Cabela's Phishing from Microsoft Outlook Part 4


align="center" border="0" cellpadding="0" cellspacing="0" class="" style="width:600px;" width="600"

>









































































Click here to see in your browser, or you can unsubscribe from all future emails.














































Â






















Cabela's Phishing from Microsoft Outlook Part 3















Preview - Welcome to Offer






































Â






















































Cabela's Phishing from Microsoft Outlook Part 2

Content analysis details: (9.0 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[51.158.242.221 listed in will-spam-for-food.eu.org]

[51.158.242.221 listed in will-spam-for-food.eu.org]

[51.158.242.221 listed in will-spam-for-food.eu.org]

[51.158.242.221 listed in will-spam-for-food.eu.org]

[51.158.242.221 listed in will-spam-for-food.eu.org]

[51.158.242.221 listed in will-spam-for-food.eu.org]

[51.158.242.221 listed in will-spam-for-food.eu.org]

[51.158.242.221 listed in will-spam-for-food.eu.org]

[2603:10b6:5:3ba:cafe:0:0:c8 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:5:3ba:cafe:0:0:c8 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:5:3ba:cafe:0:0:c8 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:5:3ba:cafe:0:0:c8 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:5:3ba:cafe:0:0:c8 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:5:3ba:cafe:0:0:c8 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:5:3ba:cafe:0:0:c8 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:5:3ba:cafe:0:0:c8 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:5:3ba:0:0:0:24 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:5:3ba:0:0:0:24 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:5:3ba:0:0:0:24 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:5:3ba:0:0:0:24 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:5:3ba:0:0:0:24 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:5:3ba:0:0:0:24 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:5:3ba:0:0:0:24 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:5:3ba:0:0:0:24 listed in]

[will-spam-for-food.eu.org]

[52.102.128.16 listed in will-spam-for-food.eu.org]

[52.102.128.16 listed in will-spam-for-food.eu.org]

[52.102.128.16 listed in will-spam-for-food.eu.org]

[52.102.128.16 listed in will-spam-for-food.eu.org]

[52.102.128.16 listed in will-spam-for-food.eu.org]

[52.102.128.16 listed in will-spam-for-food.eu.org]

[52.102.128.16 listed in will-spam-for-food.eu.org]

[52.102.128.16 listed in will-spam-for-food.eu.org]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[52.102.128.16 listed in list.dnswl.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[51.158.242.221 listed in dnsbl.ahbl.org]

[51.158.242.221 listed in dnsbl.ahbl.org]

[51.158.242.221 listed in dnsbl.ahbl.org]

[51.158.242.221 listed in dnsbl.ahbl.org]

[52.102.128.16 listed in dnsbl.ahbl.org]

[52.102.128.16 listed in dnsbl.ahbl.org]

[52.102.128.16 listed in dnsbl.ahbl.org]

[52.102.128.16 listed in dnsbl.ahbl.org]

[2603:10b6:5:3ba:0:0:0:24 listed in]

[dnsbl.ahbl.org]

[2603:10b6:5:3ba:0:0:0:24 listed in]

[dnsbl.ahbl.org]

[2603:10b6:5:3ba:0:0:0:24 listed in]

[dnsbl.ahbl.org]

[2603:10b6:5:3ba:0:0:0:24 listed in]

[dnsbl.ahbl.org]

[2603:10b6:5:3ba:cafe:0:0:c8 listed in]

[dnsbl.ahbl.org]

[2603:10b6:5:3ba:cafe:0:0:c8 listed in]

[dnsbl.ahbl.org]

[2603:10b6:5:3ba:cafe:0:0:c8 listed in]

[dnsbl.ahbl.org]

[2603:10b6:5:3ba:cafe:0:0:c8 listed in]

[dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[51.158.242.221 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[51.158.242.221 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[51.158.242.221 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[51.158.242.221 listed in dnsbl.ahbl.org]

-0.0 SPF_HELO_PASS SPF: HELO matches SPF record

0.0 ARC_SIGNED Message has a ARC signature

0.0 ARC_VALID Message has a valid ARC signature

0.0 AXB_X_FF_SEZ_S Forefront sez this is spam

0.0 FROM_LOCAL_DIGITS From: localpart has long digit sequence

0.3 FROM_LOCAL_HEX From: localpart has long hexadecimal sequence

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[52.102.128.16 listed in wl.mailspike.net]

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 HTML_MESSAGE BODY: HTML included in message

0.8 HTML_IMAGE_RATIO_02 BODY: HTML has a low ratio of text to image area

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

1.0 FORGED_SPF_HELO No description available.

1.0 MR_DIFF_MID No description available.

Subject: {SPAM?} Fwd: Your Cabela's Feedback is Valued + Free Gift





Welcome to [Coded Mails]

































Preview - Welcome to Offer






































Â








































































Cabela's Phishing from Microsoft Outlook Part 2

Content analysis details: (9.0 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[51.158.238.185 listed in will-spam-for-food.eu.org]

[51.158.238.185 listed in will-spam-for-food.eu.org]

[51.158.238.185 listed in will-spam-for-food.eu.org]

[51.158.238.185 listed in will-spam-for-food.eu.org]

[51.158.238.185 listed in will-spam-for-food.eu.org]

[51.158.238.185 listed in will-spam-for-food.eu.org]

[51.158.238.185 listed in will-spam-for-food.eu.org]

[51.158.238.185 listed in will-spam-for-food.eu.org]

[2603:10b6:510:34b:cafe:0:0:b1 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:510:34b:cafe:0:0:b1 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:510:34b:cafe:0:0:b1 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:510:34b:cafe:0:0:b1 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:510:34b:cafe:0:0:b1 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:510:34b:cafe:0:0:b1 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:510:34b:cafe:0:0:b1 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:510:34b:cafe:0:0:b1 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:510:34b:0:0:0:12 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:510:34b:0:0:0:12 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:510:34b:0:0:0:12 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:510:34b:0:0:0:12 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:510:34b:0:0:0:12 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:510:34b:0:0:0:12 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:510:34b:0:0:0:12 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:510:34b:0:0:0:12 listed in]

[will-spam-for-food.eu.org]

[52.102.128.40 listed in will-spam-for-food.eu.org]

[52.102.128.40 listed in will-spam-for-food.eu.org]

[52.102.128.40 listed in will-spam-for-food.eu.org]

[52.102.128.40 listed in will-spam-for-food.eu.org]

[52.102.128.40 listed in will-spam-for-food.eu.org]

[52.102.128.40 listed in will-spam-for-food.eu.org]

[52.102.128.40 listed in will-spam-for-food.eu.org]

[52.102.128.40 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[51.158.238.185 listed in dnsbl.ahbl.org]

[51.158.238.185 listed in dnsbl.ahbl.org]

[51.158.238.185 listed in dnsbl.ahbl.org]

[51.158.238.185 listed in dnsbl.ahbl.org]

[52.102.128.40 listed in dnsbl.ahbl.org]

[52.102.128.40 listed in dnsbl.ahbl.org]

[52.102.128.40 listed in dnsbl.ahbl.org]

[52.102.128.40 listed in dnsbl.ahbl.org]

[2603:10b6:510:34b:cafe:0:0:b1 listed in]

[dnsbl.ahbl.org]

[2603:10b6:510:34b:cafe:0:0:b1 listed in]

[dnsbl.ahbl.org]

[2603:10b6:510:34b:cafe:0:0:b1 listed in]

[dnsbl.ahbl.org]

[2603:10b6:510:34b:cafe:0:0:b1 listed in]

[dnsbl.ahbl.org]

[2603:10b6:510:34b:0:0:0:12 listed in]

[dnsbl.ahbl.org]

[2603:10b6:510:34b:0:0:0:12 listed in]

[dnsbl.ahbl.org]

[2603:10b6:510:34b:0:0:0:12 listed in]

[dnsbl.ahbl.org]

[2603:10b6:510:34b:0:0:0:12 listed in]

[dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[51.158.238.185 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[51.158.238.185 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[51.158.238.185 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[51.158.238.185 listed in dnsbl.ahbl.org]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[52.102.128.40 listed in list.dnswl.org]

-0.0 SPF_HELO_PASS SPF: HELO matches SPF record

0.0 ARC_SIGNED Message has a ARC signature

0.0 ARC_VALID Message has a valid ARC signature

0.0 AXB_X_FF_SEZ_S Forefront sez this is spam

0.0 FROM_LOCAL_DIGITS From: localpart has long digit sequence

0.3 FROM_LOCAL_HEX From: localpart has long hexadecimal sequence

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 HTML_MESSAGE BODY: HTML included in message

0.8 HTML_IMAGE_RATIO_02 BODY: HTML has a low ratio of text to image area

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

1.0 FORGED_SPF_HELO No description available.

1.0 MR_DIFF_MID No description available.

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[52.102.128.40 listed in wl.mailspike.net]

Subject: {SPAM?} Fwd: Your Opinion Matters: Short Survey, Big Reward





Welcome to [Coded Mails]



























Cabela's Phishing from Microsoft Outlook Part 1

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Wed, 17 Dec 2025 20:18:00 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vW4WQ-00000000Ebm-3I1C

for dave@doctor.nl2k.ab.ca;

Wed, 17 Dec 2025 20:17:46 -0700

Resent-From: The Doctor

Resent-Date: Wed, 17 Dec 2025 20:17:46 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-westusazhn15012040.outbound.protection.outlook.com ([52.102.128.40]:19809 helo=SJ2PR03CU001.outbound.protection.outlook.com)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.98.2 (FreeBSD))

(envelope-from <0675616586483651704352109329123735970631@cfbjibs.temptingfragrances.com>)

id 1vW2RD-00000000G3U-0bRt

for sales@nk.ca;

Wed, 17 Dec 2025 18:04:24 -0700

ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none;

b=YJOMnaG6p1JQB3S2cvpIZvR1UDZ5SI/J6dnBc38oPoFeLQy0Gn0t9oq3nQMt3OSVRZ+ppAJG0IqP3X+63sphj95unwzzuR5Y/lDpyPQq8ow7QyNrjMWTiaCRaEpDiQmfRMRSQkWROshNFBCjaRQeUuETTbTWewBjtX9Nojq7dOe/JbvIhQDOuteDPkOUAlyM2v76RlIyD3ka4VazzjLGVtI0s/aE3BXPXhIfWlKHTafhMSd5pyXEQKb1BkItxbb9djTlh5C6g0FJBschvoDjHiO1Vbkw8gVY5bbAI9dhqqxTWqKyu89OcETG43SubpPCKEq4mq7AxSGjw+l9b9pIQw==

ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;

s=arcselector10001;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1;

bh=+VZuAbSuK/knReTP/zXmmfoHFaDHc1zCgdQ+rHevKKo=;

b=AAW79TirWglquP6gT9BsLH+NJuov/30ss1Ve4YPr+RmwTV+0Vy5lPobKWrRiJf4E+Zfaz0NY5P/E+XiMBbHgxuTnBnS5KIit/73t0F02gh9277vfO+fOsrgyirOaoKdV3yGoMQQwPT9hHA8W13pT19TNrAVaLb2VyoEBDUycbpSwl7ApOUuyht3jctwRWjPRBT0LYDdLpqjryD0rWGL1Q5x7LBgzzBHJvAQrPQooUwlZN54HnbsNEzfd/zNaE2SCSQX2RWWku1TCzjHHlmWcH5jocxpQEcnL3dJPPRQMirvuqW4ZLjmBiXo/EBYF6UE9JF10A437620YqYatRHPM1w==

ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=none (sender ip is

51.158.238.185) smtp.rcpttodomain=nk.ca

smtp.mailfrom=cfbjibs.temptingfragrances.com; dmarc=none action=none

header.from=cfbjibs.temptingfragrances.com; dkim=none (message not signed);

arc=none (0)

Received: from PH5P222CA0001.NAMP222.PROD.OUTLOOK.COM (2603:10b6:510:34b::12)

by DM6PR16MB3670.namprd16.prod.outlook.com (2603:10b6:5:2ba::23) with

Microsoft SMTP Server (version=TLS1_2,

cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.9434.6; Thu, 18 Dec

2025 01:03:19 +0000

Received: from CY4PEPF0000E9D3.namprd03.prod.outlook.com

(2603:10b6:510:34b:cafe::b1) by PH5P222CA0001.outlook.office365.com

(2603:10b6:510:34b::12) with Microsoft SMTP Server (version=TLS1_3,

cipher=TLS_AES_256_GCM_SHA384) id 15.20.9434.7 via Frontend Transport; Thu,

18 Dec 2025 01:03:26 +0000

X-MS-Exchange-Authentication-Results: spf=none (sender IP is 51.158.238.185)

smtp.mailfrom=cfbjibs.temptingfragrances.com; dkim=none (message not signed)

header.d=none;dmarc=none action=none

header.from=cfbjibs.temptingfragrances.com;

Received-SPF: None (protection.outlook.com: cfbjibs.temptingfragrances.com

does not designate permitted sender hosts)

Received: from unical.it (51.158.238.185) by

CY4PEPF0000E9D3.mail.protection.outlook.com (10.167.241.138) with Microsoft

SMTP Server id 15.20.9434.6 via Frontend Transport; Thu, 18 Dec 2025 01:03:17

+0000

From: Cabela's Insights <0818890471938414921462094@cfbjibs.temptingfragrances.com>

To: sales@nk.ca

Subject: Fwd: Your Opinion Matters: Short Survey, Big Reward

Message-ID: <4163305008.eap1.2948904184817@qrivo.co>

MIME-Version: 1.0

Date: Thu, 18 Dec 2025 01:02:05 +0000

Content-Type: text/html; charset=utf-8

X-SES-Outgoing: Thu, 18 Dec 2025 01:02:05 +0000-51.158.238.185

In-Reply-To:

Errors-To: abuse@6riPjuEIJq.google.com

List-Unsubscribe:

References:

X-EOPAttributedMessage: 0

X-MS-PublicTrafficType: Email

X-MS-TrafficTypeDiagnostic: CY4PEPF0000E9D3:EE_|DM6PR16MB3670:EE_

X-MS-Office365-Filtering-Correlation-Id: 2ee3104e-d3b2-43fa-f9cf-08de3dd13b10

X-MS-Exchange-SenderADCheck: 1

X-MS-Exchange-AntiSpam-Relay: 0

X-Microsoft-Antispam:

BCL:0;ARA:13230040|376014|34020700016|82310400026|36860700013|41320700013|61400799027|1032899013|69100299015|4022899009|8096899003|2066899003|4076899003|8135299006|13003099007|16110700003;

X-Microsoft-Antispam-Message-Info:

=?utf-8?B?cHMxOU1YTS95MUFzbEdBdDR5ZzNUejJnVmFSVkNhRlp4U2xzQWtTMUR0L1Nv?=

=?utf-8?B?MXVET2JRUlNGNFhKb0VNMjZ5cGNVazBmYmNocnZkUzVwUnovMUNUeUJxcjI3?=

=?utf-8?B?dHFOek5oamZuVWRDTG9iNTJEckRjRVY4VVBzNG16VnZXdmoyRnVzU2tQNk9D?=

=?utf-8?B?aTlnR0xpd2dBdkEva0RuQy8wazVKYkZCQVY2WnNTOHFYcThwczB5MWVUOFlD?=

=?utf-8?B?WUdSZjAxdEhiK2oxOXNNOGMySWliMHJxSzNkdFlteTA1bTkzYWJCazBvc3pi?=

=?utf-8?B?K3UvTS8yd3NFYUQrd3dFcnFRWC9hVUJidmNPdnBQU1JoU25xWFU2TmQzazli?=

=?utf-8?B?Q0NBQnFwcFdUV25kSEtIYVVsREx6d2ZmS0tobEhhRG1ibWwzRmVVUzZUVTF4?=

=?utf-8?B?NHpyVUhBZTZwMHhwUzR1VnJxQzBhekpFQVRTbEoxR1Y2UE1Fb3IvVmJCODlU?=

=?utf-8?B?bVhUTlY0L3lWdU4vU29uMUYzdnFQdEJPS2EyVHlpdUtkdTlwWVcwbGR2NzJj?=

=?utf-8?B?NWFCbDFYZVhyOUtQYk1jbWtCMjYrRTF6NUtpMFlpa0lpQTA2THpmaGJsSWQ0?=

=?utf-8?B?WDZBTS83bUJpTFNPMjlqUytkT1ZMaFhzYVJvOEhMWmJRZjFOTzhUNW51Zy8v?=

=?utf-8?B?MFJMekhNakRiNUk2OXdZUzFkUlBjSHdCNzRjck5YOENVVzhhazE0WU0ydzVh?=

=?utf-8?B?SXlKQ3hjSVV0cFdNWU5ZK2tzOFdTTjYyZkVUSVdxWjRUNjZrK0tHdldja2VD?=

=?utf-8?B?MnkzVUsvL0RUaTR1UmpBRHNWOVJ2M08xekdhb1RISk4yOGg2Q2J3NEE4dWJR?=

=?utf-8?B?YThPS1JoYldtbmlMRThHZnNWbWJlaWlpVXMvK2h2eUxmYXl2b1BTbllIUis3?=

=?utf-8?B?VUpTdllqQitFTkNORXJ3U3lReS9UMEgxemdwQWVxd0RYUG53VmxRcmE1UGxa?=

=?utf-8?B?MEJmbzg4c2txMlRoMmNyTXdRZjBYRTVNL3NpL0NLNzBveWppcnB0Q2pvNm5B?=

=?utf-8?B?K3NKakdZaUprQkJsbVV4eWlxM2YvaXZzRk01QVFybXVoV25wdjJoNmhRNnAr?=

=?utf-8?B?VHZKbXJ1S1Z3T0tBTURvcmRXYjI1d2hiZ2pQZWVseFVoUzVSNWgyVkdOUUdU?=

=?utf-8?B?SERUb29XMXVQclZKTFZIU1cxOFN1Q2xlYXBCbkRtZ3drK0IwWkxoUDRBR2U1?=

=?utf-8?B?SUN3QU5zRC9iRzVPV0NqbjdjcjhwK05uVHI3TjFvQUZsTnArbTZ0WXdnSzZk?=

=?utf-8?B?L2djTnZHdHpDYjNjSndnckVEc1VsbWVCZTZ6SzlsUjAwa09qT0dTcVNmRUc5?=

=?utf-8?B?THZVaHE1QjZ2S0pOQnFXV3hjYWgxeVAyUW1xNndGV08wYTlaZG10Qmd0NmRq?=

=?utf-8?B?dDFhbGdzNnUwRVdaeGRTL2pQQmkxSFZ5RmFkaS93LzE2djcwOEhQNFNuaXUy?=

=?utf-8?B?QTRGNHRwU0xpWkNwMHhTaVk0YVYxTzBUeWNLbkkxdHl5a3M4bldnVjQ1T1l4?=

=?utf-8?B?dUhWQ0JjdUU2T2dhS0NnT1J4OUh1Qi9rMnd6NTlWNi9YSVRIUjM2RWpzanFW?=

=?utf-8?B?Q2NZbkl6WUFpRzhUN213aXhXSGxBZGJTVExVSlEzV2tXbW1mRDJpVTl2RXNp?=

=?utf-8?B?S3NRN3d6UHBVbmFoT3hnUGV3OGdWQjgzaU1ZRmVCQ2w2ZjNENEF3ekZiMTQr?=

=?utf-8?B?RVMwaDJmL0JJcllCLzlKYlBNNEY0Wmd4UkNCVTFvdHpqM2U1Vzhjdit4N2pv?=

=?utf-8?B?UjVNeGZoWjJnVXpCcGRTeEY0NkN3c25Vbm1vVWdWRFlUbW1DQllNZ0Fkdkoy?=

=?utf-8?B?emxrcW8vczRUbTZ6OUZnd1JtdUREb0lJWTFGY0JxTkhiSjJXUEVEZEwvMjlU?=

=?utf-8?B?UXlna09CYlZtaGkvYjBGSnlHU1dYcmJDOHN1dW5OS1o5TW9iR09uSmV5VGxO?=

=?utf-8?B?Z0s3dWNOSTc5VnVYVjdiSEtuMS9ROElwbDhTbitGQzBDbnBOYjNscUdkVDg4?=

=?utf-8?B?K0ljV1lvNlNocmZ0Skw0bjUzVFRQTGRnajl6eW9GQTRKUWJCQ3EwQXFFdFlR?=

=?utf-8?B?QWZEVDI2UXJTUDJ6T2JPNTZMRkJVaEx1ZFoyZVFhOGVqb3A3bW40UElJcEhh?=

=?utf-8?B?YXBFV0pvVDZneE8xdXA0KzZna1JqaWQxWkxlK2syYjNESGxCRHpyb2FYN1Js?=

=?utf-8?B?TXJVdk0yTmJ5MkZwSXVsRDBiNSt5NDdvQkdCUElBTVBLalJqQWdkWUFmVnNH?=

=?utf-8?B?dXdpd2p1L3BrN3E0N3J4WjdkZWd0Uk02bzB3dGFRVTZvOVUyM1Blck10dG8r?=

=?utf-8?B?WVE2aDlKNktvZlJGVDRRNFl1aFZFM25LQjJ3dlplNUpNeHJGckV2SDBjSEVY?=

=?utf-8?B?ZzNiQnZyMEhmSStpa25CRmZ2RzgwZWhuUnliWndxUk1mYm1rNWpJbWZlLzEy?=

=?utf-8?B?TzBDc0djYUF6YXVRMVJOS2M0aGhOczgyc0xBdUdxNC9uRmhZVlp5SklxSGNM?=

=?utf-8?B?Q2JHSkpWWE9MVFRHUDE1Y0FNSzMycThXOTVEUGQwYnpJVWZGZkhDSDU3WW1W?=

=?utf-8?B?bGVpOGUrT0ZrcmlrMDZKNzZwZUlHTWtNU3h3R2QzeTN1RXJqMno1eUdUZ0o4?=

=?utf-8?B?UnB4NFlnVU9FQUR2SGV0SFBJdnFWZlh1akZ0Tmw2dk5DNUJDcWRUYmNvSCtx?=

=?utf-8?B?TlhtbDdsTVROY1BMWmtKdk11S3lUMlhVWC9hWDJZd1M2bGtmSFlMbTc5MExz?=

=?utf-8?B?c1R5T2lNN2Q4N05aajBrVzQ2cEw1Qm1QNFU0QTdVVW9rczRReGJXTzBOVnJZ?=

=?utf-8?B?NWtGc0RMSHAwZ3lPTVVzZ052R0pQUVc4RkhXK2xIdk5TUWFpTklZdTN5NHBV?=

=?utf-8?B?K21xdGM1Z1BqUEFUOG9icm5kM2NhTEdZd081bmtYbS9YQkZWb0d0cUlPUHcy?=

=?utf-8?B?bWdLRkRqMXd5OStIYU1PejVGYnc0elBDc1VzMUJIc2g0amNYbFFhYUgwOWVi?=

=?utf-8?B?NjAwUm9nWFJBZ3JwWXpKVldZVFlTa0FPY1pLSXBnbUpkdFRoQ0RqdFgyTGlD?=

=?utf-8?B?YnFsWHhZbEd4Vm4xVWZSNlB5Ni9nMUgzVWhLQitMSkVqS1NmeVBIT1lCL1Iv?=

=?utf-8?B?UHM5SVNMZWNZUUZWaWN0cTk3K2xCVmh0NUIzL2RZTXBZQzJTT1RFT3BwdmNW?=

=?utf-8?B?aUorVGFXNXNDQngzRkplaU85YTRoQjI5b0RQNVY5N1VkSlovQXgyMUkyNGt3?=

=?utf-8?B?Vk9pbE1IL1RFM2RaTmY2NEY2VGdkc2RrVXZrdG5JNysrL2ZaZEFhdUtIZVhN?=

=?utf-8?B?M2Jjd213bGJtc2h0T1FZRmhQTXpFRm12UkdzcFduZXlyQTJ5ci9PcE9Qem8z?=

=?utf-8?B?VDFBMEFUZWlSR2lYMzhIeVYzMnF5c1dtcmtNZ21IUjhURW5qenVBdWdLVzlT?=

=?utf-8?B?akZCR2hTczRZRDUvYlBUMEQ1Z2RwMzhqV0IzbnJBKzcra0wxQ3BqMlM4Qjky?=

=?utf-8?B?aFRJbGk2alp5Yk9SUjdXdmxVaWZBQWVRdlBhSUtxZnlJN3hWSHQxNGVLdm1B?=

=?utf-8?B?NWFPbXdiRTRsWmdnaGNuVWJVMU14MHlJaTR3aXVKZ3kxcDBkM2hTT0pXK291?=

=?utf-8?B?TEFpMUJJd2ZqK3I2eXdvZ3U1eU14WmxGT0FTSjBHQmxYTnVxOTF3dUlkUExv?=

=?utf-8?B?OTZUa00zNWg1RjVheUJhZkZaRjNCSGxZOHJPMVVoYjNIdUlLN2pseDkvN3Zp?=

=?utf-8?B?V095YWhGNTl0eE5vcis5eDZWaHFGRUVVaTBLOGxFUTFvc3B3QUg1bURNdFN6?=

=?utf-8?Q?LmhuDoVKBhpTasFH3Q3cfQ6l/s?=

X-Forefront-Antispam-Report:

CIP:51.158.238.185;CTRY:NL;LANG:en;SCL:9;SRV:;IPV:NLI;SFV:SPM;H:unical.it;PTR:185-238-158-51.instances.scw.cloud;CAT:OSPM;SFS:(13230040)(376014)(34020700016)(82310400026)(36860700013)(41320700013)(61400799027)(1032899013)(69100299015)(4022899009)(8096899003)(2066899003)(4076899003)(8135299006)(13003099007)(16110700003);DIR:OUT;SFP:1501;

X-OriginatorOrg: cfbjibs.temptingfragrances.com

X-MS-Exchange-CrossTenant-OriginalArrivalTime: 18 Dec 2025 01:03:17.8666

(UTC)

X-MS-Exchange-CrossTenant-Network-Message-Id: 2ee3104e-d3b2-43fa-f9cf-08de3dd13b10

X-MS-Exchange-CrossTenant-Id: a56ba61c-afa1-4cb0-a86d-f691f8c4bec4

X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=a56ba61c-afa1-4cb0-a86d-f691f8c4bec4;Ip=[51.158.238.185];Helo=[unical.it]

X-MS-Exchange-CrossTenant-AuthSource:

CY4PEPF0000E9D3.namprd03.prod.outlook.com

X-MS-Exchange-CrossTenant-AuthAs: Anonymous

X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem

X-MS-Exchange-Transport-CrossTenantHeadersStamped: DM6PR16MB3670

X-Spam_score: 9.0

X-Spam_score_int: 90

X-Spam_bar: +++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Welcome to [Coded Mails] Preview - Welcome to Offer






































































Click here to see in your browser, or you can unsubscribe from all future emails.














































Â






















Cabela's Phishing from Microsoft Outlook Part 3

















Preview - Welcome to Offer






Cabela's Phishing from Microsoft Outlook Part 2

Content analysis details: (5.3 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[51.158.238.185 listed in will-spam-for-food.eu.org]

[51.158.238.185 listed in will-spam-for-food.eu.org]

[51.158.238.185 listed in will-spam-for-food.eu.org]

[51.158.238.185 listed in will-spam-for-food.eu.org]

[51.158.238.185 listed in will-spam-for-food.eu.org]

[51.158.238.185 listed in will-spam-for-food.eu.org]

[51.158.238.185 listed in will-spam-for-food.eu.org]

[51.158.238.185 listed in will-spam-for-food.eu.org]

[2603:10b6:208:2c1:cafe:0:0:35 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:208:2c1:cafe:0:0:35 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:208:2c1:cafe:0:0:35 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:208:2c1:cafe:0:0:35 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:208:2c1:cafe:0:0:35 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:208:2c1:cafe:0:0:35 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:208:2c1:cafe:0:0:35 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:208:2c1:cafe:0:0:35 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:208:2c1:0:0:0:7 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:208:2c1:0:0:0:7 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:208:2c1:0:0:0:7 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:208:2c1:0:0:0:7 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:208:2c1:0:0:0:7 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:208:2c1:0:0:0:7 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:208:2c1:0:0:0:7 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:208:2c1:0:0:0:7 listed in]

[will-spam-for-food.eu.org]

[52.102.146.47 listed in will-spam-for-food.eu.org]

[52.102.146.47 listed in will-spam-for-food.eu.org]

[52.102.146.47 listed in will-spam-for-food.eu.org]

[52.102.146.47 listed in will-spam-for-food.eu.org]

[52.102.146.47 listed in will-spam-for-food.eu.org]

[52.102.146.47 listed in will-spam-for-food.eu.org]

[52.102.146.47 listed in will-spam-for-food.eu.org]

[52.102.146.47 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[51.158.238.185 listed in dnsbl.ahbl.org]

[51.158.238.185 listed in dnsbl.ahbl.org]

[51.158.238.185 listed in dnsbl.ahbl.org]

[51.158.238.185 listed in dnsbl.ahbl.org]

[52.102.146.47 listed in dnsbl.ahbl.org]

[52.102.146.47 listed in dnsbl.ahbl.org]

[52.102.146.47 listed in dnsbl.ahbl.org]

[52.102.146.47 listed in dnsbl.ahbl.org]

[2603:10b6:208:2c1:0:0:0:7 listed in]

[dnsbl.ahbl.org]

[2603:10b6:208:2c1:0:0:0:7 listed in]

[dnsbl.ahbl.org]

[2603:10b6:208:2c1:0:0:0:7 listed in]

[dnsbl.ahbl.org]

[2603:10b6:208:2c1:0:0:0:7 listed in]

[dnsbl.ahbl.org]

[2603:10b6:208:2c1:cafe:0:0:35 listed in]

[dnsbl.ahbl.org]

[2603:10b6:208:2c1:cafe:0:0:35 listed in]

[dnsbl.ahbl.org]

[2603:10b6:208:2c1:cafe:0:0:35 listed in]

[dnsbl.ahbl.org]

[2603:10b6:208:2c1:cafe:0:0:35 listed in]

[dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[51.158.238.185 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[51.158.238.185 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[51.158.238.185 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[51.158.238.185 listed in dnsbl.ahbl.org]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[52.102.146.47 listed in list.dnswl.org]

0.0 RCVD_IN_VALIDITY_CERTIFIED_BLOCKED RBL: ADMINISTRATOR NOTICE: The

query to Validity was blocked. See

https://knowledge.validity.com/hc/en-us/articles/20961730681243

for more information.

[52.102.146.47 listed in sa-trusted.bondedsender.org]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

0.0 RCVD_IN_VALIDITY_SAFE_BLOCKED RBL: ADMINISTRATOR NOTICE: The query to

Validity was blocked. See

https://knowledge.validity.com/hc/en-us/articles/20961730681243

for more information.

[52.102.146.47 listed in sa-accredit.habeas.com]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-0.0 SPF_HELO_PASS SPF: HELO matches SPF record

0.0 ARC_SIGNED Message has a ARC signature

0.0 ARC_VALID Message has a valid ARC signature

0.0 AXB_X_FF_SEZ_S Forefront sez this is spam

0.0 FROM_LOCAL_DIGITS From: localpart has long digit sequence

0.3 FROM_LOCAL_HEX From: localpart has long hexadecimal sequence

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[52.102.146.47 listed in wl.mailspike.net]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[52.102.146.47 listed in bl.score.senderscore.com]

0.0 RCVD_IN_VALIDITY_RPBL_BLOCKED RBL: ADMINISTRATOR NOTICE: The query to

Validity was blocked. See

https://knowledge.validity.com/hc/en-us/articles/20961730681243

for more information.

[52.102.146.47 listed in bl.score.senderscore.com]

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 HTML_MESSAGE BODY: HTML included in message

0.8 HTML_IMAGE_RATIO_02 BODY: HTML has a low ratio of text to image area

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

1.0 MR_DIFF_MID No description available.

1.0 FORGED_SPF_HELO No description available.

Subject: {SPAM?} Fwd: Your Cabela's Feedback is Valued + Free Gift





Welcome to [Coded Mails]





















Cabela's Phishing from Microsoft Outlook Part 1

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Wed, 17 Dec 2025 20:18:00 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vW4WH-00000000EaX-0n4Z

for dave@doctor.nl2k.ab.ca;

Wed, 17 Dec 2025 20:17:37 -0700

Resent-From: The Doctor

Resent-Date: Wed, 17 Dec 2025 20:17:37 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-northcentralusazhn15013047.outbound.protection.outlook.com ([52.102.146.47]:16881 helo=CH4PR04CU002.outbound.protection.outlook.com)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.98.2 (FreeBSD))

(envelope-from <2165383686137285264283691967094829955733@cfbjibs.temptingfragrances.com>)

id 1vW1mi-000000009E2-3JcS

for root@nl2k.ab.ca;

Wed, 17 Dec 2025 17:22:33 -0700

ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none;

b=WjYAlvA02XscGjtHwrMFb99OzR7l9GXg/QIzdKFJdKn9nNEmeW1EuW2969AMqUgcaT/VEUW5O54POZlnGqI1e7mL5TWIIiLk39wO/urX7oqS+qQ2E9FACGfQpPXG0VK/9F+HKsDMVswlJXfy1BMruz0BlsLSYr6uXF4YyizVYAcWqu4gE/xoP6Arz5vYF7IE0d9Wp4GDvwhEDNZ4DOXo9ShrUl60lCZdQ+t0m9YKgiWPq3RA0Q3l1jHZbha8Rq4MB6nMa1ambKIl3f1pYT4tnpgMtqpljyDkCxA071ZyEOOSvjg8K/QFTcJW9v4HdDzIuuXYO758VezQD4tEdAvwnw==

ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;

s=arcselector10001;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1;

bh=fXo51oa0S013LIhz0GYMH5PgsWL8XeapMwJRWA6R3Ik=;

b=A8jQTXqY473/vswL8mJeqTQkYFQGUvpcowwjvSDNvSlVVvytdbzcDnD/1cJUFNGllkwus0JmenXRzYu5ezjctMB8AP1MiYzKdLsxwQd9Waqrr86RBo5Y4L8KCIl3QDKoh3ZItkWTmMgb/v3bDH/fvsJWDYB6gOKtomZvgcHjtlmNgenFm/ojbBgA2DDbsJsiqyr+9tj9bYr5Q9zzfeeVPdilx9EHFfeZFvw/m7+tWAI3U7YpbfR+CmfgFqjvFuZ/YNR6B9r0GGu0QpMIKD6+epfiBIm0kki1hLcw8LKkGGU/CkjGekkJaNFhLEcZ9qundtYfqpfq5TDy+MQVIaBSxQ==

ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=none (sender ip is

51.158.238.185) smtp.rcpttodomain=nl2k.ab.ca

smtp.mailfrom=cfbjibs.temptingfragrances.com; dmarc=none action=none

header.from=cfbjibs.temptingfragrances.com; dkim=none (message not signed);

arc=none (0)

Received: from BL1PR13CA0302.namprd13.prod.outlook.com (2603:10b6:208:2c1::7)

by BY1PR16MB6526.namprd16.prod.outlook.com (2603:10b6:a03:4a7::13) with

Microsoft SMTP Server (version=TLS1_2,

cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.9434.7; Thu, 18 Dec

2025 00:21:31 +0000

Received: from BL6PEPF0001AB4B.namprd04.prod.outlook.com

(2603:10b6:208:2c1:cafe::35) by BL1PR13CA0302.outlook.office365.com

(2603:10b6:208:2c1::7) with Microsoft SMTP Server (version=TLS1_3,

cipher=TLS_AES_256_GCM_SHA384) id 15.20.9434.6 via Frontend Transport; Thu,

18 Dec 2025 00:21:31 +0000

X-MS-Exchange-Authentication-Results: spf=none (sender IP is 51.158.238.185)

smtp.mailfrom=cfbjibs.temptingfragrances.com; dkim=none (message not signed)

header.d=none;dmarc=none action=none

header.from=cfbjibs.temptingfragrances.com;

Received-SPF: None (protection.outlook.com: cfbjibs.temptingfragrances.com

does not designate permitted sender hosts)

Received: from unical.it (51.158.238.185) by

BL6PEPF0001AB4B.mail.protection.outlook.com (10.167.242.69) with Microsoft

SMTP Server id 15.20.9434.6 via Frontend Transport; Thu, 18 Dec 2025 00:21:30

+0000

From: Cabela's Survey Invitation <72926758480153850171775236916@cfbjibs.temptingfragrances.com>

To: root@nl2k.ab.ca

Subject: Fwd: Your Cabela's Feedback is Valued + Free Gift

Message-ID: <2001551712.sdze.0794482493985@qrivo.co>

MIME-Version: 1.0

Date: Thu, 18 Dec 2025 00:16:59 +0000

Content-Type: text/html; charset=utf-8

X-SES-Outgoing: Thu, 18 Dec 2025 00:16:59 +0000-51.158.238.185

In-Reply-To:

Errors-To: abuse@nCLFdztjFI.google.com

List-Unsubscribe:

References:

X-EOPAttributedMessage: 0

X-MS-PublicTrafficType: Email

X-MS-TrafficTypeDiagnostic: BL6PEPF0001AB4B:EE_|BY1PR16MB6526:EE_

X-MS-Office365-Filtering-Correlation-Id: 439b1b79-ee34-4507-a1fa-08de3dcb64c1

X-MS-Exchange-SenderADCheck: 1

X-MS-Exchange-AntiSpam-Relay: 0

X-Microsoft-Antispam:

BCL:0;ARA:13230040|1032899013|4022899009|82310400026|376014|61400799027|34020700016|36860700013|41320700013|69100299015|13003099007|4076899003|2066899003|8096899003|16110700003;

X-Microsoft-Antispam-Message-Info:

=?utf-8?B?M1dhcUwweHRCM1VQOFMyazhySzlqVk1QWWt0aURaKzVrVThTc3F5R0pBcHQx?=

=?utf-8?B?KzdWSnU1SWgxTUFpYmVacWlzb3I1VitOZFhWc1BSc2o4OFV0a0Zqdklmb21m?=

=?utf-8?B?NUQyMExnL3JVdEd0cnRUUWxkcDFMVnZNZ0F1N21MUjFMVlVvL2JSMzc0WVlS?=

=?utf-8?B?ZW5FckgwakVOQ2FoT3hFL0FneTROMXV5ZXJFVkY5eWV2alhNdTRWd1cwUjJx?=

=?utf-8?B?VFhRSlB5dHpvT1NPMy8xaWh4NnVtYUs3Q1pMNE1hN1RiOWlTQWNuQXNuVUNw?=

=?utf-8?B?UXBNVUhiZXBESTJiRGtpWHlFUk1BVis3Sldob2dPQzNrU2dmam53S204WWZu?=

=?utf-8?B?eHN3TXdBRkMwek9GUEVEVnFqeVRrWHhkUGpFS0lFVzNBOWJIVGVLTUNROFZY?=

=?utf-8?B?aTdMVWljZ0g4SUFqOVNtdVFSQVR2aWwxUEoxWjBRWVdZbHB4MkN1YzFMamoz?=

=?utf-8?B?dkRwMExpQmE2Q1YxakZDSllDcCt1bVJlVmFSUTNFWUY4YncvSG0zQjdCSDZh?=

=?utf-8?B?NEQ1U0NhQ203TUNEeGVNUHk0NndhbzZjYjBEdXpROTdLTnhabGVZRmxHQkg0?=

=?utf-8?B?WEJReXpqNmRkeE85cVhiSCs3YXFJazE1MThjbGdmMm50UWU4RWpVNXZrWEFR?=

=?utf-8?B?UGgyNHVIVEU4b3RjQ1lrd2ZJaUk2ZFJpOGdLb1hIUW9xR2ZERXQ4ZHg5a0cr?=

=?utf-8?B?b3pwcFBpbGw4Rno3ZWg0RDlEOXU5Nlg4aTA5TG5RT29qbEdiRi81Q09Maks1?=

=?utf-8?B?RTRYcW1xdDRTWGRsZFdRS1JxM2tENzc0MDRKTXpZWmZiRWpQa2ZVTXh5QUxJ?=

=?utf-8?B?MC9iMitaVUljVStYT05hN2RSeitSeGdQT3NLck0waVFmQ3E4YWhzaEgxQUw0?=

=?utf-8?B?V3RiTjdsZHBlNmlObEhZOUtiRU10d1MyMVB3UzlRVnI1eXAwdHFYVFNqQ1F4?=

=?utf-8?B?MFFkNEpTMUp1enNvdG1vTEZ6L0wrQmVjYXNXMTBGbjNsejhVRVJKVHpUWVZk?=

=?utf-8?B?cFBPNnVmdjd0QkN2dUM2V1RsTytWNDBnMUxZaWJJamFDenVDK0xLVW5NMXRY?=

=?utf-8?B?UFFHd2loNThTbHVmVlhWeGF5VUhGSE9WN3l5WXlVeTIyU2szRWpMa0J1bHI3?=

=?utf-8?B?YytEZ1RBZVlUQUIva3pNNUFLcHFLU1EyTE45aTZGeGxUWVlaYmIxRklmdGlM?=

=?utf-8?B?aGNQQlZLRzZNTzdWWXdHL3VvaXhFa24zQUtUTFZTdzc5VHFHMmlOS2I3ZUpM?=

=?utf-8?B?TzQ2ZjVQM3A5RkR4Ri9RQW9BUmFxUkMvUGNiNHVJSjBjeTFXbHZUeW5PS1d2?=

=?utf-8?B?WURid0dkdUpzMVoyMjN4WkY4dHFVUTFGUHkwVVJZam1Wc0ZKaGRUSHk4eHpC?=

=?utf-8?B?WnlYcmN4aFBrT1BPUnVvM21MS1pBL2orajhsWTN3L2Q1eG8zLzRGdTNvYjV5?=

=?utf-8?B?ZUNCUDhWMml6WDU3U3NPZzVZRjZ6T3UzZm9YaHg0bm1IdGRJZlJxZ3VOdExX?=

=?utf-8?B?c2FwNzF3VmkxbzlUcWpTYXhXdTZKUzUreFpVWisyV0pDNkpkQzgwM24vTUlt?=

=?utf-8?B?M1lkclRkdENBTFBzZ1ZrTzRWcStxOG0vcTdjMTY0Y1hmcElyYkowWXoxNnNk?=

=?utf-8?B?a3RxYVZzZ1J4VHcwVEErMjRoc3kxR1NRRHE2T3d1SG1GOG9aYzVvRXY3TDdj?=

=?utf-8?B?YTllcDlUTnZ0VTZMMXJpa3BQKzFHKzA5eEsxSUZ3S0RINHhYY1J4SjVTMXBB?=

=?utf-8?B?N1d4emJsa3VZUVJhZkFHQVpZcExsb1RwZGNJelVxaWU2Tmk5UGJZSzY3K2Fj?=

=?utf-8?B?TG5wZVBIRFVSdFd3VW5MLzFoRVNsK1BMVWUzSGFZNDF0OFFjNzZwV0xjbHdJ?=

=?utf-8?B?dEU1L2xnNnVvVjM1eXdTS2ZFY0d0ZGk1ejl6RnpyVDJ0M1NteCt0MUNjRU1I?=

=?utf-8?B?dW5XU0x1TTVWbjgrK1FOcGY5cUFZM0FKdzc1K2xpZXFWK1FyWFZ6a2o2bTY0?=

=?utf-8?B?clZpNmNUcUpJUmQ1dCtEUDFadlpERXV4c0txMTZyaWhyWlJnakNHRUZJb3Vr?=

=?utf-8?B?T0lJcmd0VVRMTmJoQ3BVRHF2Vzgwc1J2bVBzRHh3RTZGR2tPT1kyaWZaMDkr?=

=?utf-8?B?ZE52Z1RsWTJiWEgvVUhjZzNleldaZWtybGU4U0hVSS92NnN3UmsyYUJGaHBZ?=

=?utf-8?B?YXBIZ0dBTThHWkV4S2FUUHdyc25NeTF5K0VGeXNWbEFKY09Ca0VNK1NnOWpt?=

=?utf-8?B?TmYrTzRBeURhd2l1dTFXOEJibERiUFNTS1RTV1A2bWQvS002ZFJQTWZ4VFNC?=

=?utf-8?B?NVBlRHRTMXk3QXdya0E0MTFmNVE5cHlnZW9MY3pObm50dGpJWVYxcHdiUzdS?=

=?utf-8?B?NlMvMUFkL0ZPdFZkWVQ5OUNyaFY4ZlBuU0tSOU5QL21NTWxSSWdzUGtSUEpP?=

=?utf-8?B?a1hscVo5OUJTY2JlOVI4a1FtWmxQR2tWN2ZNWVdyYzRxZkhLSE1Rc0hWc200?=

=?utf-8?B?bnlBNFl0cFN2SGZwSy9UWlJjdmNRS0pPWmRRWU9OMVI2b2ZKSmwrQis4RGVV?=

=?utf-8?B?K0VKbXZGbWgxRisrY2YzWTlJbThXTjltMk1kWHlXZ2dXODJPQkY5S2tQSGpI?=

=?utf-8?B?dEhCdG5LTUZtKzltOEZ1azBKdjR6Yy9ZSHo1VTB3WElZRVlDRHpUMkYrcEVL?=

=?utf-8?B?aCtCK0JPN3U1cnlROXRqdnVGQVFtTnFCMXFPdE9Fdm10UStCUVNLN2VGNDQ4?=

=?utf-8?B?V3R3bHJxZlBlajdCVlU5MnBnNDZZV0lOcGVaRjlqdjB2TnZxNlE4NzVvVHRK?=

=?utf-8?B?LzR5Tkd3RDlWQUVwd0kyc0JKMDBQWUZxN0VyZVlCRnBhMkk2YXlkRC9GWVJP?=

=?utf-8?B?bi9OalJWRnduSVhQQ3lvTVIwajhKZnozc3h1QXBZQ1BHYzFxcTRMZ0hlYlhj?=

=?utf-8?B?ZGpNdVpVZEpzVXB4MmxrSnh6RTRBdG12MVRzOUFPcEZOdWtPWXZnOVI3S2NH?=

=?utf-8?B?THQ2RWZiZlRpNkFvR1RraGJzSmVubXp4OGQ3ZFBmT1lMRjJyS1daWDlZVWda?=

=?utf-8?B?aDROZzlXMGszTmhYa3NvSmdSdzJXRjNzWFZqWlVtZ0ltdHBld2UzVWpIbnFW?=

=?utf-8?B?RDFXVGh1bEhvWGk2RXJZOXBQZGI3bmlUOG1GZ0VVQmNoSncyVmpBaGpnaWZw?=

=?utf-8?B?SElUZDlnb2s1RVE2VG5Fc0c1TmxOYUhzWmczdVBQVkdyTDNEeHgwTUZQaGUy?=

=?utf-8?B?Q3lyTU1IZzFpQ0VFeEJOUkJremVLZS9wRDFBM0loUjViMWdkOUZTNVJsTnUx?=

=?utf-8?B?dWRRbHJJa3VjTGZDeVRnKzR5WmVlV0Z3PT0=?=

X-Forefront-Antispam-Report:

CIP:51.158.238.185;CTRY:NL;LANG:en;SCL:9;SRV:;IPV:NLI;SFV:SPM;H:unical.it;PTR:185-238-158-51.instances.scw.cloud;CAT:OSPM;SFS:(13230040)(1032899013)(4022899009)(82310400026)(376014)(61400799027)(34020700016)(36860700013)(41320700013)(69100299015)(13003099007)(4076899003)(2066899003)(8096899003)(16110700003);DIR:OUT;SFP:1501;

X-OriginatorOrg: cfbjibs.temptingfragrances.com

X-MS-Exchange-CrossTenant-OriginalArrivalTime: 18 Dec 2025 00:21:30.9200

(UTC)

X-MS-Exchange-CrossTenant-Network-Message-Id: 439b1b79-ee34-4507-a1fa-08de3dcb64c1

X-MS-Exchange-CrossTenant-Id: a56ba61c-afa1-4cb0-a86d-f691f8c4bec4

X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=a56ba61c-afa1-4cb0-a86d-f691f8c4bec4;Ip=[51.158.238.185];Helo=[unical.it]

X-MS-Exchange-CrossTenant-AuthSource:

BL6PEPF0001AB4B.namprd04.prod.outlook.com

X-MS-Exchange-CrossTenant-AuthAs: Anonymous

X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem

X-MS-Exchange-Transport-CrossTenantHeadersStamped: BY1PR16MB6526

X-Spam_score: 5.3

X-Spam_score_int: 53

X-Spam_bar: +++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Welcome to [Coded Mails] Preview - Welcome to Offer

Cabela's Phishing from Microsoft Outlook Part 4



























































































Click here to see in your browser, or you can unsubscribe from all future emails.














































Â
























Cabela's Phishing from Microsoft Outlook Part 3

p {

display: block;

margin: 13px 0;

}



























Preview - Welcome to Offer






































Â






























Cabela's Phishing from Microsoft Outlook Part 2



Content analysis details: (5.5 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[51.158.238.185 listed in dnsbl.ahbl.org]

[51.158.238.185 listed in dnsbl.ahbl.org]

[51.158.238.185 listed in dnsbl.ahbl.org]

[51.158.238.185 listed in dnsbl.ahbl.org]

[52.102.140.22 listed in dnsbl.ahbl.org]

[52.102.140.22 listed in dnsbl.ahbl.org]

[52.102.140.22 listed in dnsbl.ahbl.org]

[52.102.140.22 listed in dnsbl.ahbl.org]

[2603:10b6:510:32b:cafe:0:0:4 listed in]

[dnsbl.ahbl.org]

[2603:10b6:510:32b:cafe:0:0:4 listed in]

[dnsbl.ahbl.org]

[2603:10b6:510:32b:cafe:0:0:4 listed in]

[dnsbl.ahbl.org]

[2603:10b6:510:32b:cafe:0:0:4 listed in]

[dnsbl.ahbl.org]

[2603:10b6:510:32b:0:0:0:9 listed in]

[dnsbl.ahbl.org]

[2603:10b6:510:32b:0:0:0:9 listed in]

[dnsbl.ahbl.org]

[2603:10b6:510:32b:0:0:0:9 listed in]

[dnsbl.ahbl.org]

[2603:10b6:510:32b:0:0:0:9 listed in]

[dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[51.158.238.185 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[51.158.238.185 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[51.158.238.185 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[51.158.238.185 listed in dnsbl.ahbl.org]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

0.0 RCVD_IN_VALIDITY_CERTIFIED_BLOCKED RBL: ADMINISTRATOR NOTICE: The

query to Validity was blocked. See

https://knowledge.validity.com/hc/en-us/articles/20961730681243

for more information.

[52.102.140.22 listed in sa-trusted.bondedsender.org]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

0.0 RCVD_IN_VALIDITY_SAFE_BLOCKED RBL: ADMINISTRATOR NOTICE: The query to

Validity was blocked. See

https://knowledge.validity.com/hc/en-us/articles/20961730681243

for more information.

[52.102.140.22 listed in sa-accredit.habeas.com]

0.0 ARC_SIGNED Message has a ARC signature

0.0 ARC_VALID Message has a valid ARC signature

0.0 AXB_X_FF_SEZ_S Forefront sez this is spam

0.0 FROM_LOCAL_DIGITS From: localpart has long digit sequence

0.3 FROM_LOCAL_HEX From: localpart has long hexadecimal sequence

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[2603:10b6:510:32b:cafe:0:0:4 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:510:32b:cafe:0:0:4 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:510:32b:cafe:0:0:4 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:510:32b:cafe:0:0:4 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:510:32b:cafe:0:0:4 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:510:32b:cafe:0:0:4 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:510:32b:cafe:0:0:4 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:510:32b:cafe:0:0:4 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:510:32b:0:0:0:9 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:510:32b:0:0:0:9 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:510:32b:0:0:0:9 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:510:32b:0:0:0:9 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:510:32b:0:0:0:9 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:510:32b:0:0:0:9 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:510:32b:0:0:0:9 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:510:32b:0:0:0:9 listed in]

[will-spam-for-food.eu.org]

[52.102.140.22 listed in will-spam-for-food.eu.org]

[52.102.140.22 listed in will-spam-for-food.eu.org]

[52.102.140.22 listed in will-spam-for-food.eu.org]

[52.102.140.22 listed in will-spam-for-food.eu.org]

[52.102.140.22 listed in will-spam-for-food.eu.org]

[52.102.140.22 listed in will-spam-for-food.eu.org]

[52.102.140.22 listed in will-spam-for-food.eu.org]

[52.102.140.22 listed in will-spam-for-food.eu.org]

[51.158.238.185 listed in will-spam-for-food.eu.org]

[51.158.238.185 listed in will-spam-for-food.eu.org]

[51.158.238.185 listed in will-spam-for-food.eu.org]

[51.158.238.185 listed in will-spam-for-food.eu.org]

[51.158.238.185 listed in will-spam-for-food.eu.org]

[51.158.238.185 listed in will-spam-for-food.eu.org]

[51.158.238.185 listed in will-spam-for-food.eu.org]

[51.158.238.185 listed in will-spam-for-food.eu.org]

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[52.102.140.22 listed in wl.mailspike.net]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[52.102.140.22 listed in bl.score.senderscore.com]

0.0 RCVD_IN_VALIDITY_RPBL_BLOCKED RBL: ADMINISTRATOR NOTICE: The query to

Validity was blocked. See

https://knowledge.validity.com/hc/en-us/articles/20961730681243

for more information.

[52.102.140.22 listed in bl.score.senderscore.com]

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 HTML_MESSAGE BODY: HTML included in message

0.8 HTML_IMAGE_RATIO_02 BODY: HTML has a low ratio of text to image area

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.8 SARE_FROM_SPAM_WORD3 I don't know people named this!

1.0 MR_DIFF_MID No description available.

0.4 KHOP_HELO_FCRDNS Relay HELO differs from its IP's reverse DNS

Subject: {SPAM?} Fwd: Exclusive: Yeti Outdoor Bundle for Your Feedback





Welcome to [Coded Mails]