Spear phishing / Whaling from Microsoft Outlook
Posted by Dave Yadallee onX-Mozilla-Status2: 00000000
Return-path:
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Fri, 24 Apr 2026 12:49:00 -0600
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))
(envelope-from
id 1wGLZb-00000000FAQ-2X1D
for dave@doctor.nl2k.ab.ca;
Fri, 24 Apr 2026 12:48:19 -0600
Resent-From: The Doctor
Resent-Date: Fri, 24 Apr 2026 12:48:19 -0600
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from [52.101.56.78] (port=19897 helo=BN1PR04CU002.outbound.protection.outlook.com)
by doctor.nl2k.ab.ca with esmtp (Exim 4.98.2 (FreeBSD))
(envelope-from
id 1wGL0j-00000000AAC-49LF
for root@nk.ca;
Fri, 24 Apr 2026 12:12:28 -0600
ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none;
b=NUJUweyIKkG4jpfznYU/d4IoVPtYO+nTvqBlfrC5Vnx2HiU8uddAN1Cpown056WpF0CPWP0zCrP0isVOcPjPEw5oLB8slC0pJu+mPsfwvjWeyuOtfonUOyN6TwSFB+nEKia6HgoG4a9dEC/dYCfw4Wqcg+03SKiBMR2vK0vjpnNhlZLzePWzz95xKpBy4QdgdttgS8d6pUzowFE4CvzambP13D7DIyY9vGgx0EH7cMyrKquC40agXMUlDrllejfHwzXD1+5uVJq8kjJAo/Awnkb+F94vW+G6eunye4vZYhgCKlBMNe0XrUkr/dIz+KBqg35usQJ3UJrf4h5XyK2bIQ==
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;
s=arcselector10001;
h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1;
bh=5ePwmMF4TuhLUxEe/sY7Z9KEYmwXMyc1slC4J0R1iA0=;
b=GEyibcplQhLqdeq+XQb9ek533o7oowKiW+mmzxBUFJeeEZ/Ik1ZcnDl4GyMPwRPJEbSYTiqi3F88PZGrRCgPby5HFs2qdkx5teMyhcFLzyGIwG6yDxWotau3bH6UQE5U3l47iQq6uCrDZ56WZzEvsMBCTUIsI1VIEUQncRswHY6+7RRyBivyWmbq/NGNLx6EP2DixImoYyF3m/gw5UMOgKvr4qbDbcxAeYUNVXi7SJ5yjE2oImKvlTaf1JyWXMgv37QeSI0r92vXlkazVcqtDBU4SJdBcmSjq1aGxxDR9FaaMz4fMycwEaE6+r0FJnnK2JKyGw79Blpuia5ROqeXRw==
ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=none (sender ip is
66.235.175.121) smtp.rcpttodomain=nk.ca
smtp.mailfrom=smartfinancereports.com; dmarc=none action=none
header.from=smartfinancereports.com; dkim=none (message not signed); arc=none
(0)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=smartfinancereports.com; s=selector1;
h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck;
bh=5ePwmMF4TuhLUxEe/sY7Z9KEYmwXMyc1slC4J0R1iA0=;
b=OlvaKgqpKeRYBBqgG40X8l5p75IiS5H5Jg4/e8qHJHUuuZfxiQpeUlRWErda5gMjHd6dIdHu51rJoyZNSF2G3/khBfo18UBAHJ9ABVfMVHfB16T07mAKLuhKSKCtGy0kwLz4XUVAkHugYuFMes7jkBiaHjmNkiSbFw8W3aRmm7Xki5CDFhVgpyfIbrEZUclh2DyEzRdXcYFVLw8zQqonWlLLPN4KiDD87sSGB+y5bOwgyKKpypfwEKk17dcg/BOPzJkcVCQ/5MdH1JQd71UUpHVMhR/2fDgOmC3y7r5MWZ6k/7NaDiVM1mb/2FaTis+W/nycYdEwMYLyvQSMyKwI/w==
Received: from BYAPR01CA0046.prod.exchangelabs.com (2603:10b6:a03:94::23) by
SA1PR18MB4791.namprd18.prod.outlook.com (2603:10b6:806:1de::14) with
Microsoft SMTP Server (version=TLS1_2,
cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.9846.22; Fri, 24 Apr
2026 18:11:18 +0000
Received: from SJ5PEPF000001CB.namprd05.prod.outlook.com
(2603:10b6:a03:94:cafe::2a) by BYAPR01CA0046.outlook.office365.com
(2603:10b6:a03:94::23) with Microsoft SMTP Server (version=TLS1_3,
cipher=TLS_AES_256_GCM_SHA384) id 15.20.9846.22 via Frontend Transport; Fri,
24 Apr 2026 18:11:18 +0000
X-MS-Exchange-Authentication-Results: spf=none (sender IP is 66.235.175.121)
smtp.mailfrom=smartfinancereports.com; dkim=none (message not signed)
header.d=none;dmarc=none action=none header.from=smartfinancereports.com;
Received-SPF: None (protection.outlook.com: smartfinancereports.com does not
designate permitted sender hosts)
Received: from WIN-TOKEA7RFKOO (66.235.175.121) by
SJ5PEPF000001CB.mail.protection.outlook.com (10.167.242.40) with Microsoft
SMTP Server id 15.20.9846.18 via Frontend Transport; Fri, 24 Apr 2026
18:11:17 +0000
From: "PETER DENSE"
Subject: Opportunities with AGP Global Capital
To: root@nk.ca
Content-Type: multipart/alternative; charset="ISO-8859-1"; boundary="mr8jM5BUQPohPS5=_vPWuyxxXZg8GLBcks0"
MIME-Version: 1.0
Reply-To: peterdensen@outlook.com
Date: Fri, 24 Apr 2026 11:11:17 -0700
Message-ID:
<383633635143594822@smartfinancereports-com.mail.protection.outlook.com>
X-EOPAttributedMessage: 0
X-MS-PublicTrafficType: Email
X-MS-TrafficTypeDiagnostic: SJ5PEPF000001CB:EE_|SA1PR18MB4791:EE_
X-MS-Office365-Filtering-Correlation-Id: 32bbd8ab-ef91-49d7-e109-08dea22ce168
X-MS-Exchange-SenderADCheck: 1
X-MS-Exchange-AntiSpam-Relay: 0
X-Microsoft-Antispam:
BCL:0;ARA:13230040|376014|36860700016|82310400026|1800799024|18002099003|56012099003|8096899003;
X-Microsoft-Antispam-Message-Info:
DvDRfUkZAD6iSzhkibQSHf/Rcz5tkYq9nCaRNwV9FdHAjlokI/0N8p58BKKP5vnkJ4PTD6Y5dtRevTBD05m6xSG4dJIyYQR4y2m0n/YlpPGGD5Feu7uoYpNHUxnA3TlMKGu/5ZUqyLPzFLnOiIsQc/n5LeEMdrOHXylYA2dv2buexfi8oEi+4+JCLveJeWG3/3j/+cSHJkovBddhj57c3gDqHxKdN5PblbfA+apYljW4cq5FfS6JdDhRWYp6ZTnttMMvu9k2TK6EQtkwmOYsmtfnItCFyJrXYdc0SS//JR2WS7wzafrc8X2oxclBDc1MKPmxsAU1pcyEjqE7DoToerfmZF9Xa5Wi7xn9CRVGcPZPE6+KkFKhThYy3xWvKqtHRazBfSXOKXAOdCTGCpqGCpGwl5wM0uHjdRDGCACB7K5q7M7fmwx0PBAwqH2f01ZmBcP1uk79wfsXboCmhDfJqBxIEyhfTRqplxbd/pEjbVQMIrZ8yzbBV6Kdcz4IIhjCRrP9KSivf1VujsHvs8mcAf29E46BNODEkc7vDO4nT56q+C8NvoGbkkbabTfpHGjiETUSRZVl4/zRYU4N+S4XWt6XMT1rxthCptLaD83RTA3chJQAMhQSJwAWSNQVCNzJo/p7beslIz9K7BJZs67QZFYhoX1eOYygCRNvzVmCV60kA/YazC2tY6ZxWnZLPZGrAJ8+H8ojk7NZLxjiU2hL32BFWWN/9JzzMGdcNP6yJe7Vek0bW+Jh4S57U4YLCu6Q2ALO/hvNxu5Px8FJpn46Iw==
X-Forefront-Antispam-Report:
CIP:66.235.175.121;CTRY:US;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:WIN-TOKEA7RFKOO;PTR:InfoDomainNonexistent;CAT:NONE;SFS:(13230040)(376014)(36860700016)(82310400026)(1800799024)(18002099003)(56012099003)(8096899003);DIR:OUT;SFP:1102;
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0:
qTlG9HzGovlMHsgytZ2v09dBlSyBGv4uqET/LqGeHeBHQ916gc/+FuivrEoIllLsz7T/DoPB/U4WxfTYzSoZBCIiw0hcxrKJF7aFNDdZ1P+U32F1nVfGQOtxPfO0OawfjFQ9/LoyXlp3z2VzNN21opk1lki3swc+ClWCafNnDmSso3XYKWjeOGnZixYsjzDwdir5OvBTrRBa4tRWXC0NtHvKLUhCiPFV4tB013NFsIeQnkvyWX5X76RgG7IV+gvdi+m9YLVpJUlpSUe+Pr4iKd0AChZXQBBYsvSdThLYBtuYodZwPVgncT++c2w/z2pYPIqVifeamcSgP/+uLS0zTOcQeThxG2nTCVmhwNiN4NwpVNvAQEuvDQpY1g+cqmdezLgluoAuh8SJ+4iD4b9P4RWC5ioK9Z+129tywAh6K4T/qIuzh00BSi5lCoxeXOdl
X-OriginatorOrg: smartfinancereports.com
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 24 Apr 2026 18:11:17.5992
(UTC)
X-MS-Exchange-CrossTenant-Network-Message-Id: 32bbd8ab-ef91-49d7-e109-08dea22ce168
X-MS-Exchange-CrossTenant-Id: 762ebcd9-70c8-423b-b6b3-5327bc0a5aee
X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=762ebcd9-70c8-423b-b6b3-5327bc0a5aee;Ip=[66.235.175.121];Helo=[WIN-TOKEA7RFKOO]
X-MS-Exchange-CrossTenant-AuthSource:
SJ5PEPF000001CB.namprd05.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Anonymous
X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem
X-MS-Exchange-Transport-CrossTenantHeadersStamped: SA1PR18MB4791
This is a multi-part message in MIME format
--mr8jM5BUQPohPS5=_vPWuyxxXZg8GLBcks0
Content-Type: text/plain ; charset="ISO-8859-1"
Content-Transfer-Encoding: quoted-printable
Hi,
I=92m Peter Densen, CEO of AGP Global Capital. We provide fast, busine=
ss-purpose funding for companies and principals who need capital witho=
ut bank delays.
We fund:
=20
Bridge loans
=20
Working capital
=20
Asset-backed and structured financing
Recent closings include:
=20
$12.5M bridge funded in 14 days
=20
$2M working capital for a logistics firm
=20
$4.8M asset-backed liquidity loan
You=92re on our outreach list because your profile indicates active ca=
pital needs.
If you have a real transaction you=92re looking to close in Q1, let=92=
s speak briefly and see if we=92re a fit. Calls are straightforward an=
d decision-driven.
Reply here, and we=92ll take it from there
--mr8jM5BUQPohPS5=_vPWuyxxXZg8GLBcks0
Content-Type: text/html ; charset="ISO-8859-1"
Content-Transfer-Encoding: quoted-printable
Hi,
I=92m Peter Densen=
, CEO of AGP Global Capital=
. We provide fast, business=
-purpose funding for companies and principals wh=
o need capital without bank delays.
We fund:
Bridge loans
Working capital
Asset-backed and structured financing=
SPAN>
Recent closings include:
$12.5M bridge funded in 14 days=
$2M working capital for a logis=
tics firm
$4.8M asset-backed liquidity lo=
an
You=92re on our outreach list because y=
our profile indicates active capital needs.
If you have a real=
transaction you=92re looking to close in Q1, le=
t=92s speak briefly and see if we=92re a fit. Calls are straightforwar=
d and decision-driven.
Reply here, and we=92ll take it from there
<=/HTML>
--mr8jM5BUQPohPS5=_vPWuyxxXZg8GLBcks0--