Project investment spam from Microsoft Outlook Part 2

Posted by Dave Yadallee on
Content analysis details: (10.9 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[2603:10a6:10:618:0:0:0:5 listed in]

[will-spam-for-food.eu.org]

[2603:10a6:10:618:0:0:0:5 listed in]

[will-spam-for-food.eu.org]

[2603:10a6:10:618:0:0:0:5 listed in]

[will-spam-for-food.eu.org]

[2603:10a6:10:618:0:0:0:5 listed in]

[will-spam-for-food.eu.org]

[2603:10a6:10:618:0:0:0:5 listed in]

[will-spam-for-food.eu.org]

[2603:10a6:10:618:0:0:0:5 listed in]

[will-spam-for-food.eu.org]

[2603:10a6:10:618:0:0:0:5 listed in]

[will-spam-for-food.eu.org]

[2603:10a6:10:618:0:0:0:5 listed in]

[will-spam-for-food.eu.org]

[52.103.35.79 listed in will-spam-for-food.eu.org]

[52.103.35.79 listed in will-spam-for-food.eu.org]

[52.103.35.79 listed in will-spam-for-food.eu.org]

[52.103.35.79 listed in will-spam-for-food.eu.org]

[52.103.35.79 listed in will-spam-for-food.eu.org]

[52.103.35.79 listed in will-spam-for-food.eu.org]

[52.103.35.79 listed in will-spam-for-food.eu.org]

[52.103.35.79 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[52.103.35.79 listed in dnsbl.ahbl.org]

[52.103.35.79 listed in dnsbl.ahbl.org]

[52.103.35.79 listed in dnsbl.ahbl.org]

[52.103.35.79 listed in dnsbl.ahbl.org]

[2603:10a6:10:618:0:0:0:5 listed in]

[dnsbl.ahbl.org]

[2603:10a6:10:618:0:0:0:5 listed in]

[dnsbl.ahbl.org]

[2603:10a6:10:618:0:0:0:5 listed in]

[dnsbl.ahbl.org]

[2603:10a6:10:618:0:0:0:5 listed in]

[dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[52.103.35.79 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[52.103.35.79 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[52.103.35.79 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[52.103.35.79 listed in dnsbl.ahbl.org]

-0.0 SPF_PASS SPF: sender matches SPF record

0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider

[khalifmohammed41(at)outlook.com]

0.2 FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in digit

[m.khalif2016(at)gmail.com]

-0.0 T_RP_MATCHES_RCVD Envelope sender domain matches handover relay

domain

1.2 MISSING_HEADERS Missing To: header

0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends in

digit

[khalifmohammed41(at)outlook.com]

-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)

[52.103.35.79 listed in wl.mailspike.net]

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

1.4 MALFORMED_FREEMAIL Bad headers on message from free email service

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

1.9 REPLYTO_WITHOUT_TO_CC No description available.

1.0 FREEMAIL_REPLYTO Reply-To/From or Reply-To/body contain different

freemails

Subject: {SPAM?} Project funding/loan



--_000_DU4PR07MB11594A48C79112058B002DD9DD29FADU4PR07MB11594eu_

Content-Type: text/plain; charset="iso-8859-1"

Content-Transfer-Encoding: quoted-printable



Greetings,





Al Ghurair Investment is offering single digit interest loan for private an=

d corporate bodies, to finance their projects across the globe.



With our flexible security and an option of early repayment and/or conversi=

on into equity, our project financing is the best you can get. Our track re=

cords are there to speak volume.



Kindly submit your business plan to my official email addresses below, for =

consideration.







Mohammed Khalif

Foreign Loan Consultant

Email: m.khalif2016@gmail.com

m.khalif@al-ghurairinvestmentgroup.cc









--_000_DU4PR07MB11594A48C79112058B002DD9DD29FADU4PR07MB11594eu_

Content-Type: text/html; charset="iso-8859-1"

Content-Transfer-Encoding: quoted-printable








1">








Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" clas=

s=3D"elementToProof">

Greetings,



Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" clas=

s=3D"elementToProof">







Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" clas=

s=3D"elementToProof">







Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" clas=

s=3D"elementToProof">

Al Ghurair Investment is offering single digit interest loan for private an=

d corporate bodies, to finance their projects across the globe.



Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" clas=

s=3D"elementToProof">







Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" clas=

s=3D"elementToProof">

With our flexible security and an option of early repayment and/or conversi=

on into equity, our project financing is the best you can get. Our track re=

cords are there to speak volume.



Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" clas=

s=3D"elementToProof">







Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" clas=

s=3D"elementToProof">

Kindly submit your business plan to my official email addresses below, for =

consideration.



Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" clas=

s=3D"elementToProof">







Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" clas=

s=3D"elementToProof">







Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" clas=

s=3D"elementToProof">







Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" clas=

s=3D"elementToProof">

Mohammed Khalif



Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" clas=

s=3D"elementToProof">

Foreign Loan Consultant



Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" clas=

s=3D"elementToProof">

Email: m.khalif2016@gmail.com



Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" clas=

s=3D"elementToProof">

       m.khalif@al-ghurairinvestmentgroup.cc



Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" clas=

s=3D"elementToProof">







Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" clas=

s=3D"elementToProof">







Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">












--_000_DU4PR07MB11594A48C79112058B002DD9DD29FADU4PR07MB11594eu_--

Project investment spam from Microsoft Outlook Part 1

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Fri, 30 Jan 2026 13:21:00 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vluyl-00000000KZS-2UWt

for dave@doctor.nl2k.ab.ca;

Fri, 30 Jan 2026 13:20:31 -0700

Resent-From: The Doctor

Resent-Date: Fri, 30 Jan 2026 13:20:31 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-swedencentralazolkn19013079.outbound.protection.outlook.com ([52.103.35.79]:20674 helo=GVXPR05CU001.outbound.protection.outlook.com)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vltv4-00000000AMl-178S

for sales@nk.ca;

Fri, 30 Jan 2026 12:12:53 -0700

ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none;

b=m+taud6X/9xNsdnNQ4q83oIs2qZLHhe1zEhZbqEmMZh5sgNeYvE7+tqe00QhrXR5qOCGIsQnk3TIaVb6ytcvtCfEL9JID9zcjulV72f1M9OVJ8H7/cjCNQatkabDYotlBcjV/87YFQjDIMGUwAblLMz4tzUOU2Mp7nQmdFZtJKGivyfkLOYTJdns5ZhjKhcV/2S459yI5KZeYHAtUbWBYSMH1612Em4veROysp+27MF8reTwOzagIZxSZEGTDL1EIXIj3IDOIQrBlrfICmyM+aseBDUb3JOGV6KCsC1gH/Z9ZE+DZJ74g798Ki1C2V2/MphrOOaUOStIKm6vXg1opg==

ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;

s=arcselector10001;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1;

bh=vpN1Mv/h15mUdqfwFimbiJWIzAHNFvGSHXeRlUjP5fs=;

b=t+TRHqX/uylBWEfKx8A0qxMzdrDR4QR2X3Ue8LTHdfyU/DNx3KL05eOzwLRovCVZ8C5Uj1pizk/V4SSPvyKv4gzVO/2Jqt7e15n3hkoSBw4KgGd8bUqve4BgqiVOljKCG61L7yiCTpLEVKwS2yoB8vdFliuEjE0cW7LAvIsplcg8m6viUscGw5UGPOts3nWunMnZj+S7p0TPvyFn871vQSpDa4My85ITtJcvdubRlYmCxUXQVT7yJooNvSVa7Y9DC9WVeZAdP+Y5mJKAK+R+079Kx4VB7cmq+k2m5cbeq3yKKrlQpUAhru/gcYluXGjUZtlLxPMED/ybR4amqd7fQg==

ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=none; dmarc=none;

dkim=none; arc=none

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=outlook.com;

s=selector1;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck;

bh=vpN1Mv/h15mUdqfwFimbiJWIzAHNFvGSHXeRlUjP5fs=;

b=TLh0vwPQbARxb+lnLs3XrlmL3qQwbn6JYmm4Z/C/Zn9afy/v5EQ18Pjds4as88c/yabbzMk0/QnJ/SiN5W+gt/dBA+GEEuLtrTA9+ztIEnbfpAkGp2p1K3hzmZUSLNQZ4GoUy1HmpkLM0IsxgVuSrj97g3SIYBpTihI1DFcJRadhdyn9UT8hBSi+iF9yKgiXuM10l5uv634ivMQLVp4SwzonediiXOU61P7rl+bEt/yRy/AHktDxYK1cewDQhL2Sef8267QFSFLvjEnu4x4nMHxaWvSAAckKVY6Li9ubUHR3DwH/VBnUpFsOD/4VoPYDVSBP6t4xkhk9EdJAp1y4/Q==

Received: from DU4PR07MB11594.eurprd07.prod.outlook.com (2603:10a6:10:618::5)

by GVXPR07MB9822.eurprd07.prod.outlook.com (2603:10a6:150:11a::14) with

Microsoft SMTP Server (version=TLS1_2,

cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.9564.11; Fri, 30 Jan

2026 19:11:36 +0000

Received: from DU4PR07MB11594.eurprd07.prod.outlook.com

([fe80::f552:3ff6:ee97:679b]) by DU4PR07MB11594.eurprd07.prod.outlook.com

([fe80::f552:3ff6:ee97:679b%6]) with mapi id 15.20.9564.010; Fri, 30 Jan 2026

19:11:36 +0000

From: Khalif Mohammed

Subject: Project funding/loan

Thread-Topic: Project funding/loan

Thread-Index: AQHckhxAkNJbo740T0O25JVdX5mGzA==

Date: Fri, 30 Jan 2026 19:11:36 +0000

Message-ID:



Reply-To: "m.khalif2016@gmail.com"

Accept-Language: en-US

Content-Language: en-US

X-MS-Has-Attach:

X-MS-TNEF-Correlator:

msip_labels:

x-ms-publictraffictype: Email

x-ms-traffictypediagnostic: DU4PR07MB11594:EE_|GVXPR07MB9822:EE_

x-ms-office365-filtering-correlation-id: a20c6a27-abb8-40eb-0053-08de60336383

x-ms-exchange-slblob-mailprops:

9IecXKUgicB5Y5xtj3Bi4po1AHQXatGhZQJ7VCU6lf2I0QCUPp3vR0WpW7B4Qk28w4QNO83tpPzs8Wl41CP1jcAz88cEGdK/fXWUiGquZqiDi+gU1OiV/LnwlM07nQ/S+9mCC6N74EjsTJZOFirmggtpHIrMiNxCd/Dl6qLwqtlhNV9KQD+P0uw0gKE36wsSIeTUwfQbMyjn4dzIFHx0O2LdsF+EYDAI7uertUpvSDIq9es5EFXABwpVce1z+9IDGi1wf49B87cBNbLJcPFIPjzRD83rRKWknw1iRuGn9s4a7kVri83MDPectSzaeS3lR/7td8S/iM7R7SpFmG4oVVt1G05Ev4MWGjBn1sp5YA6MxQafuUa3NwqLoG0eEgLBf6V3tlcUKn4qBYNDb2mLM3dtIdRD9jnodlrk7/WJSkcnwqMosr+FDfLT8kHCrCdg0tGiDjNdMydpb3mcWRv8sq4uPHXML2n2ru8bmEWxe+Y8QPeaVKkPYuk8gdBuBHvnLs+t/x8Jj99WjYfVT+yZamDcDGbIt0LkyNuevpzkaD/S6ShVu6+/YAE9bpVnwEh6jdzx1so047Cdl5ILQTy6UpC9zKlpsyKZVOHdyf36ks1TtYpNC0v8LA7y1mDQTBL3OYMGcJRSB97Xc6hINP0wtvFpbrSxq51e/hZfmxb/b/qQVPPlLcmcxmUr9vT7bgtiOV0VusyWNvMV067SuKwnH8u7UXEaR3SBuw8GlyNN37ZgRLN609zNMA==

x-microsoft-antispam:

BCL:0;ARA:14566002|5062599005|461199028|11091999009|31061999003|7071999006|12121999013|19110799012|6115599003|8060799015|8062599012|39105399006|20031999003|15030799006|15080799012|440099028|3412199025|41105399003|40105399003|39145399003|35041999009|102099032|56899033;

x-microsoft-antispam-message-info:

=?iso-8859-1?Q?ZTlL5AAR6T7U2UUbtPujeOYHFnT/0w2FX3R2ZILFThPK48SxhFbjeduW/f?=

=?iso-8859-1?Q?ATCz464R3EE5P+JUHuEcSwb5ngee+2+oVzj3vHphq5sTWzETg3FRNeYXe0?=

=?iso-8859-1?Q?vasSKikk8580qrWrS+6g5u6+nj979hliEufteUo/bgkEAY/1W6PAf8LEoB?=

=?iso-8859-1?Q?dQKxvMfK5ziw7gRr6H1Sszriiju+EAPN68ZE+9Wi2vwiYRxFPj4554Dy21?=

=?iso-8859-1?Q?m/XNLej7eBk4zgUq4PxV55hpdNFzp/wT9+3G6KTwmXUDgWDHMec61zKoEh?=

=?iso-8859-1?Q?FoNVuNFcmpka80lx/gLwwlXR3GOQfrgaDDBYNoz+b5nAN+j1uVpP+0Ku/M?=

=?iso-8859-1?Q?GHXLn0rMCJ//vrWDIFAlfRffQ99PfpzK1XiG+yvn6xdRksmiuZDGDu/mxV?=

=?iso-8859-1?Q?9zXyo7jIK+yuJZyiZgoqvGWPZBt/XSaugrnr6J4hbvD45QoKbnd/xkkftQ?=

=?iso-8859-1?Q?gFhVLxpT0RKSgvIlZXJGLoAgAetKFk9y+Fw91/L4nIOxJmDm3L1fJduB++?=

=?iso-8859-1?Q?FYVXH39Pidp12pURt3DpS2SZveehJQpDMTpYLfirAziPeG0fwEDrtPhplD?=

=?iso-8859-1?Q?BVuQkSfL1/qe4oZxs6gLfBfby7+T2qBHpg4fYlw3LG/C+k6PwS6A/D4h0N?=

=?iso-8859-1?Q?NxBI5Q3Yx85KkLxzq3qBtVFfngFfdT7pfbWXD945MhbGvQs+eWdU9cMc08?=

=?iso-8859-1?Q?Hvza31ElMUjz40MA7H2n9P38ZMaXoPc58VAfcurINzIV9hLwJesw3dWg0G?=

=?iso-8859-1?Q?ErF26mf7DgO7cd0iUur2dgN6SayfHWG0QkKKwERU9XI3la/dTOywjwPLS8?=

=?iso-8859-1?Q?0tXeNSkny9eiV3NqOOQuTZJSPvmLw6YSXHAqhqJ3NSP/sgHEro3LYVDSzx?=

=?iso-8859-1?Q?I6HY7wTn6fWrqFRNYfCTzIrkzRym8d4tnFUQg5lJfsgGsjT0PDhZZpiLw8?=

=?iso-8859-1?Q?iO1fgRclOJJOCwdmAFhvrIFwmuIYcr5duH7MHcQ2Z73HWeBxLbAkCuwx7R?=

=?iso-8859-1?Q?P3LiAsv45XGX0AtIfwdx7mFU+blaD32YjxumYsMqoD/kuR+6gSC5YDAaTW?=

=?iso-8859-1?Q?gKl/JZP0vZGBo7jVHAGQnVVSXssXlg3KOf5X55OkOoCP+XPIQzFqSLHVRG?=

=?iso-8859-1?Q?LfNwmpOhMQgP4IjsTOs57z7TuXOgDLnlSI7wo36E96wzsX5bqTXG5rJ/HC?=

=?iso-8859-1?Q?DMRPYNH0VOg3f7tJHA2PCEroRk2PHMNc9Fieut2KQsHLCPX5IIt14aNq8y?=

=?iso-8859-1?Q?LtCAAH4kXhLaHBAJYJ2c/XLRegVkAyWDSF0GlJDrL55E6sT3oqrBy6oO2L?=

=?iso-8859-1?Q?s3EVlxkUv65hxJE+JA7AETn/HHNN1AfKWwa+tfPFm4LKnuLKL8fIPP+cI2?=

=?iso-8859-1?Q?usfOpi8HHajYgECokHPAC6FbkoDVHUxKTwPwNTd4nVcbTPUJoVnz+8BUw/?=

=?iso-8859-1?Q?v6H9ezeSbGT1ejB5KOIxhMyHVwCHOeMbRRbPCbrGXQGmiQJk5WkJ/KdCnS?=

=?iso-8859-1?Q?Mq1/3pkgetTIYIe3PD3Y8V7VptRs/axiFgIH7e2b9gBTTzouoV7xylUFRF?=

=?iso-8859-1?Q?Is/eJEY=3D?=

x-ms-exchange-antispam-messagedata-chunkcount: 1

x-ms-exchange-antispam-messagedata-0:

=?iso-8859-1?Q?AimzrvRHcBKsrZF4/VNt6/EJZEVz9Mp/s8lPl73ggeuOl9mMYRotL7Xaxx?=

=?iso-8859-1?Q?M6YrMOdQhwDnJ4kbS2qtvVuu4ViR2AVt4d/JCCwG96oPRkoUEg66Qj+aQB?=

=?iso-8859-1?Q?wTKvRbbyYOJa5L+CDydncwy1/Y62Yy0KVztBFmJiuWsrCIGUPZHEXcKWQ9?=

=?iso-8859-1?Q?G9eZ+cCLxxXuhIbcYN9KUNB5dpPoF2XwmE7mvUf4G1gSwDbaY/4lWGOYXN?=

=?iso-8859-1?Q?A4zcY/rtZN+++VrziIvixY3EjIlSdssGLI/EAhVMb/Ol/9nkD7oBa7Ep5/?=

=?iso-8859-1?Q?QVbWjgU2dhAYzUfEOKG/ZNb/IpmfPXy8K3Spj9fdAr6lGmOwEcL5ckovaV?=

=?iso-8859-1?Q?+LwcjdPSGm+8VcgyvAqxqCnFRuludXbP9QxOaPhsywYGw9zeFIFFEiYcAc?=

=?iso-8859-1?Q?mukP3Zzlv+COUqwWj/8HfR3+m0rCScQ+IaZicUxs83QlGKtX9JA39r691E?=

=?iso-8859-1?Q?VLrVtmRgFZWLXwkh4Bb7ayVcM24u/6BiJsEChgrNr4jaqDo/I8EuU3i72R?=

=?iso-8859-1?Q?1rK2QirL7CurQamhA9jOlumc3xBFzz9ryCAJv+zEGXsTNsCzvzgsKfK6v5?=

=?iso-8859-1?Q?Q1riiueTLJygV6eNiG9Vb68TYvLcGhZcuQuTcHZQonGVmVkl0RWmLA9lCh?=

=?iso-8859-1?Q?+jco1ZrUJXrEIlq+J2vlV26mjCiTaY01cKw388GFf65Y5uQzIXskYan2qL?=

=?iso-8859-1?Q?Ja82ge2G8AYKHd3nMOgi6VyXttgXcbwH3DiyHKHMDQizoKMK5floqL4mTp?=

=?iso-8859-1?Q?4Zkbtj+Wa3Txv7EZsHFw+sekYvAMqSrAbS7Lbj5ggL+vBXFcV7V4JXZ0ec?=

=?iso-8859-1?Q?jtx4LdWt5SNy+67QVigw4jVZu2l4IA1laUSpEc5z8itvVQb+rYMdLaiVmC?=

=?iso-8859-1?Q?BEmCOXYZS1RxqAlfT2wCowYO99zHrRCL68rb0KX9aWNg4AGPWTbtBqtwHN?=

=?iso-8859-1?Q?fn0BhR6RDVGrIOqVGPjyM/dXOr2k7J4Qu9jekBbpNWlQ+30Y9WJKKeekrJ?=

=?iso-8859-1?Q?1el4Qw00XuDFUk/OTKuOsWgAEOVYgrQn0gYdWbw04eoQV0E5xle54Zhsmw?=

=?iso-8859-1?Q?cm6dG5tIQwFs7S6uypJOzb959xKkTG5LVQ4Bys4oVk7aQo/vv9dqfLEkC+?=

=?iso-8859-1?Q?4JsO4iM85+bAHFfp2n07esBTHriZgkkwdSifHQusRYmBVWnJ5UhZXkpWSx?=

=?iso-8859-1?Q?B6o4DKXhtmik5yhGEFUgNvxRoEBZx0CXUo/Y8oLhLmGNBOznAGl31QYnjV?=

=?iso-8859-1?Q?25/wSD0Aovo9ToI7nL+8A25JJNaoQwLbdlxY1uXhtCBa/1waTWdxYj1EAX?=

=?iso-8859-1?Q?hfsShYxsTcq+uRJ03KcHelhIlbUQIfw5KVMpsJtFeFklasDAXVbnhIdTte?=

=?iso-8859-1?Q?rRFkPU8UEwycK1UL0gFobc79pjnzfq0vy9PewzwBhKrJhBYP4p01bVgihX?=

=?iso-8859-1?Q?1w9IFZRDkVFaWOIQ?=

Content-Type: multipart/alternative;

boundary="_000_DU4PR07MB11594A48C79112058B002DD9DD29FADU4PR07MB11594eu_"

MIME-Version: 1.0

X-OriginatorOrg: outlook.com

X-MS-Exchange-CrossTenant-AuthAs: Internal

X-MS-Exchange-CrossTenant-AuthSource: DU4PR07MB11594.eurprd07.prod.outlook.com

X-MS-Exchange-CrossTenant-RMS-PersistedConsumerOrg: 00000000-0000-0000-0000-000000000000

X-MS-Exchange-CrossTenant-Network-Message-Id: a20c6a27-abb8-40eb-0053-08de60336383

X-MS-Exchange-CrossTenant-originalarrivaltime: 30 Jan 2026 19:11:36.1486

(UTC)

X-MS-Exchange-CrossTenant-fromentityheader: Hosted

X-MS-Exchange-CrossTenant-id: 84df9e7f-e9f6-40af-b435-aaaaaaaaaaaa

X-MS-Exchange-CrossTenant-rms-persistedconsumerorg: 00000000-0000-0000-0000-000000000000

X-MS-Exchange-Transport-CrossTenantHeadersStamped: GVXPR07MB9822

X-Spam_score: 10.9

X-Spam_score_int: 109

X-Spam_bar: ++++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Greetings, Al Ghurair Investment is offering single digit

interest loan for private and corporate bodies, to finance their projects

across the globe. With our flexible security and an option of early repayment

and/or conversion into equity, our project financing is the best you can

get. Our track records are there to speak volume.

McAfee Phish from Google Gmail Part 4

Posted by Dave Yadallee on













/InformAction">
emtype=3D"http://schema.org/EmailMessage">
ntent=3D"Carmen Meyer: Good morning, Transaction is cleared for next steps"=

/>
Event">
eduled"/>
rg/Organization">
n>
EFwme1"/>
ight: 1px; height: 0; max-height: 0; width: 0; max-width: 0; opacity: 0; ov=

erflow: hidden;" itemprop=3D"name">Good morning, Transaction is cleared for=

next steps
pacing=3D"0" role=3D"presentation" align=3D"center" style=3D"width:100%;" c=

lass=3D"body-container">

>
 

0" cellspacing=3D"0" role=3D"presentation" align=3D"center" style=3D"width:=

100%;" class=3D"">=


itemscope itemtype=3D"http://schema.org/EmailMessage">


iption">Good morning, Transaction is cleared for next steps

" role=3D"presentation" align=3D"center" style=3D"width:100%;" class=3D""><=

tbody>=


tion: rtl; font-size: 0; padding: 24px 32px; text-align: left; vertical-ali=

gn: top;" class=3D"main-container-inner">

tr; display: inline-block; vertical-align: top; width: 100%;overflow: hidde=

n; word-wrap: break-word;">
g=3D"0" role=3D"presentation" width=3D"100%" class=3D"main-column-table-ltr=

" style=3D"padding-right: 32px; padding-left: 0;;table-layout: fixed;">
dy>=


">
ion" width=3D"100%" style=3D"table-layout: fixed;">
tr>

ze: 0; padding: 0; text-align: left; word-break: break-word;;padding-bottom=

:2px;">

;font-weight: 400; font-size: 22px; line-height: 28px;color: #3c4043; text-=

decoration: none;" class=3D"primary-text" role=3D"presentation">
rop=3D"name">Good morning, Transaction is cleared for next steps
v>

rd-break: break-word;;padding-bottom:24px;">

to, sans-serif;font-style: normal; font-weight: 400; font-size: 14px; line-=

height: 20px; letter-spacing: 0.2px;color: #3c4043; text-decoration: none;"=

class=3D"primary-text" role=3D"presentation">
ime itemprop=3D"startDate" datetime=3D"20260131T064629Z">Saturday =

Jan 31, 2026 =E2=8B=85 12:46am (Central Time - Chicago)

break-word;;padding-bottom:24px;">

serif;font-style: normal; font-weight: 400; font-size: 14px; line-height: 2=

0px; letter-spacing: 0.2px;color: #3c4043; text-decoration: none;" class=3D=

"primary-text" role=3D"presentation">

McAfee
Transaction Date: S=

aturday, 31 January 2026
Transaction No: URJR-1621-SRFJ
Customer Supp=

ort Request - { 1-582- 238-0725 }

Your plan has been renewed.

G=

ood morning,

We=E2=80=99re informing you that your McAfee subscriptio=

n will renew automatically as scheduled. A payment of $552.77 via Auto Debi=

t is planned for your 1 Year term.

Billing Activity Confirmation:
=

=E2=80=A2 Plan: Full Membership
=E2=80=A2 Quantity: 2x
=E2=80=A2 Term=

Duration: 1 Year
=E2=80=A2 Billing Mode: Auto Debit
=E2=80=A2 Amount=

Due: $552.77

If you=E2=80=99d like to review or stop the renewal, pl=

ease contact +1 (859) 204-6320.

All the best,
McAfee, Inc.


pan>
day, 31 January 2026Transaction No: URJR-1621-SRFJCustomer Support Request =

- { 1-582- 238-0725 }Your plan has been renewed.Good morning,We&rsquo;r=

e informing you that your McAfee subscription will renew automatically as s=

cheduled. A payment of $552.77 via Auto Debit is planned for your 1 Year te=

rm.Billing Activity Confirmation:&bull; Plan: Full Membership&bull;=

Quantity: 2x&bull; Term Duration: 1 Year&bull; Billing Mode: Auto =

Debit&bull; Amount Due: $552.77If you&rsquo;d like to review or sto=

p the renewal, please contact +1 (859) 204-6320.All the best,McAfee, Inc."=

/>

ft; word-break: break-word;;padding-bottom:24px;">

: Roboto, sans-serif;font-style: normal; font-weight: 400; font-size: 14px;=

line-height: 20px; letter-spacing: 0.2px;color: #3c4043; text-decoration: =

none;" class=3D"primary-text" role=3D"presentation">
lpadding=3D"0" cellspacing=3D"0" role=3D"presentation" style=3D"padding-bot=

tom: 4px;">


r: #3c4043; text-decoration: none;font-weight: 700;-webkit-font-smoothing: =

antialiased;margin: 0; padding: 0;">Guests

(Guest lis=

t has been hidden at organizer's request)


--0000000000003a1e1b06499e8e06--

McAfee Phish from Google Gmail Part 3

Posted by Dave Yadallee on
@font-face {

font-family: 'Google Sans';

font-style: normal;

font-weight: 700;

src: url(//fonts.gstatic.com/s/googlesans/v14/4UabrENHsxJlGDuGo1OIlLV154t=

zCwM.ttf) format('truetype');

}





=20



=20



=20



=20



McAfee Phish from Google Gmail Part 2

Posted by Dave Yadallee on

















link=3D"#0563C1" vlink=3D"#954F72">


class=3DMsoNormal>Hi Good morning!!


class=3DMsoNormal> 

I sent you =

an email on Friday but didn=E2=80=99t hear back.


class=3DMsoNormal> 


style=3D'background:aqua;mso-highlight:aqua'>Happy to schedule a quick =

call.

 


class=3DMsoNormal>Thank you!


class=3DMsoNormal>Kundan,

VA =

Team!!

 


class=3DMsoNormal> 

On Fri, Jan =

9, 2026 at 9:37=E2=80=AFAM < > wrote:


class=3DMsoNormal> 


class=3DMsoNormal>Hi,


class=3DMsoNormal> 

Happy New =

Year!

 


class=3DMsoNormal>Are you looking to hire an affordable Remote =

Virtual Assistant?


class=3DMsoNormal> 


class=3DMsoNormal>Bookkeeping, social media, calls, Leads, CRM tools, =

data entry, emails, design, websites, apps, SEO, digital marketing, and =

video editing, RPO, LPO, more.


class=3DMsoNormal> 

Happy to =

schedule a quick call or share our pricing and =

packages=E2=80=94whichever works best for you.


class=3DMsoNormal> 

Thank =

you,

Kundan


class=3DMsoNormal>VA Team!!


class=3DMsoNormal> 



------=_NextPart_000_005B_01DC918D.D9C2A2A0--

Social Media Followup spam from Yahoo! mail Part 1

Posted by Dave Yadallee on
X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Thu, 29 Jan 2026 15:26:00 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vlaSL-00000000OrM-0GHW

for dave@doctor.nl2k.ab.ca;

Thu, 29 Jan 2026 15:25:41 -0700

Resent-From: The Doctor

Resent-Date: Thu, 29 Jan 2026 15:25:40 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from sonic306-20.consmr.mail.sg3.yahoo.com ([106.10.241.140]:45964)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vlYrD-00000000FFW-46uR

for root@nk.ca;

Thu, 29 Jan 2026 13:43:26 -0700

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yahoo.com; s=s2048; t=1769719338; bh=k8yhLI974+cZJx9XprdKsSoqxVkzVoadvsv2qVqkh1o=; h=From:To:Subject:Date:References:From:Subject:Reply-To; b=Hj3Ki7i6ayx28t/oX4Vg/iNJ5/1/vjeLsZjEE/TBoAIRFqTNCpCCJGubi8fI8UXoXO0MlEaO2IEbprOZk29O9TFjvE6fZCX6cgQfgTPekMm9G84SEMKc/J0qUgLbCr9AeNqs5gZR33C+Uctog8KnZOrowiSYtzDvu3dIoUbRZH2MHre2FzmlyZgzqInDXGDLccFsyqV9Am/9uNg9Bh8j3RunUB45p2TViX3b3rNxWMk4T25nea+uXYcRv5HWCm4Qc6D2YTUf9uL05cscDMRZnyDRqSBS40awj7mukQ5dYSOI3As1Lr6xm6SuJL9TdKmuRyN6h4Lt15MBRREa7eYPdA==

X-SONIC-DKIM-SIGN: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yahoo.com; s=s2048; t=1769719338; bh=p1ho1zEU502NI4nPMhZTmOgHTObfucBA0DmBjitqrw3=; h=X-Sonic-MF:From:To:Subject:Date:From:Subject; b=nCEqolB59IY36OrQhHfPxYVph5sBl+aZqymuE9PWf0zPUvDc7QkXvjwBsGQDsKHgvMwKWtLiGkATtCECR/5HJYWfWPbW2zQKkLdY8c6fD1r5yrtcsxv/uQvlFfi9mYc9bebS8/oszwhYCTsc8Nam5nnoF7c27dOglr7eHmBrbNY3YcbKzLgN9KlK1JpBorQgIAQ7x88vyxOpnigbjavPUO6gXvePJZ1jHXynGpuTXRjzfX9de4j+sUUrC1Wy+GVA4VSW2gXqfBGmMnVqNeBu64gHL/jMomR3BwEenFTKOhfi/guc96OhO5NhSo1rEowTGPO4YemmKFsnxJDvN/xpEA==

X-YMail-OSG: GGZT3HoVM1nn2eVOzskPbbE1W6FkWzoZJErUGrxsz4RJuKaDeRRN5E3x3MXBr6V

Yo4KcHGd5go2YLobKsJo2bNlFrn0rzPEqrVGFhZLQ0ssyKils0hDSIqCaR3cGvdUWTwEF0xTgeAZ

d.DSgPnOdAJAp.vBrH4CxcHR7dSVW7O_ASAZhuFsXG3NGnViRw6X4.KuNzMAtbBLU73bSDzPu11Q

r94zHWLWhIgB2Zqrgyo1kFfuTpSLemiSa.HVlfUM9h7cBN_Acch1xaf_HLmoMTsRmtI_6XI.TRUG

gqDQwzQY_xwc37v_6nftkYoCl0DCSXD5MMMaAROWlNXM8I.9isFblov1oujxs3UpezYKlMzUCgwy

rJCEatgXiiCt79Msb3Bu5_gxaE2dieM8GxH1OSJ9hP.zRQfWmHlXLH0RtD2kt7ghHSMTJFOlrBpY

AJC6Q7mBu7cltf9RPshxvI4OGd5lHTPI_wKQ2UqrorilMFt4MyuUXIID6JHLYtc5mW0I1RW31N_v

tvBaMOAj0.YUg4MvfH1crBXj_ua58J5_r7nOfHndiIf1YYIfq7Pasypvu2nlA_MFEjvQVJyD36zt

2qryAaBly6SHbg2nGG7FKXyz.qZQLE1o2pd.2LW9OErjWxN5szF20ipagXzKJYgbd5.xAmQCVzFu

ViRNf17e6PU3eQ5q4e.E80hxPbOo527EbVwyufnEH9Ph.xD5qsqf1rNGTKOBD4nAOACQyqIUM4E7

13Jm_h7xYJK33CrdUkMnVjTeJBllQeWBnySerxoDgNolGCevdZp_zH5edkE6W3wQGFsN2IIUYeCC

Dt4L67FbVtlXUz76TNu9lNFD5HGnCPIvpHwoJvKkVuC.1IKps7zMV8QmqeBzPPvX52X7hD6Uym7b

kNh9FYgQaFdruJOY.xJpKTzcVG2R0mHmJxz9svqLEVdesfLjjs_rWqY_MEp_1Tcu7jFRqS1sSSJ7

aYOiPfC_wEBS.B2C.69Y6AOr3CxZX48HhQG0rg_qMFdw8a0bRVeGyBepIeSiydeDT09mw0qZjEen

5Xrqc66ThBYS_W.l0Ck6Ztpien6ErZhmJBDPC9ZKvfPlXPci84GIeJKunxSTWr1PPHWyR4.2HImO

uXKhhDj5wNLDgVt06.WUY707HttrP65aIxDF.6WHubWxJurdQnKCqmqz.KxyE.uwF20b.z2NgOEP

F7J.Il70orvpIlVeIiLHihmDMs2Njls7.QZDigRojemZfDsaaH7ZSRVdBLnBK7l6YLuw8JSxj.ZV

BqyYCJ4d3g19ddjED7WCQZ.EKKTtrT5j4aeI4idYK09YpBXvN5.wZ.WUzbf8JLfTQI50uI6jWNqx

HkZ3NRcGQJrFqm37T_DlTRrh8lvkjbtbChi1cbdCDqe2mlTxvXw2O1u8fqf3HqjPT1iVBJnW6ciz

Jj4k3L8Zze87D5uetNnJ4VbCcVbSj7MjW5uVCUWUTs39volpCaMT2U039mG4xVl7FSx4JyHAtl15

N3xP8aZI9SBUJHM9sWsLcOMkMJeBA6ZRHEiPZ.Edm2pNJU1ZdkBg6qc7_92_P8YdVWbnVbdeUGvT

bEVvmjcD7jjFjWmFwmvquXNWCq_DTgMXMHEkJXOcWMWyHmzHEnu3ZEVd2.0UeLsd554rRcbfhMoR

Nn0jZYV7EGoLUJCp8MJSGkMNOk2oRog9SEfHz2_2vuFR5R9RmqIpKAe.CiA.0gRET1QrlWt579Nj

w961ynlDQfBtomcCUUzrz_taCZxWC0EIfDs.UgqunUpGsQF.xlduvaig3PFIgVQwWyKuIv3cBi8s

eGqw2FqusMbxtY7OaTMSZYRsOTtH1gAIsY5Tyv8V1icJ0SqrR8V6j6rJQPpAD.61q_5UTeG62g_k

FIsjDV8fOXoV.ZLrxXVLXbc32V9OjQmaVyWcAqUUyKWquFIflAFUchTKnrbhiM9KQKmSwR1daR25

Nj3t0AiSbhzPYnduCITYHEQ47Nwq8Dm1bi28RJd74Axc7xDfECWZ4v3h6AurMgiQEhDP7Ah4nRaX

BOXlWHDt.4y54M79P0djmjL.EWpYh98klcubqYRr9eA9HIJWUj7g3liensuoGElWuqdk6RiIvgow

fyTT4TsXM7745TTphkLKVgN6RpjA69ZA0sOdKBp9lb2WuzIwAPF.2Hwq82jMKiEIMpLZ3bNecv4s

FiANTEJJrFXnp4ZlVZchuE0pxdW2BinBzrj03iv92fctsMFMMW.hfj9CRHV7rjnxQIbZQpNG.iou

LsNrgjMtizVtt1Bai.S4G7Q3rrPoB6EE-

X-Sonic-MF:

X-Sonic-ID: 9721138d-fef7-4184-be45-dd9b7474587b

Received: from sonic.gate.mail.ne1.yahoo.com by sonic306.consmr.mail.sg3.yahoo.com with HTTP; Thu, 29 Jan 2026 20:42:18 +0000

Received: by hermes--production-sg3-d7b46f8d-mtbdw (Yahoo Inc. Hermes SMTP Server) with ESMTPA ID 47c3585353895ee0c0cc8b6765972a9c;

Thu, 29 Jan 2026 20:42:13 +0000 (UTC)

From: "Kundan"

To: "Kundan"

Subject: Re: Social media / quick call ??

Date: Fri, 30 Jan 2026 02:11:59 +0530

Message-ID: <005a01dc915f$c00a66a0$401f33e0$@yahoo.com>

MIME-Version: 1.0

Content-Type: multipart/alternative;

boundary="----=_NextPart_000_005B_01DC918D.D9C2A2A0"

X-Mailer: Microsoft Outlook 16.0

Thread-Index: AdyRXlUB28JB3hfQSvif6G5cdnyeeg==

Content-Language: en-us

References: <005a01dc915f$c00a66a0$401f33e0$.ref@yahoo.com>

X-Spam_score: 5.5

X-Spam_score_int: 55

X-Spam_bar: +++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.



Content preview: Hi Good morning!! I sent you an email on Friday but didn’t

hear back. Happy to schedule a quick call.



Content analysis details: (5.5 points, 5.0 required)



pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[106.10.241.140 listed in will-spam-for-food.eu.org]

[106.10.241.140 listed in will-spam-for-food.eu.org]

[106.10.241.140 listed in will-spam-for-food.eu.org]

[106.10.241.140 listed in will-spam-for-food.eu.org]

[106.10.241.140 listed in will-spam-for-food.eu.org]

[106.10.241.140 listed in will-spam-for-food.eu.org]

[106.10.241.140 listed in will-spam-for-food.eu.org]

[106.10.241.140 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[106.10.241.140 listed in dnsbl.ahbl.org]

[106.10.241.140 listed in dnsbl.ahbl.org]

[106.10.241.140 listed in dnsbl.ahbl.org]

[106.10.241.140 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[106.10.241.140 listed in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[106.10.241.140 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[106.10.241.140 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[106.10.241.140 listed in dnsbl.ahbl.org]

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[106.10.241.140 listed in list.dnswl.org]

-0.0 SPF_PASS SPF: sender matches SPF record

0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in

headers

0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider

[kundanp917(at)yahoo.com]

-0.0 T_RP_MATCHES_RCVD Envelope sender domain matches handover relay

domain

0.2 FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends in

digit

[kundanp917(at)yahoo.com]

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

Subject: {SPAM?} Re: Social media / quick call ??



This is a multipart message in MIME format.



------=_NextPart_000_005B_01DC918D.D9C2A2A0

Content-Type: text/plain;

charset="utf-8"

Content-Transfer-Encoding: quoted-printable



Hi Good morning!!



=20



I sent you an email on Friday but didn=E2=80=99t hear back.



=20



Happy to schedule a quick call.



=20



Thank you!



Kundan,



VA Team!!



=20



=20



On Fri, Jan 9, 2026 at 9:37=E2=80=AFAM < > wrote:



=20



Hi,



=20



Happy New Year!



=20



Are you looking to hire an affordable Remote Virtual Assistant?



=20



Bookkeeping, social media, calls, Leads, CRM tools, data entry, emails, =

design, websites, apps, SEO, digital marketing, and video editing, RPO, =

LPO, more.



=20



Happy to schedule a quick call or share our pricing and =

packages=E2=80=94whichever works best for you.



=20



Thank you,



Kundan



VA Team!!



=20