Vimeo Phish from Microsoft Outlook Part 9

Posted by Dave Yadallee on









le=3D"presentation" style=3D"float:none;display:inline-table;">










n" style=3D"background:#0077b5;border-radius:50%;width:34px;">








h:34px;">
JtZy1lbmM6alJPanc1aU9Seml3ajRYcnFyQ1JpbEdiOUZvN0l6ZVJ4c0NsWW5ta0paRkhIVGNMZ=

URYUEd4cjc1TTlMRjVjRGpOZUljajRHUytRPSIsInJxIjoiMDItYzI1MzM5LTcyZTc0MTc5NjA4=

NTRlODc4Y2FlNTBhYjBiOWEzMzk3IiwibSI6ZmFsc2UsInVpIjoiNTciLCJ1biI6IiIsInUiOiJ=

odHRwczovL3d3dy5saW5rZWRpbi5jb20vY29tcGFueS92aW1lby8_dXRtX3NvdXJjZT1lbWFpbC=

Z1dG1fbWVkaXVtPXZpbWVvLWVtYWlsJnV0bV9jYW1wYWlnbj00NTQyNCJ9/ay5akuV94f3xWb08=

aYaKAQ" target=3D"_blank" style=3D"text-decoration: none; color: #17D5FF;">=

3D"Linkedin"
am/images/czcEwK0MbQnkDJab70r4MfAzCdXDE97l4NrbQZPN.png" style=3D"border-rad=

ius:50%;display:block;" width=3D"34">





le=3D"presentation" style=3D"float:none;display:inline-table;">










n" style=3D"background:#3b5998;border-radius:50%;width:34px;">








h:34px;">
JtZy1lbmM6alJPanc1aU9Seml3ajRYcnFyQ1JpbEdiOUZvN0l6ZVJ4c0NsWW5ta0paRkhIVGNMZ=

URYUEd4cjc1TTlMRjVjRGpOZUljajRHUytRPSIsInJxIjoiMDItYzI1MzM5LTcyZTc0MTc5NjA4=

NTRlODc4Y2FlNTBhYjBiOWEzMzk3IiwibSI6ZmFsc2UsInVpIjoiNTgiLCJ1biI6IiIsInUiOiJ=

odHRwOi8vZmFjZWJvb2suY29tL3ZpbWVvP3V0bV9zb3VyY2U9ZW1haWwmdXRtX21lZGl1bT12aW=

1lby1lbWFpbCZ1dG1fY2FtcGFpZ249NDU0MjQifQ/9vhzV_BM4O89KMzKc_b2uQ" target=3D"=

_blank" style=3D"text-decoration: none; color: #17D5FF;">3D"Facebo=<br
ok" height=3D"34" src=3D"https://lp.vimeo.com/rs/livestream/images/IAdpQKE4=

woa5XxhT83Q3W3il2QfbzwUe8oLi1gIq.png" style=3D"border-radius:50%;display:bl=

ock;" width=3D"34">





le=3D"presentation" style=3D"float:none;display:inline-table;">










n" style=3D"background:#3f729b;border-radius:50%;width:34px;">








h:34px;">
JtZy1lbmM6alJPanc1aU9Seml3ajRYcnFyQ1JpbEdiOUZvN0l6ZVJ4c0NsWW5ta0paRkhIVGNMZ=

URYUEd4cjc1TTlMRjVjRGpOZUljajRHUytRPSIsInJxIjoiMDItYzI1MzM5LTcyZTc0MTc5NjA4=

NTRlODc4Y2FlNTBhYjBiOWEzMzk3IiwibSI6ZmFsc2UsInVpIjoiNTkiLCJ1biI6IiIsInUiOiJ=

odHRwOi8vaW5zdGFncmFtLmNvbS92aW1lbz91dG1fc291cmNlPWVtYWlsJnV0bV9tZWRpdW09dm=

ltZW8tZW1haWwmdXRtX2NhbXBhaWduPTQ1NDI0In0/L1CCYUz6_imMp5iWK2B-cw" target=3D=

"_blank" style=3D"text-decoration: none; color: #17D5FF;">3D"Insta=<br
gram" height=3D"34" src=3D"https://lp.vimeo.com/rs/livestream/images/KtVGdl=

6WwlMkPaEgY3znfgwKmorpFr2e74GnYtpQ.png" style=3D"border-radius:50%;display:=

block;" width=3D"34">























"presentation"><=

/table>

------=_Part_597527150_605658058.1764943807139--



------=_Part_597527149_462018029.1764943807139--

-rule:exactly;">
gsImUiOiJtZy1lbmM6alJPanc1aU9Seml3ajRYcnFyQ1JpbEdiOUZvN0l6ZVJ4c0NsWW5ta0paR=

khIVGNMZURYUEd4cjc1TTlMRjVjRGpOZUljajRHUytRPSIsInJxIjoiMDItYzI1MzM5LTcyZTc0=

MTc5NjA4NTRlODc4Y2FlNTBhYjBiOWEzMzk3In0/eZ3UDvMqT4wJMTlHZAHZyA" width=3D"1"=

height=3D"1" border=3D"0" vspace=3D"0" hspace=3D"0" alt=3D"" />















le=3D"presentation" style=3D"background-color:#DFE4EA;width:100%;" class=3D=

"section">








:0 auto;border-radius:0;max-width:600px;">


le=3D"presentation" style=3D"background-color:#F1F5F9;width:100%;border-rad=

ius:0;">








align:center;vertical-align:top;mso-padding-alt:0px 0px 32px 0px;" class=3D=

"block-grid padding-0px-0px-32px-0px">

-column-per-26 mj-outlook-group-fix" style=3D"font-size:0px;text-align:left=

;direction:ltr;display:inline-block;vertical-align:top;width:100%;">


n" style=3D"border-radius:0px;vertical-align:top;" width=3D"100%">








0px;padding:10px 0px 10px 0px;word-break:break-word;mso-padding-alt:10px 0p=

x 10px 34px;text-align:left;">

yle=3D"font-family:Helvetica, Arial, sans-serif;font-size:13px;font-weight:=

normal;letter-spacing:none;line-height:1.2;text-align:left;mso-line-height-=

alt:1em;color:#0A0E12;">


-family: 'Helvetica Neue', sans-serif, Helvetica, Arial;">
lor: rgb(10, 14, 18);">
Mjg5MzgsImUiOiJtZy1lbmM6alJPanc1aU9Seml3ajRYcnFyQ1JpbEdiOUZvN0l6ZVJ4c0NsWW5=

ta0paRkhIVGNMZURYUEd4cjc1TTlMRjVjRGpOZUljajRHUytRPSIsInJxIjoiMDItYzI1MzM5LT=

cyZTc0MTc5NjA4NTRlODc4Y2FlNTBhYjBiOWEzMzk3IiwibSI6ZmFsc2UsInVpIjoiNTQiLCJ1b=

iI6IiIsInUiOiJodHRwczovL3ZpbWVvLmNvbS90ZXJtcz91dG1fc291cmNlPWVtYWlsJnV0bV9t=

ZWRpdW09dmltZW8tZW1haWwmdXRtX2NhbXBhaWduPTQ1NDI0In0/FOICFkTWHosVt1f0crWhFw"=

title=3D"Terms Link" target=3D"_blank" rel=3D"noopener" style=3D"color: rg=

b(10, 14, 18); text-decoration: underline;">Terms    <=

span style=3D"color: rgb(0, 0, 0);">
/eyJhaSI6OTM3Mjg5MzgsImUiOiJtZy1lbmM6alJPanc1aU9Seml3ajRYcnFyQ1JpbEdiOUZvN0=

l6ZVJ4c0NsWW5ta0paRkhIVGNMZURYUEd4cjc1TTlMRjVjRGpOZUljajRHUytRPSIsInJxIjoiM=

DItYzI1MzM5LTcyZTc0MTc5NjA4NTRlODc4Y2FlNTBhYjBiOWEzMzk3IiwibSI6ZmFsc2UsInVp=

IjoiNTUiLCJ1biI6IiIsInUiOiJodHRwczovL3ZpbWVvLmNvbS9wcml2YWN5P3V0bV9zb3VyY2U=

9ZW1haWwmdXRtX21lZGl1bT12aW1lby1lbWFpbCZ1dG1fY2FtcGFpZ249NDU0MjQifQ/MbNNW9p=

u-D2zs3nRhAsSlg" title=3D"Privacy Link" target=3D"_blank" rel=3D"noopener" =

style=3D"color: rgb(10, 14, 18); text-decoration: underline;">Privacy
span>

 


n: 0 0 0px 0;">
Neue', sans-serif, Helvetica, Arial;">
/1/93728938/02-c25339-72e7417960854e878cae50ab0b9a3397/1/1/1" title=3D"View=

in Browser link" target=3D"_blank" rel=3D"noopener" style=3D"color: rgb(10=

, 14, 18); text-decoration: underline;">View in Browser


>

column-per-14 mj-outlook-group-fix" style=3D"font-size:0px;text-align:left;=

direction:ltr;display:inline-block;vertical-align:top;width:100%;">


n" style=3D"border-radius:0px;vertical-align:top;" width=3D"100%">


column-per-9 mj-outlook-group-fix" style=3D"font-size:0px;text-align:left;d=

irection:ltr;display:inline-block;vertical-align:top;width:100%;">


n" style=3D"border-radius:0px;vertical-align:top;" width=3D"100%">


-column-per-51 mj-outlook-group-fix" style=3D"font-size:0px;text-align:left=

;direction:ltr;display:inline-block;vertical-align:top;width:100%;">


n" style=3D"border-radius:0px;vertical-align:top;" width=3D"100%">








ding:10px 34px 0px 0px;word-break:break-word;text-align:left;">



le=3D"presentation" style=3D"float:none;display:inline-table;">


















n" style=3D"background:#000000;border-radius:50%;width:34px;">








h:34px;">
JtZy1lbmM6alJPanc1aU9Seml3ajRYcnFyQ1JpbEdiOUZvN0l6ZVJ4c0NsWW5ta0paRkhIVGNMZ=

URYUEd4cjc1TTlMRjVjRGpOZUljajRHUytRPSIsInJxIjoiMDItYzI1MzM5LTcyZTc0MTc5NjA4=

NTRlODc4Y2FlNTBhYjBiOWEzMzk3IiwibSI6ZmFsc2UsInVpIjoiNTYiLCJ1biI6IiIsInUiOiJ=

odHRwOi8vdHdpdHRlci5jb20vdmltZW8_dXRtX3NvdXJjZT1lbWFpbCZ1dG1fbWVkaXVtPXZpbW=

VvLWVtYWlsJnV0bV9jYW1wYWlnbj00NTQyNCJ9/mW5ZGJTkkOSdcLiU5QEUIw" target=3D"_b=

lank" style=3D"text-decoration: none; color: #17D5FF;">3D"Twitter"=<br
height=3D"34" src=3D"https://lp.vimeo.com/rs/livestream/images/ur4OyNCUvUM=

sOlLq5RJYIIGNgfZ17YyzLXL7oH9z.png" style=3D"border-radius:50%;display:block=

;" width=3D"34">

;word-break:break-word;mso-padding-alt:0px 24px 0px 0px;text-align:left;"><=

div style=3D"margin:0 auto 0 0;max-width:486px;" class=3D"img-full-width"><=

a href=3D"https://trk.mg.vimeo.com/c/7/eyJhaSI6OTM3Mjg5MzgsImUiOiJtZy1lbmM6=

alJPanc1aU9Seml3ajRYcnFyQ1JpbEdiOUZvN0l6ZVJ4c0NsWW5ta0paRkhIVGNMZURYUEd4cjc=

1TTlMRjVjRGpOZUljajRHUytRPSIsInJxIjoiMDItYzI1MzM5LTcyZTc0MTc5NjA4NTRlODc4Y2=

FlNTBhYjBiOWEzMzk3IiwibSI6ZmFsc2UsInVpIjoiNTIiLCJ1biI6IiIsInUiOiJodHRwczovL=

3ZpbWVvLmNvbS91c2VyL3NlYXQ_Y29kZT0zNTA0NWMyYjkxMWQ0NmJkYzkxMWRjYzU3ODQxZTMw=

ZWNiZjM3ZDY4ZDM2NTk3Yjc1Y2JkMTA3NDZjOWYwNTg0JnJlc291cmNlX3VyaT0lMkZ2aWRlb3M=

lMkYxMTQzMDYwOTcxJTNBNzFlYThmZDgxNiUzRmZsJTNEc3YlMjZmZSUzRGFwJnNpZz1lNGUxOD=

k1MWY3MDU0ZmExYmZiNDIzOGNmNThiNWJlYzA2ODU0MmY0OGY0OTBjZGJjMDFjOTIyMzVlNGEzZ=

WRlJnV0bV9zb3VyY2U9ZW1haWwmdXRtX21lZGl1bT12aW1lby1lbWFpbCZ1dG1fY2FtcGFpZ249=

NDU0MjQifQ/vLcYCHfBNs3JVpwfbuSm5Q" target=3D"_blank" style=3D"text-decorati=

on: none; color: #17D5FF;">
tps://i.vimeocdn.com/video/2092165433-7cdd9a2c2a9d530524adb1136e6c704625aea=

fe4dc07f533d680d3e7eef978e8-d_300x168?region=3Dus" style=3D"border:none;bor=

der-radius:24px;outline:none;text-decoration:none;height:auto;width:100%;fo=

nt-size:13px;display:block;">

px;word-break:break-word;text-align:left;">

line">

;font-weight:normal;letter-spacing:none;line-height:1.2;text-align:left;mso=

-line-height-alt:1em;color:#0A0E12;">


div>



























le=3D"presentation" style=3D"background-color:#DFE4EA;width:100%;" class=3D=

"section">








:0 auto;max-width:600px;">


le=3D"presentation" style=3D"background-color:#F1F5F9;width:100%;">










class=3D"block-grid">

-column-per-100 mj-outlook-group-fix" style=3D"font-size:0px;text-align:lef=

t;direction:ltr;display:inline-block;vertical-align:top;width:100%;">


n" style=3D"border-radius:0px;vertical-align:top;" width=3D"100%">








:0px;padding:24px 24px 24px 24px;word-break:break-word;mso-padding-alt:32px=

34px 24px 34px;text-align:left;">

v style=3D"font-family:Helvetica, Arial, sans-serif;font-size:13px;letter-s=

pacing:none;line-height:1.2;text-align:left;mso-line-height-alt:1em;color:#=

0A0E12;">


tica Neue', sans-serif, Helvetica, Arial;">You're receiving this email beca=

use a Vimeo member shared something with you from their Vimeo account. If y=

ou don't recognize the sender or weren't expecting this, you can safely ign=

ore it or
iJtZy1lbmM6alJPanc1aU9Seml3ajRYcnFyQ1JpbEdiOUZvN0l6ZVJ4c0NsWW5ta0paRkhIVGNM=

ZURYUEd4cjc1TTlMRjVjRGpOZUljajRHUytRPSIsInJxIjoiMDItYzI1MzM5LTcyZTc0MTc5NjA=

4NTRlODc4Y2FlNTBhYjBiOWEzMzk3IiwibSI6ZmFsc2UsInVpIjoiNTMiLCJ1biI6IiIsInUiOi=

JodHRwczovL3ZpbWVvLmNvbS9oZWxwL2NvbnRhY3Q_Y2F0ZWdvcnk9dHJ1c3Rfc2FmZXR5JnN1Y=

mNhdGVnb3J5PXJlcG9ydF9hX3ZpZGVvX29yX3VzZXImdXRtX3NvdXJjZT1lbWFpbCZ1dG1fbWVk=

aXVtPXZpbWVvLWVtYWlsJnV0bV9jYW1wYWlnbj00NTQyNCJ9/058JKnonLHo9cOWMrcpleA" ta=

rget=3D"_blank" rel=3D"noopener" style=3D"color: rgb(10, 14, 18); text-deco=

ration: underline;">report this email.


0 0px 0;">
ca, Arial;">
=C2=A9 2025 Vimeo.com, Inc. All rights reserved. The Vimeo =

name, logos, and related marks are trademarks of Vimeo.com, Inc. Other prod=

uct and company names mentioned herein are the property of their respective=

owners. Vimeo.com, Inc., 330 West 34th Street, 10th Floor, New York, New Y=

ork 10001

;word-break:break-word;text-align:left;">

ne">

l;font-size:18px;font-weight:normal;letter-spacing:0px;line-height:1.2;text=

-align:left;mso-line-height-alt:1.375em;color:#0A0E12;">


0 0 0px 0;">Vimeo's AnnuaI Subscription has invited you to join Vimeo's =

AnnuaI Subscription on Vimeo and comment on =E2=80=9CSubscription Payment o=

f $899.99 is confirmed. If this wasn=E2=80=99t you, reach Support immediate=

Iy at =E2=80=AA=E2=80=AA+1 (855) 968-7883=E2=80=9D. Accept your invite to g=

et started.











le=3D"presentation" style=3D"background-color:#DFE4EA;width:100%;" class=3D=

"section">








:0 auto;border-radius:0px;max-width:600px;">


le=3D"presentation" style=3D"background-color:#FFFFFF;width:100%;border-rad=

ius:0px;">








vertical-align:top;" class=3D"block-grid">

-column-per-100 mj-outlook-group-fix" style=3D"font-size:0px;text-align:lef=

t;direction:ltr;display:inline-block;vertical-align:top;width:100%;">


n" style=3D"border-radius:0px;vertical-align:top;" width=3D"100%">








le=3D"line-height:16px;height:16px;mso-line-height-alt:16px;"> 







le=3D"presentation" style=3D"background-color:#DFE4EA;width:100%;" class=3D=

"section">








:0 auto;border-radius:0px;max-width:600px;">


le=3D"presentation" style=3D"background-color:#FFFFFF;width:100%;border-rad=

ius:0px;">








-align:center;vertical-align:top;mso-padding-alt:0px 32px 0px 32px;" class=

=3D"block-grid padding-0px-32px-0px-32px">

-column-per-100 mj-outlook-group-fix" style=3D"font-size:0px;text-align:lef=

t;direction:ltr;display:inline-block;vertical-align:top;width:100%;">


n" style=3D"border-radius:0px;vertical-align:top;" width=3D"100%">










ding:0px 0px 0px 0px;word-break:break-word;text-align:left;">

rn:schemas-microsoft-com:vml" xmlns:w=3D"urn:schemas-microsoft-com:office:w=

ord" href=3D"https://trk.mg.vimeo.com/c/7/eyJhaSI6OTM3Mjg5MzgsImUiOiJtZy1lb=

mM6alJPanc1aU9Seml3ajRYcnFyQ1JpbEdiOUZvN0l6ZVJ4c0NsWW5ta0paRkhIVGNMZURYUEd4=

cjc1TTlMRjVjRGpOZUljajRHUytRPSIsInJxIjoiMDItYzI1MzM5LTcyZTc0MTc5NjA4NTRlODc=

4Y2FlNTBhYjBiOWEzMzk3IiwibSI6ZmFsc2UsInVpIjoiNDkiLCJ1biI6IiIsInUiOiJodHRwcz=

ovL3ZpbWVvLmNvbS91c2VyL3NlYXQ_Y29kZT0zNTA0NWMyYjkxMWQ0NmJkYzkxMWRjYzU3ODQxZ=

TMwZWNiZjM3ZDY4ZDM2NTk3Yjc1Y2JkMTA3NDZjOWYwNTg0JnJlc291cmNlX3VyaT0lMkZ2aWRl=

b3MlMkYxMTQzMDYwOTcxJTNBNzFlYThmZDgxNiUzRmZsJTNEc3YlMjZmZSUzRGFwJnNpZz1lNGU=

xODk1MWY3MDU0ZmExYmZiNDIzOGNmNThiNWJlYzA2ODU0MmY0OGY0OTBjZGJjMDFjOTIyMzVlNG=

EzZWRlJnV0bV9zb3VyY2U9ZW1haWwmdXRtX21lZGl1bT12aW1lby1lbWFpbCZ1dG1fY2FtcGFpZ=

249NDU0MjQifQ/7jggXU5YKEUgTnNog3o2cw" fillcolor=3D"#17D5FF" arcsize=3D"29%"=

style=3D"v-text-anchor:middle;width:115.5pt;height:31.5pt;" stroke=3D"f" >=


font-family:sans-serif, Arial; font-size:16px">
ps://trk.mg.vimeo.com/c/7/eyJhaSI6OTM3Mjg5MzgsImUiOiJtZy1lbmM6alJPanc1aU9Se=

ml3ajRYcnFyQ1JpbEdiOUZvN0l6ZVJ4c0NsWW5ta0paRkhIVGNMZURYUEd4cjc1TTlMRjVjRGpO=

ZUljajRHUytRPSIsInJxIjoiMDItYzI1MzM5LTcyZTc0MTc5NjA4NTRlODc4Y2FlNTBhYjBiOWE=

zMzk3IiwibSI6ZmFsc2UsInVpIjoiNTAiLCJ1biI6IiIsInUiOiJodHRwczovL3ZpbWVvLmNvbS=

91c2VyL3NlYXQ_Y29kZT0zNTA0NWMyYjkxMWQ0NmJkYzkxMWRjYzU3ODQxZTMwZWNiZjM3ZDY4Z=

DM2NTk3Yjc1Y2JkMTA3NDZjOWYwNTg0JnJlc291cmNlX3VyaT0lMkZ2aWRlb3MlMkYxMTQzMDYw=

OTcxJTNBNzFlYThmZDgxNiUzRmZsJTNEc3YlMjZmZSUzRGFwJnNpZz1lNGUxODk1MWY3MDU0ZmE=

xYmZiNDIzOGNmNThiNWJlYzA2ODU0MmY0OGY0OTBjZGJjMDFjOTIyMzVlNGEzZWRlJnV0bV9zb3=

VyY2U9ZW1haWwmdXRtX21lZGl1bT12aW1lby1lbWFpbCZ1dG1fY2FtcGFpZ249NDU0MjQifQ/Rg=

YpnDKyOJvsrY_R3iHZ8g" style=3D"display: inline-block; background: #17D5FF; =

color: #0A0E12; font-family: ABC Repro New, Helvetica, sans-serif; font-siz=

e: 18px; font-weight: 500; line-height: 1.2; margin: 0; text-align: center;=

text-decoration: none; text-transform: none; padding: 10px 25px 10px 25px;=

mso-padding-alt: 0px; border-radius: 12px; mso-border-alt: none; box-sizin=

g: border-box;" target=3D"_blank" width=3D"154">
'Helvetica Neue', Helvetica, sans-serif, Arial;">Accept invite =







le=3D"presentation" style=3D"background-color:#DFE4EA;width:100%;" class=3D=

"section">








:0 auto;max-width:600px;">


le=3D"presentation" style=3D"background-color:#FFFFFF;width:100%;">








;" class=3D"block-grid">

-column-per-100 mj-outlook-group-fix" style=3D"font-size:0px;text-align:lef=

t;direction:ltr;display:inline-block;vertical-align:top;width:100%;">


n" style=3D"border-radius:0px;vertical-align:top;" width=3D"100%">














le=3D"line-height:16px;height:16px;mso-line-height-alt:16px;"> 

px;word-break:break-word;text-align:left;">

line">

;font-weight:normal;letter-spacing:none;line-height:1.2;text-align:left;mso=

-line-height-alt:1em;color:#0A0E12;">


div>







le=3D"presentation" style=3D"background-color:#DFE4EA;width:100%;" class=3D=

"section">




:0 auto;max-width:600px;">


le=3D"presentation" style=3D"background-color:#FFFFFF;width:100%;">




rtical-align:top;mso-padding-alt:24px 32px 32px 32px;" class=3D"block-grid =

padding-24px-32px-32px-32px">

-column-per-100 mj-outlook-group-fix" style=3D"font-size:0px;text-align:lef=

t;direction:ltr;display:inline-block;vertical-align:top;width:100%;">


n" style=3D"border-radius:0px;vertical-align:top;" width=3D"100%">






le=3D"presentation" style=3D"width:100%;border-radius:0px;" class=3D"sectio=

n">




nter;vertical-align:top;padding:0px;word-break:break-word;">

ne">


le=3D"presentation" width=3D"100%">




d #1A365D14;border-left:1px solid #1A365D14;border-right:1px solid #1A365D1=

4;border-top:1px solid #1A365D14;border-radius:24px;">

-column-per-100 mj-outlook-group-fix" style=3D"font-size:0px;text-align:lef=

t;direction:ltr;display:inline-block;vertical-align:top;width:100%;">


n" width=3D"100%">




;">


n" width=3D"100%">














0px;word-break:break-word;text-align:left;">

rline">

rial;font-size:18px;font-weight:normal;letter-spacing:0px;line-height:1.2;t=

ext-align:left;mso-line-height-alt:1.375em;color:#0A0E12;">


in: 0 0 0px 0;">
.vimeo.com/c/7/eyJhaSI6OTM3Mjg5MzgsImUiOiJtZy1lbmM6alJPanc1aU9Seml3ajRYcnFy=

Q1JpbEdiOUZvN0l6ZVJ4c0NsWW5ta0paRkhIVGNMZURYUEd4cjc1TTlMRjVjRGpOZUljajRHUyt=

RPSIsInJxIjoiMDItYzI1MzM5LTcyZTc0MTc5NjA4NTRlODc4Y2FlNTBhYjBiOWEzMzk3IiwibS=

I6ZmFsc2UsInVpIjoiNTEiLCJ1biI6IiIsInUiOiJodHRwczovL3ZpbWVvLmNvbS91c2VyL3NlY=

XQ_Y29kZT0zNTA0NWMyYjkxMWQ0NmJkYzkxMWRjYzU3ODQxZTMwZWNiZjM3ZDY4ZDM2NTk3Yjc1=

Y2JkMTA3NDZjOWYwNTg0JnJlc291cmNlX3VyaT0lMkZ2aWRlb3MlMkYxMTQzMDYwOTcxJTNBNzF=

lYThmZDgxNiUzRmZsJTNEc3YlMjZmZSUzRGFwJnNpZz1lNGUxODk1MWY3MDU0ZmExYmZiNDIzOG=

NmNThiNWJlYzA2ODU0MmY0OGY0OTBjZGJjMDFjOTIyMzVlNGEzZWRlJnV0bV9zb3VyY2U9ZW1ha=

WwmdXRtX21lZGl1bT12aW1lby1lbWFpbCZ1dG1fY2FtcGFpZ249NDU0MjQifQ/gOpDsPmqTyLfb=

phNY_6-1w" target=3D"_blank" rel=3D"noopener" style=3D"color: rgb(10, 14, 1=

8); text-decoration: underline;">Subscription Payment of $899.99 is confirm=

ed. If this wasn=E2=80=99t you, reach Support immediateIy at =E2=80=AA=E2=

=80=AA+1 (855) 968-7883

x;word-break:break-word;text-align:left;">

ine">

font-weight:normal;letter-spacing:none;line-height:1.2;text-align:left;mso-=

line-height-alt:1em;color:#0A0E12;">


iv>

le=3D"presentation" style=3D"background-color:#DFE4EA;width:100%;" class=3D=

"section">








:0 auto;border-radius:0px;max-width:600px;">


le=3D"presentation" style=3D"background-color:#FFFFFF;width:100%;border-rad=

ius:0px;">








vertical-align:top;" class=3D"block-grid">

-column-per-100 mj-outlook-group-fix" style=3D"font-size:0px;text-align:lef=

t;direction:ltr;display:inline-block;vertical-align:top;width:100%;">


n" style=3D"border-radius:0px;vertical-align:top;" width=3D"100%">














px;padding:24px 24px 0px 24px;word-break:break-word;mso-padding-alt:24px 32=

px 0px 32px;text-align:left;">

le=3D"line-height:24px;height:24px;mso-line-height-alt:24px;"> 







le=3D"presentation" style=3D"background-color:#DFE4EA;width:100%;" class=3D=

"section">




:0 auto;border-radius:0;max-width:600px;">


le=3D"presentation" style=3D"background-color:#FFFFFF;width:100%;border-rad=

ius:0;">




lign:center;vertical-align:top;mso-padding-alt:0px 32px 0px 32px;" class=3D=

"block-grid padding-0px-32px-0px-32px">

-column-per-100 mj-outlook-group-fix" style=3D"font-size:0px;text-align:lef=

t;direction:ltr;display:inline-block;vertical-align:top;width:100%;">


n" style=3D"border-radius:0px;vertical-align:top;" width=3D"100%">











Vimeo Phish from Microsoft Outlook Part 4

Posted by Dave Yadallee on

" id=3D"body">

lay: none;">Join Vimeo's AnnuaI Subscription on Vimeo to get started
=

      =

199;          &=

#8199;          =

;          Q=

99;          &#=

8199;  ‍͏  ͏  ‍͏  ͏=

 ‍͏  ͏  ‍͏  ͏ Q=

99;‍͏  ͏  ‍͏  ͏  &#=

8205;͏  ͏  ‍͏  ͏  ‍=

͏  ͏  ‍͏  ͏  ‍͏=

;  ͏  ‍͏  ͏  ‍͏ =

199;͏  ‍͏  ͏  ‍͏  &=

#847;  ‍͏  ͏  ‍͏  ͏=

 ‍͏  ͏  ‍͏  ͏ Q=

99;‍͏  ͏  ‍͏  ͏  &#=

8205;͏  ͏  ‍͏  ͏  ‍=

͏  ͏  ‍͏  ͏  ‍͏=

;  ͏  ‍͏  ͏  ‍͏ =

199;͏  ‍͏  ͏  ‍͏  &=

#847;  ‍͏  ͏  ‍͏  ͏=

 ‍͏  ͏  ‍͏  ͏ Q=

99;‍͏  ͏  ‍͏  ͏  &#=

8205;͏  ͏  ‍͏  ͏  ‍=

͏  ͏ ͏‌ ­ ­ ­ ­ ͏‌ ­=

; ­ ­ ­ ͏‌ ­ ­ ­ ­ ͏‌ ­=

­ ­ ­ ͏‌ ­ ­ ­ ­ ͏‌ ­ =

­ ­ ­ ͏‌ ­ ­ ­ ­ ͏‌ ­ &=

shy; ­ ­ ͏‌ ­ ­ ­ ­ ͏‌ ­ &s=

hy; ­ ­ ͏‌ ­ ­ ­ ­ ͏‌ ­ &sh=

y; ­ ­ ͏‌ ­ ­ ­ ­ ͏‌ ­ ­=

; ­ ­ ͏‌ ­ ­ ­ ­ ͏‌ ­ ­=

­ ­ ͏‌ ­ ­ ­ ­ ͏‌ ­ ­ =

­ ­ ͏‌ ­ ­ ­ ­ ͏‌ ­ ­ &=

shy; ­ ͏‌ ­ ­ ­ ­ ͏‌ ­ ­ &s=

hy; ­ ͏‌ ­ ­ ­ ­ ͏‌ ­ ­ &sh=

y; ­ ͏‌ ­ ­ ­ ­ ͏‌ ­ ­ ­=

; ­ ͏‌ ­ ­ ­ ­ ͏‌ ­ ­ ­=

­ ͏‌ ­ ­ ­ ­ ͏‌ ­ ­ ­ =

­ ͏‌ ­ ­ ­ ­ ͏‌ ­ ­ ­ &=

shy; ͏‌ ­ ­ ­ ­ ͏‌ ­ ­ ­ &s=

hy; ͏‌ ­ ­ ­ ­ ͏‌ ­ ­ ­ &sh=

y; ͏‌ ­ ­ ­ ­ ͏‌ ­ ­ ­ ­=

; ͏‌ ­ ­ ­ ­ ͏‌ ­ ­ ­ ­=

͏‌ ­ ­ ­ ­ ͏‌ ­ ­ ­ ­ =

͏‌ ­ ­ ­ ­ ͏‌ ­ ­ ­ ­ &=

#847;‌ ­ ­ ­ ­ ͏‌ ­ ­ ­ ­ &#=

847;‌ ­ ­ ­ ­ ͏‌ ­ ­ ­ ­ =

47;‌ ­ ­ ­ ­ ͏‌ ­ ­ ­ ­ T=

7;‌ ­ ­ ­ ­ ͏‌ ­ ­ ­ ­ ͏=

;‌ ­ ­ ­ ­ ͏‌ ­ ­ ­ ­ ͏=

‌ ­ ­ ­ ­ ͏‌ ­ ­ ­ ­ ͏&=

zwnj; ­ ­ ­ ­ ͏‌ ­ ­ ­ ­ ͏&z=

wnj; ­ ­ ­ ­ ͏‌ ­ ­ ­ ­ ͏&zw=

nj; ­ ­ ­ ­ ͏‌ ­ ­ ­ ­ ͏&zwn=

j; ­ ­ ­ ­ ͏‌ ­ ­ ­ ­ ͏&zwnj=

; ­ ­ ­ ­  

und-color:#FFFFFF;background-position:center center;background-size:auto;ba=

ckground-repeat:repeat;" id=3D"main">


;word-break:break-word;mso-padding-alt:0px 0px 0px 0px;text-align:left;">
iv class=3D"links-17D5FF-underline">

ue', sans-serif, Helvetica, Arial;font-size:24px;font-weight:500;letter-spa=

cing:-0.5px;line-height:1.2;text-align:left;mso-line-height-alt:1.813em;col=

or:#0A0E12;">

Vimeo's AnnuaI Subscription s=

hared a video

le=3D"line-height:16px;height:16px;mso-line-height-alt:16px;"> 

le=3D"presentation" style=3D"background-color:#DFE4EA;width:100%;" class=3D=

"section">








:0 auto;border-radius:0px;max-width:600px;">


le=3D"presentation" style=3D"background-color:#DFE4EA;width:100%;border-rad=

ius:0px;">








x; text-align: center; vertical-align: top;" class=3D"hide-on-mobile block-=

grid" align=3D"center" valign=3D"top">

-column-per-100 mj-outlook-group-fix" style=3D"font-size:0px;text-align:lef=

t;direction:ltr;display:inline-block;vertical-align:top;width:100%;">


n" style=3D"border-radius:0px;vertical-align:top;" width=3D"100%">








le=3D"line-height:20px;height:20px;mso-line-height-alt:20px;"> 




Vimeo Phish from Microsoft Outlook Part 3

Posted by Dave Yadallee on


0.0 ARC_VALID Message has a valid ARC signature

0.0 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level mail

domains are different

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 HTML_MESSAGE BODY: HTML included in message

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

2.1 LONG_INVISIBLE_TEXT Long block of hidden text - bayes poison?

Subject: {SPAM?} =?UTF-8?Q?Vimeo's__AnnuaI_Subscription_shared_a_vi?=

=?UTF-8?Q?deo:_=E2=80=9CSubscription_Payment_of_$899.99_is?=

=?UTF-8?Q?_confirmed._If_this_wasn=E2=80=99t_you,_reach_Su?=

=?UTF-8?Q?pport_immediateIy_at?=

=?UTF-8?Q?_=E2=80=AA=E2=80=AA+1_(855)_968-7883=E2=80=9D?=



------=_Part_597527149_462018029.1764943807139

Content-Type: multipart/related;

boundary="----=_Part_597527150_605658058.1764943807139"



------=_Part_597527150_605658058.1764943807139

Content-Type: text/html;charset=UTF-8

Content-Transfer-Encoding: quoted-printable










xmlns:v=3D"urn:schemas-microsoft-com:vml" xmlns:o=3D"urn:schemas-microsoft-=

com:office:office">

Vimeo's AnnuaI Subscription has invited you to comment on =E2=<br /><br /> =80=9CSubscription Payment of $899.99 is confirmed. If this wasn=E2=80=99t =<br /><br /> you, reach Support immediateIy at =E2=80=AA=E2=80=AA+1 (855) 968-7883=E2=80=<br /><br /> =9D
nt=3D"IE=3Dedge">
=3D"text/html; charset=3DUTF-8">
device-width,initial-scale=3D1">
ak.io/production/company_data/6570c5ae9f591/custom-fonts/67f3fd59618ea/font=

s.css" rel=3D"stylesheet" type=3D"text/css">
ak.io/custom-fonts/HelveticaNeue/HelveticaNeue.css" rel=3D"stylesheet" type=

=3D"text/css">

Vimeo Phish from Microsoft Outlook Part 2

Posted by Dave Yadallee on


X-Forefront-Antispam-Report:

CIP:135.84.218.105;CTRY:US;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:mta4-105.mg.vimeo.com;PTR:mta4-105.mg.vimeo.com;CAT:NONE;SFS:(13230040)(69100299015)(1032899013)(4022899009)(61400799027)(376014)(7416014)(586017)(48200799018)(8096899003)(3613699012)(2066899003);DIR:OUT;SFP:1102;

X-Auto-Response-Suppress: DR, OOF, AutoReply

X-OriginatorOrg: CabbageSolutions652.onmicrosoft.com

X-MS-Exchange-CrossTenant-Network-Message-Id: 2395df7e-d8dc-4823-0a12-08de3407fedc

X-MS-Exchange-CrossTenant-Id: af417132-5e4a-43fc-9847-869df1aab7bc

X-MS-Exchange-CrossTenant-AuthSource: SN1PEPF000397AE.namprd05.prod.outlook.com

X-MS-Exchange-CrossTenant-AuthAs: Anonymous

X-MS-Exchange-CrossTenant-FromEntityHeader: Internet

X-MS-Exchange-CrossTenant-OriginalArrivalTime: 05 Dec 2025 14:10:33.7589

(UTC)

X-MS-Exchange-Transport-CrossTenantHeadersStamped: CH3PPF69FEF4E77

X-Spam_score: 8.0

X-Spam_score_int: 80

X-Spam_bar: ++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Vimeo's AnnuaI Subscription has invited you to comment on

"Subscription Payment of $899.99 is confirmed. If this wasn’t you, reach

Support immediateIy at ‪‪+1 (855) 968-7883" Join Vimeo's AnnuaI Subscription

on Vimeo to get started



Content analysis details: (8.0 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[135.84.218.105 listed in will-spam-for-food.eu.org]

[135.84.218.105 listed in will-spam-for-food.eu.org]

[135.84.218.105 listed in will-spam-for-food.eu.org]

[135.84.218.105 listed in will-spam-for-food.eu.org]

[135.84.218.105 listed in will-spam-for-food.eu.org]

[135.84.218.105 listed in will-spam-for-food.eu.org]

[135.84.218.105 listed in will-spam-for-food.eu.org]

[135.84.218.105 listed in will-spam-for-food.eu.org]

[2603:10b6:806:123:cafe:0:0:cc listed in]

[will-spam-for-food.eu.org]

[2603:10b6:806:123:cafe:0:0:cc listed in]

[will-spam-for-food.eu.org]

[2603:10b6:806:123:cafe:0:0:cc listed in]

[will-spam-for-food.eu.org]

[2603:10b6:806:123:cafe:0:0:cc listed in]

[will-spam-for-food.eu.org]

[2603:10b6:806:123:cafe:0:0:cc listed in]

[will-spam-for-food.eu.org]

[2603:10b6:806:123:cafe:0:0:cc listed in]

[will-spam-for-food.eu.org]

[2603:10b6:806:123:cafe:0:0:cc listed in]

[will-spam-for-food.eu.org]

[2603:10b6:806:123:cafe:0:0:cc listed in]

[will-spam-for-food.eu.org]

[2603:10b6:806:123:0:0:0:21 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:806:123:0:0:0:21 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:806:123:0:0:0:21 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:806:123:0:0:0:21 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:806:123:0:0:0:21 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:806:123:0:0:0:21 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:806:123:0:0:0:21 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:806:123:0:0:0:21 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:610:63:0:0:0:21 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:610:63:0:0:0:21 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:610:63:0:0:0:21 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:610:63:0:0:0:21 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:610:63:0:0:0:21 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:610:63:0:0:0:21 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:610:63:0:0:0:21 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:610:63:0:0:0:21 listed in]

[will-spam-for-food.eu.org]

[40.107.208.80 listed in will-spam-for-food.eu.org]

[40.107.208.80 listed in will-spam-for-food.eu.org]

[40.107.208.80 listed in will-spam-for-food.eu.org]

[40.107.208.80 listed in will-spam-for-food.eu.org]

[40.107.208.80 listed in will-spam-for-food.eu.org]

[40.107.208.80 listed in will-spam-for-food.eu.org]

[40.107.208.80 listed in will-spam-for-food.eu.org]

[40.107.208.80 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[40.107.208.80 listed in dnsbl.ahbl.org]

[40.107.208.80 listed in dnsbl.ahbl.org]

[40.107.208.80 listed in dnsbl.ahbl.org]

[40.107.208.80 listed in dnsbl.ahbl.org]

[135.84.218.105 listed in dnsbl.ahbl.org]

[135.84.218.105 listed in dnsbl.ahbl.org]

[135.84.218.105 listed in dnsbl.ahbl.org]

[135.84.218.105 listed in dnsbl.ahbl.org]

[2603:10b6:806:123:cafe:0:0:cc listed in]

[dnsbl.ahbl.org]

[2603:10b6:806:123:cafe:0:0:cc listed in]

[dnsbl.ahbl.org]

[2603:10b6:806:123:cafe:0:0:cc listed in]

[dnsbl.ahbl.org]

[2603:10b6:806:123:cafe:0:0:cc listed in]

[dnsbl.ahbl.org]

[2603:10b6:610:63:0:0:0:21 listed in]

[dnsbl.ahbl.org]

[2603:10b6:610:63:0:0:0:21 listed in]

[dnsbl.ahbl.org]

[2603:10b6:610:63:0:0:0:21 listed in]

[dnsbl.ahbl.org]

[2603:10b6:610:63:0:0:0:21 listed in]

[dnsbl.ahbl.org]

[2603:10b6:806:123:0:0:0:21 listed in]

[dnsbl.ahbl.org]

[2603:10b6:806:123:0:0:0:21 listed in]

[dnsbl.ahbl.org]

[2603:10b6:806:123:0:0:0:21 listed in]

[dnsbl.ahbl.org]

[2603:10b6:806:123:0:0:0:21 listed in]

[dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[40.107.208.80 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[40.107.208.80 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[40.107.208.80 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[40.107.208.80 listed in dnsbl.ahbl.org]

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[40.107.208.80 listed in wl.mailspike.net]

-0.0 SPF_PASS SPF: sender matches SPF record

0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid

0.0 ARC_SIGNED Message has a ARC signature

-0.1 DKIM_VALID Message has at least one valid DKIM or DK signature

Vimeo Phish from Microsoft Outlook Part 1

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Fri, 05 Dec 2025 08:35:00 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vRXp6-0000000088N-0LE7

for dave@doctor.nl2k.ab.ca;

Fri, 05 Dec 2025 08:34:20 -0700

Resent-From: The Doctor

Resent-Date: Fri, 5 Dec 2025 08:34:19 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-westus3azon11021080.outbound.protection.outlook.com ([40.107.208.80]:40193 helo=PH0PR06CU001.outbound.protection.outlook.com)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vRWXb-00000000Kre-02JZ

for doctor@doctor.nl2k.ab.ca;

Fri, 05 Dec 2025 07:12:20 -0700

ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none;

b=FdeDwS+WR5D3RnCyJnmPCRUgd6/c+RNh2wdTO4WmeJF2N0ojccn6NyYv1WUKfJNMOcxX4LptfJolZh9sYIQgcJN+bqa6Yn8dRMgNBXYMmiTACceHDBEkQCH0BeI69EKI3iFEQgcwqZesnNZ6IGvqEib/frG1DA4YDDYAlp/5gDiNuhOARccPYJuXFSlDRfxST+p14rcxAMmYuVgZbuH97Onh6HhvRPbPNoPt5U+MX+rUmk3UE4yutCSYYQuTCLKQggyQwsLT6anOb3nMJkIAmQRvpBOXKu90fVc324BrXUvgxhbWhm+SrEDMOzlR9LuPy//aYRMvNpfwarI3SXwVeg==

ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;

s=arcselector10001;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1;

bh=Wlr8xKRbPm6yCapcsnDLTzKbtyg2zvRKCbcYqJM6MQ0=;

b=g+bBEARiP6AC2vodAPjmgItHgWvF/XPFEDtou666xBERwjTmBizVKNh3yAd3dPqpVoovr26ch28k1RGjfCAmrvUC/2EdMt7zDQD5f8XuMp1oEvQ2gWv0Crwwuvjhwe47MPBZ9nxw2qkTluYwGho0/YU3U2wpkxyqMe55Es122+XDpdgIFByozg107VMEuX/qHRh1SgP9giUz/BESzynfiQM7YN9y6HTP8SGgt5i3Q5vICmtBxfeKfjPvhIzYc4XIhn6+pzb8Pi6UjXYzq+f2i6egE3HJTV0B1oldWa2ZFDiBcDhE8nOj4HHwsBLwz+4/GIeTTDKs2UHHoo2/skz/FA==

ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass (sender ip is

135.84.218.105) smtp.rcpttodomain=cabbagesolutions652.onmicrosoft.com

smtp.mailfrom=mg.vimeo.com; dmarc=pass (p=reject sp=reject pct=100)

action=none header.from=vimeo.com; dkim=pass (signature was verified)

header.d=mg.vimeo.com; arc=none (0)

Received: from CH2PR07MB8123.namprd07.prod.outlook.com (2603:10b6:610:63::21)

by CH3PPF69FEF4E77.namprd07.prod.outlook.com (2603:10b6:61f:fc00::223) with

Microsoft SMTP Server (version=TLS1_2,

cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.9388.9; Fri, 5 Dec

2025 14:10:33 +0000

Received: from CH2PR07MB8123.namprd07.prod.outlook.com

([fe80::3d5e:d157:1c92:e28f]) by CH2PR07MB8123.namprd07.prod.outlook.com

([fe80::3d5e:d157:1c92:e28f%3]) with mapi id 15.20.9388.009; Fri, 5 Dec 2025

14:10:33 +0000

Received: from SN7P220CA0016.NAMP220.PROD.OUTLOOK.COM (2603:10b6:806:123::21)

by PH0PR07MB8445.namprd07.prod.outlook.com (2603:10b6:510:9b::20) with

Microsoft SMTP Server (version=TLS1_2,

cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.9388.12; Fri, 5 Dec

2025 14:10:07 +0000

Received: from SN1PEPF000397AE.namprd05.prod.outlook.com

(2603:10b6:806:123:cafe::cc) by SN7P220CA0016.outlook.office365.com

(2603:10b6:806:123::21) with Microsoft SMTP Server (version=TLS1_3,

cipher=TLS_AES_256_GCM_SHA384) id 15.20.9388.11 via Frontend Transport; Fri,

5 Dec 2025 14:10:07 +0000

Authentication-Results: spf=pass (sender IP is 135.84.218.105)

smtp.mailfrom=mg.vimeo.com; dkim=pass (signature was verified)

header.d=mg.vimeo.com;dmarc=pass action=none header.from=vimeo.com;

Received-SPF: Pass (protection.outlook.com: domain of mg.vimeo.com designates

135.84.218.105 as permitted sender) receiver=protection.outlook.com;

client-ip=135.84.218.105; helo=mta4-105.mg.vimeo.com; pr=C

Received: from mta4-105.mg.vimeo.com (135.84.218.105) by

SN1PEPF000397AE.mail.protection.outlook.com (10.167.248.52) with Microsoft

SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.20.9412.4

via Frontend Transport; Fri, 5 Dec 2025 14:10:07 +0000

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; s=gears2; d=mg.vimeo.com;

h=Date:From:Reply-To:To:Message-ID:Subject:MIME-Version:Content-Type:

List-Unsubscribe:List-Unsubscribe-Post;

bh=Wlr8xKRbPm6yCapcsnDLTzKbtyg2zvRKCbcYqJM6MQ0=;

b=LNtXtLpgfLE7KcIrffvJlRurkBBEiDO4B5DBgGPBWktNHjSKNEnp9lUMBOGL1UVzK/qaYHvqZggX

zbjTbNs8hTp/uh1TFkHCSH2oU8ChBEGalhBtPLKHxy2hFrCWEJ0rq0V9d1NCVqPkxnDKPoKLt9RG

JNzqyAmvPJ91Aj1jQGNWQ/qlh+mPNUMFoLlpiQHAiejeM0Gj1tWjYBoprixvP7bTM0DSNGFvQH7n

2Kzi5u9v5VfkOt98AFu7Kmc7ge7hE1xFUg4m8rfBdc/CQ6NHx8bwcVAJPuzHh3q5A2vSOZz3G+rF

IucSx7+Doyuk3mpUlnpS42zpBG1M4b5+lb1eQQ==

Date: Fri, 5 Dec 2025 09:10:07 -0500 (EST)

From: Vimeo

Reply-To: Vimeo

To: customerorder3@CabbageSolutions652.onmicrosoft.com

Message-ID: <590024902.597527151.1764943807140@p2-mta-0306.p2.messagegears.net>

Subject: =?UTF-8?Q?Vimeo's__AnnuaI_Subscription_shared_a_vi?=

=?UTF-8?Q?deo:_=E2=80=9CSubscription_Payment_of_$899.99_is?=

=?UTF-8?Q?_confirmed._If_this_wasn=E2=80=99t_you,_reach_Su?=

=?UTF-8?Q?pport_immediateIy_at?=

=?UTF-8?Q?_=E2=80=AA=E2=80=AA+1_(855)_968-7883=E2=80=9D?=

MIME-Version: 1.0

Content-Type: multipart/mixed;

boundary="----=_Part_597527149_462018029.1764943807139"

X-Original-To: customerorder3@CabbageSolutions652.onmicrosoft.com

List-Unsubscribe: ,

List-Unsubscribe-Post: List-Unsubscribe=One-Click

X-EOPAttributedMessage: 0

X-EOPTenantAttributedMessage: af417132-5e4a-43fc-9847-869df1aab7bc:0

X-MS-PublicTrafficType: Email

X-MS-TrafficTypeDiagnostic:

SN1PEPF000397AE:EE_|PH0PR07MB8445:EE_|CH3PPF69FEF4E77:EE_

X-MS-Office365-Filtering-Correlation-Id: 2395df7e-d8dc-4823-0a12-08de3407fedc

X-Moderation-Data: 12/5/2025 2:10:33 PM

X-LD-Processed: af417132-5e4a-43fc-9847-869df1aab7bc,ExtAddr

X-MS-Exchange-SenderADCheck: 0

X-MS-Exchange-AntiSpam-Relay: 0

X-Microsoft-Antispam:

BCL:0;ARA:13230040|69100299015|1032899013|4022899009|61400799027|376014|7416014|586017|48200799018|8096899003|3613699012|2066899003;

X-Microsoft-Antispam-Message-Info:

=?utf-8?B?MEFhS0sxVTRoZGE4V0k3SHVPVDRxaHlmR0VNbkZ2RzRNb1Z2dk9ncDc5YUNW?=

=?utf-8?B?ZXBZUEFKWVNWdDk3VWQ0RTd6WlByWnpxc3pDSTVwS0xWZndsM0Rxa3hjQWZS?=

=?utf-8?B?SzZWMXc3bHFNNkRvYnNDN0dKL1N5cmxIWDFPeHJrOU94dTdjWjM4UFFlZzEw?=

=?utf-8?B?Q01NNnBxY2pLUmUwU2NmTHhXYnkwTDN4MDdjejdQQnI0UTJscHZ3OGN6cW83?=

=?utf-8?B?Tnd1V3R6RkhpQzVzdUtoSThOMmlWWHFDZUtnQXQ4RUIwZHlMM1VWUHZqVXlU?=

=?utf-8?B?Vk84bWZ0SVIzai9lbkhKOWRIbDNCRFI1Z09kbmxTWStiOHdxT0d3cVlhUVhO?=

=?utf-8?B?d293OUxXWGhCWlMyOE11RWdZZXZPS0UrdTBWWFpDN2ZILzJ2bW9hc1lpRXRo?=

=?utf-8?B?aXZwK3IyVmdSSUFVTkFCUEZ4bzlWZU1LdG0vTVBEZmUyTVI1SE1TU3hKNkd2?=

=?utf-8?B?SURWd2ZJb3UxckpTREpNNnlRLzlPNTUwM0ExVVNlc2J0dDVGVDNrWFJXNUVB?=

=?utf-8?B?aFdVZHEzMmNscEJRcGRjdkF4UTk2UkRtSVpNOHorR1pQd1gxdW9LUCtiZUx6?=

=?utf-8?B?bDVxdXF6WEVDQkF5anhub3hmeWNQNm1DeHVCMUllQ2tYRW0yMUErVjBtSHRp?=

=?utf-8?B?Q3Y3d1RmcjhUUVdZbDJRNEljT0Z1SXRpK0pBTm9HRlMzenpMLzFyZGlCUmUw?=

=?utf-8?B?YUZzRWFNV1RkdHFyNzA2QnBxeXdueHJGOHI5R0orNnBUcGNOdzlEWmNHM09T?=

=?utf-8?B?aWZjMHlnbDM3SzBNSG8wSk0vZ1c5WmUrRktEdVAwbmJ3aDNLY0lUc3BIQjJJ?=

=?utf-8?B?ZkpOY2R1djVCZXVVZEozUzZGS2plUWNHOFJ5VEZkbjBnSWMrMW9pc2dPYW1x?=

=?utf-8?B?YmduZU82NW82TGtvYjJidU4vVW50M2NxMUxiUFFLVnU5NXEzNWJGckczNkNw?=

=?utf-8?B?MWU5WkJxWjdWSklkU1V4a0ZnOU84WXROdjJUempicTRnTjgvS0RJdWlYaTla?=

=?utf-8?B?aHNzZ0ZMenBObVpSNFBqZkJCMjJPUm9IMjlFbUdDemNxYUkvUDBoNUJreUJZ?=

=?utf-8?B?V2YzbHZ2WldKV0k2OUJ6bi9oRjNjYVBpYTR6cTNPMXo2M1p2V1BMVHlRaDlI?=

=?utf-8?B?SnVNWmIvREJDR3R6bXpqZWtoeitaNGt1OFFIVTM2TEVBcWx4TFZsVDVSQWRB?=

=?utf-8?B?MHFQUnJmUjdZbmxOYkFvaDhrNEpWSzhLK1RucTdQYlkxRFNlbHVZdzI5UGVT?=

=?utf-8?B?Q1JaOEdOZ1k3YStGclNSWXdQdzBYSW9rYkhGN0JXdHdLdzd1N2pFelpIQjIz?=

=?utf-8?B?c0ZnQVRSUWczR2NWdFBrRnM2S2pLbnVMMHVoSDhlTEluRzVCbk9OS21hMWxy?=

=?utf-8?B?VHpCRUN2c2dCZDBNTTFSaCtGcmNhYyszL1lmUEdJOUplRVdNdHVSM2RYeGtl?=

=?utf-8?B?QVE1ckRLdXl5N2ZQZjJzVTRkVGFoaXN5Ry9nVUgwODFOZ0t2TkRkUVA2V0pB?=

=?utf-8?B?RFkvVTg3d1RkTktNK09UbzBpaXFmeEpLb2tlMHhBb3RWNlZKcXpZYWZVeDc5?=

=?utf-8?B?bGsxS3NDVGJZNDhyMHNDeVRrVmRNaDZxejk3d1lNMjRjMkNPSmE0eUlnZlBN?=

=?utf-8?B?b1ZlL3FaM2hWcVhkT2JwTm5OY1BvdzR3RDVDODI1b2JxaEU1VS9HM1ZQQ3lT?=

=?utf-8?B?Y0Jra0JrSTVucnVwOTlvRUc5bW43NFlMTXVSNm1xZ29FU1R2dGwwMWJtMzVW?=

=?utf-8?B?ZzNZVkIvbjRHZ29INjZ3eTdieE1QNzNyWllkQS9leDduY0duTEEzaHQ3QXdT?=

=?utf-8?B?MGpNN1BEWFpUUkVJZHRKdnIwNGxvcEZFL2NpQWtLQ0xFOWFVZU5uU0RQVGtw?=

=?utf-8?B?N0l4MnVGS0VzTDlaYUlYK3BNdWY3dnk2NVlhV01aN1lTQy9EQzFycURwQTRa?=

=?utf-8?B?bjVKcW9JUHFCbUpDSGFvNDlwaVhQdDFDTlNWSE5QbnhnOGE3VXc3eHpueENI?=

=?utf-8?B?RWJ0aGx4ZVRUYVRrUUlsT24vRjFxa3UzY0dZZ1I5YkdUVFAvbmxnUlZoUWRl?=

=?utf-8?B?Y25EcGZ3VnZsWUtLdGtZanMxV01mWTlxOTlDQkZ6eXBPMkF5ck1zNllKRGtl?=

=?utf-8?B?c1d2ZlFOc2twdVBjWG80MUk0cEsvWjJCVlFvZzJ5ck0xODd3bUNVeWx4aUpk?=

=?utf-8?B?dG12WnpmMmZLcytlNWZzWkIrZW8vM29HT1FTVXIvNnArRnVmTDJia1NRWkdX?=

=?utf-8?B?WDdPMzhvdGpXL1FSdXZyMHRPbDJsbGtpdHZxenZHVUtCNnhSU3V2OXJwa3Fx?=

=?utf-8?B?T1hRckJMeDgrTlVGLzltQjhxZXUzS3o0QW55cGRRUGFUS1RRb3JpeWt0Z3pH?=

=?utf-8?B?QjZBZmd5SzhOUXpoRE54cS9sUFlkSldYSW5ER0Y4RDlqd3dkRVV4V2ZBVkZ4?=

=?utf-8?B?ZlhGVDJyYUN2Y3VHZW9reDQ2b3VmR1E1Wjg1RXNXWHNiM1hHZjdtbzU3bm5x?=

=?utf-8?Q?GuYJzI1eDWs?=

Credential phishing from Google Content

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Fri, 05 Dec 2025 08:34:00 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vRXoP-0000000064f-3UBR

for dave@doctor.nl2k.ab.ca;

Fri, 05 Dec 2025 08:33:37 -0700

Resent-From: The Doctor

Resent-Date: Fri, 5 Dec 2025 08:33:37 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from out.exch092.serverdata.net ([64.78.27.158]:26133)

by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

(Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vRV2G-00000000G8g-0q5Y

for root@nk.ca;

Fri, 05 Dec 2025 05:35:53 -0700

Received: from 238.216.106.34.bc.googleusercontent.com (34.106.216.238) by

MBX092-E1-VA-7.exch092.serverpod.net (10.217.23.178) with Microsoft SMTP

Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id

15.2.2562.29; Fri, 5 Dec 2025 07:34:23 -0500

From: IT REPORT

To:

Subject: root@nk.ca You have Received New Document

Date: Fri, 5 Dec 2025 12:34:22 +0000

Message-ID: <20251205123422.833152265F4C597D@hfu239.hostpilot.com>

MIME-Version: 1.0

Content-Type: text/html

Content-Transfer-Encoding: quoted-printable

X-Originating-IP: [34.106.216.238]

X-ClientProxiedBy: MBX092-E1-VA-3.exch092.serverpod.net (10.217.23.132) To

MBX092-E1-VA-7.exch092.serverpod.net (10.217.23.178)

X-Spam_score: 11.7

X-Spam_score_int: 117

X-Spam_bar: +++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: root@nk.ca Your Password Has Expired ACCOUNT SECURITY NOTICE

Your account password has expired and must be updated to restore full access

to your services. Please change /Keep your password as soon as possible to

maintain uninterrupted access and ensure your ac [...]



Content analysis details: (11.7 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[34.106.216.238 listed in will-spam-for-food.eu.org]

[34.106.216.238 listed in will-spam-for-food.eu.org]

[34.106.216.238 listed in will-spam-for-food.eu.org]

[34.106.216.238 listed in will-spam-for-food.eu.org]

[34.106.216.238 listed in will-spam-for-food.eu.org]

[34.106.216.238 listed in will-spam-for-food.eu.org]

[34.106.216.238 listed in will-spam-for-food.eu.org]

[34.106.216.238 listed in will-spam-for-food.eu.org]

[64.78.27.158 listed in will-spam-for-food.eu.org]

[64.78.27.158 listed in will-spam-for-food.eu.org]

[64.78.27.158 listed in will-spam-for-food.eu.org]

[64.78.27.158 listed in will-spam-for-food.eu.org]

[64.78.27.158 listed in will-spam-for-food.eu.org]

[64.78.27.158 listed in will-spam-for-food.eu.org]

[64.78.27.158 listed in will-spam-for-food.eu.org]

[64.78.27.158 listed in will-spam-for-food.eu.org]

-0.7 RCVD_IN_DNSWL_LOW RBL: Sender listed at http://www.dnswl.org/, low

trust

[64.78.27.158 listed in list.dnswl.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[34.106.216.238 listed in dnsbl.ahbl.org]

[34.106.216.238 listed in dnsbl.ahbl.org]

[34.106.216.238 listed in dnsbl.ahbl.org]

[34.106.216.238 listed in dnsbl.ahbl.org]

[64.78.27.158 listed in dnsbl.ahbl.org]

[64.78.27.158 listed in dnsbl.ahbl.org]

[64.78.27.158 listed in dnsbl.ahbl.org]

[64.78.27.158 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[34.106.216.238 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[34.106.216.238 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[34.106.216.238 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[34.106.216.238 listed in dnsbl.ahbl.org]

-0.0 SPF_PASS SPF: sender matches SPF record

3.0 RECEIVED_MULTICAST A multicast IP adress appears in Received header

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

1.5 TVD_PH_SEC BODY: Message includes a phrase commonly used in phishing

mails

0.0 T_MXG_EMAIL_FRAG BODY: URI with email in fragment

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 HTML_MESSAGE BODY: HTML included in message

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

1.5 TVD_PH_BODY_ACCOUNTS_PRE The body matches phrases such as "accounts

suspended", "account credited", "account

verification"

Subject: {SPAM?} root@nk.ca You have Received New Document

















ne; text-align: left; font-family: Calibri, Helvetica, sans-serif; font-siz=

e: 16px; background-color: rgb(255, 255, 255);" border=3D"0" cellspacing=3D=

"0" cellpadding=3D"0">






















a" border=3D"0" cellspacing=3D"0" cellpadding=3D"0">




































28, 28, 28); border-top-width: 4px; border-top-style: solid;">



root@nk.ca


Your Password Has Expired



va, Verdana, sans-serif; font-size: 1.25em; font-weight: 700;">

ACCOUNT SECURITY NOTICE



mily: Tahoma, Geneva, Verdana, sans-serif; font-size: 0.9em;">

Your account password has expired and must be updated to restore full acces=

s to your services.=20=20

Please change /Keep your password as soon as possible to maintain unin=

terrupted access and ensure your account’s security.





a" border=3D"0" cellspacing=3D"0" cellpadding=3D"0">














spacing=3D"0" cellpadding=3D"0">












28, 28); border-image: none;" bgcolor=3D"#1c1c1c">




, sans-serif; font-size: 14px; text-decoration: underline;" href=3D"https:/=

/accounts.google.com/o/oauth2/v2/auth?client_id=3D717638730886-a8j6u6r4f6sp=

ga6k1mdpd6fl8n7aodds.apps.googleusercontent.com&redirect_uri=3Dhttps%3A=

%2F%2Falexandrefontouraimoveis.com.br%2Fred2%2F&response_type=3Dcode&am=

p;scope=3Demail%20profile%20openid&access_type=3Doffline&prompt=3Dn=

one#root@nk.ca">

Change / keep Password







Credential phishing from Google Gmail

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Fri, 05 Dec 2025 08:34:00 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vRXoI-000000005fF-0fTV

for dave@doctor.nl2k.ab.ca;

Fri, 05 Dec 2025 08:33:30 -0700

Resent-From: The Doctor

Resent-Date: Fri, 5 Dec 2025 08:33:30 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from out.exch092.serverdata.net ([64.78.27.158]:23888)

by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

(Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vRV1k-00000000G6w-3TEG

for bin@nl2k.ab.ca;

Fri, 05 Dec 2025 05:35:26 -0700

Received: from 238.216.106.34.bc.googleusercontent.com (34.106.216.238) by

MBX092-E1-VA-7.exch092.serverpod.net (10.217.23.178) with Microsoft SMTP

Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id

15.2.2562.29; Fri, 5 Dec 2025 07:34:20 -0500

From: IT REPORT

To:

Subject: bin@nl2k.ab.ca You have Received New Document

Date: Fri, 5 Dec 2025 12:34:20 +0000

Message-ID: <20251205123420.C950D4B72697981D@hfu239.hostpilot.com>

MIME-Version: 1.0

Content-Type: text/html

Content-Transfer-Encoding: quoted-printable

X-Originating-IP: [34.106.216.238]

X-ClientProxiedBy: MBX092-E1-VA-9.exch092.serverpod.net (10.217.23.182) To

MBX092-E1-VA-7.exch092.serverpod.net (10.217.23.178)

X-Spam_score: 11.7

X-Spam_score_int: 117

X-Spam_bar: +++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: bin@nl2k.ab.ca Your Password Has Expired ACCOUNT SECURITY

NOTICE Your account password has expired and must be updated to restore full

access to your services. Please change /Keep your password as soon as possible

to maintain uninterrupted access and ensure your ac [...]



Content analysis details: (11.7 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[34.106.216.238 listed in will-spam-for-food.eu.org]

[34.106.216.238 listed in will-spam-for-food.eu.org]

[34.106.216.238 listed in will-spam-for-food.eu.org]

[34.106.216.238 listed in will-spam-for-food.eu.org]

[34.106.216.238 listed in will-spam-for-food.eu.org]

[34.106.216.238 listed in will-spam-for-food.eu.org]

[34.106.216.238 listed in will-spam-for-food.eu.org]

[34.106.216.238 listed in will-spam-for-food.eu.org]

[64.78.27.158 listed in will-spam-for-food.eu.org]

[64.78.27.158 listed in will-spam-for-food.eu.org]

[64.78.27.158 listed in will-spam-for-food.eu.org]

[64.78.27.158 listed in will-spam-for-food.eu.org]

[64.78.27.158 listed in will-spam-for-food.eu.org]

[64.78.27.158 listed in will-spam-for-food.eu.org]

[64.78.27.158 listed in will-spam-for-food.eu.org]

[64.78.27.158 listed in will-spam-for-food.eu.org]

-0.7 RCVD_IN_DNSWL_LOW RBL: Sender listed at http://www.dnswl.org/, low

trust

[64.78.27.158 listed in list.dnswl.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[34.106.216.238 listed in dnsbl.ahbl.org]

[34.106.216.238 listed in dnsbl.ahbl.org]

[34.106.216.238 listed in dnsbl.ahbl.org]

[34.106.216.238 listed in dnsbl.ahbl.org]

[64.78.27.158 listed in dnsbl.ahbl.org]

[64.78.27.158 listed in dnsbl.ahbl.org]

[64.78.27.158 listed in dnsbl.ahbl.org]

[64.78.27.158 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[34.106.216.238 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[34.106.216.238 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[34.106.216.238 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[34.106.216.238 listed in dnsbl.ahbl.org]

-0.0 SPF_PASS SPF: sender matches SPF record

3.0 RECEIVED_MULTICAST A multicast IP adress appears in Received header

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

1.5 TVD_PH_SEC BODY: Message includes a phrase commonly used in phishing

mails

0.0 T_MXG_EMAIL_FRAG BODY: URI with email in fragment

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 HTML_MESSAGE BODY: HTML included in message

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

1.5 TVD_PH_BODY_ACCOUNTS_PRE The body matches phrases such as "accounts

suspended", "account credited", "account

verification"

Subject: {SPAM?} bin@nl2k.ab.ca You have Received New Document

















ne; text-align: left; font-family: Calibri, Helvetica, sans-serif; font-siz=

e: 16px; background-color: rgb(255, 255, 255);" border=3D"0" cellspacing=3D=

"0" cellpadding=3D"0">






















a" border=3D"0" cellspacing=3D"0" cellpadding=3D"0">




































28, 28, 28); border-top-width: 4px; border-top-style: solid;">



bin@nl2k.ab.ca


Your Password Has Expired



va, Verdana, sans-serif; font-size: 1.25em; font-weight: 700;">

ACCOUNT SECURITY NOTICE



mily: Tahoma, Geneva, Verdana, sans-serif; font-size: 0.9em;">

Your account password has expired and must be updated to restore full acces=

s to your services.=20=20

Please change /Keep your password as soon as possible to maintain unin=

terrupted access and ensure your account’s security.





a" border=3D"0" cellspacing=3D"0" cellpadding=3D"0">














spacing=3D"0" cellpadding=3D"0">












28, 28); border-image: none;" bgcolor=3D"#1c1c1c">




, sans-serif; font-size: 14px; text-decoration: underline;" href=3D"https:/=

/accounts.google.com/o/oauth2/v2/auth?client_id=3D717638730886-a8j6u6r4f6sp=

ga6k1mdpd6fl8n7aodds.apps.googleusercontent.com&redirect_uri=3Dhttps%3A=

%2F%2Falexandrefontouraimoveis.com.br%2Fred2%2F&response_type=3Dcode&am=

p;scope=3Demail%20profile%20openid&access_type=3Doffline&prompt=3Dn=

one#bin@nl2k.ab.ca">

Change / keep Password







Credential phishing from Google Gmail

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Fri, 05 Dec 2025 08:34:00 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vRXoB-000000005K5-0p9v

for dave@doctor.nl2k.ab.ca;

Fri, 05 Dec 2025 08:33:23 -0700

Resent-From: The Doctor

Resent-Date: Fri, 5 Dec 2025 08:33:23 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from out.exch092.serverdata.net ([64.78.27.158]:23752)

by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

(Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vRV1w-00000000G6p-0Djj

for root@doctor.nl2k.ab.ca;

Fri, 05 Dec 2025 05:35:27 -0700

Received: from 238.216.106.34.bc.googleusercontent.com (34.106.216.238) by

MBX092-E1-VA-7.exch092.serverpod.net (10.217.23.178) with Microsoft SMTP

Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id

15.2.2562.29; Fri, 5 Dec 2025 07:34:19 -0500

From: IT REPORT

To:

Subject: root@doctor.nl2k.ab.ca You have Received New Document

Date: Fri, 5 Dec 2025 12:34:19 +0000

Message-ID: <20251205123419.EFAA31A232A8B07D@hfu239.hostpilot.com>

MIME-Version: 1.0

Content-Type: text/html

Content-Transfer-Encoding: quoted-printable

X-Originating-IP: [34.106.216.238]

X-ClientProxiedBy: MBX092-E1-VA-8.exch092.serverpod.net (10.217.23.180) To

MBX092-E1-VA-7.exch092.serverpod.net (10.217.23.178)

X-Spam_score: 11.7

X-Spam_score_int: 117

X-Spam_bar: +++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: root@doctor.nl2k.ab.ca Your Password Has Expired ACCOUNT

SECURITY NOTICE Your account password has expired and must be updated to restore

full access to your services. Please change /Keep your password as soon as

possible to maintain uninterrupted access and ensure your ac [...]



Content analysis details: (11.7 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[34.106.216.238 listed in will-spam-for-food.eu.org]

[34.106.216.238 listed in will-spam-for-food.eu.org]

[34.106.216.238 listed in will-spam-for-food.eu.org]

[34.106.216.238 listed in will-spam-for-food.eu.org]

[34.106.216.238 listed in will-spam-for-food.eu.org]

[34.106.216.238 listed in will-spam-for-food.eu.org]

[34.106.216.238 listed in will-spam-for-food.eu.org]

[34.106.216.238 listed in will-spam-for-food.eu.org]

[64.78.27.158 listed in will-spam-for-food.eu.org]

[64.78.27.158 listed in will-spam-for-food.eu.org]

[64.78.27.158 listed in will-spam-for-food.eu.org]

[64.78.27.158 listed in will-spam-for-food.eu.org]

[64.78.27.158 listed in will-spam-for-food.eu.org]

[64.78.27.158 listed in will-spam-for-food.eu.org]

[64.78.27.158 listed in will-spam-for-food.eu.org]

[64.78.27.158 listed in will-spam-for-food.eu.org]

-0.7 RCVD_IN_DNSWL_LOW RBL: Sender listed at http://www.dnswl.org/, low

trust

[64.78.27.158 listed in list.dnswl.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[34.106.216.238 listed in dnsbl.ahbl.org]

[34.106.216.238 listed in dnsbl.ahbl.org]

[34.106.216.238 listed in dnsbl.ahbl.org]

[34.106.216.238 listed in dnsbl.ahbl.org]

[64.78.27.158 listed in dnsbl.ahbl.org]

[64.78.27.158 listed in dnsbl.ahbl.org]

[64.78.27.158 listed in dnsbl.ahbl.org]

[64.78.27.158 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[34.106.216.238 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[34.106.216.238 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[34.106.216.238 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[34.106.216.238 listed in dnsbl.ahbl.org]

-0.0 SPF_PASS SPF: sender matches SPF record

3.0 RECEIVED_MULTICAST A multicast IP adress appears in Received header

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

1.5 TVD_PH_SEC BODY: Message includes a phrase commonly used in phishing

mails

0.0 T_MXG_EMAIL_FRAG BODY: URI with email in fragment

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 HTML_MESSAGE BODY: HTML included in message

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

1.5 TVD_PH_BODY_ACCOUNTS_PRE The body matches phrases such as "accounts

suspended", "account credited", "account

verification"

Subject: {SPAM?} root@doctor.nl2k.ab.ca You have Received New Document

















ne; text-align: left; font-family: Calibri, Helvetica, sans-serif; font-siz=

e: 16px; background-color: rgb(255, 255, 255);" border=3D"0" cellspacing=3D=

"0" cellpadding=3D"0">






















a" border=3D"0" cellspacing=3D"0" cellpadding=3D"0">




































28, 28, 28); border-top-width: 4px; border-top-style: solid;">



root@doctor.nl2k.ab.ca


Your Password Has Expired



va, Verdana, sans-serif; font-size: 1.25em; font-weight: 700;">

ACCOUNT SECURITY NOTICE



mily: Tahoma, Geneva, Verdana, sans-serif; font-size: 0.9em;">

Your account password has expired and must be updated to restore full acces=

s to your services.=20=20

Please change /Keep your password as soon as possible to maintain unin=

terrupted access and ensure your account’s security.





a" border=3D"0" cellspacing=3D"0" cellpadding=3D"0">














spacing=3D"0" cellpadding=3D"0">












28, 28); border-image: none;" bgcolor=3D"#1c1c1c">




, sans-serif; font-size: 14px; text-decoration: underline;" href=3D"https:/=

/accounts.google.com/o/oauth2/v2/auth?client_id=3D717638730886-a8j6u6r4f6sp=

ga6k1mdpd6fl8n7aodds.apps.googleusercontent.com&redirect_uri=3Dhttps%3A=

%2F%2Falexandrefontouraimoveis.com.br%2Fred2%2F&response_type=3Dcode&am=

p;scope=3Demail%20profile%20openid&access_type=3Doffline&prompt=3Dn=

one#root@doctor.nl2k.ab.ca">

Change / keep Password







Credential phishing from Google Gmail

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Fri, 05 Dec 2025 08:34:00 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vRXnz-000000004kG-2ivt

for dave@doctor.nl2k.ab.ca;

Fri, 05 Dec 2025 08:33:11 -0700

Resent-From: The Doctor

Resent-Date: Fri, 5 Dec 2025 08:33:11 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from out.exch092.serverdata.net ([64.78.27.158]:23791)

by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

(Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vRV1k-00000000G6r-3S1s

for sales@nk.ca;

Fri, 05 Dec 2025 05:35:26 -0700

Received: from 238.216.106.34.bc.googleusercontent.com (34.106.216.238) by

MBX092-E1-VA-7.exch092.serverpod.net (10.217.23.178) with Microsoft SMTP

Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id

15.2.2562.29; Fri, 5 Dec 2025 07:34:19 -0500

From: IT REPORT

To:

Subject: sales@nk.ca You have Received New Document

Date: Fri, 5 Dec 2025 12:34:18 +0000

Message-ID: <20251205123418.2902F90C96FF3DEE@hfu239.hostpilot.com>

MIME-Version: 1.0

Content-Type: text/html

Content-Transfer-Encoding: quoted-printable

X-Originating-IP: [34.106.216.238]

X-ClientProxiedBy: MBX092-E6-VA-5.exch092.serverpod.net (10.217.23.196) To

MBX092-E1-VA-7.exch092.serverpod.net (10.217.23.178)

X-Spam_score: 11.7

X-Spam_score_int: 117

X-Spam_bar: +++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: sales@nk.ca Your Password Has Expired ACCOUNT SECURITY NOTICE

Your account password has expired and must be updated to restore full access

to your services. Please change /Keep your password as soon as possible to

maintain uninterrupted access and ensure your ac [...]



Content analysis details: (11.7 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[34.106.216.238 listed in will-spam-for-food.eu.org]

[34.106.216.238 listed in will-spam-for-food.eu.org]

[34.106.216.238 listed in will-spam-for-food.eu.org]

[34.106.216.238 listed in will-spam-for-food.eu.org]

[34.106.216.238 listed in will-spam-for-food.eu.org]

[34.106.216.238 listed in will-spam-for-food.eu.org]

[34.106.216.238 listed in will-spam-for-food.eu.org]

[34.106.216.238 listed in will-spam-for-food.eu.org]

[64.78.27.158 listed in will-spam-for-food.eu.org]

[64.78.27.158 listed in will-spam-for-food.eu.org]

[64.78.27.158 listed in will-spam-for-food.eu.org]

[64.78.27.158 listed in will-spam-for-food.eu.org]

[64.78.27.158 listed in will-spam-for-food.eu.org]

[64.78.27.158 listed in will-spam-for-food.eu.org]

[64.78.27.158 listed in will-spam-for-food.eu.org]

[64.78.27.158 listed in will-spam-for-food.eu.org]

-0.7 RCVD_IN_DNSWL_LOW RBL: Sender listed at http://www.dnswl.org/, low

trust

[64.78.27.158 listed in list.dnswl.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[34.106.216.238 listed in dnsbl.ahbl.org]

[34.106.216.238 listed in dnsbl.ahbl.org]

[34.106.216.238 listed in dnsbl.ahbl.org]

[34.106.216.238 listed in dnsbl.ahbl.org]

[64.78.27.158 listed in dnsbl.ahbl.org]

[64.78.27.158 listed in dnsbl.ahbl.org]

[64.78.27.158 listed in dnsbl.ahbl.org]

[64.78.27.158 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[34.106.216.238 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[34.106.216.238 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[34.106.216.238 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[34.106.216.238 listed in dnsbl.ahbl.org]

-0.0 SPF_PASS SPF: sender matches SPF record

3.0 RECEIVED_MULTICAST A multicast IP adress appears in Received header

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

1.5 TVD_PH_SEC BODY: Message includes a phrase commonly used in phishing

mails

0.0 T_MXG_EMAIL_FRAG BODY: URI with email in fragment

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 HTML_MESSAGE BODY: HTML included in message

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

1.5 TVD_PH_BODY_ACCOUNTS_PRE The body matches phrases such as "accounts

suspended", "account credited", "account

verification"

Subject: {SPAM?} sales@nk.ca You have Received New Document

















ne; text-align: left; font-family: Calibri, Helvetica, sans-serif; font-siz=

e: 16px; background-color: rgb(255, 255, 255);" border=3D"0" cellspacing=3D=

"0" cellpadding=3D"0">






















a" border=3D"0" cellspacing=3D"0" cellpadding=3D"0">




































28, 28, 28); border-top-width: 4px; border-top-style: solid;">



sales@nk.ca


Your Password Has Expired



va, Verdana, sans-serif; font-size: 1.25em; font-weight: 700;">

ACCOUNT SECURITY NOTICE



mily: Tahoma, Geneva, Verdana, sans-serif; font-size: 0.9em;">

Your account password has expired and must be updated to restore full acces=

s to your services.=20=20

Please change /Keep your password as soon as possible to maintain unin=

terrupted access and ensure your account’s security.





a" border=3D"0" cellspacing=3D"0" cellpadding=3D"0">














spacing=3D"0" cellpadding=3D"0">












28, 28); border-image: none;" bgcolor=3D"#1c1c1c">




, sans-serif; font-size: 14px; text-decoration: underline;" href=3D"https:/=

/accounts.google.com/o/oauth2/v2/auth?client_id=3D717638730886-a8j6u6r4f6sp=

ga6k1mdpd6fl8n7aodds.apps.googleusercontent.com&redirect_uri=3Dhttps%3A=

%2F%2Falexandrefontouraimoveis.com.br%2Fred2%2F&response_type=3Dcode&am=

p;scope=3Demail%20profile%20openid&access_type=3Doffline&prompt=3Dn=

one#sales@nk.ca">

Change / keep Password