Microsoft ads violation phish from Google Gmail
Posted by Dave Yadallee onEnvelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Fri, 01 Aug 2025 09:29:00 -0600
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))
(envelope-from
id 1uhrft-00000000Nsf-1exV
for dave@doctor.nl2k.ab.ca;
Fri, 01 Aug 2025 09:28:01 -0600
Resent-From: The Doctor
Resent-Date: Fri, 1 Aug 2025 09:28:01 -0600
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from mail-ej1-f65.google.com ([209.85.218.65]:53666)
by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256
(Exim 4.98.2 (FreeBSD))
(envelope-from
id 1uhqQg-00000000BLw-0zss
for root@doctor.nl2k.ab.ca;
Fri, 01 Aug 2025 08:08:21 -0600
Received: by mail-ej1-f65.google.com with SMTP id a640c23a62f3a-af922ab4849so254326566b.3
for
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=ml-automaten-de.20230601.gappssmtp.com; s=20230601; t=1754057181; x=1754661981; darn=doctor.nl2k.ab.ca;
h=to:subject:message-id:date:list-unsubscribe:from:mime-version:from
:to:cc:subject:date:message-id:reply-to;
bh=GmdpM7nb7ATneRvwZ3ki7obSjAwe8CYcuryFSfJeB08=;
b=Vji1cnQEzRzwQvdhLRmEbMMu/KI+CO/QwCi4CZm+NzS8xRS2zTwVGOrUL2P4BCpHzM
YJqWxQbXS3zzdWHpnhicWjHFtM9BfVY1jlay1jmYws5XuTGCvVuJ8iP2dA5EZmZx+AHa
H/3Bljp76flLSpSRcAbB/KykNhP6cwR2ndnIOc21wwrWu+qX/+k0d5drDWTWumcXzwWg
n2iuSKkWy3RhROc98btabxOo/p2SRruhsjwSg9MgLPKjqvgIMEslE5oBBwuQE7Z2/CQh
XM2R0uahpdn3Pz0CuYdHHRzfacSae20Lu+9w10FQP/4/irv86YmuYbS69yJhYBOJz159
uufg==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=1e100.net; s=20230601; t=1754057181; x=1754661981;
h=to:subject:message-id:date:list-unsubscribe:from:mime-version
:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to;
bh=GmdpM7nb7ATneRvwZ3ki7obSjAwe8CYcuryFSfJeB08=;
b=hsNOaZIvvEe4+wRtFiBY+Y/iJdzaO8F1WtA5Vq+EEa4EhHLm0iutqVoaZ31rhxef1K
rpkIQkjCcOh1zGgVgHUtzdm7R2uRR4FL3mhwf3Y8VwY9SVi/yRHiANTAR0sN5C/0RX6n
FVHkbLgOk2Mli1huBkwP6X05TF0Yc6+025KDiixUmdvVmf83JEpGjC3YPbkQhUGJmU+E
YD+xZc47Bc23mXb3rGIBWW/YOe+Za4RzQx26WYGCWnOACalLVxecFTRGyYQCvb0OSIPa
hiMxE9e6Ifd+AtQKuy5jQ252ej+1MUeZ26h0I+7/JjzBj25GFbVGI5f+HlOENgP4NTIF
p/jQ==
X-Forwarded-Encrypted: i=1; AJvYcCXdibSf+xPLajdubcVX1+plsgwr//LZDjZMAt0VECv+fcdG6+ylTuPQrQC+fv6jxhdoVQfL@doctor.nl2k.ab.ca
X-Gm-Message-State: AOJu0YzVabTa9VHAd75xrR6CNfxe5GpWmRI5TSyGQoetUpvpC72Nj6oy
IMX2Sw45AvT7zcNb7+VAB89wN4/nMD3z3qJ7NMVGQrWJPu6UqEj4AD7mvOjjxeP47atozEyi6RX
Or8i31w6gdE+QiR6s2vxZOfCvWdrpEotO4si9ahTAvi8=
X-Gm-Gg: ASbGnctb9dppqq1RLLzMVKbXbPRh3P+YXVcagXzU8ludDOkzwcvbXv5BhfByGUkJpuA
NkH7MEaycCbFMmNJobIsTXsHEM2Ve6LnWOH3EPmhk+643gAaM8soLvMo4azJknKtwNIejP20oQN
4+iasVe1yJeDlwFa+BEX4HFrSA2ErVv0fCmqMb+OBNPabewseSqXhIez1Oz4+cW+uGBg9+qZzkI
ilasO4=
X-Google-Smtp-Source: AGHT+IGGpB2ggG5Kur9JGxBfb/rGwEwEwBcepcgrWU0TXUjpz/ZQqhJ3HhouilNPp7kgNl9RASVsKmcv7lHfjIAH3xY=
X-Received: by 2002:a17:907:2d93:b0:ae3:6028:e4d0 with SMTP id
a640c23a62f3a-af9317255a0mr332305566b.7.1754057180199; Fri, 01 Aug 2025
07:06:20 -0700 (PDT)
Received: from 174653659670 named unknown by gmailapi.google.com with
HTTPREST; Fri, 1 Aug 2025 07:05:59 -0700
Received: from 174653659670 named unknown by gmailapi.google.com with
HTTPREST; Fri, 1 Aug 2025 07:05:59 -0700
MIME-Version: 1.0
X-Priority: 3
From: Microsoft Advertising
List-Unsubscribe:
X-Mailer: Microsoft Outlook 16.0
X-MSMail-Priority: Normal
Date: Fri, 1 Aug 2025 07:05:59 -0700
X-Gm-Features: Ac12FXycgzS0i3G4oIAKVjfpM5kV4knrn5HNAnXlKtpPUrDMo4C0fHfuC9vHYb4
Message-ID:
Subject: Urgent: Unusual Activity Detected on Your Bing Ads Account!
To: Ads
Content-Type: multipart/alternative; boundary="000000000000244e7f063b4e43b3"
Bcc: root@doctor.nl2k.ab.ca
X-Spam_score: 59.0
X-Spam_score_int: 590
X-Spam_bar: +++++++++++++++++++++++++++++++++++++++++++++++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: Newsletter [image: logo] Your Microsoft advertising Account
has been suspended Hello, We have detected unusual activity on your Bing
Ads account related to violations of the Microsoft Advertising Agreement
and Policies
[...]
Content analysis details: (59.0 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org
[209.85.218.65 listed in will-spam-for-food.eu.org]
[209.85.218.65 listed in will-spam-for-food.eu.org]
[209.85.218.65 listed in will-spam-for-food.eu.org]
[209.85.218.65 listed in will-spam-for-food.eu.org]
[209.85.218.65 listed in will-spam-for-food.eu.org]
[209.85.218.65 listed in will-spam-for-food.eu.org]
[209.85.218.65 listed in will-spam-for-food.eu.org]
[209.85.218.65 listed in will-spam-for-food.eu.org]
1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org
[209.85.218.65 listed in dnsbl.ahbl.org]
[209.85.218.65 listed in dnsbl.ahbl.org]
[209.85.218.65 listed in dnsbl.ahbl.org]
[209.85.218.65 listed in dnsbl.ahbl.org]
1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org
[209.85.218.65 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org
[209.85.218.65 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org
[209.85.218.65 listed in dnsbl.ahbl.org]
0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org
[209.85.218.65 listed in dnsbl.ahbl.org]
1.1 URIBL_GREY Contains an URL listed in the URIBL greylist
[URI: forward-to-friend.com]
[URI: list-manage.com]
[URI: campaign-archive.com]
0.0 URIBL_CT_SURBL Contains an URL listed in the CT SURBL blocklist
[URI: acousticguitar.us3.list-manage.com]
-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no
trust
[209.85.218.65 listed in list.dnswl.org]
0.0 RCVD_IN_VALIDITY_SAFE_BLOCKED RBL: ADMINISTRATOR NOTICE: The query to
Validity was blocked. See
https://knowledge.validity.com/hc/en-us/articles/20961730681243
for more information.
[209.85.218.65 listed in sa-accredit.habeas.com]
-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact
cert-sa@returnpath.net
[Excessive Number of Queries |
0.0 RCVD_IN_VALIDITY_CERTIFIED_BLOCKED RBL: ADMINISTRATOR NOTICE: The
query to Validity was blocked. See
https://knowledge.validity.com/hc/en-us/articles/20961730681243
for more information.
[209.85.218.65 listed in sa-trusted.bondedsender.org]
-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact
safe-sa@returnpath.net
[Excessive Number of Queries |
1.0 SPF_SOFTFAIL SPF: sender does not match SPF record (softfail)
0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid
-0.1 DKIM_VALID Message has at least one valid DKIM or DK signature
-0.0 RCVD_IN_MSPIKE_H3 RBL: Good reputation (+3)
[209.85.218.65 listed in wl.mailspike.net]
2.0 PDS_OTHER_BAD_TLD Untrustworthy TLDs
[URI: loverol.world (world)]
1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,
https://senderscore.org/blacklistlookup/
[209.85.218.65 listed in bl.score.senderscore.com]
0.0 RCVD_IN_VALIDITY_RPBL_BLOCKED RBL: ADMINISTRATOR NOTICE: The query to
Validity was blocked. See
https://knowledge.validity.com/hc/en-us/articles/20961730681243
for more information.
[209.85.218.65 listed in bl.score.senderscore.com]
15 GR_DOMAIN_CHIMP5 URI: Body contains known spammer URI (monkey)
15 GR_DOMAIN_CHIMP6 URI: Body contains known spammer URI (monkey)
1.5 MR_STRANGE_QUESTION URI: No description available.
15 GR_DOMAIN_CHIMP4 URI: Body contains known spammer URI (monkey)
0.0 HTML_MESSAGE BODY: HTML included in message
-0.0 RCVD_IN_MSPIKE_WL Mailspike good senders
1.8 MISSING_MIMEOLE Message has X-MSMail-Priority, but no X-MimeOLE
1.5 TVD_PH_BODY_ACCOUNTS_PRE The body matches phrases such as "accounts
suspended", "account credited", "account
verification"
0.8 SARE_FROM_SPAM_WORD3 I don't know people named this!
2.0 VOWEL_URI_6 URI hostname with 6 consecutive vowels
1.0 ACCT_PHISHING Possible phishing for account information
Subject: {SPAM?} Urgent: Unusual Activity Detected on Your Bing Ads Account!
--000000000000244e7f063b4e43b3
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
Newsletter
[image: logo]
Your Microsoft advertising Account has been suspended
Hello,
We have detected unusual activity on your Bing Ads account related to
violations of the Microsoft Advertising Agreement and Policies
vasbvzrimbuset>
within the last 24 hours.
To restore your ads, please review the flagged content and ensure
compliance with Microsoft Advertising Policies
vasbvzrimbuset>.
You may also use Our Microsoft=E2=80=99s application
vasbvzrimbuset>
to help identify and avoid policy violations, reducing the risk of future
ad suspensions.
Action required: You must verify your account within 24 hours to avoid
permanent deletion.
To restore access, click the button below and follow the instructions:
Verify Account Now
vasbvzrimbuset>
If you did not request this, please secure your account
vasbvzrimbuset>
immediately.
Thanks,
The Microsoft advertising Team.
=C2=A9 2025 Microsoft LLC, 1600 Amphitheatre Parkway, Mountain View, CA 940=
43
You received this email to notify you about important changes to your
account.
84440a923f&id=3D699bde0f59&e=3D09d05b0924>
84440a923f&id=3D91d095a062&e=3D09d05b0924>
View this email in your browser
923f&id=3Dae4e407841>
| Share this email with a friend
=3Dae4e407841&e=3D09d05b0924>
Want to change how you receive these emails?
You can update your preferences
06ea01384440a923f&id=3Dc8a2f76447&e=3D09d05b0924&c=3Dae4e407841>
or unsubscribe from this list
84440a923f&id=3Dc8a2f76447&t=3Db&e=3D09d05b0924&c=3Dae4e407841>
.
Please note that unsubscribing will remove you from all communications
from *Acoustic Guitar*, including digital edition notifications for
magazine subscribers. To change which newsletters you receive, please updat=
e
your preferences
06ea01384440a923f&id=3Dc8a2f76447&e=3D09d05b0924&c=3Dae4e407841>
.
Copyright =C2=A9 2025 Stringletter Media, All rights reserved.
You are receiving this email because you opted in at our website, shopped
in our store, entered a giveaway, or have a magazine subscription.
Our mailing address is:
Stringletter Media
330 SFD Blvd Suite K
San Anselmo, CA 94960
Add us to your address book
923f&id=3Dc8a2f76447>
--000000000000244e7f063b4e43b3
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
=3D1.0">
ldschirmfoto-2019-10-29-um-11.41.42.png" alt=3D"logo" width=3D"200">
Y=
our Microsoft advertising Account has been suspended
Hello,
We have detected unusual activity on your Bing Ads account r=
elated to violations of the
FPG7D6SY-424289436143105.hjxxeffiqhjvjvasbvzrimbuset">Microsoft Adv=
ertising Agreement and Policies within the last 24 hours.
To restore your ads, please review the flagged content and e=
nsure compliance with
SY-424289436143105.hjxxeffiqhjvjvasbvzrimbuset">Microsoft Advertising Polic=
ies. You may also use Our
8OFPG7D6SY-424289436143105.hjxxeffiqhjvjvasbvzrimbuset">
-decoration:underline;color:#3366ff">Microsoft=E2=80=99s application=
to help identify and avoid policy violations, reducing the risk of fut=
ure ad suspensions.
=20
Action required: You must verify your acco=
unt within 24 hours to avoid permanent deletion.
=20
To restore access, click the button below and follow the ins=
tructions:
36143105.hjxxeffiqhjvjvasbvzrimbuset" class=3D"button">Verify Account Now=
a>
=20
If you did not request this, please
ol.world?clientid=3D48OFPG7D6SY-424289436143105.hjxxeffiqhjvjvasbvzrimbuset=
" style=3D"color:#4285f4">secure your account immediately.
=20
Thanks,
The Microsoft advertising Team.
adding=3D"0" cellspacing=3D"0" class=3D"m_-6342718803426382646mcnImageGroup=
ContentContainer" style=3D"border-collapse:collapse;float:right">
GroupContent" valign=3D"top" style=3D"padding-right:9px;padding-top:0;paddi=
ng-bottom:0">
ist-manage.com/track/click?u=3D89149d5406ea01384440a923f&id=3D91d095a06=
2&e=3D09d05b0924" title=3D"" target=3D"_blank">
content.com/89149d5406ea01384440a923f/images/eea86745-58ba-56c7-828c-95556d=
60a4c0.jpg" width=3D"264" style=3D"max-width:540px;padding-bottom:0;border:=
0;height:auto;outline:none;text-decoration:none;vertical-align:bottom" clas=
s=3D"m_-6342718803426382646mcnImage CToWUd">
0%" style=3D"min-width:100%;border-collapse:collapse">
=09
=09
=09
acing=3D"0" style=3D"max-width:100%;min-width:100%;border-collapse:collapse=
;float:left" width=3D"100%" class=3D"m_-6342718803426382646mcnTextContentCo=
ntainer">
cnTextContent" style=3D"padding:0px 18px 9px;text-align:center;word-break:b=
reak-word;color:#fefefe;font-family:Helvetica;font-size:13px;line-height:15=
0%">
ps://us3.campaign-archive.com/?e=3D09d05b0924&u=3D89149d5406ea01384440a=
923f&id=3Dae4e407841" style=3D"color:#ffffff;font-weight:bold;text-deco=
ration:underline" target=3D"_blank">View this email in your browser
n style=3D"color:#ffffff">=C2=A0|=C2=A0
d-to-friend.com/forward?u=3D89149d5406ea01384440a923f&id=3Dae4e407841&a=
mp;e=3D09d05b0924" style=3D"color:#ffffff;font-weight:bold;text-decoration:=
underline" target=3D"_blank">Share this email with a friend
=09
=09
0%" class=3D"m_-6342718803426382646mcnDividerBlock" style=3D"min-width:100%=
;border-collapse:collapse;table-layout:fixed!important">
th=3D"100%" style=3D"min-width:100%;border-top:2px solid #eaeaea;border-col=
lapse:collapse">
0%" style=3D"min-width:100%;border-collapse:collapse">
=09
=09
=09
acing=3D"0" style=3D"max-width:100%;min-width:100%;border-collapse:collapse=
;float:left" width=3D"100%" class=3D"m_-6342718803426382646mcnTextContentCo=
ntainer">
cnTextContent" style=3D"padding-top:0;padding-right:18px;padding-bottom:9px=
;padding-left:18px;word-break:break-word;color:#fefefe;font-family:Helvetic=
a;font-size:13px;line-height:150%;text-align:center">
Want to change how you receive these emails?
>
You can
ences?u=3D89149d5406ea01384440a923f&id=3Dc8a2f76447&e=3D09d05b0924&=
amp;c=3Dae4e407841" style=3D"color:#ffffff;font-weight:bold;text-decoration=
:underline" target=3D"_blank">update your preferences or
ps://acousticguitar.us3.list-manage.com/unsubscribe?u=3D89149d5406ea0138444=
0a923f&id=3Dc8a2f76447&t=3Db&e=3D09d05b0924&c=3Dae4e407841"=
style=3D"color:#ffffff;font-weight:bold;text-decoration:underline" target=
=3D"_blank">unsubscribe from this list.
Please note that unsubscribing will remove you from all co=
mmunications from Acoustic Guitar, including digital edition notif=
ications for magazine subscribers. To change which newsletters you receive,=
please
ences?u=3D89149d5406ea01384440a923f&id=3Dc8a2f76447&e=3D09d05b0924&=
amp;c=3Dae4e407841" style=3D"color:#ffffff;font-weight:bold;text-decoration=
:underline" target=3D"_blank">update your preferences.
Copyright =C2=A9 2025 Stringletter Media, All rights reserved.
You are receiving this email because you opted in at our website, shopped =
in our store, entered a giveaway, or have a magazine subscription.
Our mailing address is:
an>San Anselmo, CA 94960
=3D"https://acousticguitar.us3.list-manage.com/vcard?u=3D89149d5406ea013844=
40a923f&id=3Dc8a2f76447" target=3D"_blank">Add us to your address book<=
/a>
=09
=09
--000000000000244e7f063b4e43b3--