Web/SEO/App spam from Microsoft Outlook Part 4

Posted by Dave Yadallee on
Hi,



I was looking at your website and noticed that you aren’t at the top of Google search. I can fix that for you and make your

company more profitable.



I can give you our Complete SEO Action Plan along with a customary reach and add great value to your

product/ service.



We can place your website on Google 1st page. Yahoo etc.



Should I send you an “Proposal & Package”? “Yes / Okay / if interested”



Thanks & Regards,



Waiting for quick reply.

      

Note: - I will be happy to send you our Pricing and Package details

Web/SEO/App spam from Microsoft Outlook Part 2

Posted by Dave Yadallee on










































































































In-Reply-To:



Accept-Language: en-US

Content-Language: en-US

X-MS-Has-Attach:

X-MS-TNEF-Correlator:

msip_labels:

x-ms-exchange-messagesentrepresentingtype: 1

x-ms-publictraffictype: Email

x-ms-traffictypediagnostic: TY4PR01MB12649:EE_|TY3PR01MB12024:EE_

x-ms-office365-filtering-correlation-id: 7c3b3eae-0c81-402f-790b-08de748d7fa5

x-microsoft-antispam:

BCL:0;ARA:14566002|7042599007|7071999006|8060799015|8062599012|41001999006|19110799012|15030799006|15080799012|39105399006|31061999003|20031999003|461199028|3412199025|440099028|26104999006|102099032|35041999009|40105399003|39145399003|41105399003|1710799026;

x-microsoft-antispam-message-info:

=?utf-8?B?djFPaTY4TGJXYnVYb1diMXRPOW8zUC9YTEE2YXBSeE44SG4zZHdYNFpHVkly?=

=?utf-8?B?ZVpIYTZuZXhhbE1IUW83b2dsRWphaXpURDZIbGptTGdqY0NyMUl2dEdXeFI4?=

=?utf-8?B?YUdJUmZtNmZyUGQ4RUczZEx1UzhDVFVja0hVRTFsbmdDYW01TTBKUEE4SDBM?=

=?utf-8?B?WksyNHlGc3JyYWZXTHkvNHU2alNBWkJUMjBsQUZpSGVOVEpGTWJjZHFiVWhX?=

=?utf-8?B?cGcrZ1RiNGFQNUpoQXRYaGVHank5M1FCRnF1SGMydWF5cllERmdoK1ZFOGFD?=

=?utf-8?B?YWFNWU43dUx5cTBpakk5YTVtdmsyRDRtdFJocHcreTMwbkx2Z1VQWTM1L28y?=

=?utf-8?B?QUhvTVRnTEhEZ29oekxSSmRXakd0RHNaS21lU2NhdGlCMWxHN3JSdDBzU09X?=

=?utf-8?B?R1hUYWdPbzJSbldXS3QrM2JOalFaK0k0dnRIQUpMZ2luMVdCd01kMFNmSmZl?=

=?utf-8?B?cldYUDY4cmg1WjBUWjUrVXRRTU9PY0RJam82QU51eUhFQnl3ejNQd2dNTDZJ?=

=?utf-8?B?TDlibUVua0VSSWt5akZIeWFpckVCNTM4M2lFWjJmNEJyaU96RUcrbURUZ1cv?=

=?utf-8?B?eEJkQ1FpdmZjcE9IOHlKVWp0SFI4YVROMEhQNVl3THN6bTgvVzF4OUVGRURi?=

=?utf-8?B?VnFxWGJDbE9qZWk5VStxbGtZUW1BWG1Xb2hKb2IwU3ZhbnQzUlp3d0hRSThv?=

=?utf-8?B?OUtlSDlZbDBaL0kzd2VZdHVlTDV2a1RrM0lkWnhVZ0FJeEtDYlU5NVViTXM2?=

=?utf-8?B?V2UxbUx1QVk2NWlnVDVVTjhwYjNCcHZPZkVJcHVuSUx1andyN0NiUU5PeUNW?=

=?utf-8?B?cmJTTHNDWDFYNG9TMENjMVdtSmxHUFJxQnpheHBmSnZuZ05DNXJmTGtRcmJZ?=

=?utf-8?B?UUUrSmZDbnN6SGtuT3JsRGptdnExcURsQjU2ZmhwdmNTN1dPdlF0aDcxUWxX?=

=?utf-8?B?dGtUSTFMUHpYeUVyYzJFMUQ4V1FJWDNjNElUS1ZRUStpZVVBd3N4L2dMeng3?=

=?utf-8?B?NGFVbEZhVHN1NWMyNkl6RWZOb1UzRTZ2K1hiNDcrbGsxWk5MOFFSN3I5NlFL?=

=?utf-8?B?Vlk1TjFZSDNOSjJzQktYRTcyRnZaZitSdlhwaHVnVDNvN3dGOFAvNFoxY1VB?=

=?utf-8?B?U1lSZU1oakFZZFR2Ry91Nzl2ODFtdWQ1Z2wxaVdvb0c0U2twS1U1WHA1cExV?=

=?utf-8?B?eGJ2SFJCV1JabytQOFFRSEx3TVlsTzdMMFN5UElTaFpsNzJHdTVkTDBKV0tx?=

=?utf-8?B?MFlSNjBDRk50NlpORTNwOEZuSDJtdU0zcFhDVlZ5ODQ3WDhUazJYMTZnUDlT?=

=?utf-8?B?NldubFZDbGc0a3c2WHFiL2NtazJMeGpyd2RWQW9YdzRNY1ZCR0tVMXBrSUZP?=

=?utf-8?B?MmhHQ1pkTERLOEgwZ2pRVjFmdUMvdWc3VmM5WkRnL3FuQzdpV1RsSFE4M3RM?=

=?utf-8?B?WkU1TmtXWXJ1UFg1T2c3eWl0cDhtaTNmOXZGQWYxZEN5TDVsdHRITVZhNGUv?=

=?utf-8?B?TEgvdWdXajg2YkRBNmdZZWtLM3BicFFtZkg1dGI2b2R2cWVDSzk4bnZXS2ZJ?=

=?utf-8?B?OXFGYndOdklQcGxUdFJxUlViT3JwcEVraGpHV3JvbENMWDZhT29EUEk4R1NK?=

=?utf-8?B?UXdwd3NVdE0vSEtZT2Evb3ZtSDhTVVE9PQ==?=

x-ms-exchange-antispam-messagedata-chunkcount: 1

x-ms-exchange-antispam-messagedata-0:

=?utf-8?B?WURwL21UYXpTTitlblBiR0orcUNaeHRrdTZsTXZvNTdhZ21oeVJFejNpVmFu?=

=?utf-8?B?T2N0TElZV1RNV3Q0V0F2VUxYZEV0MUNTdUNwL2JpcUZMM0lpVTE2RzBjdXZI?=

=?utf-8?B?aWZvVlJuNktTTUhYK0hNM0FuazdHdjVjcnpLZ3FtNDMvNkFvQmFoQko0eFlh?=

=?utf-8?B?UEVhOXkxOFYxeWRQalNPOWwrWHRia0Q5MlY4SkRHNzVmbWFNclJRNVZCTUpF?=

Web/SEO/App spam from Microsoft Outlook Part 3

Posted by Dave Yadallee on


=?utf-8?B?WDBrUmw5Ym04Qm1iTkdGZVM1Vm1DdFJySFhSRS8wdFdaanBLckRhRUdtUzhr?=

=?utf-8?B?ZERxK2taT3NYNGlNVHpJZjdUS2NOMHBSYllRZjBmUDh2aGpkeXVMZXRlU2hi?=

=?utf-8?B?OFlzdVhsb1VtUi80YXp3TmdPU08zR2Z5c2ozelRVWEpyWGFJbC8rZ2RIblFR?=

=?utf-8?B?Z2k3dzRaVy9oTjdGeHFkZ2FJaEFIcXRCRzl6M3hjOUtJVFFTWUpqdXRaQndj?=

=?utf-8?B?dDZzUFdLUmZ5V2hCVlZqRndlUU55M1dwMUQyWlNuWUduNXRBbzZnVFEyS3ha?=

=?utf-8?B?MHRUTXRJR0MxcVNaOXJ0REc3ZUJDc3h4V24rdjNmcDBPYUtuSFp5a3RLWTZw?=

=?utf-8?B?VFg1RzBvOEhsOWJxU2ljSHBZZEFPbE91RkgwN2NKNWFHbkhhN2s4UG9GUGxv?=

=?utf-8?B?Vyt0UFh1U3IxYzNrN0VESDBsZUlEUW5zczFiNWN6UnlWU0VDaXJMd1BrTFBz?=

=?utf-8?B?U3FCQVdFMGtDYXdybW1MM0hjN282QVo4SkJ0bGNBc1VTVitwUFFmS1psb003?=

=?utf-8?B?UU52SFZRVXdyQ1JvdjYzMGpMUExVNmdYYVpVVWJaMmxSaXdZbnVaNmhlZG40?=

=?utf-8?B?VEQ3VjYrVzdFdlFuMjc3N3ZtaXVVNVB3eGdlSkZUOHIwMXJVai84NXdLb2JL?=

=?utf-8?B?SHdYOFNlakdQblRjek5URHYyZ3AySjRpdzlQWi9JYWY4dFJ1QjdoZ2NnWmhK?=

=?utf-8?B?UG05Sk0xMWhoQUFOYnZFd0JPa25tN3Zlb0lhZittZmd1S21tckFNNlZoYXMw?=

=?utf-8?B?TzlqOXNCNWpTeXlrMkZ6TXB6VUpJV3B1NEM5MUhIcHBkbFdJaWxrYktTY2ht?=

=?utf-8?B?c256UHgwWSs1K1d4aVpORVFvSEJUZDh0QzBEUXV4VGtEQjBmSis4dnRHdFpr?=

=?utf-8?B?SWJUMG5SNU1yMmhTMUR4S25rQ0wzaUs3c2VpZjlPVmpGSVpMSDM5Q3h6VkEy?=

=?utf-8?B?MkV6ZTdnNWR0WTBDbEVraVlKMmU3dmdzV09DYnl1Y0Y1dEthWEpyV1dibmla?=

=?utf-8?B?MW40eXViOEY3K1lJMkF3dkFncTRLcHhxOFFjUkVHM3ZHeWRBazZaTEVBc3A1?=

=?utf-8?B?R2V1d0oyNldEaG10MVRaUzRKY0gzNlJrMStEd2JqV3lkSHZ1YmpqTDJKZ1JQ?=

=?utf-8?B?dzlEQ253NVVoVGpkNkZaMlM2ZnUyZTN2cWZFSWpvVmNMRHpndTJOL3pSUWJ6?=

=?utf-8?B?VnVGd3AxSjFSUGc0TTA2VmJWN09aQnRRdHVoODhVRkpWUFF2S1prc3ZPVmxT?=

=?utf-8?B?cmNXeG9sdU9KSVpua2owbHpCRU5RMkN6VEhXRi9yczg1ZERicStqMEFEeXE5?=

=?utf-8?B?OGZBWHpnWGdFNGs5TWFEL3FINWRVMGdDOG14TDYxMFIzSEM5cG9QcHVwbWk4?=

=?utf-8?B?ZkZBQ2RuSzVhcVNTV1RCL284ZEk1RVhNL2R5V2VpS3B3RVNmT1I0ZWJLN3c2?=

=?utf-8?B?RkhCWUtzeGhDblJlT0xBa2hpUWZOSjhsL2h0RnJwZ2Fyelhac2JaRFZkYnlS?=

=?utf-8?B?ZDdMU0hrYmtuMThmRmZvS2NCK1VvZU4zR0VqRVdOdTc0VTdOb3VWV2dubkZS?=

=?utf-8?B?bjllY2krNlNEaDFOOG1tSGtOQXU2RTVZWEhoeWlUTFV1NHdZdUtsV2s4M3g0?=

=?utf-8?B?Uy8vQTk1OVNubUdPYnFZTk1RUElHQ0xqdVVvL3ExWC9xR1I4T1Rldk5ZZzF2?=

=?utf-8?Q?1sX9C6Ro7EN8pHhvn7ppR2CJe0vfs7xL?=

Content-Type: multipart/alternative;

boundary="_000_TY4PR01MB126498264058197CFF1FDFBA5D775ATY4PR01MB12649jp_"

MIME-Version: 1.0

X-OriginatorOrg: outlook.com

X-MS-Exchange-CrossTenant-AuthAs: Internal

X-MS-Exchange-CrossTenant-AuthSource: TY4PR01MB12649.jpnprd01.prod.outlook.com

X-MS-Exchange-CrossTenant-RMS-PersistedConsumerOrg: 00000000-0000-0000-0000-000000000000

X-MS-Exchange-CrossTenant-Network-Message-Id: 7c3b3eae-0c81-402f-790b-08de748d7fa5

X-MS-Exchange-CrossTenant-originalarrivaltime: 25 Feb 2026 16:47:01.3396

(UTC)

X-MS-Exchange-CrossTenant-fromentityheader: Hosted

X-MS-Exchange-CrossTenant-id: 84df9e7f-e9f6-40af-b435-aaaaaaaaaaaa

X-MS-Exchange-CrossTenant-rms-persistedconsumerorg: 00000000-0000-0000-0000-000000000000

X-MS-Exchange-Transport-CrossTenantHeadersStamped: TY3PR01MB12024

X-Spam_score: 6.0

X-Spam_score_int: 60

X-Spam_bar: ++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Hi, I was looking at your website and noticed that you aren’t

at the top of Google search. I can fix that for you and make your company

more profitable. I can give you our Complete SEO Action Plan along with a

customary reach and add great value to your product/ service.



Content analysis details: (6.0 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[2603:1096:405:1e7:0:0:0:14 listed in]

[will-spam-for-food.eu.org]

[2603:1096:405:1e7:0:0:0:14 listed in]

[will-spam-for-food.eu.org]

[2603:1096:405:1e7:0:0:0:14 listed in]

[will-spam-for-food.eu.org]

[2603:1096:405:1e7:0:0:0:14 listed in]

[will-spam-for-food.eu.org]

[2603:1096:405:1e7:0:0:0:14 listed in]

[will-spam-for-food.eu.org]

[2603:1096:405:1e7:0:0:0:14 listed in]

[will-spam-for-food.eu.org]

[2603:1096:405:1e7:0:0:0:14 listed in]

[will-spam-for-food.eu.org]

[2603:1096:405:1e7:0:0:0:14 listed in]

[will-spam-for-food.eu.org]

[52.103.66.22 listed in will-spam-for-food.eu.org]

[52.103.66.22 listed in will-spam-for-food.eu.org]

[52.103.66.22 listed in will-spam-for-food.eu.org]

[52.103.66.22 listed in will-spam-for-food.eu.org]

[52.103.66.22 listed in will-spam-for-food.eu.org]

[52.103.66.22 listed in will-spam-for-food.eu.org]

[52.103.66.22 listed in will-spam-for-food.eu.org]

[52.103.66.22 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[52.103.66.22 listed in dnsbl.ahbl.org]

[52.103.66.22 listed in dnsbl.ahbl.org]

[52.103.66.22 listed in dnsbl.ahbl.org]

[52.103.66.22 listed in dnsbl.ahbl.org]

[2603:1096:405:1e7:0:0:0:14 listed in]

[dnsbl.ahbl.org]

[2603:1096:405:1e7:0:0:0:14 listed in]

[dnsbl.ahbl.org]

[2603:1096:405:1e7:0:0:0:14 listed in]

[dnsbl.ahbl.org]

[2603:1096:405:1e7:0:0:0:14 listed in]

[dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[52.103.66.22 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[52.103.66.22 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[52.103.66.22 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[52.103.66.22 listed in dnsbl.ahbl.org]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[52.103.66.22 listed in list.dnswl.org]

-0.0 SPF_PASS SPF: sender matches SPF record

-0.0 SPF_HELO_PASS SPF: HELO matches SPF record

0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider

[loki263148(at)outlook.com]

-0.0 T_RP_MATCHES_RCVD Envelope sender domain matches handover relay

domain

0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends in

digit

[loki263148(at)outlook.com]

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[52.103.66.22 listed in wl.mailspike.net]

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 HTML_MESSAGE BODY: HTML included in message

1.0 MR_DIFF_MID No description available.

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

Subject: {SPAM?} Re: Yes, please send a quote

Web/SEO/App spam from Microsoft Outlook Part 1

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Wed, 25 Feb 2026 09:49:00 -0700

Received: from mail-japanwestazolkn19010022.outbound.protection.outlook.com ([52.103.66.22]:55281 helo=OS0P286CU011.outbound.protection.outlook.com)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vvI3h-00000000CqX-3z7Z

for dave@doctor.nl2k.ab.ca;

Wed, 25 Feb 2026 09:48:33 -0700

ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none;

b=Db5hI9aniPjpJcdWZdJw3YkulV7effjFvCaA03WldkrUtUzF4dd9Kir7OslPGcAr8rBRcInQz7Ni80JAcjgATtAjveZUZPM6GvbFfVe8RcV5f1vbVyYXieJBAXdI5xEjLQKIxChjJAVd7A6XoQ9Uil+46C7q+M5iAQLb8Z5A2o9e3HoagtT6AQi00IgQIh4gcSgmCncAHCiJ7dbw6qI96dzhS7ozwX/e6Ab9I4/uFm1irtN/CMHW4lPhj6O61rBUCCqbvMKP6JEcFfIO4LTe7Hbw5dIjmROLe3FxfnIihDmtWCBuD+uagoWFJSVsNpW+xnGct1Dt9FjOSy1p/AgrqQ==

ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;

s=arcselector10001;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1;

bh=uKOCfDZOkdUupxuzLAA40mBt00GikVwp+5An8vxE1P0=;

b=j6XxfSYQHMl+aOC6LfYZmglCyEpj+2m9Nezy0q+PTTz5/bSDnTtUhJvNHzR7xWIBKg+1FroQ4TYCBs2NTqALE1Oxq8GW1j3pTzuIGCdRiBuRnQHvlz2NP7PKO1/UbE5HcszRPgAg2r3QCLy712BJzs2RyW1covm7lqM4x2komWnBmRrzlI4oB5Ewfesv6US1K5/rVr/cZTk8W3qqY0YqjeOA/nrAsjOxQGFqLsd8uZCfDPArhTC6PnRIdxX6pB9VYGmrrKLicJ6nze1Zzj3HWdN8vJkCFdOm0XVaUPaK+UAhp7yz4gPIdhjzieANaWmW1rrNWqD7Xkj5iGhR766xpw==

ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=none; dmarc=none;

dkim=none; arc=none

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=outlook.com;

s=selector1;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck;

bh=uKOCfDZOkdUupxuzLAA40mBt00GikVwp+5An8vxE1P0=;

b=Hlzr2De1oTHkr2tgqDtPesb2c3L1L6Xerh7dcu23J+vEzYiVqC91TTT92tdiKVvGhtSp1L2LxVioVkcaCz2t8xAoyEHyDZul3cUx0NQaUhzEeJkk1A5mBSkp+6lmbVbYaOtxwtezhhVDj02+Ki26GHEi5VVFU0c+ECPbM+XrnWlD+QTXI8vJh6I5dwElFMhXagGkHUDfojIfxj09UCFJIuizceIBmH++uajb02xL1jSwuyCVm7pzGSFwMzCxmBXI+7M/jbjyIOwwNf3oyVk8tC0BJw2jhoXuUNCuHTFq+yaiCI2onB4aqMZZEJuLLwvFrAPzGX1IAJ0Lz2/esE4efA==

Received: from TY4PR01MB12649.jpnprd01.prod.outlook.com

(2603:1096:405:1e7::14) by TY3PR01MB12024.jpnprd01.prod.outlook.com

(2603:1096:400:3dc::12) with Microsoft SMTP Server (version=TLS1_2,

cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.9632.23; Wed, 25 Feb

2026 16:47:02 +0000

Received: from TY4PR01MB12649.jpnprd01.prod.outlook.com

([fe80::52a2:251f:6311:8672]) by TY4PR01MB12649.jpnprd01.prod.outlook.com

([fe80::52a2:251f:6311:8672%6]) with mapi id 15.20.9654.007; Wed, 25 Feb 2026

16:47:02 +0000

From: Loki 263148

To: Loki 263148

Subject: Re: Yes, please send a quote

Thread-Topic: Yes, please send a quote

Thread-Index:

AQHcoRDJ3vQ637o0ME64CXgHrejg8bWI33rzgAFETd6AAAByVYABz5uKgAFixmaAAamJjYAAAGgHgAGZ232AAXgj+YAAAFQCgAGXkM+AAAAhOg==

Date: Wed, 25 Feb 2026 16:47:01 +0000

Message-ID:



References:













































































































Web/SEO/App spam from Microsoft Outlook Part 2

Posted by Dave Yadallee on
Content analysis details: (7.4 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[2603:1096:820:d4:0:0:0:11 listed in]

[will-spam-for-food.eu.org]

[2603:1096:820:d4:0:0:0:11 listed in]

[will-spam-for-food.eu.org]

[2603:1096:820:d4:0:0:0:11 listed in]

[will-spam-for-food.eu.org]

[2603:1096:820:d4:0:0:0:11 listed in]

[will-spam-for-food.eu.org]

[2603:1096:820:d4:0:0:0:11 listed in]

[will-spam-for-food.eu.org]

[2603:1096:820:d4:0:0:0:11 listed in]

[will-spam-for-food.eu.org]

[2603:1096:820:d4:0:0:0:11 listed in]

[will-spam-for-food.eu.org]

[2603:1096:820:d4:0:0:0:11 listed in]

[will-spam-for-food.eu.org]

[52.103.74.78 listed in will-spam-for-food.eu.org]

[52.103.74.78 listed in will-spam-for-food.eu.org]

[52.103.74.78 listed in will-spam-for-food.eu.org]

[52.103.74.78 listed in will-spam-for-food.eu.org]

[52.103.74.78 listed in will-spam-for-food.eu.org]

[52.103.74.78 listed in will-spam-for-food.eu.org]

[52.103.74.78 listed in will-spam-for-food.eu.org]

[52.103.74.78 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[52.103.74.78 listed in dnsbl.ahbl.org]

[52.103.74.78 listed in dnsbl.ahbl.org]

[52.103.74.78 listed in dnsbl.ahbl.org]

[52.103.74.78 listed in dnsbl.ahbl.org]

[2603:1096:820:d4:0:0:0:11 listed in]

[dnsbl.ahbl.org]

[2603:1096:820:d4:0:0:0:11 listed in]

[dnsbl.ahbl.org]

[2603:1096:820:d4:0:0:0:11 listed in]

[dnsbl.ahbl.org]

[2603:1096:820:d4:0:0:0:11 listed in]

[dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[52.103.74.78 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[52.103.74.78 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[52.103.74.78 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[52.103.74.78 listed in dnsbl.ahbl.org]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[52.103.74.78 listed in list.dnswl.org]

-0.0 SPF_PASS SPF: sender matches SPF record

-0.0 SPF_HELO_PASS SPF: HELO matches SPF record

1.2 MISSING_HEADERS Missing To: header

0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider

[sonukumar.app(at)outlook.com]

-0.0 T_RP_MATCHES_RCVD Envelope sender domain matches handover relay

domain

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[52.103.74.78 listed in wl.mailspike.net]

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 HTML_MESSAGE BODY: HTML included in message

1.4 MALFORMED_FREEMAIL Bad headers on message from free email service

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

Subject: {SPAM?} "Yes"



--_000_KL1PR06MB61363C1D3FD64D7FAD3F9B6EF475AKL1PR06MB6136apcp_

Content-Type: text/plain; charset="iso-8859-1"

Content-Transfer-Encoding: quoted-printable



Hi,



Your website has some errors slowing it down.



I can fix them.



Can I share the problems screenshot with you along with pricing?



Regards.

Sonu



--_000_KL1PR06MB61363C1D3FD64D7FAD3F9B6EF475AKL1PR06MB6136apcp_

Content-Type: text/html; charset="iso-8859-1"

Content-Transfer-Encoding: quoted-printable








1">








Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" clas=

s=3D"elementToProof">

Hi,



Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" clas=

s=3D"elementToProof">







Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" clas=

s=3D"elementToProof">

Your website has some errors slowing it down.



Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" clas=

s=3D"elementToProof">







Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" clas=

s=3D"elementToProof">

I can fix them.



Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" clas=

s=3D"elementToProof">







Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" clas=

s=3D"elementToProof">

Can I share the problems screenshot with you along with pricing?



Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" clas=

s=3D"elementToProof">







Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" clas=

s=3D"elementToProof">

Regards.



Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">

Sonu








--_000_KL1PR06MB61363C1D3FD64D7FAD3F9B6EF475AKL1PR06MB6136apcp_--

Web/SEO/App spam from Microsoft Outlook Part 1

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Wed, 25 Feb 2026 09:30:01 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vvHlP-000000003Kb-1UAf

for dave@doctor.nl2k.ab.ca;

Wed, 25 Feb 2026 09:29:27 -0700

Resent-From: The Doctor

Resent-Date: Wed, 25 Feb 2026 09:29:27 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-koreacentralazolkn19013078.outbound.protection.outlook.com ([52.103.74.78]:50442 helo=SEYPR02CU001.outbound.protection.outlook.com)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vvHgO-0000000010K-2KgC

for sales@nk.ca;

Wed, 25 Feb 2026 09:24:27 -0700

ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none;

b=dexWqmjMHtFnvWsOpIWiXjdCAT7NCNI8DtUsbgn+BiipxPoTXiUbMmdQr7PVXkC5tcN50TWprWBVBYfL8uICv61/PKsRQnRkzU2MFagPafUOZtlmWucXnY6/V7UNL4xiELDMF5rFInccWS2ZEkwa2oE9qCFO58ZsTN8YIczBCsvhzVV+ESv8XwlVWSD4jH3TUbqJU+urXwNLBEOqI+QA/g4RQONBwLKtghl0Z/1AoYqofBlYW5GCgI+7kYo6cKPJtK4uunSyA15UFmg0d+bilzWKY2HVosaGghBJoj0v4nNESV/v8QdNXPpXTYm1Y7PIjw3FJA9lFngoqK8l3j6Brg==

ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;

s=arcselector10001;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1;

bh=ARvZnEZuw1idtX/o3VSpRYAT0pUQXmoM50+NDz4c5Wg=;

b=tLooYjAvjIFxAJygO0lAraILLT+EdMh36/DXWepjVimg0mDFM2GOoqbqgk7txRVZ8/YuclkTHSn6s42NSfWBIDog04nWnl0Ql+I85QP3lOns1LvPtY7zbUzgZaPMSLED3yyMMacFyog6B4VT2AiCmjRtBRLhWxp7va3Ut1S+csfop6xQJuVw1QJYsLZdnT0ZO7aijOfsxMSNVKxmZ/82LnEENhv6lBaHyxAfPgxzAhnzdGeEu4KTQINHj0MtuRliDiHnKSEiZvPPpLITe/igQWkKX77zGvtbM44Xj5E435i7+90+bLsdvG5oo5h1UuHPOi1/6hoeYXXXxm9jhjiaMw==

ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=none; dmarc=none;

dkim=none; arc=none

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=outlook.com;

s=selector1;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck;

bh=ARvZnEZuw1idtX/o3VSpRYAT0pUQXmoM50+NDz4c5Wg=;

b=DOzKRf30JSqiAALuHnmHm7lPJh6P6vMxyhqXcR4t01HiJspLQEOdZMtI1CuAH3faWpmpgDzccLOpLBIg2XjntEMcWX1+wHhw2NQ30o2NlhsXx6fVvw5cjQ7Kzq5maF+uDIRezlsyNLF6CPCMM4Si6Dgnqa3cY79bnBc5IIg9qCgnaP9oUhGyeTKLXaD5bGp43XopH/cVod4D+Y4i4Zddk5HeBna70XVK8anOc/zBlZJcB2gpPPd479OSPdauOPygEDGYdE381q8cHpALghSMMdMLljIBkEyX4cN8ZnVQnzPLIX+U+cfwAu+sQtXeQOcaRutJc/VhdAV7MtnIkCgfhg==

Received: from KL1PR06MB6136.apcprd06.prod.outlook.com (2603:1096:820:d4::11)

by SEZPR06MB7238.apcprd06.prod.outlook.com (2603:1096:101:226::7) with

Microsoft SMTP Server (version=TLS1_2,

cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.9632.22; Wed, 25 Feb

2026 16:23:06 +0000

Received: from KL1PR06MB6136.apcprd06.prod.outlook.com

([fe80::3fb1:b735:842c:9e50]) by KL1PR06MB6136.apcprd06.prod.outlook.com

([fe80::3fb1:b735:842c:9e50%4]) with mapi id 15.20.9632.017; Wed, 25 Feb 2026

16:23:06 +0000

From: Sonu Kumar

Subject: "Yes"

Thread-Topic: "Yes"

Thread-Index: AQHcpnMFsfd0QyOztEinH3AH6NG8xw==

Date: Wed, 25 Feb 2026 16:23:05 +0000

Message-ID:



Accept-Language: en-US

Content-Language: en-US

X-MS-Has-Attach:

X-MS-TNEF-Correlator:

msip_labels:

x-ms-publictraffictype: Email

x-ms-traffictypediagnostic: KL1PR06MB6136:EE_|SEZPR06MB7238:EE_

x-ms-office365-filtering-correlation-id: 79f7ec7c-e896-479a-664f-08de748a2814

x-ms-exchange-slblob-mailprops:

ajlDcABzOp7QBg/GQxktTC7ueHwT2+3ZbTwhdWcTDRZ8CPDbeI7jpBQXnZqQt9XUTdkOPtz76wM9lsvieOKoUPoRdiLLgvfcHg4TjrUvhiLSDG+aRKi6gGTCmntpZDZh42TBp6PJx+1PhiC+hf1HSD+3TMx94mnhXs4YkqWXpVxl1Cx512spOoQqx25Lt2ad57Z1touJsTYgiXRpJnc6Vca0ndqFoEM/mw5DtCljKwAHfAeTijZjbbsTEhzHutkZ9Idv0/yVszFSK/RqtLoVg6MR3hhvud+uaswswhZbvG5fq3xuhxPZqlNpSDDFf6Chj/it3RqxGV8sBQxpybOzV9xab6SGDnZuSqEeg4zNgcUE7CdN6t6FwbpWTKKGrMsOPXZSE0WoBmVRPkBx6ybbHRJFjPPPNw0HUX6PUvM5iA2erR9rBvoBbs02WkDAQdIJKifPfSgBav0+6szbqjPnhPoKHMj352SkLVNXTygwMF7JeIwbfn7QKUwVJm5w2wVYFrLSEib6tH28yeGycbhuBea9h0d84p0Gus+lmumT7dd4PjknmsYM5gSlm2B++hg6B72KKkOCha0=

x-microsoft-antispam:

BCL:0;ARA:14566002|31061999003|39105399006|20031999003|15030799006|15080799012|19110799012|461199028|8060799015|8062599012|40105399003|51015399003|3412199025|440099028|102099032;

x-microsoft-antispam-message-info:

=?iso-8859-1?Q?PqMFpylzXTBSrK69BURakwEHWSpCJr/s+UoyVKlx7TnkGuY2kffmqKanA6?=

=?iso-8859-1?Q?Al96kdf/Uh3UlouNPca72+d/pJ1ykDScx/w4QaOWGKAY0fTRMjas41lY+J?=

=?iso-8859-1?Q?TcHavMPY/qe3dK/Iuut2EKF2kES+N3x/FGsZl3BuTuQF6aPtNsprUOTvMW?=

=?iso-8859-1?Q?mWKEkhE8HPIA/VmW+ZXMJhTEx8YPJRRbPGIMVvpEV+g6BGh+CZADIu/BqR?=

=?iso-8859-1?Q?NrWdUIE6SOIlPtPsPN8rpBcBSF4Eewd8Rgj7jlZuTJy4SqbsZG2g3q9gjT?=

=?iso-8859-1?Q?CE9cvGLNNcK3svcoFHZx27KYhV8nvFhwyGxHQSJXqTZmePkqRWKVLiNwLV?=

=?iso-8859-1?Q?BvYoHauSyt20rcO50+9iN3hr03puqNNaR0YLKkSDZUPbccmmXXur8pMVZu?=

=?iso-8859-1?Q?S8UJRJoXXhekwy/wektNGgpGgi8qdYMcn40d5mnU5FXa2Cn1SiJezIPms/?=

=?iso-8859-1?Q?K5UMhvc7VaZzkOnFjkoeGrTjBCww0SV6RZIrVNvTNPrxFd3yKWJUBl2m//?=

=?iso-8859-1?Q?QHg6VLoHxuhWw//GqADizEiPc56IpWoad+zDvIJk6YcSPIb4etNZY33bbY?=

=?iso-8859-1?Q?p0WyLBxZxsq8UkArVALLLfsfxzHt5Hz7yn7cGd+6Mg/z9e4akbYCVMNW0/?=

=?iso-8859-1?Q?d5xAgUQ49Nw0p+wPTvn5ZvTQZZvPK9S1EiYkVL7B7rw+Nz+/z+UYszCeqM?=

=?iso-8859-1?Q?fe1wVlJrvfpT/g1tkW5BaRHKddtJSjkg5SMj6HO9SSjFwkpfzueaxSWBef?=

=?iso-8859-1?Q?NAMRFYaX17TMuCRR9/8P9Z7EYOpD94RnHItWGSVsbZhp0FJ3PbhDN8w6Ll?=

=?iso-8859-1?Q?Yx3JijX4w+41Yi6dFSy977DyL0BKXEfoTHxPFMzpC3CT06RS/uL86y0hyO?=

=?iso-8859-1?Q?oCAjEODa3iXOrTk223Q74qzn9lGsbCCZFt9a5FCBdLp4T2acUsD8LwKzjc?=

=?iso-8859-1?Q?i1vdMHiVf68tfPoJ/4MJL56WA7Td2b9qse+qSMbjv7CEkF0nsGVApCIJke?=

=?iso-8859-1?Q?Ge+VyVw1UjIb7xsPWrjUOJhyn1nVeQAcFR9ycQ?=

x-ms-exchange-antispam-messagedata-chunkcount: 1

x-ms-exchange-antispam-messagedata-0:

=?iso-8859-1?Q?95gTf+RV0y6pbtoDipnAXVujViuq/H0mY9V96rkgL+e/keZ+LmZZG/IfTR?=

=?iso-8859-1?Q?UraHykVXNhNLd9oz9nZQ1xGA4f+Oca4VUW796C/bfnvD/1Iz0RocquJIVi?=

=?iso-8859-1?Q?e9DoJ9HsIh2nTaqp/ZNueERgV3BLWXHtOCG+W387/beCOUORIdh6xzML63?=

=?iso-8859-1?Q?3TE6UPZx/uO06VwIRPYYZdkgr0vbYC28vMP+eN/CHcIyuZj69vIlvho0as?=

=?iso-8859-1?Q?A0PaowlWk625DOKrNO7hP1R4CNJer29cGZalx8tN/ClSaMRaXXYU9qS9jt?=

=?iso-8859-1?Q?sxpGuG00K2BPoc4hfM1k6Nr1yAdqfZLUCCRsxS9FHP3ilsy4S+uerfN1os?=

=?iso-8859-1?Q?66FOVwxJKbxwljMmy1JrfDFl/ao+D/MgP1umznTJRLGTSILPjxfgEkDUHj?=

=?iso-8859-1?Q?3u8it6YsjhUCORhmbkSEt3l+WmTMGnOsLPlUveZXv5Lp3eEi2pN69z1OO3?=

=?iso-8859-1?Q?laIwFFA1IWSdK7JR+ASzUMbZbDCXg9SMT3qmHuro3W1oqYZHng1uWM0r74?=

=?iso-8859-1?Q?aVNZm1jjO9hrhL/z6NMaFLhumU2oFAkYIuH14M8ZyA/Js48VkIkkGT0YdY?=

=?iso-8859-1?Q?T0TgLOV901Or2z5E6MrKmgabOuJh6xneWIwfA9Pi3rOsSYF7L4VZcluj0S?=

=?iso-8859-1?Q?mQBIjQeeySLWAtgexPN4w+lK8ftB12eoBNk6OuUQozBQ8EdBjHPSAeKIYv?=

=?iso-8859-1?Q?Au6Drbrz8RZyKkpvYlr2chbuVWWZ9RSj9RG47lYYdGn53HrQyWotI9Eroe?=

=?iso-8859-1?Q?D5HCqc6EDLcafJjpdQuPqWoljmOJIS2tmPS7e6+SfhjeHQg6UKZccbl7tT?=

=?iso-8859-1?Q?SG+k1t8NRdwfYNoBMu4IDenRqyBU9S3QtIo5MciZtC/GyqI1kesNLV+jFJ?=

=?iso-8859-1?Q?qA9AO9W9fr6v2q8iI9W5SXihvslprL8lTFbfW+ZwcUjf+mRZEKDwwR1KCA?=

=?iso-8859-1?Q?B/f2zPHUzjKUT2KXeX3SAjwC8KKW70HomY4QmO9BO9cU4XLbPuqqIVQ2xo?=

=?iso-8859-1?Q?6cGyejJUQaz0WIA3YY5b6IREXKM1PZ6YKV2beLk0kjb6OjmNwXPen0MQPe?=

=?iso-8859-1?Q?HLe0bGvqMTmCKf3JSQfsJe1WIrjzKLV2chs9YS8GlC8eJDdzDIv/OKrFVy?=

=?iso-8859-1?Q?eJ4f7Zj3pfPI0lMtlNRcn2r8zbX5WDLyRoz+e+lr2kCFkARkyspitUrGqD?=

=?iso-8859-1?Q?rpueUd/wC3dYO0eNxbGvylkK21Ho0VAiVKTYhN9mxlbZd+Rcbna881rmw9?=

=?iso-8859-1?Q?QA/kThHUL249p1lDPFdIYa0eZmkizE8tyytqr5uL5pGiMPWBJ0RwlJ52vW?=

=?iso-8859-1?Q?9Hhzm1r2IgV9ggpPGfw2qxvjE9XIeYaeZqZ1o7TS0pYeCDAZC0Vb577D6/?=

=?iso-8859-1?Q?2x79AFi1kA5VXiLJ1t/pvmOsj8paFG0udX3Q448hjmtOwMocVYeYqWSuwa?=

=?iso-8859-1?Q?COVnrJgof2CwMtSOgCZuygIT+dacsMpQKtfsh10GFMB4MRML/14YQlHWOc?=

=?iso-8859-1?Q?yC+gRJyKrcbmi9H9oygy7F?=

Content-Type: multipart/alternative;

boundary="_000_KL1PR06MB61363C1D3FD64D7FAD3F9B6EF475AKL1PR06MB6136apcp_"

MIME-Version: 1.0

X-OriginatorOrg: outlook.com

X-MS-Exchange-CrossTenant-AuthAs: Internal

X-MS-Exchange-CrossTenant-AuthSource: KL1PR06MB6136.apcprd06.prod.outlook.com

X-MS-Exchange-CrossTenant-RMS-PersistedConsumerOrg: 00000000-0000-0000-0000-000000000000

X-MS-Exchange-CrossTenant-Network-Message-Id: 79f7ec7c-e896-479a-664f-08de748a2814

X-MS-Exchange-CrossTenant-originalarrivaltime: 25 Feb 2026 16:23:05.9471

(UTC)

X-MS-Exchange-CrossTenant-fromentityheader: Hosted

X-MS-Exchange-CrossTenant-id: 84df9e7f-e9f6-40af-b435-aaaaaaaaaaaa

X-MS-Exchange-CrossTenant-rms-persistedconsumerorg: 00000000-0000-0000-0000-000000000000

X-MS-Exchange-Transport-CrossTenantHeadersStamped: SEZPR06MB7238

X-Spam_score: 7.4

X-Spam_score_int: 74

X-Spam_bar: +++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Hi, Your website has some errors slowing it down. I can fix

them.

Cryptocurrency phish from Microsoft Part 3

Posted by Dave Yadallee on


1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[52.101.61.104 listed in dnsbl.ahbl.org]

[52.101.61.104 listed in dnsbl.ahbl.org]

[52.101.61.104 listed in dnsbl.ahbl.org]

[52.101.61.104 listed in dnsbl.ahbl.org]

[2603:10b6:510:2cf:0:0:0:17 listed in]

[dnsbl.ahbl.org]

[2603:10b6:510:2cf:0:0:0:17 listed in]

[dnsbl.ahbl.org]

[2603:10b6:510:2cf:0:0:0:17 listed in]

[dnsbl.ahbl.org]

[2603:10b6:510:2cf:0:0:0:17 listed in]

[dnsbl.ahbl.org]

[2603:10b6:510:2cf:cafe:0:0:ed listed in]

[dnsbl.ahbl.org]

[2603:10b6:510:2cf:cafe:0:0:ed listed in]

[dnsbl.ahbl.org]

[2603:10b6:510:2cf:cafe:0:0:ed listed in]

[dnsbl.ahbl.org]

[2603:10b6:510:2cf:cafe:0:0:ed listed in]

[dnsbl.ahbl.org]

[50.31.156.124 listed in dnsbl.ahbl.org]

[50.31.156.124 listed in dnsbl.ahbl.org]

[50.31.156.124 listed in dnsbl.ahbl.org]

[50.31.156.124 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[52.101.61.104 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[52.101.61.104 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[52.101.61.104 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[52.101.61.104 listed in dnsbl.ahbl.org]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[52.101.61.104 listed in list.dnswl.org]

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[52.101.61.104 listed in wl.mailspike.net]

-0.0 SPF_PASS SPF: sender matches SPF record

-0.0 SPF_HELO_PASS SPF: HELO matches SPF record

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

2.5 SUSPICIOUS_RECIPS Similar addresses in recipient list

0.0 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level mail

domains are different

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 HTML_IMAGE_RATIO_06 BODY: HTML has a low ratio of text to image area

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 T_OBFU_PDF_ATTACH PDF attachment with generic MIME type

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

2.0 RATWR8_MESSID Message-ID with excessive dashes and dollars

2.0 VOWEL_URI_6 URI hostname with 6 consecutive vowels

Subject: {SPAM?} Reminder: Robert Tech Digit LLC sent you a payment request





Robert Tech Digit LLC

sent you an invoice reminder

$550.00

Due Wed, February 25, 2026

Pay invoice

Invoice details



Bill to

Dear 1

For invoice #

INV-000002C2

Due date

Wed, February 25, 2026

Message

24 X 7 Support Helpline Call +1 (803)-384-7451 𝙿𝚄𝚁𝙲𝙷𝙰𝚂𝙴 𝙱𝚁𝙴𝙰𝙺𝙳𝙾𝚆𝙽 𝙸𝚝𝚎𝚖 𝙳𝚎𝚜𝚌𝚛𝚒𝚙𝚝𝚒𝚘𝚗 | 𝚀𝚝𝚢 | 𝙿𝚛𝚒𝚌𝚎 | 𝙰𝚖𝚘𝚞𝚗𝚝 Bitcoin (BTC) Purchase | 1 | CA$ 500.00 | CA$ 500.00 PayPal Digital Asset Service Fee | 1 | CAD 50.00 |CA$ 50.00 𝚃𝙾𝚃𝙰𝙻 𝙲𝙷𝙰𝚁𝙶𝙴𝙳: CA$ 550.𝟎𝟎 𝙸𝙼𝙿𝙾𝚁𝚃𝙰𝙽𝚃 𝙽𝙾𝚃𝙸𝙲𝙴 𝚃𝚑𝚒𝚜 𝚒𝚜 𝚊𝚗 𝚊𝚞𝚝𝚘𝚖𝚊𝚝𝚎𝚍 𝚋𝚒𝚕𝚕𝚒𝚗𝚐 𝚌𝚘𝚗𝚏𝚒𝚛𝚖𝚊𝚝𝚒𝚘𝚗. 𝙿𝚕𝚎𝚊𝚜𝚎 𝚍𝚘 𝚗𝚘𝚝 𝚛𝚎𝚙𝚕𝚢. 𝙷𝚎𝚕𝚙 𝙲𝚎𝚗𝚝𝚎𝚛: +1 (803)-384-7451



Got questions?

For any concerns regarding the invoice, contact Abesse.Songne2123@outlook.com

 

Melio is a payments solution designed to serve small businesses in the United States, including sole proprietorships. Therefore, virtually any business looking to pay other businesses for bills can use Melio.

Trusted by our industry-leading financial partners

Trusted by our industry-leading financial partners.

This email was sent to you by Melio Payments Inc.

124 East 14th St., New York, NY, 10003, USA



Privacy Policy | Terms of Service

Cryptocurrency phish from Microsoft Part 2

Posted by Dave Yadallee on
X-Forefront-Antispam-Report:

CIP:50.31.156.124;CTRY:US;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:sc-ord-mta124.mtasv.net;PTR:sc-ord-mta124.mtasv.net;CAT:NONE;SFS:(13230040)(9140799003)(1032899013)(69100299015)(7416014)(34036016)(3109299003)(6049299003)(586017)(376014)(7149299003)(61400799027)(48200799018)(7049299003)(4053099003)(8096899003)(2066899003)(19033499003)(3613699012)(17002299003)(8075299003)(102250200026);DIR:OUT;SFP:1102;

X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1

X-MS-Exchange-AntiSpam-MessageData-0:

bj5cRu37MBop59wM7IuFM/Mn2FvFxyBlSDAb4UsklWqD8bxwwUYc/dw4NYF8IhRfz5gvSnJyKf+iKzpm2jNBIWwlaSKJzFQFZCmGZemmVI9pMYD1PGhELQuBl0QvWDNy6/zl/IZeZWzcJ4q94n18WzZ9kVudFs4laWm+6rptvU3FVOGwvSCfKFaTWuTv7AgCAjijsm8sembXog4tbi7vgLAf9M24x2EXBDCsvfJKNnAUky3p7ICgxTR/02bbjCCeIwMYHr/NNruZW17/V840Lacgk1W5o1gC8SndYe0P2C3Pes7gu47MWHIdnM1161HJzJsH1G4mOmPBZVbhygTdh/qr6VbIdUrMCRPcM6V7gWah3Rb9KCmO1SxlG89YUOwHZ+waIOlRVzHSThADDR0l1BThykPG8PMgKFUV3JH2fHSN/83vb38ZCm82MO0ZlOHv

X-ExternalRecipientOutboundConnectors: 67c8da6a-08cc-4259-8c31-b94d9bfa7702

X-Auto-Response-Suppress: DR, OOF, AutoReply

X-OriginatorOrg: HughesCalderon.onmicrosoft.com

X-MS-Exchange-CrossTenant-OriginalArrivalTime: 25 Feb 2026 15:32:23.0939

(UTC)

X-MS-Exchange-CrossTenant-Network-Message-Id: a6d71c47-cf52-467e-7cb6-08de7483127c

X-MS-Exchange-CrossTenant-Id: 67c8da6a-08cc-4259-8c31-b94d9bfa7702

X-MS-Exchange-CrossTenant-AuthSource:

CY4PEPF0000EDD2.namprd03.prod.outlook.com

X-MS-Exchange-CrossTenant-AuthAs: Anonymous

X-MS-Exchange-CrossTenant-FromEntityHeader: Internet

X-MS-Exchange-Transport-CrossTenantHeadersStamped: BY5PR02MB6485

X-Spam_score: 12.6

X-Spam_score_int: 126

X-Spam_bar: ++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Robert Tech Digit LLC sent you an invoice reminder



Content analysis details: (12.6 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[50.31.156.124 listed in will-spam-for-food.eu.org]

[50.31.156.124 listed in will-spam-for-food.eu.org]

[50.31.156.124 listed in will-spam-for-food.eu.org]

[50.31.156.124 listed in will-spam-for-food.eu.org]

[50.31.156.124 listed in will-spam-for-food.eu.org]

[50.31.156.124 listed in will-spam-for-food.eu.org]

[50.31.156.124 listed in will-spam-for-food.eu.org]

[50.31.156.124 listed in will-spam-for-food.eu.org]

[2603:10b6:510:2cf:cafe:0:0:ed listed in]

[will-spam-for-food.eu.org]

[2603:10b6:510:2cf:cafe:0:0:ed listed in]

[will-spam-for-food.eu.org]

[2603:10b6:510:2cf:cafe:0:0:ed listed in]

[will-spam-for-food.eu.org]

[2603:10b6:510:2cf:cafe:0:0:ed listed in]

[will-spam-for-food.eu.org]

[2603:10b6:510:2cf:cafe:0:0:ed listed in]

[will-spam-for-food.eu.org]

[2603:10b6:510:2cf:cafe:0:0:ed listed in]

[will-spam-for-food.eu.org]

[2603:10b6:510:2cf:cafe:0:0:ed listed in]

[will-spam-for-food.eu.org]

[2603:10b6:510:2cf:cafe:0:0:ed listed in]

[will-spam-for-food.eu.org]

[2603:10b6:510:2cf:0:0:0:17 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:510:2cf:0:0:0:17 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:510:2cf:0:0:0:17 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:510:2cf:0:0:0:17 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:510:2cf:0:0:0:17 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:510:2cf:0:0:0:17 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:510:2cf:0:0:0:17 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:510:2cf:0:0:0:17 listed in]

[will-spam-for-food.eu.org]

[52.101.61.104 listed in will-spam-for-food.eu.org]

[52.101.61.104 listed in will-spam-for-food.eu.org]

[52.101.61.104 listed in will-spam-for-food.eu.org]

[52.101.61.104 listed in will-spam-for-food.eu.org]

[52.101.61.104 listed in will-spam-for-food.eu.org]

[52.101.61.104 listed in will-spam-for-food.eu.org]

[52.101.61.104 listed in will-spam-for-food.eu.org]

[52.101.61.104 listed in will-spam-for-food.eu.org]

Cryptocurrency phish from Microsoft Part 1

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Wed, 25 Feb 2026 09:29:00 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vvHky-000000002wI-0NRo

for dave@doctor.nl2k.ab.ca;

Wed, 25 Feb 2026 09:29:00 -0700

Resent-From: The Doctor

Resent-Date: Wed, 25 Feb 2026 09:28:59 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-centralusazon11020104.outbound.protection.outlook.com ([52.101.61.104]:38813 helo=DM1PR04CU001.outbound.protection.outlook.com)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vvGtB-00000000MpR-0kkQ

for doctor@doctor.nl2k.ab.ca;

Wed, 25 Feb 2026 08:33:35 -0700

ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none;

b=lVFe0uL6B964GYRX97EcLnf/NMjcERw+OJnYAgxdcIE8Q1YnyqJwgFT2aDXHW+QBVBwKagUi6364M5SQVGS/nZFdJhtg8Kr9uWGOdl51H2i/Qx9rs3MRdByA0WDg4horhb3g+QBre1EA0M2rvpUAjQHt2cjXozzhwvcEuCtRXvtlX+uryNEY09r7+11UdajjwCeVjnaG/bBzTeUMbn+r1mlDUs8UqbPSxvHPqpJdHj2ymEYVM6WfViR0gjwyB+QlIPdd4j4bmT58Bg9xnbGOejHojj775F54OVYgGBZM+JaE0QgHe8HQVU4z2YGRESha5rBBPjqKaB0uMSwoAo62Ig==

ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;

s=arcselector10001;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1;

bh=IZPJykDUYXX0g3gD7rnVI4+OsZL0sHy4EqSgGfqM3SE=;

b=VIGfM/soRwUomugTj/SllEOcXXZ9w0Fl4sJcBLUxGi2ghHCIUp/bvTyYmClga9xfnUjDIBR0s4j9OoZ9JjcB/d0WBwA1xJaYrGyWbcMdOvjmxb4ObcE27lTdOtH5vd/Y75bNkEIV5OEj72NfoQMmBDBUV3G8S4lwjSWRJaONmA9XqMyPPWUoPFDnWNpZx7vdLem7tmo89+0BWB4wsuMepQMN5EqTMIDvN//K8hh91ezwvqfxQEWJHhGN1oa/fv+aJq7zE1dDNwyXaJDuAop+FgWMtA7BmNuh1e8WmNwymVGpP+HCN0Xnn4KMJ5/Lq+gzJGO4lBAXMsNvY3ozIgcwKg==

ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass (sender ip is

50.31.156.124) smtp.rcpttodomain=hughescalderon.onmicrosoft.com

smtp.mailfrom=pm-bounce.meliopayments.com; dmarc=pass (p=reject sp=reject

pct=100) action=none header.from=meliopayments.com; dkim=pass (signature was

verified) header.d=pm.mtasv.net; dkim=pass (signature was verified)

header.d=meliopayments.com; arc=none (0)

Received: from PH8PR07CA0037.namprd07.prod.outlook.com (2603:10b6:510:2cf::17)

by BY5PR02MB6485.namprd02.prod.outlook.com (2603:10b6:a03:1d2::20) with

Microsoft SMTP Server (version=TLS1_2,

cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.9632.21; Wed, 25 Feb

2026 15:32:25 +0000

Received: from CY4PEPF0000EDD2.namprd03.prod.outlook.com

(2603:10b6:510:2cf:cafe::ed) by PH8PR07CA0037.outlook.office365.com

(2603:10b6:510:2cf::17) with Microsoft SMTP Server (version=TLS1_3,

cipher=TLS_AES_256_GCM_SHA384) id 15.20.9632.22 via Frontend Transport; Wed,

25 Feb 2026 15:32:17 +0000

Authentication-Results: spf=pass (sender IP is 50.31.156.124)

smtp.mailfrom=pm-bounce.meliopayments.com; dkim=pass (signature was verified)

header.d=pm.mtasv.net;dkim=pass (signature was verified)

header.d=meliopayments.com;dmarc=pass action=none

header.from=meliopayments.com;

Received-SPF: Pass (protection.outlook.com: domain of

pm-bounce.meliopayments.com designates 50.31.156.124 as permitted sender)

receiver=protection.outlook.com; client-ip=50.31.156.124;

helo=sc-ord-mta124.mtasv.net; pr=C

Received: from sc-ord-mta124.mtasv.net (50.31.156.124) by

CY4PEPF0000EDD2.mail.protection.outlook.com (10.167.241.198) with Microsoft

SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.20.9632.12

via Frontend Transport; Wed, 25 Feb 2026 15:32:23 +0000

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; s=pm20250324; d=pm.mtasv.net;

h=From:Date:Subject:Message-Id:Reply-To:To:MIME-Version:Content-Type:Date:

From:Message-ID:Reply-To:Sender:Subject:To:CC; t=1772033543; x=1772119943;

bh=IZPJykDUYXX0g3gD7rnVI4+OsZL0sHy4EqSgGfqM3SE=;

b=HeYWmITh9ItLiaon5ZCgX0NJfZbprE+ngfmz0R7712G70HU/1DMW27QF4uHf254/IZUK5ABVCJ9O

3emSExK+BeoUpXeIxiTn4Bk6w43nuWD1qbkhT3lQmpGrZt/TnaJsWzN4/3V/JwSY+6o3g19Ca6qm

CNQgyYiN0OcoTslUUptCgfWdD1R022mB/8/ogSEurfHOR4/chXLK1jwLRpXoUtCKcnmwj3ZZzvWo

DTOTPAT4cESxJivy/eZBx5OWsiKPmUx9qrJPXQshy+AbX4lVD3UzqaeVPHCWp4PNJGXUSf0eAZsn

2vdVjoDyfCzmCdmtEQTI4Tw+bY81oebvAAWCuw==

Received: by sc-ord-mta124.mtasv.net id hjsb0c3b84k9 for ; Wed, 25 Feb 2026 10:32:22 -0500 (envelope-from )

X-PM-IP: 50.31.156.124

X-IADB-IP: 50.31.156.124

X-IADB-IP-REVERSE: 124.156.31.50

DKIM-Signature: v=1; a=rsa-sha256; d=meliopayments.com; s=20180910150509pm;

c=relaxed/relaxed; i=service@meliopayments.com; t=1772033542; x=1772206342;

h=date:date:from:from:message-id:reply-to:reply-to:sender:subject:subject:to:

to:cc:feedback-id:mime-version:content-type;

bh=IZPJykDUYXX0g3gD7rnVI4+OsZL0sHy4EqSgGfqM3SE=;

b=CA+gcxKqK6C/m4ob/pjHlsBvjZkGy4jZvT+pt3iaf3cceuPUInEL3yNmkLmNE365HUu2/4XSRW7

vBq6r7TMishEHT/LOj6dZWh8Uyz2dzdrSTjn68sJ2vVa5amKGSRqRCFFq/GyqMusSKelizti0sP4a

826cogQ7KDr+re2wF+E=

From: Melio Payments

Date: Wed, 25 Feb 2026 15:32:22 +0000

Subject: Reminder: Robert Tech Digit LLC sent you a payment request

Message-Id: <8e1ce691-17ac-44d3-ab7b-b9237892af79@mtasv.net>

Reply-To: support@meliopayments.com

To: invoice1@HughesCalderon.onmicrosoft.com,

invoice2@HughesCalderon.onmicrosoft.com,

invoice3@HughesCalderon.onmicrosoft.com,

invoice4@HughesCalderon.onmicrosoft.com,

invoice5@HughesCalderon.onmicrosoft.com,

invoice6@HughesCalderon.onmicrosoft.com

Feedback-ID: s9308314-YXItaW52b2ljZS1yZW1pbmRlci1tYW51YWw=:s9308314:a153792:postmark

X-Complaints-To: abuse@postmarkapp.com

X-PM-Message-Id: 8e1ce691-17ac-44d3-ab7b-b9237892af79

X-PM-Tag: ar-invoice-reminder-manual

X-PM-RCPT: =?utf-8?q?|bTF8MTUzNzkyfDkzMDgzMTR8aW52b2ljZTVASHVnaGVzQ2FsZGVyb24ub25t?=

=?utf-8?q?aWNyb3NvZnQuY29t|?=

X-PM-Message-Options: v1;1.fyQ9OXKXUu1ejYCHCVoBvA.dxQwxPSWz52b6ZDdleZzoA-mmHf0FtUCkIb-0RMwiQPgWqTjxvT-4P_XdCNpnAlhQYYtYR97RGGdrYGS9Qc4SFw3y25kfIOGwfOSdHFzzj08pPF70bRdIg6BqyvP49Z0u3n7h68gosBW8DlwF5MDhrZ60pFFF5Ck4rWWW4UFc9jzYz05E4yem5fVX4ISS9DZ

X-PM-Message-Details: v1;1.AWsNpHH2WRMzW1yIUo-HhQ.pgYeT3N_hmJ_Okt9ari7OFwDnL3h56xY6UCCDWGwRXjBZ2hu7NdZ7G7poxOGPPxdVhCEZChkBXifu5BeUCZTlovqzNP1s4ZCbi1I2Pj2yiIv0mu2JI29jCSmlYm9NAJBWEyEFsDuQlPB2tKovfD1efJ6Oncrwg2YB6gwCh_iBsrDVjnujAcV4SptMQ9GOA5WTK-e8Jcxdw_Izx89Kp8L4S5codwlXkq8CIibat3d_HfTye4uoRXFJJgF12_v5_lmYLbXCvGzmDpvPtDXUoq1sUR4mFxqVQsAiOSWWDXOoOd3v0vVojU5U8GPCgPx9m3duydnrdS1lLU8vd0YdqM4tA

MIME-Version: 1.0

X-PM-MTA-Pool: transactional-1

Content-Type: multipart/mixed; boundary=mk3-ad29e6f9822d4cc690bd6f4efd4cdc74

X-EOPAttributedMessage: 0

X-EOPTenantAttributedMessage: 67c8da6a-08cc-4259-8c31-b94d9bfa7702:0

X-MS-PublicTrafficType: Email

X-MS-TrafficTypeDiagnostic: CY4PEPF0000EDD2:EE_|BY5PR02MB6485:EE_

X-MS-Office365-Filtering-Correlation-Id: a6d71c47-cf52-467e-7cb6-08de7483127c

X-LD-Processed: 67c8da6a-08cc-4259-8c31-b94d9bfa7702,ExtAddr

X-MS-Exchange-SenderADCheck: 0

X-MS-Exchange-AntiSpam-Relay: 0

X-Microsoft-Antispam:

BCL:0;ARA:13230040|9140799003|1032899013|69100299015|7416014|34036016|3109299003|6049299003|586017|376014|7149299003|61400799027|48200799018|7049299003|4053099003|8096899003|2066899003|19033499003|3613699012|17002299003|8075299003|102250200026;

X-Microsoft-Antispam-Message-Info:

=?utf-8?B?Wm1HTTVjS1lmbzJkY05RTHVUZzBreGVIWldMbUdkU3loTGVoV09iellmM0RF?=

=?utf-8?B?aUNJQisxUTlNdjRYMmtTb3ljMTdBY3pFZGZnMVpFNGtFMHJ1amZYVWl2TGZp?=

=?utf-8?B?N3JCbFZubnRoM0h4Nk02VVFBTFN1TDlkVlBXOFEza21IVTdpMXk5OEFFY2hX?=

=?utf-8?B?ckd1djRMNXlBa2tac0MrZ3l2L0JzR0JzcFVYbGs0QzIyNXJRWWdYbWZWOUs5?=

=?utf-8?B?bUNtVmdvOVN1ODZlam1rZUNUenlic0hHeU1WWXBXT054NWxCWndRaTRvOFdz?=

=?utf-8?B?bWJOaWk2OE55SEhVYlBSTDk5dEhIWEI3VGJEV1A1RS92YWdMQUhnckVJRVdE?=

=?utf-8?B?K1duL0c5MWpCSmhPNGhjR3puOG5WT0dqaFpDczNMWlFpTmRDcTV1d0dyRWtX?=

=?utf-8?B?bEs0eFJpWkFibi9YbFVTU3FLL3VLZXZCN2tuZjNTemlOcEZNK2VNUEZUd0NT?=

=?utf-8?B?TEF6bGJidmtRR2RNMGxXZHRRak8zVHJlbHgweUJXVHVLc3FMNHVNQWEyME5o?=

=?utf-8?B?cnVRczNranpDb2ZWK0tHRGlzYnM0d2psUS9lZ3pJMHlFdEFrYWJmbDRuVzhW?=

=?utf-8?B?M0NSK1lYOVZIQ1ZrK1FQWXNPeWpGVDdBL1VFODh2aVJRK3Q0WWk0YnFDUFZV?=

=?utf-8?B?N2g1ZXJjNk9sT1pmL081bmt2Tnl3d21iaWEzem9yQk5PL3FnSkZ6dzVCeUcx?=

=?utf-8?B?dlJSZTRCN0puWUZSaVV1MFo0d25veFJiaVlzOGhsd2F2UlJ0NlR6L0xCaEV3?=

=?utf-8?B?MG1OZWNvTW5GOFNUZGV6RTB5dDliQ2V5N2M4cGJQbmltUE1hUmxrUktkL0tv?=

=?utf-8?B?cnEveXJNYjRNWmR0VWgyQ3pOUVZ0d3l6Nm16aTQ0TktBVVNaWXI1UUFCeXE4?=

=?utf-8?B?UkQvcVQrczNjbTAvUkZRcmhSYVJQY1RMTitGQ0I5eHNUcjJzQXdRcjhETXVm?=

=?utf-8?B?NllmcjhMT0JVaENrcGJTUXhDTUFEZmtFRkRhYU1ZUVh5MHBLT1dPQjhzMWc5?=

=?utf-8?B?VEdtLzE0RE0zSVRzNUhxZ0RvZGhtQVZCVXdkbDIxMjVoRjY4UnNZQXg1Wlhz?=

=?utf-8?B?NzdtTG1wZ1R1aDByNU5zeXYwVlNBL2VYTXJQbzRxSVh4U08vY1VkSUxINWV6?=

=?utf-8?B?NkVXRzBFN2NxaUI5VFI0amF5b2pkQUQ5NnNBQzlEeXhoODVlRmZBM25TRjhY?=

=?utf-8?B?RXFHMGNtUGxEMWlQUkN0UFZ1eVp0anA5UmZpdURFdDhGd0NucGNSNGIvMGVG?=

=?utf-8?B?emQ4WU9BNnFMSlVZV3grRTlodmNvMlNRWjYzNXJLYTE1SXRwbUJ4c0J2RjRC?=

=?utf-8?B?MTc1UVFaaW81UXhUenVZc3NWYXQ3S1R1QmN4cnRDWGpMM0h2d1ZhMG5YVDM2?=

=?utf-8?B?czVnZVY3WWRGWUlvK25BRGpocVBSSk1Vc3JmRDE4RVZMVVo0M1dkVzBPTVly?=

=?utf-8?B?QSsyZ0d6dXZuNE5TNW51MFNNUjlhR2xwQ3haTFVHc2RCbTlkYnVzUkVjbFV4?=

=?utf-8?B?NTl0OFlTYjcwcWlIdlZSNXVieitDK0ZvYzVtQXFIMHNWc2l6b1FxUkNEanpi?=

=?utf-8?Q?+zIVvTX8SDpZxX0Om0zx5MRi5T0vDEJKt+HHMFgbU2XChC?=

iPhone Paypal phish from Google Gmail Part 4

Posted by Dave Yadallee on

/InformAction">
emtype=3D"http://schema.org/EmailMessage">
ntent=3D"Jolene Henry: Dear We are preparing your shipment.! Your recent pu=

rchase has been successfully acknowledged. Order Receipt Id: NHYJ-4706-SGK =

is now scheduled for dispatch preparation. For order tracking information, =

please reach us anytime. If several orders were placed close together, they=

might be combined in one shipment. Assistance is available at 863 409 5218=

. Receipt Details: Transaction Date: 2026-02-25 Product Purchased: iPhone 1=

7 Pro Reference No: 72406967 Quantity: 1x Shipping: Free Payment Method: Pa=

yPal Total Paid: $1135.66 We=E2=80=99re here to ensure a smooth experience.=

Call (863)-409-5218 if you require support. PayPal, LLC Support Hours: 6 A=

M =E2=80=93 6 PM Phone: +1 (863)-409-5218 . . . . . . . . . . . . . . . . .=

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . =

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .=

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . =

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .=

. . . . . . . . . . . . . . . . . . ."/>
temscope itemtype=3D"http://schema.org/Event">
" content=3D"http://schema.org/EventScheduled"/>
" itemscope itemtype=3D"http://schema.org/Organization">
ame" content=3D"Google Calendar"/>
lendar" content=3D"sjcrm7deotv3f1vb1tq0t8ag9c"/>
e; font-size: 1px; color: #fff; line-height: 1px; height: 0; max-height: 0;=

width: 0; max-width: 0; opacity: 0; overflow: hidden;" itemprop=3D"name">Y=

our Invoice reference Number has been recorded
rue">
e itemprop=3D"endDate" datetime=3D"20260226T043000Z">
order=3D"0" cellpadding=3D"0" cellspacing=3D"0" role=3D"presentation" align=

=3D"center" style=3D"width:100%;" class=3D"body-container">

tyle=3D"" class=3D"" align=3D"left">

den=3D"true">  
=


n" align=3D"center" style=3D"width:100%;" class=3D"">

=3D"" class=3D"" align=3D"left">
rg/EmailMessage">

Dear We are preparing your shi=

pment.!

Your recent purchase has been successfully acknowledged.
Order=

Receipt Id: NHYJ-4706-SGK is now scheduled for dispatch preparation.

For=

order tracking information, please reach us anytime.
If several orders =

were placed close together, they might be combined in one shipment. Assista=

nce is available at 863 409 5218.

Receipt Details:
Transaction Date: 2=

026-02-25
Product Purchased: iPhone 17 Pro
Reference No: 72406967
=

Quantity: 1x
Shipping: Free
Payment Method: PayPal
Total Paid: $11=

35.66

We=E2=80=99re here to ensure a smooth experience. Call (863)-409-52=

18 if you require support.

PayPal, LLC
Support Hours: 6 AM =E2=80=93 6=

PM
Phone: +1 (863)-409-5218
.
.
.
.
.
.
.
.
=

.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
=

.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
=

.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
=

.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
=

.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
=

.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
=

.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
=

.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
=

.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
=

.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
=

.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
=

.
.
.
.
.
.
.
.
.
.
.
.
.


d>

"0" role=3D"presentation" align=3D"center" style=3D"width:100%;" class=3D""=

>
r>

ection: rtl; font-size: 0; padding: 24px 32px; text-align: left; vertical-a=

lign: top;" class=3D"main-container-inner">

: ltr; display: inline-block; vertical-align: top; width: 100%;overflow: hi=

dden; word-wrap: break-word;">
cing=3D"0" role=3D"presentation" width=3D"100%" class=3D"main-column-table-=

ltr" style=3D"padding-right: 32px; padding-left: 0;;table-layout: fixed;"><=

tbody>
r>

op;">
tation" width=3D"100%" style=3D"table-layout: fixed;">

-size: 0; padding: 0; text-align: left; word-break: break-word;;padding-bot=

tom:2px;">

rif;font-weight: 400; font-size: 22px; line-height: 28px;color: #3c4043; te=

xt-decoration: none;" class=3D"primary-text" role=3D"presentation">
emprop=3D"name">Your Invoice reference Number has been recorded
>

d-break: break-word;;padding-bottom:24px;">

o, sans-serif;font-style: normal; font-weight: 400; font-size: 14px; line-h=

eight: 20px; letter-spacing: 0.2px;color: #3c4043; text-decoration: none;" =

class=3D"primary-text" role=3D"presentation">
me itemprop=3D"startDate" datetime=3D"20260225T050000Z">Wednesday =

Feb 25, 2026 =E2=8B=85 12am =E2=80=93 11:30pm (Eastern Time - New York)
an>

eft; word-break: break-word;;padding-bottom:24px;">

y: Roboto, sans-serif;font-style: normal; font-weight: 400; font-size: 14px=

; line-height: 20px; letter-spacing: 0.2px;color: #3c4043; text-decoration:=

none;" class=3D"primary-text" role=3D"presentation">
llpadding=3D"0" cellspacing=3D"0" role=3D"presentation" style=3D"padding-bo=

ttom: 4px;">


or: #3c4043; text-decoration: none;font-weight: 700;-webkit-font-smoothing:=

antialiased;margin: 0; padding: 0;">Organizer


left; word-break: break-word;;padding-bottom:24px;">

ly: Roboto, sans-serif;font-style: normal; font-weight: 400; font-size: 14p=

x; line-height: 20px; letter-spacing: 0.2px;color: #3c4043; text-decoration=

: none;" class=3D"primary-text" role=3D"presentation">
ellpadding=3D"0" cellspacing=3D"0" role=3D"presentation" style=3D"padding-b=

ottom: 4px;">


lor: #3c4043; text-decoration: none;font-weight: 700;-webkit-font-smoothing=

: antialiased;margin: 0; padding: 0;">Guests

(Guest l=

ist has been hidden at organizer's request)


--00000000000077bca5064ba75741--

iPhone Paypal phish from Google Gmail Part 2

Posted by Dave Yadallee on




















=20



=20



=20

iPhone Paypal phish from Google Gmail Part 3

Posted by Dave Yadallee on


=20

















iPhone Paypal phish from Google Gmail Part 1

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Wed, 25 Feb 2026 09:29:01 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vvHkh-000000002em-1Ty7

for dave@doctor.nl2k.ab.ca;

Wed, 25 Feb 2026 09:28:43 -0700

Resent-From: The Doctor

Resent-Date: Wed, 25 Feb 2026 09:28:43 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-ot1-f73.google.com ([209.85.210.73]:48507)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vvGTS-00000000KVo-3t4Z

for doctor@nl2k.ab.ca;

Wed, 25 Feb 2026 08:07:00 -0700

Received: by mail-ot1-f73.google.com with SMTP id 46e09a7af769-7d4c3d9dd70so99987759a34.1

for ; Wed, 25 Feb 2026 07:06:05 -0800 (PST)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=google.com; s=20230601; t=1772031959; x=1772636759; darn=nl2k.ab.ca;

h=from:subject:date:message-id:sender:reply-to:mime-version:from:to

:cc:subject:date:message-id:reply-to;

bh=l7QBh5QbckAmIIxnN5o0d6wbam/0shA7ov9TW8wvHMg=;

b=PKW/m1Sg5it3N6rJlHDSgQBc8MyZdAHT38S0gWTBIX4s0pwZA0R2XbxTX2vKNhdU3s

0P3hK/xfnzCLk1DxoutlyrqS/Z3DEw034Z9/KrwlQNS7krbfmeG561iaJvru8N4J1yZ2

TVajL75+szn1j1GhgY4NuM6P5KWCaPKHQGmN+nLmA84J3yXCRlDsQwdURjKnV6OcACsC

HcAw5nk4GnriP2h4xaUwYQ54myBlXRbAhIi091Ra5unwCOcvFPoJO/0BTw18DSBkuwv5

uyHI9k4xjO76+sooQjgvDiIqFovZBzMHXcsAN2K2NwcBzxyS+ObIWgztJyjFlquHVAWB

bLyw==

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=clickviewm-org.20230601.gappssmtp.com; s=20230601; t=1772031959; x=1772636759; darn=nl2k.ab.ca;

h=from:subject:date:message-id:sender:reply-to:mime-version:from:to

:cc:subject:date:message-id:reply-to;

bh=l7QBh5QbckAmIIxnN5o0d6wbam/0shA7ov9TW8wvHMg=;

b=yqz2iPehE6Sqbxh4g9VCehU+7fKHR5Cw9pIbrRih8w9CPqR9FA38G7+WSlklm6d6d+

SP5e9bizSa5ORzDwxZjIZqhw8mx2prTsJQKDKEqtLl/a8Nv8bHSj8qHYUslNeMolqB+0

M6hVJjV1YnnXtuPiAckWdpa8DaYjn1Mn2+6JnK9ZTf7CP4EwTriurVeHWxmrYu0PtRpG

AUnO4037ob4RTZvXKK64nZYdKIH8sd9FSjRiKcrozF5+8JpvhzUtME7SOfk1EA9QDf8/

7P2f73cXA+WpjAX6P/1Fag0CTIOUCAYa06eM8s7Dr7T781hKPMYtk/2tAL/1W//xI5Fu

EVbw==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20230601; t=1772031959; x=1772636759;

h=from:subject:date:message-id:sender:reply-to:mime-version

:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to;

bh=l7QBh5QbckAmIIxnN5o0d6wbam/0shA7ov9TW8wvHMg=;

b=nj45/D7FDVc6Nxu5VkoFs+2aBvx8YxiT9S1X7Y1LxuaIMlf9ZP06xwIlratn1/N2ba

Nx+zZJmPJkzqzjFqY/GYAYPc3xiu5ga70VCyEIj/7+N7BPbZ/tLBzosXjFpFikZRSqqN

GcasxazPBA+EPHKfzcNlF3cTptcTWXuClFCehgX+vkWGmL6zI3NTKIYYS9/FlmiD4d4r

ZY/uX5xOBVl5XjEm1dsJ1ego4VfS57Jru0HpMohBobLu+QHCUfwHSKW7BdtufbuPqh5R

X2+EcO0oQFQ8Py+cUMI3Qvo4oZ0DWfgJmrAApiRRWYc3FpzBwktMLJDyjeCGU5uHjyt9

ZVUQ==

X-Forwarded-Encrypted: i=1; AJvYcCXs2QrX8H+R1/wbnHKQjBJZIkyp+zV2hSDX7SB+ACtZFPdf9cy+Tkk+KJFjEuIkEKJEhd+RDSk=@nl2k.ab.ca

X-Gm-Message-State: AOJu0YwhRFGg5ctPv5yOguLHUbVxMdWeygrSuZDugF02Q+yM8HeYePPo

iZyq5psSQyRpzJJmVOh4qUGokDg9jifrZ0WRXPL1HkibRJdoCSzWoVlFBE1DOHbVoCt9d5DDLjK

0w/xN2vHqXRwTxHdabgEy00vndkdMICTkZrIxzgMYBGUwhA==

MIME-Version: 1.0

X-Received: by 2002:a05:6830:650c:b0:7c6:cf19:1df1 with SMTP id

46e09a7af769-7d52bf527demt12037201a34.30.1772031959173; Wed, 25 Feb 2026

07:05:59 -0800 (PST)

Reply-To: Jolene Henry

Sender: Google Calendar

Message-ID:

Date: Wed, 25 Feb 2026 15:05:59 +0000

Subject: Your Invoice reference Number has been recorded

From: Jolene Henry

Content-Type: multipart/alternative; boundary="00000000000077bca5064ba75741"

X-Spam_score: 12.8

X-Spam_score_int: 128

X-Spam_bar: ++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Dear We are preparing your shipment.! Your recent purchase

has been successfully acknowledged. Order Receipt Id: NHYJ-4706-SGK is now

scheduled for dispatch preparation. For order tracking information [...]



Content analysis details: (12.8 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[209.85.210.73 listed in list.dnswl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[209.85.210.73 listed in will-spam-for-food.eu.org]

[209.85.210.73 listed in will-spam-for-food.eu.org]

[209.85.210.73 listed in will-spam-for-food.eu.org]

[209.85.210.73 listed in will-spam-for-food.eu.org]

[209.85.210.73 listed in will-spam-for-food.eu.org]

[209.85.210.73 listed in will-spam-for-food.eu.org]

[209.85.210.73 listed in will-spam-for-food.eu.org]

[209.85.210.73 listed in will-spam-for-food.eu.org]

-0.0 RCVD_IN_MSPIKE_H3 RBL: Good reputation (+3)

[209.85.210.73 listed in wl.mailspike.net]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[209.85.210.73 listed in dnsbl.ahbl.org]

[209.85.210.73 listed in dnsbl.ahbl.org]

[209.85.210.73 listed in dnsbl.ahbl.org]

[209.85.210.73 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[209.85.210.73 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[209.85.210.73 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[209.85.210.73 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[209.85.210.73 listed in dnsbl.ahbl.org]

-0.0 RCVD_IN_MSPIKE_WL Mailspike good senders

1.2 MISSING_HEADERS Missing To: header

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 LOTS_OF_MONEY Huge... sums of money

1.9 REPLYTO_WITHOUT_TO_CC No description available.

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

2.0 RATWR8_MESSID Message-ID with excessive dashes and dollars

2.6 LONG_INVISIBLE_TEXT Long block of hidden text - bayes poison?

Subject: {SPAM?} Your Invoice reference Number has been recorded



--00000000000077bca5064ba75741

Content-Type: text/plain; charset="UTF-8"; format=flowed; delsp=yes

Content-Transfer-Encoding: base64



RGVhciBXZSBhcmUgcHJlcGFyaW5nIHlvdXIgc2hpcG1lbnQuISBZb3VyIHJlY2VudCBwdXJjaGFz

ZSBoYXMgYmVlbiAgDQpzdWNjZXNzZnVsbHkgYWNrbm93bGVkZ2VkLiBPcmRlciBSZWNlaXB0IElk

OiBOSFlKLTQ3MDYtU0dLIGlzIG5vdyBzY2hlZHVsZWQgIA0KZm9yIGRpc3BhdGNoIHByZXBhcmF0

aW9uLiBGb3Igb3JkZXIgdHJhY2tpbmcgaW5mb3JtYXRpb24sIHBsZWFzZSByZWFjaCB1cyAgDQph

bnl0aW1lLiBJZiBzZXZlcmFsIG9yZGVycyB3ZXJlIHBsYWNlZCBjbG9zZSB0b2dldGhlciwgdGhl

eSBtaWdodCBiZSAgDQpjb21iaW5lZCBpbiBvbmUgc2hpcG1lbnQuIEFzc2lzdGFuY2UgaXMgYXZh

aWxhYmxlIGF0IDg2MyA0MDkgNTIxOC4gUmVjZWlwdCAgDQpEZXRhaWxzOiBUcmFuc2FjdGlvbiBE

YXRlOiAyMDI2LTAyLTI1IFByb2R1Y3QgUHVyY2hhc2VkOiBpUGhvbmUgMTcgUHJvICANClJlZmVy

ZW5jZSBObzogNzI0MDY5NjcgUXVhbnRpdHk6IDF4IFNoaXBwaW5nOiBGcmVlIFBheW1lbnQgTWV0

aG9kOiBQYXlQYWwgIA0KVG90YWwgUGFpZDogJDExMzUuNjYgV2XigJlyZSBoZXJlIHRvIGVuc3Vy

ZSBhIHNtb290aCBleHBlcmllbmNlLiBDYWxsICANCig4NjMpLTQwOS01MjE4IGlmIHlvdSByZXF1

aXJlIHN1cHBvcnQuIFBheVBhbCwgTExDIFN1cHBvcnQgSG91cnM6IDYgQU0g4oCTIDYgIA0KUE0g

UGhvbmU6ICsxICANCig4NjMpLTQwOS01MjE4IC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAu

IC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4g

LiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAu

IC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4g

LiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAu

IC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4g

LiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAu

DQoNCllvdXIgSW52b2ljZSByZWZlcmVuY2UgTnVtYmVyIGhhcyBiZWVuIHJlY29yZGVkDQpXZWRu

ZXNkYXkgRmViIDI1LCAyMDI2IOKLhSAxMmFtIOKAkyAxMTozMHBtDQpFYXN0ZXJuIFRpbWUgLSBO

ZXcgWW9yaw0KDQoNCg0KT3JnYW5pemVyDQpKb2xlbmUgSGVucnkNCmJsYW5jaGVjb29rMjhAY2xp

Y2t2aWV3bS5vcmcNCg0K

--00000000000077bca5064ba75741

Content-Type: text/html; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable




schemas-microsoft-com:vml" xmlns:o=3D"urn:schemas-microsoft-com:office:offi=

ce">
t=3D"text/html; charset=3DUTF-8">
=3Ddevice-width,initial-scale=3D1">
ight dark">

iPhone Paypal phish from Google Gmail Part 4

Posted by Dave Yadallee on

/InformAction">
emtype=3D"http://schema.org/EmailMessage">
ntent=3D"Esveydi Turman: 2026-02-25 Transaction: DTWT-8860-SIF Reference Nu=

mber: 53621047 Your payment is successfully reflected. Hi, we=E2=80=99re gl=

ad to confirm your recent purchase from PayPal. Your payment has been recei=

ved and the order is now scheduled for processing. Below are the transactio=

n details: Order Description: Item: iPhone 17 Pro Max Quantity: 1x Payment =

Method: PayPal Total Amount: $1196.33 For further assistance, please connec=

t with our team using the contact details below. Orders can be canceled wit=

hin 24 hours by calling 1{863} 409-5218. =C2=A9 2025 PayPal LLC =E2=80=93 A=

ll rights reserved. . . . . . . . . . . . . . . . . . . . . . . . . . . . .=

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . =

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .=

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . =

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .=

. . . . . . . ."/>
ttp://schema.org/Event">
hema.org/EventScheduled"/>
=3D"http://schema.org/Organization">
le Calendar"/>
q7cjlguqs5aam7moiejr8oq1s"/>
olor: #fff; line-height: 1px; height: 0; max-height: 0; width: 0; max-width=

: 0; opacity: 0; overflow: hidden;" itemprop=3D"name">Bill 5389-HFKT transa=

ction confirmed
ellspacing=3D"0" role=3D"presentation" align=3D"center" style=3D"width:100%=

;" class=3D"body-container">

eft">
 

=3D"0" cellspacing=3D"0" role=3D"presentation" align=3D"center" style=3D"wi=

dth:100%;" class=3D"">
<=

span itemscope itemtype=3D"http://schema.org/EmailMessage">


escription">2026-02-25
Transaction: DTWT-8860-SIF
Reference Number: 5=

3621047

Your payment is successfully reflected.

Hi, we=E2=80=99re glad =

to confirm your recent purchase from PayPal.

Your payment has been receiv=

ed and the order is now scheduled for processing.
Below are the transa=

ction details:

Order Description:
Item: iPhone 17 Pro Max
Quantit=

y: 1x
Payment Method: PayPal
Total Amount: $1196.33

For further=

assistance, please connect with our team using the contact details below. =


Orders can be canceled within 24 hours by calling 1{863} 409-5218.

=

© 2025 PayPal LLC =E2=80=93 All rights reserved.
.
.
.
.
r>.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
r>.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
r>.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
r>.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
r>.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
r>.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
r>.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
r>.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
r>.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
r>.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
r>.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
r>.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
r>.
.


g=3D"0" cellspacing=3D"0" role=3D"presentation" align=3D"center" style=3D"w=

idth:100%;" class=3D"">

order-radius: 8px; direction: rtl; font-size: 0; padding: 24px 32px; text-a=

lign: left; vertical-align: top;" class=3D"main-container-inner">

lign: left; direction: ltr; display: inline-block; vertical-align: top; wid=

th: 100%;overflow: hidden; word-wrap: break-word;">
padding=3D"0" cellspacing=3D"0" role=3D"presentation" width=3D"100%" class=

=3D"main-column-table-ltr" style=3D"padding-right: 32px; padding-left: 0;;t=

able-layout: fixed;">

ng:0; vertical-align:top;">
g=3D"0" role=3D"presentation" width=3D"100%" style=3D"table-layout: fixed;"=

>
>

reak-word;;padding-bottom:2px;">

', Roboto, sans-serif;font-weight: 400; font-size: 22px; line-height: 2=

8px;color: #3c4043; text-decoration: none;" class=3D"primary-text" role=3D"=

presentation">Bill 5389-HFKT transaction confirmed<=

/span>

: left; word-break: break-word;;padding-bottom:24px;">

mily: Roboto, sans-serif;font-style: normal; font-weight: 400; font-size: 1=

4px; line-height: 20px; letter-spacing: 0.2px;color: #3c4043; text-decorati=

on: none;" class=3D"primary-text" role=3D"presentation">
=3D"true">
an>Tuesday Feb 24 =E2=8B=85 11pm =E2=80=93 Wednesday Feb 25, 2026 =E2=8B=85=

10:30pm (Central Time - Chicago)

nt-size: 0; padding: 0; text-align: left; word-break: break-word;;padding-b=

ottom:24px;">

al; font-weight: 400; font-size: 14px; line-height: 20px; letter-spacing: 0=

.2px;color: #3c4043; text-decoration: none;" class=3D"primary-text" role=3D=

"presentation">
=3D"presentation" style=3D"padding-bottom: 4px;">


ry-text" style=3D"font-size: 14px;color: #3c4043; text-decoration: none;fon=

t-weight: 700;-webkit-font-smoothing: antialiased;margin: 0; padding: 0;">O=

rganizer


=3D"notranslate">
lay: inline-block;;color: #3c4043; text-decoration: none;" href=3D"mailto:l=

ucanancysm6756@lightusermf.org">Esveydi Turman
organizer" itemscope itemtype=3D"http://schema.org/Person">
=3D"name" content=3D"Esveydi Turman"/>
ucanancysm6756@lightusermf.org"/>

reak-word;;padding-bottom:24px;">

rif;font-style: normal; font-weight: 400; font-size: 14px; line-height: 20p=

x; letter-spacing: 0.2px;color: #3c4043; text-decoration: none;" class=3D"p=

rimary-text" role=3D"presentation">
llspacing=3D"0" role=3D"presentation" style=3D"padding-bottom: 4px;">
d>


decoration: none;font-weight: 700;-webkit-font-smoothing: antialiased;margi=

n: 0; padding: 0;">Guests

(Guest list has been hidden=

at organizer's request)
<=

/div>
<=

/td>


--000000000000640acb064ba73d5a--

iPhone Paypal phish from Google Gmail Part 3

Posted by Dave Yadallee on
@media only screen and (min-width:580px) {

.main-container-inner {

padding: 24px 32px !important;

}



.info-bar-inner {

padding: 12px 32px !important;

}



.main-column-table-ltr {

padding-right: 32px !important;

}



.main-column-table-rtl {

padding-left: 32px !important;

}



.appointment-buttons th {

display: table-cell;

clear: none;

}

}



.primary-text {

color: #3c4043 !important;

}



.secondary-text,

.phone-number a {

color: #70757a !important;

}



.accent-text {

color: #1a73e8 !important;

}



.accent-text-dark {

color: #185abc !important;

}



.grey-button-text,

.attachment-chip a {

color: #5f6368 !important;

}



.primary-button {

background-color: #1a73e8 !important;

}



.primary-button-text {

color: #fff !important;

}



.underline-on-hover:hover {

text-decoration: underline !important;

}



.grey-infobar-text {

color: #202124 !important;

}



@media (prefers-color-scheme: dark) {

.primary-text:not([class^=3D"x_"]) {

color: #e8eaed !important;

}



.secondary-text:not([class^=3D"x_"]),

.phone-number:not([class^=3D"x_"]) a {

color: #9aa0a6 !important;

}



.grey-button-text:not([class^=3D"x_"]),

.attachment-chip:not([class^=3D"x_"]) a {

color: #bdc1c6 !important;

}



.accent-text:not([class^=3D"x_"]),

.hairline-button-text:not([class^=3D"x_"]) {

color: #8ab4f8 !important;

}



.primary-button:not([class^=3D"x_"]) {

background-color: #8ab4f8 !important;

}



.primary-button-text:not([class^=3D"x_"]) {

color: #202124 !important;

}

}