Chinese products spam Part 2

Posted by Dave Yadallee on


------=_Part_312081_885067890.1781077947025

Content-Type: text/html; charset="utf-8"

Content-Transfer-Encoding: 7bit













Dear Purchasing Manager,







Good day!







This is Vivian from a professional hotel furniture manufacturer in China.







We specialize in custom hotel bedroom sets, lobby furniture, restaurant and resort furniture for global clients.







We can handle both small projects and large hotel chain orders with stable quality and fast lead time.







Our products are widely sold to America, Europe, the Middle East, Southeast Asia, Australia and other international markets. We have rich experience working with hotel contractors, project designers and furniture wholesalers.







We provide one-stop service including custom design, OEM/ODM, factory direct price, quality inspection and after-sales support.







If you are looking for a reliable, cost-effective and professional hotel furniture supplier, we are your best choice.







Welcome to contact us for catalogs, factory pictures, or quotation anytime.










Best regards,




Vivian







Foshan RHT Furniture Co.,Ltd.







WhatsApp/WeChat: 0086-19290112590







Email: vivian6634@163.com







Website: http://www.rongtaif.com/







------=_Part_312081_885067890.1781077947025--



------=_Part_312080_1165617387.1781077947025--

Chinese productus spam Part 1

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Wed, 10 Jun 2026 05:31:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wXH8Y-000000000eR-2Lng

for dave@doctor.nl2k.ab.ca;

Wed, 10 Jun 2026 05:30:22 -0600

Resent-From: The Doctor

Resent-Date: Wed, 10 Jun 2026 05:30:22 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from dmd100.mail84.iemailforce.com ([61.147.84.100]:43307)

by doctor.nl2k.ab.ca with esmtp (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wXDkf-00000000LCm-3q04

for doctor@nl2k.ab.ca;

Wed, 10 Jun 2026 01:53:48 -0600

DKIM-Signature: v=1; a=rsa-sha256; d=edm1.sqeee.com; s=iemdkim; c=relaxed/relaxed;

bh=1KMIHp5e7HMYOyPWuoirP0QKysI5FMo7w072EjBoMaI=;

h=from:reply-to:subject:date:to:cc:resent-date:resent-from:resent-to:

resent-cc; t=1781077947;

b=nD3KPq4li8U2jYJ2yXEv7lRgOUIbRHSEFt20vFMInA9o7ayNQjSLmxSc57d+u56URBH6mKCWl

uJQxTWhSAcfKuSuP5D3rB0k/yW8A08iNHdzgM9hyYfmgueVKI7N8s/H59tlSqEvjeI9I2usLOmM

uRDUsTcjj64Nh2k+RqXIipFhL3FkQfsdKDMhklGdtX7L0P69jBa0LeIZ2gEg/ITv2WpbpMmbs0+

JqCKvCU1xNsscsY9L0be8wd7/nHYsKS4mWt9syttvTnod2MXT7DgGHJhWnfrpZ2RZ/EGJ0D7nj6

DkKecA7RjpPgKzCKGWxG13CJFdIJgnawRWIhkHXwlhaw==;

Date: Wed, 10 Jun 2026 15:52:27 +0800 (CST)

From: vivian

Reply-To: "vivian6634@163.com"

To: doctor@nl2k.ab.ca

Message-ID:

Subject: Re: Hotel furniture factory

MIME-Version: 1.0

Content-Type: multipart/mixed;

boundary="----=_Part_312080_1165617387.1781077947025"

List-Unsubscribe: ,

List-Unsubscribe-Post: List-Unsubscribe=One-Click

X-Iemail-Message-Id:

Feedback-ID: 3a686e9debd94bdb906880472c8d0b19:journey_iEmailMailing_181562_1781076989254_358096:normal:iemail

X-System: P9vr5pzQYFye

X-Spam_score: 9.3

X-Spam_score_int: 93

X-Spam_bar: +++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Re: Hotel furniture factory Hello doctor@nl2k.ab.ca, It looks

like your email software does not support HTML. Please visit the webpage

below in order to read this message in your webbrowser: https://iem-tracking.dmartech.cn/x/weblink?p=JY7NisMwDITvfpcU_

[...]



Content analysis details: (9.3 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[61.147.84.100 listed in will-spam-for-food.eu.org]

[61.147.84.100 listed in will-spam-for-food.eu.org]

[61.147.84.100 listed in will-spam-for-food.eu.org]

[61.147.84.100 listed in will-spam-for-food.eu.org]

[61.147.84.100 listed in will-spam-for-food.eu.org]

[61.147.84.100 listed in will-spam-for-food.eu.org]

[61.147.84.100 listed in will-spam-for-food.eu.org]

[61.147.84.100 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[61.147.84.100 listed in dnsbl.ahbl.org]

[61.147.84.100 listed in dnsbl.ahbl.org]

[61.147.84.100 listed in dnsbl.ahbl.org]

[61.147.84.100 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[61.147.84.100 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[61.147.84.100 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[61.147.84.100 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[61.147.84.100 listed in dnsbl.ahbl.org]

1.6 RCVD_IN_BRBL_LASTEXT RBL: No description available.

[61.147.84.100 listed in bb.barracudacentral.org]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[61.147.84.100 listed in list.dnswl.org]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[61.147.84.100 listed in bl.score.senderscore.com]

-0.0 SPF_PASS SPF: sender matches SPF record

0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in digit

[vivian6634(at)163.com]

0.3 LONGWORD BODY: Uses overlong words

0.5 L_HELLO_ADDRESS BODY: Greets you by address, not by name

0.6 MEGALONGWORD BODY: Uses really overlong words

0.7 HTML_IMAGE_ONLY_28 BODY: HTML: images with 2400-2800 bytes of words

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

2.5 FREEMAIL_FORGED_REPLYTO Freemail in Reply-To, but not From

1.5 IMPRONONCABLE_2 Too much mixed numbers and lower-case letters

Subject: {SPAM?} Re: Hotel furniture factory



------=_Part_312080_1165617387.1781077947025

Content-Type: multipart/alternative;

boundary="----=_Part_312081_885067890.1781077947025"



------=_Part_312081_885067890.1781077947025

Content-Type: text/plain; charset="utf-8"

Content-Transfer-Encoding: 7bit



Re: Hotel furniture factory



Hello doctor@nl2k.ab.ca,



It looks like your email software does not support HTML.

Please visit the webpage below in order to read this message in your webbrowser:

https://iem-tracking.dmartech.cn/x/weblink?p=JY7NisMwDITvfpcU_0s-BPbSQwvtwkJh20uQLbukTZOSpLDdp1_DSugwzIhv0jK2hjz6HDhHDjZyDNIjSgs6IcuogkivZZ0eee56bqXWLhptmlKCaqwD06CL2FgdldPBoOIgcstTWqf5Yxz0fUNxk0gM9bkwUZCOoy3J-qqMAShSJp0cUJZiqSGdKaGDAgnIQg7EKtRhzwqMSlGsNXSbXvOY312_fVA_HOr147VTqJzXnQJUEnzAoJ3tjEMZvBDr0v4bUFsKurdcsmJ0dYkssgmVQFh8TgyVR7XNdWynbA_d-7k777-_4PkD92Her-NleB_nk9udf198umznz-E42T8

Dragonfly/Intelcom phish Part 2

Posted by Dave Yadallee on
This is a multi-part message in MIME format.



--139dc9e2d192e62775ad5c3baa93d99ea

Content-Type: text/plain; charset=UTF-8

Content-Transfer-Encoding: 8bit



















French version follows





Intelcom is now Dragonfly!







Valued customer,



A package addressed to you has been held due to non-payment of applicable customs duties, in accordance with the Canada Border Services Agency’s terms and conditions. Please pay these customs duties using our secure form below and schedule delivery at a time that is convenient for you: Â



Access secure form



Failure to comply with this notice will result in your package being returned to the sender.



Important:Â Dragonfly may collect duties and taxes when required by border authorities.









This is an automated email. Please do not reply.







Â





Intelcom est maintenant Dragonfly!







Cher(e) client(e),



Un colis qui vous est destiné a été retenu en raison du non-paiement des droits de douane applicables, conformément aux conditions générales de l'Agence des services frontaliers du Canada. Veuillez régler ces droits de douane à l'aide de notre formulaire sécurisé ci-dessous et choisir une heure de livraison qui vous convient :Â



Accéder au formulaire sécurisé



Le non-respect de cet avis entrainera la réexpédition de votre colis à son expéditeur.



Important : Dragonfly peut percevoir des droits et taxes lorsque les autorités frontalières l’exigent.









Ceci est un message automatisé. Veuillez ne pas répondre à ce courriel.















--139dc9e2d192e62775ad5c3baa93d99ea

Content-Type: text/html; charset=UTF-8

Content-Transfer-Encoding: 8bit















































































--139dc9e2d192e62775ad5c3baa93d99ea--

Aramco based Nigerian spam

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Wed, 10 Jun 2026 07:34:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wXJ46-00000000D7Z-2q10

for dave@doctor.nl2k.ab.ca;

Wed, 10 Jun 2026 07:33:54 -0600

Resent-From: The Doctor

Resent-Date: Wed, 10 Jun 2026 07:33:54 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from [160.187.143.98] (port=40560 helo=roob.crystalcorex.com)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wXHao-00000000LHe-47aj

for root@nl2k.ab.ca;

Wed, 10 Jun 2026 05:59:44 -0600

DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed;

d=rimaugroup.co.id; s=default; h=Content-Transfer-Encoding:Content-Type:

MIME-Version:Message-ID:Date:Subject:To:From:Reply-To:Sender:Cc:Content-ID:

Content-Description:Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc

:Resent-Message-ID:In-Reply-To:References:List-Id:List-Help:List-Unsubscribe:

List-Subscribe:List-Post:List-Owner:List-Archive;

bh=ezTyp9dJKStRIfNBj+icmouDCGqSfrzazmnhrFjF1qw=; b=Gc2lax+gwr0eqnJZG/mXBMHTTY

PlcrAL/LdI0iIw4Z+Hu/oshUKRZbXUXjRMuF4TEYGW8oey3pykMw2mwUBm+CHGmRt+22C9V2Y3fC2

bvJysyKRhvbeoDqF1mh9usK8MgdzOpc/WgAr6uRcbNWcczWI12rw7KYTyJEcuCmkgiyS7ShoaUgQ3

PW7x8NiWy1GoCsIC0z/e/6SHZ1kjNVgKEN/TTbCOAQUbu8bOw/hirLtfOmBzSYIVXDXqekq8ueYup

rzBQJC5t8N4sA/bsUaOp39SMwN+rnvHucp+7gNhmxvIG/LPTo5GPGQ1qY5ovU6GJSezCFpi4N5Q9Z

t0c1oKdg==;

Received: from [38.255.61.36] (port=49469 helo=rdcpharm.com)

by server.rimaugroup.co.id with esmtpsa (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

(Exim 4.99.4)

(envelope-from )

id 1wUMpD-0000000A76T-0PZ9

for root@nl2k.ab.ca;

Tue, 02 Jun 2026 16:28:22 +0530

Reply-To: raschidmario1@gmail.com

From: "Mr. Mario Raschid"

To: root@nl2k.ab.ca

Subject: Investment Project Venture

Date: 02 Jun 2026 12:58:20 +0200

Message-ID: <20260602125819.ECBCA509BE54A9F1@rdcpharm.com>

MIME-Version: 1.0

Content-Type: text/html

Content-Transfer-Encoding: quoted-printable

X-AntiAbuse: This header was added to track abuse, please include it with any abuse report

X-AntiAbuse: Primary Hostname - server.rimaugroup.co.id

X-AntiAbuse: Original Domain - nl2k.ab.ca

X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12]

X-AntiAbuse: Sender Address Domain - rdcpharm.com

X-Get-Message-Sender-Via: server.rimaugroup.co.id: authenticated_id: sherma.yunita@rimaugroup.co.id

X-Authenticated-Sender: server.rimaugroup.co.id: sherma.yunita@rimaugroup.co.id

X-Source:

X-Source-Args:

X-Source-Dir:

X-Spam_score: 16.0

X-Spam_score_int: 160

X-Spam_bar: ++++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Saudi Aramco Ventures. Al-Midra Tower, 11th Floor, West Wing,

Dhahran 31311 Kingdom of Saudi Arabia Greetings,



Content analysis details: (16.0 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[38.255.61.36 listed in will-spam-for-food.eu.org]

[38.255.61.36 listed in will-spam-for-food.eu.org]

[38.255.61.36 listed in will-spam-for-food.eu.org]

[38.255.61.36 listed in will-spam-for-food.eu.org]

[38.255.61.36 listed in will-spam-for-food.eu.org]

[38.255.61.36 listed in will-spam-for-food.eu.org]

[38.255.61.36 listed in will-spam-for-food.eu.org]

[38.255.61.36 listed in will-spam-for-food.eu.org]

[160.187.143.98 listed in will-spam-for-food.eu.org]

[160.187.143.98 listed in will-spam-for-food.eu.org]

[160.187.143.98 listed in will-spam-for-food.eu.org]

[160.187.143.98 listed in will-spam-for-food.eu.org]

[160.187.143.98 listed in will-spam-for-food.eu.org]

[160.187.143.98 listed in will-spam-for-food.eu.org]

[160.187.143.98 listed in will-spam-for-food.eu.org]

[160.187.143.98 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[160.187.143.98 listed in dnsbl.ahbl.org]

[160.187.143.98 listed in dnsbl.ahbl.org]

[160.187.143.98 listed in dnsbl.ahbl.org]

[160.187.143.98 listed in dnsbl.ahbl.org]

[38.255.61.36 listed in dnsbl.ahbl.org]

[38.255.61.36 listed in dnsbl.ahbl.org]

[38.255.61.36 listed in dnsbl.ahbl.org]

[38.255.61.36 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[160.187.143.98 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[160.187.143.98 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[160.187.143.98 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[160.187.143.98 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_SBL_XBL RBL: Received via a relay in Spamhaus SBL+XBL

[38.255.61.36 listed in sbl-xbl.spamhaus.org]

1.5 RCVD_IN_CBL RBL: Received via a relay in cbl.abuseat.org

[Listed by XBL, see ]

1.6 RCVD_IN_BRBL_LASTEXT RBL: No description available.

[160.187.143.98 listed in bb.barracudacentral.org]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[160.187.143.98 listed in bl.score.senderscore.com]

0.0 SPF_HELO_FAIL SPF: HELO does not match SPF record (fail)

[SPF failed: Rejected by SPF record.]

0.0 T_SPF_PERMERROR SPF: test of record failed (permerror)

0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in digit

[raschidmario1(at)gmail.com]

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 HTML_MESSAGE BODY: HTML included in message

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

1.3 RDNS_NONE Delivered to internal network by a host with no rDNS

0.0 HK_NAME_MR_MRS No description available.

2.5 FREEMAIL_FORGED_REPLYTO Freemail in Reply-To, but not From

2.0 MIXED_HREF_CASE Has href in mixed case

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

0.8 SARE_FROM_SPAM_WORD3 I don't know people named this!

1.0 VOWEL_URI_5 URI hostname with 5 consecutive vowels

0.5 VOWEL_FROM_5 Impronouncable from header (6 consecutive vowels)

0.0 FROM_MISSP_REPLYTO From misspaced, has Reply-To

0.0 FROM_MISSPACED From: missing whitespace

0.7 TO_NO_BRKTS_FROM_MSSP Multiple formatting errors

Subject: {SPAM?} Investment Project Venture









Saudi Aramco Ventures.
Al-Midra Tower, 11th Floor, West Wing,
Dhah=

ran 31311 Kingdom of Saudi Arabia



Greetings,



I hope this message finds you well.



I am writing to explore the possibility of a mutually beneficial busines=

s collaboration with your esteemed organization. We have identified a poten=

tially lucrative opportunity and would like to inquire whether you would be=

interested in acting as an agent partner in managing related business cont=

racts.



If this opportunity aligns with your interests, we would appreciate the =

chance to discuss it further.



For further information please feel free to contact me directly via emai=

l: raschidmario1@gmail.com
P>

Sincerely,
Mr. Mario Raschid,
Director of Sales/Business Developme=

nt
Saudi Aramco Ventures
Website:
om">https://aramcoventures.com



 



Dragonfly/Intelcom phish Part 1

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Tue, 09 Jun 2026 21:05:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wX9FN-00000000LvP-2uhr

for dave@doctor.nl2k.ab.ca;

Tue, 09 Jun 2026 21:04:53 -0600

Resent-From: The Doctor

Resent-Date: Tue, 9 Jun 2026 21:04:53 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from [169.239.183.22] (port=42112 helo=bond.schaeffler.com)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wX7tZ-00000000E7d-3u4A

for sales@nk.ca;

Tue, 09 Jun 2026 19:38:21 -0600

Received: by bond.schaeffler.com (Postfix, from userid 33)

id 8A34DFE90E; Wed, 10 Jun 2026 03:33:49 +0200 (SAST)

Date: Wed, 10 Jun 2026 03:32:47 +0200

To: sales@nk.ca

From: =?UTF-8?Q?Dragonfly_Notification=C2=AE?=

Reply-To: noreply@dragonflyshipping.com.ca

Subject: =?UTF-8?Q?Your_package_has_been_held_by_the_CBSA_due_to_unpaid_customs_du?=

=?UTF-8?Q?ties._/_Votre_colis_a_=C3=A9t=C3=A9_retenu_par_l=E2=80=99ASFC_e?=

=?UTF-8?Q?n_raison_de_droits_de_douane_impay=C3=A9s.?=

Message-ID: <8a5b8afa108a7eb17a7e5774c5f18b0c@dragonflyshipping.com.ca>

List-Unsubscribe: mailto:bounce770-iHaHqGsA4T80jqS@dragonflyshipping.com.ca?subject=list-unsubscribe

MIME-Version: 1.0

Content-Type: multipart/alternative;

boundary="139dc9e2d192e62775ad5c3baa93d99ea"

Content-Transfer-Encoding: 8bit

X-Spam_score: 7.1

X-Spam_score_int: 71

X-Spam_bar: +++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: French version follows Intelcom is now Dragonfly!



Content analysis details: (7.1 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[169.239.183.22 listed in will-spam-for-food.eu.org]

[169.239.183.22 listed in will-spam-for-food.eu.org]

[169.239.183.22 listed in will-spam-for-food.eu.org]

[169.239.183.22 listed in will-spam-for-food.eu.org]

[169.239.183.22 listed in will-spam-for-food.eu.org]

[169.239.183.22 listed in will-spam-for-food.eu.org]

[169.239.183.22 listed in will-spam-for-food.eu.org]

[169.239.183.22 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[169.239.183.22 listed in dnsbl.ahbl.org]

[169.239.183.22 listed in dnsbl.ahbl.org]

[169.239.183.22 listed in dnsbl.ahbl.org]

[169.239.183.22 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[169.239.183.22 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[169.239.183.22 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[169.239.183.22 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[169.239.183.22 listed in dnsbl.ahbl.org]

2.5 URIBL_DBL_PHISH Contains a Phishing URL listed in the DBL blocklist

[URI: scanned.page]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

0.0 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level mail

domains are different

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[169.239.183.22 listed in bl.score.senderscore.com]

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 HTML_MESSAGE BODY: HTML included in message

1.3 RDNS_NONE Delivered to internal network by a host with no rDNS

0.0 SARE_FROM_SPAM_WORD4 From address suggests this may be spam

Subject: {SPAM?} =?UTF-8?Q?Your_package_has_been_held_by_the_CBSA_due_to_unpaid_customs_du?=

=?UTF-8?Q?ties._/_Votre_colis_a_=C3=A9t=C3=A9_retenu_par_l=E2=80=99ASFC_e?=

=?UTF-8?Q?n_raison_de_droits_de_douane_impay=C3=A9s.?=

Nigerian spam using Aramco

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Wed, 10 Jun 2026 07:34:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wXJ46-00000000D7Z-2q10

for dave@doctor.nl2k.ab.ca;

Wed, 10 Jun 2026 07:33:54 -0600

Resent-From: The Doctor

Resent-Date: Wed, 10 Jun 2026 07:33:54 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from [160.187.143.98] (port=40560 helo=roob.crystalcorex.com)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wXHao-00000000LHe-47aj

for root@nl2k.ab.ca;

Wed, 10 Jun 2026 05:59:44 -0600

DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed;

d=rimaugroup.co.id; s=default; h=Content-Transfer-Encoding:Content-Type:

MIME-Version:Message-ID:Date:Subject:To:From:Reply-To:Sender:Cc:Content-ID:

Content-Description:Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc

:Resent-Message-ID:In-Reply-To:References:List-Id:List-Help:List-Unsubscribe:

List-Subscribe:List-Post:List-Owner:List-Archive;

bh=ezTyp9dJKStRIfNBj+icmouDCGqSfrzazmnhrFjF1qw=; b=Gc2lax+gwr0eqnJZG/mXBMHTTY

PlcrAL/LdI0iIw4Z+Hu/oshUKRZbXUXjRMuF4TEYGW8oey3pykMw2mwUBm+CHGmRt+22C9V2Y3fC2

bvJysyKRhvbeoDqF1mh9usK8MgdzOpc/WgAr6uRcbNWcczWI12rw7KYTyJEcuCmkgiyS7ShoaUgQ3

PW7x8NiWy1GoCsIC0z/e/6SHZ1kjNVgKEN/TTbCOAQUbu8bOw/hirLtfOmBzSYIVXDXqekq8ueYup

rzBQJC5t8N4sA/bsUaOp39SMwN+rnvHucp+7gNhmxvIG/LPTo5GPGQ1qY5ovU6GJSezCFpi4N5Q9Z

t0c1oKdg==;

Received: from [38.255.61.36] (port=49469 helo=rdcpharm.com)

by server.rimaugroup.co.id with esmtpsa (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

(Exim 4.99.4)

(envelope-from )

id 1wUMpD-0000000A76T-0PZ9

for root@nl2k.ab.ca;

Tue, 02 Jun 2026 16:28:22 +0530

Reply-To: raschidmario1@gmail.com

From: "Mr. Mario Raschid"

To: root@nl2k.ab.ca

Subject: Investment Project Venture

Date: 02 Jun 2026 12:58:20 +0200

Message-ID: <20260602125819.ECBCA509BE54A9F1@rdcpharm.com>

MIME-Version: 1.0

Content-Type: text/html

Content-Transfer-Encoding: quoted-printable

X-AntiAbuse: This header was added to track abuse, please include it with any abuse report

X-AntiAbuse: Primary Hostname - server.rimaugroup.co.id

X-AntiAbuse: Original Domain - nl2k.ab.ca

X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12]

X-AntiAbuse: Sender Address Domain - rdcpharm.com

X-Get-Message-Sender-Via: server.rimaugroup.co.id: authenticated_id: sherma.yunita@rimaugroup.co.id

X-Authenticated-Sender: server.rimaugroup.co.id: sherma.yunita@rimaugroup.co.id

X-Source:

X-Source-Args:

X-Source-Dir:

X-Spam_score: 16.0

X-Spam_score_int: 160

X-Spam_bar: ++++++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Saudi Aramco Ventures. Al-Midra Tower, 11th Floor, West Wing,

Dhahran 31311 Kingdom of Saudi Arabia Greetings,



Content analysis details: (16.0 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[38.255.61.36 listed in will-spam-for-food.eu.org]

[38.255.61.36 listed in will-spam-for-food.eu.org]

[38.255.61.36 listed in will-spam-for-food.eu.org]

[38.255.61.36 listed in will-spam-for-food.eu.org]

[38.255.61.36 listed in will-spam-for-food.eu.org]

[38.255.61.36 listed in will-spam-for-food.eu.org]

[38.255.61.36 listed in will-spam-for-food.eu.org]

[38.255.61.36 listed in will-spam-for-food.eu.org]

[160.187.143.98 listed in will-spam-for-food.eu.org]

[160.187.143.98 listed in will-spam-for-food.eu.org]

[160.187.143.98 listed in will-spam-for-food.eu.org]

[160.187.143.98 listed in will-spam-for-food.eu.org]

[160.187.143.98 listed in will-spam-for-food.eu.org]

[160.187.143.98 listed in will-spam-for-food.eu.org]

[160.187.143.98 listed in will-spam-for-food.eu.org]

[160.187.143.98 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[160.187.143.98 listed in dnsbl.ahbl.org]

[160.187.143.98 listed in dnsbl.ahbl.org]

[160.187.143.98 listed in dnsbl.ahbl.org]

[160.187.143.98 listed in dnsbl.ahbl.org]

[38.255.61.36 listed in dnsbl.ahbl.org]

[38.255.61.36 listed in dnsbl.ahbl.org]

[38.255.61.36 listed in dnsbl.ahbl.org]

[38.255.61.36 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[160.187.143.98 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[160.187.143.98 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[160.187.143.98 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[160.187.143.98 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_SBL_XBL RBL: Received via a relay in Spamhaus SBL+XBL

[38.255.61.36 listed in sbl-xbl.spamhaus.org]

1.5 RCVD_IN_CBL RBL: Received via a relay in cbl.abuseat.org

[Listed by XBL, see ]

1.6 RCVD_IN_BRBL_LASTEXT RBL: No description available.

[160.187.143.98 listed in bb.barracudacentral.org]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[160.187.143.98 listed in bl.score.senderscore.com]

0.0 SPF_HELO_FAIL SPF: HELO does not match SPF record (fail)

[SPF failed: Rejected by SPF record.]

0.0 T_SPF_PERMERROR SPF: test of record failed (permerror)

0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in digit

[raschidmario1(at)gmail.com]

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 HTML_MESSAGE BODY: HTML included in message

1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts

1.3 RDNS_NONE Delivered to internal network by a host with no rDNS

0.0 HK_NAME_MR_MRS No description available.

2.5 FREEMAIL_FORGED_REPLYTO Freemail in Reply-To, but not From

2.0 MIXED_HREF_CASE Has href in mixed case

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

0.8 SARE_FROM_SPAM_WORD3 I don't know people named this!

1.0 VOWEL_URI_5 URI hostname with 5 consecutive vowels

0.5 VOWEL_FROM_5 Impronouncable from header (6 consecutive vowels)

0.0 FROM_MISSP_REPLYTO From misspaced, has Reply-To

0.0 FROM_MISSPACED From: missing whitespace

0.7 TO_NO_BRKTS_FROM_MSSP Multiple formatting errors

Subject: {SPAM?} Investment Project Venture









Saudi Aramco Ventures.
Al-Midra Tower, 11th Floor, West Wing,
Dhah=

ran 31311 Kingdom of Saudi Arabia



Greetings,



I hope this message finds you well.



I am writing to explore the possibility of a mutually beneficial busines=

s collaboration with your esteemed organization. We have identified a poten=

tially lucrative opportunity and would like to inquire whether you would be=

interested in acting as an agent partner in managing related business cont=

racts.



If this opportunity aligns with your interests, we would appreciate the =

chance to discuss it further.



For further information please feel free to contact me directly via emai=

l: raschidmario1@gmail.com
P>

Sincerely,
Mr. Mario Raschid,
Director of Sales/Business Developme=

nt
Saudi Aramco Ventures
Website:
om">https://aramcoventures.com



 



Paypal Bitcoin Phishing from Microsoft Outlook Part 3

Posted by Dave Yadallee on
Content analysis details: (13.7 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[40.93.20.59 listed in dnsbl.ahbl.org]

[40.93.20.59 listed in dnsbl.ahbl.org]

[40.93.20.59 listed in dnsbl.ahbl.org]

[40.93.20.59 listed in dnsbl.ahbl.org]

[209.85.128.69 listed in dnsbl.ahbl.org]

[209.85.128.69 listed in dnsbl.ahbl.org]

[209.85.128.69 listed in dnsbl.ahbl.org]

[209.85.128.69 listed in dnsbl.ahbl.org]

[2603:10b6:a03:338:0:0:0:16 listed in]

[dnsbl.ahbl.org]

[2603:10b6:a03:338:0:0:0:16 listed in]

[dnsbl.ahbl.org]

[2603:10b6:a03:338:0:0:0:16 listed in]

[dnsbl.ahbl.org]

[2603:10b6:a03:338:0:0:0:16 listed in]

[dnsbl.ahbl.org]

[2603:10b6:a03:338:0:0:0:4 listed in]

[dnsbl.ahbl.org]

[2603:10b6:a03:338:0:0:0:4 listed in]

[dnsbl.ahbl.org]

[2603:10b6:a03:338:0:0:0:4 listed in]

[dnsbl.ahbl.org]

[2603:10b6:a03:338:0:0:0:4 listed in]

[dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[40.93.20.59 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[40.93.20.59 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[40.93.20.59 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[40.93.20.59 listed in dnsbl.ahbl.org]

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[209.85.128.69 listed in will-spam-for-food.eu.org]

[209.85.128.69 listed in will-spam-for-food.eu.org]

[209.85.128.69 listed in will-spam-for-food.eu.org]

[209.85.128.69 listed in will-spam-for-food.eu.org]

[209.85.128.69 listed in will-spam-for-food.eu.org]

[209.85.128.69 listed in will-spam-for-food.eu.org]

[209.85.128.69 listed in will-spam-for-food.eu.org]

[209.85.128.69 listed in will-spam-for-food.eu.org]

[2603:10b6:a03:338:0:0:0:4 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:a03:338:0:0:0:4 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:a03:338:0:0:0:4 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:a03:338:0:0:0:4 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:a03:338:0:0:0:4 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:a03:338:0:0:0:4 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:a03:338:0:0:0:4 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:a03:338:0:0:0:4 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:a03:338:0:0:0:16 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:a03:338:0:0:0:16 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:a03:338:0:0:0:16 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:a03:338:0:0:0:16 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:a03:338:0:0:0:16 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:a03:338:0:0:0:16 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:a03:338:0:0:0:16 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:a03:338:0:0:0:16 listed in]

[will-spam-for-food.eu.org]

[40.93.20.59 listed in will-spam-for-food.eu.org]

[40.93.20.59 listed in will-spam-for-food.eu.org]

[40.93.20.59 listed in will-spam-for-food.eu.org]

[40.93.20.59 listed in will-spam-for-food.eu.org]

[40.93.20.59 listed in will-spam-for-food.eu.org]

[40.93.20.59 listed in will-spam-for-food.eu.org]

[40.93.20.59 listed in will-spam-for-food.eu.org]

[40.93.20.59 listed in will-spam-for-food.eu.org]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[40.93.20.59 listed in list.dnswl.org]

-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact

safe-sa@returnpath.net

[Excessive Number of Queries | ]

-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact

cert-sa@returnpath.net

[Excessive Number of Queries | ]

-0.0 SPF_HELO_PASS SPF: HELO matches SPF record

-0.0 SPF_PASS SPF: sender matches SPF record

1.0 HK_RANDOM_REPLYTO Reply-To username looks random

1.0 HK_RANDOM_FROM From username looks random

0.5 FROM_LOCAL_NOVOWEL From: localpart has series of non-vowel letters

3.5 VOWEL_FROM_7 Impronouncable from header (7+ consecutive vowels)

1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,

https://senderscore.org/blacklistlookup/

[40.93.20.59 listed in bl.score.senderscore.com]

0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in digit

[haressaznzxrrsxaxz321(at)gmail.com]

0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider

[haressaznzxrrsxaxz321(at)gmail.com]

-0.0 T_RP_MATCHES_RCVD Envelope sender domain matches handover relay

domain

0.0 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level mail

domains are different

0.1 TW_RW BODY: Odd Letter Triples with RW

0.6 MEGALONGWORD BODY: Uses really overlong words

0.3 LONGWORD BODY: Uses overlong words

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 HTML_MESSAGE BODY: HTML included in message

0.2 FREEMAIL_FORGED_FROMDOMAIN 2nd level domains in From and EnvelopeFrom

freemail headers are different

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

2.0 RATWR8_MESSID Message-ID with excessive dashes and dollars

3.0 LONG_INVISIBLE_TEXT Long block of hidden text - bayes poison?

0.1 TO_IN_SUBJ To address is in Subject

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[40.93.20.59 listed in wl.mailspike.net]

Subject: {SPAM?} =?UTF-8?Q?Pozv=C3=A1nky=3A_Payment_Confirmation_=2D_Your_Bitcoin_Order?=

=?UTF-8?Q?_Is_Being_Verified_=40_ut_9=2E_j=C3=BAn_2026_=28cynthiaperez389903=40gro?=

=?UTF-8?Q?ups=2Eoutlook=2Ecom=29?=



Paypal Bitcoin Phishing from Microsoft Outlook Part 4

Posted by Dave Yadallee on


Haresasz Nxysarwsa has invited you to Payment Confirmation – Your Bitcoin Order Is Being Verified

Title: Payment Confirmation – Your Bitcoin Order Is Being Verified

When: June 9, 2026

Organizer:

Haresasz Nxysarwsa

Description: Dear Customer,



This is to confirm that we have successfully received your PayPal payment for your recent Bitcoin (BTC) purchase request.



Transaction Details:



Payment Method: PayPal

Purchase Type: Bitcoin (BTC)

Amount Charged: $750.00

Current Status: Verification in Progress



Your order is currently undergoing routine security and compliance checks. Once verification is complete, the Bitcoin purchase will be finalized automatically.



If you did not authorize this transaction, please contact our support team immediately at +1 805 424 9350.



Sincerely,

Payment Verification Team

Attendees:



cynthiaperez389903@groups.outlook.com



Payment Confirmation – Your Bitcoin Order Is Being Verified

Dear Customer, This is to confirm that we have successfully received your PayPal payment for your recent Bitcoin (BTC) purchase request. Transaction Details: Payment Method: PayPal Purchase Type: B



Dear Customer,



This is to confirm that we have successfully received your PayPal payment for your recent Bitcoin (BTC) purchase request.



Transaction Details:



Payment Method: PayPal

Purchase Type: Bitcoin (BTC)

Amount Charged: $750.00

Current Status: Verification in Progress



Your order is currently undergoing routine security and compliance checks. Once verification is complete, the Bitcoin purchase will be finalized automatically.



If you did not authorize this transaction, please contact our support team immediately at +1 805 424 9350.



Sincerely,

Payment Verification Team

Kedy

utorok 9. jún 2026

Organizátor

Haresasz Nxysarwsa

haressaznzxrrsxaxz321@gmail.com

Hostia

(Zoznam hostí bol na žiadosť organizátora skrytý)

Odpoveď na cynthiaperez389903@groups.outlook.com

Áno



Nie



Možno

Ďalšie možnosti



Pozvánka z Kalendára Google



Túto správu ste dostali, pretože ste účastníkom danej udalosti.



Ak túto pozvánku prepošlete, ktorýkoľvek jej príjemca bude môcť odoslať odpoveď organizátorovi, byť pridaný do zoznamu hostí, pozývať iných bez ohľadu na ich vlastný stav pozvánky alebo meniť vaše potvrdenie účasti. Ďalšie informácie

Paypal Bitcoin Phishing from Microsoft Outlook Part 2

Posted by Dave Yadallee on
X-Microsoft-Antispam-Message-Info:

=?utf-8?B?Y0FhUEFKR040VG1LUVA2U2loS3ZIVllZTkN4RUhUNGtaVkJsVWRIQzk2RW14?=

=?utf-8?B?Z1ZpenJBYjR5enVyV2JENWtNUEVSdlVJUExJNGFGU3ROcUZkazZ4bWRQNmc5?=

=?utf-8?B?cFJ2dkcvSlpuZXBzam8yOW9WajZnbnpsdU5FVG1nN0RXMVk3dEgwd2hlcEpu?=

=?utf-8?B?NnNJZmtDRDBRalhRbXkvSnRPMlFrdUpTM2xqbTQwdU96WWE3R0tnNDlzRGd4?=

=?utf-8?B?WkN6NHRqSU4vWnUzbHhGVXc2WFluSmpRZlkzOGdEckRPRHB1SzludU5FeG1D?=

=?utf-8?B?cURWbFF3QUZpMG9BZzVidDU1K2xRa1lvaEZTcWttSmR0WDNjSmhGY1l0cmRF?=

=?utf-8?B?elhzQzJBWDgyZDFiMmd2Q3JBSXM4RHR4ZmdaeTczQ2N5eG1zOVdPbUJBMXlW?=

=?utf-8?B?YmYvSnVuNmxranBOVGtid3pXUFZYR1ZKRDFzZ3cvRmZHVTE4NTVFdHUyY2Vm?=

=?utf-8?B?UGEwalM4NUpJdGptTjQ4aGI1VThKblM2cGFTSk5FV2hFUWN0aGtqZnhjSlBh?=

=?utf-8?B?TzNQM0RCcXNOSEl3ZlFjZWhOVm5rOG9zdVpaS010d1BTOVlQYWE5Rnd3ajVC?=

=?utf-8?B?N1VWdTFQQThnMWFMZEpMVFEyUWhNN2lSWmtuVDNEcm9ZZnRCd2ppZFVtcGpV?=

=?utf-8?B?cVd1REswMUZ6MXZFcUJReEFHQThpdmNNOVNaQ0V3a2FUZmw1VW1sVFRReGY5?=

=?utf-8?B?SlN5a25qTWZsNm5VT1J2YzNlbHZNV3lScVNPVGdZZ21uUVFBeG8yVGZqa25s?=

=?utf-8?B?T0c3L1NDUCtnZXlZTDJFUm05MGdwaCtGUDhRNG9XM09NR3A0L3UwWU9QZmhk?=

=?utf-8?B?bFpjUUIyYlVUWk9VUG51Yyt1ZGlNNXhUd3V1OEtXazZxVW04QXA1dUVTYkJo?=

=?utf-8?B?RFdGeW1kcW83U3F6U0FpbkhVbmN2MXdSZzFKUEN6QWNROGZhdVRoMTJMaTYw?=

=?utf-8?B?Mys5RUVjbDNNTEh3dHF5dUlDbkFvTmFiTk44Qld0S3RpZjRIWDVVME5nNkI3?=

=?utf-8?B?V3JxMGUxSWduSlhuZm5HVENHSjBna05GVzRBY2tBK0NOL2N2TmdjYndUVWxy?=

=?utf-8?B?Q1haUm1WcXNnMUQ4VEpEdjlMY1pvVkNIMERLa3UxYlk2RUJ3Nkx5ZmVsdUVI?=

=?utf-8?B?ak50S0svTHVVZjFDM2Z1RU94YU0yMVVUaW5DWVNMUGpVTjNHSzFCekkvRURm?=

=?utf-8?B?K3grOG1TcCtQdjkvWWtzak81cnhQZVVaQlQwSTdlL21raGpSTFVnS2lEWllr?=

=?utf-8?B?dzRSNzVIZGNRUzNaR3RjWHVGUHhkLysyQ3lBOTVJWjgrd1RDTS9RWEZQN2dm?=

=?utf-8?B?WXBVcGNySnhFVThROGNIS1BYQjlJVm5rb3JCeHV1Q1NpQXBOTW80Slg1S2pV?=

=?utf-8?B?UnpBcHZZa3gzcEtnRCsrVmllamRJSU55QmZLRlZ4QSswUHNlUzhoQkptcWtH?=

=?utf-8?B?TjN6UlNvK0RGYlgyYXdESFVLMmlWbXpYMFVFUFdlaGxsRDhuaVlYRlgxU3VW?=

=?utf-8?B?c25DZkk5cVRVYjhaU0FJb3U5Vlp0ck1EYlh5WU5EVldzMForTnEvVVJZMWxL?=

=?utf-8?B?UjVZdnBjbkFaaElIeEdsS3pqaGp6WjEwT0pUNmhvUDJpSGMya0IyOGpPd3Vj?=

=?utf-8?B?M2VMZFRHVVhPenNlRG0zME5FcXp6b3ZnQWJEVFNLcEFYZHVVV3RGRk52d0gy?=

=?utf-8?B?UVVaaEhmWmdKK005NzJMTytWeWlKL0lnTS93ZHlYd0szVUNhSEUyYWdEQW04?=

=?utf-8?B?TzNvOCtzUEFrdGh4eGFYNjM3ZGtpRzBLRVZtaEpyYndIaFRMb2RwQkhjYUFW?=

=?utf-8?B?RDltUnNmTEhlVTJSMS8vVDYxMHB3Q0pkZndvYm8wTjRxQmcvRmpLTWxUbkhZ?=

=?utf-8?B?WXRzVTJ2NGMwQnBobDVPRlhKTVZlYk1qOTNLNVV3SXEyT2E4UndQd21vUWk1?=

=?utf-8?B?SHo3ak5TTzFEd0cydWhldGZuTXdYczdvYWlNbXFRSGdYT016WXZWQ08xWml5?=

=?utf-8?B?aTUrczF0b0N5cit1RDFWY0xxc3pjK3U0TG1MV1hXOHBjNmlYU3FoMWgwaWJX?=

=?utf-8?B?K08vTkpXZlNZZ3BmTUtqQUEyanloQ3ExdC95QmtsZ29NNHl1VkVKU2dhRnlz?=

=?utf-8?B?dEc1MmRGL1BGcnNhcWZkbm1BZnpzMTZud09tK002Uzl4WSt4VXZNa0lVN0ZG?=

=?utf-8?B?djMrK1cyYTdLN29XNEZ0dmh5bUxhSTNEbWFxb3orZ2lKK0RTTHMwcmZwQ1NV?=

=?utf-8?B?MHQyc1RQWVQ4UWNsaFBWTURncFUxb2k2dU1scHdtZ2Y4MTdLN0lZTy9wMDh4?=

=?utf-8?B?bm8vOTc1K3ZTaFVxZFFlTmY0OHBTUVRMOWcyMk5sRTNQYUQ2eEZFVWY3T3hr?=

=?utf-8?B?bEp1NXBEei9yTkI3Q3dTNzZWTm1STzhLV3QxeG1Ydnhtd3BuNG5WMG5BMnhw?=

=?utf-8?B?VGFFZHRZYU02K3pWSFpUZWZPdGV1VFJCQ3F5T2poTVdOYkNnQjFhUEJ5MjYx?=

=?utf-8?B?VW5mRVQwaDVSYk1sT3hPZTV3eHppQUVoQ3FUcjN6S3IrVG1kNFNlQU1tRkdt?=

=?utf-8?B?MFNtOFpseEkvZ0ZCTUFSQU02THpLclNhMUtERmlzdjUxNysrbUovOHFkNTh2?=

=?utf-8?B?MWoyQkxBWjBYRGFjTldsK0pXVmJPck5BUXF4cW1oK29hY2Y0bk1RWlBtM0Iv?=

=?utf-8?B?clVleXBvdWE4UmZySXhzekdCbGZFdFpFK1pRQlRiKzM4L2l3MGQvUzdnVCt3?=

=?utf-8?B?Ulh6SDJLNStZdUNWU1dGb2ZYc3Z4VjRPa3lXU2duTWZQdW9OSWRSWEFHeTJs?=

=?utf-8?B?YlppVDNmc1ViZEl4WmpwY1R3ZjhiUWZQZTIwWkNXVm9tdkd3QlU0S1FodGY5?=

=?utf-8?B?czRiZ0pISEtJNDJFZXlVL3pRTGRuRTdiVHdCMWVCZDJZNEl4TktRQzJLZDNa?=

=?utf-8?B?ZDBDLzNLSkxIQXZWL0lYMWFGRWIzQ2JNYnJSWDA1d2V2YkFqUUZhcmVWRHpm?=

=?utf-8?B?UGZlMWxaMjVaOW5SNzQ4NThsV2RHNjY0YktLWDlvMzByK2RramhZUkhZdzBL?=

=?utf-8?B?S09GeGkvK2EyVmhKMlNqT2ZsaVNZVTNFb3BXTFJmY0wxdjdJZVZ6SkdEQ3I1?=

=?utf-8?B?UlRzQzJabURydGxQZ3FTcGZ3R2tpSTZlQlZibzBURzlGbGRLTnAyWW96VEpK?=

=?utf-8?B?blRtVnVUUmVGNUxIZlZPaTNkM3dxSXIzdGFZM2E4dmdPYlZNd1haODFFaGh0?=

=?utf-8?B?bmlXd2c9PQ==?=

X-Auto-Response-Suppress: DR, OOF, AutoReply

X-OriginatorOrg: sct-15-20-9412-4-msonline-outlook-090a5.templateTenant

X-MS-Exchange-CrossTenant-OriginalArrivalTime: 09 Jun 2026 16:09:43.5726

(UTC)

X-MS-Exchange-CrossTenant-Network-Message-Id: f5632051-3a3f-486b-14ef-08dec64184c9

X-MS-Exchange-CrossTenant-Id: 84df9e7f-e9f6-40af-b435-aaaaaaaaaaaa

X-MS-Exchange-CrossTenant-AuthSource: SJ5PEPF00000205.namprd05.prod.outlook.com

X-MS-Exchange-CrossTenant-AuthAs: Anonymous

X-MS-Exchange-CrossTenant-FromEntityHeader: Internet

X-MS-Exchange-Transport-CrossTenantHeadersStamped: LV9PR18MB927589

X-Spam_score: 13.7

X-Spam_score_int: 137

X-Spam_bar: +++++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Payment Confirmation – Your Bitcoin Order Is Being Verified

utorok 9. jún 2026 Dear Customer, This is to confirm that we have successfully

received your PayPal payment for your recent Bitcoin (BTC) purchase request.



Paypal Bitcoin Phishing from Microsoft Outlook Part 1

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Tue, 09 Jun 2026 14:14:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wX2pM-000000008Jz-3ZZB

for dave@doctor.nl2k.ab.ca;

Tue, 09 Jun 2026 14:13:36 -0600

Resent-From: The Doctor

Resent-Date: Tue, 9 Jun 2026 14:13:36 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-northcentralusazlp17013059.outbound.protection.outlook.com ([40.93.20.59]:36351 helo=CH4PR04CU002.outbound.protection.outlook.com)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wWz2L-00000000Mzm-1z9q

for doctor@doctor.nl2k.ab.ca;

Tue, 09 Jun 2026 10:10:57 -0600

Received: from SJ0PR03CA0161.namprd03.prod.outlook.com (2603:10b6:a03:338::16)

by LV9PR18MB927589.namprd18.prod.outlook.com (2603:10b6:408:376::24) with

Microsoft SMTP Server (version=TLS1_2,

cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.92.10; Tue, 9 Jun 2026

16:09:43 +0000

Received: from SJ5PEPF00000205.namprd05.prod.outlook.com

(2603:10b6:a03:338::4) by SJ0PR03CA0161.outlook.office365.com

(2603:10b6:a03:338::16) with Microsoft SMTP Server (version=TLS1_3,

cipher=TLS_AES_256_GCM_SHA384) id 15.21.92.13 via Frontend Transport; Tue, 9

Jun 2026 16:09:43 +0000

Authentication-Results: spf=pass (sender IP is 209.85.128.69)

smtp.mailfrom=gmail.com; dkim=pass (signature was verified)

header.d=google.com;dkim=pass (signature was verified)

header.d=gmail.com;dmarc=pass action=none header.from=gmail.com;compauth=pass

reason=100

Received-SPF: Pass (protection.outlook.com: domain of gmail.com designates

209.85.128.69 as permitted sender) receiver=protection.outlook.com;

client-ip=209.85.128.69; helo=mail-wm1-f69.google.com; pr=C

Received: from mail-wm1-f69.google.com (209.85.128.69) by

SJ5PEPF00000205.mail.protection.outlook.com (10.167.244.38) with Microsoft

SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.113.7

via Frontend Transport; Tue, 9 Jun 2026 16:09:43 +0000

X-IncomingTopHeaderMarker:

OriginalChecksum:25E206E7EFFC06789889CF8D86B6964DFEE09EA908D2C89631F8CA767E6F9F15;UpperCasedChecksum:BD9ADE5EE704C0427FE424ECDF6BE331E32665AF02722F5BC1C8778369E2571B;SizeAsReceived:3419;Count:15

Received: by mail-wm1-f69.google.com with SMTP id 5b1f17b1804b1-490c4f61a34so26033535e9.2

for ; Tue, 09 Jun 2026 09:09:43 -0700 (PDT)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=google.com; s=20251104; t=1781021382; x=1781626182; darn=groups.outlook.com;

h=to:from:subject:date:message-id:sender:reply-to:mime-version:from

:to:cc:subject:date:message-id:reply-to;

bh=3gsPOXFxVkVry+97oF/DtoS3xmb1+/434RuDnz6KWwU=;

b=qHKWfW6ZXpSimhCwbftv4xr/rqGg098TGoNW3GNKhTY6qLkiGn8Uqk9cepSh8ZMLX0

52KVgfLKwHMTk+Tv5lK3xlFN1DtqieGG2sX7g7ASOQ2z97wyy4h2keI8j8hbWKWr4CtH

40BLeYHFQy5fwWzLVmttgnRua7FmDbTK275U5J9oo6MVXujlQy4hcWsPkAajgGk9rMPD

vi696C4q6fQ/b5kjR5VQvoWBlj4OV13c1aAIokCEdNvZtvutW3R47uhTYNh5XQQmVfef

61VkXqQL3zn1WsNiUzZX8Q3Fw1laGTYNQD33rFP6gWx6nRg+9+0VJruFBnB+E9bIYi+3

5LmA==

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=gmail.com; s=20251104; t=1781021382; x=1781626182; darn=groups.outlook.com;

h=to:from:subject:date:message-id:sender:reply-to:mime-version:from

:to:cc:subject:date:message-id:reply-to;

bh=3gsPOXFxVkVry+97oF/DtoS3xmb1+/434RuDnz6KWwU=;

b=dItvbUxLcD9s9giosS0mgrmC50efZ164QIyIAOVSn99uoHu8oFpaaUwXDUkD1egJ6K

kFxsTfA/FfrxVi0/48vm2Un1Ba2RaYxWWPGY2e6Gxh2+9jKQtJWJTyCemWM26ekcJ6KF

iZFxQGy031BdO1NsK9pw6UgqxzQVHUirYH4f9lgDD6BcyQn9Ccqivmxxb5uKcfSQbgX/

COIL6FfzAPjcaKJl4Vkvg3aqgy7WOsIBdADPgZgCr2SBd1/M+Mf+bKmLUq+zxUf1h4ZJ

909KyIKJFQirXeLYImL4MjKbEJN7SX6HZpKKNvggkEWOTHk0cO5/JUhEGkYpin/25Stz

2AZg==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20251104; t=1781021382; x=1781626182;

h=to:from:subject:date:message-id:sender:reply-to:mime-version

:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to;

bh=3gsPOXFxVkVry+97oF/DtoS3xmb1+/434RuDnz6KWwU=;

b=rhNR/7SMCSo9kH+hhSRcNqZaXKSM0PFaJ0HckxNGRDAG5ycBo0Rxf9IQZ0qzisj96w

F8PFJQwTkmuBMv1E3BpNS4R6a2sk1N3LMCaFIxuDND+/IqFI4h6w5rAD5+q7SKTctzDo

OhA3ifMViHavXDpbMZD3ikepRk1+fShPRLz2PLQ/MK/1irjM1KVj8zVorLo5sdLTB27H

e/pZBJ4q77Vr2vtcnfqwY/uLay+aRid3iAyGMeunFrErcvE2nOfTmvkTCPcX612J4FUw

bBjYdJqJD+JLNbBRKIIUsizOCy9fJvGuFx7JP7KwSD6aKcupzhovSAIgwA60o8DG8xIe

a78w==

X-Gm-Message-State: AOJu0YzrTVfivXnWWlGg+DGIWB2nHkj/rHLwbyR1HnrW0sEqKxmHMR+q

WfKNZpOiWbvtell7zswSZbifzD/5vym2vRbDJGMkci1CjsI9mHHGR+9PQ+ooK9Qs52U4qlUKKjY

w1Ps37DUV4rPwvLOtQPAUhSTabQZqyJf7mU8=

MIME-Version: 1.0

X-Received: by 2002:a05:600c:c491:b0:490:bb44:3f8b with SMTP id

5b1f17b1804b1-490c2605385mr349204085e9.17.1781021381628; Tue, 09 Jun 2026

09:09:41 -0700 (PDT)

Reply-To: Haresasz Nxysarwsa

Sender: =?UTF-8?Q?Kalend=C3=A1r_Google?=

Message-ID:

Date: Tue, 09 Jun 2026 16:09:41 +0000

Subject: =?UTF-8?Q?Pozv=C3=A1nky=3A_Payment_Confirmation_=2D_Your_Bitcoin_Order?=

=?UTF-8?Q?_Is_Being_Verified_=40_ut_9=2E_j=C3=BAn_2026_=28cynthiaperez389903=40gro?=

=?UTF-8?Q?ups=2Eoutlook=2Ecom=29?=

From: Haresasz Nxysarwsa

To: cynthiaperez389903@groups.outlook.com

Content-Type: multipart/mixed; boundary="000000000000ca1c610653d45a01"

X-IncomingHeaderCount: 15

X-EOPAttributedMessage: 0

X-EOPTenantAttributedMessage: 84df9e7f-e9f6-40af-b435-aaaaaaaaaaaa:0

X-MS-PublicTrafficType: Email

X-MS-TrafficTypeDiagnostic: SJ5PEPF00000205:EE_|LV9PR18MB927589:EE_

X-MS-Office365-Filtering-Correlation-Id: f5632051-3a3f-486b-14ef-08dec64184c9

X-MS-Exchange-EOPDirect: true

X-Sender-IP: 209.85.128.69

X-SID-PRA: HARESSAZNZXRRSXAXZ321@GMAIL.COM

X-SID-Result: PASS

X-MS-Consumer-Group-Expansion-Loop: cynthiaperez389903@groups.outlook.com

X-MS-Exchange-Group-Expansion-Loop: cynthiaperez389903@groups.outlook.com

X-Microsoft-Antispam:

BCL:0;ARA:1444111002|9020799019|9000799056|29080799009|16200799027|9400799043|4040799016|970799063|34130799006|32020799003|3151999006|26000799027|6149299003|26130799012|22000799015|24102599021|5139299004|1680799066|6092099016|26104999009|21002599022;

Microsoft Teams phish Part 2

Posted by Dave Yadallee on



: rgb(50, 49, 48); line-height: 1.5; font-size: 14px;">A client has shared =

a business plan with you via Microsoft SharePoint.




adius: 8px; border: 1px solid rgb(237, 235, 233); border-image: none; width=

: 100%;" cellspacing=3D"0" cellpadding=3D"0">












adding: 14px;">


ellspacing=3D"0" cellpadding=3D"0">
















=3D"middle" style=3D"margin: 0px; width: 44px;">
=3D"margin: 0px; padding-left: 12px;">




yle=3D"color: rgb(96, 94, 92); font-size: 12px; margin-top: 4px;">Business =

document • Shared via Microsoft SharePoint



yle=3D"color: rgb(138, 136, 134); margin-top: 6px;">A client has shared thi=

s file with you
=3D"right" style=3D"margin: 0px; color: rgb(96, 94, 92);">Shared





: rgb(50, 49, 48); font-size: 14px;">This file is attached to this email.
p>


r: rgb(50, 49, 48); font-size: 14px;">Please open the attachment to view th=

e document. If access is required, contact your administrator.




one; border-color: rgb(237, 235, 233) currentColor currentColor; margin: 24=

px 0px; border-right-width: medium; border-bottom-width: medium; border-lef=

t-width: medium;">


94, 92); font-size: 12px;">You are receiving this notification as a member=

of the nk.ca Teams workspace.










; margin: 0px; padding: 16px 24px; text-align: center; color: rgb(96, 94, 9=

2); font-size: 12px;">© Microsoft Corporation
This is an automated =

message. Please do not reply.





















Microsoft Teams phish Part 1

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Tue, 09 Jun 2026 14:14:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wX2p5-0000000080P-0BY1

for dave@doctor.nl2k.ab.ca;

Tue, 09 Jun 2026 14:13:19 -0600

Resent-From: The Doctor

Resent-Date: Tue, 9 Jun 2026 14:13:18 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from go-lanjingtv.com ([141.133.172.76]:58737)

by doctor.nl2k.ab.ca with esmtp (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wWyiT-00000000D9I-0yaf

for sales@nk.ca;

Tue, 09 Jun 2026 09:50:20 -0600

From: admin@nk.ca

To: sales@nk.ca

Subject: New File Shared with You in Microsoft Teams#67641033

Date: 9 Jun 2026 08:49:22 -0700

Message-ID: <20260609084922.D978BFCD48305D33@nk.ca>

MIME-Version: 1.0

Content-Type: text/html

Content-Transfer-Encoding: quoted-printable





















=20=20=20=20=20=20=20=20




32px 0px; color: rgb(51, 51, 51); text-transform: none; letter-spacing: no=

rmal; font-family: "Segoe UI", Arial, sans-serif; font-size: 11px; font-sty=

le: normal; font-weight: 400; word-spacing: 0px; white-space: normal; orpha=

ns: 2; widows: 2; font-variant-ligatures: normal; font-variant-caps: normal=

; -webkit-text-stroke-width: 0px; text-decoration-thickness: initial; text-=

decoration-style: initial; text-decoration-color:=20

initial;' cellspacing=3D"0" cellpadding=3D"0">








255); border-radius: 8px; width: 100%; overflow: hidden;" cellspacing=3D"0=

" cellpadding=3D"0">












x; border-bottom-color: rgb(237, 235, 233); border-bottom-width: 1px; borde=

r-bottom-style: solid;">


"0">














=3D"margin: 0px;">


d: rgb(98, 100, 167); border-radius: 4px; width: 20px; height: 20px; text-a=

lign: center; color: rgb(255, 255, 255); line-height: 20px; padding-top: 0p=

x; font-weight: bold; border-top-color: currentColor; border-top-width: 0px=

; border-top-style: none;">MT
adding-left: 8px;">


b(50, 49, 48); padding-top: 0px; font-size: 14px; font-weight: 600; border-=

top-color: currentColor; border-top-width: 0px; border-top-style: none;">Mi=

crosoft Teams



b(96, 94, 92); font-size: 12px;">





tom: 20px;" cellspacing=3D"0" cellpadding=3D"0">














"margin: 0px;">


d: rgb(98, 100, 167); border-radius: 50%; width: 40px; height: 40px; text-a=

lign: center; color: rgb(255, 255, 255); line-height: 40px; padding-top: 0p=

x; font-size: 14px; font-weight: bold; border-top-color: currentColor; bord=

er-top-width: 0px; border-top-style: none;">AT
adding-left: 12px;">


b(50, 49, 48); padding-top: 0px; font-size: 14px; font-weight: 600; border-=

top-color: currentColor; border-top-width: 0px; border-top-style: none;">ad=

min@nk.ca



b(96, 94, 92); font-size: 12px; margin-top: 2px;">General • Finance T=

eam



b(96, 94, 92); font-size: 12px; margin-top: 2px;">Shared a file with you
iv>


b(96, 94, 92); font-size: 12px; margin-top: 2px;">6/9/2026 8:49:22 a.m. (UT=

C+02:00)

WEb/SEO/App spam from Microsoft Outlook PArt 3

Posted by Dave Yadallee on



11pt; color: rgb(0, 0, 0);">

Thank you





x_x_x_x_x_x_x_x_x_x_x_x_x_x_x_x_divRplyFwdMsg">


11pt; color: rgb(0, 0, 0);">

From: sanaya parween <sanayaparween550@outlook.com>


Sent: Monday, April 27, 2026 7:21 PM


Subject: Re: 


 





_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb=

(0, 0, 0);">

Hi,



_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb=

(0, 0, 0);">







_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb=

(0, 0, 0);">

I checked your website you have an impressive site, but ranking is not good=

on Google.



_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb=

(0, 0, 0);">







_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb=

(0, 0, 0);">

Would you like to optimize your site? I will be happy to share our pricing =

and proposals with you.



_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb=

(0, 0, 0);">







_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb=

(0, 0, 0);">

Let me know If you are interested, I will send you our SEO Packages and pri=

ce list.



_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb=

(0, 0, 0);">







_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb=

(0, 0, 0);">

Thanks,








--_000_DM8P223MB00786C195D8A266A0F3515A8931D2DM8P223MB0078NAMP_--

WEb/SEO/App spam from Microsoft Outlook PArt 2

Posted by Dave Yadallee on
x-ms-exchange-antispam-messagedata-0:

=?iso-8859-1?Q?fN1bObw36XIBA6X9MW9BwxRwMdhp+FeG3ALBDTJv5izqXnSXj42ITjRW6m?=

=?iso-8859-1?Q?hzxZHT7LJlfI9C5bp3i5Nrj7afEQdgngthvzq0sxZ0dGFH0t5RF6lNb/wT?=

=?iso-8859-1?Q?TdS02rTClurTpbSOOL04J1TfB2TN22f8ao49wajRw0uiaVemheIm/sNfIw?=

=?iso-8859-1?Q?8boHEJxKp8L0sk900rU3U+wB06LeuZ1b9utiwchLCUL5O99XHP4ezH3/B9?=

=?iso-8859-1?Q?a2R/ng0YhgbTZ/c+cxOCQue98LAmptrNKvmIrez7XSELJPyvxGSHmECfuU?=

=?iso-8859-1?Q?D68DIjitX6enCXsThgJn1zxi3wDDpB5WbYla6BuG+X4g6FOpaJ+09JSWWl?=

=?iso-8859-1?Q?PWYKQhfWvbY1EU3miKeH/BbdUrDU+I0Xv4IhSOdh2hLPxFKSnipBzZ1g5P?=

=?iso-8859-1?Q?AWvyOZZp1szsSNGR9gwb/JyRqKRaeXVXR1pRxqpcVnFjp9Pz2wUDvKdbsl?=

=?iso-8859-1?Q?k04W9fuGQrrob7u0O1uLtl1ycfhiVb2ES3ol5hlbgDOWi/NEzqEGT3wLkq?=

=?iso-8859-1?Q?1y8UjeMy3eWK5XeOImE5iQJYXMuws3rPBvD++db0Vx28F3c1jYauZ6qw3C?=

=?iso-8859-1?Q?8hXXKRuSN/mi997a+p9sHLg+4ZG1s5V0O1Ec4BKkKQv+8GhQOkk2KQdGcm?=

=?iso-8859-1?Q?DI+VN5Odz9kdRmk+q7JrpWktXVmPUfIfcj7YJ+zbSnjDG/dLX1LGtMaQPt?=

=?iso-8859-1?Q?MY3AiWO1IAVDFPgIQk6yPdDESNJfLhkQ0EhwDfoUS02GRBmBHiIzixaPzV?=

=?iso-8859-1?Q?Kk3o6u7UE67c9TkorsyVKtwpSFtiAKjK399rlPYj5RgHkVCNStKfL/O220?=

=?iso-8859-1?Q?Kmoe0wHO90bXMOsh13McM4Gv+WNCtqA2Vc0xEJF4iwO/EtSDiE0pGLbSJW?=

=?iso-8859-1?Q?vTyfZlr76SwDI6GhiQ3uqAL0hen533zVuxAPeghwKl+fmWrBXmdqfSGXr2?=

=?iso-8859-1?Q?ABE7neL5e+LVle3B0xmIJBa69cZ4pLPsw3iGPY80OGx7Xcu8DDSztHsK9Q?=

=?iso-8859-1?Q?XzXWcb3jrj6EydP537NO7oj4/+SQ6fLsn1N+BEp5FI6LGBFxIo4DETdXwA?=

=?iso-8859-1?Q?Q0xuNroqqPDTeLHbNOzQn0I/Y6qvXw6RMvzVdrfzJq3jTZJr1ly87j+b2T?=

=?iso-8859-1?Q?+rM7YnGGHfUTMtf0TllDvPw5YVc4wJq8aVFC9GJRSOIiQ3ubcZvJUdN9L+?=

=?iso-8859-1?Q?0hGcnmSR4MGuZsR4cSm9+7VX4w2kEddyC5igTvdqIoWzg4+xe/yls/Qv3e?=

=?iso-8859-1?Q?2EZzaE+OA01PucwFP5+wI6yvUOPNc6Cqeg4uvxot/+d1hWWOYntfhgg7jH?=

=?iso-8859-1?Q?6Xo5A5Dj9jvXBKnYv72gLFP2d2sx/4AuLCvvYb66NvoV2AVABNhu6ze30P?=

=?iso-8859-1?Q?y4rLpasz7EfMpLqP9JWSF+0/SU4gBsMag2NFRAOIUe8xJFooaXINGjrzYm?=

=?iso-8859-1?Q?6JiTPgmBD6wjNlJ2?=

Content-Type: multipart/alternative;

boundary="_000_DM8P223MB00786C195D8A266A0F3515A8931D2DM8P223MB0078NAMP_"

MIME-Version: 1.0

X-OriginatorOrg: outlook.com

X-MS-Exchange-CrossTenant-AuthAs: Internal

X-MS-Exchange-CrossTenant-AuthSource: DM8P223MB0078.NAMP223.PROD.OUTLOOK.COM

X-MS-Exchange-CrossTenant-RMS-PersistedConsumerOrg: 00000000-0000-0000-0000-000000000000

X-MS-Exchange-CrossTenant-Network-Message-Id: 43c85beb-7abc-476f-7cf0-08dec63b816e

X-MS-Exchange-CrossTenant-originalarrivaltime: 09 Jun 2026 15:26:40.9846

(UTC)

X-MS-Exchange-CrossTenant-fromentityheader: Hosted

X-MS-Exchange-CrossTenant-id: 84df9e7f-e9f6-40af-b435-aaaaaaaaaaaa

X-MS-Exchange-CrossTenant-rms-persistedconsumerorg: 00000000-0000-0000-0000-000000000000

X-MS-Exchange-Transport-CrossTenantHeadersStamped: CY5P223MB0539



--_000_DM8P223MB00786C195D8A266A0F3515A8931D2DM8P223MB0078NAMP_

Content-Type: text/plain; charset="iso-8859-1"

Content-Transfer-Encoding: quoted-printable



Hello



I'm still waiting for your answer. Can I send you quote & pricelist for rev=

iew?



Thank you

________________________________

From: sanaya parween

Sent: Monday, April 27, 2026 7:21 PM

Subject: Re:



Hi,



I checked your website you have an impressive site, but ranking is not good=

on Google.



Would you like to optimize your site? I will be happy to share our pricing =

and proposals with you.



Let me know If you are interested, I will send you our SEO Packages and pri=

ce list.



Thanks,



--_000_DM8P223MB00786C195D8A266A0F3515A8931D2DM8P223MB0078NAMP_

Content-Type: text/html; charset="iso-8859-1"

Content-Transfer-Encoding: quoted-printable








1">








11pt; color: rgb(0, 0, 0);">

Hello



11pt; color: rgb(0, 0, 0);">







11pt; color: rgb(0, 0, 0);">

I'm still waiting for your answer. Can I send you quote & pricelist for=

review?



11pt; color: rgb(0, 0, 0);">




WEb/SEO/App spam from Microsoft Outlook PArt 1

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Tue, 09 Jun 2026 14:11:00 -0600

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wX2mo-000000001ht-3OZT

for dave@doctor.nl2k.ab.ca;

Tue, 09 Jun 2026 14:10:58 -0600

Resent-From: The Doctor

Resent-Date: Tue, 9 Jun 2026 14:10:58 -0600

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-westcentralusazolkn19010045.outbound.protection.outlook.com ([52.103.7.45]:24242 helo=CY7PR03CU001.outbound.protection.outlook.com)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.99.3 (FreeBSD))

(envelope-from )

id 1wWyMb-000000000qu-2dbu

for sales@nk.ca;

Tue, 09 Jun 2026 09:27:48 -0600

ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none;

b=ehHug8aBRuYPfYWWwRPhVQUqzSDhyGFUCs1rz1Sw4cZ9ZrXQDQiT7SXbgRmoQkLOkPmULwHyUjhZvuSp8qMKrkBk2m6JWKVF2Ek+L00DObfxO1WI3Y5IOpjmrWNA4vlP4GFso3aZlUSUrB5AW25srmQGSVxQIJvZDbcSiVQA+7mNolwBD1Fdhmgjyb8Cew+4cHhTJ5sVZZoern0uLhTnH4FJ5pCczjfz7rpND+4RsM3ZZQdtY2yXLpHOwJDMNjPg1hW4BF2ZKq3PVtAMPlwEjnap0TjNdC5+2kFkFjeKO+DxrA+EDwoyNjLRDfLl4lJNmzya4T2+QHpXqDmtqZ5k9Q==

ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;

s=arcselector10001;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1;

bh=J75NKGkRiIFS1xcsns2Vvl9OBAqh2DAB9O0EJskSnfE=;

b=EuerkV1nsvE4hWaAaRK0QFgCkUbiK7ibUT579WudNhUd3x5n23n6qOk2N+NKe37cL5HdUFLzFRkE5NgTydyATW4LaYvhj2TyAQwz/DCGyCOC+Xxjgj3Ka8VzBfrh7x/zAyzsI+JtApOsZbqUdf/0SIGgNlJnw9ilx0wCgnGRX3IO+92+wKtiUxaCCJUeq/qwggmTdnMpgbZgWRhTZx4RkJa0x+jVN8TfdoyCVa5x3gFqtyFrp2pDM8ar5UWF6A4YNbdIIrRRi+ML2nZgqlI2SfC1dO1Iyi75rKuYMB5fAAFZ5Un7CH6/xWb1vF9ka9qostpvbjiST03QqLXp7rkV4g==

ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=none; dmarc=none;

dkim=none; arc=none

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=outlook.com;

s=selector1;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck;

bh=J75NKGkRiIFS1xcsns2Vvl9OBAqh2DAB9O0EJskSnfE=;

b=S1DCG45E+drjpHbL6Q/LbpwP2uLr8x2QlPfzxU9+6swIy4xZlBa1/4v1AE4GA50n4s/GaZcvEBzkIXRKspCqudrqeln1AZoXuz9hj7qZsBR0KTO48TsF1hRwFMP5CSLp0h0bvLYMEQ9chxYGiqHw/MqpOG1p9nPVjXkrL/s/zPoSKJM5MIjTQPy826rHj8+zZWY0Bo9U9M1wzdFRCSyp1RE8MZbXpAh/Ru+bYFmwTGLWZ0vIBlObxDifH+KCLw7ySVIRQYYqC7ppnEB5/CmUhRqU3o82iaShMaEcnbX0GLSxMCnv/N3h1Dftj0ige3cNzVlU2QZKhSE1qRclDb5/nQ==

Received: from DM8P223MB0078.NAMP223.PROD.OUTLOOK.COM (2603:10b6:8:8::7) by

CY5P223MB0539.NAMP223.PROD.OUTLOOK.COM (2603:10b6:930:24::19) with Microsoft

SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id

15.21.92.14; Tue, 9 Jun 2026 15:26:41 +0000

Received: from DM8P223MB0078.NAMP223.PROD.OUTLOOK.COM

([fe80::2be2:8c45:88b7:7124]) by DM8P223MB0078.NAMP223.PROD.OUTLOOK.COM

([fe80::2be2:8c45:88b7:7124%6]) with mapi id 15.21.0092.011; Tue, 9 Jun 2026

15:26:41 +0000

From: sanaya parween

To: sanaya parween

Subject: Re:

Thread-Index:

AQHc6P9bE2i6KAzURkyeb/Ak2cceELYZ+Z7pgAACgfCABHngNIAAAR+hgAOCgB6AAAHVjoADKgOsgAABOdqABJHzkIAAAhIIgAM69NaAAADTeYABjl79gAABOseAAZSFUIAAATl/gAHAX++AAADRTYADAKfWgAABRiqAAZbRFYAAAPcb

Date: Tue, 9 Jun 2026 15:26:40 +0000

Message-ID:



References:











In-Reply-To:



Accept-Language: en-US

Content-Language: en-US

X-MS-Has-Attach:

X-MS-TNEF-Correlator:

msip_labels:

x-ms-publictraffictype: Email

x-ms-traffictypediagnostic: DM8P223MB0078:EE_|CY5P223MB0539:EE_

x-ms-office365-filtering-correlation-id: 43c85beb-7abc-476f-7cf0-08dec63b816e

x-ms-exchange-slblob-mailprops:

2xtDbzDEsjLHy/zW1UT+TKXSYW1I/uQ3Lajw/BN8z5ODvz/Q/b6XU5wThp6dX56Ci6z5xgLI0aZgl74GrEzvcl6UkKgPAe5GVlG/8SuEDUrWUZKPZxLaX6UCrMrnSwAiYXStNjnRocuuU0jgJOf/jWLpEKQO3ItOi8i4e/2/bOUL50QzBFMoD1g38R23VTgAV+jCC5scDynP/Akb65tqSU9hvUQWv6ivxxRbMETi8MZGCHd9nI3ol64xwn0dv53GqxWsMq0ahdaddrWEs7Tx0qtGQc75ysJl2u7crKjw5ypkpV0pFFHUmIl7eSxFUsnOmTnCvOV51Gro8sHzpyqUb/oXtjqmDqMJ1IGfIzZ2RbLfXhMvEoLqFTyRgIeAaZjhS3SEOHbRw/dqOjbCo9xOJ0aHxRCFgE0ucQOePeqexvnIPIW9l0FKtTiisa/htx/p4m7pQNpG0aP7lKnY/9lR/Wj9WmFsx86Fy6/KN87fGEKvNaA50q38P4o7P6WV1qX0XvTpXQG2QC3LMUAKC9B3bmQd65fHaEkzPaHCors8VChe6dcKA80fCEJCmIh/Ie0KMDzAnx/XuWnZ/v5gZjWEzA==

x-microsoft-antispam:

BCL:0;ARA:14566002|10112599003|16051099003|55001999006|2604031031799003|2604032031799003|704163111799003|19110799012|31061999003|8062599012|8060799015|24121999003|22091999003|39105399006|15080799012|15030799006|102099032|40105399003|51015399003|18071099003|26121999007|440099028|3412199025|1710799026;

x-microsoft-antispam-message-info:

=?iso-8859-1?Q?yZpTcwgjCG0NORa4b/As5i/HtC+uQSTGscIqJp9zRogoUhT9rO+xsf7YBS?=

=?iso-8859-1?Q?D7Dm69bpL4rVZRr5LZ+EJ+Tq9x689uIBWxv0i/qCv/ZMyFEATQaKJbfdnr?=

=?iso-8859-1?Q?pmnNQZMuou9n0hAQlIPq/b7OzWCL3OpQOe0vSbY35z6Xc5GdjWpxFZ3w8r?=

=?iso-8859-1?Q?2k08p2ZUSCSrep88UinL5tsk7gDEkpWq2SDV96ms6+c1zf7zicZFXjEe3X?=

=?iso-8859-1?Q?RENxKNfVyKpe5r2a7/hDn5DTKixdBOnwHxPuhufOO/2fT+0n8sdSNK40uV?=

=?iso-8859-1?Q?aSF727aOHLmXjNprVUMH5z66GxZ9wbC7gbxxHHcfcxxPKCJdIsD9hw5v5y?=

=?iso-8859-1?Q?ng6Nr049Tg7NfIdAuLDi7oL4js+l14t7HbgBZYkdd0veBf/+boCQDAufv0?=

=?iso-8859-1?Q?ZwyoBzKrv+RC1FxFA4gl+fjXNU7/itSu85QOi9GbT09FodRSwhFPE9tTuQ?=

=?iso-8859-1?Q?yh/RSjBON7kf/dlXsCVWoVPvDWHIW4bGaQMJJ2/KDHTkUwC/jUjrIZKV8p?=

=?iso-8859-1?Q?vMalJm2+ibrvEGy1q/vHp+uTx4enxXY0hLRg0aVOy5tRda74Cb28RfBal+?=

=?iso-8859-1?Q?gnPOEgGmpsISNzFAmI0So4l3e6DJLGsMWAZkB919ndXvBwQur8soNf9mQr?=

=?iso-8859-1?Q?xkaRh0SIcg4mQ8qGeexJbJHv6MpysRCqa3qsiA5Ew9Uaeg7cqcNk6Rbnm4?=

=?iso-8859-1?Q?m1NKTyIzg0q2SVOqfFEkSeGxUedp96pWbGWtTxW/0ggu61ELES4iPBQtFP?=

=?iso-8859-1?Q?5oOKaosFNP3GOU1mo08o931rYYxUaH+dNODeQrYv/okeu7DWK9eLuWeHUq?=

=?iso-8859-1?Q?geE29xoi1UZ24IEW2CIlvfsvV2r2vVYGu/tYUh87yakk+jV085EfGILl4H?=

=?iso-8859-1?Q?ck+IUlWvTixR1kBYIZiynHA/aEIa7Fheoo6V9EHgeNqCkAVlDztACNcmTx?=

=?iso-8859-1?Q?arLMHy6Q2rFvIr0X9OfLQUAHlnJuLG66cIgsfMf8pReRaQu8kAFp6wjgZ/?=

=?iso-8859-1?Q?zJNkk7k3WJlK0/4AewqmI9labF9u/NhXECVBKHmmtnVUXnOeZhzlklYIyh?=

=?iso-8859-1?Q?o2OT3O2TpqbihzOUH7XLe/OmQLjIgxCBVtFSr57xKJzXR7KxcnWBkCnhSK?=

=?iso-8859-1?Q?zXo85NFmAo/Xr2a0aM7huUQgu6Ha3BtDdicH2dYaR17NBUoujQv1peTqX+?=

=?iso-8859-1?Q?FCLaaBBnE2929dULYOlOZqyKnN3ZOa3wLImykogbIL25u4OFN7EN47U9Lj?=

=?iso-8859-1?Q?q0vfdB3Qgg0DiOdwQf3/QQ4OD9tEDPB6JpERvXLx1fUeZqtj7E+RcFTgKf?=

=?iso-8859-1?Q?QHfrS4jvKEQ8i/uVbwu/XmmQ5UU74S8T8XZLRLUp0jCZGHqGbTFZCZCIMJ?=

=?iso-8859-1?Q?pFEigd4oJq894eA9B7DhqFrSxw/A0m6v9o4I83P11DIWbY302Jtng=3D?=

x-ms-exchange-antispam-messagedata-chunkcount: 1