NetKnow Corporate Blog

Haresasz Nxysarwsa has invited you to PayPal Transaction Successful – BTC Order Pending Completion

Title: PayPal Transaction Successful – BTC Order Pending Completion

When: June 29, 2026

Organizer:

Haresasz Nxysarwsa

Description: Dear Customer,



Thank you for your recent PayPal payment. Your Bitcoin order has been received and is now awaiting final confirmation.



Order Summary:



Asset Purchased: Bitcoin (BTC)

Payment Method: PayPal

Total Amount: $750.00

Status: Pending Completion



Please allow a short period for processing as our system validates the transaction details.



If you do not recognize this payment, please call +1 656 556 2206 immediately.



Best Regards,

Order Processing Department

Attendees:



cynthiaperez389903@groups.outlook.com



PayPal Transaction Successful – BTC Order Pending Completion

Dear Customer, Thank you for your recent PayPal payment. Your Bitcoin order has been received and is now awaiting final confirmation. Order Summary: Asset Purchased: Bitcoin (BTC) Payment Method: P



Dear Customer,



Thank you for your recent PayPal payment. Your Bitcoin order has been received and is now awaiting final confirmation.



Order Summary:



Asset Purchased: Bitcoin (BTC)

Payment Method: PayPal

Total Amount: $750.00

Status: Pending Completion



Please allow a short period for processing as our system validates the transaction details.



If you do not recognize this payment, please call +1 656 556 2206 immediately.



Best Regards,

Order Processing Department

Kedy

pondelok 29. jún 2026

Organizátor

Haresasz Nxysarwsa

haressaznzxrrsxaxz321@gmail.com

Hostia

(Zoznam hostí bol na žiadosť organizátora skrytý)

Odpoveď na cynthiaperez389903@groups.outlook.com

Áno



Nie



Možno

Ďalšie možnosti



Pozvánka z Kalendára Google



Túto správu ste dostali, pretože ste účastníkom danej udalosti.



Ak túto pozvánku prepošlete, ktorýkoľvek jej príjemca bude môcť odoslať odpoveď organizátorovi, byť pridaný do zoznamu hostí, pozývať iných bez ohľadu na ich vlastný stav pozvánky alebo meniť vaše potvrdenie účasti. Ďalšie informácie

X-Microsoft-Antispam-Message-Info:

=?utf-8?B?bFUwTVNQS2p4MHlqSmRUOU1GbmRHaHJRTmwxeDNxVTU0NkUvQU9DL0o1TGRY?=

=?utf-8?B?cC9LRVo0bVdVRDF1QnRJd1BaVDd1STBkU1RyNFRWUnlSZ2FDWTVaNVBkdlBw?=

=?utf-8?B?U1E4SDRyUGxQVkh2S3dxekxRWlVmT2U3bG1WdW5qcHVZS20yM3JLS0k5K3Nt?=

=?utf-8?B?Rlhqd1k2MGN2bUVBa2RESjFjalJHeVFOeWFhSWxhRTNQaUdIMnpEMXJvU2ky?=

=?utf-8?B?SWxTcURkZEJUWnlMbko1cTRFcUx0MVlwMzhuSkJ4RERhWC9weWlDWDB6ZVN0?=

=?utf-8?B?VEpiblhkcktDY0dZTiswMmJtYlJwaGdxOU4rOWoxai96SjFLd29BNXRFek4w?=

=?utf-8?B?N3A5Y3lQQUR6YWhNVUptRzdNbitRRm4zVUhuSzZaL1A2K3BEV0dnVGNOeHV4?=

=?utf-8?B?S2NNSjhXNFZrYU1GWkZoL0VXVDhCcmhNSjFpVTVaRWhVR3NicFIyOWZGQW5B?=

=?utf-8?B?L3RSQURMc1hTc3NrM1BVUFM2NVIyaGtTNThZNlg4R0dYUTBiclU0Z3gwMksv?=

=?utf-8?B?NEJoSDNCSDM3SUk4SUtIdmVkVEw2UFJtN1NiUzFLSEFFK1ZKUW51NjdrRVhh?=

=?utf-8?B?TWpDRGZncjRGN2NzaFZkbUxlOFloMXpqWGlJZk5xak56d3BBbDlrVys0YXFv?=

=?utf-8?B?dUp1WW93ZGpDUXhuYlQ3UkpjTEsvUmVKKzQwKzRvMGlEQjVtYzBTTUREWUNn?=

=?utf-8?B?b2c2N2l3ZkF2NjNOQXVURXNVZWgxWGdZeFJNZmtKbEk0QXBZMjVZSHRhSWN6?=

=?utf-8?B?MVVsaG9icHhyNE83MEdKT3poKzVTMUFjV3lPcTJQSGdxT1VnU2tpSEZ1TkM1?=

=?utf-8?B?dXV5RXc0SFg2Tkk0WjdOUWRLN3JlVnVnbyswNUtBRzAwV1haaW1sU0N2UTJ0?=

=?utf-8?B?MzBPU1BQTmxrd1BvRUhoL0crNTIxNnpKSlNwcVdLMzRlS2s3Z2VSM05uUC96?=

=?utf-8?B?ZXZxUUh0NkMyWlh5ZlpwNExtZXZuOW8yYUI2TTVIenhtSGpvR3lnQUY2aTRB?=

=?utf-8?B?Z3lKVjdIQ2ZnaU9MdDRPWEl5Z0pFS1QvMEp4UjN0VUJuK1lXbDZHTWRSQ1lC?=

=?utf-8?B?NUFjSXpjakY3NEpXNjVwZkxGcC9mSHlUcVpKblFVRStmMHFBNW5aLzFvNThr?=

=?utf-8?B?YVliUitjdHVTM2pMRXhWMk02R09LNldvNkl6TnVLeElEbUpvYnBPd3pISHpj?=

=?utf-8?B?QkpwRHRDZUg4aDlBRHlOcGJVNWc3ZEdlcmZ4OVVVU2JNYlNrL2xiclRXcm9R?=

=?utf-8?B?ZnAveFZmMTNyQmc0Qk1QWkF2OFN3QjhXeXowZ1c2ZWFYUWJKRi9BeE5STE5M?=

=?utf-8?B?TW1SZnhUT0RPRGw4OTdTL2M4TVhuSVBkbEptNUFEUldHOTdxVVg3NjlTWmNP?=

=?utf-8?B?eVB1QXJWUlJLb0pRZVJ3YTN4YUE3b0xBcWRYbFdiV2VJTDcwa2lSOGxXcGlW?=

=?utf-8?B?UmxtampOSDVRMzYwWjI1by8zUFZXem5ieXFHWmRHK2FjQ0xOWDlIRzJKUENa?=

=?utf-8?B?Q1h0R0FQTnJWTlZPYVNzVDEwUVdCUlNsWVZadkFsUGViU3dwQ1czbittemNq?=

=?utf-8?B?a25WazVKTkkrdnRQc04xcnpTRERpWTFwcUpxckE2QmM2WW9WMVQ0YlVJVWoy?=

=?utf-8?B?ZkptMVdzMENjeXZLWlI0WGlQK3BzZnZhRUhoMW9vQ3dvTHJ4MTJlVDdjeS9T?=

=?utf-8?B?amtWT2RyVmdKdGQyTjE0Njk2b3NvWkFxNzl1NWxNbDAxNW01TEJLK1ZYMXdp?=

=?utf-8?B?dXI3TjI0MWN5YzdNMitWWmxPZUdVUXFIaEFRWWJHeERRejhiMi9PMlBtYjJ5?=

=?utf-8?B?VlNOMWVyTFpzV1czVGQwVEFZN3N4STlzZEhPM2hPd0hiQTVKZ3l3QWdVNHlX?=

=?utf-8?B?c0JvQSswZ3JqaCtuYzlJMWZobGNlRGxQOHNaRDBzYUQyK3dzemxWUWpLM2lj?=

=?utf-8?B?dm9JTGxrWFZENEZOWktYbEdnTkFaTTR2ZzBYSVlOOGdNbHJzSERGVVJ4Z01x?=

=?utf-8?B?am9iMjczRjdGSFcyRmtjWWZ1VWQxcFkvNm5uclp4Y1BnZTl5RitwZ2Z3UHVs?=

=?utf-8?B?UHhmcGl2RDN4dUw0OC9pRmpwR3ZYRFBacFR6WW1zZnNxWDVDb1RJWm9uSEFs?=

=?utf-8?B?OFJJY0lvMUp2cTVtZGl2czcvL0piSjBsTzdiQXVPa2hlei93SEZrcnE2TnV6?=

=?utf-8?B?c3VsbUk5bUhPVDFQN2gwL0d1Y3VBOUNVZDl6RkUvTE9ESGg0blpEUWJ6UzRu?=

=?utf-8?B?MXBXN0xGc2FaME9HUFl3RUxFV0xHbSthcGovZERKdXB4Z1NRaENpSEViZjM4?=

=?utf-8?B?dGtYV2JNR0NoWDhkZVhOdGE4K2N4RXJjTURNSVJGS0RrVURWUTVzLy9aSWNz?=

=?utf-8?B?OTdDQVVLNTRuOGd1ZzBvYzVnd1JQNUxyS29TUCswM2hTRTlRemp0TWFjdUpG?=

=?utf-8?B?c0d4dUUwc1lhbFhaWXdBYnN0ZVN1WTZXUEI3KzJmTzFXczdObzlVLzB1bUFv?=

=?utf-8?B?YlowNmtVa2VHUGd4ai9pQjRIMGczNHFiRlQvaHpraHY2SnJkbVl1cy9ydlFz?=

=?utf-8?B?TDBUdVZlOXlhdFgrZ1Fpc01udzBxc2RscGcyYUlvRlkySmU5RURuNGpCNy9l?=

=?utf-8?B?eTNYZStLcW5GNWZpc2gyRGRhT3NoamRGMFQ0MUZBaTRuZ2dLVEZVV3pYNGc5?=

=?utf-8?B?MktDUi9nWjBVYU5OQWNXbUxwbFhoRGJ5OEt5K1FHMmRWTjVhVVA4SUFrV1ll?=

=?utf-8?B?U0ljZDdIMXQ3dGpjV05tdUx6U2s5MGQ0bUczeU5tKzIvbmpBNUZFcWNxT1dN?=

=?utf-8?B?cTlhaEE5ZVBvQjY0UmdkRjZmREpoVEk3YTUwSEhWTFZxQ044SG1EK2ZMVm0r?=

=?utf-8?B?akJSZWxwK2IwMWlzOEI2VUpDVVdXNndUMlJJbW1EQ0JoTlVPaTRJTDE0WFJs?=

=?utf-8?B?NVd2ZHd1RHdyY2pERUlpU0o2Z2FqdERDQjVVYUJsZklyMEVJdFBEbVpwaW5U?=

=?utf-8?B?UkNFemtrMU1ud2FBa1pxMzlnNjNEY1dBQWMwdFJ4OG50OHV1a0RKV0NRU1VC?=

=?utf-8?B?S2hTQVhkSnJ6VGtzNGI3TVZHcDBiYU9pTzZwOEZvTmdRRkJvN2ZlMDZYZjlZ?=

=?utf-8?B?TW5zUEUxT096dUNsZ0ZnekllZkZnZTFpalZHWVlWTFVtTm5YR3JtaHN3dW5O?=

=?utf-8?B?R2dHS0JkUHRaSFpMOE0vS0QvS0EwSW01cmJWa3hBV0RIaVUwaThvL3ZIbys4?=

=?utf-8?B?a2EzdXZYTVl4QjUzQ25iN0syd1RWUEFhQ0JBZEx5cUFJZWdLRWtWTkYwODlU?=

=?utf-8?B?L2IxaXJOcG1FdlNlSkFiVmxhcWpRWjlIZStCMmhxTXg4NmJ5QzZvR1M4SW4x?=

=?utf-8?B?VzJ3R1pVeXNOOS93UWFNWUpIdjg4S00vbi9pc1M2aWNwNkxhRzE3Rmd3OExR?=

=?utf-8?B?SkZRNDJIWFNwcjAzbUUzNlZ2a2xJcWRJSTZma28xbDcxQ3B4Y0N0cXFEZmRU?=

=?utf-8?B?QXc5UFlzSDlZak9qZE5sWVV3RjJVamZOWUVNcTRlTHJMQ0RoUG5ZVURSUHV5?=

=?utf-8?B?Z3JocmcvQUhuUEFNVCsvZUtZMkhlY2hOM1lYNjlYZ3M2NUVaQnpWU0t5Qllq?=

=?utf-8?B?NytjMno4eEtueXd4YlV5NklaWnhhVThGNUYySW5nQTZvWG81Z3hPTDRWU1dw?=

=?utf-8?B?TEMvQy9wUUJ2V044VW4xS0FVUFFYYlVYZTBaaDlvRzkvZFNVQnFYM0VaY3FK?=

=?utf-8?B?U3hKZGVncTJBakgza0V3dUtzQzVUQmhFRE1oK3Q4Tk13WnJiZkMwa2UxM2VC?=

=?utf-8?B?Nloxd2FkMm85SzhtWStpUUVJMUNpY3JFTWtMUkw4OHNnRUFlTFFUcnB1ZVdZ?=

=?utf-8?B?eWtRTFJzcFRjdENwYkNZa1h3UVlVQVQvbjY2NUtzY3RlTENseHNKLzlZdlgv?=

=?utf-8?B?THkyS1l1Mk9CbTlsZHBndnBZdWJQRGNRenUxaDlJQ085elA5ZXNvSjNQSDlR?=

=?utf-8?Q?TZD8H0v4d6Ws2ikXH62?=

X-Auto-Response-Suppress: DR, OOF, AutoReply

X-OriginatorOrg: sct-15-20-9412-4-msonline-outlook-090a5.templateTenant

X-MS-Exchange-CrossTenant-OriginalArrivalTime: 29 Jun 2026 16:48:10.7533

(UTC)

X-MS-Exchange-CrossTenant-Network-Message-Id: 8c9cf958-2740-4f9a-892e-08ded5fe3439

X-MS-Exchange-CrossTenant-Id: 84df9e7f-e9f6-40af-b435-aaaaaaaaaaaa

X-MS-Exchange-CrossTenant-AuthSource: SN1PEPF00036F3C.namprd05.prod.outlook.com

X-MS-Exchange-CrossTenant-AuthAs: Anonymous

X-MS-Exchange-CrossTenant-FromEntityHeader: Internet

X-MS-Exchange-Transport-CrossTenantHeadersStamped: SJ4PPF5DF2E3EFE

X-Spam_score: 13.7

X-Spam_score_int: 137

X-Spam_bar: +++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: PayPal Transaction Successful – BTC Order Pending Completion

pondelok 29. jún 2026 Dear Customer, Thank you for your recent PayPal payment.

Your Bitcoin order has been received and is now awaiting final confirmation.

Content analysis details: (13.7 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[209.85.128.71 listed in will-spam-for-food.eu.org]

[209.85.128.71 listed in will-spam-for-food.eu.org]

[209.85.128.71 listed in will-spam-for-food.eu.org]

[209.85.128.71 listed in will-spam-for-food.eu.org]

[209.85.128.71 listed in will-spam-for-food.eu.org]

[209.85.128.71 listed in will-spam-for-food.eu.org]

[209.85.128.71 listed in will-spam-for-food.eu.org]

[209.85.128.71 listed in will-spam-for-food.eu.org]

[2603:10b6:806:d0:cafe:0:0:a4 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:806:d0:cafe:0:0:a4 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:806:d0:cafe:0:0:a4 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:806:d0:cafe:0:0:a4 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:806:d0:cafe:0:0:a4 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:806:d0:cafe:0:0:a4 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:806:d0:cafe:0:0:a4 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:806:d0:cafe:0:0:a4 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:806:d0:0:0:0:7 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:806:d0:0:0:0:7 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:806:d0:0:0:0:7 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:806:d0:0:0:0:7 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:806:d0:0:0:0:7 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:806:d0:0:0:0:7 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:806:d0:0:0:0:7 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:806:d0:0:0:0:7 listed in]

[will-spam-for-food.eu.org]

[40.93.2.68 listed in will-spam-for-food.eu.org]

[40.93.2.68 listed in will-spam-for-food.eu.org]

[40.93.2.68 listed in will-spam-for-food.eu.org]

[40.93.2.68 listed in will-spam-for-food.eu.org]

[40.93.2.68 listed in will-spam-for-food.eu.org]

[40.93.2.68 listed in will-spam-for-food.eu.org]

[40.93.2.68 listed in will-spam-for-food.eu.org]

[40.93.2.68 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[40.93.2.68 listed in dnsbl.ahbl.org]

[40.93.2.68 listed in dnsbl.ahbl.org]

[40.93.2.68 listed in dnsbl.ahbl.org]

[40.93.2.68 listed in dnsbl.ahbl.org]

[209.85.128.71 listed in dnsbl.ahbl.org]

[209.85.128.71 listed in dnsbl.ahbl.org]

[209.85.128.71 listed in dnsbl.ahbl.org]

[209.85.128.71 listed in dnsbl.ahbl.org]

[2603:10b6:806:d0:cafe:0:0:a4 listed in]

[dnsbl.ahbl.org]

[2603:10b6:806:d0:cafe:0:0:a4 listed in]

[dnsbl.ahbl.org]

[2603:10b6:806:d0:cafe:0:0:a4 listed in]

[dnsbl.ahbl.org]

[2603:10b6:806:d0:cafe:0:0:a4 listed in]

[dnsbl.ahbl.org]

[2603:10b6:806:d0:0:0:0:7 listed in]

[dnsbl.ahbl.org]

[2603:10b6:806:d0:0:0:0:7 listed in]

[dnsbl.ahbl.org]

[2603:10b6:806:d0:0:0:0:7 listed in]

[dnsbl.ahbl.org]

[2603:10b6:806:d0:0:0:0:7 listed in]

[dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[40.93.2.68 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[40.93.2.68 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[40.93.2.68 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[40.93.2.68 listed in dnsbl.ahbl.org]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[40.93.2.68 listed in bl.score.senderscore.com]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[40.93.2.68 listed in list.dnswl.org]

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[40.93.2.68 listed in wl.mailspike.net]

-0.0 SPF_PASS SPF: sender matches SPF record

1.0 HK_RANDOM_FROM From username looks random

3.5 VOWEL_FROM_7 Impronouncable from header (7+ consecutive vowels)

0.5 FROM_LOCAL_NOVOWEL From: localpart has series of non-vowel letters

1.0 HK_RANDOM_REPLYTO Reply-To username looks random

-0.0 T_RP_MATCHES_RCVD Envelope sender domain matches handover relay

domain

0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider

[haressaznzxrrsxaxz321(at)gmail.com]

0.0 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level mail

domains are different

0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in digit

[haressaznzxrrsxaxz321(at)gmail.com]

0.1 TW_RW BODY: Odd Letter Triples with RW

0.3 LONGWORD BODY: Uses overlong words

0.6 MEGALONGWORD BODY: Uses really overlong words

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 HTML_MESSAGE BODY: HTML included in message

2.0 RATWR8_MESSID Message-ID with excessive dashes and dollars

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

0.2 FREEMAIL_FORGED_FROMDOMAIN 2nd level domains in From and EnvelopeFrom

freemail headers are different

0.1 TO_IN_SUBJ To address is in Subject

3.0 LONG_INVISIBLE_TEXT Long block of hidden text - bayes poison?

Subject: {SPAM?} =?UTF-8?Q?Pozv=C3=A1nky=3A_PayPal_Transaction_Successful_=2D_BTC_Order?=

=?UTF-8?Q?_Pending_Completion_=40_po_29=2E_j=C3=BAn_2026_=28cynthiaperez389903=40g?=

=?UTF-8?Q?roups=2Eoutlook=2Ecom=29?=

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Mon, 29 Jun 2026 15:44:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1weJl3-00000000Dmw-390f

for dave@doctor.nl2k.ab.ca;

Mon, 29 Jun 2026 15:43:13 -0600

Resent-From: The Doctor

Resent-Date: Mon, 29 Jun 2026 15:43:13 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-eastusazlp17012068.outbound.protection.outlook.com ([40.93.2.68]:10709 helo=BL0PR03CU003.outbound.protection.outlook.com)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1weFAb-000000002p9-2oj3

for doctor@doctor.nl2k.ab.ca;

Mon, 29 Jun 2026 10:49:29 -0600

Received: from SA0PR11CA0032.namprd11.prod.outlook.com (2603:10b6:806:d0::7)

by SJ4PPF5DF2E3EFE.namprd18.prod.outlook.com (2603:10b6:a0f:fc02::f1d) with

Microsoft SMTP Server (version=TLS1_2,

cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.159.19; Mon, 29 Jun

2026 16:48:11 +0000

Received: from SN1PEPF00036F3C.namprd05.prod.outlook.com

(2603:10b6:806:d0:cafe::a4) by SA0PR11CA0032.outlook.office365.com

(2603:10b6:806:d0::7) with Microsoft SMTP Server (version=TLS1_3,

cipher=TLS_AES_256_GCM_SHA384) id 15.21.159.19 via Frontend Transport; Mon,

29 Jun 2026 16:48:10 +0000

Authentication-Results: spf=pass (sender IP is 209.85.128.71)

smtp.mailfrom=gmail.com; dkim=pass (signature was verified)

header.d=google.com;dkim=pass (signature was verified)

header.d=gmail.com;dmarc=pass action=none header.from=gmail.com;compauth=pass

reason=100

Received-SPF: Pass (protection.outlook.com: domain of gmail.com designates

209.85.128.71 as permitted sender) receiver=protection.outlook.com;

client-ip=209.85.128.71; helo=mail-wm1-f71.google.com; pr=C

Received: from mail-wm1-f71.google.com (209.85.128.71) by

SN1PEPF00036F3C.mail.protection.outlook.com (10.167.248.20) with Microsoft

SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.181.6

via Frontend Transport; Mon, 29 Jun 2026 16:48:10 +0000

X-IncomingTopHeaderMarker:

OriginalChecksum:A37DF50CE334A0C7E854E00FC5B48EA42873398795EE5CA8BC543DD5B35012EF;UpperCasedChecksum:4296C111E5E2FCB2CB283789DAF8AD6023E4EC8DA06BB0C47A4CF9E63BF5CCEF;SizeAsReceived:3418;Count:15

Received: by mail-wm1-f71.google.com with SMTP id 5b1f17b1804b1-493b54823bdso4408255e9.0

for ; Mon, 29 Jun 2026 09:48:10 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=google.com; s=20251104; t=1782751689; x=1783356489; darn=groups.outlook.com;

h=to:from:subject:date:message-id:sender:reply-to:mime-version:from

:to:cc:subject:date:message-id:reply-to;

bh=Ym88YrZTah7EGkIJClw+4WBh5ytwtcxMQ9SLJAVnBD0=;

b=DYCshFmWnPqt1MOJEhuxP/MZ//+SgAKn1J5tG0B6Ze5Dhrz2nkUEI791npM201yGyj

Z0WJ0h9UXcj2uS6Z01yx21QK7DSStkDN/gO4vrXwjRxitmA+gcY260yz1QA95TVvWKCg

D/fBX5pYuc/CwioxdUmW9r0rUmfeysF7EFBxDgCtsAoUVSczBk8pnM/XMtxau1mRSPr/

AIlTb7rwl/9HTT+U4sKG0SwJq8iWO4iQ2N6q6wX23hDgVQ1irWOYw5xEerkh+ARux+NE

u7pUxoCEjZ90kRU6yKfnVUlOoCZBLVv9ZKv9Q2k29H8NNBR4/g4r1ytCuerXI+ljA4m4

lLnQ==

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=gmail.com; s=20251104; t=1782751689; x=1783356489; darn=groups.outlook.com;

h=to:from:subject:date:message-id:sender:reply-to:mime-version:from

:to:cc:subject:date:message-id:reply-to;

bh=Ym88YrZTah7EGkIJClw+4WBh5ytwtcxMQ9SLJAVnBD0=;

b=epP9xNqfiO6CSLr08pPIKnfLpo8gCn+1A3NfsecCVxaHubaIJEoVW12g9/v7XKysAz

sDk1SSloLwn5+vRue4PfB/Lr74Ya6KE2zSvBmqGNe/KzquvIy/6M7OvieMOKr6JLpBiN

DWTYt0ijD2NOX8xMELTVncNoKczVeYx6l+/icJv97qP0Xdvd4KH8zv6/9cVp+snKW6ma

17fh+XZtHC2k7+4DCd2kIgOAhj6j5xLLnkEsV6dFfJVI4hMkS4hyjfaPw5uH6CmrNwBl

lfG+ovxFQrRD7V/abTHPoHOOOn2iB8cXwo5aDkT+IqnpBMwXHB4hZX1EGjZGRcJiwTj/

yvag==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20251104; t=1782751689; x=1783356489;

h=to:from:subject:date:message-id:sender:reply-to:mime-version

:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to;

bh=Ym88YrZTah7EGkIJClw+4WBh5ytwtcxMQ9SLJAVnBD0=;

b=NxLrolooNVxglYJUgLYXkm3sE2b2YXre7Zy5QdMoHLDxTXIYmVeDLmFRj0NaDW6iTx

srYQex4w1NHpEhe9uSQKPsXPL4r89DjYWhtwMazHxByIRqodYf1ECUiOUiGG6vjzP3S3

iaSw7JLzOnqZ3j205mkpJHRMDRng4S0JZP8Cj6bof3DlQFF8qPYjtYIz4nvOQ/age5TZ

vdlkO5ZkAKKIDt9TUw7i67kYcIRaPQ1pWIqtk5Z243J+qLEquX/tjmc/Ygtp5p13BlT0

SsFHeigfPtx8h74d9Ya/vz8eb6CjhGm2pssh7yam0ne1UZhGheXf83bho4XETPwS4HGp

X1sQ==

X-Gm-Message-State: AOJu0YzQAg1TQR+ewLc9vcTcAnhPgvwXs2xMENrBCiha6Aey3uWKtxB5

sHsh3TF0HibcQz1Y2SUYyVd3BFkhu5m9w7u2EX56YX/k9t1crYrKceGNkFQv8XbdWQ9b1guSC/U

TmDIaY9kYzH3R9lDED0HT1Dp3Zm4fTHiyw40=

MIME-Version: 1.0

X-Received: by 2002:a05:600d:8494:20b0:492:3fb5:3a17 with SMTP id

5b1f17b1804b1-493b8ccc7bfmr789785e9.2.1782751688765; Mon, 29 Jun 2026

09:48:08 -0700 (PDT)

Reply-To: Haresasz Nxysarwsa

Sender: =?UTF-8?Q?Kalend=C3=A1r_Google?=

Message-ID:

Date: Mon, 29 Jun 2026 16:48:08 +0000

Subject: =?UTF-8?Q?Pozv=C3=A1nky=3A_PayPal_Transaction_Successful_=2D_BTC_Order?=

=?UTF-8?Q?_Pending_Completion_=40_po_29=2E_j=C3=BAn_2026_=28cynthiaperez389903=40g?=

=?UTF-8?Q?roups=2Eoutlook=2Ecom=29?=

From: Haresasz Nxysarwsa

To: cynthiaperez389903@groups.outlook.com

Content-Type: multipart/mixed; boundary="00000000000021b6b90655673975"

X-IncomingHeaderCount: 15

X-EOPAttributedMessage: 0

X-EOPTenantAttributedMessage: 84df9e7f-e9f6-40af-b435-aaaaaaaaaaaa:0

X-MS-PublicTrafficType: Email

X-MS-TrafficTypeDiagnostic: SN1PEPF00036F3C:EE_|SJ4PPF5DF2E3EFE:EE_

X-MS-Office365-Filtering-Correlation-Id: 8c9cf958-2740-4f9a-892e-08ded5fe3439

X-MS-Exchange-EOPDirect: true

X-Sender-IP: 209.85.128.71

X-SID-PRA: HARESSAZNZXRRSXAXZ321@GMAIL.COM

X-SID-Result: PASS

X-MS-Consumer-Group-Expansion-Loop: cynthiaperez389903@groups.outlook.com

X-MS-Exchange-Group-Expansion-Loop: cynthiaperez389903@groups.outlook.com

X-Microsoft-Antispam:

BCL:0;ARA:1444111002|22000799015|26130799012|4040799016|9000799056|24102599021|16001999021|26000799027|9400799043|6092099016|1680799066|5139299004|32020799003|34130799006|16200799027|6019299003|29080799009|970799063|9020799019|3151999006|3412199025|26104999009|440099028|4302099013|1370799030|1380799030|1360799030|1041999012|18021999003|2145499017|30041999003|1602099012;

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Mon, 29 Jun 2026 15:42:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1weJjT-00000000DUQ-3H3J

for dave@doctor.nl2k.ab.ca;

Mon, 29 Jun 2026 15:41:35 -0600

Resent-From: The Doctor

Resent-Date: Mon, 29 Jun 2026 15:41:35 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-ot1-f70.google.com ([209.85.210.70]:42180)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1weDqM-00000000EVw-3lid

for doctor@nl2k.ab.ca;

Mon, 29 Jun 2026 09:24:28 -0600

Received: by mail-ot1-f70.google.com with SMTP id 46e09a7af769-7e9e2c0be98so823039a34.0

for ; Mon, 29 Jun 2026 08:23:30 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=google.com; s=20251104; t=1782746604; x=1783351404; darn=nl2k.ab.ca;

h=to:from:subject:date:message-id:sender:reply-to:mime-version:from

:to:cc:subject:date:message-id:reply-to;

bh=KRMvUpxrRMw1bSS94sti7cY3RcqlvU7Iy8dGW7qYavs=;

b=vVKMtgSqA62ioTU818aoR0tISwHh6uqquuM55pxY4/6hFzUf6PdWjjWAtF24TvJHJ+

USRD70pKCk8N7GNaJPw9Cy8jhyPZepGYpNkRE9DKK8PasvNvbgVbkd6/mcMAAwvvv/Xk

RsSNlzPJhIw3J89X4oDO4WZn3m5Cv3ldbX0wVNc9xhD7D6gntfh8EN09jXMldBBxln6o

TnXXg2jn6WCx1XO4N2rHCfXZqe5MsC8G3H0BWC+l2B6eZN2OiPRUaVSiX2TMjErvmBnX

o4i8Q61UqgzLkNXzrK99NUQNaQR3UWC89oBehg/R2hf/tkthtap7kW80bfJ+EmEern07

XUgQ==

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=5m5u-com.20251104.gappssmtp.com; s=20251104; t=1782746604; x=1783351404; darn=nl2k.ab.ca;

h=to:from:subject:date:message-id:sender:reply-to:mime-version:from

:to:cc:subject:date:message-id:reply-to;

bh=KRMvUpxrRMw1bSS94sti7cY3RcqlvU7Iy8dGW7qYavs=;

b=sVxpshkC6ZdtNNQlVf4dGD8OFd8anrQk/AgYAlhhOnzT4fdK2gN9w8KOUu/Cj5t9Ok

qlEAj26Kwe3OAR5a6PJbSwwPJutsqK0vy94mEUU+z5lwlwPfJOkCxTDnCFVNc5AFWevd

HaB5rQDV1zJ61icH4aZWAqoZfi+VGgLoissjBLzj71PxPHJUNjEaqivbD/0Y3nrMhUn+

S6I1Eiaisx51FuWCSgZOXBmkhZcEpjvxdd5hLAX/+Y1k5V/VWu3RoGgEASPVKpOKZ5cF

oejldS5aaBck0MjRzCR5f2xEbgbn/oy2f9kJn3qERmHC4wYmmQtvO9KCp0f2MtJ7v3bb

otPQ==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20251104; t=1782746604; x=1783351404;

h=to:from:subject:date:message-id:sender:reply-to:mime-version

:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to;

bh=KRMvUpxrRMw1bSS94sti7cY3RcqlvU7Iy8dGW7qYavs=;

b=ViCP/fqoADhq0RtaNUTrPWryQmjfUQZYjN9IBq/z2zjDI/gKRT//sPMo9gPfRFMt66

EnGkotp8TTMBi4pch1RcBP4nl1TLolsLFARVQ5vGBOK9eA4hXz19vOcLy4iBskCmtB7l

7zRJb8A/3OGovmfc9m6WF2piJ0Iy9Mb4e7g2+gXfHD2zAKmG2C3uDv2P2UUPsULAd7dt

0wB586HxMk7b7c/SXJ2u8u65Mmy1N+M/q/4LAenOPxOWbnF0FqaDPm0G2E1tEV7HHDDY

nAgFdyzBHg0714MnnX/Dq1cYD+YSczaMZ2gBcCdta70TWglqgJpsUVnwyBmQC2RY/eYh

9/lQ==

X-Gm-Message-State: AOJu0YzIShZZivseNdltdumJDrcxXctNSPQDwqBJxS/Fg+V+liD25Aes

7a2iUT6jQDVxqzRujobfCyVOKGYQnxyyU+pZh8lMwIOT65PixpBCAQQ0RT+roIh3k/ZcWNRp5nh

Er7uUvTIB+g26ag6RXqQaIPBGYT2gDnKIbwmqFIsCioi7ZP4ReKFlSDDw

MIME-Version: 1.0

X-Received: by 2002:a05:6830:6af8:b0:7e9:dc11:5920 with SMTP id

46e09a7af769-7e9dc115cb5mr2186442a34.8.1782746604355; Mon, 29 Jun 2026

08:23:24 -0700 (PDT)

Reply-To: Allah Yekta

Sender: Google Calendar

Message-ID:

Date: Mon, 29 Jun 2026 15:23:24 +0000

Subject: Appointment booked: Norto n LifeLock Renewal Invoice #NXA1KW8H1TDPB5

@ Mon Jun 29, 2026 3:25pm - 3:30pm (GMT-4) (doctor@nl2k.ab.ca)

From: Allah Yekta

To: doctor@nl2k.ab.ca

Content-Type: multipart/mixed; boundary="00000000000013cf2c0655660a1e"



Allah Yekta has invited you to Norto n LifeLock Renewal Invoice #NXA1KW8H1TDPB5

Title: Norto n LifeLock Renewal Invoice #NXA1KW8H1TDPB5

When: Monday, June 29, 2026, 13:25 – 13:30

Organizer:

Allah Yekta

Description:



Norton LifeLock Bill Date: Monday, 29 June 2026 23:21:15

Bill receipt: D668YNMU1HQS8RZ

Phone Contact: +1-(805)-853-6485



Coverage records reflect ongoing account updates



Dear Service User,



This message is to inform you that your membership with Norto n LifeLock is set to continue under its standard renewal settings. On Monday, 29 June 2026 23:21:15, a charge of USD342.17 may be applied to your account in line with your existing subscription preferences.



**Payment Information Center**

- Quantity: x1 Device

- Product: Account Service Hub

- Current Plan: 3-Years Warranty

- Payment Method: Auto Debit

- Total Paid: USD342.17

- Client ID: WM1XGBLYD4

- Activation Key: e3b8f022-cbb3-469a-aaca-243806f7270c





This membership renews automatically at the end of each term unless changes are made at least 48 hours prior to the renewal date.



If you would like to review, adjust, or cancel your membership, please contact our support team at +1 (805)-843-0624.



With genuine gratitude,,

Norton Life lock Service

Accounts head: Manuel Kunkle

Administrative Department: 1601 Prude Mill Rd Fort Collins Co 80525-7527 Us

Business Hours: 6 AM – 6 PM

Attendees:



doctor@nl2k.ab.ca



Norton LifeLock Bill Date: Monday, 29 June 2026 23:21:15Bill receipt: D668YNMU1HQS8RZPhone Contact: +1-(805)-853-6485 Coverage records reflect ongoing account updates Dear Service User, This message is to inform you that your membership with Norto n LifeLock is set to continue under its standard renewal settings. On Monday, 29 June 2026 23:21:15, a charge of USD342.17 may be applied to your account in line with your existing subscription preferences. **Payment Information Center**- Quantity: x1 Device- Product: Account Service Hub- Current Plan: 3-Years Warranty- Payment Method: Auto Debit- Total Paid: USD342.17- Client ID: WM1XGBLYD4- Activation Key: e3b8f022-cbb3-469a-aaca-243806f7270c This membership renews automatically at the end of each term unless changes are made at least 48 hours prior to the renewal date. If you would like to review, adjust, or cancel your membership, please contact our support team at +1 (805)-843-0624. With genuine gratitude,,Norton Life lock ServiceAccounts head: Manuel KunkleAdministrative Department: 1601 Prude Mill Rd Fort Collins Co 80525-7527 UsBusiness Hours: 6 AM – 6 PM



Norto n LifeLock Renewal Invoice #NXA1KW8H1TDPB5

Monday Jun 29, 2026 ⋅ 3:25pm – 3:30pm (Eastern Time - New York)



Norton LifeLock Bill Date: Monday, 29 June 2026 23:21:15

Bill receipt: D668YNMU1HQS8RZ

Phone Contact: +1-(805)-853-6485



Coverage records reflect ongoing account updates



Dear Service User,



This message is to inform you that your membership with Norto n LifeLock is set to continue under its standard renewal settings. On Monday, 29 June 2026 23:21:15, a charge of USD342.17 may be applied to your account in line with your existing subscription preferences.



**Payment Information Center**

- Quantity: x1 Device

- Product: Account Service Hub

- Current Plan: 3-Years Warranty

- Payment Method: Auto Debit

- Total Paid: USD342.17

- Client ID: WM1XGBLYD4

- Activation Key: e3b8f022-cbb3-469a-aaca-243806f7270c





This membership renews automatically at the end of each term unless changes are made at least 48 hours prior to the renewal date.



If you would like to review, adjust, or cancel your membership, please contact our support team at +1 (805)-843-0624.



With genuine gratitude,,

Norton Life lock Service

Accounts head: Manuel Kunkle

Administrative Department: 1601 Prude Mill Rd Fort Collins Co 80525-7527 Us

Business Hours: 6 AM – 6 PM



Powered by Google Calendar appointment scheduling. Use is subject to the Google Privacy Policy and Terms of Service.



You are receiving this email because you are included on the guest list for this booked appointment.



Forwarding this invitation could allow any recipient to cancel on your behalf.

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Mon, 29 Jun 2026 15:45:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1weJmK-00000000DzG-03Sr

for dave@doctor.nl2k.ab.ca;

Mon, 29 Jun 2026 15:44:32 -0600

Resent-From: The Doctor

Resent-Date: Mon, 29 Jun 2026 15:44:31 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail.senamhi.gob.pe ([190.119.131.37]:58700 helo=senamhi-mail.senamhi.gob.pe)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1weJIV-000000009mA-3lYt

for doctor@doctor.nl2k.ab.ca;

Mon, 29 Jun 2026 15:13:53 -0600

Received: from localhost (localhost [127.0.0.1])

by senamhi-mail.senamhi.gob.pe (Postfix) with ESMTP id 8707838989CF41;

Mon, 29 Jun 2026 15:32:44 -0500 (-05)

Received: from senamhi-mail.senamhi.gob.pe ([127.0.0.1])

by localhost (senamhi-mail.senamhi.gob.pe [127.0.0.1]) (amavis, port 10032)

with ESMTP id NrmHiC0P9BFo; Mon, 29 Jun 2026 15:32:43 -0500 (-05)

Received: from senamhi-mail.senamhi.gob.pe (localhost [127.0.0.1])

by senamhi-mail.senamhi.gob.pe (Postfix) with ESMTPS id DD671389890BB3;

Mon, 29 Jun 2026 15:32:42 -0500 (-05)

DKIM-Filter: OpenDKIM Filter v2.10.3 senamhi-mail.senamhi.gob.pe DD671389890BB3

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=senamhi.gob.pe;

s=92A4C6C2-509C-11F1-B330-7558252557ED; t=1782765163;

bh=M0kxO+YksMF/96KZnbWJTPsLmimEsgGFWMaRIOB+KmI=;

h=Date:From:Message-ID:MIME-Version;

b=JhvMFVly8RsX0nW78LJBNcUDJ/P7Rq/be1j5K0cji8fo3Ti7/kW0n4+3XRLfVTGaH

lrw5QYT1P8Le+xfDn4pNdv0U6htuwRrVVKBDtG9RDlFYFbhA/JrYt22NvZQ1ya3h08

eoZqPybguQ6FZmA2zDz63nskq4KmsRteZZGoBp6Qp/Nef5Gg7OEJMRl/hJOMZYddhS

bK/w1JMgfbnc8L47sz2ZSqwMJb8t0YPN/x4/oaaX2tLQFQQYVtphrayhdV/Ia6HcZb

utJlVzNZNKQ19jInCbbuShD7pMB10ctmBpQ3SAPZ2CaLh4BqCaClMjcH/ASvVIwv8O

QDGi1cvsE/+FQ==

Received: from senamhi-mail.senamhi.gob.pe (mail.senamhi.gob.pe [10.10.20.5])

by senamhi-mail.senamhi.gob.pe (Postfix) with ESMTP id 5E37B3160FB8C8;

Mon, 29 Jun 2026 15:32:37 -0500 (-05)

Date: Mon, 29 Jun 2026 15:32:37 -0500 (PET)

From: c.mori@senamhi.gob.pe

Reply-To: info@stefanquandtfoundation.com

Message-ID: <1436731749.204083.1782765157327.JavaMail.zimbra@senamhi.gob.pe>

Subject: =?utf-8?Q?GL=C3=9CCKWUNSCH?=

MIME-Version: 1.0

Content-Type: multipart/alternative;

boundary="=_fbe075b9-c222-4959-b0a0-1a69291e7c90"

X-Originating-IP: [146.70.36.134]

X-Mailer: Zimbra 8.8.15_GA_4581 (zclient/8.8.15_GA_4581)

Thread-Index: YLHG5XRSQxyJKIf6yy3TH0yx1NdaDA==

Thread-Topic: =?utf-8?Q?GL=C3=9CCKWUNSCH?=

X-Spam_score: 6.3

X-Spam_score_int: 63

X-Spam_bar: ++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Herzlichen Glückwunsch! Wir freuen uns, Ihnen mitteilen

zu können, dass Ihre E-Mail-Adresse für eine Spende in Höhe von 1.200.000,00

USD aus dem Spendenprogramm der Stefan Quandt Foundation ausgewählt wurde.

Für weitere [...]



Content analysis details: (6.3 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[190.119.131.37 listed in dnsbl.ahbl.org]

[190.119.131.37 listed in dnsbl.ahbl.org]

[190.119.131.37 listed in dnsbl.ahbl.org]

[190.119.131.37 listed in dnsbl.ahbl.org]

[146.70.36.134 listed in dnsbl.ahbl.org]

[146.70.36.134 listed in dnsbl.ahbl.org]

[146.70.36.134 listed in dnsbl.ahbl.org]

[146.70.36.134 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[190.119.131.37 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[190.119.131.37 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[190.119.131.37 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[190.119.131.37 listed in dnsbl.ahbl.org]

1.6 RCVD_IN_BRBL_LASTEXT RBL: No description available.

[190.119.131.37 listed in bb.barracudacentral.org]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-0.0 SPF_PASS SPF: sender matches SPF record

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

1.2 MISSING_HEADERS Missing To: header

-0.0 T_RP_MATCHES_RCVD Envelope sender domain matches handover relay

domain

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[190.119.131.37 listed in bl.score.senderscore.com]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[146.70.36.134 listed in will-spam-for-food.eu.org]

[146.70.36.134 listed in will-spam-for-food.eu.org]

[146.70.36.134 listed in will-spam-for-food.eu.org]

[146.70.36.134 listed in will-spam-for-food.eu.org]

[146.70.36.134 listed in will-spam-for-food.eu.org]

[146.70.36.134 listed in will-spam-for-food.eu.org]

[146.70.36.134 listed in will-spam-for-food.eu.org]

[146.70.36.134 listed in will-spam-for-food.eu.org]

[190.119.131.37 listed in will-spam-for-food.eu.org]

[190.119.131.37 listed in will-spam-for-food.eu.org]

[190.119.131.37 listed in will-spam-for-food.eu.org]

[190.119.131.37 listed in will-spam-for-food.eu.org]

[190.119.131.37 listed in will-spam-for-food.eu.org]

[190.119.131.37 listed in will-spam-for-food.eu.org]

[190.119.131.37 listed in will-spam-for-food.eu.org]

[190.119.131.37 listed in will-spam-for-food.eu.org]

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 NO_RDNS2 Sending MTA has no reverse DNS

1.9 REPLYTO_WITHOUT_TO_CC No description available.

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

0.0 LOTS_OF_MONEY Huge... sums of money

Subject: {SPAM?} =?utf-8?Q?GL=C3=9CCKWUNSCH?=



--=_fbe075b9-c222-4959-b0a0-1a69291e7c90

Content-Type: text/plain; charset=utf-8

Content-Transfer-Encoding: quoted-printable









Herzlichen Gl=C3=BCckwunsch!



Wir freuen uns, Ihnen mitteilen zu k=C3=B6nnen, dass Ihre E-Mail-Adresse f=

=C3=BCr eine Spende in H=C3=B6he von 1.200.000,00 USD aus dem Spendenprogra=

mm der Stefan Quandt Foundation ausgew=C3=A4hlt wurde. F=C3=BCr weitere Inf=

ormationen zu dieser Spende und den erforderlichen Schritten zur Bearbeitun=

g und Auszahlung Ihrer Pr=C3=A4mie kontaktieren Sie bitte unsere offizielle=

Spendenabteilung per E-Mail unter info@stefanquandtfoundation.com.

--=_fbe075b9-c222-4959-b0a0-1a69291e7c90

Content-Type: text/html; charset=utf-8

Content-Transfer-Encoding: quoted-printable

<=

div>

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Mon, 29 Jun 2026 15:43:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1weJkq-00000000DkC-0IXD

for dave@doctor.nl2k.ab.ca;

Mon, 29 Jun 2026 15:43:00 -0600

Resent-From: The Doctor

Resent-Date: Mon, 29 Jun 2026 15:42:59 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-m105.netease.com ([154.81.10.5]:20832)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1weEtt-000000001Bm-3wVJ

for sales@nk.ca;

Mon, 29 Jun 2026 10:32:12 -0600

Content-Type: multipart/alternative; BOUNDARY="=_Part_1089161_2100749458.1782750665618"

To: sales

Subject: =?UTF-8?B?UmU6TG9va2luZyBmb3IgTmV3IFNvbGUgRGV2ZWxvcG1lbnQgT3B0aW9ucz8=?=

X-Priority: 3

MIME-Version: 1.0

Received: from serenatam@lebaijk.com( [10.139.5.81] ) by ajax-webmail ( [127.0.0.1] ) ; Tue, 30 Jun 2026 00:31:05 +0800 (GMT+08:00)

From: SerenaTam

Date: Tue, 30 Jun 2026 00:31:05 +0800 (GMT+08:00)

X-WM-Tid: 0a9f14385b0dd0bekusyc73b6dbe15c856

DKIM-Signature: a=rsa-sha256;

b=euXuKvmhi6gpl3SM8t6mt6BwXVF5aZZo64VhSeDf5T4C/fvecvd3fZ5otEETTh04xlv2GqHm830GltAZyYSUiFeisIfodkZPw3QJtE1fD0xqkp7wh7/m7h6F8qDwn3HZFjowm0BmOJiIqzB0fGUYdNVpmSSOwLZQQ5joE0RQxkWuElvTjnCpDjqLmlMgOnu06h+lXRRBj+vLQb7UMuHWc0I5gTXNFqjTLXT+kx5LjIsrXotviVtyIlw7hZhiguZxCwb7IIkJpgYQJZCkTg7H9/rav4n5wgbfVMo43WiwvhMcSh1nTK/sXAMsqfi6sj4CcHS4fhDvsWFIQzDnMxgxKw==; s=default; c=relaxed/relaxed; d=lebaijk.com; v=1;

bh=kSwu5SwwyYGxBOSZhMTxGjWT34h/O65YbH47PvbpehE=;

h=date:mime-version:subject:message-id:from;

Message-ID:





Hi sales,

I hope this email finds you well.

Thank you for subscribing to our newsletter. We're thrilled to have you on board!

I am excited to inform you that we are currently offering a special promotion on our products.If you have any needs, please let me know as soon as possible so I can secure a discounted spot for you.

Thank you for your attention, and I look forward to hearing from you soon.

Best regards,







Secure your updates and feature insights at . Continue Product News



Wish to step back? Quickly hit Control Contact Settings.





SerenaTam

serenatam@lebaijk.com









在2026-06-24，SerenaTam 写道:



-----原始邮件-----

发件人： SerenaTam

发件时间: 2026年06月24日 周三

收件人： [sales ]

主题： Looking for New Sole Development Options?





Enable regular insights and our product’s newest features by hittinging . Continue Updates



If you’d rather not get more emails, just hit Adjust Settings at any time.

Hi Sales,



Besides standard outsole designs, we support custom mold development and OEM production for footwear projects.



If you're developing new styles, we'd be happy to share some samples.





Best regards,

SerenaTam

serenatam@lebaijk.com





在2026-06-22，SerenaTam 写道:



-----原始邮件-----

发件人： SerenaTam

发件时间: 2026年06月22日 周一

收件人： [sales ]

主题： Custom Shoe Sole Solutions for Footwear Brands



Hi Sales，



We specialize in custom shoe soles, including natural rubber and bio-based sole solutions for footwear brands and manufacturers.



Would you be interested in seeing some of our latest sole designs?



Reply interested if you do.





Best regards,



Maintain your product-savvy edge with . Stay Updated on News



If you prefer to exit, choose Review Communication Options.





SerenaTam

serenatam@lebaijk.com

-size:11pt;font-family:Calibri,sans-serif;color:rgb(36,36,36)">
=3D"border:0px;font-style:inherit;font-variant-ligatures:inherit;font-varia=

nt-caps:inherit;font-variant-alternates:inherit;font-variant-numeric:inheri=

t;font-variant-east-asian:inherit;font-size:9pt;line-height:13.8px;margin:0=

px;padding:0px;vertical-align:baseline;color:inherit">As

of today, paying your rent by check, pre-authorized or credit card is=20

no longer valid and your rent payment must be made by Interac transfer.
an>

;font-family:Calibri,sans-serif;color:rgb(36,36,36)">
0px;font-style:inherit;font-variant-ligatures:inherit;font-variant-caps:inh=

erit;font-variant-alternates:inherit;font-variant-numeric:inherit;font-vari=

ant-east-asian:inherit;font-size:9pt;line-height:13.8px;margin:0px;padding:=

0px;vertical-align:baseline;color:inherit">At

the same time, we kindly ask you to pay your rent by Interac transfer=20

to our new Interac account whose email address is marked below.

<=

p style=3D"margin:0cm 0cm 10pt;line-height:16.8667px;font-size:11pt;font-fa=

mily:Calibri,sans-serif;color:rgb(36,36,36)">
-style:inherit;font-variant-ligatures:inherit;font-variant-caps:inherit;fon=

t-variant-alternates:inherit;font-variant-numeric:inherit;font-variant-east=

-asian:inherit;font-size:9pt;line-height:13.8px;margin:0px;padding:0px;vert=

ical-align:baseline;color:inherit">Email address for Interac transfer
>
t;font-variant-caps:inherit;font-variant-alternates:inherit;font-variant-nu=

meric:inherit;font-variant-east-asian:inherit;font-size:9pt;line-height:13.=

8px;margin:0px;padding:0px;vertical-align:baseline;color:inherit">:=C2=A0=

=C2=A0=C2=A0
vicegestionlocative018@gmail.com" target=3D"_blank">servicegestionlocative0=

18@gmail.com

667px;font-size:11pt;font-family:Calibri,sans-serif;color:rgb(36,36,36)">
pan style=3D"border:0px;font-style:inherit;font-variant-ligatures:inherit;f=

ont-variant-caps:inherit;font-variant-alternates:inherit;font-variant-numer=

ic:inherit;font-variant-east-asian:inherit;font-size:9pt;line-height:13.8px=

;margin:0px;padding:0px;vertical-align:baseline;color:inherit">Please use t=

he following question and answer as specified.

:0cm 0cm 10pt;line-height:16.8667px;font-size:11pt;font-family:Calibri,sans=

-serif;color:rgb(36,36,36)">
nt-variant-ligatures:inherit;font-variant-caps:inherit;font-variant-alterna=

tes:inherit;font-variant-numeric:inherit;font-variant-east-asian:inherit;fo=

nt-size:9pt;line-height:13.8px;margin:0px;padding:0px;vertical-align:baseli=

ne;color:inherit">Security question:
tyle:inherit;font-variant-ligatures:inherit;font-variant-caps:inherit;font-=

variant-alternates:inherit;font-variant-numeric:inherit;font-variant-east-a=

sian:inherit;font-size:9pt;line-height:13.8px;margin:0px;padding:0px;vertic=

al-align:baseline;color:inherit">=C2=A0 =C2=A0=C2=A0
olor:rgb(255,0,0)">PAIEMENT

height:16.8667px;font-size:11pt;font-family:Calibri,sans-serif;color:rgb(36=

,36,36)">
s:inherit;font-variant-caps:inherit;font-variant-alternates:inherit;font-va=

riant-numeric:inherit;font-variant-east-asian:inherit;font-size:9pt;line-he=

ight:13.8px;margin:0px;padding:0px;vertical-align:baseline;color:inherit">S=

ecurity Response:
ariant-ligatures:inherit;font-variant-caps:inherit;font-variant-alternates:=

inherit;font-variant-numeric:inherit;font-variant-east-asian:inherit;font-s=

ize:9pt;line-height:13.8px;margin:0px;padding:0px;vertical-align:baseline;c=

olor:inherit">=C2=A0 =C2=A0=C2=A0=C2=A0
0,0)">Interac1

7px;font-size:11pt;font-family:Calibri,sans-serif;color:rgb(36,36,36)">
n style=3D"border:0px;font-style:inherit;font-variant-ligatures:inherit;fon=

t-variant-caps:inherit;font-variant-alternates:inherit;font-variant-numeric=

:inherit;font-variant-east-asian:inherit;font-size:9pt;line-height:13.8px;m=

argin:0px;padding:0px;vertical-align:baseline;color:inherit">Please confirm=

by email when the transfer is made.

0pt;line-height:16.8667px;font-size:11pt;font-family:Calibri,sans-serif;col=

or:rgb(36,36,36)">
-ligatures:inherit;font-variant-caps:inherit;font-variant-alternates:inheri=

t;font-variant-numeric:inherit;font-variant-east-asian:inherit;font-size:9p=

t;line-height:13.8px;margin:0px;padding:0px;vertical-align:baseline;color:i=

nherit">We

therefore thank you for proceeding as quickly as possible (within 3=20

days from the date of receipt of this letter) to pay this deadline in=20

order to regularize your situation.

pt;line-height:16.8667px;font-size:11pt;font-family:Calibri,sans-serif;colo=

r:rgb(36,36,36)">
ligatures:inherit;font-variant-caps:inherit;font-variant-alternates:inherit=

;font-variant-numeric:inherit;font-variant-east-asian:inherit;font-size:9pt=

;line-height:13.8px;margin:0px;padding:0px;vertical-align:baseline;color:in=

herit">In this anticipation, we ask you to accept the expression of our dis=

tinguished greetings.

:16.8667px;font-size:11pt;font-family:Calibri,sans-serif;color:rgb(36,36,36=

)">
rit;font-variant-caps:inherit;font-variant-alternates:inherit;font-variant-=

numeric:inherit;font-variant-east-asian:inherit;font-size:9pt;line-height:1=

3.8px;margin:0px;padding:0px;vertical-align:baseline;color:inherit">Please =

feel free to respond directly to this email.

cm 0cm 10pt;line-height:16.8667px;font-size:11pt;font-family:Calibri,sans-s=

erif;color:rgb(36,36,36)">
-variant-ligatures:inherit;font-variant-caps:inherit;font-variant-alternate=

s:inherit;font-variant-numeric:inherit;font-variant-east-asian:inherit;font=

-size:9pt;line-height:13.8px;margin:0px;padding:0px;vertical-align:baseline=

;color:inherit">Accounting Service

yle=3D"margin:0cm 0cm 10pt;line-height:16.8667px;font-size:11pt;font-family=

:Calibri,sans-serif;color:rgb(36,36,36)">
le:inherit;font-variant-ligatures:inherit;font-variant-caps:inherit;font-va=

riant-alternates:inherit;font-variant-numeric:inherit;font-variant-east-asi=

an:inherit;font-size:9pt;line-height:13.8px;margin:0px;padding:0px;vertical=

-align:baseline;color:inherit">Par

la m=C3=AAme occasion, nous vous prions de bien vouloir effectuer le=20

paiement de votre loyer par virement Interac vers notre nouveau compte=20

Interac dont l=E2=80=99adresse courriel est marqu=C3=A9e en dessous.=

nt-family:Calibri,sans-serif;color:rgb(36,36,36)">
;font-style:inherit;font-variant-ligatures:inherit;font-variant-caps:inheri=

t;font-variant-alternates:inherit;font-variant-numeric:inherit;font-variant=

-east-asian:inherit;font-size:9pt;line-height:13.8px;margin:0px;padding:0px=

;vertical-align:baseline;color:inherit">Adresse courriel du virement Intera=

c
:inherit;font-variant-caps:inherit;font-variant-alternates:inherit;font-var=

iant-numeric:inherit;font-variant-east-asian:inherit;font-size:9pt;line-hei=

ght:13.8px;margin:0px;padding:0px;vertical-align:baseline;color:inherit">:=

=C2=A0=C2=A0
vicegestionlocative018@gmail.com" target=3D"_blank">servicegestionlocative0=

18@gmail.com

667px;font-size:11pt;font-family:Calibri,sans-serif;color:rgb(36,36,36)">
pan style=3D"border:0px;font-style:inherit;font-variant-ligatures:inherit;f=

ont-variant-caps:inherit;font-variant-alternates:inherit;font-variant-numer=

ic:inherit;font-variant-east-asian:inherit;font-size:9pt;line-height:13.8px=

;margin:0px;padding:0px;vertical-align:baseline;color:inherit">Veuillez uti=

liser la question et la r=C3=A9ponse suivantes telles qu'elles ont =C3=

=A9t=C3=A9 sp=C3=A9cifi=C3=A9es.

line-height:16.8667px;font-size:11pt;font-family:Calibri,sans-serif;color:r=

gb(36,36,36)">
atures:inherit;font-variant-caps:inherit;font-variant-alternates:inherit;fo=

nt-variant-numeric:inherit;font-variant-east-asian:inherit;font-size:9pt;li=

ne-height:13.8px;margin:0px;padding:0px;vertical-align:baseline;color:inher=

it">Question de s=C3=A9curit=C3=A9
le:inherit;font-variant-ligatures:inherit;font-variant-caps:inherit;font-va=

riant-alternates:inherit;font-variant-numeric:inherit;font-variant-east-asi=

an:inherit;font-size:9pt;line-height:13.8px;margin:0px;padding:0px;vertical=

-align:baseline;color:inherit">:=C2=A0=C2=A0=C2=A0
or:rgb(255,0,0)">PAIEMENT

ight:16.8667px;font-size:11pt;font-family:Calibri,sans-serif;color:rgb(36,3=

6,36)">
inherit;font-variant-caps:inherit;font-variant-alternates:inherit;font-vari=

ant-numeric:inherit;font-variant-east-asian:inherit;font-size:9pt;line-heig=

ht:13.8px;margin:0px;padding:0px;vertical-align:baseline;color:inherit">R=

=C3=A9ponse de s=C3=A9curit=C3=A9
e:inherit;font-variant-ligatures:inherit;font-variant-caps:inherit;font-var=

iant-alternates:inherit;font-variant-numeric:inherit;font-variant-east-asia=

n:inherit;font-size:9pt;line-height:13.8px;margin:0px;padding:0px;vertical-=

align:baseline;color:inherit">:=C2=A0=C2=A0=C2=A0=C2=A0
=3D"color:rgb(255,0,0)">Interac1

line-height:16.8667px;font-size:11pt;font-family:Calibri,sans-serif;color:r=

gb(36,36,36)">
atures:inherit;font-variant-caps:inherit;font-variant-alternates:inherit;fo=

nt-variant-numeric:inherit;font-variant-east-asian:inherit;font-size:9pt;li=

ne-height:13.8px;margin:0px;padding:0px;vertical-align:baseline;color:inher=

it">Merci de nous confirmer par e-mail quand le virement est fait.
p>

-family:Calibri,sans-serif;color:rgb(36,36,36)">
ont-style:inherit;font-variant-ligatures:inherit;font-variant-caps:inherit;=

font-variant-alternates:inherit;font-variant-numeric:inherit;font-variant-e=

ast-asian:inherit;font-size:9pt;line-height:13.8px;margin:0px;padding:0px;v=

ertical-align:baseline;color:inherit">Aussi,

nous vous remercions de proc=C3=A9der au plus vite (sous 3 jours =C3=A0 co=

mpter=20

de la date de r=C3=A9ception de cette lettre) au r=C3=A8glement de cette =

=C3=A9ch=C3=A9ance=20

afin de r=C3=A9gulariser votre situation.

0cm 10pt;line-height:16.8667px;font-size:11pt;font-family:Calibri,sans-seri=

f;color:rgb(36,36,36)">
riant-ligatures:inherit;font-variant-caps:inherit;font-variant-alternates:i=

nherit;font-variant-numeric:inherit;font-variant-east-asian:inherit;font-si=

ze:9pt;line-height:13.8px;margin:0px;padding:0px;vertical-align:baseline;co=

lor:inherit">Dans cette attente, nous vous prions d=E2=80=99agr=C3=A9er, l=

=E2=80=99expression de nos salutations distingu=C3=A9es.

=3D"margin:0cm 0cm 10pt;line-height:16.8667px;font-size:11pt;font-family:Ca=

libri,sans-serif;color:rgb(36,36,36)">
inherit;font-variant-ligatures:inherit;font-variant-caps:inherit;font-varia=

nt-alternates:inherit;font-variant-numeric:inherit;font-variant-east-asian:=

inherit;font-size:9pt;line-height:13.8px;margin:0px;padding:0px;vertical-al=

ign:baseline;color:inherit">N=E2=80=99h=C3=A9sitez pas =C3=A0 r=C3=A9pondre=

directement =C3=A0 ce courriel.

line-height:16.8667px;font-size:11pt;font-family:Calibri,sans-serif;color:r=

gb(36,36,36)">
atures:inherit;font-variant-caps:inherit;font-variant-alternates:inherit;fo=

nt-variant-numeric:inherit;font-variant-east-asian:inherit;font-size:9pt;li=

ne-height:13.8px;margin:0px;padding:0px;vertical-align:baseline;color:inher=

it">Le service comptabilit=C3=A9

line-height:16.8667px;font-size:11pt;font-family:Calibri,sans-serif;color:r=

gb(36,36,36)">
atures:inherit;font-variant-caps:inherit;font-variant-alternates:inherit;fo=

nt-variant-numeric:inherit;font-variant-east-asian:inherit;font-size:9pt;li=

ne-height:13.8px;margin:0px;padding:0px;vertical-align:baseline;color:inher=

it">_______________________________________________________________<=

/p>

t-family:Calibri,sans-serif;color:rgb(36,36,36)">
font-style:inherit;font-variant-ligatures:inherit;font-variant-caps:inherit=

;font-variant-alternates:inherit;font-variant-numeric:inherit;font-variant-=

east-asian:inherit;font-size:9pt;line-height:13.8px;margin:0px;padding:0px;=

vertical-align:baseline;color:inherit">Dear Tenants,

margin:0cm 0cm 10pt;line-height:16.8667px;font-size:11pt;font-family:Calibr=

i,sans-serif;color:rgb(36,36,36)">
rit;font-variant-ligatures:inherit;font-variant-caps:inherit;font-variant-a=

lternates:inherit;font-variant-numeric:inherit;font-variant-east-asian:inhe=

rit;font-size:9pt;line-height:13.8px;margin:0px;padding:0px;vertical-align:=

baseline;color:inherit">As

of today 29/06/2026, we inform you of the update of our bank details=20

concerning the payment of your rent for the month of JUNE 2026.

<=

p style=3D"margin:0cm 0cm 10pt;line-height:16.8667px;font-size:11pt;font-fa=

mily:Calibri,sans-serif;color:rgb(36,36,36)">
-style:inherit;font-variant-ligatures:inherit;font-variant-caps:inherit;fon=

t-variant-alternates:inherit;font-variant-numeric:inherit;font-variant-east=

-asian:inherit;font-size:9pt;line-height:13.8px;margin:0px;padding:0px;vert=

ical-align:baseline;color:inherit">In

accordance with the signed rental contract, the due date for payment of

your rent is set at the end of each month or the beginning of the=20

month.

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Mon, 29 Jun 2026 15:41:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1weJiq-00000000DNa-3J22

for dave@doctor.nl2k.ab.ca;

Mon, 29 Jun 2026 15:40:56 -0600

Resent-From: The Doctor

Resent-Date: Mon, 29 Jun 2026 15:40:56 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-ed1-f41.google.com ([209.85.208.41]:53435)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1weDGy-00000000AgH-2oRR

for doctor@nl2k.ab.ca;

Mon, 29 Jun 2026 08:47:54 -0600

Received: by mail-ed1-f41.google.com with SMTP id 4fb4d7f45d1cf-69863ecfa9dso2033029a12.2

for ; Mon, 29 Jun 2026 07:46:57 -0700 (PDT)

ARC-Seal: i=1; a=rsa-sha256; t=1782744411; cv=none;

d=google.com; s=arc-20260327;

b=gR8pqnE19S04i7SuqxyF9zOxeRJ/7o7C4nRVb+SCnOLQDoYLHJQheUPgYv04XDtqav

oui+q8bDgTHNBh4K7SoexySMj9MF5WXzRnYqqsyYUvi5OwXMYVHMn87NDxVSFQ62zUY1

3nj2CsDNert+nLajnwu2ZBDDfXvWr8Agv1XBmer/RDB3KN+qorKZikKABDY/59sDdSWq

nFtsnGOsXywvBUR5kUIFJCxd1pqta5BTVU2O0rSM42EJ/kQq6sxv0xn79zxhXEdOtMJ5

1boe8TTnGVC5/oDMKtSNjINRbd20ojGVCXGNizKlPgOAD3klVvsE0wwxBKfxf1maiDUF

Se7w==

ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20260327;

h=to:subject:message-id:date:from:reply-to:mime-version

:dkim-signature;

bh=GYGvENwrUrg5NVOSfiUvhJ2ZBi9K+PVvaqKDKVfbMRQ=;

fh=XYJH9pod8nz9u2musqNgcQzZybXAtB6FYPaJ54RtA6o=;

b=mCPx1wVrIwZ+M/n+V0bbtaUdEComXl3+Wtgy7sU6PDZOalBRIZ2X2u376daqy+hf2+

CCmmIIAG9YQ9ipfDpbr5TWy2oXX3BYEX5Xc7jaVo/bgKiOUuhlJy5Uyiw2KYBp2yPqSD

D6tqTQFj79Y0FakbV8qbI9mebQbBQ3GNUlaZB9xfJxLKjah6u04TjxVfQ+sKMCZ6i4OT

rYwS6oxxNnlPTZMB5OE00cCI4lCfFyjWElcE1naCSNYKxuKx7l4xwdLxpL/lcxjZXmXh

xe7tqrTgLBzHigPB0xu/oP3L1XoTBW7EwJEzNOg9w469KxpbwOnrCn0gTSTFSwdxM1/o

9aBg==;

darn=nl2k.ab.ca

ARC-Authentication-Results: i=1; mx.google.com; arc=none

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=mail-uft-edu-br.20251104.gappssmtp.com; s=20251104; t=1782744411; x=1783349211; darn=nl2k.ab.ca;

h=to:subject:message-id:date:from:reply-to:mime-version:from:to:cc

:subject:date:message-id:reply-to;

bh=GYGvENwrUrg5NVOSfiUvhJ2ZBi9K+PVvaqKDKVfbMRQ=;

b=P3wDjh/1RvWr2n7iD7scXyXVw/tIy9aeYe3S2tyXY3cKpiVrKi4KXSdkEC1ZPbYGZq

y3SBMVU5VS32+iwbAL3CP/bkx0u0wn/HfIJki7lRAbISGVXPXzCxrjc3YIJaPsq44HqD

LdSLEBuqsofZNAif7JpEyX1+MTAcP6PN4VV/NZ0U4srlMA14eBg4tcI2j/dXuWv8BJvu

bwvYFUJ3Xpyzft2yrtR3GWqrokwS+PhCWHHcViKB0V8/Qanl+QYEDnuYvU1EumR/JXvi

0qZiAFir+J5vGAbzs4eIZCYugUeke6+oVFjugGfaXg5bcxe62qGDtAjBH9/k4iv95os+

N+5g==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20251104; t=1782744411; x=1783349211;

h=to:subject:message-id:date:from:reply-to:mime-version:x-gm-gg

:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to;

bh=GYGvENwrUrg5NVOSfiUvhJ2ZBi9K+PVvaqKDKVfbMRQ=;

b=clNwtw742JmxOsY68YdRop6ENDzPnJBquAXguy+zJcNKzkhYIHcIvKJBb8JZV7NtYz

ZMeofUinLiYoK2/Br5eUvX1PNh1J6gzXbOIJsAdRLb2DF/Q4G4b/8bo5b4HD9XG96Jpo

S8IhTuwbSyrutja0Ve+SDYlp4vOr60sD0bKPPsNmHrLyDobO1u5ruF7942rGZFPM4/aW

91iwVdw7ekb4o+3ZNUtS7s3n/gRA+5wtAHwzR2xigxv9RZ2rGzXNBKp+bFbiIPloQgU7

IjONgBgDdt49XJbQKSsd0BY5x0kLj7WgA8KDlpO5EeRF/56WWxqVFUBVT2ELQdjfjEe3

W++Q==

X-Forwarded-Encrypted: i=1; AHgh+Rpy3D5A5zZEZzq1D25z3cLrYuoe3d/V2yNL9ySW3Y+TOyn0LUDliVoiTQ3WjHFCH8349Jb6PyY=@nl2k.ab.ca

X-Gm-Message-State: AOJu0YxUThYJTTdrv495ZBmub6S3ncHUZxx5GcHK5pE61B2daK8yjRk7

wWq/ZeAmhKHjLL4OiYuujl+A6RQWKEc+mhZq5aQ6dACHoWZ5A45sPZas4/IwbeZcdFWhb2dxHCg

AZV3k/P7b69bdOBELGq0TObLgzYfq0J+OZX5Y4Em3PgV8Uzs9qXAXhaZZCflcXyF8HK0q9yvOrd

GdRlhJARwjYdmgZf+tFP56E4QxWbUOo2tflSmXWdJh7/qcH7SQdXFHK7e1exjwOxEvA67ZPaHrz

zg02s6rFSSu0zmi/AV/JvoMZdm+wnxPERst

X-Gm-Gg: AfdE7cnmE3tABTIRX2KnLvgborWqhuoyWXZhnq8fd/chUUw3Xh54c7WdBRF5up6glP3

ZCsGOLBERFeWHckspcvMTYcJGKPa/5x1OW1f279yxyDlGQCaoZqbTm95eASegxTuJBu7PRkX37I

8suv7XX/Vlh1LC08/c6hcuMG+BwvJS8IfHc2ZUjDwbeIqoJd4kZGD0FHCjYbf8hcHrZp8N3hkJL

PkoBTm6jkghPr12CVLOQakBc5wgGRkkh4S0aQSr8/BqulbN/kRDzOo9xnKJ0PjzzlZ4uHz5remT

PBcijzr1L0qx95YGw4pv3PqEcuSuQ08faREJQAYwO5n8N6oUKomP+rAQlH0YIZaJGHCNomi/pBj

jQ4szTRjrtWZ0

X-Received: by 2002:a05:6402:51cb:b0:698:663d:d7bb with SMTP id

4fb4d7f45d1cf-698663ddc7amr1856619a12.25.1782744409289; Mon, 29 Jun 2026

07:46:49 -0700 (PDT)

MIME-Version: 1.0

Reply-To: servicegestionlocative018@gmail.com

From: SERVICE LOCATIVE

Date: Mon, 29 Jun 2026 16:46:36 +0200

X-Gm-Features: AVVi8CfAk9oQrsGcrmBd5gB7g49EKfV_snkmSfkmRAzy9RtffWxd5XQQFiedHjE

Message-ID:

Subject: Chers Locataires,

To: undisclosed-recipients:;

Content-Type: multipart/alternative; boundary="0000000000003dd01b06556587b4"

Bcc: doctor@nl2k.ab.ca

X-CLOUD-SEC-AV-Sent: true

X-CLOUD-SEC-AV-Info: uft,google_mail,monitor

X-Gm-Spam: 0

X-Gm-Phishy: 0

X-Spam_score: 5.3

X-Spam_score_int: 53

X-Spam_bar: +++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: [image: unnamed.png] Chers Locataires, À ce jour 29/06/2026,

nous vous informons de la mise à jour de nos coordonnées bancaires concernant

le paiement de votre loyer pour le mois de juin 2026.



Content analysis details: (5.3 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[209.85.208.41 listed in will-spam-for-food.eu.org]

[209.85.208.41 listed in will-spam-for-food.eu.org]

[209.85.208.41 listed in will-spam-for-food.eu.org]

[209.85.208.41 listed in will-spam-for-food.eu.org]

[209.85.208.41 listed in will-spam-for-food.eu.org]

[209.85.208.41 listed in will-spam-for-food.eu.org]

[209.85.208.41 listed in will-spam-for-food.eu.org]

[209.85.208.41 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[209.85.208.41 listed in dnsbl.ahbl.org]

[209.85.208.41 listed in dnsbl.ahbl.org]

[209.85.208.41 listed in dnsbl.ahbl.org]

[209.85.208.41 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[209.85.208.41 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[209.85.208.41 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[209.85.208.41 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[209.85.208.41 listed in dnsbl.ahbl.org]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[209.85.208.41 listed in list.dnswl.org]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[209.85.208.41 listed in bl.score.senderscore.com]

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[209.85.208.41 listed in wl.mailspike.net]

-0.0 SPF_PASS SPF: sender matches SPF record

1.5 GR_DOMAIN_UNDISC1 To contains undisclosed recipient (undisc)

0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in digit

[servicegestionlocative018(at)gmail.com]

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 HTML_MESSAGE BODY: HTML included in message

2.5 FREEMAIL_FORGED_REPLYTO Freemail in Reply-To, but not From

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

Subject: {SPAM?} Chers Locataires,

--0000000000003dd01b06556587b4

Content-Type: text/plain; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable



[image: unnamed.png]



Chers Locataires,



=C3=80 ce jour 29/06/2026, nous vous informons de la mise =C3=A0 jour de no=

s

coordonn=C3=A9es bancaires concernant le paiement de votre loyer pour le mo=

is de

juin 2026.



Conform=C3=A9ment au contrat de location sign=C3=A9, l=E2=80=99=C3=A9ch=C3=

=A9ance pour le paiement de

votre loyer est fix=C3=A9e chaque fin de mois ou d=C3=A9but de mois.



=C3=80 compter d=E2=80=99aujourd=E2=80=99hui, le paiement de votre loyer pa=

r ch=C3=A8que, par

pr=C3=A9autoris=C3=A9 ou par carte de cr=C3=A9dit ne sont plus valables et =

votre paiement

pour le loyer doit se faire par virement Interac .



Par la m=C3=AAme occasion, nous vous prions de bien vouloir effectuer le

paiement de votre loyer par virement Interac vers notre nouveau compte

Interac dont l=E2=80=99adresse courriel est marqu=C3=A9e en dessous.



Adresse courriel du virement Interac: servicegestionlocative018@gmail.com



Veuillez utiliser la question et la r=C3=A9ponse suivantes telles qu'elles =

ont

=C3=A9t=C3=A9 sp=C3=A9cifi=C3=A9es.



Question de s=C3=A9curit=C3=A9: PAIEMENT



R=C3=A9ponse de s=C3=A9curit=C3=A9: Interac1



Merci de nous confirmer par e-mail quand le virement est fait.



Aussi, nous vous remercions de proc=C3=A9der au plus vite (sous 3 jours =C3=

=A0

compter de la date de r=C3=A9ception de cette lettre) au r=C3=A8glement de =

cette

=C3=A9ch=C3=A9ance afin de r=C3=A9gulariser votre situation.



Dans cette attente, nous vous prions d=E2=80=99agr=C3=A9er, l=E2=80=99expre=

ssion de nos

salutations distingu=C3=A9es.



N=E2=80=99h=C3=A9sitez pas =C3=A0 r=C3=A9pondre directement =C3=A0 ce courr=

iel.



Le service comptabilit=C3=A9



_______________________________________________________________



Dear Tenants,



As of today 29/06/2026, we inform you of the update of our bank details

concerning the payment of your rent for the month of JUNE 2026.



In accordance with the signed rental contract, the due date for payment of

your rent is set at the end of each month or the beginning of the month.



As of today, paying your rent by check, pre-authorized or credit card is no

longer valid and your rent payment must be made by Interac transfer.



At the same time, we kindly ask you to pay your rent by Interac transfer to

our new Interac account whose email address is marked below.



Email address for Interac transfer: servicegestionlocative018@gmail.com



Please use the following question and answer as specified.



Security question: PAIEMENT



Security Response: Interac1



Please confirm by email when the transfer is made.



We therefore thank you for proceeding as quickly as possible (within 3 days

from the date of receipt of this letter) to pay this deadline in order to

regularize your situation.



In this anticipation, we ask you to accept the expression of our

distinguished greetings.



Please feel free to respond directly to this email.



Accounting Service



--0000000000003dd01b06556587b4

Content-Type: text/html; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable

----_NmP-5d57c1e10feb6c21-Part_1

Content-Type: text/plain; charset=utf-8

Content-Transfer-Encoding: quoted-printable



EFT Payment Authorization Required.



Review Documents https://shared.=

ospreycharterfishing.ca/?t=3Dc2FsZXNAbmsuY2E



Do Not Share This Email



This email contains a secure link to Docusign. Please do not share this =

email, link, or access code with others.



This message was sent by nk.ca =

using DocuSign. If you wish to stop receiving emails, contact the sender.

----_NmP-5d57c1e10feb6c21-Part_1

Content-Type: text/html; charset=utf-8

Content-Transfer-Encoding: quoted-printable












initial-scale=3D1">






Helvetica,sans-serif;">

style=3D"max-width:640px;"> 22px;background:#ffffff;"> 0/email/emailLogo.png" alt=3D"Docusign" width=3D"118" = style=3D"display:block;border:0;"> border=3D"0" bgcolor=3D"#260559" style=3D"border-radius:16px;"> .98.0/email/iconSign.png" alt=3D"" width=3D"48" height=3D"48" = style=3D"display:block;border:0;margin:0 auto;"> 0;color:#ffffff;">EFT Payment Authorization Required. t=3Dc2FsZXNAbmsuY2E" style=3D"display:inline-block;background:#735AFF;color= :#ffffff;font-size:15px;font-weight:700;text-decoration:none;border-radius:= 8px;line-height:44px;padding:0 24px;">Review Documents 13px;color:#130032;line-height:18px;"> Do Not Share This Email This email contains a secure link to Docusign. Please do not = share this email, link, or access code with others. 666;text-align:center;background:#f4f4f4;border:1px solid = #e0e0e0;border-radius:4px;padding:11px 15px;"> This message was sent by nk.ca using DocuSign. If you wish to= stop receiving emails, contact the sender.

----_NmP-5d57c1e10feb6c21-Part_1--

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Mon, 29 Jun 2026 08:48:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1weDGV-00000000AjM-01fj

for dave@doctor.nl2k.ab.ca;

Mon, 29 Jun 2026 08:47:15 -0600

Resent-From: The Doctor

Resent-Date: Mon, 29 Jun 2026 08:47:14 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from a9-156.smtp-out.amazonses.com ([54.240.9.156]:43349)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.99.3 (FreeBSD))

(envelope-from <0100019f13bb0fdc-cdb49eb2-bce9-42cf-8ef1-868caf3baf54-000000@send.mail.actforcanada.org>)

id 1weClP-000000006dw-1QTF

for sales@nk.ca;

Mon, 29 Jun 2026 08:15:14 -0600

DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/simple; s=resend;

d=mail.actforcanada.org; t=1782742454;

h=From:To:Subject:Message-ID:Date:MIME-Version:Content-Type;

bh=bO7dDMwC/pgI3dSoNTvg569ieB75Kx4nOkXhCK/VIag=;

b=skFlG4cF5d+RCjw7e971oCimCaxJ64p9NnRXrenqTOCNESGKw3AuX2w4d6+cDGGR

axvXGgYZ7pgs2uf4SaUgTlr+584HyQINyE8sZJbSadz6a350uHmnQTDGDAJogeY2h+e

W5I4HvC922xlMvmIZfjQE0lMc2raEcmeRbBwuxCk=

DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/simple;

s=224i4yxa5dv7c2xz3womw6peuasteono; d=amazonses.com; t=1782742454;

h=From:To:Subject:Message-ID:Date:MIME-Version:Content-Type:Feedback-ID;

bh=bO7dDMwC/pgI3dSoNTvg569ieB75Kx4nOkXhCK/VIag=;

b=Zo57p+F7CplcWTRlcTHmoKT2RsusuN24RAv/bHBqEOdxWRDorkttNu84mhABqr7W

9z/hxkBvGpIpf0yZAqLRxMGnwq48UCkTr/GcPf8tF/W+YvWBbvit0ZLFaTceRA1Nxpf

NpxUQUJgEC+/BiCOiACBgtwaILIZLkWp7mHfLQXQ=

From: DocuSign

To: sales@nk.ca

Subject: Review Document: EFT Payment Authorization Notice

Message-ID: <0100019f13bb0fdc-cdb49eb2-bce9-42cf-8ef1-868caf3baf54-000000@email.amazonses.com>

Date: Mon, 29 Jun 2026 14:14:14 +0000

MIME-Version: 1.0

Content-Type: multipart/alternative;

boundary="--_NmP-5d57c1e10feb6c21-Part_1"

Feedback-ID: :1.us-east-1.Qbuke0KWFseNm4ZY5BZZcA857c7btUUKWdYGLfiVNfnNo1sjs/fTPiEEYfIL81lYM6M2fq+7rUQynMmcjRJhO6NTEDm15yorO7g/kF0uLWLFC4SvlmBpV70qbwlaFJeXLBwlAXNuUqELHhJxhzT5qSbM+zv1Trp3TaezYEQqdGA=:1.us-east-1.QSNtDRXSTq9sAuvRl56h5mypgasnQ5yDLNpVzTnziu0=:AmazonSES

X-SES-Outgoing: 2026.06.29-54.240.9.156

X-Spam_score: 6.9

X-Spam_score_int: 69

X-Spam_bar: ++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: EFT Payment Authorization Required. Review Documents https://shared.ospreycharterfishing.ca/?t=c2FsZXNAbmsuY2E

Do Not Share This Email



Content analysis details: (6.9 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[54.240.9.156 listed in will-spam-for-food.eu.org]

[54.240.9.156 listed in will-spam-for-food.eu.org]

[54.240.9.156 listed in will-spam-for-food.eu.org]

[54.240.9.156 listed in will-spam-for-food.eu.org]

[54.240.9.156 listed in will-spam-for-food.eu.org]

[54.240.9.156 listed in will-spam-for-food.eu.org]

[54.240.9.156 listed in will-spam-for-food.eu.org]

[54.240.9.156 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[54.240.9.156 listed in dnsbl.ahbl.org]

[54.240.9.156 listed in dnsbl.ahbl.org]

[54.240.9.156 listed in dnsbl.ahbl.org]

[54.240.9.156 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[54.240.9.156 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[54.240.9.156 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[54.240.9.156 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[54.240.9.156 listed in dnsbl.ahbl.org]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-0.0 SPF_PASS SPF: sender matches SPF record

2.0 GR_DOMAIN_AMAZON1 Received contains spam friendly host (amazon)

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[54.240.9.156 listed in list.dnswl.org]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[54.240.9.156 listed in bl.score.senderscore.com]

-0.0 RCVD_IN_MSPIKE_H3 RBL: Good reputation (+3)

[54.240.9.156 listed in wl.mailspike.net]

1.5 MR_STRANGE_QUESTION URI: No description available.

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_IMAGE_ONLY_32 BODY: HTML: images with 2800-3200 bytes of words

2.0 RATWR8_MESSID Message-ID with excessive dashes and dollars

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

0.1 MXG_SPOOFED_DOCUSIGN Docusign spoofing

-0.0 RCVD_IN_MSPIKE_WL Mailspike good senders

Subject: {SPAM?} Review Document: EFT Payment Authorization Notice

----_NmP-5d57c1e10feb6c21-Part_1

Content-Type: text/plain; charset=utf-8

Content-Transfer-Encoding: quoted-printable



EFT Payment Authorization Required.



Review Documents https://shared.=

ospreycharterfishing.ca/?t=3Dc2FsZXNAbmsuY2E



Do Not Share This Email



This email contains a secure link to Docusign. Please do not share this =

email, link, or access code with others.



This message was sent by nk.ca =

using DocuSign. If you wish to stop receiving emails, contact the sender.

----_NmP-5d57c1e10feb6c21-Part_1

Content-Type: text/html; charset=utf-8

Content-Transfer-Encoding: quoted-printable












initial-scale=3D1">






Helvetica,sans-serif;">

style=3D"max-width:640px;"> 22px;background:#ffffff;"> 0/email/emailLogo.png" alt=3D"Docusign" width=3D"118" = style=3D"display:block;border:0;"> border=3D"0" bgcolor=3D"#260559" style=3D"border-radius:16px;"> .98.0/email/iconSign.png" alt=3D"" width=3D"48" height=3D"48" = style=3D"display:block;border:0;margin:0 auto;"> 0;color:#ffffff;">EFT Payment Authorization Required. t=3Dc2FsZXNAbmsuY2E" style=3D"display:inline-block;background:#735AFF;color= :#ffffff;font-size:15px;font-weight:700;text-decoration:none;border-radius:= 8px;line-height:44px;padding:0 24px;">Review Documents 13px;color:#130032;line-height:18px;"> Do Not Share This Email This email contains a secure link to Docusign. Please do not = share this email, link, or access code with others. 666;text-align:center;background:#f4f4f4;border:1px solid = #e0e0e0;border-radius:4px;padding:11px 15px;"> This message was sent by nk.ca using DocuSign. If you wish to= stop receiving emails, contact the sender.

----_NmP-5d57c1e10feb6c21-Part_1--

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Mon, 29 Jun 2026 08:48:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1weDGV-00000000AjM-01fj

for dave@doctor.nl2k.ab.ca;

Mon, 29 Jun 2026 08:47:15 -0600

Resent-From: The Doctor

Resent-Date: Mon, 29 Jun 2026 08:47:14 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from a9-156.smtp-out.amazonses.com ([54.240.9.156]:43349)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.99.3 (FreeBSD))

(envelope-from <0100019f13bb0fdc-cdb49eb2-bce9-42cf-8ef1-868caf3baf54-000000@send.mail.actforcanada.org>)

id 1weClP-000000006dw-1QTF

for sales@nk.ca;

Mon, 29 Jun 2026 08:15:14 -0600

DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/simple; s=resend;

d=mail.actforcanada.org; t=1782742454;

h=From:To:Subject:Message-ID:Date:MIME-Version:Content-Type;

bh=bO7dDMwC/pgI3dSoNTvg569ieB75Kx4nOkXhCK/VIag=;

b=skFlG4cF5d+RCjw7e971oCimCaxJ64p9NnRXrenqTOCNESGKw3AuX2w4d6+cDGGR

axvXGgYZ7pgs2uf4SaUgTlr+584HyQINyE8sZJbSadz6a350uHmnQTDGDAJogeY2h+e

W5I4HvC922xlMvmIZfjQE0lMc2raEcmeRbBwuxCk=

DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/simple;

s=224i4yxa5dv7c2xz3womw6peuasteono; d=amazonses.com; t=1782742454;

h=From:To:Subject:Message-ID:Date:MIME-Version:Content-Type:Feedback-ID;

bh=bO7dDMwC/pgI3dSoNTvg569ieB75Kx4nOkXhCK/VIag=;

b=Zo57p+F7CplcWTRlcTHmoKT2RsusuN24RAv/bHBqEOdxWRDorkttNu84mhABqr7W

9z/hxkBvGpIpf0yZAqLRxMGnwq48UCkTr/GcPf8tF/W+YvWBbvit0ZLFaTceRA1Nxpf

NpxUQUJgEC+/BiCOiACBgtwaILIZLkWp7mHfLQXQ=

From: DocuSign

To: sales@nk.ca

Subject: Review Document: EFT Payment Authorization Notice

Message-ID: <0100019f13bb0fdc-cdb49eb2-bce9-42cf-8ef1-868caf3baf54-000000@email.amazonses.com>

Date: Mon, 29 Jun 2026 14:14:14 +0000

MIME-Version: 1.0

Content-Type: multipart/alternative;

boundary="--_NmP-5d57c1e10feb6c21-Part_1"

Feedback-ID: :1.us-east-1.Qbuke0KWFseNm4ZY5BZZcA857c7btUUKWdYGLfiVNfnNo1sjs/fTPiEEYfIL81lYM6M2fq+7rUQynMmcjRJhO6NTEDm15yorO7g/kF0uLWLFC4SvlmBpV70qbwlaFJeXLBwlAXNuUqELHhJxhzT5qSbM+zv1Trp3TaezYEQqdGA=:1.us-east-1.QSNtDRXSTq9sAuvRl56h5mypgasnQ5yDLNpVzTnziu0=:AmazonSES

X-SES-Outgoing: 2026.06.29-54.240.9.156

X-Spam_score: 6.9

X-Spam_score_int: 69

X-Spam_bar: ++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: EFT Payment Authorization Required. Review Documents https://shared.ospreycharterfishing.ca/?t=c2FsZXNAbmsuY2E

Do Not Share This Email



Content analysis details: (6.9 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[54.240.9.156 listed in will-spam-for-food.eu.org]

[54.240.9.156 listed in will-spam-for-food.eu.org]

[54.240.9.156 listed in will-spam-for-food.eu.org]

[54.240.9.156 listed in will-spam-for-food.eu.org]

[54.240.9.156 listed in will-spam-for-food.eu.org]

[54.240.9.156 listed in will-spam-for-food.eu.org]

[54.240.9.156 listed in will-spam-for-food.eu.org]

[54.240.9.156 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[54.240.9.156 listed in dnsbl.ahbl.org]

[54.240.9.156 listed in dnsbl.ahbl.org]

[54.240.9.156 listed in dnsbl.ahbl.org]

[54.240.9.156 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[54.240.9.156 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[54.240.9.156 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[54.240.9.156 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[54.240.9.156 listed in dnsbl.ahbl.org]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-0.0 SPF_PASS SPF: sender matches SPF record

2.0 GR_DOMAIN_AMAZON1 Received contains spam friendly host (amazon)

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[54.240.9.156 listed in list.dnswl.org]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[54.240.9.156 listed in bl.score.senderscore.com]

-0.0 RCVD_IN_MSPIKE_H3 RBL: Good reputation (+3)

[54.240.9.156 listed in wl.mailspike.net]

1.5 MR_STRANGE_QUESTION URI: No description available.

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_IMAGE_ONLY_32 BODY: HTML: images with 2800-3200 bytes of words

2.0 RATWR8_MESSID Message-ID with excessive dashes and dollars

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

0.1 MXG_SPOOFED_DOCUSIGN Docusign spoofing

-0.0 RCVD_IN_MSPIKE_WL Mailspike good senders

Subject: {SPAM?} Review Document: EFT Payment Authorization Notice