Paypal Bitcoin Phishing from Microsoft Outlook Part 3

Posted by Dave Yadallee on
Content analysis details: (13.7 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[40.93.20.59 listed in dnsbl.ahbl.org]

[40.93.20.59 listed in dnsbl.ahbl.org]

[40.93.20.59 listed in dnsbl.ahbl.org]

[40.93.20.59 listed in dnsbl.ahbl.org]

[209.85.128.69 listed in dnsbl.ahbl.org]

[209.85.128.69 listed in dnsbl.ahbl.org]

[209.85.128.69 listed in dnsbl.ahbl.org]

[209.85.128.69 listed in dnsbl.ahbl.org]

[2603:10b6:a03:338:0:0:0:16 listed in]

[dnsbl.ahbl.org]

[2603:10b6:a03:338:0:0:0:16 listed in]

[dnsbl.ahbl.org]

[2603:10b6:a03:338:0:0:0:16 listed in]

[dnsbl.ahbl.org]

[2603:10b6:a03:338:0:0:0:16 listed in]

[dnsbl.ahbl.org]

[2603:10b6:a03:338:0:0:0:4 listed in]

[dnsbl.ahbl.org]

[2603:10b6:a03:338:0:0:0:4 listed in]

[dnsbl.ahbl.org]

[2603:10b6:a03:338:0:0:0:4 listed in]

[dnsbl.ahbl.org]

[2603:10b6:a03:338:0:0:0:4 listed in]

[dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[40.93.20.59 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[40.93.20.59 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[40.93.20.59 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[40.93.20.59 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[209.85.128.69 listed in will-spam-for-food.eu.org]

[209.85.128.69 listed in will-spam-for-food.eu.org]

[209.85.128.69 listed in will-spam-for-food.eu.org]

[209.85.128.69 listed in will-spam-for-food.eu.org]

[209.85.128.69 listed in will-spam-for-food.eu.org]

[209.85.128.69 listed in will-spam-for-food.eu.org]

[209.85.128.69 listed in will-spam-for-food.eu.org]

[209.85.128.69 listed in will-spam-for-food.eu.org]

[2603:10b6:a03:338:0:0:0:4 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:a03:338:0:0:0:4 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:a03:338:0:0:0:4 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:a03:338:0:0:0:4 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:a03:338:0:0:0:4 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:a03:338:0:0:0:4 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:a03:338:0:0:0:4 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:a03:338:0:0:0:4 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:a03:338:0:0:0:16 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:a03:338:0:0:0:16 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:a03:338:0:0:0:16 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:a03:338:0:0:0:16 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:a03:338:0:0:0:16 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:a03:338:0:0:0:16 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:a03:338:0:0:0:16 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:a03:338:0:0:0:16 listed in]

[will-spam-for-food.eu.org]

[40.93.20.59 listed in will-spam-for-food.eu.org]

[40.93.20.59 listed in will-spam-for-food.eu.org]

[40.93.20.59 listed in will-spam-for-food.eu.org]

[40.93.20.59 listed in will-spam-for-food.eu.org]

[40.93.20.59 listed in will-spam-for-food.eu.org]

[40.93.20.59 listed in will-spam-for-food.eu.org]

[40.93.20.59 listed in will-spam-for-food.eu.org]

[40.93.20.59 listed in will-spam-for-food.eu.org]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[40.93.20.59 listed in list.dnswl.org]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-0.0 SPF_HELO_PASS SPF: HELO matches SPF record

-0.0 SPF_PASS SPF: sender matches SPF record

1.0 HK_RANDOM_REPLYTO Reply-To username looks random

1.0 HK_RANDOM_FROM From username looks random

0.5 FROM_LOCAL_NOVOWEL From: localpart has series of non-vowel letters

3.5 VOWEL_FROM_7 Impronouncable from header (7+ consecutive vowels)

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[40.93.20.59 listed in bl.score.senderscore.com]

0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in digit

[haressaznzxrrsxaxz321(at)gmail.com]

0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider

[haressaznzxrrsxaxz321(at)gmail.com]

-0.0 T_RP_MATCHES_RCVD Envelope sender domain matches handover relay

domain

0.0 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level mail

domains are different

0.1 TW_RW BODY: Odd Letter Triples with RW

0.6 MEGALONGWORD BODY: Uses really overlong words

0.3 LONGWORD BODY: Uses overlong words

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 HTML_MESSAGE BODY: HTML included in message

0.2 FREEMAIL_FORGED_FROMDOMAIN 2nd level domains in From and EnvelopeFrom

freemail headers are different

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

2.0 RATWR8_MESSID Message-ID with excessive dashes and dollars

3.0 LONG_INVISIBLE_TEXT Long block of hidden text - bayes poison?

0.1 TO_IN_SUBJ To address is in Subject

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[40.93.20.59 listed in wl.mailspike.net]

Subject: {SPAM?} =?UTF-8?Q?Pozv=C3=A1nky=3A_Payment_Confirmation_=2D_Your_Bitcoin_Order?=

=?UTF-8?Q?_Is_Being_Verified_=40_ut_9=2E_j=C3=BAn_2026_=28cynthiaperez389903=40gro?=

=?UTF-8?Q?ups=2Eoutlook=2Ecom=29?=



Paypal Bitcoin Phishing from Microsoft Outlook Part 4

Posted by Dave Yadallee on


Haresasz Nxysarwsa has invited you to Payment Confirmation – Your Bitcoin Order Is Being Verified

Title: Payment Confirmation – Your Bitcoin Order Is Being Verified

When: June 9, 2026

Organizer:

Haresasz Nxysarwsa

Description: Dear Customer,



This is to confirm that we have successfully received your PayPal payment for your recent Bitcoin (BTC) purchase request.



Transaction Details:



Payment Method: PayPal

Purchase Type: Bitcoin (BTC)

Amount Charged: $750.00

Current Status: Verification in Progress



Your order is currently undergoing routine security and compliance checks. Once verification is complete, the Bitcoin purchase will be finalized automatically.



If you did not authorize this transaction, please contact our support team immediately at +1 805 424 9350.



Sincerely,

Payment Verification Team

Attendees:



cynthiaperez389903@groups.outlook.com



Payment Confirmation – Your Bitcoin Order Is Being Verified

Dear Customer, This is to confirm that we have successfully received your PayPal payment for your recent Bitcoin (BTC) purchase request. Transaction Details: Payment Method: PayPal Purchase Type: B



Dear Customer,



This is to confirm that we have successfully received your PayPal payment for your recent Bitcoin (BTC) purchase request.



Transaction Details:



Payment Method: PayPal

Purchase Type: Bitcoin (BTC)

Amount Charged: $750.00

Current Status: Verification in Progress



Your order is currently undergoing routine security and compliance checks. Once verification is complete, the Bitcoin purchase will be finalized automatically.



If you did not authorize this transaction, please contact our support team immediately at +1 805 424 9350.



Sincerely,

Payment Verification Team

Kedy

utorok 9. jún 2026

Organizátor

Haresasz Nxysarwsa

haressaznzxrrsxaxz321@gmail.com

Hostia

(Zoznam hostí bol na žiadosť organizátora skrytý)

Odpoveď na cynthiaperez389903@groups.outlook.com

Áno



Nie



Možno

Ďalšie možnosti



Pozvánka z Kalendára Google



Túto správu ste dostali, pretože ste účastníkom danej udalosti.



Ak túto pozvánku prepošlete, ktorýkoľvek jej príjemca bude môcť odoslať odpoveď organizátorovi, byť pridaný do zoznamu hostí, pozývať iných bez ohľadu na ich vlastný stav pozvánky alebo meniť vaše potvrdenie účasti. Ďalšie informácie

Paypal Bitcoin Phishing from Microsoft Outlook Part 2

Posted by Dave Yadallee on
X-Microsoft-Antispam-Message-Info:

=?utf-8?B?Y0FhUEFKR040VG1LUVA2U2loS3ZIVllZTkN4RUhUNGtaVkJsVWRIQzk2RW14?=

=?utf-8?B?Z1ZpenJBYjR5enVyV2JENWtNUEVSdlVJUExJNGFGU3ROcUZkazZ4bWRQNmc5?=

=?utf-8?B?cFJ2dkcvSlpuZXBzam8yOW9WajZnbnpsdU5FVG1nN0RXMVk3dEgwd2hlcEpu?=

=?utf-8?B?NnNJZmtDRDBRalhRbXkvSnRPMlFrdUpTM2xqbTQwdU96WWE3R0tnNDlzRGd4?=

=?utf-8?B?WkN6NHRqSU4vWnUzbHhGVXc2WFluSmpRZlkzOGdEckRPRHB1SzludU5FeG1D?=

=?utf-8?B?cURWbFF3QUZpMG9BZzVidDU1K2xRa1lvaEZTcWttSmR0WDNjSmhGY1l0cmRF?=

=?utf-8?B?elhzQzJBWDgyZDFiMmd2Q3JBSXM4RHR4ZmdaeTczQ2N5eG1zOVdPbUJBMXlW?=

=?utf-8?B?YmYvSnVuNmxranBOVGtid3pXUFZYR1ZKRDFzZ3cvRmZHVTE4NTVFdHUyY2Vm?=

=?utf-8?B?UGEwalM4NUpJdGptTjQ4aGI1VThKblM2cGFTSk5FV2hFUWN0aGtqZnhjSlBh?=

=?utf-8?B?TzNQM0RCcXNOSEl3ZlFjZWhOVm5rOG9zdVpaS010d1BTOVlQYWE5Rnd3ajVC?=

=?utf-8?B?N1VWdTFQQThnMWFMZEpMVFEyUWhNN2lSWmtuVDNEcm9ZZnRCd2ppZFVtcGpV?=

=?utf-8?B?cVd1REswMUZ6MXZFcUJReEFHQThpdmNNOVNaQ0V3a2FUZmw1VW1sVFRReGY5?=

=?utf-8?B?SlN5a25qTWZsNm5VT1J2YzNlbHZNV3lScVNPVGdZZ21uUVFBeG8yVGZqa25s?=

=?utf-8?B?T0c3L1NDUCtnZXlZTDJFUm05MGdwaCtGUDhRNG9XM09NR3A0L3UwWU9QZmhk?=

=?utf-8?B?bFpjUUIyYlVUWk9VUG51Yyt1ZGlNNXhUd3V1OEtXazZxVW04QXA1dUVTYkJo?=

=?utf-8?B?RFdGeW1kcW83U3F6U0FpbkhVbmN2MXdSZzFKUEN6QWNROGZhdVRoMTJMaTYw?=

=?utf-8?B?Mys5RUVjbDNNTEh3dHF5dUlDbkFvTmFiTk44Qld0S3RpZjRIWDVVME5nNkI3?=

=?utf-8?B?V3JxMGUxSWduSlhuZm5HVENHSjBna05GVzRBY2tBK0NOL2N2TmdjYndUVWxy?=

=?utf-8?B?Q1haUm1WcXNnMUQ4VEpEdjlMY1pvVkNIMERLa3UxYlk2RUJ3Nkx5ZmVsdUVI?=

=?utf-8?B?ak50S0svTHVVZjFDM2Z1RU94YU0yMVVUaW5DWVNMUGpVTjNHSzFCekkvRURm?=

=?utf-8?B?K3grOG1TcCtQdjkvWWtzak81cnhQZVVaQlQwSTdlL21raGpSTFVnS2lEWllr?=

=?utf-8?B?dzRSNzVIZGNRUzNaR3RjWHVGUHhkLysyQ3lBOTVJWjgrd1RDTS9RWEZQN2dm?=

=?utf-8?B?WXBVcGNySnhFVThROGNIS1BYQjlJVm5rb3JCeHV1Q1NpQXBOTW80Slg1S2pV?=

=?utf-8?B?UnpBcHZZa3gzcEtnRCsrVmllamRJSU55QmZLRlZ4QSswUHNlUzhoQkptcWtH?=

=?utf-8?B?TjN6UlNvK0RGYlgyYXdESFVLMmlWbXpYMFVFUFdlaGxsRDhuaVlYRlgxU3VW?=

=?utf-8?B?c25DZkk5cVRVYjhaU0FJb3U5Vlp0ck1EYlh5WU5EVldzMForTnEvVVJZMWxL?=

=?utf-8?B?UjVZdnBjbkFaaElIeEdsS3pqaGp6WjEwT0pUNmhvUDJpSGMya0IyOGpPd3Vj?=

=?utf-8?B?M2VMZFRHVVhPenNlRG0zME5FcXp6b3ZnQWJEVFNLcEFYZHVVV3RGRk52d0gy?=

=?utf-8?B?UVVaaEhmWmdKK005NzJMTytWeWlKL0lnTS93ZHlYd0szVUNhSEUyYWdEQW04?=

=?utf-8?B?TzNvOCtzUEFrdGh4eGFYNjM3ZGtpRzBLRVZtaEpyYndIaFRMb2RwQkhjYUFW?=

=?utf-8?B?RDltUnNmTEhlVTJSMS8vVDYxMHB3Q0pkZndvYm8wTjRxQmcvRmpLTWxUbkhZ?=

=?utf-8?B?WXRzVTJ2NGMwQnBobDVPRlhKTVZlYk1qOTNLNVV3SXEyT2E4UndQd21vUWk1?=

=?utf-8?B?SHo3ak5TTzFEd0cydWhldGZuTXdYczdvYWlNbXFRSGdYT016WXZWQ08xWml5?=

=?utf-8?B?aTUrczF0b0N5cit1RDFWY0xxc3pjK3U0TG1MV1hXOHBjNmlYU3FoMWgwaWJX?=

=?utf-8?B?K08vTkpXZlNZZ3BmTUtqQUEyanloQ3ExdC95QmtsZ29NNHl1VkVKU2dhRnlz?=

=?utf-8?B?dEc1MmRGL1BGcnNhcWZkbm1BZnpzMTZud09tK002Uzl4WSt4VXZNa0lVN0ZG?=

=?utf-8?B?djMrK1cyYTdLN29XNEZ0dmh5bUxhSTNEbWFxb3orZ2lKK0RTTHMwcmZwQ1NV?=

=?utf-8?B?MHQyc1RQWVQ4UWNsaFBWTURncFUxb2k2dU1scHdtZ2Y4MTdLN0lZTy9wMDh4?=

=?utf-8?B?bm8vOTc1K3ZTaFVxZFFlTmY0OHBTUVRMOWcyMk5sRTNQYUQ2eEZFVWY3T3hr?=

=?utf-8?B?bEp1NXBEei9yTkI3Q3dTNzZWTm1STzhLV3QxeG1Ydnhtd3BuNG5WMG5BMnhw?=

=?utf-8?B?VGFFZHRZYU02K3pWSFpUZWZPdGV1VFJCQ3F5T2poTVdOYkNnQjFhUEJ5MjYx?=

=?utf-8?B?VW5mRVQwaDVSYk1sT3hPZTV3eHppQUVoQ3FUcjN6S3IrVG1kNFNlQU1tRkdt?=

=?utf-8?B?MFNtOFpseEkvZ0ZCTUFSQU02THpLclNhMUtERmlzdjUxNysrbUovOHFkNTh2?=

=?utf-8?B?MWoyQkxBWjBYRGFjTldsK0pXVmJPck5BUXF4cW1oK29hY2Y0bk1RWlBtM0Iv?=

=?utf-8?B?clVleXBvdWE4UmZySXhzekdCbGZFdFpFK1pRQlRiKzM4L2l3MGQvUzdnVCt3?=

=?utf-8?B?Ulh6SDJLNStZdUNWU1dGb2ZYc3Z4VjRPa3lXU2duTWZQdW9OSWRSWEFHeTJs?=

=?utf-8?B?YlppVDNmc1ViZEl4WmpwY1R3ZjhiUWZQZTIwWkNXVm9tdkd3QlU0S1FodGY5?=

=?utf-8?B?czRiZ0pISEtJNDJFZXlVL3pRTGRuRTdiVHdCMWVCZDJZNEl4TktRQzJLZDNa?=

=?utf-8?B?ZDBDLzNLSkxIQXZWL0lYMWFGRWIzQ2JNYnJSWDA1d2V2YkFqUUZhcmVWRHpm?=

=?utf-8?B?UGZlMWxaMjVaOW5SNzQ4NThsV2RHNjY0YktLWDlvMzByK2RramhZUkhZdzBL?=

=?utf-8?B?S09GeGkvK2EyVmhKMlNqT2ZsaVNZVTNFb3BXTFJmY0wxdjdJZVZ6SkdEQ3I1?=

=?utf-8?B?UlRzQzJabURydGxQZ3FTcGZ3R2tpSTZlQlZibzBURzlGbGRLTnAyWW96VEpK?=

=?utf-8?B?blRtVnVUUmVGNUxIZlZPaTNkM3dxSXIzdGFZM2E4dmdPYlZNd1haODFFaGh0?=

=?utf-8?B?bmlXd2c9PQ==?=

X-Auto-Response-Suppress: DR, OOF, AutoReply

X-OriginatorOrg: sct-15-20-9412-4-msonline-outlook-090a5.templateTenant

X-MS-Exchange-CrossTenant-OriginalArrivalTime: 09 Jun 2026 16:09:43.5726

(UTC)

X-MS-Exchange-CrossTenant-Network-Message-Id: f5632051-3a3f-486b-14ef-08dec64184c9

X-MS-Exchange-CrossTenant-Id: 84df9e7f-e9f6-40af-b435-aaaaaaaaaaaa

X-MS-Exchange-CrossTenant-AuthSource: SJ5PEPF00000205.namprd05.prod.outlook.com

X-MS-Exchange-CrossTenant-AuthAs: Anonymous

X-MS-Exchange-CrossTenant-FromEntityHeader: Internet

X-MS-Exchange-Transport-CrossTenantHeadersStamped: LV9PR18MB927589

X-Spam_score: 13.7

X-Spam_score_int: 137

X-Spam_bar: +++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Payment Confirmation – Your Bitcoin Order Is Being Verified

utorok 9. jún 2026 Dear Customer, This is to confirm that we have successfully

received your PayPal payment for your recent Bitcoin (BTC) purchase request.



Paypal Bitcoin Phishing from Microsoft Outlook Part 1

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Tue, 09 Jun 2026 14:14:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wX2pM-000000008Jz-3ZZB

for dave@doctor.nl2k.ab.ca;

Tue, 09 Jun 2026 14:13:36 -0600

Resent-From: The Doctor

Resent-Date: Tue, 9 Jun 2026 14:13:36 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-northcentralusazlp17013059.outbound.protection.outlook.com ([40.93.20.59]:36351 helo=CH4PR04CU002.outbound.protection.outlook.com)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wWz2L-00000000Mzm-1z9q

for doctor@doctor.nl2k.ab.ca;

Tue, 09 Jun 2026 10:10:57 -0600

Received: from SJ0PR03CA0161.namprd03.prod.outlook.com (2603:10b6:a03:338::16)

by LV9PR18MB927589.namprd18.prod.outlook.com (2603:10b6:408:376::24) with

Microsoft SMTP Server (version=TLS1_2,

cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.92.10; Tue, 9 Jun 2026

16:09:43 +0000

Received: from SJ5PEPF00000205.namprd05.prod.outlook.com

(2603:10b6:a03:338::4) by SJ0PR03CA0161.outlook.office365.com

(2603:10b6:a03:338::16) with Microsoft SMTP Server (version=TLS1_3,

cipher=TLS_AES_256_GCM_SHA384) id 15.21.92.13 via Frontend Transport; Tue, 9

Jun 2026 16:09:43 +0000

Authentication-Results: spf=pass (sender IP is 209.85.128.69)

smtp.mailfrom=gmail.com; dkim=pass (signature was verified)

header.d=google.com;dkim=pass (signature was verified)

header.d=gmail.com;dmarc=pass action=none header.from=gmail.com;compauth=pass

reason=100

Received-SPF: Pass (protection.outlook.com: domain of gmail.com designates

209.85.128.69 as permitted sender) receiver=protection.outlook.com;

client-ip=209.85.128.69; helo=mail-wm1-f69.google.com; pr=C

Received: from mail-wm1-f69.google.com (209.85.128.69) by

SJ5PEPF00000205.mail.protection.outlook.com (10.167.244.38) with Microsoft

SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.113.7

via Frontend Transport; Tue, 9 Jun 2026 16:09:43 +0000

X-IncomingTopHeaderMarker:

OriginalChecksum:25E206E7EFFC06789889CF8D86B6964DFEE09EA908D2C89631F8CA767E6F9F15;UpperCasedChecksum:BD9ADE5EE704C0427FE424ECDF6BE331E32665AF02722F5BC1C8778369E2571B;SizeAsReceived:3419;Count:15

Received: by mail-wm1-f69.google.com with SMTP id 5b1f17b1804b1-490c4f61a34so26033535e9.2

for ; Tue, 09 Jun 2026 09:09:43 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=google.com; s=20251104; t=1781021382; x=1781626182; darn=groups.outlook.com;

h=to:from:subject:date:message-id:sender:reply-to:mime-version:from

:to:cc:subject:date:message-id:reply-to;

bh=3gsPOXFxVkVry+97oF/DtoS3xmb1+/434RuDnz6KWwU=;

b=qHKWfW6ZXpSimhCwbftv4xr/rqGg098TGoNW3GNKhTY6qLkiGn8Uqk9cepSh8ZMLX0

52KVgfLKwHMTk+Tv5lK3xlFN1DtqieGG2sX7g7ASOQ2z97wyy4h2keI8j8hbWKWr4CtH

40BLeYHFQy5fwWzLVmttgnRua7FmDbTK275U5J9oo6MVXujlQy4hcWsPkAajgGk9rMPD

vi696C4q6fQ/b5kjR5VQvoWBlj4OV13c1aAIokCEdNvZtvutW3R47uhTYNh5XQQmVfef

61VkXqQL3zn1WsNiUzZX8Q3Fw1laGTYNQD33rFP6gWx6nRg+9+0VJruFBnB+E9bIYi+3

5LmA==

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=gmail.com; s=20251104; t=1781021382; x=1781626182; darn=groups.outlook.com;

h=to:from:subject:date:message-id:sender:reply-to:mime-version:from

:to:cc:subject:date:message-id:reply-to;

bh=3gsPOXFxVkVry+97oF/DtoS3xmb1+/434RuDnz6KWwU=;

b=dItvbUxLcD9s9giosS0mgrmC50efZ164QIyIAOVSn99uoHu8oFpaaUwXDUkD1egJ6K

kFxsTfA/FfrxVi0/48vm2Un1Ba2RaYxWWPGY2e6Gxh2+9jKQtJWJTyCemWM26ekcJ6KF

iZFxQGy031BdO1NsK9pw6UgqxzQVHUirYH4f9lgDD6BcyQn9Ccqivmxxb5uKcfSQbgX/

COIL6FfzAPjcaKJl4Vkvg3aqgy7WOsIBdADPgZgCr2SBd1/M+Mf+bKmLUq+zxUf1h4ZJ

909KyIKJFQirXeLYImL4MjKbEJN7SX6HZpKKNvggkEWOTHk0cO5/JUhEGkYpin/25Stz

2AZg==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20251104; t=1781021382; x=1781626182;

h=to:from:subject:date:message-id:sender:reply-to:mime-version

:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to;

bh=3gsPOXFxVkVry+97oF/DtoS3xmb1+/434RuDnz6KWwU=;

b=rhNR/7SMCSo9kH+hhSRcNqZaXKSM0PFaJ0HckxNGRDAG5ycBo0Rxf9IQZ0qzisj96w

F8PFJQwTkmuBMv1E3BpNS4R6a2sk1N3LMCaFIxuDND+/IqFI4h6w5rAD5+q7SKTctzDo

OhA3ifMViHavXDpbMZD3ikepRk1+fShPRLz2PLQ/MK/1irjM1KVj8zVorLo5sdLTB27H

e/pZBJ4q77Vr2vtcnfqwY/uLay+aRid3iAyGMeunFrErcvE2nOfTmvkTCPcX612J4FUw

bBjYdJqJD+JLNbBRKIIUsizOCy9fJvGuFx7JP7KwSD6aKcupzhovSAIgwA60o8DG8xIe

a78w==

X-Gm-Message-State: AOJu0YzrTVfivXnWWlGg+DGIWB2nHkj/rHLwbyR1HnrW0sEqKxmHMR+q

WfKNZpOiWbvtell7zswSZbifzD/5vym2vRbDJGMkci1CjsI9mHHGR+9PQ+ooK9Qs52U4qlUKKjY

w1Ps37DUV4rPwvLOtQPAUhSTabQZqyJf7mU8=

MIME-Version: 1.0

X-Received: by 2002:a05:600c:c491:b0:490:bb44:3f8b with SMTP id

5b1f17b1804b1-490c2605385mr349204085e9.17.1781021381628; Tue, 09 Jun 2026

09:09:41 -0700 (PDT)

Reply-To: Haresasz Nxysarwsa

Sender: =?UTF-8?Q?Kalend=C3=A1r_Google?=

Message-ID:

Date: Tue, 09 Jun 2026 16:09:41 +0000

Subject: =?UTF-8?Q?Pozv=C3=A1nky=3A_Payment_Confirmation_=2D_Your_Bitcoin_Order?=

=?UTF-8?Q?_Is_Being_Verified_=40_ut_9=2E_j=C3=BAn_2026_=28cynthiaperez389903=40gro?=

=?UTF-8?Q?ups=2Eoutlook=2Ecom=29?=

From: Haresasz Nxysarwsa

To: cynthiaperez389903@groups.outlook.com

Content-Type: multipart/mixed; boundary="000000000000ca1c610653d45a01"

X-IncomingHeaderCount: 15

X-EOPAttributedMessage: 0

X-EOPTenantAttributedMessage: 84df9e7f-e9f6-40af-b435-aaaaaaaaaaaa:0

X-MS-PublicTrafficType: Email

X-MS-TrafficTypeDiagnostic: SJ5PEPF00000205:EE_|LV9PR18MB927589:EE_

X-MS-Office365-Filtering-Correlation-Id: f5632051-3a3f-486b-14ef-08dec64184c9

X-MS-Exchange-EOPDirect: true

X-Sender-IP: 209.85.128.69

X-SID-PRA: HARESSAZNZXRRSXAXZ321@GMAIL.COM

X-SID-Result: PASS

X-MS-Consumer-Group-Expansion-Loop: cynthiaperez389903@groups.outlook.com

X-MS-Exchange-Group-Expansion-Loop: cynthiaperez389903@groups.outlook.com

X-Microsoft-Antispam:

BCL:0;ARA:1444111002|9020799019|9000799056|29080799009|16200799027|9400799043|4040799016|970799063|34130799006|32020799003|3151999006|26000799027|6149299003|26130799012|22000799015|24102599021|5139299004|1680799066|6092099016|26104999009|21002599022;

Microsoft Teams phish Part 2

Posted by Dave Yadallee on



: rgb(50, 49, 48); line-height: 1.5; font-size: 14px;">A client has shared =

a business plan with you via Microsoft SharePoint.




adius: 8px; border: 1px solid rgb(237, 235, 233); border-image: none; width=

: 100%;" cellspacing=3D"0" cellpadding=3D"0">












adding: 14px;">


ellspacing=3D"0" cellpadding=3D"0">
















=3D"middle" style=3D"margin: 0px; width: 44px;">
=3D"margin: 0px; padding-left: 12px;">




yle=3D"color: rgb(96, 94, 92); font-size: 12px; margin-top: 4px;">Business =

document • Shared via Microsoft SharePoint



yle=3D"color: rgb(138, 136, 134); margin-top: 6px;">A client has shared thi=

s file with you
=3D"right" style=3D"margin: 0px; color: rgb(96, 94, 92);">Shared





: rgb(50, 49, 48); font-size: 14px;">This file is attached to this email.
p>


r: rgb(50, 49, 48); font-size: 14px;">Please open the attachment to view th=

e document. If access is required, contact your administrator.




one; border-color: rgb(237, 235, 233) currentColor currentColor; margin: 24=

px 0px; border-right-width: medium; border-bottom-width: medium; border-lef=

t-width: medium;">


94, 92); font-size: 12px;">You are receiving this notification as a member=

of the nk.ca Teams workspace.










; margin: 0px; padding: 16px 24px; text-align: center; color: rgb(96, 94, 9=

2); font-size: 12px;">© Microsoft Corporation
This is an automated =

message. Please do not reply.





















Microsoft Teams phish Part 1

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Tue, 09 Jun 2026 14:14:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wX2p5-0000000080P-0BY1

for dave@doctor.nl2k.ab.ca;

Tue, 09 Jun 2026 14:13:19 -0600

Resent-From: The Doctor

Resent-Date: Tue, 9 Jun 2026 14:13:18 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from go-lanjingtv.com ([141.133.172.76]:58737)

by doctor.nl2k.ab.ca with esmtp (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wWyiT-00000000D9I-0yaf

for sales@nk.ca;

Tue, 09 Jun 2026 09:50:20 -0600

From: admin@nk.ca

To: sales@nk.ca

Subject: New File Shared with You in Microsoft Teams#67641033

Date: 9 Jun 2026 08:49:22 -0700

Message-ID: <20260609084922.D978BFCD48305D33@nk.ca>

MIME-Version: 1.0

Content-Type: text/html

Content-Transfer-Encoding: quoted-printable





















=20=20=20=20=20=20=20=20




32px 0px; color: rgb(51, 51, 51); text-transform: none; letter-spacing: no=

rmal; font-family: "Segoe UI", Arial, sans-serif; font-size: 11px; font-sty=

le: normal; font-weight: 400; word-spacing: 0px; white-space: normal; orpha=

ns: 2; widows: 2; font-variant-ligatures: normal; font-variant-caps: normal=

; -webkit-text-stroke-width: 0px; text-decoration-thickness: initial; text-=

decoration-style: initial; text-decoration-color:=20

initial;' cellspacing=3D"0" cellpadding=3D"0">














255); border-radius: 8px; width: 100%; overflow: hidden;" cellspacing=3D"0=

" cellpadding=3D"0">


















x; border-bottom-color: rgb(237, 235, 233); border-bottom-width: 1px; borde=

r-bottom-style: solid;">


"0">














=3D"margin: 0px;">


d: rgb(98, 100, 167); border-radius: 4px; width: 20px; height: 20px; text-a=

lign: center; color: rgb(255, 255, 255); line-height: 20px; padding-top: 0p=

x; font-weight: bold; border-top-color: currentColor; border-top-width: 0px=

; border-top-style: none;">MT
adding-left: 8px;">


b(50, 49, 48); padding-top: 0px; font-size: 14px; font-weight: 600; border-=

top-color: currentColor; border-top-width: 0px; border-top-style: none;">Mi=

crosoft Teams



b(96, 94, 92); font-size: 12px;">





tom: 20px;" cellspacing=3D"0" cellpadding=3D"0">














"margin: 0px;">


d: rgb(98, 100, 167); border-radius: 50%; width: 40px; height: 40px; text-a=

lign: center; color: rgb(255, 255, 255); line-height: 40px; padding-top: 0p=

x; font-size: 14px; font-weight: bold; border-top-color: currentColor; bord=

er-top-width: 0px; border-top-style: none;">AT
adding-left: 12px;">


b(50, 49, 48); padding-top: 0px; font-size: 14px; font-weight: 600; border-=

top-color: currentColor; border-top-width: 0px; border-top-style: none;">ad=

min@nk.ca



b(96, 94, 92); font-size: 12px; margin-top: 2px;">General • Finance T=

eam



b(96, 94, 92); font-size: 12px; margin-top: 2px;">Shared a file with you
iv>


b(96, 94, 92); font-size: 12px; margin-top: 2px;">6/9/2026 8:49:22 a.m. (UT=

C+02:00)

WEb/SEO/App spam from Microsoft Outlook PArt 3

Posted by Dave Yadallee on



11pt; color: rgb(0, 0, 0);">

Thank you





x_x_x_x_x_x_x_x_x_x_x_x_x_x_x_x_divRplyFwdMsg">


11pt; color: rgb(0, 0, 0);">

From: sanaya parween <sanayaparween550@outlook.com>


Sent: Monday, April 27, 2026 7:21 PM


Subject: Re: 


 





_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb=

(0, 0, 0);">

Hi,



_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb=

(0, 0, 0);">







_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb=

(0, 0, 0);">

I checked your website you have an impressive site, but ranking is not good=

on Google.



_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb=

(0, 0, 0);">







_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb=

(0, 0, 0);">

Would you like to optimize your site? I will be happy to share our pricing =

and proposals with you.



_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb=

(0, 0, 0);">







_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb=

(0, 0, 0);">

Let me know If you are interested, I will send you our SEO Packages and pri=

ce list.



_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb=

(0, 0, 0);">







_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb=

(0, 0, 0);">

Thanks,








--_000_DM8P223MB00786C195D8A266A0F3515A8931D2DM8P223MB0078NAMP_--

WEb/SEO/App spam from Microsoft Outlook PArt 2

Posted by Dave Yadallee on
x-ms-exchange-antispam-messagedata-0:

=?iso-8859-1?Q?fN1bObw36XIBA6X9MW9BwxRwMdhp+FeG3ALBDTJv5izqXnSXj42ITjRW6m?=

=?iso-8859-1?Q?hzxZHT7LJlfI9C5bp3i5Nrj7afEQdgngthvzq0sxZ0dGFH0t5RF6lNb/wT?=

=?iso-8859-1?Q?TdS02rTClurTpbSOOL04J1TfB2TN22f8ao49wajRw0uiaVemheIm/sNfIw?=

=?iso-8859-1?Q?8boHEJxKp8L0sk900rU3U+wB06LeuZ1b9utiwchLCUL5O99XHP4ezH3/B9?=

=?iso-8859-1?Q?a2R/ng0YhgbTZ/c+cxOCQue98LAmptrNKvmIrez7XSELJPyvxGSHmECfuU?=

=?iso-8859-1?Q?D68DIjitX6enCXsThgJn1zxi3wDDpB5WbYla6BuG+X4g6FOpaJ+09JSWWl?=

=?iso-8859-1?Q?PWYKQhfWvbY1EU3miKeH/BbdUrDU+I0Xv4IhSOdh2hLPxFKSnipBzZ1g5P?=

=?iso-8859-1?Q?AWvyOZZp1szsSNGR9gwb/JyRqKRaeXVXR1pRxqpcVnFjp9Pz2wUDvKdbsl?=

=?iso-8859-1?Q?k04W9fuGQrrob7u0O1uLtl1ycfhiVb2ES3ol5hlbgDOWi/NEzqEGT3wLkq?=

=?iso-8859-1?Q?1y8UjeMy3eWK5XeOImE5iQJYXMuws3rPBvD++db0Vx28F3c1jYauZ6qw3C?=

=?iso-8859-1?Q?8hXXKRuSN/mi997a+p9sHLg+4ZG1s5V0O1Ec4BKkKQv+8GhQOkk2KQdGcm?=

=?iso-8859-1?Q?DI+VN5Odz9kdRmk+q7JrpWktXVmPUfIfcj7YJ+zbSnjDG/dLX1LGtMaQPt?=

=?iso-8859-1?Q?MY3AiWO1IAVDFPgIQk6yPdDESNJfLhkQ0EhwDfoUS02GRBmBHiIzixaPzV?=

=?iso-8859-1?Q?Kk3o6u7UE67c9TkorsyVKtwpSFtiAKjK399rlPYj5RgHkVCNStKfL/O220?=

=?iso-8859-1?Q?Kmoe0wHO90bXMOsh13McM4Gv+WNCtqA2Vc0xEJF4iwO/EtSDiE0pGLbSJW?=

=?iso-8859-1?Q?vTyfZlr76SwDI6GhiQ3uqAL0hen533zVuxAPeghwKl+fmWrBXmdqfSGXr2?=

=?iso-8859-1?Q?ABE7neL5e+LVle3B0xmIJBa69cZ4pLPsw3iGPY80OGx7Xcu8DDSztHsK9Q?=

=?iso-8859-1?Q?XzXWcb3jrj6EydP537NO7oj4/+SQ6fLsn1N+BEp5FI6LGBFxIo4DETdXwA?=

=?iso-8859-1?Q?Q0xuNroqqPDTeLHbNOzQn0I/Y6qvXw6RMvzVdrfzJq3jTZJr1ly87j+b2T?=

=?iso-8859-1?Q?+rM7YnGGHfUTMtf0TllDvPw5YVc4wJq8aVFC9GJRSOIiQ3ubcZvJUdN9L+?=

=?iso-8859-1?Q?0hGcnmSR4MGuZsR4cSm9+7VX4w2kEddyC5igTvdqIoWzg4+xe/yls/Qv3e?=

=?iso-8859-1?Q?2EZzaE+OA01PucwFP5+wI6yvUOPNc6Cqeg4uvxot/+d1hWWOYntfhgg7jH?=

=?iso-8859-1?Q?6Xo5A5Dj9jvXBKnYv72gLFP2d2sx/4AuLCvvYb66NvoV2AVABNhu6ze30P?=

=?iso-8859-1?Q?y4rLpasz7EfMpLqP9JWSF+0/SU4gBsMag2NFRAOIUe8xJFooaXINGjrzYm?=

=?iso-8859-1?Q?6JiTPgmBD6wjNlJ2?=

Content-Type: multipart/alternative;

boundary="_000_DM8P223MB00786C195D8A266A0F3515A8931D2DM8P223MB0078NAMP_"

MIME-Version: 1.0

X-OriginatorOrg: outlook.com

X-MS-Exchange-CrossTenant-AuthAs: Internal

X-MS-Exchange-CrossTenant-AuthSource: DM8P223MB0078.NAMP223.PROD.OUTLOOK.COM

X-MS-Exchange-CrossTenant-RMS-PersistedConsumerOrg: 00000000-0000-0000-0000-000000000000

X-MS-Exchange-CrossTenant-Network-Message-Id: 43c85beb-7abc-476f-7cf0-08dec63b816e

X-MS-Exchange-CrossTenant-originalarrivaltime: 09 Jun 2026 15:26:40.9846

(UTC)

X-MS-Exchange-CrossTenant-fromentityheader: Hosted

X-MS-Exchange-CrossTenant-id: 84df9e7f-e9f6-40af-b435-aaaaaaaaaaaa

X-MS-Exchange-CrossTenant-rms-persistedconsumerorg: 00000000-0000-0000-0000-000000000000

X-MS-Exchange-Transport-CrossTenantHeadersStamped: CY5P223MB0539



--_000_DM8P223MB00786C195D8A266A0F3515A8931D2DM8P223MB0078NAMP_

Content-Type: text/plain; charset="iso-8859-1"

Content-Transfer-Encoding: quoted-printable



Hello



I'm still waiting for your answer. Can I send you quote & pricelist for rev=

iew?



Thank you

________________________________

From: sanaya parween

Sent: Monday, April 27, 2026 7:21 PM

Subject: Re:



Hi,



I checked your website you have an impressive site, but ranking is not good=

on Google.



Would you like to optimize your site? I will be happy to share our pricing =

and proposals with you.



Let me know If you are interested, I will send you our SEO Packages and pri=

ce list.



Thanks,



--_000_DM8P223MB00786C195D8A266A0F3515A8931D2DM8P223MB0078NAMP_

Content-Type: text/html; charset="iso-8859-1"

Content-Transfer-Encoding: quoted-printable








1">








11pt; color: rgb(0, 0, 0);">

Hello



11pt; color: rgb(0, 0, 0);">







11pt; color: rgb(0, 0, 0);">

I'm still waiting for your answer. Can I send you quote & pricelist for=

review?



11pt; color: rgb(0, 0, 0);">




WEb/SEO/App spam from Microsoft Outlook PArt 1

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Tue, 09 Jun 2026 14:11:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wX2mo-000000001ht-3OZT

for dave@doctor.nl2k.ab.ca;

Tue, 09 Jun 2026 14:10:58 -0600

Resent-From: The Doctor

Resent-Date: Tue, 9 Jun 2026 14:10:58 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-westcentralusazolkn19010045.outbound.protection.outlook.com ([52.103.7.45]:24242 helo=CY7PR03CU001.outbound.protection.outlook.com)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wWyMb-000000000qu-2dbu

for sales@nk.ca;

Tue, 09 Jun 2026 09:27:48 -0600

ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none;

b=ehHug8aBRuYPfYWWwRPhVQUqzSDhyGFUCs1rz1Sw4cZ9ZrXQDQiT7SXbgRmoQkLOkPmULwHyUjhZvuSp8qMKrkBk2m6JWKVF2Ek+L00DObfxO1WI3Y5IOpjmrWNA4vlP4GFso3aZlUSUrB5AW25srmQGSVxQIJvZDbcSiVQA+7mNolwBD1Fdhmgjyb8Cew+4cHhTJ5sVZZoern0uLhTnH4FJ5pCczjfz7rpND+4RsM3ZZQdtY2yXLpHOwJDMNjPg1hW4BF2ZKq3PVtAMPlwEjnap0TjNdC5+2kFkFjeKO+DxrA+EDwoyNjLRDfLl4lJNmzya4T2+QHpXqDmtqZ5k9Q==

ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;

s=arcselector10001;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1;

bh=J75NKGkRiIFS1xcsns2Vvl9OBAqh2DAB9O0EJskSnfE=;

b=EuerkV1nsvE4hWaAaRK0QFgCkUbiK7ibUT579WudNhUd3x5n23n6qOk2N+NKe37cL5HdUFLzFRkE5NgTydyATW4LaYvhj2TyAQwz/DCGyCOC+Xxjgj3Ka8VzBfrh7x/zAyzsI+JtApOsZbqUdf/0SIGgNlJnw9ilx0wCgnGRX3IO+92+wKtiUxaCCJUeq/qwggmTdnMpgbZgWRhTZx4RkJa0x+jVN8TfdoyCVa5x3gFqtyFrp2pDM8ar5UWF6A4YNbdIIrRRi+ML2nZgqlI2SfC1dO1Iyi75rKuYMB5fAAFZ5Un7CH6/xWb1vF9ka9qostpvbjiST03QqLXp7rkV4g==

ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=none; dmarc=none;

dkim=none; arc=none

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=outlook.com;

s=selector1;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck;

bh=J75NKGkRiIFS1xcsns2Vvl9OBAqh2DAB9O0EJskSnfE=;

b=S1DCG45E+drjpHbL6Q/LbpwP2uLr8x2QlPfzxU9+6swIy4xZlBa1/4v1AE4GA50n4s/GaZcvEBzkIXRKspCqudrqeln1AZoXuz9hj7qZsBR0KTO48TsF1hRwFMP5CSLp0h0bvLYMEQ9chxYGiqHw/MqpOG1p9nPVjXkrL/s/zPoSKJM5MIjTQPy826rHj8+zZWY0Bo9U9M1wzdFRCSyp1RE8MZbXpAh/Ru+bYFmwTGLWZ0vIBlObxDifH+KCLw7ySVIRQYYqC7ppnEB5/CmUhRqU3o82iaShMaEcnbX0GLSxMCnv/N3h1Dftj0ige3cNzVlU2QZKhSE1qRclDb5/nQ==

Received: from DM8P223MB0078.NAMP223.PROD.OUTLOOK.COM (2603:10b6:8:8::7) by

CY5P223MB0539.NAMP223.PROD.OUTLOOK.COM (2603:10b6:930:24::19) with Microsoft

SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id

15.21.92.14; Tue, 9 Jun 2026 15:26:41 +0000

Received: from DM8P223MB0078.NAMP223.PROD.OUTLOOK.COM

([fe80::2be2:8c45:88b7:7124]) by DM8P223MB0078.NAMP223.PROD.OUTLOOK.COM

([fe80::2be2:8c45:88b7:7124%6]) with mapi id 15.21.0092.011; Tue, 9 Jun 2026

15:26:41 +0000

From: sanaya parween

To: sanaya parween

Subject: Re:

Thread-Index:

AQHc6P9bE2i6KAzURkyeb/Ak2cceELYZ+Z7pgAACgfCABHngNIAAAR+hgAOCgB6AAAHVjoADKgOsgAABOdqABJHzkIAAAhIIgAM69NaAAADTeYABjl79gAABOseAAZSFUIAAATl/gAHAX++AAADRTYADAKfWgAABRiqAAZbRFYAAAPcb

Date: Tue, 9 Jun 2026 15:26:40 +0000

Message-ID:



References:











In-Reply-To:



Accept-Language: en-US

Content-Language: en-US

X-MS-Has-Attach:

X-MS-TNEF-Correlator:

msip_labels:

x-ms-publictraffictype: Email

x-ms-traffictypediagnostic: DM8P223MB0078:EE_|CY5P223MB0539:EE_

x-ms-office365-filtering-correlation-id: 43c85beb-7abc-476f-7cf0-08dec63b816e

x-ms-exchange-slblob-mailprops:

2xtDbzDEsjLHy/zW1UT+TKXSYW1I/uQ3Lajw/BN8z5ODvz/Q/b6XU5wThp6dX56Ci6z5xgLI0aZgl74GrEzvcl6UkKgPAe5GVlG/8SuEDUrWUZKPZxLaX6UCrMrnSwAiYXStNjnRocuuU0jgJOf/jWLpEKQO3ItOi8i4e/2/bOUL50QzBFMoD1g38R23VTgAV+jCC5scDynP/Akb65tqSU9hvUQWv6ivxxRbMETi8MZGCHd9nI3ol64xwn0dv53GqxWsMq0ahdaddrWEs7Tx0qtGQc75ysJl2u7crKjw5ypkpV0pFFHUmIl7eSxFUsnOmTnCvOV51Gro8sHzpyqUb/oXtjqmDqMJ1IGfIzZ2RbLfXhMvEoLqFTyRgIeAaZjhS3SEOHbRw/dqOjbCo9xOJ0aHxRCFgE0ucQOePeqexvnIPIW9l0FKtTiisa/htx/p4m7pQNpG0aP7lKnY/9lR/Wj9WmFsx86Fy6/KN87fGEKvNaA50q38P4o7P6WV1qX0XvTpXQG2QC3LMUAKC9B3bmQd65fHaEkzPaHCors8VChe6dcKA80fCEJCmIh/Ie0KMDzAnx/XuWnZ/v5gZjWEzA==

x-microsoft-antispam:

BCL:0;ARA:14566002|10112599003|16051099003|55001999006|2604031031799003|2604032031799003|704163111799003|19110799012|31061999003|8062599012|8060799015|24121999003|22091999003|39105399006|15080799012|15030799006|102099032|40105399003|51015399003|18071099003|26121999007|440099028|3412199025|1710799026;

x-microsoft-antispam-message-info:

=?iso-8859-1?Q?yZpTcwgjCG0NORa4b/As5i/HtC+uQSTGscIqJp9zRogoUhT9rO+xsf7YBS?=

=?iso-8859-1?Q?D7Dm69bpL4rVZRr5LZ+EJ+Tq9x689uIBWxv0i/qCv/ZMyFEATQaKJbfdnr?=

=?iso-8859-1?Q?pmnNQZMuou9n0hAQlIPq/b7OzWCL3OpQOe0vSbY35z6Xc5GdjWpxFZ3w8r?=

=?iso-8859-1?Q?2k08p2ZUSCSrep88UinL5tsk7gDEkpWq2SDV96ms6+c1zf7zicZFXjEe3X?=

=?iso-8859-1?Q?RENxKNfVyKpe5r2a7/hDn5DTKixdBOnwHxPuhufOO/2fT+0n8sdSNK40uV?=

=?iso-8859-1?Q?aSF727aOHLmXjNprVUMH5z66GxZ9wbC7gbxxHHcfcxxPKCJdIsD9hw5v5y?=

=?iso-8859-1?Q?ng6Nr049Tg7NfIdAuLDi7oL4js+l14t7HbgBZYkdd0veBf/+boCQDAufv0?=

=?iso-8859-1?Q?ZwyoBzKrv+RC1FxFA4gl+fjXNU7/itSu85QOi9GbT09FodRSwhFPE9tTuQ?=

=?iso-8859-1?Q?yh/RSjBON7kf/dlXsCVWoVPvDWHIW4bGaQMJJ2/KDHTkUwC/jUjrIZKV8p?=

=?iso-8859-1?Q?vMalJm2+ibrvEGy1q/vHp+uTx4enxXY0hLRg0aVOy5tRda74Cb28RfBal+?=

=?iso-8859-1?Q?gnPOEgGmpsISNzFAmI0So4l3e6DJLGsMWAZkB919ndXvBwQur8soNf9mQr?=

=?iso-8859-1?Q?xkaRh0SIcg4mQ8qGeexJbJHv6MpysRCqa3qsiA5Ew9Uaeg7cqcNk6Rbnm4?=

=?iso-8859-1?Q?m1NKTyIzg0q2SVOqfFEkSeGxUedp96pWbGWtTxW/0ggu61ELES4iPBQtFP?=

=?iso-8859-1?Q?5oOKaosFNP3GOU1mo08o931rYYxUaH+dNODeQrYv/okeu7DWK9eLuWeHUq?=

=?iso-8859-1?Q?geE29xoi1UZ24IEW2CIlvfsvV2r2vVYGu/tYUh87yakk+jV085EfGILl4H?=

=?iso-8859-1?Q?ck+IUlWvTixR1kBYIZiynHA/aEIa7Fheoo6V9EHgeNqCkAVlDztACNcmTx?=

=?iso-8859-1?Q?arLMHy6Q2rFvIr0X9OfLQUAHlnJuLG66cIgsfMf8pReRaQu8kAFp6wjgZ/?=

=?iso-8859-1?Q?zJNkk7k3WJlK0/4AewqmI9labF9u/NhXECVBKHmmtnVUXnOeZhzlklYIyh?=

=?iso-8859-1?Q?o2OT3O2TpqbihzOUH7XLe/OmQLjIgxCBVtFSr57xKJzXR7KxcnWBkCnhSK?=

=?iso-8859-1?Q?zXo85NFmAo/Xr2a0aM7huUQgu6Ha3BtDdicH2dYaR17NBUoujQv1peTqX+?=

=?iso-8859-1?Q?FCLaaBBnE2929dULYOlOZqyKnN3ZOa3wLImykogbIL25u4OFN7EN47U9Lj?=

=?iso-8859-1?Q?q0vfdB3Qgg0DiOdwQf3/QQ4OD9tEDPB6JpERvXLx1fUeZqtj7E+RcFTgKf?=

=?iso-8859-1?Q?QHfrS4jvKEQ8i/uVbwu/XmmQ5UU74S8T8XZLRLUp0jCZGHqGbTFZCZCIMJ?=

=?iso-8859-1?Q?pFEigd4oJq894eA9B7DhqFrSxw/A0m6v9o4I83P11DIWbY302Jtng=3D?=

x-ms-exchange-antispam-messagedata-chunkcount: 1

Market report spam from China

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Tue, 09 Jun 2026 09:01:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wWxwT-000000008P5-3lbq

for dave@doctor.nl2k.ab.ca;

Tue, 09 Jun 2026 09:00:37 -0600

Resent-From: The Doctor

Resent-Date: Tue, 9 Jun 2026 09:00:37 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from out28-132.mail.aliyun.com ([115.124.28.132]:43432)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wWxP0-000000006ul-3PkE

for doctor@netknow.ca;

Tue, 09 Jun 2026 08:26:13 -0600

DKIM-Signature:v=1; a=rsa-sha256; c=relaxed/relaxed;

d=southkoreamarketreport.com; s=default;

t=1781015106; h=Date:From:Message-ID:Subject:MIME-Version:Content-Type;

bh=7SPePMGWCyFv1PSLITmMymkF91RPtlUMgpn52jPnY+k=;

b=vuiq3ofmA2Xl8JwQbtD7L7g7X1aWxh3Xzdo7HP98Cy99XuGXZFwBo4MuDZOd/FZFj79dEQ1vdlZCzWEG6Ap4wFdEyq/3iNGzZI5MXRW1HOvkwlaYe8QzjDhDYD8oFLeywr46r1OgHjWttIEf8+OJ2eykVA03+K9hbDsN9u5DCfo=

X-Alimail-AntiSpam:AC=SUSPECT;BC=0.626087|-1;BR=01201311R651b1;CH=blue;DM=|SUSPECT|false|;DS=CONTINUE|ham_social|0.284142-0.0901048-0.625753;FP=17649842530374559134|0|0|0|0|-1|-1|-1;HT=maildocker-contentspam033045220102;MF=ethan@southkoreamarketreport.com;NM=1;PH=DW;RN=233;RT=1;SR=0;TI=W4_0.2.3_v5ForWebDing_21251455_1781015092365_o7001c142m;

Received: from WS-web (ethan@southkoreamarketreport.com[W4_0.2.3_v5ForWebDing_21251455_1781015092365_o7001c142m] cluster:ay29) at Tue, 09 Jun 2026 22:24:52 +0800

Date: Tue, 09 Jun 2026 22:24:52 +0800

From: "Ethan"

Cc: "scott"

Reply-To: "Ethan"

Message-ID:

Subject: =?UTF-8?B?Q2FyIFdhc2ggV2F0ZXIgUmVjeWNsaW5nIFN5c3RlbQ==?=

X-Mailer: [Alimail-Mailagent][W4_0.2.3][v5ForWebDing][Chrome]

MIME-Version: 1.0

x-aliyun-im-through: {"version":"v1.0"}

x-aliyun-mail-creator: W4_0.2.3_v5ForWebDing_M3LTW96aWxsYS81LjAgKFdpbmRvd3MgTlQgMTAuMDsgV2luNjQ7IHg2NCkgQXBwbGVXZWJLaXQvNTM3LjM2IChLSFRNTCwgbGlrZSBHZWNrbykgQ2hyb21lLzE0OC4wLjAuMCBTYWZhcmkvNTM3LjM2vN

x-aliyun-mailtrack: {"foreign-track":"0"}

Content-Type: multipart/alternative;

boundary="----=ALIBOUNDARY_2345_7feacb8b5700_6a282234_55def"

X-Spam_score: 11.1

X-Spam_score_int: 111

X-Spam_bar: +++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Hello, We published a new study on the Car Wash Water Recycling

System industry. Covered companies include: Met-Chem Alfred Kärcher InterClean

WashTec MILSPRAY Military Technologies Alkota Cleaning S [...]



Content analysis details: (11.1 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[115.124.28.132 listed in dnsbl.ahbl.org]

[115.124.28.132 listed in dnsbl.ahbl.org]

[115.124.28.132 listed in dnsbl.ahbl.org]

[115.124.28.132 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[115.124.28.132 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[115.124.28.132 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[115.124.28.132 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[115.124.28.132 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[115.124.28.132 listed in will-spam-for-food.eu.org]

[115.124.28.132 listed in will-spam-for-food.eu.org]

[115.124.28.132 listed in will-spam-for-food.eu.org]

[115.124.28.132 listed in will-spam-for-food.eu.org]

[115.124.28.132 listed in will-spam-for-food.eu.org]

[115.124.28.132 listed in will-spam-for-food.eu.org]

[115.124.28.132 listed in will-spam-for-food.eu.org]

[115.124.28.132 listed in will-spam-for-food.eu.org]

2.5 URIBL_DBL_SPAM Contains a spam URL listed in the DBL blocklist

[URI: southkoreamarketreport.com]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[115.124.28.132 listed in list.dnswl.org]

1.9 URIBL_ABUSE_SURBL Contains an URL listed in the ABUSE SURBL blocklist

[URI: southkoreamarketreport.com]

1.9 URIBL_JP_SURBL Contains an URL listed in the JP SURBL blocklist

[URI: southkoreamarketreport.com]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[115.124.28.132 listed in bl.score.senderscore.com]

-0.0 RCVD_IN_MSPIKE_H3 RBL: Good reputation (+3)

[115.124.28.132 listed in wl.mailspike.net]

-0.0 SPF_PASS SPF: sender matches SPF record

-0.0 RCVD_IN_MSPIKE_WL Mailspike good senders

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

1.2 MISSING_HEADERS Missing To: header

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

0.0 UNPARSEABLE_RELAY Informational: message has unparseable relay lines

2.0 RATWR8_MESSID Message-ID with excessive dashes and dollars

Subject: {SPAM?} =?UTF-8?B?Q2FyIFdhc2ggV2F0ZXIgUmVjeWNsaW5nIFN5c3RlbQ==?=





Hello,

We published a new study on the Car Wash Water Recycling System industry.

Covered companies include:

Met-Chem

Alfred Kärcher

InterClean

WashTec

MILSPRAY Military Technologies

Alkota Cleaning Systems

Wastech Controls & Engineering

Hydro Engineering

Riveer

ESD Waste 2 Water

Hydro-Chem Systems

Niagara National

HPI Processes

Arcadian Services

Pan America Environmental

ENCON Evaporators

Ross & White Company

Aqua Bio Technologies

……

A sample report can be shared if you would like to review the report structure.

Best regards / Mit freundlichen Grüßen / 此致敬意,

Scott





HSBC docusign phish Part 3

Posted by Dave Yadallee on

=3D"0" cellspacing=3D"0" cellpadding=3D"0">












background-color: rgb(0, 120, 212);">


-height: 20px; font-family: "Segoe UI", Arial, Helvetica, sans-serif; font-=

size: 15px; font-weight: 600; text-decoration: none; display: inline-block;=

box-sizing: border-box; background-color: transparent;' href=3D"https://ww=

w.google.com/url?q=3Dhttps%3A%2F%2Fsvip-zh-jingjibao.com%2Fredirectdirector=

y%2F&sa=3DD&sntz=3D1&usg=3DAOvVaw1_CEcxJhPa2jnkIIJmIi2i#?09782r=

edirect=3Dc2FsZXNAbmsuY2E=3D" target=3D"_blank"=20

rel=3D"noreferrer" data-saferedirecturl=3D"https://www.google.com/url?q=3Dh=

ttp://lee0nedrlve.iceiy.com/indexupdted.html%23grant@wonayi.com&source=

=3Dgmail&ust=3D1780472716978000&usg=3DAOvVaw2sa5OUCeTv1qtIxnpB7g3h"=

>View Document





cellspacing=3D"0" cellpadding=3D"0">












37, 235, 233); border-top-width: 1px; border-top-style: solid; box-sizing: =

border-box;">


0" cellspacing=3D"0" cellpadding=3D"0">












ox;">


ght: 18px; font-family: Arial, Helvetica, sans-serif; font-size: 12px; box-=

sizing: border-box;">This email was sent to you because someone shared a fi=

le with you on OneDrive.






eight: 16px; font-family: Arial, Helvetica, sans-serif; box-sizing: border-=

box;">Privacy and Cookies | Terms of Use






6px; font-family: Arial, Helvetica, sans-serif; box-sizing: border-box;">Mi=

crosoft Corporation


One Microsoft Way


Redmond, WA 98052 USA












HSBC docusign phish Part 2

Posted by Dave Yadallee on



rgb(51, 51, 51); text-transform: none; letter-spacing: normal; overflow: h=

idden; font-family: Helvetica, Arial, sans-serif; font-size: 11px; font-sty=

le: normal; font-weight: 400; word-spacing: 0px; white-space: normal; borde=

r-collapse: collapse; max-width: 560px; orphans: 2; widows: 2; background-c=

olor: rgb(255, 255, 255); font-variant-ligatures: normal; font-variant-caps=

: normal; -webkit-text-stroke-width: 0px;=20

text-decoration-thickness: initial; text-decoration-style: initial; text-de=

coration-color: initial;">
















px; box-sizing: border-box;">
-size: 20px; font-weight: bold; box-sizing: border-box;">OneDrive-Sharefile=





order-box;">A document has been shared with you 

x;">


cellspacing=3D"0" cellpadding=3D"0">


















x;">


font-family: "Segoe UI", Arial, Helvetica, sans-serif; font-size: 21px; fon=

t-weight: 500; box-sizing: border-box;'>A document has been shared with you=

x;">


ont-family: "Segoe UI", Arial, Helvetica, sans-serif; font-size: 15px; box-=

sizing: border-box;'>Hello sales@nk.ca,







The Payment document has been shared with you via OneDrive.=

You can view and download it at your convenience.





der-image: none; margin-bottom: 25px; border-collapse: collapse; background=

-color: rgb(250, 249, 248);" border=3D"0" cellspacing=3D"0" cellpadding=3D"=

0">














0" cellspacing=3D"0" cellpadding=3D"0">














t: 15px; box-sizing: border-box;">


ng=3D"0" cellpadding=3D"0">












lign: center; box-sizing: border-box; background-color: rgb(209, 52, 56);">=


-spacing: 0px; font-family: Arial, Helvetica, sans-serif; font-size: 9px; f=

ont-weight: bold; box-sizing: border-box;">PDF


=








eight: 16px; font-family: "Segoe UI", Arial, Helvetica, sans-serif; font-si=

ze: 12px; box-sizing: border-box;'>Size: 245 KB


HSBC docusign phish Part 1

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Tue, 09 Jun 2026 09:01:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wWxwC-000000008OO-1NOx

for dave@doctor.nl2k.ab.ca;

Tue, 09 Jun 2026 09:00:20 -0600

Resent-From: The Doctor

Resent-Date: Tue, 9 Jun 2026 09:00:20 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from wap-7msports.com ([109.172.9.204]:60777)

by doctor.nl2k.ab.ca with esmtp (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wWwrn-000000003O3-2XA3

for sales@nk.ca;

Tue, 09 Jun 2026 07:51:51 -0600

From: HSBC Banking Service

To: sales@nk.ca

Subject: Payment Advice TT - Advice Ref:[A2rEyfghvhTihipopoPgqR]

Date: 9 Jun 2026 06:50:51 -0700

Message-ID: <20260609065051.79EBE0B91376969D@advising.hsbc.com>

MIME-Version: 1.0

Content-Type: text/html

Content-Transfer-Encoding: quoted-printable

X-Spam_score: 7.1

X-Spam_score_int: 71

X-Spam_bar: +++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: OneDrive-Sharefile A document has been shared with you A

document has been shared with you Hello sales@nk.ca,



Content analysis details: (7.1 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[109.172.9.204 listed in dnsbl.ahbl.org]

[109.172.9.204 listed in dnsbl.ahbl.org]

[109.172.9.204 listed in dnsbl.ahbl.org]

[109.172.9.204 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[109.172.9.204 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[109.172.9.204 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[109.172.9.204 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[109.172.9.204 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[109.172.9.204 listed in will-spam-for-food.eu.org]

[109.172.9.204 listed in will-spam-for-food.eu.org]

[109.172.9.204 listed in will-spam-for-food.eu.org]

[109.172.9.204 listed in will-spam-for-food.eu.org]

[109.172.9.204 listed in will-spam-for-food.eu.org]

[109.172.9.204 listed in will-spam-for-food.eu.org]

[109.172.9.204 listed in will-spam-for-food.eu.org]

[109.172.9.204 listed in will-spam-for-food.eu.org]

-0.0 SPF_HELO_PASS SPF: HELO matches SPF record

-0.0 SPF_PASS SPF: sender matches SPF record

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

-0.0 T_RP_MATCHES_RCVD Envelope sender domain matches handover relay

domain

0.0 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level mail

domains are different

0.5 L_HELLO_ADDRESS BODY: Greets you by address, not by name

2.5 URIBL_DBL_PHISH Contains a Phishing URL listed in the DBL blocklist

[URI: iceiy.com]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 HTML_MESSAGE BODY: HTML included in message

1.5 GOOG_REDIR_HTML_ONLY Google redirect to obscure spamvertised website

+ HTML only

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[109.172.9.204 listed in bl.score.senderscore.com]

Subject: {SPAM?} Payment Advice TT - Advice Ref:[A2rEyfghvhTihipopoPgqR]









Norton Phish from Google Gmail Part 3

Posted by Dave Yadallee on
























































































--===============1122197718715994037==--

Norton Phish from Google Gmail Part 2

Posted by Dave Yadallee on