French language rental demand phish from Google Gmail

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Sun, 12 Apr 2026 08:45:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1wBw3S-00000000EWG-3kUV

for dave@doctor.nl2k.ab.ca;

Sun, 12 Apr 2026 08:44:54 -0600

Resent-From: The Doctor

Resent-Date: Sun, 12 Apr 2026 08:44:54 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-lf1-f67.google.com ([209.85.167.67]:54298)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.98.2 (FreeBSD))

(envelope-from <33039@ppk.ac.th>)

id 1wBvke-000000006oy-35o0

for doctor@nl2k.ab.ca;

Sun, 12 Apr 2026 08:25:37 -0600

Received: by mail-lf1-f67.google.com with SMTP id 2adb3069b0e04-5a2c77c62d7so3543150e87.0

for ; Sun, 12 Apr 2026 07:24:41 -0700 (PDT)

ARC-Seal: i=1; a=rsa-sha256; t=1776003875; cv=none;

d=google.com; s=arc-20240605;

b=S1pOB+MbXpqSCbpu76rDYD7Fv14lRSIzhJ1sL5VLA342s45oMqWtWmVAKwoAJQtyUN

yFcnZ0dnpfyTSg/rcbfilhfFtiDlF3/Ft23YaEpibpHt5dhMXDYU1FtK26AY8nIik6at

v1gLz7zhGkBqf4YjHO5dlNpXE2K8Rl68U5eA6OSUR6warKGELmjyQJawmHUT1hNqPoLM

FaA/KGzNO+/wwfUiq8kSrptuNUdGKiAb/paK4OAjftKS7jRBeE+woZ/Dcwd06a1PokEO

6x8izP/baZg5ltA7JVnIjwTUcZtiJvvOPxXS10Pk835rY8gluNy2fwDS0qsv9Qdcs/4d

7fWw==

ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20240605;

h=to:subject:message-id:date:from:reply-to:mime-version

:dkim-signature;

bh=hSdHXvGvxV7MRvfeVcTqnZOgtXM/agvdU0uDFSkftkQ=;

fh=ETYg8Qe7AlprisbU+xuke3XsRCYYLswe6JRNKPt1uzo=;

b=WlUXTmZ9MLV96mSAVEk7hxIdZZSXcyxnrGm385jJVpIMRHeQjIyUixzh2MjKJaaYIU

IzMBxpEqfRuNR7+lceX9OHDzjs8eOlA+NtxHOxZGFMo/t1xqtSKdONwrMOz8uSS6BKYh

/6RoX+bNu1xiTRTwXWV+XheGH7niIZA6S8k3YbC11ec+i90ta57pAVKnkkeGLqxVdHWx

YxKKIevIbyU0/Ti5cszLTJQxsykLGZQyLbose4v/cqhJm1GHdM+1v4oMPiXQLcTzfzqX

Lo7SZ6NSxuectFxQcEmAko9kAjpQ8p9wPMwLBQu3tFeh/5neyhgcRMGhkXNyGNTki/tA

xPWw==;

darn=nl2k.ab.ca

ARC-Authentication-Results: i=1; mx.google.com; arc=none

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=ppk-ac-th.20251104.gappssmtp.com; s=20251104; t=1776003875; x=1776608675; darn=nl2k.ab.ca;

h=to:subject:message-id:date:from:reply-to:mime-version:from:to:cc

:subject:date:message-id:reply-to;

bh=hSdHXvGvxV7MRvfeVcTqnZOgtXM/agvdU0uDFSkftkQ=;

b=ZMEBjoMCgQUbemO6rF6e4jGFpJkbT9rvgc+wX++6+dY+6imlEnvOqJ5Q0YdKH+J3ML

cfrw89KjJxkhJJSEIQz2wjdMfYp2r2gPPlq+FNsjnj+7fVWrFm89jxwgDd1JRgUlRP1w

6cOqlBHVxrbaZ5O4SBkJKImt0vlCcEvqDIPaezqJ6Jw4LEzFmOldHSPRMiIjvkQGVbqK

4tAm9txKvK5TgOSQAljog5LRmsAgsF5wKCT/esrFQf54GaR7cNEcCODd+kufTMUuILB8

04+gPH6RRy2tTmLxM49CbfuvoB8VQvQ0OYzMeda+OMSSyTaCmS82q0T9OdPiOIQ9EWbX

vXBw==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20251104; t=1776003875; x=1776608675;

h=to:subject:message-id:date:from:reply-to:mime-version:x-gm-gg

:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to;

bh=hSdHXvGvxV7MRvfeVcTqnZOgtXM/agvdU0uDFSkftkQ=;

b=LrtwQ0l1XzjNcgq4/VLKFf8J98d4u0ZZwvD9otIcO+1K+K5a/in2+xr69PfBte7QpE

utLp7ISXRy7b2TEUQZsfhGGd6pr+U+ahCOhRKDeRDhN9XhoDZb9gWWGC7pJmClGcZQtH

n8HKkeZrLhiYdb86bl8p13RJYQIVBHVdu1/DIE8E21y50zSulBw76ZQceYVrrWDWXNL3

G7XjFBtGzhi+x/dOa/iHdZ92LMJpfzDFqcY1JuIl3lqVdxfGaJ1d4gSY8Eb9hIMS/9vQ

MhRvIdyiguF3WaLcuMh90eVgfpB+vqBOAA1LhjuCRD90DsgUWnTct5KAul531v97H1KI

XpeQ==

X-Forwarded-Encrypted: i=1; AFNElJ+hKTf+Ukj9WNuR7T2vd1IcW1LkVI42o233AAcO/k4O4anxg+uUkZQY1X9G2FmXy4oQQHpdrrQ=@nl2k.ab.ca

X-Gm-Message-State: AOJu0YwIQwlkR/7yNyMuw9QWoiYXck9nWYFf/aw0tdztuSMiXxdDmd9G

EjUooWYVwir/asAB9JD15Nd1YpQsW6fQZLOSigpGSoQLn4gYgt1ZfzgiD0DlcFIJWkx/XMN3H5D

uthhxMYz2IWyPZw4wH5iVUqwCOrbXhxr1R52iyhOh5g==

X-Gm-Gg: AeBDievJ2rjKV9/6n91uholiihp0y0A9S+TOy6vV5LZUdhkrWUEFwZJHRrAIDpaUfwa

YTpVm7uCqHZfq5HmDNP4ygDdJZzBny5s+DZyeBj0L4L7bGW/YJ6O35Wobz5RTkkfHIgCsuDZEAJ

Df2A5J7CHGuOcJodMNoymn0uwErekmsqYtFfZACFfvUHyzsrq+fDcfTksn3f0Ai0yFQWekPKP3X

nYDvDPb0D9QOyj25pvimGTaCUnXjE7hMBjrhK+BFss39s5JL7BCF4xvk00GMSbtRemhzRlZ23Cy

ZQUKoSK4hCo=

X-Received: by 2002:a05:6512:39cc:b0:5a2:7bd5:329e with SMTP id

2adb3069b0e04-5a3efb4e964mr3020645e87.37.1776003874080; Sun, 12 Apr 2026

07:24:34 -0700 (PDT)

MIME-Version: 1.0

Reply-To: servicegestionlocative148@gmail.com

From: Service Locative <33039@ppk.ac.th>

Date: Sun, 12 Apr 2026 14:24:37 +0200

X-Gm-Features: AQROBzDwzRTdXaOLYQd5CEIogsXcKj4qgNKcgpfIh49icVm9WI6ZFirodbCE8LI

Message-ID:

Subject: Rappel de paiement

To: undisclosed-recipients:;

Content-Type: multipart/alternative; boundary="00000000000008d4c9064f442034"

Bcc: doctor@nl2k.ab.ca

X-Spam_score: 8.3

X-Spam_score_int: 83

X-Spam_bar: ++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Chers locataires, Nous espérons que vous allez bien. Nous

vous écrivons aujourd’hui afin de vous informer d’un changement important

concernant le paiement de votre loyer. Dans un souci de simpli [...]



Content analysis details: (8.3 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[209.85.167.67 listed in list.dnswl.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[209.85.167.67 listed in dnsbl.ahbl.org]

[209.85.167.67 listed in dnsbl.ahbl.org]

[209.85.167.67 listed in dnsbl.ahbl.org]

[209.85.167.67 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[209.85.167.67 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[209.85.167.67 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[209.85.167.67 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[209.85.167.67 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[209.85.167.67 listed in will-spam-for-food.eu.org]

[209.85.167.67 listed in will-spam-for-food.eu.org]

[209.85.167.67 listed in will-spam-for-food.eu.org]

[209.85.167.67 listed in will-spam-for-food.eu.org]

[209.85.167.67 listed in will-spam-for-food.eu.org]

[209.85.167.67 listed in will-spam-for-food.eu.org]

[209.85.167.67 listed in will-spam-for-food.eu.org]

[209.85.167.67 listed in will-spam-for-food.eu.org]

-0.0 SPF_PASS SPF: sender matches SPF record

1.5 GR_DOMAIN_UNDISC1 To contains undisclosed recipient (undisc)

0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in digit

[servicegestionlocative148(at)gmail.com]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

0.0 RCVD_IN_VALIDITY_SAFE_BLOCKED RBL: ADMINISTRATOR NOTICE: The query to

Validity was blocked. See

https://knowledge.validity.com/hc/en-us/articles/20961730681243

for more information.

[209.85.167.67 listed in sa-accredit.habeas.com]

0.0 RCVD_IN_VALIDITY_RPBL_BLOCKED RBL: ADMINISTRATOR NOTICE: The query to

Validity was blocked. See

https://knowledge.validity.com/hc/en-us/articles/20961730681243

for more information.

[209.85.167.67 listed in bl.score.senderscore.com]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[209.85.167.67 listed in bl.score.senderscore.com]

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[209.85.167.67 listed in wl.mailspike.net]

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

2.5 FREEMAIL_FORGED_REPLYTO Freemail in Reply-To, but not From

Subject: {SPAM?} Rappel de paiement



Chers locataires,

Nous espérons que vous allez bien.

Nous vous écrivons aujourd’hui afin de vous informer d’un changement important concernant le paiement de votre loyer. Dans un souci de simplification, de rapidité et de sécurité, nous vous invitons à effectuer vos paiements par virement Interac, et ce à compter de ce mois-ci.

Ce nouveau mode de paiement nous permettra :



de suivre plus facilement les transactions,

de réduire les délais de traitement,

et de nous assurer que chaque loyer est bien reçu à temps.



Informations pour le virement :



Adresse courriel du destinataire : servicegestionlocative148@gmail.com



Question de sécurité : Facture

Réponse : Payer



Une fois le virement effectué, merci de nous en informer par retour de courriel. Si possible, nous vous invitons à joindre une capture d’écran ou une copie de l’ordre de virement, ce qui facilitera la mise à jour rapide de votre dossier.

Nous comprenons que ce changement puisse demander un petit temps d’adaptation. Soyez assuré(e) que nous restons disponibles pour vous accompagner tout au long de cette transition.

N’hésitez pas à nous contacter pour toute question ou assistance concernant votre premier virement.

Un grand merci pour votre collaboration et votre confiance. Votre confort et votre tranquillité d’esprit demeurent nos priorités.

Pour toute demande, vous pouvez nous écrire à : servicegestionlocative148@gmail.com



Bien cordialement,

Fedex Phish from sendgrid

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Sun, 12 Apr 2026 08:21:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1wBvfv-000000006C3-00nd

for dave@doctor.nl2k.ab.ca;

Sun, 12 Apr 2026 08:20:35 -0600

Resent-From: The Doctor

Resent-Date: Sun, 12 Apr 2026 08:20:34 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from s.wfbtztkb.outbound-mail.sendgrid.net ([159.183.231.27]:24140)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1wBvZ4-00000000OOV-1q9n

for sales@nk.ca;

Sun, 12 Apr 2026 08:13:32 -0600

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=perfectfitclosets.ca;

h=content-transfer-encoding:content-type:date:from:mime-version:subject:

to:cc:content-type:date:from:subject:to;

s=s1; t=1776003156; bh=dgTjN9KWVZdljRDXKJvzVAIxu083wDrWtYH0pCiL0lI=;

b=UpnRXb0UhldzUnAjUUHEa9NEg/5I3JJrV4Ok3EenhGUPaYLrkxvt/jwn67lcaXUsH7AM

7xpQEuVrefxsXk+IIVHBBb6u+Be/I1r5IUVTUD2kSnJ87vEf8gKNoa7uAgJHZJmWGn/7gJ

yT1QQXKmhJxV55gZEU04v93mdlPgf3q3hUDPzXB7NGtvcez5xU6b0aDz/I+kUX9xzDVwgP

ewFhQHEnl+oKSfaqaBEcpEwcaIXSMuVUbosezyG5Cslg6Ih6jy8AS4LIDvZFDqvo0eCNLp

DHczB0DBUop8ZXiWiS+P0wywtmPAYz6UHj92/wiI8+j/c0bymmNJ0ZYsxVlOK/aQ==

Received: by recvd-5845d65b6f-q6s9s with SMTP id recvd-5845d65b6f-q6s9s-1-69DBA853-BE

2026-04-12 14:12:35.964112443 +0000 UTC m=+162526.155406460

Received: from Mzg5MDY5MjY (unknown)

by geopod-ismtpd-0 (SG) with HTTP

id LThm21wgTX6F0jN7y2qAeQ

Sun, 12 Apr 2026 14:12:35.952 +0000 (UTC)

Content-Transfer-Encoding: quoted-printable

Content-Type: text/html; charset=us-ascii

Date: Sun, 12 Apr 2026 14:12:36 +0000 (UTC)

From: FedEx =?iso-8859-1?q?EXPRESS=AE?=

Mime-Version: 1.0

Message-ID:

Subject: Your parcel is waiting for instructions

X-SG-EID:

=?us-ascii?Q?u001=2EQqNlE5al1bvBBtqp7HdPg4UP2wHzFGm6w91pbB3KXUXLPLVBiJ1lNXRm+?=

=?us-ascii?Q?Y9wGR2o03GafpBLcdRZUkXCJmZ5mz8h6CftISnX?=

=?us-ascii?Q?uEJQgsuNU6KyhjSZF6Tx7DmcVFrLBN4vUkSzMmP?=

=?us-ascii?Q?2o8Hd2EKd5=2F=2FdxbvhRE8YaEwKxd5KdsfcPEJuF7?=

=?us-ascii?Q?S4EnxZJYmRfydGQZzm1jKKGM3+i7HX2c4+EwI30?=

=?us-ascii?Q?hVfEYcOps+XjZ9bZ4gqCwAPHypyn05c8IwhmZK=2F?= =?us-ascii?Q?3FdH?=

To: sales@nk.ca

X-Entity-ID: u001.v/heuvXHas+F6NykZsuNtw==

X-Spam_score: 40.4

X-Spam_score_int: 404

X-Spam_bar: ++++++++++++++++++++++++++++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: FedEx Your Parcel is waiting for owner instuctions .



Content analysis details: (40.4 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[159.183.231.27 listed in dnsbl.ahbl.org]

[159.183.231.27 listed in dnsbl.ahbl.org]

[159.183.231.27 listed in dnsbl.ahbl.org]

[159.183.231.27 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[159.183.231.27 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[159.183.231.27 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[159.183.231.27 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[159.183.231.27 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[159.183.231.27 listed in will-spam-for-food.eu.org]

[159.183.231.27 listed in will-spam-for-food.eu.org]

[159.183.231.27 listed in will-spam-for-food.eu.org]

[159.183.231.27 listed in will-spam-for-food.eu.org]

[159.183.231.27 listed in will-spam-for-food.eu.org]

[159.183.231.27 listed in will-spam-for-food.eu.org]

[159.183.231.27 listed in will-spam-for-food.eu.org]

[159.183.231.27 listed in will-spam-for-food.eu.org]

1.1 URIBL_GREY Contains an URL listed in the URIBL greylist

[URI: sendgrid.net]

2.5 URIBL_DBL_PHISH Contains a Phishing URL listed in the DBL blocklist

[URI: perfectfitclosets.ca]

0.1 URIBL_SBL_A Contains URL's A record listed in the SBL blocklist

[URI: appcenter-api.bignox.com/36.255.220.177]

-0.0 SPF_PASS SPF: sender matches SPF record

15 GR_DOMAIN_SENDGR1 Received contains spammer id (sendgr)

15 GR_DOMAIN_SENDGR6 URI: Body contains known spammer URI (sendgr)

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_IMAGE_ONLY_32 BODY: HTML: images with 2800-3200 bytes of words

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

0.6 HTML_MIME_NO_HTML_TAG HTML-only message, but there is no HTML tag

Subject: {SPAM?} Your parcel is waiting for instructions




,Segoe UI,Helvetica Neue,Arial,sans-serif; line-height: 22px; font-weight: =

bold; font-style: normal; font-size: 50px; text-decoration: none; text-tran=

sform: none; direction: ltr; color: #333333; text-align: left; mso-line-hei=

ght-rule: exactly; mso-text-raise: -2px;">
=3D"margin: 0; color: #843fa1; mso-line-height-rule: exactly;">Fed

pan class=3D"t1" style=3D"margin: 0; color: #e67e23; mso-line-height-rule: =

exactly;">Ex




,Segoe UI,Helvetica Neue,Arial,sans-serif; line-height: 22px; font-weight: =

bold; font-style: normal; font-size: 50px; text-decoration: none; text-tran=

sform: none; direction: ltr; color: #333333; text-align: left; mso-line-hei=

ght-rule: exactly; mso-text-raise: -2px;">
n: 0; color: #e67e23; mso-line-height-rule: exactly;"> 




,Segoe UI,Helvetica Neue,Arial,sans-serif; line-height: 22px; font-weight: =

bold; font-style: normal; font-size: 50px; text-decoration: none; text-tran=

sform: none; direction: ltr; color: #333333; text-align: left; mso-line-hei=

ght-rule: exactly; mso-text-raise: -2px;"> 



Your Parcel is waiting for owner ins=

tuctions .



Dear Customer,



Your parcel has arrived at our facility =

and is ready for the final step of delivery. To initiate the shipping proce=

ss, please complete the outstanding payment within the next 24 hours. You m=

ay proceed by following the link below. Should you have any questions, feel=

free to reach out—we’re happy to assist!




elvetica, arial, sans-serif;">
lick/v1/url?redirectUrl=3Dhttps://mail.trabalhosassemae.com.br/uhntyp28htyw=

5xrhfsvdfcau/">https://www.fedex.com/tracking?id=3DK0SQ24IU1JPNX8T<=

/strong>



Thank you for your prompt attention.



Best regards,

g>
le: exactly;">Fed

23; mso-line-height-rule: exactly;">Ex


://u38906926.ct.sendgrid.net/wf/open?upn=3Du001.47O2DjJnszqz5BkLM6ntPXkc5EC=

YGbR8j07FXis3P5ygSnq7IKirMicnBAS1-2BDjjtmHpIgtj2cErcrIG2vji4wpGT-2FVyfLd6qv=

Su0D3ZRlYTY33NO4rtVWQUgilKaogyFE53Q49HuQpKV-2FwqGCu8XKUFpZNHTXiNYQjd7ercks3=

rqr6G78IOE4BWtQE-2FFY8jX-2BOH5XXQJ6VPGdnSLER6yA-3D-3D" alt=3D"" width=3D"1"=

height=3D"1" border=3D"0" style=3D"height:1px !important;width:1px !import=

ant;border-width:0 !important;margin-top:0 !important;margin-bottom:0 !impo=

rtant;margin-right:0 !important;margin-left:0 !important;padding-top:0 !imp=

ortant;padding-bottom:0 !important;padding-right:0 !important;padding-left:=

0 !important;"/>

Fedex Phish from Sendgrid

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Sun, 12 Apr 2026 08:21:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1wBvfq-000000005kO-3y1T

for dave@doctor.nl2k.ab.ca;

Sun, 12 Apr 2026 08:20:30 -0600

Resent-From: The Doctor

Resent-Date: Sun, 12 Apr 2026 08:20:30 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from s.wfbtzhst.outbound-mail.sendgrid.net ([159.183.224.103]:15822)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1wBvX6-00000000NlW-2moJ

for root@nk.ca;

Sun, 12 Apr 2026 08:11:30 -0600

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=perfectfitclosets.ca;

h=content-transfer-encoding:content-type:date:from:mime-version:subject:

to:cc:content-type:date:from:subject:to;

s=s1; t=1776003034; bh=utq8fiy7gBJpOJh+qnuE5mWh3GhQTFvhwFvvGFwCYhc=;

b=k+3hRknFToniInBXLLXvm4IOPR68bFQcLMHglX65f9edzu50LCFkQjCacCwPou+MKMKM

CjruSwomXYAMZhxqh+4Z76gEgcjdu+83KtH+PKSDwK1pwU2Br0sayJ36qPvIpYfK5/85pC

Iqt3vQRGCUD3ooMba9XRo983NEOz21Z7RLFwsGIu28Cb5M631+l68TgXLIsnCMLQ9k6Osx

JRDnWwxldGCXtfyAvyvmttY1XFmvfzJX+AqHb1PLhWVJCEEo41y7tZn2b73VCybh40axFf

tQDcgKwMVKAGCgLrbXnl/38T2ZURURntNv0olP6wLSpLNxuhrtIKaSDHbYVX3Y5g==

Received: by recvd-5b8f9fcb4b-27t5f with SMTP id recvd-5b8f9fcb4b-27t5f-1-69DBA7DA-C

2026-04-12 14:10:34.062313713 +0000 UTC m=+162448.913651298

Received: from Mzg5MDY5MjY (unknown)

by geopod-ismtpd-21 (SG) with HTTP

id 7mDyADuGSYiLieTLg7gGZw

Sun, 12 Apr 2026 14:10:34.029 +0000 (UTC)

Content-Transfer-Encoding: quoted-printable

Content-Type: text/html; charset=us-ascii

Date: Sun, 12 Apr 2026 14:10:34 +0000 (UTC)

From: FedEx =?iso-8859-1?q?EXPRESS=AE?=

Mime-Version: 1.0

Message-ID: <7mDyADuGSYiLieTLg7gGZw@geopod-ismtpd-21>

Subject: Your parcel is waiting for instructions

X-SG-EID:

=?us-ascii?Q?u001=2EQqNlE5al1bvBBtqp7HdPg4UP2wHzFGm6w91pbB3KXUXLPLVBiJ1lNXRm+?=

=?us-ascii?Q?Y9wGR2o03GafpBLcdRZUkXCJmZ5mwVyYKUHDvDE?=

=?us-ascii?Q?QxjIIyKMmH=2F9amn4lJD32+z7WVxw2R3p=2FY0gCk6?=

=?us-ascii?Q?AWU1KxHcrm5bQo7p=2F=2FR9KpAcO0j9ztcA1X9FuMq?=

=?us-ascii?Q?eOTC42m=2FR1n1NoVtpEozosG1BuFrYmmkgJE5wWP?=

=?us-ascii?Q?1k8j1oKSSxVuLOv2hwVRKJB6KTQ5HREDgHsyStf?= =?us-ascii?Q?QX6C?=

To: root@nk.ca

X-Entity-ID: u001.v/heuvXHas+F6NykZsuNtw==

X-Spam_score: 40.4

X-Spam_score_int: 404

X-Spam_bar: ++++++++++++++++++++++++++++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: FedEx Your Parcel is waiting for owner instuctions .



Content analysis details: (40.4 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[159.183.224.103 listed in dnsbl.ahbl.org]

[159.183.224.103 listed in dnsbl.ahbl.org]

[159.183.224.103 listed in dnsbl.ahbl.org]

[159.183.224.103 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[159.183.224.103 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[159.183.224.103 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[159.183.224.103 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[159.183.224.103 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[159.183.224.103 listed in will-spam-for-food.eu.org]

[159.183.224.103 listed in will-spam-for-food.eu.org]

[159.183.224.103 listed in will-spam-for-food.eu.org]

[159.183.224.103 listed in will-spam-for-food.eu.org]

[159.183.224.103 listed in will-spam-for-food.eu.org]

[159.183.224.103 listed in will-spam-for-food.eu.org]

[159.183.224.103 listed in will-spam-for-food.eu.org]

[159.183.224.103 listed in will-spam-for-food.eu.org]

1.1 URIBL_GREY Contains an URL listed in the URIBL greylist

[URI: sendgrid.net]

2.5 URIBL_DBL_PHISH Contains a Phishing URL listed in the DBL blocklist

[URI: perfectfitclosets.ca]

0.1 URIBL_SBL_A Contains URL's A record listed in the SBL blocklist

[URI: appcenter-api.bignox.com/36.255.220.177]

-0.0 SPF_PASS SPF: sender matches SPF record

15 GR_DOMAIN_SENDGR1 Received contains spammer id (sendgr)

15 GR_DOMAIN_SENDGR6 URI: Body contains known spammer URI (sendgr)

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_IMAGE_ONLY_32 BODY: HTML: images with 2800-3200 bytes of words

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

0.6 HTML_MIME_NO_HTML_TAG HTML-only message, but there is no HTML tag

Subject: {SPAM?} Your parcel is waiting for instructions




,Segoe UI,Helvetica Neue,Arial,sans-serif; line-height: 22px; font-weight: =

bold; font-style: normal; font-size: 50px; text-decoration: none; text-tran=

sform: none; direction: ltr; color: #333333; text-align: left; mso-line-hei=

ght-rule: exactly; mso-text-raise: -2px;">
=3D"margin: 0; color: #843fa1; mso-line-height-rule: exactly;">Fed

pan class=3D"t1" style=3D"margin: 0; color: #e67e23; mso-line-height-rule: =

exactly;">Ex




,Segoe UI,Helvetica Neue,Arial,sans-serif; line-height: 22px; font-weight: =

bold; font-style: normal; font-size: 50px; text-decoration: none; text-tran=

sform: none; direction: ltr; color: #333333; text-align: left; mso-line-hei=

ght-rule: exactly; mso-text-raise: -2px;">
n: 0; color: #e67e23; mso-line-height-rule: exactly;"> 




,Segoe UI,Helvetica Neue,Arial,sans-serif; line-height: 22px; font-weight: =

bold; font-style: normal; font-size: 50px; text-decoration: none; text-tran=

sform: none; direction: ltr; color: #333333; text-align: left; mso-line-hei=

ght-rule: exactly; mso-text-raise: -2px;"> 



Your Parcel is waiting for owner ins=

tuctions .



Dear Customer,



Your parcel has arrived at our facility =

and is ready for the final step of delivery. To initiate the shipping proce=

ss, please complete the outstanding payment within the next 24 hours. You m=

ay proceed by following the link below. Should you have any questions, feel=

free to reach out—we’re happy to assist!




elvetica, arial, sans-serif;">
lick/v1/url?redirectUrl=3Dhttps://mail.trabalhosassemae.com.br/uhntyp28htyw=

5xrhfsvdfcau/">https://www.fedex.com/tracking?id=3DK0SQ24IU1JPNX8T<=

/strong>



Thank you for your prompt attention.



Best regards,

g>
le: exactly;">Fed

23; mso-line-height-rule: exactly;">Ex


://u38906926.ct.sendgrid.net/wf/open?upn=3Du001.EtyC8XKcPmGZYDmBykh8zWLvUP7=

e1n8NGu6u5F3t1ztJa1SpqLPaq-2F-2B9DY7z-2BaKjkiaA2kB1A-2BcXamt-2FnYSr0wG9nJD2=

FS-2BDl27G2kWlRF23jnyIBVQ-2BOy5E9yo2Mw1RxliIgdldIVNBA8ZHHjiwzfGm-2BCmJ9rGoM=

JxlMInTYzgCbOYVM1Ek4Gb2FCkFOzn3d-2B5UgfsdwEwDg3AzQMTVmQ-3D-3D" alt=3D"" wid=

th=3D"1" height=3D"1" border=3D"0" style=3D"height:1px !important;width:1px=

!important;border-width:0 !important;margin-top:0 !important;margin-bottom=

:0 !important;margin-right:0 !important;margin-left:0 !important;padding-to=

p:0 !important;padding-bottom:0 !important;padding-right:0 !important;paddi=

ng-left:0 !important;"/>

Fedex Phish from Sendgrid

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Sun, 12 Apr 2026 08:21:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1wBvfi-000000005df-2gGl

for dave@doctor.nl2k.ab.ca;

Sun, 12 Apr 2026 08:20:22 -0600

Resent-From: The Doctor

Resent-Date: Sun, 12 Apr 2026 08:20:22 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from s.wfbtztkb.outbound-mail.sendgrid.net ([159.183.231.27]:24856)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1wBvMB-00000000Mw5-0nke

for root@nk.ca;

Sun, 12 Apr 2026 08:00:18 -0600

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=perfectfitclosets.ca;

h=content-transfer-encoding:content-type:date:from:mime-version:subject:

to:cc:content-type:date:from:subject:to;

s=s1; t=1776002355; bh=VK3VoyGSUaWB0GshfM++lgXPYj5MhmlcWconV0HAAQo=;

b=V/3JkbH3fpbcGCOR13HqjxmeJQTokQXpZE/Xw20M8vagJMw0juUVB5+zY/0CapUaqRdZ

SuPWsqpni/aX5/1PAne03z1YcLxzKu20cau3gIdJou8Y7T/E4AUGXJFRkNLkXvAzhTIqCF

XCmBTx0lUfWK3+SPoBZIwAoUOaM+IOj9G6MFf+PcLoHKztbkvEeg4UIajCNyhZiJ3j6IOh

iCDritacuxux3dxjyTj5ueS3Vu5rXovbd+AEqO5rzz+8KEIR+U+waJCrH7GOvgSdUDOxYa

/PoPCZKUKexjIC7duTv95e+lgxlGSZH9tyGteFKZilnJmQhCmaklXx0y/XLyVtkg==

Received: by recvd-6cb6c68998-4jn8w with SMTP id recvd-6cb6c68998-4jn8w-1-69DBA533-17

2026-04-12 13:59:15.571016906 +0000 UTC m=+161716.721229676

Received: from Mzg5MDY5MjY (unknown)

by geopod-ismtpd-14 (SG) with HTTP

id 8RWG9OhMQ9u5R3IfH596Kw

Sun, 12 Apr 2026 13:59:15.542 +0000 (UTC)

Content-Transfer-Encoding: quoted-printable

Content-Type: text/html; charset=utf-8

Date: Sun, 12 Apr 2026 13:59:15 +0000 (UTC)

From: FedEx Tracking

Mime-Version: 1.0

Message-ID: <8RWG9OhMQ9u5R3IfH596Kw@geopod-ismtpd-14>

Subject: We've updated your estimated delivery

X-SG-EID:

=?us-ascii?Q?u001=2EQqNlE5al1bvBBtqp7HdPgxedUqGYuBWmx7JGl4mIJfmePVUn0lHb9CXNn?=

=?us-ascii?Q?0DyQ=2F0CCy350ge5NTBTE3br7LM8v7kXBs3I0waf?=

=?us-ascii?Q?zpDj=2F37NiGrwggsEs05+8EnWszh38=2FUN8pMd6Cw?=

=?us-ascii?Q?gjlUrrNn=2FQaTp6yJHLtq6xObOAroSHX5k90yvKE?=

=?us-ascii?Q?5LRh47qUk+MeGlbO8AgXu1kMATuMCvMkcXYGONQ?=

=?us-ascii?Q?++kkil9a0S7hC3fPpJKw53XpqjNTVbne7J4aLFA?= =?us-ascii?Q?Q4=2Ff?=

To: root@nk.ca

X-Entity-ID: u001.v/heuvXHas+F6NykZsuNtw==

X-Spam_score: 39.7

X-Spam_score_int: 397

X-Spam_bar: +++++++++++++++++++++++++++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: FedEx Delivery Notification We’ve updated the estimated

delivery of your shipment. N/A Delivery Date 06:59:15 Confirm and Resolve

Charges Tracking details Tracking ID #&NUMBER14; CANADA 06:59:15 To CANADA

Number of pieces 1 T [...]



Content analysis details: (39.7 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[159.183.231.27 listed in dnsbl.ahbl.org]

[159.183.231.27 listed in dnsbl.ahbl.org]

[159.183.231.27 listed in dnsbl.ahbl.org]

[159.183.231.27 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[159.183.231.27 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[159.183.231.27 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[159.183.231.27 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[159.183.231.27 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[159.183.231.27 listed in will-spam-for-food.eu.org]

[159.183.231.27 listed in will-spam-for-food.eu.org]

[159.183.231.27 listed in will-spam-for-food.eu.org]

[159.183.231.27 listed in will-spam-for-food.eu.org]

[159.183.231.27 listed in will-spam-for-food.eu.org]

[159.183.231.27 listed in will-spam-for-food.eu.org]

[159.183.231.27 listed in will-spam-for-food.eu.org]

[159.183.231.27 listed in will-spam-for-food.eu.org]

2.5 URIBL_DBL_PHISH Contains a Phishing URL listed in the DBL blocklist

[URI: symbioproject.com]

[URI: perfectfitclosets.ca]

1.1 URIBL_GREY Contains an URL listed in the URIBL greylist

[URI: sendgrid.net]

0.0 URIBL_RED Contains an URL listed in the URIBL redlist

[URI: symbioproject.com]

-0.0 RCVD_IN_MSPIKE_H3 RBL: Good reputation (+3)

[159.183.231.27 listed in wl.mailspike.net]

-0.0 SPF_PASS SPF: sender matches SPF record

-0.0 RCVD_IN_MSPIKE_WL Mailspike good senders

15 GR_DOMAIN_SENDGR1 Received contains spammer id (sendgr)

15 GR_DOMAIN_SENDGR6 URI: Body contains known spammer URI (sendgr)

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

Subject: {SPAM?} We've updated your estimated delivery



FedEx

We’ve updated the estimated delivery of your shipment. N/A

Delivery Date

06:59:15

Confirm and Resolve Charges

Tracking details

Tracking ID #&NUMBER14;

CANADA 06:59:15

To CANADA

Number of pieces 1

Total shipment weight 2.40 LB

Service FedEx International Connect Plus

TRACK SHIPMENT



icon Please do not respond to this message. This email was sent from an unattended mailbox. This report was generated at approximately CANADA



All weights are estimated.



To track the latest status of your shipment, click on the tracking number above.



Standard transit is the date and time the package is scheduled to be delivered by, based on the selected service, destination and ship date. Limitations and exceptions may apply. Please see the FedEx Service Guide for terms and conditions of service, including the FedEx Money-Back Guarantee, or contact your FedEx Customer Support representative.



© 2026 Federal Express Corporation. The content of this message is protected by copyright and trademark laws under U.S. and international law. Review our Privacy Notice. All rights reserved.



Thank you for your business.



ID: 1026



French language rental phish from Google Gmail

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path: <33039@ppk.ac.th>

Envelope-to: dave@nk.ca

Delivery-date: Sun, 12 Apr 2026 08:21:00 -0600

Received: from mail-lf1-f67.google.com ([209.85.167.67]:52309)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.98.2 (FreeBSD))

(envelope-from <33039@ppk.ac.th>)

id 1wBvfj-0000000057n-0OeD

for dave@nk.ca;

Sun, 12 Apr 2026 08:20:32 -0600

Received: by mail-lf1-f67.google.com with SMTP id 2adb3069b0e04-59dea72099eso3413721e87.0

for ; Sun, 12 Apr 2026 07:19:36 -0700 (PDT)

ARC-Seal: i=1; a=rsa-sha256; t=1776003569; cv=none;

d=google.com; s=arc-20240605;

b=jGMxgb/3DNM4Bga2e9ya8f1fdAojc7vB2Mym+NtTDA7pXKCgP3wWqi9cbrNx1c5Dgj

sAmy6qESzKyB1+GWz7YggkGWvs/ysZyWKNoEJ0yTcOTK584g+k3O1ObO7FO/xNYGQRcp

omnOTEafCBzfYsFjKcVzqqiS5nvAs08CvZHq5/QTJ1VXbA+L1eKPSIb+UDvG83Z9QMsX

73VSrr2Qo60iI/QG9bZFxk5d76JRa/jCSBq73/RsVZN+ZckgweOZIE9AzfIeT6cS7z5k

9EA3ovQWsSsjq58X7hvLJXDDGmWiMfOeKc4+Kzk3oUIImyqqaTKHlZuU2O0B7lqnhOoP

PQaw==

ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20240605;

h=to:subject:message-id:date:from:reply-to:mime-version

:dkim-signature;

bh=cmnecNb47a9TmsOI2vIYpGIqs6BwSQ+B/iuYnrZXZDM=;

fh=CTyG2AI6b7/Lnd90Wpvf0l7OM+XjUsCR9umBXbd3ves=;

b=Y0CXyrTTHfdNLSFMSbevS0rN6uYlmmOaYcsBu9ZWdduxBh6ihT3Nak6dq+wU11HxK3

t21SJdf4d3dyHfnKKKoGi2oYaiYrjo1E/DhNebp8cr0pWkD4U8CERvr8a30w2UmLVO3k

icd7omH5Lxqtuv47A9y6ongSN9iJ5iZQ6R9mgqpC4gEEPO08icUvSy8zKHD4b79hvzqg

PIaYZbVar8z8o+qS124BLCQMopaLeIVr2YyUXCVA5JzkUq3d6b2F1/MK2alGkUOHJec4

3/QojF6qVk5dQ1UVcn6/EEU9XaIPdllKlw/Ivcj/BfJzKDs6nLlpmOI2IfzPLdgjqRnd

VWOA==;

darn=nk.ca

ARC-Authentication-Results: i=1; mx.google.com; arc=none

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=ppk-ac-th.20251104.gappssmtp.com; s=20251104; t=1776003569; x=1776608369; darn=nk.ca;

h=to:subject:message-id:date:from:reply-to:mime-version:from:to:cc

:subject:date:message-id:reply-to;

bh=cmnecNb47a9TmsOI2vIYpGIqs6BwSQ+B/iuYnrZXZDM=;

b=DESjOw234l2rEw8xGqgaPEWerX2/qHB3bQFpzx0LtFe8HI516tLDugIWtwHyS2fAI2

hvXsgv4nk6tVGm2ij++aFb3Xgre1AbPHnhRj6dbnVcbWmz6et6FpDfipFXq8WtEkt7Un

EQITFTVRiWRAC7O7Qn57a64obEMp4CWCUTHDVij3dVArfhIxWtsJhys10dKIByLScYAz

H0v6912ujd/qatqGB0LXgncSOYC8KyQivlemuHBQCtftPU9QFI5qHj3CUUWz0r11Enjb

Zg5WhPzQnkYROys1mQ/0DWZTBY6q2SkYAb7ZBItpudV6teNT3y6gMRMmu67JQan+mpFm

0kJA==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20251104; t=1776003569; x=1776608369;

h=to:subject:message-id:date:from:reply-to:mime-version:x-gm-gg

:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to;

bh=cmnecNb47a9TmsOI2vIYpGIqs6BwSQ+B/iuYnrZXZDM=;

b=E8sTkyPFLserR3YHWCsFEeGCCOAJsdBenb5BVcMryVnMQOM2Js31oJLGlrBeA9KULe

N6KZpu+3d+kbrWfZvmXXpEAeMHIrYYaiD9fxLt7d7/zL0ytP5AD/0E75hgCdZEtmgXtl

S6dpJWrULtGV5v8anIOk19E1oYleoAXcbobv6GkVa4QCj6i2TOKZzEXWTNKwAh9uuQ4t

NTgG/06/4EG5DLs4Va0f9Ne9EcJbe4SIKRb+rkDjmpizGXZC08S2BFCR4xKWa1D5TnY1

okogLEj9jlI4oqQFFRzcGQ1rlG1Vghn7w4xChoGJHxpC4DX8n1ixGIqbrKnfwtQMhdAO

fLYQ==

X-Forwarded-Encrypted: i=1; AFNElJ+FzS/KilSjhmH41HgrLfk2Vr2IWL4BKGf18lYmbBoMZVyMfKTAlczKLbxfsIX/z0T5da3S@nk.ca

X-Gm-Message-State: AOJu0YwOqgp1e02TcWEfsaq9Qz/XXzV/TqW67RL3D/r59nv2L3NOtMy+

cmVBxiyZyx8WLIl60KyMOOblishXD1Xg5dhMaJ/zZUqApwEJg9vTgyBUjP+iYipPo0eNQ75Jh0W

nYGYLtRWjs+hrzNFulTTCN/pN5O1myPdG3xHHJfWUVw==

X-Gm-Gg: AeBDievd0jdauOFVZzeLU/AWBcLpkgidK28kl2paBWD/KEECUkMv8p2TdrJEKBAqT+l

aOHMYTffChKguF7C9wOnD7WN363n2Jev+DOTnXW20z2hYRguBaxvGt7cowKFmAOihwImTdbDM0C

YZJDMiMOSd15JopMnX5dGpGkObqcEBpTih1En3yL+n6Zo2kz3gWVklEwgTOJiL1l8O3RvEHgvTN

QOkwKC4oF5A/EM3tQhbqnmlUPEYJCs1oc3qs45LZimA4qI8ayz6C/OLGMNa/vlWE2PPs8KwYpZ1

nb2FtLMfp4iLKrya9b/1eg==

X-Received: by 2002:a05:6512:3ca6:b0:5a2:a355:aa4e with SMTP id

2adb3069b0e04-5a3efb4584bmr3176936e87.31.1776003568152; Sun, 12 Apr 2026

07:19:28 -0700 (PDT)

MIME-Version: 1.0

Reply-To: servicegestionlocative148@gmail.com

From: Service Locative <33039@ppk.ac.th>

Date: Sun, 12 Apr 2026 14:19:31 +0200

X-Gm-Features: AQROBzBAn8i0h3SKV7Q9IyL7QkfrlQp3yf-qhh34W9z0sPQb-92o_Gpb1jx3VUE

Message-ID:

Subject: Rappel de paiement

To: undisclosed-recipients:;

Content-Type: multipart/alternative; boundary="000000000000ccc53f064f440d3c"

Bcc: dave@nk.ca

X-Spam_score: 8.3

X-Spam_score_int: 83

X-Spam_bar: ++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Chers locataires, Nous espérons que vous allez bien. Nous

vous écrivons aujourd’hui afin de vous informer d’un changement important

concernant le paiement de votre loyer. Dans un souci de simpli [...]



Content analysis details: (8.3 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[209.85.167.67 listed in dnsbl.ahbl.org]

[209.85.167.67 listed in dnsbl.ahbl.org]

[209.85.167.67 listed in dnsbl.ahbl.org]

[209.85.167.67 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[209.85.167.67 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[209.85.167.67 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[209.85.167.67 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[209.85.167.67 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[209.85.167.67 listed in will-spam-for-food.eu.org]

[209.85.167.67 listed in will-spam-for-food.eu.org]

[209.85.167.67 listed in will-spam-for-food.eu.org]

[209.85.167.67 listed in will-spam-for-food.eu.org]

[209.85.167.67 listed in will-spam-for-food.eu.org]

[209.85.167.67 listed in will-spam-for-food.eu.org]

[209.85.167.67 listed in will-spam-for-food.eu.org]

[209.85.167.67 listed in will-spam-for-food.eu.org]

0.0 RCVD_IN_VALIDITY_SAFE_BLOCKED RBL: ADMINISTRATOR NOTICE: The query to

Validity was blocked. See

https://knowledge.validity.com/hc/en-us/articles/20961730681243

for more information.

[209.85.167.67 listed in sa-accredit.habeas.com]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[209.85.167.67 listed in list.dnswl.org]

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[209.85.167.67 listed in wl.mailspike.net]

0.0 RCVD_IN_VALIDITY_RPBL_BLOCKED RBL: ADMINISTRATOR NOTICE: The query to

Validity was blocked. See

https://knowledge.validity.com/hc/en-us/articles/20961730681243

for more information.

[209.85.167.67 listed in bl.score.senderscore.com]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[209.85.167.67 listed in bl.score.senderscore.com]

-0.0 SPF_PASS SPF: sender matches SPF record

1.5 GR_DOMAIN_UNDISC1 To contains undisclosed recipient (undisc)

0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in digit

[servicegestionlocative148(at)gmail.com]

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

2.5 FREEMAIL_FORGED_REPLYTO Freemail in Reply-To, but not From

Subject: {SPAM?} Rappel de paiement



Chers locataires,

Nous espérons que vous allez bien.

Nous vous écrivons aujourd’hui afin de vous informer d’un changement important concernant le paiement de votre loyer. Dans un souci de simplification, de rapidité et de sécurité, nous vous invitons à effectuer vos paiements par virement Interac, et ce à compter de ce mois-ci.

Ce nouveau mode de paiement nous permettra :



de suivre plus facilement les transactions,

de réduire les délais de traitement,

et de nous assurer que chaque loyer est bien reçu à temps.



Informations pour le virement :



Adresse courriel du destinataire : servicegestionlocative148@gmail.com



Question de sécurité : Facture

Réponse : Payer



Une fois le virement effectué, merci de nous en informer par retour de courriel. Si possible, nous vous invitons à joindre une capture d’écran ou une copie de l’ordre de virement, ce qui facilitera la mise à jour rapide de votre dossier.

Nous comprenons que ce changement puisse demander un petit temps d’adaptation. Soyez assuré(e) que nous restons disponibles pour vous accompagner tout au long de cette transition.

N’hésitez pas à nous contacter pour toute question ou assistance concernant votre premier virement.

Un grand merci pour votre collaboration et votre confiance. Votre confort et votre tranquillité d’esprit demeurent nos priorités.

Pour toute demande, vous pouvez nous écrire à : servicegestionlocative148@gmail.com



Bien cordialement,

Transfer.it phish

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Sat, 11 Apr 2026 18:48:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1wBizE-00000000OB0-1V86

for dave@doctor.nl2k.ab.ca;

Sat, 11 Apr 2026 18:47:40 -0600

Resent-From: The Doctor

Resent-Date: Sat, 11 Apr 2026 18:47:40 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from relay5.api.mega.co.nz ([66.203.124.5]:47161)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1wBgb3-00000000P1J-3ALH

for root@nk.ca;

Sat, 11 Apr 2026 16:14:43 -0600

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=transfer.it;

s=transferit-api; t=1775945623;

bh=Zwz7gHjwZ+L4oNbPCJRfXivW258rSN9u0BoYpfRTjvs=;

h=Date:To:From:Subject:From;

b=Qiaavp7bYZ9b+/odYJajcGn97jQ7u/K6GJSHAYxrEgGwpMpprHXKYZk89FeQRunyU

he9dNnUapU8XpuUaXn1j8Q85jy2tOjJqOZCkoyXpqFlWiGSXpQ+gSeOdV7Q+ndmHG4

U38dS6+/OamG5UPqfge7xBwo1wYtEF0STt2eawi7HKmOVSB86ynuur7sQ2D2f7citz

IioKoDNydjJ7BzsBzLW8Z+oIdPzmN2EZD3B7MOORA2GfcaSvXTY9sMBVN8+3tnSh1P

Sew9GjXZZeC8tID49eLMzF71ciDYHCLeflqX6pue53vHuiz9UJ+FxN6fto3KxjltnX

qRZSTN1adgeyQ==

Received: from mega475 (bt7.api.mega.co.nz [66.203.125.17])

by relay5.api.mega.co.nz (Postfix) with ESMTP id 11F41182278

for ; Sun, 12 Apr 2026 00:13:43 +0200 (CEST)

Date: Sat, 11 Apr 2026 22:13:43 +0000

To: root@nk.ca

From: "Transfer.it"

Subject: Your Transfer.it upload is ready to share!

Message-ID:

MIME-Version: 1.0

Content-Type: multipart/alternative;

boundary="b1_ZILpz5kCbZPUScDS3485VJj4eDZ2C0XTqbg9kk9Xg"

Content-Transfer-Encoding: 8bit



Your transfer is ready!



Transfer it logo



Hi there,



Your transfer, “WCC443-I HAVE SOMETHING IMPORTANT AND INTERESTING TO TELL YOU ABOUT YOUR LIFE. PLEASE REPLY TO ME IMMEDIATELY AT MY EMAIL ADDRESS donaldaalan@outlook.com BY CLICKING ON IT TO REPLY TO ME DIRECTLY.-ANE858”, is good to go!



Here’s the link so you can start sharing it:

https://transfer.it/t/upQhKWwH1DST



You can view your transfer at any time to check stats or update settings.

View your transfer



1 item • 183 B in total • Expires on 2026-07-10



We’ll also send you a quick email when someone accesses it.



Let the sharing begin 🎉



Cheers,

The Transfer.it team



Powered by MEGA Privacy Company



About • Privacy • Terms • Report this transfer

Web/SEO/App spam from Microsoft Outlook Part 2

--_000_KL1PR01MB40172B5EEEFD5007A42EF283E1262KL1PR01MB4017apcp_

Content-Type: text/plain; charset="iso-8859-1"

Content-Transfer-Encoding: quoted-printable



Can I send the audit

________________________________

From: Nagina Khan

Sent: Wednesday, April 8, 2026 4:01 PM

Subject: Re: Top Rank?



Hi,



Noticed a few SEO issues on your site that could be fixed quickly.



Can I send you a screenshot?



Just reply "Yes" or "Sure."





--_000_KL1PR01MB40172B5EEEFD5007A42EF283E1262KL1PR01MB4017apcp_

Content-Type: text/html; charset="iso-8859-1"

Content-Transfer-Encoding: quoted-printable








1">








nt, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; c=

olor: rgb(0, 0, 0);">

Can I send the audit








, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">

From: Nagina Khan


Sent: Wednesday, April 8, 2026 4:01 PM


Subject: Re: Top Rank?



Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; fo=

nt-size: 12pt; color: rgb(0, 0, 0);">

 





argin: 0in 0in 0.0001pt; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFo=

ntService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0=

, 0);">

Hi,



.0001pt; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calib=

ri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">

 



.0001pt; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calib=

ri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">

Noticed a few SEO issues on your site that could be fixed quickly.



.0001pt; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calib=

ri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">

 



.0001pt; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calib=

ri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">

Can I send you a screenshot?



.0001pt; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calib=

ri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">

 



1.5pt solid windowtext;">


.0001pt; padding: 0in; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFont=

Service, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, =

0);">

Just reply "Yes" or "Sure."





nt, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; c=

olor: rgb(0, 0, 0);">












--_000_KL1PR01MB40172B5EEEFD5007A42EF283E1262KL1PR01MB4017apcp_--

Web/SEO/App spam from Microsoft Outlook Part 1

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Sat, 11 Apr 2026 13:31:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1wBe2m-00000000EbN-1OPE

for dave@doctor.nl2k.ab.ca;

Sat, 11 Apr 2026 13:31:00 -0600

Resent-From: The Doctor

Resent-Date: Sat, 11 Apr 2026 13:31:00 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-japaneastazolkn19012059.outbound.protection.outlook.com ([52.103.43.59]:35648 helo=TYPPR03CU001.outbound.protection.outlook.com)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1wBYq2-00000000CvO-1S5H

for sales@nk.ca;

Sat, 11 Apr 2026 07:57:41 -0600

ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none;

b=oCiwck/kvBO6bKK3xKrNUrXI6igoZX5IHOaLa73OswLJTRsH40XJ1v2vin6IkXtG7vJjOwRX2vm0bhYFR4b+Ce1F2VYf28vF2uKafTmjugr/p/udAbOlEJfGzK9rJT2S7YFgWheYRTWwar0Ikvz4wkT4c6LquxEWkxEMSxT0REA5uTcgpJkNeQpm1iLu5Xurwj8Ttx+WaudqUsmQcbvrO+/sKImNCvkPKjCk0ypVAJO8IoRJxd1Yb9Hw0tCICHe5l4yhHhX0bY70JHXOil/P9fmWXLNf0uXGKgD3t2z0YIgxJQJ5QmwU44eBLkqALtkgbkdncRZvBYTUqTNDd/a3eA==

ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;

s=arcselector10001;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1;

bh=NKlBXMPrJIkHL48aBgJe2wjRoW+kF1ilOzN1lTgvrys=;

b=iLie+iLPMsOx/kuREPZeqAZNjHmL1sFbK9K/AvPp9hy1BX8XggZnBjaZxBQKRaxfRt2FK1VeF5/nmVPX0eE0BxCxvDv6cut+CmwJI6cSbpTG66RpS//42YkLMtWUgTb7gRDrQmLCgYXMdbcK2pmoenvwwKIQ6KIg6PH7vk4nRgxyJhKJM4OzJXBbN6HsS4PyuE4j+Lj/O3skse5pJvlBFrp3FNqp8FauhgBK3nZYoO4qBrsnsq85pBvpSGJJFbfkFx+u7AJ0FMpVCDtT0y5V6rvsuruOBMK2C1MGeXOI6qypT9fTKjWrlUEP6/nVeMnJFP5KmSnyDX/PDjRT3eWlRw==

ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=none; dmarc=none;

dkim=none; arc=none

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=outlook.com;

s=selector1;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck;

bh=NKlBXMPrJIkHL48aBgJe2wjRoW+kF1ilOzN1lTgvrys=;

b=EpHr0VKf8JTwnKvZaMDuyxL8o5IvtIksGMeBxPTkolBbgg/oGaxWQIguMP+7H5iehkNZUkU0l2ovdKNCECtua6Ea7FtIBHImZf55J5r2uE91ktAclmKLpv4lAyUtKQb4Lb9HnVXapwaupzIWwv7MxxMxb8N/VQO2HlFHNpRzdiasPffN38uHoQ8atjAV4raykhFbxhXVR+qzKvNe0QJLt2tRxXStPXLQ1GzFNQMPlNm/Z/l8L6M+vFXqBWdQobn6lbjITEU3VfhuBmFvRCkgXmAnOlGlJ4hQDljFg3imFRERHIxjyLoCioKlTnnbFIlgJB1+bU93UeoytMXlp1FPJA==

Received: from KL1PR01MB4017.apcprd01.prod.exchangelabs.com

(2603:1096:820:41::9) by TYZPR01MB5524.apcprd01.prod.exchangelabs.com

(2603:1096:400:363::11) with Microsoft SMTP Server (version=TLS1_2,

cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.9769.45; Sat, 11 Apr

2026 13:55:58 +0000

Received: from KL1PR01MB4017.apcprd01.prod.exchangelabs.com

([fe80::2823:efd9:768:85d0]) by KL1PR01MB4017.apcprd01.prod.exchangelabs.com

([fe80::2823:efd9:768:85d0%6]) with mapi id 15.20.9769.044; Sat, 11 Apr 2026

13:55:56 +0000

From: Nagina Khan

Subject: Re: screenshot

Thread-Topic: screenshot

Thread-Index: AQHcybrTqdfdrE2EwkuNCgH98KSx5A==

Date: Sat, 11 Apr 2026 13:55:56 +0000

Message-ID:



Accept-Language: en-US

Content-Language: en-US

X-MS-Has-Attach:

X-MS-TNEF-Correlator:

msip_labels:

x-ms-publictraffictype: Email

x-ms-traffictypediagnostic: KL1PR01MB4017:EE_|TYZPR01MB5524:EE_

x-ms-office365-filtering-correlation-id: 41c202aa-c5ba-482f-314e-08de97d20ddd

x-microsoft-antispam:

BCL:0;ARA:14566002|461199028|7071999006|24071999003|15030799006|15080799012|22091999003|24121999003|37011999003|25031999004|8062599012|20031999003|39105399006|31061999003|19110799012|8060799015|3412199025|440099028|26121999003|102099032|25131999003|19061999003|35041999009|40105399003|39145399003|41105399003;

x-microsoft-antispam-message-info:

=?iso-8859-1?Q?Ea6DjsnSyhOKVZPE6cafyA246mJz2UWWpIk5ytp9OGXLN9ebqtI98THkZh?=

=?iso-8859-1?Q?sAF+SVsec+9fbIdjL/9+JiOfCQm99abAZpjgCKiGcgQZE+Hx2IX90CXiCu?=

=?iso-8859-1?Q?jiiEnwR40Id8AsE/QXaCLQnas7OQ6gA3PEBV13W2IVSbpygmxnZB1fF1gU?=

=?iso-8859-1?Q?RG1M6cNVoSrzjNgH18VtXLkKE28GpTiqaVCz76VESKM6HleTBAQ2CMe7R5?=

=?iso-8859-1?Q?22BGHQStxHXKKshg9VjPWhVYmDQu+a2R8woffpzmpDGE5B7euyewXzPG1z?=

=?iso-8859-1?Q?jhsSUSXR2RYoOoaMcbu2feCryEq/jYf9PcIU5R0PQ3e+ZfChTFUTS3kXEP?=

=?iso-8859-1?Q?yVX4cQoUc4IAnnwSoHS86dmPrtmJFVqtMHBPY8kmuATFkCdHDLmzO9J6dB?=

=?iso-8859-1?Q?Tbc26oSYkxPuumc+lbFvj0/uLBZRHcnO8RUlfqhbsQFhO+++v0X5ghRAck?=

=?iso-8859-1?Q?gjO5E//szkRYSMGJ4w0DRkovXv/GfQOVnFzI7IKX4sZXF5+s2iK3amdn9I?=

=?iso-8859-1?Q?tl8kZLZ41n+9dkVuFWF1zwHJq9LlDzjJzFmHooiUAM0SQau9t9d3YuXBSM?=

=?iso-8859-1?Q?Hm29Befy/cPf02P61DLZtyziUcRPzkI0p9F360CeV3qJIoKYBkL57hq5uy?=

=?iso-8859-1?Q?Z2lQUE2Injd05BLJEnNi0eXMZGSRumhWru+I3PdFtLJekEwbudpU5c/gfu?=

=?iso-8859-1?Q?IhJJyN/FRdeB0u6YPgx9bqiexVYaRbc7XCDj14LckU08XI0HswBDkuWmGY?=

=?iso-8859-1?Q?tOA398C7qPzhZL9kFOKlLa9xNM0NkfAVmqQslVnR7d2REPYXIXh8VRO3l4?=

=?iso-8859-1?Q?C08QYt4txruFUScaN31Y5zI0iJGdValT2+Ek49nfL9l9QcYvRaqU9jGcI7?=

=?iso-8859-1?Q?NsPs0bPalGzZxx+LqWINxhn2PxyAKjlMn8xFqiJX0A9XlyG/rRqelSJSXH?=

=?iso-8859-1?Q?JenTtjlkL4KkPp9BV4lRMB3lXigqwm8D7+vkZP/MB+wwZ/Ptl+nsJ5DGHq?=

=?iso-8859-1?Q?YtHnjqunlYokKL3vs9sDOO0pTlG7kYQDEiQjQREYShE8JyT5biaJAKruwz?=

=?iso-8859-1?Q?T0Ccqnlr62qaSbN/pSGa6COGeoXtp0xqxahFAdZzbpjLeXg49lN+UKfMd4?=

=?iso-8859-1?Q?ksPOSsl1+/sCf30SMRup6qvyD/XY5CUc6Fn3M8JsRi9eWCDwFBG6CMFJRT?=

=?iso-8859-1?Q?Cf2LhIoEKNx0zxW2E05KMC0YkRGg/J6JkCz9gFY1pRzt5ErN4BX6pLIZ/I?=

=?iso-8859-1?Q?qF3gjH3TzLph8wjptR7LuUs+lVgvkjD60pnMeG2IDRSkGpKftAJZUq2dOA?=

=?iso-8859-1?Q?MgeJB0pdDjRI2F/nHPYpFDjOMdJAWLQtd9rb4Vg2XISBVKU/2TdpmVR9GG?=

=?iso-8859-1?Q?DmucDGAQ7Z8Hzyfq0Z7Uwb98yDiae9Vg=3D=3D?=

x-ms-exchange-antispam-messagedata-chunkcount: 1

x-ms-exchange-antispam-messagedata-0:

=?iso-8859-1?Q?jm3LhYfYoZC8anGJmUrFm1oaiGpMEwmgxzVfmVY4OKHs4jwBrv09b8sWQE?=

=?iso-8859-1?Q?2cPQMkyq1S6+I9xxOZfGll1aAHa3B6a2EzbwDy38BqSRDPzGJ+fZ9JmbhP?=

=?iso-8859-1?Q?g62K2VGDakBJsxTqZm6aPoANaadp4lFUMpJGJhEXhFay5MkYGpjEEZ9lFb?=

=?iso-8859-1?Q?EHjm9pc+CsdxeGlW88vdV3HhAmT6ghKV3yGhfxrP7bO1yYm+hksKHZy0mf?=

=?iso-8859-1?Q?cwzSWRLhduL4BoHiYlEH3fC+jsw92B+Wf1WQTBFDSaYUmw+HtYEPBaH8dE?=

=?iso-8859-1?Q?B1qNnAedDbFxQ4oVhud9ctTbjX38HxmSWW7D8rPKd/Ygd5ipavthyrHNaT?=

=?iso-8859-1?Q?yz+tQ6cU9OGj8VxgtmRu7VV00TOHyQh2/GN5DIShq7N7qjIIWkrMaDlrOz?=

=?iso-8859-1?Q?scQDvAt9ja/HuI5+bNamFW64jsl4H6TMp5syzoT1g0XsgW8zBMrRjIUuGy?=

=?iso-8859-1?Q?4/8n9XDryMv7PFEOf6kUnHrHrAodqE6QlWZYGsYoKxLfNW3X4wvtM0W7Gy?=

=?iso-8859-1?Q?/13po2A+lPztVqsbrDMknE28mVBZmFbJ1X56usr1JrKxb5qvV34Pc+MwG3?=

=?iso-8859-1?Q?nvYv8/3DROnto+fH1Z9LlkaC3XsLuaIy2E6KHStUeAFAU+jAXCYJhUFVwl?=

=?iso-8859-1?Q?MbZQaq1daTDXHnOKICya0o0svyqxstssQJOmECczHPqvDdIrNPs0Rnp7o0?=

=?iso-8859-1?Q?PiBhNIyL71x/eFllOzTiqQ54UeBfnqRnR9DZ+HoNV3Hd8Cp81dEJzi4dgx?=

=?iso-8859-1?Q?dHjJ6HYjc6rVUYeO++Yi5Hh2Ichw3LU8I4Vs0DLUAhA9ymrSh9Jli89WYz?=

=?iso-8859-1?Q?zyK64F+0DsavjZpofvgMH9IzPWD93a6fKfUN7T9uDvtIvMWbFFVCIR9LQM?=

=?iso-8859-1?Q?MrXgGtfhSl084wxy9uY0tSA2ZnquILaE1zsd12bB+7PeqJqqejPR/CmAjl?=

=?iso-8859-1?Q?YkMOINkg8NoWbMuZO54tRCmDIHJS5BcAOFPMtKh5dIFwtyueu6YO0nVFul?=

=?iso-8859-1?Q?OcFxequ7Q9nBdHbeY2lLwwpnTQ1amZ4yrZZuwGrzy9A+PcMATpIm3dCBVz?=

=?iso-8859-1?Q?CYpQKm5vleaw94eNbrxczKHrnH7hzfzsrS6RDCSnugqYmrpCi04zCr6KzV?=

=?iso-8859-1?Q?snCCNH7aY3wWRlrGH4xwYWoRIDXkr3PulBe0JE0fj3uNzFp3FJsH4IF4MO?=

=?iso-8859-1?Q?5XV+xpS+vLBinHTtginZxMgTcuhxRvDqwUcKQw+2BU70umQqs+b/k7O52v?=

=?iso-8859-1?Q?einGlN1JKGmog+9U84fs4PgKFpYb0as/CX3xv9JflSQyU+j9q2tekH0Pcr?=

=?iso-8859-1?Q?jXhqUcXD7jWTqg8RaboFvW1b2nC1CzsFbJhPJkZaW/1yjo/4iuPtwMIOB+?=

=?iso-8859-1?Q?IOtZn7ARgxmLLMNbAMDPdlhbpKuoncuV+8J1fXGpWvOCIxy0MoQR5ew8Tm?=

=?iso-8859-1?Q?pljWaOdIliG2wu09o3m63FFE5SnDxHRwYR7N7tT9ITSCuafPaR6rahmzib?=

=?iso-8859-1?Q?50VnYFQpPCSWK/gdesDyLWuL1jXl55A956LDDXTOfHNQ=3D=3D?=

Content-Type: multipart/alternative;

boundary="_000_KL1PR01MB40172B5EEEFD5007A42EF283E1262KL1PR01MB4017apcp_"

MIME-Version: 1.0

X-OriginatorOrg: outlook.com

X-MS-Exchange-CrossTenant-AuthAs: Internal

X-MS-Exchange-CrossTenant-AuthSource: KL1PR01MB4017.apcprd01.prod.exchangelabs.com

X-MS-Exchange-CrossTenant-RMS-PersistedConsumerOrg: 00000000-0000-0000-0000-000000000000

X-MS-Exchange-CrossTenant-Network-Message-Id: 41c202aa-c5ba-482f-314e-08de97d20ddd

X-MS-Exchange-CrossTenant-originalarrivaltime: 11 Apr 2026 13:55:56.4143

(UTC)

X-MS-Exchange-CrossTenant-fromentityheader: Hosted

X-MS-Exchange-CrossTenant-id: 84df9e7f-e9f6-40af-b435-aaaaaaaaaaaa

X-MS-Exchange-CrossTenant-rms-persistedconsumerorg: 00000000-0000-0000-0000-000000000000

X-MS-Exchange-Transport-CrossTenantHeadersStamped: TYZPR01MB5524

Casino database in crypto spam from OVH

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Sat, 11 Apr 2026 13:31:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1wBe2b-00000000Due-1jR3

for dave@doctor.nl2k.ab.ca;

Sat, 11 Apr 2026 13:30:49 -0600

Resent-From: The Doctor

Resent-Date: Sat, 11 Apr 2026 13:30:49 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from 172-233-232-10.ip.linodeusercontent.com ([172.233.232.10]:34300 helo=mail.allegiansystems.com)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1wBYuT-00000000F1n-0JVB

for sales@nk.ca;

Sat, 11 Apr 2026 08:02:14 -0600

Received: from localhost (localhost [127.0.0.1])

by mail.allegiansystems.com (Postfix) with ESMTP id 58AAC3E00D9;

Sat, 11 Apr 2026 13:51:08 +0000 (UTC)

Received: from mail.allegiansystems.com ([127.0.0.1])

by localhost (mail.allegiansystems.com [127.0.0.1]) (amavis, port 10032)

with ESMTP id 8vV6Jgnm4Unk; Sat, 11 Apr 2026 13:51:06 +0000 (UTC)

Received: from localhost (localhost [127.0.0.1])

by mail.allegiansystems.com (Postfix) with ESMTP id D10753E00CD;

Sat, 11 Apr 2026 13:51:05 +0000 (UTC)

DKIM-Filter: OpenDKIM Filter v2.10.3 mail.allegiansystems.com D10753E00CD

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=bestany.net;

s=17269DDE-45D3-11EF-8696-F13841C98DFE; t=1775915466;

bh=PKgl8t/wY9pyHWbvBiOMBr0V6RpVdr4hIN+6IQdGKu8=;

h=Message-ID:From:To:Date:MIME-Version;

b=IlP4pZ8fZnNVSfCIKfZzYmxpA7/dGRGs8WBhuCitpWxbhXRqI8Z/y8qasB6CMk/sv

dzLh0SxOA+1dASLDhdGmypmi99jQFZJh6k6x0R7H67J/qtUbhR3bWvOTVU3pY1bCLG

/jhxiyk2Fnomv3ryaY9HwX0JCZatdIxAdGjOsoZzqcJeqE+wBxEKvyS+xjffvOudOH

yqevsxlMP8nhOxTPeliTFp9SydlA7VuTdzkM+/5vGsNpTPd0qGPFvFQ3jFqZQ9gNXb

he2pBt/vwhByfHy1Cot7KCeCB+wyvJiOOeZrpqeTOw625a22L4qVMu5/8cdmt3YAOa

pmhfEmzzOSHUg==

X-Virus-Scanned: amavis at mail.allegiansystems.com

Received: from mail.allegiansystems.com ([127.0.0.1])

by localhost (mail.allegiansystems.com [127.0.0.1]) (amavis, port 10026)

with ESMTP id qZpLhFzaJa7M; Sat, 11 Apr 2026 13:51:05 +0000 (UTC)

Received: from mppmkxeo (ip95.ip-164-132-92.eu [164.132.92.95])

by mail.allegiansystems.com (Postfix) with ESMTPSA id B392D3E0041;

Sat, 11 Apr 2026 13:50:44 +0000 (UTC)

Message-ID: <59A39B37C417387402A0982CAF7C0C741DE7@bestany.net>

Reply-To: Paul Van

From: Paul Van

To: Michelle

Subject: Casino 1win full database for sale

Date: Sat, 11 Apr 2026 15:50:42 +0200

MIME-Version: 1.0

Content-Type: text/plain;

format=flowed;

charset="utf-8";

reply-type=original

Content-Transfer-Encoding: quoted-printable

X-Priority: 3

X-MSMail-Priority: Normal

X-Mailer: Microsoft Windows Live Mail 14.0.8117.416

X-MimeOLE: Produced By Microsoft MimeOLE V14.0.8117.416

X-Spam_score: 16.4

X-Spam_score_int: 164

X-Spam_bar: ++++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: hello I am selling the database for the 1win casino. The database

contains 96 million customers with full information, and the file is almost

30 GB in size. In November 2024, the 1Win platform suffered a data breach

in which attackers copied data for roughly 96-100 million users, including

email addresses, telephone numbers, IP addresses, countries, geolo [...]



Content analysis details: (16.4 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[172.233.232.10 listed in dnsbl.ahbl.org]

[172.233.232.10 listed in dnsbl.ahbl.org]

[172.233.232.10 listed in dnsbl.ahbl.org]

[172.233.232.10 listed in dnsbl.ahbl.org]

[164.132.92.95 listed in dnsbl.ahbl.org]

[164.132.92.95 listed in dnsbl.ahbl.org]

[164.132.92.95 listed in dnsbl.ahbl.org]

[164.132.92.95 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[172.233.232.10 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[172.233.232.10 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[172.233.232.10 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[172.233.232.10 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[164.132.92.95 listed in will-spam-for-food.eu.org]

[164.132.92.95 listed in will-spam-for-food.eu.org]

[164.132.92.95 listed in will-spam-for-food.eu.org]

[164.132.92.95 listed in will-spam-for-food.eu.org]

[164.132.92.95 listed in will-spam-for-food.eu.org]

[164.132.92.95 listed in will-spam-for-food.eu.org]

[164.132.92.95 listed in will-spam-for-food.eu.org]

[164.132.92.95 listed in will-spam-for-food.eu.org]

[172.233.232.10 listed in will-spam-for-food.eu.org]

[172.233.232.10 listed in will-spam-for-food.eu.org]

[172.233.232.10 listed in will-spam-for-food.eu.org]

[172.233.232.10 listed in will-spam-for-food.eu.org]

[172.233.232.10 listed in will-spam-for-food.eu.org]

[172.233.232.10 listed in will-spam-for-food.eu.org]

[172.233.232.10 listed in will-spam-for-food.eu.org]

[172.233.232.10 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_CBL RBL: Received via a relay in cbl.abuseat.org

[Listed by XBL, see ]

1.5 RCVD_IN_SBL_XBL RBL: Received via a relay in Spamhaus SBL+XBL

[164.132.92.95 listed in sbl-xbl.spamhaus.org]

1.6 RCVD_IN_BRBL_LASTEXT RBL: No description available.

[172.233.232.10 listed in bb.barracudacentral.org]

-0.0 SPF_PASS SPF: sender matches SPF record

3.5 VOWEL_TOCC_7 To or Cc header with 7+ consecutive vowels

0.0 TVD_RCVD_IP Message was received from an IP address

0.2 STOX_REPLY_TYPE No description available.

0.5 SARE_SUB_CASINO Subject contains spammer subject - gambling

0.3 LONGWORD BODY: Uses overlong words

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

1.9 STOX_REPLY_TYPE_WITHOUT_QUOTES No description available.

0.4 RDNS_DYNAMIC Delivered to internal network by host with

dynamic-looking rDNS

0.0 NO_RDNS2 Sending MTA has no reverse DNS

0.0 T_FILL_THIS_FORM_SHORT Fill in a short form with personal information

Subject: {SPAM?} Casino 1win full database for sale



hello



I am selling the database for the 1win casino. The database contains 96 m=

illion customers with full information, and the file is almost 30 GB in s=

ize.



In November 2024, the 1Win platform suffered a data breach in which attac=

kers copied data for roughly 96-100 million users, including email addres=

ses, telephone numbers, IP addresses, countries, geolocation, dates of bi=

rth and passwords hashed with SHA-256. The dataset was later added to the=

Have I Been Pwned? database



If you are interested in buying the database, contact me on Telegram at @=

emaildba



Price: $2000



I accept only Bitcoin or another cryptocurrency as payment method.























gpcvhcgyxekxvvebkxxuulmbfpcfpaoixkbegqxsep

xzuuxidmyhrtdjbruldkaqrxqrpaucolpzpqyxjtckmnyxmss

Recruitment spam from Croatia Part 2

+Zm97kV6yCPmqPnmUUGrSkM0MMUIYgdCSPAAZA1nwzj/ESX2npbHVGQaq3UGM6BJ8Ii/yRlb

g2iVpWIK4oVfksB8/9MP/JA51Ct2Z2pdefcOlrHkcvdJWypwOFfDNHpm+ny3nUsBDWPzlCdk

Ut/ZAGqseJnD5h44ufGCGoOdlLE9NmYXElAYpygLEIg3RPQyvmPR0hZJxsMKbAGkCE14iU07

k9bpOtifSbOWeW2zlVp14eBpQZwH4ezMkuvn/PLyVuQ5SPIape9Wq822adJ4/nFG69QIVCFA

FQ6XRi57riG7WhzrY24mkcERtEtErlyH/HJkflnmJzEEo07GGwMdc3rU1+uG06WjLJy2bpFY

fuKjEUf30U9GrnqFLeFASFvykh5JC1LTm1OnK7ww3N/+hzRhObz4c9h1S+F0Gd0U3LH2opJd

QmX2/yJdNe9SCkQxiVrRkssAVcmwMmjYaxwIPArSrbC0syPfLO3tUplH11W+mO1M9ddGbLcv

jfqUziEOwdnsGn2iRg61s9oMoRjPS76rEQhXi0xZhDBsFwj9CLYeYEVoZsqh+19CYRtZ3wgj

ayW+jo6Pkuwb67C3lllKPDKzy1B5pMIQmdt/iutAVgi9egGOF7LLATnzcPMz+LJkdnaG+vIP

kmvo5OdvsmU+CNQ9oUQFUNFqsenkHXlGJ2RqYpgVROAD2nvm8DOwufQRrQxMxvmePTNFfOk3

yYewhyHAzt9juCo8lshhJoIkI+A72BcYjYIa50XRkC7CP73MD+PIU+Pqa9swJ9BTuh2EAlsP

hr8tzUgmFQL29yIeEpjxfuKGKrR+UQAY4vJHO12kVEYJdUJxCvFQa7F2j4vYtNcFMb5t7XmW

xwJ8ba7IuAZdAbd7AdauSl0v0vqbtUB9CtEHpJ/OIgfy0nGEtLQHUNIS3wPETD351NqwxL8K

EasMwhntLhJG2+EkhWbpFKnIDSWyl4D+CkdH440wF7ETu3xxnisEG5Z2qtvcqdzchoX6fDS9

6anAdKco2XOJaZyV7U0bv0lzu2Tnt7SpWgcrIVnFlQzYAczcDa2F+n1IzeUfXZoZaPs3Lj+u

x2NKtKdl6e/1Q8/dZKTiaPsXbcB3XcMNIRs3qwqj45ZZJPRyxUCGURr9qGw+yIBVfHTgziDO

q0/SRlFSheHJ04k9c2KRLaEtX2S1Go5v9zTrKiVx45Gg4jfqVzChWfqn06JWB3pjYKUO7J6c

1JJyczzRwGE5PL8vFcNBHeY/pAuVB2uLMr3q3hl7cnsjoh6NjfBsJVvMYR/p+uHGb7b3u4Tn

mNq4FQXD0xftt/6xJPehjmZEADsi1jkmtsuhYk5ITSXRF80re/OVSW7rzvxgidnTGpMbauUg

/eCIKySivp1ZMtDmb49ZUuc72jBmyLVZdZAa+9SxGPwRKo2fDAZ2UDV0wotPAVNNcGOMJCu1

rtSynG8rjjRW+SpFM7S8E0gJdOLnjyJgO8zntDiVRSKX8r0sz4dAIAvqeq3LwIhbaGVQCSfO

nsSDfPQ6Grzzq0NqaMaTeL5uXJygNtavf1coD1w44nbVJmomqhhE9WNN+PdH63SXVtjZF+pn

G6l5vGMVOMid+PVbgcISBPEyvXWTll5pG2U2McEClYZuC6ewvKOopRJs5g5QuP8HmhjtBkOT

4ookLn6tYe70DRY3I9/5F7NV3f29s/ZCQXiVYtd+DF25Ghscme6ESe2jDbVLCRT3QNIKzkKm

VNnge0pqDPC5yrzc0zzHD7sNuRbVnbOmHRkknFL7febxS5BR53yLbOVkxSuCNvPIBqxqNK3E

y+lWm7M9IejwC27LscszMkFjgHHw50LB9kyM1W4xlOm1SO5NUjZcB0nDRUTaRPZTRaz2q4jQ

XmrM+ZliZs6pKVRMQPmYVMqmcDQG0mr2RkfhGEpFzmwPlNiPOrF9nVpJ1Pdh+c9bQACT6cK7

3X9mSketzHZTZu7e12Q5Yt60gclArX2BhFGmKdUjiExttSz7YwHXMgprQgkwon9bmy3346be

koaiJNnaceFcnh1rs9F8axpbv1J1LrQbsxP3JZvwxbCQAAj9aK97cG1wUkHGxkvvws4+qarD

F9oh9CqUFxzhRISwfWDoZXxcWpf9bnJT5dVAtjPz1Nt/5+rox3dsp2anOeR/dlJf94wAYDMY

G0Lh++jrGralC1zGivtM4zSvjcPcvaSygj3ucy2WavmJK2pnWokK/iYsg43OEIORTKyBETG6

kk4yTe3+q6p0Xqv08zQ2dtwbr9F5QtMER2E8zVHhb5HIJm3TbpWbRZhmb14FAzuIcwitfaUl

96IbhAccWjb76diTcIrc8kztreiaOHnVjjxmoDii1IM4puc4zc9QGJaRm5AaVzViilhIVaIn

ZH/KholxpPD0855x7EmEIVK5cjamYmbwyh7x6c9kPwHdxxoXMrlpHlIYwes9w3ZL+ZC/n1AX

CYk4fPqFZlfWfKBKUpTC8W3aWUxbeC2H1Q2hOev4yOIGqi0PvSq4eGsIDc2I9pvgdS4yG0lh

+ov9axAzZavJogw8I3hhBFG8hte2RT2ifSvEiIAIJqBe/EPz6g/SUH7bPyxZ1SzeTCFmK2Oy

48yYzJoGyxfyXVMOfFF0Cvd8K11apmCY4U6Soci6WxOyg/vlpJeJgtCTeuq/sS7oFZ+OSfyU

N3PxvwDajWA+fqQaTIkGRO5b2AXNpWpCh1Ih6KFrIE8zeZKddn0+PBIN2QK68b6213GKBqaK

MV0Gx5jZNLcqidxbngvZvLGSWyJza9YlDZgQF6g30eUy/ls0kd+Aj8kWy/PgK2+oUBzUjWIM

6pOU3wqjk0Q8wSDcgx0lj3cnOcdWrUsWag7ZGsww/WlnYS+ja9NTKUhVy7avWgbkg345SXlH

NrQBzC3tnaTsPm5dBbUy7Hm2uMAC9Hvd00tTzF+xtHefynQHoSa8M4fDTqoxtgG62SUjr/bD

Dz547SzdONlvvd0fc8kpeOwoCiyAJT8bpuEJ7A+JKpvgUp5KSwX4+mUBtpfi400p7Rn2PhCv

Ma0ss/KjTfftYXMMfjFcU7WlNOCqmsPpy1AmXFztWeEY8DXiVop9/5uCqJfVRA9Tc3jf//n9

U4yM72H/Bzq22F4xv/p+GJ1aZnZTYVljcHgR1IuFDcu6kRQuKN0NJfRozeoMOcVFMVdda0hT

3JjwFf0HUMbLfPmSjbsWVLOA7R/hRS9r9P2ajqHAn4GbeOJGVIJnIW9gci8zU1aR/6al3jex

IjSZ/uX1TCrjwYLou4LExIq325qmj3LQm1xJROZIaatGDDg9+TllJpS/H64LefpsTocExa8t

L6mMVz0uHOmzDUFflfb9BcXF3kWcVDKgsxz6oy8mE1Fq6iuKBansszI5A/SGIqEBopIOiSdn

fJFw6dvJQZk7MHk4hzOfwqNVMkx7CcBIL9nyC8LOVPV8qRY5jLy9Fq/I9HiAHYwbKoHHCHb0

wvFF0ld0Pz5638e/deXx0Vji1aYmHEN3hizhSKgmD20aek1M6OWyeBIbGg+kFvQ82mMZZuWE

FHIh733JCJJUuOmb10gXAqaMFuZn0DkEsDTb6FvMJx247KMmYRWPkIp313SHS7nsOgUxXGTQ

7wHhI+fOe666cVaEB1ixAz73KhKI8zU/Hz+wZr95IXWjkGCHniFEgedd5bh21RD6TDOl6LC4

OFfwVvvSz2F6MApFTqwQBxiTGjY/c35BT4TZxmJ2GMHnUBG0sp7mCYjLM2hdQ0ma3/khdHQr

+IZ4J3tGeGDrV6gpQwkT+2COIy/HaxVbEfPw76gNsPeilMSsRAJiDcCjtJ/PijF1pLjybg/l

BqHp1dDIq1zactRClnTAG1vh5VfO3qZAgTLLRbGYIItDvbsd1rYZLSiDym4WC7flzhm7l20c

QwaDOt0QLo6Z0S+r0y0B9kx3CYuMgPcg0icUOmH6idUuXcDVv4onNuNc3BnEbL/IYaNUSfVb

FxboWhdiVpdzkXP01FpUyDaT6HKZEJg8FM0aPmZ+lYwM0REjDItYOlGv1rOJGt8zgpnNfvhB

ZxJLlGuPKAsia3rJcfNX51jCdDahvCvA7+wHhdxqul89R5Cw0sDbV3+F+aCOHyBTf3pi+J0e

CRdkw4DeizD7SDv1pzFWgXB74q/KYMrWAtIHUKK7+9LpPzWVVoxXhBXQBc988iF08i+EDx4/

kqzqDj9mxizWSzbEOoIOq1o71fN5sZXXS6II/vkGyBN8EafyjSxIk86pA5sv61LTHbc0kWNC

uTAMjPeG9udyNSlioyfU/4yTq31kwO/58gxPREe26x+HHkg5vcZdJM7Po74Ye2rocWxxm20e

WbZCtMTglgG83gR26OWaWhN+/tw7VmoFPv53xJk8/ygzTsZTPz4xH9StIUhFVcMLQTKhLcrr

Ist2f46RmAoNimlbMAUEsc8tA/rYRztTOZ8NSYroyuB5C9G2GW1DUoujxZRNwFG3grtKAtNS

X5boCN/z8z8qni4z7OUUS5Vr4ND7WPYD8Vi4fiwc1Yd+bPJ8lluM/t/7FIjd/o0Hynyf2nYA

BvV5vvs2e9315PbagJd7AaFRs+5O0UZcvlklMw00SFPwjjuM27evJvkmdekkg5hAj8xsykk6

bK8hLMAL1fpwpp9BiS19UGD+RCmSpi6QUUmtw26uJjvYE89JE249c5QjDGvW53KZKZILChhf

PomvzozXByZoaeFJDYH/l61UaxcEqbR1W18sUj9u1jc0JtXWXZbrcdLyH01h+FTV2vDCaUBQ

9pBERlsZoo53NX58VOBqi9/XAlGP/3zcFcIFcc2jbY7fhWPnqdt0k+8f6sE1pHNHN8xhWrni

AlmKUTK7ulab6F01295qY945NAxc9pymD2DNxrGwtjf0hIlPY6ItirsXB3aeh5pCOJojIFqz

f2NORS+OTleyoV2cySN9hosTo+gMdU2TTbNSZhNGoCP8SAPoIXurx7oCN4XVCKJDGPjfCYy5

RNzOiHKrtbBJsUpLr+kEbP6DE2LI8kLHmLJQlBLRNIoWx5/fdYFPzIWZmNRRnjJZhkEYcUpr

ATZphrwYBKbM8ONm/Pnt9tfmXs5N0jvkK8XfZv1Zf+ieH7sOE/qA0cAQAmAQzauaf60XoY/s

40vL94E9AtgTF4ZBgBVK6eVScykZWjONsXf6E7zd00DC48PhyACndNoCOPEx2DMYItAp+9nL

MMeYWmgRlt4n2OOxyeWlMxhpbDN1qCTv8eyLSbD+EnIoogaRL0C9pVTb32h5R519yDJo/mqt

MeY04FVMDX5ZVe63AtHtw10VobKo+mKyU40AYVsjrdFGlgoyS5cLPuEb2cIuDsSR9sz4HICy

k2dEmftu8cZcJZ9G0rGaTmT4NFMYgHjsf0IFahD3+OMMDMLbNDrpEvjONp3HPGK3dsFrIXCs

w==

IronPort-HdrOrdr: A9a23:YP2atqFmJbrVhRPPpLqE08eALOsnbusQ8zAXPhhKOH5om7+j5q

WTdZUgpGbJYVkqOU3I9ersBEDiewKlyXcW2+ks1N6ZNWGM0ldASrsSjrcKqAeNJ8SKzIBgPN

BbHJSWQ+eAaWSSxfyKhzVQPexQpuW6zA==

X-Talos-CUID: 9a23:xbhvXG/S6/y+jSZv7aqVv20vKOEqQEPl9nbzGR6YNWZtToDFb1DFrQ==

X-Talos-MUID: =?us-ascii?q?9a23=3Ap5CtYA7Yw8FDHvlIOXAo3N+pxoxUs72uVmwQv69?=

=?us-ascii?q?BkPeEE2t6MCmdywSeF9o=3D?=

X-IronPort-AV: E=Sophos;i="6.23,172,1770591600";

d="scan'208,217";a="11734563"

Received: from unknown (HELO mail.zagreb.hr) ([10.11.7.190])

by mail.zagreb.hr with ESMTP; 11 Apr 2026 00:51:17 +0200

Received: from SZGEXCH01.win.zagreb.hr (10.11.7.190) by

SZGEXCH01.win.zagreb.hr (10.11.7.190) with Microsoft SMTP Server

(version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id

15.2.2562.37; Sat, 11 Apr 2026 00:51:16 +0200

Received: from SZGEXCH01.win.zagreb.hr ([fe80::d721:7d23:e5e7:9a5a]) by

SZGEXCH01.win.zagreb.hr ([fe80::d721:7d23:e5e7:9a5a%14]) with mapi id

15.02.2562.037; Sat, 11 Apr 2026 00:51:16 +0200

From: =?utf-8?B?VnJ0acSHIFZsYWRpbWlyYSBOYXpvcmE=?=



Subject: Service Request Inquiry

Thread-Topic: Service Request Inquiry

Thread-Index: AdzJM0yXBEz6WhFYTru313amgs/rLgABg4bAAABkizAAAAAMQAAAAB2gAAAAGdAAAAAZYAAAAB2AAAAAH1AAAAAesAAAAB3QAAAAHAAAAAAa8A==

Date: Fri, 10 Apr 2026 22:51:16 +0000

Message-ID:

Reply-To: "Minato.N@tanaka-kico.co"

Accept-Language: hr-HR, en-US

Content-Language: en-US

X-MS-Has-Attach:

X-MS-TNEF-Correlator:

x-originating-ip: [10.11.7.31]

Content-Type: multipart/alternative;

boundary="_000_cc733a5f28ae426fa1a8dada9561073bzagrebhr_"

MIME-Version: 1.0

X-Spam_score: 7.5

X-Spam_score_int: 75

X-Spam_bar: +++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Tanaka Kiko Co., Ltd., a Japan-based manufacturer of industrial

machinery equipment, is currently expanding its presence in the North American

market. As part of this initiative, we are seeking a qual [...]



Content analysis details: (7.5 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

-0.7 RCVD_IN_DNSWL_LOW RBL: Sender listed at http://www.dnswl.org/, low

trust

[176.222.33.4 listed in list.dnswl.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[176.222.33.4 listed in dnsbl.ahbl.org]

[176.222.33.4 listed in dnsbl.ahbl.org]

[176.222.33.4 listed in dnsbl.ahbl.org]

[176.222.33.4 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[176.222.33.4 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[176.222.33.4 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[176.222.33.4 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[176.222.33.4 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[176.222.33.4 listed in will-spam-for-food.eu.org]

[176.222.33.4 listed in will-spam-for-food.eu.org]

[176.222.33.4 listed in will-spam-for-food.eu.org]

[176.222.33.4 listed in will-spam-for-food.eu.org]

[176.222.33.4 listed in will-spam-for-food.eu.org]

[176.222.33.4 listed in will-spam-for-food.eu.org]

[176.222.33.4 listed in will-spam-for-food.eu.org]

[176.222.33.4 listed in will-spam-for-food.eu.org]

-0.0 SPF_PASS SPF: sender matches SPF record

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

1.2 MISSING_HEADERS Missing To: header

-0.0 T_RP_MATCHES_RCVD Envelope sender domain matches handover relay

domain

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[176.222.33.4 listed in wl.mailspike.net]

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 NO_RDNS2 Sending MTA has no reverse DNS

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

1.9 REPLYTO_WITHOUT_TO_CC No description available.

Subject: {SPAM?} Service Request Inquiry



Tanaka Kiko Co., Ltd., a Japan-based manufacturer of industrial machinery equipment, is currently expanding its presence in the North American market. As part of this initiative, we are seeking a qualified Independent Representative in your region.







This opportunity offers a flexible, part-time arrangement, along with a competitive compensation structure that includes both salary and commission. We believe this role may align well with your experience and interests.







If you are interested in learning more, please feel free to reply directly to Mr. Minato Nagi at: Minato.N@tanaka-kico.co for further details.



We look forward to your response.







Kind regards,



Vrtić Vladimira Nazora



Independent Recruiter

Recruitment spam from Croatia Part 1

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Fri, 10 Apr 2026 19:19:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1wBMzm-00000000Gjr-2Vky

for dave@doctor.nl2k.ab.ca;

Fri, 10 Apr 2026 19:18:46 -0600

Resent-From: The Doctor

Resent-Date: Fri, 10 Apr 2026 19:18:46 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail.zagreb.hr ([176.222.33.4]:6893)

by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

(Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1wBKhu-000000002G4-3OLZ

for support@nl2k.ca;

Fri, 10 Apr 2026 16:52:19 -0600

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=zagreb.hr; i=@zagreb.hr; q=dns/txt; s=omotnica;

t=1775861531; x=1807397531;

h=from:subject:date:message-id:reply-to:mime-version;

bh=FvktMUo9r0ateNNQY/3r2kEN2cetICdmTeMNDTj/pvY=;

b=o9urFCKd31AkeKuW0tbK/TGr3DF185qQ+Q0yeCD8LwIVdqmU1KFry5pp

HAsHyZvW7BbSR1UIRxHNtIFfpDdynljgx3MrkfZK9pwx04Cj3hH5LkxcP

p2BdMyFfsyaRrtgqd8HQngqaLy+3sYWsfdPlIMYXwvHAVKLKuRBuFHOaj

P7z/JqeKX7OPdv88Z2c4JkVRhgJ1xx7nphTmj+ahxjWkA+SwsfXGOyB8H

38RyUBddk2Up9hM4GxFvHB98kXwl4+Q4OD5UL47icbw0CbSFTcQDwq0R+

EheXDnxN1vglAxSDSIHJmSFoZrPjqE+QzMpMSyIpLkZpmnZqr7Uq5Kgqa

w==;

X-CSE-ConnectionGUID: KSZIgZVPRiKR9HThlnU8Ng==

X-CSE-MsgGUID: T8qh6DuFR/CVhN/bcvh/XA==

X-ThreatScanner-Verdict: Negative

IronPort-Data: B9a23:feXhuqoVTKgcgxL9tlTDryZOP6ReBgzWbkXIpnL2NzP8mNGAAz2lo

58oTP6E4RlP4jRVAs+djXVAsx2M8uFGte9XOSAdHXkEQ14TXtGTCZkcDKDih+C2lDbnO4ugF

5M25VFqJH7o6q0H/JwHWjFnAt5lyg030S+jH31KXffj3Cjz0ORWvqT3DSHGVRrxDB8VDJIcP

Fg97IyIm3hnSKLlie2LzFWwNZLaM2Jp16aRBc+REqYIKcSNAuggnxyS0kAeMJz/FdyBD38f5

HHRXT4zf8gqAIBvfGRzhy1hzceTSSUMLAw43GxAwDL9CJ0xf0CF16SujtkT7dF5C3U+S0RXn

ANcJEkg+VP8LTZWU/QPwIXBljJKVBLS2TcO1tWwhUmUYiJS5xArGXdfqsJJhlhhau0TM6d5P

waD7Jt+OocZMI7IWQWq9/7F0VODm1+mKxdcDvq3Q3xOqFWxVQFpdDOP0pfPQCAmG3rUQlup0

j2P7v1Z+rs39ZaIDAuhlCkdC2wLzm9k4GrOFco6Uj2l/OaMG5/lL+8LLkxUlWvsUlwqmXC2c

M2msIH89JxiKG97QJ8mn4EU0rmRatHUHpWYm44h7c6PgktNHDe1ZIwlxN9Q3TZm29cuy1Pqu

CtjI/ofOTiZS9UgGWhr3pquNZmTyAmP2ORlvNqtYXYU8X/ES5B1sYvdP9qcwl17JHnZgwWwM

2eCxwowk/LCLfRQrZW7rEelyQ3kOlWNZjoS3AbXmNIrDznuMISSScdPX4x4bIwbM1MKK0bUu

P0XvJDjLhUinM2WL1KGwyK4rm4l5COiQIhgoHciWbRncuNlRi99hbIOAoQeHONW43Gmj+fhI

yDU/FzpZmJlewwS9ynzZ0UwCwS1JG0IfihxFEJGmTvOYxTq0AbaSzOMcWznymj1dmjc9QI0y

ZIIWgVC+wzBiv+RGQBBkzQ99IN5s1K3J3S7RCMRXMuBsc22aOyEQKhsmTCu6b1Zro/71IiQ2

SAAezPYUShRh9l62jzkgqLjCTfcaxPqmiS/SyOIPxAK9GaAj1uBrTbEGTSPPbu64hrx/m7Sd

SO9AoA5VwGnS6I7z/IMjbsGVpbFJGSKHsNvpSC5kPjgr5HcXsPikmZHzu+6kxsbKnprSVHvM

f4pnkjq+g4qDwt9guW/XmqdO22Zq5y8mG3XpghT3wyOweWu/IMfoblplC5YO2gXPDN5SCKG4

9yqRiqRZy70FW/Yap8Ovfm33e+KDxvYp7b+y2QBlU/lxIxltIQQiFkTRui1WdLWYTixvVZvM

YzgiSFLA8TdFxelQ4PQcDmn2k33bjmySArnVzGfOoDCGYHMru5KcA6oDcI25X1SpJu3vl9lA

mRT8s+zhWRUwKVEbiNv2Oa3DOm+4g6ENMFRy52V1jCKI1jWNpsIerz5W0tDqTGKZxFioE5Zb

nzZ/hbM1xxM5N2aOvb86GLJ/MT1Z0KOTFHvQ3aG49xdCqrn0wSn56ImNVbOpxYn0FkM6V3tE

uRrDS7sb2P04//XMb38qmr1F+ALUpHuBvN9OZCAaeMopKeK5RcZ39ZR1AVk8eQ16kJqdcU/q

Q9Gs3u58ZWBpN4hz5+BKy3XUzbmN3QamwGT3VyUii808FElJCBRokuhmnYaqFwbNV79tgbZo

cKFED5pVCBvcOXHQoCIfW9CthgzqUra0h50c1sNv2VRsnaNcv6CdrlZaKS/xE1skH3muj0O7

zJ5kl7Jo6dcnyi8gPwnaxbq3y86kGfxo2JspRP2wwSXPQSDb9gZq9/4vg9Uof5mA9j0bkoLi

JRXv4a0AA7ys/SrNNvMvfzDRJWq8i8MgcDgxIvEFweqd97u/eko0BQHUqb0Fn28383lNyQeJ

WiN9gWK+gi3xtgg7vkVVZeBz1v5jeRYCYy1OlsR0GyaJeU4QAbatBbNYqVXF2m2xKtJ4GFe6

dx5YrKmR2VrKR+Ogl/Bv2sKc/hRlz75SLW3PattMSPlNwd+0vZJyMzfIu9Jkn/xtDF3mP2ox

SYxxM51ehw5umfv6r+DCDy8UHqKOaraTyd8wGyQAqUn0NzWH9iDLyl/zyZGPVa1SGWZXyRzY

FOpKK9uNrMSwdV4yT/DaVSoRjRxPqxYKG5Q5FtUBDgsfN7pN6bmA2XPJg1CzF1hZiJdQJ9ON

zuCh1sfWCaNcCluF/saJFELqQN++3wVV0v4jJefg6m5ni+KiH4oNb6k1u0H1ADNahj8OZsPL

4hjDqrwUQgRJKWSLDM+dUwe+IH3Pzoj7zays9iZlAGlXHrL1awdXILx6WV/v8AiGkP/OWQj/

zOpLL13yGQpqEedZjGkeme8rEVJXy/c/45VKceLzl0G3flVJis3Zohd9ILCwOZYmidrtsY+0

Br8A7NUljjkYpbnHzrkW82mKSXmJn80soUXjM9fbgRkUfJvpMaQMJkm2F3y83mWAsPqq81DM

ruB16yRjJtVS4THDTNcXbSXiq15UKoAx2ZDE796+4f0KkkjAb0ljlQEui7EnVgaJXCbcEsww

8Dwc+Z9c+xQ+6b/uHeqWK/hw6RhDcJpEnBGk/DdKysLqzQioTtEB5qQaZZJBmEzCip8q72Xx

pd/N4lr6V8MxAWstMgQRD1OPCfLeZ7sYoiAzBKWfaf+whE100mCwLwjPuXUm3pGcgfhk54d3

4UbGblcrZbENMzSVvM3OTIwz5f6H7zj663rRSiSdGqaCBHiY52E44A0llMsFsqIdvaL1OErM

lYWI78N1aDZ6/XeNk7xri55+h6r99eCEm+ZTIyto21tDs5J5lrFqU5rlHZq5zSrX/NwPuqHR

+AjYDPwbRC/yw7nxlVhBoAPkouyKeoUo9MickHKhUrTGFVzQSvbQsEO5UzIhi7k3PM7jmT0U

G5ZLjkxelfpboHc0HuveNnxYbO0P5TXAVSzYWA0lnojEUGc7PbgXY6hXWkzH+o0XABoNRFSx

QYgx8D0qM8YhDpxwehJZrATXXdziwNT1zGSC+8CpWYiPbxRrb6mj051sE8D0tQotUKCpXrHn

CK5kBXRqdI8yANZNc4x8uAN/iUpzgsV/NujpaVZVOb5S8oUq4qrxpHKoEvV99CU3j4zxKIeN

Q4/T042VLWWKHtxYJbMlGSFilKNyhDO2bT6kFDvHduPkIj3R+cCV5uU8retjAF0VztPXeA4r

fMq3ralLYKP0Fi8ZlHXTFW+wvqL+S3emy0Op7fdBvQztH1rpPw6NNjrINj6gVxArQU/RfjCM

GnNdUmT5wqrSBVXgxxAtr5Yj3mJv6GoiRJXCWFrwwMzJMVUEeN4sy99aB60BZdldKAMLWVQF

AXEO0X21BKHvt7m6PFlE0tRLWo/o1bdjIP37S50+WMg4EoJbtFfw4lBl6xt8DvlDjyQlRin3

HgxvgwAeKGoFSJGJM1RkzPQdAvbl4u0FCumvtLzrZ4KnlzNjyLEoppsKOm47WHi9fD4ARng0

VFM/6duVKchiTg1DZN1eKCIKL2BAfndX2/kIQarHun/iDFdkyA/seJygCM1T/xt89WUucBtO

1zv0U7xpLEkBJH1I8P1BHDgwqQxisk4oLQ42L+V8FBtr3DDtZxJka5busUGzWDmx/yCWsqsK

2EWm1c2S7lHMSJQbG/vMD+7oPo1QVgC+CM86KS/61/OX5zWtONehDKFiHDkkwoD3tJDE84rb

m+GKeT2Brsv2zhZnozkhNnF7hpNRex30lSLNDVdQbr69i4lRiBIH3V9MTXrHHWhgn7dU2bJp

ErygafT0ev53y8iSnkgnMWhpfANop6CaSp/0gSFbekJeJKV8eeQIdbfWTgrHplWslU+77Siw

vMSIp36FnRsW8DP1TtvuSbSA0DSya7d8zzaWH2f8oRornOidr4QM9bUpXVQV9pHENhkulQuP

UIeuFOwkLC4q1D/7LEwPF0t+9xqWVoLA2lcz0spukeziTeA0y58W7zExVlmuvMJfGKooEdj5

H+UOMYMPG/h1+luNWlqWGNANdqdrr+LxObJS92CDwLF4iZqo6iYlYVFbpx3u2LjPQELrbaOo

d/GOqyQR+7kWWEb33puSUEuvyx5XHsE0LaLNdQ8xJTwjLDwT81L9ehtWAeKBXRAazo0cvcPF

P60Xv0pTmrYHKmgmglsiUhCHnTpOFpfdnUH1u+qB90E/CbP34DlsK9a9FmzmA+mQoiBle1K4

c4L/YD5b/QFORMKHvue9oed7CduglGTDu2b5JCJxidgNaga9AqtcMKtBXC57fSOVKeLhzzbl

g0x/v3wjVsruS86lAQLBaeDf01jRZxUzteY3CAT826TsI0xNbgsHsjHNJH3MCsRJiWnALByV

nrZJ6Iw1mB6sJND04TTSDdKS6DCxHAJNb9PNFxcc2QhMOyVzkcKG4d+K8N2PQYKJDbcds+cc

3O+bsRtQd6NAFD/sj1a2g1t/5Q7WAeibqb7TUghvS6pXJe8jiDDpC0L5+qjMxaghT1V6j+z3

ILLIYv+xPxjHpEJtkhd3ZIhIQo0IbKtq76QIJC2e1/H30DhInCBMOoxhUvyuunZgbhJ/u8CO

2Rhk5rHTPEL+cZf1XgYwZOG8nu1IzPui9tAdWv4vcQkKwrUuv2qcI15Z7W4kB1MGAuEERGRl

c61XIw58t46+RThqlZdzLN1vhXpwx7NSePauDzSX/CPc4KZPNvt4ThUk4qDN8v0LduXaghoN

5/QAKitkKqAsn7wzen14jl7FyZ1t1IaWpKJVq1PHn4UWJqUiyx3n4WpTVcToQvfZuBOZb6KG

nEuE/vjnzaytL3PcywDQaZ4l6oJxVH1HFOslSjVSuiKB+K4V8B4R5ZBOSKrCMmKQSnGS+Af1

RjVmLSCLf56yUf40uev4aOt8XfYHFwkQFW8sYI8svHuCu8WCEkHeLFUDPCDBpM2gyJUHPWlI

J/TzZ81DBTZdjbNC8+QIJhvQARaNQoUhSxsr4JhGA6Sfu42Qpff0IwyDcFZQmLEhtix15TY/

WBBY6XOKiqvdxOL03gswnwPlmoGzzmgrh59lGzKhQaJlJoA8DkDJGANyLzp0Ym5v0KyzPj0V

3muYCcIY0JON0J13H8RM91YBL8NGv6fmxWpHtCXRZw7wjOVuFM9GhuZ7djFFqseODWsgmGuB

U8IDA4hiruS3GXqcBTZOMT8TnW7QR+MFkx0Bss3xcu8yaejWLROWO2xFWltdqLvvLlsHkAtY

aDO66JNqp9EHunKeTzod1l5xIDzh5xsek4wrzhE5pA9HMk4wIo3NwSfnzEerMkwqQwLhaNOo

5c4exF8DSimbTCszLLiy3SDupCUdILoKyvIMl9qYjnY0dfslsQXa6BczYBQBZJ8dYeGNBjVM

0nEtmFF4NeOpUCLsmt06WVtDrgACwNfcxYCPREtqrQuCs1pgk8cqaz5PlyMJI5grD2y9fEZs

aS2D72u31FukfqBwzBIduBXKMfTIvGGWZRi9heXDz6gLgNOxXXRnlXH9iitdEiXdwGuSYk1w

yjnksSkOmoz/e4mudbFesJvrRR4VD1Dqr3fzYqSWK32OccxDJ1QQ6QCgmgVYvv2xrjIyX+Le

QhMvhDbCXYZOTUWL/VhSq6Y+YwUbDmXUiw8nGxEfCaNuHK2Ob1j6f4HVHxKJdSJTcZidNaRZ

py7y62/llJVePen42gAlv+s23jyATHx+AnKHNZn8fjl3QeknRbP2CgPdKXpPDXOP+WVnzPXd

QO16XurimOYOUfbZIGmSVrs3SY8JHRam+Z6uT2m/XDeolk9qM8NIKQ/3aWweiDmesXl4vW9z

t0l2rR7Y09kw77sjAaQFYZ3rpzPVy4Hnoa2QRzqfekD3zDLOJFUsJiTXEQRZj1HlThuerTLC

rmHTpZC6+zDgru0uSyfV63sS9/fFCYRErT9858CHygnLzT9+g59K0/mskHQySOVmlMoF8Uzr

1iCwgi15lJYDFj7VRdtlAFYIlv/htRxdDVub83M4H0OOS3G7P4JkDM23yC8g4UykbkTl0eRC

G0T+hcdb1xdyVGcC+52ljW+ZGlLXewxLfI5Ho6wSshUOrFu8i15tUtX4hTNB33treS5gJnIS

HOgG5diVKRlsnqDKSIu8avxLaasWvoRXvRkeV4z8KUNSdsUDVLuLDvxuS45wb0Nml6HFWVx0

dBUSoO6m4U8G7PaNi/0zN9XQbGIcOSR5jUkQB8GlOFEBIpR6eHC6POYfoD13DX+db1Fd9kJr

4vW/5MhT0vOtysi9OfqluKZpkCt4dA3y3GN1qs97F1JwbGb4U8F8pFcVW4mp3XLAT8T1ZeSy

8AxLHSZ71PT2MuG+NpFgCK0PnfODJdVBc80189SH7ZWRdHkdCXIrrhn/53rKP8TPnHSudy+S

/m4RMxChju7k45rnJTmYN4Di7qDvIxVVDbvy3zbAJCSaZAlLYl51MyFaSV50GOwYD+WTrd9E

sCl8Hl7sx8tTOoWtLRZ5O2N/Y1djJNlB4ww0sCbsz45J6ViyoHHwyaUxtSz2XBY0LlAxpkZg

KzSuYjOLP+oAe+UhQMhknBgf6uN6twg2j2zdQxBdQ1WHUbywRGkls2YhXWKpeWrXQ7OUMNRk

t5eNH4Hj5HV0ZztOCrdihQTN6NyWWYhyJTbJ9y64Vo0XkmHbg0TfW1LK8/NbzSdN2GDiQY6b

ARbNaBRgBxzH71ZS9Q7rvUQpMgNnnryLnfFjvWPIME4tB1ptuXNcrXaWUAiU+fQgw7XBiLuV

6MOy7NwxboyaJWV7xMXm3Ef8pKTu6h4FFduGsysboCRXcaRvwYZ5GLrJwyclYLhy8dRTg5kj

pJcxfwJO0TDJC/0efmKZxA02pqHHWuPfg2H+/E9l3EglPDJkFxu4+Vrgt2T3lL6OAbglgaVV

TAV5Hite9g33EXdVHGPmfEO9d8iJ4CvxcjN3QnCoACvnScDPQKP2OmPCUQi7Sn5d9jhe1ewa

3Vb1MLydeEJcU3/SeUJ8I4hzYQjMMiZVy7li/ly0NHnMVDHl5k2qWJ+CxcXJg5jH9EqvvA30

M8w5qYgwYgmyjC6egm7YzDF8MKHFKNOAwrG0BQNBi+3CBR8Ew4jvNZEaIf9UJs5MLncv9t2M

XXUpI1L70+HbK00s63+n3FhNHGK0dw0Ak2jFgGb8SSs/TluyWRxl+PIQHccmoWpcHwoADNOO

FJKDrwZDT2V2ScerVVmdomRIQjpRzxTzs2s9B/ttxS4R2VRlbI60ER7nlJvPCKJSGVzCyaYU

Mt+SUgOTl5DQeNNJJpiGwXbTDS/FD3DSQ8fvWeu/9qZrjusSVj8Vg0YG8JHCQSf+DpzLGvM2

SJVzuLaFYC+8LF/o5eMJBayEBWzckG9hpQ92Ubn/ZiUmO8ECPYMePzODayzNCsv9iW/VnNvs

QYYz4uy+GoDqiPuCGyUC5uAVWIzJNlQzYoziJAxDh9xxYQIG1wDi19ugEpvkMsz8ZoNqaJbO

9aY3U/WPwo4w0jxPAxlkfIyOtTTfESwkOKUS2rlIq0zCQ+erhg3JmZOAqzPpAZS+Yu9uhxRx

pLW1QDKPPdKzB6qrhOFseEeg3daToys6dvrDt6388E42UthYjoflzgn0btPKGUHkX0fr0JGy

MIYJE6kYXjfcjz9DzSxBmuMcNBIutmEqMbMghEiXYzFsiLXhL+lb4RhcAJHAcxdnaFsoxZ+L

5JcVuoIHGBBiiGte5myMEfnS+r49WlOVW1DCVsJ3USUmh0ZiCusJENMU2LepoCu57wgwH27D

xIeYFCMAu51r/5qehMRFhx13/eTaf7O600VYdfCbdiyRb+4TxNHPLkvMGpoFdb5vRH+0ZW5F

dEDCp3OZn+qpArZZG0UjDZ4bo2dTKtG/YT5nsRBpB3tiQq+WYai+Mz6ZjkKSLDMpA0qQcxYi

lkjIybTZTcv5oXO+0n+jrwv6DvlAUAKbfP+gIQGHacFwawCn1SesYMGsMOJ5aN22RRB6WTB/

92bx9TJWFdb4XBOoS1AO3aue+grAxrwjX2r54yF2GmbfpgrDB/sb2vEsW9+bGe53vry6/zqt

b3hIOI19CDXao208wRTlUNB/tiQlmSJLN3OJuOB7Wuusug7Xeaz/lPlFYriEsXKmcJdTlQRr

sD1zk6ug9FFpNV8hLQEXIiXa940jCn36sglTTvPkx6K6YeOGhUiUXA04aHJs4KHokv24vrWW

DJOx7Ofxluq5+VGTNpIZPBPdW+OqxK+tMeRMrnidMBe6xBwRYIPKWAWCfa47qK6t1N00q/Pr

Domain Name phish from Gogole Gmail

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Fri, 10 Apr 2026 15:22:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1wBJHy-00000000JuT-2sX5

for dave@doctor.nl2k.ab.ca;

Fri, 10 Apr 2026 15:21:18 -0600

Resent-From: The Doctor

Resent-Date: Fri, 10 Apr 2026 15:21:18 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-pj1-f54.google.com ([209.85.216.54]:55630)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1wBElc-00000000OUQ-1RE6

for root@nk.ca;

Fri, 10 Apr 2026 10:31:44 -0600

Received: by mail-pj1-f54.google.com with SMTP id 98e67ed59e1d1-35da1af3e10so2347479a91.3

for ; Fri, 10 Apr 2026 09:30:49 -0700 (PDT)

ARC-Seal: i=1; a=rsa-sha256; t=1775838643; cv=none;

d=google.com; s=arc-20240605;

b=ao4z1EcnoJGxPgW3itsybMykcbcaG/4dzv+fPi9l60f3GH/+NK0c9mMfCA8++vLiEd

CMZeZrhAKMz2M0wlL+/TCWRL54mxXnUUwv0kLnZY7/7k0z3G1EC75TcY4VY+jjV0l3zN

nj/HsIosDXbNfPcxLLgG3KQYpczrpOUIhA7UXTQYpvYSBVFee6M/eZPM1EWs4BV2UhP2

sLjoDMoGKax5UIPPWv0BXdq96VN33bXKkW27GsFZxy79rGa0TD5kC44RIM4Dki5wLRkd

BGDyxkmmGlbv0H8g8I2nEpFfbzkTT5Hm+MdXz9r7DZ+zR+B8Hs1b4R0xBEAGjpt9cQXE

e8tA==

ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20240605;

h=to:subject:message-id:date:from:mime-version:dkim-signature;

bh=nPURtGhqVbKiFdIIb7XbxIDuLPH0geiv42JQJWF5lgY=;

fh=ny7+SATv4n6lSNl0rVMQyaj6POVJTUZJLShjjgjSTJg=;

b=Oq6FgoR7qg5DG1cGru3tntlhnl2iSVgeEqjuFN6bLxEJ0ereY8ZM05r6EZBkPAXvP7

3KBlGY1CiXgqUa4dbysksXsJfP9rfKX1v3PqBDv0vqss8u8d/pQqVzEx3CL6pD2lLSTs

DmT68cg3YVXuwpQBLudosPhbz5ifmOLe93p6Z+cRwwtdVFZys+LdkljwusjJMoy05I2h

QlNuo/j29sHJ3hE+K5EZjfrCPQRapmDrp/YHAFStKh0HlftDSLr/4BAmzZpMeIu/ntxN

ZeN9AFTLfMuGrgJsvbHAyOgkT+tcwvspcOsGhli2Wh5oqrzXTEZuz/Uia8jMw4ZbzTx+

seEw==;

darn=nk.ca

ARC-Authentication-Results: i=1; mx.google.com; arc=none

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=gmail.com; s=20251104; t=1775838643; x=1776443443; darn=nk.ca;

h=to:subject:message-id:date:from:mime-version:from:to:cc:subject

:date:message-id:reply-to;

bh=nPURtGhqVbKiFdIIb7XbxIDuLPH0geiv42JQJWF5lgY=;

b=SMl7s1wC1m902Nb688EcHsG7avIPbx7E+qxkKUNj9vmxIornsWzK+4RU9JYFQtm29c

KOEUB+oA1TBIsKI05HCRYk917YRaIiG1saTeZ+0WzXFC/yUxds/kdg6xg7DCCm5qkpam

4mvN1v8VpzSoqDD5TSp6XR2XcXHBYAtfPqUILXI4jMuH+0jCq+gKpRu76Eu5RLqkeCuN

syGpjxdYJczjMrn6de6vrTTAFX/CYdQm9S1B5zpQ+JNMwTK0wRsieEQ6YmannXOLHNdw

jxz1B4Z256Gr4cHSUJEU6ER0vMzSGn+z5ZeRv4lRPiFU7080rIGPPhSR34YezVfc7XTM

HYCg==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20251104; t=1775838643; x=1776443443;

h=to:subject:message-id:date:from:mime-version:x-gm-gg

:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to;

bh=nPURtGhqVbKiFdIIb7XbxIDuLPH0geiv42JQJWF5lgY=;

b=okvZvQudBf6WG6sp4BwIkAne3X5P5o//uGBNgb68SwCylDtqDY+TpEqS4Xx+MDc6/4

GQvNc8TxHNQUcbX3XjysXemOqCU3O2YsMot3dpTlYkPXUjXM+k+SDKYg2Y8Fps/DhQpV

ejzlxDBB4Uy297flBJU0rsSwGTLUnf+XGWWaGqp5BYHPxTwJ/z6KrH+Xm8L9fxAHkTw1

h3VQ6Q6cCy7eeqHMp9XNVWo6DoI5Qxum/YAermURWJShIexSadK5jtQQQnmT80+H3rBw

0/2lzYfQW/yQ4ueLfO8OfsIMX3jPHGeupEQGHQUVKpL94zYzmyykziQ26BglEUzorrVy

5lNQ==

X-Gm-Message-State: AOJu0YwztPlL0UdLX04ndwyMEyWEvR4/5Ocgr+ClMSvsf/5VajfbH12x

IpwP4jRwIEe5CF0vVj/5DvPgoGZNcDnSYPIuSq7rfphqbIpSB7I4lAzma4ZwMrG+Lxm0FWFW/BL

5UHkMkQoyLuOnBGTbtLoOLAfPir7f5bVIS6V1

X-Gm-Gg: AeBDiesjvSJ+zK5cwfcHaLPDFX3RphRN5ZyoGyskHcyuTt6VlBH85BaFF90pYz1HxC+

XBOr0KqniL+GeJ/HVu0/0TU48bpNvvoR2UKFQ0pDYrbmdemB0NCkTNWSYx0Xs0NzbvB4tTWRhil

1U+NwIoDjRvZHsu8VIWCDfS6jfobr/KXN+nXO4GbjS2s+ROo0Y9mScAfz6j04dsTMixtKgRs/7s

MbPIAhE99jQFw3yPiumP6dhA1ykktK+xHo9oOKaGe3rGXTNye6MbiIvpQSiB+wS+kIyFq3RWC3c

orTzL65rGtV/YCwrpRrPCgU=

X-Received: by 2002:a05:690e:1908:b0:651:a928:4c73 with SMTP id

956f58d0204a3-651a9285307mr202404d50.44.1775838130320; Fri, 10 Apr 2026

09:22:10 -0700 (PDT)

Received: from 1008170693301 named unknown by gmailapi.google.com with

HTTPREST; Fri, 10 Apr 2026 11:22:09 -0500

Received: from 1008170693301 named unknown by gmailapi.google.com with

HTTPREST; Fri, 10 Apr 2026 11:22:09 -0500

MIME-Version: 1.0

From: nicholaslouis.co@gmail.com

Date: Fri, 10 Apr 2026 11:22:09 -0500

X-Gm-Features: AQROBzD3wGrfYRiltc__z9BFwdAFvYc-53XgoXszx0555XT7E78ykBEB3Rfaj9s

Message-ID:

Subject: VOIP IN EDMONTON

To: root@nk.ca

Content-Type: multipart/alternative; boundary="000000000000efb9c4064f1d8806"

X-Spam_score: 8.3

X-Spam_score_int: 83

X-Spam_bar: ++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Hello, I wanted to let you know that the premium domain VoipEdmonton.com

is available for purchase at Godaddy.



Content analysis details: (8.3 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[209.85.216.54 listed in dnsbl.ahbl.org]

[209.85.216.54 listed in dnsbl.ahbl.org]

[209.85.216.54 listed in dnsbl.ahbl.org]

[209.85.216.54 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[209.85.216.54 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[209.85.216.54 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[209.85.216.54 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[209.85.216.54 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[209.85.216.54 listed in will-spam-for-food.eu.org]

[209.85.216.54 listed in will-spam-for-food.eu.org]

[209.85.216.54 listed in will-spam-for-food.eu.org]

[209.85.216.54 listed in will-spam-for-food.eu.org]

[209.85.216.54 listed in will-spam-for-food.eu.org]

[209.85.216.54 listed in will-spam-for-food.eu.org]

[209.85.216.54 listed in will-spam-for-food.eu.org]

[209.85.216.54 listed in will-spam-for-food.eu.org]

-0.0 SPF_PASS SPF: sender matches SPF record

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[209.85.216.54 listed in list.dnswl.org]

1.6 SUBJ_ALL_CAPS Subject is all capitals

0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider

[nicholaslouis.co(at)gmail.com]

-0.0 RCVD_IN_MSPIKE_H3 RBL: Good reputation (+3)

[209.85.216.54 listed in wl.mailspike.net]

1.6 HTML_IMAGE_ONLY_12 BODY: HTML: images with 800-1200 bytes of words

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

-0.0 RCVD_IN_MSPIKE_WL Mailspike good senders

Subject: {SPAM?} VOIP IN EDMONTON



--000000000000efb9c4064f1d8806

Content-Type: text/plain; charset="UTF-8"



Hello,



I wanted to let you know that the premium domain



VoipEdmonton.com is available for purchase at Godaddy.



This domain would be really good for attracting clients looking for your

VOIP IN EDMONTON.



If the domain is developed or redirected to your current website, it would

be extremely beneficial to your company and services in terms of catching

more leads and clients while retaining your brand identity.



You can get this domain for $650 at www.VoipEdmonton.com right now.



Best Regards,



Nicholas.



--000000000000efb9c4064f1d8806

Content-Type: text/html; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable





Hello,

I wanted to let you know that the prem=

ium domain

VoipEdmonton.com is available for purch=

ase at Godaddy.

This domain would be really good f=

or attracting clients looking for your
VOIP IN EDMONTON.

v>
If the domain is developed or redirected to your current w=

ebsite, it would be extremely beneficial to your company and services in te=

rms of catching more leads and clients while retaining your brand identity.=


You can get this domain for $650 at
tp://www.VoipEdmonton.com">www.VoipEdmonton.com
right now.

r>
Best Regards,

Nicholas.

=3D"https://nicholaslouis_co_gmail_com-dot-mmanalytics2.appspot.com/em_oBUP=

lK7Pew7e5btd2Kul/comet.gif" style=3D"display:none !important;">





--000000000000efb9c4064f1d8806--

Domain name phish from Google Gmail

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 09 Apr 2026 22:15:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1wB3GP-00000000Cud-3dVR

for dave@doctor.nl2k.ab.ca;

Thu, 09 Apr 2026 22:14:37 -0600

Resent-From: The Doctor

Resent-Date: Thu, 9 Apr 2026 22:14:37 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-ua1-f42.google.com ([209.85.222.42]:48169)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1wAy6D-000000000Qz-0Usz

for sales@nk.ca;

Thu, 09 Apr 2026 16:43:53 -0600

Received: by mail-ua1-f42.google.com with SMTP id a1e0cc1a2514c-951c5ac6253so455000241.0

for ; Thu, 09 Apr 2026 15:42:57 -0700 (PDT)

ARC-Seal: i=1; a=rsa-sha256; t=1775774570; cv=none;

d=google.com; s=arc-20240605;

b=GPiwB/VBrEEVfywxoFn4+TrUKMQPiA5sWhDf5EL3O+zwiwcICzuG20dH3hHHncAa50

6fZk0TRGmLebLx7xATs82Y3CIky58/hMct9d5YgFm3ZocAiBOplXSOEOt4/tOHvEGJNU

a2iLhfAyrEm+cpmsNN9zTxVIeXfVODRQphOPCmmoPD+o0li9Jr2zyRS1XDAwwNqeLpU4

QxBlfTkUarppLMnYoOFKzj7KEYQ7VhwdIg3vCPaz3R7lpl7k/0Lft1fK1RlEx+iDnm8a

4ToAHRDQvgMkI1EizFAzfTSpJKKvhXoTfp3n1LIY5YzXF4jJqW23nJ32Sr4rCP9Q+xV0

vchA==

ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20240605;

h=to:subject:message-id:date:from:mime-version:dkim-signature;

bh=doKeFjGpUS1MMkq9fVuSWY9+2OFO3+OWG8xkr33xJj8=;

fh=C4vsnDG7cTH8aa/8f7sygxKSfblX4MPDg6mph8A3jUw=;

b=D1Kv2QeqA7ejhxHermhQCnxcMbQQCb+9PgUv3QM02mHUMbts5tbwVBI6rpRlX8XKl+

UDaGIcy6z8hwlyhAMEhEbGA4AxxdTR2mV9GaBn6zbyj86bDsImiQCjIGrMutxQL9qWpR

9Wq66rP9UhsV9J4/6Yahek+GxbkZB0azu2LPD8cDeP/rcA9VbyxD5rlEHw2QYooDk3f1

qNqYFxOz7Ya8VXSOwZEWe1ekM9UPGttUhUlzUMeOEldcYH2FbSqdrx1FUP+YuPEzOAl1

kXJISodRBqFQyYJeOQ6xcWN6GvAtHwqymrgs9YNWKrCva/Ay2V3CilLKyTzys/vFuejq

6hUQ==;

darn=nk.ca

ARC-Authentication-Results: i=1; mx.google.com; arc=none

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=gmail.com; s=20251104; t=1775774570; x=1776379370; darn=nk.ca;

h=to:subject:message-id:date:from:mime-version:from:to:cc:subject

:date:message-id:reply-to;

bh=doKeFjGpUS1MMkq9fVuSWY9+2OFO3+OWG8xkr33xJj8=;

b=Xpf8h0uKgnwyAKbOpFTokmVkO7np5AT977PCsvRprOZ2zpYVRuafTbLMfhUmuwcvMv

qPQi6Uv6b0+A6Zet4FOHt4XOLWFhMecNz/qAmz5ljYAWYshyfeiafvr+8Ig+Zxgx8dfo

KM7RcZ0CbGQv3+pcIxyJAenGHGd1/GJEZdT1X8cuJLnjvGuymzLhmTUG2B9ESlHbvy0A

IyOZR486ugMyNR0mHbe4UsjsmFU7axEnJwc5fcuPXdXCewLlaa/Hk0SS1mcWtiqcLWT2

dG8BbhtDKg8TrdG7iHdklOqfb0XNbx42/k1kUK2lubVsMoC4sA8cypsJFLcq0D924pRR

lSCQ==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20251104; t=1775774570; x=1776379370;

h=to:subject:message-id:date:from:mime-version:x-gm-gg

:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to;

bh=doKeFjGpUS1MMkq9fVuSWY9+2OFO3+OWG8xkr33xJj8=;

b=RnXuLs2uCAYd4aC1GryfN9/9Nvcrg400EclxKsez/bvdUmWtUzNP2EgiuclVNn0vFT

UDKFZHNsAz9qTO7IhR9725ynIeBh3Fxn1xACMlzUoTqgAtOgj+rj7L0ECN0ThLb+KQjv

mBR1VOEtH2blDKQ0uQnZGS3dFP4SFMie+Nl9VL326Fnk7acoVGYApLE3r9JWX4D/+CZe

Dy/j6jIVS70ZOp/P4s6bzVVsFNgDGF3QjJJwa5aYuveAqDsEV23EiCnG56NPdorP6+0J

pE3WMVfTV18qH/6sJB3/0L2MsoPKQKuA4/2Z/pK8vB5ofS/XCojD2ulahbHljSzt8wjD

W07Q==

X-Gm-Message-State: AOJu0YwhCSbp1NVuHPmix9VKaTLC37M9aGiNdXGXsLWX4i7Qql6eDwxU

AnEu4bTPxFMV3ghYdLQ2ZJubnt+3y3BbIJCMyjRJTudkUEfH54t6cPC+026nQPBFs+bTCfX+UEt

HwlmE7sgJEut5XH/19r8kXcMT/yFcaE5LINgc

X-Gm-Gg: AeBDietZwZ6iLD+mdx3izymOgaSTIT9pQ5qfEDbKFE6jP2/K8QyCXJAfKZLo1t+3RD0

HKhBIXlNm4WzmN0S4V2XnZEMmLaZd5tgqO2IMSrrT8JUK4fQJj9g6qOc+VpW/uNMMUCu7UnvPa7

u2SlcK50vhz7L9uX4kkKt75YbXNMnWtyHWBMgA4MyaQRceB5nGEwxcvPwLLwUpGmlwJdtEPp2eL

TMQrdGUqkl/umkfzejE6Yf/UULIwV98mm++nOplxE0ycU46Ehv3YvE7CDhMuUZWMuftxEd+/Q+/

MHuMzzKQZvaDxRuK+58V1hWAqIXSMRPAjbmHN11JFk8=

X-Received: by 2002:a05:6102:26c9:b0:5f1:72a7:f879 with SMTP id

ada2fe7eead31-60a01366052mr324852137.28.1775774570281; Thu, 09 Apr 2026

15:42:50 -0700 (PDT)

MIME-Version: 1.0

From: Bob Jones

Date: Fri, 10 Apr 2026 03:42:37 +0500

X-Gm-Features: AQROBzCQ9ustgHKOXnHifeu5Y3bQwFSpPRKfXAE_u6XOTuUJfrx7TWqzCW37py0

Message-ID:

Subject: Msp in Edmonton

To: sales@nk.ca

Content-Type: multipart/alternative; boundary="000000000000767fd4064f0ebc52"

X-Spam_score: 5.1

X-Spam_score_int: 51

X-Spam_bar: +++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Hello EdmontonMsp.com is available for $950. Would you be

interested in this acquisition?



Content analysis details: (5.1 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[209.85.222.42 listed in dnsbl.ahbl.org]

[209.85.222.42 listed in dnsbl.ahbl.org]

[209.85.222.42 listed in dnsbl.ahbl.org]

[209.85.222.42 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[209.85.222.42 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[209.85.222.42 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[209.85.222.42 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[209.85.222.42 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[209.85.222.42 listed in will-spam-for-food.eu.org]

[209.85.222.42 listed in will-spam-for-food.eu.org]

[209.85.222.42 listed in will-spam-for-food.eu.org]

[209.85.222.42 listed in will-spam-for-food.eu.org]

[209.85.222.42 listed in will-spam-for-food.eu.org]

[209.85.222.42 listed in will-spam-for-food.eu.org]

[209.85.222.42 listed in will-spam-for-food.eu.org]

[209.85.222.42 listed in will-spam-for-food.eu.org]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[209.85.222.42 listed in list.dnswl.org]

-0.0 SPF_PASS SPF: sender matches SPF record

0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider

[miamimaidservice92(at)gmail.com]

0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends in

digit

[miamimaidservice92(at)gmail.com]

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[209.85.222.42 listed in wl.mailspike.net]

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

Subject: {SPAM?} Msp in Edmonton



--000000000000767fd4064f0ebc52

Content-Type: text/plain; charset="UTF-8"



Hello



EdmontonMsp.com is available for $950.



Would you be interested in this acquisition?



Warm Regards

Bob Jones



--000000000000767fd4064f0ebc52

Content-Type: text/html; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable



Hello

Edmont=

onMsp.com is available for $950.


=3D"auto">Would you be interested in this acquisition?

o">
Warm Regards
Bob Jone=

s=C2=A0




--000000000000767fd4064f0ebc52--

Domain purchase phish from Google Gmail

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Fri, 10 Apr 2026 15:22:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1wBJHu-00000000JuK-1E2z

for dave@doctor.nl2k.ab.ca;

Fri, 10 Apr 2026 15:21:14 -0600

Resent-From: The Doctor

Resent-Date: Fri, 10 Apr 2026 15:21:14 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-oo1-f50.google.com ([209.85.161.50]:43376)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1wBEiE-00000000OGg-1s46

for sales@nk.ca;

Fri, 10 Apr 2026 10:28:14 -0600

Received: by mail-oo1-f50.google.com with SMTP id 006d021491bc7-662f30d3f1fso1282831eaf.1

for ; Fri, 10 Apr 2026 09:27:19 -0700 (PDT)

ARC-Seal: i=1; a=rsa-sha256; t=1775838433; cv=none;

d=google.com; s=arc-20240605;

b=GAMZFcx5z5ob1JPpyTqu/soJi52s5KGbliDXuAJeh7r3z37EghWJIHXRL4ATYdJDZ3

u7pihBb3qsD3ALz7lrl/fDYkoHO9uA9dVsEUky/M/a27xUA0kWJAFMfA+vyMhkpNVoGV

1nmIt/Ne16zoNa7oTh3w6z4eI3SrUWhqcKoijcJJSYou2Reo8/DhWd44WLlDxqOs4hDG

pNZe4/wZtoe7F2qQFFnnVkihj53EN9YGJc9GeX10x2SnkRKUwGoaDZ73P6qi+BVGns0r

kkRZIo5hFZo7l6Zh26D7253pz2+Z70GA7GgZkSt8fwAKCtToR6vq1qFbju0rGQK45Qpz

9yzg==

ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20240605;

h=to:subject:message-id:date:from:mime-version:dkim-signature;

bh=84X5Tf0YRcGeCCp60oPsR8jn7szCpBnsTumiuhe0PXk=;

fh=C4vsnDG7cTH8aa/8f7sygxKSfblX4MPDg6mph8A3jUw=;

b=UEaGFGiGkIaOSe57i6GKRmDRRD2sWsOeGIRywslIv5djsYnBRB21s0AgD+GjQMTKHR

wivfOa44tUkU6rRCHKw9hh1JVABagF+lPBM+GFQ8yBZuTAWJxXaWQ2RCJg/FnQwokzDm

hSAhPnDThiuJ95qRDF8d7QpdAyewh5lg3Fm0MmHzhiJCR4ReQEKx+bWVyH0HfKMbGcLP

xrh+PTJfmAh0E5PbQOJZ/illiSIyhnjBDOpDWoRgSg03s/Zdgun85vG+7+9EFGQWQ/jx

8YvkJhTVyDptgjsDJVJMxJObPasYaBXymvDa3f4FnhaZ/bNl8y8Ov9s2JdLMxB5FXts0

KflA==;

darn=nk.ca

ARC-Authentication-Results: i=1; mx.google.com; arc=none

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=gmail.com; s=20251104; t=1775838433; x=1776443233; darn=nk.ca;

h=to:subject:message-id:date:from:mime-version:from:to:cc:subject

:date:message-id:reply-to;

bh=84X5Tf0YRcGeCCp60oPsR8jn7szCpBnsTumiuhe0PXk=;

b=e2Veu5rD74NCpI20H3wSdHKQM6oEGdP2Itfr7wAqEyGsOFnP7UxJ91ScFV0Dm4JMDq

/4XJMCC+JcUP7ZN9rHqnGtrbnzWUd8wy5KVgL6vVcQFkB4YjE19eF1cM2HYPQNUq/71o

BFZ4qEHXYJp7wlVDG0d8Tl7jukcN4Fs26JwSg5IPkv3mHvFMb0XnAE1CoAqpSuFsg+ud

qBOtzYnjqIfte+rZekGU/TvuFDzZpq3Vt47dpq3LNLAROJVtPfws4hxFk3teCuzooGs2

IZ4X0efw/ifTnkZAd9kwAAR1DV+nS0ZPhvFgRn+Z22yBwKCn2Ncf811XDAtw6PvPtfrD

rGkA==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20251104; t=1775838433; x=1776443233;

h=to:subject:message-id:date:from:mime-version:x-gm-gg

:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to;

bh=84X5Tf0YRcGeCCp60oPsR8jn7szCpBnsTumiuhe0PXk=;

b=GSzkoXVy3MqwGntxWKyykS36cvhGq72BGXEnr/C1JdGjbhkeUdKk/7bVecX6qjmejN

JmdUH2XzcgReMj8xpVvaLRf3oFuhSbU/F+5Lvyiuvq7dq/HbbxNMIAAS3imp9soJa2aG

hLqT0g31qXWbKWKBdekY7/nIIo6AZ1CUueyZIL+EkekpYE1ggEigvFWmQns2d1709kUV

oOPZv+SrVEb3AfMNiAmg5mDOmFgMqncdFVDfyUFtM/hPBd9y1HZ/dVVW7NvVfI09OccH

FUyiW1Tv+0cQnX0MjKAcSn3kOLE72O/qFiyuB/ACL1+aCWBH6F+AhfR7m2SL6Q1PR9yi

3gzg==

X-Gm-Message-State: AOJu0YySeVqcTti5FZaa2ZgH0QeLF/6o3DZTTcrccVH0RdzEPDjALsQz

b+8fPxsjxijBhiomzOm2BdLxoZn0J2x/dtl8M8e13kyaSsro1Q/1GSed01ub77ruoNVkEe13bwB

VfUchg2CfhAlfTSyjgUsFVaNF3ITY+VqwBM7R

X-Gm-Gg: AeBDietCJ6sykmjQd2h6ZMJaOpKBFd25s7uwgpqhfeVao86BhpGmkhUMIcmXu20nWWI

4R0p6UTK4RHmdOvEwgvxkdUYZ18oCOny9y88RF65I7LbSpNBAqhLutPN/lQxKlCMNY0MZnp+nfN

vriRDa4bvgxvDdquPdmnE0nCZDP8Rwo/30G51ggNKTRy+XK8Pl12igqODp0DWdHFSTSCYk9nsVQ

3urvr75zDM7IstQ4fFuok7bqmcZe7rWyNI0mvW8vFOdgkKlmtKaf+Ha6QhEgrb0vIyjcbZJNeYO

cTWwvQ2+0b9gRBPD636gEdc=

X-Received: by 2002:a05:690e:b41:b0:650:178e:253 with SMTP id

956f58d0204a3-65186f2f0c2mr6752887d50.0.1775838084155; Fri, 10 Apr 2026

09:21:24 -0700 (PDT)

Received: from 1008170693301 named unknown by gmailapi.google.com with

HTTPREST; Fri, 10 Apr 2026 11:21:23 -0500

Received: from 1008170693301 named unknown by gmailapi.google.com with

HTTPREST; Fri, 10 Apr 2026 11:21:23 -0500

MIME-Version: 1.0

From: nicholaslouis.co@gmail.com

Date: Fri, 10 Apr 2026 11:21:23 -0500

X-Gm-Features: AQROBzC_z8zl2znhhHBczuNlVvrgl-95zGGIYtPAxoMnWCI3MBUCmxt1ZOiegE0

Message-ID:

Subject: VOIP IN EDMONTON

To: sales@nk.ca

Content-Type: multipart/alternative; boundary="0000000000002f4b29064f1d861e"

X-Spam_score: 8.3

X-Spam_score_int: 83

X-Spam_bar: ++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Hello, I wanted to let you know that the premium domain VoipEdmonton.com

is available for purchase at Godaddy.



Content analysis details: (8.3 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[209.85.161.50 listed in dnsbl.ahbl.org]

[209.85.161.50 listed in dnsbl.ahbl.org]

[209.85.161.50 listed in dnsbl.ahbl.org]

[209.85.161.50 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[209.85.161.50 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[209.85.161.50 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[209.85.161.50 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[209.85.161.50 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[209.85.161.50 listed in will-spam-for-food.eu.org]

[209.85.161.50 listed in will-spam-for-food.eu.org]

[209.85.161.50 listed in will-spam-for-food.eu.org]

[209.85.161.50 listed in will-spam-for-food.eu.org]

[209.85.161.50 listed in will-spam-for-food.eu.org]

[209.85.161.50 listed in will-spam-for-food.eu.org]

[209.85.161.50 listed in will-spam-for-food.eu.org]

[209.85.161.50 listed in will-spam-for-food.eu.org]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[209.85.161.50 listed in list.dnswl.org]

-0.0 SPF_PASS SPF: sender matches SPF record

1.6 SUBJ_ALL_CAPS Subject is all capitals

0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider

[nicholaslouis.co(at)gmail.com]

-0.0 RCVD_IN_MSPIKE_H3 RBL: Good reputation (+3)

[209.85.161.50 listed in wl.mailspike.net]

1.6 HTML_IMAGE_ONLY_12 BODY: HTML: images with 800-1200 bytes of words

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

-0.0 RCVD_IN_MSPIKE_WL Mailspike good senders

0.0 T_REMOTE_IMAGE Message contains an external image

Subject: {SPAM?} VOIP IN EDMONTON



--0000000000002f4b29064f1d861e

Content-Type: text/plain; charset="UTF-8"



Hello,



I wanted to let you know that the premium domain



VoipEdmonton.com is available for purchase at Godaddy.



This domain would be really good for attracting clients looking for your

VOIP IN EDMONTON.



If the domain is developed or redirected to your current website, it would

be extremely beneficial to your company and services in terms of catching

more leads and clients while retaining your brand identity.



You can get this domain for $650 at www.VoipEdmonton.com right now.



Best Regards,



Nicholas.



--0000000000002f4b29064f1d861e

Content-Type: text/html; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable





Hello,

I wanted to let you know that the prem=

ium domain

VoipEdmonton.com is available for purch=

ase at Godaddy.

This domain would be really good f=

or attracting clients looking for your
VOIP IN EDMONTON.

v>
If the domain is developed or redirected to your current w=

ebsite, it would be extremely beneficial to your company and services in te=

rms of catching more leads and clients while retaining your brand identity.=


You can get this domain for $650 at
tp://www.VoipEdmonton.com">www.VoipEdmonton.com
right now.

r>
Best Regards,

Nicholas.

=3D"https://nicholaslouis_co_gmail_com-dot-mmanalytics.appspot.com/em_GrGDV=

VfCnSWAX8pOmpL6/asteroid.gif" style=3D"display:none !important;">





--0000000000002f4b29064f1d861e--

Package phish from Sendgrid

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Fri, 10 Apr 2026 10:19:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1wBEZ4-00000000NbG-0Sqe

for dave@doctor.nl2k.ab.ca;

Fri, 10 Apr 2026 10:18:38 -0600

Resent-From: The Doctor

Resent-Date: Fri, 10 Apr 2026 10:18:38 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from s.wfbtzhsv.outbound-mail.sendgrid.net ([159.183.224.104]:32048)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1wBDH9-00000000Lr3-2yYQ

for root@nk.ca;

Fri, 10 Apr 2026 08:56:12 -0600

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kbsxfa.com;

h=from:subject:date:mime-version:to:content-type:

content-transfer-encoding:cc:content-type:date:from:subject:to;

s=s1; t=1775832909; bh=sgmqfxVTn5tNusgxdcpPp+bpUdFmqXEdz+qDeA54eWI=;

b=x2bkUphuwncopMkSzXt+aYkXPIu7t8EGgTham61yLkfp3wzewfuosLrg3RCCf0raDuWq

Z6W64rfafYdI/pDJ4OmN9rvXmPNkU+8Tv3iQHqc55CsrSCSjHXktc1VC2RAJ11fC4yYTR1

wYB2MkcBn6BjkHAEzBAE8eU0GoVP5k3iLBYRXXfpuLDExvQruLmzMNLkIQg7SbYiJ3aY0M

2mwcczCQznEwNiqZlQ62omNhBei14jimnFOIxMIeSuGJsKQ8Q+DS+rGl62bSE8nKpFhoEl

8CUEd7wGDO9A9tDlWF0QpzCks4wzgIBFwJkhwrxWA9LXX1JUi0naWGzeo1O4kzQg==

Received: by recvd-585cb44ccd-dljnx with SMTP id recvd-585cb44ccd-dljnx-1-69D90F4D-E

2026-04-10 14:55:09.064709211 +0000 UTC m=+928694.265763231

Received: from franchimon-icm.com (unknown)

by geopod-ismtpd-canary-0 (SG)

with ESMTP id zocxVFIJRnyF_oH_6VAI6g

for ;

Fri, 10 Apr 2026 14:55:09.004 +0000 (UTC)

Message-Id:

From: Logistics Team

Subject: Important: Confirm Your Shipping Information to Prevent Return of

Your Package

Date: Fri, 10 Apr 2026 14:55:09 +0000 (UTC)

X-Priority: 5

X-Mailer: GipLbbceRAfxU NCYIBswiQSvBuDl IDcusAxuV 286.86158

Mime-Version: 1.0

X-SG-EID:

=?us-ascii?Q?u001=2Eol3cEI4W5DOn5lRhLQ=2Fe7c6hfFNQrSnzZPz=2F=2FA8LA9cYm8u8U=2FaARP4KH?=

=?us-ascii?Q?kLRG=2FMPOlFVAhg0WxPjfLoqaPciLexthaxcfIU5?=

=?us-ascii?Q?QVwZj=2FRSTEoRk=2FVA24+Pv53gaECzH9yXcAz3f=2Fo?=

=?us-ascii?Q?Txgh7NBHLKaE90VjzQhS1VFnwIXg4EZJYerwzn6?=

=?us-ascii?Q?1Rf1QzqRXzC72x6pgUPRfQG7d8VGO41IvYZynPj?=

=?us-ascii?Q?4qRO6N3=2FFug=2FHfwYCYou5k=3D?=

To: "root@nk.ca"

X-Entity-ID: u001.4YvAU33fPP5NJy37RisiGA==

Content-Type: text/html; charset=us-ascii

Content-Transfer-Encoding: base64

X-Spam_score: 29.3

X-Spam_score_int: 293

X-Spam_bar: +++++++++++++++++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Dear root@nk.ca, We are writing to inform you that we encountered

an issue with verifying the delivery address for your recent order. As a

result, we were unable to complete the delivery of your package.



Content analysis details: (29.3 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[159.183.224.104 listed in dnsbl.ahbl.org]

[159.183.224.104 listed in dnsbl.ahbl.org]

[159.183.224.104 listed in dnsbl.ahbl.org]

[159.183.224.104 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[159.183.224.104 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[159.183.224.104 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[159.183.224.104 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[159.183.224.104 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[159.183.224.104 listed in will-spam-for-food.eu.org]

[159.183.224.104 listed in will-spam-for-food.eu.org]

[159.183.224.104 listed in will-spam-for-food.eu.org]

[159.183.224.104 listed in will-spam-for-food.eu.org]

[159.183.224.104 listed in will-spam-for-food.eu.org]

[159.183.224.104 listed in will-spam-for-food.eu.org]

[159.183.224.104 listed in will-spam-for-food.eu.org]

[159.183.224.104 listed in will-spam-for-food.eu.org]

1.9 URIBL_JP_SURBL Contains an URL listed in the JP SURBL blocklist

[URI: xfonyfg.com]

1.9 URIBL_ABUSE_SURBL Contains an URL listed in the ABUSE SURBL blocklist

[URI: intelcom.ca.xfonyfg.com]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

0.0 RCVD_IN_VALIDITY_CERTIFIED_BLOCKED RBL: ADMINISTRATOR NOTICE: The

query to Validity was blocked. See

https://knowledge.validity.com/hc/en-us/articles/20961730681243

for more information.

[159.183.224.104 listed in sa-trusted.bondedsender.org]

0.0 RCVD_IN_VALIDITY_RPBL_BLOCKED RBL: ADMINISTRATOR NOTICE: The query to

Validity was blocked. See

https://knowledge.validity.com/hc/en-us/articles/20961730681243

for more information.

[159.183.224.104 listed in bl.score.senderscore.com]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[159.183.224.104 listed in bl.score.senderscore.com]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

0.0 RCVD_IN_VALIDITY_SAFE_BLOCKED RBL: ADMINISTRATOR NOTICE: The query to

Validity was blocked. See

https://knowledge.validity.com/hc/en-us/articles/20961730681243

for more information.

[159.183.224.104 listed in sa-accredit.habeas.com]

-0.0 SPF_PASS SPF: sender matches SPF record

15 GR_DOMAIN_SENDGR1 Received contains spammer id (sendgr)

1.5 DEAR_EMAIL BODY: Message contains Dear email address

0.5 L_HELLO_ADDRESS BODY: Greets you by address, not by name

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 MIME_BASE64_TEXT RAW: Message text disguised using base64 encoding

0.5 VOWEL_FROM_5 Impronouncable from header (6 consecutive vowels)

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

2.5 XM_RANDOM X-Mailer apparently random

2.0 FILL_THIS_FORM_LONG Fill in a form with personal information

1.0 XPRIO Has X-Priority header

0.0 FILL_THIS_FORM Fill in a form with personal information

Subject: {SPAM?} Important: Confirm Your Shipping Information to Prevent Return of

Your Package



Dear root@nk.ca,



We are writing to inform you that we encountered an issue with verifying the delivery address for your recent order. As a result, we were unable to complete the delivery of your package.



Current Status:

The address details provided appear to be incomplete or unclear. In order to avoid delays or the return of your shipment, we kindly ask that you review and update your shipping information as soon as possible.



Required Action:

Please ensure that the following details are correct:



Full street address

Unit or apartment number (if applicable)

City, postal code, and country

Contact phone number



Deadline for Update:

To prevent further delay or potential return of your package, we kindly ask that you submit the updated information within the next 48 hours.



Important Reminder:

For security purposes, please update your details only through the official delivery portal linked to your account. If we do not receive updated information within the hold window, we may be required to delay or return your shipment as per our carrier's policies.



Review Delivery Details: https://intelcom.ca.xfonyfg.com/lMrgLhGebN



This is an automated notification from 's delivery system. Please refrain from replying to this email.



Thank you for your prompt attention to this matter.