Targeted Teradata spam from Google Gmail Part 1

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Wed, 25 Feb 2026 04:03:01 -0700

Received: from mail-pl1-f178.google.com ([209.85.214.178]:57346)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vvCeq-00000000LoN-1WuQ

for dave@doctor.nl2k.ab.ca;

Wed, 25 Feb 2026 04:02:30 -0700

Received: by mail-pl1-f178.google.com with SMTP id d9443c01a7336-2ad9f316d68so8738515ad.2

for ; Wed, 25 Feb 2026 03:01:33 -0800 (PST)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=targetexelist.com; s=google; t=1772017287; x=1772622087; darn=doctor.nl2k.ab.ca;

h=disposition-notification-to:content-language:thread-index

:mime-version:message-id:date:subject:in-reply-to:references:to:from

:return-receipt-to:from:to:cc:subject:date:message-id:reply-to;

bh=8qpzEAXiwPyR6tD6G45VRM9Wi+6wBaiSVGw/cM56y/E=;

b=gWO8vxLhx19foJHl/oIQ3HzRBbQtguR5Xq9ntt5khwEG+Ycqhi7/Vvi8ziL0Whkb1k

C7/OD0vIvHbhoNfWo08b9DY8N8Z9UDQfPw4ZdGH5cZdgeQBP9gv3Ll3y46WwOc/HsvBf

46tLUBncNFRaWqLJIj31XuEi54MuFuO1JDJCPJvdhgaOwq5ppF9rw7ZngMAk25XRirtW

XSkPX5An6GrH1y3HMaQEZAdB1PFyayqtkrNdrsryjXuX3EfDAKos8SE8TucN6CJlfJpp

ejMiCvxk93Zedrn76+tSZPYdivceY+U7H7lCyO1qeanvMNqvDylr4GWHZm8sGSoWirsJ

syHw==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20230601; t=1772017287; x=1772622087;

h=disposition-notification-to:content-language:thread-index

:mime-version:message-id:date:subject:in-reply-to:references:to:from

:return-receipt-to:x-gm-gg:x-gm-message-state:from:to:cc:subject

:date:message-id:reply-to;

bh=8qpzEAXiwPyR6tD6G45VRM9Wi+6wBaiSVGw/cM56y/E=;

b=N9b4xVYBdU/ALvKkbndFDlvo4Nnn1us2OxAITnM2QFnMmWRE17IHmxPEGX9XSFUHfz

kLMDmKIBYIvKgw2vaZSZ99ZZSthbKfMjpyz8htr6USV0l9FRt1fLXIoFX3Ql2XeANu7n

d7Rl8A80TKARsiE9F61SWOJqSW7WzscBQxl2MyD2KaTP49RXHQQFm3Ha9xuB78CgQwo9

ElTzP76HglGJXawMXPZZeLCHb3RwF60/4kXj1iORsFVq5Vl0kWlxHasAVHbVo8w27806

IrpWR5jNWpedcar0+2QXivwkU030TxFE6f2xYZ6utRoGKjMiotRNfqGHMIecMRebmOEe

fwmA==

X-Gm-Message-State: AOJu0YyNSKmnZec8PECFevVlBz04aoQoEZdpB+XQRyc9faZ1DDcl4c/z

O6qzgkacTXXaAYXzfac7APcLyghl07o385E6+I/wiXZxzioh3JQHOyaZFiFkKcSDSQmKLW+spc/

eT+5S7eRlTg==

X-Gm-Gg: ATEYQzwHmcQVT0PGbqVrpWuqro5MzG0N0732xwIETZPFzraeJVt0nFVJhZsPkV/J+g4

c0WIHfV/p702vDwex4GxbqZ1i2eqTN9l4HcfKaG4KnHRUQJdZjIERstzDQ5mxxiy3HIa3GMv199

uDDmDa46TouBxZwEfmvjXnCpGXBUiK22qxU+mAoHELonCi3XyxTR02gCKoE3mzRidF28f77/18A

qIRJ3PuCbtOgNrmMnOmLS3aelsQ4R2dFNla+MHPgg6D8SbzxhK9YJ9FXYMk9t0FeSFI8+YPEylx

Yro5UAyztjrEWPPqtk49BFxEdo8CuPrLLy6foz0xU29seI2iA+T+fpGN9K0CokTHMT4Y00J8cKY

mu8rA9PVOk/IgIoXEapdeAQh7CgNzBP3GvZ6zKEaHjwD38cUhaJ8HS85w+r0bkteUln5FHAQA4E

THjh2lo5wPknO9Kt+NnuMNoNZfDTsdvZcmqSh3zbw=

X-Received: by 2002:a17:903:2445:b0:2a7:cb46:706e with SMTP id d9443c01a7336-2ad744edbfemr176311675ad.35.1772017286832;

Wed, 25 Feb 2026 03:01:26 -0800 (PST)

Received: from DESKTOPK42Q2LS ([103.75.11.35])

by smtp.googlemail.com with ESMTPSA id d9443c01a7336-2ad74e3445fsm161947265ad.13.2026.02.25.03.01.23

for

(version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128);

Wed, 25 Feb 2026 03:01:26 -0800 (PST)

Return-Receipt-To:

From:

To:

References:

In-Reply-To:

Subject: Targeted Teradata Users Info

Date: Wed, 25 Feb 2026 16:26:23 +0530

Message-ID:

MIME-Version: 1.0

Content-Type: multipart/alternative;

boundary="----=_NextPart_000_138C_01DCA673.86881F70"

X-Mailer: Microsoft Outlook 16.0

Thread-Index: AdymRRdBgtUkBrhBT4av6PXP7fCtbgAAAVxQAAAADcAAAADfwAAAAA3gAAAAEeAAAAANEAAAABCgAAAAEAAAAAAOMA==

Content-Language: en-us

Disposition-Notification-To:

X-Spam_score: 9.2

X-Spam_score_int: 92

X-Spam_bar: +++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Hi, Are you interested in the contact information of Teradata

Users across UK and Europe? If interested, let me know your target geography:

___? so that I can get back to you with Counts, Pricing and more information.





Content analysis details: (9.2 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[103.75.11.35 listed in will-spam-for-food.eu.org]

[103.75.11.35 listed in will-spam-for-food.eu.org]

[103.75.11.35 listed in will-spam-for-food.eu.org]

[103.75.11.35 listed in will-spam-for-food.eu.org]

[103.75.11.35 listed in will-spam-for-food.eu.org]

[103.75.11.35 listed in will-spam-for-food.eu.org]

[103.75.11.35 listed in will-spam-for-food.eu.org]

[103.75.11.35 listed in will-spam-for-food.eu.org]

[209.85.214.178 listed in will-spam-for-food.eu.org]

[209.85.214.178 listed in will-spam-for-food.eu.org]

[209.85.214.178 listed in will-spam-for-food.eu.org]

[209.85.214.178 listed in will-spam-for-food.eu.org]

[209.85.214.178 listed in will-spam-for-food.eu.org]

[209.85.214.178 listed in will-spam-for-food.eu.org]

[209.85.214.178 listed in will-spam-for-food.eu.org]

[209.85.214.178 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[209.85.214.178 listed in dnsbl.ahbl.org]

[209.85.214.178 listed in dnsbl.ahbl.org]

[209.85.214.178 listed in dnsbl.ahbl.org]

[209.85.214.178 listed in dnsbl.ahbl.org]

[103.75.11.35 listed in dnsbl.ahbl.org]

[103.75.11.35 listed in dnsbl.ahbl.org]

[103.75.11.35 listed in dnsbl.ahbl.org]

[103.75.11.35 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[209.85.214.178 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[209.85.214.178 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[209.85.214.178 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[209.85.214.178 listed in dnsbl.ahbl.org]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[209.85.214.178 listed in list.dnswl.org]

-0.0 SPF_PASS SPF: sender matches SPF record

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

-0.0 RCVD_IN_MSPIKE_H3 RBL: Good reputation (+3)

[209.85.214.178 listed in wl.mailspike.net]

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 HTML_MESSAGE BODY: HTML included in message

-0.0 RCVD_IN_MSPIKE_WL Mailspike good senders

0.0 NO_RDNS2 Sending MTA has no reverse DNS

1.0 REPLYTO_BOGUS In-Reply-To header seems not to be valid

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

2.0 END_FUTURE_EMAILS Spammy unsubscribe

1.0 MR_DIFF_MID No description available.

0.0 T_END_FUTURE_EMAILS Spammy unsubscribe

Boots UK Phish from cv,net part 2

Posted by Dave Yadallee on


.cta-button {

display: inline-block;

background-color: #004990;

color: #ffffff !important;

text-decoration: none;

padding: 12px 24px;

border-radius: 4px;

font-size: 14px;

font-weight: bold;

}

.footer {

font-size: 12px;

color: #777777;

margin-top: 32px;

border-top: 1px solid #dddddd;

padding-top: 16px;

text-align: center;

}






padding: 0;

background-color: #f4f6f8;

font-family: Arial, Helvetica, sans-serif;

color: #333333">












margin: 0 auto;

background-color: #ffffff;

padding: 24px" class=3D"email-container">




padding-bottom: 16px" class=3D"header">


color: #004990;

margin-bottom: 16px">Complete our short survey and receive a free gif=

t








line-height: 1.6;

margin-bottom: 16px">Dear Customer, DOCTOR@NL2K.AB.CA,






line-height: 1.6;

margin-bottom: 16px">Thank you for shopping with Boots.com
trong>.






line-height: 1.6;

margin-bottom: 16px">

We’re committed to providing you with the best possible o=

nline experience, and your feedback helps us do just that.

We’d love to hear your thoughts about your recent visit t=

o Boots.com.






line-height: 1.6;

margin-bottom: 16px">

Please take a few minutes to complete our short survey. As a th=

ank you for your time,

you will receive a free gift once the survey i=

s completed, subject to the terms outlined at the end of the survey.






line-height: 1.6;

margin-bottom: 16px; text-align: center;">


background-color: #004990;

color: #ffffff !important;

text-decoration: none;

padding: 12px 24px;

border-radius: 4px;

font-size: 14px;

font-weight: bold" href=3D"https://www.hitchedbridalandformalwear.com=

/wp-includes/pomo/boots_store/" class=3D"cta-button" target=3D"_blank">

Start the survey








line-height: 1.6;

margin-bottom: 16px">

Your responses are confidential and will be used only to help u=

s improve our products and services.






line-height: 1.6;

margin-bottom: 16px">

Thank you for taking the time to share your feedback and for ch=

oosing Boots.






line-height: 1.6;

margin-bottom: 16px">

Kind regards,


The Boots Customer Experience Team


Boots UK Limited






color: #777777;

margin-top: 32px;

border-top: 1px solid #dddddd;

padding-top: 16px;

text-align: center" class=3D"footer">

© 2026 Boots UK Limited. All rights reserved.






Boots UK Phish from cv,net part 1

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Wed, 25 Feb 2026 05:50:01 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vvEKK-000000005bv-3Wqc

for dave@doctor.nl2k.ab.ca;

Wed, 25 Feb 2026 05:49:16 -0700

Resent-From: The Doctor

Resent-Date: Wed, 25 Feb 2026 05:49:16 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from [69.74.130.150] (port=56839 helo=boots.co.uk)

by doctor.nl2k.ab.ca with esmtp (Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vvB6X-00000000E5C-0zxM

for DOCTOR@NL2K.AB.CA;

Wed, 25 Feb 2026 02:22:57 -0700

From: Boots

To: DOCTOR@NL2K.AB.CA

Subject: 2/25/2026 4:21:57 a.m. =?UTF-8?B?U2hhcmUgWW91ciBGZWVkYmFjayAmIFJlY2VpdmUgYSBGcmVlIEdpZnQgZnJvbSBCb290cyAoQGJvb3RzVUspWW91ciBvcGluaW9uIG1hdHRlcnPigJRjbGFpbSB5b3VyIHRoYW5rLXlvdSBnaWZ0ISB8IEN1c3RvbWVyIHNhdGlzZmFjdGlvbiBzdXJ2ZXkgIEUtbWFpbDo=?=DOCTOR@NL2K.AB.CA NO:3715607-93256

Date: 25 Feb 2026 04:21:57 -0500

Message-ID: <20260225042157.17BC604DC52AF88D@boots.co.uk>

MIME-Version: 1.0

Content-Type: text/html

Content-Transfer-Encoding: quoted-printable

X-Spam_score: 20.6

X-Spam_score_int: 206

X-Spam_bar: ++++++++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Boots.com Survey Complete our short survey and receive a

free gift



Content analysis details: (20.6 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

2.6 RCVD_IN_MSPIKE_L5 RBL: Very bad reputation (-5)

[69.74.130.150 listed in bl.mailspike.net]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[69.74.130.150 listed in will-spam-for-food.eu.org]

[69.74.130.150 listed in will-spam-for-food.eu.org]

[69.74.130.150 listed in will-spam-for-food.eu.org]

[69.74.130.150 listed in will-spam-for-food.eu.org]

[69.74.130.150 listed in will-spam-for-food.eu.org]

[69.74.130.150 listed in will-spam-for-food.eu.org]

[69.74.130.150 listed in will-spam-for-food.eu.org]

[69.74.130.150 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[69.74.130.150 listed in dnsbl.ahbl.org]

[69.74.130.150 listed in dnsbl.ahbl.org]

[69.74.130.150 listed in dnsbl.ahbl.org]

[69.74.130.150 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[69.74.130.150 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[69.74.130.150 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[69.74.130.150 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[69.74.130.150 listed in dnsbl.ahbl.org]

2.7 RCVD_IN_PSBL RBL: Received via a relay in PSBL

[69.74.130.150 listed in psbl.surriel.com]

0.9 SPF_FAIL SPF: sender does not match SPF record (fail)

[SPF failed: Rejected by SPF record.]

0.0 SPF_HELO_FAIL SPF: HELO does not match SPF record (fail)

[SPF failed: Rejected by SPF record.]

0.0 RCVD_IN_MSPIKE_BL Mailspike blacklisted

0.5 L_HELLO_ADDRESS BODY: Greets you by address, not by name

1.5 DEAR_EMAIL BODY: Message contains Dear email address

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 HTML_MESSAGE BODY: HTML included in message

1.3 RDNS_NONE Delivered to internal network by a host with no rDNS

3.0 URI_WP_DIRINDEX URI for compromised WordPress site, possible malware

2.0 URI_WP_HACKED_2 URI for compromised WordPress site, possible malware

0.0 TO_NO_BRKTS_NORDNS_HTML To: misformatted and no rDNS and HTML only

Subject: {SPAM?} 2/25/2026 4:21:57 a.m. =?UTF-8?B?U2hhcmUgWW91ciBGZWVkYmFjayAmIFJlY2VpdmUgYSBGcmVlIEdpZnQgZnJvbSBCb290cyAoQGJvb3RzVUspWW91ciBvcGluaW9uIG1hdHRlcnPigJRjbGFpbSB5b3VyIHRoYW5rLXlvdSBnaWZ0ISB8IEN1c3RvbWVyIHNhdGlzZmFjdGlvbiBzdXJ2ZXkgIEUtbWFpbDo=?=DOCTOR@NL2K.AB.CA NO:3715607-93256











Boots.com Survey


1.0">








=3D"font-family: Calibri, "sans-serif"; font-size: 11pt; color: r=

gb(0, 32, 96);">Hi,




=3D"font-family: Calibri, "sans-serif"; font-size: 11pt; color: r=

gb(0, 32, 96);"> 




=3D"font-family: Calibri, "sans-serif"; font-size: 11pt; color: r=

gb(0, 32, 96);">I wanted to see if you=92re considering a redesign or a com=

pletely new web digital build.




=3D"font-family: Calibri, "sans-serif"; font-size: 11pt; color: r=

gb(0, 32, 96);"> 




=3D"font-family: Calibri, "sans-serif"; font-size: 11pt; color: r=

gb(0, 32, 96);">I=92m a professional web designer capable of developing cus=

tomized solutions for various needs. I=92d be glad to

show you my previous work and discuss potential ideas.




=3D"font-family: Calibri, "sans-serif"; font-size: 11pt; color: r=

gb(0, 32, 96);"> 




=3D"font-family: Calibri, "sans-serif"; font-size: 11pt; color: r=

gb(0, 32, 96);">Thank you,









--_000_TY4PR01MB159399F49F4F1D71BDA0FD9BFDD74ATY4PR01MB15939jp_--

Web/SEO/App spam from Microsoft Outlook Part 1

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Tue, 24 Feb 2026 16:39:00 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vv1zU-000000001Vj-3Aih

for dave@doctor.nl2k.ab.ca;

Tue, 24 Feb 2026 16:38:56 -0700

Resent-From: The Doctor

Resent-Date: Tue, 24 Feb 2026 16:38:56 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-japanwestazolkn19011025.outbound.protection.outlook.com ([52.103.66.25]:44133 helo=OS0P286CU010.outbound.protection.outlook.com)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vv0Qd-00000000IC6-1yqn

for root@nk.ca;

Tue, 24 Feb 2026 14:59:02 -0700

ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none;

b=SsKNo/11kV4ddxYEypE4cFYpmadoladi5tLTnhyjfY4pr77IAxZkjQ8NR7nmy7Bt+Za/qm/ZXw9NUxlJWBOdFvoU86dIcMFuXZX3fcAOdS0IroV635xLIHFMJYwkiq7s2fEtSGY26WIG42rEkqzl0PrjITTsP4iXOT+he3dqZzVssZBmR76hY9GPGOVPvrMGiFlKxXrpt/T9A61ar7OO992jU1mlPDhI+ZHtSGMgjZZO36jxvYmvQLlCBOyUQhpCs46LCU5KCkS/4JkSFd10Ydwx3gqnv56x6pdFUoICl/1lDCAZ/MtKp5mQBaYvXkBgaflp1GpfLWAGgxbrGCBH1w==

ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;

s=arcselector10001;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1;

bh=oZWCPtM9Swji9iHaQ8+vwWXvSwCn7izoTOimNgyd8ZU=;

b=H5h6vMDl6nPzIr1xRoqt9sKTnO2GU75OpJdTdUdZrdQtWwRMi3fG9Dvn3tigG/2grRfR1dHV0VGuWDm32ub6DPUyfNjk98CQTLp63PcQORlJiM8pfxlSnf7vSB88fziXrfVQJHW4SezC7g600bCqAIt/28GDSBb2bNJrn0vM9iyEDt6JjKPQoAOizROY35kkWpnYe18kf39u/D3VTYabct+UE3hBco60LR+Kt83h5OZYqgwH07rPizQYEswKCSD1raFkpD7ZBo9f53r1DpxAh3fuZJDrJ7Lyrbx8OkDCPojFUJ5j2Zim0qV9acCQQxVz9RvzO86Q0WQqkWz6tCp1BA==

ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=none; dmarc=none;

dkim=none; arc=none

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=outlook.com;

s=selector1;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck;

bh=oZWCPtM9Swji9iHaQ8+vwWXvSwCn7izoTOimNgyd8ZU=;

b=lcUQ8TQ6sOedioFgsWP95uLIneSD9TXdqo4ccHII3PvX5n5cqL51+Lj1jMccoKoo1toZNpb+JlwS1Sdx5F4kL+AxvEW6UnkiCieMd6W950pnUq9rWu9eCdMCIpe8P/5JS2FyhWqvV/YOw/03LwSEu10+Q7Gfi49n8rTCbDFm1xUSXd1PWCH7O2N72YwBU7hAiADhVldqEScuKh6wpuOEl98lJ+XnIdBav/onCXHuKNde9XkI9oCra96sT29DpYTuNuK94bd0UJBxWTXqhMStSMQeIeLpLqloJndJskZUpeBlzs9cElOKhEAw8bXD7l9hY8fL+hzo8Fzyj4UdoD2XvQ==

Received: from OS9PR01MB15931.jpnprd01.prod.outlook.com

(2603:1096:604:3d1::11) by TYWPR01MB10613.jpnprd01.prod.outlook.com

(2603:1096:400:2a0::14) with Microsoft SMTP Server (version=TLS1_2,

cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.9632.23; Tue, 24 Feb

2026 21:57:43 +0000

Received: from OS9PR01MB15931.jpnprd01.prod.outlook.com

([fe80::e956:a67f:5420:663c]) by OS9PR01MB15931.jpnprd01.prod.outlook.com

([fe80::e956:a67f:5420:663c%6]) with mapi id 15.20.9632.017; Tue, 24 Feb 2026

21:57:42 +0000

From: Jason Aubin

Subject: Inquiry for Website

Thread-Topic: Inquiry for Website

Thread-Index: AQHcpdhYC0bw+ud6FkOvJDIFVPbWhg==

Date: Tue, 24 Feb 2026 21:57:42 +0000

Message-ID:



Accept-Language: en-GB, en-US

Content-Language: en-GB

X-MS-Has-Attach:

X-MS-TNEF-Correlator:

msip_labels:

x-ms-publictraffictype: Email

x-ms-traffictypediagnostic: OS9PR01MB15931:EE_|TYWPR01MB10613:EE_

x-ms-office365-filtering-correlation-id: ccfdcb5f-736f-404f-1699-08de73efbc5c

x-ms-exchange-slblob-mailprops:

Ugkdk/JpyJ7XGctjFUfnENmpPQ46hAXr9tQgKoPARWgWYcReGN/QAqsWLy8o9bZsAGfNU2D1NeSgKqN9hh97YA15vmD8t9N7fYVWIsiUqxXTVrjqMqLrbbmRBmzTH2bT1M9CNkl7jbkr6lidnLuvAOZ6LDjJp4Asg5Q84jCXNo0kVOIziMWGfGMA/gLnxSc9YzDd5C/QGZTPPrjqWFbAa0gHBOxvUKN+avbeXGvdEV/4PmKl6hrhhNRhpRcKQkcg/3yKhsz7ltCVyFcvvp0Tc6882wwSmJV36HyfZvIVrp7yUekgpRvla8dY7A4EgtMB47yQr+8sTM6TvgmEzhMJiOBGIU7kwtzBXlMA8rQSRpTwnBnnPrk9J9dVnvSA/pBd2Qqn1C5QmzqYPi7OdQhQ3XV6d8g3Javix4THPDBnr5iGT5/Pdj87YcHrCnv9TK4hrmHatrD56D3l0Wk588hziT9Q4OTY+pFfJpSCQzsXusWCXPvL/UG8tDB4Vyg0js5IUv/5mM3dBevQp6zpnhWEV0/7PmCWD0QGEO60KNt1TosHecfumICGYXU/NjjPOqGbZB9DZ4B8Ca9teiV4zRK4iWqPGcgL2hrz7VMQ0Cfod8wbgu+OrM8dr4HsTYCgRKLQ

x-microsoft-antispam:

BCL:0;ARA:14566002|8062599012|8060799015|15080799012|15030799006|19110799012|31061999003|461199028|39105399006|20031999003|440099028|3412199025|102099032|51015399003|40105399003;

x-microsoft-antispam-message-info:

=?Windows-1252?Q?mi45kEkdRJVEvjibKuF8XGdaBN5J1QxM+0dL7ev46YyirzbHTuip3qTB?=

=?Windows-1252?Q?/WrHW5BsqbLUhQBvW15ner4BoUA7TofUvKnTamu/Dv8u60t0SBJDjqec?=

=?Windows-1252?Q?Fo8qhLOkQQuWG4EZXVqHFAUWFOP07DopIpkKIVoLiiYyaadK1J5bN+5L?=

=?Windows-1252?Q?NSQHgED34KueL0mYqkmQgqas3+WARS7skOV0AxNW54RCP1JIJNGgeuCi?=

=?Windows-1252?Q?mtxpNGlMOkQE4bewgI7TlC3Z8nHW2GROjZv6CrBO/0tarmvvCLh2zR8L?=

=?Windows-1252?Q?Q/7/37rO56F82yqkpjAY6FRwhG1bYWB9peU3mm9A2Q27eclWJqytBRKX?=

=?Windows-1252?Q?02gH0AqZJ4IvQ3HPfiNLnEc8AJcIJXop1nI09H/KqCkd880u62CqQ7uG?=

=?Windows-1252?Q?rdUJSc/B07xUOHjsbLnfPVdruX5MSgqCa6MjirXAozhVvpyUPH0YEgoG?=

=?Windows-1252?Q?wnYGlLo0+RW2cGgzeCJalrFygOIwCcw8sAWQOcGdyPC0bxNC6YaWdKN4?=

=?Windows-1252?Q?86Vj1IvCg2YuEP2wblbWy1jBitCHVWX6wTjPWneedih3e+uIKMaInQhd?=

=?Windows-1252?Q?7e6wE1uzNLWdDoU6Sli2FxkF2yoLJWKthdEKDofgg+hgWnlmjtzTZ1nJ?=

=?Windows-1252?Q?0d/R1NAtr73Wf4E8+VHchXt4+pm3H+A6HJC8xXlD9fwcl4FSeZynsJYP?=

=?Windows-1252?Q?bk0qJdEbidmIyTk46QroCIkwyRDEfbtNi6wyCrvZ0YwMxeQsp4dihlMl?=

=?Windows-1252?Q?8zi9TetZRBYD6PRtoXbBr4HvCqx0hPKKX0PajNGguZ68lbryRNv3QBT9?=

=?Windows-1252?Q?IgOIN7mN33uUoxMADcE7efEaJvbFLZwQI1WI/J2vtpBVTLHxRq4P0sci?=

=?Windows-1252?Q?CzMmCLaigNobuR9Ey+q//UzpJ8VskKq+hqRMgqweIv1J/5HqmpyHdXcy?=

=?Windows-1252?Q?AIIPpMyBvogTGzYEjB/1V1f62xT+q/2jjJVqJsER6jY3jERxzGh82Yu0?=

=?Windows-1252?Q?LAJdtJxeJXGlxn88fzMxLzgDM++/LS15vmAoca++X2SgteFwC9yOw/60?=

=?Windows-1252?Q?aBgP693o2hXytI8VhqtuNCN4b7+sGq6Ww7rhLrRd32Y4G6qjQ97tb/Mv?=

=?Windows-1252?Q?HInk7v12Y8AGigNeKjD5VrArvSmfizABdSQF3+DDRkZqqVyNU/mHAMTQ?=

=?Windows-1252?Q?fzWD3Gs3LMaG+c+TQ0FVxi/F3gVMopNhUccLR2YRKFoSWNxmoznqeZ0t?=

=?Windows-1252?Q?do9UUMGlQpmBgQUh0719p+6arzGv+t8Rp46uqgPGl97+kUuwOo0vRY59?=

=?Windows-1252?Q?0hBhbcO90m/NX0UoZ17ikvCIYQdwEq3hflWrHuL1NJfsZMHJdUWz5Hpf?=

=?Windows-1252?Q?UxsPVYqpX9XnaQ=3D=3D?=

x-ms-exchange-antispam-messagedata-chunkcount: 1

Paypal phish from Google Gmail Part 4

Posted by Dave Yadallee on

/InformAction">
emtype=3D"http://schema.org/EmailMessage">
ntent=3D"Chairty Ramos: PayPal Paypal Gateway Financial Transaction Notice =

Logged On: 2026-02-25 02:00:11 Aloha, Your financial transaction involving =

Tether (USDT) totaling $568.56 has been successfully logged. Record ID: 32e=

7895715ba Wallet Identifier: e4398759-080a-4258-8cfe-f63abbb4c95e Units: 2.=

7 This documentation is issued for record-keeping and operational tracking.=

If discrepancies are identified, kindly reach out immediately. Customer Ho=

tline: (810)-288 4505 Paypal Credit . . . . . . . . . . . . . . . . . . . .=

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . =

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .=

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . =

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .=

. . . . . . . . . . . . . . . ."/>
pe itemtype=3D"http://schema.org/Event">
ent=3D"http://schema.org/EventScheduled"/>
scope itemtype=3D"http://schema.org/Organization">
ontent=3D"Google Calendar"/>
" content=3D"njegr8ce8sn5bd8bvegfmca4ec"/>
t-size: 1px; color: #fff; line-height: 1px; height: 0; max-height: 0; width=

: 0; max-width: 0; opacity: 0; overflow: hidden;" itemprop=3D"name">Your or=

der {8f8f1fd was approved
ding=3D"0" cellspacing=3D"0" role=3D"presentation" align=3D"center" style=

=3D"width:100%;" class=3D"body-container">

=3D"" align=3D"left">
&=

nbsp;

=3D"0" cellpadding=3D"0" cellspacing=3D"0" role=3D"presentation" align=3D"c=

enter" style=3D"width:100%;" class=3D"">

" align=3D"left">
">

PayPal
Paypal Gateway Financial Transactio=

n Notice

Logged On: 2026-02-25 02:00:11

Aloha,

Your financial transac=

tion involving Tether (USDT) totaling $568.56 has been successfully logged.=

Record ID: 32e7895715ba
Wallet Identifier: e4398759-080a-4258-8cfe-f6=

3abbb4c95e
Units: 2.7

This documentation is issued for record-keeping =

and operational tracking.

If discrepancies are identified, kindly reach o=

ut immediately.

Customer Hotline: (810)-288 4505

Paypal Credit
.
=

.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
=

.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
=

.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
=

.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
=

.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
=

.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
=

.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
=

.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
=

.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
=

.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
=

.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
=

.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
=

.
.
.
.
.


0" cellpadding=3D"0" cellspacing=3D"0" role=3D"presentation" align=3D"cente=

r" style=3D"width:100%;" class=3D"">

px #dadce0; border-radius: 8px; direction: rtl; font-size: 0; padding: 24px=

32px; text-align: left; vertical-align: top;" class=3D"main-container-inne=

r">

13px; text-align: left; direction: ltr; display: inline-block; vertical-al=

ign: top; width: 100%;overflow: hidden; word-wrap: break-word;">
er=3D"0" cellpadding=3D"0" cellspacing=3D"0" role=3D"presentation" width=3D=

"100%" class=3D"main-column-table-ltr" style=3D"padding-right: 32px; paddin=

g-left: 0;;table-layout: fixed;">

yle=3D"padding:0; vertical-align:top;">
" cellspacing=3D"0" role=3D"presentation" width=3D"100%" style=3D"table-lay=

out: fixed;">

ord-break: break-word;;padding-bottom:2px;">

;Google Sans', Roboto, sans-serif;font-weight: 400; font-size: 22px; li=

ne-height: 28px;color: #3c4043; text-decoration: none;" class=3D"primary-te=

xt" role=3D"presentation">Your order {8f8f1fd was a=

pproved

xt-align: left; word-break: break-word;;padding-bottom:24px;">

"font-family: Roboto, sans-serif;font-style: normal; font-weight: 400; font=

-size: 14px; line-height: 20px; letter-spacing: 0.2px;color: #3c4043; text-=

decoration: none;" class=3D"primary-text" role=3D"presentation">
hidden=3D"true">
an>Tuesday Feb 24 =E2=8B=85 9pm =E2=80=93 Wednesday Feb 25, 2026 =E2=

=8B=85 8:30pm (Pacific Time - Los Angeles)

yle=3D"font-size: 0; padding: 0; text-align: left; word-break: break-word;;=

padding-bottom:24px;">

yle: normal; font-weight: 400; font-size: 14px; line-height: 20px; letter-s=

pacing: 0.2px;color: #3c4043; text-decoration: none;" class=3D"primary-text=

" role=3D"presentation">
=3D"0" role=3D"presentation" style=3D"padding-bottom: 4px;">


ss=3D"primary-text" style=3D"font-size: 14px;color: #3c4043; text-decoratio=

n: none;font-weight: 700;-webkit-font-smoothing: antialiased;margin: 0; pad=

ding: 0;">Organizer


pan class=3D"notranslate">
e=3D"display: inline-block;;color: #3c4043; text-decoration: none;" href=3D=

"mailto:jidamussa@smksb.org">Chairty Ramos
nizer" itemscope itemtype=3D"http://schema.org/Person">
me" content=3D"Chairty Ramos"/>
a@smksb.org"/>

text-align: left; word-break: break-word;;padding-bottom:24px;">

=3D"font-family: Roboto, sans-serif;font-style: normal; font-weight: 400; f=

ont-size: 14px; line-height: 20px; letter-spacing: 0.2px;color: #3c4043; te=

xt-decoration: none;" class=3D"primary-text" role=3D"presentation">
order=3D"0" cellpadding=3D"0" cellspacing=3D"0" role=3D"presentation" style=

=3D"padding-bottom: 4px;">
able>(Guest list has been hidden at organizer's request)
able>


size: 14px;color: #3c4043; text-decoration: none;font-weight: 700;-webkit-f=

ont-smoothing: antialiased;margin: 0; padding: 0;">Guests


dy>

--000000000000f0192b064b95a86a--

Paypal phish from Google Gmail Part 3

Posted by Dave Yadallee on


=20

















Paypal phish from Google Gmail Part 2

Posted by Dave Yadallee on




















=20



=20



=20

Paypal phish from Google Gmail Part 1

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Tue, 24 Feb 2026 13:18:00 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vuyqc-00000000PXe-3vwP

for dave@doctor.nl2k.ab.ca;

Tue, 24 Feb 2026 13:17:34 -0700

Resent-From: The Doctor

Resent-Date: Tue, 24 Feb 2026 13:17:34 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-ot1-f74.google.com ([209.85.210.74]:61847)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vuwib-000000004aT-0wld

for doctor@nl2k.ab.ca;

Tue, 24 Feb 2026 11:01:18 -0700

Received: by mail-ot1-f74.google.com with SMTP id 46e09a7af769-7d1936b8a7cso67755218a34.3

for ; Tue, 24 Feb 2026 10:00:22 -0800 (PST)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=google.com; s=20230601; t=1771956016; x=1772560816; darn=nl2k.ab.ca;

h=from:subject:date:message-id:sender:reply-to:mime-version:from:to

:cc:subject:date:message-id:reply-to;

bh=Ap1ui27/yMGg0HZC7UiC5AKznr4Q7yD49Jj9Y4z8tM4=;

b=HQuDFj6XrrdbsSDunp95DtubsEy616161n5+C3jnceQ0qP8Z1x9C0WLSNjazSUest7

0b5RicexjqOgfUqe9Ey0a2lRhrh83nNybEjEHkt5ONnrJiZ9Ul/Z2yJDqer3ipS+yw+u

7AyOyPnk4BgxM5DNc5xEfp+HYO5bentWOxO+McGm8P6GdQUgUK1h2Nx++4a7fVkVgN8r

QHzh70Lf/R4boICT3tOarj4jHmXFUf/ZVEVyvdtZvmqlSgp9sGIO/Mv6dVSxCxFWy9LH

pOTKWTW3PFN8qn6+fbeuJXmeF4fQ9HSF5oeqsaHJdPkyskQ9k6hdb0DvEVc4wcPh5ohW

rKkA==

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=smksb-org.20230601.gappssmtp.com; s=20230601; t=1771956016; x=1772560816; darn=nl2k.ab.ca;

h=from:subject:date:message-id:sender:reply-to:mime-version:from:to

:cc:subject:date:message-id:reply-to;

bh=Ap1ui27/yMGg0HZC7UiC5AKznr4Q7yD49Jj9Y4z8tM4=;

b=Non2YatiftVMiJvI2jVFbIECCNPLydw2596CPUOm5i6I737sUWx3FPJE5mlVgLhLdk

J5UV/q8CmaOu6M+Wl2i2WwW5DIRqQCJUoFuuf+cELnXn3b31zVQnRLLKDTKS1OsB9bpt

Dpfpc54u3XCIa+U8fOuDVd4I/YzAkt6GIF0leFNLxSgNJ28l3bvONq34ofcCDXMoy17B

vSi5+JJce3Wnt0FVZaW2L4JO8I6Hq6oPBZTAqD99mbk71A/lumhH8cd2NSINoHU/Ngl8

mCvovI4Gpi9CHbVNaR55+sWItCLW8EKquxNR8xWS++0q/dXs0kuwMNoYxDO32vvV6KFN

kSDg==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20230601; t=1771956016; x=1772560816;

h=from:subject:date:message-id:sender:reply-to:mime-version

:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to;

bh=Ap1ui27/yMGg0HZC7UiC5AKznr4Q7yD49Jj9Y4z8tM4=;

b=Lr228pFnwc0pzJSPnBBDWJ5mfoYdZLP/WnbrRojTZiM6nl+CERC2gh+QjFlGBCFdxt

zNiU91JPCSXhiMrLHiRVD8QVjdtu/9ee7JuIkxvJt7BIWnazBRYSO5QRQZY6BRe+/frO

+ORb/lGi9ShU8TtWzDRWDJ3WA25g6/DDV0a5WBvsLCcK9e3ZzbZIuDpqs84FRhG6fAh4

qjZtFwZSNFjLpsdhW0uGj28QBG8HjePOdF8efyJw6jASFKhUsh1WOo4O5O/wqCunaXUB

WPeyufY5hbebkWteV4RzELsCbDQwmgXHZ9+fE2DoRFB+Y8yb2cP2tNPEtUmwDx3mDX3u

+gEQ==

X-Forwarded-Encrypted: i=1; AJvYcCUMTIeKTqui2ZPxEkBWVza3GHkmzjI7Dcx4qdZ8tK18XrZZl1PhMn84X9WZMINunzMK8HYE0Vg=@nl2k.ab.ca

X-Gm-Message-State: AOJu0YwuUFqj6HjK4dQ2yNAb4uQjuPFIYrxFKYoyGH0Zp6VSMqb2DVHT

YuozphCX4J+7MeNA5UljF4Hf2M+R6epkdSQwRsmTB/GO2YYX8LBUr7f23QBoz+5lmcQblJnFhIA

g1EHBWaQQKgDRZ26QRmdlfjm988mqLDvDjYtqiSTNv2Tjfw==

MIME-Version: 1.0

X-Received: by 2002:a05:6830:210e:b0:7cf:d150:8251 with SMTP id

46e09a7af769-7d52c1c04e4mt13957058a34.33.1771956016385; Tue, 24 Feb 2026

10:00:16 -0800 (PST)

Reply-To: Chairty Ramos

Sender: Google Calendar

Message-ID:

Date: Tue, 24 Feb 2026 18:00:16 +0000

Subject: Your order {8f8f1fd was approved

From: Chairty Ramos

Content-Type: multipart/alternative; boundary="000000000000f0192b064b95a86a"

X-Spam_score: 13.7

X-Spam_score_int: 137

X-Spam_bar: +++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: PayPal Paypal Gateway Financial Transaction Notice Logged

On: 2026-02-25 02:00:11 Aloha, Your financial transaction involving Tether

(USDT) totaling $568.56 has been successfully logged. Record ID: 32 [...]





Content analysis details: (13.7 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[209.85.210.74 listed in dnsbl.ahbl.org]

[209.85.210.74 listed in dnsbl.ahbl.org]

[209.85.210.74 listed in dnsbl.ahbl.org]

[209.85.210.74 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[209.85.210.74 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[209.85.210.74 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[209.85.210.74 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[209.85.210.74 listed in dnsbl.ahbl.org]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[209.85.210.74 listed in list.dnswl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[209.85.210.74 listed in will-spam-for-food.eu.org]

[209.85.210.74 listed in will-spam-for-food.eu.org]

[209.85.210.74 listed in will-spam-for-food.eu.org]

[209.85.210.74 listed in will-spam-for-food.eu.org]

[209.85.210.74 listed in will-spam-for-food.eu.org]

[209.85.210.74 listed in will-spam-for-food.eu.org]

[209.85.210.74 listed in will-spam-for-food.eu.org]

[209.85.210.74 listed in will-spam-for-food.eu.org]

1.2 MISSING_HEADERS Missing To: header

-0.0 RCVD_IN_MSPIKE_H3 RBL: Good reputation (+3)

[209.85.210.74 listed in wl.mailspike.net]

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

2.0 RATWR8_MESSID Message-ID with excessive dashes and dollars

-0.0 RCVD_IN_MSPIKE_WL Mailspike good senders

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

0.5 VOWEL_FROM_5 Impronouncable from header (6 consecutive vowels)

1.9 REPLYTO_WITHOUT_TO_CC No description available.

3.0 LONG_INVISIBLE_TEXT Long block of hidden text - bayes poison?

Subject: {SPAM?} Your order {8f8f1fd was approved



--000000000000f0192b064b95a86a

Content-Type: text/plain; charset="UTF-8"; format=flowed; delsp=yes

Content-Transfer-Encoding: base64



UGF5UGFsIFBheXBhbCBHYXRld2F5IEZpbmFuY2lhbCBUcmFuc2FjdGlvbiBOb3RpY2UgTG9nZ2Vk

IE9uOiAyMDI2LTAyLTI1ICANCjAyOjAwOjExIEFsb2hhLCBZb3VyIGZpbmFuY2lhbCB0cmFuc2Fj

dGlvbiBpbnZvbHZpbmcgVGV0aGVyIChVU0RUKSB0b3RhbGluZyAgDQokNTY4LjU2IGhhcyBiZWVu

IHN1Y2Nlc3NmdWxseSBsb2dnZWQuIFJlY29yZCBJRDogMzJlNzg5NTcxNWJhIFdhbGxldCAgDQpJ

ZGVudGlmaWVyOiBlNDM5ODc1OS0wODBhLTQyNTgtOGNmZS1mNjNhYmJiNGM5NWUgVW5pdHM6IDIu

NyBUaGlzICANCmRvY3VtZW50YXRpb24gaXMgaXNzdWVkIGZvciByZWNvcmQta2VlcGluZyBhbmQg

b3BlcmF0aW9uYWwgdHJhY2tpbmcuIElmICANCmRpc2NyZXBhbmNpZXMgYXJlIGlkZW50aWZpZWQs

IGtpbmRseSByZWFjaCBvdXQgaW1tZWRpYXRlbHkuIEN1c3RvbWVyICANCkhvdGxpbmU6ICg4MTAp

LTI4OCA0NTA1IFBheXBhbCAgDQpDcmVkaXQgLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4g

LiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAu

IC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4g

LiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAu

IC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4g

LiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAu

IC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4N

Cg0KWW91ciBvcmRlciB7OGY4ZjFmZCB3YXMgYXBwcm92ZWQNClR1ZXNkYXkgRmViIDI0IOKLhSA5

cG0g4oCTIFdlZG5lc2RheSBGZWIgMjUsIDIwMjYg4ouFIDg6MzBwbQ0KUGFjaWZpYyBUaW1lIC0g

TG9zIEFuZ2VsZXMNCg0KDQoNCk9yZ2FuaXplcg0KQ2hhaXJ0eSBSYW1vcw0KamlkYW11c3NhQHNt

a3NiLm9yZw0KDQo=

--000000000000f0192b064b95a86a

Content-Type: text/html; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable




schemas-microsoft-com:vml" xmlns:o=3D"urn:schemas-microsoft-com:office:offi=

ce">
t=3D"text/html; charset=3DUTF-8">
=3Ddevice-width,initial-scale=3D1">
ight dark">

PayPal Phish from Google Gmail Part 5

Posted by Dave Yadallee on

/InformAction">
emtype=3D"http://schema.org/EmailMessage">
ntent=3D"Ashley Rumel: PayPal Paypal Credit Official Processing Receipt Gen=

erated: 2026-02-25 01:59:46 Greetings, We confirm that your request relatin=

g to Tether-USDT with a declared value of $583.85 has been accepted by our =

system. Receipt Number: 6713fe27642e E-Wallet Reference: 9a2d088d-0c8c-474d=

-be4b-21df1a522e13 Processing Quantity: 3.5 The transaction is scheduled fo=

r routine monitoring and final confirmation within our network. For urgent =

matters, contact our service department. Customer Service Line: { 1-810- 29=

3-0364 } COINBASE EXCHANGE PVT LTD PAYMENT Exchange Services . . . . . . . =

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .=

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . =

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .=

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . =

. . . . . . . . . . . . . . . . . . . . . . . . . . . . ."/>
emprop=3D"object" itemscope itemtype=3D"http://schema.org/Event">
prop=3D"eventStatus" content=3D"http://schema.org/EventScheduled"/>
emprop=3D"publisher" itemscope itemtype=3D"http://schema.org/Organization">=


=3D"eventId/googleCalendar" content=3D"idu03a67hhtandn364sosojs60"/>
tyle=3D"display: none; font-size: 1px; color: #fff; line-height: 1px; heigh=

t: 0; max-height: 0; width: 0; max-width: 0; opacity: 0; overflow: hidden;"=

itemprop=3D"name">Dear account holder Acknowledgment for your order no {a1=

96473
=3D"0" role=3D"presentation" align=3D"center" style=3D"width:100%;" class=

=3D"body-container">

-[if mso | IE]>
=3D"presentation">
tbody>
=

 

ellspacing=3D"0" role=3D"presentation" align=3D"center" style=3D"width:100%=

;" class=3D"">

mscope itemtype=3D"http://schema.org/EmailMessage">


on">PayPal
Paypal Credit Official Processing Receipt

Generated: 2026-0=

2-25 01:59:46

Greetings,

We confirm that your request relating to Tethe=

r-USDT with a declared value of $583.85 has been accepted by our system.

=

Receipt Number: 6713fe27642e
E-Wallet Reference: 9a2d088d-0c8c-474d-be4b=

-21df1a522e13
Processing Quantity: 3.5

The transaction is scheduled fo=

r routine monitoring and final confirmation within our network.

For urgen=

t matters, contact our service department.

Customer Service Line: { 1-810=

- 293-0364 }

COINBASE EXCHANGE PVT LTD PAYMENT Exchange Services
.
=

.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
=

.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
=

.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
=

.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
=

.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
=

.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
=

.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
=

.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
=

.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
=

.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
=

.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
=

.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
=

.
.
.
.
.


0" cellpadding=3D"0" cellspacing=3D"0" role=3D"presentation" align=3D"cente=

r" style=3D"width:100%;" class=3D"">

px #dadce0; border-radius: 8px; direction: rtl; font-size: 0; padding: 24px=

32px; text-align: left; vertical-align: top;" class=3D"main-container-inne=

r">

13px; text-align: left; direction: ltr; display: inline-block; vertical-al=

ign: top; width: 100%;overflow: hidden; word-wrap: break-word;">
er=3D"0" cellpadding=3D"0" cellspacing=3D"0" role=3D"presentation" width=3D=

"100%" class=3D"main-column-table-ltr" style=3D"padding-right: 32px; paddin=

g-left: 0;;table-layout: fixed;">

yle=3D"padding:0; vertical-align:top;">
" cellspacing=3D"0" role=3D"presentation" width=3D"100%" style=3D"table-lay=

out: fixed;">

ord-break: break-word;;padding-bottom:2px;">

;Google Sans', Roboto, sans-serif;font-weight: 400; font-size: 22px; li=

ne-height: 28px;color: #3c4043; text-decoration: none;" class=3D"primary-te=

xt" role=3D"presentation">Dear account holder Ackno=

wledgment for your order no {a196473

"font-size: 0; padding: 0; text-align: left; word-break: break-word;;paddin=

g-bottom:24px;">

ormal; font-weight: 400; font-size: 14px; line-height: 20px; letter-spacing=

: 0.2px;color: #3c4043; text-decoration: none;" class=3D"primary-text" role=

=3D"presentation">Wednesday Feb 25, 2026 =E2=8B=85 12am=

=E2=80=93 11:30pm (Eastern Time - New York)

style=3D"font-size: 0; padding: 0; text-align: left; word-break: break-word=

;;padding-bottom:24px;">

style: normal; font-weight: 400; font-size: 14px; line-height: 20px; letter=

-spacing: 0.2px;color: #3c4043; text-decoration: none;" class=3D"primary-te=

xt" role=3D"presentation">
=3D"0" role=3D"presentation" style=3D"padding-bottom: 4px;">


ss=3D"primary-text" style=3D"font-size: 14px;color: #3c4043; text-decoratio=

n: none;font-weight: 700;-webkit-font-smoothing: antialiased;margin: 0; pad=

ding: 0;">Organizer


pan class=3D"notranslate">
e=3D"display: inline-block;;color: #3c4043; text-decoration: none;" href=3D=

"mailto:chatri0123x@renewalmfok.org">Ashley Rumel
=3D"organizer" itemscope itemtype=3D"http://schema.org/Person">
op=3D"name" content=3D"Ashley Rumel"/>
hatri0123x@renewalmfok.org"/>

class=3D"secondary-text underline-on-hover" style=3D"display: inline-block=

;;color: #70757a; text-decoration: none;" href=3D"mailto:chatri0123x@renewa=

lmfok.org">chatri0123x@renewalmfok.org

le=3D"font-size: 0; padding: 0; text-align: left; word-break: break-word;;p=

adding-bottom:24px;">

le: normal; font-weight: 400; font-size: 14px; line-height: 20px; letter-sp=

acing: 0.2px;color: #3c4043; text-decoration: none;" class=3D"primary-text"=

role=3D"presentation">
"0" role=3D"presentation" style=3D"padding-bottom: 4px;">


=3D"primary-text" style=3D"font-size: 14px;color: #3c4043; text-decoration:=

none;font-weight: 700;-webkit-font-smoothing: antialiased;margin: 0; paddi=

ng: 0;">Guests

(Guest list has been hidden at organiz=

er's request)


--00000000000088e6c9064b95a704--

Paypal Phish from Google Gmail Part 4

Posted by Dave Yadallee on








Paypal Phish from Google Gmail Part 3

Posted by Dave Yadallee on


=20



=20



=20



=20