Quicksearch: Your search for concern returned 0 results:

French rental demand phish from Google Gmail Part 2

--0000000000003bca7f06535dd183

Content-Type: text/plain; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable



Chers locataires,



Nous esp=C3=A9rons que vous allez bien.



Nous vous =C3=A9crivons afin de vous informer d'un changement important

concernant le paiement de votre loyer. Dans un souci de simplification, de

rapidit=C3=A9 et de s=C3=A9curit=C3=A9, nous vous invitons =C3=A0 effectuer=

vos paiements par

virement Interac, et ce =C3=A0 compter de ce mois-ci.



Ce nouveau mode de paiement nous permettra :



- de suivre plus facilement les transactions ;

- de r=C3=A9duire les d=C3=A9lais de traitement ;

- et de nous assurer que chaque loyer est bien re=C3=A7u =C3=A0 temps.



Informations pour le virement :





Adresse courriel du destinataire : agenceimmobilier1990@outlook.com



Question de s=C3=A9curit=C3=A9 : VIREMENT





R=C3=A9ponse : INTERAC



Une fois le virement effectu=C3=A9, merci de nous en informer par retour de

courriel. Si possible, nous vous invitons =C3=A0 joindre une capture d'=C3=

=A9cran ou

une confirmation du virement afin de faciliter la mise =C3=A0 jour rapide d=

e

votre dossier.



Nous comprenons que ce changement puisse n=C3=A9cessiter un temps d'adaptat=

ion.

Soyez assur=C3=A9(e) que nous restons disponibles pour vous accompagner tou=

t au

long de cette transition.



N=E2=80=99h=C3=A9sitez pas =C3=A0 nous contacter pour toute question ou pou=

r obtenir de

l'aide lors de votre premier virement.



Nous vous remercions pour votre collaboration et votre confiance. Votre

confort et votre tranquillit=C3=A9 d=E2=80=99esprit demeurent nos priorit=

=C3=A9s.



Pour toute demande, vous pouvez nous =C3=A9crire =C3=A0 :

agenceimmobilier1990@outlook.com



Bien cordialement,





Service Locative



--0000000000003bca7f06535dd183

Content-Type: text/html; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable



Chers locataires,

Nous esp=C3=A9rons que vous=

allez bien.

Nous vous =C3=A9crivons afin de vous informer d'un c=

hangement important concernant le paiement de votre loyer. Dans un souci de=

simplification, de rapidit=C3=A9 et de s=C3=A9curit=C3=A9, nous vous invit=

ons =C3=A0 effectuer vos paiements par virement Interac, et ce =C3=A0 compt=

er de ce mois-ci.

Ce nouveau mode de paiement nous permettra :


>
  • de suivre plus facilement les transactions ;
  • de r=C3=A9duire l=

    es d=C3=A9lais de traitement ;
  • et de nous assurer que chaque loyer =

    est bien re=C3=A7u =C3=A0 temps.
  • Informations pour le v=

    irement :


    Adresse courriel du destinataire :
    color=3D"#0000ff">=C2=A0
    ,246);font-family:"Google Sans",Roboto;font-size:14px;text-align:=

    center">
    ook.com" target=3D"_blank">agenceimmobilier1990@outlook.com

    n>

    Question de s=C3=A9curit=C3=A9 :=C2=A0
    s,Aptos_EmbeddedFont,Aptos_MSFontService,Calibri,Helvetica,sans-serif;color=

    :rgb(200,38,19)">VIREMENT


    R=C3=A9ponse :=C2=A0
    =3D"font-family:Aptos,Aptos_EmbeddedFont,Aptos_MSFontService,Calibri,Helvet=

    ica,sans-serif;font-size:16px;color:rgb(200,38,19)">
    tyle=3D"vertical-align:inherit">
    inherit">INTERAC

    Une fois le virement effectu=

    =C3=A9, merci de nous en informer par retour de courriel. Si possible, nous=

    vous invitons =C3=A0 joindre une capture d'=C3=A9cran ou une confirmat=

    ion du virement afin de faciliter la mise =C3=A0 jour rapide de votre dossi=

    er.

    Nous comprenons que ce changement puisse n=C3=A9cessiter un temps=

    d'adaptation. Soyez assur=C3=A9(e) que nous restons disponibles pour v=

    ous accompagner tout au long de cette transition.

    N=E2=80=99h=C3=A9si=

    tez pas =C3=A0 nous contacter pour toute question ou pour obtenir de l'=

    aide lors de votre premier virement.

    Nous vous remercions pour votre =

    collaboration et votre confiance. Votre confort et votre tranquillit=C3=A9 =

    d=E2=80=99esprit demeurent nos priorit=C3=A9s.

    Pour toute demande, vo=

    us pouvez nous =C3=A9crire =C3=A0 :=C2=A0
    b(233,238,246);font-family:"Google Sans",Roboto;font-size:14px;te=

    xt-align:center">
    1990@outlook.com" target=3D"_blank">agenceimmobilier1990@outlook.com

    ont>

    Bien cordialement,


    Service Locative





    --0000000000003bca7f06535dd183--

    French rental demand phish from Google Gmail Part 1

    X-Mozilla-Status: 0001

    X-Mozilla-Status2: 00000000

    Return-path:

    Envelope-to: dave@doctor.nl2k.ab.ca

    Delivery-date: Wed, 03 Jun 2026 12:46:00 -0600

    Received: from mail-dl1-f48.google.com ([74.125.82.48]:48466)

    by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

    (Exim 4.99.3 (FreeBSD))

    (envelope-from )

    id 1wUqaf-00000000PWE-2lZ4

    for dave@doctor.nl2k.ab.ca;

    Wed, 03 Jun 2026 12:45:30 -0600

    Received: by mail-dl1-f48.google.com with SMTP id a92af1059eb24-137dd523634so6690896c88.1

    for ; Wed, 03 Jun 2026 11:44:33 -0700 (PDT)

    ARC-Seal: i=1; a=rsa-sha256; t=1780512268; cv=none;

    d=google.com; s=arc-20240605;

    b=lROFAqEKpNULqImhAoOmCP3sMsPBvTZpORL5ZZNn/QU6xbPk1T5W1+XgsxMAQ6Sud+

    wWMZiZF5im2ZvI7XbFpkN2jsnA9A0//e3yX6z50f2dQpJrRQXCzY3tVv1ZeK2rtfew9Q

    lbtemD0mPvOoYrQAarvlesu4aDcb1Syo5PEz9n3DwsjW9+5xc6oVicr+nxMl3dLg0HFY

    aq8itXxcWDl55fuxyPx1vjYyI/bTQCQHZRKkEfhIHZARM9xa3bF6TjY04LmsfkDLy+04

    oWjDXThlca32wytLoLYsaMCFrrI5htqJnq8qZJhzNLej9KLE7CWiYjarhWOmJtsWgy3m

    u/TQ==

    ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20240605;

    h=to:subject:message-id:date:from:reply-to:mime-version

    :dkim-signature;

    bh=O/5wFZUtNunhXLGC5aJYw/gHqbalIm305kc+HXYesNY=;

    fh=zVbOMpQjN1ElltPgYQHeloHI1ULle2HETGB3YJEe754=;

    b=AkIed8FKjZ2zIGaARfsGaanXUZrUL0c10xqqIBFBEURXScjs1BDFWXxqv35VIWCnYk

    l5Nt2WtEGBA6HPniJq7Gdj9Nsd1+RFwPue2p9ZvB8W2/iTQUHgSV2uR2r/NuYiueigMm

    xcW/cJ8Hxu0nnsbW5yE6/M9H36MRMs6Q/f9z4l/oKEpT0G4idh6LDqnKxPmoXwvOkH1w

    oJfPmORsC1LpP6jrss0DsGoTm8xFWHcfxodanrBmaei9Ra6p9jpQ3ytqrZGqXbir0ioi

    nWi+rWjLsM7eKhs5MrhGhdTb6C5NwZD87egOWSCDqd8TyQc5eS3fZWaDF5d4d93QRc7A

    0BoQ==;

    darn=doctor.nl2k.ab.ca

    ARC-Authentication-Results: i=1; mx.google.com; arc=none

    DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

    d=edutec-sed-ms-gov-br.20251104.gappssmtp.com; s=20251104; t=1780512268; x=1781117068; darn=doctor.nl2k.ab.ca;

    h=to:subject:message-id:date:from:reply-to:mime-version:from:to:cc

    :subject:date:message-id:reply-to;

    bh=O/5wFZUtNunhXLGC5aJYw/gHqbalIm305kc+HXYesNY=;

    b=GzScLCVnafy9HCuKhLZeCNrBvyoWCDYvML3W8f9D/pEZ/ZHnTkQ3iXxGnTyhV3H6wF

    /4/NghM0JfynWn6FcY2sixceWF9M6UNR0zPhDmfvncXb1oEWgmp6np6CVwfwc2cJkpRa

    NHpdLGaqa74UxYgk1GqDH+XuIuD/A6Vstel/4/ixFXq5O2PNWrHuJqKZ5iSAyyw8OLUA

    CqxVw0WwnC0DTZzhj8akaWZa97HonDaOogs522yA47HZKfXGTAHt1ht9R/sGS/L8v9Bl

    QYWQtGIhN5mHjxzWOwEaXQvkOU4K21HGHI6oeoAB9Op1zQpwXF6zMxosGthB5bllkrq9

    Xc7w==

    X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

    d=1e100.net; s=20251104; t=1780512268; x=1781117068;

    h=to:subject:message-id:date:from:reply-to:mime-version:x-gm-gg

    :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to;

    bh=O/5wFZUtNunhXLGC5aJYw/gHqbalIm305kc+HXYesNY=;

    b=a7lWdL9JdxVpnmd+8tlZPBrtxQ6SAfv0vfBoVtCcaUaVM6fRd426LCwNLoEkdYKYJH

    qn8K7Jl2BcJZ85wWtt0GAt1HNTy8ukroOHGD78gEGfuCI2EdZa/R03Tk0iU6jJBgYV93

    4rw5g788cPj7GwWS2smj4/FwW/AAtuY5/gfhNctHVfhQ+oJg3neg0fKcR8Eq3twxhAKN

    5D5huIdO2PAMTwSRPMJZm/Kj3hevaYr7SrVoF+a69pivQkGLJKFpSI+c9cmUMzax0SwC

    e+hVWL85eZxtcut+CUX42MmjScfozQBf+298LPs83ccHAPC0C7RBNyqJh6pQg1v4Ohmi

    cjCQ==

    X-Forwarded-Encrypted: i=1; AFNElJ8v4rZW1ja2PEzIY9Hk615FP78PIjK5SceI/inDF29vHRjmPIFls7YMrboto4xkb1a/JAMz@doctor.nl2k.ab.ca

    X-Gm-Message-State: AOJu0Yxj5tF+g7uhYh/jMl5uT6uyjQInQ+xgKMu6bcHXYaobApsaYCNc

    gBjBizkhfARqff7yhkP66sx5vQeSH2QpOIowtsF7vXLty8HGlOVBSGviA9loqFqBBml5g6PErVp

    pTzIQL5/8Fg4ALCqTb0+oxJBHXYPNXdC8YMbyXrxKsw==

    X-Gm-Gg: Acq92OGBOM9Rk1EhY0vhEB4pDkquu5rDBjeqdFHNHwZuoVRYqSVoQLy1T9DU5elIwak

    TLbsjMDZboB5rwImGmWrmvyhB2frGgEgDjXz8kXf+9f34GqvcdM3KBwenRnrnXnkFQtGIx4fDme

    jyFaGaDcVNdMlnej9358NAclSyeHCIYwsLCJNJW3yIHdGOpaUlf2NTZXcI24e8FKaYc0jT8eDKT

    AgK3h4S/77tzqJSPsm6tQyTt/ckD2CRSuQCOeeKZAgR0HK4PwWB/r4Gu24wwEkBhCaeIuRqwwqJ

    EaxaKfbdAzjGKf5l99sI

    X-Received: by 2002:a05:7022:7a4:b0:136:fac0:84dc with SMTP id

    a92af1059eb24-137f693a12amr1817845c88.3.1780512267680; Wed, 03 Jun 2026

    11:44:27 -0700 (PDT)

    MIME-Version: 1.0

    Reply-To: servicelocative10@gmail.com

    From: Service Locative

    Date: Wed, 3 Jun 2026 20:44:07 +0200

    X-Gm-Features: AVHnY4L-_t2ltkxYbpdNMkg7WtLilyqSwEwp1Qz6Fb5N1eO5NUDf5udQOqiiLmI

    Message-ID:

    Subject: =?UTF-8?Q?Re=3A_Rappel_=3A_Loyer_Mai_=2D_r=C3=A9gulariser_votre_paiement?=

    =?UTF-8?Q?_=F0=9F=8F=A0?=

    To: undisclosed-recipients:;

    Content-Type: multipart/alternative; boundary="0000000000003bca7f06535dd183"

    Bcc: dave@doctor.nl2k.ab.ca

    X-Spam_score: 9.5

    X-Spam_score_int: 95

    X-Spam_bar: +++++++++

    X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

    has identified this incoming email as possible spam. The original

    message has been attached to this so you can view it or label

    similar future email. If you have any questions, see

    @@CONTACT_ADDRESS@@ for details.



    Content preview: Chers locataires, Nous espérons que vous allez bien. Nous

    vous écrivons afin de vous informer d'un changement important concernant

    le paiement de votre loyer. Dans un souci de simplification, de rapidité

    et de sécurité, nous vous invitons à effectu [...]



    Content analysis details: (9.5 points, 5.0 required)



    pts rule name description

    ---- ---------------------- --------------------------------------------------

    1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

    [74.125.82.48 listed in dnsbl.ahbl.org]

    [74.125.82.48 listed in dnsbl.ahbl.org]

    [74.125.82.48 listed in dnsbl.ahbl.org]

    [74.125.82.48 listed in dnsbl.ahbl.org]

    0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

    [74.125.82.48 listed in dnsbl.ahbl.org]

    1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

    [74.125.82.48 listed in dnsbl.ahbl.org]

    0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

    [74.125.82.48 listed in dnsbl.ahbl.org]

    0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

    [74.125.82.48 listed in dnsbl.ahbl.org]

    1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

    [74.125.82.48 listed in will-spam-for-food.eu.org]

    [74.125.82.48 listed in will-spam-for-food.eu.org]

    [74.125.82.48 listed in will-spam-for-food.eu.org]

    [74.125.82.48 listed in will-spam-for-food.eu.org]

    [74.125.82.48 listed in will-spam-for-food.eu.org]

    [74.125.82.48 listed in will-spam-for-food.eu.org]

    [74.125.82.48 listed in will-spam-for-food.eu.org]

    [74.125.82.48 listed in will-spam-for-food.eu.org]

    -0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

    trust

    [74.125.82.48 listed in list.dnswl.org]

    -2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

    safe-sa@returnpath.net

    [Excessive Number of Queries | ]

    -3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

    cert-sa@returnpath.net

    [Excessive Number of Queries | ]

    -0.0 RCVD_IN_MSPIKE_H3 RBL: Good reputation (+3)

    [74.125.82.48 listed in wl.mailspike.net]

    1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

    https://senderscore.org/blacklistlookup/

    [74.125.82.48 listed in bl.score.senderscore.com]

    -0.0 SPF_PASS SPF: sender matches SPF record

    -0.0 RCVD_IN_MSPIKE_WL Mailspike good senders

    1.5 GR_DOMAIN_UNDISC1 To contains undisclosed recipient (undisc)

    0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

    headers

    0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in digit

    [servicelocative10(at)gmail.com]

    0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

    0.0 HTML_MESSAGE BODY: HTML included in message

    0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

    1.0 FREEMAIL_REPLYTO Reply-To/From or Reply-To/body contain different

    freemails

    2.5 FREEMAIL_FORGED_REPLYTO Freemail in Reply-To, but not From

    2.8 UNDISC_FREEM Undisclosed recipients + freemail reply-to

    Subject: {SPAM?} =?UTF-8?Q?Re=3A_Rappel_=3A_Loyer_Mai_=2D_r=C3=A9gulariser_votre_paiement?=

    =?UTF-8?Q?_=F0=9F=8F=A0?=

    Nigerian spam from Google User

    X-Mozilla-Status: 0001

    X-Mozilla-Status2: 00000000

    Return-path:

    Envelope-to: dave@doctor.nl2k.ab.ca

    Delivery-date: Mon, 01 Jun 2026 11:16:00 -0600

    Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

    (envelope-from )

    id 1wU6Ew-00000000Fx7-1Z7l

    for dave@doctor.nl2k.ab.ca;

    Mon, 01 Jun 2026 11:15:50 -0600

    Resent-From: The Doctor

    Resent-Date: Mon, 1 Jun 2026 11:15:50 -0600

    Resent-Message-ID:

    Resent-To: Dave Yadallee

    Received: from ns1.robo.co.jp ([219.166.6.18]:41620 helo=mail.robo.co.jp)

    by doctor.nl2k.ab.ca with esmtp (Exim 4.99.3 (FreeBSD))

    (envelope-from )

    id 1wU5El-00000000DTA-1h6F

    for sales@nk.ca;

    Mon, 01 Jun 2026 10:11:45 -0600

    Received: from [127.0.0.1] (55.232.229.8.bc.googleusercontent.com [8.229.232.55])

    by mail.robo.co.jp (Postfix) with ESMTPA id C8477629AC

    for ; Tue, 2 Jun 2026 01:07:43 +0900 (JST)

    From: Whitney Spencer

    To: sales@nk.ca

    Subject: Nagindas Khandwala College Remittance Notification

    Message-ID:

    Date: Mon, 01 Jun 2026 16:10:44 +0000

    MIME-Version: 1.0

    Content-Type: multipart/mixed; boundary="--_NmP-82f725d3a620d697-Part_1"

    X-Spam_score: 8.4

    X-Spam_score_int: 84

    X-Spam_bar: ++++++++

    X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

    has identified this incoming email as possible spam. The original

    message has been attached to this so you can view it or label

    similar future email. If you have any questions, see

    @@CONTACT_ADDRESS@@ for details.



    Content preview: Good day Sales, Reichel - O'Connell Group has initiated a

    new payment on 06/01/2026 via EFT to Nagindas Khandwala College



    Content analysis details: (8.4 points, 5.0 required)



    pts rule name description

    ---- ---------------------- --------------------------------------------------

    1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

    [8.229.232.55 listed in dnsbl.ahbl.org]

    [8.229.232.55 listed in dnsbl.ahbl.org]

    [8.229.232.55 listed in dnsbl.ahbl.org]

    [8.229.232.55 listed in dnsbl.ahbl.org]

    [219.166.6.18 listed in dnsbl.ahbl.org]

    [219.166.6.18 listed in dnsbl.ahbl.org]

    [219.166.6.18 listed in dnsbl.ahbl.org]

    [219.166.6.18 listed in dnsbl.ahbl.org]

    0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

    [8.229.232.55 listed in dnsbl.ahbl.org]

    1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

    [8.229.232.55 listed in dnsbl.ahbl.org]

    0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

    [8.229.232.55 listed in dnsbl.ahbl.org]

    0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

    [8.229.232.55 listed in dnsbl.ahbl.org]

    1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

    [8.229.232.55 listed in will-spam-for-food.eu.org]

    [8.229.232.55 listed in will-spam-for-food.eu.org]

    [8.229.232.55 listed in will-spam-for-food.eu.org]

    [8.229.232.55 listed in will-spam-for-food.eu.org]

    [8.229.232.55 listed in will-spam-for-food.eu.org]

    [8.229.232.55 listed in will-spam-for-food.eu.org]

    [8.229.232.55 listed in will-spam-for-food.eu.org]

    [8.229.232.55 listed in will-spam-for-food.eu.org]

    [219.166.6.18 listed in will-spam-for-food.eu.org]

    [219.166.6.18 listed in will-spam-for-food.eu.org]

    [219.166.6.18 listed in will-spam-for-food.eu.org]

    [219.166.6.18 listed in will-spam-for-food.eu.org]

    [219.166.6.18 listed in will-spam-for-food.eu.org]

    [219.166.6.18 listed in will-spam-for-food.eu.org]

    [219.166.6.18 listed in will-spam-for-food.eu.org]

    [219.166.6.18 listed in will-spam-for-food.eu.org]

    1.5 RCVD_IN_SBL_XBL RBL: Received via a relay in Spamhaus SBL+XBL

    [8.229.232.55 listed in sbl-xbl.spamhaus.org]

    1.5 RCVD_IN_CBL RBL: Received via a relay in cbl.abuseat.org

    [Listed by XBL, see ]

    -3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

    cert-sa@returnpath.net

    [Excessive Number of Queries | ]

    -2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

    safe-sa@returnpath.net

    [Excessive Number of Queries | ]

    1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

    https://senderscore.org/blacklistlookup/

    [219.166.6.18 listed in bl.score.senderscore.com]

    0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

    1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

    0.0 HTML_MESSAGE BODY: HTML included in message

    2.0 RATWR8_MESSID Message-ID with excessive dashes and dollars

    0.0 T_HTML_ATTACH HTML attachment to bypass scanning?

    1.0 SARE_HTML_INV_TAG3 Message contains invalid HTML tag

    Subject: {SPAM?} Nagindas Khandwala College Remittance Notification







    Good day Sales,



    Reichel - O'Connell Group has initiated a new payment on 06/01/2026 via EFT to Nagindas Khandwala College



    The following attached payslip and credit notes were cleared with this payment:



    payments will post to your account within 1-3 days of attached receipt. Please contact us with any questions or concerns.



    Sincerely



    Take care,







    Whitney Spencer | Account Manager



    Reichel - O'Connell





    Nigerian spam from Google Cloud

    X-Mozilla-Status: 0001

    X-Mozilla-Status2: 00000000

    Return-path:

    Envelope-to: dave@doctor.nl2k.ab.ca

    Delivery-date: Mon, 01 Jun 2026 11:14:00 -0600

    Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

    (envelope-from )

    id 1wU6Cs-00000000FlZ-44as

    for dave@doctor.nl2k.ab.ca;

    Mon, 01 Jun 2026 11:13:42 -0600

    Resent-From: The Doctor

    Resent-Date: Mon, 1 Jun 2026 11:13:42 -0600

    Resent-Message-ID:

    Resent-To: Dave Yadallee

    Received: from ns1.robo.co.jp ([219.166.6.18]:38492 helo=mail.robo.co.jp)

    by doctor.nl2k.ab.ca with esmtp (Exim 4.99.3 (FreeBSD))

    (envelope-from )

    id 1wU3CC-00000000K5Z-0dY6

    for sales@nk.ca;

    Mon, 01 Jun 2026 08:00:58 -0600

    Received: from [127.0.0.1] (55.232.229.8.bc.googleusercontent.com [8.229.232.55])

    by mail.robo.co.jp (Postfix) with ESMTPA id 5899C61DBD

    for ; Mon, 1 Jun 2026 22:56:55 +0900 (JST)

    From: "Alba Wiza Jr."

    To: sales@nk.ca

    Subject: Nagindas Khandwala College Remittance Notification

    Message-ID: <5db00ccb-184c-ffee-ba8e-23416caf212b@synergyhub.com.my>

    Date: Mon, 01 Jun 2026 13:59:55 +0000

    MIME-Version: 1.0

    Content-Type: multipart/mixed; boundary="--_NmP-6584e903f963d64e-Part_1"

    X-Spam_score: 8.4

    X-Spam_score_int: 84

    X-Spam_bar: ++++++++

    X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

    has identified this incoming email as possible spam. The original

    message has been attached to this so you can view it or label

    similar future email. If you have any questions, see

    @@CONTACT_ADDRESS@@ for details.



    Content preview: Good day Sales, Leannon LLC Group has initiated a new payment

    on 06/01/2026 via EFT to Nagindas Khandwala College



    Content analysis details: (8.4 points, 5.0 required)



    pts rule name description

    ---- ---------------------- --------------------------------------------------

    1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

    [219.166.6.18 listed in dnsbl.ahbl.org]

    [219.166.6.18 listed in dnsbl.ahbl.org]

    [219.166.6.18 listed in dnsbl.ahbl.org]

    [219.166.6.18 listed in dnsbl.ahbl.org]

    [8.229.232.55 listed in dnsbl.ahbl.org]

    [8.229.232.55 listed in dnsbl.ahbl.org]

    [8.229.232.55 listed in dnsbl.ahbl.org]

    [8.229.232.55 listed in dnsbl.ahbl.org]

    0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

    [219.166.6.18 listed in dnsbl.ahbl.org]

    0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

    [219.166.6.18 listed in dnsbl.ahbl.org]

    1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

    [219.166.6.18 listed in dnsbl.ahbl.org]

    0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

    [219.166.6.18 listed in dnsbl.ahbl.org]

    1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

    [8.229.232.55 listed in will-spam-for-food.eu.org]

    [8.229.232.55 listed in will-spam-for-food.eu.org]

    [8.229.232.55 listed in will-spam-for-food.eu.org]

    [8.229.232.55 listed in will-spam-for-food.eu.org]

    [8.229.232.55 listed in will-spam-for-food.eu.org]

    [8.229.232.55 listed in will-spam-for-food.eu.org]

    [8.229.232.55 listed in will-spam-for-food.eu.org]

    [8.229.232.55 listed in will-spam-for-food.eu.org]

    [219.166.6.18 listed in will-spam-for-food.eu.org]

    [219.166.6.18 listed in will-spam-for-food.eu.org]

    [219.166.6.18 listed in will-spam-for-food.eu.org]

    [219.166.6.18 listed in will-spam-for-food.eu.org]

    [219.166.6.18 listed in will-spam-for-food.eu.org]

    [219.166.6.18 listed in will-spam-for-food.eu.org]

    [219.166.6.18 listed in will-spam-for-food.eu.org]

    [219.166.6.18 listed in will-spam-for-food.eu.org]

    1.5 RCVD_IN_SBL_XBL RBL: Received via a relay in Spamhaus SBL+XBL

    [8.229.232.55 listed in sbl-xbl.spamhaus.org]

    1.5 RCVD_IN_CBL RBL: Received via a relay in cbl.abuseat.org

    [Listed by XBL, see ]

    -2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

    safe-sa@returnpath.net

    [Excessive Number of Queries | ]

    -3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

    cert-sa@returnpath.net

    [Excessive Number of Queries | ]

    1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

    https://senderscore.org/blacklistlookup/

    [219.166.6.18 listed in bl.score.senderscore.com]

    0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

    1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

    0.0 HTML_MESSAGE BODY: HTML included in message

    2.0 RATWR8_MESSID Message-ID with excessive dashes and dollars

    1.0 SARE_HTML_INV_TAG3 Message contains invalid HTML tag

    0.0 T_HTML_ATTACH HTML attachment to bypass scanning?

    Subject: {SPAM?} Nagindas Khandwala College Remittance Notification



    Good day Sales,



    Leannon LLC Group has initiated a new payment on 06/01/2026 via EFT to Nagindas Khandwala College



    The following attached payslip and credit notes were cleared with this payment:



    payments will post to your account within 1-3 days of attached receipt. Please contact us with any questions or concerns.



    Sincerely



    Take care,







    Alba Wiza Jr. | Account Manager



    Leannon LLC





















    chinese products spam

    X-Mozilla-Status: 0001

    X-Mozilla-Status2: 00000000

    Return-path:

    Envelope-to: dave@doctor.nl2k.ab.ca

    Delivery-date: Fri, 29 May 2026 17:28:00 -0600

    Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

    (envelope-from )

    id 1wT6bu-000000001Vy-125V

    for dave@doctor.nl2k.ab.ca;

    Fri, 29 May 2026 17:27:26 -0600

    Resent-From: The Doctor

    Resent-Date: Fri, 29 May 2026 17:27:26 -0600

    Resent-Message-ID:

    Resent-To: Dave Yadallee

    Received: from mail-m93245.xmail.ntesmail.com ([103.126.93.245]:29524)

    by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

    (Exim 4.99.3 (FreeBSD))

    (envelope-from )

    id 1wSzHH-0000000004R-05F2

    for sales@nk.ca;

    Fri, 29 May 2026 09:37:50 -0600

    Content-Type: multipart/alternative; BOUNDARY="=_Part_674955_3179734.1780069001264"

    To: sales

    Subject: =?UTF-8?B?V2hvbGVzYWxlIGFuZCBjdXN0b20tbWFkZSBmYXNoaW9uYWJsZSBqZXdlbHJ5IHdpdGggY29wcGVyIGFuZCB6aXJjb24/IENob29zZSBvdXIgY29tcGFueSE=?=

    X-Priority: 3

    MIME-Version: 1.0

    Received: from gy003@saiyajewelry.cn( [10.139.5.212] ) by ajax-webmail ( [127.0.0.1] ) ; Fri, 29 May 2026 23:36:41 +0800 (GMT+08:00)

    From: Joy

    Date: Fri, 29 May 2026 23:36:41 +0800 (GMT+08:00)

    X-WM-Tid: 0a9e74616826d095kusy7a4c3657d8b16

    DKIM-Signature: a=rsa-sha256;

    b=GjiWLkkRkkxFwHJJuYNw8+ceOvJqrD+viOyTLUM1yBWNaTXSMJto39K7QTU9DTecl6qLNtZs6AGYuocpUazYha0ufuaCvhhqif9SYOG5FdhADEbMus5h8ECHi/BCYetW4rvXazQ3US1MHILrna53adoW6MoyCrqgy3NlJgj1paObiHtyc3W51CBemGVE4WppC+ufSxdltyb/0Iu3DMoLEZm296GjZo3jH/btsDsUkprb0ihxDY11/LRPxWN+vvfPlTsbQ8288uFLGBKgRa6+OHOFGnkh4a8NjGIwl8SbIgKssP+UXtvhlA2JDM9xWLjUi2dJ2UGEGptXEOW9ou7hDg==; c=relaxed/relaxed; s=default; d=saiyajewelry.cn; v=1;

    bh=zjUkMVlLfe5rXX8EXWllhjLF1M9OHDLAcs+DpRjCvbM=;

    h=date:mime-version:subject:message-id:from;

    Message-ID:

    X-Spam_score: 6.3

    X-Spam_score_int: 63

    X-Spam_bar: ++++++

    X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

    has identified this incoming email as possible spam. The original

    message has been attached to this so you can view it or label

    similar future email. If you have any questions, see

    @@CONTACT_ADDRESS@@ for details.



    Content preview: Discover our eco-friendly copper and zircon jewelry, compliant

    with international standards, offering quality craftsmanship, reliable logistics,

    and a risk-free sample order process. Explore our colle [...]



    Content analysis details: (6.3 points, 5.0 required)



    pts rule name description

    ---- ---------------------- --------------------------------------------------

    1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

    [103.126.93.245 listed in dnsbl.ahbl.org]

    [103.126.93.245 listed in dnsbl.ahbl.org]

    [103.126.93.245 listed in dnsbl.ahbl.org]

    [103.126.93.245 listed in dnsbl.ahbl.org]

    0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

    [103.126.93.245 listed in dnsbl.ahbl.org]

    0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

    [103.126.93.245 listed in dnsbl.ahbl.org]

    0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

    [103.126.93.245 listed in dnsbl.ahbl.org]

    1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

    [103.126.93.245 listed in dnsbl.ahbl.org]

    1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

    [103.126.93.245 listed in will-spam-for-food.eu.org]

    [103.126.93.245 listed in will-spam-for-food.eu.org]

    [103.126.93.245 listed in will-spam-for-food.eu.org]

    [103.126.93.245 listed in will-spam-for-food.eu.org]

    [103.126.93.245 listed in will-spam-for-food.eu.org]

    [103.126.93.245 listed in will-spam-for-food.eu.org]

    [103.126.93.245 listed in will-spam-for-food.eu.org]

    [103.126.93.245 listed in will-spam-for-food.eu.org]

    -2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

    safe-sa@returnpath.net

    [Excessive Number of Queries | ]

    -3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

    cert-sa@returnpath.net

    [Excessive Number of Queries | ]

    1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

    https://senderscore.org/blacklistlookup/

    [103.126.93.245 listed in bl.score.senderscore.com]

    -0.0 SPF_PASS SPF: sender matches SPF record

    0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

    headers

    1.5 MR_STRANGE_QUESTION URI: No description available.

    0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

    0.0 HTML_MESSAGE BODY: HTML included in message

    0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

    0.3 PLING_QUERY Subject has exclamation mark and question mark

    3.0 LONG_INVISIBLE_TEXT Long block of hidden text - bayes poison?

    Subject: {SPAM?} =?UTF-8?B?V2hvbGVzYWxlIGFuZCBjdXN0b20tbWFkZSBmYXNoaW9uYWJsZSBqZXdlbHJ5IHdpdGggY29wcGVyIGFuZCB6aXJjb24/IENob29zZSBvdXIgY29tcGFueSE=?=





    Discover our eco-friendly copper and zircon jewelry, compliant with international standards, offering quality craftsmanship, reliable logistics, and a risk-free sample order process. Explore our collections and certifications today.

    Hi there,



    Let's be honest—when it comes to fashion jewelry, getting the right materials and craftsmanship saves you way more headaches than just chasing the lowest price. We specialize in eco-friendly copper and zircon pieces, encompassing a wide range of styles including bold, hip-hop, trendy, vintage, minimalist, and cute. All pieces come with 14K gold, rose gold, or palladium white gold plating, so they look great and meet export compliance standards.







    We use lead-free, nickel-free copper across the board. Our plating meets REACH, RoHS, and California Prop 65 requirements. All test reports are uploaded as clear images on our Alibaba store homepage—you can see the key details (test items, dates, batch numbers) at a glance and screenshot them for your records. For customers in Europe/US (sensitive skin concerns) or Middle East/Latin America (hot & humid climates), we add extra pure water rinsing and nano-sealing before plating. Salt spray test data? Just ask, we'll send it over.







    Here's our after-deals assure—no fine print: Before shipment, we'll share packing photos + plating thickness measurements for your confirmation. If you run into abnormal stone loss or plating peeling (not caused by mishandling), just send us the batch code and photos. We'll either replace the parts in your next order or credit the equivalent amount. No runaround, no blame game—just traceable batches and clear accountability.







    You call the shots on logistics, we've got your back:



    ✅ Want to use your own freight forwarder? No problem. We'll handle export docs, booking, and loading—keeping you updated at every step.



    ✅ Prefer a hands-off approach? Our logistics partners provide DDP (duty-paid) door-to-door delivery to US, Europe, Middle East, Brazil, and India. You just give us the delivery address; we handle customs clearance, taxes, and final-mile delivery.



    ✅ Worried about visibility? You'll get a tracking number once we ship, plus proactive updates when your goods leave port, arrive, and clear customs. No guessing games.







    We run on the same quality standards and data system. Factory audit? Anytime. Whether you want to send a third-party inspector (SGS/Bureau Veritas, etc.) or visit yourself, we'll arrange the full pickup-to-dropoff support (airport transfer, hotel booking, local transport, working meals). You just focus on checking the production line, reviewing craftsmanship, and feeling the product quality. Distance isnt the issue—transparency is.







    We'll be at the Hong Kong Jewelry Show this September, displaying our latest eco-friendly copper & zircon collections, plating samples, and full test reports. If you're planning to attend, let us know your schedule and we'll reserve a private meeting area at our booth. Can't make it? No worries—browse our full catalog on Alibaba first:



    https://ywqianju888.en.alibaba.com/?spm=a2700.micro_cgs_home.0.0.84e63e5fBNFQ1t



    Our "Certifications" section on the homepage has all test report images organized by market (Europe/US, Middle East, Latin America), with key compliance items highlighted for quick reference.







    To make your first order risk-ziro: Sample fees are 100% refundable when you place a bulk order. See something you like? Just reply with Sample + Item Number, and I'll create a custom sample order link on Alibaba for you. I can also send you the factory audit booking link or set up a face-to-face meeting at the HK show—your call.







    No fluff, no empty promises—just deliverables we can put in writing. We'd love to be the reliable backup (or main!) supplier in your jewelry supply chain.







    Best regards,





    subscribe

    Joy

    Sales Manager

    Yiwu Gangyuan Import and Export Co., Ltd

    Email:gy003@saiyajewelry.cn

    Phone/WA:+86 19906577316

    Add:No. X4 North Fuli Road, Golden Triangle Industrial Zone, Suxi Town, Yiwu City, Zhejiang Province

    Paypal phish from Google Gmail Part 4















































































    --===============7159839042201245390==--

    Chinese products spam Part 2

    Hi there,



    We are Shanghai HG Apparel Co. Ltd., a garment Manufacturer, established in 2005, and we are not a trader. We operate

    our own factory.



    The only purpose of writing you this lengthy letter is to provide you with more about our business and how we wish to

    collaborate with you. Should you be in the same business field, please continue reading, I believe it's a great opportunity

    for us to become acquainted. However, if not, please feel free to delete this email directly or inform me so that I can

    remove your email from our mailing list.



    The products we manufacture include:

    T-shirts/Polos, casual shirts, Hoodies, Sweat shirts, Pants/ Trousers, Coats & Jackets, Blazers, Dresses, Skirts,

    Uniforms, Nurse Scrubs, Work wear, Safety wear, formal shirts, suits etc.



    We also supply fabrics, scarves, beanies, women's bags, sweaters, etc., but these are outsourced.



    Regarding myself: I am Mr. Lee, the sales manager. I am known for my quick temper. I anticipate prompt responses from

    my customers and, in turn, I ensure that I never keep them waiting. I understand that when you email me for any matter,

    you would also desire a swift response. I will not let you wait; I always respond to my customers' emails promptly. Even when

    I am very busy, I will send a brief message to confirm receipt of your email and inform you of when I will reply in detail. That is

    the way I communicate with my customers and everyone else.



    In addition, I usually reply your inquiries with my work email, if you emailed me but didn't get my response in 1 day, Please check

    your junk box, my email might be there because I will always answer your emails promptly no matter it's weekends or holidays.

    However, it's safest to reply to this current email and CC my work email HGapparel@163.com the same time, by doing this, I think

    I will never miss your emails.



    We are quite different from other Chinese suppliers. After much interaction with me. you will realize how I treat my customers,

    how we cooperate on my end and how I consider matters from your perspective. I know clearly what my customers expect from

    us. I don't think other suppliers can do the same as I do. I prefer a long-term business partnership even if the profit is not

    substantial. We aspire to be not only your supplier but also a reliable partner. Are you interested in collaborating with someone

    like me ?



    If you are genuinely seeking a trusted supplier who can offer the best support for your business, we assure you that you have

    found the right one you can rely on. It is us. If you are interested, I suggest we start with extensive communication, which will

    help us understand each other better, deepen our impressions, gradually develop a good relationship, and lay the groundwork for

    our future collaboration. It is too late to find a reliable supplier when you truly need one. Therefore, upon receiving my email, I

    would be very grateful for a quick response, which is very important for both of us, right ?



    I understand you may hesitate considering moving to a new factory. it's not an easy decision, with so many uncertainties,

    especially before you know the new suppliers quite well. I understand this very much. If you are now satisfied with your current

    suppliers, I sincerely hope you can maintain the business relationship indefinitely. ONLY WHEN you are dissatisfied with them

    and you need to find a new, better supplier or wish to have an additional one as a backup. Please feel free to contact us for more

    info. I firmly believe you'll enjoy doing business with us, I am very confident.



    We eagerly look forward to the opportunity to work with you. If possible, we welcome you to visit our factory in person. What we

    most want is just a long-term business relationship not a quick order or big orders.



    To show your interest, please list your questions or concerns, I will answer in detail as fast as I can.



    Our work email is HGapparel@163.com, it's mainly used for handling all business-related correspondences. It's likely to be

    useful for you, so please keep it.



    Thanks for reading and your prompt response would be highly appreciated.



    Mr. lee

    French language rental demand phish from Google Gmail

    X-Mozilla-Status: 0001

    X-Mozilla-Status2: 00000000

    Return-path:

    Envelope-to: dave@doctor.nl2k.ab.ca

    Delivery-date: Sun, 12 Apr 2026 12:42:00 -0600

    Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))

    (envelope-from )

    id 1wBzkV-000000006gY-0rqx

    for dave@doctor.nl2k.ab.ca;

    Sun, 12 Apr 2026 12:41:35 -0600

    Resent-From: The Doctor

    Resent-Date: Sun, 12 Apr 2026 12:41:35 -0600

    Resent-Message-ID:

    Resent-To: Dave Yadallee

    Received: from mail-wm1-f67.google.com ([209.85.128.67]:57478)

    by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

    (Exim 4.98.2 (FreeBSD))

    (envelope-from <33052@ppk.ac.th>)

    id 1wBwCL-00000000FzX-1TJk

    for root@doctor.nl2k.ab.ca;

    Sun, 12 Apr 2026 08:54:15 -0600

    Received: by mail-wm1-f67.google.com with SMTP id 5b1f17b1804b1-488b0e1b870so58115545e9.2

    for ; Sun, 12 Apr 2026 07:53:18 -0700 (PDT)

    ARC-Seal: i=1; a=rsa-sha256; t=1776005591; cv=none;

    d=google.com; s=arc-20240605;

    b=JX+temfDKSQiNYf3YVdRwV7/fcTsaMcY3dDIF24Wq2cyxmQR79RKpnYngpv0um6VTa

    sleFaJJHTQoScI8Uy8CXxNFGZyuUD0W7zwDV/QnKmqc4wGAOlOhqu/P9vZnAfC+Glbgl

    C2kdwvsxT3VvcCT7xI2UU88w3iz97IUCyUgRUg8N+kZuyUa2U5Qu9ng4NwOz0owchn0+

    3PgzI5MCWhrdB71R4AZkp3Mej8L8otY9aJhMZgwRwoHp/D2bRpPYCeIWYfaab+W2ZRP1

    q9mZBqMIxFo8vXrTufWbXrPDENFRyafbsL7HODGgiq9aztxAyrEOX+eL1gkU5TFn5MWu

    lERA==

    ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20240605;

    h=to:subject:message-id:date:from:reply-to:mime-version

    :dkim-signature;

    bh=Uwm0JhtIbanbWEgLrUoJa3/AJ6gUkPV0Ivh7HaAR2pE=;

    fh=xIC24Ho7nbZF1yObKVf6vdg7uyiR/6sTta/eDfU8GVc=;

    b=K7cTcFq5ZWGJAYbUkspSChLaA+SZ8ai31ilwjHhIT+xs+MTKjUdgH29STCdpe9saDw

    x7Gj4zbptIg4NNxP4c5bQbnK3TZCRhQYwl/cxKtZWwQfsruqh0oaMfpq18Qymw9opOnS

    oD2nMzvwvpiy/ZLZ/Qf2GcA2rjl6SMF3dhJUhTxOuZYqaWqQ2kCZqY/RWHtsckkEgDUu

    s/msIUN5M6UKq6btVG+Ln9hUQLY/+E5f9LjKOqKBYxbScnSMfyf2T8WT12eNmY/5MeEh

    6EDwJeIlmgdYUxDi5p5GR15LJe5QjJtmmbXKTNvfnxF0PKcTHbILT5V+W2S/EHxiYgQH

    MdiQ==;

    darn=doctor.nl2k.ab.ca

    ARC-Authentication-Results: i=1; mx.google.com; arc=none

    DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

    d=ppk-ac-th.20251104.gappssmtp.com; s=20251104; t=1776005591; x=1776610391; darn=doctor.nl2k.ab.ca;

    h=to:subject:message-id:date:from:reply-to:mime-version:from:to:cc

    :subject:date:message-id:reply-to;

    bh=Uwm0JhtIbanbWEgLrUoJa3/AJ6gUkPV0Ivh7HaAR2pE=;

    b=Lt+P95BRHBjgWjo+XYuMUlOqRr7cy0HJm3lUzt0XGn3uDnTeAOyvQ7RWMxgTuDZarz

    asDn6lYl/+X54iRrrbW2yBXM0apu/mJQQh/u0+n061b5KFhosBFbAT72tMYL685mIehH

    QoeIwID3oEYtj57WvZmnfn6ACKX+SSjOoKZWjMrtEeOI1MgWbaFELazo04crf+9AxulQ

    ab5suymuX6JBC/5Ra6avLUeScgYm6dtZ4HsxjxohVMwKCvLOjmLDcL8Zfco9yTJc4Gn8

    PIsg0x+kwSDncVhcobL3VNznmY/f0KQBVVy9S874nCbQZ3ZClQgWEvNZv9PZ0o4PUkQn

    0JJQ==

    X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

    d=1e100.net; s=20251104; t=1776005591; x=1776610391;

    h=to:subject:message-id:date:from:reply-to:mime-version:x-gm-gg

    :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to;

    bh=Uwm0JhtIbanbWEgLrUoJa3/AJ6gUkPV0Ivh7HaAR2pE=;

    b=DkU0xwscqEf5P33vQh9hehYkYgLCh+XDJDHy18HIxYvY9kxTw1OBCh+m6yuP39Mtzq

    7SS5gZt4PTanPnnYJVDadgadrgTQ4W674T8F3//BmfEyRQZqgF0yi2UxCY7xBe+uD/9t

    kl5PSOXdL2H+d6cvpVNo39BigmgkjPQt8jTGFh9b3/2SLKJWY/1qsMHqE3vS+6XlPfrh

    JWOMbwUrEB+7rnCd0If1eRPeDPvEg7k8Z44mEfyOmKfhywChlvYpLLlhqEMYDS9MYHSR

    LkYeCHAU8ztwFxY4Bi38WgO/b2o2zwCiwD6ofLsggON37QQWGGMG0GZ3nQQlhPfqaD72

    I9mA==

    X-Forwarded-Encrypted: i=1; AJvYcCX0r4S1dsZD+xyGk9kUclEmnJP2uLbj8oc3A/nsH3XWIZ8zUZkgd+DatAy+KszrpoQJmSmQ@doctor.nl2k.ab.ca

    X-Gm-Message-State: AOJu0Ywhj8/1MNepH8nTwDZAcc0Y2Ik77KsKvqGXwkU0xEbMLXb9lxf5

    qiVFpUuUKAVix7FIXxAf0cddmsB+yOHeOZjyziEyp0y0lGrO06qvIwjulKK6Yh5y6ptbhymbRGX

    Atxvi5GJ1cjV2AEEDVKedfs7qxXtTtpmmZiFEA9DMvQ==

    X-Gm-Gg: AeBDiesd1rrkRYPuycXKqe3yUDdPOGaPEXONRXT0K5LF79FvD8XmnDIcxnK9zhego5Q

    t1u0Lj6oMzaCT+pCGNEyd/AI32aiDx91zy6dLAK4XlmW13qHB+nQWCdn4ibyKDvuIYu/cWHekge

    K7wlXZlSEdNUaIZsSgW2kg3ZMxLGlO2i7KHD0M70srDuXU8pueR59mh6TETT1QEzCBdXJrHEkZ2

    lvNNmuVbXMzvrY1qI637ADVpEwMNaioDhepJvvfNWek9SKQ3I3noIbubEM9bBcZEJXMmSwTe/cR

    NB3r37h6Y7Q=

    X-Received: by 2002:a05:600c:1c0a:b0:485:4388:3492 with SMTP id

    5b1f17b1804b1-488d67f4e67mr135095555e9.11.1776005590600; Sun, 12 Apr 2026

    07:53:10 -0700 (PDT)

    MIME-Version: 1.0

    Reply-To: servicegestionlocative148@gmail.com

    From: Service Locative <33052@ppk.ac.th>

    Date: Sun, 12 Apr 2026 14:53:12 +0200

    X-Gm-Features: AQROBzC0EbbpJPp6UY4FJnwO_WrqLd9AlkrfnHIv_ol6IngNxY5h1F1HJ4WmFoc

    Message-ID:

    Subject: Rappel de paiement

    To: undisclosed-recipients:;

    Content-Type: multipart/alternative; boundary="00000000000058e0f6064f448662"

    Bcc: root@doctor.nl2k.ab.ca

    X-Spam_score: 9.1

    X-Spam_score_int: 91

    X-Spam_bar: +++++++++

    X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

    has identified this incoming email as possible spam. The original

    message has been attached to this so you can view it or label

    similar future email. If you have any questions, see

    @@CONTACT_ADDRESS@@ for details.



    Content preview: Chers locataires, Nous espérons que vous allez bien. Nous

    vous écrivons aujourd’hui afin de vous informer d’un changement important

    concernant le paiement de votre loyer. Dans un souci de simpli [...]



    Content analysis details: (9.1 points, 5.0 required)



    pts rule name description

    ---- ---------------------- --------------------------------------------------

    1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

    [209.85.128.67 listed in dnsbl.ahbl.org]

    [209.85.128.67 listed in dnsbl.ahbl.org]

    [209.85.128.67 listed in dnsbl.ahbl.org]

    [209.85.128.67 listed in dnsbl.ahbl.org]

    0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

    [209.85.128.67 listed in dnsbl.ahbl.org]

    1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

    [209.85.128.67 listed in dnsbl.ahbl.org]

    0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

    [209.85.128.67 listed in dnsbl.ahbl.org]

    0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

    [209.85.128.67 listed in dnsbl.ahbl.org]

    1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

    [209.85.128.67 listed in will-spam-for-food.eu.org]

    [209.85.128.67 listed in will-spam-for-food.eu.org]

    [209.85.128.67 listed in will-spam-for-food.eu.org]

    [209.85.128.67 listed in will-spam-for-food.eu.org]

    [209.85.128.67 listed in will-spam-for-food.eu.org]

    [209.85.128.67 listed in will-spam-for-food.eu.org]

    [209.85.128.67 listed in will-spam-for-food.eu.org]

    [209.85.128.67 listed in will-spam-for-food.eu.org]

    -0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

    trust

    [209.85.128.67 listed in list.dnswl.org]

    -0.0 SPF_PASS SPF: sender matches SPF record

    1.5 GR_DOMAIN_UNDISC1 To contains undisclosed recipient (undisc)

    0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in digit

    [servicegestionlocative148(at)gmail.com]

    -0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

    [209.85.128.67 listed in wl.mailspike.net]

    0.0 HTML_MESSAGE BODY: HTML included in message

    0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

    0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

    2.5 FREEMAIL_FORGED_REPLYTO Freemail in Reply-To, but not From

    Subject: {SPAM?} Rappel de paiement



    Chers locataires,

    Nous espérons que vous allez bien.

    Nous vous écrivons aujourd’hui afin de vous informer d’un changement important concernant le paiement de votre loyer. Dans un souci de simplification, de rapidité et de sécurité, nous vous invitons à effectuer vos paiements par virement Interac, et ce à compter de ce mois-ci.

    Ce nouveau mode de paiement nous permettra :



    de suivre plus facilement les transactions,

    de réduire les délais de traitement,

    et de nous assurer que chaque loyer est bien reçu à temps.



    Informations pour le virement :



    Adresse courriel du destinataire : servicegestionlocative148@gmail.com



    Question de sécurité : Facture

    Réponse : Payer



    Une fois le virement effectué, merci de nous en informer par retour de courriel. Si possible, nous vous invitons à joindre une capture d’écran ou une copie de l’ordre de virement, ce qui facilitera la mise à jour rapide de votre dossier.

    Nous comprenons que ce changement puisse demander un petit temps d’adaptation. Soyez assuré(e) que nous restons disponibles pour vous accompagner tout au long de cette transition.

    N’hésitez pas à nous contacter pour toute question ou assistance concernant votre premier virement.

    Un grand merci pour votre collaboration et votre confiance. Votre confort et votre tranquillité d’esprit demeurent nos priorités.

    Pour toute demande, vous pouvez nous écrire à : servicegestionlocative148@gmail.com



    Bien cordialement,

    French language rental demand phish from Google Gmail

    X-Mozilla-Status: 0001

    X-Mozilla-Status2: 00000000

    Return-path:

    Envelope-to: dave@doctor.nl2k.ab.ca

    Delivery-date: Sun, 12 Apr 2026 08:45:00 -0600

    Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))

    (envelope-from )

    id 1wBw3S-00000000EWG-3kUV

    for dave@doctor.nl2k.ab.ca;

    Sun, 12 Apr 2026 08:44:54 -0600

    Resent-From: The Doctor

    Resent-Date: Sun, 12 Apr 2026 08:44:54 -0600

    Resent-Message-ID:

    Resent-To: Dave Yadallee

    Received: from mail-lf1-f67.google.com ([209.85.167.67]:54298)

    by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

    (Exim 4.98.2 (FreeBSD))

    (envelope-from <33039@ppk.ac.th>)

    id 1wBvke-000000006oy-35o0

    for doctor@nl2k.ab.ca;

    Sun, 12 Apr 2026 08:25:37 -0600

    Received: by mail-lf1-f67.google.com with SMTP id 2adb3069b0e04-5a2c77c62d7so3543150e87.0

    for ; Sun, 12 Apr 2026 07:24:41 -0700 (PDT)

    ARC-Seal: i=1; a=rsa-sha256; t=1776003875; cv=none;

    d=google.com; s=arc-20240605;

    b=S1pOB+MbXpqSCbpu76rDYD7Fv14lRSIzhJ1sL5VLA342s45oMqWtWmVAKwoAJQtyUN

    yFcnZ0dnpfyTSg/rcbfilhfFtiDlF3/Ft23YaEpibpHt5dhMXDYU1FtK26AY8nIik6at

    v1gLz7zhGkBqf4YjHO5dlNpXE2K8Rl68U5eA6OSUR6warKGELmjyQJawmHUT1hNqPoLM

    FaA/KGzNO+/wwfUiq8kSrptuNUdGKiAb/paK4OAjftKS7jRBeE+woZ/Dcwd06a1PokEO

    6x8izP/baZg5ltA7JVnIjwTUcZtiJvvOPxXS10Pk835rY8gluNy2fwDS0qsv9Qdcs/4d

    7fWw==

    ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20240605;

    h=to:subject:message-id:date:from:reply-to:mime-version

    :dkim-signature;

    bh=hSdHXvGvxV7MRvfeVcTqnZOgtXM/agvdU0uDFSkftkQ=;

    fh=ETYg8Qe7AlprisbU+xuke3XsRCYYLswe6JRNKPt1uzo=;

    b=WlUXTmZ9MLV96mSAVEk7hxIdZZSXcyxnrGm385jJVpIMRHeQjIyUixzh2MjKJaaYIU

    IzMBxpEqfRuNR7+lceX9OHDzjs8eOlA+NtxHOxZGFMo/t1xqtSKdONwrMOz8uSS6BKYh

    /6RoX+bNu1xiTRTwXWV+XheGH7niIZA6S8k3YbC11ec+i90ta57pAVKnkkeGLqxVdHWx

    YxKKIevIbyU0/Ti5cszLTJQxsykLGZQyLbose4v/cqhJm1GHdM+1v4oMPiXQLcTzfzqX

    Lo7SZ6NSxuectFxQcEmAko9kAjpQ8p9wPMwLBQu3tFeh/5neyhgcRMGhkXNyGNTki/tA

    xPWw==;

    darn=nl2k.ab.ca

    ARC-Authentication-Results: i=1; mx.google.com; arc=none

    DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

    d=ppk-ac-th.20251104.gappssmtp.com; s=20251104; t=1776003875; x=1776608675; darn=nl2k.ab.ca;

    h=to:subject:message-id:date:from:reply-to:mime-version:from:to:cc

    :subject:date:message-id:reply-to;

    bh=hSdHXvGvxV7MRvfeVcTqnZOgtXM/agvdU0uDFSkftkQ=;

    b=ZMEBjoMCgQUbemO6rF6e4jGFpJkbT9rvgc+wX++6+dY+6imlEnvOqJ5Q0YdKH+J3ML

    cfrw89KjJxkhJJSEIQz2wjdMfYp2r2gPPlq+FNsjnj+7fVWrFm89jxwgDd1JRgUlRP1w

    6cOqlBHVxrbaZ5O4SBkJKImt0vlCcEvqDIPaezqJ6Jw4LEzFmOldHSPRMiIjvkQGVbqK

    4tAm9txKvK5TgOSQAljog5LRmsAgsF5wKCT/esrFQf54GaR7cNEcCODd+kufTMUuILB8

    04+gPH6RRy2tTmLxM49CbfuvoB8VQvQ0OYzMeda+OMSSyTaCmS82q0T9OdPiOIQ9EWbX

    vXBw==

    X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

    d=1e100.net; s=20251104; t=1776003875; x=1776608675;

    h=to:subject:message-id:date:from:reply-to:mime-version:x-gm-gg

    :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to;

    bh=hSdHXvGvxV7MRvfeVcTqnZOgtXM/agvdU0uDFSkftkQ=;

    b=LrtwQ0l1XzjNcgq4/VLKFf8J98d4u0ZZwvD9otIcO+1K+K5a/in2+xr69PfBte7QpE

    utLp7ISXRy7b2TEUQZsfhGGd6pr+U+ahCOhRKDeRDhN9XhoDZb9gWWGC7pJmClGcZQtH

    n8HKkeZrLhiYdb86bl8p13RJYQIVBHVdu1/DIE8E21y50zSulBw76ZQceYVrrWDWXNL3

    G7XjFBtGzhi+x/dOa/iHdZ92LMJpfzDFqcY1JuIl3lqVdxfGaJ1d4gSY8Eb9hIMS/9vQ

    MhRvIdyiguF3WaLcuMh90eVgfpB+vqBOAA1LhjuCRD90DsgUWnTct5KAul531v97H1KI

    XpeQ==

    X-Forwarded-Encrypted: i=1; AFNElJ+hKTf+Ukj9WNuR7T2vd1IcW1LkVI42o233AAcO/k4O4anxg+uUkZQY1X9G2FmXy4oQQHpdrrQ=@nl2k.ab.ca

    X-Gm-Message-State: AOJu0YwIQwlkR/7yNyMuw9QWoiYXck9nWYFf/aw0tdztuSMiXxdDmd9G

    EjUooWYVwir/asAB9JD15Nd1YpQsW6fQZLOSigpGSoQLn4gYgt1ZfzgiD0DlcFIJWkx/XMN3H5D

    uthhxMYz2IWyPZw4wH5iVUqwCOrbXhxr1R52iyhOh5g==

    X-Gm-Gg: AeBDievJ2rjKV9/6n91uholiihp0y0A9S+TOy6vV5LZUdhkrWUEFwZJHRrAIDpaUfwa

    YTpVm7uCqHZfq5HmDNP4ygDdJZzBny5s+DZyeBj0L4L7bGW/YJ6O35Wobz5RTkkfHIgCsuDZEAJ

    Df2A5J7CHGuOcJodMNoymn0uwErekmsqYtFfZACFfvUHyzsrq+fDcfTksn3f0Ai0yFQWekPKP3X

    nYDvDPb0D9QOyj25pvimGTaCUnXjE7hMBjrhK+BFss39s5JL7BCF4xvk00GMSbtRemhzRlZ23Cy

    ZQUKoSK4hCo=

    X-Received: by 2002:a05:6512:39cc:b0:5a2:7bd5:329e with SMTP id

    2adb3069b0e04-5a3efb4e964mr3020645e87.37.1776003874080; Sun, 12 Apr 2026

    07:24:34 -0700 (PDT)

    MIME-Version: 1.0

    Reply-To: servicegestionlocative148@gmail.com

    From: Service Locative <33039@ppk.ac.th>

    Date: Sun, 12 Apr 2026 14:24:37 +0200

    X-Gm-Features: AQROBzDwzRTdXaOLYQd5CEIogsXcKj4qgNKcgpfIh49icVm9WI6ZFirodbCE8LI

    Message-ID:

    Subject: Rappel de paiement

    To: undisclosed-recipients:;

    Content-Type: multipart/alternative; boundary="00000000000008d4c9064f442034"

    Bcc: doctor@nl2k.ab.ca

    X-Spam_score: 8.3

    X-Spam_score_int: 83

    X-Spam_bar: ++++++++

    X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

    has identified this incoming email as possible spam. The original

    message has been attached to this so you can view it or label

    similar future email. If you have any questions, see

    @@CONTACT_ADDRESS@@ for details.



    Content preview: Chers locataires, Nous espérons que vous allez bien. Nous

    vous écrivons aujourd’hui afin de vous informer d’un changement important

    concernant le paiement de votre loyer. Dans un souci de simpli [...]



    Content analysis details: (8.3 points, 5.0 required)



    pts rule name description

    ---- ---------------------- --------------------------------------------------

    -0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

    trust

    [209.85.167.67 listed in list.dnswl.org]

    1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

    [209.85.167.67 listed in dnsbl.ahbl.org]

    [209.85.167.67 listed in dnsbl.ahbl.org]

    [209.85.167.67 listed in dnsbl.ahbl.org]

    [209.85.167.67 listed in dnsbl.ahbl.org]

    0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

    [209.85.167.67 listed in dnsbl.ahbl.org]

    1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

    [209.85.167.67 listed in dnsbl.ahbl.org]

    0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

    [209.85.167.67 listed in dnsbl.ahbl.org]

    0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

    [209.85.167.67 listed in dnsbl.ahbl.org]

    1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

    [209.85.167.67 listed in will-spam-for-food.eu.org]

    [209.85.167.67 listed in will-spam-for-food.eu.org]

    [209.85.167.67 listed in will-spam-for-food.eu.org]

    [209.85.167.67 listed in will-spam-for-food.eu.org]

    [209.85.167.67 listed in will-spam-for-food.eu.org]

    [209.85.167.67 listed in will-spam-for-food.eu.org]

    [209.85.167.67 listed in will-spam-for-food.eu.org]

    [209.85.167.67 listed in will-spam-for-food.eu.org]

    -0.0 SPF_PASS SPF: sender matches SPF record

    1.5 GR_DOMAIN_UNDISC1 To contains undisclosed recipient (undisc)

    0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in digit

    [servicegestionlocative148(at)gmail.com]

    -2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

    safe-sa@returnpath.net

    [Excessive Number of Queries | ]

    0.0 RCVD_IN_VALIDITY_SAFE_BLOCKED RBL: ADMINISTRATOR NOTICE: The query to

    Validity was blocked. See

    https://knowledge.validity.com/hc/en-us/articles/20961730681243

    for more information.

    [209.85.167.67 listed in sa-accredit.habeas.com]

    0.0 RCVD_IN_VALIDITY_RPBL_BLOCKED RBL: ADMINISTRATOR NOTICE: The query to

    Validity was blocked. See

    https://knowledge.validity.com/hc/en-us/articles/20961730681243

    for more information.

    [209.85.167.67 listed in bl.score.senderscore.com]

    1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

    https://senderscore.org/blacklistlookup/

    [209.85.167.67 listed in bl.score.senderscore.com]

    -0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

    [209.85.167.67 listed in wl.mailspike.net]

    0.0 HTML_MESSAGE BODY: HTML included in message

    0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

    0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

    2.5 FREEMAIL_FORGED_REPLYTO Freemail in Reply-To, but not From

    Subject: {SPAM?} Rappel de paiement



    Chers locataires,

    Nous espérons que vous allez bien.

    Nous vous écrivons aujourd’hui afin de vous informer d’un changement important concernant le paiement de votre loyer. Dans un souci de simplification, de rapidité et de sécurité, nous vous invitons à effectuer vos paiements par virement Interac, et ce à compter de ce mois-ci.

    Ce nouveau mode de paiement nous permettra :



    de suivre plus facilement les transactions,

    de réduire les délais de traitement,

    et de nous assurer que chaque loyer est bien reçu à temps.



    Informations pour le virement :



    Adresse courriel du destinataire : servicegestionlocative148@gmail.com



    Question de sécurité : Facture

    Réponse : Payer



    Une fois le virement effectué, merci de nous en informer par retour de courriel. Si possible, nous vous invitons à joindre une capture d’écran ou une copie de l’ordre de virement, ce qui facilitera la mise à jour rapide de votre dossier.

    Nous comprenons que ce changement puisse demander un petit temps d’adaptation. Soyez assuré(e) que nous restons disponibles pour vous accompagner tout au long de cette transition.

    N’hésitez pas à nous contacter pour toute question ou assistance concernant votre premier virement.

    Un grand merci pour votre collaboration et votre confiance. Votre confort et votre tranquillité d’esprit demeurent nos priorités.

    Pour toute demande, vous pouvez nous écrire à : servicegestionlocative148@gmail.com



    Bien cordialement,

    French language rental phish from Google Gmail

    X-Mozilla-Status: 0001

    X-Mozilla-Status2: 00000000

    Return-path: <33039@ppk.ac.th>

    Envelope-to: dave@nk.ca

    Delivery-date: Sun, 12 Apr 2026 08:21:00 -0600

    Received: from mail-lf1-f67.google.com ([209.85.167.67]:52309)

    by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

    (Exim 4.98.2 (FreeBSD))

    (envelope-from <33039@ppk.ac.th>)

    id 1wBvfj-0000000057n-0OeD

    for dave@nk.ca;

    Sun, 12 Apr 2026 08:20:32 -0600

    Received: by mail-lf1-f67.google.com with SMTP id 2adb3069b0e04-59dea72099eso3413721e87.0

    for ; Sun, 12 Apr 2026 07:19:36 -0700 (PDT)

    ARC-Seal: i=1; a=rsa-sha256; t=1776003569; cv=none;

    d=google.com; s=arc-20240605;

    b=jGMxgb/3DNM4Bga2e9ya8f1fdAojc7vB2Mym+NtTDA7pXKCgP3wWqi9cbrNx1c5Dgj

    sAmy6qESzKyB1+GWz7YggkGWvs/ysZyWKNoEJ0yTcOTK584g+k3O1ObO7FO/xNYGQRcp

    omnOTEafCBzfYsFjKcVzqqiS5nvAs08CvZHq5/QTJ1VXbA+L1eKPSIb+UDvG83Z9QMsX

    73VSrr2Qo60iI/QG9bZFxk5d76JRa/jCSBq73/RsVZN+ZckgweOZIE9AzfIeT6cS7z5k

    9EA3ovQWsSsjq58X7hvLJXDDGmWiMfOeKc4+Kzk3oUIImyqqaTKHlZuU2O0B7lqnhOoP

    PQaw==

    ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20240605;

    h=to:subject:message-id:date:from:reply-to:mime-version

    :dkim-signature;

    bh=cmnecNb47a9TmsOI2vIYpGIqs6BwSQ+B/iuYnrZXZDM=;

    fh=CTyG2AI6b7/Lnd90Wpvf0l7OM+XjUsCR9umBXbd3ves=;

    b=Y0CXyrTTHfdNLSFMSbevS0rN6uYlmmOaYcsBu9ZWdduxBh6ihT3Nak6dq+wU11HxK3

    t21SJdf4d3dyHfnKKKoGi2oYaiYrjo1E/DhNebp8cr0pWkD4U8CERvr8a30w2UmLVO3k

    icd7omH5Lxqtuv47A9y6ongSN9iJ5iZQ6R9mgqpC4gEEPO08icUvSy8zKHD4b79hvzqg

    PIaYZbVar8z8o+qS124BLCQMopaLeIVr2YyUXCVA5JzkUq3d6b2F1/MK2alGkUOHJec4

    3/QojF6qVk5dQ1UVcn6/EEU9XaIPdllKlw/Ivcj/BfJzKDs6nLlpmOI2IfzPLdgjqRnd

    VWOA==;

    darn=nk.ca

    ARC-Authentication-Results: i=1; mx.google.com; arc=none

    DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

    d=ppk-ac-th.20251104.gappssmtp.com; s=20251104; t=1776003569; x=1776608369; darn=nk.ca;

    h=to:subject:message-id:date:from:reply-to:mime-version:from:to:cc

    :subject:date:message-id:reply-to;

    bh=cmnecNb47a9TmsOI2vIYpGIqs6BwSQ+B/iuYnrZXZDM=;

    b=DESjOw234l2rEw8xGqgaPEWerX2/qHB3bQFpzx0LtFe8HI516tLDugIWtwHyS2fAI2

    hvXsgv4nk6tVGm2ij++aFb3Xgre1AbPHnhRj6dbnVcbWmz6et6FpDfipFXq8WtEkt7Un

    EQITFTVRiWRAC7O7Qn57a64obEMp4CWCUTHDVij3dVArfhIxWtsJhys10dKIByLScYAz

    H0v6912ujd/qatqGB0LXgncSOYC8KyQivlemuHBQCtftPU9QFI5qHj3CUUWz0r11Enjb

    Zg5WhPzQnkYROys1mQ/0DWZTBY6q2SkYAb7ZBItpudV6teNT3y6gMRMmu67JQan+mpFm

    0kJA==

    X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

    d=1e100.net; s=20251104; t=1776003569; x=1776608369;

    h=to:subject:message-id:date:from:reply-to:mime-version:x-gm-gg

    :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to;

    bh=cmnecNb47a9TmsOI2vIYpGIqs6BwSQ+B/iuYnrZXZDM=;

    b=E8sTkyPFLserR3YHWCsFEeGCCOAJsdBenb5BVcMryVnMQOM2Js31oJLGlrBeA9KULe

    N6KZpu+3d+kbrWfZvmXXpEAeMHIrYYaiD9fxLt7d7/zL0ytP5AD/0E75hgCdZEtmgXtl

    S6dpJWrULtGV5v8anIOk19E1oYleoAXcbobv6GkVa4QCj6i2TOKZzEXWTNKwAh9uuQ4t

    NTgG/06/4EG5DLs4Va0f9Ne9EcJbe4SIKRb+rkDjmpizGXZC08S2BFCR4xKWa1D5TnY1

    okogLEj9jlI4oqQFFRzcGQ1rlG1Vghn7w4xChoGJHxpC4DX8n1ixGIqbrKnfwtQMhdAO

    fLYQ==

    X-Forwarded-Encrypted: i=1; AFNElJ+FzS/KilSjhmH41HgrLfk2Vr2IWL4BKGf18lYmbBoMZVyMfKTAlczKLbxfsIX/z0T5da3S@nk.ca

    X-Gm-Message-State: AOJu0YwOqgp1e02TcWEfsaq9Qz/XXzV/TqW67RL3D/r59nv2L3NOtMy+

    cmVBxiyZyx8WLIl60KyMOOblishXD1Xg5dhMaJ/zZUqApwEJg9vTgyBUjP+iYipPo0eNQ75Jh0W

    nYGYLtRWjs+hrzNFulTTCN/pN5O1myPdG3xHHJfWUVw==

    X-Gm-Gg: AeBDievd0jdauOFVZzeLU/AWBcLpkgidK28kl2paBWD/KEECUkMv8p2TdrJEKBAqT+l

    aOHMYTffChKguF7C9wOnD7WN363n2Jev+DOTnXW20z2hYRguBaxvGt7cowKFmAOihwImTdbDM0C

    YZJDMiMOSd15JopMnX5dGpGkObqcEBpTih1En3yL+n6Zo2kz3gWVklEwgTOJiL1l8O3RvEHgvTN

    QOkwKC4oF5A/EM3tQhbqnmlUPEYJCs1oc3qs45LZimA4qI8ayz6C/OLGMNa/vlWE2PPs8KwYpZ1

    nb2FtLMfp4iLKrya9b/1eg==

    X-Received: by 2002:a05:6512:3ca6:b0:5a2:a355:aa4e with SMTP id

    2adb3069b0e04-5a3efb4584bmr3176936e87.31.1776003568152; Sun, 12 Apr 2026

    07:19:28 -0700 (PDT)

    MIME-Version: 1.0

    Reply-To: servicegestionlocative148@gmail.com

    From: Service Locative <33039@ppk.ac.th>

    Date: Sun, 12 Apr 2026 14:19:31 +0200

    X-Gm-Features: AQROBzBAn8i0h3SKV7Q9IyL7QkfrlQp3yf-qhh34W9z0sPQb-92o_Gpb1jx3VUE

    Message-ID:

    Subject: Rappel de paiement

    To: undisclosed-recipients:;

    Content-Type: multipart/alternative; boundary="000000000000ccc53f064f440d3c"

    Bcc: dave@nk.ca

    X-Spam_score: 8.3

    X-Spam_score_int: 83

    X-Spam_bar: ++++++++

    X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

    has identified this incoming email as possible spam. The original

    message has been attached to this so you can view it or label

    similar future email. If you have any questions, see

    @@CONTACT_ADDRESS@@ for details.



    Content preview: Chers locataires, Nous espérons que vous allez bien. Nous

    vous écrivons aujourd’hui afin de vous informer d’un changement important

    concernant le paiement de votre loyer. Dans un souci de simpli [...]



    Content analysis details: (8.3 points, 5.0 required)



    pts rule name description

    ---- ---------------------- --------------------------------------------------

    1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

    [209.85.167.67 listed in dnsbl.ahbl.org]

    [209.85.167.67 listed in dnsbl.ahbl.org]

    [209.85.167.67 listed in dnsbl.ahbl.org]

    [209.85.167.67 listed in dnsbl.ahbl.org]

    0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

    [209.85.167.67 listed in dnsbl.ahbl.org]

    0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

    [209.85.167.67 listed in dnsbl.ahbl.org]

    1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

    [209.85.167.67 listed in dnsbl.ahbl.org]

    0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

    [209.85.167.67 listed in dnsbl.ahbl.org]

    1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

    [209.85.167.67 listed in will-spam-for-food.eu.org]

    [209.85.167.67 listed in will-spam-for-food.eu.org]

    [209.85.167.67 listed in will-spam-for-food.eu.org]

    [209.85.167.67 listed in will-spam-for-food.eu.org]

    [209.85.167.67 listed in will-spam-for-food.eu.org]

    [209.85.167.67 listed in will-spam-for-food.eu.org]

    [209.85.167.67 listed in will-spam-for-food.eu.org]

    [209.85.167.67 listed in will-spam-for-food.eu.org]

    0.0 RCVD_IN_VALIDITY_SAFE_BLOCKED RBL: ADMINISTRATOR NOTICE: The query to

    Validity was blocked. See

    https://knowledge.validity.com/hc/en-us/articles/20961730681243

    for more information.

    [209.85.167.67 listed in sa-accredit.habeas.com]

    -2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

    safe-sa@returnpath.net

    [Excessive Number of Queries | ]

    -0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

    trust

    [209.85.167.67 listed in list.dnswl.org]

    -0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

    [209.85.167.67 listed in wl.mailspike.net]

    0.0 RCVD_IN_VALIDITY_RPBL_BLOCKED RBL: ADMINISTRATOR NOTICE: The query to

    Validity was blocked. See

    https://knowledge.validity.com/hc/en-us/articles/20961730681243

    for more information.

    [209.85.167.67 listed in bl.score.senderscore.com]

    1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

    https://senderscore.org/blacklistlookup/

    [209.85.167.67 listed in bl.score.senderscore.com]

    -0.0 SPF_PASS SPF: sender matches SPF record

    1.5 GR_DOMAIN_UNDISC1 To contains undisclosed recipient (undisc)

    0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in digit

    [servicegestionlocative148(at)gmail.com]

    0.0 HTML_MESSAGE BODY: HTML included in message

    0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

    0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

    2.5 FREEMAIL_FORGED_REPLYTO Freemail in Reply-To, but not From

    Subject: {SPAM?} Rappel de paiement



    Chers locataires,

    Nous espérons que vous allez bien.

    Nous vous écrivons aujourd’hui afin de vous informer d’un changement important concernant le paiement de votre loyer. Dans un souci de simplification, de rapidité et de sécurité, nous vous invitons à effectuer vos paiements par virement Interac, et ce à compter de ce mois-ci.

    Ce nouveau mode de paiement nous permettra :



    de suivre plus facilement les transactions,

    de réduire les délais de traitement,

    et de nous assurer que chaque loyer est bien reçu à temps.



    Informations pour le virement :



    Adresse courriel du destinataire : servicegestionlocative148@gmail.com



    Question de sécurité : Facture

    Réponse : Payer



    Une fois le virement effectué, merci de nous en informer par retour de courriel. Si possible, nous vous invitons à joindre une capture d’écran ou une copie de l’ordre de virement, ce qui facilitera la mise à jour rapide de votre dossier.

    Nous comprenons que ce changement puisse demander un petit temps d’adaptation. Soyez assuré(e) que nous restons disponibles pour vous accompagner tout au long de cette transition.

    N’hésitez pas à nous contacter pour toute question ou assistance concernant votre premier virement.

    Un grand merci pour votre collaboration et votre confiance. Votre confort et votre tranquillité d’esprit demeurent nos priorités.

    Pour toute demande, vous pouvez nous écrire à : servicegestionlocative148@gmail.com



    Bien cordialement,

    WEbroot phish from Google Gmail

    X-Mozilla-Status: 0001

    X-Mozilla-Status2: 00000000

    Return-path:

    Envelope-to: dave@doctor.nl2k.ab.ca

    Delivery-date: Tue, 31 Mar 2026 06:43:00 -0600

    Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))

    (envelope-from )

    id 1w7YQq-00000000C36-3C5J

    for dave@doctor.nl2k.ab.ca;

    Tue, 31 Mar 2026 06:42:56 -0600

    Resent-From: The Doctor

    Resent-Date: Tue, 31 Mar 2026 06:42:56 -0600

    Resent-Message-ID:

    Resent-To: Dave Yadallee

    Received: from mail-ua1-f74.google.com ([209.85.222.74]:46157)

    by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

    (Exim 4.98.2 (FreeBSD))

    (envelope-from )

    id 1w7YBU-00000000Hdh-1z2Z

    for doctor@nl2k.ab.ca;

    Tue, 31 Mar 2026 06:27:14 -0600

    Received: by mail-ua1-f74.google.com with SMTP id a1e0cc1a2514c-953adc55a49so4911077241.0

    for ; Tue, 31 Mar 2026 05:26:16 -0700 (PDT)

    DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

    d=google.com; s=20251104; t=1774959970; x=1775564770; darn=nl2k.ab.ca;

    h=to:from:subject:date:message-id:sender:reply-to:mime-version:from

    :to:cc:subject:date:message-id:reply-to;

    bh=dxTZDYh+h/9xRNnyUSuJzxJg3cmMXGGVSd1m5YNSh5Y=;

    b=Fn3VsJrEI8Q2M0mCqKiKyaDh9VhbK0aqhiqKzhRedB8ThbanDzbjVyfaE/xAUQgnoj

    xZcsdeiH8MsSoR/2x+du8LZWAg9p/02U/cgNcUjSm/upINhd+mEHDtwDf6JraoQMsI+d

    jsN7P778FM9mvjb7Fg/yiwJay2aoSs/DJzatdrAoKqbkBhMfn6/+8Z21hp20X9XqCza8

    X+ruC+IibXwDU49TlFXM3nKibEaoTjTHJvADmpUvMowChZfhFrT1/+mucLH2DBJq2k83

    ezrT5lqtYV/6fojiAlPwgYfF378inC24GO89tzCIXptwgWiK71H9A+a0giBoS3V0mu/A

    Rs4w==

    DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

    d=elderring-com.20230601.gappssmtp.com; s=20230601; t=1774959970; x=1775564770; darn=nl2k.ab.ca;

    h=to:from:subject:date:message-id:sender:reply-to:mime-version:from

    :to:cc:subject:date:message-id:reply-to;

    bh=dxTZDYh+h/9xRNnyUSuJzxJg3cmMXGGVSd1m5YNSh5Y=;

    b=g9Q+C6x4faLEvKY9dlnbo/ch2SakscpF04u5rtmR5LhAy4n4X27gobut0F49nvjTf8

    TkXzcDYTaVyBTXrN4bGwUuJSvLSpUQlD//TpyxYQPec7PJyLz07fpfEWcpvGVdw/KxV3

    gKneXEOEQE/84lce9ZKh3U+pQlF5MzWUDZKCWvgjNRRMB7hjj6z//N1S80muCk864u9J

    Hoa/h/SAaEJQ0MD6iztNvveP1yDVXIVwG57/Ve97OnIRsvFmN7gim6jwPdY06oVWoUVR

    aKj5jiiAHVIs4zi3SNVCw3TkAFFlYZ6sl7ORdgXEE9VwYCuvdkPSG4eejZGagZV6gSns

    PIXA==

    X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

    d=1e100.net; s=20251104; t=1774959970; x=1775564770;

    h=to:from:subject:date:message-id:sender:reply-to:mime-version

    :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to;

    bh=dxTZDYh+h/9xRNnyUSuJzxJg3cmMXGGVSd1m5YNSh5Y=;

    b=MbDSoSGl8YmNsg+SkJbctWsFxql5PDJMx1LzbBblB+X7p8G9OZ48V94hk2fjaKq1Te

    DI1v/qMG7uSW40BaJkXsEnKeRhTrJnjf1hMhHfqzsRfE2jkHScZtzAxPn9shNeE2pvAJ

    sUfHY6IkzGocCI/vQ40HuUNuViLvQNPa/C7KnOXDWqaqlGaFSUV/IOwIsr3immz1WHoF

    iqPtG6vnq7t1ckq4AJ4Ucw51yoxde+c+qjbuxOSlaw8odqrmvqoN+p22/0x74s28f31Q

    zkC3BvGIG/enKPBxdzZN+wtD98vxBCaxvvnpErXX70aSX+kzlDrXzLS219NfzypxywgZ

    WJsQ==

    X-Gm-Message-State: AOJu0YzbbXn35vtPtcWb5UVcjHJ9p53RgNgvcAjVGPh7VfWnRy9ZG4Hf

    6/AGxqLl8nHUXf+AHvM70QHlGH/9OMKZbvlxjmz2o47cWMpy9mk0G0ACMKTP3g2RrwpEGiJlnbx

    ixuCogUQ2kyFgqhUSQdr+L3iLY6Psstv3L4paPXt1BgdvtS9kL3raOuE=

    MIME-Version: 1.0

    X-Received: by 2002:a05:6122:786:b0:56a:fcbf:8aa4 with SMTP id

    71dfb90a1353d-56d4a49e906mr7561649e0c.2.1774959969974; Tue, 31 Mar 2026

    05:26:09 -0700 (PDT)

    Reply-To: Abigael zvheir

    Sender: Google Calendar

    Message-ID:

    Date: Tue, 31 Mar 2026 12:26:09 +0000

    Subject: Invitation: Receipt shows latest records @ Tue Mar 31, 2026 9:26pm

    (EDT) (doctor@nl2k.ab.ca)

    From: Abigael zvheir

    To: doctor@nl2k.ab.ca

    Content-Type: multipart/mixed; boundary="000000000000804b89064e511243"

    X-Spam_score: 8.4

    X-Spam_score_int: 84

    X-Spam_bar: ++++++++

    X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

    has identified this incoming email as possible spam. The original

    message has been attached to this so you can view it or label

    similar future email. If you have any questions, see

    @@CONTACT_ADDRESS@@ for details.



    Content preview: Receipt shows latest records Tuesday Mar 31, 2026 â‹… 9:26pm

    Eastern Time - New York Webroot Billing details reflect update



    Content analysis details: (8.4 points, 5.0 required)



    pts rule name description

    ---- ---------------------- --------------------------------------------------

    1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

    [209.85.222.74 listed in dnsbl.ahbl.org]

    [209.85.222.74 listed in dnsbl.ahbl.org]

    [209.85.222.74 listed in dnsbl.ahbl.org]

    [209.85.222.74 listed in dnsbl.ahbl.org]

    1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

    [209.85.222.74 listed in dnsbl.ahbl.org]

    0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

    [209.85.222.74 listed in dnsbl.ahbl.org]

    0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

    [209.85.222.74 listed in dnsbl.ahbl.org]

    0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

    [209.85.222.74 listed in dnsbl.ahbl.org]

    1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

    [209.85.222.74 listed in will-spam-for-food.eu.org]

    [209.85.222.74 listed in will-spam-for-food.eu.org]

    [209.85.222.74 listed in will-spam-for-food.eu.org]

    [209.85.222.74 listed in will-spam-for-food.eu.org]

    [209.85.222.74 listed in will-spam-for-food.eu.org]

    [209.85.222.74 listed in will-spam-for-food.eu.org]

    [209.85.222.74 listed in will-spam-for-food.eu.org]

    [209.85.222.74 listed in will-spam-for-food.eu.org]

    -0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

    trust

    [209.85.222.74 listed in list.dnswl.org]

    0.3 LONGWORD BODY: Uses overlong words

    0.1 TW_ZV BODY: Odd Letter Triples with ZV

    0.6 MEGALONGWORD BODY: Uses really overlong words

    -0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

    [209.85.222.74 listed in wl.mailspike.net]

    0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

    0.0 HTML_MESSAGE BODY: HTML included in message

    0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

    2.0 RATWR8_MESSID Message-ID with excessive dashes and dollars

    0.6 LONG_INVISIBLE_TEXT Long block of hidden text - bayes poison?

    Subject: {SPAM?} Invitation: Receipt shows latest records @ Tue Mar 31, 2026 9:26pm

    (EDT) (doctor@nl2k.ab.ca)





    Abigael zvheir has invited you to Receipt shows latest records

    Title: Receipt shows latest records

    When: Tuesday, March 31, 2026 at 19:26

    Organizer:

    Abigael zvheir

    Description: Webroot



    Billing details reflect update



    Greetings,

    We’re grateful for your continued use of System Defense Suite and your trust in Webroot.



    Payment Records Hub

    Invoice Id: JJJS-5251-HAO

    Invoice: System Defense Suite

    Support: Four Years

    Amount: $355.63

    Customer ID: EQ9JYA8FKVYM



    Your plan is set to renew automatically on Tuesday, 31 March 2026, ensuring seamless service without any action required from your side.



    For any concerns, please contact our billing team at Helpdesk Service 1(808) 420-9637.

    Do not reply to this no, as it is not monitored. For support, call 1(808) 420-9637.



    Gladly shared,

    Kgbostondesigncom Hanan

    Copyright ©2026 Company, All rights reserved.

    Attendees:



    doctor@nl2k.ab.ca





    Webroot



    Billing details reflect update



    Greetings,

    We’re grateful for your continued use of System Defense Suite and your trust in Webroot.



    Payment Records Hub

    Invoice Id: JJJS-5251-HAO

    Invoice: System Defense Suite

    Support: Four Years

    Amount: $355.63

    Customer ID: EQ9JYA8FKVYM



    Your plan is set to renew automatically on Tuesday, 31 March 2026, ensuring seamless service without any action required from your side.



    For any concerns, please contact our billing team at Helpdesk Service 1(808) 420-9637.

    Do not reply to this no, as it is not monitored. For support, call 1(808) 420-9637.



    Gladly shared,

    Kgbostondesigncom Hanan

    Copyright ©2026 Company, All rights reserved.

    When

    Tuesday Mar 31, 2026 ⋅ 9:26pm (Eastern Time - New York)

    Organizer

    Abigael zvheir

    abigaelzvheir@elderring.com

    Guests

    (Guest list has been hidden at organizer's request)

    Reply for doctor@nl2k.ab.ca

    Yes



    No



    Maybe

    More options



    Invitation from Google Calendar



    You are receiving this email because you are an attendee on the event.



    Forwarding this invitation could allow any recipient to send a response to the organizer, be added to the guest list, invite others regardless of their own invitation status, or modify your RSVP. Learn more

    Fedex phish from Sendgrid

    X-Mozilla-Status: 0001

    X-Mozilla-Status2: 00000000

    Return-path:

    Envelope-to: dave@doctor.nl2k.ab.ca

    Delivery-date: Mon, 16 Mar 2026 09:41:00 -0600

    Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))

    (envelope-from )

    id 1w2A3I-000000008lg-1BAJ

    for dave@doctor.nl2k.ab.ca;

    Mon, 16 Mar 2026 09:40:20 -0600

    Resent-From: The Doctor

    Resent-Date: Mon, 16 Mar 2026 09:40:20 -0600

    Resent-Message-ID:

    Resent-To: Dave Yadallee

    Received: from v5247.v595b88b3.use4.send.mailgun.net ([143.55.235.247]:34426)

    by doctor.nl2k.ab.ca with utf8esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256

    (Exim 4.98.2 (FreeBSD))

    (envelope-from )

    id 1w29Ih-00000000Ogt-1Ezc

    for root@nk.ca;

    Mon, 16 Mar 2026 08:52:18 -0600

    DKIM-Signature: a=rsa-sha256; v=1; c=relaxed/relaxed; d=mx5.gtcmail.com; q=dns/txt; s=k1; t=1773672671; x=1773679871;

    h=Content-Type: Content-Transfer-Encoding: Message-Id: To: To: From: From: Subject: Subject: Mime-Version: Date: Sender: Sender;

    bh=pmGtVQzsGvf9Dx20tmYi3DMuAyV0tbrXoAdfVfVcJds=;

    b=Q30KmXx+fux3I0TfFYpVBnhe3icURKmQp8it+ypvpd9sdyCp35Rrq+tblWi+qH3/iFggX8DwLi4yzeDy5ESIY4EBRkBc5TBj5nUVYkkey2KzJvvxwEv2Q7H1CxgygqgIw4IX65J8qWVXz6qZMQnSJPdEXgyfyE1rFDLAjvxKmaRyxnGmXevm9ATickwcz4wJ53tuMaY6OxflbiktAFxM07Uw5yuTZnGHCgsXBC3OV1/uxFqG0iWrFzwDKj1pNBKdyoS6AMNZK+5u8G8vj23olch4TxyW/wnCVU+ScEnLlmi4ZR0AGXDAIs/rmsvE+DExAuUQ1N4ftM9H4+BmQ/z18Q==

    X-Mailgun-Sid: WyI5OGM5YyIsInJvb3RAbmsuY2EiLCJmN2VjZWYiXQ==

    Received: by e24cabe3c26a51a8054f0801f3daffd5a3648fd1532c2682dba9fbef277c06aa with HTTP

    id 69b818dfcc25e8f3d60479d7; Mon, 16 Mar 2026 14:51:11 GMT

    X-Mailgun-Sending-Ip: 143.55.235.247

    Sender: info=fedex.com@mx5.gtcmail.com

    Date: Mon, 16 Mar 2026 14:51:11 +0000

    Mime-Version: 1.0

    Subject: Your package awaits your instructions

    From: =?utf-8?b?RmVkRXggU3VwcG9ydCDCrg==?=

    To: root@nk.ca

    Message-Id: <20260316145111.edd0db4615a489d9@mx5.gtcmail.com>

    Content-Transfer-Encoding: 7bit

    Content-Type: text/html; charset=ascii

    X-Spam_score: 9.4

    X-Spam_score_int: 94

    X-Spam_bar: +++++++++

    X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

    has identified this incoming email as possible spam. The original

    message has been attached to this so you can view it or label

    similar future email. If you have any questions, see

    @@CONTACT_ADDRESS@@ for details.



    Content preview: FedEx - Your package awaits your instructions FedEx Your

    package awaits your instructions



    Content analysis details: (9.4 points, 5.0 required)



    pts rule name description

    ---- ---------------------- --------------------------------------------------

    1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

    [143.55.235.247 listed in will-spam-for-food.eu.org]

    [143.55.235.247 listed in will-spam-for-food.eu.org]

    [143.55.235.247 listed in will-spam-for-food.eu.org]

    [143.55.235.247 listed in will-spam-for-food.eu.org]

    [143.55.235.247 listed in will-spam-for-food.eu.org]

    [143.55.235.247 listed in will-spam-for-food.eu.org]

    [143.55.235.247 listed in will-spam-for-food.eu.org]

    [143.55.235.247 listed in will-spam-for-food.eu.org]

    1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

    [143.55.235.247 listed in dnsbl.ahbl.org]

    [143.55.235.247 listed in dnsbl.ahbl.org]

    [143.55.235.247 listed in dnsbl.ahbl.org]

    [143.55.235.247 listed in dnsbl.ahbl.org]

    1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

    [143.55.235.247 listed in dnsbl.ahbl.org]

    0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

    [143.55.235.247 listed in dnsbl.ahbl.org]

    0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

    [143.55.235.247 listed in dnsbl.ahbl.org]

    0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

    [143.55.235.247 listed in dnsbl.ahbl.org]

    2.5 URIBL_DBL_PHISH Contains a Phishing URL listed in the DBL blocklist

    [URI: gtcmail.com]

    [URI: psee.io]

    0.0 URIBL_DBL_ABUSE_REDIR Contains an abused redirector URL listed in the

    DBL blocklist

    [URI: psee.io]

    -0.0 SPF_PASS SPF: sender matches SPF record

    0.0 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level mail

    domains are different

    1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

    0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

    0.0 HTML_MESSAGE BODY: HTML included in message

    0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

    0.8 SARE_FROM_SPAM_WORD3 I don't know people named this!

    Subject: {SPAM?} Your package awaits your instructions











    FedEx - Your package awaits your instructions











    Your package awaits your instructions





    Hello





    Your package has arrived at our facility and is ready for the final stage of delivery. To initiate the shipping process, we ask you to complete the pending payment within the next 24 hours.





    You can proceed by clicking the button below:







    Complete payment now





    If you have any questions or concerns, don't hesitate to contact us: we're here to help!





    Thank you for your attention.





    Best regards,


    FedEx











    German Language Cloud Credential Phish from Google Gmail Part 2






    border-radius:22px;overflow:hidden;box-shadow:0 4px 14px rgba(0,0,0,0.04);"=

    >






    cellspacing=3D"0" border=3D"0">








    olid #f1d1d1;padding:14px 24px;text-align:center;font-family:-apple-system,=

    BlinkMacSystemFont,'SF Pro Text','Segoe UI',Arial,sans-serif;font-size:14px=

    ;line-height:20px;font-weight:600;color:#c9342f;">

    Payment failed =E2=80=93 Please update your payment method. =








    cellspacing=3D"0" border=3D"0">






















































































    e-system,BlinkMacSystemFont,'SF Pro Text','Segoe UI',Arial,sans-serif;font-=

    size:13px;line-height:18px;color:#6e6e73;font-weight:600;">

    iCIoud Storage


    system,BlinkMacSystemFont,'SF Pro Display','Segoe UI',Arial,sans-serif;font=

    -size:32px;line-height:38px;font-weight:600;color:#1d1d1f;letter-spacing:-0=

    .5px;">

    Your account has been deactivated

    system,BlinkMacSystemFont,'SF Pro Text','Segoe UI',Arial,sans-serif;font-si=

    ze:16px;line-height:26px;color:#424245;">

    Payment method update required =E2=9A=A0=EF=B8=8F Your photos and videos wi=

    ll be deleted.




    =3D"0" cellspacing=3D"0" border=3D"0" style=3D"background-color:#f5f5f7;bor=

    der:1px solid #ebebed;border-radius:16px;">














    y:-apple-system,BlinkMacSystemFont,'SF Pro Display','Segoe UI',Arial,sans-s=

    erif;font-size:18px;line-height:24px;font-weight:600;color:#1d1d1f;">

    Subscription details



    adding=3D"0" cellspacing=3D"0" border=3D"0" style=3D"font-family:-apple-sys=

    tem,BlinkMacSystemFont,'SF Pro Text','Segoe UI',Arial,sans-serif;font-size:=

    15px;color:#1d1d1f;">


































    solid #e5e5e7;color:#6e6e73;width:42%;">Tarif

    solid #e5e5e7;font-weight:500;">Storage

    solid #e5e5e7;color:#6e6e73;">Email address

    solid #e5e5e7;font-weight:500;">doctor@nl2k.ab.ca

    solid #e5e5e7;color:#6e6e73;">Product

    ;">iCloud Storage
    R=

    enewal date

    >13.03.2026





    system,BlinkMacSystemFont,'SF Pro Display','Segoe UI',Arial,sans-serif;font=

    -size:21px;line-height:28px;font-weight:600;color:#1d1d1f;">

    Action required

    system,BlinkMacSystemFont,'SF Pro Text','Segoe UI',Arial,sans-serif;font-si=

    ze:15px;line-height:25px;color:#424245;">

    Verification required

    Please update your payment method




    ing=3D"0" border=3D"0">








    :980px;">


    KNAs8MXyWR29i9vkCRRS3r9QKdw&e=3Ddoctor@nl2k.ab.ca"

    style=3D"display:inline-block;padding:14px 30p=

    x;font-family:-apple-system,BlinkMacSystemFont,'SF Pro Text','Segoe UI',Ari=

    al,sans-serif;font-size:15px;line-height:20px;font-weight:600;color:#ffffff=

    ;text-decoration:none;border-radius:980px;">

    Update payment method







    background-color:#ececee;"> 



    r;font-family:-apple-system,BlinkMacSystemFont,'SF Pro Text','Segoe UI',Ari=

    al,sans-serif;font-size:13px;line-height:21px;color:#6e6e73;">

    This notification was generated automatically and concerns your iCloud stor=

    age plan.













    ily:-apple-system,BlinkMacSystemFont,'SF Pro Text','Segoe UI',Arial,sans-se=

    rif;font-size:12px;line-height:18px;color:#8e8e93;">

    Apple Services =C2=B7 iCIoud =C2=B7 Support


















    text-align:center;margin-top:10px">Unsub
    =3D9gRaLB643DNoaKNAs8MXyWR29i9vkCRRS3r9QKdw&e=3Ddoctor@nl2k.ab.ca">here
    =

    to remove yourself from our emails list


    --000000000000b64de5064cd9c884--

    German Language Cloud Credential Phish from Google Gmail Part 2








    system,BlinkMacSystemFont,'SF Pro Display','Segoe UI',Arial,sans-serif;font=

    -size:32px;line-height:38px;font-weight:600;color:#1d1d1f;letter-spacing:-0=

    .5px;">

    Your account has been deactivated








    system,BlinkMacSystemFont,'SF Pro Text','Segoe UI',Arial,sans-serif;font-si=

    ze:16px;line-height:26px;color:#424245;">

    Payment method update required =E2=9A=A0=EF=B8=8F Your photos and videos wi=

    ll be deleted.














    =3D"0" cellspacing=3D"0" border=3D"0" style=3D"background-color:#f5f5f7;bor=

    der:1px solid #ebebed;border-radius:16px;">














    y:-apple-system,BlinkMacSystemFont,'SF Pro Display','Segoe UI',Arial,sans-s=

    erif;font-size:18px;line-height:24px;font-weight:600;color:#1d1d1f;">

    Subscription details



    adding=3D"0" cellspacing=3D"0" border=3D"0" style=3D"font-family:-apple-sys=

    tem,BlinkMacSystemFont,'SF Pro Text','Segoe UI',Arial,sans-serif;font-size:=

    15px;color:#1d1d1f;">


































    solid #e5e5e7;color:#6e6e73;width:42%;">Tarif

    solid #e5e5e7;font-weight:500;">Storage

    solid #e5e5e7;color:#6e6e73;">Email address

    solid #e5e5e7;font-weight:500;">doctor@nk.ca

    solid #e5e5e7;color:#6e6e73;">Product

    ;">iCloud Storage
    R=

    enewal date

    >13.03.2026















    system,BlinkMacSystemFont,'SF Pro Display','Segoe UI',Arial,sans-serif;font=

    -size:21px;line-height:28px;font-weight:600;color:#1d1d1f;">

    Action required










    system,BlinkMacSystemFont,'SF Pro Text','Segoe UI',Arial,sans-serif;font-si=

    ze:15px;line-height:25px;color:#424245;">

    Verification required

    Please update your payment method














    ing=3D"0" border=3D"0">








    :980px;">


    8YBk3fd21TcChGpTjexQ9vsHkqL&e=3Ddoctor@nk.ca"

    style=3D"display:inline-block;padding:14px 30p=

    x;font-family:-apple-system,BlinkMacSystemFont,'SF Pro Text','Segoe UI',Ari=

    al,sans-serif;font-size:15px;line-height:20px;font-weight:600;color:#ffffff=

    ;text-decoration:none;border-radius:980px;">

    Update payment method

















    background-color:#ececee;"> 













    r;font-family:-apple-system,BlinkMacSystemFont,'SF Pro Text','Segoe UI',Ari=

    al,sans-serif;font-size:13px;line-height:21px;color:#6e6e73;">

    This notification was generated automatically and concerns your iCloud stor=

    age plan.


















    ily:-apple-system,BlinkMacSystemFont,'SF Pro Text','Segoe UI',Arial,sans-se=

    rif;font-size:12px;line-height:18px;color:#8e8e93;">

    Apple Services =C2=B7 iCIoud =C2=B7 Support


















    text-align:center;margin-top:10px">Unsub
    =3D9Xn4aiFCsmqaF8YBk3fd21TcChGpTjexQ9vsHkqL&e=3Ddoctor@nk.ca">here
    to r=

    emove yourself from our emails list


    --0000000000001eccd6064cd9048e--

    German Language Cloud Credential Phish from Google Gmail Part 2






    border-radius:22px;overflow:hidden;box-shadow:0 4px 14px rgba(0,0,0,0.04);"=

    >






    cellspacing=3D"0" border=3D"0">








    olid #f1d1d1;padding:14px 24px;text-align:center;font-family:-apple-system,=

    BlinkMacSystemFont,'SF Pro Text','Segoe UI',Arial,sans-serif;font-size:14px=

    ;line-height:20px;font-weight:600;color:#c9342f;">

    Payment failed =E2=80=93 Please update your payment method. =








    cellspacing=3D"0" border=3D"0">






















































































    e-system,BlinkMacSystemFont,'SF Pro Text','Segoe UI',Arial,sans-serif;font-=

    size:13px;line-height:18px;color:#6e6e73;font-weight:600;">

    iCIoud Storage


    system,BlinkMacSystemFont,'SF Pro Display','Segoe UI',Arial,sans-serif;font=

    -size:32px;line-height:38px;font-weight:600;color:#1d1d1f;letter-spacing:-0=

    .5px;">

    Your account has been deactivated

    system,BlinkMacSystemFont,'SF Pro Text','Segoe UI',Arial,sans-serif;font-si=

    ze:16px;line-height:26px;color:#424245;">

    Payment method update required =E2=9A=A0=EF=B8=8F Your photos and videos wi=

    ll be deleted.




    =3D"0" cellspacing=3D"0" border=3D"0" style=3D"background-color:#f5f5f7;bor=

    der:1px solid #ebebed;border-radius:16px;">














    y:-apple-system,BlinkMacSystemFont,'SF Pro Display','Segoe UI',Arial,sans-s=

    erif;font-size:18px;line-height:24px;font-weight:600;color:#1d1d1f;">

    Subscription details



    adding=3D"0" cellspacing=3D"0" border=3D"0" style=3D"font-family:-apple-sys=

    tem,BlinkMacSystemFont,'SF Pro Text','Segoe UI',Arial,sans-serif;font-size:=

    15px;color:#1d1d1f;">


































    solid #e5e5e7;color:#6e6e73;width:42%;">Tarif

    solid #e5e5e7;font-weight:500;">Storage

    solid #e5e5e7;color:#6e6e73;">Email address

    solid #e5e5e7;font-weight:500;">doctor@edmontonab.ca

    solid #e5e5e7;color:#6e6e73;">Product

    ;">iCloud Storage
    R=

    enewal date

    >13.03.2026





    system,BlinkMacSystemFont,'SF Pro Display','Segoe UI',Arial,sans-serif;font=

    -size:21px;line-height:28px;font-weight:600;color:#1d1d1f;">

    Action required

    system,BlinkMacSystemFont,'SF Pro Text','Segoe UI',Arial,sans-serif;font-si=

    ze:15px;line-height:25px;color:#424245;">

    Verification required

    Please update your payment method




    ing=3D"0" border=3D"0">








    :980px;">


    HHjEb8FnWE9d9Asehh8yaMgb6CJ&e=3Ddoctor@edmontonab.ca"

    style=3D"display:inline-block;padding:14px 30p=

    x;font-family:-apple-system,BlinkMacSystemFont,'SF Pro Text','Segoe UI',Ari=

    al,sans-serif;font-size:15px;line-height:20px;font-weight:600;color:#ffffff=

    ;text-decoration:none;border-radius:980px;">

    Update payment method







    background-color:#ececee;"> 



    r;font-family:-apple-system,BlinkMacSystemFont,'SF Pro Text','Segoe UI',Ari=

    al,sans-serif;font-size:13px;line-height:21px;color:#6e6e73;">

    This notification was generated automatically and concerns your iCloud stor=

    age plan.













    ily:-apple-system,BlinkMacSystemFont,'SF Pro Text','Segoe UI',Arial,sans-se=

    rif;font-size:12px;line-height:18px;color:#8e8e93;">

    Apple Services =C2=B7 iCIoud =C2=B7 Support


















    text-align:center;margin-top:10px">Unsub
    =3D8HFMMWySSP29QHHjEb8FnWE9d9Asehh8yaMgb6CJ&e=3Ddoctor@edmontonab.ca">here<=

    /a> to remove yourself from our emails list


    --0000000000008df18e064cd8a93d--