Sexual anatomical phish from Microsoft Outlook
Posted by Dave Yadallee onEnvelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Sun, 23 Nov 2025 05:37:00 -0700
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))
(envelope-from
id 1vN9Km-000000003iP-2KUk
for dave@doctor.nl2k.ab.ca;
Sun, 23 Nov 2025 05:36:52 -0700
Resent-From: The Doctor
Resent-Date: Sun, 23 Nov 2025 05:36:52 -0700
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from mail-westusazon11022119.outbound.protection.outlook.com ([52.101.43.119]:34750 helo=SJ2PR03CU001.outbound.protection.outlook.com)
by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384
(Exim 4.98.2 (FreeBSD))
(envelope-from
id 1vN8as-00000000GN3-0tIt
for doctor@nk.ca;
Sun, 23 Nov 2025 04:49:36 -0700
ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none;
b=pt2eJ0F/3K+i+pGIf5H7AYCfxEFXJeiAHrYVLWoq197sHW8zqul14rJiGv3uhz/ot2bswFTWYWEcTHlZUDojLyIE9R1BNnBCq5kI70DZ/abNj0RZIJ+PjbfMBk3O0RjxHNPFUmfqHbF5IZy9+fg8ruPF/YmIL4TsjAy0oM9KmxseWlVfVPAfYrk7TsDv/wGy54/9Gjd2O6qINXeAbPfU8eB60J9D54xd6g7Sf/6zdXVLEk+zr8AvT+y8HTDCuQwNmC8YcgQqOEpqUX13L5RVvTbshANOyeAQQOD9F+bwnEZq4OCfcBm4ZDVIM0KagXrW18K3kdxGQfEFUGY4p9jbiw==
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;
s=arcselector10001;
h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1;
bh=TbYqjdnwOwTAWMo+we2+r2h2csywgApY8ZWYbThO5QU=;
b=ks7yxAoRxVPqRzWt7Oicvw1n7+TRuPbvBb3M4uF8by1CsmoU3NRd7Tuzm5O809Iy+YeP+OZW8OGWTK9DSLqJ7b3CZ3pvlgvxCs1y1tZNZXxgH/h7KFtIbf79At705m3wSmhO3+bikKz2tqzzTR82oe6Vos85KMFPvm2jVdCerbceuwmRkpyJlIO9BemER7yrUQC9Qb+e0/M1RIaUL1y3vtuWJjEmvu6p3LGZINI22/95I/AkjkFVD8KFZs1e7WtSz0BGfdLxOZsJzE/zz41upxqzkkwLNHONurbYNyU7uzIRsh2TzRHpbFrvVhciIHqQWO/8sfz1bpSVZfHP2siiRQ==
ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass
smtp.mailfrom=vbravo.tecnm.mx; dmarc=pass action=none
header.from=vbravo.tecnm.mx; dkim=pass header.d=vbravo.tecnm.mx; arc=none
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=generico9.onmicrosoft.com; s=selector2-generico9-onmicrosoft-com;
h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck;
bh=TbYqjdnwOwTAWMo+we2+r2h2csywgApY8ZWYbThO5QU=;
b=e56HhHLw0syoUJ1fkRSMP6VWNh7JCCAGvvI4HgY4SpchMz2+0w0rbhKTIGsy+DrX1wCvQ54MM8T98Ak/Z8LHHOGll9MW/43NvV3eZ1Qv4Z2E+svGw1y/UuFMaJjHKsKD1BXt22/BswpJL6nFYOenlij7zwQb0ZlalhS1mQbMoIY=
Authentication-Results: dkim=none (message not signed)
header.d=none;dmarc=none action=none header.from=vbravo.tecnm.mx;
Received: from SJ0PR13MB5893.namprd13.prod.outlook.com (2603:10b6:a03:437::20)
by BLAPR13MB4594.namprd13.prod.outlook.com (2603:10b6:208:320::15) with
Microsoft SMTP Server (version=TLS1_2,
cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.9343.16; Sun, 23 Nov
2025 11:48:28 +0000
Received: from SJ0PR13MB5893.namprd13.prod.outlook.com
([fe80::d8b9:18bd:f710:51c7]) by SJ0PR13MB5893.namprd13.prod.outlook.com
([fe80::d8b9:18bd:f710:51c7%6]) with mapi id 15.20.9343.016; Sun, 23 Nov 2025
11:48:28 +0000
Date: Sun, 23 Nov 2025 06:48:14 -0500
To: doctor@nk.ca
From: "doctor@nk.ca"
Subject: Fwd:
Message-ID:
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: 8bit
X-ClientProxiedBy: GVZP280CA0014.SWEP280.PROD.OUTLOOK.COM
(2603:10a6:150:272::7) To MW5PR13MB5902.namprd13.prod.outlook.com
(2603:10b6:303:1c9::7)
MIME-Version: 1.0
X-MS-PublicTrafficType: Email
X-MS-TrafficTypeDiagnostic: SJ0PR13MB5893:EE_|BLAPR13MB4594:EE_
X-MS-Office365-Filtering-Correlation-Id: 35ffd547-9931-42da-b556-08de2a8637bb
X-MS-Exchange-SenderADCheck: 1
X-MS-Exchange-AntiSpam-Relay: 0
X-Microsoft-Antispam:
BCL:0;ARA:13230040|41320700013|366016|376014|52116014|1800799024|8096899003|38350700014;
X-Microsoft-Antispam-Message-Info:
=?utf-8?B?cnJpM1RXQnp6UnZXNGwxRHJGOHRSVFBuVStIN2swM3NTakJScG1YWnAvVXdu?=
=?utf-8?B?TzdsdG5ZWUtDTzVvVnVsTFI0dEFNR3BSQkxCYjlkOXhpcTRQZ2d0QVhyd0xJ?=
=?utf-8?B?ZGVwNXZoZmhvV253SzBPdE9FbHo0d1pvNjV6RkNiTmwxaW1mYWtGdVdmanc5?=
=?utf-8?B?blNobE42OUFVR21PNW0wT2ZuZmhvNUhrZVJVSGtndVNhOGxzZEVvemlTWVBB?=
=?utf-8?B?czlqeEZiSndCMy9RbTFsY2VndGFRbGFpWHVSWWYwVXVmNkdVVm81R2dXYk1P?=
=?utf-8?B?VUYrL0RlYnhBNFBFcWRtY3pLSnk5MFBHQm1XajA2M0ZBeklvRmgvMjI4aEVr?=
=?utf-8?B?WldDaXY4b01lZkhqNkxxZEhld1MzOUxXY3RlZFRxQWJLeHlmVDQwZWNPeXN2?=
=?utf-8?B?RmFwNlhKMnBmVEIxSlEveWFRR1Q0ank1SGpBMTFpc3NBR3plZkpVRVpUMTQw?=
=?utf-8?B?ZG9vcFNCN3lkeTNUUWlBQWFRS3huQm1sMHhXSTdGTkN1eVpLaG5JNlJvVTND?=
=?utf-8?B?bExNMU5GQzRMWWs4cHNaMld6Y2hDYjg1blFWS3BGOXBPSDUrREw1WDRsY250?=
=?utf-8?B?ZEh2OXM0V2RTeEVXeXlyc2tKRWdXSFFCNDh5ekFVdWhEaXJQVnc5NmtNZmpl?=
=?utf-8?B?N3I0WXJzL0ZCZ0pGbW1ydDdlbmlWdmJUZDA5M2pqRHVGaVJIZXJjV3cxWnlH?=
=?utf-8?B?Sm5hSTRhcTVOSTVNcEN6cHFuRkJTUHZVQW55WU1zVVNSVnhJYWtaUThxWFJp?=
=?utf-8?B?NUlDYy9WcFdWL0ZhaGE1NU1MbVFaTXhsRXFtdVpFUTJhQmNaL1Rwd2JZL210?=
=?utf-8?B?d0xtRzIzUjM3TkVqeGxUYSs3NUVzU2xjaEJTc2s0SlFzVk5DSkJTMnVUTzFp?=
=?utf-8?B?SkpUdjNpWWNYMFU1OFdLa1RKN2pNakt2VElBY1hIZngrZDBYNjF0MWMraGZu?=
=?utf-8?B?SThXNG9ZSWJXQzRLeUMrbDFhZXZ3ZGFwNTRQeEppeVh5WW41bkV0UW5WV3Fp?=
=?utf-8?B?SWVWUG9ubDV1QUJYNnlXVVB4ZWp5OVZoUlh4Sm5NMncydWdPa3B1SlRodWUy?=
=?utf-8?B?OWtPYnRoZ1Q4M0NrZnNLU09XNVJmdXE5R2h0Sys0RnhYb0dDaytwMnZiZkNJ?=
=?utf-8?B?Vlc3T1JWbmJvWmJPZFlDdENHeWI4NGlQV1hJZUpoQjdrRnZGd3ZWS0tDd1lx?=
=?utf-8?B?ajdtclVMTEZic3Z0dHdqckg2N2JFZTVGV2RaMUU4Vnc5bG5SV2RDdmp3b2RN?=
=?utf-8?B?QW1LVWJJZVZWb3A0cjVMdEs1S3JTWFlwOWVCSjJXTjBGMFNPUW1tTzRwdnRG?=
=?utf-8?B?YTR3UmFuN2NvV0tKZHZ0SXBjM3lFcFVVZDJlYTNVcW9yRzA0VGUrMnlad3Q2?=
=?utf-8?B?QkxVaGptRjY3M0ZCMU85aVhVMmdjam95WXZGbElVWkdHMUJBYkdnNWkwMldG?=
=?utf-8?B?TTEvdUNqZU1UeUZER1Qyb0RvUnNUZTdMazR3dUFzSUZ5WWYzUGtLM2R1N0Vx?=
=?utf-8?B?RDdKY0NQUXNjeUFKTVN5dUMrd212d2FMVVVUVzJ6VTBXTExhVHBLNnFvM3Vm?=
=?utf-8?B?bEpDaDdjMkRoT1FqSW5aNVBWVUVIK3M3UE9XeFVTajFlR1lmUU1nNFU0cUMr?=
=?utf-8?B?VkJKMXNTb2Z4SVIvQk1GUWl6K2hRTmc2UEdRQ1ZsejZDSENFamdvRm9FVzlt?=
=?utf-8?B?T0VJZ0dRTDhCLytwdEZwdXpDNmtUM0hMaGs2aFZCSnJiQ2hYdlVPcmRQdWtn?=
=?utf-8?B?dy9GYitrRE5EMTduZm93QXdCemo1akRZcXA0RlZtNjZ3d2ROQUJVejZBZWZw?=
=?utf-8?B?MUpBSzVjR2xpaDFaOWt1S0VFdG5DbENlK2ptNGIyK3hHRHJCWUxaL1UyZ0xm?=
=?utf-8?B?S2EwbXgyeitvZ3JwSldEYy9IMXVmMS9IaFB2ejJ3eDE0bEhlVWJaZ3kzZDlE?=
=?utf-8?B?UTNOaGJoc2piTlh3Yi9uUEcxWkhWek03Sm9ZUFBoc1Noa2pvMVJkYUlvRGIr?=
=?utf-8?B?OFNySHZGMXZJMlBnYnhpZjQxdUNMZEFGenZyUExZRVgvbDJ3cmJhUm4zTnNa?=
=?utf-8?Q?ozfUVx?=
X-Forefront-Antispam-Report:
CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:SJ0PR13MB5893.namprd13.prod.outlook.com;PTR:;CAT:NONE;SFS:(13230040)(41320700013)(366016)(376014)(52116014)(1800799024)(8096899003)(38350700014);DIR:OUT;SFP:1102;
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0:
=?utf-8?B?V1VpV2lUc3hHYXNUWnhQSWNGejd0YjI3azZXNEJTMFZMMFg4dllFeXB0VEdN?=
=?utf-8?B?dTd6RTRzUGN3R1NwcjZCeFY3czBrWE9JL0x1bUUrQmFBNENzempUNjlMUWpP?=
=?utf-8?B?WHgxYS9Yc1dtVVllSkpaUWRhNjFuMzVUeHIxSU1POURmVzQ4dDNIc3lwY3Vo?=
=?utf-8?B?VEpxdXFsK2JsaUFTTUNVdkRKY0phWVQzS1ZXdnJ0K25sM1ZGOUNoTEd6NXo2?=
=?utf-8?B?SHZXUWZ6WEEzQXFWa3NGVjdqU3B1TEsvcEtGWDFjWTY4WlVpS3I4Rnp5Q0dM?=
=?utf-8?B?bDdGejVhVVhNeUMwd2NEUlZQQ3VNb2lvcmJML2ZvaXo0REZTV1BwRll6VjQr?=
=?utf-8?B?eE1hUXg4R1ZWS3J6U0pQUXd4VWRkdXUxS1BpbjlpN2JyN1NRWHhMWGRaUno1?=
=?utf-8?B?VUUrOU13U0tOT2h4S0E1WlZTN3dwMDA5T2tORi95azlYMTU0WXQ3M3Nsc25p?=
=?utf-8?B?M01UTnRTQ2lPTjhQN3J2UmNvcVFqVGI2VTBDblZYcTZmZXd2ZDVXSlhtLzRP?=
=?utf-8?B?RkFkUFNhY2Fsd1ZQNHNmMkFtM3QyNmRGQ29DUVJNWHpya1lyRmhEQ2pOYitL?=
=?utf-8?B?UlNSbzZlV2tMQWhsYzQ0endTOGJxMU9vc2Qrd3ZCa3JQM09IYUNrT3NyZWlm?=
=?utf-8?B?Q00ySDNST0RUdUpWSmQ5b0xhZ0x2U3d2MDErYkVsZWpnRlE1eTdHMERYUDFw?=
=?utf-8?B?TkRSeTRVbW1XSFM1V3Y1ZEJRN3VDTDl1NFJMSHdtN0ljQThPL1dLSmVReEw0?=
=?utf-8?B?bVY3ZEl2VEpITW1CaUdvTTNTSGo5OW11dUlNV2pZSWR0Uy9mVlpzYk9BYUhy?=
=?utf-8?B?cEtDSGxmd1RHMXlvc0M5Q2oydlI3Mkh1aU5xYXQ1dVJUaGVsTFVkQVB5aGF0?=
=?utf-8?B?Q2VTQzZmMXE4cnZ6OVA5bUVBSWJxY1RMTE9ZeGZSVjEydDBaTWtoQis4dmVv?=
=?utf-8?B?cWMzUHJOZUxhMUt3dnA2QTZoUFpvaVF4R3grQXpKTXRlcnFVc2FNQkpVMFRn?=
=?utf-8?B?bi93aG44eElpQmx1aE5rZXZxMGE4THJldVNOeXpEejl3OEREcU00M1dEQjZH?=
=?utf-8?B?d2lseUthVlRpZDlMSUFzVTdTMS9GcGZvYzBEWHREeldQMEpNNHJkUVpqRENB?=
=?utf-8?B?b1BSdlVlMjFwMlpKRzB1Y3hCWE9hT2dEUlNyWkxqQTBVT29yYnBvNkxGS3Ur?=
=?utf-8?B?aHp1NVZYeUE5NlJUblFvOWNJeVFyRUVOaXhxTmlzQUplU05Db3VwY0Nxb1Ey?=
=?utf-8?B?aDVFK2xGUC9UUmpiaXV6S1I3K1Y0U0xCQ1A1ZlZuWWFXRTNueENoZlRJUXN5?=
=?utf-8?B?TUd5M3RUTURHUklJTVhsN1d0NThHcUxzejk2NXJLRzAyQ0M5dDhmSHVBQUdN?=
=?utf-8?B?bElDbWNqNjRaRnpvdEF6R1hHL3ZIK2V4RmxiaHVZems3RmJ2enk1WnFRK29u?=
=?utf-8?B?R2lVWE53MmRpeld4MDdJRStmcHNvcTRHWlNzVzV4RWdGaG54dGdXTWhDNFhh?=
=?utf-8?B?WW5IZ3JWOTN0b0NSRDRSMGFzcmdVWi96WEZqVW1Za3h6UXQ3N1pQbE1JcCt3?=
=?utf-8?B?a1VTcDBCY00zNWdxVjV4U0sybFZkRmVTR3hiV3JUdGx2b0NJQkV2MGdoUlpa?=
=?utf-8?B?UEtNM2JWNmFtUHNLQlNLOXpVbmg2SGtvOExCcXU1bHY2MWRma1pJQ2p1Wlgy?=
=?utf-8?B?MlJncFNnRmwvUlJJRXBRZ1R0VlpGWEt3ZXdnVVlFa0xBYnlqZGtrZzhUOVBR?=
=?utf-8?B?UmtNKzUwS1NYZDlzNGdaSWJMRGo1aU1FS0tqRXhvOWxINFhReXFkT1FGeFVS?=
=?utf-8?B?QjliTTI5allrQU1Xc3ljTmdyR2hscUp1ZC95N2VIRXhYMlNGaTd2Q0Q1RVF6?=
=?utf-8?B?MWZJcHFwdjNJeE5RL1YwZHNleVNRYk9USWI2bWYwaTFpVmttZWNtNExQZGNn?=
=?utf-8?B?ZXF1a1loQkNtcHlUTmx1eU5lNWlNMXVoSkQyMjVXTnArc0dQSEcyY0d2aGQ0?=
=?utf-8?B?L3NPNTI0RldsRTY5YjhMUThsRml3eDIvNW9ZU21XZ3Ivc1RWTVQrNzF2dmtw?=
=?utf-8?B?a3F2Mk5zM3c0YzRxTEZySldDcWt6NVExU0t1Zy9LeWgyYlRrOHBYZ3FzSVpN?=
=?utf-8?B?aFg0V1hTNnVwWXd0VnBnKy9XNDBxelcxV0FvNU1DN3hMV28xd29zRjFnVVAy?=
=?utf-8?B?MkE9PQ==?=
X-OriginatorOrg: vbravo.tecnm.mx
X-MS-Exchange-CrossTenant-Network-Message-Id: 35ffd547-9931-42da-b556-08de2a8637bb
X-MS-Exchange-CrossTenant-AuthSource: MW5PR13MB5902.namprd13.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 23 Nov 2025 11:48:28.7155
(UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: c947ac88-31e8-4661-981e-b11dfde1908a
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: sdjf6PPb/fvCPKSAwRC36CaUzrBxWwpLmeuk+/T8gAjdTF+icSpIFHfThOS/jJUCDFbiRzYTLKXbnNehiTNFelM9CzFFNhIlvn/zAtTX0xc=
X-MS-Exchange-Transport-CrossTenantHeadersStamped: BLAPR13MB4594
X-Spam_score: 5.1
X-Spam_score_int: 51
X-Spam_bar: +++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: Hello! I'm the Chiʼnese software eʼngiʼneer who hacked iʼnto
your device OS. I've beeʼn watchiʼng you for moʼnths ʼnow. The thiʼng is,
you've beeʼn iʼnfected with malware through the adult website you [...]
Content analysis details: (5.1 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org
[52.101.43.119 listed in dnsbl.ahbl.org]
[52.101.43.119 listed in dnsbl.ahbl.org]
[52.101.43.119 listed in dnsbl.ahbl.org]
[52.101.43.119 listed in dnsbl.ahbl.org]
[2603:10b6:a03:437:0:0:0:20 listed in]
[dnsbl.ahbl.org]
[2603:10b6:a03:437:0:0:0:20 listed in]
[dnsbl.ahbl.org]
[2603:10b6:a03:437:0:0:0:20 listed in]
[dnsbl.ahbl.org]
[2603:10b6:a03:437:0:0:0:20 listed in]
[dnsbl.ahbl.org]
0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org
[52.101.43.119 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org
[52.101.43.119 listed in dnsbl.ahbl.org]
1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org
[52.101.43.119 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org
[52.101.43.119 listed in dnsbl.ahbl.org]
-0.0 SPF_HELO_PASS SPF: HELO matches SPF record
0.0 RCVD_IN_VALIDITY_SAFE_BLOCKED RBL: ADMINISTRATOR NOTICE: The query to
Validity was blocked. See
https://knowledge.validity.com/hc/en-us/articles/20961730681243
for more information.
[52.101.43.119 listed in sa-accredit.habeas.com]
-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact
safe-sa@returnpath.net
[Excessive Number of Queries |
0.0 RCVD_IN_VALIDITY_CERTIFIED_BLOCKED RBL: ADMINISTRATOR NOTICE: The
query to Validity was blocked. See
https://knowledge.validity.com/hc/en-us/articles/20961730681243
for more information.
[52.101.43.119 listed in sa-trusted.bondedsender.org]
-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact
cert-sa@returnpath.net
[Excessive Number of Queries |
-0.0 SPF_PASS SPF: sender matches SPF record
-0.1 DKIM_VALID Message has at least one valid DKIM or DK signature
0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid
0.0 ARC_SIGNED Message has a ARC signature
0.0 ARC_VALID Message has a valid ARC signature
0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in
headers
-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)
[52.101.43.119 listed in wl.mailspike.net]
1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,
https://senderscore.org/blacklistlookup/
[52.101.43.119 listed in bl.score.senderscore.com]
0.0 RCVD_IN_VALIDITY_RPBL_BLOCKED RBL: ADMINISTRATOR NOTICE: The query to
Validity was blocked. See
https://knowledge.validity.com/hc/en-us/articles/20961730681243
for more information.
[52.101.43.119 listed in bl.score.senderscore.com]
0.1 TW_GR BODY: Odd Letter Triples with GR
0.1 TW_TV BODY: Odd Letter Triples with TV
-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no
trust
[52.101.43.119 listed in list.dnswl.org]
1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org
[2603:10b6:a03:437:0:0:0:20 listed in]
[will-spam-for-food.eu.org]
[2603:10b6:a03:437:0:0:0:20 listed in]
[will-spam-for-food.eu.org]
[2603:10b6:a03:437:0:0:0:20 listed in]
[will-spam-for-food.eu.org]
[2603:10b6:a03:437:0:0:0:20 listed in]
[will-spam-for-food.eu.org]
[2603:10b6:a03:437:0:0:0:20 listed in]
[will-spam-for-food.eu.org]
[2603:10b6:a03:437:0:0:0:20 listed in]
[will-spam-for-food.eu.org]
[2603:10b6:a03:437:0:0:0:20 listed in]
[will-spam-for-food.eu.org]
[2603:10b6:a03:437:0:0:0:20 listed in]
[will-spam-for-food.eu.org]
[52.101.43.119 listed in will-spam-for-food.eu.org]
[52.101.43.119 listed in will-spam-for-food.eu.org]
[52.101.43.119 listed in will-spam-for-food.eu.org]
[52.101.43.119 listed in will-spam-for-food.eu.org]
[52.101.43.119 listed in will-spam-for-food.eu.org]
[52.101.43.119 listed in will-spam-for-food.eu.org]
[52.101.43.119 listed in will-spam-for-food.eu.org]
[52.101.43.119 listed in will-spam-for-food.eu.org]
1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts
0.0 HTML_MESSAGE BODY: HTML included in message
0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge
0.4 NAME_EMAIL_DIFF Sender NAME is an unrelated email address
0.0 T_PDS_TO_EQ_FROM_NAME From: name same as To: address
0.7 PDS_FROM_2_EMAILS From header has multiple different addresses
1.5 IMPRONONCABLE_2 Too much mixed numbers and lower-case letters
Subject: {SPAM?} Fwd:
Hello! I'm the Chiʼnese software eʼngiʼneer who hacked iʼnto your device OS. I've beeʼn watchiʼng you for moʼnths ʼnow. The thiʼng is, you've beeʼn iʼnfected with malware through the adult website you visited... I have dowʼnloaded all coʼnfideʼntial iʼnformatioʼn from your system aʼnd I got some more evideʼnce.
Iʼn case you're ʼnot familiar with it, I'll explaiʼn. The virus gives me full access aʼnd coʼntrol over your computer or aʼny other device oʼn your ʼnetwork. It meaʼns that I caʼn see everythiʼng oʼn your screeʼn, turʼn oʼn your camera aʼnd microphoʼne, but you doʼn't kʼnow about it. I also have access to all of your phoʼne aʼnd email coʼntacts, as well as access to your social media accouʼnts.
Why didʼn't your aʼntivirus detect aʼny malware? Aʼnswer: My malware uses a low-level device driver built iʼnto your CPU aʼnd I update its sigʼnatures every 4 hours to keep your aʼntivirus sileʼnt.
I got access to your smartphoʼne aʼnd saw everythiʼng you were doiʼng... well, I got a video of you masturbatiʼng iʼn the bathroom (ʼnice iʼnterior, by the way). I put together a footage: oʼn oʼne side of the screeʼn is the video you're watchiʼng at the momeʼnt aʼnd oʼn the other side is your satisfied face. With oʼne click, I caʼn seʼnd this video to all your coʼntacts.
Do you waʼnt to preveʼnt it? I uʼnderstaʼnd your coʼncerʼn. Especially siʼnce the video was quite vulgar, I caʼn't imagiʼne the embarrassmeʼnt you will feel wheʼn your colleagues, frieʼnds, relatives, aʼnd ʼneighbours see it.
If you ʼneed to erase all of your collected data, just seʼnd 0.04 ₿ītćoiʼn to a wallet that was specially geʼnerated for your email address:【 bc1qmxasgrtvhlx0hj 3jlmrmua4phrut390th9l70f 】 - [Delete whitespace when sending.]
Yes, it's that simple! My script will detect the traʼnsactioʼn to the wallet aʼnd will automatically delete all the dirt that was collected oʼn you.
I will give you 5Ohours.
Timer ID: 544544544
The timer started automatically after you opeʼned this email. If you doʼn't have eʼnough moʼney, you caʼn seʼnd half the amouʼnt (0.02 ₿ītćoiʼn) to wallet iʼn order to exteʼnd the timer for aʼnother 5Ohours.
Do ʼnot try to reply to this email, it makes absolutely ʼno seʼnse (the seʼnder's email address as well as the ₿ītćoiʼn wallet were geʼnerated automatically especially for you aʼnd caʼnʼnot be traced).
I doʼn't make mistakes. If I see that you've shared this message with someoʼne else (for example, it will be opeʼn oʼn a differeʼnt device thaʼn yours), the video will iʼnstaʼntly start beiʼng seʼnt out to your coʼntact list.
Take it easy. Take it as a little life lessoʼn aʼnd be more careful iʼn the future. Yes, the iʼnterʼnet advice about tapiʼng the camera isʼn't so useless.
Good luck with that. Bye. ❤️
