Google Drive Phish from Google user Content Part 2



YmxlIGFsaWduPSJjZW50ZXIiIGJvcmRlcj0iMCIgY2VsbHBhZGRpbmc9IjAiIGNlbGxzcGFjaW5n

PSIwIiBjbGFzcz0icm93LWNvbnRlbnQgc3RhY2siIHJvbGU9InByZXNlbnRhdGlvbiIgc3R5bGU9

Im1zby10YWJsZS1sc3BhY2U6IDBwdDsgbXNvLXRhYmxlLXJzcGFjZTogMHB0OyBjb2xvcjogIzAw

MDsgd2lkdGg6IDYwMHB4OyBtYXJnaW46IDAgYXV0bzsiIHdpZHRoPSI2MDAiPgo8dGJvZHk+Cjx0

cj4KPHRkIGNsYXNzPSJjb2x1bW4gY29sdW1uLTEiIHN0eWxlPSJtc28tdGFibGUtbHNwYWNlOiAw

cHQ7IG1zby10YWJsZS1yc3BhY2U6IDBwdDsgdGV4dC1hbGlnbjogbGVmdDsgZm9udC13ZWlnaHQ6

IDQwMDsgcGFkZGluZy1ib3R0b206IDVweDsgcGFkZGluZy10b3A6IDVweDsgdmVydGljYWwtYWxp

Z246IHRvcDsgYm9yZGVyLXRvcDogMHB4OyBib3JkZXItcmlnaHQ6IDBweDsgYm9yZGVyLWJvdHRv

bTogMHB4OyBib3JkZXItbGVmdDogMHB4OyIgd2lkdGg9IjEwMCUiPgo8dGFibGUgYm9yZGVyPSIw

IiBjZWxscGFkZGluZz0iMCIgY2VsbHNwYWNpbmc9IjAiIGNsYXNzPSJpbWFnZV9ibG9jayBibG9j

ay0xIiByb2xlPSJwcmVzZW50YXRpb24iIHN0eWxlPSJtc28tdGFibGUtbHNwYWNlOiAwcHQ7IG1z

by10YWJsZS1yc3BhY2U6IDBwdDsiIHdpZHRoPSIxMDAlIj4KPHRyPgo8dGQgY2xhc3M9InBhZCIg

c3R5bGU9IndpZHRoOjEwMCU7cGFkZGluZy1yaWdodDowcHg7cGFkZGluZy1sZWZ0OjBweDsiPgo8

ZGl2IGFsaWduPSJjZW50ZXIiIGNsYXNzPSJhbGlnbm1lbnQiIHN0eWxlPSJsaW5lLWhlaWdodDox

MHB4Ij48aW1nIHNyYz0iaHR0cHM6Ly9pLmd5YXpvLmNvbS9jYjQ1M2JhOTJiZmVjOTliZjJmYWQ3

NmM5YTc4NjRjNy5wbmciIHN0eWxlPSJoZWlnaHQ6IGF1dG87IGRpc3BsYXk6IGJsb2NrOyBib3Jk

ZXI6IDA7IG1heC13aWR0aDogMTUwcHg7IHdpZHRoOiAxMDAlOyIgd2lkdGg9IjE1MCIvPjwvZGl2

Pgo8L3RkPgo8L3RyPgo8L3RhYmxlPgo8dGFibGUgYm9yZGVyPSIwIiBjZWxscGFkZGluZz0iMCIg

Y2VsbHNwYWNpbmc9IjAiIGNsYXNzPSJpbWFnZV9ibG9jayBibG9jay0yIiByb2xlPSJwcmVzZW50

YXRpb24iIHN0eWxlPSJtc28tdGFibGUtbHNwYWNlOiAwcHQ7IG1zby10YWJsZS1yc3BhY2U6IDBw

dDsiIHdpZHRoPSIxMDAlIj4KPHRyPgo8dGQgY2xhc3M9InBhZCIgc3R5bGU9IndpZHRoOjEwMCU7

cGFkZGluZy1yaWdodDowcHg7cGFkZGluZy1sZWZ0OjBweDsiPgo8ZGl2IGFsaWduPSJjZW50ZXIi

IGNsYXNzPSJhbGlnbm1lbnQiIHN0eWxlPSJsaW5lLWhlaWdodDoxMHB4Ij48aW1nIHNyYz0iaHR0

cHM6Ly9pLmd5YXpvLmNvbS9kZTg3YjliN2JkYTlmZDI4NTc3N2VmN2MzNzYwODNjZi5wbmciIHN0

eWxlPSJoZWlnaHQ6IGF1dG87IGRpc3BsYXk6IGJsb2NrOyBib3JkZXI6IDA7IG1heC13aWR0aDog

MjEwcHg7IHdpZHRoOiAxMDAlOyIgd2lkdGg9IjIxMCIvPjwvZGl2Pgo8L3RkPgo8L3RyPgo8L3Rh

YmxlPgo8dGFibGUgYm9yZGVyPSIwIiBjZWxscGFkZGluZz0iMTAiIGNlbGxzcGFjaW5nPSIwIiBj

bGFzcz0iaGVhZGluZ19ibG9jayBibG9jay0zIiByb2xlPSJwcmVzZW50YXRpb24iIHN0eWxlPSJt

c28tdGFibGUtbHNwYWNlOiAwcHQ7IG1zby10YWJsZS1yc3BhY2U6IDBwdDsiIHdpZHRoPSIxMDAl

Ij4KPHRyPgo8dGQgY2xhc3M9InBhZCI+CjxoMSBzdHlsZT0ibWFyZ2luOiAwOyBjb2xvcjogIzBj

MGIwYzsgZGlyZWN0aW9uOiBsdHI7IGZvbnQtZmFtaWx5OiAnU291cmNlIFNhbnMgUHJvJywgVGFo

b21hLCBWZXJkYW5hLCBTZWdvZSwgc2Fucy1zZXJpZjsgZm9udC1zaXplOiAzMHB4OyBmb250LXdl

aWdodDogNjAwOyBsZXR0ZXItc3BhY2luZzogbm9ybWFsOyBsaW5lLWhlaWdodDogMTIwJTsgdGV4

dC1hbGlnbjogY2VudGVyOyBtYXJnaW4tdG9wOiAwOyBtYXJnaW4tYm90dG9tOiAwOyI+PHNwYW4g

Y2xhc3M9InRpbnlNY2UtcGxhY2Vob2xkZXIiPllvdSBoYXZlIHJlYWNoZWQgeW91ciBzdG9yYWdl

IGxpbWl0PC9zcGFuPjwvaDE+CjwvdGQ+CjwvdHI+CjwvdGFibGU+Cjx0YWJsZSBib3JkZXI9IjAi

IGNlbGxwYWRkaW5nPSIwIiBjZWxsc3BhY2luZz0iMCIgY2xhc3M9ImltYWdlX2Jsb2NrIGJsb2Nr

LTQiIHJvbGU9InByZXNlbnRhdGlvbiIgc3R5bGU9Im1zby10YWJsZS1sc3BhY2U6IDBwdDsgbXNv

LXRhYmxlLXJzcGFjZTogMHB0OyIgd2lkdGg9IjEwMCUiPgo8dHI+Cjx0ZCBjbGFzcz0icGFkIiBz

dHlsZT0id2lkdGg6MTAwJTtwYWRkaW5nLXJpZ2h0OjBweDtwYWRkaW5nLWxlZnQ6MHB4OyI+Cjxk

aXYgYWxpZ249ImNlbnRlciIgY2xhc3M9ImFsaWdubWVudCIgc3R5bGU9ImxpbmUtaGVpZ2h0OjEw

cHgiPjxpbWcgY2xhc3M9ImZ1bGxXaWR0aCIgc3JjPSJodHRwczovL2kuZ3lhem8uY29tL2MyMDc1

MDA5Nzg4YWVjZDZlZTBiNmE4OTdjZTkwZjhhLnBuZyIgc3R5bGU9ImhlaWdodDogYXV0bzsgZGlz

cGxheTogYmxvY2s7IGJvcmRlcjogMDsgbWF4LXdpZHRoOiA0MjBweDsgd2lkdGg6IDEwMCU7IiB3

aWR0aD0iNDIwIi8+PC9kaXY+CjwvdGQ+CjwvdHI+CjwvdGFibGU+Cjx0YWJsZSBib3JkZXI9IjAi

IGNlbGxwYWRkaW5nPSI1MCIgY2VsbHNwYWNpbmc9IjAiIGNsYXNzPSJwYXJhZ3JhcGhfYmxvY2sg

YmxvY2stNSIgcm9sZT0icHJlc2VudGF0aW9uIiBzdHlsZT0ibXNvLXRhYmxlLWxzcGFjZTogMHB0

OyBtc28tdGFibGUtcnNwYWNlOiAwcHQ7IHdvcmQtYnJlYWs6IGJyZWFrLXdvcmQ7IiB3aWR0aD0i

MTAwJSI+Cjx0cj4KPHRkIGNsYXNzPSJwYWQiPgo8ZGl2IHN0eWxlPSJjb2xvcjojMTAxMTEyO2Rp

cmVjdGlvbjpsdHI7Zm9udC1mYW1pbHk6J1NvdXJjZSBTYW5zIFBybycsIFRhaG9tYSwgVmVyZGFu

YSwgU2Vnb2UsIHNhbnMtc2VyaWY7Zm9udC1zaXplOjE4cHg7Zm9udC13ZWlnaHQ6NDAwO2xldHRl

ci1zcGFjaW5nOjBweDtsaW5lLWhlaWdodDoxMjAlO3RleHQtYWxpZ246bGVmdDttc28tbGluZS1o

ZWlnaHQtYWx0OjIxLjU5OTk5OTk5OTk5OTk5OHB4OyI+CjxwIHN0eWxlPSJtYXJnaW46IDA7IG1h

cmdpbi1ib3R0b206IDE2cHg7Ij5EZWFyIGN1c3RvbWVyLDwvcD4KPHAgc3R5bGU9Im1hcmdpbjog

MDsgbWFyZ2luLWJvdHRvbTogMTZweDsiPjxzdHJvbmc+WW91ciBHb29nbGUgRHJpdmUgaXMgZnVs

bC48L3N0cm9uZz48L3A+CjxwIHN0eWxlPSJtYXJnaW46IDA7Ij5Zb3UgY2FuIG5vdyByZWNlaXZl

IGFuIGFkZGl0aW9uYWwgNTAgR0IgZm9yIGp1c3QgJDQuMDAsIGVsc2UgeW91IGNhbiBubyBsb25n

ZXIgYmFja3VwIHlvdXIgaW1hZ2VzIGFuZCBmaWxlcy48L3A+CjwvZGl2Pgo8L3RkPgo8L3RyPgo8

L3RhYmxlPgo8dGFibGUgYm9yZGVyPSIwIiBjZWxscGFkZGluZz0iMTAiIGNlbGxzcGFjaW5nPSIw

IiBjbGFzcz0iYnV0dG9uX2Jsb2NrIGJsb2NrLTYiIHJvbGU9InByZXNlbnRhdGlvbiIgc3R5bGU9

Im1zby10YWJsZS1sc3BhY2U6IDBwdDsgbXNvLXRhYmxlLXJzcGFjZTogMHB0OyIgd2lkdGg9IjEw

MCUiPgo8dHI+Cjx0ZCBjbGFzcz0icGFkIj4KPGRpdiBhbGlnbj0iY2VudGVyIiBjbGFzcz0iYWxp

Z25tZW50Ij48IS0tW2lmIG1zb10+PHY6cm91bmRyZWN0IHhtbG5zOnY9InVybjpzY2hlbWFzLW1p

Y3Jvc29mdC1jb206dm1sIiB4bWxuczp3PSJ1cm46c2NoZW1hcy1taWNyb3NvZnQtY29tOm9mZmlj

ZTp3b3JkIiBocmVmPSJodHRwczovL3N0b3JhZ2UuZ29vZ2xlYXBpcy5jb20vZWNmdnl6ZWZ6ZXl1

ZmN1eXpmdXplY3Z6dXpldmN1emZldWNmdXplY2cvZ29vY2hrdGdsaXNibWl0bHNva29sejdkaTU0

ZHNjeGttN2diZi5odG1sIiBzdHlsZT0iaGVpZ2h0OjQycHg7d2lkdGg6MTM0cHg7di10ZXh0LWFu

Y2hvcjptaWRkbGU7IiBhcmNzaXplPSI2MCUiIHN0cm9rZT0iZmFsc2UiIGZpbGxjb2xvcj0iIzAw

OWFmZiI+PHc6YW5jaG9ybG9jay8+PHY6dGV4dGJveCBpbnNldD0iMHB4LDBweCwwcHgsMHB4Ij48

Y2VudGVyIHN0eWxlPSJjb2xvcjojZmZmZmZmOyBmb250LWZhbWlseTpUYWhvbWEsIFZlcmRhbmEs

IHNhbnMtc2VyaWY7IGZvbnQtc2l6ZToxNnB4Ij48IVtlbmRpZl0tLT48YSBocmVmPSJodHRwczov

L3N0b3JhZ2UuZ29vZ2xlYXBpcy5jb20vZWNmdnl6ZWZ6ZXl1ZmN1eXpmdXplY3Z6dXpldmN1emZl

dWNmdXplY2cvZ29vY2hrdGdsaXNibWl0bHNva29sejdkaTU0ZHNjeGttN2diZi5odG1sIiBzdHls

ZT0idGV4dC1kZWNvcmF0aW9uOm5vbmU7ZGlzcGxheTppbmxpbmUtYmxvY2s7Y29sb3I6I2ZmZmZm

ZjtiYWNrZ3JvdW5kLWNvbG9yOiMwMDlhZmY7Ym9yZGVyLXJhZGl1czoyNXB4O3dpZHRoOmF1dG87

Ym9yZGVyLXRvcDowcHggc29saWQgdHJhbnNwYXJlbnQ7Zm9udC13ZWlnaHQ6NDAwO2JvcmRlci1y

aWdodDowcHggc29saWQgdHJhbnNwYXJlbnQ7Ym9yZGVyLWJvdHRvbTowcHggc29saWQgdHJhbnNw

YXJlbnQ7Ym9yZGVyLWxlZnQ6MHB4IHNvbGlkIHRyYW5zcGFyZW50O3BhZGRpbmctdG9wOjVweDtw

YWRkaW5nLWJvdHRvbTo1cHg7Zm9udC1mYW1pbHk6J1NvdXJjZSBTYW5zIFBybycsIFRhaG9tYSwg

VmVyZGFuYSwgU2Vnb2UsIHNhbnMtc2VyaWY7Zm9udC1zaXplOjE2cHg7dGV4dC1hbGlnbjpjZW50

ZXI7bXNvLWJvcmRlci1hbHQ6bm9uZTt3b3JkLWJyZWFrOmtlZXAtYWxsOyIgdGFyZ2V0PSJfYmxh

bmsiPjxzcGFuIHN0eWxlPSJwYWRkaW5nLWxlZnQ6MjBweDtwYWRkaW5nLXJpZ2h0OjIwcHg7Zm9u

dC1zaXplOjE2cHg7ZGlzcGxheTppbmxpbmUtYmxvY2s7bGV0dGVyLXNwYWNpbmc6bm9ybWFsOyI+

PHNwYW4gc3R5bGU9IndvcmQtYnJlYWs6IGJyZWFrLXdvcmQ7IGxpbmUtaGVpZ2h0OiAzMnB4OyI+

cmVjZWl2ZSA1MCBHQjwvc3Bhbj48L3NwYW4+PC9hPjwhLS1baWYgbXNvXT48L2NlbnRlcj48L3Y6

dGV4dGJveD48L3Y6cm91bmRyZWN0PjwhW2VuZGlmXS0tPjwvZGl2Pgo8L3RkPgo8L3RyPgo8L3Rh

YmxlPgo8dGFibGUgYm9yZGVyPSIwIiBjZWxscGFkZGluZz0iMTUiIGNlbGxzcGFjaW5nPSIwIiBj

bGFzcz0iaW1hZ2VfYmxvY2sgYmxvY2stNyIgcm9sZT0icHJlc2VudGF0aW9uIiBzdHlsZT0ibXNv

LXRhYmxlLWxzcGFjZTogMHB0OyBtc28tdGFibGUtcnNwYWNlOiAwcHQ7IiB3aWR0aD0iMTAwJSI+

Cjx0cj4KPHRkIGNsYXNzPSJwYWQiPgo8ZGl2IGFsaWduPSJjZW50ZXIiIGNsYXNzPSJhbGlnbm1l

bnQiIHN0eWxlPSJsaW5lLWhlaWdodDoxMHB4Ij48aW1nIHNyYz0iaHR0cHM6Ly9pLmd5YXpvLmNv

bS85Nzc4MDBlYTAxYTI1YTM1ZWNlNTliOTNlZmZjYjFmMi5wbmciIHN0eWxlPSJoZWlnaHQ6IGF1

dG87IGRpc3BsYXk6IGJsb2NrOyBib3JkZXI6IDA7IG1heC13aWR0aDogMTIwcHg7IHdpZHRoOiAx

MDAlOyIgd2lkdGg9IjEyMCIvPjwvZGl2Pgo8L3RkPgo8L3RyPgo8L3RhYmxlPgo8L3RkPgo8L3Ry

Pgo8L3Rib2R5Pgo8L3RhYmxlPgo8L3RkPgo8L3RyPgo8L3Rib2R5Pgo8L3RhYmxlPgo8dGFibGUg

YWxpZ249ImNlbnRlciIgYm9yZGVyPSIwIiBjZWxscGFkZGluZz0iMCIgY2VsbHNwYWNpbmc9IjAi

IGNsYXNzPSJyb3cgcm93LTIiIHJvbGU9InByZXNlbnRhdGlvbiIgc3R5bGU9Im1zby10YWJsZS1s

c3BhY2U6IDBwdDsgbXNvLXRhYmxlLXJzcGFjZTogMHB0OyIgd2lkdGg9IjEwMCUiPgo8dGJvZHk+

Cjx0cj4KPHRkPgo8dGFibGUgYWxpZ249ImNlbnRlciIgYm9yZGVyPSIwIiBjZWxscGFkZGluZz0i

MCIgY2VsbHNwYWNpbmc9IjAiIGNsYXNzPSJyb3ctY29udGVudCBzdGFjayIgcm9sZT0icHJlc2Vu

dGF0aW9uIiBzdHlsZT0ibXNvLXRhYmxlLWxzcGFjZTogMHB0OyBtc28tdGFibGUtcnNwYWNlOiAw

cHQ7IGNvbG9yOiAjMDAwOyB3aWR0aDogNjAwcHg7IG1hcmdpbjogMCBhdXRvOyIgd2lkdGg9IjYw

MCI+Cjx0Ym9keT4KPHRyPgo8dGQgY2xhc3M9ImNvbHVtbiBjb2x1bW4tMSIgc3R5bGU9Im1zby10

YWJsZS1sc3BhY2U6IDBwdDsgbXNvLXRhYmxlLXJzcGFjZTogMHB0OyB0ZXh0LWFsaWduOiBsZWZ0

OyBmb250LXdlaWdodDogNDAwOyBwYWRkaW5nLWJvdHRvbTogNXB4OyBwYWRkaW5nLXRvcDogNXB4

OyB2ZXJ0aWNhbC1hbGlnbjogdG9wOyBib3JkZXItdG9wOiAwcHg7IGJvcmRlci1yaWdodDogMHB4

OyBib3JkZXItYm90dG9tOiAwcHg7IGJvcmRlci1sZWZ0OiAwcHg7IiB3aWR0aD0iMTAwJSI+Cjx0

YWJsZSBib3JkZXI9IjAiIGNlbGxwYWRkaW5nPSIwIiBjZWxsc3BhY2luZz0iMCIgY2xhc3M9Imlj

b25zX2Jsb2NrIGJsb2NrLTEiIHJvbGU9InByZXNlbnRhdGlvbiIgc3R5bGU9Im1zby10YWJsZS1s

c3BhY2U6IDBwdDsgbXNvLXRhYmxlLXJzcGFjZTogMHB0OyIgd2lkdGg9IjEwMCUiPgo8dHI+Cjx0

ZCBjbGFzcz0icGFkIiBzdHlsZT0idmVydGljYWwtYWxpZ246IG1pZGRsZTsgY29sb3I6ICM5ZDlk

OWQ7IGZvbnQtZmFtaWx5OiBpbmhlcml0OyBmb250LXNpemU6IDE1cHg7IHBhZGRpbmctYm90dG9t

OiA1cHg7IHBhZGRpbmctdG9wOiA1cHg7IHRleHQtYWxpZ246IGNlbnRlcjsiPgo8dGFibGUgY2Vs

bHBhZGRpbmc9IjAiIGNlbGxzcGFjaW5nPSIwIiByb2xlPSJwcmVzZW50YXRpb24iIHN0eWxlPSJt

c28tdGFibGUtbHNwYWNlOiAwcHQ7IG1zby10YWJsZS1yc3BhY2U6IDBwdDsiIHdpZHRoPSIxMDAl

Ij4KPHRyPgo8dGQgY2xhc3M9ImFsaWdubWVudCIgc3R5bGU9InZlcnRpY2FsLWFsaWduOiBtaWRk

bGU7IHRleHQtYWxpZ246IGNlbnRlcjsiPjwhLS1baWYgdm1sXT48dGFibGUgYWxpZ249ImxlZnQi

IGNlbGxwYWRkaW5nPSIwIiBjZWxsc3BhY2luZz0iMCIgcm9sZT0icHJlc2VudGF0aW9uIiBzdHls

ZT0iZGlzcGxheTppbmxpbmUtYmxvY2s7cGFkZGluZy1sZWZ0OjBweDtwYWRkaW5nLXJpZ2h0OjBw

eDttc28tdGFibGUtbHNwYWNlOiAwcHQ7bXNvLXRhYmxlLXJzcGFjZTogMHB0OyI+PCFbZW5kaWZd

LS0+CjwhLS1baWYgIXZtbF0+PCEtLT4KCjwvdGQ+CjwvdHI+CjwvdGFibGU+CjwvdGQ+CjwvdHI+

CjwvdGFibGU+CjwvdGQ+CjwvdHI+CjwvdGJvZHk+CjwvdGFibGU+CjwvdGQ+CjwvdHI+CjwvdGJv

ZHk+CjwvdGFibGU+CjwvdGQ+CjwvdHI+CjwvdGJvZHk+CjwvdGFibGU+PCEtLSBFbmQgLS0+Cjwv

Ym9keT4KPC9odG1sPg==



Google Drive Phish from Google user Content Part 1

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 08 Jan 2026 14:52:00 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vdxuI-00000000P7Q-3HJR

for dave@doctor.nl2k.ab.ca;

Thu, 08 Jan 2026 14:51:02 -0700

Resent-From: The Doctor

Resent-Date: Thu, 8 Jan 2026 14:51:02 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from 25.75.140.34.bc.googleusercontent.com ([34.140.75.25]:39370 helo=freenet-mobilfunk.de)

by doctor.nl2k.ab.ca with esmtp (Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vduf8-00000000DFS-34ZO

for doctor@nl2k.ab.ca;

Thu, 08 Jan 2026 11:23:19 -0700

Received: by freenet-mobilfunk.de (Postfix, from userid 1000)

id 6D1BF369B35; Thu, 8 Jan 2026 18:22:16 +0000 (UTC)

To: doctor@nl2k.ab.ca

From: "=?UTF-8?B?R29vZ2xlIERyaXZlIFJld2FyZA==?="

Subject: =?UTF-8?B?Q29uZ3JhdHVsYXRpb25zISBZb3VyIEdvb2dsZSBEcml2ZSByZXdhcmQgc2VudCE=?=

MIME-Version: 1.0

Content-Type: text/html; charset="UTF-8"

Content-Transfer-Encoding: base64

List-Unsubscribe-Post: List-Unsubscribe=One-Click

Message-Id: <20260108182216.6D1BF369B35@freenet-mobilfunk.de>

Date: Thu, 8 Jan 2026 18:22:16 +0000 (UTC)

X-Spam_score: 12.6

X-Spam_score_int: 126

X-Spam_bar: ++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: You have reached your storage limit Dear customer,



Content analysis details: (12.6 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[34.140.75.25 listed in dnsbl.ahbl.org]

[34.140.75.25 listed in dnsbl.ahbl.org]

[34.140.75.25 listed in dnsbl.ahbl.org]

[34.140.75.25 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[34.140.75.25 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[34.140.75.25 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[34.140.75.25 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[34.140.75.25 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[34.140.75.25 listed in will-spam-for-food.eu.org]

[34.140.75.25 listed in will-spam-for-food.eu.org]

[34.140.75.25 listed in will-spam-for-food.eu.org]

[34.140.75.25 listed in will-spam-for-food.eu.org]

[34.140.75.25 listed in will-spam-for-food.eu.org]

[34.140.75.25 listed in will-spam-for-food.eu.org]

[34.140.75.25 listed in will-spam-for-food.eu.org]

[34.140.75.25 listed in will-spam-for-food.eu.org]

1.0 SPF_SOFTFAIL SPF: sender does not match SPF record (softfail)

0.9 SPF_HELO_SOFTFAIL SPF: HELO does not match SPF record (softfail)

0.0 TVD_RCVD_IP Message was received from an IP address

0.0 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level mail

domains are different

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 HTML_MESSAGE BODY: HTML included in message

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.8 SARE_FROM_SPAM_WORD3 I don't know people named this!

0.0 SARE_FROM_SPAM_WORD4 From address suggests this may be spam

0.4 RDNS_DYNAMIC Delivered to internal network by host with

dynamic-looking rDNS

0.1 FROM_EXCESS_BASE64 From: base64 encoded unnecessarily

0.4 KHOP_HELO_FCRDNS Relay HELO differs from its IP's reverse DNS

3.0 GOOG_STO_NOIMG_HTML Apparently using google content hosting to avoid

URIBL

Subject: {SPAM?} =?UTF-8?B?Q29uZ3JhdHVsYXRpb25zISBZb3VyIEdvb2dsZSBEcml2ZSByZXdhcmQgc2VudCE=?=



PCFET0NUWVBFIGh0bWw+Cgo8aHRtbCBsYW5nPSJlbiIgeG1sbnM6bz0idXJuOnNjaGVtYXMtbWlj

cm9zb2Z0LWNvbTpvZmZpY2U6b2ZmaWNlIiB4bWxuczp2PSJ1cm46c2NoZW1hcy1taWNyb3NvZnQt

Y29tOnZtbCI+CjxoZWFkPgo8dGl0bGU+PC90aXRsZT4KPG1ldGEgY29udGVudD0idGV4dC9odG1s

OyBjaGFyc2V0PXV0Zi04IiBodHRwLWVxdWl2PSJDb250ZW50LVR5cGUiLz4KPG1ldGEgY29udGVu

dD0id2lkdGg9ZGV2aWNlLXdpZHRoLCBpbml0aWFsLXNjYWxlPTEuMCIgbmFtZT0idmlld3BvcnQi

Lz48IS0tW2lmIG1zb10+PHhtbD48bzpPZmZpY2VEb2N1bWVudFNldHRpbmdzPjxvOlBpeGVsc1Bl

ckluY2g+OTY8L286UGl4ZWxzUGVySW5jaD48bzpBbGxvd1BORy8+PC9vOk9mZmljZURvY3VtZW50

U2V0dGluZ3M+PC94bWw+PCFbZW5kaWZdLS0+PCEtLVtpZiAhbXNvXT48IS0tPgo8bGluayBocmVm

PSJodHRwczovL2ZvbnRzLmdvb2dsZWFwaXMuY29tL2NzczI/ZmFtaWx5PVNvdXJjZStTYW5zK1By

bzp3Z2h0QDEwMDsyMDA7MzAwOzQwMDs1MDA7NjAwOzcwMDs4MDA7OTAwIiByZWw9InN0eWxlc2hl

ZXQiIHR5cGU9InRleHQvY3NzIi8+PCEtLTwhW2VuZGlmXS0tPgo8c3R5bGU+CgkJKiB7CgkJCWJv

eC1zaXppbmc6IGJvcmRlci1ib3g7CgkJfQoKCQlib2R5IHsKCQkJbWFyZ2luOiAwOwoJCQlwYWRk

aW5nOiAwOwoJCX0KCgkJYVt4LWFwcGxlLWRhdGEtZGV0ZWN0b3JzXSB7CgkJCWNvbG9yOiBpbmhl

cml0ICFpbXBvcnRhbnQ7CgkJCXRleHQtZGVjb3JhdGlvbjogaW5oZXJpdCAhaW1wb3J0YW50OwoJ

CX0KCgkJI01lc3NhZ2VWaWV3Qm9keSBhIHsKCQkJY29sb3I6IGluaGVyaXQ7CgkJCXRleHQtZGVj

b3JhdGlvbjogbm9uZTsKCQl9CgoJCXAgewoJCQlsaW5lLWhlaWdodDogaW5oZXJpdAoJCX0KCgkJ

LmRlc2t0b3BfaGlkZSwKCQkuZGVza3RvcF9oaWRlIHRhYmxlIHsKCQkJbXNvLWhpZGU6IGFsbDsK

CQkJZGlzcGxheTogbm9uZTsKCQkJbWF4LWhlaWdodDogMHB4OwoJCQlvdmVyZmxvdzogaGlkZGVu

OwoJCX0KCgkJLmltYWdlX2Jsb2NrIGltZytkaXYgewoJCQlkaXNwbGF5OiBub25lOwoJCX0KCgkJ

QG1lZGlhIChtYXgtd2lkdGg6NjIwcHgpIHsKCQkJLmRlc2t0b3BfaGlkZSB0YWJsZS5pY29ucy1p

bm5lciB7CgkJCQlkaXNwbGF5OiBpbmxpbmUtYmxvY2sgIWltcG9ydGFudDsKCQkJfQoKCQkJLmlj

b25zLWlubmVyIHsKCQkJCXRleHQtYWxpZ246IGNlbnRlcjsKCQkJfQoKCQkJLmljb25zLWlubmVy

IHRkIHsKCQkJCW1hcmdpbjogMCBhdXRvOwoJCQl9CgoJCQkuaW1hZ2VfYmxvY2sgaW1nLmZ1bGxX

aWR0aCB7CgkJCQltYXgtd2lkdGg6IDEwMCUgIWltcG9ydGFudDsKCQkJfQoKCQkJLnJvdy1jb250

ZW50IHsKCQkJCXdpZHRoOiAxMDAlICFpbXBvcnRhbnQ7CgkJCX0KCgkJCS5zdGFjayAuY29sdW1u

IHsKCQkJCXdpZHRoOiAxMDAlOwoJCQkJZGlzcGxheTogYmxvY2s7CgkJCX0KCgkJCS5tb2JpbGVf

aGlkZSB7CgkJCQltYXgtd2lkdGg6IDA7CgkJCQltaW4taGVpZ2h0OiAwOwoJCQkJbWF4LWhlaWdo

dDogMDsKCQkJCWZvbnQtc2l6ZTogMDsKCQkJCWRpc3BsYXk6IG5vbmU7CgkJCQlvdmVyZmxvdzog

aGlkZGVuOwoJCQl9CgoJCQkuZGVza3RvcF9oaWRlLAoJCQkuZGVza3RvcF9oaWRlIHRhYmxlIHsK

CQkJCW1heC1oZWlnaHQ6IG5vbmUgIWltcG9ydGFudDsKCQkJCWRpc3BsYXk6IHRhYmxlICFpbXBv

cnRhbnQ7CgkJCX0KCQl9Cgk8L3N0eWxlPgo8L2hlYWQ+Cjxib2R5IHN0eWxlPSJ0ZXh0LXNpemUt

YWRqdXN0OiBub25lOyBiYWNrZ3JvdW5kLWNvbG9yOiAjZmZmOyBtYXJnaW46IDA7IHBhZGRpbmc6

IDA7Ij4KPHRhYmxlIGJvcmRlcj0iMCIgY2VsbHBhZGRpbmc9IjAiIGNlbGxzcGFjaW5nPSIwIiBj

bGFzcz0ibmwtY29udGFpbmVyIiByb2xlPSJwcmVzZW50YXRpb24iIHN0eWxlPSJtc28tdGFibGUt

bHNwYWNlOiAwcHQ7IG1zby10YWJsZS1yc3BhY2U6IDBwdDsgYmFja2dyb3VuZC1jb2xvcjogI2Zm

ZjsiIHdpZHRoPSIxMDAlIj4KPHRib2R5Pgo8dHI+Cjx0ZD4KPHRhYmxlIGFsaWduPSJjZW50ZXIi

IGJvcmRlcj0iMCIgY2VsbHBhZGRpbmc9IjAiIGNlbGxzcGFjaW5nPSIwIiBjbGFzcz0icm93IHJv

dy0xIiByb2xlPSJwcmVzZW50YXRpb24iIHN0eWxlPSJtc28tdGFibGUtbHNwYWNlOiAwcHQ7IG1z

by10YWJsZS1yc3BhY2U6IDBwdDsiIHdpZHRoPSIxMDAlIj4KPHRib2R5Pgo8dHI+Cjx0ZD4KPHRh

Google Drive Phish from Google user Content Part 2



YmxlIGFsaWduPSJjZW50ZXIiIGJvcmRlcj0iMCIgY2VsbHBhZGRpbmc9IjAiIGNlbGxzcGFjaW5n

PSIwIiBjbGFzcz0icm93LWNvbnRlbnQgc3RhY2siIHJvbGU9InByZXNlbnRhdGlvbiIgc3R5bGU9

Im1zby10YWJsZS1sc3BhY2U6IDBwdDsgbXNvLXRhYmxlLXJzcGFjZTogMHB0OyBjb2xvcjogIzAw

MDsgd2lkdGg6IDYwMHB4OyBtYXJnaW46IDAgYXV0bzsiIHdpZHRoPSI2MDAiPgo8dGJvZHk+Cjx0

cj4KPHRkIGNsYXNzPSJjb2x1bW4gY29sdW1uLTEiIHN0eWxlPSJtc28tdGFibGUtbHNwYWNlOiAw

cHQ7IG1zby10YWJsZS1yc3BhY2U6IDBwdDsgdGV4dC1hbGlnbjogbGVmdDsgZm9udC13ZWlnaHQ6

IDQwMDsgcGFkZGluZy1ib3R0b206IDVweDsgcGFkZGluZy10b3A6IDVweDsgdmVydGljYWwtYWxp

Z246IHRvcDsgYm9yZGVyLXRvcDogMHB4OyBib3JkZXItcmlnaHQ6IDBweDsgYm9yZGVyLWJvdHRv

bTogMHB4OyBib3JkZXItbGVmdDogMHB4OyIgd2lkdGg9IjEwMCUiPgo8dGFibGUgYm9yZGVyPSIw

IiBjZWxscGFkZGluZz0iMCIgY2VsbHNwYWNpbmc9IjAiIGNsYXNzPSJpbWFnZV9ibG9jayBibG9j

ay0xIiByb2xlPSJwcmVzZW50YXRpb24iIHN0eWxlPSJtc28tdGFibGUtbHNwYWNlOiAwcHQ7IG1z

by10YWJsZS1yc3BhY2U6IDBwdDsiIHdpZHRoPSIxMDAlIj4KPHRyPgo8dGQgY2xhc3M9InBhZCIg

c3R5bGU9IndpZHRoOjEwMCU7cGFkZGluZy1yaWdodDowcHg7cGFkZGluZy1sZWZ0OjBweDsiPgo8

ZGl2IGFsaWduPSJjZW50ZXIiIGNsYXNzPSJhbGlnbm1lbnQiIHN0eWxlPSJsaW5lLWhlaWdodDox

MHB4Ij48aW1nIHNyYz0iaHR0cHM6Ly9pLmd5YXpvLmNvbS9jYjQ1M2JhOTJiZmVjOTliZjJmYWQ3

NmM5YTc4NjRjNy5wbmciIHN0eWxlPSJoZWlnaHQ6IGF1dG87IGRpc3BsYXk6IGJsb2NrOyBib3Jk

ZXI6IDA7IG1heC13aWR0aDogMTUwcHg7IHdpZHRoOiAxMDAlOyIgd2lkdGg9IjE1MCIvPjwvZGl2

Pgo8L3RkPgo8L3RyPgo8L3RhYmxlPgo8dGFibGUgYm9yZGVyPSIwIiBjZWxscGFkZGluZz0iMCIg

Y2VsbHNwYWNpbmc9IjAiIGNsYXNzPSJpbWFnZV9ibG9jayBibG9jay0yIiByb2xlPSJwcmVzZW50

YXRpb24iIHN0eWxlPSJtc28tdGFibGUtbHNwYWNlOiAwcHQ7IG1zby10YWJsZS1yc3BhY2U6IDBw

dDsiIHdpZHRoPSIxMDAlIj4KPHRyPgo8dGQgY2xhc3M9InBhZCIgc3R5bGU9IndpZHRoOjEwMCU7

cGFkZGluZy1yaWdodDowcHg7cGFkZGluZy1sZWZ0OjBweDsiPgo8ZGl2IGFsaWduPSJjZW50ZXIi

IGNsYXNzPSJhbGlnbm1lbnQiIHN0eWxlPSJsaW5lLWhlaWdodDoxMHB4Ij48aW1nIHNyYz0iaHR0

cHM6Ly9pLmd5YXpvLmNvbS9kZTg3YjliN2JkYTlmZDI4NTc3N2VmN2MzNzYwODNjZi5wbmciIHN0

eWxlPSJoZWlnaHQ6IGF1dG87IGRpc3BsYXk6IGJsb2NrOyBib3JkZXI6IDA7IG1heC13aWR0aDog

MjEwcHg7IHdpZHRoOiAxMDAlOyIgd2lkdGg9IjIxMCIvPjwvZGl2Pgo8L3RkPgo8L3RyPgo8L3Rh

YmxlPgo8dGFibGUgYm9yZGVyPSIwIiBjZWxscGFkZGluZz0iMTAiIGNlbGxzcGFjaW5nPSIwIiBj

bGFzcz0iaGVhZGluZ19ibG9jayBibG9jay0zIiByb2xlPSJwcmVzZW50YXRpb24iIHN0eWxlPSJt

c28tdGFibGUtbHNwYWNlOiAwcHQ7IG1zby10YWJsZS1yc3BhY2U6IDBwdDsiIHdpZHRoPSIxMDAl

Ij4KPHRyPgo8dGQgY2xhc3M9InBhZCI+CjxoMSBzdHlsZT0ibWFyZ2luOiAwOyBjb2xvcjogIzBj

MGIwYzsgZGlyZWN0aW9uOiBsdHI7IGZvbnQtZmFtaWx5OiAnU291cmNlIFNhbnMgUHJvJywgVGFo

b21hLCBWZXJkYW5hLCBTZWdvZSwgc2Fucy1zZXJpZjsgZm9udC1zaXplOiAzMHB4OyBmb250LXdl

aWdodDogNjAwOyBsZXR0ZXItc3BhY2luZzogbm9ybWFsOyBsaW5lLWhlaWdodDogMTIwJTsgdGV4

dC1hbGlnbjogY2VudGVyOyBtYXJnaW4tdG9wOiAwOyBtYXJnaW4tYm90dG9tOiAwOyI+PHNwYW4g

Y2xhc3M9InRpbnlNY2UtcGxhY2Vob2xkZXIiPllvdSBoYXZlIHJlYWNoZWQgeW91ciBzdG9yYWdl

IGxpbWl0PC9zcGFuPjwvaDE+CjwvdGQ+CjwvdHI+CjwvdGFibGU+Cjx0YWJsZSBib3JkZXI9IjAi

IGNlbGxwYWRkaW5nPSIwIiBjZWxsc3BhY2luZz0iMCIgY2xhc3M9ImltYWdlX2Jsb2NrIGJsb2Nr

LTQiIHJvbGU9InByZXNlbnRhdGlvbiIgc3R5bGU9Im1zby10YWJsZS1sc3BhY2U6IDBwdDsgbXNv

LXRhYmxlLXJzcGFjZTogMHB0OyIgd2lkdGg9IjEwMCUiPgo8dHI+Cjx0ZCBjbGFzcz0icGFkIiBz

dHlsZT0id2lkdGg6MTAwJTtwYWRkaW5nLXJpZ2h0OjBweDtwYWRkaW5nLWxlZnQ6MHB4OyI+Cjxk

aXYgYWxpZ249ImNlbnRlciIgY2xhc3M9ImFsaWdubWVudCIgc3R5bGU9ImxpbmUtaGVpZ2h0OjEw

cHgiPjxpbWcgY2xhc3M9ImZ1bGxXaWR0aCIgc3JjPSJodHRwczovL2kuZ3lhem8uY29tL2MyMDc1

MDA5Nzg4YWVjZDZlZTBiNmE4OTdjZTkwZjhhLnBuZyIgc3R5bGU9ImhlaWdodDogYXV0bzsgZGlz

cGxheTogYmxvY2s7IGJvcmRlcjogMDsgbWF4LXdpZHRoOiA0MjBweDsgd2lkdGg6IDEwMCU7IiB3

aWR0aD0iNDIwIi8+PC9kaXY+CjwvdGQ+CjwvdHI+CjwvdGFibGU+Cjx0YWJsZSBib3JkZXI9IjAi

IGNlbGxwYWRkaW5nPSI1MCIgY2VsbHNwYWNpbmc9IjAiIGNsYXNzPSJwYXJhZ3JhcGhfYmxvY2sg

YmxvY2stNSIgcm9sZT0icHJlc2VudGF0aW9uIiBzdHlsZT0ibXNvLXRhYmxlLWxzcGFjZTogMHB0

OyBtc28tdGFibGUtcnNwYWNlOiAwcHQ7IHdvcmQtYnJlYWs6IGJyZWFrLXdvcmQ7IiB3aWR0aD0i

MTAwJSI+Cjx0cj4KPHRkIGNsYXNzPSJwYWQiPgo8ZGl2IHN0eWxlPSJjb2xvcjojMTAxMTEyO2Rp

cmVjdGlvbjpsdHI7Zm9udC1mYW1pbHk6J1NvdXJjZSBTYW5zIFBybycsIFRhaG9tYSwgVmVyZGFu

YSwgU2Vnb2UsIHNhbnMtc2VyaWY7Zm9udC1zaXplOjE4cHg7Zm9udC13ZWlnaHQ6NDAwO2xldHRl

ci1zcGFjaW5nOjBweDtsaW5lLWhlaWdodDoxMjAlO3RleHQtYWxpZ246bGVmdDttc28tbGluZS1o

ZWlnaHQtYWx0OjIxLjU5OTk5OTk5OTk5OTk5OHB4OyI+CjxwIHN0eWxlPSJtYXJnaW46IDA7IG1h

cmdpbi1ib3R0b206IDE2cHg7Ij5EZWFyIGN1c3RvbWVyLDwvcD4KPHAgc3R5bGU9Im1hcmdpbjog

MDsgbWFyZ2luLWJvdHRvbTogMTZweDsiPjxzdHJvbmc+WW91ciBHb29nbGUgRHJpdmUgaXMgZnVs

bC48L3N0cm9uZz48L3A+CjxwIHN0eWxlPSJtYXJnaW46IDA7Ij5Zb3UgY2FuIG5vdyByZWNlaXZl

IGFuIGFkZGl0aW9uYWwgNTAgR0IgZm9yIGp1c3QgJDQuMDAsIGVsc2UgeW91IGNhbiBubyBsb25n

ZXIgYmFja3VwIHlvdXIgaW1hZ2VzIGFuZCBmaWxlcy48L3A+CjwvZGl2Pgo8L3RkPgo8L3RyPgo8

L3RhYmxlPgo8dGFibGUgYm9yZGVyPSIwIiBjZWxscGFkZGluZz0iMTAiIGNlbGxzcGFjaW5nPSIw

IiBjbGFzcz0iYnV0dG9uX2Jsb2NrIGJsb2NrLTYiIHJvbGU9InByZXNlbnRhdGlvbiIgc3R5bGU9

Im1zby10YWJsZS1sc3BhY2U6IDBwdDsgbXNvLXRhYmxlLXJzcGFjZTogMHB0OyIgd2lkdGg9IjEw

MCUiPgo8dHI+Cjx0ZCBjbGFzcz0icGFkIj4KPGRpdiBhbGlnbj0iY2VudGVyIiBjbGFzcz0iYWxp

Z25tZW50Ij48IS0tW2lmIG1zb10+PHY6cm91bmRyZWN0IHhtbG5zOnY9InVybjpzY2hlbWFzLW1p

Y3Jvc29mdC1jb206dm1sIiB4bWxuczp3PSJ1cm46c2NoZW1hcy1taWNyb3NvZnQtY29tOm9mZmlj

ZTp3b3JkIiBocmVmPSJodHRwczovL3N0b3JhZ2UuZ29vZ2xlYXBpcy5jb20vZWNmdnl6ZWZ6ZXl1

ZmN1eXpmdXplY3Z6dXpldmN1emZldWNmdXplY2cvZ29vY2hrdGdsaXNibWl0bHNva29sejdkaTU0

ZHNjeGttN2diZi5odG1sIiBzdHlsZT0iaGVpZ2h0OjQycHg7d2lkdGg6MTM0cHg7di10ZXh0LWFu

Y2hvcjptaWRkbGU7IiBhcmNzaXplPSI2MCUiIHN0cm9rZT0iZmFsc2UiIGZpbGxjb2xvcj0iIzAw

OWFmZiI+PHc6YW5jaG9ybG9jay8+PHY6dGV4dGJveCBpbnNldD0iMHB4LDBweCwwcHgsMHB4Ij48

Y2VudGVyIHN0eWxlPSJjb2xvcjojZmZmZmZmOyBmb250LWZhbWlseTpUYWhvbWEsIFZlcmRhbmEs

IHNhbnMtc2VyaWY7IGZvbnQtc2l6ZToxNnB4Ij48IVtlbmRpZl0tLT48YSBocmVmPSJodHRwczov

L3N0b3JhZ2UuZ29vZ2xlYXBpcy5jb20vZWNmdnl6ZWZ6ZXl1ZmN1eXpmdXplY3Z6dXpldmN1emZl

dWNmdXplY2cvZ29vY2hrdGdsaXNibWl0bHNva29sejdkaTU0ZHNjeGttN2diZi5odG1sIiBzdHls

ZT0idGV4dC1kZWNvcmF0aW9uOm5vbmU7ZGlzcGxheTppbmxpbmUtYmxvY2s7Y29sb3I6I2ZmZmZm

ZjtiYWNrZ3JvdW5kLWNvbG9yOiMwMDlhZmY7Ym9yZGVyLXJhZGl1czoyNXB4O3dpZHRoOmF1dG87

Ym9yZGVyLXRvcDowcHggc29saWQgdHJhbnNwYXJlbnQ7Zm9udC13ZWlnaHQ6NDAwO2JvcmRlci1y

aWdodDowcHggc29saWQgdHJhbnNwYXJlbnQ7Ym9yZGVyLWJvdHRvbTowcHggc29saWQgdHJhbnNw

YXJlbnQ7Ym9yZGVyLWxlZnQ6MHB4IHNvbGlkIHRyYW5zcGFyZW50O3BhZGRpbmctdG9wOjVweDtw

YWRkaW5nLWJvdHRvbTo1cHg7Zm9udC1mYW1pbHk6J1NvdXJjZSBTYW5zIFBybycsIFRhaG9tYSwg

VmVyZGFuYSwgU2Vnb2UsIHNhbnMtc2VyaWY7Zm9udC1zaXplOjE2cHg7dGV4dC1hbGlnbjpjZW50

ZXI7bXNvLWJvcmRlci1hbHQ6bm9uZTt3b3JkLWJyZWFrOmtlZXAtYWxsOyIgdGFyZ2V0PSJfYmxh

bmsiPjxzcGFuIHN0eWxlPSJwYWRkaW5nLWxlZnQ6MjBweDtwYWRkaW5nLXJpZ2h0OjIwcHg7Zm9u

dC1zaXplOjE2cHg7ZGlzcGxheTppbmxpbmUtYmxvY2s7bGV0dGVyLXNwYWNpbmc6bm9ybWFsOyI+

PHNwYW4gc3R5bGU9IndvcmQtYnJlYWs6IGJyZWFrLXdvcmQ7IGxpbmUtaGVpZ2h0OiAzMnB4OyI+

cmVjZWl2ZSA1MCBHQjwvc3Bhbj48L3NwYW4+PC9hPjwhLS1baWYgbXNvXT48L2NlbnRlcj48L3Y6

dGV4dGJveD48L3Y6cm91bmRyZWN0PjwhW2VuZGlmXS0tPjwvZGl2Pgo8L3RkPgo8L3RyPgo8L3Rh

YmxlPgo8dGFibGUgYm9yZGVyPSIwIiBjZWxscGFkZGluZz0iMTUiIGNlbGxzcGFjaW5nPSIwIiBj

bGFzcz0iaW1hZ2VfYmxvY2sgYmxvY2stNyIgcm9sZT0icHJlc2VudGF0aW9uIiBzdHlsZT0ibXNv

LXRhYmxlLWxzcGFjZTogMHB0OyBtc28tdGFibGUtcnNwYWNlOiAwcHQ7IiB3aWR0aD0iMTAwJSI+

Cjx0cj4KPHRkIGNsYXNzPSJwYWQiPgo8ZGl2IGFsaWduPSJjZW50ZXIiIGNsYXNzPSJhbGlnbm1l

bnQiIHN0eWxlPSJsaW5lLWhlaWdodDoxMHB4Ij48aW1nIHNyYz0iaHR0cHM6Ly9pLmd5YXpvLmNv

bS85Nzc4MDBlYTAxYTI1YTM1ZWNlNTliOTNlZmZjYjFmMi5wbmciIHN0eWxlPSJoZWlnaHQ6IGF1

dG87IGRpc3BsYXk6IGJsb2NrOyBib3JkZXI6IDA7IG1heC13aWR0aDogMTIwcHg7IHdpZHRoOiAx

MDAlOyIgd2lkdGg9IjEyMCIvPjwvZGl2Pgo8L3RkPgo8L3RyPgo8L3RhYmxlPgo8L3RkPgo8L3Ry

Pgo8L3Rib2R5Pgo8L3RhYmxlPgo8L3RkPgo8L3RyPgo8L3Rib2R5Pgo8L3RhYmxlPgo8dGFibGUg

YWxpZ249ImNlbnRlciIgYm9yZGVyPSIwIiBjZWxscGFkZGluZz0iMCIgY2VsbHNwYWNpbmc9IjAi

IGNsYXNzPSJyb3cgcm93LTIiIHJvbGU9InByZXNlbnRhdGlvbiIgc3R5bGU9Im1zby10YWJsZS1s

c3BhY2U6IDBwdDsgbXNvLXRhYmxlLXJzcGFjZTogMHB0OyIgd2lkdGg9IjEwMCUiPgo8dGJvZHk+

Cjx0cj4KPHRkPgo8dGFibGUgYWxpZ249ImNlbnRlciIgYm9yZGVyPSIwIiBjZWxscGFkZGluZz0i

MCIgY2VsbHNwYWNpbmc9IjAiIGNsYXNzPSJyb3ctY29udGVudCBzdGFjayIgcm9sZT0icHJlc2Vu

dGF0aW9uIiBzdHlsZT0ibXNvLXRhYmxlLWxzcGFjZTogMHB0OyBtc28tdGFibGUtcnNwYWNlOiAw

cHQ7IGNvbG9yOiAjMDAwOyB3aWR0aDogNjAwcHg7IG1hcmdpbjogMCBhdXRvOyIgd2lkdGg9IjYw

MCI+Cjx0Ym9keT4KPHRyPgo8dGQgY2xhc3M9ImNvbHVtbiBjb2x1bW4tMSIgc3R5bGU9Im1zby10

YWJsZS1sc3BhY2U6IDBwdDsgbXNvLXRhYmxlLXJzcGFjZTogMHB0OyB0ZXh0LWFsaWduOiBsZWZ0

OyBmb250LXdlaWdodDogNDAwOyBwYWRkaW5nLWJvdHRvbTogNXB4OyBwYWRkaW5nLXRvcDogNXB4

OyB2ZXJ0aWNhbC1hbGlnbjogdG9wOyBib3JkZXItdG9wOiAwcHg7IGJvcmRlci1yaWdodDogMHB4

OyBib3JkZXItYm90dG9tOiAwcHg7IGJvcmRlci1sZWZ0OiAwcHg7IiB3aWR0aD0iMTAwJSI+Cjx0

YWJsZSBib3JkZXI9IjAiIGNlbGxwYWRkaW5nPSIwIiBjZWxsc3BhY2luZz0iMCIgY2xhc3M9Imlj

b25zX2Jsb2NrIGJsb2NrLTEiIHJvbGU9InByZXNlbnRhdGlvbiIgc3R5bGU9Im1zby10YWJsZS1s

c3BhY2U6IDBwdDsgbXNvLXRhYmxlLXJzcGFjZTogMHB0OyIgd2lkdGg9IjEwMCUiPgo8dHI+Cjx0

ZCBjbGFzcz0icGFkIiBzdHlsZT0idmVydGljYWwtYWxpZ246IG1pZGRsZTsgY29sb3I6ICM5ZDlk

OWQ7IGZvbnQtZmFtaWx5OiBpbmhlcml0OyBmb250LXNpemU6IDE1cHg7IHBhZGRpbmctYm90dG9t

OiA1cHg7IHBhZGRpbmctdG9wOiA1cHg7IHRleHQtYWxpZ246IGNlbnRlcjsiPgo8dGFibGUgY2Vs

bHBhZGRpbmc9IjAiIGNlbGxzcGFjaW5nPSIwIiByb2xlPSJwcmVzZW50YXRpb24iIHN0eWxlPSJt

c28tdGFibGUtbHNwYWNlOiAwcHQ7IG1zby10YWJsZS1yc3BhY2U6IDBwdDsiIHdpZHRoPSIxMDAl

Ij4KPHRyPgo8dGQgY2xhc3M9ImFsaWdubWVudCIgc3R5bGU9InZlcnRpY2FsLWFsaWduOiBtaWRk

bGU7IHRleHQtYWxpZ246IGNlbnRlcjsiPjwhLS1baWYgdm1sXT48dGFibGUgYWxpZ249ImxlZnQi

IGNlbGxwYWRkaW5nPSIwIiBjZWxsc3BhY2luZz0iMCIgcm9sZT0icHJlc2VudGF0aW9uIiBzdHls

ZT0iZGlzcGxheTppbmxpbmUtYmxvY2s7cGFkZGluZy1sZWZ0OjBweDtwYWRkaW5nLXJpZ2h0OjBw

eDttc28tdGFibGUtbHNwYWNlOiAwcHQ7bXNvLXRhYmxlLXJzcGFjZTogMHB0OyI+PCFbZW5kaWZd

LS0+CjwhLS1baWYgIXZtbF0+PCEtLT4KCjwvdGQ+CjwvdHI+CjwvdGFibGU+CjwvdGQ+CjwvdHI+

CjwvdGFibGU+CjwvdGQ+CjwvdHI+CjwvdGJvZHk+CjwvdGFibGU+CjwvdGQ+CjwvdHI+CjwvdGJv

ZHk+CjwvdGFibGU+CjwvdGQ+CjwvdHI+CjwvdGJvZHk+CjwvdGFibGU+PCEtLSBFbmQgLS0+Cjwv

Ym9keT4KPC9odG1sPg==

Google Drive Phish from Google user Content Part 1

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 08 Jan 2026 14:51:00 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vdxuF-00000000P6G-17Bt

for dave@doctor.nl2k.ab.ca;

Thu, 08 Jan 2026 14:50:59 -0700

Resent-From: The Doctor

Resent-Date: Thu, 8 Jan 2026 14:50:59 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from 25.75.140.34.bc.googleusercontent.com ([34.140.75.25]:39362 helo=freenet-mobilfunk.de)

by doctor.nl2k.ab.ca with esmtp (Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vduf8-00000000DFQ-34i6

for root@doctor.nl2k.ab.ca;

Thu, 08 Jan 2026 11:23:16 -0700

Received: by freenet-mobilfunk.de (Postfix, from userid 1000)

id 7BAB8369B34; Thu, 8 Jan 2026 18:22:15 +0000 (UTC)

To: root@doctor.nl2k.ab.ca

From: "=?UTF-8?B?R29vZ2xlIERyaXZlIFJld2FyZA==?="

Subject: =?UTF-8?B?Q29uZ3JhdHVsYXRpb25zISBZb3VyIEdvb2dsZSBEcml2ZSByZXdhcmQgc2VudCE=?=

MIME-Version: 1.0

Content-Type: text/html; charset="UTF-8"

Content-Transfer-Encoding: base64

List-Unsubscribe-Post: List-Unsubscribe=One-Click

Message-Id: <20260108182215.7BAB8369B34@freenet-mobilfunk.de>

Date: Thu, 8 Jan 2026 18:22:15 +0000 (UTC)

X-Spam_score: 12.6

X-Spam_score_int: 126

X-Spam_bar: ++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: You have reached your storage limit Dear customer,



Content analysis details: (12.6 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[34.140.75.25 listed in dnsbl.ahbl.org]

[34.140.75.25 listed in dnsbl.ahbl.org]

[34.140.75.25 listed in dnsbl.ahbl.org]

[34.140.75.25 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[34.140.75.25 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[34.140.75.25 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[34.140.75.25 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[34.140.75.25 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[34.140.75.25 listed in will-spam-for-food.eu.org]

[34.140.75.25 listed in will-spam-for-food.eu.org]

[34.140.75.25 listed in will-spam-for-food.eu.org]

[34.140.75.25 listed in will-spam-for-food.eu.org]

[34.140.75.25 listed in will-spam-for-food.eu.org]

[34.140.75.25 listed in will-spam-for-food.eu.org]

[34.140.75.25 listed in will-spam-for-food.eu.org]

[34.140.75.25 listed in will-spam-for-food.eu.org]

1.0 SPF_SOFTFAIL SPF: sender does not match SPF record (softfail)

0.9 SPF_HELO_SOFTFAIL SPF: HELO does not match SPF record (softfail)

0.0 TVD_RCVD_IP Message was received from an IP address

0.0 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level mail

domains are different

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 HTML_MESSAGE BODY: HTML included in message

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.8 SARE_FROM_SPAM_WORD3 I don't know people named this!

0.0 SARE_FROM_SPAM_WORD4 From address suggests this may be spam

0.4 RDNS_DYNAMIC Delivered to internal network by host with

dynamic-looking rDNS

0.1 FROM_EXCESS_BASE64 From: base64 encoded unnecessarily

3.0 GOOG_STO_NOIMG_HTML Apparently using google content hosting to avoid

URIBL

0.4 KHOP_HELO_FCRDNS Relay HELO differs from its IP's reverse DNS

Subject: {SPAM?} =?UTF-8?B?Q29uZ3JhdHVsYXRpb25zISBZb3VyIEdvb2dsZSBEcml2ZSByZXdhcmQgc2VudCE=?=



PCFET0NUWVBFIGh0bWw+Cgo8aHRtbCBsYW5nPSJlbiIgeG1sbnM6bz0idXJuOnNjaGVtYXMtbWlj

cm9zb2Z0LWNvbTpvZmZpY2U6b2ZmaWNlIiB4bWxuczp2PSJ1cm46c2NoZW1hcy1taWNyb3NvZnQt

Y29tOnZtbCI+CjxoZWFkPgo8dGl0bGU+PC90aXRsZT4KPG1ldGEgY29udGVudD0idGV4dC9odG1s

OyBjaGFyc2V0PXV0Zi04IiBodHRwLWVxdWl2PSJDb250ZW50LVR5cGUiLz4KPG1ldGEgY29udGVu

dD0id2lkdGg9ZGV2aWNlLXdpZHRoLCBpbml0aWFsLXNjYWxlPTEuMCIgbmFtZT0idmlld3BvcnQi

Lz48IS0tW2lmIG1zb10+PHhtbD48bzpPZmZpY2VEb2N1bWVudFNldHRpbmdzPjxvOlBpeGVsc1Bl

ckluY2g+OTY8L286UGl4ZWxzUGVySW5jaD48bzpBbGxvd1BORy8+PC9vOk9mZmljZURvY3VtZW50

U2V0dGluZ3M+PC94bWw+PCFbZW5kaWZdLS0+PCEtLVtpZiAhbXNvXT48IS0tPgo8bGluayBocmVm

PSJodHRwczovL2ZvbnRzLmdvb2dsZWFwaXMuY29tL2NzczI/ZmFtaWx5PVNvdXJjZStTYW5zK1By

bzp3Z2h0QDEwMDsyMDA7MzAwOzQwMDs1MDA7NjAwOzcwMDs4MDA7OTAwIiByZWw9InN0eWxlc2hl

ZXQiIHR5cGU9InRleHQvY3NzIi8+PCEtLTwhW2VuZGlmXS0tPgo8c3R5bGU+CgkJKiB7CgkJCWJv

eC1zaXppbmc6IGJvcmRlci1ib3g7CgkJfQoKCQlib2R5IHsKCQkJbWFyZ2luOiAwOwoJCQlwYWRk

aW5nOiAwOwoJCX0KCgkJYVt4LWFwcGxlLWRhdGEtZGV0ZWN0b3JzXSB7CgkJCWNvbG9yOiBpbmhl

cml0ICFpbXBvcnRhbnQ7CgkJCXRleHQtZGVjb3JhdGlvbjogaW5oZXJpdCAhaW1wb3J0YW50OwoJ

CX0KCgkJI01lc3NhZ2VWaWV3Qm9keSBhIHsKCQkJY29sb3I6IGluaGVyaXQ7CgkJCXRleHQtZGVj

b3JhdGlvbjogbm9uZTsKCQl9CgoJCXAgewoJCQlsaW5lLWhlaWdodDogaW5oZXJpdAoJCX0KCgkJ

LmRlc2t0b3BfaGlkZSwKCQkuZGVza3RvcF9oaWRlIHRhYmxlIHsKCQkJbXNvLWhpZGU6IGFsbDsK

CQkJZGlzcGxheTogbm9uZTsKCQkJbWF4LWhlaWdodDogMHB4OwoJCQlvdmVyZmxvdzogaGlkZGVu

OwoJCX0KCgkJLmltYWdlX2Jsb2NrIGltZytkaXYgewoJCQlkaXNwbGF5OiBub25lOwoJCX0KCgkJ

QG1lZGlhIChtYXgtd2lkdGg6NjIwcHgpIHsKCQkJLmRlc2t0b3BfaGlkZSB0YWJsZS5pY29ucy1p

bm5lciB7CgkJCQlkaXNwbGF5OiBpbmxpbmUtYmxvY2sgIWltcG9ydGFudDsKCQkJfQoKCQkJLmlj

b25zLWlubmVyIHsKCQkJCXRleHQtYWxpZ246IGNlbnRlcjsKCQkJfQoKCQkJLmljb25zLWlubmVy

IHRkIHsKCQkJCW1hcmdpbjogMCBhdXRvOwoJCQl9CgoJCQkuaW1hZ2VfYmxvY2sgaW1nLmZ1bGxX

aWR0aCB7CgkJCQltYXgtd2lkdGg6IDEwMCUgIWltcG9ydGFudDsKCQkJfQoKCQkJLnJvdy1jb250

ZW50IHsKCQkJCXdpZHRoOiAxMDAlICFpbXBvcnRhbnQ7CgkJCX0KCgkJCS5zdGFjayAuY29sdW1u

IHsKCQkJCXdpZHRoOiAxMDAlOwoJCQkJZGlzcGxheTogYmxvY2s7CgkJCX0KCgkJCS5tb2JpbGVf

aGlkZSB7CgkJCQltYXgtd2lkdGg6IDA7CgkJCQltaW4taGVpZ2h0OiAwOwoJCQkJbWF4LWhlaWdo

dDogMDsKCQkJCWZvbnQtc2l6ZTogMDsKCQkJCWRpc3BsYXk6IG5vbmU7CgkJCQlvdmVyZmxvdzog

aGlkZGVuOwoJCQl9CgoJCQkuZGVza3RvcF9oaWRlLAoJCQkuZGVza3RvcF9oaWRlIHRhYmxlIHsK

CQkJCW1heC1oZWlnaHQ6IG5vbmUgIWltcG9ydGFudDsKCQkJCWRpc3BsYXk6IHRhYmxlICFpbXBv

cnRhbnQ7CgkJCX0KCQl9Cgk8L3N0eWxlPgo8L2hlYWQ+Cjxib2R5IHN0eWxlPSJ0ZXh0LXNpemUt

YWRqdXN0OiBub25lOyBiYWNrZ3JvdW5kLWNvbG9yOiAjZmZmOyBtYXJnaW46IDA7IHBhZGRpbmc6

IDA7Ij4KPHRhYmxlIGJvcmRlcj0iMCIgY2VsbHBhZGRpbmc9IjAiIGNlbGxzcGFjaW5nPSIwIiBj

bGFzcz0ibmwtY29udGFpbmVyIiByb2xlPSJwcmVzZW50YXRpb24iIHN0eWxlPSJtc28tdGFibGUt

bHNwYWNlOiAwcHQ7IG1zby10YWJsZS1yc3BhY2U6IDBwdDsgYmFja2dyb3VuZC1jb2xvcjogI2Zm

ZjsiIHdpZHRoPSIxMDAlIj4KPHRib2R5Pgo8dHI+Cjx0ZD4KPHRhYmxlIGFsaWduPSJjZW50ZXIi

IGJvcmRlcj0iMCIgY2VsbHBhZGRpbmc9IjAiIGNlbGxzcGFjaW5nPSIwIiBjbGFzcz0icm93IHJv

dy0xIiByb2xlPSJwcmVzZW50YXRpb24iIHN0eWxlPSJtc28tdGFibGUtbHNwYWNlOiAwcHQ7IG1z

by10YWJsZS1yc3BhY2U6IDBwdDsiIHdpZHRoPSIxMDAlIj4KPHRib2R5Pgo8dHI+Cjx0ZD4KPHRh

Stratobooster phish from Google

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 08 Jan 2026 14:51:00 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vdxuA-00000000P66-25IB

for dave@doctor.nl2k.ab.ca;

Thu, 08 Jan 2026 14:50:54 -0700

Resent-From: The Doctor

Resent-Date: Thu, 8 Jan 2026 14:50:54 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from 237.89.91.34.bc.googleusercontent.com ([34.91.89.237]:40942 helo=freenet-mobilfunk.de)

by doctor.nl2k.ab.ca with esmtp (Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vduYR-00000000CZL-0VHp

for doctor@doctor.nl2k.ab.ca;

Thu, 08 Jan 2026 11:16:23 -0700

Received: by freenet-mobilfunk.de (Postfix, from userid 1000)

id 36583369B8B; Thu, 8 Jan 2026 18:15:28 +0000 (UTC)

To: doctor@doctor.nl2k.ab.ca

From: "=?UTF-8?B?UGVyZm9ybWFuY2UgRW5oYW5jZXI=?="

Subject: =?UTF-8?B?VW5sZWE=?==?UTF-8?B?c2ggWW91ciBU?==?UTF-8?B?cnVlIFBvdGVudA==?==?UTF-8?B?aWFsIPCfmoA=?=

MIME-Version: 1.0

Content-Type: text/html; charset="UTF-8"

Content-Transfer-Encoding: base64

List-Unsubscribe-Post: List-Unsubscribe=One-Click

Message-Id: <20260108181528.36583369B8B@freenet-mobilfunk.de>

Date: Thu, 8 Jan 2026 18:15:28 +0000 (UTC)

X-Spam_score: 15.1

X-Spam_score_int: 151

X-Spam_bar: +++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: StratosBoost — Luxury Black & Gold Unleash Your True Potential

🚀



Content analysis details: (15.1 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[34.91.89.237 listed in dnsbl.ahbl.org]

[34.91.89.237 listed in dnsbl.ahbl.org]

[34.91.89.237 listed in dnsbl.ahbl.org]

[34.91.89.237 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[34.91.89.237 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[34.91.89.237 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[34.91.89.237 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[34.91.89.237 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[34.91.89.237 listed in will-spam-for-food.eu.org]

[34.91.89.237 listed in will-spam-for-food.eu.org]

[34.91.89.237 listed in will-spam-for-food.eu.org]

[34.91.89.237 listed in will-spam-for-food.eu.org]

[34.91.89.237 listed in will-spam-for-food.eu.org]

[34.91.89.237 listed in will-spam-for-food.eu.org]

[34.91.89.237 listed in will-spam-for-food.eu.org]

[34.91.89.237 listed in will-spam-for-food.eu.org]

1.0 SPF_SOFTFAIL SPF: sender does not match SPF record (softfail)

0.9 SPF_HELO_SOFTFAIL SPF: HELO does not match SPF record (softfail)

3.0 RECEIVED_MULTICAST A multicast IP adress appears in Received header

0.0 TVD_RCVD_IP Message was received from an IP address

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

0.0 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level mail

domains are different

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_IMAGE_ONLY_32 BODY: HTML: images with 2800-3200 bytes of words

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.1 FROM_EXCESS_BASE64 From: base64 encoded unnecessarily

0.4 RDNS_DYNAMIC Delivered to internal network by host with

dynamic-looking rDNS

0.4 KHOP_HELO_FCRDNS Relay HELO differs from its IP's reverse DNS

0.0 SARE_FROM_SPAM_WORD4 From address suggests this may be spam

3.0 GOOG_STO_NOIMG_HTML Apparently using google content hosting to avoid

URIBL

Subject: {SPAM?} =?UTF-8?B?VW5sZWE=?==?UTF-8?B?c2ggWW91ciBU?==?UTF-8?B?cnVlIFBvdGVudA==?==?UTF-8?B?aWFsIPCfmoA=?=



PCFkb2N0eXBlIGh0bWw+CjxodG1sIGxhbmc9ImVuIj4KPGhlYWQ+CjxtZXRhIGNoYXJzZXQ9InV0

Zi04Ij4KPG1ldGEgbmFtZT0idmlld3BvcnQiIGNvbnRlbnQ9IndpZHRoPWRldmljZS13aWR0aCxp

bml0aWFsLXNjYWxlPTEiPgo8dGl0bGU+U3RyYXRvc0Jvb3N0IOKAlCBMdXh1cnkgQmxhY2sgJiBH

b2xkPC90aXRsZT4KPHN0eWxlPgpodG1sLGJvZHl7aGVpZ2h0OjEwMCU7bWFyZ2luOjA7Zm9udC1m

YW1pbHk6IlBvcHBpbnMiLEFyaWFsLHNhbnMtc2VyaWY7YmFja2dyb3VuZDojMGUwZTBmO2NvbG9y

OiNmZmY7fQouY29udGFpbmVye21heC13aWR0aDo2ODBweDttYXJnaW46MjhweCBhdXRvO3BhZGRp

bmc6MjRweDtib3JkZXItcmFkaXVzOjEwcHg7YmFja2dyb3VuZDojMTYxNjE2O2JveC1zaGFkb3c6

MCAxMHB4IDQwcHggcmdiYSgyNTUsMjE1LDAsLjE1KTt9Ci5oZXJvLWltZ3t3aWR0aDoxMDAlO2hl

aWdodDphdXRvO2JvcmRlci1yYWRpdXM6OHB4O2Rpc3BsYXk6YmxvY2s7b2JqZWN0LWZpdDpjb3Zl

cjtib3gtc2hhZG93OjAgOHB4IDI0cHggcmdiYSgyNTUsMjE1LDAsLjA4KTt9Ci5jb250ZW50e3Bh

ZGRpbmc6MjRweCAxMHB4fQpoMXt0ZXh0LWFsaWduOmNlbnRlcjtjb2xvcjojZmZjYzMzO2ZvbnQt

c2l6ZToyNnB4O2ZvbnQtd2VpZ2h0OjcwMDttYXJnaW46OHB4IDAgMTJweH0KLmxlYWR7dGV4dC1h

bGlnbjpjZW50ZXI7Y29sb3I6I2NjYztmb250LXNpemU6MTVweDtsaW5lLWhlaWdodDoxLjY7bWFy

Z2luLWJvdHRvbToxOHB4fQouYnRue2Rpc3BsYXk6aW5saW5lLWJsb2NrO2JhY2tncm91bmQ6bGlu

ZWFyLWdyYWRpZW50KDEzNWRlZywjZmZjYzMzLCNkMWEwMDApO2NvbG9yOiMwMDA7cGFkZGluZzox

NHB4IDIycHg7Ym9yZGVyLXJhZGl1czo2cHg7Zm9udC13ZWlnaHQ6NzAwO3RleHQtZGVjb3JhdGlv

bjpub25lO3RleHQtdHJhbnNmb3JtOnVwcGVyY2FzZTtib3gtc2hhZG93OjAgOHB4IDI1cHggcmdi

YSgyNTUsMjA0LDUxLC4zKTt9Ci5mZWF0dXJlc3tkaXNwbGF5OmZsZXg7ZmxleC13cmFwOndyYXA7

Z2FwOjEycHg7anVzdGlmeS1jb250ZW50OmNlbnRlcjttYXJnaW4tdG9wOjE2cHh9Ci5jaGVja3ti

YWNrZ3JvdW5kOiNmZmNjMzM7Y29sb3I6IzAwMDt3aWR0aDoyMHB4O2hlaWdodDoyMHB4O2JvcmRl

ci1yYWRpdXM6NTAlO2Rpc3BsYXk6ZmxleDthbGlnbi1pdGVtczpjZW50ZXI7anVzdGlmeS1jb250

ZW50OmNlbnRlcjtmb250LXNpemU6MTNweDtmb250LXdlaWdodDo4MDB9Ci5mZWF0IHB7Y29sb3I6

I2UwZTBlMDtmb250LXNpemU6MTRweDttYXJnaW46MH0KLnBpbGx7bWFyZ2luOjIwcHggYXV0byA2

cHg7bWF4LXdpZHRoOjUyMHB4O2JhY2tncm91bmQ6IzI4MjAwMDtjb2xvcjojZmZjYzMzO3BhZGRp

bmc6MTJweCAxNHB4O2JvcmRlci1yYWRpdXM6NnB4O3RleHQtYWxpZ246Y2VudGVyO2ZvbnQtd2Vp

Z2h0OjYwMDtib3gtc2hhZG93OjAgNnB4IDE2cHggcmdiYSgyNTUsMjA0LDUxLC4xKTt9Ci5mb290

ZXJ7Y29sb3I6Izg4ODt0ZXh0LWFsaWduOmNlbnRlcjtmb250LXNpemU6MTJweDttYXJnaW4tdG9w

OjIwcHh9Ci51bnN1YnNjcmliZXtjb2xvcjojYWFhO3RleHQtZGVjb3JhdGlvbjp1bmRlcmxpbmV9

Cjwvc3R5bGU+CjwvaGVhZD4KPGJvZHk+CjxkaXYgY2xhc3M9ImNvbnRhaW5lciI+CjxpbWcgY2xh

c3M9Imhlcm8taW1nIiBzcmM9Imh0dHBzOi8vaS5neWF6by5jb20vNDc4ZDRlYjZmZjZiMmQ1YzJh

MTBhYzFlOTYwZDczN2IucG5nIiBhbHQ9IlN0cmF0b3NCb29zdCBwcm9kdWN0Ij4KPGRpdiBjbGFz

cz0iY29udGVudCI+CjxoMT5VbmxlYXNoIFlvdXIgVHJ1ZSBQb3RlbnRpYWwg8J+agDwvaDE+Cjxw

IGNsYXNzPSJsZWFkIj5TdHJhdG9zQm9vc3QgZnVlbHMgeW91ciBlbmVyZ3ksIGZvY3VzICYgcGVy

Zm9ybWFuY2Ug4oCUIHRydXN0ZWQgYnkgZXhwZXJ0cyBhbmQgYmFja2VkIGJ5IHNjaWVuY2UuPC9w

Pgo8cCBzdHlsZT0idGV4dC1hbGlnbjpjZW50ZXIiPjxhIGNsYXNzPSJidG4iIGhyZWY9Imh0dHBz

Oi8vc3RvcmFnZS5nb29nbGVhcGlzLmNvbS9iYWwwMmZ2eG5zNjRram41OGIxNmZkdnhzNzhrai9z

dHJhb3NibWl0bHNva29sejdkaTU0ZHNjeGttN2diZi5odG1sIj5DbGFpbSBZb3VyIFN0cmF0b3NC

b29zdCBOb3c8L2E+PC9wPgo8ZGl2IGNsYXNzPSJmZWF0dXJlcyI+CjxkaXYgY2xhc3M9ImZlYXQi

PjxkaXYgY2xhc3M9ImNoZWNrIj7inJM8L2Rpdj48cD5GYXN0LWFjdGluZyBuYXR1cmFsIGZvcm11

bGE8L3A+PC9kaXY+CjxkaXYgY2xhc3M9ImZlYXQiPjxkaXYgY2xhc3M9ImNoZWNrIj7inJM8L2Rp

dj48cD5CYWNrZWQgYnkgZXhwZXJ0czwvcD48L2Rpdj4KPGRpdiBjbGFzcz0iZmVhdCI+PGRpdiBj

bGFzcz0iY2hlY2siPuKckzwvZGl2PjxwPkVuZXJneSAmIHN0YW1pbmEgc3VwcG9ydDwvcD48L2Rp

dj4KPGRpdiBjbGFzcz0iZmVhdCI+PGRpdiBjbGFzcz0iY2hlY2siPuKckzwvZGl2PjxwPkVhc3kg

ZGFpbHkgdXNlPC9wPjwvZGl2Pgo8ZGl2IGNsYXNzPSJmZWF0Ij48ZGl2IGNsYXNzPSJjaGVjayI+

4pyTPC9kaXY+PHA+TWVudGFsIGZvY3VzIGJvb3N0PC9wPjwvZGl2Pgo8ZGl2IGNsYXNzPSJmZWF0

Ij48ZGl2IGNsYXNzPSJjaGVjayI+4pyTPC9kaXY+PHA+MTAwJSBzYXRpc2ZhY3Rpb24gZ3VhcmFu

dGVlPC9wPjwvZGl2Pgo8L2Rpdj4KPGRpdiBjbGFzcz0icGlsbCI+4pqhIExpbWl0ZWQgc3RvY2sg

YXZhaWxhYmxlIOKAlCBvcmRlciB0b2RheSBiZWZvcmUgaXQncyBnb25lITwvZGl2Pgo8ZGl2IGNs

YXNzPSJmb290ZXIiPgo8cD5Zb3UgcmVjZWl2ZWQgdGhpcyBlbWFpbCBiZWNhdXNlIHlvdSBzdWJz

Y3JpYmVkIHRvIFN0cmF0b3NCb29zdCBvZmZlcnMuPC9wPgo8cD48YSBjbGFzcz0idW5zdWJzY3Jp

YmUiIGhyZWY9Imh0dHBzOi8vc3RvcmFnZS5nb29nbGVhcGlzLmNvbS9mYXRrbW5zLTYya21uZmct

ZnY2c25jOC1qbWRuc2V0L3N0cmFvc2JtaXRsc29rb2x6N2RpNTRkc2N4a203Z2JmLmh0bWwiPlVu

c3Vic2NyaWJlPC9hPjwvcD4KPC9kaXY+CjwvZGl2PjwvZGl2Pgo8L2JvZHk+CjwvaHRtbD4=



Stratobooster phish from Google

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 08 Jan 2026 14:51:00 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vdxty-00000000P5X-2A1v

for dave@doctor.nl2k.ab.ca;

Thu, 08 Jan 2026 14:50:42 -0700

Resent-From: The Doctor

Resent-Date: Thu, 8 Jan 2026 14:50:42 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from 237.89.91.34.bc.googleusercontent.com ([34.91.89.237]:38198 helo=freenet-mobilfunk.de)

by doctor.nl2k.ab.ca with esmtp (Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vduYR-00000000CXi-0VFA

for doctor@nl2k.ab.ca;

Thu, 08 Jan 2026 11:16:26 -0700

Received: by freenet-mobilfunk.de (Postfix, from userid 1000)

id 7BD15369B48; Thu, 8 Jan 2026 18:15:22 +0000 (UTC)

To: doctor@nl2k.ab.ca

From: "=?UTF-8?B?UGVyZm9ybWFuY2UgRW5oYW5jZXI=?="

Subject: =?UTF-8?B?VW5sZWE=?==?UTF-8?B?c2ggWW91ciBU?==?UTF-8?B?cnVlIFBvdGVudA==?==?UTF-8?B?aWFsIPCfmoA=?=

MIME-Version: 1.0

Content-Type: text/html; charset="UTF-8"

Content-Transfer-Encoding: base64

List-Unsubscribe-Post: List-Unsubscribe=One-Click

Message-Id: <20260108181522.7BD15369B48@freenet-mobilfunk.de>

Date: Thu, 8 Jan 2026 18:15:22 +0000 (UTC)

X-Spam_score: 15.1

X-Spam_score_int: 151

X-Spam_bar: +++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: StratosBoost — Luxury Black & Gold Unleash Your True Potential

🚀



Content analysis details: (15.1 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[34.91.89.237 listed in dnsbl.ahbl.org]

[34.91.89.237 listed in dnsbl.ahbl.org]

[34.91.89.237 listed in dnsbl.ahbl.org]

[34.91.89.237 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[34.91.89.237 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[34.91.89.237 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[34.91.89.237 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[34.91.89.237 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[34.91.89.237 listed in will-spam-for-food.eu.org]

[34.91.89.237 listed in will-spam-for-food.eu.org]

[34.91.89.237 listed in will-spam-for-food.eu.org]

[34.91.89.237 listed in will-spam-for-food.eu.org]

[34.91.89.237 listed in will-spam-for-food.eu.org]

[34.91.89.237 listed in will-spam-for-food.eu.org]

[34.91.89.237 listed in will-spam-for-food.eu.org]

[34.91.89.237 listed in will-spam-for-food.eu.org]

1.0 SPF_SOFTFAIL SPF: sender does not match SPF record (softfail)

0.9 SPF_HELO_SOFTFAIL SPF: HELO does not match SPF record (softfail)

3.0 RECEIVED_MULTICAST A multicast IP adress appears in Received header

0.0 TVD_RCVD_IP Message was received from an IP address

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

0.0 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level mail

domains are different

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_IMAGE_ONLY_32 BODY: HTML: images with 2800-3200 bytes of words

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.1 FROM_EXCESS_BASE64 From: base64 encoded unnecessarily

0.4 RDNS_DYNAMIC Delivered to internal network by host with

dynamic-looking rDNS

0.4 KHOP_HELO_FCRDNS Relay HELO differs from its IP's reverse DNS

0.0 SARE_FROM_SPAM_WORD4 From address suggests this may be spam

3.0 GOOG_STO_NOIMG_HTML Apparently using google content hosting to avoid

URIBL

Subject: {SPAM?} =?UTF-8?B?VW5sZWE=?==?UTF-8?B?c2ggWW91ciBU?==?UTF-8?B?cnVlIFBvdGVudA==?==?UTF-8?B?aWFsIPCfmoA=?=



PCFkb2N0eXBlIGh0bWw+CjxodG1sIGxhbmc9ImVuIj4KPGhlYWQ+CjxtZXRhIGNoYXJzZXQ9InV0

Zi04Ij4KPG1ldGEgbmFtZT0idmlld3BvcnQiIGNvbnRlbnQ9IndpZHRoPWRldmljZS13aWR0aCxp

bml0aWFsLXNjYWxlPTEiPgo8dGl0bGU+U3RyYXRvc0Jvb3N0IOKAlCBMdXh1cnkgQmxhY2sgJiBH

b2xkPC90aXRsZT4KPHN0eWxlPgpodG1sLGJvZHl7aGVpZ2h0OjEwMCU7bWFyZ2luOjA7Zm9udC1m

YW1pbHk6IlBvcHBpbnMiLEFyaWFsLHNhbnMtc2VyaWY7YmFja2dyb3VuZDojMGUwZTBmO2NvbG9y

OiNmZmY7fQouY29udGFpbmVye21heC13aWR0aDo2ODBweDttYXJnaW46MjhweCBhdXRvO3BhZGRp

bmc6MjRweDtib3JkZXItcmFkaXVzOjEwcHg7YmFja2dyb3VuZDojMTYxNjE2O2JveC1zaGFkb3c6

MCAxMHB4IDQwcHggcmdiYSgyNTUsMjE1LDAsLjE1KTt9Ci5oZXJvLWltZ3t3aWR0aDoxMDAlO2hl

aWdodDphdXRvO2JvcmRlci1yYWRpdXM6OHB4O2Rpc3BsYXk6YmxvY2s7b2JqZWN0LWZpdDpjb3Zl

cjtib3gtc2hhZG93OjAgOHB4IDI0cHggcmdiYSgyNTUsMjE1LDAsLjA4KTt9Ci5jb250ZW50e3Bh

ZGRpbmc6MjRweCAxMHB4fQpoMXt0ZXh0LWFsaWduOmNlbnRlcjtjb2xvcjojZmZjYzMzO2ZvbnQt

c2l6ZToyNnB4O2ZvbnQtd2VpZ2h0OjcwMDttYXJnaW46OHB4IDAgMTJweH0KLmxlYWR7dGV4dC1h

bGlnbjpjZW50ZXI7Y29sb3I6I2NjYztmb250LXNpemU6MTVweDtsaW5lLWhlaWdodDoxLjY7bWFy

Z2luLWJvdHRvbToxOHB4fQouYnRue2Rpc3BsYXk6aW5saW5lLWJsb2NrO2JhY2tncm91bmQ6bGlu

ZWFyLWdyYWRpZW50KDEzNWRlZywjZmZjYzMzLCNkMWEwMDApO2NvbG9yOiMwMDA7cGFkZGluZzox

NHB4IDIycHg7Ym9yZGVyLXJhZGl1czo2cHg7Zm9udC13ZWlnaHQ6NzAwO3RleHQtZGVjb3JhdGlv

bjpub25lO3RleHQtdHJhbnNmb3JtOnVwcGVyY2FzZTtib3gtc2hhZG93OjAgOHB4IDI1cHggcmdi

YSgyNTUsMjA0LDUxLC4zKTt9Ci5mZWF0dXJlc3tkaXNwbGF5OmZsZXg7ZmxleC13cmFwOndyYXA7

Z2FwOjEycHg7anVzdGlmeS1jb250ZW50OmNlbnRlcjttYXJnaW4tdG9wOjE2cHh9Ci5jaGVja3ti

YWNrZ3JvdW5kOiNmZmNjMzM7Y29sb3I6IzAwMDt3aWR0aDoyMHB4O2hlaWdodDoyMHB4O2JvcmRl

ci1yYWRpdXM6NTAlO2Rpc3BsYXk6ZmxleDthbGlnbi1pdGVtczpjZW50ZXI7anVzdGlmeS1jb250

ZW50OmNlbnRlcjtmb250LXNpemU6MTNweDtmb250LXdlaWdodDo4MDB9Ci5mZWF0IHB7Y29sb3I6

I2UwZTBlMDtmb250LXNpemU6MTRweDttYXJnaW46MH0KLnBpbGx7bWFyZ2luOjIwcHggYXV0byA2

cHg7bWF4LXdpZHRoOjUyMHB4O2JhY2tncm91bmQ6IzI4MjAwMDtjb2xvcjojZmZjYzMzO3BhZGRp

bmc6MTJweCAxNHB4O2JvcmRlci1yYWRpdXM6NnB4O3RleHQtYWxpZ246Y2VudGVyO2ZvbnQtd2Vp

Z2h0OjYwMDtib3gtc2hhZG93OjAgNnB4IDE2cHggcmdiYSgyNTUsMjA0LDUxLC4xKTt9Ci5mb290

ZXJ7Y29sb3I6Izg4ODt0ZXh0LWFsaWduOmNlbnRlcjtmb250LXNpemU6MTJweDttYXJnaW4tdG9w

OjIwcHh9Ci51bnN1YnNjcmliZXtjb2xvcjojYWFhO3RleHQtZGVjb3JhdGlvbjp1bmRlcmxpbmV9

Cjwvc3R5bGU+CjwvaGVhZD4KPGJvZHk+CjxkaXYgY2xhc3M9ImNvbnRhaW5lciI+CjxpbWcgY2xh

c3M9Imhlcm8taW1nIiBzcmM9Imh0dHBzOi8vaS5neWF6by5jb20vNDc4ZDRlYjZmZjZiMmQ1YzJh

MTBhYzFlOTYwZDczN2IucG5nIiBhbHQ9IlN0cmF0b3NCb29zdCBwcm9kdWN0Ij4KPGRpdiBjbGFz

cz0iY29udGVudCI+CjxoMT5VbmxlYXNoIFlvdXIgVHJ1ZSBQb3RlbnRpYWwg8J+agDwvaDE+Cjxw

IGNsYXNzPSJsZWFkIj5TdHJhdG9zQm9vc3QgZnVlbHMgeW91ciBlbmVyZ3ksIGZvY3VzICYgcGVy

Zm9ybWFuY2Ug4oCUIHRydXN0ZWQgYnkgZXhwZXJ0cyBhbmQgYmFja2VkIGJ5IHNjaWVuY2UuPC9w

Pgo8cCBzdHlsZT0idGV4dC1hbGlnbjpjZW50ZXIiPjxhIGNsYXNzPSJidG4iIGhyZWY9Imh0dHBz

Oi8vc3RvcmFnZS5nb29nbGVhcGlzLmNvbS9iYWwwMmZ2eG5zNjRram41OGIxNmZkdnhzNzhrai9z

dHJhb3NibWl0bHNva29sejdkaTU0ZHNjeGttN2diZi5odG1sIj5DbGFpbSBZb3VyIFN0cmF0b3NC

b29zdCBOb3c8L2E+PC9wPgo8ZGl2IGNsYXNzPSJmZWF0dXJlcyI+CjxkaXYgY2xhc3M9ImZlYXQi

PjxkaXYgY2xhc3M9ImNoZWNrIj7inJM8L2Rpdj48cD5GYXN0LWFjdGluZyBuYXR1cmFsIGZvcm11

bGE8L3A+PC9kaXY+CjxkaXYgY2xhc3M9ImZlYXQiPjxkaXYgY2xhc3M9ImNoZWNrIj7inJM8L2Rp

dj48cD5CYWNrZWQgYnkgZXhwZXJ0czwvcD48L2Rpdj4KPGRpdiBjbGFzcz0iZmVhdCI+PGRpdiBj

bGFzcz0iY2hlY2siPuKckzwvZGl2PjxwPkVuZXJneSAmIHN0YW1pbmEgc3VwcG9ydDwvcD48L2Rp

dj4KPGRpdiBjbGFzcz0iZmVhdCI+PGRpdiBjbGFzcz0iY2hlY2siPuKckzwvZGl2PjxwPkVhc3kg

ZGFpbHkgdXNlPC9wPjwvZGl2Pgo8ZGl2IGNsYXNzPSJmZWF0Ij48ZGl2IGNsYXNzPSJjaGVjayI+

4pyTPC9kaXY+PHA+TWVudGFsIGZvY3VzIGJvb3N0PC9wPjwvZGl2Pgo8ZGl2IGNsYXNzPSJmZWF0

Ij48ZGl2IGNsYXNzPSJjaGVjayI+4pyTPC9kaXY+PHA+MTAwJSBzYXRpc2ZhY3Rpb24gZ3VhcmFu

dGVlPC9wPjwvZGl2Pgo8L2Rpdj4KPGRpdiBjbGFzcz0icGlsbCI+4pqhIExpbWl0ZWQgc3RvY2sg

YXZhaWxhYmxlIOKAlCBvcmRlciB0b2RheSBiZWZvcmUgaXQncyBnb25lITwvZGl2Pgo8ZGl2IGNs

YXNzPSJmb290ZXIiPgo8cD5Zb3UgcmVjZWl2ZWQgdGhpcyBlbWFpbCBiZWNhdXNlIHlvdSBzdWJz

Y3JpYmVkIHRvIFN0cmF0b3NCb29zdCBvZmZlcnMuPC9wPgo8cD48YSBjbGFzcz0idW5zdWJzY3Jp

YmUiIGhyZWY9Imh0dHBzOi8vc3RvcmFnZS5nb29nbGVhcGlzLmNvbS9mYXRrbW5zLTYya21uZmct

ZnY2c25jOC1qbWRuc2V0L3N0cmFvc2JtaXRsc29rb2x6N2RpNTRkc2N4a203Z2JmLmh0bWwiPlVu

c3Vic2NyaWJlPC9hPjwvcD4KPC9kaXY+CjwvZGl2PjwvZGl2Pgo8L2JvZHk+CjwvaHRtbD4=



Stratobooster phish from Google

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 08 Jan 2026 14:51:00 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vdxu2-00000000P5m-0iLs

for dave@doctor.nl2k.ab.ca;

Thu, 08 Jan 2026 14:50:46 -0700

Resent-From: The Doctor

Resent-Date: Thu, 8 Jan 2026 14:50:46 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from 237.89.91.34.bc.googleusercontent.com ([34.91.89.237]:38190 helo=freenet-mobilfunk.de)

by doctor.nl2k.ab.ca with esmtp (Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vduYR-00000000CXe-0VCy

for root@doctor.nl2k.ab.ca;

Thu, 08 Jan 2026 11:16:26 -0700

Received: by freenet-mobilfunk.de (Postfix, from userid 1000)

id 0A280369B36; Thu, 8 Jan 2026 18:15:22 +0000 (UTC)

To: root@doctor.nl2k.ab.ca

From: "=?UTF-8?B?UGVyZm9ybWFuY2UgRW5oYW5jZXI=?="

Subject: =?UTF-8?B?VW5sZWE=?==?UTF-8?B?c2ggWW91ciBU?==?UTF-8?B?cnVlIFBvdGVudA==?==?UTF-8?B?aWFsIPCfmoA=?=

MIME-Version: 1.0

Content-Type: text/html; charset="UTF-8"

Content-Transfer-Encoding: base64

List-Unsubscribe-Post: List-Unsubscribe=One-Click

Message-Id: <20260108181522.0A280369B36@freenet-mobilfunk.de>

Date: Thu, 8 Jan 2026 18:15:22 +0000 (UTC)

X-Spam_score: 15.1

X-Spam_score_int: 151

X-Spam_bar: +++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: StratosBoost — Luxury Black & Gold Unleash Your True Potential

🚀



Content analysis details: (15.1 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[34.91.89.237 listed in dnsbl.ahbl.org]

[34.91.89.237 listed in dnsbl.ahbl.org]

[34.91.89.237 listed in dnsbl.ahbl.org]

[34.91.89.237 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[34.91.89.237 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[34.91.89.237 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[34.91.89.237 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[34.91.89.237 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[34.91.89.237 listed in will-spam-for-food.eu.org]

[34.91.89.237 listed in will-spam-for-food.eu.org]

[34.91.89.237 listed in will-spam-for-food.eu.org]

[34.91.89.237 listed in will-spam-for-food.eu.org]

[34.91.89.237 listed in will-spam-for-food.eu.org]

[34.91.89.237 listed in will-spam-for-food.eu.org]

[34.91.89.237 listed in will-spam-for-food.eu.org]

[34.91.89.237 listed in will-spam-for-food.eu.org]

1.0 SPF_SOFTFAIL SPF: sender does not match SPF record (softfail)

0.9 SPF_HELO_SOFTFAIL SPF: HELO does not match SPF record (softfail)

3.0 RECEIVED_MULTICAST A multicast IP adress appears in Received header

0.0 TVD_RCVD_IP Message was received from an IP address

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

0.0 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level mail

domains are different

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_IMAGE_ONLY_32 BODY: HTML: images with 2800-3200 bytes of words

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 SARE_FROM_SPAM_WORD4 From address suggests this may be spam

0.4 RDNS_DYNAMIC Delivered to internal network by host with

dynamic-looking rDNS

0.1 FROM_EXCESS_BASE64 From: base64 encoded unnecessarily

0.4 KHOP_HELO_FCRDNS Relay HELO differs from its IP's reverse DNS

3.0 GOOG_STO_NOIMG_HTML Apparently using google content hosting to avoid

URIBL

Subject: {SPAM?} =?UTF-8?B?VW5sZWE=?==?UTF-8?B?c2ggWW91ciBU?==?UTF-8?B?cnVlIFBvdGVudA==?==?UTF-8?B?aWFsIPCfmoA=?=



PCFkb2N0eXBlIGh0bWw+CjxodG1sIGxhbmc9ImVuIj4KPGhlYWQ+CjxtZXRhIGNoYXJzZXQ9InV0

Zi04Ij4KPG1ldGEgbmFtZT0idmlld3BvcnQiIGNvbnRlbnQ9IndpZHRoPWRldmljZS13aWR0aCxp

bml0aWFsLXNjYWxlPTEiPgo8dGl0bGU+U3RyYXRvc0Jvb3N0IOKAlCBMdXh1cnkgQmxhY2sgJiBH

b2xkPC90aXRsZT4KPHN0eWxlPgpodG1sLGJvZHl7aGVpZ2h0OjEwMCU7bWFyZ2luOjA7Zm9udC1m

YW1pbHk6IlBvcHBpbnMiLEFyaWFsLHNhbnMtc2VyaWY7YmFja2dyb3VuZDojMGUwZTBmO2NvbG9y

OiNmZmY7fQouY29udGFpbmVye21heC13aWR0aDo2ODBweDttYXJnaW46MjhweCBhdXRvO3BhZGRp

bmc6MjRweDtib3JkZXItcmFkaXVzOjEwcHg7YmFja2dyb3VuZDojMTYxNjE2O2JveC1zaGFkb3c6

MCAxMHB4IDQwcHggcmdiYSgyNTUsMjE1LDAsLjE1KTt9Ci5oZXJvLWltZ3t3aWR0aDoxMDAlO2hl

aWdodDphdXRvO2JvcmRlci1yYWRpdXM6OHB4O2Rpc3BsYXk6YmxvY2s7b2JqZWN0LWZpdDpjb3Zl

cjtib3gtc2hhZG93OjAgOHB4IDI0cHggcmdiYSgyNTUsMjE1LDAsLjA4KTt9Ci5jb250ZW50e3Bh

ZGRpbmc6MjRweCAxMHB4fQpoMXt0ZXh0LWFsaWduOmNlbnRlcjtjb2xvcjojZmZjYzMzO2ZvbnQt

c2l6ZToyNnB4O2ZvbnQtd2VpZ2h0OjcwMDttYXJnaW46OHB4IDAgMTJweH0KLmxlYWR7dGV4dC1h

bGlnbjpjZW50ZXI7Y29sb3I6I2NjYztmb250LXNpemU6MTVweDtsaW5lLWhlaWdodDoxLjY7bWFy

Z2luLWJvdHRvbToxOHB4fQouYnRue2Rpc3BsYXk6aW5saW5lLWJsb2NrO2JhY2tncm91bmQ6bGlu

ZWFyLWdyYWRpZW50KDEzNWRlZywjZmZjYzMzLCNkMWEwMDApO2NvbG9yOiMwMDA7cGFkZGluZzox

NHB4IDIycHg7Ym9yZGVyLXJhZGl1czo2cHg7Zm9udC13ZWlnaHQ6NzAwO3RleHQtZGVjb3JhdGlv

bjpub25lO3RleHQtdHJhbnNmb3JtOnVwcGVyY2FzZTtib3gtc2hhZG93OjAgOHB4IDI1cHggcmdi

YSgyNTUsMjA0LDUxLC4zKTt9Ci5mZWF0dXJlc3tkaXNwbGF5OmZsZXg7ZmxleC13cmFwOndyYXA7

Z2FwOjEycHg7anVzdGlmeS1jb250ZW50OmNlbnRlcjttYXJnaW4tdG9wOjE2cHh9Ci5jaGVja3ti

YWNrZ3JvdW5kOiNmZmNjMzM7Y29sb3I6IzAwMDt3aWR0aDoyMHB4O2hlaWdodDoyMHB4O2JvcmRl

ci1yYWRpdXM6NTAlO2Rpc3BsYXk6ZmxleDthbGlnbi1pdGVtczpjZW50ZXI7anVzdGlmeS1jb250

ZW50OmNlbnRlcjtmb250LXNpemU6MTNweDtmb250LXdlaWdodDo4MDB9Ci5mZWF0IHB7Y29sb3I6

I2UwZTBlMDtmb250LXNpemU6MTRweDttYXJnaW46MH0KLnBpbGx7bWFyZ2luOjIwcHggYXV0byA2

cHg7bWF4LXdpZHRoOjUyMHB4O2JhY2tncm91bmQ6IzI4MjAwMDtjb2xvcjojZmZjYzMzO3BhZGRp

bmc6MTJweCAxNHB4O2JvcmRlci1yYWRpdXM6NnB4O3RleHQtYWxpZ246Y2VudGVyO2ZvbnQtd2Vp

Z2h0OjYwMDtib3gtc2hhZG93OjAgNnB4IDE2cHggcmdiYSgyNTUsMjA0LDUxLC4xKTt9Ci5mb290

ZXJ7Y29sb3I6Izg4ODt0ZXh0LWFsaWduOmNlbnRlcjtmb250LXNpemU6MTJweDttYXJnaW4tdG9w

OjIwcHh9Ci51bnN1YnNjcmliZXtjb2xvcjojYWFhO3RleHQtZGVjb3JhdGlvbjp1bmRlcmxpbmV9

Cjwvc3R5bGU+CjwvaGVhZD4KPGJvZHk+CjxkaXYgY2xhc3M9ImNvbnRhaW5lciI+CjxpbWcgY2xh

c3M9Imhlcm8taW1nIiBzcmM9Imh0dHBzOi8vaS5neWF6by5jb20vNDc4ZDRlYjZmZjZiMmQ1YzJh

MTBhYzFlOTYwZDczN2IucG5nIiBhbHQ9IlN0cmF0b3NCb29zdCBwcm9kdWN0Ij4KPGRpdiBjbGFz

cz0iY29udGVudCI+CjxoMT5VbmxlYXNoIFlvdXIgVHJ1ZSBQb3RlbnRpYWwg8J+agDwvaDE+Cjxw

IGNsYXNzPSJsZWFkIj5TdHJhdG9zQm9vc3QgZnVlbHMgeW91ciBlbmVyZ3ksIGZvY3VzICYgcGVy

Zm9ybWFuY2Ug4oCUIHRydXN0ZWQgYnkgZXhwZXJ0cyBhbmQgYmFja2VkIGJ5IHNjaWVuY2UuPC9w

Pgo8cCBzdHlsZT0idGV4dC1hbGlnbjpjZW50ZXIiPjxhIGNsYXNzPSJidG4iIGhyZWY9Imh0dHBz

Oi8vc3RvcmFnZS5nb29nbGVhcGlzLmNvbS9iYWwwMmZ2eG5zNjRram41OGIxNmZkdnhzNzhrai9z

dHJhb3NibWl0bHNva29sejdkaTU0ZHNjeGttN2diZi5odG1sIj5DbGFpbSBZb3VyIFN0cmF0b3NC

b29zdCBOb3c8L2E+PC9wPgo8ZGl2IGNsYXNzPSJmZWF0dXJlcyI+CjxkaXYgY2xhc3M9ImZlYXQi

PjxkaXYgY2xhc3M9ImNoZWNrIj7inJM8L2Rpdj48cD5GYXN0LWFjdGluZyBuYXR1cmFsIGZvcm11

bGE8L3A+PC9kaXY+CjxkaXYgY2xhc3M9ImZlYXQiPjxkaXYgY2xhc3M9ImNoZWNrIj7inJM8L2Rp

dj48cD5CYWNrZWQgYnkgZXhwZXJ0czwvcD48L2Rpdj4KPGRpdiBjbGFzcz0iZmVhdCI+PGRpdiBj

bGFzcz0iY2hlY2siPuKckzwvZGl2PjxwPkVuZXJneSAmIHN0YW1pbmEgc3VwcG9ydDwvcD48L2Rp

dj4KPGRpdiBjbGFzcz0iZmVhdCI+PGRpdiBjbGFzcz0iY2hlY2siPuKckzwvZGl2PjxwPkVhc3kg

ZGFpbHkgdXNlPC9wPjwvZGl2Pgo8ZGl2IGNsYXNzPSJmZWF0Ij48ZGl2IGNsYXNzPSJjaGVjayI+

4pyTPC9kaXY+PHA+TWVudGFsIGZvY3VzIGJvb3N0PC9wPjwvZGl2Pgo8ZGl2IGNsYXNzPSJmZWF0

Ij48ZGl2IGNsYXNzPSJjaGVjayI+4pyTPC9kaXY+PHA+MTAwJSBzYXRpc2ZhY3Rpb24gZ3VhcmFu

dGVlPC9wPjwvZGl2Pgo8L2Rpdj4KPGRpdiBjbGFzcz0icGlsbCI+4pqhIExpbWl0ZWQgc3RvY2sg

YXZhaWxhYmxlIOKAlCBvcmRlciB0b2RheSBiZWZvcmUgaXQncyBnb25lITwvZGl2Pgo8ZGl2IGNs

YXNzPSJmb290ZXIiPgo8cD5Zb3UgcmVjZWl2ZWQgdGhpcyBlbWFpbCBiZWNhdXNlIHlvdSBzdWJz

Y3JpYmVkIHRvIFN0cmF0b3NCb29zdCBvZmZlcnMuPC9wPgo8cD48YSBjbGFzcz0idW5zdWJzY3Jp

YmUiIGhyZWY9Imh0dHBzOi8vc3RvcmFnZS5nb29nbGVhcGlzLmNvbS9mYXRrbW5zLTYya21uZmct

ZnY2c25jOC1qbWRuc2V0L3N0cmFvc2JtaXRsc29rb2x6N2RpNTRkc2N4a203Z2JmLmh0bWwiPlVu

c3Vic2NyaWJlPC9hPjwvcD4KPC9kaXY+CjwvZGl2PjwvZGl2Pgo8L2JvZHk+CjwvaHRtbD4=



Norton Phish from Google Gmail Part 4


/InformAction">
emtype=3D"http://schema.org/EmailMessage">
ntent=3D"7654337 435: ."/>

pe=3D"http://schema.org/Event">
tp://schema.org/EventScheduled"/>
mtype=3D"http://schema.org/Organization">
"Google Calendar"/>

=3D"Tlw0kuhvAXAWVfHN119iEwKkeq"/>
px; color: #fff; line-height: 1px; height: 0; max-height: 0; width: 0; max-=

width: 0; opacity: 0; overflow: hidden;" itemprop=3D"name">Receipt update r=

ecorded BQGWV76W

cellspacing=3D"0" role=3D"presentation" align=3D"center" style=3D"width:100=

%;" class=3D"body-container">

left">
 
<=

!--[if mso | IE]>

ing=3D"0" cellspacing=3D"0" role=3D"presentation" align=3D"center" style=3D=

"width:100%;" class=3D"">

">


=3D"description">.


cellpadding=3D"0" cellspacing=3D"0" role=3D"presentation" align=3D"center" =

style=3D"width:100%;" class=3D"">
tbody>

#dadce0; border-radius: 8px; direction: rtl; font-size: 0; padding: 24px 32=

px; text-align: left; vertical-align: top;" class=3D"main-container-inner">=


px; text-align: left; direction: ltr; display: inline-block; vertical-align=

: top; width: 100%;overflow: hidden; word-wrap: break-word;">
=3D"0" cellpadding=3D"0" cellspacing=3D"0" role=3D"presentation" width=3D"1=

00%" class=3D"main-column-table-ltr" style=3D"padding-right: 32px; padding-=

left: 0;;table-layout: fixed;">

e=3D"padding:0; vertical-align:top;">
cellspacing=3D"0" role=3D"presentation" width=3D"100%" style=3D"table-layou=

t: fixed;">

d-break: break-word;;padding-bottom:2px;">

oogle Sans', Roboto, sans-serif;font-weight: 400; font-size: 22px; line=

-height: 28px;color: #3c4043; text-decoration: none;" class=3D"primary-text=

" role=3D"presentation">Receipt update recorded BQG=

WV76W

-align: left; word-break: break-word;;padding-bottom:24px;">

ont-family: Roboto, sans-serif;font-style: normal; font-weight: 400; font-s=

ize: 14px; line-height: 20px; letter-spacing: 0.2px;color: #3c4043; text-de=

coration: none;" class=3D"primary-text" role=3D"presentation">
dden=3D"true">

0; text-align: left; word-break: break-word;;padding-bottom:24px;">

yle=3D"font-family: Roboto, sans-serif;font-style: normal; font-weight: 400=

; font-size: 14px; line-height: 20px; letter-spacing: 0.2px;color: #3c4043;=

text-decoration: none;" class=3D"primary-text" role=3D"presentation">
>

Norton LifeLock Payment Receipt Date: Thursday, 08 January 2026
Paym=

ent Receipt Receipt: WD53614OPD5578
Customer Service Channel: +1 (865)-2=

23-0970

Membership Information Email

Hey,

This message is=

shared to acknowledge your association with the Norton LifeLock community =

over the past 5 Years. We appreciate the time you have spent with us. Your =

previous subscription period has concluded, and assistance is available sho=

uld you wish to continue using our services.

Transaction Description:=

Quantity: x3 Device
Product: Membership support
Plan: 5 Years =

Warranty
Payment Method: Auto Debit
Total Amount: USD591.66
Client=

ID: LPMMONMPK9
Activation Key: 1ae12ab5-3d62-4613-a46f-aefb03f2efe1

=

If you have questions or would like support regarding your account, you =

may contact us at +1-865-209-0164.

Warm regards,,
Norton LifeLock =

security
Team Lead: Claudia Urbano
Support Line: +1-865-209-0164
C=

orporate Operations Location,: 2420 Hwy 31 Nw Mesquite Tx 75150 US
Worki=

ng Hours: 6 AM =E2=80=93 6 PM


ent=3D"Norton LifeLock Payment Receipt Date: Thursday, 08 January 2026Payme=

nt Receipt Receipt: WD53614OPD5578Customer Service Channel: +1 (865)-223-09=

70Membership Information EmailHey,This message is shared to acknowledge you=

r association with the Norton LifeLock community over the past 5 Years. We =

appreciate the time you have spent with us. Your previous subscription peri=

od has concluded, and assistance is available should you wish to continue u=

sing our services.Transaction Description:Quantity: x3 DeviceProduct: Membe=

rship supportPlan: 5 Years WarrantyPayment Method: Auto DebitTotal Amount: =

USD591.66Client ID: LPMMONMPK9Activation Key: 1ae12ab5-3d62-4613-a46f-aefb0=

3f2efe1If you have questions or would like support regarding your account, =

you may contact us at +1-865-209-0164.Warm regards,,Norton LifeLock securit=

yTeam Lead: Claudia UrbanoSupport Line: +1-865-209-0164Corporate Operations=

Location,: 2420 Hwy 31 Nw Mesquite Tx 75150 USWorking Hours: 6 AM =E2=80=

=93 6 PM"/>

align: left; word-break: break-word;;padding-bottom:24px;">

nt-family: Roboto, sans-serif;font-style: normal; font-weight: 400; font-si=

ze: 14px; line-height: 20px; letter-spacing: 0.2px;color: #3c4043; text-dec=

oration: none;" class=3D"primary-text" role=3D"presentation">
=3D"0" cellpadding=3D"0" cellspacing=3D"0" role=3D"presentation" style=3D"p=

adding-bottom: 4px;">
le>La lista de invitados se ha ocultado porque as=C3=AD lo ha solicitado el=

organizador.


14px;color: #3c4043; text-decoration: none;font-weight: 700;-webkit-font-s=

moothing: antialiased;margin: 0; padding: 0;">Invitados



--000000000000b3abc70647e26b6c--

Norton Phish from Google Gmail Part 3

.primary-button-text {

color: #fff !important;

}



.underline-on-hover:hover {

text-decoration: underline !important;

}



.grey-infobar-text {

color: #202124 !important;

}



@media (prefers-color-scheme: dark) {

.primary-text:not([class^=3D"x_"]) {

color: #e8eaed !important;

}



.secondary-text:not([class^=3D"x_"]),

.phone-number:not([class^=3D"x_"]) a {

color: #9aa0a6 !important;

}



.grey-button-text:not([class^=3D"x_"]),

.attachment-chip:not([class^=3D"x_"]) a {

color: #bdc1c6 !important;

}



.accent-text:not([class^=3D"x_"]),

.hairline-button-text:not([class^=3D"x_"]) {

color: #8ab4f8 !important;

}



.primary-button:not([class^=3D"x_"]) {

background-color: #8ab4f8 !important;

}



.primary-button-text:not([class^=3D"x_"]) {

color: #202124 !important;

}

}















Norton Phish from Google Gmail Part 2


schemas-microsoft-com:vml" xmlns:o=3D"urn:schemas-microsoft-com:office:offi=

ce">
t=3D"text/html; charset=3DUTF-8">
=3Ddevice-width,initial-scale=3D1">
ight dark">





















=20



=20



=20



=20
















/InformAction">
emtype=3D"http://schema.org/EmailMessage">
ntent=3D"Lacey Fulton: ."/>

ype=3D"http://schema.org/Event">
ttp://schema.org/EventScheduled"/>
emtype=3D"http://schema.org/Organization">
=3D"Google Calendar"/>

ent=3D"93mUOlerCiws6DQSe2saWu3kyf"/>
: 1px; color: #fff; line-height: 1px; height: 0; max-height: 0; width: 0; m=

ax-width: 0; opacity: 0; overflow: hidden;" itemprop=3D"name">Ticket delive=

ry notification for CQX9BIB7

dding=3D"0" cellspacing=3D"0" role=3D"presentation" align=3D"center" style=

=3D"width:100%;" class=3D"body-container">

=3D"" align=3D"left">
&=

nbsp;

=3D"0" cellpadding=3D"0" cellspacing=3D"0" role=3D"presentation" align=3D"c=

enter" style=3D"width:100%;" class=3D"">

" align=3D"left">
">

.


border=3D"0" cellpadding=3D"0" cellspacing=3D"0" role=3D"presentation" alig=

n=3D"center" style=3D"width:100%;" class=3D"">

r: solid 1px #dadce0; border-radius: 8px; direction: rtl; font-size: 0; pad=

ding: 24px 32px; text-align: left; vertical-align: top;" class=3D"main-cont=

ainer-inner">

font-size: 13px; text-align: left; direction: ltr; display: inline-block; v=

ertical-align: top; width: 100%;overflow: hidden; word-wrap: break-word;"><=

table border=3D"0" cellpadding=3D"0" cellspacing=3D"0" role=3D"presentation=

" width=3D"100%" class=3D"main-column-table-ltr" style=3D"padding-right: 32=

px; padding-left: 0;;table-layout: fixed;">

umn-td" style=3D"padding:0; vertical-align:top;">
dding=3D"0" cellspacing=3D"0" role=3D"presentation" width=3D"100%" style=3D=

"table-layout: fixed;">

n: left; word-break: break-word;;padding-bottom:2px;">

mily: 'Google Sans', Roboto, sans-serif;font-weight: 400; font-size=

: 22px; line-height: 28px;color: #3c4043; text-decoration: none;" class=3D"=

primary-text" role=3D"presentation">Ticket delivery=

notification for CQX9BIB7

: 0; padding: 0; text-align: left; word-break: break-word;;padding-bottom:2=

4px;">

t-weight: 400; font-size: 14px; line-height: 20px; letter-spacing: 0.2px;co=

lor: #3c4043; text-decoration: none;" class=3D"primary-text" role=3D"presen=

tation">viernes 9 de ene de 2026 =E2=8B=85 5:53am (Hora=

de Europa central - Madrid)

ze: 0; padding: 0; text-align: left; word-break: break-word;;padding-bottom=

:24px;">

ont-weight: 400; font-size: 14px; line-height: 20px; letter-spacing: 0.2px;=

color: #3c4043; text-decoration: none;" class=3D"primary-text" role=3D"pres=

entation">

Norton 360 Dispatch Confirmation Date: Thursday, 08 Janu=

ary 2026
Dispatch Confirmation id: YT51880QNM8309
Help Center Contact=

: +1 (859)-204-6979

Membership Status Notification

Hey,

T=

his message is shared to inform you that your subscription has continued in=

accordance with your existing preferences. As of Thursday, 08 January 2026=

, your service period has been updated for the current term of 5-Years. We =

appreciate your continued association with our services.

Item Feature=

List:

License Key: f27932b3-d8bf-40ef-84a1-208fb91b15a4
Purchased=

Item: Membership support
Membership UID: WLKJ6SM8MJ
Warranty Term: 5=

-Years
Total Amount: $546.00

If you have questions or would like a=

ssistance regarding your account or service details, you may contact our su=

pport team at +1 (859)-204-6979.

Always grateful,,
Norton LifeLock=

Prime
Finance Director: Kamilah Samanez
Customer Service Number: +1-=

865-209-0164
Authorized Office Address,: 428 Cherry Street Fort Wayne In=

46804 United States

=C2=A9 2026 Company. All rights reserved.


pan>
ion Date: Thursday, 08 January 2026Dispatch Confirmation id: YT51880QNM8309=

Help Center Contact: +1 (859)-204-6979Membership Status NotificationHey,Thi=

s message is shared to inform you that your subscription has continued in a=

ccordance with your existing preferences. As of Thursday, 08 January 2026, =

your service period has been updated for the current term of 5-Years. We ap=

preciate your continued association with our services.Item Feature List:Lic=

ense Key: f27932b3-d8bf-40ef-84a1-208fb91b15a4Purchased Item: Membership su=

pportMembership UID: WLKJ6SM8MJWarranty Term: 5-YearsTotal Amount: $546.00I=

f you have questions or would like assistance regarding your account or ser=

vice details, you may contact our support team at +1 (859)-204-6979.Always =

grateful,,Norton LifeLock PrimeFinance Director: Kamilah SamanezCustomer Se=

rvice Number: +1-865-209-0164Authorized Office Address,: 428 Cherry Street =

Fort Wayne In 46804 United States&copy; 2026 Company. All rights reserv=

ed."/>

: left; word-break: break-word;;padding-bottom:24px;">

mily: Roboto, sans-serif;font-style: normal; font-weight: 400; font-size: 1=

4px; line-height: 20px; letter-spacing: 0.2px;color: #3c4043; text-decorati=

on: none;" class=3D"primary-text" role=3D"presentation">
cellpadding=3D"0" cellspacing=3D"0" role=3D"presentation" style=3D"padding=

-bottom: 4px;">


color: #3c4043; text-decoration: none;font-weight: 700;-webkit-font-smoothi=

ng: antialiased;margin: 0; padding: 0;">Invitados

La =

lista de invitados se ha ocultado porque as=C3=AD lo ha solicitado el organ=

izador.
=



--0000000000002ab9a90647e26b73--

Norton Phish from Google Gmail Part 2























=20



=20



=20



=20



Norton Phish from Google Gmail Part 1

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 08 Jan 2026 14:50:00 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vdxsd-00000000P1D-19NZ

for dave@doctor.nl2k.ab.ca;

Thu, 08 Jan 2026 14:49:19 -0700

Resent-From: The Doctor

Resent-Date: Thu, 8 Jan 2026 14:49:19 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-oa1-f74.google.com ([209.85.160.74]:54777)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vdsLk-00000000KZx-3Ad0

for doctor@nl2k.ab.ca;

Thu, 08 Jan 2026 08:55:11 -0700

Received: by mail-oa1-f74.google.com with SMTP id 586e51a60fabf-3fef084337fso3050445fac.1

for ; Thu, 08 Jan 2026 07:54:12 -0800 (PST)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=google.com; s=20230601; t=1767887646; x=1768492446; darn=nl2k.ab.ca;

h=from:subject:date:message-id:sender:reply-to:mime-version:from:to

:cc:subject:date:message-id:reply-to;

bh=2dVLjURsKbER9tEfxt8j3x0mZekgNp5gEHaoQcoFINs=;

b=M4BIKBsI+zC/H056cwukUTUcbfpq/lvn09NFB6Ky8U2JhyAHJPhjojnFVJw+D5jNon

+TmwV6qGxbvFY7yCDupFlQ80LET2rcq0Q2i0gUV6yFo+cOopWe1hvDN0mlrFCchH1duP

7LTrXFL2rnc38Jz2Mjuf8RQkj8WfeARGnnDf8BtcJjQBIPSkMbQJaRBAfxd5wcZ+/VMF

MPYtIFs3a8WRW0DGPlStshwqVZmK8rPPUA2/S1aaVvba2br0Bo/m/pa+n9DG00v7OfD0

wYWiSYcfuzLGTPY5t/qIB541Ve2dWcfPWD2GQ57kLsHhnS+ktZaW4lu/3tGyeZd0gWnI

wjhw==

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=sanchezlastra-es.20230601.gappssmtp.com; s=20230601; t=1767887646; x=1768492446; darn=nl2k.ab.ca;

h=from:subject:date:message-id:sender:reply-to:mime-version:from:to

:cc:subject:date:message-id:reply-to;

bh=2dVLjURsKbER9tEfxt8j3x0mZekgNp5gEHaoQcoFINs=;

b=gyNqcw3WUWS6k5df3qFahz3iElELeoV1z0bORBst59zEj5ogcB/43004eV8bNn56Zv

FW0XVdrMZzZWDJGCjl5OTqDilS+kkTvmFRatGN1xw4YOglUlrsJ5LWLvycObyiuyIbKu

cice8ocO4ExuemMTNSlZ7eH9+pz8QGm5zxy4X7pTr+bJXWA9PbqHw2B+W7xF+Yvu3T/N

i/f+tBCDpflkyI/h8jLhuNdTqzJe8fNKDkIF+7X2hnNBuUjgd40JuFwD0B2005nGTXTb

W05eI906pvryvOB1gB3p+joiExW0qFbP2VVPZe3VTKXt+UgT+TwgWSd5qipI4P3SDhIy

c0cg==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20230601; t=1767887646; x=1768492446;

h=from:subject:date:message-id:sender:reply-to:mime-version

:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to;

bh=2dVLjURsKbER9tEfxt8j3x0mZekgNp5gEHaoQcoFINs=;

b=GuEjukj/uVNRow84+DFfw43+yLT25c5+J2TnKYynKNx2A8zbAMjLE5sefDjSlUQAtU

BJ6l+YCAxJ6I1a7VPBqBFMy7E/k19cHT4ms+lJvO4eMviE/NaNTJc8nIbbWXoJ9JsP1I

RkznOIx+IZIEAdCJROAfobwparWrcRm5T4sTnz1REW6Y9SLj99wauK8RFgRdMMc79UQ5

sX5DN33k3Fh4K6G9YVIfLjUnrri+Pe3zdbGWqBJtL9ePCerP/2CAdZy93InX8C831gwU

UYlCpP0elzCPLU78P0BxFuRFeokcn3lZ6cjgiotIvf6KJvcINBUo59tRWksdfn056dc2

iTpg==

X-Forwarded-Encrypted: i=1; AJvYcCX1/e1YHCKkiN/7Hbi3iWdDKdgJpJztdEjpslHkjbDb3EKHuq1sAikHtbXfUpwi7OxmUDvNrZE=@nl2k.ab.ca

X-Gm-Message-State: AOJu0Yz1kb/hcvEoeU9+WT9OKF7xfJJeLMbiYrMcftzt1TGo7egzB/SU

6sDwoy9U8GbDTBABJunDmGiIuvyZRZOcI7GaOPA9WDj9UU44Ad521YY7S1eqi+rYbIT52FAg7ut

kdPhVDeC1SrQgLA7OfO6rXPAmZDIdfML8kqogOM1YslPjFQ==

MIME-Version: 1.0

X-Received: by 2002:a05:6820:4ecf:b0:65b:3907:b360 with SMTP id

006d021491bc7-65f54f71ae0mt2063435eaf.62.1767887646094; Thu, 08 Jan 2026

07:54:06 -0800 (PST)

Reply-To: Lacey Fulton

Sender: Google Calendar

Message-ID:

Date: Thu, 08 Jan 2026 15:54:06 +0000

Subject: Ticket delivery notification for CQX9BIB7

From: Lacey Fulton

Content-Type: multipart/alternative; boundary="0000000000002ab9a90647e26b73"

X-Spam_score: 14.0

X-Spam_score_int: 140

X-Spam_bar: ++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: . Ticket delivery notification for CQX9BIB7 viernes 9 de ene

de 2026 â‹… 5:53am Hora de Europa central - Madrid Norton 360 Dispatch Confirmation

Date: Thursday, 08 January 2026Dispatch Confirmation id: YT51880QNM8309Help

Center Contact: +1 (859)-204-6979Membership Status NotificationHey,This message

is shared t [...]



Content analysis details: (14.0 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[209.85.160.74 listed in dnsbl.ahbl.org]

[209.85.160.74 listed in dnsbl.ahbl.org]

[209.85.160.74 listed in dnsbl.ahbl.org]

[209.85.160.74 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[209.85.160.74 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[209.85.160.74 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[209.85.160.74 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[209.85.160.74 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[209.85.160.74 listed in will-spam-for-food.eu.org]

[209.85.160.74 listed in will-spam-for-food.eu.org]

[209.85.160.74 listed in will-spam-for-food.eu.org]

[209.85.160.74 listed in will-spam-for-food.eu.org]

[209.85.160.74 listed in will-spam-for-food.eu.org]

[209.85.160.74 listed in will-spam-for-food.eu.org]

[209.85.160.74 listed in will-spam-for-food.eu.org]

[209.85.160.74 listed in will-spam-for-food.eu.org]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[209.85.160.74 listed in list.dnswl.org]

-0.0 RCVD_IN_MSPIKE_H3 RBL: Good reputation (+3)

[209.85.160.74 listed in wl.mailspike.net]

0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid

-0.1 DKIM_VALID Message has at least one valid DKIM or DK signature

-0.0 RCVD_IN_MSPIKE_WL Mailspike good senders

0.8 MY_DSL I could use a BL for this.

1.2 MISSING_HEADERS Missing To: header

0.6 J_CHICKENPOX_47 BODY: 4alpha-pock-7alpha

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 HTML_MESSAGE BODY: HTML included in message

2.4 LONG_INVISIBLE_TEXT Long block of hidden text - bayes poison?

2.0 RATWR8_MESSID Message-ID with excessive dashes and dollars

1.9 REPLYTO_WITHOUT_TO_CC No description available.

Subject: {SPAM?} Ticket delivery notification for CQX9BIB7



--0000000000002ab9a90647e26b73

Content-Type: text/plain; charset="UTF-8"; format=flowed; delsp=yes

Content-Transfer-Encoding: base64



Lg0KDQpUaWNrZXQgZGVsaXZlcnkgbm90aWZpY2F0aW9uIGZvciBDUVg5QklCNw0Kdmllcm5lcyA5

IGRlIGVuZSBkZSAyMDI2IOKLhSA1OjUzYW0NCkhvcmEgZGUgRXVyb3BhIGNlbnRyYWwgLSBNYWRy

aWQNCg0KDQoNCk5vcnRvbiAzNjAgRGlzcGF0Y2ggQ29uZmlybWF0aW9uIERhdGU6IFRodXJzZGF5

LCAwOCBKYW51YXJ5IDIwMjZEaXNwYXRjaCAgDQpDb25maXJtYXRpb24gaWQ6IFlUNTE4ODBRTk04

MzA5SGVscCBDZW50ZXIgQ29udGFjdDogKzEgIA0KKDg1OSktMjA0LTY5NzlNZW1iZXJzaGlwIFN0

YXR1cyBOb3RpZmljYXRpb25IZXksVGhpcyBtZXNzYWdlIGlzIHNoYXJlZCB0byAgDQppbmZvcm0g

eW91IHRoYXQgeW91ciBzdWJzY3JpcHRpb24gaGFzIGNvbnRpbnVlZCBpbiBhY2NvcmRhbmNlIHdp

dGggeW91ciAgDQpleGlzdGluZyBwcmVmZXJlbmNlcy4gQXMgb2YgVGh1cnNkYXksIDA4IEphbnVh

cnkgMjAyNiwgeW91ciBzZXJ2aWNlIHBlcmlvZCAgDQpoYXMgYmVlbiB1cGRhdGVkIGZvciB0aGUg

Y3VycmVudCB0ZXJtIG9mIDUtWWVhcnMuIFdlIGFwcHJlY2lhdGUgeW91ciAgDQpjb250aW51ZWQg

YXNzb2NpYXRpb24gd2l0aCBvdXIgc2VydmljZXMuSXRlbSBGZWF0dXJlIExpc3Q6TGljZW5zZSBL

ZXk6ICANCmYyNzkzMmIzLWQ4YmYtNDBlZi04NGExLTIwOGZiOTFiMTVhNFB1cmNoYXNlZCBJdGVt

OiBNZW1iZXJzaGlwICANCnN1cHBvcnRNZW1iZXJzaGlwIFVJRDogV0xLSjZTTThNSldhcnJhbnR5

IFRlcm06IDUtWWVhcnNUb3RhbCBBbW91bnQ6ICANCiQ1NDYuMDBJZiB5b3UgaGF2ZSBxdWVzdGlv

bnMgb3Igd291bGQgbGlrZSBhc3Npc3RhbmNlIHJlZ2FyZGluZyB5b3VyICANCmFjY291bnQgb3Ig

c2VydmljZSBkZXRhaWxzLCB5b3UgbWF5IGNvbnRhY3Qgb3VyIHN1cHBvcnQgdGVhbSBhdCArMSAg

DQooODU5KS0yMDQtNjk3OS5BbHdheXMgZ3JhdGVmdWwsLE5vcnRvbiBMaWZlTG9jayBQcmltZUZp

bmFuY2UgRGlyZWN0b3I6ICANCkthbWlsYWggU2FtYW5lekN1c3RvbWVyIFNlcnZpY2UgTnVtYmVy

OiArMS04NjUtMjA5LTAxNjRBdXRob3JpemVkIE9mZmljZSAgDQpBZGRyZXNzLDogNDI4IENoZXJy

eSBTdHJlZXQgRm9ydCBXYXluZSBJbiA0NjgwNCBVbml0ZWQgU3RhdGVzJmNvcHk7IDIwMjYgIA0K

Q29tcGFueS4gQWxsIHJpZ2h0cyByZXNlcnZlZC4NCg0KT3JnYW5pemFkb3INCkxhY2V5IEZ1bHRv

bg0KYmFudG9ua2VtZ291bkBzYW5jaGV6bGFzdHJhLmVzDQoNCkludml0YWRvcw0KTGEgbGlzdGEg

ZGUgaW52aXRhZG9zIHNlIGhhIG9jdWx0YWRvIHBvcnF1ZSBhc8OtIGxvIGhhIHNvbGljaXRhZG8g

ZWwgIA0Kb3JnYW5pemFkb3IuDQoNCg==

--0000000000002ab9a90647e26b73

Content-Type: text/html; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable




schemas-microsoft-com:vml" xmlns:o=3D"urn:schemas-microsoft-com:office:offi=

ce">
t=3D"text/html; charset=3DUTF-8">
=3Ddevice-width,initial-scale=3D1">
ight dark">

Money phishing Part 2












style=3D"color: rgb(34, 34, 34); font-family: Arial, Helvetica, sans-serif;=

font-size: small; font-style: normal; font-variant-ligatures: normal; =

font-variant-caps: normal; font-weight: 400; letter-spacing: normal; =

orphans: 2; text-indent: 0px; text-transform: none; widows: 2; =

word-spacing: 0px; -webkit-text-stroke-width: 0px; white-space: normal; =

text-decoration-thickness: initial; text-decoration-style: initial; =

text-decoration-color: initial;">





start;">Sales
 , A 
font-size: 14.16px; text-align: start;">payment has been processed =

for 

start;">Invoice Number: 

0);">244777
 to 
style=3D"text-align: start;">:- 

16px; text-align: start;">Nagindas Khandwala College.




 


class=3D"gmail-v1auto-style3" style=3D"color: rgb(44, 54, 58); box-sizing: =

border-box; font-size: 14.16px; text-align: start;"> Payment Document =

sent to: 

class=3D"gmail-v1Object" style=3D"color: rgb(44, 54, 58); font-family: =

Roboto, sans-serif; font-size: 14px; text-align: left;">
style=3D"font-family: Arial, Helvetica, sans-serif;">sales@nk.=

ca




 




  View The EFT Remittance Advice =

Below:  




 







class=3D"gmail- gmail-" style=3D"color: rgb(34, 34, 34);">





















style=3D"color: rgb(44, 54, 58); box-sizing: border-box; font-size: 14.=

16px; text-align: start;">Scanned by: 

class=3D"gmail-v1auto-style3" style=3D"color: rgb(44, 54, 58); font-family:=

Roboto, sans-serif; font-size: 14px; text-align: left;">
style=3D"font-family: Arial, Helvetica, sans-serif;">nk.ca

style=3D"font-family: Arial, Helvetica, sans-serif;"> Trusted AI =

Scanner Detector.


style=3D"color: rgb(44, 54, 58); box-sizing: border-box; font-size: 14.=

16px; text-align: start;" />


style=3D"color: rgb(44, 54, 58); box-sizing: border-box; font-size: 14.=

16px; text-align: start;">Attachment type: PDF


class=3D"gmail-v1auto-style3" style=3D"color: rgb(44, 54, 58); box-sizing: =

border-box; font-size: 14.16px; text-align: start;" />


box-sizing: border-box; font-size: 14.16px; text-align: start;">Date: =

3:53:24 PM @ 

an class=3D"gmail-v1Object" style=3D"color: rgb(44, 54, 58); font-family: =

Roboto, sans-serif; font-size: 14px; text-align: left;">
style=3D"box-sizing: border-box; font-family: Arial, Helvetica, sans-serif;=

font-size: 14.16px;">01/08/2026








, 169);" />






center;"> If you=

have problems viewing this attachment, you may need to contact the account=

representative











font-size: small; font-style: normal; font-variant-ligatures: normal; =

font-variant-caps: normal; font-weight: 400; letter-spacing: normal; =

orphans: 2; text-indent: 0px; text-transform: none; widows: 2; =

word-spacing: 0px; -webkit-text-stroke-width: 0px; white-space: normal; =

text-decoration-thickness: initial; text-decoration-style: initial; =

text-decoration-color: initial; color: rgb(255, 255, 255);">



 




 





rgb(44, 54, 58); font-family: Roboto, sans-serif; font-size: =

14px;">Disclaimer: This email is intended for the named recipient only. It =

may contain information which is confidential, commercially sensitive, or =

copyright. If you are not the intended recipient you must not reproduce or =

distribute any part of the email, disclose its contents, or take any action=

in reliance. If you have received this email in error, please contact the =

sender and delete the message. It is your responsibility to scan this email=

and any attachments for viruses and other defects. To the extent permitted=

by law and its associates will not be liable for any loss or damage =

arising in any way from this communication including any file attachments. =

We may monitor email you send to us, either as a reply to this email or any=

email you send to us, to confirm our systems are protected and for =

compliance with company policies. Although we take reasonable precautions =

to protect the confidentiality of our email systems, we do not warrant the =

confidentiality or security of email or attachments we receive.=