Norton Phish from Google Gmail Part 3

Posted by Dave Yadallee on Tuesday, March 3. 2026

@font-face {

font-family: 'Google Sans';

font-style: normal;

font-weight: 700;

src: url(//fonts.gstatic.com/s/googlesans/v14/4UabrENHsxJlGDuGo1OIlLV154t=

zCwM.ttf) format('truetype');

}

=20

=20

=20

=20

Norton Phish from Google Gmail Part 4

Posted by Dave Yadallee on Tuesday, March 3. 2026

>
/InformAction">
/schema.org/Event">
org/EventScheduled"/>
p://schema.org/Organization">
ndar"/>
ll4ahk8eh1op5vtgng"/>
fff; line-height: 1px; height: 0; max-height: 0; width: 0; max-width: 0; op=

acity: 0; overflow: hidden;" itemprop=3D"name">9982-321-AYB payment confirm=

ed for Order
datetime=3D"20260304T050000Z">
"20260305T043000Z">
spacing=3D"0" role=3D"presentation" align=3D"center" style=3D"width:100%;" =

class=3D"body-container">
tr>

">

"0" cellspacing=3D"0" role=3D"presentation" align=3D"center" style=3D"width=

:100%;" class=3D"">

n itemscope itemtype=3D"http://schema.org/EmailMessage">

ription">Membership Date- 2026-03-04
Membership No- 1011-998-MND
Supp=

ort No- +1 (803) 234-0500

Hello Customer,

We appreciate your continued=

trust in N0RT0N LIFELOCK 360. Your subscription has been successfully rene=

wed in accordance with your prior electronic authorization.

A payment of =

USD318.33 has been processed for the applicable services.

Product Pricing=

Center
Purchase Item: Prime Protection Plan
Coverage Term: 4 Years
r>Total Amount Charged: $ 355.66

Thank you for your ongoing business.

I=

f you have any questions or would like further assistance, please contact 1=

{803} 234-0500. We value your feedback.

Thanks again,
Finance Head of=

N0RT0N LIFELOCK 360, LLC.
Jody B
.
.
.
.
.
.
.
=

.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
=

.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
=

.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
=

.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
=

.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
=

.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
=

.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
=

.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
=

.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
=

.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
=

.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
=

.
.
.
.
.
.
.
.
.
.
.
.
.
.

n>

ng=3D"0" role=3D"presentation" align=3D"center" style=3D"width:100%;" class=

=3D"">
tr>

; direction: rtl; font-size: 0; padding: 24px 32px; text-align: left; verti=

cal-align: top;" class=3D"main-container-inner">

tion: ltr; display: inline-block; vertical-align: top; width: 100%;overflow=

: hidden; word-wrap: break-word;">
lspacing=3D"0" role=3D"presentation" width=3D"100%" class=3D"main-column-ta=

ble-ltr" style=3D"padding-right: 32px; padding-left: 0;;table-layout: fixed=

;">

gn:top;">
esentation" width=3D"100%" style=3D"table-layout: fixed;">

font-size: 0; padding: 0; text-align: left; word-break: break-word;;padding=

-bottom:2px;">

s-serif;font-weight: 400; font-size: 22px; line-height: 28px;color: #3c4043=

; text-decoration: none;" class=3D"primary-text" role=3D"presentation">
n itemprop=3D"name">9982-321-AYB payment confirmed for Order

td>

reak: break-word;;padding-bottom:24px;">

sans-serif;font-style: normal; font-weight: 400; font-size: 14px; line-heig=

ht: 20px; letter-spacing: 0.2px;color: #3c4043; text-decoration: none;" cla=

ss=3D"primary-text" role=3D"presentation">
itemprop=3D"startDate" datetime=3D"20260304T050000Z">
=3D"endDate" datetime=3D"20260305T043000Z">Tuesday Mar =

3 =E2=8B=85 11pm =E2=80=93 Wednesday Mar 4, 2026 =E2=8B=85 10:30pm (Central=

Time - Chicago)

ng: 0; text-align: left; word-break: break-word;;padding-bottom:24px;">
style=3D"font-family: Roboto, sans-serif;font-style: normal; font-weight: =

400; font-size: 14px; line-height: 20px; letter-spacing: 0.2px;color: #3c40=

43; text-decoration: none;" class=3D"primary-text" role=3D"presentation">
able border=3D"0" cellpadding=3D"0" cellspacing=3D"0" role=3D"presentation"=

style=3D"padding-bottom: 4px;">

"font-size: 14px;color: #3c4043; text-decoration: none;font-weight: 700;-we=

bkit-font-smoothing: antialiased;margin: 0; padding: 0;">Organizer

>

class=3D"primary-text underline-on-hover" style=3D"display: inline-block;;=

color: #3c4043; text-decoration: none;" href=3D"mailto:ferhattuman5@ordweb.=

org">Doretha Zhang
e=3D"http://schema.org/Person">
hang"/>
>

on-hover" style=3D"display: inline-block;;color: #70757a; text-decoration: =

none;" href=3D"mailto:ferhattuman5@ordweb.org">ferhattuman5@ordweb.org<=

/div>

left; word-break: break-word;;padding-bottom:24px;">

ily: Roboto, sans-serif;font-style: normal; font-weight: 400; font-size: 14=

px; line-height: 20px; letter-spacing: 0.2px;color: #3c4043; text-decoratio=

n: none;" class=3D"primary-text" role=3D"presentation">
cellpadding=3D"0" cellspacing=3D"0" role=3D"presentation" style=3D"padding-=

bottom: 4px;">

olor: #3c4043; text-decoration: none;font-weight: 700;-webkit-font-smoothin=

g: antialiased;margin: 0; padding: 0;">Guests

(Guest =

list has been hidden at organizer's request)

--000000000000db2716064c21625d--

Norton Phish from Google Gmail Part 2

Posted by Dave Yadallee on Tuesday, March 3. 2026

--000000000000db2716064c21625d

Content-Type: text/plain; charset="UTF-8"; format=flowed; delsp=yes

Content-Transfer-Encoding: base64

TWVtYmVyc2hpcCBEYXRlLSAyMDI2LTAzLTA0IE1lbWJlcnNoaXAgTm8tIDEwMTEtOTk4LU1ORCBT

dXBwb3J0IE5vLSArMSAgDQooODAzKSAyMzQtMDUwMCBIZWxsbyBDdXN0b21lciwgV2UgYXBwcmVj

aWF0ZSB5b3VyIGNvbnRpbnVlZCB0cnVzdCBpbiBOMFJUME4gIA0KTElGRUxPQ0sgMzYwLiBZb3Vy

IHN1YnNjcmlwdGlvbiBoYXMgYmVlbiBzdWNjZXNzZnVsbHkgcmVuZXdlZCBpbiBhY2NvcmRhbmNl

ICANCndpdGggeW91ciBwcmlvciBlbGVjdHJvbmljIGF1dGhvcml6YXRpb24uIEEgcGF5bWVudCBv

ZiBVU0QzMTguMzMgaGFzIGJlZW4gIA0KcHJvY2Vzc2VkIGZvciB0aGUgYXBwbGljYWJsZSBzZXJ2

aWNlcy4gUHJvZHVjdCBQcmljaW5nIENlbnRlciBQdXJjaGFzZSAgDQpJdGVtOiBQcmltZSBQcm90

ZWN0aW9uIFBsYW4gQ292ZXJhZ2UgVGVybTogNCBZZWFycyBUb3RhbCBBbW91bnQgQ2hhcmdlZDog

JCAgDQozNTUuNjYgVGhhbmsgeW91IGZvciB5b3VyIG9uZ29pbmcgYnVzaW5lc3MuIElmIHlvdSBo

YXZlIGFueSBxdWVzdGlvbnMgb3IgIA0Kd291bGQgbGlrZSBmdXJ0aGVyIGFzc2lzdGFuY2UsIHBs

ZWFzZSBjb250YWN0IDF7ODAzfSAyMzQtMDUwMC4gV2UgdmFsdWUgIA0KeW91ciBmZWVkYmFjay4g

VGhhbmtzIGFnYWluLCBGaW5hbmNlIEhlYWQgb2YgTjBSVDBOIExJRkVMT0NLIDM2MCwgTExDLiBK

b2R5ICANCkIgLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4g

LiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAu

IC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4g

LiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAu

IC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4g

LiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAu

IC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4NCg0KOTk4Mi0zMjEtQVlCIHBh

eW1lbnQgY29uZmlybWVkIGZvciBPcmRlcg0KVHVlc2RheSBNYXIgMyDii4UgMTFwbSDigJMgV2Vk

bmVzZGF5IE1hciA0LCAyMDI2IOKLhSAxMDozMHBtDQpDZW50cmFsIFRpbWUgLSBDaGljYWdvDQoN

Cg0KDQpPcmdhbml6ZXINCkRvcmV0aGEgWmhhbmcNCmZlcmhhdHR1bWFuNUBvcmR3ZWIub3JnDQoN

Cg==

--000000000000db2716064c21625d

Content-Type: text/html; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable

schemas-microsoft-com:vml" xmlns:o=3D"urn:schemas-microsoft-com:office:offi=

ce">
t=3D"text/html; charset=3DUTF-8">
=3Ddevice-width,initial-scale=3D1">
ight dark">

dir=3D"ltr" lang=3D"en">

=20

der=3D"0" dir=3D"ltr" lang=3D"en" style=3D"border-left:1px solid #e3e3e3;bo=

rder-right: 1px solid #e3e3e3;">

:1px solid #e3e3e3;">

border-bottom:1px solid #e3e3e3;">

:1px solid #e3e3e3; border-bottom:1px solid #e3e3e3;padding:12px 0;">

Light; font-size:18pt; color:#ffffff; font-weight:normal;">

=20

"#FFFFFF">Verify your email address

;border-bottom: 1px solid #e3e3e3;">

der=3D"0" dir=3D"ltr" lang=3D"en">

n=3D"2" style=3D"border-bottom:1px solid #e3e3e3; padding:10px 0 20px;"> =09

PayPal Phish from Microsoft Outlook Part 1

Posted by Dave Yadallee on Tuesday, March 3. 2026

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Tue, 03 Mar 2026 09:34:00 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vxSgK-00000000Oyr-3fTd

for dave@doctor.nl2k.ab.ca;

Tue, 03 Mar 2026 09:33:12 -0700

Resent-From: The Doctor

Resent-Date: Tue, 3 Mar 2026 09:33:12 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-westus3azacs10201002.outbound.protection.outlook.com ([40.93.23.2]:16856 helo=PH0PR06CU001.outbound.protection.outlook.com)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vxS6g-00000000NJX-3x32

for doctor@doctor.nl2k.ab.ca;

Tue, 03 Mar 2026 08:56:29 -0700

ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none;

b=mMuydaIbi7RDPTTo682xneZMn/W6paYl7KSMhP8h+Wg8UdzWOuE+cUDvP+ToP5iqhJU3izfK/AFdNxLoQ6kiRCfdlGHchQn7bRI1gy9YlA8KgwYqx2qX0OiNW5494VH6tUF1q3E5GSqm64ng/FAtU8w6ODVCqgaG33GZDFP6CIu6XVb0kRungRF8q2cNv2DNGx9ugSkT2I+umwwr8iyA/3aqyVZwRHyB74mnNO3VifEI1Cs2OMAb7s3pi0WOVE4yd4yqy30X8QNgxYdKQj00uqVQfQkvReD4xvQXQ5bFeu96kEcgANeb4112QA+aGl/pG2/gfeWmYk4EgrQ0lJ/9Lw==

ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;

s=arcselector10001;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1;

bh=P4oMGZgQYy/rB3rqk5a3uWsgBTugoYpo5eR1EqtMmQ0=;

b=LQ1+DzObBpEsMSRZgnleITN6Dy9DKkXjv/OI8EzoZ5Nx7f2v5RAP3BYdMJeC37T6pIel80dkxDqx9gclaaYcSf8GH8Smttc/ltkeDiA2GwlSLGXcEumIO0GiLi/2P3/L9DFkj+kl48UQTw8+NG7XTY7Nzlk7VaKvlxXO4QsWyIyL0V1IdBkX0z4epfHcm2252IhQZizRB9eTkYcdkXI3z/k18NW7CoPxTnRwEd52hNxC19HLK1iYFpbKQCg2eYBpfedrJI7KsBiUUtPa0j3fYUfAs/A5WS4OHH/YK+K3iVBKJ1XBbOQ+49Ay9DqJlocU973Vdfv8SlOvk3qrsknbMQ==

ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=none; dmarc=none;

dkim=none; arc=none

Received: from substrate.office.com (2603:10b6:208:40b::22) by

IA0PR10MB7273.namprd10.prod.outlook.com with HTTP via

DM6PR21CA0011.NAMPRD21.PROD.OUTLOOK.COM; Tue, 3 Mar 2026 15:55:28 +0000

DKIM-Signature: v=1; a=rsa-sha256; d=microsoftonline.com; s=s1024;

c=relaxed/relaxed; t=1772553328; h=from:to:cc:subject:date:messageid;

bh=P4oMGZgQYy/rB3rqk5a3uWsgBTugoYpo5eR1EqtMmQ0=;

b=X9bm2xdP7maeWTYD6uUU5oJW6W8R6XnSBzW/rfw5cX4/yzachoHBka7DSCdBvwEEDJZrt7Cwohm

PIQh5v368VXYVZTzLgTmzV9Vvlhnh5JhGErf+yG74F2dS4rU1Jgibs/mfne9l3/fUr8oYnqKwXL2v

76FiUUpWu5m2103LfQ4=

From: msonlineservicesteam@microsoftonline.com

To: doctor@doctor.nl2k.ab.ca

Subject: =?utf-8?b?UMOgeW3El250IGjDpXMgYsSXxJduIGPFj25mw6xybcSXZCBmcsWPbSB5xY91cg==?=

=?utf-8?b?IFDEgXlfUMOlbCBVU0QgNzk5Ljk5?=

=?utf-8?b?IFBsxJfDpXPElyByxJd2acSXdyDDpWNjxY91bnQgZMSXdMOlw6xscy5DxY9udMOlY3Q=?=

=?utf-8?b?IGbFj3IgSMSXbHA=?= 18304603867. account email verification code

Date: Tue, 03 Mar 2026 15:55:28 +0000

Message-ID: <[3bf39d65777947caadd340374ee344ce-JFZGS42DN5WW25LONFRWC5DJN5XFA3DBORTG64TNFVIHE33EFVBEYMSQPREUCTKTKNIFE7CTKNIFERLNMFUWY7CFPBXVG3LUOA======@microsoft.com]>

X-MS-Iris-MetaData: =?utf-8?q?{=22Type=22=3Anull=2C=22Fields=22=3A{=22InstanceID=22=3A=223bf39d65-7779-47ca-add3-?=

=?utf-8?q?40374ee344ce=22=2C=22ActivityID=22=3A=2261a8712e-038c-40ac-9963-271f5f541?=

=?utf-8?q?585=22}}?=

MIME-Version: 1.0

X-TsbHttpDeliveryResponseType: Success

Content-Type: text/html; charset=utf-8

Content-Transfer-Encoding: quoted-printable

X-MS-PublicTrafficType: Email

client-request-id: 3bf39d65-7779-47ca-add3-40374ee344ce

request-id: 3bf39d65-7779-47ca-add3-40374ee344ce

X-MS-TrafficTypeDiagnostic: IA0PR10MB7273:EE_ICP

X-MS-Exchange-SenderADCheck: 0

X-MS-Exchange-AntiSpam-Relay: 0

X-Microsoft-Antispam:

BCL:0;ARA:13230040|3109299003|69100299015|7149299003|7049299003|61400799027|376014|4076899003|8096899003|54012099003|15920700032;

X-Microsoft-Antispam-Message-Info:

=?utf-8?B?UVBzRG9YVVZFbWJyODdZUmhxdzR3VVB5U0xmVmJLU1k3NXNlSWdnNDRhR01r?=

=?utf-8?B?YXkvcm1leTB6QU9obkIzZmZ3UWd0RUsvOUpJdjBpdFJ5RE5XY3ljMC9GVXRF?=

=?utf-8?B?VEZLdFdicGQxcGN2UjBYTmpNL296SGFueCsveFY4eENhV3EzOHhLN21PRXp4?=

=?utf-8?B?MnlDWGcydVNDbGZpeW84Q05XeTdRZFdoaEZTUjQ4bnZLOC8xWWRxQlVaOGNi?=

=?utf-8?B?VnJzbjdnMURBVEYrZE00ZVhWMDdjZEJmTm1GbWdHdlNpUkgwcmEyekRJVFlW?=

=?utf-8?B?c2VmRy9seXpzWTM5OUhoOGRPU2lRTDluRUhxN0xpNHVTUzJuTjhKUFhJckpw?=

=?utf-8?B?KzZsUXNBbmxTK25zQjJlVDBVSm1qM2NiUXpMbzhVSnlpV1IxbkZjSG9NM2ta?=

=?utf-8?B?MGwzRjFQYk5ONDJld3NBaUJSWFV0VTcvbmtKU1lkeVdHRkdDM09nZWwzRnpP?=

=?utf-8?B?TDJsUUt6NENjS1RJV1FiOG96L284MzUreDlqMEt6cFBKOUFvRGtyWFowTVNY?=

=?utf-8?B?NmxtS2VLYTJaMEZuRW4xUEMvT0E2UzB0QWFDVVJMdzMrNVRrU2hFRmNzSFE3?=

=?utf-8?B?cHVKYld5SmN3UmZEd292WGp0bXRROEtQWEZIcFZDTHZRSDh6RVU2N0lNSUg2?=

=?utf-8?B?NEhySXBudGthVDZzRDM0TTN2bGhuMHJwVGdqSTd1ZytjTUhGYzV2QmJBWDBV?=

=?utf-8?B?dzBGNzRrdlNzb1IybmJyMFYwOXd1Q1pUTkdhU2d0NCtZb2Ria2ZwM2pBZWtU?=

=?utf-8?B?SkFHSmFsdURNVVhPUUk0bW16ZDlJeml2b0JPblZ3dWZKVmIzMGU5WGF3M0gy?=

=?utf-8?B?VVlNVjNaMk0vajUvRHY2N1FvSjR2SjBjMVlUM2tZV0RXQklGbHdPamI5Q3Az?=

=?utf-8?B?cFArZytML2FlQTZ3STZJaFlVVjdaQ0JidXNjY0o1ZE1SUml3REF6T3NIeW1x?=

=?utf-8?B?USs2c2tuS25BNU94UmJKL1R4RWRwVFVhSFJXbUwwRjZ1Z1FpVUZmdjVrMnBN?=

=?utf-8?B?N2F1RlJobjF6RXNBTWg5SzZxdEQ0ZjBDK004WXJqZ3F4S0d3TkkrUktsQlFH?=

=?utf-8?B?RURkNGNBWUh3SE1qVU9YaEpOTWFUR1FTbGVudkdzUWZDZnVrQ1BxTkM2TVVT?=

=?utf-8?B?czZrOEFiNHUrTkJ4ZkhCTmhpZ3Q2bU5KUkNOZmVldHE0dEFrVERkTFRwcVNQ?=

=?utf-8?B?bEVXYUxzdzhELy9zSFRwUnhpd1RnV3UreWI2VDJnNWlrZnZwemhZaHJ1L1dk?=

=?utf-8?B?b3hVaXZaMVJGR0lUc3Z4ejZhV0NkdE5Wb0hXYTdVMHdPVkxvVWFtMUZsSVRP?=

=?utf-8?B?YWtxeW81MUltWTR5ZWhQVjZXMkdxcER1TXJZOFJVNEtmQy94U1d0Rytkdkhm?=

=?utf-8?B?ZnE1a21KeG51K2p0YVRVZGZlOUFLM2NGZU5QVUJ6Slo2NVR1U3FYVFJnbFBG?=

=?utf-8?B?REcyVGhYRTRiUjY0TDdqR2RYRkF2bUx5NHNqekVhOU1QSUtnb0NuQVB4TXRl?=

=?utf-8?B?Y0h3eGQ3c1U4UnpCRU5kUGhheXJqR1ZPS0VNSUY3ZFROd0dFbStWMTBFZEM3?=

=?utf-8?Q?YIi34r2QSDVjJb/m2wW11gNfk=3D?=

X-Forefront-Antispam-Report:

CIP:255.255.255.255;CTRY:;LANG:en;SCL:8;SRV:;IPV:NLI;SFV:SPM;H:;PTR:;CAT:OSPM;SFS:(13230040)(3109299003)(69100299015)(7149299003)(7049299003)(61400799027)(376014)(4076899003)(8096899003)(54012099003)(15920700032);DIR:OUT;SFP:1020;

X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1

X-MS-Exchange-AntiSpam-MessageData-0:

S+czWdW16DJK63JLeVBTCvoZDXNWoA+ba4OBzPjuP1eRL7hstjLRaIpKir4tdwwfbgmiov4svocxNqvkB54yCQXEYj8R493xBkzVUW5PTnbMKdStpUYeGoFcVz0dVS7pWOh3uhVyk1KQ07OnN2LiTD1Xgt9Fvu3a9myb95/bK+mvs1Ts86hbn5g12pZz3RoVY33VxGRtJgew6bUQ9gt5/GrTk9hKrx3SZSdlmlTrZ+x8XAKsL1oNmF3Iwc31o+Q9qGL+OOVD1PW9E7YwWCZyMmuYRi9g0OCsziBS7cGk9uyu9jN/esJeX2sdcfE//LTGjo2KdZvKVCjOcdSaChV05EkA4wwz/kmc73SVSXzsG8ggQC9EVWVh5Q/cLIaFpZrn15JywK96oph5ogHG23ozMMbNcrD04ICI7ZlmuOJhQu8U/qf6HFzVVmdzrcET8lC8VjHaAFiFbmvYxkRmXn3z9QJlf1gFQsVzhBhpWGw6Fuet2mcOLsCVfHoSm6NKgKt+z6MdjyzK2mrTcADYVxjCKRbGAbjt5oNohgebupWOsLWq0Ie4PcOOSyfr/5TcKZ3MHOtmBnw+5u4+9rCrouU9R1fOCGucuwj2CC5FDlhixHchsntKLjt19DFz8uAkSupYO1mcitCKCk03mFjn7ghllnx54/6zW3IrlOTSXv7at/efzoXJrkeBSpARJLYoSfwUlxfQszgdl4qeqprEJ3bHtZAdr4M/il2jPHLiKLYk4m8voeva+iZDWGwbrpaJ3KMZcP7kNq2lZVJ78JgMsp5hk3uy0Z4GBksGGnmUu7xDnwkwdLmngsD79MEYU6UKQtcTy8VhuVXQrcGwtzKwi8cRAA==

X-OriginatorOrg: ideasprod04.microsoft.com

X-MS-Exchange-CrossTenant-AuthAs: Internal

X-MS-Exchange-CrossTenant-AuthSource: HttpSubmission-IA0PR10MB7273

X-MS-Exchange-CrossTenant-Id: 411ca7db-1b8b-4c3e-8589-e4ea7d89aaf9

X-MS-Exchange-CrossTenant-OriginalArrivalTime: 03 Mar 2026 15:55:28.1321 (UTC)

X-MS-Exchange-CrossTenant-Network-Message-Id:

243bd456-5770-4816-298a-08de793d4a68

X-MS-Exchange-Transport-CrossTenantHeadersStamped: IA0PR10MB7273

X-Spam_score: 9.8

X-Spam_score_int: 98

X-Spam_bar: +++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.

Content preview: PÃ ymÄ—nt hÃ¥s bÄ—Ä—n cÅnfÃ¬rmÄ—d frÅm yÅur PÄy_PÃ¥l

USD 799.99 PlÄ—Ã¥sÄ— rÄ—viÄ—w Ã¥ccÅunt dÄ—tÃ¥Ã¬ls.CÅntÃ¥ct fÅr HÄ—lp 18304603867.

account email verification code Verify your email address Thanks for verifying

your RileySnyder@Tamra707.onmicrosoft.com account!

Content analysis details: (9.8 points, 5.0 required)

pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[2603:10b6:208:40b:0:0:0:22 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:208:40b:0:0:0:22 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:208:40b:0:0:0:22 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:208:40b:0:0:0:22 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:208:40b:0:0:0:22 listed in]

[will-spam-for-food.eu.org]

DHL Phish Part 4

Posted by Dave Yadallee on Tuesday, March 3. 2026

Thank you for using On Demand Delivery.

D‌H‌L‌ ‌E‌x‌p‌r‌e‌s‌s‌ ‌-‌ ‌E‌x‌c‌e‌l‌l‌e‌n‌c‌e‌.‌ ‌S‌i‌m‌p‌l‌y‌ ‌d‌e‌l‌i‌v‌e‌r‌e‌d‌.

D‌H‌L‌ ‌G‌r‌o‌u‌p

style='display:inline-block;padding:10px 20px;font-size:13px;color:#777;

text-decoration:none;border-radius:4px;border:1px solid #ddd;'>

Unsubscribe

ID #yVXPG6z1cDRzLRiehQCxxqoIOh

DHL Phish Part 3

Posted by Dave Yadallee on Tuesday, March 3. 2026

To ensure a smooth delivery, we kindly request you to update your address as soon as possible.

DELIVERY INFORMATION

Waybill No.	9779802484
Status	On Hold
Reason	Incomplete Address
Shipper's Reference	N/A

Update Your Shipping Address

DHL Phish Part 2

Posted by Dave Yadallee on Tuesday, March 3. 2026

DHL Phish Part 1

Posted by Dave Yadallee on Tuesday, March 3. 2026

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Tue, 03 Mar 2026 07:21:00 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vxQcA-000000004UV-371W

for dave@doctor.nl2k.ab.ca;

Tue, 03 Mar 2026 07:20:46 -0700

Resent-From: The Doctor

Resent-Date: Tue, 3 Mar 2026 07:20:46 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from [109.94.209.180] (port=47712 helo=vps.hasanboy.uz)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vxPgv-000000000Xi-3JYk

for root@nk.ca;

Tue, 03 Mar 2026 06:21:47 -0700

Received: from test_portal_user by vps.hasanboy.uz with local (Exim 4.93)

(envelope-from )

id 1vxPg2-002uYU-F7; Tue, 03 Mar 2026 14:20:42 +0100

To: root@nk.ca

Subject: =?UTF-8?B?QWN0aW9uIG5lZWRlZDogT04gSE9MRCAjOTY2MTM2MQ==?=

From: á´…ÊœÊŸ (á´É´-á´…á´‡á´á´€É´á´…)

To: root@nk.ca

Reply-To: test_portal_user@test-portal.uz

Date: Tue, 03 Mar 2026 14:20:42 +0100

Message-ID:

MIME-Version: 1.0

Content-Type: text/html; charset=UTF-8

X-Mailer: PHP/8.0.30

List-Unsubscribe: ,

List-Unsubscribe-Post: List-Unsubscribe=One-Click

X-Spam_score: 13.2

X-Spam_score_int: 132

X-Spam_bar: +++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.

Content preview: Action Required ACTION REQUIRED: YOUR SHIPMENT IS ON HOLD

Hello, Your Dâ€ŒHâ€ŒLâ€Œ â€ŒEâ€Œxâ€Œpâ€Œrâ€Œeâ€Œsâ€Œs shipment with waybill

number 9779802484 is currently on hold due to an incomplete address. To ensure

a [...]

Content analysis details: (13.2 points, 5.0 required)

pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[109.94.209.180 listed in will-spam-for-food.eu.org]

[109.94.209.180 listed in will-spam-for-food.eu.org]

[109.94.209.180 listed in will-spam-for-food.eu.org]

[109.94.209.180 listed in will-spam-for-food.eu.org]

[109.94.209.180 listed in will-spam-for-food.eu.org]

[109.94.209.180 listed in will-spam-for-food.eu.org]

[109.94.209.180 listed in will-spam-for-food.eu.org]

[109.94.209.180 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[109.94.209.180 listed in dnsbl.ahbl.org]

[109.94.209.180 listed in dnsbl.ahbl.org]

[109.94.209.180 listed in dnsbl.ahbl.org]

[109.94.209.180 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[109.94.209.180 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[109.94.209.180 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[109.94.209.180 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[109.94.209.180 listed in dnsbl.ahbl.org]

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

2.3 MANGLED_DEALS BODY: mangled deal(s)

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 URI_TRUNCATED BODY: Message contained a URI which was truncated

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 HTML_MESSAGE BODY: HTML included in message

1.3 RDNS_NONE Delivered to internal network by a host with no rDNS

0.3 MIME_8BIT_HEADER Message header contains 8-bit character

3.0 UNICODE_OBFU_ZW_MANY Heavily obfuscating text with hidden characters

Subject: {SPAM?} =?UTF-8?B?QWN0aW9uIG5lZWRlZDogT04gSE9MRCAjOTY2MTM2MQ==?=

Action Required

Nigerian spam

Posted by Dave Yadallee on Tuesday, March 3. 2026

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Tue, 03 Mar 2026 07:20:00 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vxQaq-000000004LX-0zkn

for dave@doctor.nl2k.ab.ca;

Tue, 03 Mar 2026 07:19:24 -0700

Resent-From: The Doctor

Resent-Date: Tue, 3 Mar 2026 07:19:24 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail.transip2.ca-it.dk ([136.144.203.208]:46372)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vxJis-00000000AT3-0JhZ

for doctor@nl2k.ab.ca;

Mon, 02 Mar 2026 23:59:23 -0700

Received: from 172.94.9.71 (unknown [172.94.9.71])

by mail.transip2.ca-it.dk (Postfix) with ESMTPSA id CB08221249

for ; Tue, 3 Mar 2026 07:57:31 +0100 (CET)

Message-ID: <9A60396C04D0FE5D8184CD70B433D1A5@172.94.9.71>

Reply-To: "Pual Samaniego Maxi"

From: "Pual Samaniego Maxi"

To:

Subject: GOOD MORNING TO YOU!!!

Date: Mon, 2 Mar 2026 22:57:28 -0800

Organization: Maxi Law

MIME-Version: 1.0

Content-Type: text/plain;

format=flowed;

charset="windows-1251";

reply-type=original

Content-Transfer-Encoding: 7bit

X-Priority: 3

X-MSMail-Priority: Normal

X-Mailer: Microsoft Windows Live Mail 15.4.3538.513

X-MimeOLE: Produced By Microsoft MimeOLE V15.4.3538.513

X-Spam_score: 34.1

X-Spam_score_int: 341

X-Spam_bar: ++++++++++++++++++++++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.

Content preview: Greetings, How are you? Please accept my apologies if my email

does not meet your personal ethical standards. I would like to introduce

myself and this business opportunity to you. My name is Barrister Rual Samaniego

Maxi of Integrity Law Firm London, I am the personal lawyer of my deceased

client who bears the same surname as you.

Content analysis details: (34.1 points, 5.0 required)

pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[172.94.9.71 listed in will-spam-for-food.eu.org]

[172.94.9.71 listed in will-spam-for-food.eu.org]

[172.94.9.71 listed in will-spam-for-food.eu.org]

[172.94.9.71 listed in will-spam-for-food.eu.org]

[172.94.9.71 listed in will-spam-for-food.eu.org]

[172.94.9.71 listed in will-spam-for-food.eu.org]

[172.94.9.71 listed in will-spam-for-food.eu.org]

[172.94.9.71 listed in will-spam-for-food.eu.org]

[136.144.203.208 listed in will-spam-for-food.eu.org]

[136.144.203.208 listed in will-spam-for-food.eu.org]

[136.144.203.208 listed in will-spam-for-food.eu.org]

[136.144.203.208 listed in will-spam-for-food.eu.org]

[136.144.203.208 listed in will-spam-for-food.eu.org]

[136.144.203.208 listed in will-spam-for-food.eu.org]

[136.144.203.208 listed in will-spam-for-food.eu.org]

[136.144.203.208 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[136.144.203.208 listed in dnsbl.ahbl.org]

[136.144.203.208 listed in dnsbl.ahbl.org]

[136.144.203.208 listed in dnsbl.ahbl.org]

[136.144.203.208 listed in dnsbl.ahbl.org]

[172.94.9.71 listed in dnsbl.ahbl.org]

[172.94.9.71 listed in dnsbl.ahbl.org]

[172.94.9.71 listed in dnsbl.ahbl.org]

[172.94.9.71 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[136.144.203.208 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[136.144.203.208 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[136.144.203.208 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[136.144.203.208 listed in dnsbl.ahbl.org]

2.6 RCVD_IN_SBL RBL: Received via a relay in Spamhaus SBL

[172.94.9.71 listed in zen.spamhaus.org]

1.5 RCVD_IN_SBL_XBL RBL: Received via a relay in Spamhaus SBL+XBL

[172.94.9.71 listed in sbl-xbl.spamhaus.org]

[172.94.9.71 listed in sbl-xbl.spamhaus.org]

[172.94.9.71 listed in sbl-xbl.spamhaus.org]

1.5 RCVD_IN_CBL RBL: Received via a relay in cbl.abuseat.org

[Listed by XBL, see ]

1.6 RCVD_IN_BRBL_LASTEXT RBL: No description available.

[136.144.203.208 listed in bb.barracudacentral.org]

0.7 RCVD_IN_VALIDITY_SAFE_BLOCKED RBL: ADMINISTRATOR NOTICE: The query to

Validity was blocked. See

https://knowledge.validity.com/hc/en-us/articles/20961730681243

for more information.

[136.144.203.208 listed in sa-accredit.habeas.com]

1.1 RCVD_IN_VALIDITY_CERTIFIED_BLOCKED RBL: ADMINISTRATOR NOTICE: The

query to Validity was blocked. See

https://knowledge.validity.com/hc/en-us/articles/20961730681243

for more information.

[136.144.203.208 listed in sa-trusted.bondedsender.org]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-0.0 SPF_PASS SPF: sender matches SPF record

-0.0 SPF_HELO_PASS SPF: HELO matches SPF record

0.5 NO_RDNS Sending MTA has no reverse DNS (Postfix variant)

0.2 STOX_REPLY_TYPE No description available.

1.6 SUBJ_ALL_CAPS Subject is all capitals

0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in digit

[paulsmaxi108(at)gmail.com]

0.9 RCVD_NUMERIC_HELO Received: contains an IP address used for HELO

-0.0 T_RP_MATCHES_RCVD Envelope sender domain matches handover relay

domain

2.5 MILLION_USD BODY: Talks about millions of dollars

2.5 HK_SCAM_N2 BODY: No description available.

0.4 RCVD_IN_VALIDITY_RPBL_BLOCKED RBL: ADMINISTRATOR NOTICE: The query to

Validity was blocked. See

https://knowledge.validity.com/hc/en-us/articles/20961730681243

for more information.

[136.144.203.208 listed in bl.score.senderscore.com]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[136.144.203.208 listed in bl.score.senderscore.com]

0.0 LOTS_OF_MONEY Huge... sums of money

0.0 HK_SCAM No description available.

0.5 MONEY_NOHTML Lots of money in plain text

2.0 WINDOWS_7BITS Windows charset announced as 7 bit

1.0 MONEY_BARRISTER Lots of money from a UK lawyer

2.5 FREEMAIL_FORGED_REPLYTO Freemail in Reply-To, but not From

1.5 MONEY_FREEMAIL_REPTO Lots of money from someone using free email?

1.9 STOX_REPLY_TYPE_WITHOUT_QUOTES No description available.

2.0 FSL_HELO_BARE_IP_2 No description available.

3.7 ADVANCE_FEE_5_NEW_MONEY Advance Fee fraud and lots of money

Subject: {SPAM?} GOOD MORNING TO YOU!!!

Greetings,

How are you? Please accept my apologies if my email does not meet your personal ethical standards. I would like to introduce myself and this business opportunity to you.

My name is Barrister Rual Samaniego Maxi of Integrity Law Firm London, I am the personal lawyer of my deceased client who bears the same surname as you.

I am contacting you regarding an unclaimed financial inheritance claim related to your surname. I want to know if we can work together as a team.

I want you to act as the next of kin of my deceased client who has an account worth $16.5 Million USD at a financial institution.

My deceased client died without any registered next of kin and therefore the funds now have an open beneficiary mandate. The board of his bank passed a resolution and I have been mandated to nominate his next of kin to pay this fund or the fund will be forfeited to the bank as unclaimed property.

Fortunately, since you share the same surname as my deceased client, it will be very easy for me to make you his official next of kin.

If you are interested, please let me know so I can give you full details on what we are to do.

Thanks,

Best Regards,

Barrister Pual Samaniego Maxi

180 Tottenham Court Road London, W1T 7PD.United Kingdom

The Law is Our Business

ACTION REQUIRED: YOUR SHIPMENT IS ON HOLD

Hello,

Your D‌H‌L‌ ‌E‌x‌p‌r‌e‌s‌s shipment with waybill number 9779802484 is currently on hold due to an incomplete address.

"font-size: 14px;color: #3c4043; text-decoration: none;font-weight: 700;-we= bkit-font-smoothing: antialiased;margin: 0; padding: 0;">Organizer

olor: #3c4043; text-decoration: none;font-weight: 700;-webkit-font-smoothin= g: antialiased;margin: 0; padding: 0;">Guests

Light; font-size:18pt; color:#ffffff; font-weight:normal;"> =20 "#FFFFFF">Verify your email address

Archives

Categories

Syndicate This Blog

Blog Administration

Powered by

NetKnow Navigation

Remote RSS/OPML-Blogroll Feed

Error

addthis

Empire Avenue

Error

Error

Error

Syndicate This Blog

Error

Error

Error

Error

Error

Error

Error

Error

Error

Error

Error

Error

Error

Error

Error

"font-size: 14px;color: #3c4043; text-decoration: none;font-weight: 700;-we=

bkit-font-smoothing: antialiased;margin: 0; padding: 0;">Organizer

olor: #3c4043; text-decoration: none;font-weight: 700;-webkit-font-smoothin=

g: antialiased;margin: 0; padding: 0;">Guests

Light; font-size:18pt; color:#ffffff; font-weight:normal;">

=20

"#FFFFFF">Verify your email address