Amazon Prime Phish from Google Gmail
Posted by Dave Yadallee onX-Mozilla-Status2: 00000000
Return-path:
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Mon, 09 Nov 2026 08:17:00 -0600
Received: from doctor by doctor.nl2k.ab.ca with local (Exim 4.100.1 (FreeBSD))
(envelope-from
id 1xQQAp-0000000012i-0quR
for dave@doctor.nl2k.ab.ca;
Mon, 09 Nov 2026 08:16:39 -0600
Resent-From: The Doctor
Resent-Date: Mon, 9 Nov 2026 08:16:39 -0600
Resent-Message-ID:
Resent-To: Dave Yadallee
Received: from mail-dl2-f7.google.com ([74.125.229.135]:39364)
by doctor.nl2k.ab.ca with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256
(Exim 4.100.1 (FreeBSD))
(envelope-from
id 1xQODL-000000005Ej-48DH
for root@nk.ca;
Mon, 09 Nov 2026 06:11:10 -0600
Received: by mail-dl2-f7.google.com with SMTP id a92af1059eb24-139b659a45eso205903c88.1
for
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=evosaa48.juventus4.biz.id; s=google; t=1794226204; x=1794831004; darn=nk.ca;
h=content-transfer-encoding:content-type:mime-version:message-id
:subject:to:date:from:from:to:cc:subject:date:message-id:reply-to
:content-type;
bh=0EJHjpWNZ/TILrcC7IQZhCMi+bB+taSYzgF5dkVbp1c=;
b=fY0hLipUbl+rEYpzlFbvrAjEzxS8ISWAngSFG20dtIhreKpTcgQag1V4Og9Ri88pdZ
DN+MQ0w6dEBnxkBqUuDxQ/6cmGJf/nHPI8k7A8vkvObzVlATUIaZnGyeyTyzo4zKVkCc
CaohhCbJE8QGBjLSTshBuAhuXdkHFOg8KTyOqKbD2L+gbo9mU3lRd6mn8leqiey7mCjn
dhJLf+XRsnrVw/myVc80n1Usp2WyYV+iFGfqrnsF/DbEDnt60xdxMWzfiKEs6ef8+uHc
q6IbbCc5++QsFChQF0DCycxju+nvyyvEDPKtZ1RyhJK8f3ERNdXRZJLbrzkmPcT0fNmZ
xBhg==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=1e100.net; s=20260707; t=1794226204; x=1794831004;
h=content-transfer-encoding:content-type:mime-version:message-id
:subject:to:date:from:x-gm-gg:x-gm-message-state:from:to:cc:subject
:date:message-id:reply-to:content-type;
bh=0EJHjpWNZ/TILrcC7IQZhCMi+bB+taSYzgF5dkVbp1c=;
b=0Wkm2+1mvoK+6GzQ+VaHSinXRnw8NFZvZU0rRGIBobfbO0tueE6+sVbdECLjlGvI4k
OLf9Ew896+m8D+BdQGY7CJbCbDMzSbZVlMIjwgi4VntnSkH/KNaZyOPLcE6iNDmZNamw
eV4plqIlUcqIzNdvaieHVhWW1TyIf3P9XqG+GaGubFyXrp/W/+doofvfiH1JrCM6LUIb
EUJbXcjFhcRU3ktvVa1DDwV723731G99BlxOcDj9vrK2IsaUHgHUBXAT768dREmZe0pt
PUhg19/GVphN5lTuSW+OqFcERgx6LTaV2MQ81k84WftRZWyC4WujOprtV7fWv5OLVMTq
GQ6A==
X-Gm-Message-State: APuU4Z9xx6kCwsghwHJXf3WKi6sfxRLEJcBzmAfBurYd6/IlsmThfqWw
lMyoAlF/Go+UQGPCaE6u2d/fSRKRnD2Gjd/guecvu5s5lv8VFKGw4HEm9s0S36LjVu9j+kvyXu+
F/eO0xcyQM/Qjlw==
X-Gm-Gg: AYBFou3tYS6ZkT01vQuF5UyGyJJXYlHX56P5yRhlDykGZo8ydCVR55VwzgEPm9UjsaM
j5iDr68Sw54queLtdUBF3/ZFsMIx9fdkaC3v4GSqKs7LtPHIQU3xE8+PhmBCCDTtOqPqAeV/66o
GnXDf5obsXfA9L/ur86WEqV2QY8Qjul3M7KuTbRbcbfSe7EZTDn9caQJNOCf3O11ELxbf60zKop
0+0FY4oga36LvWDT5OkP1kKIKesCFw5mgOUJUAwfhX4vIW2tQM8h4XpmBnyljGR24eAa+acw8ia
TQWk5WAV5zfLvdvivB1vIGsvJZN+Du4W2gYP/O8+c9sQ0Sf7F144fqNKoYKAo1O6U4ft9Bfk3Id
pAfcFS1FNjAy7DQtnZS6NsuQSB85YL1i0v6AX7fBDfyt/rLYmQ41C18UbwiuVwZYb4Nv3Kv9DDv
K4jpHzeImtrgvGcf2vUb9meV3NxY8sxF4NAkMpPCBYX3SS/5nspZZ5Kb3kizbIgWyw3cSsx8bch
7oLlm7plLN7OIibyM+N9GaGyXoUP+AvS/npmmRpfVZWil4t+pJsfkSMkIvg6DgwnyAJtjFuatYs
JUEvWfiHDlW2CyoAI20gc4Bh07442wYgtKSBXryDJIeHQvv2DkNvsBkb4bBATotv1wYuAQU8gg=
=
X-Received: by 2002:a05:701b:291b:b0:1ac:2f6d:e1c6 with SMTP id a92af1059eb24-1b39fe2b272mr5763786c88.6.1794226203613;
Mon, 09 Nov 2026 04:10:03 -0800 (PST)
Received: from mail-qv1-299.google.com ([47.237.200.244])
by smtp.gmail.com with ESMTPSA id a92af1059eb24-1b375603ee8sm12425093c88.9.2026.11.09.04.10.01
for
(version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256);
Mon, 09 Nov 2026 04:10:02 -0800 (PST)
From: "=?UTF-8?Q?Prime Membership?="
X-Google-Original-From: =?UTF-8?Q?Prime Membership?=
Date: Mon, 9 Nov 2026 12:10:00 +0000
To: root@nk.ca
Subject: =?UTF-8?Q?Your Prime benefits are on hold due to a billing issue on Mon, November 09, 2026 12:10 PM?=
Message-ID:
X-Priority: 1
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Spam_score: 9.1
X-Spam_score_int: 91
X-Spam_bar: +++++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: Your Prime benefits are on hold due to a billing issue Hello,
We're unable to charge your payment method for $14.99 and any applicable
taxes for your next 1 month of Prime. Your Prime benefits are cu [...]
Content analysis details: (9.1 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no
trust
[74.125.229.135 listed in list.dnswl.org]
1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org
[47.237.200.244 listed in will-spam-for-food.eu.org]
[47.237.200.244 listed in will-spam-for-food.eu.org]
[47.237.200.244 listed in will-spam-for-food.eu.org]
[47.237.200.244 listed in will-spam-for-food.eu.org]
[47.237.200.244 listed in will-spam-for-food.eu.org]
[47.237.200.244 listed in will-spam-for-food.eu.org]
[47.237.200.244 listed in will-spam-for-food.eu.org]
[47.237.200.244 listed in will-spam-for-food.eu.org]
[74.125.229.135 listed in will-spam-for-food.eu.org]
[74.125.229.135 listed in will-spam-for-food.eu.org]
[74.125.229.135 listed in will-spam-for-food.eu.org]
[74.125.229.135 listed in will-spam-for-food.eu.org]
[74.125.229.135 listed in will-spam-for-food.eu.org]
[74.125.229.135 listed in will-spam-for-food.eu.org]
[74.125.229.135 listed in will-spam-for-food.eu.org]
[74.125.229.135 listed in will-spam-for-food.eu.org]
1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org
[47.237.200.244 listed in dnsbl.ahbl.org]
[47.237.200.244 listed in dnsbl.ahbl.org]
[47.237.200.244 listed in dnsbl.ahbl.org]
[47.237.200.244 listed in dnsbl.ahbl.org]
[74.125.229.135 listed in dnsbl.ahbl.org]
[74.125.229.135 listed in dnsbl.ahbl.org]
[74.125.229.135 listed in dnsbl.ahbl.org]
[74.125.229.135 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org
[47.237.200.244 listed in dnsbl.ahbl.org]
0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org
[47.237.200.244 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org
[47.237.200.244 listed in dnsbl.ahbl.org]
1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org
[47.237.200.244 listed in dnsbl.ahbl.org]
1.5 RCVD_IN_SBL_XBL RBL: Received via a relay in Spamhaus SBL+XBL
[47.237.200.244 listed in sbl-xbl.spamhaus.org]
1.5 RCVD_IN_CBL RBL: Received via a relay in cbl.abuseat.org
[Listed by XBL, see
-0.0 SPF_PASS SPF: sender matches SPF record
0.2 MR_NOT_ATTRIBUTED_IP Beta rule: an non-attributed IPv4 found in
headers
0.0 BAD_ENC_HEADER Message has bad MIME encoding in the header
-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact
cert-sa@returnpath.net
[Excessive Number of Queries |
-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact
safe-sa@returnpath.net
[Excessive Number of Queries |
-0.2 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)
[74.125.229.135 listed in wl.mailspike.net]
1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,
https://senderscore.org/blacklistlookup/
[74.125.229.135 listed in bl.score.senderscore.com]
0.0 HTML_MESSAGE BODY: HTML included in message
0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge
1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts
0.0 NO_RDNS2 Sending MTA has no reverse DNS
0.0 SARE_FROM_SPAM_WORD4 From address suggests this may be spam
0.6 HTML_MIME_NO_HTML_TAG HTML-only message, but there is no HTML tag
0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid
3.0 URI_GOOGDRAWPREVIEW_MINFP Link to image at Google Docs, probable
phishing
Subject: {SPAM?} =?UTF-8?Q?Your Prime benefits are on hold due to a billing issue on Mon, November 09, 2026 12:10 PM?=
=0A
enter class=3D"x_w*****r" style=3D"">=0A
" border=3D"0" cellspacing=3D"0" width=3D"100%" class=3D"x_main-container" =
style=3D"width:100%; max-width:578px; min-width:343px">=0A =
=0A
578">=0A
n=3D"center" width=3D"100%" style=3D"margin:0 auto; width:100%; border-spac=
ing:0; font-family:sans-serif; color:#4a4a4a">=0A
=0A
=3D"border-radius:16px; font-family:CircularStd,Arial">=0A =
" width=3D"100%" class=3D"x_logo-table" bgcolor=3D"#ffffff" style=3D"border=
-top-left-radius:16px; border-top-right-radius:16px; background-color:#fff"=
>=0A
tom:24px">
ORw0KGgoAAAANSUhEUgAAAGEAAAA2CAYAAADXjffsAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjw=
v8YQUAAAAJcEhZcwAADsMAAA7DAcdvqGQAABYOSURBVHhe7VsJjF3Vef7u9tZ582azZ7yAMXhsZ=
mzAGEMgLGmpWVKWxEQgVYXSkKihaRWUqmojkSpRqrZq0lQKShBJUSXShYQGFShlc0gAE0MMBIgh=
xMb74HXGs89b7rtLv+/c9wwxMPYMDgyuf/u+e+9Z//Pv/zl3rJiA4/CBgl2/H4cPEI4zYQbAjDd=
HQq6BoW4WL1s/xxDMeCaUA+C+jSG++4qDiRBY3Q18/nSgmE4YcizAjDZHEo9d48C/vFTBthGgf7=
iGe14u4dl9b2rHsQAzmwm8qmGMgSiPUYp92fPQb+cQBJGpO1ZgRjPBIuHnFCxc3DGEruoBFINxn=
NVcwfL22jEVUcx4n0A3gGH6hV8PAKUa0NsBzM1EZNCxw4bpM4HUqTiAiwBuTCoFISIPmEAKI76H=
0AdaU0CTq2iGL3ENoZ03ZkTks6MAEZ9slsSWAyui8Wd9ieKvetIbhbDCX4KV5iycknUu0XXCUcA=
rcswqAtZVWZcjPjE7RtQeiyM7UY2OPI0DnJpoopAF0qxPo8IZM5zP51zClUNVKsimiHzWQd5QYw=
y+VUAq4px1XidzVIhXBqNEzidCmq+F68u5LLDY2AiGZtMgvPMWG3wmhykzQY3V44FtATbsdZENf=
CxdkMLCTuCn24B1jGQ2DwUkDtDZHGPlwgz+YAmwJEuiW67pL6TWvAGs5UV64bTZwFWnACPjEdbu=
rOG5PTUMoAm3fATozgE/2Aj0DUckgI32PHBdD80UGSx4Zi/wxDYSnVw/q8PHmYuajdY8RFye3wW=
MjlWQs0tY1Bpi9RmzcO4JwAE6+cdYt35rCRuHHURBgFxTHr+zwMcfnpZCd7aEqpVDmv4oJC2dKM=
TQRIBHdmXwk60+Ng3HKPk2xa2KWU0eVnancR3xX5iP4FkSF63TJnETHA/Hhakzga0DXjc9XsOj2=
zzkKSJz24FM2seWwRCVKEuJpXRRMrN0oFmnip7OKv720hYsLkgLIkQc5NYnQ9z5eooaAZzeNIYv=
XFzA954FNuzn+FyHlwHuuAL4SLGE6x8I8PJIMzgc5mer+N7qNE5rDlGLHfzzerZ7KTFbXbkAvbN=
cbN05jDfCFkphTGmewKDXBFownOyO4IyFRby6J0QfPX3NtqkXnIv4umEIxylh1bwM/n6VhxaGwF=
5ACaek/2rYw1eeqOGJAx7StRC+45j5ikGZq7HIqAxWtFfx1UvTODPPMptqRzBKFLMlNX0yqCvb1=
ECMdWueUbVqpoxNJWDbfhuFlIP5LSFOyAfIOD4mPBv7vCzWHSjiu08PYVA2hlIlPQ5IQKGWplnY=
VCrg1h+TAfsChCRWioi7bOaR2S7NmGfHxjxJ/S2apCKlXohnIjYmSOssyt4bFRePUbt22S0okg7=
NdOrVdBNylBqZqS1+EfdvBjaVHaSyNjrSMea6gREEi4QatQt4creHzdQUh/OCmtvHdf7DE2NYv9=
/hOAE8Ir20GOOj1N7O9iwZSWmJI7w84ODfn2OfmKaYOIlGBjuZqcPAtJgg1aESI0u7nqM5SnPGT=
/W6uPPSFO6+3MH3r3BxyzlE0hug1NN+knCP7yvgV4NJ54Ao+nZDOmJQuzFSpmQ5NcydBZw010Fv=
F9BGQlZRhI+8sc1aWI12PKAhCIiBZQiVLCIbsqU/gctm13D7KuBHV9bww48Df3mGD5fSbJEyDu8=
dto8vrQhx15U0c1fHuO1yF735CUOwbBhghO32EhebY9eI9yM0a2v7m+jrEv/1uTMdPHTJAP7n4j=
dw1+XAeR0lKktIC2Fh7XafmlU3ueyfkH9yLRBMnQmiBKHsRZzaJaOLIO1wySLgrDkhuosVLCtWc=
W1vCud3taNA0+ISq32Bi1f2qD+R5BgeTZIk3eG9me/XLKzg3tUpPPoJ4CdXl/CjKwIsL/hmQVQE=
cDqk4wqn5wPfzQLpCGX6pAmGMW4eF3V7+PiCEEs6ApzaBnxsYYoBQkBBoZax36y8hdU9DpYzylr=
SWsZ582imOjLGzGaCktkSocXhHJYxVY9uGDRBBOUd53RU8NnlnLZ1FsqF+ehqph9g35rloUyh6g=
9yfE6EVAYyubPgMDB1JiQjIxXQumvxdg2uExon5MheUB0VzXS5Ec4+kWaEgsBHc706EKFC6ZJsB=
LwzLqI6p43GLu2kc2930MLucHNUezLLoffVoji4iB7FaRKdhOcAKc4XUwjEYF1qF3H6DM2dFhUj=
y/IQtDpIkYtBPShwadjEfBpTvmXNOIUMO3PMstNkSJYnRwIra7TzxZE2jNtJ6+7OgoJAWR/Y5Qr=
W9QFP7wyN+dH6OjOhGc8AzZshbt1kTgam3dGCmIRtcF4OeHaLbRYtkkhiB8d9cxf5ZyTU0TLOlv=
eh8RBlou+wXBL+b6/FuOzuAOf9J3D+f3n484cDbK1QakjoglPB6tNcapyfaCkHk7DFB83uu8PRZ=
YJ+DA/0xLCR8yfynpQYHs1AkLM3d/ObgPCtSuxZ6FL0UyS0RbM0UqpibMJnEOAwEmSITm2bnynh=
prMyuH6petLRmwH0G/Ht8HBUmdCA2CzHBkN0E0Za/CcTUKRhlemQpM1EkK8SJNjTtFGIPAkTk1F=
p9vn0N5/5aB7X9KRw05IAt6wEvnVhDfetzuKvT69gnqeUjpGXGYRRAOFICHxUmNCQ9MaT1LFKSd=
i2awgB1UGlaUYLC2dnaJ4abY8cptp++pBwQdorI9KSTyHDJKJM3ySf0uWP4YtnAF+/EPjax1z8B=
ZnwiZ4M2otcI3OFmJGbiC+NSXCW/zu8LkybCdpyUMQSalLG7cMTwITPRVCF7WACPx+08dB2hnVs=
oygjl3awkmGnEzPGl7Ois5WTdqMklKsycXonkPOv0TEKHKq+IiUtSzba4lg1dmPyynb0Oyy3qHl=
MuxIicGxJt4ioAvOszIzPtl5M4kFTE5dNCKyQ1DGoWSjxvTPHLLy9ZpytEuG1fTU8vFXrDA3O0g=
6TjLFugIscF1JiJHFJzLDeE42YDDjV9MAlAkl4aGHUzeIbT5fx6cd8/NnTKfzpmjz+5qEQr5eLJ=
C7Vmu1XtIxhMUNG4RUzwnHFDL5GjCLk+HLROO9a2m+CQthsxGyQ/Xxb0VCIPON5mTeBMnPt8TTG=
S0cVOGHZPMdMpESMQjievHMMh4mLnoW7oRELNa+iu2xYM0zORFXkKc0ek4trzkihhVl3jXx83Wr=
DV58McPNjIb7xTIh/fM7GrT9zcPOjMW58MMJPN5fM1ooJw83Mgjqik4DwmRZI8iSlIpJEcF+Qxb=
N9KTzwGvDgjgo2+VRJSnwrCbQoN4LPnFfEHE8ZZb0/pVULrh2MHhTyvh0dI00kvNgjhmqXJdSGn=
+J+hsIaTnUlmgNtKPosq8uowU9EJjlRZZ3KUgdNBYFrkBAxyDZMqTkeShTcCsNmwyoSc9Vc4PdP=
oT/jIvPU8nKlijW7U/jOLx1850XgrleANTstvELNH6xyLo4jn6e5jhSmzQSpvNboUQJbwxJWn0p=
iN48xRBsl8krl08hygT0dIb50eRErO8mw+k6jJi1kXbTGE1zcCHIowSvkzALeBiReJmWjyDla6C=
BzdhXjKS3SZY4CNNNSdUQjaAsG0VEZRobpe81NGyIow9U2g0u/lLPKKFJLmolvlX2M8HA8tSt6P=
maFYyjGw+iMRsHci4xgbz60OFX81UV5fH6lg3lpagTnNbJCXGX+lDRo7JOKIU7oyJq1SaveaSnv=
BtPewPuTRyUBSVmO6nrbVXl0MwvdvpdXf4X2NcKSLgu9XRl0ULqYYpEkkn6dijkYYiCxY4wIsJ3=
v2OgpKNYW9g3NSCBi+y000BO0SFqZth6WFaokhCQ+xB5mgzvojzJyFKTAKUUmW2Y+AoOBgMnjVs=
4zYpImG20c4+Rmn/MqhpFmetjH2zYmZtq3aua1kGNkDaOSnV+xXN13EI8X9gMb98YYLvlIc57OJ=
gdL57jopqklDxiyUne1tU8/lsx4eJj+LuoaMmGHNCFCE8q4/YocLpqX8N/YW4LsNicgJpIZOUsF=
q5qODdhP5kfvzLeNjzHl5norKNpiP3XTG6ttLZLEkeJrTNUbyTZ9OY4RVb3r4jPrZD7N9rIpUb9=
kbtOEhcJBIOdvCqjFqkzaqUx6xR7qwkvYGmAziU0iZGybDEM4+HBYOBJGvSNISkSQGhdcpQPUJp=
1BiJdkTJdByHyfIoKJAYLkt2GWVKraBJV63W9AcshjhudlEDYMEIhAyTZI0kD3xpL0Un9mnWZLi=
CVImGHaGCSTMZJx+GvGSPon7VST4K/lUHHhNS6+myUaP2Ue6teRQ4LTFEFTpBmxyMnpWdvNqagh=
S8dhqjB1JpDS0uAxt5lRByVSLzrLZJSjx+MwdZi6T9DFnzs3ARt2VhlghPBcB587N43uQl2lj8O=
UYMpMEKiDxYRGe/hyihXqU3PE8MKk7R9eNph1NZ4YOJgn2Xrz1ACWG5LVyWb8R8Og1J266tkvGS=
/5nQymxQSBIkKzQ69IhQyJnSYTMXz4NUE7n9qCJ3BtNROiyu/pnXUkunYntFVnDqX4rMjaiyukp=
phBCkSMeRmsKEpM9o4agcQ7w7SZAEq+DrQ1RcpIDXnO6GByns9wqIe+9HDMsfmo7RI+9ZcdbB+p=
4eV9ETYMprFtzMYYmyowyTkhZucd9HS5WHkicHYrgxYJJ2khqti/DSaosZKaO14FzpsDrGhl9Gw=
xXNXpk+Zmi8b+/IcNRHyRyzbEd7E1SOG+DcDDzId2MuEbooDL4qR52ebTFotZe2J2sqzoyQ7g7h=
s6keXylfe8mWNMbh+mzgS21lntNfdWMTg6gauXtmD1EhsLC8yDOZcYoCE/jIxIUjIRxUefn8JXH=
q/imf4UsnaEPCvS2hK2SV6XeYdfNbvGe+kQK9QeN4pRtMt45rM585FZitl4TC0igUUUM/67wbTM=
kb6g+PUQ8LW1Adb2u1RH4LqTQtzYG6GzkNhQ22QwHzLQFxKWZxgxRqnfsNeHk0qhhQUe7VOKaiI=
fIG0PIgt9bHP3ixEe3lzGBPJmG+PVT7Md27uxApVsYjoOQ4rp+wSm931VB7etq+D+rQ7GIg9zsg=
FWL3PxyROAnuYKXE9fVkjBpZpK5ur5sYxlAzleyrzf8vr+QGPVZj9ECEkPeJkzBm1RJNsUaqi9L=
rXw6AOMs3YyLGEtGbF+N3D9/wYIqD2L2hzcf23abN3bZlwyi+OIApPBtJlgUOfPAeJ1H3OG29eX=
MVh1Tc7QkrZw9uwIV53qYOU8oI2hhUtKG7y4xpDW14m1sVEH7a6aESWD7xMb9BFaAyFzt5CcQiR=
OWUQWE1TjhCFGAwcPvQGs21TCinlZ3NDLcjZ/ZKeFm38M1Gijr+ux8M0LKHB2Y0um4Rcmh+lrgk=
GPF8OxCuOBx/eREc8Cm/b5GKdFjOkfilTvZS0BrlycxvIFNhY01dBKx2Hp2xTWSwMEDRbIfb1fm=
qDTPhFKUtqY00RDipCISWDl0U9zs3tcn7XQOW+hqRlmeyK7Yi5wz6Vsys7fejHAP73oIsMFfH0V=
cO2JJQROrr4WFipyPEzu9B7Mkb5Qo+Pho8s8QXu9W6pZ3MNo4gcbxjEYNxnCUogQEtn5FK/e5ir=
OPiHGysUZrKQfke1MAjmuVp/ImQOZyRE+ekBiK57X/MYEuSS8hzEivXEQeGpLhBd2V7Bl2Ea/n0=
E6GkHVSWNZq4UvX5jGubOAcXa74b/L+PlQFt3uOO74ZBN6CyXU7JzZXdYJoqVd2d8WE0Q6xcA6X=
NFS9P2osuiIZuap3Ta+vX4C64eazKfu+lI5ICeU1GSIUzauore9htNOasJymqtTCsAcGlJ9hMvA=
430Cn6G2g0HfwW6dbVDi19PcvLyzgs2DASasJpOU6RzBtgPMcwJct8jCjeek0ZHxYcceXhu0cM1=
9wDDX9EeLKvjyRRk0O4lwelEFIRO2Rt48Gbwnn5BIsSLhZBLzES0hpmTt4+Ke6gN++PwAnh9uoz=
Ojo+OKzFEH7ZDv2WRcgDz9QZFhRUvOwYk0V6d2eehu1ykdMJfBRYacqzHSktkwttrMwVWbzfJDg=
VjJxhnHmgiKMLPDMqU8jRHipe9Md4+S2JT2DXt1UAOMTLDbxAhKzAv0ratPydVRqlxFm1XFZQtC=
fOqsHE5nIlZkuY5lQzrib6+38HcbPHR5If7jygjL2pPtbPmSI/UHgvfgE94OGkgX8TRPE0RhP6X=
s4VcCPPi6j00TOZNpGuIQO/M5YsQUiYzQgX9M6RKxlYfnUUV73sWsgo2TW2toK2TJKAtNpL1OvV=
rZkDGANm8PLlSBQo08qnKOkh+hVKkxwXKwqeRigOK6e2gCB6oWRnwJBEnEjurjU2Ir+ohAg/BdF=
GlP+ebb08uXNuPCU4AOVkmAkqgJ2E+n8oUHK1g3ksGtK2r44+UeUhxvOsb0qDJB8qlLRPHMCZWc=
HJEmcbdTAtftAu7dUMYLg1mka4FZuDb/xBSprTRDRAmZfeu8WYhJGpUjJZqgP8KgAaR2iGnipEN=
KNnIh+R/TX8+6s5/Mianmu+46/Ne45AXDCfmzJLHUPo+UaBZGcckCi8QvmD9e6SDTE+3TQMmGpd=
jwxB4Lt6wBzm4p45u/R7zy+SQ05TVVOKpMAFVUp+QNRJPlJk+WogRONcyw6Rd9If51i4MdeyYwM=
GGZP2sSURU0iYBqr83BFH2HVLtCUyIC6pIpMM9y5IeCwmDd+GsuvticM2W+bdIBpGyJhEJj6G8e=
iCfbtFAlT2y2cMHcGi7p8bCUZif5sykRnoalzmXNKCI71N7vv2bhma1VfHFVExZndKaeoZCoxdR=
14egyoY6EBmzsmTQQl07IpiNMwsBxNGH/eIRf9gM/2+Pi6b4Y+2mrRRh90CWJ1nLkzKkv6klICC=
vtKDNSORRUnpArAeEhOPgVBwu0pSDp11cbS9pcXLDANXtgi4sxWplsKvbXVxbCO9k5DamZyRfWK=
tNQOofewbyhyIIMxV9ip5WabQrWTxWOKhNEaA0m02G+OKCDlAQKkq/V9EVcmr4CaOKrMG5sC4/T=
hr90wMYvdvjYSIO7u+zRdlsY82NUGXEFVBMFAMZssL3+oONQ0NeAqtOMNgnlkisOr4wXoZkGu82=
rYUELHf/8FH63i46fzr9ZTGEb7QCb7WlejralJdfyU3zS8a2ZleaowQhbWm/EhKkny03AwZk/cC=
a8dwipARbGqQqMEulE6QCpONrB7KeW7B8JMFyOMEqHu72WNzY/QZ9mhcScbZfRqlA366Ajn8LsI=
h0sw98TeJ9N2z6b0tGWEmNISvqjmQIziglSaIV2idawQLbHAN8plQEvSaJkLjEYCSRskCYm9lia=
IDNmDlTM8niZMw+NY+SY/99uzj4omFFMkII3CGpMSv1ZuzgJyJ0moLpDQXVvbZmwMMlmBI063Y1=
/miEws8yRtn9FIjpG41mEmaIT1R0CipLeBqR6o7hxTxhRH8pc0g5qkdkimRkwo5ggRETwBkIyLo=
p4GpRslOsuN30oaMu5QXTTynSQCVKS9eaftipoToLZmQEzzDH//4R3Mq3H4X0F4P8ABwZVfDU9S=
DoAAAAASUVORK5CYII=3D" height=3D"65" alt=3D"=0A Information regarding your=
payment from Amazon Prime=0A"> =0A =
=0A =0A =
=0A
ffffff; text-align:center; padding-bottom:52px">=0A =
=3D"padding-top:32px; width:100%; border-top:1px solid #e5e5e5">=0A=
>=0A
ng-bottom:32px; font-size:18px; color:#00405D">=0A =
d>=0A =0A =
=0A =
align=3D"left" style=3D"padding-bottom:12px; font-family:CircularStd,Arial=
; font-size:17px; font-weight:bold; line-height:1.67; letter-spacing:0.38px=
; color:#13126c; text-align:left; margin:0">Your Prime benefits are on hold=
due to a billing issue=0A =
:12px; font-family:CircularStd,Arial; font-size:15px; font-weight:bold; lin=
e-height:1.67; letter-spacing:0.38px; color:#13126c; text-align:left; margi=
n:0">Hello, =0A
ass=3D"x_email-paragraph" style=3D"margin-bottom:24px">We're unable to char=
ge your payment method for $14.99 and any applicable taxes for your next 1 =
month of Prime. Your Prime benefits are currently on hold. =0A =
ss=3D"x_email-content" align=3D"left" style=3D"font-family:CircularStd,Aria=
l; font-size:16px; line-height:1.5; letter-spacing:0.2px; color:#171731; te=
xt-align:left">=0A
s=3D"x_email-paragraph" style=3D"margin-bottom:24px">If you don't update yo=
ur payment method in the next 6 days, your membership may be canceled. To r=
estore access to your benefits, please update your payment information.
iv>=0A =0A =
=0A =0A =
=0A =
tr>=0A
resentation" align=3D"left" style=3D"width:100%; max-width:303px">=0A
>=0A
ogle.com/drawings/d/1ayuPGa4IqkStuv-1IWc1e4ve96BgiDQ8n619fU1LgNw/preview?FU=
p4j" target=3D"_blank" rel=3D"noopener noreferrer" data-auth=3D"NotApplicab=
le" id=3D"x_bill_view_link" data-linkindex=3D"0">=0A
tn x_btn-primary" bgcolor=3D"#3667e9" style=3D"padding-top:10px; padding-bo=
ttom:10px; padding-left:30px; padding-right:30px; letter-spacing:0.8px; lin=
e-height:1; border-radius:12px; border-width:1px; border-color:transparent;=
font-family:CircularStd,Arial; font-size:14px; font-weight:bold; backgroun=
d-color:#FFD916; color:#000000">Update Information=0A
=3D"x_message_body" class=3D"x_email-content" align=3D"left" style=3D"font-=
family:CircularStd,Arial; font-size:16px; line-height:2; letter-spacing:0.2=
px; color:#171731; text-align:left">=0A =
">Sincerly,
Amazon Prime Team=0A =
=0A =
yle=3D"font-family:CircularStd,Arial; font-size:16px; line-height:0.5; lett=
er-spacing:0.2px; color:#171731; text-align:left">=0A =
bottom:24px">
=0A =0A =
=0A
tion" width=3D"100%" class=3D"x_responsive-padding-x" style=3D"background-c=
olor:#fafafa; padding-top:31px; padding-bottom:31px">=0A =
eft">=0A =0A =
om:16px; font-family:CircularStd,Arial; font-size:12px; line-height:24px; l=
etter-spacing:0.18px; color:#171731">=C2=A9 Amazon.com, Inc. or its affilia=
tes. All rights reserved. Amazon, Amazon.com, Prime, the Amazon.com logo an=
d 1-Click are registered trademarks of Amazon.com, Inc. or its affiliates. =
=0A
-help-link" style=3D"font-family:CircularStd,Arial; font-size:16px; font-we=
ight:500; line-height:19px; letter-spacing:0.6px; color:#171731">=0A =
rgin-top:16px; margin-bottom:8px; font-family:CircularStd,Arial; font-size:=
12px; font-weight:500; line-height:19px; letter-spacing:0.6px; color:#17173=
1"> Amazon.com, 410 Terry Avenue N., Seattle, WA 98109-5210.=0A=0A =
=0A =
=0A
=0A =0A =
=0A =0A =
=0A =0A =
=0A =0A
>=0A
=3D"table1footer2" style=3D"border-spacing:0">=0A =
Microsoft Office 2024 license phish
Posted by Dave Yadallee onX-Mozilla-Status2: 00000000
Return-path: <>
Envelope-to: dave@doctor.nl2k.ab.ca
Delivery-date: Mon, 09 Nov 2026 12:04:00 -0600
Received: from [163.52.128.20] (port=32769 helo=softwareslicense.com)
by doctor.nl2k.ab.ca with esmtp (Exim 4.100.1 (FreeBSD))
id 1xQThy-00000000MgU-0iFb
for dave@doctor.nl2k.ab.ca;
Mon, 09 Nov 2026 12:03:08 -0600
DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; s=smtp; d=doctor.nl2k.ab.ca;
h=Date:From:To:Cc:Subject:MIME-Version:Content-Type; i=dave@doctor.nl2k.ab.ca;
bh=1OnWsMKRSRCFj0MG/DSxLoVDPDE=;
b=PWXCWmA6Uac+5P8LIh+2As//JW9nDZcgWxyh+GwSta/f8Gl4D/MjqP92rHW+8kbevGzevosvLW4Z
i7bZi4ZSMDucKA3bAqe0ogYRzOH3CrGyvQRGiy3/yHUVn3RwmI4Ku4BGRsuKBNPl6xIG2RYP9cyA
lDM9N9BPRSwTu3jhFEUqsmKx1iKsK89pl4MUKbk/YuYOpRspNDJ4vElFNj9huJxZouY/jI+lHq6s
e32tl/SAz4cCjC9g7Itr4urOJfa7x6GPyQDepnMgtn/dr+6LBEOqjY67DdvEdpX9S2WILIy4dadt
YYhUYS3LQPL8jtktnBuyjr0SzgjCKAqBws/xVg==
DomainKey-Signature: a=rsa-sha1; c=nofws; q=dns; s=smtp; d=doctor.nl2k.ab.ca;
b=WMMIxTpkCsm5+8O3bdDl2P9PP1YPV7bDiFF3h9FvCoSXvsBZVxZlBGWT9t+Wt1QOM/hnYmMbHcKX
jySD95crdwetqKV7KAhADT0xK8/klNr6Wrck5E/eVpnYU6C1uK3locdRzA6OddTumnznYiKNoNsz
vHwRIPb+uoWyJmoYlJNGSDdl5Iv7BTT0bMsySghptfan1hfV1lTCd+XNihJaUGBQG/0Q640Gck+t
d5s8wRQdEZlczTnGvuYNq674r1hMFU5Tbu3hxbElsRb5HZNUzeG5Djpa4L5CBzSsJpxQAXy3HuNs
NYAQnx0LaEyTIGVynVlGNuTWW0E528YM3SHfpA==;
Date: 11-09-2026
From: Digital License Center
To: dave@doctor.nl2k.ab.ca
Cc: dave@doctor.nl2k.ab.ca
Subject: Microsoft Office 2024 – Get Your Lifetime License Today!
MIME-Version: 1.0
Content-Type: text/html
X-Spam_score: 11.0
X-Spam_score_int: 110
X-Spam_bar: +++++++++++
X-Spam_report: Spam detection software, running on the system "doctor.nl2k.ab.ca",
has identified this incoming email as possible spam. The original
message has been attached to this so you can view it or label
similar future email. If you have any questions, see
@@CONTACT_ADDRESS@@ for details.
Content preview: Office 2024 for Windows & Mac KeyMart MICROSOFT OFFICE 2024
· WINDOWS & MAC Work Smarter. Achieve More.
Content analysis details: (11.0 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
0.1 MISSING_MID Missing Message-Id: header
1.0 RCVD_IN_WSFF RBL: Received via a relay in will-spam-for-food.eu.org
[163.52.128.20 listed in will-spam-for-food.eu.org]
[163.52.128.20 listed in will-spam-for-food.eu.org]
[163.52.128.20 listed in will-spam-for-food.eu.org]
[163.52.128.20 listed in will-spam-for-food.eu.org]
[163.52.128.20 listed in will-spam-for-food.eu.org]
[163.52.128.20 listed in will-spam-for-food.eu.org]
[163.52.128.20 listed in will-spam-for-food.eu.org]
[163.52.128.20 listed in will-spam-for-food.eu.org]
1.5 RCVD_IN_AHBL RBL: AHBL: sender is listed in dnsbl.ahbl.org
[163.52.128.20 listed in dnsbl.ahbl.org]
[163.52.128.20 listed in dnsbl.ahbl.org]
[163.52.128.20 listed in dnsbl.ahbl.org]
[163.52.128.20 listed in dnsbl.ahbl.org]
1.5 RCVD_IN_AHBL_SPAM RBL: AHBL: Spam Source in dnsbl.ahbl.org
[163.52.128.20 listed in dnsbl.ahbl.org]
0.0 RCVD_IN_AHBL_RTB RBL: AHBL: Real-Time Blocked in dnsbl.ahbl.org
[163.52.128.20 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_PROXY RBL: AHBL: Open Proxy server in dnsbl.ahbl.org
[163.52.128.20 listed in dnsbl.ahbl.org]
0.5 RCVD_IN_AHBL_SMTP RBL: AHBL: Open SMTP relay in dnsbl.ahbl.org
[163.52.128.20 listed in dnsbl.ahbl.org]
0.6 INVALID_DATE_TZ_ABSURD Invalid Date: header (timezone does not exist)
1.4 BUG6152_INVALID_DATE_TZ_ABSURD No description available.
0.4 INVALID_DATE Invalid Date: header (not RFC 2822)
-2.0 RCVD_IN_RP_SAFE RBL: Sender in ReturnPath Safe - Contact
safe-sa@returnpath.net
[Excessive Number of Queries |
-3.0 RCVD_IN_RP_CERTIFIED RBL: Sender in ReturnPath Certified - Contact
cert-sa@returnpath.net
[Excessive Number of Queries |
1.9 URIBL_JP_SURBL Contains an URL listed in the JP SURBL blocklist
[URI: 89.252.175.132]
1.9 URIBL_ABUSE_SURBL Contains an URL listed in the ABUSE SURBL blocklist
[URI: 89.252.175.132]
1.3 RCVD_IN_RP_RNBL RBL: Relay in RNBL,
https://senderscore.org/blacklistlookup/
[163.52.128.20 listed in bl.score.senderscore.com]
0.0 NORMAL_HTTP_TO_IP URI: URI host has a public dotted-decimal IPv4
address
0.0 HTML_MESSAGE BODY: HTML included in message
0.0 HTML_FONT_SIZE_HUGE BODY: HTML font size is huge
1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts
1.3 RDNS_NONE Delivered to internal network by a host with no rDNS
0.0 T_DKIM_INVALID DKIM-Signature header exists but is not valid
0.3 MIME_8BIT_HEADER Message header contains 8-bit character
0.4 TO_EQ_FM_DIRECT_MX To == From and direct-to-MX
0.0 TO_EQ_FM_DOM_HTML_ONLY To domain == From domain and HTML only
0.0 TO_EQ_FM_HTML_DIRECT To == From and HTML only, direct-to-MX
0.0 T_FILL_THIS_FORM_SHORT Fill in a short form with personal information
Subject: {SPAM?} Microsoft Office 2024 – Get Your Lifetime License Today!
KeyMart | ||||
MICROSOFT OFFICE 2024 · WINDOWS & MAC
| ||||
Microsoft Office 2024 WINDOWS & MAC · LIFETIME LICENSE Windows — Select Your License 30 PC – Lifetime ▾ 1 PC – Lifetime $35.00 2 PC – Lifetime 3 PC – Lifetime 5 PC – Lifetime 10 PC – Lifetime 20 PC – Lifetime 30 PC – Lifetime $170.00 Intermediate package prices are displayed on the product page. Select your preferred Windows quantity before checkout. href="http://89.252.175.132/4liDzP3464QWsd123xsdkdjrmoa71AHTEYONTNKLMTKA116283GERM628d1"> CHOOSE YOUR WINDOWS LICENSE →
| ||||
MAC EDITION Office Home & Business 2024 for Mac
One-time price $140.00 1 Mac · Lifetime license href="http://89.252.175.132/4kPJnV3464riyI123bweqnbegnv71TESOOZFXPRDQSXO116283DCUP628H1"> GET THE MAC LICENSE →
| ||||
| ||||
Your Essential Office Applications Word Excel PowerPoint Outlook OneNote Access* Publisher* Teams*
| ||||
Fast & Convenient Digital Delivery
| ||||
Ready to Upgrade?
href="http://89.252.175.132/4Tfmyh3464vCGw123jekuvihniq71FGQJSCETSHFNAWC116283WAWS628a1"> SHOP WINDOWS href="http://89.252.175.132/4SuqMu3464QSKq123tkpjeourkr71KLNBLOFFPAHTTJP116283CULM628U1"> SHOP MAC | ||||
KeyMart Genuine Digital Software Licenses Need assistance? support@keymart.net Windows and Mac editions are licensed and sold separately. Microsoft and Office are trademarks of Microsoft Corporation. KeyMart is an independent retailer and is not affiliated with or endorsed by Microsoft. You are receiving this email because you subscribed to our updates. Unsubscribe | Visit KeyMart © 2026 KeyMart. All rights reserved. |