German language spam

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Mon, 29 Jun 2026 15:45:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1weJmK-00000000DzG-03Sr

for dave@doctor.nl2k.ab.ca;

Mon, 29 Jun 2026 15:44:32 -0600

Resent-From: The Doctor

Resent-Date: Mon, 29 Jun 2026 15:44:31 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail.senamhi.gob.pe ([190.119.131.37]:58700 helo=senamhi-mail.senamhi.gob.pe)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1weJIV-000000009mA-3lYt

for doctor@doctor.nl2k.ab.ca;

Mon, 29 Jun 2026 15:13:53 -0600

Received: from localhost (localhost [127.0.0.1])

by senamhi-mail.senamhi.gob.pe (Postfix) with ESMTP id 8707838989CF41;

Mon, 29 Jun 2026 15:32:44 -0500 (-05)

Received: from senamhi-mail.senamhi.gob.pe ([127.0.0.1])

by localhost (senamhi-mail.senamhi.gob.pe [127.0.0.1]) (amavis, port 10032)

with ESMTP id NrmHiC0P9BFo; Mon, 29 Jun 2026 15:32:43 -0500 (-05)

Received: from senamhi-mail.senamhi.gob.pe (localhost [127.0.0.1])

by senamhi-mail.senamhi.gob.pe (Postfix) with ESMTPS id DD671389890BB3;

Mon, 29 Jun 2026 15:32:42 -0500 (-05)

DKIM-Filter: OpenDKIM Filter v2.10.3 senamhi-mail.senamhi.gob.pe DD671389890BB3

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=senamhi.gob.pe;

s=92A4C6C2-509C-11F1-B330-7558252557ED; t=1782765163;

bh=M0kxO+YksMF/96KZnbWJTPsLmimEsgGFWMaRIOB+KmI=;

h=Date:From:Message-ID:MIME-Version;

b=JhvMFVly8RsX0nW78LJBNcUDJ/P7Rq/be1j5K0cji8fo3Ti7/kW0n4+3XRLfVTGaH

lrw5QYT1P8Le+xfDn4pNdv0U6htuwRrVVKBDtG9RDlFYFbhA/JrYt22NvZQ1ya3h08

eoZqPybguQ6FZmA2zDz63nskq4KmsRteZZGoBp6Qp/Nef5Gg7OEJMRl/hJOMZYddhS

bK/w1JMgfbnc8L47sz2ZSqwMJb8t0YPN/x4/oaaX2tLQFQQYVtphrayhdV/Ia6HcZb

utJlVzNZNKQ19jInCbbuShD7pMB10ctmBpQ3SAPZ2CaLh4BqCaClMjcH/ASvVIwv8O

QDGi1cvsE/+FQ==

Received: from senamhi-mail.senamhi.gob.pe (mail.senamhi.gob.pe [10.10.20.5])

by senamhi-mail.senamhi.gob.pe (Postfix) with ESMTP id 5E37B3160FB8C8;

Mon, 29 Jun 2026 15:32:37 -0500 (-05)

Date: Mon, 29 Jun 2026 15:32:37 -0500 (PET)

From: c.mori@senamhi.gob.pe

Reply-To: info@stefanquandtfoundation.com

Message-ID: <1436731749.204083.1782765157327.JavaMail.zimbra@senamhi.gob.pe>

Subject: =?utf-8?Q?GL=C3=9CCKWUNSCH?=

MIME-Version: 1.0

Content-Type: multipart/alternative;

boundary="=_fbe075b9-c222-4959-b0a0-1a69291e7c90"

X-Originating-IP: [146.70.36.134]

X-Mailer: Zimbra 8.8.15_GA_4581 (zclient/8.8.15_GA_4581)

Thread-Index: YLHG5XRSQxyJKIf6yy3TH0yx1NdaDA==

Thread-Topic: =?utf-8?Q?GL=C3=9CCKWUNSCH?=

X-Spam_score: 6.3

X-Spam_score_int: 63

X-Spam_bar: ++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Herzlichen Glückwunsch! Wir freuen uns, Ihnen mitteilen

zu können, dass Ihre E-Mail-Adresse für eine Spende in Höhe von 1.200.000,00

USD aus dem Spendenprogramm der Stefan Quandt Foundation ausgewählt wurde.

Für weitere [...]



Content analysis details: (6.3 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[190.119.131.37 listed in dnsbl.ahbl.org]

[190.119.131.37 listed in dnsbl.ahbl.org]

[190.119.131.37 listed in dnsbl.ahbl.org]

[190.119.131.37 listed in dnsbl.ahbl.org]

[146.70.36.134 listed in dnsbl.ahbl.org]

[146.70.36.134 listed in dnsbl.ahbl.org]

[146.70.36.134 listed in dnsbl.ahbl.org]

[146.70.36.134 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[190.119.131.37 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[190.119.131.37 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[190.119.131.37 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[190.119.131.37 listed in dnsbl.ahbl.org]

1.6 RCVD_IN_BRBL_LASTEXT RBL: No description available.

[190.119.131.37 listed in bb.barracudacentral.org]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-0.0 SPF_PASS SPF: sender matches SPF record

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

1.2 MISSING_HEADERS Missing To: header

-0.0 T_RP_MATCHES_RCVD Envelope sender domain matches handover relay

domain

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[190.119.131.37 listed in bl.score.senderscore.com]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[146.70.36.134 listed in will-spam-for-food.eu.org]

[146.70.36.134 listed in will-spam-for-food.eu.org]

[146.70.36.134 listed in will-spam-for-food.eu.org]

[146.70.36.134 listed in will-spam-for-food.eu.org]

[146.70.36.134 listed in will-spam-for-food.eu.org]

[146.70.36.134 listed in will-spam-for-food.eu.org]

[146.70.36.134 listed in will-spam-for-food.eu.org]

[146.70.36.134 listed in will-spam-for-food.eu.org]

[190.119.131.37 listed in will-spam-for-food.eu.org]

[190.119.131.37 listed in will-spam-for-food.eu.org]

[190.119.131.37 listed in will-spam-for-food.eu.org]

[190.119.131.37 listed in will-spam-for-food.eu.org]

[190.119.131.37 listed in will-spam-for-food.eu.org]

[190.119.131.37 listed in will-spam-for-food.eu.org]

[190.119.131.37 listed in will-spam-for-food.eu.org]

[190.119.131.37 listed in will-spam-for-food.eu.org]

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 NO_RDNS2 Sending MTA has no reverse DNS

1.9 REPLYTO_WITHOUT_TO_CC No description available.

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

0.0 LOTS_OF_MONEY Huge... sums of money

Subject: {SPAM?} =?utf-8?Q?GL=C3=9CCKWUNSCH?=



--=_fbe075b9-c222-4959-b0a0-1a69291e7c90

Content-Type: text/plain; charset=utf-8

Content-Transfer-Encoding: quoted-printable









Herzlichen Gl=C3=BCckwunsch!



Wir freuen uns, Ihnen mitteilen zu k=C3=B6nnen, dass Ihre E-Mail-Adresse f=

=C3=BCr eine Spende in H=C3=B6he von 1.200.000,00 USD aus dem Spendenprogra=

mm der Stefan Quandt Foundation ausgew=C3=A4hlt wurde. F=C3=BCr weitere Inf=

ormationen zu dieser Spende und den erforderlichen Schritten zur Bearbeitun=

g und Auszahlung Ihrer Pr=C3=A4mie kontaktieren Sie bitte unsere offizielle=

Spendenabteilung per E-Mail unter info@stefanquandtfoundation.com.

--=_fbe075b9-c222-4959-b0a0-1a69291e7c90

Content-Type: text/html; charset=utf-8

Content-Transfer-Encoding: quoted-printable




<=

div>

Herzlichen Gl=C3=BCckwunsch!


>
Wir freuen uns, Ihnen mitteilen zu k=C3=B6nnen, dass Ihre E-Mail-Adre=

sse f=C3=BCr eine Spende in H=C3=B6he von 1.200.000,00 USD aus dem Spendenp=

rogramm der Stefan Quandt Foundation ausgew=C3=A4hlt wurde. F=C3=BCr weiter=

e Informationen zu dieser Spende und den erforderlichen Schritten zur Bearb=

eitung und Auszahlung Ihrer Pr=C3=A4mie kontaktieren Sie bitte unsere offiz=

ielle Spendenabteilung per E-Mail unter info@stefanquandtfoundation.com.
iv>

--=_fbe075b9-c222-4959-b0a0-1a69291e7c90--

Chinese products spam

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Mon, 29 Jun 2026 15:43:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1weJkq-00000000DkC-0IXD

for dave@doctor.nl2k.ab.ca;

Mon, 29 Jun 2026 15:43:00 -0600

Resent-From: The Doctor

Resent-Date: Mon, 29 Jun 2026 15:42:59 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-m105.netease.com ([154.81.10.5]:20832)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1weEtt-000000001Bm-3wVJ

for sales@nk.ca;

Mon, 29 Jun 2026 10:32:12 -0600

Content-Type: multipart/alternative; BOUNDARY="=_Part_1089161_2100749458.1782750665618"

To: sales

Subject: =?UTF-8?B?UmU6TG9va2luZyBmb3IgTmV3IFNvbGUgRGV2ZWxvcG1lbnQgT3B0aW9ucz8=?=

X-Priority: 3

MIME-Version: 1.0

Received: from serenatam@lebaijk.com( [10.139.5.81] ) by ajax-webmail ( [127.0.0.1] ) ; Tue, 30 Jun 2026 00:31:05 +0800 (GMT+08:00)

From: SerenaTam

Date: Tue, 30 Jun 2026 00:31:05 +0800 (GMT+08:00)

X-WM-Tid: 0a9f14385b0dd0bekusyc73b6dbe15c856

DKIM-Signature: a=rsa-sha256;

b=euXuKvmhi6gpl3SM8t6mt6BwXVF5aZZo64VhSeDf5T4C/fvecvd3fZ5otEETTh04xlv2GqHm830GltAZyYSUiFeisIfodkZPw3QJtE1fD0xqkp7wh7/m7h6F8qDwn3HZFjowm0BmOJiIqzB0fGUYdNVpmSSOwLZQQ5joE0RQxkWuElvTjnCpDjqLmlMgOnu06h+lXRRBj+vLQb7UMuHWc0I5gTXNFqjTLXT+kx5LjIsrXotviVtyIlw7hZhiguZxCwb7IIkJpgYQJZCkTg7H9/rav4n5wgbfVMo43WiwvhMcSh1nTK/sXAMsqfi6sj4CcHS4fhDvsWFIQzDnMxgxKw==; s=default; c=relaxed/relaxed; d=lebaijk.com; v=1;

bh=kSwu5SwwyYGxBOSZhMTxGjWT34h/O65YbH47PvbpehE=;

h=date:mime-version:subject:message-id:from;

Message-ID:





Hi sales,

I hope this email finds you well.

Thank you for subscribing to our newsletter. We're thrilled to have you on board!

I am excited to inform you that we are currently offering a special promotion on our products.If you have any needs, please let me know as soon as possible so I can secure a discounted spot for you.

Thank you for your attention, and I look forward to hearing from you soon.

Best regards,







Secure your updates and feature insights at . Continue Product News



Wish to step back? Quickly hit Control Contact Settings.





SerenaTam

serenatam@lebaijk.com









在2026-06-24,SerenaTam 写道:



-----原始邮件-----

发件人: SerenaTam

发件时间: 2026年06月24日 周三

收件人: [sales ]

主题: Looking for New Sole Development Options?





Enable regular insights and our product’s newest features by hittinging . Continue Updates



If you’d rather not get more emails, just hit Adjust Settings at any time.

Hi Sales,



Besides standard outsole designs, we support custom mold development and OEM production for footwear projects.



If you're developing new styles, we'd be happy to share some samples.





Best regards,

SerenaTam

serenatam@lebaijk.com





在2026-06-22,SerenaTam 写道:



-----原始邮件-----

发件人: SerenaTam

发件时间: 2026年06月22日 周一

收件人: [sales ]

主题: Custom Shoe Sole Solutions for Footwear Brands



Hi Sales,



We specialize in custom shoe soles, including natural rubber and bio-based sole solutions for footwear brands and manufacturers.



Would you be interested in seeing some of our latest sole designs?



Reply interested if you do.





Best regards,



Maintain your product-savvy edge with . Stay Updated on News



If you prefer to exit, choose Review Communication Options.





SerenaTam

serenatam@lebaijk.com







French language rent demand phish from Google Gmail Part 4


-size:11pt;font-family:Calibri,sans-serif;color:rgb(36,36,36)">
=3D"border:0px;font-style:inherit;font-variant-ligatures:inherit;font-varia=

nt-caps:inherit;font-variant-alternates:inherit;font-variant-numeric:inheri=

t;font-variant-east-asian:inherit;font-size:9pt;line-height:13.8px;margin:0=

px;padding:0px;vertical-align:baseline;color:inherit">As

of today, paying your rent by check, pre-authorized or credit card is=20

no longer valid and your rent payment must be made by Interac transfer.
an>


;font-family:Calibri,sans-serif;color:rgb(36,36,36)">
0px;font-style:inherit;font-variant-ligatures:inherit;font-variant-caps:inh=

erit;font-variant-alternates:inherit;font-variant-numeric:inherit;font-vari=

ant-east-asian:inherit;font-size:9pt;line-height:13.8px;margin:0px;padding:=

0px;vertical-align:baseline;color:inherit">At

the same time, we kindly ask you to pay your rent by Interac transfer=20

to our new Interac account whose email address is marked below.

<=

p style=3D"margin:0cm 0cm 10pt;line-height:16.8667px;font-size:11pt;font-fa=

mily:Calibri,sans-serif;color:rgb(36,36,36)">
-style:inherit;font-variant-ligatures:inherit;font-variant-caps:inherit;fon=

t-variant-alternates:inherit;font-variant-numeric:inherit;font-variant-east=

-asian:inherit;font-size:9pt;line-height:13.8px;margin:0px;padding:0px;vert=

ical-align:baseline;color:inherit">Email address for Interac transfer
>
t;font-variant-caps:inherit;font-variant-alternates:inherit;font-variant-nu=

meric:inherit;font-variant-east-asian:inherit;font-size:9pt;line-height:13.=

8px;margin:0px;padding:0px;vertical-align:baseline;color:inherit">:=C2=A0=

=C2=A0
=C2=A0
vicegestionlocative018@gmail.com" target=3D"_blank">servicegestionlocative0=

18@gmail.com


667px;font-size:11pt;font-family:Calibri,sans-serif;color:rgb(36,36,36)">
pan style=3D"border:0px;font-style:inherit;font-variant-ligatures:inherit;f=

ont-variant-caps:inherit;font-variant-alternates:inherit;font-variant-numer=

ic:inherit;font-variant-east-asian:inherit;font-size:9pt;line-height:13.8px=

;margin:0px;padding:0px;vertical-align:baseline;color:inherit">Please use t=

he following question and answer as specified.


:0cm 0cm 10pt;line-height:16.8667px;font-size:11pt;font-family:Calibri,sans=

-serif;color:rgb(36,36,36)">
nt-variant-ligatures:inherit;font-variant-caps:inherit;font-variant-alterna=

tes:inherit;font-variant-numeric:inherit;font-variant-east-asian:inherit;fo=

nt-size:9pt;line-height:13.8px;margin:0px;padding:0px;vertical-align:baseli=

ne;color:inherit">Security question:

tyle:inherit;font-variant-ligatures:inherit;font-variant-caps:inherit;font-=

variant-alternates:inherit;font-variant-numeric:inherit;font-variant-east-a=

sian:inherit;font-size:9pt;line-height:13.8px;margin:0px;padding:0px;vertic=

al-align:baseline;color:inherit">=C2=A0 =C2=A0
=C2=A0
olor:rgb(255,0,0)">PAIEMENT


height:16.8667px;font-size:11pt;font-family:Calibri,sans-serif;color:rgb(36=

,36,36)">
s:inherit;font-variant-caps:inherit;font-variant-alternates:inherit;font-va=

riant-numeric:inherit;font-variant-east-asian:inherit;font-size:9pt;line-he=

ight:13.8px;margin:0px;padding:0px;vertical-align:baseline;color:inherit">S=

ecurity Response:

ariant-ligatures:inherit;font-variant-caps:inherit;font-variant-alternates:=

inherit;font-variant-numeric:inherit;font-variant-east-asian:inherit;font-s=

ize:9pt;line-height:13.8px;margin:0px;padding:0px;vertical-align:baseline;c=

olor:inherit">=C2=A0 =C2=A0
=C2=A0=C2=A0
0,0)">Interac1


7px;font-size:11pt;font-family:Calibri,sans-serif;color:rgb(36,36,36)">
n style=3D"border:0px;font-style:inherit;font-variant-ligatures:inherit;fon=

t-variant-caps:inherit;font-variant-alternates:inherit;font-variant-numeric=

:inherit;font-variant-east-asian:inherit;font-size:9pt;line-height:13.8px;m=

argin:0px;padding:0px;vertical-align:baseline;color:inherit">Please confirm=

by email when the transfer is made.


0pt;line-height:16.8667px;font-size:11pt;font-family:Calibri,sans-serif;col=

or:rgb(36,36,36)">
-ligatures:inherit;font-variant-caps:inherit;font-variant-alternates:inheri=

t;font-variant-numeric:inherit;font-variant-east-asian:inherit;font-size:9p=

t;line-height:13.8px;margin:0px;padding:0px;vertical-align:baseline;color:i=

nherit">We

therefore thank you for proceeding as quickly as possible (within 3=20

days from the date of receipt of this letter) to pay this deadline in=20

order to regularize your situation.


pt;line-height:16.8667px;font-size:11pt;font-family:Calibri,sans-serif;colo=

r:rgb(36,36,36)">
ligatures:inherit;font-variant-caps:inherit;font-variant-alternates:inherit=

;font-variant-numeric:inherit;font-variant-east-asian:inherit;font-size:9pt=

;line-height:13.8px;margin:0px;padding:0px;vertical-align:baseline;color:in=

herit">In this anticipation, we ask you to accept the expression of our dis=

tinguished greetings.


:16.8667px;font-size:11pt;font-family:Calibri,sans-serif;color:rgb(36,36,36=

)">
rit;font-variant-caps:inherit;font-variant-alternates:inherit;font-variant-=

numeric:inherit;font-variant-east-asian:inherit;font-size:9pt;line-height:1=

3.8px;margin:0px;padding:0px;vertical-align:baseline;color:inherit">Please =

feel free to respond directly to this email.


cm 0cm 10pt;line-height:16.8667px;font-size:11pt;font-family:Calibri,sans-s=

erif;color:rgb(36,36,36)">
-variant-ligatures:inherit;font-variant-caps:inherit;font-variant-alternate=

s:inherit;font-variant-numeric:inherit;font-variant-east-asian:inherit;font=

-size:9pt;line-height:13.8px;margin:0px;padding:0px;vertical-align:baseline=

;color:inherit">Accounting Service






































--0000000000003dd01b06556587b4--

French language rent demand phish from Google Gmail Part 3


yle=3D"margin:0cm 0cm 10pt;line-height:16.8667px;font-size:11pt;font-family=

:Calibri,sans-serif;color:rgb(36,36,36)">
le:inherit;font-variant-ligatures:inherit;font-variant-caps:inherit;font-va=

riant-alternates:inherit;font-variant-numeric:inherit;font-variant-east-asi=

an:inherit;font-size:9pt;line-height:13.8px;margin:0px;padding:0px;vertical=

-align:baseline;color:inherit">Par

la m=C3=AAme occasion, nous vous prions de bien vouloir effectuer le=20

paiement de votre loyer par virement Interac vers notre nouveau compte=20

Interac dont l=E2=80=99adresse courriel est marqu=C3=A9e en dessous.
=


nt-family:Calibri,sans-serif;color:rgb(36,36,36)">
;font-style:inherit;font-variant-ligatures:inherit;font-variant-caps:inheri=

t;font-variant-alternates:inherit;font-variant-numeric:inherit;font-variant=

-east-asian:inherit;font-size:9pt;line-height:13.8px;margin:0px;padding:0px=

;vertical-align:baseline;color:inherit">Adresse courriel du virement Intera=

c

:inherit;font-variant-caps:inherit;font-variant-alternates:inherit;font-var=

iant-numeric:inherit;font-variant-east-asian:inherit;font-size:9pt;line-hei=

ght:13.8px;margin:0px;padding:0px;vertical-align:baseline;color:inherit">:=

=C2=A0
=C2=A0
vicegestionlocative018@gmail.com" target=3D"_blank">servicegestionlocative0=

18@gmail.com


667px;font-size:11pt;font-family:Calibri,sans-serif;color:rgb(36,36,36)">
pan style=3D"border:0px;font-style:inherit;font-variant-ligatures:inherit;f=

ont-variant-caps:inherit;font-variant-alternates:inherit;font-variant-numer=

ic:inherit;font-variant-east-asian:inherit;font-size:9pt;line-height:13.8px=

;margin:0px;padding:0px;vertical-align:baseline;color:inherit">Veuillez uti=

liser la question et la r=C3=A9ponse suivantes telles qu'elles ont =C3=

=A9t=C3=A9 sp=C3=A9cifi=C3=A9es.


line-height:16.8667px;font-size:11pt;font-family:Calibri,sans-serif;color:r=

gb(36,36,36)">
atures:inherit;font-variant-caps:inherit;font-variant-alternates:inherit;fo=

nt-variant-numeric:inherit;font-variant-east-asian:inherit;font-size:9pt;li=

ne-height:13.8px;margin:0px;padding:0px;vertical-align:baseline;color:inher=

it">Question de s=C3=A9curit=C3=A9

le:inherit;font-variant-ligatures:inherit;font-variant-caps:inherit;font-va=

riant-alternates:inherit;font-variant-numeric:inherit;font-variant-east-asi=

an:inherit;font-size:9pt;line-height:13.8px;margin:0px;padding:0px;vertical=

-align:baseline;color:inherit">:=C2=A0=C2=A0
=C2=A0
or:rgb(255,0,0)">PAIEMENT


ight:16.8667px;font-size:11pt;font-family:Calibri,sans-serif;color:rgb(36,3=

6,36)">
inherit;font-variant-caps:inherit;font-variant-alternates:inherit;font-vari=

ant-numeric:inherit;font-variant-east-asian:inherit;font-size:9pt;line-heig=

ht:13.8px;margin:0px;padding:0px;vertical-align:baseline;color:inherit">R=

=C3=A9ponse de s=C3=A9curit=C3=A9

e:inherit;font-variant-ligatures:inherit;font-variant-caps:inherit;font-var=

iant-alternates:inherit;font-variant-numeric:inherit;font-variant-east-asia=

n:inherit;font-size:9pt;line-height:13.8px;margin:0px;padding:0px;vertical-=

align:baseline;color:inherit">:=C2=A0=C2=A0
=C2=A0=C2=A0
=3D"color:rgb(255,0,0)">Interac1


line-height:16.8667px;font-size:11pt;font-family:Calibri,sans-serif;color:r=

gb(36,36,36)">
atures:inherit;font-variant-caps:inherit;font-variant-alternates:inherit;fo=

nt-variant-numeric:inherit;font-variant-east-asian:inherit;font-size:9pt;li=

ne-height:13.8px;margin:0px;padding:0px;vertical-align:baseline;color:inher=

it">Merci de nous confirmer par e-mail quand le virement est fait.

p>


-family:Calibri,sans-serif;color:rgb(36,36,36)">
ont-style:inherit;font-variant-ligatures:inherit;font-variant-caps:inherit;=

font-variant-alternates:inherit;font-variant-numeric:inherit;font-variant-e=

ast-asian:inherit;font-size:9pt;line-height:13.8px;margin:0px;padding:0px;v=

ertical-align:baseline;color:inherit">Aussi,

nous vous remercions de proc=C3=A9der au plus vite (sous 3 jours =C3=A0 co=

mpter=20

de la date de r=C3=A9ception de cette lettre) au r=C3=A8glement de cette =

=C3=A9ch=C3=A9ance=20

afin de r=C3=A9gulariser votre situation.


0cm 10pt;line-height:16.8667px;font-size:11pt;font-family:Calibri,sans-seri=

f;color:rgb(36,36,36)">
riant-ligatures:inherit;font-variant-caps:inherit;font-variant-alternates:i=

nherit;font-variant-numeric:inherit;font-variant-east-asian:inherit;font-si=

ze:9pt;line-height:13.8px;margin:0px;padding:0px;vertical-align:baseline;co=

lor:inherit">Dans cette attente, nous vous prions d=E2=80=99agr=C3=A9er, l=

=E2=80=99expression de nos salutations distingu=C3=A9es.


=3D"margin:0cm 0cm 10pt;line-height:16.8667px;font-size:11pt;font-family:Ca=

libri,sans-serif;color:rgb(36,36,36)">
inherit;font-variant-ligatures:inherit;font-variant-caps:inherit;font-varia=

nt-alternates:inherit;font-variant-numeric:inherit;font-variant-east-asian:=

inherit;font-size:9pt;line-height:13.8px;margin:0px;padding:0px;vertical-al=

ign:baseline;color:inherit">N=E2=80=99h=C3=A9sitez pas =C3=A0 r=C3=A9pondre=

directement =C3=A0 ce courriel.


line-height:16.8667px;font-size:11pt;font-family:Calibri,sans-serif;color:r=

gb(36,36,36)">
atures:inherit;font-variant-caps:inherit;font-variant-alternates:inherit;fo=

nt-variant-numeric:inherit;font-variant-east-asian:inherit;font-size:9pt;li=

ne-height:13.8px;margin:0px;padding:0px;vertical-align:baseline;color:inher=

it">Le service comptabilit=C3=A9


line-height:16.8667px;font-size:11pt;font-family:Calibri,sans-serif;color:r=

gb(36,36,36)">
atures:inherit;font-variant-caps:inherit;font-variant-alternates:inherit;fo=

nt-variant-numeric:inherit;font-variant-east-asian:inherit;font-size:9pt;li=

ne-height:13.8px;margin:0px;padding:0px;vertical-align:baseline;color:inher=

it">_______________________________________________________________
<=

/p>


t-family:Calibri,sans-serif;color:rgb(36,36,36)">
font-style:inherit;font-variant-ligatures:inherit;font-variant-caps:inherit=

;font-variant-alternates:inherit;font-variant-numeric:inherit;font-variant-=

east-asian:inherit;font-size:9pt;line-height:13.8px;margin:0px;padding:0px;=

vertical-align:baseline;color:inherit">Dear Tenants,


margin:0cm 0cm 10pt;line-height:16.8667px;font-size:11pt;font-family:Calibr=

i,sans-serif;color:rgb(36,36,36)">
rit;font-variant-ligatures:inherit;font-variant-caps:inherit;font-variant-a=

lternates:inherit;font-variant-numeric:inherit;font-variant-east-asian:inhe=

rit;font-size:9pt;line-height:13.8px;margin:0px;padding:0px;vertical-align:=

baseline;color:inherit">As

of today 29/06/2026, we inform you of the update of our bank details=20

concerning the payment of your rent for the month of JUNE 2026.

<=

p style=3D"margin:0cm 0cm 10pt;line-height:16.8667px;font-size:11pt;font-fa=

mily:Calibri,sans-serif;color:rgb(36,36,36)">
-style:inherit;font-variant-ligatures:inherit;font-variant-caps:inherit;fon=

t-variant-alternates:inherit;font-variant-numeric:inherit;font-variant-east=

-asian:inherit;font-size:9pt;line-height:13.8px;margin:0px;padding:0px;vert=

ical-align:baseline;color:inherit">In

accordance with the signed rental contract, the due date for payment of

your rent is set at the end of each month or the beginning of the=20

month.

French language Rental demand phish from Google Gmail Part 1

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Mon, 29 Jun 2026 15:41:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1weJiq-00000000DNa-3J22

for dave@doctor.nl2k.ab.ca;

Mon, 29 Jun 2026 15:40:56 -0600

Resent-From: The Doctor

Resent-Date: Mon, 29 Jun 2026 15:40:56 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-ed1-f41.google.com ([209.85.208.41]:53435)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1weDGy-00000000AgH-2oRR

for doctor@nl2k.ab.ca;

Mon, 29 Jun 2026 08:47:54 -0600

Received: by mail-ed1-f41.google.com with SMTP id 4fb4d7f45d1cf-69863ecfa9dso2033029a12.2

for ; Mon, 29 Jun 2026 07:46:57 -0700 (PDT)

ARC-Seal: i=1; a=rsa-sha256; t=1782744411; cv=none;

d=google.com; s=arc-20260327;

b=gR8pqnE19S04i7SuqxyF9zOxeRJ/7o7C4nRVb+SCnOLQDoYLHJQheUPgYv04XDtqav

oui+q8bDgTHNBh4K7SoexySMj9MF5WXzRnYqqsyYUvi5OwXMYVHMn87NDxVSFQ62zUY1

3nj2CsDNert+nLajnwu2ZBDDfXvWr8Agv1XBmer/RDB3KN+qorKZikKABDY/59sDdSWq

nFtsnGOsXywvBUR5kUIFJCxd1pqta5BTVU2O0rSM42EJ/kQq6sxv0xn79zxhXEdOtMJ5

1boe8TTnGVC5/oDMKtSNjINRbd20ojGVCXGNizKlPgOAD3klVvsE0wwxBKfxf1maiDUF

Se7w==

ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20260327;

h=to:subject:message-id:date:from:reply-to:mime-version

:dkim-signature;

bh=GYGvENwrUrg5NVOSfiUvhJ2ZBi9K+PVvaqKDKVfbMRQ=;

fh=XYJH9pod8nz9u2musqNgcQzZybXAtB6FYPaJ54RtA6o=;

b=mCPx1wVrIwZ+M/n+V0bbtaUdEComXl3+Wtgy7sU6PDZOalBRIZ2X2u376daqy+hf2+

CCmmIIAG9YQ9ipfDpbr5TWy2oXX3BYEX5Xc7jaVo/bgKiOUuhlJy5Uyiw2KYBp2yPqSD

D6tqTQFj79Y0FakbV8qbI9mebQbBQ3GNUlaZB9xfJxLKjah6u04TjxVfQ+sKMCZ6i4OT

rYwS6oxxNnlPTZMB5OE00cCI4lCfFyjWElcE1naCSNYKxuKx7l4xwdLxpL/lcxjZXmXh

xe7tqrTgLBzHigPB0xu/oP3L1XoTBW7EwJEzNOg9w469KxpbwOnrCn0gTSTFSwdxM1/o

9aBg==;

darn=nl2k.ab.ca

ARC-Authentication-Results: i=1; mx.google.com; arc=none

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=mail-uft-edu-br.20251104.gappssmtp.com; s=20251104; t=1782744411; x=1783349211; darn=nl2k.ab.ca;

h=to:subject:message-id:date:from:reply-to:mime-version:from:to:cc

:subject:date:message-id:reply-to;

bh=GYGvENwrUrg5NVOSfiUvhJ2ZBi9K+PVvaqKDKVfbMRQ=;

b=P3wDjh/1RvWr2n7iD7scXyXVw/tIy9aeYe3S2tyXY3cKpiVrKi4KXSdkEC1ZPbYGZq

y3SBMVU5VS32+iwbAL3CP/bkx0u0wn/HfIJki7lRAbISGVXPXzCxrjc3YIJaPsq44HqD

LdSLEBuqsofZNAif7JpEyX1+MTAcP6PN4VV/NZ0U4srlMA14eBg4tcI2j/dXuWv8BJvu

bwvYFUJ3Xpyzft2yrtR3GWqrokwS+PhCWHHcViKB0V8/Qanl+QYEDnuYvU1EumR/JXvi

0qZiAFir+J5vGAbzs4eIZCYugUeke6+oVFjugGfaXg5bcxe62qGDtAjBH9/k4iv95os+

N+5g==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20251104; t=1782744411; x=1783349211;

h=to:subject:message-id:date:from:reply-to:mime-version:x-gm-gg

:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to;

bh=GYGvENwrUrg5NVOSfiUvhJ2ZBi9K+PVvaqKDKVfbMRQ=;

b=clNwtw742JmxOsY68YdRop6ENDzPnJBquAXguy+zJcNKzkhYIHcIvKJBb8JZV7NtYz

ZMeofUinLiYoK2/Br5eUvX1PNh1J6gzXbOIJsAdRLb2DF/Q4G4b/8bo5b4HD9XG96Jpo

S8IhTuwbSyrutja0Ve+SDYlp4vOr60sD0bKPPsNmHrLyDobO1u5ruF7942rGZFPM4/aW

91iwVdw7ekb4o+3ZNUtS7s3n/gRA+5wtAHwzR2xigxv9RZ2rGzXNBKp+bFbiIPloQgU7

IjONgBgDdt49XJbQKSsd0BY5x0kLj7WgA8KDlpO5EeRF/56WWxqVFUBVT2ELQdjfjEe3

W++Q==

X-Forwarded-Encrypted: i=1; AHgh+Rpy3D5A5zZEZzq1D25z3cLrYuoe3d/V2yNL9ySW3Y+TOyn0LUDliVoiTQ3WjHFCH8349Jb6PyY=@nl2k.ab.ca

X-Gm-Message-State: AOJu0YxUThYJTTdrv495ZBmub6S3ncHUZxx5GcHK5pE61B2daK8yjRk7

wWq/ZeAmhKHjLL4OiYuujl+A6RQWKEc+mhZq5aQ6dACHoWZ5A45sPZas4/IwbeZcdFWhb2dxHCg

AZV3k/P7b69bdOBELGq0TObLgzYfq0J+OZX5Y4Em3PgV8Uzs9qXAXhaZZCflcXyF8HK0q9yvOrd

GdRlhJARwjYdmgZf+tFP56E4QxWbUOo2tflSmXWdJh7/qcH7SQdXFHK7e1exjwOxEvA67ZPaHrz

zg02s6rFSSu0zmi/AV/JvoMZdm+wnxPERst

X-Gm-Gg: AfdE7cnmE3tABTIRX2KnLvgborWqhuoyWXZhnq8fd/chUUw3Xh54c7WdBRF5up6glP3

ZCsGOLBERFeWHckspcvMTYcJGKPa/5x1OW1f279yxyDlGQCaoZqbTm95eASegxTuJBu7PRkX37I

8suv7XX/Vlh1LC08/c6hcuMG+BwvJS8IfHc2ZUjDwbeIqoJd4kZGD0FHCjYbf8hcHrZp8N3hkJL

PkoBTm6jkghPr12CVLOQakBc5wgGRkkh4S0aQSr8/BqulbN/kRDzOo9xnKJ0PjzzlZ4uHz5remT

PBcijzr1L0qx95YGw4pv3PqEcuSuQ08faREJQAYwO5n8N6oUKomP+rAQlH0YIZaJGHCNomi/pBj

jQ4szTRjrtWZ0

X-Received: by 2002:a05:6402:51cb:b0:698:663d:d7bb with SMTP id

4fb4d7f45d1cf-698663ddc7amr1856619a12.25.1782744409289; Mon, 29 Jun 2026

07:46:49 -0700 (PDT)

MIME-Version: 1.0

Reply-To: servicegestionlocative018@gmail.com

From: SERVICE LOCATIVE

Date: Mon, 29 Jun 2026 16:46:36 +0200

X-Gm-Features: AVVi8CfAk9oQrsGcrmBd5gB7g49EKfV_snkmSfkmRAzy9RtffWxd5XQQFiedHjE

Message-ID:

Subject: Chers Locataires,

To: undisclosed-recipients:;

Content-Type: multipart/alternative; boundary="0000000000003dd01b06556587b4"

Bcc: doctor@nl2k.ab.ca

X-CLOUD-SEC-AV-Sent: true

X-CLOUD-SEC-AV-Info: uft,google_mail,monitor

X-Gm-Spam: 0

X-Gm-Phishy: 0

X-Spam_score: 5.3

X-Spam_score_int: 53

X-Spam_bar: +++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: [image: unnamed.png] Chers Locataires, À ce jour 29/06/2026,

nous vous informons de la mise à jour de nos coordonnées bancaires concernant

le paiement de votre loyer pour le mois de juin 2026.



Content analysis details: (5.3 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[209.85.208.41 listed in will-spam-for-food.eu.org]

[209.85.208.41 listed in will-spam-for-food.eu.org]

[209.85.208.41 listed in will-spam-for-food.eu.org]

[209.85.208.41 listed in will-spam-for-food.eu.org]

[209.85.208.41 listed in will-spam-for-food.eu.org]

[209.85.208.41 listed in will-spam-for-food.eu.org]

[209.85.208.41 listed in will-spam-for-food.eu.org]

[209.85.208.41 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[209.85.208.41 listed in dnsbl.ahbl.org]

[209.85.208.41 listed in dnsbl.ahbl.org]

[209.85.208.41 listed in dnsbl.ahbl.org]

[209.85.208.41 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[209.85.208.41 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[209.85.208.41 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[209.85.208.41 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[209.85.208.41 listed in dnsbl.ahbl.org]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[209.85.208.41 listed in list.dnswl.org]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[209.85.208.41 listed in bl.score.senderscore.com]

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[209.85.208.41 listed in wl.mailspike.net]

-0.0 SPF_PASS SPF: sender matches SPF record

1.5 GR_DOMAIN_UNDISC1 To contains undisclosed recipient (undisc)

0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in digit

[servicegestionlocative018(at)gmail.com]

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 HTML_MESSAGE BODY: HTML included in message

2.5 FREEMAIL_FORGED_REPLYTO Freemail in Reply-To, but not From

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

Subject: {SPAM?} Chers Locataires,

French language Rental demand phish from Google Gmail Part 2

--0000000000003dd01b06556587b4

Content-Type: text/plain; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable



[image: unnamed.png]



Chers Locataires,



=C3=80 ce jour 29/06/2026, nous vous informons de la mise =C3=A0 jour de no=

s

coordonn=C3=A9es bancaires concernant le paiement de votre loyer pour le mo=

is de

juin 2026.



Conform=C3=A9ment au contrat de location sign=C3=A9, l=E2=80=99=C3=A9ch=C3=

=A9ance pour le paiement de

votre loyer est fix=C3=A9e chaque fin de mois ou d=C3=A9but de mois.



=C3=80 compter d=E2=80=99aujourd=E2=80=99hui, le paiement de votre loyer pa=

r ch=C3=A8que, par

pr=C3=A9autoris=C3=A9 ou par carte de cr=C3=A9dit ne sont plus valables et =

votre paiement

pour le loyer doit se faire par virement Interac .



Par la m=C3=AAme occasion, nous vous prions de bien vouloir effectuer le

paiement de votre loyer par virement Interac vers notre nouveau compte

Interac dont l=E2=80=99adresse courriel est marqu=C3=A9e en dessous.



Adresse courriel du virement Interac: servicegestionlocative018@gmail.com



Veuillez utiliser la question et la r=C3=A9ponse suivantes telles qu'elles =

ont

=C3=A9t=C3=A9 sp=C3=A9cifi=C3=A9es.



Question de s=C3=A9curit=C3=A9: PAIEMENT



R=C3=A9ponse de s=C3=A9curit=C3=A9: Interac1



Merci de nous confirmer par e-mail quand le virement est fait.



Aussi, nous vous remercions de proc=C3=A9der au plus vite (sous 3 jours =C3=

=A0

compter de la date de r=C3=A9ception de cette lettre) au r=C3=A8glement de =

cette

=C3=A9ch=C3=A9ance afin de r=C3=A9gulariser votre situation.



Dans cette attente, nous vous prions d=E2=80=99agr=C3=A9er, l=E2=80=99expre=

ssion de nos

salutations distingu=C3=A9es.



N=E2=80=99h=C3=A9sitez pas =C3=A0 r=C3=A9pondre directement =C3=A0 ce courr=

iel.



Le service comptabilit=C3=A9



_______________________________________________________________



Dear Tenants,



As of today 29/06/2026, we inform you of the update of our bank details

concerning the payment of your rent for the month of JUNE 2026.



In accordance with the signed rental contract, the due date for payment of

your rent is set at the end of each month or the beginning of the month.



As of today, paying your rent by check, pre-authorized or credit card is no

longer valid and your rent payment must be made by Interac transfer.



At the same time, we kindly ask you to pay your rent by Interac transfer to

our new Interac account whose email address is marked below.



Email address for Interac transfer: servicegestionlocative018@gmail.com



Please use the following question and answer as specified.



Security question: PAIEMENT



Security Response: Interac1



Please confirm by email when the transfer is made.



We therefore thank you for proceeding as quickly as possible (within 3 days

from the date of receipt of this letter) to pay this deadline in order to

regularize your situation.



In this anticipation, we ask you to accept the expression of our

distinguished greetings.



Please feel free to respond directly to this email.



Accounting Service



--0000000000003dd01b06556587b4

Content-Type: text/html; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable




l editable gmail-LW-avf gmail-tS-tW gmail-tS-tY" aria-label=3D"Corps du mes=

sage" role=3D"textbox" aria-multiline=3D"true" style=3D"direction:ltr;min-h=

eight:360px" tabindex=3D"1" aria-controls=3D":1pt" aria-expanded=3D"false">=


iv dir=3D"ltr">

=3D"ltr">

">3D"unnamed.png"
max-width: 100%;">




style:inherit;font-variant-ligatures:inherit;font-variant-caps:inherit;colo=

r:inherit">Chers Locataires,

=3D"Cuerpo del mensaje" id=3D"m_-8700910239268902263m_-5210032204652066017m=

_3778100333867976357m_-6335694584586737790m_5861050040110733594m_7002668753=

225702404m_7920201845045995484m_-5869028843263505643m_-6453791297863320123m=

_3062098251504186206m_-8153741461079944995m_3631911247705242201m_-882497081=

1027184047m_-5895069974758073221m_-2948366017695986914m_-710145306197419600=

4m_-6783548724141477854m_4965375905960778701m_-7663992554718504462m_7777942=

045378914383m_-9059053877740185937m_5446366119487504526m_592132274497113099=

0m_-367930166348440071m_5022754417935243765gmail-x_m_7632929855598720032gma=

il-:11m" style=3D"direction:ltr;min-height:376px">

:georgia,serif">


size:11pt;font-family:Calibri,sans-serif;color:rgb(36,36,36)">
=3D"border:0px;font-style:inherit;font-variant-ligatures:inherit;font-varia=

nt-caps:inherit;font-variant-alternates:inherit;font-variant-numeric:inheri=

t;font-variant-east-asian:inherit;font-size:9pt;line-height:13.8px;margin:0=

px;padding:0px;vertical-align:baseline;color:inherit">=C3=80

ce jour 29/06/2026, nous vous informons de la mise =C3=A0 jour de nos=20

coordonn=C3=A9es bancaires concernant le paiement de votre loyer pour le mo=

is

de juin

gatures:inherit;font-variant-caps:inherit;font-variant-alternates:inherit;f=

ont-variant-numeric:inherit;font-variant-east-asian:inherit;font-size:9pt;l=

ine-height:13.8px;margin:0px;padding:0px;vertical-align:baseline;color:inhe=

rit">=C2=A02026.


667px;font-size:11pt;font-family:Calibri,sans-serif;color:rgb(36,36,36)">
pan style=3D"border:0px;font-style:inherit;font-variant-ligatures:inherit;f=

ont-variant-caps:inherit;font-variant-alternates:inherit;font-variant-numer=

ic:inherit;font-variant-east-asian:inherit;font-size:9pt;line-height:13.8px=

;margin:0px;padding:0px;vertical-align:baseline;color:inherit">Conform=C3=

=A9ment

au contrat de location sign=C3=A9, l=E2=80=99=C3=A9ch=C3=A9ance pour le pa=

iement de votre=20

loyer est fix=C3=A9e chaque fin de mois ou d=C3=A9but de mois.


style=3D"margin:0cm 0cm 10pt;line-height:16.8667px;font-size:11pt;font-fam=

ily:Calibri,sans-serif;color:rgb(36,36,36)">
style:inherit;font-variant-ligatures:inherit;font-variant-caps:inherit;font=

-variant-alternates:inherit;font-variant-numeric:inherit;font-variant-east-=

asian:inherit;font-size:9pt;line-height:13.8px;margin:0px;padding:0px;verti=

cal-align:baseline;color:inherit">=C3=80

compter d=E2=80=99aujourd=E2=80=99hui, le paiement de votre loyer par ch=

=C3=A8que, par=20

pr=C3=A9autoris=C3=A9 ou par carte de cr=C3=A9dit ne sont plus valables et =

votre=20

paiement pour le loyer doit se faire par virement Interac .

Docusign Phish from Amazon Part 2



----_NmP-5d57c1e10feb6c21-Part_1

Content-Type: text/plain; charset=utf-8

Content-Transfer-Encoding: quoted-printable



EFT Payment Authorization Required.



Review Documents https://shared.=

ospreycharterfishing.ca/?t=3Dc2FsZXNAbmsuY2E



Do Not Share This Email



This email contains a secure link to Docusign. Please do not share this =

email, link, or access code with others.



This message was sent by nk.ca =

using DocuSign. If you wish to stop receiving emails, contact the sender.

----_NmP-5d57c1e10feb6c21-Part_1

Content-Type: text/html; charset=utf-8

Content-Transfer-Encoding: quoted-printable












initial-scale=3D1">






Helvetica,sans-serif;">






















style=3D"max-width:640px;">












































22px;background:#ffffff;">


0/email/emailLogo.png" alt=3D"Docusign" width=3D"118" =

style=3D"display:block;border:0;">




border=3D"0" bgcolor=3D"#260559" style=3D"border-radius:16px;">










.98.0/email/iconSign.png" alt=3D"" width=3D"48" height=3D"48" =

style=3D"display:block;border:0;margin:0 auto;">


0;color:#ffffff;">EFT Payment Authorization Required.






t=3Dc2FsZXNAbmsuY2E" style=3D"display:inline-block;background:#735AFF;color=

:#ffffff;font-size:15px;font-weight:700;text-decoration:none;border-radius:=

8px;line-height:44px;padding:0 24px;">Review Documents







13px;color:#130032;line-height:18px;">

Do Not Share This Email



This email contains a secure link to Docusign. Please do not =

share this email, link, or access code with others.




666;text-align:center;background:#f4f4f4;border:1px solid =

#e0e0e0;border-radius:4px;padding:11px 15px;">

This message was sent by nk.ca using DocuSign. If you wish to=

stop receiving emails, contact the sender.













----_NmP-5d57c1e10feb6c21-Part_1--

Docusign Phish from Amazon Part 1

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Mon, 29 Jun 2026 08:48:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1weDGV-00000000AjM-01fj

for dave@doctor.nl2k.ab.ca;

Mon, 29 Jun 2026 08:47:15 -0600

Resent-From: The Doctor

Resent-Date: Mon, 29 Jun 2026 08:47:14 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from a9-156.smtp-out.amazonses.com ([54.240.9.156]:43349)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.99.3 (FreeBSD))

(envelope-from <0100019f13bb0fdc-cdb49eb2-bce9-42cf-8ef1-868caf3baf54-000000@send.mail.actforcanada.org>)

id 1weClP-000000006dw-1QTF

for sales@nk.ca;

Mon, 29 Jun 2026 08:15:14 -0600

DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/simple; s=resend;

d=mail.actforcanada.org; t=1782742454;

h=From:To:Subject:Message-ID:Date:MIME-Version:Content-Type;

bh=bO7dDMwC/pgI3dSoNTvg569ieB75Kx4nOkXhCK/VIag=;

b=skFlG4cF5d+RCjw7e971oCimCaxJ64p9NnRXrenqTOCNESGKw3AuX2w4d6+cDGGR

axvXGgYZ7pgs2uf4SaUgTlr+584HyQINyE8sZJbSadz6a350uHmnQTDGDAJogeY2h+e

W5I4HvC922xlMvmIZfjQE0lMc2raEcmeRbBwuxCk=

DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/simple;

s=224i4yxa5dv7c2xz3womw6peuasteono; d=amazonses.com; t=1782742454;

h=From:To:Subject:Message-ID:Date:MIME-Version:Content-Type:Feedback-ID;

bh=bO7dDMwC/pgI3dSoNTvg569ieB75Kx4nOkXhCK/VIag=;

b=Zo57p+F7CplcWTRlcTHmoKT2RsusuN24RAv/bHBqEOdxWRDorkttNu84mhABqr7W

9z/hxkBvGpIpf0yZAqLRxMGnwq48UCkTr/GcPf8tF/W+YvWBbvit0ZLFaTceRA1Nxpf

NpxUQUJgEC+/BiCOiACBgtwaILIZLkWp7mHfLQXQ=

From: DocuSign

To: sales@nk.ca

Subject: Review Document: EFT Payment Authorization Notice

Message-ID: <0100019f13bb0fdc-cdb49eb2-bce9-42cf-8ef1-868caf3baf54-000000@email.amazonses.com>

Date: Mon, 29 Jun 2026 14:14:14 +0000

MIME-Version: 1.0

Content-Type: multipart/alternative;

boundary="--_NmP-5d57c1e10feb6c21-Part_1"

Feedback-ID: :1.us-east-1.Qbuke0KWFseNm4ZY5BZZcA857c7btUUKWdYGLfiVNfnNo1sjs/fTPiEEYfIL81lYM6M2fq+7rUQynMmcjRJhO6NTEDm15yorO7g/kF0uLWLFC4SvlmBpV70qbwlaFJeXLBwlAXNuUqELHhJxhzT5qSbM+zv1Trp3TaezYEQqdGA=:1.us-east-1.QSNtDRXSTq9sAuvRl56h5mypgasnQ5yDLNpVzTnziu0=:AmazonSES

X-SES-Outgoing: 2026.06.29-54.240.9.156

X-Spam_score: 6.9

X-Spam_score_int: 69

X-Spam_bar: ++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: EFT Payment Authorization Required. Review Documents https://shared.ospreycharterfishing.ca/?t=c2FsZXNAbmsuY2E

Do Not Share This Email



Content analysis details: (6.9 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[54.240.9.156 listed in will-spam-for-food.eu.org]

[54.240.9.156 listed in will-spam-for-food.eu.org]

[54.240.9.156 listed in will-spam-for-food.eu.org]

[54.240.9.156 listed in will-spam-for-food.eu.org]

[54.240.9.156 listed in will-spam-for-food.eu.org]

[54.240.9.156 listed in will-spam-for-food.eu.org]

[54.240.9.156 listed in will-spam-for-food.eu.org]

[54.240.9.156 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[54.240.9.156 listed in dnsbl.ahbl.org]

[54.240.9.156 listed in dnsbl.ahbl.org]

[54.240.9.156 listed in dnsbl.ahbl.org]

[54.240.9.156 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[54.240.9.156 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[54.240.9.156 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[54.240.9.156 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[54.240.9.156 listed in dnsbl.ahbl.org]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-0.0 SPF_PASS SPF: sender matches SPF record

2.0 GR_DOMAIN_AMAZON1 Received contains spam friendly host (amazon)

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[54.240.9.156 listed in list.dnswl.org]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[54.240.9.156 listed in bl.score.senderscore.com]

-0.0 RCVD_IN_MSPIKE_H3 RBL: Good reputation (+3)

[54.240.9.156 listed in wl.mailspike.net]

1.5 MR_STRANGE_QUESTION URI: No description available.

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_IMAGE_ONLY_32 BODY: HTML: images with 2800-3200 bytes of words

2.0 RATWR8_MESSID Message-ID with excessive dashes and dollars

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

0.1 MXG_SPOOFED_DOCUSIGN Docusign spoofing

-0.0 RCVD_IN_MSPIKE_WL Mailspike good senders

Subject: {SPAM?} Review Document: EFT Payment Authorization Notice

Docusign Phish from Amazon Part 2



----_NmP-5d57c1e10feb6c21-Part_1

Content-Type: text/plain; charset=utf-8

Content-Transfer-Encoding: quoted-printable



EFT Payment Authorization Required.



Review Documents https://shared.=

ospreycharterfishing.ca/?t=3Dc2FsZXNAbmsuY2E



Do Not Share This Email



This email contains a secure link to Docusign. Please do not share this =

email, link, or access code with others.



This message was sent by nk.ca =

using DocuSign. If you wish to stop receiving emails, contact the sender.

----_NmP-5d57c1e10feb6c21-Part_1

Content-Type: text/html; charset=utf-8

Content-Transfer-Encoding: quoted-printable












initial-scale=3D1">






Helvetica,sans-serif;">






















style=3D"max-width:640px;">












































22px;background:#ffffff;">


0/email/emailLogo.png" alt=3D"Docusign" width=3D"118" =

style=3D"display:block;border:0;">




border=3D"0" bgcolor=3D"#260559" style=3D"border-radius:16px;">










.98.0/email/iconSign.png" alt=3D"" width=3D"48" height=3D"48" =

style=3D"display:block;border:0;margin:0 auto;">


0;color:#ffffff;">EFT Payment Authorization Required.






t=3Dc2FsZXNAbmsuY2E" style=3D"display:inline-block;background:#735AFF;color=

:#ffffff;font-size:15px;font-weight:700;text-decoration:none;border-radius:=

8px;line-height:44px;padding:0 24px;">Review Documents







13px;color:#130032;line-height:18px;">

Do Not Share This Email



This email contains a secure link to Docusign. Please do not =

share this email, link, or access code with others.




666;text-align:center;background:#f4f4f4;border:1px solid =

#e0e0e0;border-radius:4px;padding:11px 15px;">

This message was sent by nk.ca using DocuSign. If you wish to=

stop receiving emails, contact the sender.













----_NmP-5d57c1e10feb6c21-Part_1--

Docusign Phish from Amazon Part 1

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Mon, 29 Jun 2026 08:48:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1weDGV-00000000AjM-01fj

for dave@doctor.nl2k.ab.ca;

Mon, 29 Jun 2026 08:47:15 -0600

Resent-From: The Doctor

Resent-Date: Mon, 29 Jun 2026 08:47:14 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from a9-156.smtp-out.amazonses.com ([54.240.9.156]:43349)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.99.3 (FreeBSD))

(envelope-from <0100019f13bb0fdc-cdb49eb2-bce9-42cf-8ef1-868caf3baf54-000000@send.mail.actforcanada.org>)

id 1weClP-000000006dw-1QTF

for sales@nk.ca;

Mon, 29 Jun 2026 08:15:14 -0600

DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/simple; s=resend;

d=mail.actforcanada.org; t=1782742454;

h=From:To:Subject:Message-ID:Date:MIME-Version:Content-Type;

bh=bO7dDMwC/pgI3dSoNTvg569ieB75Kx4nOkXhCK/VIag=;

b=skFlG4cF5d+RCjw7e971oCimCaxJ64p9NnRXrenqTOCNESGKw3AuX2w4d6+cDGGR

axvXGgYZ7pgs2uf4SaUgTlr+584HyQINyE8sZJbSadz6a350uHmnQTDGDAJogeY2h+e

W5I4HvC922xlMvmIZfjQE0lMc2raEcmeRbBwuxCk=

DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/simple;

s=224i4yxa5dv7c2xz3womw6peuasteono; d=amazonses.com; t=1782742454;

h=From:To:Subject:Message-ID:Date:MIME-Version:Content-Type:Feedback-ID;

bh=bO7dDMwC/pgI3dSoNTvg569ieB75Kx4nOkXhCK/VIag=;

b=Zo57p+F7CplcWTRlcTHmoKT2RsusuN24RAv/bHBqEOdxWRDorkttNu84mhABqr7W

9z/hxkBvGpIpf0yZAqLRxMGnwq48UCkTr/GcPf8tF/W+YvWBbvit0ZLFaTceRA1Nxpf

NpxUQUJgEC+/BiCOiACBgtwaILIZLkWp7mHfLQXQ=

From: DocuSign

To: sales@nk.ca

Subject: Review Document: EFT Payment Authorization Notice

Message-ID: <0100019f13bb0fdc-cdb49eb2-bce9-42cf-8ef1-868caf3baf54-000000@email.amazonses.com>

Date: Mon, 29 Jun 2026 14:14:14 +0000

MIME-Version: 1.0

Content-Type: multipart/alternative;

boundary="--_NmP-5d57c1e10feb6c21-Part_1"

Feedback-ID: :1.us-east-1.Qbuke0KWFseNm4ZY5BZZcA857c7btUUKWdYGLfiVNfnNo1sjs/fTPiEEYfIL81lYM6M2fq+7rUQynMmcjRJhO6NTEDm15yorO7g/kF0uLWLFC4SvlmBpV70qbwlaFJeXLBwlAXNuUqELHhJxhzT5qSbM+zv1Trp3TaezYEQqdGA=:1.us-east-1.QSNtDRXSTq9sAuvRl56h5mypgasnQ5yDLNpVzTnziu0=:AmazonSES

X-SES-Outgoing: 2026.06.29-54.240.9.156

X-Spam_score: 6.9

X-Spam_score_int: 69

X-Spam_bar: ++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: EFT Payment Authorization Required. Review Documents https://shared.ospreycharterfishing.ca/?t=c2FsZXNAbmsuY2E

Do Not Share This Email



Content analysis details: (6.9 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[54.240.9.156 listed in will-spam-for-food.eu.org]

[54.240.9.156 listed in will-spam-for-food.eu.org]

[54.240.9.156 listed in will-spam-for-food.eu.org]

[54.240.9.156 listed in will-spam-for-food.eu.org]

[54.240.9.156 listed in will-spam-for-food.eu.org]

[54.240.9.156 listed in will-spam-for-food.eu.org]

[54.240.9.156 listed in will-spam-for-food.eu.org]

[54.240.9.156 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[54.240.9.156 listed in dnsbl.ahbl.org]

[54.240.9.156 listed in dnsbl.ahbl.org]

[54.240.9.156 listed in dnsbl.ahbl.org]

[54.240.9.156 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[54.240.9.156 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[54.240.9.156 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[54.240.9.156 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[54.240.9.156 listed in dnsbl.ahbl.org]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-0.0 SPF_PASS SPF: sender matches SPF record

2.0 GR_DOMAIN_AMAZON1 Received contains spam friendly host (amazon)

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[54.240.9.156 listed in list.dnswl.org]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[54.240.9.156 listed in bl.score.senderscore.com]

-0.0 RCVD_IN_MSPIKE_H3 RBL: Good reputation (+3)

[54.240.9.156 listed in wl.mailspike.net]

1.5 MR_STRANGE_QUESTION URI: No description available.

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_IMAGE_ONLY_32 BODY: HTML: images with 2800-3200 bytes of words

2.0 RATWR8_MESSID Message-ID with excessive dashes and dollars

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

0.1 MXG_SPOOFED_DOCUSIGN Docusign spoofing

-0.0 RCVD_IN_MSPIKE_WL Mailspike good senders

Subject: {SPAM?} Review Document: EFT Payment Authorization Notice

Docusign Phish from Amazon Part 2





----_NmP-1f72ff7c4ff28ae9-Part_1

Content-Type: text/plain; charset=utf-8

Content-Transfer-Encoding: quoted-printable



EFT Payment Authorization Required.



Review Documents https://shared.=

ospreycharterfishing.ca/?t=3Dcm9vdEBuay5jYQ



Do Not Share This Email



This email contains a secure link to Docusign. Please do not share this =

email, link, or access code with others.



This message was sent by nk.ca =

using DocuSign. If you wish to stop receiving emails, contact the sender.

----_NmP-1f72ff7c4ff28ae9-Part_1

Content-Type: text/html; charset=utf-8

Content-Transfer-Encoding: quoted-printable












initial-scale=3D1">






Helvetica,sans-serif;">






















style=3D"max-width:640px;">












































22px;background:#ffffff;">


0/email/emailLogo.png" alt=3D"Docusign" width=3D"118" =

style=3D"display:block;border:0;">




border=3D"0" bgcolor=3D"#260559" style=3D"border-radius:16px;">










.98.0/email/iconSign.png" alt=3D"" width=3D"48" height=3D"48" =

style=3D"display:block;border:0;margin:0 auto;">


0;color:#ffffff;">EFT Payment Authorization Required.






t=3Dcm9vdEBuay5jYQ" style=3D"display:inline-block;background:#735AFF;color:=

#ffffff;font-size:15px;font-weight:700;text-decoration:none;border-radius:8=

px;line-height:44px;padding:0 24px;">Review Documents







13px;color:#130032;line-height:18px;">

Do Not Share This Email



This email contains a secure link to Docusign. Please do not =

share this email, link, or access code with others.




666;text-align:center;background:#f4f4f4;border:1px solid =

#e0e0e0;border-radius:4px;padding:11px 15px;">

This message was sent by nk.ca using DocuSign. If you wish to=

stop receiving emails, contact the sender.













----_NmP-1f72ff7c4ff28ae9-Part_1--

Docusign Phish from Amazon Part 1

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Mon, 29 Jun 2026 08:48:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1weDGM-00000000Ail-0tP7

for dave@doctor.nl2k.ab.ca;

Mon, 29 Jun 2026 08:47:06 -0600

Resent-From: The Doctor

Resent-Date: Mon, 29 Jun 2026 08:47:06 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from a14-57.smtp-out.amazonses.com ([54.240.14.57]:59545)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.99.3 (FreeBSD))

(envelope-from <0100019f13ba4a94-b037d1e5-b836-40d7-a4c9-6f2bf62d0bf0-000000@send.updates.abodereader.com>)

id 1weCka-0000000064z-3C5r

for root@nk.ca;

Mon, 29 Jun 2026 08:14:24 -0600

DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/simple; s=resend;

d=updates.abodereader.com; t=1782742403;

h=From:To:Subject:Message-ID:Date:MIME-Version:Content-Type;

bh=VLIdqf7k1ECf3AKHaixB3DeTGviheVApv14SLv1UhTU=;

b=PO5RXIglL9sQ3w0w2KtsUC/r8yDgqHVOF6rH12OZDyJpPO4KrxFFH/OmiULjyczZ

mCi2c2tz2ITBYTirmzKfrqOPEAqqJg2FtQw9RJdUxXPr1wDNVdKnlQj/cJnuxAVaf2v

A15obIMJVzWSK+czxMnuDfmDtOojp4NMu0QBNERg=

DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/simple;

s=224i4yxa5dv7c2xz3womw6peuasteono; d=amazonses.com; t=1782742403;

h=From:To:Subject:Message-ID:Date:MIME-Version:Content-Type:Feedback-ID;

bh=VLIdqf7k1ECf3AKHaixB3DeTGviheVApv14SLv1UhTU=;

b=ViccElIl1YmE/qdtWAevNoOrVn8TLO6qFz3mGjfP8ttyhRrTc5PjgVTWAB+LuqfQ

p3GWqzRanOZ80VEes49QGa+ZZYZ/ZhkRtn9zpGkA0JPJv1iKv6ziysNmdKtXT1I+bK/

7y/BDEEa+i7ZC/QlG5XLZ1QBqES9HIRrKtVagDnM=

From: DocuSign

To: root@nk.ca

Subject: Review Document: EFT Payment Authorization Notice

Message-ID: <0100019f13ba4a94-b037d1e5-b836-40d7-a4c9-6f2bf62d0bf0-000000@email.amazonses.com>

Date: Mon, 29 Jun 2026 14:13:23 +0000

MIME-Version: 1.0

Content-Type: multipart/alternative;

boundary="--_NmP-1f72ff7c4ff28ae9-Part_1"

Feedback-ID: :1.us-east-1.JjpWZXhkc+hAx/1QFiBBGfqtcUWSdRo6a3Sgkmv86ckHPV0LelUjeS8iu0mBcWOyykDqpHVwju04db6Aer9xzulXHbyGOB9gmHuKcfJdI6tp2bYT9osSWvhwtiHAVe9ogrY78eeHjESQ5sOfO7exZvZ/tkujmd9q0G6QVH4QBc0=:1.us-east-1.QSNtDRXSTq9sAuvRl56h5mypgasnQ5yDLNpVzTnziu0=:AmazonSES

X-SES-Outgoing: 2026.06.29-54.240.14.57

X-Spam_score: 6.7

X-Spam_score_int: 67

X-Spam_bar: ++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: EFT Payment Authorization Required. Review Documents https://shared.ospreycharterfishing.ca/?t=cm9vdEBuay5jYQ

Do Not Share This Email



Content analysis details: (6.7 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[54.240.14.57 listed in will-spam-for-food.eu.org]

[54.240.14.57 listed in will-spam-for-food.eu.org]

[54.240.14.57 listed in will-spam-for-food.eu.org]

[54.240.14.57 listed in will-spam-for-food.eu.org]

[54.240.14.57 listed in will-spam-for-food.eu.org]

[54.240.14.57 listed in will-spam-for-food.eu.org]

[54.240.14.57 listed in will-spam-for-food.eu.org]

[54.240.14.57 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[54.240.14.57 listed in dnsbl.ahbl.org]

[54.240.14.57 listed in dnsbl.ahbl.org]

[54.240.14.57 listed in dnsbl.ahbl.org]

[54.240.14.57 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[54.240.14.57 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[54.240.14.57 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[54.240.14.57 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[54.240.14.57 listed in dnsbl.ahbl.org]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[54.240.14.57 listed in list.dnswl.org]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-0.0 SPF_PASS SPF: sender matches SPF record

2.0 GR_DOMAIN_AMAZON1 Received contains spam friendly host (amazon)

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[54.240.14.57 listed in bl.score.senderscore.com]

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[54.240.14.57 listed in wl.mailspike.net]

1.5 MR_STRANGE_QUESTION URI: No description available.

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_IMAGE_ONLY_32 BODY: HTML: images with 2800-3200 bytes of words

2.0 RATWR8_MESSID Message-ID with excessive dashes and dollars

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

0.1 MXG_SPOOFED_DOCUSIGN Docusign spoofing

Subject: {SPAM?} Review Document: EFT Payment Authorization Notice

Docusign Phish from Amazon Part 2





----_NmP-523b8a454a848e68-Part_1

Content-Type: text/plain; charset=utf-8

Content-Transfer-Encoding: quoted-printable



EFT Payment Authorization Required.



Review Documents https://shared.=

ospreycharterfishing.ca/?t=3Dcm9vdEBubDJrLmNh



Do Not Share This Email



This email contains a secure link to Docusign. Please do not share this =

email, link, or access code with others.



This message was sent by nl2k.ca =

using DocuSign. If you wish to stop receiving emails, contact the sender.

----_NmP-523b8a454a848e68-Part_1

Content-Type: text/html; charset=utf-8

Content-Transfer-Encoding: quoted-printable












initial-scale=3D1">






Helvetica,sans-serif;">






















style=3D"max-width:640px;">












































22px;background:#ffffff;">


0/email/emailLogo.png" alt=3D"Docusign" width=3D"118" =

style=3D"display:block;border:0;">




border=3D"0" bgcolor=3D"#260559" style=3D"border-radius:16px;">










.98.0/email/iconSign.png" alt=3D"" width=3D"48" height=3D"48" =

style=3D"display:block;border:0;margin:0 auto;">


0;color:#ffffff;">EFT Payment Authorization Required.






t=3Dcm9vdEBubDJrLmNh" style=3D"display:inline-block;background:#735AFF;colo=

r:#ffffff;font-size:15px;font-weight:700;text-decoration:none;border-radius=

:8px;line-height:44px;padding:0 24px;">Review Documents







13px;color:#130032;line-height:18px;">

Do Not Share This Email



This email contains a secure link to Docusign. Please do not =

share this email, link, or access code with others.




666;text-align:center;background:#f4f4f4;border:1px solid =

#e0e0e0;border-radius:4px;padding:11px 15px;">

This message was sent by nl2k.ca using DocuSign. If you wish =

to stop receiving emails, contact the sender.













----_NmP-523b8a454a848e68-Part_1--

Docusign Phish from Amazon Part 1

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Mon, 29 Jun 2026 08:48:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1weDGI-00000000AiB-12Mg

for dave@doctor.nl2k.ab.ca;

Mon, 29 Jun 2026 08:47:02 -0600

Resent-From: The Doctor

Resent-Date: Mon, 29 Jun 2026 08:47:02 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from a10-10.smtp-out.amazonses.com ([54.240.10.10]:60581)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.99.3 (FreeBSD))

(envelope-from <0100019f13b62e6d-f663af18-0d01-4c8f-8767-35fc98acd54e-000000@send.mail.drafft.site>)

id 1weCgH-00000000KyH-1CFc

for root@nl2k.ca;

Mon, 29 Jun 2026 08:09:57 -0600

DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/simple; s=resend;

d=mail.drafft.site; t=1782742134;

h=From:To:Subject:Message-ID:Date:MIME-Version:Content-Type;

bh=MaZF8tYF7zkaIuSJp/iKaSl7M3o/1mku16leQTyWX58=;

b=6sljJi31jbB6yG1wi8WJ5zmo7e8UaOK8VqNgDe/HcdU0Zqin5ZfQyM/fzjFBISK3

E8VRig4HVqSCqlKpqeU4pdEHsToy3OPC66d5GkZXk7byuWf9klJiONbFTRg6NXVSa9V

qu15HQsPXgc4SpQcCW/AQ/skPxeswGxaw5hUoaFE=

DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/simple;

s=224i4yxa5dv7c2xz3womw6peuasteono; d=amazonses.com; t=1782742134;

h=From:To:Subject:Message-ID:Date:MIME-Version:Content-Type:Feedback-ID;

bh=MaZF8tYF7zkaIuSJp/iKaSl7M3o/1mku16leQTyWX58=;

b=mvIln9oNpLAg0xIbSMiD7NiOycxgb/iiOaORMkvemNYQHETU1rR9ucObcj/sYMVl

2+C6cDOA4YP2/C0wIoFmRcW4iYcCzFojkcdgrtnTsiI8YgUcf1gyYyAfWuIeI4J3x6D

SeOYGRuHwtRssWZoVU7aSED7vrI9ILQPcwkr3ZJI=

From: DocuSign

To: root@nl2k.ca

Subject: Review Document: EFT Payment Authorization Notice

Message-ID: <0100019f13b62e6d-f663af18-0d01-4c8f-8767-35fc98acd54e-000000@email.amazonses.com>

Date: Mon, 29 Jun 2026 14:08:54 +0000

MIME-Version: 1.0

Content-Type: multipart/alternative;

boundary="--_NmP-523b8a454a848e68-Part_1"

Feedback-ID: :1.us-east-1.024kA0Mzc16XjNTEGOXUSs+c/2RKCVLbTaL7GWXm6VYI/mhiu2ZfOLGoE/Olfpn4p1YoSmlzOJJommLzrQfbeV8VtZLAQtYAd9hA4kVhKrKTP8ZGzAvr8AWJNE8wsAOJSsBi+YSpgfgrXCkkG4XFG4Au7nEq17/IL1vgLhn9RLY=:1.us-east-1.epbACCJLarUaEI78XZoGREJ9LamRjxMH5pM2kZb64rA=:AmazonSES

X-SES-Outgoing: 2026.06.29-54.240.10.10

X-Spam_score: 7.4

X-Spam_score_int: 74

X-Spam_bar: +++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: EFT Payment Authorization Required. Review Documents https://shared.ospreycharterfishing.ca/?t=cm9vdEBubDJrLmNh

Do Not Share This Email



Content analysis details: (7.4 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[54.240.10.10 listed in will-spam-for-food.eu.org]

[54.240.10.10 listed in will-spam-for-food.eu.org]

[54.240.10.10 listed in will-spam-for-food.eu.org]

[54.240.10.10 listed in will-spam-for-food.eu.org]

[54.240.10.10 listed in will-spam-for-food.eu.org]

[54.240.10.10 listed in will-spam-for-food.eu.org]

[54.240.10.10 listed in will-spam-for-food.eu.org]

[54.240.10.10 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[54.240.10.10 listed in dnsbl.ahbl.org]

[54.240.10.10 listed in dnsbl.ahbl.org]

[54.240.10.10 listed in dnsbl.ahbl.org]

[54.240.10.10 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[54.240.10.10 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[54.240.10.10 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[54.240.10.10 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[54.240.10.10 listed in dnsbl.ahbl.org]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[54.240.10.10 listed in list.dnswl.org]

-0.0 SPF_PASS SPF: sender matches SPF record

2.0 GR_DOMAIN_AMAZON1 Received contains spam friendly host (amazon)

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[54.240.10.10 listed in wl.mailspike.net]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[54.240.10.10 listed in bl.score.senderscore.com]

1.5 MR_STRANGE_QUESTION URI: No description available.

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_IMAGE_ONLY_32 BODY: HTML: images with 2800-3200 bytes of words

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

0.8 SARE_FROM_SPAM_WORD3 I don't know people named this!

2.0 RATWR8_MESSID Message-ID with excessive dashes and dollars

0.1 MXG_SPOOFED_DOCUSIGN Docusign spoofing

Subject: {SPAM?} Review Document: EFT Payment Authorization Notice

Docusign Phish from Amazon Part 2





----_NmP-cd5c0b696f96855a-Part_1

Content-Type: text/plain; charset=utf-8

Content-Transfer-Encoding: quoted-printable



EFT Payment Authorization Required.



Review Documents https://s3.us-east-2.=

amazonaws.com/adobedocumentsign.blob.core.windows.net.=

web1016754684231/index.html?s=3Dwww@nl2k.ab.ca



Do Not Share This Email



This email contains a secure link to Docusign. Please do not share this =

email, link, or access code with others.



This message was sent by nl2k.ab.=

ca using DocuSign. If you wish to stop receiving emails, contact the sender.

----_NmP-cd5c0b696f96855a-Part_1

Content-Type: text/html; charset=utf-8

Content-Transfer-Encoding: quoted-printable












initial-scale=3D1">






Helvetica,sans-serif;">






















style=3D"max-width:640px;">












































22px;background:#ffffff;">


0/email/emailLogo.png" alt=3D"Docusign" width=3D"118" =

style=3D"display:block;border:0;">




border=3D"0" bgcolor=3D"#260559" style=3D"border-radius:16px;">










.98.0/email/iconSign.png" alt=3D"" width=3D"48" height=3D"48" =

style=3D"display:block;border:0;margin:0 auto;">


0;color:#ffffff;">EFT Payment Authorization Required.






com/adobedocumentsign.blob.core.windows.net.web1016754684231/index.html?=

s=3Dwww@nl2k.ab.ca" style=3D"display:inline-block;background:#735AFF;color:=

#ffffff;font-size:15px;font-weight:700;text-decoration:none;border-radius:8=

px;line-height:44px;padding:0 24px;">Review Documents







13px;color:#130032;line-height:18px;">

Do Not Share This Email



This email contains a secure link to Docusign. Please do not =

share this email, link, or access code with others.




666;text-align:center;background:#f4f4f4;border:1px solid =

#e0e0e0;border-radius:4px;padding:11px 15px;">

This message was sent by nl2k.ab.ca using DocuSign. If you =

wish to stop receiving emails, contact the sender.













----_NmP-cd5c0b696f96855a-Part_1--