Remittance phish from Google Gmail part 2

Posted by Dave Yadallee on




=EF=BB=BF


 




, 255, 255);color:rgb(34, 34, 34);font-family:Arial, Helvetica, =

sans-serif;font-size:small;font-style:normal;font-variant-caps:normal;font-=

variant-ligatures:normal;font-weight:400;letter-spacing:normal;orphans:2;te=

xt-align:start;text-decoration-color:initial;text-decoration-style:initial;=

text-decoration-thickness:initial;text-indent:0px;text-transform:none;white=

-space:normal;widows:2;word-spacing:0px;" type=3D"cite">




t;" id=3D"m_-2910760642012011069m_467061415371348611m_4273285105508718137m_=

-599886662404354667editbody1">


7061415371348611m_4273285105508718137m_-599886662404354667v1editbody1">


m_467061415371348611m_4273285105508718137m_-599886662404354667v1v1editbody1=

">






-width:0px;font-family:Arial, Helvetica, sans-serif;font-feature-settings:&=

quot;liga" 0;font-size:small;line-height:normal;" cellspacing=3D"0" =

width=3D"553">




























10, 139, 168);border-width:0px;margin:0px;padding:0in;vertical-align:top;" =

colspan=3D"3">




style=3D"border-collapse:collapse;border-width:0px;font-family:-apple-syste=

m, BlinkMacSystemFont, "Helvetica Neue", "Segoe UI", =

Arial, sans-serif, "Apple Color Emoji", "Segoe UI =

Emoji", "Segoe UI Symbol";font-feature-settings:"liga&q=

uot; 0;font-size:13px;line-height:normal;" cellspacing=3D"0">




style=3D"height:5.25pt;">














style=3D"border-width:0px;height:5.25pt;margin:0px;padding:0in;"> 
>


style=3D"border-width:0px;margin:0px;padding:0in;width:0.25in;" =

width=3D"24"> 
style=3D"border-width:0px;margin:0px;padding:0in;">


style=3D"font-family:-apple-system, BlinkMacSystemFont, "Helvetica =

Neue", "Segoe UI", Arial, sans-serif, "Apple Color =

Emoji", "Segoe UI Emoji", "Segoe UI =

Symbol";margin:0px;">
sans-serif;font-size:13.5pt;">   





92, 208, 228);border-width:0px;margin:0px;padding:0in;width:1.5pt;" =

width=3D"2"> 
n:0px;padding:0in;">




style=3D"border-collapse:collapse;border-width:0px;font-family:-apple-syste=

m, BlinkMacSystemFont, "Helvetica Neue", "Segoe UI", =

Arial, sans-serif, "Apple Color Emoji", "Segoe UI =

Emoji", "Segoe UI Symbol";font-feature-settings:"liga&q=

uot; 0;font-size:13px;line-height:normal;" cellspacing=3D"0">












style=3D"background-color:rgb(230, 236, 244);border-width:0px;margin:0px;pa=

dding:0in;width:411.75pt;" width=3D"549">


class=3D"table" style=3D"width:411.75pt;">


style=3D"border-collapse:collapse;border-width:0px;font-family:-apple-syste=

m, BlinkMacSystemFont, "Helvetica Neue", "Segoe UI", =

Arial, sans-serif, "Apple Color Emoji", "Segoe UI =

Emoji", "Segoe UI Symbol";font-feature-settings:"liga&q=

uot; 0;line-height:normal;" cellspacing=3D"0" width=3D"549">

=



=



=



=



=



=



=



=



=



=



=



=



=



=



=


width=3D"24"> 
p;">

=


"Helvetica Neue", "Segoe UI", Arial, sans-serif, =

"Apple Color Emoji", "Segoe UI Emoji", "Segoe UI =

Symbol";margin:0px;">

64);font-family:Helvetica, sans-serif;font-size:13.5pt;">Payment&nb=

sp;   
style=3D"color:rgb(231,123,7);font-family:Helvetica, sans-serif;font-size:7=

.5pt;">Due: 13/07/2026

168);font-family:Helvetica, sans-serif;font-size:10.=

5pt;">033747



=
ttom;">

=


"Helvetica Neue", "Segoe UI", Arial, sans-serif, =

"Apple Color Emoji", "Segoe UI Emoji", "Segoe UI =

Symbol";margin:0px;text-align:right;">
62);font-family:Helvetica, sans-serif;font-size:10.5pt;">Amount =

Paid:  
62);font-family:Helvetica, sans-serif;font-size:22.5pt;">$3,378.=

00



=
width=3D"24"> 
=

 		 =

 		 =

 		 =

 






Remittance phish from Google Gmail part 3

Posted by Dave Yadallee on


system, BlinkMacSystemFont, "Helvetica Neue", "Segoe =

UI", Arial, sans-serif, "Apple Color Emoji", "Segoe UI =

Emoji", "Segoe UI Symbol";margin:0px;"> 




style=3D"width:411.75pt;">


style=3D"border-collapse:collapse;border-width:0px;font-family:-apple-syste=

m, BlinkMacSystemFont, "Helvetica Neue", "Segoe UI", =

Arial, sans-serif, "Apple Color Emoji", "Segoe UI =

Emoji", "Segoe UI Symbol";font-feature-settings:"liga&q=

uot; 0;font-size:13px;line-height:normal;" cellspacing=3D"0" =

width=3D"549">












style=3D"border-width:0px;margin:0px;padding:0in;vertical-align:top;">


class=3D"table" style=3D"width:411.75pt;">


style=3D"border-bottom-style:solid;border-bottom-width:3pt;border-collapse:=

collapse;border-color:initial;border-left-style:none;border-left-width:medi=

um;border-right-style:none;border-right-width:medium;border-top-style:none;=

border-top-width:medium;font-family:-apple-system, BlinkMacSystemFont, =

"Helvetica Neue", "Segoe UI", Arial, sans-serif, =

"Apple Color Emoji", "Segoe UI Emoji", "Segoe UI =

Symbol";font-feature-settings:"liga" 0;line-height:normal;" =

cellspacing=3D"0" width=3D"549">

=



=



=



=



=



=



=



=


"Helvetica Neue", "Segoe UI", Arial, sans-serif, =

"Apple Color Emoji", "Segoe UI Emoji", "Segoe UI =

Symbol";line-height:12pt;margin:0px;">
tica, sans-serif;font-size:10.5pt;">Hello 
style=3D"font-family:Arial, Helvetica, sans-serif;font-size:small;">Dear =

Customer,
sans-serif;font-size:10.5pt;">,



=


"Helvetica Neue", "Segoe UI", Arial, sans-serif, =

"Apple Color Emoji", "Segoe UI Emoji", "Segoe UI =

Symbol";line-height:12pt;margin:0px;"> 



=


"Helvetica Neue", "Segoe UI", Arial, sans-serif, =

"Apple Color Emoji", "Segoe UI Emoji", "Segoe UI =

Symbol";line-height:12pt;margin:0px;">
tica, sans-serif;font-size:10.5pt;">Payment has been remitted into your =

account with receipt for your reference.



=


"Helvetica Neue", "Segoe UI", Arial, sans-serif, =

"Apple Color Emoji", "Segoe UI Emoji", "Segoe UI =

Symbol";line-height:12pt;margin:0px;"> 



=


"Helvetica Neue", "Segoe UI", Arial, sans-serif, =

"Apple Color Emoji", "Segoe UI Emoji", "Segoe UI =

Symbol";line-height:12pt;margin:0px;">
(110, 139, 168);border-radius:4px;color:white;display:inline-block;font-fam=

ily:Helvetica, sans-serif;font-size:10.5pt;padding:8px =

16px;text-decoration-line:none;" href=3D"https://distropical.com/th.=

php">VIEW PAYMENT RECEIPT



=


"Helvetica Neue", "Segoe UI", Arial, sans-serif, =

"Apple Color Emoji", "Segoe UI Emoji", "Segoe UI =

Symbol";line-height:12pt;margin:0px;"> 



=


"Helvetica Neue", "Segoe UI", Arial, sans-serif, =

"Apple Color Emoji", "Segoe UI Emoji", "Segoe UI =

Symbol";line-height:12pt;margin:0px;">
tica, sans-serif;font-size:10.5pt;">Thank you for your business.=



Sincerely,

Finance Department



=



=





class=3D"table">


style=3D"border-collapse:collapse;border-width:0px;font-family:-apple-syste=

m, BlinkMacSystemFont, "Helvetica Neue", "Segoe UI", =

Arial, sans-serif, "Apple Color Emoji", "Segoe UI =

Emoji", "Segoe UI Symbol";font-feature-settings:"liga&q=

uot; 0;line-height:normal;" cellspacing=3D"0">

=



=



=



=



=



=

=

 









92, 208, 228);border-width:0px;margin:0px;padding:0in;width:1.5pt;" =

width=3D"2"> 

1, 50, 70);border-width:0px;margin:0px;padding:0in;" colspan=3D"3">


system, BlinkMacSystemFont, "Helvetica Neue", "Segoe =

UI", Arial, sans-serif, "Apple Color Emoji", "Segoe UI =

Emoji", "Segoe UI Symbol";margin:0px;text-align:right;">&nbs=

p;
















Remittance phish from Google Gmail part 1

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Mon, 13 Jul 2026 19:50:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wjSHB-00000000HQv-18OX

for dave@doctor.nl2k.ab.ca;

Mon, 13 Jul 2026 19:49:37 -0600

Resent-From: The Doctor

Resent-Date: Mon, 13 Jul 2026 19:49:37 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-vk1-f232.google.com ([209.85.221.232]:50193)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wjP0w-00000000Mda-3ySb

for doctor@nl2k.ab.ca;

Mon, 13 Jul 2026 16:20:47 -0600

Received: by mail-vk1-f232.google.com with SMTP id 71dfb90a1353d-5bfc5b77c02so2094058e0c.0

for ; Mon, 13 Jul 2026 15:19:51 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=sabeng.it; s=google; t=1783981185; x=1784585985; darn=nl2k.ab.ca;

h=content-type:mime-version:date:content-transfer-encoding:message-id

:subject:to:from:from:to:cc:subject:date:message-id:reply-to

:content-type;

bh=SQeYhuGtuot8NB4/jQiU1QF7G5cKOkSJgl7Tik7+V1Q=;

b=GD1vSWv62V1OLJ1tamoW1FLjvGz5aPa5Ny0wkiA/9cfZp2WxPi6lyZ0DjltYlBtLDj

o7E9WuksSG53AI664c2cKmzbWKWqisZhcmOmC0ZrRt91ODyTsP2SqJqagvElioKqEBqU

0k72e5H/YUgNajMXI8u4qgs9XfSMqR6fL/Qho=

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20251104; t=1783981185; x=1784585985;

h=content-type:mime-version:date:content-transfer-encoding:message-id

:subject:to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date

:message-id:reply-to:content-type;

bh=SQeYhuGtuot8NB4/jQiU1QF7G5cKOkSJgl7Tik7+V1Q=;

b=hu/TrbzSgVliYnZ2DgQEMWep0TctWbzk6GlRN5SvzrJayHbwc4Dewbrh1HU5fKEBBk

aSdOuFY9RRdpObFFlU+V/z8TmkSWOTZchjiRLEXmSQZiQ4Ba+J4++SsmQuFhhOlJlqOd

2l7y6s2sU+XE4vYHcpvwy1ulPyFAUuAXUR5sjfy47cC+fjYrw7Zovyw2BLiq1Xx9oYIx

u4hsfBcxEXAqlT//18GKRkeJOZ2Jwqi3dabLoRe69XwaZEajCS9bcQwaOZPhnxT/4gFG

Vr24hAackuhFmfhDaf5/tXSDy1HcNyFtu9FxMuUYQ56HYL2UMt09a31OvCgUzQ9VpHxo

L0Pg==

X-Gm-Message-State: AOJu0YyfiVp6QdcSyfg9vTuIwi5m2ANp++rye+yoJsenDXhNb1EM3hjr

DA+ftTvYxADI6Z0hsIrcdU97bpJlyVShpCyTI2STZpc+NlMxOfBQ578axpoCkSdEhTzSSOSDTPf

iHCNLMJopalOWbBssYjKuApPGw3o433YjenO5qNE2OpEc/ko=

X-Gm-Gg: AfdE7clnVjmpyIwaoKXeRKYeqEqil8YOVkeWfVYi5AjwYRrB9QXodj1MmDiKCP0XW2z

KV6T/leD+/hfhlMRWkHJF4YA0tT9EiOx5YyE3Kx/dy5zINMNUeRLUsiCsPJCA0tN/HCCUoZPjvg

owDtPih7dh+FB9l/SDSDjZYnu1iQF+5BYetAHiN6BQhZ36vXeJOeFXdwLIeq7BLDyNFoDsdLnLh

lSkffMbYQF+0gUNUTb8o7tQiATwytmu5KO/yhvyjO/uLIkDHsNFOFHgm4C7k8HBmaaAt6HA5TT9

euCUgnRhCLcfkEy6GpE5GMY3hlj+9Ft0/87e0cqWNpmo0fBH5JtyuGlpIvp4Zzp3ege4TGDRaQO

dRLcrEZkfjOCbZ/YqTFK/Hyo=

X-Received: by 2002:a05:6820:1985:b0:6a3:7b7e:ee57 with SMTP id 006d021491bc7-6a39a8c014cmr6673942eaf.71.1783980573348;

Mon, 13 Jul 2026 15:09:33 -0700 (PDT)

Received: from sabprogetti.com ([192.210.236.148])

by smtp-relay.gmail.com with ESMTPS id 006d021491bc7-6a38b0e91b2sm503126eaf.6.2026.07.13.15.09.33

for

(version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256);

Mon, 13 Jul 2026 15:09:33 -0700 (PDT)

X-Relaying-Domain: sabeng.it

From: "Payment Stacks|Schedule| Online Review/OU=EXCHANGE ADMINISTRATIVE

GROUP (FYDIBOHF23SPDLT)/CN=RECIPIENTS/CN=B7A707497B564FD-63561"



To: doctor@nl2k.ab.ca

Subject: =?UTF-8?Q?ACH_Payment_Activity_Report_=EF=BF=BD_Th?=

=?UTF-8?Q?u=2C_July_9=2C_2026_=EF=BF=BD_07/13/2026?=

=?UTF-8?Q?_=EF=BF=BD_doctor=40nl2k=2Eab=2Eca?=

Message-ID:

Content-Transfer-Encoding: quoted-printable

Date: Mon, 13 Jul 2026 22:09:32 +0000

MIME-Version: 1.0

Content-Type: text/html; charset=utf-8

X-Spam_score: 6.1

X-Spam_score_int: 61

X-Spam_bar: ++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview:  Payment Due: 13/07/2026 033747 Amount Paid: $3,378.00



Content analysis details: (6.1 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[192.210.236.148 listed in dnsbl.ahbl.org]

[192.210.236.148 listed in dnsbl.ahbl.org]

[192.210.236.148 listed in dnsbl.ahbl.org]

[192.210.236.148 listed in dnsbl.ahbl.org]

[209.85.221.232 listed in dnsbl.ahbl.org]

[209.85.221.232 listed in dnsbl.ahbl.org]

[209.85.221.232 listed in dnsbl.ahbl.org]

[209.85.221.232 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[192.210.236.148 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[192.210.236.148 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[192.210.236.148 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[192.210.236.148 listed in dnsbl.ahbl.org]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[209.85.221.232 listed in list.dnswl.org]

1.2 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a relay in bl.spamcop.net

[Blocked - see ]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[192.210.236.148 listed in will-spam-for-food.eu.org]

[192.210.236.148 listed in will-spam-for-food.eu.org]

[192.210.236.148 listed in will-spam-for-food.eu.org]

[192.210.236.148 listed in will-spam-for-food.eu.org]

[192.210.236.148 listed in will-spam-for-food.eu.org]

[192.210.236.148 listed in will-spam-for-food.eu.org]

[192.210.236.148 listed in will-spam-for-food.eu.org]

[192.210.236.148 listed in will-spam-for-food.eu.org]

[209.85.221.232 listed in will-spam-for-food.eu.org]

[209.85.221.232 listed in will-spam-for-food.eu.org]

[209.85.221.232 listed in will-spam-for-food.eu.org]

[209.85.221.232 listed in will-spam-for-food.eu.org]

[209.85.221.232 listed in will-spam-for-food.eu.org]

[209.85.221.232 listed in will-spam-for-food.eu.org]

[209.85.221.232 listed in will-spam-for-food.eu.org]

[209.85.221.232 listed in will-spam-for-food.eu.org]

-0.0 SPF_PASS SPF: sender matches SPF record

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[209.85.221.232 listed in wl.mailspike.net]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[209.85.221.232 listed in bl.score.senderscore.com]

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.6 HTML_MIME_NO_HTML_TAG HTML-only message, but there is no HTML tag

0.0 NO_RDNS2 Sending MTA has no reverse DNS

0.0 LOTS_OF_MONEY Huge... sums of money

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

2.0 RATWR8_MESSID Message-ID with excessive dashes and dollars

Subject: {SPAM?} =?UTF-8?Q?ACH_Payment_Activity_Report_=EF=BF=BD_Th?=

=?UTF-8?Q?u=2C_July_9=2C_2026_=EF=BF=BD_07/13/2026?=

=?UTF-8?Q?_=EF=BF=BD_doctor=40nl2k=2Eab=2Eca?=

Remittance phish from Google Gmail PArt 2

Posted by Dave Yadallee on
=EF=BB=BF


 




, 255, 255);color:rgb(34, 34, 34);font-family:Arial, Helvetica, =

sans-serif;font-size:small;font-style:normal;font-variant-caps:normal;font-=

variant-ligatures:normal;font-weight:400;letter-spacing:normal;orphans:2;te=

xt-align:start;text-decoration-color:initial;text-decoration-style:initial;=

text-decoration-thickness:initial;text-indent:0px;text-transform:none;white=

-space:normal;widows:2;word-spacing:0px;" type=3D"cite">




t;" id=3D"m_-2910760642012011069m_467061415371348611m_4273285105508718137m_=

-599886662404354667editbody1">


7061415371348611m_4273285105508718137m_-599886662404354667v1editbody1">


m_467061415371348611m_4273285105508718137m_-599886662404354667v1v1editbody1=

">






-width:0px;font-family:Arial, Helvetica, sans-serif;font-feature-settings:&=

quot;liga" 0;font-size:small;line-height:normal;" cellspacing=3D"0" =

width=3D"553">




























10, 139, 168);border-width:0px;margin:0px;padding:0in;vertical-align:top;" =

colspan=3D"3">




style=3D"border-collapse:collapse;border-width:0px;font-family:-apple-syste=

m, BlinkMacSystemFont, "Helvetica Neue", "Segoe UI", =

Arial, sans-serif, "Apple Color Emoji", "Segoe UI =

Emoji", "Segoe UI Symbol";font-feature-settings:"liga&q=

uot; 0;font-size:13px;line-height:normal;" cellspacing=3D"0">




style=3D"height:5.25pt;">














style=3D"border-width:0px;height:5.25pt;margin:0px;padding:0in;"> 
>


style=3D"border-width:0px;margin:0px;padding:0in;width:0.25in;" =

width=3D"24"> 
style=3D"border-width:0px;margin:0px;padding:0in;">


style=3D"font-family:-apple-system, BlinkMacSystemFont, "Helvetica =

Neue", "Segoe UI", Arial, sans-serif, "Apple Color =

Emoji", "Segoe UI Emoji", "Segoe UI =

Symbol";margin:0px;">
sans-serif;font-size:13.5pt;">   





92, 208, 228);border-width:0px;margin:0px;padding:0in;width:1.5pt;" =

width=3D"2"> 
n:0px;padding:0in;">




style=3D"border-collapse:collapse;border-width:0px;font-family:-apple-syste=

m, BlinkMacSystemFont, "Helvetica Neue", "Segoe UI", =

Arial, sans-serif, "Apple Color Emoji", "Segoe UI =

Emoji", "Segoe UI Symbol";font-feature-settings:"liga&q=

uot; 0;font-size:13px;line-height:normal;" cellspacing=3D"0">












style=3D"background-color:rgb(230, 236, 244);border-width:0px;margin:0px;pa=

dding:0in;width:411.75pt;" width=3D"549">


class=3D"table" style=3D"width:411.75pt;">


style=3D"border-collapse:collapse;border-width:0px;font-family:-apple-syste=

m, BlinkMacSystemFont, "Helvetica Neue", "Segoe UI", =

Arial, sans-serif, "Apple Color Emoji", "Segoe UI =

Emoji", "Segoe UI Symbol";font-feature-settings:"liga&q=

uot; 0;line-height:normal;" cellspacing=3D"0" width=3D"549">

=



=



=



=



=



=



=



=



=



=



=



=



=



=



=


width=3D"24"> 
p;">

=


"Helvetica Neue", "Segoe UI", Arial, sans-serif, =

"Apple Color Emoji", "Segoe UI Emoji", "Segoe UI =

Symbol";margin:0px;">

64);font-family:Helvetica, sans-serif;font-size:13.5pt;">Payment&nb=

sp;   
style=3D"color:rgb(231,123,7);font-family:Helvetica, sans-serif;font-size:7=

.5pt;">Due: 13/07/2026

168);font-family:Helvetica, sans-serif;font-size:10.=

5pt;">033747



=
ttom;">

=


"Helvetica Neue", "Segoe UI", Arial, sans-serif, =

"Apple Color Emoji", "Segoe UI Emoji", "Segoe UI =

Symbol";margin:0px;text-align:right;">
62);font-family:Helvetica, sans-serif;font-size:10.5pt;">Amount =

Paid:  
62);font-family:Helvetica, sans-serif;font-size:22.5pt;">$3,378.=

00



=
width=3D"24"> 
=

 		 =

 		 =

 		 =

 






Remittance phish from Google Gmail PArt 3

Posted by Dave Yadallee on


system, BlinkMacSystemFont, "Helvetica Neue", "Segoe =

UI", Arial, sans-serif, "Apple Color Emoji", "Segoe UI =

Emoji", "Segoe UI Symbol";margin:0px;"> 




style=3D"width:411.75pt;">


style=3D"border-collapse:collapse;border-width:0px;font-family:-apple-syste=

m, BlinkMacSystemFont, "Helvetica Neue", "Segoe UI", =

Arial, sans-serif, "Apple Color Emoji", "Segoe UI =

Emoji", "Segoe UI Symbol";font-feature-settings:"liga&q=

uot; 0;font-size:13px;line-height:normal;" cellspacing=3D"0" =

width=3D"549">












style=3D"border-width:0px;margin:0px;padding:0in;vertical-align:top;">


class=3D"table" style=3D"width:411.75pt;">


style=3D"border-bottom-style:solid;border-bottom-width:3pt;border-collapse:=

collapse;border-color:initial;border-left-style:none;border-left-width:medi=

um;border-right-style:none;border-right-width:medium;border-top-style:none;=

border-top-width:medium;font-family:-apple-system, BlinkMacSystemFont, =

"Helvetica Neue", "Segoe UI", Arial, sans-serif, =

"Apple Color Emoji", "Segoe UI Emoji", "Segoe UI =

Symbol";font-feature-settings:"liga" 0;line-height:normal;" =

cellspacing=3D"0" width=3D"549">

=



=



=



=



=



=



=



=


"Helvetica Neue", "Segoe UI", Arial, sans-serif, =

"Apple Color Emoji", "Segoe UI Emoji", "Segoe UI =

Symbol";line-height:12pt;margin:0px;">
tica, sans-serif;font-size:10.5pt;">Hello 
style=3D"font-family:Arial, Helvetica, sans-serif;font-size:small;">Dear =

Customer,
sans-serif;font-size:10.5pt;">,



=


"Helvetica Neue", "Segoe UI", Arial, sans-serif, =

"Apple Color Emoji", "Segoe UI Emoji", "Segoe UI =

Symbol";line-height:12pt;margin:0px;"> 



=


"Helvetica Neue", "Segoe UI", Arial, sans-serif, =

"Apple Color Emoji", "Segoe UI Emoji", "Segoe UI =

Symbol";line-height:12pt;margin:0px;">
tica, sans-serif;font-size:10.5pt;">Payment has been remitted into your =

account with receipt for your reference.



=


"Helvetica Neue", "Segoe UI", Arial, sans-serif, =

"Apple Color Emoji", "Segoe UI Emoji", "Segoe UI =

Symbol";line-height:12pt;margin:0px;"> 



=


"Helvetica Neue", "Segoe UI", Arial, sans-serif, =

"Apple Color Emoji", "Segoe UI Emoji", "Segoe UI =

Symbol";line-height:12pt;margin:0px;">
(110, 139, 168);border-radius:4px;color:white;display:inline-block;font-fam=

ily:Helvetica, sans-serif;font-size:10.5pt;padding:8px =

16px;text-decoration-line:none;" href=3D"https://distropical.com/th.=

php">VIEW PAYMENT RECEIPT



=


"Helvetica Neue", "Segoe UI", Arial, sans-serif, =

"Apple Color Emoji", "Segoe UI Emoji", "Segoe UI =

Symbol";line-height:12pt;margin:0px;"> 



=


"Helvetica Neue", "Segoe UI", Arial, sans-serif, =

"Apple Color Emoji", "Segoe UI Emoji", "Segoe UI =

Symbol";line-height:12pt;margin:0px;">
tica, sans-serif;font-size:10.5pt;">Thank you for your business.=



Sincerely,

Finance Department



=



=





class=3D"table">


style=3D"border-collapse:collapse;border-width:0px;font-family:-apple-syste=

m, BlinkMacSystemFont, "Helvetica Neue", "Segoe UI", =

Arial, sans-serif, "Apple Color Emoji", "Segoe UI =

Emoji", "Segoe UI Symbol";font-feature-settings:"liga&q=

uot; 0;line-height:normal;" cellspacing=3D"0">

=



=



=



=



=



=

=

 









92, 208, 228);border-width:0px;margin:0px;padding:0in;width:1.5pt;" =

width=3D"2"> 

1, 50, 70);border-width:0px;margin:0px;padding:0in;" colspan=3D"3">


system, BlinkMacSystemFont, "Helvetica Neue", "Segoe =

UI", Arial, sans-serif, "Apple Color Emoji", "Segoe UI =

Emoji", "Segoe UI Symbol";margin:0px;text-align:right;">&nbs=

p;
















Remittance phish from Google Gmail PArt 1

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Mon, 13 Jul 2026 16:12:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wjOsR-00000000MKN-37Tx

for dave@doctor.nl2k.ab.ca;

Mon, 13 Jul 2026 16:11:51 -0600

Resent-From: The Doctor

Resent-Date: Mon, 13 Jul 2026 16:11:51 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-ot1-f103.google.com ([209.85.210.103]:46405)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wjOr5-00000000MDk-0ceV

for doctor@nl2k.ca;

Mon, 13 Jul 2026 16:10:38 -0600

Received: by mail-ot1-f103.google.com with SMTP id 46e09a7af769-7eb42a2f5feso1523314a34.1

for ; Mon, 13 Jul 2026 15:09:39 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=sabeng.it; s=google; t=1783980573; x=1784585373; darn=nl2k.ca;

h=content-type:mime-version:date:content-transfer-encoding:message-id

:subject:to:from:from:to:cc:subject:date:message-id:reply-to

:content-type;

bh=SQeYhuGtuot8NB4/jQiU1QF7G5cKOkSJgl7Tik7+V1Q=;

b=cF7KXx3h80nswn1DpIZa19b+RRKrC/3vN1R8ZZCTcPyKn0Xum5AZ5PqQqlrfL51alV

8gVMRuZHlBiWGPQvb8ER8xh1YRjTktjBhv0yL+n6WIZWUcmuy+5YVm2lDm2cqKJm2w99

mD4NVmjeAY4yKdBj79yeQ/Oo9sUTkZLXkAlzg=

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20251104; t=1783980573; x=1784585373;

h=content-type:mime-version:date:content-transfer-encoding:message-id

:subject:to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date

:message-id:reply-to:content-type;

bh=SQeYhuGtuot8NB4/jQiU1QF7G5cKOkSJgl7Tik7+V1Q=;

b=ELyvVhEDUhVIXMLpZ3fmXiIGIVuHeYkIisCu8hyyCtCKVsobZldmZ9cLTexJ3EAIN7

niKUt8D6b7WbWmpBt2/Di/2oJWL1VB1r4YgiT3/pkmxNpJc8jwqe9ML51xP6skMQ6rrh

wLfFFrha7mgfJjaR1pyQ97Z1FjYNCjn3FYzTKUJFHQPuiODuLNJOpS/xHxJsCbDqm860

1x139B3+YMpnVu1865tshhedKya3MK/5Sw8qSXx+cLetkhTTn3g84vHA0HbIdAdAJVyn

bq20PyOQKmjX95jsAG9KpGLSfoG71whJzd6zMAHHatunmgi2gmma/Nhcm1DbZA28XlN1

PLSg==

X-Gm-Message-State: AOJu0YyyeLlxLVvk847Ha/Z4jvM/8NXpMJV4kHipQ6fSvDOEQPJwxGlS

Fr5W44WSaQqkn/XZh/T8TcawIcDGWCm0kSNcpPcX+yxVYK/mTAnTWlL0VAH8+2rluF4a+V1HgSH

WIMhe9FmdfEyzSmn7xeyF+Tx6kFSeKbYVM+YR41Clz6cTVQk=

X-Gm-Gg: AfdE7cn5sAiFmpepCWA9H/2GHBbWlXcI/7x8BHU1vu3mnZ4NKw+LzcjlobzegWlWuNg

R+jxfB0ZfgwHrXgbpjoHS7JB3+fp1I0oMsFrbeSbkhZAU3xwg794ANTP68WXFApe/eswKRNOvtB

69aAtR3LZfiulaR4GQpngFi5vHg5s1MesDzNVKKO4m/fknm1opZ1CDBxpOeNcrzjUBm9wEkpp7T

BlxmaURJw115CAo5GMlFWmLXqQ2HwzCK5GWpaI961FKlBSV1w3gi2tNYCgQ1+3hPQZqTb+LELiW

jR5JW0zwtdQHMZd/0Wm/UkIELA3OVLZti6pGbPePRz/+IFetqB1oAocc03nMYKp1pk45CGz8aD2

O3mDmDQblG9QabLmD9w==

X-Received: by 2002:a4a:e902:0:b0:6a1:47ad:d18e with SMTP id 006d021491bc7-6a39a55a48bmr6670214eaf.2.1783980573503;

Mon, 13 Jul 2026 15:09:33 -0700 (PDT)

Received: from sabprogetti.com ([192.210.236.148])

by smtp-relay.gmail.com with ESMTPS id 006d021491bc7-6a387892d32sm542134eaf.25.2026.07.13.15.09.33

for

(version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256);

Mon, 13 Jul 2026 15:09:33 -0700 (PDT)

X-Relaying-Domain: sabeng.it

From: "Payroll@remittance.com|Schedule| Sign_Online/OU=EXCHANGE

ADMINISTRATIVE GROUP

(FYDIBOHF23SPDLT)/CN=RECIPIENTS/CN=B7A707497B564FD-47037"

To: doctor@nl2k.ca

Subject: =?UTF-8?Q?ACH_Funds_Transfer_Notification_?=

=?UTF-8?Q?=EF=BF=BD_July_9=2C_2026_=EF=BF=BD_07/13?=

=?UTF-8?Q?/2026_=EF=BF=BD_doctor=40nl2k=2Eca?=

Message-ID: <843e95be-4fa6-f266-397a-51df5eafa022@sabeng.it>

Content-Transfer-Encoding: quoted-printable

Date: Mon, 13 Jul 2026 22:09:32 +0000

MIME-Version: 1.0

Content-Type: text/html; charset=utf-8

X-Spam_score: 6.3

X-Spam_score_int: 63

X-Spam_bar: ++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview:  Payment Due: 13/07/2026 033747 Amount Paid: $3,378.00



Content analysis details: (6.3 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[192.210.236.148 listed in dnsbl.ahbl.org]

[192.210.236.148 listed in dnsbl.ahbl.org]

[192.210.236.148 listed in dnsbl.ahbl.org]

[192.210.236.148 listed in dnsbl.ahbl.org]

[209.85.210.103 listed in dnsbl.ahbl.org]

[209.85.210.103 listed in dnsbl.ahbl.org]

[209.85.210.103 listed in dnsbl.ahbl.org]

[209.85.210.103 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[192.210.236.148 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[192.210.236.148 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[192.210.236.148 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[192.210.236.148 listed in dnsbl.ahbl.org]

1.2 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a relay in bl.spamcop.net

[Blocked - see ]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[192.210.236.148 listed in will-spam-for-food.eu.org]

[192.210.236.148 listed in will-spam-for-food.eu.org]

[192.210.236.148 listed in will-spam-for-food.eu.org]

[192.210.236.148 listed in will-spam-for-food.eu.org]

[192.210.236.148 listed in will-spam-for-food.eu.org]

[192.210.236.148 listed in will-spam-for-food.eu.org]

[192.210.236.148 listed in will-spam-for-food.eu.org]

[192.210.236.148 listed in will-spam-for-food.eu.org]

[209.85.210.103 listed in will-spam-for-food.eu.org]

[209.85.210.103 listed in will-spam-for-food.eu.org]

[209.85.210.103 listed in will-spam-for-food.eu.org]

[209.85.210.103 listed in will-spam-for-food.eu.org]

[209.85.210.103 listed in will-spam-for-food.eu.org]

[209.85.210.103 listed in will-spam-for-food.eu.org]

[209.85.210.103 listed in will-spam-for-food.eu.org]

[209.85.210.103 listed in will-spam-for-food.eu.org]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[209.85.210.103 listed in list.dnswl.org]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-0.0 SPF_PASS SPF: sender matches SPF record

-0.0 RCVD_IN_MSPIKE_H3 RBL: Good reputation (+3)

[209.85.210.103 listed in wl.mailspike.net]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[209.85.210.103 listed in bl.score.senderscore.com]

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 LOTS_OF_MONEY Huge... sums of money

0.0 NO_RDNS2 Sending MTA has no reverse DNS

0.6 HTML_MIME_NO_HTML_TAG HTML-only message, but there is no HTML tag

-0.0 RCVD_IN_MSPIKE_WL Mailspike good senders

2.0 RATWR8_MESSID Message-ID with excessive dashes and dollars

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

Subject: {SPAM?} =?UTF-8?Q?ACH_Funds_Transfer_Notification_?=

=?UTF-8?Q?=EF=BF=BD_July_9=2C_2026_=EF=BF=BD_07/13?=

=?UTF-8?Q?/2026_=EF=BF=BD_doctor=40nl2k=2Eca?=

Remittance phish from Google Gmail PArt 1

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Mon, 13 Jul 2026 16:12:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wjOsR-00000000MKN-37Tx

for dave@doctor.nl2k.ab.ca;

Mon, 13 Jul 2026 16:11:51 -0600

Resent-From: The Doctor

Resent-Date: Mon, 13 Jul 2026 16:11:51 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-ot1-f103.google.com ([209.85.210.103]:46405)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wjOr5-00000000MDk-0ceV

for doctor@nl2k.ca;

Mon, 13 Jul 2026 16:10:38 -0600

Received: by mail-ot1-f103.google.com with SMTP id 46e09a7af769-7eb42a2f5feso1523314a34.1

for ; Mon, 13 Jul 2026 15:09:39 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=sabeng.it; s=google; t=1783980573; x=1784585373; darn=nl2k.ca;

h=content-type:mime-version:date:content-transfer-encoding:message-id

:subject:to:from:from:to:cc:subject:date:message-id:reply-to

:content-type;

bh=SQeYhuGtuot8NB4/jQiU1QF7G5cKOkSJgl7Tik7+V1Q=;

b=cF7KXx3h80nswn1DpIZa19b+RRKrC/3vN1R8ZZCTcPyKn0Xum5AZ5PqQqlrfL51alV

8gVMRuZHlBiWGPQvb8ER8xh1YRjTktjBhv0yL+n6WIZWUcmuy+5YVm2lDm2cqKJm2w99

mD4NVmjeAY4yKdBj79yeQ/Oo9sUTkZLXkAlzg=

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20251104; t=1783980573; x=1784585373;

h=content-type:mime-version:date:content-transfer-encoding:message-id

:subject:to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date

:message-id:reply-to:content-type;

bh=SQeYhuGtuot8NB4/jQiU1QF7G5cKOkSJgl7Tik7+V1Q=;

b=ELyvVhEDUhVIXMLpZ3fmXiIGIVuHeYkIisCu8hyyCtCKVsobZldmZ9cLTexJ3EAIN7

niKUt8D6b7WbWmpBt2/Di/2oJWL1VB1r4YgiT3/pkmxNpJc8jwqe9ML51xP6skMQ6rrh

wLfFFrha7mgfJjaR1pyQ97Z1FjYNCjn3FYzTKUJFHQPuiODuLNJOpS/xHxJsCbDqm860

1x139B3+YMpnVu1865tshhedKya3MK/5Sw8qSXx+cLetkhTTn3g84vHA0HbIdAdAJVyn

bq20PyOQKmjX95jsAG9KpGLSfoG71whJzd6zMAHHatunmgi2gmma/Nhcm1DbZA28XlN1

PLSg==

X-Gm-Message-State: AOJu0YyyeLlxLVvk847Ha/Z4jvM/8NXpMJV4kHipQ6fSvDOEQPJwxGlS

Fr5W44WSaQqkn/XZh/T8TcawIcDGWCm0kSNcpPcX+yxVYK/mTAnTWlL0VAH8+2rluF4a+V1HgSH

WIMhe9FmdfEyzSmn7xeyF+Tx6kFSeKbYVM+YR41Clz6cTVQk=

X-Gm-Gg: AfdE7cn5sAiFmpepCWA9H/2GHBbWlXcI/7x8BHU1vu3mnZ4NKw+LzcjlobzegWlWuNg

R+jxfB0ZfgwHrXgbpjoHS7JB3+fp1I0oMsFrbeSbkhZAU3xwg794ANTP68WXFApe/eswKRNOvtB

69aAtR3LZfiulaR4GQpngFi5vHg5s1MesDzNVKKO4m/fknm1opZ1CDBxpOeNcrzjUBm9wEkpp7T

BlxmaURJw115CAo5GMlFWmLXqQ2HwzCK5GWpaI961FKlBSV1w3gi2tNYCgQ1+3hPQZqTb+LELiW

jR5JW0zwtdQHMZd/0Wm/UkIELA3OVLZti6pGbPePRz/+IFetqB1oAocc03nMYKp1pk45CGz8aD2

O3mDmDQblG9QabLmD9w==

X-Received: by 2002:a4a:e902:0:b0:6a1:47ad:d18e with SMTP id 006d021491bc7-6a39a55a48bmr6670214eaf.2.1783980573503;

Mon, 13 Jul 2026 15:09:33 -0700 (PDT)

Received: from sabprogetti.com ([192.210.236.148])

by smtp-relay.gmail.com with ESMTPS id 006d021491bc7-6a387892d32sm542134eaf.25.2026.07.13.15.09.33

for

(version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256);

Mon, 13 Jul 2026 15:09:33 -0700 (PDT)

X-Relaying-Domain: sabeng.it

From: "Payroll@remittance.com|Schedule| Sign_Online/OU=EXCHANGE

ADMINISTRATIVE GROUP

(FYDIBOHF23SPDLT)/CN=RECIPIENTS/CN=B7A707497B564FD-47037"

To: doctor@nl2k.ca

Subject: =?UTF-8?Q?ACH_Funds_Transfer_Notification_?=

=?UTF-8?Q?=EF=BF=BD_July_9=2C_2026_=EF=BF=BD_07/13?=

=?UTF-8?Q?/2026_=EF=BF=BD_doctor=40nl2k=2Eca?=

Message-ID: <843e95be-4fa6-f266-397a-51df5eafa022@sabeng.it>

Content-Transfer-Encoding: quoted-printable

Date: Mon, 13 Jul 2026 22:09:32 +0000

MIME-Version: 1.0

Content-Type: text/html; charset=utf-8

X-Spam_score: 6.3

X-Spam_score_int: 63

X-Spam_bar: ++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview:  Payment Due: 13/07/2026 033747 Amount Paid: $3,378.00



Content analysis details: (6.3 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[192.210.236.148 listed in dnsbl.ahbl.org]

[192.210.236.148 listed in dnsbl.ahbl.org]

[192.210.236.148 listed in dnsbl.ahbl.org]

[192.210.236.148 listed in dnsbl.ahbl.org]

[209.85.210.103 listed in dnsbl.ahbl.org]

[209.85.210.103 listed in dnsbl.ahbl.org]

[209.85.210.103 listed in dnsbl.ahbl.org]

[209.85.210.103 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[192.210.236.148 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[192.210.236.148 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[192.210.236.148 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[192.210.236.148 listed in dnsbl.ahbl.org]

1.2 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a relay in bl.spamcop.net

[Blocked - see ]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[192.210.236.148 listed in will-spam-for-food.eu.org]

[192.210.236.148 listed in will-spam-for-food.eu.org]

[192.210.236.148 listed in will-spam-for-food.eu.org]

[192.210.236.148 listed in will-spam-for-food.eu.org]

[192.210.236.148 listed in will-spam-for-food.eu.org]

[192.210.236.148 listed in will-spam-for-food.eu.org]

[192.210.236.148 listed in will-spam-for-food.eu.org]

[192.210.236.148 listed in will-spam-for-food.eu.org]

[209.85.210.103 listed in will-spam-for-food.eu.org]

[209.85.210.103 listed in will-spam-for-food.eu.org]

[209.85.210.103 listed in will-spam-for-food.eu.org]

[209.85.210.103 listed in will-spam-for-food.eu.org]

[209.85.210.103 listed in will-spam-for-food.eu.org]

[209.85.210.103 listed in will-spam-for-food.eu.org]

[209.85.210.103 listed in will-spam-for-food.eu.org]

[209.85.210.103 listed in will-spam-for-food.eu.org]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[209.85.210.103 listed in list.dnswl.org]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-0.0 SPF_PASS SPF: sender matches SPF record

-0.0 RCVD_IN_MSPIKE_H3 RBL: Good reputation (+3)

[209.85.210.103 listed in wl.mailspike.net]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[209.85.210.103 listed in bl.score.senderscore.com]

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 LOTS_OF_MONEY Huge... sums of money

0.0 NO_RDNS2 Sending MTA has no reverse DNS

0.6 HTML_MIME_NO_HTML_TAG HTML-only message, but there is no HTML tag

-0.0 RCVD_IN_MSPIKE_WL Mailspike good senders

2.0 RATWR8_MESSID Message-ID with excessive dashes and dollars

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

Subject: {SPAM?} =?UTF-8?Q?ACH_Funds_Transfer_Notification_?=

=?UTF-8?Q?=EF=BF=BD_July_9=2C_2026_=EF=BF=BD_07/13?=

=?UTF-8?Q?/2026_=EF=BF=BD_doctor=40nl2k=2Eca?=

Remittance phish from Google Gmail Part 2

Posted by Dave Yadallee on




=EF=BB=BF


 




, 255, 255);color:rgb(34, 34, 34);font-family:Arial, Helvetica, =

sans-serif;font-size:small;font-style:normal;font-variant-caps:normal;font-=

variant-ligatures:normal;font-weight:400;letter-spacing:normal;orphans:2;te=

xt-align:start;text-decoration-color:initial;text-decoration-style:initial;=

text-decoration-thickness:initial;text-indent:0px;text-transform:none;white=

-space:normal;widows:2;word-spacing:0px;" type=3D"cite">




t;" id=3D"m_-2910760642012011069m_467061415371348611m_4273285105508718137m_=

-599886662404354667editbody1">


7061415371348611m_4273285105508718137m_-599886662404354667v1editbody1">


m_467061415371348611m_4273285105508718137m_-599886662404354667v1v1editbody1=

">






-width:0px;font-family:Arial, Helvetica, sans-serif;font-feature-settings:&=

quot;liga" 0;font-size:small;line-height:normal;" cellspacing=3D"0" =

width=3D"553">




























10, 139, 168);border-width:0px;margin:0px;padding:0in;vertical-align:top;" =

colspan=3D"3">




style=3D"border-collapse:collapse;border-width:0px;font-family:-apple-syste=

m, BlinkMacSystemFont, "Helvetica Neue", "Segoe UI", =

Arial, sans-serif, "Apple Color Emoji", "Segoe UI =

Emoji", "Segoe UI Symbol";font-feature-settings:"liga&q=

uot; 0;font-size:13px;line-height:normal;" cellspacing=3D"0">




style=3D"height:5.25pt;">














style=3D"border-width:0px;height:5.25pt;margin:0px;padding:0in;"> 
>


style=3D"border-width:0px;margin:0px;padding:0in;width:0.25in;" =

width=3D"24"> 
style=3D"border-width:0px;margin:0px;padding:0in;">


style=3D"font-family:-apple-system, BlinkMacSystemFont, "Helvetica =

Neue", "Segoe UI", Arial, sans-serif, "Apple Color =

Emoji", "Segoe UI Emoji", "Segoe UI =

Symbol";margin:0px;">
sans-serif;font-size:13.5pt;">   





92, 208, 228);border-width:0px;margin:0px;padding:0in;width:1.5pt;" =

width=3D"2"> 
n:0px;padding:0in;">




style=3D"border-collapse:collapse;border-width:0px;font-family:-apple-syste=

m, BlinkMacSystemFont, "Helvetica Neue", "Segoe UI", =

Arial, sans-serif, "Apple Color Emoji", "Segoe UI =

Emoji", "Segoe UI Symbol";font-feature-settings:"liga&q=

uot; 0;font-size:13px;line-height:normal;" cellspacing=3D"0">












style=3D"background-color:rgb(230, 236, 244);border-width:0px;margin:0px;pa=

dding:0in;width:411.75pt;" width=3D"549">


class=3D"table" style=3D"width:411.75pt;">


style=3D"border-collapse:collapse;border-width:0px;font-family:-apple-syste=

m, BlinkMacSystemFont, "Helvetica Neue", "Segoe UI", =

Arial, sans-serif, "Apple Color Emoji", "Segoe UI =

Emoji", "Segoe UI Symbol";font-feature-settings:"liga&q=

uot; 0;line-height:normal;" cellspacing=3D"0" width=3D"549">

=



=



=



=



=



=



=



=



=



=



=



=



=



=



=


width=3D"24"> 
p;">

=


"Helvetica Neue", "Segoe UI", Arial, sans-serif, =

"Apple Color Emoji", "Segoe UI Emoji", "Segoe UI =

Symbol";margin:0px;">

64);font-family:Helvetica, sans-serif;font-size:13.5pt;">Payment&nb=

sp;   
style=3D"color:rgb(231,123,7);font-family:Helvetica, sans-serif;font-size:7=

.5pt;">Due: 13/07/2026

168);font-family:Helvetica, sans-serif;font-size:10.=

5pt;">033747



=
ttom;">

=


"Helvetica Neue", "Segoe UI", Arial, sans-serif, =

"Apple Color Emoji", "Segoe UI Emoji", "Segoe UI =

Symbol";margin:0px;text-align:right;">
62);font-family:Helvetica, sans-serif;font-size:10.5pt;">Amount =

Paid:  
62);font-family:Helvetica, sans-serif;font-size:22.5pt;">$3,378.=

00



=
width=3D"24"> 
=

 		 =

 		 =

 		 =

 






Remittance phish from Google Gmail Part 3

Posted by Dave Yadallee on



system, BlinkMacSystemFont, "Helvetica Neue", "Segoe =

UI", Arial, sans-serif, "Apple Color Emoji", "Segoe UI =

Emoji", "Segoe UI Symbol";margin:0px;"> 




style=3D"width:411.75pt;">


style=3D"border-collapse:collapse;border-width:0px;font-family:-apple-syste=

m, BlinkMacSystemFont, "Helvetica Neue", "Segoe UI", =

Arial, sans-serif, "Apple Color Emoji", "Segoe UI =

Emoji", "Segoe UI Symbol";font-feature-settings:"liga&q=

uot; 0;font-size:13px;line-height:normal;" cellspacing=3D"0" =

width=3D"549">












style=3D"border-width:0px;margin:0px;padding:0in;vertical-align:top;">


class=3D"table" style=3D"width:411.75pt;">


style=3D"border-bottom-style:solid;border-bottom-width:3pt;border-collapse:=

collapse;border-color:initial;border-left-style:none;border-left-width:medi=

um;border-right-style:none;border-right-width:medium;border-top-style:none;=

border-top-width:medium;font-family:-apple-system, BlinkMacSystemFont, =

"Helvetica Neue", "Segoe UI", Arial, sans-serif, =

"Apple Color Emoji", "Segoe UI Emoji", "Segoe UI =

Symbol";font-feature-settings:"liga" 0;line-height:normal;" =

cellspacing=3D"0" width=3D"549">

=



=



=



=



=



=



=



=


"Helvetica Neue", "Segoe UI", Arial, sans-serif, =

"Apple Color Emoji", "Segoe UI Emoji", "Segoe UI =

Symbol";line-height:12pt;margin:0px;">
tica, sans-serif;font-size:10.5pt;">Hello 
style=3D"font-family:Arial, Helvetica, sans-serif;font-size:small;">Dear =

Customer,
sans-serif;font-size:10.5pt;">,



=


"Helvetica Neue", "Segoe UI", Arial, sans-serif, =

"Apple Color Emoji", "Segoe UI Emoji", "Segoe UI =

Symbol";line-height:12pt;margin:0px;"> 



=


"Helvetica Neue", "Segoe UI", Arial, sans-serif, =

"Apple Color Emoji", "Segoe UI Emoji", "Segoe UI =

Symbol";line-height:12pt;margin:0px;">
tica, sans-serif;font-size:10.5pt;">Payment has been remitted into your =

account with receipt for your reference.



=


"Helvetica Neue", "Segoe UI", Arial, sans-serif, =

"Apple Color Emoji", "Segoe UI Emoji", "Segoe UI =

Symbol";line-height:12pt;margin:0px;"> 



=


"Helvetica Neue", "Segoe UI", Arial, sans-serif, =

"Apple Color Emoji", "Segoe UI Emoji", "Segoe UI =

Symbol";line-height:12pt;margin:0px;">
(110, 139, 168);border-radius:4px;color:white;display:inline-block;font-fam=

ily:Helvetica, sans-serif;font-size:10.5pt;padding:8px =

16px;text-decoration-line:none;" href=3D"https://distropical.com/th.=

php">VIEW PAYMENT RECEIPT



=


"Helvetica Neue", "Segoe UI", Arial, sans-serif, =

"Apple Color Emoji", "Segoe UI Emoji", "Segoe UI =

Symbol";line-height:12pt;margin:0px;"> 



=


"Helvetica Neue", "Segoe UI", Arial, sans-serif, =

"Apple Color Emoji", "Segoe UI Emoji", "Segoe UI =

Symbol";line-height:12pt;margin:0px;">
tica, sans-serif;font-size:10.5pt;">Thank you for your business.=



Sincerely,

Finance Department



=



=





class=3D"table">


style=3D"border-collapse:collapse;border-width:0px;font-family:-apple-syste=

m, BlinkMacSystemFont, "Helvetica Neue", "Segoe UI", =

Arial, sans-serif, "Apple Color Emoji", "Segoe UI =

Emoji", "Segoe UI Symbol";font-feature-settings:"liga&q=

uot; 0;line-height:normal;" cellspacing=3D"0">

=



=



=



=



=



=

=

 









92, 208, 228);border-width:0px;margin:0px;padding:0in;width:1.5pt;" =

width=3D"2"> 

1, 50, 70);border-width:0px;margin:0px;padding:0in;" colspan=3D"3">


system, BlinkMacSystemFont, "Helvetica Neue", "Segoe =

UI", Arial, sans-serif, "Apple Color Emoji", "Segoe UI =

Emoji", "Segoe UI Symbol";margin:0px;text-align:right;">&nbs=

p;






















Remittance phish from Google Gmail Part 1

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Mon, 13 Jul 2026 16:12:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wjOsC-00000000MJW-1DSa

for dave@doctor.nl2k.ab.ca;

Mon, 13 Jul 2026 16:11:36 -0600

Resent-From: The Doctor

Resent-Date: Mon, 13 Jul 2026 16:11:36 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-oo1-f104.google.com ([209.85.161.104]:61490)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wjOr3-00000000MDe-3acn

for doctor@doctor.nl2k.ab.ca;

Mon, 13 Jul 2026 16:10:38 -0600

Received: by mail-oo1-f104.google.com with SMTP id 006d021491bc7-6a3776acb16so260886eaf.2

for ; Mon, 13 Jul 2026 15:09:39 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=sabeng.it; s=google; t=1783980573; x=1784585373; darn=doctor.nl2k.ab.ca;

h=content-type:mime-version:date:content-transfer-encoding:message-id

:subject:to:from:from:to:cc:subject:date:message-id:reply-to

:content-type;

bh=SQeYhuGtuot8NB4/jQiU1QF7G5cKOkSJgl7Tik7+V1Q=;

b=iQSJAU4FSEAPmfzsMfKanmkqLUk/nqUzL2w/oBJQ71qynPwglYoUCKyG26NAOg5ki1

BY5WbaWWlczsI57CmuW+CNgKOcho6cwxxrtGuoyIIyPg0y8cvzNpNlfIGUzPSbQwDypg

MK6xboL1RrilQVO7SCMZ2+GlQr4nHznwnhrak=

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20251104; t=1783980573; x=1784585373;

h=content-type:mime-version:date:content-transfer-encoding:message-id

:subject:to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date

:message-id:reply-to:content-type;

bh=SQeYhuGtuot8NB4/jQiU1QF7G5cKOkSJgl7Tik7+V1Q=;

b=rUdFU8Da1eblkmkno997+mKSREriJXL+I0lG45GkN0m0XAHrYktWjGQCgrFsI8KLJu

nFpb2VlrtGx1EVTrvI0j0Ejv6dVuYaPdZV52vI5FKCPndslihjm4C1j99Wy2sl6RW/7c

T22Hu6yvNZ7uG70DSbdcNjg/H7MgNXiLMEt0BGOIQT52ZNZm6wRbunHoOzeMn/biJ3se

JheYnUO4szJiRAv+mGt+QmQcQEi1/1hxN3B9yHr3t1/lCdl2k9ddxBUlGkooZkXsH2Y9

B/sTqhWsOTklgEAI4VGFrW0kuBw55VmIzog4rTw5Ulh+J1LL9aVdJvrRnAtVUIT1OhAX

+rHA==

X-Gm-Message-State: AOJu0Yy1wTv4Az5t1GMCMfxvyq4RaEmFIH746/Utk2xOoUeqNEdzhVe5

HWnNZDpS011EtNjDpTiUWzxQ787tnxxlPleCchBsIcTl2geyWhcPg1uvzMGJ+UaYhvElYhnEdsm

QxZ3SwBBkCy7c9HvDi3Ezke/ZpJ/hVCSC3ux6nPB0QZPZHQY=

X-Gm-Gg: AfdE7cn4cg+4A/2yNqoVdWRP9dzjvsx2KPr8rg+tLr8JTjlYUwb7JwSSf0AokSHdMXH

dK6VNf1AcwFG5+ZNghwL/a7QW3fQ4YKioDsVD8HYhIaCQ67eecSvRj1E8G1+Oq+uPrJbpLUHoY7

0gkBIhVMjpBz0KRTJ5eP1MBQWgB0039tT2h8rGoBxfLh1cI6Ljp6BaiP2RittdKX4ag33lrz+pD

PiR1jZHoqgD3Y8UaMVFW1ASRaiMSo1Qh8OQKDNKleGx6OPf2j3D3vfbl1XRfhNuxP3Vj6n+3HWh

1r9mYQ/L2FTAQSgsXAhUFlwT5Zq2t0KDSXk/5cZPLT8CxpJ2s/CKevdoDBQw3rbZ+NqDSAU78q5

0xTz9vFaObvvmfBYzif0rdXU=

X-Received: by 2002:a05:6820:1b05:b0:6a1:60cd:9854 with SMTP id 006d021491bc7-6a39a7222d1mr6460046eaf.53.1783980572857;

Mon, 13 Jul 2026 15:09:32 -0700 (PDT)

Received: from sabprogetti.com ([192.210.236.148])

by smtp-relay.gmail.com with ESMTPS id 006d021491bc7-6a387892d32sm542134eaf.25.2026.07.13.15.09.32

for

(version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256);

Mon, 13 Jul 2026 15:09:32 -0700 (PDT)

X-Relaying-Domain: sabeng.it

From: "alert@remittance.com | EFT Portal/OU=EXCHANGE ADMINISTRATIVE GROUP

(FYDIBOHF23SPDLT)/CN=RECIPIENTS/CN=B7A707497B564FD-10700"



To: doctor@doctor.nl2k.ab.ca

Subject: =?UTF-8?Q?ACH_Payment_Processed_=EF=BF=BD_Thu=2C_J?=

=?UTF-8?Q?uly_9=2C_2026_=EF=BF=BD_07/13/2026_?=

=?UTF-8?Q?=EF=BF=BD_doctor=40doctor=2Enl2k=2Eab=2E?= =?UTF-8?Q?ca?=

Message-ID: <97c00ed5-e038-3336-0a79-8bd3fbb0edc8@sabeng.it>

Content-Transfer-Encoding: quoted-printable

Date: Mon, 13 Jul 2026 22:09:31 +0000

MIME-Version: 1.0

Content-Type: text/html; charset=utf-8

X-Spam_score: 6.3

X-Spam_score_int: 63

X-Spam_bar: ++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview:  Payment Due: 13/07/2026 033747 Amount Paid: $3,378.00



Content analysis details: (6.3 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[192.210.236.148 listed in dnsbl.ahbl.org]

[192.210.236.148 listed in dnsbl.ahbl.org]

[192.210.236.148 listed in dnsbl.ahbl.org]

[192.210.236.148 listed in dnsbl.ahbl.org]

[209.85.161.104 listed in dnsbl.ahbl.org]

[209.85.161.104 listed in dnsbl.ahbl.org]

[209.85.161.104 listed in dnsbl.ahbl.org]

[209.85.161.104 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[192.210.236.148 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[192.210.236.148 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[192.210.236.148 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[192.210.236.148 listed in dnsbl.ahbl.org]

1.2 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a relay in bl.spamcop.net

[Blocked - see ]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[192.210.236.148 listed in will-spam-for-food.eu.org]

[192.210.236.148 listed in will-spam-for-food.eu.org]

[192.210.236.148 listed in will-spam-for-food.eu.org]

[192.210.236.148 listed in will-spam-for-food.eu.org]

[192.210.236.148 listed in will-spam-for-food.eu.org]

[192.210.236.148 listed in will-spam-for-food.eu.org]

[192.210.236.148 listed in will-spam-for-food.eu.org]

[192.210.236.148 listed in will-spam-for-food.eu.org]

[209.85.161.104 listed in will-spam-for-food.eu.org]

[209.85.161.104 listed in will-spam-for-food.eu.org]

[209.85.161.104 listed in will-spam-for-food.eu.org]

[209.85.161.104 listed in will-spam-for-food.eu.org]

[209.85.161.104 listed in will-spam-for-food.eu.org]

[209.85.161.104 listed in will-spam-for-food.eu.org]

[209.85.161.104 listed in will-spam-for-food.eu.org]

[209.85.161.104 listed in will-spam-for-food.eu.org]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[209.85.161.104 listed in list.dnswl.org]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-0.0 SPF_PASS SPF: sender matches SPF record

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[209.85.161.104 listed in bl.score.senderscore.com]

-0.0 RCVD_IN_MSPIKE_H3 RBL: Good reputation (+3)

[209.85.161.104 listed in wl.mailspike.net]

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

2.0 RATWR8_MESSID Message-ID with excessive dashes and dollars

-0.0 RCVD_IN_MSPIKE_WL Mailspike good senders

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

0.0 LOTS_OF_MONEY Huge... sums of money

0.0 NO_RDNS2 Sending MTA has no reverse DNS

0.6 HTML_MIME_NO_HTML_TAG HTML-only message, but there is no HTML tag

Subject: {SPAM?} =?UTF-8?Q?ACH_Payment_Processed_=EF=BF=BD_Thu=2C_J?=

=?UTF-8?Q?uly_9=2C_2026_=EF=BF=BD_07/13/2026_?=

=?UTF-8?Q?=EF=BF=BD_doctor=40doctor=2Enl2k=2Eab=2E?= =?UTF-8?Q?ca?=

Remittance phish from Google Gmail Part 3

Posted by Dave Yadallee on


system, BlinkMacSystemFont, "Helvetica Neue", "Segoe =

UI", Arial, sans-serif, "Apple Color Emoji", "Segoe UI =

Emoji", "Segoe UI Symbol";margin:0px;"> 




style=3D"width:411.75pt;">


style=3D"border-collapse:collapse;border-width:0px;font-family:-apple-syste=

m, BlinkMacSystemFont, "Helvetica Neue", "Segoe UI", =

Arial, sans-serif, "Apple Color Emoji", "Segoe UI =

Emoji", "Segoe UI Symbol";font-feature-settings:"liga&q=

uot; 0;font-size:13px;line-height:normal;" cellspacing=3D"0" =

width=3D"549">












style=3D"border-width:0px;margin:0px;padding:0in;vertical-align:top;">


class=3D"table" style=3D"width:411.75pt;">


style=3D"border-bottom-style:solid;border-bottom-width:3pt;border-collapse:=

collapse;border-color:initial;border-left-style:none;border-left-width:medi=

um;border-right-style:none;border-right-width:medium;border-top-style:none;=

border-top-width:medium;font-family:-apple-system, BlinkMacSystemFont, =

"Helvetica Neue", "Segoe UI", Arial, sans-serif, =

"Apple Color Emoji", "Segoe UI Emoji", "Segoe UI =

Symbol";font-feature-settings:"liga" 0;line-height:normal;" =

cellspacing=3D"0" width=3D"549">

=



=



=



=



=



=



=



=


"Helvetica Neue", "Segoe UI", Arial, sans-serif, =

"Apple Color Emoji", "Segoe UI Emoji", "Segoe UI =

Symbol";line-height:12pt;margin:0px;">
tica, sans-serif;font-size:10.5pt;">Hello 
style=3D"font-family:Arial, Helvetica, sans-serif;font-size:small;">Dear =

Customer,
sans-serif;font-size:10.5pt;">,



=


"Helvetica Neue", "Segoe UI", Arial, sans-serif, =

"Apple Color Emoji", "Segoe UI Emoji", "Segoe UI =

Symbol";line-height:12pt;margin:0px;"> 



=


"Helvetica Neue", "Segoe UI", Arial, sans-serif, =

"Apple Color Emoji", "Segoe UI Emoji", "Segoe UI =

Symbol";line-height:12pt;margin:0px;">
tica, sans-serif;font-size:10.5pt;">Payment has been remitted into your =

account with receipt for your reference.



=


"Helvetica Neue", "Segoe UI", Arial, sans-serif, =

"Apple Color Emoji", "Segoe UI Emoji", "Segoe UI =

Symbol";line-height:12pt;margin:0px;"> 



=


"Helvetica Neue", "Segoe UI", Arial, sans-serif, =

"Apple Color Emoji", "Segoe UI Emoji", "Segoe UI =

Symbol";line-height:12pt;margin:0px;">
(110, 139, 168);border-radius:4px;color:white;display:inline-block;font-fam=

ily:Helvetica, sans-serif;font-size:10.5pt;padding:8px =

16px;text-decoration-line:none;" href=3D"https://distropical.com/th.=

php">VIEW PAYMENT RECEIPT



=


"Helvetica Neue", "Segoe UI", Arial, sans-serif, =

"Apple Color Emoji", "Segoe UI Emoji", "Segoe UI =

Symbol";line-height:12pt;margin:0px;"> 



=


"Helvetica Neue", "Segoe UI", Arial, sans-serif, =

"Apple Color Emoji", "Segoe UI Emoji", "Segoe UI =

Symbol";line-height:12pt;margin:0px;">
tica, sans-serif;font-size:10.5pt;">Thank you for your business.=



Sincerely,

Finance Department



=



=





class=3D"table">


style=3D"border-collapse:collapse;border-width:0px;font-family:-apple-syste=

m, BlinkMacSystemFont, "Helvetica Neue", "Segoe UI", =

Arial, sans-serif, "Apple Color Emoji", "Segoe UI =

Emoji", "Segoe UI Symbol";font-feature-settings:"liga&q=

uot; 0;line-height:normal;" cellspacing=3D"0">

=



=



=



=



=



=

=

 











92, 208, 228);border-width:0px;margin:0px;padding:0in;width:1.5pt;" =

width=3D"2"> 






1, 50, 70);border-width:0px;margin:0px;padding:0in;" colspan=3D"3">


system, BlinkMacSystemFont, "Helvetica Neue", "Segoe =

UI", Arial, sans-serif, "Apple Color Emoji", "Segoe UI =

Emoji", "Segoe UI Symbol";margin:0px;text-align:right;">&nbs=

p;























Remittance phish from Google Gmail Part 2

Posted by Dave Yadallee on
=EF=BB=BF


 




, 255, 255);color:rgb(34, 34, 34);font-family:Arial, Helvetica, =

sans-serif;font-size:small;font-style:normal;font-variant-caps:normal;font-=

variant-ligatures:normal;font-weight:400;letter-spacing:normal;orphans:2;te=

xt-align:start;text-decoration-color:initial;text-decoration-style:initial;=

text-decoration-thickness:initial;text-indent:0px;text-transform:none;white=

-space:normal;widows:2;word-spacing:0px;" type=3D"cite">




t;" id=3D"m_-2910760642012011069m_467061415371348611m_4273285105508718137m_=

-599886662404354667editbody1">


7061415371348611m_4273285105508718137m_-599886662404354667v1editbody1">


m_467061415371348611m_4273285105508718137m_-599886662404354667v1v1editbody1=

">






-width:0px;font-family:Arial, Helvetica, sans-serif;font-feature-settings:&=

quot;liga" 0;font-size:small;line-height:normal;" cellspacing=3D"0" =

width=3D"553">




























10, 139, 168);border-width:0px;margin:0px;padding:0in;vertical-align:top;" =

colspan=3D"3">




style=3D"border-collapse:collapse;border-width:0px;font-family:-apple-syste=

m, BlinkMacSystemFont, "Helvetica Neue", "Segoe UI", =

Arial, sans-serif, "Apple Color Emoji", "Segoe UI =

Emoji", "Segoe UI Symbol";font-feature-settings:"liga&q=

uot; 0;font-size:13px;line-height:normal;" cellspacing=3D"0">




style=3D"height:5.25pt;">














style=3D"border-width:0px;height:5.25pt;margin:0px;padding:0in;"> 
>


style=3D"border-width:0px;margin:0px;padding:0in;width:0.25in;" =

width=3D"24"> 
style=3D"border-width:0px;margin:0px;padding:0in;">


style=3D"font-family:-apple-system, BlinkMacSystemFont, "Helvetica =

Neue", "Segoe UI", Arial, sans-serif, "Apple Color =

Emoji", "Segoe UI Emoji", "Segoe UI =

Symbol";margin:0px;">
sans-serif;font-size:13.5pt;">   





92, 208, 228);border-width:0px;margin:0px;padding:0in;width:1.5pt;" =

width=3D"2"> 
n:0px;padding:0in;">




style=3D"border-collapse:collapse;border-width:0px;font-family:-apple-syste=

m, BlinkMacSystemFont, "Helvetica Neue", "Segoe UI", =

Arial, sans-serif, "Apple Color Emoji", "Segoe UI =

Emoji", "Segoe UI Symbol";font-feature-settings:"liga&q=

uot; 0;font-size:13px;line-height:normal;" cellspacing=3D"0">












style=3D"background-color:rgb(230, 236, 244);border-width:0px;margin:0px;pa=

dding:0in;width:411.75pt;" width=3D"549">


class=3D"table" style=3D"width:411.75pt;">


style=3D"border-collapse:collapse;border-width:0px;font-family:-apple-syste=

m, BlinkMacSystemFont, "Helvetica Neue", "Segoe UI", =

Arial, sans-serif, "Apple Color Emoji", "Segoe UI =

Emoji", "Segoe UI Symbol";font-feature-settings:"liga&q=

uot; 0;line-height:normal;" cellspacing=3D"0" width=3D"549">

=



=



=



=



=



=



=



=



=



=



=



=



=



=



=


width=3D"24"> 
p;">

=


"Helvetica Neue", "Segoe UI", Arial, sans-serif, =

"Apple Color Emoji", "Segoe UI Emoji", "Segoe UI =

Symbol";margin:0px;">

64);font-family:Helvetica, sans-serif;font-size:13.5pt;">Payment&nb=

sp;   
style=3D"color:rgb(231,123,7);font-family:Helvetica, sans-serif;font-size:7=

.5pt;">Due: 13/07/2026

168);font-family:Helvetica, sans-serif;font-size:10.=

5pt;">033747



=
ttom;">

=


"Helvetica Neue", "Segoe UI", Arial, sans-serif, =

"Apple Color Emoji", "Segoe UI Emoji", "Segoe UI =

Symbol";margin:0px;text-align:right;">
62);font-family:Helvetica, sans-serif;font-size:10.5pt;">Amount =

Paid:  
62);font-family:Helvetica, sans-serif;font-size:22.5pt;">$3,378.=

00



=
width=3D"24"> 
=

 		 =

 		 =

 		 =

 






Remittance phish from Google Gmail Part 1

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Mon, 13 Jul 2026 16:12:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wjOsF-00000000MJm-2ANX

for dave@doctor.nl2k.ab.ca;

Mon, 13 Jul 2026 16:11:39 -0600

Resent-From: The Doctor

Resent-Date: Mon, 13 Jul 2026 16:11:39 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-pl1-f229.google.com ([209.85.214.229]:48445)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wjOr3-00000000MDi-3cXD

for doctor@mail.nl2k.ab.ca;

Mon, 13 Jul 2026 16:10:38 -0600

Received: by mail-pl1-f229.google.com with SMTP id d9443c01a7336-2cce6a0c9c3so32621705ad.1

for ; Mon, 13 Jul 2026 15:09:39 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=sabeng.it; s=google; t=1783980573; x=1784585373; darn=mail.nl2k.ab.ca;

h=content-type:mime-version:date:content-transfer-encoding:message-id

:subject:to:from:from:to:cc:subject:date:message-id:reply-to

:content-type;

bh=SQeYhuGtuot8NB4/jQiU1QF7G5cKOkSJgl7Tik7+V1Q=;

b=OL8gavcHjVsRN7kI1lyeorh5HuPES7VWkVvSgXww7PggHEdhDLj5sXmvlteGu/Q/Ou

1Qf4RdaoLYfUdcU6aipmTiGotGUn2uYvxONtTAQeDRXycRXjUh8lID1Fpnwpc2l3g6Ec

qMDXSCfTtUiLFyQahlADjuvs5WSU170OQ6IuA=

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20251104; t=1783980573; x=1784585373;

h=content-type:mime-version:date:content-transfer-encoding:message-id

:subject:to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date

:message-id:reply-to:content-type;

bh=SQeYhuGtuot8NB4/jQiU1QF7G5cKOkSJgl7Tik7+V1Q=;

b=mkP9ada4GhnRNu8xsakmZOTcRG8CQfZz6Vs90gwh/CUOhfRJwqX7Mj5lpi1XqvLf4i

GWjUGEWDVs3CNvqn7A6CHklX40BI+Ib4UNGu/u9eglfmYenWunHTc3f1bIBRuluIyECd

QYCPFxddldjKBQ7ejusdlreUiN2lcJwQSLhIBDU+VrQpgOf+zKaMyJdMEz/CqzFmTSsA

zHpuVHq0rsb+RAz/Jb3yzmZC1Z9Rs8xnDMaGyk/q5QzNNmK/DMoPRs4krtIEcO73cQQ4

g9TQCIMGc/Xz6DwgvDzicMjv7FfJaiskp3SF71P78iX4VbvAR6St41Lgm+WPSM7s/lmd

pIQQ==

X-Gm-Message-State: AOJu0Ywep0EoNluz2JUq/E5Xhg42K53WP1vlh/gSQpoBPuAgChVd4Fqe

VbXUDp+Ohef0/iOz5/C8UsBOQ9ETgKAoqe+HbHwbBidm29dJUmgVyunUTKUAVMoHFZ9jYZt98TK

7R4POG84zFhwEn82MrLZHhmJsZOpU1YjO0lBVvlWCdcswtxw=

X-Gm-Gg: AfdE7cmGq9YX6jhOe93ZDoceGI50QkQhE7R3wk2vuKV7rLKOKDXvorVTDV3nfHm7AGE

hUbVHsP2byYL+y9nCkYMDSBXwwB9yAr+o+sSy/JCSenFpGPfFiFXp0OXaCxo/Hpqu/uQ6MvRc7I

Fd75nMdO60ja/Mt5131YFaIhZDbl4+1BImoMcHZHwBOkZzdT8MtSsolp2nqE5QsigTuFUst8yqb

s5sa4u4Pk3vEVHnCfqFwsvR0Mw62PcrBeL3oMSMGSI7p5g2xVNuQ8UmprLPFuTg6W4wDtsyjS8j

3nABpn1z+03Ao67u8NMc10PfOyGvd0t+YuAlmujtmjzRlWXRXvii0AEr1EtShJkExeZiB5ugAP8

l7NBASR6gkHzO2LMVGCCeKA==

X-Received: by 2002:a17:902:d2ca:b0:2c9:97a8:8c1b with SMTP id d9443c01a7336-2ce9f2948camr100384155ad.46.1783980573226;

Mon, 13 Jul 2026 15:09:33 -0700 (PDT)

Received: from sabprogetti.com ([192.210.236.148])

by smtp-relay.gmail.com with ESMTPS id d9443c01a7336-2ccc9ccd086sm21273355ad.35.2026.07.13.15.09.32

for

(version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256);

Mon, 13 Jul 2026 15:09:33 -0700 (PDT)

X-Relaying-Domain: sabeng.it

From: "alert@remittance.com | EFT Portal/OU=EXCHANGE ADMINISTRATIVE GROUP

(FYDIBOHF23SPDLT)/CN=RECIPIENTS/CN=B7A707497B564FD-78448"



To: doctor@mail.nl2k.ab.ca

Subject: =?UTF-8?Q?ACH_Payment_Status_Update_=EF=BF=BD_July?=

=?UTF-8?Q?_9=2C_2026_=EF=BF=BD_07/13/2026_?=

=?UTF-8?Q?=EF=BF=BD_doctor=40mail=2Enl2k=2Eab=2Eca?=

Message-ID: <7a9d77a6-dcc5-5e6b-29c9-a3104bfc1d24@sabeng.it>

Content-Transfer-Encoding: quoted-printable

Date: Mon, 13 Jul 2026 22:09:31 +0000

MIME-Version: 1.0

Content-Type: text/html; charset=utf-8

X-Spam_score: 6.3

X-Spam_score_int: 63

X-Spam_bar: ++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview:  Payment Due: 13/07/2026 033747 Amount Paid: $3,378.00



Content analysis details: (6.3 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[192.210.236.148 listed in dnsbl.ahbl.org]

[192.210.236.148 listed in dnsbl.ahbl.org]

[192.210.236.148 listed in dnsbl.ahbl.org]

[192.210.236.148 listed in dnsbl.ahbl.org]

[209.85.214.229 listed in dnsbl.ahbl.org]

[209.85.214.229 listed in dnsbl.ahbl.org]

[209.85.214.229 listed in dnsbl.ahbl.org]

[209.85.214.229 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[192.210.236.148 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[192.210.236.148 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[192.210.236.148 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[192.210.236.148 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[192.210.236.148 listed in will-spam-for-food.eu.org]

[192.210.236.148 listed in will-spam-for-food.eu.org]

[192.210.236.148 listed in will-spam-for-food.eu.org]

[192.210.236.148 listed in will-spam-for-food.eu.org]

[192.210.236.148 listed in will-spam-for-food.eu.org]

[192.210.236.148 listed in will-spam-for-food.eu.org]

[192.210.236.148 listed in will-spam-for-food.eu.org]

[192.210.236.148 listed in will-spam-for-food.eu.org]

[209.85.214.229 listed in will-spam-for-food.eu.org]

[209.85.214.229 listed in will-spam-for-food.eu.org]

[209.85.214.229 listed in will-spam-for-food.eu.org]

[209.85.214.229 listed in will-spam-for-food.eu.org]

[209.85.214.229 listed in will-spam-for-food.eu.org]

[209.85.214.229 listed in will-spam-for-food.eu.org]

[209.85.214.229 listed in will-spam-for-food.eu.org]

[209.85.214.229 listed in will-spam-for-food.eu.org]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[209.85.214.229 listed in list.dnswl.org]

1.2 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a relay in bl.spamcop.net

[Blocked - see ]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-0.0 SPF_PASS SPF: sender matches SPF record

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[209.85.214.229 listed in bl.score.senderscore.com]

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

2.0 RATWR8_MESSID Message-ID with excessive dashes and dollars

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

0.0 LOTS_OF_MONEY Huge... sums of money

0.0 NO_RDNS2 Sending MTA has no reverse DNS

0.6 HTML_MIME_NO_HTML_TAG HTML-only message, but there is no HTML tag

-0.0 RCVD_IN_MSPIKE_H3 RBL: Good reputation (+3)

[209.85.214.229 listed in wl.mailspike.net]

-0.0 RCVD_IN_MSPIKE_WL Mailspike good senders

Subject: {SPAM?} =?UTF-8?Q?ACH_Payment_Status_Update_=EF=BF=BD_July?=

=?UTF-8?Q?_9=2C_2026_=EF=BF=BD_07/13/2026_?=

=?UTF-8?Q?=EF=BF=BD_doctor=40mail=2Enl2k=2Eab=2Eca?=

Remittance phish from Google Gmail Part 3

Posted by Dave Yadallee on


system, BlinkMacSystemFont, "Helvetica Neue", "Segoe =

UI", Arial, sans-serif, "Apple Color Emoji", "Segoe UI =

Emoji", "Segoe UI Symbol";margin:0px;"> 




style=3D"width:411.75pt;">


style=3D"border-collapse:collapse;border-width:0px;font-family:-apple-syste=

m, BlinkMacSystemFont, "Helvetica Neue", "Segoe UI", =

Arial, sans-serif, "Apple Color Emoji", "Segoe UI =

Emoji", "Segoe UI Symbol";font-feature-settings:"liga&q=

uot; 0;font-size:13px;line-height:normal;" cellspacing=3D"0" =

width=3D"549">












style=3D"border-width:0px;margin:0px;padding:0in;vertical-align:top;">


class=3D"table" style=3D"width:411.75pt;">


style=3D"border-bottom-style:solid;border-bottom-width:3pt;border-collapse:=

collapse;border-color:initial;border-left-style:none;border-left-width:medi=

um;border-right-style:none;border-right-width:medium;border-top-style:none;=

border-top-width:medium;font-family:-apple-system, BlinkMacSystemFont, =

"Helvetica Neue", "Segoe UI", Arial, sans-serif, =

"Apple Color Emoji", "Segoe UI Emoji", "Segoe UI =

Symbol";font-feature-settings:"liga" 0;line-height:normal;" =

cellspacing=3D"0" width=3D"549">

=



=



=



=



=



=



=



=


"Helvetica Neue", "Segoe UI", Arial, sans-serif, =

"Apple Color Emoji", "Segoe UI Emoji", "Segoe UI =

Symbol";line-height:12pt;margin:0px;">
tica, sans-serif;font-size:10.5pt;">Hello 
style=3D"font-family:Arial, Helvetica, sans-serif;font-size:small;">Dear =

Customer,
sans-serif;font-size:10.5pt;">,



=


"Helvetica Neue", "Segoe UI", Arial, sans-serif, =

"Apple Color Emoji", "Segoe UI Emoji", "Segoe UI =

Symbol";line-height:12pt;margin:0px;"> 



=


"Helvetica Neue", "Segoe UI", Arial, sans-serif, =

"Apple Color Emoji", "Segoe UI Emoji", "Segoe UI =

Symbol";line-height:12pt;margin:0px;">
tica, sans-serif;font-size:10.5pt;">Payment has been remitted into your =

account with receipt for your reference.



=


"Helvetica Neue", "Segoe UI", Arial, sans-serif, =

"Apple Color Emoji", "Segoe UI Emoji", "Segoe UI =

Symbol";line-height:12pt;margin:0px;"> 



=


"Helvetica Neue", "Segoe UI", Arial, sans-serif, =

"Apple Color Emoji", "Segoe UI Emoji", "Segoe UI =

Symbol";line-height:12pt;margin:0px;">
(110, 139, 168);border-radius:4px;color:white;display:inline-block;font-fam=

ily:Helvetica, sans-serif;font-size:10.5pt;padding:8px =

16px;text-decoration-line:none;" href=3D"https://distropical.com/th.=

php">VIEW PAYMENT RECEIPT



=


"Helvetica Neue", "Segoe UI", Arial, sans-serif, =

"Apple Color Emoji", "Segoe UI Emoji", "Segoe UI =

Symbol";line-height:12pt;margin:0px;"> 



=


"Helvetica Neue", "Segoe UI", Arial, sans-serif, =

"Apple Color Emoji", "Segoe UI Emoji", "Segoe UI =

Symbol";line-height:12pt;margin:0px;">
tica, sans-serif;font-size:10.5pt;">Thank you for your business.=



Sincerely,

Finance Department



=



=





class=3D"table">


style=3D"border-collapse:collapse;border-width:0px;font-family:-apple-syste=

m, BlinkMacSystemFont, "Helvetica Neue", "Segoe UI", =

Arial, sans-serif, "Apple Color Emoji", "Segoe UI =

Emoji", "Segoe UI Symbol";font-feature-settings:"liga&q=

uot; 0;line-height:normal;" cellspacing=3D"0">

=



=



=



=



=



=

=

 









92, 208, 228);border-width:0px;margin:0px;padding:0in;width:1.5pt;" =

width=3D"2"> 

1, 50, 70);border-width:0px;margin:0px;padding:0in;" colspan=3D"3">


system, BlinkMacSystemFont, "Helvetica Neue", "Segoe =

UI", Arial, sans-serif, "Apple Color Emoji", "Segoe UI =

Emoji", "Segoe UI Symbol";margin:0px;text-align:right;">&nbs=

p;
















Remittance phish from Google Gmail Part 2

Posted by Dave Yadallee on
=EF=BB=BF


 




, 255, 255);color:rgb(34, 34, 34);font-family:Arial, Helvetica, =

sans-serif;font-size:small;font-style:normal;font-variant-caps:normal;font-=

variant-ligatures:normal;font-weight:400;letter-spacing:normal;orphans:2;te=

xt-align:start;text-decoration-color:initial;text-decoration-style:initial;=

text-decoration-thickness:initial;text-indent:0px;text-transform:none;white=

-space:normal;widows:2;word-spacing:0px;" type=3D"cite">




t;" id=3D"m_-2910760642012011069m_467061415371348611m_4273285105508718137m_=

-599886662404354667editbody1">


7061415371348611m_4273285105508718137m_-599886662404354667v1editbody1">


m_467061415371348611m_4273285105508718137m_-599886662404354667v1v1editbody1=

">






-width:0px;font-family:Arial, Helvetica, sans-serif;font-feature-settings:&=

quot;liga" 0;font-size:small;line-height:normal;" cellspacing=3D"0" =

width=3D"553">














10, 139, 168);border-width:0px;margin:0px;padding:0in;vertical-align:top;" =

colspan=3D"3">




style=3D"border-collapse:collapse;border-width:0px;font-family:-apple-syste=

m, BlinkMacSystemFont, "Helvetica Neue", "Segoe UI", =

Arial, sans-serif, "Apple Color Emoji", "Segoe UI =

Emoji", "Segoe UI Symbol";font-feature-settings:"liga&q=

uot; 0;font-size:13px;line-height:normal;" cellspacing=3D"0">




style=3D"height:5.25pt;">














style=3D"border-width:0px;height:5.25pt;margin:0px;padding:0in;"> 
>


style=3D"border-width:0px;margin:0px;padding:0in;width:0.25in;" =

width=3D"24"> 
style=3D"border-width:0px;margin:0px;padding:0in;">


style=3D"font-family:-apple-system, BlinkMacSystemFont, "Helvetica =

Neue", "Segoe UI", Arial, sans-serif, "Apple Color =

Emoji", "Segoe UI Emoji", "Segoe UI =

Symbol";margin:0px;">
sans-serif;font-size:13.5pt;">   





92, 208, 228);border-width:0px;margin:0px;padding:0in;width:1.5pt;" =

width=3D"2"> 
n:0px;padding:0in;">




style=3D"border-collapse:collapse;border-width:0px;font-family:-apple-syste=

m, BlinkMacSystemFont, "Helvetica Neue", "Segoe UI", =

Arial, sans-serif, "Apple Color Emoji", "Segoe UI =

Emoji", "Segoe UI Symbol";font-feature-settings:"liga&q=

uot; 0;font-size:13px;line-height:normal;" cellspacing=3D"0">












style=3D"background-color:rgb(230, 236, 244);border-width:0px;margin:0px;pa=

dding:0in;width:411.75pt;" width=3D"549">


class=3D"table" style=3D"width:411.75pt;">


style=3D"border-collapse:collapse;border-width:0px;font-family:-apple-syste=

m, BlinkMacSystemFont, "Helvetica Neue", "Segoe UI", =

Arial, sans-serif, "Apple Color Emoji", "Segoe UI =

Emoji", "Segoe UI Symbol";font-feature-settings:"liga&q=

uot; 0;line-height:normal;" cellspacing=3D"0" width=3D"549">

=



=



=



=



=



=



=



=



=



=



=



=



=



=



=


width=3D"24"> 
p;">

=


"Helvetica Neue", "Segoe UI", Arial, sans-serif, =

"Apple Color Emoji", "Segoe UI Emoji", "Segoe UI =

Symbol";margin:0px;">

64);font-family:Helvetica, sans-serif;font-size:13.5pt;">Payment&nb=

sp;   
style=3D"color:rgb(231,123,7);font-family:Helvetica, sans-serif;font-size:7=

.5pt;">Due: 13/07/2026

168);font-family:Helvetica, sans-serif;font-size:10.=

5pt;">033747



=
ttom;">

=


"Helvetica Neue", "Segoe UI", Arial, sans-serif, =

"Apple Color Emoji", "Segoe UI Emoji", "Segoe UI =

Symbol";margin:0px;text-align:right;">
62);font-family:Helvetica, sans-serif;font-size:10.5pt;">Amount =

Paid:  
62);font-family:Helvetica, sans-serif;font-size:22.5pt;">$3,378.=

00



=
width=3D"24"> 
=

 		 =

 		 =

 		 =