Social Media Phish from Google Gmail

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Sun, 12 Apr 2026 13:02:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1wC03p-00000000EJm-33tm

for dave@doctor.nl2k.ab.ca;

Sun, 12 Apr 2026 13:01:33 -0600

Resent-From: The Doctor

Resent-Date: Sun, 12 Apr 2026 13:01:33 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-qv1-f70.google.com ([209.85.219.70]:47205)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.98.2 (FreeBSD))

(envelope-from <3z-rbaQwJBWoLQSIIVIVbWloOUIQT.KWUaITMaVS.KI@maestro.bounces.google.com>)

id 1wBzzZ-000000008XU-15Iq

for sales@nk.ca;

Sun, 12 Apr 2026 12:57:17 -0600

Received: by mail-qv1-f70.google.com with SMTP id 6a1803df08f44-8aca154e2b5so24409826d6.2

for ; Sun, 12 Apr 2026 11:56:21 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=gmail.com; s=20251104; t=1776020175; x=1776624975; darn=nk.ca;

h=content-transfer-encoding:to:from:subject:date:message-id

:mime-version:from:to:cc:subject:date:message-id:reply-to;

bh=npSzxG715XdnVldxX0mQDvjr8HLzOxeIh5WBu9gEgOY=;

b=CMQ5NHJo9Yjget7tq1QbTwe5Wc1/aijV0AWYxtrStmMjCcwwtrCLcMSI61vlXBxNWz

TT9xNw5M4jCsgw4SZUl5zQwFRU4q2GfTybTSR+yF8wKmz80pblkIxMaV+iFFyZ8+SsaR

exOIe7neCgWFuaHljR2qcGFra40CiVm2nLOnMgFUnnA+ZcAR9KksWycjDHp50eWAArLS

980V41f+IN0Do+wCKc4WB8j25fYKYHCiJfwqHqLLWzcQYS3ZExoSzn6RviaxGMdOVsmk

elZwsyp2zD0kPbbNjDeG4iTP/Xwl+FUQtg67bMpzkYFyXzvbvVgxwL2ZbLbX0gNXSky1

NVzA==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20251104; t=1776020175; x=1776624975;

h=content-transfer-encoding:to:from:subject:date:message-id

:mime-version:x-gm-message-state:from:to:cc:subject:date:message-id

:reply-to;

bh=npSzxG715XdnVldxX0mQDvjr8HLzOxeIh5WBu9gEgOY=;

b=J4aYCUPmucFlse3mIkuF+R4zvQpCWgVGOMrF/XUf18TTp1CEHo29o7qcVfbvokUvKf

DAof85mSYeI41lPGHgbDE/9qcfRvFlpXDAOHnu/JKa8RRqjIkJ8Kzn/gmoWF+ZvZDXIt

Lk3ks90rOOQFj95Lv2Yh3Kr4wpKD9Fc7ed7t3XMtpIGgeKNb4jOun/YmETZiBLqcd/fY

a4dMsl4xJxkK11TNriDwN621LIecH7pRzinPYuFOkTCH9T7mewYkfNQ/zYsL7aChJs4P

F4RbPcFaA7Z6Czs2cnZEChMMym/X7qFovJzV4bp2Vu5AQ1z5evRXe4Nd/0f7/cIYwkpp

7ZPg==

X-Gm-Message-State: AOJu0YxRMMqhoZN+KlgcmZW4aloC9gWMKJw4ctrdJO6cBbaNwRwnyLk5

uE9yhUAAv0ionPeth9jC3ayz8e+lkALvSFph6KjzvjS8Err3Broiq0sRGr9mf4Wv/5XU1wu/38T

a+6Uc7w==

MIME-Version: 1.0

X-Received: by 2002:a05:6214:5013:b0:8a5:104b:e361 with SMTP id

6a1803df08f44-8ac8646ba1dmr151148486d6.50.1776020175339; Sun, 12 Apr 2026

11:56:15 -0700 (PDT)

Message-ID:

Date: Sun, 12 Apr 2026 18:56:15 +0000

Subject: daveyadallee, Get More 10,000 Instagram Followers

From: dikaananto36@gmail.com

To: sales@nk.ca

Content-Type: text/plain; charset="UTF-8"; format=flowed; delsp=yes

Content-Transfer-Encoding: base64

X-Spam_score: 9.5

X-Spam_score_int: 95

X-Spam_bar: +++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Hi, daveyadallee, Get More 10,000 Instagram Followers Sorry

to interrupt your time. We offer social media services, If you're interested,

please visit our Website. If you're not interested, please skip this step.





Content analysis details: (9.5 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[209.85.219.70 listed in dnsbl.ahbl.org]

[209.85.219.70 listed in dnsbl.ahbl.org]

[209.85.219.70 listed in dnsbl.ahbl.org]

[209.85.219.70 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[209.85.219.70 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[209.85.219.70 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[209.85.219.70 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[209.85.219.70 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[209.85.219.70 listed in will-spam-for-food.eu.org]

[209.85.219.70 listed in will-spam-for-food.eu.org]

[209.85.219.70 listed in will-spam-for-food.eu.org]

[209.85.219.70 listed in will-spam-for-food.eu.org]

[209.85.219.70 listed in will-spam-for-food.eu.org]

[209.85.219.70 listed in will-spam-for-food.eu.org]

[209.85.219.70 listed in will-spam-for-food.eu.org]

[209.85.219.70 listed in will-spam-for-food.eu.org]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[209.85.219.70 listed in list.dnswl.org]

2.5 URIBL_DBL_PHISH Contains a Phishing URL listed in the DBL blocklist

[URI: instatool.site]

-0.0 SPF_PASS SPF: sender matches SPF record

0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider

[dikaananto36(at)gmail.com]

0.0 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level mail

domains are different

-0.0 T_RP_MATCHES_RCVD Envelope sender domain matches handover relay

domain

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[209.85.219.70 listed in wl.mailspike.net]

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

0.2 FREEMAIL_FORGED_FROMDOMAIN 2nd level domains in From and EnvelopeFrom

freemail headers are different

2.0 RATWR8_MESSID Message-ID with excessive dashes and dollars

Subject: {SPAM?} daveyadallee, Get More 10,000 Instagram Followers



Hi, daveyadallee, Get More 10,000 Instagram Followers

Sorry to interrupt your time.



We offer social media services,

If you're interested, please visit our Website.

If you're not interested, please skip this step.



We will help you increase your social media presence to another level.

( Threads, Instagram, Twitter, Youtube, Facebook, etc. )



Are you interested in a free trial ?

Special For You Bonus Extra $2 - $5 FREE BALANCE TODAY SIGNUP NOW..!!!

GET 100K Followers Instagram NOW !!!

Order here :



[ https://instatool.site/services/?daveyadallee ]





Take free trial service today only...!!

10 -101K Instagram Followers



- Instant Start

- Safest Methods

- Privacy Protection

- Speed 200K Followers/day

- High Quality Followers

- Drop-Back Guarantee

- Trusted Seller testimony

- Starting get 100K Followers Instagram

- Guaranteed to be the cheapest



Thank you,

Regards,



Copyright © 2014 - 2026 instatool.site

Fedex Phish from Sendgrid

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Sun, 12 Apr 2026 12:42:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1wBzkq-000000006gw-0Cce

for dave@doctor.nl2k.ab.ca;

Sun, 12 Apr 2026 12:41:56 -0600

Resent-From: The Doctor

Resent-Date: Sun, 12 Apr 2026 12:41:55 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from s.wrqvtvpz.outbound-mail.sendgrid.net ([149.72.120.62]:62876)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1wBwSO-00000000HA5-0FwQ

for root@nk.ca;

Sun, 12 Apr 2026 09:10:47 -0600

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=perfectfitclosets.ca;

h=content-transfer-encoding:content-type:date:from:mime-version:subject:

to:cc:content-type:date:from:subject:to;

s=s1; t=1776006587; bh=8pRVtoPwGWVxZTFJGZxcWPmJC9yeE+p6+VorZa/5I8I=;

b=hTq/sDVl1yHmBlft049JM6iB4jcS0mcAuduDpzJl51IKlKG7k7VyZ+r8Y6r68QgbEkom

cYJc23kWnjnVnI+P5B1XCsoobuCye9V/5XU8RjlDWBvwJVtcROeBz/GfWxyvebxnVaJnLJ

U81UMoQvHs3w+VT+JoY3jRuXx19csxgIKi/DQBk8vbrUrs0s8LsNuIeTVNn3IL4zEoymq0

98vQChkU+q6mWLWNm0aUq7E5nZaBYZxpsAXREQ0AUQK+C2WhRKPb91c9VmNn12dFMWNv2P

PHiOXeCroPjq9YjZhVb2ozQmyDxOOaCNRbEnTtykqNHIwXxK5DjQCfgSvggBwbLw==

Received: by recvd-canary-55d67c68cf-jmvtd with SMTP id recvd-canary-55d67c68cf-jmvtd-1-69DBB5BA-80

2026-04-12 15:09:46.992624929 +0000 UTC m=+166003.665250705

Received: from Mzg5MDY5MjY (unknown)

by geopod-ismtpd-20 (SG) with HTTP

id 4miVPN46Tyu1xMuPvLNTEw

Sun, 12 Apr 2026 15:09:46.957 +0000 (UTC)

Content-Transfer-Encoding: quoted-printable

Content-Type: text/html; charset=utf-8

Date: Sun, 12 Apr 2026 15:09:47 +0000 (UTC)

From: FedEx Tracking

Mime-Version: 1.0

Message-ID: <4miVPN46Tyu1xMuPvLNTEw@geopod-ismtpd-20>

Subject: We've updated your estimated delivery

X-SG-EID:

=?us-ascii?Q?u001=2EQqNlE5al1bvBBtqp7HdPgxedUqGYuBWmx7JGl4mIJfmePVUn0lHb9CXNn?=

=?us-ascii?Q?0DyQ=2F0CCy350ge5NTBTE3br7LM8vzkPVuO65DIn?=

=?us-ascii?Q?DpgJPK5uAdvyKgebvp3gg8RGyBcURbS=2FsJOQ+Sz?=

=?us-ascii?Q?XXRFKKKoFbkRzsZLx=2F3wNgEBpl4AcGlY8k1yPyZ?=

=?us-ascii?Q?7NSGu=2FTZIs4HwqChpFajgG+1ZAwA2o8nSFdrGty?=

=?us-ascii?Q?HPt2T3dTyabCaJiVz0heZF3oxpc9EPe2NiE7Ozn?= =?us-ascii?Q?11v8?=

To: root@nk.ca

X-Entity-ID: u001.v/heuvXHas+F6NykZsuNtw==

X-Spam_score: 39.7

X-Spam_score_int: 397

X-Spam_bar: +++++++++++++++++++++++++++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: FedEx Delivery Notification We’ve updated the estimated

delivery of your shipment. N/A Delivery Date 08:09:46 Confirm and Resolve

Charges Tracking details Tracking ID #&NUMBER14; CANADA 08:09:46 To CANADA

Number of pieces 1 T [...]



Content analysis details: (39.7 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[149.72.120.62 listed in dnsbl.ahbl.org]

[149.72.120.62 listed in dnsbl.ahbl.org]

[149.72.120.62 listed in dnsbl.ahbl.org]

[149.72.120.62 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[149.72.120.62 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[149.72.120.62 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[149.72.120.62 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[149.72.120.62 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[149.72.120.62 listed in will-spam-for-food.eu.org]

[149.72.120.62 listed in will-spam-for-food.eu.org]

[149.72.120.62 listed in will-spam-for-food.eu.org]

[149.72.120.62 listed in will-spam-for-food.eu.org]

[149.72.120.62 listed in will-spam-for-food.eu.org]

[149.72.120.62 listed in will-spam-for-food.eu.org]

[149.72.120.62 listed in will-spam-for-food.eu.org]

[149.72.120.62 listed in will-spam-for-food.eu.org]

2.5 URIBL_DBL_PHISH Contains a Phishing URL listed in the DBL blocklist

[URI: perfectfitclosets.ca]

1.1 URIBL_GREY Contains an URL listed in the URIBL greylist

[URI: sendgrid.net]

-0.0 RCVD_IN_MSPIKE_H3 RBL: Good reputation (+3)

[149.72.120.62 listed in wl.mailspike.net]

-0.0 SPF_PASS SPF: sender matches SPF record

-0.0 RCVD_IN_MSPIKE_WL Mailspike good senders

15 GR_DOMAIN_SENDGR1 Received contains spammer id (sendgr)

15 GR_DOMAIN_SENDGR6 URI: Body contains known spammer URI (sendgr)

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

Subject: {SPAM?} We've updated your estimated delivery





FedEx

We’ve updated the estimated delivery of your shipment. N/A

Delivery Date

08:09:46

Confirm and Resolve Charges

Tracking details

Tracking ID #&NUMBER14;

CANADA 08:09:46

To CANADA

Number of pieces 1

Total shipment weight 2.40 LB

Service FedEx International Connect Plus

TRACK SHIPMENT



icon Please do not respond to this message. This email was sent from an unattended mailbox. This report was generated at approximately CANADA



All weights are estimated.



To track the latest status of your shipment, click on the tracking number above.



Standard transit is the date and time the package is scheduled to be delivered by, based on the selected service, destination and ship date. Limitations and exceptions may apply. Please see the FedEx Service Guide for terms and conditions of service, including the FedEx Money-Back Guarantee, or contact your FedEx Customer Support representative.



© 2026 Federal Express Corporation. The content of this message is protected by copyright and trademark laws under U.S. and international law. Review our Privacy Notice. All rights reserved.



Thank you for your business.



ID: 1026

Fedex Phish from Sendgrid

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Sun, 12 Apr 2026 12:42:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1wBzkf-000000006gr-0vKL

for dave@doctor.nl2k.ab.ca;

Sun, 12 Apr 2026 12:41:45 -0600

Resent-From: The Doctor

Resent-Date: Sun, 12 Apr 2026 12:41:45 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from s.pnkfpknw.outbound-mail.sendgrid.net ([50.31.49.41]:36772)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1wBwKh-00000000GmS-0eUM

for doctor@doctor.nl2k.ab.ca;

Sun, 12 Apr 2026 09:02:50 -0600

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=perfectfitclosets.ca;

h=content-transfer-encoding:content-type:date:from:mime-version:subject:

to:cc:content-type:date:from:subject:to;

s=s1; t=1776006111; bh=1BN1cj1ggFWrDeU308VW1LxSXftXMxTJlHTnZxqzEZ0=;

b=ImfLyrRm7B9xxKoPaVSx5kOHRPJiSnrTEPwD+kZo9yCYFo6IRXwR5Pa1tWHJo2TLMXWq

DFwu8GHrWsz1n/Gcw+/2CTSVXRsBiy6Mr5kHybV9sGD47oUyMNcLHwVkJGL92Zc+5To+E+

plAgQLzs+1QmcbKO3rPqEHdJJImr+fzuNdu7kLwZQ7NxTsDfsX1qaLdps7ddC4gj+YGgzt

fk8DRfH2weM3JU2/+Xo2+hmQjDyLhzB7Yz/Xl1c25Ah/TGysVrzxEGTF48+ZEwEjxeB1g6

PfStFHI21Ui4TLVMTsXi4fa8S6MBdbr1cwq8wZM1AjEDAXa90R/C7GqnfcghJpEQ==

Received: by recvd-84777968bb-jgmxn with SMTP id recvd-84777968bb-jgmxn-1-69DBB3DF-8

2026-04-12 15:01:51.024016731 +0000 UTC m=+165480.414841013

Received: from Mzg5MDY5MjY (unknown)

by geopod-ismtpd-18 (SG) with HTTP

id r49cflrVSXqnfK-Pf9nIUg

Sun, 12 Apr 2026 15:01:50.986 +0000 (UTC)

Content-Transfer-Encoding: quoted-printable

Content-Type: text/html; charset=utf-8

Date: Sun, 12 Apr 2026 15:01:51 +0000 (UTC)

From: FedEx Tracking

Mime-Version: 1.0

Message-ID:

Subject: We've updated your estimated delivery

X-SG-EID:

=?us-ascii?Q?u001=2EQqNlE5al1bvBBtqp7HdPgxedUqGYuBWmx7JGl4mIJfmePVUn0lHb9CXNn?=

=?us-ascii?Q?0DyQ=2F0CCy350ge5NTBTE3br7LM8v4CXSnnqXH1d?=

=?us-ascii?Q?yu8YBJnDDhwOu6jbWiNtQskXLOoXPoOLN6E7Oue?=

=?us-ascii?Q?F0RRZUGxGtJk+0EXuGhFzucuAcCI8MT3XvoYObX?=

=?us-ascii?Q?qF3aehTp7rj5bXpOE=2FD=2Fd2Nq7biQnX5pVIcFFwA?=

=?us-ascii?Q?W9eeAO3sCHMLx5UQKYUZdBg=2FOgpPEYz8UVnWoEh?= =?us-ascii?Q?8xGs?=

To: doctor@doctor.nl2k.ab.ca

X-Entity-ID: u001.v/heuvXHas+F6NykZsuNtw==

X-Spam_score: 39.5

X-Spam_score_int: 395

X-Spam_bar: +++++++++++++++++++++++++++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: FedEx Delivery Notification We’ve updated the estimated

delivery of your shipment. N/A Delivery Date 08:01:50 Confirm and Resolve

Charges Tracking details Tracking ID #&NUMBER14; CANADA 08:01:50 To CANADA

Number of pieces 1 T [...]



Content analysis details: (39.5 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[50.31.49.41 listed in dnsbl.ahbl.org]

[50.31.49.41 listed in dnsbl.ahbl.org]

[50.31.49.41 listed in dnsbl.ahbl.org]

[50.31.49.41 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[50.31.49.41 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[50.31.49.41 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[50.31.49.41 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[50.31.49.41 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[50.31.49.41 listed in will-spam-for-food.eu.org]

[50.31.49.41 listed in will-spam-for-food.eu.org]

[50.31.49.41 listed in will-spam-for-food.eu.org]

[50.31.49.41 listed in will-spam-for-food.eu.org]

[50.31.49.41 listed in will-spam-for-food.eu.org]

[50.31.49.41 listed in will-spam-for-food.eu.org]

[50.31.49.41 listed in will-spam-for-food.eu.org]

[50.31.49.41 listed in will-spam-for-food.eu.org]

2.5 URIBL_DBL_PHISH Contains a Phishing URL listed in the DBL blocklist

[URI: perfectfitclosets.ca]

1.1 URIBL_GREY Contains an URL listed in the URIBL greylist

[URI: sendgrid.net]

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[50.31.49.41 listed in wl.mailspike.net]

-0.0 SPF_PASS SPF: sender matches SPF record

15 GR_DOMAIN_SENDGR1 Received contains spammer id (sendgr)

15 GR_DOMAIN_SENDGR6 URI: Body contains known spammer URI (sendgr)

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

Subject: {SPAM?} We've updated your estimated delivery





FedEx

We’ve updated the estimated delivery of your shipment. N/A

Delivery Date

08:01:50

Confirm and Resolve Charges

Tracking details

Tracking ID #&NUMBER14;

CANADA 08:01:50

To CANADA

Number of pieces 1

Total shipment weight 2.40 LB

Service FedEx International Connect Plus

TRACK SHIPMENT



icon Please do not respond to this message. This email was sent from an unattended mailbox. This report was generated at approximately CANADA



All weights are estimated.



To track the latest status of your shipment, click on the tracking number above.



Standard transit is the date and time the package is scheduled to be delivered by, based on the selected service, destination and ship date. Limitations and exceptions may apply. Please see the FedEx Service Guide for terms and conditions of service, including the FedEx Money-Back Guarantee, or contact your FedEx Customer Support representative.



© 2026 Federal Express Corporation. The content of this message is protected by copyright and trademark laws under U.S. and international law. Review our Privacy Notice. All rights reserved.



Thank you for your business.



ID: 1026

Fedex PHish from Sendgrid

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Sun, 12 Apr 2026 12:42:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1wBzkb-000000006gm-3i5P

for dave@doctor.nl2k.ab.ca;

Sun, 12 Apr 2026 12:41:41 -0600

Resent-From: The Doctor

Resent-Date: Sun, 12 Apr 2026 12:41:41 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from s.wrqvtvpz.outbound-mail.sendgrid.net ([149.72.120.62]:20968)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1wBwJM-00000000GjR-3nuY

for doctor@nk.ca;

Sun, 12 Apr 2026 09:01:28 -0600

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=perfectfitclosets.ca;

h=content-transfer-encoding:content-type:date:from:mime-version:subject:

to:cc:content-type:date:from:subject:to;

s=s1; t=1776006027; bh=VLPS3kipgEh8P7je2NL9cgz/XvqwUraFXBjDkrHB8ec=;

b=2QfEFtvW4bt8Xfurqzl+DZsEo6cptZLhyooex3VyH3UQiRLQkjybzivWvplSqWtTagOw

Asp8Xzds1bNZrWIKjiRzNlcyVcXhfZCggZ0Kq4DT+YAIH6O49Wozj866ifN3GG20gVJ8I9

m6W+PX5oa7nXHGbABPl00h9mYKtM+S/3ubryaiKvfs5GWaZnK9A7iF3UMSd5kKE3G/wMBZ

ZIKWhC+gpxQkMkO+lACdk2fOd7pxZ2zW+a3GL7ddYBifioPcVlajhH4F1W4+KPS+4KOBkW

Oo/4vHMJ0gAIo6lhK28ouyz4Sf+1bHZ2nUsYhMxo7VOMX3je4fHJlUJLI9dAnqYA==

Received: by recvd-5db5ffb897-bc5sl with SMTP id recvd-5db5ffb897-bc5sl-1-69DBB38B-13A

2026-04-12 15:00:27.836751363 +0000 UTC m=+165393.145283302

Received: from Mzg5MDY5MjY (unknown)

by geopod-ismtpd-17 (SG) with HTTP

id ftl20afQRTaHiTD7nckYeQ

Sun, 12 Apr 2026 15:00:27.832 +0000 (UTC)

Content-Transfer-Encoding: quoted-printable

Content-Type: text/html; charset=utf-8

Date: Sun, 12 Apr 2026 15:00:27 +0000 (UTC)

From: FedEx Tracking

Mime-Version: 1.0

Message-ID:

Subject: We've updated your estimated delivery

X-SG-EID:

=?us-ascii?Q?u001=2EQqNlE5al1bvBBtqp7HdPgxedUqGYuBWmx7JGl4mIJfmePVUn0lHb9CXNn?=

=?us-ascii?Q?0DyQ=2F0CCy350ge5NTBTE3br7LM8vwykKYv2ZP7m?=

=?us-ascii?Q?Q6pQCnsKyqKZPXfpYnnlZSGTeZZZWSQ=2FtUgEkSx?=

=?us-ascii?Q?HI3aoxK3zm7y3Q4tTJidbU9+09YV5OLVkyXRAfC?=

=?us-ascii?Q?6KcJZP7mn6nh93ShjQXGPBsn0whFiiMViNt4puL?=

=?us-ascii?Q?81Z5OSSgkNHb6tu4QuML67EfUyT=2FpjZUh2dLxb0?= =?us-ascii?Q?O+JL?=

To: doctor@nk.ca

X-Entity-ID: u001.v/heuvXHas+F6NykZsuNtw==

X-Spam_score: 36.0

X-Spam_score_int: 360

X-Spam_bar: ++++++++++++++++++++++++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: FedEx Delivery Notification We’ve updated the estimated

delivery of your shipment. N/A Delivery Date 08:00:27 Confirm and Resolve

Charges Tracking details Tracking ID #&NUMBER14; CANADA 08:00:27 To CANADA

Number of pieces 1 T [...]



Content analysis details: (36.0 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[149.72.120.62 listed in dnsbl.ahbl.org]

[149.72.120.62 listed in dnsbl.ahbl.org]

[149.72.120.62 listed in dnsbl.ahbl.org]

[149.72.120.62 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[149.72.120.62 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[149.72.120.62 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[149.72.120.62 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[149.72.120.62 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[149.72.120.62 listed in will-spam-for-food.eu.org]

[149.72.120.62 listed in will-spam-for-food.eu.org]

[149.72.120.62 listed in will-spam-for-food.eu.org]

[149.72.120.62 listed in will-spam-for-food.eu.org]

[149.72.120.62 listed in will-spam-for-food.eu.org]

[149.72.120.62 listed in will-spam-for-food.eu.org]

[149.72.120.62 listed in will-spam-for-food.eu.org]

[149.72.120.62 listed in will-spam-for-food.eu.org]

0.0 URIBL_RED Contains an URL listed in the URIBL redlist

[URI: symbioproject.com]

1.1 URIBL_GREY Contains an URL listed in the URIBL greylist

[URI: sendgrid.net]

2.5 URIBL_DBL_PHISH Contains a Phishing URL listed in the DBL blocklist

[URI: symbioproject.com]

[URI: perfectfitclosets.ca]

0.0 RCVD_IN_VALIDITY_SAFE_BLOCKED RBL: ADMINISTRATOR NOTICE: The query to

Validity was blocked. See

https://knowledge.validity.com/hc/en-us/articles/20961730681243

for more information.

[149.72.120.62 listed in sa-accredit.habeas.com]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

0.0 RCVD_IN_VALIDITY_CERTIFIED_BLOCKED RBL: ADMINISTRATOR NOTICE: The

query to Validity was blocked. See

https://knowledge.validity.com/hc/en-us/articles/20961730681243

for more information.

[149.72.120.62 listed in sa-trusted.bondedsender.org]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-0.0 RCVD_IN_MSPIKE_H3 RBL: Good reputation (+3)

[149.72.120.62 listed in wl.mailspike.net]

0.0 RCVD_IN_VALIDITY_RPBL_BLOCKED RBL: ADMINISTRATOR NOTICE: The query to

Validity was blocked. See

https://knowledge.validity.com/hc/en-us/articles/20961730681243

for more information.

[149.72.120.62 listed in bl.score.senderscore.com]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[149.72.120.62 listed in bl.score.senderscore.com]

-0.0 SPF_PASS SPF: sender matches SPF record

-0.0 RCVD_IN_MSPIKE_WL Mailspike good senders

15 GR_DOMAIN_SENDGR1 Received contains spammer id (sendgr)

15 GR_DOMAIN_SENDGR6 URI: Body contains known spammer URI (sendgr)

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

Subject: {SPAM?} We've updated your estimated delivery





FedEx

We’ve updated the estimated delivery of your shipment. N/A

Delivery Date

08:00:27

Confirm and Resolve Charges

Tracking details

Tracking ID #&NUMBER14;

CANADA 08:00:27

To CANADA

Number of pieces 1

Total shipment weight 2.40 LB

Service FedEx International Connect Plus

TRACK SHIPMENT



icon Please do not respond to this message. This email was sent from an unattended mailbox. This report was generated at approximately CANADA



All weights are estimated.



To track the latest status of your shipment, click on the tracking number above.



Standard transit is the date and time the package is scheduled to be delivered by, based on the selected service, destination and ship date. Limitations and exceptions may apply. Please see the FedEx Service Guide for terms and conditions of service, including the FedEx Money-Back Guarantee, or contact your FedEx Customer Support representative.



© 2026 Federal Express Corporation. The content of this message is protected by copyright and trademark laws under U.S. and international law. Review our Privacy Notice. All rights reserved.



Thank you for your business.



ID: 1026

Fedex Phish from sendgrid

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Sun, 12 Apr 2026 08:46:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1wBw3j-00000000Eay-2C2O

for dave@doctor.nl2k.ab.ca;

Sun, 12 Apr 2026 08:45:11 -0600

Resent-From: The Doctor

Resent-Date: Sun, 12 Apr 2026 08:45:11 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from s.wrqvtwtt.outbound-mail.sendgrid.net ([149.72.121.119]:48220)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1wBvvp-00000000AR3-00kN

for doctor@nk.ca;

Sun, 12 Apr 2026 08:37:03 -0600

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=perfectfitclosets.ca;

h=content-transfer-encoding:content-type:date:from:mime-version:subject:

to:cc:content-type:date:from:subject:to;

s=s1; t=1776004568; bh=DpgUPM/2TYdVbs83igj6MFc5Kax4tMWguW/9oCpJWUI=;

b=ZVaotDlb2oiYf0yjWU/1iBas+P0faTxORPGHsfD/uohb05wNLfGvpadtHqKGbNQxx1vs

HRiIjjttSCRVn1ub2JpCURuFt5tcpGhvIwXNAwmowf6A2ufjUvohedb4xXAyjCwNo0rCkF

hYYrj2aYFA3ftHuO4GawsWWci6NwzSDL6HakF/MmOySoLQdGhZ8mZHYyL2ywsOgz+FsTwV

lAW4akAAVu4Vq6Ptstv+rWaEm0LMxngOPQEdfyZxCLnAYSOUuDT5whcc//KCThZSa53U66

9mXyKXZbJURPKeVWkjggeJ4LioeDudmf6BumbE0cAcp9ZDlumwVtA/7XXgPt8djw==

Received: by recvd-canary-584cfc8b5d-vvn2c with SMTP id recvd-canary-584cfc8b5d-vvn2c-1-69DBADD8-9

2026-04-12 14:36:08.102171674 +0000 UTC m=+163996.265651483

Received: from Mzg5MDY5MjY (unknown)

by geopod-ismtpd-13 (SG) with HTTP

id C9xWTfoOR3qnHKSfRGLIaQ

Sun, 12 Apr 2026 14:36:08.070 +0000 (UTC)

Content-Transfer-Encoding: quoted-printable

Content-Type: text/html; charset=us-ascii

Date: Sun, 12 Apr 2026 14:36:08 +0000 (UTC)

From: FedEx =?iso-8859-1?q?EXPRESS=AE?=

Mime-Version: 1.0

Message-ID:

Subject: Your parcel is waiting for instructions

X-SG-EID:

=?us-ascii?Q?u001=2EQqNlE5al1bvBBtqp7HdPg4UP2wHzFGm6w91pbB3KXUXLPLVBiJ1lNXRm+?=

=?us-ascii?Q?Y9wGR2o03GafpBLcdRZUkXCJmZ5m3M0TlWuiNko?=

=?us-ascii?Q?ANkFU7QskjWzL+avrhJCYbOPFkaJqhj9WU0=2F5od?=

=?us-ascii?Q?JCHGChaejMF6qVADARXrFtC3QVpCVO=2FznDI4xX5?=

=?us-ascii?Q?yGobxmFt78KthXSY=2Fwncm+fsNj8BpGshkWPSRjI?=

=?us-ascii?Q?gIp9nJQkE9QWTqhNRa9M9iCpFDawkt=2F+3ymp6XM?= =?us-ascii?Q?wrM+?=

To: doctor@nk.ca

X-Entity-ID: u001.v/heuvXHas+F6NykZsuNtw==

X-Spam_score: 37.4

X-Spam_score_int: 374

X-Spam_bar: +++++++++++++++++++++++++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: FedEx Your Parcel is waiting for owner instuctions .



Content analysis details: (37.4 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[149.72.121.119 listed in dnsbl.ahbl.org]

[149.72.121.119 listed in dnsbl.ahbl.org]

[149.72.121.119 listed in dnsbl.ahbl.org]

[149.72.121.119 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[149.72.121.119 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[149.72.121.119 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[149.72.121.119 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[149.72.121.119 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[149.72.121.119 listed in will-spam-for-food.eu.org]

[149.72.121.119 listed in will-spam-for-food.eu.org]

[149.72.121.119 listed in will-spam-for-food.eu.org]

[149.72.121.119 listed in will-spam-for-food.eu.org]

[149.72.121.119 listed in will-spam-for-food.eu.org]

[149.72.121.119 listed in will-spam-for-food.eu.org]

[149.72.121.119 listed in will-spam-for-food.eu.org]

[149.72.121.119 listed in will-spam-for-food.eu.org]

1.1 URIBL_GREY Contains an URL listed in the URIBL greylist

[URI: sendgrid.net]

0.0 RCVD_IN_VALIDITY_CERTIFIED_BLOCKED RBL: ADMINISTRATOR NOTICE: The

query to Validity was blocked. See

https://knowledge.validity.com/hc/en-us/articles/20961730681243

for more information.

[149.72.121.119 listed in sa-trusted.bondedsender.org]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

2.5 URIBL_DBL_PHISH Contains a Phishing URL listed in the DBL blocklist

[URI: perfectfitclosets.ca]

0.1 URIBL_SBL_A Contains URL's A record listed in the SBL blocklist

[URI: appcenter-api.bignox.com/36.255.220.177]

-0.0 SPF_PASS SPF: sender matches SPF record

15 GR_DOMAIN_SENDGR1 Received contains spammer id (sendgr)

15 GR_DOMAIN_SENDGR6 URI: Body contains known spammer URI (sendgr)

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_IMAGE_ONLY_32 BODY: HTML: images with 2800-3200 bytes of words

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.6 HTML_MIME_NO_HTML_TAG HTML-only message, but there is no HTML tag

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

Subject: {SPAM?} Your parcel is waiting for instructions




,Segoe UI,Helvetica Neue,Arial,sans-serif; line-height: 22px; font-weight: =

bold; font-style: normal; font-size: 50px; text-decoration: none; text-tran=

sform: none; direction: ltr; color: #333333; text-align: left; mso-line-hei=

ght-rule: exactly; mso-text-raise: -2px;">
=3D"margin: 0; color: #843fa1; mso-line-height-rule: exactly;">Fed

pan class=3D"t1" style=3D"margin: 0; color: #e67e23; mso-line-height-rule: =

exactly;">Ex




,Segoe UI,Helvetica Neue,Arial,sans-serif; line-height: 22px; font-weight: =

bold; font-style: normal; font-size: 50px; text-decoration: none; text-tran=

sform: none; direction: ltr; color: #333333; text-align: left; mso-line-hei=

ght-rule: exactly; mso-text-raise: -2px;">
n: 0; color: #e67e23; mso-line-height-rule: exactly;"> 




,Segoe UI,Helvetica Neue,Arial,sans-serif; line-height: 22px; font-weight: =

bold; font-style: normal; font-size: 50px; text-decoration: none; text-tran=

sform: none; direction: ltr; color: #333333; text-align: left; mso-line-hei=

ght-rule: exactly; mso-text-raise: -2px;"> 



Your Parcel is waiting for owner ins=

tuctions .



Dear Customer,



Your parcel has arrived at our facility =

and is ready for the final step of delivery. To initiate the shipping proce=

ss, please complete the outstanding payment within the next 24 hours. You m=

ay proceed by following the link below. Should you have any questions, feel=

free to reach out—we’re happy to assist!




elvetica, arial, sans-serif;">
lick/v1/url?redirectUrl=3Dhttps://mail.trabalhosassemae.com.br/uhntyp28htyw=

5xrhfsvdfcau/">https://www.fedex.com/tracking?id=3DK0SQ24IU1JPNX8T<=

/strong>



Thank you for your prompt attention.



Best regards,

g>
le: exactly;">Fed

23; mso-line-height-rule: exactly;">Ex


://u38906926.ct.sendgrid.net/wf/open?upn=3Du001.vAfwyCsv5SKe20dbI9Z6QE-2Bol=

S-2FuHipLhwG8H0khMrlf00IqQ7uoayzquKO-2FoTkzMTLkGZsHNCIus5e7uG5BDdIeXThc38O-=

2FmcJpeeh5vZp3QgGyD9mqGma4CddXlTahY958hUHd-2FONQCekxKzO0HVMkWQ3AhRtkIbu1NPx=

E-2BbLLc1qsbzGA-2Bw2kCk1QSEEfsScyDF9LEb8zC4uc2CWa0w-3D-3D" alt=3D"" width=

=3D"1" height=3D"1" border=3D"0" style=3D"height:1px !important;width:1px !=

important;border-width:0 !important;margin-top:0 !important;margin-bottom:0=

!important;margin-right:0 !important;margin-left:0 !important;padding-top:=

0 !important;padding-bottom:0 !important;padding-right:0 !important;padding=

-left:0 !important;"/>

Fedex phish from Sendgrid

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Sun, 12 Apr 2026 08:46:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1wBw3c-00000000EZa-2LJ6

for dave@doctor.nl2k.ab.ca;

Sun, 12 Apr 2026 08:45:04 -0600

Resent-From: The Doctor

Resent-Date: Sun, 12 Apr 2026 08:45:04 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from s.wrqvtwtt.outbound-mail.sendgrid.net ([149.72.121.119]:29494)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1wBvn5-000000007Ch-1JPM

for doctor@doctor.nl2k.ab.ca;

Sun, 12 Apr 2026 08:28:06 -0600

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=perfectfitclosets.ca;

h=content-transfer-encoding:content-type:date:from:mime-version:subject:

to:cc:content-type:date:from:subject:to;

s=s1; t=1776004026; bh=frLcItWQvA34pn9Apxhu6zwTPTkYsmDL8CyajF4gp2g=;

b=eDWCDf/FMF8WlNSVSZOTYDV+rprK+RnoV5ic6RzCbA9yDZP3+zTPsl+0+CSRY7yDYy+t

0wSmuUZJaCGqu2vXk7WudzV5ywfKdMYt8T8ZzpM9MVuPfSIqGstyDbuKr5I2GGOjPwiGa5

eaRnvmtTG1pAmkDRKK6kaorVtUNyjF130rO1j0iPWya+xgz/p23pEiqD5+MMbUo0Hl7hub

GTqpqB1MVLg6lOkewkcNPagjLsQKPgXVMI9qcnYRyFx08aE1jKZ1BklkSM9AA92f44ryp/

5oHHf6Y9EJ9T0DcHv+ZuAjaaR9GSB8iWr4hU38orZ4J2AsG9MikZfLN0CpqEpeHQ==

Received: by recvd-6b69d658f7-54kts with SMTP id recvd-6b69d658f7-54kts-1-69DBABBA-60

2026-04-12 14:27:06.881262633 +0000 UTC m=+163443.614074166

Received: from Mzg5MDY5MjY (unknown)

by geopod-ismtpd-15 (SG) with HTTP

id Ix2PorOMRFCiHr4Prkjy-A

Sun, 12 Apr 2026 14:27:06.879 +0000 (UTC)

Content-Transfer-Encoding: quoted-printable

Content-Type: text/html; charset=us-ascii

Date: Sun, 12 Apr 2026 14:27:06 +0000 (UTC)

From: FedEx =?iso-8859-1?q?EXPRESS=AE?=

Mime-Version: 1.0

Message-ID:

Subject: Your parcel is waiting for instructions

X-SG-EID:

=?us-ascii?Q?u001=2EQqNlE5al1bvBBtqp7HdPg4UP2wHzFGm6w91pbB3KXUXLPLVBiJ1lNXRm+?=

=?us-ascii?Q?Y9wGR2o03GafpBLcdRZUkXCJmZ5mzxD9a=2FJSesW?=

=?us-ascii?Q?kT2VaKpwG9M14jCBxAJ7aAQJYtIKztG56avjKiz?=

=?us-ascii?Q?ojc62ZUElTTrp1t6eR=2FkvBUjbaclFOS4FwoGxob?=

=?us-ascii?Q?xrpixJ2007UCR1PV9eD58cz3Cg=2FsDpKB7gJuHy+?=

=?us-ascii?Q?E9jfUTNDICJIUOZ1NXQzbogttRxsCRN7C7aVpqz?=

=?us-ascii?Q?AL5K0ZUgTrFPkTHQVFLEUGlWfA=3D=3D?=

To: doctor@doctor.nl2k.ab.ca

X-Entity-ID: u001.v/heuvXHas+F6NykZsuNtw==

X-Spam_score: 40.2

X-Spam_score_int: 402

X-Spam_bar: ++++++++++++++++++++++++++++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: FedEx Your Parcel is waiting for owner instuctions .



Content analysis details: (40.2 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[149.72.121.119 listed in dnsbl.ahbl.org]

[149.72.121.119 listed in dnsbl.ahbl.org]

[149.72.121.119 listed in dnsbl.ahbl.org]

[149.72.121.119 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[149.72.121.119 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[149.72.121.119 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[149.72.121.119 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[149.72.121.119 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[149.72.121.119 listed in will-spam-for-food.eu.org]

[149.72.121.119 listed in will-spam-for-food.eu.org]

[149.72.121.119 listed in will-spam-for-food.eu.org]

[149.72.121.119 listed in will-spam-for-food.eu.org]

[149.72.121.119 listed in will-spam-for-food.eu.org]

[149.72.121.119 listed in will-spam-for-food.eu.org]

[149.72.121.119 listed in will-spam-for-food.eu.org]

[149.72.121.119 listed in will-spam-for-food.eu.org]

2.5 URIBL_DBL_PHISH Contains a Phishing URL listed in the DBL blocklist

[URI: perfectfitclosets.ca]

0.1 URIBL_SBL_A Contains URL's A record listed in the SBL blocklist

[URI: appcenter-api.bignox.com/36.255.220.177]

1.1 URIBL_GREY Contains an URL listed in the URIBL greylist

[URI: sendgrid.net]

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[149.72.121.119 listed in wl.mailspike.net]

-0.0 SPF_PASS SPF: sender matches SPF record

15 GR_DOMAIN_SENDGR1 Received contains spammer id (sendgr)

15 GR_DOMAIN_SENDGR6 URI: Body contains known spammer URI (sendgr)

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_IMAGE_ONLY_32 BODY: HTML: images with 2800-3200 bytes of words

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

0.6 HTML_MIME_NO_HTML_TAG HTML-only message, but there is no HTML tag

Subject: {SPAM?} Your parcel is waiting for instructions




,Segoe UI,Helvetica Neue,Arial,sans-serif; line-height: 22px; font-weight: =

bold; font-style: normal; font-size: 50px; text-decoration: none; text-tran=

sform: none; direction: ltr; color: #333333; text-align: left; mso-line-hei=

ght-rule: exactly; mso-text-raise: -2px;">
=3D"margin: 0; color: #843fa1; mso-line-height-rule: exactly;">Fed

pan class=3D"t1" style=3D"margin: 0; color: #e67e23; mso-line-height-rule: =

exactly;">Ex




,Segoe UI,Helvetica Neue,Arial,sans-serif; line-height: 22px; font-weight: =

bold; font-style: normal; font-size: 50px; text-decoration: none; text-tran=

sform: none; direction: ltr; color: #333333; text-align: left; mso-line-hei=

ght-rule: exactly; mso-text-raise: -2px;">
n: 0; color: #e67e23; mso-line-height-rule: exactly;"> 




,Segoe UI,Helvetica Neue,Arial,sans-serif; line-height: 22px; font-weight: =

bold; font-style: normal; font-size: 50px; text-decoration: none; text-tran=

sform: none; direction: ltr; color: #333333; text-align: left; mso-line-hei=

ght-rule: exactly; mso-text-raise: -2px;"> 



Your Parcel is waiting for owner ins=

tuctions .



Dear Customer,



Your parcel has arrived at our facility =

and is ready for the final step of delivery. To initiate the shipping proce=

ss, please complete the outstanding payment within the next 24 hours. You m=

ay proceed by following the link below. Should you have any questions, feel=

free to reach out—we’re happy to assist!




elvetica, arial, sans-serif;">
lick/v1/url?redirectUrl=3Dhttps://mail.trabalhosassemae.com.br/uhntyp28htyw=

5xrhfsvdfcau/">https://www.fedex.com/tracking?id=3DK0SQ24IU1JPNX8T<=

/strong>



Thank you for your prompt attention.



Best regards,

g>
le: exactly;">Fed

23; mso-line-height-rule: exactly;">Ex


://u38906926.ct.sendgrid.net/wf/open?upn=3Du001.vAfwyCsv5SKe20dbI9Z6QKeFEUi=

u7Ze4oT3Osa2V9TbyGtsUGDzBAyE2MNYYUcJRsKGyIdjmOYV0l8MrQSz1r-2FwbwkWRIhisrjnA=

py-2F-2BM0JoP9ljRyxdzWEXO7varUhKpTLx9aZIeqy4NU7GQfZEd-2Bc4K0rPwSCqQo0LWtuRH=

6HapQybNO3dRQ10dQvbWSCj53vqr0YMZPkjQklXGq5DnrdGNVohmYtW6v2Kq5qd-2BEQ-3D" al=

t=3D"" width=3D"1" height=3D"1" border=3D"0" style=3D"height:1px !important=

;width:1px !important;border-width:0 !important;margin-top:0 !important;mar=

gin-bottom:0 !important;margin-right:0 !important;margin-left:0 !important;=

padding-top:0 !important;padding-bottom:0 !important;padding-right:0 !impor=

tant;padding-left:0 !important;"/>

French language rental demand phish from Google Gmail

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Sun, 12 Apr 2026 12:42:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1wBzkV-000000006gY-0rqx

for dave@doctor.nl2k.ab.ca;

Sun, 12 Apr 2026 12:41:35 -0600

Resent-From: The Doctor

Resent-Date: Sun, 12 Apr 2026 12:41:35 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-wm1-f67.google.com ([209.85.128.67]:57478)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.98.2 (FreeBSD))

(envelope-from <33052@ppk.ac.th>)

id 1wBwCL-00000000FzX-1TJk

for root@doctor.nl2k.ab.ca;

Sun, 12 Apr 2026 08:54:15 -0600

Received: by mail-wm1-f67.google.com with SMTP id 5b1f17b1804b1-488b0e1b870so58115545e9.2

for ; Sun, 12 Apr 2026 07:53:18 -0700 (PDT)

ARC-Seal: i=1; a=rsa-sha256; t=1776005591; cv=none;

d=google.com; s=arc-20240605;

b=JX+temfDKSQiNYf3YVdRwV7/fcTsaMcY3dDIF24Wq2cyxmQR79RKpnYngpv0um6VTa

sleFaJJHTQoScI8Uy8CXxNFGZyuUD0W7zwDV/QnKmqc4wGAOlOhqu/P9vZnAfC+Glbgl

C2kdwvsxT3VvcCT7xI2UU88w3iz97IUCyUgRUg8N+kZuyUa2U5Qu9ng4NwOz0owchn0+

3PgzI5MCWhrdB71R4AZkp3Mej8L8otY9aJhMZgwRwoHp/D2bRpPYCeIWYfaab+W2ZRP1

q9mZBqMIxFo8vXrTufWbXrPDENFRyafbsL7HODGgiq9aztxAyrEOX+eL1gkU5TFn5MWu

lERA==

ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20240605;

h=to:subject:message-id:date:from:reply-to:mime-version

:dkim-signature;

bh=Uwm0JhtIbanbWEgLrUoJa3/AJ6gUkPV0Ivh7HaAR2pE=;

fh=xIC24Ho7nbZF1yObKVf6vdg7uyiR/6sTta/eDfU8GVc=;

b=K7cTcFq5ZWGJAYbUkspSChLaA+SZ8ai31ilwjHhIT+xs+MTKjUdgH29STCdpe9saDw

x7Gj4zbptIg4NNxP4c5bQbnK3TZCRhQYwl/cxKtZWwQfsruqh0oaMfpq18Qymw9opOnS

oD2nMzvwvpiy/ZLZ/Qf2GcA2rjl6SMF3dhJUhTxOuZYqaWqQ2kCZqY/RWHtsckkEgDUu

s/msIUN5M6UKq6btVG+Ln9hUQLY/+E5f9LjKOqKBYxbScnSMfyf2T8WT12eNmY/5MeEh

6EDwJeIlmgdYUxDi5p5GR15LJe5QjJtmmbXKTNvfnxF0PKcTHbILT5V+W2S/EHxiYgQH

MdiQ==;

darn=doctor.nl2k.ab.ca

ARC-Authentication-Results: i=1; mx.google.com; arc=none

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=ppk-ac-th.20251104.gappssmtp.com; s=20251104; t=1776005591; x=1776610391; darn=doctor.nl2k.ab.ca;

h=to:subject:message-id:date:from:reply-to:mime-version:from:to:cc

:subject:date:message-id:reply-to;

bh=Uwm0JhtIbanbWEgLrUoJa3/AJ6gUkPV0Ivh7HaAR2pE=;

b=Lt+P95BRHBjgWjo+XYuMUlOqRr7cy0HJm3lUzt0XGn3uDnTeAOyvQ7RWMxgTuDZarz

asDn6lYl/+X54iRrrbW2yBXM0apu/mJQQh/u0+n061b5KFhosBFbAT72tMYL685mIehH

QoeIwID3oEYtj57WvZmnfn6ACKX+SSjOoKZWjMrtEeOI1MgWbaFELazo04crf+9AxulQ

ab5suymuX6JBC/5Ra6avLUeScgYm6dtZ4HsxjxohVMwKCvLOjmLDcL8Zfco9yTJc4Gn8

PIsg0x+kwSDncVhcobL3VNznmY/f0KQBVVy9S874nCbQZ3ZClQgWEvNZv9PZ0o4PUkQn

0JJQ==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20251104; t=1776005591; x=1776610391;

h=to:subject:message-id:date:from:reply-to:mime-version:x-gm-gg

:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to;

bh=Uwm0JhtIbanbWEgLrUoJa3/AJ6gUkPV0Ivh7HaAR2pE=;

b=DkU0xwscqEf5P33vQh9hehYkYgLCh+XDJDHy18HIxYvY9kxTw1OBCh+m6yuP39Mtzq

7SS5gZt4PTanPnnYJVDadgadrgTQ4W674T8F3//BmfEyRQZqgF0yi2UxCY7xBe+uD/9t

kl5PSOXdL2H+d6cvpVNo39BigmgkjPQt8jTGFh9b3/2SLKJWY/1qsMHqE3vS+6XlPfrh

JWOMbwUrEB+7rnCd0If1eRPeDPvEg7k8Z44mEfyOmKfhywChlvYpLLlhqEMYDS9MYHSR

LkYeCHAU8ztwFxY4Bi38WgO/b2o2zwCiwD6ofLsggON37QQWGGMG0GZ3nQQlhPfqaD72

I9mA==

X-Forwarded-Encrypted: i=1; AJvYcCX0r4S1dsZD+xyGk9kUclEmnJP2uLbj8oc3A/nsH3XWIZ8zUZkgd+DatAy+KszrpoQJmSmQ@doctor.nl2k.ab.ca

X-Gm-Message-State: AOJu0Ywhj8/1MNepH8nTwDZAcc0Y2Ik77KsKvqGXwkU0xEbMLXb9lxf5

qiVFpUuUKAVix7FIXxAf0cddmsB+yOHeOZjyziEyp0y0lGrO06qvIwjulKK6Yh5y6ptbhymbRGX

Atxvi5GJ1cjV2AEEDVKedfs7qxXtTtpmmZiFEA9DMvQ==

X-Gm-Gg: AeBDiesd1rrkRYPuycXKqe3yUDdPOGaPEXONRXT0K5LF79FvD8XmnDIcxnK9zhego5Q

t1u0Lj6oMzaCT+pCGNEyd/AI32aiDx91zy6dLAK4XlmW13qHB+nQWCdn4ibyKDvuIYu/cWHekge

K7wlXZlSEdNUaIZsSgW2kg3ZMxLGlO2i7KHD0M70srDuXU8pueR59mh6TETT1QEzCBdXJrHEkZ2

lvNNmuVbXMzvrY1qI637ADVpEwMNaioDhepJvvfNWek9SKQ3I3noIbubEM9bBcZEJXMmSwTe/cR

NB3r37h6Y7Q=

X-Received: by 2002:a05:600c:1c0a:b0:485:4388:3492 with SMTP id

5b1f17b1804b1-488d67f4e67mr135095555e9.11.1776005590600; Sun, 12 Apr 2026

07:53:10 -0700 (PDT)

MIME-Version: 1.0

Reply-To: servicegestionlocative148@gmail.com

From: Service Locative <33052@ppk.ac.th>

Date: Sun, 12 Apr 2026 14:53:12 +0200

X-Gm-Features: AQROBzC0EbbpJPp6UY4FJnwO_WrqLd9AlkrfnHIv_ol6IngNxY5h1F1HJ4WmFoc

Message-ID:

Subject: Rappel de paiement

To: undisclosed-recipients:;

Content-Type: multipart/alternative; boundary="00000000000058e0f6064f448662"

Bcc: root@doctor.nl2k.ab.ca

X-Spam_score: 9.1

X-Spam_score_int: 91

X-Spam_bar: +++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Chers locataires, Nous espérons que vous allez bien. Nous

vous écrivons aujourd’hui afin de vous informer d’un changement important

concernant le paiement de votre loyer. Dans un souci de simpli [...]



Content analysis details: (9.1 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[209.85.128.67 listed in dnsbl.ahbl.org]

[209.85.128.67 listed in dnsbl.ahbl.org]

[209.85.128.67 listed in dnsbl.ahbl.org]

[209.85.128.67 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[209.85.128.67 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[209.85.128.67 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[209.85.128.67 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[209.85.128.67 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[209.85.128.67 listed in will-spam-for-food.eu.org]

[209.85.128.67 listed in will-spam-for-food.eu.org]

[209.85.128.67 listed in will-spam-for-food.eu.org]

[209.85.128.67 listed in will-spam-for-food.eu.org]

[209.85.128.67 listed in will-spam-for-food.eu.org]

[209.85.128.67 listed in will-spam-for-food.eu.org]

[209.85.128.67 listed in will-spam-for-food.eu.org]

[209.85.128.67 listed in will-spam-for-food.eu.org]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[209.85.128.67 listed in list.dnswl.org]

-0.0 SPF_PASS SPF: sender matches SPF record

1.5 GR_DOMAIN_UNDISC1 To contains undisclosed recipient (undisc)

0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in digit

[servicegestionlocative148(at)gmail.com]

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[209.85.128.67 listed in wl.mailspike.net]

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

2.5 FREEMAIL_FORGED_REPLYTO Freemail in Reply-To, but not From

Subject: {SPAM?} Rappel de paiement



Chers locataires,

Nous espérons que vous allez bien.

Nous vous écrivons aujourd’hui afin de vous informer d’un changement important concernant le paiement de votre loyer. Dans un souci de simplification, de rapidité et de sécurité, nous vous invitons à effectuer vos paiements par virement Interac, et ce à compter de ce mois-ci.

Ce nouveau mode de paiement nous permettra :



de suivre plus facilement les transactions,

de réduire les délais de traitement,

et de nous assurer que chaque loyer est bien reçu à temps.



Informations pour le virement :



Adresse courriel du destinataire : servicegestionlocative148@gmail.com



Question de sécurité : Facture

Réponse : Payer



Une fois le virement effectué, merci de nous en informer par retour de courriel. Si possible, nous vous invitons à joindre une capture d’écran ou une copie de l’ordre de virement, ce qui facilitera la mise à jour rapide de votre dossier.

Nous comprenons que ce changement puisse demander un petit temps d’adaptation. Soyez assuré(e) que nous restons disponibles pour vous accompagner tout au long de cette transition.

N’hésitez pas à nous contacter pour toute question ou assistance concernant votre premier virement.

Un grand merci pour votre collaboration et votre confiance. Votre confort et votre tranquillité d’esprit demeurent nos priorités.

Pour toute demande, vous pouvez nous écrire à : servicegestionlocative148@gmail.com



Bien cordialement,

French language rental demand phish from Google Gmail

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Sun, 12 Apr 2026 08:45:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1wBw3S-00000000EWG-3kUV

for dave@doctor.nl2k.ab.ca;

Sun, 12 Apr 2026 08:44:54 -0600

Resent-From: The Doctor

Resent-Date: Sun, 12 Apr 2026 08:44:54 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-lf1-f67.google.com ([209.85.167.67]:54298)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.98.2 (FreeBSD))

(envelope-from <33039@ppk.ac.th>)

id 1wBvke-000000006oy-35o0

for doctor@nl2k.ab.ca;

Sun, 12 Apr 2026 08:25:37 -0600

Received: by mail-lf1-f67.google.com with SMTP id 2adb3069b0e04-5a2c77c62d7so3543150e87.0

for ; Sun, 12 Apr 2026 07:24:41 -0700 (PDT)

ARC-Seal: i=1; a=rsa-sha256; t=1776003875; cv=none;

d=google.com; s=arc-20240605;

b=S1pOB+MbXpqSCbpu76rDYD7Fv14lRSIzhJ1sL5VLA342s45oMqWtWmVAKwoAJQtyUN

yFcnZ0dnpfyTSg/rcbfilhfFtiDlF3/Ft23YaEpibpHt5dhMXDYU1FtK26AY8nIik6at

v1gLz7zhGkBqf4YjHO5dlNpXE2K8Rl68U5eA6OSUR6warKGELmjyQJawmHUT1hNqPoLM

FaA/KGzNO+/wwfUiq8kSrptuNUdGKiAb/paK4OAjftKS7jRBeE+woZ/Dcwd06a1PokEO

6x8izP/baZg5ltA7JVnIjwTUcZtiJvvOPxXS10Pk835rY8gluNy2fwDS0qsv9Qdcs/4d

7fWw==

ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20240605;

h=to:subject:message-id:date:from:reply-to:mime-version

:dkim-signature;

bh=hSdHXvGvxV7MRvfeVcTqnZOgtXM/agvdU0uDFSkftkQ=;

fh=ETYg8Qe7AlprisbU+xuke3XsRCYYLswe6JRNKPt1uzo=;

b=WlUXTmZ9MLV96mSAVEk7hxIdZZSXcyxnrGm385jJVpIMRHeQjIyUixzh2MjKJaaYIU

IzMBxpEqfRuNR7+lceX9OHDzjs8eOlA+NtxHOxZGFMo/t1xqtSKdONwrMOz8uSS6BKYh

/6RoX+bNu1xiTRTwXWV+XheGH7niIZA6S8k3YbC11ec+i90ta57pAVKnkkeGLqxVdHWx

YxKKIevIbyU0/Ti5cszLTJQxsykLGZQyLbose4v/cqhJm1GHdM+1v4oMPiXQLcTzfzqX

Lo7SZ6NSxuectFxQcEmAko9kAjpQ8p9wPMwLBQu3tFeh/5neyhgcRMGhkXNyGNTki/tA

xPWw==;

darn=nl2k.ab.ca

ARC-Authentication-Results: i=1; mx.google.com; arc=none

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=ppk-ac-th.20251104.gappssmtp.com; s=20251104; t=1776003875; x=1776608675; darn=nl2k.ab.ca;

h=to:subject:message-id:date:from:reply-to:mime-version:from:to:cc

:subject:date:message-id:reply-to;

bh=hSdHXvGvxV7MRvfeVcTqnZOgtXM/agvdU0uDFSkftkQ=;

b=ZMEBjoMCgQUbemO6rF6e4jGFpJkbT9rvgc+wX++6+dY+6imlEnvOqJ5Q0YdKH+J3ML

cfrw89KjJxkhJJSEIQz2wjdMfYp2r2gPPlq+FNsjnj+7fVWrFm89jxwgDd1JRgUlRP1w

6cOqlBHVxrbaZ5O4SBkJKImt0vlCcEvqDIPaezqJ6Jw4LEzFmOldHSPRMiIjvkQGVbqK

4tAm9txKvK5TgOSQAljog5LRmsAgsF5wKCT/esrFQf54GaR7cNEcCODd+kufTMUuILB8

04+gPH6RRy2tTmLxM49CbfuvoB8VQvQ0OYzMeda+OMSSyTaCmS82q0T9OdPiOIQ9EWbX

vXBw==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20251104; t=1776003875; x=1776608675;

h=to:subject:message-id:date:from:reply-to:mime-version:x-gm-gg

:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to;

bh=hSdHXvGvxV7MRvfeVcTqnZOgtXM/agvdU0uDFSkftkQ=;

b=LrtwQ0l1XzjNcgq4/VLKFf8J98d4u0ZZwvD9otIcO+1K+K5a/in2+xr69PfBte7QpE

utLp7ISXRy7b2TEUQZsfhGGd6pr+U+ahCOhRKDeRDhN9XhoDZb9gWWGC7pJmClGcZQtH

n8HKkeZrLhiYdb86bl8p13RJYQIVBHVdu1/DIE8E21y50zSulBw76ZQceYVrrWDWXNL3

G7XjFBtGzhi+x/dOa/iHdZ92LMJpfzDFqcY1JuIl3lqVdxfGaJ1d4gSY8Eb9hIMS/9vQ

MhRvIdyiguF3WaLcuMh90eVgfpB+vqBOAA1LhjuCRD90DsgUWnTct5KAul531v97H1KI

XpeQ==

X-Forwarded-Encrypted: i=1; AFNElJ+hKTf+Ukj9WNuR7T2vd1IcW1LkVI42o233AAcO/k4O4anxg+uUkZQY1X9G2FmXy4oQQHpdrrQ=@nl2k.ab.ca

X-Gm-Message-State: AOJu0YwIQwlkR/7yNyMuw9QWoiYXck9nWYFf/aw0tdztuSMiXxdDmd9G

EjUooWYVwir/asAB9JD15Nd1YpQsW6fQZLOSigpGSoQLn4gYgt1ZfzgiD0DlcFIJWkx/XMN3H5D

uthhxMYz2IWyPZw4wH5iVUqwCOrbXhxr1R52iyhOh5g==

X-Gm-Gg: AeBDievJ2rjKV9/6n91uholiihp0y0A9S+TOy6vV5LZUdhkrWUEFwZJHRrAIDpaUfwa

YTpVm7uCqHZfq5HmDNP4ygDdJZzBny5s+DZyeBj0L4L7bGW/YJ6O35Wobz5RTkkfHIgCsuDZEAJ

Df2A5J7CHGuOcJodMNoymn0uwErekmsqYtFfZACFfvUHyzsrq+fDcfTksn3f0Ai0yFQWekPKP3X

nYDvDPb0D9QOyj25pvimGTaCUnXjE7hMBjrhK+BFss39s5JL7BCF4xvk00GMSbtRemhzRlZ23Cy

ZQUKoSK4hCo=

X-Received: by 2002:a05:6512:39cc:b0:5a2:7bd5:329e with SMTP id

2adb3069b0e04-5a3efb4e964mr3020645e87.37.1776003874080; Sun, 12 Apr 2026

07:24:34 -0700 (PDT)

MIME-Version: 1.0

Reply-To: servicegestionlocative148@gmail.com

From: Service Locative <33039@ppk.ac.th>

Date: Sun, 12 Apr 2026 14:24:37 +0200

X-Gm-Features: AQROBzDwzRTdXaOLYQd5CEIogsXcKj4qgNKcgpfIh49icVm9WI6ZFirodbCE8LI

Message-ID:

Subject: Rappel de paiement

To: undisclosed-recipients:;

Content-Type: multipart/alternative; boundary="00000000000008d4c9064f442034"

Bcc: doctor@nl2k.ab.ca

X-Spam_score: 8.3

X-Spam_score_int: 83

X-Spam_bar: ++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Chers locataires, Nous espérons que vous allez bien. Nous

vous écrivons aujourd’hui afin de vous informer d’un changement important

concernant le paiement de votre loyer. Dans un souci de simpli [...]



Content analysis details: (8.3 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[209.85.167.67 listed in list.dnswl.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[209.85.167.67 listed in dnsbl.ahbl.org]

[209.85.167.67 listed in dnsbl.ahbl.org]

[209.85.167.67 listed in dnsbl.ahbl.org]

[209.85.167.67 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[209.85.167.67 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[209.85.167.67 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[209.85.167.67 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[209.85.167.67 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[209.85.167.67 listed in will-spam-for-food.eu.org]

[209.85.167.67 listed in will-spam-for-food.eu.org]

[209.85.167.67 listed in will-spam-for-food.eu.org]

[209.85.167.67 listed in will-spam-for-food.eu.org]

[209.85.167.67 listed in will-spam-for-food.eu.org]

[209.85.167.67 listed in will-spam-for-food.eu.org]

[209.85.167.67 listed in will-spam-for-food.eu.org]

[209.85.167.67 listed in will-spam-for-food.eu.org]

-0.0 SPF_PASS SPF: sender matches SPF record

1.5 GR_DOMAIN_UNDISC1 To contains undisclosed recipient (undisc)

0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in digit

[servicegestionlocative148(at)gmail.com]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

0.0 RCVD_IN_VALIDITY_SAFE_BLOCKED RBL: ADMINISTRATOR NOTICE: The query to

Validity was blocked. See

https://knowledge.validity.com/hc/en-us/articles/20961730681243

for more information.

[209.85.167.67 listed in sa-accredit.habeas.com]

0.0 RCVD_IN_VALIDITY_RPBL_BLOCKED RBL: ADMINISTRATOR NOTICE: The query to

Validity was blocked. See

https://knowledge.validity.com/hc/en-us/articles/20961730681243

for more information.

[209.85.167.67 listed in bl.score.senderscore.com]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[209.85.167.67 listed in bl.score.senderscore.com]

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[209.85.167.67 listed in wl.mailspike.net]

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

2.5 FREEMAIL_FORGED_REPLYTO Freemail in Reply-To, but not From

Subject: {SPAM?} Rappel de paiement



Chers locataires,

Nous espérons que vous allez bien.

Nous vous écrivons aujourd’hui afin de vous informer d’un changement important concernant le paiement de votre loyer. Dans un souci de simplification, de rapidité et de sécurité, nous vous invitons à effectuer vos paiements par virement Interac, et ce à compter de ce mois-ci.

Ce nouveau mode de paiement nous permettra :



de suivre plus facilement les transactions,

de réduire les délais de traitement,

et de nous assurer que chaque loyer est bien reçu à temps.



Informations pour le virement :



Adresse courriel du destinataire : servicegestionlocative148@gmail.com



Question de sécurité : Facture

Réponse : Payer



Une fois le virement effectué, merci de nous en informer par retour de courriel. Si possible, nous vous invitons à joindre une capture d’écran ou une copie de l’ordre de virement, ce qui facilitera la mise à jour rapide de votre dossier.

Nous comprenons que ce changement puisse demander un petit temps d’adaptation. Soyez assuré(e) que nous restons disponibles pour vous accompagner tout au long de cette transition.

N’hésitez pas à nous contacter pour toute question ou assistance concernant votre premier virement.

Un grand merci pour votre collaboration et votre confiance. Votre confort et votre tranquillité d’esprit demeurent nos priorités.

Pour toute demande, vous pouvez nous écrire à : servicegestionlocative148@gmail.com



Bien cordialement,

Fedex Phish from sendgrid

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Sun, 12 Apr 2026 08:21:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1wBvfv-000000006C3-00nd

for dave@doctor.nl2k.ab.ca;

Sun, 12 Apr 2026 08:20:35 -0600

Resent-From: The Doctor

Resent-Date: Sun, 12 Apr 2026 08:20:34 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from s.wfbtztkb.outbound-mail.sendgrid.net ([159.183.231.27]:24140)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1wBvZ4-00000000OOV-1q9n

for sales@nk.ca;

Sun, 12 Apr 2026 08:13:32 -0600

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=perfectfitclosets.ca;

h=content-transfer-encoding:content-type:date:from:mime-version:subject:

to:cc:content-type:date:from:subject:to;

s=s1; t=1776003156; bh=dgTjN9KWVZdljRDXKJvzVAIxu083wDrWtYH0pCiL0lI=;

b=UpnRXb0UhldzUnAjUUHEa9NEg/5I3JJrV4Ok3EenhGUPaYLrkxvt/jwn67lcaXUsH7AM

7xpQEuVrefxsXk+IIVHBBb6u+Be/I1r5IUVTUD2kSnJ87vEf8gKNoa7uAgJHZJmWGn/7gJ

yT1QQXKmhJxV55gZEU04v93mdlPgf3q3hUDPzXB7NGtvcez5xU6b0aDz/I+kUX9xzDVwgP

ewFhQHEnl+oKSfaqaBEcpEwcaIXSMuVUbosezyG5Cslg6Ih6jy8AS4LIDvZFDqvo0eCNLp

DHczB0DBUop8ZXiWiS+P0wywtmPAYz6UHj92/wiI8+j/c0bymmNJ0ZYsxVlOK/aQ==

Received: by recvd-5845d65b6f-q6s9s with SMTP id recvd-5845d65b6f-q6s9s-1-69DBA853-BE

2026-04-12 14:12:35.964112443 +0000 UTC m=+162526.155406460

Received: from Mzg5MDY5MjY (unknown)

by geopod-ismtpd-0 (SG) with HTTP

id LThm21wgTX6F0jN7y2qAeQ

Sun, 12 Apr 2026 14:12:35.952 +0000 (UTC)

Content-Transfer-Encoding: quoted-printable

Content-Type: text/html; charset=us-ascii

Date: Sun, 12 Apr 2026 14:12:36 +0000 (UTC)

From: FedEx =?iso-8859-1?q?EXPRESS=AE?=

Mime-Version: 1.0

Message-ID:

Subject: Your parcel is waiting for instructions

X-SG-EID:

=?us-ascii?Q?u001=2EQqNlE5al1bvBBtqp7HdPg4UP2wHzFGm6w91pbB3KXUXLPLVBiJ1lNXRm+?=

=?us-ascii?Q?Y9wGR2o03GafpBLcdRZUkXCJmZ5mz8h6CftISnX?=

=?us-ascii?Q?uEJQgsuNU6KyhjSZF6Tx7DmcVFrLBN4vUkSzMmP?=

=?us-ascii?Q?2o8Hd2EKd5=2F=2FdxbvhRE8YaEwKxd5KdsfcPEJuF7?=

=?us-ascii?Q?S4EnxZJYmRfydGQZzm1jKKGM3+i7HX2c4+EwI30?=

=?us-ascii?Q?hVfEYcOps+XjZ9bZ4gqCwAPHypyn05c8IwhmZK=2F?= =?us-ascii?Q?3FdH?=

To: sales@nk.ca

X-Entity-ID: u001.v/heuvXHas+F6NykZsuNtw==

X-Spam_score: 40.4

X-Spam_score_int: 404

X-Spam_bar: ++++++++++++++++++++++++++++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: FedEx Your Parcel is waiting for owner instuctions .



Content analysis details: (40.4 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[159.183.231.27 listed in dnsbl.ahbl.org]

[159.183.231.27 listed in dnsbl.ahbl.org]

[159.183.231.27 listed in dnsbl.ahbl.org]

[159.183.231.27 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[159.183.231.27 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[159.183.231.27 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[159.183.231.27 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[159.183.231.27 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[159.183.231.27 listed in will-spam-for-food.eu.org]

[159.183.231.27 listed in will-spam-for-food.eu.org]

[159.183.231.27 listed in will-spam-for-food.eu.org]

[159.183.231.27 listed in will-spam-for-food.eu.org]

[159.183.231.27 listed in will-spam-for-food.eu.org]

[159.183.231.27 listed in will-spam-for-food.eu.org]

[159.183.231.27 listed in will-spam-for-food.eu.org]

[159.183.231.27 listed in will-spam-for-food.eu.org]

1.1 URIBL_GREY Contains an URL listed in the URIBL greylist

[URI: sendgrid.net]

2.5 URIBL_DBL_PHISH Contains a Phishing URL listed in the DBL blocklist

[URI: perfectfitclosets.ca]

0.1 URIBL_SBL_A Contains URL's A record listed in the SBL blocklist

[URI: appcenter-api.bignox.com/36.255.220.177]

-0.0 SPF_PASS SPF: sender matches SPF record

15 GR_DOMAIN_SENDGR1 Received contains spammer id (sendgr)

15 GR_DOMAIN_SENDGR6 URI: Body contains known spammer URI (sendgr)

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_IMAGE_ONLY_32 BODY: HTML: images with 2800-3200 bytes of words

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

0.6 HTML_MIME_NO_HTML_TAG HTML-only message, but there is no HTML tag

Subject: {SPAM?} Your parcel is waiting for instructions




,Segoe UI,Helvetica Neue,Arial,sans-serif; line-height: 22px; font-weight: =

bold; font-style: normal; font-size: 50px; text-decoration: none; text-tran=

sform: none; direction: ltr; color: #333333; text-align: left; mso-line-hei=

ght-rule: exactly; mso-text-raise: -2px;">
=3D"margin: 0; color: #843fa1; mso-line-height-rule: exactly;">Fed

pan class=3D"t1" style=3D"margin: 0; color: #e67e23; mso-line-height-rule: =

exactly;">Ex




,Segoe UI,Helvetica Neue,Arial,sans-serif; line-height: 22px; font-weight: =

bold; font-style: normal; font-size: 50px; text-decoration: none; text-tran=

sform: none; direction: ltr; color: #333333; text-align: left; mso-line-hei=

ght-rule: exactly; mso-text-raise: -2px;">
n: 0; color: #e67e23; mso-line-height-rule: exactly;"> 




,Segoe UI,Helvetica Neue,Arial,sans-serif; line-height: 22px; font-weight: =

bold; font-style: normal; font-size: 50px; text-decoration: none; text-tran=

sform: none; direction: ltr; color: #333333; text-align: left; mso-line-hei=

ght-rule: exactly; mso-text-raise: -2px;"> 



Your Parcel is waiting for owner ins=

tuctions .



Dear Customer,



Your parcel has arrived at our facility =

and is ready for the final step of delivery. To initiate the shipping proce=

ss, please complete the outstanding payment within the next 24 hours. You m=

ay proceed by following the link below. Should you have any questions, feel=

free to reach out—we’re happy to assist!




elvetica, arial, sans-serif;">
lick/v1/url?redirectUrl=3Dhttps://mail.trabalhosassemae.com.br/uhntyp28htyw=

5xrhfsvdfcau/">https://www.fedex.com/tracking?id=3DK0SQ24IU1JPNX8T<=

/strong>



Thank you for your prompt attention.



Best regards,

g>
le: exactly;">Fed

23; mso-line-height-rule: exactly;">Ex


://u38906926.ct.sendgrid.net/wf/open?upn=3Du001.47O2DjJnszqz5BkLM6ntPXkc5EC=

YGbR8j07FXis3P5ygSnq7IKirMicnBAS1-2BDjjtmHpIgtj2cErcrIG2vji4wpGT-2FVyfLd6qv=

Su0D3ZRlYTY33NO4rtVWQUgilKaogyFE53Q49HuQpKV-2FwqGCu8XKUFpZNHTXiNYQjd7ercks3=

rqr6G78IOE4BWtQE-2FFY8jX-2BOH5XXQJ6VPGdnSLER6yA-3D-3D" alt=3D"" width=3D"1"=

height=3D"1" border=3D"0" style=3D"height:1px !important;width:1px !import=

ant;border-width:0 !important;margin-top:0 !important;margin-bottom:0 !impo=

rtant;margin-right:0 !important;margin-left:0 !important;padding-top:0 !imp=

ortant;padding-bottom:0 !important;padding-right:0 !important;padding-left:=

0 !important;"/>

Fedex Phish from Sendgrid

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Sun, 12 Apr 2026 08:21:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1wBvfq-000000005kO-3y1T

for dave@doctor.nl2k.ab.ca;

Sun, 12 Apr 2026 08:20:30 -0600

Resent-From: The Doctor

Resent-Date: Sun, 12 Apr 2026 08:20:30 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from s.wfbtzhst.outbound-mail.sendgrid.net ([159.183.224.103]:15822)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1wBvX6-00000000NlW-2moJ

for root@nk.ca;

Sun, 12 Apr 2026 08:11:30 -0600

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=perfectfitclosets.ca;

h=content-transfer-encoding:content-type:date:from:mime-version:subject:

to:cc:content-type:date:from:subject:to;

s=s1; t=1776003034; bh=utq8fiy7gBJpOJh+qnuE5mWh3GhQTFvhwFvvGFwCYhc=;

b=k+3hRknFToniInBXLLXvm4IOPR68bFQcLMHglX65f9edzu50LCFkQjCacCwPou+MKMKM

CjruSwomXYAMZhxqh+4Z76gEgcjdu+83KtH+PKSDwK1pwU2Br0sayJ36qPvIpYfK5/85pC

Iqt3vQRGCUD3ooMba9XRo983NEOz21Z7RLFwsGIu28Cb5M631+l68TgXLIsnCMLQ9k6Osx

JRDnWwxldGCXtfyAvyvmttY1XFmvfzJX+AqHb1PLhWVJCEEo41y7tZn2b73VCybh40axFf

tQDcgKwMVKAGCgLrbXnl/38T2ZURURntNv0olP6wLSpLNxuhrtIKaSDHbYVX3Y5g==

Received: by recvd-5b8f9fcb4b-27t5f with SMTP id recvd-5b8f9fcb4b-27t5f-1-69DBA7DA-C

2026-04-12 14:10:34.062313713 +0000 UTC m=+162448.913651298

Received: from Mzg5MDY5MjY (unknown)

by geopod-ismtpd-21 (SG) with HTTP

id 7mDyADuGSYiLieTLg7gGZw

Sun, 12 Apr 2026 14:10:34.029 +0000 (UTC)

Content-Transfer-Encoding: quoted-printable

Content-Type: text/html; charset=us-ascii

Date: Sun, 12 Apr 2026 14:10:34 +0000 (UTC)

From: FedEx =?iso-8859-1?q?EXPRESS=AE?=

Mime-Version: 1.0

Message-ID: <7mDyADuGSYiLieTLg7gGZw@geopod-ismtpd-21>

Subject: Your parcel is waiting for instructions

X-SG-EID:

=?us-ascii?Q?u001=2EQqNlE5al1bvBBtqp7HdPg4UP2wHzFGm6w91pbB3KXUXLPLVBiJ1lNXRm+?=

=?us-ascii?Q?Y9wGR2o03GafpBLcdRZUkXCJmZ5mwVyYKUHDvDE?=

=?us-ascii?Q?QxjIIyKMmH=2F9amn4lJD32+z7WVxw2R3p=2FY0gCk6?=

=?us-ascii?Q?AWU1KxHcrm5bQo7p=2F=2FR9KpAcO0j9ztcA1X9FuMq?=

=?us-ascii?Q?eOTC42m=2FR1n1NoVtpEozosG1BuFrYmmkgJE5wWP?=

=?us-ascii?Q?1k8j1oKSSxVuLOv2hwVRKJB6KTQ5HREDgHsyStf?= =?us-ascii?Q?QX6C?=

To: root@nk.ca

X-Entity-ID: u001.v/heuvXHas+F6NykZsuNtw==

X-Spam_score: 40.4

X-Spam_score_int: 404

X-Spam_bar: ++++++++++++++++++++++++++++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: FedEx Your Parcel is waiting for owner instuctions .



Content analysis details: (40.4 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[159.183.224.103 listed in dnsbl.ahbl.org]

[159.183.224.103 listed in dnsbl.ahbl.org]

[159.183.224.103 listed in dnsbl.ahbl.org]

[159.183.224.103 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[159.183.224.103 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[159.183.224.103 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[159.183.224.103 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[159.183.224.103 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[159.183.224.103 listed in will-spam-for-food.eu.org]

[159.183.224.103 listed in will-spam-for-food.eu.org]

[159.183.224.103 listed in will-spam-for-food.eu.org]

[159.183.224.103 listed in will-spam-for-food.eu.org]

[159.183.224.103 listed in will-spam-for-food.eu.org]

[159.183.224.103 listed in will-spam-for-food.eu.org]

[159.183.224.103 listed in will-spam-for-food.eu.org]

[159.183.224.103 listed in will-spam-for-food.eu.org]

1.1 URIBL_GREY Contains an URL listed in the URIBL greylist

[URI: sendgrid.net]

2.5 URIBL_DBL_PHISH Contains a Phishing URL listed in the DBL blocklist

[URI: perfectfitclosets.ca]

0.1 URIBL_SBL_A Contains URL's A record listed in the SBL blocklist

[URI: appcenter-api.bignox.com/36.255.220.177]

-0.0 SPF_PASS SPF: sender matches SPF record

15 GR_DOMAIN_SENDGR1 Received contains spammer id (sendgr)

15 GR_DOMAIN_SENDGR6 URI: Body contains known spammer URI (sendgr)

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_IMAGE_ONLY_32 BODY: HTML: images with 2800-3200 bytes of words

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

0.6 HTML_MIME_NO_HTML_TAG HTML-only message, but there is no HTML tag

Subject: {SPAM?} Your parcel is waiting for instructions




,Segoe UI,Helvetica Neue,Arial,sans-serif; line-height: 22px; font-weight: =

bold; font-style: normal; font-size: 50px; text-decoration: none; text-tran=

sform: none; direction: ltr; color: #333333; text-align: left; mso-line-hei=

ght-rule: exactly; mso-text-raise: -2px;">
=3D"margin: 0; color: #843fa1; mso-line-height-rule: exactly;">Fed

pan class=3D"t1" style=3D"margin: 0; color: #e67e23; mso-line-height-rule: =

exactly;">Ex




,Segoe UI,Helvetica Neue,Arial,sans-serif; line-height: 22px; font-weight: =

bold; font-style: normal; font-size: 50px; text-decoration: none; text-tran=

sform: none; direction: ltr; color: #333333; text-align: left; mso-line-hei=

ght-rule: exactly; mso-text-raise: -2px;">
n: 0; color: #e67e23; mso-line-height-rule: exactly;"> 




,Segoe UI,Helvetica Neue,Arial,sans-serif; line-height: 22px; font-weight: =

bold; font-style: normal; font-size: 50px; text-decoration: none; text-tran=

sform: none; direction: ltr; color: #333333; text-align: left; mso-line-hei=

ght-rule: exactly; mso-text-raise: -2px;"> 



Your Parcel is waiting for owner ins=

tuctions .



Dear Customer,



Your parcel has arrived at our facility =

and is ready for the final step of delivery. To initiate the shipping proce=

ss, please complete the outstanding payment within the next 24 hours. You m=

ay proceed by following the link below. Should you have any questions, feel=

free to reach out—we’re happy to assist!




elvetica, arial, sans-serif;">
lick/v1/url?redirectUrl=3Dhttps://mail.trabalhosassemae.com.br/uhntyp28htyw=

5xrhfsvdfcau/">https://www.fedex.com/tracking?id=3DK0SQ24IU1JPNX8T<=

/strong>



Thank you for your prompt attention.



Best regards,

g>
le: exactly;">Fed

23; mso-line-height-rule: exactly;">Ex


://u38906926.ct.sendgrid.net/wf/open?upn=3Du001.EtyC8XKcPmGZYDmBykh8zWLvUP7=

e1n8NGu6u5F3t1ztJa1SpqLPaq-2F-2B9DY7z-2BaKjkiaA2kB1A-2BcXamt-2FnYSr0wG9nJD2=

FS-2BDl27G2kWlRF23jnyIBVQ-2BOy5E9yo2Mw1RxliIgdldIVNBA8ZHHjiwzfGm-2BCmJ9rGoM=

JxlMInTYzgCbOYVM1Ek4Gb2FCkFOzn3d-2B5UgfsdwEwDg3AzQMTVmQ-3D-3D" alt=3D"" wid=

th=3D"1" height=3D"1" border=3D"0" style=3D"height:1px !important;width:1px=

!important;border-width:0 !important;margin-top:0 !important;margin-bottom=

:0 !important;margin-right:0 !important;margin-left:0 !important;padding-to=

p:0 !important;padding-bottom:0 !important;padding-right:0 !important;paddi=

ng-left:0 !important;"/>

Fedex Phish from Sendgrid

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Sun, 12 Apr 2026 08:21:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1wBvfi-000000005df-2gGl

for dave@doctor.nl2k.ab.ca;

Sun, 12 Apr 2026 08:20:22 -0600

Resent-From: The Doctor

Resent-Date: Sun, 12 Apr 2026 08:20:22 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from s.wfbtztkb.outbound-mail.sendgrid.net ([159.183.231.27]:24856)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1wBvMB-00000000Mw5-0nke

for root@nk.ca;

Sun, 12 Apr 2026 08:00:18 -0600

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=perfectfitclosets.ca;

h=content-transfer-encoding:content-type:date:from:mime-version:subject:

to:cc:content-type:date:from:subject:to;

s=s1; t=1776002355; bh=VK3VoyGSUaWB0GshfM++lgXPYj5MhmlcWconV0HAAQo=;

b=V/3JkbH3fpbcGCOR13HqjxmeJQTokQXpZE/Xw20M8vagJMw0juUVB5+zY/0CapUaqRdZ

SuPWsqpni/aX5/1PAne03z1YcLxzKu20cau3gIdJou8Y7T/E4AUGXJFRkNLkXvAzhTIqCF

XCmBTx0lUfWK3+SPoBZIwAoUOaM+IOj9G6MFf+PcLoHKztbkvEeg4UIajCNyhZiJ3j6IOh

iCDritacuxux3dxjyTj5ueS3Vu5rXovbd+AEqO5rzz+8KEIR+U+waJCrH7GOvgSdUDOxYa

/PoPCZKUKexjIC7duTv95e+lgxlGSZH9tyGteFKZilnJmQhCmaklXx0y/XLyVtkg==

Received: by recvd-6cb6c68998-4jn8w with SMTP id recvd-6cb6c68998-4jn8w-1-69DBA533-17

2026-04-12 13:59:15.571016906 +0000 UTC m=+161716.721229676

Received: from Mzg5MDY5MjY (unknown)

by geopod-ismtpd-14 (SG) with HTTP

id 8RWG9OhMQ9u5R3IfH596Kw

Sun, 12 Apr 2026 13:59:15.542 +0000 (UTC)

Content-Transfer-Encoding: quoted-printable

Content-Type: text/html; charset=utf-8

Date: Sun, 12 Apr 2026 13:59:15 +0000 (UTC)

From: FedEx Tracking

Mime-Version: 1.0

Message-ID: <8RWG9OhMQ9u5R3IfH596Kw@geopod-ismtpd-14>

Subject: We've updated your estimated delivery

X-SG-EID:

=?us-ascii?Q?u001=2EQqNlE5al1bvBBtqp7HdPgxedUqGYuBWmx7JGl4mIJfmePVUn0lHb9CXNn?=

=?us-ascii?Q?0DyQ=2F0CCy350ge5NTBTE3br7LM8v7kXBs3I0waf?=

=?us-ascii?Q?zpDj=2F37NiGrwggsEs05+8EnWszh38=2FUN8pMd6Cw?=

=?us-ascii?Q?gjlUrrNn=2FQaTp6yJHLtq6xObOAroSHX5k90yvKE?=

=?us-ascii?Q?5LRh47qUk+MeGlbO8AgXu1kMATuMCvMkcXYGONQ?=

=?us-ascii?Q?++kkil9a0S7hC3fPpJKw53XpqjNTVbne7J4aLFA?= =?us-ascii?Q?Q4=2Ff?=

To: root@nk.ca

X-Entity-ID: u001.v/heuvXHas+F6NykZsuNtw==

X-Spam_score: 39.7

X-Spam_score_int: 397

X-Spam_bar: +++++++++++++++++++++++++++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: FedEx Delivery Notification We’ve updated the estimated

delivery of your shipment. N/A Delivery Date 06:59:15 Confirm and Resolve

Charges Tracking details Tracking ID #&NUMBER14; CANADA 06:59:15 To CANADA

Number of pieces 1 T [...]



Content analysis details: (39.7 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[159.183.231.27 listed in dnsbl.ahbl.org]

[159.183.231.27 listed in dnsbl.ahbl.org]

[159.183.231.27 listed in dnsbl.ahbl.org]

[159.183.231.27 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[159.183.231.27 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[159.183.231.27 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[159.183.231.27 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[159.183.231.27 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[159.183.231.27 listed in will-spam-for-food.eu.org]

[159.183.231.27 listed in will-spam-for-food.eu.org]

[159.183.231.27 listed in will-spam-for-food.eu.org]

[159.183.231.27 listed in will-spam-for-food.eu.org]

[159.183.231.27 listed in will-spam-for-food.eu.org]

[159.183.231.27 listed in will-spam-for-food.eu.org]

[159.183.231.27 listed in will-spam-for-food.eu.org]

[159.183.231.27 listed in will-spam-for-food.eu.org]

2.5 URIBL_DBL_PHISH Contains a Phishing URL listed in the DBL blocklist

[URI: symbioproject.com]

[URI: perfectfitclosets.ca]

1.1 URIBL_GREY Contains an URL listed in the URIBL greylist

[URI: sendgrid.net]

0.0 URIBL_RED Contains an URL listed in the URIBL redlist

[URI: symbioproject.com]

-0.0 RCVD_IN_MSPIKE_H3 RBL: Good reputation (+3)

[159.183.231.27 listed in wl.mailspike.net]

-0.0 SPF_PASS SPF: sender matches SPF record

-0.0 RCVD_IN_MSPIKE_WL Mailspike good senders

15 GR_DOMAIN_SENDGR1 Received contains spammer id (sendgr)

15 GR_DOMAIN_SENDGR6 URI: Body contains known spammer URI (sendgr)

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

Subject: {SPAM?} We've updated your estimated delivery



FedEx

We’ve updated the estimated delivery of your shipment. N/A

Delivery Date

06:59:15

Confirm and Resolve Charges

Tracking details

Tracking ID #&NUMBER14;

CANADA 06:59:15

To CANADA

Number of pieces 1

Total shipment weight 2.40 LB

Service FedEx International Connect Plus

TRACK SHIPMENT



icon Please do not respond to this message. This email was sent from an unattended mailbox. This report was generated at approximately CANADA



All weights are estimated.



To track the latest status of your shipment, click on the tracking number above.



Standard transit is the date and time the package is scheduled to be delivered by, based on the selected service, destination and ship date. Limitations and exceptions may apply. Please see the FedEx Service Guide for terms and conditions of service, including the FedEx Money-Back Guarantee, or contact your FedEx Customer Support representative.



© 2026 Federal Express Corporation. The content of this message is protected by copyright and trademark laws under U.S. and international law. Review our Privacy Notice. All rights reserved.



Thank you for your business.



ID: 1026



French language rental phish from Google Gmail

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path: <33039@ppk.ac.th>

Envelope-to: dave@nk.ca

Delivery-date: Sun, 12 Apr 2026 08:21:00 -0600

Received: from mail-lf1-f67.google.com ([209.85.167.67]:52309)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.98.2 (FreeBSD))

(envelope-from <33039@ppk.ac.th>)

id 1wBvfj-0000000057n-0OeD

for dave@nk.ca;

Sun, 12 Apr 2026 08:20:32 -0600

Received: by mail-lf1-f67.google.com with SMTP id 2adb3069b0e04-59dea72099eso3413721e87.0

for ; Sun, 12 Apr 2026 07:19:36 -0700 (PDT)

ARC-Seal: i=1; a=rsa-sha256; t=1776003569; cv=none;

d=google.com; s=arc-20240605;

b=jGMxgb/3DNM4Bga2e9ya8f1fdAojc7vB2Mym+NtTDA7pXKCgP3wWqi9cbrNx1c5Dgj

sAmy6qESzKyB1+GWz7YggkGWvs/ysZyWKNoEJ0yTcOTK584g+k3O1ObO7FO/xNYGQRcp

omnOTEafCBzfYsFjKcVzqqiS5nvAs08CvZHq5/QTJ1VXbA+L1eKPSIb+UDvG83Z9QMsX

73VSrr2Qo60iI/QG9bZFxk5d76JRa/jCSBq73/RsVZN+ZckgweOZIE9AzfIeT6cS7z5k

9EA3ovQWsSsjq58X7hvLJXDDGmWiMfOeKc4+Kzk3oUIImyqqaTKHlZuU2O0B7lqnhOoP

PQaw==

ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20240605;

h=to:subject:message-id:date:from:reply-to:mime-version

:dkim-signature;

bh=cmnecNb47a9TmsOI2vIYpGIqs6BwSQ+B/iuYnrZXZDM=;

fh=CTyG2AI6b7/Lnd90Wpvf0l7OM+XjUsCR9umBXbd3ves=;

b=Y0CXyrTTHfdNLSFMSbevS0rN6uYlmmOaYcsBu9ZWdduxBh6ihT3Nak6dq+wU11HxK3

t21SJdf4d3dyHfnKKKoGi2oYaiYrjo1E/DhNebp8cr0pWkD4U8CERvr8a30w2UmLVO3k

icd7omH5Lxqtuv47A9y6ongSN9iJ5iZQ6R9mgqpC4gEEPO08icUvSy8zKHD4b79hvzqg

PIaYZbVar8z8o+qS124BLCQMopaLeIVr2YyUXCVA5JzkUq3d6b2F1/MK2alGkUOHJec4

3/QojF6qVk5dQ1UVcn6/EEU9XaIPdllKlw/Ivcj/BfJzKDs6nLlpmOI2IfzPLdgjqRnd

VWOA==;

darn=nk.ca

ARC-Authentication-Results: i=1; mx.google.com; arc=none

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=ppk-ac-th.20251104.gappssmtp.com; s=20251104; t=1776003569; x=1776608369; darn=nk.ca;

h=to:subject:message-id:date:from:reply-to:mime-version:from:to:cc

:subject:date:message-id:reply-to;

bh=cmnecNb47a9TmsOI2vIYpGIqs6BwSQ+B/iuYnrZXZDM=;

b=DESjOw234l2rEw8xGqgaPEWerX2/qHB3bQFpzx0LtFe8HI516tLDugIWtwHyS2fAI2

hvXsgv4nk6tVGm2ij++aFb3Xgre1AbPHnhRj6dbnVcbWmz6et6FpDfipFXq8WtEkt7Un

EQITFTVRiWRAC7O7Qn57a64obEMp4CWCUTHDVij3dVArfhIxWtsJhys10dKIByLScYAz

H0v6912ujd/qatqGB0LXgncSOYC8KyQivlemuHBQCtftPU9QFI5qHj3CUUWz0r11Enjb

Zg5WhPzQnkYROys1mQ/0DWZTBY6q2SkYAb7ZBItpudV6teNT3y6gMRMmu67JQan+mpFm

0kJA==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20251104; t=1776003569; x=1776608369;

h=to:subject:message-id:date:from:reply-to:mime-version:x-gm-gg

:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to;

bh=cmnecNb47a9TmsOI2vIYpGIqs6BwSQ+B/iuYnrZXZDM=;

b=E8sTkyPFLserR3YHWCsFEeGCCOAJsdBenb5BVcMryVnMQOM2Js31oJLGlrBeA9KULe

N6KZpu+3d+kbrWfZvmXXpEAeMHIrYYaiD9fxLt7d7/zL0ytP5AD/0E75hgCdZEtmgXtl

S6dpJWrULtGV5v8anIOk19E1oYleoAXcbobv6GkVa4QCj6i2TOKZzEXWTNKwAh9uuQ4t

NTgG/06/4EG5DLs4Va0f9Ne9EcJbe4SIKRb+rkDjmpizGXZC08S2BFCR4xKWa1D5TnY1

okogLEj9jlI4oqQFFRzcGQ1rlG1Vghn7w4xChoGJHxpC4DX8n1ixGIqbrKnfwtQMhdAO

fLYQ==

X-Forwarded-Encrypted: i=1; AFNElJ+FzS/KilSjhmH41HgrLfk2Vr2IWL4BKGf18lYmbBoMZVyMfKTAlczKLbxfsIX/z0T5da3S@nk.ca

X-Gm-Message-State: AOJu0YwOqgp1e02TcWEfsaq9Qz/XXzV/TqW67RL3D/r59nv2L3NOtMy+

cmVBxiyZyx8WLIl60KyMOOblishXD1Xg5dhMaJ/zZUqApwEJg9vTgyBUjP+iYipPo0eNQ75Jh0W

nYGYLtRWjs+hrzNFulTTCN/pN5O1myPdG3xHHJfWUVw==

X-Gm-Gg: AeBDievd0jdauOFVZzeLU/AWBcLpkgidK28kl2paBWD/KEECUkMv8p2TdrJEKBAqT+l

aOHMYTffChKguF7C9wOnD7WN363n2Jev+DOTnXW20z2hYRguBaxvGt7cowKFmAOihwImTdbDM0C

YZJDMiMOSd15JopMnX5dGpGkObqcEBpTih1En3yL+n6Zo2kz3gWVklEwgTOJiL1l8O3RvEHgvTN

QOkwKC4oF5A/EM3tQhbqnmlUPEYJCs1oc3qs45LZimA4qI8ayz6C/OLGMNa/vlWE2PPs8KwYpZ1

nb2FtLMfp4iLKrya9b/1eg==

X-Received: by 2002:a05:6512:3ca6:b0:5a2:a355:aa4e with SMTP id

2adb3069b0e04-5a3efb4584bmr3176936e87.31.1776003568152; Sun, 12 Apr 2026

07:19:28 -0700 (PDT)

MIME-Version: 1.0

Reply-To: servicegestionlocative148@gmail.com

From: Service Locative <33039@ppk.ac.th>

Date: Sun, 12 Apr 2026 14:19:31 +0200

X-Gm-Features: AQROBzBAn8i0h3SKV7Q9IyL7QkfrlQp3yf-qhh34W9z0sPQb-92o_Gpb1jx3VUE

Message-ID:

Subject: Rappel de paiement

To: undisclosed-recipients:;

Content-Type: multipart/alternative; boundary="000000000000ccc53f064f440d3c"

Bcc: dave@nk.ca

X-Spam_score: 8.3

X-Spam_score_int: 83

X-Spam_bar: ++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Chers locataires, Nous espérons que vous allez bien. Nous

vous écrivons aujourd’hui afin de vous informer d’un changement important

concernant le paiement de votre loyer. Dans un souci de simpli [...]



Content analysis details: (8.3 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[209.85.167.67 listed in dnsbl.ahbl.org]

[209.85.167.67 listed in dnsbl.ahbl.org]

[209.85.167.67 listed in dnsbl.ahbl.org]

[209.85.167.67 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[209.85.167.67 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[209.85.167.67 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[209.85.167.67 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[209.85.167.67 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[209.85.167.67 listed in will-spam-for-food.eu.org]

[209.85.167.67 listed in will-spam-for-food.eu.org]

[209.85.167.67 listed in will-spam-for-food.eu.org]

[209.85.167.67 listed in will-spam-for-food.eu.org]

[209.85.167.67 listed in will-spam-for-food.eu.org]

[209.85.167.67 listed in will-spam-for-food.eu.org]

[209.85.167.67 listed in will-spam-for-food.eu.org]

[209.85.167.67 listed in will-spam-for-food.eu.org]

0.0 RCVD_IN_VALIDITY_SAFE_BLOCKED RBL: ADMINISTRATOR NOTICE: The query to

Validity was blocked. See

https://knowledge.validity.com/hc/en-us/articles/20961730681243

for more information.

[209.85.167.67 listed in sa-accredit.habeas.com]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[209.85.167.67 listed in list.dnswl.org]

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[209.85.167.67 listed in wl.mailspike.net]

0.0 RCVD_IN_VALIDITY_RPBL_BLOCKED RBL: ADMINISTRATOR NOTICE: The query to

Validity was blocked. See

https://knowledge.validity.com/hc/en-us/articles/20961730681243

for more information.

[209.85.167.67 listed in bl.score.senderscore.com]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[209.85.167.67 listed in bl.score.senderscore.com]

-0.0 SPF_PASS SPF: sender matches SPF record

1.5 GR_DOMAIN_UNDISC1 To contains undisclosed recipient (undisc)

0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in digit

[servicegestionlocative148(at)gmail.com]

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

2.5 FREEMAIL_FORGED_REPLYTO Freemail in Reply-To, but not From

Subject: {SPAM?} Rappel de paiement



Chers locataires,

Nous espérons que vous allez bien.

Nous vous écrivons aujourd’hui afin de vous informer d’un changement important concernant le paiement de votre loyer. Dans un souci de simplification, de rapidité et de sécurité, nous vous invitons à effectuer vos paiements par virement Interac, et ce à compter de ce mois-ci.

Ce nouveau mode de paiement nous permettra :



de suivre plus facilement les transactions,

de réduire les délais de traitement,

et de nous assurer que chaque loyer est bien reçu à temps.



Informations pour le virement :



Adresse courriel du destinataire : servicegestionlocative148@gmail.com



Question de sécurité : Facture

Réponse : Payer



Une fois le virement effectué, merci de nous en informer par retour de courriel. Si possible, nous vous invitons à joindre une capture d’écran ou une copie de l’ordre de virement, ce qui facilitera la mise à jour rapide de votre dossier.

Nous comprenons que ce changement puisse demander un petit temps d’adaptation. Soyez assuré(e) que nous restons disponibles pour vous accompagner tout au long de cette transition.

N’hésitez pas à nous contacter pour toute question ou assistance concernant votre premier virement.

Un grand merci pour votre collaboration et votre confiance. Votre confort et votre tranquillité d’esprit demeurent nos priorités.

Pour toute demande, vous pouvez nous écrire à : servicegestionlocative148@gmail.com



Bien cordialement,

Transfer.it phish

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Sat, 11 Apr 2026 18:48:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1wBizE-00000000OB0-1V86

for dave@doctor.nl2k.ab.ca;

Sat, 11 Apr 2026 18:47:40 -0600

Resent-From: The Doctor

Resent-Date: Sat, 11 Apr 2026 18:47:40 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from relay5.api.mega.co.nz ([66.203.124.5]:47161)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1wBgb3-00000000P1J-3ALH

for root@nk.ca;

Sat, 11 Apr 2026 16:14:43 -0600

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=transfer.it;

s=transferit-api; t=1775945623;

bh=Zwz7gHjwZ+L4oNbPCJRfXivW258rSN9u0BoYpfRTjvs=;

h=Date:To:From:Subject:From;

b=Qiaavp7bYZ9b+/odYJajcGn97jQ7u/K6GJSHAYxrEgGwpMpprHXKYZk89FeQRunyU

he9dNnUapU8XpuUaXn1j8Q85jy2tOjJqOZCkoyXpqFlWiGSXpQ+gSeOdV7Q+ndmHG4

U38dS6+/OamG5UPqfge7xBwo1wYtEF0STt2eawi7HKmOVSB86ynuur7sQ2D2f7citz

IioKoDNydjJ7BzsBzLW8Z+oIdPzmN2EZD3B7MOORA2GfcaSvXTY9sMBVN8+3tnSh1P

Sew9GjXZZeC8tID49eLMzF71ciDYHCLeflqX6pue53vHuiz9UJ+FxN6fto3KxjltnX

qRZSTN1adgeyQ==

Received: from mega475 (bt7.api.mega.co.nz [66.203.125.17])

by relay5.api.mega.co.nz (Postfix) with ESMTP id 11F41182278

for ; Sun, 12 Apr 2026 00:13:43 +0200 (CEST)

Date: Sat, 11 Apr 2026 22:13:43 +0000

To: root@nk.ca

From: "Transfer.it"

Subject: Your Transfer.it upload is ready to share!

Message-ID:

MIME-Version: 1.0

Content-Type: multipart/alternative;

boundary="b1_ZILpz5kCbZPUScDS3485VJj4eDZ2C0XTqbg9kk9Xg"

Content-Transfer-Encoding: 8bit



Your transfer is ready!



Transfer it logo



Hi there,



Your transfer, “WCC443-I HAVE SOMETHING IMPORTANT AND INTERESTING TO TELL YOU ABOUT YOUR LIFE. PLEASE REPLY TO ME IMMEDIATELY AT MY EMAIL ADDRESS donaldaalan@outlook.com BY CLICKING ON IT TO REPLY TO ME DIRECTLY.-ANE858”, is good to go!



Here’s the link so you can start sharing it:

https://transfer.it/t/upQhKWwH1DST



You can view your transfer at any time to check stats or update settings.

View your transfer



1 item • 183 B in total • Expires on 2026-07-10



We’ll also send you a quick email when someone accesses it.



Let the sharing begin 🎉



Cheers,

The Transfer.it team



Powered by MEGA Privacy Company



About • Privacy • Terms • Report this transfer

Web/SEO/App spam from Microsoft Outlook Part 2

--_000_KL1PR01MB40172B5EEEFD5007A42EF283E1262KL1PR01MB4017apcp_

Content-Type: text/plain; charset="iso-8859-1"

Content-Transfer-Encoding: quoted-printable



Can I send the audit

________________________________

From: Nagina Khan

Sent: Wednesday, April 8, 2026 4:01 PM

Subject: Re: Top Rank?



Hi,



Noticed a few SEO issues on your site that could be fixed quickly.



Can I send you a screenshot?



Just reply "Yes" or "Sure."





--_000_KL1PR01MB40172B5EEEFD5007A42EF283E1262KL1PR01MB4017apcp_

Content-Type: text/html; charset="iso-8859-1"

Content-Transfer-Encoding: quoted-printable








1">








nt, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; c=

olor: rgb(0, 0, 0);">

Can I send the audit








, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">

From: Nagina Khan


Sent: Wednesday, April 8, 2026 4:01 PM


Subject: Re: Top Rank?



Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; fo=

nt-size: 12pt; color: rgb(0, 0, 0);">

 





argin: 0in 0in 0.0001pt; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFo=

ntService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0=

, 0);">

Hi,



.0001pt; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calib=

ri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">

 



.0001pt; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calib=

ri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">

Noticed a few SEO issues on your site that could be fixed quickly.



.0001pt; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calib=

ri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">

 



.0001pt; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calib=

ri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">

Can I send you a screenshot?



.0001pt; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calib=

ri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">

 



1.5pt solid windowtext;">


.0001pt; padding: 0in; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFont=

Service, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, =

0);">

Just reply "Yes" or "Sure."





nt, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; c=

olor: rgb(0, 0, 0);">












--_000_KL1PR01MB40172B5EEEFD5007A42EF283E1262KL1PR01MB4017apcp_--

Web/SEO/App spam from Microsoft Outlook Part 1

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Sat, 11 Apr 2026 13:31:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1wBe2m-00000000EbN-1OPE

for dave@doctor.nl2k.ab.ca;

Sat, 11 Apr 2026 13:31:00 -0600

Resent-From: The Doctor

Resent-Date: Sat, 11 Apr 2026 13:31:00 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-japaneastazolkn19012059.outbound.protection.outlook.com ([52.103.43.59]:35648 helo=TYPPR03CU001.outbound.protection.outlook.com)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1wBYq2-00000000CvO-1S5H

for sales@nk.ca;

Sat, 11 Apr 2026 07:57:41 -0600

ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none;

b=oCiwck/kvBO6bKK3xKrNUrXI6igoZX5IHOaLa73OswLJTRsH40XJ1v2vin6IkXtG7vJjOwRX2vm0bhYFR4b+Ce1F2VYf28vF2uKafTmjugr/p/udAbOlEJfGzK9rJT2S7YFgWheYRTWwar0Ikvz4wkT4c6LquxEWkxEMSxT0REA5uTcgpJkNeQpm1iLu5Xurwj8Ttx+WaudqUsmQcbvrO+/sKImNCvkPKjCk0ypVAJO8IoRJxd1Yb9Hw0tCICHe5l4yhHhX0bY70JHXOil/P9fmWXLNf0uXGKgD3t2z0YIgxJQJ5QmwU44eBLkqALtkgbkdncRZvBYTUqTNDd/a3eA==

ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;

s=arcselector10001;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1;

bh=NKlBXMPrJIkHL48aBgJe2wjRoW+kF1ilOzN1lTgvrys=;

b=iLie+iLPMsOx/kuREPZeqAZNjHmL1sFbK9K/AvPp9hy1BX8XggZnBjaZxBQKRaxfRt2FK1VeF5/nmVPX0eE0BxCxvDv6cut+CmwJI6cSbpTG66RpS//42YkLMtWUgTb7gRDrQmLCgYXMdbcK2pmoenvwwKIQ6KIg6PH7vk4nRgxyJhKJM4OzJXBbN6HsS4PyuE4j+Lj/O3skse5pJvlBFrp3FNqp8FauhgBK3nZYoO4qBrsnsq85pBvpSGJJFbfkFx+u7AJ0FMpVCDtT0y5V6rvsuruOBMK2C1MGeXOI6qypT9fTKjWrlUEP6/nVeMnJFP5KmSnyDX/PDjRT3eWlRw==

ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=none; dmarc=none;

dkim=none; arc=none

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=outlook.com;

s=selector1;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck;

bh=NKlBXMPrJIkHL48aBgJe2wjRoW+kF1ilOzN1lTgvrys=;

b=EpHr0VKf8JTwnKvZaMDuyxL8o5IvtIksGMeBxPTkolBbgg/oGaxWQIguMP+7H5iehkNZUkU0l2ovdKNCECtua6Ea7FtIBHImZf55J5r2uE91ktAclmKLpv4lAyUtKQb4Lb9HnVXapwaupzIWwv7MxxMxb8N/VQO2HlFHNpRzdiasPffN38uHoQ8atjAV4raykhFbxhXVR+qzKvNe0QJLt2tRxXStPXLQ1GzFNQMPlNm/Z/l8L6M+vFXqBWdQobn6lbjITEU3VfhuBmFvRCkgXmAnOlGlJ4hQDljFg3imFRERHIxjyLoCioKlTnnbFIlgJB1+bU93UeoytMXlp1FPJA==

Received: from KL1PR01MB4017.apcprd01.prod.exchangelabs.com

(2603:1096:820:41::9) by TYZPR01MB5524.apcprd01.prod.exchangelabs.com

(2603:1096:400:363::11) with Microsoft SMTP Server (version=TLS1_2,

cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.9769.45; Sat, 11 Apr

2026 13:55:58 +0000

Received: from KL1PR01MB4017.apcprd01.prod.exchangelabs.com

([fe80::2823:efd9:768:85d0]) by KL1PR01MB4017.apcprd01.prod.exchangelabs.com

([fe80::2823:efd9:768:85d0%6]) with mapi id 15.20.9769.044; Sat, 11 Apr 2026

13:55:56 +0000

From: Nagina Khan

Subject: Re: screenshot

Thread-Topic: screenshot

Thread-Index: AQHcybrTqdfdrE2EwkuNCgH98KSx5A==

Date: Sat, 11 Apr 2026 13:55:56 +0000

Message-ID:



Accept-Language: en-US

Content-Language: en-US

X-MS-Has-Attach:

X-MS-TNEF-Correlator:

msip_labels:

x-ms-publictraffictype: Email

x-ms-traffictypediagnostic: KL1PR01MB4017:EE_|TYZPR01MB5524:EE_

x-ms-office365-filtering-correlation-id: 41c202aa-c5ba-482f-314e-08de97d20ddd

x-microsoft-antispam:

BCL:0;ARA:14566002|461199028|7071999006|24071999003|15030799006|15080799012|22091999003|24121999003|37011999003|25031999004|8062599012|20031999003|39105399006|31061999003|19110799012|8060799015|3412199025|440099028|26121999003|102099032|25131999003|19061999003|35041999009|40105399003|39145399003|41105399003;

x-microsoft-antispam-message-info:

=?iso-8859-1?Q?Ea6DjsnSyhOKVZPE6cafyA246mJz2UWWpIk5ytp9OGXLN9ebqtI98THkZh?=

=?iso-8859-1?Q?sAF+SVsec+9fbIdjL/9+JiOfCQm99abAZpjgCKiGcgQZE+Hx2IX90CXiCu?=

=?iso-8859-1?Q?jiiEnwR40Id8AsE/QXaCLQnas7OQ6gA3PEBV13W2IVSbpygmxnZB1fF1gU?=

=?iso-8859-1?Q?RG1M6cNVoSrzjNgH18VtXLkKE28GpTiqaVCz76VESKM6HleTBAQ2CMe7R5?=

=?iso-8859-1?Q?22BGHQStxHXKKshg9VjPWhVYmDQu+a2R8woffpzmpDGE5B7euyewXzPG1z?=

=?iso-8859-1?Q?jhsSUSXR2RYoOoaMcbu2feCryEq/jYf9PcIU5R0PQ3e+ZfChTFUTS3kXEP?=

=?iso-8859-1?Q?yVX4cQoUc4IAnnwSoHS86dmPrtmJFVqtMHBPY8kmuATFkCdHDLmzO9J6dB?=

=?iso-8859-1?Q?Tbc26oSYkxPuumc+lbFvj0/uLBZRHcnO8RUlfqhbsQFhO+++v0X5ghRAck?=

=?iso-8859-1?Q?gjO5E//szkRYSMGJ4w0DRkovXv/GfQOVnFzI7IKX4sZXF5+s2iK3amdn9I?=

=?iso-8859-1?Q?tl8kZLZ41n+9dkVuFWF1zwHJq9LlDzjJzFmHooiUAM0SQau9t9d3YuXBSM?=

=?iso-8859-1?Q?Hm29Befy/cPf02P61DLZtyziUcRPzkI0p9F360CeV3qJIoKYBkL57hq5uy?=

=?iso-8859-1?Q?Z2lQUE2Injd05BLJEnNi0eXMZGSRumhWru+I3PdFtLJekEwbudpU5c/gfu?=

=?iso-8859-1?Q?IhJJyN/FRdeB0u6YPgx9bqiexVYaRbc7XCDj14LckU08XI0HswBDkuWmGY?=

=?iso-8859-1?Q?tOA398C7qPzhZL9kFOKlLa9xNM0NkfAVmqQslVnR7d2REPYXIXh8VRO3l4?=

=?iso-8859-1?Q?C08QYt4txruFUScaN31Y5zI0iJGdValT2+Ek49nfL9l9QcYvRaqU9jGcI7?=

=?iso-8859-1?Q?NsPs0bPalGzZxx+LqWINxhn2PxyAKjlMn8xFqiJX0A9XlyG/rRqelSJSXH?=

=?iso-8859-1?Q?JenTtjlkL4KkPp9BV4lRMB3lXigqwm8D7+vkZP/MB+wwZ/Ptl+nsJ5DGHq?=

=?iso-8859-1?Q?YtHnjqunlYokKL3vs9sDOO0pTlG7kYQDEiQjQREYShE8JyT5biaJAKruwz?=

=?iso-8859-1?Q?T0Ccqnlr62qaSbN/pSGa6COGeoXtp0xqxahFAdZzbpjLeXg49lN+UKfMd4?=

=?iso-8859-1?Q?ksPOSsl1+/sCf30SMRup6qvyD/XY5CUc6Fn3M8JsRi9eWCDwFBG6CMFJRT?=

=?iso-8859-1?Q?Cf2LhIoEKNx0zxW2E05KMC0YkRGg/J6JkCz9gFY1pRzt5ErN4BX6pLIZ/I?=

=?iso-8859-1?Q?qF3gjH3TzLph8wjptR7LuUs+lVgvkjD60pnMeG2IDRSkGpKftAJZUq2dOA?=

=?iso-8859-1?Q?MgeJB0pdDjRI2F/nHPYpFDjOMdJAWLQtd9rb4Vg2XISBVKU/2TdpmVR9GG?=

=?iso-8859-1?Q?DmucDGAQ7Z8Hzyfq0Z7Uwb98yDiae9Vg=3D=3D?=

x-ms-exchange-antispam-messagedata-chunkcount: 1

x-ms-exchange-antispam-messagedata-0:

=?iso-8859-1?Q?jm3LhYfYoZC8anGJmUrFm1oaiGpMEwmgxzVfmVY4OKHs4jwBrv09b8sWQE?=

=?iso-8859-1?Q?2cPQMkyq1S6+I9xxOZfGll1aAHa3B6a2EzbwDy38BqSRDPzGJ+fZ9JmbhP?=

=?iso-8859-1?Q?g62K2VGDakBJsxTqZm6aPoANaadp4lFUMpJGJhEXhFay5MkYGpjEEZ9lFb?=

=?iso-8859-1?Q?EHjm9pc+CsdxeGlW88vdV3HhAmT6ghKV3yGhfxrP7bO1yYm+hksKHZy0mf?=

=?iso-8859-1?Q?cwzSWRLhduL4BoHiYlEH3fC+jsw92B+Wf1WQTBFDSaYUmw+HtYEPBaH8dE?=

=?iso-8859-1?Q?B1qNnAedDbFxQ4oVhud9ctTbjX38HxmSWW7D8rPKd/Ygd5ipavthyrHNaT?=

=?iso-8859-1?Q?yz+tQ6cU9OGj8VxgtmRu7VV00TOHyQh2/GN5DIShq7N7qjIIWkrMaDlrOz?=

=?iso-8859-1?Q?scQDvAt9ja/HuI5+bNamFW64jsl4H6TMp5syzoT1g0XsgW8zBMrRjIUuGy?=

=?iso-8859-1?Q?4/8n9XDryMv7PFEOf6kUnHrHrAodqE6QlWZYGsYoKxLfNW3X4wvtM0W7Gy?=

=?iso-8859-1?Q?/13po2A+lPztVqsbrDMknE28mVBZmFbJ1X56usr1JrKxb5qvV34Pc+MwG3?=

=?iso-8859-1?Q?nvYv8/3DROnto+fH1Z9LlkaC3XsLuaIy2E6KHStUeAFAU+jAXCYJhUFVwl?=

=?iso-8859-1?Q?MbZQaq1daTDXHnOKICya0o0svyqxstssQJOmECczHPqvDdIrNPs0Rnp7o0?=

=?iso-8859-1?Q?PiBhNIyL71x/eFllOzTiqQ54UeBfnqRnR9DZ+HoNV3Hd8Cp81dEJzi4dgx?=

=?iso-8859-1?Q?dHjJ6HYjc6rVUYeO++Yi5Hh2Ichw3LU8I4Vs0DLUAhA9ymrSh9Jli89WYz?=

=?iso-8859-1?Q?zyK64F+0DsavjZpofvgMH9IzPWD93a6fKfUN7T9uDvtIvMWbFFVCIR9LQM?=

=?iso-8859-1?Q?MrXgGtfhSl084wxy9uY0tSA2ZnquILaE1zsd12bB+7PeqJqqejPR/CmAjl?=

=?iso-8859-1?Q?YkMOINkg8NoWbMuZO54tRCmDIHJS5BcAOFPMtKh5dIFwtyueu6YO0nVFul?=

=?iso-8859-1?Q?OcFxequ7Q9nBdHbeY2lLwwpnTQ1amZ4yrZZuwGrzy9A+PcMATpIm3dCBVz?=

=?iso-8859-1?Q?CYpQKm5vleaw94eNbrxczKHrnH7hzfzsrS6RDCSnugqYmrpCi04zCr6KzV?=

=?iso-8859-1?Q?snCCNH7aY3wWRlrGH4xwYWoRIDXkr3PulBe0JE0fj3uNzFp3FJsH4IF4MO?=

=?iso-8859-1?Q?5XV+xpS+vLBinHTtginZxMgTcuhxRvDqwUcKQw+2BU70umQqs+b/k7O52v?=

=?iso-8859-1?Q?einGlN1JKGmog+9U84fs4PgKFpYb0as/CX3xv9JflSQyU+j9q2tekH0Pcr?=

=?iso-8859-1?Q?jXhqUcXD7jWTqg8RaboFvW1b2nC1CzsFbJhPJkZaW/1yjo/4iuPtwMIOB+?=

=?iso-8859-1?Q?IOtZn7ARgxmLLMNbAMDPdlhbpKuoncuV+8J1fXGpWvOCIxy0MoQR5ew8Tm?=

=?iso-8859-1?Q?pljWaOdIliG2wu09o3m63FFE5SnDxHRwYR7N7tT9ITSCuafPaR6rahmzib?=

=?iso-8859-1?Q?50VnYFQpPCSWK/gdesDyLWuL1jXl55A956LDDXTOfHNQ=3D=3D?=

Content-Type: multipart/alternative;

boundary="_000_KL1PR01MB40172B5EEEFD5007A42EF283E1262KL1PR01MB4017apcp_"

MIME-Version: 1.0

X-OriginatorOrg: outlook.com

X-MS-Exchange-CrossTenant-AuthAs: Internal

X-MS-Exchange-CrossTenant-AuthSource: KL1PR01MB4017.apcprd01.prod.exchangelabs.com

X-MS-Exchange-CrossTenant-RMS-PersistedConsumerOrg: 00000000-0000-0000-0000-000000000000

X-MS-Exchange-CrossTenant-Network-Message-Id: 41c202aa-c5ba-482f-314e-08de97d20ddd

X-MS-Exchange-CrossTenant-originalarrivaltime: 11 Apr 2026 13:55:56.4143

(UTC)

X-MS-Exchange-CrossTenant-fromentityheader: Hosted

X-MS-Exchange-CrossTenant-id: 84df9e7f-e9f6-40af-b435-aaaaaaaaaaaa

X-MS-Exchange-CrossTenant-rms-persistedconsumerorg: 00000000-0000-0000-0000-000000000000

X-MS-Exchange-Transport-CrossTenantHeadersStamped: TYZPR01MB5524