Stratobooster phish from Google

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 08 Jan 2026 14:51:00 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vdxuA-00000000P66-25IB

for dave@doctor.nl2k.ab.ca;

Thu, 08 Jan 2026 14:50:54 -0700

Resent-From: The Doctor

Resent-Date: Thu, 8 Jan 2026 14:50:54 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from 237.89.91.34.bc.googleusercontent.com ([34.91.89.237]:40942 helo=freenet-mobilfunk.de)

by doctor.nl2k.ab.ca with esmtp (Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vduYR-00000000CZL-0VHp

for doctor@doctor.nl2k.ab.ca;

Thu, 08 Jan 2026 11:16:23 -0700

Received: by freenet-mobilfunk.de (Postfix, from userid 1000)

id 36583369B8B; Thu, 8 Jan 2026 18:15:28 +0000 (UTC)

To: doctor@doctor.nl2k.ab.ca

From: "=?UTF-8?B?UGVyZm9ybWFuY2UgRW5oYW5jZXI=?="

Subject: =?UTF-8?B?VW5sZWE=?==?UTF-8?B?c2ggWW91ciBU?==?UTF-8?B?cnVlIFBvdGVudA==?==?UTF-8?B?aWFsIPCfmoA=?=

MIME-Version: 1.0

Content-Type: text/html; charset="UTF-8"

Content-Transfer-Encoding: base64

List-Unsubscribe-Post: List-Unsubscribe=One-Click

Message-Id: <20260108181528.36583369B8B@freenet-mobilfunk.de>

Date: Thu, 8 Jan 2026 18:15:28 +0000 (UTC)

X-Spam_score: 15.1

X-Spam_score_int: 151

X-Spam_bar: +++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: StratosBoost — Luxury Black & Gold Unleash Your True Potential

🚀



Content analysis details: (15.1 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[34.91.89.237 listed in dnsbl.ahbl.org]

[34.91.89.237 listed in dnsbl.ahbl.org]

[34.91.89.237 listed in dnsbl.ahbl.org]

[34.91.89.237 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[34.91.89.237 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[34.91.89.237 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[34.91.89.237 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[34.91.89.237 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[34.91.89.237 listed in will-spam-for-food.eu.org]

[34.91.89.237 listed in will-spam-for-food.eu.org]

[34.91.89.237 listed in will-spam-for-food.eu.org]

[34.91.89.237 listed in will-spam-for-food.eu.org]

[34.91.89.237 listed in will-spam-for-food.eu.org]

[34.91.89.237 listed in will-spam-for-food.eu.org]

[34.91.89.237 listed in will-spam-for-food.eu.org]

[34.91.89.237 listed in will-spam-for-food.eu.org]

1.0 SPF_SOFTFAIL SPF: sender does not match SPF record (softfail)

0.9 SPF_HELO_SOFTFAIL SPF: HELO does not match SPF record (softfail)

3.0 RECEIVED_MULTICAST A multicast IP adress appears in Received header

0.0 TVD_RCVD_IP Message was received from an IP address

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

0.0 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level mail

domains are different

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_IMAGE_ONLY_32 BODY: HTML: images with 2800-3200 bytes of words

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.1 FROM_EXCESS_BASE64 From: base64 encoded unnecessarily

0.4 RDNS_DYNAMIC Delivered to internal network by host with

dynamic-looking rDNS

0.4 KHOP_HELO_FCRDNS Relay HELO differs from its IP's reverse DNS

0.0 SARE_FROM_SPAM_WORD4 From address suggests this may be spam

3.0 GOOG_STO_NOIMG_HTML Apparently using google content hosting to avoid

URIBL

Subject: {SPAM?} =?UTF-8?B?VW5sZWE=?==?UTF-8?B?c2ggWW91ciBU?==?UTF-8?B?cnVlIFBvdGVudA==?==?UTF-8?B?aWFsIPCfmoA=?=



PCFkb2N0eXBlIGh0bWw+CjxodG1sIGxhbmc9ImVuIj4KPGhlYWQ+CjxtZXRhIGNoYXJzZXQ9InV0

Zi04Ij4KPG1ldGEgbmFtZT0idmlld3BvcnQiIGNvbnRlbnQ9IndpZHRoPWRldmljZS13aWR0aCxp

bml0aWFsLXNjYWxlPTEiPgo8dGl0bGU+U3RyYXRvc0Jvb3N0IOKAlCBMdXh1cnkgQmxhY2sgJiBH

b2xkPC90aXRsZT4KPHN0eWxlPgpodG1sLGJvZHl7aGVpZ2h0OjEwMCU7bWFyZ2luOjA7Zm9udC1m

YW1pbHk6IlBvcHBpbnMiLEFyaWFsLHNhbnMtc2VyaWY7YmFja2dyb3VuZDojMGUwZTBmO2NvbG9y

OiNmZmY7fQouY29udGFpbmVye21heC13aWR0aDo2ODBweDttYXJnaW46MjhweCBhdXRvO3BhZGRp

bmc6MjRweDtib3JkZXItcmFkaXVzOjEwcHg7YmFja2dyb3VuZDojMTYxNjE2O2JveC1zaGFkb3c6

MCAxMHB4IDQwcHggcmdiYSgyNTUsMjE1LDAsLjE1KTt9Ci5oZXJvLWltZ3t3aWR0aDoxMDAlO2hl

aWdodDphdXRvO2JvcmRlci1yYWRpdXM6OHB4O2Rpc3BsYXk6YmxvY2s7b2JqZWN0LWZpdDpjb3Zl

cjtib3gtc2hhZG93OjAgOHB4IDI0cHggcmdiYSgyNTUsMjE1LDAsLjA4KTt9Ci5jb250ZW50e3Bh

ZGRpbmc6MjRweCAxMHB4fQpoMXt0ZXh0LWFsaWduOmNlbnRlcjtjb2xvcjojZmZjYzMzO2ZvbnQt

c2l6ZToyNnB4O2ZvbnQtd2VpZ2h0OjcwMDttYXJnaW46OHB4IDAgMTJweH0KLmxlYWR7dGV4dC1h

bGlnbjpjZW50ZXI7Y29sb3I6I2NjYztmb250LXNpemU6MTVweDtsaW5lLWhlaWdodDoxLjY7bWFy

Z2luLWJvdHRvbToxOHB4fQouYnRue2Rpc3BsYXk6aW5saW5lLWJsb2NrO2JhY2tncm91bmQ6bGlu

ZWFyLWdyYWRpZW50KDEzNWRlZywjZmZjYzMzLCNkMWEwMDApO2NvbG9yOiMwMDA7cGFkZGluZzox

NHB4IDIycHg7Ym9yZGVyLXJhZGl1czo2cHg7Zm9udC13ZWlnaHQ6NzAwO3RleHQtZGVjb3JhdGlv

bjpub25lO3RleHQtdHJhbnNmb3JtOnVwcGVyY2FzZTtib3gtc2hhZG93OjAgOHB4IDI1cHggcmdi

YSgyNTUsMjA0LDUxLC4zKTt9Ci5mZWF0dXJlc3tkaXNwbGF5OmZsZXg7ZmxleC13cmFwOndyYXA7

Z2FwOjEycHg7anVzdGlmeS1jb250ZW50OmNlbnRlcjttYXJnaW4tdG9wOjE2cHh9Ci5jaGVja3ti

YWNrZ3JvdW5kOiNmZmNjMzM7Y29sb3I6IzAwMDt3aWR0aDoyMHB4O2hlaWdodDoyMHB4O2JvcmRl

ci1yYWRpdXM6NTAlO2Rpc3BsYXk6ZmxleDthbGlnbi1pdGVtczpjZW50ZXI7anVzdGlmeS1jb250

ZW50OmNlbnRlcjtmb250LXNpemU6MTNweDtmb250LXdlaWdodDo4MDB9Ci5mZWF0IHB7Y29sb3I6

I2UwZTBlMDtmb250LXNpemU6MTRweDttYXJnaW46MH0KLnBpbGx7bWFyZ2luOjIwcHggYXV0byA2

cHg7bWF4LXdpZHRoOjUyMHB4O2JhY2tncm91bmQ6IzI4MjAwMDtjb2xvcjojZmZjYzMzO3BhZGRp

bmc6MTJweCAxNHB4O2JvcmRlci1yYWRpdXM6NnB4O3RleHQtYWxpZ246Y2VudGVyO2ZvbnQtd2Vp

Z2h0OjYwMDtib3gtc2hhZG93OjAgNnB4IDE2cHggcmdiYSgyNTUsMjA0LDUxLC4xKTt9Ci5mb290

ZXJ7Y29sb3I6Izg4ODt0ZXh0LWFsaWduOmNlbnRlcjtmb250LXNpemU6MTJweDttYXJnaW4tdG9w

OjIwcHh9Ci51bnN1YnNjcmliZXtjb2xvcjojYWFhO3RleHQtZGVjb3JhdGlvbjp1bmRlcmxpbmV9

Cjwvc3R5bGU+CjwvaGVhZD4KPGJvZHk+CjxkaXYgY2xhc3M9ImNvbnRhaW5lciI+CjxpbWcgY2xh

c3M9Imhlcm8taW1nIiBzcmM9Imh0dHBzOi8vaS5neWF6by5jb20vNDc4ZDRlYjZmZjZiMmQ1YzJh

MTBhYzFlOTYwZDczN2IucG5nIiBhbHQ9IlN0cmF0b3NCb29zdCBwcm9kdWN0Ij4KPGRpdiBjbGFz

cz0iY29udGVudCI+CjxoMT5VbmxlYXNoIFlvdXIgVHJ1ZSBQb3RlbnRpYWwg8J+agDwvaDE+Cjxw

IGNsYXNzPSJsZWFkIj5TdHJhdG9zQm9vc3QgZnVlbHMgeW91ciBlbmVyZ3ksIGZvY3VzICYgcGVy

Zm9ybWFuY2Ug4oCUIHRydXN0ZWQgYnkgZXhwZXJ0cyBhbmQgYmFja2VkIGJ5IHNjaWVuY2UuPC9w

Pgo8cCBzdHlsZT0idGV4dC1hbGlnbjpjZW50ZXIiPjxhIGNsYXNzPSJidG4iIGhyZWY9Imh0dHBz

Oi8vc3RvcmFnZS5nb29nbGVhcGlzLmNvbS9iYWwwMmZ2eG5zNjRram41OGIxNmZkdnhzNzhrai9z

dHJhb3NibWl0bHNva29sejdkaTU0ZHNjeGttN2diZi5odG1sIj5DbGFpbSBZb3VyIFN0cmF0b3NC

b29zdCBOb3c8L2E+PC9wPgo8ZGl2IGNsYXNzPSJmZWF0dXJlcyI+CjxkaXYgY2xhc3M9ImZlYXQi

PjxkaXYgY2xhc3M9ImNoZWNrIj7inJM8L2Rpdj48cD5GYXN0LWFjdGluZyBuYXR1cmFsIGZvcm11

bGE8L3A+PC9kaXY+CjxkaXYgY2xhc3M9ImZlYXQiPjxkaXYgY2xhc3M9ImNoZWNrIj7inJM8L2Rp

dj48cD5CYWNrZWQgYnkgZXhwZXJ0czwvcD48L2Rpdj4KPGRpdiBjbGFzcz0iZmVhdCI+PGRpdiBj

bGFzcz0iY2hlY2siPuKckzwvZGl2PjxwPkVuZXJneSAmIHN0YW1pbmEgc3VwcG9ydDwvcD48L2Rp

dj4KPGRpdiBjbGFzcz0iZmVhdCI+PGRpdiBjbGFzcz0iY2hlY2siPuKckzwvZGl2PjxwPkVhc3kg

ZGFpbHkgdXNlPC9wPjwvZGl2Pgo8ZGl2IGNsYXNzPSJmZWF0Ij48ZGl2IGNsYXNzPSJjaGVjayI+

4pyTPC9kaXY+PHA+TWVudGFsIGZvY3VzIGJvb3N0PC9wPjwvZGl2Pgo8ZGl2IGNsYXNzPSJmZWF0

Ij48ZGl2IGNsYXNzPSJjaGVjayI+4pyTPC9kaXY+PHA+MTAwJSBzYXRpc2ZhY3Rpb24gZ3VhcmFu

dGVlPC9wPjwvZGl2Pgo8L2Rpdj4KPGRpdiBjbGFzcz0icGlsbCI+4pqhIExpbWl0ZWQgc3RvY2sg

YXZhaWxhYmxlIOKAlCBvcmRlciB0b2RheSBiZWZvcmUgaXQncyBnb25lITwvZGl2Pgo8ZGl2IGNs

YXNzPSJmb290ZXIiPgo8cD5Zb3UgcmVjZWl2ZWQgdGhpcyBlbWFpbCBiZWNhdXNlIHlvdSBzdWJz

Y3JpYmVkIHRvIFN0cmF0b3NCb29zdCBvZmZlcnMuPC9wPgo8cD48YSBjbGFzcz0idW5zdWJzY3Jp

YmUiIGhyZWY9Imh0dHBzOi8vc3RvcmFnZS5nb29nbGVhcGlzLmNvbS9mYXRrbW5zLTYya21uZmct

ZnY2c25jOC1qbWRuc2V0L3N0cmFvc2JtaXRsc29rb2x6N2RpNTRkc2N4a203Z2JmLmh0bWwiPlVu

c3Vic2NyaWJlPC9hPjwvcD4KPC9kaXY+CjwvZGl2PjwvZGl2Pgo8L2JvZHk+CjwvaHRtbD4=



Stratobooster phish from Google

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 08 Jan 2026 14:51:00 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vdxty-00000000P5X-2A1v

for dave@doctor.nl2k.ab.ca;

Thu, 08 Jan 2026 14:50:42 -0700

Resent-From: The Doctor

Resent-Date: Thu, 8 Jan 2026 14:50:42 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from 237.89.91.34.bc.googleusercontent.com ([34.91.89.237]:38198 helo=freenet-mobilfunk.de)

by doctor.nl2k.ab.ca with esmtp (Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vduYR-00000000CXi-0VFA

for doctor@nl2k.ab.ca;

Thu, 08 Jan 2026 11:16:26 -0700

Received: by freenet-mobilfunk.de (Postfix, from userid 1000)

id 7BD15369B48; Thu, 8 Jan 2026 18:15:22 +0000 (UTC)

To: doctor@nl2k.ab.ca

From: "=?UTF-8?B?UGVyZm9ybWFuY2UgRW5oYW5jZXI=?="

Subject: =?UTF-8?B?VW5sZWE=?==?UTF-8?B?c2ggWW91ciBU?==?UTF-8?B?cnVlIFBvdGVudA==?==?UTF-8?B?aWFsIPCfmoA=?=

MIME-Version: 1.0

Content-Type: text/html; charset="UTF-8"

Content-Transfer-Encoding: base64

List-Unsubscribe-Post: List-Unsubscribe=One-Click

Message-Id: <20260108181522.7BD15369B48@freenet-mobilfunk.de>

Date: Thu, 8 Jan 2026 18:15:22 +0000 (UTC)

X-Spam_score: 15.1

X-Spam_score_int: 151

X-Spam_bar: +++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: StratosBoost — Luxury Black & Gold Unleash Your True Potential

🚀



Content analysis details: (15.1 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[34.91.89.237 listed in dnsbl.ahbl.org]

[34.91.89.237 listed in dnsbl.ahbl.org]

[34.91.89.237 listed in dnsbl.ahbl.org]

[34.91.89.237 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[34.91.89.237 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[34.91.89.237 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[34.91.89.237 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[34.91.89.237 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[34.91.89.237 listed in will-spam-for-food.eu.org]

[34.91.89.237 listed in will-spam-for-food.eu.org]

[34.91.89.237 listed in will-spam-for-food.eu.org]

[34.91.89.237 listed in will-spam-for-food.eu.org]

[34.91.89.237 listed in will-spam-for-food.eu.org]

[34.91.89.237 listed in will-spam-for-food.eu.org]

[34.91.89.237 listed in will-spam-for-food.eu.org]

[34.91.89.237 listed in will-spam-for-food.eu.org]

1.0 SPF_SOFTFAIL SPF: sender does not match SPF record (softfail)

0.9 SPF_HELO_SOFTFAIL SPF: HELO does not match SPF record (softfail)

3.0 RECEIVED_MULTICAST A multicast IP adress appears in Received header

0.0 TVD_RCVD_IP Message was received from an IP address

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

0.0 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level mail

domains are different

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_IMAGE_ONLY_32 BODY: HTML: images with 2800-3200 bytes of words

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.1 FROM_EXCESS_BASE64 From: base64 encoded unnecessarily

0.4 RDNS_DYNAMIC Delivered to internal network by host with

dynamic-looking rDNS

0.4 KHOP_HELO_FCRDNS Relay HELO differs from its IP's reverse DNS

0.0 SARE_FROM_SPAM_WORD4 From address suggests this may be spam

3.0 GOOG_STO_NOIMG_HTML Apparently using google content hosting to avoid

URIBL

Subject: {SPAM?} =?UTF-8?B?VW5sZWE=?==?UTF-8?B?c2ggWW91ciBU?==?UTF-8?B?cnVlIFBvdGVudA==?==?UTF-8?B?aWFsIPCfmoA=?=



PCFkb2N0eXBlIGh0bWw+CjxodG1sIGxhbmc9ImVuIj4KPGhlYWQ+CjxtZXRhIGNoYXJzZXQ9InV0

Zi04Ij4KPG1ldGEgbmFtZT0idmlld3BvcnQiIGNvbnRlbnQ9IndpZHRoPWRldmljZS13aWR0aCxp

bml0aWFsLXNjYWxlPTEiPgo8dGl0bGU+U3RyYXRvc0Jvb3N0IOKAlCBMdXh1cnkgQmxhY2sgJiBH

b2xkPC90aXRsZT4KPHN0eWxlPgpodG1sLGJvZHl7aGVpZ2h0OjEwMCU7bWFyZ2luOjA7Zm9udC1m

YW1pbHk6IlBvcHBpbnMiLEFyaWFsLHNhbnMtc2VyaWY7YmFja2dyb3VuZDojMGUwZTBmO2NvbG9y

OiNmZmY7fQouY29udGFpbmVye21heC13aWR0aDo2ODBweDttYXJnaW46MjhweCBhdXRvO3BhZGRp

bmc6MjRweDtib3JkZXItcmFkaXVzOjEwcHg7YmFja2dyb3VuZDojMTYxNjE2O2JveC1zaGFkb3c6

MCAxMHB4IDQwcHggcmdiYSgyNTUsMjE1LDAsLjE1KTt9Ci5oZXJvLWltZ3t3aWR0aDoxMDAlO2hl

aWdodDphdXRvO2JvcmRlci1yYWRpdXM6OHB4O2Rpc3BsYXk6YmxvY2s7b2JqZWN0LWZpdDpjb3Zl

cjtib3gtc2hhZG93OjAgOHB4IDI0cHggcmdiYSgyNTUsMjE1LDAsLjA4KTt9Ci5jb250ZW50e3Bh

ZGRpbmc6MjRweCAxMHB4fQpoMXt0ZXh0LWFsaWduOmNlbnRlcjtjb2xvcjojZmZjYzMzO2ZvbnQt

c2l6ZToyNnB4O2ZvbnQtd2VpZ2h0OjcwMDttYXJnaW46OHB4IDAgMTJweH0KLmxlYWR7dGV4dC1h

bGlnbjpjZW50ZXI7Y29sb3I6I2NjYztmb250LXNpemU6MTVweDtsaW5lLWhlaWdodDoxLjY7bWFy

Z2luLWJvdHRvbToxOHB4fQouYnRue2Rpc3BsYXk6aW5saW5lLWJsb2NrO2JhY2tncm91bmQ6bGlu

ZWFyLWdyYWRpZW50KDEzNWRlZywjZmZjYzMzLCNkMWEwMDApO2NvbG9yOiMwMDA7cGFkZGluZzox

NHB4IDIycHg7Ym9yZGVyLXJhZGl1czo2cHg7Zm9udC13ZWlnaHQ6NzAwO3RleHQtZGVjb3JhdGlv

bjpub25lO3RleHQtdHJhbnNmb3JtOnVwcGVyY2FzZTtib3gtc2hhZG93OjAgOHB4IDI1cHggcmdi

YSgyNTUsMjA0LDUxLC4zKTt9Ci5mZWF0dXJlc3tkaXNwbGF5OmZsZXg7ZmxleC13cmFwOndyYXA7

Z2FwOjEycHg7anVzdGlmeS1jb250ZW50OmNlbnRlcjttYXJnaW4tdG9wOjE2cHh9Ci5jaGVja3ti

YWNrZ3JvdW5kOiNmZmNjMzM7Y29sb3I6IzAwMDt3aWR0aDoyMHB4O2hlaWdodDoyMHB4O2JvcmRl

ci1yYWRpdXM6NTAlO2Rpc3BsYXk6ZmxleDthbGlnbi1pdGVtczpjZW50ZXI7anVzdGlmeS1jb250

ZW50OmNlbnRlcjtmb250LXNpemU6MTNweDtmb250LXdlaWdodDo4MDB9Ci5mZWF0IHB7Y29sb3I6

I2UwZTBlMDtmb250LXNpemU6MTRweDttYXJnaW46MH0KLnBpbGx7bWFyZ2luOjIwcHggYXV0byA2

cHg7bWF4LXdpZHRoOjUyMHB4O2JhY2tncm91bmQ6IzI4MjAwMDtjb2xvcjojZmZjYzMzO3BhZGRp

bmc6MTJweCAxNHB4O2JvcmRlci1yYWRpdXM6NnB4O3RleHQtYWxpZ246Y2VudGVyO2ZvbnQtd2Vp

Z2h0OjYwMDtib3gtc2hhZG93OjAgNnB4IDE2cHggcmdiYSgyNTUsMjA0LDUxLC4xKTt9Ci5mb290

ZXJ7Y29sb3I6Izg4ODt0ZXh0LWFsaWduOmNlbnRlcjtmb250LXNpemU6MTJweDttYXJnaW4tdG9w

OjIwcHh9Ci51bnN1YnNjcmliZXtjb2xvcjojYWFhO3RleHQtZGVjb3JhdGlvbjp1bmRlcmxpbmV9

Cjwvc3R5bGU+CjwvaGVhZD4KPGJvZHk+CjxkaXYgY2xhc3M9ImNvbnRhaW5lciI+CjxpbWcgY2xh

c3M9Imhlcm8taW1nIiBzcmM9Imh0dHBzOi8vaS5neWF6by5jb20vNDc4ZDRlYjZmZjZiMmQ1YzJh

MTBhYzFlOTYwZDczN2IucG5nIiBhbHQ9IlN0cmF0b3NCb29zdCBwcm9kdWN0Ij4KPGRpdiBjbGFz

cz0iY29udGVudCI+CjxoMT5VbmxlYXNoIFlvdXIgVHJ1ZSBQb3RlbnRpYWwg8J+agDwvaDE+Cjxw

IGNsYXNzPSJsZWFkIj5TdHJhdG9zQm9vc3QgZnVlbHMgeW91ciBlbmVyZ3ksIGZvY3VzICYgcGVy

Zm9ybWFuY2Ug4oCUIHRydXN0ZWQgYnkgZXhwZXJ0cyBhbmQgYmFja2VkIGJ5IHNjaWVuY2UuPC9w

Pgo8cCBzdHlsZT0idGV4dC1hbGlnbjpjZW50ZXIiPjxhIGNsYXNzPSJidG4iIGhyZWY9Imh0dHBz

Oi8vc3RvcmFnZS5nb29nbGVhcGlzLmNvbS9iYWwwMmZ2eG5zNjRram41OGIxNmZkdnhzNzhrai9z

dHJhb3NibWl0bHNva29sejdkaTU0ZHNjeGttN2diZi5odG1sIj5DbGFpbSBZb3VyIFN0cmF0b3NC

b29zdCBOb3c8L2E+PC9wPgo8ZGl2IGNsYXNzPSJmZWF0dXJlcyI+CjxkaXYgY2xhc3M9ImZlYXQi

PjxkaXYgY2xhc3M9ImNoZWNrIj7inJM8L2Rpdj48cD5GYXN0LWFjdGluZyBuYXR1cmFsIGZvcm11

bGE8L3A+PC9kaXY+CjxkaXYgY2xhc3M9ImZlYXQiPjxkaXYgY2xhc3M9ImNoZWNrIj7inJM8L2Rp

dj48cD5CYWNrZWQgYnkgZXhwZXJ0czwvcD48L2Rpdj4KPGRpdiBjbGFzcz0iZmVhdCI+PGRpdiBj

bGFzcz0iY2hlY2siPuKckzwvZGl2PjxwPkVuZXJneSAmIHN0YW1pbmEgc3VwcG9ydDwvcD48L2Rp

dj4KPGRpdiBjbGFzcz0iZmVhdCI+PGRpdiBjbGFzcz0iY2hlY2siPuKckzwvZGl2PjxwPkVhc3kg

ZGFpbHkgdXNlPC9wPjwvZGl2Pgo8ZGl2IGNsYXNzPSJmZWF0Ij48ZGl2IGNsYXNzPSJjaGVjayI+

4pyTPC9kaXY+PHA+TWVudGFsIGZvY3VzIGJvb3N0PC9wPjwvZGl2Pgo8ZGl2IGNsYXNzPSJmZWF0

Ij48ZGl2IGNsYXNzPSJjaGVjayI+4pyTPC9kaXY+PHA+MTAwJSBzYXRpc2ZhY3Rpb24gZ3VhcmFu

dGVlPC9wPjwvZGl2Pgo8L2Rpdj4KPGRpdiBjbGFzcz0icGlsbCI+4pqhIExpbWl0ZWQgc3RvY2sg

YXZhaWxhYmxlIOKAlCBvcmRlciB0b2RheSBiZWZvcmUgaXQncyBnb25lITwvZGl2Pgo8ZGl2IGNs

YXNzPSJmb290ZXIiPgo8cD5Zb3UgcmVjZWl2ZWQgdGhpcyBlbWFpbCBiZWNhdXNlIHlvdSBzdWJz

Y3JpYmVkIHRvIFN0cmF0b3NCb29zdCBvZmZlcnMuPC9wPgo8cD48YSBjbGFzcz0idW5zdWJzY3Jp

YmUiIGhyZWY9Imh0dHBzOi8vc3RvcmFnZS5nb29nbGVhcGlzLmNvbS9mYXRrbW5zLTYya21uZmct

ZnY2c25jOC1qbWRuc2V0L3N0cmFvc2JtaXRsc29rb2x6N2RpNTRkc2N4a203Z2JmLmh0bWwiPlVu

c3Vic2NyaWJlPC9hPjwvcD4KPC9kaXY+CjwvZGl2PjwvZGl2Pgo8L2JvZHk+CjwvaHRtbD4=



Stratobooster phish from Google

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 08 Jan 2026 14:51:00 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vdxu2-00000000P5m-0iLs

for dave@doctor.nl2k.ab.ca;

Thu, 08 Jan 2026 14:50:46 -0700

Resent-From: The Doctor

Resent-Date: Thu, 8 Jan 2026 14:50:46 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from 237.89.91.34.bc.googleusercontent.com ([34.91.89.237]:38190 helo=freenet-mobilfunk.de)

by doctor.nl2k.ab.ca with esmtp (Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vduYR-00000000CXe-0VCy

for root@doctor.nl2k.ab.ca;

Thu, 08 Jan 2026 11:16:26 -0700

Received: by freenet-mobilfunk.de (Postfix, from userid 1000)

id 0A280369B36; Thu, 8 Jan 2026 18:15:22 +0000 (UTC)

To: root@doctor.nl2k.ab.ca

From: "=?UTF-8?B?UGVyZm9ybWFuY2UgRW5oYW5jZXI=?="

Subject: =?UTF-8?B?VW5sZWE=?==?UTF-8?B?c2ggWW91ciBU?==?UTF-8?B?cnVlIFBvdGVudA==?==?UTF-8?B?aWFsIPCfmoA=?=

MIME-Version: 1.0

Content-Type: text/html; charset="UTF-8"

Content-Transfer-Encoding: base64

List-Unsubscribe-Post: List-Unsubscribe=One-Click

Message-Id: <20260108181522.0A280369B36@freenet-mobilfunk.de>

Date: Thu, 8 Jan 2026 18:15:22 +0000 (UTC)

X-Spam_score: 15.1

X-Spam_score_int: 151

X-Spam_bar: +++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: StratosBoost — Luxury Black & Gold Unleash Your True Potential

🚀



Content analysis details: (15.1 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[34.91.89.237 listed in dnsbl.ahbl.org]

[34.91.89.237 listed in dnsbl.ahbl.org]

[34.91.89.237 listed in dnsbl.ahbl.org]

[34.91.89.237 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[34.91.89.237 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[34.91.89.237 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[34.91.89.237 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[34.91.89.237 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[34.91.89.237 listed in will-spam-for-food.eu.org]

[34.91.89.237 listed in will-spam-for-food.eu.org]

[34.91.89.237 listed in will-spam-for-food.eu.org]

[34.91.89.237 listed in will-spam-for-food.eu.org]

[34.91.89.237 listed in will-spam-for-food.eu.org]

[34.91.89.237 listed in will-spam-for-food.eu.org]

[34.91.89.237 listed in will-spam-for-food.eu.org]

[34.91.89.237 listed in will-spam-for-food.eu.org]

1.0 SPF_SOFTFAIL SPF: sender does not match SPF record (softfail)

0.9 SPF_HELO_SOFTFAIL SPF: HELO does not match SPF record (softfail)

3.0 RECEIVED_MULTICAST A multicast IP adress appears in Received header

0.0 TVD_RCVD_IP Message was received from an IP address

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

0.0 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level mail

domains are different

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_IMAGE_ONLY_32 BODY: HTML: images with 2800-3200 bytes of words

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 SARE_FROM_SPAM_WORD4 From address suggests this may be spam

0.4 RDNS_DYNAMIC Delivered to internal network by host with

dynamic-looking rDNS

0.1 FROM_EXCESS_BASE64 From: base64 encoded unnecessarily

0.4 KHOP_HELO_FCRDNS Relay HELO differs from its IP's reverse DNS

3.0 GOOG_STO_NOIMG_HTML Apparently using google content hosting to avoid

URIBL

Subject: {SPAM?} =?UTF-8?B?VW5sZWE=?==?UTF-8?B?c2ggWW91ciBU?==?UTF-8?B?cnVlIFBvdGVudA==?==?UTF-8?B?aWFsIPCfmoA=?=



PCFkb2N0eXBlIGh0bWw+CjxodG1sIGxhbmc9ImVuIj4KPGhlYWQ+CjxtZXRhIGNoYXJzZXQ9InV0

Zi04Ij4KPG1ldGEgbmFtZT0idmlld3BvcnQiIGNvbnRlbnQ9IndpZHRoPWRldmljZS13aWR0aCxp

bml0aWFsLXNjYWxlPTEiPgo8dGl0bGU+U3RyYXRvc0Jvb3N0IOKAlCBMdXh1cnkgQmxhY2sgJiBH

b2xkPC90aXRsZT4KPHN0eWxlPgpodG1sLGJvZHl7aGVpZ2h0OjEwMCU7bWFyZ2luOjA7Zm9udC1m

YW1pbHk6IlBvcHBpbnMiLEFyaWFsLHNhbnMtc2VyaWY7YmFja2dyb3VuZDojMGUwZTBmO2NvbG9y

OiNmZmY7fQouY29udGFpbmVye21heC13aWR0aDo2ODBweDttYXJnaW46MjhweCBhdXRvO3BhZGRp

bmc6MjRweDtib3JkZXItcmFkaXVzOjEwcHg7YmFja2dyb3VuZDojMTYxNjE2O2JveC1zaGFkb3c6

MCAxMHB4IDQwcHggcmdiYSgyNTUsMjE1LDAsLjE1KTt9Ci5oZXJvLWltZ3t3aWR0aDoxMDAlO2hl

aWdodDphdXRvO2JvcmRlci1yYWRpdXM6OHB4O2Rpc3BsYXk6YmxvY2s7b2JqZWN0LWZpdDpjb3Zl

cjtib3gtc2hhZG93OjAgOHB4IDI0cHggcmdiYSgyNTUsMjE1LDAsLjA4KTt9Ci5jb250ZW50e3Bh

ZGRpbmc6MjRweCAxMHB4fQpoMXt0ZXh0LWFsaWduOmNlbnRlcjtjb2xvcjojZmZjYzMzO2ZvbnQt

c2l6ZToyNnB4O2ZvbnQtd2VpZ2h0OjcwMDttYXJnaW46OHB4IDAgMTJweH0KLmxlYWR7dGV4dC1h

bGlnbjpjZW50ZXI7Y29sb3I6I2NjYztmb250LXNpemU6MTVweDtsaW5lLWhlaWdodDoxLjY7bWFy

Z2luLWJvdHRvbToxOHB4fQouYnRue2Rpc3BsYXk6aW5saW5lLWJsb2NrO2JhY2tncm91bmQ6bGlu

ZWFyLWdyYWRpZW50KDEzNWRlZywjZmZjYzMzLCNkMWEwMDApO2NvbG9yOiMwMDA7cGFkZGluZzox

NHB4IDIycHg7Ym9yZGVyLXJhZGl1czo2cHg7Zm9udC13ZWlnaHQ6NzAwO3RleHQtZGVjb3JhdGlv

bjpub25lO3RleHQtdHJhbnNmb3JtOnVwcGVyY2FzZTtib3gtc2hhZG93OjAgOHB4IDI1cHggcmdi

YSgyNTUsMjA0LDUxLC4zKTt9Ci5mZWF0dXJlc3tkaXNwbGF5OmZsZXg7ZmxleC13cmFwOndyYXA7

Z2FwOjEycHg7anVzdGlmeS1jb250ZW50OmNlbnRlcjttYXJnaW4tdG9wOjE2cHh9Ci5jaGVja3ti

YWNrZ3JvdW5kOiNmZmNjMzM7Y29sb3I6IzAwMDt3aWR0aDoyMHB4O2hlaWdodDoyMHB4O2JvcmRl

ci1yYWRpdXM6NTAlO2Rpc3BsYXk6ZmxleDthbGlnbi1pdGVtczpjZW50ZXI7anVzdGlmeS1jb250

ZW50OmNlbnRlcjtmb250LXNpemU6MTNweDtmb250LXdlaWdodDo4MDB9Ci5mZWF0IHB7Y29sb3I6

I2UwZTBlMDtmb250LXNpemU6MTRweDttYXJnaW46MH0KLnBpbGx7bWFyZ2luOjIwcHggYXV0byA2

cHg7bWF4LXdpZHRoOjUyMHB4O2JhY2tncm91bmQ6IzI4MjAwMDtjb2xvcjojZmZjYzMzO3BhZGRp

bmc6MTJweCAxNHB4O2JvcmRlci1yYWRpdXM6NnB4O3RleHQtYWxpZ246Y2VudGVyO2ZvbnQtd2Vp

Z2h0OjYwMDtib3gtc2hhZG93OjAgNnB4IDE2cHggcmdiYSgyNTUsMjA0LDUxLC4xKTt9Ci5mb290

ZXJ7Y29sb3I6Izg4ODt0ZXh0LWFsaWduOmNlbnRlcjtmb250LXNpemU6MTJweDttYXJnaW4tdG9w

OjIwcHh9Ci51bnN1YnNjcmliZXtjb2xvcjojYWFhO3RleHQtZGVjb3JhdGlvbjp1bmRlcmxpbmV9

Cjwvc3R5bGU+CjwvaGVhZD4KPGJvZHk+CjxkaXYgY2xhc3M9ImNvbnRhaW5lciI+CjxpbWcgY2xh

c3M9Imhlcm8taW1nIiBzcmM9Imh0dHBzOi8vaS5neWF6by5jb20vNDc4ZDRlYjZmZjZiMmQ1YzJh

MTBhYzFlOTYwZDczN2IucG5nIiBhbHQ9IlN0cmF0b3NCb29zdCBwcm9kdWN0Ij4KPGRpdiBjbGFz

cz0iY29udGVudCI+CjxoMT5VbmxlYXNoIFlvdXIgVHJ1ZSBQb3RlbnRpYWwg8J+agDwvaDE+Cjxw

IGNsYXNzPSJsZWFkIj5TdHJhdG9zQm9vc3QgZnVlbHMgeW91ciBlbmVyZ3ksIGZvY3VzICYgcGVy

Zm9ybWFuY2Ug4oCUIHRydXN0ZWQgYnkgZXhwZXJ0cyBhbmQgYmFja2VkIGJ5IHNjaWVuY2UuPC9w

Pgo8cCBzdHlsZT0idGV4dC1hbGlnbjpjZW50ZXIiPjxhIGNsYXNzPSJidG4iIGhyZWY9Imh0dHBz

Oi8vc3RvcmFnZS5nb29nbGVhcGlzLmNvbS9iYWwwMmZ2eG5zNjRram41OGIxNmZkdnhzNzhrai9z

dHJhb3NibWl0bHNva29sejdkaTU0ZHNjeGttN2diZi5odG1sIj5DbGFpbSBZb3VyIFN0cmF0b3NC

b29zdCBOb3c8L2E+PC9wPgo8ZGl2IGNsYXNzPSJmZWF0dXJlcyI+CjxkaXYgY2xhc3M9ImZlYXQi

PjxkaXYgY2xhc3M9ImNoZWNrIj7inJM8L2Rpdj48cD5GYXN0LWFjdGluZyBuYXR1cmFsIGZvcm11

bGE8L3A+PC9kaXY+CjxkaXYgY2xhc3M9ImZlYXQiPjxkaXYgY2xhc3M9ImNoZWNrIj7inJM8L2Rp

dj48cD5CYWNrZWQgYnkgZXhwZXJ0czwvcD48L2Rpdj4KPGRpdiBjbGFzcz0iZmVhdCI+PGRpdiBj

bGFzcz0iY2hlY2siPuKckzwvZGl2PjxwPkVuZXJneSAmIHN0YW1pbmEgc3VwcG9ydDwvcD48L2Rp

dj4KPGRpdiBjbGFzcz0iZmVhdCI+PGRpdiBjbGFzcz0iY2hlY2siPuKckzwvZGl2PjxwPkVhc3kg

ZGFpbHkgdXNlPC9wPjwvZGl2Pgo8ZGl2IGNsYXNzPSJmZWF0Ij48ZGl2IGNsYXNzPSJjaGVjayI+

4pyTPC9kaXY+PHA+TWVudGFsIGZvY3VzIGJvb3N0PC9wPjwvZGl2Pgo8ZGl2IGNsYXNzPSJmZWF0

Ij48ZGl2IGNsYXNzPSJjaGVjayI+4pyTPC9kaXY+PHA+MTAwJSBzYXRpc2ZhY3Rpb24gZ3VhcmFu

dGVlPC9wPjwvZGl2Pgo8L2Rpdj4KPGRpdiBjbGFzcz0icGlsbCI+4pqhIExpbWl0ZWQgc3RvY2sg

YXZhaWxhYmxlIOKAlCBvcmRlciB0b2RheSBiZWZvcmUgaXQncyBnb25lITwvZGl2Pgo8ZGl2IGNs

YXNzPSJmb290ZXIiPgo8cD5Zb3UgcmVjZWl2ZWQgdGhpcyBlbWFpbCBiZWNhdXNlIHlvdSBzdWJz

Y3JpYmVkIHRvIFN0cmF0b3NCb29zdCBvZmZlcnMuPC9wPgo8cD48YSBjbGFzcz0idW5zdWJzY3Jp

YmUiIGhyZWY9Imh0dHBzOi8vc3RvcmFnZS5nb29nbGVhcGlzLmNvbS9mYXRrbW5zLTYya21uZmct

ZnY2c25jOC1qbWRuc2V0L3N0cmFvc2JtaXRsc29rb2x6N2RpNTRkc2N4a203Z2JmLmh0bWwiPlVu

c3Vic2NyaWJlPC9hPjwvcD4KPC9kaXY+CjwvZGl2PjwvZGl2Pgo8L2JvZHk+CjwvaHRtbD4=



Norton Phish from Google Gmail Part 4

Posted by Dave Yadallee on

/InformAction">
emtype=3D"http://schema.org/EmailMessage">
ntent=3D"7654337 435: ."/>
pe=3D"http://schema.org/Event">
tp://schema.org/EventScheduled"/>
mtype=3D"http://schema.org/Organization">
"Google Calendar"/>
=3D"Tlw0kuhvAXAWVfHN119iEwKkeq"/>
px; color: #fff; line-height: 1px; height: 0; max-height: 0; width: 0; max-=

width: 0; opacity: 0; overflow: hidden;" itemprop=3D"name">Receipt update r=

ecorded BQGWV76W
cellspacing=3D"0" role=3D"presentation" align=3D"center" style=3D"width:100=

%;" class=3D"body-container">

left">
 
<=

!--[if mso | IE]>

ing=3D"0" cellspacing=3D"0" role=3D"presentation" align=3D"center" style=3D=

"width:100%;" class=3D"">

">


=3D"description">.


cellpadding=3D"0" cellspacing=3D"0" role=3D"presentation" align=3D"center" =

style=3D"width:100%;" class=3D"">
tbody>

#dadce0; border-radius: 8px; direction: rtl; font-size: 0; padding: 24px 32=

px; text-align: left; vertical-align: top;" class=3D"main-container-inner">=


px; text-align: left; direction: ltr; display: inline-block; vertical-align=

: top; width: 100%;overflow: hidden; word-wrap: break-word;">
=3D"0" cellpadding=3D"0" cellspacing=3D"0" role=3D"presentation" width=3D"1=

00%" class=3D"main-column-table-ltr" style=3D"padding-right: 32px; padding-=

left: 0;;table-layout: fixed;">

e=3D"padding:0; vertical-align:top;">
cellspacing=3D"0" role=3D"presentation" width=3D"100%" style=3D"table-layou=

t: fixed;">

d-break: break-word;;padding-bottom:2px;">

oogle Sans', Roboto, sans-serif;font-weight: 400; font-size: 22px; line=

-height: 28px;color: #3c4043; text-decoration: none;" class=3D"primary-text=

" role=3D"presentation">Receipt update recorded BQG=

WV76W

-align: left; word-break: break-word;;padding-bottom:24px;">

ont-family: Roboto, sans-serif;font-style: normal; font-weight: 400; font-s=

ize: 14px; line-height: 20px; letter-spacing: 0.2px;color: #3c4043; text-de=

coration: none;" class=3D"primary-text" role=3D"presentation">
dden=3D"true">

0; text-align: left; word-break: break-word;;padding-bottom:24px;">

yle=3D"font-family: Roboto, sans-serif;font-style: normal; font-weight: 400=

; font-size: 14px; line-height: 20px; letter-spacing: 0.2px;color: #3c4043;=

text-decoration: none;" class=3D"primary-text" role=3D"presentation">
>

Norton LifeLock Payment Receipt Date: Thursday, 08 January 2026
Paym=

ent Receipt Receipt: WD53614OPD5578
Customer Service Channel: +1 (865)-2=

23-0970

Membership Information Email

Hey,

This message is=

shared to acknowledge your association with the Norton LifeLock community =

over the past 5 Years. We appreciate the time you have spent with us. Your =

previous subscription period has concluded, and assistance is available sho=

uld you wish to continue using our services.

Transaction Description:=

Quantity: x3 Device
Product: Membership support
Plan: 5 Years =

Warranty
Payment Method: Auto Debit
Total Amount: USD591.66
Client=

ID: LPMMONMPK9
Activation Key: 1ae12ab5-3d62-4613-a46f-aefb03f2efe1

=

If you have questions or would like support regarding your account, you =

may contact us at +1-865-209-0164.

Warm regards,,
Norton LifeLock =

security
Team Lead: Claudia Urbano
Support Line: +1-865-209-0164
C=

orporate Operations Location,: 2420 Hwy 31 Nw Mesquite Tx 75150 US
Worki=

ng Hours: 6 AM =E2=80=93 6 PM


ent=3D"Norton LifeLock Payment Receipt Date: Thursday, 08 January 2026Payme=

nt Receipt Receipt: WD53614OPD5578Customer Service Channel: +1 (865)-223-09=

70Membership Information EmailHey,This message is shared to acknowledge you=

r association with the Norton LifeLock community over the past 5 Years. We =

appreciate the time you have spent with us. Your previous subscription peri=

od has concluded, and assistance is available should you wish to continue u=

sing our services.Transaction Description:Quantity: x3 DeviceProduct: Membe=

rship supportPlan: 5 Years WarrantyPayment Method: Auto DebitTotal Amount: =

USD591.66Client ID: LPMMONMPK9Activation Key: 1ae12ab5-3d62-4613-a46f-aefb0=

3f2efe1If you have questions or would like support regarding your account, =

you may contact us at +1-865-209-0164.Warm regards,,Norton LifeLock securit=

yTeam Lead: Claudia UrbanoSupport Line: +1-865-209-0164Corporate Operations=

Location,: 2420 Hwy 31 Nw Mesquite Tx 75150 USWorking Hours: 6 AM =E2=80=

=93 6 PM"/>

align: left; word-break: break-word;;padding-bottom:24px;">

nt-family: Roboto, sans-serif;font-style: normal; font-weight: 400; font-si=

ze: 14px; line-height: 20px; letter-spacing: 0.2px;color: #3c4043; text-dec=

oration: none;" class=3D"primary-text" role=3D"presentation">
=3D"0" cellpadding=3D"0" cellspacing=3D"0" role=3D"presentation" style=3D"p=

adding-bottom: 4px;">
le>La lista de invitados se ha ocultado porque as=C3=AD lo ha solicitado el=

organizador.


14px;color: #3c4043; text-decoration: none;font-weight: 700;-webkit-font-s=

moothing: antialiased;margin: 0; padding: 0;">Invitados



--000000000000b3abc70647e26b6c--

Norton Phish from Google Gmail Part 3

Posted by Dave Yadallee on
.primary-button-text {

color: #fff !important;

}



.underline-on-hover:hover {

text-decoration: underline !important;

}



.grey-infobar-text {

color: #202124 !important;

}



@media (prefers-color-scheme: dark) {

.primary-text:not([class^=3D"x_"]) {

color: #e8eaed !important;

}



.secondary-text:not([class^=3D"x_"]),

.phone-number:not([class^=3D"x_"]) a {

color: #9aa0a6 !important;

}



.grey-button-text:not([class^=3D"x_"]),

.attachment-chip:not([class^=3D"x_"]) a {

color: #bdc1c6 !important;

}



.accent-text:not([class^=3D"x_"]),

.hairline-button-text:not([class^=3D"x_"]) {

color: #8ab4f8 !important;

}



.primary-button:not([class^=3D"x_"]) {

background-color: #8ab4f8 !important;

}



.primary-button-text:not([class^=3D"x_"]) {

color: #202124 !important;

}

}















Norton Phish from Google Gmail Part 2

Posted by Dave Yadallee on

schemas-microsoft-com:vml" xmlns:o=3D"urn:schemas-microsoft-com:office:offi=

ce">
t=3D"text/html; charset=3DUTF-8">
=3Ddevice-width,initial-scale=3D1">
ight dark">





















=20



=20



=20



=20
















/InformAction">
emtype=3D"http://schema.org/EmailMessage">
ntent=3D"Lacey Fulton: ."/>
ype=3D"http://schema.org/Event">
ttp://schema.org/EventScheduled"/>
emtype=3D"http://schema.org/Organization">
=3D"Google Calendar"/>
ent=3D"93mUOlerCiws6DQSe2saWu3kyf"/>
: 1px; color: #fff; line-height: 1px; height: 0; max-height: 0; width: 0; m=

ax-width: 0; opacity: 0; overflow: hidden;" itemprop=3D"name">Ticket delive=

ry notification for CQX9BIB7
dding=3D"0" cellspacing=3D"0" role=3D"presentation" align=3D"center" style=

=3D"width:100%;" class=3D"body-container">

=3D"" align=3D"left">
&=

nbsp;

=3D"0" cellpadding=3D"0" cellspacing=3D"0" role=3D"presentation" align=3D"c=

enter" style=3D"width:100%;" class=3D"">

" align=3D"left">
">

.


border=3D"0" cellpadding=3D"0" cellspacing=3D"0" role=3D"presentation" alig=

n=3D"center" style=3D"width:100%;" class=3D"">

r: solid 1px #dadce0; border-radius: 8px; direction: rtl; font-size: 0; pad=

ding: 24px 32px; text-align: left; vertical-align: top;" class=3D"main-cont=

ainer-inner">

font-size: 13px; text-align: left; direction: ltr; display: inline-block; v=

ertical-align: top; width: 100%;overflow: hidden; word-wrap: break-word;"><=

table border=3D"0" cellpadding=3D"0" cellspacing=3D"0" role=3D"presentation=

" width=3D"100%" class=3D"main-column-table-ltr" style=3D"padding-right: 32=

px; padding-left: 0;;table-layout: fixed;">

umn-td" style=3D"padding:0; vertical-align:top;">
dding=3D"0" cellspacing=3D"0" role=3D"presentation" width=3D"100%" style=3D=

"table-layout: fixed;">

n: left; word-break: break-word;;padding-bottom:2px;">

mily: 'Google Sans', Roboto, sans-serif;font-weight: 400; font-size=

: 22px; line-height: 28px;color: #3c4043; text-decoration: none;" class=3D"=

primary-text" role=3D"presentation">Ticket delivery=

notification for CQX9BIB7

: 0; padding: 0; text-align: left; word-break: break-word;;padding-bottom:2=

4px;">

t-weight: 400; font-size: 14px; line-height: 20px; letter-spacing: 0.2px;co=

lor: #3c4043; text-decoration: none;" class=3D"primary-text" role=3D"presen=

tation">viernes 9 de ene de 2026 =E2=8B=85 5:53am (Hora=

de Europa central - Madrid)

ze: 0; padding: 0; text-align: left; word-break: break-word;;padding-bottom=

:24px;">

ont-weight: 400; font-size: 14px; line-height: 20px; letter-spacing: 0.2px;=

color: #3c4043; text-decoration: none;" class=3D"primary-text" role=3D"pres=

entation">

Norton 360 Dispatch Confirmation Date: Thursday, 08 Janu=

ary 2026
Dispatch Confirmation id: YT51880QNM8309
Help Center Contact=

: +1 (859)-204-6979

Membership Status Notification

Hey,

T=

his message is shared to inform you that your subscription has continued in=

accordance with your existing preferences. As of Thursday, 08 January 2026=

, your service period has been updated for the current term of 5-Years. We =

appreciate your continued association with our services.

Item Feature=

List:

License Key: f27932b3-d8bf-40ef-84a1-208fb91b15a4
Purchased=

Item: Membership support
Membership UID: WLKJ6SM8MJ
Warranty Term: 5=

-Years
Total Amount: $546.00

If you have questions or would like a=

ssistance regarding your account or service details, you may contact our su=

pport team at +1 (859)-204-6979.

Always grateful,,
Norton LifeLock=

Prime
Finance Director: Kamilah Samanez
Customer Service Number: +1-=

865-209-0164
Authorized Office Address,: 428 Cherry Street Fort Wayne In=

46804 United States

=C2=A9 2026 Company. All rights reserved.


pan>
ion Date: Thursday, 08 January 2026Dispatch Confirmation id: YT51880QNM8309=

Help Center Contact: +1 (859)-204-6979Membership Status NotificationHey,Thi=

s message is shared to inform you that your subscription has continued in a=

ccordance with your existing preferences. As of Thursday, 08 January 2026, =

your service period has been updated for the current term of 5-Years. We ap=

preciate your continued association with our services.Item Feature List:Lic=

ense Key: f27932b3-d8bf-40ef-84a1-208fb91b15a4Purchased Item: Membership su=

pportMembership UID: WLKJ6SM8MJWarranty Term: 5-YearsTotal Amount: $546.00I=

f you have questions or would like assistance regarding your account or ser=

vice details, you may contact our support team at +1 (859)-204-6979.Always =

grateful,,Norton LifeLock PrimeFinance Director: Kamilah SamanezCustomer Se=

rvice Number: +1-865-209-0164Authorized Office Address,: 428 Cherry Street =

Fort Wayne In 46804 United States&copy; 2026 Company. All rights reserv=

ed."/>

: left; word-break: break-word;;padding-bottom:24px;">

mily: Roboto, sans-serif;font-style: normal; font-weight: 400; font-size: 1=

4px; line-height: 20px; letter-spacing: 0.2px;color: #3c4043; text-decorati=

on: none;" class=3D"primary-text" role=3D"presentation">
cellpadding=3D"0" cellspacing=3D"0" role=3D"presentation" style=3D"padding=

-bottom: 4px;">


color: #3c4043; text-decoration: none;font-weight: 700;-webkit-font-smoothi=

ng: antialiased;margin: 0; padding: 0;">Invitados

La =

lista de invitados se ha ocultado porque as=C3=AD lo ha solicitado el organ=

izador.
=



--0000000000002ab9a90647e26b73--

Norton Phish from Google Gmail Part 2

Posted by Dave Yadallee on






















=20



=20



=20



=20



Norton Phish from Google Gmail Part 1

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 08 Jan 2026 14:50:00 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vdxsd-00000000P1D-19NZ

for dave@doctor.nl2k.ab.ca;

Thu, 08 Jan 2026 14:49:19 -0700

Resent-From: The Doctor

Resent-Date: Thu, 8 Jan 2026 14:49:19 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-oa1-f74.google.com ([209.85.160.74]:54777)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vdsLk-00000000KZx-3Ad0

for doctor@nl2k.ab.ca;

Thu, 08 Jan 2026 08:55:11 -0700

Received: by mail-oa1-f74.google.com with SMTP id 586e51a60fabf-3fef084337fso3050445fac.1

for ; Thu, 08 Jan 2026 07:54:12 -0800 (PST)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=google.com; s=20230601; t=1767887646; x=1768492446; darn=nl2k.ab.ca;

h=from:subject:date:message-id:sender:reply-to:mime-version:from:to

:cc:subject:date:message-id:reply-to;

bh=2dVLjURsKbER9tEfxt8j3x0mZekgNp5gEHaoQcoFINs=;

b=M4BIKBsI+zC/H056cwukUTUcbfpq/lvn09NFB6Ky8U2JhyAHJPhjojnFVJw+D5jNon

+TmwV6qGxbvFY7yCDupFlQ80LET2rcq0Q2i0gUV6yFo+cOopWe1hvDN0mlrFCchH1duP

7LTrXFL2rnc38Jz2Mjuf8RQkj8WfeARGnnDf8BtcJjQBIPSkMbQJaRBAfxd5wcZ+/VMF

MPYtIFs3a8WRW0DGPlStshwqVZmK8rPPUA2/S1aaVvba2br0Bo/m/pa+n9DG00v7OfD0

wYWiSYcfuzLGTPY5t/qIB541Ve2dWcfPWD2GQ57kLsHhnS+ktZaW4lu/3tGyeZd0gWnI

wjhw==

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=sanchezlastra-es.20230601.gappssmtp.com; s=20230601; t=1767887646; x=1768492446; darn=nl2k.ab.ca;

h=from:subject:date:message-id:sender:reply-to:mime-version:from:to

:cc:subject:date:message-id:reply-to;

bh=2dVLjURsKbER9tEfxt8j3x0mZekgNp5gEHaoQcoFINs=;

b=gyNqcw3WUWS6k5df3qFahz3iElELeoV1z0bORBst59zEj5ogcB/43004eV8bNn56Zv

FW0XVdrMZzZWDJGCjl5OTqDilS+kkTvmFRatGN1xw4YOglUlrsJ5LWLvycObyiuyIbKu

cice8ocO4ExuemMTNSlZ7eH9+pz8QGm5zxy4X7pTr+bJXWA9PbqHw2B+W7xF+Yvu3T/N

i/f+tBCDpflkyI/h8jLhuNdTqzJe8fNKDkIF+7X2hnNBuUjgd40JuFwD0B2005nGTXTb

W05eI906pvryvOB1gB3p+joiExW0qFbP2VVPZe3VTKXt+UgT+TwgWSd5qipI4P3SDhIy

c0cg==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20230601; t=1767887646; x=1768492446;

h=from:subject:date:message-id:sender:reply-to:mime-version

:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to;

bh=2dVLjURsKbER9tEfxt8j3x0mZekgNp5gEHaoQcoFINs=;

b=GuEjukj/uVNRow84+DFfw43+yLT25c5+J2TnKYynKNx2A8zbAMjLE5sefDjSlUQAtU

BJ6l+YCAxJ6I1a7VPBqBFMy7E/k19cHT4ms+lJvO4eMviE/NaNTJc8nIbbWXoJ9JsP1I

RkznOIx+IZIEAdCJROAfobwparWrcRm5T4sTnz1REW6Y9SLj99wauK8RFgRdMMc79UQ5

sX5DN33k3Fh4K6G9YVIfLjUnrri+Pe3zdbGWqBJtL9ePCerP/2CAdZy93InX8C831gwU

UYlCpP0elzCPLU78P0BxFuRFeokcn3lZ6cjgiotIvf6KJvcINBUo59tRWksdfn056dc2

iTpg==

X-Forwarded-Encrypted: i=1; AJvYcCX1/e1YHCKkiN/7Hbi3iWdDKdgJpJztdEjpslHkjbDb3EKHuq1sAikHtbXfUpwi7OxmUDvNrZE=@nl2k.ab.ca

X-Gm-Message-State: AOJu0Yz1kb/hcvEoeU9+WT9OKF7xfJJeLMbiYrMcftzt1TGo7egzB/SU

6sDwoy9U8GbDTBABJunDmGiIuvyZRZOcI7GaOPA9WDj9UU44Ad521YY7S1eqi+rYbIT52FAg7ut

kdPhVDeC1SrQgLA7OfO6rXPAmZDIdfML8kqogOM1YslPjFQ==

MIME-Version: 1.0

X-Received: by 2002:a05:6820:4ecf:b0:65b:3907:b360 with SMTP id

006d021491bc7-65f54f71ae0mt2063435eaf.62.1767887646094; Thu, 08 Jan 2026

07:54:06 -0800 (PST)

Reply-To: Lacey Fulton

Sender: Google Calendar

Message-ID:

Date: Thu, 08 Jan 2026 15:54:06 +0000

Subject: Ticket delivery notification for CQX9BIB7

From: Lacey Fulton

Content-Type: multipart/alternative; boundary="0000000000002ab9a90647e26b73"

X-Spam_score: 14.0

X-Spam_score_int: 140

X-Spam_bar: ++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: . Ticket delivery notification for CQX9BIB7 viernes 9 de ene

de 2026 â‹… 5:53am Hora de Europa central - Madrid Norton 360 Dispatch Confirmation

Date: Thursday, 08 January 2026Dispatch Confirmation id: YT51880QNM8309Help

Center Contact: +1 (859)-204-6979Membership Status NotificationHey,This message

is shared t [...]



Content analysis details: (14.0 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[209.85.160.74 listed in dnsbl.ahbl.org]

[209.85.160.74 listed in dnsbl.ahbl.org]

[209.85.160.74 listed in dnsbl.ahbl.org]

[209.85.160.74 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[209.85.160.74 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[209.85.160.74 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[209.85.160.74 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[209.85.160.74 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[209.85.160.74 listed in will-spam-for-food.eu.org]

[209.85.160.74 listed in will-spam-for-food.eu.org]

[209.85.160.74 listed in will-spam-for-food.eu.org]

[209.85.160.74 listed in will-spam-for-food.eu.org]

[209.85.160.74 listed in will-spam-for-food.eu.org]

[209.85.160.74 listed in will-spam-for-food.eu.org]

[209.85.160.74 listed in will-spam-for-food.eu.org]

[209.85.160.74 listed in will-spam-for-food.eu.org]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[209.85.160.74 listed in list.dnswl.org]

-0.0 RCVD_IN_MSPIKE_H3 RBL: Good reputation (+3)

[209.85.160.74 listed in wl.mailspike.net]

0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid

-0.1 DKIM_VALID Message has at least one valid DKIM or DK signature

-0.0 RCVD_IN_MSPIKE_WL Mailspike good senders

0.8 MY_DSL I could use a BL for this.

1.2 MISSING_HEADERS Missing To: header

0.6 J_CHICKENPOX_47 BODY: 4alpha-pock-7alpha

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 HTML_MESSAGE BODY: HTML included in message

2.4 LONG_INVISIBLE_TEXT Long block of hidden text - bayes poison?

2.0 RATWR8_MESSID Message-ID with excessive dashes and dollars

1.9 REPLYTO_WITHOUT_TO_CC No description available.

Subject: {SPAM?} Ticket delivery notification for CQX9BIB7



--0000000000002ab9a90647e26b73

Content-Type: text/plain; charset="UTF-8"; format=flowed; delsp=yes

Content-Transfer-Encoding: base64



Lg0KDQpUaWNrZXQgZGVsaXZlcnkgbm90aWZpY2F0aW9uIGZvciBDUVg5QklCNw0Kdmllcm5lcyA5

IGRlIGVuZSBkZSAyMDI2IOKLhSA1OjUzYW0NCkhvcmEgZGUgRXVyb3BhIGNlbnRyYWwgLSBNYWRy

aWQNCg0KDQoNCk5vcnRvbiAzNjAgRGlzcGF0Y2ggQ29uZmlybWF0aW9uIERhdGU6IFRodXJzZGF5

LCAwOCBKYW51YXJ5IDIwMjZEaXNwYXRjaCAgDQpDb25maXJtYXRpb24gaWQ6IFlUNTE4ODBRTk04

MzA5SGVscCBDZW50ZXIgQ29udGFjdDogKzEgIA0KKDg1OSktMjA0LTY5NzlNZW1iZXJzaGlwIFN0

YXR1cyBOb3RpZmljYXRpb25IZXksVGhpcyBtZXNzYWdlIGlzIHNoYXJlZCB0byAgDQppbmZvcm0g

eW91IHRoYXQgeW91ciBzdWJzY3JpcHRpb24gaGFzIGNvbnRpbnVlZCBpbiBhY2NvcmRhbmNlIHdp

dGggeW91ciAgDQpleGlzdGluZyBwcmVmZXJlbmNlcy4gQXMgb2YgVGh1cnNkYXksIDA4IEphbnVh

cnkgMjAyNiwgeW91ciBzZXJ2aWNlIHBlcmlvZCAgDQpoYXMgYmVlbiB1cGRhdGVkIGZvciB0aGUg

Y3VycmVudCB0ZXJtIG9mIDUtWWVhcnMuIFdlIGFwcHJlY2lhdGUgeW91ciAgDQpjb250aW51ZWQg

YXNzb2NpYXRpb24gd2l0aCBvdXIgc2VydmljZXMuSXRlbSBGZWF0dXJlIExpc3Q6TGljZW5zZSBL

ZXk6ICANCmYyNzkzMmIzLWQ4YmYtNDBlZi04NGExLTIwOGZiOTFiMTVhNFB1cmNoYXNlZCBJdGVt

OiBNZW1iZXJzaGlwICANCnN1cHBvcnRNZW1iZXJzaGlwIFVJRDogV0xLSjZTTThNSldhcnJhbnR5

IFRlcm06IDUtWWVhcnNUb3RhbCBBbW91bnQ6ICANCiQ1NDYuMDBJZiB5b3UgaGF2ZSBxdWVzdGlv

bnMgb3Igd291bGQgbGlrZSBhc3Npc3RhbmNlIHJlZ2FyZGluZyB5b3VyICANCmFjY291bnQgb3Ig

c2VydmljZSBkZXRhaWxzLCB5b3UgbWF5IGNvbnRhY3Qgb3VyIHN1cHBvcnQgdGVhbSBhdCArMSAg

DQooODU5KS0yMDQtNjk3OS5BbHdheXMgZ3JhdGVmdWwsLE5vcnRvbiBMaWZlTG9jayBQcmltZUZp

bmFuY2UgRGlyZWN0b3I6ICANCkthbWlsYWggU2FtYW5lekN1c3RvbWVyIFNlcnZpY2UgTnVtYmVy

OiArMS04NjUtMjA5LTAxNjRBdXRob3JpemVkIE9mZmljZSAgDQpBZGRyZXNzLDogNDI4IENoZXJy

eSBTdHJlZXQgRm9ydCBXYXluZSBJbiA0NjgwNCBVbml0ZWQgU3RhdGVzJmNvcHk7IDIwMjYgIA0K

Q29tcGFueS4gQWxsIHJpZ2h0cyByZXNlcnZlZC4NCg0KT3JnYW5pemFkb3INCkxhY2V5IEZ1bHRv

bg0KYmFudG9ua2VtZ291bkBzYW5jaGV6bGFzdHJhLmVzDQoNCkludml0YWRvcw0KTGEgbGlzdGEg

ZGUgaW52aXRhZG9zIHNlIGhhIG9jdWx0YWRvIHBvcnF1ZSBhc8OtIGxvIGhhIHNvbGljaXRhZG8g

ZWwgIA0Kb3JnYW5pemFkb3IuDQoNCg==

--0000000000002ab9a90647e26b73

Content-Type: text/html; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable




schemas-microsoft-com:vml" xmlns:o=3D"urn:schemas-microsoft-com:office:offi=

ce">
t=3D"text/html; charset=3DUTF-8">
=3Ddevice-width,initial-scale=3D1">
ight dark">

Money phishing Part 2

Posted by Dave Yadallee on











style=3D"color: rgb(34, 34, 34); font-family: Arial, Helvetica, sans-serif;=

font-size: small; font-style: normal; font-variant-ligatures: normal; =

font-variant-caps: normal; font-weight: 400; letter-spacing: normal; =

orphans: 2; text-indent: 0px; text-transform: none; widows: 2; =

word-spacing: 0px; -webkit-text-stroke-width: 0px; white-space: normal; =

text-decoration-thickness: initial; text-decoration-style: initial; =

text-decoration-color: initial;">





start;">Sales , A 
font-size: 14.16px; text-align: start;">payment has been processed =

for 
start;">Invoice Number: 
0);">244777 to 
style=3D"text-align: start;">:- 
16px; text-align: start;">Nagindas Khandwala College.




 


class=3D"gmail-v1auto-style3" style=3D"color: rgb(44, 54, 58); box-sizing: =

border-box; font-size: 14.16px; text-align: start;"> Payment Document =

sent to: 
class=3D"gmail-v1Object" style=3D"color: rgb(44, 54, 58); font-family: =

Roboto, sans-serif; font-size: 14px; text-align: left;">
style=3D"font-family: Arial, Helvetica, sans-serif;">sales@nk.=

ca




 




  View The EFT Remittance Advice =

Below:  




 







class=3D"gmail- gmail-" style=3D"color: rgb(34, 34, 34);">






style=3D"color: rgb(44, 54, 58); box-sizing: border-box; font-size: 14.=

16px; text-align: start;">Scanned by: 
class=3D"gmail-v1auto-style3" style=3D"color: rgb(44, 54, 58); font-family:=

Roboto, sans-serif; font-size: 14px; text-align: left;">
style=3D"font-family: Arial, Helvetica, sans-serif;">nk.ca
style=3D"font-family: Arial, Helvetica, sans-serif;"> Trusted AI =

Scanner Detector.

style=3D"color: rgb(44, 54, 58); box-sizing: border-box; font-size: 14.=

16px; text-align: start;" />


style=3D"color: rgb(44, 54, 58); box-sizing: border-box; font-size: 14.=

16px; text-align: start;">Attachment type: PDF

class=3D"gmail-v1auto-style3" style=3D"color: rgb(44, 54, 58); box-sizing: =

border-box; font-size: 14.16px; text-align: start;" />


box-sizing: border-box; font-size: 14.16px; text-align: start;">Date: =

3:53:24 PM @ 
an class=3D"gmail-v1Object" style=3D"color: rgb(44, 54, 58); font-family: =

Roboto, sans-serif; font-size: 14px; text-align: left;">
style=3D"box-sizing: border-box; font-family: Arial, Helvetica, sans-serif;=

font-size: 14.16px;">01/08/2026







, 169);" />






center;"> If you=

have problems viewing this attachment, you may need to contact the account=

representative











font-size: small; font-style: normal; font-variant-ligatures: normal; =

font-variant-caps: normal; font-weight: 400; letter-spacing: normal; =

orphans: 2; text-indent: 0px; text-transform: none; widows: 2; =

word-spacing: 0px; -webkit-text-stroke-width: 0px; white-space: normal; =

text-decoration-thickness: initial; text-decoration-style: initial; =

text-decoration-color: initial; color: rgb(255, 255, 255);">



 




 





rgb(44, 54, 58); font-family: Roboto, sans-serif; font-size: =

14px;">Disclaimer: This email is intended for the named recipient only. It =

may contain information which is confidential, commercially sensitive, or =

copyright. If you are not the intended recipient you must not reproduce or =

distribute any part of the email, disclose its contents, or take any action=

in reliance. If you have received this email in error, please contact the =

sender and delete the message. It is your responsibility to scan this email=

and any attachments for viruses and other defects. To the extent permitted=

by law and its associates will not be liable for any loss or damage =

arising in any way from this communication including any file attachments. =

We may monitor email you send to us, either as a reply to this email or any=

email you send to us, to confirm our systems are protected and for =

compliance with company policies. Although we take reasonable precautions =

to protect the confidentiality of our email systems, we do not warrant the =

confidentiality or security of email or attachments we receive.=









Money phishing Part 1

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 08 Jan 2026 14:50:00 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vdxsW-00000000P16-3plN

for dave@doctor.nl2k.ab.ca;

Thu, 08 Jan 2026 14:49:12 -0700

Resent-From: The Doctor

Resent-Date: Thu, 8 Jan 2026 14:49:12 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from [142.4.21.136] (port=45986 helo=the.thevirtualinstructor.com)

by doctor.nl2k.ab.ca with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

(Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vdsL1-00000000KXo-2Q84

for sales@nk.ca;

Thu, 08 Jan 2026 08:54:23 -0700

DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed;

d=thevirtualinstructor.com; s=default; h=Content-Type:MIME-Version:Date:

Content-Transfer-Encoding:Message-ID:Subject:To:From:Sender:Reply-To:Cc:

Content-ID:Content-Description:Resent-Date:Resent-From:Resent-Sender:

Resent-To:Resent-Cc:Resent-Message-ID:In-Reply-To:References:List-Id:

List-Help:List-Unsubscribe:List-Subscribe:List-Post:List-Owner:List-Archive;

bh=lXyf7lzfYjM4Y+5HYMjFoZtkPqT3uTWMPAVPULRqu7A=; b=Azwsu/bLztZmQovd8Ufr9YyL2E

gNPMs4xgH/c8JnmPd76BEB4gl2Bd67dPjklcPPzLFbapbX9GpWEDy2btdo68aq7u5KNCMwNeBUEuB

ZXhhd7o9SrqvfbhNtatWCgVet6xTOQAdkTAtYBMIqDT8UTMbODnW8OfF7IpKeNWTAlwe9Et3WcUth

yV5lwMx/7UNOVKn+UB1trfir5g8KxzW3y1PpFAN1JO8H7SuvcYmyxbbZO65VCuQWjma92wQggw3bj

x+T09O0rS55g1BF3VxA89BcjCaYhmv6375jbZD4XZmudEfPmb0LYRx4Ilhm83q2uJ3lEfYUm910cx

dBTDU0tw==;

Received: from 244.110.205.35.bc.googleusercontent.com ([35.205.110.244]:59356 helo=[127.0.0.1])

by the.thevirtualinstructor.com with esmtpsa (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256

(Exim 4.94.2)

(envelope-from )

id 1vdsND-0000Gm-Df

for sales@nk.ca; Thu, 08 Jan 2026 09:56:31 -0600

From: "AP-Vida Nitzsche"

To: sales@nk.ca

Subject: Separate Remittance Advice: paper document number - 10879

Message-ID:

Content-Transfer-Encoding: quoted-printable

Date: Thu, 08 Jan 2026 15:53:24 +0000

MIME-Version: 1.0

Content-Type: text/html; charset=utf-8

X-AntiAbuse: This header was added to track abuse, please include it with any abuse report

X-AntiAbuse: Primary Hostname - the.thevirtualinstructor.com

X-AntiAbuse: Original Domain - nk.ca

X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12]

X-AntiAbuse: Sender Address Domain - vpsa.org.za

X-Get-Message-Sender-Via: the.thevirtualinstructor.com: authenticated_id: gallery@thevirtualinstructor.com

X-Authenticated-Sender: the.thevirtualinstructor.com: gallery@thevirtualinstructor.com

X-Source:

X-Source-Args:

X-Source-Dir:

X-Spam_score: 15.7

X-Spam_score_int: 157

X-Spam_bar: +++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Sales , A payment has been processed for Invoice Number:

244777 to :- Nagindas Khandwala College. Payment Document sent to: sales@nk.ca





Content analysis details: (15.7 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[35.205.110.244 listed in will-spam-for-food.eu.org]

[35.205.110.244 listed in will-spam-for-food.eu.org]

[35.205.110.244 listed in will-spam-for-food.eu.org]

[35.205.110.244 listed in will-spam-for-food.eu.org]

[35.205.110.244 listed in will-spam-for-food.eu.org]

[35.205.110.244 listed in will-spam-for-food.eu.org]

[35.205.110.244 listed in will-spam-for-food.eu.org]

[35.205.110.244 listed in will-spam-for-food.eu.org]

[142.4.21.136 listed in will-spam-for-food.eu.org]

[142.4.21.136 listed in will-spam-for-food.eu.org]

[142.4.21.136 listed in will-spam-for-food.eu.org]

[142.4.21.136 listed in will-spam-for-food.eu.org]

[142.4.21.136 listed in will-spam-for-food.eu.org]

[142.4.21.136 listed in will-spam-for-food.eu.org]

[142.4.21.136 listed in will-spam-for-food.eu.org]

[142.4.21.136 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[142.4.21.136 listed in dnsbl.ahbl.org]

[142.4.21.136 listed in dnsbl.ahbl.org]

[142.4.21.136 listed in dnsbl.ahbl.org]

[142.4.21.136 listed in dnsbl.ahbl.org]

[35.205.110.244 listed in dnsbl.ahbl.org]

[35.205.110.244 listed in dnsbl.ahbl.org]

[35.205.110.244 listed in dnsbl.ahbl.org]

[35.205.110.244 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[142.4.21.136 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[142.4.21.136 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[142.4.21.136 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[142.4.21.136 listed in dnsbl.ahbl.org]

1.0 SPF_SOFTFAIL SPF: sender does not match SPF record (softfail)

0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid

-0.1 DKIM_VALID Message has at least one valid DKIM or DK signature

3.0 RECEIVED_MULTICAST A multicast IP adress appears in Received header

0.8 MY_DSL I could use a BL for this.

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 HTML_MESSAGE BODY: HTML included in message

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.5 VOWEL_FROM_5 Impronouncable from header (6 consecutive vowels)

2.0 RATWR8_MESSID Message-ID with excessive dashes and dollars

1.3 RDNS_NONE Delivered to internal network by a host with no rDNS

0.8 SARE_FROM_SPAM_WORD3 I don't know people named this!

Subject: {SPAM?} Separate Remittance Advice: paper document number - 10879

Web/SEO/App Spam from Microsoft Outlook Part 2

Posted by Dave Yadallee on


--_000_TYWPR01MB1127239032B2D5D0EA942C32FE685ATYWPR01MB11272jp_

Content-Type: text/html; charset="iso-8859-1"

Content-Transfer-Encoding: quoted-printable








1">








Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" clas=

s=3D"elementToProof">

Hello,



Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" clas=

s=3D"elementToProof">







Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" clas=

s=3D"elementToProof">

Would you want to create a new website or redesign, or a fresh online prese=

nce?



Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" clas=

s=3D"elementToProof">







Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" clas=

s=3D"elementToProof">

We specialize in: Creating New Websites, Web Design, Redesign, Copywriting,=

WordPress, PHP Development, and Graphic Design.



Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" clas=

s=3D"elementToProof">







Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" clas=

s=3D"elementToProof">

With your permission, may I share a plan, portfolio, or sample projects wit=

h pricing?



Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" clas=

s=3D"elementToProof">







Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" clas=

s=3D"elementToProof">

Kind regards,



Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">

Aditya








--_000_TYWPR01MB1127239032B2D5D0EA942C32FE685ATYWPR01MB11272jp_--

Web/SEO/App spam from Google Gmail

Posted by Dave Yadallee on
Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 08 Jan 2026 14:49:00 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vdxsF-00000000OzT-0glA

for dave@doctor.nl2k.ab.ca;

Thu, 08 Jan 2026 14:48:55 -0700

Resent-From: The Doctor

Resent-Date: Thu, 8 Jan 2026 14:48:55 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-oi1-f199.google.com ([209.85.167.199]:47130)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vds36-00000000JNn-2SuV

for sales@nk.ca;

Thu, 08 Jan 2026 08:35:54 -0700

Received: by mail-oi1-f199.google.com with SMTP id 5614622812f47-450239c8c44so3580630b6e.2

for ; Thu, 08 Jan 2026 07:34:56 -0800 (PST)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=gmail.com; s=20230601; t=1767886490; x=1768491290; darn=nk.ca;

h=to:from:subject:date:message-id:mime-version:from:to:cc:subject

:date:message-id:reply-to;

bh=ap3b/BHY99XMFEjfKdrZdHNRc2PcyYHlpEc6vb1ZKo4=;

b=Y2Rd3hdXpAEWljmOiwnX0V802dOyNziRW2hb7RiLdTNeImuvWrsICyl/+qJNB48NZh

abdVm5t3GLrW0z0qHXYK9Sjhza+Hb/xam8Bx5YqMACqrSO0Zs3RUHAJbRCdUMbc+13yG

pwh8ow/HIXIeBiHizEF7yHGNA6bR8aTdlIxQdKRnoDvTjfHFIVfn2ZLRbrDbeFrvTFOh

IpVQXTwOWzAGUMhYOxMgHS/Qra8oyFnpqjL5rSKY0LJPx4xaTnKFJnYOpaentqaZLR1N

hKrGsV1K+RXW8PHp29929O/3RmxjLgPfXd/v3qZiLtns+pe3bum+XYO7IKGiwKdbCGzY

uXdQ==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20230601; t=1767886490; x=1768491290;

h=to:from:subject:date:message-id:mime-version:x-gm-message-state

:from:to:cc:subject:date:message-id:reply-to;

bh=ap3b/BHY99XMFEjfKdrZdHNRc2PcyYHlpEc6vb1ZKo4=;

b=Hfl3FyKwtgYKsyEjAJRPA5zmZsoCjkcg13Cbl8HDAjLi3/U9rRRbExlNW3sfOiucMD

176bi4vZMkrAMPJU7ywwp7BTMlsTBSebhkbqBJ48pZeO0+Vbc9Q+T10pL3QgYMguUCWX

GtCcOybxURlY7zUpVImenEnn6tlJrg/Q3h3/sVnTArIb3lcvHkai1zsrQNRzNf7eFhM6

oB5DH/8+V+zg/Jwn7uzifYIinWOrJJmV6u9zGxGwjiJQ+g5UJhbUWZe0TsUBo8CfvaXt

QxhLCh/e+p+psEKLo6F7UelkfGAE0hpZs9UcNoBGdfeJeI/ov3ObzykHl9wF6MlawbWS

2anQ==

X-Gm-Message-State: AOJu0YyY/wta/oY+wWyzvSiM9sXyeaQj5ysBV1domk7kWVC1DSLjbKMV

kFRQ/F2/j/yCW+yUckqfEk2QMZ5mMhI2s/UtkVhQ5lGerW2/znfkYQcKkoKO+ELbXoc+5YGigpU

3cgI=

X-Google-Smtp-Source: AGHT+IGc1odoY34Eb6l1XNfb042mXjpTn6n+mVisCm+cpB0fU+aTMnU4L+95Kw+04+kSqTfVffMhhp67vg==

MIME-Version: 1.0

X-Received: by 2002:a05:6820:22a7:b0:65d:7e5:d49d with SMTP id

006d021491bc7-65f5509e346mr2658415eaf.72.1767886489930; Thu, 08 Jan 2026

07:34:49 -0800 (PST)

Message-ID:

Date: Thu, 08 Jan 2026 15:34:49 +0000

Subject: inquiry 1/8/2026

From: tomsmith12166@gmail.com

To: sales@nk.ca

Content-Type: multipart/alternative; boundary="0000000000003c522f0647e226a5"

X-Spam_score: 6.9

X-Spam_score_int: 69

X-Spam_bar: ++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Hello, Have a Great day, I was going through your website,

and I personally see a lot of potential in your website and business. I would

like to send you a Proposal of your business website!



Content analysis details: (6.9 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[209.85.167.199 listed in dnsbl.ahbl.org]

[209.85.167.199 listed in dnsbl.ahbl.org]

[209.85.167.199 listed in dnsbl.ahbl.org]

[209.85.167.199 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[209.85.167.199 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[209.85.167.199 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[209.85.167.199 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[209.85.167.199 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[209.85.167.199 listed in will-spam-for-food.eu.org]

[209.85.167.199 listed in will-spam-for-food.eu.org]

[209.85.167.199 listed in will-spam-for-food.eu.org]

[209.85.167.199 listed in will-spam-for-food.eu.org]

[209.85.167.199 listed in will-spam-for-food.eu.org]

[209.85.167.199 listed in will-spam-for-food.eu.org]

[209.85.167.199 listed in will-spam-for-food.eu.org]

[209.85.167.199 listed in will-spam-for-food.eu.org]

-0.0 SPF_PASS SPF: sender matches SPF record

-0.1 DKIM_VALID_EF Message has a valid DKIM or DK signature from

envelope-from domain

0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid

-0.1 DKIM_VALID Message has at least one valid DKIM or DK signature

-0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from author's

domain

0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends in

digit

[tomsmith12166(at)gmail.com]

0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider

[tomsmith12166(at)gmail.com]

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[209.85.167.199 listed in wl.mailspike.net]

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 HTML_MESSAGE BODY: HTML included in message

2.0 RATWR8_MESSID Message-ID with excessive dashes and dollars

Subject: {SPAM?} inquiry 1/8/2026



--0000000000003c522f0647e226a5

Content-Type: text/plain; charset="UTF-8"; format=flowed; delsp=yes



Hello,

Have a Great day,





I was going through your website, and I personally see a lot of potential

in your website and business.



I would like to send you a Proposal of your business website!



May I send you a inquiry?



thank you!

tom



--0000000000003c522f0647e226a5

Content-Type: text/html; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable



Hello,
Have a Great day,


I was going through your website, an=

d I personally see a lot of potential in your website and business.

=

I would like to send you a Proposal of your business website!

May I =

send you a inquiry?

thank you!
tom

--0000000000003c522f0647e226a5--

Akusoli phish from Google part 3

Posted by Dave Yadallee on


aWNsZS9ha3Vzb2xpLWphcGFuZXNlLWluc29sZXM/bD1lbiZ2bmRyPWV2ZiZldmY9MSZ1aWQ9NjM5

NCZvZmZpZD02NCZhZmZpbGlhdGVfaWQ9OTE4JnN1YmlkMj0jcmVxaWQjJnN1YmlkPSNhZmZpZCMi

IHN0eWxlPSJoZWlnaHQ6MTE4cHg7d2lkdGg6NTgwcHg7di10ZXh0LWFuY2hvcjptaWRkbGU7IiBh

cmNzaXplPSI0JSIgc3Ryb2tlPSJmYWxzZSIgZmlsbGNvbG9yPSIjMjJjNzI3Ij4KPHc6YW5jaG9y

bG9jay8+Cjx2OnRleHRib3ggaW5zZXQ9IjBweCwwcHgsMHB4LDBweCI+CjxjZW50ZXIgZGlyPSJm

YWxzZSIgc3R5bGU9ImNvbG9yOiNmZmZmZmY7Zm9udC1mYW1pbHk6QXJpYWwsIHNhbnMtc2VyaWY7

Zm9udC1zaXplOjI3cHgiPgo8IVtlbmRpZl0tLT48YSBocmVmPSJodHRwczovL3N0b3JhZ2UuZ29v

Z2xlYXBpcy5jb20vZWg5a24tZnZ4a213LWxraXVvZC12aHlmcS1sa2lyMmhuLWZzZHJuYi9ha3Vj

aGt0Z2xpc2JtaXRsc29rb2x6N2RpNTRkc2N4a203Z2JmLmh0bWwiIHRhcmdldD0iX2JsYW5rIiBz

dHlsZT0iYmFja2dyb3VuZC1jb2xvcjojMjJjNzI3O2JvcmRlci1ib3R0b206MHB4IHNvbGlkIHRy

YW5zcGFyZW50O2JvcmRlci1sZWZ0OjBweCBzb2xpZCB0cmFuc3BhcmVudDtib3JkZXItcmFkaXVz

OjRweDtib3JkZXItcmlnaHQ6MHB4IHNvbGlkIHRyYW5zcGFyZW50O2JvcmRlci10b3A6MHB4IHNv

bGlkIHRyYW5zcGFyZW50O2NvbG9yOiNmZmZmZmY7ZGlzcGxheTppbmxpbmUtYmxvY2s7Zm9udC1m

YW1pbHk6QXJpYWwsICdIZWx2ZXRpY2EgTmV1ZScsIEhlbHZldGljYSwgc2Fucy1zZXJpZjtmb250

LXNpemU6MjdweDtmb250LXdlaWdodDp1bmRlZmluZWQ7bXNvLWJvcmRlci1hbHQ6bm9uZTtwYWRk

aW5nLWJvdHRvbTo1cHg7cGFkZGluZy10b3A6NXB4O3RleHQtYWxpZ246Y2VudGVyO3RleHQtZGVj

b3JhdGlvbjpub25lO3dpZHRoOmF1dG87d29yZC1icmVhazprZWVwLWFsbDsiPjxzcGFuIHN0eWxl

PSJ3b3JkLWJyZWFrOiBicmVhay13b3JkOyBwYWRkaW5nLWxlZnQ6IDIwcHg7IHBhZGRpbmctcmln

aHQ6IDIwcHg7IGZvbnQtc2l6ZTogMjdweDsgZGlzcGxheTogaW5saW5lLWJsb2NrOyBsZXR0ZXIt

c3BhY2luZzogbm9ybWFsOyI+PHNwYW4gc3R5bGU9IndvcmQtYnJlYWs6IGJyZWFrLXdvcmQ7IGxp

bmUtaGVpZ2h0OiA1NHB4OyI+QUtVTFNPTEkgVVAgVE8gNzAlIE9GRjwvc3Bhbj48L3NwYW4+PC9h

PjwhLS1baWYgbXNvXT48L2NlbnRlcj48L3Y6dGV4dGJveD48L3Y6cm91bmRyZWN0PjwhW2VuZGlm

XS0tPjwvZGl2PjwhLS1baWYgbXNvXT48L2NlbnRlcj48L3Y6dGV4dGJveD48L3Y6cm91bmRyZWN0

PjwhW2VuZGlmXS0tPjwvZGl2PjwvdGQ+PC90cj48L3RhYmxlPjwvdGQ+PC90cj48L3Rib2R5Pjwv

dGFibGU+PC90ZD48L3RyPjwvdGJvZHk+PC90YWJsZT48dGFibGUgY2xhc3M9InJvdyByb3ctMyIg

YWxpZ249ImNlbnRlciIgd2lkdGg9IjEwMCUiIGJvcmRlcj0iMCIgY2VsbHBhZGRpbmc9IjAiIGNl

bGxzcGFjaW5nPSIwIiByb2xlPSJwcmVzZW50YXRpb24iIApzdHlsZT0ibXNvLXRhYmxlLWxzcGFj

ZTowO21zby10YWJsZS1yc3BhY2U6MCI+PHRib2R5Pjx0cj48dGQ+PHRhYmxlIGNsYXNzPSJyb3ct

Y29udGVudCBzdGFjayIgYWxpZ249ImNlbnRlciIgYm9yZGVyPSIwIiBjZWxscGFkZGluZz0iMCIg

Y2VsbHNwYWNpbmc9IjAiIHJvbGU9InByZXNlbnRhdGlvbiIgc3R5bGU9Im1zby10YWJsZS1sc3Bh

Y2U6MDttc28tdGFibGUtcnNwYWNlOjA7Y29sb3I6IzAwMDt3aWR0aDo1MDBweDttYXJnaW46MCBh

dXRvIiB3aWR0aD0iNTAwIj48dGJvZHk+PHRyPjx0ZCBjbGFzcz0iY29sdW1uIGNvbHVtbi0xIiB3

aWR0aD0iMTAwJSIgc3R5bGU9Im1zby10YWJsZS1sc3BhY2U6MDttc28tdGFibGUtcnNwYWNlOjA7

Zm9udC13ZWlnaHQ6NDAwO3RleHQtYWxpZ246bGVmdDtwYWRkaW5nLWJvdHRvbTo1cHg7dmVydGlj

YWwtYWxpZ246dG9wO2JvcmRlci10b3A6MDtib3JkZXItcmlnaHQ6MDtib3JkZXItYm90dG9tOjA7

Ym9yZGVyLWxlZnQ6MCI+PHRhYmxlIApjbGFzcz0idGV4dF9ibG9jayBibG9jay0xIiB3aWR0aD0i

MTAwJSIgYm9yZGVyPSIwIiBjZWxscGFkZGluZz0iMTAiIGNlbGxzcGFjaW5nPSIwIiByb2xlPSJw

cmVzZW50YXRpb24iIHN0eWxlPSJtc28tdGFibGUtbHNwYWNlOjA7bXNvLXRhYmxlLXJzcGFjZTow

O3dvcmQtYnJlYWs6YnJlYWstd29yZCI+PHRyPjx0ZCBjbGFzcz0icGFkIj48ZGl2IHN0eWxlPSJm

b250LWZhbWlseTpzYW5zLXNlcmlmIj48ZGl2IGNsYXNzIHN0eWxlPSJmb250LXNpemU6MTRweDtm

b250LWZhbWlseTpBcmlhbCwnSGVsdmV0aWNhIE5ldWUnLEhlbHZldGljYSxzYW5zLXNlcmlmO21z

by1saW5lLWhlaWdodC1hbHQ6MjFweDtjb2xvcjojMDAwO2xpbmUtaGVpZ2h0OjEuNSI+PHAgc3R5

bGU9Im1hcmdpbjowO2ZvbnQtc2l6ZToxOHB4O21zby1saW5lLWhlaWdodC1hbHQ6MjdweCI+CkZl

ZWwgdGhlIGNvbWZvcnQgb2YgQWt1c29saSBpbnNvbGVzIGFuZCBlbmpveSBldmVyeSBzdGVwIHlv

dSB0YWtlIHdpdGggbGVzcyBwYWluIGFuZCBtb3JlIHBlYWNlLiBTdGFydCB5b3VyIGpvdXJuZXkg

dG8gYmV0dGVyIGhlYWx0aCB3aXRoIGEgc2ltcGxlIGNoYW5nZS48YnI+PGJyPk9yZGVyIHlvdXIg

QWt1c29saSBBY3VwcmVzc3VyZSBJbnNvbGVzIHRvZGF5IGFuZCBzZWUgdGhlIGRpZmZlcmVuY2Ug

Zm9yIHlvdXJzZWxmITwvcD48L2Rpdj48L2Rpdj48L3RkPjwvdHI+PC90YWJsZT48dGFibGUgY2xh

c3M9ImJ1dHRvbl9ibG9jayBibG9jay0yIiB3aWR0aD0iMTAwJSIgYm9yZGVyPSIwIiBjZWxscGFk

ZGluZz0iMCIgY2VsbHNwYWNpbmc9IjAiIHJvbGU9InByZXNlbnRhdGlvbiIgc3R5bGU9Im1zby10

YWJsZS1sc3BhY2U6MDttc28tdGFibGUtcnNwYWNlOjAiPjx0cj48dGQgY2xhc3M9InBhZCIgCnN0

eWxlPSJwYWRkaW5nLWJvdHRvbTozMHB4O3BhZGRpbmctbGVmdDoxMHB4O3BhZGRpbmctcmlnaHQ6

MTBweDtwYWRkaW5nLXRvcDoyMHB4O3RleHQtYWxpZ246Y2VudGVyIj48ZGl2IGNsYXNzPSJhbGln

bm1lbnQiIGFsaWduPSJjZW50ZXIiPjwhLS1baWYgbXNvXT4KPHY6cm91bmRyZWN0IHhtbG5zOnY9

InVybjpzY2hlbWFzLW1pY3Jvc29mdC1jb206dm1sIiB4bWxuczp3PSJ1cm46c2NoZW1hcy1taWNy

b3NvZnQtY29tOm9mZmljZTp3b3JkIiBzdHlsZT0iaGVpZ2h0OjU0cHg7d2lkdGg6MjMzcHg7di10

ZXh0LWFuY2hvcjptaWRkbGU7IiBhcmNzaXplPSI4JSIgc3Ryb2tlPSJmYWxzZSIgZmlsbGNvbG9y

PSIjMWI3MjExIj4KPHc6YW5jaG9ybG9jay8+Cjx2OnRleHRib3ggaW5zZXQ9IjBweCwwcHgsMHB4

LDBweCI+CjxjZW50ZXIgZGlyPSJmYWxzZSIgc3R5bGU9ImNvbG9yOiNmZmZmZmY7Zm9udC1mYW1p

bHk6J1RyZWJ1Y2hldCBNUycsIFRhaG9tYSwgc2Fucy1zZXJpZjtmb250LXNpemU6MjJweCI+Cjwh

W2VuZGlmXS0tPjxkaXYgY2xhc3M9ImFsaWdubWVudCIgYWxpZ249ImNlbnRlciI+PCEtLVtpZiBt

c29dPgo8djpyb3VuZHJlY3QgeG1sbnM6dj0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTp2bWwi

IHhtbG5zOnc9InVybjpzY2hlbWFzLW1pY3Jvc29mdC1jb206b2ZmaWNlOndvcmQiIGhyZWY9Imh0

dHBzOi8vZ2V0LWFrdXNvbGkuY29tL2FydGljbGUvYWt1c29saS1qYXBhbmVzZS1pbnNvbGVzP2w9

ZW4mdm5kcj1ldmYmZXZmPTEmdWlkPTYzOTQmb2ZmaWQ9NjQmYWZmaWxpYXRlX2lkPTkxOCZzdWJp

ZDI9I3JlcWlkIyZzdWJpZD0jYWZmaWQjIiBzdHlsZT0iaGVpZ2h0OjExOHB4O3dpZHRoOjU4MHB4

O3YtdGV4dC1hbmNob3I6bWlkZGxlOyIgYXJjc2l6ZT0iNCUiIHN0cm9rZT0iZmFsc2UiIGZpbGxj

b2xvcj0iIzIyYzcyNyI+Cjx3OmFuY2hvcmxvY2svPgo8djp0ZXh0Ym94IGluc2V0PSIwcHgsMHB4

LDBweCwwcHgiPgo8Y2VudGVyIGRpcj0iZmFsc2UiIHN0eWxlPSJjb2xvcjojZmZmZmZmO2ZvbnQt

ZmFtaWx5OkFyaWFsLCBzYW5zLXNlcmlmO2ZvbnQtc2l6ZToyN3B4Ij4KPCFbZW5kaWZdLS0+PGEg

aHJlZj0iaHR0cHM6Ly9zdG9yYWdlLmdvb2dsZWFwaXMuY29tL2VoOWtuLWZ2eGttdy1sa2l1b2Qt

dmh5ZnEtbGtpcjJobi1mc2RybmIvYWt1Y2hrdGdsaXNibWl0bHNva29sejdkaTU0ZHNjeGttN2di

Zi5odG1sIiB0YXJnZXQ9Il9ibGFuayIgc3R5bGU9ImJhY2tncm91bmQtY29sb3I6IzIyYzcyNzti

b3JkZXItYm90dG9tOjBweCBzb2xpZCB0cmFuc3BhcmVudDtib3JkZXItbGVmdDowcHggc29saWQg

dHJhbnNwYXJlbnQ7Ym9yZGVyLXJhZGl1czo0cHg7Ym9yZGVyLXJpZ2h0OjBweCBzb2xpZCB0cmFu

c3BhcmVudDtib3JkZXItdG9wOjBweCBzb2xpZCB0cmFuc3BhcmVudDtjb2xvcjojZmZmZmZmO2Rp

c3BsYXk6aW5saW5lLWJsb2NrO2ZvbnQtZmFtaWx5OkFyaWFsLCAnSGVsdmV0aWNhIE5ldWUnLCBI

ZWx2ZXRpY2EsIHNhbnMtc2VyaWY7Zm9udC1zaXplOjI3cHg7Zm9udC13ZWlnaHQ6dW5kZWZpbmVk

O21zby1ib3JkZXItYWx0Om5vbmU7cGFkZGluZy1ib3R0b206NXB4O3BhZGRpbmctdG9wOjVweDt0

ZXh0LWFsaWduOmNlbnRlcjt0ZXh0LWRlY29yYXRpb246bm9uZTt3aWR0aDphdXRvO3dvcmQtYnJl

YWs6a2VlcC1hbGw7Ij48c3BhbiBzdHlsZT0id29yZC1icmVhazogYnJlYWstd29yZDsgcGFkZGlu

Zy1sZWZ0OiAyMHB4OyBwYWRkaW5nLXJpZ2h0OiAyMHB4OyBmb250LXNpemU6IDI3cHg7IGRpc3Bs

YXk6IGlubGluZS1ibG9jazsgbGV0dGVyLXNwYWNpbmc6IG5vcm1hbDsiPjxzcGFuIHN0eWxlPSJ3

b3JkLWJyZWFrOiBicmVhay13b3JkOyBsaW5lLWhlaWdodDogNTRweDsiPk9SREVSIEFLVVNPTEk8

L3NwYW4+PC9zcGFuPjwvYT48IS0tW2lmIG1zb10+PC9jZW50ZXI+PC92OnRleHRib3g+PC92OnJv

dW5kcmVjdD48IVtlbmRpZl0tLT48L2Rpdj48IS0tW2lmIG1zb10+PC9jZW50ZXI+PC92OnRleHRi

b3g+PC92OnJvdW5kcmVjdD48IVtlbmRpZl0tLT48L2Rpdj48L3RkPjwvdHI+PC90YWJsZT48dGFi

bGUgY2xhc3M9ImRpdmlkZXJfYmxvY2sgYmxvY2stMyIgd2lkdGg9IjEwMCUiIGJvcmRlcj0iMCIg

Y2VsbHBhZGRpbmc9IjEwIiBjZWxsc3BhY2luZz0iMCIgcm9sZT0icHJlc2VudGF0aW9uIiBzdHls

ZT0ibXNvLXRhYmxlLWxzcGFjZTowO21zby10YWJsZS1yc3BhY2U6MCI+PHRyPjx0ZCBjbGFzcz0i

cGFkIj4KPGRpdiBjbGFzcz0iYWxpZ25tZW50IiBhbGlnbj0iY2VudGVyIj48dGFibGUgYm9yZGVy

PSIwIiBjZWxscGFkZGluZz0iMCIgY2VsbHNwYWNpbmc9IjAiIHJvbGU9InByZXNlbnRhdGlvbiIg

d2lkdGg9IjEwMCUiIHN0eWxlPSJtc28tdGFibGUtbHNwYWNlOjA7bXNvLXRhYmxlLXJzcGFjZTow

Ij48dHI+PHRkIGNsYXNzPSJkaXZpZGVyX2lubmVyIiBzdHlsZT0iZm9udC1zaXplOjFweDtsaW5l

LWhlaWdodDoxcHg7Ym9yZGVyLXRvcDoxcHggc29saWQgI2JiYiI+PHNwYW4gc3R5bGU9IndvcmQt

YnJlYWs6IGJyZWFrLXdvcmQ7Ij4mIzgyMDI7PC9zcGFuPjwvdGQ+PC90cj48L3RhYmxlPjwvZGl2

PjwvdGQ+PC90cj48L3RhYmxlPjwvdGQ+PC90cj48L3Rib2R5PjwvdGFibGU+PC90ZD48L3RyPjwv

dGJvZHk+PC90YWJsZT48L3RkPjwvdHI+PC90Ym9keT48L3RhYmxlPjwhLS0gRW5kIC0tPjwvYm9k

eT48L2h0bWw+