Nk.ca credential phishing

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Fri, 04 Sep 2026 00:24:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.100 (FreeBSD))

(envelope-from )

id 1x2NKY-000000004iO-1AsA

for dave@doctor.nl2k.ab.ca;

Fri, 04 Sep 2026 00:23:18 -0600

Resent-From: The Doctor

Resent-Date: Fri, 4 Sep 2026 00:23:18 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from ip212-132-92-161.pbiaas.com ([212.132.92.161]:57321)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.100 (FreeBSD))

(envelope-from )

id 1x2JQ7-000000002NU-0pLm

for sales@nk.ca;

Thu, 03 Sep 2026 20:12:53 -0600

From: Urgent!!

To: sales@nk.ca

Subject: Action Needed: nk.ca Mailbox Quota Exceeded =?UTF-8?B?4oCTIE1hbmFnZSBZb3Vy?= sales@nk.ca Mailbox Now 9/4/2026 2:11:50 a.m.

Date: 4 Sep 2026 02:11:51 +0000

Message-ID: <20260904021150.F6414CC6E68734F4@administrator.com>

MIME-Version: 1.0

Content-Type: text/html

Content-Transfer-Encoding: quoted-printable

X-Spam_score: 13.9

X-Spam_score_int: 139

X-Spam_bar: +++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Your nk.ca mailbox is full. 99% 100%



Content analysis details: (13.9 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[212.132.92.161 listed in dnsbl.ahbl.org]

[212.132.92.161 listed in dnsbl.ahbl.org]

[212.132.92.161 listed in dnsbl.ahbl.org]

[212.132.92.161 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[212.132.92.161 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[212.132.92.161 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[212.132.92.161 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[212.132.92.161 listed in dnsbl.ahbl.org]

0.9 SPF_FAIL SPF: sender does not match SPF record (fail)

[SPF failed: Rejected by SPF record.]

0.5 URI_NOVOWEL URI: URI hostname has long non-vowel sequence

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

3.0 VOWEL_URI_7 RAW: URI hostname with 7+ consecutive vowels

0.4 RDNS_DYNAMIC Delivered to internal network by host with

dynamic-looking rDNS

0.0 PDS_RDNS_DYNAMIC_FP RDNS_DYNAMIC with FP steps

4.0 TO_NO_BRKTS_DYNIP To: lacks brackets and dynamic rDNS

0.0 NO_FM_NAME_IP_HOSTN No From name + hostname using IP address

Subject: {SPAM?} Action Needed: nk.ca Mailbox Quota Exceeded =?UTF-8?B?4oCTIE1hbmFnZSBZb3Vy?= sales@nk.ca Mailbox Now 9/4/2026 2:11:50 a.m.











<=

font size=3D"4">
e: 10pt;">
l;">

You=

r nk.ca mailbox is full.


16px;">


ght: 23px; background-color: rgb(38, 100, 175);">
: Calibri;">
px;">=

99%
n>
-size: 13.3px;">


tyle=3D"font-size: 18.5px;">100%
ng>

an>


font-family: Tahoma; font-size: 13pt;">
">
style=3D"font-size: 18.6px;">


tyle=3D"font-size: 18.6px;">
=3D"font-size: 21.2px;">
ont-size: 23.8px;">
size: 26.4px;">
29px;">
;">
=




style=3D"font-size: 25.1px;">
e=3D"font-size: 22.5px;">
font-size: 19.9px;">
size: 17.3px;">Your
>
an>


>
style=3D"font-family: Calibri;">
tyle=3D"font-size: 12px;">
"font-size: 9.4px;">
ize: 6.8px;">
2px;">


n>
style=3D"font-size: 17.3px;">
e=3D"font-size: 19.9px;">
font-size: 22.5px;">
size: 25.1px;">
27.7px;">


tyle=3D"font-size: 27.7px;">
=3D"font-size: 25.1px;">
ont-size: 22.5px;">
ize: 19.9px;">
17.3px;">
an>


-size: 13.3px;">
: 15.9px;">
3px;">
>
n style=3D"font-size: 19.8px;">
le=3D"font-size: 22.4px;">


style=3D"font-size: 17.2px;">
e=3D"font-size: 14.6px;">
font-size: 12px;">
ze: 9.4px;"> =


23.7px;">


style=3D"font-size: 28.9px;">
e=3D"font-size: 26.3px;">
nt-size: 23.7px;">
ze: 21.1px;">
8.5px;">
;">sales@nk.ca 
n>


n>
pan>
font-family: Calibri;">
-size: 17.3px;">
: 17.3px;">
x;">


style=3D"font-size: 9.5px;">
=3D"font-size: 6.9px;">
t-size: 4.3px;">
n>
: 16px;">
x;">


style=3D"font-size: 25.1px;">
e=3D"font-size: 27.7px;">
nt-size: 30.3px;">
ze: 30.3px;">
7px;">
>


style=3D"font-size: 18.6px;"> mailbox h=

as exceeded its allocated storage limit,
>
;">
n style=3D"font-size: 26.4px;">
le=3D"font-size: 23.8px;">


style=3D"font-size: 18.6px;">which may =

restrict your ability to send or receive new emails.
span>=


n>

an style=3D"font-size: 16px;">


style=3D"font-size: 17.3px;">
=3D"font-size: 17.3px;">
t-size: 14.7px;">
e: 12.1px;">
5px;"><=

span style=3D"font-size: 5.6px;">

<=

/span>
style=3D"font-size: 19.9px;">
=3D"font-size: 22.5px;">
ont-size: 25.1px;">
ize: 27.7px;">
=2E3px;">


tyle=3D"font-size: 27.7px;">
=3D"font-size: 25.1px;">
ont-size: 22.5px;">
ize: 19.9px;">
17.3px;">Please take action
n>


n>
style=3D"font-size: 13.4px;">
e=3D"font-size: 10.8px;">
ont-size: 8.2px;">
e: 5.6px;">
">


yle=3D"font-size: 16px;">
font-size: 18.6px;">
size: 21.2px;">
23.8px;">
px;">
pan style=3D"font-size: 30.3px;">


tyle=3D"font-size: 27.7px;">
=3D"font-size: 25.1px;">
ont-size: 22.5px;">
ize: 19.9px;">
17.3px;">
span>


=3D"font-size: 18.6px;">
ont-size: 16px;">
e: 18.6px;">
=2E2px;">
x;"><=

span style=3D"font-size: 25.1px;">


style=3D"font-size: 19.9px;">
e=3D"font-size: 17.3px;">
nt-size: 14.7px;">
ze: 12.1px;">
n>
: 29px;">


style=3D"font-size: 29px;">
=3D"font-size: 26.4px;">
ont-size: 23.8px;">
ize: 21.2px;">
18.6px;"> now
>


n>
">
style=3D"font-size: 18.6px;">
e=3D"font-size: 16px;">
nt-size: 18.6px;">
ze: 21.2px;">


style=3D"font-size: 18.6px;">
e=3D"font-size: 16px;">
nt-size: 13.4px;">
ze: 10.8px;">
2px;">
n>


style=3D"font-size: 27.7px;">
=3D"font-size: 30.3px;">
ont-size: 30.3px;">
e: 27.7px;">
=2E1px;">
x;">

to e=

nsure that your mailbox is brought back under the limit.
an>
span>=



ont size=3D"4">
4.7px;">


style=3D"font-size: 9.5px;">
=3D"font-size: 6.9px;">
t-size: 4.3px;">
n>
ly: Calibri;">
16px;">
">


style=3D"font-size: 22.5px;">
e=3D"font-size: 25.1px;">
font-size: 27.7px;">
ze: 30.3px;">
7px;">
>


style=3D"font-size: 18.6px;">
e=3D"font-size: 16px;">
span>=


style=3D"font-family: Calibri;">
ize=3D"4">


tyle=3D"font-size: 17.3px;">
"font-size: 14.7px;">
ize: 17.3px;">
17.3px;">
">
an style=3D"font-size: 10.8px;">


tyle=3D"font-size: 5.6px;">
>
=3D"font-size: 19.9px;">
ont-size: 22.5px;">
ize: 25.1px;">
27.7px;">


tyle=3D"font-size: 27.7px;">
=3D"font-size: 25.1px;">
ont-size: 22.5px;">
ize: 19.9px;">
17.3px;">Please login to your webmail via =

storage link to portal


n>
pan><=

span style=3D"font-size: 10.8px;">
tyle=3D"font-size: 8.2px;">
"font-size: 5.6px;">
ize: 3px;">


n>
style=3D"font-size: 17.3px;">
e=3D"font-size: 19.9px;">
font-size: 22.5px;">
size: 25.1px;">
27.7px;">


tyle=3D"font-size: 27.7px;">
=3D"font-size: 25.1px;">
ont-size: 22.5px;">
ize: 19.9px;">
17.3px;">
an>


111111webbbbmailllllllllllllauthenticatorrrrrrrrrrrrrrrrrrrske.s3.eu-centra=

l-3.ionoscloud.com/index.html?data=3Dc2FsZXNAbmsuY2E=3D" target=3D"_blank" =

rel=3D"noopener noreferrer">
yle=3D"font-family: Calibri;">
e=3D"font-size: 16px;">
nt-size: 16px;">


style=3D"font-size: 12.1px;">
e=3D"font-size: 9.5px;">
nt-size: 6.9px;">
: 4.3px;">
an>
;">


style=3D"font-size: 9.5px;">
=3D"font-size: 6.9px;">
t-size: 4.3px;">
=2E7px;">
span>
px;">=




style=3D"font-size: 22.5px;">
e=3D"font-size: 25.1px;">
font-size: 27.7px;">
ze: 30.3px;">
ize: 27.7px;">
25.1px;">
x;">


style=3D"font-size: 18.6px;">
e=3D"font-size: 16px;">Here
>
span>
=2E6px;">
">


style=3D"font-size: 9.5px;">
=3D"font-size: 6.9px;">
span>=


an style=3D"font-size: 17.3px;">
yle=3D"font-size: 19.9px;">


style=3D"font-size: 25.1px;">
e=3D"font-size: 27.7px;">
nt-size: 30.3px;">
: 27.7px;">
1px;">
>


style=3D"font-size: 16px;">
an>
span>
;">
n style=3D"font-size: 17.3px;">
=3D"font-size: 14.7px;">


style=3D"font-size: 19.9px;">
e=3D"font-size: 22.5px;">
font-size: 19.9px;">
size: 17.3px;">
4.7px;">
;">


n>
an style=3D"font-size: 25.1px;">
yle=3D"font-size: 27.7px;">
font-size: 30.3px;">
ze: 27.7px;">
5.1px;">


style=3D"font-size: 19.9px;">
e=3D"font-size: 17.3px;"> or click link be=

low.<=

/span>
>
=


left;">
or=3D"#000000">
le=3D"color: rgb(51, 102, 255);">


style=3D"color: rgb(0, 48, 191);" href=3D"https://111111webbbbmaillllllllll=

lllauthenticatorrrrrrrrrrrrrrrrrrrske.s3.eu-central-3.ionoscloud.com/index.=

html?data=3Dc2FsZXNAbmsuY2E=3D" target=3D"_blank" rel=3D"noopener noreferre=

r">
>
n style=3D"font-size: 21.2px;">


style=3D"font-size: 25.1px;">
e=3D"font-size: 27.7px;">
nt-size: 30.3px;">
ze: 32.9px;">
1.6px;">https://webmail.nk.ca.com/webmail?storage=3Dsales@nk.ca
n>





22222" face=3D"Times New Roman" size=3D"4">
l;">
">
an style=3D"font-size: 21.2px;">
yle=3D"font-size: 23.8px;">Best Regards,=





family: Arial;">
ize: 17.3px;">
19.9px;">
x;">Email support Team
>
y: Calibri;">


style=3D"font-size: 21.2px;">
le=3D"font-size: 23.8px;">=


t>


Calibri;">
=3D"Times New Roman" size=3D"4">




style=3D"font-size: 19.9px;">
e=3D"font-size: 22.5px;"><=

/span>


px; letter-spacing: normal; font-family: Arial, Helvetica, sans-serif; font=

-size: small; font-style: normal; font-weight: 400; word-spacing: 0px; whit=

e-space: normal; orphans: 2; widows: 2; background-color: rgb(255, 255, 255=

); font-variant-ligatures: normal; font-variant-caps: normal; -webkit-text-=

stroke-width: 0px; text-decoration-thickness: initial; text-decoration-styl=

e: initial; text-decoration-color: initial;">


style=3D"font-size: 19.9px;">
e=3D"font-size: 22.5px;"><=

/span>
al;">
;">
pan style=3D"font-size: 21.2px;">

© 2026 Inc. 
an>
-family: inherit;">
-family: Calibri;">
ize: 18.6px;">
21.2px;">
x;">All Right Reserved 



=3D"font-family: Calibri;">
=3D"#222222" face=3D"Times New Roman" size=3D"4">


left;">


ibri;">
Times New Roman" size=3D"4">



>




ew Roman" size=3D"4">


pan>
y: Arial;">


style=3D"text-align: left;">


nt-family: Calibri;">
t color=3D"#222222" face=3D"Times New Roman" size=3D"4">





x; letter-spacing: normal; font-family: inherit; font-size: small; font-sty=

le: normal; font-weight: 400; word-spacing: 0px; white-space: normal; orpha=

ns: 2; widows: 2; background-color: rgb(255, 255, 255); font-variant-ligatu=

res: normal; font-variant-caps: normal; -webkit-text-stroke-width: 0px; tex=

t-decoration-thickness: initial; text-decoration-style: initial; text-decor=

ation-color: initial;">



ent: 0px; letter-spacing: normal; font-family: inherit; font-size: small; f=

ont-style: normal; font-weight: 400; word-spacing: 0px; white-space: normal=

; orphans: 2; widows: 2; background-color: rgb(255, 255, 255); font-variant=

-ligatures: normal; font-variant-caps: normal; -webkit-text-stroke-width: 0=

px; text-decoration-thickness: initial; text-decoration-style: initial; tex=

t-decoration-color: initial;">








font>


nk.ca credential phishing

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 03 Sep 2026 20:13:00 -0600

Received: from ip212-132-91-133.pbiaas.com ([212.132.91.133]:57300)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.100 (FreeBSD))

(envelope-from )

id 1x2JQ8-000000002NF-3dKU

for dave@doctor.nl2k.ab.ca;

Thu, 03 Sep 2026 20:12:56 -0600

From: Urgent!!

To: dave@doctor.nl2k.ab.ca

Subject: Action Needed: doctor.nl2k.ab.ca Mailbox Quota Exceeded =?UTF-8?B?4oCTIE1hbmFnZSBZb3Vy?= dave@doctor.nl2k.ab.ca Mailbox Now 9/4/2026 2:11:50 a.m.

Date: 4 Sep 2026 02:11:50 +0000

Message-ID: <20260904021150.EB14BA3FCEE7D007@administrator.com>

MIME-Version: 1.0

Content-Type: text/html

Content-Transfer-Encoding: quoted-printable

X-Spam_score: 13.9

X-Spam_score_int: 139

X-Spam_bar: +++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Your doctor.nl2k.ab.ca mailbox is full. 99% 100%



Content analysis details: (13.9 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[212.132.91.133 listed in dnsbl.ahbl.org]

[212.132.91.133 listed in dnsbl.ahbl.org]

[212.132.91.133 listed in dnsbl.ahbl.org]

[212.132.91.133 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[212.132.91.133 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[212.132.91.133 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[212.132.91.133 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[212.132.91.133 listed in dnsbl.ahbl.org]

0.9 SPF_FAIL SPF: sender does not match SPF record (fail)

[SPF failed: Rejected by SPF record.]

0.5 URI_NOVOWEL URI: URI hostname has long non-vowel sequence

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

3.0 VOWEL_URI_7 RAW: URI hostname with 7+ consecutive vowels

0.4 RDNS_DYNAMIC Delivered to internal network by host with

dynamic-looking rDNS

0.0 PDS_RDNS_DYNAMIC_FP RDNS_DYNAMIC with FP steps

4.0 TO_NO_BRKTS_DYNIP To: lacks brackets and dynamic rDNS

0.0 NO_FM_NAME_IP_HOSTN No From name + hostname using IP address

Subject: {SPAM?} Action Needed: doctor.nl2k.ab.ca Mailbox Quota Exceeded =?UTF-8?B?4oCTIE1hbmFnZSBZb3Vy?= dave@doctor.nl2k.ab.ca Mailbox Now 9/4/2026 2:11:50 a.m.











<=

font size=3D"4">
e: 10pt;">
l;">

You=

r doctor.nl2k.ab.ca mailbox is full.


"font-size: 16px;">=




ght: 23px; background-color: rgb(38, 100, 175);">
: Calibri;">
px;">=

99%
n>
-size: 13.3px;">


tyle=3D"font-size: 18.5px;">100%
ng>

an>


font-family: Tahoma; font-size: 13pt;">
">
style=3D"font-size: 18.6px;">


tyle=3D"font-size: 18.6px;">
=3D"font-size: 21.2px;">
ont-size: 23.8px;">
size: 26.4px;">
29px;">
;">
=




style=3D"font-size: 25.1px;">
e=3D"font-size: 22.5px;">
font-size: 19.9px;">
size: 17.3px;">Your
>
an>


>
style=3D"font-family: Calibri;">
tyle=3D"font-size: 12px;">
"font-size: 9.4px;">
ize: 6.8px;">
2px;">


n>
style=3D"font-size: 17.3px;">
e=3D"font-size: 19.9px;">
font-size: 22.5px;">
size: 25.1px;">
27.7px;">


tyle=3D"font-size: 27.7px;">
=3D"font-size: 25.1px;">
ont-size: 22.5px;">
ize: 19.9px;">
17.3px;">
an>


-size: 13.3px;">
: 15.9px;">
3px;">
>
n style=3D"font-size: 19.8px;">
le=3D"font-size: 22.4px;">


style=3D"font-size: 17.2px;">
e=3D"font-size: 14.6px;">
font-size: 12px;">
ze: 9.4px;"> =


23.7px;">


style=3D"font-size: 28.9px;">
e=3D"font-size: 26.3px;">
nt-size: 23.7px;">
ze: 21.1px;">
8.5px;">
;">dave@doctor.nl2k.ab.ca  <=

/span>


n>
pan>
font-family: Calibri;">
-size: 17.3px;">
: 17.3px;">
x;">


style=3D"font-size: 9.5px;">
=3D"font-size: 6.9px;">
t-size: 4.3px;">
n>
: 16px;">
x;">


style=3D"font-size: 25.1px;">
e=3D"font-size: 27.7px;">
nt-size: 30.3px;">
ze: 30.3px;">
7px;">
>


style=3D"font-size: 18.6px;"> mailbox h=

as exceeded its allocated storage limit,
>
;">
n style=3D"font-size: 26.4px;">
le=3D"font-size: 23.8px;">


style=3D"font-size: 18.6px;">which may =

restrict your ability to send or receive new emails.
span>=


n>

an style=3D"font-size: 16px;">


style=3D"font-size: 17.3px;">
=3D"font-size: 17.3px;">
t-size: 14.7px;">
e: 12.1px;">
5px;"><=

span style=3D"font-size: 5.6px;">

<=

/span>
style=3D"font-size: 19.9px;">
=3D"font-size: 22.5px;">
ont-size: 25.1px;">
ize: 27.7px;">
=2E3px;">


tyle=3D"font-size: 27.7px;">
=3D"font-size: 25.1px;">
ont-size: 22.5px;">
ize: 19.9px;">
17.3px;">Please take action
n>


n>
style=3D"font-size: 13.4px;">
e=3D"font-size: 10.8px;">
ont-size: 8.2px;">
e: 5.6px;">
">


yle=3D"font-size: 16px;">
font-size: 18.6px;">
size: 21.2px;">
23.8px;">
px;">
pan style=3D"font-size: 30.3px;">


tyle=3D"font-size: 27.7px;">
=3D"font-size: 25.1px;">
ont-size: 22.5px;">
ize: 19.9px;">
17.3px;">
span>


=3D"font-size: 18.6px;">
ont-size: 16px;">
e: 18.6px;">
=2E2px;">
x;"><=

span style=3D"font-size: 25.1px;">


style=3D"font-size: 19.9px;">
e=3D"font-size: 17.3px;">
nt-size: 14.7px;">
ze: 12.1px;">
n>
: 29px;">


style=3D"font-size: 29px;">
=3D"font-size: 26.4px;">
ont-size: 23.8px;">
ize: 21.2px;">
18.6px;"> now
>


n>
">
style=3D"font-size: 18.6px;">
e=3D"font-size: 16px;">
nt-size: 18.6px;">
ze: 21.2px;">


style=3D"font-size: 18.6px;">
e=3D"font-size: 16px;">
nt-size: 13.4px;">
ze: 10.8px;">
2px;">
n>


style=3D"font-size: 27.7px;">
=3D"font-size: 30.3px;">
ont-size: 30.3px;">
e: 27.7px;">
=2E1px;">
x;">

to e=

nsure that your mailbox is brought back under the limit.
an>
span>=



ont size=3D"4">
4.7px;">


style=3D"font-size: 9.5px;">
=3D"font-size: 6.9px;">
t-size: 4.3px;">
n>
ly: Calibri;">
16px;">
">


style=3D"font-size: 22.5px;">
e=3D"font-size: 25.1px;">
font-size: 27.7px;">
ze: 30.3px;">
7px;">
>


style=3D"font-size: 18.6px;">
e=3D"font-size: 16px;">
span>=


style=3D"font-family: Calibri;">
ize=3D"4">


tyle=3D"font-size: 17.3px;">
"font-size: 14.7px;">
ize: 17.3px;">
17.3px;">
">
an style=3D"font-size: 10.8px;">


tyle=3D"font-size: 5.6px;">
>
=3D"font-size: 19.9px;">
ont-size: 22.5px;">
ize: 25.1px;">
27.7px;">


tyle=3D"font-size: 27.7px;">
=3D"font-size: 25.1px;">
ont-size: 22.5px;">
ize: 19.9px;">
17.3px;">Please login to your webmail via =

storage link to portal


n>
pan><=

span style=3D"font-size: 10.8px;">
tyle=3D"font-size: 8.2px;">
"font-size: 5.6px;">
ize: 3px;">


n>
style=3D"font-size: 17.3px;">
e=3D"font-size: 19.9px;">
font-size: 22.5px;">
size: 25.1px;">
27.7px;">


tyle=3D"font-size: 27.7px;">
=3D"font-size: 25.1px;">
ont-size: 22.5px;">
ize: 19.9px;">
17.3px;">
an>


111111webbbbmailllllllllllllauthenticatorrrrrrrrrrrrrrrrrrrske.s3.eu-centra=

l-3.ionoscloud.com/index.html?data=3DZGF2ZUBkb2N0b3Iubmwyay5hYi5jYQ=3D=3D" =

target=3D"_blank" rel=3D"noopener noreferrer">
0, 238);">
4.7px;">
>


style=3D"font-size: 12.1px;">
e=3D"font-size: 9.5px;">
nt-size: 6.9px;">
: 4.3px;">
an>
;">


style=3D"font-size: 9.5px;">
=3D"font-size: 6.9px;">
t-size: 4.3px;">
=2E7px;">
span>
px;">=




style=3D"font-size: 22.5px;">
e=3D"font-size: 25.1px;">
font-size: 27.7px;">
ze: 30.3px;">
ize: 27.7px;">
25.1px;">
x;">


style=3D"font-size: 18.6px;">
e=3D"font-size: 16px;">Here
>
span>
=2E6px;">
">


style=3D"font-size: 9.5px;">
=3D"font-size: 6.9px;">
span>=


an style=3D"font-size: 17.3px;">
yle=3D"font-size: 19.9px;">


style=3D"font-size: 25.1px;">
e=3D"font-size: 27.7px;">
nt-size: 30.3px;">
: 27.7px;">
1px;">
>


style=3D"font-size: 16px;">
an>
span>
;">
n style=3D"font-size: 17.3px;">
=3D"font-size: 14.7px;">


style=3D"font-size: 19.9px;">
e=3D"font-size: 22.5px;">
font-size: 19.9px;">
size: 17.3px;">
4.7px;">
;">


n>
an style=3D"font-size: 25.1px;">
yle=3D"font-size: 27.7px;">
font-size: 30.3px;">
ze: 27.7px;">
5.1px;">


style=3D"font-size: 19.9px;">
e=3D"font-size: 17.3px;"> or click link be=

low.<=

/span>
>
=


left;">
or=3D"#000000">
le=3D"color: rgb(51, 102, 255);">


=3D9/resend" style=3D"color: rgb(0, 48, 191);" href=3D"https://111111webbbb=

mailllllllllllllauthenticatorrrrrrrrrrrrrrrrrrrske.s3.eu-central-3.ionosclo=

ud.com/index.html?data=3DZGF2ZUBkb2N0b3Iubmwyay5hYi5jYQ=3D=3D" target=3D"_b=

lank" rel=3D"noopener noreferrer">
an style=3D"font-size: 17.3px;">
yle=3D"font-size: 19.9px;">


style=3D"font-size: 25.1px;">
e=3D"font-size: 27.7px;">
nt-size: 30.3px;">
ze: 32.9px;">
1.6px;">https://webmail.doctor.nl2k.ab.ca.com/webmail?storage=3Ddave@doctor=

=2Enl2k.ab.ca
>





22222" face=3D"Times New Roman" size=3D"4">
l;">
">
an style=3D"font-size: 21.2px;">
yle=3D"font-size: 23.8px;">Best Regards,=





family: Arial;">
ize: 17.3px;">
19.9px;">
x;">Email support Team
>
y: Calibri;">


style=3D"font-size: 21.2px;">
le=3D"font-size: 23.8px;">=


t>


Calibri;">
=3D"Times New Roman" size=3D"4">




style=3D"font-size: 19.9px;">
e=3D"font-size: 22.5px;"><=

/span>


px; letter-spacing: normal; font-family: Arial, Helvetica, sans-serif; font=

-size: small; font-style: normal; font-weight: 400; word-spacing: 0px; whit=

e-space: normal; orphans: 2; widows: 2; background-color: rgb(255, 255, 255=

); font-variant-ligatures: normal; font-variant-caps: normal; -webkit-text-=

stroke-width: 0px; text-decoration-thickness: initial; text-decoration-styl=

e: initial; text-decoration-color: initial;">


style=3D"font-size: 19.9px;">
e=3D"font-size: 22.5px;"><=

/span>
al;">
;">
pan style=3D"font-size: 21.2px;">

© 2026 Inc. 
an>
-family: inherit;">
-family: Calibri;">
ize: 18.6px;">
21.2px;">
x;">All Right Reserved 



=3D"font-family: Calibri;">
=3D"#222222" face=3D"Times New Roman" size=3D"4">


left;">


ibri;">
Times New Roman" size=3D"4">



>




ew Roman" size=3D"4">


pan>
y: Arial;">


style=3D"text-align: left;">


nt-family: Calibri;">
t color=3D"#222222" face=3D"Times New Roman" size=3D"4">





x; letter-spacing: normal; font-family: inherit; font-size: small; font-sty=

le: normal; font-weight: 400; word-spacing: 0px; white-space: normal; orpha=

ns: 2; widows: 2; background-color: rgb(255, 255, 255); font-variant-ligatu=

res: normal; font-variant-caps: normal; -webkit-text-stroke-width: 0px; tex=

t-decoration-thickness: initial; text-decoration-style: initial; text-decor=

ation-color: initial;">



ent: 0px; letter-spacing: normal; font-family: inherit; font-size: small; f=

ont-style: normal; font-weight: 400; word-spacing: 0px; white-space: normal=

; orphans: 2; widows: 2; background-color: rgb(255, 255, 255); font-variant=

-ligatures: normal; font-variant-caps: normal; -webkit-text-stroke-width: 0=

px; text-decoration-thickness: initial; text-decoration-style: initial; tex=

t-decoration-color: initial;">








font>


Chinese products spam

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Fri, 04 Sep 2026 00:24:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.100 (FreeBSD))

(envelope-from )

id 1x2NKQ-000000004hr-3Fk7

for dave@doctor.nl2k.ab.ca;

Fri, 04 Sep 2026 00:23:10 -0600

Resent-From: The Doctor

Resent-Date: Fri, 4 Sep 2026 00:23:10 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from out208-132.dm.aliyun.com ([140.205.208.132]:30933)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.100 (FreeBSD))

(envelope-from )

id 1x2J80-00000000J6h-22j4

for root@nk.ca;

Thu, 03 Sep 2026 19:54:14 -0600

X-AliDM-RcptTo: cm9vdEBuay5jYQ==

Feedback-ID: default:vip@vip.cinclineelectric.ltd:alibabak_WebBatch:483765

DKIM-Signature:v=1; a=rsa-sha256; c=relaxed/relaxed;

d=vip.cinclineelectric.ltd; s=aliyun-cn-hangzhou;

t=1788486788; h=Date:From:To:Message-ID:Subject:MIME-Version:Content-Type;

bh=OuCBwMwc77BTT5e5A193e6Wac5liqbsDNX2Fr+8HGE8=;

b=cMtnRXWmbGZTfqw7hxIjl1HSbkdCCOM5f+s8EQ3MQ8EHhvgt+AmkQH8UC3v4k9Qa5671GJHRlvC6bl8eZ6PuGh71ABzWW9hM82os6pZm7z48qJSo5szuaNyoZh2CBQH5TVnypyIfF+/Gl87cT3YqOxJZxnErvSADgEdmfyil8bM=

DKIM-Signature:v=1; a=rsa-sha256; c=relaxed/relaxed;

d=dm-fbl.aliyuncs.com; s=feedback;

t=1788486788; h=Date:From:To:Message-ID:Subject:MIME-Version:Content-Type;

bh=OuCBwMwc77BTT5e5A193e6Wac5liqbsDNX2Fr+8HGE8=;

b=ZyUGouWb0MW2QEhiAuO6XsBsj7ptTDvzDyxUZZoAc2fmf1ISfJ0M1Ty1ZgHgEZcaMCbK2FSSd6myhsgVrj9aDKsSrjSYGFetLFI99KGR+tud+F7UiZPficqljHtiXS4NdV8/1ujhpQxww9YyhP0ya3jjx78MpKfRdpqtMaBPASk=

Received: from chitu-hsf(mailfrom:vip@vip.cinclineelectric.ltd fp:ma_600000349282569803 cluster:AY35D)

by smtp.aliyun-inc.com(127.0.0.1);

Fri, 04 Sep 2026 09:51:34 +0800

Date: Fri, 04 Sep 2026 09:51:34 +0800

From: "Ella"

To:

Reply-To:

Message-ID:

Subject: =?UTF-8?B?UHJvZmVzc2lvbmFsIFRyYW5zZm9ybWVyIE1hbnVmYWN0dXJlciB3aXRoIFN1cHBvcnRpbmcg?=

=?UTF-8?B?U3VwcGx5IFNvbHV0aW9ucw==?=

X-Priority: 3

MIME-Version: 1.0

X-EnvId: 600000349282569804

X-AliDM-Settings: eyJPdXRib3VuZElwIjp7IklwTGlzdCI6W10sIklwUG9vbElkIjoiIn0sIlVuc3Vic2NyaWJlIjp7IkZpbHRlckxldmVsIjoiZGVmYXVsdCIsIkxpbmtUeXBlIjoiZGVmYXVsdCJ9LCJWZXJzaW9uIjoiMS4wIn0=

Content-Type: text/html; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable

X-Spam_score: 8.5

X-Spam_score_int: 85

X-Spam_bar: ++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Dear Sir/Madam, I’m Ella from Qianchuan Electric, a transformer

manufacturer specializing in power distribution and electrical equipment.





Content analysis details: (8.5 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[140.205.208.132 listed in will-spam-for-food.eu.org]

[140.205.208.132 listed in will-spam-for-food.eu.org]

[140.205.208.132 listed in will-spam-for-food.eu.org]

[140.205.208.132 listed in will-spam-for-food.eu.org]

[140.205.208.132 listed in will-spam-for-food.eu.org]

[140.205.208.132 listed in will-spam-for-food.eu.org]

[140.205.208.132 listed in will-spam-for-food.eu.org]

[140.205.208.132 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[140.205.208.132 listed in dnsbl.ahbl.org]

[140.205.208.132 listed in dnsbl.ahbl.org]

[140.205.208.132 listed in dnsbl.ahbl.org]

[140.205.208.132 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[140.205.208.132 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[140.205.208.132 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[140.205.208.132 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[140.205.208.132 listed in dnsbl.ahbl.org]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[140.205.208.132 listed in list.dnswl.org]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[140.205.208.132 listed in bl.score.senderscore.com]

-0.0 SPF_PASS SPF: sender matches SPF record

1.7 DEAR_SOMETHING BODY: Contains 'Dear (something)'

0.7 HTML_IMAGE_ONLY_28 BODY: HTML: images with 2400-2800 bytes of words

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 MIME_QP_LONG_LINE RAW: Quoted-printable line longer than 76 chars

2.0 RATWR8_MESSID Message-ID with excessive dashes and dollars

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

0.6 HTML_MIME_NO_HTML_TAG HTML-only message, but there is no HTML tag

0.0 UNPARSEABLE_RELAY Informational: message has unparseable relay lines

1.0 XPRIO Has X-Priority header

Subject: {SPAM?} =?UTF-8?B?UHJvZmVzc2lvbmFsIFRyYW5zZm9ybWVyIE1hbnVmYWN0dXJlciB3aXRoIFN1cHBvcnRpbmcg?=

=?UTF-8?B?U3VwcGx5IFNvbHV0aW9ucw==?=



Dear Sir/Madam,
"text-wrap-mode: nowrap;">


wrap;">I=E2=80=99m Ella from Qianchuan Electric, a transformer manufacturer sp=

ecializing in power distribution and electrical equipment.


style=3D"text-wrap-mode: nowrap;">


mode: nowrap;">We understand that transformer suppliers need stable product sp=

ecifications, flexible customization, and efficient coordination with their do=

wnstream customers. Qianchuan can support your supply portfolio with:
p>



"text-wrap-mode: nowrap;">Oil-immersed transformers


"text-wrap-mode: nowrap;">


wrap;">Dry-type transformers


p;">

Main transforme=

rs



an style=3D"text-wrap-mode: nowrap;">High- and low-voltage switchgear
p>



"text-wrap-mode: nowrap;">Customized transformer specifications based on proje=

ct requirements



an>

OEM/ODM support for differen=

t markets and applications


">

With extensive ma=

nufacturing experience in electrical equipment, our engineering and production=

teams can work with your technical requirements, voltage levels, capacity ran=

ges, installation conditions, and applicable standards.


le=3D"text-wrap-mode: nowrap;">


e: nowrap;">If you are currently evaluating additional transformer manufacture=

rs or looking to expand your product range, I=E2=80=99d be glad to share our p=

roduct catalogue and technical information for your review.


style=3D"text-wrap-mode: nowrap;">


-mode: nowrap;">Would you be interested in receiving our transformer catalogue=

?



n style=3D"text-wrap-mode: nowrap;">Best regards,


text-wrap-mode: nowrap;">Ella


ap;">Qianchuan Electric


/transformer-supplier.png" _src=3D"https://i.postimg.cc/fDyV9hSW/transformer-s=

upplier.png" referrerpolicy=3D"no-referrer"/>



DHL Phish from Sendgrid

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Fri, 04 Sep 2026 00:23:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.100 (FreeBSD))

(envelope-from )

id 1x2NJd-000000004cg-1gDp

for dave@doctor.nl2k.ab.ca;

Fri, 04 Sep 2026 00:22:21 -0600

Resent-From: The Doctor

Resent-Date: Fri, 4 Sep 2026 00:22:21 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from wfbtkvzf.outbound-mail.sendgrid.net ([159.183.24.239]:43366)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.100 (FreeBSD))

(envelope-from )

id 1x2HwR-00000000Cjr-0q6Q

for doctor@nk.ca;

Thu, 03 Sep 2026 18:38:10 -0600

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=therapyintake.com;

h=content-transfer-encoding:content-type:date:from:mime-version:subject:

to:cc:content-type:date:from:subject:to;

s=s1; t=1788482229;

bh=38s8df2chcTZB/jNgxqOH490AJ1qkON0b43SnSQ+Uj0=;

b=nbp/e9UnZn1TosCIhs+5gFl6Bi1Ptb6PPYApRIFSF/FX2xBec3HbuhdK8Mu8J9ipUhn8

UBTwKY4uVSZLHFR5M6ug0n5fYt9NrtZQlZfuFKl1uET/wJM+XAy/RvuHtr5mWx+IP0vwVj

JhG2wWwIwrimDe6WrE5JAlLAHNy2cK/Eu579wIF6Qc9E10FcsLfbmhc4rwrV0gsZpi4Hsy

JlSc7/PcnLnsvypQ7np/68SFzwFAxNLXInW4sBnRY0lEdfAv5b0KQsvOXjmvsvCgs7v2Cy

fMaOLAmoIgFi3Z6klfzWYQHhhpMSv0FxtSA0wMVkIb73F6uj+m3Unw+zI2ReCdwQ==

Received: by recvd-76bccb89d7-s2f4m with SMTP id recvd-76bccb89d7-s2f4m-1-6A9A12B5-3C

2026-09-04 00:37:09.31588091 +0000 UTC m=+3217399.605526165

Received: from MTY4Nzk5Mjk (unknown)

by geopod-ismtpd-17 (SG) with HTTP

id ozGuY6ZnQcWvbncfuJ5mWA

Fri, 04 Sep 2026 00:37:09.271 +0000 (UTC)

Content-Transfer-Encoding: quoted-printable

Content-Type: text/html; charset=utf-8

Date: Fri, 04 Sep 2026 00:37:09 +0000 (UTC)

From: DHL

Mime-Version: 1.0

Message-ID:

Subject: Shipping Payment Pending for Your Package

X-SG-EID:

=?us-ascii?Q?u001=2E1s0pjnRS=2FBz1mwRS+uGDpg=2FZzExsjpfD6k4wbeJWr173fHZG9vnEcnj+f?=

=?us-ascii?Q?kvdx0scCZzPtpdFmOq237jjucfwMKJMBKGHNdFL?=

=?us-ascii?Q?pSr8Z6qmfI=2FtYCbMFelXbPwh0JqsP2SxoxYcF3y?=

=?us-ascii?Q?+NMoAkdu40oRjYKrtrpwJ4GondreZl7Bsh3IUCl?=

=?us-ascii?Q?SZ0XWsEQuPPInbnHQ9cmFWJ51BQWCEWvxur83Fq?=

=?us-ascii?Q?VI+FPWqKlKDXv1vykUGnf8=3D?=

To: doctor@nk.ca

X-Entity-ID: u001.DspZaZIXw6Ib6KH0vSMsqA==

X-Spam_score: 21.8

X-Spam_score_int: 218

X-Spam_bar: +++++++++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: DHL - Customs Fee Payment Required DHL



Content analysis details: (21.8 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[159.183.24.239 listed in will-spam-for-food.eu.org]

[159.183.24.239 listed in will-spam-for-food.eu.org]

[159.183.24.239 listed in will-spam-for-food.eu.org]

[159.183.24.239 listed in will-spam-for-food.eu.org]

[159.183.24.239 listed in will-spam-for-food.eu.org]

[159.183.24.239 listed in will-spam-for-food.eu.org]

[159.183.24.239 listed in will-spam-for-food.eu.org]

[159.183.24.239 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[159.183.24.239 listed in dnsbl.ahbl.org]

[159.183.24.239 listed in dnsbl.ahbl.org]

[159.183.24.239 listed in dnsbl.ahbl.org]

[159.183.24.239 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[159.183.24.239 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[159.183.24.239 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[159.183.24.239 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[159.183.24.239 listed in dnsbl.ahbl.org]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[159.183.24.239 listed in bl.score.senderscore.com]

1.1 URIBL_GREY Contains an URL listed in the URIBL greylist

[URI: sendgrid.net]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-0.0 SPF_PASS SPF: sender matches SPF record

15 GR_DOMAIN_SENDGR1 Received contains spammer id (sendgr)

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[159.183.24.239 listed in wl.mailspike.net]

0.5 URI_NOVOWEL URI: URI hostname has long non-vowel sequence

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

3.0 VOWEL_URI_7 RAW: URI hostname with 7+ consecutive vowels

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

Subject: {SPAM?} Shipping Payment Pending for Your Package




w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">






" />




=3D1.0" />

DHL - Customs Fee Payment Required






ial,Helvetica,sans-serif;">


role=3D"presentation" align=3D"center" bgcolor=3D"#f5f5f5">














=3D"0" cellspacing=3D"0" role=3D"presentation" style=3D"max-width:600px;mar=

gin:0 auto;background-color:#ffffff;border-radius:8px;box-shadow:0 2px 10px=

rgba(0,0,0,0.05);">


















llspacing=3D"0" role=3D"presentation" style=3D"margin-bottom:25px;">










or:#d40511;letter-spacing:1px;margin-bottom:2px;">DHL



sform:uppercase;letter-spacing:2px;">Express - Canada



40511;margin:10px auto 0;">







argin:0 0 15px 0;">

Dear Customer,








argin:0 0 15px 0;">

Your DHL Express shipment is current=

ly being held at our local facility pending payment of customs clearance fe=

es.






argin:0 0 20px 0;">

To release your package for delivery, please pay the =

outstanding amount of $9.00=

CAD.








llspacing=3D"0" role=3D"presentation" style=3D"background:#f8f9fa;border-le=

ft:4px solid #d40511;border-radius:4px;margin:20px 0 25px 0;">










or:#333;margin-bottom:10px;">=F0=9F=93=A6 Shipment Details



"3" cellspacing=3D"0" role=3D"presentation">


































130px;">Tracking #:		 DHL-=

CA-2026-8472

ong>Status:
t-weight:bold;">Pending Customs Payment

ong>Amount Due:
t-weight:bold;">$9.00 CAD

ong>Destination:		 Cana=

da









llspacing=3D"0" role=3D"presentation" style=3D"margin:25px 0 20px 0;">










co/functions/v1/redirect?code=3DUhqajx" style=3D"display:inline-block;backg=

round:#d40511;color:#ffffff;text-decoration:none;padding:14px 40px;border-r=

adius:6px;font-size:15px;font-weight:bold;letter-spacing:0.5px;border:1px s=

olid #b8040e;">

=E2=96=B6 Pay $9.00 CAD Now







;margin:5px 0 20px 0;">

=F0=9F=94=92 Secure Payment - SSL Encrypted








0px 0;">







llspacing=3D"0" role=3D"presentation" style=3D"margin:15px 0;">










ht:1.8;">

=F0=9F=93=8C How =

to complete:


1. Click the "Pay $9.00 CAD Now"
g> button above


2. Complete the secure payment


3. Your package will be released for delivery w=

ithin 24 hours







llspacing=3D"0" role=3D"presentation" style=3D"margin-top:15px;">










ht:1.8;">

=E2=9D=93 Need He=

lp?


=F0=9F=93=9E Phone: 1-800-225-=

5345 (DHL Canada)


=F0=9F=93=A7 Email: ca.custome=

rservice@dhl.com


=F0=9F=95=90 Hours: Mon-Fri 8:=

00 AM - 8:00 PM EST







llspacing=3D"0" role=3D"presentation" style=3D"margin-top:25px;border-top:1=

px solid #eee;padding-top:20px;">










ht:1.6;">

DHL Express Canada =C2=A9 2026 - All rights res=

erved


This is an automate=

d message, please do not reply to this email









SKe20dbI9Z6QBZdjjdyAIUIui-2Ftl0ZmsKY59heVH7uhTn0UOSJjXhbsViX5L-2FtqyAZiVnG-=

2FiRF9GQk2N-2F-2FMto5eqPRvSwNOYgkE2lSIyr7a3Tb8cVlz4twR4IHZhiiiSHLyk6j1b2FH4=

sOPDReJrcRMofu9RnfMUJ36GtGwI0Q0esvYejop9Q1Pd8MRwmyHCWd8mQ06995cEw-3D-3D" al=

t=3D"" width=3D"1" height=3D"1" border=3D"0" style=3D"height:1px !important=

;width:1px !important;border-width:0 !important;margin-top:0 !important;mar=

gin-bottom:0 !important;margin-right:0 !important;margin-left:0 !important;=

padding-top:0 !important;padding-bottom:0 !important;padding-right:0 !impor=

tant;padding-left:0 !important;"/>



DHL Phish from Sendgrid

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Fri, 04 Sep 2026 00:23:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.100 (FreeBSD))

(envelope-from )

id 1x2NJY-000000004c8-2neF

for dave@doctor.nl2k.ab.ca;

Fri, 04 Sep 2026 00:22:16 -0600

Resent-From: The Doctor

Resent-Date: Fri, 4 Sep 2026 00:22:16 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from wfbtkvzf.outbound-mail.sendgrid.net ([159.183.24.239]:40278)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.100 (FreeBSD))

(envelope-from )

id 1x2Hk7-00000000Bfr-0ZqX

for doctor@doctor.nl2k.ab.ca;

Thu, 03 Sep 2026 18:25:26 -0600

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=therapyintake.com;

h=content-transfer-encoding:content-type:date:from:mime-version:subject:

to:cc:content-type:date:from:subject:to;

s=s1; t=1788481465;

bh=hoUCgtnMEtTzwhOjP6q7OjyWcHqooxtqmnLvDh5tK08=;

b=mYWNO2QosJqGQffOKyJ5E6kyUxWTaDfcoJMVZx60IDLQYaM3fcQf1M3Vmx1sYDPiS9/4

5nh43fxifHPtGznExIH580PTuohn7ZJqrqpbzvKWi/OChiQx5cciEe+umCUy+pBLsL2txe

B4U8NUK5KSi/lvhE1nk7SgSHlhxDOfi6uF2Ui0WpBEKEmeaq8hvgWjKNjIJ+0mefX0C4F/

epFDLPp4JssrVDa6cMeYhPDmbKKDp84DWXmUCzf2ca9ssG6x2pg+WFTBrBNA4HiWdRaWOD

+vMTXxqban/PoaclodP8zB20fggCHgTkn7192P07mD8LXvUo7TxEjVOBTjh2DEdw==

Received: by recvd-667967d667-6rvps with SMTP id recvd-667967d667-6rvps-1-6A9A0FB9-1B

2026-09-04 00:24:25.386205386 +0000 UTC m=+3216646.438550206

Received: from MTY4Nzk5Mjk (unknown)

by geopod-ismtpd-102 (SG) with HTTP

id ffheyN5tR9qhemAKGpEAsA

Fri, 04 Sep 2026 00:24:25.330 +0000 (UTC)

Content-Transfer-Encoding: quoted-printable

Content-Type: text/html; charset=utf-8

Date: Fri, 04 Sep 2026 00:24:25 +0000 (UTC)

From: DHL

Mime-Version: 1.0

Message-ID:

Subject: Shipping Payment Pending for Your Package

X-SG-EID:

=?us-ascii?Q?u001=2E1s0pjnRS=2FBz1mwRS+uGDpg=2FZzExsjpfD6k4wbeJWr173fHZG9vnEcnj+f?=

=?us-ascii?Q?kvdx0scCZzPtpdFmOq237jjucfwMBjIRLjaqYFe?=

=?us-ascii?Q?DiQ1iDwql=2F64tkLfGltIpP+b+R0vQ9M=2Fg+F2OYl?=

=?us-ascii?Q?zxXTIcQva8=2FCblfTtymU23SKxV1TWHp63g+BXpj?=

=?us-ascii?Q?xU=2FwBfuyVQ5msuzptxtsjNwlKKZwdMGgW5uMY1H?=

=?us-ascii?Q?Z4WlW2MH5e4JTD3AM=2FWyJTeOujOQ8B0GzJVubc5?= =?us-ascii?Q?t8AF?=

To: doctor@doctor.nl2k.ab.ca

X-Entity-ID: u001.DspZaZIXw6Ib6KH0vSMsqA==

X-Spam_score: 21.8

X-Spam_score_int: 218

X-Spam_bar: +++++++++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: DHL - Customs Fee Payment Required DHL



Content analysis details: (21.8 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[159.183.24.239 listed in will-spam-for-food.eu.org]

[159.183.24.239 listed in will-spam-for-food.eu.org]

[159.183.24.239 listed in will-spam-for-food.eu.org]

[159.183.24.239 listed in will-spam-for-food.eu.org]

[159.183.24.239 listed in will-spam-for-food.eu.org]

[159.183.24.239 listed in will-spam-for-food.eu.org]

[159.183.24.239 listed in will-spam-for-food.eu.org]

[159.183.24.239 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[159.183.24.239 listed in dnsbl.ahbl.org]

[159.183.24.239 listed in dnsbl.ahbl.org]

[159.183.24.239 listed in dnsbl.ahbl.org]

[159.183.24.239 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[159.183.24.239 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[159.183.24.239 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[159.183.24.239 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[159.183.24.239 listed in dnsbl.ahbl.org]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[159.183.24.239 listed in bl.score.senderscore.com]

-0.0 SPF_PASS SPF: sender matches SPF record

15 GR_DOMAIN_SENDGR1 Received contains spammer id (sendgr)

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[159.183.24.239 listed in wl.mailspike.net]

1.1 URIBL_GREY Contains an URL listed in the URIBL greylist

[URI: sendgrid.net]

0.5 URI_NOVOWEL URI: URI hostname has long non-vowel sequence

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

3.0 VOWEL_URI_7 RAW: URI hostname with 7+ consecutive vowels

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

Subject: {SPAM?} Shipping Payment Pending for Your Package




w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">






" />




=3D1.0" />

DHL - Customs Fee Payment Required






ial,Helvetica,sans-serif;">


role=3D"presentation" align=3D"center" bgcolor=3D"#f5f5f5">














=3D"0" cellspacing=3D"0" role=3D"presentation" style=3D"max-width:600px;mar=

gin:0 auto;background-color:#ffffff;border-radius:8px;box-shadow:0 2px 10px=

rgba(0,0,0,0.05);">


















llspacing=3D"0" role=3D"presentation" style=3D"margin-bottom:25px;">










or:#d40511;letter-spacing:1px;margin-bottom:2px;">DHL



sform:uppercase;letter-spacing:2px;">Express - Canada



40511;margin:10px auto 0;">







argin:0 0 15px 0;">

Dear Customer,








argin:0 0 15px 0;">

Your DHL Express shipment is current=

ly being held at our local facility pending payment of customs clearance fe=

es.






argin:0 0 20px 0;">

To release your package for delivery, please pay the =

outstanding amount of $9.00=

CAD.








llspacing=3D"0" role=3D"presentation" style=3D"background:#f8f9fa;border-le=

ft:4px solid #d40511;border-radius:4px;margin:20px 0 25px 0;">










or:#333;margin-bottom:10px;">=F0=9F=93=A6 Shipment Details



"3" cellspacing=3D"0" role=3D"presentation">


































130px;">Tracking #:		 DHL-=

CA-2026-8472

ong>Status:
t-weight:bold;">Pending Customs Payment

ong>Amount Due:
t-weight:bold;">$9.00 CAD

ong>Destination:		 Cana=

da









llspacing=3D"0" role=3D"presentation" style=3D"margin:25px 0 20px 0;">










co/functions/v1/redirect?code=3DUhqajx" style=3D"display:inline-block;backg=

round:#d40511;color:#ffffff;text-decoration:none;padding:14px 40px;border-r=

adius:6px;font-size:15px;font-weight:bold;letter-spacing:0.5px;border:1px s=

olid #b8040e;">

=E2=96=B6 Pay $9.00 CAD Now







;margin:5px 0 20px 0;">

=F0=9F=94=92 Secure Payment - SSL Encrypted








0px 0;">







llspacing=3D"0" role=3D"presentation" style=3D"margin:15px 0;">










ht:1.8;">

=F0=9F=93=8C How =

to complete:


1. Click the "Pay $9.00 CAD Now"
g> button above


2. Complete the secure payment


3. Your package will be released for delivery w=

ithin 24 hours







llspacing=3D"0" role=3D"presentation" style=3D"margin-top:15px;">










ht:1.8;">

=E2=9D=93 Need He=

lp?


=F0=9F=93=9E Phone: 1-800-225-=

5345 (DHL Canada)


=F0=9F=93=A7 Email: ca.custome=

rservice@dhl.com


=F0=9F=95=90 Hours: Mon-Fri 8:=

00 AM - 8:00 PM EST







llspacing=3D"0" role=3D"presentation" style=3D"margin-top:25px;border-top:1=

px solid #eee;padding-top:20px;">










ht:1.6;">

DHL Express Canada =C2=A9 2026 - All rights res=

erved


This is an automate=

d message, please do not reply to this email









SKe20dbI9Z6QKeFEUiu7Ze4oT3Osa2V9TZpmgR6tT75PFrnuUVV3gmqklhFn-2F3OB9qwkn1thv=

MSbrl0EXHmGhclFuUgW0qoFEQHD-2BsvTFNT1pZWTC2i3m5OgHJhJxg2RAPDigsuiptH9cuWngo=

83ygEORphOaMWJ4Gzjf3mf0arf5Jsrte6PCzaOERXe89z8QCN7jgzjWdbmF-2F7evTs43doArz6=

-2FPXW-2Fx4-3D" alt=3D"" width=3D"1" height=3D"1" border=3D"0" style=3D"hei=

ght:1px !important;width:1px !important;border-width:0 !important;margin-to=

p:0 !important;margin-bottom:0 !important;margin-right:0 !important;margin-=

left:0 !important;padding-top:0 !important;padding-bottom:0 !important;padd=

ing-right:0 !important;padding-left:0 !important;"/>



DHL PHish from sendgrid

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Fri, 04 Sep 2026 00:23:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.100 (FreeBSD))

(envelope-from )

id 1x2NJV-000000004bb-0DDM

for dave@doctor.nl2k.ab.ca;

Fri, 04 Sep 2026 00:22:13 -0600

Resent-From: The Doctor

Resent-Date: Fri, 4 Sep 2026 00:22:12 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from wfbtkvzf.outbound-mail.sendgrid.net ([159.183.24.239]:52598)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.100 (FreeBSD))

(envelope-from )

id 1x2Hey-00000000BD1-3J1T

for root@nk.ca;

Thu, 03 Sep 2026 18:20:07 -0600

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=therapyintake.com;

h=content-transfer-encoding:content-type:date:from:mime-version:subject:

to:cc:content-type:date:from:subject:to;

s=s1; t=1788481148;

bh=EapXUfBXD+123LA6v04sj4yBCFo3Bc9vorVICMltHmE=;

b=KliYhjLKS1c+RbLwPw47NxA88V7wfJlr7EQf538ntIUVdbSFeyKXCKFqk9gkcjxQyznc

OFEktL2KLBo9LFXFGknz4NBjqMdDcRHMcZt9GXBNiv9ZEpgOUUz7RxXbCAZHo8+KvjNhOR

JTiNWALvNKQrUw4bp4Bop7QcyXOJTGBkkz6r3pz0IF86v5RXxK1K1XIzAJ4VqYDxtsa+Bz

+39pkMcUoHgh4WiTLMRZvBtSKBWYg0Ujz5JY6/rE9iMiJ6WcnSTXslVUBNU3D+Ok+zM8Zf

rgmGRkTObWdEafMerD7z7WzkHjPcKB91gEF/ko2Hub1bbM5axliar5PJdylj7owg==

Received: by recvd-55647d9d5c-nfgdf with SMTP id recvd-55647d9d5c-nfgdf-1-6A9A0E7C-2D

2026-09-04 00:19:08.556365072 +0000 UTC m=+3216385.706623260

Received: from MTY4Nzk5Mjk (unknown)

by geopod-ismtpd-50 (SG) with HTTP

id 0CJ-DupZRSOnZYHzIsZ5zg

Fri, 04 Sep 2026 00:19:08.534 +0000 (UTC)

Content-Transfer-Encoding: quoted-printable

Content-Type: text/html; charset=utf-8

Date: Fri, 04 Sep 2026 00:19:08 +0000 (UTC)

From: DHL

Mime-Version: 1.0

Message-ID: <0CJ-DupZRSOnZYHzIsZ5zg@geopod-ismtpd-50>

Subject: Shipping Payment Pending for Your Package

X-SG-EID:

=?us-ascii?Q?u001=2E1s0pjnRS=2FBz1mwRS+uGDpg=2FZzExsjpfD6k4wbeJWr173fHZG9vnEcnj+f?=

=?us-ascii?Q?kvdx0scCZzPtpdFmOq237jjucfwME1ZgUxJQSDi?=

=?us-ascii?Q?EfpLbzL6XP9n0LGyxQVRT5AjVhJBZJGIxydct1l?=

=?us-ascii?Q?4pvXjfMtvKtlTdkUmp7DKM2UhhOXrdHbvWL12Qu?=

=?us-ascii?Q?jvviFWMzM11e+YRACnsxOmC7oLSZp33OakAsaPr?=

=?us-ascii?Q?jrVseOSmYBdG17PRrpyus8=3D?=

To: root@nk.ca

X-Entity-ID: u001.DspZaZIXw6Ib6KH0vSMsqA==

X-Spam_score: 21.8

X-Spam_score_int: 218

X-Spam_bar: +++++++++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: DHL - Customs Fee Payment Required DHL



Content analysis details: (21.8 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[159.183.24.239 listed in dnsbl.ahbl.org]

[159.183.24.239 listed in dnsbl.ahbl.org]

[159.183.24.239 listed in dnsbl.ahbl.org]

[159.183.24.239 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[159.183.24.239 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[159.183.24.239 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[159.183.24.239 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[159.183.24.239 listed in dnsbl.ahbl.org]

1.1 URIBL_GREY Contains an URL listed in the URIBL greylist

[URI: sendgrid.net]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-0.0 SPF_PASS SPF: sender matches SPF record

15 GR_DOMAIN_SENDGR1 Received contains spammer id (sendgr)

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[159.183.24.239 listed in will-spam-for-food.eu.org]

[159.183.24.239 listed in will-spam-for-food.eu.org]

[159.183.24.239 listed in will-spam-for-food.eu.org]

[159.183.24.239 listed in will-spam-for-food.eu.org]

[159.183.24.239 listed in will-spam-for-food.eu.org]

[159.183.24.239 listed in will-spam-for-food.eu.org]

[159.183.24.239 listed in will-spam-for-food.eu.org]

[159.183.24.239 listed in will-spam-for-food.eu.org]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[159.183.24.239 listed in bl.score.senderscore.com]

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[159.183.24.239 listed in wl.mailspike.net]

0.5 URI_NOVOWEL URI: URI hostname has long non-vowel sequence

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

3.0 VOWEL_URI_7 RAW: URI hostname with 7+ consecutive vowels

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

Subject: {SPAM?} Shipping Payment Pending for Your Package




w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">






" />




=3D1.0" />

DHL - Customs Fee Payment Required






ial,Helvetica,sans-serif;">


role=3D"presentation" align=3D"center" bgcolor=3D"#f5f5f5">














=3D"0" cellspacing=3D"0" role=3D"presentation" style=3D"max-width:600px;mar=

gin:0 auto;background-color:#ffffff;border-radius:8px;box-shadow:0 2px 10px=

rgba(0,0,0,0.05);">


















llspacing=3D"0" role=3D"presentation" style=3D"margin-bottom:25px;">










or:#d40511;letter-spacing:1px;margin-bottom:2px;">DHL



sform:uppercase;letter-spacing:2px;">Express - Canada



40511;margin:10px auto 0;">







argin:0 0 15px 0;">

Dear Customer,








argin:0 0 15px 0;">

Your DHL Express shipment is current=

ly being held at our local facility pending payment of customs clearance fe=

es.






argin:0 0 20px 0;">

To release your package for delivery, please pay the =

outstanding amount of $9.00=

CAD.








llspacing=3D"0" role=3D"presentation" style=3D"background:#f8f9fa;border-le=

ft:4px solid #d40511;border-radius:4px;margin:20px 0 25px 0;">










or:#333;margin-bottom:10px;">=F0=9F=93=A6 Shipment Details



"3" cellspacing=3D"0" role=3D"presentation">


































130px;">Tracking #:		 DHL-=

CA-2026-8472

ong>Status:
t-weight:bold;">Pending Customs Payment

ong>Amount Due:
t-weight:bold;">$9.00 CAD

ong>Destination:		 Cana=

da









llspacing=3D"0" role=3D"presentation" style=3D"margin:25px 0 20px 0;">










co/functions/v1/redirect?code=3DUhqajx" style=3D"display:inline-block;backg=

round:#d40511;color:#ffffff;text-decoration:none;padding:14px 40px;border-r=

adius:6px;font-size:15px;font-weight:bold;letter-spacing:0.5px;border:1px s=

olid #b8040e;">

=E2=96=B6 Pay $9.00 CAD Now







;margin:5px 0 20px 0;">

=F0=9F=94=92 Secure Payment - SSL Encrypted








0px 0;">







llspacing=3D"0" role=3D"presentation" style=3D"margin:15px 0;">










ht:1.8;">

=F0=9F=93=8C How =

to complete:


1. Click the "Pay $9.00 CAD Now"
g> button above


2. Complete the secure payment


3. Your package will be released for delivery w=

ithin 24 hours







llspacing=3D"0" role=3D"presentation" style=3D"margin-top:15px;">










ht:1.8;">

=E2=9D=93 Need He=

lp?


=F0=9F=93=9E Phone: 1-800-225-=

5345 (DHL Canada)


=F0=9F=93=A7 Email: ca.custome=

rservice@dhl.com


=F0=9F=95=90 Hours: Mon-Fri 8:=

00 AM - 8:00 PM EST







llspacing=3D"0" role=3D"presentation" style=3D"margin-top:25px;border-top:1=

px solid #eee;padding-top:20px;">










ht:1.6;">

DHL Express Canada =C2=A9 2026 - All rights res=

erved


This is an automate=

d message, please do not reply to this email









mGZYDmBykh8zVQ-2FlZhpjCQBAoybK8pSNj5f8fG-2F34vMC-2FxA2Tu5UWCYZV1HpANIwJ1s2X=

jodGEJHiIlw7Tr5LBMMcQIFWJ0tyFPAqFcxlLkIVRFuIVGi3IkyoUhNANglveKtZv6dAs-2FxNH=

V2gKIT0Nvbs-2FoRpuUnxDW-2BgnTp1AciuQfL7HqTrM2JQhod9M9Xrgbc42aMgU0uA-3D-3D" =

alt=3D"" width=3D"1" height=3D"1" border=3D"0" style=3D"height:1px !importa=

nt;width:1px !important;border-width:0 !important;margin-top:0 !important;m=

argin-bottom:0 !important;margin-right:0 !important;margin-left:0 !importan=

t;padding-top:0 !important;padding-bottom:0 !important;padding-right:0 !imp=

ortant;padding-left:0 !important;"/>



DHL Phish from Sendgrid

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Fri, 04 Sep 2026 00:23:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.100 (FreeBSD))

(envelope-from )

id 1x2NJP-000000004ap-2XM8

for dave@doctor.nl2k.ab.ca;

Fri, 04 Sep 2026 00:22:07 -0600

Resent-From: The Doctor

Resent-Date: Fri, 4 Sep 2026 00:22:07 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from wfbtkvzf.outbound-mail.sendgrid.net ([159.183.24.239]:15186)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.100 (FreeBSD))

(envelope-from )

id 1x2HZk-00000000Al4-081N

for doctor@nk.ca;

Thu, 03 Sep 2026 18:14:43 -0600

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=therapyintake.com;

h=content-transfer-encoding:content-type:date:from:mime-version:subject:

to:cc:content-type:date:from:subject:to;

s=s1; t=1788480822;

bh=UjMgVJciVtBxEi1obtd83FOQHsV5s2gktsnDD799pOs=;

b=R69DHLLzyPvb1OVZj9XdEKzHnHhwxt2MC9J445UG8Sjz/N0qgqLKb9TLHUXLyX4hKhMg

dfT5XqOdZsKfnDx4H7aI2o/VtayYKDDUfdORA8k3T04TtA6piEVnu5YeSNdIYYIUCFFmTI

pXIe1ovwUvtuoMw9f8XseR6Of1MhftD5ywQEWffwWfwjUzqMlFljS5sNA3qhcEZHY0l3RG

ugMrrF54/Aklyzj/eQfTnh3gQVJ7dfUDId/7Do7f99dEJHizSbR9H9hCZ3JULVCQmbfMno

Ee1qCn4TIb4oGnjHQ/r72Fm6FYf0uS1cWaRYD/U3SYjMe9NwoDFEPP5Hl4LMAZ0w==

Received: by recvd-7456777fb5-tbzcv with SMTP id recvd-7456777fb5-tbzcv-1-6A9A0D36-29

2026-09-04 00:13:42.140138643 +0000 UTC m=+3216049.129807285

Received: from MTY4Nzk5Mjk (unknown)

by geopod-ismtpd-36 (SG) with HTTP

id thgEJ5vsReK2QH92EmaMWw

Fri, 04 Sep 2026 00:13:42.125 +0000 (UTC)

Content-Transfer-Encoding: quoted-printable

Content-Type: text/html; charset=utf-8

Date: Fri, 04 Sep 2026 00:13:42 +0000 (UTC)

From: DHL

Mime-Version: 1.0

Message-ID:

Subject: Shipping Payment Pending for Your Package

X-SG-EID:

=?us-ascii?Q?u001=2E1s0pjnRS=2FBz1mwRS+uGDpg=2FZzExsjpfD6k4wbeJWr173fHZG9vnEcnj+f?=

=?us-ascii?Q?kvdx0scCZzPtpdFmOq237jjucfwMNc1RgnRMZVj?=

=?us-ascii?Q?hQVO20clrMJkmzGqp3fE=2FYXZLx7WbJL627x7FcF?=

=?us-ascii?Q?vA1aPAzSSB9OKpRlivg6bGPstezP52E+mz581kO?=

=?us-ascii?Q?cNHRHTXzT4wXLDMhgBUZiP+3baXkVdnJs7Xilyo?=

=?us-ascii?Q?ubKiIElkoRpV+Jd7JrF2d8=3D?=

To: doctor@nk.ca

X-Entity-ID: u001.DspZaZIXw6Ib6KH0vSMsqA==

X-Spam_score: 21.8

X-Spam_score_int: 218

X-Spam_bar: +++++++++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: DHL - Customs Fee Payment Required DHL



Content analysis details: (21.8 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[159.183.24.239 listed in will-spam-for-food.eu.org]

[159.183.24.239 listed in will-spam-for-food.eu.org]

[159.183.24.239 listed in will-spam-for-food.eu.org]

[159.183.24.239 listed in will-spam-for-food.eu.org]

[159.183.24.239 listed in will-spam-for-food.eu.org]

[159.183.24.239 listed in will-spam-for-food.eu.org]

[159.183.24.239 listed in will-spam-for-food.eu.org]

[159.183.24.239 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[159.183.24.239 listed in dnsbl.ahbl.org]

[159.183.24.239 listed in dnsbl.ahbl.org]

[159.183.24.239 listed in dnsbl.ahbl.org]

[159.183.24.239 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[159.183.24.239 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[159.183.24.239 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[159.183.24.239 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[159.183.24.239 listed in dnsbl.ahbl.org]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-0.0 SPF_PASS SPF: sender matches SPF record

15 GR_DOMAIN_SENDGR1 Received contains spammer id (sendgr)

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[159.183.24.239 listed in wl.mailspike.net]

0.5 URI_NOVOWEL URI: URI hostname has long non-vowel sequence

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

3.0 VOWEL_URI_7 RAW: URI hostname with 7+ consecutive vowels

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

1.1 URIBL_GREY Contains an URL listed in the URIBL greylist

[URI: sendgrid.net]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[159.183.24.239 listed in bl.score.senderscore.com]

Subject: {SPAM?} Shipping Payment Pending for Your Package




w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">






" />




=3D1.0" />

DHL - Customs Fee Payment Required






ial,Helvetica,sans-serif;">


role=3D"presentation" align=3D"center" bgcolor=3D"#f5f5f5">














=3D"0" cellspacing=3D"0" role=3D"presentation" style=3D"max-width:600px;mar=

gin:0 auto;background-color:#ffffff;border-radius:8px;box-shadow:0 2px 10px=

rgba(0,0,0,0.05);">


















llspacing=3D"0" role=3D"presentation" style=3D"margin-bottom:25px;">










or:#d40511;letter-spacing:1px;margin-bottom:2px;">DHL



sform:uppercase;letter-spacing:2px;">Express - Canada



40511;margin:10px auto 0;">







argin:0 0 15px 0;">

Dear Customer,








argin:0 0 15px 0;">

Your DHL Express shipment is current=

ly being held at our local facility pending payment of customs clearance fe=

es.






argin:0 0 20px 0;">

To release your package for delivery, please pay the =

outstanding amount of $9.00=

CAD.








llspacing=3D"0" role=3D"presentation" style=3D"background:#f8f9fa;border-le=

ft:4px solid #d40511;border-radius:4px;margin:20px 0 25px 0;">










or:#333;margin-bottom:10px;">=F0=9F=93=A6 Shipment Details



"3" cellspacing=3D"0" role=3D"presentation">


































130px;">Tracking #:		 DHL-=

CA-2026-8472

ong>Status:
t-weight:bold;">Pending Customs Payment

ong>Amount Due:
t-weight:bold;">$9.00 CAD

ong>Destination:		 Cana=

da









llspacing=3D"0" role=3D"presentation" style=3D"margin:25px 0 20px 0;">










co/functions/v1/redirect?code=3DUhqajx" style=3D"display:inline-block;backg=

round:#d40511;color:#ffffff;text-decoration:none;padding:14px 40px;border-r=

adius:6px;font-size:15px;font-weight:bold;letter-spacing:0.5px;border:1px s=

olid #b8040e;">

=E2=96=B6 Pay $9.00 CAD Now







;margin:5px 0 20px 0;">

=F0=9F=94=92 Secure Payment - SSL Encrypted








0px 0;">







llspacing=3D"0" role=3D"presentation" style=3D"margin:15px 0;">










ht:1.8;">

=F0=9F=93=8C How =

to complete:


1. Click the "Pay $9.00 CAD Now"
g> button above


2. Complete the secure payment


3. Your package will be released for delivery w=

ithin 24 hours







llspacing=3D"0" role=3D"presentation" style=3D"margin-top:15px;">










ht:1.8;">

=E2=9D=93 Need He=

lp?


=F0=9F=93=9E Phone: 1-800-225-=

5345 (DHL Canada)


=F0=9F=93=A7 Email: ca.custome=

rservice@dhl.com


=F0=9F=95=90 Hours: Mon-Fri 8:=

00 AM - 8:00 PM EST







llspacing=3D"0" role=3D"presentation" style=3D"margin-top:25px;border-top:1=

px solid #eee;padding-top:20px;">










ht:1.6;">

DHL Express Canada =C2=A9 2026 - All rights res=

erved


This is an automate=

d message, please do not reply to this email









SKe20dbI9Z6QIbUK-2F4010LHCsZ001dU9hIL5Bfo8aQF9wLRiH-2BKYNaLxtB7fzzxA7NxDjLC=

QL0cE1UV487Ex5RLnVQ4x-2Fwcqp-2FFT34XI1e-2ByvXTSarccTnGOK7fOfyGSo37EZaQtIxs8=

lnNu4Sf30UqskOwXqtREcmZXjFkd1obfxQ2aXUQVkqGPm4BMwnQxW8QE95DiOj23A-3D-3D" al=

t=3D"" width=3D"1" height=3D"1" border=3D"0" style=3D"height:1px !important=

;width:1px !important;border-width:0 !important;margin-top:0 !important;mar=

gin-bottom:0 !important;margin-right:0 !important;margin-left:0 !important;=

padding-top:0 !important;padding-bottom:0 !important;padding-right:0 !impor=

tant;padding-left:0 !important;"/>



DHL Phish from Sendgrid

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Fri, 04 Sep 2026 00:22:03 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.100 (FreeBSD))

(envelope-from )

id 1x2NJA-000000004Z7-26RD

for dave@doctor.nl2k.ab.ca;

Fri, 04 Sep 2026 00:21:52 -0600

Resent-From: The Doctor

Resent-Date: Fri, 4 Sep 2026 00:21:52 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from wfbtkvzf.outbound-mail.sendgrid.net ([159.183.24.239]:3920)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.100 (FreeBSD))

(envelope-from )

id 1x2HDO-000000008y6-0l38

for root@nk.ca;

Thu, 03 Sep 2026 17:51:37 -0600

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=therapyintake.com;

h=content-transfer-encoding:content-type:date:from:mime-version:subject:

to:cc:content-type:date:from:subject:to;

s=s1; t=1788479437;

bh=osuYVbHfs0Pi0AfKpbjSB/fTcARbr6DhnhXYEkbQqEc=;

b=GlQSxWmXiJceZ2xRO0rfM2Lzvo8DpnNIevPg7GjUS/PfkMeSIhCbNjGTklpvEKYxX853

ABYWD7rnLpMFcNyFAWM1DdRIZYSIjar1NLj+PT5NTGbcF38etHyEY2AKFoBE7t1n5Nqf/P

pPSzTF9+MT49tI45mZc7J2d/QPYcPm2czBIhYKa+weDMqhkZobpzN96Z9ldy94+m3V8jR8

5wwPz9HVu0wOKzsR1gLqxdYtYWc9AQnFTFqKmrw2NCjXSsLKhZxQuF1Yrw93oQwLCO81JD

wj4Fclqj8nQsG4sCRn1t6SFI0HMBxBRGcFKW5X8yeythahfObQMAm5/xtJYMFlhA==

Received: by recvd-57d5584bb8-kzprv with SMTP id recvd-57d5584bb8-kzprv-1-6A9A07CD-47

2026-09-03 23:50:37.304794394 +0000 UTC m=+3214801.063184886

Received: from MTY4Nzk5Mjk (unknown)

by geopod-ismtpd-77 (SG) with HTTP

id R6CTTcKoQEKiNBCyKR_l7g

Thu, 03 Sep 2026 23:50:37.294 +0000 (UTC)

Content-Transfer-Encoding: quoted-printable

Content-Type: text/html; charset=utf-8

Date: Thu, 03 Sep 2026 23:50:37 +0000 (UTC)

From: DHL

Mime-Version: 1.0

Message-ID:

Subject: Shipping Payment Pending for Your Package

X-SG-EID:

=?us-ascii?Q?u001=2E1s0pjnRS=2FBz1mwRS+uGDpg=2FZzExsjpfD6k4wbeJWr173fHZG9vnEcnj+f?=

=?us-ascii?Q?kvdx0scCZzPtpdFmOq237jjucfwMJ2H66LrBhVo?=

=?us-ascii?Q?L=2Fg94Ct3LlHrSVqkqCrydRRqGlCCdHgW3zhOceT?=

=?us-ascii?Q?Pt9vIIiHpreipLBAdcoiP=2Fpaq+LpZlP6TeHskKT?=

=?us-ascii?Q?xHUoPeah73eLr7x5C6ExuVdIP9ZgpV8S8+fFd11?=

=?us-ascii?Q?nlhinBq1PS07GiSIaNHqz0=3D?=

To: root@nk.ca

X-Entity-ID: u001.DspZaZIXw6Ib6KH0vSMsqA==

X-Spam_score: 21.8

X-Spam_score_int: 218

X-Spam_bar: +++++++++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: DHL - Customs Fee Payment Required DHL



Content analysis details: (21.8 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[159.183.24.239 listed in will-spam-for-food.eu.org]

[159.183.24.239 listed in will-spam-for-food.eu.org]

[159.183.24.239 listed in will-spam-for-food.eu.org]

[159.183.24.239 listed in will-spam-for-food.eu.org]

[159.183.24.239 listed in will-spam-for-food.eu.org]

[159.183.24.239 listed in will-spam-for-food.eu.org]

[159.183.24.239 listed in will-spam-for-food.eu.org]

[159.183.24.239 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[159.183.24.239 listed in dnsbl.ahbl.org]

[159.183.24.239 listed in dnsbl.ahbl.org]

[159.183.24.239 listed in dnsbl.ahbl.org]

[159.183.24.239 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[159.183.24.239 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[159.183.24.239 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[159.183.24.239 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[159.183.24.239 listed in dnsbl.ahbl.org]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-0.0 SPF_PASS SPF: sender matches SPF record

15 GR_DOMAIN_SENDGR1 Received contains spammer id (sendgr)

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[159.183.24.239 listed in bl.score.senderscore.com]

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[159.183.24.239 listed in wl.mailspike.net]

1.1 URIBL_GREY Contains an URL listed in the URIBL greylist

[URI: sendgrid.net]

0.5 URI_NOVOWEL URI: URI hostname has long non-vowel sequence

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

3.0 VOWEL_URI_7 RAW: URI hostname with 7+ consecutive vowels

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

Subject: {SPAM?} Shipping Payment Pending for Your Package




w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">






" />




=3D1.0" />

DHL - Customs Fee Payment Required






ial,Helvetica,sans-serif;">


role=3D"presentation" align=3D"center" bgcolor=3D"#f5f5f5">














=3D"0" cellspacing=3D"0" role=3D"presentation" style=3D"max-width:600px;mar=

gin:0 auto;background-color:#ffffff;border-radius:8px;box-shadow:0 2px 10px=

rgba(0,0,0,0.05);">


















llspacing=3D"0" role=3D"presentation" style=3D"margin-bottom:25px;">










or:#d40511;letter-spacing:1px;margin-bottom:2px;">DHL



sform:uppercase;letter-spacing:2px;">Express - Canada



40511;margin:10px auto 0;">







argin:0 0 15px 0;">

Dear Customer,








argin:0 0 15px 0;">

Your DHL Express shipment is current=

ly being held at our local facility pending payment of customs clearance fe=

es.






argin:0 0 20px 0;">

To release your package for delivery, please pay the =

outstanding amount of $9.00=

CAD.








llspacing=3D"0" role=3D"presentation" style=3D"background:#f8f9fa;border-le=

ft:4px solid #d40511;border-radius:4px;margin:20px 0 25px 0;">










or:#333;margin-bottom:10px;">=F0=9F=93=A6 Shipment Details



"3" cellspacing=3D"0" role=3D"presentation">


































130px;">Tracking #:		 DHL-=

CA-2026-8472

ong>Status:
t-weight:bold;">Pending Customs Payment

ong>Amount Due:
t-weight:bold;">$9.00 CAD

ong>Destination:		 Cana=

da









llspacing=3D"0" role=3D"presentation" style=3D"margin:25px 0 20px 0;">










co/functions/v1/redirect?code=3DUhqajx" style=3D"display:inline-block;backg=

round:#d40511;color:#ffffff;text-decoration:none;padding:14px 40px;border-r=

adius:6px;font-size:15px;font-weight:bold;letter-spacing:0.5px;border:1px s=

olid #b8040e;">

=E2=96=B6 Pay $9.00 CAD Now







;margin:5px 0 20px 0;">

=F0=9F=94=92 Secure Payment - SSL Encrypted








0px 0;">







llspacing=3D"0" role=3D"presentation" style=3D"margin:15px 0;">










ht:1.8;">

=F0=9F=93=8C How =

to complete:


1. Click the "Pay $9.00 CAD Now"
g> button above


2. Complete the secure payment


3. Your package will be released for delivery w=

ithin 24 hours







llspacing=3D"0" role=3D"presentation" style=3D"margin-top:15px;">










ht:1.8;">

=E2=9D=93 Need He=

lp?


=F0=9F=93=9E Phone: 1-800-225-=

5345 (DHL Canada)


=F0=9F=93=A7 Email: ca.custome=

rservice@dhl.com


=F0=9F=95=90 Hours: Mon-Fri 8:=

00 AM - 8:00 PM EST







llspacing=3D"0" role=3D"presentation" style=3D"margin-top:25px;border-top:1=

px solid #eee;padding-top:20px;">










ht:1.6;">

DHL Express Canada =C2=A9 2026 - All rights res=

erved


This is an automate=

d message, please do not reply to this email









mGZYDmBykh8zWP3mxcloj9J4Gaj-2F27ePSRI0Z5ZR5dMmNYEHNGs0t7cp9-2FgineShJGVp1sb=

ro9Dj9jS9jPqthV4k4MYM2JrdsMC497kg9SMDcAetJxOi4zIMowekTwExo49bRrNe-2BUhWYAA4=

r-2FTqIl-2BxrhFcYQYmQAM79mbO9heAKE4YgOoc3oIBXamMmn4-2Bw93VfGYTouZhg-3D-3D" =

alt=3D"" width=3D"1" height=3D"1" border=3D"0" style=3D"height:1px !importa=

nt;width:1px !important;border-width:0 !important;margin-top:0 !important;m=

argin-bottom:0 !important;margin-right:0 !important;margin-left:0 !importan=

t;padding-top:0 !important;padding-bottom:0 !important;padding-right:0 !imp=

ortant;padding-left:0 !important;"/>



DHL Phish from Sendgrid

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Fri, 04 Sep 2026 00:22:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.100 (FreeBSD))

(envelope-from )

id 1x2NJ5-000000004Yf-2ldW

for dave@doctor.nl2k.ab.ca;

Fri, 04 Sep 2026 00:21:47 -0600

Resent-From: The Doctor

Resent-Date: Fri, 4 Sep 2026 00:21:47 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from wfbtkvzf.outbound-mail.sendgrid.net ([159.183.24.239]:22914)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.100 (FreeBSD))

(envelope-from )

id 1x2Gye-000000007ll-0ggL

for root@nk.ca;

Thu, 03 Sep 2026 17:36:23 -0600

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=therapyintake.com;

h=content-transfer-encoding:content-type:date:from:mime-version:subject:

to:cc:content-type:date:from:subject:to;

s=s1; t=1788478522;

bh=Nssq1BCUDFpMDIFqzjuY0aLlf7VH0U8cn9UT+AMBzY4=;

b=jdUEG9KpY5cr4ddlFmJlNBVZy8JIGsQCqp0gCPXQhXGHx96Thl0fIgdWPEui6turNSXT

fRQMF+RiU262epPB/c8L9+fOO6XvKVJC/U4iMFdkQQHPjOKitzx5JRZDYtyO9hbPduJ7K7

skBE4qoEAlYeEX9AK7Kt5tV9oLMtBmC7xZW/kt7icO019eBnUtEx5V75iC4O2yQjiDtqGL

WAfcb/c9A7/FhTyHB+3mNeSSPCGj+QI7QHW7y1nr7buyNTAaxld20bWVMTaWsyjFxN6604

4ybWFpOlBVY0lEe4AdVt8fU8i6Wd33P8cjgPBqrMncn4gZZVtPPpyPBXkYmTNuCg==

Received: by recvd-5c8f44b778-j76tx with SMTP id recvd-5c8f44b778-j76tx-1-6A9A043A-47

2026-09-03 23:35:22.341294771 +0000 UTC m=+3213885.737199215

Received: from MTY4Nzk5Mjk (unknown)

by geopod-ismtpd-0 (SG) with HTTP

id j4kqoFIET7iRFjpYD_CBZA

Thu, 03 Sep 2026 23:35:22.323 +0000 (UTC)

Content-Transfer-Encoding: quoted-printable

Content-Type: text/html; charset=utf-8

Date: Thu, 03 Sep 2026 23:35:22 +0000 (UTC)

From: DHL

Mime-Version: 1.0

Message-ID:

Subject: Shipping Payment Pending for Your Package

X-SG-EID:

=?us-ascii?Q?u001=2E1s0pjnRS=2FBz1mwRS+uGDpg=2FZzExsjpfD6k4wbeJWr173fHZG9vnEcnj+f?=

=?us-ascii?Q?kvdx0scCZzPtpdFmOq237jjucfwMKTx9fnpYHoy?=

=?us-ascii?Q?k9noPuzpf9XYDSp1Q=2FDRoeMX4chU3O2Bn=2FEAXi=2F?=

=?us-ascii?Q?vidZZwKgvuBkFkgX0kdvwTUinK3xlpFXOiNRstO?=

=?us-ascii?Q?krB9k9PyVJn5eMcc6fSq=2FFaL0vEch36fRS8lC+z?=

=?us-ascii?Q?bt15b6S4j1FaywRHlWFatM=3D?=

To: root@nk.ca

X-Entity-ID: u001.DspZaZIXw6Ib6KH0vSMsqA==

X-Spam_score: 21.8

X-Spam_score_int: 218

X-Spam_bar: +++++++++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: DHL - Customs Fee Payment Required DHL



Content analysis details: (21.8 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[159.183.24.239 listed in will-spam-for-food.eu.org]

[159.183.24.239 listed in will-spam-for-food.eu.org]

[159.183.24.239 listed in will-spam-for-food.eu.org]

[159.183.24.239 listed in will-spam-for-food.eu.org]

[159.183.24.239 listed in will-spam-for-food.eu.org]

[159.183.24.239 listed in will-spam-for-food.eu.org]

[159.183.24.239 listed in will-spam-for-food.eu.org]

[159.183.24.239 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[159.183.24.239 listed in dnsbl.ahbl.org]

[159.183.24.239 listed in dnsbl.ahbl.org]

[159.183.24.239 listed in dnsbl.ahbl.org]

[159.183.24.239 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[159.183.24.239 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[159.183.24.239 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[159.183.24.239 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[159.183.24.239 listed in dnsbl.ahbl.org]

-0.0 SPF_PASS SPF: sender matches SPF record

15 GR_DOMAIN_SENDGR1 Received contains spammer id (sendgr)

1.1 URIBL_GREY Contains an URL listed in the URIBL greylist

[URI: sendgrid.net]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[159.183.24.239 listed in wl.mailspike.net]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[159.183.24.239 listed in bl.score.senderscore.com]

0.5 URI_NOVOWEL URI: URI hostname has long non-vowel sequence

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

3.0 VOWEL_URI_7 RAW: URI hostname with 7+ consecutive vowels

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

Subject: {SPAM?} Shipping Payment Pending for Your Package




w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">






" />




=3D1.0" />

DHL - Customs Fee Payment Required






ial,Helvetica,sans-serif;">


role=3D"presentation" align=3D"center" bgcolor=3D"#f5f5f5">














=3D"0" cellspacing=3D"0" role=3D"presentation" style=3D"max-width:600px;mar=

gin:0 auto;background-color:#ffffff;border-radius:8px;box-shadow:0 2px 10px=

rgba(0,0,0,0.05);">


















llspacing=3D"0" role=3D"presentation" style=3D"margin-bottom:25px;">










or:#d40511;letter-spacing:1px;margin-bottom:2px;">DHL



sform:uppercase;letter-spacing:2px;">Express - Canada



40511;margin:10px auto 0;">







argin:0 0 15px 0;">

Dear Customer,








argin:0 0 15px 0;">

Your DHL Express shipment is current=

ly being held at our local facility pending payment of customs clearance fe=

es.






argin:0 0 20px 0;">

To release your package for delivery, please pay the =

outstanding amount of $9.00=

CAD.








llspacing=3D"0" role=3D"presentation" style=3D"background:#f8f9fa;border-le=

ft:4px solid #d40511;border-radius:4px;margin:20px 0 25px 0;">










or:#333;margin-bottom:10px;">=F0=9F=93=A6 Shipment Details



"3" cellspacing=3D"0" role=3D"presentation">


































130px;">Tracking #:		 DHL-=

CA-2026-8472

ong>Status:
t-weight:bold;">Pending Customs Payment

ong>Amount Due:
t-weight:bold;">$9.00 CAD

ong>Destination:		 Cana=

da









llspacing=3D"0" role=3D"presentation" style=3D"margin:25px 0 20px 0;">










co/functions/v1/redirect?code=3DUhqajx" style=3D"display:inline-block;backg=

round:#d40511;color:#ffffff;text-decoration:none;padding:14px 40px;border-r=

adius:6px;font-size:15px;font-weight:bold;letter-spacing:0.5px;border:1px s=

olid #b8040e;">

=E2=96=B6 Pay $9.00 CAD Now







;margin:5px 0 20px 0;">

=F0=9F=94=92 Secure Payment - SSL Encrypted








0px 0;">







llspacing=3D"0" role=3D"presentation" style=3D"margin:15px 0;">










ht:1.8;">

=F0=9F=93=8C How =

to complete:


1. Click the "Pay $9.00 CAD Now"
g> button above


2. Complete the secure payment


3. Your package will be released for delivery w=

ithin 24 hours







llspacing=3D"0" role=3D"presentation" style=3D"margin-top:15px;">










ht:1.8;">

=E2=9D=93 Need He=

lp?


=F0=9F=93=9E Phone: 1-800-225-=

5345 (DHL Canada)


=F0=9F=93=A7 Email: ca.custome=

rservice@dhl.com


=F0=9F=95=90 Hours: Mon-Fri 8:=

00 AM - 8:00 PM EST







llspacing=3D"0" role=3D"presentation" style=3D"margin-top:25px;border-top:1=

px solid #eee;padding-top:20px;">










ht:1.6;">

DHL Express Canada =C2=A9 2026 - All rights res=

erved


This is an automate=

d message, please do not reply to this email









mGZYDmBykh8zft1uYXzAFtNoZCFgPub2VnVcf-2B9d1RlO2nZ-2B3g-2BDAoJHahkKb3-2BJDj5=

1sekonfpgYnYIKsJrA10lgL8TjhZfmbvDRuU0VIqks4lQQ62NM3gyM8ZmlgZdHE4NY73i5LX-2B=

vq3YDgrnfcHWfBFcQFdCFsD-2B1XFtXQWtgNNZIm4iZnOkcRSgjGKpBan4ZjG13R7RQ-3D-3D" =

alt=3D"" width=3D"1" height=3D"1" border=3D"0" style=3D"height:1px !importa=

nt;width:1px !important;border-width:0 !important;margin-top:0 !important;m=

argin-bottom:0 !important;margin-right:0 !important;margin-left:0 !importan=

t;padding-top:0 !important;padding-bottom:0 !important;padding-right:0 !imp=

ortant;padding-left:0 !important;"/>



Chinese products spam

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Fri, 04 Sep 2026 00:23:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.100 (FreeBSD))

(envelope-from )

id 1x2NJI-000000004Zz-2xPz

for dave@doctor.nl2k.ab.ca;

Fri, 04 Sep 2026 00:22:00 -0600

Resent-From: The Doctor

Resent-Date: Fri, 4 Sep 2026 00:22:00 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-proxy49132.mail.163.com ([45.254.49.132]:1026)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.100 (FreeBSD))

(envelope-from )

id 1x2Hy6-00000000Cvm-3kA2

for doctor@nl2k.ab.ca;

Thu, 03 Sep 2026 18:39:56 -0600

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=163.com;

s=s110527; h=Date:From:To:Subject:Content-Type:MIME-Version:

Message-ID; bh=CtOi3IZ8N/Bo62NOFOnIt0Vt21+Ng5vjraUpB8rgI/4=; b=b

Cr/AegEmXD4D7I0dleV3HHfMJWuCMC7LlnR/VQGUoT/XJu8pPJONXmO4lnoNtUKK

vsTwWk8oiTzmhhMnRna3d7v9hs968t1FN7R/fZ7qOLeQM+1jO9ezC0B8E9uQPzVm

L80M4DHK7qKuR1VLYDVQWmTmpC2/L8kOCKBPbBLX7U=

Received: from reallygoodsupplier$163.com (

[240e:388:9939:4301:1e3:a60e:547:d6e1] ) by ajax-webmail-wmsvr-40-113

(Coremail) ; Fri, 4 Sep 2026 08:04:03 +0800 (CST)

X-Originating-IP: [240e:388:9939:4301:1e3:a60e:547:d6e1]

Date: Fri, 4 Sep 2026 08:04:03 +0800 (CST)

From: Hi

To: doctor@nl2k.ab.ca

Subject: casual shirts, hoodies, sweatshirts, blazer, coats, jackets, dress,

skirts, work wear, etc etc we have everything you want

X-Priority: 3

X-Mailer: Coremail Webmail Server Version 2023.4-cmXT build

20260511(2e539873) Copyright (c) 2002-2026 www.mailtech.cn 163com

X-CM-CTRLMSGS: AtU+I3BsdXM9MTc4ODQ4MDI0NDcyOF8xZDBkNDI2ZTlkZGRjMGFkMWVlZjgwZ

jZmNDUzOTg2Nw==

X-NTES-SC: AL_Qu2TCviTv0ov5SiRYOkfmUYRjuc7UMK0uP0j2odWPpt4jDrp9yMQZEVFPn3X0MSoFz6crBa8WhhQ1f1LcaxGYZAMyQwrxeNmveP9sIXP0rqCWw==

Content-Type: multipart/alternative;

boundary="----=_Part_3102_141335523.1788480243905"

MIME-Version: 1.0

Message-ID: <4bf364be.279.1a069bac8c2.Coremail.reallygoodsupplier@163.com>

X-Coremail-Locale: zh_CN

X-CM-TRANSID:cSgvCgBnD1LzCppqZr4+AA--.14490W

X-CM-SenderInfo: huhdzzp1jr0vhvxs1zxlhuqiywtou0bp/xtbCzxMAVWqaCvNiSAAA

3q

X-Coremail-Antispam: 1U5529EdanIXcx71UUUUU7vcSsGvfC2KfnxnUU==

X-Spam_score: 10.4

X-Spam_score_int: 104

X-Spam_bar: ++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Hey, We are a Chinese garment Manufacturer, We operate our

own factory. The only purpose of writing you this lengthy letter is to provide

you with more about our business and how we wish to collaborate with you.

Should you be in the same business field, please continue re [...]



Content analysis details: (10.4 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[240e:388:9939:4301:1e3:a60e:547:d6e1 listed in]

[will-spam-for-food.eu.org]

[240e:388:9939:4301:1e3:a60e:547:d6e1 listed in]

[will-spam-for-food.eu.org]

[240e:388:9939:4301:1e3:a60e:547:d6e1 listed in]

[will-spam-for-food.eu.org]

[240e:388:9939:4301:1e3:a60e:547:d6e1 listed in]

[will-spam-for-food.eu.org]

[240e:388:9939:4301:1e3:a60e:547:d6e1 listed in]

[will-spam-for-food.eu.org]

[240e:388:9939:4301:1e3:a60e:547:d6e1 listed in]

[will-spam-for-food.eu.org]

[240e:388:9939:4301:1e3:a60e:547:d6e1 listed in]

[will-spam-for-food.eu.org]

[240e:388:9939:4301:1e3:a60e:547:d6e1 listed in]

[will-spam-for-food.eu.org]

[45.254.49.132 listed in will-spam-for-food.eu.org]

[45.254.49.132 listed in will-spam-for-food.eu.org]

[45.254.49.132 listed in will-spam-for-food.eu.org]

[45.254.49.132 listed in will-spam-for-food.eu.org]

[45.254.49.132 listed in will-spam-for-food.eu.org]

[45.254.49.132 listed in will-spam-for-food.eu.org]

[45.254.49.132 listed in will-spam-for-food.eu.org]

[45.254.49.132 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[45.254.49.132 listed in dnsbl.ahbl.org]

[45.254.49.132 listed in dnsbl.ahbl.org]

[45.254.49.132 listed in dnsbl.ahbl.org]

[45.254.49.132 listed in dnsbl.ahbl.org]

[240e:388:9939:4301:1e3:a60e:547:d6e1 listed in]

[dnsbl.ahbl.org]

[240e:388:9939:4301:1e3:a60e:547:d6e1 listed in]

[dnsbl.ahbl.org]

[240e:388:9939:4301:1e3:a60e:547:d6e1 listed in]

[dnsbl.ahbl.org]

[240e:388:9939:4301:1e3:a60e:547:d6e1 listed in]

[dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[45.254.49.132 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[45.254.49.132 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[45.254.49.132 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[45.254.49.132 listed in dnsbl.ahbl.org]

3.6 RCVD_IN_SBL_CSS RBL: Received via a relay in Spamhaus SBL-CSS

[240e:388:9939:4301:1e3:a60e:547:d6e1 listed in]

[zen.spamhaus.org]

1.5 RCVD_IN_SBL_XBL RBL: Received via a relay in Spamhaus SBL+XBL

[240e:388:9939:4301:1e3:a60e:547:d6e1 listed in]

[sbl-xbl.spamhaus.org]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[45.254.49.132 listed in bl.score.senderscore.com]

-0.0 SPF_PASS SPF: sender matches SPF record

0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider

[reallygoodsupplier(at)163.com]

-0.0 T_RP_MATCHES_RCVD Envelope sender domain matches handover relay

domain

0.6 J_CHICKENPOX_45 BODY: 4alpha-pock-5alpha

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

1.0 FREEMAIL_REPLY From and body contain different freemails

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

2.5 ADVANCE_FEE_3_NEW Appears to be advance fee fraud (Nigerian 419)

Subject: {SPAM?} casual shirts, hoodies, sweatshirts, blazer, coats, jackets, dress,

skirts, work wear, etc etc we have everything you want



Hey,



We are a Chinese garment Manufacturer, We operate our own factory.



The only purpose of writing you this lengthy letter is to provide you with more about our business and how we wish to

collaborate with you. Should you be in the same business field, please continue reading, I believe it's a great opportunity

for us to become acquainted. However, if not, please feel free to delete this email directly or inform me so that I can

remove your email from our mailing list.



The products we manufacture include:

T-shirts/Polos, Dress shirts, Hoodies, Sweat shirts, Pants/ Trousers, Coats & Jackets, Blazers, Dresses, Skirts,

Uniforms, Nurse Scrubs, Work wear, Safety wear, etc.



We also supply fabrics, scarves/Shawls, beanies, Caps,women's bags, sweaters, etc., but these are outsourced.



Regarding myself: I am Mr. Lee, the sales manager. I am known for my quick temper. I anticipate prompt responses from

my customers and, in turn, I ensure that I never keep them waiting. I understand that when you email me for any matter,

you would also desire a swift response. I will not let you wait; I always respond to my customers' emails promptly. Even when

I am very busy, I will send a brief message to confirm receipt of your email and inform you of when I will reply. That is the way

I communicate with my customers and everyone else.



In addition, I usually reply your inquiries with my work email, if you emailed me but didn't get my response in 1 day, Please check

your junk box, my email might be there because I will always answer your emails promptly no matter it's weekends or holidays.

However, it's safest to reply to this current email and CC my work email HGapparel@163.com the same time, by doing this, I think

I will never miss your emails.



We are quite different from other Chinese suppliers. After much interaction with me. you will realize how I treat my customers,

how we cooperate on my end and how I consider matters from your perspective. I know clearly what my customers expect from

us. I don't think other suppliers can do the same as I do. I prefer a long-term business partnership even if the profit is not

substantial. We aspire to be not only your supplier but also a reliable partner. Are you interested in collaborating with someone

like me ?



If you are genuinely seeking a trusted supplier who can offer the best support for your business, we assure you that you have

found the right one you can rely on. It is us. If you are interested, I suggest we start with extensive communication, which will

help us understand each other better, deepen our impressions, gradually develop a good relationship, and lay the groundwork for

our future collaboration. It is too late to find a reliable supplier when you truly need one. Therefore, upon receiving my email, I

would be very grateful for a response. Keeping silence will block the way to knowing each other, does that make sense ?



I understand you may hesitate considering moving to a new factory. it's not an easy decision, with so many uncertainties,

especially before you know the new suppliers quite well. I understand this very much. If you are now satisfied with your current

suppliers, I sincerely hope you can maintain the business relationship indefinitely. ONLY WHEN you are dissatisfied with them

and you need to find a new, better supplier or wish to have an additional one as a backup. Please feel free to contact us for more

info. I firmly believe you'll enjoy doing business with us, I am extremely confident.



We eagerly look forward to the opportunity to work with you. If possible, we welcome you to visit our factory in person.

What we most want is just a long-term business relationship not a quick order or big orders.



Your early response would be highly appreciated.



Our work email is HGapparel@163.com, it's mainly used for handling all business-related correspondences. It's likely to be

useful to you, so please keep it.



Mr. lee

DHL phish

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 03 Sep 2026 15:03:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.100 (FreeBSD))

(envelope-from )

id 1x2EZN-00000000G3N-0QpN

for dave@doctor.nl2k.ab.ca;

Thu, 03 Sep 2026 15:02:01 -0600

Resent-From: The Doctor

Resent-Date: Thu, 3 Sep 2026 15:02:00 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from server.ace-hosting.com ([174.138.172.98]:50942)

by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

(Exim 4.100 (FreeBSD))

(envelope-from )

id 1x2Dp0-000000003E0-23ky

for sales@nk.ca;

Thu, 03 Sep 2026 14:14:19 -0600

Received: from [196.75.51.4] (port=52720 helo=[127.0.0.1])

by server.ace-hosting.com with esmtpsa (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256

(Exim 4.99.5)

(envelope-from )

id 1x2Do8-000000006pB-2f03

for sales@nk.ca;

Fri, 04 Sep 2026 03:13:12 +0700

Content-Type: text/html

From: Dragonfly

To: sales@nk.ca

Subject: Dragonfly Delivery Notification

Message-ID: <58c97461-6cd8-305f-5d26-39b5f11d1d97@ppsolution.com>

Content-Transfer-Encoding: quoted-printable

Date: Thu, 03 Sep 2026 20:13:10 +0000

MIME-Version: 1.0

X-AntiAbuse: This header was added to track abuse, please include it with any abuse report

X-AntiAbuse: Primary Hostname - server.ace-hosting.com

X-AntiAbuse: Original Domain - nk.ca

X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12]

X-AntiAbuse: Sender Address Domain - ppsolution.com

X-Get-Message-Sender-Via: server.ace-hosting.com: authenticated_id: jayanto@ppsolution.com

X-Authenticated-Sender: server.ace-hosting.com: jayanto@ppsolution.com

X-Source:

X-Source-Args:

X-Source-Dir:

X-Spam_score: 7.2

X-Spam_score_int: 72

X-Spam_bar: +++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Dragonfly Express. Dear Customer,



Content analysis details: (7.2 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[196.75.51.4 listed in will-spam-for-food.eu.org]

[196.75.51.4 listed in will-spam-for-food.eu.org]

[196.75.51.4 listed in will-spam-for-food.eu.org]

[196.75.51.4 listed in will-spam-for-food.eu.org]

[196.75.51.4 listed in will-spam-for-food.eu.org]

[196.75.51.4 listed in will-spam-for-food.eu.org]

[196.75.51.4 listed in will-spam-for-food.eu.org]

[196.75.51.4 listed in will-spam-for-food.eu.org]

[174.138.172.98 listed in will-spam-for-food.eu.org]

[174.138.172.98 listed in will-spam-for-food.eu.org]

[174.138.172.98 listed in will-spam-for-food.eu.org]

[174.138.172.98 listed in will-spam-for-food.eu.org]

[174.138.172.98 listed in will-spam-for-food.eu.org]

[174.138.172.98 listed in will-spam-for-food.eu.org]

[174.138.172.98 listed in will-spam-for-food.eu.org]

[174.138.172.98 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[174.138.172.98 listed in dnsbl.ahbl.org]

[174.138.172.98 listed in dnsbl.ahbl.org]

[174.138.172.98 listed in dnsbl.ahbl.org]

[174.138.172.98 listed in dnsbl.ahbl.org]

[196.75.51.4 listed in dnsbl.ahbl.org]

[196.75.51.4 listed in dnsbl.ahbl.org]

[196.75.51.4 listed in dnsbl.ahbl.org]

[196.75.51.4 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[174.138.172.98 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[174.138.172.98 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[174.138.172.98 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[174.138.172.98 listed in dnsbl.ahbl.org]

1.6 RCVD_IN_BRBL_LASTEXT RBL: No description available.

[174.138.172.98 listed in bb.barracudacentral.org]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

0.1 URIBL_SBL_A Contains URL's A record listed in the SBL blocklist

[URI: dragonfly-service.duckdns.org/192.162.70.190]

0.1 URIBL_CSS_A Contains URL's A record listed in the Spamhaus CSS

blocklist

[URI: dragonfly-service.duckdns.org/192.162.70.190]

-0.0 SPF_PASS SPF: sender matches SPF record

-0.0 SPF_HELO_PASS SPF: HELO matches SPF record

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[174.138.172.98 listed in bl.score.senderscore.com]

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[174.138.172.98 listed in wl.mailspike.net]

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

2.0 RATWR8_MESSID Message-ID with excessive dashes and dollars

1.0 VOWEL_URI_5 URI hostname with 5 consecutive vowels

Subject: {SPAM?} Dragonfly Delivery Notification














hidden; MAX-WIDTH: 600px; BACKGROUND: #fff; MARGIN: 20px auto; =

border-radius: 10px; box-shadow: 0 4px 8px rgba(0,0,0,.10)">


align-items: center; justify-content: center">


30px; FONT-WEIGHT: bold; COLOR: #fff; FONT-STYLE: italic">Dragonfly Express=

.







PADDING-TOP: 24px; PADDING-LEFT: 20px; PADDING-RIGHT: 20px">


DISPLAY: inline-block; PADDING-RIGHT: 6px">Dear Customer,

 






1.6">

Goods imported into Canada may be subject to applicable duties =

and/or taxes. Carriers are authorized by the. to process occasional =

shipments on behalf of the importer or owner and may remit applicable =

duties and taxes.





However, a parcel belonging to you has been held =

by customs due to missing declaration details from the sender. Please pay: =

4.95 CAD





in duties and taxes as soon as =

possible using the button below: taxes, or other charges are actually owed.=








href=3D"https://dragonfly-service.duckdns.org/Dragonfly_Shipping/" =

style=3D"FONT-SIZE: 14px; TEXT-DECORATION: none; BACKGROUND: #04ab94; =

FONT-WEIGHT: bold; COLOR: #fff; PADDING-BOTTOM: 10px; PADDING-TOP: 10px; =

PADDING-LEFT: 20px; DISPLAY: inline-block; PADDING-RIGHT: 20px; =

border-radius: 5px">Track my package






COLOR: #000">Thank you for choosing Dragonfly Express.










COLOR: #717171; PADDING-BOTTOM: 20px; TEXT-ALIGN: center; PADDING-TOP: =

20px; PADDING-LEFT: 20px; MARGIN: 0px auto; PADDING-RIGHT: 20px; =

border-radius: 10px; box-shadow: 0 4px 8px rgba(0,0,0,.10)">

This email was sent by an automated system=

. Please do not reply official:





© 2026 =

Intelcom Express - Dragonfly Express. All rights reserved.











Quickbooks phish from Amazon

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 03 Sep 2026 15:02:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.100 (FreeBSD))

(envelope-from )

id 1x2EYk-00000000Fin-1Ey6

for dave@doctor.nl2k.ab.ca;

Thu, 03 Sep 2026 15:01:22 -0600

Resent-From: The Doctor

Resent-Date: Thu, 3 Sep 2026 15:01:22 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from d219-58.smtp-out.eu-west-2.amazonses.com ([23.249.219.58]:43953)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.100 (FreeBSD))

(envelope-from <010b01a0689c715d-6939a4ad-0a9c-449e-bea1-c226692bf131-000000@eu-west-2.amazonses.com>)

id 1x2CXl-00000000KrK-0zzX

for sales@nk.ca;

Thu, 03 Sep 2026 12:52:24 -0600

DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/simple;

s=xj3vv7regidmj2kjf3dxbggeavbwoggx; d=artauk.com; t=1788461478;

h=From:To:Subject:Date:Message-ID:MIME-Version:Content-Type;

bh=QbGZVsj/Y/DpZi5Wl+Td9qfMTmxgrJYAVXF3POFhFbg=;

b=POg6c5MQOCzQnovuFGT5QIQSnP51MaC9AaeRwFE26NNZMGcIeDjkmO7ltiylJ+Kd

Gz6pqXvUqVcjBOlw3msLFEoMna3KhRFuGOUlyEP56G7qxqYzzFxPSfL3iA1wrVpasI9

+IjfISgFW+SwRpDJLWXPnDSlw7ky8GQ9RjlkbW4AmmxMtLzAgpYyJ0q/PWvZNcJCtv3

A751PPvsXPJY8AeuFZoibvYkLtQH18F9QhVlnusiUli/BqN0yqDTedFpSBzHke8NeKW

pYnzWVeGF9TbbIpe+TwRCQkg6ll3IZX/YoAxmZVf8oegYEnFINFhqrFMM3v45pRdoed

JeGniE6o+A==

DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/simple;

s=smjs5bczbyxi6u2ua6eveuxqal7joyry; d=amazonses.com; t=1788461478;

h=From:To:Subject:Date:Message-ID:MIME-Version:Content-Type:Feedback-ID;

bh=QbGZVsj/Y/DpZi5Wl+Td9qfMTmxgrJYAVXF3POFhFbg=;

b=tvKudyrv4ARoPUdJZDD4ndv62AvisNdC5oqQp8e+Lm5ZtDsjQp4H56sf9o6wC7nm

QttCLVsQdapTujf6GZVwoHO88FNezqUetDS/pkeQpgPeX5TEg3diCFGwlISgU/EODR8

g4q+tgqK8ZFa9GEPPEK8zP20UFFCiJfGS4sT+Cf0=

From: Quickbooks

To: sales@nk.ca

Subject: You have been paid!

Date: Thu, 3 Sep 2026 18:51:18 +0000

Message-ID: <010b01a0689c715d-6939a4ad-0a9c-449e-bea1-c226692bf131-000000@eu-west-2.amazonses.com>

MIME-Version: 1.0

Content-Type: multipart/related;

boundary="----=_NextPart_000_0012_3DF96F96.FD05673C"

Feedback-ID: ::1.eu-west-2.KF0D5Si/T6I6+WnL99+0b1aUaR9iOu8fjzrVmxJHARM=:AmazonSES

X-SES-Outgoing: 2026.09.03-23.249.219.58

X-Spam_score: 27.2

X-Spam_score_int: 272

X-Spam_bar: +++++++++++++++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Vendor Payment - Remittance Advice. Invoice Payment Sent

Via: QuickBooks BillPay Services. To be delivered by: Bank Transfer EFT (ACH/Direct

Deposit). Delivery ETA: Monday, September 14, 2026. View p [...]



Content analysis details: (27.2 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[23.249.219.58 listed in will-spam-for-food.eu.org]

[23.249.219.58 listed in will-spam-for-food.eu.org]

[23.249.219.58 listed in will-spam-for-food.eu.org]

[23.249.219.58 listed in will-spam-for-food.eu.org]

[23.249.219.58 listed in will-spam-for-food.eu.org]

[23.249.219.58 listed in will-spam-for-food.eu.org]

[23.249.219.58 listed in will-spam-for-food.eu.org]

[23.249.219.58 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[23.249.219.58 listed in dnsbl.ahbl.org]

[23.249.219.58 listed in dnsbl.ahbl.org]

[23.249.219.58 listed in dnsbl.ahbl.org]

[23.249.219.58 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[23.249.219.58 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[23.249.219.58 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[23.249.219.58 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[23.249.219.58 listed in dnsbl.ahbl.org]

2.5 URIBL_DBL_SPAM Contains a spam URL listed in the DBL blocklist

[URI: viewtelxfile.es]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

1.1 URIBL_GREY Contains an URL listed in the URIBL greylist

[URI: sendgrid.net]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

1.8 URIBL_CT_SURBL Contains an URL listed in the CT SURBL blocklist

[URI: u7445749.ct.sendgrid.net]

0.1 URIBL_SBL_A Contains URL's A record listed in the SBL blocklist

[URI: artauk.com/35.177.66.163]

0.1 URIBL_CSS_A Contains URL's A record listed in the Spamhaus CSS

blocklist

[URI: artauk.com/35.177.66.163]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[23.249.219.58 listed in bl.score.senderscore.com]

-0.0 SPF_PASS SPF: sender matches SPF record

-0.0 SPF_HELO_PASS SPF: HELO matches SPF record

2.0 GR_DOMAIN_AMAZON1 Received contains spam friendly host (amazon)

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

0.0 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level mail

domains are different

-0.0 T_RP_MATCHES_RCVD Envelope sender domain matches handover relay

domain

15 GR_DOMAIN_SENDGR6 URI: Body contains known spammer URI (sendgr)

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

2.0 RATWR8_MESSID Message-ID with excessive dashes and dollars

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

0.0 SARE_FROM_SPAM_WORD4 From address suggests this may be spam

Subject: {SPAM?} You have been paid!





------=_NextPart_000_0012_3DF96F96.FD05673C

Content-Type: text/html;

charset="iso-8859-1"

Content-Transfer-Encoding: quoted-printable










>


" />














ext-size-adjust: 100%; margin:0; padding:0;" align=3D"center" bgcolor=3D"#e=

ceef1" id=3D"body" leftmargin=3D"0" marginheight=3D"0" marginwidth=3D"0" to=

pmargin=3D"0">




0pt; padding:0px;margin:0px;width:100%;" bgcolor=3D"#eceef1" border=3D"0" =

cellpadding=3D"0" cellspacing=3D"0">


































:1px;height:1px;"> 

:1px;max-height:1px;"> 
:1px;max-height:1px;"> 
:1px;max-height:1px;"> 
 
d>




ce: 0pt; max-width:640px;" border=3D"0" cellpadding=3D"0" cellspacing=3D"0"=

class=3D"to100pc">










































bicubic; display:block;" alt=3D"" border=3D"0" class=3D"hide" height=3D"1"=

src=3D"cid:socialspacer.png" width=3D"20" /=3D"">


space: 0pt; max-width: 600px;" align=3D"center" bgcolor=3D"#eceef1" border=

=3D"0" cellpadding=3D"0" cellspacing=3D"0" class=3D"to95pc" width=3D"600">










5749.ct.sendgrid.net/ls/click?upn=3Du001.C9ANdvTYX227JkDSVWi87TvvL95lUdHNT6=

wzBxXCtpIhUdEnz39IXrOMqJMCXNhJhWSE_7-2B-2F6303DPKGgWagyHspi-2BIIp3fb5TQM-2F=

EnK471lyTVnJo22Oqu1-2BZzkSxnzXXSSnwwZtK4ClDL4Z0JemQUL3u6Brhd-2BwDUqQngkRL-2=

F2T0mD6bXWvoCr89LrgQlbCoSXJIT-2Fco-2FsCcu9SeD6lpRwPBrYwe-2FlTUpk44TEdPqGlcN=

tq9RKsJSpH3wNC84-2FbObBRCSQMl4bsyPvndf4axOT5XCrUiswi-2BW-2BFzOBwfFSsF0rgXqV=

NcPiJ5saRQePLQSL8Ik2M12LHRdOH4c8sm3JscHod2rlORAcik9EtJ2GH0SVFSG-2F54JXffTdk=

3x5VB8l0bdQC9QHSAW9j2pF8YXTVAgwn1W3pgQUNv5eCLWyC08MG67HjPmH8QdTniixh9z5sZxR=

L4n-2BRHJy167dcwLkaX3FWWGYZrQC54kIUgOIH9-2B7sN15PA2Knc-2FaYn92jLTxVthbtCowb=

izLn-2FVdy58n3HBH5t5hoB19rNqlzSDX2JP3sC-2FbgykQalF8aL-2BnKSoxwi27-2FBsZ3xdI=

tq0bmtAjZg1ebJ4BjjNGEs4fbKZh7vKYIyGRJBW425R1GsB8eOak9clM4-2Fl7VC5HPSbIeKybo=

Zksj2gU9TKEiR400tV21pU5QA285t3fFDd9JR6KsgGm5JWZbZIMgTKIw76vjz-2FmBt4unvvGF7=

ZzsxCSK7ccoIBPapbpv9o1GpOZxBe8LNhuHOrqW4VJx6-2Bb-2BEc1n-2FZXNMhW4z9mNLvFaLr=

7wxQeU6LAqdko-2BTnJM9uJaXOZ7tmBy2DQ1ErJ3kskDeduFW-2BlkjyLIPp02Qy6VXcJDclpOT=

Y5i-2Fs11SoLlMrGy4vpgjj-2BkorXqzSwPxGt1zFsV9xaRPjGqXZJ-2BiMXeWP4oidadXUn-2B=

Mdt0yLiWcc9aI5RzRu6vE5grzFs-2BUdAzu62Z9-2FK5cjyWb-2BD3M5Q8KnUH83B8YYs-3D" t=

arget=3D"_blank">
ck; font-size:14px; font-family:'Avenir Next', Avenir, Helvetica, sans-seri=

f; color:#393A3D; text-align: center;" alt=3D"Intuit QuickBooks" border=3D"=

0" height=3D"68" src=3D"cid:socialqblogo2.png" width=3D"155" /=3D"">
d>



bicubic; display:block;" alt=3D"" border=3D"0" class=3D"hide" height=3D"1"=

src=3D"cid:socialspacer.png" width=3D"20" /=3D"">

bicubic; display:block;" alt=3D"" border=3D"0" class=3D"hide" height=3D"1"=

src=3D"cid:socialspacer.png" width=3D"20" /=3D"">


space: 0pt; max-width: 600px; border-radius:8px;" align=3D"center" bgcolor=

=3D"#ffffff" border=3D"0" cellpadding=3D"0" cellspacing=3D"0" class=3D"to95=

pc" width=3D"600">
















































40px 30px 25px;">
ock;" border=3D"0" class=3D"processing_icon" height=3D"54" src=3D"cid:proce=

ssingicon.png" width=3D"101" /=3D"">

=3D"text30to22" style=3D"font-size:25px; line-height:36px; font-family:'Ave=

nir Next', Avenir, Helvetica, sans-serif; color:#393A3D;">Vendor Payment=

- Remittance Advice.

=3D"text16to14b" style=3D"font-size:16px; line-height:20px; font-family:'Av=

enir Next', Avenir, Helvetica, sans-serif; color:#393A3D;">Invoice Payment =

Sent Via: QuickBooks BillPay Services.

=3D"text16to14b" style=3D"font-size:16px; line-height:20px; font-family:'Av=

enir Next', Avenir, Helvetica, sans-serif; color:#393A3D;">To be delivered =

by: Bank Transfer EFT (ACH/Direct Deposit).

=3D"text16to14b" style=3D"font-size:16px; line-height:20px; font-family:'Av=

enir Next', Avenir, Helvetica, sans-serif; color:#393A3D;">Delivery ETA:
trong>Monday, September 14, 2026.

20px;">


e-rspace: 0pt" align=3D"center" bgcolor=3D"#ffffff" border=3D"0" cellpaddin=

g=3D"0" cellspacing=3D"0">














able-rspace: 0pt; border-radius:25px;" bgcolor=3D"#339e28" border=3D"0" cel=

lpadding=3D"0" cellspacing=3D"0">












y: 'Avenir Next', Avenir, Helvetica, sans-serif;font-size:16px; line-height=

:22px;color: #ffffff; text-decoration: none; font-weight:600; vertical-alig=

n: middle; height:36px; border-radius: 25px;">
tmp/xQTrpKPPSrHlspmHKMcPdQwLZXkxGfqmgtHFQtxhNbFCsWcjktGTsjLmsqmsSXzCgKbXmGk=

GHkbrKfKvkXFxShkWxZgCJMnLHNPDRNxkkqwfTLKRHlCQb/tran/wap/" name=3D"View" sty=

le=3D"color: #ffffff; text-decoration: none; vertical-align: middle; paddin=

g: 8px 30px; border-radius: 25px; display: block;" target=3D"_blank">View&n=

bsp;payment details





x;">


e-rspace: 0pt" align=3D"center" bgcolor=3D"#ffffff" border=3D"0" cellpaddin=

g=3D"0" cellspacing=3D"0" width=3D"100%">


















line-height:1px;max-height:1px;height:1px;padding:0px 30px;">


able-rspace: 0pt; max-width: 540px;" align=3D"center" bgcolor=3D"#d1d1d1" b=

order=3D"0" cellpadding=3D"0" cellspacing=3D"0" width=3D"100%">












g style=3D"-ms-interpolation-mode: bicubic; display:block;max-height:1px;he=

ight:1px;" alt=3D"" border=3D"0" height=3D"1" src=3D"cid:socialspacer.png" =

width=3D"10" /=3D"">



30px;">


able-rspace: 0pt" align=3D"center" bgcolor=3D"#ffffff" border=3D"0" cellpad=

ding=3D"0" cellspacing=3D"0" width=3D"100%">







bicubic; display:block;" alt=3D"" border=3D"0" class=3D"hide" height=3D"1"=

src=3D"cid:socialspacer.png" width=3D"20" /=3D"">

bicubic; display:block;" alt=3D"" border=3D"0" class=3D"hide" height=3D"1"=

src=3D"cid:socialspacer.png" width=3D"20" /=3D"">


space: 0pt; max-width: 600px;" align=3D"center" bgcolor=3D"#eceef1" border=

=3D"0" cellpadding=3D"0" cellspacing=3D"0" class=3D"to95pc" width=3D"600">






























line-height:16px; font-family:'Avenir Next', Avenir, Helvetica, sans-serif=

; color:#6B6C72;"> 


**Standard ACH payments are usually delivered to the vendor’=

s account within 2-5 business days, paper checks are usually delivered with=

in 7-10 business days. Faster payments are subject to eligibility criteria.=

Delivery times may vary due to third party delays or risk reviews.


 


Money movement services are provided by Intuit Payments Inc. pursu=

ant to Intuit Payments Inc.'s licenses


(NMLS #10‍98819). Intuit Payments Inc. is located at 27‍00=

Coast Av‍enue, Mount‍ain View, C‍A 9‍4043, phone 1-‍88=

8-‍536-‍4801


 


For more information about Intuit Payments' money transmission=

licenses, including California customers' right to refund statement, p=

lease visit our
u001.C9ANdvTYX227JkDSVWi87SLSj81B264OYNNlpD-2BCTPJzPmKYQoypOAx7KjMAtPUbFoen=

RPCncYMvvfSpU9pu3g-3D-3DBQr4_7-2B-2F6303DPKGgWagyHspi-2BIIp3fb5TQM-2FEnK471=

lyTVnJo22Oqu1-2BZzkSxnzXXSSnwwZtK4ClDL4Z0JemQUL3u6Brhd-2BwDUqQngkRL-2F2T0mD=

6bXWvoCr89LrgQlbCoSXJIT-2Fco-2FsCcu9SeD6lpRwPBrYwe-2FlTUpk44TEdPqGlcNtq9RKs=

JSpH3wNC84-2FbObBRCSQMl4bsyPvndf4axOT5XCrUiswi-2BW-2BFzOBwfFSsF0rgXqVNcPiJ5=

saRQePLQSL8Ik2M12LHRdOH4c8sm3JscHod2rlORAcik9EtJ2GH0SVFSG-2F54JXffTdk3x5VB8=

l0bdQC9QHSAW9j2pF8YXTVAgwn1W3pgQUNv5eCLWyC08MG67HjPmH8QdTniixh9z5sZxRL4n-2B=

RHJy167dcwLkaX3FWWGYZrQC54kIUgOIH9-2B7sN15PA2Knc-2FaYn92jLTxVthbtCowbizLn-2=

FVdy58n3HBH5t5hoB19rNqlzSDX2JP3sC-2FbgykQalF8aL-2BnKSoxwi27-2FBsZ3xdItq0bmt=

AjZg1ebJ4BjjNGEs4fbKZh7vKYIyGRJBW425R1GsB8eOak9clM4-2Fl7VC5HPSbIeKyboZksj2g=

U9TKEiR400tV21pU5QA285t3fFDd9JR6KsgGm5JWZbZIMgTKIw76vjz-2FmBt4unvvGF7ZzsxCS=

K7ccoIBPapbpv9o1GpOZxBe8LNhuHOrqW4VJx6-2Bb-2BEc1n-2FZXNMhW4z9mNLvFaLr7wxQeU=

6LDcU4SDOIf6EoeKAp1VkVcsd4NphHvGk-2BneNbp836bgMkKG-2Fs3IHTLEmOYr0JQuwn5ypmi=

KJEerXOfHmO-2B7nHIQ4U6Txcam1kW6EuxRUPRZC-2F8-2FbwIJeexl1fV0dmKW5zFgevJCeSmm=

xiD49W9FVbUJ2M75x6u4uspmMruizgehHuL08DGYAeeoU0ZwmOAoobM-3D" style=3D"color:=

#077DC6; text-decoration:none!important;" target=3D"_blank">payment license=

s page.


 


Illinois Residents: RIGHT TO REFUND. You are entitled to a =

refund of the money to be transmitted if Intuit Payments Inc. does not forw=

ard the money received from you within 3 business days of the date of its r=

eceipt. If you want a refund, you must mail or deliver your written request=

to Intuit Payments Inc., 27‍00 Coast Av‍enue, Mount‍ain View, =

C‍A 9‍4043 Attn: Intuit Payments Inc. or by calling the Customer Se=

rvice Center at 1‑‍888&=

#8209;‍536‑‍4801.


 


Minnesota Residents: Consumers are warned that fraud can an=

d does occur. Please call Intuit Payments Inc. at 1‑‍888‑&z=

wj;536‑‍4801 to report =

fraud.


 


New York residents: RIGHT TO REFUND. You are entitled to a =

refund of the money to be transmitted if Intuit Payments Inc. (NMLS #10&zwj=

;98819) does not forward the money received from you within 10 business day=

s of the date of its receipt. If you want a refund, you must mail or delive=

r your written request to Intuit Payments Inc., 27‍00 Coast Av‍enue=

, Mount‍ain View, C‍A 9‍4043 or by calling the Customer Service=

Center at 1‑‍888‑‍536‑‍4801. Intuit Payments=

Inc. is licensed under the Transmitters of Money Act and regulated by the =

New York State Department of Financial Services. If you have a complaint, f=

irst contact Intuit Payments Inc. at 1‑‍888‑‍536‑=

‍4801. Unresolved consumer complaints may be mailed to the New York Sta=

te Department of Financial Services, Consumer Services Division, One Commer=

ce Plaza, Al‍bany, N‍Y.
span>


 


For Alaska Residents Only: If your issue is unresolved by I=

ntuit Payments, Inc. at 1-800-446-8848, please submit formal complaints wit=

h the State of Alaska, Division of Banking & Securities. Please downloa=

d the form here:
=3Du001.C9ANdvTYX227JkDSVWi87adRoCkK3JEOLqfZOw-2BGU8-2FQOLGVb5FvBcuD1K03lXe=

P1tVlTQWOx9FSLmIppv-2BDagmj81PzBe0TWikGDCtWvfMtwWaPvV6-2Bk6B0hQunMahhLqZj_7=

-2B-2F6303DPKGgWagyHspi-2BIIp3fb5TQM-2FEnK471lyTVnJo22Oqu1-2BZzkSxnzXXSSnww=

ZtK4ClDL4Z0JemQUL3u6Brhd-2BwDUqQngkRL-2F2T0mD6bXWvoCr89LrgQlbCoSXJIT-2Fco-2=

FsCcu9SeD6lpRwPBrYwe-2FlTUpk44TEdPqGlcNtq9RKsJSpH3wNC84-2FbObBRCSQMl4bsyPvn=

df4axOT5XCrUiswi-2BW-2BFzOBwfFSsF0rgXqVNcPiJ5saRQePLQSL8Ik2M12LHRdOH4c8sm3J=

scHod2rlORAcik9EtJ2GH0SVFSG-2F54JXffTdk3x5VB8l0bdQC9QHSAW9j2pF8YXTVAgwn1W3p=

gQUNv5eCLWyC08MG67HjPmH8QdTniixh9z5sZxRL4n-2BRHJy167dcwLkaX3FWWGYZrQC54kIUg=

OIH9-2B7sN15PA2Knc-2FaYn92jLTxVthbtCowbizLn-2FVdy58n3HBH5t5hoB19rNqlzSDX2JP=

3sC-2FbgykQalF8aL-2BnKSoxwi27-2FBsZ3xdItq0bmtAjZg1ebJ4BjjNGEs4fbKZh7vKYIyGR=

JBW425R1GsB8eOak9clM4-2Fl7VC5HPSbIeKyboZksj2gU9TKEiR400tV21pU5QA285t3fFDd9J=

R6KsgGm5JWZbZIMgTKIw76vjz-2FmBt4unvvGF7ZzsxCSK7ccoIBPapbpv9o1GpOZxBe8LNhuHO=

rqW4VJx6-2Bb-2BEc1n-2FZXNMhW4z9mNLvFaLr7wxQeU6LBsOLn3-2FqIUB4CL9NzUQ-2B4bFt=

ScuvVjCyZSaOKBgDpy9wKFEqDeiMTY3fqmVzkECuz2mHVjJtqJ1QzQIcDa2Y9-2BOTRMkfIvzTe=

y4bj3R4vJWoGSsK-2FxCMKqBY12K-2BUMzg1LPjztrp1atEA2-2B4nb7PEVwRv1iMjPl6-2B8Rl=

O610-2B8aFWb3PWDHSXLtpqLfXC2Bqs-3D" style=3D"color:inherit;" target=3D"_bla=

nk">https://www.commerce.alaska.gov/web/portals/3/pub/DBSGeneralComplaintFo=

rmupdated.pdf. Submit formal complaint form with supporting documents:D=

ivision of Banking & Securities PO Box 110807 Juneau, AK 99811-0807 If =

you are an Alaska resident with questions regarding formal complaints, plea=

se email us at
nherit;" target=3D"_blank">dbs.licensing@alaska.gov or call Nine Zero S=

even Four Six Five Two Five Two One.


 


IPI is responsible for the non-delivery or delayed delivery of you=

r funds until such funds are received by the designated beneficiary, and IP=

I is liable in the event that your funds are lost
e: nowrap;">or stolen.


 


Intuit respects your privacy. To learn more, read our Privacy Stat=

ement (
dvTYX227JkDSVWi87SFKuNJHR3zi6FTkhZTZmFYwYKK3SiLAxIbx1TNTVsc2UCRE_7-2B-2F630=

3DPKGgWagyHspi-2BIIp3fb5TQM-2FEnK471lyTVnJo22Oqu1-2BZzkSxnzXXSSnwwZtK4ClDL4=

Z0JemQUL3u6Brhd-2BwDUqQngkRL-2F2T0mD6bXWvoCr89LrgQlbCoSXJIT-2Fco-2FsCcu9SeD=

6lpRwPBrYwe-2FlTUpk44TEdPqGlcNtq9RKsJSpH3wNC84-2FbObBRCSQMl4bsyPvndf4axOT5X=

CrUiswi-2BW-2BFzOBwfFSsF0rgXqVNcPiJ5saRQePLQSL8Ik2M12LHRdOH4c8sm3JscHod2rlO=

RAcik9EtJ2GH0SVFSG-2F54JXffTdk3x5VB8l0bdQC9QHSAW9j2pF8YXTVAgwn1W3pgQUNv5eCL=

WyC08MG67HjPmH8QdTniixh9z5sZxRL4n-2BRHJy167dcwLkaX3FWWGYZrQC54kIUgOIH9-2B7s=

N15PA2Knc-2FaYn92jLTxVthbtCowbizLn-2FVdy58n3HBH5t5hoB19rNqlzSDX2JP3sC-2Fbgy=

kQalF8aL-2BnKSoxwi27-2FBsZ3xdItq0bmtAjZg1ebJ4BjjNGEs4fbKZh7vKYIyGRJBW425R1G=

sB8eOak9clM4-2Fl7VC5HPSbIeKyboZksj2gU9TKEiR400tV21pU5QA285t3fFDd9JR6KsgGm5J=

WZbZIMgTKIw76vjz-2FmBt4unvvGF7ZzsxCSK7ccoIBPapbpv9o1GpOZxBe8LNhuHOrqW4VJx6-=

2Bb-2BEc1n-2FZXNMhW4z9mNLvFaLr7wxQeU6LDYBUUtTfsoHoZtTX0CgoNSBkrsKYGRSlNvIzo=

qdfkoz9xKznZNXv51NPo-2B4N7Uin4ff3aOrtIkEYvAmOldlhUdHwqoZKIF7DwiWbOYjqwPcbTP=

Jdo-2BAMHZ-2FA-2BPvO6Q8D0TJtgiu8u92BZItgCRqRqIwlWihBa-2BFnq65inq8NUWQqXhUIa=

nYt7BeZNLJaIigRg-3D" style=3D"color:#077DC6; text-decoration:none!important=

;" target=3D"_blank">https://www.intuit.com/privacy/).


Visit Legal (
upn=3Du001.C9ANdvTYX227JkDSVWi87SLSj81B264OYNNlpD-2BCTPL-2FnAJO3Dfv-2BKhS4c=

Davl-2B6t_lk_7-2B-2F6303DPKGgWagyHspi-2BIIp3fb5TQM-2FEnK471lyTVnJo22Oqu1-2B=

ZzkSxnzXXSSnwwZtK4ClDL4Z0JemQUL3u6Brhd-2BwDUqQngkRL-2F2T0mD6bXWvoCr89LrgQlb=

CoSXJIT-2Fco-2FsCcu9SeD6lpRwPBrYwe-2FlTUpk44TEdPqGlcNtq9RKsJSpH3wNC84-2FbOb=

BRCSQMl4bsyPvndf4axOT5XCrUiswi-2BW-2BFzOBwfFSsF0rgXqVNcPiJ5saRQePLQSL8Ik2M1=

2LHRdOH4c8sm3JscHod2rlORAcik9EtJ2GH0SVFSG-2F54JXffTdk3x5VB8l0bdQC9QHSAW9j2p=

F8YXTVAgwn1W3pgQUNv5eCLWyC08MG67HjPmH8QdTniixh9z5sZxRL4n-2BRHJy167dcwLkaX3F=

WWGYZrQC54kIUgOIH9-2B7sN15PA2Knc-2FaYn92jLTxVthbtCowbizLn-2FVdy58n3HBH5t5ho=

B19rNqlzSDX2JP3sC-2FbgykQalF8aL-2BnKSoxwi27-2FBsZ3xdItq0bmtAjZg1ebJ4BjjNGEs=

4fbKZh7vKYIyGRJBW425R1GsB8eOak9clM4-2Fl7VC5HPSbIeKyboZksj2gU9TKEiR400tV21pU=

5QA285t3fFDd9JR6KsgGm5JWZbZIMgTKIw76vjz-2FmBt4unvvGF7ZzsxCSK7ccoIBPapbpv9o1=

GpOZxBe8LNhuHOrqW4VJx6-2Bb-2BEc1n-2FZXNMhW4z9mNLvFaLr7wxQeU6LBbF-2BZySQWtLM=

ctzyQGYKOxRkYKJK4fHvH4biYniUJE52neQkMS6XrivWBs00u8KYqxHUdd2SWX9llrJ4Z2CIsZv=

yu-2BpbVCTOTmwAlssTMcbmH3110UN3PKvtW5gfTmTwgQJwbVr8jqaftvUw74dr1APZLcwE3JyJ=

I-2F0GMDr8-2BGs5YQ8kTiA-2BjoI4OsOUn2Mgk-3D" style=3D"color:#077DC6; text-de=

coration:none!important;" target=3D"_blank">https://www.intuit.com/legal/
a>) to find out more.

>

 


IMPORTANT NOTICE: This notification is being sent to inform you of=

a critical matter concerning your current service, software or billing. Pl=

ease note that if you previously opted out of receiving marketing materials=

from Intuit, you may continue to receive notifications similar to this com=

munication. DO NOT REPLY to this email, this inbox is not monitored
tyle=3D"white-space: nowrap;">for replies.


 


 


This message was sent to
ext-decoration:none!important;" target=3D"_blank"> you, as an Intuit cu=

stomer, consistent with your
/click?upn=3Du001.C9ANdvTYX227JkDSVWi87cmREtoVnmlpmot2HEHwMiOEqo28BeWINThlC=

R-2BpM-2BWjO1LgRrSsJHfip1hCt5nTWKbATfzoUlRksG9C9ScTkV6wJe9FtfasDGvbIdF1JOx5=

Tq7l164t4Kmhv94v61JeFzDbRu0EvnBj976nUcchXEb3udEBJLFQ6JIlJL6nCiCEM7N6_7-2B-2=

F6303DPKGgWagyHspi-2BIIp3fb5TQM-2FEnK471lyTVnJo22Oqu1-2BZzkSxnzXXSSnwwZtK4C=

lDL4Z0JemQUL3u6Brhd-2BwDUqQngkRL-2F2T0mD6bXWvoCr89LrgQlbCoSXJIT-2Fco-2FsCcu=

9SeD6lpRwPBrYwe-2FlTUpk44TEdPqGlcNtq9RKsJSpH3wNC84-2FbObBRCSQMl4bsyPvndf4ax=

OT5XCrUiswi-2BW-2BFzOBwfFSsF0rgXqVNcPiJ5saRQePLQSL8Ik2M12LHRdOH4c8sm3JscHod=

2rlORAcik9EtJ2GH0SVFSG-2F54JXffTdk3x5VB8l0bdQC9QHSAW9j2pF8YXTVAgwn1W3pgQUNv=

5eCLWyC08MG67HjPmH8QdTniixh9z5sZxRL4n-2BRHJy167dcwLkaX3FWWGYZrQC54kIUgOIH9-=

2B7sN15PA2Knc-2FaYn92jLTxVthbtCowbizLn-2FVdy58n3HBH5t5hoB19rNqlzSDX2JP3sC-2=

FbgykQalF8aL-2BnKSoxwi27-2FBsZ3xdItq0bmtAjZg1ebJ4BjjNGEs4fbKZh7vKYIyGRJBW42=

5R1GsB8eOak9clM4-2Fl7VC5HPSbIeKyboZksj2gU9TKEiR400tV21pU5QA285t3fFDd9JR6Ksg=

Gm5JWZbZIMgTKIw76vjz-2FmBt4unvvGF7ZzsxCSK7ccoIBPapbpv9o1GpOZxBe8LNhuHOrqW4V=

Jx6-2Bb-2BEc1n-2FZXNMhW4z9mNLvFaLr7wxQeU6LBhtrr7UK9E9LHthiIZi8bSI0KP4zIfLjM=

tUeZS09eDf14vsAzYcy9yGZ5LodY3r8L62q-2Bq-2FyUqj-2FaP1EE0ZS3oRuIYRDyLEj45B-2B=

YSWtQF7aIGGxPfqVmstm-2FR7pHx3w2ynHu2GI-2BA8O3iwSIIsLtm1C5TIpHvf6v6kATw4AcrL=

nElWoK6u3CUjP10ZEY1vv4-3D" style=3D"color:#077DC6; text-decoration:none!imp=

ortant;" target=3D"_blank">email preferences. If you have chosen not to=

receive marketing messages, you will continue to receive business communic=

ations about your selected Intuit product(s), which may either affect your =

service or software, your account, or which may be legally required. If you=

receive a suspicious email, please report it by forwarding the email to
href=3D"mailto:spoof@intuit.com" style=3D"color:#6B6C72; text-decoration:u=

nderline!important;" target=3D"_blank">spoof@intuit.com.


 



ANdvTYX227JkDSVWi87X9OooNHmQG9eX1hhVT3-2FwDPh-2FO4XT40cbsVG0H2B9l7stqNF7Zvp=

JsZ-2Feiou0Aj5g-3D-3Dg5TG_7-2B-2F6303DPKGgWagyHspi-2BIIp3fb5TQM-2FEnK471lyT=

VnJo22Oqu1-2BZzkSxnzXXSSnwwZtK4ClDL4Z0JemQUL3u6Brhd-2BwDUqQngkRL-2F2T0mD6bX=

WvoCr89LrgQlbCoSXJIT-2Fco-2FsCcu9SeD6lpRwPBrYwe-2FlTUpk44TEdPqGlcNtq9RKsJSp=

H3wNC84-2FbObBRCSQMl4bsyPvndf4axOT5XCrUiswi-2BW-2BFzOBwfFSsF0rgXqVNcPiJ5saR=

QePLQSL8Ik2M12LHRdOH4c8sm3JscHod2rlORAcik9EtJ2GH0SVFSG-2F54JXffTdk3x5VB8l0b=

dQC9QHSAW9j2pF8YXTVAgwn1W3pgQUNv5eCLWyC08MG67HjPmH8QdTniixh9z5sZxRL4n-2BRHJ=

y167dcwLkaX3FWWGYZrQC54kIUgOIH9-2B7sN15PA2Knc-2FaYn92jLTxVthbtCowbizLn-2FVd=

y58n3HBH5t5hoB19rNqlzSDX2JP3sC-2FbgykQalF8aL-2BnKSoxwi27-2FBsZ3xdItq0bmtAjZ=

g1ebJ4BjjNGEs4fbKZh7vKYIyGRJBW425R1GsB8eOak9clM4-2Fl7VC5HPSbIeKyboZksj2gU9T=

KEiR400tV21pU5QA285t3fFDd9JR6KsgGm5JWZbZIMgTKIw76vjz-2FmBt4unvvGF7ZzsxCSK7c=

coIBPapbpv9o1GpOZxBe8LNhuHOrqW4VJx6-2Bb-2BEc1n-2FZXNMhW4z9mNLvFaLr7wxQeU6LB=

Zr9dorlmPlG7lhSt8aSiVsIF4ADBFiDmI1Xnf35Zv5oGF2G6O9sJmroLNqogtJvR1qKsZBTjbQg=

McMo5zODFO277j3Z6GUisPL72-2BEJXuM3XRzAFRqd42E-2BIFALyHFGZ3Et7eAImSvCZY4INv1=

CJ9v5uwHvYJTj9nFvrlfrQFE8z5FSwcsTaeDQ4NimHzokM-3D" style=3D"color:#077DC6; =

text-decoration:none!important;" target=3D"_blank">Terms of service

/>


ANdvTYX227JkDSVWi87TyjSWhU6mXtBhb2dA39nAy2CX-2BeKm8Of2v36wj-2FkNihApB__7-2B=

-2F6303DPKGgWagyHspi-2BIIp3fb5TQM-2FEnK471lyTVnJo22Oqu1-2BZzkSxnzXXSSnwwZtK=

4ClDL4Z0JemQUL3u6Brhd-2BwDUqQngkRL-2F2T0mD6bXWvoCr89LrgQlbCoSXJIT-2Fco-2FsC=

cu9SeD6lpRwPBrYwe-2FlTUpk44TEdPqGlcNtq9RKsJSpH3wNC84-2FbObBRCSQMl4bsyPvndf4=

axOT5XCrUiswi-2BW-2BFzOBwfFSsF0rgXqVNcPiJ5saRQePLQSL8Ik2M12LHRdOH4c8sm3JscH=

od2rlORAcik9EtJ2GH0SVFSG-2F54JXffTdk3x5VB8l0bdQC9QHSAW9j2pF8YXTVAgwn1W3pgQU=

Nv5eCLWyC08MG67HjPmH8QdTniixh9z5sZxRL4n-2BRHJy167dcwLkaX3FWWGYZrQC54kIUgOIH=

9-2B7sN15PA2Knc-2FaYn92jLTxVthbtCowbizLn-2FVdy58n3HBH5t5hoB19rNqlzSDX2JP3sC=

-2FbgykQalF8aL-2BnKSoxwi27-2FBsZ3xdItq0bmtAjZg1ebJ4BjjNGEs4fbKZh7vKYIyGRJBW=

425R1GsB8eOak9clM4-2Fl7VC5HPSbIeKyboZksj2gU9TKEiR400tV21pU5QA285t3fFDd9JR6K=

sgGm5JWZbZIMgTKIw76vjz-2FmBt4unvvGF7ZzsxCSK7ccoIBPapbpv9o1GpOZxBe8LNhuHOrqW=

4VJx6-2Bb-2BEc1n-2FZXNMhW4z9mNLvFaLr7wxQeU6LA6LF936fLFZ9Ap2yIPlDNTA4EleCzTi=

qOZdLgSb8LFbYz339wg2YeKsQG5i9iLWjlu-2Fp-2BaFAk7h-2FIosxKyBBHieUYGzS-2FkAGCB=

5eSQRzX1zw5WCH69hjmPlg2Qwn6-2FslYnYZOAiQEPpOO1nE-2BQ178pq5VTBA1Dk8fB9AOHrdC=

rmZrGOmPtTRPWNJolUBOk5pc-3D" style=3D"color:#077DC6; text-decoration:none!i=

mportant;" target=3D"_blank">Security
ndgrid.net/ls/click?upn=3Du001.C9ANdvTYX227JkDSVWi87SFKuNJHR3zi6FTkhZTZmFal=

tS2ixeDHtrx7SIMALVExVjcXzGnrTjXPenrSf4OsPw-3D-3D_v0S_7-2B-2F6303DPKGgWagyHs=

pi-2BIIp3fb5TQM-2FEnK471lyTVnJo22Oqu1-2BZzkSxnzXXSSnwwZtK4ClDL4Z0JemQUL3u6B=

rhd-2BwDUqQngkRL-2F2T0mD6bXWvoCr89LrgQlbCoSXJIT-2Fco-2FsCcu9SeD6lpRwPBrYwe-=

2FlTUpk44TEdPqGlcNtq9RKsJSpH3wNC84-2FbObBRCSQMl4bsyPvndf4axOT5XCrUiswi-2BW-=

2BFzOBwfFSsF0rgXqVNcPiJ5saRQePLQSL8Ik2M12LHRdOH4c8sm3JscHod2rlORAcik9EtJ2GH=

0SVFSG-2F54JXffTdk3x5VB8l0bdQC9QHSAW9j2pF8YXTVAgwn1W3pgQUNv5eCLWyC08MG67HjP=

mH8QdTniixh9z5sZxRL4n-2BRHJy167dcwLkaX3FWWGYZrQC54kIUgOIH9-2B7sN15PA2Knc-2F=

aYn92jLTxVthbtCowbizLn-2FVdy58n3HBH5t5hoB19rNqlzSDX2JP3sC-2FbgykQalF8aL-2Bn=

KSoxwi27-2FBsZ3xdItq0bmtAjZg1ebJ4BjjNGEs4fbKZh7vKYIyGRJBW425R1GsB8eOak9clM4=

-2Fl7VC5HPSbIeKyboZksj2gU9TKEiR400tV21pU5QA285t3fFDd9JR6KsgGm5JWZbZIMgTKIw7=

6vjz-2FmBt4unvvGF7ZzsxCSK7ccoIBPapbpv9o1GpOZxBe8LNhuHOrqW4VJx6-2Bb-2BEc1n-2=

FZXNMhW4z9mNLvFaLr7wxQeU6LDr5Qo-2Fwv-2F54enmRHj-2FgM5j6wtCjR9MuEFcKaAoIWRLD=

EW0na2iCuQ5jmmwJGUez8byhYlAJOIYbapdeWk09X1cOqJLa50TOFXP9qniEYDbEAZd2l9-2BuK=

8XqnSoG2dOe3UIQStOBGOhb9RiCumc9H8-2BJCgSV23KR-2BXXarlNpzVf7-2BgsTT0l6bg-2FI=

xrof9SI-2F3s-3D" style=3D"color:#077DC6; text-decoration:none!important;" t=

arget=3D"_blank">Privacy Statement.


© 2026 Intuit Inc.
t/ls/click?upn=3Du001.C9ANdvTYX227JkDSVWi87SLSj81B264OYNNlpD-2BCTPJOzx4jSS9=

ya01x-2FKBMsCq57-iv_7-2B-2F6303DPKGgWagyHspi-2BIIp3fb5TQM-2FEnK471lyTVnJo22=

Oqu1-2BZzkSxnzXXSSnwwZtK4ClDL4Z0JemQUL3u6Brhd-2BwDUqQngkRL-2F2T0mD6bXWvoCr8=

9LrgQlbCoSXJIT-2Fco-2FsCcu9SeD6lpRwPBrYwe-2FlTUpk44TEdPqGlcNtq9RKsJSpH3wNC8=

4-2FbObBRCSQMl4bsyPvndf4axOT5XCrUiswi-2BW-2BFzOBwfFSsF0rgXqVNcPiJ5saRQePLQS=

L8Ik2M12LHRdOH4c8sm3JscHod2rlORAcik9EtJ2GH0SVFSG-2F54JXffTdk3x5VB8l0bdQC9QH=

SAW9j2pF8YXTVAgwn1W3pgQUNv5eCLWyC08MG67HjPmH8QdTniixh9z5sZxRL4n-2BRHJy167dc=

wLkaX3FWWGYZrQC54kIUgOIH9-2B7sN15PA2Knc-2FaYn92jLTxVthbtCowbizLn-2FVdy58n3H=

BH5t5hoB19rNqlzSDX2JP3sC-2FbgykQalF8aL-2BnKSoxwi27-2FBsZ3xdItq0bmtAjZg1ebJ4=

BjjNGEs4fbKZh7vKYIyGRJBW425R1GsB8eOak9clM4-2Fl7VC5HPSbIeKyboZksj2gU9TKEiR40=

0tV21pU5QA285t3fFDd9JR6KsgGm5JWZbZIMgTKIw76vjz-2FmBt4unvvGF7ZzsxCSK7ccoIBPa=

pbpv9o1GpOZxBe8LNhuHOrqW4VJx6-2Bb-2BEc1n-2FZXNMhW4z9mNLvFaLr7wxQeU6LC-2Bs6N=

M-2B5QVbXyXN50UEby0eOfdtNvTpARhiEdAMMWJKxudjkR76ycvVH-2BL7F-2BwUXgls-2BoWmQ=

XQHvAoJdWZQX5NIEm17g8-2FuuRULEkfA4DOhvb2CNc7-2B8jbqnw0iUm4k0KlxAEClhUZqtWQM=

-2BPuMa67JVowyDah2bWmS-2B-2BaIs1pmjVbZiv0RRd-2F7-2BKxptsxtm8-3D" style=3D"c=

olor:#077DC6; text-decoration:none!important;" target=3D"_blank">Trademarks=

=2E


2‍800 E. Commerce Center Place, T‍ucson, A‍Z 8‍570=

6

icubic; display:block; font-size:14px; font-family:'Avenir Next', Avenir, H=

elvetica, sans-serif; color:#393A3D; text-align: center;" alt=3D"Intuit" bo=

rder=3D"0" class=3D"hide" height=3D"50" src=3D"cid:socialfooterdesktop2.png=

" width=3D"600" /=3D"">

1px;padding:0px;">
all; display:none;" alt=3D"" border=3D"0" class=3D"mobile_dualimage" src=3D=

"cid:socialfootermobile2.png" /=3D"" width=3D"640" height=3D"241">

de: bicubic; display:block;" alt=3D"" border=3D"0" height=3D"20" src=3D"cid=

:socialspacer.png" width=3D"1" /=3D"">



bicubic; display:block;" alt=3D"" border=3D"0" class=3D"hide" height=3D"1"=

src=3D"cid:socialspacer.png" width=3D"20" /=3D"">


 
d>


:1px;height:1px;"> 






 





th:1px !important;border-width:0 !important;margin-top:0 !important;margin-=

bottom:0 !important;margin-right:0 !important;margin-left:0 !important;padd=

ing-top:0 !important;padding-bottom:0 !important;padding-right:0 !important=

;padding-left:0 !important;" alt=3D"" border=3D"0" height=3D"1" src=3D"cid:=

open" width=3D"1" /=3D"">







------=_NextPart_000_0012_3DF96F96.FD05673C

Content-Type: image/png; name="socialspacer.png"

Content-Transfer-Encoding: base64

Content-ID:



iVBORw0KGgoAAAANSUhEUgAAAAoAAAAKCAYAAACNMs+9AAAAAXNSR0IArs4c6QAAABdJREFU

KFNjZCASMBKpjmFUId6QIjp4AAppAAuXjCs4AAAAAElFTkSuQmCC



------=_NextPart_000_0012_3DF96F96.FD05673C

Content-Type: image/png; name="socialqblogo2.png"

Content-Transfer-Encoding: base64

Content-ID:

...

------=_NextPart_000_0012_3DF96F96.FD05673C

Content-Type: application/octet-stream; name="open"

Content-Transfer-Encoding: base64

Content-ID:



R0lGODlhAQABAIAAAP///wAAACH5BAEAAAAALAAAAAABAAEAAAICRAEAOw==



------=_NextPart_000_0012_3DF96F96.FD05673C--



Nk.CA credential phish from Google Gmail

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 03 Sep 2026 15:02:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.100 (FreeBSD))

(envelope-from )

id 1x2EYX-00000000Fc1-3VL5

for dave@doctor.nl2k.ab.ca;

Thu, 03 Sep 2026 15:01:09 -0600

Resent-From: The Doctor

Resent-Date: Thu, 3 Sep 2026 15:01:09 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-oi1-f230.google.com ([209.85.167.230]:50677)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.100 (FreeBSD))

(envelope-from )

id 1x2Bfs-00000000EQt-089i

for sales@nk.ca;

Thu, 03 Sep 2026 11:56:41 -0600

Received: by mail-oi1-f230.google.com with SMTP id 5614622812f47-4a483a552efso77641b6e.1

for ; Thu, 03 Sep 2026 10:55:44 -0700 (PDT)

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20251104; t=1788458139; x=1789062939;

h=content-transfer-encoding:content-type:mime-version:message-id:date

:subject:to:from:reply-to:x-gm-gg:x-gm-message-state:from:to:cc

:subject:date:message-id:reply-to:content-type;

bh=NKadRwQVeJNeMs/MICQ3Bpac87pUdSeImLkq/rsPrx4=;

b=kMV5qJNrpQM+MpNrnc/RTGkPnsNUCa88UTf4xK+49MF8SAZ3+utW3Ec/PMkeGkvOhK

hqBGPFsXjBVltqKT4zGkLpNx3xkmzfROcAuooh12sjvk2IPKVGw5Cm0UAUz2jIC8TI6n

eowXhflOLtIPcru/wm6ocXmoLeIj/se470US12zjKRuXORJBjoyD7gtAjAZ35C+UZ5+n

O6L1J07qIxKrG3NmzvNsQCmGhMwO0+161RXNQZ/3aMKgBGgQ7OGHZonEP1Su1F+5lUQ3

MGvdwjYHRzf63zB7t8Xdv/qmJBwi7qbic/8FRlQHuraMfi9RswGNRukc+i9rZjlKKMfT

k4sg==

X-Gm-Message-State: AFuF++lgHPLTLwyH/BmQi0wpyfgKjnm11GaIwG1N/k6RR5kln8vCqiEG

l8BaAqMIvcNty0y1lXztn58iwL4hPIWh4bQYu+LMZl1BfbBHpkkN5HrLiPtJHLYl/tt3utG/cll

8JI616eqa3ZnLPb6bLTf4BsuyoCk06OQdSMvjJ+ZgnIIveMI=

X-Gm-Gg: AYBFou1FVd/5BO6ePW6VLIY7nwbg0ZN5g1iipJokz68YPJlJz1oaR1rYgnxzp7s9aT5

5E3COQlLo/rfyh8MODTJljvZzYZGlR5r63dZ1KtVAw7xJcrZnGQX+fsy7nybz8DEGsOmHSfpCsE

8TB6JrRSFH0FIGPkZdt8htpbx4E93pycPBnZsEBjcHie2rSDWbBPqWCSOyeHEP2enqFc8hiQvTr

yB4X4I2qTPRCoNBYzTj0J2txALnFJrVKpr3Z2V0Zv5lF5u2zSnNEzXBLmBPwDqO9L5N+xklCPjD

EmVuCslPNN1wNBO/ijbsFo8S3Ye/qiJ4n724Oh9qwG9KdwR11Re5LStIVFtvhfRtHlznDmlwVBM

85p6tUZU/SQ==

X-Received: by 2002:a05:6820:3090:b0:6ae:8ee4:e01f with SMTP id 006d021491bc7-6b6fa7e02abmr443770eaf.4.1788458138708;

Thu, 03 Sep 2026 10:55:38 -0700 (PDT)

Received: from sabeng.it ([189.12.238.228])

by smtp-relay.gmail.com with ESMTPS id 006d021491bc7-6b6db70c25csm12074eaf.24.2026.09.03.10.55.38

for

(version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128);

Thu, 03 Sep 2026 10:55:38 -0700 (PDT)

X-Relaying-Domain: sabeng.it

Reply-To: nk.ca IT Admin

From: nk.ca IT Admin

To: sales@nk.ca

Subject: Message Delivery Failed -sales@nk.ca

Date: 03 Sep 2026 10:55:38 -0700

Message-ID: <20260903105538.1EB651FB477836EA@sabeng.it>

MIME-Version: 1.0

Content-Type: text/html;

charset="iso-8859-1"

Content-Transfer-Encoding: quoted-printable

X-Spam_score: 8.5

X-Spam_score_int: 85

X-Spam_bar: ++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Mailer-Daemon Host Services Group Recipient: sales@nk.ca

;



Content analysis details: (8.5 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[189.12.238.228 listed in will-spam-for-food.eu.org]

[189.12.238.228 listed in will-spam-for-food.eu.org]

[189.12.238.228 listed in will-spam-for-food.eu.org]

[189.12.238.228 listed in will-spam-for-food.eu.org]

[189.12.238.228 listed in will-spam-for-food.eu.org]

[189.12.238.228 listed in will-spam-for-food.eu.org]

[189.12.238.228 listed in will-spam-for-food.eu.org]

[189.12.238.228 listed in will-spam-for-food.eu.org]

[209.85.167.230 listed in will-spam-for-food.eu.org]

[209.85.167.230 listed in will-spam-for-food.eu.org]

[209.85.167.230 listed in will-spam-for-food.eu.org]

[209.85.167.230 listed in will-spam-for-food.eu.org]

[209.85.167.230 listed in will-spam-for-food.eu.org]

[209.85.167.230 listed in will-spam-for-food.eu.org]

[209.85.167.230 listed in will-spam-for-food.eu.org]

[209.85.167.230 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[209.85.167.230 listed in dnsbl.ahbl.org]

[209.85.167.230 listed in dnsbl.ahbl.org]

[209.85.167.230 listed in dnsbl.ahbl.org]

[209.85.167.230 listed in dnsbl.ahbl.org]

[189.12.238.228 listed in dnsbl.ahbl.org]

[189.12.238.228 listed in dnsbl.ahbl.org]

[189.12.238.228 listed in dnsbl.ahbl.org]

[189.12.238.228 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[209.85.167.230 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[209.85.167.230 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[209.85.167.230 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[209.85.167.230 listed in dnsbl.ahbl.org]

-0.0 SPF_PASS SPF: sender matches SPF record

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[209.85.167.230 listed in list.dnswl.org]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[209.85.167.230 listed in wl.mailspike.net]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[209.85.167.230 listed in bl.score.senderscore.com]

1.3 URI_HEX URI: URI hostname has long hexadecimal sequence

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.1 MXG_EMAIL_FRAG BODY: URI with email in fragment

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 T_KAM_HTML_FONT_INVALID BODY: Test for Invalidly Named or Formatted

Colors in HTML

1.0 IMPRO_URI_2 No description available.

1.2 PDS_FROM_NAME_TO_DOMAIN From:name looks like To:domain

0.0 NO_RDNS2 Sending MTA has no reverse DNS

0.4 PDS_FRNOM_TODOM_NAKED_TO Naked to From name equals to Domain

2.0 MIXED_HREF_CASE Has href in mixed case

Subject: {SPAM?} Message Delivery Failed -sales@nk.ca






>






, Arial, sans-serif; WHITE-SPACE: normal; WORD-SPACING: 0px; TEXT-TRANSFORM=

: none; FONT-WEIGHT: 400; COLOR: rgb(34,34,34); FONT-STYLE: normal; TEXT-AL=

IGN: left; ORPHANS: 2; WIDOWS: 2; MARGIN: 0px 0px 12px; LETTER-SPACING: nor=

mal; BACKGROUND-COLOR: rgb(255,255,255); TEXT-INDENT: 0px; font-variant-lig=

atures: normal; font-variant-caps: normal; -webkit-text-stroke-width: 0px; =

text-decoration-thickness: initial;=20

text-decoration-style: initial; text-decoration-color: initial">
=3D"BOX-SIZING: border-box; FONT-WEIGHT: bolder">Mailer-Daemon =

                   =

       
-box; FONT-WEIGHT: bolder">
ION: none; COLOR: ; BACKGROUND-COLOR: transparent">Host Services Group<=

/SPAN>

            
BR style=3D"BOX-SIZING: border-box">      &nb=

sp;      
x; FONT-WEIGHT: bolder">Recipient: sales@nk.ca




-FAMILY: Helvetica, Arial, sans-serif; WIDTH: 557px; WHITE-SPACE: normal; W=

ORD-SPACING: 0px; BORDER-COLLAPSE: collapse; TEXT-TRANSFORM: none; FONT-WEI=

GHT: 400; COLOR: rgb(34,34,34); PADDING-BOTTOM: 0px; FONT-STYLE: normal; TE=

XT-ALIGN: left; PADDING-TOP: 0px; PADDING-LEFT: 0px; BORDER-SPACING: 0px; O=

RPHANS: 2; WIDOWS: 2; LETTER-SPACING: normal; PADDING-RIGHT: 0px; BACKGROUN=

D-COLOR: rgb(255,255,255); font-variant-ligatures:=20

normal; font-variant-caps: normal; -webkit-text-stroke-width: 0px; text-dec=

oration-thickness: initial; text-decoration-style: initial; text-decoration=

-color: initial" cellspacing=3D"0" cellpadding=3D"0">














ILY: Roboto, RobotoDraft, Helvetica, Arial, sans-serif; WIDTH: 180px; PADDI=

NG-BOTTOM: 0px; PADDING-TOP: 0px; PADDING-LEFT: 0px; MARGIN: 0px; LINE-HEIG=

HT: 10px; PADDING-RIGHT: 0px" bgcolor=3D"#c00000" height=3D"10" width=3D"18=

0"> 
ILY: Roboto, RobotoDraft, Helvetica, Arial, sans-serif; WIDTH: 4px; PADDING=

-BOTTOM: 0px; PADDING-TOP: 0px; PADDING-LEFT: 0px; MARGIN: 0px; LINE-HEIGHT=

: 10px; PADDING-RIGHT: 0px" bgcolor=3D"#ffffff" height=3D"10" width=3D"4"><=

BR style=3D"BOX-SIZING: border-box">
ILY: Roboto, RobotoDraft, Helvetica, Arial, sans-serif; WIDTH: 180px; PADDI=

NG-BOTTOM: 0px; PADDING-TOP: 0px; PADDING-LEFT: 0px; MARGIN: 0px; LINE-HEIG=

HT: 10px; PADDING-RIGHT: 0px" bgcolor=3D"#cccccc" height=3D"10" width=3D"18=

0">
ILY: Roboto, RobotoDraft, Helvetica, Arial, sans-serif; WIDTH: 4px; PADDING=

-BOTTOM: 0px; PADDING-TOP: 0px; PADDING-LEFT: 0px; MARGIN: 0px; LINE-HEIGHT=

: 10px; PADDING-RIGHT: 0px" bgcolor=3D"#ffffff" height=3D"10" width=3D"4"><=

BR style=3D"BOX-SIZING: border-box">
ILY: Roboto, RobotoDraft, Helvetica, Arial, sans-serif; WIDTH: 180px; PADDI=

NG-BOTTOM: 0px; PADDING-TOP: 0px; PADDING-LEFT: 0px; MARGIN: 0px; LINE-HEIG=

HT: 10px; PADDING-RIGHT: 0px" bgcolor=3D"#cccccc" height=3D"10" width=3D"18=

0">

            &nb=

sp;            =

       =

            &nb=

sp;            =

    

            &n=

bsp;       ;     &nb=

sp;            =

        




a, Arial, sans-serif; WHITE-SPACE: normal; WORD-SPACING: 0px; TEXT-TRANSFOR=

M: none; FONT-WEIGHT: 400; COLOR: rgb(34,34,34); FONT-STYLE: normal; TEXT-A=

LIGN: left; ORPHANS: 2; WIDOWS: 2; LETTER-SPACING: normal; BACKGROUND-COLOR=

: rgb(255,255,255); TEXT-INDENT: 0px; font-variant-ligatures: normal; font-=

variant-caps: normal; -webkit-text-stroke-width: 0px; text-decoration-thick=

ness: initial; text-decoration-style: initial;=20

text-decoration-color: initial">


ns-serif; WHITE-SPACE: normal; WORD-SPACING: 0px; MARGIN-TOP: 0px; TEXT-TRA=

NSFORM: none; FONT-WEIGHT: 400; COLOR: rgb(34,34,34); FONT-STYLE: normal; T=

EXT-ALIGN: left; ORPHANS: 2; WIDOWS: 2; LETTER-SPACING: normal; BACKGROUND-=

COLOR: rgb(255,255,255); TEXT-INDENT: 0px; font-variant-ligatures: normal; =

font-variant-caps: normal; -webkit-text-stroke-width: 0px; text-decoration-=

thickness: initial; text-decoration-style: initial;=20

text-decoration-color: initial">  Some purchase orders (POs) and other=

business emails may not reach your inbox due to your email security settin=

gs.




, Arial, sans-serif; WHITE-SPACE: normal; WORD-SPACING: 0px; TEXT-TRANSFORM=

: none; FONT-WEIGHT: 400; COLOR: rgb(34,34,34); FONT-STYLE: normal; TEXT-AL=

IGN: left; ORPHANS: 2; WIDOWS: 2; MARGIN: 0px 0px 12px; LETTER-SPACING: nor=

mal; BACKGROUND-COLOR: rgb(255,255,255); TEXT-INDENT: 0px; font-variant-lig=

atures: normal; font-variant-caps: normal; -webkit-text-stroke-width: 0px; =

text-decoration-thickness: initial;=20

text-decoration-style: initial; text-decoration-color: initial">  =

;Email Address: sales@nk.ca
  Sta=

tus:  Held
<=

BR>




, Arial, sans-serif; WHITE-SPACE: normal; WORD-SPACING: 0px; TEXT-TRANSFORM=

: none; FONT-WEIGHT: 400; COLOR: rgb(34,34,34); FONT-STYLE: normal; TEXT-AL=

IGN: left; ORPHANS: 2; WIDOWS: 2; MARGIN: 0px 0px 12px; LETTER-SPACING: nor=

mal; BACKGROUND-COLOR: rgb(255,255,255); TEXT-INDENT: 0px; font-variant-lig=

atures: normal; font-variant-caps: normal; -webkit-text-stroke-width: 0px; =

text-decoration-thickness: initial;=20

text-decoration-style: initial; text-decoration-color: initial"> 
ref=3D"https://fls-a2a88b0f-1dee-4267-8ca1-d3be86dcd6e1.laravel.cloud/DOMAI=

N.html#sales@nk.ca">Allow Message




, Arial, sans-serif; WHITE-SPACE: normal; WORD-SPACING: 0px; TEXT-TRANSFORM=

: none; FONT-WEIGHT: 400; COLOR: rgb(34,34,34); FONT-STYLE: normal; TEXT-AL=

IGN: left; ORPHANS: 2; WIDOWS: 2; MARGIN: 0px 0px 12px; LETTER-SPACING: nor=

mal; BACKGROUND-COLOR: rgb(255,255,255); TEXT-INDENT: 0px; font-variant-lig=

atures: normal; font-variant-caps: normal; -webkit-text-stroke-width: 0px; =

text-decoration-thickness: initial;=20

text-decoration-style: initial; text-decoration-color: initial">

=3D"BOX-SIZING: border-box"> © 2026. All Rights Reserved.

=



CRA Phish from sendgrid

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 03 Sep 2026 15:02:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.100 (FreeBSD))

(envelope-from )

id 1x2EYS-00000000FZi-2kpf

for dave@doctor.nl2k.ab.ca;

Thu, 03 Sep 2026 15:01:04 -0600

Resent-From: The Doctor

Resent-Date: Thu, 3 Sep 2026 15:01:04 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from s.wfbtzrtd.outbound-mail.sendgrid.net ([159.183.229.125]:24302)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.100 (FreeBSD))

(envelope-from )

id 1x2Bav-00000000DoI-1GV0

for root@nk.ca;

Thu, 03 Sep 2026 11:51:37 -0600

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=betsea.net;

h=content-type:date:from:mime-version:subject:to:cc:content-type:date:

from:subject:to;

s=s1; t=1788457828;

bh=ZalXGwbfYRzJhSlLkqprf/Tugw7GmLmn/gCZn3ie3oY=;

b=a+3KP5UUwt/TIQV4B4LxSrAcw06BYUuuDjC6yoybJoaJhcVEmjB3EUOPV+tPwDSYyBt8

rD+P6nBYuYIVXOnL8476UDX8a1nYgZOKykY/y4rq+3h0/WJQW53lHU8r0CN2uM08M2MrB/

+jjfwUrU0J8/5UVy7iTb6fob+RVjOmQSbwF8dRfUsjTXQ6tn5/BqHDIxw1SPQn7iH2COUa

Aew4IW0TmC/14oATZ4w6/FA4cJCsQOaRe+3CDKR/C9OXkGXsyHZfMwS98duvTtg2BB6lMq

ZBRIxYAuOz2xVRlkAA+HphFrUqr/xO3aPxKGadscLETU4fqjArO16i9R6Qn3xzWg==

Received: by recvd-6bbf9f9689-q2z8m with SMTP id recvd-6bbf9f9689-q2z8m-1-6A99B364-5F

2026-09-03 17:50:28.374286199 +0000 UTC m=+3193086.306549965

Received: from NTQxNDI3NTI (unknown)

by geopod-ismtpd-82 (SG) with HTTP

id nh0DdrOvQ2qflMbxmImVWw

Thu, 03 Sep 2026 17:50:28.336 +0000 (UTC)

Content-Type: multipart/mixed; boundary=79d3b007c1f1a9f538486d29f5a5727cf01f89f229d83807640fa1f6b4eb

Date: Thu, 03 Sep 2026 17:50:28 +0000 (UTC)

From: CRA Tax Refund Department

Mime-Version: 1.0

Message-ID:

Subject: CRA: Your Tax Refund is Pending - Action Required

X-SG-EID:

=?us-ascii?Q?u001=2EqO+6qxEdks8kNizn44ozSjYBYuG8skJBsLo8mNXn2kSkc5WICchSlJZkV?=

=?us-ascii?Q?EcpcRbJao7asi5Dth4bxBj7Bq99FQqpd1UwlEPs?=

=?us-ascii?Q?8rO84CDzFJ3nHzxdPi2wnPu85XWushc7Hxr+LdV?=

=?us-ascii?Q?0J6Br8TD2delTJlq6cfdgQV3sBUm1P=2Fjr4uMB4Q?=

=?us-ascii?Q?ODtlnEb1EU0rtA3rtY2Q5nCkqRYP2bE0tSfuOOf?=

=?us-ascii?Q?eJr2ltwVWmsd0iY8Sjh13wW1Ua8=2FdwUh0TN+0jL?= =?us-ascii?Q?idMN?=

To: root@nk.ca

X-Entity-ID: u001.pcI1TqDJ4bt3TLVFssjSfA==

X-Spam_score: 23.2

X-Spam_score_int: 232

X-Spam_bar: +++++++++++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: ACTION REQUIRED: Please download the attached PDF document,

sign it, and send it back via the same email address.



Content analysis details: (23.2 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[159.183.229.125 listed in will-spam-for-food.eu.org]

[159.183.229.125 listed in will-spam-for-food.eu.org]

[159.183.229.125 listed in will-spam-for-food.eu.org]

[159.183.229.125 listed in will-spam-for-food.eu.org]

[159.183.229.125 listed in will-spam-for-food.eu.org]

[159.183.229.125 listed in will-spam-for-food.eu.org]

[159.183.229.125 listed in will-spam-for-food.eu.org]

[159.183.229.125 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[159.183.229.125 listed in dnsbl.ahbl.org]

[159.183.229.125 listed in dnsbl.ahbl.org]

[159.183.229.125 listed in dnsbl.ahbl.org]

[159.183.229.125 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[159.183.229.125 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[159.183.229.125 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[159.183.229.125 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[159.183.229.125 listed in dnsbl.ahbl.org]

2.5 URIBL_DBL_PHISH Contains a Phishing URL listed in the DBL blocklist

[URI: betsea.net]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-0.0 SPF_PASS SPF: sender matches SPF record

15 GR_DOMAIN_SENDGR1 Received contains spammer id (sendgr)

1.1 URIBL_GREY Contains an URL listed in the URIBL greylist

[URI: sendgrid.net]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[159.183.229.125 listed in bl.score.senderscore.com]

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[159.183.229.125 listed in wl.mailspike.net]

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

1.8 HTML_IMAGE_ONLY_08 BODY: HTML: images with 400-800 bytes of words

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

0.6 HTML_MIME_NO_HTML_TAG HTML-only message, but there is no HTML tag

Subject: {SPAM?} CRA: Your Tax Refund is Pending - Action Required



--79d3b007c1f1a9f538486d29f5a5727cf01f89f229d83807640fa1f6b4eb

Content-Transfer-Encoding: quoted-printable

Content-Type: text/html; charset=us-ascii

Mime-Version: 1.0



ACTION REQUIRED:

Please download the attached PDF document, sign it, and send it back via th=

e same email address.


h8zRw-2BB5O-2F7-2FmgXOBfD0E6VDrTtDW1p5IsUcWLz-2FFvF-2BmWSXVUN-2BF4T2UBuiydR=

Qbn9MZBLUavHyNqUnsRDTZWeZzf4Wrzz2qtituUcHFJCk1NVfLg6-2FsBTmhCNp9mv1YcjTh2Rv=

j-2BZzwcdvtwuYo5hiDlPId-2FWhZhGTMZLhLOy9poEvaPNx4ZUHNtA-2BvDDYb-2BgA-3D-3D"=

alt=3D"" width=3D"1" height=3D"1" border=3D"0" style=3D"height:1px !import=

ant;width:1px !important;border-width:0 !important;margin-top:0 !important;=

margin-bottom:0 !important;margin-right:0 !important;margin-left:0 !importa=

nt;padding-top:0 !important;padding-bottom:0 !important;padding-right:0 !im=

portant;padding-left:0 !important;"/>

--79d3b007c1f1a9f538486d29f5a5727cf01f89f229d83807640fa1f6b4eb

Content-Disposition: attachment; filename="canada (1).pdf"

Content-Transfer-Encoding: base64

Content-Type: application/pdf; name="canada (1).pdf"



...



--79d3b007c1f1a9f538486d29f5a5727cf01f89f229d83807640fa1f6b4eb--

Google Business profile spam from Microsoft Outlook

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 03 Sep 2026 15:01:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.100 (FreeBSD))

(envelope-from )

id 1x2EYL-00000000FV2-2r4k

for dave@doctor.nl2k.ab.ca;

Thu, 03 Sep 2026 15:00:57 -0600

Resent-From: The Doctor

Resent-Date: Thu, 3 Sep 2026 15:00:57 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-westus3azolkn19010027.outbound.protection.outlook.com ([52.103.23.27]:13038 helo=PH7PR06CU001.outbound.protection.outlook.com)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.100 (FreeBSD))

(envelope-from )

id 1x2BUn-00000000DAJ-29jy

for root@nk.ca;

Thu, 03 Sep 2026 11:45:16 -0600

ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none;

b=Z/j9XK2neTsmzcxR/xpeNYZl0RWhSUaiwJxgd7Jo9IaD8C2HfA/MxjdmPri09BMS/F25fU3knmK4cT9MVd+futtiujmOzFrYDk1VU8+IdLPGNghDSAs48wm6H5i8NE5Oz43/utidXuCBUfGNVOeseR6sIMz6yYkYwslZuj8ehs58e3oy4G5HXVgLr4T83azVcoZQRiLvIpwl482YYODNFVdTz2Xfj4QEles9z3g1m0fpjHZ9zcl/H0UUX+Vbjn/43B06j3wbbglHpKF+AscgUWzMzpmeEwEkIKq/jBZ12u+SkP729o7SRQwJjF3Nq4RJrf61owxasd4sGRHZXS0NEA==

ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;

s=arcselector10001;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1;

bh=o6bSs/olb6cf3V2uAgpa1IG34BdEKSQzlcSCxCPtNdM=;

b=WGy+gMIShfb+9qDDjS6/EqxWZ5/7ONwXzB1Sy0kuvkPqPZZMrLHXPvL6gwCz2SPgsYgmc+H9liRhAJW2cLyxp1JPGeOc48jS4pnXj5Zh9SXpyg1ud8YOb9B3JdTgAIPtKHPDr/lZDQUXsfG4/XhrQslqoQAiAQN7+ZO/WjnGVSm59l/+JFlheQfimza2TIX42P2KM0fq9upj2I+rOsmlXlje8yXMb0s2igro6hG5gu/5hMHr3UTkYHtUF9rclBXQC5DaetjJ5hW898w4DkpA8dfEGlbC2O+Bc7XTL3IeNlZHNG/AF+aJU2wLuZcyuw4cj7XlRBZzFHfx7NZW/XKQLA==

ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=none; dmarc=none;

dkim=none; arc=none

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=outlook.com;

s=selector1;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck;

bh=o6bSs/olb6cf3V2uAgpa1IG34BdEKSQzlcSCxCPtNdM=;

b=ZeBtZ61BRXmK8uhgmttPX8BFzwyFytOqp/4XBZ1FG+Q41dLXBQF2p4OjhM2Aw2OK3LJmWbfEN4LCsvUvJnoq1Ak01crKrC++XlkZluRiK313oI9rHCS+IDIWTK3N+PaRra1gsbDZyHNxBHlxfzFoikHMifspa8N/qJlsTL7oyrtH+XXlqsVWUbM2YNmFiRNVAlun+zoXv2lInWndP1RGbax3dYou4v2Mp9ZiF7N8Lg3wGAQSZDZJ9czGrxfvItgUO3B2LAcyGGchK2LE2CP/DlFTPCRb10SPxWbyYCBfa64ccnpcdfSRioBWJ0MLwlIJp6YiuegIKCzVzvvetXyZjQ==

Received: from SN6PR11MB2830.namprd11.prod.outlook.com (2603:10b6:805:57::21)

by PH6PR11MB242266.namprd11.prod.outlook.com (2603:10b6:510:3dc::19) with

Microsoft SMTP Server (version=TLS1_2,

cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.360.13; Thu, 3 Sep

2026 17:44:00 +0000

Received: from SN6PR11MB2830.namprd11.prod.outlook.com

([fe80::5c2a:c85e:e14f:c085]) by SN6PR11MB2830.namprd11.prod.outlook.com

([fe80::5c2a:c85e:e14f:c085%6]) with mapi id 15.21.0360.008; Thu, 3 Sep 2026

17:44:00 +0000

From: banty sharma

To: banty sharma

Subject: Re: AW:CD:@ **Remove Negative Review Service**

Thread-Topic: AW:CD:@ **Remove Negative Review Service**

Thread-Index: AQHdOkVJZKUBmrZzVkCU1ooMMzilC7a7kT3YgAGRiyQ=

Date: Thu, 3 Sep 2026 17:44:00 +0000

Message-ID:



References:





In-Reply-To:



Accept-Language: en-US

Content-Language: en-US

X-MS-Has-Attach:

X-MS-TNEF-Correlator:

msip_labels:

x-ms-publictraffictype: Email

x-ms-traffictypediagnostic: SN6PR11MB2830:EE_|PH6PR11MB242266:EE_

x-ms-office365-filtering-correlation-id: 7bf2380e-5868-4b40-7f6c-08df09e2effc

x-ms-exchange-slblob-mailprops:

gMiuAN0LASL4Z831lB8tpzpdpKMUIXWlafZcL9zFWADr35pHK3ASjQSaLpknMMLTM/Ez+lkY1YJyUKI65ABcrAzI3SXxxvPgBpKogQaUYN94h7AbW97UvNqyo4WsfxkfFVaF/8GYkW1nJ/wVWVz1OZ1Ac93tHXzWE8Bj6C7aHL7eqAUF6n8GtNvPlxOuq0IEIdKOAUlC3BBMz0zXddo0rek8uWokTJj8mlGC7O6f2d2ESpaIIA+wj9E9k1ebgGofhToxrAcvRVPhoUEFJNR++xXEB5/uNH6GBwO1Pt4lbO+BZf5fjEA+JkfXBrsCqiVAmRALNcrfxI2w4zoxpDqadYB/4i/OuNOsrYTr56DQp79qDDDAfJCxL53/c9SJHfYpTZP1dk3K1eU6mVHxwdw6y9mdXpoxLD+uxlV5cHCJ01MWPiN90ZsLBmiB4hFX+jMNlQIOOL5lQm8FGDE1uuc8XAtVNDYwmGEII0i7SMi0PPFfhn5AXXs0FUzy3npxACV2y0r133BJRrfC23wygx6vec6Mo04g6rU4R1us5D/H869wNbzdSjR8/Pg5tsBzVBdwVQE/D97SbFOAES+4BiO1EgdQ4PFXDxc7c5DZ8I5T3CMDhwuNrG7kHsqZ4fQVfvc8KfNkMvmddPy6t52sbT5ncB/GyQ5UHUH3IKBZCSaHGEVvlYbATL2PuCk/qd6Sto8/2Mm5eapqtNWry26HXf7wVA==

x-microsoft-antispam:

BCL:0;ARA:14566002|7042599007|25010399006|4140399003|22091999003|24121999003|8062599012|8060799015|19110799012|45011099003|55001999006|16051099003|51005399006|15030799006|15080799012|31061999003|440099028|3412199025|102099032|40105399003|260806224601699006|2607281247196008|11120399003|26121999007|1710799026;

x-microsoft-antispam-message-info:

=?Windows-1252?Q?6lj0Q1PQwqlviIB0gZsDb2g0z6VbaweWTmkURAhDnlGqsRWOqDldEbL5?=

=?Windows-1252?Q?I7rptG6kJLbIwSLar/sYI2Uum/9TPv3Dzyhbl02f2c0JTRJ3rl5yzUMd?=

=?Windows-1252?Q?2m7HjReFozK5scdrHRSVq/cCUzir0hJRzq4H7z+ijqiKTLU+nWn9Ev7t?=

=?Windows-1252?Q?TeIMp4rQk05BgisWCZsTCIZ2q+5CWvAaOHMxTwXMJ5lAQjBteHFYEFT1?=

=?Windows-1252?Q?YDR5dy+cs3XaS0v25Z7HZRRi1u+HbCfCFwSq9pHhVMSFedrd+cxNzpfr?=

=?Windows-1252?Q?/OrvvUqQobwIEtiHXL7aZxCQCuoISeLT50lc0V8ss+jY7mSldTaBsRhI?=

=?Windows-1252?Q?grl7c9yw1EhVkRvuw3Spbifoigo76D19mHzFI4NyXCf3jisL1gGEYRbJ?=

=?Windows-1252?Q?+hk/fmGPrmYmxNyjr+oYq8El5ujeKQJfY0+HF9HjgXUgEXoc7VI6AcES?=

=?Windows-1252?Q?vIK3SiRf9Am5PbKE6IlidWuJvyaszVaUQMq9EgbET7LtoE02urzHADKs?=

=?Windows-1252?Q?q2eJwEL3Icf/shFmNNATQaQI6BwNaF2PFdjVTfRTsmVQRKFhOAD4msjJ?=

=?Windows-1252?Q?dde8m2+/t1awLHzdMscPHhhW/R462qH3uI6N9GJ+i22vqEocaW3EGYxV?=

=?Windows-1252?Q?dCil7mAcj1A83ZjuV++eY6CF5QRs7pSTEax8Ky8bbBjlFR0ZZMIqEi0v?=

=?Windows-1252?Q?bM832EhcUZPF2JLCifUfPSs0saCUKg1w/3+2qiE44vKa5MxUfFjpTqJx?=

=?Windows-1252?Q?cGom0f8Qc3FDaOWVr20HoX8/MG+j3tOKka0q3tZlb/47nEa3dQ2cNtID?=

=?Windows-1252?Q?OLqkadsCI6dLOfs07IW720g4IYlcuj9en+KuqDp/yn0sagu6mKE5+SPL?=

=?Windows-1252?Q?q0syfmxPh4zEB/myVaueEUntxY+UWVpFDVrWH5SP73trDyKbYp7XZaSY?=

=?Windows-1252?Q?c+PCtHgPT8rhc63GltUhdAO5wpiwEujya8IluFyoJqBzarrX7OEWH6kn?=

=?Windows-1252?Q?QoeDZ7q04ehz8caniomb4CAzgkidICCmvGnZfdhrv+7wxI3ro4Mbb72m?=

=?Windows-1252?Q?NxHQTUCF+hkJm4WOR+ddngar/MPFQZ9DAhpA67rQE1Lpa5WQS9UIL4oS?=

=?Windows-1252?Q?5goRwwIjkAzp9t5mWzH07S0FrTb/G/R19YEZfSOaMuGcNkDBDr+uyxdS?=

=?Windows-1252?Q?rUPipLCDvQAhcVx1dPL2RfzIAWDSSOFC61k4J7kD0D1WzYAY0+GABzEu?=

=?Windows-1252?Q?A5n2ckE+UnRQhsOoKZCDp0ZTRU6QKIyW2iL5D7DuPaEigMW1EihIGOJw?=

=?Windows-1252?Q?eH65Acif3V+8KiCWt6gGCuZV0JA=3D?=

x-ms-exchange-antispam-messagedata-chunkcount: 1

x-ms-exchange-antispam-messagedata-0:

=?Windows-1252?Q?ql/YhJd2ssDNohLlGXppPgRjeBbYch0/CLNNDn0+83tRyrs15dzyywb2?=

=?Windows-1252?Q?l2pLz6FZju4QO7N9wyMabw4lSdZvfj0IpoFWfYHqu5GuLiyJ+YInQp06?=

=?Windows-1252?Q?91+8cRFjwTUief4UEm1o1mmCsN7OnB9hu9UVcIWl9pxR7Wxtl+V7rK3y?=

=?Windows-1252?Q?OejFmItK7CSTGiglGn180pLCnk16ijPyYOMLjaXRLyq+r2dRf5qAXYeN?=

=?Windows-1252?Q?9uhPw4TsTM+FxWhZc6hNkwHusi6TV6ge7SjOAtfhARdrLh6+AzZb3W2A?=

=?Windows-1252?Q?Lz+aZmXRBHIw6XTrGkBYkW/HFsEkEOJzR1uiytdLHOQ/ygbWq78GkW6p?=

=?Windows-1252?Q?dAKp7maC5rqH0fx9++oypt8/D0qhgFR9J6DXi7Q4frMSxjnyqfJvOV9P?=

=?Windows-1252?Q?mGicPzQiFkz6+qSn0upw1IZjq3CxmebP76+g53kSJcdTcS2cjicjBLBu?=

=?Windows-1252?Q?+nK7NN26312cBWkMX+3rWazNR9QH8dns2QwAaxvtG78L/m6l7pHoEeA+?=

=?Windows-1252?Q?ZXk0VVDoQmIgMHeLy5kkBZuqhu3/Lt5HERfNiqMNPuSJlimbgaEdoFB5?=

=?Windows-1252?Q?8TV0cDNsTFDVX5Y3wk8VGb9dCp0q9EXVY3O0g8YiAjp56eGHvn9rWRF7?=

=?Windows-1252?Q?MOpEGP1fu8lOtHFljyymkHdQ10oJSXAe+J/oFPMDUQijt2vwTBA6QgJT?=

=?Windows-1252?Q?Td/rHO6EK0ASTQBAiCxTRCnkYPoRrFdra4VvjkjdXn4xXZVq45ecYe16?=

=?Windows-1252?Q?LoRTTCYpf3eyhZrob1f7Se/5VJhZy5owUkiNfO15ijtrkJCN3/u4RFtr?=

=?Windows-1252?Q?93e08zAM2UB5POyf+CZNYaCTvjcoucSj/cm0PlLAAC1dzFFmtbIEA7yV?=

=?Windows-1252?Q?bOFx/mO+c0IN7d3gRLBwRHoTdse6M/57jgSAqJcGlE7UoVQvP79J4wXs?=

=?Windows-1252?Q?6AjQnT+zg80ySALzmPyBzDfE9C/VMwEVmwtyJlobmFaPp4I3KrNEzkdp?=

=?Windows-1252?Q?AyMHsEGFFSrVnZK6B19ALiu5THiksldmqv2ylFFE0zxUzkRQe1XNGU24?=

=?Windows-1252?Q?e5yfvr/Dt6vUhYGOQl3iiRndwXdx8TX3rDy5i+oc3Tu64QkVHMnhubWv?=

=?Windows-1252?Q?Zy3mjWMVMUiYbasOqpiW84Yckeuz6U/FZiDSAvzm0qwYLtTyEBiz+Xqi?=

=?Windows-1252?Q?VXnsatfLg/u55luWFVOIUBakYIyeMyo9PUzv+7lIlJHiLTeU4hB2923I?=

=?Windows-1252?Q?JTLBoXpw4darBO7LML1IMgisz2AeGHlPqbN8WOUpFHoy4vYwU+6nvZHC?=

=?Windows-1252?Q?odHjR6UA44bOmtTGmOGhsw1DsnAAoV+A9mvRSivSdTt5hEXYZqUHwkq8?=

=?Windows-1252?Q?IO9/LaEc7/8jMSb5sr9f6/f8WVvtQG3an/8EaxwrLmsV+gNFaQC4FHfz?=

=?Windows-1252?Q?T3UiYF5V9GgZpSadnTonRxVUMAXeZ7nCNvBUd4Voxf/Vi6BrasAHV32q?=

=?Windows-1252?Q?9vTic6e2g4Q7FDS4a9bALeRbuU5gvaYNO/ibrJf2UaiAHKGhWe2brI38?=

=?Windows-1252?Q?blkdGkHLbSSx4PHH?=

Content-Type: multipart/alternative;

boundary="_000_SN6PR11MB283008EFF7412B9CA916915D89B62SN6PR11MB2830namp_"

MIME-Version: 1.0

X-OriginatorOrg: outlook.com

X-MS-Exchange-CrossTenant-AuthAs: Internal

X-MS-Exchange-CrossTenant-AuthSource: SN6PR11MB2830.namprd11.prod.outlook.com

X-MS-Exchange-CrossTenant-RMS-PersistedConsumerOrg: 00000000-0000-0000-0000-000000000000

X-MS-Exchange-CrossTenant-Network-Message-Id: 7bf2380e-5868-4b40-7f6c-08df09e2effc

X-MS-Exchange-CrossTenant-originalarrivaltime: 03 Sep 2026 17:44:00.3366

(UTC)

X-MS-Exchange-CrossTenant-fromentityheader: Hosted

X-MS-Exchange-CrossTenant-id: 84df9e7f-e9f6-40af-b435-aaaaaaaaaaaa

X-MS-Exchange-CrossTenant-rms-persistedconsumerorg: 00000000-0000-0000-0000-000000000000

X-MS-Exchange-Transport-CrossTenantHeadersStamped: PH6PR11MB242266



--_000_SN6PR11MB283008EFF7412B9CA916915D89B62SN6PR11MB2830namp_

Content-Type: text/plain; charset="Windows-1252"

Content-Transfer-Encoding: quoted-printable



Hi,



Quick checking in-



I=92m still waiting for your response.



If you're interested, I can share a brief Google Business Profile review wi=

th a few practical suggestions.



Thanks,

________________________________

From: banty sharma

Sent: Wednesday, September 2, 2026 12:39 AM

Subject: AW:CD:@ **Remove Negative Review Service**



Hello,



I came across your Google Business Profile and noticed there may be opportu=

nities to improve how your business is presented through customer reviews.



If you're open to it, I'd be happy to share a few ideas that could help str=

engthen your online presence.



Just let me know if you'd like more details.



Best regards,

Banty Sharma,





--_000_SN6PR11MB283008EFF7412B9CA916915D89B62SN6PR11MB2830namp_

Content-Type: text/html; charset="Windows-1252"

Content-Transfer-Encoding: quoted-printable








252">








nt, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; c=

olor: rgb(0, 0, 0);">

Hi,



nt, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; c=

olor: rgb(0, 0, 0);">







nt, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; c=

olor: rgb(0, 0, 0);">

Quick checking in-



nt, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; c=

olor: rgb(0, 0, 0);">







nt, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; c=

olor: rgb(0, 0, 0);">

I=92m still waiting for your response.



nt, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; c=

olor: rgb(0, 0, 0);">







nt, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; c=

olor: rgb(0, 0, 0);">

If you're interested, I can share a brief Google Business Profile review wi=

th a few practical suggestions.



nt, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; c=

olor: rgb(0, 0, 0);">







nt, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; c=

olor: rgb(0, 0, 0);">

Thanks,













11pt; color: rgb(0, 0, 0);">

From: banty sharma


Sent: Wednesday, September 2, 2026 12:39 AM


Subject: AW:CD:@ **Remove Negative Review Service**


 





d-color: rgb(255, 255, 255); margin: 0px; font-family: cambria, georgia, se=

rif; font-size: 11pt; color: rgb(0, 0, 0);">

Hello,



d-color: rgb(255, 255, 255); margin: 0px; font-family: cambria, georgia, se=

rif; font-size: 11pt; color: rgb(0, 0, 0);">

 



d-color: rgb(255, 255, 255); margin: 0px; font-family: cambria, georgia, se=

rif; font-size: 11pt;">

I came across your
=3D"spanWithBackgroundColor" style=3D"color: rgb(200, 38, 19); background-c=

olor: rgb(255, 255, 0);">Google Business Profile
style=3D"color: rgb(0, 0, 0);"> and noticed

there may be opportunities to improve how your business is presented throu=

gh customer reviews.



d-color: rgb(255, 255, 255); margin: 0px; font-family: cambria, georgia, se=

rif; font-size: 11pt; color: rgb(0, 0, 0);">

 



d-color: rgb(255, 255, 255); margin: 0px; font-family: cambria, georgia, se=

rif; font-size: 11pt; color: rgb(0, 0, 0);">

If you're open to it, I'd be happy to share a few ideas that could help str=

engthen your online presence.



d-color: rgb(255, 255, 255); margin: 0px; font-family: cambria, georgia, se=

rif; font-size: 11pt; color: rgb(200, 38, 19);">

 



d-color: rgb(255, 255, 255); margin: 0px; font-family: cambria, georgia, se=

rif; font-size: 11pt; color: rgb(0, 0, 0);">


255, 255);">Just let me know if you'd like more details.
an>



d-color: rgb(255, 255, 255); margin: 0px; font-family: cambria, georgia, se=

rif; font-size: 11pt; color: rgb(0, 0, 0);">

 



d-color: rgb(255, 255, 255); margin: 0px; font-family: cambria, georgia, se=

rif; font-size: 11pt; color: rgb(0, 0, 0);">

Best regards,



d-color: rgb(255, 255, 255); margin: 0px; font-family: cambria, georgia, se=

rif; font-size: 11pt; color: rgb(0, 0, 0);">

Banty Sharma,



_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb=

(0, 0, 0);">












--_000_SN6PR11MB283008EFF7412B9CA916915D89B62SN6PR11MB2830namp_--