Web/SEO/App spam from Google Gmail Part 2

Posted by Dave Yadallee on Tuesday, March 3. 2026

-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no

trust

[209.85.214.195 listed in list.dnswl.org]

1.5 RCVD_IN_SBL_XBL RBL: Received via a relay in Spamhaus SBL+XBL

[2401:4900:8841:3a8b:65eb:256e:1c98:b2bb listed]

[in sbl-xbl.spamhaus.org]

1.5 RCVD_IN_CBL RBL: Received via a relay in cbl.abuseat.org

[Listed by XBL, see ]

-0.0 RCVD_IN_MSPIKE_H3 RBL: Good reputation (+3)

[209.85.214.195 listed in wl.mailspike.net]

1.0 SPF_SOFTFAIL SPF: sender does not match SPF record (softfail)

-0.0 RCVD_IN_MSPIKE_WL Mailspike good senders

0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge

0.0 HTML_MESSAGE BODY: HTML included in message

0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid

Subject: {SPAM?} S-E-O Proposal !!

This is a multi-part message in MIME format.

------=_NextPart_000_0114_01DCAB5B.5AB61BD0

Content-Type: text/plain;

charset="us-ascii"

Content-Transfer-Encoding: 7bit

Hi there,

I was checking your website . See you have a good design, and it looks

great, but it's not ranking on Google and other major search engines.

Do you want more targeted visitors on your website?

We can place your website on Google 1st page. Yahoo, Facebook, LinkedIn,

YouTube, Instagram, Pinterest etc.)

May I send you a Price, SEO Packages? If interested.

Kind Regards,

lovely

------=_NextPart_000_0114_01DCAB5B.5AB61BD0

Content-Type: text/html;

charset="us-ascii"

Content-Transfer-Encoding: quoted-printable

xmlns:o=3D"urn:schemas-microsoft-com:office:office" =

xmlns:w=3D"urn:schemas-microsoft-com:office:word" =

xmlns:m=3D"http://schemas.microsoft.com/office/2004/12/omml" =

xmlns=3D"http://www.w3.org/TR/REC-html40">
HTTP-EQUIV=3D"Content-Type" CONTENT=3D"text/html; =

charset=3Dus-ascii">
(filtered medium)">

class=3DWordSection1>

Hi there,

class=3DMsoNormal>
style=3D'font-size:12.0pt;color:black'>

class=3DMsoNormal>I was =

checking your website . See you have a good design, and it looks great, =

but it's not ranking on Google and other major search =

engines.

style=3D'font-size:12.0pt;color:black'>

class=3DMsoNormal>Do you =

want more targeted visitors on your website?

class=3DMsoNormal>
style=3D'font-size:12.0pt;color:black'>

class=3DMsoNormal>We can =

place your website on Google 1st page. Yahoo, Facebook, LinkedIn, =

YouTube, Instagram, Pinterest etc.)

class=3DMsoNormal>
style=3D'font-size:12.0pt;color:black'>

class=3DMsoNormal>May I =

send you a Price, SEO Packages? If interested.

class=3DMsoNormal>
style=3D'font-size:12.0pt;color:black'>

class=3DMsoNormal>
style=3D'font-size:12.0pt;color:black'> Kind =

Regards,

style=3D'font-size:12.0pt;color:black'>
style=3D'font-size:12.0pt;color:black'>

class=3DMsoNoSpacing>lovely

------=_NextPart_000_0114_01DCAB5B.5AB61BD0--

Web/SEO/App spam from Google Gmail Part 1

Posted by Dave Yadallee on Tuesday, March 3. 2026

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Tue, 03 Mar 2026 11:57:00 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vxUut-000000004L6-2Ws5

for dave@doctor.nl2k.ab.ca;

Tue, 03 Mar 2026 11:56:23 -0700

Resent-From: The Doctor

Resent-Date: Tue, 3 Mar 2026 11:56:23 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-pl1-f195.google.com ([209.85.214.195]:52717)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256

(Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vxStt-00000000PRC-18Gq

for sales@nk.ca;

Tue, 03 Mar 2026 09:47:23 -0700

Received: by mail-pl1-f195.google.com with SMTP id d9443c01a7336-2adff872068so29727335ad.1

for ; Tue, 03 Mar 2026 08:46:26 -0800 (PST)

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=theappsdeveloper-com.20230601.gappssmtp.com; s=20230601; t=1772556379; x=1773161179; darn=nk.ca;

h=content-language:thread-index:mime-version:message-id:date:subject

:to:from:from:to:cc:subject:date:message-id:reply-to;

bh=uc9Wb2J09QnFz53l1MkwW9h3Big4S1oe5EFD9mQSHks=;

b=V55dn4xFItIrbN6h/sCr0pEBtPQzRzEA3xNJifop+WuHTN6NcE8cGX4R+Gc1qFv719

QTQKaZxdXOx6oKhuPWwhAKC5vntfPtJSBUGvpzbAZIMGPpdIOJnIixmARpofOYRXVOX4

aPz/GDOXUTAVG3d4JaCnAawp33/VdNTyoACTXRMhatwjH7tlAAywrCCN4Ex2Z8GoRD7V

AZuh0qzyJj2PBDE2EfPr4b/c69kPAJyX0enNDDjPJZzCcXSg/YrJLtKe85iuFTFJYtFy

NW8kN2GlcA2cl30J3IDoYUCr0P6y15GnZbGUwjk1a8w2GjPr91mUqaNMB9c7FfbH4gVx

P6Ng==

X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;

d=1e100.net; s=20230601; t=1772556379; x=1773161179;

h=content-language:thread-index:mime-version:message-id:date:subject

:to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date

:message-id:reply-to;

bh=uc9Wb2J09QnFz53l1MkwW9h3Big4S1oe5EFD9mQSHks=;

b=RxduZGWO1GslUoiScrvT9sBzMUjP86bAMbguyFQg8mSXH2eGij1T9/S9P4CqnsVKaz

PwM3+1QlkRkbjh74T4wsVUstU5DNatAcyCeOid4dDrr4VR+e3xajYJycSH3legzvWIvu

oZnsWDTViIcw9iCQFzU0ytHwt4RJOvfPFSkFe8HH16hvu3RAnp06arI18r2/Mpo/qZQA

rf5Yq7eB8EbwWF77LJgTsvWMCUGISdWNIXRqtAzmR1wwd34KQ2wx3c7AC12imdCnEs0O

csJgNFuaLrPZ5rt49O5W5Pol8zHYNXGQO3UD/wK5mfEMOuNC+hu8RE9xx4jD9MVKYajy

unYg==

X-Gm-Message-State: AOJu0YxDELvM231nJ8vWIiGTNx9pktXL8T5sPnvRPsBDoa21hSqCjBBX

L/v7sF0NeiValtr/nD48Z9tM7w3zVYbYpq736CSI1aukUs6ar8umQRk01z4zx8sFE8l58lpnSPJ

9oXSmpHs=

X-Gm-Gg: ATEYQzxFpBN5prE0o+U38BllxIBN5qhBpQdMy1WoDTFPgkpxACTe8iraLzhI8d/2aup

tMd5gUEGV9GNYfKbytst4OulVQaRRYTmG+sk8fTBEAu7VvX3V1CC56JdmEDWZRnnS8Tm2HQFhjP

0Sy7mrijxKEJp+uwwAw1PfwCcf/n/FR3EvHB9ntZYIJPqQe/T81fy/G5HHhqyTm9fCQXqoh5dR1

GkOHXk2PvDFG++ArVwwzDs6AFFB/a5w+S4Ui1E7BYEUXJ8+SJz/EdrBVDDkUL8sT3qKScq3BBQj

ZTzr1HkuD7dyGq6sp6z3Hvm1e5ud3dfx3OoOTZQj8qUQPzCREc/ZlQwkaQyMuR7l9b7rhmFKzUz

6xaQm8AeMxgKHAF8UVtpe2SK7ERf1c0QYcRB25JlvaZ3iz7Z+Fbk8ARvt29gWT6GJaBL8x/g6wy

EOfbm3rBqpK/KROTGT3qnC19Oh4mwle4whkucJXZ/Mirc6be9g

X-Received: by 2002:a17:902:c94b:b0:2ae:5442:45cf with SMTP id d9443c01a7336-2ae54424962mr74422605ad.33.1772556379363;

Tue, 03 Mar 2026 08:46:19 -0800 (PST)

Received: from dell ([2401:4900:8841:3a8b:65eb:256e:1c98:b2bb])

by smtp.gmail.com with ESMTPSA id d9443c01a7336-2ae4b782c53sm75485035ad.41.2026.03.03.08.46.17

for

(version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128);

Tue, 03 Mar 2026 08:46:18 -0800 (PST)

From: "lovely"

To:

Subject: S-E-O Proposal !!

Date: Tue, 3 Mar 2026 22:15:44 +0530

Message-ID: <011301dcab2d$40fddfd0$c2f99f70$@com>

MIME-Version: 1.0

Content-Type: multipart/alternative;

boundary="----=_NextPart_000_0114_01DCAB5B.5AB61BD0"

X-Mailer: Microsoft Office Outlook 12.0

Thread-Index: AdyqcwNbVIavfGATQo2C4/x7bMo/Tg==

Content-Language: en-in

X-Spam_score: 9.0

X-Spam_score_int: 90

X-Spam_bar: +++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.

Content preview: Hi there, I was checking your website . See you have a good

design, and it looks great, but it's not ranking on Google and other major

search engines. Do you want more targeted visitors on your website?

Content analysis details: (9.0 points, 5.0 required)

pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[2401:4900:8841:3a8b:65eb:256e:1c98:b2bb listed]

[in will-spam-for-food.eu.org]

[2401:4900:8841:3a8b:65eb:256e:1c98:b2bb listed]

[in will-spam-for-food.eu.org]

[2401:4900:8841:3a8b:65eb:256e:1c98:b2bb listed]

[in will-spam-for-food.eu.org]

[2401:4900:8841:3a8b:65eb:256e:1c98:b2bb listed]

[in will-spam-for-food.eu.org]

[2401:4900:8841:3a8b:65eb:256e:1c98:b2bb listed]

[in will-spam-for-food.eu.org]

[2401:4900:8841:3a8b:65eb:256e:1c98:b2bb listed]

[in will-spam-for-food.eu.org]

[2401:4900:8841:3a8b:65eb:256e:1c98:b2bb listed]

[in will-spam-for-food.eu.org]

[2401:4900:8841:3a8b:65eb:256e:1c98:b2bb listed]

[in will-spam-for-food.eu.org]

[209.85.214.195 listed in will-spam-for-food.eu.org]

[209.85.214.195 listed in will-spam-for-food.eu.org]

[209.85.214.195 listed in will-spam-for-food.eu.org]

[209.85.214.195 listed in will-spam-for-food.eu.org]

[209.85.214.195 listed in will-spam-for-food.eu.org]

[209.85.214.195 listed in will-spam-for-food.eu.org]

[209.85.214.195 listed in will-spam-for-food.eu.org]

[209.85.214.195 listed in will-spam-for-food.eu.org]

1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org

[209.85.214.195 listed in dnsbl.ahbl.org]

[209.85.214.195 listed in dnsbl.ahbl.org]

[209.85.214.195 listed in dnsbl.ahbl.org]

[209.85.214.195 listed in dnsbl.ahbl.org]

[2401:4900:8841:3a8b:65eb:256e:1c98:b2bb listed]

[in dnsbl.ahbl.org]

[2401:4900:8841:3a8b:65eb:256e:1c98:b2bb listed]

[in dnsbl.ahbl.org]

[2401:4900:8841:3a8b:65eb:256e:1c98:b2bb listed]

[in dnsbl.ahbl.org]

[2401:4900:8841:3a8b:65eb:256e:1c98:b2bb listed]

[in dnsbl.ahbl.org]

0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org

[209.85.214.195 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org

[209.85.214.195 listed in dnsbl.ahbl.org]

0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org

[209.85.214.195 listed in dnsbl.ahbl.org]

1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org

[209.85.214.195 listed in dnsbl.ahbl.org]

Norton Phish from Google Gmail Part 3

Posted by Dave Yadallee on Tuesday, March 3. 2026

@font-face {

font-family: 'Google Sans';

font-style: normal;

font-weight: 700;

src: url(//fonts.gstatic.com/s/googlesans/v14/4UabrENHsxJlGDuGo1OIlLV154t=

zCwM.ttf) format('truetype');

}

=20

=20

=20

=20

Norton Phish from Google Gmail Part 4

Posted by Dave Yadallee on Tuesday, March 3. 2026

>
/InformAction">
/schema.org/Event">
org/EventScheduled"/>
p://schema.org/Organization">
ndar"/>
ll4ahk8eh1op5vtgng"/>
fff; line-height: 1px; height: 0; max-height: 0; width: 0; max-width: 0; op=

acity: 0; overflow: hidden;" itemprop=3D"name">9982-321-AYB payment confirm=

ed for Order
datetime=3D"20260304T050000Z">
"20260305T043000Z">
spacing=3D"0" role=3D"presentation" align=3D"center" style=3D"width:100%;" =

class=3D"body-container">
tr>

">

"0" cellspacing=3D"0" role=3D"presentation" align=3D"center" style=3D"width=

:100%;" class=3D"">

n itemscope itemtype=3D"http://schema.org/EmailMessage">

ription">Membership Date- 2026-03-04
Membership No- 1011-998-MND
Supp=

ort No- +1 (803) 234-0500

Hello Customer,

We appreciate your continued=

trust in N0RT0N LIFELOCK 360. Your subscription has been successfully rene=

wed in accordance with your prior electronic authorization.

A payment of =

USD318.33 has been processed for the applicable services.

Product Pricing=

Center
Purchase Item: Prime Protection Plan
Coverage Term: 4 Years
r>Total Amount Charged: $ 355.66

Thank you for your ongoing business.

I=

f you have any questions or would like further assistance, please contact 1=

{803} 234-0500. We value your feedback.

Thanks again,
Finance Head of=

N0RT0N LIFELOCK 360, LLC.
Jody B
.
.
.
.
.
.
.
=

.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
=

.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
=

.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
=

.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
=

.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
=

.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
=

.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
=

.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
=

.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
=

.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
=

.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
=

.
.
.
.
.
.
.
.
.
.
.
.
.
.

n>

ng=3D"0" role=3D"presentation" align=3D"center" style=3D"width:100%;" class=

=3D"">
tr>

; direction: rtl; font-size: 0; padding: 24px 32px; text-align: left; verti=

cal-align: top;" class=3D"main-container-inner">

tion: ltr; display: inline-block; vertical-align: top; width: 100%;overflow=

: hidden; word-wrap: break-word;">
lspacing=3D"0" role=3D"presentation" width=3D"100%" class=3D"main-column-ta=

ble-ltr" style=3D"padding-right: 32px; padding-left: 0;;table-layout: fixed=

;">

gn:top;">
esentation" width=3D"100%" style=3D"table-layout: fixed;">

font-size: 0; padding: 0; text-align: left; word-break: break-word;;padding=

-bottom:2px;">

s-serif;font-weight: 400; font-size: 22px; line-height: 28px;color: #3c4043=

; text-decoration: none;" class=3D"primary-text" role=3D"presentation">
n itemprop=3D"name">9982-321-AYB payment confirmed for Order

td>

reak: break-word;;padding-bottom:24px;">

sans-serif;font-style: normal; font-weight: 400; font-size: 14px; line-heig=

ht: 20px; letter-spacing: 0.2px;color: #3c4043; text-decoration: none;" cla=

ss=3D"primary-text" role=3D"presentation">
itemprop=3D"startDate" datetime=3D"20260304T050000Z">
=3D"endDate" datetime=3D"20260305T043000Z">Tuesday Mar =

3 =E2=8B=85 11pm =E2=80=93 Wednesday Mar 4, 2026 =E2=8B=85 10:30pm (Central=

Time - Chicago)

ng: 0; text-align: left; word-break: break-word;;padding-bottom:24px;">
style=3D"font-family: Roboto, sans-serif;font-style: normal; font-weight: =

400; font-size: 14px; line-height: 20px; letter-spacing: 0.2px;color: #3c40=

43; text-decoration: none;" class=3D"primary-text" role=3D"presentation">
able border=3D"0" cellpadding=3D"0" cellspacing=3D"0" role=3D"presentation"=

style=3D"padding-bottom: 4px;">

"font-size: 14px;color: #3c4043; text-decoration: none;font-weight: 700;-we=

bkit-font-smoothing: antialiased;margin: 0; padding: 0;">Organizer

>

class=3D"primary-text underline-on-hover" style=3D"display: inline-block;;=

color: #3c4043; text-decoration: none;" href=3D"mailto:ferhattuman5@ordweb.=

org">Doretha Zhang
e=3D"http://schema.org/Person">
hang"/>
>

on-hover" style=3D"display: inline-block;;color: #70757a; text-decoration: =

none;" href=3D"mailto:ferhattuman5@ordweb.org">ferhattuman5@ordweb.org<=

/div>

left; word-break: break-word;;padding-bottom:24px;">

ily: Roboto, sans-serif;font-style: normal; font-weight: 400; font-size: 14=

px; line-height: 20px; letter-spacing: 0.2px;color: #3c4043; text-decoratio=

n: none;" class=3D"primary-text" role=3D"presentation">
cellpadding=3D"0" cellspacing=3D"0" role=3D"presentation" style=3D"padding-=

bottom: 4px;">

olor: #3c4043; text-decoration: none;font-weight: 700;-webkit-font-smoothin=

g: antialiased;margin: 0; padding: 0;">Guests

(Guest =

list has been hidden at organizer's request)

--000000000000db2716064c21625d--

Norton Phish from Google Gmail Part 2

Posted by Dave Yadallee on Tuesday, March 3. 2026

--000000000000db2716064c21625d

Content-Type: text/plain; charset="UTF-8"; format=flowed; delsp=yes

Content-Transfer-Encoding: base64

TWVtYmVyc2hpcCBEYXRlLSAyMDI2LTAzLTA0IE1lbWJlcnNoaXAgTm8tIDEwMTEtOTk4LU1ORCBT

dXBwb3J0IE5vLSArMSAgDQooODAzKSAyMzQtMDUwMCBIZWxsbyBDdXN0b21lciwgV2UgYXBwcmVj

aWF0ZSB5b3VyIGNvbnRpbnVlZCB0cnVzdCBpbiBOMFJUME4gIA0KTElGRUxPQ0sgMzYwLiBZb3Vy

IHN1YnNjcmlwdGlvbiBoYXMgYmVlbiBzdWNjZXNzZnVsbHkgcmVuZXdlZCBpbiBhY2NvcmRhbmNl

ICANCndpdGggeW91ciBwcmlvciBlbGVjdHJvbmljIGF1dGhvcml6YXRpb24uIEEgcGF5bWVudCBv

ZiBVU0QzMTguMzMgaGFzIGJlZW4gIA0KcHJvY2Vzc2VkIGZvciB0aGUgYXBwbGljYWJsZSBzZXJ2

aWNlcy4gUHJvZHVjdCBQcmljaW5nIENlbnRlciBQdXJjaGFzZSAgDQpJdGVtOiBQcmltZSBQcm90

ZWN0aW9uIFBsYW4gQ292ZXJhZ2UgVGVybTogNCBZZWFycyBUb3RhbCBBbW91bnQgQ2hhcmdlZDog

JCAgDQozNTUuNjYgVGhhbmsgeW91IGZvciB5b3VyIG9uZ29pbmcgYnVzaW5lc3MuIElmIHlvdSBo

YXZlIGFueSBxdWVzdGlvbnMgb3IgIA0Kd291bGQgbGlrZSBmdXJ0aGVyIGFzc2lzdGFuY2UsIHBs

ZWFzZSBjb250YWN0IDF7ODAzfSAyMzQtMDUwMC4gV2UgdmFsdWUgIA0KeW91ciBmZWVkYmFjay4g

VGhhbmtzIGFnYWluLCBGaW5hbmNlIEhlYWQgb2YgTjBSVDBOIExJRkVMT0NLIDM2MCwgTExDLiBK

b2R5ICANCkIgLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4g

LiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAu

IC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4g

LiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAu

IC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4g

LiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAu

IC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4gLiAuIC4NCg0KOTk4Mi0zMjEtQVlCIHBh

eW1lbnQgY29uZmlybWVkIGZvciBPcmRlcg0KVHVlc2RheSBNYXIgMyDii4UgMTFwbSDigJMgV2Vk

bmVzZGF5IE1hciA0LCAyMDI2IOKLhSAxMDozMHBtDQpDZW50cmFsIFRpbWUgLSBDaGljYWdvDQoN

Cg0KDQpPcmdhbml6ZXINCkRvcmV0aGEgWmhhbmcNCmZlcmhhdHR1bWFuNUBvcmR3ZWIub3JnDQoN

Cg==

--000000000000db2716064c21625d

Content-Type: text/html; charset="UTF-8"

Content-Transfer-Encoding: quoted-printable

schemas-microsoft-com:vml" xmlns:o=3D"urn:schemas-microsoft-com:office:offi=

ce">
t=3D"text/html; charset=3DUTF-8">
=3Ddevice-width,initial-scale=3D1">
ight dark">

dir=3D"ltr" lang=3D"en">

=20

der=3D"0" dir=3D"ltr" lang=3D"en" style=3D"border-left:1px solid #e3e3e3;bo=

rder-right: 1px solid #e3e3e3;">

:1px solid #e3e3e3;">

border-bottom:1px solid #e3e3e3;">

:1px solid #e3e3e3; border-bottom:1px solid #e3e3e3;padding:12px 0;">

Light; font-size:18pt; color:#ffffff; font-weight:normal;">

=20

"#FFFFFF">Verify your email address

;border-bottom: 1px solid #e3e3e3;">

der=3D"0" dir=3D"ltr" lang=3D"en">

n=3D"2" style=3D"border-bottom:1px solid #e3e3e3; padding:10px 0 20px;"> =09

PayPal Phish from Microsoft Outlook Part 1

Posted by Dave Yadallee on Tuesday, March 3. 2026

X-Mozilla-Status: 0001

X-Mozilla-Status2: 00000000

Return-path:

Envelope-to: dave@doctor.nl2k.ab.ca

Delivery-date: Tue, 03 Mar 2026 09:34:00 -0700

Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vxSgK-00000000Oyr-3fTd

for dave@doctor.nl2k.ab.ca;

Tue, 03 Mar 2026 09:33:12 -0700

Resent-From: The Doctor

Resent-Date: Tue, 3 Mar 2026 09:33:12 -0700

Resent-Message-ID:

Resent-To: Dave Yadallee

Received: from mail-westus3azacs10201002.outbound.protection.outlook.com ([40.93.23.2]:16856 helo=PH0PR06CU001.outbound.protection.outlook.com)

by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384

(Exim 4.98.2 (FreeBSD))

(envelope-from )

id 1vxS6g-00000000NJX-3x32

for doctor@doctor.nl2k.ab.ca;

Tue, 03 Mar 2026 08:56:29 -0700

ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none;

b=mMuydaIbi7RDPTTo682xneZMn/W6paYl7KSMhP8h+Wg8UdzWOuE+cUDvP+ToP5iqhJU3izfK/AFdNxLoQ6kiRCfdlGHchQn7bRI1gy9YlA8KgwYqx2qX0OiNW5494VH6tUF1q3E5GSqm64ng/FAtU8w6ODVCqgaG33GZDFP6CIu6XVb0kRungRF8q2cNv2DNGx9ugSkT2I+umwwr8iyA/3aqyVZwRHyB74mnNO3VifEI1Cs2OMAb7s3pi0WOVE4yd4yqy30X8QNgxYdKQj00uqVQfQkvReD4xvQXQ5bFeu96kEcgANeb4112QA+aGl/pG2/gfeWmYk4EgrQ0lJ/9Lw==

ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;

s=arcselector10001;

h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1;

bh=P4oMGZgQYy/rB3rqk5a3uWsgBTugoYpo5eR1EqtMmQ0=;

b=LQ1+DzObBpEsMSRZgnleITN6Dy9DKkXjv/OI8EzoZ5Nx7f2v5RAP3BYdMJeC37T6pIel80dkxDqx9gclaaYcSf8GH8Smttc/ltkeDiA2GwlSLGXcEumIO0GiLi/2P3/L9DFkj+kl48UQTw8+NG7XTY7Nzlk7VaKvlxXO4QsWyIyL0V1IdBkX0z4epfHcm2252IhQZizRB9eTkYcdkXI3z/k18NW7CoPxTnRwEd52hNxC19HLK1iYFpbKQCg2eYBpfedrJI7KsBiUUtPa0j3fYUfAs/A5WS4OHH/YK+K3iVBKJ1XBbOQ+49Ay9DqJlocU973Vdfv8SlOvk3qrsknbMQ==

ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=none; dmarc=none;

dkim=none; arc=none

Received: from substrate.office.com (2603:10b6:208:40b::22) by

IA0PR10MB7273.namprd10.prod.outlook.com with HTTP via

DM6PR21CA0011.NAMPRD21.PROD.OUTLOOK.COM; Tue, 3 Mar 2026 15:55:28 +0000

DKIM-Signature: v=1; a=rsa-sha256; d=microsoftonline.com; s=s1024;

c=relaxed/relaxed; t=1772553328; h=from:to:cc:subject:date:messageid;

bh=P4oMGZgQYy/rB3rqk5a3uWsgBTugoYpo5eR1EqtMmQ0=;

b=X9bm2xdP7maeWTYD6uUU5oJW6W8R6XnSBzW/rfw5cX4/yzachoHBka7DSCdBvwEEDJZrt7Cwohm

PIQh5v368VXYVZTzLgTmzV9Vvlhnh5JhGErf+yG74F2dS4rU1Jgibs/mfne9l3/fUr8oYnqKwXL2v

76FiUUpWu5m2103LfQ4=

From: msonlineservicesteam@microsoftonline.com

To: doctor@doctor.nl2k.ab.ca

Subject: =?utf-8?b?UMOgeW3El250IGjDpXMgYsSXxJduIGPFj25mw6xybcSXZCBmcsWPbSB5xY91cg==?=

=?utf-8?b?IFDEgXlfUMOlbCBVU0QgNzk5Ljk5?=

=?utf-8?b?IFBsxJfDpXPElyByxJd2acSXdyDDpWNjxY91bnQgZMSXdMOlw6xscy5DxY9udMOlY3Q=?=

=?utf-8?b?IGbFj3IgSMSXbHA=?= 18304603867. account email verification code

Date: Tue, 03 Mar 2026 15:55:28 +0000

Message-ID: <[3bf39d65777947caadd340374ee344ce-JFZGS42DN5WW25LONFRWC5DJN5XFA3DBORTG64TNFVIHE33EFVBEYMSQPREUCTKTKNIFE7CTKNIFERLNMFUWY7CFPBXVG3LUOA======@microsoft.com]>

X-MS-Iris-MetaData: =?utf-8?q?{=22Type=22=3Anull=2C=22Fields=22=3A{=22InstanceID=22=3A=223bf39d65-7779-47ca-add3-?=

=?utf-8?q?40374ee344ce=22=2C=22ActivityID=22=3A=2261a8712e-038c-40ac-9963-271f5f541?=

=?utf-8?q?585=22}}?=

MIME-Version: 1.0

X-TsbHttpDeliveryResponseType: Success

Content-Type: text/html; charset=utf-8

Content-Transfer-Encoding: quoted-printable

X-MS-PublicTrafficType: Email

client-request-id: 3bf39d65-7779-47ca-add3-40374ee344ce

request-id: 3bf39d65-7779-47ca-add3-40374ee344ce

X-MS-TrafficTypeDiagnostic: IA0PR10MB7273:EE_ICP

X-MS-Exchange-SenderADCheck: 0

X-MS-Exchange-AntiSpam-Relay: 0

X-Microsoft-Antispam:

BCL:0;ARA:13230040|3109299003|69100299015|7149299003|7049299003|61400799027|376014|4076899003|8096899003|54012099003|15920700032;

X-Microsoft-Antispam-Message-Info:

=?utf-8?B?UVBzRG9YVVZFbWJyODdZUmhxdzR3VVB5U0xmVmJLU1k3NXNlSWdnNDRhR01r?=

=?utf-8?B?YXkvcm1leTB6QU9obkIzZmZ3UWd0RUsvOUpJdjBpdFJ5RE5XY3ljMC9GVXRF?=

=?utf-8?B?VEZLdFdicGQxcGN2UjBYTmpNL296SGFueCsveFY4eENhV3EzOHhLN21PRXp4?=

=?utf-8?B?MnlDWGcydVNDbGZpeW84Q05XeTdRZFdoaEZTUjQ4bnZLOC8xWWRxQlVaOGNi?=

=?utf-8?B?VnJzbjdnMURBVEYrZE00ZVhWMDdjZEJmTm1GbWdHdlNpUkgwcmEyekRJVFlW?=

=?utf-8?B?c2VmRy9seXpzWTM5OUhoOGRPU2lRTDluRUhxN0xpNHVTUzJuTjhKUFhJckpw?=

=?utf-8?B?KzZsUXNBbmxTK25zQjJlVDBVSm1qM2NiUXpMbzhVSnlpV1IxbkZjSG9NM2ta?=

=?utf-8?B?MGwzRjFQYk5ONDJld3NBaUJSWFV0VTcvbmtKU1lkeVdHRkdDM09nZWwzRnpP?=

=?utf-8?B?TDJsUUt6NENjS1RJV1FiOG96L284MzUreDlqMEt6cFBKOUFvRGtyWFowTVNY?=

=?utf-8?B?NmxtS2VLYTJaMEZuRW4xUEMvT0E2UzB0QWFDVVJMdzMrNVRrU2hFRmNzSFE3?=

=?utf-8?B?cHVKYld5SmN3UmZEd292WGp0bXRROEtQWEZIcFZDTHZRSDh6RVU2N0lNSUg2?=

=?utf-8?B?NEhySXBudGthVDZzRDM0TTN2bGhuMHJwVGdqSTd1ZytjTUhGYzV2QmJBWDBV?=

=?utf-8?B?dzBGNzRrdlNzb1IybmJyMFYwOXd1Q1pUTkdhU2d0NCtZb2Ria2ZwM2pBZWtU?=

=?utf-8?B?SkFHSmFsdURNVVhPUUk0bW16ZDlJeml2b0JPblZ3dWZKVmIzMGU5WGF3M0gy?=

=?utf-8?B?VVlNVjNaMk0vajUvRHY2N1FvSjR2SjBjMVlUM2tZV0RXQklGbHdPamI5Q3Az?=

=?utf-8?B?cFArZytML2FlQTZ3STZJaFlVVjdaQ0JidXNjY0o1ZE1SUml3REF6T3NIeW1x?=

=?utf-8?B?USs2c2tuS25BNU94UmJKL1R4RWRwVFVhSFJXbUwwRjZ1Z1FpVUZmdjVrMnBN?=

=?utf-8?B?N2F1RlJobjF6RXNBTWg5SzZxdEQ0ZjBDK004WXJqZ3F4S0d3TkkrUktsQlFH?=

=?utf-8?B?RURkNGNBWUh3SE1qVU9YaEpOTWFUR1FTbGVudkdzUWZDZnVrQ1BxTkM2TVVT?=

=?utf-8?B?czZrOEFiNHUrTkJ4ZkhCTmhpZ3Q2bU5KUkNOZmVldHE0dEFrVERkTFRwcVNQ?=

=?utf-8?B?bEVXYUxzdzhELy9zSFRwUnhpd1RnV3UreWI2VDJnNWlrZnZwemhZaHJ1L1dk?=

=?utf-8?B?b3hVaXZaMVJGR0lUc3Z4ejZhV0NkdE5Wb0hXYTdVMHdPVkxvVWFtMUZsSVRP?=

=?utf-8?B?YWtxeW81MUltWTR5ZWhQVjZXMkdxcER1TXJZOFJVNEtmQy94U1d0Rytkdkhm?=

=?utf-8?B?ZnE1a21KeG51K2p0YVRVZGZlOUFLM2NGZU5QVUJ6Slo2NVR1U3FYVFJnbFBG?=

=?utf-8?B?REcyVGhYRTRiUjY0TDdqR2RYRkF2bUx5NHNqekVhOU1QSUtnb0NuQVB4TXRl?=

=?utf-8?B?Y0h3eGQ3c1U4UnpCRU5kUGhheXJqR1ZPS0VNSUY3ZFROd0dFbStWMTBFZEM3?=

=?utf-8?Q?YIi34r2QSDVjJb/m2wW11gNfk=3D?=

X-Forefront-Antispam-Report:

CIP:255.255.255.255;CTRY:;LANG:en;SCL:8;SRV:;IPV:NLI;SFV:SPM;H:;PTR:;CAT:OSPM;SFS:(13230040)(3109299003)(69100299015)(7149299003)(7049299003)(61400799027)(376014)(4076899003)(8096899003)(54012099003)(15920700032);DIR:OUT;SFP:1020;

X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1

X-MS-Exchange-AntiSpam-MessageData-0:

S+czWdW16DJK63JLeVBTCvoZDXNWoA+ba4OBzPjuP1eRL7hstjLRaIpKir4tdwwfbgmiov4svocxNqvkB54yCQXEYj8R493xBkzVUW5PTnbMKdStpUYeGoFcVz0dVS7pWOh3uhVyk1KQ07OnN2LiTD1Xgt9Fvu3a9myb95/bK+mvs1Ts86hbn5g12pZz3RoVY33VxGRtJgew6bUQ9gt5/GrTk9hKrx3SZSdlmlTrZ+x8XAKsL1oNmF3Iwc31o+Q9qGL+OOVD1PW9E7YwWCZyMmuYRi9g0OCsziBS7cGk9uyu9jN/esJeX2sdcfE//LTGjo2KdZvKVCjOcdSaChV05EkA4wwz/kmc73SVSXzsG8ggQC9EVWVh5Q/cLIaFpZrn15JywK96oph5ogHG23ozMMbNcrD04ICI7ZlmuOJhQu8U/qf6HFzVVmdzrcET8lC8VjHaAFiFbmvYxkRmXn3z9QJlf1gFQsVzhBhpWGw6Fuet2mcOLsCVfHoSm6NKgKt+z6MdjyzK2mrTcADYVxjCKRbGAbjt5oNohgebupWOsLWq0Ie4PcOOSyfr/5TcKZ3MHOtmBnw+5u4+9rCrouU9R1fOCGucuwj2CC5FDlhixHchsntKLjt19DFz8uAkSupYO1mcitCKCk03mFjn7ghllnx54/6zW3IrlOTSXv7at/efzoXJrkeBSpARJLYoSfwUlxfQszgdl4qeqprEJ3bHtZAdr4M/il2jPHLiKLYk4m8voeva+iZDWGwbrpaJ3KMZcP7kNq2lZVJ78JgMsp5hk3uy0Z4GBksGGnmUu7xDnwkwdLmngsD79MEYU6UKQtcTy8VhuVXQrcGwtzKwi8cRAA==

X-OriginatorOrg: ideasprod04.microsoft.com

X-MS-Exchange-CrossTenant-AuthAs: Internal

X-MS-Exchange-CrossTenant-AuthSource: HttpSubmission-IA0PR10MB7273

X-MS-Exchange-CrossTenant-Id: 411ca7db-1b8b-4c3e-8589-e4ea7d89aaf9

X-MS-Exchange-CrossTenant-OriginalArrivalTime: 03 Mar 2026 15:55:28.1321 (UTC)

X-MS-Exchange-CrossTenant-Network-Message-Id:

243bd456-5770-4816-298a-08de793d4a68

X-MS-Exchange-Transport-CrossTenantHeadersStamped: IA0PR10MB7273

X-Spam_score: 9.8

X-Spam_score_int: 98

X-Spam_bar: +++++++++

X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",

has identified this incoming email as possible spam. The original

message has been attached to this so you can view it or label

similar future email. If you have any questions, see

@@CONTACT_ADDRESS@@ for details.

Content preview: PÃ ymÄ—nt hÃ¥s bÄ—Ä—n cÅnfÃ¬rmÄ—d frÅm yÅur PÄy_PÃ¥l

USD 799.99 PlÄ—Ã¥sÄ— rÄ—viÄ—w Ã¥ccÅunt dÄ—tÃ¥Ã¬ls.CÅntÃ¥ct fÅr HÄ—lp 18304603867.

account email verification code Verify your email address Thanks for verifying

your RileySnyder@Tamra707.onmicrosoft.com account!

Content analysis details: (9.8 points, 5.0 required)

pts rule name description

---- ---------------------- --------------------------------------------------

1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org

[2603:10b6:208:40b:0:0:0:22 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:208:40b:0:0:0:22 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:208:40b:0:0:0:22 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:208:40b:0:0:0:22 listed in]

[will-spam-for-food.eu.org]

[2603:10b6:208:40b:0:0:0:22 listed in]

[will-spam-for-food.eu.org]

DHL Phish Part 4

Posted by Dave Yadallee on Tuesday, March 3. 2026

Thank you for using On Demand Delivery.

D‌H‌L‌ ‌E‌x‌p‌r‌e‌s‌s‌ ‌-‌ ‌E‌x‌c‌e‌l‌l‌e‌n‌c‌e‌.‌ ‌S‌i‌m‌p‌l‌y‌ ‌d‌e‌l‌i‌v‌e‌r‌e‌d‌.

D‌H‌L‌ ‌G‌r‌o‌u‌p

style='display:inline-block;padding:10px 20px;font-size:13px;color:#777;

text-decoration:none;border-radius:4px;border:1px solid #ddd;'>

Unsubscribe

ID #yVXPG6z1cDRzLRiehQCxxqoIOh

DHL Phish Part 3

Posted by Dave Yadallee on Tuesday, March 3. 2026

To ensure a smooth delivery, we kindly request you to update your address as soon as possible.

DELIVERY INFORMATION

Waybill No.	9779802484
Status	On Hold
Reason	Incomplete Address
Shipper's Reference	N/A

Update Your Shipping Address

DHL Phish Part 2

Posted by Dave Yadallee on Tuesday, March 3. 2026

ACTION REQUIRED: YOUR SHIPMENT IS ON HOLD

Hello,

Your D‌H‌L‌ ‌E‌x‌p‌r‌e‌s‌s shipment with waybill number 9779802484 is currently on hold due to an incomplete address.

"font-size: 14px;color: #3c4043; text-decoration: none;font-weight: 700;-we= bkit-font-smoothing: antialiased;margin: 0; padding: 0;">Organizer

olor: #3c4043; text-decoration: none;font-weight: 700;-webkit-font-smoothin= g: antialiased;margin: 0; padding: 0;">Guests

Light; font-size:18pt; color:#ffffff; font-weight:normal;"> =20 "#FFFFFF">Verify your email address

Archives

Categories

Syndicate This Blog

Blog Administration

Powered by

NetKnow Navigation

Remote RSS/OPML-Blogroll Feed

Error

addthis

Empire Avenue

Error

Error

Error

Syndicate This Blog

Error

Error

Error

Error

Error

Error

Error

Error

Error

Error

Error

Error

Error

Error

Error

"font-size: 14px;color: #3c4043; text-decoration: none;font-weight: 700;-we=

bkit-font-smoothing: antialiased;margin: 0; padding: 0;">Organizer

olor: #3c4043; text-decoration: none;font-weight: 700;-webkit-font-smoothin=

g: antialiased;margin: 0; padding: 0;">Guests

Light; font-size:18pt; color:#ffffff; font-weight:normal;">

=20

"#FFFFFF">Verify your email address