holdings but recipient is [email protected] (not Kelvin); sender domain klasseauto.net is external; uses Tipalti payment gateway with obfuscated mail-link URLs containing authorization tokens; multiple red flags suggest credential/wire-fraud BEC attempt targeting LoadKarma (one of Kelvin's entities listed in context).

Status of Payment - Loadkarma

Victoria Yeung <[email protected]>
To: A Hatson <[email protected]>
Monday May 25, 2026 · 8:20 AM PT · in [email protected]
AI verdict  phishing urgent · confidence: high · by haiku
“Spoofed payment notification with suspicious Tipalti links and mismatched sender domain.”
Reasoning: Email displays as from Victoria Yeung at Klasse Holdings but recipient is [email protected] (not Kelvin); sender domain klasseauto.net is external; uses Tipalti payment gateway with obfuscated mail-link URLs containing authorization tokens; multiple red flags suggest credential/wire-fraud BEC attempt targeting LoadKarma (one of Kelvin's entities listed in context).
Good Afternoon, FYI... Please see the attached summary of invoices that were paid today. Kindly confirm receipt of funds. Thank you! Victoria Yeung ACCOUNTS PAYABLE KLASSE HOLDINGS From: "[email protected]" <[email protected]> Objet: payment processed successfully Date: May 13, 2026 at 12:21:24 UTC To: "[email protected] Dear Loadkarma, A USD 5,730.00 (EUR 4,755.93) payment was sent to you today by Wire Transfer and covers the following: Amount Type Document number Document date USD 1,200.00 Invoice 003/2026/A/CTN https://mail-link.tipalti.com/CL0/https:%2F%2Fsuppliers.tipalti.com%2FTheViswaGroup%2FdownloadCenter%2FdownloadInvoice%3FAuthorizationToken=4bc41241-8e87-4035-b260-6f21010262d8/1/0100019e2148df59-6ebedea5-c86e-4da1-ba9e-e03dc296feb5-000000/7ajLvfZ7jqlTfedKdo3QEROVfrcDNqWeM1vR91wBTbo=452 4/1/2026 USD 1,200.00 Invoice 004/2026/A/01/CTN https://mail-link.tipalti.com/CL0/https:%2F%2Fsuppliers.tipalti.com%2FTheViswaGroup%2FdownloadCenter%2FdownloadInvoice%3FAuthorizationToken=0fea503b-fa0f-4acc-adc8-3fa687624fcc/1/0100019e2148df59-6ebedea5-c86e-4da1-ba9e-e03dc296feb5-000000/SIg80sgEe_joLlRspC8tPUuMUqwa0yzw0xJa7Om5CVQ=452 4/1/2026 USD 900.00 Invoice 005/2026/A/CTN https://mail-link.tipalti.com/CL0/https:%2F%2Fsuppliers.tipalti.com%2FTheViswaGroup%2FdownloadCenter%2FdownloadInvoice%3FAuthorizationToken=99f66aa4-63a2-4f39-b683-558e5f17b2ec/1/0100019e2148df59-6ebedea5-c86e-4da1-ba9e-e03dc296feb5-000000/CyOTWtFE-fGP3X4U-oB21WdjRJ3C52iPPHUbHzDA3nc=452 4/1/2026 USD 1,530.00 Invoice 007/2026/A/CTN https://mail-link.tipalti.com/CL0/https:%2F%2Fsuppliers.tipalti.com%2FTheViswaGroup%2FdownloadCenter%2FdownloadInvoice%3FAuthorizationToken=f2ebc6f8-741f-4f87-ba9c-c801aadad1ed/1/0100019e2148df59-6ebedea5-c86e-4da1-ba9e-e03dc296feb5-000000/0qvJfp0pyjLTRSk_C-aEA4jGIohM2O0Nwu5HEMNdhJ8=452 4/1/2026 USD 900.00 Invoice 006/2026/A/CTN https://mail-link.tipalti.com/CL0/https:%2F%2Fsuppliers.tipalti.com%2FTheViswaGroup%2FdownloadCenter%2FdownloadInvoice%3FAuthorizationToken=9bc1d559-aaec-4f75-b19f-b94941c1a0f8/1/0100019e2148df59-6ebedea5-c86e-4da1-ba9e-e03dc296feb5-000000/3_lVeVudnMg6K75X0y3CGnI6FNA4QqQB60Tg_kYZAso=452 4/1/2026 Best regards, Note: FX fees will apply. Payments are Powered by Tipalti. See Tipalti's terms https://mail-link.tipalti.com/CL0/https:%2F%2Ftipalti.com%2Fpayee-agreement%2F/1/0100019e2148df59-6ebedea5-c86e-4da1-ba9e-e03dc296feb5-000000/ZI450CrDaz-xaDTVIx5940Ccoj6pIFN1sRhOj6lJ1Ho=452 . https://mail-link.tipalti.com/CL0/https:%2F%2Ftipalti.com%2Fpowered-by-tipalti-payee%2F%3Futm_source=payee%26utm_medium=email%26utm_campaign=powered_by/1/0100019e2148df59-6ebedea5-c86e-4da1-ba9e-e03dc296feb5-000000/Kk5rfOKRxaCazldkpguO4ZpGiDc6jIDx5vcx_AEzcK4=452 Start of the forwarded message: From: "[email protected]" <[email protected]> Objet: Klasse auto submitted a payment to you Date: May 21, 2026 at 19:29:08 UTC To: "[email protected]" Dear Loadkarma, A payment to you was submitted by Wire Transfer. Payment message: Invoices 011/2026/A/NBIA,010/2026/A/NBIA Best regards, . Payments are Powered by Tipalti. See Tipalti's terms https://mail-link.tipalti.com/CL0/https:%2F%2Ftipalti.com%2Fpayee-agreement%2F/1/0100019e4c035854-abe9ceca-fbe5-4afe-9d69-a2762ad99390-000000/QJ4gOIOWCvbMwGIAgDIcgClIAXC0FQJTAkpb1s9z35g=452 . https://mail-link.tipalti.com/CL0/https:%2F%2Ftipalti.com%2Fpowered-by-tipalti-payee%2F%3Futm_source=payee%26utm_medium=email%26utm_campaign=powered_by/1/0100019e4c035854-abe9ceca-fbe5-4afe-9d69-a2762ad99390-000000/S5ZiJ4OU6lgTrWwOcLCydT09-yVsjByuxBETbU7e2S8=452 Start of the forwarded message: From: "[email protected]" <[email protected]> Objet: Tipalti payment processed successfully Date: May 21, 2026 at 20:51:22 UTC To: "[email protected]" Dear Loadkarma, A USD 3,456.00 (EUR 2,893.12) payment was sent to you today by Wire Transfer and covers the following: Amount Type Document number Document date USD 1,768.00 Invoice 011/2026/A/NBIA https://mail-link.tipalti.com/CL0/https:%2F%2Fsuppliers.tipalti.com%2FTheViswaGroup%2FdownloadCenter%2FdownloadInvoice%3FAuthorizationToken=3ffbaec5-7c5c-4181-9b4e-987febb2dbab/1/0100019e4c4ea2f6-7d8cefcc-1117-48b1-9768-f1d4f5283aa8-000000/K3X0MZ80RuNPZOj1VAESx4uNoInj8iIjFm2MaI9YgFQ=452 4/17/2026 USD 1,688.00 Invoice 010/2026/A/NBIA https://mail-link.tipalti.com/CL0/https:%2F%2Fsuppliers.tipalti.com%2FTheViswaGroup%2FdownloadCenter%2FdownloadInvoice%3FAuthorizationToken=ceb3e491-1f5b-4bae-9c38-0a1349cfecfc/1/0100019e4c4ea2f6-7d8cefcc-1117-48b1-9768-f1d4f5283aa8-000000/8rPpdQy4XRt8MMe51EmXmo15j1JUaVvONsKUHeshwis=452 4/17/2026 Best regards, Note: FX fees will apply.